diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 865a9e4b2..3fd5c31fe 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -41,6 +41,27 @@ OpenAPI有效性:
       - "**/target/spotbugs*.xml"
       - "**/target/site/spotbugs.html"
 
+质量摘要:
+  stage: verify
+  image: node:22-alpine
+  cache: []
+  allow_failure: true
+  needs:
+    - job: OpenAPI有效性
+      artifacts: false
+    - job: 校验与测试
+      artifacts: true
+    - job: 静态分析报告
+      artifacts: true
+  script:
+    - node --test scripts/java-quality-summary.test.mjs
+    - node scripts/java-quality-summary.mjs --output target/java-quality-summary.json --require-jacoco --require-spotbugs
+  artifacts:
+    when: always
+    expire_in: 7 days
+    paths:
+      - target/java-quality-summary.json
+
 校验与测试:
   stage: verify
   script:
@@ -76,7 +97,6 @@ OpenAPI有效性:
       - finance/target/*.jar
       - warehouse/target/*.jar
       - warehouse-overseas-service/target/*.jar
-      - overseas-security-service/target/*.jar
       - lastleg-service/target/*.jar
       - file/target/*.jar
       - print/target/*.jar
diff --git a/AGENTS.md b/AGENTS.md
index 5a0872a4a..c399798f3 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -20,9 +20,11 @@
 |---|---|---|
 | 登录、Token、密码、注册 | `auth/` | `auth/AGENTS.md` |
 | 客户档案、成员、审核、RBAC、授权快照 | `iam/` | `iam/AGENTS.md` |
+| 客户建档默认尺寸初始化与补偿 | `iam/`、`firstleg/` | IAM `CustomerDimensionRuleInitializationService` 持久化意图、`CustomerDimensionInitializationRelay` 后台投递；Firstleg 内部入口 `/internal/firstleg/v1/customer-dimension-configs/defaults`，未 `READY` 不得审核通过 |
 | 消息中心、站内通知、消息模板、收件箱 | `iam/` | `iam/AGENTS.md`，再按 `src/main/java/com/baiyue/iam/notification/` 定位；业务事件生产者回到所属服务 |
 | 订单、货物、快照、状态、幂等、Outbox | `order/` | `order/AGENTS.md` |
 | 履约分配、入库、测量、审核、FBA 计费 | `firstleg/` | `firstleg/AGENTS.md` |
+| Firstleg 内部模块化与依赖基线 | `firstleg/` | `firstleg/docs/firstleg-internal-modularization-baseline.md`、`firstleg/scripts/analyze-firstleg-dependencies.mjs`；价格簿查询和客户统计按端口/适配器切片，不改变服务与数据库边界 |
 | 分柜、柜次、智能排柜、预装/装柜清单、PDA | `firstleg/` | `firstleg/AGENTS.md`，再按 `split/`、`loading/`、`outbound/` 定位 |
 | 智能装柜入仓码候选与箱数分配 | `firstleg/` | `controller/PlatformSmartLoadingController.java` 的 `/inbound-candidates`、`/plans/{planId}/inbound-assignments`，业务编排 `service/SmartLoadingService.java` |
 | 订舱、船期、拖车、报关 | `firstleg/` | `oceanbooking/`、`portschedule/`、`outbound/dispatch/`、`customs/` |
@@ -36,14 +38,15 @@
 | 路由、CORS、JWT 入口、访问域 | `gateway/` | `gateway/AGENTS.md` |
 | 百度/Amazon/OCR/第三方适配 | `integration-service/` | `integration-service/AGENTS.md` |
 | 海外 API 路由、海外 Token、Audience/JWKS | `gateway-overseas/` | `gateway-overseas/AGENTS.md` |
-| 海外 IAM 状态与权限版本投影 | `overseas-security-service/` | `overseas-security-service/AGENTS.md`；消费三类 IAM 安全事件并为海外 Gateway 提供内部 fail-closed 校验 |
+| 海外 IAM 状态与权限版本投影 | `lastleg-service/security/` | `lastleg-service/AGENTS.md`；内部入口 `/internal/lastleg/security/v1/events`、`/validate`；消费三类 IAM 安全事件并为海外 Gateway 提供 fail-closed 校验，投影表归 `baiyue_lastleg` |
 | 尾程订单、海外入仓计划、换标、库存、采购、本土卡车 | `lastleg-service/` | `lastleg-service/AGENTS.md`，再按 `inboundplan/`、`relabel/`、`inventory/`、`procurement/`、`trucking/` 定位 |
 | 海外入仓分页、FBA 预约、PDA 柜号签收与入仓 | `lastleg-service/` | 平台入口 `inboundplan/controller/InboundPlanController.java`、`InboundPlanQueryMapper.java`、`InboundFbaAppointmentService.java`；PDA 公网入口 `inboundplan/pda/controller/ReceivingContainerController.java`、`ReceivingContainerService.java`，旧 planNo/allocationId Controller 已移除 |
 | 海外仓排车查询、候选与智能预排 | `lastleg-service/` | `dispatch/controller/DispatchQueryController.java`、`SmartDispatchController.java`；草稿柜、托盘锁和预排归 `dispatch/`，只读排车和预排创建独立开关，不自动开放编辑、取消、发车、PDA 出库或派送 |
 | 客户海外仓贴标、转运、废弃与退货换标 | `lastleg-service/` | `relabel/`、`transfer/`、`discard/` 的 Merchant Controller/Service；Client 消费端 `../apps/client-web/src/modules/overseas-warehouse/`，统一经 `gateway-overseas/` |
-| 海外仓 PDA 盘点、移库、托盘、换标与查询 | `lastleg-service/`、`warehouse-overseas-service/` | Lastleg `pda/stocktake/`、`pda/move/`、`pda/warehouse/`、`palletops/`、`relabel/pda/`；契约 `lastleg-service/src/main/resources/openapi/overseas-pda-operations-v1.yaml`；物理库位/托盘调用 `warehouse-overseas-service/`，设备端入口是否开放以 `../apps/pda-overseas-uniapp/AGENTS.md` 为准 |
+| 海外仓 PDA 盘点、移库、托盘、换标与查询 | `lastleg-service/`、`warehouse-overseas-service/` | Lastleg `pda/stocktake/`、`pda/move/`、`pda/warehouse/`、`palletops/`、`relabel/pda/`；契约 `lastleg-service/src/main/resources/openapi/overseas-pda-operations-v1.yaml`；物理托盘流转与补偿进入 Warehouse `InternalPdaPalletTransitionController`，设备端入口是否开放以 `../apps/pda-overseas-uniapp/AGENTS.md` 为准 |
 | 国内船节点向海外接柜门禁事件 | `firstleg/`、`common-event-contract/`、`lastleg-service/` | Firstleg `portschedule/service/CarrierScheduleNodeOutboxService.java` 发布 `FirstLegContainerShippingNodeRecordedV1`；Lastleg `shipping/service/ContainerShippingNodeConsumer.java` 单调消费，只有实际 `PICKUP_READY` 及以后节点允许海外 PDA 候选进入可收货 |
-| 海外仓库、海外库位、海外托盘、资源锁 | `warehouse-overseas-service/` | `warehouse-overseas-service/AGENTS.md` |
+| 海外仓库目录、海外库位、海外托盘、资源锁 | 国内仓库目录归 `warehouse/`，海外资源归 `warehouse-overseas-service/` | `warehouse/AGENTS.md`、`warehouse-overseas-service/AGENTS.md`；海外库只保存国内 warehouseId 引用 |
+| Lastleg 内部模块化与依赖基线 | `lastleg-service/` | `lastleg-service/docs/lastleg-internal-modularization-baseline.md`、`lastleg-service/scripts/analyze-lastleg-dependencies.mjs`；只用于约束服务内部依赖，不改变服务和数据库边界 |
 | PDF 标签、审计、跨区双向事件 | `print/`、`audit-service/`、`event-bridge-service/` | 事件模型先读 `common-event-contract/AGENTS.md`；国内真实生产验收 `firstleg/.../TaillegRealProducerAcceptanceTest.java`、海外真实消费验收 `lastleg-service/.../TaillegRealConsumerAcceptanceTest.java`；可靠投递与 CN/OVERSEAS 目标路由读 `event-bridge-service/AGENTS.md` |
 
 ## 公共模块快速索引
@@ -52,7 +55,7 @@
 |---|---|
 | 公共依赖版本 | `platform-bom/pom.xml`；统一管理公共组件版本，不放业务实现 |
 | 通用响应、分页、异常、基础实体与导出契约 | `common-core/`；从 `ApiResponse.java`、`PageResult.java`、`BizException.java`、`ExportContracts.java` 定位 |
-| Web 异常、请求关联 ID、Long ID 序列化 | `common-web/`；从 `GlobalExceptionHandler.java`、`CorrelationIdFilter.java`、`LongIdJacksonConfiguration.java` 定位 |
+| Web 异常、请求关联/Trace、同步出站传播、Long ID 序列化 | `common-web/`；从 `GlobalExceptionHandler.java`、`CorrelationIdFilter.java`、`TraceParent.java`、`FeignTraceRequestInterceptor.java`、`RestClientTraceInterceptor.java`、`LongIdJacksonConfiguration.java` 定位 |
 | JWT、JWKS、会话校验与认证用户 | `common-security/`；从 `JwtAuthenticationFilter.java`、`JwtClaimsMapper.java`、`AccessTokenSessionValidator.java` 定位 |
 | Springdoc/OpenAPI 自动配置 | `common-openapi/`；从 `BaiyueOpenApiAutoConfiguration.java`、`OpenApiProperties.java` 定位 |
 | 业务审计注解、脱敏、Outbox 与投递 | `common-audit/`；从 `BusinessAudit.java`、`BusinessAuditAspect.java`、`SensitiveDataSanitizer.java`、`AuditOutboxPublisher.java` 定位 |
@@ -78,9 +81,10 @@
 - 供应商查询接口固定只使用 `platform:supplier:list`；IAM 中 `platform:supplier:list` 是正式菜单资源，`platform:supplier:view` 必须停用/移除，不得重新提升或兼容。
 - 权限语义变更必须同步 Controller `@PreAuthorize`、OpenAPI、模块权限 SQL、IAM 菜单资源、统一增量脚本和契约测试。并行模块任务不得覆盖菜单与权限总控已写入共享 SQL 或权限契约的改动。
 - 数据库只访问所属服务库。模块表结构位于 `<module>/src/main/resources/db/`；当前开发阶段直接更新最新模块基线和 `deploy/sql/头程数据库统一增量-MySQL8.sql`，不为历史开发数据新增兼容迁移。已有名称含 `migration` 的脚本仅作现有结构来源和开发追溯，部署说明见 `deploy/sql/README.md`。
+- 后端同样遵守根指引中的“开发数据和上传文件可丢弃”边界：不得为现有开发库孤儿文件、旧文件归属或历史部分失败新增删除补偿接口、兼容复用、回填或清理链路；只修复当前正式上传与持久化路径，既有开发文件由人工重新上传。
 - 通用配置在 `config/nacos/{local,cn}/`；服务日志、上传文件、`target/`、`reports/` 不属于源码。
 - Java 签名变更的最低编译门禁是 `mvn -pl <module> -am test-compile`，它必须在部署前完成并覆盖测试源码；有行为变化时继续运行 `mvn -pl <module> -am test`。`-DskipTests` 可跳过测试执行但仍须保留测试编译，`-Dmaven.test.skip=true` 会跳过测试编译，不得作为签名变更的交付验证。全量验证仍使用 `mvn -DskipTests validate`、`mvn test`；不要在本地启动 Java/Nacos/数据库，除非用户明确要求。
-- `AGENTS.md` 索引维护完成后运行 `./scripts/agents-index-contract.ps1`；脚本只读源码目录和指定指引，验证根快速表唯一性、部署单元、Client active 路由、海外 Gateway 覆盖、模块覆盖、关键入口与排除目录，不访问 HTTP、数据库或部署环境。
+- `AGENTS.md` 索引维护完成后运行 `./scripts/agents-index-contract.ps1`；脚本只读源码目录和指定指引，验证根快速表唯一性、部署单元、Client active 路由、四期范围漂移、订舱关联候选与柜量语义、海外 Gateway 覆盖、PDA 运行配置、Lastleg 海外安全投影、同步 Trace、模块覆盖、关键入口与排除目录，不访问 HTTP、数据库或部署环境。
 - 单服务镜像构建/部署从 `Jenkinsfile.service`、`deploy/docker/Dockerfile`、`deploy/scripts/deploy-built-service.sh` 进入；新镜像启动失败或健康检查失败时只允许回滚到同服务先前镜像，并保持任务失败，离线合同见 `scripts/deploy-built-service-rollback.test.mjs`。实际部署仍须当前对话明确授权。
 
 ## 全量 HTTP 验收脚本路由
@@ -89,6 +93,7 @@
 - Admin 总入口默认按模块列表覆盖平台全链路；需要定位单个业务时使用 `--modules <name>`，模块名称和静态合同先查 `scripts/admin-test-env-modules/README.md`。
 - 这些脚本会创建、更新或最终停用测试数据，必须在当前对话明确授权测试环境验收后执行，并保存 JSON 报告；未授权不得请求 Gateway。
 - 后端 Maven、前端 `pnpm test/typecheck`、PDA `node --test` 和数据库 Dry-run 都是本地质量检查，不属于全量 HTTP 验收。
+- Java 模块、OpenAPI 覆盖、JaCoCo 与 SpotBugs 聚合摘要使用 `node scripts/java-quality-summary.mjs`；默认仅报告存量缺口，是否阻断由显式 `--require-*` 参数决定，输出位于 `target/` 时不得作为业务事实或提交物。
 - HTTP 全量通过后，才进入 Admin/Client 真实页面调用、浏览器样式和 PDA 页面/设备验收；自动化 HTTP 通过不代表视觉验收完成。
 
 ## 阶段文档入口
diff --git a/Jenkinsfile b/Jenkinsfile
index be2593cce..a06ba1017 100644
--- a/Jenkinsfile
+++ b/Jenkinsfile
@@ -1,6 +1,6 @@
 def serviceModules = [
     'gateway', 'gateway-overseas', 'auth', 'iam', 'firstleg', 'finance', 'order', 'warehouse', 'file', 'print',
-    'integration-service', 'lastleg-service', 'warehouse-overseas-service', 'overseas-security-service', 'event-bridge-service', 'audit-service'
+    'integration-service', 'lastleg-service', 'warehouse-overseas-service', 'event-bridge-service', 'audit-service'
 ]
 
 def serviceCheckboxes = [
@@ -17,7 +17,6 @@ def serviceCheckboxes = [
     'integration-service': 'SERVICE_INTEGRATION',
     'lastleg-service': 'SERVICE_LASTLEG',
     'warehouse-overseas-service': 'SERVICE_WAREHOUSE_OVERSEAS',
-    'overseas-security-service': 'SERVICE_OVERSEAS_SECURITY',
     'event-bridge-service': 'SERVICE_EVENT_BRIDGE',
     'audit-service': 'SERVICE_AUDIT'
 ]
@@ -69,7 +68,6 @@ pipeline {
         booleanParam(name: 'SERVICE_INTEGRATION', defaultValue: false, description: '第三方集成服务（integration-service）')
         booleanParam(name: 'SERVICE_LASTLEG', defaultValue: false, description: '海外尾程与入仓服务（lastleg-service）')
         booleanParam(name: 'SERVICE_WAREHOUSE_OVERSEAS', defaultValue: false, description: '海外仓资源服务（warehouse-overseas-service）')
-        booleanParam(name: 'SERVICE_OVERSEAS_SECURITY', defaultValue: false, description: '海外IAM安全投影服务（overseas-security-service）')
         booleanParam(name: 'SERVICE_EVENT_BRIDGE', defaultValue: false, description: '跨区域事件桥（event-bridge-service；默认同时部署国内和海外实例）')
         choice(name: 'EVENT_BRIDGE_REGION', choices: ['BOTH', 'CN', 'OVERSEAS'], description: 'BOTH 同时部署国内和海外实例；CN/OVERSEAS 用于单区故障重跑')
         booleanParam(name: 'SERVICE_AUDIT', defaultValue: false, description: '审计服务（audit-service）')
diff --git a/Jenkinsfile.service b/Jenkinsfile.service
index 88c8bac39..bd81515d2 100644
--- a/Jenkinsfile.service
+++ b/Jenkinsfile.service
@@ -1,6 +1,6 @@
 def serviceModules = [
     'gateway', 'gateway-overseas', 'auth', 'iam', 'firstleg', 'finance', 'order', 'warehouse', 'file', 'print',
-    'integration-service', 'lastleg-service', 'warehouse-overseas-service', 'overseas-security-service', 'event-bridge-service', 'audit-service'
+    'integration-service', 'lastleg-service', 'warehouse-overseas-service', 'event-bridge-service', 'audit-service'
 ]
 
 def serviceJars = [
@@ -17,7 +17,6 @@ def serviceJars = [
     'integration-service': 'integration-service/target/integration-service-1.0.0-SNAPSHOT.jar',
     'lastleg-service': 'lastleg-service/target/lastleg-service-1.0.0-SNAPSHOT.jar',
     'warehouse-overseas-service': 'warehouse-overseas-service/target/warehouse-overseas-service-1.0.0-SNAPSHOT.jar',
-    'overseas-security-service': 'overseas-security-service/target/overseas-security-service-1.0.0-SNAPSHOT.jar',
     'event-bridge-service': 'event-bridge-service/target/event-bridge-service-1.0.0-SNAPSHOT.jar',
     'audit-service': 'audit-service/target/audit-service-1.0.0-SNAPSHOT.jar'
 ]
diff --git a/README.md b/README.md
index 604e465ae..0f2913388 100644
--- a/README.md
+++ b/README.md
@@ -12,7 +12,7 @@
 - `firstleg`：头程揽收、入仓、装载、发运和交接。
 - `warehouse`：国内仓储能力。
 - `file`、`print`、`audit-service`、`integration-service`：国内公共业务能力；Print 调用方接入见 `print/README.md`。
-- `gateway-overseas`、`lastleg-service`、`warehouse-overseas-service`、`overseas-security-service`：海外公网入口、海外尾程与入仓业务、海外仓储资源及 IAM 安全投影。
+- `gateway-overseas`、`lastleg-service`、`warehouse-overseas-service`：海外公网入口、海外尾程/入仓与 IAM 安全投影、海外仓储资源。
 - `event-bridge-service`：按国内、海外双实例部署的跨区域事件桥。
 - `common-*`、`common-event-contract`：由本仓维护并以 `com.baiyue.shared` 发布的公共制品。
 - `platform-bom`：统一管理仓库内公共依赖版本。
diff --git a/auth/src/main/java/com/baiyue/auth/client/IamOnboardingClient.java b/auth/src/main/java/com/baiyue/auth/client/IamOnboardingClient.java
index b78cc2138..c0bb9d5ed 100644
--- a/auth/src/main/java/com/baiyue/auth/client/IamOnboardingClient.java
+++ b/auth/src/main/java/com/baiyue/auth/client/IamOnboardingClient.java
@@ -25,5 +25,6 @@ public interface IamOnboardingClient {
                              String legalPerson, String legalPhone, String contactEmail,
                              String countryCode, String address) { }
 
-    record OnboardingResponse(Long tenantId, Long membershipId, String tenantStatus) { }
+    record OnboardingResponse(Long tenantId, Long membershipId, String tenantStatus,
+                              String dimensionInitializationStatus) { }
 }
diff --git a/auth/src/main/java/com/baiyue/auth/dto/MerchantRegisterResponse.java b/auth/src/main/java/com/baiyue/auth/dto/MerchantRegisterResponse.java
index 3c357b850..09ece63c9 100644
--- a/auth/src/main/java/com/baiyue/auth/dto/MerchantRegisterResponse.java
+++ b/auth/src/main/java/com/baiyue/auth/dto/MerchantRegisterResponse.java
@@ -5,5 +5,6 @@ public record MerchantRegisterResponse(
         Long tenantId,
         Long membershipId,
         String tenantStatus,
+        String dimensionInitializationStatus,
         String nextStep
 ) { }
diff --git a/auth/src/main/java/com/baiyue/auth/service/MerchantRegistrationService.java b/auth/src/main/java/com/baiyue/auth/service/MerchantRegistrationService.java
index 09dd998cd..d3fa0f65f 100644
--- a/auth/src/main/java/com/baiyue/auth/service/MerchantRegistrationService.java
+++ b/auth/src/main/java/com/baiyue/auth/service/MerchantRegistrationService.java
@@ -103,7 +103,8 @@ public class MerchantRegistrationService {
             throw exception;
         }
         return new MerchantRegisterResponse(accountId, onboarding.tenantId(), onboarding.membershipId(),
-                onboarding.tenantStatus(), "LOGIN_AND_COMPLETE_QUALIFICATIONS");
+                onboarding.tenantStatus(), onboarding.dimensionInitializationStatus(),
+                "LOGIN_AND_COMPLETE_QUALIFICATIONS");
     }
 
     private void registerRollbackCompensation(long accountId, AtomicBoolean compensationCompleted) {
diff --git a/auth/src/main/resources/db/phase1-admin-accounts.sql b/auth/src/main/resources/db/phase1-admin-accounts.sql
index cfa329c3d..130763a9f 100644
--- a/auth/src/main/resources/db/phase1-admin-accounts.sql
+++ b/auth/src/main/resources/db/phase1-admin-accounts.sql
@@ -1,4 +1,4 @@
--- Phase-one local administrator accounts.
+-- Phase-one local platform administrator account. Merchant accounts are created through onboarding.
 -- Development-only initial password: ChangeMe123!
 -- The BCrypt hash is intentionally stored instead of plaintext.
 USE baiyue_auth;
@@ -10,9 +10,7 @@ INSERT INTO auth_account (
   operator_tenant_id, default_membership_id, default_app_code, deleted
 ) VALUES
   (1000001, 'platform_admin', '$2a$12$AMZJjd88leYPLI9uKvjZiew2CTQXI32BXoHFX.FrCi28/IeZ7mZ96',
-   '平台系统管理员', 'ACTIVE', 0, 1, 0, 0, 0, 3000001, 'PLATFORM', 0),
-  (1000002, 'merchant_admin', '$2a$12$AMZJjd88leYPLI9uKvjZiew2CTQXI32BXoHFX.FrCi28/IeZ7mZ96',
-   'IT 测试客户管理员', 'ACTIVE', 0, 1, 0, 10001, 10001, 3000002, 'MERCHANT', 0)
+   '平台系统管理员', 'ACTIVE', 0, 1, 0, 0, 0, 3000001, 'PLATFORM', 0)
 ON DUPLICATE KEY UPDATE
   password_hash = VALUES(password_hash),
   display_name = VALUES(display_name),
diff --git a/auth/src/test/java/com/baiyue/auth/repository/InitialAccountSeedSqlContractTest.java b/auth/src/test/java/com/baiyue/auth/repository/InitialAccountSeedSqlContractTest.java
index 025bf6ec7..82620e90c 100644
--- a/auth/src/test/java/com/baiyue/auth/repository/InitialAccountSeedSqlContractTest.java
+++ b/auth/src/test/java/com/baiyue/auth/repository/InitialAccountSeedSqlContractTest.java
@@ -11,7 +11,7 @@ import static org.assertj.core.api.Assertions.assertThat;
 
 class InitialAccountSeedSqlContractTest {
     @Test
-    void initializesOnlyThePlatformAndItTestAdministratorAccounts() throws Exception {
+    void initializesOnlyThePlatformAdministratorAccount() throws Exception {
         assertAccountSeed(new ClassPathResource("db/phase1-admin-accounts.sql")
             .getContentAsString(StandardCharsets.UTF_8));
         assertAccountSeed(Files.readString(unifiedSql(), StandardCharsets.UTF_8));
@@ -21,9 +21,10 @@ class InitialAccountSeedSqlContractTest {
         assertThat(sql)
             .contains("(1000001, 'platform_admin'")
             .contains("'平台系统管理员', 'ACTIVE'")
-            .contains("(1000002, 'merchant_admin'")
-            .contains("'IT 测试客户管理员', 'ACTIVE'")
             .contains("password_change_required")
+            .doesNotContain("merchant_admin")
+            .doesNotContain("IT_TEST")
+            .doesNotContain("(1000002, 'merchant_admin'")
             .doesNotContain("一期演示企业管理员");
     }
 
diff --git a/auth/src/test/java/com/baiyue/auth/service/MerchantRegistrationServiceTest.java b/auth/src/test/java/com/baiyue/auth/service/MerchantRegistrationServiceTest.java
index 5a4541699..fd61c5925 100644
--- a/auth/src/test/java/com/baiyue/auth/service/MerchantRegistrationServiceTest.java
+++ b/auth/src/test/java/com/baiyue/auth/service/MerchantRegistrationServiceTest.java
@@ -35,7 +35,7 @@ class MerchantRegistrationServiceTest {
     void registeredAuthAccountUsesTheOwnerIdentityReturnedByIamOnboarding() {
         when(encoder.encode("Password123")).thenReturn("encoded-password");
         when(onboarding.register(eq("internal-token"), any())).thenReturn(ApiResponse.success(
-                new IamOnboardingClient.OnboardingResponse(10001L, 30001L, "PROFILE_REQUIRED")));
+                new IamOnboardingClient.OnboardingResponse(10001L, 30001L, "PROFILE_REQUIRED", "PENDING")));
 
         var result = service.register(new MerchantRegisterRequest(
                 "registered_owner", "Password123", "注册人", "测试企业", "张三",
@@ -56,13 +56,14 @@ class MerchantRegistrationServiceTest {
         assertEquals("ACTIVE", storedAccount.getValue().getAccountStatus());
         assertEquals("encoded-password", storedAccount.getValue().getPasswordHash());
         assertEquals("LOGIN_AND_COMPLETE_QUALIFICATIONS", result.nextStep());
+        assertEquals("PENDING", result.dimensionInitializationStatus());
     }
 
