docs(tasks): record T-103 entry audit

admin/README.md

@@ -9,6 +9,9 @@
 | `CMBUYER_SESSION_SECRET` | 至少 32 字节的会话签名密钥。 |
 | `CMBUYER_COOKIE_SECURE` | 可选；存在时只能精确为 `true` 或 `false`。HTTPS 部署应设为 `true`。 |
 | `CMBUYER_DATABASE_SOURCE` | 已迁移 SQLite 的显式 data source。 |
+| `CMBUYER_AUTHORIZATION_TTL` | 一次性授权的正 Go duration，例如 `10m`。 |
+| `CMBUYER_MAX_TASK_QUANTITY` | 每条任务允许的正整数数量上限。 |
+| `CMBUYER_MAX_TOTAL_PRICE` | 每条任务允许的规范正数总价上限，例如 `999.99`。 |
 
 示例仅展示变量名，不提供可运行凭据：
 
@@ -18,8 +21,12 @@ $env:CMBUYER_ADMIN_PASSWORD_BCRYPT = '<bcrypt 密码哈希>'
 $env:CMBUYER_SESSION_SECRET = '<至少 32 字节的随机密钥>'
 $env:CMBUYER_COOKIE_SECURE = 'true'
 $env:CMBUYER_DATABASE_SOURCE = '<SQLite data source>'
+$env:CMBUYER_AUTHORIZATION_TTL = '10m'
+$env:CMBUYER_MAX_TASK_QUANTITY = '99'
+$env:CMBUYER_MAX_TOTAL_PRICE = '999.99'
 go run ./cmd/migrate -database $env:CMBUYER_DATABASE_SOURCE up
 go run ./cmd/server
 ```
 
 采购服务会话仅保存在当前进程内；进程重启后既有登录会话会安全失效。
+管理员的“开始采购（只创建待付款订单）”只签发一次性授权并创建待付款订单的资格；服务不会自动付款，也不包含任何支付操作。

admin/cmd/server/main.go

@@ -34,6 +34,7 @@ func run() error {
 	if err != nil {
 		return err
 	}
+	taskStore.SetStartPolicy(tasks.StartPolicy{AuthorizationTTL: configuration.AuthorizationTTL, MaxQuantity: configuration.MaxTaskQuantity, MaxTotalPrice: configuration.MaxTotalPrice})
 
 	router, err := server.NewRouter(server.Options{
 		AdminUsername:       configuration.AdminUsername,

admin/internal/auth/session.go

@@ -62,6 +62,12 @@ func (manager *Manager) Ensure(writer http.ResponseWriter, request *http.Request
 	return current.csrfToken, false
 }
 
+// IsAuthenticated 只读检查当前请求是否持有有效管理会话；它不会像 Ensure 一样创建匿名会话。
+func (manager *Manager) IsAuthenticated(request *http.Request) bool {
+	_, current, found := manager.current(request)
+	return found && current.authenticated
+}
+
 // VerifyCSRF 只接受当前未过期会话中以恒定时间比较匹配的 token。
 func (manager *Manager) VerifyCSRF(request *http.Request, token string) (authenticated bool, ok bool) {
 	_, current, found := manager.current(request)

admin/internal/auth/session_test.go

@@ -37,6 +37,51 @@ func TestManagerRejectsTamperedAndExpiredCookies(t *testing.T) {
 	}
 }
 
+func TestIsAuthenticatedDoesNotCreateOrDependOnCSRFValidation(t *testing.T) {
+	manager := NewManager([]byte(strings.Repeat("s", 32)), false)
+	missingSession := httptest.NewRequest(http.MethodPost, "/tasks/start-purchases", nil)
+	if manager.IsAuthenticated(missingSession) {
+		t.Fatal("missing session was treated as authenticated")
+	}
+	if len(manager.sessions) != 0 {
+		t.Fatalf("read-only authentication check created %d sessions", len(manager.sessions))
+	}
+	anonymousRequest := httptest.NewRequest(http.MethodGet, "/login", nil)
+	anonymousResponse := httptest.NewRecorder()
+	manager.Ensure(anonymousResponse, anonymousRequest)
+	anonymousCookie := anonymousResponse.Result().Cookies()[0]
+	anonymousCheck := httptest.NewRequest(http.MethodPost, "/tasks/start-purchases", nil)
+	anonymousCheck.AddCookie(anonymousCookie)
+	if manager.IsAuthenticated(anonymousCheck) {
+		t.Fatal("anonymous CSRF session was treated as authenticated")
+	}
+
+	loginRequest := httptest.NewRequest(http.MethodPost, "/login", nil)
+	loginRequest.AddCookie(anonymousCookie)
+	authenticatedResponse := httptest.NewRecorder()
+	csrf := manager.RotateAuthenticated(authenticatedResponse, loginRequest)
+	authenticatedCookie := authenticatedResponse.Result().Cookies()[0]
+
+	authenticatedCheck := httptest.NewRequest(http.MethodPost, "/tasks/start-purchases", nil)
+	authenticatedCheck.AddCookie(authenticatedCookie)
+	if !manager.IsAuthenticated(authenticatedCheck) {
+		t.Fatal("valid authenticated session was not recognized")
+	}
+	if authenticated, csrfOK := manager.VerifyCSRF(authenticatedCheck, "wrong-token"); authenticated || csrfOK {
+		t.Fatalf("wrong token result = (%t, %t), want (false, false)", authenticated, csrfOK)
+	}
+
+	validRequest := httptest.NewRequest(http.MethodPost, "/tasks/start-purchases", nil)
+	validRequest.AddCookie(authenticatedCookie)
+	if authenticated, csrfOK := manager.VerifyCSRF(validRequest, csrf); !authenticated || !csrfOK {
+		t.Fatalf("valid token result = (%t, %t), want (true, true)", authenticated, csrfOK)
+	}
+
+	if authenticated, csrfOK := manager.VerifyCSRF(httptest.NewRequest(http.MethodPost, "/tasks/start-purchases", nil), csrf); authenticated || csrfOK {
+		t.Fatalf("missing session result = (%t, %t), want (false, false)", authenticated, csrfOK)
+	}
+}
+
 func flipCookieValue(t *testing.T, value string) string {
 	t.Helper()
 	if value == "" {

admin/internal/config/config.go

@@ -5,7 +5,9 @@ import (
 	"errors"
 	"fmt"
 	"os"
+	"strconv"
 	"strings"
+	"time"
 
 	"golang.org/x/crypto/bcrypt"
 )
@@ -16,6 +18,9 @@ const (
 	sessionSecretEnv       = "CMBUYER_SESSION_SECRET"
 	cookieSecureEnv        = "CMBUYER_COOKIE_SECURE"
 	databaseSourceEnv      = "CMBUYER_DATABASE_SOURCE"
+	authorizationTTLEnv    = "CMBUYER_AUTHORIZATION_TTL"
+	maxTaskQuantityEnv     = "CMBUYER_MAX_TASK_QUANTITY"
+	maxTotalPriceEnv       = "CMBUYER_MAX_TOTAL_PRICE"
 	minimumSecretLength    = 32
 )
 
@@ -26,6 +31,9 @@ type Config struct {
 	SessionSecret       []byte
 	CookieSecure        bool
 	DatabaseSource      string
+	AuthorizationTTL    time.Duration
+	MaxTaskQuantity     int
+	MaxTotalPrice       string
 }
 
 // LoadFromEnv 从进程环境读取配置。错误只指出缺失或非法的变量名，绝不回显秘密。
@@ -71,6 +79,29 @@ func Load(lookup func(string) (string, bool)) (Config, error) {
 	if err != nil {
 		return Config{}, err
 	}
+	ttlText, err := required(lookup, authorizationTTLEnv)
+	if err != nil {
+		return Config{}, err
+	}
+	ttl, err := time.ParseDuration(ttlText)
+	if err != nil || ttl <= 0 {
+		return Config{}, fmt.Errorf("%s must be a positive duration", authorizationTTLEnv)
+	}
+	quantityText, err := required(lookup, maxTaskQuantityEnv)
+	if err != nil {
+		return Config{}, err
+	}
+	maxQuantity, err := strconv.Atoi(quantityText)
+	if err != nil || maxQuantity < 1 {
+		return Config{}, fmt.Errorf("%s must be a positive integer", maxTaskQuantityEnv)
+	}
+	maxPrice, err := required(lookup, maxTotalPriceEnv)
+	if err != nil {
+		return Config{}, err
+	}
+	if !canonicalMoney(maxPrice) {
+		return Config{}, fmt.Errorf("%s must be a canonical positive decimal", maxTotalPriceEnv)
+	}
 
 	return Config{
 		AdminUsername:       username,
@@ -78,9 +109,25 @@ func Load(lookup func(string) (string, bool)) (Config, error) {
 		SessionSecret:       []byte(secret),
 		CookieSecure:        cookieSecure,
 		DatabaseSource:      databaseSource,
+		AuthorizationTTL:    ttl, MaxTaskQuantity: maxQuantity, MaxTotalPrice: maxPrice,
 	}, nil
 }
 
+func canonicalMoney(value string) bool {
+	parts := strings.Split(value, ".")
+	if len(parts) != 2 || len(parts[0]) == 0 || len(parts[1]) != 2 || (len(parts[0]) > 1 && parts[0][0] == '0') {
+		return false
+	}
+	for _, part := range parts {
+		for _, ch := range part {
+			if ch < '0' || ch > '9' {
+				return false
+			}
+		}
+	}
+	return strings.Trim(parts[0]+parts[1], "0") != ""
+}
+
 func required(lookup func(string) (string, bool), name string) (string, error) {
 	value, present := lookup(name)
 	if !present || strings.TrimSpace(value) == "" {

admin/internal/config/config_test.go

@@ -21,6 +21,9 @@ func TestLoad(t *testing.T) {
 		"CMBUYER_SESSION_SECRET":        strings.Repeat("s", 32),
 		"CMBUYER_COOKIE_SECURE":         "true",
 		"CMBUYER_DATABASE_SOURCE":       ":memory:",
+		"CMBUYER_AUTHORIZATION_TTL":     "10m",
+		"CMBUYER_MAX_TASK_QUANTITY":     "99",
+		"CMBUYER_MAX_TOTAL_PRICE":       "999.99",
 	}
 
 	got, err := config.Load(lookup(values))
@@ -43,6 +46,9 @@ func TestLoadRejectsMissingOrInvalidConfiguration(t *testing.T) {
 		"CMBUYER_ADMIN_PASSWORD_BCRYPT": string(hash),
 		"CMBUYER_SESSION_SECRET":        strings.Repeat("s", 32),
 		"CMBUYER_DATABASE_SOURCE":       ":memory:",
+		"CMBUYER_AUTHORIZATION_TTL":     "10m",
+		"CMBUYER_MAX_TASK_QUANTITY":     "99",
+		"CMBUYER_MAX_TOTAL_PRICE":       "999.99",
 	}
 
 	tests := []struct {
@@ -55,6 +61,9 @@ func TestLoadRejectsMissingOrInvalidConfiguration(t *testing.T) {
 		{"short secret", func(values map[string]string) { values["CMBUYER_SESSION_SECRET"] = "short" }, "CMBUYER_SESSION_SECRET"},
 		{"invalid secure flag", func(values map[string]string) { values["CMBUYER_COOKIE_SECURE"] = "1" }, "CMBUYER_COOKIE_SECURE"},
 		{"missing database", func(values map[string]string) { delete(values, "CMBUYER_DATABASE_SOURCE") }, "CMBUYER_DATABASE_SOURCE"},
+		{"invalid authorization ttl", func(values map[string]string) { values["CMBUYER_AUTHORIZATION_TTL"] = "0s" }, "CMBUYER_AUTHORIZATION_TTL"},
+		{"invalid maximum quantity", func(values map[string]string) { values["CMBUYER_MAX_TASK_QUANTITY"] = "0" }, "CMBUYER_MAX_TASK_QUANTITY"},
+		{"invalid maximum total price", func(values map[string]string) { values["CMBUYER_MAX_TOTAL_PRICE"] = "1" }, "CMBUYER_MAX_TOTAL_PRICE"},
 	}
 
 	for _, test := range tests {

admin/internal/server/router.go

@@ -2,11 +2,16 @@
 package server
 
 import (
+	"bytes"
 	"crypto/subtle"
+	"encoding/json"
 	"errors"
+	"io"
+	"mime"
 	"net/http"
 	"net/url"
 	"strings"
+	"unicode/utf8"
 
 	"cmbuyer/admin/internal/auth"
 	"cmbuyer/admin/internal/tasks"
@@ -17,6 +22,7 @@ import (
 )
 
 const maxFormBytes = 8 << 10
+const maxJSONBytes = 64 << 10
 
 // Options 是路由层需要的安全依赖。凭据由启动配置注入，不能在路由中设置默认值。
 type Options struct {
@@ -42,10 +48,84 @@ func NewRouter(options Options) (*gin.Engine, error) {
 	router.GET("/tasks", tasksPage(options))
 	router.GET("/tasks/new", newTaskPage(options))
 	router.POST("/tasks", createTask(options))
+	router.POST("/tasks/start-purchases", startPurchases(options))
+	router.GET("/static/tasks.js", func(context *gin.Context) {
+		context.Data(http.StatusOK, "application/javascript; charset=utf-8", webui.TasksScript())
+	})
 
 	return router, nil
 }
 
+func startPurchases(options Options) gin.HandlerFunc {
+	return func(context *gin.Context) {
+		if !options.Sessions.IsAuthenticated(context.Request) {
+			context.Status(http.StatusUnauthorized)
+			return
+		}
+		authenticated, csrfOK := options.Sessions.VerifyCSRF(context.Request, context.GetHeader("X-CSRF-Token"))
+		if !authenticated || !csrfOK {
+			context.Status(http.StatusForbidden)
+			return
+		}
+		if !isJSONContentType(context.GetHeader("Content-Type")) {
+			context.Status(http.StatusUnsupportedMediaType)
+			return
+		}
+		context.Request.Body = http.MaxBytesReader(context.Writer, context.Request.Body, maxJSONBytes)
+		raw, err := io.ReadAll(context.Request.Body)
+		if err != nil {
+			var tooLarge *http.MaxBytesError
+			if errors.As(err, &tooLarge) {
+				context.Status(http.StatusRequestEntityTooLarge)
+			} else {
+				context.Status(http.StatusBadRequest)
+			}
+			return
+		}
+		if !utf8.Valid(raw) {
+			context.Status(http.StatusBadRequest)
+			return
+		}
+		decoder := json.NewDecoder(bytes.NewReader(raw))
+		decoder.DisallowUnknownFields()
+		var command tasks.StartCommand
+		if err := decoder.Decode(&command); err != nil {
+			context.Status(http.StatusBadRequest)
+			return
+		}
+		var extra any
+		if err := decoder.Decode(&extra); err != io.EOF {
+			context.Status(http.StatusBadRequest)
+			return
+		}
+		result, err := options.Tasks.StartPurchases(context.Request.Context(), command, options.AdminUsername)
+		if err != nil {
+			if errors.Is(err, tasks.ErrInvalidStart) {
+				context.Status(http.StatusBadRequest)
+			} else if errors.Is(err, tasks.ErrStartConflict) {
+				context.Status(http.StatusConflict)
+			} else {
+				context.Status(http.StatusInternalServerError)
+			}
+			return
+		}
+		context.JSON(http.StatusOK, result)
+	}
+}
+
+func isJSONContentType(value string) bool {
+	mediaType, parameters, err := mime.ParseMediaType(value)
+	if err != nil || mediaType != "application/json" {
+		return false
+	}
+	for name, value := range parameters {
+		if name != "charset" || !strings.EqualFold(value, "utf-8") {
+			return false
+		}
+	}
+	return true
+}
+
 func healthz(context *gin.Context) {
 	context.JSON(http.StatusOK, gin.H{"status": "ok"})
 }
@@ -55,7 +135,7 @@ func securityHeaders() gin.HandlerFunc {
 		context.Header("Cache-Control", "no-store")
 		context.Header("X-Content-Type-Options", "nosniff")
 		context.Header("Referrer-Policy", "no-referrer")
-		context.Header("Content-Security-Policy", "default-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'none'; object-src 'none'; base-uri 'none'; frame-ancestors 'none'; form-action 'self'")
+		context.Header("Content-Security-Policy", "default-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self'; object-src 'none'; base-uri 'none'; frame-ancestors 'none'; form-action 'self'")
 		context.Next()
 	}
 }
@@ -126,14 +206,23 @@ func tasksPage(options Options) gin.HandlerFunc {
 			return
 		}
 
-		drafts, err := options.Tasks.ListDrafts(context.Request.Context())
+		filter := tasks.TaskFilter{Keyword: context.Query("keyword"), Status: context.Query("status"), CreatedFrom: context.Query("created_from"), CreatedTo: context.Query("created_to")}
+		if validation := tasks.ValidateTaskFilter(filter); !validation.Valid() {
+			startKey, err := tasks.NewCreateKey()
+			if err != nil {
+				context.Status(http.StatusInternalServerError)
+				return
+			}
+			renderTasks(context, http.StatusBadRequest, webui.TasksData{CSRFToken: csrfToken, Filter: filter, FilterErrors: validation, HasFilter: true, StartKey: startKey})
+			return
+		}
+		data, err := taskListData(context, options, csrfToken, filter)
 		if err != nil {
 			context.Status(http.StatusInternalServerError)
 			return
 		}
-		data := webui.TasksData{CSRFToken: csrfToken, Drafts: drafts}
+		for _, row := range data.Tasks {
-		for _, draft := range drafts {
+			if row.ID == context.Query("created") {
-			if draft.ID == context.Query("created") {
 				data.Success = true
 				break
 			}
@@ -185,24 +274,32 @@ func createTask(options Options) gin.HandlerFunc {
 		}
 		fullPage := requestForm.Get("form_mode") == "full"
 		if !validation.Valid() {
-			drafts, err := options.Tasks.ListDrafts(context.Request.Context())
+			data, ok := createErrorData(context, options, fullPage)
-			if err != nil {
+			if !ok {
-				context.Status(http.StatusInternalServerError)
 				return
 			}
-			renderTasks(context, http.StatusBadRequest, webui.TasksData{CSRFToken: csrfFor(context, options), Drafts: drafts, Form: form, Errors: validation, OpenForm: !fullPage, FullPage: fullPage, FocusField: firstError(validation)})
+			data.Form = form
