feat(admin): add device credential isolation

AGENTS.md

@@ -10,7 +10,8 @@ cmbuyer 是一个自动化采购系统：**采购服务**（网页端，`admin/`
 
 **系统只创建待付款订单，任何情况下都不自动付款。**
 
-当前状态：仓库只有文档，尚未开始编码。阶段为 Phase 0。
+当前状态：两端骨架、基础模型、登录和真机取证脚手架已落地；Phase 1 真机取证与不依赖页面判据的
+Phase 2 服务端任务并行。实时快照见 [`docs/current-state.md`](docs/current-state.md)。
 
 ## 必读顺序
 
@@ -33,7 +34,9 @@ cmbuyer 是一个自动化采购系统：**采购服务**（网页端，`admin/`
 系统**会**点击「提交订单」创建待付款订单，但必须满足四个前置条件（授权未消费且服务端
 提交围栏已建立、闸门二通过、闸门三通过、控件唯一），且**只点一次**、点击后无论结果
 都不重试。围栏申请失败或响应不明时不得点击；围栏建立后只能调和同一提交记录。
-**第一趟试选的代码路径不得引用任何下单函数**，必须有测试证明不可达。
+管理员点击“开始采购（只创建待付款订单）”是唯一的人类授权动作。T-103 的规格选择/读价隔离
+验证路径不得引用数量、确认页、提交或付款函数；后续能力必须按真机取证任务逐段开放，并有静态
+调用链测试证明未获准能力不可达。
 
 ### 2. 安全边界只能收紧
 
@@ -141,8 +144,8 @@ python scripts/validate_agent_context.py
 
 **跨端契约改动必跑完整门禁**——两端会同时坏。
 
-代码尚未初始化，上述命令在 T-001 / T-002 完成前不可运行；届时由对应任务替换为真实命令
-并同步文档。
+两端已初始化；跨端契约改动还需在仓库根运行 `./init.ps1`（或 `./init.sh`）完成安装、测试、
+vet/build、compileall 和上下文门禁。
 
 ## 风格
 

README.md

@@ -8,13 +8,14 @@
 ## 它做什么
 
 一笔外部订单进来，采购人员需要去拼多多找到同款、选对颜色尺码、下单、把订单号抄回系统。
-cmbuyer 把这个过程自动化，人只在两个点介入：**机器选对了吗**和**付不付款**。
+cmbuyer 把这个过程自动化：管理员明确“买什么、买多少、最多多少钱”并点击开始采购，系统只
+创建待付款订单，**是否付款始终由人决定**。
 
 ```text
 手工填链接（MVP）  ／  Excel · ERP（V2）
             │
             v
- 采购服务（admin/，Go）  建单 · 试选确认 · 下单授权 · 审计
+ 采购服务（admin/，Go）  建单 · 开始采购授权 · 围栏 · 审计
             │  HTTP
             v
 采购工具（client/，Python）  领任务 · 跑流程 · 回传
@@ -23,31 +24,22 @@ cmbuyer 把这个过程自动化，人只在两个点介入：**机器选对了
    Android 手机（拼多多 App）
 ```
 
-## 两趟执行
+## 单趟执行
 
-MVP 只做**任务自带商品链接**的情形，分两趟跑完：
+MVP 只做**任务自带商品链接**的情形：管理员先把任务保存为 `DRAFT`，再在表格中勾选并点击
+“开始采购（只创建待付款订单）”。该点击创建一次性授权，锁定商品、颜色、尺码、数量和最高总价。
 
-| 趟次 | 做什么 |
-| --- | --- |
-| **第一趟 · 试选** | 开商品 → 精确勾选颜色分类和尺码 → 读单价 → 截图 → **退出释放手机** → 回传 |
-| **人工确认** | 人在网页端看「机器选对了吗」→ 确认并**锁定单价** |
-| **第二趟 · 下单** | 重新开商品 → 重新选同一规格 → **三道价格闸门** → 提交订单一次 → 转「待付款」 |
-
-为什么分两趟：一台手机是瓶颈，不能停在规格面板上等人。代价是走两遍，换来手机不空闲，
-且第二趟能抓住价格变动。
-
-**三道价格闸门**：① 第一趟规格面板读价 ② 第二趟重读必须与授权价一致
-③ 订单确认页「实付款」不超上限。任一道读不到或不通过即停，转人工。
+采购工具领取后在同一次设备会话中完成：打开商品 → 精确选择规格 → 闸门一读 SKU 单价并校验
+上限 → 设置并复核数量 → 闸门二重读规格与同价 → 进入确认页 → 闸门三校验应付总额 → 服务端
+原子建立提交围栏 → 精确点击一次“提交订单” → 转待付款。中间不再回网页端等“机器选对了吗”。
 
 价格**只在规格面板和订单确认页读**——别处的价格文本被拆成多个节点、带券后前缀、
 实付价与原价混在一起，不可靠。
 
 ## 现在处于什么阶段
 
-**Phase 0 · 地基。仓库目前只有文档，尚未开始编码。**
-
-下一步：T-005（网页端 MVP 原型）与 T-006（桌面端 MVP 原型）的文件和自动检查已完成，
-请先人工确认 6 个 HTML 原型，再进入 T-001 / T-002 骨架和生产实现。
+**Phase 1 真机取证与 Phase 2 的安全服务端工作并行。** 两端骨架、基础模型、登录和真机基线已
+落地；T-111 正在冻结单趟采购契约，T-103 随后继续规格精确选择与读价，T-202 等待主审合入。
 详见 [`docs/current-state.md`](docs/current-state.md)。
 
 **生死线是 M2**：真机能按链接打开商品、精确勾选颜色分类和尺码、**读到该 SKU 单价**。
@@ -74,7 +66,7 @@ MVP 只做**任务自带商品链接**的情形，分两趟跑完：
 4. 规格按维度精确匹配，防前缀碰撞，找不到即停
 5. 数量设置后必须读回复核
 6. **三道价格闸门**，任一道读不到或不通过即停
-7. **第一趟绝不下单**——试选路径不得引用下单函数
+7. **能力分层**——T-103 规格验证路径不得引用数量、确认页或下单函数；后续能力逐段取证
 8. 检测到外部支付交接立即停止，不读取不保存凭据
 9. 检测到验证码 / 风控 / 人脸 / 短信校验立即停止，不绕过
 10. 只读非敏感摘要，不提取收货地址原文、手机号、支付凭据

admin/README.md

@@ -0,0 +1,64 @@
+# 采购服务
+
+启动前必须显式设置下列环境变量；服务不提供默认管理员账号、密码或会话密钥。
+
+| 变量 | 要求 |
+| --- | --- |
+| `CMBUYER_ADMIN_USERNAME` | 非空管理员账号。 |
+| `CMBUYER_ADMIN_PASSWORD_BCRYPT` | 非空 bcrypt 密码哈希，不接受明文密码。 |
+| `CMBUYER_SESSION_SECRET` | 至少 32 字节的会话签名密钥。 |
+| `CMBUYER_COOKIE_SECURE` | 可选；存在时只能精确为 `true` 或 `false`。HTTPS 部署应设为 `true`。 |
+| `CMBUYER_DATABASE_SOURCE` | 已迁移 SQLite 的显式 data source。 |
+| `CMBUYER_AUTHORIZATION_TTL` | 一次性授权的正 Go duration，例如 `10m`。 |
+| `CMBUYER_MAX_TASK_QUANTITY` | 每条任务允许的正整数数量上限。 |
+| `CMBUYER_MAX_TOTAL_PRICE` | 每条任务允许的规范正数总价上限，例如 `999.99`。 |
+| `CMBUYER_EVIDENCE_DIR` | 内部原始截图的绝对私有目录；不得指向仓库或公开静态目录。 |
+
+示例仅展示变量名，不提供可运行凭据：
+
+```powershell
+$env:CMBUYER_ADMIN_USERNAME = '<管理员账号>'
+$env:CMBUYER_ADMIN_PASSWORD_BCRYPT = '<bcrypt 密码哈希>'
+$env:CMBUYER_SESSION_SECRET = '<至少 32 字节的随机密钥>'
+$env:CMBUYER_COOKIE_SECURE = 'true'
+$env:CMBUYER_DATABASE_SOURCE = '<SQLite data source>'
+$env:CMBUYER_AUTHORIZATION_TTL = '10m'
+$env:CMBUYER_MAX_TASK_QUANTITY = '99'
+$env:CMBUYER_MAX_TOTAL_PRICE = '999.99'
+$env:CMBUYER_EVIDENCE_DIR = '<内部截图绝对目录>'
+go run ./cmd/migrate -database $env:CMBUYER_DATABASE_SOURCE up
+go run ./cmd/server
+```
+
+MVP 服务固定绑定 IPv4 回环 `127.0.0.1:8080`，只供同一运营电脑上的采购服务和采购工具使用。不要把监听地址
+改成 `0.0.0.0` 或局域网地址；未来若需要非回环访问，必须先单独建立并验收 HTTPS/TLS 终止与代理
+信任边界，设备 Bearer 不得经过明文局域网。
+
+数据库迁移完成后，用同一个显式 SQLite data source 管理设备凭据：
+
+```powershell
+# 签发：token 只在本次成功输出中显示一次，请立即放入采购工具的受控本机配置。
+go run ./cmd/device-credentials -database $env:CMBUYER_DATABASE_SOURCE issue -name '<非秘密设备名称>'
+
+# 仅显示设备 id、名称、状态和时间，不显示 token/hash。
+go run ./cmd/device-credentials -database $env:CMBUYER_DATABASE_SOURCE list
+
+# 撤销立即影响之后开始的每次设备请求；重复执行保持 REVOKED，不恢复旧 token。
+go run ./cmd/device-credentials -database $env:CMBUYER_DATABASE_SOURCE revoke -device-id '<签发时的设备UUID>'
+```
+
+该 CLI 只接受已存在、已迁移的文件型 SQLite 普通路径或 `file:` URI，并强制以 `mode=rw` 打开；
+路径拼错或文件缺失时 SQLite 原子拒绝且不会留下空数据库，也不接受内存、只读或可创建模式。CLI
+不自动迁移。签发 token 是 32 字节加密随机值的 64 位小写十六进制表示；
+SQLite 只保存原始 token 的 32 字节 SHA-256 BLOB。签发输出以外的 list/revoke、日志、错误和 HTTP
+响应都不会显示 token 或 hash。
+
+采购服务会话仅保存在当前进程内；进程重启后既有登录会话会安全失效。
+管理员的“开始采购（只创建待付款订单）”只签发一次性授权并创建待付款订单的资格；服务不会自动付款，也不包含任何支付操作。
+
+`GET /tasks/{id}` 直接访问时渲染完整详情页，任务列表以同一 URL 加载详情抽屉。内部截图只通过
+`GET /evidence/{asset_id}` 向有效管理员会话提供，并始终返回 `no-store`；文件不在静态目录中。
+
+`POST /api/v1/tasks/{id}/evidence` 使用 `Authorization: Bearer <token>` 和
+`X-CMBuyer-Device-ID: <小写UUIDv4>` 逐请求查库认证；管理员会话不能代替设备身份。凭据错误统一空
+401，SQLite 认证故障为空 503，且两者都发生在上传 body 被读取之前。

admin/cmd/device-credentials/main.go

@@ -0,0 +1,200 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"flag"
+	"fmt"
+	"io"
+	"log"
+	"net/url"
+	"os"
+	"path/filepath"
+	"strings"
+	"time"
+
+	"cmbuyer/admin/internal/deviceauth"
+	"cmbuyer/admin/internal/storage/sqlite"
+)
+
+func main() {
+	if err := run(context.Background(), os.Args[1:], os.Stdout, os.Stderr); err != nil {
+		log.Print(err)
+		os.Exit(1)
+	}
+}
+
+func run(ctx context.Context, args []string, stdout, stderr io.Writer) error {
+	flags := flag.NewFlagSet("device-credentials", flag.ContinueOnError)
+	flags.SetOutput(stderr)
+	databaseSource := flags.String("database", "", "explicit migrated SQLite data source")
+	if err := flags.Parse(args); err != nil {
+		return err
+	}
+	if *databaseSource == "" {
+		return errors.New("-database is required")
+	}
+	if flags.NArg() < 1 {
+		return errors.New("usage: device-credentials -database <sqlite-data-source> <issue|list|revoke> [options]")
+	}
+	command := flags.Arg(0)
+	commandArgs := flags.Args()[1:]
+	var issueName, revokeDeviceID string
+	switch command {
+	case "issue":
+		commandFlags := flag.NewFlagSet("issue", flag.ContinueOnError)
+		commandFlags.SetOutput(stderr)
+		commandFlags.StringVar(&issueName, "name", "", "non-secret device display name")
+		if err := commandFlags.Parse(commandArgs); err != nil {
+			return err
+		}
+		if issueName == "" || commandFlags.NArg() != 0 {
+			return errors.New("usage: device-credentials -database <sqlite-data-source> issue -name <display-name>")
+		}
+	case "list":
+		if len(commandArgs) != 0 {
+			return errors.New("usage: device-credentials -database <sqlite-data-source> list")
+		}
+	case "revoke":
+		commandFlags := flag.NewFlagSet("revoke", flag.ContinueOnError)
+		commandFlags.SetOutput(stderr)
+		commandFlags.StringVar(&revokeDeviceID, "device-id", "", "canonical device UUID")
+		if err := commandFlags.Parse(commandArgs); err != nil {
+			return err
+		}
+		if revokeDeviceID == "" || commandFlags.NArg() != 0 {
+			return errors.New("usage: device-credentials -database <sqlite-data-source> revoke -device-id <uuid>")
+		}
+	default:
+		return fmt.Errorf("unsupported device credential command %q", command)
+	}
+	if command == "issue" && !deviceauth.ValidDisplayName(issueName) {
+		return deviceauth.ErrInvalidCredential
+	}
+	if command == "revoke" && !deviceauth.ValidDeviceID(revokeDeviceID) {
+		return deviceauth.ErrInvalidCredential
+	}
+
+	existingSource, err := existingSQLiteDataSource(*databaseSource)
+	if err != nil {
+		return err
+	}
+	database, err := sqlite.Open(existingSource)
+	if err != nil {
+		return fmt.Errorf("open SQLite database: %w", err)
+	}
+	defer database.Close()
+	store, err := deviceauth.NewCredentialStore(database)
+	if err != nil {
+		return err
+	}
+
+	switch command {
+	case "issue":
+		issued, err := store.Issue(ctx, issueName)
+		if err != nil {
+			return err
+		}
+		// The token has json:"-" and is printed only by this explicit post-commit path. Generic
+		// serialization, list, revoke, errors, and server responses therefore cannot disclose it.
+		if _, err := fmt.Fprintf(stdout, "device_id=%s\ndisplay_name=%s\ntoken=%s\ncreated_at=%s\n",
+			issued.DeviceID, issued.DisplayName, issued.Token, issued.CreatedAt.Format(time.RFC3339Nano)); err != nil {
+			return errors.New("write issued device credential")
+		}
+		return nil
+	case "list":
+		credentials, err := store.List(ctx)
+		if err != nil {
+			return err
+		}
+		return writeJSON(stdout, credentials)
+	case "revoke":
+		credential, changed, err := store.Revoke(ctx, revokeDeviceID)
+		if err != nil {
+			return err
+		}
+		return writeJSON(stdout, struct {
+			Credential deviceauth.Credential `json:"credential"`
+			RevokedNow bool                  `json:"revoked_now"`
+		}{Credential: credential, RevokedNow: changed})
+	}
+	return errors.New("unreachable device credential command")
+}
+
+func existingSQLiteDataSource(value string) (string, error) {
+	if value == "" || strings.TrimSpace(value) != value {
+		return "", errors.New("-database must name an existing file-backed SQLite database")
+	}
+
+	var parsed *url.URL
+	var query url.Values
+	if strings.HasPrefix(strings.ToLower(value), "file:") {
+		var err error
+		parsed, err = url.Parse(value)
+		if err != nil || !strings.EqualFold(parsed.Scheme, "file") || parsed.User != nil || parsed.Host != "" || parsed.Fragment != "" {
+			return "", errors.New("-database file URI is invalid")
+		}
+		// go-sqlite3 recognizes URI filenames only with the exact lowercase file: prefix.
+		// Canonicalize accepted scheme casing before mode=rw reaches the driver, otherwise a
+		// mixed-case input could be treated as a plain filename and recreate a missing database.
+		parsed.Scheme = "file"
+		query, err = url.ParseQuery(parsed.RawQuery)
+		if err != nil {
+			return "", errors.New("-database query parameters are invalid")
+		}
+		fileName := parsed.Path
+		if parsed.Opaque != "" {
+			fileName = parsed.Opaque
+		}
+		decodedName, err := url.PathUnescape(fileName)
+		if err != nil || fileName == "" || strings.EqualFold(decodedName, ":memory:") {
+			return "", errors.New("-database must name an existing file-backed SQLite database")
+		}
+	} else {
+		pathPart, rawQuery, hasQuery := strings.Cut(value, "?")
+		if pathPart == "" || strings.EqualFold(pathPart, ":memory:") || strings.Contains(pathPart, "://") {
+			return "", errors.New("-database must name an existing file-backed SQLite database")
+		}
+		var err error
+		query, err = url.ParseQuery(rawQuery)
+		if err != nil {
+			return "", errors.New("-database query parameters are invalid")
+		}
+		normalizedPath := filepath.ToSlash(pathPart)
+		if filepath.VolumeName(pathPart) != "" && !strings.HasPrefix(normalizedPath, "/") {
+			normalizedPath = "/" + normalizedPath
+		}
+		parsed = &url.URL{Scheme: "file", Path: normalizedPath}
+		if !hasQuery {
+			query = make(url.Values)
+		}
+	}
+
+	modes := query["mode"]
+	if len(modes) > 1 || len(modes) == 1 && modes[0] != "rw" {
+		return "", errors.New("-database only permits SQLite mode=rw")
+	}
+	if len(modes) == 0 {
+		query.Set("mode", "rw")
+	}
+	for _, name := range []string{"immutable", "_query_only"} {
+		for _, setting := range query[name] {
+			if setting != "0" && !strings.EqualFold(setting, "false") {
+				return "", errors.New("-database contains a read-only SQLite option")
+			}
+		}
+	}
+	parsed.RawQuery = query.Encode()
+	parsed.ForceQuery = false
+	return parsed.String(), nil
+}
+
+func writeJSON(writer io.Writer, value any) error {
+	encoder := json.NewEncoder(writer)
+	encoder.SetEscapeHTML(true)
+	if err := encoder.Encode(value); err != nil {
+		return errors.New("write device credential metadata")
+	}
+	return nil
+}

admin/cmd/device-credentials/main_test.go

@@ -0,0 +1,293 @@
+package main
+
+import (
+	"bytes"
+	"context"
+	"database/sql"
+	"errors"
+	"io"
+	"net/url"
+	"os"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"testing"
+
+	"cmbuyer/admin/internal/deviceauth"
+	"cmbuyer/admin/internal/migrations"
+	"cmbuyer/admin/internal/storage/sqlite"
+)
+
+func TestIssueListAndIdempotentRevokeNeverRediscloseSecret(t *testing.T) {
+	databaseSource := migratedDatabase(t)
+	var issued bytes.Buffer
+	if err := run(context.Background(), []string{"-database", databaseSource, "issue", "-name", "采购工具一号"}, &issued, io.Discard); err != nil {
+		t.Fatalf("issue: %v", err)
+	}
+	fields := outputFields(t, issued.String())
+	deviceID, token := fields["device_id"], fields["token"]
+	if len(token) != 64 || strings.Count(issued.String(), token) != 1 {
+		t.Fatalf("issue token occurrence/length = %d/%d", strings.Count(issued.String(), token), len(token))
+	}
+
+	var listed bytes.Buffer
+	if err := run(context.Background(), []string{"-database", databaseSource, "list"}, &listed, io.Discard); err != nil {
+		t.Fatalf("list: %v", err)
+	}
+	assertNoSecretMetadata(t, listed.String(), token)
+	if !strings.Contains(listed.String(), deviceID) || !strings.Contains(listed.String(), "采购工具一号") {
+		t.Fatalf("list omitted safe metadata: %s", listed.String())
+	}
+
+	var revoked bytes.Buffer
+	if err := run(context.Background(), []string{"-database", databaseSource, "revoke", "-device-id", deviceID}, &revoked, io.Discard); err != nil {
+		t.Fatalf("revoke: %v", err)
+	}
+	assertNoSecretMetadata(t, revoked.String(), token)
+	if !strings.Contains(revoked.String(), `"revoked_now":true`) {
+		t.Fatalf("first revoke output = %s", revoked.String())
+	}
+	var repeated bytes.Buffer
+	if err := run(context.Background(), []string{"-database", databaseSource, "revoke", "-device-id", deviceID}, &repeated, io.Discard); err != nil {
+		t.Fatalf("repeat revoke: %v", err)
+	}
+	assertNoSecretMetadata(t, repeated.String(), token)
+	if !strings.Contains(repeated.String(), `"revoked_now":false`) {
+		t.Fatalf("repeat revoke output = %s", repeated.String())
+	}
+}
+
+func TestIssueOutputFailureLeavesCommittedCredentialWithoutSecretInError(t *testing.T) {
+	databaseSource := migratedDatabase(t)
+	writer := &recordingFailureWriter{}
+	err := run(context.Background(), []string{"-database", databaseSource, "issue", "-name", "output failure"}, writer, io.Discard)
+	if err == nil || err.Error() != "write issued device credential" {
+		t.Fatalf("issue output failure error = %v", err)
+	}
+	fields := outputFields(t, writer.contents.String())
+	if strings.Contains(err.Error(), fields["token"]) {
+		t.Fatal("output error disclosed token")
+	}
+	database, err := sql.Open("sqlite3", databaseSource)
+	if err != nil {
+		t.Fatalf("open database: %v", err)
+	}
+	defer database.Close()
+	var count int
+	if err := database.QueryRow(`SELECT COUNT(*) FROM device_credentials`).Scan(&count); err != nil || count != 1 {
+		t.Fatalf("committed credential count = %d, err=%v", count, err)
+	}
+}
+
+func TestCLIRequiresPreMigratedExplicitDatabase(t *testing.T) {
+	if err := run(context.Background(), []string{"list"}, io.Discard, io.Discard); err == nil {
+		t.Fatal("command without -database succeeded")
+	}
+	missing := filepath.Join(t.TempDir(), "missing.db")
+	if err := run(context.Background(), []string{"-database", missing, "list"}, io.Discard, io.Discard); err == nil {
+		t.Fatal("list opened a missing database")
+	}
+	if _, err := os.Stat(missing); !errors.Is(err, os.ErrNotExist) {
+		t.Fatalf("missing database was created: %v", err)
+	}
+
+	unmigrated := filepath.Join(t.TempDir(), "unmigrated.db")
+	unmigratedDatabase, err := sqlite.Open(unmigrated)
+	if err != nil {
+		t.Fatalf("create unmigrated database: %v", err)
+	}
+	if _, err := unmigratedDatabase.Exec(`CREATE TABLE unrelated (id INTEGER)`); err != nil {
+		_ = unmigratedDatabase.Close()
+		t.Fatalf("initialize unmigrated database: %v", err)
+	}
+	if err := unmigratedDatabase.Close(); err != nil {
+		t.Fatalf("close unmigrated database: %v", err)
+	}
+	if err := run(context.Background(), []string{"-database", unmigrated, "list"}, io.Discard, io.Discard); err == nil {
+		t.Fatal("list accepted an unmigrated database")
+	}
+	database, err := sql.Open("sqlite3", unmigrated)
+	if err != nil {
+		t.Fatalf("open unmigrated database: %v", err)
+	}
+	defer database.Close()
+	var count int
+	if err := database.QueryRow(`SELECT COUNT(*) FROM sqlite_master WHERE type='table' AND name='device_credentials'`).Scan(&count); err != nil || count != 0 {
+		t.Fatalf("device_credentials table count = %d, err=%v", count, err)
+	}
+
+	undeclared := filepath.Join(t.TempDir(), "undeclared.db")
+	if err := run(context.Background(), []string{"-database", undeclared, "rotate"}, io.Discard, io.Discard); err == nil {
+		t.Fatal("undeclared command succeeded")
+	}
+	if _, err := os.Stat(undeclared); !errors.Is(err, os.ErrNotExist) {
+		t.Fatalf("undeclared command opened database: %v", err)
+	}
+
+	invalidIssue := filepath.Join(t.TempDir(), "invalid-issue.db")
+	if err := run(context.Background(), []string{"-database", invalidIssue, "issue", "-name", " padded"}, io.Discard, io.Discard); !errors.Is(err, deviceauth.ErrInvalidCredential) {
+		t.Fatalf("invalid issue error = %v", err)
+	}
+	if _, err := os.Stat(invalidIssue); !errors.Is(err, os.ErrNotExist) {
+		t.Fatalf("invalid issue opened database: %v", err)
+	}
+
+	invalidRevoke := filepath.Join(t.TempDir(), "invalid-revoke.db")
+	if err := run(context.Background(), []string{"-database", invalidRevoke, "revoke", "-device-id", "not-a-uuid"}, io.Discard, io.Discard); !errors.Is(err, deviceauth.ErrInvalidCredential) {
+		t.Fatalf("invalid revoke error = %v", err)
+	}
+	if _, err := os.Stat(invalidRevoke); !errors.Is(err, os.ErrNotExist) {
+		t.Fatalf("invalid revoke opened database: %v", err)
+	}
+
+	migrated := migratedDatabase(t)
+	unknownID := "13c9f507-7473-4fa6-8d71-8786c34c6301"
+	var unknownOutput bytes.Buffer
+	err = run(context.Background(), []string{"-database", migrated, "revoke", "-device-id", unknownID}, &unknownOutput, io.Discard)
+	if !errors.Is(err, deviceauth.ErrCredentialNotFound) || unknownOutput.Len() != 0 || strings.Contains(err.Error(), unknownID) {
+		t.Fatalf("unknown revoke = output %q, error %v", unknownOutput.String(), err)
+	}
+}
+
+func TestExistingSQLiteDataSourcePreservesSafeOptionsAndRejectsCreationModes(t *testing.T) {
+	databaseSource := migratedDatabase(t)
+	fileURI := (&url.URL{
+		Scheme:   "file",
+		Path:     sqliteURIPath(databaseSource),
+		RawQuery: "_busy_timeout=5000&cache=shared",
+	}).String()
+	normalized, err := existingSQLiteDataSource(fileURI)
+	if err != nil {
+		t.Fatalf("normalize file URI: %v", err)
+	}
+	parsed, err := url.Parse(normalized)
+	if err != nil {
+		t.Fatalf("parse normalized URI: %v", err)
+	}
+	query := parsed.Query()
+	if query.Get("mode") != "rw" || query.Get("_busy_timeout") != "5000" || query.Get("cache") != "shared" {
+		t.Fatalf("normalized query = %v", query)
+	}
+	if err := run(context.Background(), []string{"-database", fileURI, "list"}, io.Discard, io.Discard); err != nil {
+		t.Fatalf("list existing file URI: %v", err)
+	}
+
+	plainNormalized, err := existingSQLiteDataSource(databaseSource + "?_foreign_keys=on")
+	if err != nil {
+		t.Fatalf("normalize ordinary path: %v", err)
+	}
+	plainURI, err := url.Parse(plainNormalized)
+	if err != nil || plainURI.Scheme != "file" || plainURI.Query().Get("mode") != "rw" || plainURI.Query().Get("_foreign_keys") != "on" {
+		t.Fatalf("ordinary path normalization = %q, err=%v", plainNormalized, err)
+	}
+
+	missing := filepath.Join(t.TempDir(), "missing-uri.db")
+	missingURI := (&url.URL{Scheme: "file", Path: sqliteURIPath(missing)}).String()
+	if err := run(context.Background(), []string{"-database", missingURI, "list"}, io.Discard, io.Discard); err == nil {
+		t.Fatal("missing file URI succeeded")
+	}
+	if _, err := os.Stat(missing); !errors.Is(err, os.ErrNotExist) {
+		t.Fatalf("missing file URI created a file: %v", err)
+	}
+	for _, scheme := range []string{"FILE", "File"} {
+		mixedMissing := filepath.Join(t.TempDir(), strings.ToLower(scheme)+"-missing.db")
+		canonical := (&url.URL{Scheme: "file", Path: sqliteURIPath(mixedMissing)}).String()
+		mixedURI := scheme + canonical[len("file"):]
+		normalized, err := existingSQLiteDataSource(mixedURI)
+		if err != nil || !strings.HasPrefix(normalized, "file:") {
+			t.Fatalf("normalize %s URI = %q, err=%v", scheme, normalized, err)
+		}
+		if err := run(context.Background(), []string{"-database", mixedURI, "list"}, io.Discard, io.Discard); err == nil {
+			t.Fatalf("missing %s URI succeeded", scheme)
+		}
+		if _, err := os.Stat(mixedMissing); !errors.Is(err, os.ErrNotExist) {
+			t.Fatalf("missing %s URI created a file: %v", scheme, err)
+		}
+	}
+
+	for name, source := range map[string]string{
+		"plain memory":     ":memory:",
+		"URI memory":       "file::memory:?cache=shared",
+		"memory mode":      fileURI + "&mode=memory",
+		"read only mode":   fileURI + "&mode=ro",
+		"create mode":      fileURI + "&mode=rwc",
+		"duplicate mode":   fileURI + "&mode=rw&mode=rw",
+		"immutable":        fileURI + "&immutable=1",
+		"query only":       fileURI + "&_query_only=1",
+		"remote authority": "file://server/share/database.db?mode=rw",
+	} {
+		t.Run(name, func(t *testing.T) {
+			if _, err := existingSQLiteDataSource(source); err == nil {
+				t.Fatalf("unsafe source accepted: %q", source)
+			}
+		})
+	}
+}
+
+func sqliteURIPath(path string) string {
+	normalized := filepath.ToSlash(path)
+	if filepath.VolumeName(path) != "" && !strings.HasPrefix(normalized, "/") {
+		return "/" + normalized
+	}
+	return normalized
+}
+
+type recordingFailureWriter struct {
+	contents bytes.Buffer
+}
+
+func (writer *recordingFailureWriter) Write(value []byte) (int, error) {
+	_, _ = writer.contents.Write(value)
+	return 0, errors.New("injected stdout failure")
+}
+
+func assertNoSecretMetadata(t *testing.T, output, token string) {
+	t.Helper()
+	if strings.Contains(output, token) || strings.Contains(output, "token") || strings.Contains(output, "hash") || strings.Contains(output, "sha256") {
+		t.Fatalf("metadata output disclosed secret material: %s", output)
+	}
+}
+
+func outputFields(t *testing.T, output string) map[string]string {
+	t.Helper()
+	fields := make(map[string]string)
+	for _, line := range strings.Split(strings.TrimSpace(output), "\n") {
+		name, value, found := strings.Cut(line, "=")
+		if !found || name == "" || value == "" {
+			t.Fatalf("invalid issue output line %q", line)
+		}
+		fields[name] = value
+	}
+	for _, required := range []string{"device_id", "display_name", "token", "created_at"} {
+		if fields[required] == "" {
+			t.Fatalf("issue output missing %s: %q", required, output)
+		}
+	}
+	return fields
+}
+
+func migratedDatabase(t *testing.T) string {
+	t.Helper()
+	databaseSource := filepath.Join(t.TempDir(), "credentials.db")
+	database, err := sqlite.Open(databaseSource)
+	if err != nil {
+		t.Fatalf("open database: %v", err)
+	}
+	if err := migrations.Up(context.Background(), database, commandMigrationDirectory(t)); err != nil {
+		_ = database.Close()
+		t.Fatalf("migrate database: %v", err)
+	}
+	if err := database.Close(); err != nil {
+		t.Fatalf("close migrated database: %v", err)
+	}
+	return databaseSource
+}
+
+func commandMigrationDirectory(t *testing.T) string {
+	t.Helper()
+	_, file, _, ok := runtime.Caller(0)
+	if !ok {
+		t.Fatal("locate migrations")
+	}
+	return filepath.Join(filepath.Dir(file), "..", "..", "migrations")
+}

admin/cmd/server/main.go

@@ -5,10 +5,19 @@ import (
 	"log"
 	"net/http"
 
+	"cmbuyer/admin/internal/auth"
+	"cmbuyer/admin/internal/config"
+	"cmbuyer/admin/internal/deviceauth"
 	"cmbuyer/admin/internal/server"
+	evidencestorage "cmbuyer/admin/internal/storage/evidence"
+	"cmbuyer/admin/internal/storage/sqlite"
+	"cmbuyer/admin/internal/taskdetail"
+	"cmbuyer/admin/internal/tasks"
 )
 
-const listenAddress = ":8080"
+// Device Bearer credentials must not cross a plaintext LAN. The MVP is a same-computer
+// deployment, so widening this address requires a separately reviewed TLS boundary first.
+const listenAddress = "127.0.0.1:8080"
 
 func main() {
 	if err := run(); err != nil {
@@ -17,7 +26,47 @@ func main() {
 }
 
 func run() error {
-	err := http.ListenAndServe(listenAddress, server.NewRouter())
+	configuration, err := config.LoadFromEnv()
+	if err != nil {
+		return err
+	}
+	database, err := sqlite.Open(configuration.DatabaseSource)
+	if err != nil {
+		return err
+	}
+	defer database.Close()
+	taskStore, err := tasks.NewSQLiteStore(database)
+	if err != nil {
+		return err
+	}
+	taskStore.SetStartPolicy(tasks.StartPolicy{AuthorizationTTL: configuration.AuthorizationTTL, MaxQuantity: configuration.MaxTaskQuantity, MaxTotalPrice: configuration.MaxTotalPrice})
+	detailStore, err := taskdetail.NewSQLiteStore(database)
+	if err != nil {
+		return err
+	}
+	evidenceStore, err := evidencestorage.NewStore(database, configuration.EvidenceDirectory)
+	if err != nil {
+		return err
+	}
+	deviceAuthenticator, err := deviceauth.NewSQLiteAuthenticator(database)
+	if err != nil {
+		return err
+	}
+
+	router, err := server.NewRouter(server.Options{
+		AdminUsername:       configuration.AdminUsername,
+		AdminPasswordBcrypt: configuration.AdminPasswordBcrypt,
+		Sessions:            auth.NewManager(configuration.SessionSecret, configuration.CookieSecure),
+		Tasks:               taskStore,
+		TaskDetails:         detailStore,
+		Evidence:            evidenceStore,
+		DeviceAuthenticator: deviceAuthenticator,
+	})
+	if err != nil {
+		return err
+	}
+
+	err = http.ListenAndServe(listenAddress, router)
 	if errors.Is(err, http.ErrServerClosed) {
 		return nil
 	}

admin/cmd/server/main_test.go

@@ -0,0 +1,9 @@
+package main
+
+import "testing"
+
+func TestListenAddressIsIPv4LoopbackOnly(t *testing.T) {
+	if listenAddress != "127.0.0.1:8080" {
+		t.Fatalf("listenAddress = %q, want loopback-only endpoint", listenAddress)
+	}
+}

admin/go.mod

@@ -6,6 +6,7 @@ require (
 	github.com/gin-gonic/gin v1.11.0
 	github.com/mattn/go-sqlite3 v1.14.49
 	github.com/pressly/goose/v3 v3.24.0
+	golang.org/x/crypto v0.40.0
 )
 
 require (
@@ -35,7 +36,6 @@ require (
 	go.uber.org/mock v0.5.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	golang.org/x/arch v0.20.0 // indirect
-	golang.org/x/crypto v0.40.0 // indirect
 	golang.org/x/mod v0.25.0 // indirect
 	golang.org/x/net v0.42.0 // indirect
 	golang.org/x/sync v0.16.0 // indirect

admin/internal/auth/session.go

@@ -0,0 +1,204 @@
+// Package auth 提供内存会话与 CSRF 防护。会话不落库，服务重启会安全地使所有登录失效。
+package auth
+
+import (
+	"crypto/hmac"
+	"crypto/rand"
+	"crypto/sha256"
+	"crypto/subtle"
+	"encoding/base64"
+	"io"
+	"net/http"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+)
+
+const (
+	CookieName        = "cmbuyer_session"
+	SessionLifetime   = 8 * time.Hour
+	csrfTokenByteSize = 32
+)
+
+type session struct {
+	csrfToken     string
+	authenticated bool
+	expiresAt     time.Time
+}
+
+// Manager 签发、验证并撤销进程内会话。cookie 仅承载经过 HMAC 签名的随机 session ID。
+type Manager struct {
+	secret       []byte
+	cookieSecure bool
+	now          func() time.Time
+	random       io.Reader
+
+	mu       sync.Mutex
+	sessions map[string]session
+}
+
+// NewManager 创建会话管理器。secret 在启动时已由 config 验证为足够长度。
+func NewManager(secret []byte, cookieSecure bool) *Manager {
+	return &Manager{
+		secret:       append([]byte(nil), secret...),
+		cookieSecure: cookieSecure,
+		now:          time.Now,
+		random:       rand.Reader,
+		sessions:     make(map[string]session),
+	}
+}
+
+// Ensure 返回当前有效会话；不存在或过期时签发匿名会话，以保护登录表单本身的 POST。
+func (manager *Manager) Ensure(writer http.ResponseWriter, request *http.Request) (csrfToken string, authenticated bool) {
+	if id, current, ok := manager.current(request); ok {
+		return current.csrfToken, current.authenticated
+	} else if id != "" {
+		manager.delete(id)
+	}
+
+	id, current := manager.create(false)
+	manager.writeCookie(writer, id, current.expiresAt)
+	return current.csrfToken, false
+}
+
+// IsAuthenticated 只读检查当前请求是否持有有效管理会话；它不会像 Ensure 一样创建匿名会话。
+func (manager *Manager) IsAuthenticated(request *http.Request) bool {
+	_, current, found := manager.current(request)
+	return found && current.authenticated
+}
+
+// VerifyCSRF 只接受当前未过期会话中以恒定时间比较匹配的 token。
+func (manager *Manager) VerifyCSRF(request *http.Request, token string) (authenticated bool, ok bool) {
+	_, current, found := manager.current(request)
+	if !found || token == "" {
+		return false, false
+	}
+
+	if subtle.ConstantTimeCompare([]byte(current.csrfToken), []byte(token)) != 1 {
+		return false, false
+	}
+
+	return current.authenticated, true
+}
+
+// RotateAuthenticated 在登录成功后撤销旧会话并签发全新认证会话，避免 session fixation 与 CSRF 复用。
+func (manager *Manager) RotateAuthenticated(writer http.ResponseWriter, request *http.Request) string {
+	if id, _, ok := manager.current(request); ok {
+		manager.delete(id)
+	}
+
+	id, current := manager.create(true)
+	manager.writeCookie(writer, id, current.expiresAt)
+	return current.csrfToken
+}
+
+// Logout 撤销当前会话并立即清除浏览器 cookie。
+func (manager *Manager) Logout(writer http.ResponseWriter, request *http.Request) {
+	if id, _, ok := manager.current(request); ok {
+		manager.delete(id)
+	}
+	http.SetCookie(writer, &http.Cookie{
+		Name:     CookieName,
+		Value:    "",
+		Path:     "/",
+		MaxAge:   -1,
+		HttpOnly: true,
+		Secure:   manager.cookieSecure,
+		SameSite: http.SameSiteLaxMode,
+	})
+}
+
+func (manager *Manager) current(request *http.Request) (string, session, bool) {
+	cookie, err := request.Cookie(CookieName)
+	if err != nil {
+		return "", session{}, false
+	}
+
+	id, expiresAt, ok := manager.verifyCookie(cookie.Value)
+	if !ok || !manager.now().Before(expiresAt) {
+		return id, session{}, false
+	}
+
+	manager.mu.Lock()
+	defer manager.mu.Unlock()
+	current, found := manager.sessions[id]
+	if !found || !manager.now().Before(current.expiresAt) {
+		return id, session{}, false
+	}
+
+	return id, current, true
+}
+
+func (manager *Manager) create(authenticated bool) (string, session) {
+	id := manager.randomToken()
+	current := session{
+		csrfToken:     manager.randomToken(),
+		authenticated: authenticated,
+		expiresAt:     manager.now().Add(SessionLifetime),
+	}
+
+	manager.mu.Lock()
+	manager.sessions[id] = current
+	manager.mu.Unlock()
+	return id, current
+}
+
+func (manager *Manager) delete(id string) {
+	manager.mu.Lock()
+	delete(manager.sessions, id)
+	manager.mu.Unlock()
+}
+
+func (manager *Manager) randomToken() string {
+	bytes := make([]byte, csrfTokenByteSize)
+	if _, err := io.ReadFull(manager.random, bytes); err != nil {
+		panic("crypto/rand failed while creating a session token")
+	}
+	return base64.RawURLEncoding.EncodeToString(bytes)
+}
+
+func (manager *Manager) writeCookie(writer http.ResponseWriter, id string, expiresAt time.Time) {
+	http.SetCookie(writer, &http.Cookie{
+		Name:     CookieName,
+		Value:    manager.signCookie(id, expiresAt),
+		Path:     "/",
+		MaxAge:   int(expiresAt.Sub(manager.now()).Seconds()),
+		Expires:  expiresAt,
+		HttpOnly: true,
+		Secure:   manager.cookieSecure,
+		SameSite: http.SameSiteLaxMode,
+	})
+}
+
+func (manager *Manager) signCookie(id string, expiresAt time.Time) string {
+	payload := id + "." + strconv.FormatInt(expiresAt.Unix(), 10)
+	mac := hmac.New(sha256.New, manager.secret)
+	_, _ = mac.Write([]byte(payload))
+	return payload + "." + base64.RawURLEncoding.EncodeToString(mac.Sum(nil))
+}
+
+func (manager *Manager) verifyCookie(value string) (string, time.Time, bool) {
+	parts := strings.Split(value, ".")
+	if len(parts) != 3 || parts[0] == "" {
+		return "", time.Time{}, false
+	}
+
+	expiresUnix, err := strconv.ParseInt(parts[1], 10, 64)
+	if err != nil {
+		return "", time.Time{}, false
+	}
+	provided, err := base64.RawURLEncoding.DecodeString(parts[2])
+	if err != nil {
+		return "", time.Time{}, false
+	}
+
+	payload := parts[0] + "." + parts[1]
+	mac := hmac.New(sha256.New, manager.secret)
+	_, _ = mac.Write([]byte(payload))
+	if !hmac.Equal(provided, mac.Sum(nil)) {
+		return "", time.Time{}, false
+	}
+
+	return parts[0], time.Unix(expiresUnix, 0), true
+}

admin/internal/auth/session_test.go

@@ -0,0 +1,94 @@
+package auth
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestManagerRejectsTamperedAndExpiredCookies(t *testing.T) {
+	manager := NewManager([]byte(strings.Repeat("s", 32)), true)
+	request := httptest.NewRequest(http.MethodGet, "/login", nil)
+	response := httptest.NewRecorder()
+	csrf, authenticated := manager.Ensure(response, request)
+	if csrf == "" || authenticated {
+		t.Fatalf("Ensure = (%q, %t), want anonymous CSRF session", csrf, authenticated)
+	}
+	cookie := response.Result().Cookies()[0]
+	if !cookie.HttpOnly || !cookie.Secure || cookie.SameSite != http.SameSiteLaxMode || cookie.Path != "/" {
+		t.Fatalf("session cookie is missing security attributes: %#v", cookie)
+	}
+
+	tampered := *cookie
+	tampered.Value = flipCookieValue(t, cookie.Value)
+	tamperedRequest := httptest.NewRequest(http.MethodPost, "/login", nil)
+	tamperedRequest.AddCookie(&tampered)
+	if _, ok := manager.VerifyCSRF(tamperedRequest, csrf); ok {
+		t.Fatal("tampered signed cookie passed CSRF verification")
+	}
+
+	manager.now = func() time.Time { return time.Now().Add(9 * time.Hour) }
+	expiredRequest := httptest.NewRequest(http.MethodPost, "/login", nil)
+	expiredRequest.AddCookie(cookie)
+	if _, ok := manager.VerifyCSRF(expiredRequest, csrf); ok {
+		t.Fatal("expired cookie passed CSRF verification")
+	}
+}
+
+func TestIsAuthenticatedDoesNotCreateOrDependOnCSRFValidation(t *testing.T) {
+	manager := NewManager([]byte(strings.Repeat("s", 32)), false)
+	missingSession := httptest.NewRequest(http.MethodPost, "/tasks/start-purchases", nil)
+	if manager.IsAuthenticated(missingSession) {
+		t.Fatal("missing session was treated as authenticated")
+	}
+	if len(manager.sessions) != 0 {
+		t.Fatalf("read-only authentication check created %d sessions", len(manager.sessions))
+	}
+	anonymousRequest := httptest.NewRequest(http.MethodGet, "/login", nil)
+	anonymousResponse := httptest.NewRecorder()
+	manager.Ensure(anonymousResponse, anonymousRequest)
+	anonymousCookie := anonymousResponse.Result().Cookies()[0]
+	anonymousCheck := httptest.NewRequest(http.MethodPost, "/tasks/start-purchases", nil)
+	anonymousCheck.AddCookie(anonymousCookie)
+	if manager.IsAuthenticated(anonymousCheck) {
+		t.Fatal("anonymous CSRF session was treated as authenticated")
+	}
+
+	loginRequest := httptest.NewRequest(http.MethodPost, "/login", nil)
+	loginRequest.AddCookie(anonymousCookie)
+	authenticatedResponse := httptest.NewRecorder()
+	csrf := manager.RotateAuthenticated(authenticatedResponse, loginRequest)
+	authenticatedCookie := authenticatedResponse.Result().Cookies()[0]
+
+	authenticatedCheck := httptest.NewRequest(http.MethodPost, "/tasks/start-purchases", nil)
+	authenticatedCheck.AddCookie(authenticatedCookie)
+	if !manager.IsAuthenticated(authenticatedCheck) {
+		t.Fatal("valid authenticated session was not recognized")
+	}
+	if authenticated, csrfOK := manager.VerifyCSRF(authenticatedCheck, "wrong-token"); authenticated || csrfOK {
+		t.Fatalf("wrong token result = (%t, %t), want (false, false)", authenticated, csrfOK)
+	}
+
+	validRequest := httptest.NewRequest(http.MethodPost, "/tasks/start-purchases", nil)
+	validRequest.AddCookie(authenticatedCookie)
+	if authenticated, csrfOK := manager.VerifyCSRF(validRequest, csrf); !authenticated || !csrfOK {
+		t.Fatalf("valid token result = (%t, %t), want (true, true)", authenticated, csrfOK)
+	}
+
+	if authenticated, csrfOK := manager.VerifyCSRF(httptest.NewRequest(http.MethodPost, "/tasks/start-purchases", nil), csrf); authenticated || csrfOK {
+		t.Fatalf("missing session result = (%t, %t), want (false, false)", authenticated, csrfOK)
+	}
+}
+
+func flipCookieValue(t *testing.T, value string) string {
+	t.Helper()
+	if value == "" {
+		t.Fatal("cannot tamper with an empty cookie")
+	}
+	if value[0] == 'A' {
+		return "B" + value[1:]
+	}
+	return "A" + value[1:]
+}

admin/internal/config/config.go

@@ -0,0 +1,149 @@
+// Package config 读取采购服务的启动配置。凭据只允许来自显式环境变量，避免把秘密写入代码或仓库。
+package config
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"time"
+
+	"golang.org/x/crypto/bcrypt"
+)
+
+const (
+	adminUsernameEnv       = "CMBUYER_ADMIN_USERNAME"
+	adminPasswordBcryptEnv = "CMBUYER_ADMIN_PASSWORD_BCRYPT"
+	sessionSecretEnv       = "CMBUYER_SESSION_SECRET"
+	cookieSecureEnv        = "CMBUYER_COOKIE_SECURE"
+	databaseSourceEnv      = "CMBUYER_DATABASE_SOURCE"
+	authorizationTTLEnv    = "CMBUYER_AUTHORIZATION_TTL"
+	maxTaskQuantityEnv     = "CMBUYER_MAX_TASK_QUANTITY"
+	maxTotalPriceEnv       = "CMBUYER_MAX_TOTAL_PRICE"
+	evidenceDirectoryEnv   = "CMBUYER_EVIDENCE_DIR"
+	minimumSecretLength    = 32
+)
+
+// Config 是启动采购服务所需的最小安全配置。
+type Config struct {
+	AdminUsername       string
+	AdminPasswordBcrypt string
+	SessionSecret       []byte
+	CookieSecure        bool
+	DatabaseSource      string
+	AuthorizationTTL    time.Duration
+	MaxTaskQuantity     int
+	MaxTotalPrice       string
+	EvidenceDirectory   string
+}
+
+// LoadFromEnv 从进程环境读取配置。错误只指出缺失或非法的变量名，绝不回显秘密。
+func LoadFromEnv() (Config, error) {
+	return Load(os.LookupEnv)
+}
+
+// Load 使用 lookup 读取配置，以便在不污染进程环境的情况下测试启动边界。
+func Load(lookup func(string) (string, bool)) (Config, error) {
+	username, err := required(lookup, adminUsernameEnv)
+	if err != nil {
+		return Config{}, err
+	}
+
+	passwordHash, err := required(lookup, adminPasswordBcryptEnv)
+	if err != nil {
+		return Config{}, err
+	}
+	if _, err := bcrypt.Cost([]byte(passwordHash)); err != nil {
+		return Config{}, fmt.Errorf("%s is not a valid bcrypt hash", adminPasswordBcryptEnv)
+	}
+
+	secret, err := required(lookup, sessionSecretEnv)
+	if err != nil {
+		return Config{}, err
+	}
+	if len([]byte(secret)) < minimumSecretLength {
+		return Config{}, fmt.Errorf("%s must be at least %d bytes", sessionSecretEnv, minimumSecretLength)
+	}
+
+	cookieSecure := false
+	if value, present := lookup(cookieSecureEnv); present {
+		switch value {
+		case "true":
+			cookieSecure = true
+		case "false":
+			cookieSecure = false
+		default:
+			return Config{}, fmt.Errorf("%s must be exactly true or false", cookieSecureEnv)
+		}
+	}
+	databaseSource, err := required(lookup, databaseSourceEnv)
+	if err != nil {
+		return Config{}, err
+	}
+	ttlText, err := required(lookup, authorizationTTLEnv)
+	if err != nil {
+		return Config{}, err
+	}
+	ttl, err := time.ParseDuration(ttlText)
+	if err != nil || ttl <= 0 {
+		return Config{}, fmt.Errorf("%s must be a positive duration", authorizationTTLEnv)
+	}
+	quantityText, err := required(lookup, maxTaskQuantityEnv)
+	if err != nil {
+		return Config{}, err
+	}
+	maxQuantity, err := strconv.Atoi(quantityText)
+	if err != nil || maxQuantity < 1 {
+		return Config{}, fmt.Errorf("%s must be a positive integer", maxTaskQuantityEnv)
+	}
+	maxPrice, err := required(lookup, maxTotalPriceEnv)
+	if err != nil {
+		return Config{}, err
+	}
+	if !canonicalMoney(maxPrice) {
+		return Config{}, fmt.Errorf("%s must be a canonical positive decimal", maxTotalPriceEnv)
+	}
+	evidenceDirectory, err := required(lookup, evidenceDirectoryEnv)
+	if err != nil {
+		return Config{}, err
+	}
+	if strings.TrimSpace(evidenceDirectory) != evidenceDirectory || !filepath.IsAbs(evidenceDirectory) {
+		return Config{}, fmt.Errorf("%s must be an absolute path without surrounding whitespace", evidenceDirectoryEnv)
+	}
+
+	return Config{
+		AdminUsername:       username,
+		AdminPasswordBcrypt: passwordHash,
+		SessionSecret:       []byte(secret),
+		CookieSecure:        cookieSecure,
+		DatabaseSource:      databaseSource,
+		AuthorizationTTL:    ttl, MaxTaskQuantity: maxQuantity, MaxTotalPrice: maxPrice,
+		EvidenceDirectory: evidenceDirectory,
+	}, nil
+}
+
+func canonicalMoney(value string) bool {
+	parts := strings.Split(value, ".")
+	if len(parts) != 2 || len(parts[0]) == 0 || len(parts[1]) != 2 || (len(parts[0]) > 1 && parts[0][0] == '0') {
+		return false
+	}
+	for _, part := range parts {
+		for _, ch := range part {
+			if ch < '0' || ch > '9' {
+				return false
+			}
+		}
+	}
+	return strings.Trim(parts[0]+parts[1], "0") != ""
+}
+
+func required(lookup func(string) (string, bool), name string) (string, error) {
+	value, present := lookup(name)
+	if !present || strings.TrimSpace(value) == "" {
+		return "", errors.New(name + " must be set")
+	}
+
+	return value, nil
+}

admin/internal/config/config_test.go

@@ -0,0 +1,98 @@
+package config_test
+
+import (
+	"strings"
+	"testing"
+
+	"cmbuyer/admin/internal/config"
+
+	"golang.org/x/crypto/bcrypt"
+)
+
+func TestLoad(t *testing.T) {
+	hash, err := bcrypt.GenerateFromPassword([]byte("test-password"), bcrypt.MinCost)
+	if err != nil {
+		t.Fatalf("generate bcrypt hash: %v", err)
+	}
+
+	values := map[string]string{
+		"CMBUYER_ADMIN_USERNAME":        "admin",
+		"CMBUYER_ADMIN_PASSWORD_BCRYPT": string(hash),
+		"CMBUYER_SESSION_SECRET":        strings.Repeat("s", 32),
+		"CMBUYER_COOKIE_SECURE":         "true",
+		"CMBUYER_DATABASE_SOURCE":       ":memory:",
+		"CMBUYER_AUTHORIZATION_TTL":     "10m",
+		"CMBUYER_MAX_TASK_QUANTITY":     "99",
+		"CMBUYER_MAX_TOTAL_PRICE":       "999.99",
+		"CMBUYER_EVIDENCE_DIR":          t.TempDir(),
+	}
+
+	got, err := config.Load(lookup(values))
+	if err != nil {
+		t.Fatalf("Load: %v", err)
+	}
+	if got.AdminUsername != "admin" || !got.CookieSecure {
+		t.Fatalf("Load returned unexpected public configuration: %#v", got)
+	}
+}
+
+func TestLoadRejectsMissingOrInvalidConfiguration(t *testing.T) {
+	hash, err := bcrypt.GenerateFromPassword([]byte("test-password"), bcrypt.MinCost)
+	if err != nil {
+		t.Fatalf("generate bcrypt hash: %v", err)
+	}
+
+	base := map[string]string{
+		"CMBUYER_ADMIN_USERNAME":        "admin",
+		"CMBUYER_ADMIN_PASSWORD_BCRYPT": string(hash),
+		"CMBUYER_SESSION_SECRET":        strings.Repeat("s", 32),
+		"CMBUYER_DATABASE_SOURCE":       ":memory:",
+		"CMBUYER_AUTHORIZATION_TTL":     "10m",
+		"CMBUYER_MAX_TASK_QUANTITY":     "99",
+		"CMBUYER_MAX_TOTAL_PRICE":       "999.99",
+		"CMBUYER_EVIDENCE_DIR":          t.TempDir(),
+	}
+
+	tests := []struct {
+		name   string
+		mutate func(map[string]string)
+		want   string
+	}{
+		{"missing username", func(values map[string]string) { delete(values, "CMBUYER_ADMIN_USERNAME") }, "CMBUYER_ADMIN_USERNAME"},
+		{"invalid bcrypt", func(values map[string]string) { values["CMBUYER_ADMIN_PASSWORD_BCRYPT"] = "not-a-bcrypt-hash" }, "CMBUYER_ADMIN_PASSWORD_BCRYPT"},
+		{"short secret", func(values map[string]string) { values["CMBUYER_SESSION_SECRET"] = "short" }, "CMBUYER_SESSION_SECRET"},
+		{"invalid secure flag", func(values map[string]string) { values["CMBUYER_COOKIE_SECURE"] = "1" }, "CMBUYER_COOKIE_SECURE"},
+		{"missing database", func(values map[string]string) { delete(values, "CMBUYER_DATABASE_SOURCE") }, "CMBUYER_DATABASE_SOURCE"},
+		{"invalid authorization ttl", func(values map[string]string) { values["CMBUYER_AUTHORIZATION_TTL"] = "0s" }, "CMBUYER_AUTHORIZATION_TTL"},
+		{"invalid maximum quantity", func(values map[string]string) { values["CMBUYER_MAX_TASK_QUANTITY"] = "0" }, "CMBUYER_MAX_TASK_QUANTITY"},
+		{"invalid maximum total price", func(values map[string]string) { values["CMBUYER_MAX_TOTAL_PRICE"] = "1" }, "CMBUYER_MAX_TOTAL_PRICE"},
+		{"missing evidence directory", func(values map[string]string) { delete(values, "CMBUYER_EVIDENCE_DIR") }, "CMBUYER_EVIDENCE_DIR"},
+		{"relative evidence directory", func(values map[string]string) { values["CMBUYER_EVIDENCE_DIR"] = "evidence" }, "CMBUYER_EVIDENCE_DIR"},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			values := copyValues(base)
+			test.mutate(values)
+			_, err := config.Load(lookup(values))
+			if err == nil || !strings.Contains(err.Error(), test.want) {
+				t.Fatalf("Load error = %v, want mention of %s", err, test.want)
+			}
+		})
+	}
+}
+
+func lookup(values map[string]string) func(string) (string, bool) {
+	return func(key string) (string, bool) {
+		value, ok := values[key]
+		return value, ok
+	}
+}
+
+func copyValues(values map[string]string) map[string]string {
+	copy := make(map[string]string, len(values))
+	for key, value := range values {
+		copy[key] = value
+	}
+	return copy
+}

admin/internal/deviceauth/credentials.go

@@ -0,0 +1,212 @@
+package deviceauth
+
+import (
+	"context"
+	"crypto/rand"
+	"crypto/sha256"
+	"database/sql"
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"io"
+	"strings"
+	"sync"
+	"time"
+	"unicode"
+)
+
+const (
+	StatusActive  = "ACTIVE"
+	StatusRevoked = "REVOKED"
+)
+
+var (
+	ErrInvalidCredential  = errors.New("invalid device credential input")
+	ErrCredentialNotFound = errors.New("device credential not found")
+)
+
+type Credential struct {
+	DeviceID    string     `json:"device_id"`
+	DisplayName string     `json:"display_name"`
+	Status      string     `json:"status"`
+	CreatedAt   time.Time  `json:"created_at"`
+	RevokedAt   *time.Time `json:"revoked_at,omitempty"`
+}
+
+// IssuedCredential is the only value that can carry the plaintext token. It is returned only
+// after SQLite has committed the hash and is intended for the management CLI's one stdout write.
+type IssuedCredential struct {
+	Credential
+	Token string `json:"-"`
+}
+
+type CredentialStore struct {
+	database *sql.DB
+	now      func() time.Time
+	random   io.Reader
+	randomMu sync.Mutex
+}
+
+func NewCredentialStore(database *sql.DB) (*CredentialStore, error) {
+	if database == nil {
+		return nil, errors.New("device credential database is required")
+	}
+	if _, err := database.Exec("SELECT device_id FROM device_credentials LIMIT 1"); err != nil {
+		return nil, errors.New("device credential migration is not available")
+	}
+	return &CredentialStore{database: database, now: time.Now, random: rand.Reader}, nil
+}
+
+func (store *CredentialStore) Issue(ctx context.Context, displayName string) (IssuedCredential, error) {
+	if !ValidDisplayName(displayName) {
+		return IssuedCredential{}, ErrInvalidCredential
+	}
+	randomBytes := make([]byte, 16+32)
+	store.randomMu.Lock()
+	_, randomErr := io.ReadFull(store.random, randomBytes)
+	store.randomMu.Unlock()
+	if randomErr != nil {
+		return IssuedCredential{}, fmt.Errorf("generate device credential: %w", randomErr)
+	}
+	deviceID := formatUUIDv4(randomBytes[:16])
+	token := hex.EncodeToString(randomBytes[16:])
+	tokenHash := sha256.Sum256(randomBytes[16:])
+	createdAt := store.now().UTC()
+	if createdAt.IsZero() {
+		return IssuedCredential{}, errors.New("device credential clock is invalid")
+	}
+	_, err := store.database.ExecContext(ctx, `INSERT INTO device_credentials
+		(device_id, display_name, token_sha256, status, created_at, revoked_at)
+		VALUES (?, ?, ?, ?, ?, NULL)`,
+		deviceID, displayName, tokenHash[:], StatusActive, createdAt.Format(time.RFC3339Nano))
+	if err != nil {
+		return IssuedCredential{}, fmt.Errorf("persist device credential: %w", err)
+	}
+	return IssuedCredential{Credential: Credential{
+		DeviceID: deviceID, DisplayName: displayName, Status: StatusActive, CreatedAt: createdAt,
+	}, Token: token}, nil
+}
+
+func (store *CredentialStore) List(ctx context.Context) ([]Credential, error) {
+	rows, err := store.database.QueryContext(ctx, `SELECT device_id, display_name, status, created_at, revoked_at
+		FROM device_credentials ORDER BY created_at, device_id`)
+	if err != nil {
+		return nil, fmt.Errorf("list device credentials: %w", err)
+	}
+	defer rows.Close()
+	credentials := make([]Credential, 0)
+	for rows.Next() {
+		credential, err := scanCredential(rows)
+		if err != nil {
+			return nil, err
+		}
+		credentials = append(credentials, credential)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, fmt.Errorf("list device credentials: %w", err)
+	}
+	return credentials, nil
+}
+
+func (store *CredentialStore) Revoke(ctx context.Context, deviceID string) (Credential, bool, error) {
+	if !ValidDeviceID(deviceID) {
+		return Credential{}, false, ErrInvalidCredential
+	}
+	revokedAt := store.now().UTC()
+	if revokedAt.IsZero() {
+		return Credential{}, false, errors.New("device credential clock is invalid")
+	}
+	transaction, err := store.database.BeginTx(ctx, nil)
+	if err != nil {
+		return Credential{}, false, fmt.Errorf("begin device credential revocation: %w", err)
+	}
+	defer transaction.Rollback()
+	result, err := transaction.ExecContext(ctx, `UPDATE device_credentials
+		SET status = ?, revoked_at = ? WHERE device_id = ? AND status = ?`,
+		StatusRevoked, revokedAt.Format(time.RFC3339Nano), deviceID, StatusActive)
+	if err != nil {
+		return Credential{}, false, fmt.Errorf("revoke device credential: %w", err)
+	}
+	changedRows, err := result.RowsAffected()
+	if err != nil {
+		return Credential{}, false, fmt.Errorf("inspect device credential revocation: %w", err)
+	}
+	credential, err := scanCredential(transaction.QueryRowContext(ctx, `SELECT device_id, display_name, status, created_at, revoked_at
+		FROM device_credentials WHERE device_id = ?`, deviceID))
+	if errors.Is(err, sql.ErrNoRows) {
+		return Credential{}, false, ErrCredentialNotFound
+	}
+	if err != nil {
+		return Credential{}, false, err
+	}
+	if err := transaction.Commit(); err != nil {
+		return Credential{}, false, fmt.Errorf("commit device credential revocation: %w", err)
+	}
+	return credential, changedRows == 1, nil
+}
+
+type rowScanner interface {
+	Scan(...any) error
+}
+
+func scanCredential(row rowScanner) (Credential, error) {
+	var credential Credential
+	var created string
+	var revoked sql.NullString
+	if err := row.Scan(&credential.DeviceID, &credential.DisplayName, &credential.Status, &created, &revoked); err != nil {
+		return Credential{}, err
+	}
+	if !ValidDeviceID(credential.DeviceID) || !ValidDisplayName(credential.DisplayName) || (credential.Status != StatusActive && credential.Status != StatusRevoked) {
+		return Credential{}, errors.New("stored device credential metadata is invalid")
+	}
+	createdAt, err := parseStoredTime(created)
+	if err != nil {
+		return Credential{}, err
+	}
+	credential.CreatedAt = createdAt
+	if revoked.Valid {
+		revokedAt, err := parseStoredTime(revoked.String)
+		if err != nil {
+			return Credential{}, err
+		}
+		if revokedAt.Before(createdAt) {
+			return Credential{}, errors.New("stored device credential status is invalid")
+		}
+		credential.RevokedAt = &revokedAt
+	}
+	if (credential.Status == StatusActive) != (credential.RevokedAt == nil) {
+		return Credential{}, errors.New("stored device credential status is invalid")
+	}
+	return credential, nil
+}
+
+func ValidDisplayName(value string) bool {
+	if value == "" || len([]rune(value)) > 128 || strings.TrimSpace(value) != value {
+		return false
+	}
+	for _, character := range value {
+		if unicode.IsControl(character) {
+			return false
+		}
+	}
+	return true
+}
+
+func parseStoredTime(value string) (time.Time, error) {
+	if strings.TrimSpace(value) != value || !strings.HasSuffix(value, "Z") {
+		return time.Time{}, errors.New("stored device credential time is invalid")
+	}
+	parsed, err := time.Parse(time.RFC3339Nano, value)
+	if err != nil || parsed.Location() != time.UTC {
+		return time.Time{}, errors.New("stored device credential time is invalid")
+	}
+	return parsed, nil
+}
+
+func formatUUIDv4(bytes []byte) string {
+	copyBytes := append([]byte(nil), bytes...)
+	copyBytes[6] = (copyBytes[6] & 0x0f) | 0x40
+	copyBytes[8] = (copyBytes[8] & 0x3f) | 0x80
+	encoded := hex.EncodeToString(copyBytes)
+	return encoded[:8] + "-" + encoded[8:12] + "-" + encoded[12:16] + "-" + encoded[16:20] + "-" + encoded[20:]
+}

admin/internal/deviceauth/deviceauth.go

@@ -0,0 +1,168 @@
+// Package deviceauth owns the machine identity boundary shared by all device routes.
+package deviceauth
+
+import (
+	"crypto/sha256"
+	"crypto/subtle"
+	"database/sql"
+	"encoding/hex"
+	"errors"
+	"net/http"
+	"strings"
+)
+
+const (
+	AuthorizationHeader = "Authorization"
+	DeviceIDHeader      = "X-CMBuyer-Device-ID"
+	tokenHexLength      = 64
+)
+
+var (
+	// ErrUnauthenticated deliberately covers every credential defect. Callers must not reveal
+	// whether a device exists, is revoked, or supplied a mismatched token.
+	ErrUnauthenticated = errors.New("device authentication failed")
+	// ErrUnavailable is distinct so a storage outage is not disguised as a bad credential.
+	// HTTP callers still return no diagnostic body because database details are server-only.
+	ErrUnavailable = errors.New("device authentication unavailable")
+)
+
+type Principal struct {
+	ID string
+}
+
+type Authenticator interface {
+	Authenticate(*http.Request) (Principal, error)
+}
+
+// RejectAllAuthenticator is useful for tests and for fail-closed wiring where no credential
+// store is available. Production startup uses SQLiteAuthenticator.
+type RejectAllAuthenticator struct{}
+
+func (RejectAllAuthenticator) Authenticate(*http.Request) (Principal, error) {
+	return Principal{}, ErrUnauthenticated
+}
+
+type SQLiteAuthenticator struct {
+	database *sql.DB
+}
+
+func NewSQLiteAuthenticator(database *sql.DB) (*SQLiteAuthenticator, error) {
+	if database == nil {
+		return nil, errors.New("device credential database is required")
+	}
+	if _, err := database.Exec("SELECT device_id FROM device_credentials LIMIT 1"); err != nil {
+		return nil, errors.New("device credential migration is not available")
+	}
+	return &SQLiteAuthenticator{database: database}, nil
+}
+
+func (authenticator *SQLiteAuthenticator) Authenticate(request *http.Request) (Principal, error) {
+	if request == nil {
+		return Principal{}, ErrUnauthenticated
+	}
+	deviceID, token, ok := requestCredentials(request)
+	if !ok {
+		return Principal{}, ErrUnauthenticated
+	}
+
+	candidateHash := sha256.Sum256(token)
+	var storedHash []byte
+	var hashType string
+	var hashLength sql.NullInt64
+	var status sql.NullString
+	var revokedAt sql.NullString
+	var found bool
+	err := authenticator.database.QueryRowContext(
+		request.Context(),
+		`SELECT CASE WHEN credentials.device_id IS NULL THEN zeroblob(32) ELSE credentials.token_sha256 END,
+		        typeof(credentials.token_sha256),
+		        length(credentials.token_sha256),
+		        credentials.status,
+		        credentials.revoked_at,
+		        credentials.device_id IS NOT NULL
+		 FROM (SELECT 1) AS singleton
+		 LEFT JOIN device_credentials AS credentials ON credentials.device_id = ?`,
+		deviceID,
+	).Scan(&storedHash, &hashType, &hashLength, &status, &revokedAt, &found)
+	if err != nil {
+		return Principal{}, ErrUnavailable
+	}
+	if len(storedHash) != sha256.Size {
+		return Principal{}, ErrUnavailable
+	}
+	matched := subtle.ConstantTimeCompare(candidateHash[:], storedHash) == 1
+	if !found {
+		// The LEFT JOIN supplies a 32-byte dummy hash, so unknown ids take the same compare path
+		// as known credentials without requiring a plaintext token lookup.
+		return Principal{}, ErrUnauthenticated
+	}
+	if hashType != "blob" || !hashLength.Valid || hashLength.Int64 != sha256.Size || len(storedHash) != sha256.Size || !status.Valid {
+		return Principal{}, ErrUnavailable
+	}
+	switch status.String {
+	case StatusActive:
+		if revokedAt.Valid {
+			return Principal{}, ErrUnavailable
+		}
+	case StatusRevoked:
+		if !revokedAt.Valid {
+			return Principal{}, ErrUnavailable
+		}
+		if _, err := parseStoredTime(revokedAt.String); err != nil {
+			return Principal{}, ErrUnavailable
+		}
+	default:
+		return Principal{}, ErrUnavailable
+	}
+	if !matched || status.String == StatusRevoked {
+		return Principal{}, ErrUnauthenticated
+	}
+	return Principal{ID: deviceID}, nil
+}
+
+func requestCredentials(request *http.Request) (string, []byte, bool) {
+	authorizations := request.Header.Values(AuthorizationHeader)
+	deviceIDs := request.Header.Values(DeviceIDHeader)
+	if len(authorizations) != 1 || len(deviceIDs) != 1 {
+		return "", nil, false
+	}
+	authorization := authorizations[0]
+	if len(authorization) != len("Bearer ")+tokenHexLength || !strings.EqualFold(authorization[:len("Bearer")], "Bearer") || authorization[len("Bearer")] != ' ' {
+		return "", nil, false
+	}
+	tokenHex := authorization[len("Bearer "):]
+	if !validLowerHex(tokenHex, tokenHexLength) || !ValidDeviceID(deviceIDs[0]) {
+		return "", nil, false
+	}
+	token, err := hex.DecodeString(tokenHex)
+	if err != nil {
+		return "", nil, false
+	}
+	return deviceIDs[0], token, true
+}
+
+func ValidDeviceID(value string) bool {
+	if len(value) != 36 {
+		return false
+	}
+	for index, character := range value {
+		if index == 8 || index == 13 || index == 18 || index == 23 {
+			if character != '-' {
+				return false
+			}
+			continue
+		}
+		if !(character >= '0' && character <= '9' || character >= 'a' && character <= 'f') {
+			return false
+		}
+	}
+	return value[14] == '4' && (value[19] == '8' || value[19] == '9' || value[19] == 'a' || value[19] == 'b')
+}
+
+func validLowerHex(value string, length int) bool {
+	if len(value) != length {
+		return false
+	}
+	decoded, err := hex.DecodeString(value)
+	return err == nil && hex.EncodeToString(decoded) == value
+}

admin/internal/deviceauth/deviceauth_test.go

@@ -0,0 +1,407 @@
+package deviceauth
+
+import (
+	"context"
+	"crypto/rand"
+	"crypto/sha256"
+	"database/sql"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"net/http"
+	"net/http/httptest"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"cmbuyer/admin/internal/migrations"
+	"cmbuyer/admin/internal/storage/sqlite"
+)
+
+func TestIssueStoresOnlyRawTokenHashAndGenericJSONOmitsSecret(t *testing.T) {
+	database, store := newCredentialStore(t)
+	first, err := store.Issue(context.Background(), "采购工具一号")
+	if err != nil {
+		t.Fatalf("Issue first: %v", err)
+	}
+	second, err := store.Issue(context.Background(), "采购工具二号")
+	if err != nil {
+		t.Fatalf("Issue second: %v", err)
+	}
+	if first.DeviceID == second.DeviceID || first.Token == second.Token || !ValidDeviceID(first.DeviceID) || !validLowerHex(first.Token, tokenHexLength) {
+		t.Fatalf("issued identifiers are not independent canonical values")
+	}
+
+	rawToken, err := hex.DecodeString(first.Token)
+	if err != nil {
+		t.Fatalf("decode issued token: %v", err)
+	}
+	wantHash := sha256.Sum256(rawToken)
+	var storedHash []byte
+	var storageType string
+	if err := database.QueryRow(`SELECT token_sha256, typeof(token_sha256) FROM device_credentials WHERE device_id = ?`, first.DeviceID).Scan(&storedHash, &storageType); err != nil {
+		t.Fatalf("read stored hash: %v", err)
+	}
+	if storageType != "blob" || len(storedHash) != sha256.Size || !equalBytes(storedHash, wantHash[:]) {
+		t.Fatalf("stored hash type/length/value = %q/%d/%t", storageType, len(storedHash), equalBytes(storedHash, wantHash[:]))
+	}
+	var leakedCopies int
+	if err := database.QueryRow(`SELECT COUNT(*) FROM device_credentials WHERE CAST(token_sha256 AS TEXT) IN (?, ?)`, first.Token, hex.EncodeToString(wantHash[:])).Scan(&leakedCopies); err != nil {
+		t.Fatalf("search token copies: %v", err)
+	}
+	if leakedCopies != 0 {
+		t.Fatal("database stored a plaintext or hex-encoded token/hash copy")
+	}
+	encoded, err := json.Marshal(first)
+	if err != nil {
+		t.Fatalf("marshal issued credential: %v", err)
+	}
+	if strings.Contains(string(encoded), first.Token) || strings.Contains(string(encoded), "token") {
+		t.Fatalf("generic serialization disclosed token field: %s", encoded)
+	}
+}
+
+func TestAuthenticateStrictHeaderMatrixAndBinding(t *testing.T) {
+	_, store := newCredentialStore(t)
+	first, err := store.Issue(context.Background(), "one")
+	if err != nil {
+		t.Fatalf("issue first: %v", err)
+	}
+	second, err := store.Issue(context.Background(), "two")
+	if err != nil {
+		t.Fatalf("issue second: %v", err)
+	}
+	authenticator := authenticatorForStore(t, store)
+
+	for _, scheme := range []string{"Bearer", "bearer", "BEARER"} {
+		request := credentialRequest(first.DeviceID, scheme+" "+first.Token)
+		principal, err := authenticator.Authenticate(request)
+		if err != nil || principal.ID != first.DeviceID {
+			t.Fatalf("scheme %q Authenticate = (%q, %v)", scheme, principal.ID, err)
+		}
+	}
+
+	unknownID := newRuntimeUUID(t)
+	wrongToken := newRuntimeToken(t)
+	tests := []struct {
+		name   string
+		mutate func(*http.Request)
+	}{
+		{"missing authorization", func(request *http.Request) { request.Header.Del(AuthorizationHeader) }},
+		{"missing device", func(request *http.Request) { request.Header.Del(DeviceIDHeader) }},
+		{"empty authorization", func(request *http.Request) { request.Header.Set(AuthorizationHeader, "") }},
+		{"empty device", func(request *http.Request) { request.Header.Set(DeviceIDHeader, "") }},
+		{"duplicate authorization", func(request *http.Request) { request.Header.Add(AuthorizationHeader, "Bearer "+first.Token) }},
+		{"duplicate device", func(request *http.Request) { request.Header.Add(DeviceIDHeader, first.DeviceID) }},
+		{"combined authorization", func(request *http.Request) {
+			request.Header.Set(AuthorizationHeader, "Bearer "+first.Token+", Bearer "+first.Token)
+		}},
+		{"combined device", func(request *http.Request) { request.Header.Set(DeviceIDHeader, first.DeviceID+", "+first.DeviceID) }},
+		{"extra separator", func(request *http.Request) { request.Header.Set(AuthorizationHeader, "Bearer  "+first.Token) }},
+		{"tab separator", func(request *http.Request) { request.Header.Set(AuthorizationHeader, "Bearer\t"+first.Token) }},
+		{"uppercase token", func(request *http.Request) {
+			request.Header.Set(AuthorizationHeader, "Bearer "+strings.ToUpper(first.Token))
+		}},
+		{"short token", func(request *http.Request) { request.Header.Set(AuthorizationHeader, "Bearer "+first.Token[:62]) }},
+		{"long token", func(request *http.Request) { request.Header.Set(AuthorizationHeader, "Bearer "+first.Token+"00") }},
+		{"non hex token", func(request *http.Request) { request.Header.Set(AuthorizationHeader, "Bearer "+first.Token[:63]+"g") }},
+		{"token separator", func(request *http.Request) {
+			request.Header.Set(AuthorizationHeader, "Bearer "+first.Token[:32]+"-"+first.Token[33:])
+		}},
+		{"uppercase device", func(request *http.Request) { request.Header.Set(DeviceIDHeader, strings.ToUpper(first.DeviceID)) }},
+		{"padded device", func(request *http.Request) { request.Header.Set(DeviceIDHeader, " "+first.DeviceID) }},
+		{"wrong uuid version", func(request *http.Request) {
+			request.Header.Set(DeviceIDHeader, first.DeviceID[:14]+"3"+first.DeviceID[15:])
+		}},
+		{"wrong uuid variant", func(request *http.Request) {
+			request.Header.Set(DeviceIDHeader, first.DeviceID[:19]+"7"+first.DeviceID[20:])
+		}},
+		{"unknown device", func(request *http.Request) { request.Header.Set(DeviceIDHeader, unknownID) }},
+		{"wrong token", func(request *http.Request) { request.Header.Set(AuthorizationHeader, "Bearer "+wrongToken) }},
+		{"token device mismatch", func(request *http.Request) { request.Header.Set(DeviceIDHeader, second.DeviceID) }},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			request := credentialRequest(first.DeviceID, "Bearer "+first.Token)
+			test.mutate(request)
+			principal, err := authenticator.Authenticate(request)
+			if !errors.Is(err, ErrUnauthenticated) || principal != (Principal{}) {
+				t.Fatalf("Authenticate = (%#v, %v), want empty unauthenticated", principal, err)
+			}
+		})
+	}
+	if principal, err := authenticator.Authenticate(nil); !errors.Is(err, ErrUnauthenticated) || principal != (Principal{}) {
+		t.Fatalf("Authenticate(nil) = (%#v, %v)", principal, err)
+	}
+}
+
+func TestRevokeIsImmediateAndIdempotent(t *testing.T) {
+	_, store := newCredentialStore(t)
+	issued, err := store.Issue(context.Background(), "device")
+	if err != nil {
+		t.Fatalf("Issue: %v", err)
+	}
+	authenticator := authenticatorForStore(t, store)
+	request := credentialRequest(issued.DeviceID, "Bearer "+issued.Token)
+	if _, err := authenticator.Authenticate(request); err != nil {
+		t.Fatalf("Authenticate before revoke: %v", err)
+	}
+
+	first, changed, err := store.Revoke(context.Background(), issued.DeviceID)
+	if err != nil || !changed || first.Status != StatusRevoked || first.RevokedAt == nil {
+		t.Fatalf("first Revoke = (%#v, %t, %v)", first, changed, err)
+	}
+	if principal, err := authenticator.Authenticate(request); !errors.Is(err, ErrUnauthenticated) || principal != (Principal{}) {
+		t.Fatalf("Authenticate after committed revoke = (%#v, %v)", principal, err)
+	}
+	second, changed, err := store.Revoke(context.Background(), issued.DeviceID)
+	if err != nil || changed || second.RevokedAt == nil || !second.RevokedAt.Equal(*first.RevokedAt) {
+		t.Fatalf("second Revoke = (%#v, %t, %v)", second, changed, err)
+	}
+	listed, err := store.List(context.Background())
+	if err != nil || len(listed) != 1 || listed[0].Status != StatusRevoked {
+		t.Fatalf("List = (%#v, %v)", listed, err)
+	}
+}
+
+func TestConcurrentAuthenticationAndRevocation(t *testing.T) {
+	_, store := newCredentialStore(t)
+	issued, err := store.Issue(context.Background(), "concurrent")
+	if err != nil {
+		t.Fatalf("Issue: %v", err)
+	}
+	authenticator := authenticatorForStore(t, store)
+	request := func() *http.Request { return credentialRequest(issued.DeviceID, "Bearer "+issued.Token) }
+	start := make(chan struct{})
+	results := make(chan error, 16)
+	var wait sync.WaitGroup
+	for index := 0; index < 16; index++ {
+		wait.Add(1)
+		go func() {
+			defer wait.Done()
+			<-start
+			_, err := authenticator.Authenticate(request())
+			results <- err
+		}()
+	}
+	close(start)
+	if _, _, err := store.Revoke(context.Background(), issued.DeviceID); err != nil {
+		t.Fatalf("Revoke: %v", err)
+	}
+	wait.Wait()
+	close(results)
+	for err := range results {
+		if err != nil && !errors.Is(err, ErrUnauthenticated) {
+			t.Fatalf("concurrent Authenticate error = %v", err)
+		}
+	}
+	for index := 0; index < 16; index++ {
+		if _, err := authenticator.Authenticate(request()); !errors.Is(err, ErrUnauthenticated) {
+			t.Fatalf("post-commit Authenticate %d error = %v", index, err)
+		}
+	}
+}
+
+func TestAuthenticationDatabaseFaultAndCorruptionAreUnavailable(t *testing.T) {
+	database, store := newCredentialStore(t)
+	issued, err := store.Issue(context.Background(), "device")
+	if err != nil {
+		t.Fatalf("Issue: %v", err)
+	}
+	authenticator := authenticatorForStore(t, store)
+	if err := database.Close(); err != nil {
+		t.Fatalf("close database: %v", err)
+	}
+	if _, err := authenticator.Authenticate(credentialRequest(issued.DeviceID, "Bearer "+issued.Token)); !errors.Is(err, ErrUnavailable) {
+		t.Fatalf("closed database Authenticate error = %v", err)
+	}
+
+	corruptDB, err := sqlite.Open(filepath.Join(t.TempDir(), "corrupt.db"))
+	if err != nil {
+		t.Fatalf("open corrupt database: %v", err)
+	}
+	t.Cleanup(func() { _ = corruptDB.Close() })
+	if _, err := corruptDB.Exec(`CREATE TABLE device_credentials (device_id TEXT PRIMARY KEY, token_sha256 BLOB, status TEXT, revoked_at TEXT)`); err != nil {
+		t.Fatalf("create corrupt table: %v", err)
+	}
+	corruptAuthenticator, err := NewSQLiteAuthenticator(corruptDB)
+	if err != nil {
+		t.Fatalf("new corrupt authenticator: %v", err)
+	}
+	tests := []struct {
+		name      string
+		hashValue func([sha256.Size]byte) any
+		status    string
+		revokedAt any
+	}{
+		{name: "null hash", hashValue: func([sha256.Size]byte) any { return nil }, status: StatusActive},
+		{name: "matching text hash", hashValue: func(hash [sha256.Size]byte) any { return string(hash[:]) }, status: StatusActive},
+		{name: "unknown status", hashValue: func(hash [sha256.Size]byte) any { return hash[:] }, status: "BROKEN"},
+		{name: "active with revoked time", hashValue: func(hash [sha256.Size]byte) any { return hash[:] }, status: StatusActive, revokedAt: "2026-08-04T00:00:00Z"},
+		{name: "revoked without time", hashValue: func(hash [sha256.Size]byte) any { return hash[:] }, status: StatusRevoked},
+		{name: "revoked with invalid time", hashValue: func(hash [sha256.Size]byte) any { return hash[:] }, status: StatusRevoked, revokedAt: "not-a-time"},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			rawToken, token := newRuntimeTokenPair(t)
+			hash := sha256.Sum256(rawToken)
+			deviceID := newRuntimeUUID(t)
+			if _, err := corruptDB.Exec(`INSERT INTO device_credentials VALUES (?, ?, ?, ?)`, deviceID, test.hashValue(hash), test.status, test.revokedAt); err != nil {
+				t.Fatalf("insert corrupt row: %v", err)
+			}
+			principal, err := corruptAuthenticator.Authenticate(credentialRequest(deviceID, "Bearer "+token))
+			if !errors.Is(err, ErrUnavailable) || principal != (Principal{}) {
+				t.Fatalf("corrupt Authenticate = (%#v, %v), want unavailable", principal, err)
+			}
+		})
+	}
+}
+
+func TestCredentialAuthenticationSurvivesDatabaseReopen(t *testing.T) {
+	databaseSource := filepath.Join(t.TempDir(), "reopen.db")
+	database, err := sqlite.Open(databaseSource)
+	if err != nil {
+		t.Fatalf("open database: %v", err)
+	}
+	if err := migrations.Up(context.Background(), database, deviceMigrationDirectory(t)); err != nil {
+		_ = database.Close()
+		t.Fatalf("migrate database: %v", err)
+	}
+	store, err := NewCredentialStore(database)
+	if err != nil {
+		_ = database.Close()
+		t.Fatalf("new store: %v", err)
+	}
+	issued, err := store.Issue(context.Background(), "reopen")
+	if err != nil {
+		_ = database.Close()
+		t.Fatalf("issue: %v", err)
+	}
+	if err := database.Close(); err != nil {
+		t.Fatalf("close database: %v", err)
+	}
+
+	reopened, err := sqlite.Open(databaseSource)
+	if err != nil {
+		t.Fatalf("reopen database: %v", err)
+	}
+	defer reopened.Close()
+	authenticator, err := NewSQLiteAuthenticator(reopened)
+	if err != nil {
+		t.Fatalf("new reopened authenticator: %v", err)
+	}
+	principal, err := authenticator.Authenticate(credentialRequest(issued.DeviceID, "Bearer "+issued.Token))
+	if err != nil || principal.ID != issued.DeviceID {
+		t.Fatalf("Authenticate after reopen = (%#v, %v)", principal, err)
+	}
+}
+
+func TestCredentialInputAndMigrationAreRequired(t *testing.T) {
+	database, err := sqlite.Open(filepath.Join(t.TempDir(), "unmigrated.db"))
+	if err != nil {
+		t.Fatalf("open database: %v", err)
+	}
+	t.Cleanup(func() { _ = database.Close() })
+	if _, err := NewCredentialStore(database); err == nil {
+		t.Fatal("NewCredentialStore accepted an unmigrated database")
+	}
+	if _, err := NewSQLiteAuthenticator(database); err == nil {
+		t.Fatal("NewSQLiteAuthenticator accepted an unmigrated database")
+	}
+
+	_, store := newCredentialStore(t)
+	for _, name := range []string{"", " leading", "trailing ", "line\nbreak", strings.Repeat("名", 129)} {
+		if _, err := store.Issue(context.Background(), name); !errors.Is(err, ErrInvalidCredential) {
+			t.Fatalf("Issue(%q) error = %v", name, err)
+		}
+	}
+	if _, _, err := store.Revoke(context.Background(), "not-a-uuid"); !errors.Is(err, ErrInvalidCredential) {
+		t.Fatalf("Revoke invalid id error = %v", err)
+	}
+	if _, _, err := store.Revoke(context.Background(), newRuntimeUUID(t)); !errors.Is(err, ErrCredentialNotFound) {
+		t.Fatalf("Revoke unknown id error = %v", err)
+	}
+}
+
+func newCredentialStore(t *testing.T) (*sql.DB, *CredentialStore) {
+	t.Helper()
+	databaseSource := filepath.Join(t.TempDir(), "device-auth.db") + "?_busy_timeout=5000&_journal_mode=WAL"
+	database, err := sqlite.Open(databaseSource)
+	if err != nil {
+		t.Fatalf("open database: %v", err)
+	}
+	t.Cleanup(func() { _ = database.Close() })
+	if err := migrations.Up(context.Background(), database, deviceMigrationDirectory(t)); err != nil {
+		t.Fatalf("migrate database: %v", err)
+	}
+	store, err := NewCredentialStore(database)
+	if err != nil {
+		t.Fatalf("NewCredentialStore: %v", err)
+	}
+	store.now = func() time.Time { return time.Date(2026, 8, 4, 12, 0, 0, 123, time.UTC) }
+	return database, store
+}
+
+func authenticatorForStore(t *testing.T, store *CredentialStore) *SQLiteAuthenticator {
+	t.Helper()
+	authenticator, err := NewSQLiteAuthenticator(store.database)
+	if err != nil {
+		t.Fatalf("NewSQLiteAuthenticator: %v", err)
+	}
+	return authenticator
+}
+
+func credentialRequest(deviceID, authorization string) *http.Request {
+	request := httptest.NewRequest(http.MethodPost, "/api/v1/tasks/id/evidence", nil)
+	request.Header.Set(DeviceIDHeader, deviceID)
+	request.Header.Set(AuthorizationHeader, authorization)
+	return request
+}
+
+func newRuntimeToken(t *testing.T) string {
+	t.Helper()
+	_, token := newRuntimeTokenPair(t)
+	return token
+}
+
+func newRuntimeTokenPair(t *testing.T) ([]byte, string) {
+	t.Helper()
+	raw := make([]byte, 32)
+	if _, err := rand.Read(raw); err != nil {
+		t.Fatalf("generate runtime token: %v", err)
+	}
+	return raw, hex.EncodeToString(raw)
+}
+
+func newRuntimeUUID(t *testing.T) string {
+	t.Helper()
+	raw := make([]byte, 16)
+	if _, err := rand.Read(raw); err != nil {
+		t.Fatalf("generate runtime UUID: %v", err)
+	}
+	return formatUUIDv4(raw)
+}
+
+func equalBytes(left, right []byte) bool {
+	if len(left) != len(right) {
+		return false
+	}
+	for index := range left {
+		if left[index] != right[index] {
+			return false
+		}
+	}
+	return true
+}
+
+func deviceMigrationDirectory(t *testing.T) string {
+	t.Helper()
+	_, file, _, ok := runtime.Caller(0)
+	if !ok {
+		t.Fatal("locate migrations")
+	}
+	return filepath.Join(filepath.Dir(file), "..", "..", "migrations")
+}

admin/internal/domain/authorization.go

@@ -10,32 +10,28 @@ var ErrInvalidAuthorizationTransition = errors.New("invalid authorization status
 type AuthorizationStatus string
 
 const (
-	AuthorizationStatusPendingDelivery AuthorizationStatus = "PENDING_DELIVERY"
-	AuthorizationStatusDelivered       AuthorizationStatus = "DELIVERED"
-	AuthorizationStatusAcknowledged    AuthorizationStatus = "ACKNOWLEDGED"
-	AuthorizationStatusExecuting       AuthorizationStatus = "EXECUTING"
-	AuthorizationStatusFenced          AuthorizationStatus = "FENCED"
-	AuthorizationStatusConsumed        AuthorizationStatus = "CONSUMED"
-	AuthorizationStatusSuperseded      AuthorizationStatus = "SUPERSEDED"
-	AuthorizationStatusExpired         AuthorizationStatus = "EXPIRED"
+	AuthorizationStatusActive    AuthorizationStatus = "ACTIVE"
+	AuthorizationStatusClaimed   AuthorizationStatus = "CLAIMED"
+	AuthorizationStatusFenced    AuthorizationStatus = "FENCED"
+	AuthorizationStatusConsumed  AuthorizationStatus = "CONSUMED"
+	AuthorizationStatusExpired   AuthorizationStatus = "EXPIRED"
+	AuthorizationStatusAbandoned AuthorizationStatus = "ABANDONED"
 )
 
 type OrderAuthorization struct {
-	ID                  string
-	TaskID              string
-	SpecTrialID         string
-	Version             int
-	GoodsID             string
-	SKUColor            string
-	SKUSize             string
-	Quantity            int
-	AuthorizedUnitPrice string
-	TotalPriceCap       string
-	Note                *string
-	Status              AuthorizationStatus
-	CreatedBy           string
-	CreatedAt           time.Time
-	ExpiresAt           time.Time
+	ID            string
+	TaskID        string
+	TaskVersion   int
+	StartKey      string
+	GoodsID       string
+	SKUColor      string
+	SKUSize       string
+	Quantity      int
+	TotalPriceCap string
+	Status        AuthorizationStatus
+	CreatedBy     string
+	CreatedAt     time.Time
+	ExpiresAt     time.Time
 }
 
 // CanTransitionTo 围栏后的授权只能消费，不能回到可领取或可过期状态，以防重复采购。
@@ -54,25 +50,15 @@ func TransitionAuthorization(current, next AuthorizationStatus) (AuthorizationSt
 }
 
 var authorizationTransitions = map[AuthorizationStatus]map[AuthorizationStatus]struct{}{
-	AuthorizationStatusPendingDelivery: {
-		AuthorizationStatusDelivered:  {},
-		AuthorizationStatusSuperseded: {},
-		AuthorizationStatusExpired:    {},
+	AuthorizationStatusActive: {
+		AuthorizationStatusClaimed:   {},
+		AuthorizationStatusExpired:   {},
+		AuthorizationStatusAbandoned: {},
 	},
-	AuthorizationStatusDelivered: {
-		AuthorizationStatusAcknowledged: {},
-		AuthorizationStatusSuperseded:   {},
-		AuthorizationStatusExpired:      {},
-	},
-	AuthorizationStatusAcknowledged: {
-		AuthorizationStatusExecuting:  {},
-		AuthorizationStatusSuperseded: {},
-		AuthorizationStatusExpired:    {},
-	},
-	AuthorizationStatusExecuting: {
-		AuthorizationStatusFenced:     {},
-		AuthorizationStatusSuperseded: {},
-		AuthorizationStatusExpired:    {},
+	AuthorizationStatusClaimed: {
+		AuthorizationStatusFenced:    {},
+		AuthorizationStatusExpired:   {},
+		AuthorizationStatusAbandoned: {},
 	},
 	AuthorizationStatusFenced: {
 		AuthorizationStatusConsumed: {},

admin/internal/domain/authorization_test.go

@@ -14,19 +14,17 @@ func TestAuthorizationTransitions(t *testing.T) {
 		next    domain.AuthorizationStatus
 		allowed bool
 	}{
-		{"deliver", domain.AuthorizationStatusPendingDelivery, domain.AuthorizationStatusDelivered, true},
-		{"acknowledge", domain.AuthorizationStatusDelivered, domain.AuthorizationStatusAcknowledged, true},
-		{"execute", domain.AuthorizationStatusAcknowledged, domain.AuthorizationStatusExecuting, true},
-		{"fence", domain.AuthorizationStatusExecuting, domain.AuthorizationStatusFenced, true},
+		{"claim", domain.AuthorizationStatusActive, domain.AuthorizationStatusClaimed, true},
+		{"fence", domain.AuthorizationStatusClaimed, domain.AuthorizationStatusFenced, true},
 		{"consume fenced authorization", domain.AuthorizationStatusFenced, domain.AuthorizationStatusConsumed, true},
-		{"expire pending delivery", domain.AuthorizationStatusPendingDelivery, domain.AuthorizationStatusExpired, true},
-		{"supersede pending delivery", domain.AuthorizationStatusPendingDelivery, domain.AuthorizationStatusSuperseded, true},
-		{"expire before fence", domain.AuthorizationStatusExecuting, domain.AuthorizationStatusExpired, true},
-		{"supersede before fence", domain.AuthorizationStatusDelivered, domain.AuthorizationStatusSuperseded, true},
+		{"expire active", domain.AuthorizationStatusActive, domain.AuthorizationStatusExpired, true},
+		{"abandon active", domain.AuthorizationStatusActive, domain.AuthorizationStatusAbandoned, true},
+		{"expire claimed before fence", domain.AuthorizationStatusClaimed, domain.AuthorizationStatusExpired, true},
+		{"abandon claimed before fence", domain.AuthorizationStatusClaimed, domain.AuthorizationStatusAbandoned, true},
 		{"fenced authorization cannot expire", domain.AuthorizationStatusFenced, domain.AuthorizationStatusExpired, false},
-		{"fenced authorization cannot be superseded", domain.AuthorizationStatusFenced, domain.AuthorizationStatusSuperseded, false},
-		{"fenced authorization cannot be delivered again", domain.AuthorizationStatusFenced, domain.AuthorizationStatusDelivered, false},
-		{"consumed authorization cannot restart", domain.AuthorizationStatusConsumed, domain.AuthorizationStatusDelivered, false},
+		{"fenced authorization cannot be abandoned", domain.AuthorizationStatusFenced, domain.AuthorizationStatusAbandoned, false},
+		{"fenced authorization cannot be claimed again", domain.AuthorizationStatusFenced, domain.AuthorizationStatusClaimed, false},
+		{"consumed authorization cannot restart", domain.AuthorizationStatusConsumed, domain.AuthorizationStatusClaimed, false},
 	}
 
 	for _, test := range tests {

admin/internal/domain/purchase_attempt.go

@@ -0,0 +1,74 @@
+package domain
+
+import (
+	"errors"
+	"time"
+)
+
+var ErrInvalidAttemptTransition = errors.New("invalid purchase attempt status transition")
+
+// AttemptStatus 只描述单趟领取的可恢复执行。真实提交结果独立由唯一围栏记录调和。
+type AttemptStatus string
+
+const (
+	AttemptStatusClaimed   AttemptStatus = "CLAIMED"
+	AttemptStatusOrdering  AttemptStatus = "ORDERING"
+	AttemptStatusFailed    AttemptStatus = "FAILED"
+	AttemptStatusFenced    AttemptStatus = "FENCED"
+	AttemptStatusAbandoned AttemptStatus = "ABANDONED"
+)
+
+// AttemptFailureCode 是服务端可审计的固定失败摘要，不能承载页面正文或其他自由文本。
+type AttemptFailureCode string
+
+const (
+	AttemptFailureAuthorizationExpired AttemptFailureCode = "AUTHORIZATION_EXPIRED"
+	AttemptFailureLeaseLost            AttemptFailureCode = "LEASE_LOST"
+	AttemptFailureGate1Rejected        AttemptFailureCode = "GATE_1_REJECTED"
+	AttemptFailureQuantityMismatch     AttemptFailureCode = "QUANTITY_MISMATCH"
+	AttemptFailureGate2Rejected        AttemptFailureCode = "GATE_2_REJECTED"
+	AttemptFailureGate3Rejected        AttemptFailureCode = "GATE_3_REJECTED"
+	AttemptFailureFenceRejected        AttemptFailureCode = "FENCE_REJECTED"
+	AttemptFailureSafeAborted          AttemptFailureCode = "SAFE_ABORTED"
+)
+
+type PurchaseAttempt struct {
+	ID              string
+	TaskID          string
+	AuthorizationID string
+	ClaimGeneration int
+	Status          AttemptStatus
+	Gate1UnitPrice  *string
+	Gate2UnitPrice  *string
+	QuantityRead    *int
+	ConfirmAmount   *string
+	FailureCode     *AttemptFailureCode
+	StartedAt       time.Time
+	FinishedAt      *time.Time
+}
+
+// CanTransitionTo 只允许围栏前的领取恢复为安全失败；围栏后不再提供回退或重试路径。
+func (status AttemptStatus) CanTransitionTo(next AttemptStatus) bool {
+	_, allowed := attemptTransitions[status][next]
+	return allowed
+}
+
+func TransitionAttempt(current, next AttemptStatus) (AttemptStatus, error) {
+	if !current.CanTransitionTo(next) {
+		return current, ErrInvalidAttemptTransition
+	}
+	return next, nil
+}
+
+var attemptTransitions = map[AttemptStatus]map[AttemptStatus]struct{}{
+	AttemptStatusClaimed: {
+		AttemptStatusOrdering:  {},
+		AttemptStatusFailed:    {},
+		AttemptStatusAbandoned: {},
+	},
+	AttemptStatusOrdering: {
+		AttemptStatusFenced:    {},
+		AttemptStatusFailed:    {},
+		AttemptStatusAbandoned: {},
+	},
+}

admin/internal/domain/purchase_attempt_test.go

@@ -0,0 +1,34 @@
+package domain_test
+
+import (
+	"errors"
+	"testing"
+
+	"cmbuyer/admin/internal/domain"
+)
+
+func TestPurchaseAttemptTransitions(t *testing.T) {
+	for _, test := range []struct {
+		current domain.AttemptStatus
+		next    domain.AttemptStatus
+		allowed bool
+	}{
+		{domain.AttemptStatusClaimed, domain.AttemptStatusOrdering, true},
+		{domain.AttemptStatusOrdering, domain.AttemptStatusFenced, true},
+		{domain.AttemptStatusOrdering, domain.AttemptStatusFailed, true},
+		{domain.AttemptStatusFenced, domain.AttemptStatusOrdering, false},
+		{domain.AttemptStatusFenced, domain.AttemptStatusAbandoned, false},
+		{domain.AttemptStatus("UNKNOWN"), domain.AttemptStatusOrdering, false},
+	} {
+		got, err := domain.TransitionAttempt(test.current, test.next)
+		if test.allowed {
+			if err != nil || got != test.next {
+				t.Fatalf("TransitionAttempt(%s, %s) = (%s, %v)", test.current, test.next, got, err)
+			}
+			continue
+		}
+		if !errors.Is(err, domain.ErrInvalidAttemptTransition) || got != test.current {
+			t.Fatalf("invalid TransitionAttempt(%s, %s) = (%s, %v)", test.current, test.next, got, err)
+		}
+	}
+}

admin/internal/domain/spec_trial.go

@@ -1,16 +0,0 @@
-package domain
-
-import "time"
-
-type SpecTrial struct {
-	ID             string
-	TaskID         string
-	Attempt        int
-	ProductTitle   string
-	SelectedColor  string
-	SelectedSize   string
-	UnitPrice      string
-	TotalPrice     string
-	EvidenceSHA256 string
-	CreatedAt      time.Time
-}

admin/internal/domain/submission.go

@@ -17,17 +17,17 @@ const (
 )
 
 type OrderSubmission struct {
-	ID                string
-	TaskID            string
-	AuthorizationID   string
-	CommandID         string
-	DryRunID          string
-	Status            SubmissionStatus
-	VerifiedUnitPrice string
-	QuantityRead      int
-	ConfirmPageAmount string
-	CreatedAt         time.Time
-	ResolvedAt        *time.Time
+	ID              string
+	TaskID          string
+	AuthorizationID string
+	AttemptID       string
+	Status          SubmissionStatus
+	Gate1UnitPrice  string
+	Gate2UnitPrice  string
+	QuantityRead    int
+	ConfirmAmount   string
+	CreatedAt       time.Time
+	ResolvedAt      *time.Time
 }
 
 // CanTransitionTo 只允许围栏记录向最终观察结果调和，拒绝回退以防触发第二次真实动作。

admin/internal/domain/submission_test.go

@@ -20,6 +20,7 @@ func TestSubmissionTransitions(t *testing.T) {
 		{"cannot reopen fenced submission", domain.SubmissionStatusSubmitted, domain.SubmissionStatusFenced, false},
 		{"submitted cannot require reconciliation", domain.SubmissionStatusSubmitted, domain.SubmissionStatusReconciliationRequired, false},
 		{"cannot skip reconciliation", domain.SubmissionStatusFenced, domain.SubmissionStatusManualResolved, false},
+		{"manual resolution cannot create a second submission", domain.SubmissionStatusManualResolved, domain.SubmissionStatusFenced, false},
 	}
 
 	for _, test := range tests {

admin/internal/domain/task.go

@@ -14,15 +14,12 @@ const (
 	TaskStatusDraft                  TaskStatus = "DRAFT"
 	TaskStatusPending                TaskStatus = "PENDING"
 	TaskStatusClaimed                TaskStatus = "CLAIMED"
-	TaskStatusRunning                TaskStatus = "RUNNING"
-	TaskStatusWaitingConfirmation    TaskStatus = "WAITING_CONFIRMATION"
-	TaskStatusPendingRetrial         TaskStatus = "PENDING_RETRIAL"
-	TaskStatusAuthorized             TaskStatus = "AUTHORIZED"
 	TaskStatusOrdering               TaskStatus = "ORDERING"
 	TaskStatusWaitingPayment         TaskStatus = "WAITING_PAYMENT"
 	TaskStatusReconciliationRequired TaskStatus = "RECONCILIATION_REQUIRED"
 	TaskStatusNeedsManual            TaskStatus = "NEEDS_MANUAL"
 	TaskStatusSucceeded              TaskStatus = "SUCCEEDED"
+	TaskStatusFailed                 TaskStatus = "FAILED"
 	TaskStatusCanceled               TaskStatus = "CANCELED"
 )
 
@@ -68,35 +65,32 @@ func TransitionTask(current, next TaskStatus) (TaskStatus, error) {
 
 var taskTransitions = map[TaskStatus]map[TaskStatus]struct{}{
 	TaskStatusDraft: {
-		TaskStatusPending: {},
+		TaskStatusPending:  {},
+		TaskStatusCanceled: {},
 	},
 	TaskStatusPending: {
-		TaskStatusClaimed: {},
-	},
-	TaskStatusPendingRetrial: {
-		TaskStatusClaimed: {},
+		TaskStatusClaimed:  {},
+		TaskStatusDraft:    {},
+		TaskStatusCanceled: {},
 	},
 	TaskStatusClaimed: {
-		TaskStatusRunning: {},
-		TaskStatusPending: {},
-	},
-	TaskStatusRunning: {
-		TaskStatusWaitingConfirmation: {},
-		TaskStatusNeedsManual:         {},
-	},
-	TaskStatusWaitingConfirmation: {
-		TaskStatusCanceled:   {},
-		TaskStatusAuthorized: {},
-	},
-	TaskStatusAuthorized: {
 		TaskStatusOrdering: {},
+		TaskStatusDraft:    {},
 	},
 	TaskStatusOrdering: {
 		TaskStatusNeedsManual:            {},
 		TaskStatusWaitingPayment:         {},
 		TaskStatusReconciliationRequired: {},
 	},
+	TaskStatusNeedsManual: {
+		TaskStatusDraft:    {},
+		TaskStatusCanceled: {},
+	},
 	TaskStatusWaitingPayment: {
 		TaskStatusSucceeded: {},
 	},
+	TaskStatusReconciliationRequired: {
+		TaskStatusWaitingPayment: {},
+		TaskStatusFailed:         {},
+	},
 }

admin/internal/domain/task_test.go

@@ -14,22 +14,24 @@ func TestTaskTransitions(t *testing.T) {
 		next    domain.TaskStatus
 		allowed bool
 	}{
-		{"start trial", domain.TaskStatusDraft, domain.TaskStatusPending, true},
-		{"claim trial", domain.TaskStatusPending, domain.TaskStatusClaimed, true},
-		{"claim retrial", domain.TaskStatusPendingRetrial, domain.TaskStatusClaimed, true},
-		{"start trial execution", domain.TaskStatusClaimed, domain.TaskStatusRunning, true},
-		{"release unstarted claim", domain.TaskStatusClaimed, domain.TaskStatusPending, true},
-		{"trial completes", domain.TaskStatusRunning, domain.TaskStatusWaitingConfirmation, true},
-		{"trial needs manual review", domain.TaskStatusRunning, domain.TaskStatusNeedsManual, true},
-		{"authorize confirmed trial", domain.TaskStatusWaitingConfirmation, domain.TaskStatusAuthorized, true},
-		{"reject confirmed trial", domain.TaskStatusWaitingConfirmation, domain.TaskStatusCanceled, true},
-		{"start authorized order leg", domain.TaskStatusAuthorized, domain.TaskStatusOrdering, true},
+		{"start purchase", domain.TaskStatusDraft, domain.TaskStatusPending, true},
+		{"cancel draft before fence", domain.TaskStatusDraft, domain.TaskStatusCanceled, true},
+		{"claim purchase", domain.TaskStatusPending, domain.TaskStatusClaimed, true},
+		{"release expired authorization", domain.TaskStatusPending, domain.TaskStatusDraft, true},
+		{"start ordering", domain.TaskStatusClaimed, domain.TaskStatusOrdering, true},
+		{"release unstarted claim", domain.TaskStatusClaimed, domain.TaskStatusDraft, true},
+		{"ordering needs manual review", domain.TaskStatusOrdering, domain.TaskStatusNeedsManual, true},
 		{"order reaches payment", domain.TaskStatusOrdering, domain.TaskStatusWaitingPayment, true},
 		{"order needs manual review before fence", domain.TaskStatusOrdering, domain.TaskStatusNeedsManual, true},
 		{"order needs reconciliation", domain.TaskStatusOrdering, domain.TaskStatusReconciliationRequired, true},
+		{"manual review resets draft", domain.TaskStatusNeedsManual, domain.TaskStatusDraft, true},
+		{"manual review cancels before fence", domain.TaskStatusNeedsManual, domain.TaskStatusCanceled, true},
 		{"payment verified", domain.TaskStatusWaitingPayment, domain.TaskStatusSucceeded, true},
-		{"cannot skip trial", domain.TaskStatusDraft, domain.TaskStatusAuthorized, false},
-		{"trial cannot enter order leg", domain.TaskStatusRunning, domain.TaskStatusOrdering, false},
+		{"reconcile confirms waiting payment", domain.TaskStatusReconciliationRequired, domain.TaskStatusWaitingPayment, true},
+		{"reconcile confirms failed", domain.TaskStatusReconciliationRequired, domain.TaskStatusFailed, true},
+		{"cannot skip authorization", domain.TaskStatusDraft, domain.TaskStatusOrdering, false},
+		{"ordering cannot return pending", domain.TaskStatusOrdering, domain.TaskStatusPending, false},
+		{"ordering cannot bypass manual review to draft", domain.TaskStatusOrdering, domain.TaskStatusDraft, false},
 		{"terminal task cannot restart", domain.TaskStatusSucceeded, domain.TaskStatusPending, false},
 		{"unknown status is rejected", domain.TaskStatus("UNKNOWN"), domain.TaskStatusPending, false},
 	}

admin/internal/evidence/evidence.go

@@ -0,0 +1,72 @@
+// Package evidence defines the narrow internal screenshot contract shared by HTTP and storage.
+package evidence
+
+import (
+	"context"
+	"errors"
+	"io"
+	"time"
+
+	"cmbuyer/admin/internal/deviceauth"
+)
+
+const (
+	KindSKUPanelGate1        = "SKU_PANEL_GATE_1"
+	PrivacyInternalRaw       = "INTERNAL_RAW"
+	PNGContentType           = "image/png"
+	MaxFileBytes       int64 = 10 << 20
+	MaxImageSide             = 8192
+	MaxImagePixels           = 16_777_216
+)
+
+var (
+	ErrInvalid  = errors.New("invalid evidence")
+	ErrConflict = errors.New("evidence upload key conflict")
+	ErrNotFound = errors.New("evidence not found")
+	ErrTooLarge = errors.New("evidence file too large")
+)
+
+type UploadMetadata struct {
+	UploadKey   string
+	TaskID      string
+	AttemptID   string
+	Kind        string
+	PrivacyTier string
+	SHA256      string
+	CapturedAt  time.Time
+}
+
+// StagedFile contains only server-generated state. Multipart filenames and client paths never enter this type.
+type StagedFile struct {
+	Path        string
+	SHA256      string
+	ByteSize    int64
+	ContentType string
+	Width       int
+	Height      int
+}
+
+type Asset struct {
+	ID                 string    `json:"asset_id"`
+	TaskID             string    `json:"task_id"`
+	AttemptID          string    `json:"attempt_id"`
+	Kind               string    `json:"kind"`
+	PrivacyTier        string    `json:"privacy_tier"`
+	SHA256             string    `json:"sha256"`
+	ByteSize           int64     `json:"byte_size"`
+	ContentType        string    `json:"content_type"`
+	Width              int       `json:"width_px"`
+	Height             int       `json:"height_px"`
+	CapturedAt         time.Time `json:"captured_at"`
+	UploadedByDeviceID string    `json:"-"`
+	StorageKey         string    `json:"-"`
+	CreatedAt          time.Time `json:"-"`
+}
+
+// Store separates bounded multipart staging from metadata commit so field order cannot weaken validation.
+type Store interface {
+	Stage(io.Reader, string) (StagedFile, error)
+	Discard(StagedFile)
+	Commit(context.Context, deviceauth.Principal, UploadMetadata, StagedFile) (Asset, bool, error)
+	Open(context.Context, string) (Asset, io.ReadSeekCloser, error)
+}

admin/internal/migrations/migrations_test.go

@@ -3,8 +3,11 @@ package migrations_test
 import (
 	"context"
 	"database/sql"
+	"os"
 	"path/filepath"
 	"runtime"
+	"strconv"
+	"strings"
 	"testing"
 
 	"cmbuyer/admin/internal/migrations"
@@ -13,6 +16,8 @@ import (
 	"github.com/pressly/goose/v3"
 )
 
+const migrationTime = "2026-08-04T00:00:00Z"
+
 func TestUpDownAndIdempotence(t *testing.T) {
 	database := openTestDatabase(t)
 	directory := migrationDirectory(t)
@@ -21,173 +26,470 @@ func TestUpDownAndIdempotence(t *testing.T) {
 	if err := migrations.Up(context, database, directory); err != nil {
 		t.Fatalf("apply migrations: %v", err)
 	}
-	assertVersion(t, database, 1)
+	assertVersion(t, database, 4)
 	assertTableExists(t, database, "tasks", true)
-	assertTableExists(t, database, "spec_trials", true)
+	assertTableExists(t, database, "spec_trials", false)
 	assertTableExists(t, database, "order_authorizations", true)
+	assertTableExists(t, database, "purchase_attempts", true)
 	assertTableExists(t, database, "order_submissions", true)
+	assertTableExists(t, database, "evidence_assets", true)
+	assertTableExists(t, database, "device_credentials", true)
+	assertTableExists(t, database, "single_pass_upgrade_guard", false)
 
 	if err := migrations.Up(context, database, directory); err != nil {
 		t.Fatalf("reapply migrations: %v", err)
 	}
-	assertVersion(t, database, 1)
+	assertVersion(t, database, 4)
 
 	if err := migrations.Down(context, database, directory); err != nil {
-		t.Fatalf("roll back migration: %v", err)
+		t.Fatalf("roll back device credential migration: %v", err)
 	}
-	assertVersion(t, database, 0)
-	assertTableExists(t, database, "tasks", false)
-	assertTableExists(t, database, "spec_trials", false)
-	assertTableExists(t, database, "order_authorizations", false)
-	assertTableExists(t, database, "order_submissions", false)
+	assertVersion(t, database, 3)
+	assertTableExists(t, database, "device_credentials", false)
+	assertTableExists(t, database, "evidence_assets", true)
 
-	if err := migrations.Up(context, database, directory); err != nil {
-		t.Fatalf("apply migration after rollback: %v", err)
+	if err := migrations.Down(context, database, directory); err != nil {
+		t.Fatalf("roll back evidence migration: %v", err)
+	}
+	assertVersion(t, database, 2)
+	assertTableExists(t, database, "evidence_assets", false)
+
+	if err := migrations.Down(context, database, directory); err != nil {
+		t.Fatalf("roll back v2 migration: %v", err)
 	}
 	assertVersion(t, database, 1)
+	assertTableExists(t, database, "spec_trials", true)
+	assertTableExists(t, database, "purchase_attempts", false)
+	assertTableExists(t, database, "single_pass_downgrade_guard", false)
+
+	if err := migrations.Up(context, database, directory); err != nil {
+		t.Fatalf("reapply v2 after rollback: %v", err)
+	}
+	assertVersion(t, database, 4)
 }
 
-func TestSchemaConstraints(t *testing.T) {
+func TestUpgradePreservesManualDraftLosslessly(t *testing.T) {
+	database := openTestDatabase(t)
+	migrateToV1(t, database)
+	if _, err := database.Exec(`
+		INSERT INTO tasks (
+			id, source, source_ref, title, goods_id, sku_color, sku_size, quantity, max_total_price,
+			reference_asset_id, status, version, created_at, updated_at
+		) VALUES ('draft-one', 'MANUAL', 'source-ref', 'title', 'goods', 'white', 'XL', 2, '80.50',
+			'asset-id', 'DRAFT', 7, '2026-08-03T00:00:00Z', '2026-08-03T01:00:00Z')
+	`); err != nil {
+		t.Fatalf("insert v1 draft: %v", err)
+	}
+
+	if err := migrations.Up(context.Background(), database, migrationDirectory(t)); err != nil {
+		t.Fatalf("upgrade v1 draft: %v", err)
+	}
+	assertVersion(t, database, 4)
+	var got struct {
+		id, source, sourceRef, title, goodsID, color, size, maxPrice, assetID, status, created, updated string
+		quantity, version                                                                               int
+	}
+	if err := database.QueryRow(`SELECT id, source, source_ref, title, goods_id, sku_color, sku_size, quantity, max_total_price, reference_asset_id, status, version, created_at, updated_at FROM tasks WHERE id = 'draft-one'`).Scan(
+		&got.id, &got.source, &got.sourceRef, &got.title, &got.goodsID, &got.color, &got.size, &got.quantity, &got.maxPrice, &got.assetID, &got.status, &got.version, &got.created, &got.updated,
+	); err != nil {
+		t.Fatalf("read upgraded draft: %v", err)
+	}
+	if got != (struct {
+		id, source, sourceRef, title, goodsID, color, size, maxPrice, assetID, status, created, updated string
+		quantity, version                                                                               int
+	}{"draft-one", "MANUAL", "source-ref", "title", "goods", "white", "XL", "80.50", "asset-id", "DRAFT", "2026-08-03T00:00:00Z", "2026-08-03T01:00:00Z", 2, 7}) {
+		t.Fatalf("upgraded draft changed: %#v", got)
+	}
+}
+
+func TestUpgradeRejectsLegacyExecutionDataAtomically(t *testing.T) {
+	tests := []struct {
+		name  string
+		setup func(*testing.T, *sql.DB)
+	}{
+		{"non-draft task", func(t *testing.T, database *sql.DB) {
+			insertV1Task(t, database, "pending", "MANUAL", "PENDING", "1.00")
+		}},
+		{"non-manual task", func(t *testing.T, database *sql.DB) { insertV1Task(t, database, "excel", "EXCEL", "DRAFT", "1.00") }},
+		{"invalid v2 money", func(t *testing.T, database *sql.DB) { insertV1Task(t, database, "zero", "MANUAL", "DRAFT", "0.00") }},
+		{"third decimal place", func(t *testing.T, database *sql.DB) {
+			insertV1Task(t, database, "third-decimal", "MANUAL", "DRAFT", "1.234")
+		}},
+		{"spec trial", func(t *testing.T, database *sql.DB) {
+			insertV1Task(t, database, "task", "MANUAL", "DRAFT", "1.00")
+			insertV1SpecTrial(t, database, "trial", "task")
+		}},
+		{"authorization", func(t *testing.T, database *sql.DB) {
+			insertV1Task(t, database, "task", "MANUAL", "DRAFT", "1.00")
+			insertV1SpecTrial(t, database, "trial", "task")
+			insertV1Authorization(t, database, "auth", "task", "trial")
+		}},
+		{"submission", func(t *testing.T, database *sql.DB) {
+			insertV1Task(t, database, "task", "MANUAL", "DRAFT", "1.00")
+			insertV1SpecTrial(t, database, "trial", "task")
+			insertV1Authorization(t, database, "auth", "task", "trial")
+			if _, err := database.Exec(`INSERT INTO order_submissions (id, task_id, authorization_id, command_id, dry_run_id, status, verified_unit_price, quantity_read, confirm_page_amount, created_at) VALUES ('submission', 'task', 'auth', 'command', 'dry-run', 'FENCED', '1.00', 1, '1.00', ? )`, migrationTime); err != nil {
+				t.Fatalf("insert v1 submission: %v", err)
+			}
+		}},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			database := openTestDatabase(t)
+			migrateToV1(t, database)
+			test.setup(t, database)
+			before := v1RowCount(t, database)
+			if err := migrations.Up(context.Background(), database, migrationDirectory(t)); err == nil {
+				t.Fatal("unsafe legacy data upgraded successfully")
+			}
+			assertVersion(t, database, 1)
+			assertTableExists(t, database, "spec_trials", true)
+			assertTableExists(t, database, "purchase_attempts", false)
+			assertTableExists(t, database, "single_pass_upgrade_guard", false)
+			if after := v1RowCount(t, database); after != before {
+				t.Fatalf("v1 data changed after rejection: before=%d after=%d", before, after)
+			}
+		})
+	}
+}
+
+func TestV2SchemaConstraintsAndRelationships(t *testing.T) {
 	database := openTestDatabase(t)
 	if err := migrations.Up(context.Background(), database, migrationDirectory(t)); err != nil {
 		t.Fatalf("apply migrations: %v", err)
 	}
-
-	for _, column := range []struct {
-		table string
-		name  string
-	}{
+	for _, column := range []struct{ table, name string }{
 		{"tasks", "max_total_price"},
-		{"spec_trials", "unit_price"},
-		{"spec_trials", "total_price"},
-		{"order_authorizations", "authorized_unit_price"},
 		{"order_authorizations", "total_price_cap"},
-		{"order_submissions", "verified_unit_price"},
-		{"order_submissions", "confirm_page_amount"},
+		{"purchase_attempts", "gate1_unit_price"},
+		{"purchase_attempts", "gate2_unit_price"},
+		{"purchase_attempts", "confirm_amount"},
+		{"order_submissions", "gate1_unit_price"},
+		{"order_submissions", "gate2_unit_price"},
+		{"order_submissions", "confirm_amount"},
 	} {
 		assertColumnType(t, database, column.table, column.name, "TEXT")
 	}
-
-	if _, err := database.Exec(`
-		INSERT INTO tasks (
-			id, source, title, goods_id, sku_color, sku_size, quantity, max_total_price,
-			status, created_at, updated_at
-		) VALUES ('bad-quantity', 'MANUAL', 'title', 'goods', 'white', 'XL', 0, '80.00', 'DRAFT', '2026-08-03T00:00:00Z', '2026-08-03T00:00:00Z')
-	`); err == nil {
-		t.Fatal("insert task with quantity 0 succeeded")
+	for _, legacy := range []string{"spec_trials", "authorized_unit_price", "spec_trial_id", "command_id", "dry_run_id"} {
+		var count int
+		if err := database.QueryRow(`SELECT COUNT(*) FROM sqlite_master WHERE sql LIKE '%' || ? || '%'`, legacy).Scan(&count); err != nil {
+			t.Fatalf("search schema for %s: %v", legacy, err)
+		}
+		if count != 0 {
+			t.Fatalf("legacy identifier %q remains in v2 schema", legacy)
+		}
 	}
 