     @Test
     void failedAuthInsertCompensatesTheIamRegistration() {
         when(encoder.encode("Password123")).thenReturn("encoded-password");
         when(onboarding.register(eq("internal-token"), any())).thenReturn(ApiResponse.success(
-                new IamOnboardingClient.OnboardingResponse(10001L, 30001L, "PROFILE_REQUIRED")));
+                new IamOnboardingClient.OnboardingResponse(10001L, 30001L, "PROFILE_REQUIRED", "PENDING")));
         when(onboarding.compensate(eq("internal-token"), any())).thenReturn(ApiResponse.success(null));
         doThrow(new IllegalStateException("auth database unavailable")).when(accounts).insert(any());
 
@@ -82,7 +83,7 @@ class MerchantRegistrationServiceTest {
     void rolledBackAuthTransactionCompensatesAfterTheLocalTransactionCompletes() {
         when(encoder.encode("Password123")).thenReturn("encoded-password");
         when(onboarding.register(eq("internal-token"), any())).thenReturn(ApiResponse.success(
-                new IamOnboardingClient.OnboardingResponse(10001L, 30001L, "PROFILE_REQUIRED")));
+                new IamOnboardingClient.OnboardingResponse(10001L, 30001L, "PROFILE_REQUIRED", "PENDING")));
         when(onboarding.compensate(eq("internal-token"), any())).thenReturn(ApiResponse.success(null));
 
         TransactionSynchronizationManager.initSynchronization();
diff --git a/common-openapi/AGENTS.md b/common-openapi/AGENTS.md
index 59eed2647..f91a255d8 100644
--- a/common-openapi/AGENTS.md
+++ b/common-openapi/AGENTS.md
@@ -13,10 +13,12 @@
 | `baiyue.openapi` 配置项 | `src/main/java/com/baiyue/common/openapi/OpenApiProperties.java` |
 | 自动配置注册 | `src/main/resources/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports` |
 | 长整型 OpenAPI 字符串契约 | `src/main/java/com/baiyue/common/openapi/BaiyueOpenApiAutoConfiguration.java` |
+| PDA OpenAPI 分组 | `src/main/java/com/baiyue/common/openapi/BaiyueOpenApiAutoConfiguration.java` 的 `pda` GroupedOpenApi；固定匹配 `/api/pda/**`，合同测试 `src/test/java/com/baiyue/common/openapi/PdaOpenApiGroupContractTest.java` |
 
 ## 修改与验证
 
 - 调整分组、标题或安全方案时检查所有 MVC 服务的 Swagger 输出；Gateway 的 WebFlux 聚合配置在 `gateway/`。
+- PDA Controller 必须进入独立 `pda` 分组；新增或改名 `/api/pda/**` 路径时同步检查分组合同和目标服务 OpenAPI，不得混入平台或商户分组。
 - 普通业务成功和失败在 OpenAPI 中统一描述为 HTTP 200，并提示调用方检查 body `code`；只为 Security、协议、基础设施、Warehouse 503、Audit 202 和 Event Bridge 内部鉴权等真实状态边界声明非 200 响应。
 - 配置项变化直接同步代码、全部消费者和 Nacos 模板，当前开发阶段不保留旧配置键兼容。
 - 从父目录运行 `mvn -pl common-openapi -am test`。
diff --git a/common-security/AGENTS.md b/common-security/AGENTS.md
index 5829c1000..e9e566096 100644
--- a/common-security/AGENTS.md
+++ b/common-security/AGENTS.md
@@ -12,7 +12,7 @@
 | 安全链自动配置 | `src/main/java/com/baiyue/common/security/BaiyueSecurityAutoConfiguration.java` |
 | JWT 解码模式 | `JwksJwtDecoderAutoConfiguration.java`（国内与海外统一 RS256/JWKS）；`HmacJwtDecoderAutoConfiguration.java` 仅作当前开发阶段清理前的旧实现定位，不得作为跨区域共享密钥方案 |
 | JWT 过滤与声明映射 | `JwtAuthenticationFilter.java`、`JwtClaimsMapper.java` |
-| 当前用户与认证对象 | `AuthenticatedUser.java`、`BaiyueJwtAuthenticationToken.java` |
+| 当前用户与认证对象 | `AuthenticatedUser.java`、`BaiyueJwtAuthenticationToken.java`；海外 PDA 仓范围由 `JwtClaimsMapper.java` 将 `overseas_warehouse_id` 映射为 `overseasWarehouseId` |
 | 会话与授权来源 | `AccessTokenSessionValidator.java`、`RedisAccessTokenSessionValidator.java`（国内登录 Token 即时失效）、`ClaimsAccessTokenSessionValidator.java`（海外访问 Token 本地短时 Claims）、`RedisTokenKeys.java` |
 | 401/403 响应 | `JsonAuthenticationEntryPoint.java`、`JsonAccessDeniedHandler.java` |
 | 自动配置注册 | `src/main/resources/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports` |
@@ -22,6 +22,7 @@
 
 - 所有资源服务统一使用 `jwt-mode=jwks`、RS256、Issuer 和 JWKS；国内服务验证国内 Audience 并使用 `session-mode=redis`，海外服务只接受登录/刷新时签发的海外 Audience Token 并使用 `session-mode=claims`，不得访问国内 Redis。海外服务应缓存 JWKS 并在密钥轮换时刷新，不得每个请求访问国内 Auth；不得重新引入跨区域共享 HS256 密钥，也不得让海外服务接受国内 Token。
 - Token Claim、Redis Key、Issuer、Audience、JWKS、会话模式或认证对象变化必须同步检查 `auth/`、`gateway/`、Nacos/部署配置和所有实际业务服务。
+- `overseas_warehouse_id` 只承载 IAM 已确认的海外仓绑定；缺失、格式非法或与实时安全投影不一致时不得放宽 PDA 仓范围，Gateway 与业务服务必须 fail-closed。
 - `JsonAuthenticationEntryPoint` 与 `JsonAccessDeniedHandler` 属于统一 HTTP 200 业务契约的例外：认证入口仍返回真实 401/403，供前端刷新 Token 和区分授权失败。
 - 不降低服务端租户、会话或权限校验；密钥只从配置中心或环境变量读取。
 - 从父目录运行 `mvn -pl common-security -am test`。
diff --git a/common-web/AGENTS.md b/common-web/AGENTS.md
index d2312b7cf..019c951df 100644
--- a/common-web/AGENTS.md
+++ b/common-web/AGENTS.md
@@ -13,6 +13,7 @@
 | 请求 ID 过滤器 | `src/main/java/com/baiyue/common/web/CorrelationIdFilter.java` |
 | W3C Trace Context | `src/main/java/com/baiyue/common/web/TraceParent.java`；严格接收 version 00，响应 `traceparent`、`X-Trace-Id` 与 MDC `traceId` 使用同一 trace ID |
 | Feign Trace 传播 | `FeignTraceRequestInterceptor.java`、`FeignTracePropagationAutoConfiguration.java`；仅 Feign 存在时装配，optional 依赖不向无 Feign 服务传递 |
+| RestClient Trace 传播 | `RestClientTraceInterceptor.java`、`RestClientTracePropagationAutoConfiguration.java`；Spring 管理的 Builder 自动装配，原始 Builder 可显式复用拦截器 |
 | 自动配置入口 | `src/main/java/com/baiyue/common/web/CommonWebAutoConfiguration.java`；为只扫描自身包的服务注册异常处理器和 Correlation 过滤器 |
 | 全局异常映射与业务失败指标 | `src/main/java/com/baiyue/common/web/GlobalExceptionHandler.java`；指标 `baiyue.api.business.failures` 按有限 `code` 标记 |
 | 过滤器测试 | `src/test/java/com/baiyue/common/web/CorrelationIdFilterTest.java` |
@@ -27,5 +28,6 @@
 - 修改 Correlation ID 时同步检查当前请求头契约、线程上下文清理和日志链路。
 - 入站 Trace 优先级固定为：合法单值 `traceparent` > 完全缺失 `traceparent` 时的 32 位非零十六进制 `X-Trace-Id` > 新 trace。只要 `traceparent` 已出现但重复、超长、格式非法或含全零 ID，就必须生成新 trace，不得回退信任 `X-Trace-Id`；请求 ID 独立按 `X-Request-Id` 校验或生成。
 - 同步 Feign 出站固定先移除调用模板中的 `X-Request-Id`、`X-Trace-Id`、`traceparent`，再仅从当前 MDC 的合法请求 ID 和 trace ID 重建；`traceparent` 沿用当前 trace ID、每次调用生成新非零 span ID、flags 固定 `01`。不得从业务参数、远端返回头或无效 MDC 建立上下文；本能力不处理 Reactor、异步线程、重试、超时或 fallback。
+- 同步 RestClient 出站统一覆盖 `X-Request-Id`、`X-Trace-Id`、`traceparent`，从当前 MDC 生成 child span；MDC 缺失或非法时安全新建 trace。不得从业务参数或远端响应头建立上下文，生产代码应使用 Spring 管理的 `RestClient.Builder`，原始 Builder 必须显式安装同一拦截器。
 - 从父目录运行 `mvn -pl common-web -am test`。
 - 所有对外 `Long/long` 值统一序列化为 JSON 字符串，避免 19 位雪花 ID 在浏览器中丢失精度；禁止业务模块重复添加局部转换器。
diff --git a/common-web/src/main/java/com/baiyue/common/web/OutboundTraceHeaders.java b/common-web/src/main/java/com/baiyue/common/web/OutboundTraceHeaders.java
new file mode 100644
index 000000000..bbd1be9a4
--- /dev/null
+++ b/common-web/src/main/java/com/baiyue/common/web/OutboundTraceHeaders.java
@@ -0,0 +1,40 @@
+package com.baiyue.common.web;
+
+import org.slf4j.MDC;
+
+import java.util.UUID;
+import java.util.regex.Pattern;
+
+/** Immutable standard headers for one synchronous outbound child span. */
+public record OutboundTraceHeaders(String requestId, String traceId, String traceParent) {
+    private static final Pattern SAFE_REQUEST_ID = Pattern.compile("[A-Za-z0-9._:-]{1,128}");
+
+    /** Builds a child span from the current MDC, safely starting a new trace when absent/invalid. */
+    public static OutboundTraceHeaders fromCurrentOrNew() {
+        String requestId = safeRequestId(MDC.get(CorrelationContext.REQUEST_ID));
+        String traceId = TraceParent.normalizeTrustedTraceId(MDC.get(CorrelationContext.TRACE_ID))
+                .orElseGet(() -> TraceParent.newRoot(null).traceId());
+        return child(requestId, traceId);
+    }
+
+    /** Builds a local child from a trusted persisted trace value, or safely starts a new trace. */
+    public static OutboundTraceHeaders fromTrustedTraceOrNew(String trustedTraceId) {
+        String traceId = TraceParent.normalizeTrustedTraceId(trustedTraceId)
+                .orElseGet(() -> TraceParent.newRoot(null).traceId());
+        return child(UUID.randomUUID().toString(), traceId);
+    }
+
+    public String spanId() {
+        return TraceParent.parse(traceParent).orElseThrow().parentId();
+    }
+
+    private static OutboundTraceHeaders child(String requestId, String traceId) {
+        TraceParent child = TraceParent.outboundChild(traceId);
+        return new OutboundTraceHeaders(requestId, child.traceId(), child.value());
+    }
+
+    private static String safeRequestId(String value) {
+        return value != null && SAFE_REQUEST_ID.matcher(value).matches()
+                ? value : UUID.randomUUID().toString();
+    }
+}
diff --git a/common-web/src/main/java/com/baiyue/common/web/RestClientTraceCustomizer.java b/common-web/src/main/java/com/baiyue/common/web/RestClientTraceCustomizer.java
new file mode 100644
index 000000000..0fcf7ad9f
--- /dev/null
+++ b/common-web/src/main/java/com/baiyue/common/web/RestClientTraceCustomizer.java
@@ -0,0 +1,24 @@
+package com.baiyue.common.web;
+
+import org.springframework.boot.web.client.RestClientCustomizer;
+import org.springframework.core.Ordered;
+import org.springframework.web.client.RestClient;
+
+/** Installs the trace interceptor after ordinary RestClient customizers. */
+public final class RestClientTraceCustomizer implements RestClientCustomizer, Ordered {
+    private final RestClientTraceInterceptor interceptor;
+
+    public RestClientTraceCustomizer(RestClientTraceInterceptor interceptor) {
+        this.interceptor = interceptor;
+    }
+
+    @Override
+    public void customize(RestClient.Builder builder) {
+        builder.requestInterceptor(interceptor);
+    }
+
+    @Override
+    public int getOrder() {
+        return Ordered.LOWEST_PRECEDENCE;
+    }
+}
diff --git a/common-web/src/main/java/com/baiyue/common/web/RestClientTraceInterceptor.java b/common-web/src/main/java/com/baiyue/common/web/RestClientTraceInterceptor.java
new file mode 100644
index 000000000..488cd808f
--- /dev/null
+++ b/common-web/src/main/java/com/baiyue/common/web/RestClientTraceInterceptor.java
@@ -0,0 +1,21 @@
+package com.baiyue.common.web;
+
+import org.springframework.http.HttpRequest;
+import org.springframework.http.client.ClientHttpRequestExecution;
+import org.springframework.http.client.ClientHttpRequestInterceptor;
+import org.springframework.http.client.ClientHttpResponse;
+
+import java.io.IOException;
+
+/** Applies the trusted synchronous trace context to Spring RestClient requests. */
+public final class RestClientTraceInterceptor implements ClientHttpRequestInterceptor {
+    @Override
+    public ClientHttpResponse intercept(HttpRequest request, byte[] body,
+                                        ClientHttpRequestExecution execution) throws IOException {
+        OutboundTraceHeaders outbound = OutboundTraceHeaders.fromCurrentOrNew();
+        request.getHeaders().set(CorrelationContext.REQUEST_ID_HEADER, outbound.requestId());
+        request.getHeaders().set(CorrelationContext.TRACE_ID_HEADER, outbound.traceId());
+        request.getHeaders().set(CorrelationContext.TRACE_PARENT_HEADER, outbound.traceParent());
+        return execution.execute(request, body);
+    }
+}
diff --git a/common-web/src/main/java/com/baiyue/common/web/RestClientTracePropagationAutoConfiguration.java b/common-web/src/main/java/com/baiyue/common/web/RestClientTracePropagationAutoConfiguration.java
new file mode 100644
index 000000000..6acccad5d
--- /dev/null
+++ b/common-web/src/main/java/com/baiyue/common/web/RestClientTracePropagationAutoConfiguration.java
@@ -0,0 +1,25 @@
+package com.baiyue.common.web;
+
+import org.springframework.boot.autoconfigure.AutoConfiguration;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnClass;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean;
+import org.springframework.boot.web.client.RestClientCustomizer;
+import org.springframework.context.annotation.Bean;
+import org.springframework.web.client.RestClient;
+
+/** Adds trace propagation to Spring-managed RestClient builders. */
+@AutoConfiguration(afterName = "org.springframework.boot.autoconfigure.web.client.RestClientAutoConfiguration")
+@ConditionalOnClass({RestClient.class, RestClientCustomizer.class})
+public class RestClientTracePropagationAutoConfiguration {
+
+    @Bean
+    @ConditionalOnMissingBean(RestClientTraceInterceptor.class)
+    RestClientTraceInterceptor restClientTraceInterceptor() {
+        return new RestClientTraceInterceptor();
+    }
+
+    @Bean
+    RestClientTraceCustomizer baiyueTraceRestClientCustomizer(RestClientTraceInterceptor interceptor) {
+        return new RestClientTraceCustomizer(interceptor);
+    }
+}
diff --git a/common-web/src/main/java/com/baiyue/common/web/TraceParent.java b/common-web/src/main/java/com/baiyue/common/web/TraceParent.java
index 2ece6f081..88ae5829f 100644
--- a/common-web/src/main/java/com/baiyue/common/web/TraceParent.java
+++ b/common-web/src/main/java/com/baiyue/common/web/TraceParent.java
@@ -3,6 +3,7 @@ package com.baiyue.common.web;
 import java.security.SecureRandom;
 import java.util.HexFormat;
 import java.util.Optional;
+import java.util.Locale;
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;
 
@@ -63,6 +64,24 @@ public record TraceParent(String traceId, String parentId, String traceFlags) {
         return new TraceParent(currentTraceId.toLowerCase(java.util.Locale.ROOT), randomNonZero(8), "01");
     }
 