+			data.Errors = validation
+			data.OpenForm = !fullPage
+			data.FullPage = fullPage
+			data.FocusField = firstError(validation)
+			renderTasks(context, http.StatusBadRequest, data)
 			return
 		}
 		created, err := options.Tasks.CreateDraft(context.Request.Context(), draft)
 		if err != nil {
 			if errors.Is(err, tasks.ErrCreateKeyConflict) {
 				validation["create_key"] = "该创建请求已用于另一条任务，请重新打开表单。"
-				drafts, listErr := options.Tasks.ListDrafts(context.Request.Context())
+				data, ok := createErrorData(context, options, fullPage)
-				if listErr != nil {
+				if !ok {
-					context.Status(http.StatusInternalServerError)
 					return
 				}
-				renderTasks(context, http.StatusConflict, webui.TasksData{CSRFToken: csrfFor(context, options), Drafts: drafts, Form: form, Errors: validation, OpenForm: !fullPage, FullPage: fullPage, FocusField: firstError(validation)})
+				data.Form = form
+				data.Errors = validation
+				data.OpenForm = !fullPage
+				data.FullPage = fullPage
+				data.FocusField = firstError(validation)
+				renderTasks(context, http.StatusConflict, data)
 				return
 			}
 			context.Status(http.StatusInternalServerError)
@@ -226,6 +323,38 @@ func csrfFor(context *gin.Context, options Options) string {
 	csrf, _ := options.Sessions.Ensure(context.Writer, context.Request)
 	return csrf
 }
+
+func taskListData(context *gin.Context, options Options, csrfToken string, filter tasks.TaskFilter) (webui.TasksData, error) {
+	rows, err := options.Tasks.ListTasks(context.Request.Context(), filter)
+	if err != nil {
+		return webui.TasksData{}, err
+	}
+	startKey, err := tasks.NewCreateKey()
+	if err != nil {
+		return webui.TasksData{}, err
+	}
+	return webui.TasksData{
+		CSRFToken: csrfToken,
+		Tasks:     rows,
+		Filter:    filter,
+		HasFilter: filter.Keyword != "" || filter.Status != "" || filter.CreatedFrom != "" || filter.CreatedTo != "",
+		StartKey:  startKey,
+	}, nil
+}
+
+func createErrorData(context *gin.Context, options Options, fullPage bool) (webui.TasksData, bool) {
+	csrfToken := csrfFor(context, options)
+	if fullPage {
+		return webui.TasksData{CSRFToken: csrfToken}, true
+	}
+	data, err := taskListData(context, options, csrfToken, tasks.TaskFilter{})
+	if err != nil {
+		context.Status(http.StatusInternalServerError)
+		return webui.TasksData{}, false
+	}
+	return data, true
+}
+
 func renderTasks(context *gin.Context, status int, data webui.TasksData) {
 	context.Header("Content-Type", "text/html; charset=utf-8")
 	context.Status(status)

admin/internal/server/router_test.go

@@ -8,6 +8,7 @@ import (
 	"regexp"
 	"strings"
 	"testing"
+	"time"
 
 	"cmbuyer/admin/internal/auth"
 	"cmbuyer/admin/internal/server"
@@ -190,7 +191,7 @@ func TestTaskCreationRendersSharedFormsAndPersistsOnlyDraft(t *testing.T) {
 	if fullPage.Code != http.StatusOK {
 		t.Fatalf("GET full form status = %d, want 200", fullPage.Code)
 	}
-	for _, want := range []string{`<div class="modal-scrim"`, `<dialog open`, `aria-modal="true"`, `name="title"`, `name="product_url"`, `name="sku_color"`, `name="sku_size"`, `name="quantity"`, `name="max_total_price"`, `type="url" inputmode="url" maxlength="2048"`, `type="number" inputmode="numeric" min="1" step="1"`, `inputmode="decimal" pattern="[0-9]+(\.[0-9]{1,2})?"`, `maxlength="120"`, `maxlength="80"`, `required`, `autofocus`, `导入</button><a class="button primary"`, `type="search" disabled`, `disabled>筛选</button>`, `disabled>清除</button>`, `min-height:44px`, `overflow-x:auto`, `prefers-reduced-motion`} {
+	for _, want := range []string{`<div class="modal-scrim"`, `<dialog open`, `aria-modal="true"`, `name="title"`, `name="product_url"`, `name="sku_color"`, `name="sku_size"`, `name="quantity"`, `name="max_total_price"`, `type="url" inputmode="url" maxlength="2048"`, `type="number" inputmode="numeric" min="1" step="1"`, `inputmode="decimal" pattern="[0-9]+(\.[0-9]{1,2})?"`, `maxlength="120"`, `maxlength="80"`, `required`, `autofocus`, `导入</button><a class="button primary"`, `type="search"`, `data-start-purchases`, `data-select-all`, `最高总额`, `min-height:44px`, `:focus-visible`, `overflow-x:auto`, `prefers-reduced-motion`} {
 		if !strings.Contains(modal.Body.String(), want) {
 			t.Fatalf("dialog form is missing %q", want)
 		}
@@ -277,13 +278,108 @@ func TestTaskCreationRendersSharedFormsAndPersistsOnlyDraft(t *testing.T) {
 			t.Fatalf("task list is missing %q", want)
 		}
 	}
-	for _, forbidden := range []string{"utm_source", "试选", "PENDING", "支付", "订单确认", "真机", "提交订单"} {
+	for _, forbidden := range []string{"utm_source", "试选", "订单确认", "真机", "提交订单"} {
 		if strings.Contains(body, forbidden) {
 			t.Fatalf("task list exposed deferred scope %q", forbidden)
 		}
 	}
 }
 
+func TestTasksPageKeepsOriginalShellAndRendersFilteredWorkbench(t *testing.T) {
+	store := &memoryStore{rows: []tasks.TaskRow{
+		{ID: "b3c9f507-7473-4fa6-8d71-8786c34c6301", Title: "待开始衬衫", GoodsID: "937122477375", SKUColor: "黑色", SKUSize: "M", Quantity: 2, MaxTotalPrice: "12.80", Status: "DRAFT", Version: 3, CreatedAt: time.Date(2026, 8, 4, 1, 2, 3, 0, time.UTC)},
+		{ID: "c3c9f507-7473-4fa6-8d71-8786c34c6301", Title: "等待领取衬衫", GoodsID: "958756616606", SKUColor: "白色", SKUSize: "L", Quantity: 1, MaxTotalPrice: "20.00", Status: "PENDING", Version: 4, CreatedAt: time.Date(2026, 8, 4, 2, 3, 4, 0, time.UTC)},
+	}}
+	router, _ := newRouterWithStore(t, store)
+	cookie := authenticate(t, router)
+	query := url.Values{"keyword": {"衬衫"}, "created_from": {"2026-08-04"}, "created_to": {"2026-08-04"}}
+	response := serve(router, http.MethodGet, "/tasks?"+query.Encode(), nil, cookie)
+	if response.Code != http.StatusOK {
+		t.Fatalf("filtered tasks status = %d, want 200", response.Code)
+	}
+	body := response.Body.String()
+	for _, want := range []string{
+		`<a class="skip" href="#main">`,
+		`:focus-visible`,
+		`min-height:44px`,
+		`@media(max-width:420px)`,
+		`prefers-reduced-motion`,
+		`<button class="button" type="button" disabled>导入</button><a class="button primary" href="/tasks?create=1">创建任务</a>`,
+		`name="keyword" type="search" value="衬衫"`,
+		`name="created_from" type="date" value="2026-08-04"`,
+		`name="created_to" type="date" value="2026-08-04"`,
+		`data-start-purchases`,
+		`data-selection-summary aria-live="polite"`,
+		`系统不会付款`,
+		`开始采购（只创建待付款订单）`,
+		`采购结果`,
+		`创建时间（上海）`,
+		`https://mobile.yangkeduo.com/goods.html?goods_id=937122477375`,
+		`target="_blank" rel="noopener noreferrer"`,
+		`待开始`,
+		`已授权待领取`,
+		`datetime="2026-08-04T09:02:03&#43;08:00">2026-08-04 09:02`,
+		`<script src="/static/tasks.js" defer></script>`,
+	} {
+		if !strings.Contains(body, want) {
+			t.Fatalf("workbench is missing %q", want)
+		}
+	}
+	if strings.Index(body, `name="keyword"`) > strings.Index(body, `data-start-purchases`) || strings.Index(body, `data-start-purchases`) > strings.Index(body, `<div class="table-wrap">`) {
+		t.Fatal("workbench rows are not ordered as toolbar, filters, batch actions, table")
+	}
+	if count := strings.Count(body, `data-task-id=`); count != 1 {
+		t.Fatalf("selectable row count = %d, want only the DRAFT row", count)
+	}
+	for _, forbidden := range []string{`<th scope="col">操作</th>`, `确认开始采购`, `确认机器选对了吗`} {
+		if strings.Contains(body, forbidden) {
+			t.Fatalf("workbench exposed forbidden per-row or confirmation UI %q", forbidden)
+		}
+	}
+	if store.listTasksCalls != 1 || store.listDraftsCalls != 0 {
+		t.Fatalf("GET /tasks calls = (ListTasks %d, ListDrafts %d), want (1, 0)", store.listTasksCalls, store.listDraftsCalls)
+	}
+}
+
+func TestTasksPageRerendersAccessibleFilterErrorsAndKeepsValues(t *testing.T) {
+	store := &memoryStore{}
+	router, _ := newRouterWithStore(t, store)
+	cookie := authenticate(t, router)
+	query := url.Values{
+		"keyword":      {`保留%_\`},
+		"status":       {"UNKNOWN"},
+		"created_from": {"2026-02-30"},
+		"created_to":   {"not-a-date"},
+	}
+	response := serve(router, http.MethodGet, "/tasks?"+query.Encode(), nil, cookie)
+	if response.Code != http.StatusBadRequest {
+		t.Fatalf("invalid filter status = %d, want 400", response.Code)
+	}
+	body := response.Body.String()
+	for _, want := range []string{
+		`role="alert" aria-live="assertive"`,
+		`href="#filter-status"`,
+		`href="#filter-created-from"`,
+		`href="#filter-created-to"`,
+		`name="keyword" type="search" value="保留%_\"`,
+		`<option value="UNKNOWN" selected>无效状态：UNKNOWN</option>`,
+		`name="created_from" type="date" value="2026-02-30" aria-invalid="true" aria-describedby="filter-created-from-error"`,
+		`name="created_to" type="date" value="not-a-date" aria-invalid="true" aria-describedby="filter-created-to-error"`,
+		`id="filter-status-error"`,
+		`id="filter-created-from-error"`,
+		`id="filter-created-to-error"`,
+		`筛选条件有误`,
+	} {
+		if !strings.Contains(body, want) {
+			t.Fatalf("invalid filter page is missing %q", want)
+		}
+	}
+	if store.listTasksCalls != 0 || store.listDraftsCalls != 0 {
+		t.Fatalf("invalid filter queried stores: ListTasks=%d ListDrafts=%d", store.listTasksCalls, store.listDraftsCalls)
+	}
+	assertSecurityHeaders(t, response)
+}
+
 func TestTaskCreationRequiresAuthenticationAndCSRF(t *testing.T) {
 	router, _ := newRouter(t)
 	if response := serve(router, http.MethodPost, "/tasks", url.Values{}, nil); response.Code != http.StatusForbidden {
@@ -327,7 +423,7 @@ func assertSecurityHeaders(t *testing.T, response *httptest.ResponseRecorder) {
 		"Cache-Control":           "no-store",
 		"X-Content-Type-Options":  "nosniff",
 		"Referrer-Policy":         "no-referrer",
-		"Content-Security-Policy": "default-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'none'; object-src 'none'; base-uri 'none'; frame-ancestors 'none'; form-action 'self'",
+		"Content-Security-Policy": "default-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self'; object-src 'none'; base-uri 'none'; frame-ancestors 'none'; form-action 'self'",
 	}
 	for name, expected := range want {
 		if got := response.Header().Get(name); got != expected {
@@ -381,6 +477,10 @@ func TestLogoutRequiresCSRFAndRevokesSession(t *testing.T) {
 }
 
 func newRouter(t *testing.T) (*gin.Engine, *auth.Manager) {
+	return newRouterWithStore(t, &memoryStore{})
+}
+
+func newRouterWithStore(t *testing.T, store tasks.Store) (*gin.Engine, *auth.Manager) {
 	t.Helper()
 	gin.SetMode(gin.TestMode)
 	hash, err := bcrypt.GenerateFromPassword([]byte("test-password"), bcrypt.MinCost)
@@ -392,7 +492,7 @@ func newRouter(t *testing.T) (*gin.Engine, *auth.Manager) {
 		AdminUsername:       "admin",
 		AdminPasswordBcrypt: string(hash),
 		Sessions:            manager,
-		Tasks:               &memoryStore{},
+		Tasks:               store,
 	})
 	if err != nil {
 		t.Fatalf("NewRouter: %v", err)
@@ -400,7 +500,12 @@ func newRouter(t *testing.T) (*gin.Engine, *auth.Manager) {
 	return router, manager
 }
 
-type memoryStore struct{ drafts []tasks.Draft }
+type memoryStore struct {
+	drafts          []tasks.Draft
+	rows            []tasks.TaskRow
+	listDraftsCalls int
+	listTasksCalls  int
+}
 
 func (store *memoryStore) CreateDraft(_ context.Context, draft tasks.Draft) (tasks.Draft, error) {
 	for _, existing := range store.drafts {
@@ -415,8 +520,23 @@ func (store *memoryStore) CreateDraft(_ context.Context, draft tasks.Draft) (tas
 	return draft, nil
 }
 func (store *memoryStore) ListDrafts(_ context.Context) ([]tasks.Draft, error) {
+	store.listDraftsCalls++
 	return append([]tasks.Draft(nil), store.drafts...), nil
 }
+func (store *memoryStore) ListTasks(_ context.Context, _ tasks.TaskFilter) ([]tasks.TaskRow, error) {
+	store.listTasksCalls++
+	if store.rows != nil {
+		return append([]tasks.TaskRow(nil), store.rows...), nil
+	}
+	result := make([]tasks.TaskRow, 0, len(store.drafts))
+	for _, draft := range store.drafts {
+		result = append(result, tasks.TaskRow{ID: draft.ID, Title: draft.Title, GoodsID: draft.GoodsID, SKUColor: draft.SKUColor, SKUSize: draft.SKUSize, Quantity: draft.Quantity, MaxTotalPrice: draft.MaxTotalPrice, Status: "DRAFT", Version: 1, CreatedAt: draft.CreatedAt})
+	}
+	return result, nil
+}
+func (store *memoryStore) StartPurchases(_ context.Context, _ tasks.StartCommand, _ string) (tasks.StartResult, error) {
+	return tasks.StartResult{}, tasks.ErrInvalidStart
+}
 
 func serve(router http.Handler, method, target string, form url.Values, cookie *http.Cookie) *httptest.ResponseRecorder {
 	var body *strings.Reader

admin/internal/server/start_purchases_test.go

@@ -0,0 +1,328 @@
+package server_test
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	"cmbuyer/admin/internal/tasks"
+)
+
+const (
+	startKeyForHTTP = "c3c9f507-7473-4fa6-8d71-8786c34c6301"
+	taskIDForHTTP   = "a3c9f507-7473-4fa6-8d71-8786c34c6301"
+)
+
+func TestStartPurchasesAuthenticatesBeforeInspectingRequestBody(t *testing.T) {
+	store := &startRecordingStore{}
+	router, _ := newRouterWithStore(t, store)
+	hugeMalformed := `{"start_key":"` + strings.Repeat("x", 70<<10)
+
+	for name, request := range map[string]*http.Request{
+		"anonymous malformed": newStartRequest(t, hugeMalformed, "text/plain", "", nil),
+		"device bearer":       newStartRequest(t, validStartBody(), "application/json", "", nil),
+	} {
+		t.Run(name, func(t *testing.T) {
+			if name == "device bearer" {
+				request.Header.Set("Authorization", "Bearer device-token")
+			}
+			response := httptest.NewRecorder()
+			router.ServeHTTP(response, request)
+			if response.Code != http.StatusUnauthorized {
+				t.Fatalf("status = %d, want 401", response.Code)
+			}
+		})
+	}
+
+	cookie, csrf := authenticatedStartSession(t, router)
+	for name, token := range map[string]string{"missing CSRF": "", "wrong CSRF": "wrong-csrf"} {
+		request := newStartRequest(t, hugeMalformed, "text/plain", token, cookie)
+		response := httptest.NewRecorder()
+		router.ServeHTTP(response, request)
+		if response.Code != http.StatusForbidden {
+			t.Fatalf("%s status = %d, want 403", name, response.Code)
+		}
+	}
+	if csrf == "" {
+		t.Fatal("authenticated page did not contain a CSRF token")
+	}
+	if store.startCalls != 0 {
+		t.Fatalf("unauthorized requests called store %d times", store.startCalls)
+	}
+}
+
+func TestStartPurchasesRejectsInvalidUTF8BeforeJSONDecoding(t *testing.T) {
+	validPrefix := []byte(`{"start_key":"` + startKeyForHTTP + `","tasks":[],"start_key":"`)
+	duplicateKeyBypass := append(append([]byte(nil), validPrefix...), 0xff)
+	duplicateKeyBypass = append(duplicateKeyBypass, []byte(`"}`)...)