-	if _, err := database.Exec(`
-		INSERT INTO tasks (
-			id, source, title, goods_id, sku_color, sku_size, quantity, max_total_price,
-			status, created_at, updated_at
-		) VALUES ('bad-price', 'MANUAL', 'title', 'goods', 'white', 'XL', 1, '80..00', 'DRAFT', '2026-08-03T00:00:00Z', '2026-08-03T00:00:00Z')
-	`); err == nil {
-		t.Fatal("insert task with malformed decimal price succeeded")
+	insertV2Task(t, database, "task-one", "MANUAL", "DRAFT")
+	insertV2Task(t, database, "task-two", "MANUAL", "DRAFT")
+	for index, value := range []string{"", "0", "0.00", "-1.00", "1e2", "1.", "1.234", " 1.00", "one"} {
+		if _, err := database.Exec(`INSERT INTO tasks (id, source, title, goods_id, sku_color, sku_size, quantity, max_total_price, status, created_at, updated_at) VALUES (?, 'MANUAL', 'title', 'goods', 'white', 'XL', 1, ?, 'DRAFT', ?, ?)`, "bad-price-"+strconv.Itoa(index), value, migrationTime, migrationTime); err == nil {
+			t.Fatalf("invalid total price %q succeeded", value)
+		}
+	}
+	if _, err := database.Exec(`INSERT INTO tasks (id, source, title, goods_id, sku_color, sku_size, quantity, max_total_price, status, created_at, updated_at) VALUES ('bad-status', 'MANUAL', 'title', 'goods', 'white', 'XL', 1, '1.00', 'UNKNOWN', ?, ?)`, migrationTime, migrationTime); err == nil {
+		t.Fatal("unknown task status succeeded")
+	}
+	insertV2Authorization(t, database, "auth-one", "task-one", 1, "start-one")
+	insertV2Authorization(t, database, "auth-two", "task-two", 1, "start-two")
+	if _, err := database.Exec(`INSERT INTO order_authorizations (id, task_id, task_version, start_key, goods_id, sku_color, sku_size, quantity, total_price_cap, status, created_by, created_at, expires_at) VALUES ('bad-auth-price', 'task-one', 2, 'bad-price', 'goods', 'white', 'XL', 1, '1.234', 'ACTIVE', 'admin', ?, ?)`, migrationTime, migrationTime); err == nil {
+		t.Fatal("third decimal authorization cap succeeded")
+	}
+	if _, err := database.Exec(`INSERT INTO order_authorizations (id, task_id, task_version, start_key, goods_id, sku_color, sku_size, quantity, total_price_cap, status, created_by, created_at, expires_at) VALUES ('bad-auth-status', 'task-one', 2, 'bad-status', 'goods', 'white', 'XL', 1, '1.00', 'UNKNOWN', 'admin', ?, ?)`, migrationTime, migrationTime); err == nil {
+		t.Fatal("unknown authorization status succeeded")
+	}
+	insertV2Authorization(t, database, "auth-one-b", "task-one", 2, "start-one-b")
+	if _, err := database.Exec(`INSERT INTO order_authorizations (id, task_id, task_version, start_key, goods_id, sku_color, sku_size, quantity, total_price_cap, status, created_by, created_at, expires_at) VALUES ('duplicate-version', 'task-one', 1, 'different-start', 'goods', 'white', 'XL', 1, '1.00', 'ACTIVE', 'admin', ?, ?)`, migrationTime, migrationTime); err == nil {
+		t.Fatal("duplicate task version authorization succeeded")
+	}
+	if _, err := database.Exec(`INSERT INTO purchase_attempts (id, task_id, authorization_id, claim_generation, status, started_at) VALUES ('cross-attempt', 'task-one', 'auth-two', 1, 'CLAIMED', ?)`, migrationTime); err == nil {
+		t.Fatal("attempt using another task authorization succeeded")
+	}
+	insertV2Attempt(t, database, "attempt-one", "task-one", "auth-one", 1)
+	if _, err := database.Exec(`INSERT INTO purchase_attempts (id, task_id, authorization_id, claim_generation, status, gate1_unit_price, started_at) VALUES ('bad-attempt-price', 'task-one', 'auth-one', 2, 'ORDERING', '1.234', ?)`, migrationTime); err == nil {
+		t.Fatal("third decimal gate price succeeded")
+	}
+	if _, err := database.Exec(`INSERT INTO purchase_attempts (id, task_id, authorization_id, claim_generation, status, started_at) VALUES ('bad-attempt-status', 'task-one', 'auth-one', 2, 'UNKNOWN', ?)`, migrationTime); err == nil {
+		t.Fatal("unknown attempt status succeeded")
+	}
+	if _, err := database.Exec(`INSERT INTO purchase_attempts (id, task_id, authorization_id, claim_generation, status, failure_code, started_at) VALUES ('bad-code', 'task-one', 'auth-one', 2, 'FAILED', 'FREE_TEXT', ?)`, migrationTime); err == nil {
+		t.Fatal("unknown failure code succeeded")
+	}
+	if _, err := database.Exec(`INSERT INTO order_submissions (id, task_id, authorization_id, attempt_id, status, gate1_unit_price, gate2_unit_price, quantity_read, confirm_amount, created_at) VALUES ('cross-submission', 'task-one', 'auth-two', 'attempt-one', 'FENCED', '1.00', '1.00', 1, '1.00', ?)`, migrationTime); err == nil {
+		t.Fatal("submission using another task authorization succeeded")
+	}
+	if _, err := database.Exec(`INSERT INTO order_submissions (id, task_id, authorization_id, attempt_id, status, gate1_unit_price, gate2_unit_price, quantity_read, confirm_amount, created_at) VALUES ('cross-authorization-submission', 'task-one', 'auth-one-b', 'attempt-one', 'FENCED', '1.00', '1.00', 1, '1.00', ?)`, migrationTime); err == nil {
+		t.Fatal("submission combining another same-task authorization and attempt succeeded")
+	}
+	if _, err := database.Exec(`INSERT INTO order_submissions (id, task_id, authorization_id, attempt_id, status, gate1_unit_price, gate2_unit_price, quantity_read, confirm_amount, created_at) VALUES ('bad-submission-status', 'task-one', 'auth-one', 'attempt-one', 'UNKNOWN', '1.00', '1.00', 1, '1.00', ?)`, migrationTime); err == nil {
+		t.Fatal("unknown submission status succeeded")
+	}
+	if _, err := database.Exec(`INSERT INTO order_submissions (id, task_id, authorization_id, attempt_id, status, gate1_unit_price, gate2_unit_price, quantity_read, confirm_amount, created_at) VALUES ('bad-submission-price', 'task-one', 'auth-one', 'attempt-one', 'FENCED', '1.234', '1.00', 1, '1.00', ?)`, migrationTime); err == nil {
+		t.Fatal("third decimal submission price succeeded")
+	}
+	insertV2Submission(t, database, "submission-one", "task-one", "auth-one", "attempt-one")
+	if _, err := database.Exec(`INSERT INTO order_submissions (id, task_id, authorization_id, attempt_id, status, gate1_unit_price, gate2_unit_price, quantity_read, confirm_amount, created_at) VALUES ('duplicate-auth', 'task-one', 'auth-one', 'attempt-one', 'FENCED', '1.00', '1.00', 1, '1.00', ?)`, migrationTime); err == nil {
+		t.Fatal("second submission for fenced authorization succeeded")
+	}
+}
+
+func TestEvidenceSchemaConstraintsAndDowngradeGuard(t *testing.T) {
+	database := openTestDatabase(t)
+	if err := migrations.Up(context.Background(), database, migrationDirectory(t)); err != nil {
+		t.Fatalf("apply migrations: %v", err)
+	}
+	insertV2Task(t, database, "task-one", "MANUAL", "DRAFT")
+	insertV2Authorization(t, database, "auth-one", "task-one", 1, "start-one")
+	insertV2Attempt(t, database, "attempt-one", "task-one", "auth-one", 1)
+	insertV2Task(t, database, "task-two", "MANUAL", "DRAFT")
+	insertV2Authorization(t, database, "auth-two", "task-two", 1, "start-two")
+	insertV2Attempt(t, database, "attempt-two", "task-two", "auth-two", 1)
+	hash := strings.Repeat("a", 64)
+	insert := `INSERT INTO evidence_assets (id, upload_key, task_id, attempt_id, kind, privacy_tier, sha256, byte_size, content_type, width_px, height_px, storage_key, uploaded_by_device_id, captured_at, created_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
+	validArgs := []any{"asset-one", "upload-one", "task-one", "attempt-one", "SKU_PANEL_GATE_1", "INTERNAL_RAW", hash, 100, "image/png", 100, 100, "aa/" + hash + ".png", "device-one", migrationTime, migrationTime}
+	if _, err := database.Exec(insert, validArgs...); err != nil {
+		t.Fatalf("insert valid evidence: %v", err)
+	}
+	for name, mutate := range map[string]func([]any){
+		"attempt from another task": func(values []any) { values[0], values[1], values[3] = "bad-task", "upload-bad-task", "attempt-two" },
+		"unapproved kind":           func(values []any) { values[0], values[1], values[4] = "bad-kind", "upload-bad-kind", "ORDER_CONFIRM" },
+		"wrong privacy":             func(values []any) { values[0], values[1], values[5] = "bad-privacy", "upload-bad-privacy", "PUBLIC" },
+		"uppercase hash": func(values []any) {
+			values[0], values[1], values[6], values[11] = "bad-hash", "upload-bad-hash", strings.Repeat("A", 64), "AA/"+strings.Repeat("A", 64)+".png"
+		},
+		"too many pixels": func(values []any) {
+			values[0], values[1], values[9], values[10] = "bad-pixels", "upload-bad-pixels", 8192, 8192
+		},
+		"client path": func(values []any) { values[0], values[1], values[11] = "bad-path", "upload-bad-path", `..\secret.png` },
+	} {
+		t.Run(name, func(t *testing.T) {
+			values := append([]any(nil), validArgs...)
+			mutate(values)
+			if _, err := database.Exec(insert, values...); err == nil {
+				t.Fatal("invalid evidence row succeeded")
+			}
+		})
 	}
 
-	if _, err := database.Exec(`
-		INSERT INTO tasks (
-			id, source, title, goods_id, sku_color, sku_size, quantity, max_total_price,
-			status, created_at, updated_at
-		) VALUES ('fractional-quantity', 'MANUAL', 'title', 'goods', 'white', 'XL', 1.5, '80.00', 'DRAFT', '2026-08-03T00:00:00Z', '2026-08-03T00:00:00Z')
-	`); err == nil {
-		t.Fatal("insert task with fractional quantity succeeded")
+	if err := migrations.Down(context.Background(), database, migrationDirectory(t)); err != nil {
+		t.Fatalf("roll back empty device credential migration: %v", err)
+	}
+	if err := migrations.Down(context.Background(), database, migrationDirectory(t)); err == nil {
+		t.Fatal("evidence-bearing schema downgraded successfully")
+	}
+	assertVersion(t, database, 3)
+	assertTableExists(t, database, "evidence_assets", true)
+	var count int
+	if err := database.QueryRow("SELECT COUNT(*) FROM evidence_assets").Scan(&count); err != nil || count != 1 {
+		t.Fatalf("evidence after rejected downgrade = %d, err=%v", count, err)
+	}
+}
+
+func TestDeviceCredentialSchemaConstraintsAndDowngradeGuard(t *testing.T) {
+	database := openTestDatabase(t)
+	if err := migrations.Up(context.Background(), database, migrationDirectory(t)); err != nil {
+		t.Fatalf("apply migrations: %v", err)
+	}
+	deviceID := "13c9f507-7473-4fa6-8d71-8786c34c6301"
+	hash := make([]byte, 32)
+	for index := range hash {
+		hash[index] = byte(index + 1)
+	}
+	insert := `INSERT INTO device_credentials (device_id, display_name, token_sha256, status, created_at, revoked_at) VALUES (?, ?, ?, ?, ?, ?)`
+	valid := []any{deviceID, "采购工具一号", hash, "ACTIVE", migrationTime, nil}
+	if _, err := database.Exec(insert, valid...); err != nil {
+		t.Fatalf("insert valid credential: %v", err)
+	}
+	for name, mutate := range map[string]func([]any){
+		"uppercase uuid": func(values []any) { values[0], values[2] = strings.ToUpper(deviceID), append([]byte(nil), hash...) },
+		"wrong uuid version": func(values []any) {
+			values[0], values[2] = "23c9f507-7473-3fa6-8d71-8786c34c6301", append([]byte(nil), hash...)
+		},
+		"blank display name": func(values []any) {
+			values[0], values[1], values[2] = "33c9f507-7473-4fa6-8d71-8786c34c6301", "", append([]byte(nil), hash...)
+		},
+		"padded display name": func(values []any) {
+			values[0], values[1], values[2] = "43c9f507-7473-4fa6-8d71-8786c34c6301", " padded", append([]byte(nil), hash...)
+		},
+		"text hash": func(values []any) {
+			values[0], values[2] = "53c9f507-7473-4fa6-8d71-8786c34c6301", strings.Repeat("a", 32)
+		},
+		"short blob hash": func(values []any) { values[0], values[2] = "63c9f507-7473-4fa6-8d71-8786c34c6301", make([]byte, 31) },
+		"unknown status": func(values []any) {
+			values[0], values[2], values[3] = "73c9f507-7473-4fa6-8d71-8786c34c6301", append([]byte(nil), hash...), "UNKNOWN"
+		},
+		"active with revoke time": func(values []any) {
+			values[0], values[2], values[5] = "83c9f507-7473-4fa6-8d71-8786c34c6301", append([]byte(nil), hash...), migrationTime
+		},
+		"revoked without time": func(values []any) {
+			values[0], values[2], values[3] = "93c9f507-7473-4fa6-8d71-8786c34c6301", append([]byte(nil), hash...), "REVOKED"
+		},
+		"revoke before creation": func(values []any) {
+			values[0], values[2], values[3], values[4], values[5] = "b3c9f507-7473-4fa6-8d71-8786c34c6301", append([]byte(nil), hash...), "REVOKED", "2026-08-04T01:00:00Z", "2026-08-04T00:00:00Z"
+		},
+		"non UTC created time": func(values []any) {
+			values[0], values[2], values[4] = "a3c9f507-7473-4fa6-8d71-8786c34c6301", append([]byte(nil), hash...), "2026-08-04T08:00:00+08:00"
+		},
+	} {
+		t.Run(name, func(t *testing.T) {
+			values := append([]any(nil), valid...)
+			mutate(values)
+			if bytesValue, ok := values[2].([]byte); ok && len(bytesValue) == 32 {
+				bytesValue[0]++
+			}
+			if _, err := database.Exec(insert, values...); err == nil {
+				t.Fatal("invalid device credential row succeeded")
+			}
+		})
 	}
 
-	if _, err := database.Exec(`
-		INSERT INTO tasks (
-			id, source, title, goods_id, sku_color, sku_size, quantity, max_total_price,
-			status, created_at, updated_at
-		) VALUES ('trailing-decimal', 'MANUAL', 'title', 'goods', 'white', 'XL', 1, '80.', 'DRAFT', '2026-08-03T00:00:00Z', '2026-08-03T00:00:00Z')
-	`); err == nil {
-		t.Fatal("insert task with trailing decimal point succeeded")
+	if err := migrations.Down(context.Background(), database, migrationDirectory(t)); err == nil {
+		t.Fatal("credential-bearing schema downgraded successfully")
 	}
+	assertVersion(t, database, 4)
+	assertTableExists(t, database, "device_credentials", true)
+	var count int
+	if err := database.QueryRow(`SELECT COUNT(*) FROM device_credentials`).Scan(&count); err != nil || count != 1 {
+		t.Fatalf("credentials after rejected downgrade = %d, err=%v", count, err)
+	}
+}
 
-	if _, err := database.Exec(`
-		INSERT INTO tasks (
-			id, source, title, goods_id, sku_color, sku_size, quantity, max_total_price,
-			status, created_at, updated_at
-		) VALUES ('bad-status', 'MANUAL', 'title', 'goods', 'white', 'XL', 1, '80.00', 'UNKNOWN', '2026-08-03T00:00:00Z', '2026-08-03T00:00:00Z')
-	`); err == nil {
-		t.Fatal("insert task with invalid status succeeded")
+func TestDowngradeRejectsV2BusinessDataAtomically(t *testing.T) {
+	tests := []struct {
+		name  string
+		setup func(*testing.T, *sql.DB)
+	}{
+		{"authorization", func(t *testing.T, database *sql.DB) {
+			insertV2Task(t, database, "task", "MANUAL", "DRAFT")
+			insertV2Authorization(t, database, "auth", "task", 1, "start")
+		}},
+		{"attempt", func(t *testing.T, database *sql.DB) {
+			insertV2Task(t, database, "task", "MANUAL", "DRAFT")
+			insertV2Authorization(t, database, "auth", "task", 1, "start")
+			insertV2Attempt(t, database, "attempt", "task", "auth", 1)
+		}},
+		{"submission", func(t *testing.T, database *sql.DB) {
+			insertV2Task(t, database, "task", "MANUAL", "DRAFT")
+			insertV2Authorization(t, database, "auth", "task", 1, "start")
+			insertV2Attempt(t, database, "attempt", "task", "auth", 1)
+			insertV2Submission(t, database, "submission", "task", "auth", "attempt")
+		}},
+		{"non-draft task", func(t *testing.T, database *sql.DB) { insertV2Task(t, database, "pending", "MANUAL", "PENDING") }},
+		{"non-manual task", func(t *testing.T, database *sql.DB) { insertV2Task(t, database, "excel", "EXCEL", "DRAFT") }},
 	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			database := openTestDatabase(t)
+			migrateToV2(t, database)
+			test.setup(t, database)
+			before := v2RowCount(t, database)
+			if err := migrations.Down(context.Background(), database, migrationDirectory(t)); err == nil {
+				t.Fatal("unsafe v2 data downgraded successfully")
+			}
+			assertVersion(t, database, 2)
+			assertTableExists(t, database, "purchase_attempts", true)
+			assertTableExists(t, database, "spec_trials", false)
+			assertTableExists(t, database, "single_pass_downgrade_guard", false)
+			if after := v2RowCount(t, database); after != before {
+				t.Fatalf("v2 data changed after rejected downgrade: before=%d after=%d", before, after)
+			}
+		})
+	}
+}
 
-	insertTask(t, database, "task-one")
-	insertTask(t, database, "task-two")
-	if _, err := database.Exec(`
-		INSERT INTO spec_trials (
-			id, task_id, attempt, product_title, selected_color, selected_size, unit_price,
-			total_price, evidence_sha256, created_at
-		) VALUES ('orphan-trial', 'missing-task', 1, 'title', 'white', 'XL', '32.50', '65.00', 'hash', '2026-08-03T00:00:00Z')
-	`); err == nil {
-		t.Fatal("insert spec trial without task succeeded")
+func migrateToV1(t *testing.T, database *sql.DB) {
+	t.Helper()
+	if err := migrations.Run(context.Background(), database, migrationDirectory(t), "up-by-one"); err != nil {
+		t.Fatalf("apply v1: %v", err)
 	}
+	assertVersion(t, database, 1)
+}
 
-	insertSpecTrial(t, database, "trial-one", "task-one")
-	insertSpecTrial(t, database, "trial-two", "task-two")
-	if _, err := database.Exec(`
-		INSERT INTO order_authorizations (
-			id, task_id, spec_trial_id, version, goods_id, sku_color, sku_size, quantity,
-			authorized_unit_price, total_price_cap, status, created_by, created_at, expires_at
-		) VALUES ('authorization-cross-task', 'task-one', 'trial-two', 1, 'goods', 'white', 'XL', 2, '32.50', '80.00', 'PENDING_DELIVERY', 'admin-one', '2026-08-03T00:00:00Z', '2026-08-03T01:00:00Z')
-	`); err == nil {
-		t.Fatal("insert authorization with a spec trial from another task succeeded")
+func migrateToV2(t *testing.T, database *sql.DB) {
+	t.Helper()
+	if err := migrations.Run(context.Background(), database, migrationDirectory(t), "up-by-one"); err != nil {
+		t.Fatalf("apply v1: %v", err)
 	}
+	if err := migrations.Run(context.Background(), database, migrationDirectory(t), "up-by-one"); err != nil {
+		t.Fatalf("apply v2: %v", err)
+	}
+	assertVersion(t, database, 2)
+}
 
-	insertAuthorization(t, database, "authorization-one", "task-one", "trial-one", 1)
-	insertAuthorization(t, database, "authorization-task-two", "task-two", "trial-two", 1)
-	if _, err := database.Exec(`
-		INSERT INTO order_submissions (
-			id, task_id, authorization_id, command_id, dry_run_id, status, verified_unit_price,
-			quantity_read, confirm_page_amount, created_at
-		) VALUES ('submission-cross-task', 'task-one', 'authorization-task-two', 'command-cross-task', 'dry-run-cross-task', 'FENCED', '32.50', 2, '65.00', '2026-08-03T00:00:00Z')
-	`); err == nil {
-		t.Fatal("insert submission with an authorization from another task succeeded")
+func insertV1Task(t *testing.T, database *sql.DB, id, source, status, price string) {
+	t.Helper()
+	if _, err := database.Exec(`INSERT INTO tasks (id, source, title, goods_id, sku_color, sku_size, quantity, max_total_price, status, created_at, updated_at) VALUES (?, ?, 'title', 'goods', 'white', 'XL', 1, ?, ?, ?, ?)`, id, source, price, status, migrationTime, migrationTime); err != nil {
+		t.Fatalf("insert v1 task: %v", err)
 	}
+}
 
-	if _, err := database.Exec(`
-		INSERT INTO order_authorizations (
-			id, task_id, spec_trial_id, version, goods_id, sku_color, sku_size, quantity,
-			authorized_unit_price, total_price_cap, status, created_by, created_at, expires_at
-		) VALUES ('authorization-duplicate', 'task-one', 'trial-one', 1, 'goods', 'white', 'XL', 2, '32.50', '80.00', 'PENDING_DELIVERY', 'admin-one', '2026-08-03T00:00:00Z', '2026-08-03T01:00:00Z')
-	`); err == nil {
-		t.Fatal("insert authorization with duplicate task version succeeded")
+func insertV1SpecTrial(t *testing.T, database *sql.DB, id, taskID string) {
+	t.Helper()
+	if _, err := database.Exec(`INSERT INTO spec_trials (id, task_id, attempt, product_title, selected_color, selected_size, unit_price, total_price, evidence_sha256, created_at) VALUES (?, ?, 1, 'title', 'white', 'XL', '1.00', '1.00', 'hash', ?)`, id, taskID, migrationTime); err != nil {
+		t.Fatalf("insert v1 spec trial: %v", err)
 	}
+}
 
-	insertSubmission(t, database, "submission-one", "authorization-one", "command-one")
-	if _, err := database.Exec(`
-		INSERT INTO order_submissions (
-			id, task_id, authorization_id, command_id, dry_run_id, status, verified_unit_price,
-			quantity_read, confirm_page_amount, created_at
-		) VALUES ('submission-duplicate-auth', 'task-one', 'authorization-one', 'command-two', 'dry-run-two', 'FENCED', '32.50', 2, '65.00', '2026-08-03T00:00:00Z')
-	`); err == nil {
-		t.Fatal("insert submission with duplicate authorization succeeded")
+func insertV1Authorization(t *testing.T, database *sql.DB, id, taskID, trialID string) {
+	t.Helper()
+	if _, err := database.Exec(`INSERT INTO order_authorizations (id, task_id, spec_trial_id, version, goods_id, sku_color, sku_size, quantity, authorized_unit_price, total_price_cap, status, created_by, created_at, expires_at) VALUES (?, ?, ?, 1, 'goods', 'white', 'XL', 1, '1.00', '1.00', 'PENDING_DELIVERY', 'admin', ?, ?)`, id, taskID, trialID, migrationTime, migrationTime); err != nil {
+		t.Fatalf("insert v1 authorization: %v", err)
 	}
+}
 
-	insertAuthorization(t, database, "authorization-two", "task-one", "trial-one", 2)
-	if _, err := database.Exec(`
-		INSERT INTO order_submissions (
-			id, task_id, authorization_id, command_id, dry_run_id, status, verified_unit_price,
-			quantity_read, confirm_page_amount, created_at
-		) VALUES ('submission-duplicate-command', 'task-one', 'authorization-two', 'command-one', 'dry-run-three', 'FENCED', '32.50', 2, '65.00', '2026-08-03T00:00:00Z')
-	`); err == nil {
-		t.Fatal("insert submission with duplicate command succeeded")
+func insertV2Task(t *testing.T, database *sql.DB, id, source, status string) {
+	t.Helper()
+	if _, err := database.Exec(`INSERT INTO tasks (id, source, title, goods_id, sku_color, sku_size, quantity, max_total_price, status, created_at, updated_at) VALUES (?, ?, 'title', 'goods', 'white', 'XL', 1, '1.00', ?, ?, ?)`, id, source, status, migrationTime, migrationTime); err != nil {
+		t.Fatalf("insert v2 task: %v", err)
 	}
 }
 
+func insertV2Authorization(t *testing.T, database *sql.DB, id, taskID string, version int, startKey string) {
+	t.Helper()
+	if _, err := database.Exec(`INSERT INTO order_authorizations (id, task_id, task_version, start_key, goods_id, sku_color, sku_size, quantity, total_price_cap, status, created_by, created_at, expires_at) VALUES (?, ?, ?, ?, 'goods', 'white', 'XL', 1, '1.00', 'ACTIVE', 'admin', ?, ?)`, id, taskID, version, startKey, migrationTime, migrationTime); err != nil {
+		t.Fatalf("insert v2 authorization: %v", err)
+	}
+}
+
+func insertV2Attempt(t *testing.T, database *sql.DB, id, taskID, authorizationID string, generation int) {
+	t.Helper()
+	if _, err := database.Exec(`INSERT INTO purchase_attempts (id, task_id, authorization_id, claim_generation, status, started_at) VALUES (?, ?, ?, ?, 'CLAIMED', ?)`, id, taskID, authorizationID, generation, migrationTime); err != nil {
+		t.Fatalf("insert v2 attempt: %v", err)
+	}
+}
+
+func insertV2Submission(t *testing.T, database *sql.DB, id, taskID, authorizationID, attemptID string) {
+	t.Helper()
+	if _, err := database.Exec(`INSERT INTO order_submissions (id, task_id, authorization_id, attempt_id, status, gate1_unit_price, gate2_unit_price, quantity_read, confirm_amount, created_at) VALUES (?, ?, ?, ?, 'FENCED', '1.00', '1.00', 1, '1.00', ?)`, id, taskID, authorizationID, attemptID, migrationTime); err != nil {
+		t.Fatalf("insert v2 submission: %v", err)
+	}
+}
+
+func v1RowCount(t *testing.T, database *sql.DB) int {
+	t.Helper()
+	var count int
+	if err := database.QueryRow(`SELECT (SELECT COUNT(*) FROM tasks) + (SELECT COUNT(*) FROM spec_trials) + (SELECT COUNT(*) FROM order_authorizations) + (SELECT COUNT(*) FROM order_submissions)`).Scan(&count); err != nil {
+		t.Fatalf("count v1 rows: %v", err)
+	}
+	return count
+}
+
+func v2RowCount(t *testing.T, database *sql.DB) int {
+	t.Helper()
+	var count int
+	if err := database.QueryRow(`SELECT (SELECT COUNT(*) FROM tasks) + (SELECT COUNT(*) FROM order_authorizations) + (SELECT COUNT(*) FROM purchase_attempts) + (SELECT COUNT(*) FROM order_submissions)`).Scan(&count); err != nil {
+		t.Fatalf("count v2 rows: %v", err)
+	}
+	return count
+}
+
 func openTestDatabase(t *testing.T) *sql.DB {
 	t.Helper()
 	database, err := sqlite.Open(filepath.Join(t.TempDir(), "migrations.db"))
 	if err != nil {
 		t.Fatalf("open test database: %v", err)
 	}
-	t.Cleanup(func() {
-		if err := database.Close(); err != nil {
-			t.Errorf("close test database: %v", err)
-		}
-	})
-
+	t.Cleanup(func() { _ = database.Close() })
 	return database
 }
 
@@ -197,7 +499,6 @@ func migrationDirectory(t *testing.T) string {
 	if !ok {
 		t.Fatal("locate migration test source")
 	}
-
 	return filepath.Join(filepath.Dir(file), "..", "..", "migrations")
 }
 
@@ -234,50 +535,14 @@ func assertColumnType(t *testing.T, database *sql.DB, table, column, want string
 	}
 }
 
-func insertTask(t *testing.T, database *sql.DB, id string) {
-	t.Helper()
-	if _, err := database.Exec(`
-		INSERT INTO tasks (
-			id, source, title, goods_id, sku_color, sku_size, quantity, max_total_price,
-			status, created_at, updated_at
-		) VALUES (?, 'MANUAL', 'title', 'goods', 'white', 'XL', 2, '80.00', 'DRAFT', '2026-08-03T00:00:00Z', '2026-08-03T00:00:00Z')
-	`, id); err != nil {
-		t.Fatalf("insert task: %v", err)
-	}
-}
-
-func insertSpecTrial(t *testing.T, database *sql.DB, id, taskID string) {
-	t.Helper()
-	if _, err := database.Exec(`
-		INSERT INTO spec_trials (
-			id, task_id, attempt, product_title, selected_color, selected_size, unit_price,
-			total_price, evidence_sha256, created_at
-		) VALUES (?, ?, 1, 'title', 'white', 'XL', '32.50', '65.00', 'hash', '2026-08-03T00:00:00Z')
-	`, id, taskID); err != nil {
-		t.Fatalf("insert spec trial: %v", err)
-	}
-}
-
-func insertAuthorization(t *testing.T, database *sql.DB, id, taskID, specTrialID string, version int) {
-	t.Helper()
-	if _, err := database.Exec(`
-		INSERT INTO order_authorizations (
-			id, task_id, spec_trial_id, version, goods_id, sku_color, sku_size, quantity,
-			authorized_unit_price, total_price_cap, status, created_by, created_at, expires_at
-		) VALUES (?, ?, ?, ?, 'goods', 'white', 'XL', 2, '32.50', '80.00', 'PENDING_DELIVERY', 'admin-one', '2026-08-03T00:00:00Z', '2026-08-03T01:00:00Z')
-	`, id, taskID, specTrialID, version); err != nil {
-		t.Fatalf("insert authorization: %v", err)
-	}
-}
-
-func insertSubmission(t *testing.T, database *sql.DB, id, authorizationID, commandID string) {
-	t.Helper()
-	if _, err := database.Exec(`
-		INSERT INTO order_submissions (
-			id, task_id, authorization_id, command_id, dry_run_id, status, verified_unit_price,
-			quantity_read, confirm_page_amount, created_at
-		) VALUES (?, 'task-one', ?, ?, 'dry-run-one', 'FENCED', '32.50', 2, '65.00', '2026-08-03T00:00:00Z')
-	`, id, authorizationID, commandID); err != nil {
-		t.Fatalf("insert submission: %v", err)
+func TestMigrationsDoNotDisableForeignKeys(t *testing.T) {
+	for _, name := range []string{"00002_single_pass_model.sql", "00003_evidence_assets.sql", "00004_device_credentials.sql"} {
+		contents, err := os.ReadFile(filepath.Join(migrationDirectory(t), name))
+		if err != nil {
+			t.Fatalf("read %s: %v", name, err)
+		}
+		if strings.Contains(strings.ToUpper(string(contents)), "PRAGMA FOREIGN_KEYS = OFF") {
+			t.Fatalf("%s disables foreign keys", name)
+		}
 	}
 }

admin/internal/server/evidence.go

@@ -0,0 +1,205 @@
+package server
+
+import (
+	"errors"
+	"io"
+	"mime"
+	"mime/multipart"
+	"net/http"
+	"strconv"
+	"strings"
+	"time"
+	"unicode/utf8"
+
+	"cmbuyer/admin/internal/deviceauth"
+	"cmbuyer/admin/internal/evidence"
+
+	"github.com/gin-gonic/gin"
+)
+
+const (
+	maxEvidenceRequestBytes = evidence.MaxFileBytes + 64<<10
+	maxEvidenceFieldBytes   = 4 << 10
+)
+
+var evidenceFieldNames = map[string]struct{}{
+	"upload_key": {}, "attempt_id": {}, "kind": {}, "privacy_tier": {}, "sha256": {}, "captured_at": {},
+}
+
+func uploadEvidence(options Options) gin.HandlerFunc {
+	return func(context *gin.Context) {
+		// Authentication deliberately precedes content-type parsing and every body read. A rejected
+		// device must not make the service spool or inspect a potentially sensitive upload.
+		principal, err := options.DeviceAuthenticator.Authenticate(context.Request)
+		if errors.Is(err, deviceauth.ErrUnauthenticated) {
+			context.Header("WWW-Authenticate", "Bearer")
+			context.Status(http.StatusUnauthorized)
+			return
+		}
+		if err != nil {
+			context.Status(http.StatusServiceUnavailable)
+			return
+		}
+		if !deviceauth.ValidDeviceID(principal.ID) {
+			// A custom authenticator is still an untrusted boundary. Do not defer principal
+			// validation until Commit because multipart bytes would already have been read.
+			context.Status(http.StatusServiceUnavailable)
+			return
+		}
+
+		boundary, ok := multipartBoundary(context.GetHeader("Content-Type"))
+		if !ok {
+			context.Status(http.StatusUnsupportedMediaType)
+			return
+		}
+		context.Request.Body = http.MaxBytesReader(context.Writer, context.Request.Body, maxEvidenceRequestBytes)
+		reader := multipart.NewReader(context.Request.Body, boundary)
+		fields := make(map[string]string, len(evidenceFieldNames))
+		var staged evidence.StagedFile
+		hasFile := false
+		discard := func() {
+			if hasFile {
+				options.Evidence.Discard(staged)
+			}
+		}
+
+		for {
+			part, err := reader.NextPart()
+			if errors.Is(err, io.EOF) {
+				break
+			}
+			if err != nil {
+				discard()
+				writeMultipartError(context, err)
+				return
+			}
+			name := part.FormName()
+			if name == "file" {
+				if hasFile || part.FileName() == "" || !exactPNGContentType(part.Header.Get("Content-Type")) {
+					_ = part.Close()
+					discard()
+					context.Status(http.StatusUnsupportedMediaType)
+					return
+				}
+				staged, err = options.Evidence.Stage(part, evidence.PNGContentType)
+				_ = part.Close()
+				if err != nil {
+					writeEvidenceStoreError(context, err)
+					return
+				}
+				hasFile = true
+				continue
+			}
+			if _, allowed := evidenceFieldNames[name]; !allowed || part.FileName() != "" {
+				_ = part.Close()
+				discard()
+				context.Status(http.StatusBadRequest)
+				return
+			}
+			if _, duplicate := fields[name]; duplicate {
+				_ = part.Close()
+				discard()
+				context.Status(http.StatusBadRequest)
+				return
+			}
+			value, err := io.ReadAll(io.LimitReader(part, maxEvidenceFieldBytes+1))
+			_ = part.Close()
+			if err != nil || len(value) == 0 || len(value) > maxEvidenceFieldBytes || !utf8.Valid(value) {
+				discard()
+				context.Status(http.StatusBadRequest)
+				return
+			}
+			fields[name] = string(value)
+		}
+		if !hasFile || len(fields) != len(evidenceFieldNames) {
+			discard()
+			context.Status(http.StatusBadRequest)
+			return
+		}
+		captured, err := time.Parse(time.RFC3339Nano, fields["captured_at"])
+		if err != nil || !strings.HasSuffix(fields["captured_at"], "Z") {
+			discard()
+			context.Status(http.StatusBadRequest)
+			return
+		}
+		asset, replayed, err := options.Evidence.Commit(context.Request.Context(), principal, evidence.UploadMetadata{
+			UploadKey: fields["upload_key"], TaskID: context.Param("id"), AttemptID: fields["attempt_id"],
+			Kind: fields["kind"], PrivacyTier: fields["privacy_tier"], SHA256: fields["sha256"], CapturedAt: captured.UTC(),
+		}, staged)
+		if err != nil {
+			writeEvidenceStoreError(context, err)
+			return
+		}
+		status := http.StatusCreated
+		if replayed {
+			status = http.StatusOK
+		}
+		context.JSON(status, asset)
+	}
+}
+
+func readEvidence(options Options) gin.HandlerFunc {
+	return func(context *gin.Context) {
+		if !options.Sessions.IsAuthenticated(context.Request) {
+			context.Status(http.StatusUnauthorized)
+			return
+		}
+		asset, file, err := options.Evidence.Open(context.Request.Context(), context.Param("asset_id"))
+		if errors.Is(err, evidence.ErrNotFound) {
+			context.Status(http.StatusNotFound)
+			return
+		}
+		if err != nil {
+			context.Status(http.StatusInternalServerError)
+			return
+		}
+		defer file.Close()
+		context.Header("Content-Type", evidence.PNGContentType)
+		context.Header("Content-Length", strconv.FormatInt(asset.ByteSize, 10))
+		context.Header("Content-Disposition", `inline; filename="evidence.png"`)
+		context.Header("Cache-Control", "no-store")
+		context.Header("X-Content-Type-Options", "nosniff")
+		context.Status(http.StatusOK)
+		if _, err := io.Copy(context.Writer, file); err != nil {
+			_ = context.Error(err)
+		}
+	}
+}
+
+func multipartBoundary(value string) (string, bool) {
+	mediaType, parameters, err := mime.ParseMediaType(value)
+	if err != nil || mediaType != "multipart/form-data" || len(parameters) != 1 || parameters["boundary"] == "" {
+		return "", false
+	}
+	return parameters["boundary"], true
+}
+
+func exactPNGContentType(value string) bool {
+	mediaType, parameters, err := mime.ParseMediaType(value)
+	return err == nil && mediaType == evidence.PNGContentType && len(parameters) == 0
+}
+
+func writeMultipartError(context *gin.Context, err error) {
+	var tooLarge *http.MaxBytesError
+	if errors.As(err, &tooLarge) {
+		context.Status(http.StatusRequestEntityTooLarge)
+		return
+	}
+	context.Status(http.StatusBadRequest)
+}
+
+func writeEvidenceStoreError(context *gin.Context, err error) {
+	var tooLarge *http.MaxBytesError
+	switch {
+	case errors.As(err, &tooLarge):
+		context.Status(http.StatusRequestEntityTooLarge)
+	case errors.Is(err, evidence.ErrTooLarge):
+		context.Status(http.StatusRequestEntityTooLarge)
+	case errors.Is(err, evidence.ErrInvalid):
+		context.Status(http.StatusBadRequest)
+	case errors.Is(err, evidence.ErrConflict):
+		context.Status(http.StatusConflict)
+	default:
+		context.Status(http.StatusInternalServerError)
+	}
+}

admin/internal/server/evidence_test.go

@@ -0,0 +1,451 @@
+package server_test
+
+import (
+	"bytes"
+	"context"
+	"crypto/sha256"
+	"database/sql"
+	"encoding/hex"
+	"encoding/json"
+	"image"
+	"image/png"
+	"io"
+	"mime/multipart"
+	"net/http"
+	"net/http/httptest"
+	"net/textproto"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"testing"
+
+	"cmbuyer/admin/internal/deviceauth"
+	"cmbuyer/admin/internal/evidence"
+	"cmbuyer/admin/internal/migrations"
+	evidencestorage "cmbuyer/admin/internal/storage/evidence"
+	"cmbuyer/admin/internal/storage/sqlite"
+)
+
+const (
+	evidenceTaskID    = "63c9f507-7473-4fa6-8d71-8786c34c6301"
+	evidenceAuthID    = "73c9f507-7473-4fa6-8d71-8786c34c6301"
+	evidenceAttemptID = "83c9f507-7473-4fa6-8d71-8786c34c6301"
+	evidenceUploadKey = "93c9f507-7473-4fa6-8d71-8786c34c6301"
+	evidenceDeviceID  = "13c9f507-7473-4fa6-8d71-8786c34c6301"
+)
+
+func TestEvidenceUploadAuthenticatesBeforeReadingBody(t *testing.T) {
+	authenticator := &fakeDeviceAuthenticator{}
+	router, _ := newRouterWithDependencies(t, &memoryStore{}, emptyDetailStore{}, emptyEvidenceStore{}, authenticator)
+	poison := &poisonBody{}
+	request := httptest.NewRequest(http.MethodPost, "/api/v1/tasks/"+evidenceTaskID+"/evidence", nil)
+	request.Body = poison
+	request.Header.Set("Content-Type", "text/plain")
+	response := httptest.NewRecorder()
+
+	router.ServeHTTP(response, request)
+
+	if response.Code != http.StatusUnauthorized || response.Body.Len() != 0 || response.Header().Get("WWW-Authenticate") != "Bearer" || poison.reads != 0 || authenticator.calls != 1 {
+		t.Fatalf("status/reads/auth calls = %d/%d/%d, want 401/0/1", response.Code, poison.reads, authenticator.calls)
+	}
+	assertSecurityHeaders(t, response)
+}
+
+func TestEvidenceUploadAuthenticationStorageFailureBeforeReadingBody(t *testing.T) {
+	database, err := sqlite.Open(filepath.Join(t.TempDir(), "authentication-failure.db"))
+	if err != nil {
+		t.Fatalf("open database: %v", err)
+	}
+	if err := migrations.Up(context.Background(), database, testMigrationDirectory(t)); err != nil {
+		t.Fatalf("migrate database: %v", err)
+	}
+	authenticator, err := deviceauth.NewSQLiteAuthenticator(database)
+	if err != nil {
+		t.Fatalf("new authenticator: %v", err)
+	}
+	credentialStore, err := deviceauth.NewCredentialStore(database)
+	if err != nil {
+		t.Fatalf("new credential store: %v", err)
+	}
+	issued, err := credentialStore.Issue(context.Background(), "test device")
+	if err != nil {
+		t.Fatalf("issue credential: %v", err)
+	}
+	if err := database.Close(); err != nil {
+		t.Fatalf("close database: %v", err)
+	}
+	router, _ := newRouterWithDependencies(t, &memoryStore{}, emptyDetailStore{}, emptyEvidenceStore{}, authenticator)
+	poison := &poisonBody{}
+	request := httptest.NewRequest(http.MethodPost, "/api/v1/tasks/"+evidenceTaskID+"/evidence", nil)
+	request.Body = poison
+	request.Header.Set(deviceauth.AuthorizationHeader, "Bearer "+issued.Token)
+	request.Header.Set(deviceauth.DeviceIDHeader, issued.DeviceID)
+	response := httptest.NewRecorder()
+	router.ServeHTTP(response, request)
+	if response.Code != http.StatusServiceUnavailable || response.Body.Len() != 0 || poison.reads != 0 {
+		t.Fatalf("storage failure status/body/reads = %d/%q/%d, want 503/empty/0", response.Code, response.Body.String(), poison.reads)
+	}
+}
+
+func TestEvidenceUploadRejectsInvalidSuccessfulPrincipalBeforeReadingBody(t *testing.T) {
+	router, _ := newRouterWithDependencies(t, &memoryStore{}, emptyDetailStore{}, emptyEvidenceStore{}, uncheckedDeviceAuthenticator{})
+	poison := &poisonBody{}
+	request := httptest.NewRequest(http.MethodPost, "/api/v1/tasks/"+evidenceTaskID+"/evidence", nil)
+	request.Body = poison
+	response := httptest.NewRecorder()
+	router.ServeHTTP(response, request)
+	if response.Code != http.StatusServiceUnavailable || response.Body.Len() != 0 || poison.reads != 0 {
+		t.Fatalf("invalid principal status/body/reads = %d/%q/%d, want 503/empty/0", response.Code, response.Body.String(), poison.reads)
+	}
+}
+
+func TestAdminSessionCannotActAsDeviceUploader(t *testing.T) {
+	router, _ := newRouter(t)
+	cookie := authenticate(t, router)
+	request := httptest.NewRequest(http.MethodPost, "/api/v1/tasks/"+evidenceTaskID+"/evidence", nil)
+	request.Body = &poisonBody{}
+	request.AddCookie(cookie)
+	response := httptest.NewRecorder()
+	router.ServeHTTP(response, request)
+	if response.Code != http.StatusUnauthorized {
+		t.Fatalf("admin upload status = %d, want 401", response.Code)
+	}
+}
+
+func TestRealDeviceCredentialIdentityIsolationAndMixedCredentials(t *testing.T) {
+	database, err := sqlite.Open(filepath.Join(t.TempDir(), "identity-isolation.db"))
+	if err != nil {
+		t.Fatalf("open database: %v", err)
+	}
+	t.Cleanup(func() { _ = database.Close() })
+	if err := migrations.Up(context.Background(), database, testMigrationDirectory(t)); err != nil {
+		t.Fatalf("migrate database: %v", err)
+	}
+	insertEvidenceAttempt(t, database)
+	assetStore, err := evidencestorage.NewStore(database, filepath.Join(t.TempDir(), "assets"))
+	if err != nil {
+		t.Fatalf("new evidence store: %v", err)
+	}
+	credentialStore, err := deviceauth.NewCredentialStore(database)
+	if err != nil {
+		t.Fatalf("new credential store: %v", err)
+	}
+	issued, err := credentialStore.Issue(context.Background(), "采购工具一号")
+	if err != nil {
+		t.Fatalf("issue credential: %v", err)
+	}
+	authenticator, err := deviceauth.NewSQLiteAuthenticator(database)
+	if err != nil {
+		t.Fatalf("new authenticator: %v", err)
+	}
+	taskStore := &memoryStore{}
+	router, _ := newRouterWithDependencies(t, taskStore, emptyDetailStore{}, assetStore, authenticator)
+	addDeviceHeaders := func(request *http.Request) {
+		request.Header.Set(deviceauth.AuthorizationHeader, "Bearer "+issued.Token)
+		request.Header.Set(deviceauth.DeviceIDHeader, issued.DeviceID)
+	}
+
+	start := newStartRequest(t, validStartBody(), "application/json", "", nil)
+	addDeviceHeaders(start)
+	startResponse := httptest.NewRecorder()
+	router.ServeHTTP(startResponse, start)
+	create := httptest.NewRequest(http.MethodPost, "/tasks", strings.NewReader("title=device"))
+	create.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	addDeviceHeaders(create)
+	createResponse := httptest.NewRecorder()
+	router.ServeHTTP(createResponse, create)
+	if startResponse.Code != http.StatusUnauthorized || createResponse.Code != http.StatusUnauthorized || taskStore.startCalls != 0 || len(taskStore.drafts) != 0 {
+		t.Fatalf("device management isolation = start %d/create %d/calls %d/drafts %d", startResponse.Code, createResponse.Code, taskStore.startCalls, len(taskStore.drafts))
+	}
+
+	adminCookie, csrf := authenticatedStartSession(t, router)
+	mixedWithoutCSRF := newStartRequest(t, validStartBody(), "application/json", "", adminCookie)
+	addDeviceHeaders(mixedWithoutCSRF)
+	mixedWithoutCSRFResponse := httptest.NewRecorder()
+	router.ServeHTTP(mixedWithoutCSRFResponse, mixedWithoutCSRF)
+	if mixedWithoutCSRFResponse.Code != http.StatusForbidden || taskStore.startCalls != 0 {
+		t.Fatalf("mixed request bypassed admin CSRF: status/calls=%d/%d", mixedWithoutCSRFResponse.Code, taskStore.startCalls)
+	}
+	mixedAdmin := newStartRequest(t, validStartBody(), "application/json", csrf, adminCookie)
+	addDeviceHeaders(mixedAdmin)
+	mixedAdminResponse := httptest.NewRecorder()
+	router.ServeHTTP(mixedAdminResponse, mixedAdmin)
+	if mixedAdminResponse.Code != http.StatusBadRequest || taskStore.startCalls != 1 {
+		t.Fatalf("mixed admin request changed identity domain: status/calls=%d/%d", mixedAdminResponse.Code, taskStore.startCalls)
+	}
+
+	pngBytes := serverTestPNG(t, 3, 2)
+	upload := newEvidenceUploadRequest(t, evidenceTaskID, validEvidenceFields(pngBytes), pngBytes, evidence.PNGContentType, "raw.png", nil)
+	addDeviceHeaders(upload)
+	upload.AddCookie(adminCookie)
+	uploadResponse := httptest.NewRecorder()
+	router.ServeHTTP(uploadResponse, upload)
+	if uploadResponse.Code != http.StatusCreated {
+		t.Fatalf("mixed upload status/body = %d/%q", uploadResponse.Code, uploadResponse.Body.String())
+	}
+	var uploadedBy string
+	if err := database.QueryRow(`SELECT uploaded_by_device_id FROM evidence_assets`).Scan(&uploadedBy); err != nil || uploadedBy != issued.DeviceID {
+		t.Fatalf("uploaded principal = %q, err=%v", uploadedBy, err)
+	}
+
+	if _, _, err := credentialStore.Revoke(context.Background(), issued.DeviceID); err != nil {
+		t.Fatalf("revoke credential: %v", err)
+	}
+	revokedUpload := newEvidenceUploadRequest(t, evidenceTaskID, validEvidenceFields(pngBytes), pngBytes, evidence.PNGContentType, "raw.png", nil)
+	addDeviceHeaders(revokedUpload)
+	revokedResponse := httptest.NewRecorder()
+	router.ServeHTTP(revokedResponse, revokedUpload)
+	if revokedResponse.Code != http.StatusUnauthorized || revokedResponse.Body.Len() != 0 {
+		t.Fatalf("revoked upload = %d/%q", revokedResponse.Code, revokedResponse.Body.String())
+	}
+}
+
+func TestEvidenceUploadReplayConflictAndProtectedRead(t *testing.T) {
+	router, database := newEvidenceRouter(t, &fakeDeviceAuthenticator{principal: deviceauth.Principal{ID: evidenceDeviceID}})
+	pngBytes := serverTestPNG(t, 6, 4)
+	fields := validEvidenceFields(pngBytes)
+
+	first := serveEvidenceUpload(t, router, evidenceTaskID, fields, pngBytes, evidence.PNGContentType, `..\private\original.png`, nil)
+	if first.Code != http.StatusCreated {
+		t.Fatalf("first upload status/body = %d/%q", first.Code, first.Body.String())
+	}
+	var asset evidence.Asset
+	if err := json.Unmarshal(first.Body.Bytes(), &asset); err != nil {
+		t.Fatalf("decode upload response: %v", err)
+	}
+	if asset.TaskID != evidenceTaskID || asset.AttemptID != evidenceAttemptID || asset.SHA256 != fields["sha256"] || strings.Contains(first.Body.String(), "private") || strings.Contains(first.Body.String(), "original.png") {
+		t.Fatalf("unsafe upload response = %s", first.Body.String())
+	}
+
+	replay := serveEvidenceUpload(t, router, evidenceTaskID, fields, pngBytes, evidence.PNGContentType, "again.png", nil)
+	if replay.Code != http.StatusOK {
+		t.Fatalf("replay status = %d, want 200", replay.Code)
+	}
+	var replayed evidence.Asset
+	if err := json.Unmarshal(replay.Body.Bytes(), &replayed); err != nil || replayed.ID != asset.ID {
+		t.Fatalf("replay asset = %#v, err %v", replayed, err)
+	}
+
+	conflicting := copyStringMap(fields)
+	conflicting["captured_at"] = "2026-08-04T09:01:01Z"
+	if response := serveEvidenceUpload(t, router, evidenceTaskID, conflicting, pngBytes, evidence.PNGContentType, "same.png", nil); response.Code != http.StatusConflict {
+		t.Fatalf("conflicting replay status = %d, want 409", response.Code)
+	}
+	var count int
+	if err := database.QueryRow("SELECT COUNT(*) FROM evidence_assets").Scan(&count); err != nil || count != 1 {
+		t.Fatalf("asset count = %d, err %v", count, err)
+	}
+
+	if response := serve(router, http.MethodGet, "/evidence/"+asset.ID, nil, nil); response.Code != http.StatusUnauthorized || response.Body.Len() != 0 {
+		t.Fatalf("anonymous read = %d/%q", response.Code, response.Body.String())
+	}
+	adminCookie := authenticate(t, router)
+	read := serve(router, http.MethodGet, "/evidence/"+asset.ID, nil, adminCookie)
+	if read.Code != http.StatusOK || !bytes.Equal(read.Body.Bytes(), pngBytes) {
+		t.Fatalf("admin read = %d, bytes equal %t", read.Code, bytes.Equal(read.Body.Bytes(), pngBytes))
+	}
+	for header, want := range map[string]string{"Content-Type": "image/png", "Cache-Control": "no-store", "X-Content-Type-Options": "nosniff", "Content-Disposition": `inline; filename="evidence.png"`} {
+		if got := read.Header().Get(header); got != want {
+			t.Fatalf("%s = %q, want %q", header, got, want)
+		}
+	}
+	missing := serve(router, http.MethodGet, "/evidence/not-a-uuid", nil, adminCookie)
+	if missing.Code != http.StatusNotFound || missing.Body.Len() != 0 {
+		t.Fatalf("missing evidence = %d/%q", missing.Code, missing.Body.String())
+	}
+}
+
+func TestEvidenceUploadRejectsStrictMultipartViolations(t *testing.T) {
+	router, database := newEvidenceRouter(t, &fakeDeviceAuthenticator{principal: deviceauth.Principal{ID: evidenceDeviceID}})
+	pngBytes := serverTestPNG(t, 2, 2)
+	base := validEvidenceFields(pngBytes)
+	wrongHash := copyStringMap(base)
+	wrongHash["sha256"] = strings.Repeat("b", 64)
+	uppercaseHash := copyStringMap(base)
+	uppercaseHash["sha256"] = strings.ToUpper(uppercaseHash["sha256"])
+	wrongPrivacy := copyStringMap(base)
+	wrongPrivacy["privacy_tier"] = "PUBLIC"
+	wrongKind := copyStringMap(base)
+	wrongKind["kind"] = "ORDER_CONFIRM"
+	tests := []struct {
+		name        string
+		fields      map[string]string
+		file        []byte
+		contentType string
+		extra       func(*multipart.Writer) error
+		want        int
+	}{
+		{name: "attempt belongs to another task", fields: base, file: pngBytes, contentType: evidence.PNGContentType, want: http.StatusBadRequest},
+		{name: "xml file", fields: base, file: []byte("<hierarchy/>"), contentType: evidence.PNGContentType, want: http.StatusBadRequest},
+		{name: "wrong hash", fields: wrongHash, file: pngBytes, contentType: evidence.PNGContentType, want: http.StatusBadRequest},
+		{name: "uppercase hash", fields: uppercaseHash, file: pngBytes, contentType: evidence.PNGContentType, want: http.StatusBadRequest},
+		{name: "wrong privacy", fields: wrongPrivacy, file: pngBytes, contentType: evidence.PNGContentType, want: http.StatusBadRequest},
+		{name: "unapproved kind", fields: wrongKind, file: pngBytes, contentType: evidence.PNGContentType, want: http.StatusBadRequest},
+		{name: "too large", fields: base, file: make([]byte, evidence.MaxFileBytes+1), contentType: evidence.PNGContentType, want: http.StatusRequestEntityTooLarge},
+		{name: "wrong file content type", fields: base, file: pngBytes, contentType: "application/xml", want: http.StatusUnsupportedMediaType},
+		{name: "unknown path field", fields: base, file: pngBytes, contentType: evidence.PNGContentType, extra: func(writer *multipart.Writer) error { return writer.WriteField("path", `C:\secret.xml`) }, want: http.StatusBadRequest},
+		{name: "duplicate metadata", fields: base, file: pngBytes, contentType: evidence.PNGContentType, extra: func(writer *multipart.Writer) error { return writer.WriteField("sha256", base["sha256"]) }, want: http.StatusBadRequest},
+		{name: "second file", fields: base, file: pngBytes, contentType: evidence.PNGContentType, extra: func(writer *multipart.Writer) error {
+			part, err := writer.CreateFormFile("file", "second.png")
+			if err == nil {
+				_, err = part.Write(pngBytes)
+			}
+			return err
+		}, want: http.StatusUnsupportedMediaType},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			taskID := evidenceTaskID
+			if test.name == "attempt belongs to another task" {
+				taskID = "a3c9f507-7473-4fa6-8d71-8786c34c6301"
+			}
+			response := serveEvidenceUpload(t, router, taskID, copyStringMap(test.fields), test.file, test.contentType, "file.png", test.extra)
+			if response.Code != test.want || response.Body.Len() != 0 {
+				t.Fatalf("status/body = %d/%q, want %d/empty", response.Code, response.Body.String(), test.want)
+			}
+		})
+	}
+	var count int
+	if err := database.QueryRow("SELECT COUNT(*) FROM evidence_assets").Scan(&count); err != nil || count != 0 {
+		t.Fatalf("invalid requests created %d assets, err %v", count, err)
+	}
+}
+
+type fakeDeviceAuthenticator struct {
+	principal deviceauth.Principal
+	err       error
+	calls     int
+}
+
+func (authenticator *fakeDeviceAuthenticator) Authenticate(*http.Request) (deviceauth.Principal, error) {
+	authenticator.calls++
+	if authenticator.err != nil {
+		return deviceauth.Principal{}, authenticator.err
+	}
+	if authenticator.principal.ID == "" {
+		return deviceauth.Principal{}, deviceauth.ErrUnauthenticated
+	}
+	return authenticator.principal, nil
+}
+
+type poisonBody struct{ reads int }
+
+type uncheckedDeviceAuthenticator struct{}
+
+func (uncheckedDeviceAuthenticator) Authenticate(*http.Request) (deviceauth.Principal, error) {
+	return deviceauth.Principal{}, nil
+}
+
+func (body *poisonBody) Read([]byte) (int, error) {
+	body.reads++
+	return 0, io.ErrUnexpectedEOF
+}
+func (*poisonBody) Close() error { return nil }
+
+func newEvidenceRouter(t *testing.T, authenticator deviceauth.Authenticator) (http.Handler, *sql.DB) {
+	t.Helper()
+	database, err := sqlite.Open(filepath.Join(t.TempDir(), "server-evidence.db"))
+	if err != nil {
+		t.Fatalf("open database: %v", err)
+	}
+	t.Cleanup(func() { _ = database.Close() })
+	if err := migrations.Up(context.Background(), database, testMigrationDirectory(t)); err != nil {
+		t.Fatalf("migrate database: %v", err)
+	}
+	insertEvidenceAttempt(t, database)
+	store, err := evidencestorage.NewStore(database, filepath.Join(t.TempDir(), "assets"))
+	if err != nil {
+		t.Fatalf("new evidence store: %v", err)
+	}
+	router, _ := newRouterWithDependencies(t, &memoryStore{}, emptyDetailStore{}, store, authenticator)
+	return router, database
+}
+
+func testMigrationDirectory(t *testing.T) string {
+	t.Helper()
+	_, file, _, ok := runtime.Caller(0)
+	if !ok {
+		t.Fatal("locate migration directory")
+	}
+	return filepath.Join(filepath.Dir(file), "..", "..", "migrations")
+}
+
+func insertEvidenceAttempt(t *testing.T, database *sql.DB) {
+	t.Helper()
+	timestamp := "2026-08-04T00:00:00Z"
+	if _, err := database.Exec(`INSERT INTO tasks (id, source, title, goods_id, sku_color, sku_size, quantity, max_total_price, status, version, created_at, updated_at) VALUES (?, 'MANUAL', 'task', '123', 'black', 'M', 1, '1.00', 'DRAFT', 1, ?, ?)`, evidenceTaskID, timestamp, timestamp); err != nil {
+		t.Fatalf("insert task: %v", err)
+	}
+	if _, err := database.Exec(`INSERT INTO order_authorizations (id, task_id, task_version, start_key, goods_id, sku_color, sku_size, quantity, total_price_cap, status, created_by, created_at, expires_at) VALUES (?, ?, 1, 'start', '123', 'black', 'M', 1, '1.00', 'ACTIVE', 'admin', ?, ?)`, evidenceAuthID, evidenceTaskID, timestamp, timestamp); err != nil {
+		t.Fatalf("insert authorization: %v", err)
+	}
+	if _, err := database.Exec(`INSERT INTO purchase_attempts (id, task_id, authorization_id, claim_generation, status, started_at) VALUES (?, ?, ?, 1, 'CLAIMED', ?)`, evidenceAttemptID, evidenceTaskID, evidenceAuthID, timestamp); err != nil {
+		t.Fatalf("insert attempt: %v", err)
+	}
+}
+
+func serveEvidenceUpload(t *testing.T, router http.Handler, taskID string, fields map[string]string, file []byte, fileContentType, filename string, extra func(*multipart.Writer) error) *httptest.ResponseRecorder {
+	t.Helper()
+	request := newEvidenceUploadRequest(t, taskID, fields, file, fileContentType, filename, extra)
+	response := httptest.NewRecorder()
+	router.ServeHTTP(response, request)
+	return response
+}
+
+func newEvidenceUploadRequest(t *testing.T, taskID string, fields map[string]string, file []byte, fileContentType, filename string, extra func(*multipart.Writer) error) *http.Request {
+	t.Helper()
+	var body bytes.Buffer
+	writer := multipart.NewWriter(&body)
+	for _, name := range []string{"upload_key", "attempt_id", "kind", "privacy_tier", "sha256", "captured_at"} {
+		if err := writer.WriteField(name, fields[name]); err != nil {
+			t.Fatalf("write field %s: %v", name, err)
+		}
+	}
+	header := make(textproto.MIMEHeader)
+	header.Set("Content-Disposition", `form-data; name="file"; filename="`+filename+`"`)
+	header.Set("Content-Type", fileContentType)
+	part, err := writer.CreatePart(header)
+	if err != nil {
+		t.Fatalf("create file part: %v", err)
+	}
+	if _, err := part.Write(file); err != nil {
+		t.Fatalf("write file: %v", err)
+	}
+	if extra != nil {
+		if err := extra(writer); err != nil {
+			t.Fatalf("write extra part: %v", err)
+		}
+	}
+	if err := writer.Close(); err != nil {
+		t.Fatalf("close multipart: %v", err)
+	}
+	request := httptest.NewRequest(http.MethodPost, "/api/v1/tasks/"+taskID+"/evidence", bytes.NewReader(body.Bytes()))
+	request.Header.Set("Content-Type", writer.FormDataContentType())
+	return request
+}
+
+func validEvidenceFields(pngBytes []byte) map[string]string {
+	hash := sha256.Sum256(pngBytes)
+	return map[string]string{
+		"upload_key": evidenceUploadKey, "attempt_id": evidenceAttemptID,
+		"kind": evidence.KindSKUPanelGate1, "privacy_tier": evidence.PrivacyInternalRaw,
+		"sha256": hex.EncodeToString(hash[:]), "captured_at": "2026-08-04T09:01:00Z",
+	}
+}
+
+func serverTestPNG(t *testing.T, width, height int) []byte {
+	t.Helper()
+	var buffer bytes.Buffer
+	if err := png.Encode(&buffer, image.NewNRGBA(image.Rect(0, 0, width, height))); err != nil {
+		t.Fatalf("encode PNG: %v", err)
+	}
+	return buffer.Bytes()
+}
+
+func copyStringMap(values map[string]string) map[string]string {
+	copy := make(map[string]string, len(values))
+	for key, value := range values {
+		copy[key] = value
+	}
+	return copy
+}

admin/internal/server/router.go

@@ -2,18 +2,435 @@
 package server
 
 import (
+	"bytes"
+	"crypto/subtle"
+	"encoding/json"
+	"errors"
+	"io"
+	"mime"
 	"net/http"
+	"net/url"
+	"strings"
+	"unicode/utf8"
+
+	"cmbuyer/admin/internal/auth"
+	"cmbuyer/admin/internal/deviceauth"
+	"cmbuyer/admin/internal/evidence"
+	"cmbuyer/admin/internal/taskdetail"
+	"cmbuyer/admin/internal/tasks"
+	"cmbuyer/admin/internal/transport/webui"
 
 	"github.com/gin-gonic/gin"
+	"golang.org/x/crypto/bcrypt"
 )
 
-// NewRouter 返回当前服务范围内的完整 HTTP 路由。
-func NewRouter() *gin.Engine {
-	router := gin.New()
+const maxFormBytes = 8 << 10
+const maxJSONBytes = 64 << 10
 
-	router.GET("/healthz", func(context *gin.Context) {
-		context.JSON(http.StatusOK, gin.H{"status": "ok"})
+// Options 是路由层需要的安全依赖。凭据由启动配置注入，不能在路由中设置默认值。
+type Options struct {
+	AdminUsername       string
+	AdminPasswordBcrypt string
+	Sessions            *auth.Manager
+	Tasks               tasks.Store
+	TaskDetails         taskdetail.Store
+	Evidence            evidence.Store
+	DeviceAuthenticator deviceauth.Authenticator
+}
+
+// NewRouter 返回当前服务范围内的完整 HTTP 路由。
+func NewRouter(options Options) (*gin.Engine, error) {
+	if options.AdminUsername == "" || options.AdminPasswordBcrypt == "" || options.Sessions == nil || options.Tasks == nil || options.TaskDetails == nil || options.Evidence == nil || options.DeviceAuthenticator == nil {
+		return nil, errors.New("server authentication options are incomplete")
+	}
+
+	router := gin.New()
+	router.Use(gin.Recovery())
+	router.Use(securityHeaders())
+	router.GET("/healthz", healthz)
+	router.GET("/login", loginPage(options))
+	router.POST("/login", login(options))
+	router.POST("/logout", logout(options))
+	router.GET("/tasks", tasksPage(options))
+	router.GET("/tasks/:id", taskDetailPage(options))
+	router.GET("/tasks/new", newTaskPage(options))
+	router.POST("/tasks", createTask(options))
+	router.POST("/tasks/start-purchases", startPurchases(options))
+	router.POST("/api/v1/tasks/:id/evidence", uploadEvidence(options))
+	router.GET("/evidence/:asset_id", readEvidence(options))
+	router.GET("/static/tasks.js", func(context *gin.Context) {
+		context.Data(http.StatusOK, "application/javascript; charset=utf-8", webui.TasksScript())
 	})
 
-	return router
+	return router, nil
+}
+
+func startPurchases(options Options) gin.HandlerFunc {
+	return func(context *gin.Context) {
+		if !options.Sessions.IsAuthenticated(context.Request) {
+			context.Status(http.StatusUnauthorized)
+			return
+		}
+		authenticated, csrfOK := options.Sessions.VerifyCSRF(context.Request, context.GetHeader("X-CSRF-Token"))
+		if !authenticated || !csrfOK {
+			context.Status(http.StatusForbidden)
+			return
+		}
+		if !isJSONContentType(context.GetHeader("Content-Type")) {
+			context.Status(http.StatusUnsupportedMediaType)
+			return
+		}
+		context.Request.Body = http.MaxBytesReader(context.Writer, context.Request.Body, maxJSONBytes)
+		raw, err := io.ReadAll(context.Request.Body)
+		if err != nil {
+			var tooLarge *http.MaxBytesError
+			if errors.As(err, &tooLarge) {
+				context.Status(http.StatusRequestEntityTooLarge)
+			} else {
+				context.Status(http.StatusBadRequest)
+			}
+			return
+		}
+		if !utf8.Valid(raw) {
+			context.Status(http.StatusBadRequest)
+			return
+		}
+		decoder := json.NewDecoder(bytes.NewReader(raw))
+		decoder.DisallowUnknownFields()
+		var command tasks.StartCommand
+		if err := decoder.Decode(&command); err != nil {
+			context.Status(http.StatusBadRequest)
+			return
+		}
+		var extra any
+		if err := decoder.Decode(&extra); err != io.EOF {
+			context.Status(http.StatusBadRequest)
+			return
+		}
+		result, err := options.Tasks.StartPurchases(context.Request.Context(), command, options.AdminUsername)
+		if err != nil {
+			if errors.Is(err, tasks.ErrInvalidStart) {
+				context.Status(http.StatusBadRequest)
+			} else if errors.Is(err, tasks.ErrStartConflict) {
+				context.Status(http.StatusConflict)
+			} else {
+				context.Status(http.StatusInternalServerError)
+			}
+			return
+		}
+		context.JSON(http.StatusOK, result)
+	}
+}
+
+func isJSONContentType(value string) bool {
+	mediaType, parameters, err := mime.ParseMediaType(value)
+	if err != nil || mediaType != "application/json" {
+		return false
+	}
+	for name, value := range parameters {
+		if name != "charset" || !strings.EqualFold(value, "utf-8") {
+			return false
+		}
+	}
+	return true
+}
+
+func healthz(context *gin.Context) {
+	context.JSON(http.StatusOK, gin.H{"status": "ok"})
+}
+
+func securityHeaders() gin.HandlerFunc {
+	return func(context *gin.Context) {
+		context.Header("Cache-Control", "no-store")
+		context.Header("X-Content-Type-Options", "nosniff")
+		context.Header("Referrer-Policy", "no-referrer")
+		context.Header("Content-Security-Policy", "default-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self'; object-src 'none'; base-uri 'none'; frame-ancestors 'none'; form-action 'self'")
+		context.Next()
+	}
+}
+
+func loginPage(options Options) gin.HandlerFunc {
+	return func(context *gin.Context) {
+		csrfToken, authenticated := options.Sessions.Ensure(context.Writer, context.Request)
+		if authenticated {
+			context.Redirect(http.StatusSeeOther, "/tasks")
+			return
+		}
+
+		renderLogin(context, http.StatusOK, csrfToken, returnTo(context.Query("return_to")), "", "")
+	}
+}
+
+func login(options Options) gin.HandlerFunc {
+	return func(context *gin.Context) {
+		if !parseForm(context) {
+			return
+		}
+		form := context.Request.PostForm
+		csrfToken := form.Get("csrf_token")
+		returnPath := returnTo(form.Get("return_to"))
+		username := form.Get("username")
+		password := form.Get("password")
+
+		if _, ok := options.Sessions.VerifyCSRF(context.Request, csrfToken); !ok {
+			newCSRF, _ := options.Sessions.Ensure(context.Writer, context.Request)
+			renderLogin(context, http.StatusForbidden, newCSRF, returnPath, "", "请求已过期，请重新登录。")
+			return
+		}
+
+		usernameMatches := subtle.ConstantTimeCompare([]byte(options.AdminUsername), []byte(username)) == 1
+		passwordMatches := bcrypt.CompareHashAndPassword([]byte(options.AdminPasswordBcrypt), []byte(password)) == nil
+		if !usernameMatches || !passwordMatches {
+			csrf, _ := options.Sessions.Ensure(context.Writer, context.Request)
+			renderLogin(context, http.StatusUnauthorized, csrf, returnPath, "", "账号或密码不正确，请检查后重试。")
+			return
+		}
+
+		options.Sessions.RotateAuthenticated(context.Writer, context.Request)
+		context.Redirect(http.StatusSeeOther, returnPath)
+	}
+}
+
+func logout(options Options) gin.HandlerFunc {
+	return func(context *gin.Context) {
+		if !parseForm(context) {
+			return
+		}
+		authenticated, ok := options.Sessions.VerifyCSRF(context.Request, context.Request.PostForm.Get("csrf_token"))
+		if !ok || !authenticated {
+			context.Status(http.StatusForbidden)
+			return
+		}
+
+		options.Sessions.Logout(context.Writer, context.Request)
+		context.Redirect(http.StatusSeeOther, "/login")
+	}
+}
+
+func tasksPage(options Options) gin.HandlerFunc {
+	return func(context *gin.Context) {
+		csrfToken, authenticated := options.Sessions.Ensure(context.Writer, context.Request)
+		if !authenticated {
+			context.Redirect(http.StatusSeeOther, "/login?return_to="+url.QueryEscape(context.Request.URL.RequestURI()))
+			return
+		}
+
+		filter := tasks.TaskFilter{Keyword: context.Query("keyword"), Status: context.Query("status"), CreatedFrom: context.Query("created_from"), CreatedTo: context.Query("created_to")}
+		if validation := tasks.ValidateTaskFilter(filter); !validation.Valid() {
+			startKey, err := tasks.NewCreateKey()
+			if err != nil {
+				context.Status(http.StatusInternalServerError)
+				return
+			}
+			renderTasks(context, http.StatusBadRequest, webui.TasksData{CSRFToken: csrfToken, Filter: filter, FilterErrors: validation, HasFilter: true, StartKey: startKey})
+			return
+		}
+		data, err := taskListData(context, options, csrfToken, filter)
+		if err != nil {
+			context.Status(http.StatusInternalServerError)
+			return
+		}
+		for _, row := range data.Tasks {
+			if row.ID == context.Query("created") {
+				data.Success = true
+				break
+			}
+		}
+		if context.Query("create") == "1" {
+			form, err := newTaskForm()
+			if err != nil {
+				context.Status(http.StatusInternalServerError)
+				return
+			}
+			data.OpenForm = true
+			data.Form = form
+			data.FocusField = "title"
+		}
+		renderTasks(context, http.StatusOK, data)
+	}
+}
+
+func newTaskPage(options Options) gin.HandlerFunc {
+	return func(context *gin.Context) {
+		csrf, authenticated := options.Sessions.Ensure(context.Writer, context.Request)
+		if !authenticated {
+			context.Redirect(http.StatusSeeOther, "/login?return_to=%2Ftasks%2Fnew")
+			return
+		}
+		form, err := newTaskForm()
+		if err != nil {
+			context.Status(http.StatusInternalServerError)
+			return
+		}
+		renderTasks(context, http.StatusOK, webui.TasksData{CSRFToken: csrf, Form: form, FullPage: true, FocusField: "title"})
+	}
+}
+func createTask(options Options) gin.HandlerFunc {
+	return func(context *gin.Context) {
+		if !options.Sessions.IsAuthenticated(context.Request) {
+			context.Status(http.StatusUnauthorized)
+			return
+		}
+		if !parseForm(context) {
+			return
+		}
+		requestForm := context.Request.PostForm
+		authenticated, csrfOK := options.Sessions.VerifyCSRF(context.Request, requestForm.Get("csrf_token"))
+		if !csrfOK || !authenticated {
+			context.Status(http.StatusForbidden)
+			return
+		}
+		form := taskForm(requestForm)
+		draft, validation := tasks.Validate(form)
+		if draft.GoodsID != "" {
+			form.ProductURL = tasks.CanonicalURL(draft.GoodsID)
+		}
+		fullPage := requestForm.Get("form_mode") == "full"
+		if !validation.Valid() {
+			data, ok := createErrorData(context, options, fullPage)
+			if !ok {
+				return
+			}
+			data.Form = form
+			data.Errors = validation
+			data.OpenForm = !fullPage
+			data.FullPage = fullPage
+			data.FocusField = firstError(validation)
+			renderTasks(context, http.StatusBadRequest, data)
+			return
+		}
+		created, err := options.Tasks.CreateDraft(context.Request.Context(), draft)
+		if err != nil {
+			if errors.Is(err, tasks.ErrCreateKeyConflict) {
+				validation["create_key"] = "该创建请求已用于另一条任务，请重新打开表单。"
+				data, ok := createErrorData(context, options, fullPage)
+				if !ok {
+					return
+				}
+				data.Form = form
+				data.Errors = validation
+				data.OpenForm = !fullPage
+				data.FullPage = fullPage
+				data.FocusField = firstError(validation)
+				renderTasks(context, http.StatusConflict, data)
+				return
+			}
+			context.Status(http.StatusInternalServerError)
+			return
+		}
+		context.Redirect(http.StatusSeeOther, "/tasks?created="+url.QueryEscape(created.ID))
+	}
+}
+
+func newTaskForm() (tasks.Form, error) {
+	key, err := tasks.NewCreateKey()
+	if err != nil {
+		return tasks.Form{}, err
+	}
+	return tasks.Form{CreateKey: key}, nil
+}
+func taskForm(form url.Values) tasks.Form {
+	return tasks.Form{CreateKey: form.Get("create_key"), Title: form.Get("title"), ProductURL: form.Get("product_url"), SKUColor: form.Get("sku_color"), SKUSize: form.Get("sku_size"), Quantity: form.Get("quantity"), MaxTotalPrice: form.Get("max_total_price")}
+}
+func csrfFor(context *gin.Context, options Options) string {
+	csrf, _ := options.Sessions.Ensure(context.Writer, context.Request)
+	return csrf
+}
+
+func taskListData(context *gin.Context, options Options, csrfToken string, filter tasks.TaskFilter) (webui.TasksData, error) {
+	rows, err := options.Tasks.ListTasks(context.Request.Context(), filter)
+	if err != nil {
+		return webui.TasksData{}, err
+	}
+	startKey, err := tasks.NewCreateKey()
+	if err != nil {
+		return webui.TasksData{}, err
+	}
+	return webui.TasksData{
+		CSRFToken: csrfToken,
+		Tasks:     rows,
+		Filter:    filter,
+		HasFilter: filter.Keyword != "" || filter.Status != "" || filter.CreatedFrom != "" || filter.CreatedTo != "",
+		StartKey:  startKey,
+	}, nil
+}
+
+func createErrorData(context *gin.Context, options Options, fullPage bool) (webui.TasksData, bool) {
+	csrfToken := csrfFor(context, options)
+	if fullPage {
+		return webui.TasksData{CSRFToken: csrfToken}, true
+	}
+	data, err := taskListData(context, options, csrfToken, tasks.TaskFilter{})
+	if err != nil {
+		context.Status(http.StatusInternalServerError)
+		return webui.TasksData{}, false
+	}
+	return data, true
+}
+
+func renderTasks(context *gin.Context, status int, data webui.TasksData) {
+	context.Header("Content-Type", "text/html; charset=utf-8")
+	context.Status(status)
+	if err := webui.RenderTasks(context.Writer, data); err != nil {
+		_ = context.Error(err)
+	}
+}
+
+func renderLogin(context *gin.Context, status int, csrfToken, returnPath, username, message string) {
+	context.Header("Content-Type", "text/html; charset=utf-8")
+	context.Status(status)
+	if err := webui.RenderLogin(context.Writer, webui.LoginData{
+		CSRFToken: csrfToken,
+		ReturnTo:  returnPath,
+		Username:  username,
+		Error:     message,
+	}); err != nil {
+		_ = context.Error(err)
+	}
+}
+
+func parseForm(context *gin.Context) bool {
+	context.Request.Body = http.MaxBytesReader(context.Writer, context.Request.Body, maxFormBytes)
+	if err := context.Request.ParseForm(); err != nil {
+		var tooLarge *http.MaxBytesError
+		if errors.As(err, &tooLarge) {
+			context.Status(http.StatusRequestEntityTooLarge)
+		} else {
+			context.Status(http.StatusBadRequest)
+		}
+		return false
+	}
+	return true
+}
+
+func firstError(validation tasks.Errors) string {
+	for _, field := range []string{"title", "product_url", "sku_color", "sku_size", "quantity", "max_total_price"} {
+		if _, ok := validation[field]; ok {
+			return field
+		}
+	}
+	return "title"
+}
+
+func returnTo(value string) string {
+	if value == "/tasks" || strings.HasPrefix(value, "/tasks/") || strings.HasPrefix(value, "/tasks?") {
+		if strings.Contains(value, "\\") || strings.Contains(value, "%") || strings.HasPrefix(value, "//") {
+			return "/tasks"
+		}
+		parsed, err := url.ParseRequestURI(value)
+		if err == nil && parsed.IsAbs() == false && parsed.Host == "" && hasSafeTaskPath(parsed.Path) {
+			return value
+		}
+	}
+
+	return "/tasks"
+}
+
+func hasSafeTaskPath(path string) bool {
+	for _, segment := range strings.Split(path, "/") {
+		if segment == "." || segment == ".." {
+			return false
+		}
+	}
+	return true
 }

admin/internal/server/router_test.go

@@ -1,28 +1,637 @@
 package server_test
 
 import (
+	"context"
+	"io"
 	"net/http"
 	"net/http/httptest"
+	"net/url"
+	"regexp"
+	"strings"
 	"testing"
+	"time"
 
+	"cmbuyer/admin/internal/auth"
+	"cmbuyer/admin/internal/deviceauth"
+	"cmbuyer/admin/internal/evidence"
 	"cmbuyer/admin/internal/server"
+	"cmbuyer/admin/internal/taskdetail"
+	"cmbuyer/admin/internal/tasks"
+
+	"github.com/gin-gonic/gin"
+	"golang.org/x/crypto/bcrypt"
 )
 
-func TestHealthz(t *testing.T) {
+var csrfPattern = regexp.MustCompile(`name="csrf_token" value="([^"]+)"`)
+var createKeyPattern = regexp.MustCompile(`name="create_key" value="([^"]+)"`)
+
+func TestHealthzIsPublic(t *testing.T) {
+	router, _ := newRouter(t)
 	request := httptest.NewRequest(http.MethodGet, "/healthz", nil)
 	response := httptest.NewRecorder()
 
-	server.NewRouter().ServeHTTP(response, request)
+	router.ServeHTTP(response, request)
 
 	if response.Code != http.StatusOK {
 		t.Fatalf("healthz status = %d, want %d", response.Code, http.StatusOK)
 	}
-
 	if contentType := response.Header().Get("Content-Type"); contentType != "application/json; charset=utf-8" {
 		t.Fatalf("healthz content type = %q, want application/json; charset=utf-8", contentType)
 	}
-
 	if body := response.Body.String(); body != "{\"status\":\"ok\"}" {
 		t.Fatalf("healthz body = %q, want {\"status\":\"ok\"}", body)
 	}
+	assertSecurityHeaders(t, response)
+}
+
+func TestTasksRequiresLoginAndBlocksOpenRedirects(t *testing.T) {
+	router, _ := newRouter(t)
+
+	tasks := serve(router, http.MethodGet, "/tasks", nil, nil)
+	if tasks.Code != http.StatusSeeOther {
+		t.Fatalf("GET /tasks status = %d, want %d", tasks.Code, http.StatusSeeOther)
+	}
+	if location := tasks.Header().Get("Location"); location != "/login?return_to=%2Ftasks" {
+		t.Fatalf("GET /tasks location = %q, want login return path", location)
+	}
+
+	for _, target := range []string{"https://example.invalid", "//example.invalid", `\\example.invalid`, "/other", "/tasks/..", "/tasks/../other", "/tasks/%2e%2e", "%2F%2Fevil.invalid", "%252F%252Fevil.invalid"} {
+		response := serve(router, http.MethodGet, "/login?return_to="+url.QueryEscape(target), nil, nil)
+		if response.Code != http.StatusOK {
+			t.Fatalf("GET /login return_to=%q status = %d, want 200", target, response.Code)
+		}
+		if strings.Contains(response.Body.String(), target) || !strings.Contains(response.Body.String(), `name="return_to" value="/tasks"`) {
+			t.Fatalf("GET /login accepted unsafe return_to %q", target)
+		}
+	}
+
+	encodedPath := serve(router, http.MethodGet, "/login?return_to=%2Ftasks%252F..", nil, nil)
+	if !strings.Contains(encodedPath.Body.String(), `name="return_to" value="/tasks"`) {
+		t.Fatal("encoded parent path was accepted as return_to")
+	}
+	encodedQuery := serve(router, http.MethodGet, "/login?return_to=%2Ftasks%3Fnext%3D%252Ftasks%252F..", nil, nil)
+	if !strings.Contains(encodedQuery.Body.String(), `name="return_to" value="/tasks"`) {
+		t.Fatal("encoded query bypass was accepted as return_to")
+	}
+}
+
+func TestLoginRotatesSessionAndCSRF(t *testing.T) {
+	router, _ := newRouter(t)
+	initial := serve(router, http.MethodGet, "/login?return_to=%2Ftasks%3Fview%3Dmine", nil, nil)
+	oldCookie := sessionCookie(t, initial)
+	oldCSRF := csrfToken(t, initial.Body.String())
+
+	login := serve(router, http.MethodPost, "/login", url.Values{
+		"csrf_token": {oldCSRF},
+		"return_to":  {"/tasks?view=mine"},
+		"username":   {"admin"},
+		"password":   {"test-password"},
+	}, oldCookie)
+	if login.Code != http.StatusSeeOther || login.Header().Get("Location") != "/tasks?view=mine" {
+		t.Fatalf("successful login = (%d, %q), want 303 /tasks?view=mine", login.Code, login.Header().Get("Location"))
+	}
+	newCookie := sessionCookie(t, login)
+	if newCookie.Value == oldCookie.Value {
+		t.Fatal("successful login reused the anonymous session cookie")
+	}
+
+	tasks := serve(router, http.MethodGet, "/tasks", nil, newCookie)
+	if tasks.Code != http.StatusOK {
+		t.Fatalf("GET /tasks after login status = %d, want 200", tasks.Code)
+	}
+	if newCSRF := csrfToken(t, tasks.Body.String()); newCSRF == oldCSRF {
+		t.Fatal("successful login reused the anonymous CSRF token")
+	}
+	for _, forbidden := range []string{"建单", "试选", "拼多多", "规格", "单价", "证据"} {
+		if strings.Contains(tasks.Body.String(), forbidden) {
+			t.Fatalf("task shell must not expose deferred feature content %q", forbidden)
+		}
+	}
+	assertSecurityHeaders(t, initial)
+	assertSecurityHeaders(t, tasks)
+}
+
+func TestLoginPageIncludesAccessibleFormBasics(t *testing.T) {
+	router, _ := newRouter(t)
+	page := serve(router, http.MethodGet, "/login", nil, nil)
+	body := page.Body.String()
+	for _, want := range []string{
+		`<label for="username">`,
+		`<label for="password">`,
+		`autocomplete="username"`,
+		`autocomplete="current-password"`,
+		`min-height:44px`,
+		`:focus-visible`,
+		`prefers-reduced-motion`,
+	} {
+		if !strings.Contains(body, want) {
+			t.Fatalf("login page is missing %q", want)
+		}
+	}
+	if strings.Contains(body, "http://") || strings.Contains(body, "https://") || strings.Contains(body, "<script") {
+		t.Fatal("login page must not load external resources or require client-side JavaScript")
+	}
+
+	failure := serve(router, http.MethodPost, "/login", url.Values{
+		"csrf_token": {csrfToken(t, body)},
+		"username":   {"admin"},
+		"password":   {"wrong"},
+	}, sessionCookie(t, page))
+	if !strings.Contains(failure.Body.String(), `role="alert"`) {
+		t.Fatal("login failure must announce its error")
+	}
+}
+
+func TestLoginCSRFAndCredentialFailuresAreSafe(t *testing.T) {
+	router, _ := newRouter(t)
+	page := serve(router, http.MethodGet, "/login", nil, nil)
+	cookie := sessionCookie(t, page)
+
+	withoutCSRF := serve(router, http.MethodPost, "/login", url.Values{
+		"username": {"admin"},
+		"password": {"test-password"},
+	}, cookie)
+	if withoutCSRF.Code != http.StatusForbidden || !strings.Contains(withoutCSRF.Body.String(), "请求已过期") {
+		t.Fatalf("login without CSRF = (%d, %q), want rejected form", withoutCSRF.Code, withoutCSRF.Body.String())
+	}
+
+	page = serve(router, http.MethodGet, "/login", nil, cookie)
+	badCredentials := serve(router, http.MethodPost, "/login", url.Values{
+		"csrf_token": {csrfToken(t, page.Body.String())},
+		"username":   {"unknown"},
+		"password":   {"wrong"},
+	}, cookie)
+	if badCredentials.Code != http.StatusUnauthorized {
+		t.Fatalf("login with invalid credentials status = %d, want 401", badCredentials.Code)
+	}
+	if body := badCredentials.Body.String(); !strings.Contains(body, "账号或密码不正确") || strings.Contains(body, "unknown") {
+		t.Fatalf("invalid login leaked account detail: %q", body)
+	}
+}
+
+func TestTamperedCookieCannotAccessTasks(t *testing.T) {
+	router, _ := newRouter(t)
+	page := serve(router, http.MethodGet, "/login", nil, nil)
+	cookie := sessionCookie(t, page)
+
+	tampered := *cookie
+	tampered.Value = flipCookieValue(t, cookie.Value)
+	response := serve(router, http.MethodGet, "/tasks", nil, &tampered)
+	if response.Code != http.StatusSeeOther {
+		t.Fatalf("tampered cookie status = %d, want 303", response.Code)
+	}
+
+}
+
+func TestTaskCreationRendersSharedFormsAndPersistsOnlyDraft(t *testing.T) {
+	router, _ := newRouter(t)
+	cookie := authenticate(t, router)
+
+	modal := serve(router, http.MethodGet, "/tasks?create=1", nil, cookie)
+	if modal.Code != http.StatusOK {
+		t.Fatalf("GET dialog form status = %d, want 200", modal.Code)
+	}
+	fullPage := serve(router, http.MethodGet, "/tasks/new", nil, cookie)
+	if fullPage.Code != http.StatusOK {
+		t.Fatalf("GET full form status = %d, want 200", fullPage.Code)
+	}
+	for _, want := range []string{`<div class="modal-scrim"`, `<dialog open`, `aria-modal="true"`, `name="title"`, `name="product_url"`, `name="sku_color"`, `name="sku_size"`, `name="quantity"`, `name="max_total_price"`, `type="url" inputmode="url" maxlength="2048"`, `type="number" inputmode="numeric" min="1" step="1"`, `inputmode="decimal" pattern="[0-9]+(\.[0-9]{1,2})?"`, `maxlength="120"`, `maxlength="80"`, `required`, `autofocus`, `导入</button><a class="button primary"`, `type="search"`, `data-start-purchases`, `data-select-all`, `最高总额`, `min-height:44px`, `:focus-visible`, `overflow-x:auto`, `prefers-reduced-motion`} {
+		if !strings.Contains(modal.Body.String(), want) {
+			t.Fatalf("dialog form is missing %q", want)
+		}
+	}
+	for _, want := range []string{`name="title"`, `name="product_url"`, `name="sku_color"`, `name="sku_size"`, `name="quantity"`, `name="max_total_price"`, `name="form_mode" value="full"`} {
+		if !strings.Contains(fullPage.Body.String(), want) {
+			t.Fatalf("full-page form is missing %q", want)
+		}
+	}
+
+	invalid := serve(router, http.MethodPost, "/tasks", url.Values{
+		"csrf_token":      {csrfToken(t, modal.Body.String())},
+		"create_key":      {createKey(t, modal.Body.String())},
+		"title":           {`<script>alert(1)</script>`},
+		"product_url":     {"https://mobile.yangkeduo.com/goods.html?goods_id=937122477375&uin=discard"},
+		"sku_color":       {"black"},
+		"sku_size":        {"M"},
+		"quantity":        {"0"},
+		"max_total_price": {"12.80"},
+		"form_mode":       {"dialog"},
+	}, cookie)
+	if invalid.Code != http.StatusBadRequest || !strings.Contains(invalid.Body.String(), `<dialog open`) || !strings.Contains(invalid.Body.String(), "数量必须是正整数") || !strings.Contains(invalid.Body.String(), `role="alert"`) || !strings.Contains(invalid.Body.String(), `href="#quantity"`) || !strings.Contains(invalid.Body.String(), `aria-describedby="quantity-error"`) || !strings.Contains(invalid.Body.String(), `autofocus`) {
+		t.Fatalf("invalid create = (%d, %q), want dialog validation response", invalid.Code, invalid.Body.String())
+	}
+	if strings.Contains(invalid.Body.String(), `<script>alert(1)</script>`) || !strings.Contains(invalid.Body.String(), `&lt;script&gt;alert(1)&lt;/script&gt;`) {
+		t.Fatalf("invalid create did not safely preserve title: %q", invalid.Body.String())
+	}
+	if strings.Contains(invalid.Body.String(), "uin=discard") || !strings.Contains(invalid.Body.String(), `value="https://mobile.yangkeduo.com/goods.html?goods_id=937122477375"`) {
+		t.Fatalf("invalid create did not canonicalize product URL: %q", invalid.Body.String())
+	}
+
+	createPage := serve(router, http.MethodGet, "/tasks?create=1", nil, cookie)
+	key := createKey(t, createPage.Body.String())
+	created := serve(router, http.MethodPost, "/tasks", url.Values{
+		"csrf_token":      {csrfToken(t, createPage.Body.String())},
+		"create_key":      {key},
+		"title":           {"<b>夏季上衣</b>"},
+		"product_url":     {"https://mobile.yangkeduo.com/goods.html?goods_id=937122477375&utm_source=discard"},
+		"sku_color":       {"black"},
+		"sku_size":        {"M"},
+		"quantity":        {"2"},
+		"max_total_price": {"12.8"},
+		"form_mode":       {"dialog"},
+	}, cookie)
+	if created.Code != http.StatusSeeOther || !strings.HasPrefix(created.Header().Get("Location"), "/tasks?created=") {
+		t.Fatalf("valid create = (%d, %q), want 303 to a created-task acknowledgement", created.Code, created.Header().Get("Location"))
+	}
+	replay := serve(router, http.MethodPost, "/tasks", url.Values{
+		"csrf_token":      {csrfToken(t, createPage.Body.String())},
+		"create_key":      {key},
+		"title":           {"<b>夏季上衣</b>"},
+		"product_url":     {"https://mobile.yangkeduo.com/goods.html?goods_id=937122477375&utm_source=discard"},
+		"sku_color":       {"black"},
+		"sku_size":        {"M"},
+		"quantity":        {"2"},
+		"max_total_price": {"12.8"},
+		"form_mode":       {"dialog"},
+	}, cookie)
+	if replay.Code != http.StatusSeeOther {
+		t.Fatalf("idempotent replay status = %d, want 303", replay.Code)
+	}
+	conflict := serve(router, http.MethodPost, "/tasks", url.Values{
+		"csrf_token":      {csrfToken(t, createPage.Body.String())},
+		"create_key":      {key},
+		"title":           {"different task"},
+		"product_url":     {"https://mobile.yangkeduo.com/goods.html?goods_id=937122477375"},
+		"sku_color":       {"black"},
+		"sku_size":        {"M"},
+		"quantity":        {"2"},
+		"max_total_price": {"12.80"},
+		"form_mode":       {"dialog"},
+	}, cookie)
+	if conflict.Code != http.StatusConflict || !strings.Contains(conflict.Body.String(), "该创建请求已用于另一条任务") {
+		t.Fatalf("conflicting create = (%d, %q), want a 409 form error", conflict.Code, conflict.Body.String())
+	}
+
+	list := serve(router, http.MethodGet, created.Header().Get("Location"), nil, cookie)
+	if list.Code != http.StatusOK {
+		t.Fatalf("GET /tasks status = %d, want 200", list.Code)
+	}
+	body := list.Body.String()
+	for _, want := range []string{`任务已创建，已显示在列表首行。`, `&lt;b&gt;夏季上衣&lt;/b&gt;`, `https://mobile.yangkeduo.com/goods.html?goods_id=937122477375`, `target="_blank"`, `rel="noopener noreferrer"`, `¥12.80`, `待开始`, `选择全部任务`, `选择任务`} {
+		if !strings.Contains(body, want) {
+			t.Fatalf("task list is missing %q", want)
+		}
+	}
+	for _, forbidden := range []string{"utm_source", "试选", "订单确认", "真机", "提交订单"} {
+		if strings.Contains(body, forbidden) {
+			t.Fatalf("task list exposed deferred scope %q", forbidden)
+		}
+	}
+}
+
+func TestTasksPageKeepsOriginalShellAndRendersFilteredWorkbench(t *testing.T) {
+	store := &memoryStore{rows: []tasks.TaskRow{
+		{ID: "b3c9f507-7473-4fa6-8d71-8786c34c6301", Title: "待开始衬衫", GoodsID: "937122477375", SKUColor: "黑色", SKUSize: "M", Quantity: 2, MaxTotalPrice: "12.80", Status: "DRAFT", Version: 3, CreatedAt: time.Date(2026, 8, 4, 1, 2, 3, 0, time.UTC)},
+		{ID: "c3c9f507-7473-4fa6-8d71-8786c34c6301", Title: "等待领取衬衫", GoodsID: "958756616606", SKUColor: "白色", SKUSize: "L", Quantity: 1, MaxTotalPrice: "20.00", Status: "PENDING", Version: 4, CreatedAt: time.Date(2026, 8, 4, 2, 3, 4, 0, time.UTC)},
+	}}
+	router, _ := newRouterWithStore(t, store)
+	cookie := authenticate(t, router)
+	query := url.Values{"keyword": {"衬衫"}, "created_from": {"2026-08-04"}, "created_to": {"2026-08-04"}}
+	response := serve(router, http.MethodGet, "/tasks?"+query.Encode(), nil, cookie)
+	if response.Code != http.StatusOK {
+		t.Fatalf("filtered tasks status = %d, want 200", response.Code)
+	}
+	body := response.Body.String()
+	for _, want := range []string{
+		`<a class="skip" href="#main">`,
+		`:focus-visible`,
+		`min-height:44px`,
+		`@media(max-width:420px)`,
+		`prefers-reduced-motion`,
+		`<button class="button" type="button" disabled>导入</button><a class="button primary" href="/tasks?create=1">创建任务</a>`,
+		`name="keyword" type="search" value="衬衫"`,
+		`name="created_from" type="date" value="2026-08-04"`,
+		`name="created_to" type="date" value="2026-08-04"`,
+		`data-start-purchases`,
+		`data-selection-summary aria-live="polite"`,
+		`系统不会付款`,
+		`开始采购（只创建待付款订单）`,
+		`采购结果`,
+		`创建时间（上海）`,
+		`https://mobile.yangkeduo.com/goods.html?goods_id=937122477375`,
+		`target="_blank" rel="noopener noreferrer"`,
+		`data-task-row data-detail-url="/tasks/b3c9f507-7473-4fa6-8d71-8786c34c6301" tabindex="0"`,
+		`data-open-detail>查看详情</button>`,
+		`.detail-link-button{display:block;min-height:44px`,
+		`data-detail-drawer aria-modal="true"`,
+		`待开始`,
+		`已授权待领取`,
+		`datetime="2026-08-04T09:02:03&#43;08:00">2026-08-04 09:02`,
+		`<script src="/static/tasks.js" defer></script>`,
+	} {
+		if !strings.Contains(body, want) {
+			t.Fatalf("workbench is missing %q", want)
+		}
+	}
+	if strings.Index(body, `name="keyword"`) > strings.Index(body, `data-start-purchases`) || strings.Index(body, `data-start-purchases`) > strings.Index(body, `<div class="table-wrap">`) {
+		t.Fatal("workbench rows are not ordered as toolbar, filters, batch actions, table")
+	}
+	if count := strings.Count(body, `data-task-id=`); count != 1 {
+		t.Fatalf("selectable row count = %d, want only the DRAFT row", count)
+	}
+	for _, forbidden := range []string{`<th scope="col">操作</th>`, `确认开始采购`, `确认机器选对了吗`} {
+		if strings.Contains(body, forbidden) {
+			t.Fatalf("workbench exposed forbidden per-row or confirmation UI %q", forbidden)
+		}
+	}
+	if store.listTasksCalls != 1 || store.listDraftsCalls != 0 {
+		t.Fatalf("GET /tasks calls = (ListTasks %d, ListDrafts %d), want (1, 0)", store.listTasksCalls, store.listDraftsCalls)
+	}
+}
+
+func TestTasksPageRerendersAccessibleFilterErrorsAndKeepsValues(t *testing.T) {
+	store := &memoryStore{}
+	router, _ := newRouterWithStore(t, store)
+	cookie := authenticate(t, router)
+	query := url.Values{
+		"keyword":      {`保留%_\`},
+		"status":       {"UNKNOWN"},
+		"created_from": {"2026-02-30"},
+		"created_to":   {"not-a-date"},
+	}
+	response := serve(router, http.MethodGet, "/tasks?"+query.Encode(), nil, cookie)
+	if response.Code != http.StatusBadRequest {
+		t.Fatalf("invalid filter status = %d, want 400", response.Code)
+	}
+	body := response.Body.String()
+	for _, want := range []string{
+		`role="alert" aria-live="assertive"`,
+		`href="#filter-status"`,
+		`href="#filter-created-from"`,
+		`href="#filter-created-to"`,
+		`name="keyword" type="search" value="保留%_\"`,
+		`<option value="UNKNOWN" selected>无效状态：UNKNOWN</option>`,
+		`name="created_from" type="date" value="2026-02-30" aria-invalid="true" aria-describedby="filter-created-from-error"`,
+		`name="created_to" type="date" value="not-a-date" aria-invalid="true" aria-describedby="filter-created-to-error"`,
+		`id="filter-status-error"`,
+		`id="filter-created-from-error"`,
+		`id="filter-created-to-error"`,
+		`筛选条件有误`,
+	} {
+		if !strings.Contains(body, want) {
+			t.Fatalf("invalid filter page is missing %q", want)
+		}
+	}
+	if store.listTasksCalls != 0 || store.listDraftsCalls != 0 {
+		t.Fatalf("invalid filter queried stores: ListTasks=%d ListDrafts=%d", store.listTasksCalls, store.listDraftsCalls)
+	}
+	assertSecurityHeaders(t, response)
+}
+
+func TestTaskCreationRequiresAuthenticationAndCSRF(t *testing.T) {
+	router, _ := newRouter(t)
+	if response := serve(router, http.MethodPost, "/tasks", url.Values{}, nil); response.Code != http.StatusUnauthorized {
+		t.Fatalf("anonymous POST /tasks = %d, want 401", response.Code)
+	}
+	cookie := authenticate(t, router)
+	if response := serve(router, http.MethodPost, "/tasks", url.Values{}, cookie); response.Code != http.StatusForbidden {
+		t.Fatalf("POST /tasks without CSRF = %d, want 403", response.Code)
+	}
+}
+
+func TestTaskCreationFailsClosedForMalformedOrOversizedForms(t *testing.T) {
+	router, _ := newRouter(t)
+	cookie := authenticate(t, router)
+	page := serve(router, http.MethodGet, "/tasks?create=1", nil, cookie)
+	base := url.Values{
+		"csrf_token":      {csrfToken(t, page.Body.String())},
+		"create_key":      {createKey(t, page.Body.String())},
+		"title":           {"title"},
+		"product_url":     {"https://mobile.yangkeduo.com/goods.html?goods_id=1;uin=malformed"},
+		"sku_color":       {"black"},
+		"sku_size":        {"M"},
+		"quantity":        {"1"},
+		"max_total_price": {"1.00"},
+		"form_mode":       {"dialog"},
+	}
+	malformed := serve(router, http.MethodPost, "/tasks", base, cookie)
+	if malformed.Code != http.StatusBadRequest || !strings.Contains(malformed.Body.String(), "canonical 商品链接") {
+		t.Fatalf("malformed URL create = (%d, %q), want validation failure", malformed.Code, malformed.Body.String())
+	}
+
+	oversized := url.Values{"csrf_token": {csrfToken(t, page.Body.String())}, "title": {strings.Repeat("x", 9<<10)}}
+	if response := serve(router, http.MethodPost, "/tasks", oversized, cookie); response.Code != http.StatusRequestEntityTooLarge {
+		t.Fatalf("oversized form status = %d, want 413", response.Code)
+	}
+}
+
+func assertSecurityHeaders(t *testing.T, response *httptest.ResponseRecorder) {
+	t.Helper()
+	want := map[string]string{
+		"Cache-Control":           "no-store",
+		"X-Content-Type-Options":  "nosniff",
+		"Referrer-Policy":         "no-referrer",
+		"Content-Security-Policy": "default-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self'; object-src 'none'; base-uri 'none'; frame-ancestors 'none'; form-action 'self'",
+	}
+	for name, expected := range want {
+		if got := response.Header().Get(name); got != expected {
+			t.Fatalf("%s = %q, want %q", name, got, expected)
+		}
+	}
+}
+
+func flipCookieValue(t *testing.T, value string) string {
+	t.Helper()
+	if value == "" {
+		t.Fatal("cannot tamper with an empty cookie")
+	}
+	if value[0] == 'A' {
+		return "B" + value[1:]
+	}
+	return "A" + value[1:]
+}
+
+func TestLogoutRequiresCSRFAndRevokesSession(t *testing.T) {
+	router, _ := newRouter(t)
+	loginPage := serve(router, http.MethodGet, "/login", nil, nil)
+	loginCookie := sessionCookie(t, loginPage)
+	login := serve(router, http.MethodPost, "/login", url.Values{
+		"csrf_token": {csrfToken(t, loginPage.Body.String())},
+		"username":   {"admin"},
+		"password":   {"test-password"},
+	}, loginCookie)
+	authenticatedCookie := sessionCookie(t, login)
+
+	missingCSRF := serve(router, http.MethodPost, "/logout", url.Values{}, authenticatedCookie)
+	if missingCSRF.Code != http.StatusForbidden {
+		t.Fatalf("logout without CSRF status = %d, want 403", missingCSRF.Code)
+	}
+
+	tasks := serve(router, http.MethodGet, "/tasks", nil, authenticatedCookie)
+	logout := serve(router, http.MethodPost, "/logout", url.Values{
+		"csrf_token": {csrfToken(t, tasks.Body.String())},
+	}, authenticatedCookie)
+	if logout.Code != http.StatusSeeOther || logout.Header().Get("Location") != "/login" {
+		t.Fatalf("logout = (%d, %q), want 303 /login", logout.Code, logout.Header().Get("Location"))
+	}
+	if cookie := sessionCookie(t, logout); cookie.MaxAge >= 0 {
+		t.Fatalf("logout cookie MaxAge = %d, want a deletion cookie", cookie.MaxAge)
+	}
+
+	reused := serve(router, http.MethodGet, "/tasks", nil, authenticatedCookie)
+	if reused.Code != http.StatusSeeOther {
+		t.Fatalf("revoked session status = %d, want 303", reused.Code)
+	}
+}
+
+func newRouter(t *testing.T) (*gin.Engine, *auth.Manager) {
+	return newRouterWithStore(t, &memoryStore{})
+}
+
+func newRouterWithStore(t *testing.T, store tasks.Store) (*gin.Engine, *auth.Manager) {
+	return newRouterWithDependencies(t, store, emptyDetailStore{}, emptyEvidenceStore{}, deviceauth.RejectAllAuthenticator{})
+}
+
+func newRouterWithDependencies(t *testing.T, store tasks.Store, details taskdetail.Store, evidenceStore evidence.Store, deviceAuthenticator deviceauth.Authenticator) (*gin.Engine, *auth.Manager) {
+	t.Helper()
+	gin.SetMode(gin.TestMode)
+	hash, err := bcrypt.GenerateFromPassword([]byte("test-password"), bcrypt.MinCost)
+	if err != nil {
+		t.Fatalf("generate bcrypt hash: %v", err)
+	}
+	manager := auth.NewManager([]byte(strings.Repeat("s", 32)), false)
+	router, err := server.NewRouter(server.Options{
+		AdminUsername:       "admin",
+		AdminPasswordBcrypt: string(hash),
+		Sessions:            manager,
+		Tasks:               store,
+		TaskDetails:         details,
+		Evidence:            evidenceStore,
+		DeviceAuthenticator: deviceAuthenticator,
+	})
+	if err != nil {
+		t.Fatalf("NewRouter: %v", err)
+	}
+	return router, manager
+}
+
+type emptyDetailStore struct{}
+
+func (emptyDetailStore) Get(context.Context, string) (taskdetail.Detail, error) {
+	return taskdetail.Detail{}, taskdetail.ErrNotFound
+}
+
+type emptyEvidenceStore struct{}
+
+func (emptyEvidenceStore) Stage(io.Reader, string) (evidence.StagedFile, error) {
+	return evidence.StagedFile{}, evidence.ErrInvalid
+}
+func (emptyEvidenceStore) Discard(evidence.StagedFile) {}
+func (emptyEvidenceStore) Commit(context.Context, deviceauth.Principal, evidence.UploadMetadata, evidence.StagedFile) (evidence.Asset, bool, error) {
+	return evidence.Asset{}, false, evidence.ErrInvalid
+}
+func (emptyEvidenceStore) Open(context.Context, string) (evidence.Asset, io.ReadSeekCloser, error) {
+	return evidence.Asset{}, nil, evidence.ErrNotFound
+}
+
+type memoryStore struct {
+	drafts          []tasks.Draft
+	rows            []tasks.TaskRow
+	listDraftsCalls int
+	listTasksCalls  int
+	startCalls      int
+}
+
+func (store *memoryStore) CreateDraft(_ context.Context, draft tasks.Draft) (tasks.Draft, error) {
+	for _, existing := range store.drafts {
+		if existing.ID == draft.ID {
+			if existing.Title != draft.Title || existing.GoodsID != draft.GoodsID || existing.SKUColor != draft.SKUColor || existing.SKUSize != draft.SKUSize || existing.Quantity != draft.Quantity || existing.MaxTotalPrice != draft.MaxTotalPrice {
+				return tasks.Draft{}, tasks.ErrCreateKeyConflict
+			}
+			return existing, nil
+		}
+	}
+	store.drafts = append(store.drafts, draft)
+	return draft, nil
+}
+func (store *memoryStore) ListDrafts(_ context.Context) ([]tasks.Draft, error) {
+	store.listDraftsCalls++
+	return append([]tasks.Draft(nil), store.drafts...), nil
+}
+func (store *memoryStore) ListTasks(_ context.Context, _ tasks.TaskFilter) ([]tasks.TaskRow, error) {
+	store.listTasksCalls++
+	if store.rows != nil {
+		return append([]tasks.TaskRow(nil), store.rows...), nil
+	}
+	result := make([]tasks.TaskRow, 0, len(store.drafts))
+	for _, draft := range store.drafts {
+		result = append(result, tasks.TaskRow{ID: draft.ID, Title: draft.Title, GoodsID: draft.GoodsID, SKUColor: draft.SKUColor, SKUSize: draft.SKUSize, Quantity: draft.Quantity, MaxTotalPrice: draft.MaxTotalPrice, Status: "DRAFT", Version: 1, CreatedAt: draft.CreatedAt})
+	}
+	return result, nil
+}
+func (store *memoryStore) StartPurchases(_ context.Context, _ tasks.StartCommand, _ string) (tasks.StartResult, error) {
+	store.startCalls++
+	return tasks.StartResult{}, tasks.ErrInvalidStart
+}
+
+func serve(router http.Handler, method, target string, form url.Values, cookie *http.Cookie) *httptest.ResponseRecorder {
+	var body *strings.Reader
+	if form == nil {
+		body = strings.NewReader("")
+	} else {
+		body = strings.NewReader(form.Encode())
+	}
+	request := httptest.NewRequest(method, target, body)
+	if form != nil {
+		request.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	}
+	if cookie != nil {
+		request.AddCookie(cookie)
+	}
+	response := httptest.NewRecorder()
+	router.ServeHTTP(response, request)
+	return response
+}
+
+func sessionCookie(t *testing.T, response *httptest.ResponseRecorder) *http.Cookie {
+	t.Helper()
+	for _, cookie := range response.Result().Cookies() {
+		if cookie.Name == auth.CookieName {
+			return cookie
+		}
+	}
+	t.Fatalf("response did not set %s cookie", auth.CookieName)
+	return nil
+}
+
+func csrfToken(t *testing.T, body string) string {
+	t.Helper()
+	matches := csrfPattern.FindStringSubmatch(body)
+	if len(matches) != 2 || matches[1] == "" {
+		t.Fatalf("no CSRF token in response body: %q", body)
+	}
+	return matches[1]
+}
+
+func createKey(t *testing.T, body string) string {
+	t.Helper()
+	matches := createKeyPattern.FindStringSubmatch(body)
+	if len(matches) != 2 || matches[1] == "" {
+		t.Fatalf("no create key in response body: %q", body)
+	}
+	return matches[1]
+}
+
+func authenticate(t *testing.T, router http.Handler) *http.Cookie {
+	t.Helper()
+	page := serve(router, http.MethodGet, "/login", nil, nil)
+	login := serve(router, http.MethodPost, "/login", url.Values{
+		"csrf_token": {csrfToken(t, page.Body.String())},
+		"username":   {"admin"},
+		"password":   {"test-password"},
+	}, sessionCookie(t, page))
+	if login.Code != http.StatusSeeOther {
+		t.Fatalf("authenticate status = %d, want 303", login.Code)
+	}
+	return sessionCookie(t, login)
 }

admin/internal/server/start_purchases_test.go

@@ -0,0 +1,328 @@
+package server_test
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	"cmbuyer/admin/internal/tasks"
+)
+
+const (
+	startKeyForHTTP = "c3c9f507-7473-4fa6-8d71-8786c34c6301"
+	taskIDForHTTP   = "a3c9f507-7473-4fa6-8d71-8786c34c6301"
+)
+
+func TestStartPurchasesAuthenticatesBeforeInspectingRequestBody(t *testing.T) {
+	store := &startRecordingStore{}
+	router, _ := newRouterWithStore(t, store)
+	hugeMalformed := `{"start_key":"` + strings.Repeat("x", 70<<10)
+
+	for name, request := range map[string]*http.Request{
+		"anonymous malformed": newStartRequest(t, hugeMalformed, "text/plain", "", nil),
+		"device bearer":       newStartRequest(t, validStartBody(), "application/json", "", nil),
+	} {
+		t.Run(name, func(t *testing.T) {
+			if name == "device bearer" {
+				request.Header.Set("Authorization", "Bearer device-token")
+			}
+			response := httptest.NewRecorder()
+			router.ServeHTTP(response, request)
+			if response.Code != http.StatusUnauthorized {
+				t.Fatalf("status = %d, want 401", response.Code)
+			}
+		})
+	}
+
+	cookie, csrf := authenticatedStartSession(t, router)
+	for name, token := range map[string]string{"missing CSRF": "", "wrong CSRF": "wrong-csrf"} {
+		request := newStartRequest(t, hugeMalformed, "text/plain", token, cookie)
+		response := httptest.NewRecorder()
+		router.ServeHTTP(response, request)
+		if response.Code != http.StatusForbidden {
+			t.Fatalf("%s status = %d, want 403", name, response.Code)
+		}
+	}
+	if csrf == "" {
+		t.Fatal("authenticated page did not contain a CSRF token")
+	}
+	if store.startCalls != 0 {
+		t.Fatalf("unauthorized requests called store %d times", store.startCalls)
+	}
+}
+
+func TestStartPurchasesRejectsInvalidUTF8BeforeJSONDecoding(t *testing.T) {
+	validPrefix := []byte(`{"start_key":"` + startKeyForHTTP + `","tasks":[],"start_key":"`)
+	duplicateKeyBypass := append(append([]byte(nil), validPrefix...), 0xff)
+	duplicateKeyBypass = append(duplicateKeyBypass, []byte(`"}`)...)
+	invalidWhitespace := append([]byte(validStartBody()), 0xfe)
+
+	for name, body := range map[string][]byte{
+		"invalid byte after JSON":     invalidWhitespace,
+		"invalid duplicate-key value": duplicateKeyBypass,
+	} {
+		t.Run(name, func(t *testing.T) {
+			store := &startRecordingStore{}
+			router, _ := newRouterWithStore(t, store)
+			cookie, csrf := authenticatedStartSession(t, router)
+			response := serveStartBytes(t, router, body, "application/json", csrf, cookie)
+			if response.Code != http.StatusBadRequest || store.startCalls != 0 {
+				t.Fatalf("status/calls = %d/%d, want 400/0", response.Code, store.startCalls)
+			}
+			if response.Body.Len() != 0 {
+				t.Fatalf("invalid UTF-8 response leaked body %q", response.Body.String())
+			}
+		})
+	}
+}
+
+func TestStartPurchasesEnforcesExact64KiBBodyBoundary(t *testing.T) {
+	const limit = 64 << 10
+	base := validStartBody()
+	for name, test := range map[string]struct {
+		body      string
+		want      int
+		wantCalls int
+	}{
+		"exact limit": {body: base + strings.Repeat(" ", limit-len(base)), want: http.StatusOK, wantCalls: 1},
+		"one over":    {body: base + strings.Repeat(" ", limit-len(base)+1), want: http.StatusRequestEntityTooLarge},
+	} {
+		t.Run(name, func(t *testing.T) {
+			store := &startRecordingStore{startResult: successfulStartResult()}
+			router, _ := newRouterWithStore(t, store)
+			cookie, csrf := authenticatedStartSession(t, router)
+			response := serveStartRequest(t, router, test.body, "application/json", csrf, cookie)
+			if response.Code != test.want || store.startCalls != test.wantCalls {
+				t.Fatalf("status/calls = %d/%d, want %d/%d", response.Code, store.startCalls, test.want, test.wantCalls)
+			}
+		})
+	}
+}
+
+func TestStartPurchasesContentTypeContract(t *testing.T) {
+	for _, contentType := range []string{
+		"application/json",
+		"application/json; charset=utf-8",
+		"application/json;charset=UTF-8",
+	} {
+		t.Run("accept "+contentType, func(t *testing.T) {
+			store := &startRecordingStore{startResult: successfulStartResult()}
+			router, _ := newRouterWithStore(t, store)
+			cookie, csrf := authenticatedStartSession(t, router)
+			response := serveStartRequest(t, router, validStartBody(), contentType, csrf, cookie)
+			if response.Code != http.StatusOK || store.startCalls != 1 {
+				t.Fatalf("status/calls = %d/%d, want 200/1", response.Code, store.startCalls)
+			}
+		})
+	}
+
+	for _, contentType := range []string{
+		"",
+		"text/plain",
+		"application/json-patch+json",
+		"application/json; charset=gbk",
+		"application/json; profile=unapproved",
+		"application/json; charset",
+	} {
+		t.Run("reject "+contentType, func(t *testing.T) {
+			store := &startRecordingStore{}
+			router, _ := newRouterWithStore(t, store)
+			cookie, csrf := authenticatedStartSession(t, router)
+			response := serveStartRequest(t, router, validStartBody(), contentType, csrf, cookie)
+			if response.Code != http.StatusUnsupportedMediaType || store.startCalls != 0 {
+				t.Fatalf("status/calls = %d/%d, want 415/0", response.Code, store.startCalls)
+			}
+		})
+	}
+}
+
+func TestStartPurchasesRejectsMalformedAndOversizedJSON(t *testing.T) {
+	tests := []struct {
+		name      string
+		body      string
+		want      int
+		storeErr  error
+		wantCalls int
+	}{
+		{name: "empty", body: "", want: http.StatusBadRequest},
+		{name: "empty object", body: `{}`, want: http.StatusBadRequest, storeErr: tasks.ErrInvalidStart, wantCalls: 1},
+		{name: "null object", body: `null`, want: http.StatusBadRequest, storeErr: tasks.ErrInvalidStart, wantCalls: 1},
+		{name: "malformed", body: `{`, want: http.StatusBadRequest},
+		{name: "wrong top-level type", body: `[]`, want: http.StatusBadRequest},
+		{name: "unknown field", body: `{"start_key":"` + startKeyForHTTP + `","tasks":[],"created_by":"attacker"}`, want: http.StatusBadRequest},
+		{name: "wrong field type", body: `{"start_key":"` + startKeyForHTTP + `","tasks":[{"task_id":"` + taskIDForHTTP + `","expected_task_version":"1"}]}`, want: http.StatusBadRequest},
+		{name: "second JSON value", body: validStartBody() + `{}`, want: http.StatusBadRequest},
+		{name: "duplicate task ids", body: `{"start_key":"` + startKeyForHTTP + `","tasks":[{"task_id":"` + taskIDForHTTP + `","expected_task_version":1},{"task_id":"` + taskIDForHTTP + `","expected_task_version":1}]}`, want: http.StatusBadRequest, storeErr: tasks.ErrInvalidStart, wantCalls: 1},
+		{name: "oversized first value", body: `{"start_key":"` + strings.Repeat("x", 70<<10), want: http.StatusRequestEntityTooLarge},
+		{name: "oversized trailing whitespace", body: validStartBody() + strings.Repeat(" ", 70<<10), want: http.StatusRequestEntityTooLarge},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			store := &startRecordingStore{startErr: test.storeErr}
+			router, _ := newRouterWithStore(t, store)
+			cookie, csrf := authenticatedStartSession(t, router)
+			response := serveStartRequest(t, router, test.body, "application/json", csrf, cookie)
+			if response.Code != test.want || store.startCalls != test.wantCalls {
+				t.Fatalf("status/calls = %d/%d, want %d/%d", response.Code, store.startCalls, test.want, test.wantCalls)
+			}
+			if response.Body.Len() != 0 {
+				t.Fatalf("error response leaked body %q", response.Body.String())
+			}
+			assertSecurityHeaders(t, response)
+		})
+	}
+}
+
+func TestStartPurchasesUsesAuthenticatedAdminAndReturnsStableSafeResult(t *testing.T) {
+	result := successfulStartResult()
+	store := &startRecordingStore{startResult: result}
+	router, _ := newRouterWithStore(t, store)
+	cookie, csrf := authenticatedStartSession(t, router)
+
+	first := serveStartRequest(t, router, validStartBody(), "application/json; charset=utf-8", csrf, cookie)
+	second := serveStartRequest(t, router, validStartBody(), "application/json", csrf, cookie)
+	for index, response := range []*httptest.ResponseRecorder{first, second} {
+		if response.Code != http.StatusOK {
+			t.Fatalf("response %d status = %d, want 200", index, response.Code)
+		}
+		if got := response.Header().Get("Content-Type"); got != "application/json; charset=utf-8" {
+			t.Fatalf("response content type = %q", got)
+		}
+		var decoded tasks.StartResult
+		if err := json.Unmarshal(response.Body.Bytes(), &decoded); err != nil {
+			t.Fatalf("decode response: %v", err)
+		}
+		if decoded.PaymentAutomated || decoded.AuthorizedCount != 1 || decoded.Tasks[0].AuthorizationID != result.Tasks[0].AuthorizationID {
+			t.Fatalf("unsafe or unstable response = %#v", decoded)
+		}
+		assertSecurityHeaders(t, response)
+	}
+	if store.startCalls != 2 || len(store.createdBy) != 2 || store.createdBy[0] != "admin" || store.createdBy[1] != "admin" {
+		t.Fatalf("store calls/created_by = %d/%#v", store.startCalls, store.createdBy)
+	}
+	for _, command := range store.commands {
+		if command.StartKey != startKeyForHTTP || len(command.Tasks) != 1 || command.Tasks[0].TaskID != taskIDForHTTP || command.Tasks[0].ExpectedTaskVersion != 7 {
+			t.Fatalf("decoded command = %#v", command)
+		}
+	}
+}
+
+func TestStartPurchasesMapsStoreErrorsWithoutLeakingDetails(t *testing.T) {
+	for name, test := range map[string]struct {
+		err  error
+		want int
+	}{
+		"invalid":  {err: tasks.ErrInvalidStart, want: http.StatusBadRequest},
+		"conflict": {err: tasks.ErrStartConflict, want: http.StatusConflict},
+		"internal": {err: errors.New("sqlite secret path and query"), want: http.StatusInternalServerError},
+	} {
+		t.Run(name, func(t *testing.T) {
+			store := &startRecordingStore{startErr: test.err}
+			router, _ := newRouterWithStore(t, store)
+			cookie, csrf := authenticatedStartSession(t, router)
+			response := serveStartRequest(t, router, validStartBody(), "application/json", csrf, cookie)
+			if response.Code != test.want || store.startCalls != 1 {
+				t.Fatalf("status/calls = %d/%d, want %d/1", response.Code, store.startCalls, test.want)
+			}
+			if response.Body.Len() != 0 || strings.Contains(response.Body.String(), "sqlite") {
+				t.Fatalf("error leaked details: %q", response.Body.String())
+			}
+		})
+	}
+}
+
+type startRecordingStore struct {
+	startResult tasks.StartResult
+	startErr    error
+	startCalls  int
+	commands    []tasks.StartCommand
+	createdBy   []string
+}
+
+func (store *startRecordingStore) CreateDraft(_ context.Context, draft tasks.Draft) (tasks.Draft, error) {
+	return draft, nil
+}
+
+func (store *startRecordingStore) ListDrafts(context.Context) ([]tasks.Draft, error) {
+	return nil, nil
+}
+
+func (store *startRecordingStore) ListTasks(context.Context, tasks.TaskFilter) ([]tasks.TaskRow, error) {
+	return nil, nil
+}
+
+func (store *startRecordingStore) StartPurchases(_ context.Context, command tasks.StartCommand, createdBy string) (tasks.StartResult, error) {
+	store.startCalls++
+	store.commands = append(store.commands, command)
+	store.createdBy = append(store.createdBy, createdBy)
+	return store.startResult, store.startErr
+}
+
+func authenticatedStartSession(t *testing.T, router http.Handler) (*http.Cookie, string) {
+	t.Helper()
+	cookie := authenticate(t, router)
+	page := serve(router, http.MethodGet, "/tasks", nil, cookie)
+	if page.Code != http.StatusOK {
+		t.Fatalf("GET /tasks status = %d", page.Code)
+	}
+	return cookie, csrfToken(t, page.Body.String())
+}
+
+func newStartRequest(t *testing.T, body, contentType, csrf string, cookie *http.Cookie) *http.Request {
+	t.Helper()
+	return newStartByteRequest(t, []byte(body), contentType, csrf, cookie)
+}
+
+func newStartByteRequest(t *testing.T, body []byte, contentType, csrf string, cookie *http.Cookie) *http.Request {
+	t.Helper()
+	request := httptest.NewRequest(http.MethodPost, "/tasks/start-purchases", bytes.NewReader(body))
+	if contentType != "" {
+		request.Header.Set("Content-Type", contentType)
+	}
+	if csrf != "" {
+		request.Header.Set("X-CSRF-Token", csrf)
+	}
+	if cookie != nil {
+		request.AddCookie(cookie)
+	}
+	return request
+}
+
+func serveStartBytes(t *testing.T, router http.Handler, body []byte, contentType, csrf string, cookie *http.Cookie) *httptest.ResponseRecorder {
+	t.Helper()
+	response := httptest.NewRecorder()
+	router.ServeHTTP(response, newStartByteRequest(t, body, contentType, csrf, cookie))
+	return response
+}
+
+func serveStartRequest(t *testing.T, router http.Handler, body, contentType, csrf string, cookie *http.Cookie) *httptest.ResponseRecorder {
+	t.Helper()
+	response := httptest.NewRecorder()
+	router.ServeHTTP(response, newStartRequest(t, body, contentType, csrf, cookie))
+	return response
+}
+
+func validStartBody() string {
+	return `{"start_key":"` + startKeyForHTTP + `","tasks":[{"task_id":"` + taskIDForHTTP + `","expected_task_version":7}]}`
+}
+
+func successfulStartResult() tasks.StartResult {
+	expires := time.Date(2026, 8, 4, 2, 3, 4, 0, time.UTC)
+	return tasks.StartResult{
+		StartKey:         startKeyForHTTP,
+		AuthorizedCount:  1,
+		PaymentAutomated: false,
+		Tasks: []tasks.AuthorizedTask{{
+			TaskID:          taskIDForHTTP,
+			TaskVersion:     8,
+			AuthorizationID: "d3c9f507-7473-4fa6-8d71-8786c34c6301",
+			ExpiresAt:       expires,
+		}},
+	}
+}