+    /**
+     * Normalizes a trace ID from a trusted persisted/internal context.
+     *
+     * <p>Unlike an untrusted HTTP header, a canonical UUID is accepted and compacted because
+     * existing event envelopes historically persisted UUID trace IDs.</p>
+     */
+    public static Optional<String> normalizeTrustedTraceId(String value) {
+        if (validLegacyTraceId(value)) {
+            return Optional.of(value.toLowerCase(Locale.ROOT));
+        }
+        if (value != null && value.matches(
+                "[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}")) {
+            String compact = value.replace("-", "").toLowerCase(Locale.ROOT);
+            return validLegacyTraceId(compact) ? Optional.of(compact) : Optional.empty();
+        }
+        return Optional.empty();
+    }
+
     public static boolean validLegacyTraceId(String value) {
         return value != null && LEGACY_TRACE_ID.matcher(value).matches()
                 && !ZERO_TRACE_ID.equalsIgnoreCase(value);
diff --git a/common-web/src/main/resources/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports b/common-web/src/main/resources/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports
index 06a277bae..2d417843c 100644
--- a/common-web/src/main/resources/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports
+++ b/common-web/src/main/resources/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports
@@ -1,3 +1,4 @@
 com.baiyue.common.web.LongIdJacksonConfiguration
 com.baiyue.common.web.CommonWebAutoConfiguration
 com.baiyue.common.web.FeignTracePropagationAutoConfiguration
+com.baiyue.common.web.RestClientTracePropagationAutoConfiguration
diff --git a/common-web/src/test/java/com/baiyue/common/web/OutboundTraceHeadersTest.java b/common-web/src/test/java/com/baiyue/common/web/OutboundTraceHeadersTest.java
new file mode 100644
index 000000000..c0f3c006a
--- /dev/null
+++ b/common-web/src/test/java/com/baiyue/common/web/OutboundTraceHeadersTest.java
@@ -0,0 +1,41 @@
+package com.baiyue.common.web;
+
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.Test;
+import org.slf4j.MDC;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+class OutboundTraceHeadersTest {
+
+    @AfterEach
+    void clearMdc() {
+        MDC.clear();
+    }
+
+    @Test
+    void currentContextCreatesAValidChildWithoutUsingBusinessValues() {
+        MDC.put(CorrelationContext.REQUEST_ID, "req-trusted");
+        MDC.put(CorrelationContext.TRACE_ID, "4bf92f3577b34da6a3ce929d0e0e4736");
+
+        OutboundTraceHeaders headers = OutboundTraceHeaders.fromCurrentOrNew();
+
+        assertThat(headers.requestId()).isEqualTo("req-trusted");
+        assertThat(headers.traceId()).isEqualTo("4bf92f3577b34da6a3ce929d0e0e4736");
+        assertThat(headers.traceParent())
+                .matches("00-4bf92f3577b34da6a3ce929d0e0e4736-[0-9a-f]{16}-01");
+    }
+
+    @Test
+    void canonicalPersistedUuidIsCompactedAndInvalidValueStartsNewTrace() {
+        OutboundTraceHeaders uuid = OutboundTraceHeaders.fromTrustedTraceOrNew(
+                "550e8400-e29b-41d4-a716-446655440000");
+        OutboundTraceHeaders invalid = OutboundTraceHeaders.fromTrustedTraceOrNew(
+                "ORDER:customer-99:booking-123");
+
+        assertThat(uuid.traceId()).isEqualTo("550e8400e29b41d4a716446655440000");
+        assertThat(invalid.traceId()).matches("[0-9a-f]{32}")
+                .isNotEqualTo("ORDER:customer-99:booking-123");
+        assertThat(invalid.requestId()).matches("[0-9a-f-]{36}");
+    }
+}
diff --git a/common-web/src/test/java/com/baiyue/common/web/RestClientTraceInterceptorTest.java b/common-web/src/test/java/com/baiyue/common/web/RestClientTraceInterceptorTest.java
new file mode 100644
index 000000000..b8c6e74e7
--- /dev/null
+++ b/common-web/src/test/java/com/baiyue/common/web/RestClientTraceInterceptorTest.java
@@ -0,0 +1,60 @@
+package com.baiyue.common.web;
+
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.Test;
+import org.slf4j.MDC;
+import org.springframework.mock.http.client.MockClientHttpRequest;
+import org.springframework.mock.http.client.MockClientHttpResponse;
+
+import java.util.concurrent.atomic.AtomicReference;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+class RestClientTraceInterceptorTest {
+    private final RestClientTraceInterceptor interceptor = new RestClientTraceInterceptor();
+
+    @AfterEach
+    void clearMdc() {
+        MDC.clear();
+    }
+
+    @Test
+    void trustedContextOverwritesAllCallerProvidedTraceHeaders() throws Exception {
+        MDC.put(CorrelationContext.REQUEST_ID, "req-rest-client");
+        MDC.put(CorrelationContext.TRACE_ID, "4bf92f3577b34da6a3ce929d0e0e4736");
+        MockClientHttpRequest request = new MockClientHttpRequest();
+        request.getHeaders().add(CorrelationContext.REQUEST_ID_HEADER, "business-request-id");
+        request.getHeaders().add(CorrelationContext.TRACE_ID_HEADER, "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa");
+        request.getHeaders().add(CorrelationContext.TRACE_PARENT_HEADER,
+                "00-aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-bbbbbbbbbbbbbbbb-00");
+        AtomicReference<org.springframework.http.HttpHeaders> captured = new AtomicReference<>();
+
+        interceptor.intercept(request, new byte[0], (outbound, body) -> {
+            captured.set(outbound.getHeaders());
+            return new MockClientHttpResponse(new byte[0], org.springframework.http.HttpStatus.OK);
+        });
+
+        assertThat(captured.get().getValuesAsList(CorrelationContext.REQUEST_ID_HEADER))
+                .containsExactly("req-rest-client");
+        assertThat(captured.get().getValuesAsList(CorrelationContext.TRACE_ID_HEADER))
+                .containsExactly("4bf92f3577b34da6a3ce929d0e0e4736");
+        assertThat(captured.get().getFirst(CorrelationContext.TRACE_PARENT_HEADER))
+                .matches("00-4bf92f3577b34da6a3ce929d0e0e4736-[0-9a-f]{16}-01");
+    }
+
+    @Test
+    void missingOrInvalidMdcSafelyCreatesNewStandardHeaders() throws Exception {
+        MDC.put(CorrelationContext.TRACE_ID, "business-order-123");
+        MockClientHttpRequest request = new MockClientHttpRequest();
+
+        interceptor.intercept(request, new byte[0], (outbound, body) ->
+                new MockClientHttpResponse(new byte[0], org.springframework.http.HttpStatus.OK));
+
+        assertThat(request.getHeaders().getFirst(CorrelationContext.REQUEST_ID_HEADER))
+                .matches("[0-9a-f-]{36}");
+        assertThat(request.getHeaders().getFirst(CorrelationContext.TRACE_ID_HEADER))
+                .matches("[0-9a-f]{32}").isNotEqualTo("business-order-123");
+        assertThat(request.getHeaders().getFirst(CorrelationContext.TRACE_PARENT_HEADER))
+                .matches("00-[0-9a-f]{32}-[0-9a-f]{16}-01");
+    }
+}
diff --git a/common-web/src/test/java/com/baiyue/common/web/RestClientTracePropagationAutoConfigurationTest.java b/common-web/src/test/java/com/baiyue/common/web/RestClientTracePropagationAutoConfigurationTest.java
new file mode 100644
index 000000000..f2edb83d2
--- /dev/null
+++ b/common-web/src/test/java/com/baiyue/common/web/RestClientTracePropagationAutoConfigurationTest.java
@@ -0,0 +1,37 @@
+package com.baiyue.common.web;
+
+import org.junit.jupiter.api.Test;
+import org.springframework.boot.autoconfigure.AutoConfigurations;
+import org.springframework.boot.test.context.runner.ApplicationContextRunner;
+import org.springframework.boot.web.client.RestClientCustomizer;
+import org.springframework.core.Ordered;
+import org.springframework.web.client.RestClient;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+
+class RestClientTracePropagationAutoConfigurationTest {
+    private final ApplicationContextRunner contextRunner = new ApplicationContextRunner()
+            .withConfiguration(AutoConfigurations.of(RestClientTracePropagationAutoConfiguration.class));
+
+    @Test
+    void registersInterceptorAndIndependentCustomizer() {
+        contextRunner.run(context -> {
+            assertThat(context).hasSingleBean(RestClientTraceInterceptor.class);
+            assertThat(context).hasBean("baiyueTraceRestClientCustomizer");
+            assertThat(context.getBeansOfType(RestClientCustomizer.class)).hasSize(1);
+            RestClientTraceCustomizer customizer = context.getBean(RestClientTraceCustomizer.class);
+            assertThat(customizer.getOrder()).isEqualTo(Ordered.LOWEST_PRECEDENCE);
+            RestClient.Builder builder = mock(RestClient.Builder.class);
+            customizer.customize(builder);
+            verify(builder).requestInterceptor(context.getBean(RestClientTraceInterceptor.class));
+        });
+    }
+
+    @Test
+    void reusesApplicationProvidedTraceInterceptor() {
+        contextRunner.withBean(RestClientTraceInterceptor.class, RestClientTraceInterceptor::new)
+                .run(context -> assertThat(context).hasSingleBean(RestClientTraceInterceptor.class));
+    }
+}
diff --git a/common-web/src/test/java/com/baiyue/common/web/TraceParentTest.java b/common-web/src/test/java/com/baiyue/common/web/TraceParentTest.java
index e59be28aa..e67870a1c 100644
--- a/common-web/src/test/java/com/baiyue/common/web/TraceParentTest.java
+++ b/common-web/src/test/java/com/baiyue/common/web/TraceParentTest.java
@@ -51,4 +51,12 @@ class TraceParentTest {
         assertThat(child.value()).matches(
                 "00-4bf92f3577b34da6a3ce929d0e0e4736-[0-9a-f]{16}-01");
     }
+
+    @Test
+    void trustedPersistedUuidNormalizationDoesNotBroadenHttpParsing() {
+        assertThat(TraceParent.normalizeTrustedTraceId("550E8400-E29B-41D4-A716-446655440000"))
+                .contains("550e8400e29b41d4a716446655440000");
+        assertThat(TraceParent.parse(
+                "00-550E8400E29B41D4A716446655440000-00f067aa0ba902b7-01")).isEmpty();
+    }
 }
diff --git a/config/nacos/cn/iam-service.yml b/config/nacos/cn/iam-service.yml
index 32dcc05c7..f735164e7 100644
--- a/config/nacos/cn/iam-service.yml
+++ b/config/nacos/cn/iam-service.yml
@@ -5,6 +5,11 @@ spring:
     password: ${IAM_DB_PASSWORD}
     driver-class-name: com.mysql.cj.jdbc.Driver
 baiyue:
+  security-event:
+    event-bridge-url: ${SECURITY_EVENT_BRIDGE_URL:http://event-bridge-overseas:9312}
+  customer-dimension-initialization:
+    fixed-delay-ms: ${CUSTOMER_DIMENSION_INITIALIZATION_FIXED_DELAY_MS:5000}
+    max-attempts: ${CUSTOMER_DIMENSION_INITIALIZATION_MAX_ATTEMPTS:12}
   notification:
     scheduler-enabled: ${NOTIFICATION_SCHEDULER_ENABLED:false}
     dispatch-timeout-seconds: ${NOTIFICATION_DISPATCH_TIMEOUT_SECONDS:300}
diff --git a/config/nacos/local/iam-service.yml b/config/nacos/local/iam-service.yml
index 4639f7ca1..cc1ad14ab 100644
--- a/config/nacos/local/iam-service.yml
+++ b/config/nacos/local/iam-service.yml
@@ -4,6 +4,9 @@ spring.datasource:
   username: ${IAM_DB_USERNAME:root}
   password: ${IAM_DB_PASSWORD:123456}
 baiyue:
+  customer-dimension-initialization:
+    fixed-delay-ms: ${CUSTOMER_DIMENSION_INITIALIZATION_FIXED_DELAY_MS:5000}
+    max-attempts: ${CUSTOMER_DIMENSION_INITIALIZATION_MAX_ATTEMPTS:12}
   notification:
     scheduler-enabled: ${NOTIFICATION_SCHEDULER_ENABLED:false}
     dispatch-timeout-seconds: ${NOTIFICATION_DISPATCH_TIMEOUT_SECONDS:300}
diff --git a/config/nacos/overseas/event-bridge-service.yml b/config/nacos/overseas/event-bridge-service.yml
index bbc198d5c..00a8ac755 100644
--- a/config/nacos/overseas/event-bridge-service.yml
+++ b/config/nacos/overseas/event-bridge-service.yml
@@ -10,7 +10,7 @@ baiyue:
   data-residency: ${DATA_RESIDENCY:OVERSEAS}
   event-dispatcher:
     consumer-url: ${EVENT_CONSUMER_URL:http://lastleg-service:9303/internal/lastleg/events}
-    security-consumer-url: ${OVERSEAS_SECURITY_EVENT_CONSUMER_URL:http://overseas-security-service:9307/internal/overseas-security/v1/events}
+    security-consumer-url: ${LASTLEG_SECURITY_EVENT_CONSUMER_URL:http://lastleg-service:9303/internal/lastleg/security/v1/events}
     fixed-delay: ${EVENT_DISPATCH_FIXED_DELAY:3000}
     batch-size: ${EVENT_DISPATCH_BATCH_SIZE:50}
     max-attempts: ${EVENT_DISPATCH_MAX_ATTEMPTS:10}
diff --git a/config/nacos/overseas/gateway-overseas.yml b/config/nacos/overseas/gateway-overseas.yml
index 11e2deb34..a9c1eadf2 100644
--- a/config/nacos/overseas/gateway-overseas.yml
+++ b/config/nacos/overseas/gateway-overseas.yml
@@ -4,6 +4,6 @@ springdoc:
 baiyue:
   security:
     overseas-projection:
-      service-url: ${OVERSEAS_SECURITY_SERVICE_URL:http://overseas-security-service:9307}
+      service-url: ${LASTLEG_SECURITY_SERVICE_URL:http://lastleg-service:9303}
       internal-service-token: ${INTERNAL_SERVICE_TOKEN}
-      timeout: ${OVERSEAS_SECURITY_VALIDATION_TIMEOUT:2s}
+      timeout: ${LASTLEG_SECURITY_VALIDATION_TIMEOUT:2s}
diff --git a/config/nacos/overseas/overseas-security-service.yml b/config/nacos/overseas/overseas-security-service.yml
deleted file mode 100644
index 80565c445..000000000
--- a/config/nacos/overseas/overseas-security-service.yml
+++ /dev/null
@@ -1,7 +0,0 @@
-springdoc:
-  api-docs.enabled: ${SWAGGER_ENABLED:false}
-  swagger-ui.enabled: ${SWAGGER_ENABLED:false}
-baiyue:
-  security:
-    internal-service-token: ${INTERNAL_SERVICE_TOKEN}
-    permission-snapshot-key-prefix: ${PERMISSION_SNAPSHOT_KEY_PREFIX:baiyue:permission-snapshot}
diff --git a/config/nacos/overseas/warehouse-overseas-service.yml b/config/nacos/overseas/warehouse-overseas-service.yml
index a05d57b33..53f24467e 100644
--- a/config/nacos/overseas/warehouse-overseas-service.yml
+++ b/config/nacos/overseas/warehouse-overseas-service.yml
@@ -4,3 +4,8 @@ spring:
     username: ${WAREHOUSE_DB_USERNAME}
     password: ${WAREHOUSE_DB_PASSWORD}
     driver-class-name: com.mysql.cj.jdbc.Driver
+baiyue:
+  clients:
+    domestic-warehouse:
+      url: ${DOMESTIC_WAREHOUSE_URL}
+      cache-ttl: ${DOMESTIC_WAREHOUSE_CACHE_TTL:30m}
diff --git a/deploy/docker-compose.overseas.yml b/deploy/docker-compose.overseas.yml
index f41f67f15..24729ca6a 100644
--- a/deploy/docker-compose.overseas.yml
+++ b/deploy/docker-compose.overseas.yml
@@ -47,8 +47,8 @@ services:
       CORS_ALLOW_CREDENTIALS: ${CORS_ALLOW_CREDENTIALS:-false}
       AUTH_SESSION_VALIDATION_URL: ${AUTH_SESSION_VALIDATION_URL}
       PDA_SESSION_VALIDATION_TIMEOUT: ${PDA_SESSION_VALIDATION_TIMEOUT:-2s}
-      OVERSEAS_SECURITY_SERVICE_URL: ${OVERSEAS_SECURITY_SERVICE_URL:-http://overseas-security-service:9307}
-      OVERSEAS_SECURITY_VALIDATION_TIMEOUT: ${OVERSEAS_SECURITY_VALIDATION_TIMEOUT:-2s}
+      LASTLEG_SECURITY_SERVICE_URL: ${LASTLEG_SECURITY_SERVICE_URL:-http://lastleg-service:9303}
+      LASTLEG_SECURITY_VALIDATION_TIMEOUT: ${LASTLEG_SECURITY_VALIDATION_TIMEOUT:-2s}
 
   lastleg-service:
     <<: *overseas-common
@@ -80,6 +80,7 @@ services:
       WAREHOUSE_DB_URL: ${WAREHOUSE_OVERSEAS_DB_URL}
       WAREHOUSE_DB_USERNAME: ${WAREHOUSE_OVERSEAS_DB_USERNAME}
       WAREHOUSE_DB_PASSWORD: ${WAREHOUSE_OVERSEAS_DB_PASSWORD}
+      DOMESTIC_WAREHOUSE_URL: ${DOMESTIC_WAREHOUSE_URL}
 
   event-bridge-service:
     <<: *overseas-common
@@ -94,25 +95,12 @@ services:
       EVENT_BRIDGE_DB_USERNAME: ${EVENT_BRIDGE_OVERSEAS_DB_USERNAME}
       EVENT_BRIDGE_DB_PASSWORD: ${EVENT_BRIDGE_OVERSEAS_DB_PASSWORD}
       EVENT_CONSUMER_URL: ${EVENT_CONSUMER_URL:-http://lastleg-service:9303/internal/lastleg/events}
-      OVERSEAS_SECURITY_EVENT_CONSUMER_URL: ${OVERSEAS_SECURITY_EVENT_CONSUMER_URL:-http://overseas-security-service:9307/internal/overseas-security/v1/events}
+      LASTLEG_SECURITY_EVENT_CONSUMER_URL: ${LASTLEG_SECURITY_EVENT_CONSUMER_URL:-http://lastleg-service:9303/internal/lastleg/security/v1/events}
     networks:
       firstleg-overseas-network:
       infra-network:
         aliases: [event-bridge-overseas]
 
-  overseas-security-service:
-    <<: *overseas-common
-    image: ${IMAGE_REPOSITORY}/overseas-security-service:${IMAGE_TAG}
-    container_name: firstleg-${DEPLOY_ENV:-test}-overseas-security
-    ports: ["${PUBLISHED_BIND_ADDRESS:-127.0.0.1}:${OVERSEAS_SECURITY_PORT:-9307}:9307"]
-    volumes: ["${LOG_ROOT:-/data/logs/baiyue-firstleg}/overseas-security-service:/app/logs"]
-    environment:
-      <<: *overseas-environment
-      SERVER_PORT: 9307
-      OVERSEAS_SECURITY_DB_URL: ${OVERSEAS_SECURITY_DB_URL}
-      OVERSEAS_SECURITY_DB_USERNAME: ${OVERSEAS_SECURITY_DB_USERNAME}
-      OVERSEAS_SECURITY_DB_PASSWORD: ${OVERSEAS_SECURITY_DB_PASSWORD}
-
 networks:
   firstleg-overseas-network:
     name: firstleg-${DEPLOY_ENV:-test}-overseas-network
diff --git a/deploy/docker-compose.yml b/deploy/docker-compose.yml
index 4f6700005..8e61b9ec7 100644
--- a/deploy/docker-compose.yml
+++ b/deploy/docker-compose.yml
@@ -79,6 +79,7 @@ services:
       IAM_DB_URL: ${IAM_DB_URL}
       IAM_DB_USERNAME: ${IAM_DB_USERNAME}
       IAM_DB_PASSWORD: ${IAM_DB_PASSWORD}
+      SECURITY_EVENT_BRIDGE_URL: ${SECURITY_EVENT_BRIDGE_URL:-http://event-bridge-overseas:9312}
 
   firstleg:
     <<: *common
diff --git a/deploy/scripts/deploy-built-service.sh b/deploy/scripts/deploy-built-service.sh
index b8d703d8c..d4ad1ad7d 100644
--- a/deploy/scripts/deploy-built-service.sh
+++ b/deploy/scripts/deploy-built-service.sh
@@ -37,10 +37,7 @@ case "$DEPLOY_ENV" in
 esac
 
 if [ "$DEPLOY_ENV" = "development" ]; then
-  case "$SERVICE" in
-    gateway|gateway-overseas) PUBLISHED_BIND_ADDRESS=0.0.0.0 ;;
-    *) PUBLISHED_BIND_ADDRESS=127.0.0.1 ;;
-  esac
+  PUBLISHED_BIND_ADDRESS=127.0.0.1
 else
   PUBLISHED_BIND_ADDRESS="${PUBLISHED_BIND_ADDRESS:-0.0.0.0}"
 fi
@@ -67,7 +64,7 @@ env_file_value() {
 }
 
 case "$SERVICE" in
-  gateway-overseas|lastleg-service|warehouse-overseas-service|overseas-security-service)
+  gateway-overseas|lastleg-service|warehouse-overseas-service)
     COMPOSE_FILE="deploy/docker-compose.overseas.yml"
     PROJECT_NAME="firstleg-$DEPLOY_ENV-overseas"
     ;;
@@ -101,15 +98,6 @@ if [ "$SERVICE" = "gateway-overseas" ]; then
   fi
 fi
 
-if [ "$SERVICE" = "overseas-security-service" ]; then
-  for key in OVERSEAS_SECURITY_DB_URL OVERSEAS_SECURITY_DB_USERNAME OVERSEAS_SECURITY_DB_PASSWORD; do
-    if ! env_file_has_key "$key" || [ -z "$(env_file_value "$key")" ]; then
-      echo "部署 overseas-security-service 时，环境文件必须包含非空 $key" >&2
-      exit 2
-    fi
-  done
-fi
-
 for file in "$ENV_FILE" "$COMPOSE_FILE"; do
   if [ ! -f "$file" ]; then
     echo "必需文件不存在: $file" >&2
@@ -127,7 +115,7 @@ if [ "$SERVICE" = "finance" ]; then
 fi
 
 case "$SERVICE" in
-  gateway-overseas|lastleg-service|warehouse-overseas-service|overseas-security-service)
+  gateway-overseas|lastleg-service|warehouse-overseas-service)
     for key in NACOS_SERVER_ADDR OVERSEAS_NACOS_NAMESPACE INTERNAL_SERVICE_TOKEN JWT_ISSUER OVERSEAS_JWT_AUDIENCE JWT_JWK_SET_URI; do
       if ! env_file_has_key "$key" || [ -z "$(env_file_value "$key")" ]; then
         echo "部署海外服务时，环境文件必须包含非空 $key" >&2
@@ -433,10 +421,7 @@ export DEPLOY_ENV="$deploy_env"
 export IMAGE_REPOSITORY="$image_repository"
 export IMAGE_TAG="$image_tag"
 if [ "$deploy_env" = "development" ]; then
-  case "$service" in
-    gateway|gateway-overseas) export PUBLISHED_BIND_ADDRESS=0.0.0.0 ;;
-    *) export PUBLISHED_BIND_ADDRESS=127.0.0.1 ;;
-  esac
+  export PUBLISHED_BIND_ADDRESS=127.0.0.1
 else
   export PUBLISHED_BIND_ADDRESS="${PUBLISHED_BIND_ADDRESS:-0.0.0.0}"
 fi
diff --git a/deploy/scripts/deploy-services.sh b/deploy/scripts/deploy-services.sh
index abdbafef5..7c9983f82 100644
--- a/deploy/scripts/deploy-services.sh
+++ b/deploy/scripts/deploy-services.sh
@@ -39,7 +39,7 @@ env_file_value() {
 DEPLOY_REGION=CN
 for service in $SERVICES; do
   case "$service" in
-    gateway-overseas|lastleg-service|warehouse-overseas-service|overseas-security-service) DEPLOY_REGION=OVERSEAS ;;
+    gateway-overseas|lastleg-service|warehouse-overseas-service) DEPLOY_REGION=OVERSEAS ;;
     event-bridge-service)
       BRIDGE_REGION="${EVENT_BRIDGE_REGION_OVERRIDE:-}"
       if [ -z "$BRIDGE_REGION" ] && env_file_has_key REGION_CODE; then
@@ -60,7 +60,7 @@ done
 if [ "$DEPLOY_REGION" = "OVERSEAS" ]; then
   for service in $SERVICES; do
     case "$service" in
-      gateway-overseas|lastleg-service|warehouse-overseas-service|overseas-security-service|event-bridge-service) ;;
+      gateway-overseas|lastleg-service|warehouse-overseas-service|event-bridge-service) ;;
       *) echo "一次部署不得混合国内与海外服务: $SERVICE_CSV" >&2; exit 2 ;;
     esac
   done
@@ -80,17 +80,6 @@ if [ "$DEPLOY_REGION" = "OVERSEAS" ]; then
   done
 fi
 
-case " $SERVICES " in
-  *" overseas-security-service "*)
-    for key in OVERSEAS_SECURITY_DB_URL OVERSEAS_SECURITY_DB_USERNAME OVERSEAS_SECURITY_DB_PASSWORD; do
-      if ! env_file_has_key "$key" || [ -z "$(env_file_value "$key")" ]; then
-        echo "部署 overseas-security-service 时，环境文件必须包含非空 $key" >&2
-        exit 2
-      fi
-    done
-    ;;
-esac
-
 case " $SERVICES " in
   *" gateway-overseas "*)
     if ! env_file_has_key AUTH_SESSION_VALIDATION_URL || [ -z "$(env_file_value AUTH_SESSION_VALIDATION_URL)" ]; then
diff --git a/deploy/service-map.yml b/deploy/service-map.yml
index e78b8a6e5..e22eec804 100644
--- a/deploy/service-map.yml
+++ b/deploy/service-map.yml
@@ -8,11 +8,6 @@ services:
     jar: gateway-overseas/target/gateway-overseas-1.0.0-SNAPSHOT.jar
     port: 9300
     regions: [OVERSEAS]
-  overseas-security-service:
-    artifactId: overseas-security-service
-    jar: overseas-security-service/target/overseas-security-service-1.0.0-SNAPSHOT.jar
-    port: 9307
-    regions: [OVERSEAS]
   auth:
     artifactId: auth-service
     jar: auth/target/auth-service-1.0.0-SNAPSHOT.jar
diff --git a/deploy/sql/README.md b/deploy/sql/README.md
index dc681dba9..5a946294c 100644
--- a/deploy/sql/README.md
+++ b/deploy/sql/README.md
@@ -3,13 +3,14 @@
 ## 唯一数据库初始化与发布入口
 
 - 国内区域固定入口：`头程数据库统一增量-MySQL8.sql`。文件名保留历史兼容，内容维护为当前完整数据库基线和存量环境兼容升级，不再按日期拆分发布脚本。
-- 海外区域固定增量入口：`海外区域统一增量-MySQL8.sql`；空库先分别执行 `lastleg-service/src/main/resources/db/lastleg.sql`、`warehouse-overseas-service/src/main/resources/db/warehouse.sql` 与 `overseas-security-service/src/main/resources/db/overseas-security.sql` 基线，再执行该入口。固定入口升级 `baiyue_lastleg`、`baiyue_lastlag_warehouse` 与 `baiyue_overseas_security`，后者保存 IAM 安全事件消费者 Inbox 和可恢复投影；Redis 只作可重建镜像。
+- 海外区域固定增量入口：`海外区域统一增量-MySQL8.sql`；空库先分别执行 `lastleg-service/src/main/resources/db/lastleg.sql`与 `warehouse-overseas-service/src/main/resources/db/warehouse.sql` 基线，再执行该入口。固定入口会创建并校验独立的 `baiyue_event_bridge_overseas`，再升级 `baiyue_lastleg`与 `baiyue_lastlag_warehouse`；IAM 安全事件 Inbox 和可恢复投影已并入 `baiyue_lastleg.ll_security_*`，Redis 只作可重建镜像。
+- Lastleg 基线和海外固定增量仅确定性初始化国内固定 `platform_admin`（`authUserId=1000001`、`tenantId=0`）的 USER/AUTHORIZATION version=0 安全投影；其他既有开发账号不建立兼容表或长期补投入口。
 - 国内、海外 Compose 部署默认设置 `SPRING_SQL_INIT_MODE=never`，执行任一 SQL 均需用户单独授权。
 - 该脚本汇总一期、二期及已实现三期出仓能力的数据库基线、存量升级、IAM 权限资源和最终结构校验，适用于 MySQL 8.0。
 - 正式上线前的数据库变更直接维护该文件中的当前基线、存量兼容处理和最终校验，不再创建按日期拆分的发布 SQL；正式上线后的迁移策略在生产发布规范中另行冻结。
 - 当前测试环境尚未上线，船期价格表相关表、字段和索引只维护在现有初始化建表定义及本固定入口中，不向 `phase1-order-extension.sql`、`phase2-fba-pricing-migration.sql` 或新的增量脚本追加同一结构。
 - 模块 `src/main/resources/db/` 下的 SQL 用于开发溯源；`deploy/sql/` 下已有日期文件全部冻结为历史记录，不再单独部署，也不得与固定入口重复执行。
-- 固定入口不包含 `auth/phase1-admin-accounts.sql` 和 `warehouse/warehouse-seed.sql`；仅在开发/测试基线账号缺失时创建最小登录账号，重复执行不覆盖现有密码。脚本不写入演示订单；正式平台公共仓库主数据已内联到固定入口。
+- 固定入口不包含 `auth/phase1-admin-accounts.sql` 和 `warehouse/warehouse-seed.sql`；仅在开发/测试基线账号缺失时创建平台管理员，重复执行不覆盖现有密码。脚本不创建固定客户、客户账号或演示订单；客户必须通过正式建档/注册流程创建。正式平台公共仓库主数据已内联到固定入口；义乌、东莞、洛杉矶、纽约四个固定作业仓均初始化 `RECEIVING`，其中洛杉矶和纽约使用海外接柜入仓收货语义，FBA 目的地址不创建作业能力。
 - `warehouse/phase2-pallet-location-schema-migration.sql` 的有效结构已被当前 `phase2-pallet-location-schema.sql` 和后续共享溢出位迁移完整覆盖，因此不重复内联，避免每次部署无条件删除并重建同名唯一索引。
 - 脚本会创建 9 个独立数据库：`baiyue_auth`、`baiyue_iam`、`baiyue_order`、`baiyue_warehouse`、`baiyue_firstleg`、`baiyue_file`、`baiyue_audit`、`baiyue_event_bridge`、`baiyue_finance`。Gateway、Print、Integration Service 无数据库。
 - IAM 消息中心基线已内联到固定入口，包括 5 张 `iam_notification_*` 表、任务/事件幂等约束、平台消息管理权限、企业成员收件箱权限及默认角色授权；模块溯源脚本为 `iam/src/main/resources/db/notification-center.sql`。
diff --git a/deploy/sql/头程数据库统一增量-MySQL8.sql b/deploy/sql/头程数据库统一增量-MySQL8.sql
index f9bd01018..7d593825a 100644
--- a/deploy/sql/头程数据库统一增量-MySQL8.sql
+++ b/deploy/sql/头程数据库统一增量-MySQL8.sql
@@ -278,7 +278,7 @@ PREPARE auth_password_change_required_stmt FROM @auth_password_change_required_s
 EXECUTE auth_password_change_required_stmt;
 DEALLOCATE PREPARE auth_password_change_required_stmt;
 