+	invalidWhitespace := append([]byte(validStartBody()), 0xfe)
+
+	for name, body := range map[string][]byte{
+		"invalid byte after JSON":     invalidWhitespace,
+		"invalid duplicate-key value": duplicateKeyBypass,
+	} {
+		t.Run(name, func(t *testing.T) {
+			store := &startRecordingStore{}
+			router, _ := newRouterWithStore(t, store)
+			cookie, csrf := authenticatedStartSession(t, router)
+			response := serveStartBytes(t, router, body, "application/json", csrf, cookie)
+			if response.Code != http.StatusBadRequest || store.startCalls != 0 {
+				t.Fatalf("status/calls = %d/%d, want 400/0", response.Code, store.startCalls)
+			}
+			if response.Body.Len() != 0 {
+				t.Fatalf("invalid UTF-8 response leaked body %q", response.Body.String())
+			}
+		})
+	}
+}
+
+func TestStartPurchasesEnforcesExact64KiBBodyBoundary(t *testing.T) {
+	const limit = 64 << 10
+	base := validStartBody()
+	for name, test := range map[string]struct {
+		body      string
+		want      int
+		wantCalls int
+	}{
+		"exact limit": {body: base + strings.Repeat(" ", limit-len(base)), want: http.StatusOK, wantCalls: 1},
+		"one over":    {body: base + strings.Repeat(" ", limit-len(base)+1), want: http.StatusRequestEntityTooLarge},
+	} {
+		t.Run(name, func(t *testing.T) {
+			store := &startRecordingStore{startResult: successfulStartResult()}
+			router, _ := newRouterWithStore(t, store)
+			cookie, csrf := authenticatedStartSession(t, router)
+			response := serveStartRequest(t, router, test.body, "application/json", csrf, cookie)
+			if response.Code != test.want || store.startCalls != test.wantCalls {
+				t.Fatalf("status/calls = %d/%d, want %d/%d", response.Code, store.startCalls, test.want, test.wantCalls)
+			}
+		})
+	}
+}
+
+func TestStartPurchasesContentTypeContract(t *testing.T) {
+	for _, contentType := range []string{
+		"application/json",
+		"application/json; charset=utf-8",
+		"application/json;charset=UTF-8",
+	} {
+		t.Run("accept "+contentType, func(t *testing.T) {
+			store := &startRecordingStore{startResult: successfulStartResult()}
+			router, _ := newRouterWithStore(t, store)
+			cookie, csrf := authenticatedStartSession(t, router)
+			response := serveStartRequest(t, router, validStartBody(), contentType, csrf, cookie)
+			if response.Code != http.StatusOK || store.startCalls != 1 {
+				t.Fatalf("status/calls = %d/%d, want 200/1", response.Code, store.startCalls)
+			}
+		})
+	}
+
+	for _, contentType := range []string{
+		"",
+		"text/plain",
+		"application/json-patch+json",
+		"application/json; charset=gbk",
+		"application/json; profile=unapproved",
+		"application/json; charset",
+	} {
+		t.Run("reject "+contentType, func(t *testing.T) {
+			store := &startRecordingStore{}
+			router, _ := newRouterWithStore(t, store)
+			cookie, csrf := authenticatedStartSession(t, router)
+			response := serveStartRequest(t, router, validStartBody(), contentType, csrf, cookie)
+			if response.Code != http.StatusUnsupportedMediaType || store.startCalls != 0 {
+				t.Fatalf("status/calls = %d/%d, want 415/0", response.Code, store.startCalls)
+			}
+		})
+	}
+}
+
+func TestStartPurchasesRejectsMalformedAndOversizedJSON(t *testing.T) {
+	tests := []struct {
+		name      string
+		body      string
+		want      int
+		storeErr  error
+		wantCalls int
+	}{
+		{name: "empty", body: "", want: http.StatusBadRequest},
+		{name: "empty object", body: `{}`, want: http.StatusBadRequest, storeErr: tasks.ErrInvalidStart, wantCalls: 1},
+		{name: "null object", body: `null`, want: http.StatusBadRequest, storeErr: tasks.ErrInvalidStart, wantCalls: 1},
+		{name: "malformed", body: `{`, want: http.StatusBadRequest},
+		{name: "wrong top-level type", body: `[]`, want: http.StatusBadRequest},
+		{name: "unknown field", body: `{"start_key":"` + startKeyForHTTP + `","tasks":[],"created_by":"attacker"}`, want: http.StatusBadRequest},
+		{name: "wrong field type", body: `{"start_key":"` + startKeyForHTTP + `","tasks":[{"task_id":"` + taskIDForHTTP + `","expected_task_version":"1"}]}`, want: http.StatusBadRequest},
+		{name: "second JSON value", body: validStartBody() + `{}`, want: http.StatusBadRequest},
+		{name: "duplicate task ids", body: `{"start_key":"` + startKeyForHTTP + `","tasks":[{"task_id":"` + taskIDForHTTP + `","expected_task_version":1},{"task_id":"` + taskIDForHTTP + `","expected_task_version":1}]}`, want: http.StatusBadRequest, storeErr: tasks.ErrInvalidStart, wantCalls: 1},
+		{name: "oversized first value", body: `{"start_key":"` + strings.Repeat("x", 70<<10), want: http.StatusRequestEntityTooLarge},
+		{name: "oversized trailing whitespace", body: validStartBody() + strings.Repeat(" ", 70<<10), want: http.StatusRequestEntityTooLarge},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			store := &startRecordingStore{startErr: test.storeErr}
+			router, _ := newRouterWithStore(t, store)
+			cookie, csrf := authenticatedStartSession(t, router)
+			response := serveStartRequest(t, router, test.body, "application/json", csrf, cookie)
+			if response.Code != test.want || store.startCalls != test.wantCalls {
+				t.Fatalf("status/calls = %d/%d, want %d/%d", response.Code, store.startCalls, test.want, test.wantCalls)
+			}
+			if response.Body.Len() != 0 {
+				t.Fatalf("error response leaked body %q", response.Body.String())
+			}
+			assertSecurityHeaders(t, response)
+		})
+	}
+}
+
+func TestStartPurchasesUsesAuthenticatedAdminAndReturnsStableSafeResult(t *testing.T) {
+	result := successfulStartResult()
+	store := &startRecordingStore{startResult: result}
+	router, _ := newRouterWithStore(t, store)
+	cookie, csrf := authenticatedStartSession(t, router)
+
+	first := serveStartRequest(t, router, validStartBody(), "application/json; charset=utf-8", csrf, cookie)
+	second := serveStartRequest(t, router, validStartBody(), "application/json", csrf, cookie)
+	for index, response := range []*httptest.ResponseRecorder{first, second} {
+		if response.Code != http.StatusOK {
+			t.Fatalf("response %d status = %d, want 200", index, response.Code)
+		}
+		if got := response.Header().Get("Content-Type"); got != "application/json; charset=utf-8" {
+			t.Fatalf("response content type = %q", got)
+		}
+		var decoded tasks.StartResult
+		if err := json.Unmarshal(response.Body.Bytes(), &decoded); err != nil {
+			t.Fatalf("decode response: %v", err)
+		}
+		if decoded.PaymentAutomated || decoded.AuthorizedCount != 1 || decoded.Tasks[0].AuthorizationID != result.Tasks[0].AuthorizationID {
+			t.Fatalf("unsafe or unstable response = %#v", decoded)
+		}
+		assertSecurityHeaders(t, response)
+	}
+	if store.startCalls != 2 || len(store.createdBy) != 2 || store.createdBy[0] != "admin" || store.createdBy[1] != "admin" {
+		t.Fatalf("store calls/created_by = %d/%#v", store.startCalls, store.createdBy)
+	}
+	for _, command := range store.commands {
+		if command.StartKey != startKeyForHTTP || len(command.Tasks) != 1 || command.Tasks[0].TaskID != taskIDForHTTP || command.Tasks[0].ExpectedTaskVersion != 7 {
+			t.Fatalf("decoded command = %#v", command)
+		}
+	}
+}
+
+func TestStartPurchasesMapsStoreErrorsWithoutLeakingDetails(t *testing.T) {
+	for name, test := range map[string]struct {
+		err  error
+		want int
+	}{
+		"invalid":  {err: tasks.ErrInvalidStart, want: http.StatusBadRequest},
+		"conflict": {err: tasks.ErrStartConflict, want: http.StatusConflict},
+		"internal": {err: errors.New("sqlite secret path and query"), want: http.StatusInternalServerError},
+	} {
+		t.Run(name, func(t *testing.T) {
+			store := &startRecordingStore{startErr: test.err}
+			router, _ := newRouterWithStore(t, store)
+			cookie, csrf := authenticatedStartSession(t, router)
+			response := serveStartRequest(t, router, validStartBody(), "application/json", csrf, cookie)
+			if response.Code != test.want || store.startCalls != 1 {
+				t.Fatalf("status/calls = %d/%d, want %d/1", response.Code, store.startCalls, test.want)
+			}
+			if response.Body.Len() != 0 || strings.Contains(response.Body.String(), "sqlite") {
+				t.Fatalf("error leaked details: %q", response.Body.String())
+			}
+		})
+	}
+}
+
+type startRecordingStore struct {
+	startResult tasks.StartResult
+	startErr    error
+	startCalls  int
+	commands    []tasks.StartCommand
+	createdBy   []string
+}
+
+func (store *startRecordingStore) CreateDraft(_ context.Context, draft tasks.Draft) (tasks.Draft, error) {
+	return draft, nil
+}
+
+func (store *startRecordingStore) ListDrafts(context.Context) ([]tasks.Draft, error) {
+	return nil, nil
+}
+
+func (store *startRecordingStore) ListTasks(context.Context, tasks.TaskFilter) ([]tasks.TaskRow, error) {
+	return nil, nil
+}
+
+func (store *startRecordingStore) StartPurchases(_ context.Context, command tasks.StartCommand, createdBy string) (tasks.StartResult, error) {
+	store.startCalls++
+	store.commands = append(store.commands, command)
+	store.createdBy = append(store.createdBy, createdBy)
+	return store.startResult, store.startErr
+}
+
+func authenticatedStartSession(t *testing.T, router http.Handler) (*http.Cookie, string) {
+	t.Helper()
+	cookie := authenticate(t, router)
+	page := serve(router, http.MethodGet, "/tasks", nil, cookie)
+	if page.Code != http.StatusOK {
+		t.Fatalf("GET /tasks status = %d", page.Code)
+	}
+	return cookie, csrfToken(t, page.Body.String())
+}
+
+func newStartRequest(t *testing.T, body, contentType, csrf string, cookie *http.Cookie) *http.Request {
+	t.Helper()
+	return newStartByteRequest(t, []byte(body), contentType, csrf, cookie)
+}
+
+func newStartByteRequest(t *testing.T, body []byte, contentType, csrf string, cookie *http.Cookie) *http.Request {
+	t.Helper()
+	request := httptest.NewRequest(http.MethodPost, "/tasks/start-purchases", bytes.NewReader(body))
+	if contentType != "" {
+		request.Header.Set("Content-Type", contentType)
+	}
+	if csrf != "" {
+		request.Header.Set("X-CSRF-Token", csrf)
+	}
+	if cookie != nil {
+		request.AddCookie(cookie)
+	}
+	return request
+}
+
+func serveStartBytes(t *testing.T, router http.Handler, body []byte, contentType, csrf string, cookie *http.Cookie) *httptest.ResponseRecorder {
+	t.Helper()
+	response := httptest.NewRecorder()
+	router.ServeHTTP(response, newStartByteRequest(t, body, contentType, csrf, cookie))
+	return response
+}
+
+func serveStartRequest(t *testing.T, router http.Handler, body, contentType, csrf string, cookie *http.Cookie) *httptest.ResponseRecorder {
+	t.Helper()
+	response := httptest.NewRecorder()
+	router.ServeHTTP(response, newStartRequest(t, body, contentType, csrf, cookie))
+	return response
+}
+
+func validStartBody() string {
+	return `{"start_key":"` + startKeyForHTTP + `","tasks":[{"task_id":"` + taskIDForHTTP + `","expected_task_version":7}]}`
+}
+
+func successfulStartResult() tasks.StartResult {
+	expires := time.Date(2026, 8, 4, 2, 3, 4, 0, time.UTC)
+	return tasks.StartResult{
+		StartKey:         startKeyForHTTP,
+		AuthorizedCount:  1,
+		PaymentAutomated: false,
+		Tasks: []tasks.AuthorizedTask{{
+			TaskID:          taskIDForHTTP,
+			TaskVersion:     8,
+			AuthorizationID: "d3c9f507-7473-4fa6-8d71-8786c34c6301",
+			ExpiresAt:       expires,
+		}},
+	}
+}

admin/internal/tasks/authorization.go

@@ -0,0 +1,128 @@
+package tasks
+
+import (
+	"errors"
+	"math"
+	"math/big"
+	"sort"
+	"strings"
+	"time"
+	_ "time/tzdata"
+)
+
+const maxStartItems = 100
+
+var (
+	ErrStartConflict = errors.New("purchase start conflicts with current task state")
+	ErrInvalidStart  = errors.New("invalid purchase start request")
+)
+
+type StartPolicy struct {
+	AuthorizationTTL time.Duration
+	MaxQuantity      int
+	MaxTotalPrice    string
+}
+type StartItem struct {
+	TaskID              string `json:"task_id"`
+	ExpectedTaskVersion int    `json:"expected_task_version"`
+}
+type StartCommand struct {
+	StartKey string      `json:"start_key"`
+	Tasks    []StartItem `json:"tasks"`
+}
+type AuthorizedTask struct {
+	TaskID          string    `json:"task_id"`
+	TaskVersion     int       `json:"task_version"`
+	AuthorizationID string    `json:"authorization_id"`
+	ExpiresAt       time.Time `json:"expires_at"`
+}
+type StartResult struct {
+	StartKey         string           `json:"start_key"`
+	AuthorizedCount  int              `json:"authorized_count"`
+	Tasks            []AuthorizedTask `json:"tasks"`
+	PaymentAutomated bool             `json:"payment_automated"`
+}
+type TaskFilter struct{ Keyword, Status, CreatedFrom, CreatedTo string }
+type TaskRow struct {
+	ID, Title, GoodsID, SKUColor, SKUSize, MaxTotalPrice, Status string
+	Quantity, Version                                            int
+	CreatedAt                                                    time.Time
+}
+
+func normalizeCents(value string) (string, *big.Int, bool) {
+	if value == "" || strings.TrimSpace(value) != value {
+		return "", nil, false
+	}
+	parts := strings.Split(value, ".")
+	if len(parts) != 2 || len(parts[0]) == 0 || len(parts[1]) != 2 || (len(parts[0]) > 1 && parts[0][0] == '0') {
+		return "", nil, false
+	}
+	for _, part := range parts {
+		for _, ch := range part {
+			if ch < '0' || ch > '9' {
+				return "", nil, false
+			}
+		}
+	}
+	cents := new(big.Int)
+	if _, ok := cents.SetString(parts[0]+parts[1], 10); !ok || cents.Sign() <= 0 {
+		return "", nil, false
+	}
+	return value, cents, true
+}
+
+func startItems(command StartCommand) ([]StartItem, error) {
+	if !validUUID(command.StartKey) || len(command.Tasks) == 0 || len(command.Tasks) > maxStartItems {
+		return nil, ErrInvalidStart
+	}
+	items := append([]StartItem(nil), command.Tasks...)
+	sort.Slice(items, func(i, j int) bool { return items[i].TaskID < items[j].TaskID })
+	for i, item := range items {
+		if !validUUID(item.TaskID) || item.ExpectedTaskVersion <= 0 || item.ExpectedTaskVersion == math.MaxInt || (i > 0 && item.TaskID == items[i-1].TaskID) {
+			return nil, ErrInvalidStart
+		}
+	}
+	return items, nil
+}
+
+func validTaskStatus(value string) bool {
+	if value == "" {
+		return true
+	}
+	for _, status := range []string{"DRAFT", "PENDING", "CLAIMED", "ORDERING", "NEEDS_MANUAL", "WAITING_PAYMENT", "RECONCILIATION_REQUIRED", "SUCCEEDED", "FAILED", "CANCELED"} {
+		if value == status {
+			return true
+		}
+	}
+	return false
+}
+
+func ShanghaiRange(from, to string) (time.Time, time.Time, error) {
+	if from == "" && to == "" {
+		return time.Time{}, time.Time{}, nil
+	}
+	location, err := time.LoadLocation("Asia/Shanghai")
+	if err != nil {
+		return time.Time{}, time.Time{}, err
+	}
+	parse := func(value string) (time.Time, error) { return time.ParseInLocation("2006-01-02", value, location) }
+	var start, end time.Time
+	if from != "" {
+		start, err = parse(from)
+		if err != nil {
+			return time.Time{}, time.Time{}, ErrInvalidStart
+		}
+		start = start.UTC()
+	}
+	if to != "" {
+		end, err = parse(to)
+		if err != nil {
+			return time.Time{}, time.Time{}, ErrInvalidStart
+		}
+		end = end.AddDate(0, 0, 1).UTC()
+	}
+	if !start.IsZero() && !end.IsZero() && !start.Before(end) {
+		return time.Time{}, time.Time{}, ErrInvalidStart
+	}
+	return start, end, nil
+}

admin/internal/tasks/start_purchases_store_test.go

@@ -0,0 +1,424 @@
+package tasks
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"fmt"
+	"math"
+	"reflect"
+	"sort"
+	"sync"
+	"testing"
+	"time"
+
+	"cmbuyer/admin/internal/migrations"
+)
+
+var fixedStartTime = time.Date(2026, 8, 4, 9, 2, 3, 456000000, time.FixedZone("UTC+8", 8*60*60))
+
+func TestStartPurchasesPersistsCompleteSnapshotsForOneAndHundredTasks(t *testing.T) {
+	for _, count := range []int{1, 100} {
+		t.Run(fmt.Sprintf("%d tasks", count), func(t *testing.T) {
+			database := migratedDatabase(t)
+			store := configuredStartStore(t, database)
+			store.now = func() time.Time { return fixedStartTime }
+			items := make([]StartItem, 0, count)
+			wantDrafts := make(map[string]Draft, count)
+			for index := 1; index <= count; index++ {
+				id := startTestUUID(index)
+				draft := Draft{
+					ID:            id,
+					Title:         fmt.Sprintf("task-%03d", index),
+					GoodsID:       fmt.Sprintf("937122%06d", index),
+					SKUColor:      fmt.Sprintf("color-%03d", index),
+					SKUSize:       fmt.Sprintf("size-%03d", index),
+					Quantity:      index%10 + 1,
+					MaxTotalPrice: fmt.Sprintf("%d.%02d", index+10, index%100),
+				}
+				if _, err := store.CreateDraft(context.Background(), draft); err != nil {
+					t.Fatalf("create draft %d: %v", index, err)
+				}
+				items = append(items, StartItem{TaskID: id, ExpectedTaskVersion: 1})
+				wantDrafts[id] = draft
+			}
+			sort.Slice(items, func(i, j int) bool { return items[i].TaskID > items[j].TaskID })
+			command := StartCommand{StartKey: startTestUUID(1001 + count), Tasks: items}
+
+			result, err := store.StartPurchases(context.Background(), command, "authenticated-admin")
+			if err != nil {
+				t.Fatalf("StartPurchases: %v", err)
+			}
+			if result.StartKey != command.StartKey || result.AuthorizedCount != count || result.PaymentAutomated || len(result.Tasks) != count {
+				t.Fatalf("result = %#v", result)
+			}
+			wantCreated := fixedStartTime.UTC()
+			wantExpires := wantCreated.Add(15 * time.Minute)
+			seenAuthorizationIDs := map[string]bool{}
+			for index, authorized := range result.Tasks {
+				if index > 0 && result.Tasks[index-1].TaskID >= authorized.TaskID {
+					t.Fatalf("result is not in canonical task order: %#v", result.Tasks)
+				}
+				if authorized.TaskVersion != 2 || !authorized.ExpiresAt.Equal(wantExpires) || !validUUID(authorized.AuthorizationID) || seenAuthorizationIDs[authorized.AuthorizationID] {
+					t.Fatalf("authorized task = %#v", authorized)
+				}
+				seenAuthorizationIDs[authorized.AuthorizationID] = true
+				want := wantDrafts[authorized.TaskID]
+				var taskStatus, taskUpdated, authTaskID, authStartKey, goodsID, color, size, priceCap, authStatus, createdBy, createdAt, expiresAt string
+				var taskVersion, authTaskVersion, quantity int
+				err := database.QueryRow(`
+					SELECT t.status,t.version,t.updated_at,
+					       a.task_id,a.task_version,a.start_key,a.goods_id,a.sku_color,a.sku_size,a.quantity,a.total_price_cap,a.status,a.created_by,a.created_at,a.expires_at
+					FROM tasks t JOIN order_authorizations a ON a.task_id=t.id WHERE a.id=?`, authorized.AuthorizationID).