admin/internal/server/task_detail.go

@@ -0,0 +1,84 @@
+package server
+
+import (
+	"errors"
+	"mime"
+	"net/http"
+	"net/url"
+	"strconv"
+	"strings"
+
+	"cmbuyer/admin/internal/taskdetail"
+	"cmbuyer/admin/internal/transport/webui"
+
+	"github.com/gin-gonic/gin"
+)
+
+const detailViewHeader = "X-CMBuyer-View"
+const detailVaryHeader = "X-CMBuyer-View, Accept, Sec-Fetch-Site"
+
+func taskDetailPage(options Options) gin.HandlerFunc {
+	return func(context *gin.Context) {
+		context.Header("Vary", detailVaryHeader)
+		if !options.Sessions.IsAuthenticated(context.Request) {
+			context.Redirect(http.StatusSeeOther, "/login?return_to="+url.QueryEscape(context.Request.URL.RequestURI()))
+			return
+		}
+		view := context.GetHeader(detailViewHeader)
+		if view != "" && view != "drawer" {
+			context.Status(http.StatusBadRequest)
+			return
+		}
+		if view == "drawer" {
+			if context.GetHeader("Sec-Fetch-Site") != "same-origin" {
+				context.Status(http.StatusForbidden)
+				return
+			}
+			if !acceptsHTML(context.GetHeader("Accept")) {
+				context.Status(http.StatusNotAcceptable)
+				return
+			}
+		}
+		detail, err := options.TaskDetails.Get(context.Request.Context(), context.Param("id"))
+		if errors.Is(err, taskdetail.ErrNotFound) {
+			context.Status(http.StatusNotFound)
+			return
+		}
+		if err != nil {
+			context.Status(http.StatusInternalServerError)
+			return
+		}
+		context.Header("Content-Type", "text/html; charset=utf-8")
+		context.Status(http.StatusOK)
+		data := webui.TaskDetailData{Detail: detail}
+		if view == "drawer" {
+			if err := webui.RenderTaskDetailFragment(context.Writer, data); err != nil {
+				_ = context.Error(err)
+			}
+			return
+		}
+		if err := webui.RenderTaskDetailPage(context.Writer, data); err != nil {
+			_ = context.Error(err)
+		}
+	}
+}
+
+func acceptsHTML(header string) bool {
+	for _, value := range strings.Split(header, ",") {
+		mediaType, parameters, err := mime.ParseMediaType(strings.TrimSpace(value))
+		if err != nil || !strings.EqualFold(mediaType, "text/html") {
+			continue
+		}
+		quality := 1.0
+		if rawQuality, exists := parameters["q"]; exists {
+			quality, err = strconv.ParseFloat(rawQuality, 64)
+			if err != nil || quality < 0 || quality > 1 {
+				continue
+			}
+		}
+		if quality > 0 {
+			return true
+		}
+	}
+	return false
+}

admin/internal/server/task_detail_test.go

@@ -0,0 +1,110 @@
+package server_test
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	"cmbuyer/admin/internal/deviceauth"
+	"cmbuyer/admin/internal/taskdetail"
+)
+
+const detailTaskID = "a3c9f507-7473-4fa6-8d71-8786c34c6301"
+
+func TestTaskDetailRequiresAdminBeforeLookup(t *testing.T) {
+	details := &recordingDetailStore{detail: taskDetailFixture()}
+	router, _ := newRouterWithDependencies(t, &memoryStore{}, details, emptyEvidenceStore{}, deviceauth.RejectAllAuthenticator{})
+	response := serve(router, http.MethodGet, "/tasks/"+detailTaskID, nil, nil)
+	if response.Code != http.StatusSeeOther || !strings.HasPrefix(response.Header().Get("Location"), "/login?return_to=") || details.calls != 0 {
+		t.Fatalf("anonymous detail = %d/%q, calls=%d", response.Code, response.Header().Get("Location"), details.calls)
+	}
+}
+
+func TestTaskDetailFullPageAndDrawerShareAuditContent(t *testing.T) {
+	details := &recordingDetailStore{detail: taskDetailFixture()}
+	router, _ := newRouterWithDependencies(t, &memoryStore{}, details, emptyEvidenceStore{}, deviceauth.RejectAllAuthenticator{})
+	cookie := authenticate(t, router)
+	full := serve(router, http.MethodGet, "/tasks/"+detailTaskID, nil, cookie)
+	if full.Code != http.StatusOK || !strings.Contains(full.Body.String(), "<!doctype html>") || !strings.Contains(full.Body.String(), `data-task-detail-content`) {
+		t.Fatalf("full detail = %d/%q", full.Code, full.Body.String())
+	}
+	request := httptest.NewRequest(http.MethodGet, "/tasks/"+detailTaskID, nil)
+	request.AddCookie(cookie)
+	request.Header.Set("X-CMBuyer-View", "drawer")
+	request.Header.Set("Accept", "text/html")
+	request.Header.Set("Sec-Fetch-Site", "same-origin")
+	fragment := httptest.NewRecorder()
+	router.ServeHTTP(fragment, request)
+	if fragment.Code != http.StatusOK || strings.Contains(fragment.Body.String(), "<!doctype html>") || !strings.Contains(fragment.Body.String(), `data-task-detail-content`) {
+		t.Fatalf("fragment detail = %d/%q", fragment.Code, fragment.Body.String())
+	}
+	for _, text := range []string{"测试&lt;script&gt;", "订单已创建，系统尚未付款", "SKU_PANEL_GATE_1", "/evidence/b3c9f507-7473-4fa6-8d71-8786c34c6301", "暂无规格、价格或数量读数", "本页没有重试、再次提交或付款动作"} {
+		if !strings.Contains(full.Body.String(), text) || !strings.Contains(fragment.Body.String(), text) {
+			t.Fatalf("shared detail missing %q", text)
+		}
+	}
+	if strings.Contains(full.Body.String(), "<script>") || strings.Contains(fragment.Body.String(), "<script>") {
+		t.Fatal("task title was not HTML escaped")
+	}
+	if got := fragment.Header().Get("Vary"); got != "X-CMBuyer-View, Accept, Sec-Fetch-Site" {
+		t.Fatalf("fragment Vary = %q", got)
+	}
+	if details.calls != 2 {
+		t.Fatalf("detail store calls = %d, want 2", details.calls)
+	}
+}
+
+func TestTaskDetailRejectsForgedFragmentAndMissingTask(t *testing.T) {
+	details := &recordingDetailStore{err: taskdetail.ErrNotFound}
+	router, _ := newRouterWithDependencies(t, &memoryStore{}, details, emptyEvidenceStore{}, deviceauth.RejectAllAuthenticator{})
+	cookie := authenticate(t, router)
+	for name, headers := range map[string]map[string]string{
+		"unknown view":        {"X-CMBuyer-View": "xml", "Accept": "text/html"},
+		"missing fetch site":  {"X-CMBuyer-View": "drawer", "Accept": "text/html"},
+		"cross-site drawer":   {"X-CMBuyer-View": "drawer", "Accept": "text/html", "Sec-Fetch-Site": "cross-site"},
+		"wrong accept":        {"X-CMBuyer-View": "drawer", "Accept": "application/json", "Sec-Fetch-Site": "same-origin"},
+		"html quality zero":   {"X-CMBuyer-View": "drawer", "Accept": "text/html;q=0, application/json", "Sec-Fetch-Site": "same-origin"},
+		"html substring mime": {"X-CMBuyer-View": "drawer", "Accept": "application/nottext/html", "Sec-Fetch-Site": "same-origin"},
+	} {
+		t.Run(name, func(t *testing.T) {
+			request := httptest.NewRequest(http.MethodGet, "/tasks/"+detailTaskID, nil)
+			request.AddCookie(cookie)
+			for key, value := range headers {
+				request.Header.Set(key, value)
+			}
+			response := httptest.NewRecorder()
+			router.ServeHTTP(response, request)
+			if response.Code < 400 || response.Code >= 500 || response.Body.Len() != 0 {
+				t.Fatalf("forged fragment = %d/%q", response.Code, response.Body.String())
+			}
+		})
+	}
+	missing := serve(router, http.MethodGet, "/tasks/not-a-uuid", nil, cookie)
+	if missing.Code != http.StatusNotFound || missing.Body.Len() != 0 {
+		t.Fatalf("missing detail = %d/%q", missing.Code, missing.Body.String())
+	}
+}
+
+type recordingDetailStore struct {
+	detail taskdetail.Detail
+	err    error
+	calls  int
+}
+
+func (store *recordingDetailStore) Get(context.Context, string) (taskdetail.Detail, error) {
+	store.calls++
+	return store.detail, store.err
+}
+
+func taskDetailFixture() taskdetail.Detail {
+	started := time.Date(2026, 8, 4, 1, 2, 3, 0, time.UTC)
+	return taskdetail.Detail{
+		Task:           taskdetail.Task{ID: detailTaskID, Source: "MANUAL", Title: "测试<script>", GoodsID: "937122477375", SKUColor: "黑色", SKUSize: "M", Quantity: 2, MaxTotalPrice: "30.00", Status: "WAITING_PAYMENT", Version: 3, CreatedAt: started, UpdatedAt: started},
+		Authorizations: []taskdetail.Authorization{{ID: "c3c9f507-7473-4fa6-8d71-8786c34c6301", Status: "FENCED", CreatedBy: "admin", TotalPriceCap: "30.00", TaskVersion: 2, CreatedAt: started, ExpiresAt: started.Add(time.Hour)}},
+		Attempts:       []taskdetail.Attempt{{ID: "d3c9f507-7473-4fa6-8d71-8786c34c6301", AuthorizationID: "c3c9f507-7473-4fa6-8d71-8786c34c6301", Status: "CLAIMED", ClaimGeneration: 1, StartedAt: started}},
+		Evidence:       []taskdetail.Evidence{{ID: "b3c9f507-7473-4fa6-8d71-8786c34c6301", AttemptID: "d3c9f507-7473-4fa6-8d71-8786c34c6301", Kind: "SKU_PANEL_GATE_1", PrivacyTier: "INTERNAL_RAW", SHA256: strings.Repeat("a", 64), ByteSize: 100, ContentType: "image/png", Width: 100, Height: 200, CapturedAt: started}},
+	}
+}

admin/internal/storage/evidence/durability_unix.go

@@ -0,0 +1,20 @@
+//go:build !windows
+
+package evidence
+
+import (
+	"fmt"
+	"os"
+)
+
+func syncDirectory(path string) error {
+	directory, err := os.Open(path)
+	if err != nil {
+		return fmt.Errorf("open directory for durability sync: %w", err)
+	}
+	defer directory.Close()
+	if err := directory.Sync(); err != nil {
+		return fmt.Errorf("sync directory metadata: %w", err)
+	}
+	return nil
+}

admin/internal/storage/evidence/durability_windows.go

@@ -0,0 +1,35 @@
+//go:build windows
+
+package evidence
+
+import (
+	"fmt"
+	"syscall"
+)
+
+// syncDirectory uses an explicit directory handle because os.Open(...).Sync is not a portable
+// Windows directory durability boundary. Any unsupported filesystem or access failure is fatal:
+// callers must not make the corresponding evidence row visible in SQLite.
+func syncDirectory(path string) error {
+	pathPointer, err := syscall.UTF16PtrFromString(path)
+	if err != nil {
+		return fmt.Errorf("encode directory path for durability sync: %w", err)
+	}
+	handle, err := syscall.CreateFile(
+		pathPointer,
+		syscall.GENERIC_WRITE,
+		syscall.FILE_SHARE_READ|syscall.FILE_SHARE_WRITE|syscall.FILE_SHARE_DELETE,
+		nil,
+		syscall.OPEN_EXISTING,
+		syscall.FILE_FLAG_BACKUP_SEMANTICS,
+		0,
+	)
+	if err != nil {
+		return fmt.Errorf("open directory for durability sync: %w", err)
+	}
+	defer syscall.CloseHandle(handle)
+	if err := syscall.FlushFileBuffers(handle); err != nil {
+		return fmt.Errorf("flush directory metadata: %w", err)
+	}
+	return nil
+}

admin/internal/storage/evidence/store.go

@@ -0,0 +1,545 @@
+// Package evidence stores INTERNAL_RAW PNG assets outside the public web tree.
+package evidence
+
+import (
+	"context"
+	"crypto/rand"
+	"crypto/sha256"
+	"database/sql"
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"image/png"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+	"time"
+
+	"cmbuyer/admin/internal/deviceauth"
+	core "cmbuyer/admin/internal/evidence"
+)
+
+var pngSignature = []byte{0x89, 'P', 'N', 'G', 0x0d, 0x0a, 0x1a, 0x0a}
+
+type Store struct {
+	database      *sql.DB
+	root          string
+	now           func() time.Time
+	random        io.Reader
+	syncDirectory func(string) error
+	syncFile      func(*os.File) error
+	renameFile    func(string, string) error
+	commitTx      func(*sql.Tx) error
+	mu            sync.Mutex
+}
+
+func NewStore(database *sql.DB, root string) (*Store, error) {
+	return newStore(database, root, syncDirectory)
+}
+
+func newStore(database *sql.DB, root string, directorySync func(string) error) (*Store, error) {
+	if database == nil {
+		return nil, errors.New("evidence database is required")
+	}
+	if directorySync == nil {
+		return nil, errors.New("evidence directory sync is required")
+	}
+	if root == "" || !filepath.IsAbs(root) {
+		return nil, errors.New("evidence root must be an absolute path")
+	}
+	absolute, err := filepath.Abs(filepath.Clean(root))
+	if err != nil {
+		return nil, fmt.Errorf("resolve evidence root: %w", err)
+	}
+	if filepath.Dir(absolute) == absolute {
+		return nil, errors.New("evidence root cannot be a filesystem root")
+	}
+	if err := ensureDurableDirectory(absolute, 0o700, directorySync); err != nil {
+		return nil, fmt.Errorf("create evidence root: %w", err)
+	}
+	// A prior startup may have created the root and then failed its parent sync.
+	// Existence is therefore never accepted as proof that the directory entry is durable.
+	if err := directorySync(filepath.Dir(absolute)); err != nil {
+		return nil, fmt.Errorf("persist evidence root directory: %w", err)
+	}
+	if err := os.Chmod(absolute, 0o700); err != nil {
+		return nil, fmt.Errorf("protect evidence root: %w", err)
+	}
+	staging := filepath.Join(absolute, ".staging")
+	if err := ensureDurableDirectory(staging, 0o700, directorySync); err != nil {
+		return nil, fmt.Errorf("create evidence staging directory: %w", err)
+	}
+	if err := directorySync(absolute); err != nil {
+		return nil, fmt.Errorf("persist evidence staging directory: %w", err)
+	}
+	if err := os.Chmod(staging, 0o700); err != nil {
+		return nil, fmt.Errorf("protect evidence staging directory: %w", err)
+	}
+	if _, err := database.Exec("SELECT storage_key FROM evidence_assets LIMIT 1"); err != nil {
+		return nil, fmt.Errorf("evidence migration is not available: %w", err)
+	}
+	return &Store{
+		database:      database,
+		root:          absolute,
+		now:           time.Now,
+		random:        rand.Reader,
+		syncDirectory: directorySync,
+		syncFile:      func(file *os.File) error { return file.Sync() },
+		renameFile:    os.Rename,
+		commitTx:      func(transaction *sql.Tx) error { return transaction.Commit() },
+	}, nil
+}
+
+func (store *Store) Stage(reader io.Reader, contentType string) (staged core.StagedFile, resultErr error) {
+	if reader == nil || contentType != core.PNGContentType {
+		return core.StagedFile{}, core.ErrInvalid
+	}
+	temporary, err := os.CreateTemp(filepath.Join(store.root, ".staging"), "upload-*.png")
+	if err != nil {
+		return core.StagedFile{}, err
+	}
+	staged.Path = temporary.Name()
+	defer func() {
+		if resultErr != nil {
+			_ = temporary.Close()
+			_ = os.Remove(staged.Path)
+		}
+	}()
+	if err := temporary.Chmod(0o600); err != nil {
+		return core.StagedFile{}, err
+	}
+	hasher := sha256.New()
+	written, err := io.Copy(io.MultiWriter(temporary, hasher), io.LimitReader(reader, core.MaxFileBytes+1))
+	if err != nil {
+		return core.StagedFile{}, err
+	}
+	if written > core.MaxFileBytes {
+		return core.StagedFile{}, core.ErrTooLarge
+	}
+	if written == 0 {
+		return core.StagedFile{}, core.ErrInvalid
+	}
+	if err := temporary.Sync(); err != nil {
+		return core.StagedFile{}, err
+	}
+	if err := temporary.Close(); err != nil {
+		return core.StagedFile{}, err
+	}
+
+	imageFile, err := os.Open(staged.Path)
+	if err != nil {
+		return core.StagedFile{}, err
+	}
+	defer imageFile.Close()
+	width, height, err := validatePNG(imageFile)
+	if err != nil {
+		return core.StagedFile{}, err
+	}
+
+	staged.SHA256 = hex.EncodeToString(hasher.Sum(nil))
+	staged.ByteSize = written
+	staged.ContentType = core.PNGContentType
+	staged.Width = width
+	staged.Height = height
+	return staged, nil
+}
+
+func (store *Store) Discard(staged core.StagedFile) {
+	if store.isStagedPath(staged.Path) {
+		_ = os.Remove(staged.Path)
+	}
+}
+
+func (store *Store) Commit(ctx context.Context, principal deviceauth.Principal, metadata core.UploadMetadata, staged core.StagedFile) (core.Asset, bool, error) {
+	if !store.isStagedPath(staged.Path) || !validPrincipal(principal) || !validMetadata(metadata) || metadata.SHA256 != staged.SHA256 || staged.ContentType != core.PNGContentType || staged.ByteSize < 1 || staged.ByteSize > core.MaxFileBytes || staged.Width < 1 || staged.Height < 1 || staged.Width > core.MaxImageSide || staged.Height > core.MaxImageSide || int64(staged.Width)*int64(staged.Height) > core.MaxImagePixels {
+		store.Discard(staged)
+		return core.Asset{}, false, core.ErrInvalid
+	}
+	defer store.Discard(staged)
+
+	store.mu.Lock()
+	defer store.mu.Unlock()
+
+	transaction, err := store.database.BeginTx(ctx, nil)
+	if err != nil {
+		return core.Asset{}, false, err
+	}
+	defer transaction.Rollback()
+
+	existing, found, err := findByUploadKey(ctx, transaction, principal.ID, metadata.UploadKey)
+	if err != nil {
+		return core.Asset{}, false, err
+	}
+	if found {
+		if !sameUpload(existing, principal, metadata, staged) {
+			return core.Asset{}, false, core.ErrConflict
+		}
+		if err := store.verifyStoredFile(existing); err != nil {
+			return core.Asset{}, false, err
+		}
+		if err := store.commitTx(transaction); err != nil {
+			return core.Asset{}, false, err
+		}
+		return existing, true, nil
+	}
+
+	var attemptCount int
+	if err := transaction.QueryRowContext(ctx, "SELECT COUNT(*) FROM purchase_attempts WHERE task_id = ? AND id = ?", metadata.TaskID, metadata.AttemptID).Scan(&attemptCount); err != nil {
+		return core.Asset{}, false, err
+	}
+	if attemptCount != 1 {
+		return core.Asset{}, false, core.ErrInvalid
+	}
+
+	storageKey := storageKey(metadata.SHA256)
+	finalPath, err := store.pathForKey(storageKey)
+	if err != nil {
+		return core.Asset{}, false, err
+	}
+	finalDirectory := filepath.Dir(finalPath)
+	if err := ensureDurableDirectory(finalDirectory, 0o700, store.syncDirectory); err != nil {
+		return core.Asset{}, false, err
+	}
+	// Always repeat the shard-parent boundary. If an earlier attempt created this
+	// directory and its parent sync failed, a retry must not trust mere existence.
+	if err := store.syncDirectory(store.root); err != nil {
+		return core.Asset{}, false, fmt.Errorf("persist evidence shard directory: %w", err)
+	}
+	if err := os.Chmod(finalDirectory, 0o700); err != nil {
+		return core.Asset{}, false, err
+	}
+	if info, statErr := os.Stat(finalPath); statErr == nil {
+		if !info.Mode().IsRegular() || info.Size() != staged.ByteSize || fileSHA256(finalPath) != staged.SHA256 {
+			return core.Asset{}, false, errors.New("stored evidence content does not match its key")
+		}
+	} else if !errors.Is(statErr, os.ErrNotExist) {
+		return core.Asset{}, false, statErr
+	} else {
+		publishPath, err := store.preparePublishFile(staged, finalDirectory)
+		if err != nil {
+			return core.Asset{}, false, err
+		}
+		defer os.Remove(publishPath)
+		if err := store.renameFile(publishPath, finalPath); err != nil {
+			return core.Asset{}, false, err
+		}
+	}
+	// The publication file was fsynced in this shard before its same-directory rename.
+	// Persist the final directory entry before SQLite can expose a referencing row.
+	// A directory sync failure is deliberately fatal; the unreachable file may remain
+	// as an orphan, but no evidence_assets row may be committed for it.
+	if err := store.syncDirectory(finalDirectory); err != nil {
+		return core.Asset{}, false, fmt.Errorf("persist evidence directory entry: %w", err)
+	}
+
+	id, err := newUUID(store.random)
+	if err != nil {
+		return core.Asset{}, false, err
+	}
+	now := store.now().UTC()
+	asset := core.Asset{
+		ID: id, TaskID: metadata.TaskID, AttemptID: metadata.AttemptID,
+		Kind: metadata.Kind, PrivacyTier: metadata.PrivacyTier, SHA256: staged.SHA256,
+		ByteSize: staged.ByteSize, ContentType: staged.ContentType, Width: staged.Width, Height: staged.Height,
+		CapturedAt: metadata.CapturedAt.UTC(), UploadedByDeviceID: principal.ID,
+		StorageKey: storageKey, CreatedAt: now,
+	}
+	_, err = transaction.ExecContext(ctx, `INSERT INTO evidence_assets
+		(id, upload_key, task_id, attempt_id, kind, privacy_tier, sha256, byte_size, content_type, width_px, height_px, storage_key, uploaded_by_device_id, captured_at, created_at)
+		VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+		asset.ID, metadata.UploadKey, asset.TaskID, asset.AttemptID, asset.Kind, asset.PrivacyTier,
+		asset.SHA256, asset.ByteSize, asset.ContentType, asset.Width, asset.Height, asset.StorageKey,
+		asset.UploadedByDeviceID, asset.CapturedAt.Format(time.RFC3339Nano), asset.CreatedAt.Format(time.RFC3339Nano))
+	if err != nil {
+		return core.Asset{}, false, err
+	}
+	if err := store.commitTx(transaction); err != nil {
+		return core.Asset{}, false, err
+	}
+	return asset, false, nil
+}
+
+func (store *Store) Open(ctx context.Context, id string) (core.Asset, io.ReadSeekCloser, error) {
+	if !validUUID(id) {
+		return core.Asset{}, nil, core.ErrNotFound
+	}
+	asset, found, err := findByID(ctx, store.database, id)
+	if err != nil {
+		return core.Asset{}, nil, err
+	}
+	if !found || asset.StorageKey != storageKey(asset.SHA256) {
+		return core.Asset{}, nil, core.ErrNotFound
+	}
+	path, err := store.pathForKey(asset.StorageKey)
+	if err != nil {
+		return core.Asset{}, nil, core.ErrNotFound
+	}
+	file, err := os.Open(path)
+	if errors.Is(err, os.ErrNotExist) {
+		return core.Asset{}, nil, core.ErrNotFound
+	}
+	if err != nil {
+		return core.Asset{}, nil, err
+	}
+	info, err := file.Stat()
+	if err != nil || !info.Mode().IsRegular() || info.Size() != asset.ByteSize {
+		_ = file.Close()
+		if err != nil {
+			return core.Asset{}, nil, err
+		}
+		return core.Asset{}, nil, core.ErrNotFound
+	}
+	return asset, file, nil
+}
+
+func (store *Store) verifyStoredFile(asset core.Asset) error {
+	path, err := store.pathForKey(asset.StorageKey)
+	if err != nil {
+		return err
+	}
+	info, err := os.Stat(path)
+	if err != nil || !info.Mode().IsRegular() || info.Size() != asset.ByteSize || fileSHA256(path) != asset.SHA256 {
+		if err != nil {
+			return err
+		}
+		return errors.New("stored evidence file is invalid")
+	}
+	return nil
+}
+
+func (store *Store) isStagedPath(path string) bool {
+	if path == "" {
+		return false
+	}
+	relative, err := filepath.Rel(filepath.Join(store.root, ".staging"), filepath.Clean(path))
+	return err == nil && relative != "." && relative != "" && relative != ".." && !strings.HasPrefix(relative, ".."+string(filepath.Separator)) && !filepath.IsAbs(relative)
+}
+
+func (store *Store) pathForKey(key string) (string, error) {
+	path := filepath.Join(store.root, filepath.FromSlash(key))
+	relative, err := filepath.Rel(store.root, path)
+	if err != nil || relative == "." || relative == "" || relative == ".." || strings.HasPrefix(relative, ".."+string(filepath.Separator)) || filepath.IsAbs(relative) {
+		return "", errors.New("invalid evidence storage key")
+	}
+	return path, nil
+}
+
+func (store *Store) preparePublishFile(staged core.StagedFile, directory string) (path string, resultErr error) {
+	source, err := os.Open(staged.Path)
+	if err != nil {
+		return "", err
+	}
+	defer source.Close()
+
+	temporary, err := os.CreateTemp(directory, ".publish-*.png")
+	if err != nil {
+		return "", err
+	}
+	temporaryPath := temporary.Name()
+	path = temporaryPath
+	defer func() {
+		if resultErr != nil {
+			_ = temporary.Close()
+			_ = os.Remove(temporaryPath)
+		}
+	}()
+	if err := temporary.Chmod(0o600); err != nil {
+		return "", err
+	}
+	hasher := sha256.New()
+	written, err := io.Copy(io.MultiWriter(temporary, hasher), source)
+	if err != nil {
+		return "", err
+	}
+	if written != staged.ByteSize || hex.EncodeToString(hasher.Sum(nil)) != staged.SHA256 {
+		return "", errors.New("staged evidence changed before publication")
+	}
+	width, height, err := validatePNG(temporary)
+	if err != nil {
+		return "", err
+	}
+	if width != staged.Width || height != staged.Height {
+		return "", errors.New("staged evidence dimensions changed before publication")
+	}
+	if err := store.syncFile(temporary); err != nil {
+		return "", fmt.Errorf("sync evidence publication file: %w", err)
+	}
+	if err := temporary.Close(); err != nil {
+		return "", err
+	}
+	return path, nil
+}
+
+func validatePNG(reader io.ReadSeeker) (int, int, error) {
+	if _, err := reader.Seek(0, io.SeekStart); err != nil {
+		return 0, 0, err
+	}
+	signature := make([]byte, len(pngSignature))
+	if _, err := io.ReadFull(reader, signature); err != nil || string(signature) != string(pngSignature) {
+		return 0, 0, core.ErrInvalid
+	}
+	if _, err := reader.Seek(0, io.SeekStart); err != nil {
+		return 0, 0, err
+	}
+	configuration, err := png.DecodeConfig(reader)
+	if err != nil || configuration.Width < 1 || configuration.Height < 1 || configuration.Width > core.MaxImageSide || configuration.Height > core.MaxImageSide || int64(configuration.Width)*int64(configuration.Height) > core.MaxImagePixels {
+		return 0, 0, core.ErrInvalid
+	}
+	if _, err := reader.Seek(0, io.SeekStart); err != nil {
+		return 0, 0, err
+	}
+	if _, err := png.Decode(reader); err != nil {
+		return 0, 0, core.ErrInvalid
+	}
+	var trailing [1]byte
+	if count, err := reader.Read(trailing[:]); count != 0 || !errors.Is(err, io.EOF) {
+		return 0, 0, core.ErrInvalid
+	}
+	return configuration.Width, configuration.Height, nil
+}
+
+func ensureDurableDirectory(path string, mode os.FileMode, syncParent func(string) error) error {
+	info, err := os.Stat(path)
+	if err == nil {
+		if !info.IsDir() {
+			return fmt.Errorf("path exists but is not a directory: %s", path)
+		}
+		return nil
+	}
+	if !errors.Is(err, os.ErrNotExist) {
+		return err
+	}
+
+	parent := filepath.Dir(path)
+	if parent == path {
+		return fmt.Errorf("cannot create filesystem root as a managed directory: %s", path)
+	}
+	if err := ensureDurableDirectory(parent, mode, syncParent); err != nil {
+		return err
+	}
+	if err := os.Mkdir(path, mode); err != nil && !errors.Is(err, os.ErrExist) {
+		return err
+	}
+	info, err = os.Stat(path)
+	if err != nil {
+		return err
+	}
+	if !info.IsDir() {
+		return fmt.Errorf("path exists but is not a directory: %s", path)
+	}
+	if err := os.Chmod(path, mode); err != nil {
+		return err
+	}
+	// Syncing the parent makes creation of this directory durable. This also covers
+	// a concurrent creator: returning success without the parent sync could otherwise
+	// allow the following database transaction to outrun the directory entry.
+	if err := syncParent(parent); err != nil {
+		return fmt.Errorf("persist directory creation for %s: %w", path, err)
+	}
+	return nil
+}
+
+func storageKey(hash string) string { return hash[:2] + "/" + hash + ".png" }
+
+func validMetadata(metadata core.UploadMetadata) bool {
+	return validUUID(metadata.UploadKey) && validUUID(metadata.TaskID) && validUUID(metadata.AttemptID) && metadata.Kind == core.KindSKUPanelGate1 && metadata.PrivacyTier == core.PrivacyInternalRaw && validSHA256(metadata.SHA256) && !metadata.CapturedAt.IsZero() && metadata.CapturedAt.Location() == time.UTC
+}
+
+func validPrincipal(principal deviceauth.Principal) bool {
+	return deviceauth.ValidDeviceID(principal.ID)
+}
+
+func validSHA256(value string) bool {
+	if len(value) != 64 {
+		return false
+	}
+	for _, character := range value {
+		if !(character >= '0' && character <= '9' || character >= 'a' && character <= 'f') {
+			return false
+		}
+	}
+	return true
+}
+
+func validUUID(value string) bool {
+	if len(value) != 36 {
+		return false
+	}
+	for index, character := range value {
+		if index == 8 || index == 13 || index == 18 || index == 23 {
+			if character != '-' {
+				return false
+			}
+			continue
+		}
+		if !(character >= '0' && character <= '9' || character >= 'a' && character <= 'f') {
+			return false
+		}
+	}
+	return value[14] == '4' && (value[19] == '8' || value[19] == '9' || value[19] == 'a' || value[19] == 'b')
+}
+
+func newUUID(reader io.Reader) (string, error) {
+	bytes := make([]byte, 16)
+	if _, err := io.ReadFull(reader, bytes); err != nil {
+		return "", err
+	}
+	bytes[6] = (bytes[6] & 0x0f) | 0x40
+	bytes[8] = (bytes[8] & 0x3f) | 0x80
+	encoded := hex.EncodeToString(bytes)
+	return encoded[:8] + "-" + encoded[8:12] + "-" + encoded[12:16] + "-" + encoded[16:20] + "-" + encoded[20:], nil
+}
+
+func fileSHA256(path string) string {
+	file, err := os.Open(path)
+	if err != nil {
+		return ""
+	}
+	defer file.Close()
+	hasher := sha256.New()
+	if _, err := io.Copy(hasher, file); err != nil {
+		return ""
+	}
+	return hex.EncodeToString(hasher.Sum(nil))
+}
+
+type rowScanner interface{ Scan(...any) error }
+
+func findByUploadKey(ctx context.Context, query interface {
+	QueryRowContext(context.Context, string, ...any) *sql.Row
+}, deviceID, uploadKey string) (core.Asset, bool, error) {
+	return scanAsset(query.QueryRowContext(ctx, `SELECT id, task_id, attempt_id, kind, privacy_tier, sha256, byte_size, content_type, width_px, height_px, storage_key, uploaded_by_device_id, captured_at, created_at FROM evidence_assets WHERE uploaded_by_device_id = ? AND upload_key = ?`, deviceID, uploadKey))
+}
+
+func findByID(ctx context.Context, query interface {
+	QueryRowContext(context.Context, string, ...any) *sql.Row
+}, id string) (core.Asset, bool, error) {
+	return scanAsset(query.QueryRowContext(ctx, `SELECT id, task_id, attempt_id, kind, privacy_tier, sha256, byte_size, content_type, width_px, height_px, storage_key, uploaded_by_device_id, captured_at, created_at FROM evidence_assets WHERE id = ?`, id))
+}
+
+func scanAsset(row rowScanner) (core.Asset, bool, error) {
+	var asset core.Asset
+	var captured, created string
+	err := row.Scan(&asset.ID, &asset.TaskID, &asset.AttemptID, &asset.Kind, &asset.PrivacyTier, &asset.SHA256, &asset.ByteSize, &asset.ContentType, &asset.Width, &asset.Height, &asset.StorageKey, &asset.UploadedByDeviceID, &captured, &created)
+	if errors.Is(err, sql.ErrNoRows) {
+		return core.Asset{}, false, nil
+	}
+	if err != nil {
+		return core.Asset{}, false, err
+	}
+	asset.CapturedAt, err = time.Parse(time.RFC3339Nano, captured)
+	if err != nil {
+		return core.Asset{}, false, err
+	}
+	asset.CreatedAt, err = time.Parse(time.RFC3339Nano, created)
+	if err != nil {
+		return core.Asset{}, false, err
+	}
+	return asset, true, nil
+}
+
+func sameUpload(asset core.Asset, principal deviceauth.Principal, metadata core.UploadMetadata, staged core.StagedFile) bool {
+	return asset.TaskID == metadata.TaskID && asset.AttemptID == metadata.AttemptID && asset.Kind == metadata.Kind && asset.PrivacyTier == metadata.PrivacyTier && asset.SHA256 == metadata.SHA256 && asset.ByteSize == staged.ByteSize && asset.ContentType == staged.ContentType && asset.Width == staged.Width && asset.Height == staged.Height && asset.UploadedByDeviceID == principal.ID && asset.CapturedAt.Equal(metadata.CapturedAt)
+}

admin/internal/storage/evidence/store_test.go

@@ -0,0 +1,554 @@
+package evidence
+
+import (
+	"bytes"
+	"context"
+	"crypto/sha256"
+	"database/sql"
+	"encoding/hex"
+	"errors"
+	"image"
+	"image/color"
+	"image/png"
+	"io"
+	"os"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"cmbuyer/admin/internal/deviceauth"
+	core "cmbuyer/admin/internal/evidence"
+	"cmbuyer/admin/internal/migrations"
+	"cmbuyer/admin/internal/storage/sqlite"
+)
+
+const (
+	testTaskID    = "13c9f507-7473-4fa6-8d71-8786c34c6301"
+	testAuthID    = "23c9f507-7473-4fa6-8d71-8786c34c6301"
+	testAttemptID = "33c9f507-7473-4fa6-8d71-8786c34c6301"
+	testUploadKey = "43c9f507-7473-4fa6-8d71-8786c34c6301"
+	testDeviceID  = "53c9f507-7473-4fa6-8d71-8786c34c6301"
+)
+
+func TestStageCommitReplayAndOpen(t *testing.T) {
+	database, store := newTestStore(t)
+	insertAttemptFixture(t, database)
+	pngBytes := makePNG(t, 8, 6)
+	hash := sha256Hex(pngBytes)
+	metadata := core.UploadMetadata{UploadKey: testUploadKey, TaskID: testTaskID, AttemptID: testAttemptID, Kind: core.KindSKUPanelGate1, PrivacyTier: core.PrivacyInternalRaw, SHA256: hash, CapturedAt: time.Date(2026, 8, 4, 1, 2, 3, 0, time.UTC)}
+	principal := deviceauth.Principal{ID: testDeviceID}
+
+	staged, err := store.Stage(bytes.NewReader(pngBytes), core.PNGContentType)
+	if err != nil {
+		t.Fatalf("Stage: %v", err)
+	}
+	asset, replayed, err := store.Commit(context.Background(), principal, metadata, staged)
+	if err != nil || replayed {
+		t.Fatalf("Commit = replayed %t, err %v", replayed, err)
+	}
+	if asset.SHA256 != hash || asset.ByteSize != int64(len(pngBytes)) || asset.Width != 8 || asset.Height != 6 || asset.StorageKey != hash[:2]+"/"+hash+".png" {
+		t.Fatalf("asset = %#v", asset)
+	}
+	opened, reader, err := store.Open(context.Background(), asset.ID)
+	if err != nil {
+		t.Fatalf("Open: %v", err)
+	}
+	got, err := io.ReadAll(reader)
+	_ = reader.Close()
+	if err != nil || !bytes.Equal(got, pngBytes) || opened.ID != asset.ID {
+		t.Fatalf("opened asset changed: bytes=%t asset=%#v err=%v", bytes.Equal(got, pngBytes), opened, err)
+	}
+
+	replayStage, err := store.Stage(bytes.NewReader(pngBytes), core.PNGContentType)
+	if err != nil {
+		t.Fatalf("stage replay: %v", err)
+	}
+	replayedAsset, replayed, err := store.Commit(context.Background(), principal, metadata, replayStage)
+	if err != nil || !replayed || replayedAsset.ID != asset.ID {
+		t.Fatalf("replay = %#v, %t, %v", replayedAsset, replayed, err)
+	}
+
+	conflictStage, err := store.Stage(bytes.NewReader(pngBytes), core.PNGContentType)
+	if err != nil {
+		t.Fatalf("stage conflict: %v", err)
+	}
+	conflicting := metadata
+	conflicting.CapturedAt = conflicting.CapturedAt.Add(time.Second)
+	if _, _, err := store.Commit(context.Background(), principal, conflicting, conflictStage); !errors.Is(err, core.ErrConflict) {
+		t.Fatalf("conflicting replay error = %v", err)
+	}
+}
+
+func TestConcurrentReplayCreatesOneAsset(t *testing.T) {
+	database, store := newTestStore(t)
+	insertAttemptFixture(t, database)
+	pngBytes := makePNG(t, 3, 2)
+	metadata := core.UploadMetadata{UploadKey: testUploadKey, TaskID: testTaskID, AttemptID: testAttemptID, Kind: core.KindSKUPanelGate1, PrivacyTier: core.PrivacyInternalRaw, SHA256: sha256Hex(pngBytes), CapturedAt: time.Date(2026, 8, 4, 1, 2, 3, 0, time.UTC)}
+	staged := make([]core.StagedFile, 2)
+	for index := range staged {
+		var err error
+		staged[index], err = store.Stage(bytes.NewReader(pngBytes), core.PNGContentType)
+		if err != nil {
+			t.Fatalf("Stage %d: %v", index, err)
+		}
+	}
+	var wait sync.WaitGroup
+	wait.Add(2)
+	assets := make([]core.Asset, 2)
+	replays := make([]bool, 2)
+	errorsSeen := make([]error, 2)
+	for index := range staged {
+		go func(index int) {
+			defer wait.Done()
+			assets[index], replays[index], errorsSeen[index] = store.Commit(context.Background(), deviceauth.Principal{ID: testDeviceID}, metadata, staged[index])
+		}(index)
+	}
+	wait.Wait()
+	if errorsSeen[0] != nil || errorsSeen[1] != nil || assets[0].ID != assets[1].ID || replays[0] == replays[1] {
+		t.Fatalf("concurrent commits assets=%#v replays=%#v errors=%#v", assets, replays, errorsSeen)
+	}
+	var count int
+	if err := database.QueryRow("SELECT COUNT(*) FROM evidence_assets").Scan(&count); err != nil || count != 1 {
+		t.Fatalf("asset count = %d, err %v", count, err)
+	}
+}
+
+func TestPlatformDirectorySync(t *testing.T) {
+	if err := syncDirectory(t.TempDir()); err != nil {
+		t.Fatalf("syncDirectory must either establish the durability boundary or fail closed: %v", err)
+	}
+}
+
+func TestNewStoreRetriesRootParentSyncWhenRootAlreadyExists(t *testing.T) {
+	database, _ := newTestStore(t)
+	parent := t.TempDir()
+	root := filepath.Join(parent, "retry-root")
+	injected := errors.New("injected root parent sync failure")
+	if _, err := newStore(database, root, func(string) error { return injected }); !errors.Is(err, injected) {
+		t.Fatalf("first newStore error = %v, want injected root sync failure", err)
+	}
+	if info, err := os.Stat(root); err != nil || !info.IsDir() {
+		t.Fatalf("failed parent sync must leave root for retry: info=%v err=%v", info, err)
+	}
+
+	var paths []string
+	store, err := newStore(database, root, func(path string) error {
+		paths = append(paths, path)
+		return syncDirectory(path)
+	})
+	if err != nil {
+		t.Fatalf("retry newStore: %v", err)
+	}
+	if store == nil || len(paths) == 0 || paths[0] != parent {
+		t.Fatalf("retry sync paths = %#v, want root parent %q first", paths, parent)
+	}
+}
+
+func TestCommitSyncsShardAndRenameBeforeDatabaseWrite(t *testing.T) {
+	database, store := newTestStore(t)
+	insertAttemptFixture(t, database)
+	pngBytes := makePNG(t, 4, 3)
+	hash := sha256Hex(pngBytes)
+	metadata := testMetadata(hash)
+	staged, err := store.Stage(bytes.NewReader(pngBytes), core.PNGContentType)
+	if err != nil {
+		t.Fatalf("Stage: %v", err)
+	}
+	finalPath, err := store.pathForKey(storageKey(hash))
+	if err != nil {
+		t.Fatalf("final path: %v", err)
+	}
+	finalDirectory := filepath.Dir(finalPath)
+	var events []string
+	store.syncDirectory = func(path string) error {
+		var count int
+		if err := database.QueryRow("SELECT COUNT(*) FROM evidence_assets").Scan(&count); err != nil {
+			t.Fatalf("count evidence before directory sync: %v", err)
+		}
+		if count != 0 {
+			t.Fatalf("database row became visible before directory sync: %d", count)
+		}
+		switch path {
+		case store.root:
+			events = append(events, "sync-root")
+			if path != store.root {
+				t.Fatalf("shard parent sync path = %q, want evidence root %q", path, store.root)
+			}
+			if info, err := os.Stat(finalDirectory); err != nil || !info.IsDir() {
+				t.Fatalf("shard directory must exist before parent sync: info=%v err=%v", info, err)
+			}
+			if _, err := os.Stat(finalPath); !errors.Is(err, os.ErrNotExist) {
+				t.Fatalf("final file exists before publication: %v", err)
+			}
+		case finalDirectory:
+			events = append(events, "sync-shard")
+			if info, err := os.Stat(finalPath); err != nil || !info.Mode().IsRegular() {
+				t.Fatalf("renamed file must exist before shard sync: info=%v err=%v", info, err)
+			}
+		default:
+			t.Fatalf("unexpected extra directory sync: %q", path)
+		}
+		return syncDirectory(path)
+	}
+	store.syncFile = func(file *os.File) error {
+		if filepath.Dir(file.Name()) != finalDirectory || !strings.HasPrefix(filepath.Base(file.Name()), ".publish-") {
+			t.Fatalf("publication temp is not inside shard: %q", file.Name())
+		}
+		events = append(events, "sync-file")
+		return file.Sync()
+	}
+	store.renameFile = func(oldPath, newPath string) error {
+		if filepath.Dir(oldPath) != filepath.Dir(newPath) || newPath != finalPath {
+			t.Fatalf("rename is not same-directory publication: %q -> %q", oldPath, newPath)
+		}
+		events = append(events, "rename")
+		return os.Rename(oldPath, newPath)
+	}
+
+	if _, replayed, err := store.Commit(context.Background(), deviceauth.Principal{ID: testDeviceID}, metadata, staged); err != nil || replayed {
+		t.Fatalf("Commit = replayed %t, err %v", replayed, err)
+	}
+	if got, want := strings.Join(events, ","), "sync-root,sync-root,sync-file,rename,sync-shard"; got != want {
+		t.Fatalf("durability order = %q, want %q", got, want)
+	}
+	assertEvidenceCount(t, database, 1)
+	assertNoPublishTemps(t, finalDirectory)
+}
+
+func TestCommitDirectorySyncFailuresNeverWriteDatabase(t *testing.T) {
+	for _, failAt := range []int{1, 2, 3} {
+		t.Run(map[int]string{1: "new shard parent", 2: "unconditional shard parent", 3: "rename target"}[failAt], func(t *testing.T) {
+			database, store := newTestStore(t)
+			insertAttemptFixture(t, database)
+			pngBytes := makePNG(t, 4, 3)
+			hash := sha256Hex(pngBytes)
+			staged, err := store.Stage(bytes.NewReader(pngBytes), core.PNGContentType)
+			if err != nil {
+				t.Fatalf("Stage: %v", err)
+			}
+			finalPath, err := store.pathForKey(storageKey(hash))
+			if err != nil {
+				t.Fatalf("final path: %v", err)
+			}
+			injected := errors.New("injected directory sync failure")
+			calls := 0
+			store.syncDirectory = func(path string) error {
+				calls++
+				if calls == failAt {
+					return injected
+				}
+				return syncDirectory(path)
+			}
+
+			if _, _, err := store.Commit(context.Background(), deviceauth.Principal{ID: testDeviceID}, testMetadata(hash), staged); !errors.Is(err, injected) {
+				t.Fatalf("Commit error = %v, want injected sync failure", err)
+			}
+			if calls != failAt {
+				t.Fatalf("sync calls = %d, want %d", calls, failAt)
+			}
+			assertEvidenceCount(t, database, 0)
+			_, statErr := os.Stat(finalPath)
+			if failAt < 3 && !errors.Is(statErr, os.ErrNotExist) {
+				t.Fatalf("file exists before rename durability boundary: %v", statErr)
+			}
+			if failAt == 3 && statErr != nil {
+				t.Fatalf("post-rename sync failure may leave an orphan file, stat error = %v", statErr)
+			}
+			assertNoPublishTemps(t, filepath.Dir(finalPath))
+		})
+	}
+}
+
+func TestCommitRetriesShardParentSyncAfterPriorFailure(t *testing.T) {
+	database, store := newTestStore(t)
+	insertAttemptFixture(t, database)
+	pngBytes := makePNG(t, 4, 3)
+	hash := sha256Hex(pngBytes)
+	finalPath, err := store.pathForKey(storageKey(hash))
+	if err != nil {
+		t.Fatalf("final path: %v", err)
+	}
+	firstStage, err := store.Stage(bytes.NewReader(pngBytes), core.PNGContentType)
+	if err != nil {
+		t.Fatalf("first Stage: %v", err)
+	}
+	injected := errors.New("injected first shard parent sync failure")
+	store.syncDirectory = func(string) error { return injected }
+	if _, _, err := store.Commit(context.Background(), deviceauth.Principal{ID: testDeviceID}, testMetadata(hash), firstStage); !errors.Is(err, injected) {
+		t.Fatalf("first Commit error = %v", err)
+	}
+	if info, err := os.Stat(filepath.Dir(finalPath)); err != nil || !info.IsDir() {
+		t.Fatalf("failed first sync must leave the created shard for retry: info=%v err=%v", info, err)
+	}
+	assertEvidenceCount(t, database, 0)
+
+	secondStage, err := store.Stage(bytes.NewReader(pngBytes), core.PNGContentType)
+	if err != nil {
+		t.Fatalf("second Stage: %v", err)
+	}
+	var paths []string
+	store.syncDirectory = func(path string) error {
+		paths = append(paths, path)
+		return syncDirectory(path)
+	}
+	if _, replayed, err := store.Commit(context.Background(), deviceauth.Principal{ID: testDeviceID}, testMetadata(hash), secondStage); err != nil || replayed {
+		t.Fatalf("retry Commit = replayed %t, err %v", replayed, err)
+	}
+	if len(paths) != 2 || paths[0] != store.root || paths[1] != filepath.Dir(finalPath) {
+		t.Fatalf("retry sync paths = %#v, want root then shard", paths)
+	}
+	assertEvidenceCount(t, database, 1)
+	assertNoPublishTemps(t, filepath.Dir(finalPath))
+}
+
+func TestCommitPublicationFailuresCleanTempAndNeverWriteDatabase(t *testing.T) {
+	for _, name := range []string{"file sync", "rename"} {
+		t.Run(name, func(t *testing.T) {
+			database, store := newTestStore(t)
+			insertAttemptFixture(t, database)
+			pngBytes := makePNG(t, 4, 3)
+			hash := sha256Hex(pngBytes)
+			staged, err := store.Stage(bytes.NewReader(pngBytes), core.PNGContentType)
+			if err != nil {
+				t.Fatalf("Stage: %v", err)
+			}
+			finalPath, err := store.pathForKey(storageKey(hash))
+			if err != nil {
+				t.Fatalf("final path: %v", err)
+			}
+			injected := errors.New("injected publication failure")
+			if name == "file sync" {
+				store.syncFile = func(*os.File) error { return injected }
+			} else {
+				store.renameFile = func(string, string) error { return injected }
+			}
+			if _, _, err := store.Commit(context.Background(), deviceauth.Principal{ID: testDeviceID}, testMetadata(hash), staged); !errors.Is(err, injected) {
+				t.Fatalf("Commit error = %v, want injected publication failure", err)
+			}
+			if _, err := os.Stat(finalPath); !errors.Is(err, os.ErrNotExist) {
+				t.Fatalf("final file exists after failed publication: %v", err)
+			}
+			assertNoPublishTemps(t, filepath.Dir(finalPath))
+			assertEvidenceCount(t, database, 0)
+		})
+	}
+}
+
+func TestCommitDatabaseFailuresAfterDurableRenameLeaveOnlyOrphan(t *testing.T) {
+	for _, test := range []struct {
+		name   string
+		inject func(*testing.T, *sql.DB, *Store, error)
+	}{
+		{
+			name: "insert",
+			inject: func(t *testing.T, database *sql.DB, _ *Store, _ error) {
+				t.Helper()
+				if _, err := database.Exec(`CREATE TRIGGER fail_evidence_insert BEFORE INSERT ON evidence_assets BEGIN SELECT RAISE(ABORT, 'injected insert failure'); END`); err != nil {
+					t.Fatalf("create insert failure trigger: %v", err)
+				}
+			},
+		},
+		{
+			name: "commit",
+			inject: func(_ *testing.T, _ *sql.DB, store *Store, injected error) {
+				store.commitTx = func(*sql.Tx) error { return injected }
+			},
+		},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			database, store := newTestStore(t)
+			insertAttemptFixture(t, database)
+			pngBytes := makePNG(t, 4, 3)
+			hash := sha256Hex(pngBytes)
+			staged, err := store.Stage(bytes.NewReader(pngBytes), core.PNGContentType)
+			if err != nil {
+				t.Fatalf("Stage: %v", err)
+			}
+			finalPath, err := store.pathForKey(storageKey(hash))
+			if err != nil {
+				t.Fatalf("final path: %v", err)
+			}
+			injected := errors.New("injected database failure")
+			test.inject(t, database, store, injected)
+			syncCalls := 0
+			store.syncDirectory = func(path string) error {
+				syncCalls++
+				return syncDirectory(path)
+			}
+
+			if _, _, err := store.Commit(context.Background(), deviceauth.Principal{ID: testDeviceID}, testMetadata(hash), staged); err == nil {
+				t.Fatal("Commit unexpectedly succeeded")
+			}
+			if syncCalls != 3 {
+				t.Fatalf("database failure occurred before both durability syncs: sync calls = %d", syncCalls)
+			}
+			if info, err := os.Stat(finalPath); err != nil || !info.Mode().IsRegular() {
+				t.Fatalf("durable rename may leave only an orphan file: info=%v err=%v", info, err)
+			}
+			assertNoPublishTemps(t, filepath.Dir(finalPath))
+			assertEvidenceCount(t, database, 0)
+		})
+	}
+}
+
+func TestStageRejectsUnsafeContent(t *testing.T) {
+	_, store := newTestStore(t)
+	largePNG := makePNG(t, core.MaxImageSide+1, 1)
+	pngWithXML := append(makePNG(t, 1, 1), []byte("<hierarchy/>")...)
+	for name, test := range map[string]struct {
+		reader      io.Reader
+		contentType string
+	}{
+		"wrong content type": {reader: bytes.NewReader(makePNG(t, 1, 1)), contentType: "application/octet-stream"},
+		"xml":                {reader: bytes.NewBufferString("<hierarchy/>"), contentType: core.PNGContentType},
+		"png with xml tail":  {reader: bytes.NewReader(pngWithXML), contentType: core.PNGContentType},
+		"truncated png":      {reader: bytes.NewReader(pngSignature), contentType: core.PNGContentType},
+		"too wide":           {reader: bytes.NewReader(largePNG), contentType: core.PNGContentType},
+		"too many bytes":     {reader: io.LimitReader(zeroReader{}, core.MaxFileBytes+1), contentType: core.PNGContentType},
+	} {
+		t.Run(name, func(t *testing.T) {
+			staged, err := store.Stage(test.reader, test.contentType)
+			if !errors.Is(err, core.ErrInvalid) && !errors.Is(err, core.ErrTooLarge) {
+				store.Discard(staged)
+				t.Fatalf("Stage error = %v", err)
+			}
+		})
+	}
+}
+
+func TestCommitRequiresAttemptOwnedByTaskAndLowercaseHash(t *testing.T) {
+	database, store := newTestStore(t)
+	insertAttemptFixture(t, database)
+	pngBytes := makePNG(t, 2, 2)
+	base := core.UploadMetadata{UploadKey: testUploadKey, TaskID: testTaskID, AttemptID: testAttemptID, Kind: core.KindSKUPanelGate1, PrivacyTier: core.PrivacyInternalRaw, SHA256: sha256Hex(pngBytes), CapturedAt: time.Date(2026, 8, 4, 1, 2, 3, 0, time.UTC)}
+	for name, mutate := range map[string]func(*core.UploadMetadata){
+		"unknown attempt": func(value *core.UploadMetadata) { value.AttemptID = "53c9f507-7473-4fa6-8d71-8786c34c6301" },
+		"uppercase hash": func(value *core.UploadMetadata) {
+			value.SHA256 = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
+		},
+		"wrong kind": func(value *core.UploadMetadata) { value.Kind = "ORDER_CONFIRM" },
+	} {
+		t.Run(name, func(t *testing.T) {
+			staged, err := store.Stage(bytes.NewReader(pngBytes), core.PNGContentType)
+			if err != nil {
+				t.Fatalf("Stage: %v", err)
+			}
+			metadata := base
+			mutate(&metadata)
+			if _, _, err := store.Commit(context.Background(), deviceauth.Principal{ID: testDeviceID}, metadata, staged); !errors.Is(err, core.ErrInvalid) {
+				t.Fatalf("Commit error = %v", err)
+			}
+		})
+	}
+	var count int
+	if err := database.QueryRow("SELECT COUNT(*) FROM evidence_assets").Scan(&count); err != nil || count != 0 {
+		t.Fatalf("invalid commits created %d assets, err %v", count, err)
+	}
+}
+
+func TestNewStoreRejectsRelativeAndFilesystemRootPaths(t *testing.T) {
+	database, _ := newTestStore(t)
+	if _, err := NewStore(database, "relative-evidence"); err == nil {
+		t.Fatal("relative evidence root succeeded")
+	}
+	volumeRoot := filepath.VolumeName(t.TempDir()) + string(filepath.Separator)
+	if _, err := NewStore(database, volumeRoot); err == nil {
+		t.Fatal("filesystem root succeeded")
+	}
+}
+
+type zeroReader struct{}
+
+func (zeroReader) Read(buffer []byte) (int, error) {
+	for index := range buffer {
+		buffer[index] = 0
+	}
+	return len(buffer), nil
+}
+
+func newTestStore(t *testing.T) (*sql.DB, *Store) {
+	t.Helper()
+	database, err := sqlite.Open(filepath.Join(t.TempDir(), "evidence.db"))
+	if err != nil {
+		t.Fatalf("open database: %v", err)
+	}
+	t.Cleanup(func() { _ = database.Close() })
+	_, file, _, ok := runtime.Caller(0)
+	if !ok {
+		t.Fatal("locate test")
+	}
+	directory := filepath.Join(filepath.Dir(file), "..", "..", "..", "migrations")
+	if err := migrations.Up(context.Background(), database, directory); err != nil {
+		t.Fatalf("migrate database: %v", err)
+	}
+	store, err := NewStore(database, filepath.Join(t.TempDir(), "assets"))
+	if err != nil {
+		t.Fatalf("NewStore: %v", err)
+	}
+	return database, store
+}
+
+func insertAttemptFixture(t *testing.T, database *sql.DB) {
+	t.Helper()
+	timestamp := "2026-08-04T00:00:00Z"
+	if _, err := database.Exec(`INSERT INTO tasks (id, source, title, goods_id, sku_color, sku_size, quantity, max_total_price, status, version, created_at, updated_at) VALUES (?, 'MANUAL', 'task', '123', 'black', 'M', 1, '1.00', 'DRAFT', 1, ?, ?)`, testTaskID, timestamp, timestamp); err != nil {
+		t.Fatalf("insert task: %v", err)
+	}
+	if _, err := database.Exec(`INSERT INTO order_authorizations (id, task_id, task_version, start_key, goods_id, sku_color, sku_size, quantity, total_price_cap, status, created_by, created_at, expires_at) VALUES (?, ?, 1, 'start', '123', 'black', 'M', 1, '1.00', 'ACTIVE', 'admin', ?, ?)`, testAuthID, testTaskID, timestamp, timestamp); err != nil {
+		t.Fatalf("insert authorization: %v", err)
+	}
+	if _, err := database.Exec(`INSERT INTO purchase_attempts (id, task_id, authorization_id, claim_generation, status, started_at) VALUES (?, ?, ?, 1, 'CLAIMED', ?)`, testAttemptID, testTaskID, testAuthID, timestamp); err != nil {
+		t.Fatalf("insert attempt: %v", err)
+	}
+}
+
+func testMetadata(hash string) core.UploadMetadata {
+	return core.UploadMetadata{
+		UploadKey: testUploadKey, TaskID: testTaskID, AttemptID: testAttemptID,
+		Kind: core.KindSKUPanelGate1, PrivacyTier: core.PrivacyInternalRaw, SHA256: hash,
+		CapturedAt: time.Date(2026, 8, 4, 1, 2, 3, 0, time.UTC),
+	}
+}
+
+func assertEvidenceCount(t *testing.T, database *sql.DB, want int) {
+	t.Helper()
+	var count int
+	if err := database.QueryRow("SELECT COUNT(*) FROM evidence_assets").Scan(&count); err != nil {
+		t.Fatalf("count evidence assets: %v", err)
+	}
+	if count != want {
+		t.Fatalf("evidence asset count = %d, want %d", count, want)
+	}
+}
+
+func assertNoPublishTemps(t *testing.T, directory string) {
+	t.Helper()
+	entries, err := os.ReadDir(directory)
+	if err != nil {
+		t.Fatalf("read shard directory: %v", err)
+	}
+	for _, entry := range entries {
+		if strings.HasPrefix(entry.Name(), ".publish-") {
+			t.Fatalf("publication temp leaked: %q", entry.Name())
+		}
+	}
+}
+
+func makePNG(t *testing.T, width, height int) []byte {
+	t.Helper()
+	imageData := image.NewNRGBA(image.Rect(0, 0, width, height))
+	imageData.Set(0, 0, color.NRGBA{R: 12, G: 34, B: 56, A: 255})
+	var buffer bytes.Buffer
+	if err := png.Encode(&buffer, imageData); err != nil {
+		t.Fatalf("encode PNG: %v", err)
+	}
+	return buffer.Bytes()
+}
+
+func sha256Hex(value []byte) string {
+	hash := sha256.Sum256(value)
+	return hex.EncodeToString(hash[:])
+}

admin/internal/taskdetail/detail.go

@@ -0,0 +1,60 @@
+// Package taskdetail provides a read-only audit projection for one task.
+package taskdetail
+
+import (
+	"context"
+	"errors"
+	"time"
+)
+
+var ErrNotFound = errors.New("task detail not found")
+
+type Store interface {
+	Get(context.Context, string) (Detail, error)
+}
+
+type Detail struct {
+	Task           Task
+	Authorizations []Authorization
+	Attempts       []Attempt
+	Submissions    []Submission
+	Evidence       []Evidence
+}
+
+type Task struct {
+	ID, Source, Title, GoodsID, SKUColor, SKUSize, MaxTotalPrice, Status string
+	Quantity, Version                                                    int
+	CreatedAt, UpdatedAt                                                 time.Time
+}
+
+type Authorization struct {
+	ID, Status, CreatedBy, TotalPriceCap string
+	TaskVersion                          int
+	CreatedAt, ExpiresAt                 time.Time
+}
+
+type Attempt struct {
+	ID, AuthorizationID, Status string
+	ClaimGeneration             int
+	Gate1UnitPrice              *string
+	Gate2UnitPrice              *string
+	QuantityRead                *int
+	ConfirmAmount               *string
+	FailureCode                 *string
+	StartedAt                   time.Time
+	FinishedAt                  *time.Time
+}
+
+type Submission struct {
+	ID, AuthorizationID, AttemptID, Status        string
+	Gate1UnitPrice, Gate2UnitPrice, ConfirmAmount string
+	QuantityRead                                  int
+	CreatedAt                                     time.Time
+	ResolvedAt                                    *time.Time
+}
+
+type Evidence struct {
+	ID, AttemptID, Kind, PrivacyTier, SHA256, ContentType string
+	ByteSize, Width, Height                               int64
+	CapturedAt                                            time.Time
+}

admin/internal/taskdetail/store.go

@@ -0,0 +1,204 @@
+package taskdetail
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"fmt"
+	"time"
+)
+
+type SQLiteStore struct{ database *sql.DB }
+
+func NewSQLiteStore(database *sql.DB) (*SQLiteStore, error) {
+	if database == nil {
+		return nil, errors.New("task detail database is required")
+	}
+	if _, err := database.Exec("SELECT storage_key FROM evidence_assets LIMIT 1"); err != nil {
+		return nil, fmt.Errorf("task detail migration is not available: %w", err)
+	}
+	return &SQLiteStore{database: database}, nil
+}
+
+func (store *SQLiteStore) Get(ctx context.Context, id string) (Detail, error) {
+	if !validUUID(id) {
+		return Detail{}, ErrNotFound
+	}
+	tx, err := store.database.BeginTx(ctx, &sql.TxOptions{ReadOnly: true})
+	if err != nil {
+		return Detail{}, err
+	}
+	defer tx.Rollback()
+
+	var detail Detail
+	var created, updated string
+	err = tx.QueryRowContext(ctx, `SELECT id, source, title, goods_id, sku_color, sku_size, quantity, max_total_price, status, version, created_at, updated_at FROM tasks WHERE id = ?`, id).Scan(
+		&detail.Task.ID, &detail.Task.Source, &detail.Task.Title, &detail.Task.GoodsID, &detail.Task.SKUColor, &detail.Task.SKUSize,
+		&detail.Task.Quantity, &detail.Task.MaxTotalPrice, &detail.Task.Status, &detail.Task.Version, &created, &updated,
+	)
+	if errors.Is(err, sql.ErrNoRows) {
+		return Detail{}, ErrNotFound
+	}
+	if err != nil {
+		return Detail{}, err
+	}
+	if detail.Task.CreatedAt, err = parseTime(created); err != nil {
+		return Detail{}, err
+	}
+	if detail.Task.UpdatedAt, err = parseTime(updated); err != nil {
+		return Detail{}, err
+	}
+	if detail.Authorizations, err = readAuthorizations(ctx, tx, id); err != nil {
+		return Detail{}, err
+	}
+	if detail.Attempts, err = readAttempts(ctx, tx, id); err != nil {
+		return Detail{}, err
+	}
+	if detail.Submissions, err = readSubmissions(ctx, tx, id); err != nil {
+		return Detail{}, err
+	}
+	if detail.Evidence, err = readEvidence(ctx, tx, id); err != nil {
+		return Detail{}, err
+	}
+	if err := tx.Commit(); err != nil {
+		return Detail{}, err
+	}
+	return detail, nil
+}
+
+func readAuthorizations(ctx context.Context, tx *sql.Tx, taskID string) ([]Authorization, error) {
+	rows, err := tx.QueryContext(ctx, `SELECT id, task_version, total_price_cap, status, created_by, created_at, expires_at FROM order_authorizations WHERE task_id = ? ORDER BY created_at DESC, id DESC`, taskID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	result := []Authorization{}
+	for rows.Next() {
+		var item Authorization
+		var created, expires string
+		if err := rows.Scan(&item.ID, &item.TaskVersion, &item.TotalPriceCap, &item.Status, &item.CreatedBy, &created, &expires); err != nil {
+			return nil, err
+		}
+		if item.CreatedAt, err = parseTime(created); err != nil {
+			return nil, err
+		}
+		if item.ExpiresAt, err = parseTime(expires); err != nil {
+			return nil, err
+		}
+		result = append(result, item)
+	}
+	return result, rows.Err()
+}
+
+func readAttempts(ctx context.Context, tx *sql.Tx, taskID string) ([]Attempt, error) {
+	rows, err := tx.QueryContext(ctx, `SELECT id, authorization_id, claim_generation, status, gate1_unit_price, gate2_unit_price, quantity_read, confirm_amount, failure_code, started_at, finished_at FROM purchase_attempts WHERE task_id = ? ORDER BY started_at DESC, id DESC`, taskID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	result := []Attempt{}
+	for rows.Next() {
+		var item Attempt
+		var gate1, gate2, confirm, failure, finished sql.NullString
+		var quantity sql.NullInt64
+		var started string
+		if err := rows.Scan(&item.ID, &item.AuthorizationID, &item.ClaimGeneration, &item.Status, &gate1, &gate2, &quantity, &confirm, &failure, &started, &finished); err != nil {
+			return nil, err
+		}
+		item.Gate1UnitPrice, item.Gate2UnitPrice, item.ConfirmAmount, item.FailureCode = stringPointer(gate1), stringPointer(gate2), stringPointer(confirm), stringPointer(failure)
+		if quantity.Valid {
+			value := int(quantity.Int64)
+			item.QuantityRead = &value
+		}
+		if item.StartedAt, err = parseTime(started); err != nil {
+			return nil, err
+		}
+		if finished.Valid {
+			value, parseErr := parseTime(finished.String)
+			if parseErr != nil {
+				return nil, parseErr
+			}
+			item.FinishedAt = &value
+		}
+		result = append(result, item)
+	}
+	return result, rows.Err()
+}
+
+func readSubmissions(ctx context.Context, tx *sql.Tx, taskID string) ([]Submission, error) {
+	rows, err := tx.QueryContext(ctx, `SELECT id, authorization_id, attempt_id, status, gate1_unit_price, gate2_unit_price, quantity_read, confirm_amount, created_at, resolved_at FROM order_submissions WHERE task_id = ? ORDER BY created_at DESC, id DESC`, taskID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	result := []Submission{}
+	for rows.Next() {
+		var item Submission
+		var created string
+		var resolved sql.NullString
+		if err := rows.Scan(&item.ID, &item.AuthorizationID, &item.AttemptID, &item.Status, &item.Gate1UnitPrice, &item.Gate2UnitPrice, &item.QuantityRead, &item.ConfirmAmount, &created, &resolved); err != nil {
+			return nil, err
+		}
+		if item.CreatedAt, err = parseTime(created); err != nil {
+			return nil, err
+		}
+		if resolved.Valid {
+			value, parseErr := parseTime(resolved.String)
+			if parseErr != nil {
+				return nil, parseErr
+			}
+			item.ResolvedAt = &value
+		}
+		result = append(result, item)
+	}
+	return result, rows.Err()
+}
+
+func readEvidence(ctx context.Context, tx *sql.Tx, taskID string) ([]Evidence, error) {
+	rows, err := tx.QueryContext(ctx, `SELECT id, attempt_id, kind, privacy_tier, sha256, byte_size, content_type, width_px, height_px, captured_at FROM evidence_assets WHERE task_id = ? ORDER BY captured_at, created_at, id`, taskID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	result := []Evidence{}
+	for rows.Next() {
+		var item Evidence
+		var captured string
+		if err := rows.Scan(&item.ID, &item.AttemptID, &item.Kind, &item.PrivacyTier, &item.SHA256, &item.ByteSize, &item.ContentType, &item.Width, &item.Height, &captured); err != nil {
+			return nil, err
+		}
+		if item.CapturedAt, err = parseTime(captured); err != nil {
+			return nil, err
+		}
+		result = append(result, item)
+	}
+	return result, rows.Err()
+}
+
+func parseTime(value string) (time.Time, error) { return time.Parse(time.RFC3339Nano, value) }
+
+func stringPointer(value sql.NullString) *string {
+	if !value.Valid {
+		return nil
+	}
+	copy := value.String
+	return &copy
+}
+
+func validUUID(value string) bool {
+	if len(value) != 36 {
+		return false
+	}
+	for index, character := range value {
+		if index == 8 || index == 13 || index == 18 || index == 23 {
+			if character != '-' {
+				return false
+			}
+			continue
+		}
+		if !(character >= '0' && character <= '9' || character >= 'a' && character <= 'f') {
+			return false
+		}
+	}
+	return value[14] == '4' && (value[19] == '8' || value[19] == '9' || value[19] == 'a' || value[19] == 'b')
+}

admin/internal/taskdetail/store_test.go

@@ -0,0 +1,82 @@
+package taskdetail
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"testing"
+
+	"cmbuyer/admin/internal/migrations"
+	"cmbuyer/admin/internal/storage/sqlite"
+)
+
+const (
+	detailTask = "a3c9f507-7473-4fa6-8d71-8786c34c6301"
+	detailAuth = "b3c9f507-7473-4fa6-8d71-8786c34c6301"
+	detailTry  = "c3c9f507-7473-4fa6-8d71-8786c34c6301"
+)
+
+func TestSQLiteStoreReturnsOnlyPersistedAuditFacts(t *testing.T) {
+	database := openDetailDatabase(t)
+	timestamp := "2026-08-04T00:00:00Z"
+	if _, err := database.Exec(`INSERT INTO tasks (id, source, title, goods_id, sku_color, sku_size, quantity, max_total_price, status, version, created_at, updated_at) VALUES (?, 'MANUAL', 'shirt', '123', 'black', 'M', 2, '30.00', 'CLAIMED', 3, ?, ?)`, detailTask, timestamp, timestamp); err != nil {
+		t.Fatalf("insert task: %v", err)
+	}
+	if _, err := database.Exec(`INSERT INTO order_authorizations (id, task_id, task_version, start_key, goods_id, sku_color, sku_size, quantity, total_price_cap, status, created_by, created_at, expires_at) VALUES (?, ?, 2, 'start', '123', 'black', 'M', 2, '30.00', 'CLAIMED', 'admin', ?, ?)`, detailAuth, detailTask, timestamp, timestamp); err != nil {
+		t.Fatalf("insert authorization: %v", err)
+	}
+	if _, err := database.Exec(`INSERT INTO purchase_attempts (id, task_id, authorization_id, claim_generation, status, started_at) VALUES (?, ?, ?, 1, 'CLAIMED', ?)`, detailTry, detailTask, detailAuth, timestamp); err != nil {
+		t.Fatalf("insert attempt: %v", err)
+	}
+	hash := strings.Repeat("a", 64)
+	if _, err := database.Exec(`INSERT INTO evidence_assets (id, upload_key, task_id, attempt_id, kind, privacy_tier, sha256, byte_size, content_type, width_px, height_px, storage_key, uploaded_by_device_id, captured_at, created_at) VALUES ('d3c9f507-7473-4fa6-8d71-8786c34c6301', 'upload', ?, ?, 'SKU_PANEL_GATE_1', 'INTERNAL_RAW', ?, 100, 'image/png', 10, 20, ?, 'device', ?, ?)`, detailTask, detailTry, hash, "aa/"+hash+".png", timestamp, timestamp); err != nil {
+		t.Fatalf("insert evidence: %v", err)
+	}
+	store, err := NewSQLiteStore(database)
+	if err != nil {
+		t.Fatalf("NewSQLiteStore: %v", err)
+	}
+	detail, err := store.Get(context.Background(), detailTask)
+	if err != nil {
+		t.Fatalf("Get: %v", err)
+	}
+	if detail.Task.ID != detailTask || detail.Task.Status != "CLAIMED" || len(detail.Authorizations) != 1 || len(detail.Attempts) != 1 || len(detail.Evidence) != 1 || len(detail.Submissions) != 0 {
+		t.Fatalf("detail = %#v", detail)
+	}
+	if detail.Attempts[0].Gate1UnitPrice != nil || detail.Attempts[0].FailureCode != nil {
+		t.Fatalf("missing attempt facts were fabricated: %#v", detail.Attempts[0])
+	}
+}
+
+func TestSQLiteStoreFailsClosedForMalformedAndMissingIDs(t *testing.T) {
+	database := openDetailDatabase(t)
+	store, err := NewSQLiteStore(database)
+	if err != nil {
+		t.Fatalf("NewSQLiteStore: %v", err)
+	}
+	for _, id := range []string{"../database", "not-a-uuid", "a3c9f507-7473-1fa6-8d71-8786c34c6301"} {
+		if _, err := store.Get(context.Background(), id); !errors.Is(err, ErrNotFound) {
+			t.Fatalf("Get(%q) error = %v", id, err)
+		}
+	}
+}
+
+func openDetailDatabase(t *testing.T) *sql.DB {
+	t.Helper()
+	database, err := sqlite.Open(filepath.Join(t.TempDir(), "details.db"))
+	if err != nil {
+		t.Fatalf("open database: %v", err)
+	}
+	t.Cleanup(func() { _ = database.Close() })
+	_, file, _, ok := runtime.Caller(0)
+	if !ok {
+		t.Fatal("locate migration directory")
+	}
+	if err := migrations.Up(context.Background(), database, filepath.Join(filepath.Dir(file), "..", "..", "migrations")); err != nil {
+		t.Fatalf("migrate database: %v", err)
+	}
+	return database
+}

admin/internal/tasks/authorization.go

@@ -0,0 +1,128 @@
+package tasks
+
+import (
+	"errors"
+	"math"
+	"math/big"
+	"sort"
+	"strings"
+	"time"
+	_ "time/tzdata"
+)
+
+const maxStartItems = 100
+
+var (
+	ErrStartConflict = errors.New("purchase start conflicts with current task state")
+	ErrInvalidStart  = errors.New("invalid purchase start request")
+)
+
+type StartPolicy struct {
+	AuthorizationTTL time.Duration
+	MaxQuantity      int
+	MaxTotalPrice    string
+}
+type StartItem struct {
+	TaskID              string `json:"task_id"`
+	ExpectedTaskVersion int    `json:"expected_task_version"`
+}
+type StartCommand struct {
+	StartKey string      `json:"start_key"`
+	Tasks    []StartItem `json:"tasks"`
+}
+type AuthorizedTask struct {
+	TaskID          string    `json:"task_id"`
+	TaskVersion     int       `json:"task_version"`
+	AuthorizationID string    `json:"authorization_id"`
+	ExpiresAt       time.Time `json:"expires_at"`
+}
+type StartResult struct {
+	StartKey         string           `json:"start_key"`
+	AuthorizedCount  int              `json:"authorized_count"`
+	Tasks            []AuthorizedTask `json:"tasks"`
+	PaymentAutomated bool             `json:"payment_automated"`
+}
+type TaskFilter struct{ Keyword, Status, CreatedFrom, CreatedTo string }
+type TaskRow struct {
+	ID, Title, GoodsID, SKUColor, SKUSize, MaxTotalPrice, Status string
+	Quantity, Version                                            int
+	CreatedAt                                                    time.Time
+}
+
+func normalizeCents(value string) (string, *big.Int, bool) {
+	if value == "" || strings.TrimSpace(value) != value {
+		return "", nil, false
+	}
+	parts := strings.Split(value, ".")
+	if len(parts) != 2 || len(parts[0]) == 0 || len(parts[1]) != 2 || (len(parts[0]) > 1 && parts[0][0] == '0') {
+		return "", nil, false
+	}
+	for _, part := range parts {
+		for _, ch := range part {
+			if ch < '0' || ch > '9' {
+				return "", nil, false
+			}
+		}
+	}
+	cents := new(big.Int)
+	if _, ok := cents.SetString(parts[0]+parts[1], 10); !ok || cents.Sign() <= 0 {
+		return "", nil, false
+	}
+	return value, cents, true
+}
+
+func startItems(command StartCommand) ([]StartItem, error) {
+	if !validUUID(command.StartKey) || len(command.Tasks) == 0 || len(command.Tasks) > maxStartItems {
+		return nil, ErrInvalidStart
+	}
+	items := append([]StartItem(nil), command.Tasks...)
+	sort.Slice(items, func(i, j int) bool { return items[i].TaskID < items[j].TaskID })
+	for i, item := range items {
+		if !validUUID(item.TaskID) || item.ExpectedTaskVersion <= 0 || item.ExpectedTaskVersion == math.MaxInt || (i > 0 && item.TaskID == items[i-1].TaskID) {
+			return nil, ErrInvalidStart
+		}
+	}
+	return items, nil
+}
+
+func validTaskStatus(value string) bool {
+	if value == "" {
+		return true
+	}
+	for _, status := range []string{"DRAFT", "PENDING", "CLAIMED", "ORDERING", "NEEDS_MANUAL", "WAITING_PAYMENT", "RECONCILIATION_REQUIRED", "SUCCEEDED", "FAILED", "CANCELED"} {
+		if value == status {
+			return true
+		}
+	}
+	return false
+}
+
+func ShanghaiRange(from, to string) (time.Time, time.Time, error) {
+	if from == "" && to == "" {
+		return time.Time{}, time.Time{}, nil
+	}
+	location, err := time.LoadLocation("Asia/Shanghai")
+	if err != nil {
+		return time.Time{}, time.Time{}, err
+	}
+	parse := func(value string) (time.Time, error) { return time.ParseInLocation("2006-01-02", value, location) }
+	var start, end time.Time
+	if from != "" {
+		start, err = parse(from)
+		if err != nil {
+			return time.Time{}, time.Time{}, ErrInvalidStart
+		}
+		start = start.UTC()
+	}
+	if to != "" {
+		end, err = parse(to)
+		if err != nil {
+			return time.Time{}, time.Time{}, ErrInvalidStart
+		}
+		end = end.AddDate(0, 0, 1).UTC()
+	}
+	if !start.IsZero() && !end.IsZero() && !start.Before(end) {
+		return time.Time{}, time.Time{}, ErrInvalidStart
+	}
+	return start, end, nil
+}

admin/internal/tasks/start_purchases_store_test.go

@@ -0,0 +1,424 @@
+package tasks
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"fmt"
+	"math"
+	"reflect"
+	"sort"
+	"sync"
+	"testing"
+	"time"
+
+	"cmbuyer/admin/internal/migrations"
+)
+
+var fixedStartTime = time.Date(2026, 8, 4, 9, 2, 3, 456000000, time.FixedZone("UTC+8", 8*60*60))
+
+func TestStartPurchasesPersistsCompleteSnapshotsForOneAndHundredTasks(t *testing.T) {
+	for _, count := range []int{1, 100} {
+		t.Run(fmt.Sprintf("%d tasks", count), func(t *testing.T) {
+			database := migratedDatabase(t)
+			store := configuredStartStore(t, database)
+			store.now = func() time.Time { return fixedStartTime }
+			items := make([]StartItem, 0, count)
+			wantDrafts := make(map[string]Draft, count)
+			for index := 1; index <= count; index++ {
+				id := startTestUUID(index)
+				draft := Draft{
+					ID:            id,
+					Title:         fmt.Sprintf("task-%03d", index),
+					GoodsID:       fmt.Sprintf("937122%06d", index),
+					SKUColor:      fmt.Sprintf("color-%03d", index),
+					SKUSize:       fmt.Sprintf("size-%03d", index),
+					Quantity:      index%10 + 1,
+					MaxTotalPrice: fmt.Sprintf("%d.%02d", index+10, index%100),
+				}
+				if _, err := store.CreateDraft(context.Background(), draft); err != nil {
+					t.Fatalf("create draft %d: %v", index, err)
+				}
+				items = append(items, StartItem{TaskID: id, ExpectedTaskVersion: 1})
+				wantDrafts[id] = draft
+			}
+			sort.Slice(items, func(i, j int) bool { return items[i].TaskID > items[j].TaskID })
+			command := StartCommand{StartKey: startTestUUID(1001 + count), Tasks: items}
+
+			result, err := store.StartPurchases(context.Background(), command, "authenticated-admin")
+			if err != nil {
+				t.Fatalf("StartPurchases: %v", err)
+			}
+			if result.StartKey != command.StartKey || result.AuthorizedCount != count || result.PaymentAutomated || len(result.Tasks) != count {
+				t.Fatalf("result = %#v", result)
+			}
+			wantCreated := fixedStartTime.UTC()
+			wantExpires := wantCreated.Add(15 * time.Minute)
+			seenAuthorizationIDs := map[string]bool{}
+			for index, authorized := range result.Tasks {
+				if index > 0 && result.Tasks[index-1].TaskID >= authorized.TaskID {
+					t.Fatalf("result is not in canonical task order: %#v", result.Tasks)
+				}
+				if authorized.TaskVersion != 2 || !authorized.ExpiresAt.Equal(wantExpires) || !validUUID(authorized.AuthorizationID) || seenAuthorizationIDs[authorized.AuthorizationID] {
+					t.Fatalf("authorized task = %#v", authorized)
+				}
+				seenAuthorizationIDs[authorized.AuthorizationID] = true
+				want := wantDrafts[authorized.TaskID]
+				var taskStatus, taskUpdated, authTaskID, authStartKey, goodsID, color, size, priceCap, authStatus, createdBy, createdAt, expiresAt string
+				var taskVersion, authTaskVersion, quantity int
+				err := database.QueryRow(`
+					SELECT t.status,t.version,t.updated_at,
+					       a.task_id,a.task_version,a.start_key,a.goods_id,a.sku_color,a.sku_size,a.quantity,a.total_price_cap,a.status,a.created_by,a.created_at,a.expires_at
+					FROM tasks t JOIN order_authorizations a ON a.task_id=t.id WHERE a.id=?`, authorized.AuthorizationID).
+					Scan(&taskStatus, &taskVersion, &taskUpdated, &authTaskID, &authTaskVersion, &authStartKey, &goodsID, &color, &size, &quantity, &priceCap, &authStatus, &createdBy, &createdAt, &expiresAt)
+				if err != nil {
+					t.Fatalf("read authorization snapshot: %v", err)
+				}
+				if taskStatus != "PENDING" || taskVersion != 2 || taskUpdated != wantCreated.Format(time.RFC3339Nano) ||
+					authTaskID != want.ID || authTaskVersion != 2 || authStartKey != command.StartKey ||
+					goodsID != want.GoodsID || color != want.SKUColor || size != want.SKUSize || quantity != want.Quantity || priceCap != want.MaxTotalPrice ||
+					authStatus != "ACTIVE" || createdBy != "authenticated-admin" || createdAt != wantCreated.Format(time.RFC3339Nano) || expiresAt != wantExpires.Format(time.RFC3339Nano) {
+					t.Fatalf("stored task/authorization mismatch for %s", want.ID)
+				}
+			}
+			var distinctCreated, distinctExpires int
+			if err := database.QueryRow(`SELECT COUNT(DISTINCT created_at), COUNT(DISTINCT expires_at) FROM order_authorizations WHERE start_key=?`, command.StartKey).Scan(&distinctCreated, &distinctExpires); err != nil {
+				t.Fatal(err)
+			}
+			if distinctCreated != 1 || distinctExpires != 1 {
+				t.Fatalf("batch timestamps are not shared: created=%d expires=%d", distinctCreated, distinctExpires)
+			}
+		})
+	}
+}
+
+func TestStartPurchasesRejectsInvalidCommandsAndPolicyWithoutWrites(t *testing.T) {
+	validItem := StartItem{TaskID: startTestUUID(1), ExpectedTaskVersion: 1}
+	hundredOne := make([]StartItem, 101)
+	for index := range hundredOne {
+		hundredOne[index] = StartItem{TaskID: startTestUUID(index + 1), ExpectedTaskVersion: 1}
+	}
+	for name, command := range map[string]StartCommand{
+		"invalid start key": {StartKey: "not-a-uuid", Tasks: []StartItem{validItem}},
+		"empty tasks":       {StartKey: startTestUUID(1001)},
+		"over batch limit":  {StartKey: startTestUUID(1001), Tasks: hundredOne},
+		"invalid task id":   {StartKey: startTestUUID(1001), Tasks: []StartItem{{TaskID: "1", ExpectedTaskVersion: 1}}},
+		"duplicate task":    {StartKey: startTestUUID(1001), Tasks: []StartItem{validItem, validItem}},
+		"zero version":      {StartKey: startTestUUID(1001), Tasks: []StartItem{{TaskID: validItem.TaskID}}},
+		"overflow version":  {StartKey: startTestUUID(1001), Tasks: []StartItem{{TaskID: validItem.TaskID, ExpectedTaskVersion: math.MaxInt}}},
+	} {
+		t.Run(name, func(t *testing.T) {
+			database := migratedDatabase(t)
+			store := configuredStartStore(t, database)
+			_, err := store.StartPurchases(context.Background(), command, "admin")
+			if !errors.Is(err, ErrInvalidStart) {
+				t.Fatalf("error = %v, want ErrInvalidStart", err)
+			}
+			assertAuthorizationCount(t, database, 0)
+		})
+	}
+
+	for name, mutate := range map[string]func(*SQLiteStore){
+		"zero ttl":      func(store *SQLiteStore) { store.policy.AuthorizationTTL = 0 },
+		"zero quantity": func(store *SQLiteStore) { store.policy.MaxQuantity = 0 },
+		"bad max price": func(store *SQLiteStore) { store.policy.MaxTotalPrice = "999" },
+	} {
+		t.Run(name, func(t *testing.T) {
+			database := migratedDatabase(t)
+			store := configuredStartStore(t, database)
+			createStartDraft(t, store, validItem.TaskID)
+			mutate(store)
+			_, err := store.StartPurchases(context.Background(), StartCommand{StartKey: startTestUUID(1001), Tasks: []StartItem{validItem}}, "admin")
+			if !errors.Is(err, ErrInvalidStart) {
+				t.Fatalf("error = %v, want ErrInvalidStart", err)
+			}
+			assertDraftUnchanged(t, database, validItem.TaskID)
+			assertAuthorizationCount(t, database, 0)
+		})
+	}
+
+	database := migratedDatabase(t)
+	store := configuredStartStore(t, database)
+	createStartDraft(t, store, validItem.TaskID)
+	_, err := store.StartPurchases(context.Background(), StartCommand{StartKey: startTestUUID(1001), Tasks: []StartItem{validItem}}, "")
+	if !errors.Is(err, ErrInvalidStart) {
+		t.Fatalf("empty created_by error = %v", err)
+	}
+	assertDraftUnchanged(t, database, validItem.TaskID)
+}
+
+func TestStartPurchasesRejectsEveryTaskConflictWithoutAuthorization(t *testing.T) {
+	for name, mutate := range map[string]func(*testing.T, *SQLiteStore, string, *StartItem){
+		"missing": func(_ *testing.T, _ *SQLiteStore, _ string, item *StartItem) {
+			item.TaskID = startTestUUID(99)
+		},
+		"not draft": func(t *testing.T, store *SQLiteStore, id string, _ *StartItem) {
+			execTestSQL(t, store.database, `UPDATE tasks SET status='PENDING' WHERE id=?`, id)
+		},
+		"version mismatch": func(_ *testing.T, _ *SQLiteStore, _ string, item *StartItem) {
+			item.ExpectedTaskVersion = 2
+		},
+		"empty goods id": func(t *testing.T, store *SQLiteStore, id string, _ *StartItem) {
+			execTestSQL(t, store.database, `UPDATE tasks SET goods_id='' WHERE id=?`, id)
+		},
+		"nondigit goods id": func(t *testing.T, store *SQLiteStore, id string, _ *StartItem) {
+			execTestSQL(t, store.database, `UPDATE tasks SET goods_id='937x' WHERE id=?`, id)
+		},
+		"empty color": func(t *testing.T, store *SQLiteStore, id string, _ *StartItem) {
+			execTestSQL(t, store.database, `UPDATE tasks SET sku_color='' WHERE id=?`, id)
+		},
+		"empty size": func(t *testing.T, store *SQLiteStore, id string, _ *StartItem) {
+			execTestSQL(t, store.database, `UPDATE tasks SET sku_size='' WHERE id=?`, id)
+		},
+		"quantity over policy": func(_ *testing.T, store *SQLiteStore, _ string, _ *StartItem) {
+			store.policy.MaxQuantity = 1
+		},
+		"noncanonical price one decimal": func(t *testing.T, store *SQLiteStore, id string, _ *StartItem) {
+			execTestSQL(t, store.database, `UPDATE tasks SET max_total_price='12.8' WHERE id=?`, id)
+		},
+		"noncanonical leading zero": func(t *testing.T, store *SQLiteStore, id string, _ *StartItem) {
+			execTestSQL(t, store.database, `UPDATE tasks SET max_total_price='012.80' WHERE id=?`, id)
+		},
+		"price over policy": func(_ *testing.T, store *SQLiteStore, _ string, _ *StartItem) {
+			store.policy.MaxTotalPrice = "12.79"
+		},
+	} {
+		t.Run(name, func(t *testing.T) {
+			database := migratedDatabase(t)
+			store := configuredStartStore(t, database)
+			id := startTestUUID(1)
+			createStartDraft(t, store, id)
+			item := StartItem{TaskID: id, ExpectedTaskVersion: 1}
+			mutate(t, store, id, &item)
+			_, err := store.StartPurchases(context.Background(), StartCommand{StartKey: startTestUUID(1001), Tasks: []StartItem{item}}, "admin")
+			if !errors.Is(err, ErrStartConflict) {
+				t.Fatalf("error = %v, want ErrStartConflict", err)
+			}
+			assertAuthorizationCount(t, database, 0)
+		})
+	}
+}
+
+func TestStartPurchasesRollsBackWholeBatchForLateConflictAndSQLFailure(t *testing.T) {
+	for _, test := range []struct {
+		name       string
+		breakBatch func(*testing.T, *SQLiteStore, string)
+	}{
+		{name: "late validation conflict", breakBatch: func(t *testing.T, store *SQLiteStore, secondID string) {
+			execTestSQL(t, store.database, `UPDATE tasks SET sku_size='' WHERE id=?`, secondID)
+		}},
+		{name: "late SQL failure", breakBatch: func(t *testing.T, store *SQLiteStore, secondID string) {
+			statement := fmt.Sprintf(`CREATE TRIGGER reject_second_authorization BEFORE INSERT ON order_authorizations WHEN NEW.task_id='%s' BEGIN SELECT RAISE(ABORT, 'test failure'); END`, secondID)
+			execTestSQL(t, store.database, statement)
+		}},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			database := migratedDatabase(t)
+			store := configuredStartStore(t, database)
+			firstID, secondID := startTestUUID(1), startTestUUID(2)
+			createStartDraft(t, store, firstID)
+			createStartDraft(t, store, secondID)
+			test.breakBatch(t, store, secondID)
+			_, err := store.StartPurchases(context.Background(), StartCommand{StartKey: startTestUUID(1001), Tasks: []StartItem{{TaskID: firstID, ExpectedTaskVersion: 1}, {TaskID: secondID, ExpectedTaskVersion: 1}}}, "admin")
+			if err == nil {
+				t.Fatal("StartPurchases unexpectedly succeeded")
+			}
+			assertDraftUnchanged(t, database, firstID)
+			var secondStatus string
+			var secondVersion int
+			if err := database.QueryRow(`SELECT status,version FROM tasks WHERE id=?`, secondID).Scan(&secondStatus, &secondVersion); err != nil {
+				t.Fatal(err)
+			}
+			if secondStatus != "DRAFT" || secondVersion != 1 {
+				t.Fatalf("second task = %s/v%d, want DRAFT/v1", secondStatus, secondVersion)
+			}
+			assertAuthorizationCount(t, database, 0)
+		})
+	}
+}
+
+func TestStartPurchasesReplayIsStableAndRejectsDifferentOrIncompleteSets(t *testing.T) {
+	database := migratedDatabase(t)
+	store := configuredStartStore(t, database)
+	firstID, secondID, thirdID := startTestUUID(1), startTestUUID(2), startTestUUID(3)
+	for _, id := range []string{firstID, secondID, thirdID} {
+		createStartDraft(t, store, id)
+	}
+	command := StartCommand{StartKey: startTestUUID(1001), Tasks: []StartItem{{TaskID: secondID, ExpectedTaskVersion: 1}, {TaskID: firstID, ExpectedTaskVersion: 1}}}
+	first, err := store.StartPurchases(context.Background(), command, "admin")
+	if err != nil {
+		t.Fatal(err)
+	}
+	command.Tasks[0], command.Tasks[1] = command.Tasks[1], command.Tasks[0]
+	replay, err := store.StartPurchases(context.Background(), command, "admin")
+	if err != nil || !reflect.DeepEqual(replay, first) {
+		t.Fatalf("replay = (%#v, %v), want %#v", replay, err, first)
+	}
+	assertAuthorizationCount(t, database, 2)
+
+	conflicting := []StartCommand{
+		{StartKey: command.StartKey, Tasks: command.Tasks[:1]},
+		{StartKey: command.StartKey, Tasks: []StartItem{{TaskID: firstID, ExpectedTaskVersion: 2}, {TaskID: secondID, ExpectedTaskVersion: 1}}},
+		{StartKey: command.StartKey, Tasks: []StartItem{{TaskID: firstID, ExpectedTaskVersion: 1}, {TaskID: secondID, ExpectedTaskVersion: 1}, {TaskID: thirdID, ExpectedTaskVersion: 1}}},
+	}
+	for _, changed := range conflicting {
+		if _, err := store.StartPurchases(context.Background(), changed, "admin"); !errors.Is(err, ErrStartConflict) {
+			t.Fatalf("different payload error = %v", err)
+		}
+	}
+	assertAuthorizationCount(t, database, 2)
+	assertDraftUnchanged(t, database, thirdID)
+
+	execTestSQL(t, database, `DELETE FROM order_authorizations WHERE task_id=?`, secondID)
+	if _, err := store.StartPurchases(context.Background(), command, "admin"); !errors.Is(err, ErrStartConflict) {
+		t.Fatalf("incomplete replay error = %v", err)
+	}
+	assertAuthorizationCount(t, database, 1)
+}
+
+func TestStartPurchasesConcurrentReplayAndVersionRace(t *testing.T) {
+	t.Run("same key replays one stable result", func(t *testing.T) {
+		database := migratedDatabase(t)
+		store := configuredStartStore(t, database)
+		id := startTestUUID(1)
+		createStartDraft(t, store, id)
+		command := StartCommand{StartKey: startTestUUID(1001), Tasks: []StartItem{{TaskID: id, ExpectedTaskVersion: 1}}}
+		const callers = 16
+		start := make(chan struct{})
+		results := make(chan StartResult, callers)
+		errorsChannel := make(chan error, callers)
+		var group sync.WaitGroup
+		for range callers {
+			group.Add(1)
+			go func() {
+				defer group.Done()
+				<-start
+				result, err := store.StartPurchases(context.Background(), command, "admin")
+				if err != nil {
+					errorsChannel <- err
+					return
+				}
+				results <- result
+			}()
+		}
+		close(start)
+		group.Wait()
+		close(results)
+		close(errorsChannel)
+		for err := range errorsChannel {
+			t.Fatalf("concurrent replay: %v", err)
+		}
+		var want StartResult
+		for result := range results {
+			if want.StartKey == "" {
+				want = result
+			} else if !reflect.DeepEqual(result, want) {
+				t.Fatalf("unstable replay: %#v != %#v", result, want)
+			}
+		}
+		assertAuthorizationCount(t, database, 1)
+		var version int
+		if err := database.QueryRow(`SELECT version FROM tasks WHERE id=?`, id).Scan(&version); err != nil || version != 2 {
+			t.Fatalf("task version = %d, err=%v", version, err)
+		}
+	})
+
+	t.Run("different keys race one expected version", func(t *testing.T) {
+		database := migratedDatabase(t)
+		store := configuredStartStore(t, database)
+		id := startTestUUID(1)
+		createStartDraft(t, store, id)
+		start := make(chan struct{})
+		errorsChannel := make(chan error, 2)
+		var group sync.WaitGroup
+		for _, key := range []string{startTestUUID(1001), startTestUUID(1002)} {
+			group.Add(1)
+			go func(startKey string) {
+				defer group.Done()
+				<-start
+				_, err := store.StartPurchases(context.Background(), StartCommand{StartKey: startKey, Tasks: []StartItem{{TaskID: id, ExpectedTaskVersion: 1}}}, "admin")
+				errorsChannel <- err
+			}(key)
+		}
+		close(start)
+		group.Wait()
+		close(errorsChannel)
+		successes, conflicts := 0, 0
+		for err := range errorsChannel {
+			switch {
+			case err == nil:
+				successes++
+			case errors.Is(err, ErrStartConflict):
+				conflicts++
+			default:
+				t.Fatalf("unexpected race error: %v", err)
+			}
+		}
+		if successes != 1 || conflicts != 1 {
+			t.Fatalf("success/conflict = %d/%d, want 1/1", successes, conflicts)
+		}
+		assertAuthorizationCount(t, database, 1)
+	})
+}
+
+func TestSQLiteStoreRejectsV1SchemaAtStartup(t *testing.T) {
+	database := openDatabase(t)
+	if err := migrations.Run(context.Background(), database, migrationDirectory(t), "up-by-one"); err != nil {
+		t.Fatalf("migrate to v1: %v", err)
+	}
+	if _, err := NewSQLiteStore(database); err == nil {
+		t.Fatal("NewSQLiteStore accepted the v1 two-pass schema")
+	}
+}
+
+func configuredStartStore(t *testing.T, database *sql.DB) *SQLiteStore {
+	t.Helper()
+	store, err := NewSQLiteStore(database)
+	if err != nil {
+		t.Fatalf("NewSQLiteStore: %v", err)
+	}
+	store.SetStartPolicy(StartPolicy{AuthorizationTTL: 15 * time.Minute, MaxQuantity: 10, MaxTotalPrice: "999.99"})
+	return store
+}
+
+func createStartDraft(t *testing.T, store *SQLiteStore, id string) {
+	t.Helper()
+	draft := Draft{ID: id, Title: "test", GoodsID: "937122477375", SKUColor: "黑色", SKUSize: "M", Quantity: 2, MaxTotalPrice: "12.80"}
+	if _, err := store.CreateDraft(context.Background(), draft); err != nil {
+		t.Fatalf("CreateDraft: %v", err)
+	}
+}
+
+func startTestUUID(number int) string {
+	return fmt.Sprintf("%08x-1234-4abc-a123-%012x", number, number)
+}
+
+func assertAuthorizationCount(t *testing.T, database *sql.DB, want int) {
+	t.Helper()
+	var got int
+	if err := database.QueryRow(`SELECT COUNT(*) FROM order_authorizations`).Scan(&got); err != nil {
+		t.Fatal(err)
+	}
+	if got != want {
+		t.Fatalf("authorization count = %d, want %d", got, want)
+	}
+}
+
+func assertDraftUnchanged(t *testing.T, database *sql.DB, id string) {
+	t.Helper()
+	var status string
+	var version int
+	if err := database.QueryRow(`SELECT status,version FROM tasks WHERE id=?`, id).Scan(&status, &version); err != nil {
+		t.Fatal(err)
+	}
+	if status != "DRAFT" || version != 1 {
+		t.Fatalf("task %s = %s/v%d, want DRAFT/v1", id, status, version)
+	}
+}
+
+func execTestSQL(t *testing.T, database *sql.DB, statement string, arguments ...any) {
+	t.Helper()
+	if _, err := database.Exec(statement, arguments...); err != nil {
+		t.Fatalf("execute test SQL: %v", err)
+	}
+}

admin/internal/tasks/start_store.go

@@ -0,0 +1,229 @@
+package tasks
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"strings"
+	"time"
+
+	"cmbuyer/admin/internal/domain"
+)
+
+// ErrInvalidFilter 表示任务筛选值无效，路由应按字段重新渲染而不是泄露内部错误。
+var ErrInvalidFilter = errors.New("invalid task filter")
+
+// SetStartPolicy is called during startup; policy is explicit because authorization limits must not be implicit defaults.
+func (store *SQLiteStore) SetStartPolicy(policy StartPolicy) { store.policy = policy }
+
+func (store *SQLiteStore) ListTasks(ctx context.Context, filter TaskFilter) ([]TaskRow, error) {
+	if !ValidateTaskFilter(filter).Valid() {
+		return nil, ErrInvalidFilter
+	}
+	from, to, err := ShanghaiRange(filter.CreatedFrom, filter.CreatedTo)
+	if err != nil {
+		return nil, ErrInvalidFilter
+	}
+	clauses, args := []string{"1=1"}, []any{}
+	if filter.Status != "" {
+		clauses = append(clauses, "status = ?")
+		args = append(args, filter.Status)
+	}
+	if filter.Keyword != "" {
+		escaped := strings.NewReplacer("\\", "\\\\", "%", "\\%", "_", "\\_").Replace(filter.Keyword)
+		clauses = append(clauses, "(title LIKE ? ESCAPE '\\' OR goods_id LIKE ? ESCAPE '\\')")
+		args = append(args, "%"+escaped+"%", "%"+escaped+"%")
+	}
+	if !from.IsZero() {
+		clauses = append(clauses, "julianday(created_at) >= julianday(?)")
+		args = append(args, from.Format(time.RFC3339Nano))
+	}
+	if !to.IsZero() {
+		clauses = append(clauses, "julianday(created_at) < julianday(?)")
+		args = append(args, to.Format(time.RFC3339Nano))
+	}
+	rows, err := store.database.QueryContext(ctx, "SELECT id,title,goods_id,sku_color,sku_size,quantity,max_total_price,status,version,created_at FROM tasks WHERE "+strings.Join(clauses, " AND ")+" ORDER BY julianday(created_at) DESC,rowid DESC", args...)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	result := []TaskRow{}
+	for rows.Next() {
+		var item TaskRow
+		var created string
+		if err := rows.Scan(&item.ID, &item.Title, &item.GoodsID, &item.SKUColor, &item.SKUSize, &item.Quantity, &item.MaxTotalPrice, &item.Status, &item.Version, &created); err != nil {
+			return nil, err
+		}
+		item.CreatedAt, err = time.Parse(time.RFC3339Nano, created)
+		if err != nil {
+			return nil, err
+		}
+		result = append(result, item)
+	}
+	return result, rows.Err()
+}
+
+// ValidateTaskFilter 返回可关联到字段的错误，使服务端页面拒绝篡改参数时仍能保留输入值。
+func ValidateTaskFilter(filter TaskFilter) Errors {
+	validation := Errors{}
+	if !validTaskStatus(filter.Status) {
+		validation["status"] = "请选择有效的任务状态。"
+	}
+	location, err := time.LoadLocation("Asia/Shanghai")
+	if err != nil {
+		validation["created_from"] = "日期筛选暂不可用，请稍后重试。"
+		validation["created_to"] = "日期筛选暂不可用，请稍后重试。"
+		return validation
+	}
+	parseDate := func(field, value string) (time.Time, bool) {
+		if value == "" {
+			return time.Time{}, true
+		}
+		parsed, parseErr := time.ParseInLocation("2006-01-02", value, location)
+		if parseErr != nil {
+			validation[field] = "请输入有效日期。"
+			return time.Time{}, false
+		}
+		return parsed, true
+	}
+	from, fromOK := parseDate("created_from", filter.CreatedFrom)
+	to, toOK := parseDate("created_to", filter.CreatedTo)
+	if fromOK && toOK && !from.IsZero() && !to.IsZero() && from.After(to) {
+		validation["created_to"] = "结束日期不能早于开始日期。"
+	}
+	return validation
+}
+
+func (store *SQLiteStore) StartPurchases(ctx context.Context, command StartCommand, createdBy string) (StartResult, error) {
+	items, err := startItems(command)
+	if err != nil || createdBy == "" {
+		return StartResult{}, ErrInvalidStart
+	}
+	if store.policy.AuthorizationTTL <= 0 || store.policy.MaxQuantity <= 0 {
+		return StartResult{}, ErrInvalidStart
+	}
+	_, ceiling, ok := normalizeCents(store.policy.MaxTotalPrice)
+	if !ok {
+		return StartResult{}, ErrInvalidStart
+	}
+	writeCtx, cancel := context.WithTimeout(ctx, sqliteWriteTimeout)
+	defer cancel()
+	select {
+	case store.writeGate <- struct{}{}:
+		defer func() { <-store.writeGate }()
+	case <-writeCtx.Done():
+		return StartResult{}, writeCtx.Err()
+	}
+	tx, err := store.database.BeginTx(writeCtx, nil)
+	if err != nil {
+		return StartResult{}, err
+	}
+	defer tx.Rollback()
+	// Replay precedes any DRAFT check. One service process serializes this check with creation; SQLite uniqueness remains the cross-transaction backstop.
+	result, found, err := replayStart(writeCtx, tx, command.StartKey, items)
+	if err != nil {
+		return StartResult{}, err
+	}
+	if found {
+		if err := tx.Commit(); err != nil {
+			return StartResult{}, err
+		}
+		return result, nil
+	}
+	now := store.now().UTC()
+	expires := now.Add(store.policy.AuthorizationTTL)
+	result = StartResult{StartKey: command.StartKey, AuthorizedCount: len(items), Tasks: make([]AuthorizedTask, 0, len(items)), PaymentAutomated: false}
+	for _, item := range items {
+		var title, goods, color, size, price, status string
+		var quantity, version int
+		if err := tx.QueryRowContext(writeCtx, "SELECT title,goods_id,sku_color,sku_size,quantity,max_total_price,status,version FROM tasks WHERE id=?", item.TaskID).Scan(&title, &goods, &color, &size, &quantity, &price, &status, &version); err != nil {
+			if err == sql.ErrNoRows {
+				return StartResult{}, ErrStartConflict
+			}
+			return StartResult{}, err
+		}
+		if status != "DRAFT" || version != item.ExpectedTaskVersion || !goodsIDValid(goods) || color == "" || size == "" || quantity < 1 || quantity > store.policy.MaxQuantity {
+			return StartResult{}, ErrStartConflict
+		}
+		canonical, cents, ok := normalizeCents(price)
+		if !ok || canonical != price || cents.Cmp(ceiling) > 0 {
+			return StartResult{}, ErrStartConflict
+		}
+		if _, err := domain.TransitionTask(domain.TaskStatusDraft, domain.TaskStatusPending); err != nil {
+			return StartResult{}, err
+		}
+		id, err := NewCreateKey()
+		if err != nil {
+			return StartResult{}, err
+		}
+		next := version + 1
+		if _, err = tx.ExecContext(writeCtx, "INSERT INTO order_authorizations (id,task_id,task_version,start_key,goods_id,sku_color,sku_size,quantity,total_price_cap,status,created_by,created_at,expires_at) VALUES (?,?,?,?,?,?,?,?,?,'ACTIVE',?,?,?)", id, item.TaskID, next, command.StartKey, goods, color, size, quantity, price, createdBy, now.Format(time.RFC3339Nano), expires.Format(time.RFC3339Nano)); err != nil {
+			return StartResult{}, err
+		}
+		updated, err := tx.ExecContext(writeCtx, "UPDATE tasks SET status='PENDING',version=version+1,updated_at=? WHERE id=? AND status='DRAFT' AND version=?", now.Format(time.RFC3339Nano), item.TaskID, version)
+		if err != nil {
+			return StartResult{}, err
+		}
+		affected, err := updated.RowsAffected()
+		if err != nil {
+			return StartResult{}, err
+		}
+		if affected != 1 {
+			return StartResult{}, ErrStartConflict
+		}
+		result.Tasks = append(result.Tasks, AuthorizedTask{TaskID: item.TaskID, TaskVersion: next, AuthorizationID: id, ExpiresAt: expires})
+	}
+	if err := tx.Commit(); err != nil {
+		return StartResult{}, err
+	}
+	return result, nil
+}
+
+func goodsIDValid(value string) bool {
+	if value == "" {
+		return false
+	}
+	for _, ch := range value {
+		if ch < '0' || ch > '9' {
+			return false
+		}
+	}
+	return true
+}
+
+func replayStart(ctx context.Context, tx *sql.Tx, startKey string, items []StartItem) (StartResult, bool, error) {
+	rows, err := tx.QueryContext(ctx, "SELECT id,task_id,task_version,expires_at FROM order_authorizations WHERE start_key=? ORDER BY task_id", startKey)
+	if err != nil {
+		return StartResult{}, false, err
+	}
+	defer rows.Close()
+	result := StartResult{StartKey: startKey, PaymentAutomated: false}
+	for rows.Next() {
+		var item AuthorizedTask
+		var expires string
+		if err := rows.Scan(&item.AuthorizationID, &item.TaskID, &item.TaskVersion, &expires); err != nil {
+			return StartResult{}, false, err
+		}
+		item.ExpiresAt, err = time.Parse(time.RFC3339Nano, expires)
+		if err != nil {
+			return StartResult{}, false, err
+		}
+		result.Tasks = append(result.Tasks, item)
+	}
+	if err := rows.Err(); err != nil {
+		return StartResult{}, false, err
+	}
+	if len(result.Tasks) == 0 {
+		return StartResult{}, false, nil
+	}
+	if len(result.Tasks) != len(items) {
+		return StartResult{}, false, ErrStartConflict
+	}
+	for i := range items {
+		if result.Tasks[i].TaskID != items[i].TaskID || result.Tasks[i].TaskVersion-1 != items[i].ExpectedTaskVersion {
+			return StartResult{}, false, ErrStartConflict
+		}
+	}
+	result.AuthorizedCount = len(result.Tasks)
+	return result, true, nil
+}

admin/internal/tasks/start_store_test.go

@@ -0,0 +1,195 @@
+package tasks
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"testing"
+	"time"
+)
+
+func TestListTasksTreatsLikeMetacharactersLiterally(t *testing.T) {
+	database := migratedDatabase(t)
+	store, err := NewSQLiteStore(database)
+	if err != nil {
+		t.Fatal(err)
+	}
+	created := "2026-08-04T01:00:00Z"
+	insertTaskRow(t, database, "percent", "100%纯棉", "100", "DRAFT", created)
+	insertTaskRow(t, database, "underscore", "尺码_A", "101", "DRAFT", created)
+	insertTaskRow(t, database, "backslash", `路径\名称`, "102", "DRAFT", created)
+	insertTaskRow(t, database, "plain", "普通商品", "103", "DRAFT", created)
+
+	for _, test := range []struct {
+		keyword string
+		wantID  string
+	}{
+		{keyword: "%", wantID: "percent"},
+		{keyword: "_", wantID: "underscore"},
+		{keyword: `\`, wantID: "backslash"},
+	} {
+		t.Run(test.wantID, func(t *testing.T) {
+			rows, err := store.ListTasks(context.Background(), TaskFilter{Keyword: test.keyword})
+			if err != nil {
+				t.Fatal(err)
+			}
+			if len(rows) != 1 || rows[0].ID != test.wantID {
+				t.Fatalf("keyword %q rows = %#v, want only %q", test.keyword, rows, test.wantID)
+			}
+		})
+	}
+}
+
+func TestListTasksSupportsEveryStatusAndEmptyMeansAll(t *testing.T) {
+	database := migratedDatabase(t)
+	store, err := NewSQLiteStore(database)
+	if err != nil {
+		t.Fatal(err)
+	}
+	statuses := []string{"DRAFT", "PENDING", "CLAIMED", "ORDERING", "NEEDS_MANUAL", "WAITING_PAYMENT", "RECONCILIATION_REQUIRED", "SUCCEEDED", "FAILED", "CANCELED"}
+	for index, status := range statuses {
+		insertTaskRow(t, database, status, status, "200", status, time.Date(2026, 8, 4, 1, 0, index, 0, time.UTC).Format(time.RFC3339Nano))
+	}
+
+	all, err := store.ListTasks(context.Background(), TaskFilter{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(all) != len(statuses) {
+		t.Fatalf("all-status rows = %d, want %d", len(all), len(statuses))
+	}
+	for _, status := range statuses {
+		rows, err := store.ListTasks(context.Background(), TaskFilter{Status: status})
+		if err != nil {
+			t.Fatalf("status %s: %v", status, err)
+		}
+		if len(rows) != 1 || rows[0].Status != status {
+			t.Fatalf("status %s rows = %#v", status, rows)
+		}
+	}
+}
+
+func TestListTasksUsesShanghaiHalfOpenDateRange(t *testing.T) {
+	database := migratedDatabase(t)
+	store, err := NewSQLiteStore(database)
+	if err != nil {
+		t.Fatal(err)
+	}
+	insertTaskRow(t, database, "before", "before", "300", "DRAFT", "2026-08-03T15:59:59Z")
+	insertTaskRow(t, database, "at-start", "at-start", "301", "DRAFT", "2026-08-03T16:00:00Z")
+	insertTaskRow(t, database, "before-end", "before-end", "302", "DRAFT", "2026-08-04T15:59:59Z")
+	insertTaskRow(t, database, "at-end", "at-end", "303", "DRAFT", "2026-08-04T16:00:00Z")
+
+	rows, err := store.ListTasks(context.Background(), TaskFilter{CreatedFrom: "2026-08-04", CreatedTo: "2026-08-04"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(rows) != 2 || rows[0].ID != "before-end" || rows[1].ID != "at-start" {
+		t.Fatalf("Shanghai day rows = %#v, want [before-end at-start]", rows)
+	}
+}
+
+func TestListTasksBreaksEqualTimestampsByDescendingRowID(t *testing.T) {
+	database := migratedDatabase(t)
+	store, err := NewSQLiteStore(database)
+	if err != nil {
+		t.Fatal(err)
+	}
+	created := "2026-08-04T01:02:03Z"
+	insertTaskRow(t, database, "first", "first", "400", "DRAFT", created)
+	insertTaskRow(t, database, "second", "second", "401", "DRAFT", created)
+
+	rows, err := store.ListTasks(context.Background(), TaskFilter{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(rows) != 2 || rows[0].ID != "second" || rows[1].ID != "first" {
+		t.Fatalf("equal-time rows = %#v, want descending rowid", rows)
+	}
+}
+
+func TestListTasksRejectsInvalidStatusAndDates(t *testing.T) {
+	store, err := NewSQLiteStore(migratedDatabase(t))
+	if err != nil {
+		t.Fatal(err)
+	}
+	for name, filter := range map[string]TaskFilter{
+		"status":        {Status: "UNKNOWN"},
+		"from date":     {CreatedFrom: "2026-02-30"},
+		"to date":       {CreatedTo: "04/08/2026"},
+		"reverse range": {CreatedFrom: "2026-08-05", CreatedTo: "2026-08-04"},
+	} {
+		t.Run(name, func(t *testing.T) {
+			rows, err := store.ListTasks(context.Background(), filter)
+			if !errors.Is(err, ErrInvalidFilter) || rows != nil {
+				t.Fatalf("ListTasks(%#v) = (%#v, %v), want ErrInvalidFilter", filter, rows, err)
+			}
+		})
+	}
+}
+
+func TestStartPurchasesIsAtomicAndReplaysSameSet(t *testing.T) {
+	database := migratedDatabase(t)
+	store, err := NewSQLiteStore(database)
+	if err != nil {
+		t.Fatal(err)
+	}
+	store.SetStartPolicy(StartPolicy{AuthorizationTTL: time.Hour, MaxQuantity: 10, MaxTotalPrice: "999.99"})
+	store.now = func() time.Time { return time.Date(2026, 8, 4, 1, 2, 3, 0, time.UTC) }
+	for _, draft := range []Draft{testDraft(testKey, "one"), testDraft("b3c9f507-7473-4fa6-8d71-8786c34c6301", "two")} {
+		if _, err := store.CreateDraft(context.Background(), draft); err != nil {
+			t.Fatal(err)
+		}
+	}
+	command := StartCommand{StartKey: "c3c9f507-7473-4fa6-8d71-8786c34c6301", Tasks: []StartItem{{TaskID: "b3c9f507-7473-4fa6-8d71-8786c34c6301", ExpectedTaskVersion: 1}, {TaskID: testKey, ExpectedTaskVersion: 1}}}
+	first, err := store.StartPurchases(context.Background(), command, "admin")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if first.AuthorizedCount != 2 || first.PaymentAutomated {
+		t.Fatalf("start result=%#v", first)
+	}
+	command.Tasks[0], command.Tasks[1] = command.Tasks[1], command.Tasks[0]
+	replay, err := store.StartPurchases(context.Background(), command, "admin")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if replay.Tasks[0].AuthorizationID != first.Tasks[0].AuthorizationID || replay.Tasks[1].AuthorizationID != first.Tasks[1].AuthorizationID {
+		t.Fatalf("replay=%#v first=%#v", replay, first)
+	}
+	var pending, auths int
+	if err := database.QueryRow(`SELECT COUNT(*) FROM tasks WHERE status='PENDING' AND version=2`).Scan(&pending); err != nil || pending != 2 {
+		t.Fatalf("pending=%d err=%v", pending, err)
+	}
+	if err := database.QueryRow(`SELECT COUNT(*) FROM order_authorizations WHERE status='ACTIVE' AND created_by='admin'`).Scan(&auths); err != nil || auths != 2 {
+		t.Fatalf("auths=%d err=%v", auths, err)
+	}
+	_, err = store.StartPurchases(context.Background(), StartCommand{StartKey: command.StartKey, Tasks: command.Tasks[:1]}, "admin")
+	if !errors.Is(err, ErrStartConflict) {
+		t.Fatalf("subset err=%v", err)
+	}
+}
+
+func TestShanghaiRangeAndMoneyAreFailClosed(t *testing.T) {
+	start, end, err := ShanghaiRange("2026-08-04", "2026-08-04")
+	if err != nil || start.Format(time.RFC3339) != "2026-08-03T16:00:00Z" || end.Format(time.RFC3339) != "2026-08-04T16:00:00Z" {
+		t.Fatalf("range=(%s,%s,%v)", start, end, err)
+	}
+	for _, value := range []string{"0.01", "12.80", "999999999999999999999999.99"} {
+		if _, _, ok := normalizeCents(value); !ok {
+			t.Fatalf("money %q rejected", value)
+		}
+	}
+	for _, value := range []string{"1", "01.20", "0.00", "1.234", "1.", " 1.00", "1e2"} {
+		if _, _, ok := normalizeCents(value); ok {
+			t.Fatalf("money %q accepted", value)
+		}
+	}
+}
+
+func insertTaskRow(t *testing.T, database *sql.DB, id, title, goodsID, status, createdAt string) {
+	t.Helper()
+	if _, err := database.Exec(`INSERT INTO tasks (id, source, title, goods_id, sku_color, sku_size, quantity, max_total_price, status, version, created_at, updated_at) VALUES (?, 'MANUAL', ?, ?, '黑色', 'M', 2, '12.80', ?, 1, ?, ?)`, id, title, goodsID, status, createdAt, createdAt); err != nil {
+		t.Fatalf("insert task %s: %v", id, err)
+	}
+}