--- 开发/测试环境最小登录基线：一个平台系统管理员和一个 IT 测试客户管理员。
+-- 开发/测试环境最小登录基线只保留平台系统管理员；客户必须走正式建档/注册流程创建。
 -- 缺失账号首次创建时写入开发基线 BCrypt 哈希；重复执行统一增量绝不覆盖现有密码。
 INSERT INTO auth_account (
   id, username, password_hash, display_name, account_status,
@@ -286,9 +286,7 @@ INSERT INTO auth_account (
   operator_tenant_id, default_membership_id, default_app_code, deleted
 ) VALUES
   (1000001, 'platform_admin', '$2a$12$AMZJjd88leYPLI9uKvjZiew2CTQXI32BXoHFX.FrCi28/IeZ7mZ96',
-   '平台系统管理员', 'ACTIVE', 0, 1, 0, 0, 0, 3000001, 'PLATFORM', 0),
-  (1000002, 'merchant_admin', '$2a$12$AMZJjd88leYPLI9uKvjZiew2CTQXI32BXoHFX.FrCi28/IeZ7mZ96',
-   'IT 测试客户管理员', 'ACTIVE', 0, 1, 0, 10001, 10001, 3000002, 'MERCHANT', 0)
+   '平台系统管理员', 'ACTIVE', 0, 1, 0, 0, 0, 3000001, 'PLATFORM', 0)
 ON DUPLICATE KEY UPDATE
   display_name = VALUES(display_name),
   account_status = 'ACTIVE',
@@ -1194,10 +1192,7 @@ INSERT INTO iam_tenant (
   approved_at, approved_by, created_by, deleted, version
 ) VALUES
   (0, 'PLATFORM', '虫虫出海平台', 'PLATFORM', 'ACTIVE', '虫虫出海平台',
-   NULL, '平台系统管理员', NULL, NULL, NOW(3), 1000001, 1000001, 0, 0),
-  (10001, 'IT_TEST', 'IT 测试客户', 'MERCHANT', 'ACTIVE', 'IT 测试客户',
-   '91310000ITTEST0001', 'IT 测试客户管理员', '13800000000', 'it-test@example.com',
-   NOW(3), 1000001, 1000001, 0, 0)
+   NULL, '平台系统管理员', NULL, NULL, NOW(3), 1000001, 1000001, 0, 0)
 ON DUPLICATE KEY UPDATE
   tenant_code = VALUES(tenant_code), tenant_name = VALUES(tenant_name), tenant_type = VALUES(tenant_type),
   status = 'ACTIVE', legal_name = VALUES(legal_name),
@@ -1206,28 +1201,10 @@ ON DUPLICATE KEY UPDATE
   contact_email = VALUES(contact_email), approved_at = COALESCE(approved_at, NOW(3)),
   approved_by = VALUES(approved_by), deleted = 0;
 
--- The built-in IT customer must be immediately usable for order acceptance tests.
--- These approved metadata rows intentionally have no document URL: initialization must not
--- point at qualification files that do not exist in File service storage.
-INSERT INTO iam_tenant_qualification (
-  id, tenant_id, qualification_type, certificate_no, document_url,
-  valid_from, valid_to, status, review_comment, deleted
-) VALUES
-  (2100001, 10001, 'BUSINESS_LICENSE', '91310000ITTEST0001', NULL,
-   NULL, NULL, 'APPROVED', '开发测试初始化资质，无文件附件', 0),
-  (2100002, 10001, 'LEGAL_PERSON_ID', NULL, NULL,
-   NULL, NULL, 'APPROVED', '开发测试初始化资质，无文件附件', 0)
-ON DUPLICATE KEY UPDATE
-  tenant_id = VALUES(tenant_id), qualification_type = VALUES(qualification_type),
-  certificate_no = VALUES(certificate_no), status = 'APPROVED',
-  review_comment = VALUES(review_comment), deleted = 0;
-
 INSERT INTO iam_user (
   id, auth_user_id, user_type, display_name, phone, email, status, deleted, version
 ) VALUES
-  (2000001, 1000001, 'INTERNAL', '平台系统管理员', NULL, NULL, 'ACTIVE', 0, 0),
-  (2000002, 1000002, 'ENTERPRISE', 'IT 测试客户管理员', '13800000000',
-   'it-test@example.com', 'ACTIVE', 0, 0)
+  (2000001, 1000001, 'INTERNAL', '平台系统管理员', NULL, NULL, 'ACTIVE', 0, 0)
 ON DUPLICATE KEY UPDATE
   display_name = VALUES(display_name), phone = VALUES(phone), email = VALUES(email),
   status = 'ACTIVE', deleted = 0;
@@ -1235,8 +1212,7 @@ ON DUPLICATE KEY UPDATE
 INSERT INTO iam_membership (
   id, tenant_id, user_id, member_type, member_no, status, joined_at, deleted, version
 ) VALUES
-  (3000001, 0, 2000001, 'EMPLOYEE', 'PLATFORM-ADMIN-001', 'ACTIVE', NOW(3), 0, 0),
-  (3000002, 10001, 2000002, 'OWNER', 'MERCHANT-OWNER-001', 'ACTIVE', NOW(3), 0, 0)
+  (3000001, 0, 2000001, 'EMPLOYEE', 'PLATFORM-ADMIN-001', 'ACTIVE', NOW(3), 0, 0)
 ON DUPLICATE KEY UPDATE
   member_type = VALUES(member_type), member_no = VALUES(member_no),
   status = 'ACTIVE', joined_at = COALESCE(joined_at, NOW(3)), left_at = NULL, deleted = 0;
@@ -1246,9 +1222,7 @@ INSERT INTO iam_role (
 ) VALUES
   (4000001, 0, 'PLATFORM', 'PLATFORM_ADMIN', '平台超级管理员', 'SYSTEM', 'ACTIVE', '一期平台全部菜单和按钮', 0, 0),
   (4000002, 0, 'PLATFORM', 'CUSTOMER_REVIEWER', '企业审核员', 'SYSTEM', 'ACTIVE', '企业资料与入驻审核', 0, 0),
-  (4000003, 0, 'PLATFORM', 'ORDER_OPERATOR', '平台订单运营', 'SYSTEM', 'ACTIVE', '头程订单审核与履约处理', 0, 0),
-  (4000101, 10001, 'MERCHANT', 'MERCHANT_OWNER', '企业管理员', 'SYSTEM', 'ACTIVE', '本企业一期全部菜单和按钮', 0, 0),
-  (4000102, 10001, 'MERCHANT', 'MERCHANT_ORDER_MANAGER', '企业订单管理员', 'SYSTEM', 'ACTIVE', '本企业头程订单操作', 0, 0)
+  (4000003, 0, 'PLATFORM', 'ORDER_OPERATOR', '平台订单运营', 'SYSTEM', 'ACTIVE', '头程订单审核与履约处理', 0, 0)
 ON DUPLICATE KEY UPDATE
   role_name = VALUES(role_name), role_type = VALUES(role_type), status = 'ACTIVE',
   description = VALUES(description), deleted = 0;
@@ -1335,39 +1309,8 @@ SELECT 4000003, id, 0 FROM iam_permission
 WHERE id IN (5102019, 5102024, 5102025)
 ON DUPLICATE KEY UPDATE tenant_id = VALUES(tenant_id);
 
--- Merchant: level-one menus, level-two menus and buttons.
-INSERT INTO iam_permission
-  (id, tenant_id, app_code, permission_type, parent_id, permission_code, permission_name, route_path, http_method, sort_no, status, deleted)
-VALUES
-  (5200000, 10001, 'MERCHANT', 'MENU', 0, 'merchant:enterprise', '企业管理', '/enterprise', NULL, 10, 'ACTIVE', 0),
-  (5201000, 10001, 'MERCHANT', 'MENU', 0, 'merchant:order', '头程订单', '/first-leg-orders', NULL, 20, 'ACTIVE', 0),
-  (5202000, 10001, 'MERCHANT', 'MENU', 0, 'merchant:master-data', '基础资料', '/master-data', NULL, 30, 'ACTIVE', 0),
-  (5200010, 10001, 'MERCHANT', 'MENU', 5200000, 'merchant:profile:view', '企业资料', '/enterprise/profile', NULL, 10, 'ACTIVE', 0),
-  (5200020, 10001, 'MERCHANT', 'MENU', 5200000, 'merchant:member:list', '企业成员', '/enterprise/members', NULL, 20, 'ACTIVE', 0),
-  (5200030, 10001, 'MERCHANT', 'MENU', 5200000, 'merchant:role:list', '角色管理', '/enterprise/roles', NULL, 30, 'ACTIVE', 0),
-  (5201010, 10001, 'MERCHANT', 'MENU', 5201000, 'merchant:order:list', '我的订单', '/first-leg-orders/list', NULL, 10, 'ACTIVE', 0),
-  (5201020, 10001, 'MERCHANT', 'MENU', 5201000, 'merchant:order:create-page', '新建订单', '/first-leg-orders/create', NULL, 20, 'ACTIVE', 0),
-  (5202010, 10001, 'MERCHANT', 'MENU', 5202000, 'merchant:warehouse:list', '收货仓选择', '/master-data/warehouses', NULL, 10, 'ACTIVE', 0),
-  (5202020, 10001, 'MERCHANT', 'MENU', 5202000, 'merchant:counterparty:list', '往来单位', '/master-data/counterparties', NULL, 20, 'ACTIVE', 0),
-  (5200011, 10001, 'MERCHANT', 'BUTTON', 5200010, 'merchant:profile:edit', '编辑企业资料', NULL, NULL, 10, 'ACTIVE', 0),
-  (5200012, 10001, 'MERCHANT', 'BUTTON', 5200010, 'merchant:qualification:upload', '上传企业资质', NULL, NULL, 20, 'ACTIVE', 0),
-  (5200021, 10001, 'MERCHANT', 'BUTTON', 5200020, 'merchant:member:create', '新增成员', NULL, NULL, 10, 'ACTIVE', 0),
-  (5200022, 10001, 'MERCHANT', 'BUTTON', 5200020, 'merchant:member:grant-role', '分配角色', NULL, NULL, 20, 'ACTIVE', 0),
-  (5200031, 10001, 'MERCHANT', 'BUTTON', 5200030, 'merchant:role:create', '新增角色', NULL, NULL, 10, 'ACTIVE', 0),
-  (5200032, 10001, 'MERCHANT', 'BUTTON', 5200030, 'merchant:role:grant', '角色授权', NULL, NULL, 20, 'ACTIVE', 0),
-  (5201011, 10001, 'MERCHANT', 'BUTTON', 5201010, 'merchant:order:view', '查看订单', NULL, NULL, 10, 'ACTIVE', 0),
-  (5201012, 10001, 'MERCHANT', 'BUTTON', 5201010, 'merchant:order:cancel', '取消订单', NULL, NULL, 20, 'ACTIVE', 0),
-  (5201021, 10001, 'MERCHANT', 'BUTTON', 5201020, 'merchant:order:create', '创建草稿', NULL, NULL, 10, 'ACTIVE', 0),
-  (5201022, 10001, 'MERCHANT', 'BUTTON', 5201020, 'merchant:order:edit', '编辑草稿', NULL, NULL, 20, 'ACTIVE', 0),
-  (5201023, 10001, 'MERCHANT', 'BUTTON', 5201020, 'merchant:order:submit', '提交订单', NULL, NULL, 30, 'ACTIVE', 0)
-ON DUPLICATE KEY UPDATE
-  permission_type = VALUES(permission_type), parent_id = VALUES(parent_id),
-  permission_name = VALUES(permission_name), route_path = VALUES(route_path),
-  http_method = NULL, sort_no = VALUES(sort_no), status = 'ACTIVE', deleted = 0;
-
 INSERT INTO iam_membership_role (membership_id, role_id, tenant_id) VALUES
-  (3000001, 4000001, 0),
-  (3000002, 4000101, 10001)
+  (3000001, 4000001, 0)
 ON DUPLICATE KEY UPDATE tenant_id = VALUES(tenant_id);
 
 -- Full administrator roles receive all phase-one permissions in their application scope.
@@ -1376,11 +1319,6 @@ SELECT 4000001, id, 0 FROM iam_permission
 WHERE app_code = 'PLATFORM' AND tenant_id = 0 AND permission_type IN ('MENU', 'BUTTON')
 ON DUPLICATE KEY UPDATE tenant_id = VALUES(tenant_id);
 
-INSERT INTO iam_role_permission (role_id, permission_id, tenant_id)
-SELECT 4000101, id, 10001 FROM iam_permission
-WHERE app_code = 'MERCHANT' AND tenant_id = 10001 AND permission_type IN ('MENU', 'BUTTON')
-ON DUPLICATE KEY UPDATE tenant_id = VALUES(tenant_id);
-
 -- Limited platform and merchant operational roles.
 INSERT INTO iam_role_permission (role_id, permission_id, tenant_id)
 SELECT 4000002, id, 0 FROM iam_permission
@@ -1396,17 +1334,10 @@ SELECT 4000003, id, 0 FROM iam_permission
 WHERE permission_code LIKE 'platform:order%' OR permission_code LIKE 'platform:firstleg%'
 ON DUPLICATE KEY UPDATE tenant_id = VALUES(tenant_id);
 
-INSERT INTO iam_role_permission (role_id, permission_id, tenant_id)
-SELECT 4000102, id, 10001 FROM iam_permission
-WHERE permission_code LIKE 'merchant:order%' OR permission_code IN ('merchant:master-data', 'merchant:warehouse:list')
-ON DUPLICATE KEY UPDATE tenant_id = VALUES(tenant_id);
-
 INSERT INTO iam_data_scope (id, role_id, tenant_id, scope_type, scope_expression) VALUES
   (6000001, 4000001, 0, 'TENANT', NULL),
   (6000002, 4000002, 0, 'TENANT', NULL),
-  (6000003, 4000003, 0, 'TENANT', NULL),
-  (6000101, 4000101, 10001, 'TENANT', NULL),
-  (6000102, 4000102, 10001, 'TENANT', NULL)
+  (6000003, 4000003, 0, 'TENANT', NULL)
 ON DUPLICATE KEY UPDATE tenant_id = VALUES(tenant_id), scope_type = VALUES(scope_type), scope_expression = NULL;
 
 -- ============================================================================
@@ -1455,17 +1386,34 @@ INSERT INTO iam_role (
 )
 ON DUPLICATE KEY UPDATE status='ACTIVE', deleted=0;
 
--- Clone the一期 merchant menu/button template into the global scope.
+-- Global merchant permission template used by every formally onboarded customer.
 INSERT INTO iam_permission (
   id, tenant_id, app_code, permission_type, parent_id, permission_code,
   permission_name, route_path, http_method, sort_no, status, deleted
 )
-SELECT id + 100000, 0, app_code, permission_type,
-       CASE WHEN parent_id = 0 THEN 0 ELSE parent_id + 100000 END,
-       permission_code, permission_name, route_path, NULL, sort_no, 'ACTIVE', 0
-FROM iam_permission
-WHERE tenant_id = 10001 AND app_code = 'MERCHANT'
-  AND permission_type IN ('MENU', 'BUTTON')
+VALUES
+  (5300000, 0, 'MERCHANT', 'MENU', 0, 'merchant:enterprise', '企业管理', '/enterprise', NULL, 10, 'ACTIVE', 0),
+  (5301000, 0, 'MERCHANT', 'MENU', 0, 'merchant:order', '头程订单', '/first-leg-orders', NULL, 20, 'ACTIVE', 0),
+  (5302000, 0, 'MERCHANT', 'MENU', 0, 'merchant:master-data', '基础资料', '/master-data', NULL, 30, 'ACTIVE', 0),
+  (5300010, 0, 'MERCHANT', 'MENU', 5300000, 'merchant:profile:view', '企业资料', '/enterprise/profile', NULL, 10, 'ACTIVE', 0),
+  (5300020, 0, 'MERCHANT', 'MENU', 5300000, 'merchant:member:list', '企业成员', '/enterprise/members', NULL, 20, 'ACTIVE', 0),
+  (5300030, 0, 'MERCHANT', 'MENU', 5300000, 'merchant:role:list', '角色管理', '/enterprise/roles', NULL, 30, 'ACTIVE', 0),
+  (5301010, 0, 'MERCHANT', 'MENU', 5301000, 'merchant:order:list', '我的订单', '/first-leg-orders/list', NULL, 10, 'ACTIVE', 0),
+  (5301020, 0, 'MERCHANT', 'MENU', 5301000, 'merchant:order:create-page', '新建订单', '/first-leg-orders/create', NULL, 20, 'ACTIVE', 0),
+  (5302010, 0, 'MERCHANT', 'MENU', 5302000, 'merchant:warehouse:list', '收货仓选择', '/master-data/warehouses', NULL, 10, 'ACTIVE', 0),
+  (5302020, 0, 'MERCHANT', 'MENU', 5302000, 'merchant:counterparty:list', '往来单位', '/master-data/counterparties', NULL, 20, 'ACTIVE', 0),
+  (5300011, 0, 'MERCHANT', 'BUTTON', 5300010, 'merchant:profile:edit', '编辑企业资料', NULL, NULL, 10, 'ACTIVE', 0),
+  (5300012, 0, 'MERCHANT', 'BUTTON', 5300010, 'merchant:qualification:upload', '上传企业资质', NULL, NULL, 20, 'ACTIVE', 0),
+  (5300021, 0, 'MERCHANT', 'BUTTON', 5300020, 'merchant:member:create', '新增成员', NULL, NULL, 10, 'ACTIVE', 0),
+  (5300022, 0, 'MERCHANT', 'BUTTON', 5300020, 'merchant:member:grant-role', '分配成员角色', NULL, NULL, 20, 'ACTIVE', 0),
+  (5300031, 0, 'MERCHANT', 'BUTTON', 5300030, 'merchant:role:create', '新增角色', NULL, NULL, 10, 'ACTIVE', 0),
+  (5300032, 0, 'MERCHANT', 'BUTTON', 5300030, 'merchant:role:grant', '角色授权', NULL, NULL, 20, 'ACTIVE', 0),
+  (5301011, 0, 'MERCHANT', 'BUTTON', 5301010, 'merchant:order:view', '查看订单', NULL, NULL, 10, 'ACTIVE', 0),
+  (5301012, 0, 'MERCHANT', 'BUTTON', 5301010, 'merchant:order:cancel', '取消订单', NULL, NULL, 20, 'ACTIVE', 0),
+  (5301021, 0, 'MERCHANT', 'BUTTON', 5301020, 'merchant:order:create', '创建草稿', NULL, NULL, 10, 'ACTIVE', 0),
+  (5301022, 0, 'MERCHANT', 'BUTTON', 5301020, 'merchant:order:edit', '编辑草稿', NULL, NULL, 20, 'ACTIVE', 0),
+  (5301023, 0, 'MERCHANT', 'BUTTON', 5301020, 'merchant:order:submit', '提交订单', NULL, NULL, 30, 'ACTIVE', 0),
+  (5301024, 0, 'MERCHANT', 'BUTTON', 5301020, 'merchant:order:quick-create', '快速下单', NULL, NULL, 40, 'ACTIVE', 0)
 ON DUPLICATE KEY UPDATE
   permission_name=VALUES(permission_name), route_path=VALUES(route_path),
   parent_id=VALUES(parent_id), sort_no=VALUES(sort_no), status='ACTIVE', deleted=0;
@@ -1507,20 +1455,11 @@ DEALLOCATE PREPARE member_no_index_stmt;
 INSERT INTO iam_permission
   (id, tenant_id, app_code, permission_type, parent_id, permission_code, permission_name, sort_no, status, deleted)
 VALUES
-  (5200023, 10001, 'MERCHANT', 'BUTTON', 5200020, 'merchant:member:edit', '编辑成员', 30, 'ACTIVE', 0),
-  (5200024, 10001, 'MERCHANT', 'BUTTON', 5200020, 'merchant:member:status', '启停成员', 40, 'ACTIVE', 0),
-  (5200025, 10001, 'MERCHANT', 'BUTTON', 5200020, 'merchant:member:reset-password', '重置成员密码', 50, 'ACTIVE', 0),
   (5300023, 0, 'MERCHANT', 'BUTTON', 5300020, 'merchant:member:edit', '编辑成员', 30, 'ACTIVE', 0),
   (5300024, 0, 'MERCHANT', 'BUTTON', 5300020, 'merchant:member:status', '启停成员', 40, 'ACTIVE', 0),
   (5300025, 0, 'MERCHANT', 'BUTTON', 5300020, 'merchant:member:reset-password', '重置成员密码', 50, 'ACTIVE', 0)
 ON DUPLICATE KEY UPDATE permission_name = VALUES(permission_name), status = VALUES(status), deleted = 0;
 