+					Scan(&taskStatus, &taskVersion, &taskUpdated, &authTaskID, &authTaskVersion, &authStartKey, &goodsID, &color, &size, &quantity, &priceCap, &authStatus, &createdBy, &createdAt, &expiresAt)
+				if err != nil {
+					t.Fatalf("read authorization snapshot: %v", err)
+				}
+				if taskStatus != "PENDING" || taskVersion != 2 || taskUpdated != wantCreated.Format(time.RFC3339Nano) ||
+					authTaskID != want.ID || authTaskVersion != 2 || authStartKey != command.StartKey ||
+					goodsID != want.GoodsID || color != want.SKUColor || size != want.SKUSize || quantity != want.Quantity || priceCap != want.MaxTotalPrice ||
+					authStatus != "ACTIVE" || createdBy != "authenticated-admin" || createdAt != wantCreated.Format(time.RFC3339Nano) || expiresAt != wantExpires.Format(time.RFC3339Nano) {
+					t.Fatalf("stored task/authorization mismatch for %s", want.ID)
+				}
+			}
+			var distinctCreated, distinctExpires int
+			if err := database.QueryRow(`SELECT COUNT(DISTINCT created_at), COUNT(DISTINCT expires_at) FROM order_authorizations WHERE start_key=?`, command.StartKey).Scan(&distinctCreated, &distinctExpires); err != nil {
+				t.Fatal(err)
+			}
+			if distinctCreated != 1 || distinctExpires != 1 {
+				t.Fatalf("batch timestamps are not shared: created=%d expires=%d", distinctCreated, distinctExpires)
+			}
+		})
+	}
+}
+
+func TestStartPurchasesRejectsInvalidCommandsAndPolicyWithoutWrites(t *testing.T) {
+	validItem := StartItem{TaskID: startTestUUID(1), ExpectedTaskVersion: 1}
+	hundredOne := make([]StartItem, 101)
+	for index := range hundredOne {
+		hundredOne[index] = StartItem{TaskID: startTestUUID(index + 1), ExpectedTaskVersion: 1}
+	}
+	for name, command := range map[string]StartCommand{
+		"invalid start key": {StartKey: "not-a-uuid", Tasks: []StartItem{validItem}},
+		"empty tasks":       {StartKey: startTestUUID(1001)},
+		"over batch limit":  {StartKey: startTestUUID(1001), Tasks: hundredOne},
+		"invalid task id":   {StartKey: startTestUUID(1001), Tasks: []StartItem{{TaskID: "1", ExpectedTaskVersion: 1}}},
+		"duplicate task":    {StartKey: startTestUUID(1001), Tasks: []StartItem{validItem, validItem}},
+		"zero version":      {StartKey: startTestUUID(1001), Tasks: []StartItem{{TaskID: validItem.TaskID}}},
+		"overflow version":  {StartKey: startTestUUID(1001), Tasks: []StartItem{{TaskID: validItem.TaskID, ExpectedTaskVersion: math.MaxInt}}},
+	} {
+		t.Run(name, func(t *testing.T) {
+			database := migratedDatabase(t)
+			store := configuredStartStore(t, database)
+			_, err := store.StartPurchases(context.Background(), command, "admin")
+			if !errors.Is(err, ErrInvalidStart) {
+				t.Fatalf("error = %v, want ErrInvalidStart", err)
+			}
+			assertAuthorizationCount(t, database, 0)
+		})
+	}
+
+	for name, mutate := range map[string]func(*SQLiteStore){
+		"zero ttl":      func(store *SQLiteStore) { store.policy.AuthorizationTTL = 0 },
+		"zero quantity": func(store *SQLiteStore) { store.policy.MaxQuantity = 0 },
+		"bad max price": func(store *SQLiteStore) { store.policy.MaxTotalPrice = "999" },
+	} {
+		t.Run(name, func(t *testing.T) {
+			database := migratedDatabase(t)
+			store := configuredStartStore(t, database)
+			createStartDraft(t, store, validItem.TaskID)
+			mutate(store)
+			_, err := store.StartPurchases(context.Background(), StartCommand{StartKey: startTestUUID(1001), Tasks: []StartItem{validItem}}, "admin")
+			if !errors.Is(err, ErrInvalidStart) {
+				t.Fatalf("error = %v, want ErrInvalidStart", err)
+			}
+			assertDraftUnchanged(t, database, validItem.TaskID)
+			assertAuthorizationCount(t, database, 0)
+		})
+	}
+
+	database := migratedDatabase(t)
+	store := configuredStartStore(t, database)
+	createStartDraft(t, store, validItem.TaskID)
+	_, err := store.StartPurchases(context.Background(), StartCommand{StartKey: startTestUUID(1001), Tasks: []StartItem{validItem}}, "")
+	if !errors.Is(err, ErrInvalidStart) {
+		t.Fatalf("empty created_by error = %v", err)
+	}
+	assertDraftUnchanged(t, database, validItem.TaskID)
+}
+
+func TestStartPurchasesRejectsEveryTaskConflictWithoutAuthorization(t *testing.T) {
+	for name, mutate := range map[string]func(*testing.T, *SQLiteStore, string, *StartItem){
+		"missing": func(_ *testing.T, _ *SQLiteStore, _ string, item *StartItem) {
+			item.TaskID = startTestUUID(99)
+		},
+		"not draft": func(t *testing.T, store *SQLiteStore, id string, _ *StartItem) {
+			execTestSQL(t, store.database, `UPDATE tasks SET status='PENDING' WHERE id=?`, id)
+		},
+		"version mismatch": func(_ *testing.T, _ *SQLiteStore, _ string, item *StartItem) {
+			item.ExpectedTaskVersion = 2
+		},
+		"empty goods id": func(t *testing.T, store *SQLiteStore, id string, _ *StartItem) {
+			execTestSQL(t, store.database, `UPDATE tasks SET goods_id='' WHERE id=?`, id)
+		},
+		"nondigit goods id": func(t *testing.T, store *SQLiteStore, id string, _ *StartItem) {
+			execTestSQL(t, store.database, `UPDATE tasks SET goods_id='937x' WHERE id=?`, id)
+		},
+		"empty color": func(t *testing.T, store *SQLiteStore, id string, _ *StartItem) {
+			execTestSQL(t, store.database, `UPDATE tasks SET sku_color='' WHERE id=?`, id)
+		},
+		"empty size": func(t *testing.T, store *SQLiteStore, id string, _ *StartItem) {
+			execTestSQL(t, store.database, `UPDATE tasks SET sku_size='' WHERE id=?`, id)
+		},
+		"quantity over policy": func(_ *testing.T, store *SQLiteStore, _ string, _ *StartItem) {
+			store.policy.MaxQuantity = 1
+		},
+		"noncanonical price one decimal": func(t *testing.T, store *SQLiteStore, id string, _ *StartItem) {
+			execTestSQL(t, store.database, `UPDATE tasks SET max_total_price='12.8' WHERE id=?`, id)
+		},
+		"noncanonical leading zero": func(t *testing.T, store *SQLiteStore, id string, _ *StartItem) {
+			execTestSQL(t, store.database, `UPDATE tasks SET max_total_price='012.80' WHERE id=?`, id)
+		},
+		"price over policy": func(_ *testing.T, store *SQLiteStore, _ string, _ *StartItem) {
+			store.policy.MaxTotalPrice = "12.79"
+		},
+	} {
+		t.Run(name, func(t *testing.T) {
+			database := migratedDatabase(t)
+			store := configuredStartStore(t, database)
+			id := startTestUUID(1)
+			createStartDraft(t, store, id)
+			item := StartItem{TaskID: id, ExpectedTaskVersion: 1}
+			mutate(t, store, id, &item)
+			_, err := store.StartPurchases(context.Background(), StartCommand{StartKey: startTestUUID(1001), Tasks: []StartItem{item}}, "admin")
+			if !errors.Is(err, ErrStartConflict) {
+				t.Fatalf("error = %v, want ErrStartConflict", err)
+			}
+			assertAuthorizationCount(t, database, 0)
+		})
+	}
+}
+
+func TestStartPurchasesRollsBackWholeBatchForLateConflictAndSQLFailure(t *testing.T) {
+	for _, test := range []struct {
+		name       string
+		breakBatch func(*testing.T, *SQLiteStore, string)
+	}{
+		{name: "late validation conflict", breakBatch: func(t *testing.T, store *SQLiteStore, secondID string) {
+			execTestSQL(t, store.database, `UPDATE tasks SET sku_size='' WHERE id=?`, secondID)
+		}},
+		{name: "late SQL failure", breakBatch: func(t *testing.T, store *SQLiteStore, secondID string) {
+			statement := fmt.Sprintf(`CREATE TRIGGER reject_second_authorization BEFORE INSERT ON order_authorizations WHEN NEW.task_id='%s' BEGIN SELECT RAISE(ABORT, 'test failure'); END`, secondID)
+			execTestSQL(t, store.database, statement)
+		}},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			database := migratedDatabase(t)
+			store := configuredStartStore(t, database)
+			firstID, secondID := startTestUUID(1), startTestUUID(2)
+			createStartDraft(t, store, firstID)
+			createStartDraft(t, store, secondID)
+			test.breakBatch(t, store, secondID)
+			_, err := store.StartPurchases(context.Background(), StartCommand{StartKey: startTestUUID(1001), Tasks: []StartItem{{TaskID: firstID, ExpectedTaskVersion: 1}, {TaskID: secondID, ExpectedTaskVersion: 1}}}, "admin")
+			if err == nil {
+				t.Fatal("StartPurchases unexpectedly succeeded")
+			}
+			assertDraftUnchanged(t, database, firstID)
+			var secondStatus string
+			var secondVersion int
+			if err := database.QueryRow(`SELECT status,version FROM tasks WHERE id=?`, secondID).Scan(&secondStatus, &secondVersion); err != nil {
+				t.Fatal(err)
+			}
+			if secondStatus != "DRAFT" || secondVersion != 1 {
+				t.Fatalf("second task = %s/v%d, want DRAFT/v1", secondStatus, secondVersion)
+			}
+			assertAuthorizationCount(t, database, 0)
+		})
+	}
+}
+
+func TestStartPurchasesReplayIsStableAndRejectsDifferentOrIncompleteSets(t *testing.T) {
+	database := migratedDatabase(t)
+	store := configuredStartStore(t, database)
+	firstID, secondID, thirdID := startTestUUID(1), startTestUUID(2), startTestUUID(3)
+	for _, id := range []string{firstID, secondID, thirdID} {
+		createStartDraft(t, store, id)
+	}
+	command := StartCommand{StartKey: startTestUUID(1001), Tasks: []StartItem{{TaskID: secondID, ExpectedTaskVersion: 1}, {TaskID: firstID, ExpectedTaskVersion: 1}}}
+	first, err := store.StartPurchases(context.Background(), command, "admin")
+	if err != nil {
+		t.Fatal(err)
+	}
+	command.Tasks[0], command.Tasks[1] = command.Tasks[1], command.Tasks[0]
+	replay, err := store.StartPurchases(context.Background(), command, "admin")
+	if err != nil || !reflect.DeepEqual(replay, first) {
+		t.Fatalf("replay = (%#v, %v), want %#v", replay, err, first)
+	}
+	assertAuthorizationCount(t, database, 2)
+
+	conflicting := []StartCommand{
+		{StartKey: command.StartKey, Tasks: command.Tasks[:1]},
+		{StartKey: command.StartKey, Tasks: []StartItem{{TaskID: firstID, ExpectedTaskVersion: 2}, {TaskID: secondID, ExpectedTaskVersion: 1}}},
+		{StartKey: command.StartKey, Tasks: []StartItem{{TaskID: firstID, ExpectedTaskVersion: 1}, {TaskID: secondID, ExpectedTaskVersion: 1}, {TaskID: thirdID, ExpectedTaskVersion: 1}}},
+	}
+	for _, changed := range conflicting {
+		if _, err := store.StartPurchases(context.Background(), changed, "admin"); !errors.Is(err, ErrStartConflict) {
+			t.Fatalf("different payload error = %v", err)
+		}
+	}
+	assertAuthorizationCount(t, database, 2)
+	assertDraftUnchanged(t, database, thirdID)
+
+	execTestSQL(t, database, `DELETE FROM order_authorizations WHERE task_id=?`, secondID)
+	if _, err := store.StartPurchases(context.Background(), command, "admin"); !errors.Is(err, ErrStartConflict) {
+		t.Fatalf("incomplete replay error = %v", err)
+	}
+	assertAuthorizationCount(t, database, 1)
+}
+
+func TestStartPurchasesConcurrentReplayAndVersionRace(t *testing.T) {
+	t.Run("same key replays one stable result", func(t *testing.T) {
+		database := migratedDatabase(t)
+		store := configuredStartStore(t, database)
+		id := startTestUUID(1)
+		createStartDraft(t, store, id)
+		command := StartCommand{StartKey: startTestUUID(1001), Tasks: []StartItem{{TaskID: id, ExpectedTaskVersion: 1}}}
+		const callers = 16
+		start := make(chan struct{})
+		results := make(chan StartResult, callers)
+		errorsChannel := make(chan error, callers)
+		var group sync.WaitGroup
+		for range callers {
+			group.Add(1)
+			go func() {
+				defer group.Done()
+				<-start
+				result, err := store.StartPurchases(context.Background(), command, "admin")
+				if err != nil {
+					errorsChannel <- err
+					return
+				}
+				results <- result
+			}()
+		}
+		close(start)
+		group.Wait()
+		close(results)
+		close(errorsChannel)
+		for err := range errorsChannel {
+			t.Fatalf("concurrent replay: %v", err)
+		}
+		var want StartResult
+		for result := range results {
+			if want.StartKey == "" {
+				want = result
+			} else if !reflect.DeepEqual(result, want) {
+				t.Fatalf("unstable replay: %#v != %#v", result, want)
+			}
+		}
+		assertAuthorizationCount(t, database, 1)
+		var version int
+		if err := database.QueryRow(`SELECT version FROM tasks WHERE id=?`, id).Scan(&version); err != nil || version != 2 {
+			t.Fatalf("task version = %d, err=%v", version, err)
+		}
+	})
+
+	t.Run("different keys race one expected version", func(t *testing.T) {
+		database := migratedDatabase(t)
+		store := configuredStartStore(t, database)
+		id := startTestUUID(1)
+		createStartDraft(t, store, id)
+		start := make(chan struct{})
+		errorsChannel := make(chan error, 2)
+		var group sync.WaitGroup
+		for _, key := range []string{startTestUUID(1001), startTestUUID(1002)} {
+			group.Add(1)
+			go func(startKey string) {
+				defer group.Done()
+				<-start
+				_, err := store.StartPurchases(context.Background(), StartCommand{StartKey: startKey, Tasks: []StartItem{{TaskID: id, ExpectedTaskVersion: 1}}}, "admin")
+				errorsChannel <- err
+			}(key)
+		}
+		close(start)
+		group.Wait()
+		close(errorsChannel)
+		successes, conflicts := 0, 0
+		for err := range errorsChannel {
+			switch {
+			case err == nil:
+				successes++
+			case errors.Is(err, ErrStartConflict):
+				conflicts++
+			default:
+				t.Fatalf("unexpected race error: %v", err)
+			}
+		}
+		if successes != 1 || conflicts != 1 {
+			t.Fatalf("success/conflict = %d/%d, want 1/1", successes, conflicts)
+		}
+		assertAuthorizationCount(t, database, 1)
+	})
+}
+
+func TestSQLiteStoreRejectsV1SchemaAtStartup(t *testing.T) {
+	database := openDatabase(t)
+	if err := migrations.Run(context.Background(), database, migrationDirectory(t), "up-by-one"); err != nil {
+		t.Fatalf("migrate to v1: %v", err)
+	}
+	if _, err := NewSQLiteStore(database); err == nil {
+		t.Fatal("NewSQLiteStore accepted the v1 two-pass schema")
+	}
+}
+
+func configuredStartStore(t *testing.T, database *sql.DB) *SQLiteStore {
+	t.Helper()
+	store, err := NewSQLiteStore(database)
+	if err != nil {
+		t.Fatalf("NewSQLiteStore: %v", err)
+	}
+	store.SetStartPolicy(StartPolicy{AuthorizationTTL: 15 * time.Minute, MaxQuantity: 10, MaxTotalPrice: "999.99"})
+	return store
+}
+
+func createStartDraft(t *testing.T, store *SQLiteStore, id string) {
+	t.Helper()
+	draft := Draft{ID: id, Title: "test", GoodsID: "937122477375", SKUColor: "黑色", SKUSize: "M", Quantity: 2, MaxTotalPrice: "12.80"}
+	if _, err := store.CreateDraft(context.Background(), draft); err != nil {
+		t.Fatalf("CreateDraft: %v", err)
+	}
+}
+
+func startTestUUID(number int) string {
+	return fmt.Sprintf("%08x-1234-4abc-a123-%012x", number, number)
+}
+
+func assertAuthorizationCount(t *testing.T, database *sql.DB, want int) {
+	t.Helper()
+	var got int
+	if err := database.QueryRow(`SELECT COUNT(*) FROM order_authorizations`).Scan(&got); err != nil {
+		t.Fatal(err)
+	}
+	if got != want {
+		t.Fatalf("authorization count = %d, want %d", got, want)
+	}
+}
+
+func assertDraftUnchanged(t *testing.T, database *sql.DB, id string) {
+	t.Helper()
+	var status string
+	var version int
+	if err := database.QueryRow(`SELECT status,version FROM tasks WHERE id=?`, id).Scan(&status, &version); err != nil {
+		t.Fatal(err)
+	}
+	if status != "DRAFT" || version != 1 {
+		t.Fatalf("task %s = %s/v%d, want DRAFT/v1", id, status, version)
+	}
+}
+
+func execTestSQL(t *testing.T, database *sql.DB, statement string, arguments ...any) {
+	t.Helper()
+	if _, err := database.Exec(statement, arguments...); err != nil {
+		t.Fatalf("execute test SQL: %v", err)
+	}
+}

admin/internal/tasks/start_store.go

@@ -0,0 +1,229 @@
+package tasks
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"strings"
+	"time"
+
+	"cmbuyer/admin/internal/domain"
+)
+
+// ErrInvalidFilter 表示任务筛选值无效，路由应按字段重新渲染而不是泄露内部错误。
+var ErrInvalidFilter = errors.New("invalid task filter")
+
+// SetStartPolicy is called during startup; policy is explicit because authorization limits must not be implicit defaults.