admin/internal/tasks/store.go

@@ -0,0 +1,135 @@
+package tasks
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"fmt"
+	"time"
+)
+
+const sqliteWriteTimeout = 2 * time.Second
+
+type Store interface {
+	CreateDraft(context.Context, Draft) (Draft, error)
+	ListDrafts(context.Context) ([]Draft, error)
+	ListTasks(context.Context, TaskFilter) ([]TaskRow, error)
+	StartPurchases(context.Context, StartCommand, string) (StartResult, error)
+}
+type SQLiteStore struct {
+	database  *sql.DB
+	now       func() time.Time
+	writeGate chan struct{}
+	policy    StartPolicy
+}
+
+func NewSQLiteStore(database *sql.DB) (*SQLiteStore, error) {
+	if database == nil {
+		return nil, errors.New("database is required")
+	}
+	if _, err := database.Exec("SELECT task_version, start_key, total_price_cap FROM order_authorizations LIMIT 1"); err != nil {
+		return nil, fmt.Errorf("tasks migration is not available: %w", err)
+	}
+	if _, err := database.Exec("SELECT 1 FROM purchase_attempts LIMIT 1"); err != nil {
+		return nil, fmt.Errorf("single-pass migration is not available: %w", err)
+	}
+	return &SQLiteStore{database: database, now: time.Now, writeGate: make(chan struct{}, 1)}, nil
+}
+
+func (store *SQLiteStore) CreateDraft(ctx context.Context, draft Draft) (Draft, error) {
+	writeContext, cancel := context.WithTimeout(ctx, sqliteWriteTimeout)
+	defer cancel()
+	// SQLite permits one writer at a time. Serializing this store's short create
+	// transaction prevents concurrent retries of one create key from surfacing as busy.
+	select {
+	case store.writeGate <- struct{}{}:
+		defer func() { <-store.writeGate }()
+	case <-writeContext.Done():
+		return Draft{}, writeContext.Err()
+	}
+	draft.CreatedAt = store.now().UTC()
+	transaction, err := store.database.BeginTx(writeContext, nil)
+	if err != nil {
+		return Draft{}, err
+	}
+	defer transaction.Rollback()
+	_, err = transaction.ExecContext(writeContext, `INSERT INTO tasks (id, source, title, goods_id, sku_color, sku_size, quantity, max_total_price, status, version, created_at, updated_at) VALUES (?, 'MANUAL', ?, ?, ?, ?, ?, ?, 'DRAFT', 1, ?, ?)`, draft.ID, draft.Title, draft.GoodsID, draft.SKUColor, draft.SKUSize, draft.Quantity, draft.MaxTotalPrice, draft.CreatedAt.Format(time.RFC3339Nano), draft.CreatedAt.Format(time.RFC3339Nano))
+	if err == nil {
+		if err := transaction.Commit(); err != nil {
+			return Draft{}, err
+		}
+		return draft, nil
+	}
+	existing, found, currentPhase, lookupErr := findDraft(writeContext, transaction, draft.ID)
+	if lookupErr != nil {
+		return Draft{}, lookupErr
+	}
+	if found && currentPhase && samePayload(existing, draft) {
+		if err := transaction.Commit(); err != nil {
+			return Draft{}, err
+		}
+		return existing, nil
+	}
+	if found {
+		return Draft{}, ErrCreateKeyConflict
+	}
+	return Draft{}, err
+}
+
+func (store *SQLiteStore) ListDrafts(ctx context.Context) ([]Draft, error) {
+	// rowid makes equal timestamps deterministic: SQLite assigns it in insertion order,
+	// whereas UUID v4 is deliberately not time-sortable.
+	rows, err := store.database.QueryContext(ctx, `SELECT id, title, goods_id, sku_color, sku_size, quantity, max_total_price, created_at FROM tasks WHERE source = 'MANUAL' AND status = 'DRAFT' ORDER BY created_at DESC, rowid DESC`)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	result := []Draft{}
+	for rows.Next() {
+		draft, err := scanDraft(rows)
+		if err != nil {
+			return nil, err
+		}
+		result = append(result, draft)
+	}
+	return result, rows.Err()
+}
+
+func findDraft(ctx context.Context, transaction *sql.Tx, id string) (Draft, bool, bool, error) {
+	row := transaction.QueryRowContext(ctx, `SELECT id, title, goods_id, sku_color, sku_size, quantity, max_total_price, created_at, source, status, version FROM tasks WHERE id = ?`, id)
+	var draft Draft
+	var created, source, status string
+	var version int
+	err := row.Scan(&draft.ID, &draft.Title, &draft.GoodsID, &draft.SKUColor, &draft.SKUSize, &draft.Quantity, &draft.MaxTotalPrice, &created, &source, &status, &version)
+	if errors.Is(err, sql.ErrNoRows) {
+		return Draft{}, false, false, nil
+	}
+	if err != nil {
+		return Draft{}, false, false, err
+	}
+	parsed, err := time.Parse(time.RFC3339Nano, created)
+	if err != nil {
+		return Draft{}, false, false, err
+	}
+	draft.CreatedAt = parsed
+	return draft, true, source == "MANUAL" && status == "DRAFT" && version == 1, nil
+}
+
+type scanner interface{ Scan(...any) error }
+
+func scanDraft(row scanner) (Draft, error) {
+	var draft Draft
+	var created string
+	if err := row.Scan(&draft.ID, &draft.Title, &draft.GoodsID, &draft.SKUColor, &draft.SKUSize, &draft.Quantity, &draft.MaxTotalPrice, &created); err != nil {
+		return Draft{}, err
+	}
+	parsed, err := time.Parse(time.RFC3339Nano, created)
+	if err != nil {
+		return Draft{}, err
+	}
+	draft.CreatedAt = parsed
+	return draft, nil
+}
+func samePayload(left, right Draft) bool {
+	return left.ID == right.ID && left.Title == right.Title && left.GoodsID == right.GoodsID && left.SKUColor == right.SKUColor && left.SKUSize == right.SKUSize && left.Quantity == right.Quantity && left.MaxTotalPrice == right.MaxTotalPrice
+}

admin/internal/tasks/tasks.go

@@ -0,0 +1,159 @@
+// Package tasks 定义手工 DRAFT 任务的校验与窄仓储边界。
+package tasks
+
+import (
+	"crypto/rand"
+	"encoding/hex"
+	"errors"
+	"net/url"
+	"strconv"
+	"strings"
+	"time"
+)
+
+const (
+	maxTitleLength = 120
+	maxSKUText     = 80
+)
+
+var ErrCreateKeyConflict = errors.New("create key conflicts with a different task")
+
+type Draft struct {
+	ID            string
+	Title         string
+	GoodsID       string
+	SKUColor      string
+	SKUSize       string
+	Quantity      int
+	MaxTotalPrice string
+	CreatedAt     time.Time
+}
+
+type Form struct{ CreateKey, Title, ProductURL, SKUColor, SKUSize, Quantity, MaxTotalPrice string }
+type Errors map[string]string
+
+func (errors Errors) Valid() bool { return len(errors) == 0 }
+
+// Validate trims and normalizes a user form. It never reads a product page or derives price data.
+func Validate(form Form) (Draft, Errors) {
+	draft := Draft{ID: strings.TrimSpace(form.CreateKey), Title: strings.TrimSpace(form.Title), SKUColor: strings.TrimSpace(form.SKUColor), SKUSize: strings.TrimSpace(form.SKUSize)}
+	errors := Errors{}
+	if !validUUID(draft.ID) {
+		errors["create_key"] = "创建请求已过期，请重新打开表单。"
+	}
+	if draft.Title == "" || len([]rune(draft.Title)) > maxTitleLength {
+		errors["title"] = "任务名称不能为空，且不能超过 120 个字符。"
+	}
+	if draft.SKUColor == "" || len([]rune(draft.SKUColor)) > maxSKUText {
+		errors["sku_color"] = "颜色分类不能为空，且不能超过 80 个字符。"
+	}
+	if draft.SKUSize == "" || len([]rune(draft.SKUSize)) > maxSKUText {
+		errors["sku_size"] = "尺码不能为空，且不能超过 80 个字符。"
+	}
+	goodsID, ok := CanonicalGoodsID(strings.TrimSpace(form.ProductURL))
+	if !ok {
+		errors["product_url"] = "请输入唯一的 canonical 商品链接。"
+	} else {
+		draft.GoodsID = goodsID
+	}
+	quantity, err := strconv.ParseInt(strings.TrimSpace(form.Quantity), 10, 0)
+	if err != nil || quantity < 1 {
+		errors["quantity"] = "数量必须是正整数。"
+	} else {
+		draft.Quantity = int(quantity)
+	}
+	money, ok := normalizeMoney(strings.TrimSpace(form.MaxTotalPrice))
+	if !ok {
+		errors["max_total_price"] = "价格上限必须大于零，且最多两位小数。"
+	} else {
+		draft.MaxTotalPrice = money
+	}
+	return draft, errors
+}
+
+// CanonicalGoodsID only accepts the one verified manual-entry URL shape; untrusted query data is discarded.
+func CanonicalGoodsID(value string) (string, bool) {
+	if value == "" || strings.Contains(value, "\\") || strings.Contains(value, "%") {
+		return "", false
+	}
+	parsed, err := url.ParseRequestURI(value)
+	if err != nil || parsed.Scheme != "https" || parsed.Host != "mobile.yangkeduo.com" || parsed.User != nil || parsed.Port() != "" || parsed.Path != "/goods.html" || parsed.Fragment != "" {
+		return "", false
+	}
+	values, err := url.ParseQuery(parsed.RawQuery)
+	if err != nil {
+		return "", false
+	}
+	goodsIDs := values["goods_id"]
+	if len(goodsIDs) != 1 || goodsIDs[0] == "" {
+		return "", false
+	}
+	for _, character := range goodsIDs[0] {
+		if character < '0' || character > '9' {
+			return "", false
+		}
+	}
+	return goodsIDs[0], true
+}
+
+func CanonicalURL(goodsID string) string {
+	return "https://mobile.yangkeduo.com/goods.html?goods_id=" + goodsID
+}
+
+func NewCreateKey() (string, error) {
+	bytes := make([]byte, 16)
+	if _, err := rand.Read(bytes); err != nil {
+		return "", err
+	}
+	bytes[6] = (bytes[6] & 0x0f) | 0x40
+	bytes[8] = (bytes[8] & 0x3f) | 0x80
+	hexValue := hex.EncodeToString(bytes)
+	return hexValue[0:8] + "-" + hexValue[8:12] + "-" + hexValue[12:16] + "-" + hexValue[16:20] + "-" + hexValue[20:32], nil
+}
+
+func validUUID(value string) bool {
+	if len(value) != 36 {
+		return false
+	}
+	for index, character := range value {
+		if index == 8 || index == 13 || index == 18 || index == 23 {
+			if character != '-' {
+				return false
+			}
+			continue
+		}
+		if !(character >= '0' && character <= '9' || character >= 'a' && character <= 'f') {
+			return false
+		}
+	}
+	return value[14] == '4' && (value[19] == '8' || value[19] == '9' || value[19] == 'a' || value[19] == 'b')
+}
+
+func normalizeMoney(value string) (string, bool) {
+	parts := strings.Split(value, ".")
+	if len(parts) > 2 || parts[0] == "" || len(parts) == 2 && (len(parts[1]) == 0 || len(parts[1]) > 2) {
+		return "", false
+	}
+	for _, character := range parts[0] {
+		if character < '0' || character > '9' {
+			return "", false
+		}
+	}
+	fraction := ""
+	if len(parts) == 2 {
+		fraction = parts[1]
+		for _, character := range fraction {
+			if character < '0' || character > '9' {
+				return "", false
+			}
+		}
+	}
+	whole := strings.TrimLeft(parts[0], "0")
+	if whole == "" {
+		whole = "0"
+	}
+	if whole == "0" && strings.Trim(fraction, "0") == "" {
+		return "", false
+	}
+	return whole + "." + (fraction + "00")[:2], true
+}

admin/internal/tasks/tasks_test.go

@@ -0,0 +1,300 @@
+package tasks
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"path/filepath"
+	"regexp"
+	"runtime"
+	"sync"
+	"testing"
+	"time"
+
+	"cmbuyer/admin/internal/migrations"
+	"cmbuyer/admin/internal/storage/sqlite"
+)
+
+const testKey = "a3c9f507-7473-4fa6-8d71-8786c34c6301"
+
+func TestValidateNormalizesManualDraft(t *testing.T) {
+	draft, validation := Validate(Form{
+		CreateKey:     " " + testKey + " ",
+		Title:         "  夏季上衣  ",
+		ProductURL:    "https://mobile.yangkeduo.com/goods.html?goods_id=937122477375&utm_source=untrusted",
+		SKUColor:      " 黑色CHA(纯棉) ",
+		SKUSize:       " M(建议100-115) ",
+		Quantity:      "2",
+		MaxTotalPrice: "00012.8",
+	})
+	if !validation.Valid() {
+		t.Fatalf("Validate errors = %#v", validation)
+	}
+	if draft.ID != testKey || draft.GoodsID != "937122477375" || draft.Title != "夏季上衣" || draft.SKUColor != "黑色CHA(纯棉)" || draft.SKUSize != "M(建议100-115)" || draft.Quantity != 2 || draft.MaxTotalPrice != "12.80" {
+		t.Fatalf("normalized draft = %#v", draft)
+	}
+}
+
+func TestValidateRejectsInvalidFieldsAndURLs(t *testing.T) {
+	base := Form{CreateKey: testKey, Title: "title", ProductURL: "https://mobile.yangkeduo.com/goods.html?goods_id=1", SKUColor: "black", SKUSize: "M", Quantity: "1", MaxTotalPrice: "1"}
+	for name, update := range map[string]func(*Form){
+		"empty title":       func(form *Form) { form.Title = "  " },
+		"long color":        func(form *Form) { form.SKUColor = string(make([]rune, maxSKUText+1)) },
+		"fraction quantity": func(form *Form) { form.Quantity = "1.5" },
+		"zero quantity":     func(form *Form) { form.Quantity = "0" },
+		"too many decimals": func(form *Form) { form.MaxTotalPrice = "1.234" },
+		"trailing decimal":  func(form *Form) { form.MaxTotalPrice = "1." },
+		"zero money":        func(form *Form) { form.MaxTotalPrice = "0.00" },
+	} {
+		t.Run(name, func(t *testing.T) {
+			form := base
+			update(&form)
+			if _, validation := Validate(form); validation.Valid() {
+				t.Fatal("invalid form was accepted")
+			}
+		})
+	}
+
+	for _, value := range []string{
+		"http://mobile.yangkeduo.com/goods.html?goods_id=1",
+		"https://yangkeduo.com/goods.html?goods_id=1",
+		"https://mobile.yangkeduo.com:443/goods.html?goods_id=1",
+		"https://user@mobile.yangkeduo.com/goods.html?goods_id=1",
+		"https://mobile.yangkeduo.com/goods.html?goods_id=1#fragment",
+		"https://mobile.yangkeduo.com/goods.html?goods_id=1&goods_id=2",
+		"https://mobile.yangkeduo.com/goods.html?goods_id=one",
+		"https://mobile.yangkeduo.com/goods.html?goods_id=%31",
+		"https://mobile.yangkeduo.com/goods.html?goods_id=1%26goods_id%3D2",
+		"https://mobile.yangkeduo.com/goods.html?goods_id=1;uin=bad",
+		"https://mobile.yangkeduo.com/other.html?goods_id=1",
+	} {
+		if _, ok := CanonicalGoodsID(value); ok {
+			t.Fatalf("CanonicalGoodsID accepted %q", value)
+		}
+	}
+}
+
+func TestNormalizeMoneyBoundaries(t *testing.T) {
+	for value, want := range map[string]string{"1": "1.00", "1.2": "1.20", "000.01": "0.01", "999999999999999999": "999999999999999999.00"} {
+		got, ok := normalizeMoney(value)
+		if !ok || got != want {
+			t.Fatalf("normalizeMoney(%q) = (%q, %t), want (%q, true)", value, got, ok, want)
+		}
+	}
+	for _, value := range []string{"0", "0.0", "0.00", "1.", ".1", "1.000", "-1", "1e2", " 1"} {
+		if got, ok := normalizeMoney(value); ok {
+			t.Fatalf("normalizeMoney(%q) = %q, want rejection", value, got)
+		}
+	}
+}
+
+func TestNewCreateKeyIsUUIDv4(t *testing.T) {
+	key, err := NewCreateKey()
+	if err != nil {
+		t.Fatalf("NewCreateKey: %v", err)
+	}
+	if !regexp.MustCompile(`^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$`).MatchString(key) {
+		t.Fatalf("create key %q is not UUID v4", key)
+	}
+}
+
+func TestSQLiteStoreRequiresMigratedDatabase(t *testing.T) {
+	database := openDatabase(t)
+	if _, err := NewSQLiteStore(database); err == nil {
+		t.Fatal("NewSQLiteStore accepted an unmigrated database")
+	}
+}
+
+func TestSQLiteStoreCreatesListsAndHandlesIdempotency(t *testing.T) {
+	database := migratedDatabase(t)
+	store, err := NewSQLiteStore(database)
+	if err != nil {
+		t.Fatalf("NewSQLiteStore: %v", err)
+	}
+	baseTime := time.Date(2026, 8, 4, 9, 0, 0, 0, time.UTC)
+	call := 0
+	store.now = func() time.Time {
+		result := baseTime.Add(time.Duration(call) * time.Minute)
+		call++
+		return result
+	}
+	first := testDraft(testKey, "first")
+	created, err := store.CreateDraft(context.Background(), first)
+	if err != nil {
+		t.Fatalf("create first draft: %v", err)
+	}
+	replayed, err := store.CreateDraft(context.Background(), first)
+	if err != nil {
+		t.Fatalf("replay first draft: %v", err)
+	}
+	if replayed.CreatedAt != created.CreatedAt {
+		t.Fatalf("replayed CreatedAt = %s, want original %s", replayed.CreatedAt, created.CreatedAt)
+	}
+	second := testDraft("b3c9f507-7473-4fa6-8d71-8786c34c6301", "second")
+	if _, err := store.CreateDraft(context.Background(), second); err != nil {
+		t.Fatalf("create second draft: %v", err)
+	}
+	drafts, err := store.ListDrafts(context.Background())
+	if err != nil {
+		t.Fatalf("list drafts: %v", err)
+	}
+	if len(drafts) != 2 || drafts[0].ID != second.ID || drafts[1].ID != first.ID {
+		t.Fatalf("draft order = %#v, want second then first", drafts)
+	}
+	var source, status string
+	var version int
+	if err := database.QueryRow(`SELECT source, status, version FROM tasks WHERE id = ?`, first.ID).Scan(&source, &status, &version); err != nil {
+		t.Fatalf("read stored task: %v", err)
+	}
+	if source != "MANUAL" || status != "DRAFT" || version != 1 {
+		t.Fatalf("stored metadata = (%q, %q, %d)", source, status, version)
+	}
+
+	conflicting := first
+	conflicting.Title = "different"
+	if _, err := store.CreateDraft(context.Background(), conflicting); !errors.Is(err, ErrCreateKeyConflict) {
+		t.Fatalf("conflicting create error = %v, want ErrCreateKeyConflict", err)
+	}
+}
+
+func TestSQLiteStoreRollsBackFailedCreate(t *testing.T) {
+	database := migratedDatabase(t)
+	store, err := NewSQLiteStore(database)
+	if err != nil {
+		t.Fatalf("NewSQLiteStore: %v", err)
+	}
+	if _, err := database.Exec(`CREATE TRIGGER reject_task BEFORE INSERT ON tasks BEGIN SELECT RAISE(ABORT, 'reject test insert'); END`); err != nil {
+		t.Fatalf("create trigger: %v", err)
+	}
+	if _, err := store.CreateDraft(context.Background(), testDraft(testKey, "blocked")); err == nil {
+		t.Fatal("CreateDraft succeeded despite rejecting trigger")
+	}
+	drafts, err := store.ListDrafts(context.Background())
+	if err != nil {
+		t.Fatalf("list after failed create: %v", err)
+	}
+	if len(drafts) != 0 {
+		t.Fatalf("failed create persisted drafts: %#v", drafts)
+	}
+}
+
+func TestSQLiteStoreUsesInsertionOrderForEqualTimesAndFiltersPhase(t *testing.T) {
+	database := migratedDatabase(t)
+	store, err := NewSQLiteStore(database)
+	if err != nil {
+		t.Fatalf("NewSQLiteStore: %v", err)
+	}
+	store.now = func() time.Time { return time.Date(2026, 8, 4, 9, 0, 0, 0, time.UTC) }
+	first := testDraft(testKey, "first")
+	second := testDraft("b3c9f507-7473-4fa6-8d71-8786c34c6301", "second")
+	for _, draft := range []Draft{first, second} {
+		if _, err := store.CreateDraft(context.Background(), draft); err != nil {
+			t.Fatalf("create %s: %v", draft.Title, err)
+		}
+	}
+	if _, err := database.Exec(`INSERT INTO tasks (id, source, title, goods_id, sku_color, sku_size, quantity, max_total_price, status, version, created_at, updated_at) VALUES ('excel-draft', 'EXCEL', 'other', '1', 'black', 'M', 1, '1.00', 'DRAFT', 1, '2026-08-04T10:00:00Z', '2026-08-04T10:00:00Z'), ('manual-pending', 'MANUAL', 'other', '2', 'black', 'M', 1, '1.00', 'PENDING', 1, '2026-08-04T10:00:00Z', '2026-08-04T10:00:00Z')`); err != nil {
+		t.Fatalf("insert out-of-scope tasks: %v", err)
+	}
+	drafts, err := store.ListDrafts(context.Background())
+	if err != nil {
+		t.Fatalf("list drafts: %v", err)
+	}
+	if len(drafts) != 2 || drafts[0].ID != second.ID || drafts[1].ID != first.ID {
+		t.Fatalf("equal-time draft order/filter = %#v, want second then first only", drafts)
+	}
+	if _, err := database.Exec(`UPDATE tasks SET status = 'PENDING' WHERE id = ?`, first.ID); err != nil {
+		t.Fatalf("move draft outside current phase: %v", err)
+	}
+	if _, err := store.CreateDraft(context.Background(), first); !errors.Is(err, ErrCreateKeyConflict) {
+		t.Fatalf("replay of non-DRAFT record error = %v, want conflict", err)
+	}
+	third := testDraft("c3c9f507-7473-4fa6-8d71-8786c34c6301", "third")
+	if _, err := database.Exec(`INSERT INTO tasks (id, source, title, goods_id, sku_color, sku_size, quantity, max_total_price, status, version, created_at, updated_at) VALUES (?, 'EXCEL', ?, ?, ?, ?, ?, ?, 'DRAFT', 1, '2026-08-04T09:00:00Z', '2026-08-04T09:00:00Z')`, third.ID, third.Title, third.GoodsID, third.SKUColor, third.SKUSize, third.Quantity, third.MaxTotalPrice); err != nil {
+		t.Fatalf("insert same-payload EXCEL record: %v", err)
+	}
+	if _, err := store.CreateDraft(context.Background(), third); !errors.Is(err, ErrCreateKeyConflict) {
+		t.Fatalf("replay of non-MANUAL record error = %v, want conflict", err)
+	}
+	if _, err := database.Exec(`UPDATE tasks SET version = 2, source = 'MANUAL' WHERE id = ?`, third.ID); err != nil {
+		t.Fatalf("change replay record version: %v", err)
+	}
+	if _, err := store.CreateDraft(context.Background(), third); !errors.Is(err, ErrCreateKeyConflict) {
+		t.Fatalf("replay of non-v1 record error = %v, want conflict", err)
+	}
+}
+
+func TestSQLiteStoreConcurrentIdenticalCreateIsOneDraft(t *testing.T) {
+	store, err := NewSQLiteStore(migratedDatabase(t))
+	if err != nil {
+		t.Fatalf("NewSQLiteStore: %v", err)
+	}
+	const callers = 20
+	start := make(chan struct{})
+	errors := make(chan error, callers)
+	results := make(chan Draft, callers)
+	var group sync.WaitGroup
+	for range callers {
+		group.Add(1)
+		go func() {
+			defer group.Done()
+			<-start
+			draft, err := store.CreateDraft(context.Background(), testDraft(testKey, "same"))
+			if err != nil {
+				errors <- err
+				return
+			}
+			results <- draft
+		}()
+	}
+	close(start)
+	group.Wait()
+	close(errors)
+	close(results)
+	for err := range errors {
+		t.Fatalf("concurrent create: %v", err)
+	}
+	for result := range results {
+		if result.ID != testKey {
+			t.Fatalf("concurrent result = %#v", result)
+		}
+	}
+	drafts, err := store.ListDrafts(context.Background())
+	if err != nil {
+		t.Fatalf("list after concurrent create: %v", err)
+	}
+	if len(drafts) != 1 || drafts[0].ID != testKey {
+		t.Fatalf("concurrent creates persisted %#v, want exactly one", drafts)
+	}
+}
+
+func testDraft(id, title string) Draft {
+	return Draft{ID: id, Title: title, GoodsID: "937122477375", SKUColor: "black", SKUSize: "M", Quantity: 2, MaxTotalPrice: "12.80"}
+}
+
+func openDatabase(t *testing.T) *sql.DB {
+	t.Helper()
+	database, err := sqlite.Open(filepath.Join(t.TempDir(), "tasks.db"))
+	if err != nil {
+		t.Fatalf("open database: %v", err)
+	}
+	t.Cleanup(func() { _ = database.Close() })
+	return database
+}
+
+func migratedDatabase(t *testing.T) *sql.DB {
+	t.Helper()
+	database := openDatabase(t)
+	if err := migrations.Up(context.Background(), database, migrationDirectory(t)); err != nil {
+		t.Fatalf("migrate database: %v", err)
+	}
+	return database
+}
+
+func migrationDirectory(t *testing.T) string {
+	t.Helper()
+	_, file, _, ok := runtime.Caller(0)
+	if !ok {
+		t.Fatal("locate test source")
+	}
+	return filepath.Join(filepath.Dir(file), "..", "..", "migrations")
+}

admin/internal/transport/webui/static/drawer.test.js

@@ -0,0 +1,211 @@
+"use strict";
+
+const test = require("node:test");
+const assert = require("node:assert/strict");
+const fs = require("node:fs");
+const path = require("node:path");
+const vm = require("node:vm");
+
+const source = fs.readFileSync(path.join(__dirname, "tasks.js"), "utf8");
+
+test("visible button opens the same routed detail and close restores list state", async () => {
+  const harness = createDrawerHarness();
+
+  harness.button.listeners.click();
+  await harness.flush();
+
+  assert.equal(harness.requests.length, 1);
+  assert.equal(harness.requests[0].url, "/tasks/a3c9f507-7473-4fa6-8d71-8786c34c6301");
+  assert.equal(harness.requests[0].options.headers["X-CMBuyer-View"], "drawer");
+  assert.equal(harness.drawer.open, true);
+  assert.equal(harness.closeButton.focused, true);
+  assert.equal(harness.history.pushes.length, 1);
+  assert.equal(harness.history.pushes[0].url, harness.requests[0].url);
+  assert.equal(harness.history.pushes[0].state.focusTarget, "button");
+
+  harness.closeButton.listeners.click();
+  assert.equal(harness.history.backCalls, 1);
+  harness.popstate({state: {cmbuyerList: true}});
+  assert.equal(harness.drawer.open, false);
+  assert.equal(harness.button.focused, true);
+  assert.equal(harness.row.focused, false);
+  assert.equal(harness.scrolls.length, 1);
+  assert.equal(harness.scrolls[0].top, 275);
+  assert.equal(harness.scrolls[0].behavior, "auto");
+});
+
+test("button focus target survives back, forward, and back again", async () => {
+  const harness = createDrawerHarness();
+  harness.button.listeners.click();
+  await harness.flush();
+  const drawerState = harness.history.pushes[0].state;
+
+  harness.popstate({state: {cmbuyerList: true}});
+  assert.equal(harness.button.focusCalls, 1);
+  assert.equal(harness.row.focusCalls, 0);
+
+  harness.popstate({state: drawerState});
+  await harness.flush();
+  assert.equal(harness.drawer.open, true);
+  assert.equal(harness.history.pushes.length, 1);
+
+  harness.popstate({state: {cmbuyerList: true}});
+  assert.equal(harness.drawer.open, false);
+  assert.equal(harness.button.focusCalls, 2);
+  assert.equal(harness.row.focusCalls, 0);
+});
+
+test("failed forward retry reuses history and closes back to button in one step", async () => {
+  const harness = createDrawerHarness();
+  harness.button.listeners.click();
+  await harness.flush();
+  const drawerState = harness.history.pushes[0].state;
+  harness.popstate({state: {cmbuyerList: true}});
+
+  harness.failNextRequest();
+  harness.popstate({state: drawerState});
+  await harness.flush();
+  const retry = harness.body.children[1].children[0];
+  retry.listeners.click();
+  await harness.flush();
+
+  assert.equal(harness.history.pushes.length, 1);
+  assert.equal(harness.drawer.open, true);
+  harness.closeButton.listeners.click();
+  assert.equal(harness.history.backCalls, 1);
+  harness.popstate({state: {cmbuyerList: true}});
+  assert.equal(harness.drawer.open, false);
+  assert.equal(harness.button.focusCalls, 2);
+  assert.equal(harness.row.focusCalls, 0);
+});
+
+test("double click and Enter open rows but nested controls never do", async () => {
+  const harness = createDrawerHarness();
+  const ignored = {closest: () => ({})};
+  const rowTarget = {closest: () => null};
+
+  harness.row.listeners.dblclick({target: ignored});
+  harness.row.listeners.dblclick({target: rowTarget});
+  await harness.flush();
+  assert.equal(harness.requests.length, 1);
+
+  harness.popstate({state: {cmbuyerList: true}});
+  let prevented = false;
+  harness.row.listeners.keydown({key: "Enter", target: harness.row, preventDefault: () => { prevented = true; }});
+  await harness.flush();
+  assert.equal(prevented, true);
+  assert.equal(harness.requests.length, 2);
+
+  harness.row.listeners.keydown({key: "Enter", target: ignored, preventDefault: () => assert.fail("nested control Enter was intercepted")});
+  assert.equal(harness.requests.length, 2);
+});
+
+test("browser back and forward close and reopen without duplicating history", async () => {
+  const harness = createDrawerHarness();
+  harness.row.listeners.keydown({key: "Enter", target: harness.row, preventDefault() {}});
+  await harness.flush();
+  assert.equal(harness.history.pushes.length, 1);
+
+  harness.popstate({state: {cmbuyerList: true}});
+  assert.equal(harness.drawer.open, false);
+  harness.popstate({state: {cmbuyerDrawer: true, detailURL: harness.row.dataset.detailUrl}});
+  await harness.flush();
+
+  assert.equal(harness.drawer.open, true);
+  assert.equal(harness.requests.length, 2);
+  assert.equal(harness.history.pushes.length, 1);
+});
+
+test("Escape follows browser history and does not mutate list URL", async () => {
+  const harness = createDrawerHarness();
+  harness.button.listeners.click();
+  await harness.flush();
+  let prevented = false;
+
+  harness.drawer.listeners.cancel({preventDefault: () => { prevented = true; }});
+
+  assert.equal(prevented, true);
+  assert.equal(harness.history.backCalls, 1);
+  assert.equal(harness.history.replaces[0].url, "/tasks?status=DRAFT");
+});
+
+function createDrawerHarness() {
+  class FakeElement {
+    constructor() {
+      this.listeners = {};
+      this.dataset = {};
+      this.open = false;
+      this.focused = false;
+      this.focusCalls = 0;
+      this.children = [];
+      this._innerHTML = "";
+    }
+    addEventListener(type, listener) { this.listeners[type] = listener; }
+    focus() { this.focused = true; this.focusCalls++; }
+    showModal() { this.open = true; }
+    close() { this.open = false; }
+    replaceChildren(...children) { this.children = children; this._innerHTML = ""; }
+    append(...children) { this.children.push(...children); }
+    setAttribute() {}
+    closest() { return null; }
+    set innerHTML(value) { this._innerHTML = value; }
+    get innerHTML() { return this._innerHTML; }
+  }
+
+  const body = new FakeElement();
+  const closeButton = new FakeElement();
+  const button = new FakeElement();
+  const row = new FakeElement();
+  row.dataset.detailUrl = "/tasks/a3c9f507-7473-4fa6-8d71-8786c34c6301";
+  row.querySelector = (selector) => selector === "[data-open-detail]" ? button : null;
+  const drawer = new FakeElement();
+  drawer.querySelector = (selector) => ({"[data-detail-body]": body, "[data-close-detail]": closeButton})[selector] || null;
+
+  const requests = [];
+  const popstateListeners = [];
+  const scrolls = [];
+  let failNext = false;
+  const history = {
+    state: null,
+    pushes: [],
+    replaces: [],
+    backCalls: 0,
+    pushState(state, _title, url) { this.state = state; this.pushes.push({state, url}); },
+    replaceState(state, _title, url) { this.state = state; this.replaces.push({state, url}); },
+    back() { this.backCalls++; },
+  };
+  const document = {
+    querySelector: (selector) => selector === "[data-start-purchases]" ? null : selector === "[data-detail-drawer]" ? drawer : null,
+    querySelectorAll: (selector) => selector === "[data-task-row]" ? [row] : [],
+    createElement: () => new FakeElement(),
+    contains: (element) => element === row || element === button,
+  };
+  const window = {
+    location: {pathname: "/tasks", search: "?status=DRAFT"},
+    history,
+    scrollY: 275,
+    scrollTo: (value) => scrolls.push(value),
+    addEventListener(type, listener) { if (type === "popstate") popstateListeners.push(listener); },
+  };
+  const context = {
+    AbortController,
+    document,
+    window,
+    fetch: async (url, options) => {
+      requests.push({url, options});
+      if (failNext) {
+        failNext = false;
+        return {ok: false, headers: {get: () => "text/html"}, text: async () => ""};
+      }
+      return {ok: true, headers: {get: () => "text/html; charset=utf-8"}, text: async () => '<article data-task-detail-content>详情</article>'};
+    },
+  };
+  vm.runInNewContext(source, context, {filename: "tasks.js"});
+
+  return {
+    body, button, closeButton, drawer, history, requests, row, scrolls,
+    failNextRequest: () => { failNext = true; },
+    popstate: (event) => { history.state = event.state; popstateListeners.forEach((listener) => listener(event)); },
+    flush: () => new Promise((resolve) => setImmediate(resolve)),
+  };
+}

admin/internal/transport/webui/static/tasks.js

@@ -0,0 +1,167 @@
+(() => {
+  "use strict";
+  const form = document.querySelector("[data-start-purchases]");
+  if (!form) return;
+  const all = form.querySelector("[data-select-all]");
+  const summary = form.querySelector("[data-selection-summary]");
+  const button = form.querySelector("[data-start-button]");
+  const feedback = form.querySelector("[data-start-feedback]");
+  const boxes = () => [...form.querySelectorAll("input[data-task-id]")];
+  let selectionFrozen = false;
+  const parseCents = (value) => {
+    const match = /^(0|[1-9]\d*)\.(\d{2})$/.exec(value);
+    return match ? BigInt(match[1] + match[2]) : null;
+  };
+  const refresh = () => {
+    const available = boxes();
+    const selected = available.filter((box) => box.checked);
+    let cents = 0n;
+    let pricesValid = true;
+    selected.forEach((box) => {
+      const price = parseCents(box.dataset.price);
+      if (price === null) pricesValid = false;
+      else cents += price;
+    });
+    summary.textContent = `已选 ${selected.length} 条，最高总额 ¥${cents / 100n}.${(cents % 100n).toString().padStart(2, "0")}`;
+    button.disabled = !selected.length || !pricesValid;
+    if (!pricesValid) feedback.textContent = "所选任务金额无法安全汇总，请刷新后重选。";
+    if (all) {
+      all.checked = selected.length > 0 && selected.length === available.length;
+      all.indeterminate = selected.length > 0 && selected.length < available.length;
+      all.disabled = selectionFrozen || available.length === 0;
+    }
+  };
+  const freezeSelection = (frozen) => {
+    selectionFrozen = frozen;
+    boxes().forEach((box) => { box.disabled = frozen; });
+    refresh();
+  };
+  boxes().forEach((box) => box.addEventListener("change", refresh));
+  if (all) all.addEventListener("change", () => { boxes().forEach((box) => { box.checked = all.checked; }); refresh(); });
+  let frozenPayload = null;
+  let inFlight = false;
+  form.addEventListener("submit", async (event) => {
+    event.preventDefault();
+    const selected = boxes().filter((box) => box.checked);
+    if (!selected.length || inFlight) return;
+    const tasks = selected.map((box) => ({task_id: box.dataset.taskId, expected_task_version: Number(box.dataset.taskVersion)}));
+    if (tasks.some((item) => !Number.isSafeInteger(item.expected_task_version) || item.expected_task_version < 1)) { feedback.textContent = "任务版本无效，请刷新后重选。"; return; }
+    frozenPayload = frozenPayload || JSON.stringify({start_key: form.dataset.startKey, tasks});
+    inFlight = true; freezeSelection(true); button.disabled = true; button.textContent = "正在授权…";
+    try { const response = await fetch("/tasks/start-purchases", {method:"POST", headers:{"Content-Type":"application/json", "X-CSRF-Token":form.dataset.csrf}, body:frozenPayload});
+      if (response.ok) { window.location.reload(); return; }
+      if (response.status === 409) { feedback.textContent = "任务已变化，请刷新后重选。"; frozenPayload = null; freezeSelection(false); boxes().forEach((box) => { box.checked = false; }); refresh(); return; }
+      if (response.status === 400 || response.status === 401 || response.status === 403) { feedback.textContent = "请求未被接受，请刷新页面后重试。"; frozenPayload = null; freezeSelection(false); return; }
+      feedback.textContent = "结果暂时不明确，只能使用同一按钮原样重放。";
+    } catch (_) { feedback.textContent = "网络结果不明确，请使用同一按钮原样重试。"; }
+    finally { inFlight = false; button.textContent = "开始采购（只创建待付款订单）"; if (frozenPayload) button.disabled = false; }
+  });
+  refresh();
+})();
+
+(() => {
+  "use strict";
+  const drawer = document.querySelector("[data-detail-drawer]");
+  if (!drawer) return;
+  const body = drawer.querySelector("[data-detail-body]");
+  const closeButton = drawer.querySelector("[data-close-detail]");
+  const rows = [...document.querySelectorAll("[data-task-row]")];
+  const initialURL = window.location.pathname + window.location.search;
+  let focusTrigger = null;
+  let scrollPosition = window.scrollY;
+  let activeRequest = null;
+
+  const isInteractive = (target) => Boolean(target && typeof target.closest === "function" && target.closest("a,button,input,select,textarea,label,[contenteditable=true]"));
+  const showDrawer = () => {
+    if (!drawer.open) drawer.showModal();
+  };
+  const restoreList = () => {
+    if (activeRequest) {
+      activeRequest.abort();
+      activeRequest = null;
+    }
+    if (drawer.open) drawer.close();
+    window.scrollTo({top: scrollPosition, behavior: "auto"});
+    if (focusTrigger && document.contains(focusTrigger)) focusTrigger.focus({preventScroll: true});
+  };
+  const showError = (url, row, requestedFocus, pushHistory) => {
+    body.replaceChildren();
+    const message = document.createElement("p");
+    message.className = "drawer-feedback";
+    message.setAttribute("role", "alert");
+    message.textContent = "任务详情加载失败。请重试，或在完整页打开。";
+    const actions = document.createElement("p");
+    const retry = document.createElement("button");
+    retry.className = "button primary";
+    retry.type = "button";
+    retry.textContent = "重试";
+    retry.addEventListener("click", () => loadDetail(url, row, requestedFocus, pushHistory));
+    const fallback = document.createElement("a");
+    fallback.className = "button";
+    fallback.href = url;
+    fallback.textContent = "在完整页打开";
+    actions.className = "actions";
+    actions.append(retry, fallback);
+    body.append(message, actions);
+  };
+  const loadDetail = async (url, row, requestedFocus, pushHistory) => {
+    if (activeRequest) activeRequest.abort();
+    const requestController = new AbortController();
+    activeRequest = requestController;
+    focusTrigger = requestedFocus || focusTrigger;
+    if (pushHistory) scrollPosition = window.scrollY;
+    body.innerHTML = '<p class="drawer-feedback" role="status">正在加载任务详情…</p>';
+    showDrawer();
+    try {
+      const response = await fetch(url, {headers: {"X-CMBuyer-View": "drawer", "Accept": "text/html"}, credentials: "same-origin", signal: requestController.signal});
+      if (!response.ok || !String(response.headers.get("Content-Type") || "").toLowerCase().startsWith("text/html")) throw new Error("detail request rejected");
+      const fragment = await response.text();
+      if (!fragment.includes("data-task-detail-content")) throw new Error("detail fragment missing");
+      body.innerHTML = fragment;
+      if (pushHistory) window.history.pushState({cmbuyerDrawer: true, detailURL: url, focusTarget: requestedFocus === row ? "row" : "button"}, "", url);
+      closeButton.focus();
+    } catch (error) {
+      if (error.name !== "AbortError") showError(url, row, requestedFocus, pushHistory);
+    } finally {
+      if (activeRequest === requestController) activeRequest = null;
+    }
+  };
+  const requestClose = () => {
+    if (window.history.state && window.history.state.cmbuyerDrawer) window.history.back();
+    else restoreList();
+  };
+
+  window.history.replaceState({cmbuyerList: true, listURL: initialURL}, "", initialURL);
+  rows.forEach((row) => {
+    const url = row.dataset.detailUrl;
+    row.addEventListener("dblclick", (event) => {
+      if (!isInteractive(event.target)) loadDetail(url, row, row, true);
+    });
+    row.addEventListener("keydown", (event) => {
+      if (event.key === "Enter" && event.target === row) {
+        event.preventDefault();
+        loadDetail(url, row, row, true);
+      }
+    });
+    const button = row.querySelector("[data-open-detail]");
+    if (button) button.addEventListener("click", () => loadDetail(url, row, button, true));
+  });
+  closeButton.addEventListener("click", requestClose);
+  drawer.addEventListener("cancel", (event) => {
+    event.preventDefault();
+    requestClose();
+  });
+  window.addEventListener("popstate", (event) => {
+    if (event.state && event.state.cmbuyerDrawer) {
+      const row = rows.find((candidate) => candidate.dataset.detailUrl === event.state.detailURL);
+      if (!row) {
+        restoreList();
+        return;
+      }
+      const requestedFocus = event.state.focusTarget === "button" ? row.querySelector("[data-open-detail]") || row : row;
+      loadDetail(event.state.detailURL, row, requestedFocus, false);
+      return;
+    }
+    restoreList();
+  });
+})();

admin/internal/transport/webui/static/tasks.test.js

@@ -0,0 +1,138 @@
+"use strict";
+
+const test = require("node:test");
+const assert = require("node:assert/strict");
+const fs = require("node:fs");
+const path = require("node:path");
+const vm = require("node:vm");
+
+const source = fs.readFileSync(path.join(__dirname, "tasks.js"), "utf8");
+
+test("successful authorization sends numeric version and reloads", async () => {
+  const requests = [];
+  const harness = createHarness(async (_url, options) => {
+    requests.push(options);
+    return {ok: true, status: 200};
+  });
+
+  await harness.submit();
+
+  assert.equal(requests.length, 1);
+  assert.equal(requests[0].headers["Content-Type"], "application/json");
+  assert.equal(requests[0].headers["X-CSRF-Token"], "csrf-token");
+  const payload = JSON.parse(requests[0].body);
+  assert.equal(payload.start_key, "start-key");
+  assert.equal(typeof payload.tasks[0].expected_task_version, "number");
+  assert.equal(payload.tasks[0].expected_task_version, 7);
+  assert.equal(harness.reloads(), 1);
+});
+
+test("409 clears stale selection and requires a fresh choice", async () => {
+  const harness = createHarness(async () => ({ok: false, status: 409}));
+
+  await harness.submit();
+
+  assert.equal(harness.box.checked, false);
+  assert.equal(harness.box.disabled, false);
+  assert.equal(harness.button.disabled, true);
+  assert.match(harness.feedback.textContent, /任务已变化/);
+});
+
+for (const status of [400, 401, 403]) {
+  test(`${status} releases the frozen payload for a page refresh`, async () => {
+    const harness = createHarness(async () => ({ok: false, status}));
+
+    await harness.submit();
+
+    assert.equal(harness.box.checked, true);
+    assert.equal(harness.box.disabled, false);
+    assert.equal(harness.button.disabled, false);
+    assert.match(harness.feedback.textContent, /刷新页面后重试/);
+  });
+}
+
+test("5xx retries the byte-identical frozen payload", async () => {
+  const bodies = [];
+  const harness = createHarness(async (_url, options) => {
+    bodies.push(options.body);
+    return {ok: false, status: 503};
+  });
+
+  await harness.submit();
+  assert.equal(harness.box.disabled, true);
+  assert.equal(harness.button.disabled, false);
+  assert.match(harness.feedback.textContent, /原样重放/);
+  await harness.submit();
+
+  assert.equal(bodies.length, 2);
+  assert.equal(bodies[1], bodies[0]);
+});
+
+test("network ambiguity retries the same payload and can finish", async () => {
+  const bodies = [];
+  let call = 0;
+  const harness = createHarness(async (_url, options) => {
+    bodies.push(options.body);
+    call++;
+    if (call === 1) throw new Error("network result unknown");
+    return {ok: true, status: 200};
+  });
+
+  await harness.submit();
+  assert.equal(harness.box.disabled, true);
+  assert.match(harness.feedback.textContent, /原样重试/);
+  await harness.submit();
+
+  assert.deepEqual(bodies, [bodies[0], bodies[0]]);
+  assert.equal(harness.reloads(), 1);
+});
+
+function createHarness(fetchImplementation) {
+  class FakeElement {
+    constructor() {
+      this.dataset = {};
+      this.checked = false;
+      this.disabled = false;
+      this.indeterminate = false;
+      this.textContent = "";
+      this.listeners = {};
+    }
+
+    addEventListener(type, listener) {
+      this.listeners[type] = listener;
+    }
+  }
+
+  const box = new FakeElement();
+  box.checked = true;
+  box.dataset = {taskId: "task-id", taskVersion: "7", price: "12.80"};
+  const selectAll = new FakeElement();
+  const summary = new FakeElement();
+  const button = new FakeElement();
+  const feedback = new FakeElement();
+  const form = new FakeElement();
+  form.dataset = {startKey: "start-key", csrf: "csrf-token"};
+  form.querySelector = (selector) => ({
+    "[data-select-all]": selectAll,
+    "[data-selection-summary]": summary,
+    "[data-start-button]": button,
+    "[data-start-feedback]": feedback,
+  })[selector] || null;
+  form.querySelectorAll = (selector) => selector === "input[data-task-id]" ? [box] : [];
+
+  let reloadCount = 0;
+  const context = {
+    document: {querySelector: (selector) => selector === "[data-start-purchases]" ? form : null},
+    fetch: fetchImplementation,
+    window: {location: {reload: () => { reloadCount++; }}},
+  };
+  vm.runInNewContext(source, context, {filename: "tasks.js"});
+
+  return {
+    box,
+    button,
+    feedback,
+    reloads: () => reloadCount,
+    submit: () => form.listeners.submit({preventDefault() {}}),
+  };
+}

admin/internal/transport/webui/templates/login.html

@@ -0,0 +1,63 @@
+{{define "login.html"}}
+<!doctype html>
+<html lang="zh-CN">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>登录 · 采购服务</title>
+  <style>
+    :root { color-scheme: light; --bg:#f4f7fb; --surface:#fff; --text:#172033; --muted:#526079; --border:#cfd8e6; --primary:#155eef; --primary-hover:#0b4ed1; --primary-soft:#eaf1ff; --danger:#b42318; --danger-soft:#fef3f2; --focus:#ffbf47; --shadow:0 12px 30px rgba(23,32,51,.1); font-family:"Segoe UI","Microsoft YaHei UI",system-ui,sans-serif; }
+    * { box-sizing:border-box; }
+    html { min-width:320px; background:var(--bg); }
+    body { min-height:100dvh; margin:0; color:var(--text); background:var(--bg); font-size:16px; line-height:1.55; }
+    button,input { font:inherit; }
+    :focus-visible { outline:3px solid var(--focus); outline-offset:3px; }
+    .skip-link { position:fixed; z-index:10; top:8px; left:8px; padding:10px 14px; color:#fff; background:var(--text); transform:translateY(-160%); }
+    .skip-link:focus { transform:translateY(0); }
+    main { display:grid; min-height:100dvh; place-items:center; padding:24px 16px; }
+    .card { width:min(100%,440px); padding:32px; border:1px solid var(--border); border-radius:14px; background:var(--surface); box-shadow:var(--shadow); }
+    .brand { display:flex; align-items:center; gap:10px; margin:0 0 24px; font-size:1rem; font-weight:700; }
+    .brand-mark { display:grid; width:32px; height:32px; place-items:center; border-radius:8px; color:#fff; background:var(--primary); font-size:.82rem; }
+    h1 { margin:0; font-size:clamp(1.6rem,5vw,2rem); line-height:1.25; }
+    .intro { margin:8px 0 24px; color:var(--muted); }
+    .field { margin-top:16px; }
+    label { display:block; margin-bottom:6px; font-weight:700; }
+    input { width:100%; min-height:44px; padding:10px 12px; border:1px solid #9ba9bc; border-radius:8px; color:var(--text); background:#fff; }
+    input[aria-invalid="true"] { border-color:var(--danger); box-shadow:0 0 0 1px var(--danger); }
+    .hint { margin:5px 0 0; color:var(--muted); font-size:.875rem; }
+    .error { margin:0 0 18px; padding:12px 14px; border-left:4px solid var(--danger); border-radius:6px; color:var(--danger); background:var(--danger-soft); font-weight:650; }
+    .submit { width:100%; min-height:44px; margin-top:24px; padding:10px 16px; border:1px solid transparent; border-radius:8px; color:#fff; background:var(--primary); font-weight:700; cursor:pointer; transition:background-color 180ms ease-out; }
+    .submit:hover { background:var(--primary-hover); }
+    .notice { margin:20px 0 0; padding:12px 14px; border:1px solid #b9cffc; border-radius:8px; color:#29466f; background:var(--primary-soft); font-size:.9rem; }
+    @media (max-width:420px) { main { padding-inline:12px; } .card { padding:24px 16px; } }
+    @media (prefers-reduced-motion:reduce) { *,*::before,*::after { transition-duration:.01ms !important; animation-duration:.01ms !important; } }
+  </style>
+</head>
+<body>
+  <a class="skip-link" href="#main">跳到主要内容</a>
+  <main id="main">
+    <section class="card" aria-labelledby="login-title">
+      <p class="brand"><span class="brand-mark" aria-hidden="true">采</span><span>采购服务</span></p>
+      <h1 id="login-title">管理端登录</h1>
+      <p class="intro">登录后进入采购任务工作台。设备身份不能使用此入口。</p>
+      {{if .Error}}<p class="error" role="alert">{{.Error}}</p>{{end}}
+      <form method="post" action="/login">
+        <input type="hidden" name="csrf_token" value="{{.CSRFToken}}">
+        <input type="hidden" name="return_to" value="{{.ReturnTo}}">
+        <div class="field">
+          <label for="username">账号</label>
+          <input id="username" name="username" type="text" value="{{.Username}}" autocomplete="username" required aria-invalid="{{if .Error}}true{{else}}false{{end}}" aria-describedby="username-hint">
+          <p class="hint" id="username-hint">使用采购管理员账号登录。</p>
+        </div>
+        <div class="field">
+          <label for="password">密码</label>
+          <input id="password" name="password" type="password" autocomplete="current-password" required aria-invalid="{{if .Error}}true{{else}}false{{end}}">
+        </div>
+        <button class="submit" type="submit">登录并继续</button>
+      </form>
+      <p class="notice">系统只创建待付款订单，付款始终由人完成。</p>
+    </section>
+  </main>
+</body>
+</html>
+{{end}}

admin/internal/transport/webui/templates/task-detail.html

@@ -0,0 +1,38 @@
+{{define "task-detail-page.html"}}
+<!doctype html>
+<html lang="zh-CN">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>{{.Detail.Task.Title}} · 任务详情 · 采购服务</title>
+  <style>
+    :root{--bg:#f4f7fb;--surface:#fff;--text:#172033;--muted:#526079;--border:#cfd8e6;--primary:#155eef;--danger:#b42318;--success:#067647;--focus:#ffbf47;font-family:"Segoe UI","Microsoft YaHei UI",system-ui,sans-serif}*{box-sizing:border-box}body{margin:0;color:var(--text);background:var(--bg);font-size:16px;line-height:1.55}a{color:#124cc5;text-underline-offset:3px}:focus-visible{outline:3px solid var(--focus);outline-offset:3px}.skip{position:fixed;z-index:100;top:8px;left:8px;padding:10px;color:#fff;background:#172033;transform:translateY(-160%)}.skip:focus{transform:translateY(0)}.topbar{display:flex;align-items:center;justify-content:space-between;gap:16px;min-height:64px;padding:10px clamp(16px,4vw,40px);border-bottom:1px solid var(--border);background:var(--surface)}.brand{color:var(--text);font-weight:700;text-decoration:none}.brand b{display:inline-grid;place-items:center;width:32px;height:32px;margin-right:8px;border-radius:8px;background:var(--primary);color:#fff;font-size:.82rem}.button{display:inline-flex;align-items:center;justify-content:center;min-height:44px;padding:9px 14px;border:1px solid var(--border);border-radius:8px;color:var(--text);background:#fff;font-weight:700;text-decoration:none}.detail-page{width:min(100% - 32px,1120px);margin:28px auto 48px}.detail-shell{display:grid;gap:16px}.detail-head{display:flex;align-items:flex-start;justify-content:space-between;gap:16px}.detail-head h1{margin:0;font-size:clamp(1.45rem,3vw,2rem)}.detail-head p{margin:4px 0;color:var(--muted)}.status{display:inline-block;padding:4px 10px;border-radius:999px;background:#eaf1ff;color:#173d8f;font-size:.88rem;font-weight:700;white-space:nowrap}.safety{margin:0;padding:13px 15px;border:1px solid #a9c3f7;border-left:5px solid var(--primary);border-radius:10px;background:#edf3ff}.detail-grid{display:grid;grid-template-columns:minmax(0,1fr) minmax(250px,320px);gap:16px}.detail-card{overflow:hidden;border:1px solid var(--border);border-radius:12px;background:var(--surface)}.detail-card>header,.detail-card>.detail-body{padding:16px 18px}.detail-card>header{border-bottom:1px solid var(--border)}.detail-card h2,.detail-card h3{margin:0}.detail-card header p,.empty-note{margin:4px 0 0;color:var(--muted)}.facts{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:10px;margin:0}.facts div{min-width:0;padding:11px;border:1px solid var(--border);border-radius:8px;background:#f8fafc}.facts dt{font-size:.82rem;color:var(--muted);font-weight:700}.facts dd{margin:3px 0 0;overflow-wrap:anywhere;font-weight:650}.audit-list{display:grid;gap:10px;margin:0;padding:0;list-style:none}.audit-list li{padding:12px;border:1px solid var(--border);border-radius:8px}.audit-list p{margin:4px 0}.mono{font-family:Consolas,"SFMono-Regular",monospace;overflow-wrap:anywhere}.evidence-grid{display:grid;grid-template-columns:repeat(auto-fit,minmax(220px,1fr));gap:14px}.evidence{margin:0}.evidence img{display:block;width:100%;height:auto;max-height:520px;object-fit:contain;border:1px solid var(--border);border-radius:8px;background:#eef2f7}.evidence figcaption{margin-top:7px;color:var(--muted);font-size:.85rem}.section-stack{display:grid;gap:16px}.privacy-note{margin:12px 0 0;color:var(--muted);font-size:.88rem}@media(max-width:760px){.detail-grid{grid-template-columns:1fr}.detail-head{display:grid}.facts{grid-template-columns:1fr}}@media(prefers-reduced-motion:reduce){*,*::before,*::after{scroll-behavior:auto!important;transition-duration:.01ms!important;animation-duration:.01ms!important}}
+  </style>
+</head>
+<body>
+  <a class="skip" href="#main">跳到主要内容</a>
+  <header class="topbar"><a class="brand" href="/tasks"><b aria-hidden="true">采</b>采购服务</a><a class="button" href="/tasks">返回任务列表</a></header>
+  <main class="detail-page" id="main">{{template "task-detail-content" .}}</main>
+</body>
+</html>
+{{end}}
+
+{{define "task-detail-content"}}
+<article class="detail-shell" data-task-detail-content data-task-id="{{.Detail.Task.ID}}">
+  <header class="detail-head"><div><h1>{{.Detail.Task.Title}}</h1><p>任务 <span class="mono">{{.Detail.Task.ID}}</span> · 版本 {{.Detail.Task.Version}}</p></div><span class="status">{{statusLabel .Detail.Task.Status}}</span></header>
+  <p class="safety"><strong>{{taskSafetyTitle .Detail.Task.Status}}</strong> {{taskSafetyText .Detail.Task.Status}}</p>
+  <div class="detail-grid">
+    <div class="section-stack">
+      <section class="detail-card" aria-labelledby="task-facts-title"><header><h2 id="task-facts-title">任务要求</h2><p>管理员锁定的采购边界；详情页不会触发设备动作。</p></header><div class="detail-body"><dl class="facts"><div><dt>商品</dt><dd><a href="{{canonicalURL .Detail.Task.GoodsID}}" target="_blank" rel="noopener noreferrer">goods_id {{.Detail.Task.GoodsID}}</a></dd></div><div><dt>目标规格</dt><dd>{{.Detail.Task.SKUColor}} / {{.Detail.Task.SKUSize}}</dd></div><div><dt>数量</dt><dd>{{.Detail.Task.Quantity}} 件</dd></div><div><dt>最高总价</dt><dd>¥{{.Detail.Task.MaxTotalPrice}}</dd></div><div><dt>创建时间（上海）</dt><dd><time datetime="{{shanghaiDateTime .Detail.Task.CreatedAt}}">{{shanghaiTime .Detail.Task.CreatedAt}}</time></dd></div><div><dt>更新时间（上海）</dt><dd><time datetime="{{shanghaiDateTime .Detail.Task.UpdatedAt}}">{{shanghaiTime .Detail.Task.UpdatedAt}}</time></dd></div></dl></div></section>
+
+      <section class="detail-card" aria-labelledby="execution-title"><header><h2 id="execution-title">设备执行事实</h2><p>只展示数据库中已存在的 attempt；T-204 不创建执行记录。</p></header><div class="detail-body">{{if .Detail.Attempts}}<ol class="audit-list">{{range .Detail.Attempts}}<li><h3>Attempt <span class="mono">{{.ID}}</span></h3><p>状态：{{attemptStatusLabel .Status}} · 领取代次 {{.ClaimGeneration}}</p><p>开始：<time datetime="{{shanghaiDateTime .StartedAt}}">{{shanghaiTime .StartedAt}}</time>{{with .FinishedAt}} · 结束：<time datetime="{{shanghaiDateTime .}}">{{shanghaiTime .}}</time>{{end}}</p>{{with .FailureCode}}<p>失败码：<span class="mono">{{.}}</span></p>{{end}}{{if or .Gate1UnitPrice .Gate2UnitPrice .QuantityRead .ConfirmAmount}}<p>已有读数：{{with .Gate1UnitPrice}}闸门一 ¥{{.}}；{{end}}{{with .Gate2UnitPrice}}闸门二 ¥{{.}}；{{end}}{{with .QuantityRead}}数量 {{.}}；{{end}}{{with .ConfirmAmount}}确认页 ¥{{.}}{{end}}</p>{{else}}<p class="empty-note">暂无规格、价格或数量读数。</p>{{end}}</li>{{end}}</ol>{{else}}<p class="empty-note">暂无设备执行记录。</p>{{end}}</div></section>
+
+      <section class="detail-card" aria-labelledby="evidence-title"><header><h2 id="evidence-title">内部截图</h2><p>INTERNAL_RAW 仅供已登录管理员审计，不代表价格闸门通过或人工批准。</p></header><div class="detail-body">{{if .Detail.Evidence}}<div class="evidence-grid">{{range .Detail.Evidence}}<figure class="evidence"><img src="/evidence/{{.ID}}" width="{{.Width}}" height="{{.Height}}" loading="lazy" alt="规格面板内部审计截图，采集于 {{shanghaiTime .CapturedAt}}"><figcaption>{{evidenceKindLabel .Kind}}（<span class="mono">{{.Kind}}</span>）· {{formatBytes .ByteSize}} · <time datetime="{{shanghaiDateTime .CapturedAt}}">{{shanghaiTime .CapturedAt}}</time><br>Attempt <span class="mono">{{.AttemptID}}</span></figcaption></figure>{{end}}</div>{{else}}<p class="empty-note">暂无内部截图。只有已认证设备显式上传的 PNG 会出现在这里。</p>{{end}}<p class="privacy-note">截图可能包含页面已显示的地址或手机号；系统不提取、索引或写入日志。完整 XML、外部支付页和支付凭据不会上传。</p></div></section>
+
+      <section class="detail-card" aria-labelledby="submission-title"><header><h2 id="submission-title">提交围栏与结果</h2><p>只读审计；本页没有重试、再次提交或付款动作。</p></header><div class="detail-body">{{if .Detail.Submissions}}<ol class="audit-list">{{range .Detail.Submissions}}<li><h3>Submission <span class="mono">{{.ID}}</span></h3><p>状态：{{submissionStatusLabel .Status}}</p><p>闸门一 ¥{{.Gate1UnitPrice}}；闸门二 ¥{{.Gate2UnitPrice}}；数量 {{.QuantityRead}}；确认页 ¥{{.ConfirmAmount}}</p><p>建立：<time datetime="{{shanghaiDateTime .CreatedAt}}">{{shanghaiTime .CreatedAt}}</time>{{with .ResolvedAt}} · 调和：<time datetime="{{shanghaiDateTime .}}">{{shanghaiTime .}}</time>{{end}}</p></li>{{end}}</ol>{{else}}<p class="empty-note">尚未建立提交围栏；详情页不会创建或释放围栏。</p>{{end}}</div></section>
+    </div>
+
+    <aside class="section-stack" aria-label="任务状态摘要"><section class="detail-card"><header><h2>开始采购授权</h2><p>锁定任务字段和最高总价，不授权付款。</p></header><div class="detail-body">{{if .Detail.Authorizations}}<ol class="audit-list">{{range .Detail.Authorizations}}<li><h3>{{authorizationStatusLabel .Status}}</h3><p class="mono">{{.ID}}</p><p>任务版本 {{.TaskVersion}} · 上限 ¥{{.TotalPriceCap}}</p><p>授权人：{{.CreatedBy}}</p><p><time datetime="{{shanghaiDateTime .CreatedAt}}">{{shanghaiTime .CreatedAt}}</time> 至 <time datetime="{{shanghaiDateTime .ExpiresAt}}">{{shanghaiTime .ExpiresAt}}</time></p></li>{{end}}</ol>{{else}}<p class="empty-note">尚未开始采购，没有授权记录。</p>{{end}}</div></section><section class="detail-card"><header><h2>固定边界</h2></header><div class="detail-body"><ul><li>系统只创建待付款订单，不自动付款。</li><li>截图仅供审计，不替代实时三道价格闸门。</li><li>围栏后只能调和同一提交，禁止再次点击。</li></ul></div></section></aside>
+  </div>
+</article>
+{{end}}

admin/internal/transport/webui/webui.go

@@ -0,0 +1,162 @@
+// Package webui 渲染采购服务当前可用的服务端页面。
+package webui
+
+import (
+	"embed"
+	"fmt"
+	"html/template"
+	"io"
+	"time"
+
+	"cmbuyer/admin/internal/taskdetail"
+	"cmbuyer/admin/internal/tasks"
+)
+
+//go:embed templates/*.html
+var templateFiles embed.FS
+
+//go:embed static/tasks.js
+var tasksScript []byte
+
+var shanghaiLocation = time.FixedZone("Asia/Shanghai", 8*60*60)
+
+var templates = template.Must(template.New("webui").Funcs(template.FuncMap{
+	"list":                     func(values ...any) []any { return values },
+	"statusLabel":              statusLabel,
+	"shanghaiDateTime":         func(value time.Time) string { return value.In(shanghaiLocation).Format(time.RFC3339) },
+	"shanghaiTime":             func(value time.Time) string { return value.In(shanghaiLocation).Format("2006-01-02 15:04") },
+	"canonicalURL":             tasks.CanonicalURL,
+	"formatBytes":              formatBytes,
+	"taskSafetyTitle":          taskSafetyTitle,
+	"taskSafetyText":           taskSafetyText,
+	"authorizationStatusLabel": authorizationStatusLabel,
+	"attemptStatusLabel":       attemptStatusLabel,
+	"submissionStatusLabel":    submissionStatusLabel,
+	"evidenceKindLabel":        evidenceKindLabel,
+}).ParseFS(templateFiles, "templates/*.html"))
+
+// LoginData 是登录页面所需的非敏感展示数据。
+type LoginData struct {
+	CSRFToken string
+	ReturnTo  string
+	Username  string
+	Error     string
+}
+
+// TasksData 是受保护的建单与任务工作台页面所需数据。
+type TasksData struct {
+	CSRFToken    string
+	Tasks        []tasks.TaskRow
+	Filter       tasks.TaskFilter
+	FilterErrors tasks.Errors
+	HasFilter    bool
+	StartKey     string
+	Form         tasks.Form
+	Errors       tasks.Errors
+	OpenForm     bool
+	FullPage     bool
+	FocusField   string
+	Success      bool
+}
+
+type TaskDetailData struct{ Detail taskdetail.Detail }
+
+// RenderLogin 写入登录页。
+func RenderLogin(writer io.Writer, data LoginData) error {
+	return templates.ExecuteTemplate(writer, "login.html", data)
+}
+
+// RenderTasks 写入登录后的受保护任务页。
+func RenderTasks(writer io.Writer, data TasksData) error {
+	return templates.ExecuteTemplate(writer, "tasks.html", data)
+}
+
+func RenderTaskDetailPage(writer io.Writer, data TaskDetailData) error {
+	return templates.ExecuteTemplate(writer, "task-detail-page.html", data)
+}
+
+func RenderTaskDetailFragment(writer io.Writer, data TaskDetailData) error {
+	return templates.ExecuteTemplate(writer, "task-detail-content", data)
+}
+
+func TasksScript() []byte { return tasksScript }
+
+func statusLabel(status string) string {
+	labels := map[string]string{
+		"DRAFT":                   "待开始",
+		"PENDING":                 "已授权待领取",
+		"CLAIMED":                 "已领取",
+		"ORDERING":                "执行中",
+		"NEEDS_MANUAL":            "待人工处理",
+		"WAITING_PAYMENT":         "待付款",
+		"RECONCILIATION_REQUIRED": "围栏后待调和",
+		"SUCCEEDED":               "已完成",
+		"FAILED":                  "失败",
+		"CANCELED":                "已取消",
+	}
+	if label, ok := labels[status]; ok {
+		return label
+	}
+	return "未知状态"
+}
+
+func taskSafetyTitle(status string) string {
+	if status == "WAITING_PAYMENT" {
+		return "订单已创建，系统尚未付款。"
+	}
+	if status == "RECONCILIATION_REQUIRED" {
+		return "订单可能已创建，只能调和同一提交。"
+	}
+	return "系统只创建待付款订单，不会自动付款。"
+}
+
+func taskSafetyText(status string) string {
+	if status == "DRAFT" {
+		return "创建任务不构成授权；请回到列表勾选后开始采购。"
+	}
+	if status == "RECONCILIATION_REQUIRED" {
+		return "围栏保持占用，禁止重新授权、再次提交或释放。"
+	}
+	return "截图只供内部审计，不替代实时价格闸门，也不会触发设备动作。"
+}
+
+func authorizationStatusLabel(status string) string {
+	labels := map[string]string{"ACTIVE": "授权有效", "CLAIMED": "已被领取", "FENCED": "提交围栏已建立", "CONSUMED": "授权已消费", "EXPIRED": "授权已过期", "ABANDONED": "授权已关闭"}
+	if value, ok := labels[status]; ok {
+		return value
+	}
+	return "未知授权状态"
+}
+
+func attemptStatusLabel(status string) string {
+	labels := map[string]string{"CLAIMED": "已领取", "ORDERING": "执行中", "FAILED": "围栏前失败", "FENCED": "已建立围栏", "ABANDONED": "已安全停止"}
+	if value, ok := labels[status]; ok {
+		return value
+	}
+	return "未知执行状态"
+}
+
+func submissionStatusLabel(status string) string {
+	labels := map[string]string{"FENCED": "围栏已建立", "SUBMITTED": "已创建待付款订单", "RECONCILIATION_REQUIRED": "结果待调和", "MANUAL_RESOLVED": "已人工调和"}
+	if value, ok := labels[status]; ok {
+		return value
+	}
+	return "未知提交状态"
+}
+
+func evidenceKindLabel(kind string) string {
+	if kind == "SKU_PANEL_GATE_1" {
+		return "规格面板 · 闸门一"
+	}
+	return "内部截图"
+}
+
+func formatBytes(value int64) string {
+	if value >= 1<<20 {
+		return fmt.Sprintf("%.1f MiB", float64(value)/(1<<20))
+	}
+	if value >= 1<<10 {
+		return fmt.Sprintf("%.1f KiB", float64(value)/(1<<10))
+	}
+	return fmt.Sprintf("%d B", value)
+}

admin/migrations/00002_single_pass_model.sql

@@ -0,0 +1,333 @@
+-- +goose Up
+-- v1 的试选/锁旧价记录无法安全推断为单趟执行事实。先在同一事务中拒绝它们，
+-- 避免删除审计数据后再尝试猜测映射。
+CREATE TABLE single_pass_upgrade_guard (
+  valid INTEGER NOT NULL CHECK (valid = 1)
+);
+
+INSERT INTO single_pass_upgrade_guard (valid)
+SELECT CASE WHEN
+  (SELECT COUNT(*) FROM spec_trials) = 0
+  AND (SELECT COUNT(*) FROM order_authorizations) = 0
+  AND (SELECT COUNT(*) FROM order_submissions) = 0
+  AND (SELECT COUNT(*) FROM tasks WHERE source <> 'MANUAL' OR status <> 'DRAFT') = 0
+  -- v2 的金额边界是严格正数；不把 v1 中不能无损纳入该边界的数据悄悄改写。
+  AND (SELECT COUNT(*) FROM tasks WHERE
+    max_total_price = ''
+    OR max_total_price GLOB '*[^0-9.]*'
+    OR length(max_total_price) - length(replace(max_total_price, '.', '')) > 1
+    OR max_total_price = '.'
+    OR (instr(max_total_price, '.') > 0 AND (
+      instr(max_total_price, '.') = 1
+      OR length(max_total_price) = instr(max_total_price, '.')
+      OR length(max_total_price) - instr(max_total_price, '.') > 2
+    ))
+    OR replace(replace(max_total_price, '.', ''), '0', '') = ''
+  ) = 0
+THEN 1 ELSE 0 END;
+
+DROP TABLE single_pass_upgrade_guard;
+
+ALTER TABLE tasks RENAME TO tasks_v1;
+DROP TABLE order_submissions;
+DROP TABLE order_authorizations;
+DROP TABLE spec_trials;
+
+CREATE TABLE tasks (
+  id TEXT PRIMARY KEY,
+  source TEXT NOT NULL CHECK (source IN ('MANUAL', 'EXCEL', 'ERP')),
+  source_ref TEXT,
+  title TEXT NOT NULL,
+  goods_id TEXT NOT NULL,
+  sku_color TEXT NOT NULL,
+  sku_size TEXT NOT NULL,
+  quantity INTEGER NOT NULL CHECK (quantity > 0 AND typeof(quantity) = 'integer'),
+  max_total_price TEXT NOT NULL CHECK (
+    max_total_price <> ''
+    AND max_total_price NOT GLOB '*[^0-9.]*'
+    AND length(max_total_price) - length(replace(max_total_price, '.', '')) <= 1
+    AND max_total_price <> '.'
+    AND (instr(max_total_price, '.') = 0 OR (
+      instr(max_total_price, '.') > 1
+      AND length(max_total_price) > instr(max_total_price, '.')
+      AND length(max_total_price) - instr(max_total_price, '.') <= 2
+    ))
+    AND replace(replace(max_total_price, '.', ''), '0', '') <> ''
+  ),
+  reference_asset_id TEXT,
+  status TEXT NOT NULL CHECK (status IN (
+    'DRAFT', 'PENDING', 'CLAIMED', 'ORDERING', 'NEEDS_MANUAL', 'WAITING_PAYMENT',
+    'RECONCILIATION_REQUIRED', 'SUCCEEDED', 'FAILED', 'CANCELED'
+  )),
+  version INTEGER NOT NULL DEFAULT 1 CHECK (version > 0 AND typeof(version) = 'integer'),
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL
+);
+
+INSERT INTO tasks (
+  id, source, source_ref, title, goods_id, sku_color, sku_size, quantity, max_total_price,
+  reference_asset_id, status, version, created_at, updated_at
+)
+SELECT
+  id, source, source_ref, title, goods_id, sku_color, sku_size, quantity, max_total_price,
+  reference_asset_id, status, version, created_at, updated_at
+FROM tasks_v1;
+
+DROP TABLE tasks_v1;
+
+CREATE TABLE order_authorizations (
+  id TEXT PRIMARY KEY,
+  task_id TEXT NOT NULL REFERENCES tasks(id),
+  task_version INTEGER NOT NULL CHECK (task_version > 0 AND typeof(task_version) = 'integer'),
+  start_key TEXT NOT NULL,
+  goods_id TEXT NOT NULL,
+  sku_color TEXT NOT NULL,
+  sku_size TEXT NOT NULL,
+  quantity INTEGER NOT NULL CHECK (quantity > 0 AND typeof(quantity) = 'integer'),
+  total_price_cap TEXT NOT NULL CHECK (
+    total_price_cap <> ''
+    AND total_price_cap NOT GLOB '*[^0-9.]*'
+    AND length(total_price_cap) - length(replace(total_price_cap, '.', '')) <= 1
+    AND total_price_cap <> '.'
+    AND (instr(total_price_cap, '.') = 0 OR (
+      instr(total_price_cap, '.') > 1
+      AND length(total_price_cap) > instr(total_price_cap, '.')
+      AND length(total_price_cap) - instr(total_price_cap, '.') <= 2
+    ))
+    AND replace(replace(total_price_cap, '.', ''), '0', '') <> ''
+  ),
+  status TEXT NOT NULL CHECK (status IN ('ACTIVE', 'CLAIMED', 'FENCED', 'CONSUMED', 'EXPIRED', 'ABANDONED')),
+  created_by TEXT NOT NULL,
+  created_at TEXT NOT NULL,
+  expires_at TEXT NOT NULL,
+  UNIQUE (task_id, task_version),
+  UNIQUE (start_key, task_id),
+  UNIQUE (task_id, id)
+);
+
+CREATE TABLE purchase_attempts (
+  id TEXT PRIMARY KEY,
+  task_id TEXT NOT NULL,
+  authorization_id TEXT NOT NULL,
+  claim_generation INTEGER NOT NULL CHECK (claim_generation > 0 AND typeof(claim_generation) = 'integer'),
+  status TEXT NOT NULL CHECK (status IN ('CLAIMED', 'ORDERING', 'FAILED', 'FENCED', 'ABANDONED')),
+  gate1_unit_price TEXT CHECK (
+    gate1_unit_price IS NULL OR (
+      gate1_unit_price <> ''
+      AND gate1_unit_price NOT GLOB '*[^0-9.]*'
+      AND length(gate1_unit_price) - length(replace(gate1_unit_price, '.', '')) <= 1
+      AND gate1_unit_price <> '.'
+      AND (instr(gate1_unit_price, '.') = 0 OR (
+        instr(gate1_unit_price, '.') > 1
+        AND length(gate1_unit_price) > instr(gate1_unit_price, '.')
+        AND length(gate1_unit_price) - instr(gate1_unit_price, '.') <= 2
+      ))
+      AND replace(replace(gate1_unit_price, '.', ''), '0', '') <> ''
+    )
+  ),
+  gate2_unit_price TEXT CHECK (
+    gate2_unit_price IS NULL OR (
+      gate2_unit_price <> ''
+      AND gate2_unit_price NOT GLOB '*[^0-9.]*'
+      AND length(gate2_unit_price) - length(replace(gate2_unit_price, '.', '')) <= 1
+      AND gate2_unit_price <> '.'
+      AND (instr(gate2_unit_price, '.') = 0 OR (
+        instr(gate2_unit_price, '.') > 1
+        AND length(gate2_unit_price) > instr(gate2_unit_price, '.')
+        AND length(gate2_unit_price) - instr(gate2_unit_price, '.') <= 2
+      ))
+      AND replace(replace(gate2_unit_price, '.', ''), '0', '') <> ''
+    )
+  ),
+  quantity_read INTEGER CHECK (quantity_read IS NULL OR (quantity_read > 0 AND typeof(quantity_read) = 'integer')),
+  confirm_amount TEXT CHECK (
+    confirm_amount IS NULL OR (
+      confirm_amount <> ''
+      AND confirm_amount NOT GLOB '*[^0-9.]*'
+      AND length(confirm_amount) - length(replace(confirm_amount, '.', '')) <= 1
+      AND confirm_amount <> '.'
+      AND (instr(confirm_amount, '.') = 0 OR (
+        instr(confirm_amount, '.') > 1
+        AND length(confirm_amount) > instr(confirm_amount, '.')
+        AND length(confirm_amount) - instr(confirm_amount, '.') <= 2
+      ))
+      AND replace(replace(confirm_amount, '.', ''), '0', '') <> ''
+    )
+  ),
+  failure_code TEXT CHECK (failure_code IS NULL OR failure_code IN (
+    'AUTHORIZATION_EXPIRED', 'LEASE_LOST', 'GATE_1_REJECTED', 'QUANTITY_MISMATCH',
+    'GATE_2_REJECTED', 'GATE_3_REJECTED', 'FENCE_REJECTED', 'SAFE_ABORTED'
+  )),
+  started_at TEXT NOT NULL,
+  finished_at TEXT,
+  UNIQUE (task_id, claim_generation),
+  UNIQUE (task_id, id),
+  UNIQUE (task_id, authorization_id, id),
+  FOREIGN KEY (task_id, authorization_id) REFERENCES order_authorizations(task_id, id)
+);
+
+CREATE TABLE order_submissions (
+  id TEXT PRIMARY KEY,
+  task_id TEXT NOT NULL,
+  authorization_id TEXT NOT NULL,
+  attempt_id TEXT NOT NULL,
+  status TEXT NOT NULL CHECK (status IN ('FENCED', 'SUBMITTED', 'RECONCILIATION_REQUIRED', 'MANUAL_RESOLVED')),
+  gate1_unit_price TEXT NOT NULL CHECK (
+    gate1_unit_price <> ''
+    AND gate1_unit_price NOT GLOB '*[^0-9.]*'
+    AND length(gate1_unit_price) - length(replace(gate1_unit_price, '.', '')) <= 1
+    AND gate1_unit_price <> '.'
+    AND (instr(gate1_unit_price, '.') = 0 OR (
+      instr(gate1_unit_price, '.') > 1
+      AND length(gate1_unit_price) > instr(gate1_unit_price, '.')
+      AND length(gate1_unit_price) - instr(gate1_unit_price, '.') <= 2
+    ))
+    AND replace(replace(gate1_unit_price, '.', ''), '0', '') <> ''
+  ),
+  gate2_unit_price TEXT NOT NULL CHECK (
+    gate2_unit_price <> ''
+    AND gate2_unit_price NOT GLOB '*[^0-9.]*'
+    AND length(gate2_unit_price) - length(replace(gate2_unit_price, '.', '')) <= 1
+    AND gate2_unit_price <> '.'
+    AND (instr(gate2_unit_price, '.') = 0 OR (
+      instr(gate2_unit_price, '.') > 1
+      AND length(gate2_unit_price) > instr(gate2_unit_price, '.')
+      AND length(gate2_unit_price) - instr(gate2_unit_price, '.') <= 2
+    ))
+    AND replace(replace(gate2_unit_price, '.', ''), '0', '') <> ''
+  ),
+  quantity_read INTEGER NOT NULL CHECK (quantity_read > 0 AND typeof(quantity_read) = 'integer'),
+  confirm_amount TEXT NOT NULL CHECK (
+    confirm_amount <> ''
+    AND confirm_amount NOT GLOB '*[^0-9.]*'
+    AND length(confirm_amount) - length(replace(confirm_amount, '.', '')) <= 1
+    AND confirm_amount <> '.'
+    AND (instr(confirm_amount, '.') = 0 OR (
+      instr(confirm_amount, '.') > 1
+      AND length(confirm_amount) > instr(confirm_amount, '.')
+      AND length(confirm_amount) - instr(confirm_amount, '.') <= 2
+    ))
+    AND replace(replace(confirm_amount, '.', ''), '0', '') <> ''
+  ),
+  created_at TEXT NOT NULL,
+  resolved_at TEXT,
+  UNIQUE (authorization_id),
+  UNIQUE (attempt_id),
+  FOREIGN KEY (task_id, authorization_id, attempt_id) REFERENCES purchase_attempts(task_id, authorization_id, id)
+);
+
+-- +goose Down
+-- 只有尚未产生任何单趟授权或执行事实的纯 MANUAL/DRAFT 数据才能无损回到 v1。
+CREATE TABLE single_pass_downgrade_guard (
+  valid INTEGER NOT NULL CHECK (valid = 1)
+);
+
+INSERT INTO single_pass_downgrade_guard (valid)
+SELECT CASE WHEN
+  (SELECT COUNT(*) FROM order_authorizations) = 0
+  AND (SELECT COUNT(*) FROM purchase_attempts) = 0
+  AND (SELECT COUNT(*) FROM order_submissions) = 0
+  AND (SELECT COUNT(*) FROM tasks WHERE source <> 'MANUAL' OR status <> 'DRAFT') = 0
+THEN 1 ELSE 0 END;
+
+DROP TABLE single_pass_downgrade_guard;
+
+ALTER TABLE tasks RENAME TO tasks_v2;
+DROP TABLE order_submissions;
+DROP TABLE purchase_attempts;
+DROP TABLE order_authorizations;
+
+CREATE TABLE tasks (
+  id TEXT PRIMARY KEY,
+  source TEXT NOT NULL CHECK (source IN ('MANUAL', 'EXCEL', 'ERP')),
+  source_ref TEXT,
+  title TEXT NOT NULL,
+  goods_id TEXT NOT NULL,
+  sku_color TEXT NOT NULL,
+  sku_size TEXT NOT NULL,
+  quantity INTEGER NOT NULL CHECK (quantity > 0 AND typeof(quantity) = 'integer'),
+  max_total_price TEXT NOT NULL CHECK (
+    max_total_price <> ''
+    AND max_total_price NOT GLOB '*[^0-9.]*'
+    AND length(max_total_price) - length(replace(max_total_price, '.', '')) <= 1
+    AND max_total_price <> '.'
+    AND (instr(max_total_price, '.') = 0 OR (
+      instr(max_total_price, '.') > 1
+      AND length(max_total_price) > instr(max_total_price, '.')
+      AND length(max_total_price) - instr(max_total_price, '.') <= 2
+    ))
+  ),
+  reference_asset_id TEXT,
+  status TEXT NOT NULL CHECK (status IN (
+    'DRAFT', 'PENDING', 'CLAIMED', 'RUNNING', 'WAITING_CONFIRMATION',
+    'PENDING_RETRIAL', 'AUTHORIZED', 'ORDERING', 'WAITING_PAYMENT',
+    'RECONCILIATION_REQUIRED', 'NEEDS_MANUAL', 'SUCCEEDED', 'CANCELED'
+  )),
+  version INTEGER NOT NULL DEFAULT 1 CHECK (version > 0 AND typeof(version) = 'integer'),
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL
+);
+
+INSERT INTO tasks (
+  id, source, source_ref, title, goods_id, sku_color, sku_size, quantity, max_total_price,
+  reference_asset_id, status, version, created_at, updated_at
+)
+SELECT
+  id, source, source_ref, title, goods_id, sku_color, sku_size, quantity, max_total_price,
+  reference_asset_id, status, version, created_at, updated_at
+FROM tasks_v2;
+
+DROP TABLE tasks_v2;
+
+CREATE TABLE spec_trials (
+  id TEXT PRIMARY KEY,
+  task_id TEXT NOT NULL REFERENCES tasks(id),
+  attempt INTEGER NOT NULL CHECK (attempt > 0 AND typeof(attempt) = 'integer'),
+  product_title TEXT NOT NULL,
+  selected_color TEXT NOT NULL,
+  selected_size TEXT NOT NULL,
+  unit_price TEXT NOT NULL CHECK (unit_price <> '' AND unit_price NOT GLOB '*[^0-9.]*' AND length(unit_price) - length(replace(unit_price, '.', '')) <= 1 AND unit_price <> '.' AND (instr(unit_price, '.') = 0 OR (instr(unit_price, '.') > 1 AND length(unit_price) > instr(unit_price, '.') AND length(unit_price) - instr(unit_price, '.') <= 2))),
+  total_price TEXT NOT NULL CHECK (total_price <> '' AND total_price NOT GLOB '*[^0-9.]*' AND length(total_price) - length(replace(total_price, '.', '')) <= 1 AND total_price <> '.' AND (instr(total_price, '.') = 0 OR (instr(total_price, '.') > 1 AND length(total_price) > instr(total_price, '.') AND length(total_price) - instr(total_price, '.') <= 2))),
+  evidence_sha256 TEXT NOT NULL,
+  created_at TEXT NOT NULL,
+  UNIQUE (task_id, attempt),
+  UNIQUE (task_id, id)
+);
+
+CREATE TABLE order_authorizations (
+  id TEXT PRIMARY KEY,
+  task_id TEXT NOT NULL REFERENCES tasks(id),
+  spec_trial_id TEXT NOT NULL REFERENCES spec_trials(id),
+  version INTEGER NOT NULL CHECK (version > 0 AND typeof(version) = 'integer'),
+  goods_id TEXT NOT NULL,
+  sku_color TEXT NOT NULL,
+  sku_size TEXT NOT NULL,
+  quantity INTEGER NOT NULL CHECK (quantity > 0 AND typeof(quantity) = 'integer'),
+  authorized_unit_price TEXT NOT NULL CHECK (authorized_unit_price <> '' AND authorized_unit_price NOT GLOB '*[^0-9.]*' AND length(authorized_unit_price) - length(replace(authorized_unit_price, '.', '')) <= 1 AND authorized_unit_price <> '.' AND (instr(authorized_unit_price, '.') = 0 OR (instr(authorized_unit_price, '.') > 1 AND length(authorized_unit_price) > instr(authorized_unit_price, '.') AND length(authorized_unit_price) - instr(authorized_unit_price, '.') <= 2))),
+  total_price_cap TEXT NOT NULL CHECK (total_price_cap <> '' AND total_price_cap NOT GLOB '*[^0-9.]*' AND length(total_price_cap) - length(replace(total_price_cap, '.', '')) <= 1 AND total_price_cap <> '.' AND (instr(total_price_cap, '.') = 0 OR (instr(total_price_cap, '.') > 1 AND length(total_price_cap) > instr(total_price_cap, '.') AND length(total_price_cap) - instr(total_price_cap, '.') <= 2))),
+  note TEXT,
+  status TEXT NOT NULL CHECK (status IN ('PENDING_DELIVERY', 'DELIVERED', 'ACKNOWLEDGED', 'EXECUTING', 'FENCED', 'CONSUMED', 'SUPERSEDED', 'EXPIRED')),
+  created_by TEXT NOT NULL,
+  created_at TEXT NOT NULL,
+  expires_at TEXT NOT NULL,
+  UNIQUE (task_id, version),
+  UNIQUE (task_id, id),
+  FOREIGN KEY (task_id, spec_trial_id) REFERENCES spec_trials(task_id, id)
+);
+
+CREATE TABLE order_submissions (
+  id TEXT PRIMARY KEY,
+  task_id TEXT NOT NULL REFERENCES tasks(id),
+  authorization_id TEXT NOT NULL REFERENCES order_authorizations(id),
+  command_id TEXT NOT NULL,
+  dry_run_id TEXT NOT NULL,
+  status TEXT NOT NULL CHECK (status IN ('FENCED', 'SUBMITTED', 'RECONCILIATION_REQUIRED', 'MANUAL_RESOLVED')),
+  verified_unit_price TEXT NOT NULL CHECK (verified_unit_price <> '' AND verified_unit_price NOT GLOB '*[^0-9.]*' AND length(verified_unit_price) - length(replace(verified_unit_price, '.', '')) <= 1 AND verified_unit_price <> '.' AND (instr(verified_unit_price, '.') = 0 OR (instr(verified_unit_price, '.') > 1 AND length(verified_unit_price) > instr(verified_unit_price, '.') AND length(verified_unit_price) - instr(verified_unit_price, '.') <= 2))),
+  quantity_read INTEGER NOT NULL CHECK (quantity_read > 0 AND typeof(quantity_read) = 'integer'),
+  confirm_page_amount TEXT NOT NULL CHECK (confirm_page_amount <> '' AND confirm_page_amount NOT GLOB '*[^0-9.]*' AND length(confirm_page_amount) - length(replace(confirm_page_amount, '.', '')) <= 1 AND confirm_page_amount <> '.' AND (instr(confirm_page_amount, '.') = 0 OR (instr(confirm_page_amount, '.') > 1 AND length(confirm_page_amount) > instr(confirm_page_amount, '.') AND length(confirm_page_amount) - instr(confirm_page_amount, '.') <= 2))),
+  created_at TEXT NOT NULL,
+  resolved_at TEXT,
+  UNIQUE (authorization_id),
+  UNIQUE (command_id),
+  FOREIGN KEY (task_id, authorization_id) REFERENCES order_authorizations(task_id, id)
+);

admin/migrations/00003_evidence_assets.sql

@@ -0,0 +1,53 @@
+-- +goose Up
+CREATE TABLE evidence_assets (
+  id TEXT PRIMARY KEY,
+  upload_key TEXT NOT NULL,
+  task_id TEXT NOT NULL,
+  attempt_id TEXT NOT NULL,
+  kind TEXT NOT NULL CHECK (kind = 'SKU_PANEL_GATE_1'),
+  privacy_tier TEXT NOT NULL CHECK (privacy_tier = 'INTERNAL_RAW'),
+  sha256 TEXT NOT NULL CHECK (
+    length(sha256) = 64
+    AND sha256 NOT GLOB '*[^0-9a-f]*'
+  ),
+  byte_size INTEGER NOT NULL CHECK (
+    typeof(byte_size) = 'integer'
+    AND byte_size > 0
+    AND byte_size <= 10485760
+  ),
+  content_type TEXT NOT NULL CHECK (content_type = 'image/png'),
+  width_px INTEGER NOT NULL CHECK (
+    typeof(width_px) = 'integer'
+    AND width_px > 0
+    AND width_px <= 8192
+  ),
+  height_px INTEGER NOT NULL CHECK (
+    typeof(height_px) = 'integer'
+    AND height_px > 0
+    AND height_px <= 8192
+  ),
+  storage_key TEXT NOT NULL CHECK (
+    storage_key = substr(sha256, 1, 2) || '/' || sha256 || '.png'
+  ),
+  uploaded_by_device_id TEXT NOT NULL CHECK (trim(uploaded_by_device_id) <> ''),
+  captured_at TEXT NOT NULL CHECK (trim(captured_at) <> ''),
+  created_at TEXT NOT NULL CHECK (trim(created_at) <> ''),
+  CHECK (width_px * height_px <= 16777216),
+  UNIQUE (uploaded_by_device_id, upload_key),
+  FOREIGN KEY (task_id, attempt_id) REFERENCES purchase_attempts(task_id, id)
+);
+
+CREATE INDEX evidence_assets_task_time_idx
+ON evidence_assets (task_id, captured_at, created_at, id);
+
+-- +goose Down
+-- 已写入的内部原图是审计事实，回滚迁移不得静默删除它们。
+CREATE TABLE evidence_downgrade_guard (
+  valid INTEGER NOT NULL CHECK (valid = 1)
+);
+
+INSERT INTO evidence_downgrade_guard (valid)
+SELECT CASE WHEN (SELECT COUNT(*) FROM evidence_assets) = 0 THEN 1 ELSE 0 END;
+
+DROP TABLE evidence_downgrade_guard;
+DROP TABLE evidence_assets;

admin/migrations/00004_device_credentials.sql

@@ -0,0 +1,62 @@
+-- +goose Up
+CREATE TABLE device_credentials (
+  device_id TEXT PRIMARY KEY CHECK (
+    length(device_id) = 36
+    AND substr(device_id, 9, 1) = '-'
+    AND substr(device_id, 14, 1) = '-'
+    AND substr(device_id, 19, 1) = '-'
+    AND substr(device_id, 24, 1) = '-'
+    AND length(replace(device_id, '-', '')) = 32
+    AND replace(device_id, '-', '') NOT GLOB '*[^0-9a-f]*'
+    AND substr(device_id, 15, 1) = '4'
+    AND substr(device_id, 20, 1) IN ('8', '9', 'a', 'b')
+  ),
+  display_name TEXT NOT NULL CHECK (
+    display_name = trim(display_name)
+    AND length(display_name) BETWEEN 1 AND 128
+  ),
+  token_sha256 BLOB NOT NULL UNIQUE CHECK (
+    typeof(token_sha256) = 'blob'
+    AND length(token_sha256) = 32
+  ),
+  status TEXT NOT NULL CHECK (status IN ('ACTIVE', 'REVOKED')),
+  created_at TEXT NOT NULL CHECK (
+    created_at = trim(created_at)
+    AND length(created_at) >= 20
+    AND substr(created_at, 11, 1) = 'T'
+    AND substr(created_at, -1, 1) = 'Z'
+    AND julianday(created_at) IS NOT NULL
+  ),
+  revoked_at TEXT CHECK (
+    revoked_at IS NULL OR (
+      revoked_at = trim(revoked_at)
+      AND length(revoked_at) >= 20
+      AND substr(revoked_at, 11, 1) = 'T'
+      AND substr(revoked_at, -1, 1) = 'Z'
+      AND julianday(revoked_at) IS NOT NULL
+    )
+  ),
+  CHECK (
+    (status = 'ACTIVE' AND revoked_at IS NULL)
+    OR (
+      status = 'REVOKED'
+      AND revoked_at IS NOT NULL
+      AND julianday(revoked_at) >= julianday(created_at)
+    )
+  )
+);
+
+CREATE INDEX device_credentials_status_created_idx
+ON device_credentials (status, created_at, device_id);
+
+-- +goose Down
+-- 已签发凭据是安全配置；回滚不得静默删除并让设备身份审计链消失。
+CREATE TABLE device_credentials_downgrade_guard (
+  valid INTEGER NOT NULL CHECK (valid = 1)
+);
+
+INSERT INTO device_credentials_downgrade_guard (valid)
+SELECT CASE WHEN (SELECT COUNT(*) FROM device_credentials) = 0 THEN 1 ELSE 0 END;
+
+DROP TABLE device_credentials_downgrade_guard;
+DROP TABLE device_credentials;

client/requirements.txt

@@ -1,7 +1,9 @@
 # -*- coding: utf-8 -*-
 # 桌面界面（Qt 官方 Python 绑定）。
 PySide6
-# 后续真机取证会使用；本阶段不导入或连接设备。
+# T-101 基线取证使用；只连接显式 serial，不打开或操作拼多多页面。
 uiautomator2
+# T-101 直接使用当前 ADB server 的已列出设备对象交给 uiautomator2，禁止 WiFi 自动重连。
+adbutils>=2.11,<3
 # 后续截图完整性检查会使用。
 Pillow

client/scripts/capture_device_baseline.py

@@ -0,0 +1,76 @@
+"""采集指定 Android 设备的本地基线证据；不打开或操作拼多多页面。"""
+
+from __future__ import annotations
+
+import argparse
+from pathlib import Path
+import sys
+
+
+CLIENT_ROOT = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(CLIENT_ROOT / "src"))
+
+from cmbuyer_client.device.adb import AdbClient, DeviceConnectionError, SubprocessAdbRunner
+from cmbuyer_client.device.baseline import (
+    BaselineCaptureError,
+    DeviceBaselineCapturer,
+    NoReconnectUiautomatorConnector,
+)
+
+
+def parse_arguments(argv: list[str] | None = None) -> argparse.Namespace:
+    parser = argparse.ArgumentParser(description="采集显式指定 Android 设备的本地基线证据。")
+    parser.add_argument("--serial", required=True, help="ADB device serial；禁止自动选择。")
+    parser.add_argument("--output-dir", required=True, type=Path, help="新建的本地证据目录；不得覆盖已有目录。")
+    parser.add_argument("--timeout", type=float, default=10.0, help="ADB、uiautomator2 RPC 与 ADB socket 超时（秒）。")
+    parser.add_argument("--adb", default="adb", help="adb 可执行文件路径。")
+    return parser.parse_args(argv)
+
+
+def validate_arguments(arguments: argparse.Namespace) -> None:
+    """在导入设备库前拒绝危险或无效输入，便于离线测试。"""
+
+    if not arguments.serial.strip():
+        raise ValueError("必须显式提供非空 --serial。")
+    if arguments.timeout <= 0:
+        raise ValueError("--timeout 必须大于 0。")
+
+
+def main(argv: list[str] | None = None) -> int:
+    arguments = parse_arguments(argv)
+    try:
+        validate_arguments(arguments)
+    except ValueError as error:
+        print(f"失败：{error}", file=sys.stderr)
+        return 2
+
+    try:
+        import adbutils
+        import uiautomator2 as u2
+    except ImportError:
+        print("失败：缺少 uiautomator2；请在采购工具虚拟环境中运行。", file=sys.stderr)
+        return 2
+
+    client = AdbClient(SubprocessAdbRunner(arguments.adb), timeout_seconds=arguments.timeout)
+    connector = NoReconnectUiautomatorConnector(
+        adbutils.AdbClient(socket_timeout=arguments.timeout).device_list,
+        u2.connect,
+    )
+    capturer = DeviceBaselineCapturer(client, connector, timeout_seconds=arguments.timeout)
+    try:
+        result = capturer.capture(arguments.serial, arguments.output_dir)
+    except (DeviceConnectionError, BaselineCaptureError) as error:
+        # 错误类型只表达状态，不打印 ADB 输出、serial、XML 或页面正文。
+        print(f"基线取证失败：{error}", file=sys.stderr)
+        return 1
+    except OSError:
+        print("基线取证失败：无法创建或发布本地证据目录。", file=sys.stderr)
+        return 1
+
+    print(f"基线取证完成：{result.output_directory}")
+    print(f"manifest：{result.manifest_path}")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

client/scripts/capture_product_open.py

@@ -0,0 +1,75 @@
+"""打开已验证的拼多多商品直链并采集只读本地证据。"""
+
+from __future__ import annotations
+
+import argparse
+from pathlib import Path
+import sys
+
+
+CLIENT_ROOT = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(CLIENT_ROOT / "src"))
+
+from cmbuyer_client.device.adb import AdbClient, DeviceConnectionError, SubprocessAdbRunner
+from cmbuyer_client.device.baseline import NoReconnectUiautomatorConnector
+from cmbuyer_client.pdd.product_open import ProductOpenCapturer, ProductOpenError
+from cmbuyer_client.pdd.product_url import ProductUrlError, parse_product_url
+
+
+def parse_arguments(argv: list[str] | None = None) -> argparse.Namespace:
+    parser = argparse.ArgumentParser(description="打开 canonical 拼多多商品链接并采集只读证据。")
+    parser.add_argument("--serial", required=True, help="ADB device serial；禁止自动选择。")
+    parser.add_argument("--url", required=True, help="唯一允许的 goods.html?goods_id= 直链。")
+    parser.add_argument("--output-dir", required=True, type=Path, help="新建的本地证据目录；不得覆盖已有目录。")
+    parser.add_argument("--timeout", type=float, default=10.0, help="ADB 和只读 RPC 超时（秒）。")
+    parser.add_argument("--adb", default="adb", help="adb 可执行文件路径。")
+    return parser.parse_args(argv)
+
+
+def validate_arguments(arguments: argparse.Namespace) -> None:
+    if not arguments.serial.strip():
+        raise ValueError("必须显式提供非空 --serial。")
+    if arguments.timeout <= 0:
+        raise ValueError("--timeout 必须大于 0。")
+    parse_product_url(arguments.url)
+
+
+def main(argv: list[str] | None = None) -> int:
+    arguments = parse_arguments(argv)
+    try:
+        validate_arguments(arguments)
+        link = parse_product_url(arguments.url)
+    except (ValueError, ProductUrlError) as error:
+        print(f"失败：{error}", file=sys.stderr)
+        return 2
+
+    try:
+        import adbutils
+        import uiautomator2 as u2
+    except ImportError:
+        print("失败：缺少 uiautomator2；请在采购工具虚拟环境中运行。", file=sys.stderr)
+        return 2
+
+    client = AdbClient(SubprocessAdbRunner(arguments.adb), timeout_seconds=arguments.timeout)
+    connector = NoReconnectUiautomatorConnector(
+        adbutils.AdbClient(socket_timeout=arguments.timeout).device_list,
+        u2.connect,
+    )
+    capturer = ProductOpenCapturer(client, connector, timeout_seconds=arguments.timeout)
+    try:
+        result = capturer.open_and_capture(arguments.serial, link.canonical_url, arguments.output_dir)
+    except (DeviceConnectionError, ProductOpenError) as error:
+        # 不打印 ADB 输出、serial、Activity、XML 或页面正文。
+        print(f"商品打开取证失败：{error}", file=sys.stderr)
+        return 1
+    except OSError:
+        print("商品打开取证失败：无法创建或发布本地证据目录。", file=sys.stderr)
+        return 1
+
+    print(f"商品打开取证完成：{result.output_directory}")
+    print(f"manifest：{result.manifest_path}")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

client/scripts/capture_sku_panel_spike.py

@@ -0,0 +1,103 @@
+"""采集人工已停在规格面板的三种状态证据；不执行任何页面操作。"""
+
+from __future__ import annotations
+
+import argparse
+from math import isfinite
+from pathlib import Path
+import sys
+
+
+CLIENT_ROOT = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(CLIENT_ROOT / "src"))
+
+from cmbuyer_client.device.adb import AdbClient, DeviceConnectionError, SubprocessAdbRunner
+from cmbuyer_client.device.baseline import NoReconnectUiautomatorConnector
+from cmbuyer_client.pdd.product_url import ProductUrl, ProductUrlError, parse_product_url
+from cmbuyer_client.pdd.sku_panel_spike import (
+    HUMAN_DECLARED_STATES,
+    SkuPanelEvidenceCapturer,
+    SkuPanelEvidenceError,
+)
+
+
+def parse_arguments(argv: list[str] | None = None) -> argparse.Namespace:
+    parser = argparse.ArgumentParser(description="采集人工已打开的拼多多规格面板状态证据。")
+    parser.add_argument("--serial", required=True, help="ADB device serial；禁止自动选择。")
+    product_source = parser.add_mutually_exclusive_group(required=True)
+    product_source.add_argument("--url", help="唯一 canonical goods.html?goods_id= 直链。")
+    product_source.add_argument("--goods-id", help="纯数字商品标识；仅用于记录证据归属。")
+    parser.add_argument("--state", required=True, choices=sorted(HUMAN_DECLARED_STATES), help="人工声明的面板状态。")
+    parser.add_argument("--output-dir", required=True, type=Path, help="新建的本地证据目录；不得覆盖已有目录。")
+    parser.add_argument("--timeout", type=float, default=10.0, help="ADB 和只读 RPC 超时（秒）。")
+    parser.add_argument("--adb", default="adb", help="adb 可执行文件路径。")
+    return parser.parse_args(argv)
+
+
+def resolve_product_url(arguments: argparse.Namespace) -> ProductUrl:
+    if isinstance(arguments.url, str):
+        return parse_product_url(arguments.url)
+    if isinstance(arguments.goods_id, str):
+        # 仅使用严格 parser 重新验证并构建，不把输入交给 ADB 或页面。
+        return parse_product_url(f"https://mobile.yangkeduo.com/goods.html?goods_id={arguments.goods_id}")
+    raise ValueError("必须提供 --url 或 --goods-id。")
+
+
+def validate_arguments(arguments: argparse.Namespace) -> ProductUrl:
+    if not isinstance(arguments.serial, str) or not arguments.serial.strip():
+        raise ValueError("必须显式提供非空 --serial。")
+    if (
+        not isinstance(arguments.timeout, (int, float))
+        or isinstance(arguments.timeout, bool)
+        or arguments.timeout <= 0
+        or not isfinite(arguments.timeout)
+    ):
+        raise ValueError("--timeout 必须是大于 0 的有限数值。")
+    if arguments.state not in HUMAN_DECLARED_STATES:
+        raise ValueError("--state 必须是允许的人工声明状态。")
+    return resolve_product_url(arguments)
+
+
+def main(argv: list[str] | None = None) -> int:
+    arguments = parse_arguments(argv)
+    try:
+        link = validate_arguments(arguments)
+    except (ValueError, ProductUrlError) as error:
+        print(f"失败：{error}", file=sys.stderr)
+        return 2
+
+    try:
+        import adbutils
+        import uiautomator2 as u2
+    except ImportError:
+        print("失败：缺少 uiautomator2；请在采购工具虚拟环境中运行。", file=sys.stderr)
+        return 2
+
+    client = AdbClient(SubprocessAdbRunner(arguments.adb), timeout_seconds=arguments.timeout)
+    connector = NoReconnectUiautomatorConnector(
+        adbutils.AdbClient(socket_timeout=arguments.timeout).device_list,
+        u2.connect,
+    )
+    capturer = SkuPanelEvidenceCapturer(client, connector, timeout_seconds=arguments.timeout)
+    try:
+        result = capturer.capture(
+            arguments.serial,
+            link.canonical_url,
+            arguments.state,
+            arguments.output_dir,
+        )
+    except (DeviceConnectionError, SkuPanelEvidenceError) as error:
+        # 不打印 ADB 输出、serial、Activity、XML 或页面正文。
+        print(f"规格面板证据采集失败：{error}", file=sys.stderr)
+        return 1
+    except OSError:
+        print("规格面板证据采集失败：无法创建或发布本地证据目录。", file=sys.stderr)
+        return 1
+
+    print(f"规格面板证据采集完成：{result.output_directory}")
+    print(f"manifest：{result.manifest_path}")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

client/scripts/run_t103_sku_selection.py

@@ -0,0 +1,84 @@
+"""恢复 T-103 已取证目标规格、验证现价并保存本地原始截图。"""
+
+from __future__ import annotations
+
+import argparse
+from math import isfinite
+from pathlib import Path
+import sys
+
+
+CLIENT_ROOT = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(CLIENT_ROOT / "src"))
+
+from cmbuyer_client.device.adb import AdbClient, DeviceConnectionError, SubprocessAdbRunner
+from cmbuyer_client.device.baseline import NoReconnectUiautomatorConnector
+from cmbuyer_client.pdd.product_url import ProductUrlError, parse_product_url
+from cmbuyer_client.pdd.sku_selection import EXPECTED_GOODS_ID, SkuSelectionError, TASK_TO_UI_SELECTION
+from cmbuyer_client.pdd.sku_selection_runner import SkuSelectionRunError, SkuSelectionRunner
+
+
+def parse_arguments(argv: list[str] | None = None) -> argparse.Namespace:
+    parser = argparse.ArgumentParser(description="恢复 T-103 已取证规格并保存本地原始截图。")
+    parser.add_argument("--serial", required=True, help="ADB device serial；禁止自动选择。")
+    parser.add_argument("--url", required=True, help="唯一 canonical goods.html?goods_id= 直链。")
+    parser.add_argument("--color", required=True, help="T-103 任务颜色值。")
+    parser.add_argument("--size", required=True, help="T-103 任务尺码值。")
+    parser.add_argument("--output-dir", required=True, type=Path, help="新建本地目录；不得覆盖已有目录。")
+    parser.add_argument("--timeout", type=float, default=10.0, help="ADB 与设备 RPC 超时（秒）。")
+    parser.add_argument("--adb", default="adb", help="adb 可执行文件路径。")
+    return parser.parse_args(argv)
+
+
+def validate_arguments(arguments: argparse.Namespace) -> None:
+    if not isinstance(arguments.serial, str) or not arguments.serial.strip():
+        raise ValueError("必须显式提供非空 --serial。")
+    if not isinstance(arguments.timeout, (int, float)) or isinstance(arguments.timeout, bool) or arguments.timeout <= 0 or not isfinite(arguments.timeout):
+        raise ValueError("--timeout 必须是大于 0 的有限数值。")
+    link = parse_product_url(arguments.url)
+    if link.goods_id != EXPECTED_GOODS_ID:
+        raise ValueError("--url 不是 T-103 已取证商品。")
+    if (arguments.color, arguments.size) not in TASK_TO_UI_SELECTION:
+        raise ValueError("--color 与 --size 必须是 T-103 已取证任务值。")
+
+
+def main(argv: list[str] | None = None) -> int:
+    arguments = parse_arguments(argv)
+    try:
+        validate_arguments(arguments)
+    except (ValueError, ProductUrlError) as error:
+        print(f"失败：{error}", file=sys.stderr)
+        return 2
+
+    try:
+        import adbutils
+        import uiautomator2 as u2
+    except ImportError:
+        print("失败：缺少 uiautomator2；请在采购工具虚拟环境中运行。", file=sys.stderr)
+        return 2
+
+    runner = SkuSelectionRunner(
+        AdbClient(SubprocessAdbRunner(arguments.adb), timeout_seconds=arguments.timeout),
+        NoReconnectUiautomatorConnector(adbutils.AdbClient(socket_timeout=arguments.timeout).device_list, u2.connect),
+        timeout_seconds=arguments.timeout,
+    )
+    try:
+        result = runner.run(arguments.serial, arguments.url, arguments.color, arguments.size, arguments.output_dir)
+    except (DeviceConnectionError, SkuSelectionRunError, SkuSelectionError) as error:
+        # Flow 可能来自测试替身或未来实现；CLI 不回显任何异常正文，避免泄露节点树或页面文本。
+        print("规格恢复失败：已停止，未发布本地证据目录。", file=sys.stderr)
+        return 1
+    except OSError:
+        print("规格恢复失败：无法创建或发布本地证据目录。", file=sys.stderr)
+        return 1
+
+    print(f"规格恢复完成：{result.output_directory}")
+    print(f"manifest：{result.manifest_path}")
+    print(f"目标规格：{arguments.color} / {arguments.size}")
+    print(f"确认单价：{result.unit_price}")
+    print("页面对应性：请人工核对本地原始截图。")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

client/scripts/sanitize_sku_panel_evidence.py

@@ -0,0 +1,41 @@
+"""本机脱敏 T-103 raw 证据到同级 derived；不连接设备或解析页面语义。"""
+
+from __future__ import annotations
+
+import argparse
+from pathlib import Path
+import sys
+
+
+CLIENT_ROOT = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(CLIENT_ROOT / "src"))
+
+from cmbuyer_client.device.sku_evidence_sanitizer import (
+    SkuEvidenceSanitizationError,
+    sanitize_sku_panel_evidence,
+)
+
+
+def parse_arguments(argv: list[str] | None = None) -> argparse.Namespace:
+    parser = argparse.ArgumentParser(description="将本机 raw 规格面板证据确定性脱敏到同级 derived。")
+    parser.add_argument("--raw-dir", required=True, type=Path, help="仅允许名为 raw 的本机原始证据目录。")
+    parser.add_argument("--output-dir", required=True, type=Path, help="仅允许 raw 同级且名为 derived 的新目录。")
+    return parser.parse_args(argv)
+
+
+def main(argv: list[str] | None = None) -> int:
+    arguments = parse_arguments(argv)
+    try:
+        result = sanitize_sku_panel_evidence(arguments.raw_dir, arguments.output_dir)
+    except SkuEvidenceSanitizationError as error:
+        # 错误不回显 raw 路径、manifest/XML、地址、手机号或 serial。
+        print(f"证据脱敏失败：{error}", file=sys.stderr)
+        return 1
+
+    print(f"派生证据脱敏完成：{result.output_directory}")
+    print(f"manifest：{result.manifest_path}")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

client/src/cmbuyer_client/device/__init__.py

@@ -0,0 +1,15 @@
+"""设备连接与基线取证边界。
+
+本包只提供显式设备选择、非敏感身份核验和本地基线采集；不包含任何采购页面或订单操作。
+"""
+
+from .adb import AdbClient, AdbDevice, CommandResult
+from .baseline import BaselineCaptureResult, DeviceBaselineCapturer
+
+__all__ = [
+    "AdbClient",
+    "AdbDevice",
+    "BaselineCaptureResult",
+    "CommandResult",
+    "DeviceBaselineCapturer",
+]

client/src/cmbuyer_client/device/adb.py

@@ -0,0 +1,282 @@
+"""ADB 设备清单与物理设备冲突的 fail-closed 边界。"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+from pathlib import Path
+import subprocess
+from typing import Protocol, Sequence
+
+
+class DeviceConnectionError(RuntimeError):
+    """显式设备连接边界的基础错误，不携带命令输出或设备敏感内容。"""
+
+
+class SerialRequiredError(DeviceConnectionError):
+    """调用方没有明确指定设备 serial。"""
+
+
+class DeviceNotFoundError(DeviceConnectionError):
+    """指定 serial 不在 ADB 当前清单中。"""
+
+
+class DeviceOfflineError(DeviceConnectionError):
+    """指定设备处于 offline 状态。"""
+
+
+class DeviceUnauthorizedError(DeviceConnectionError):
+    """指定设备尚未授权此电脑。"""
+
+
+class DeviceStateError(DeviceConnectionError):
+    """指定设备处于其他不可用状态。"""
+
+
+class DeviceCommandTimeoutError(DeviceConnectionError):
+    """ADB 命令超过调用方指定的超时。"""
+
+
+class DeviceCommandError(DeviceConnectionError):
+    """ADB 命令失败；错误文本刻意不回显设备输出。"""
+
+
+class DeviceIdentityUnconfirmedError(DeviceConnectionError):
+    """多条在线通道无法完成同机身份判断，必须由人处理。"""
+
+
+class DuplicatePhysicalDeviceError(DeviceConnectionError):
+    """同一物理手机通过多个 ADB 通道同时在线。"""
+
+
+class IntentLaunchUnconfirmedError(DeviceConnectionError):
+    """`am start -W` 没有给出可确认的启动成功结果。"""
+
+
+@dataclass(frozen=True)
+class CommandResult:
+    """可注入命令执行器的最小、可离线构造结果。"""
+
+    stdout: str
+    stderr: str = ""
+    returncode: int = 0
+
+
+@dataclass(frozen=True)
+class IntentLaunchSummary:
+    """不含 Activity、页面内容或 ADB 输出的受限启动摘要。"""
+
+    status: str
+    returncode: int
+
+
+class CommandRunner(Protocol):
+    """运行 ADB 子命令的可替换边界。"""
+
+    def run(self, arguments: Sequence[str], timeout_seconds: float) -> CommandResult:
+        """运行参数，不得通过 shell 拼接。"""
+
+
+class SubprocessAdbRunner:
+    """使用 subprocess 的生产执行器，所有调用必须带超时。"""
+
+    def __init__(self, executable: str | Path = "adb") -> None:
+        self._executable = str(executable)
+
+    def run(self, arguments: Sequence[str], timeout_seconds: float) -> CommandResult:
+        try:
+            completed = subprocess.run(
+                [self._executable, *arguments],
+                check=False,
+                capture_output=True,
+                text=True,
+                encoding="utf-8",
+                errors="replace",
+                timeout=timeout_seconds,
+            )
+        except subprocess.TimeoutExpired as error:
+            raise DeviceCommandTimeoutError("ADB 命令超时，请检查设备连接后由人工重试。") from error
+        except OSError as error:
+            raise DeviceCommandError("无法启动 ADB，请检查 adb 路径与本机工具链。") from error
+
+        return CommandResult(
+            stdout=completed.stdout,
+            stderr=completed.stderr,
+            returncode=completed.returncode,
+        )
+
+
+@dataclass(frozen=True)
+class AdbDevice:
+    """`adb devices -l` 的单行非敏感传输元数据。"""
+
+    serial: str
+    state: str
+    product: str | None = None
+    model: str | None = None
+    device: str | None = None
+
+
+@dataclass(frozen=True)
+class DeviceInspection:
+    """选定通道的只读身份结果，原始硬件标识只在内存中参与比较。"""
+
+    device: AdbDevice
+    model: str
+    android_version: str
+
+
+def parse_adb_devices(output: str) -> list[AdbDevice]:
+    """解析 `adb devices -l`，忽略标题、空行和 adb 附加提示。"""
+
+    devices: list[AdbDevice] = []
+    for raw_line in output.splitlines():
+        line = raw_line.strip()
+        if not line or line.startswith("List of devices attached") or line.startswith("*"):
+            continue
+        fields = line.split()
+        if len(fields) < 2:
+            continue
+        details = {
+            key: value
+            for field in fields[2:]
+            if ":" in field
+            for key, value in [field.split(":", 1)]
+        }
+        devices.append(
+            AdbDevice(
+                serial=fields[0],
+                state=fields[1],
+                product=details.get("product"),
+                model=details.get("model"),
+                device=details.get("device"),
+            )
+        )
+    return devices
+
+
+class AdbClient:
+    """显式 serial 的 ADB 只读查询。
+
+    多个在线通道必须完成硬件身份比对。比对失败时不能用相同 model/product 猜测同一台手机，
+    因为那会把不确定性隐藏成错误的安全结论。
+    """
+
+    def __init__(self, runner: CommandRunner, timeout_seconds: float = 10.0) -> None:
+        if timeout_seconds <= 0:
+            raise ValueError("timeout_seconds 必须大于 0")
+        self._runner = runner
+        self._timeout_seconds = timeout_seconds
+
+    def inspect(self, serial: str) -> DeviceInspection:
+        """确认指定通道在线且不与另一在线通道指向同一物理设备。"""
+
+        selected_serial = _require_serial(serial)
+        devices = self.devices()
+        selected = next((device for device in devices if device.serial == selected_serial), None)
+        if selected is None:
+            raise DeviceNotFoundError("指定设备不在 ADB 清单中，请显式检查 serial。")
+        _raise_for_state(selected.state)
+
+        online_devices = [device for device in devices if device.state == "device"]
+        if len(online_devices) > 1:
+            identities: dict[str, frozenset[str]] = {}
+            for candidate in online_devices:
+                try:
+                    identities[candidate.serial] = self._physical_identity(candidate)
+                except DeviceConnectionError as error:
+                    raise DeviceIdentityUnconfirmedError(
+                        "存在多个在线 ADB 通道且身份无法确认，已拒绝选择设备。"
+                    ) from error
+
+            selected_identity = identities[selected.serial]
+            if any(
+                candidate_serial != selected.serial and selected_identity.intersection(candidate_identity)
+                for candidate_serial, candidate_identity in identities.items()
+            ):
+                raise DuplicatePhysicalDeviceError(
+                    "同一物理手机的多个 ADB 通道同时在线，已拒绝继续；请仅保留一个通道。"
+                )
+
+        model = self._getprop(selected.serial, "ro.product.model") or selected.model or "unknown"
+        android_version = self._getprop(selected.serial, "ro.build.version.release") or "unknown"
+        return DeviceInspection(device=selected, model=model, android_version=android_version)
+
+    def devices(self) -> list[AdbDevice]:
+        """读取并解析 ADB 设备清单。"""
+
+        result = self._run_checked(("devices", "-l"))
+        return parse_adb_devices(result.stdout)
+
+    def start_pdd_view_intent(self, serial: str, goods_id: str) -> IntentLaunchSummary:
+        """以参数数组启动唯一允许的拼多多 ACTION_VIEW Intent。
+
+        这里刻意不提供任意 shell 或任意 package 的执行接口。调用方必须先完成
+        ``inspect`` 和应用版本核验；本方法在本层从纯数字 ``goods_id`` 重建 URL，调用方不能
+        把另一个 URL 直接交给 ADB。本方法既不点击控件，也不解析 Activity 或页面文本。
+        """
+
+        selected_serial = _require_serial(serial)
+        if (
+            not isinstance(goods_id, str)
+            or not goods_id
+            or any(character < "0" or character > "9" for character in goods_id)
+        ):
+            raise ValueError("goods_id 必须是纯数字")
+        canonical_url = f"https://mobile.yangkeduo.com/goods.html?goods_id={goods_id}"
+        result = self._run_checked(
+            (
+                "-s",
+                selected_serial,
+                "shell",
+                "am",
+                "start",
+                "-W",
+                "-a",
+                "android.intent.action.VIEW",
+                "-d",
+                canonical_url,
+                "-p",
+                "com.xunmeng.pinduoduo",
+            )
+        )
+        if not any(line.strip() == "Status: ok" for line in result.stdout.splitlines()):
+            raise IntentLaunchUnconfirmedError("商品链接启动结果无法确认，已停止后续取证。")
+        return IntentLaunchSummary(status="ok", returncode=result.returncode)
+
+    def _physical_identity(self, device: AdbDevice) -> frozenset[str]:
+        serialno = self._getprop(device.serial, "ro.serialno")
+        boot_serialno = self._getprop(device.serial, "ro.boot.serialno")
+        identifiers = frozenset(value for value in (serialno, boot_serialno) if value)
+        if identifiers:
+            return identifiers
+        # model/product/device 只能作为展示元数据，不能证明两台同型号设备是同一物理机。
+        raise DeviceIdentityUnconfirmedError("无法读取设备硬件身份摘要。")
+
+    def _getprop(self, serial: str, property_name: str) -> str:
+        result = self._run_checked(("-s", serial, "shell", "getprop", property_name))
+        return result.stdout.strip()
+
+    def _run_checked(self, arguments: Sequence[str]) -> CommandResult:
+        try:
+            result = self._runner.run(arguments, self._timeout_seconds)
+        except subprocess.TimeoutExpired as error:
+            raise DeviceCommandTimeoutError("ADB 命令超时，请检查设备连接后由人工重试。") from error
+        if result.returncode != 0:
+            raise DeviceCommandError("ADB 命令失败，请检查设备连接或授权状态。")
+        return result
+
+
+def _require_serial(serial: str) -> str:
+    if not isinstance(serial, str) or not serial.strip():
+        raise SerialRequiredError("必须显式提供设备 serial，禁止自动选择设备。")
+    return serial.strip()
+
+
+def _raise_for_state(state: str) -> None:
+    if state == "device":
+        return
+    if state == "offline":
+        raise DeviceOfflineError("指定设备处于 offline 状态。")
+    if state == "unauthorized":
+        raise DeviceUnauthorizedError("指定设备尚未授权此电脑。")
+    raise DeviceStateError("指定设备不处于可用状态。")