-INSERT INTO iam_role_permission (role_id, permission_id, tenant_id)
-SELECT 4000101, id, 10001 FROM iam_permission
-WHERE tenant_id = 10001 AND permission_code IN
-  ('merchant:member:edit', 'merchant:member:status', 'merchant:member:reset-password')
-ON DUPLICATE KEY UPDATE tenant_id = VALUES(tenant_id);
-
 INSERT INTO iam_role_permission (role_id, permission_id, tenant_id)
 SELECT 4000100, id, 0 FROM iam_permission
 WHERE tenant_id = 0 AND permission_code IN
@@ -1548,9 +1487,6 @@ VALUES
   (5101013, 0, 'PLATFORM', 'BUTTON', 5101010, 'platform:user:status', '启停用户', 30, 'ACTIVE', 0),
   (5101014, 0, 'PLATFORM', 'BUTTON', 5101010, 'platform:user:reset-password', '重置密码', 40, 'ACTIVE', 0),
   (5101015, 0, 'PLATFORM', 'BUTTON', 5101010, 'platform:user:grant-role', '分配内部用户角色', 50, 'ACTIVE', 0),
-  (5200033, 10001, 'MERCHANT', 'BUTTON', 5200030, 'merchant:role:edit', '编辑角色', 30, 'ACTIVE', 0),
-  (5200034, 10001, 'MERCHANT', 'BUTTON', 5200030, 'merchant:role:status', '启停角色', 40, 'ACTIVE', 0),
-  (5200035, 10001, 'MERCHANT', 'BUTTON', 5200030, 'merchant:role:delete', '删除角色', 50, 'ACTIVE', 0),
   (5300033, 0, 'MERCHANT', 'BUTTON', 5300030, 'merchant:role:edit', '编辑角色', 30, 'ACTIVE', 0),
   (5300034, 0, 'MERCHANT', 'BUTTON', 5300030, 'merchant:role:status', '启停角色', 40, 'ACTIVE', 0),
   (5300035, 0, 'MERCHANT', 'BUTTON', 5300030, 'merchant:role:delete', '删除角色', 50, 'ACTIVE', 0)
@@ -1569,12 +1505,6 @@ WHERE tenant_id = 0 AND app_code = 'PLATFORM'
                           'platform:user:grant-role')
 ON DUPLICATE KEY UPDATE tenant_id = VALUES(tenant_id);
 
-INSERT INTO iam_role_permission (role_id, permission_id, tenant_id)
-SELECT 4000101, id, 10001 FROM iam_permission
-WHERE tenant_id = 10001 AND app_code = 'MERCHANT'
-  AND permission_code IN ('merchant:role:edit', 'merchant:role:status', 'merchant:role:delete')
-ON DUPLICATE KEY UPDATE tenant_id = VALUES(tenant_id);
-
 INSERT INTO iam_role_permission (role_id, permission_id, tenant_id)
 SELECT 4000100, id, 0 FROM iam_permission
 WHERE tenant_id = 0 AND app_code = 'MERCHANT'
@@ -4286,23 +4216,9 @@ SET @unified_ddl = IF(
 PREPARE unified_stmt FROM @unified_ddl; EXECUTE unified_stmt; DEALLOCATE PREPARE unified_stmt;
 
 -- ============================================================================
--- 重新同步一期商户管理员全局模板，包含一期后续追加的菜单和按钮
+-- 重新授权一期商户管理员全局模板，包含一期后续追加的菜单和按钮
 -- ============================================================================
 USE baiyue_iam;
-INSERT INTO iam_permission (
-  id, tenant_id, app_code, permission_type, parent_id, permission_code,
-  permission_name, route_path, http_method, sort_no, status, deleted
-)
-SELECT id + 100000, 0, app_code, permission_type,
-       CASE WHEN parent_id = 0 THEN 0 ELSE parent_id + 100000 END,
-       permission_code, permission_name, route_path, NULL, sort_no, 'ACTIVE', 0
-FROM iam_permission
-WHERE tenant_id = 10001 AND app_code = 'MERCHANT'
-  AND permission_type IN ('MENU', 'BUTTON')
-ON DUPLICATE KEY UPDATE
-  permission_name = VALUES(permission_name), route_path = VALUES(route_path),
-  parent_id = VALUES(parent_id), sort_no = VALUES(sort_no), status = 'ACTIVE', deleted = 0;
-
 INSERT INTO iam_role_permission (role_id, permission_id, tenant_id)
 SELECT owner_role.id, permission.id, 0
 FROM iam_role owner_role
@@ -5983,7 +5899,7 @@ BEGIN
   SELECT MAX(plan_status) INTO current_plan_status FROM fl_loading_plan
    WHERE container_booking_id = NEW.container_booking_id;
   IF current_plan_status = 'COMPLETED'
-     AND NEW.document_type NOT IN ('DESTINATION_CLEARANCE', 'CUSTOMS_DECLARATION') THEN
+     AND NEW.document_type NOT IN ('DESTINATION_CLEARANCE', 'CUSTOMS_DECLARATION', 'DELIVERY_ORDER', 'PICKUP_ORDER') THEN
     SIGNAL SQLSTATE '45000' SET MESSAGE_TEXT = '装柜完成后货柜文件不可新增';
   END IF;
 END$$
@@ -5999,7 +5915,7 @@ BEGIN
   SELECT MAX(plan_status) INTO current_plan_status FROM fl_loading_plan
    WHERE container_booking_id = OLD.container_booking_id;
   IF current_plan_status = 'COMPLETED'
-     AND OLD.document_type NOT IN ('DESTINATION_CLEARANCE', 'CUSTOMS_DECLARATION') THEN
+     AND OLD.document_type NOT IN ('DESTINATION_CLEARANCE', 'CUSTOMS_DECLARATION', 'DELIVERY_ORDER', 'PICKUP_ORDER') THEN
     SIGNAL SQLSTATE '45000' SET MESSAGE_TEXT = '装柜完成后货柜文件不可修改';
   END IF;
 END$$
@@ -6440,7 +6356,7 @@ JOIN wh_warehouse warehouse
 ON DUPLICATE KEY UPDATE
   tenant_id = VALUES(tenant_id);
 
--- 国内固定作业仓必须启用收货能力，FBA 目的地址仍不得创建作业能力。
+-- 四个固定平台作业仓必须启用收货能力，FBA 目的地址仍不得创建作业能力。
 INSERT INTO wh_service_capability (
   id, tenant_id, warehouse_id, capability_code, capability_name, enabled, cutoff_time,
   description, created_by, created_at, updated_by, updated_at, deleted, version
@@ -6449,7 +6365,11 @@ VALUES
   (193000000000400001,0,193000000000200001,'RECEIVING','头程收货',1,'16:00:00',
    '义乌仓头程订单收货能力',NULL,CURRENT_TIMESTAMP(3),NULL,CURRENT_TIMESTAMP(3),0,0),
   (193000000000400002,0,193000000000200002,'RECEIVING','头程收货',1,'16:00:00',
-   '东莞仓头程订单收货能力',NULL,CURRENT_TIMESTAMP(3),NULL,CURRENT_TIMESTAMP(3),0,0)
+   '东莞仓头程订单收货能力',NULL,CURRENT_TIMESTAMP(3),NULL,CURRENT_TIMESTAMP(3),0,0),
+  (193000000000400003,0,193000000000200003,'RECEIVING','海外收货',1,'16:00:00',
+   '洛杉矶仓海外接柜入仓收货能力',NULL,CURRENT_TIMESTAMP(3),NULL,CURRENT_TIMESTAMP(3),0,0),
+  (193000000000400004,0,193000000000200004,'RECEIVING','海外收货',1,'16:00:00',
+   '纽约仓海外接柜入仓收货能力',NULL,CURRENT_TIMESTAMP(3),NULL,CURRENT_TIMESTAMP(3),0,0)
 ON DUPLICATE KEY UPDATE
   capability_name = VALUES(capability_name),
   enabled = VALUES(enabled),
@@ -7096,11 +7016,11 @@ BEGIN
   IF (SELECT COUNT(*)
         FROM wh_service_capability capability
        WHERE capability.tenant_id = 0
-         AND capability.warehouse_id IN (193000000000200001,193000000000200002)
+         AND capability.warehouse_id IN (193000000000200001,193000000000200002,193000000000200003,193000000000200004)
          AND capability.capability_code = 'RECEIVING'
          AND capability.enabled = 1
-         AND capability.deleted = 0) <> 2 THEN
-    SIGNAL SQLSTATE '45000' SET MESSAGE_TEXT = '国内固定作业仓收货能力写入校验失败';
+         AND capability.deleted = 0) <> 4 THEN
+    SIGNAL SQLSTATE '45000' SET MESSAGE_TEXT = '固定平台作业仓收货能力写入校验失败';
   END IF;
 END//
 DELIMITER ;
@@ -9109,6 +9029,7 @@ CREATE TABLE IF NOT EXISTS fl_ocean_booking (
   bill_of_lading_no VARCHAR(128) NULL COMMENT '提单号',
   shipping_company_id BIGINT UNSIGNED NULL COMMENT '船公司逻辑ID快照',
   shipping_company_name VARCHAR(128) NULL COMMENT '船公司名称快照',
+  carrier_code VARCHAR(16) NULL COMMENT '船司标准编码：MATSON/SML/ZIM/COSCO/EMC/HEDE/OTHER；发布前必填',
   booking_agent_id BIGINT UNSIGNED NULL COMMENT '订舱代理逻辑ID快照',
   booking_agent_name VARCHAR(128) NULL COMMENT '订舱代理名称快照',
   vessel_name VARCHAR(128) NULL COMMENT '当前确认船名快照',
@@ -9137,10 +9058,38 @@ CREATE TABLE IF NOT EXISTS fl_ocean_booking (
   CONSTRAINT chk_ocean_booking_customer CHECK (customer_id > 0),
   CONSTRAINT chk_ocean_booking_status CHECK (status IN
     ('DRAFT','RELEASED')),
+  CONSTRAINT chk_ocean_booking_carrier_code CHECK
+    (carrier_code IS NULL OR carrier_code IN ('MATSON','SML','ZIM','COSCO','EMC','HEDE','OTHER')),
   CONSTRAINT chk_ocean_booking_schedule CHECK
     (estimated_sailing_at IS NULL OR estimated_arrival_at IS NULL OR estimated_arrival_at >= estimated_sailing_at)
 ) ENGINE=InnoDB COMMENT='独立海运订舱聚合；柜次仍由fl_container_booking承载';
 
+SET @ocean_add_carrier_code = (
+  SELECT IF(COUNT(*) = 0,
+    'ALTER TABLE fl_ocean_booking ADD COLUMN carrier_code VARCHAR(16) NULL COMMENT ''船司标准编码：MATSON/SML/ZIM/COSCO/EMC/HEDE/OTHER；发布前必填'' AFTER shipping_company_name',
+    'SELECT 1')
+    FROM information_schema.columns
+   WHERE table_schema=DATABASE() AND table_name='fl_ocean_booking' AND column_name='carrier_code'
+);
+PREPARE ocean_add_carrier_code_stmt FROM @ocean_add_carrier_code;
+EXECUTE ocean_add_carrier_code_stmt;
+DEALLOCATE PREPARE ocean_add_carrier_code_stmt;
+
+SET @ocean_drop_carrier_code_check = (
+  SELECT IF(COUNT(*) > 0,
+    'ALTER TABLE fl_ocean_booking DROP CHECK chk_ocean_booking_carrier_code',
+    'SELECT 1')
+    FROM information_schema.table_constraints
+   WHERE constraint_schema=DATABASE() AND table_name='fl_ocean_booking'
+     AND constraint_name='chk_ocean_booking_carrier_code' AND constraint_type='CHECK'
+);
+PREPARE ocean_drop_carrier_code_check_stmt FROM @ocean_drop_carrier_code_check;
+EXECUTE ocean_drop_carrier_code_check_stmt;
+DEALLOCATE PREPARE ocean_drop_carrier_code_check_stmt;
+ALTER TABLE fl_ocean_booking
+  ADD CONSTRAINT chk_ocean_booking_carrier_code CHECK
+    (carrier_code IS NULL OR carrier_code IN ('MATSON','SML','ZIM','COSCO','EMC','HEDE','OTHER'));
+
 -- CREATE TABLE IF NOT EXISTS does not reconcile a database initialized before customer became optional.
 ALTER TABLE fl_ocean_booking
   MODIFY COLUMN customer_id BIGINT UNSIGNED NULL COMMENT '可选客户ID快照',
@@ -10377,11 +10326,11 @@ CREATE TABLE IF NOT EXISTS fl_carrier_schedule_query (
   ocean_booking_id BIGINT UNSIGNED NOT NULL COMMENT '关联海运订舱ID',
   container_booking_id BIGINT UNSIGNED NULL COMMENT '指定查询的柜次ID；整票订舱查询时为空',
   container_scope_id BIGINT UNSIGNED GENERATED ALWAYS AS (COALESCE(container_booking_id,0)) STORED COMMENT '柜次唯一作用域计算值；整票订舱查询固定为0',
-  carrier_code VARCHAR(16) NOT NULL COMMENT '船公司编码：MATSON美森、SML森罗、ZIM以星、COSCO中远海运、EMC长荣、HEDE合德',
+  carrier_code VARCHAR(16) NOT NULL COMMENT '船公司标准编码；OTHER表示人工跟踪',
   tracking_type VARCHAR(32) NOT NULL COMMENT '官网跟踪类型：BOOKING_NO订舱号、BILL_OF_LADING提单号、CONTAINER_NO箱号',
   tracking_no VARCHAR(128) NOT NULL COMMENT '提交至船公司官网的跟踪号码',
   official_url VARCHAR(500) NOT NULL COMMENT '船公司官网查询入口地址快照',
-  access_mode VARCHAR(32) NOT NULL COMMENT '船司访问方式：PUBLIC_FORM、PUBLIC_WEB_PROXY、PUBLIC_HTML、HCAPTCHA、OFFICIAL_API',
+  access_mode VARCHAR(32) NOT NULL COMMENT '船司访问方式；MANUAL表示仅人工补录节点',
   status VARCHAR(24) NOT NULL COMMENT '任务操作状态：READY、MANUAL_REQUIRED、STOPPED',
   trigger_source VARCHAR(32) NOT NULL DEFAULT 'MANUAL' COMMENT '任务触发来源：OUTBOUND_CONFIRM或MANUAL',
   latest_standard_node VARCHAR(32) NULL COMMENT '最近实际标准船节点；预计事实不推进',
@@ -10423,11 +10372,11 @@ CREATE TABLE IF NOT EXISTS fl_carrier_schedule_query (
   CONSTRAINT fk_carrier_schedule_query_result FOREIGN KEY (result_port_schedule_id) REFERENCES fl_port_schedule(id),
   CONSTRAINT chk_carrier_schedule_query_customer CHECK (customer_id > 0),
   CONSTRAINT chk_carrier_schedule_query_carrier CHECK
-    (carrier_code IN ('MATSON','SML','ZIM','COSCO','EMC','HEDE')),
+    (carrier_code IN ('MATSON','SML','ZIM','COSCO','EMC','HEDE','OTHER')),
   CONSTRAINT chk_carrier_schedule_query_tracking CHECK
     (tracking_type IN ('BOOKING_NO','BILL_OF_LADING','CONTAINER_NO')),
   CONSTRAINT chk_carrier_schedule_query_access CHECK
-    (access_mode IN ('PUBLIC_FORM','PUBLIC_WEB_PROXY','PUBLIC_HTML','HCAPTCHA','OFFICIAL_API')),
+    (access_mode IN ('PUBLIC_FORM','PUBLIC_WEB_PROXY','PUBLIC_HTML','HCAPTCHA','OFFICIAL_API','MANUAL')),
   CONSTRAINT chk_carrier_schedule_query_status CHECK
     (status IN ('READY','MANUAL_REQUIRED','STOPPED')),
   CONSTRAINT chk_carrier_schedule_query_node CHECK
@@ -10786,6 +10735,7 @@ DROP PROCEDURE IF EXISTS migrate_carrier_schedule_retry_columns;
 -- CREATE TABLE IF NOT EXISTS 不会替换历史 CHECK 与唯一索引。统一收敛到当前
 -- READY/MANUAL_REQUIRED/STOPPED、五种访问方式、十个实际节点和每业务范围唯一任务。
 ALTER TABLE fl_carrier_schedule_query
+  DROP CHECK chk_carrier_schedule_query_carrier,
   DROP CHECK chk_carrier_schedule_query_access,
   DROP CHECK chk_carrier_schedule_query_status;
 DROP PROCEDURE IF EXISTS drop_legacy_carrier_schedule_node_check;
@@ -10802,8 +10752,10 @@ DELIMITER ;
 CALL drop_legacy_carrier_schedule_node_check();
 DROP PROCEDURE IF EXISTS drop_legacy_carrier_schedule_node_check;
 ALTER TABLE fl_carrier_schedule_query
+  ADD CONSTRAINT chk_carrier_schedule_query_carrier CHECK
+    (carrier_code IN ('MATSON','SML','ZIM','COSCO','EMC','HEDE','OTHER')),
   ADD CONSTRAINT chk_carrier_schedule_query_access CHECK
-    (access_mode IN ('PUBLIC_FORM','PUBLIC_WEB_PROXY','PUBLIC_HTML','HCAPTCHA','OFFICIAL_API')),
+    (access_mode IN ('PUBLIC_FORM','PUBLIC_WEB_PROXY','PUBLIC_HTML','HCAPTCHA','OFFICIAL_API','MANUAL')),
   ADD CONSTRAINT chk_carrier_schedule_query_status CHECK
     (status IN ('READY','MANUAL_REQUIRED','STOPPED')),
   ADD CONSTRAINT chk_carrier_schedule_query_node CHECK
@@ -13928,6 +13880,7 @@ CALL queue_column_comment('baiyue_firstleg', 'fl_mojia_measurement_receipt', 'up
 CALL queue_column_comment('baiyue_firstleg', 'fl_mojia_measurement_receipt', 'weight_kg', '设备实测重量kg');
 CALL queue_column_comment('baiyue_firstleg', 'fl_mojia_measurement_receipt', 'width_cm', '设备实测宽度cm');
 CALL queue_column_comment('baiyue_firstleg', 'fl_ocean_booking', 'bill_of_lading_no', '提单号');
+CALL queue_column_comment('baiyue_firstleg', 'fl_ocean_booking', 'carrier_code', '船司标准编码：MATSON/SML/ZIM/COSCO/EMC/HEDE/OTHER；发布前必填');
 CALL queue_column_comment('baiyue_firstleg', 'fl_ocean_booking', 'booking_agent_id', '订舱代理逻辑ID快照');
 CALL queue_column_comment('baiyue_firstleg', 'fl_ocean_booking', 'booking_agent_name', '订舱代理名称快照');
 CALL queue_column_comment('baiyue_firstleg', 'fl_ocean_booking', 'booking_no', '平台海运订舱编号');
@@ -14892,6 +14845,21 @@ BEGIN
          'baiyue_firstleg','baiyue_file','baiyue_audit','baiyue_event_bridge','baiyue_finance'))<>9 THEN
     SIGNAL SQLSTATE '45000' SET MESSAGE_TEXT = '统一迁移失败：九个业务数据库未完整创建';
   END IF;
+  IF (SELECT COUNT(*) FROM information_schema.columns
+       WHERE table_schema='baiyue_iam' AND table_name='iam_tenant'
+         AND column_name='dimension_initialization_status') <> 1
+     OR (SELECT COUNT(*) FROM information_schema.tables
+          WHERE table_schema='baiyue_iam'
+            AND table_name='iam_customer_dimension_initialization_task') <> 1
+     OR (SELECT COUNT(*) FROM information_schema.columns
+          WHERE table_schema='baiyue_iam'
+            AND table_name='iam_customer_dimension_initialization_task'
+            AND column_name IN ('tenant_id','initialization_key','action','status','attempt_count',
+              'next_retry_at','lease_owner','lease_until','last_error_code','last_error_message',
+              'task_version')) <> 11 THEN
+    SIGNAL SQLSTATE '45000'
+      SET MESSAGE_TEXT = '统一迁移失败：IAM客户默认尺寸后台初始化状态或可靠任务结构不完整';
+  END IF;
   IF (SELECT COUNT(*) FROM information_schema.columns
        WHERE table_schema='baiyue_firstleg' AND table_name='fl_carrier_schedule_query'
          AND column_name IN ('trigger_source','latest_standard_node','latest_node_observed_at',
@@ -15335,10 +15303,9 @@ VALUES
   (5105019, 0, 'PLATFORM', 'BUTTON', 5105000, 'platform:finance:cost:create', '登记成本', NULL, 'POST', 100, 'ACTIVE', 0),
   (5105020, 0, 'PLATFORM', 'BUTTON', 5105000, 'platform:finance:customer-terms:view', '查看客户账期', NULL, 'GET', 110, 'ACTIVE', 0),
   (5105021, 0, 'PLATFORM', 'BUTTON', 5105000, 'platform:finance:customer-terms:update', '修改客户账期', NULL, 'PUT', 120, 'ACTIVE', 0),
-  (5205000, 10001, 'MERCHANT', 'MENU', 5200000, 'merchant:finance:statement', '财务账单', '/finance/statements', NULL, 40, 'ACTIVE', 0),
-  (5205010, 10001, 'MERCHANT', 'BUTTON', 5205000, 'merchant:finance:statement:list', '查看账单', NULL, 'GET', 10, 'ACTIVE', 0),
-  (5205011, 10001, 'MERCHANT', 'BUTTON', 5205000, 'merchant:finance:statement:view', '查看账单详情及收款', NULL, 'GET', 20, 'ACTIVE', 0),
-  (5205012, 10001, 'MERCHANT', 'BUTTON', 5205000, 'merchant:finance:statement:confirm', '确认客户对账单', NULL, 'POST', 30, 'ACTIVE', 0),
+  (5305000, 0, 'MERCHANT', 'MENU', 5300000, 'merchant:finance:statement', '财务账单', '/finance/statements', NULL, 40, 'ACTIVE', 0),
+  (5305010, 0, 'MERCHANT', 'BUTTON', 5305000, 'merchant:finance:statement:list', '查看账单', NULL, 'GET', 10, 'ACTIVE', 0),
+  (5305011, 0, 'MERCHANT', 'BUTTON', 5305000, 'merchant:finance:statement:view', '查看账单详情及收款', NULL, 'GET', 20, 'ACTIVE', 0),
   (5305012, 0, 'MERCHANT', 'BUTTON', 5305000, 'merchant:finance:statement:confirm', '确认客户对账单', NULL, 'POST', 30, 'ACTIVE', 0)
 ON DUPLICATE KEY UPDATE permission_name=VALUES(permission_name), parent_id=VALUES(parent_id), route_path=VALUES(route_path), http_method=VALUES(http_method), status='ACTIVE', deleted=0;
 