+func (store *SQLiteStore) SetStartPolicy(policy StartPolicy) { store.policy = policy }
+
+func (store *SQLiteStore) ListTasks(ctx context.Context, filter TaskFilter) ([]TaskRow, error) {
+	if !ValidateTaskFilter(filter).Valid() {
+		return nil, ErrInvalidFilter
+	}
+	from, to, err := ShanghaiRange(filter.CreatedFrom, filter.CreatedTo)
+	if err != nil {
+		return nil, ErrInvalidFilter
+	}
+	clauses, args := []string{"1=1"}, []any{}
+	if filter.Status != "" {
+		clauses = append(clauses, "status = ?")
+		args = append(args, filter.Status)
+	}
+	if filter.Keyword != "" {
+		escaped := strings.NewReplacer("\\", "\\\\", "%", "\\%", "_", "\\_").Replace(filter.Keyword)
+		clauses = append(clauses, "(title LIKE ? ESCAPE '\\' OR goods_id LIKE ? ESCAPE '\\')")
+		args = append(args, "%"+escaped+"%", "%"+escaped+"%")
+	}
+	if !from.IsZero() {
+		clauses = append(clauses, "julianday(created_at) >= julianday(?)")
+		args = append(args, from.Format(time.RFC3339Nano))
+	}
+	if !to.IsZero() {
+		clauses = append(clauses, "julianday(created_at) < julianday(?)")
+		args = append(args, to.Format(time.RFC3339Nano))
+	}
+	rows, err := store.database.QueryContext(ctx, "SELECT id,title,goods_id,sku_color,sku_size,quantity,max_total_price,status,version,created_at FROM tasks WHERE "+strings.Join(clauses, " AND ")+" ORDER BY julianday(created_at) DESC,rowid DESC", args...)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	result := []TaskRow{}
+	for rows.Next() {
+		var item TaskRow
+		var created string
+		if err := rows.Scan(&item.ID, &item.Title, &item.GoodsID, &item.SKUColor, &item.SKUSize, &item.Quantity, &item.MaxTotalPrice, &item.Status, &item.Version, &created); err != nil {
+			return nil, err
+		}
+		item.CreatedAt, err = time.Parse(time.RFC3339Nano, created)
+		if err != nil {
+			return nil, err
+		}
+		result = append(result, item)
+	}
+	return result, rows.Err()
+}
+
+// ValidateTaskFilter 返回可关联到字段的错误，使服务端页面拒绝篡改参数时仍能保留输入值。
+func ValidateTaskFilter(filter TaskFilter) Errors {
+	validation := Errors{}
+	if !validTaskStatus(filter.Status) {
+		validation["status"] = "请选择有效的任务状态。"
+	}
+	location, err := time.LoadLocation("Asia/Shanghai")
+	if err != nil {
+		validation["created_from"] = "日期筛选暂不可用，请稍后重试。"
+		validation["created_to"] = "日期筛选暂不可用，请稍后重试。"
+		return validation
+	}
+	parseDate := func(field, value string) (time.Time, bool) {
+		if value == "" {
+			return time.Time{}, true
+		}
+		parsed, parseErr := time.ParseInLocation("2006-01-02", value, location)
+		if parseErr != nil {
+			validation[field] = "请输入有效日期。"
+			return time.Time{}, false
+		}
+		return parsed, true
+	}
+	from, fromOK := parseDate("created_from", filter.CreatedFrom)
+	to, toOK := parseDate("created_to", filter.CreatedTo)
+	if fromOK && toOK && !from.IsZero() && !to.IsZero() && from.After(to) {
+		validation["created_to"] = "结束日期不能早于开始日期。"
+	}
+	return validation
+}
+
+func (store *SQLiteStore) StartPurchases(ctx context.Context, command StartCommand, createdBy string) (StartResult, error) {
+	items, err := startItems(command)
+	if err != nil || createdBy == "" {
+		return StartResult{}, ErrInvalidStart
+	}
+	if store.policy.AuthorizationTTL <= 0 || store.policy.MaxQuantity <= 0 {
+		return StartResult{}, ErrInvalidStart
+	}
+	_, ceiling, ok := normalizeCents(store.policy.MaxTotalPrice)
+	if !ok {
+		return StartResult{}, ErrInvalidStart
+	}
+	writeCtx, cancel := context.WithTimeout(ctx, sqliteWriteTimeout)
+	defer cancel()
+	select {
+	case store.writeGate <- struct{}{}:
+		defer func() { <-store.writeGate }()
+	case <-writeCtx.Done():
+		return StartResult{}, writeCtx.Err()
+	}
+	tx, err := store.database.BeginTx(writeCtx, nil)
+	if err != nil {
+		return StartResult{}, err
+	}
+	defer tx.Rollback()
+	// Replay precedes any DRAFT check. One service process serializes this check with creation; SQLite uniqueness remains the cross-transaction backstop.
+	result, found, err := replayStart(writeCtx, tx, command.StartKey, items)
+	if err != nil {
+		return StartResult{}, err
+	}
+	if found {
+		if err := tx.Commit(); err != nil {
+			return StartResult{}, err
+		}
+		return result, nil
+	}
+	now := store.now().UTC()
+	expires := now.Add(store.policy.AuthorizationTTL)
+	result = StartResult{StartKey: command.StartKey, AuthorizedCount: len(items), Tasks: make([]AuthorizedTask, 0, len(items)), PaymentAutomated: false}
+	for _, item := range items {
+		var title, goods, color, size, price, status string
+		var quantity, version int
+		if err := tx.QueryRowContext(writeCtx, "SELECT title,goods_id,sku_color,sku_size,quantity,max_total_price,status,version FROM tasks WHERE id=?", item.TaskID).Scan(&title, &goods, &color, &size, &quantity, &price, &status, &version); err != nil {
+			if err == sql.ErrNoRows {
+				return StartResult{}, ErrStartConflict
+			}
+			return StartResult{}, err
+		}
+		if status != "DRAFT" || version != item.ExpectedTaskVersion || !goodsIDValid(goods) || color == "" || size == "" || quantity < 1 || quantity > store.policy.MaxQuantity {
+			return StartResult{}, ErrStartConflict
+		}
+		canonical, cents, ok := normalizeCents(price)
+		if !ok || canonical != price || cents.Cmp(ceiling) > 0 {
+			return StartResult{}, ErrStartConflict
+		}
+		if _, err := domain.TransitionTask(domain.TaskStatusDraft, domain.TaskStatusPending); err != nil {
+			return StartResult{}, err
+		}
+		id, err := NewCreateKey()
+		if err != nil {
+			return StartResult{}, err
+		}
+		next := version + 1
+		if _, err = tx.ExecContext(writeCtx, "INSERT INTO order_authorizations (id,task_id,task_version,start_key,goods_id,sku_color,sku_size,quantity,total_price_cap,status,created_by,created_at,expires_at) VALUES (?,?,?,?,?,?,?,?,?,'ACTIVE',?,?,?)", id, item.TaskID, next, command.StartKey, goods, color, size, quantity, price, createdBy, now.Format(time.RFC3339Nano), expires.Format(time.RFC3339Nano)); err != nil {
+			return StartResult{}, err
+		}
+		updated, err := tx.ExecContext(writeCtx, "UPDATE tasks SET status='PENDING',version=version+1,updated_at=? WHERE id=? AND status='DRAFT' AND version=?", now.Format(time.RFC3339Nano), item.TaskID, version)
+		if err != nil {
+			return StartResult{}, err
+		}
+		affected, err := updated.RowsAffected()
+		if err != nil {
+			return StartResult{}, err
+		}
+		if affected != 1 {
+			return StartResult{}, ErrStartConflict
+		}
+		result.Tasks = append(result.Tasks, AuthorizedTask{TaskID: item.TaskID, TaskVersion: next, AuthorizationID: id, ExpiresAt: expires})
+	}
+	if err := tx.Commit(); err != nil {
+		return StartResult{}, err
+	}
+	return result, nil
+}
+
+func goodsIDValid(value string) bool {
+	if value == "" {
+		return false
+	}
+	for _, ch := range value {
+		if ch < '0' || ch > '9' {
+			return false
+		}
+	}
+	return true
+}
+
+func replayStart(ctx context.Context, tx *sql.Tx, startKey string, items []StartItem) (StartResult, bool, error) {
+	rows, err := tx.QueryContext(ctx, "SELECT id,task_id,task_version,expires_at FROM order_authorizations WHERE start_key=? ORDER BY task_id", startKey)
+	if err != nil {
+		return StartResult{}, false, err
+	}
+	defer rows.Close()
+	result := StartResult{StartKey: startKey, PaymentAutomated: false}
+	for rows.Next() {
+		var item AuthorizedTask
+		var expires string
+		if err := rows.Scan(&item.AuthorizationID, &item.TaskID, &item.TaskVersion, &expires); err != nil {
+			return StartResult{}, false, err
+		}
+		item.ExpiresAt, err = time.Parse(time.RFC3339Nano, expires)
+		if err != nil {
+			return StartResult{}, false, err
+		}
+		result.Tasks = append(result.Tasks, item)
+	}
+	if err := rows.Err(); err != nil {
+		return StartResult{}, false, err
+	}
+	if len(result.Tasks) == 0 {
+		return StartResult{}, false, nil
+	}
+	if len(result.Tasks) != len(items) {
+		return StartResult{}, false, ErrStartConflict
+	}
+	for i := range items {
+		if result.Tasks[i].TaskID != items[i].TaskID || result.Tasks[i].TaskVersion-1 != items[i].ExpectedTaskVersion {
+			return StartResult{}, false, ErrStartConflict
+		}
+	}
+	result.AuthorizedCount = len(result.Tasks)
+	return result, true, nil
+}

admin/internal/tasks/start_store_test.go

@@ -0,0 +1,195 @@
+package tasks
+
+import (
+	"context"
+	"database/sql"
+	"errors"
+	"testing"
+	"time"
+)
+
+func TestListTasksTreatsLikeMetacharactersLiterally(t *testing.T) {
+	database := migratedDatabase(t)
+	store, err := NewSQLiteStore(database)
+	if err != nil {
+		t.Fatal(err)
+	}
+	created := "2026-08-04T01:00:00Z"
+	insertTaskRow(t, database, "percent", "100%纯棉", "100", "DRAFT", created)
+	insertTaskRow(t, database, "underscore", "尺码_A", "101", "DRAFT", created)
+	insertTaskRow(t, database, "backslash", `路径\名称`, "102", "DRAFT", created)
+	insertTaskRow(t, database, "plain", "普通商品", "103", "DRAFT", created)
+
+	for _, test := range []struct {
+		keyword string
+		wantID  string
+	}{
+		{keyword: "%", wantID: "percent"},
+		{keyword: "_", wantID: "underscore"},
+		{keyword: `\`, wantID: "backslash"},
+	} {
+		t.Run(test.wantID, func(t *testing.T) {
+			rows, err := store.ListTasks(context.Background(), TaskFilter{Keyword: test.keyword})
+			if err != nil {
+				t.Fatal(err)
+			}
+			if len(rows) != 1 || rows[0].ID != test.wantID {
+				t.Fatalf("keyword %q rows = %#v, want only %q", test.keyword, rows, test.wantID)
+			}
+		})
+	}
+}
+
+func TestListTasksSupportsEveryStatusAndEmptyMeansAll(t *testing.T) {
+	database := migratedDatabase(t)
+	store, err := NewSQLiteStore(database)
+	if err != nil {
+		t.Fatal(err)
+	}
+	statuses := []string{"DRAFT", "PENDING", "CLAIMED", "ORDERING", "NEEDS_MANUAL", "WAITING_PAYMENT", "RECONCILIATION_REQUIRED", "SUCCEEDED", "FAILED", "CANCELED"}
+	for index, status := range statuses {
+		insertTaskRow(t, database, status, status, "200", status, time.Date(2026, 8, 4, 1, 0, index, 0, time.UTC).Format(time.RFC3339Nano))
+	}
+
+	all, err := store.ListTasks(context.Background(), TaskFilter{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(all) != len(statuses) {
+		t.Fatalf("all-status rows = %d, want %d", len(all), len(statuses))
+	}
+	for _, status := range statuses {
+		rows, err := store.ListTasks(context.Background(), TaskFilter{Status: status})
+		if err != nil {
+			t.Fatalf("status %s: %v", status, err)
+		}
+		if len(rows) != 1 || rows[0].Status != status {
+			t.Fatalf("status %s rows = %#v", status, rows)
+		}
+	}
+}
+
+func TestListTasksUsesShanghaiHalfOpenDateRange(t *testing.T) {
+	database := migratedDatabase(t)
+	store, err := NewSQLiteStore(database)
+	if err != nil {
+		t.Fatal(err)
+	}
+	insertTaskRow(t, database, "before", "before", "300", "DRAFT", "2026-08-03T15:59:59Z")
+	insertTaskRow(t, database, "at-start", "at-start", "301", "DRAFT", "2026-08-03T16:00:00Z")
+	insertTaskRow(t, database, "before-end", "before-end", "302", "DRAFT", "2026-08-04T15:59:59Z")
+	insertTaskRow(t, database, "at-end", "at-end", "303", "DRAFT", "2026-08-04T16:00:00Z")
+
+	rows, err := store.ListTasks(context.Background(), TaskFilter{CreatedFrom: "2026-08-04", CreatedTo: "2026-08-04"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(rows) != 2 || rows[0].ID != "before-end" || rows[1].ID != "at-start" {
+		t.Fatalf("Shanghai day rows = %#v, want [before-end at-start]", rows)
+	}
+}
+
+func TestListTasksBreaksEqualTimestampsByDescendingRowID(t *testing.T) {
+	database := migratedDatabase(t)
+	store, err := NewSQLiteStore(database)
+	if err != nil {
+		t.Fatal(err)
+	}
+	created := "2026-08-04T01:02:03Z"
+	insertTaskRow(t, database, "first", "first", "400", "DRAFT", created)
+	insertTaskRow(t, database, "second", "second", "401", "DRAFT", created)
+
+	rows, err := store.ListTasks(context.Background(), TaskFilter{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(rows) != 2 || rows[0].ID != "second" || rows[1].ID != "first" {
+		t.Fatalf("equal-time rows = %#v, want descending rowid", rows)
+	}
+}
+
+func TestListTasksRejectsInvalidStatusAndDates(t *testing.T) {
+	store, err := NewSQLiteStore(migratedDatabase(t))
+	if err != nil {
+		t.Fatal(err)
+	}
+	for name, filter := range map[string]TaskFilter{
+		"status":        {Status: "UNKNOWN"},
+		"from date":     {CreatedFrom: "2026-02-30"},
+		"to date":       {CreatedTo: "04/08/2026"},
+		"reverse range": {CreatedFrom: "2026-08-05", CreatedTo: "2026-08-04"},
+	} {
+		t.Run(name, func(t *testing.T) {
+			rows, err := store.ListTasks(context.Background(), filter)
+			if !errors.Is(err, ErrInvalidFilter) || rows != nil {
+				t.Fatalf("ListTasks(%#v) = (%#v, %v), want ErrInvalidFilter", filter, rows, err)
+			}
+		})
+	}
+}
+
+func TestStartPurchasesIsAtomicAndReplaysSameSet(t *testing.T) {
+	database := migratedDatabase(t)
+	store, err := NewSQLiteStore(database)
+	if err != nil {
+		t.Fatal(err)
+	}
+	store.SetStartPolicy(StartPolicy{AuthorizationTTL: time.Hour, MaxQuantity: 10, MaxTotalPrice: "999.99"})
+	store.now = func() time.Time { return time.Date(2026, 8, 4, 1, 2, 3, 0, time.UTC) }
+	for _, draft := range []Draft{testDraft(testKey, "one"), testDraft("b3c9f507-7473-4fa6-8d71-8786c34c6301", "two")} {
+		if _, err := store.CreateDraft(context.Background(), draft); err != nil {
+			t.Fatal(err)
+		}
+	}
+	command := StartCommand{StartKey: "c3c9f507-7473-4fa6-8d71-8786c34c6301", Tasks: []StartItem{{TaskID: "b3c9f507-7473-4fa6-8d71-8786c34c6301", ExpectedTaskVersion: 1}, {TaskID: testKey, ExpectedTaskVersion: 1}}}
+	first, err := store.StartPurchases(context.Background(), command, "admin")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if first.AuthorizedCount != 2 || first.PaymentAutomated {
+		t.Fatalf("start result=%#v", first)
+	}
+	command.Tasks[0], command.Tasks[1] = command.Tasks[1], command.Tasks[0]
+	replay, err := store.StartPurchases(context.Background(), command, "admin")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if replay.Tasks[0].AuthorizationID != first.Tasks[0].AuthorizationID || replay.Tasks[1].AuthorizationID != first.Tasks[1].AuthorizationID {
+		t.Fatalf("replay=%#v first=%#v", replay, first)
+	}
+	var pending, auths int
+	if err := database.QueryRow(`SELECT COUNT(*) FROM tasks WHERE status='PENDING' AND version=2`).Scan(&pending); err != nil || pending != 2 {
+		t.Fatalf("pending=%d err=%v", pending, err)
+	}
+	if err := database.QueryRow(`SELECT COUNT(*) FROM order_authorizations WHERE status='ACTIVE' AND created_by='admin'`).Scan(&auths); err != nil || auths != 2 {
+		t.Fatalf("auths=%d err=%v", auths, err)
+	}
+	_, err = store.StartPurchases(context.Background(), StartCommand{StartKey: command.StartKey, Tasks: command.Tasks[:1]}, "admin")
+	if !errors.Is(err, ErrStartConflict) {
+		t.Fatalf("subset err=%v", err)
+	}
+}
+
+func TestShanghaiRangeAndMoneyAreFailClosed(t *testing.T) {
+	start, end, err := ShanghaiRange("2026-08-04", "2026-08-04")
+	if err != nil || start.Format(time.RFC3339) != "2026-08-03T16:00:00Z" || end.Format(time.RFC3339) != "2026-08-04T16:00:00Z" {
+		t.Fatalf("range=(%s,%s,%v)", start, end, err)
+	}
+	for _, value := range []string{"0.01", "12.80", "999999999999999999999999.99"} {
+		if _, _, ok := normalizeCents(value); !ok {
+			t.Fatalf("money %q rejected", value)
+		}
+	}
+	for _, value := range []string{"1", "01.20", "0.00", "1.234", "1.", " 1.00", "1e2"} {
+		if _, _, ok := normalizeCents(value); ok {
+			t.Fatalf("money %q accepted", value)
+		}
+	}
+}
+
+func insertTaskRow(t *testing.T, database *sql.DB, id, title, goodsID, status, createdAt string) {
+	t.Helper()
+	if _, err := database.Exec(`INSERT INTO tasks (id, source, title, goods_id, sku_color, sku_size, quantity, max_total_price, status, version, created_at, updated_at) VALUES (?, 'MANUAL', ?, ?, '黑色', 'M', 2, '12.80', ?, 1, ?, ?)`, id, title, goodsID, status, createdAt, createdAt); err != nil {
+		t.Fatalf("insert task %s: %v", id, err)
+	}
+}

admin/internal/tasks/store.go

@@ -13,21 +13,27 @@ const sqliteWriteTimeout = 2 * time.Second
 type Store interface {
 	CreateDraft(context.Context, Draft) (Draft, error)
 	ListDrafts(context.Context) ([]Draft, error)
+	ListTasks(context.Context, TaskFilter) ([]TaskRow, error)
+	StartPurchases(context.Context, StartCommand, string) (StartResult, error)
 }
 type SQLiteStore struct {
-	database   *sql.DB
+	database  *sql.DB
-	now        func() time.Time
+	now       func() time.Time
-	createGate chan struct{}
+	writeGate chan struct{}
+	policy    StartPolicy
 }
 
 func NewSQLiteStore(database *sql.DB) (*SQLiteStore, error) {
 	if database == nil {
 		return nil, errors.New("database is required")
 	}
-	if _, err := database.Exec("SELECT 1 FROM tasks LIMIT 1"); err != nil {
+	if _, err := database.Exec("SELECT task_version, start_key, total_price_cap FROM order_authorizations LIMIT 1"); err != nil {
 		return nil, fmt.Errorf("tasks migration is not available: %w", err)
 	}
-	return &SQLiteStore{database: database, now: time.Now, createGate: make(chan struct{}, 1)}, nil
+	if _, err := database.Exec("SELECT 1 FROM purchase_attempts LIMIT 1"); err != nil {
+		return nil, fmt.Errorf("single-pass migration is not available: %w", err)
+	}
+	return &SQLiteStore{database: database, now: time.Now, writeGate: make(chan struct{}, 1)}, nil
 }
 
 func (store *SQLiteStore) CreateDraft(ctx context.Context, draft Draft) (Draft, error) {
@@ -36,8 +42,8 @@ func (store *SQLiteStore) CreateDraft(ctx context.Context, draft Draft) (Draft,
 	// SQLite permits one writer at a time. Serializing this store's short create
 	// transaction prevents concurrent retries of one create key from surfacing as busy.