client/src/cmbuyer_client/device/baseline.py

@@ -0,0 +1,238 @@
+"""只读设备基线取证，严格限制在元数据、截图和完整节点树。"""
+
+from __future__ import annotations
+
+from collections.abc import Callable
+from dataclasses import dataclass
+from datetime import UTC, datetime
+from hashlib import sha256
+import base64
+import binascii
+from io import BytesIO
+import json
+import os
+from pathlib import Path
+import shutil
+from typing import Any, Protocol
+from uuid import uuid4
+from xml.etree import ElementTree
+
+from adbutils.errors import AdbTimeout
+from PIL import Image, UnidentifiedImageError
+from uiautomator2.exceptions import HTTPTimeoutError
+
+from .adb import AdbClient, DeviceInspection
+
+
+PDD_PACKAGE = "com.xunmeng.pinduoduo"
+SCREENSHOT_PARAMS = [1, 80]
+HIERARCHY_PARAMS = [False, 50]
+_BASE64_ASCII_WHITESPACE = " \t\r\n"
+
+
+class BaselineCaptureError(RuntimeError):
+    """基线取证无法完整落盘时的失败，不会伪造成功产物。"""
+
+
+class BaselineCaptureTimeoutError(BaselineCaptureError):
+    """设备基线取证超时；底层异常文本不向 CLI 或日志泄露。"""
+
+
+class UiAutomatorDevice(Protocol):
+    """本任务唯一需要的 uiautomator2 只读能力。"""
+
+    def app_info(self, package_name: str) -> dict[str, Any]:
+        """读取已安装应用元数据。"""
+
+    def jsonrpc_call(self, method: str, params: Any = None, timeout: float = 10) -> Any:
+        """调用公开 uiautomator2 JSON-RPC 接口。"""
+
+
+class NoReconnectUiautomatorConnector:
+    """只把当前 ADB server 已列出的设备对象交给 uiautomator2。
+
+    uiautomator2 直接接收 IP serial 时会在内部尝试 adb disconnect/connect。这里先从已列出设备中
+    取对象再调用 ``u2.connect(device_object)``，避免连接阶段隐式重连已经掉线的 WiFi 通道。
+    """
+
+    def __init__(self, list_devices: Callable[[], list[Any]], connect: Callable[[Any], UiAutomatorDevice]) -> None:
+        self._list_devices = list_devices
+        self._connect = connect
+
+    def __call__(self, serial: str) -> UiAutomatorDevice:
+        device = next((item for item in self._list_devices() if item.serial == serial), None)
+        if device is None:
+            raise BaselineCaptureError("设备在连接前已从 ADB 清单消失，已拒绝自动重连。")
+        return self._connect(device)
+
+
+@dataclass(frozen=True)
+class BaselineCaptureResult:
+    """已原子发布的基线取证摘要，不包含页面正文或原始 serial。"""
+
+    output_directory: Path
+    manifest_path: Path
+    screenshot_path: Path
+    hierarchy_path: Path
+
+
+class DeviceBaselineCapturer:
+    """以先校验通道、后连接、最后原子发布的顺序采集基线。
+
+    截图和 XML 可能包含页面敏感内容，因此仅落在调用方明确指定的本地目录；manifest 只写
+    哈希、设备非敏感元数据和脱敏后的 serial 摘要，绝不嵌入 XML 或页面文本。
+    """
+
+    def __init__(
+        self,
+        adb_client: AdbClient,
+        connector: Callable[[str], UiAutomatorDevice],
+        timeout_seconds: float,
+    ) -> None:
+        if timeout_seconds <= 0:
+            raise ValueError("timeout_seconds 必须大于 0")
+        self._adb_client = adb_client
+        self._connector = connector
+        self._timeout_seconds = timeout_seconds
+
+    def capture(self, serial: str, output_directory: Path) -> BaselineCaptureResult:
+        """采集完整基线，任何一步失败均不发布 output_directory。"""
+
+        inspection = self._adb_client.inspect(serial)
+        target = Path(output_directory)
+        if target.exists():
+            raise BaselineCaptureError("输出目录已存在；为防止混入旧证据，拒绝覆盖。")
+        if not target.name:
+            raise BaselineCaptureError("输出目录必须是明确的新目录。")
+
+        target.parent.mkdir(parents=True, exist_ok=True)
+        staging = target.parent / f".{target.name}.staging-{uuid4().hex}"
+        staging.mkdir()
+        try:
+            device = self._connector(serial)
+            app_info = device.app_info(PDD_PACKAGE)
+            version = _extract_version(app_info)
+
+            screenshot_path = staging / "screenshot.png"
+            screenshot_base64 = device.jsonrpc_call(
+                "takeScreenshot",
+                SCREENSHOT_PARAMS,
+                timeout=self._timeout_seconds,
+            )
+            _save_base64_screenshot(screenshot_base64, screenshot_path)
+
+            hierarchy = device.jsonrpc_call(
+                "dumpWindowHierarchy",
+                HIERARCHY_PARAMS,
+                timeout=self._timeout_seconds,
+            )
+            _validate_hierarchy(hierarchy)
+            hierarchy_path = staging / "hierarchy.xml"
+            hierarchy_path.write_text(hierarchy, encoding="utf-8")
+
+            manifest_path = staging / "manifest.json"
+            manifest_path.write_text(
+                json.dumps(
+                    _manifest(inspection, serial, version, screenshot_path, hierarchy_path),
+                    ensure_ascii=False,
+                    indent=2,
+                    sort_keys=True,
+                )
+                + "\n",
+                encoding="utf-8",
+            )
+            os.replace(staging, target)
+        except BaselineCaptureError:
+            # 仅删除本次创建、名称带随机标识的暂存目录，绝不触碰调用方原有输出目录。
+            if staging.exists():
+                shutil.rmtree(staging)
+            raise
+        except (AdbTimeout, HTTPTimeoutError, TimeoutError) as error:
+            if staging.exists():
+                shutil.rmtree(staging)
+            raise BaselineCaptureTimeoutError("设备基线取证超时，未发布任何证据产物。") from error
+        except Exception as error:
+            if staging.exists():
+                shutil.rmtree(staging)
+            # uiautomator2/adbutils 可能把 serial、路径或远端响应放入异常文本，不能直接传播到 CLI。
+            raise BaselineCaptureError("设备基线取证未完成，未发布任何证据产物。") from error
+
+        return BaselineCaptureResult(
+            output_directory=target,
+            manifest_path=target / "manifest.json",
+            screenshot_path=target / "screenshot.png",
+            hierarchy_path=target / "hierarchy.xml",
+        )
+
+
+def _extract_version(app_info: dict[str, Any]) -> str:
+    version = app_info.get("versionName") or app_info.get("version_name")
+    if not isinstance(version, str) or not version.strip():
+        raise BaselineCaptureError("无法读取拼多多版本，拒绝发布不完整取证。")
+    return version.strip()
+
+
+def _save_base64_screenshot(value: Any, target: Path) -> None:
+    """规范化常见 ASCII Base64 空白后严格解码；没有 adb screenshot fallback。"""
+
+    if not isinstance(value, str) or not value:
+        raise BaselineCaptureError("截图 RPC 未返回 base64 数据，拒绝发布不完整取证。")
+    try:
+        normalized = value.translate({ord(character): None for character in _BASE64_ASCII_WHITESPACE})
+        raw_image = base64.b64decode(normalized.encode("ascii"), validate=True)
+    except (UnicodeEncodeError, ValueError, binascii.Error) as error:
+        raise BaselineCaptureError("截图 RPC Base64 语法无效，拒绝发布不完整取证。") from error
+    try:
+        with Image.open(BytesIO(raw_image)) as image:
+            image.load()
+            image.save(target, format="PNG")
+    except (UnidentifiedImageError, OSError) as error:
+        raise BaselineCaptureError("截图 RPC 图像数据无效，拒绝发布不完整取证。") from error
+
+
+def _validate_hierarchy(value: Any) -> None:
+    """确认 RPC 返回的是完整节点树，不把原始 XML 放进错误或日志。"""
+
+    if not isinstance(value, str) or not value:
+        raise BaselineCaptureError("节点树导出为空，拒绝发布不完整取证。")
+    try:
+        root = ElementTree.fromstring(value)
+    except ElementTree.ParseError as error:
+        raise BaselineCaptureError("节点树不是有效 XML，拒绝发布不完整取证。") from error
+    if root.tag != "hierarchy":
+        raise BaselineCaptureError("节点树根节点无效，拒绝发布不完整取证。")
+
+
+def _manifest(
+    inspection: DeviceInspection,
+    serial: str,
+    pdd_version: str,
+    screenshot_path: Path,
+    hierarchy_path: Path,
+) -> dict[str, Any]:
+    """只序列化审计摘要；页面内容留在 XML 文件，不进入日志或 manifest。"""
+
+    return {
+        "schema_version": 1,
+        "captured_at": datetime.now(UTC).isoformat(),
+        "channel": "wifi" if ":" in serial else "usb",
+        "serial_sha256": sha256(serial.encode("utf-8")).hexdigest(),
+        "device": {
+            "model": inspection.model,
+            "android_version": inspection.android_version,
+            "pdd_package": PDD_PACKAGE,
+            "pdd_version": pdd_version,
+        },
+        "artifacts": [
+            {"path": screenshot_path.name, "sha256": _sha256_file(screenshot_path)},
+            {"path": hierarchy_path.name, "sha256": _sha256_file(hierarchy_path)},
+        ],
+    }
+
+
+def _sha256_file(path: Path) -> str:
+    digest = sha256()
+    with path.open("rb") as source:
+        for chunk in iter(lambda: source.read(1024 * 1024), b""):
+            digest.update(chunk)
+    return digest.hexdigest()

client/src/cmbuyer_client/device/sku_evidence_sanitizer.py

@@ -0,0 +1,580 @@
+"""T-103 原始规格面板证据的本机确定性隐私脱敏。
+
+此模块只处理人工采集的本地文件：不连接设备、不识别规格；仅可按已取证的固定
+几何和严格格式，将跨隐私边界的价格叶节点投影到派生 XML。
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+from hashlib import sha256
+import json
+from pathlib import Path
+import re
+import shutil
+from typing import Any
+from uuid import uuid4
+from xml.etree import ElementTree
+
+from PIL import Image, ImageDraw, UnidentifiedImageError
+
+from ..pdd.product_url import ProductUrl, ProductUrlError, parse_product_url
+from ..pdd.sku_panel_state import HUMAN_DECLARED_STATES
+
+
+SANITIZER_VERSION = "t103-privacy-v5"
+EXPECTED_GOODS_ID = "937122477375"
+EXPECTED_PDD_VERSION = "8.17.0"
+EXPECTED_DEVICE_MODEL = "PKG110"
+EXPECTED_ANDROID_VERSION = "16"
+EXPECTED_SCREENSHOT_WIDTH = 1080
+EXPECTED_SCREENSHOT_HEIGHT = 2376
+EXPECTED_XML_WIDTH = 1080
+EXPECTED_XML_HEIGHT = 2376
+_ARTIFACT_FILES = ("screenshot.png", "hierarchy.xml")
+_SHA256_RE = re.compile(r"[0-9a-f]{64}\Z")
+_BOUNDS_RE = re.compile(r"\[(-?\d+),(-?\d+)\]\[(-?\d+),(-?\d+)\]\Z")
+_FULL_PHONE_RE = re.compile(r"(?:\+?86)?1[3-9]\d{9}")
+_MASKED_PHONE_RE = re.compile(r"1[3-9]\d\*{4}\d{4}")
+_MASK_TRANSLATION = str.maketrans({"＊": "*", "•": "*", "·": "*", "×": "*", "x": "*", "X": "*"})
+_SEPARATOR_RE = re.compile(r"[\s\-‐‑‒–—―()（）]+")
+# 这两个槽位来自 T-103 当前第一态、1080×2376 XML 坐标的人工审查。它们不是通用
+# 页面判据；坐标、文本或结构任何变化都停止发布，交由人重新取证。
+_CROSSING_PRICE_SLOTS = {
+    (396, 503, 712, 570): "[396,503][712,570]",
+    (730, 503, 895, 570): "[730,503][895,570]",
+}
+_CROSSING_PRICE_BOUNDS = frozenset(_CROSSING_PRICE_SLOTS)
+_PRICE_PROJECTION_ATTRIBUTES = (
+    "bounds",
+    "text",
+    "package",
+    "class",
+    "clickable",
+    "enabled",
+    "visible-to-user",
+)
+# 仅接受普通 ASCII 空格，且每个可分隔位置最多一个；禁止换行、折扣、支付/提交文案和
+# 任何其它字符。前缀捕获组用于区分当前价与至多一个划线/原价候选。
+# T-103 人工在 live 规格面板确认当前价槽的完整非敏感前缀仅为“快卖完”；不得兼容
+# 未取证的“快卖光”或其它相近文案。
+_CROSSING_PRICE_TEXT_RE = re.compile(r" {0,1}(?:(快卖完) {0,1})?[¥￥] {0,1}[1-9]\d*\.\d{2} {0,1}\Z")
+_CROSSING_PRICE_PREFIX_RE = re.compile(r" {0,1}(?:快卖完 {0,1})?[¥￥] {0,1}[1-9]\d*\.\d{2} {0,1}")
+_CROSSING_PRICE_ALLOWED_CHARACTERS = frozenset(" 快卖完¥￥0123456789.")
+
+
+class SkuEvidenceSanitizationError(RuntimeError):
+    """原始证据不能被安全地发布为派生证据。"""
+
+
+@dataclass
+class _CleanupStats:
+    """仅记录节点数量，供派生 manifest 审计；不记录任何页面文本。"""
+
+    removed_nodes: int = 0
+    cleared_crossing_nodes: int = 0
+    preserved_crossing_price_nodes: int = 0
+    retained_below_nodes: int = 0
+    max_right: int = 0
+    max_bottom: int = 0
+    current_price_candidates: int = 0
+    original_price_candidates: int = 0
+
+
+@dataclass(frozen=True)
+class PrivacyMaskConfig:
+    """仅描述已人工确认的隐私几何区域，绝不承担页面或规格判据。"""
+
+    version: str
+    screenshot_width: int
+    screenshot_height: int
+    xml_width: int
+    xml_height: int
+    privacy_top: int
+
+
+PRIVACY_MASK_CONFIG = PrivacyMaskConfig(
+    version=SANITIZER_VERSION,
+    screenshot_width=EXPECTED_SCREENSHOT_WIDTH,
+    screenshot_height=EXPECTED_SCREENSHOT_HEIGHT,
+    xml_width=EXPECTED_XML_WIDTH,
+    xml_height=EXPECTED_XML_HEIGHT,
+    # 主审在原始截图确认 y < 540 为收货/手机号区域；整宽遮罩优先保护隐私而非保留版面。
+    privacy_top=540,
+)
+
+
+@dataclass(frozen=True)
+class SkuEvidenceSanitizationResult:
+    """已经原子发布的派生证据位置。"""
+
+    output_directory: Path
+    manifest_path: Path
+    screenshot_path: Path
+    hierarchy_path: Path
+
+
+def sanitize_sku_panel_evidence(raw_directory: Path, output_directory: Path) -> SkuEvidenceSanitizationResult:
+    """校验 raw 三文件，并发布同级 ``derived`` 的脱敏副本。
+
+    目标已存在时在读取任何输入前拒绝，避免混入旧派生物或覆盖人工保留文件。
+    """
+
+    raw = Path(raw_directory)
+    target = Path(output_directory)
+    _validate_directories(raw, target)
+    if target.exists():
+        raise SkuEvidenceSanitizationError("派生证据目录已存在，拒绝覆盖。")
+
+    staging: Path | None = None
+    try:
+        source_manifest_path = _required_file(raw, "manifest.json")
+        source_screenshot_path = _required_file(raw, "screenshot.png")
+        source_hierarchy_path = _required_file(raw, "hierarchy.xml")
+        manifest = _read_source_manifest(source_manifest_path)
+        link, state, source_hashes = _validate_source_manifest(manifest)
+        _verify_source_hashes(source_screenshot_path, source_hierarchy_path, source_hashes)
+
+        staging = raw.parent / f".derived.staging-{uuid4().hex}"
+        staging.mkdir()
+        derived_screenshot_path = staging / "screenshot.png"
+        _sanitize_screenshot(source_screenshot_path, derived_screenshot_path)
+        derived_hierarchy_path = staging / "hierarchy.xml"
+        cleanup_stats = _sanitize_hierarchy(source_hierarchy_path, derived_hierarchy_path)
+
+        derived_manifest_path = staging / "manifest.json"
+        derived_manifest_path.write_text(
+            json.dumps(
+                _derived_manifest(
+                    manifest,
+                    link,
+                    state,
+                    source_manifest_path,
+                    source_screenshot_path,
+                    source_hierarchy_path,
+                    derived_screenshot_path,
+                    derived_hierarchy_path,
+                    cleanup_stats,
+                ),
+                ensure_ascii=False,
+                indent=2,
+                sort_keys=True,
+            )
+            + "\n",
+            encoding="utf-8",
+        )
+        _publish_staging(staging, target)
+    except SkuEvidenceSanitizationError:
+        _clean_staging(staging)
+        raise
+    except (OSError, ValueError, ElementTree.ParseError, UnidentifiedImageError) as error:
+        _clean_staging(staging)
+        # 原始异常可能含文件路径、JSON/XML 文本或其他敏感内容，不能向 CLI/日志传播。
+        raise SkuEvidenceSanitizationError("原始证据无法安全脱敏，未发布任何派生产物。") from error
+    except Exception as error:
+        _clean_staging(staging)
+        raise SkuEvidenceSanitizationError("原始证据脱敏未完成，未发布任何派生产物。") from error
+
+    return SkuEvidenceSanitizationResult(
+        output_directory=target,
+        manifest_path=target / "manifest.json",
+        screenshot_path=target / "screenshot.png",
+        hierarchy_path=target / "hierarchy.xml",
+    )
+
+
+def _validate_directories(raw: Path, target: Path) -> None:
+    if raw.name != "raw" or not raw.is_dir():
+        raise SkuEvidenceSanitizationError("原始证据目录必须是存在的 raw 目录。")
+    if target.name != "derived" or target.parent != raw.parent:
+        raise SkuEvidenceSanitizationError("派生证据目录必须是 raw 同级的 derived 目录。")
+
+
+def _required_file(raw: Path, filename: str) -> Path:
+    candidate = raw / filename
+    if not candidate.is_file():
+        raise SkuEvidenceSanitizationError("原始证据文件集合不完整。")
+    return candidate
+
+
+def _read_source_manifest(path: Path) -> dict[str, Any]:
+    try:
+        value = json.loads(path.read_text(encoding="utf-8"))
+    except (OSError, UnicodeDecodeError, json.JSONDecodeError) as error:
+        raise SkuEvidenceSanitizationError("原始证据 manifest 无效。") from error
+    if not isinstance(value, dict):
+        raise SkuEvidenceSanitizationError("原始证据 manifest 结构无效。")
+    return value
+
+
+def _validate_source_manifest(manifest: dict[str, Any]) -> tuple[ProductUrl, str, dict[str, str]]:
+    product = manifest.get("product")
+    device = manifest.get("device")
+    state = manifest.get("human_declared_state")
+    if manifest.get("schema_version") != 1 or not isinstance(product, dict) or not isinstance(device, dict):
+        raise SkuEvidenceSanitizationError("原始证据 manifest 缺少必要元数据。")
+    canonical_url = product.get("canonical_url")
+    goods_id = product.get("goods_id")
+    try:
+        link = parse_product_url(canonical_url)
+    except ProductUrlError as error:
+        raise SkuEvidenceSanitizationError("原始证据商品元数据不匹配。") from error
+    if (
+        link.goods_id != EXPECTED_GOODS_ID
+        or goods_id != EXPECTED_GOODS_ID
+        or device.get("model") != EXPECTED_DEVICE_MODEL
+        or device.get("android_version") != EXPECTED_ANDROID_VERSION
+        or device.get("pdd_version") != EXPECTED_PDD_VERSION
+        or device.get("pdd_package") != "com.xunmeng.pinduoduo"
+        or not isinstance(state, str)
+        or state not in HUMAN_DECLARED_STATES
+    ):
+        raise SkuEvidenceSanitizationError("原始证据元数据与脱敏配置不匹配。")
+    return link, state, _artifact_hashes(manifest)
+
+
+def _artifact_hashes(manifest: dict[str, Any]) -> dict[str, str]:
+    artifacts = manifest.get("artifacts")
+    if not isinstance(artifacts, list):
+        raise SkuEvidenceSanitizationError("原始证据 manifest 缺少文件校验信息。")
+    hashes: dict[str, str] = {}
+    for artifact in artifacts:
+        if not isinstance(artifact, dict):
+            raise SkuEvidenceSanitizationError("原始证据 manifest 文件校验信息无效。")
+        path = artifact.get("path")
+        digest = artifact.get("sha256")
+        if path not in _ARTIFACT_FILES or path in hashes or not isinstance(digest, str) or not _SHA256_RE.fullmatch(digest):
+            raise SkuEvidenceSanitizationError("原始证据 manifest 文件校验信息无效。")
+        hashes[path] = digest
+    if set(hashes) != set(_ARTIFACT_FILES):
+        raise SkuEvidenceSanitizationError("原始证据 manifest 文件校验信息不完整。")
+    return hashes
+
+
+def _verify_source_hashes(screenshot_path: Path, hierarchy_path: Path, expected: dict[str, str]) -> None:
+    if (
+        _sha256_file(screenshot_path) != expected["screenshot.png"]
+        or _sha256_file(hierarchy_path) != expected["hierarchy.xml"]
+    ):
+        raise SkuEvidenceSanitizationError("原始证据文件校验失败。")
+
+
+def _sanitize_screenshot(source: Path, target: Path) -> None:
+    try:
+        with Image.open(source) as image:
+            image.load()
+            if image.format != "PNG" or image.size != (
+                PRIVACY_MASK_CONFIG.screenshot_width,
+                PRIVACY_MASK_CONFIG.screenshot_height,
+            ):
+                raise SkuEvidenceSanitizationError("原始截图分辨率或格式与脱敏配置不匹配。")
+            sanitized = image.convert("RGBA")
+    except SkuEvidenceSanitizationError:
+        raise
+    except (OSError, UnidentifiedImageError) as error:
+        raise SkuEvidenceSanitizationError("原始截图无效。") from error
+
+    # 用不透明黑色覆盖 y < 540，保证截图与 XML 使用相同的隐私几何边界。
+    ImageDraw.Draw(sanitized).rectangle(
+        (0, 0, PRIVACY_MASK_CONFIG.screenshot_width - 1, PRIVACY_MASK_CONFIG.privacy_top - 1),
+        fill=(0, 0, 0, 255),
+    )
+    sanitized.save(target, format="PNG", optimize=False, compress_level=9)
+
+
+def _sanitize_hierarchy(source: Path, target: Path) -> _CleanupStats:
+    try:
+        root = ElementTree.parse(source).getroot()
+    except (OSError, ElementTree.ParseError) as error:
+        raise SkuEvidenceSanitizationError("原始节点树无效。") from error
+    if root.tag != "hierarchy":
+        raise SkuEvidenceSanitizationError("原始节点树结构不匹配。")
+    if not list(root):
+        raise SkuEvidenceSanitizationError("原始节点树结构不匹配。")
+    stats = _CleanupStats()
+    _clear_node_text(root)
+    for child in list(root):
+        _sanitize_node(root, child, stats)
+    _require_expected_xml_coordinate_space(stats)
+    if stats.removed_nodes < 1 or stats.retained_below_nodes < 1:
+        raise SkuEvidenceSanitizationError("原始节点树未满足隐私几何结构。")
+    _require_safe_crossing_price_projection(stats)
+    if _contains_phone(root):
+        raise SkuEvidenceSanitizationError("派生节点树仍包含手机号，拒绝发布。")
+    ElementTree.ElementTree(root).write(target, encoding="utf-8", xml_declaration=True)
+    return stats
+
+
+def _sanitize_node(parent: ElementTree.Element, node: ElementTree.Element, stats: _CleanupStats) -> None:
+    if node.tag != "node":
+        raise SkuEvidenceSanitizationError("原始节点树结构不匹配。")
+    bounds = _parse_bounds(node.get("bounds"))
+    _observe_bounds(stats, bounds)
+    position = _vertical_position(bounds)
+    if position == "private":
+        # 私有带内的父节点不可以悄然包含下方子节点，否则会把仍需审计的下方内容一起丢失。
+        for descendant in node.iter("node"):
+            descendant_bounds = _parse_bounds(descendant.get("bounds"))
+            _observe_bounds(stats, descendant_bounds)
+            if _vertical_position(descendant_bounds) != "private":
+                raise SkuEvidenceSanitizationError("原始节点树 bounds 结构不匹配。")
+        stats.removed_nodes += sum(1 for _ in node.iter("node"))
+        parent.remove(node)
+        return
+    if position == "crossing":
+        if bounds in _CROSSING_PRICE_BOUNDS and node.get("text"):
+            _project_crossing_price_node(node, bounds, stats)
+        else:
+            # 全屏/跨界容器可保留其下方子节点，但自身所有属性和文本都可能含地址或手机号。
+            _clear_node_text(node)
+            stats.cleared_crossing_nodes += 1
+    else:
+        stats.retained_below_nodes += 1
+    for child in list(node):
+        _sanitize_node(node, child, stats)
+
+
+def _parse_bounds(value: object) -> tuple[int, int, int, int]:
+    if not isinstance(value, str):
+        raise SkuEvidenceSanitizationError("原始节点树 bounds 缺失或无效。")
+    match = _BOUNDS_RE.fullmatch(value)
+    if match is None:
+        raise SkuEvidenceSanitizationError("原始节点树 bounds 缺失或无效。")
+    left, top, right, bottom = (int(group) for group in match.groups())
+    if not (0 <= left < right and 0 <= top < bottom):
+        raise SkuEvidenceSanitizationError("原始节点树 bounds 缺失或无效。")
+    return left, top, right, bottom
+
+
+def _observe_bounds(stats: _CleanupStats, bounds: tuple[int, int, int, int]) -> None:
+    _, _, right, bottom = bounds
+    stats.max_right = max(stats.max_right, right)
+    stats.max_bottom = max(stats.max_bottom, bottom)
+
+
+def _require_expected_xml_coordinate_space(stats: _CleanupStats) -> None:
+    if (
+        stats.max_right != PRIVACY_MASK_CONFIG.xml_width
+        or stats.max_bottom != PRIVACY_MASK_CONFIG.xml_height
+    ):
+        raise SkuEvidenceSanitizationError(
+            f"原始节点树坐标范围不匹配（observed {stats.max_right}x{stats.max_bottom}）。"
+        )
+
+
+def _vertical_position(bounds: tuple[int, int, int, int]) -> str:
+    _, top, _, bottom = bounds
+    if bottom <= PRIVACY_MASK_CONFIG.privacy_top:
+        return "private"
+    if top >= PRIVACY_MASK_CONFIG.privacy_top:
+        return "below"
+    return "crossing"
+
+
+def _project_crossing_price_node(
+    node: ElementTree.Element,
+    bounds: tuple[int, int, int, int],
+    stats: _CleanupStats,
+) -> None:
+    """投影唯一允许的跨界价格叶节点；任何结构漂移一律拒绝发布。"""
+
+    if (
+        len(node) != 0
+        or node.get("package") != "com.xunmeng.pinduoduo"
+        or node.get("class") != "android.widget.TextView"
+        or node.get("clickable") != "false"
+        or node.get("enabled") != "true"
+        or node.get("visible-to-user") != "true"
+    ):
+        raise SkuEvidenceSanitizationError("跨界价格节点结构不匹配，拒绝发布。")
+    text = node.get("text")
+    if text is None:
+        raise SkuEvidenceSanitizationError("跨界价格节点文本不匹配，拒绝发布。")
+    match = _CROSSING_PRICE_TEXT_RE.fullmatch(text)
+    if match is None:
+        raise _crossing_price_text_mismatch_error(bounds, text)
+
+    # 只有这七项经上述检查后可进入派生 XML；尤其不复制 content-desc、resource-id 等原始属性。
+    node.attrib = {attribute: node.attrib[attribute] for attribute in _PRICE_PROJECTION_ATTRIBUTES}
+    node.text = None
+    node.tail = None
+    stats.preserved_crossing_price_nodes += 1
+    if match.group(1) is not None:
+        stats.current_price_candidates += 1
+    else:
+        stats.original_price_candidates += 1
+
+
+def _crossing_price_text_mismatch_error(
+    bounds: tuple[int, int, int, int],
+    text: str,
+) -> SkuEvidenceSanitizationError:
+    """仅输出固定槽位与 reason，避免将任意 raw 正文带入 CLI 或日志。"""
+
+    reason = _crossing_price_text_mismatch_reason(text)
+    slot = _CROSSING_PRICE_SLOTS[bounds]
+    return SkuEvidenceSanitizationError(f"跨界价格节点文本不匹配：slot={slot}；reason={reason}。")
+
+
+def _crossing_price_text_mismatch_reason(text: str) -> str:
+    """将未匹配文本归类为受控枚举；返回值绝不包含原始片段。"""
+
+    if "\r" in text or "\n" in text:
+        return "newline"
+    if any(character.isspace() and character != " " for character in text):
+        return "non_ascii_whitespace"
+    if any(marker in text for marker in ("提交订单", "支付", "下单", "优惠")):
+        return "extra_or_order"
+    without_one_leading_space = text[1:] if text.startswith(" ") else text
+    if without_one_leading_space.startswith("快要抢光"):
+        return "observed_prefix_kuaiyaoqiangguang"
+    if without_one_leading_space.startswith("快") and not without_one_leading_space.startswith("快卖完"):
+        return "known_prefix_missing"
+    if "¥" not in text and "￥" not in text:
+        return "currency_missing"
+    if _CROSSING_PRICE_PREFIX_RE.match(text) is not None:
+        return "extra_or_order"
+    if any(character not in _CROSSING_PRICE_ALLOWED_CHARACTERS for character in text):
+        return "forbidden_characters"
+    return "amount_shape"
+
+
+def _require_safe_crossing_price_projection(stats: _CleanupStats) -> None:
+    """当前价必须唯一；原价仅可选且唯一，避免把任意金额释放为价格证据。"""
+
+    if (
+        stats.current_price_candidates != 1
+        or stats.original_price_candidates > 1
+        or stats.preserved_crossing_price_nodes != stats.current_price_candidates + stats.original_price_candidates
+    ):
+        raise SkuEvidenceSanitizationError("跨界价格候选不唯一或缺失，拒绝发布。")
+
+
+def _clear_node_text(node: ElementTree.Element) -> None:
+    node.attrib = {"bounds": node.attrib["bounds"]} if "bounds" in node.attrib else {}
+    node.text = None
+    node.tail = None
+
+
+def _contains_phone(root: ElementTree.Element) -> bool:
+    """逐项与跨节点复检电话，避免分隔符、遮罩字符或节点切分绕过。"""
+
+    all_values: list[str] = []
+    content_values: list[str] = []
+    for element in root.iter():
+        if element.text:
+            all_values.append(element.text)
+            content_values.append(element.text)
+        for attribute, value in element.attrib.items():
+            all_values.append(value)
+            if attribute != "bounds":
+                content_values.append(value)
+        if element.tail:
+            all_values.append(element.tail)
+            content_values.append(element.tail)
+    normalized_values = [_normalize_phone_value(value) for value in all_values]
+    normalized_all_document = "".join(normalized_values)
+    normalized_document = "".join(_normalize_phone_value(value) for value in content_values)
+    return (
+        any(_matches_phone(value) for value in normalized_values)
+        or _matches_phone(normalized_all_document)
+        or _matches_phone(normalized_document)
+    )
+
+
+def _normalize_phone_value(value: str) -> str:
+    return _SEPARATOR_RE.sub("", value.translate(_MASK_TRANSLATION))
+
+
+def _matches_phone(value: str) -> bool:
+    return _FULL_PHONE_RE.search(value) is not None or _MASKED_PHONE_RE.search(value) is not None
+
+
+def _derived_manifest(
+    source_manifest: dict[str, Any],
+    link: ProductUrl,
+    state: str,
+    source_manifest_path: Path,
+    source_screenshot_path: Path,
+    source_hierarchy_path: Path,
+    derived_screenshot_path: Path,
+    derived_hierarchy_path: Path,
+    cleanup_stats: _CleanupStats,
+) -> dict[str, Any]:
+    device = source_manifest["device"]
+    return {
+        "schema_version": 1,
+        "privacy_tier": "SANITIZED",
+        "sanitizer_version": PRIVACY_MASK_CONFIG.version,
+        "screenshot_space": {
+            "width": PRIVACY_MASK_CONFIG.screenshot_width,
+            "height": PRIVACY_MASK_CONFIG.screenshot_height,
+            "privacy_mask_rectangle": [
+                0,
+                0,
+                PRIVACY_MASK_CONFIG.screenshot_width,
+                PRIVACY_MASK_CONFIG.privacy_top,
+            ],
+        },
+        "xml_coordinate_space": {
+            "width": PRIVACY_MASK_CONFIG.xml_width,
+            "height": PRIVACY_MASK_CONFIG.xml_height,
+            "privacy_mask_rectangle": [0, 0, PRIVACY_MASK_CONFIG.xml_width, PRIVACY_MASK_CONFIG.privacy_top],
+            "observed_max": {"right": cleanup_stats.max_right, "bottom": cleanup_stats.max_bottom},
+        },
+        "privacy_cleanup": {
+            "removed_nodes": cleanup_stats.removed_nodes,
+            "cleared_crossing_nodes": cleanup_stats.cleared_crossing_nodes,
+            "preserved_crossing_price_nodes": cleanup_stats.preserved_crossing_price_nodes,
+            "retained_below_nodes": cleanup_stats.retained_below_nodes,
+            "max_right": cleanup_stats.max_right,
+            "max_bottom": cleanup_stats.max_bottom,
+        },
+        "product": {"goods_id": link.goods_id},
+        "human_declared_state": state,
+        "device": {
+            "model": device["model"],
+            "android_version": device.get("android_version"),
+            "pdd_package": device["pdd_package"],
+            "pdd_version": device["pdd_version"],
+        },
+        # source hashes stay only in the local derived manifest; no raw path, serial or body is retained.
+        "source": {
+            "manifest_sha256": _sha256_file(source_manifest_path),
+            "artifacts": [
+                {"path": "screenshot.png", "sha256": _sha256_file(source_screenshot_path)},
+                {"path": "hierarchy.xml", "sha256": _sha256_file(source_hierarchy_path)},
+            ],
+        },
+        "derived": {
+            "artifacts": [
+                {"path": "screenshot.png", "sha256": _sha256_file(derived_screenshot_path)},
+                {"path": "hierarchy.xml", "sha256": _sha256_file(derived_hierarchy_path)},
+            ]
+        },
+    }
+
+
+def _sha256_file(path: Path) -> str:
+    digest = sha256()
+    with path.open("rb") as source:
+        for chunk in iter(lambda: source.read(1024 * 1024), b""):
+            digest.update(chunk)
+    return digest.hexdigest()
+
+
+def _clean_staging(staging: Path | None) -> None:
+    if staging is not None and staging.exists():
+        shutil.rmtree(staging)
+
+
+def _publish_staging(staging: Path, target: Path) -> None:
+    """发布前二次检查，并使用目录 rename 而不是会覆盖目标的 replace。"""
+
+    if target.exists():
+        raise SkuEvidenceSanitizationError("派生证据目录已存在，拒绝覆盖。")
+    try:
+        staging.rename(target)
+    except OSError as error:
+        # 竞态中新目标出现或文件系统拒绝 rename 时一律不尝试覆盖或重试。
+        raise SkuEvidenceSanitizationError("派生证据目录发布失败，未覆盖已有目录。") from error

client/src/cmbuyer_client/pdd/__init__.py

@@ -0,0 +1,23 @@
+"""拼多多链接的受限打开、只读取证与经取证的规格面板选择。
+
+此包不提供通用页面选择器、输入、滑动或任何订单动作。
+"""
+
+from .product_open import ProductOpenCapturer, ProductOpenResult
+from .product_url import ProductUrl, ProductUrlError, parse_product_url
+from .sku_selection import SkuSelection, SkuSelectionError, SkuSelectionFlow
+from .sku_selection_runner import SkuSelectionRunError, SkuSelectionRunResult, SkuSelectionRunner
+
+__all__ = [
+    "ProductOpenCapturer",
+    "ProductOpenResult",
+    "ProductUrl",
+    "ProductUrlError",
+    "SkuSelection",
+    "SkuSelectionError",
+    "SkuSelectionFlow",
+    "SkuSelectionRunError",
+    "SkuSelectionRunResult",
+    "SkuSelectionRunner",
+    "parse_product_url",
+]

client/src/cmbuyer_client/pdd/product_open.py

@@ -0,0 +1,262 @@
+"""安全打开 canonical 商品链接后的只读取证。"""
+
+from __future__ import annotations
+
+from collections.abc import Callable
+from dataclasses import dataclass
+from datetime import UTC, datetime
+from hashlib import sha256
+import json
+from math import isfinite
+import os
+from pathlib import Path
+import shutil
+from time import monotonic, sleep
+from typing import Any, Protocol
+from uuid import uuid4
+
+from adbutils.errors import AdbTimeout
+from uiautomator2.exceptions import HTTPTimeoutError
+
+from ..device.adb import AdbClient, DeviceConnectionError, DeviceInspection, IntentLaunchSummary
+from ..device.baseline import (
+    HIERARCHY_PARAMS,
+    PDD_PACKAGE,
+    SCREENSHOT_PARAMS,
+    _save_base64_screenshot,
+    _sha256_file,
+    _validate_hierarchy,
+)
+from .product_url import ProductUrl, parse_product_url
+
+
+EXPECTED_PDD_VERSION = "8.17.0"
+
+
+class ProductOpenError(RuntimeError):
+    """商品打开或证据发布未完整完成。"""
+
+
+class ProductVersionMismatchError(ProductOpenError):
+    """运行时拼多多版本不是经取证允许的版本。"""
+
+
+class ProductPackageMismatchError(ProductOpenError):
+    """Intent 后在有限时间内未观察到拼多多前台包。"""
+
+
+class ProductOpenTimeoutError(ProductOpenError):
+    """商品打开后的只读取证超时。"""
+
+
+class ProductScreenshotCaptureError(ProductOpenError):
+    """Intent 后截图不能作为完整 PNG 证据保存。"""
+
+
+class ProductHierarchyCaptureError(ProductOpenError):
+    """Intent 后完整节点树不能作为有效 XML 证据保存。"""
+
+
+class ProductOpenUiDevice(Protocol):
+    """本任务所需的只读 uiautomator2 接口；故意没有任何 UI 操作方法。"""
+
+    def app_info(self, package_name: str) -> dict[str, Any]:
+        """读取应用元数据。"""
+
+    def app_current(self) -> dict[str, Any]:
+        """读取当前前台应用元数据。"""
+
+    def jsonrpc_call(self, method: str, params: Any = None, timeout: float = 10) -> Any:
+        """调用只读取证所需的公开 JSON-RPC 方法。"""
+
+
+@dataclass(frozen=True)
+class ProductOpenResult:
+    """已原子发布的商品打开证据位置。"""
+
+    output_directory: Path
+    manifest_path: Path
+    screenshot_path: Path
+    hierarchy_path: Path
+
+
+class ProductOpenCapturer:
+    """以 fail-closed 顺序打开已重建链接，并在打开后只读留证。
+
+    本类不判断商品页、Activity、文案或控件；打开后只确认当前 package，随后采集截图与
+    完整节点树。任何失败都不会发布半成品证据目录。
+    """
+
+    def __init__(
+        self,
+        adb_client: AdbClient,
+        connector: Callable[[str], ProductOpenUiDevice],
+        timeout_seconds: float,
+        foreground_poll_interval_seconds: float = 0.2,
+        monotonic_clock: Callable[[], float] = monotonic,
+        sleep_function: Callable[[float], None] = sleep,
+    ) -> None:
+        if not _is_positive_finite(timeout_seconds):
+            raise ValueError("timeout_seconds 必须是大于 0 的有限数值")
+        if not _is_positive_finite(foreground_poll_interval_seconds):
+            raise ValueError("foreground_poll_interval_seconds 必须是大于 0 的有限数值")
+        self._adb_client = adb_client
+        self._connector = connector
+        self._timeout_seconds = timeout_seconds
+        self._foreground_poll_interval_seconds = foreground_poll_interval_seconds
+        self._monotonic_clock = monotonic_clock
+        self._sleep_function = sleep_function
+
+    def open_and_capture(self, serial: str, product_url: str, output_directory: Path) -> ProductOpenResult:
+        """完成唯一允许的 Intent 打开及其后的只读取证。"""
+
+        # 公共入口只接收原始字符串并每次重新解析，不能由调用方构造不一致的值对象伪造 manifest。
+        link = parse_product_url(product_url)
+        target = Path(output_directory)
+        _validate_new_target(target)
+
+        staging: Path | None = None
+        try:
+            # inspect 必须先于连接和 Intent，复用 T-101 的显式 serial、重复物理设备拒绝逻辑。
+            inspection = self._adb_client.inspect(serial)
+            device = self._connector(serial)
+            pdd_version = _require_expected_version(device.app_info(PDD_PACKAGE))
+
+            # 版本精确匹配是 Intent 的前置条件，失败时绝不调用 start_pdd_view_intent。
+            intent = self._adb_client.start_pdd_view_intent(serial, link.goods_id)
+            self._wait_for_pdd_foreground(device)
+
+            target.parent.mkdir(parents=True, exist_ok=True)
+            staging = target.parent / f".{target.name}.staging-{uuid4().hex}"
+            staging.mkdir()
+            screenshot_path = staging / "screenshot.png"
+            try:
+                _save_base64_screenshot(
+                    device.jsonrpc_call("takeScreenshot", SCREENSHOT_PARAMS, timeout=self._timeout_seconds),
+                    screenshot_path,
+                )
+            except (AdbTimeout, HTTPTimeoutError, TimeoutError):
+                raise
+            except Exception as error:
+                raise ProductScreenshotCaptureError("商品打开后截图取证失败，未发布任何证据产物。") from error
+
+            try:
+                hierarchy = device.jsonrpc_call(
+                    "dumpWindowHierarchy",
+                    HIERARCHY_PARAMS,
+                    timeout=self._timeout_seconds,
+                )
+                _validate_hierarchy(hierarchy)
+            except (AdbTimeout, HTTPTimeoutError, TimeoutError):
+                raise
+            except Exception as error:
+                raise ProductHierarchyCaptureError("商品打开后节点树取证失败，未发布任何证据产物。") from error
+            hierarchy_path = staging / "hierarchy.xml"
+            hierarchy_path.write_text(hierarchy, encoding="utf-8")
+
+            manifest_path = staging / "manifest.json"
+            manifest_path.write_text(
+                json.dumps(
+                    _manifest(inspection, serial, link, pdd_version, intent, screenshot_path, hierarchy_path),
+                    ensure_ascii=False,
+                    indent=2,
+                    sort_keys=True,
+                )
+                + "\n",
+                encoding="utf-8",
+            )
+            os.replace(staging, target)
+        except (ProductOpenError, DeviceConnectionError):
+            _clean_staging(staging)
+            raise
+        except (AdbTimeout, HTTPTimeoutError, TimeoutError) as error:
+            _clean_staging(staging)
+            raise ProductOpenTimeoutError("商品打开后的只读取证超时，未发布任何证据产物。") from error
+        except Exception as error:
+            _clean_staging(staging)
+            # 底层异常可能含 serial、路径或远端页面内容，不能直接向 CLI 或日志传播。
+            raise ProductOpenError("商品打开或只读取证未完成，未发布任何证据产物。") from error
+
+        return ProductOpenResult(
+            output_directory=target,
+            manifest_path=target / "manifest.json",
+            screenshot_path=target / "screenshot.png",
+            hierarchy_path=target / "hierarchy.xml",
+        )
+
+    def _wait_for_pdd_foreground(self, device: ProductOpenUiDevice) -> None:
+        """只轮询当前 package，直到 deadline；Activity 和节点树均不参与本判据。"""
+
+        deadline = self._monotonic_clock() + self._timeout_seconds
+        while True:
+            if _is_pdd_foreground(device.app_current()):
+                return
+            remaining = deadline - self._monotonic_clock()
+            if remaining <= 0:
+                raise ProductPackageMismatchError(
+                    "商品链接打开后未在限定时间内进入拼多多，已停止后续取证。"
+                )
+            # 每个失败观察后都等待正的、受 deadline 约束的时长，避免 busy-loop。
+            self._sleep_function(min(self._foreground_poll_interval_seconds, remaining))
+
+
+def _validate_new_target(target: Path) -> None:
+    if target.exists():
+        raise ProductOpenError("输出目录已存在；为防止混入旧证据，拒绝覆盖。")
+    if not target.name:
+        raise ProductOpenError("输出目录必须是明确的新目录。")
+
+
+def _clean_staging(staging: Path | None) -> None:
+    if staging is not None and staging.exists():
+        # staging 仅在本次调用中创建，删除前不解析或扩展任何调用方提供的路径。
+        shutil.rmtree(staging)
+
+
+def _require_expected_version(app_info: dict[str, Any]) -> str:
+    if not isinstance(app_info, dict):
+        raise ProductVersionMismatchError("拼多多版本与已取证版本不一致，已停止打开商品链接。")
+    version = app_info.get("versionName") or app_info.get("version_name")
+    if not isinstance(version, str) or version != EXPECTED_PDD_VERSION:
+        raise ProductVersionMismatchError("拼多多版本与已取证版本不一致，已停止打开商品链接。")
+    return version
+
+
+def _is_positive_finite(value: object) -> bool:
+    return isinstance(value, (int, float)) and not isinstance(value, bool) and value > 0 and isfinite(value)
+
+
+def _is_pdd_foreground(current: object) -> bool:
+    return isinstance(current, dict) and current.get("package") == PDD_PACKAGE
+
+
+def _manifest(
+    inspection: DeviceInspection,
+    serial: str,
+    link: ProductUrl,
+    pdd_version: str,
+    intent: IntentLaunchSummary,
+    screenshot_path: Path,
+    hierarchy_path: Path,
+) -> dict[str, Any]:
+    """只写审计摘要；原始 serial、Activity、ADB 输出和页面正文均不进入 manifest。"""
+
+    return {
+        "schema_version": 1,
+        "captured_at": datetime.now(UTC).isoformat(),
+        "product": {"goods_id": link.goods_id, "canonical_url": link.canonical_url},
+        "channel": "wifi" if ":" in serial else "usb",
+        "serial_sha256": sha256(serial.encode("utf-8")).hexdigest(),
+        "device": {
+            "model": inspection.model,
+            "android_version": inspection.android_version,
+            "pdd_package": PDD_PACKAGE,
+            "pdd_version": pdd_version,
+        },
+        "intent": {"status": intent.status, "returncode": intent.returncode},
+        "current_package": PDD_PACKAGE,
+        "artifacts": [
+            {"path": screenshot_path.name, "sha256": _sha256_file(screenshot_path)},
+            {"path": hierarchy_path.name, "sha256": _sha256_file(hierarchy_path)},
+        ],
+    }

client/src/cmbuyer_client/pdd/product_url.py

@@ -0,0 +1,61 @@
+"""唯一允许交给 Android Intent 的商品链接。"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+from urllib.parse import parse_qsl, urlsplit
+
+
+_SCHEME = "https"
+_HOST = "mobile.yangkeduo.com"
+_PATH = "/goods.html"
+
+
+class ProductUrlError(ValueError):
+    """输入不是可安全重建的 canonical 商品链接。"""
+
+
+@dataclass(frozen=True)
+class ProductUrl:
+    """经验证的商品标识及由它重建的 canonical URL。"""
+
+    goods_id: str
+    canonical_url: str
+
+
+def parse_product_url(value: str) -> ProductUrl:
+    """只接受一个 ASCII 数字 ``goods_id`` 的拼多多商品直链。
+
+    解析结果绝不原样透传：Intent 使用的 URL 必须从 ``goods_id`` 重新构建，以排除
+    短链、额外参数、userinfo、fragment 和 URL 解析器的边缘表示。
+    """
+
+    if not isinstance(value, str):
+        raise ProductUrlError("商品链接必须是字符串。")
+    try:
+        parsed = urlsplit(value)
+        port = parsed.port
+        query_pairs = parse_qsl(parsed.query, keep_blank_values=True, strict_parsing=True)
+    except ValueError as error:
+        raise ProductUrlError("商品链接格式无效。") from error
+
+    if (
+        parsed.scheme != _SCHEME
+        or parsed.hostname != _HOST
+        or parsed.username is not None
+        or parsed.password is not None
+        or port is not None
+        or parsed.path != _PATH
+        or parsed.fragment
+    ):
+        raise ProductUrlError("商品链接不是允许的拼多多商品直链。")
+    if len(query_pairs) != 1 or query_pairs[0][0] != "goods_id":
+        raise ProductUrlError("商品链接必须且只能包含一个 goods_id 参数。")
+
+    goods_id = query_pairs[0][1]
+    if not goods_id or any(character < "0" or character > "9" for character in goods_id):
+        raise ProductUrlError("goods_id 必须是纯数字。")
+    canonical_url = f"{_SCHEME}://{_HOST}{_PATH}?goods_id={goods_id}"
+    if value != canonical_url:
+        raise ProductUrlError("商品链接必须使用唯一 canonical 表示。")
+    return ProductUrl(goods_id=goods_id, canonical_url=canonical_url)

client/src/cmbuyer_client/pdd/sku_panel_spike.py

@@ -0,0 +1,252 @@
+"""人工停留在规格面板后的只读取证。
+
+本模块不识别规格面板，不打开商品链接，也不读取价格；三种面板状态完全由现场人员声明。
+"""
+
+from __future__ import annotations
+
+from collections.abc import Callable
+from dataclasses import dataclass
+from datetime import UTC, datetime
+from hashlib import sha256
+import json
+from math import isfinite
+import os
+from pathlib import Path
+import shutil
+from typing import Any, Protocol
+from uuid import uuid4
+
+from adbutils.errors import AdbTimeout
+from uiautomator2.exceptions import HTTPTimeoutError
+
+from ..device.adb import AdbClient, DeviceConnectionError, DeviceInspection
+from ..device.baseline import (
+    HIERARCHY_PARAMS,
+    PDD_PACKAGE,
+    SCREENSHOT_PARAMS,
+    _save_base64_screenshot,
+    _sha256_file,
+    _validate_hierarchy,
+)
+from .product_open import EXPECTED_PDD_VERSION
+from .product_url import ProductUrl, parse_product_url
+from .sku_panel_state import HUMAN_DECLARED_STATES
+
+
+class SkuPanelEvidenceError(RuntimeError):
+    """人工规格面板证据无法完整发布。"""
+
+
+class SkuPanelDeclaredStateError(SkuPanelEvidenceError):
+    """调用方没有提供允许的人工声明状态。"""
+
+
+class SkuPanelVersionMismatchError(SkuPanelEvidenceError):
+    """运行时拼多多版本不是已取证版本。"""
+
+
+class SkuPanelPackageMismatchError(SkuPanelEvidenceError):
+    """人工声明前台不是拼多多时仍试图留证。"""
+
+
+class SkuPanelEvidenceTimeoutError(SkuPanelEvidenceError):
+    """只读截图或节点树取证超时。"""
+
+
+class SkuPanelScreenshotError(SkuPanelEvidenceError):
+    """截图不能保存为严格有效的 PNG。"""
+
+
+class SkuPanelHierarchyError(SkuPanelEvidenceError):
+    """节点树不能保存为严格有效的 XML。"""
+
+
+class SkuPanelUiDevice(Protocol):
+    """人工面板证据所需的只读接口，故意没有任何页面操作方法。"""
+
+    def app_info(self, package_name: str) -> dict[str, Any]:
+        """读取应用元数据。"""
+
+    def app_current(self) -> dict[str, Any]:
+        """读取当前前台应用元数据。"""
+
+    def jsonrpc_call(self, method: str, params: Any = None, timeout: float = 10) -> Any:
+        """调用公开 JSON-RPC 的只读取证方法。"""
+
+
+@dataclass(frozen=True)
+class SkuPanelEvidenceResult:
+    """已原子发布的本地证据目录。"""
+
+    output_directory: Path
+    manifest_path: Path
+    screenshot_path: Path
+    hierarchy_path: Path
+
+
+class SkuPanelEvidenceCapturer:
+    """把人工已停留的面板状态留证，不对页面作任何自动结论。
+
+    状态字段命名为 ``human_declared_state``，防止消费者把本模块误解为自动面板/规格/价格识别。
+    """
+
+    def __init__(
+        self,
+        adb_client: AdbClient,
+        connector: Callable[[str], SkuPanelUiDevice],
+        timeout_seconds: float,
+    ) -> None:
+        if not _is_positive_finite(timeout_seconds):
+            raise ValueError("timeout_seconds 必须是大于 0 的有限数值")
+        self._adb_client = adb_client
+        self._connector = connector
+        self._timeout_seconds = timeout_seconds
+
+    def capture(
+        self,
+        serial: str,
+        product_url: str,
+        human_declared_state: str,
+        output_directory: Path,
+    ) -> SkuPanelEvidenceResult:
+        """采集人工已准备的状态；不会打开链接、面板或执行任何 UI 操作。"""
+
+        link = parse_product_url(product_url)
+        state = _validate_human_declared_state(human_declared_state)
+        target = Path(output_directory)
+        _validate_new_target(target)
+
+        staging: Path | None = None
+        try:
+            # 沿用 T-101 的显式 serial、在线状态与重复物理设备 fail-closed 核验。
+            inspection = self._adb_client.inspect(serial)
+            device = self._connector(serial)
+            pdd_version = _require_expected_version(device.app_info(PDD_PACKAGE))
+            _require_pdd_foreground(device.app_current())
+
+            target.parent.mkdir(parents=True, exist_ok=True)
+            staging = target.parent / f".{target.name}.staging-{uuid4().hex}"
+            staging.mkdir()
+            screenshot_path = staging / "screenshot.png"
+            try:
+                _save_base64_screenshot(
+                    device.jsonrpc_call("takeScreenshot", SCREENSHOT_PARAMS, timeout=self._timeout_seconds),
+                    screenshot_path,
+                )
+            except (AdbTimeout, HTTPTimeoutError, TimeoutError):
+                raise
+            except Exception as error:
+                raise SkuPanelScreenshotError("规格面板截图取证失败，未发布任何证据产物。") from error
+
+            try:
+                hierarchy = device.jsonrpc_call(
+                    "dumpWindowHierarchy",
+                    HIERARCHY_PARAMS,
+                    timeout=self._timeout_seconds,
+                )
+                _validate_hierarchy(hierarchy)
+            except (AdbTimeout, HTTPTimeoutError, TimeoutError):
+                raise
+            except Exception as error:
+                raise SkuPanelHierarchyError("规格面板节点树取证失败，未发布任何证据产物。") from error
+            hierarchy_path = staging / "hierarchy.xml"
+            hierarchy_path.write_text(hierarchy, encoding="utf-8")
+
+            manifest_path = staging / "manifest.json"
+            manifest_path.write_text(
+                json.dumps(
+                    _manifest(inspection, serial, link, state, pdd_version, screenshot_path, hierarchy_path),
+                    ensure_ascii=False,
+                    indent=2,
+                    sort_keys=True,
+                )
+                + "\n",
+                encoding="utf-8",
+            )
+            os.replace(staging, target)
+        except (SkuPanelEvidenceError, DeviceConnectionError):
+            _clean_staging(staging)
+            raise
+        except (AdbTimeout, HTTPTimeoutError, TimeoutError) as error:
+            _clean_staging(staging)
+            raise SkuPanelEvidenceTimeoutError("规格面板只读取证超时，未发布任何证据产物。") from error
+        except Exception as error:
+            _clean_staging(staging)
+            # 第三方异常可能含 serial、Activity 或页面正文，不能直接向 CLI/日志传播。
+            raise SkuPanelEvidenceError("规格面板只读取证未完成，未发布任何证据产物。") from error
+
+        return SkuPanelEvidenceResult(
+            output_directory=target,
+            manifest_path=target / "manifest.json",
+            screenshot_path=target / "screenshot.png",
+            hierarchy_path=target / "hierarchy.xml",
+        )
+
+
+def _is_positive_finite(value: object) -> bool:
+    return isinstance(value, (int, float)) and not isinstance(value, bool) and value > 0 and isfinite(value)
+
+
+def _validate_human_declared_state(value: object) -> str:
+    if not isinstance(value, str) or value not in HUMAN_DECLARED_STATES:
+        raise SkuPanelDeclaredStateError("必须提供允许的人工声明规格面板状态。")
+    return value
+
+
+def _validate_new_target(target: Path) -> None:
+    if target.exists():
+        raise SkuPanelEvidenceError("输出目录已存在；为防止混入旧证据，拒绝覆盖。")
+    if not target.name:
+        raise SkuPanelEvidenceError("输出目录必须是明确的新目录。")
+
+
+def _clean_staging(staging: Path | None) -> None:
+    if staging is not None and staging.exists():
+        # staging 仅在本次调用中创建，绝不删除调用方已存在的目录。
+        shutil.rmtree(staging)
+
+
+def _require_expected_version(app_info: object) -> str:
+    if not isinstance(app_info, dict):
+        raise SkuPanelVersionMismatchError("拼多多版本与已取证版本不一致，已停止取证。")
+    version = app_info.get("versionName") or app_info.get("version_name")
+    if not isinstance(version, str) or version != EXPECTED_PDD_VERSION:
+        raise SkuPanelVersionMismatchError("拼多多版本与已取证版本不一致，已停止取证。")
+    return version
+
+
+def _require_pdd_foreground(current: object) -> None:
+    if not isinstance(current, dict) or current.get("package") != PDD_PACKAGE:
+        raise SkuPanelPackageMismatchError("当前前台应用不是拼多多，已停止取证。")
+
+
+def _manifest(
+    inspection: DeviceInspection,
+    serial: str,
+    link: ProductUrl,
+    human_declared_state: str,
+    pdd_version: str,
+    screenshot_path: Path,
+    hierarchy_path: Path,
+) -> dict[str, Any]:
+    """仅记录人工声明与非敏感审计摘要，不写入 Activity 或页面内容。"""
+
+    return {
+        "schema_version": 1,
+        "captured_at": datetime.now(UTC).isoformat(),
+        "product": {"goods_id": link.goods_id, "canonical_url": link.canonical_url},
+        "human_declared_state": human_declared_state,
+        "channel": "wifi" if ":" in serial else "usb",
+        "serial_sha256": sha256(serial.encode("utf-8")).hexdigest(),
+        "device": {
+            "model": inspection.model,
+            "android_version": inspection.android_version,
+            "pdd_package": PDD_PACKAGE,
+            "pdd_version": pdd_version,
+        },
+        "artifacts": [
+            {"path": screenshot_path.name, "sha256": _sha256_file(screenshot_path)},
+            {"path": hierarchy_path.name, "sha256": _sha256_file(hierarchy_path)},
+        ],
+    }

client/src/cmbuyer_client/pdd/sku_panel_state.py

@@ -0,0 +1,13 @@
+"""T-103 的人工声明证据状态；不含任何页面识别或规格语义。"""
+
+from __future__ import annotations
+
+
+# 这些值由现场人员填写到 manifest，不能被解释为自动检测出的页面或选择状态。
+HUMAN_DECLARED_STATES = frozenset(
+    {
+        "panel-opened-target-preselected",
+        "alternate-all-dimensions-selected",
+        "target-selection-restored",
+    }
+)

client/src/cmbuyer_client/pdd/sku_selection.py

@@ -0,0 +1,420 @@
+"""T-103：仅限已取证 PDD 8.17.0 的规格面板恢复。"""
+from __future__ import annotations
+
+from dataclasses import dataclass
+import re
+from time import monotonic, sleep
+from typing import Any, Callable, Protocol
+from xml.etree import ElementTree
+
+from ..device.baseline import PDD_PACKAGE
+from .product_open import EXPECTED_PDD_VERSION
+from .product_url import parse_product_url
+
+EXPECTED_GOODS_ID = "937122477375"
+EXPECTED_UNIT_PRICE = "12.88"
+# 任务值不是页面判据；右侧是 v5 取证的唯一 accessibility 文案（空格/全角括号均有意义）。
+TASK_TO_UI_SELECTION = {("黑色CHA(纯棉)", "M(建议100-115)"): ("黑色 CHA (纯棉）", "M（建议100-115）")}
+_TARGET_COLOR_UI, _TARGET_SIZE_UI = next(iter(TASK_TO_UI_SELECTION.values()))
+_ENTRY = "快要抢光"
+_ENTRY_TEXT_BOUNDS = "[900,1312][1056,1355]"
+_ENTRY_INNER_BOUNDS = "[712,1312][1056,1355]"
+_ENTRY_ACTION_BOUNDS = "[0,1256][1080,1355]"
+_SIZE = "尺码"
+_W, _H = 1080, 2376
+_PRICE_PARENT = "[396,498][895,570]"
+_CURRENT = "[396,503][712,570]"
+_ORIGINAL = "[730,503][895,570]"
+_SUMMARY = "[396,654][1053,716]"
+_COLOR_REGION = "[36,1000][1080,1631]"
+_SIZE_LABEL = "[36,1654][114,1700]"
+_SIZE_HEADER = "[36,1637][1044,1718]"
+_SIZE_OPTIONS = "[36,1730][1044,2045]"
+_BOUNDS = re.compile(r"^\[(\d+),(\d+)\]\[(\d+),(\d+)\]$")
+_PRICE = re.compile(r"^[^0-9¥￥]*[¥￥]([1-9][0-9]*\.[0-9]{2})$")
+_ORIGINAL_PRICE = re.compile(r"^[¥￥][1-9][0-9]*\.[0-9]{2}$")
+_BAD_PRICE_ROLE = ("提交订单", "支付", "优惠", "券", "会员", "补贴", "区间", "实付", "到手", "原价", "划线价", "最低", "低至", "起价", "下单", "先用后付", "预估")
+
+
+class SkuSelectionError(RuntimeError):
+    """已取证判据不成立时的脱敏停止。"""
+
+
+class SkuPanelDevice(Protocol):
+    def app_info(self, package_name: str) -> dict[str, Any]: ...
+    def app_current(self) -> dict[str, Any]: ...
+    def dump_window_hierarchy(self) -> str: ...
+    def tap_sku_entry(self, bounds: str) -> None: ...
+    def tap_sku_option(self, bounds: str) -> None: ...
+    def leave_sku_panel(self) -> None: ...
+
+
+@dataclass(frozen=True)
+class SkuSelection:
+    color: str
+    size: str
+
+
+def resolve_task_selection(color: str, size: str) -> SkuSelection:
+    mapped = TASK_TO_UI_SELECTION.get((color, size))
+    if mapped is None:
+        raise SkuSelectionError("规格任务值不是已取证的唯一目标，已停止操作。")
+    return SkuSelection(*mapped)
+
+
+@dataclass(frozen=True)
+class _Node:
+    element: ElementTree.Element
+    parent: "_Node | None"
+    @property
+    def text(self) -> str: return self.element.get("text", "")
+    @property
+    def desc(self) -> str: return self.element.get("content-desc", "")
+    @property
+    def bounds(self) -> str: return self.element.get("bounds", "")
+
+
+class SkuSelectionFlow:
+    def __init__(self, device: SkuPanelDevice, entry_wait_timeout_seconds: float = 0.2,
+                 entry_poll_interval_seconds: float = 0.2, monotonic_clock: Callable[[], float] = monotonic,
+                 sleep_function: Callable[[float], None] = sleep) -> None:
+        if entry_wait_timeout_seconds < 0 or entry_poll_interval_seconds <= 0:
+            raise ValueError("入口等待参数无效。")
+        self._device, self._entry_timeout, self._poll = device, entry_wait_timeout_seconds, entry_poll_interval_seconds
+        self._clock, self._sleep = monotonic_clock, sleep_function
+        self._pending: tuple[str, Callable[[list[_Node]], Any]] | None = None
+
+    def open_sku_panel(self, product_url: str, pre_intent_hierarchy: str | None = None) -> None:
+        if parse_product_url(product_url).goods_id != EXPECTED_GOODS_ID:
+            raise SkuSelectionError("商品不是已取证目标，已停止操作。")
+        if pre_intent_hierarchy is not None:
+            previous_nodes = _parse_nodes(pre_intent_hierarchy)
+            if _eligible_entries(previous_nodes):
+                raise SkuSelectionError("intent 前页面已出现规格入口，已拒绝旧商品误点。")
+        entry, before = self._wait_for_entry(pre_intent_hierarchy)
+        _action_bounds(entry.bounds)
+        self._pending = (before, _panel)
+        self._device.tap_sku_entry(entry.bounds)
+        self._wait_after_action(before, _panel)
+
+    def select_sku_options(self, selection: SkuSelection) -> None:
+        if selection not in {SkuSelection(*item) for item in TASK_TO_UI_SELECTION.values()}:
+            raise SkuSelectionError("规格 UI 文案不是获准目标，已停止操作。")
+        initial = self._verified_nodes()
+        _option(initial, "color", selection.color); _option(initial, "size", selection.size)
+        _selected_label(initial, "color"); _selected_label(initial, "size")
+        self._restore("color", selection.color)
+        self._restore("size", selection.size)
+
+    def read_sku_unit_price(self) -> str:
+        return _unit_price(self._verified_nodes())
+
+    def verify_target_selection_and_read_price(self, selection: SkuSelection) -> str:
+        nodes = self._verified_nodes()
+        _selected(nodes, "color", selection.color)
+        _selected(nodes, "size", selection.size)
+        return _unit_price(nodes)
+
+    def exit_sku_panel_safely(self) -> None:
+        self._require_foreground()
+        before = self._read_hierarchy()
+        _panel(_parse_nodes(before))
+        self._device.leave_sku_panel()
+        deadline = self._clock() + self._entry_timeout
+        while True:
+            self._require_foreground()
+            raw = self._read_hierarchy()
+            if raw != before:
+                try:
+                    _panel(_parse_nodes(raw))
+                except SkuSelectionError:
+                    return
+            remaining = deadline - self._clock()
+            if remaining <= 0:
+                raise SkuSelectionError("安全退出后未确认离开规格面板，未重试返回。")
+            self._sleep(min(self._poll, remaining))
+
+    def reconcile_pending_action(self) -> None:
+        """仅只读调和一次已发出但尚未得到后置条件确认的动作。"""
+        if self._pending is None:
+            return
+        before, condition = self._pending
+        self._wait_after_action(before, condition)
+
+    def _restore(self, dimension: str, expected: str) -> None:
+        self._require_foreground()
+        before = self._read_hierarchy()
+        nodes = _panel(_parse_nodes(before))
+        target = _option(nodes, dimension, expected)
+        if _selected_label(nodes, dimension) == expected:
+            return
+        _action_bounds(target.bounds)
+        condition: Callable[[list[_Node]], Any]
+        if dimension == "color":
+            condition = lambda refreshed: _post_color(refreshed, expected)
+        else:
+            condition = lambda refreshed: _post_all_targets(refreshed, expected)
+        self._pending = (before, condition)
+        self._device.tap_sku_option(target.bounds)
+        if dimension == "color":
+            self._wait_after_action(before, condition)
+        else:
+            self._wait_after_action(before, condition)
+
+    def _wait_for_entry(self, previous: str | None) -> tuple[_Node, str]:
+        deadline, stable = self._clock() + self._entry_timeout, None
+        while True:
+            self._require_version()
+            current = self._device.app_current()
+            if isinstance(current, dict) and current.get("package") == PDD_PACKAGE:
+                raw = self._read_hierarchy()
+                entries = _eligible_entries(_parse_nodes(raw))
+                if len(entries) > 1:
+                    raise SkuSelectionError("商品页规格入口不唯一，已停止操作。")
+                if len(entries) == 1 and raw != previous:
+                    if stable == raw:
+                        return entries[0], raw
+                    stable = raw
+                else:
+                    stable = None
+            else:
+                stable = None
+            remaining = deadline - self._clock()
+            if remaining <= 0:
+                raise SkuSelectionError("等待已取证规格入口超时，未执行点击。")
+            self._sleep(min(self._poll, remaining))
+
+    def _wait_after_action(self, previous: str, condition: Callable[[list[_Node]], Any]) -> list[_Node]:
+        deadline = self._clock() + self._entry_timeout
+        while True:
+            self._require_foreground()
+            raw = self._read_hierarchy()
+            if raw != previous:
+                nodes = _parse_nodes(raw)
+                try:
+                    condition(nodes)
+                    self._pending = None
+                    return nodes
+                except SkuSelectionError:
+                    pass
+            remaining = deadline - self._clock()
+            if remaining <= 0:
+                raise SkuSelectionError("动作后页面未在限定时间内满足已取证后置条件，未重试动作。")
+            self._sleep(min(self._poll, remaining))
+
+    def _verified_nodes(self) -> list[_Node]:
+        self._require_foreground()
+        return _panel(self._read_nodes())
+
+    def _require_version(self) -> None:
+        info = self._device.app_info(PDD_PACKAGE)
+        version = (info.get("versionName") or info.get("version_name")) if isinstance(info, dict) else None
+        if version != EXPECTED_PDD_VERSION:
+            raise SkuSelectionError("拼多多版本与已取证版本不一致，已停止操作。")
+
+    def _require_foreground(self) -> None:
+        self._require_version()
+        current = self._device.app_current()
+        if not isinstance(current, dict) or current.get("package") != PDD_PACKAGE:
+            raise SkuSelectionError("拼多多不在前台，已停止操作。")
+
+    def _read_hierarchy(self) -> str:
+        try: raw = self._device.dump_window_hierarchy()
+        except Exception as error: raise SkuSelectionError("节点树读取失败，已停止操作。") from error
+        if not isinstance(raw, str) or not raw: raise SkuSelectionError("节点树不可用，已停止操作。")
+        return raw
+
+    def _read_nodes(self) -> list[_Node]: return _parse_nodes(self._read_hierarchy())
+
+
+def _parse_nodes(raw: str) -> list[_Node]:
+    try: root = ElementTree.fromstring(raw)
+    except ElementTree.ParseError as error: raise SkuSelectionError("节点树格式无效，已停止操作。") from error
+    if root.tag != "hierarchy": raise SkuSelectionError("节点树根节点无效，已停止操作。")
+    result: list[_Node] = []
+    def visit(element: ElementTree.Element, parent: _Node | None) -> None:
+        node = _Node(element, parent); result.append(node)
+        for child in element: visit(child, node)
+    visit(root, None)
+    return result
+
+
+def _panel(nodes: list[_Node]) -> list[_Node]:
+    parent = _one([n for n in nodes if n.bounds == _PRICE_PARENT], "规格面板价格区域不唯一，已停止操作。")
+    _one([n for n in nodes if n.parent is parent and n.bounds == _ORIGINAL and _readonly(n) and _ORIGINAL_PRICE.fullmatch(n.text)], "规格面板原价槽位不唯一，已停止操作。")
+    _one([n for n in nodes if n.bounds == _SUMMARY and _readonly(n) and n.text.startswith("已选：")], "规格面板已选摘要不唯一，已停止操作。")
+    _color_container(nodes); _size_container(nodes)
+    return nodes
+
+
+def _unit_price(nodes: list[_Node]) -> str:
+    parent = _one([n for n in nodes if n.bounds == _PRICE_PARENT], "规格面板价格区域不唯一，已停止读取。")
+    money = [n for n in nodes if n.parent is parent and _readonly(n) and any(mark in n.text for mark in "¥￥")]
+    if len(money) != 2: raise SkuSelectionError("规格面板金额槽位不唯一，已停止读取。")
+    current = _one([n for n in money if n.bounds == _CURRENT and not _clickable_ancestor(n) and not any(word in n.text for word in _BAD_PRICE_ROLE) and _PRICE.fullmatch(n.text)], "规格面板现价不唯一或不符合已取证槽位，已停止读取。")
+    if not any(n.bounds == _ORIGINAL and _ORIGINAL_PRICE.fullmatch(n.text) for n in money):
+        raise SkuSelectionError("规格面板原价槽位无效，已停止读取。")
+    match = _PRICE.fullmatch(current.text)
+    if match is None: raise SkuSelectionError("规格面板现价格式失效，已停止读取。")
+    return match.group(1)
+
+
+def _option(nodes: list[_Node], dimension: str, expected: str) -> _Node:
+    _panel(nodes)
+    return _one([n for n in _options(nodes, dimension) if _label(n) == expected], "规格选项不唯一或不是精确匹配，已停止操作。")
+
+
+def _selected(nodes: list[_Node], dimension: str, expected: str) -> None:
+    if _selected_label(nodes, dimension) != expected:
+        raise SkuSelectionError("规格选择后读回的 selected 文案不一致，已停止操作。")
+
+
+def _selected_label(nodes: list[_Node], dimension: str) -> str:
+    selected = [n for n in _options(nodes, dimension) if n.element.get("selected") == "true"]
+    label = _label(_one(selected, "规格维度没有唯一 selected 状态，已停止操作。"))
+    if label is None: raise SkuSelectionError("规格维度 selected 文案无效，已停止操作。")
+    return label
+
+
+def _post_color(nodes: list[_Node], expected: str) -> None:
+    _panel(nodes)
+    _selected(nodes, "color", expected)
+    _selected_label(nodes, "size")
+
+
+def _post_all_targets(nodes: list[_Node], expected_size: str) -> None:
+    _panel(nodes)
+    _selected(nodes, "color", _TARGET_COLOR_UI)
+    _selected(nodes, "size", expected_size)
+
+
+def _options(nodes: list[_Node], dimension: str) -> list[_Node]:
+    container = _color_container(nodes) if dimension == "color" else _size_container(nodes) if dimension == "size" else None
+    if container is None: raise SkuSelectionError("未知规格维度，已停止操作。")
+    candidates = [n for n in nodes if _descendant(n, container) and _contained(n, container) and _choice(n) and _label(n) is not None]
+    return [n for n in candidates if not _labeled_ancestor(n, candidates)]
+
+
+def _color_container(nodes: list[_Node]) -> _Node:
+    return _one([n for n in nodes if n.element.get("package") == PDD_PACKAGE and n.element.get("class") == "androidx.recyclerview.widget.RecyclerView" and n.bounds == _COLOR_REGION], "规格面板颜色容器不唯一，已停止操作。")
+
+
+def _size_container(nodes: list[_Node]) -> _Node:
+    label = _one([n for n in nodes if n.text == _SIZE and n.bounds == _SIZE_LABEL and _readonly(n)], "规格面板尺码标签不唯一，已停止操作。")
+    header = label.parent
+    if header is None or header.element.get("package") != PDD_PACKAGE or header.element.get("class") != "android.widget.LinearLayout" or header.bounds != _SIZE_HEADER or header.parent is None:
+        raise SkuSelectionError("规格面板尺码标题容器不符合已取证结构，已停止操作。")
+    return _one([n for n in nodes if n.parent is header.parent and n.element.get("package") == PDD_PACKAGE and n.element.get("class") == "android.widget.LinearLayout" and n.bounds == _SIZE_OPTIONS], "规格面板尺码选项容器不唯一，已停止操作。")
+
+
+def _label(node: _Node) -> str | None:
+    values = {value for value in (node.text, node.desc) if value}
+    return values.pop() if len(values) == 1 else None
+
+
+def _labeled_ancestor(node: _Node, candidates: list[_Node]) -> bool:
+    ids, parent = {id(n.element) for n in candidates}, node.parent
+    while parent is not None:
+        if id(parent.element) in ids and _label(parent) is not None: return True
+        parent = parent.parent
+    return False
+
+
+def _descendant(node: _Node, ancestor: _Node) -> bool:
+    parent = node.parent
+    while parent is not None:
+        if parent.element is ancestor.element: return True
+        parent = parent.parent
+    return False
+
+
+def _contained(node: _Node, container: _Node) -> bool:
+    left, top, right, bottom = _action_bounds(node.bounds)
+    outer_left, outer_top, outer_right, outer_bottom = _action_bounds(container.bounds)
+    return outer_left <= left < right <= outer_right and outer_top <= top < bottom <= outer_bottom
+
+
+def _clickable_ancestor(node: _Node) -> bool:
+    parent = node.parent
+    while parent is not None:
+        if parent.element.get("clickable") == "true": return True
+        parent = parent.parent
+    return False
+
+
+def _readonly(node: _Node) -> bool:
+    return node.element.get("package") == PDD_PACKAGE and node.element.get("class") == "android.widget.TextView" and node.element.get("clickable") == "false" and node.element.get("enabled") == "true" and node.element.get("visible-to-user") == "true"
+
+
+def _live(node: _Node) -> bool:
+    return node.element.get("package") == PDD_PACKAGE and node.element.get("clickable") == "true" and node.element.get("enabled") == "true" and node.element.get("visible-to-user") == "true" and bool(node.bounds)
+
+
+def _choice(node: _Node) -> bool:
+    return _live(node) and node.element.get("class") == "android.view.ViewGroup" and node.element.get("selected") in {"true", "false"}
+
+
+def _eligible_entries(nodes: list[_Node]) -> list[_Node]:
+    # 入口文本本身不可点击：必须逐层证明它仍位于已取证的唯一可点击祖先中，但动作坐标继续
+    # 使用文本子节点的窄 bounds，避免把同一祖先内未知区域变成坐标兜底。“免拼购买”等底部
+    # 容器既不属于这条祖先链，也绝不能作为替代入口。
+    if any(node.bounds == _PRICE_PARENT for node in nodes): return []
+    entry_labels = [
+        node for node in nodes
+        if node.text == _ENTRY
+        and node.element.get("package") == PDD_PACKAGE
+        and node.element.get("class") == "android.widget.TextView"
+    ]
+    if len(entry_labels) != 1:
+        return entry_labels
+    action_ancestors = [
+        node for node in nodes
+        if _exact_entry_node(node, "android.view.ViewGroup", _ENTRY_ACTION_BOUNDS, "true")
+    ]
+    if len(action_ancestors) != 1:
+        return []
+    action_ancestor = action_ancestors[0]
+    entries: list[_Node] = []
+    for node in entry_labels:
+        if not _exact_entry_node(node, "android.widget.TextView", _ENTRY_TEXT_BOUNDS, "false"):
+            return []
+        inner = node.parent
+        switcher = inner.parent if inner is not None else None
+        frame = switcher.parent if switcher is not None else None
+        ancestor = frame.parent if frame is not None else None
+        if (
+            inner is not None
+            and _exact_entry_node(inner, "android.view.ViewGroup", _ENTRY_INNER_BOUNDS, "false")
+            and switcher is not None
+            and _exact_entry_node(switcher, "android.widget.ViewSwitcher", _ENTRY_INNER_BOUNDS, "false")
+            and frame is not None
+            and _exact_entry_node(frame, "android.widget.FrameLayout", _ENTRY_INNER_BOUNDS, "false")
+            and ancestor is action_ancestor
+        ):
+            entries.append(node)
+    return entries
+
+
+def _exact_entry_node(node: _Node, class_name: str, bounds: str, clickable: str) -> bool:
+    return (
+        node.element.get("package") == PDD_PACKAGE
+        and node.element.get("class") == class_name
+        and node.bounds == bounds
+        and node.element.get("clickable") == clickable
+        and node.element.get("enabled") == "true"
+        and node.element.get("visible-to-user") == "true"
+    )
+
+
+def _action_bounds(bounds: str) -> tuple[int, int, int, int]:
+    match = _BOUNDS.fullmatch(bounds)
+    if match is None: raise SkuSelectionError("规格节点坐标格式无效，已停止操作。")
+    left, top, right, bottom = (int(item) for item in match.groups())
+    if not (0 <= left < right <= _W and 0 <= top < bottom <= _H):
+        raise SkuSelectionError("规格节点坐标不在已取证屏幕范围内，已停止操作。")
+    return left, top, right, bottom
+
+
+def _one(nodes: list[_Node], message: str) -> _Node:
+    if len(nodes) != 1: raise SkuSelectionError(message)
+    return nodes[0]

client/src/cmbuyer_client/pdd/sku_selection_runner.py

@@ -0,0 +1,348 @@
+"""T-103 真机运行边界：窄适配器、原始截图和无页面正文的摘要。"""
+
+from __future__ import annotations
+
+from collections.abc import Callable
+from dataclasses import dataclass
+from datetime import UTC, datetime
+from hashlib import sha256
+import json
+from math import isfinite
+import os
+from pathlib import Path
+import shutil
+from time import monotonic
+from typing import Any
+from uuid import uuid4
+
+from PIL import Image, UnidentifiedImageError
+
+from adbutils.errors import AdbTimeout
+from uiautomator2.exceptions import HTTPTimeoutError
+
+from ..device.adb import AdbClient, DeviceConnectionError, DeviceInspection
+from ..device.baseline import PDD_PACKAGE, SCREENSHOT_PARAMS, _save_base64_screenshot, _sha256_file
+from .product_open import EXPECTED_PDD_VERSION
+from .product_url import ProductUrl, parse_product_url
+from .sku_selection import (
+    EXPECTED_GOODS_ID,
+    EXPECTED_UNIT_PRICE,
+    SkuPanelDevice,
+    SkuSelectionError,
+    SkuSelectionFlow,
+    _action_bounds,
+    resolve_task_selection,
+)
+
+
+EXPECTED_DEVICE_MODEL = "PKG110"
+EXPECTED_ANDROID_VERSION = "16"
+EXPECTED_SCREEN_SIZE = (1080, 2376)
+
+
+class SkuSelectionRunError(RuntimeError):
+    """T-103 运行未完整完成；错误文本不携带设备或页面原文。"""
+
+
+class SkuSelectionRunTimeoutError(SkuSelectionRunError):
+    """设备 RPC 或操作超时。"""
+
+
+class SkuSelectionScreenshotError(SkuSelectionRunError):
+    """原始截图无法作为完整 PNG 原子发布。"""
+
+
+class SkuSelectionUnexpectedPriceError(SkuSelectionRunError):
+    """取证面板现价不是本任务已确认值。"""
+
+
+class SkuSelectionDeviceAdapterError(SkuSelectionRunError):
+    """第三方设备接口失败的脱敏映射。"""
+
+
+@dataclass(frozen=True)
+class SkuSelectionRunResult:
+    """已发布的截图和无页面正文 manifest 摘要。"""
+
+    output_directory: Path
+    screenshot_path: Path
+    manifest_path: Path
+    unit_price: str
+
+
+class UiautomatorSkuPanelAdapter(SkuPanelDevice):
+    """把 uiautomator2 缩为 T-103 所需的读取与三种命名操作。
+
+    ``tap_sku_entry``、``tap_sku_option`` 和 ``leave_sku_panel`` 是仅有的状态改变方法；
+    坐标由 Flow 和本类双重检查后才计算中心点，每次调用只执行一次底层动作。
+    """
+
+    def __init__(self, device: Any, timeout_seconds: float) -> None:
+        if not _is_positive_finite(timeout_seconds):
+            raise ValueError("timeout_seconds 必须是大于 0 的有限数值")
+        self._device = device
+        self._timeout_seconds = timeout_seconds
+        self._entry_was_tapped = False
+        self._left_panel = False
+
+    @property
+    def entry_was_tapped(self) -> bool:
+        """仅供运行器决定故障后的单次尽力返回，不是页面操作。"""
+
+        return self._entry_was_tapped
+
+    @property
+    def left_panel(self) -> bool:
+        return self._left_panel
+
+    def app_info(self, package_name: str) -> dict[str, Any]:
+        value = self._call("app_info", package_name)
+        if not isinstance(value, dict):
+            raise SkuSelectionDeviceAdapterError("无法读取应用版本，已停止操作。")
+        return value
+
+    def app_current(self) -> dict[str, Any]:
+        value = self._call("app_current")
+        if not isinstance(value, dict):
+            raise SkuSelectionDeviceAdapterError("无法读取前台应用，已停止操作。")
+        return value
+
+    def dump_window_hierarchy(self) -> str:
+        value = self._call("jsonrpc_call", "dumpWindowHierarchy", [False, 50], timeout=self._timeout_seconds)
+        if not isinstance(value, str):
+            raise SkuSelectionDeviceAdapterError("节点树读取失败，已停止操作。")
+        return value
+
+    def tap_sku_entry(self, bounds: str) -> None:
+        # 超时也可能表示底层事件已经送达；必须先封存 attempt，后续绝不重试该入口。
+        self._entry_was_tapped = True
+        self._tap_bounds_once(bounds)
+
+    def tap_sku_option(self, bounds: str) -> None:
+        self._tap_bounds_once(bounds)
+
+    def leave_sku_panel(self) -> None:
+        if self._left_panel:
+            raise SkuSelectionDeviceAdapterError("规格面板已经执行过返回，已停止操作。")
+        # 底层调用即使报错也可能已把返回事件送达；先封存本次机会，finally 不得再次返回。
+        self._left_panel = True
+        self._call("jsonrpc_call", "pressKey", ["back"], timeout=self._timeout_seconds)
+
+    def capture_screenshot(self) -> str:
+        value = self._call("jsonrpc_call", "takeScreenshot", SCREENSHOT_PARAMS, timeout=self._timeout_seconds)
+        if not isinstance(value, str):
+            raise SkuSelectionScreenshotError("规格面板原始截图读取失败，未发布任何证据产物。")
+        return value
+
+    def display_size(self) -> tuple[int, int]:
+        value = self._call("window_size")
+        if not isinstance(value, tuple) or len(value) != 2 or any(not isinstance(item, int) for item in value):
+            raise SkuSelectionDeviceAdapterError("无法读取屏幕坐标空间，已停止操作。")
+        return value
+
+    def _tap_bounds_once(self, bounds: str) -> None:
+        left, top, right, bottom = _action_bounds(bounds)
+        center_x = left + (right - left) // 2
+        center_y = top + (bottom - top) // 2
+        self._call("jsonrpc_call", "click", [center_x, center_y], timeout=self._timeout_seconds)
+
+    def _call(self, method: str, *args: Any, **kwargs: Any) -> Any:
+        try:
+            operation = getattr(self._device, method)
+            return operation(*args, **kwargs)
+        except (AdbTimeout, HTTPTimeoutError, TimeoutError) as error:
+            raise SkuSelectionRunTimeoutError("规格面板设备操作超时，已停止操作。") from error
+        except SkuSelectionRunError:
+            raise
+        except Exception as error:
+            raise SkuSelectionDeviceAdapterError("规格面板设备操作失败，已停止操作。") from error
+
+
+class SkuSelectionRunner:
+    """只运行 T-103 目标规格恢复、价格确认、原始截图和一次安全退出。"""
+
+    def __init__(
+        self,
+        adb_client: AdbClient,
+        connector: Callable[[str], Any],
+        timeout_seconds: float,
+        monotonic_clock: Callable[[], float] = monotonic,
+    ) -> None:
+        if not _is_positive_finite(timeout_seconds):
+            raise ValueError("timeout_seconds 必须是大于 0 的有限数值")
+        self._adb_client = adb_client
+        self._connector = connector
+        self._timeout_seconds = timeout_seconds
+        self._monotonic_clock = monotonic_clock
+
+    def run(
+        self,
+        serial: str,
+        product_url: str,
+        task_color: str,
+        task_size: str,
+        output_directory: Path,
+    ) -> SkuSelectionRunResult:
+        link = parse_product_url(product_url)
+        if link.goods_id != EXPECTED_GOODS_ID:
+            raise SkuSelectionRunError("商品不是 T-103 已取证目标，已停止操作。")
+        selection = resolve_task_selection(task_color, task_size)
+        target = Path(output_directory)
+        _validate_new_target(target)
+
+        adapter: UiautomatorSkuPanelAdapter | None = None
+        flow: SkuSelectionFlow | None = None
+        staging = _prepare_staging(target)
+        deadline = self._monotonic_clock() + self._timeout_seconds
+        try:
+            inspection = self._adb_client.inspect(serial)
+            _require_expected_device(inspection)
+            adapter = UiautomatorSkuPanelAdapter(self._connector(serial), self._timeout_seconds)
+            _require_expected_version(adapter.app_info(PDD_PACKAGE))
+            if adapter.display_size() != EXPECTED_SCREEN_SIZE:
+                raise SkuSelectionRunError("设备不是已取证的竖屏坐标空间，已停止操作。")
+            pre_intent_hierarchy = adapter.dump_window_hierarchy()
+            # 固定 ACTION_VIEW、固定 PDD package 和 canonical goods_id；不接受任意 URL 或 shell。
+            self._adb_client.start_pdd_view_intent(serial, link.goods_id)
+
+            remaining = deadline - self._monotonic_clock()
+            if remaining <= 0:
+                raise SkuSelectionRunTimeoutError("等待规格入口超时，未执行点击。")
+            flow = SkuSelectionFlow(adapter, entry_wait_timeout_seconds=remaining)
+            flow.open_sku_panel(link.canonical_url, pre_intent_hierarchy)
+            flow.select_sku_options(selection)
+            unit_price = flow.verify_target_selection_and_read_price(selection)
+            if unit_price != EXPECTED_UNIT_PRICE:
+                raise SkuSelectionUnexpectedPriceError("规格面板现价不是本任务已确认值，已停止操作。")
+
+            screenshot_path = staging / "screenshot.png"
+            try:
+                _save_base64_screenshot(adapter.capture_screenshot(), screenshot_path)
+                _require_screenshot_size(screenshot_path)
+            except SkuSelectionRunError:
+                raise
+            except Exception as error:
+                raise SkuSelectionScreenshotError("规格面板原始截图保存失败，未发布任何证据产物。") from error
+
+            manifest_path = staging / "manifest.json"
+            # 截图可能落在动态页面切换边界；发布前必须用一棵更新节点树同时重证两维和现价。
+            final_price = flow.verify_target_selection_and_read_price(selection)
+            if final_price != EXPECTED_UNIT_PRICE:
+                raise SkuSelectionUnexpectedPriceError("截图后规格面板现价不是本任务已确认值，已停止操作。")
+            # 正常路径仍经 Flow 做最后一次前台和面板判定；返回操作只发生一次。
+            flow.exit_sku_panel_safely()
+            manifest_path.write_text(
+                json.dumps(_manifest(inspection, serial, link, screenshot_path, task_color, task_size), ensure_ascii=False, indent=2, sort_keys=True) + "\n",
+                encoding="utf-8",
+            )
+            # Windows 的 rename 不替换既有目标；并发创建 target 时保留其内容并把本次运行判失败。
+            os.rename(staging, target)
+            staging = None
+        except (DeviceConnectionError, SkuSelectionRunError, SkuSelectionError):
+            _clean_staging(staging)
+            raise
+        except (AdbTimeout, HTTPTimeoutError, TimeoutError) as error:
+            _clean_staging(staging)
+            raise SkuSelectionRunTimeoutError("规格面板运行超时，未发布任何证据产物。") from error
+        except OSError as error:
+            _clean_staging(staging)
+            raise SkuSelectionRunError("规格面板证据目录无法创建或发布，未发布任何证据产物。") from error
+        except Exception as error:
+            _clean_staging(staging)
+            raise SkuSelectionRunError("规格面板运行未完成，未发布任何证据产物。") from error
+        finally:
+            # 失败路径只能复用 Flow 的版本、前台和面板证明；证明不了便停止，绝不盲目返回。
+            if flow is not None and adapter is not None and adapter.entry_was_tapped and not adapter.left_panel:
+                try:
+                    flow.reconcile_pending_action()
+                    flow.exit_sku_panel_safely()
+                except (SkuSelectionRunError, SkuSelectionError):
+                    pass
+
+        return SkuSelectionRunResult(
+            output_directory=target,
+            screenshot_path=target / "screenshot.png",
+            manifest_path=target / "manifest.json",
+            unit_price=EXPECTED_UNIT_PRICE,
+        )
+
+
+def _is_positive_finite(value: object) -> bool:
+    return isinstance(value, (int, float)) and not isinstance(value, bool) and value > 0 and isfinite(value)
+
+
+def _validate_new_target(target: Path) -> None:
+    if target.exists():
+        raise SkuSelectionRunError("输出目录已存在；为防止覆盖旧证据，已停止操作。")
+    if not target.name:
+        raise SkuSelectionRunError("输出目录必须是明确的新目录。")
+
+
+def _prepare_staging(target: Path) -> Path:
+    staging: Path | None = None
+    try:
+        target.parent.mkdir(parents=True, exist_ok=True)
+        staging = target.parent / f".{target.name}.staging-{uuid4().hex}"
+        staging.mkdir()
+        probe = staging / ".write-probe"
+        probe.write_bytes(b"ok")
+        probe.unlink()
+        return staging
+    except OSError as error:
+        _clean_staging(staging)
+        raise SkuSelectionRunError("输出目录不可写，已停止操作。") from error
+
+
+def _clean_staging(staging: Path | None) -> None:
+    if staging is not None and staging.exists():
+        shutil.rmtree(staging)
+
+
+def _require_expected_version(app_info: object) -> str:
+    version = (app_info.get("versionName") or app_info.get("version_name")) if isinstance(app_info, dict) else None
+    if version != EXPECTED_PDD_VERSION:
+        raise SkuSelectionRunError("拼多多版本与已取证版本不一致，已停止操作。")
+    return version
+
+
+def _require_expected_device(inspection: DeviceInspection) -> None:
+    if inspection.model != EXPECTED_DEVICE_MODEL or inspection.android_version != EXPECTED_ANDROID_VERSION:
+        raise SkuSelectionRunError("设备型号或 Android 版本不是已取证组合，已停止操作。")
+
+
+def _require_screenshot_size(screenshot_path: Path) -> None:
+    try:
+        with Image.open(screenshot_path) as image:
+            image.load()
+            if image.size != EXPECTED_SCREEN_SIZE:
+                raise SkuSelectionScreenshotError("原始截图坐标空间不是已取证尺寸，未发布任何证据产物。")
+    except SkuSelectionRunError:
+        raise
+    except (UnidentifiedImageError, OSError) as error:
+        raise SkuSelectionScreenshotError("原始截图无效，未发布任何证据产物。") from error
+
+
+def _manifest(inspection: DeviceInspection, serial: str, link: ProductUrl, screenshot_path: Path, task_color: str, task_size: str) -> dict[str, Any]:
+    """仅写可审计摘要；原始 serial、节点树、页面文案和实际截图内容均不写入 manifest。"""
+
+    return {
+        "schema_version": 1,
+        "captured_at": datetime.now(UTC).isoformat(),
+        "operation": "t103-sku-selection",
+        "product": {"goods_id": link.goods_id, "canonical_url": link.canonical_url},
+        "target_selection": {"color": task_color, "size": task_size},
+        "unit_price": EXPECTED_UNIT_PRICE,
+        "selection_status": "restored",
+        "panel_status": "verified",
+        "safe_exit": "completed",
+        "page_identity": "human_review_required",
+        "channel": "wifi" if ":" in serial else "usb",
+        "serial_sha256": sha256(serial.encode("utf-8")).hexdigest(),
+        "device": {
+            "model": inspection.model,
+            "android_version": inspection.android_version,
+            "pdd_package": PDD_PACKAGE,
+            "pdd_version": EXPECTED_PDD_VERSION,
+        },
+        "artifacts": [{"path": screenshot_path.name, "sha256": _sha256_file(screenshot_path)}],
+    }

client/tests/device/__init__.py

@@ -0,0 +1 @@
+"""设备连接与基线取证的离线测试。"""

client/tests/device/test_adb.py

@@ -0,0 +1,273 @@
+"""ADB 设备边界测试：所有命令执行器均为 mock，不连接真机。"""
+
+from __future__ import annotations
+
+from collections.abc import Sequence
+from pathlib import Path
+import subprocess
+import sys
+import unittest
+
+
+CLIENT_ROOT = Path(__file__).resolve().parents[2]
+sys.path.insert(0, str(CLIENT_ROOT / "src"))
+
+from cmbuyer_client.device.adb import (
+    AdbClient,
+    CommandResult,
+    DeviceIdentityUnconfirmedError,
+    DeviceCommandError,
+    DeviceCommandTimeoutError,
+    DeviceNotFoundError,
+    DeviceOfflineError,
+    DeviceStateError,
+    DeviceUnauthorizedError,
+    DuplicatePhysicalDeviceError,
+    IntentLaunchUnconfirmedError,
+    SerialRequiredError,
+)
+
+
+USB_SERIAL = "3B65BD02H7F00000"
+WIFI_SERIAL = "192.168.0.173:5555"
+
+
+class FakeRunner:
+    def __init__(self, devices_output: str, properties: dict[tuple[str, str], CommandResult | str]) -> None:
+        self.devices_output = devices_output
+        self.properties = properties
+        self.calls: list[tuple[str, ...]] = []
+
+    def run(self, arguments: Sequence[str], timeout_seconds: float) -> CommandResult:
+        self.calls.append(tuple(arguments))
+        if tuple(arguments) == ("devices", "-l"):
+            return CommandResult(stdout=self.devices_output)
+        key = (arguments[1], arguments[-1])
+        value = self.properties.get(key, "")
+        return value if isinstance(value, CommandResult) else CommandResult(stdout=value)
+
+
+def _properties(serials: tuple[str, ...]) -> dict[tuple[str, str], str]:
+    values: dict[tuple[str, str], str] = {}
+    for serial in serials:
+        values[(serial, "ro.serialno")] = "physical-phone-1"
+        values[(serial, "ro.boot.serialno")] = "physical-phone-1"
+        values[(serial, "ro.product.model")] = "PKG110"
+        values[(serial, "ro.product.name")] = "PKG110"
+        values[(serial, "ro.product.device")] = "OP5D2BL1"
+        values[(serial, "ro.build.version.release")] = "16"
+    return values
+
+
+class AdbClientTests(unittest.TestCase):
+    def test_requires_explicit_serial(self) -> None:
+        runner = FakeRunner("List of devices attached\n", {})
+
+        with self.assertRaises(SerialRequiredError):
+            AdbClient(runner).inspect("   ")
+
+        self.assertEqual(runner.calls, [])
+
+    def test_missing_offline_and_unauthorized_are_distinct(self) -> None:
+        missing = AdbClient(FakeRunner("List of devices attached\n", {}))
+        with self.assertRaises(DeviceNotFoundError):
+            missing.inspect(USB_SERIAL)
+
+        offline = AdbClient(FakeRunner(f"List of devices attached\n{USB_SERIAL}\toffline\n", {}))
+        with self.assertRaises(DeviceOfflineError):
+            offline.inspect(USB_SERIAL)
+
+        unauthorized = AdbClient(FakeRunner(f"List of devices attached\n{USB_SERIAL}\tunauthorized\n", {}))
+        with self.assertRaises(DeviceUnauthorizedError):
+            unauthorized.inspect(USB_SERIAL)
+
+    def test_two_channels_with_same_physical_identity_fail_closed(self) -> None:
+        output = (
+            "List of devices attached\n"
+            f"{WIFI_SERIAL}\tdevice product:PKG110 model:PKG110 device:OP5D2BL1\n"
+            f"{USB_SERIAL}\tdevice product:PKG110 model:PKG110 device:OP5D2BL1\n"
+        )
+        runner = FakeRunner(output, _properties((WIFI_SERIAL, USB_SERIAL)))
+
+        with self.assertRaises(DuplicatePhysicalDeviceError):
+            AdbClient(runner).inspect(USB_SERIAL)
+
+        self.assertIn(("-s", WIFI_SERIAL, "shell", "getprop", "ro.serialno"), runner.calls)
+        self.assertIn(("-s", USB_SERIAL, "shell", "getprop", "ro.serialno"), runner.calls)
+
+    def test_multiple_online_devices_with_failed_identity_fail_closed(self) -> None:
+        output = (
+            "List of devices attached\n"
+            f"{WIFI_SERIAL}\tdevice product:PKG110 model:PKG110 device:OP5D2BL1\n"
+            f"{USB_SERIAL}\tdevice product:PKG110 model:PKG110 device:OP5D2BL1\n"
+        )
+        properties = _properties((WIFI_SERIAL, USB_SERIAL))
+        properties[(WIFI_SERIAL, "ro.serialno")] = CommandResult(stdout="", returncode=1)
+        runner = FakeRunner(output, properties)
+
+        with self.assertRaises(DeviceIdentityUnconfirmedError):
+            AdbClient(runner).inspect(USB_SERIAL)
+
+    def test_online_explicit_serial_reads_non_sensitive_metadata(self) -> None:
+        output = f"List of devices attached\n{USB_SERIAL}\tdevice product:PKG110 model:PKG110 device:OP5D2BL1\n"
+        inspection = AdbClient(FakeRunner(output, _properties((USB_SERIAL,)))).inspect(USB_SERIAL)
+
+        self.assertEqual(inspection.device.serial, USB_SERIAL)
+        self.assertEqual(inspection.model, "PKG110")
+        self.assertEqual(inspection.android_version, "16")
+
+    def test_single_online_device_does_not_require_hardware_identity(self) -> None:
+        output = f"List of devices attached\n{USB_SERIAL}\tdevice product:PKG110 model:PKG110 device:OP5D2BL1\n"
+        properties = _properties((USB_SERIAL,))
+        properties[(USB_SERIAL, "ro.serialno")] = ""
+        properties[(USB_SERIAL, "ro.boot.serialno")] = ""
+
+        inspection = AdbClient(FakeRunner(output, properties)).inspect(USB_SERIAL)
+
+        self.assertEqual(inspection.model, "PKG110")
+
+    def test_multiple_online_devices_without_hardware_identity_are_unconfirmed(self) -> None:
+        output = (
+            "List of devices attached\n"
+            f"{WIFI_SERIAL}\tdevice product:PKG110 model:PKG110 device:OP5D2BL1\n"
+            f"{USB_SERIAL}\tdevice product:PKG110 model:PKG110 device:OP5D2BL1\n"
+        )
+        properties = _properties((WIFI_SERIAL, USB_SERIAL))
+        properties[(WIFI_SERIAL, "ro.serialno")] = ""
+        properties[(WIFI_SERIAL, "ro.boot.serialno")] = ""
+
+        with self.assertRaises(DeviceIdentityUnconfirmedError):
+            AdbClient(FakeRunner(output, properties)).inspect(USB_SERIAL)
+
+    def test_multiple_online_devices_with_different_identity_keep_explicit_selection(self) -> None:
+        output = (
+            "List of devices attached\n"
+            f"{WIFI_SERIAL}\tdevice product:PKG110 model:PKG110 device:OP5D2BL1\n"
+            f"{USB_SERIAL}\tdevice product:PKG110 model:PKG110 device:OP5D2BL1\n"
+        )
+        properties = _properties((WIFI_SERIAL, USB_SERIAL))
+        properties[(WIFI_SERIAL, "ro.serialno")] = "physical-phone-2"
+        properties[(WIFI_SERIAL, "ro.boot.serialno")] = "physical-phone-2"
+
+        inspection = AdbClient(FakeRunner(output, properties)).inspect(USB_SERIAL)
+
+        self.assertEqual(inspection.device.serial, USB_SERIAL)
+
+    def test_shared_boot_serial_is_duplicate_even_when_ro_serial_differs(self) -> None:
+        output = (
+            "List of devices attached\n"
+            f"{WIFI_SERIAL}\tdevice product:PKG110 model:PKG110 device:OP5D2BL1\n"
+            f"{USB_SERIAL}\tdevice product:PKG110 model:PKG110 device:OP5D2BL1\n"
+        )
+        properties = _properties((WIFI_SERIAL, USB_SERIAL))
+        properties[(WIFI_SERIAL, "ro.serialno")] = "wifi-transport-serial"
+        properties[(USB_SERIAL, "ro.serialno")] = "usb-transport-serial"
+        properties[(WIFI_SERIAL, "ro.boot.serialno")] = "shared-hardware-serial"
+        properties[(USB_SERIAL, "ro.boot.serialno")] = "shared-hardware-serial"
+
+        with self.assertRaises(DuplicatePhysicalDeviceError):
+            AdbClient(FakeRunner(output, properties)).inspect(USB_SERIAL)
+
+    def test_unknown_adb_state_is_rejected(self) -> None:
+        client = AdbClient(FakeRunner(f"List of devices attached\n{USB_SERIAL}\trecovery\n", {}))
+
+        with self.assertRaises(DeviceStateError):
+            client.inspect(USB_SERIAL)
+
+    def test_runner_timeout_is_a_distinct_connection_error(self) -> None:
+        class TimeoutRunner:
+            def run(self, arguments: Sequence[str], timeout_seconds: float) -> CommandResult:
+                raise subprocess.TimeoutExpired(arguments, timeout_seconds)
+
+        with self.assertRaises(DeviceCommandTimeoutError):
+            AdbClient(TimeoutRunner()).inspect(USB_SERIAL)
+
+    def test_product_intent_is_fixed_to_action_view_and_pdd_package(self) -> None:
+        class IntentRunner:
+            def __init__(self) -> None:
+                self.calls: list[tuple[str, ...]] = []
+
+            def run(self, arguments: Sequence[str], timeout_seconds: float) -> CommandResult:
+                self.calls.append(tuple(arguments))
+                return CommandResult(stdout="Status: ok\n")
+
+        runner = IntentRunner()
+        summary = AdbClient(runner).start_pdd_view_intent(
+            USB_SERIAL,
+            "123",
+        )
+
+        self.assertEqual(summary.status, "ok")
+        self.assertEqual(
+            runner.calls,
+            [
+                (
+                    "-s",
+                    USB_SERIAL,
+                    "shell",
+                    "am",
+                    "start",
+                    "-W",
+                    "-a",
+                    "android.intent.action.VIEW",
+                    "-d",
+                    "https://mobile.yangkeduo.com/goods.html?goods_id=123",
+                    "-p",
+                    "com.xunmeng.pinduoduo",
+                )
+            ],
+        )
+
+    def test_product_intent_without_explicit_success_is_rejected(self) -> None:
+        class UnknownIntentRunner:
+            def run(self, arguments: Sequence[str], timeout_seconds: float) -> CommandResult:
+                return CommandResult(stdout="Starting: Intent { ... }\n")
+
+        with self.assertRaises(IntentLaunchUnconfirmedError):
+            AdbClient(UnknownIntentRunner()).start_pdd_view_intent(
+                USB_SERIAL,
+                "123",
+            )
+
+    def test_product_intent_rejects_invalid_goods_id_before_runner(self) -> None:
+        class RecordingRunner:
+            def __init__(self) -> None:
+                self.calls: list[tuple[str, ...]] = []
+
+            def run(self, arguments: Sequence[str], timeout_seconds: float) -> CommandResult:
+                self.calls.append(tuple(arguments))
+                return CommandResult(stdout="Status: ok\n")
+
+        invalid_values: tuple[object, ...] = (
+            "",
+            "12a",
+            "１２３",
+            " 123",
+            "123 ",
+            "https://mobile.yangkeduo.com/goods.html?goods_id=123",
+            "am start -W -d anything",
+            123,
+            None,
+        )
+        for value in invalid_values:
+            with self.subTest(value=repr(value)):
+                runner = RecordingRunner()
+                with self.assertRaises(ValueError):
+                    AdbClient(runner).start_pdd_view_intent(USB_SERIAL, value)  # type: ignore[arg-type]
+                self.assertEqual(runner.calls, [])
+
+    def test_product_intent_nonzero_and_timeout_remain_distinct(self) -> None:
+        class FailedIntentRunner:
+            def run(self, arguments: Sequence[str], timeout_seconds: float) -> CommandResult:
+                return CommandResult(stdout="sensitive command output", returncode=1)
+
+        class TimeoutIntentRunner:
+            def run(self, arguments: Sequence[str], timeout_seconds: float) -> CommandResult:
+                raise subprocess.TimeoutExpired(arguments, timeout_seconds)
+
+        with self.assertRaises(DeviceCommandError) as command_error:
+            AdbClient(FailedIntentRunner()).start_pdd_view_intent(USB_SERIAL, "123")
+        self.assertNotIn("sensitive command output", str(command_error.exception))
+
+        with self.assertRaises(DeviceCommandTimeoutError):
+            AdbClient(TimeoutIntentRunner()).start_pdd_view_intent(USB_SERIAL, "123")

client/tests/device/test_baseline.py

@@ -0,0 +1,281 @@
+"""基线取证测试：mock ADB/uiautomator2，不连接手机。"""
+
+from __future__ import annotations
+
+from pathlib import Path
+import base64
+from io import BytesIO
+import sys
+import tempfile
+import unittest
+
+from PIL import Image
+from uiautomator2.exceptions import HTTPTimeoutError
+
+
+CLIENT_ROOT = Path(__file__).resolve().parents[2]
+sys.path.insert(0, str(CLIENT_ROOT / "src"))
+sys.path.insert(0, str(CLIENT_ROOT / "scripts"))
+
+from cmbuyer_client.device.adb import AdbDevice, DeviceInspection
+from cmbuyer_client.device.baseline import (
+    BaselineCaptureError,
+    BaselineCaptureTimeoutError,
+    DeviceBaselineCapturer,
+    NoReconnectUiautomatorConnector,
+    PDD_PACKAGE,
+)
+from capture_device_baseline import parse_arguments, validate_arguments
+
+
+SERIAL = "USB-serial-for-test"
+
+
+class StaticAdbClient:
+    def __init__(self) -> None:
+        self.serials: list[str] = []
+
+    def inspect(self, serial: str) -> DeviceInspection:
+        self.serials.append(serial)
+        return DeviceInspection(
+            device=AdbDevice(serial=serial, state="device", model="Test Model"),
+            model="Test Model",
+            android_version="16",
+        )
+
+
+class FakeUiDevice:
+    def __init__(self, fail_dump: bool = False) -> None:
+        self.fail_dump = fail_dump
+        self.rpc_calls: list[tuple[str, object, float]] = []
+        self.app_info_calls: list[str] = []
+
+    def app_info(self, package_name: str) -> dict[str, str]:
+        self.app_info_calls.append(package_name)
+        return {"versionName": "8.17.0"}
+
+    def jsonrpc_call(self, method: str, params: object = None, timeout: float = 10) -> str:
+        self.rpc_calls.append((method, params, timeout))
+        if method == "takeScreenshot":
+            image_data = BytesIO()
+            Image.new("RGB", (1, 1), color="white").save(image_data, format="PNG")
+            return base64.b64encode(image_data.getvalue()).decode("ascii")
+        if method != "dumpWindowHierarchy":
+            raise AssertionError(f"unexpected method: {method}")
+        if self.fail_dump:
+            raise RuntimeError("mock dump failed")
+        return "<hierarchy><node text='page body must stay out of manifest'/></hierarchy>"
+
+
+class BaselineCaptureTests(unittest.TestCase):
+    def test_capture_writes_hashes_without_xml_or_raw_serial_in_manifest(self) -> None:
+        adb = StaticAdbClient()
+        device = FakeUiDevice()
+        capturer = DeviceBaselineCapturer(adb, lambda serial: device, timeout_seconds=7.5)
+
+        with tempfile.TemporaryDirectory() as directory:
+            output = Path(directory) / "baseline"
+            result = capturer.capture(SERIAL, output)
+            manifest = result.manifest_path.read_text(encoding="utf-8")
+
+            self.assertEqual(adb.serials, [SERIAL])
+            self.assertEqual(device.app_info_calls, [PDD_PACKAGE])
+            self.assertEqual(
+                device.rpc_calls,
+                [
+                    ("takeScreenshot", [1, 80], 7.5),
+                    ("dumpWindowHierarchy", [False, 50], 7.5),
+                ],
+            )
+            self.assertTrue(result.screenshot_path.is_file())
+            self.assertTrue(result.hierarchy_path.is_file())
+            self.assertIn('"sha256"', manifest)
+            self.assertNotIn("page body must stay out of manifest", manifest)
+            self.assertNotIn(SERIAL, manifest)
+            self.assertIn('"channel": "usb"', manifest)
+
+    def test_capture_failure_cleans_staging_and_does_not_publish_partial_output(self) -> None:
+        device = FakeUiDevice(fail_dump=True)
+        capturer = DeviceBaselineCapturer(StaticAdbClient(), lambda serial: device, timeout_seconds=5)
+
+        with tempfile.TemporaryDirectory() as directory:
+            parent = Path(directory)
+            output = parent / "baseline"
+            with self.assertRaises(BaselineCaptureError) as raised:
+                capturer.capture(SERIAL, output)
+
+            self.assertFalse(output.exists())
+            self.assertEqual(list(parent.iterdir()), [])
+            self.assertNotIn("mock dump failed", str(raised.exception))
+
+    def test_existing_output_is_never_overwritten(self) -> None:
+        with tempfile.TemporaryDirectory() as directory:
+            output = Path(directory) / "baseline"
+            output.mkdir()
+            sentinel = output / "keep.txt"
+            sentinel.write_text("preserve", encoding="utf-8")
+            capturer = DeviceBaselineCapturer(StaticAdbClient(), lambda serial: FakeUiDevice(), timeout_seconds=5)
+
+            with self.assertRaises(BaselineCaptureError):
+                capturer.capture(SERIAL, output)
+            self.assertEqual(sentinel.read_text(encoding="utf-8"), "preserve")
+
+    def test_no_reconnect_connector_passes_only_current_adb_device_object(self) -> None:
+        class ListedDevice:
+            serial = SERIAL
+
+        listed = ListedDevice()
+        connected: list[object] = []
+
+        connector = NoReconnectUiautomatorConnector(lambda: [listed], lambda device: connected.append(device) or FakeUiDevice())
+        connector(SERIAL)
+
+        self.assertEqual(connected, [listed])
+
+    def test_no_reconnect_connector_refuses_disappeared_serial(self) -> None:
+        connector = NoReconnectUiautomatorConnector(lambda: [], lambda device: FakeUiDevice())
+
+        with self.assertRaises(BaselineCaptureError) as raised:
+            connector(SERIAL)
+        self.assertIn("拒绝自动重连", str(raised.exception))
+
+    def test_connector_exception_is_redacted_and_publishes_no_partial_output(self) -> None:
+        def failing_connector(serial: str) -> FakeUiDevice:
+            raise RuntimeError(f"third party leaked {serial}")
+
+        capturer = DeviceBaselineCapturer(StaticAdbClient(), failing_connector, timeout_seconds=5)
+        with tempfile.TemporaryDirectory() as directory:
+            output = Path(directory) / "baseline"
+            with self.assertRaises(BaselineCaptureError) as raised:
+                capturer.capture(SERIAL, output)
+
+            self.assertNotIn(SERIAL, str(raised.exception))
+            self.assertFalse(output.exists())
+            self.assertEqual(list(Path(directory).iterdir()), [])
+
+    def test_invalid_screenshot_base64_syntax_fails_closed_without_partial_output(self) -> None:
+        class InvalidScreenshotDevice(FakeUiDevice):
+            def jsonrpc_call(self, method: str, params: object = None, timeout: float = 10) -> str:
+                if method == "takeScreenshot":
+                    valid = super().jsonrpc_call(method, params, timeout)
+                    return valid[:12] + "!" + valid[12:]
+                return super().jsonrpc_call(method, params, timeout)
+
+        capturer = DeviceBaselineCapturer(StaticAdbClient(), lambda serial: InvalidScreenshotDevice(), timeout_seconds=5)
+        with tempfile.TemporaryDirectory() as directory:
+            output = Path(directory) / "baseline"
+            with self.assertRaises(BaselineCaptureError) as raised:
+                capturer.capture(SERIAL, output)
+
+            self.assertIn("Base64 语法无效", str(raised.exception))
+            self.assertNotIn("!", str(raised.exception))
+            self.assertFalse(output.exists())
+            self.assertEqual(list(Path(directory).iterdir()), [])
+
+    def test_invalid_padding_and_unapproved_ascii_whitespace_fail_closed(self) -> None:
+        invalid_insertions = {
+            "padding": lambda value: value[:-1],
+            "vertical-tab": lambda value: value[:12] + "\v" + value[12:],
+            "form-feed": lambda value: value[:12] + "\f" + value[12:],
+        }
+
+        for name, make_invalid in invalid_insertions.items():
+            with self.subTest(name=name), tempfile.TemporaryDirectory() as directory:
+                class InvalidScreenshotDevice(FakeUiDevice):
+                    def jsonrpc_call(self, method: str, params: object = None, timeout: float = 10) -> str:
+                        value = super().jsonrpc_call(method, params, timeout)
+                        if method == "takeScreenshot":
+                            return make_invalid(value)
+                        return value
+
+                output = Path(directory) / "baseline"
+                capturer = DeviceBaselineCapturer(
+                    StaticAdbClient(),
+                    lambda serial: InvalidScreenshotDevice(),
+                    timeout_seconds=5,
+                )
+                with self.assertRaises(BaselineCaptureError) as raised:
+                    capturer.capture(SERIAL, output)
+
+                self.assertIn("Base64 语法无效", str(raised.exception))
+                self.assertNotIn(SERIAL, str(raised.exception))
+                self.assertFalse(output.exists())
+                self.assertEqual(list(Path(directory).iterdir()), [])
+
+    def test_base64_decoded_nonimage_fails_closed_without_partial_output(self) -> None:
+        class NonImageScreenshotDevice(FakeUiDevice):
+            def jsonrpc_call(self, method: str, params: object = None, timeout: float = 10) -> str:
+                if method == "takeScreenshot":
+                    return base64.b64encode(b"not an image").decode("ascii")
+                return super().jsonrpc_call(method, params, timeout)
+
+        capturer = DeviceBaselineCapturer(StaticAdbClient(), lambda serial: NonImageScreenshotDevice(), timeout_seconds=5)
+        with tempfile.TemporaryDirectory() as directory:
+            output = Path(directory) / "baseline"
+            with self.assertRaises(BaselineCaptureError) as raised:
+                capturer.capture(SERIAL, output)
+
+            self.assertIn("图像数据无效", str(raised.exception))
+            self.assertNotIn("not an image", str(raised.exception))
+            self.assertFalse(output.exists())
+            self.assertEqual(list(Path(directory).iterdir()), [])
+
+    def test_ascii_base64_whitespace_is_normalized_before_strict_decode(self) -> None:
+        class WhitespaceScreenshotDevice(FakeUiDevice):
+            def jsonrpc_call(self, method: str, params: object = None, timeout: float = 10) -> str:
+                value = super().jsonrpc_call(method, params, timeout)
+                if method == "takeScreenshot":
+                    return value[:10] + " \t\r\n" + value[10:30] + "\n" + value[30:]
+                return value
+
+        capturer = DeviceBaselineCapturer(StaticAdbClient(), lambda serial: WhitespaceScreenshotDevice(), timeout_seconds=5)
+        with tempfile.TemporaryDirectory() as directory:
+            output = Path(directory) / "baseline"
+            result = capturer.capture(SERIAL, output)
+
+            self.assertTrue(result.screenshot_path.is_file())
+            with Image.open(result.screenshot_path) as image:
+                self.assertEqual(image.size, (1, 1))
+
+    def test_invalid_or_non_hierarchy_xml_fails_closed_without_partial_output(self) -> None:
+        class InvalidHierarchyDevice(FakeUiDevice):
+            def jsonrpc_call(self, method: str, params: object = None, timeout: float = 10) -> str:
+                if method == "dumpWindowHierarchy":
+                    return "<not-hierarchy/>"
+                return super().jsonrpc_call(method, params, timeout)
+
+        capturer = DeviceBaselineCapturer(StaticAdbClient(), lambda serial: InvalidHierarchyDevice(), timeout_seconds=5)
+        with tempfile.TemporaryDirectory() as directory:
+            output = Path(directory) / "baseline"
+            with self.assertRaises(BaselineCaptureError) as raised:
+                capturer.capture(SERIAL, output)
+
+            self.assertNotIn("not-hierarchy", str(raised.exception))
+            self.assertFalse(output.exists())
+            self.assertEqual(list(Path(directory).iterdir()), [])
+
+    def test_rpc_timeout_is_distinct_redacted_and_does_not_publish_partial_output(self) -> None:
+        class TimeoutRpcDevice(FakeUiDevice):
+            def jsonrpc_call(self, method: str, params: object = None, timeout: float = 10) -> str:
+                raise HTTPTimeoutError(f"raw serial={SERIAL} xml=<hierarchy/>")
+
+        capturer = DeviceBaselineCapturer(StaticAdbClient(), lambda serial: TimeoutRpcDevice(), timeout_seconds=5)
+        with tempfile.TemporaryDirectory() as directory:
+            output = Path(directory) / "baseline"
+            with self.assertRaises(BaselineCaptureTimeoutError) as raised:
+                capturer.capture(SERIAL, output)
+
+            self.assertIn("超时", str(raised.exception))
+            self.assertNotIn(SERIAL, str(raised.exception))
+            self.assertNotIn("hierarchy", str(raised.exception))
+            self.assertFalse(output.exists())
+            self.assertEqual(list(Path(directory).iterdir()), [])
+
+    def test_cli_validation_rejects_empty_serial_and_nonpositive_timeout(self) -> None:
+        empty_serial = parse_arguments(["--serial", "", "--output-dir", "baseline"])
+        with self.assertRaisesRegex(ValueError, "非空 --serial"):
+            validate_arguments(empty_serial)
+
+        nonpositive_timeout = parse_arguments(["--serial", SERIAL, "--output-dir", "baseline", "--timeout", "0"])
+        with self.assertRaisesRegex(ValueError, "必须大于 0"):
+            validate_arguments(nonpositive_timeout)