@@ -15471,11 +15438,6 @@ WHERE tenant_id=0 AND app_code='PLATFORM' AND permission_code IN (
   'platform:finance:settlement-ap:create', 'platform:finance:payment:create',
   'platform:finance:settlement:void')
 ON DUPLICATE KEY UPDATE tenant_id=VALUES(tenant_id);
-INSERT INTO baiyue_iam.iam_role_permission (role_id, permission_id, tenant_id)
-SELECT 4000101, id, 10001 FROM baiyue_iam.iam_permission
- WHERE tenant_id=10001 AND app_code='MERCHANT' AND (permission_code='merchant:finance:statement' OR permission_code LIKE 'merchant:finance:%')
-ON DUPLICATE KEY UPDATE tenant_id=VALUES(tenant_id);
-
 -- 开发期 list-only 收口：先移除角色关联并停用旧只读资源，再执行最终 Finance 断言。
 DELETE rp FROM baiyue_iam.iam_role_permission rp
 JOIN baiyue_iam.iam_permission p ON p.id=rp.permission_id AND p.tenant_id=rp.tenant_id
@@ -15851,7 +15813,7 @@ CREATE TRIGGER trg_container_document_before_insert BEFORE INSERT ON fl_containe
 BEGIN
   DECLARE current_plan_status VARCHAR(24);
   SELECT MAX(plan_status) INTO current_plan_status FROM fl_loading_plan WHERE container_booking_id=NEW.container_booking_id;
-  IF current_plan_status='COMPLETED' AND NEW.document_type NOT IN ('DESTINATION_CLEARANCE','CUSTOMS_DECLARATION') THEN
+  IF current_plan_status='COMPLETED' AND NEW.document_type NOT IN ('DESTINATION_CLEARANCE','CUSTOMS_DECLARATION','DELIVERY_ORDER','PICKUP_ORDER') THEN
     SIGNAL SQLSTATE '45000' SET MESSAGE_TEXT='装柜完成后货柜物流文件不可新增';
   END IF;
 END$$
@@ -15862,7 +15824,7 @@ CREATE TRIGGER trg_container_document_before_update BEFORE UPDATE ON fl_containe
 BEGIN
   DECLARE current_plan_status VARCHAR(24);
   SELECT MAX(plan_status) INTO current_plan_status FROM fl_loading_plan WHERE container_booking_id=OLD.container_booking_id;
-  IF current_plan_status='COMPLETED' AND OLD.document_type NOT IN ('DESTINATION_CLEARANCE','CUSTOMS_DECLARATION') THEN
+  IF current_plan_status='COMPLETED' AND OLD.document_type NOT IN ('DESTINATION_CLEARANCE','CUSTOMS_DECLARATION','DELIVERY_ORDER','PICKUP_ORDER') THEN
     SIGNAL SQLSTATE '45000' SET MESSAGE_TEXT='装柜完成后货柜物流文件不可修改';
   END IF;
 END$$
@@ -15941,22 +15903,18 @@ SELECT 0, r.id, p.id, CURRENT_TIMESTAMP(3) FROM iam_role r JOIN iam_permission p
 WHERE r.tenant_id=0 AND r.app_code='PLATFORM' AND r.role_code='PLATFORM_ADMIN' AND p.permission_code IN ('platform:finance:customer-account:list','platform:finance:customer-arap:list','platform:finance:receivable-statistics:list','platform:finance:customer-statement:list','platform:finance:settlement-ar:list','platform:finance:settlement-ap:list','platform:finance:customer-account:export','platform:finance:customer-arap:export','platform:finance:receivable-statistics:export','platform:finance:customer-statement:export','platform:finance:settlement-ar:export','platform:finance:settlement-ap:export','platform:download:list');
 UPDATE iam_permission p JOIN (SELECT 'platform:finance:fee-source:review' code,5105041 parent_id UNION ALL SELECT 'platform:finance:fee-source:edit',5105041 UNION ALL SELECT 'platform:finance:reconciliation:create',5105042 UNION ALL SELECT 'platform:finance:reconciliation:review',5105042 UNION ALL SELECT 'platform:finance:reconciliation:issue',5105042 UNION ALL SELECT 'platform:finance:reconciliation:adjust',5105042 UNION ALL SELECT 'platform:finance:reconciliation:void',5105042 UNION ALL SELECT 'platform:finance:settlement-ar:create',5105043 UNION ALL SELECT 'platform:finance:settlement-ap:create',5105044 UNION ALL SELECT 'platform:finance:payment:create',5105044) mapping ON mapping.code=p.permission_code SET p.parent_id=mapping.parent_id WHERE p.tenant_id=0 AND p.app_code='PLATFORM' AND p.permission_type='BUTTON';
 
-INSERT IGNORE INTO iam_role_permission (tenant_id, role_id, permission_id, created_at)
-SELECT 10001, r.id, p.id, CURRENT_TIMESTAMP(3) FROM iam_role r JOIN iam_permission p ON p.tenant_id=10001 AND p.app_code='MERCHANT'
-WHERE r.tenant_id=10001 AND r.app_code='MERCHANT' AND r.role_code IN ('MERCHANT_OWNER','MERCHANT_ADMIN')
-  AND p.permission_code='merchant:finance:statement:confirm';
-
 INSERT IGNORE INTO iam_role_permission (tenant_id, role_id, permission_id, created_at)
 SELECT 0, r.id, p.id, CURRENT_TIMESTAMP(3) FROM iam_role r JOIN iam_permission p ON p.tenant_id=0 AND p.app_code='MERCHANT'
 WHERE r.tenant_id=0 AND r.app_code='MERCHANT' AND r.role_code='MERCHANT_OWNER'
   AND r.status='ACTIVE' AND r.deleted=0
-  AND p.permission_code='merchant:finance:statement:confirm'
+  AND p.permission_code IN ('merchant:finance:statement','merchant:finance:statement:list',
+                            'merchant:finance:statement:view','merchant:finance:statement:confirm')
   AND p.status='ACTIVE' AND p.deleted=0;
 
 INSERT INTO baiyue_iam.iam_permission
   (id, tenant_id, app_code, permission_type, parent_id, permission_code, permission_name, route_path, http_method, sort_no, status, deleted)
 VALUES
-  (5201024, 10001, 'MERCHANT', 'BUTTON', 5201020, 'merchant:order:quick-create', '快速下单', NULL, NULL, 40, 'ACTIVE', 0)
+  (5301024, 0, 'MERCHANT', 'BUTTON', 5301020, 'merchant:order:quick-create', '快速下单', NULL, NULL, 40, 'ACTIVE', 0)
 ON DUPLICATE KEY UPDATE
   permission_type = VALUES(permission_type), parent_id = VALUES(parent_id), permission_name = VALUES(permission_name),
   route_path = VALUES(route_path), sort_no = VALUES(sort_no), status = 'ACTIVE', deleted = 0;
@@ -16172,11 +16130,8 @@ BEGIN
   IF (SELECT COUNT(*) FROM baiyue_iam.iam_permission WHERE tenant_id=0 AND app_code='PLATFORM' AND permission_code LIKE 'platform:finance:%' AND status='ACTIVE' AND deleted=0) <> 32 THEN
     SIGNAL SQLSTATE '45000' SET MESSAGE_TEXT='统一迁移失败：平台 Finance 权限不完整';
   END IF;
-  IF (SELECT COUNT(*) FROM baiyue_iam.iam_permission WHERE tenant_id=10001 AND app_code='MERCHANT' AND permission_code IN ('merchant:finance:statement:list','merchant:finance:statement:view','merchant:finance:statement:confirm') AND status='ACTIVE' AND deleted=0) <> 3 THEN
-    SIGNAL SQLSTATE '45000' SET MESSAGE_TEXT='统一迁移失败：客户 Finance 查询与确认权限不完整';
-  END IF;
-  IF (SELECT COUNT(*) FROM baiyue_iam.iam_permission WHERE tenant_id=0 AND app_code='MERCHANT' AND permission_code='merchant:finance:statement:confirm' AND status='ACTIVE' AND deleted=0) <> 1 THEN
-    SIGNAL SQLSTATE '45000' SET MESSAGE_TEXT='统一迁移失败：客户全局对账单确认权限不完整';
+  IF (SELECT COUNT(*) FROM baiyue_iam.iam_permission WHERE tenant_id=0 AND app_code='MERCHANT' AND permission_code IN ('merchant:finance:statement','merchant:finance:statement:list','merchant:finance:statement:view','merchant:finance:statement:confirm') AND status='ACTIVE' AND deleted=0) <> 4 THEN
+    SIGNAL SQLSTATE '45000' SET MESSAGE_TEXT='统一迁移失败：客户全局 Finance 权限模板不完整';
   END IF;
   IF (SELECT COUNT(*) FROM baiyue_iam.iam_role_permission rp JOIN baiyue_iam.iam_permission p ON p.id=rp.permission_id AND p.tenant_id=rp.tenant_id WHERE rp.role_id=4000001 AND rp.tenant_id=0 AND (p.permission_code='platform:finance' OR p.permission_code LIKE 'platform:finance:%')) <> 33 THEN
     SIGNAL SQLSTATE '45000' SET MESSAGE_TEXT='统一迁移失败：平台管理员 Finance 授权不完整';
@@ -16184,11 +16139,8 @@ BEGIN
   IF (SELECT COUNT(*) FROM baiyue_iam.iam_role_permission rp JOIN baiyue_iam.iam_permission p ON p.id=rp.permission_id AND p.tenant_id=rp.tenant_id WHERE rp.role_id=4000001 AND rp.tenant_id=0 AND p.status='ACTIVE' AND p.deleted=0 AND p.permission_code IN ('platform:download:list','platform:finance:customer-account:export','platform:finance:customer-arap:export','platform:finance:receivable-statistics:export','platform:finance:customer-statement:export','platform:finance:settlement-ar:export','platform:finance:settlement-ap:export')) <> 7 THEN
     SIGNAL SQLSTATE '45000' SET MESSAGE_TEXT='统一迁移失败：平台管理员 Finance 导出和下载中心授权不完整';
   END IF;
-  IF (SELECT COUNT(*) FROM baiyue_iam.iam_role_permission rp JOIN baiyue_iam.iam_permission p ON p.id=rp.permission_id AND p.tenant_id=rp.tenant_id WHERE rp.role_id=4000101 AND rp.tenant_id=10001 AND (p.permission_code='merchant:finance:statement' OR p.permission_code LIKE 'merchant:finance:%')) <> 4 THEN
-    SIGNAL SQLSTATE '45000' SET MESSAGE_TEXT='统一迁移失败：客户管理员 Finance 查询与确认授权不完整';
-  END IF;
-  IF (SELECT COUNT(*) FROM baiyue_iam.iam_role_permission rp JOIN baiyue_iam.iam_role r ON r.id=rp.role_id AND r.tenant_id=rp.tenant_id JOIN baiyue_iam.iam_permission p ON p.id=rp.permission_id AND p.tenant_id=rp.tenant_id WHERE r.tenant_id=0 AND r.app_code='MERCHANT' AND r.role_code='MERCHANT_OWNER' AND r.status='ACTIVE' AND r.deleted=0 AND p.permission_code='merchant:finance:statement:confirm' AND p.status='ACTIVE' AND p.deleted=0) <> 1 THEN
-    SIGNAL SQLSTATE '45000' SET MESSAGE_TEXT='统一迁移失败：客户全局管理员缺少对账单确认权限';
+  IF (SELECT COUNT(*) FROM baiyue_iam.iam_role_permission rp JOIN baiyue_iam.iam_role r ON r.id=rp.role_id AND r.tenant_id=rp.tenant_id JOIN baiyue_iam.iam_permission p ON p.id=rp.permission_id AND p.tenant_id=rp.tenant_id WHERE r.id=4000100 AND r.tenant_id=0 AND r.app_code='MERCHANT' AND r.role_code='MERCHANT_OWNER' AND r.status='ACTIVE' AND r.deleted=0 AND p.permission_code IN ('merchant:finance:statement','merchant:finance:statement:list','merchant:finance:statement:view','merchant:finance:statement:confirm') AND p.status='ACTIVE' AND p.deleted=0) <> 4 THEN
+    SIGNAL SQLSTATE '45000' SET MESSAGE_TEXT='统一迁移失败：客户全局管理员 Finance 模板授权不完整';
   END IF;
 END$$
 DELIMITER ;
@@ -16632,6 +16584,38 @@ SELECT 0,role.id,permission.id,NOW(3) FROM baiyue_iam.iam_role role
 JOIN baiyue_iam.iam_permission permission ON permission.id BETWEEN 5107070 AND 5107082 AND permission.tenant_id=0
 WHERE role.tenant_id=0 AND role.app_code='PLATFORM' AND role.role_code='PLATFORM_ADMIN' AND role.status='ACTIVE' AND role.deleted=0;
 
+-- IAM 客户提交即成功，默认尺寸通过持久化任务后台初始化；已有客户按历史事实标记 READY。
+USE baiyue_iam;
+SET @customer_dimension_status_ddl = (SELECT IF(
+  EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE()
+    AND table_name='iam_tenant' AND column_name='dimension_initialization_status'),
+  'SELECT 1',
+  'ALTER TABLE iam_tenant ADD COLUMN dimension_initialization_status VARCHAR(16) NOT NULL DEFAULT ''READY'' COMMENT ''默认尺寸初始化状态：PENDING待处理、READY已就绪、FAILED失败'' AFTER status'));
+PREPARE customer_dimension_status_stmt FROM @customer_dimension_status_ddl;
+EXECUTE customer_dimension_status_stmt;
+DEALLOCATE PREPARE customer_dimension_status_stmt;
+CREATE TABLE IF NOT EXISTS iam_customer_dimension_initialization_task (
+  tenant_id BIGINT NOT NULL COMMENT '客户ID及任务聚合ID',
+  operator_id BIGINT NOT NULL COMMENT '触发初始化的操作人ID；系统补偿为0',
+  initialization_key VARCHAR(128) NOT NULL COMMENT '稳定初始化幂等键：iam-customer-create:{tenantId}',
+  action VARCHAR(16) NOT NULL DEFAULT 'INITIALIZE' COMMENT '目标动作：INITIALIZE初始化、COMPENSATE补偿',
+  status VARCHAR(16) NOT NULL DEFAULT 'PENDING' COMMENT '投递状态：PENDING、SENDING、READY、FAILED、CANCELLED',
+  attempt_count INT NOT NULL DEFAULT 0 COMMENT '当前动作已失败尝试次数',
+  next_retry_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) COMMENT '下次允许投递时间',
+  lease_owner VARCHAR(128) NULL COMMENT '当前任务租约持有者',
+  lease_until DATETIME(3) NULL COMMENT '当前任务租约截止时间',
+  last_error_code VARCHAR(32) NULL COMMENT '最后下游错误码',
+  last_error_message VARCHAR(1000) NULL COMMENT '最后诊断错误，不保存敏感凭证',
+  remote_config_id BIGINT NULL COMMENT 'Firstleg返回的首条默认尺寸配置ID',
+  task_version INT NOT NULL DEFAULT 0 COMMENT '任务乐观版本；切换动作或认领时递增',
+  created_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) COMMENT '任务创建时间',
+  updated_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3) COMMENT '任务更新时间',
+  completed_at DATETIME(3) NULL COMMENT 'READY或CANCELLED完成时间',
+  PRIMARY KEY (tenant_id),
+  KEY idx_customer_dimension_task_dispatch (status,next_retry_at,lease_until),
+  KEY idx_customer_dimension_task_diagnosis (status,updated_at)
+) ENGINE=InnoDB COMMENT='IAM客户默认尺寸可靠后台初始化任务及诊断状态';
+
 CALL baiyue_firstleg.assert_unified_final_schema();
 DROP PROCEDURE IF EXISTS baiyue_firstleg.assert_unified_final_schema;
 SELECT 'PASS' AS migration_status,
diff --git a/deploy/sql/海外区域统一增量-MySQL8.sql b/deploy/sql/海外区域统一增量-MySQL8.sql
index 6fc9929f5..61a281a6c 100644
--- a/deploy/sql/海外区域统一增量-MySQL8.sql
+++ b/deploy/sql/海外区域统一增量-MySQL8.sql
@@ -1,6 +1,113 @@
 -- 海外区域固定增量入口。空库先执行 lastleg-service/src/main/resources/db/lastleg.sql 基线；
+-- 本入口同时初始化海外 Event Bridge 独立库，避免国内/海外实例误共用 Inbox。
 -- 本文件只由人工审核执行，服务部署默认不自动执行 SQL。
 SET NAMES utf8mb4;
+
+CREATE DATABASE IF NOT EXISTS baiyue_event_bridge_overseas
+  DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
+USE baiyue_event_bridge_overseas;
+
+CREATE TABLE IF NOT EXISTS bridge_outbox (
+  event_id VARCHAR(128) NOT NULL COMMENT '事件全局标识',
+  idempotency_key VARCHAR(191) NOT NULL COMMENT '发送幂等键',
+  event_type VARCHAR(64) NOT NULL COMMENT '事件类型',
+  event_version INT NOT NULL COMMENT '事件契约版本',
+  source_region VARCHAR(32) NOT NULL COMMENT '来源区域',
+  target_region VARCHAR(32) NOT NULL COMMENT '目标区域',
+  customer_id VARCHAR(128) NOT NULL COMMENT '客户标识',
+  aggregate_type VARCHAR(64) NOT NULL COMMENT '聚合类型',
+  aggregate_id VARCHAR(128) NOT NULL COMMENT '聚合标识',
+  aggregate_version BIGINT NOT NULL COMMENT '聚合版本',
+  handover_version BIGINT NULL COMMENT '跨区交接版本',
+  trace_id VARCHAR(128) NOT NULL COMMENT '链路标识',
+  correlation_id VARCHAR(128) NOT NULL COMMENT '业务关联标识',
+  causation_id VARCHAR(128) NULL COMMENT '上游事件标识',
+  occurred_at DATETIME(3) NOT NULL COMMENT '业务事实发生时间',
+  payload_hash VARCHAR(71) NOT NULL COMMENT '规范化负载摘要',
+  payload_json JSON NOT NULL COMMENT '事件负载',
+  status VARCHAR(32) NOT NULL DEFAULT 'PENDING' COMMENT '投递状态',
+  retry_count INT NOT NULL DEFAULT 0 COMMENT '已重试次数',
+  next_retry_at DATETIME(3) NULL COMMENT '下次重试时间',
+  lease_owner VARCHAR(128) NULL COMMENT '租约持有者',
+  lease_until DATETIME(3) NULL COMMENT '租约截止时间',
+  last_error VARCHAR(1000) NULL COMMENT '最后错误',
+  created_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) COMMENT '创建时间',
+  delivered_at DATETIME(3) NULL COMMENT '投递成功时间',
+  PRIMARY KEY (event_id),
+  UNIQUE KEY uk_bridge_outbox_idempotency (idempotency_key),
+  KEY idx_bridge_outbox_schedule (target_region,status,next_retry_at,lease_until)
+) ENGINE=InnoDB COMMENT='海外跨区域事件待投递箱';
+
+CREATE TABLE IF NOT EXISTS bridge_inbox (
+  event_id VARCHAR(128) NOT NULL COMMENT '事件全局标识',
+  idempotency_key VARCHAR(191) NOT NULL COMMENT '接收幂等键',
+  event_type VARCHAR(64) NOT NULL COMMENT '事件类型',
+  event_version INT NOT NULL COMMENT '事件契约版本',
+  source_region VARCHAR(32) NOT NULL COMMENT '来源区域',
+  target_region VARCHAR(32) NOT NULL COMMENT '目标区域',
+  customer_id VARCHAR(128) NOT NULL COMMENT '客户标识',
+  aggregate_type VARCHAR(64) NOT NULL COMMENT '聚合类型',
+  aggregate_id VARCHAR(128) NOT NULL COMMENT '聚合标识',
+  aggregate_version BIGINT NOT NULL COMMENT '聚合版本',
+  handover_version BIGINT NULL COMMENT '跨区交接版本',
+  trace_id VARCHAR(128) NOT NULL COMMENT '链路标识',
+  correlation_id VARCHAR(128) NOT NULL COMMENT '业务关联标识',
+  causation_id VARCHAR(128) NULL COMMENT '上游事件标识',
+  occurred_at DATETIME(3) NOT NULL COMMENT '业务事实发生时间',
+  payload_hash VARCHAR(71) NOT NULL COMMENT '规范化负载摘要',
+  payload_json JSON NOT NULL COMMENT '事件负载',
+  status VARCHAR(32) NOT NULL DEFAULT 'RECEIVED' COMMENT '消费状态',
+  lease_owner VARCHAR(128) NULL COMMENT '消费租约持有者',
+  lease_until DATETIME(3) NULL COMMENT '消费租约截止时间',
+  retry_count INT NOT NULL DEFAULT 0 COMMENT '消费重试次数',
+  next_retry_at DATETIME(3) NULL COMMENT '下次消费时间',
+  last_error VARCHAR(1000) NULL COMMENT '最后错误',
+  received_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) COMMENT '接收时间',
+  processed_at DATETIME(3) NULL COMMENT '消费完成时间',
+  PRIMARY KEY (event_id),
+  UNIQUE KEY uk_bridge_inbox_idempotency (idempotency_key),
+  KEY idx_bridge_inbox_consume (status,next_retry_at,lease_until)
+) ENGINE=InnoDB COMMENT='海外跨区域事件已接收箱';
+
+CREATE TABLE IF NOT EXISTS bridge_delivery_attempt (
+  id BIGINT NOT NULL AUTO_INCREMENT COMMENT '主键',
+  event_id VARCHAR(128) NOT NULL COMMENT '事件全局标识',
+  source_region VARCHAR(32) NOT NULL COMMENT '来源区域',
+  target_region VARCHAR(32) NOT NULL COMMENT '目标区域',
+  attempt_no INT NOT NULL COMMENT '投递序号',
+  status VARCHAR(32) NOT NULL COMMENT '投递结果',
+  response_code VARCHAR(64) NULL COMMENT '对端响应码',
+  error_message VARCHAR(1000) NULL COMMENT '错误信息',
+  started_at DATETIME(3) NOT NULL COMMENT '开始时间',
+  finished_at DATETIME(3) NULL COMMENT '完成时间',
+  PRIMARY KEY (id),
+  UNIQUE KEY uk_bridge_attempt (event_id,attempt_no),
+  KEY idx_bridge_attempt_event (event_id,started_at)
+) ENGINE=InnoDB COMMENT='海外跨区域事件投递尝试记录';
+
+DROP PROCEDURE IF EXISTS assert_overseas_event_bridge_schema;
+DELIMITER $$
+CREATE PROCEDURE assert_overseas_event_bridge_schema()
+BEGIN
+  IF (SELECT COUNT(*) FROM information_schema.tables
+       WHERE table_schema='baiyue_event_bridge_overseas'
+         AND table_name IN ('bridge_outbox','bridge_inbox','bridge_delivery_attempt')) <> 3 THEN
+    SIGNAL SQLSTATE '45000'
+      SET MESSAGE_TEXT='海外区域初始化失败：Event Bridge 三张表未完整创建';
+  END IF;
+  IF (SELECT COUNT(DISTINCT CONCAT(table_name, ':', index_name)) FROM information_schema.statistics
+       WHERE table_schema='baiyue_event_bridge_overseas'
+         AND ((table_name='bridge_outbox' AND index_name IN ('PRIMARY','uk_bridge_outbox_idempotency','idx_bridge_outbox_schedule'))
+           OR (table_name='bridge_inbox' AND index_name IN ('PRIMARY','uk_bridge_inbox_idempotency','idx_bridge_inbox_consume'))
+           OR (table_name='bridge_delivery_attempt' AND index_name IN ('PRIMARY','uk_bridge_attempt','idx_bridge_attempt_event')))) <> 9 THEN
+    SIGNAL SQLSTATE '45000'
+      SET MESSAGE_TEXT='海外区域初始化失败：Event Bridge 索引未完整创建';
+  END IF;
+END$$
+DELIMITER ;
+CALL assert_overseas_event_bridge_schema();
+DROP PROCEDURE IF EXISTS assert_overseas_event_bridge_schema;
+
 CREATE DATABASE IF NOT EXISTS baiyue_lastleg
   DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
 USE baiyue_lastleg;
@@ -862,6 +969,12 @@ PREPARE phase4_discard_review_stmt FROM @ddl; EXECUTE phase4_discard_review_stmt
 -- Warehouse Overseas 与 Lastleg 使用同一海外区域发布入口但保持独立数据库。
 -- 公共托盘详情实体读取 fba_warehouse_code；旧库缺列时创建可成功但详情会 S0500。
 USE baiyue_lastlag_warehouse;
+-- 仓库主档唯一权威已收口至国内 baiyue_warehouse；海外库只保留 warehouse_id 引用。
+-- 当前开发阶段不兼容旧海外主档数据，按依赖顺序移除重复表。
+DROP TABLE IF EXISTS wh_service_capability;
+DROP TABLE IF EXISTS wh_warehouse_address;
+DROP TABLE IF EXISTS wh_warehouse;
+
 CREATE TABLE IF NOT EXISTS wh_pallet_operation (
   id BIGINT NOT NULL COMMENT '托盘状态操作ID', operation_key VARCHAR(128) NOT NULL COMMENT '跨服务幂等操作键',
   request_hash VARCHAR(128) NOT NULL COMMENT '状态变更请求摘要', warehouse_id BIGINT NOT NULL COMMENT '实际海外仓ID',
@@ -939,33 +1052,47 @@ CREATE TABLE IF NOT EXISTS ll_order_operation_log (
   PRIMARY KEY(id), KEY idx_ll_order_operation_customer_order(customer_id,order_id,created_at)
 ) ENGINE=InnoDB COMMENT='尾程订单操作记录';
 