 	select {
-	case store.createGate <- struct{}{}:
+	case store.writeGate <- struct{}{}:
-		defer func() { <-store.createGate }()
+		defer func() { <-store.writeGate }()
 	case <-writeContext.Done():
 		return Draft{}, writeContext.Err()
 	}

admin/internal/transport/webui/static/tasks.js

@@ -0,0 +1,60 @@
+(() => {
+  "use strict";
+  const form = document.querySelector("[data-start-purchases]");
+  if (!form) return;
+  const all = form.querySelector("[data-select-all]");
+  const summary = form.querySelector("[data-selection-summary]");
+  const button = form.querySelector("[data-start-button]");
+  const feedback = form.querySelector("[data-start-feedback]");
+  const boxes = () => [...form.querySelectorAll("input[data-task-id]")];
+  let selectionFrozen = false;
+  const parseCents = (value) => {
+    const match = /^(0|[1-9]\d*)\.(\d{2})$/.exec(value);
+    return match ? BigInt(match[1] + match[2]) : null;
+  };
+  const refresh = () => {
+    const available = boxes();
+    const selected = available.filter((box) => box.checked);
+    let cents = 0n;
+    let pricesValid = true;
+    selected.forEach((box) => {
+      const price = parseCents(box.dataset.price);
+      if (price === null) pricesValid = false;
+      else cents += price;
+    });
+    summary.textContent = `已选 ${selected.length} 条，最高总额 ¥${cents / 100n}.${(cents % 100n).toString().padStart(2, "0")}`;
+    button.disabled = !selected.length || !pricesValid;
+    if (!pricesValid) feedback.textContent = "所选任务金额无法安全汇总，请刷新后重选。";
+    if (all) {
+      all.checked = selected.length > 0 && selected.length === available.length;
+      all.indeterminate = selected.length > 0 && selected.length < available.length;
+      all.disabled = selectionFrozen || available.length === 0;
+    }
+  };
+  const freezeSelection = (frozen) => {
+    selectionFrozen = frozen;
+    boxes().forEach((box) => { box.disabled = frozen; });
+    refresh();
+  };
+  boxes().forEach((box) => box.addEventListener("change", refresh));
+  if (all) all.addEventListener("change", () => { boxes().forEach((box) => { box.checked = all.checked; }); refresh(); });
+  let frozenPayload = null;
+  let inFlight = false;
+  form.addEventListener("submit", async (event) => {
+    event.preventDefault();
+    const selected = boxes().filter((box) => box.checked);
+    if (!selected.length || inFlight) return;
+    const tasks = selected.map((box) => ({task_id: box.dataset.taskId, expected_task_version: Number(box.dataset.taskVersion)}));
+    if (tasks.some((item) => !Number.isSafeInteger(item.expected_task_version) || item.expected_task_version < 1)) { feedback.textContent = "任务版本无效，请刷新后重选。"; return; }
+    frozenPayload = frozenPayload || JSON.stringify({start_key: form.dataset.startKey, tasks});
+    inFlight = true; freezeSelection(true); button.disabled = true; button.textContent = "正在授权…";
+    try { const response = await fetch("/tasks/start-purchases", {method:"POST", headers:{"Content-Type":"application/json", "X-CSRF-Token":form.dataset.csrf}, body:frozenPayload});
+      if (response.ok) { window.location.reload(); return; }
+      if (response.status === 409) { feedback.textContent = "任务已变化，请刷新后重选。"; frozenPayload = null; freezeSelection(false); boxes().forEach((box) => { box.checked = false; }); refresh(); return; }
+      if (response.status === 400 || response.status === 401 || response.status === 403) { feedback.textContent = "请求未被接受，请刷新页面后重试。"; frozenPayload = null; freezeSelection(false); return; }
+      feedback.textContent = "结果暂时不明确，只能使用同一按钮原样重放。";
+    } catch (_) { feedback.textContent = "网络结果不明确，请使用同一按钮原样重试。"; }
+    finally { inFlight = false; button.textContent = "开始采购（只创建待付款订单）"; if (frozenPayload) button.disabled = false; }
+  });
+  refresh();
+})();

admin/internal/transport/webui/static/tasks.test.js

@@ -0,0 +1,138 @@
+"use strict";
+
+const test = require("node:test");
+const assert = require("node:assert/strict");
+const fs = require("node:fs");
+const path = require("node:path");
+const vm = require("node:vm");
+
+const source = fs.readFileSync(path.join(__dirname, "tasks.js"), "utf8");
+
+test("successful authorization sends numeric version and reloads", async () => {
+  const requests = [];
+  const harness = createHarness(async (_url, options) => {
+    requests.push(options);
+    return {ok: true, status: 200};
+  });
+
+  await harness.submit();
+
+  assert.equal(requests.length, 1);
+  assert.equal(requests[0].headers["Content-Type"], "application/json");
+  assert.equal(requests[0].headers["X-CSRF-Token"], "csrf-token");
+  const payload = JSON.parse(requests[0].body);
+  assert.equal(payload.start_key, "start-key");
+  assert.equal(typeof payload.tasks[0].expected_task_version, "number");
+  assert.equal(payload.tasks[0].expected_task_version, 7);
+  assert.equal(harness.reloads(), 1);
+});
+
+test("409 clears stale selection and requires a fresh choice", async () => {
+  const harness = createHarness(async () => ({ok: false, status: 409}));
+
+  await harness.submit();
+
+  assert.equal(harness.box.checked, false);
+  assert.equal(harness.box.disabled, false);
+  assert.equal(harness.button.disabled, true);
+  assert.match(harness.feedback.textContent, /任务已变化/);
+});
+
+for (const status of [400, 401, 403]) {
+  test(`${status} releases the frozen payload for a page refresh`, async () => {
+    const harness = createHarness(async () => ({ok: false, status}));
+
+    await harness.submit();
+
+    assert.equal(harness.box.checked, true);
+    assert.equal(harness.box.disabled, false);
+    assert.equal(harness.button.disabled, false);
+    assert.match(harness.feedback.textContent, /刷新页面后重试/);
+  });
+}
+
+test("5xx retries the byte-identical frozen payload", async () => {
+  const bodies = [];
+  const harness = createHarness(async (_url, options) => {
+    bodies.push(options.body);
+    return {ok: false, status: 503};
+  });
+
+  await harness.submit();
+  assert.equal(harness.box.disabled, true);
+  assert.equal(harness.button.disabled, false);
+  assert.match(harness.feedback.textContent, /原样重放/);
+  await harness.submit();
+
+  assert.equal(bodies.length, 2);
+  assert.equal(bodies[1], bodies[0]);
+});
+
+test("network ambiguity retries the same payload and can finish", async () => {
+  const bodies = [];
+  let call = 0;
+  const harness = createHarness(async (_url, options) => {
+    bodies.push(options.body);
+    call++;
+    if (call === 1) throw new Error("network result unknown");
+    return {ok: true, status: 200};
+  });
+
+  await harness.submit();
+  assert.equal(harness.box.disabled, true);
+  assert.match(harness.feedback.textContent, /原样重试/);
+  await harness.submit();
+
+  assert.deepEqual(bodies, [bodies[0], bodies[0]]);
+  assert.equal(harness.reloads(), 1);
+});
+
+function createHarness(fetchImplementation) {
+  class FakeElement {
+    constructor() {
+      this.dataset = {};
+      this.checked = false;
+      this.disabled = false;
+      this.indeterminate = false;
+      this.textContent = "";
+      this.listeners = {};
+    }
+
+    addEventListener(type, listener) {
+      this.listeners[type] = listener;
+    }
+  }
+
+  const box = new FakeElement();
+  box.checked = true;
+  box.dataset = {taskId: "task-id", taskVersion: "7", price: "12.80"};
+  const selectAll = new FakeElement();
+  const summary = new FakeElement();
+  const button = new FakeElement();
+  const feedback = new FakeElement();
+  const form = new FakeElement();
+  form.dataset = {startKey: "start-key", csrf: "csrf-token"};
+  form.querySelector = (selector) => ({
+    "[data-select-all]": selectAll,
+    "[data-selection-summary]": summary,
+    "[data-start-button]": button,
+    "[data-start-feedback]": feedback,
+  })[selector] || null;
+  form.querySelectorAll = (selector) => selector === "input[data-task-id]" ? [box] : [];
+
+  let reloadCount = 0;
+  const context = {
+    document: {querySelector: (selector) => selector === "[data-start-purchases]" ? form : null},
+    fetch: fetchImplementation,
+    window: {location: {reload: () => { reloadCount++; }}},
+  };
+  vm.runInNewContext(source, context, {filename: "tasks.js"});
+
+  return {
+    box,
+    button,
+    feedback,
+    reloads: () => reloadCount,
+    submit: () => form.listeners.submit({preventDefault() {}}),
+  };
+}

admin/internal/transport/webui/templates/tasks.html

@@ -6,12 +6,27 @@
   <meta name="viewport" content="width=device-width, initial-scale=1">
   <title>采购任务 · 采购服务</title>
   <style>
-    :root{--bg:#f4f7fb;--surface:#fff;--text:#172033;--muted:#526079;--border:#cfd8e6;--primary:#155eef;--danger:#b42318;--success:#067647;--focus:#ffbf47;font-family:"Segoe UI","Microsoft YaHei UI",system-ui,sans-serif}*{box-sizing:border-box}html{min-width:320px;background:var(--bg)}body{min-height:100dvh;margin:0;color:var(--text);background:var(--bg);font-size:16px;line-height:1.55}button,input{font:inherit}:focus-visible{outline:3px solid var(--focus);outline-offset:3px}.skip{position:fixed;z-index:100;top:8px;left:8px;padding:10px;color:#fff;background:#172033;transform:translateY(-160%)}.skip:focus{transform:translateY(0)}header{display:flex;align-items:center;justify-content:space-between;gap:16px;min-height:64px;padding:10px clamp(16px,4vw,40px);border-bottom:1px solid var(--border);background:var(--surface)}.brand{font-weight:700}.brand b{display:inline-grid;place-items:center;width:32px;height:32px;margin-right:8px;border-radius:8px;background:var(--primary);color:#fff;font-size:.82rem}.logout,.button{display:inline-flex;align-items:center;justify-content:center;min-height:44px;padding:9px 14px;border:1px solid var(--border);border-radius:8px;color:var(--text);background:#fff;font-weight:700;text-decoration:none;cursor:pointer}.button.primary{border-color:var(--primary);background:var(--primary);color:#fff}.button:disabled,.filter input:disabled{opacity:.5;cursor:not-allowed}main{width:min(100% - 32px,1200px);margin:32px auto}.toolbar{display:flex;align-items:center;justify-content:space-between;gap:16px;margin-bottom:16px}.toolbar-actions,.filters,.actions{display:flex;flex-wrap:wrap;gap:10px}.muted,.placeholder{color:var(--muted)}.filters{align-items:end;margin:0 0 16px}.filters label{display:grid;gap:4px;font-weight:700}.filters input{min-height:44px;min-width:180px;padding:8px 10px;border:1px solid var(--border);border-radius:8px;background:#fff}.table-wrap{overflow-x:auto;border:1px solid var(--border);border-radius:12px;background:var(--surface)}table{width:100%;min-width:880px;border-collapse:collapse}th,td{padding:12px 14px;border-bottom:1px solid var(--border);text-align:left;vertical-align:top}th{background:#f8fafc;font-size:.88rem}td a{color:#124cc5;font-weight:700;text-underline-offset:3px}.status{display:inline-block;padding:3px 8px;border-radius:999px;background:#eaf1ff;color:#173d8f;font-size:.85rem;font-weight:700}.empty,.success{padding:20px;border:1px solid var(--border);border-radius:12px;background:var(--surface)}.success{margin:0 0 16px;border-color:#9dd9b8;background:#ecfdf3;color:var(--success)}.modal-scrim{position:fixed;z-index:20;inset:0;background:rgba(23,32,51,.52)}dialog[open]{position:fixed;z-index:30;top:50%;left:50%;width:min(calc(100% - 24px),640px);max-height:calc(100dvh - 24px);margin:0;padding:28px;overflow-y:auto;border:1px solid var(--border);border-radius:14px;box-shadow:0 18px 48px rgba(23,32,51,.24);transform:translate(-50%,-50%);background:var(--surface)}.form-page{width:min(100% - 32px,640px);margin:32px auto;padding:28px;border:1px solid var(--border);border-radius:14px;background:var(--surface)}.form-grid{display:grid;gap:16px}.field label{display:block;margin-bottom:6px;font-weight:700}.required{color:var(--danger)}.field input{width:100%;min-height:44px;padding:10px 12px;border:1px solid #9ba9bc;border-radius:8px}.field input[aria-invalid=true]{border-color:var(--danger)}.error{margin:5px 0 0;color:var(--danger);font-size:.9rem}.summary{margin:0 0 16px;padding:12px;border-left:4px solid var(--danger);background:#fef3f2;color:var(--danger)}.summary p{margin:0}.summary ul{margin:8px 0 0;padding-left:20px}.summary a{color:inherit}.sr-only{position:absolute;width:1px;height:1px;padding:0;margin:-1px;overflow:hidden;clip:rect(0,0,0,0);white-space:nowrap;border:0}@media(max-width:420px){main,.form-page{width:calc(100% - 24px);margin:24px auto}.toolbar{align-items:stretch;flex-direction:column}.toolbar-actions,.toolbar .button{width:100%}.toolbar-actions .button{flex:1}.filters{align-items:stretch;flex-direction:column}.filters input,.filters .button{width:100%}}@media(prefers-reduced-motion:reduce){*,*::before,*::after{transition-duration:.01ms!important;animation-duration:.01ms!important}}</style>