client/tests/device/test_sku_evidence_sanitizer.py

@@ -0,0 +1,735 @@
+"""T-103 脱敏器测试：全部证据为合成数据，绝不读取真实 raw 目录。"""
+
+from __future__ import annotations
+
+from hashlib import sha256
+import json
+from pathlib import Path
+import sys
+from tempfile import TemporaryDirectory
+import unittest
+from unittest.mock import patch
+from xml.etree import ElementTree
+
+from PIL import Image
+
+
+CLIENT_ROOT = Path(__file__).resolve().parents[2]
+sys.path.insert(0, str(CLIENT_ROOT / "src"))
+
+from cmbuyer_client.device.sku_evidence_sanitizer import (
+    EXPECTED_GOODS_ID,
+    EXPECTED_SCREENSHOT_HEIGHT,
+    EXPECTED_SCREENSHOT_WIDTH,
+    EXPECTED_XML_HEIGHT,
+    EXPECTED_XML_WIDTH,
+    HUMAN_DECLARED_STATES,
+    SkuEvidenceSanitizationError,
+    sanitize_sku_panel_evidence,
+)
+
+
+TEST_SERIAL = "synthetic-serial-never-publish"
+TEST_ADDRESS = "SYNTHETIC_ADDRESS_NEVER_PUBLISH"
+FULL_PHONE = "13800138000"
+MASKED_PHONE = "138****0000"
+SAFE_TEXT = "synthetic-safe-lower-content"
+CURRENT_PRICE = "快卖完 ¥12.88"
+ORIGINAL_PRICE = "¥29.00"
+PRICE_CURRENT_BOUNDS = "[396,503][712,570]"
+PRICE_ORIGINAL_BOUNDS = "[730,503][895,570]"
+
+
+def _hash(path: Path) -> str:
+    digest = sha256()
+    with path.open("rb") as source:
+        for chunk in iter(lambda: source.read(1024 * 1024), b""):
+            digest.update(chunk)
+    return digest.hexdigest()
+
+
+def _default_xml() -> str:
+    return (
+        "<hierarchy rotation='0'>"
+        f"<node bounds='[0,0][1080,540]' text='{TEST_ADDRESS}' content-desc='{MASKED_PHONE} {FULL_PHONE}' />"
+        f"{_price_node(CURRENT_PRICE, PRICE_CURRENT_BOUNDS)}"
+        f"{_price_node(ORIGINAL_PRICE, PRICE_ORIGINAL_BOUNDS)}"
+        f"<node bounds='[0,540][1080,2376]' text='{SAFE_TEXT}' />"
+        "</hierarchy>"
+    )
+
+
+def _price_node(
+    text: str,
+    bounds: str,
+    *,
+    package: str = "com.xunmeng.pinduoduo",
+    node_class: str = "android.widget.TextView",
+    clickable: str = "false",
+    enabled: str = "true",
+    visible: str = "true",
+    extra_attributes: str = "",
+    children: str = "",
+) -> str:
+    attributes = (
+        f"bounds='{bounds}' text='{text}' package='{package}' class='{node_class}' "
+        f"clickable='{clickable}' enabled='{enabled}' visible-to-user='{visible}'{extra_attributes}"
+    )
+    return f"<node {attributes}>{children}</node>"
+
+
+def _xml_with_prices(
+    current: str = CURRENT_PRICE,
+    original: str = ORIGINAL_PRICE,
+    *,
+    current_node: str | None = None,
+    original_node: str | None = None,
+    include_original: bool = True,
+    extra_nodes: str = "",
+) -> str:
+    current_markup = current_node if current_node is not None else _price_node(current, PRICE_CURRENT_BOUNDS)
+    original_markup = (
+        original_node if original_node is not None else _price_node(original, PRICE_ORIGINAL_BOUNDS)
+    ) if include_original else ""
+    return (
+        "<hierarchy>"
+        f"<node bounds='[0,0][1080,540]' text='{TEST_ADDRESS}' />"
+        f"{current_markup}"
+        f"{original_markup}"
+        f"{extra_nodes}"
+        f"<node bounds='[0,570][1080,2376]' text='{SAFE_TEXT}' />"
+        "</hierarchy>"
+    )
+
+
+def _write_raw(
+    root: Path,
+    *,
+    state: str = "panel-opened-target-preselected",
+    goods_id: str = EXPECTED_GOODS_ID,
+    model: str = "PKG110",
+    android_version: str = "16",
+    pdd_version: str = "8.17.0",
+    size: tuple[int, int] = (EXPECTED_SCREENSHOT_WIDTH, EXPECTED_SCREENSHOT_HEIGHT),
+    xml: str | None = None,
+) -> Path:
+    raw = root / "raw"
+    raw.mkdir(parents=True)
+    screenshot = raw / "screenshot.png"
+    image = Image.new("RGB", size, color=(0, 180, 0))
+    if size == (EXPECTED_SCREENSHOT_WIDTH, EXPECTED_SCREENSHOT_HEIGHT):
+        for y in range(540):
+            for x in range(8):
+                image.putpixel((x, y), (255, 0, 0))
+    image.save(screenshot, format="PNG")
+    hierarchy = raw / "hierarchy.xml"
+    hierarchy.write_text(_default_xml() if xml is None else xml, encoding="utf-8")
+    manifest = {
+        "schema_version": 1,
+        "product": {
+            "goods_id": goods_id,
+            "canonical_url": f"https://mobile.yangkeduo.com/goods.html?goods_id={goods_id}",
+        },
+        "human_declared_state": state,
+        "serial": TEST_SERIAL,
+        "channel": "wifi",
+        "device": {
+            "model": model,
+            "android_version": android_version,
+            "pdd_package": "com.xunmeng.pinduoduo",
+            "pdd_version": pdd_version,
+        },
+        "artifacts": [
+            {"path": "screenshot.png", "sha256": _hash(screenshot)},
+            {"path": "hierarchy.xml", "sha256": _hash(hierarchy)},
+        ],
+    }
+    (raw / "manifest.json").write_text(json.dumps(manifest, sort_keys=True), encoding="utf-8")
+    return raw
+
+
+class SkuEvidenceSanitizerTests(unittest.TestCase):
+    def test_all_declared_states_mask_screenshot_and_xml_without_raw_metadata(self) -> None:
+        for state in sorted(HUMAN_DECLARED_STATES):
+            with self.subTest(state=state), TemporaryDirectory() as temporary:
+                raw = _write_raw(Path(temporary), state=state)
+                result = sanitize_sku_panel_evidence(raw, raw.parent / "derived")
+                with Image.open(result.screenshot_path) as image:
+                    self.assertEqual(image.getpixel((0, 0)), (0, 0, 0, 255))
+                    self.assertEqual(image.getpixel((100, 600)), (0, 180, 0, 255))
+                derived_xml = result.hierarchy_path.read_text(encoding="utf-8")
+                manifest = result.manifest_path.read_text(encoding="utf-8")
+
+                self.assertIn(SAFE_TEXT, derived_xml)
+                self.assertNotIn(TEST_ADDRESS, derived_xml)
+                self.assertNotIn(FULL_PHONE, derived_xml)
+                self.assertNotIn(MASKED_PHONE, derived_xml)
+                self.assertIn(f'"human_declared_state": "{state}"', manifest)
+                self.assertIn('"privacy_tier": "SANITIZED"', manifest)
+                self.assertIn('"sanitizer_version": "t103-privacy-v5"', manifest)
+                self.assertIn('"screenshot_space": {', manifest)
+                self.assertIn('"xml_coordinate_space": {', manifest)
+                self.assertIn('"height": 2376', manifest)
+                self.assertIn('"height": 2376', manifest)
+                self.assertIn('"privacy_mask_rectangle": [', manifest)
+                self.assertIn('"removed_nodes": 1', manifest)
+                self.assertIn('"cleared_crossing_nodes": 0', manifest)
+                self.assertIn('"preserved_crossing_price_nodes": 2', manifest)
+                self.assertIn('"retained_below_nodes": 1', manifest)
+                self.assertIn('"max_right": 1080', manifest)
+                self.assertIn('"max_bottom": 2376', manifest)
+                self.assertNotIn("canonical_url", manifest)
+                self.assertNotIn(TEST_SERIAL, manifest)
+                self.assertNotIn("serial", manifest)
+                self.assertNotIn("channel", manifest)
+                self.assertNotIn(TEST_ADDRESS, manifest)
+                self.assertNotIn(FULL_PHONE, manifest)
+
+    def test_crossing_container_keeps_lower_children_but_clears_its_text(self) -> None:
+        xml = (
+            "<hierarchy>"
+            f"<node bounds='[0,0][1080,2376]' text='{TEST_ADDRESS}' content-desc='{MASKED_PHONE}'>"
+            f"<node bounds='[0,0][1080,540]' text='{FULL_PHONE}' />"
+            f"{_price_node(CURRENT_PRICE, PRICE_CURRENT_BOUNDS)}"
+            f"{_price_node(ORIGINAL_PRICE, PRICE_ORIGINAL_BOUNDS)}"
+            f"<node bounds='[0,540][1080,2376]' text='{SAFE_TEXT}' />"
+            "</node></hierarchy>"
+        )
+        with TemporaryDirectory() as temporary:
+            raw = _write_raw(Path(temporary), xml=xml)
+            result = sanitize_sku_panel_evidence(raw, raw.parent / "derived")
+            root = ElementTree.parse(result.hierarchy_path).getroot()
+            crossing = root.find("node")
+
+            self.assertIsNotNone(crossing)
+            assert crossing is not None
+            self.assertEqual(crossing.attrib, {"bounds": "[0,0][1080,2376]"})
+            self.assertEqual(len(list(crossing)), 3)
+            self.assertEqual(list(crossing)[-1].get("text"), SAFE_TEXT)
+            manifest = json.loads(result.manifest_path.read_text(encoding="utf-8"))
+            self.assertEqual(
+                manifest["privacy_cleanup"],
+                {
+                    "removed_nodes": 1,
+                    "cleared_crossing_nodes": 1,
+                    "preserved_crossing_price_nodes": 2,
+                    "retained_below_nodes": 1,
+                    "max_right": 1080,
+                    "max_bottom": 2376,
+                },
+            )
+
+    def test_only_strict_crossing_price_leaves_are_projected_with_whitelisted_attributes(self) -> None:
+        xml = _xml_with_prices(
+            current_node=_price_node(
+                CURRENT_PRICE,
+                PRICE_CURRENT_BOUNDS,
+                extra_attributes=" content-desc='discard' resource-id='discard' focused='true'",
+            ),
+            original_node=_price_node(
+                ORIGINAL_PRICE,
+                PRICE_ORIGINAL_BOUNDS,
+                extra_attributes=" content-desc='discard-too' resource-id='discard-too'",
+            ),
+        )
+        with TemporaryDirectory() as temporary:
+            raw = _write_raw(Path(temporary), xml=xml)
+            result = sanitize_sku_panel_evidence(raw, raw.parent / "derived")
+            root = ElementTree.parse(result.hierarchy_path).getroot()
+            prices = [node for node in root.findall("node") if node.get("text") in {CURRENT_PRICE, ORIGINAL_PRICE}]
+
+            self.assertEqual(len(prices), 2)
+            for node in prices:
+                self.assertEqual(
+                    set(node.attrib),
+                    {"bounds", "text", "package", "class", "clickable", "enabled", "visible-to-user"},
+                )
+                self.assertEqual(node.get("package"), "com.xunmeng.pinduoduo")
+                self.assertEqual(node.get("class"), "android.widget.TextView")
+                self.assertEqual(node.get("clickable"), "false")
+                self.assertEqual(node.get("enabled"), "true")
+                self.assertEqual(node.get("visible-to-user"), "true")
+
+            manifest = json.loads(result.manifest_path.read_text(encoding="utf-8"))
+            self.assertEqual(manifest["privacy_cleanup"]["preserved_crossing_price_nodes"], 2)
+            self.assertNotIn("discard", result.hierarchy_path.read_text(encoding="utf-8"))
+
+    def test_crossing_price_window_rejects_text_and_structure_drift(self) -> None:
+        bad_texts = (
+            f"快卖完 ¥12.88 {TEST_ADDRESS}",
+            f"快卖完 ¥12.88 {FULL_PHONE}",
+            "快卖完 ¥12.88 使用微信支付",
+            "快卖完 ¥12.88 提交订单",
+            "快卖完 ¥12.88 优惠-11元",
+            "快要抢光 ¥12.88",
+            "快卖完 ¥0.00",
+            "快卖完 ¥12.8",
+            "快卖完 ¥12.880",
+            "快卖完　¥12.88",
+        )
+        for text in bad_texts:
+            with self.subTest(text=text), TemporaryDirectory() as temporary:
+                raw = _write_raw(Path(temporary), xml=_xml_with_prices(current=text))
+                with self.assertRaises(SkuEvidenceSanitizationError):
+                    sanitize_sku_panel_evidence(raw, raw.parent / "derived")
+                self.assertFalse((raw.parent / "derived").exists())
+
+    def test_crossing_price_text_mismatch_reports_only_fixed_slot_and_reason(self) -> None:
+        newline_node = _price_node(CURRENT_PRICE, PRICE_CURRENT_BOUNDS).replace(
+            "快卖完 ¥12.88", "快卖完&#10;¥12.88"
+        )
+        cases = (
+            ("newline", _xml_with_prices(current_node=newline_node), "newline", PRICE_CURRENT_BOUNDS),
+            (
+                "non-ascii-whitespace",
+                _xml_with_prices(current="快卖完　¥12.88"),
+                "non_ascii_whitespace",
+                PRICE_CURRENT_BOUNDS,
+            ),
+            (
+                "known-prefix-missing",
+                _xml_with_prices(current="快要抢光 ¥12.88"),
+                "observed_prefix_kuaiyaoqiangguang",
+                PRICE_CURRENT_BOUNDS,
+            ),
+            (
+                "other-kuai-prefix-remains-generic",
+                _xml_with_prices(current="快递地址 ¥12.88"),
+                "known_prefix_missing",
+                PRICE_CURRENT_BOUNDS,
+            ),
+            (
+                "currency-missing",
+                _xml_with_prices(current="快卖完 12.88"),
+                "currency_missing",
+                PRICE_CURRENT_BOUNDS,
+            ),
+            (
+                "amount-shape",
+                _xml_with_prices(current="快卖完 ¥12.8"),
+                "amount_shape",
+                PRICE_CURRENT_BOUNDS,
+            ),
+            (
+                "extra-or-order",
+                _xml_with_prices(current="提交订单 ¥12.88"),
+                "extra_or_order",
+                PRICE_CURRENT_BOUNDS,
+            ),
+            (
+                "forbidden-characters",
+                _xml_with_prices(current="商品 ¥12.88"),
+                "forbidden_characters",
+                PRICE_CURRENT_BOUNDS,
+            ),
+            (
+                "right-slot-amount-shape",
+                _xml_with_prices(original="¥29.0"),
+                "amount_shape",
+                PRICE_ORIGINAL_BOUNDS,
+            ),
+        )
+        for name, xml, reason, bounds in cases:
+            with self.subTest(name=name), TemporaryDirectory() as temporary:
+                raw = _write_raw(Path(temporary), xml=xml)
+                with self.assertRaises(SkuEvidenceSanitizationError) as raised:
+                    sanitize_sku_panel_evidence(raw, raw.parent / "derived")
+
+                self.assertEqual(
+                    str(raised.exception),
+                    f"跨界价格节点文本不匹配：slot={bounds}；reason={reason}。",
+                )
+                self.assertFalse((raw.parent / "derived").exists())
+
+    def test_crossing_price_text_mismatch_never_echoes_sensitive_or_order_text(self) -> None:
+        cases = (
+            f"快卖完 ¥12.88 {TEST_ADDRESS}",
+            f"快卖完 ¥12.88 {FULL_PHONE}",
+            "快卖完 ¥12.88 使用微信支付",
+            "快卖完 ¥12.88 提交订单",
+        )
+        for text in cases:
+            with self.subTest(text=text), TemporaryDirectory() as temporary:
+                raw = _write_raw(Path(temporary), xml=_xml_with_prices(current=text))
+                with self.assertRaises(SkuEvidenceSanitizationError) as raised:
+                    sanitize_sku_panel_evidence(raw, raw.parent / "derived")
+
+                message = str(raised.exception)
+                self.assertIn("slot=[396,503][712,570]", message)
+                self.assertIn("reason=extra_or_order", message)
+                for raw_fragment in (TEST_ADDRESS, FULL_PHONE, "使用微信支付", "提交订单", "¥12.88"):
+                    self.assertNotIn(raw_fragment, message)
+
+    def test_observed_prefix_diagnostic_does_not_echo_its_suffix(self) -> None:
+        suffix = "地址和金额都不得回显"
+        text = f"快要抢光 ¥12.88 {suffix}"
+        with TemporaryDirectory() as temporary:
+            raw = _write_raw(Path(temporary), xml=_xml_with_prices(current=text))
+            with self.assertRaises(SkuEvidenceSanitizationError) as raised:
+                sanitize_sku_panel_evidence(raw, raw.parent / "derived")
+
+            message = str(raised.exception)
+            self.assertEqual(
+                message,
+                "跨界价格节点文本不匹配：slot=[396,503][712,570]；"
+                "reason=observed_prefix_kuaiyaoqiangguang。",
+            )
+            self.assertNotIn(suffix, message)
+            self.assertNotIn("¥12.88", message)
+
+    def test_crossing_price_projection_allows_only_limited_ascii_spaces_and_yen_variants(self) -> None:
+        for current in ("快卖完 ¥12.88", " 快卖完 ¥ 12.88 ", "快卖完 ￥12.88"):
+            with self.subTest(current=current), TemporaryDirectory() as temporary:
+                raw = _write_raw(Path(temporary), xml=_xml_with_prices(current=current))
+                result = sanitize_sku_panel_evidence(raw, raw.parent / "derived")
+                hierarchy = result.hierarchy_path.read_text(encoding="utf-8")
+                self.assertIn(current, hierarchy)
+
+    def test_unverified_or_missing_current_price_prefixes_fail_closed(self) -> None:
+        cases = (
+            ("old-prefix", "快卖光 ¥12.88"),
+            ("bottom-button-prefix", "快要抢光 ¥12.88"),
+            ("missing-prefix", "¥12.88"),
+        )
+        for name, current in cases:
+            with self.subTest(name=name), TemporaryDirectory() as temporary:
+                raw = _write_raw(Path(temporary), xml=_xml_with_prices(current=current))
+                with self.assertRaises(SkuEvidenceSanitizationError):
+                    sanitize_sku_panel_evidence(raw, raw.parent / "derived")
+                self.assertFalse((raw.parent / "derived").exists())
+
+    def test_unique_current_price_without_original_price_is_published(self) -> None:
+        with TemporaryDirectory() as temporary:
+            raw = _write_raw(Path(temporary), xml=_xml_with_prices(include_original=False))
+            result = sanitize_sku_panel_evidence(raw, raw.parent / "derived")
+            hierarchy = result.hierarchy_path.read_text(encoding="utf-8")
+            manifest = json.loads(result.manifest_path.read_text(encoding="utf-8"))
+
+            self.assertIn(CURRENT_PRICE, hierarchy)
+            self.assertNotIn(ORIGINAL_PRICE, hierarchy)
+            self.assertEqual(manifest["privacy_cleanup"]["preserved_crossing_price_nodes"], 1)
+
+    def test_crossing_price_projection_rejects_newline_and_structure_drift(self) -> None:
+        encoded_newline = _price_node(CURRENT_PRICE, PRICE_CURRENT_BOUNDS).replace(
+            "快卖完 ¥12.88", "快卖完&#10;¥12.88"
+        )
+        with TemporaryDirectory() as temporary:
+            raw = _write_raw(Path(temporary), xml=_xml_with_prices(current_node=encoded_newline))
+            with self.assertRaises(SkuEvidenceSanitizationError):
+                sanitize_sku_panel_evidence(raw, raw.parent / "derived")
+            self.assertFalse((raw.parent / "derived").exists())
+
+        bad_structure = (
+            ("package", {"package": "com.android.systemui"}),
+            ("class", {"node_class": "android.view.View"}),
+            ("clickable", {"clickable": "true"}),
+            ("disabled", {"enabled": "false"}),
+            ("hidden", {"visible": "false"}),
+            ("children", {"children": "<node bounds='[400,510][500,520]' />"}),
+        )
+        for name, kwargs in bad_structure:
+            with self.subTest(structure=name), TemporaryDirectory() as temporary:
+                raw = _write_raw(
+                    Path(temporary),
+                    xml=_xml_with_prices(current_node=_price_node(CURRENT_PRICE, PRICE_CURRENT_BOUNDS, **kwargs)),
+                )
+                with self.assertRaises(SkuEvidenceSanitizationError):
+                    sanitize_sku_panel_evidence(raw, raw.parent / "derived")
+                self.assertFalse((raw.parent / "derived").exists())
+
+    def test_crossing_price_candidates_require_unique_current_and_at_most_one_original(self) -> None:
+        scenarios = (
+            (
+                "missing-current",
+                _xml_with_prices(current="¥12.88", original=ORIGINAL_PRICE),
+            ),
+            (
+                "duplicate-current",
+                _xml_with_prices(current=CURRENT_PRICE, original=f"快卖完 {ORIGINAL_PRICE}"),
+            ),
+            (
+                "multiple-original",
+                _xml_with_prices(
+                    extra_nodes=_price_node("¥39.88", PRICE_ORIGINAL_BOUNDS),
+                ),
+            ),
+        )
+        for name, xml in scenarios:
+            with self.subTest(name=name), TemporaryDirectory() as temporary:
+                raw = _write_raw(Path(temporary), xml=xml)
+                with self.assertRaises(SkuEvidenceSanitizationError):
+                    sanitize_sku_panel_evidence(raw, raw.parent / "derived")
+                self.assertFalse((raw.parent / "derived").exists())
+
+    def test_crossing_price_outside_fixed_windows_is_cleared_and_submit_price_is_not_candidate(self) -> None:
+        outside_crossing = _price_node("快卖光 ¥99.99", "[396,498][712,570]")
+        submit = (
+            "<node bounds='[369,2225][710,2284]' text='提交订单 ¥12.88' "
+            "package='com.xunmeng.pinduoduo' class='android.widget.TextView' clickable='false' "
+            "enabled='true' visible-to-user='true' resource-id='submit-button' />"
+        )
+        with TemporaryDirectory() as temporary:
+            raw = _write_raw(Path(temporary), xml=_xml_with_prices(extra_nodes=outside_crossing + submit))
+            result = sanitize_sku_panel_evidence(raw, raw.parent / "derived")
+            hierarchy = result.hierarchy_path.read_text(encoding="utf-8")
+            manifest = json.loads(result.manifest_path.read_text(encoding="utf-8"))
+
+            self.assertNotIn("快卖光 ¥99.99", hierarchy)
+            self.assertIn("提交订单 ¥12.88", hierarchy)
+            self.assertIn("submit-button", hierarchy)
+            self.assertEqual(manifest["privacy_cleanup"]["preserved_crossing_price_nodes"], 2)
+
+    def test_same_raw_and_config_produce_identical_derived_files(self) -> None:
+        with TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            left_raw = _write_raw(root / "left")
+            right_raw = _write_raw(root / "right")
+            left = sanitize_sku_panel_evidence(left_raw, left_raw.parent / "derived")
+            right = sanitize_sku_panel_evidence(right_raw, right_raw.parent / "derived")
+
+            for left_path, right_path in (
+                (left.screenshot_path, right.screenshot_path),
+                (left.hierarchy_path, right.hierarchy_path),
+                (left.manifest_path, right.manifest_path),
+            ):
+                self.assertEqual(left_path.read_bytes(), right_path.read_bytes())
+
+    def test_manifest_records_distinct_screenshot_and_xml_coordinate_spaces(self) -> None:
+        with TemporaryDirectory() as temporary:
+            raw = _write_raw(Path(temporary))
+            result = sanitize_sku_panel_evidence(raw, raw.parent / "derived")
+            manifest = json.loads(result.manifest_path.read_text(encoding="utf-8"))
+
+            self.assertEqual(
+                manifest["screenshot_space"],
+                {"width": 1080, "height": 2376, "privacy_mask_rectangle": [0, 0, 1080, 540]},
+            )
+            self.assertEqual(
+                manifest["xml_coordinate_space"],
+                {
+                    "width": 1080,
+                    "height": 2376,
+                    "privacy_mask_rectangle": [0, 0, 1080, 540],
+                    "observed_max": {"right": 1080, "bottom": 2376},
+                },
+            )
+
+    def test_hash_and_metadata_mismatch_fail_closed_without_leak(self) -> None:
+        scenarios = (
+            ("hash", {}, "screenshot"),
+            ("model", {"model": "other"}, None),
+            ("android", {"android_version": "15"}, None),
+            ("version", {"pdd_version": "8.17.1"}, None),
+            ("goods", {"goods_id": "123"}, None),
+            ("state", {"state": "guessed"}, None),
+            ("old-screenshot-space", {"size": (1080, 2400)}, None),
+            ("other-screenshot-space", {"size": (100, 100)}, None),
+        )
+        for name, kwargs, corrupt_file in scenarios:
+            with self.subTest(name=name), TemporaryDirectory() as temporary:
+                raw = _write_raw(Path(temporary), **kwargs)
+                if corrupt_file is not None:
+                    (raw / f"{corrupt_file}.png").write_bytes(b"changed")
+                with self.assertRaises(SkuEvidenceSanitizationError) as raised:
+                    sanitize_sku_panel_evidence(raw, raw.parent / "derived")
+
+                message = str(raised.exception)
+                self.assertNotIn(TEST_SERIAL, message)
+                self.assertNotIn(TEST_ADDRESS, message)
+                self.assertNotIn(FULL_PHONE, message)
+                self.assertFalse((raw.parent / "derived").exists())
+                self.assertEqual(list(raw.parent.glob(".derived.staging-*")), [])
+
+    def test_old_and_unknown_human_states_are_rejected(self) -> None:
+        for state in ("initial", "one-dimension-selected", "all-dimensions-selected", "guessed"):
+            with self.subTest(state=state), TemporaryDirectory() as temporary:
+                raw = _write_raw(Path(temporary), state=state)
+                with self.assertRaises(SkuEvidenceSanitizationError):
+                    sanitize_sku_panel_evidence(raw, raw.parent / "derived")
+                self.assertFalse((raw.parent / "derived").exists())
+
+    def test_malformed_inputs_and_bounds_or_phone_residue_fail_closed(self) -> None:
+        malformed = (
+            ("manifest", None),
+            ("png", None),
+            ("xml", None),
+            ("bounds", "<hierarchy><node text='missing bounds' /></hierarchy>"),
+            (
+                "private-parent-with-lower-child",
+                "<hierarchy><node bounds='[0,0][1080,540]'><node bounds='[0,540][1080,2376]' text='x' /></node></hierarchy>",
+            ),
+            ("full-phone-below", f"<hierarchy><node bounds='[0,540][1080,2376]' text='{FULL_PHONE}' /></hierarchy>"),
+            ("masked-phone-below", f"<hierarchy><node bounds='[0,540][1080,2376]' text='{MASKED_PHONE}' /></hierarchy>"),
+        )
+        for kind, xml in malformed:
+            with self.subTest(kind=kind), TemporaryDirectory() as temporary:
+                raw = _write_raw(Path(temporary), xml=xml)
+                if kind == "manifest":
+                    (raw / "manifest.json").write_text("{invalid", encoding="utf-8")
+                elif kind == "png":
+                    (raw / "screenshot.png").write_bytes(b"not a png")
+                    manifest = json.loads((raw / "manifest.json").read_text(encoding="utf-8"))
+                    manifest["artifacts"][0]["sha256"] = _hash(raw / "screenshot.png")
+                    (raw / "manifest.json").write_text(json.dumps(manifest), encoding="utf-8")
+                elif kind == "xml":
+                    (raw / "hierarchy.xml").write_text("<hierarchy>", encoding="utf-8")
+                    manifest = json.loads((raw / "manifest.json").read_text(encoding="utf-8"))
+                    manifest["artifacts"][1]["sha256"] = _hash(raw / "hierarchy.xml")
+                    (raw / "manifest.json").write_text(json.dumps(manifest), encoding="utf-8")
+                with self.assertRaises(SkuEvidenceSanitizationError):
+                    sanitize_sku_panel_evidence(raw, raw.parent / "derived")
+
+                self.assertFalse((raw.parent / "derived").exists())
+                self.assertEqual(list(raw.parent.glob(".derived.staging-*")), [])
+
+    def test_phone_recheck_rejects_separator_mask_and_cross_node_bypasses(self) -> None:
+        variants = (
+            "138 0013-8000",
+            "138＊＊＊＊0000",
+            "138••••0000",
+            "138xxxx0000",
+            "138XXXX0000",
+        )
+        for value in variants:
+            xml = (
+                "<hierarchy>"
+                "<node bounds='[0,0][1080,540]' text='private' />"
+                f"<node bounds='[0,540][1080,2376]' text='{value}' />"
+                "</hierarchy>"
+            )
+            with self.subTest(value=value), TemporaryDirectory() as temporary:
+                raw = _write_raw(Path(temporary), xml=xml)
+                with self.assertRaises(SkuEvidenceSanitizationError):
+                    sanitize_sku_panel_evidence(raw, raw.parent / "derived")
+                self.assertFalse((raw.parent / "derived").exists())
+
+        split_xml = (
+            "<hierarchy>"
+            "<node bounds='[0,0][1080,540]' text='private' />"
+            "<node bounds='[0,540][1080,1000]' text='138' content-desc='0013' />"
+            "<node bounds='[0,1000][1080,2376]' text='8000' />"
+            "</hierarchy>"
+        )
+        with TemporaryDirectory() as temporary:
+            raw = _write_raw(Path(temporary), xml=split_xml)
+            with self.assertRaises(SkuEvidenceSanitizationError):
+                sanitize_sku_panel_evidence(raw, raw.parent / "derived")
+            self.assertFalse((raw.parent / "derived").exists())
+
+    def test_privacy_geometry_requires_removed_and_retained_nodes(self) -> None:
+        scenarios = (
+            ("no-private", f"<hierarchy><node bounds='[0,540][1080,2376]' text='{SAFE_TEXT}' /></hierarchy>"),
+            ("no-below", "<hierarchy><node bounds='[0,0][1080,540]' text='private' /></hierarchy>"),
+        )
+        for name, xml in scenarios:
+            with self.subTest(name=name), TemporaryDirectory() as temporary:
+                raw = _write_raw(Path(temporary), xml=xml)
+                with self.assertRaises(SkuEvidenceSanitizationError):
+                    sanitize_sku_panel_evidence(raw, raw.parent / "derived")
+                self.assertFalse((raw.parent / "derived").exists())
+                self.assertEqual(list(raw.parent.glob(".derived.staging-*")), [])
+
+    def test_xml_coordinate_space_must_have_exact_configured_maximums(self) -> None:
+        scenarios = (
+            (
+                "short-width",
+                "<hierarchy><node bounds='[0,0][1079,540]' text='private' />"
+                "<node bounds='[0,540][1079,2376]' text='safe' /></hierarchy>",
+                "1079x2376",
+            ),
+            (
+                "short-height",
+                "<hierarchy><node bounds='[0,0][1080,540]' text='private' />"
+                "<node bounds='[0,540][1080,2375]' text='safe' /></hierarchy>",
+                "1080x2375",
+            ),
+            (
+                "wide-width",
+                "<hierarchy><node bounds='[0,0][1081,540]' text='private' />"
+                "<node bounds='[0,540][1081,2376]' text='safe' /></hierarchy>",
+                "1081x2376",
+            ),
+            (
+                "old-v2-xml-height",
+                "<hierarchy><node bounds='[0,0][1080,540]' text='private' />"
+                "<node bounds='[0,540][1080,2400]' text='safe' /></hierarchy>",
+                "1080x2400",
+            ),
+        )
+        for name, xml, observed in scenarios:
+            with self.subTest(name=name), TemporaryDirectory() as temporary:
+                raw = _write_raw(Path(temporary), xml=xml)
+                with self.assertRaises(SkuEvidenceSanitizationError) as raised:
+                    sanitize_sku_panel_evidence(raw, raw.parent / "derived")
+
+                self.assertIn(observed, str(raised.exception))
+                self.assertNotIn(TEST_SERIAL, str(raised.exception))
+                self.assertFalse((raw.parent / "derived").exists())
+                self.assertEqual(list(raw.parent.glob(".derived.staging-*")), [])
+
+    def test_manifest_schema_package_and_artifact_structure_are_required(self) -> None:
+        def mutate(manifest: dict[str, object], kind: str) -> None:
+            if kind == "schema":
+                manifest["schema_version"] = 2
+            elif kind == "package":
+                manifest["device"]["pdd_package"] = "com.example.other"  # type: ignore[index]
+            elif kind == "missing":
+                manifest.pop("artifacts")
+            elif kind == "duplicate":
+                manifest["artifacts"].append(manifest["artifacts"][0])  # type: ignore[index]
+            elif kind == "bad-hash":
+                manifest["artifacts"][0]["sha256"] = "g" * 64  # type: ignore[index]
+
+        for kind in ("schema", "package", "missing", "duplicate", "bad-hash"):
+            with self.subTest(kind=kind), TemporaryDirectory() as temporary:
+                raw = _write_raw(Path(temporary))
+                manifest_path = raw / "manifest.json"
+                manifest = json.loads(manifest_path.read_text(encoding="utf-8"))
+                mutate(manifest, kind)
+                manifest_path.write_text(json.dumps(manifest), encoding="utf-8")
+                with self.assertRaises(SkuEvidenceSanitizationError) as raised:
+                    sanitize_sku_panel_evidence(raw, raw.parent / "derived")
+
+                self.assertNotIn(TEST_SERIAL, str(raised.exception))
+                self.assertNotIn(TEST_ADDRESS, str(raised.exception))
+                self.assertFalse((raw.parent / "derived").exists())
+
+    def test_target_created_during_publish_is_preserved_and_staging_is_removed(self) -> None:
+        with TemporaryDirectory() as temporary:
+            raw = _write_raw(Path(temporary))
+            target = raw.parent / "derived"
+
+            def race_rename(destination: Path) -> None:
+                destination.mkdir()
+                (destination / "sentinel.txt").write_text("keep", encoding="utf-8")
+                raise FileExistsError("simulated publish race")
+
+            with patch("cmbuyer_client.device.sku_evidence_sanitizer.Path.rename", side_effect=race_rename):
+                with self.assertRaises(SkuEvidenceSanitizationError):
+                    sanitize_sku_panel_evidence(raw, target)
+
+            self.assertEqual((target / "sentinel.txt").read_text(encoding="utf-8"), "keep")
+            self.assertEqual(list(raw.parent.glob(".derived.staging-*")), [])
+
+    def test_existing_derived_is_preserved_without_reading_or_writing_raw(self) -> None:
+        with TemporaryDirectory() as temporary:
+            raw = _write_raw(Path(temporary))
+            target = raw.parent / "derived"
+            target.mkdir()
+            sentinel = target / "sentinel.txt"
+            sentinel.write_text("keep", encoding="utf-8")
+
+            with self.assertRaises(SkuEvidenceSanitizationError):
+                sanitize_sku_panel_evidence(raw, target)
+
+            self.assertEqual(sentinel.read_text(encoding="utf-8"), "keep")
+            self.assertEqual(list(raw.parent.glob(".derived.staging-*")), [])
+
+    def test_directory_contract_rejects_non_sibling_paths(self) -> None:
+        with TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            raw = _write_raw(root)
+            with self.assertRaises(SkuEvidenceSanitizationError):
+                sanitize_sku_panel_evidence(raw, root / "not-derived")
+            with self.assertRaises(SkuEvidenceSanitizationError):
+                sanitize_sku_panel_evidence(root / "not-raw", root / "derived")

client/tests/pdd/__init__.py

@@ -0,0 +1 @@
+"""拼多多受限打开模块的离线测试。"""

client/tests/pdd/fixtures/product_entry_8_17_0.xml

@@ -0,0 +1,14 @@
+<hierarchy>
+  <node package="com.xunmeng.pinduoduo" class="android.view.ViewGroup" bounds="[0,1256][1080,1355]" clickable="true" enabled="true" visible-to-user="true">
+    <node package="com.xunmeng.pinduoduo" class="android.widget.FrameLayout" bounds="[712,1312][1056,1355]" clickable="false" enabled="true" visible-to-user="true">
+      <node package="com.xunmeng.pinduoduo" class="android.widget.ViewSwitcher" bounds="[712,1312][1056,1355]" clickable="false" enabled="true" visible-to-user="true">
+        <node package="com.xunmeng.pinduoduo" class="android.view.ViewGroup" bounds="[712,1312][1056,1355]" clickable="false" enabled="true" visible-to-user="true">
+          <node text="快要抢光" package="com.xunmeng.pinduoduo" class="android.widget.TextView" bounds="[900,1312][1056,1355]" clickable="false" enabled="true" visible-to-user="true" />
+        </node>
+      </node>
+    </node>
+  </node>
+  <node package="com.xunmeng.pinduoduo" class="android.view.ViewGroup" bounds="[446,2166][1080,2328]" clickable="true" enabled="true" visible-to-user="true">
+    <node text="免拼购买" package="com.xunmeng.pinduoduo" class="android.widget.TextView" bounds="[688,2256][856,2305]" clickable="false" enabled="true" visible-to-user="true" />
+  </node>
+</hierarchy>

client/tests/pdd/fixtures/sku_panel_8_17_0.xml

@@ -0,0 +1,26 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<hierarchy>
+  <node package="com.xunmeng.pinduoduo" class="android.view.ViewGroup" bounds="[0,474][1080,2328]">
+    <node package="" class="android.view.ViewGroup" bounds="[396,498][895,570]">
+      <node text="快卖完 ¥12.88" package="com.xunmeng.pinduoduo" class="android.widget.TextView" clickable="false" enabled="true" visible-to-user="true" bounds="[396,503][712,570]" />
+      <node text="¥29.88" package="com.xunmeng.pinduoduo" class="android.widget.TextView" clickable="false" enabled="true" visible-to-user="true" bounds="[730,503][895,570]" />
+    </node>
+    <node text="已选： 黑色 CHA (纯棉） M（建议100-115）" package="com.xunmeng.pinduoduo" class="android.widget.TextView" clickable="false" enabled="true" visible-to-user="true" bounds="[396,654][1053,716]" />
+    <node package="com.xunmeng.pinduoduo" class="androidx.recyclerview.widget.RecyclerView" bounds="[36,1000][1080,1631]">
+      <node content-desc="黑色 CHA (纯棉）" package="com.xunmeng.pinduoduo" class="android.view.ViewGroup" selected="true" clickable="true" enabled="true" visible-to-user="true" bounds="[126,1000][438,1172]" />
+      <node content-desc="粉红" package="com.xunmeng.pinduoduo" class="android.view.ViewGroup" selected="false" clickable="true" enabled="true" visible-to-user="true" bounds="[456,1000][690,1172]" />
+    </node>
+    <node package="com.xunmeng.pinduoduo" class="android.view.ViewGroup" bounds="[36,1637][1044,2045]">
+      <node package="com.xunmeng.pinduoduo" class="android.widget.LinearLayout" bounds="[36,1637][1044,1718]">
+        <node text="尺码" package="com.xunmeng.pinduoduo" class="android.widget.TextView" clickable="false" enabled="true" visible-to-user="true" bounds="[36,1654][114,1700]" />
+      </node>
+      <node package="com.xunmeng.pinduoduo" class="android.widget.LinearLayout" bounds="[36,1730][1044,2045]">
+        <node text="M（建议100-115）" package="com.xunmeng.pinduoduo" class="android.view.ViewGroup" selected="true" clickable="true" enabled="true" visible-to-user="true" bounds="[439,1730][831,1815]" />
+        <node text="L（建议115-130）" package="com.xunmeng.pinduoduo" class="android.view.ViewGroup" selected="false" clickable="true" enabled="true" visible-to-user="true" bounds="[840,1730][1044,1815]" />
+      </node>
+    </node>
+    <node package="com.xunmeng.pinduoduo" class="android.widget.LinearLayout" clickable="true" enabled="true" visible-to-user="true" bounds="[357,2181][722,2328]">
+      <node text="提交订单 ¥12.88" package="com.xunmeng.pinduoduo" class="android.widget.TextView" clickable="false" enabled="true" visible-to-user="true" bounds="[369,2225][710,2284]" />
+    </node>
+  </node>
+</hierarchy>

client/tests/pdd/test_product_open.py

@@ -0,0 +1,266 @@
+"""商品打开围栏的离线测试；所有设备和命令均为 fake。"""
+
+from __future__ import annotations
+
+import base64
+from io import BytesIO
+from pathlib import Path
+import sys
+from tempfile import TemporaryDirectory
+import unittest
+
+from PIL import Image
+
+
+CLIENT_ROOT = Path(__file__).resolve().parents[2]
+sys.path.insert(0, str(CLIENT_ROOT / "src"))
+
+from cmbuyer_client.device.adb import AdbDevice, DeviceInspection, IntentLaunchSummary
+from cmbuyer_client.pdd.product_open import (
+    ProductOpenCapturer,
+    ProductOpenTimeoutError,
+    ProductOpenUiDevice,
+    ProductHierarchyCaptureError,
+    ProductPackageMismatchError,
+    ProductScreenshotCaptureError,
+    ProductVersionMismatchError,
+)
+from cmbuyer_client.pdd.product_url import ProductUrl, ProductUrlError
+
+
+SERIAL = "192.168.0.173:5555"
+URL = "https://mobile.yangkeduo.com/goods.html?goods_id=123"
+HIERARCHY = "<?xml version='1.0' encoding='UTF-8'?><hierarchy rotation='0'><node /></hierarchy>"
+
+
+def _png_base64() -> str:
+    image_data = BytesIO()
+    Image.new("RGB", (1, 1), color="white").save(image_data, format="PNG")
+    return base64.b64encode(image_data.getvalue()).decode("ascii")
+
+
+class FakeAdbClient:
+    def __init__(self) -> None:
+        self.calls: list[tuple[str, str | None]] = []
+        self.inspection = DeviceInspection(
+            device=AdbDevice(serial=SERIAL, state="device", model="PKG110"),
+            model="PKG110",
+            android_version="16",
+        )
+
+    def inspect(self, serial: str) -> DeviceInspection:
+        self.calls.append(("inspect", serial))
+        return self.inspection
+
+    def start_pdd_view_intent(self, serial: str, goods_id: str) -> IntentLaunchSummary:
+        self.calls.append(("intent", goods_id))
+        return IntentLaunchSummary(status="ok", returncode=0)
+
+
+class FakeUiDevice:
+    def __init__(
+        self,
+        *,
+        version: str = "8.17.0",
+        current_package: str = "com.xunmeng.pinduoduo",
+        current_packages: list[str] | None = None,
+        hierarchy: str = HIERARCHY,
+        timeout_on_screenshot: bool = False,
+    ) -> None:
+        self.version = version
+        self.current_package = current_package
+        self.current_packages = list(current_packages) if current_packages is not None else None
+        self.hierarchy = hierarchy
+        self.timeout_on_screenshot = timeout_on_screenshot
+        self.calls: list[str] = []
+
+    def app_info(self, package_name: str) -> dict[str, str]:
+        self.calls.append("app_info")
+        return {"versionName": self.version}
+
+    def app_current(self) -> dict[str, str]:
+        self.calls.append("app_current")
+        if self.current_packages:
+            package = self.current_packages.pop(0)
+            self.current_package = package
+        return {"package": self.current_package, "activity": "sensitive.activity.name"}
+
+    def jsonrpc_call(self, method: str, params: object = None, timeout: float = 10) -> str:
+        self.calls.append(method)
+        if method == "takeScreenshot":
+            if self.timeout_on_screenshot:
+                raise TimeoutError("raw remote detail")
+            return _png_base64()
+        if method == "dumpWindowHierarchy":
+            return self.hierarchy
+        raise AssertionError(f"unexpected RPC {method}")
+
+
+class ProductOpenTests(unittest.TestCase):
+    def _capturer(self, adb: FakeAdbClient, device: FakeUiDevice, **kwargs: object) -> ProductOpenCapturer:
+        return ProductOpenCapturer(adb, lambda serial: device, timeout_seconds=2, **kwargs)
+
+    def test_success_uses_canonical_url_and_redacted_atomic_manifest(self) -> None:
+        adb = FakeAdbClient()
+        device = FakeUiDevice()
+        with TemporaryDirectory() as temporary:
+            target = Path(temporary) / "evidence"
+            result = self._capturer(adb, device).open_and_capture(SERIAL, URL, target)
+            manifest = result.manifest_path.read_text(encoding="utf-8")
+
+            self.assertTrue(result.screenshot_path.exists())
+            self.assertTrue(result.hierarchy_path.exists())
+            self.assertEqual(adb.calls, [("inspect", SERIAL), ("intent", "123")])
+            self.assertEqual(device.calls, ["app_info", "app_current", "takeScreenshot", "dumpWindowHierarchy"])
+            self.assertIn('"goods_id": "123"', manifest)
+            self.assertIn('"canonical_url": "https://mobile.yangkeduo.com/goods.html?goods_id=123"', manifest)
+            self.assertNotIn(SERIAL, manifest)
+            self.assertNotIn("sensitive.activity.name", manifest)
+            self.assertNotIn(HIERARCHY, manifest)
+
+    def test_version_mismatch_halts_before_intent(self) -> None:
+        adb = FakeAdbClient()
+        for version in ("8.17.1", " 8.17.0 "):
+            with self.subTest(version=version), TemporaryDirectory() as temporary:
+                target = Path(temporary) / "evidence"
+                with self.assertRaises(ProductVersionMismatchError):
+                    self._capturer(adb, FakeUiDevice(version=version)).open_and_capture(SERIAL, URL, target)
+
+                self.assertEqual(adb.calls[-1:], [("inspect", SERIAL)])
+                self.assertFalse(target.exists())
+
+    def test_public_entry_rejects_caller_constructed_url_value_object(self) -> None:
+        adb = FakeAdbClient()
+        with TemporaryDirectory() as temporary:
+            with self.assertRaises(ProductUrlError):
+                self._capturer(adb, FakeUiDevice()).open_and_capture(
+                    SERIAL,
+                    ProductUrl(goods_id="123", canonical_url="https://example.invalid/"),  # type: ignore[arg-type]
+                    Path(temporary) / "evidence",
+                )
+
+            self.assertEqual(adb.calls, [])
+
+    def test_foreground_package_mismatch_halts_before_capture(self) -> None:
+        adb = FakeAdbClient()
+        device = FakeUiDevice(current_package="com.example.other")
+        clock = FakeClock()
+        with TemporaryDirectory() as temporary:
+            target = Path(temporary) / "evidence"
+            with self.assertRaises(ProductPackageMismatchError):
+                self._capturer(
+                    adb,
+                    device,
+                    foreground_poll_interval_seconds=0.5,
+                    monotonic_clock=clock.monotonic,
+                    sleep_function=clock.sleep,
+                ).open_and_capture(SERIAL, URL, target)
+
+            self.assertEqual(adb.calls, [("inspect", SERIAL), ("intent", "123")])
+            self.assertEqual(device.calls, ["app_info", "app_current", "app_current", "app_current", "app_current", "app_current"])
+            self.assertEqual(clock.sleeps, [0.5, 0.5, 0.5, 0.5])
+            self.assertFalse(target.exists())
+
+    def test_foreground_package_poll_waits_for_pdd_before_reading_evidence(self) -> None:
+        adb = FakeAdbClient()
+        device = FakeUiDevice(current_packages=["com.example.other", "com.xunmeng.pinduoduo"])
+        clock = FakeClock()
+        with TemporaryDirectory() as temporary:
+            target = Path(temporary) / "evidence"
+            result = self._capturer(
+                adb,
+                device,
+                foreground_poll_interval_seconds=0.25,
+                monotonic_clock=clock.monotonic,
+                sleep_function=clock.sleep,
+            ).open_and_capture(SERIAL, URL, target)
+
+            self.assertTrue(result.manifest_path.exists())
+            self.assertEqual(clock.sleeps, [0.25])
+            self.assertEqual(
+                device.calls,
+                ["app_info", "app_current", "app_current", "takeScreenshot", "dumpWindowHierarchy"],
+            )
+
+    def test_foreground_package_poll_stops_at_deadline_without_evidence(self) -> None:
+        adb = FakeAdbClient()
+        device = FakeUiDevice(current_packages=["com.example.other", "", "com.example.other"])
+        clock = FakeClock()
+        with TemporaryDirectory() as temporary:
+            target = Path(temporary) / "evidence"
+            with self.assertRaises(ProductPackageMismatchError):
+                self._capturer(
+                    adb,
+                    device,
+                    foreground_poll_interval_seconds=0.8,
+                    monotonic_clock=clock.monotonic,
+                    sleep_function=clock.sleep,
+                ).open_and_capture(SERIAL, URL, target)
+
+            self.assertEqual(len(clock.sleeps), 3)
+            for actual, expected in zip(clock.sleeps, (0.8, 0.8, 0.4), strict=True):
+                self.assertAlmostEqual(actual, expected)
+            self.assertEqual(device.calls, ["app_info", "app_current", "app_current", "app_current", "app_current"])
+            self.assertFalse(target.exists())
+            self.assertEqual(list(Path(temporary).glob(".evidence.staging-*")), [])
+
+    def test_foreground_poll_interval_must_be_positive_and_finite(self) -> None:
+        for interval in (0, -0.1, float("inf"), float("nan"), True):
+            with self.subTest(interval=interval):
+                with self.assertRaises(ValueError):
+                    ProductOpenCapturer(
+                        FakeAdbClient(),
+                        lambda serial: FakeUiDevice(),
+                        timeout_seconds=2,
+                        foreground_poll_interval_seconds=interval,  # type: ignore[arg-type]
+                    )
+
+    def test_timeout_and_invalid_hierarchy_leave_no_partial_evidence(self) -> None:
+        scenarios = (
+            (FakeUiDevice(timeout_on_screenshot=True), ProductOpenTimeoutError),
+            (FakeUiDevice(hierarchy="<not-hierarchy />"), ProductHierarchyCaptureError),
+        )
+        for device, error_type in scenarios:
+            with self.subTest(error_type=error_type.__name__), TemporaryDirectory() as temporary:
+                target = Path(temporary) / "evidence"
+                with self.assertRaises(error_type):
+                    self._capturer(FakeAdbClient(), device).open_and_capture(SERIAL, URL, target)
+
+                self.assertFalse(target.exists())
+                self.assertEqual(list(Path(temporary).glob(".evidence.staging-*")), [])
+
+    def test_invalid_screenshot_is_a_distinct_redacted_failure(self) -> None:
+        class InvalidScreenshotDevice(FakeUiDevice):
+            def jsonrpc_call(self, method: str, params: object = None, timeout: float = 10) -> str:
+                if method == "takeScreenshot":
+                    self.calls.append(method)
+                    return "not valid base64!"
+                return super().jsonrpc_call(method, params, timeout)
+
+        with TemporaryDirectory() as temporary:
+            target = Path(temporary) / "evidence"
+            with self.assertRaises(ProductScreenshotCaptureError) as raised:
+                self._capturer(FakeAdbClient(), InvalidScreenshotDevice()).open_and_capture(SERIAL, URL, target)
+
+            self.assertNotIn("base64", str(raised.exception).lower())
+            self.assertFalse(target.exists())
+            self.assertEqual(list(Path(temporary).glob(".evidence.staging-*")), [])
+
+    def test_read_only_protocol_has_no_ui_operation_methods(self) -> None:
+        forbidden = {"click", "swipe", "send_keys", "set_text", "press", "long_click"}
+
+        self.assertTrue(forbidden.isdisjoint(ProductOpenUiDevice.__dict__))
+        self.assertEqual(base64.b64decode(_png_base64())[:8], b"\x89PNG\r\n\x1a\n")
+
+
+class FakeClock:
+    def __init__(self) -> None:
+        self.value = 0.0
+        self.sleeps: list[float] = []
+
+    def monotonic(self) -> float:
+        return self.value
+
+    def sleep(self, seconds: float) -> None:
+        self.sleeps.append(seconds)
+        self.value += seconds

client/tests/pdd/test_product_url.py

@@ -0,0 +1,49 @@
+"""canonical 商品 URL 的离线解析测试。"""
+
+from __future__ import annotations
+
+from pathlib import Path
+import sys
+import unittest
+
+
+CLIENT_ROOT = Path(__file__).resolve().parents[2]
+sys.path.insert(0, str(CLIENT_ROOT / "src"))
+
+from cmbuyer_client.pdd.product_url import ProductUrlError, parse_product_url
+
+
+class ProductUrlTests(unittest.TestCase):
+    def test_rebuilds_url_from_goods_id(self) -> None:
+        link = parse_product_url("https://mobile.yangkeduo.com/goods.html?goods_id=00123")
+
+        self.assertEqual(link.goods_id, "00123")
+        self.assertEqual(
+            link.canonical_url,
+            "https://mobile.yangkeduo.com/goods.html?goods_id=00123",
+        )
+
+    def test_rejects_noncanonical_and_ambiguous_urls(self) -> None:
+        rejected = (
+            "http://mobile.yangkeduo.com/goods.html?goods_id=123",
+            "https://other.example/goods.html?goods_id=123",
+            "https://mobile.yangkeduo.com/other.html?goods_id=123",
+            "https://user@mobile.yangkeduo.com/goods.html?goods_id=123",
+            "https://mobile.yangkeduo.com:8443/goods.html?goods_id=123",
+            "https://mobile.yangkeduo.com:443/goods.html?goods_id=123",
+            "https://mobile.yangkeduo.com/goods.html?goods_id=123#fragment",
+            "https://mobile.yangkeduo.com/goods.html",
+            "https://mobile.yangkeduo.com/goods.html?goods_id=123&goods_id=456",
+            "https://mobile.yangkeduo.com/goods.html?goods_id=123&source=share",
+            "https://mobile.yangkeduo.com/goods.html?goods_id=12a",
+            "https://mobile.yangkeduo.com/goods.html?goods_id=%EF%BC%91%EF%BC%92%EF%BC%93",
+            "https://mobile.yangkeduo.com/goods.html?goods_id=",
+            " https://mobile.yangkeduo.com/goods.html?goods_id=123",
+            "https://MOBILE.YANGKEDUO.COM/goods.html?goods_id=123",
+            "https://mobile.yangkeduo.com/goods.html?goods_id=%31%32%33",
+        )
+
+        for value in rejected:
+            with self.subTest(value=value):
+                with self.assertRaises(ProductUrlError):
+                    parse_product_url(value)

client/tests/pdd/test_sku_panel_spike.py

@@ -0,0 +1,263 @@
+"""人工声明规格面板状态的离线只读取证测试。"""
+
+from __future__ import annotations
+
+import argparse
+import base64
+from importlib.util import module_from_spec, spec_from_file_location
+from io import BytesIO
+from pathlib import Path
+import sys
+from tempfile import TemporaryDirectory
+import unittest
+
+from PIL import Image
+
+
+CLIENT_ROOT = Path(__file__).resolve().parents[2]
+sys.path.insert(0, str(CLIENT_ROOT / "src"))
+
+from cmbuyer_client.device.adb import AdbDevice, DeviceInspection
+from cmbuyer_client.pdd.product_url import ProductUrlError
+from cmbuyer_client.pdd.sku_panel_spike import (
+    HUMAN_DECLARED_STATES,
+    SkuPanelDeclaredStateError,
+    SkuPanelEvidenceCapturer,
+    SkuPanelEvidenceError,
+    SkuPanelEvidenceTimeoutError,
+    SkuPanelHierarchyError,
+    SkuPanelPackageMismatchError,
+    SkuPanelScreenshotError,
+    SkuPanelUiDevice,
+    SkuPanelVersionMismatchError,
+)
+
+
+SERIAL = "192.168.0.173:5555"
+URL = "https://mobile.yangkeduo.com/goods.html?goods_id=123"
+HIERARCHY = "<?xml version='1.0' encoding='UTF-8'?><hierarchy><node text='sensitive page text' /></hierarchy>"
+
+
+def _png_base64() -> str:
+    image_data = BytesIO()
+    Image.new("RGB", (1, 1), color="white").save(image_data, format="PNG")
+    return base64.b64encode(image_data.getvalue()).decode("ascii")
+
+
+class FakeAdbClient:
+    def __init__(self) -> None:
+        self.calls: list[str] = []
+        self.inspection = DeviceInspection(
+            device=AdbDevice(serial=SERIAL, state="device", model="PKG110"),
+            model="PKG110",
+            android_version="16",
+        )
+
+    def inspect(self, serial: str) -> DeviceInspection:
+        self.calls.append(serial)
+        return self.inspection
+
+
+class FakeUiDevice:
+    def __init__(
+        self,
+        *,
+        version: str = "8.17.0",
+        package: str = "com.xunmeng.pinduoduo",
+        screenshot: str | None = None,
+        hierarchy: str = HIERARCHY,
+    ) -> None:
+        self.version = version
+        self.package = package
+        self.screenshot = screenshot if screenshot is not None else _png_base64()
+        self.hierarchy = hierarchy
+        self.calls: list[str] = []
+
+    def app_info(self, package_name: str) -> dict[str, str]:
+        self.calls.append("app_info")
+        return {"versionName": self.version}
+
+    def app_current(self) -> dict[str, str]:
+        self.calls.append("app_current")
+        return {"package": self.package, "activity": "sensitive.activity.name"}
+
+    def jsonrpc_call(self, method: str, params: object = None, timeout: float = 10) -> str:
+        self.calls.append(method)
+        if method == "takeScreenshot":
+            return self.screenshot
+        if method == "dumpWindowHierarchy":
+            return self.hierarchy
+        raise AssertionError(f"unexpected RPC {method}")
+
+
+def _load_spike_script() -> object:
+    script_path = CLIENT_ROOT / "scripts" / "capture_sku_panel_spike.py"
+    spec = spec_from_file_location("capture_sku_panel_spike_for_test", script_path)
+    assert spec is not None and spec.loader is not None
+    module = module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module
+
+
+class SkuPanelEvidenceTests(unittest.TestCase):
+    def _capturer(self, adb: FakeAdbClient, device: FakeUiDevice) -> SkuPanelEvidenceCapturer:
+        return SkuPanelEvidenceCapturer(adb, lambda serial: device, timeout_seconds=2)
+
+    def test_all_human_declared_states_publish_redacted_manifest(self) -> None:
+        for state in sorted(HUMAN_DECLARED_STATES):
+            with self.subTest(state=state), TemporaryDirectory() as temporary:
+                adb = FakeAdbClient()
+                device = FakeUiDevice()
+                target = Path(temporary) / "evidence"
+                result = self._capturer(adb, device).capture(SERIAL, URL, state, target)
+                manifest = result.manifest_path.read_text(encoding="utf-8")
+
+                self.assertEqual(adb.calls, [SERIAL])
+                self.assertEqual(device.calls, ["app_info", "app_current", "takeScreenshot", "dumpWindowHierarchy"])
+                self.assertIn(f'"human_declared_state": "{state}"', manifest)
+                self.assertIn('"goods_id": "123"', manifest)
+                self.assertIn('"canonical_url": "https://mobile.yangkeduo.com/goods.html?goods_id=123"', manifest)
+                self.assertNotIn("detected_state", manifest)
+                self.assertNotIn(SERIAL, manifest)
+                self.assertNotIn("sensitive.activity.name", manifest)
+                self.assertNotIn(HIERARCHY, manifest)
+
+    def test_invalid_state_and_url_fail_before_device_access(self) -> None:
+        adb = FakeAdbClient()
+        rejected_states = ("initial", "one-dimension-selected", "all-dimensions-selected", "guessed")
+        with TemporaryDirectory() as temporary:
+            for state in rejected_states:
+                with self.subTest(state=state), self.assertRaises(SkuPanelDeclaredStateError):
+                    self._capturer(adb, FakeUiDevice()).capture(SERIAL, URL, state, Path(temporary) / "state")
+            with self.assertRaises(ProductUrlError):
+                self._capturer(adb, FakeUiDevice()).capture(
+                    SERIAL,
+                    "https://mobile.yangkeduo.com/goods.html?goods_id=12x",
+                    "panel-opened-target-preselected",
+                    Path(temporary) / "url",
+                )
+
+        self.assertEqual(adb.calls, [])
+
+    def test_version_or_foreground_package_mismatch_stops_before_artifacts(self) -> None:
+        scenarios = (
+            (FakeUiDevice(version="8.17.1"), SkuPanelVersionMismatchError, ["app_info"]),
+            (FakeUiDevice(package="com.example.other"), SkuPanelPackageMismatchError, ["app_info", "app_current"]),
+        )
+        for device, error_type, expected_calls in scenarios:
+            with self.subTest(error_type=error_type.__name__), TemporaryDirectory() as temporary:
+                target = Path(temporary) / "evidence"
+                with self.assertRaises(error_type):
+                    self._capturer(FakeAdbClient(), device).capture(SERIAL, URL, "panel-opened-target-preselected", target)
+
+                self.assertEqual(device.calls, expected_calls)
+                self.assertFalse(target.exists())
+
+    def test_screenshot_and_xml_failure_leave_no_partial_evidence(self) -> None:
+        scenarios = (
+            (FakeUiDevice(screenshot="not valid base64!"), SkuPanelScreenshotError),
+            (FakeUiDevice(hierarchy="<not-hierarchy />"), SkuPanelHierarchyError),
+        )
+        for device, error_type in scenarios:
+            with self.subTest(error_type=error_type.__name__), TemporaryDirectory() as temporary:
+                target = Path(temporary) / "evidence"
+                with self.assertRaises(error_type):
+                    self._capturer(FakeAdbClient(), device).capture(SERIAL, URL, "panel-opened-target-preselected", target)
+
+                self.assertFalse(target.exists())
+                self.assertEqual(list(Path(temporary).glob(".evidence.staging-*")), [])
+
+    def test_screenshot_timeout_is_redacted_and_leaves_no_partial_evidence(self) -> None:
+        class TimeoutScreenshotDevice(FakeUiDevice):
+            def jsonrpc_call(self, method: str, params: object = None, timeout: float = 10) -> str:
+                if method == "takeScreenshot":
+                    self.calls.append(method)
+                    raise TimeoutError("adb 192.168.0.173:5555 raw detail")
+                return super().jsonrpc_call(method, params, timeout)
+
+        with TemporaryDirectory() as temporary:
+            target = Path(temporary) / "evidence"
+            with self.assertRaises(SkuPanelEvidenceTimeoutError) as raised:
+                self._capturer(FakeAdbClient(), TimeoutScreenshotDevice()).capture(SERIAL, URL, "panel-opened-target-preselected", target)
+
+            self.assertNotIn(SERIAL, str(raised.exception))
+            self.assertNotIn("adb", str(raised.exception).lower())
+            self.assertFalse(target.exists())
+            self.assertEqual(list(Path(temporary).glob(".evidence.staging-*")), [])
+
+    def test_existing_output_directory_is_not_overwritten_or_connected(self) -> None:
+        adb = FakeAdbClient()
+        device = FakeUiDevice()
+        with TemporaryDirectory() as temporary:
+            target = Path(temporary) / "evidence"
+            target.mkdir()
+            sentinel = target / "sentinel.txt"
+            sentinel.write_text("keep", encoding="utf-8")
+
+            with self.assertRaises(SkuPanelEvidenceError):
+                self._capturer(adb, device).capture(SERIAL, URL, "panel-opened-target-preselected", target)
+
+            self.assertEqual(adb.calls, [])
+            self.assertEqual(device.calls, [])
+            self.assertEqual(sentinel.read_text(encoding="utf-8"), "keep")
+
+    def test_protocol_has_no_ui_or_purchase_operation_methods(self) -> None:
+        forbidden = {
+            "click",
+            "swipe",
+            "send_keys",
+            "set_text",
+            "press",
+            "open_product",
+            "open_sku_panel",
+            "set_quantity",
+            "go_to_order_confirm",
+            "submit_order",
+            "pay",
+        }
+        self.assertTrue(forbidden.isdisjoint(SkuPanelUiDevice.__dict__))
+        self.assertEqual({name for name in SkuPanelEvidenceCapturer.__dict__ if not name.startswith("_")}, {"capture"})
+
+
+class SkuPanelSpikeCliTests(unittest.TestCase):
+    def test_validate_arguments_rejects_invalid_serial_timeout_state_and_url(self) -> None:
+        script = _load_spike_script()
+        valid = {
+            "serial": SERIAL,
+            "url": URL,
+            "goods_id": None,
+            "state": "panel-opened-target-preselected",
+            "output_dir": Path("evidence"),
+            "timeout": 10.0,
+            "adb": "adb",
+        }
+        invalid_values = (
+            ("serial", ""),
+            ("timeout", 0),
+            ("timeout", float("inf")),
+            ("state", "not-declared"),
+            ("state", "initial"),
+            ("state", "one-dimension-selected"),
+            ("state", "all-dimensions-selected"),
+            ("url", "https://mobile.yangkeduo.com/goods.html?goods_id=bad"),
+        )
+        for field, value in invalid_values:
+            with self.subTest(field=field, value=value):
+                arguments = argparse.Namespace(**(valid | {field: value}))
+                with self.assertRaises((ValueError, ProductUrlError)):
+                    script.validate_arguments(arguments)  # type: ignore[attr-defined]
+
+    def test_goods_id_is_rebuilt_as_canonical_url(self) -> None:
+        script = _load_spike_script()
+        arguments = argparse.Namespace(
+            serial=SERIAL,
+            url=None,
+            goods_id="00123",
+            state="target-selection-restored",
+            output_dir=Path("evidence"),
+            timeout=10.0,
+            adb="adb",
+        )
+
+        link = script.validate_arguments(arguments)  # type: ignore[attr-defined]
+        self.assertEqual(link.canonical_url, "https://mobile.yangkeduo.com/goods.html?goods_id=00123")

client/tests/pdd/test_sku_selection.py

@@ -0,0 +1,689 @@
+from __future__ import annotations
+
+import ast
+import base64
+from contextlib import redirect_stderr
+from io import BytesIO
+import importlib.util
+from pathlib import Path
+from tempfile import TemporaryDirectory
+import unittest
+from unittest.mock import patch
+from xml.etree import ElementTree
+
+from PIL import Image
+
+import cmbuyer_client.pdd as pdd
+import cmbuyer_client.pdd.sku_selection_runner as runner_module
+from cmbuyer_client.device.adb import AdbDevice, DeviceInspection
+from cmbuyer_client.pdd import SkuSelectionError, SkuSelectionFlow, SkuSelectionRunner
+from cmbuyer_client.pdd.sku_selection import SkuPanelDevice, _action_bounds, resolve_task_selection
+from cmbuyer_client.pdd.sku_selection_runner import (
+    SkuSelectionDeviceAdapterError,
+    SkuSelectionRunError,
+    SkuSelectionScreenshotError,
+    UiautomatorSkuPanelAdapter,
+)
+
+
+_FIXTURE = Path(__file__).with_name("fixtures") / "sku_panel_8_17_0.xml"
+_ENTRY_FIXTURE = Path(__file__).with_name("fixtures") / "product_entry_8_17_0.xml"
+_TARGET_URL = "https://mobile.yangkeduo.com/goods.html?goods_id=937122477375"
+_TASK_COLOR = "黑色CHA(纯棉)"
+_TASK_SIZE = "M(建议100-115)"
+_PRODUCT_PAGE = _ENTRY_FIXTURE.read_text(encoding="utf-8")
+
+
+def _png_base64() -> str:
+    image = Image.new("RGB", (1080, 2376), "white")
+    raw = BytesIO()
+    image.save(raw, format="PNG")
+    return base64.b64encode(raw.getvalue()).decode("ascii")
+
+
+class _RawDevice:
+    def __init__(self, hierarchy: str = _PRODUCT_PAGE, screenshot: str | None = None) -> None:
+        self.hierarchy = hierarchy
+        self.panel_hierarchy = _FIXTURE.read_text(encoding="utf-8")
+        self.version = "8.17.0"
+        self.package = "com.xunmeng.pinduoduo"
+        self.screenshot = _png_base64() if screenshot is None else screenshot
+        self.calls: list[tuple[object, ...]] = []
+        self.fail_color_readback = False
+
+    def app_info(self, package_name: str) -> dict[str, str]:
+        self.calls.append(("app_info", package_name))
+        return {"versionName": self.version}
+
+    def app_current(self) -> dict[str, str]:
+        self.calls.append(("app_current",))
+        return {"package": self.package}
+
+    def jsonrpc_call(self, method: str, params: object = None, timeout: float = 10) -> str:
+        self.calls.append(("jsonrpc", method, params, timeout))
+        if method == "dumpWindowHierarchy":
+            return self.hierarchy
+        if method == "takeScreenshot":
+            return self.screenshot
+        if method == "pressKey":
+            self.hierarchy = "<hierarchy />"
+            return ""
+        if method == "click":
+            if not isinstance(params, list) or len(params) != 2:
+                raise AssertionError(params)
+            self._apply_tap(int(params[0]), int(params[1]))
+            return ""
+        raise AssertionError(method)
+
+    def _apply_tap(self, x: int, y: int) -> None:
+        if "快要抢光" in self.hierarchy and "[396,498][895,570]" not in self.hierarchy:
+            self.hierarchy = self.panel_hierarchy
+            return
+        root = ElementTree.fromstring(self.hierarchy)
+        target = next(node for node in root.iter("node") if _center(node.get("bounds", "")) == (x, y))
+        color = target.get("bounds", "").endswith("][438,1172]")
+        for node in root.iter("node"):
+            if node.get("selected") is not None and ((color and ",1000]" in node.get("bounds", "")) or (not color and ",1730]" in node.get("bounds", ""))):
+                node.set("selected", "false")
+        if color and self.fail_color_readback:
+            next(node for node in root.iter("node") if node.get("content-desc") == "粉红").set("selected", "true")
+        else:
+            target.set("selected", "true")
+        self.hierarchy = ElementTree.tostring(root, encoding="unicode")
+
+    def window_size(self) -> tuple[int, int]:
+        self.calls.append(("window_size",))
+        return 1080, 2376
+
+    def select_alternates(self) -> None:
+        root = ElementTree.fromstring(self.panel_hierarchy)
+        for node in root.iter("node"):
+            if node.get("selected") is not None:
+                node.set("selected", "false")
+        next(node for node in root.iter("node") if node.get("content-desc") == "粉红").set("selected", "true")
+        next(node for node in root.iter("node") if node.get("text") == "L（建议115-130）").set("selected", "true")
+        self.panel_hierarchy = ElementTree.tostring(root, encoding="unicode")
+        if self.hierarchy != _PRODUCT_PAGE:
+            self.hierarchy = self.panel_hierarchy
+
+
+def _center(bounds: str) -> tuple[int, int]:
+    left_top, right_bottom = bounds.split("][")
+    left, top = (int(value) for value in left_top.removeprefix("[").split(","))
+    right, bottom = (int(value) for value in right_bottom.removesuffix("]").split(","))
+    return left + (right - left) // 2, top + (bottom - top) // 2
+
+
+def _entry_chain(root: ElementTree.Element) -> list[ElementTree.Element]:
+    parents = {child: parent for parent in root.iter() for child in parent}
+    child = next(node for node in root.iter("node") if node.get("text") == "快要抢光")
+    chain = [child]
+    for _ in range(4):
+        chain.append(parents[chain[-1]])
+    return chain
+
+
+def _mutate_entry(depth: int, attribute: str, value: str) -> str:
+    root = ElementTree.fromstring(_PRODUCT_PAGE)
+    _entry_chain(root)[depth].set(attribute, value)
+    return ElementTree.tostring(root, encoding="unicode")
+
+
+def _without_entry() -> str:
+    root = ElementTree.fromstring(_PRODUCT_PAGE)
+    root.remove(_entry_chain(root)[4])
+    return ElementTree.tostring(root, encoding="unicode")
+
+
+def _duplicate_entry() -> str:
+    root = ElementTree.fromstring(_PRODUCT_PAGE)
+    entry_root = _entry_chain(root)[4]
+    root.append(ElementTree.fromstring(ElementTree.tostring(entry_root, encoding="unicode")))
+    return ElementTree.tostring(root, encoding="unicode")
+
+
+def _actions(device: _RawDevice, method: str) -> list[tuple[object, ...]]:
+    return [call for call in device.calls if call[0] == "jsonrpc" and call[1] == method]
+
+
+def _tap_centers(device: _RawDevice) -> list[tuple[int, int]]:
+    return [tuple(call[2]) for call in _actions(device, "click")]  # type: ignore[misc]
+
+
+class _FakeAdb:
+    def __init__(self) -> None:
+        self.calls: list[tuple[object, ...]] = []
+        self.inspection = DeviceInspection(AdbDevice(serial="device-1", state="device"), "PKG110", "16")
+        self.on_intent: callable | None = None
+
+    def inspect(self, serial: str) -> DeviceInspection:
+        self.calls.append(("inspect", serial))
+        return self.inspection
+
+    def start_pdd_view_intent(self, serial: str, goods_id: str) -> object:
+        self.calls.append(("intent", serial, goods_id))
+        if self.on_intent is not None:
+            self.on_intent()
+        return object()
+
+
+class SkuSelectionFlowTests(unittest.TestCase):
+    def _assert_entry_rejected_without_click(self, hierarchy: str) -> None:
+        now = [0.0]
+        device = _RawDevice(hierarchy)
+        flow = SkuSelectionFlow(
+            UiautomatorSkuPanelAdapter(device, 10),
+            0.01,
+            0.01,
+            lambda: now[0],
+            lambda seconds: now.__setitem__(0, now[0] + seconds),
+        )
+        with self.assertRaises(SkuSelectionError):
+            flow.open_sku_panel(_TARGET_URL)
+        self.assertEqual(_actions(device, "click"), [])
+
+    def test_target_mapping_is_exact_and_success_path_restores_target(self) -> None:
+        device = _RawDevice()
+        adapter = UiautomatorSkuPanelAdapter(device, 10)
+        flow = SkuSelectionFlow(adapter)
+
+        flow.open_sku_panel(_TARGET_URL)
+        flow.select_sku_options(resolve_task_selection(_TASK_COLOR, _TASK_SIZE))
+        self.assertEqual(flow.read_sku_unit_price(), "12.88")
+        flow.exit_sku_panel_safely()
+
+        self.assertEqual(_tap_centers(device), [(978, 1333)])
+        self.assertEqual(_actions(device, "pressKey"), [("jsonrpc", "pressKey", ["back"], 10)])
+
+    def test_full_verified_entry_structure_taps_exact_text_child_once(self) -> None:
+        device = _RawDevice()
+        SkuSelectionFlow(UiautomatorSkuPanelAdapter(device, 10)).open_sku_panel(_TARGET_URL)
+
+        self.assertEqual(_tap_centers(device), [(978, 1333)])
+
+    def test_entry_child_and_every_ancestor_attribute_drift_never_clicks(self) -> None:
+        expected_clickable = ("false", "false", "false", "false", "true")
+        for depth in range(5):
+            changes = {
+                "package": "other.package",
+                "class": "android.widget.Button",
+                "bounds": "[1,1][2,2]",
+                "clickable": "true" if expected_clickable[depth] == "false" else "false",
+                "enabled": "false",
+                "visible-to-user": "false",
+            }
+            for attribute, value in changes.items():
+                with self.subTest(depth=depth, attribute=attribute):
+                    self._assert_entry_rejected_without_click(_mutate_entry(depth, attribute, value))
+
+    def test_duplicate_entry_and_forbidden_sibling_entry_never_click(self) -> None:
+        self._assert_entry_rejected_without_click(_duplicate_entry())
+        self._assert_entry_rejected_without_click(_without_entry())
+        self._assert_entry_rejected_without_click(_mutate_entry(0, "clickable", "true"))
+
+    def test_unknown_task_or_ui_variants_are_rejected_without_action(self) -> None:
+        for color, size in (("黑色 CHA (纯棉）", _TASK_SIZE), (_TASK_COLOR, "M（建议100-115）"), ("黑色CHA（纯棉）", _TASK_SIZE)):
+            with self.subTest(color=color, size=size), self.assertRaises(SkuSelectionError):
+                resolve_task_selection(color, size)
+
+        device = _RawDevice(_FIXTURE.read_text(encoding="utf-8"))
+        with self.assertRaises(SkuSelectionError):
+            SkuSelectionFlow(UiautomatorSkuPanelAdapter(device, 10)).select_sku_options(
+                resolve_task_selection(_TASK_COLOR, _TASK_SIZE).__class__("粉红", "L（建议115-130）")
+            )
+        self.assertEqual(_actions(device, "click"), [])
+
+    def test_option_selected_and_container_drift_fail_closed_before_click(self) -> None:
+        base = _FIXTURE.read_text(encoding="utf-8")
+        cases = (
+            base.replace('selected="true" clickable="true" enabled="true" visible-to-user="true" bounds="[126,1000][438,1172]"', 'clickable="true" enabled="true" visible-to-user="true" bounds="[126,1000][438,1172]"'),
+            base.replace('selected="true" clickable="true" enabled="true" visible-to-user="true" bounds="[126,1000][438,1172]"', 'selected="maybe" clickable="true" enabled="true" visible-to-user="true" bounds="[126,1000][438,1172]"'),
+            base.replace('bounds="[126,1000][438,1172]"', 'bounds="[1,1][20,20]"'),
+            base.replace('enabled="true" visible-to-user="true" bounds="[126,1000][438,1172]"', 'enabled="false" visible-to-user="true" bounds="[126,1000][438,1172]"'),
+        )
+        for hierarchy in cases:
+            with self.subTest(), self.assertRaises(SkuSelectionError):
+                SkuSelectionFlow(UiautomatorSkuPanelAdapter(_RawDevice(hierarchy), 10)).select_sku_options(resolve_task_selection(_TASK_COLOR, _TASK_SIZE))
+
+    def test_invalid_bounds_stop_before_action(self) -> None:
+        for bounds in ("", "[1,2][1,3]", "[1,2][3,2]", "[0,0][1081,1]", "[0,0][1,2377]", "[a,0][1,1]"):
+            with self.subTest(bounds=bounds), self.assertRaises(SkuSelectionError):
+                _action_bounds(bounds)
+
+        device = _RawDevice(_PRODUCT_PAGE.replace("[900,1312][1056,1355]", "[0,0][1081,1]"))
+        with self.assertRaises(SkuSelectionError):
+            SkuSelectionFlow(UiautomatorSkuPanelAdapter(device, 10)).open_sku_panel(_TARGET_URL)
+        self.assertEqual(_actions(device, "click"), [])
+
+    def test_color_readback_failure_never_attempts_second_option(self) -> None:
+        device = _RawDevice()
+        device.fail_color_readback = True
+        flow = SkuSelectionFlow(UiautomatorSkuPanelAdapter(device, 10))
+        flow.open_sku_panel(_TARGET_URL)
+        device.select_alternates()
+        with self.assertRaises(SkuSelectionError):
+            flow.select_sku_options(resolve_task_selection(_TASK_COLOR, _TASK_SIZE))
+        self.assertEqual(_tap_centers(device), [(978, 1333), (282, 1086)])
+
+    def test_non_target_selection_restores_each_dimension_once(self) -> None:
+        device = _RawDevice()
+        flow = SkuSelectionFlow(UiautomatorSkuPanelAdapter(device, 10))
+        flow.open_sku_panel(_TARGET_URL)
+        device.select_alternates()
+        flow.select_sku_options(resolve_task_selection(_TASK_COLOR, _TASK_SIZE))
+        self.assertEqual(
+            _tap_centers(device),
+            [(978, 1333), (282, 1086), (635, 1772)],
+        )
+
+    def test_price_rejects_coupon_prefix_extra_amount_and_bottom_action(self) -> None:
+        for replacement in ("券后 ¥12.88", "会员补贴 ¥12.88", "到手 ¥12.88", "实付 ¥12.88", "区间 ¥12.88", "原价 ¥12.88", "划线价 ¥12.88", "最低 ¥12.88", "低至 ¥12.88", "起价 ¥12.88", "快卖完 1 ¥12.88", "快卖完 ¥12.88 ¥11.88"):
+            with self.subTest(replacement=replacement):
+                device = _RawDevice(_FIXTURE.read_text(encoding="utf-8").replace("快卖完 ¥12.88", replacement))
+                with self.assertRaises(SkuSelectionError):
+                    SkuSelectionFlow(UiautomatorSkuPanelAdapter(device, 10)).read_sku_unit_price()
+        device = _RawDevice(_FIXTURE.read_text(encoding="utf-8").replace("快卖完 ¥12.88", "提交订单 ¥12.88"))
+        with self.assertRaises(SkuSelectionError):
+            SkuSelectionFlow(UiautomatorSkuPanelAdapter(device, 10)).read_sku_unit_price()
+        clickable_parent = _FIXTURE.read_text(encoding="utf-8").replace(
+            '<node package="" class="android.view.ViewGroup" bounds="[396,498][895,570]">',
+            '<node package="" class="android.view.ViewGroup" clickable="true" bounds="[396,498][895,570]">',
+        )
+        with self.assertRaises(SkuSelectionError):
+            SkuSelectionFlow(UiautomatorSkuPanelAdapter(_RawDevice(clickable_parent), 10)).read_sku_unit_price()
+
+    def test_public_api_and_protocol_have_no_broad_or_order_operations(self) -> None:
+        forbidden = {"quantity", "confirm", "authorization", "fence", "submit", "payment", "click"}
+        self.assertTrue(forbidden.isdisjoint(SkuSelectionFlow.__dict__))
+        self.assertTrue(forbidden.isdisjoint(SkuPanelDevice.__dict__))
+        self.assertTrue(forbidden.isdisjoint(pdd.__all__))
+
+    def test_static_ast_boundary_limits_flow_runner_adapter_and_cli(self) -> None:
+        root = Path(__file__).resolve().parents[2]
+        files = (
+            root / "src" / "cmbuyer_client" / "pdd" / "sku_selection.py",
+            root / "src" / "cmbuyer_client" / "pdd" / "sku_selection_runner.py",
+            root / "scripts" / "run_t103_sku_selection.py",
+        )
+        forbidden = ("quantity", "confirm", "authorization", "fence", "submit_order", "payment")
+        for path in files:
+            source = path.read_text(encoding="utf-8")
+            with self.subTest(path=path.name):
+                self.assertTrue(all(token not in source.lower() for token in forbidden))
+                tree = ast.parse(source)
+                self.assertFalse(any(isinstance(node, ast.ImportFrom) and node.module in {"selenium", "requests"} for node in ast.walk(tree)))
+        runner_tree = ast.parse(files[1].read_text(encoding="utf-8"))
+        click_calls = [node for node in ast.walk(runner_tree) if isinstance(node, ast.Constant) and node.value == "click"]
+        self.assertEqual(len(click_calls), 1)
+
+    def test_entry_wait_rejects_unchanged_or_duplicate_page_without_click(self) -> None:
+        now = [0.0]
+        device = _RawDevice()
+        flow = SkuSelectionFlow(UiautomatorSkuPanelAdapter(device, 10), 0.01, 0.01, lambda: now[0], lambda seconds: now.__setitem__(0, now[0] + seconds))
+        with self.assertRaises(SkuSelectionError):
+            flow.open_sku_panel(_TARGET_URL, _PRODUCT_PAGE)
+        self.assertEqual(_actions(device, "click"), [])
+
+    def test_action_postcondition_wait_never_repeats_entry_click(self) -> None:
+        class NoPanelAfterEntry(_RawDevice):
+            def jsonrpc_call(self, method: str, params: object = None, timeout: float = 10) -> str:
+                if method == "click":
+                    self.calls.append(("jsonrpc", method, params, timeout))
+                    return ""
+                return super().jsonrpc_call(method, params, timeout)
+
+        device = NoPanelAfterEntry()
+        with self.assertRaises(SkuSelectionError):
+            SkuSelectionFlow(UiautomatorSkuPanelAdapter(device, 10)).open_sku_panel(_TARGET_URL)
+        self.assertEqual(_tap_centers(device), [(978, 1333)])
+
+        duplicate = _duplicate_entry()
+        device = _RawDevice(duplicate)
+        with self.assertRaises(SkuSelectionError):
+            SkuSelectionFlow(UiautomatorSkuPanelAdapter(device, 10)).open_sku_panel(_TARGET_URL)
+        self.assertEqual(_actions(device, "click"), [])
+
+    def test_fixture_contains_no_address_phone_or_payment_credentials(self) -> None:
+        for fixture in (_FIXTURE, _ENTRY_FIXTURE):
+            content = fixture.read_text(encoding="utf-8")
+            with self.subTest(fixture=fixture.name):
+                self.assertNotRegex(content, r"1[3-9]\d{9}")
+                for forbidden in ("地址", "收货", "支付", "银行卡", "身份证"):
+                    self.assertNotIn(forbidden, content)
+        content = _FIXTURE.read_text(encoding="utf-8")
+        root = ElementTree.fromstring(content)
+        leaf = next(node for node in root.iter("node") if node.get("text") == "提交订单 ¥12.88")
+        self.assertEqual(leaf.get("clickable"), "false")
+        self.assertEqual(leaf.get("bounds"), "[369,2225][710,2284]")
+
+
+class SkuSelectionRunnerTests(unittest.TestCase):
+    def _runner(self, adb: _FakeAdb, device: _RawDevice) -> SkuSelectionRunner:
+        device.hierarchy = "<hierarchy />"
+        adb.on_intent = lambda: setattr(device, "hierarchy", _PRODUCT_PAGE.replace("<hierarchy>", '<hierarchy post-intent="1">'))
+        return SkuSelectionRunner(adb, lambda serial: device, 10)
+
+    def test_runner_atomically_publishes_screenshot_and_redacted_manifest(self) -> None:
+        adb = _FakeAdb()
+        device = _RawDevice()
+        with TemporaryDirectory() as temporary:
+            target = Path(temporary) / "result"
+            result = self._runner(adb, device).run("device-1", _TARGET_URL, _TASK_COLOR, _TASK_SIZE, target)
+
+            self.assertEqual(result.unit_price, "12.88")
+            manifest = result.manifest_path.read_text(encoding="utf-8")
+            self.assertTrue(result.screenshot_path.is_file())
+            self.assertNotIn("device-1", manifest)
+            self.assertNotIn("hierarchy", manifest)
+            self.assertNotIn("已选", manifest)
+            self.assertIn('"unit_price": "12.88"', manifest)
+            self.assertIn('"selection_status": "restored"', manifest)
+            self.assertIn('"panel_status": "verified"', manifest)
+            self.assertIn('"safe_exit": "completed"', manifest)
+            self.assertFalse((target / "hierarchy.xml").exists())
+            self.assertEqual(_actions(device, "pressKey"), [("jsonrpc", "pressKey", ["back"], 10)])
+
+    def test_target_created_during_publish_is_preserved_without_staging_residue(self) -> None:
+        with TemporaryDirectory() as temporary:
+            target = Path(temporary) / "result"
+            original_rename = runner_module.os.rename
+
+            def create_target_then_rename(source: str | Path, destination: str | Path) -> None:
+                Path(destination).mkdir()
+                (Path(destination) / "sentinel").write_text("keep", encoding="utf-8")
+                original_rename(source, destination)
+
+            with patch.object(runner_module.os, "rename", side_effect=create_target_then_rename), self.assertRaises(SkuSelectionRunError):
+                self._runner(_FakeAdb(), _RawDevice()).run("device-1", _TARGET_URL, _TASK_COLOR, _TASK_SIZE, target)
+            self.assertEqual((target / "sentinel").read_text(encoding="utf-8"), "keep")
+            self.assertEqual(list(Path(temporary).glob(".result.staging-*")), [])
+
+    def test_bad_screenshot_or_existing_target_never_publishes_manifest(self) -> None:
+        with TemporaryDirectory() as temporary:
+            target = Path(temporary) / "result"
+            with self.assertRaises(SkuSelectionScreenshotError):
+                self._runner(_FakeAdb(), _RawDevice(screenshot="not-image")).run("device-1", _TARGET_URL, _TASK_COLOR, _TASK_SIZE, target)
+            self.assertFalse(target.exists())
+            self.assertEqual(list(Path(temporary).glob(".result.staging-*")), [])
+
+            target = Path(temporary) / "write-failure"
+            with patch.object(runner_module, "_save_base64_screenshot", side_effect=OSError("private path")):
+                with self.assertRaises(SkuSelectionScreenshotError):
+                    self._runner(_FakeAdb(), _RawDevice()).run("device-1", _TARGET_URL, _TASK_COLOR, _TASK_SIZE, target)
+            self.assertFalse(target.exists())
+            self.assertEqual(list(Path(temporary).glob(".write-failure.staging-*")), [])
+
+            adb = _FakeAdb()
+            device = _RawDevice()
+            target.mkdir()
+            sentinel = target / "keep"
+            sentinel.write_text("keep", encoding="utf-8")
+            with self.assertRaises(SkuSelectionRunError):
+                self._runner(adb, device).run("device-1", _TARGET_URL, _TASK_COLOR, _TASK_SIZE, target)
+            self.assertEqual(adb.calls, [])
+            self.assertEqual(device.calls, [])
+            self.assertEqual(sentinel.read_text(encoding="utf-8"), "keep")
+
+    def test_device_screen_and_output_preflight_fail_before_any_click(self) -> None:
+        with TemporaryDirectory() as temporary:
+            adb = _FakeAdb()
+            adb.inspection = DeviceInspection(AdbDevice(serial="device-1", state="device"), "wrong", "16")
+            device = _RawDevice()
+            with self.assertRaises(SkuSelectionRunError):
+                self._runner(adb, device).run("device-1", _TARGET_URL, _TASK_COLOR, _TASK_SIZE, Path(temporary) / "result")
+            self.assertEqual(device.calls, [])
+
+            class WrongScreenDevice(_RawDevice):
+                def window_size(self) -> tuple[int, int]:
+                    return 1080, 1920
+
+            device = WrongScreenDevice()
+            with self.assertRaises(SkuSelectionRunError):
+                self._runner(_FakeAdb(), device).run("device-1", _TARGET_URL, _TASK_COLOR, _TASK_SIZE, Path(temporary) / "screen")
+            self.assertEqual(_actions(device, "click"), [])
+
+            parent_file = Path(temporary) / "not-a-directory"
+            parent_file.write_text("x", encoding="utf-8")
+            adb = _FakeAdb()
+            device = _RawDevice()
+            with self.assertRaises(SkuSelectionRunError):
+                self._runner(adb, device).run("device-1", _TARGET_URL, _TASK_COLOR, _TASK_SIZE, parent_file / "result")
+            self.assertEqual(adb.calls, [])
+            self.assertEqual(device.calls, [])
+
+    def test_small_but_valid_png_is_not_accepted(self) -> None:
+        image = Image.new("RGB", (1, 1), "white")
+        raw = BytesIO(); image.save(raw, format="PNG")
+        with TemporaryDirectory() as temporary, self.assertRaises(SkuSelectionScreenshotError):
+            self._runner(_FakeAdb(), _RawDevice(screenshot=base64.b64encode(raw.getvalue()).decode("ascii"))).run(
+                "device-1", _TARGET_URL, _TASK_COLOR, _TASK_SIZE, Path(temporary) / "result"
+            )
+
+    def test_failure_after_entry_attempts_one_safe_exit_and_hides_device_detail(self) -> None:
+        adb = _FakeAdb()
+        device = _RawDevice()
+        device.fail_color_readback = True
+        device.select_alternates()
+        with TemporaryDirectory() as temporary:
+            with self.assertRaises(SkuSelectionError):
+                self._runner(adb, device).run("device-1", _TARGET_URL, _TASK_COLOR, _TASK_SIZE, Path(temporary) / "result")
+        self.assertEqual(_actions(device, "pressKey"), [])
+
+        class FailingRawDevice(_RawDevice):
+            def app_info(self, package_name: str) -> dict[str, str]:
+                raise RuntimeError("device-1 <xml>private</xml>")
+
+        with self.assertRaises(SkuSelectionDeviceAdapterError) as raised:
+            UiautomatorSkuPanelAdapter(FailingRawDevice(), 10).app_info("com.xunmeng.pinduoduo")
+        self.assertNotIn("device-1", str(raised.exception))
+        self.assertNotIn("private", str(raised.exception))
+
+    def test_unverified_failure_never_sends_blind_back(self) -> None:
+        class InvalidAfterOptionDevice(_RawDevice):
+            def jsonrpc_call(self, method: str, params: object = None, timeout: float = 10) -> str:
+                value = super().jsonrpc_call(method, params, timeout)
+                if method == "click" and "[396,498][895,570]" in self.hierarchy:
+                    self.hierarchy = "<hierarchy />"
+                return value
+
+        device = InvalidAfterOptionDevice()
+        device.select_alternates()
+        with TemporaryDirectory() as temporary, self.assertRaises(SkuSelectionError):
+            self._runner(_FakeAdb(), device).run("device-1", _TARGET_URL, _TASK_COLOR, _TASK_SIZE, Path(temporary) / "result")
+        self.assertEqual(_actions(device, "pressKey"), [])
+
+    def test_adapter_timeout_is_mapped_without_third_party_detail(self) -> None:
+        class TimeoutRawDevice(_RawDevice):
+            def jsonrpc_call(self, method: str, params: object = None, timeout: float = 10) -> str:
+                raise TimeoutError("device-1 <hierarchy>private</hierarchy>")
+
+        with self.assertRaises(SkuSelectionRunError) as raised:
+            UiautomatorSkuPanelAdapter(TimeoutRawDevice(), 10).dump_window_hierarchy()
+        self.assertNotIn("device-1", str(raised.exception))
+        self.assertNotIn("private", str(raised.exception))
+
+    def test_entry_attempt_is_recorded_before_unconfirmed_click_and_not_retried(self) -> None:
+        class TimeoutTapDevice(_RawDevice):
+            def jsonrpc_call(self, method: str, params: object = None, timeout: float = 10) -> str:
+                self.calls.append(("jsonrpc", method, params, timeout))
+                if method == "click":
+                    raise TimeoutError("device detail")
+                return super().jsonrpc_call(method, params, timeout)
+
+        adapter = UiautomatorSkuPanelAdapter(TimeoutTapDevice(), 10)
+        with self.assertRaises(SkuSelectionRunError):
+            adapter.tap_sku_entry("[900,1312][1056,1355]")
+        self.assertTrue(adapter.entry_was_tapped)
+        self.assertEqual(_actions(adapter._device, "click"), [("jsonrpc", "click", [978, 1333], 10)])
+
+    def test_entry_stability_interruptions_never_click(self) -> None:
+        now = [0.0]
+        class SequenceDevice(_RawDevice):
+            def __init__(self) -> None:
+                super().__init__(); self.frames = [_PRODUCT_PAGE, "<hierarchy />", _PRODUCT_PAGE]
+            def jsonrpc_call(self, method: str, params: object = None, timeout: float = 10) -> str:
+                if method == "dumpWindowHierarchy" and self.frames:
+                    self.hierarchy = self.frames.pop(0)
+                return super().jsonrpc_call(method, params, timeout)
+        device = SequenceDevice()
+        flow = SkuSelectionFlow(UiautomatorSkuPanelAdapter(device, 10), .02, .01, lambda: now[0], lambda x: now.__setitem__(0, now[0] + x))
+        with self.assertRaises(SkuSelectionError): flow.open_sku_panel(_TARGET_URL, "<hierarchy />")
+        self.assertEqual(_actions(device, "click"), [])
+
+    def test_screenshot_drift_and_foreground_drift_publish_nothing_and_never_back(self) -> None:
+        for drift in ("color", "size", "price"):
+            class DriftDevice(_RawDevice):
+                def jsonrpc_call(self, method: str, params: object = None, timeout: float = 10) -> str:
+                    value = super().jsonrpc_call(method, params, timeout)
+                    if method == "takeScreenshot":
+                        if drift == "price":
+                            self.hierarchy = self.hierarchy.replace("快卖完 ¥12.88", "快卖完 ¥13.88")
+                        else:
+                            root = ElementTree.fromstring(self.hierarchy)
+                            if drift == "color":
+                                for node in root.iter("node"):
+                                    if node.get("selected") is not None and ",1000]" in node.get("bounds", ""):
+                                        node.set("selected", "false")
+                                next(node for node in root.iter("node") if node.get("content-desc") == "粉红").set("selected", "true")
+                            else:
+                                for node in root.iter("node"):
+                                    if node.get("selected") is not None and ",1730]" in node.get("bounds", ""):
+                                        node.set("selected", "false")
+                                next(node for node in root.iter("node") if node.get("text") == "L（建议115-130）").set("selected", "true")
+                            self.hierarchy = ElementTree.tostring(root, encoding="unicode")
+                    return value
+            with self.subTest(drift=drift), TemporaryDirectory() as temporary:
+                target = Path(temporary) / "out"
+                with self.assertRaises((SkuSelectionError, SkuSelectionRunError)):
+                    self._runner(_FakeAdb(), DriftDevice()).run("device-1", _TARGET_URL, _TASK_COLOR, _TASK_SIZE, target)
+                self.assertFalse(target.exists())
+                self.assertFalse((target / "manifest.json").exists())
+                self.assertEqual(list(Path(temporary).glob(".out.staging-*")), [])
+
+        device = _RawDevice(); device.select_alternates()
+        device.package = "other"
+        with self.assertRaises(SkuSelectionError): SkuSelectionFlow(UiautomatorSkuPanelAdapter(device, 10)).exit_sku_panel_safely()
+        self.assertEqual(_actions(device, "pressKey"), [])
+
+    def test_screenshot_then_foreground_drift_publishes_nothing_and_never_back(self) -> None:
+        class ForegroundDriftDevice(_RawDevice):
+            def jsonrpc_call(self, method: str, params: object = None, timeout: float = 10) -> str:
+                value = super().jsonrpc_call(method, params, timeout)
+                if method == "takeScreenshot": self.package = "other"
+                return value
+
+        device = ForegroundDriftDevice()
+        with TemporaryDirectory() as temporary:
+            target = Path(temporary) / "out"
+            with self.assertRaises(SkuSelectionError):
+                self._runner(_FakeAdb(), device).run("device-1", _TARGET_URL, _TASK_COLOR, _TASK_SIZE, target)
+            self.assertFalse(target.exists())
+            self.assertFalse((target / "manifest.json").exists())
+            self.assertEqual(list(Path(temporary).glob(".out.staging-*")), [])
+        self.assertEqual(_actions(device, "pressKey"), [])
+
+    def test_option_timeout_reconciliation_controls_back_once(self) -> None:
+        class OptionTimeoutDevice(_RawDevice):
+            def __init__(self, delivered: bool) -> None:
+                super().__init__(); self.delivered = delivered; self.clicks = 0
+            def jsonrpc_call(self, method: str, params: object = None, timeout: float = 10) -> str:
+                if method == "click":
+                    self.clicks += 1
+                    if self.clicks == 2:
+                        if self.delivered: super().jsonrpc_call(method, params, timeout)
+                        else: self.calls.append(("jsonrpc", method, params, timeout))
+                        raise TimeoutError("uncertain option")
+                return super().jsonrpc_call(method, params, timeout)
+
+        for delivered, expected_back in ((False, 0), (True, 1)):
+            with self.subTest(delivered=delivered), TemporaryDirectory() as temporary:
+                device = OptionTimeoutDevice(delivered); device.select_alternates()
+                adb = _FakeAdb(); device.hierarchy = "<hierarchy />"
+                adb.on_intent = lambda: setattr(device, "hierarchy", _PRODUCT_PAGE.replace("<hierarchy>", '<hierarchy post-intent="1">'))
+                runner = SkuSelectionRunner(adb, lambda serial: device, .03)
+                with self.assertRaises(SkuSelectionRunError):
+                    runner.run("device-1", _TARGET_URL, _TASK_COLOR, _TASK_SIZE, Path(temporary) / "out")
+                self.assertEqual(len(_actions(device, "click")), 2)
+                self.assertEqual(len(_actions(device, "pressKey")), expected_back)
+
+    def test_back_timeout_is_never_retried(self) -> None:
+        class BackTimeoutDevice(_RawDevice):
+            def jsonrpc_call(self, method: str, params: object = None, timeout: float = 10) -> str:
+                if method == "pressKey":
+                    super().jsonrpc_call(method, params, timeout)
+                    raise TimeoutError("back uncertain")
+                return super().jsonrpc_call(method, params, timeout)
+
+        device = BackTimeoutDevice()
+        with TemporaryDirectory() as temporary, self.assertRaises(SkuSelectionRunError):
+            self._runner(_FakeAdb(), device).run("device-1", _TARGET_URL, _TASK_COLOR, _TASK_SIZE, Path(temporary) / "out")
+        self.assertEqual(len(_actions(device, "pressKey")), 1)
+
+    def test_entry_click_timeout_reconciles_only_through_verified_flow_exit(self) -> None:
+        class DeliveredThenTimeout(_RawDevice):
+            def jsonrpc_call(self, method: str, params: object = None, timeout: float = 10) -> str:
+                if method == "click" and self.hierarchy != _FIXTURE.read_text(encoding="utf-8"):
+                    super().jsonrpc_call(method, params, timeout)
+                    raise TimeoutError("delivery uncertain")
+                return super().jsonrpc_call(method, params, timeout)
+
+        device = DeliveredThenTimeout()
+        with TemporaryDirectory() as temporary, self.assertRaises(SkuSelectionRunError):
+            self._runner(_FakeAdb(), device).run("device-1", _TARGET_URL, _TASK_COLOR, _TASK_SIZE, Path(temporary) / "result")
+        self.assertEqual(len(_actions(device, "click")), 1)
+        self.assertEqual(len(_actions(device, "pressKey")), 1)
+
+
+class SkuSelectionCliTests(unittest.TestCase):
+    def test_cli_accepts_only_target_url_and_task_values(self) -> None:
+        script = _load_runner_script()
+        valid = {
+            "serial": "device-1",
+            "url": _TARGET_URL,
+            "color": _TASK_COLOR,
+            "size": _TASK_SIZE,
+            "output_dir": Path("evidence"),
+            "timeout": 10.0,
+            "adb": "adb",
+        }
+        script.validate_arguments(type("Arguments", (), valid)())
+        for field, value in (("serial", ""), ("url", "https://mobile.yangkeduo.com/goods.html?goods_id=1"), ("color", "黑色 CHA (纯棉）"), ("size", "M（建议100-115）"), ("timeout", 0), ("timeout", float("inf"))):
+            with self.subTest(field=field, value=value), self.assertRaises((ValueError, SkuSelectionError)):
+                script.validate_arguments(type("Arguments", (), valid | {field: value})())
+
+    def test_cli_main_catches_flow_error_without_traceback_or_page_body(self) -> None:
+        script = _load_runner_script()
+
+        class FlowFailingRunner:
+            def __init__(self, *args: object, **kwargs: object) -> None: pass
+            def run(self, *args: object, **kwargs: object) -> object:
+                raise SkuSelectionError("<hierarchy>page-body</hierarchy>")
+
+        stderr = BytesIO()
+        # TextIOWrapper keeps the assertion independent from host console encoding.
+        import io
+        text_stderr = io.TextIOWrapper(stderr, encoding="utf-8")
+        with patch.object(script, "SkuSelectionRunner", FlowFailingRunner), redirect_stderr(text_stderr):
+            status = script.main([
+                "--serial", "device-1", "--url", _TARGET_URL, "--color", _TASK_COLOR,
+                "--size", _TASK_SIZE, "--output-dir", "evidence",
+            ])
+        text_stderr.flush()
+        output = stderr.getvalue().decode("utf-8")
+        self.assertEqual(status, 1)
+        self.assertNotIn("Traceback", output)
+        self.assertNotIn("page-body", output)
+
+
+def _load_runner_script() -> object:
+    path = Path(__file__).resolve().parents[2] / "scripts" / "run_t103_sku_selection.py"
+    specification = importlib.util.spec_from_file_location("run_t103_sku_selection_test", path)
+    if specification is None or specification.loader is None:
+        raise RuntimeError("无法加载 T-103 运行脚本。")
+    module = importlib.util.module_from_spec(specification)
+    specification.loader.exec_module(module)
+    return module
+
+
+if __name__ == "__main__":
+    unittest.main()

docs/00-ai-start-here.md

@@ -9,13 +9,10 @@ cmbuyer 是一个自动化采购系统：**采购服务**（网页端，`admin/`
 **采购工具**（桌面端，`client/`）驱动 Android 手机在拼多多完成找货和下单，
 **付款始终由人完成**。
 
-第一版 MVP 只做**任务自带商品链接**的情形，**分两趟跑**：
-
-1. **第一趟试选**：桌面端定时领取 → 开商品 → 精确勾选颜色分类和尺码 → 读单价 →
-   截图 → **退出释放手机** → 回传。
-2. **人工确认**：管理员在网页端看「机器选对了吗」，确认后签发授权并**锁定单价**。
-3. **第二趟下单**：重新开商品 → 重新选同一规格 → **三道价格闸门** → 提交订单一次 →
-   任务转「待付款」，人在拼多多核对后付款。
+第一版 MVP 只做**任务自带商品链接**的情形。创建任务不授权；管理员勾选 `DRAFT` 并点击
+“开始采购（只创建待付款订单）”后，服务端锁定商品、规格、数量和最高总价并签发一次性授权。
+采购工具领取后在**同一趟**完成精确选规格、三道价格闸门、数量复核、确认页、提交围栏和唯一一次
+“提交订单”点击。中间不等待人工确认；订单创建后转待付款，由人核对和付款。
 
 ## 上下文读取
 
@@ -24,7 +21,7 @@ cmbuyer 是一个自动化采购系统：**采购服务**（网页端，`admin/`
 1. [`01-vision.md`](01-vision.md)：为什么做、为谁做、什么不做。
 2. [`02-requirements.md`](02-requirements.md)：MVP 要什么、怎么算达成。
 3. [`03-tech-stack.md`](03-tech-stack.md)：两端各自的技术选型与验证矩阵。
-4. [`04-architecture.md`](04-architecture.md)：双端职责、**两趟执行**、**三道价格闸门**、安全边界、数据模型。
+4. [`04-architecture.md`](04-architecture.md)：双端职责、**单趟执行**、**三道价格闸门**、安全边界、数据模型。
 5. [`05-coding-rules.md`](05-coding-rules.md)：写代码前必须遵守的规则。
 6. [`06-tasks.md`](06-tasks.md)：阶段路线图与建议拆分。
 7. [`tasks/README.md`](tasks/README.md)：任务文件约定。
@@ -61,7 +58,7 @@ cmbuyer 是一个自动化采购系统：**采购服务**（网页端，`admin/`
 ### 2. 安全边界只能收紧，不能放宽
 
 [`04-architecture.md`](04-architecture.md) 第四节的硬约束（不付款、提交订单四条件与服务端围栏、
-规格精确匹配、提交控件唯一、数量必须复核、三道价格闸门、第一趟不下单、外部支付停止、
+规格精确匹配、提交控件唯一、数量必须复核、三道价格闸门、隔离能力不越界、外部支付停止、
 安全校验停止、敏感信息不提取、授权一次性）**不得在任务中顺手放宽**。
 
 确需变更时先改架构文档并说明理由，再动代码。任何「为了让流程跑通先放宽一下」的改动
@@ -77,30 +74,31 @@ cmbuyer 是一个自动化采购系统：**采购服务**（网页端，`admin/`
 
 理由与三道闸门的定义见 [`04-architecture.md`](04-architecture.md) 第三节。
 
-### 4. 第一趟绝不下单
+### 4. 真机能力逐段取证、隔离开放
 
-试选阶段只勾选规格和读价，**绝不点击「现在买」或任何进入下单流程的入口**。
-第一趟的代码路径不得引用 `go_to_order_confirm()` 与 `submit_order()`，必须有测试
-证明它们不可达。
+T-103 的 `SkuSelectionFlow` 只允许证据绑定的受控入口、精确选择、读价和安全退出；不得引用
+数量、确认页、提交围栏、提交或付款能力。T-105～T-107 分别取证后才可组合。生产单趟只有在全部
+能力均获证据、三道闸门通过且服务端围栏明确许可后才能点击一次；支付能力永不开放。
 
 ## 当前阶段
 
-**Phase 0 · 地基。** 采购服务与采购工具骨架均已初始化，尚无采购业务代码。
+**Phase 1 · 真机可行性，并行启动采购服务基础能力。** 两端骨架与核心数据模型已完成，T-103
+仍是当前真机关键路径；与真机可读字段无关的采购服务能力不再空等。
 
 执行按任务依赖驱动，**不按 Phase 整段串行等待**。当前优先路径：
 
-1. T-003 统一入口与 T-004 核心数据模型已完成；T-101 真机环境盘点已就绪，但尚未真机验收。
-2. T-002 已完成，立即推进 **T-101 → T-102 → T-103 真机取证**。
-3. T-103 结论确认后，才开始依赖真机可读字段的 Phase 2 生产页面；采购服务核心与
-   T-104 → T-107 后续真机安全判据按依赖并行推进。
-4. Phase 3：双端打通与**第一趟试选**端到端。
-5. Phase 4：**第二趟下单**与收尾。
+1. T-111 先冻结“开始采购授权”的单趟契约；同时主审并合入只创建 `DRAFT` 的 T-202。
+2. T-111 完成后恢复 **T-103 真机取证**；按依赖推进 T-104 → T-107 的分段安全判据。
+3. admin agent 先做 T-209 把旧两趟 schema / 状态机迁到单趟，再推进 T-203 服务端批量开始采购 /
+   一次性授权；两者不依赖页面选择器。T-205 起的 attempt 与证据字段等待 T-103。
+4. Phase 3：双端打通与单趟围栏前 dry-run。
+5. Phase 4：单趟真实提交、待付款、调和与收尾。
 6. V2 及以后：图搜、Excel、ERP、订单自动核对、AI 辅助。
 
 > **M2 是本项目的生死线**：真机能按链接打开商品、精确勾选颜色分类和尺码、
 > **读到该 SKU 的单价**（T-103）。前序项目正是卡在选规格和读价。
-> M2 不通过之前不要写 Phase 2 的生产页面；Phase 0 原型只确认流程与信息架构，实际可读
-> 字段仍以真机证据为准。
+> M2 不通过之前不要写**依赖真机可读字段的生产执行逻辑**；管理会话、`DRAFT` 建单和只锁定
+> 已有任务字段的服务端授权事务可以并行。实际可读字段仍以真机证据为准。
 
 ## 领取任务规则
 
@@ -121,12 +119,11 @@ cmbuyer 是一个自动化采购系统：**采购服务**（网页端，`admin/`
 
 只做：
 
-- **手工填链接**建单、任务查询、勾选待开始任务后批量开始第一趟试选
-- 桌面端**定时轮询**领取（试选与下单两类）
-- 第一趟试选：精确勾选规格、读单价、截图、退出释放手机
-- 人工确认「机器选对了吗」并签发授权（**锁定单价**）
-- 授权超时与放弃，任务不会被永久锁死
-- 第二趟下单：三道闸门全过后提交订单一次
+- **手工填链接**建单、任务查询、勾选待开始任务后批量“开始采购”
+- 点击开始采购即签发锁定商品、规格、数量和最高总价的一次性授权
+- 桌面端定时轮询只领取已授权任务，在同一趟精确选规格、两次读价、复核数量和确认页金额
+- 围栏前失败/过期可人工回到待开始；围栏后只能调和
+- 三道闸门全过、服务端围栏明确许可后提交订单一次
 - 真实点击前服务端原子建立提交围栏；围栏失败不点击，围栏后只调和同一提交记录
 - 待付款展示订单截图，人核对付款后手工标记完成
 - 失败分类与转人工
@@ -166,7 +163,7 @@ cmbuyer 是一个自动化采购系统：**采购服务**（网页端，`admin/`
 | 采购服务页面 | `02-requirements.md` 验收 → `07-user-stories.md` → `08-interaction-checklist.md` → `routes.md` → `04-architecture.md` |
 | 采购工具界面 | 同上，`routes.md` 看第三节桌面端结构 |
 | 设备侧 API | `api.md` → `04-architecture.md` 数据模型与鉴权边界 |
-| 真机自动化 | `04-architecture.md` 第三节两趟执行与三道闸门 → 第四节边界 → `api.md` 第三节模块合约 → **先真机取证** |
+| 真机自动化 | `04-architecture.md` 第三节单趟执行与三道闸门 → 第四节边界 → `api.md` 第三节模块合约 → **先真机取证** |
 | 数据模型 | `04-architecture.md` 第五节；schema 变化必须同步 `api.md` 和 `current-state.md` |
 | 部署 / 运行 | `03-tech-stack.md` → `current-state.md` |
 

docs/01-vision.md

@@ -5,15 +5,15 @@
 cmbuyer 要解决：**采购人员为了履约一笔外部订单，必须手工去拼多多找到同款商品、选对
 颜色尺码、下单，再把订单号抄回系统——这个过程重复、易错、且无法追溯。**
 
-> 让采购人员把「买什么」一次说清楚，由系统驱动手机完成找货、选规格和下单，人只在
-> 两个关键点介入：**挑哪一个**和**付不付款**。
+> 让采购人员把“买什么、买多少、最多多少钱”一次说清楚，并明确点击开始采购；系统驱动手机
+> 精确选规格并创建待付款订单，**付不付款始终由人决定**。
 
 它不是无人值守的抢购脚本，也不是绕过平台规则的爬虫。它是一个**带人工闸门的采购执行
 工具**：机器负责重复劳动，人保留花钱的决定权。
 
 ## 二、目标用户
 
-- **采购管理员**：在网页端建单、复核候选商品、签发下单授权、查看执行证据。
+- **采购管理员**：在网页端建单、点击开始采购签发一次性授权、查看执行证据。
 - **采购执行员**：在桌面端连接手机、启动批次、处理需要人工接管的任务、完成付款。
 - **ERP 对接身份**：只读同步第三方系统的货运单与商品明细，不参与采购决策。
 - **系统管理员（后续）**：人员、设备、权限和审计策略管理，MVP 不提供完整界面。
@@ -27,7 +27,8 @@ cmbuyer 要解决：**采购人员为了履约一笔外部订单，必须手工
   绝不猜测。宁可少做，不可做错。
 - **先走确定路径**：MVP 只做已知商品链接的情形。图片搜索推到 V2，且届时其唯一职责
   是产出 `goods_id`，不在搜索结果页上做价格或规格判断。
-- **人站在不可逆动作正前方**：机器先试选并回传，人看过之后才授权下单。
+- **授权点明确且前置**：创建任务不授权；管理员点击“开始采购”才允许创建一笔待付款订单。
+- **实时闸门不依赖旧截图**：授权后同一设备会话两次读取规格面板价格，并在确认页校验总额。
 - **价格只在可靠位置读**：规格面板和订单确认页。别处的数字一律不信。
 - **失败要可诊断**：不能只返回「失败」，必须有步骤、错误码、截图和页面快照。
 - **证据分层**：人工决策需要的证据上传服务端，完整执行轨迹留在桌面端本地。
@@ -37,9 +38,9 @@ cmbuyer 要解决：**采购人员为了履约一笔外部订单，必须手工
 | 价值点 | 用户得到什么 |
 | --- | --- |
 | 消除重复劳动 | 不再逐条手工搜索、选规格、抄订单号 |
-| 决策集中可控 | 所有「买哪个」的决定收敛到网页端一处，有据可查 |
+| 决策集中可控 | 商品、规格、数量、最高总价和开始采购授权收敛到网页端，有据可查 |
 | 资金边界清晰 | 系统能下单不能付款，误操作不会直接造成损失 |
-| 执行可追溯 | 每笔采购留下候选、截图、授权理由和订单核对记录 |
+| 执行可追溯 | 每笔采购留下授权、三道闸门、截图、围栏和订单核对记录 |
 | 批量顺序执行 | 一次导入多条，按顺序跑，遇到问题停在该停的地方 |
 
 ## 五、不做什么（非目标）

docs/02-requirements.md

@@ -1,50 +1,48 @@
 # 需求
 
-> 本文只描述**要什么**与**怎么算达成**，用产品 / 用户语言表达，**不涉及技术实现**。
-> 技术方案、数据结构、字段定义见 [架构设计](04-architecture.md)。
+> 本文只描述**要什么**与**怎么算达成**，用产品 / 用户语言表达。技术方案、数据结构与
+> 字段定义见[架构设计](04-architecture.md)。
 
 ## 一、业务现状
 
 | 项 | 状态 |
 | --- | --- |
 | 用户 | 采购人员为履约外部订单，逐条手工在拼多多找同款、选颜色尺码、下单、抄回订单号 |
-| 任务来源 | 第三方 ERP（顺运宝）货运单与商品明细为主；Excel 批量导入和手工填链接为补充 |
-| 数据 | ERP 提供商品标题、规格、数量、参考图；部分明细带拼多多链接，部分只有图 |
-| 现有系统 | 两个前序原型（见 [愿景](01-vision.md) 第六节），代码不直接复用 |
+| MVP 任务来源 | 管理员手工填写拼多多商品链接、规格、数量和金额上限 |
+| 后续任务来源 | Excel 与第三方 ERP（顺运宝）货运明细 |
 | 设备 | 一台 Windows 电脑 + 一台已登录拼多多的 Android 手机，USB 或 WiFi ADB 连接 |
-| 约束 | 不得绕过平台风控；付款必须人工；手机需保持亮屏解锁 |
+| 约束 | 不绕过平台风控；系统只创建待付款订单；付款必须由人完成；手机保持亮屏解锁 |
 
 ## 二、用户角色
 
-- **采购管理员**：在网页端建单、查询、复核候选、签发下单授权、查看审计记录。
-- **采购执行员**：在桌面端连接设备、启动批次、处理待人工任务、在拼多多完成付款。
+- **采购管理员**：在采购服务建单、查询、点击“开始采购”签发一次性采购授权、查看审计记录。
+- **采购执行员**：在采购工具连接设备、启动轮询、处理待人工任务、在拼多多完成人工付款。
 - **ERP 对接身份**：只读同步货运单与商品明细，不能建单、授权或访问采购结果。
-- **设备身份**：一台已授权桌面端实例，用于领取任务和回传结果，不能建单或授权。
+- **设备身份**：一台已授权采购工具实例，用于领取已授权任务和回传结果，不能建单或授权。
 - **未登录用户**：不能访问任何任务、图片、证据或设备接口。
 