-CREATE DATABASE IF NOT EXISTS baiyue_overseas_security DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_0900_ai_ci;
-USE baiyue_overseas_security;
-CREATE TABLE IF NOT EXISTS overseas_security_event_inbox (
-  event_id VARCHAR(64) NOT NULL, event_type VARCHAR(96) NOT NULL, payload_hash CHAR(64) NOT NULL,
-  payload_json JSON NOT NULL, status VARCHAR(16) NOT NULL, result VARCHAR(32) NULL,
-  received_at DATETIME(3) NOT NULL, processed_at DATETIME(3) NULL,
+USE baiyue_lastleg;
+CREATE TABLE IF NOT EXISTS ll_security_event_inbox (
+  event_id VARCHAR(64) NOT NULL COMMENT '跨区安全事件ID', event_type VARCHAR(96) NOT NULL COMMENT 'IAM安全事件类型',
+  payload_hash CHAR(64) NOT NULL COMMENT '规范化载荷SHA-256哈希', payload_json JSON NOT NULL COMMENT '冻结事件载荷JSON',
+  status VARCHAR(16) NOT NULL COMMENT '消费状态：RECEIVED或PROCESSED',
+  result VARCHAR(32) NULL COMMENT '处理结果：APPLIED、STALE、DUPLICATE或DUPLICATE_VERSION',
+  received_at DATETIME(3) NOT NULL COMMENT '接收时间', processed_at DATETIME(3) NULL COMMENT '处理完成时间',
   PRIMARY KEY (event_id), KEY idx_security_inbox_type_time (event_type,received_at)
-) ENGINE=InnoDB COMMENT='海外IAM安全事件消费者Inbox';
-CREATE TABLE IF NOT EXISTS overseas_security_projection (
-  aggregate_type VARCHAR(32) NOT NULL, aggregate_id VARCHAR(64) NOT NULL, tenant_id BIGINT NOT NULL,
-  security_status VARCHAR(24) NULL, permission_version BIGINT NULL, aggregate_version BIGINT NOT NULL,
-  payload_hash CHAR(64) NOT NULL, last_event_id VARCHAR(64) NOT NULL,
-  changed_at DATETIME(3) NOT NULL, updated_at DATETIME(3) NOT NULL,
+) ENGINE=InnoDB COMMENT='海外IAM安全事件消费者收件箱';
+CREATE TABLE IF NOT EXISTS ll_security_projection (
+  aggregate_type VARCHAR(32) NOT NULL COMMENT '聚合类型：USER、TENANT或AUTHORIZATION',
+  aggregate_id VARCHAR(64) NOT NULL COMMENT '用户或客户聚合ID', tenant_id BIGINT NOT NULL COMMENT '平台0或客户ID',
+  security_status VARCHAR(24) NULL COMMENT '当前安全状态：ACTIVE或DISABLED',
+  permission_version BIGINT NULL COMMENT '当前单调权限版本',
+  aggregate_version BIGINT NOT NULL COMMENT '事件聚合单调版本', payload_hash CHAR(64) NOT NULL COMMENT '当前版本载荷哈希',
+  last_event_id VARCHAR(64) NOT NULL COMMENT '最后应用的事件ID',
+  changed_at DATETIME(3) NOT NULL COMMENT '国内IAM事实发生时间', updated_at DATETIME(3) NOT NULL COMMENT '投影更新时间',
   PRIMARY KEY (aggregate_type,aggregate_id), KEY idx_security_projection_tenant (tenant_id),
   KEY idx_security_projection_permission (aggregate_id,permission_version)
 ) ENGINE=InnoDB COMMENT='海外IAM安全状态与权限版本投影';
 
-DROP PROCEDURE IF EXISTS assert_overseas_security_projection_ready;
+-- 与国内固定 auth_account.id=1000001、tenant_id=0 的 platform_admin 一致；真实事件从版本1覆盖。
+INSERT IGNORE INTO ll_security_projection (
+  aggregate_type,aggregate_id,tenant_id,security_status,permission_version,aggregate_version,
+  payload_hash,last_event_id,changed_at,updated_at
+) VALUES
+  ('USER','1000001',0,'ACTIVE',0,0,SHA2('lastleg-baseline:platform_admin:USER:0',256),
+   'baseline-platform-admin-user-v0','1970-01-01 00:00:00.000','1970-01-01 00:00:00.000'),
+  ('AUTHORIZATION','1000001',0,NULL,0,0,SHA2('lastleg-baseline:platform_admin:AUTHORIZATION:0',256),
+   'baseline-platform-admin-authorization-v0','1970-01-01 00:00:00.000','1970-01-01 00:00:00.000');
+
+DROP PROCEDURE IF EXISTS assert_lastleg_security_projection_ready;
 DELIMITER $$
-CREATE PROCEDURE assert_overseas_security_projection_ready()
+CREATE PROCEDURE assert_lastleg_security_projection_ready()
 BEGIN
-  IF (SELECT COUNT(*) FROM information_schema.tables WHERE table_schema='baiyue_overseas_security'
-      AND table_name IN ('overseas_security_event_inbox','overseas_security_projection')) <> 2 THEN
+  IF (SELECT COUNT(*) FROM information_schema.tables WHERE table_schema='baiyue_lastleg'
+      AND table_name IN ('ll_security_event_inbox','ll_security_projection')) <> 2 THEN
     SIGNAL SQLSTATE '45000' SET MESSAGE_TEXT='海外IAM安全Inbox或投影表未完整部署';
   END IF;
 END$$
 DELIMITER ;
-CALL assert_overseas_security_projection_ready();
-DROP PROCEDURE assert_overseas_security_projection_ready;
+CALL assert_lastleg_security_projection_ready();
+DROP PROCEDURE assert_lastleg_security_projection_ready;
 SELECT 'PASS' AS migration_status, '海外仓业务、海外仓资源与IAM安全投影结构已就绪' AS message;
diff --git a/docs/Order-Firstleg在线依赖解环设计.md b/docs/Order-Firstleg在线依赖解环设计.md
new file mode 100644
index 000000000..d8828c29e
--- /dev/null
+++ b/docs/Order-Firstleg在线依赖解环设计.md
@@ -0,0 +1,60 @@
+# Order↔Firstleg 在线依赖解环设计
+
+## 结论
+
+当前不能在不改变已确认产品成功时点的前提下直接实施解环，业务代码保持不变。在线图仍包含
+`Order→Firstleg` 与 `Firstleg→Order`，所以非平凡强连通分量仍是 `Firstleg↔Order`。
+
+建议的最小退出方向是 **退出全部 `Firstleg→Order` REQUEST 边**。该方向只有
+`OrderCargoClient` 和 `OrderFulfillmentSplitClient` 两个客户端；Order 继续拥有订单、货物、父子订单和
+拆分台账，Firstleg 继续拥有入库、测量、分柜装柜、PDA 拣货和库位结算。完成后只保留
+`Order→Firstleg` 在线查询/门禁边以及双方后台边，在线 SCC 才会实际消失。
+
+## 当前可执行调用
+
+| 方向/客户端 | Controller→Service→Client→被调用入口 | 时点与调用者期望 | 失败传播 | 幂等性 |
+|---|---|---|---|---|
+| Order→Firstleg `FirstlegPricingClient` | `MerchantFirstLegOrderController`、`PlatformFirstLegOrderController` 的创建/编辑/提交 → `OrderApplicationService` → `OrderPricingChannelGuard` → `/internal/firstleg/v1/pricing/channels/validate` | 保存或提交前实时确认渠道有效；提交还必须取得入仓码前缀 | 业务错误原码上传；连接、空响应或不完整数据映射依赖不可用/冲突，订单不提交 | 纯读取 `SAFE_READ` |
+| Order→Firstleg `FirstlegUnifiedOrderClient` | `PlatformUnifiedOrderController`、`MerchantUnifiedOrderController` 列表/详情 → `UnifiedOrderQueryService` → Firstleg unified query/summaries/detail | 一个响应内组合 Order 主数据与 Firstleg 实时履约、测量、装柜和时间线 | 远端异常、失败码、空数据均失败关闭，不返回伪造履约摘要 | 纯读取 `SAFE_READ` |
+| Order→Firstleg `FirstlegInboundClient` | `MerchantFirstLegOrderController.page` → `MerchantInboundOrderListService` → references/prepareBatch；已提交订单编辑提交后 → `OrderApplicationService.prepareDraftInbound` → prepare；审核 Outbox → `OrderInboundOutboxPublisher` → create | 列表需要入库引用；草稿/待审编辑尝试同步预入库；审核成功已与 Firstleg 建单解耦 | references 失败关闭；prepare/prepareBatch 当前捕获异常并允许列表缺少入库引用，是现有失败传播缺口；审核 Outbox 持久化重试 | `tenantId+orderId` 业务键；Firstleg 对订单唯一且入仓码一致时幂等 |
+| Firstleg→Order `OrderCargoClient` | 箱号 Controller/Order 审核后台建单 → `InboundCartonLabelService`；测量 Controller/OpenAPI → `InboundMeasurementService`/`InboundMeasurementOpenApiService`；智能装柜 Controller → `SmartLoadingService` → Order cargo/snapshot endpoints | 首次箱号、测量明细、申报回填和装柜清单均要求当前订单货物事实 | 服务不可用、空数据、归属不一致均阻断当前操作；没有默认货物或空列表成功 | 纯读取 `SAFE_READ`；同时存在 REQUEST 和审核 Outbox 回调产生的 BACKGROUND 上下文 |
+| Firstleg→Order `OrderFulfillmentSplitClient` | `PlatformLoadingPdaController.complete` → `LoadingPickService.complete @Transactional` → `PdaPickSettlementService.settle` → `/internal/order/v1/fulfillment-splits` → `OrderFulfillmentSplitService.split @Transactional` | PDA 完成请求必须先取得 Order 真实余量子单 ID/单号，再在同一 Firstleg 事务写分片、测量、库位、审计并推进装柜完成 | Order 不可用或响应数量/柜次/父子关系不一致时整个 Firstleg 完成事务回滚；不得返回完成成功 | Firstleg 使用 `idempotencyKey=pda-task-{taskId}`、`operationId=PDA-SPLIT-{taskId}-{inboundId}`；Order 保存请求哈希并以唯一键重放 |
+
+## 事实所有权
+
+- Order：订单交易状态、订单货物及允许编辑的字段、父子订单 ID/单号、履约拆分台账和订单版本。
+- Firstleg：入库单、测量事实、分柜/装柜计划、PDA 拣货数量、库位结算、装柜证据和 `LOADING→LOADED` 门禁。
+- 允许复制的仅是带来源版本和哈希的 Order 快照；Firstleg 不得成为订单货物或父子订单的第二写入方。
+- 统一订单查询是组合读模型，不把 Firstleg 履约状态写回 Order 交易状态。
+
+## 推荐退出方案
+
+### 1. 先退出货物在线读取
+
+复用 Order 已有 Outbox 和 Firstleg 已有订单入库接收入口，将完整货物快照、订单版本和规范化哈希随草稿准备、待审编辑和审核事件可靠投递；Firstleg 以
+`tenantId+orderId+orderVersion` 单调 Inbox/快照落库。箱号、测量和智能装柜只读本地快照，缺失、版本冲突或哈希冲突均失败关闭。
+
+不能只在审核时复制一次：当前契约允许 `LOADED` 前按权限和状态修改业务资料。必须先冻结货物在哪个节点停止修改，或要求每次允许的 Order 编辑都可靠发布版本事件，并明确 Firstleg 在投影落后期间阻断哪些操作。
+
+### 2. 再将履约拆分改为可靠后台命令
+
+Firstleg 在本地持久化稳定 operation/idempotency key、数量行、柜次和请求哈希；后台 Relay 调用现有 Order 幂等拆分接口并保存完整响应。Order 现有拆分台账和唯一键可承担 Inbox/业务幂等，不需要新服务或 MQ。
+
+Firstleg 只有在后台结果为 `READY` 且父子关系、数量和柜次全部校验通过后，才能消费余量子订单 ID并执行本地结算。失败进入可诊断重试/DEAD，禁止默认成功。远端成功、本地未完成时只允许向前恢复，不得自动删除 Order 子订单。
+
+这一方案会引入技术态 `PENDING/READY/FAILED`，但不能擅自增加产品主状态。若在 PDA 首次点击完成时只创建任务并返回待处理，成功时点发生变化；若提前创建 Order 子单，则子单可能在装柜硬门禁完成前可见，同样改变现有语义。
+
+## 必须由产品冻结的决策
+
+1. **货物冻结点**：Order 货物在审核通过、首次生成箱号、确认测量还是确认预装后不可再改；若仍允许修改，哪些 Firstleg 操作必须等待最新 `orderVersion` 投影。
+2. **PDA 完成成功时点**：必须继续在一次请求中同时完成 Order 子单与 Firstleg 结算，还是允许首次请求返回“处理中”，后台完成后才成为 `LOADED`。同时确认后台已创建 Order 子单但 Firstleg 最终失败时采用持续向前修复，不提供在线冲正。
+
+上述任一决策未冻结前，不实施业务解环。
+
+## 最小实施与验证边界（决策冻结后）
+
+- Order：扩充版本化货物快照 Outbox；保留 `OrderFulfillmentSplitService` 事实所有权和现有幂等唯一键。
+- Firstleg：货物快照 Inbox/表、拆分命令 Outbox/Relay/诊断查询；替换两个在线 Client 的业务调用点。
+- SQL：仅更新当前模块基线与统一增量，不引入 Flyway/Liquibase，不执行 SQL。
+- 合同：证明生产请求路径不再引用两个客户端、`Firstleg→Order` 只剩 BACKGROUND，REQUEST SCC 中不再出现两者同一分量。
+- 测试：Order/Firstleg 全量直接测试、重复/异哈希事件、租约恢复、远端成功本地失败重放、DEAD 人工重试、PDA 未 READY 失败关闭，以及同步依赖合同。
diff --git a/docs/同步调用依赖与失败传播治理基线.md b/docs/同步调用依赖与失败传播治理基线.md
index 0562b97bb..f7cba31aa 100644
--- a/docs/同步调用依赖与失败传播治理基线.md
+++ b/docs/同步调用依赖与失败传播治理基线.md
@@ -2,7 +2,7 @@
 
 ## 目的与口径
 
-本基线覆盖后端服务之间的 OpenFeign、`RestClient`、`WebClient` 与 JDK `HttpClient` 调用。它用于识别同步依赖方向、在线请求深度、后台中继、超时、重试、熔断、幂等、错误映射和失败传播，不改变 Finance 或四期业务状态机。
+本基线覆盖当前官方 22 个 Maven 模块、15 个可执行服务之间的 OpenFeign、`RestClient`、`WebClient` 与 JDK `HttpClient` 调用。海外安全 Inbox/投影属于 Lastleg 内部子域，不再作为独立服务节点。基线用于识别同步依赖方向、在线请求深度、后台中继、超时、重试、熔断、幂等、错误映射和失败传播，不改变 Finance 或四期业务状态机。
 
 “存在双向服务边”不等于“一次在线请求会递归调用”。每条边必须继续区分：
 
@@ -21,12 +21,12 @@
 |---|---|---:|---|
 | Auth | IAM | 2 | 登录授权、注册，`REQUEST` |
 | IAM | Auth | 1 | 账号开通/管理，`REQUEST` |
-| IAM | Firstleg | 1 | 客户尺寸规则，`REQUEST` |
+| IAM | Firstleg | 1 | 客户尺寸默认规则可靠任务投递，`BACKGROUND` |
 | IAM | Warehouse | 1 | 海外仓储费协作，`REQUEST` |
 | IAM | Event Bridge | 1 | 安全事件中继，`BACKGROUND` |
 | Order | Firstleg | 3 | 计价/统一订单查询为 `REQUEST`，入库协作为 Outbox `BACKGROUND` |
 | Order | IAM / File / Warehouse | 各 1 | 资格、图片、仓库守卫，`REQUEST` |
-| Firstleg | Order | 2 | 货物查询与分拆回写，`REQUEST` |
+| Firstleg | Order | 2 | 货物查询同时存在 `REQUEST/BACKGROUND`；PDA 履约分拆为 `REQUEST` |
 | Firstleg | IAM / Finance / Integration / Event Bridge / Print | 各 1 | IAM、Integration、Print 为 `REQUEST`；Finance 与 Event Bridge 为 `BACKGROUND` 中继 |
 | Firstleg | File | 7 | 测量、装柜、凭证、报关、拖车等，`REQUEST` |
 | Firstleg | Warehouse | 4 | 主数据、供应商、库位/托盘，`REQUEST` |
@@ -45,10 +45,10 @@
 | 调用方 | 被调用方 | 实现 | 上下文与当前策略 |
 |---|---|---|---|
 | Gateway Overseas | Auth | `HttpPdaSessionValidationClient` | `INFRASTRUCTURE`；总超时 2 秒，异常由网关失败关闭 |
-| Gateway Overseas | Overseas Security | `HttpOverseasSecurityValidationClient` | `INFRASTRUCTURE`；安全投影实时校验，异常失败关闭，不进入在线业务图 |
+| Gateway Overseas | Lastleg Security 子域 | `HttpOverseasSecurityValidationClient` | `INFRASTRUCTURE`；Lastleg 内部安全投影实时校验，异常失败关闭，不进入在线业务图 |
 | Lastleg | Warehouse Overseas | 两个 `RestClient` Gateway | `REQUEST`；分别使用 3 秒连接、5 秒读取超时，配置可覆盖，不自动重试 |
 | Lastleg | File | 两个照片 `RestClient` Gateway | `REQUEST`；分别使用 3 秒连接、30 秒读取超时，配置可覆盖；校验响应 code 且失败关闭，不自动重试 |
-| Event Bridge | Firstleg / Lastleg / Overseas Security | 三个 JDK `HttpClient` | `BACKGROUND`；连接 3 秒、请求 10 秒，持久化租约和退避由 Event Bridge 专项治理；Security 投影不进入在线业务图 |
+| Event Bridge | Firstleg / Lastleg（业务事件与安全投影两个入口） | 三个 JDK `HttpClient` | `BACKGROUND`；连接 3 秒、请求 10 秒，持久化租约和退避由 Event Bridge 专项治理；Lastleg Security 投影不进入在线业务图 |
 | 启用 Common Audit 的服务 | Audit | `HttpAuditSink` | `INFRASTRUCTURE`；当前捕获异常后仅告警，可能让调用方误以为审计已成功，是高优先级失败传播缺口 |
 | Integration | 外部 OCR/船司 | 六个 JDK `HttpClient` | `EXTERNAL`；OCR 默认 10/60 秒，船司默认 10/30 秒，业务重试必须服从供应商和调度契约 |
 
@@ -67,21 +67,21 @@
 
 ### 在线 REQUEST 图
 
-在线图只包含用户或设备请求线程中实际执行的服务边。Event Bridge、Outbox、船节点定时任务、导出 Provider 和海外 Security 校验均不计入在线深度。
+在线图只包含用户或设备请求线程中实际执行的服务边。Event Bridge、Outbox、船节点定时任务、导出 Provider 和 Gateway→Lastleg Security 基础设施校验均不计入在线深度。
 
 当前在线强连通分量为：
 
-`Auth ↔ IAM ↔ Firstleg ↔ Order ↔ File`
+`Auth ↔ IAM`；`Firstleg ↔ Order`
 
-合同冻结 22 条在线服务边；新增在线边或新增强连通分量直接失败。Finance、Lastleg 只指向该分量或叶子服务，不属于在线环；Gateway Overseas→Security 是 `INFRASTRUCTURE`，不是 REQUEST 边。
+`IAM → Firstleg` 默认尺寸初始化已退出请求线程，合同现冻结 21 条在线服务边；新增在线边或新增强连通分量直接失败。File 不再属于在线强连通分量；Finance、Lastleg 只指向上述分量或叶子服务，不属于在线环；Gateway Overseas→Lastleg Security 是 `INFRASTRUCTURE`，不是 REQUEST 边。
 
 ### 后台 BACKGROUND 图
 
 后台图包含 Outbox/Inbox、导出 Worker 和定时任务，当前强连通分量为：
 
-`Event Bridge ↔ Firstleg ↔ Finance ↔ Lastleg`
+`Event Bridge ↔ Firstleg ↔ Finance ↔ Lastleg ↔ Order`
 
-File 的五个导出 Provider、Order→Firstleg 入库 Outbox、IAM 安全 Outbox、Firstleg/Lastleg 跨区 Outbox、Firstleg→Finance 费用 Outbox及 Event Bridge 三个消费者均只在后台图中计算。Event Bridge→Overseas Security 是单向后台叶子边，不形成在线业务环。
+File 的五个导出 Provider、Order→Firstleg 入库 Outbox、该入库消费者为生成箱号而回读 Order 货物的后台回调、IAM 默认尺寸可靠任务、IAM 安全 Outbox、Firstleg/Lastleg 跨区 Outbox、Firstleg→Finance 费用 Outbox及 Event Bridge 三个消费者均只在后台图中计算。Event Bridge→Lastleg Security 与 Event Bridge→Lastleg 业务事件在服务图上收敛为同一条后台服务边，不形成新的在线业务边或独立安全节点。
 
 ### 全图
 
@@ -97,21 +97,20 @@ File 的五个导出 Provider、Order→Firstleg 入库 Outbox、IAM 安全 Outb
 
 | 用户入口 | 最长跳数 | 全部长路径 |
 |---|---:|---|
-| 认证 API | 5 | `Auth → IAM → Firstleg → Order → File → Integration` |
-| IAM API | 4 | `IAM → Firstleg → Order → File → Integration` |
-| 订单 API | 4 | `Order → File → IAM → Firstleg → Print`；`Order → File → IAM → Firstleg → Warehouse`；`Order → Firstleg → File → IAM → Auth`；`Order → Firstleg → File → IAM → Warehouse`；`Order → IAM → Firstleg → File → Integration` |
+| 订单 API | 4 | `Order → Firstleg → File → IAM → Auth`；`Order → Firstleg → File → IAM → Warehouse` |
 | 头程 API/PDA | 4 | `Firstleg → Order → File → IAM → Auth`；`Firstleg → Order → File → IAM → Warehouse` |
-| 财务 API | 5 | `Finance → File → IAM → Firstleg → Order → Warehouse`；`Finance → Firstleg → Order → File → IAM → Auth`；`Finance → Firstleg → Order → File → IAM → Warehouse`；`Finance → IAM → Firstleg → Order → File → Integration` |
-| 文件 API | 4 | `File → IAM → Firstleg → Order → Warehouse` |
-| 海外尾程 API/PDA | 5 | `Lastleg → File → IAM → Firstleg → Order → Warehouse` |
-| 国内仓储 API | 0 | 无下游同步调用 |
-| 海外仓储 API | 0 | 无下游同步调用 |
+| 财务 API | 5 | `Finance → Firstleg → Order → File → IAM → Auth`；`Finance → Firstleg → Order → File → IAM → Warehouse` |
+| 海外尾程 API/PDA | 3 | `Lastleg → File → IAM → Auth`；`Lastleg → File → IAM → Warehouse` |
 
 这些是静态服务边可形成的最长简单路径，不表示每个具体 Controller 都会走完整链；后续入口级调用点治理必须继续以实际 Service 调用证据缩小路径，不能用静态可能性宣称线上已经发生。
 
-### 第一个建议退出的 REQUEST 边
+### 已完成的第一个 REQUEST 边退出
 
-建议优先将 `IAM → Firstleg` 的 `CustomerDimensionRuleClient` 默认尺寸初始化从 REQUEST WRITE 改为可靠后台编排。该命令已经携带稳定 `initializationKey` 并提供补偿接口，适合使用持久化 Outbox、显式 `PENDING/FAILED` 结果和人工可诊断重试；不得在失败时返回默认成功。退出此边可把当前五服务在线强连通分量拆为更小的 Auth↔IAM 与 Order↔Firstleg 子环，同时不触碰财务、Event Bridge 传输或四期业务状态机。实施前仍需 IAM/Firstleg 业务负责人确认“客户创建成功”与“默认尺寸已就绪”的产品时点。
+`IAM → Firstleg` 的 `CustomerDimensionRuleClient` 默认尺寸初始化已经从 REQUEST WRITE 改为可靠后台编排。IAM 与客户主档同事务持久化稳定 `initializationKey` 的任务，显式维护 `PENDING/READY/FAILED`，由租约调度重试并提供诊断查询和人工重试；审批通过与下单资格在未 READY 时失败关闭。此边现在仅属于 BACKGROUND，在线五服务强连通分量实际拆为 Auth↔IAM 与 Order↔Firstleg 两个子环，未触碰财务、Event Bridge 或四期业务状态机。
+
+### Order↔Firstleg 第二阶段结论
+
+具体入口、所有权与可执行退出方案见 `docs/Order-Firstleg在线依赖解环设计.md`。当前 `COMPLETE_LOADING` 在 Firstleg 本地事务中同步取得 Order 余量子单后才完成结算，且 Order 货物在 `LOADED` 前仍允许修改；成功时点和货物冻结点尚未冻结，因此本阶段不改业务代码。REQUEST SCC 仍为 `Firstleg↔Order`，合同明确阻止仅改变分类却未退出生产调用的伪解环。
 