+    :root{--bg:#f4f7fb;--surface:#fff;--text:#172033;--muted:#526079;--border:#cfd8e6;--primary:#155eef;--danger:#b42318;--success:#067647;--focus:#ffbf47;font-family:"Segoe UI","Microsoft YaHei UI",system-ui,sans-serif}*{box-sizing:border-box}html{min-width:320px;background:var(--bg)}body{min-height:100dvh;margin:0;color:var(--text);background:var(--bg);font-size:16px;line-height:1.55}button,input,select{font:inherit}:focus-visible{outline:3px solid var(--focus);outline-offset:3px}.skip{position:fixed;z-index:100;top:8px;left:8px;padding:10px;color:#fff;background:#172033;transform:translateY(-160%)}.skip:focus{transform:translateY(0)}header{display:flex;align-items:center;justify-content:space-between;gap:16px;min-height:64px;padding:10px clamp(16px,4vw,40px);border-bottom:1px solid var(--border);background:var(--surface)}.brand{font-weight:700}.brand b{display:inline-grid;place-items:center;width:32px;height:32px;margin-right:8px;border-radius:8px;background:var(--primary);color:#fff;font-size:.82rem}.logout,.button{display:inline-flex;align-items:center;justify-content:center;min-height:44px;padding:9px 14px;border:1px solid var(--border);border-radius:8px;color:var(--text);background:#fff;font-weight:700;text-decoration:none;cursor:pointer}.button.primary{border-color:var(--primary);background:var(--primary);color:#fff}.button:disabled,.filters input:disabled,.filters select:disabled{opacity:.5;cursor:not-allowed}main{width:min(100% - 32px,1200px);margin:32px auto}.toolbar{display:flex;align-items:center;justify-content:space-between;gap:16px;margin-bottom:16px}.toolbar-actions,.filters,.actions,.batch-actions{display:flex;flex-wrap:wrap;gap:10px}.muted,.placeholder,.not-selectable{color:var(--muted)}.filters{align-items:end;margin:0 0 16px}.filter-field{display:grid;gap:4px}.filter-field label{font-weight:700}.filters input,.filters select{min-height:44px;min-width:180px;padding:8px 10px;border:1px solid var(--border);border-radius:8px;background:#fff}.filters [aria-invalid=true]{border-color:var(--danger)}.batch-bar{display:flex;align-items:center;justify-content:space-between;gap:16px;margin:0 0 16px;padding:14px 16px;border:1px solid var(--border);border-radius:12px;background:var(--surface)}.batch-bar p{margin:2px 0}.batch-summary{font-weight:700}.batch-message{min-height:1.55em;color:var(--muted)}.table-wrap{overflow-x:auto;border:1px solid var(--border);border-radius:12px;background:var(--surface)}table{width:100%;min-width:880px;border-collapse:collapse}th,td{padding:12px 14px;border-bottom:1px solid var(--border);text-align:left;vertical-align:top}th{background:#f8fafc;font-size:.88rem}td a{color:#124cc5;font-weight:700;text-underline-offset:3px}.select-cell{width:64px;text-align:center}.checkbox-target{display:inline-grid;place-items:center;min-width:44px;min-height:44px;margin:-10px;cursor:pointer}.checkbox-target input{width:18px;height:18px}.status{display:inline-block;padding:3px 8px;border-radius:999px;background:#eaf1ff;color:#173d8f;font-size:.85rem;font-weight:700}.empty,.success{padding:20px;border:1px solid var(--border);border-radius:12px;background:var(--surface)}.success{margin:0 0 16px;border-color:#9dd9b8;background:#ecfdf3;color:var(--success)}.modal-scrim{position:fixed;z-index:20;inset:0;background:rgba(23,32,51,.52)}dialog[open]{position:fixed;z-index:30;top:50%;left:50%;width:min(calc(100% - 24px),640px);max-height:calc(100dvh - 24px);margin:0;padding:28px;overflow-y:auto;border:1px solid var(--border);border-radius:14px;box-shadow:0 18px 48px rgba(23,32,51,.24);transform:translate(-50%,-50%);background:var(--surface)}.form-page{width:min(100% - 32px,640px);margin:32px auto;padding:28px;border:1px solid var(--border);border-radius:14px;background:var(--surface)}.form-grid{display:grid;gap:16px}.field label{display:block;margin-bottom:6px;font-weight:700}.required{color:var(--danger)}.field input{width:100%;min-height:44px;padding:10px 12px;border:1px solid #9ba9bc;border-radius:8px}.field input[aria-invalid=true]{border-color:var(--danger)}.error{margin:5px 0 0;color:var(--danger);font-size:.9rem}.summary{margin:0 0 16px;padding:12px;border-left:4px solid var(--danger);background:#fef3f2;color:var(--danger)}.summary p{margin:0}.summary ul{margin:8px 0 0;padding-left:20px}.summary a{color:inherit}.sr-only{position:absolute;width:1px;height:1px;padding:0;margin:-1px;overflow:hidden;clip:rect(0,0,0,0);white-space:nowrap;border:0}@media(max-width:420px){main,.form-page{width:calc(100% - 24px);margin:24px auto}.toolbar,.batch-bar{align-items:stretch;flex-direction:column}.toolbar-actions,.toolbar .button,.batch-actions,.batch-actions .button{width:100%}.toolbar-actions .button,.batch-actions .button{flex:1}.filters{align-items:stretch;flex-direction:column}.filters input,.filters select,.filters .button{width:100%}}@media(prefers-reduced-motion:reduce){*,*::before,*::after{transition-duration:.01ms!important;animation-duration:.01ms!important}}</style>
 </head>
 <body>
   <a class="skip" href="#main">跳到主要内容</a>
   <header><div class="brand"><b aria-hidden="true">采</b>采购服务</div><form method="post" action="/logout"><input type="hidden" name="csrf_token" value="{{.CSRFToken}}"><button class="logout" type="submit">退出登录</button></form></header>
-  {{if .FullPage}}<main class="form-page" id="main">{{template "form" .}}</main>{{else}}<main id="main"><div class="toolbar"><div><h1>采购任务</h1><p class="muted">只显示待开始的手工任务。</p></div><div class="toolbar-actions"><button class="button" type="button" disabled>导入</button><a class="button primary" href="/tasks?create=1">创建任务</a></div></div><div class="filters" aria-label="暂不可用的列表条件"><label>关键词<input type="search" disabled></label><button class="button" type="button" disabled>筛选</button><button class="button" type="button" disabled>清除</button></div>{{if .Success}}<p class="success" role="status">任务已创建，已显示在列表首行。</p>{{end}}{{if .Drafts}}<div class="table-wrap"><table><thead><tr><th scope="col"><input type="checkbox" disabled aria-label="选择全部任务"></th><th scope="col">标题</th><th scope="col">颜色分类</th><th scope="col">尺码</th><th scope="col">价格上限</th><th scope="col">数量</th><th scope="col">采购结果</th><th scope="col">状态</th><th scope="col">创建时间</th></tr></thead><tbody>{{range .Drafts}}<tr><td><input type="checkbox" disabled aria-label="选择任务 {{.Title}}"></td><td><a href="https://mobile.yangkeduo.com/goods.html?goods_id={{.GoodsID}}" target="_blank" rel="noopener noreferrer">{{.Title}}</a></td><td>{{.SKUColor}}</td><td>{{.SKUSize}}</td><td>¥{{.MaxTotalPrice}}</td><td>{{.Quantity}}</td><td>—</td><td><span class="status">待开始</span></td><td><time datetime="{{.CreatedAt.Format "2006-01-02T15:04:05Z07:00"}}">{{.CreatedAt.Format "2006-01-02 15:04 UTC"}}</time></td></tr>{{end}}</tbody></table></div>{{else}}<section class="empty"><h2>还没有待开始任务</h2><p>创建一条手工任务后会显示在这里。</p></section>{{end}}</main>{{if .OpenForm}}<div class="modal-scrim" aria-hidden="true"></div><dialog open aria-modal="true" aria-labelledby="form-title">{{template "form" .}}</dialog>{{end}}{{end}}
+  {{if .FullPage}}<main class="form-page" id="main">{{template "form" .}}</main>{{else}}<main id="main">
+    <div class="toolbar"><div><h1>采购任务</h1><p class="muted">查询任务并统一授权待开始任务。</p></div><div class="toolbar-actions"><button class="button" type="button" disabled>导入</button><a class="button primary" href="/tasks?create=1">创建任务</a></div></div>
+    {{if .FilterErrors}}<div class="summary" role="alert" aria-live="assertive"><p>请修正筛选条件后重新查询。</p><ul>{{with index .FilterErrors "status"}}<li><a href="#filter-status">状态：{{.}}</a></li>{{end}}{{with index .FilterErrors "created_from"}}<li><a href="#filter-created-from">开始日期：{{.}}</a></li>{{end}}{{with index .FilterErrors "created_to"}}<li><a href="#filter-created-to">结束日期：{{.}}</a></li>{{end}}</ul></div>{{end}}
+    <form class="filters" method="get" action="/tasks" aria-label="任务筛选">
+      <div class="filter-field"><label for="filter-keyword">关键词</label><input id="filter-keyword" name="keyword" type="search" value="{{.Filter.Keyword}}" placeholder="标题或商品编号"></div>
+      <div class="filter-field"><label for="filter-status">状态</label><select id="filter-status" name="status" aria-invalid="{{if index .FilterErrors "status"}}true{{else}}false{{end}}"{{with index .FilterErrors "status"}} aria-describedby="filter-status-error"{{end}}>{{if index .FilterErrors "status"}}<option value="{{.Filter.Status}}" selected>无效状态：{{.Filter.Status}}</option>{{end}}<option value=""{{if eq .Filter.Status ""}} selected{{end}}>全部状态</option><option value="DRAFT"{{if eq .Filter.Status "DRAFT"}} selected{{end}}>待开始</option><option value="PENDING"{{if eq .Filter.Status "PENDING"}} selected{{end}}>已授权待领取</option><option value="CLAIMED"{{if eq .Filter.Status "CLAIMED"}} selected{{end}}>已领取</option><option value="ORDERING"{{if eq .Filter.Status "ORDERING"}} selected{{end}}>执行中</option><option value="NEEDS_MANUAL"{{if eq .Filter.Status "NEEDS_MANUAL"}} selected{{end}}>待人工处理</option><option value="WAITING_PAYMENT"{{if eq .Filter.Status "WAITING_PAYMENT"}} selected{{end}}>待付款</option><option value="RECONCILIATION_REQUIRED"{{if eq .Filter.Status "RECONCILIATION_REQUIRED"}} selected{{end}}>围栏后待调和</option><option value="SUCCEEDED"{{if eq .Filter.Status "SUCCEEDED"}} selected{{end}}>已完成</option><option value="FAILED"{{if eq .Filter.Status "FAILED"}} selected{{end}}>失败</option><option value="CANCELED"{{if eq .Filter.Status "CANCELED"}} selected{{end}}>已取消</option></select>{{with index .FilterErrors "status"}}<p class="error" id="filter-status-error">{{.}}</p>{{end}}</div>
+      <div class="filter-field"><label for="filter-created-from">开始日期</label><input id="filter-created-from" name="created_from" type="date" value="{{.Filter.CreatedFrom}}" aria-invalid="{{if index .FilterErrors "created_from"}}true{{else}}false{{end}}"{{with index .FilterErrors "created_from"}} aria-describedby="filter-created-from-error"{{end}}>{{with index .FilterErrors "created_from"}}<p class="error" id="filter-created-from-error">{{.}}</p>{{end}}</div>
+      <div class="filter-field"><label for="filter-created-to">结束日期</label><input id="filter-created-to" name="created_to" type="date" value="{{.Filter.CreatedTo}}" aria-invalid="{{if index .FilterErrors "created_to"}}true{{else}}false{{end}}"{{with index .FilterErrors "created_to"}} aria-describedby="filter-created-to-error"{{end}}>{{with index .FilterErrors "created_to"}}<p class="error" id="filter-created-to-error">{{.}}</p>{{end}}</div>
+      <div class="actions"><button class="button primary" type="submit">筛选</button><a class="button" href="/tasks">清除筛选</a></div>
+    </form>
+    {{if .Success}}<p class="success" role="status">任务已创建，已显示在列表首行。</p>{{end}}
+    <form data-start-purchases data-start-key="{{.StartKey}}" data-csrf="{{.CSRFToken}}">
+      <section class="batch-bar" aria-label="批量开始采购"><div><p class="batch-summary" data-selection-summary aria-live="polite">已选 0 条，最高总额 ¥0.00</p><p class="muted" id="payment-note">采购工具会逐条创建待付款订单，系统不会付款。</p><p class="batch-message" id="start-feedback" data-start-feedback role="status" aria-live="polite"></p></div><div class="batch-actions"><button class="button primary" type="submit" data-start-button aria-describedby="payment-note start-feedback" disabled>开始采购（只创建待付款订单）</button></div></section>
+      <div class="table-wrap"><table><thead><tr><th class="select-cell" scope="col"><label class="checkbox-target"><span class="sr-only">选择全部当前筛选结果中的待开始任务</span><input type="checkbox" data-select-all aria-label="选择全部任务"{{if not .Tasks}} disabled{{end}}></label></th><th scope="col">标题</th><th scope="col">颜色分类</th><th scope="col">尺码</th><th scope="col">价格上限</th><th scope="col">数量</th><th scope="col">采购结果</th><th scope="col">状态</th><th scope="col">创建时间（上海）</th></tr></thead><tbody>{{if .Tasks}}{{range .Tasks}}<tr><td class="select-cell">{{if eq .Status "DRAFT"}}<label class="checkbox-target"><span class="sr-only">选择任务 {{.Title}}</span><input type="checkbox" name="task_ids" value="{{.ID}}" data-task-id="{{.ID}}" data-task-version="{{.Version}}" data-price="{{.MaxTotalPrice}}" aria-label="选择任务 {{.Title}}"></label>{{else}}<span class="not-selectable">—<span class="sr-only">{{statusLabel .Status}}任务不可选择</span></span>{{end}}</td><td><a href="https://mobile.yangkeduo.com/goods.html?goods_id={{.GoodsID}}" target="_blank" rel="noopener noreferrer">{{.Title}}</a></td><td>{{.SKUColor}}</td><td>{{.SKUSize}}</td><td>¥{{.MaxTotalPrice}}</td><td>{{.Quantity}}</td><td>—</td><td><span class="status">{{statusLabel .Status}}</span></td><td><time datetime="{{shanghaiDateTime .CreatedAt}}">{{shanghaiTime .CreatedAt}}</time></td></tr>{{end}}{{else}}<tr><td colspan="9">{{if .FilterErrors}}<section class="empty"><h2>筛选条件有误</h2><p>请修正上方标出的字段后重新查询。</p></section>{{else if .HasFilter}}<section class="empty"><h2>没有符合筛选条件的任务</h2><p><a class="button" href="/tasks">清除筛选</a></p></section>{{else}}<section class="empty"><h2>还没有采购任务</h2><p>创建一条手工任务后会显示在这里。</p></section>{{end}}</td></tr>{{end}}</tbody></table></div>
+    </form>
+  </main>{{if .OpenForm}}<div class="modal-scrim" aria-hidden="true"></div><dialog open aria-modal="true" aria-labelledby="form-title">{{template "form" .}}</dialog>{{end}}<script src="/static/tasks.js" defer></script>{{end}}
 </body>
 </html>
 {{end}}

admin/internal/transport/webui/webui.go

@@ -5,6 +5,7 @@ import (
 	"embed"
 	"html/template"
 	"io"
+	"time"
 
 	"cmbuyer/admin/internal/tasks"
 )
@@ -12,7 +13,17 @@ import (
 //go:embed templates/*.html
 var templateFiles embed.FS
 
-var templates = template.Must(template.New("webui").Funcs(template.FuncMap{"list": func(values ...any) []any { return values }}).ParseFS(templateFiles, "templates/*.html"))
+//go:embed static/tasks.js
+var tasksScript []byte
+
+var shanghaiLocation = time.FixedZone("Asia/Shanghai", 8*60*60)
+
+var templates = template.Must(template.New("webui").Funcs(template.FuncMap{
+	"list":             func(values ...any) []any { return values },
+	"statusLabel":      statusLabel,