 ## 三、功能清单
 
 ### 第一版 MVP（最小闭环）
 
-MVP 只做**任务自带商品链接**的情形，分两趟执行：第一趟试选并回传，人确认后第二趟下单。
-流程见[架构设计](04-architecture.md)第三节。
+MVP 只做**任务自带商品链接**的情形。管理员点击“开始采购”后，采购工具在同一次设备会话中
+完成选规格、校验价格与数量、创建待付款订单；中间不再回到采购服务等待“机器选对了吗”。
 
 | ID | 功能 | 用户能做什么 | 优先级 | 关联用户故事 |
 | --- | --- | --- | --- | --- |
-| F-001 | 手工建单 | 管理员在任务列表内填写任务名称、拼多多链接、颜色分类、尺码、数量、价格上限，保存一条待开始任务 | P0 | US-001 |
-| F-004 | 任务查询 | 管理员按关键词、状态、时间范围找到目标任务 | P0 | US-002 |
-| F-005 | 桌面端定时领取 | 执行员启动会话后，桌面端定时轮询领取待试选和已授权两类任务 | P0 | US-003 |
-| F-006 | 第一趟试选 | 系统打开商品、按维度精确勾选颜色分类和尺码、读单价、截图后退出 | P0 | US-003 |
-| F-007 | 试选结果回传 | 管理员看到机器实际选中的规格、单价、合计和规格面板截图 | P0 | US-004 |
-| F-008 | 人工确认与授权 | 管理员确认机器选对了，签发一次性授权并锁定价格；或退回不买 | P0 | US-004、US-005 |
-| F-009 | 第二趟下单 | 系统重新选同一规格、过三道价格闸门后提交订单，回传订单截图 | P0 | US-005 |
-| F-010 | 授权超时与放弃 | 管理员在授权卡住时能放弃并重新确认，任务不会被永久锁死 | P0 | US-005 |
-| F-011 | 结果与失败分类回传 | 管理员看到成功、失败、已取消、待人工，以及可区分的失败原因和证据 | P0 | US-002、US-008 |
-| F-013 | 登录与身份隔离 | 管理员用账号登录网页端；桌面端用设备凭据接入，两者权限不互通 | P0 | US-007 |
-| F-017 | 下单 dry-run、提交围栏与调和 | 真机先只读演练到订单确认页；真实点击前由服务端原子冻结授权；点击后只调和结果、绝不重试 | P0 | US-005、US-008 |
-| F-018 | 批量开始试选 | 管理员勾选一条或多条待开始任务，统一放入第一趟试选队列 | P0 | US-010 |
+| F-001 | 手工建单 | 填写标题、拼多多链接、颜色分类、尺码、数量、最高总价，保存为待开始任务 | P0 | US-001 |
+| F-004 | 任务查询 | 按标题关键词、状态、时间范围找到任务，双击行查看详情 | P0 | US-002 |
+| F-005 | 桌面端定时领取 | 执行员启动会话后定时领取已获采购授权的任务 | P0 | US-003 |
+| F-006 | 单趟采购执行 | 打开商品、精确选择规格、校验价格、设置数量、进入确认页并创建待付款订单 | P0 | US-003、US-005 |
+| F-007 | 执行证据回传 | 管理员查看实际规格、三道闸门、原始页面截图和步骤记录 | P0 | US-002、US-008 |
+| F-008 | 开始采购授权 | 管理员批量点击一次，原子锁定每条任务并签发一次性待付款订单授权 | P0 | US-005、US-010 |
+| F-010 | 围栏前过期与重新授权 | 未建立提交围栏的失败或过期任务回到待开始，可由管理员重新点击开始采购 | P0 | US-005 |
+| F-011 | 结果与失败分类回传 | 查看成功、失败、已取消、待人工及可诊断原因和证据 | P0 | US-002、US-008 |
+| F-013 | 登录与身份隔离 | 管理员用账号登录；采购工具用设备凭据接入，权限不互通 | P0 | US-007 |
+| F-017 | 提交围栏与调和 | 真机点击前服务端原子冻结授权；点击后只调和同一提交，绝不重试 | P0 | US-005、US-008 |
+| F-018 | 批量开始采购 | 勾选一条或多条待开始任务，统一授权采购工具创建待付款订单 | P0 | US-010 |
 
-> F-002、F-003、F-012 已移出 MVP，编号保留不重用，见下表。
+> 原 F-009 的“两趟下单”并入 F-006；F-002、F-003、F-012 移出 MVP，编号不重用。
 
 ### 后续迭代
 
@@ -52,141 +50,128 @@ MVP 只做**任务自带商品链接**的情形，分两趟执行：第一趟试
 | --- | --- | --- |
 | F-002 Excel 批量建单 | 上传固定表头表格批量生成任务 | V2，被表头契约待确认阻塞 |
 | F-003 从 ERP 货运明细建单 | 同步顺运宝货运单后复核生成任务 | V2，被字段映射待确认阻塞 |
-| F-012 批量顺序编排与人工接管 | 对已开始任务排序、暂停继续、运行中接管 | V2；MVP 仅支持批量开始试选，实际执行仍由定时轮询领取 |
-| F-014 图片搜索路径（B 路径） | 任务只有参考图时搜图产出 goods_id 候选 | V2 |
+| F-012 批量编排与运行中接管 | 排序、暂停继续、运行中接管 | V2；MVP 只批量授权，设备逐条领取 |
+| F-014 图片搜索路径 | 任务只有参考图时搜图产出 goods_id 候选 | V2 |
 | F-015 候选对照台 | 多个候选并排对照挑选 | V2，随 F-014 |
-| F-016 订单自动核对回读 | 付款后只读读取订单页做五项唯一匹配并回写 | V2；MVP 用截图 + 人眼核对 |
+| F-016 订单自动核对回读 | 付款后只读读取订单页做唯一匹配并回写 | V2；MVP 用截图 + 人眼核对 |
 | F-101 AI 辅助候选判断 | 用模型看搜索结果页截图判断同款 | V2 之后 |
 | F-102 AI 辅助页面理解 | 规则读不到规格或价格时用模型兜底 | V2 之后 |
-| F-103 执行轨迹本地留档 | 记录模型输入输出与规则判断的分歧 | V2 之后 |
-| F-104 多设备并行 | 一个桌面端驱动多台手机 | V2 之后 |
+| F-103 执行轨迹本地留档 | 记录模型输入输出与规则判断分歧 | V2 之后 |
+| F-104 多设备并行 | 一个采购工具驱动多台手机 | V2 之后 |
 | F-105 完整 RBAC | 管理员、执行员、审核员细粒度权限 | V2 之后 |
 | F-106 多平台比价 | 淘宝、1688、京东 | V3 |
 | 支付自动化 | **不在规划内** | 未规划 |
 
 ## 四、核心用户故事（MVP）
 
-详细故事以[用户故事清单](07-user-stories.md)为准；本文只维护功能、优先级与 US 编号的
-索引，避免两处成为相互冲突的权威来源。
+详细故事以[用户故事清单](07-user-stories.md)为准。
 
 | 功能 | 用户故事 | 优先级 |
 | --- | --- | --- |
 | F-001 | US-001 | P0 |
-| F-004、F-011 | US-002 | P0 |
+| F-004、F-007、F-011 | US-002 | P0 |
 | F-005、F-006 | US-003 | P0 |
-| F-007、F-008 | US-004 | P0 |
-| F-008、F-009、F-010、F-017 | US-005 | P0 |
+| F-008、F-010、F-017 | US-005 | P0 |
 | F-013 | US-007 | P0 |
-| F-011 | US-008 | P0 |
-| F-018 | US-010 | P0 |
+| F-007、F-011、F-017 | US-008 | P0 |
+| F-008、F-018 | US-010 | P0 |
 
-US-006（付款前核对）在 MVP 降级为：系统展示订单截图与授权信息，人在拼多多自行核对
-后付款并手工标记完成。自动回读核对是 F-016（V2）。US-009（ERP 建单）随 F-003 移出 MVP。
+US-004 的试选后人工确认已从 MVP 删除。US-006 在 MVP 为：系统展示订单截图与授权信息，
+人在拼多多核对、付款并手工标记完成；自动回读核对是 F-016（V2）。
 
 ## 五、验收标准（MVP）
 
-### 建单
+### 建单与授权
 
-- **F-001**：在任务列表点击创建，填入任务名称、合法拼多多链接、颜色分类、尺码、数量、
-  价格上限后保存，返回任务编号；弹窗关闭，任务按创建时间倒序出现在第一行且状态为待开始。
-  链接格式非法或无法解析出 `goods_id` 时明确报错并保留已填内容。
-- **F-018**：列表只允许勾选待开始任务；全选只覆盖当前筛选结果中可开始的任务。点击
-  「开始试选」后，被选任务原子转为待领取，并明确提示这只是进入第一趟试选队列，
-  **不签发下单授权、不创建订单、不付款**。任一任务状态已变化时整批不提交，刷新后重选。
+- **F-001**：任务列表点击创建，填入标题、合法拼多多链接、颜色分类、尺码、数量和最高总价后
+  保存，弹窗关闭；新任务按创建时间倒序出现在第一行，状态为 `DRAFT`。非法链接或无法解析
+  `goods_id` 时明确报错并保留输入。
+- 创建任务**不构成采购授权**，设备不能领取 `DRAFT`。
+- **F-018**：只允许勾选当前筛选结果中的 `DRAFT`。点击“开始采购（只创建待付款订单）”前，
+  界面显示已选数量和最高总额；点击本身即管理员明确授权，不再增加选品确认步骤。
+- 服务端在一个事务中校验整批任务仍为预期版本，逐条锁定 `goods_id`、颜色、尺码、数量、最高
+  总价、授权人和有效期，并把任务转 `PENDING`。任一条冲突时整批不变，刷新后重选。
+- 相同 `start_key` 重放返回同一结果；不得产生第二份有效授权。成功后即时提示“已授权 N 条，
+  采购工具只会创建待付款订单，不会付款”。
 
-### 第一趟：试选
+### 单趟采购执行
 
-- **F-005**：执行员启动会话后桌面端定时轮询，同时领取待试选与已授权两类任务。
-  两个实例并发领取同一条时只有一个成功，另一个得到明确的「无可领任务」而不是报错。
-  **关闭会话即停止轮询；连续失败达到阈值自动停止并提示原因。**
-- **F-006**：手机打开对应商品详情页，打开规格面板，按维度精确匹配颜色分类和尺码。
-  **任一维度找不到精确值即停止并转人工，不选相近选项。** 勾选后读取该 SKU 单价
-  （闸门一），读不到即转人工，**不用商品详情页正文或搜索页的数字凑合**。
-- **F-006 释放要求**：试选完成后**必须退出商品页释放手机**，不得停在规格面板等待人工。
-- **F-006 硬边界**：试选阶段**绝不点击「现在买」或任何进入下单流程的入口**。
-  必须有测试证明该路径不调用任何下单语义动作。
-- **F-007**：回传商品标题、实际勾选到的颜色分类与尺码、单价、合计（单价 × 数量）和
-  规格面板截图；任务转「等你确认」。
+- **F-005**：采购工具只领取 `PENDING` 且授权有效的任务。并发领取同一条时只有一个成功；关闭
+  会话即停止轮询，连续失败达到阈值自动停止并显示原因。
+- **F-006 受控入口**：只点击与本项目真机证据及 App 版本绑定的精确唯一规格面板入口。当前仅确认
+  拼多多 `8.17.0`、goods_id `937122477375` 的“快要抢光”；其他入口必须分别取证，不按购买语义泛化。
+- **F-006 规格与数量**：颜色分类、尺码必须在各自维度内精确唯一匹配并读回；数量设置后必须读回
+  等于任务值。缺失、重复、禁用、前缀碰撞、读回不一致都停止，不选相近项。
+- **F-006 三道价格闸门**：价格只从规格面板和订单确认页读取，金额使用十进制字符串。
+  1. 选中目标规格后读取当前 SKU 单价，计算 `单价 × 数量`，不得超过授权最高总价。
+  2. 设置并复核数量后再次读取同一规格与单价；规格必须仍相同，单价必须与闸门一完全相等。
+  3. 订单确认页核对规格、数量与应付总额；总额不得超过授权最高总价。
+  任一道读不到、有歧义或不通过都停止并转人工，不从详情页、搜索页或按钮文字凑价格。
+- 同一设备会话连续完成上述步骤；不退出商品再等采购服务确认，也不把旧截图或旧页面读数当作
+  当前提交依据。
 
-### 决策与资金
+### 提交围栏与资金边界
 
-- **F-008**：管理员在确认页看到需求与机器所选的对照、单价、合计和截图，点击确认后
-  签发一次性授权，**授权锁定当次试选的单价**。授权重复提交幂等，不产生第二笔订单。
-  管理员也可选择「退回，不买」，任务终止。
-- **F-009 三道闸门**：第二趟重新打开商品并重新勾选同一规格后，
-  ① 重读单价必须与授权锁定价一致；
-  ② 数量设置后读回必须精确等于要求值；
-  ③ 订单确认页「实付款」不得超过授权总额上限。
-  **任一道不通过即停止并转人工。**
-- **F-009 提交条件**：授权存在且未消费、闸门全过、「提交订单」控件文本精确相等且可
-  点击祖先唯一——四者同时满足，且服务端已原子建立提交围栏，才允许**点击一次**。点击后
-  无论超时、跳外部支付还是遇到安全校验，**一律进入结果调和或人工核查且禁止重试**。
-- **F-010**：授权带过期时间。建立提交围栏前，超时或主动放弃都会作废授权并让任务进入
-  「待重新试选」，不得直接复用旧试选再次确认；建立提交围栏后，授权不得过期或放弃，
-  只能调和结果或转人工核查。**任何状态都必须给出安全且可执行的下一步。**
-- **F-017 dry-run**：首次真实下单前必须先完成一次只读演练：到订单确认页读取规格、数量、
-  「实付款」，验证提交控件唯一，然后停止并退出；**不点击「提交订单」**。演练结果与证据
-  必须回传，真实提交不得把旧演练当成当前页面事实。
-- **F-017 提交围栏**：desk 端在真实点击前向 web 端申请提交围栏；web 端必须在一个原子
-  事务中复核任务版本、授权未消费、命令与演练关联正确，然后冻结授权并生成唯一
-  `order_submission`。申请失败或响应不明确时不得点击。围栏成功后只能点击一次；点击结果
-  不明确时保留金额额度并进入调和，不能重新申请或重新点击。
-- **资金硬边界**：系统在任何路径下都不点击支付、免密支付、先用后付或任何扣款控件。
-  必须有测试证明提交订单之后不调用任何支付动作。
+- **F-017**：闸门二、闸门三和提交控件唯一均通过后，采购工具把当前验证摘要发给采购服务并申请
+  提交围栏。服务端原子复核任务版本、一次性授权未消费、领取身份、规格、数量、闸门值和唯一性，
+  创建或重放唯一 `order_submission`，才返回 `click_permitted=true`。
+- 围栏申请失败、冲突、超时、断网或响应不明确时**不得点击**。围栏成功后只可精确点击一次
+  “提交订单”；点击后无论结果、超时、外部支付交接或安全校验都禁止重试。
+- 明确创建订单后任务转 `WAITING_PAYMENT`；结果不明确转 `RECONCILIATION_REQUIRED`，授权和围栏
+  保持占用，只能调和同一提交记录。
+- 围栏建立前，授权过期、设备失败或人工放弃可使任务回到 `DRAFT`；必须由管理员重新点击“开始采购”
+  产生新授权。围栏建立后不得释放、重新授权、重新领取或再次点击。
+- 系统任何路径都不点击支付、免密支付、先用后付或扣款控件；提交订单后的代码路径不含支付动作。
+- 发布真实下单能力前必须用独立真机任务完成只读 dry-run：到订单确认页验证规格、数量、金额和提交
+  控件唯一但不点击。dry-run 是版本发布门禁，不是每笔订单的第一趟，也不能代替实时三道闸门。
 
-### 结果与异常
+### 结果、证据与异常
 
-- **F-011**：失败必须可区分至少这些原因：设备未连接、商品页打不开、规格面板打不开、
-  规格不匹配、单价读不到、单价与授权价不符、数量设置失败、金额超上限、提交控件不唯一、
-  页面识别失败、安全校验、外部支付交接、超时。每种都保留截图和页面快照。
-- **版本失配**：运行时读取到的拼多多 App 版本与当前已取证版本不一致时，桌面端必须停止
-  领取真机任务并提示重新取证；不得继续使用旧页面判据。
-- **付款收口（MVP 简化版）**：订单创建后任务转「待付款」，页面展示订单截图、商品、
-  规格、数量和授权金额供人核对。**人在拼多多付款后手工标记完成。** 自动回读核对是
-  F-016（V2）。
+- **F-007**：按步骤回传实际规格、两次规格面板价格、数量读回、确认页总额、判定、时间和截图。
+  截图是内部审计证据，不是提交前审批前置。
+- 内部系统允许上传规格面板与订单确认页的原始截图，截图中可保留页面已显示的地址和手机号；只允许
+  已认证设备显式上传、已登录管理员查看。完整 XML 只留采购工具本机，不上传；地址/手机号不解析为
+  业务字段或日志；外部支付页、支付凭据永不上传。
+- **F-011**：至少区分设备未连接、版本失配、商品打不开、面板打不开、规格不匹配、价格不可读、
+  两次价格不一致、数量复核失败、金额超上限、确认页不一致、提交控件不唯一、围栏失败、页面识别
+  失败、安全校验、外部支付交接和超时。
+- 运行时拼多多 App 版本与已取证版本不一致时停止领取真机任务，提示重新取证。
+- 订单明确创建后展示截图、商品、规格、数量和授权金额；人在拼多多付款后手工标记完成。
+  **待付款不等于采购完成。**
 
 ### 通用
 
-- 每条 P0 判据关联至少一个 US 编号；有用户界面的判据同时关联相关 IX 编号。
-- 任务终态一次原子回写，中间态不落盘产生「看起来在跑其实已死」的记录。
+- 每条 P0 判据关联至少一个 US；有用户界面的判据同时关联 IX。
+- 状态流转与提交记录原子落盘，不产生“界面在跑但服务端无记录”的悬空事实。
+- 失败页面给出可执行下一步；不会把“重试”显示在已建立围栏的提交上。
 
 ## 六、范围边界与决策
 
 | 问题 | 决策 |
 | --- | --- |
-| 第一版平台 | 网页端（管理）+ Windows 桌面端（执行），驱动一台 Android 手机 |
-| 是否需要账号 | 是。管理员账号 + 桌面端设备凭据，两套身份分离 |
-| 第一版范围 | 手工建单 → 批量开始试选 → 定时领取 → **第一趟试选** → 人工确认 → dry-run / 提交围栏 → **第二趟下单** → 待付款 |
-| 任务来源 | **仅手工填链接。** Excel 与 ERP 移出 MVP |
-| 找货方式 | **仅按链接。** 图片搜索移出 MVP |
+| 第一版平台 | 采购服务（网页端）+ 采购工具（Windows 桌面端）+ 一台 Android 手机 |
+| 身份 | 管理员账号 + 设备凭据，两套身份分离 |
+| 第一版流程 | 手工建单 → 批量开始采购并授权 → 定时领取 → 单趟选规格 / 三闸门 / 围栏 / 提交一次 → 待付款 |
+| 人工授权点 | 管理员点击“开始采购（只创建待付款订单）”；不再有试选后确认 |
+| 任务来源 | 仅手工填链接；Excel 与 ERP 移出 MVP |
+| 找货方式 | 仅按链接；图片搜索移出 MVP |
 | 采购平台 | 仅拼多多 |
 | 领取方式 | 定时轮询，只在执行员启动的会话内运行 |
-| 任务启动 | 创建后为待开始；管理员在列表勾选一条或多条并统一开始第一趟试选 |
-| 设备连接 | ADB over USB 或 WiFi 均支持；同一台手机不得同时以两种方式在线 |
-| 付款收口 | 系统展示订单截图，人核对后付款并手工标记完成 |
+| 设备连接 | ADB over USB 或 WiFi；同一手机不得以两种方式同时在线 |
+| 付款收口 | 系统展示待付款订单证据，人核对、付款并手工标记完成 |
 | 暂不支持 | 自动付款、图搜、Excel、ERP、多设备并行、多平台、退款、审批链、AI 辅助 |
 
 ## 七、待确认 / 风险点
 
-- **第三方平台风险**：拼多多 App 版本更新会改变页面结构。前序项目已观察到详情页
-  没有独立规格入口、价格文本被拆成多个节点等变化。**每次页面结构判据都必须有真机
-  证据，不得从旧版本推断。**
-- **资金风险**：涉及创建真实待付款订单。授权、金额上限、一次性围栏的规则由采购管理员
-  确认；付款始终人工。**下单动作在真机上第一次验证前，必须先取得授权。**
-- **账号风险**：手机上是真实拼多多账号。频繁自动化操作有被风控或封号的可能，需要
-  可配置的动作节奏，并在检测到安全校验时立即停止。
-- **自动化边界风险**：会自动点击并创建订单，属不可逆操作。必须支持 dry-run（跑到
-  订单确认页停止）、服务端提交围栏和点击后调和；任一环节状态不明都不得继续点击。
-- **隐私风险**：订单确认页含收货地址和掩码手机号。**只读取非敏感摘要，不提取地址
-  原文、手机号或支付凭据**；上传服务端的证据需先脱敏。
-- **规格面板上的单价位置未取证（阻塞 F-006 闸门一）**：选中 SKU 后价格显示在哪个节点、
-  是否带「券后」前缀、是否与原价并列，尚无本项目的真机证据。**T-103 必须一并取证。**
-  若规格面板上无法可靠读到单价，闸门一要改为「只截图不判价」，确认页设计随之调整。
-- **两趟之间的状态漂移**：第二趟重新进入时价格可能已变、规格选项可能已改、商品可能
-  下架。闸门二负责拦截，一律转人工——但这意味着价格波动频繁的类目会产生大量待人工。
-  需真机观察实际发生率。
-- **定时轮询的节奏**：固定间隔的机器节奏比人工节奏更容易被风控识别。间隔需可配置，
-  并在检测到安全校验时立即停止轮询。具体间隔待真机观察后确定。
-- **待确认（阻塞 F-002，已移出 MVP）**：Excel 表头契约的最终字段集与列名。
-- **待确认（阻塞 F-003，已移出 MVP）**：ERP 货运明细到任务颜色 / 尺码的字段映射。
-- **待确认（V2 之后）**：AI 辅助的模型供应商、调用预算与失败降级策略。
+- **第三方平台风险**：拼多多更新会改变页面结构。页面判据必须来自本项目真机证据，并绑定 App
+  版本；不能从前序项目或旧版本推断。
+- **资金风险**：管理员点击开始采购会授权创建真实待付款订单。按钮必须明确影响范围与最高总额，
+  服务端一次性授权、提交围栏和点击一次共同防止重复订单；付款始终人工。
+- **单趟时效风险**：授权到实际执行之间价格可能变化。任务不锁定旧观察价，而是在同一趟内两次读取
+  规格面板价格并在确认页校验总额；任何变化或歧义都停止。
+- **账号与风控风险**：固定机器节奏可能触发平台风控。轮询和动作间隔需可配置，检测到验证码、短信、
+  人脸或风险校验立即停止，不绕过。
+- **隐私风险**：内部原始截图可能含地址和手机号。只允许受控内部链路；不提取结构化隐私字段，完整
+  XML 不上传，支付凭据与外部支付页截图禁止进入系统。
+- **首次真实提交风险**：生产提交能力启用前需独立 dry-run 和明确真机授权；点击后结果不明时只能调和。
+- **待确认（移出 MVP）**：Excel 表头、ERP 字段映射、AI 模型与预算。

docs/03-tech-stack.md

@@ -43,7 +43,7 @@
 | 调用位置 | 采购工具 | 已定 | PC 有算力；改 prompt 不需要重新打包 |
 | provider | 待定 | **待定** | 需先确认预算与合规；不得由 agent 自行选定 |
 | 凭据存储 | 采购工具本机配置文件，不入库、不上传 | 已定 | 采购服务不保存、不代理、不下发任何模型凭据 |
-| 输入 | 完整节点树 XML + 页面截图 | 已定 | `dump_hierarchy(compressed=False)` 不丢节点 |
+| 输入 | 待 V2 单独定义 | 待定 | MVP 不调用 AI；内部原始截图许可不自动扩大到外部模型 |
 
 ## 四、决策记录与演进
 
@@ -72,6 +72,102 @@
 | 测试 | `go test ./...` | `.\.venv\Scripts\python.exe -m unittest discover -s tests -t .` |
 | 静态检查 | `go vet ./...` | `.\.venv\Scripts\python.exe -m compileall -q src tests scripts` |
 
+### T-101 设备基线取证（2026-08-04 已完成人工双通道验收）
+
+`client/scripts/capture_device_baseline.py` 只允许对**手工明确填写**的 ADB serial 做连接前核验、
+设备型号 / Android / 拼多多版本读取、截图和 `dump_hierarchy(compressed=False)`。它不打开商品、
+不读取页面判据，也不执行采购、下单或付款动作。多个在线通道必须完成 `getprop` 物理身份比对：
+同一手机 USB + WiFi 同时在线，或任一在线通道的身份读取失败，都会 fail closed，不能随机继续。
+
+人工验收前，先由人把手机切换到不含收货地址、手机号、支付信息或其他无关隐私的安全页面，再在
+`adb devices -l` 中**手工复制**一个在线 serial；USB 和 WiFi 分别验收，且每次只保留一个通道在线。
+WiFi 通道必须由人先行建立；脚本禁止 `adb connect`、`adb disconnect` 或自动重连。以下命令中的尖括号
+必须替换为该次人工确认的实际 serial，不能省略或改成自动选择：
+
+```powershell
+# 仓库根目录；先手工确认设备状态，命令本身只读 ADB 清单
+D:\Portable\adb\adb.exe devices -l
+
+# USB：粘贴该次 devices -l 显示的 USB serial
+.\client\.venv\Scripts\python.exe client\scripts\capture_device_baseline.py --serial <USB_SERIAL> --output-dir "$env:LOCALAPPDATA\cmbuyer\artifacts\T-101\usb-baseline" --timeout 10 --adb D:\Portable\adb\adb.exe
+
+# WiFi：由人先建立 WiFi ADB 通道、断开 USB 后，粘贴该次 devices -l 显示的 WiFi serial
+.\client\.venv\Scripts\python.exe client\scripts\capture_device_baseline.py --serial <WIFI_SERIAL> --output-dir "$env:LOCALAPPDATA\cmbuyer\artifacts\T-101\wifi-baseline" --timeout 10 --adb D:\Portable\adb\adb.exe
+```
+
+成功时输出目录仅包含截图、完整 XML 与不含页面正文的 `manifest.json`（设备元数据、通道、时间、
+文件 SHA-256 和 serial 哈希）。`--timeout` 约束 ADB 命令、ADB socket 及 `takeScreenshot` /
+`dumpWindowHierarchy(compressed=False, max_depth=50)` 的公开 JSON-RPC 调用；uiautomator2 初始化仍有
+上游固定启动上限。截图 Base64 仅兼容 RPC 返回值中的空格、TAB、CR、LF，其余字符
+仍严格拒绝。XML 仅留在本机明确指定的证据目录；人工必须先在本地检查截图/XML，再只记录路径
+和哈希，不得把原始证据提交 Git。USB 与 WiFi 已分别由人完成取证和隐私检查，设备型号、Android、
+拼多多版本、产物路径及 SHA-256 已记录到 T-101；上述命令保留用于可审计的复现与排障。
+
+### T-102 按链接打开商品取证（2026-08-04 已完成人工真机验收）
+
+`client/scripts/capture_product_open.py` 只接受
+`https://mobile.yangkeduo.com/goods.html?goods_id=<纯数字>` 的唯一 canonical 表示。解析后由
+`goods_id` 再次重建 URL，并以参数数组执行显式限定 `com.xunmeng.pinduoduo` 的 Android `VIEW`
+intent；没有任意 URL、任意 shell 或其他 App 控件操作入口。运行拼多多版本必须精确等于 T-101 已
+取证的 `8.17.0`，版本失配会在 intent 前停止。
+
+```powershell
+# 仓库根目录；USB 或 WiFi 每次只保留一个通道在线，再手工复制该次 serial
+D:\Portable\adb\adb.exe devices -l
+.\client\.venv\Scripts\python.exe client\scripts\capture_product_open.py --serial <SERIAL> --url "https://mobile.yangkeduo.com/goods.html?goods_id=<GOODS_ID>" --output-dir "$env:LOCALAPPDATA\cmbuyer\artifacts\T-102\product-open-<GOODS_ID>" --timeout 10 --adb D:\Portable\adb\adb.exe
+```
+
+脚本在 intent 成功后，以 `--timeout` 为明确上限只读轮询前台 package；只有观察到拼多多才采集截图与
+完整 XML，超时仍 fail closed。这一等待只解决 App 异步切换，不根据 Activity、节点文本或旧项目常量
+声称已到详情页。成功目录以原子方式发布，manifest 仅记录 `goods_id`、canonical URL、
+设备/App 非敏感元数据、受限命令摘要、文件路径和 SHA-256，不含原始 serial、Activity 或页面正文。
+必须由人本地确认截图对应目标商品并检查截图/XML 无地址、手机号、支付信息或其他无关隐私；原始
+证据不得提交 Git。T-102 已由人确认 goods_id `958756616606` 对应目标商品并完成截图/XML 隐私检查，
+设备、版本、证据路径与 SHA-256 已记录到任务执行记录。
+
+### T-103 规格面板三状态只读取证（T-110 边界调整后待重新验证）
+
+`client/scripts/capture_sku_panel_spike.py` 只采集人已在手机上准备好的规格面板截图和完整 XML。
+它不打开链接或规格面板，不识别面板，不点击、滑动、输入或选择规格，也不读取价格；接口只暴露
+`app_info`、`app_current` 和两个只读 JSON-RPC 方法。`panel-opened-target-preselected`、
+`alternate-all-dimensions-selected`、`target-selection-restored` 三种值写入 manifest 的字段名是
+`human_declared_state`，明确表示人工声明，不得将其当作自动识别结果。旧的“未选 / 单维度 / 全选”
+状态假设已被真机事实推翻，旧枚举会被采集器和脱敏器明确拒绝。运行拼多多版本必须精确为 `8.17.0`，
+前台 package 必须是拼多多，否则 fail closed；目标目录已存在、截图/XML 无效或超时均不得覆盖已有内容
+或发布半成品。
+
+T-103 已证明当前衣服商品没有独立「规格/已选」入口。T-110 只批准拼多多 `8.17.0`、goods_id
+`937122477375` 上经真机确认的精确唯一 `快要抢光` 作为受控规格面板入口；“免拼购买 / 单独购买 /
+直接拼成”等其他文案不能凭人工经验复用，必须分别重新取证。项目所有者已确认面板刚打开时目标颜色
+“黑色CHA(纯棉)”和尺码“M(建议100-115)”均已自动选中；取证不强行取消选择，而是记录刚打开状态、
+人工把两个维度都改成非目标值、再恢复目标值三个真实状态。只读取证 CLI 本身仍不执行点击；三种状态
+分别使用一个全新原始证据目录：
+
+```powershell
+.\client\.venv\Scripts\python.exe client\scripts\capture_sku_panel_spike.py --serial <SERIAL> --url "https://mobile.yangkeduo.com/goods.html?goods_id=<GOODS_ID>" --state panel-opened-target-preselected --output-dir "$env:LOCALAPPDATA\cmbuyer\artifacts\T-103\sku-panel-opened-target-<GOODS_ID>-v2\raw" --timeout 10 --adb D:\Portable\adb\adb.exe
+.\client\.venv\Scripts\python.exe client\scripts\capture_sku_panel_spike.py --serial <SERIAL> --url "https://mobile.yangkeduo.com/goods.html?goods_id=<GOODS_ID>" --state alternate-all-dimensions-selected --output-dir "$env:LOCALAPPDATA\cmbuyer\artifacts\T-103\sku-panel-alternate-<GOODS_ID>-v2\raw" --timeout 10 --adb D:\Portable\adb\adb.exe
+.\client\.venv\Scripts\python.exe client\scripts\capture_sku_panel_spike.py --serial <SERIAL> --url "https://mobile.yangkeduo.com/goods.html?goods_id=<GOODS_ID>" --state target-selection-restored --output-dir "$env:LOCALAPPDATA\cmbuyer\artifacts\T-103\sku-panel-target-restored-<GOODS_ID>-v2\raw" --timeout 10 --adb D:\Portable\adb\adb.exe
+```
+
+PDD 规格面板不可避免显示收货区域和手机号。项目所有者确认 cmbuyer 是内部系统，正式流程允许把
+页面原始截图上传采购服务供已登录管理员查看，不做遮罩或裁剪。完整 XML 仍只留在
+`%LOCALAPPDATA%\cmbuyer\artifacts\...\raw`；采购工具运行时在内存中读取当前页面树，但只返回规格、
+选中态、价格和页面状态摘要，不把地址或手机号解析为业务字段，也不写入日志、Git 或 Vikunja。
+
+T-103 已完成 `t103-privacy-v5` 的一次真实派生：人确认 XML 无实际地址/手机号、目标颜色
+“黑色CHA(纯棉)”与尺码“M(建议100-115)”保留；安全节点显示顶部当前价“快卖完 ¥12.88”与原价
+“¥29.88”，底部“提交订单 ¥12.88”明确属于 T-103 隔离能力的硬拒绝区。派生截图的整宽黑色隐私带
+遮住了顶部价格文字的一半，这只说明旧脱敏实验不适合展示，不否定已确认的规格面板价格事实。
+
+为加快 MVP，T-103 从此不再修改或调用截图遮罩器。现有 v5 派生 XML 只用于提取不含页面个人信息的
+最小 fixture；T-111 完成后的 `SkuSelectionFlow` 在本机实时页面树上按拼多多 8.17.0 与面板结构读取允许字段，完整
+页面树不落日志、不上传。T-204 直接接入原始截图上传，资产标记 `privacy_tier=INTERNAL_RAW`，只允许
+已认证设备写入、已登录管理员读取；不上传 XML，不允许外部支付页或支付凭据。
+
+这个范围调整不授权 T-103 调整数量、进入确认页、点击“提交订单”或触碰支付控件。T-111 完成后，
+T-103 以 `SkuSelectionFlow` 继续：由人把两个维度改成明确的非目标值，再运行受控入口、精确选择、
+读价和安全退出脚本完成真机验收。生产业务最终为单趟，但能力仍按 T-103 / T-105 / T-107 分段取证。
+
 Windows 的标准入口是仓库根 `./init.ps1`。它要求 Go、两端目录及其哨兵文件存在；已有合规
 `client/.venv` 时，所有采购工具检查与 validator 都使用该解释器。只有 venv 不存在时，才从 `py -0p`
 枚举的版本中确定性选择最高的 Python 3.11+ 创建它；没有合规版本时明确失败，绝不回退默认 `python`。
@@ -85,7 +181,8 @@ compileall。既有 `client/.venv` 若不是 Python 3.11+ 会明确失败，不
 
 当前 Windows 默认 `python` 仍可能指向 Python 3.10，不满足采购工具的 Python 3.11+ 下限；
 不得把未加版本选择器的 `python` 当作采购工具命令。统一入口优先使用既有合规 venv，仅在需要创建时
-自动选择 Launcher 中最高的合规版本；本机现有 venv 实际为 Python 3.12。桌面 GUI 与真机流程不属于 T-003 验收范围。
+自动选择 Launcher 中最高的合规版本；本机 Python 3.12 与 3.14 均已验证，主工作区当前选择 Python
+3.14。桌面 GUI 与真机流程不属于 T-003 验收范围。
 
 Windows PowerShell 差异：
 

docs/04-architecture.md

@@ -1,446 +1,418 @@
 # 架构设计
 
-> 本文讲「怎么把技术栈搭起来」：系统结构、职责划分、数据模型、技术难点、开发顺序。
-> 具体用了哪些框架 / 库 / 数据库 / 部署方式，见 [技术栈](03-tech-stack.md)。
+> 本文定义系统结构、职责、单趟采购流程、安全边界和数据模型。框架与运行命令见
+> [技术栈](03-tech-stack.md)，双端线协议以 [API 合约](api.md)为唯一权威。
 
 ## 一、系统结构
 
 ```text
-第三方 ERP（顺运宝）          Excel 表格          人工填链接
-        │                        │                    │
-        └────────────┬───────────┴────────────────────┘
-                     v
+人工填链接（MVP）                 Excel / ERP（V2）
+         │                              │
+         └──────────────┬───────────────┘
+                        v
         ┌─────────────────────────────────────────┐
-        │  采购服务（admin/，Go 单二进制）          │
-        │  · 建单、批量开始试选与任务生命周期          │
-        │  · 候选确认与下单授权（唯一决策权威）        │
-        │  · 证据存储与审计                          │
-        │  · 管理 Web（服务端渲染）                  │
-        └─────────────────────────────────────────┘
-                     ^  HTTP / JSON
-                     │  Bearer Token + 设备绑定
-                     v
+        │  采购服务（admin/，Go）                   │
+        │  · 建单、查询、开始采购授权与任务状态        │
+        │  · 提交围栏、结果调和、内部证据与审计         │
+        │  · 服务端渲染管理页面                       │
+        └───────────────────┬─────────────────────┘
+                            │ 本机回环 HTTP / JSON（MVP）
+                            │ Bearer + 设备绑定；非回环前必须先上 TLS
+                            v
         ┌─────────────────────────────────────────┐
-        │  采购工具（client/，Python + PySide6）   │
-        │  · 领任务、跑流程、回传结果                 │
-        │  · 本地执行轨迹与证据落盘                   │
-        │  · AI 辅助调用（P1）                       │
-        └─────────────────────────────────────────┘
-                     │  ADB（USB / WiFi）
-                     v
-        ┌─────────────────────────────────────────┐
-        │  Android 手机（拼多多 App）                │
-        └─────────────────────────────────────────┘
+        │  采购工具（client/，Python + PySide6）    │
+        │  · 轮询领取、单趟执行、回传状态与证据        │
+        │  · 本地完整节点树与执行轨迹                  │
+        └───────────────────┬─────────────────────┘
+                            │ ADB（USB / WiFi）
+                            v
+                 Android 手机（拼多多 App）
 ```
 
-组件落位：
-
-- 采购服务：Go + gin，入口 `admin/cmd/server/main.go`，模板
-  `admin/internal/transport/webui/templates/`
-- 采购工具：Python，入口 `client/src/main.py`，真机流程 `client/src/android/pdd_flow.py`
-- 数据库：SQLite，迁移由 goose 管理
-- 证据存储：采购服务本地文件系统，SHA-256 寻址
-- 外部服务：顺运宝 ERP（只读）、AI provider（P1，仅采购工具调用）
+- 采购服务：Go + gin，SQLite，goose migration，本地 SHA-256 证据存储。
+- 采购工具：Python + uiautomator2 + PySide6；执行器只依赖 `TaskSource` / `ResultSink` 抽象。
+- 页面判据与拼多多 App 版本绑定；版本不同即停止，不把前序项目页面结构当作事实。
 
 ## 二、职责划分
 
-### 采购服务（网页端，`admin/`）
+### 采购服务（`admin/`）
 
-**独占**：
+独占以下权威：
 
-- 任务的创建、状态流转和终态判定
-- 候选商品的接收与展示
-- **下单授权的签发与作废**——这是唯一的资金决策权威
-- 金额上限的判定
-- 证据资产的存储与访问控制
-- 管理员会话与设备凭据
+- 任务创建、批量开始采购、状态流转和终态判定；
+- **一次性采购授权的签发**：管理员点击“开始采购”是唯一的人类授权动作；
+- 任务不可变字段和最高总价校验；
+- 提交订单前的原子围栏与点击后结果调和；
+- 管理员会话、设备凭据、内部截图证据和审计记录。
 
-**不做**：
+采购服务不连接手机、不发 ADB 命令、不解析拼多多页面，也不持有支付或 AI provider 凭据。
 
-- 不连接手机、不发 ADB 命令
-- 不保存、代理或下发任何 AI provider 凭据
-- 不解析拼多多页面
+### 采购工具（`client/`）
 
-### 采购工具（桌面端，`client/`）
+独占以下设备能力：
 
-**独占**：
+- ADB 连接、设备健康检查和已取证 App 版本校验；
+- 打开商品、识别页面、精确选规格、设置数量、读取价格；
+- 在满足全部门禁并取得服务端围栏后，精确点击一次“提交订单”；
+- 截图、完整节点树和执行日志的本地采集，显式上传内部截图。
 
-- ADB 连接与设备健康检查
-- 拼多多页面识别、点击、选规格、设数量
-- 页面截图与节点树采集
-- AI 调用（P1）
-- 完整执行轨迹的本地留档
-
-**不做**：
-
-- **不自行决定买哪个候选**——必须等采购服务的授权
-- **不自行放宽金额上限**——本地校验只能更严，不能更松
-- 不直接读 Excel 或访问 ERP
-- 不在没有授权的情况下执行任何创建订单的动作
+采购工具不自行修改任务约束、不扩大金额上限、不领取 `DRAFT`，也不能签发授权。没有服务端
+明确返回 `click_permitted=true` 时，任何本地判断都不能创建订单。
 
 ### 权威冲突规则
 
-两端都会校验规格、数量、金额。**判定不一致时一律转人工，不取任一方结论。**
-这条是硬规则：双闸门的价值在于分歧能被发现，自动选一边等于把双闸门降级成单闸门。
+服务端校验锁定的任务约束，客户端校验当前真机事实。任一端拒绝或两端摘要不一致，一律停止并
+转人工；不能为了“继续跑”选择相信其中一端。
 
-## 三、两趟执行
+## 三、单趟采购执行
 
-这是本项目最核心的结构决策。**MVP 只做 A 路径（任务自带商品链接），分两趟跑完。**
+MVP 只做任务自带商品链接的 A 路径。创建任务与开始采购分离，但管理员开始后不再插入试选确认：
 
 ```text
-        ┌────────── 采购服务开始第一趟 ───────────┐
-        │ 新任务先保存为 DRAFT                         │
-        │ 管理员在任务表格勾选一条或多条                  │
-        │ 原子转为 PENDING，只进入试选队列                │
-        └────────────────────┬─────────────────────┘
-                             v
-        ┌──────────────── 第一趟：试选 ────────────────┐
-        │ 采购工具轮询领取 PENDING 任务                    │
-        │ 1. open_product(url)                          │
-        │ 2. 打开规格面板                                │
-        │ 3. 按维度精确勾选颜色分类、尺码                  │
-        │ 4. 【闸门一】读该 SKU 单价，算合计                │
-        │ 5. 截图                                       │
-        │ 6. 退出商品，释放手机                           │
-        │ 7. 回传标题 / 选中规格 / 单价 / 合计 / 截图        │
-        └────────────────────┬─────────────────────────┘
-                             v
-                   任务转 WAITING_CONFIRMATION
-                             │
-        ┌────────────────────┴─────────────────────────┐
-        │ 人在采购服务确认：机器选对了吗                   │
-        │ 看：需求 vs 选中规格、单价、合计、截图             │
-        │ 点「确认下单（不付款）」→ 签发授权，锁定授权价      │
-        │ 或「退回，不买」→ 任务终止                        │
-        └────────────────────┬─────────────────────────┘
-                             v
-        ┌──────────────── 第二趟：下单 ────────────────┐
-        │ 采购工具轮询拿到授权                            │
-        │ 1. 重新 open_product(url)                     │
-        │ 2. 重新按维度精确勾选同一规格                    │
-        │ 3. 【闸门二】重读单价，必须与授权价一致            │
-        │ 4. 设数量并复核                                │
-        │ 5. 进订单确认页                                │
-        │ 6. 【闸门三】读「实付款」，不得超授权上限          │
-        │ 7. 三个闸门全过 → 点一次「提交订单」              │
-        │ 8. 回传订单截图                                │
-        └────────────────────┬─────────────────────────┘
-                             v
-                    任务转 WAITING_PAYMENT
-                             │
-                   人工在拼多多核对后付款
+管理员创建 DRAFT
+      │
+      ├─ 勾选 DRAFT，查看选中数与最高总额
+      └─ 点击“开始采购（只创建待付款订单）”
+             │  同一事务：校验版本 + 创建一次性授权 + PENDING
+             v
+采购工具领取授权任务
+      │  1. 打开 canonical 商品链接
+      │  2. 通过证据/版本绑定、精确唯一的受控入口打开规格面板
+      │  3. 按维度精确选择并读回颜色、尺码
+      │  4. 【闸门一】读 SKU 单价；单价×数量不得超过最高总价
+      │  5. 设置数量并精确读回
+      │  6. 【闸门二】重读规格与单价；规格不变且价格等于闸门一
+      │  7. 进入订单确认页
+      │  8. 【闸门三】规格/数量一致，应付总额不超最高总价
+      │  9. 上传验证摘要并申请服务端提交围栏
+      │ 10. 仅在 click_permitted=true 且提交控件唯一时点击一次
+      │ 11. 回传观察结果；不确定时只调和，不重试
+      v
+WAITING_PAYMENT ──人核对与付款──> SUCCEEDED
+      或
+RECONCILIATION_REQUIRED ──人工核查同一提交──> WAITING_PAYMENT / FAILED
 ```
 
-### 为什么分两趟而不是停在面板上等人
+“开始采购”锁定的是管理员填写的 `goods_id`、颜色、尺码、数量和**最高总价**，不是一张旧页面
+截图里观察到的价格。价格在执行时实时读取，因此取消试选确认不会取消价格保护。
 
-一台手机是瓶颈。若第一趟停在规格面板等人确认，手机被占住跑不了别的任务，面板还可能
-超时或被拼多多重置。**第一趟必须退出并释放手机**，第二趟重新进入。
+### 受控规格面板入口
 
-代价是同一商品走两遍，但第二趟很快，而且换来两个好处：手机可以在人思考时继续跑别的
-任务的试选；价格变动能被第二趟抓住。
+T-103 真机证据表明：拼多多 `8.17.0`、goods_id `937122477375` 通过精确文本“快要抢光”打开
+规格面板。T-110 已批准把该**特定证据、版本和页面状态**绑定的点击定义为受控导航。
+
+- 只能精确唯一匹配；缺失、重复、版本失配或打开后面板不唯一时零后续点击。
+- “免拼购买 / 单独购买 / 直接拼成”等其他文案不能用包含、前缀、同义或坐标兜底。
+- 受控入口只负责进入已取证面板，不等于支付授权，也不能暴露通用任意点击能力。
+- T-103 的隔离验证 capability 只包含开商品、开面板、选规格、读价和安全退出；数量、确认页、
+  提交和支付仍由后续真机任务分别取证后才能接入生产单趟执行器。
 
 ### 三道价格闸门
 
-| 闸门 | 位置 | 作用 | 不通过时 |
+| 闸门 | 当前页面 | 判据 | 拒绝条件 |
 | --- | --- | --- | --- |
-| 一 | 第一趟规格面板 | 读该 SKU 单价，算合计，回传给人看 | 读不到即停，转人工 |
-| 二 | 第二趟规格面板 | 重读单价，**必须与授权时锁定的价格一致** | 不一致即停，转人工 |
-| 三 | 订单确认页 | 读「实付款」，不得超授权总额上限 | 超出即停，转人工 |
+| 一 | 规格面板，选中目标规格后 | 单价唯一可读；`单价 × 授权数量 <= 最高总价` | 不可读、有歧义或超上限 |
+| 二 | 规格面板，数量读回后 | 颜色、尺码仍正确；重读单价与闸门一完全相等 | 规格漂移或价格变化 |
+| 三 | 订单确认页 | 规格、数量正确；应付总额唯一可读且不超最高总价 | 任一不一致、不可读或超上限 |
 
-**闸门二不可省略。** 人确认的是「32.50 元这一单」，不是「这个商品」。拼多多价格波动
-常见，不能因为「人已经确认过」就照下不误。
+金额一律使用十进制字符串和十进制定点运算，不用浮点数。价格只从规格面板和订单确认页读取；
+详情正文、搜索卡片、底部购买/提交按钮的数字不作为价格来源。
 
-**价格只在规格面板和订单确认页读。** 商品详情页正文和搜索结果卡片上的价格文本在真机上
-被拆成多个节点（`¥` 与数字分离）、带 `券后` 一类前缀、实付价 / 原价 / 促销价难以区分
-——前序项目在这里耗掉大量时间且无可靠结论。
+闸门一与闸门二发生在同一设备会话中。它们用于发现选择或设置数量造成的页面变化，不需要管理员
+在中间确认。旧截图、缓存值和发布前 dry-run 都不能替代这次实时读取。
 
-### B 路径（图片搜索）——V2，MVP 不做
+### B 路径（V2）
 
-任务只有参考图、没有链接时，需要先搜图找出商品。**该路径推迟到 V2**，MVP 阶段建单必须
-提供商品链接。
-
-V2 实现时仍遵守：**图搜的唯一产出是 goods_id**，不在搜索结果卡片上读价格或据价筛选，
-拿到 goods_id 后汇入本节的两趟流程。
+没有商品链接时由图片搜索只产出 `goods_id`，再汇入上述流程。不在搜索结果页读取价格或规格。
 
 ## 四、安全边界（硬约束）
 
-以下每一条都必须有单元测试证明，且不得在任务中「顺手放宽」。
+以下每条都必须有测试证明，不得在任务中顺手放宽：
 
-| 边界 | 规则 | 违反后果 |
+| 边界 | 规则 | 防止什么 |
 | --- | --- | --- |
-| 不付款 | 任何路径都不点击支付、免密支付、先用后付或扣款控件 | 真实资金损失 |
-| **提交订单四条件** | 见下方专节。四者缺一不可，且**只允许点击一次** | 误下单 / 重复下单 |
-| 订单确认页其余零点击 | 除「提交订单」与返回外，不点击确认页上任何控件 | 误触发未知动作 |
-| 规格精确匹配 | 按维度等值匹配，防前缀碰撞（`红`/`粉红`、`1`/`10`）；找不到即停 | 买错货 |
-| 提交订单控件唯一 | 文本精确等于「提交订单」且可点击祖先唯一，否则停 | 点到未知控件 |
-| 数量必须复核 | 设置后读回确认精确等于要求值，否则停 | 买错数量 |
-| 价格三道闸门 | 见第三节。任一道读不到或不通过即停，**不用其他位置的数字凑合** | 超预算采购 |
-| 第一趟不下单 | 试选阶段只勾选规格和读价，**绝不点击「现在买」或任何进入下单流程的入口** | 无授权下单 |
-| 外部支付页 | 检测到微信等外部支付交接立即停止、转人工、保留证据 | 凭据泄露 |
-| 安全校验 | 检测到验证码、风控、人脸、短信校验立即停止，不尝试绕过 | 封号 / 违规 |
-| 敏感信息 | 只读非敏感摘要，不提取收货地址原文、手机号、支付凭据 | 隐私泄露 |
-| 授权一次性 | 一笔授权只能产生一笔订单，重复提交幂等 | 重复采购 |
-| 服务端提交围栏 | 真机点击前必须由采购服务原子冻结授权并创建唯一提交记录；失败或响应不明不得点击 | 并发 / 断网导致重复下单 |
-| App 版本失配即停 | 运行版本与本项目已取证版本不一致时停止领取真机任务，先重新取证 | 旧判据误点新页面 |
+| 不付款 | 不点击支付、免密支付、先用后付或任何扣款控件 | 真实资金损失 |
+| 提交四条件 | 授权+围栏、闸门二、闸门三、控件唯一同时成立，只点一次 | 误下单 / 重复下单 |
+| 确认页零点击 | 除返回和满足四条件后的“提交订单”外不点击任何控件 | 未知副作用 |
+| 规格精确匹配 | 维度内等值唯一匹配，防 `红/粉红`、`1/10` 前缀碰撞 | 买错规格 |
+| 数量读回复核 | 设置后精确读回，不一致即停 | 买错数量 |
+| 三道价格闸门 | 任一道不可读、有歧义或不通过都停，不用别处数字凑 | 超预算 |
+| 受控页面能力 | 页面动作按任务与证据分层；不得把通用 `click` 传入业务流程 | 边界扩散 |
+| 外部支付页 | 检测到外部支付交接立即停止，不读取、保存或输入凭据 | 凭据泄露 |
+| 安全校验 | 验证码、风控、人脸、短信出现即停止，不绕过 | 封号 / 违规 |
+| 内部截图 | 可上传页面已显示的地址/手机号；不解析成字段或日志，完整 XML 不上传 | 非必要扩散 |
+| 身份隔离 | 管理 session+CSRF 与设备 Bearer 分属不同路由域，混合凭据不叠加权限 | 设备越权 / 会话冒充 |
+| Bearer 传输 | MVP 仅绑定 IPv4 回环 `127.0.0.1:8080`；非回环访问先建立 HTTPS/TLS 终止 | 明文局域网泄露 token |
+| 授权一次性 | 一条任务版本只有一份有效授权；幂等重放不生成第二份 | 重复采购 |
+| 服务端提交围栏 | 点击前原子创建唯一提交记录；失败或响应不明不得点击 | 并发 / 断网重复下单 |
+| App 版本绑定 | 运行版本不同于证据版本时停止并重新取证 | 旧判据误点 |
 
 ### 提交订单的四个前置条件
 
-这是本项目唯一会创建真实待付款订单的动作。**四者同时满足才允许点击，且只点一次：**
+“提交订单”是系统唯一会创建真实待付款订单的动作。以下四项同时满足才允许点击一次：
 
-1. **授权存在且未消费，并已建立服务端提交围栏**——采购服务已签发、采购工具已 ack；
-   真机点击前，采购服务在一个原子事务中把授权从可执行态冻结为本次唯一
-   `order_submission`。围栏接口失败或响应不明时不得点击。
-2. **闸门二通过**——第二趟重读的单价与授权时锁定的价格一致。
-3. **闸门三通过**——订单确认页「实付款」不超过授权总额上限。
-4. **控件唯一**——文本精确等于「提交订单」且可点击祖先唯一。
+1. **一次性授权有效且服务端提交围栏已建立**：围栏把授权、任务、领取和本次验证摘要原子绑定到
+   唯一 `order_submission`；明确响应包含 `click_permitted=true`。
+2. **闸门二通过**：目标规格未漂移，第二次规格面板单价等于第一次。
+3. **闸门三通过**：确认页规格、数量正确，应付总额不超过授权最高总价。
+4. **提交控件唯一**：文本精确等于“提交订单”，可点击祖先唯一。
 
-点击之后，**无论发生什么都不重试**：
+围栏请求超时、断网、冲突或响应不明时不得点击。围栏建立后：
 
-| 点击后观察到 | 处置 |
+| 观察结果 | 处置 |
 | --- | --- |
-| 正常进入订单结果页 | 回传订单截图，任务转 `WAITING_PAYMENT` |
-| 跳转微信等外部支付 | 立即停止，转人工，提示「订单可能已创建、支付未完成」 |
-| 安全校验 | 立即停止，转人工，保留证据 |
-| 超时或页面无法判定 | 转人工，**预留金额额度**，提示订单状态不明 |
+| 明确进入订单结果 / 待付款页 | 上报 `SUBMITTED`，任务转 `WAITING_PAYMENT` |
+| 跳转外部支付 | 立即停止，上报结果不明确，不执行支付 |
+| 出现验证码 / 风控 / 人脸 / 短信 | 立即停止，上报结果不明确，不绕过 |
+| 超时、断连、页面无法判定 | 转 `RECONCILIATION_REQUIRED`，保留围栏和金额额度 |
 
-后三种情况一律**禁止自动重试点击**。授权保持永久围栏，结果明确后再记为已消费；在此之前
-也绝不能重新开放——宁可人工核实一遍，不可能重复下单。
+后三种情况都禁止释放围栏、重新授权、重新领取或再次点击。只能调和同一提交记录。
 
-### dry-run、提交围栏与结果调和
+### 发布前 dry-run 与生产围栏的区别
 
-下单被拆成三个不可逆程度不同的阶段，任何客户端本地判断都不能替代服务端围栏：
-
-1. **dry-run（只读演练）**：进入订单确认页，读取规格、数量和「实付款」，确认提交控件
-   唯一，上传证据后退出。该阶段绝不点击「提交订单」，也不消费授权。
-2. **提交围栏**：真实第二趟再次读取并通过三道闸门后，采购工具向采购服务申请围栏。采购服务
-   原子校验任务版本、命令、未消费授权和唯一性，创建 `order_submissions` 记录并冻结授权。
-   只有明确收到成功响应，采购工具才可点击一次。
-3. **结果调和**：点击后只上报观察结果。明确创建则转 `WAITING_PAYMENT`；超时、外部支付、
-   安全校验或断连均转 `RECONCILIATION_REQUIRED`，保留额度并由人核查。**不得释放围栏、
-   重新签发授权或自动重试点击。**
-
-授权超时和主动放弃只允许发生在提交围栏建立之前。围栏之后即使租约过期，也只能恢复
-同一提交记录并进入调和，不能把任务重新放回可领取队列。
+首次启用某一 App 版本的真实提交能力前，必须用独立真机任务完成只读 dry-run：进入确认页，验证
+规格、数量、金额与提交控件唯一，然后退出且不点击。它用于证明判据和不可达测试，不是每笔采购的
+“第一趟”，也不产生可复用页面事实。生产任务仍在同一趟内重新通过三道闸门并申请服务端围栏。
 
 ## 五、数据模型
 
 ### 5.1 核心实体
 
 ```sql
--- 采购任务：创建后业务约束不可变
 CREATE TABLE tasks (
-  id                TEXT PRIMARY KEY,          -- UUID
-  source            TEXT NOT NULL,             -- MANUAL | EXCEL | ERP
-  source_ref        TEXT,                      -- 外部单号（如虾皮订单号），非内部 id
-  title             TEXT NOT NULL,
-  goods_id          TEXT NOT NULL,             -- MVP 必填；B 路径（可为空）推迟到 V2
-  sku_color         TEXT NOT NULL,
-  sku_size          TEXT NOT NULL,
-  quantity          INTEGER NOT NULL CHECK (quantity > 0),
-  max_total_price   TEXT NOT NULL,             -- 十进制字符串，资金边界不得为空
-  reference_asset_id TEXT,                     -- 参考图，MVP 可选；B 路径（V2）必填
-  status            TEXT NOT NULL,
-  version           INTEGER NOT NULL DEFAULT 1,-- 乐观锁
-  created_at        TEXT NOT NULL,
-  updated_at        TEXT NOT NULL
-);
-
--- 第一趟试选结果：人做确认决策的依据
-CREATE TABLE spec_trials (
   id                 TEXT PRIMARY KEY,
-  task_id            TEXT NOT NULL REFERENCES tasks(id),
-  attempt            INTEGER NOT NULL,
-  product_title      TEXT NOT NULL,            -- 商品页读到的标题
-  selected_color     TEXT NOT NULL,            -- 实际勾选到的颜色分类
-  selected_size      TEXT NOT NULL,            -- 实际勾选到的尺码
-  unit_price         TEXT NOT NULL,            -- 闸门一读到的单价
-  total_price        TEXT NOT NULL,            -- unit_price × quantity
-  evidence_sha256    TEXT NOT NULL,            -- 规格面板截图
+  source             TEXT NOT NULL,              -- MANUAL | EXCEL | ERP
+  source_ref         TEXT,
+  title              TEXT NOT NULL,
+  goods_id           TEXT NOT NULL,
+  sku_color          TEXT NOT NULL,
+  sku_size           TEXT NOT NULL,
+  quantity           INTEGER NOT NULL CHECK (quantity > 0),
+  max_total_price    TEXT NOT NULL,              -- 十进制字符串
+  reference_asset_id TEXT,
+  status             TEXT NOT NULL,
+  version            INTEGER NOT NULL DEFAULT 1,
   created_at         TEXT NOT NULL,
-  UNIQUE (task_id, attempt)
+  updated_at         TEXT NOT NULL
 );
 
--- 下单授权：唯一的资金决策记录
+-- 管理员点击“开始采购”产生；锁定任务约束，不锁定旧观察价
 CREATE TABLE order_authorizations (
   id                 TEXT PRIMARY KEY,
   task_id            TEXT NOT NULL REFERENCES tasks(id),
-  spec_trial_id      TEXT NOT NULL REFERENCES spec_trials(id),
-  version            INTEGER NOT NULL,
+  task_version       INTEGER NOT NULL,
+  start_key          TEXT NOT NULL,
   goods_id           TEXT NOT NULL,
   sku_color          TEXT NOT NULL,
   sku_size           TEXT NOT NULL,
   quantity           INTEGER NOT NULL,
-  authorized_unit_price TEXT NOT NULL,         -- 锁定价：闸门二据此比对
-  total_price_cap    TEXT NOT NULL,            -- 授权总额上限：闸门三据此比对
-  note               TEXT,                     -- 可选备注
-  status             TEXT NOT NULL,
+  total_price_cap    TEXT NOT NULL,
+  status             TEXT NOT NULL,              -- ACTIVE | CLAIMED | FENCED | CONSUMED | EXPIRED | ABANDONED
   created_by         TEXT NOT NULL,
   created_at         TEXT NOT NULL,
-  expires_at         TEXT NOT NULL,            -- 围栏前超时自动作废；围栏后不再释放
-  UNIQUE (task_id, version)
+  expires_at         TEXT NOT NULL,
+  UNIQUE (task_id, task_version),
+  UNIQUE (start_key, task_id)
 );
 
--- 真实点击前的服务端一次性围栏；一笔授权最多一条
+-- 一次领取产生一条可恢复执行；保存步骤摘要，不接收完整 XML
+CREATE TABLE purchase_attempts (
+  id                 TEXT PRIMARY KEY,
+  task_id            TEXT NOT NULL REFERENCES tasks(id),
+  authorization_id   TEXT NOT NULL REFERENCES order_authorizations(id),
+  claim_generation   INTEGER NOT NULL,
+  status             TEXT NOT NULL,
+  gate1_unit_price   TEXT,
+  gate2_unit_price   TEXT,
+  quantity_read      INTEGER,
+  confirm_amount     TEXT,
+  failure_code       TEXT,
+  started_at         TEXT NOT NULL,
+  finished_at        TEXT,
+  UNIQUE (task_id, claim_generation)
+);
+
+-- 真机真实点击前建立；一份授权最多一条
 CREATE TABLE order_submissions (
   id                 TEXT PRIMARY KEY,
   task_id            TEXT NOT NULL REFERENCES tasks(id),
   authorization_id   TEXT NOT NULL REFERENCES order_authorizations(id),
-  command_id          TEXT NOT NULL,
-  dry_run_id          TEXT NOT NULL,
-  status              TEXT NOT NULL,            -- FENCED | SUBMITTED | RECONCILIATION_REQUIRED | MANUAL_RESOLVED
-  verified_unit_price TEXT NOT NULL,
-  quantity_read       INTEGER NOT NULL,
-  confirm_page_amount TEXT NOT NULL,
-  created_at          TEXT NOT NULL,
-  resolved_at         TEXT,
+  attempt_id         TEXT NOT NULL REFERENCES purchase_attempts(id),
+  status             TEXT NOT NULL,              -- FENCED | SUBMITTED | RECONCILIATION_REQUIRED | MANUAL_RESOLVED
+  gate1_unit_price   TEXT NOT NULL,
+  gate2_unit_price   TEXT NOT NULL,
+  quantity_read      INTEGER NOT NULL,
+  confirm_amount     TEXT NOT NULL,
+  created_at         TEXT NOT NULL,
+  resolved_at        TEXT,
   UNIQUE (authorization_id),
-  UNIQUE (command_id)
+  UNIQUE (attempt_id)
+);
+
+-- 设备 token 明文只在签发完成后显示一次；数据库仅保存原始 32 字节 token 的 SHA-256
+CREATE TABLE device_credentials (
+  device_id     TEXT PRIMARY KEY,              -- 规范小写 UUIDv4
+  display_name  TEXT NOT NULL,                 -- 非秘密运维名称
+  token_sha256  BLOB NOT NULL UNIQUE,           -- 恰好 32 字节
+  status        TEXT NOT NULL,                  -- ACTIVE | REVOKED
+  created_at    TEXT NOT NULL,
+  revoked_at    TEXT,
+  CHECK ((status = 'ACTIVE' AND revoked_at IS NULL)
+      OR (status = 'REVOKED' AND revoked_at IS NOT NULL AND revoked_at >= created_at))
+);
+
+-- INTERNAL_RAW 原始截图；原文件名和客户端路径不进入数据库
+CREATE TABLE evidence_assets (
+  id                    TEXT PRIMARY KEY,
+  upload_key            TEXT NOT NULL,
+  task_id               TEXT NOT NULL,
+  attempt_id            TEXT NOT NULL,
+  kind                  TEXT NOT NULL,          -- T-204 仅 SKU_PANEL_GATE_1
+  privacy_tier          TEXT NOT NULL,          -- 仅 INTERNAL_RAW
+  sha256                TEXT NOT NULL,          -- 64 位小写十六进制
+  byte_size             INTEGER NOT NULL,
+  content_type          TEXT NOT NULL,          -- 仅 image/png
+  width_px              INTEGER NOT NULL,
+  height_px             INTEGER NOT NULL,
+  storage_key           TEXT NOT NULL,          -- 由 SHA-256 唯一派生
+  uploaded_by_device_id TEXT NOT NULL,
+  captured_at           TEXT NOT NULL,
+  created_at            TEXT NOT NULL,
+  UNIQUE (uploaded_by_device_id, upload_key),
+  FOREIGN KEY (task_id, attempt_id) REFERENCES purchase_attempts(task_id, id)
 );
 ```
 
-`authorized_unit_price` 是第二趟闸门二的比对基准，**必须来自人确认时看到的那个试选
-结果**，不能在签发时重新取值。`expires_at` 见 5.3 节。
+MVP 不再用 `spec_trials` 作为审批记录，也不存在 `authorized_unit_price`。实际读价属于
+`purchase_attempts` / `order_submissions` 的执行与审计事实；管理员授权的资金边界始终是
+`total_price_cap`。
 
-MVP 的授权没有「选择理由 / 拒绝理由」——那是从多个候选里挑一个时的留档需求。这里人
-只回答「机器选对了吗」，保留一个可选 `note` 即可。
-
-金额一律用**十进制字符串**存储和传输，不用浮点数。
+设备凭据由本机管理 CLI 签发、列出和撤销。token 是 32 字节加密随机值，以 64 位小写十六进制
+只显示一次；服务端把 token 解码回原始字节后计算 SHA-256，并与按设备 id 查出的 32 字节 BLOB
+恒定时间比较。未知 id 也执行固定宽度 dummy compare。认证逐请求查库，因此撤销事务提交后才开始的
+请求全部拒绝；提交前已经完成认证的在途请求不追溯取消。格式/未知/错配/撤销统一空 401，存储故障
+空 503，两类都在读取业务请求体前失败闭合。
 
 ### 5.2 状态机
 
-任务状态（采购服务权威）。创建与开始试选分离；两趟执行对应两次 `CLAIMED → RUNNING`：
-
 ```text
-DRAFT ─start trial→ PENDING ─┐
-PENDING_RETRIAL ─────────────┴─claim→ CLAIMED ─start→ RUNNING(TRIAL)
-       ↑                     │                   ├→ NEEDS_MANUAL
-       └────────release──────┘                   └→ WAITING_CONFIRMATION
-                                                        ├→ CANCELED
-                                                        └→ AUTHORIZED
-                                                              └claim→ ORDERING
-                                                                          ├→ NEEDS_MANUAL（围栏前失败）
-                                                                          └→ [submission FENCED]
-                                                                                   ├→ WAITING_PAYMENT
-                                                                                   │        └→ SUCCEEDED
-                                                                                   └→ RECONCILIATION_REQUIRED
-                                                                                            └→ 人工核查 / 调和
+DRAFT
+  └─开始采购（创建授权）→ PENDING
+       └─claim→ CLAIMED ─start→ ORDERING
+                    ├─围栏前验证失败→ NEEDS_MANUAL ─人工处理/重置→ DRAFT
+                    ├─围栏前授权过期/安全释放→ DRAFT
+                    └─submission FENCED
+                           ├─明确创建→ WAITING_PAYMENT ─人工付款并标记→ SUCCEEDED
+                           └─结果不明→ RECONCILIATION_REQUIRED
+                                      └─人工调和同一提交→ WAITING_PAYMENT / FAILED
+
+DRAFT / PENDING / NEEDS_MANUAL ─管理员取消（围栏前）→ CANCELED
 ```
 
-| 状态 | 含义 |
+| 状态 | 含义与安全下一步 |
 | --- | --- |
-| `DRAFT` | 已保存、等待管理员开始试选；设备不可领取，也不存在下单授权 |
-| `RUNNING(TRIAL)` | 第一趟试选中：正在勾选规格、读价、截图 |
-| `WAITING_CONFIRMATION` | 试选已回传，**等人确认机器选对了没** |
-| `PENDING_RETRIAL` | 旧授权已过期或在围栏前被放弃，必须重新跑第一趟取得新价格 |
-| `AUTHORIZED` | 已签发授权，等采购工具下一轮轮询领走 |
-| `ORDERING` | 第二趟下单中：重新选规格、过闸门二三、提交订单 |
-| `WAITING_PAYMENT` | 订单已创建，等人在拼多多付款。**这不是成功** |
-| `RECONCILIATION_REQUIRED` | 已建立提交围栏，但点击结果不明确；可能已创建订单，只能核查，不能重试 |
-| `NEEDS_MANUAL` | 围栏前的转人工情形（规格不匹配、价格不符、页面识别失败等） |
-| `SUCCEEDED` | 订单已付款且核对通过 |
+| `DRAFT` | 已保存，未授权；管理员可编辑/取消或点击开始采购；设备不可领取 |
+| `PENDING` | 已有有效一次性授权，等待采购工具领取 |
+| `CLAIMED` | 已由一个设备实例持有租约，尚未开始页面操作 |
+| `ORDERING` | 单趟执行中，正在选规格、过闸门或申请围栏 |
+| `NEEDS_MANUAL` | 围栏前失败；显示原因，由人核查后重置为 DRAFT 或取消 |
+| `WAITING_PAYMENT` | 订单已明确创建，等待人在拼多多付款；**不是成功** |
+| `RECONCILIATION_REQUIRED` | 围栏后结果不明；只能核查同一提交，不能重试 |
+| `SUCCEEDED` | 人已付款并完成核对 |
+| `FAILED` | 人工调和确认订单未创建或任务无法完成 |
+| `CANCELED` | 围栏前由管理员取消，不再执行 |
 
-授权状态：`PENDING_DELIVERY → DELIVERED → ACKNOWLEDGED → EXECUTING → FENCED → CONSUMED`。
-人退回或重新确认时旧授权转 `SUPERSEDED`；超时转 `EXPIRED`。
+批量 `DRAFT → PENDING` 必须全有或全无。服务端同时创建授权；“先改状态、稍后补授权”无效。
+`WAITING_CONFIRMATION`、`PENDING_RETRIAL`、`AUTHORIZED` 和 `RUNNING(TRIAL)` 不再属于 MVP 状态。
 
-`DRAFT → PENDING` 只能由管理端“开始试选”动作触发。批量开始在一个事务中校验全部任务仍为
-`DRAFT` 且版本一致后统一流转；任一冲突时整批不变，避免用户误以为选中的任务都已开始。
-这个动作只开放第一趟领取资格，不创建 `order_authorizations` 或 `order_submissions`。
+### 5.3 授权、租约与恢复
 
-### 5.3 授权超时（MVP 必做，不得推后）
-
-> **前序项目的教训**：曾出现 `EXECUTING` 授权永不推进，导致确认表单被永久隐藏、任务
-> 锁死，只能新建任务绕过。
-
-规则：
-
-- 每笔授权带 `expires_at`。**仅在尚未建立提交围栏时**，超时自动转 `EXPIRED`。
-- 授权 `EXPIRED` 后任务转 `PENDING_RETRIAL`，先重新跑第一趟取得新价格，再回到人工确认；
-  不允许在旧 `spec_trials` 上直接重新确认。
-- 采购服务在围栏建立前提供「放弃当前授权」入口；围栏建立后改为「进入人工核查」，不得
-  作废或释放授权。
-- **任何时候都不允许出现「任务停在某状态且界面上没有任何可用动作」的组合。**
-  这是验收项，不是实现细节。
-
-授权过期后重新确认时，必须重新走第一趟试选取得新的 `spec_trials` 记录——不能复用旧的
-锁定价，因为价格可能已经变了。已建立围栏的授权不参与本超时流程。
+- 授权带 `expires_at`，只有围栏前可转 `EXPIRED` / `ABANDONED`；任务回到 `DRAFT`，必须重新点击
+  开始采购。旧授权永不复活。
+- 设备租约丢失不等于授权可安全重用。只有服务端确认该 attempt 未建立围栏，才能关闭 attempt 并
+  回到 `DRAFT` / `NEEDS_MANUAL`；不能自动重新领取并重复页面动作。
+- 围栏建立后即使租约过期也只恢复同一 `order_submission` 的调和，不能回到可领取队列。
+- 每种非终态都必须给出安全下一步，不能出现隐藏表单导致任务永久锁死。
 
 ### 5.4 证据分层
 
-| 数据 | 位置 | 理由 |
+| 数据 | 位置 | 边界 |
 | --- | --- | --- |
-| 候选商品页 / 规格页截图 | 上传采购服务 | 管理员做授权决策必须看 |
-| 订单确认页截图 | 上传采购服务 | 授权后核对与审计必须留 |
-| 订单核对截图 | 上传采购服务 | 资金核对证据 |
-| 完整节点树 XML | **仅采购工具本地** | 体积大、含页面全文、只用于排障 |
-| AI 调用记录（P1） | **仅采购工具本地** | 含 prompt / 响应全文，脱敏成本高 |
-| 失败现场快照 | 仅采购工具本地，可按需手工导出 | 同上 |
+| 商品 / 规格 / 确认页原始 screenshot | 采购工具本机 + 采购服务内部证据存储 | 可含页面已显示地址/手机号；设备鉴权上传、管理员登录查看，不遮罩 |
+| 完整 XML | 仅采购工具本机隔离目录 | 可在内存解析页面判据；不上传、不写日志、Git、Vikunja |
+| 最小 XML fixture | 采购工具测试 / Git | 只保留判据所需结构，确认无地址、手机号、支付凭据 |
+| 外部支付页或支付凭据 | 不保存、不上传 | 检测到交接立即停止 |
+| AI 调用记录（V2） | 仅采购工具本地 | 不进入采购服务 |
 
-上传前必须脱敏：**不上传含收货地址、手机号、支付凭据的截图区域或文本。**
+截图上传器只能接收调用方显式指定的截图，不能枚举证据目录或顺带上传 XML/manifest。证据响应
+使用 `Cache-Control: no-store`，不能暴露为免登录静态目录。
+
+内部截图存储采用以下固定边界：
+
+- 单个 PNG 最大 10 MiB、单边最大 8192 px、总像素最大 16,777,216；同时验证 multipart MIME、
+  PNG 魔数、完整解码、字节数、尺寸和调用方声明的 SHA-256。
+- 上传 handler 必须先通过逐请求 SQLite 设备认证并再次校验规范 principal，再解析 Content-Type 或
+  读取 body。空库、无效或已撤销凭据拒绝，认证存储故障返回 503；不把管理员 session 当设备身份。
+- 文件写入显式配置的私有证据根目录：同目录随机临时文件 → 流式 hash → 校验 → `fsync` → 原子
+  rename 到 SHA-256 内容地址 → 最后事务写数据库。数据库永远不指向半文件或缺失文件。
+- SQLite 与文件系统不能组成跨资源事务；极端故障最多留下不可达孤儿文件。不得为清理孤儿而删除
+  可能被其他资产记录并发复用的内容文件，自动保留/删除策略留给部署任务。
+- SHA-256 只用于物理内容寻址，不是业务资产唯一键；不同合法证据可以引用相同内容。同设备主体与
+  `upload_key` 同载荷重放原资产，任一规范字段变化即冲突。
 
 ## 六、关键技术难点
 
-| 难点 | 说明 | 应对 |
+| 难点 | 风险 | 应对 |
 | --- | --- | --- |
-| 拼多多页面结构随版本变化 | 前序项目已观察到详情页无独立规格入口、价格节点拆分等变化 | **每条判据先做真机 spike 取证再写代码**；判据与 App 版本一并记录 |
-| 规格面板上的价格位置 | 选中 SKU 后价格显示在哪、是否含券后前缀，未取证 | **T-103 必须一并取证**，闸门一依赖它；读不到就转人工，不用详情页数字凑合 |
-| 同一商品两趟结果不一致 | 第二趟价格变了、规格选项变了或商品下架 | 闸门二拦截；一律转人工，不自动放弃也不自动继续 |
-| 图搜结果含跨类目商品（V2） | 搜服装出现纸巾 | B 路径只产 goods_id 且限 5 个；后续用 VLM 看截图筛同款 |
-| WiFi ADB 稳定性 | 息屏、换网、DHCP 续租会断连 | 超时可配置；断连视为技术失败并保留现场，不重试点击 |
-| 同一手机 USB + WiFi 同时在线 | `adb devices` 列出两条，自动选设备会失败 | 设备档案必须显式指定 serial，不允许留空自动选 |
-| 不可逆动作的重试 | 点击「现在买」后超时，无法判断订单是否已创建 | 一律转人工并预留金额额度，**禁止自动重试点击** |
-| 双端契约漂移 | 两端独立演进会静默不兼容 | 契约改动必跑完整门禁；[api.md](api.md) 是唯一权威 |
-
-**高风险功能先做最小原型。** Phase 1 的真机 spike 必须先于 Phase 2 的界面开发完成。
+| 页面结构随版本变化 | 旧选择器误点新页面 | 每条判据先真机取证，记录 App 版本、截图、XML、goods_id |
+| 购买语义入口才打开面板 | 能力范围易扩散 | 只批准证据绑定的精确唯一入口；每种文案单独取证 |
+| 当前价与原价/按钮价混杂 | 读错价格 | 限定已取证结构和语义；价格只在面板/确认页读，歧义即停 |
+| 单趟页面状态变化 | 数量或促销导致价格变化 | 同一趟两次读规格面板价，再以确认页总额兜底 |
+| WiFi ADB / 双通道 | 断连或操作错设备 | serial 必填；USB/WiFi 同设备或身份不明时 fail closed |
+| 不可逆动作超时 | 可能已创建订单 | 服务端围栏 + 点击一次 + 只调和，不重试 |
+| 双端契约漂移 | 静默不兼容 | [api.md](api.md) 唯一权威；契约改动跑完整双端门禁 |
 
 ## 七、推荐开发顺序
 
-1. **Phase 0 地基**：两端骨架、测试命令、`init` 脚本可运行。
-2. **Phase 1 真机取证**：WiFi ADB 连通；打开商品 → 打开规格面板 → 按维度精确勾选颜色
-   分类和尺码 → **读到该 SKU 单价** → 设数量 → 进订单确认页 → 读「实付款」。
-   **结论写入文档，判据带拼多多 App 版本。**
-3. **Phase 2 采购服务核心**：数据模型与状态机、手工建单、任务查询、试选结果接收、
-   确认页与授权签发、**授权超时与放弃**。
-4. **Phase 3 双端打通**：设备侧 API、采购工具 `HttpTaskSource`/`HttpResultSink`、
-   定时轮询、第一趟试选端到端。
-5. **Phase 4 闭环收尾**：第二趟下单（含三道闸门与提交）、失败分类、完整验收、打包。
-6. **V2 及以后**：图片搜索路径、候选对照台、Excel 导入、ERP 建单、订单自动核对、AI 辅助。
+1. **Phase 0 地基**：双端骨架、测试命令、初始化脚本和原型。
+2. **Phase 1 真机取证**：逐段验证商品打开、受控面板入口、精确规格与读价、数量、确认页和提交
+   控件；真实点击前先完成独立 dry-run。每个 spike 的 capability 只覆盖当期动作。
+3. **Phase 2 采购服务核心**：DRAFT 建单/列表、批量开始采购与授权、状态/证据/围栏/调和接口。
+4. **Phase 3 双端打通**：设备身份、原子领取、单趟执行到围栏前、事件与截图。
+5. **Phase 4 闭环**：经明确真机授权验证一次提交、待付款收口、失败分类、打包。
+6. **V2**：图搜、Excel、ERP、自动核对、AI、多设备。
 
-**不要在 Phase 1 结论出来之前写 Phase 2 的页面**——确认页要显示什么，取决于真机上
-究竟能读到什么。尤其是闸门一的单价，如果规格面板上读不可靠，整个确认页的设计要改。
+T-103 继续作为“规格选择与读价”的隔离前置，不含数量、确认页或提交。生产单趟并不意味着在一个
+任务里跳过逐段取证；它只意味着这些已验证能力集成后，每笔业务任务不再等待中途人工确认。
 
 ## 八、项目结构
 
 ```text
 cmbuyer/
 ├── docs/
-├── admin/                      # 采购服务（Go）
+├── admin/
 │   ├── cmd/server/
-│   ├── internal/
-│   │   ├── domain/             # 实体与状态机，无外部依赖
-│   │   ├── usecase/            # 业务用例
-│   │   ├── transport/
-│   │   │   ├── httpapi/        # 设备侧 API
-│   │   │   └── webui/          # 管理页面 + 模板 + 静态资源
-│   │   └── storage/            # SQLite 与证据资产
+│   ├── internal/domain/
+│   ├── internal/usecase/
+│   ├── internal/transport/httpapi/
+│   ├── internal/transport/webui/
+│   ├── internal/storage/
 │   └── migrations/
-├── client/                     # 采购工具（Python）
-│   ├── src/
-│   │   ├── android/            # adb / device / pdd_flow
-│   │   ├── core/               # models / task_runner / sources 抽象
-│   │   ├── remote/             # HttpTaskSource / HttpResultSink
-│   │   └── app/                # PySide6 GUI
+├── client/
+│   ├── src/cmbuyer_client/device/
+│   ├── src/cmbuyer_client/pdd/
+│   ├── src/cmbuyer_client/core/
+│   ├── src/cmbuyer_client/remote/
+│   ├── src/cmbuyer_client/app/
 │   └── tests/
 └── scripts/
 ```
 
-`client/src/core/sources.py` 必须保留 `TaskSource` / `ResultSink` 抽象，执行器只依赖抽象。
-这样离线 Excel 模式可作为降级路径存在，且执行器不因来源变化而改动。
+执行器依赖 `TaskSource` / `ResultSink`，不直接读取 Excel 或拼接 HTTP。来源变化不得改变安全执行器。
 
 ## 九、架构纪律
 
-- 业务事实和 schema 变化必须同步更新本文与 [api.md](api.md)。
-- 不在代码里发明文档没有的接口、字段和状态。
-- 第四节的安全边界不得在任务中放宽；确需变更时先改本文并说明理由。
-- 高风险模块先单独真机验证，再接入完整流程。
-- 前序项目 `cmroubao` / `cmpdd` 是设计依据，**不是事实来源**；引用其结论时必须在本项目
-  重新验证。
+- 业务事实和 schema 变化同步本文与 [api.md](api.md)，代码不得另起一套字段或状态。
+- 第四节安全边界只能收紧。需要变更时先更新架构、任务边界和理由。
+- 页面高风险能力先真机取证并隔离测试，再接入完整流程。
+- 前序项目 `cmroubao` / `cmpdd` 只提供设计理由，不提供可直接复用的页面事实。

docs/05-coding-rules.md

@@ -24,10 +24,14 @@
   明确建立、闸门二通过、闸门三通过、控件唯一。
 - 围栏接口超时、冲突、网络失败或响应不明时不得点击；围栏建立后不得释放授权、重新领取
   或再次点击，只能恢复同一 `order_submission` 并调和结果。
-- 点击后无论超时、跳外部支付还是遇安全校验，**一律转人工、禁止重试**，授权立即标记
-  已消费。
-- **第一趟试选的代码路径不得引用 `go_to_order_confirm()` 与 `submit_order()`**，
-  必须有测试证明不可达。
+- 点击后无论超时、跳外部支付还是遇安全校验，**一律转人工、禁止重试**。授权保持已围栏；
+  只有明确结果或人工调和后才记为已消费/已解决。
+- T-103 的 `SkuSelectionFlow` 不得引用数量、订单确认、提交围栏、`submit_order_once()` 或付款能力，
+  必须有静态调用链和测试证明不可达。
+- `open_sku_panel()` 只可点击本项目真机证据与 App 版本绑定的精确唯一入口；当前仅允许拼多多
+  `8.17.0` 上已取证的 `快要抢光`。不得暴露通用 `click`，不得把其他购买文案按包含/同义/坐标兜底。
+- 规格面板中的“提交订单”、微信支付、先用后付或 0 元下单在 T-103 只能作为硬拒绝判据，绝不能
+  返回可点击对象。后续生产单趟也只能在各段已取证且四条件全通过时触发封装的一次性提交能力。
 
 ### 1.2 匹配纪律
 
@@ -41,21 +45,28 @@
 - 价格**只在规格面板（闸门一 / 二）和订单确认页（闸门三）读**。
 - **不从商品详情页正文、搜索结果卡片或任何其他位置读价格。**
 - 读不到就转人工，**不用别处的数字凑合**。
-- 第二趟重读的单价**必须与授权锁定价一致**，不一致即停——人确认的是那个价格，
-  不是那个商品。
+- 同一趟设置并复核数量后，闸门二重读的规格必须不变、单价必须与闸门一完全一致；授权锁定的是
+  最高总价而不是旧观察价。价格变化即停。
 - 图片搜索（V2）的唯一产出是 `goods_id`，同样不读价。
 
 ### 1.4 安全与隐私
 
 - 检测到验证码、风控、人脸、短信校验时立即停止，**不尝试绕过**。
 - 检测到外部支付交接立即停止，**不读取、不保存、不输入任何凭据**。
-- 只读非敏感摘要，**不提取收货地址原文、手机号、支付凭据**。
-- 上传服务端的证据必须先脱敏。
+- 页面已显示的地址和手机号允许随**内部原始截图**上传采购服务，供已登录管理员核对；不做遮罩或裁剪。
+- 地址和手机号不得被解析为结构化业务字段，也不得写入普通日志、Git、Vikunja、fixture 或错误消息。
+  原始完整 XML 只留采购工具本机；真机流程可在内存中读取，但只能返回规格、选中态、价格和页面状态摘要。
+- 截图上传器只能接收显式文件，不得枚举原始目录或顺带上传 XML/manifest/其他文件；服务端必须校验
+  设备身份和 SHA-256，证据只允许已登录管理员访问，不得提供公开静态目录。
+- **支付凭据仍不得读取、保存或上传。** 外部支付交接不在“内部原图允许上传”的例外范围内。
+- T-103 停止遮罩器开发并专注真机选择/读价；生产原始截图上传由 T-204 实现。
 
 ### 1.5 页面判据
 
 - **不得从前序项目、旧文档或推理直接写页面判据。** 必须有本项目的真机取证。
 - 每条判据必须记录取证时的**拼多多 App 版本**。
+- 购买语义按钮不能按“作用相同”共享判据。`快要抢光`、`免拼购买`、`单独购买`、`直接拼成` 等
+  每个入口文案都必须分别取证；只允许精确唯一匹配，不允许包含、前缀、相似或坐标兜底。
 - 判据失效时先重新取证，不要靠加兜底分支硬扛。
 
 > 这些红线不是建议。[`04-architecture.md`](04-architecture.md) 第四节列出的每一条都必须有
@@ -85,8 +96,9 @@
 - V2 / V3 只记录，不实现。**图搜、Excel、ERP、订单自动核对、AI 辅助全部不在 MVP。**
 - 需求明确排除的非目标不得实现。
 - 不为「将来可能用到」提前抽象。
-- **Phase 1 真机结论出来之前不写 Phase 2 的页面**——确认页显示什么，取决于真机上
-  能读到什么，尤其是规格面板上的单价。
+- **Phase 1 真机结论出来之前，不写依赖真机可读字段的生产执行功能。** T-201 管理会话、只创建
+  `DRAFT` 的 T-202，以及 T-203 只锁定现有任务字段的服务端开始采购授权事务可以并行；T-205 起
+  的实际 attempt / 页面证据等待 T-103。T-201 / T-202 不得夹带授权、机器结果、提交或付款字段。
 
 ## 5. 架构纪律
 

docs/06-tasks.md

@@ -1,40 +1,37 @@
 # 任务路线图（Roadmap）
 
-> 本文是**只读路线图**：维护阶段划分、里程碑、待办池和建议拆分清单。
-> 真实任务以「一任务一文件」存放在 [`tasks/`](tasks/README.md)（`docs/tasks/T-<编号>.md`），
-> 状态权威在任务文件 frontmatter。**本文不跟踪单任务状态。**
+> 本文维护阶段、依赖和建议拆分，不跟踪状态。真实状态、写路径和执行证据在
+> [`docs/tasks/T-XXX.md`](tasks/README.md)；状态权威是 git frontmatter。
 
 ## 使用规则
 
-1. **开工先落文件**：从下方清单把下一个任务落成 `docs/tasks/T-<编号>.md`（沿用建议编号），
-   把验收要点展开成可执行、可观察的步骤，再开始实现。
-2. **每个 agent 一次只做一个任务**：领取、状态流转、执行记录、完成定义遵循
-   [`tasks/README.md`](tasks/README.md) 和[编码规则](05-coding-rules.md)。
-3. **不跳步**：依赖未完成的任务不能开工。Phase 0 可先做使用假数据的低保真交互原型；
-   **Phase 1 的真机结论出来之前不写 Phase 2 的生产页面**，T-103 若改变可读字段则先修订原型与 IX。
-4. **本文只在规划变化时修改**：单个任务开工或完成**不**修改本文。
-5. **动手前**先读 `00-ai-start-here.md`、`05-coding-rules.md` 和 `current-state.md`。
+1. 从路线图领取任务前先落任务文件、边界、写路径和验收门禁。
+2. 一个 agent 同时只负责一个 `DOING`；只有写路径互不重叠才并行。
+3. `needs_device: true` 只能由人完成验收，agent 写完代码仍保持 `DOING`。
+4. 页面判据必须先在本项目真机取证。真机结论变化时先修订契约/原型，再写生产流程。
+5. 管理员点击“开始采购”是创建待付款订单的授权；单趟业务流程不等于跳过分段取证。
 
 ## 并行执行与关键路径
 
-执行顺序以任务表中的 `依赖` 为准，Phase 是里程碑分组，**不是要求整段串行的栅栏**。
-在 `write_paths` 不重叠且依赖已完成的前提下，按以下波次推进：
+Phase 是里程碑分组，不是整段串行栅栏。推荐波次：
 
-| 波次 | 采购服务方向 | 采购工具 / 真机方向 | 集成方向 |
+| 波次 | 采购服务 agent | 采购工具 agent | 大脑 / 集成 |
 | --- | --- | --- | --- |
-| 1 | T-001 初始化 `admin/` | T-002 初始化 `client/` | - |
-| 2 | T-001 后立即做 T-004 | T-002 后立即做 T-101 → T-102 → **T-103** | T-001、T-002 都完成后做 T-003 |
-| 3 | T-103 通过后推进 T-201 → T-207 | T-103 后推进 T-104 → T-107 | T-208 等待 T-207 与 T-107 均完成 |
-| 4 | T-301 → T-302 | T-302 后交接 T-303 → T-304 → T-306 | T-306 与 T-104 完成后做 T-305 |
-| 5 | - | T-305、T-208、T-306 后做 T-401 | T-401 后并行 T-402 / T-403，再做 T-404 → T-405 |
+| 1 | T-001 → T-004 → T-201 → T-202 | T-002 → T-101 → T-102 | T-003、原型与契约 |
+| 2 | T-209 → T-203 → T-204 | T-103 → T-104 → T-105 → T-107 | T-111 单趟重构；逐任务主审 |
+| 3 | T-205 → T-207 → T-208 | T-301 → T-304 → T-306 | 双端契约完整门禁 |
+| 4 | - | T-305 | 围栏前端到端 dry-run 主审 |
+| 5 | T-402 / T-403 | T-401 | 真机人工授权、提交与调和验收 |
+| 6 | - | T-405 | T-404 完整验收 |
 
-**T-103 是当前最高优先级和 MVP 生死线。** T-002 一完成就启动 T-101，不等待 T-003、
-T-004 或整个 Phase 0 收尾。并行只优化等待关系，不改变下列门禁：
+并行门禁：
 
-- T-103 的真机结论出来前，不写依赖真机可读字段的 Phase 2 生产页面。
-- `needs_device: true` 的任务仍只能由人完成验收。
-- 不复用前序项目页面判据，不放宽三道价格闸门，不让第一趟引用任何下单函数。
-- 第三个 agent 优先做写路径独立的集成任务或只读复核，不与两端任务争写共享文档。
+- T-202 只创建/展示 `DRAFT`，可与 T-103 并行；T-203 只实现管理员授权与任务状态，不依赖页面
+  选择器，也可在 T-103 完成前推进。
+- T-205 起涉及实际 attempt/证据字段，必须等待 T-103 确认规格和价格最小事实。
+- T-103、T-105、T-106、T-107 的 capability 相互隔离；未经取证的后续动作不可提前暴露。
+- T-401 前任何任务都不得真实点击“提交订单”；支付能力永远不实现。
+- 主 agent 独立审阅每个子 agent 的 diff 并重跑验证，不以其自报完成作为证据。
 
 ## 建议拆分清单
 
@@ -42,100 +39,100 @@ T-004 或整个 Phase 0 收尾。并行只优化等待关系，不改变下列
 
 | ID | 任务 | 依赖 | 验收要点 |
 | --- | --- | --- | --- |
-| T-001 | 初始化采购服务 `admin/` Go 骨架 | - | 在 `admin/` 创建 Go 模块；`go test ./...`、`go vet ./...` 可运行；健康检查端点可访问；用真实命令替换 `03-tech-stack.md`、`00-ai-start-here.md`、`current-state.md` 中的占位命令 |
-| T-002 | 初始化采购工具 `client/` Python 骨架 | - | 在 `client/` 创建虚拟环境、`requirements.txt` 与应用骨架；`unittest`、`python -m compileall` 可运行；日志与产物目录策略明确且不记录敏感信息 |
-| T-003 | 建立 `init.ps1` 统一入口 | T-001, T-002 | 一条命令完成两端安装与基础验证并打印启动命令；未配置时主动失败而不是静默跳过 |
-| T-004 | 建立核心数据模型与状态机 | T-001 | `tasks`、`order_authorizations`、`order_submissions` 表与 `04-architecture.md` 一致；状态流转有单元测试；金额用十进制字符串 |
-| T-005 | 网页端 MVP 交互原型 | - | “采购服务”的 `docs/design/web-*.html` 单文件假数据原型覆盖登录、表格工作台、创建弹窗、批量开始试选、路由化详情抽屉与完整详情；键盘、窄屏、空态 / 错误 / 加载、围栏后调和状态可演示；经人工确认前保持 `DOING` |
-| T-006 | 桌面端 MVP 交互原型 | - | `docs/design/desk-*.html` 单文件假数据原型覆盖“采购工具”的采购执行 / 配置固定页签、顶部轮询控制、当前任务图片、滚动日志、时间倒序执行记录，以及左侧当前任务 / 记录详情双视图；明确 dry-run / 真实下单、App 版本失配、围栏后不可重试；经人工确认前保持 `DOING` |
-| T-007 | 统一产品名称与源码目录契约 | - | 项目名固定为 `cmbuyer`；采购服务使用 `admin/`，采购工具使用 `client/`；架构、任务和启动脚本不再把 `web/` / `desk/` 当生产源码目录 |
+| T-001 | 初始化采购服务 `admin/` | - | Go 模块、健康检查、`go test` / `go vet` 可运行 |
+| T-002 | 初始化采购工具 `client/` | - | Python 包、unittest、compileall、日志/产物目录可运行 |
+| T-003 | 建立 `init.ps1` 统一入口 | T-001, T-002 | 一条命令安装并验证两端；失败明确，不静默跳过 |
+| T-004 | 建立核心数据模型与状态机 | T-001 | 基础 tasks / authorization / submission 模型、十进制金额和状态测试 |
+| T-005 | 网页端 MVP 原型 | - | 采购服务登录、传统表格、创建、批量开始采购、路由详情、待付款/调和状态可演示 |
+| T-006 | 桌面端 MVP 原型 | - | 采购工具固定 tabs、轮询、当前任务/图片/日志、记录详情双视图和单趟状态可演示 |
+| T-007 | 统一产品与目录名称 | - | 项目 `cmbuyer`；网页端“采购服务”在 `admin/`；桌面端“采购工具”在 `client/` |
+| T-010 | 原型与交互核对 | T-005, T-006 | 人工确认 P0 页面、布局、键盘、异常和无生产副作用 |
 
-### Phase 1 · 真机取证（最高风险，必须先做）
+### Phase 1 · 真机取证（最高风险）
 
-> 本阶段每个任务都需要真机，**只能由人完成验收**。结论写入任务文件并同步
-> `04-architecture.md`；**每条页面判据必须记录拼多多 App 版本**。
+> 每个任务均 `needs_device: true`。截图、XML、goods_id、设备、Android、连接方式和拼多多 App
+> 版本写入任务记录；只有人能把任务标为 DONE。
 
 | ID | 任务 | 依赖 | 验收要点 |
 | --- | --- | --- | --- |
-| T-101 | 验证 ADB 与 uiautomator2 连接（USB + WiFi） | T-002 | 两种连接都能列设备、截图、`dump_hierarchy(compressed=False)`；同一手机双通道在线时报明确错误；超时参数可配置 |
-| T-102 | 验证按链接打开商品详情页 | T-101 | 输入 `goods_id` 链接后真机进入对应详情页；打不开时有可区分的失败原因；保存截图与页面 XML |
-| T-103 | 验证规格面板打开、按维度精确选择、**读取 SKU 单价** | T-102 | 能打开规格面板；按 `颜色分类=X`、`尺码=Y` 精确选中并读回确认；**防前缀碰撞**；找不到精确值时停止且不点相近项；**取证单价在哪个节点、是否带券后前缀**——闸门一依赖此结论 |
-| T-104 | 验证试选后安全退出并释放手机 | T-103 | 读完价截完图后退出商品页；**全程不点击「现在买」或任何下单入口**，有测试证明；退出后可立即开始下一条任务 |
-| T-105 | 验证数量设置与复核 | T-103 | 设置后读回精确等于要求值；不等时停止，不进入购买入口 |
-| T-106 | dry-run：验证进入订单确认页并读「实付款」 | T-105 | 进入确认页读出规格、数量、实付金额；验证提交控件唯一但**绝不点击**；不提取地址原文与手机号；保存截图与 XML 证据到任务产物 |
-| T-107 | 固化提交控件判据与 dry-run 安全边界 | T-106 | 只把本项目真机证据转成可测试判据；第一趟和 dry-run 路径不可达 `submit_order`；App 版本不匹配时 fail closed；**不创建真实订单** |
+| T-101 | 验证 ADB / uiautomator2（USB + WiFi） | T-002 | 两通道截图和 dump；同手机双通道 fail closed；超时可配置 |
+| T-102 | 验证按链接打开商品详情页 | T-101 | canonical goods 链接进入对应商品；前台包与 goods_id 有证据 |
+| T-103 | 验证受控规格面板、精确选择与 SKU 单价 | T-102, T-110, T-111 | 精确唯一入口、维度内等值选择/读回、防前缀碰撞、当前价唯一读取；隔离 capability 不含数量/确认/提交 |
+| T-104 | 验证规格选择能力安全退出 | T-103 | 完成选择/读价/截图后可关闭面板或退出；不进入确认页、不提交 |
+| T-105 | 验证数量设置、读回与闸门二 | T-103 | 设置数量并精确读回；再次读规格/单价等于闸门一；不一致即停 |
+| T-106 | dry-run：确认页与闸门三取证 | T-105 | 进入确认页读规格、数量、应付总额并验证提交控件唯一；绝不点击 |
+| T-107 | 固化确认页与提交控件安全判据 | T-106 | 只使用本项目证据；dry-run 静态不可达提交；版本失配 fail closed |
+| T-110 | 批准证据绑定的受控规格入口 | T-103 no-go 决策 | 仅批准拼多多 8.17.0 已取证的精确唯一“快要抢光”，不泛化 |
+| T-111 | 调整为开始采购授权的单趟流程 | T-004, T-010, T-110 | 状态/API/原型/任务依赖一致；删除试选后确认但不放宽三闸门和围栏 |
 
-> **T-106 与 T-107 只做只读演练，不得点击提交订单。** 本路线图中首次允许创建真实订单
-> 的任务是 T-401；执行前必须取得明确授权，并在任务文件记录订单是否产生、如何处置。
+T-106 / T-107 是发布前只读验证，不是业务任务的第一趟。首次允许创建真实待付款订单的是 T-401，
+执行前必须有明确人工授权，并记录订单是否产生及如何处置。
 
 ### Phase 2 · 采购服务核心
 
 | ID | 任务 | 依赖 | 验收要点 |
 | --- | --- | --- | --- |
-| T-201 | 管理员登录与会话 | T-004, T-005 | 登录建立会话；CSRF 生效；未登录跳转并只接受站内返回路径 |
-| T-202 | 手工建单（F-001） | T-201 | 列表内创建弹窗与 `/tasks/new` 复用表单；任务名称、链接、颜色分类、尺码、数量、价格上限校验；成功创建 `DRAFT` 并倒序显示第一行 |
-| T-203 | 任务表格、查询与批量开始试选（F-004、F-018） | T-202 | 传统表格无操作列；标题关键词筛选；只选 `DRAFT`；批量 `DRAFT → PENDING` 全有或全无；空状态可清除筛选 |
-| T-204 | 路由化任务详情（F-011） | T-203 | 从列表进入显示保留现场的右侧抽屉，直达显示完整页；按状态呈现唯一主区块与主动作；执行证据可查看 |
-| T-205 | 试选结果接收与确认页（F-007） | T-204, T-103 | 接收 `spec_trials` 与规格面板截图；确认页展示需求 vs 所选、单价、合计、截图；**轻量版，非对照台** |
-| T-206 | 人工确认与授权签发（F-008） | T-205 | 确认即签发一次性授权并**锁定试选单价**；`expected_task_version` 冲突返回 409；金额上限服务端校验；支持「退回，不买」 |
-| T-207 | 授权超时与围栏前放弃（F-010） | T-206 | 围栏前超时 / 放弃后任务转 `PENDING_RETRIAL`，必须重新试选；围栏后禁止超时释放或放弃，改走人工核查；每个状态都有安全下一步 |
-| T-208 | 提交围栏与结果调和 API（F-017） | T-207, T-107 | dry-run start / ready、submission start / reconcile / manual-review 幂等；围栏事务原子消费执行权；响应不明不允许点击；不确定结果保留额度且不可重试 |
+| T-201 | 管理员登录与会话 | T-004, T-005 | 会话、CSRF、站内 return path 与权限测试 |
+| T-202 | 手工建单（F-001） | T-201 | 创建/展示 `MANUAL + DRAFT`；链接/金额/幂等/倒序；不含授权或执行 |
+| T-209 | 把核心 schema / 状态机迁移为单趟模型 | T-004, T-111 | 新 migration 安全替换旧 `spec_trials` / 授权锁价结构；新增 `purchase_attempts`；删除旧 MVP 状态；无业务数据事实写入迁移前置，遇未知旧数据 fail closed；领域/迁移测试同步 |
+| T-203 | 表格查询与批量开始采购（F-004、F-008、F-018） | T-202, T-209 | 只选 DRAFT；按钮明确“不付款”；事务内创建锁定任务字段的一次性授权并全批 `DRAFT → PENDING`；重放/冲突测试 |
+| T-204 | 路由化任务详情与内部截图资产（F-007、F-011） | T-203 | 抽屉/完整页共享 URL；状态详情；受保护 `INTERNAL_RAW` screenshot 上传/读取、SHA-256 与 no-store；不接收 XML |
+| T-205 | purchase attempt、事件与执行摘要 API | T-204, T-103 | 记录实际规格、两次单价、数量、确认页金额、固定 reason；不再创建 `spec_trials` 审批记录 |
+| T-206 | 单趟状态视图与安全主动作 | T-205 | PENDING/CLAIMED/ORDERING/NEEDS_MANUAL/WAITING_PAYMENT/RECONCILIATION_REQUIRED 显示和允许动作一致；无中途确认 |
+| T-207 | 授权有效期与围栏前重置（F-010） | T-206 | 围栏前过期/关闭旧授权后回 DRAFT；围栏后拒绝释放、取消、重新授权 |
+| T-208 | 提交围栏与结果调和 API（F-017） | T-207, T-107 | 原子复核授权/attempt/三闸门/唯一控件；首次许可一次；重放不许可点击；结果不明永久围栏且只调和 |
 
-### Phase 3 · 双端打通（第一趟）
+### Phase 3 · 双端打通（单趟围栏前）
 
 | ID | 任务 | 依赖 | 验收要点 |
 | --- | --- | --- | --- |
-| T-301 | 设备凭据与身份隔离（F-013） | T-201 | 设备 Bearer 不能建单或授权；管理会话不能调设备接口；凭据可撤销 |
-| T-302 | 原子领取与租约（F-005） | T-301, T-004 | 并发领取只有一个成功；重复领取重放同一结果；**同时支持领取待试选与已授权两类**；`claim_token` 与 `claim_generation` 校验生效 |
-| T-303 | 采购工具 `HttpTaskSource` / `HttpResultSink` | T-302, T-002 | 执行器只依赖抽象；测试假数据与断连 JSONL 暂存不扩大 Excel MVP 范围；补传使用幂等键 |
-| T-304 | 定时轮询与会话边界 | T-303, T-006 | 只在执行员启动的会话内轮询，关窗口即停；连续失败达阈值自动停止并提示原因；间隔可配置 |
-| T-306 | 证据上传与分层 | T-304, T-103 | 规格面板截图与订单截图上传服务端并脱敏；节点树与失败现场留本地；上传前校验不含地址与手机号 |
-| T-305 | **第一趟试选端到端** | T-306, T-104 | 从领取跑到试选回传：开商品、勾选规格、读单价、截图、退出释放手机；任务转「等你确认」；全程有事件与证据 |
+| T-301 | 设备凭据与身份隔离（F-013） | T-201 | Bearer 不能建单/授权；管理会话不能领任务；凭据可撤销 |
+| T-302 | 已授权任务原子领取与租约（F-005） | T-301, T-203 | 只领 PENDING+有效授权；并发唯一；重放同一 attempt；claim token/generation 有效 |
+| T-303 | `HttpTaskSource` / `HttpResultSink` | T-302, T-002 | 执行器依赖抽象；幂等重放；线协议严格校验；不扩大 Excel 范围 |
+| T-304 | 定时轮询与会话边界 | T-303, T-006 | 人启动后轮询；停止只阻止下次领取；连续失败停；当前任务/记录详情双视图 |
+| T-306 | 单趟截图与证据上传 | T-304, T-204 | 显式上传原始 screenshot；可含页面地址/手机号；完整 XML、本机路径、外部支付页不上传 |
+| T-305 | **单趟围栏前端到端 dry-run** | T-306, T-107, T-205 | 从领取连续跑到闸门三与提交控件验证，随后安全停止；全程事件/证据齐全，不申请真实许可、不点击提交 |
 
-### Phase 4 · 第二趟与收尾
+### Phase 4 · 真实提交与收尾
 
 | ID | 任务 | 依赖 | 验收要点 |
 | --- | --- | --- | --- |
-| T-401 | **第二趟下单端到端** | T-305, T-208, T-306 | 拿到授权后重新开商品、重新选同一规格、过三道闸门、原子建立提交围栏后提交一次；不确定结果进入调和且不可重试；明确创建才转「待付款」 |
-| T-402 | 待付款收口与手工完成 | T-401 | 详情页展示订单截图与授权信息供核对；人付款后手工标记完成；**待付款不等于成功** |
-| T-403 | 失败分类与证据归档（F-011） | T-401 | 覆盖需求列出的全部失败原因；终态一次原子回写，不落中间态 |
-| T-404 | 完整验收 MVP | T-402, T-403 | `02-requirements.md` 的 P0 验收全部通过；真机记录写入任务文件与 `current-state.md` |
-| T-405 | 采购工具打包与运行文档 | T-404 | 运营电脑可按文档运行；记录产物 SHA-256 |
+| T-401 | **单趟采购与提交围栏端到端** | T-305, T-208 | 同一设备会话通过三闸门、首次明确围栏许可后点击一次；结果不明只调和；明确创建转待付款；绝不付款 |
+| T-402 | 待付款收口与手工完成 | T-401 | 详情展示订单证据；人付款后手工标记；待付款不等于成功 |
+| T-403 | 失败分类与证据归档 | T-401 | 覆盖需求 reason；终态原子回写；围栏后无重试 |
+| T-404 | 完整 MVP 验收 | T-402, T-403 | P0 验收、双端门禁、真机记录和 current-state 全部通过 |
+| T-405 | 采购工具打包与运行文档 | T-404 | 运营电脑可安装运行，记录产物 SHA-256 |
 
-### V2 及以后（不在 MVP，编号预留）
+### V2 及以后
 
 | ID | 任务 | 说明 |
 | --- | --- | --- |
-| T-501 | 图片搜索产出 goods_id（F-014） | 推图到相册、搜图、从结果页取 goods_id；**不读价格**；最多 5 个 |
-| T-502 | 候选对照台（F-015） | 多候选并排对照，跨列逐行对齐，窄屏降级 |
-| T-503 | Excel 批量建单（F-002） | 被表头契约待确认阻塞 |
-| T-504 | ERP 货运同步与建单（F-003） | 被字段映射待确认阻塞 |
-| T-505 | 批量顺序编排与人工接管（F-012） | 勾选多条、暂停继续、运行中冻结 |
-| T-506 | 订单自动核对回读（F-016） | 五项唯一匹配才自动回写，否则待人工 |
-| T-507 | 本地执行轨迹留档（F-103） | NDJSON，含规则与模型判断的分歧字段 |
-| T-508 | AI 辅助（F-101、F-102） | 模型结论**不能放宽任何安全边界** |
+| T-501 | 图片搜索产出 goods_id（F-014） | 不在结果页读价；最多 5 个 |
+| T-502 | 候选对照台（F-015） | 多候选对照，窄屏降级 |
+| T-503 | Excel 批量建单（F-002） | 等表头契约 |
+| T-504 | ERP 同步与建单（F-003） | 等字段映射 |
+| T-505 | 批量编排与运行中接管（F-012） | 排序、暂停继续、运行中冻结 |
+| T-506 | 订单自动核对回读（F-016） | 五项唯一匹配，否则人工 |
+| T-507 | 本地执行轨迹留档（F-103） | NDJSON 与模型/规则分歧 |
+| T-508 | AI 辅助（F-101、F-102） | 模型结论不能放宽安全边界 |
 
 ## 里程碑
 
-- **M0**：网页端与桌面端 P0 原型经人工确认，流程、状态与主动作可枚举。（T-005、T-006）
-- **M1**：两端骨架可运行，数据模型与状态机落地。（Phase 0）
-- **M2**：真机能按链接打开商品、精确勾选颜色分类和尺码、**读到该 SKU 单价**。（T-103）
-- **M3**：真机能设对数量、以 dry-run 进入订单确认页读到「实付款」并验证唯一提交控件，
-  但不点击。（T-107）
-- **M4**：管理员能建单、看到试选结果、确认并签发授权。（Phase 2）
-- **M5**：第一趟试选端到端跑通，任务能停在「等你确认」。（T-305）
-- **M6**：MVP 闭环——第二趟下单成功，任务停在「待付款」。（T-401）
+- **M0**：两端原型确认；单趟主动作、状态、异常和键盘可枚举。（T-005、T-006、T-111）
+- **M1**：两端骨架、基础模型与验证入口可运行。
+- **M2**：真机按链接打开商品、精确选择颜色/尺码并读 SKU 单价。（T-103）
+- **M3**：真机设置数量、闸门二、确认页闸门三和唯一提交控件 dry-run 通过，不点击。（T-107）
+- **M4**：管理员建单并通过批量开始采购创建一次性授权；设备可安全领取。（T-203、T-302）
+- **M5**：单趟从领取到围栏前 dry-run 跑通，事件与证据齐全。（T-305）
+- **M6**：单趟真实提交只创建待付款订单，围栏/调和/人工收口闭环。（T-401～T-404）
 
-**M2 是本项目的生死线。** 前序项目正是卡在选规格和读价；M2 不通过之前不要写 Phase 2
-的生产页面。Phase 0 原型只用于确认信息架构，T-103 若改变可读字段必须先回修原型与 IX。
+**M2 仍是生死线。** M2 前可以并行管理会话、DRAFT 建单和开始采购的服务端授权事务，但不能编写
+依赖未取证页面字段的生产执行逻辑。提速来自两端并行、窄任务和主审复用门禁，不来自删除安全闸门。
 
-## 待办池（Backlog）
+## 待办池
 
-- V2 全部条目见上方「V2 及以后」表（T-501 ~ T-508）
-- 多设备并行（F-104）
-- 完整 RBAC（F-105）
-- 多平台比价（F-106）
-- 证据保留期与自动清理策略
-- 采购服务从 SQLite 迁移到 Postgres 的评估
-- 设备凭据轮换机制
-- 定时轮询间隔的风控友好节奏（需真机观察后确定）
+- V2：T-501～T-508；多设备、完整 RBAC、多平台。
+- 证据保留期和自动清理策略。
+- SQLite → Postgres 迁移评估。
+- 设备凭据轮换。
+- 风控友好的轮询与动作间隔（需真机观察）。

docs/07-user-stories.md

@@ -1,259 +1,139 @@
 # 用户故事清单
 
-> 本文记录「谁在什么场景下，为了获得什么价值，要完成什么目标」。不写接口、数据字段、
-> 组件实现或逐个按钮的行为。
-> 页面如何响应操作见[交互清单](08-interaction-checklist.md)；页面入口见[路由与页面结构](routes.md)；
-> 接口形状以 [API 合约](api.md) 为准。
+> 本文从用户目标描述 MVP。功能编号以[需求](02-requirements.md)为准，具体界面行为以
+> [交互清单](08-interaction-checklist.md)为准。
 
 ## 一、职责边界
 
-| 信息 | 权威文档 |
-| --- | --- |
-| MVP 范围、优先级、非目标 | [需求](02-requirements.md) |
-| 用户目标、场景与验收场景 | 本文 |
-| 页面操作、状态与反馈 | [交互清单](08-interaction-checklist.md) |
-| 页面入口、导航与组件归属 | [路由与页面结构](routes.md) |
-| 接口、事件与错误格式 | [API 合约](api.md) |
-
-US 编号一经引用不再重用。需求变化时先改[需求](02-requirements.md)，再同步本文。
+- 采购管理员决定买什么、最高允许多少钱，并通过“开始采购”明确授权创建待付款订单。
+- 采购工具只执行已授权任务，不修改规格、数量或金额上限。
+- 系统不付款；待付款订单由人核对、付款并手工收口。
+- 截图是内部审计证据，不是提交前审批环节。
 
 ## 二、用户故事总表
 
-| ID | 标题 | 优先级 | 角色 | 要达成的目标 | 关联功能 | 关联交互 | 状态 |
+| ID | 故事 | 优先级 | 角色 | 用户价值 | 功能 | 交互 | 状态 |
 | --- | --- | --- | --- | --- | --- | --- | --- |
-| US-001 | 把「要买什么」变成一条任务 | P0 | 采购管理员 | 填一次链接和规格，后面不用再管 | F-001 | IX-002 | 已定 |
-| US-002 | 知道每条任务现在卡在谁那里 | P0 | 采购管理员 | 一眼分出「等我」和「机器在跑」，快速找到要处理的那条 | F-004、F-011 | IX-003、IX-004 | 已定 |
-| US-003 | 让手机自己跑，不用我盯着 | P0 | 采购执行员 | 开一次轮询，手机排着队跑，只在停下来时介入 | F-005、F-006 | IX-007、IX-008 | 已定 |
-| US-004 | 确认机器有没有选对 | P0 | 采购管理员 | 看一眼机器实际勾选到的规格和价格，判断能不能买 | F-007、F-008 | IX-005 | 已定 |
-| US-005 | 放心地授权一笔下单 | P0 | 采购管理员 | 授权后确信系统只下单不付款，且不会因断网重复下单 | F-008、F-009、F-010、F-017 | IX-005、IX-010、IX-011 | 已定 |
-| US-006 | 付款前核对订单再花钱 | P0 | 采购管理员 | 对着系统给的几项组织人工核对，不一致就不付 | F-009 收口 | IX-006 | 已定 |
-| US-007 | 管理身份和设备身份互不越权 | P0 | 采购管理员 | 设备被盗用也不能建单或改授权 | F-013 | IX-001 | 已定 |
-| US-008 | 任务出问题时知道该怎么办 | P0 | 采购执行员 | 看到具体原因和下一步，而不是一个「失败」 | F-011 | IX-008 | 已定 |
-| US-010 | 把选中的任务交给机器试选 | P0 | 采购管理员 | 一次选中多条待开始任务，让桌面端逐条领取第一趟试选 | F-018 | IX-012 | 已定 |
-
-> US-009（从 ERP 货运明细建单）随 F-003 移出 MVP，编号保留不重用。
+| US-001 | 把“要买什么”变成待开始任务 | P0 | 采购管理员 | 一次填写链接、规格、数量和最高总价 | F-001 | IX-002 | 已定 |
+| US-002 | 知道任务当前卡在哪里 | P0 | 采购管理员 | 快速找到待授权、执行中、待付款或待人工任务 | F-004、F-007、F-011 | IX-003、IX-004 | 已定 |
+| US-003 | 让手机逐条执行已授权任务 | P0 | 采购执行员 | 开启轮询后无需盯每一步，异常时再介入 | F-005、F-006 | IX-007、IX-008 | 已定 |
+| US-004 | 查看机器实际执行证据 | P0 | 采购管理员 | 追溯规格、价格、数量、围栏和截图 | F-007 | IX-004 | 已定 |
+| US-005 | 明确授权且不会重复下单 | P0 | 采购管理员 | 点击开始采购后，只创建一笔待付款订单且绝不自动付款 | F-008、F-010、F-017 | IX-005、IX-010、IX-011 | 已定 |
+| US-006 | 付款前核对订单 | P0 | 采购管理员 | 对照系统证据后由人决定是否付款 | F-006 收口 | IX-006 | 已定 |
+| US-007 | 管理身份与设备身份不越权 | P0 | 采购管理员 | 设备凭据泄露也不能建单或授权 | F-013 | IX-001 | 已定 |
+| US-008 | 出问题时知道下一步 | P0 | 采购执行员 | 看到具体阶段、原因和安全恢复方式 | F-011、F-017 | IX-008、IX-011 | 已定 |
+| US-010 | 批量授权待开始任务 | P0 | 采购管理员 | 一次把选中任务交给采购工具逐条创建待付款订单 | F-008、F-018 | IX-012 | 已定 |
 
 ## 三、故事详情
 
-### US-001 把「要买什么」变成一条任务
+### US-001 把“要买什么”变成待开始任务
 
-- 优先级：P0 ｜ 关联功能：F-001 ｜ 关联交互：IX-002
-- 角色：采购管理员
-- 前置条件：已登录，手上有拼多多商品链接和要买的颜色分类、尺码。
+作为采购管理员，我希望在任务列表点击创建，填写标题、拼多多链接、颜色、尺码、数量和最高总价，
+保存后立即在首行看到 `DRAFT`，以便稍后统一授权。
 
-**用户故事**
+验收场景：
 
-作为采购管理员，我想要填一次链接和规格就把任务交出去，从而不必自己再去手机上操作。
+- 合法输入保存成功并规范化商品链接；创建动作不触发设备和授权。
+- 链接、规格、数量或金额不合法时，在字段附近说明原因并保留其他输入。
+- 重复提交同一 `create_key` 只返回原任务，不创建重复记录。
 
-**范围**
+### US-002 知道任务当前卡在哪里
 
-- 包含：任务名称、手工填链接、颜色分类、尺码、数量、价格上限。
-- 不包含：Excel 批量导入、从 ERP 生成、任务模板（均为 V2）。
+作为采购管理员，我希望在传统表格中按标题和状态筛选，看到标题链接、颜色、尺码、价格、数量、
+采购结果、状态和创建时间，并双击行查看详情。
 
-**验收场景**
+验收场景：
 
-1. 假如我有商品链接和规格，当我在任务列表的创建弹窗填完并保存，那么得到任务编号，
-   弹窗关闭，任务按创建时间倒序出现在表格第一行且状态为待开始。
-2. 假如链接无法解析出商品标识，当我提交，那么系统明确报错并保留我已填的内容。
-3. 假如我没填价格上限，当我提交，那么系统拒绝——**价格上限是资金边界，不能留空**。
+- 默认按创建时间倒序；标题是指向拼多多商品页的链接。
+- 没有操作列；详情通过双击行打开路由化抽屉，完整 URL 可复制，浏览器返回恢复列表现场。
+- 状态明确区分待开始、已授权待领取、执行中、待人工、围栏后待调和、待付款和终态。
+- 空筛选结果提供“清除筛选”，错误页保留安全重试；不把已围栏提交显示为可重试。
 
-### US-002 知道每条任务现在卡在谁那里
+### US-003 让手机逐条执行已授权任务
 
-- 优先级：P0 ｜ 关联功能：F-004、F-011 ｜ 关联交互：IX-003、IX-004
-- 角色：采购管理员
-- 前置条件：已登录，系统中有若干条不同状态的任务。
+作为采购执行员，我希望配置服务、设备 serial 和轮询间隔后，点击一次开始轮询，让采购工具逐条领取
+已授权任务并在同一趟中完成选规格、价格校验、数量、确认页和提交围栏。
 
-**用户故事**
+验收场景：
 
-作为采购管理员，我想要打开就看清哪几条在等我，从而不必逐条点进去确认还需不需要我
-处理。
+- 启动前同时校验采购服务、ADB 设备和已取证拼多多版本；任一不满足则不启动。
+- 顶部始终显示会话状态；当前任务、图片、滚动日志和倒序采购记录实时更新。
+- 精确规格、两次单价、数量读回、确认页总额或提交控件任一不合格时停止该任务。
+- 围栏明确成功后只点一次“提交订单”；系统绝不点击付款。
+- 连续轮询失败达到阈值自动停止；停止轮询不取消正在执行或已围栏的任务。
 
-**范围**
+### US-004 查看机器实际执行证据
 
-- 包含：传统任务表格、关键词与时间范围查询、任务详情抽屉和完整详情页中的结果与证据。
-- 不包含：自定义视图、导出报表、跨任务统计。
+作为采购管理员，我希望打开任务详情后看到本次授权、设备领取、实际规格、三道价格闸门、截图、
+提交围栏与结果，以便审计发生了什么，而不是在中途批准机器选择。
 
-**验收场景**
+验收场景：
 
-1. 假如有任务停在等待人工确认，当我打开工作台，那么表格状态与采购结果能让我一眼识别，
-   双击该行即可在不丢失列表现场的情况下查看详情。
-2. 假如我按关键词筛选后没有匹配，当结果为空，那么显示空状态并提供清除筛选，而不是
-   一片空白或报错。
-3. 假如任务失败了，当我打开详情，那么我看到可区分的失败原因和当时的截图，而不只是
-   「失败」两个字。
+- 证据按 attempt 和时间排序，区分规格面板、确认页、提交结果。
+- 原始截图仅登录管理员可看，响应不缓存；完整 XML 不出现在页面或接口中。
+- 地址/手机号不提取为字段或日志，外部支付页和支付凭据不存储。
+- 执行中没有“确认机器选对了吗”或“确认后继续第二趟”按钮。
 
-### US-003 让手机自己跑，不用我盯着
+### US-005 明确授权且不会重复下单
 
-- 优先级：P0 ｜ 关联功能：F-005、F-006 ｜ 关联交互：IX-007、IX-008
-- 角色：采购执行员
-- 前置条件：电脑已连上 web 端；手机已连接、已解锁、已登录拼多多。
+作为采购管理员，我希望点击“开始采购（只创建待付款订单）”时明确知道影响范围，并确信系统不会
+超出金额上限、不会付款，也不会因为断网重复提交。
 
-**用户故事**
+验收场景：
 
-作为采购执行员，我想要开一次轮询就让手机排着队把任务跑掉，从而把注意力留给真正需要
-判断的时刻。
+- 只有 `DRAFT` 可选；操作条显示选中数量和最高总额。
+- 点击即创建一次性授权并整批转 `PENDING`；不再要求试选后确认。
+- 任一任务版本冲突时整批不变；同一开始键重放同一结果。
+- 设备在同一趟通过三道闸门；服务端围栏明确建立后才准许点击一次。
+- 围栏前失败可由人重置并重新授权；围栏后只能调和同一提交，永不出现“再次下单”。
 
-**范围**
+### US-006 付款前核对订单
 
-- 包含：定时轮询领取、第一趟试选、第二趟下单、连续失败自动停。
-- 不包含：多台手机并行、无人值守整夜运行、已开始任务的排序、暂停 / 继续和运行中接管（V2）。
+作为采购管理员，我希望任务转为待付款后看到商品、规格、数量、授权上限、确认页金额与订单截图，
+在拼多多核对后由人决定是否付款。
 
-**验收场景**
+验收场景：
 
-1. 假如有待处理任务且设备就绪，当我点击开始轮询，那么系统按间隔领取任务并显示**这一趟
-   是试选还是下单**；两个实例并发不会领到同一条。
-2. 假如第一趟试选完成，当机器读完价截完图，那么**它退出商品页释放手机**，立刻可以开始
-   下一条，而不是停在规格面板上等我。
-3. 假如某条任务需要人工，当它停下来，那么界面显著提示缺什么，该任务不再被本端领取，
-   但轮询继续跑其他任务。
-4. 假如连续失败达到阈值，当失败累积，那么轮询自动停止并说明原因，**不无限重试**。
-5. 假如我关闭窗口，那么轮询立即停止，不留后台进程。
+- `WAITING_PAYMENT` 明确写“订单已创建，系统尚未付款”。
+- 标记完成前再次提示该操作只记录人工付款事实，不执行支付。
+- 人确认已付款后才转 `SUCCEEDED`；发现不一致时不付款并进入人工处理。
 
-### US-004 确认机器有没有选对
+### US-007 管理身份与设备身份不越权
 
-- 优先级：P0 ｜ 关联功能：F-007、F-008 ｜ 关联交互：IX-005
-- 角色：采购管理员
-- 前置条件：任务已完成第一趟试选并回传结果。
+作为采购管理员，我希望网页会话与设备 token 完全隔离，以便设备只能做被授权的执行工作。
 
-**用户故事**
+验收场景：
 
-作为采购管理员，我想要看一眼机器**实际勾选到**的规格和读到的价格，从而在它去下单之前
-确认没选错。
+- 未登录不能查看任务或截图；登录会话具备 CSRF 防护。
+- 设备 token 不能创建任务、开始采购、重置任务或人工调和。
+- 管理会话不能伪装设备领取或建立围栏；设备凭据可撤销。
 
-**范围**
+### US-008 出问题时知道下一步
 
-- 包含：需求与机器所选的逐项对照、单价与合计、规格面板截图、确认或退回。
-- 不包含：在多个候选之间挑选（MVP 只有一个商品，多候选对照台是 V2）。
+作为采购执行员，我希望错误包含阶段、固定原因和安全下一步，以便处理而不冒险重试。
 
-**验收场景**
+验收场景：
 
-1. 假如机器选到的颜色分类和尺码与我要的一致、合计没超上限，当我打开详情，那么各项
-   显示 ✓ 且确认按钮可用。
-2. 假如机器选到的规格与我要的不符，当我打开详情，那么显示 ✗ 并说明哪一项不符，
-   **确认按钮禁用**，我只能退回或转人工。
-3. 假如合计超出我设的上限，当我打开详情，那么显示超出多少且确认按钮禁用，
-   **不提供「仍然确认」入口**。
-4. 假如价格读不到，那么任务根本不会进到这一步，而是直接转人工并说明原因。
+- 至少区分设备、App 版本、商品、面板、规格、价格、数量、确认页、围栏、安全校验和网络错误。
+- 围栏前错误提示停止、留证并等待人工处理；不会自动重新开始。
+- 围栏后错误明确写“可能已创建订单，只能调和，禁止再次点击”。
+- 桌面端详情切换不改变服务端状态；Esc 只回到当前任务视图，不取消业务流程。
 
-### US-005 放心地授权一笔下单
+### US-010 批量授权待开始任务
 
-- 优先级：P0 ｜ 关联功能：F-008、F-009、F-010、F-017 ｜ 关联交互：IX-005、IX-010、IX-011
-- 角色：采购管理员
-- 前置条件：任务处于等待确认，已看过试选结果。
+作为采购管理员，我希望勾选多条 `DRAFT` 后统一点击开始采购，以便减少重复操作，同时知道每条都
+会允许采购工具创建一笔待付款订单。
 
-**用户故事**
+验收场景：
 
-作为采购管理员，我想要确认后签发一次授权，从而让系统去下单，同时确信它不会替我付钱，
-也不会因为卡住而让任务永久停摆。
-
-**范围**
-
-- 包含：确认签发、锁定单价、退回不买、围栏前放弃、dry-run、提交围栏与结果调和。
-- 不包含：审批链、多人会签、金额分级授权。
-
-**验收场景**
-
-1. 假如我提交授权，当系统接受，那么明确告知只创建待付款订单、付款需我在拼多多完成。
-2. 假如授权时的单价是 32.50，当机器第二趟发现价格变了，那么它**停下来转人工**，
-   不会按新价照下——我确认的是那个价格，不是那个商品。
-3. 假如一笔授权在提交围栏前卡住，当我需要重来，那么我可以放弃它，任务进入待重新试选。
-   假如围栏已经建立，则不能放弃或重试，只能核查这一次提交。
-4. 假如授权自动过期，那么系统要求**重新试选取新价**后再确认，不复用旧价。
-5. 假如我重复提交同一笔授权，那么只产生一笔订单。
-6. 假如真实点击前网络超时、无法确认服务端是否已建立围栏，那么系统不点击并提示核查；
-   假如点击后结果不明，那么系统保留围栏并进入调和，绝不再点一次。
-
-### US-006 付款前核对订单再花钱
-
-- 优先级：P0 ｜ 关联功能：F-009 收口 ｜ 关联交互：IX-006
-- 角色：采购管理员（采购执行员在拼多多完成人工付款并反馈结果）
-- 前置条件：系统已创建待付款订单，任务状态为等待付款。
-
-**用户故事**
-
-作为采购执行员，我想要拿着系统给的几项去拼多多逐一核对，从而不会付错单。
-
-**范围**
-
-- 包含：展示订单截图、商品、规格、数量与授权金额；人付款后手工标记完成。
-- 不包含：系统代付、免密支付、在拼多多改单、**自动回读核对（F-016，V2）**。
-
-**验收场景**
-
-1. 假如订单已创建，当我打开详情，那么我看到需要核对的项和设备回传的订单截图。
-2. 假如各项都对得上，当我在拼多多付完款回来点「已付款」，那么任务转为已完成并记录
-   标记人与时间。
-3. 假如金额或规格对不上，当我发现不一致，那么我能「标记异常」转人工，
-   **不能直接标记已付款**。
-4. 假如订单截图缺失，那么系统不允许标记完成，直接转人工——**无证据不得收口**。
-
-### US-007 管理身份和设备身份互不越权
-
-- 优先级：P0 ｜ 关联功能：F-013 ｜ 关联交互：IX-001
-- 角色：采购管理员
-- 前置条件：系统有管理员账号与已授权设备各一。
-
-**用户故事**
-
-作为采购管理员，我想要设备只能做执行、不能做决策，从而即使设备凭据泄露也不会有人
-凭它建单或改授权。
-
-**验收场景**
-
-1. 假如持有设备凭据，当尝试创建任务或签发授权，那么被拒绝并记录。
-2. 假如持有管理会话，当尝试调用设备接口，那么被拒绝。
-3. 假如设备凭据被撤销，当设备下次请求，那么立即失效且当前任务安全停止。
-
-### US-008 任务出问题时知道该怎么办
-
-- 优先级：P0 ｜ 关联功能：F-011 ｜ 关联交互：IX-008
-- 角色：采购执行员
-- 前置条件：任务执行中遇到异常。
-
-**用户故事**
-
-作为采购执行员，我想要看到具体卡在哪一步、为什么，从而知道是自己能处理还是要找管理员。
-
-**验收场景**
-
-1. 假如规格找不到精确匹配，那么系统说明缺的是颜色分类还是尺码、页面上有哪些可选值，
-   并转人工——**不选相近的**。
-2. 假如规格面板上读不到单价，那么系统转人工并说明原因，
-   **不用商品详情页正文的数字凑合**。
-3. 假如第二趟发现价格与授权价不一致，那么系统说明「授权 ¥X、现价 ¥Y」并转人工，
-   既不按新价下单，也不自动放弃。
-4. 假如遇到验证码或风控，那么系统立即停止、保留截图、转人工，**不尝试绕过**。
-5. 假如点击提交订单后无法判断是否已创建，那么系统转人工并提示「订单可能已创建、
-   支付未完成」，进入同一提交记录的调和，**不自动重试、不释放围栏**。
-
-### US-010 把选中的任务交给机器试选
-
-- 优先级：P0 ｜ 关联功能：F-018 ｜ 关联交互：IX-012
-- 角色：采购管理员
-- 前置条件：已登录；任务表格中至少有一条待开始任务。
-
-**用户故事**
-
-作为采购管理员，我想要勾选一条或多条待开始任务统一开始试选，从而在集中建单后一次交给
-桌面端逐条领取，而不必逐行点击操作按钮。
-
-**范围**
-
-- 包含：当前筛选结果中的可开始任务全选、清除选择、批量进入第一趟试选队列。
-- 不包含：指定执行顺序、暂停 / 继续、运行中接管、多设备调度（F-012，V2）。
-
-**验收场景**
-
-1. 假如我勾选了多条待开始任务，当我点击「开始试选」，那么这些任务一起转为待领取，
-   页面明确说明不会创建订单或付款。
-2. 假如任务不是待开始，那么该行不能被本动作勾选，并能看见不可开始的原因。
-3. 假如其中一条任务在提交前已被别人启动，当版本冲突发生，那么整批不产生部分成功，
-   页面刷新状态并让我重新选择。
+- 表头复选框只选择当前筛选结果中的 `DRAFT`；切换筛选时选择范围可见且可清空。
+- 未选择时按钮禁用；选中后显示数量、最高总额与“不付款”说明。
+- 点击后批量全有或全无；成功反馈授权数量，冲突反馈刷新重选。
+- 非 `DRAFT` 行不能勾选；表格不提供每行“开始采购”按钮，避免逐行语义不一致。
 
 ## 四、交付前检查
 
-- [ ] 每个 P0 功能至少关联一个 US 编号。
-- [ ] 每个故事说明角色、目标、价值和可验证的验收场景。
-- [ ] UI 故事已关联对应 IX 编号。
-- [ ] 故事没有复制接口、字段或组件实现细节。
-- [ ] 范围、优先级与[需求](02-requirements.md)一致。
+- 每个 P0 故事至少有一个自动化测试或明确的人机验收证据。
+- 页面、API、状态机只使用单趟采购术语，不再出现试选后确认、授权旧试选价或第二趟下单。
+- 任一可见“开始采购”都同时说明“只创建待付款订单，系统不付款”。
+- 任一围栏后状态都不提供重试、释放授权或重新开始入口。

docs/08-interaction-checklist.md

@@ -1,197 +1,147 @@
 # 交互清单
 
-> 本文把用户故事落成可实现、可测试的界面行为：用户如何触发、系统处于什么状态、如何
-> 反馈，以及失败时怎样恢复。覆盖 web 端页面与 desk 端桌面界面。
+> 本文是界面行为权威。需求范围见[需求](02-requirements.md)，页面位置见[routes](routes.md)。
 
 ## 一、职责边界
 
-| 信息 | 写在哪里 |
-| --- | --- |
-| 用户目标、价值与业务验收 | [用户故事清单](07-user-stories.md) |
-| MVP 范围与优先级 | [需求](02-requirements.md) |
-| 页面入口、路由和组件归属 | [路由与页面结构](routes.md) |
-| API、事件和错误格式 | [API 合约](api.md) |
-
-IX 编号一经引用不再重用。交互清单不能扩大需求范围。
+- 采购服务负责建单、开始采购授权、任务详情、内部证据、调和和人工付款收口。
+- 采购工具负责连接手机、轮询领取、单趟执行、日志和本地记录详情。
+- “开始采购”是管理员对创建待付款订单的明确授权；不再有试选后的确认页面。
+- 任一端都不自动付款；围栏后不提供重试或释放动作。
 
 ## 二、交互总表
 
-| ID | 关联 US | 页面 / 组件 | 触发 | 用户目标 | 预期结果 | 优先级 | 状态 |
-| --- | --- | --- | --- | --- | --- | --- | --- |
-| IX-001 | US-007 | web `/login` | 提交表单 | 进入管理后台 | 建立会话并进入原目标页或 `/tasks` | P0 | 已定 |
-| IX-002 | US-001 | web `/tasks` 创建弹窗；`/tasks/new` 直达兜底 | 提交表单 | 建单 | 解析出 `goods_id`，关闭弹窗并把待开始任务插入表格第一行 | P0 | 已定 |
-| IX-003 | US-002 | web `/tasks` 查询条与任务表格 | 输入后筛选 | 找到要处理的任务 | 默认显示标题关键词，可展开状态 / 时间条件；创建时间倒序；空状态可清除 | P0 | 已定 |
-| IX-004 | US-002 | web `/tasks/{id}` 路由化详情抽屉 / 完整页 | 双击行、任务编号链接或直接进入 | 了解任务当前处境 | 从列表进入时右侧打开且保留现场；直达时显示完整页；按状态呈现唯一主区块与主动作 | P0 | 已定 |
-| IX-005 | US-004、US-005 | web 试选确认卡 | 查看后点确认 / 退回 | 确认机器选对了并授权 | 签发一次性授权并锁定单价，明确不付款 | P0 | 已定 |
-| IX-006 | US-006 | web 待付款核对卡 | 查看后手工标记 | 核对后付款 | 展示订单截图与授权信息；人付款后标记完成 | P0 | 已定 |
-| IX-007 | US-003 | desk 配置页 | 填 serial → 连接检查 | 让设备就绪 | 连接成功并确认拼多多已安装 | P0 | 已定 |
-| IX-008 | US-003、US-008 | desk 采购执行页 | 顶部开始 / 停止轮询；查看执行记录 | 让手机自动跑并处理异常 | 三块工作区保留当前任务、滚动日志和时间倒序记录；待人工时显著提示缺什么；连续失败自动停 | P0 | 已定 |
-| IX-010 | US-005 | web 围栏前放弃授权入口 | 点击放弃 | 解开尚未提交的授权 | 授权作废，任务转待重新试选 | P0 | 已定 |
-| IX-011 | US-005、US-008 | web / desk 提交围栏与调和状态 | 真实点击前申请围栏；点击后回报 | 防止断网或重复操作产生第二笔订单 | 围栏前失败不点击；围栏后不明确只核查、不重试 | P0 | 已定 |
-| IX-012 | US-010 | web `/tasks` 表格选择与上下文批量栏 | 勾选后点「开始试选」 | 批量交给桌面端试选 | `DRAFT → PENDING` 原子提交；仅开始第一趟，不授权、不下单、不付款 | P0 | 已定 |
+| ID | 故事 | 位置 | 触发 | 结果 | 优先级 | 状态 |
+| --- | --- | --- | --- | --- | --- | --- |
+| IX-001 | US-007 | web `/login` | 登录 / 退出 | 建立或销毁管理员会话 | P0 | 已定 |
+| IX-002 | US-001 | web 任务表格创建弹窗 | 点击创建、保存 | 创建 `DRAFT` 并在首行反馈 | P0 | 已定 |
+| IX-003 | US-002 | web `/tasks` 筛选行 | 输入关键词、筛选、清除 | 更新表格并保留可理解的筛选状态 | P0 | 已定 |
+| IX-004 | US-002、US-004 | web 列表行 / `/tasks/{id}` | 双击行、浏览器前进后退 | 路由化详情抽屉或完整页，显示执行证据 | P0 | 已定 |
+| IX-005 | US-005 | web 批量操作条 | 点击开始采购 | 创建一次性授权并进入 `PENDING` | P0 | 已定 |
+| IX-006 | US-006 | web 待付款详情 | 查看后手工标记 | 只记录人工付款完成，不执行支付 | P0 | 已定 |
+| IX-007 | US-003 | desk 配置 tab | 保存并检查连接 | 服务、ADB、App 版本就绪 | P0 | 已定 |
+| IX-008 | US-003、US-008 | desk 采购执行 tab | 开始 / 停止轮询、选择记录、Esc | 单趟执行和安全人工接管 | P0 | 已定 |
+| IX-009 | US-008 | web / desk 通用错误反馈 | 请求或流程失败 | 显示阶段、原因和安全下一步 | P0 | 已定 |
+| IX-010 | US-005 | web 围栏前人工处理 | 重置 / 取消 | 关闭旧授权后回 `DRAFT` 或取消 | P0 | 已定 |
+| IX-011 | US-005、US-008 | desk 围栏 + web 调和 | 自动申请围栏 / 人工调和 | 点击一次或只处理同一提交 | P0 | 已定 |
+| IX-012 | US-010 | web 表格选择与操作条 | 勾选任务 | 明确批量范围、数量、最高总额 | P0 | 已定 |
 
-> IX-009（ERP 建单）随 F-003 移出 MVP，编号保留不重用。
+## 三、P0 高风险交互
 
-## 三、交互详情（P0 高风险）
+### IX-005 开始采购授权
 
-以下三项涉及资金、不可逆动作或权限，必须完整填写。其余交互保留总表条目。
+**目标**：让管理员用一个明确动作把选中任务授权给采购工具创建待付款订单，同时避免重复授权或
+让用户误以为系统会付款。
 
-### IX-005 试选确认与下单授权
+- 前置：已登录；至少一条 `DRAFT` 被选中；页面持有每条任务当前版本。
+- 触发：点击“开始采购（只创建待付款订单）”。
+- 点击本身即授权，不再弹出“机器选对了吗”或试选确认，也不需要第二个同义确认按钮。
 
-- 关联用户故事：US-004、US-005
-- 关联需求 / 验收：F-007、F-008；[需求](02-requirements.md)第五节「决策与资金」
-- 页面 / 组件：web `/tasks/{id}` 路由化详情抽屉 / 完整页的 `SpecTrialCard` + `AuthorizePanel`
-- 目标角色：采购管理员
-- 前置条件：已登录；任务状态为 `WAITING_CONFIRMATION`；已收到试选结果与规格面板截图
-- 触发方式：查看后点击「确认下单（不付款）」或「退回，不买」
-- 服务依赖：`POST /tasks/{id}/order-authorizations`、`POST /tasks/{id}/reject`
-- 关联原型：待补（`docs/design/`）
+操作条必须持续展示：
 
-**这不是候选对照台。** 只有一个商品，人回答的是「机器选对了吗」，不是「哪个更好」。
+1. “已选 N 条”；
+2. 所选任务最高总价之和；
+3. “采购工具会逐条创建待付款订单，系统不会付款”；
+4. 主按钮“开始采购（只创建待付款订单）”。
 
-**正常路径**
-
-1. 用户进入详情页，看到需求与机器所选的逐项对照、单价、合计和规格面板截图。
-2. 各项均为 ✓ 时，「确认下单（不付款）」可用。
-3. 用户点击确认，系统签发授权并**锁定本次试选的单价**，任务转 `AUTHORIZED`。
-4. 页面明确提示：只会创建待付款订单，付款需人在拼多多完成。
-
-**状态与异常清单**
-
-| 场景 | 本交互约定 |
+| 状态 | 行为 |
 | --- | --- |
-| 默认 / 可操作 | 各项 ✓ 时确认按钮可用；截图必须已加载出来才允许确认 |
-| 规格不一致（✗） | **确认按钮禁用**并说明哪一项不符；只能「退回，不买」或转人工 |
-| 金额超上限（✗） | **确认按钮禁用**并显示超出多少；不提供「仍然确认」入口 |
-| 加载 / 提交中 | 按钮禁用并显示进行中，防重复提交 |
-| 成功 | 关闭详情抽屉或返回工作台，该任务显示为已授权并等待桌面端领取第二趟 |
-| 退回 | 二次确认后任务终止为 `CANCELED`，说明不会再自动执行 |
-| 服务或网络错误 | 保留页面状态，说明原因并允许重试 |
-| 权限不足 | 设备凭据调用此接口一律 403 并记录；页面不暴露任务内容 |
-| 冲突 / 重复提交 | `expected_task_version` 不匹配返回 409，提示任务已变化并刷新；重复提交幂等，只产生一笔订单 |
-| 破坏性操作 | 确认会导致真实下单。提交前必须显示授权金额上限与「系统只下单不付款」 |
-| 试选已过期 | 授权过期后任务转待重新试选；完成新试选前不显示确认入口，页面明确说明旧价不再有效 |
-| 中断 / 离线 | 未提交的备注不保存；重进页面回到未确认状态 |
+| 未选择 | 按钮禁用，说明“请选择待开始任务” |
+| 选择中 | 只统计可选 `DRAFT`；非 DRAFT checkbox 禁用且有原因 |
+| 提交中 | 按钮禁用并显示“正在授权…”；避免双击，焦点不跳走 |
+| 成功 | 表格更新为 `PENDING`，清空已成功选择，toast/实时区提示授权数量和“不付款” |
+| 任一版本冲突 | 整批不变，保留筛选，清除失效选择并提示刷新后重选 |
+| 网络结果不明 | 使用同一 `start_key` 查询/重放，不生成新 key；不要直接再次授权 |
 
-**可访问性与多端**
-
-- 确认与退回按钮可键盘到达，焦点可见。
-- ✓ / ✗ 不能只靠颜色区分，必须带文字。
-- 窄屏下截图可放大查看，不被裁切到看不清规格。
+无障碍：操作条出现在表格前，状态变化用礼貌 `aria-live`；按钮具有可见焦点，文案不依赖颜色或图标。
 
 ### IX-006 待付款核对与标记完成
 
-- 关联用户故事：US-006 ｜ 关联需求：F-009 收口
-- 页面 / 组件：web `/tasks/{id}` 的 `PaymentCheckCard`
-- 目标角色：采购管理员（采购执行员在拼多多完成人工付款并反馈结果）
-- 前置条件：任务状态为 `WAITING_PAYMENT`，已收到订单截图
-- 服务依赖：`POST /tasks/{id}/mark-paid`
+- 页面显示商品、目标与实际规格、数量、授权上限、两次单价、确认页总额和订单截图。
+- 首屏警示：“订单已创建，系统尚未付款。请在拼多多人工核对并付款。”
+- “标记为已付款并完成”只写系统状态，不打开支付页面、不触发手机操作。
+- 提交前用简短确认对话框说明这是人工事实记录；成功转 `SUCCEEDED`，重复提交幂等。
+- 信息不一致时提供“转人工处理”，不提供“重新提交订单”。
 
-**MVP 简化版**：系统只展示，不自动回读。自动核对是 F-016（V2）。
+### IX-008 桌面端轮询与单趟执行
 
-**正常路径**
+采购工具固定两个 tab：“采购执行”（默认）和“配置”。采购执行顶部第一行依次显示采购服务、设备、
+拼多多版本、会话状态与“开始/停止轮询”；不另占一行。
 
-1. 用户看到订单截图、商品、规格、数量和授权金额。
-2. 用户在拼多多手工核对并付款。
-3. 用户回到页面点「已付款」，任务转 `SUCCEEDED`。
+主体保持左右结构：
 
-**状态与异常清单**
+- 左上：当前任务文字占约 2/3，商品图片占右侧约 1/3；无图显示稳定占位。
+- 左下：滚动日志，占用剩余高度；最新日志可自动跟随，用户上滚后不强制跳底。
+- 右侧：采购记录表格，按时间倒序，仅显示标题和状态。
+- 双击/Enter 记录后不弹窗，在左侧显示该记录：左侧原始文字、右侧图片、下方执行结果。
+- 按 Esc 或“返回当前任务”恢复当前任务视图；查看历史不暂停、不取消、不更改服务端状态。
 
-| 场景 | 本交互约定 |
+单趟可见阶段：
+
+```text
+待领取 → 已领取 → 打开商品 → 打开规格面板 → 选择规格
+→ 闸门一 → 数量复核 → 闸门二 → 确认页 / 闸门三
+→ 申请围栏 → 已发出唯一提交 → 待付款 / 待调和
+```
+
+| 情况 | 反馈和下一步 |
 | --- | --- |
-| 默认 | 显著提示「对不上就别付」，并说明不一致时回来标记异常而不是在拼多多改单 |
-| 成功 | 任务转已完成，记录标记人与时间 |
-| 金额或规格对不上 | 提供「标记异常」转 `NEEDS_MANUAL`，不允许直接标已付款 |
-| 截图缺失 | 说明证据缺失并转人工，**不允许在无证据情况下标记完成** |
-| 重复标记 | 幂等，不产生第二条完成记录 |
-| 破坏性操作 | 本交互不产生任何写平台动作，只改本地状态 |
+| 服务/设备/App 未就绪 | 开始轮询禁用；状态区给出具体修复入口 |
+| 正在领取或执行 | 显示阶段与任务；停止轮询只阻止下一次领取，不中断当前安全步骤 |
+| 规格、价格、数量或确认页失败 | 记录固定 reason code，停止点击并进入待人工 |
+| 正在申请围栏 | 禁用停止当前任务、退出和任何提交动作；界面只显示进度 |
+| 围栏响应不明 | 不点击，进入待调和 |
+| 已围栏 / 点击结果不明 | 红色安全横幅“可能已创建订单，禁止再次提交”；只能调和 |
+| 外部支付或安全校验 | 立即停止，不与页面继续交互；保存允许的证据并提示人工接管 |
+| 连续轮询失败 | 达阈值自动停止会话；当前已围栏提交不受影响 |
 
-### IX-008 桌面端定时轮询与人工接管
-
-- 关联用户故事：US-003、US-008 ｜ 关联需求：F-005、F-011
-- 页面 / 组件：desk 采购执行页 `PollControls` + `DeviceStatusBar` + `CurrentTaskPanel` +
-  `ExecutionLog` + `ExecutionRecordTable` + `ExecutionRecordDetailPanel`
-- 目标角色：采购执行员
-- 前置条件：web 端连接正常；设备已通过连接检查
-
-**正常路径**
-
-1. 用户确认 web、设备和已取证 App 版本三项状态都就绪，在顶部状态区点击「开始轮询」。
-2. 每到间隔时间领取一条任务，界面显示**这一趟是试选还是下单**、商品、规格、当前步骤。
-3. 第一趟试选完成后**退出商品页释放手机**，继续下一轮轮询。
-4. 执行结果按时间倒序进入右侧两列表格；单击只选中，双击、Enter 或可见查看命令在左侧打开
-   记录详情。宽屏可继续选择其他记录；可见返回按钮或 `Esc` 回到当前任务并恢复当前行焦点。
-
-**状态与异常清单**
-
-| 场景 | 本交互约定 |
-| --- | --- |
-| 默认 | 任一就绪条件不满足时「开始轮询」禁用，并说明是 web、设备还是 App 版本问题 |
-| 轮询中 | 显示下次轮询倒计时与连续失败计数 |
-| 执行中 | 显示当前趟次与步骤；**真机步骤期间禁用硬取消和关闭窗口** |
-| 当前任务图片 | 无可信图片时显示空态；有图时标来源与采集时间，不用其他来源图片凑合 |
-| 执行记录详情 | 左栏在当前任务 / 记录详情间切换，不打开模态框；详情内左侧原始文字、右侧图片证据、下方结构化采购结果；顶部实时状态不中断；不提供下单、重试提交或付款动作 |
-| 详情读取异常 | 加载、失败、无图和记录不存在分别说明；仅可重试读取同一稳定记录 ID，过期异步结果不得覆盖当前视图 |
-| 无可领任务 | 显示「暂无待领任务」并继续下一轮，**不当作错误、不计入失败计数** |
-| 待人工 | 整页显著变色，说明缺什么、下一步做什么；该任务不再被本端领取 |
-| 连续失败 | 达到阈值自动停止轮询并显示原因，**不无限重试** |
-| 关闭窗口 | 立即停止轮询，不留后台进程 |
-| 设备断连 | 当前任务标技术失败、保留现场；**不重试任何可能创建订单的点击** |
-| 安全校验 | 立即停止轮询、截图、转人工，**不提供绕过入口** |
-| 外部支付交接 | 立即停止并提示「订单可能已创建、支付未完成」；**不提供「继续」按钮** |
-| 点击提交后超时 | 转 `RECONCILIATION_REQUIRED` 并预留金额额度，**禁止自动重试**；授权保持永久围栏 |
-| 闸门二不通过 | 说明「价格已变：授权 ¥X，现价 ¥Y」并转人工，不自动下单也不自动放弃 |
-| 运行中变更 | 冻结设备切换和参数保存 |
-| 服务端不可达 | 保留本地结果与证据，提示待补传，不丢弃已完成工作 |
+键盘：Tab 顺序与视觉一致；表格上下箭头移动当前行，Enter 查看，Shift+F10 打开上下文菜单；Esc
+优先关闭菜单，其次返回当前任务视图。Esc、关闭窗口和停止轮询都不能释放围栏或触发重试。
 
 ### IX-011 提交围栏与结果调和
 
-- 关联用户故事：US-005、US-008 ｜ 关联需求：F-017
-- 页面 / 组件：desk 采购执行页；web 任务详情的提交围栏摘要
-- 前置条件：已完成 dry-run；真实第二趟重新通过三道闸门；授权尚未消费且未建立围栏
-- 服务依赖：`order-dry-runs/start`、`order-dry-runs/{rid}/ready`、
-  `order-submissions/start`、`order-submissions/{sid}/reconcile`、`manual-review`
+围栏由后台流程自动申请，不向执行员提供“提交订单”按钮。
 
-**正常路径**
+1. 当前任务在同一趟内完成闸门二和闸门三，并确认提交控件精确唯一。
+2. 客户端显示“正在申请提交围栏”，提交当前验证摘要。
+3. 只有服务端首次明确返回 `click_permitted=true`，客户端才先持久化唯一点击意图，再精确点击一次。
+4. 明确创建转待付款；外部支付、安全校验、超时、断连或未知页面转待调和。
+5. 围栏后的 web 详情只显示同一 `submission_id` 的证据、调和记录与人工结论。
 
-1. dry-run 以醒目的「只读演练」标识运行，到确认页读取并验证后退出，不出现提交动作。
-2. 真实第二趟在三道闸门通过后显示「正在申请提交围栏」，此时不允许点击或取消。
-3. 只有服务端明确返回 `click_permitted` 后执行一次点击，界面立即进入「正在核对订单结果」。
-4. 明确创建后转待付款；结果不明确则两端都显示同一 `submission_id` 与「可能已创建」，
-   只提供人工核查，不提供重试或放弃。
+| 状态 | 允许动作 | 禁止动作 |
+| --- | --- | --- |
+| 围栏前 | 停止并转人工；管理员可安全重置为 DRAFT | 绕过闸门、客户端自签授权 |
+| 围栏申请结果不明 | 不点击，记录待调和 | 换 key 申请、点击猜测 |
+| 围栏已建立 | 上报一次观察结果、人工调和 | 释放授权、重新开始、再次点击 |
+| 明确待付款 | 人工核对/付款/标记完成 | 系统支付 |
 
-**状态与异常清单**
+围栏重放响应不授予点击许可。调和页面不得出现普通“重试”按钮。
 
-| 场景 | 本交互约定 |
-| --- | --- |
-| dry-run | 蓝色信息态并固定显示「不会提交订单」；完成后有证据摘要 |
-| 围栏申请中 | 主操作禁用、显示进度；关闭窗口受控，避免用户误以为可重来 |
-| 围栏申请失败 / 响应不明 | **不点击**；展示幂等键与核查入口 |
-| 围栏成功 | 显示唯一提交编号；只允许内部流程点击一次，不向用户暴露第二个提交按钮 |
-| 点击后明确创建 | 转待付款并显示订单证据 |
-| 点击后超时 / 外部支付 / 安全校验 | 转 `RECONCILIATION_REQUIRED`；显著提示可能已创建并预留额度 |
-| 重复打开或恢复 | 恢复同一提交编号和调和状态，不重新领取、不重新点击 |
-| 人工核查 | 可记录「已创建 / 未创建 / 仍不明确」及证据；系统本身不发起新的下单 |
+### IX-012 批量选择
+
+- 第一列为 checkbox；表头全选只覆盖当前筛选结果中可授权的 `DRAFT`。
+- 行单击只改变当前/焦点行，不等于勾选；双击行打开详情，不切换 checkbox。
+- 状态变化、翻页或筛选后失效的选择必须清除并告知，不能静默作用于不可见旧数据。
+- 不在每行增加“开始采购”操作列；批量操作统一位于表格上方上下文操作条。
+- 移动端表格允许水平滚动，不把关键金额和授权动作压成不可读卡片。
 
 ## 四、通用要求
 
-适用于所有 P0 交互：
-
-- **禁用按钮必须说明原因**，不留用户猜。
-- **失败必须给下一步**，不只报错。
-- **空状态是邀请，不是错误**。
-- 破坏性与不可逆动作必须二次确认，并说明影响范围。
-- 键盘可达、焦点可见、`prefers-reduced-motion` 生效。
-- 状态不能只靠颜色表达。
-- 金额一律显示两位小数并标注币种。
-- 双击只能作为效率快捷方式；任务编号链接和聚焦行后按 Enter 必须提供等价详情入口。
-- 表格行内的复选框、商品外链和任务编号链接不得误触发行双击；关闭详情抽屉后焦点回到原行。
-- 表格批量栏只在存在选择时出现；全选只覆盖当前筛选结果中允许当前动作的行。
+- 中文文案，状态名面向用户；技术 code 只出现在可复制详情中。
+- 所有输入有可见 label，错误与字段关联；必填不只靠星号。
+- 可交互元素有键盘可见焦点，目标尺寸至少 40–44 px；不依赖 hover 才能发现关键操作。
+- 加载、空态、失败、离线、禁用、成功、超时和结果不明均有明确表现。
+- 尊重 `prefers-reduced-motion`；状态变化不使用闪烁或大幅位移动画。
+- 高影响动作要说明范围与后果。开始采购已由持续可见的操作条和具体按钮文案完成确认，不再叠加
+  一个同义模态框；取消、人工付款事实等不同后果仍按各自流程确认。
+- 关闭抽屉、返回列表或查看历史记录必须恢复触发点焦点和筛选/滚动现场。
+- 内部截图有权限和不缓存标识；不把地址/手机号做成搜索字段，不展示完整 XML。
 
 ## 五、交付前检查
 
-- [ ] 每项 P0 交互回链至少一个 US 编号。
-- [ ] 涉及资金或不可逆动作的交互已填写完整状态表。
-- [ ] 所有禁用态都有说明文案。
-- [ ] 所有空状态都有可执行的下一步。
-- [ ] 未在本文自行定义接口路径、字段或状态码。
+- Web：375 / 768 / 1024 / 1440 px；键盘、焦点、表格横向滚动、抽屉返回均检查。
+- Desk：compact / medium / wide；浅色、深色、高对比近似；键盘和窗口关闭路径检查。
+- 单趟状态与 [architecture](04-architecture.md)、[api](api.md) 完全一致。
+- 页面没有 `WAITING_CONFIRMATION`、第二趟、锁定试选价或管理员中途确认。
+- “开始采购”处始终可见“只创建待付款订单 / 系统不付款”。
+- 围栏后没有重试、释放授权或重新开始入口。

docs/README.md

@@ -4,8 +4,8 @@
 
 cmbuyer 是一个自动化采购系统：**采购服务**（网页端，`admin/`）负责建单与人工决策，
 **采购工具**（Windows 桌面端，`client/`）驱动 Android 手机在拼多多完成选规格和下单，
-**付款始终由人完成**。第一版先跑通「手工建单 → 定时领取 → 第一趟试选 → 人工确认 →
-第二趟下单 → 待付款」闭环。
+**付款始终由人完成**。第一版先跑通“手工建单 → 管理员开始采购授权 → 定时领取 → 单趟规格/
+价格/数量校验 → 提交围栏与一次点击 → 待付款”闭环。
 
 ## 文档导航
 
@@ -17,7 +17,7 @@ cmbuyer 是一个自动化采购系统：**采购服务**（网页端，`admin/`
 - [需求](02-requirements.md)：功能清单、验收标准、风险点。
 - [用户故事清单](07-user-stories.md)：US 编号、用户目标与验收场景。
 - [技术栈](03-tech-stack.md)：两端选型、运行命令、**验证矩阵**。
-- [架构设计](04-architecture.md)：双端职责、**两趟执行**、**三道价格闸门**、安全边界、数据模型。
+- [架构设计](04-architecture.md)：双端职责、**单趟执行**、**三道价格闸门**、安全边界、数据模型。
 - [编码规则](05-coding-rules.md)：硬约束，第 1 节是本项目红线。
 - [任务路线图](06-tasks.md)：阶段划分、里程碑、建议拆分清单。
 - [任务文件](tasks/README.md)：一任务一文件约定与真机验收要求。
@@ -45,13 +45,13 @@ cmbuyer 是一个自动化采购系统：**采购服务**（网页端，`admin/`
 
 新接手时如果只看四个地方，看这四个：
 
-1. [`04-architecture.md`](04-architecture.md) **第三节两趟执行与三道价格闸门**——为什么
-   分两趟、价格为什么只在两个地方读。
+1. [`04-architecture.md`](04-architecture.md) **第三节单趟执行与三道价格闸门**——开始采购
+   如何授权、两次面板价与确认页金额如何实时保护上限。
 2. [`04-architecture.md`](04-architecture.md) **第四节安全边界与提交订单四条件**——每条
    都要有测试。
 3. [`05-coding-rules.md`](05-coding-rules.md) **第 1 节红线**——违反即拒绝。
 4. [`00-ai-start-here.md`](00-ai-start-here.md) **四条特有纪律**——先取证、只收紧、
-   只在两处读价、第一趟不下单。
+   只在两处读价、隔离验证能力不越界。
 
 ## 维护原则
 

docs/api.md

@@ -1,313 +1,354 @@
 # API 合约
 
-> 本文定义采购服务（`admin/`）对外的 HTTP 接口，以及采购工具（`client/`）本地模块的合约。
-> **这是双端之间的唯一权威。** 实现前可细化，但不得在代码里另起一套不兼容接口。
->
-> 本合约的设备心跳、任务领取、事件、证据、授权命令与 ack 结构参考了前序项目
-> `cmroubao`；同时在本项目重新审计并补回 dry-run、提交前服务端围栏和点击后调和。
-> 前序接口是设计依据，不是可直接照搬的运行事实。
+> 本文是采购服务与采购工具之间的唯一线协议权威。页面判据和本地类名不是线协议。
+> 接口形状参考前序项目的经验，但所有状态与安全语义在 cmbuyer 重新定义、测试和取证。
 
 ## 通用约定
 
-- 传输：JSON over HTTP。MVP 局域网内运行，生产部署应加 HTTPS。
-- 编码：UTF-8。
-- 时间：RFC 3339，带时区，UTC 存储。
-- 金额：**十进制字符串**（如 `"45.60"`），不用浮点数。
-- 幂等：所有创建类接口接受幂等键，重复提交返回同一结果而不是第二笔。
+- 生产前缀：`/api/v1`；管理页面路由见 [routes.md](routes.md)。
+- JSON 使用 UTF-8；时间为 UTC RFC 3339；ID 为 UUID 字符串。
+- 金额均为规范十进制字符串，如 `"12.88"`；禁止 JSON number 和浮点计算。
+- 所有写接口接受 `request_id` / 业务幂等键；同键同载荷重放同一结果，同键异载荷返回 `409`。
+- 任务写入携带 `expected_task_version`；版本冲突返回 `409 version_conflict`。
+- 服务端错误不得回显设备 token、完整节点树、地址、手机号或支付信息。
 
-### 鉴权
+### 身份
 
-| 客户端 | 方式 | 说明 |
+| 身份 | 凭据 | 能力 |
 | --- | --- | --- |
-| 管理 Web | Session Cookie + CSRF Token | 表单提交必须带 CSRF |
-| 采购工具 | `Authorization: Bearer <device_token>` | 凭据绑定设备标识，可单独撤销 |
-| ERP 对接 | `Authorization: Bearer <connector_token>` | 只能调用货运同步接口 |
+| 管理员 | `HttpOnly; SameSite=Lax` 会话 cookie + CSRF；HTTPS 部署设 `Secure=true` | 建单、开始采购、查看内部证据、人工调和 |
+| 设备 | `Authorization: Bearer <device-token>` + `X-CMBuyer-Device-ID` | 心跳、领取、事件、截图、围栏与结果 |
+| ERP（V2） | 独立凭据 | 只读来源同步，不访问采购结果 |
 
-三种身份互不通用。设备凭据**不能**创建任务或签发授权；管理会话**不能**调用设备接口。
+设备凭据不能建单或开始采购；管理会话不能调用设备接口。凭据缺失或无效返回 `401`，已认证但无权
+或管理写请求缺少有效 CSRF 返回 `403`；认证存储故障按下述规则返回 `503`。
+
+设备请求的认证头采用以下固定格式：
+
+- `Authorization` 和 `X-CMBuyer-Device-ID` 必须各出现且只出现一次；代理合并出的逗号列表也拒绝。
+- Authorization scheme 按 HTTP 规则大小写不敏感，但 scheme 后只允许一个 ASCII 空格；token 必须是
+  加密随机生成的 32 字节值对应的 64 位小写十六进制文本。
+- 设备 id 必须是规范小写 UUIDv4。token 与设备 id 同时绑定，未知、错配、格式错误和已撤销均返回
+  空 `401`，可带 `WWW-Authenticate: Bearer`，不区分具体原因。
+- 认证器逐请求读取 SQLite，不缓存 ACTIVE 结论。SQLite 查询或连接故障返回空 `503`；401 与 503
+  都必须发生在 Content-Type 解析和 body 读取之前。
+- 管理 cookie 不替代设备凭据；Bearer 也不替代管理 session/CSRF。两类凭据同时出现时，各路由仍只
+  采用自己的身份域，不把权限相加。
+
+设备 token 由本机管理 CLI 签发，只在签发事务提交后向操作者显示一次；SQLite 仅保存 token 原始
+32 字节的 SHA-256（32 字节 BLOB），list/revoke、日志、错误和 HTTP 响应均不显示 token 或 hash。
+撤销幂等且不会恢复旧 token。MVP 服务只绑定 IPv4 回环 `127.0.0.1:8080`，设备 Bearer 只经过本机回环 HTTP；
+未来非回环访问必须先建立 HTTPS/TLS 终止与代理信任边界。
 
 ### 错误响应
 
 ```json
 {
   "error": {
-    "code": "invalid_argument",
-    "message": "数量必须是正整数",
-    "field": "quantity"
+    "code": "version_conflict",
+    "message": "任务已变化，请刷新后重选",
+    "retryable": false,
+    "request_id": "018f..."
   }
 }
 ```
 
-错误码枚举：`invalid_argument`、`unauthenticated`、`permission_denied`、`not_found`、
-`conflict`、`failed_precondition`、`internal`。
-
-- 未登录访问受保护资源：`401`，管理页面重定向到 `/login`。
-- 已登录但无权限：`403`。**不存在**与**无权限**必须使用不同内部原因，但响应体不得泄露
-  任务内容。
+`retryable=true` 只表示接口调用可以按同一幂等键重放，不表示可以重试任何真机点击。
 
 ## 一、管理端接口
 
-管理页面为服务端渲染，表单直接 POST 到下列路径，成功后 303 重定向。
-
-| 方法 | 路径 | 职责 |
+| 方法 | 路径 | 作用 |
 | --- | --- | --- |
-| `POST` | `/login` | 建立管理会话 |
-| `POST` | `/logout` | 销毁会话 |
-| `GET` | `/tasks` | 任务列表，支持 `q`、`status`、`days`、`cursor` |
-| `POST` | `/tasks` | 手工建单，初始状态为 `DRAFT`（F-001） |
-| `POST` | `/tasks/start-trials` | 批量把 `DRAFT` 原子转为 `PENDING`，开始第一趟试选（F-018） |
-| `GET` | `/tasks/{id}` | 任务详情 |
-| `POST` | `/tasks/{id}/cancel` | 取消任务 |
-| `POST` | `/tasks/{id}/order-authorizations` | 确认试选结果并签发授权（F-008） |
-| `POST` | `/tasks/{id}/order-authorizations/{aid}/abandon` | 围栏前放弃授权，任务转待重新试选（F-010） |
-| `POST` | `/tasks/{id}/reject` | 退回不买，任务终止 |
-| `POST` | `/tasks/{id}/mark-paid` | 人工核对付款后标记完成（MVP 简化收口） |
+| `GET/POST` | `/login` | 登录页 / 建立管理员会话 |
+| `POST` | `/logout` | 退出并使会话失效 |
+| `GET` | `/tasks` | SSR 任务表格；关键词、状态、时间筛选 |
+| `POST` | `/tasks` | 手工创建 `DRAFT` |
+| `POST` | `/tasks/start-purchases` | 批量开始采购：创建一次性授权并原子转 `PENDING` |
+| `GET` | `/tasks/{id}` | 任务完整页；同一 URL 也可由列表详情抽屉加载 |
+| `POST` | `/tasks/{id}/reset-to-draft` | 围栏前人工处理后关闭旧授权，回到 `DRAFT` |
+| `POST` | `/tasks/{id}/cancel` | 围栏前取消任务 |
+| `POST` | `/order-submissions/{sid}/reconcile` | 围栏后人工调和同一提交 |
+| `POST` | `/tasks/{id}/mark-paid` | 人工确认已付款并完成核对 |
+| `GET` | `/evidence/{asset_id}` | 登录后读取内部截图；`Cache-Control: no-store` |
 
-> Excel 导入（`/tasks/import`）与 ERP 货运（`/freight*`）已移出 MVP，见
-> [需求](02-requirements.md)第三节后续迭代表。
+`GET /tasks/{id}` 的完整页与列表抽屉共享同一服务端数据模型和详情模板。列表只可用同源请求携带
+`X-CMBuyer-View: drawer` 获取 HTML fragment；其他非空 view、跨站 fragment 请求或不接受
+`text/html` 的 fragment 请求均拒绝。直接导航同一 URL 始终返回完整页。
 
-### `POST /tasks/start-trials`
+`GET /evidence/{asset_id}` 不经静态目录：未登录先返回 `401`，不查询和泄露资产是否存在；登录后
+缺失或畸形 id 返回空 `404`。成功只返回存储的 PNG，包含 `Content-Length`、固定安全文件名、
+`Cache-Control: no-store` 与 `X-Content-Type-Options: nosniff`，不返回原文件名或服务端路径。
 
-管理页面以带 CSRF 的表单提交结构化任务版本列表：
+### `POST /tasks`
+
+核心字段：
 
 ```json
 {
-  "start_key": "<幂等键>",
+  "create_key": "018f...",
+  "title": "纯棉短袖",
+  "product_url": "https://mobile.yangkeduo.com/goods.html?goods_id=937122477375",
+  "sku_color": "黑色CHA(纯棉)",
+  "sku_size": "M(建议100-115)",
+  "quantity": 2,
+  "max_total_price": "30.00"
+}
+```
+
+- 服务端解析并保存 canonical URL 与 `goods_id`；URL 非拼多多商品页、`goods_id` 缺失或含歧义则拒绝。
+- `max_total_price` 是本任务允许创建待付款订单的总额上限，不是参考单价。
+- 成功只产生 `DRAFT`；不得创建授权、开放设备领取或触发真机。
+
+### `POST /tasks/start-purchases`
+
+```json
+{
+  "start_key": "018f...",
   "tasks": [
-    { "id": "018f...", "expected_task_version": 1 },
-    { "id": "0190...", "expected_task_version": 3 }
+    {"task_id": "018f-task-1", "expected_task_version": 1},
+    {"task_id": "018f-task-2", "expected_task_version": 1}
   ]
 }
 ```
 
-- 只接受当前状态为 `DRAFT` 的任务；该动作含义是允许采购工具领取第一趟试选，**不签发下单
-  授权、不建立提交围栏、不创建订单、不付款**。
-- 服务端在一个事务内校验全部任务存在、属于当前管理范围、状态仍为 `DRAFT` 且版本匹配，
-  然后统一转 `PENDING` 并递增版本。任一项失败返回 `409 conflict`，整批不产生部分成功。
-- `tasks` 为空或包含重复 id 返回 `400 invalid_argument`；重复 `start_key` 返回第一次的结果，
-  不重复推进版本。
-- SSR 成功后 `303` 返回原任务列表查询地址；冲突时保留筛选条件，刷新表格并要求重新选择。
+管理员按钮必须显示为“开始采购（只创建待付款订单）”。**点击本身就是授权**：允许采购工具按任务
+锁定字段创建一笔待付款订单；不再等待试选后人工确认，也不授权付款。
 
-### `POST /tasks/{id}/order-authorizations`
+服务端在一个事务中：
+
+1. 校验列表非空、无重复任务，所有任务均为 `DRAFT` 且版本一致；
+2. 校验每条任务的 `goods_id`、规格、正整数数量和最高总价完整；
+3. 为每条任务创建一次性 `order_authorization`，锁定任务版本、上述字段、管理员、时间和有效期；
+4. 把所有任务转为 `PENDING` 并递增版本。
+
+任一条失败则整批不变。相同 `start_key` + 相同任务集合重放同一批结果；集合或版本不同返回 409。
 
 ```json
 {
-  "authorization_key": "<幂等键>",
-  "expected_task_version": 3,
-  "spec_trial_id": "018f...",
-  "note": ""
+  "start_key": "018f...",
+  "authorized_count": 2,
+  "tasks": [
+    {"task_id": "018f-task-1", "task_version": 2, "authorization_id": "018f-auth-1"},
+    {"task_id": "018f-task-2", "task_version": 2, "authorization_id": "018f-auth-2"}
+  ],
+  "payment_automated": false
 }
 ```
 
-- **授权内容不由客户端提交。** `goods_id`、规格、数量、`authorized_unit_price` 全部由
-  服务端从 `spec_trial_id` 指向的试选记录取值——人确认的是那一次试选，不是一组自由填写
-  的参数。
-- `expected_task_version` 不匹配返回 `409 conflict`。
-- `total_price_cap` 由服务端按任务的价格上限计算，客户端无法提高。
-- 响应中返回 `expires_at`；围栏建立前超时后授权自动 `EXPIRED`，任务转
-  `PENDING_RETRIAL`，必须重新跑第一趟。
-- 已存在 `order_submission` 时，放弃或超时处理返回 `409 conflict`；该授权只能调和结果或
-  转人工核查，不能重新开放为可执行。
-- MVP 没有「选择理由 / 拒绝理由」——那是多候选择一时的留档需求。这里只有可选 `note`。
+### 围栏前重置与围栏后调和
 
-## 二、设备侧接口（采购工具调用）
+- `reset-to-draft` 必须同时校验任务版本、授权 id 与“尚无 `order_submission`”。关闭旧授权后回到
+  `DRAFT`；重新开始必须产生新版本与新授权。
+- 一旦存在 `order_submission`，重置、取消、授权过期和重新开始都返回 `409 submission_fenced`。
+- `reconcile` 只能处理指定 `sid`：人工记录“已创建待付款订单”或“确认未创建/无法完成”。它不能
+  触发设备点击、释放围栏或签发新授权。
 
-全部要求有效设备 Bearer；凭据中的设备标识是权威身份，请求体里的设备字段仅作核对。
+## 二、设备侧接口
 
-| 方法 | 路径 | 职责 |
+| 方法 | 路径 | 作用 |
 | --- | --- | --- |
-| `POST` | `/api/v1/devices/heartbeat` | 上报版本与就绪位，核对服务端活跃任务 |
-| `POST` | `/api/v1/tasks/claim-next` | 原子领取或重放；**同时覆盖待试选与已授权两类** |
-| `POST` | `/api/v1/tasks/{id}/start` | `CLAIMED → RUNNING`，创建 execution |
-| `POST` | `/api/v1/tasks/{id}/heartbeat` | 更新当前步骤与运行租约 |
-| `POST` | `/api/v1/tasks/{id}/release` | 未开始时退回 `PENDING` |
-| `POST` | `/api/v1/tasks/{id}/events` | 幂等补报执行事件 |
-| `POST` | `/api/v1/tasks/{id}/evidence` | 上传证据资产，SHA-256 寻址 |
-| `POST` | `/api/v1/tasks/{id}/spec-trial` | **第一趟**：回传试选结果，任务转 `WAITING_CONFIRMATION` |
-| `POST` | `/api/v1/tasks/{id}/commands/next` | **第二趟**：拉取或重放已签发的下单授权 |
-| `POST` | `/api/v1/tasks/{id}/commands/{cid}/ack` | 落盘后幂等确认命令 |
-| `POST` | `/api/v1/tasks/{id}/order-dry-runs/start` | 开始只读演练；绝不消费授权、绝不允许提交 |
-| `POST` | `/api/v1/order-dry-runs/{rid}/ready` | 回传确认页只读结果与证据，结束演练 |
-| `POST` | `/api/v1/tasks/{id}/order-submissions/start` | **真实点击前**原子建立唯一提交围栏 |
-| `POST` | `/api/v1/order-submissions/{sid}/reconcile` | 点击后上报明确或不明确结果，只调和不重试 |
-| `POST` | `/api/v1/order-submissions/{sid}/manual-review` | 将围栏后的不确定结果交给人工核查 |
-| `POST` | `/api/v1/tasks/{id}/needs-manual` | 转人工，带原因码与证据 |
-| `POST` | `/api/v1/tasks/{id}/fail` | 提交结构化失败与证据 |
+| `POST` | `/api/v1/devices/heartbeat` | 上报设备、ADB、App 版本和能力状态 |
+| `POST` | `/api/v1/tasks/claim-next` | 原子领取一个 `PENDING` 授权任务或重放本设备未结束领取 |
+| `POST` | `/api/v1/tasks/{id}/lease/renew` | 续租；只允许当前 claim |
+| `POST` | `/api/v1/tasks/{id}/events` | 批量追加结构化步骤事件 |
+| `POST` | `/api/v1/tasks/{id}/evidence` | 显式上传一个内部原始截图 |
+| `POST` | `/api/v1/purchase-attempts/{aid}/fail` | 围栏前停止并回传失败摘要 |
+| `POST` | `/api/v1/purchase-attempts/{aid}/submission-fence` | 提交当前三闸门摘要并原子申请唯一围栏 |
+| `POST` | `/api/v1/order-submissions/{sid}/result` | 点击后一次性上报观察结果；只调和不重试 |
 
-> `/candidates`（多候选回传）、`/reference-image`（图搜参考图）、`/order-record`
-> （订单自动核对）随 B 路径与 F-016 一并推迟到 V2。
+### `POST /api/v1/devices/heartbeat`
+
+```json
+{
+  "device_id": "desk-01",
+  "client_version": "0.1.0",
+  "adb_serial": "192.168.0.173:5555",
+  "android_release": "16",
+  "pdd_version": "8.17.0",
+  "state": "READY"
+}
+```
+
+服务端可返回 `app_version_allowed=false`；采购工具必须停止领取，不能只显示警告后继续。
 
 ### `POST /api/v1/tasks/claim-next`
 
-```json
-{ "device_id": "desk-01", "claim_key": "<幂等键>" }
-```
-
-成功：
+请求携带 `device_id`、`session_id`、`claim_request_id`。领取与授权绑定且具租约：
 
 ```json
 {
   "task": {
-    "id": "018f...",
-    "leg": "TRIAL",
-    "goods_id": "7531364299",
-    "product_url": "https://mobile.yangkeduo.com/goods.html?goods_id=7531364299",
-    "sku_color": "白色",
-    "sku_size": "XL",
+    "id": "018f-task",
+    "version": 3,
+    "title": "纯棉短袖",
+    "product_url": "https://mobile.yangkeduo.com/goods.html?goods_id=937122477375",
+    "goods_id": "937122477375",
+    "sku_color": "黑色CHA(纯棉)",
+    "sku_size": "M(建议100-115)",
     "quantity": 2,
-    "max_total_price": "80.00"
+    "max_total_price": "30.00"
   },
-  "claim_token": "...",
-  "claim_generation": 1,
-  "lease_expires_at": "2026-08-03T10:30:00Z"
+  "authorization": {
+    "id": "018f-auth",
+    "task_version": 2,
+    "expires_at": "2026-08-04T10:00:00Z"
+  },
+  "attempt": {
+    "id": "018f-attempt",
+    "claim_token": "opaque-single-claim-token",
+    "claim_generation": 1,
+    "lease_expires_at": "2026-08-04T09:05:00Z"
+  }
 }
 ```
 
-- **`leg` 决定这一趟做什么**：`"TRIAL"` = 第一趟试选，`"ORDER"` = 第二趟下单。
-  `leg` 为 `"ORDER"` 时只返回 `authorization_id`；完整、不可变的授权命令必须通过
-  `/commands/next` 拉取并落盘，再调用 `/commands/{cid}/ack`。领取接口不重复定义授权载荷。
-- 无可领任务返回 `200` 且 `task` 为 `null`，**不是 404**。
-- 后续所有该任务的调用必须携带 `X-Claim-Token` 与匹配的 `claim_generation`。
+- 只返回有 `ACTIVE` 授权的 `PENDING`；服务端在一个事务中转为 `CLAIMED` 并创建 attempt。
+- 同一 `claim_request_id` 同载荷重放同一结果；并发设备只有一个成功。
+- 一个设备有未结束领取时优先重放该领取，不能悄悄领第二条。
+- 响应不得包含自由动作脚本、CSS/XPath、通用坐标或支付能力。
 
-### `POST /api/v1/tasks/{id}/spec-trial`（第一趟回传）
+### 事件与证据
+
+事件只包含固定 `step` / `outcome` / `reason_code` 和非敏感摘要。禁止把完整 XML、地址、手机号、
+页面全文或 token 塞进日志字段。
+
+截图接口使用 `multipart/form-data`，只接受单个显式文件及以下元数据：
 
 ```json
 {
-  "attempt": 1,
-  "product_title": "2026夏季新款纯棉圆领短袖T恤男女同款宽松半袖",
-  "selected_color": "白色",
-  "selected_size": "XL",
-  "unit_price": "32.50",
-  "total_price": "65.00",
-  "evidence_sha256": "…"
+  "upload_key": "43c9f507-7473-4fa6-8d71-8786c34c6301",
+  "attempt_id": "33c9f507-7473-4fa6-8d71-8786c34c6301",
+  "kind": "SKU_PANEL_GATE_1",
+  "privacy_tier": "INTERNAL_RAW",
+  "sha256": "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
+  "captured_at": "2026-08-04T09:01:00Z"
 }
 ```
 
-- `selected_color` / `selected_size` 是**实际勾选到的值**，不是任务要求的值。
-  服务端据此与任务要求比对并在确认页显示 ✓ / ✗。
-- `unit_price` 来自闸门一（规格面板）。**读不到时不要发这个接口**，改发
-  `/needs-manual` 并带原因码 `UNIT_PRICE_UNREADABLE`。
-- `total_price` = `unit_price` × 任务数量，服务端会重算校验。
-- 证据须先经 `/evidence` 上传。
-- 服务端接收后创建 `spec_trials` 记录，任务转 `WAITING_CONFIRMATION`。
+- 允许规格面板和确认页截图保留页面已显示的地址/手机号；不要求遮罩或裁剪。
+- 不接受 XML、目录、manifest、本机绝对路径、外部支付页截图或支付凭据。
+- T-204 只开放 `kind=SKU_PANEL_GATE_1`；后续 kind 必须由对应真机证据任务收紧扩展。
+- `privacy_tier` 只能是 `INTERNAL_RAW`；时间必须是以 `Z` 结尾的 UTC RFC 3339。
+- URL 中的 task id、`upload_key` 与 `attempt_id` 都必须是规范的小写 UUIDv4；`sha256` 必须是
+  恰好 64 位小写十六进制字符。
+- 恰好一个带 `Content-Type: image/png` 的显式文件；除上述六个元数据字段外，未知或重复字段均拒绝。
+- 单文件最多 10 MiB、单边最多 8192 px、总像素最多 16,777,216；服务端校验 PNG 魔数、完整解码、
+  字节数、尺寸与调用方声明的 64 位小写 SHA-256。
+- `attempt_id` 必须由数据库复合外键证明属于 URL 中的 task。认证必须先于 Content-Type 解析和请求体读取。
+- 同一设备主体和 `upload_key` 的同载荷重放返回原资产；任务、attempt、截图或元数据变化返回 `409`。
+- 首次成功返回 `201`，幂等重放返回 `200`。响应只含资产 id、关联 id、kind/tier、hash、字节数、
+  MIME、宽高和采集时间，不含设备 token、原文件名或存储路径。
+- 生产上传使用逐请求 SQLite 设备认证；空凭据库、未知或已撤销设备均拒绝。不得使用管理员 session、
+  临时共享密钥或其他身份代替设备凭据。
 
-### dry-run 与真实提交协议
+### `POST /api/v1/purchase-attempts/{aid}/submission-fence`
 
-`POST /api/v1/tasks/{id}/order-dry-runs/start` 创建或重放一次演练记录。采购工具随后只允许
-进入订单确认页、读取非敏感摘要和验证提交控件唯一，不允许点击。完成后调用
-`POST /api/v1/order-dry-runs/{rid}/ready`：
+客户端只有在当前页面四条件中的后三项已经满足后才能调用：
 
 ```json
 {
-  "command_id": "…",
-  "verified_unit_price": "32.50",
+  "fence_key": "018f-fence-request",
+  "task_id": "018f-task",
+  "expected_task_version": 3,
+  "authorization_id": "018f-auth",
+  "claim_token": "opaque-single-claim-token",
+  "selected_color": "黑色CHA(纯棉)",
+  "selected_size": "M(建议100-115)",
+  "gate1_unit_price": "12.88",
+  "gate2_unit_price": "12.88",
   "quantity_read": 2,
-  "confirm_page_amount": "65.00",
-  "has_address": true,
-  "evidence_sha256": "…"
+  "confirm_page_amount": "25.76",
+  "submit_control_match_count": 1
 }
 ```
 
-- dry-run 只证明当次页面达到 `READY`，不冻结授权，也不能作为稍后真实点击时的页面事实。
-- `has_address` 只报布尔值，**不得回传地址原文或手机号**。
+服务端在一个事务中校验：任务/版本/claim/attempt 一致；授权有效未消费且字段等于任务快照；
+规格与授权相等；数量相等；两个单价相等；计算金额及确认页金额均不超过 `total_price_cap`；提交控件
+计数为一；此前不存在该授权或 attempt 的 submission。随后创建唯一 `order_submission`，授权转
+`FENCED`，任务保持不可重领。
 
-真实第二趟重新通过三道闸门后，采购工具在点击前调用
-`POST /api/v1/tasks/{id}/order-submissions/start`：
+首次明确成功响应：
 
 ```json
 {
-  "submission_key": "<幂等键>",
-  "command_id": "…",
-  "dry_run_id": "…",
-  "expected_task_version": 5,
-  "verified_unit_price": "32.50",
-  "quantity_read": 2,
-  "confirm_page_amount": "65.00"
+  "submission_id": "018f-submission",
+  "status": "FENCED",
+  "click_permitted": true,
+  "submit_text": "提交订单"
 }
 ```
 
-- 服务端在一个事务中校验命令、任务版本、授权未消费、闸门值与唯一性，创建或重放唯一
-  `order_submission` 并把授权置为 `FENCED`。同一授权或命令不得产生第二条提交记录。
-- 只有明确收到 `201/200` 且响应中的 `click_permitted: true`，采购工具才允许点击一次。
-  超时、网络错误、冲突或响应无法解析时**不得点击**，转人工查询该幂等键。
-- `dry_run_id` 只证明曾完成安全演练；服务端仍以本次真实提交请求携带的闸门读数复核。
+- 任一校验失败返回错误，绝不返回 `click_permitted=true`。
+- 同一 `fence_key` 的重放返回同一 `submission_id`，但 `click_permitted=false` 且
+  `reconciliation_required=true`；客户端不能凭重放响应点击。
+- 客户端收到首次许可后，必须先把“围栏已取得/即将发出唯一点击”持久化，再执行点击。进程崩溃或
+  本地状态不明时宁可转调和，也不再次点击。
 
-点击后调用 `POST /api/v1/order-submissions/{sid}/reconcile`：
+### `POST /api/v1/order-submissions/{sid}/result`
 
 ```json
 {
-  "outcome": "SUBMITTED",
-  "evidence_sha256": "…"
+  "result_key": "018f-result",
+  "attempt_id": "018f-attempt",
+  "observation": "SUBMITTED",
+  "evidence_asset_id": "018f-asset"
 }
 ```
 
-- `outcome` 枚举：`SUBMITTED`（明确看到订单结果）、`UNCERTAIN`（超时或无法判断）、
-  `HANDED_OFF`（外部支付）、`SECURITY_CHECK`。
-- `SUBMITTED` 转 `WAITING_PAYMENT`；其余一律转 `RECONCILIATION_REQUIRED`，授权保持已围栏并
-  预留金额额度。重复调用只重放同一调和结果。
-- 任一结果都**禁止再次点击、释放围栏或重新签发授权**。无法自动调和时调用
-  `/manual-review` 记录人工核查请求与证据。
+`observation` 只允许：
 
-### 文本字段校验
+- `SUBMITTED`：明确订单已创建，转 `WAITING_PAYMENT`；
+- `EXTERNAL_PAYMENT_HANDOFF`：已跳外部支付，停止并转 `RECONCILIATION_REQUIRED`；
+- `SECURITY_CHALLENGE`：出现安全校验，停止并转调和；
+- `UNKNOWN`：超时、断连或页面不明，转调和。
 
-所有自由文本字段（事件消息、失败原因、备注）：
+提交后没有“retry”观察值。任何结果都不能释放围栏或开放第二次点击。
 
-- UTF-8，有长度上限（事件消息 1000 字节，备注 500 字节）。
-- 拒绝含 `authorization:`、`api_key`、`bearer ` 的内容，防止凭据误入审计日志。
-- **超长必须由客户端截断后再发，服务端拒绝而不是静默截断。**
+### 文本和金额校验
+
+- 规格字段：Unicode 规范化后精确相等；不得包含、前缀、编辑距离或 AI 猜测。
+- `goods_id`：仅 ASCII 十进制数字，canonical URL 中唯一。
+- 金额：`0.01` 到系统配置上限，至多两位小数；规范化后再比较和持久化。
+- 数量：正整数，服务端与设备均设置合理上限；不能从字符串静默截断。
 
 ## 三、采购工具本地模块合约
 
 ### `TaskSource` / `ResultSink`
 
-执行器只依赖抽象，不认识来源：
-
 ```python
-class TaskSource(ABC):
-    @abstractmethod
-    def load_tasks(self) -> list[OrderTask]: ...
+class TaskSource(Protocol):
+    def claim_next(self, session: Session) -> ClaimedPurchase | None: ...
+    def renew_lease(self, claim: Claim) -> Lease: ...
 
-class ResultSink(ABC):
-    @abstractmethod
-    def save_task_result(self, task: OrderTask) -> None: ...
+class ResultSink(Protocol):
+    def append_events(self, claim: Claim, events: list[TaskEvent]) -> None: ...
+    def upload_screenshot(self, claim: Claim, asset: ScreenshotAsset) -> AssetRef: ...
+    def fail_attempt(self, claim: Claim, failure: AttemptFailure) -> None: ...
+    def create_submission_fence(self, claim: Claim, proof: SubmissionProof) -> SubmissionPermit: ...
+    def report_submission_result(self, permit: SubmissionPermit, result: SubmissionResult) -> None: ...
 ```
 
-实现：
+执行器不能依赖具体 HTTP 或 Excel 实现。`SubmissionPermit` 只能由 `ResultSink` 的服务端成功响应构造，
+业务代码不能手工 new 一个许可。
 
-| 实现 | 用途 |
-| --- | --- |
-| `HttpTaskSource` | 从采购服务领取任务（默认） |
-| `HttpResultSink` | 回传结果到采购服务（默认） |
-| `FixtureTaskSource` | 仅测试 / 演示：读取仓库内假数据，不接触真实订单 |
-| `JsonlResultSink` | 仅测试 / 断连暂存：本地追加写入，恢复连接后按幂等键补传 |
+### 真机能力分层
 
-### 真机流程模块
-
-`client/src/android/pdd_flow.py` 的公开入口，每个都不得越界：
-
-| 函数 | 输入 | 输出 | 副作用边界 |
+| 能力 | 输入 | 输出 | 安全边界 |
 | --- | --- | --- | --- |
-| `open_product(url)` | 商品 URL | 页面快照路径 | 只打开页面，不点击购买 |
-| `open_sku_panel()` | - | 面板快照 | 只点规格入口，不提交 |
-| `select_sku_options(items)` | `{维度: 值}` | 选中证据 | 按维度精确匹配，找不到抛错 |
-| `set_quantity(n)` | 数量 | 读回值 | 必须复核等于 n |
-| `read_sku_unit_price(xml)` | 规格面板 XML | 单价或 `None` | **闸门一**；读不到返回 `None`，不猜 |
-| `leave_product()` | - | - | 第一趟结束时退出并释放手机 |
-| `go_to_order_confirm()` | - | 确认页摘要 | **可能创建订单**，需显式授权 |
-| `read_order_confirm_info(xml)` | 页面 XML | 非敏感摘要 | **闸门三**；不提取地址原文、手机号 |
-| `submit_order(auth, submission)` | 授权 + 已建立的提交围栏 | 提交结果 | **唯一创建真实订单入口**，四条件与围栏全通过后只点一次 |
+| `open_product()` | canonical URL + 证据版本 | 已确认商品页 | URL、前台包、App 版本全部匹配 |
+| `open_sku_panel()` | 版本绑定受控入口 | 已确认规格面板 | 精确唯一；无通用 click |
+| `select_sku_options()` | 维度 → 精确值 | 选中态摘要 | 维度内唯一匹配并读回 |
+| `read_sku_unit_price()` | 已确认规格面板 | 十进制单价 | 排除原价、按钮价和歧义候选 |
+| `set_quantity_and_readback()` | 授权数量 | 实际数量 | 精确读回，否则停 |
+| `go_to_order_confirm()` | 已通过闸门二 | 确认页摘要 | 后续真机任务取证后才实现 |
+| `submit_order_once()` | 不可伪造的首次 `SubmissionPermit` | 观察结果 | 许可、闸门、唯一控件全校验；点前持久化；绝不重试 |
 
-两个不可逆入口：
+T-103 只实现隔离的 `SkuSelectionFlow`：前四项加安全退出。它的模块和静态依赖不得引用数量、确认页、
+围栏、提交或支付能力。后续任务按取证顺序组合成生产 `SinglePassPurchaseFlow`。
 
-- `go_to_order_confirm()` 必须校验授权存在；`submit_order()` 还必须校验授权已由服务端围栏
-  且 `submission` 与当前任务、命令、授权完全一致。
-- **第一趟的代码路径不得引用这两个函数。** 必须有测试证明试选流程不可达它们。
-- `search_by_image()` 属 B 路径，V2 再实现。
+## 四、实现前仍需定值
 
-## 四、待实现时确认
-
-- **规格面板上单价的节点位置与文本形态**（阻塞闸门一，由 T-103 真机取证确定）。
-- 授权 `expires_at` 的默认时长。
-- 定时轮询的默认间隔与连续失败停止阈值。
-- 分页游标的编码方式。
-- 设备凭据的有效期与轮换策略。
-- 证据资产的保留期与清理策略。
+- 授权有效期、领取租约时长、心跳/轮询间隔和连续失败停止阈值；
+- 内部截图保留期限；截图大小上限已固定为 10 MiB / 8192 px 单边 / 16,777,216 像素；
+- 可配置单任务数量与最高总价系统上限；
+- 首次真实提交真机任务的人工授权和待付款订单处置步骤。

docs/current-state.md

@@ -11,35 +11,48 @@
 
 ## 当前快照
 
-- 日期：2026-08-03
-- 阶段：**Phase 0 · 地基（两端骨架、核心数据模型与统一入口已完成，尚无真机采购业务代码）**
-- MVP 形态：手工填链接建单 → 批量开始试选 → 定时轮询 → **第一趟试选** → 人工确认 → **第二趟下单** → 待付款
+- 日期：2026-08-04
+- 阶段：**Phase 1 · T-103 规格选择/读价与 Phase 2 安全服务端任务并行**
+- MVP 形态：手工填链接建单 → 批量“开始采购”并签发一次性授权 → 定时领取 → 同一趟精确
+  选规格 / 三道价格闸门 / 提交围栏 / 点击一次 → 待付款。管理员点击“开始采购”即授权桌面端
+  创建待付款订单；不再有试选后确认，系统绝不自动付款。
 - 技术栈：已定。采购服务（`admin/`）使用 Go 1.23+ / gin / SQLite；采购工具（`client/`）
   使用 Python 3.11+ / uiautomator2 / PySide6。
   详见 [`03-tech-stack.md`](03-tech-stack.md)
 - 生产代码：`admin/` 已有最小 Go 服务、健康检查、核心领域模型、SQLite 迁移与任务状态机；
-  `client/` 已有 Python 包、PySide6 最小入口、运行目录与日志脱敏策略；尚无真机采购流程
-- 测试：采购服务已覆盖健康检查、核心模型、迁移与状态机等离线包级测试；采购工具 6 项离线单元测试
-  （不连接真机）
-- 数据：SQLite 核心表与迁移已落成；无业务实例数据
+  `client/` 已有 Python 包、PySide6 最小入口、运行目录与日志脱敏策略，以及显式 serial 的 ADB
+  连接边界、本地基线取证 CLI、受限商品链接打开取证 CLI、人工声明规格面板状态的只读取证 CLI，
+  以及绑定 PKG110 / Android 16 / 拼多多 8.17.0 的规格证据确定性脱敏 CLI；尚无规格选择、价格读取或下单流程
+- 测试：采购服务已覆盖健康检查、核心模型、迁移与状态机等离线包级测试；采购工具 80 项离线单元测试
+  （全部 mock，不连接真机）
+- 数据：SQLite v2 单趟核心表与领域状态机已落成，旧 `spec_trials`、`authorized_unit_price` 和
+  两趟状态已由受保护迁移移除；无业务实例数据。T-203 可以基于新模型实现批量“开始采购”与
+  一次性授权事务。
 - 标准启动路径：Windows PowerShell 运行 `./init.ps1`，Unix shell 运行 `./init.sh`。Windows 入口
   优先使用合规的既有 venv；仅在其缺失时才从 Python Launcher 已安装版本中选择最高的 Python 3.11+，
   并且不覆盖低版本环境；成功后打印真实启动命令。
 - 标准验证路径：`./init.ps1` 已实际跑通 admin 的 mod download / test / vet / build、client 的
   editable install / 包导入 / unittest / compileall，以及仓库上下文校验。可单独运行两端命令诊断。
-- 当前 blocker：无外部 blocker。T-002、T-003、T-004 已完成；T-101 真机环境盘点已就绪，
-  但尚未真机验收。桌面 GUI 与真机流程尚未验收。
+- 当前设备门禁：人工已确认拼多多 8.17.0、goods_id `937122477375` 的衣服商品只能通过“快要抢光”
+  打开规格面板；T-110 已获项目所有者批准，只把该证据/版本绑定的精确唯一入口作为受控导航。
+  T-103 的隔离 capability 仍不得包含数量、确认页、提交订单、付款或通用点击；这些动作由后续任务
+  分别取证后才接入生产单趟流程。T-103 的 v5 派生 XML 已由人确认无实际地址/
+  手机号，并保留目标预选规格、顶部当前价“快卖完 ¥12.88”和原价“¥29.88”；底部“提交订单 ¥12.88”
+  继续属于硬拒绝区。派生截图虽然把顶部价格遮住一半，但项目已停止遮罩器开发，视觉完整性不再阻塞
+  规格选择与读价；T-204 将直接上传内部原始截图供管理员查看。T-010 已允许不依赖真机字段的 T-201
+  和只创建 `DRAFT` 的 T-202 并行。T-209 已完成 schema / 状态机单趟迁移；T-203 服务端
+  “开始采购”授权事务可立即推进。T-205 起实际 attempt / 真机字段继续等待 T-103。
 
 ## 当前目录要点
 
 | 路径 | 状态 | 说明 |
 | --- | --- | --- |
 | `docs/` | 已有 | 项目规范化文档，本次已完整生成 |
-| `docs/tasks/` | 已有（T-001～T-004、T-005～T-009、T-101） | T-001～T-004 已完成；T-101 已就绪、待真机验收 |
+| `docs/tasks/` | 已有（含 T-001～T-111、T-201～T-203、T-209） | T-111 单趟契约、T-202 手工 DRAFT 建单及 T-209 单趟 schema 已完成；T-103、T-203 并行推进 |
 | `docs/design/` | 已有（6 个原型） | web 登录 / 建单 / 工作台 / 详情，desk 采购执行 / 配置；均已人工确认 |
 | `scripts/` | 已有 | 上下文门禁、Vikunja 单向导出与 MCP 启动包装 |
 | `admin/` | 已初始化 | Go 1.23+ / gin / SQLite，含核心模型、迁移与状态机；无真机采购执行 |
-| `client/` | 已初始化 | Python 3.11+ 包、依赖源、PySide6 最小入口、离线测试与 wheel 元数据检查；无真机或采购流程 |
+| `client/` | 已初始化 | Python 3.11+ 包、依赖源、PySide6 最小入口、显式 serial 的基线/商品打开/规格面板只读取证、确定性证据脱敏、离线测试与 wheel 元数据检查；无规格选择、价格读取或下单流程 |
 | `init.ps1` / `init.sh` | 已完成 | 统一安装与离线验证入口；PowerShell 优先复用合规 venv，缺失时自动选择最高的 Python 3.11+，Unix 缺工具链明确失败 |
 
 ## 任务状态
@@ -50,9 +63,16 @@
   源码目录契约）、T-008（Vikunja 任务权威与单向导出）、T-009（MVP 关键路径与并行波次），
   以及 T-001（采购服务 Go 骨架）。
 - 已完成：T-002（采购工具 Python 骨架）、T-003（双端统一初始化与验证入口）、
-  T-004（核心数据模型）。T-101（真机环境盘点）已建档并就绪，尚未真机验收，接续推进
-  T-101 → T-102 → T-103。
-- T-103 是当前最高优先级和 MVP 生死线。通过前不开发依赖真机可读字段的 Phase 2 生产页面。
+  T-004（核心数据模型）、T-101（真机环境盘点与 USB/WiFi 双通道人工验收）、T-102（canonical
+  链接打开与目标商品/隐私人工验收）。
+- 已完成 T-010（安全并行门禁）、T-201（管理员登录与会话）与 T-202（手工 DRAFT 建单和
+  基础列表）。T-202 已通过主 agent 独立审查、竞态测试与完整门禁并合入主线，仍只创建/展示
+  `DRAFT`，未实现授权、设备领取或采购执行。
+- 已完成 T-110（受控规格入口边界）与 T-111（开始采购授权的单趟契约）。T-103 已恢复为
+  `DOING`，以 `SkuSelectionFlow` 继续最小 fixture、精确规格和读价，不实现数量、确认页或提交；
+  内部原始截图上传交给 T-204。admin 方向已完成 T-209，正在转入 T-203“开始采购”授权事务。
+- 已完成 T-209：SQLite v2 已迁移为单趟授权、采购尝试和提交围栏模型，并删除旧试选领域模型；
+  迁移和状态机护栏已通过完整门禁。下一项采购服务任务为 T-203 批量“开始采购”与一次性授权。
 - 已确认原型继续只作信息架构依据；原型假数据不调用真实接口、不驱动真机。真机结论改变
   可读字段时必须先回修原型与交互清单。
 
@@ -93,9 +113,55 @@ cd client
 ```
 
 `client/requirements.txt` 是唯一依赖来源，`client/pyproject.toml` 动态读取它生成 wheel 的
-`Requires-Dist`。Python 3.12 已验证 6 项离线测试、编译与 wheel 元数据；完整运行时依赖安装
+`Requires-Dist`。Python 3.12 与 3.14 均已验证离线测试、编译与 wheel 元数据；完整运行时依赖安装
 （`pip install -e .`）已通过。`init.ps1` 优先使用合规既有 venv，缺失时自动选择最高的 Python 3.11+；
-本机现有 venv 实际验证为 Python 3.12。桌面 GUI 与真机流程未作为 T-003 验收执行。
+本机 Python 3.12 与 3.14 均已验证，主工作区当前选择 Python 3.14。桌面 GUI 与真机流程未作为 T-003
+验收执行。
+
+T-101 的人工真机验收命令（先把手机切到不含收货地址、手机号、支付信息或其他无关隐私的安全页面；
+必须从 `adb devices -l` 手工复制在线 serial，不能留空或自动选择）：
+
+```powershell
+# 仓库根目录；USB 和 WiFi 分开执行，每次只保留一个通道在线
+D:\Portable\adb\adb.exe devices -l
+.\client\.venv\Scripts\python.exe client\scripts\capture_device_baseline.py --serial <USB_SERIAL> --output-dir "$env:LOCALAPPDATA\cmbuyer\artifacts\T-101\usb-baseline" --timeout 10 --adb D:\Portable\adb\adb.exe
+# WiFi 必须由人先建立通道、断开 USB 后再手工粘贴在线 WiFi serial；脚本不自动 connect/reconnect
+.\client\.venv\Scripts\python.exe client\scripts\capture_device_baseline.py --serial <WIFI_SERIAL> --output-dir "$env:LOCALAPPDATA\cmbuyer\artifacts\T-101\wifi-baseline" --timeout 10 --adb D:\Portable\adb\adb.exe
+```
+
+脚本只读取非敏感设备元数据、拼多多版本、截图和完整 XML；不会打开商品或写页面判据。它对同机双
+通道、身份读取失败、offline、unauthorized、超时或 serial 不存在均 fail closed。成功目录的
+`manifest.json` 只记录元数据、产物路径和 SHA-256，不记录 XML 页面正文或原始 serial。T-101 已由人
+完成两次验收并确认原始证据不含敏感信息；`--timeout` 约束 ADB 命令、ADB socket 以及截图/节点树的
+公开 JSON-RPC 调用，uiautomator2 初始化仍有上游固定启动上限。截图/XML 只保留在本地，执行记录只写
+路径和 SHA-256，原始证据不得提交 Git。
+
+T-102 的人工真机验收命令（只接受唯一 canonical 链接；USB 或 WiFi 每次只保留一个通道在线）：
+
+```powershell
+# 仓库根目录；从输出中手工复制本次在线 serial
+D:\Portable\adb\adb.exe devices -l
+.\client\.venv\Scripts\python.exe client\scripts\capture_product_open.py --serial <SERIAL> --url "https://mobile.yangkeduo.com/goods.html?goods_id=<GOODS_ID>" --output-dir "$env:LOCALAPPDATA\cmbuyer\artifacts\T-102\product-open-<GOODS_ID>" --timeout 10 --adb D:\Portable\adb\adb.exe
+```
+
+脚本只允许 Android `VIEW` intent，并把 package 固定为 `com.xunmeng.pinduoduo`；intent 后会在
+`--timeout` 的有限窗口内只读轮询前台 package，解决 App 异步切换造成的一次性误判，超时仍会停止。
+它不点击、滑动、输入或判断商品页节点，也不打开规格、读取价格、进入下单或支付。运行拼多多版本必须精确为
+`8.17.0`，否则在 intent 前停止。成功后由人本地查看截图/XML，确认页面确为该 `goods_id` 对应商品并
+检查无地址、手机号、支付信息或其他无关隐私；只回报 manifest 路径及截图/XML SHA-256，原始证据
+不得提交 Git。T-102 已由人确认 goods_id `958756616606` 的目标商品及截图/XML 隐私，并完成验收。
+
+T-103 已确认当前衣服商品只能从精确文案“快要抢光”进入规格面板；T-110 只批准该证据/版本绑定入口，
+不授权“免拼购买 / 单独购买 / 直接拼成”等其他文案。面板刚打开时目标颜色“黑色CHA(纯棉)”与尺码
+“M(建议100-115)”已经自动选中。v5 派生 XML 与人工观察已证明顶部当前价为“快卖完 ¥12.88”、
+并列原价为“¥29.88”；促销前缀会变化，正式读价不能把该文案作为主判据，必须以面板结构、价格角色、
+严格金额格式和唯一性组合判断，冲突时返回 unreadable。
+
+本轮不再运行或修改截图遮罩器。T-103 先用本机证据验证真机能力；T-204 再把原始规格页截图上传采购
+服务，允许页面中已显示的地址和手机号，完整 XML 不上传。代码从已确认的派生 XML 提取最小 fixture，
+并在真机运行时只返回获准摘要。T-111 完成后，下一步实现 `SkuSelectionFlow` 的受控入口、
+按维度精确选择、选中态读回、SKU 单价读取与安全退出；完成离线主审后，由人先把两个维度改成明确
+记录的非目标值，再执行真机脚本确认恢复目标规格与 `12.88` 单价。生产原始截图展示/上传由 T-204 处理。
 
 ## 关键背景
 
@@ -112,14 +178,14 @@ cd client
 ## 已知风险（开工前须知）
 
 1. **M2 是生死线**：真机能按链接打开商品、精确勾选颜色分类和尺码、**读到该 SKU 单价**
-   （T-103）。Phase 1 不通过之前不要写生产页面；Phase 0 原型只确认流程和信息架构，真机
-   结论改变字段时必须回修。
+   （T-103）。M2 前可以写不依赖页面字段的管理员会话、DRAFT 建单和服务端授权事务；不能写
+   依赖未取证选择器的生产执行代码。真机结论改变字段时先回修契约与原型。
 2. **拼多多页面结构随版本变化**，已观察到详情页无独立规格入口、价格节点被拆分等情况。
 3. **授权卡死**：前序项目出现过 `EXECUTING` 授权永不推进导致任务锁死。本项目在 T-207
    实现围栏前超时 / 放弃，在 T-208 实现围栏后调和；围栏后不得释放或重试。
-4. **规格面板单价位置未取证**：闸门一依赖它，T-103 必须一并取证。若读不可靠，
-   确认页设计要改。
-5. **MVP 已收窄**：只做手工填链接、批量开始第一趟试选和两趟执行。Excel、ERP、图搜、
+4. **规格面板读价尚未形成生产判据**：已人工观察当前价与原价，但 T-103 仍需把证据固化为
+   唯一、版本绑定且排除按钮价的读取规则；失败就转人工，不删价格闸门。
+5. **MVP 已收窄**：只做手工填链接、批量开始采购和单趟创建待付款订单。Excel、ERP、图搜、
    批量顺序编排 / 暂停接管、订单自动核对、AI 辅助全部推到 V2（见 `06-tasks.md` 的
    T-501~T-508）。
 6. **App 版本必须 fail closed**：运行时拼多多版本与本项目已取证版本不一致就停止领取，

docs/design/README.md

@@ -51,6 +51,8 @@
 - **开工门槛（一次性）**：P0 的 UI 模块首次实现前应有原型；没有就先生成原型、人工确认后再拆任务。
 - **两阶段确认**：Phase 0 先确认流程、状态、主动作和布局；T-103 真机取证后再核对实际可读
   字段与文案。第二阶段若有变化，先修订 IX 与原型，再写生产页面。
+- 管理员“开始采购”授权的单趟流程属于显著改版，T-111 重新生成任务创建、工作台、详情和桌面执行
+  四个原型；旧的试选后确认/第二趟状态不得继续作为实现输入。
 - **触发式重新生成**：新需求显著改变某页面的布局或控件集合时，把"重新生成该页原型 → 更新 IX 草稿"作为该任务的第一步。判断标准只有一条：这次变更是否让 agent 需要重新"看图"才能枚举交互。换文案、加字段等小改动只改 IX 条目，不碰原型。
 - **实现后即过期**：页面实现后，原型自动视为过期，不回头修补；实现后的视觉事实由任务文件 `## 执行记录` 中的真实截图或可运行验证承担。
 - 需要新原型时整页重新生成，不逐次修补旧文件。

docs/design/desk-execution.html

@@ -398,12 +398,12 @@
           <option value="version_mismatch">未就绪 · 拼多多版本失配</option>
           <option value="idle" selected>已就绪 · 尚未轮询</option>
           <option value="polling">轮询中 · 暂无任务</option>
-          <option value="trial">执行中 · 第一趟试选</option>
-          <option value="trial_done">第一趟完成 · 已释放手机</option>
-          <option value="dry_run">执行中 · 下单只读演练</option>
-          <option value="dry_run_ready">演练完成 · 等待真实第二趟</option>
-          <option value="order_prefence">真实第二趟 · 围栏前校验</option>
-          <option value="fencing">真实第二趟 · 申请围栏中</option>
+          <option value="claimed">单趟执行 · 已领取</option>
+          <option value="selecting">单趟执行 · 选择规格</option>
+          <option value="gate1">单趟执行 · 闸门一</option>
+          <option value="quantity_gate2">单趟执行 · 数量与闸门二</option>
+          <option value="confirm_gate3">单趟执行 · 确认页与闸门三</option>
+          <option value="fencing">单趟执行 · 申请围栏中</option>
           <option value="fence_failed">围栏失败或响应不明 · 不点击</option>
           <option value="fenced">围栏后 · 核对同一提交</option>
           <option value="waiting_payment">明确已创建 · 等人付款</option>
@@ -469,7 +469,7 @@
                   <div class="span-2"><dt>商品</dt><dd id="product">暂无商品；轮询会在安全就绪后领取一条任务</dd></div>
                   <div><dt>颜色分类</dt><dd id="color">—</dd></div>
                   <div><dt>尺码 / 数量</dt><dd id="size-qty">—</dd></div>
-                  <div><dt>授权单价</dt><dd id="auth-price">—</dd></div>
+                  <div><dt>闸门一单价</dt><dd id="gate1-price">—</dd></div>
                   <div><dt>金额上限</dt><dd id="price-cap">—</dd></div>
                   <div class="span-2"><dt>提交围栏</dt><dd id="submission">未建立</dd></div>
                 </dl>
@@ -583,41 +583,41 @@
       const task = {
         id: 'CB-20260803-0042',
         product: '纯棉圆领短袖 T 恤（原型假数据）',
-        color: '白色', sizeQty: 'XL / 2 件', authPrice: 'CNY 32.50', cap: 'CNY 80.00'
+        color: '白色', sizeQty: 'XL / 2 件', gate1Price: 'CNY 32.50', cap: 'CNY 80.00'
       };
       const records = [
         {
           id:'REC-DEMO-0042', taskId:'CB-20260803-0042', title:'纯棉圆领短袖 T 恤（原型假数据）', collectedAt:'2026-08-03T13:52:18+08:00',
           status:'RECONCILIATION_REQUIRED', spec:'白色 | XL | 2 件', cap:'CNY 80.00', submission:'SUB-DEMO-0042 · 结果不明确',
-          note:'围栏后网络中断，订单可能已创建。只允许核查同一提交记录，不能重试。', evidence:['商品页截图裁剪（内联假证据）','规格面板截图（内联假证据）'],
-          timeline:['13:51:04 重新选择同一规格','13:51:41 三道价格闸门通过（假数据）','13:51:58 围栏已建立','13:52:18 点击结果不明确，转人工核查'],
+          note:'围栏后网络中断，订单可能已创建。只允许核查同一提交记录，不能重试。', evidence:['商品页原始截图（内联假证据）','规格面板原始截图（内联假证据）'],
+          timeline:['13:51:04 同一趟精确选择规格','13:51:41 三道价格闸门通过（假数据）','13:51:58 围栏已建立','13:52:18 点击结果不明确，转人工核查'],
           result:'下单待核查：白色 | XL | CNY 32.50 | 2 件', resultNote:'订单可能已创建、支付未完成。系统不会再次提交，也不会付款。'
         },
         {
           id:'REC-DEMO-0041', taskId:'CB-20260803-0041', title:'办公室桌面收纳盒（原型假数据）', collectedAt:'2026-08-03T12:24:09+08:00',
-          status:'WAITING_CONFIRMATION', spec:'透明 | L | 2 件', cap:'CNY 60.00', submission:'未建立',
-          note:'第一趟试选完成，规格面板证据已回传，等待管理员确认。', evidence:['商品页截图裁剪（内联假证据）','规格面板截图（内联假证据）'],
-          timeline:['12:22:31 打开商品','12:23:04 匹配透明 / L','12:23:38 读取规格面板单价','12:24:09 截图并退出商品页'],
-          result:'试选：透明 | L | CNY 24.00 | 2 件', resultNote:'这只是试选结果，不代表已下单。'
+          status:'ORDERING', spec:'透明 | L | 2 件', cap:'CNY 60.00', submission:'未建立',
+          note:'管理员已开始采购，当前单趟已完成规格与闸门一，正在设置并复核数量。', evidence:['商品页截图（内联假证据）','规格面板原始截图（内联假证据）'],
+          timeline:['12:22:31 领取一次性授权','12:23:04 精确匹配透明 / L','12:23:38 闸门一读取 CNY 24.00','12:24:09 正在复核数量与闸门二'],
+          result:'执行中：透明 | L | CNY 24.00 | 2 件', resultNote:'无需等待管理员中途确认；任一门禁失败即停止。'
         },
         {
           id:'REC-DEMO-0038', taskId:'CB-20260803-0038', title:'标签打印纸补货（原型假数据）', collectedAt:'2026-08-03T10:06:42+08:00',
           status:'WAITING_PAYMENT', spec:'白色 | 50×30 | 1 件', cap:'CNY 50.00', submission:'SUB-DEMO-0038 · SUBMITTED',
-          note:'已明确创建待付款订单，自动化已停止，等待人核对后自行付款。', evidence:['订单确认页非敏感截图（内联假证据）'],
-          timeline:['10:04:22 重新选择同一规格','10:05:10 价格与数量复核通过','10:05:36 获得唯一围栏许可','10:06:42 明确创建待付款订单'],
+          note:'已明确创建待付款订单，自动化已停止，等待人核对后自行付款。', evidence:['订单确认页内部原始截图（内联假证据）'],
+          timeline:['10:04:22 同一趟精确选择规格','10:05:10 两次价格与数量复核通过','10:05:36 获得唯一围栏许可','10:06:42 明确创建待付款订单'],
           result:'已创建待付款订单：白色 | 50×30 | CNY 46.00 | 1 件', resultNote:'系统只创建待付款订单，付款始终由人完成。'
         },
         {
           id:'REC-DEMO-0032', taskId:'CB-20260803-0032', title:'仓库打包胶带（原型假数据）', collectedAt:'2026-08-03T09:18:05+08:00',
           status:'NEEDS_MANUAL', spec:'透明 | 45mm | 4 件', cap:'CNY 55.00', submission:'未建立',
-          note:'商品页面未取得可信图片，授权价与当前规格面板价格不一致，已转人工。', evidence:[],
+          note:'设置数量后规格面板价格与闸门一不一致，已在围栏前转人工。', evidence:[],
           timeline:['09:16:40 打开商品','09:17:22 匹配透明 / 45mm','09:18:05 价格闸门二不通过，停止自动流程'],
-          result:'未采购：授权价 CNY 12.00 | 当前价 CNY 13.50', resultNote:'没有创建订单，也没有付款。'
+          result:'未采购：闸门一 CNY 12.00 | 闸门二 CNY 13.50', resultNote:'没有建立围栏、创建订单或付款。'
         }
       ].sort((a, b) => b.collectedAt.localeCompare(a.collectedAt));
       const recordStatus = {
         RECONCILIATION_REQUIRED:{label:'结果待核查',tone:'critical'},
-        WAITING_CONFIRMATION:{label:'等待确认',tone:'caution'},
+        ORDERING:{label:'采购执行中',tone:'info'},
         WAITING_PAYMENT:{label:'待付款',tone:'success'},
         NEEDS_MANUAL:{label:'转人工',tone:'caution'}
       };
@@ -627,40 +627,38 @@
       let detailRequestId = 0;
       const baseSteps = {
         idle: [],
-        trial: ['打开商品（待真机判据）', '精确匹配颜色分类与尺码', '从规格面板读取单价', '截图并退出商品页'],
-        dry: ['重新打开商品（待真机判据）', '精确选择与数量复核', '读取订单确认页非敏感摘要', '验证提交控件唯一后退出'],
-        order: ['重新选择同一规格', '闸门二：单价必须等于授权价', '数量复核与闸门三', '申请服务端提交围栏', '围栏许可后内部仅点击一次', '调和同一提交结果']
+        single: ['核对一次性授权并打开商品', '精确选择颜色分类与尺码', '闸门一：读取 SKU 单价并校验上限', '设置数量、读回并执行闸门二', '确认页执行闸门三与控件唯一校验', '申请服务端提交围栏', '首次许可后持久化并内部点击一次', '调和同一提交结果']
       };
       const scenarios = {
         not_ready: { tone:'critical', title:'web 服务不可达', text:'未开始轮询。检查本地网络和服务地址；已完成的本地证据会保留待补传。', web:'bad', device:'ok', version:'ok', leg:'未就绪', legTone:'critical', action:'开始轮询', enabled:false, reason:'web 服务未就绪，不能领取任务。', session:'未启动', step:'连接检查', kind:'idle', active:-1, countdown:'—', fail:'1 / 3' },
         version_mismatch: { tone:'critical', title:'拼多多版本与证据不一致', text:'已 fail closed：停止领取真机任务。下一步是由人重新取证并记录 App 版本，不能沿用旧判据。', web:'ok', device:'ok', version:'bad', leg:'版本失配', legTone:'critical', action:'开始轮询', enabled:false, reason:'App 版本失配；必须先完成本项目真机取证。', session:'已停止', step:'等待重新取证', kind:'idle', active:-1, countdown:'—', fail:'0 / 3' },
         idle: { tone:'success', title:'设备已就绪（模拟）', text:'三项就绪条件在本场景中均为模拟通过，可以演示定时轮询；不会连接真实设备。', web:'ok', device:'ok', version:'ok', leg:'空闲', legTone:'success', action:'开始轮询', enabled:true, reason:'点击只切换原型状态，不发起网络请求。', session:'未启动', step:'等待开始', kind:'idle', active:-1, countdown:'—', fail:'0 / 3' },
         polling: { tone:'info', title:'正在轮询，暂无待领任务', text:'无任务是正常空状态，不计入失败；将按配置间隔继续检查。', web:'ok', device:'ok', version:'ok', leg:'轮询中', legTone:'info', action:'停止轮询', enabled:true, reason:'停止后不再领取新任务。', session:'运行中', step:'等待下一轮', kind:'idle', active:-1, countdown:'00:12', fail:'0 / 3', count:2 },
-        trial: { tone:'info', title:'第一趟试选正在执行', text:'只勾选规格、读价和截图；不会进入订单确认流程，完成后必须退出商品页释放手机。', web:'ok', device:'ok', version:'ok', leg:'TRIAL · 第一趟试选', legTone:'info', action:'真机步骤执行中', enabled:false, reason:'真机步骤期间禁用硬取消和关闭，避免留下无法判定的中间态。', session:'运行中', step:'读取规格面板单价', kind:'trial', active:2, countdown:'暂停', fail:'0 / 3', lease:'04:18' },
-        trial_done: { tone:'success', title:'试选已回传，手机已释放', text:'规格与价格证据已保存（模拟）；任务等待管理员确认，本设备继续下一轮。', web:'ok', device:'ok', version:'ok', leg:'TRIAL · 已完成', legTone:'success', action:'停止轮询', enabled:true, reason:'手机已退出商品页，可以安全停止轮询。', session:'运行中', step:'等待下一轮', kind:'trial', active:4, countdown:'00:09', fail:'0 / 3', count:3 },
-        dry_run: { tone:'info', title:'DRY-RUN · 只读演练', text:'只到订单确认页读取非敏感摘要并验证控件唯一；不会提交订单，也不会消费授权。', web:'ok', device:'ok', version:'ok', leg:'DRY-RUN · 不会提交', legTone:'info', action:'只读演练进行中', enabled:false, reason:'演练中不提供提交动作；真机步骤期间受控关闭。', session:'运行中', step:'读取订单确认页', kind:'dry', active:2, countdown:'暂停', fail:'0 / 3', lease:'03:42' },
-        dry_run_ready: { tone:'success', title:'只读演练已完成', text:'演练证据已回传（模拟）并退出确认页。旧演练不能替代真实第二趟的当前页面事实。', web:'ok', device:'ok', version:'ok', leg:'DRY-RUN · READY', legTone:'success', action:'停止轮询', enabled:true, reason:'等待服务端安排真实第二趟；不会由用户直接触发提交。', session:'运行中', step:'等待真实第二趟', kind:'dry', active:4, countdown:'00:16', fail:'0 / 3', count:4 },
-        order_prefence: { tone:'caution', title:'真实第二趟 · 围栏前校验', text:'正在重新验证授权、闸门二、数量、闸门三和控件唯一。此时尚无点击许可。', web:'ok', device:'ok', version:'ok', leg:'ORDER · 围栏前', legTone:'caution', action:'安全校验进行中', enabled:false, reason:'没有服务端围栏许可，绝不能点击提交订单。', session:'运行中', step:'闸门三：核对实付款', kind:'order', active:2, countdown:'暂停', fail:'0 / 3', lease:'02:58' },
-        fencing: { tone:'caution', title:'正在申请服务端提交围栏', text:'等待明确的 click_permitted。超时、冲突、网络失败或响应不明都不会点击。', web:'ok', device:'ok', version:'ok', leg:'ORDER · 申请围栏', legTone:'caution', action:'等待围栏响应', enabled:false, reason:'申请中禁止取消、关闭或重复申请。', session:'运行中', step:'申请唯一提交围栏', kind:'order', active:3, countdown:'暂停', fail:'0 / 3', lease:'02:31' },
-        fence_failed: { tone:'critical', title:'未获得点击许可', text:'围栏申请失败或响应不明：没有点击提交订单。请按幂等键核查服务端记录，不能直接重试。', web:'bad', device:'ok', version:'ok', leg:'ORDER · 未获许可', legTone:'critical', action:'打开围栏核查说明', enabled:true, safeAction:'review', reason:'只核查围栏状态，不会触发提交。', session:'已停止', step:'核查幂等键', kind:'order', active:3, countdown:'—', fail:'1 / 3', submission:'围栏状态未知 · 幂等键 DEMO-FENCE-042' },
-        fenced: { tone:'caution', title:'围栏已建立，只核对同一提交', text:'submission_id 已固定。内部流程至多点击一次；用户界面不提供提交、重领、放弃或重试入口。', web:'ok', device:'ok', version:'ok', leg:'ORDER · 已围栏', legTone:'caution', action:'打开同一提交核查说明', enabled:true, safeAction:'review', reason:'只能查看与调和同一提交记录。', session:'受控执行', step:'调和订单结果', kind:'order', active:5, countdown:'暂停', fail:'0 / 3', lease:'01:49', submission:'SUB-DEMO-0042 · FENCED' },
-        waiting_payment: { tone:'success', title:'已明确创建待付款订单', text:'自动化已停止。系统不会付款；请人在拼多多核对后自行付款，再到采购服务标记。', web:'ok', device:'ok', version:'ok', leg:'WAITING_PAYMENT', legTone:'success', action:'查看待付款说明', enabled:true, safeAction:'paymentInfo', reason:'仅显示人工收口说明，不执行支付。', session:'已停止', step:'等待人工付款', kind:'order', active:6, countdown:'—', fail:'0 / 3', count:5, submission:'SUB-DEMO-0042 · SUBMITTED' },
-        uncertain: { tone:'critical', title:'订单可能已创建，结果不明确', text:'保持金额预留和永久围栏，只核查 SUB-DEMO-0042；禁止重新领取、放弃授权或再次点击。', web:'ok', device:'ok', version:'ok', leg:'RECONCILIATION_REQUIRED', legTone:'critical', action:'打开人工核查说明', enabled:true, safeAction:'review', reason:'核查不会发起新的下单。可另行导出假证据摘要。', session:'已停止', step:'人工核查同一提交', kind:'order', active:5, countdown:'—', fail:'0 / 3', submission:'SUB-DEMO-0042 · 结果不明确' },
-        security: { tone:'critical', title:'检测到安全校验，已停止', text:'保留现场并转人工；不尝试绕过验证码、风控、人脸或短信校验。若已围栏，只调和同一提交。', web:'ok', device:'ok', version:'ok', leg:'待人工 · 安全校验', legTone:'critical', action:'打开人工核查说明', enabled:true, safeAction:'review', reason:'只显示核查说明，不提供绕过或继续入口。', session:'已停止', step:'等待人工处理', kind:'order', active:5, countdown:'—', fail:'1 / 3', submission:'SUB-DEMO-0042 · RECONCILIATION_REQUIRED' },
-        payment_handoff: { tone:'critical', title:'进入外部支付交接，已停止', text:'订单可能已创建、支付未完成。不会读取或输入支付凭据，也没有“继续付款”按钮。', web:'ok', device:'ok', version:'ok', leg:'待人工 · 外部支付', legTone:'critical', action:'打开人工核查说明', enabled:true, safeAction:'paymentInfo', reason:'只显示人工核查与付款边界。', session:'已停止', step:'人工核查同一提交', kind:'order', active:5, countdown:'—', fail:'0 / 3', submission:'SUB-DEMO-0042 · HANDED_OFF' },
-        manual: { tone:'caution', title:'任务已转人工：授权价与现价不一致', text:'授权 CNY 32.50，规格面板现价 CNY 35.00。没有下单，也不会自动放弃；请联系管理员处理。', web:'ok', device:'ok', version:'ok', leg:'NEEDS_MANUAL', legTone:'caution', action:'导出假诊断摘要', enabled:true, safeAction:'export', reason:'导出仅生成本地假文本，不包含页面全文或敏感信息。', session:'继续轮询其他任务', step:'当前任务已移交', kind:'order', active:1, countdown:'00:11', fail:'0 / 3', submission:'未建立' },
+        claimed: { tone:'info', title:'已领取管理员授权的采购任务', text:'任务字段与最高总价已锁定；当前只准备打开目标商品，尚未建立提交围栏。', web:'ok', device:'ok', version:'ok', leg:'单趟 · 已领取', legTone:'info', action:'真机步骤执行中', enabled:false, reason:'当前任务已开始，停止轮询只应阻止下一次领取，不能硬取消本任务。', session:'运行中', step:'核对授权与商品', kind:'single', active:0, countdown:'暂停', fail:'0 / 3', lease:'04:48' },
+        selecting: { tone:'info', title:'正在精确选择颜色与尺码', text:'只在已取证维度容器内精确唯一匹配并读回；缺失、重复或版本变化立即停止。', web:'ok', device:'ok', version:'ok', leg:'单趟 · 选择规格', legTone:'info', action:'真机步骤执行中', enabled:false, reason:'当前受控步骤不能被硬取消。', session:'运行中', step:'精确选择规格', kind:'single', active:1, countdown:'暂停', fail:'0 / 3', lease:'04:18' },
+        gate1: { tone:'info', title:'闸门一：读取 SKU 单价', text:'当前规格单价必须唯一可读，单价乘数量不得超过管理员授权的最高总价。', web:'ok', device:'ok', version:'ok', leg:'单趟 · 闸门一', legTone:'info', action:'安全校验进行中', enabled:false, reason:'价格不可读或超上限时立即停止。', session:'运行中', step:'闸门一：读取 SKU 单价', kind:'single', active:2, countdown:'暂停', fail:'0 / 3', lease:'03:58' },
+        quantity_gate2: { tone:'info', title:'数量复核与闸门二', text:'数量必须读回为 2；目标规格不能漂移，第二次单价必须等于闸门一 CNY 32.50。', web:'ok', device:'ok', version:'ok', leg:'单趟 · 闸门二', legTone:'info', action:'安全校验进行中', enabled:false, reason:'数量、规格或价格变化都停止。', session:'运行中', step:'数量读回与闸门二', kind:'single', active:3, countdown:'暂停', fail:'0 / 3', lease:'03:31' },
+        confirm_gate3: { tone:'caution', title:'确认页与闸门三', text:'正在核对规格、数量、应付总额与提交控件唯一；此时没有点击许可。', web:'ok', device:'ok', version:'ok', leg:'单趟 · 闸门三', legTone:'caution', action:'安全校验进行中', enabled:false, reason:'没有服务端围栏许可，绝不能点击提交订单。', session:'运行中', step:'闸门三：核对应付总额', kind:'single', active:4, countdown:'暂停', fail:'0 / 3', lease:'02:58' },
+        fencing: { tone:'caution', title:'正在申请服务端提交围栏', text:'等待首次明确的 click_permitted。超时、冲突、网络失败或响应不明都不会点击。', web:'ok', device:'ok', version:'ok', leg:'单趟 · 申请围栏', legTone:'caution', action:'等待围栏响应', enabled:false, reason:'申请中禁止取消、关闭或换 key 重复申请。', session:'运行中', step:'申请唯一提交围栏', kind:'single', active:5, countdown:'暂停', fail:'0 / 3', lease:'02:31' },
+        fence_failed: { tone:'critical', title:'未获得首次明确点击许可', text:'围栏失败或响应不明：没有点击提交订单。只核查同一幂等键，不能直接重试。', web:'bad', device:'ok', version:'ok', leg:'单趟 · 未获许可', legTone:'critical', action:'打开围栏核查说明', enabled:true, safeAction:'review', reason:'只核查围栏状态，不触发提交。', session:'已停止', step:'核查幂等键', kind:'single', active:5, countdown:'—', fail:'1 / 3', submission:'围栏状态未知 · 幂等键 DEMO-FENCE-042' },
+        fenced: { tone:'caution', title:'围栏已建立，只核对同一提交', text:'submission_id 已固定。内部流程至多点击一次；界面不提供提交、重领、放弃或重试。', web:'ok', device:'ok', version:'ok', leg:'单趟 · 已围栏', legTone:'caution', action:'打开同一提交核查说明', enabled:true, safeAction:'review', reason:'只能查看与调和同一提交记录。', session:'受控执行', step:'调和订单结果', kind:'single', active:7, countdown:'暂停', fail:'0 / 3', lease:'01:49', submission:'SUB-DEMO-0042 · FENCED' },
+        waiting_payment: { tone:'success', title:'已明确创建待付款订单', text:'自动化已停止。系统不会付款；请人在拼多多核对后自行付款，再到采购服务标记。', web:'ok', device:'ok', version:'ok', leg:'WAITING_PAYMENT', legTone:'success', action:'查看待付款说明', enabled:true, safeAction:'paymentInfo', reason:'仅显示人工收口说明，不执行支付。', session:'已停止', step:'等待人工付款', kind:'single', active:8, countdown:'—', fail:'0 / 3', count:5, submission:'SUB-DEMO-0042 · SUBMITTED' },
+        uncertain: { tone:'critical', title:'订单可能已创建，结果不明确', text:'保持金额预留和永久围栏，只核查 SUB-DEMO-0042；禁止重新领取、释放授权或再次点击。', web:'ok', device:'ok', version:'ok', leg:'RECONCILIATION_REQUIRED', legTone:'critical', action:'打开人工核查说明', enabled:true, safeAction:'review', reason:'核查不会发起新的下单。可另行导出假证据摘要。', session:'已停止', step:'人工核查同一提交', kind:'single', active:7, countdown:'—', fail:'0 / 3', submission:'SUB-DEMO-0042 · 结果不明确' },
+        security: { tone:'critical', title:'检测到安全校验，已停止', text:'不绕过验证码、风控、人脸或短信。若已围栏，只调和同一提交；围栏前转人工。', web:'ok', device:'ok', version:'ok', leg:'待人工 · 安全校验', legTone:'critical', action:'打开人工核查说明', enabled:true, safeAction:'review', reason:'只显示核查说明，不提供绕过或继续。', session:'已停止', step:'等待人工处理', kind:'single', active:7, countdown:'—', fail:'1 / 3', submission:'SUB-DEMO-0042 · RECONCILIATION_REQUIRED' },
+        payment_handoff: { tone:'critical', title:'进入外部支付交接，已停止', text:'订单可能已创建、支付未完成。不会读取或输入支付凭据，也没有“继续付款”按钮。', web:'ok', device:'ok', version:'ok', leg:'待人工 · 外部支付', legTone:'critical', action:'打开人工核查说明', enabled:true, safeAction:'paymentInfo', reason:'只显示人工核查与付款边界。', session:'已停止', step:'人工核查同一提交', kind:'single', active:7, countdown:'—', fail:'0 / 3', submission:'SUB-DEMO-0042 · HANDED_OFF' },
+        manual: { tone:'caution', title:'任务已转人工：闸门二价格变化', text:'闸门一 CNY 32.50，数量设置后重读 CNY 35.00。围栏未建立，没有创建订单；需管理员核查后重置。', web:'ok', device:'ok', version:'ok', leg:'NEEDS_MANUAL', legTone:'caution', action:'导出假诊断摘要', enabled:true, safeAction:'export', reason:'导出只生成本地假文本，不含完整 XML、页面全文或敏感字段。', session:'继续轮询其他任务', step:'当前任务已移交', kind:'single', active:3, countdown:'00:11', fail:'0 / 3', submission:'未建立' },
         failed_stop: { tone:'critical', title:'连续失败达到阈值，轮询已停止', text:'最近三次均为服务连接失败。检查设置和网络；修复后重新开始普通轮询，不会重试任何提交点击。', web:'bad', device:'ok', version:'ok', leg:'自动停止', legTone:'critical', action:'前往配置', enabled:true, safeAction:'settings', reason:'先修复连接；不会自动恢复轮询。', session:'已停止', step:'等待修复', kind:'idle', active:-1, countdown:'—', fail:'3 / 3', count:4 }
       };
       const sessionControls = {
         not_ready:{label:'开始轮询',enabled:false,reason:'web 服务未就绪，不能领取任务。'},
         version_mismatch:{label:'开始轮询',enabled:false,reason:'App 版本失配，必须先完成本项目真机取证。'},
-        idle:{label:'开始轮询',enabled:true,reason:'只启动普通轮询，不会直接执行下单。'},
+        idle:{label:'开始轮询',enabled:true,reason:'只启动领取会话；只有已获管理员开始采购授权的任务可执行。'},
         polling:{label:'停止轮询',enabled:true,reason:'停止后不再领取新任务。'},
-        trial:{label:'停止轮询',enabled:false,reason:'真机步骤执行中，禁止硬停止。'},
-        trial_done:{label:'停止轮询',enabled:true,reason:'手机已退出商品页，可以安全停止轮询。'},
-        dry_run:{label:'停止轮询',enabled:false,reason:'只读演练执行中，禁止硬停止。'},
-        dry_run_ready:{label:'停止轮询',enabled:true,reason:'演练已退出确认页，可以安全停止轮询。'},
-        order_prefence:{label:'停止轮询',enabled:false,reason:'真实第二趟校验中，禁止硬停止。'},
+        claimed:{label:'停止轮询',enabled:false,reason:'当前任务已领取；停止只应阻止下次领取，不能硬取消本任务。'},
+        selecting:{label:'停止轮询',enabled:false,reason:'受控真机步骤执行中，禁止硬停止。'},
+        gate1:{label:'停止轮询',enabled:false,reason:'价格闸门执行中，禁止硬停止。'},
+        quantity_gate2:{label:'停止轮询',enabled:false,reason:'数量与闸门二执行中，禁止硬停止。'},
+        confirm_gate3:{label:'停止轮询',enabled:false,reason:'确认页只允许安全校验，禁止硬停止或额外点击。'},
         fencing:{label:'停止轮询',enabled:false,reason:'围栏申请中，禁止关闭、取消或重复申请。'},
         fence_failed:{label:'开始轮询',enabled:false,reason:'先核查围栏状态；不能用重新轮询绕过不明确结果。'},
         fenced:{label:'停止轮询',enabled:false,reason:'已建立围栏，只能调和同一提交。'},
@@ -836,10 +834,10 @@
         $('task-id').textContent = hasTask ? task.id : '—'; $('lease').textContent = s.lease || '—';
         $('product').textContent = hasTask ? task.product : '暂无商品；轮询会在安全就绪后领取一条任务';
         $('color').textContent = hasTask ? task.color : '—'; $('size-qty').textContent = hasTask ? task.sizeQty : '—';
-        $('auth-price').textContent = hasTask && s.kind !== 'trial' ? task.authPrice : '—'; $('price-cap').textContent = hasTask ? task.cap : '—';
+        $('gate1-price').textContent = hasTask && ['gate1','quantity_gate2','confirm_gate3','fencing','fence_failed','fenced','waiting_payment','uncertain','security','payment_handoff','manual'].includes($('scenario').value) ? task.gate1Price : '—'; $('price-cap').textContent = hasTask ? task.cap : '—';
         $('submission').textContent = s.submission || '未建立';
         $('preview-empty').hidden = hasTask; $('product-preview-image').hidden = !hasTask;
-        $('preview-source').textContent = hasTask ? '来源：商品页截图裁剪（内联假证据）' : '来源：尚无可信图片';
+        $('preview-source').textContent = hasTask ? '来源：内部原始商品截图（内联假证据）' : '来源：尚无可信图片';
         $('preview-time').textContent = hasTask ? '采集时间：2026-08-03 13:51（假数据）' : '采集时间：—';
         renderSteps(s.kind, s.active);
         $('countdown').textContent = s.countdown; $('failure-count').textContent = s.fail; $('completed-count').textContent = String(s.count || 0);
@@ -888,7 +886,7 @@
       window.addEventListener('resize', hideRecordMenu);
       $('export-log').addEventListener('click', exportDemo);
       $('close-demo').addEventListener('click', () => {
-        const unsafe = ['trial','dry_run','order_prefence','fencing','fenced'].includes($('scenario').value);
+        const unsafe = ['claimed','selecting','gate1','quantity_gate2','confirm_gate3','fencing','fenced'].includes($('scenario').value);
         showDialog(unsafe ? '当前不能直接关闭' : '关闭窗口协议', unsafe ? '真机或围栏流程处于受控阶段。原生实现需先完成安全停靠或保持同一 submission 调和，不能让关闭看起来等于“可以重来”。' : '原生实现关闭窗口后立即停止普通轮询，不留后台进程。此 HTML 只演示规则，不会关闭浏览器。');
       });
       $('dialog-close').addEventListener('click', () => $('info-dialog').close());

docs/design/web-task-create.html

@@ -203,11 +203,11 @@
           <h2>创建后发生什么</h2>
           <ol class="steps">
             <li>任务先保存为「待开始」。</li>
-            <li>在任务表格勾选后统一点击「开始试选」。</li>
-            <li>第一趟只试选、读价、截图，然后退出商品。</li>
-            <li>你看过证据后再决定是否授权。</li>
+            <li>在任务表格勾选后点击「开始采购（只创建待付款订单）」。</li>
+            <li>该点击锁定商品、规格、数量和最高总价，并授权采购工具执行。</li>
+            <li>采购工具同一趟校验规格、价格和数量后，只创建待付款订单。</li>
           </ol>
-          <p style="margin-top:10px"><strong>系统不会自动付款。</strong></p>
+          <p style="margin-top:10px"><strong>创建任务本身不授权；系统任何时候都不会自动付款。</strong></p>
         </section>
         <section class="prototype-controls">
           <h2>原型状态</h2>
@@ -310,7 +310,7 @@
         setReady();
         form.hidden = true;
         status.className = 'status success show';
-        status.innerHTML = '<h2>任务已创建</h2><p>任务编号 <strong>T-20260803-019</strong>，当前为「待开始」。请回到任务表格勾选后点击“开始试选”；系统尚未进行任何拼多多操作。</p><a class="button button-primary" href="web-task-workbench.html">查看任务工作台</a>';
+        status.innerHTML = '<h2>任务已创建</h2><p>任务编号 <strong>T-20260803-019</strong>，当前为「待开始」。请回到任务表格勾选后点击“开始采购（只创建待付款订单）”；创建本身尚未授权，也没有进行任何拼多多操作。</p><a class="button button-primary" href="web-task-workbench.html">查看任务工作台</a>';
         status.focus?.();
       }