+	"shanghaiDateTime": func(value time.Time) string { return value.In(shanghaiLocation).Format(time.RFC3339) },
+	"shanghaiTime":     func(value time.Time) string { return value.In(shanghaiLocation).Format("2006-01-02 15:04") },
+}).ParseFS(templateFiles, "templates/*.html"))
 
 // LoginData 是登录页面所需的非敏感展示数据。
 type LoginData struct {
@@ -22,16 +33,20 @@ type LoginData struct {
 	Error     string
 }
 
-// TasksData 是受保护的 DRAFT 建单与列表页面所需数据。
+// TasksData 是受保护的建单与任务工作台页面所需数据。
 type TasksData struct {
-	CSRFToken  string
+	CSRFToken    string
-	Drafts     []tasks.Draft
+	Tasks        []tasks.TaskRow
-	Form       tasks.Form
+	Filter       tasks.TaskFilter
-	Errors     tasks.Errors
+	FilterErrors tasks.Errors
-	OpenForm   bool
+	HasFilter    bool
-	FullPage   bool
+	StartKey     string
-	FocusField string
+	Form         tasks.Form
-	Success    bool
+	Errors       tasks.Errors
+	OpenForm     bool
+	FullPage     bool
+	FocusField   string
+	Success      bool
 }
 
 // RenderLogin 写入登录页。
@@ -43,3 +58,24 @@ func RenderLogin(writer io.Writer, data LoginData) error {
 func RenderTasks(writer io.Writer, data TasksData) error {
 	return templates.ExecuteTemplate(writer, "tasks.html", data)
 }
+
+func TasksScript() []byte { return tasksScript }
+
+func statusLabel(status string) string {
+	labels := map[string]string{
+		"DRAFT":                   "待开始",
+		"PENDING":                 "已授权待领取",
+		"CLAIMED":                 "已领取",
+		"ORDERING":                "执行中",
+		"NEEDS_MANUAL":            "待人工处理",
+		"WAITING_PAYMENT":         "待付款",
+		"RECONCILIATION_REQUIRED": "围栏后待调和",
+		"SUCCEEDED":               "已完成",
+		"FAILED":                  "失败",
+		"CANCELED":                "已取消",
+	}
+	if label, ok := labels[status]; ok {
+		return label
+	}
+	return "未知状态"
+}

docs/tasks/T-103.md

@@ -19,14 +19,10 @@ write_paths:
   - client/scripts/capture_sku_panel_spike.py
   - client/scripts/run_t103_sku_selection.py
   - client/scripts/sanitize_sku_panel_evidence.py
-  - docs/02-requirements.md
-  - docs/03-tech-stack.md
-  - docs/04-architecture.md
-  - docs/api.md
   - docs/current-state.md
 ---
 
-<!-- BEGIN VIKUNJA EXPORT id=23 synced=2026-08-04T10:01:59Z sha256=ed26c948a564efd44a1f3d3336dd4c383cc42acf567357c5c8fedb32d2459a0e -->
+<!-- BEGIN VIKUNJA EXPORT id=23 synced=2026-08-04T10:47:47Z sha256=5471bdfeed1fffe4f0abd25201b9d5bf7bf55fa9500c11aa297eb4c422da5f02 -->
 ## 问题 / 背景
 
 T-102 已证明 canonical 链接可进入目标商品。T-103 在 PKG110 / Android 16 / 拼多多 8.17.0、goods_id `937122477375` 上确认：规格面板由详情页精确唯一的“快要抢光”打开；T-110 已把该证据/版本绑定入口批准为受控导航。面板刚打开时目标颜色“黑色CHA(纯棉)”和尺码“M(建议100-115)”自动选中。
@@ -182,6 +178,10 @@ T-103 sanitizer v2 坐标修正与主审：提交 44c027a 将 screenshot space
 ### 2026-08-04T10:01:50Z · ila
 
 2026-08-04 T-103 入口父容器追加真机证据：只读取证目录 C:\Users\ila20\AppData\Local\cmbuyer\artifacts\T-103\entry-parent-evidence-937122477375-20260804-175737；截图 screenshot.png，XML hierarchy.xml，manifest.json。设备 PKG110 / Android 16 / 拼多多 8.17.0 / Wi-Fi，goods_id 937122477375。项目所有者人工确认截图为目标商品详情页，且“快要抢光 12.88”与“免拼购买”的位置和手机当前画面一致。只读结构核对显示：精确“快要抢光”文本节点本身不可点击，但位于唯一、可见、启用、可点击的 PDD ViewGroup 祖先内；“免拼购买”属于另一底部可点击容器。后续只允许把入口判据收紧调整为“精确唯一快要抢光子节点 + 证据绑定唯一可点击祖先”，不得允许或点击“免拼购买”，必须先补 fixture/反例/超时不重试测试再真机运行。
+
+### 2026-08-04T10:47:38Z · ila
+
+2026-08-04 T-103 入口父链收紧完成：提交 44586fe，合入主分支 ce9d6ca。入口只允许精确唯一“快要抢光”子节点及五层已取证可点击 PDD 祖先链，实际点击仍取子节点中心；“免拼购买”独立容器为硬拒绝。独立审计复算证据 hash、验证 focused 32 / full 112 tests 和完整 init 均 PASS。最终真机运行曾安全失败且未发布输出目录；随后只读诊断发现系统通知栏覆盖，app_current 虽仍报告 PDD，但节点树 64 个节点全部属于 SystemUI。下一次必须由人先完全收起通知栏并停在 PDD 首页再运行；T-103 保持 DOING，不把这次失败或入口截图确认误记为完整验收。
 <!-- END VIKUNJA EXPORT -->
 
 ## 边界

docs/tasks/T-104.md

@@ -0,0 +1,82 @@
+---
+id: T-104
+title: 验证规格选择能力安全退出
+phase: 1
+deps: [T-103]
+status: TODO
+created: 2026-08-04
+vikunja_task_id: 32
+context_ref: 9a4d11f
+work_branch: task/t-104-safe-exit
+needs_device: true
+needs_human_review: true
+write_paths:
+  - docs/tasks/T-104.md
+  - client/src/cmbuyer_client/pdd/sku_selection.py
+  - client/src/cmbuyer_client/pdd/sku_selection_runner.py
+  - client/tests/pdd/test_sku_selection.py
+  - client/tests/pdd/fixtures/product_exit_8_17_0.xml
+  - client/scripts/capture_sku_exit_spike.py
+  - client/scripts/run_t103_sku_selection.py
+  - docs/current-state.md
+---
+
+<!-- BEGIN VIKUNJA EXPORT id=32 synced=2026-08-04T10:47:05Z sha256=d0fe6a30708d16440962b8ab9ec81ce33065f96363597bd55e0a1fb4b442b6fd -->
+## 问题 / 背景
+
+T-103 已实现受控规格选择、读价、截图和单次 Back，但当前 `exit_sku_panel_safely()` 在 hierarchy 变化且规格面板判据不再成立时就返回成功。2026-08-04 的只读诊断已证明：通知栏覆盖时 `app_current` 仍可能报告拼多多，而节点树全部属于 SystemUI。因此“已不在面板”不是安全退出的充分条件。T-104 用独立真机证据把后置条件收紧为“稳定回到同一目标商品详情页”。
+
+## 关联需求与交互
+
+- 功能：F-006 单趟流程中的安全退出边界。
+- 架构/API：复用 `SkuSelectionFlow.exit_sku_panel_safely()`；不改变服务端 API。
+- 依赖：T-103 完成真机规格选择/读价/人眼安全退出验收后才开工。
+
+## 方案
+
+1. 先新增窄取证脚本：只在已验证 PDD 8.17.0 目标规格面板上发送一次 Back，随后采集本机截图/XML/App/设备/goods_id 元数据；不得打开确认页、设置数量或点击任何页面控件。
+2. 由人确认 post-exit 截图确为 goods_id `937122477375` 商品详情、规格面板已关闭、未进入确认页/外部支付页，并确认截图/XML 对应；`needs_device=true`，agent 保持 DOING。
+3. 从本项目 post-exit XML 提取只含判据节点的最小 fixture。成功判据必须稳定命中该商品详情的证据绑定正结构；可复用 T-103 的“快要抢光”五层入口链，但必须由新的 post-exit 证据再次验证。
+4. 收紧 `exit_sku_panel_safely()`：版本和前台包正确、节点树仅含 PDD 受控页面、目标商品详情正判据精确唯一并连续稳定；面板仍在、SystemUI/锁屏、PDD 其他页、确认/提交/支付语义、入口缺失/重复或结构漂移均不得记成功。
+5. Back 最多发送一次。超时或响应不明不重试；故障调和也不能产生第二次 Back。失败不得发布 `safe_exit=completed` manifest。
+6. 复用 T-103 runner/flow，不新建第二套采购流程；可增加 post-exit 本机原始截图和无页面正文摘要，完整 XML 仍只留本机，不上传、Git 或日志。
+
+## 验收要点
+
+- 真机证据记录路径、截图/XML hash、PKG110、Android 16、Wi-Fi/USB、拼多多 8.17.0 和 goods_id；只有人能完成页面对应性与无订单创建确认。
+- 离线测试覆盖成功稳定详情页，以及面板未退、SystemUI/锁屏、PDD 其他页、确认/提交/支付页、入口缺失/重复/漂移、版本/前台漂移。
+- 所有失败分支 Back 总数最多 1；超时不重试；失败不发布 completed manifest。
+- 静态证明没有数量、确认页导航、提交订单、围栏或支付能力。
+- client 全量单测、compileall、完整 init、上下文校验与 diff-check 通过。
+
+## 执行记录
+
+等待 T-103 完成后认领。
+
+## 执行记录
+
+（暂无）
+<!-- END VIKUNJA EXPORT -->
+
+## 边界
+
+- T-104 必须等待 T-103 完成人工真机验收后才可转 `DOING`。本任务先取证、后写退出成功判据；不得从
+  当前实现、前序项目、旧 XML、Activity 名或推理直接声明商品详情页。
+- 取证动作只允许在已证明为拼多多 8.17.0、goods_id `937122477375` 的目标规格面板上发送一次
+  Android Back，随后只读采集截图/XML/App/设备摘要。不得点击关闭坐标、空白处、购买、数量、确认、
+  提交或支付控件，也不得在 Back 失败或结果不明时重试。
+- “规格面板已消失”不是退出成功。成功必须由本项目 post-exit 真机证据证明：版本和前台包正确、节点树
+  仅属于 PDD 受控页面、同一目标商品详情正判据精确唯一并连续稳定；SystemUI/锁屏、PDD 其他页面、
+  确认页、提交页、外部支付页、入口缺失/重复或结构漂移一律停止且不得发布 completed manifest。
+- 可以复用 T-103 已取证的“快要抢光”五层入口链作为候选结构，但必须在新的 post-exit 截图/XML 上
+  重新验证并由人确认页面对应性；不得使用相似文本、包含/前缀、OCR、裸坐标或其他购买文案兜底。
+- 只收紧现有 `SkuSelectionFlow` 与 runner 的退出后置条件，不新建第二套采购流程，不新增通用 `click`、
+  数量、确认页导航、授权、提交围栏、创建待付款订单或支付能力。第一趟与任何真实提交函数继续静态隔离。
+- 原始完整 XML 只保存在 `%LOCALAPPDATA%\cmbuyer\artifacts\T-104\...`，不得上传、提交 Git、写入
+  Vikunja 或日志。Git 中最小 fixture 只能保留退出判据所需结构，并由人确认不含地址、手机号或支付凭据。
+- `needs_device: true`：agent 不得自行标 `DONE`。只有人确认 post-exit 截图为同一目标商品详情、面板
+  已关闭、未进入确认/提交/支付页、未创建订单，且截图/XML 对应后，任务才可完成。
+- 本任务不实现、不调用 `set_quantity_and_readback()`、`go_to_order_confirm()`、
+  `create_submission_fence()`、`submit_order_once()`、支付、免密支付、先用后付或任何扣款能力；既有
+  三道价格闸门、服务端围栏、只点一次且不重试的约束不得放宽。
+

docs/tasks/T-203.md

@@ -3,7 +3,7 @@ id: T-203
 title: 表格查询与批量开始采购授权
 phase: 2
 deps: [T-202, T-209]
-status: DOING
+status: DONE
 created: 2026-08-04
 vikunja_task_id: 30
 context_ref: 1f20271
@@ -12,6 +12,7 @@ needs_device: false
 needs_human_review: false
 write_paths:
   - docs/tasks/T-203.md
+  - admin/internal/auth/**
   - admin/internal/tasks/**
   - admin/internal/server/**
   - admin/internal/transport/webui/**
@@ -20,7 +21,7 @@ write_paths:
   - admin/README.md
 ---
 
-<!-- BEGIN VIKUNJA EXPORT id=30 synced=2026-08-04T09:16:48Z sha256=6c62ba368a760e96b8feb06f3f3ced8a2a40d10f7754a99471f7429c3862a80c -->
+<!-- BEGIN VIKUNJA EXPORT id=30 synced=2026-08-04T10:27:15Z sha256=540fb01c9da32148898851f6450b713103f1db40222e1ac0d6dbcc74b007bcb3 -->
 ## 问题 / 背景
 
 T-202 已完成手工 DRAFT 建单；T-209 将生产 schema/领域状态机迁移到单趟模型。项目所有者明确：管理员点击“开始采购（只创建待付款订单）”本身就是授权，不再增加试选后确认。T-203 负责采购服务查询和批量授权事务，使设备后续只能领取显式授权的 PENDING 任务。
@@ -53,6 +54,14 @@ F-004、F-008、F-018；US-003、US-005；IX-005；GET /tasks、POST /tasks/star
 ### 2026-08-04T09:16:39Z · ila
 
 2026-08-04 开始 T-203：依赖 T-209 已完成并合入 main。主 agent 已完成开工前只读审计，冻结 v2 schema 启动校验、单进程 writeGate、start_key 规范集合重放、Asia/Shanghai 到 UTC 半开区间、julianday 查询及 big.Int 分金额边界；本地状态转 DOING，分支 task/t-203-start-purchases。
+
+### 2026-08-04T10:18:10Z · ila
+
+2026-08-04 T-203 独立终审退回两项：未认证须按 docs/api.md 返回 401，已认证但 CSRF 错误才返回 403；原始 JSON 在 64KiB 边界内必须先做严格 UTF-8 校验。现有 auth.Manager 无法只读区分“有效管理会话 + 错 CSRF”与“无会话”，因此任务所有者批准把 write_paths 最小扩展为 admin/internal/auth/**，仅允许增加只读认证状态 API 及测试；不得创建/旋转会话或放宽 CSRF。修复、复审和完整门禁通过前 T-203 保持 DOING。
+
+### 2026-08-04T10:26:57Z · ila
+
+2026-08-04 T-203 完成：提交 5dcff4b，合入主分支 03a067e。实现传统任务表格、筛选、DRAFT 批量勾选和“开始采购（只创建待付款订单）”授权；1/100 条在单一事务内生成 ACTIVE 快照并原子转 PENDING，相同 start_key 原集合稳定重放。独立终审两轮后修复未认证 401/CSRF 403 与原始 UTF-8 严格校验。主 agent 合入后完整 init（client 112 tests）、Go 全量/竞态/vet/build、Node 7 tests、上下文和 diff-check 全部通过；未实现领取、真机、提交订单或付款。
 <!-- END VIKUNJA EXPORT -->
 
 ## 边界

docs/tasks/T-204.md

@@ -0,0 +1,101 @@
+---
+id: T-204
+title: 路由化任务详情与内部截图资产
+phase: 2
+deps: [T-203]
+status: DOING
+created: 2026-08-04
+vikunja_task_id: 31
+context_ref: 7928457
+work_branch: task/t-204-details-evidence
+needs_device: false
+needs_human_review: false
+write_paths:
+  - docs/tasks/T-204.md
+  - admin/migrations/00003_evidence_assets.sql
+  - admin/internal/migrations/migrations_test.go
+  - admin/internal/evidence/**
+  - admin/internal/storage/evidence/**
+  - admin/internal/taskdetail/**
+  - admin/internal/config/**
+  - admin/internal/server/**
+  - admin/internal/transport/webui/**
+  - admin/cmd/server/**
+  - admin/README.md
+  - docs/api.md
+  - docs/routes.md
+  - docs/04-architecture.md
+---
+
+<!-- BEGIN VIKUNJA EXPORT id=31 synced=2026-08-04T10:42:09Z sha256=2bd6675f2249b461d72b5e0a066da90e33af8023c4b97b52f0d77a8eb391c034 -->
+## 问题 / 背景
+
+T-203 已完成传统任务表格与批量“开始采购”授权。采购管理员还缺少可复制、可返回的任务详情，以及只供内部审计的规格面板/确认页原始截图。T-204 提供详情与截图资产底座；不实现 T-205 的 attempt/event 写入，不实现 T-306 的客户端上传调用。
+
+## 关联需求与交互
+
+- 功能：F-007、F-011。
+- 用户故事：US-002、US-004、US-007。
+- 交互：IX-003、IX-004；双击非控件区域或 Enter 打开同一 `/tasks/{id}`，直达显示完整页，列表增强为抽屉。
+- 架构/API：`GET /tasks/{id}`、`POST /api/v1/tasks/{id}/evidence`、`GET /evidence/{asset_id}`。
+
+## 方案
+
+1. 新增任务详情只读查询，返回任务要求、状态、版本、授权摘要和当前已有的 attempt/submission/evidence 摘要；缺少后续事实时显示明确空态，不伪造数据。
+2. `GET /tasks/{id}` 以同一数据模型渲染完整页或同源 HTML fragment。列表行双击非交互区域、键盘 Enter 打开抽屉并把 URL 推到同一路径；Esc、关闭或浏览器返回恢复筛选、滚动与触发行焦点。外部商品链接、复选框和批量按钮不得触发行详情。
+3. 详情是审计视图，不提供试选后确认、再次提交、付款自动化或围栏后重试。状态文案始终区分“订单已创建，系统尚未付款”。
+4. 新建 `evidence_assets` 迁移和存储边界：只接收明确的单个 PNG screenshot；attempt_id 必填且必须属于 URL 中的 task。元数据仅允许 upload_key、attempt_id、kind、privacy_tier=INTERNAL_RAW、sha256、captured_at；记录 MIME、字节数、宽高、存储键和上传主体。
+5. 上传先经注入的 DeviceAuthenticator；T-301 前生产默认拒绝，测试可用 fake principal 验证契约，不创建临时 token 或共享密钥。T-301 完成后再接真实 Bearer 身份。
+6. multipart 设严格总大小、字段/单文件限制；拒绝未知字段、重复字段、XML/manifest/目录/本机路径、非 PNG、魔数/DecodeConfig/尺寸/hash 不一致以及未批准的截图 kind。服务端文件名只由资产 id/存储键生成，不使用上传名。
+7. 文件同目录临时写、流式 SHA-256、校验、fsync、原子 rename 后才写 DB；故障只允许产生不可达孤儿，不允许 DB 指向缺失或半文件。upload_key 同任务同载荷幂等，载荷变化冲突，并发只生成一条可读资产。
+8. `GET /evidence/{asset_id}` 仅有效管理员会话可读，返回 `image/png`、`Cache-Control: no-store`、`X-Content-Type-Options: nosniff`；未登录不泄露资产是否存在，不经静态目录暴露。
+9. UI 采用现有采购服务高密度表格风格：可见关闭按钮、焦点圈、44px 交互目标、截图 width/height 预留和 lazy loading、响应式布局、reduced-motion；不得只有双击一种入口。
+10. T-204 明确定值单文件最大 10 MiB、解码后最大 16,777,216 像素；证据目录由显式配置提供。保留期限仍由后续部署任务定值，不在本任务自动删除资产。
+
+## 验收要点
+
+- 详情完整页与抽屉使用同一路由/数据；刷新/复制 URL、浏览器返回、Esc、焦点和滚动/筛选恢复均有测试。
+- 不存在、畸形 id、未登录、fragment 伪造请求均 fail closed，不泄露内部错误。
+- 上传覆盖认证矩阵、multipart 负例、PNG 魔数/解码/大小/尺寸/hash、未知/重复字段、任务/attempt 归属、路径穿越、幂等冲突/并发及原子故障注入。
+- 截图读取覆盖管理员会话、未登录、缺失资产和 no-store/nosniff；完整 XML、支付页和凭据不会进入接口或 Git。
+- 运行 Go 全量/竞态/vet/build、Node 测试与语法检查、完整 init、上下文校验和 diff-check。
+
+## 执行记录
+
+待认领。
+
+## 执行记录
+
+### 2026-08-04T10:42:01Z · ila
+
+2026-08-04 开始 T-204：依赖 T-203 已完成，任务定义提交 7928457。采用生产默认拒绝的 DeviceAuthenticator 接口，T-301 前不发明临时设备凭据；先实现同 URL 详情抽屉/完整页、INTERNAL_RAW PNG 原子存储与管理员 no-store 读取。工作分支 task/t-204-details-evidence。
+<!-- END VIKUNJA EXPORT -->
+
+## 边界
+
+- 本任务只实现管理员任务详情、内部 PNG 证据资产底座和受保护读取；不实现 T-205 的 attempt/event
+  写接口、闸门计算、失败分类、提交围栏或结果调和，不实现 T-306 的客户端截图与上传调用。
+- T-301 完成前不得发明临时设备 token、共享密钥或把管理员会话当设备身份。上传 handler 必须先调用窄
+  `DeviceAuthenticator`；生产默认实现一律拒绝，只有测试可以注入 fake principal。
+- 上传只接受一个调用方显式选择的 PNG；不得枚举目录，不接收 XML、manifest、本机路径、原文件名、
+  任意备注、Cookie、token、支付凭据或未批准的截图 kind。MVP 本任务只开放
+  `SKU_PANEL_GATE_1`，后续 kind 必须在对应任务中收紧扩展。
+- `attempt_id` 必填且必须以复合外键证明属于 URL 中的 task。`privacy_tier` 只能是
+  `INTERNAL_RAW`；截图可含页面已显示的地址/手机号，但服务端不得 OCR、提取、索引、搜索或写日志。
+- 单文件最多 10 MiB，单边最多 8192 px，解码后最多 16,777,216 像素；必须同时校验 multipart 类型、
+  PNG 魔数、解码结果、字节数、尺寸与调用方声明的 64 位小写 SHA-256，任一不符零发布。
+- 文件必须在显式配置的证据根目录内以服务端生成的内容地址落盘，不进入公开静态目录。先同目录临时写、
+  流式 hash、`fsync`、原子 rename，再写数据库；故障最多留下不可达孤儿，不得留下指向半文件或缺失
+  文件的可见数据库记录，也不得为清理孤儿而删除并发复用文件。
+- 同一设备主体与 `upload_key` 的相同规范请求只返回原资产；内容、任务、attempt 或元数据变化一律
+  `409`。不得把 SHA-256 当业务记录唯一键，因为不同合法证据可以复用相同物理内容。
+- `GET /evidence/{asset_id}` 只允许有效管理员会话，必须返回 `Cache-Control: no-store` 和
+  `X-Content-Type-Options: nosniff`；匿名请求先拒绝，不泄露资产是否存在，不提供公开 URL、目录浏览、
+  批量导出、删除或预签名链接。
+- `/tasks/{id}` 的抽屉与完整页必须共享同一数据和详情模板。双击不是唯一入口；Enter、可见关闭按钮、
+  Esc、浏览器前进/后退、焦点与列表滚动/筛选恢复均可用，外部商品链接、复选框、输入框和按钮不得误触
+  行详情。截图必须预留尺寸、响应式缩放、延迟加载，alt 不转录地址或手机号。
+- 详情是只读审计视图，不制造不存在的 attempt/event/闸门/提交事实，不出现“机器选对了吗”、围栏后
+  重试、再次提交或自动付款动作。截图不作为价格闸门通过或人工审批的唯一依据。
+- 本任务不实现、不调用通用真机点击、`submit_order_once()`、支付、免密支付、先用后付或任何扣款能力；
+  既有三道价格闸门、服务端提交围栏、唯一点击一次且不重试的规则不得放宽。