 ## 退出顺序
 
diff --git a/docs/头程项目目录结构与服务说明.md b/docs/头程项目目录结构与服务说明.md
index 2ed49423a..f16f95e37 100644
--- a/docs/头程项目目录结构与服务说明.md
+++ b/docs/头程项目目录结构与服务说明.md
@@ -10,7 +10,7 @@
 
 ## 1. 项目定位
 
-`baiyue-firstleg` 是国内头程与海外仓后端仓库，采用 Maven 多模块单仓结构。根 POM 聚合 23 个 Maven 模块，其中 7 个是公共/依赖模块，16 个是可独立启动、构建、制作镜像的微服务。
+`baiyue-firstleg` 是国内头程与海外仓后端仓库，采用 Maven 多模块单仓结构。根 POM 聚合 22 个 Maven 模块，其中 7 个是公共/依赖模块，15 个是可独立启动、构建、制作镜像的微服务。
 
 当前技术基线：
 
@@ -48,7 +48,6 @@ baiyue-firstleg/
 ├─ finance/                      # 财务账期、账单、收付款与核销
 ├─ lastleg-service/              # 海外尾程、入仓、库存与本土业务
 ├─ warehouse-overseas-service/   # 海外仓库、库位、托盘与资源锁
-├─ overseas-security-service/    # 海外IAM安全事件Inbox、投影与实时校验
 ├─ file/                         # 资质、导出与测量图片文件中心
 ├─ print/                        # 打印中心
 ├─ audit-service/                # 审计日志中心
@@ -100,9 +99,8 @@ baiyue-firstleg/
 | `file` | `file-service` | 9206 | `baiyue_file` | 企业资质文件、公共异步导出下载、入库测量图片及重量 OCR 调用协作 |
 | `print` | `print-service` | 9207 | 无 | 无状态 PDF 渲染服务；调用方传入完整标签数据，服务在内存中生成一次性多页 PDF |
 | `integration-service` | `integration-service` | 9210 | 无 | 百度 OCR、Amazon SP-API 等第三方适配器和启停状态；默认关闭外部调用 |
-| `lastleg-service` | `lastleg-service` | 9303 | `baiyue_lastleg` | 海外尾程订单、接柜入仓、库存与海外本土业务；不含海外出库和派送 |
+| `lastleg-service` | `lastleg-service` | 9303 | `baiyue_lastleg` | 海外尾程订单、接柜入仓、库存、海外本土业务及 IAM 安全事件投影/实时校验；不含海外出库和派送 |
 | `warehouse-overseas-service` | `warehouse-overseas-service` | 9305 | 海外仓资源库 | 海外仓库、库位、托盘和资源锁 |
-| `overseas-security-service` | `overseas-security-service` | 9307 | `baiyue_overseas_security` | IAM安全事件可靠Inbox、单调投影及海外Token即时失效校验 |
 | `event-bridge-service` | `event-bridge-service` | 9312 | `baiyue_event_bridge` | 按 CN/OVERSEAS 双实例部署的跨区事件 Inbox、重试和目标服务投递 |
 | `audit-service` | `audit-service` | 9700 | `baiyue_audit` | 接收公共审计事件并持久化；平台端可按权限查询已脱敏日志，业务审计发送默认开启 |
 
@@ -283,6 +281,6 @@ HTTP 401 / `A0401`，不得再按 HTTP 200 + 空权限处理；只有使用新
 - 平台端和商户端权限分别管理，接口与按钮权限都必须由后端校验。
 - Controller 负责协议转换，Service 负责业务编排，Repository/Mapper 负责持久化。
 - 服务之间只传 DTO 或事件契约，不能依赖其他服务的 Entity、Mapper。
-- 公共模块变化会影响多个服务，Jenkins 会按 `service-map.yml` 覆盖的全部 16 个服务执行受影响构建。
+- 公共模块变化会影响多个服务，Jenkins 会按 `service-map.yml` 覆盖的全部 15 个服务执行受影响构建。
 - 单一 Git 仓库不等于单一部署单元；每个服务仍生成独立 JAR、镜像和容器。
 - 国内头程与海外仓共享 Git 仓库，但保持两套数据库、Nacos 命名空间和部署环境。
diff --git a/event-bridge-service/AGENTS.md b/event-bridge-service/AGENTS.md
index 14ed05d26..99d0553fb 100644
--- a/event-bridge-service/AGENTS.md
+++ b/event-bridge-service/AGENTS.md
@@ -12,12 +12,13 @@
 |---|---|
 | 接收、状态、人工补投 API | `src/main/java/com/baiyue/eventbridge/controller/EventBridgeController.java` |
 | Inbox 接收与幂等 | `service/EventInboxService.java` |
-| 按目标区域调度与重试 | `service/OverseasEventDispatcher.java`；`targetRegion=CN` 回投 Firstleg；海外业务事件投 Lastleg，三类 IAM 安全事件按 eventType 投 `overseas-security-service`，传输层不解析 payload |
+| 按目标区域调度与重试 | `service/OverseasEventDispatcher.java`；`targetRegion=CN` 回投 Firstleg；海外业务事件投 Lastleg 通用入口，三类 IAM 安全事件按 eventType 投 Lastleg `/internal/lastleg/security/v1/events`，传输层不解析 payload |
 | 尾程 HTTP 客户端 | `service/LastlegEventClient.java`、`HttpLastlegEventClient.java` |
 | 国内头程 HTTP 客户端 | `service/FirstlegEventClient.java`、`HttpFirstlegEventClient.java`；默认内部入口 `/internal/firstleg/v1/container-events` |
 | 人工补投 | `service/EventReplayService.java`；只允许 `DEAD` 转回 `RETRY`，记录操作人与原因，并保留原 `eventId`、payload 与 `payloadHash` |
 | Inbox 与投递记录 | `domain/BridgeInbox.java`、`BridgeDeliveryAttempt.java` 及对应 Mapper |
 | 传输指标与 Inbox 采样 | `metrics/EventBridgeMetrics.java`、`EventBridgeInboxMetricsSampler.java`；SLO 与告警合同 `docs/development-observability-slo.md` |
+| 事件 Trace 与原始 HTTP 传播 | `trace/EventBridgeTraceScope.java`、`EventBridgeHttpTracePropagation.java`；契约与已知缺口 `docs/event-trace-propagation.md` |
 | 内部服务令牌 | `security/InternalServiceTokenGuard.java` |
 | 数据库 | `src/main/resources/db/event-bridge.sql` |
 | 测试 | `src/test/java/com/baiyue/eventbridge/` |
@@ -29,6 +30,7 @@
 - 领取任务必须有数据库租约/并发保护，避免多实例重复发送；尾程幂等仍是最终保障。
 - 内部接口使用 `X-Internal-Service-Token`，生产还应置于受信网络或 mTLS 后。
 - 指标标签只允许有限 `target_region`、`event_type`、`result`，未知区域/类型折叠为 `OTHER`，禁止 eventId、customerId、错误消息等高基数标签。Inbox 聚合按现有状态索引定时采样，Prometheus scrape 不得查询数据库；开发阶段 SLO/告警只代表代码合同，不代表监控平台已部署。
+- 投递线程只从 Inbox 已冻结 `trace_id` 建立 MDC；合法 32 位 trace ID 或规范 UUID 可贯通，非法历史值安全重建。每次 JDK HttpClient 投递生成 child span，并覆盖三类标准 Trace 头；不得把 correlationId、eventId、customerId、聚合 ID、JWT 或内部令牌写入 Trace 字段。
 
 ## 修改与验证
 
diff --git a/event-bridge-service/docs/event-trace-propagation.md b/event-bridge-service/docs/event-trace-propagation.md
new file mode 100644
index 000000000..00c2e42c3
--- /dev/null
+++ b/event-bridge-service/docs/event-trace-propagation.md
@@ -0,0 +1,16 @@
+# Event Bridge Trace 传播基线
+
+- Event Bridge 领取 Inbox 后，仅从事件信封已冻结的 `traceId` 建立投递线程 MDC。
+- 32 位非零十六进制 trace ID 直接沿用；历史规范 UUID 去除连字符后沿用。
+- 其他旧值不满足 W3C Trace ID 约束，投递时安全重建新 trace，但不覆盖或迁移原事件信封。
+- 每次 HTTP 投递生成新的 `X-Request-Id` 和 child span，并统一覆盖 `X-Trace-Id`、`traceparent`。
+- `correlationId`、`eventId`、customer ID、聚合 ID、JWT 和内部服务令牌不得写入 Trace 标准字段。
+- 投递日志在 MDC 和显式 `traceId` 字段中记录本次标准 trace；投递 attempt 仍通过 `event_id`
+  关联 `bridge_inbox.trace_id`，本轮不增加数据库字段。
+
+## 共享契约缺口
+
+当前 `EventEnvelope.traceId` 仍是通用字符串契约，没有强制 32 位 W3C Trace ID；因此历史任意字符串不能
+无损映射为 W3C trace。若后续要求所有事件跨重试、跨语言绝对保持同一标准 trace，必须由
+`common-event-contract` 生产者、消费者和 Event Bridge 共同冻结字段校验后再收敛。本轮没有修改共享
+Payload、信封字段、哈希规则或可靠性状态机。
diff --git a/event-bridge-service/src/main/java/com/baiyue/eventbridge/metrics/EventBridgeMetrics.java b/event-bridge-service/src/main/java/com/baiyue/eventbridge/metrics/EventBridgeMetrics.java
index 50a3bbe66..85756ae0e 100644
--- a/event-bridge-service/src/main/java/com/baiyue/eventbridge/metrics/EventBridgeMetrics.java
+++ b/event-bridge-service/src/main/java/com/baiyue/eventbridge/metrics/EventBridgeMetrics.java
@@ -6,6 +6,7 @@ import com.baiyue.eventbridge.domain.BridgeInbox;
 import io.micrometer.core.instrument.MeterRegistry;
 import io.micrometer.core.instrument.Timer;
 import lombok.extern.slf4j.Slf4j;
+import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.stereotype.Component;
 
 import java.time.Clock;
@@ -41,6 +42,7 @@ public class EventBridgeMetrics {
     private final MeterRegistry registry;
     private final Clock clock;
 
+    @Autowired
     public EventBridgeMetrics(MeterRegistry registry) {
         this(registry, Clock.systemDefaultZone());
     }
diff --git a/event-bridge-service/src/main/java/com/baiyue/eventbridge/service/EventInboxService.java b/event-bridge-service/src/main/java/com/baiyue/eventbridge/service/EventInboxService.java
index f4adf8f3d..f904c7984 100644
--- a/event-bridge-service/src/main/java/com/baiyue/eventbridge/service/EventInboxService.java
+++ b/event-bridge-service/src/main/java/com/baiyue/eventbridge/service/EventInboxService.java
@@ -14,7 +14,9 @@ import org.springframework.stereotype.Service;
 import org.springframework.transaction.annotation.Transactional;
 import jakarta.annotation.Resource;
 
+import java.time.Instant;
 import java.time.LocalDateTime;
+import java.time.temporal.ChronoUnit;
 import java.util.Objects;
 
 /**
@@ -78,7 +80,7 @@ public class EventInboxService {
             && Objects.equals(existing.getAggregateId(), envelope.aggregateId())
             && Objects.equals(existing.getAggregateVersion(), envelope.aggregateVersion())
             && Objects.equals(existing.getHandoverVersion(), envelope.handoverVersion())
-            && Objects.equals(existing.getOccurredAt(), envelope.occurredAt())
+            && Objects.equals(normalizeOccurredAt(existing.getOccurredAt()), normalizeOccurredAt(envelope.occurredAt()))
             && Objects.equals(existing.getTraceId(), envelope.traceId())
             && Objects.equals(existing.getCorrelationId(), envelope.correlationId())
             && Objects.equals(existing.getCausationId(), envelope.causationId());
@@ -100,7 +102,7 @@ public class EventInboxService {
         inbox.setTraceId(envelope.traceId());
         inbox.setCorrelationId(envelope.correlationId());
         inbox.setCausationId(envelope.causationId());
-        inbox.setOccurredAt(envelope.occurredAt());
+        inbox.setOccurredAt(normalizeOccurredAt(envelope.occurredAt()));
         inbox.setPayloadHash(envelope.payloadHash().toLowerCase(java.util.Locale.ROOT));
         try {
             inbox.setPayloadJson(objectMapper.writeValueAsString(envelope.payload()));
@@ -111,4 +113,8 @@ public class EventInboxService {
         inbox.setReceivedAt(LocalDateTime.now());
         return inbox;
     }
+
+    private static Instant normalizeOccurredAt(Instant value) {
+        return value == null ? null : value.truncatedTo(ChronoUnit.MILLIS);
+    }
 }
diff --git a/event-bridge-service/src/main/java/com/baiyue/eventbridge/service/HttpFirstlegEventClient.java b/event-bridge-service/src/main/java/com/baiyue/eventbridge/service/HttpFirstlegEventClient.java
index fe26409f2..f888cd04f 100644
--- a/event-bridge-service/src/main/java/com/baiyue/eventbridge/service/HttpFirstlegEventClient.java
+++ b/event-bridge-service/src/main/java/com/baiyue/eventbridge/service/HttpFirstlegEventClient.java
@@ -4,6 +4,7 @@ import com.baiyue.common.event.EventEnvelope;
 import com.baiyue.common.event.RegionCode;
 import com.baiyue.eventbridge.config.EventDispatcherProperties;
 import com.baiyue.eventbridge.domain.BridgeInbox;
+import com.baiyue.eventbridge.trace.EventBridgeHttpTracePropagation;
 import com.fasterxml.jackson.databind.JsonNode;
 import com.fasterxml.jackson.databind.ObjectMapper;
 import jakarta.annotation.PostConstruct;
@@ -20,6 +21,7 @@ import java.net.http.HttpResponse;
 public class HttpFirstlegEventClient implements FirstlegEventClient {
     @Resource private ObjectMapper objectMapper;
     @Resource private EventDispatcherProperties properties;
+    @Resource private EventBridgeHttpTracePropagation tracePropagation;
     @Value("${baiyue.event-dispatcher.firstleg-consumer-url:http://127.0.0.1:9203/internal/firstleg/v1/container-events}")
     private URI consumerUrl;
     @Value("${baiyue.security.internal-service-token:}") private String serviceToken;
@@ -37,9 +39,10 @@ public class HttpFirstlegEventClient implements FirstlegEventClient {
             row.getCustomerId(), row.getAggregateType(), row.getAggregateId(), row.getAggregateVersion(),
             row.getHandoverVersion(), row.getTraceId(), row.getCorrelationId(), row.getCausationId(),
             objectMapper.readTree(row.getPayloadJson()), row.getPayloadHash());
-        HttpRequest request = HttpRequest.newBuilder(consumerUrl).timeout(properties.requestTimeout())
+        HttpRequest.Builder requestBuilder = HttpRequest.newBuilder(consumerUrl).timeout(properties.requestTimeout())
             .header("Content-Type", "application/json")
-            .header("X-Internal-Service-Token", serviceToken)
+            .header("X-Internal-Service-Token", serviceToken);
+        HttpRequest request = tracePropagation.apply(requestBuilder)
             .POST(HttpRequest.BodyPublishers.ofString(objectMapper.writeValueAsString(envelope))).build();
         HttpResponse<String> response = httpClient.send(request, HttpResponse.BodyHandlers.ofString());
         JsonNode responseBody;
diff --git a/event-bridge-service/src/main/java/com/baiyue/eventbridge/service/HttpLastlegEventClient.java b/event-bridge-service/src/main/java/com/baiyue/eventbridge/service/HttpLastlegEventClient.java
index e3b3dd5b8..2e01d3981 100644
--- a/event-bridge-service/src/main/java/com/baiyue/eventbridge/service/HttpLastlegEventClient.java
+++ b/event-bridge-service/src/main/java/com/baiyue/eventbridge/service/HttpLastlegEventClient.java
@@ -4,6 +4,7 @@ import com.baiyue.common.event.EventEnvelope;
 import com.baiyue.common.event.RegionCode;
 import com.baiyue.eventbridge.config.EventDispatcherProperties;
 import com.baiyue.eventbridge.domain.BridgeInbox;
+import com.baiyue.eventbridge.trace.EventBridgeHttpTracePropagation;
 import com.fasterxml.jackson.databind.JsonNode;
 import com.fasterxml.jackson.databind.ObjectMapper;
 import org.springframework.beans.factory.annotation.Value;
@@ -19,6 +20,7 @@ import java.net.http.HttpResponse;
 public class HttpLastlegEventClient implements LastlegEventClient {
     @Resource private ObjectMapper objectMapper;
     @Resource private EventDispatcherProperties properties;
+    @Resource private EventBridgeHttpTracePropagation tracePropagation;
 
     @Value("${baiyue.security.internal-service-token:}")
     private String serviceToken;
@@ -38,10 +40,11 @@ public class HttpLastlegEventClient implements LastlegEventClient {
                 row.getHandoverVersion(), row.getTraceId(), row.getCorrelationId(), row.getCausationId(),
                 objectMapper.readTree(row.getPayloadJson()), row.getPayloadHash());
         String body = objectMapper.writeValueAsString(envelope);
-        HttpRequest request = HttpRequest.newBuilder(properties.consumerUrl())
+        HttpRequest.Builder requestBuilder = HttpRequest.newBuilder(properties.consumerUrl())
                 .timeout(properties.requestTimeout())
                 .header("Content-Type", "application/json")
-                .header("X-Internal-Service-Token", serviceToken)
+                .header("X-Internal-Service-Token", serviceToken);
+        HttpRequest request = tracePropagation.apply(requestBuilder)
                 .POST(HttpRequest.BodyPublishers.ofString(body))
                 .build();
         HttpResponse<String> response = httpClient.send(request, HttpResponse.BodyHandlers.ofString());
diff --git a/event-bridge-service/src/main/java/com/baiyue/eventbridge/service/HttpSecurityProjectionEventClient.java b/event-bridge-service/src/main/java/com/baiyue/eventbridge/service/HttpSecurityProjectionEventClient.java
index e18cf8714..9e55d56bd 100644
--- a/event-bridge-service/src/main/java/com/baiyue/eventbridge/service/HttpSecurityProjectionEventClient.java
+++ b/event-bridge-service/src/main/java/com/baiyue/eventbridge/service/HttpSecurityProjectionEventClient.java
@@ -4,9 +4,11 @@ import com.baiyue.common.event.EventEnvelope;
 import com.baiyue.common.event.RegionCode;
 import com.baiyue.eventbridge.config.EventDispatcherProperties;
 import com.baiyue.eventbridge.domain.BridgeInbox;
+import com.baiyue.eventbridge.trace.EventBridgeHttpTracePropagation;
 import com.fasterxml.jackson.databind.JsonNode;
 import com.fasterxml.jackson.databind.ObjectMapper;
 import jakarta.annotation.PostConstruct;
+import jakarta.annotation.Resource;
 import org.springframework.beans.factory.annotation.Value;
 import org.springframework.stereotype.Component;
 
@@ -19,6 +21,7 @@ import java.net.http.HttpResponse;
 public class HttpSecurityProjectionEventClient implements SecurityProjectionEventClient {
     private final ObjectMapper objectMapper;
     private final EventDispatcherProperties properties;
+    @Resource private EventBridgeHttpTracePropagation tracePropagation;
     @Value("${baiyue.event-dispatcher.security-consumer-url}") private URI consumerUrl;
     @Value("${baiyue.security.internal-service-token:}") private String serviceToken;
     private HttpClient httpClient;
@@ -39,18 +42,23 @@ public class HttpSecurityProjectionEventClient implements SecurityProjectionEven
                 row.getCustomerId(), row.getAggregateType(), row.getAggregateId(), row.getAggregateVersion(),
                 row.getHandoverVersion(), row.getTraceId(), row.getCorrelationId(), row.getCausationId(),
                 objectMapper.readTree(row.getPayloadJson()), row.getPayloadHash());
-        HttpRequest request = HttpRequest.newBuilder(consumerUrl).timeout(properties.requestTimeout())
+        HttpRequest.Builder requestBuilder = HttpRequest.newBuilder(consumerUrl).timeout(properties.requestTimeout())
                 .header("Content-Type", "application/json")
-                .header("X-Internal-Service-Token", serviceToken)
+                .header("X-Internal-Service-Token", serviceToken);
+        HttpRequest request = tracePropagation.apply(requestBuilder)
                 .POST(HttpRequest.BodyPublishers.ofString(objectMapper.writeValueAsString(envelope))).build();
         HttpResponse<String> response = httpClient.send(request, HttpResponse.BodyHandlers.ofString());
         JsonNode body;
         try { body = objectMapper.readTree(response.body()); }
         catch (Exception exception) { body = null; }
-        if (response.statusCode() / 100 != 2 || body == null || !"200".equals(body.path("code").asText())
-                || !row.getEventId().equals(body.path("data").path("eventId").asText())) {
-            throw new IllegalStateException("海外安全投影消费失败: HTTP " + response.statusCode());
-        }
+        requireAcknowledgement(response.statusCode(), body, row.getEventId());
         return String.valueOf(response.statusCode());
     }
+
+    static void requireAcknowledgement(int statusCode, JsonNode body, String eventId) {
+        if (statusCode / 100 != 2 || body == null || !"200".equals(body.path("code").asText())
+                || !eventId.equals(body.path("data").path("eventId").asText())) {
+            throw new IllegalStateException("Lastleg 安全投影消费失败: HTTP " + statusCode);
+        }
+    }
 }
diff --git a/event-bridge-service/src/main/java/com/baiyue/eventbridge/service/OverseasEventDispatcher.java b/event-bridge-service/src/main/java/com/baiyue/eventbridge/service/OverseasEventDispatcher.java
index 54cd77867..b20be547f 100644
--- a/event-bridge-service/src/main/java/com/baiyue/eventbridge/service/OverseasEventDispatcher.java
+++ b/event-bridge-service/src/main/java/com/baiyue/eventbridge/service/OverseasEventDispatcher.java
@@ -7,10 +7,13 @@ import com.baiyue.eventbridge.domain.BridgeInbox;
 import com.baiyue.eventbridge.mapper.BridgeDeliveryAttemptMapper;
 import com.baiyue.eventbridge.mapper.BridgeInboxMapper;
 import com.baiyue.eventbridge.metrics.EventBridgeMetrics;
+import com.baiyue.eventbridge.trace.EventBridgeTraceScope;
+import com.baiyue.common.web.CorrelationContext;
 import jakarta.annotation.Resource;
 import lombok.extern.slf4j.Slf4j;
 import org.springframework.scheduling.annotation.Scheduled;
 import org.springframework.stereotype.Component;
+import org.slf4j.MDC;
 
 import java.lang.management.ManagementFactory;
 import java.time.LocalDateTime;
@@ -42,6 +45,12 @@ public class OverseasEventDispatcher {
         }
 
         BridgeInbox event = inboxMapper.selectById(eventId);
+        try (EventBridgeTraceScope ignored = EventBridgeTraceScope.open(event)) {
+            dispatchClaimed(eventId, event);
+        }
+    }
+
+    private void dispatchClaimed(String eventId, BridgeInbox event) {
         int retryAttempt = event.getRetryCount() == null ? 1 : event.getRetryCount() + 1;
         int deliveryAttemptNo = inboxMapper.nextAttemptNo(eventId);
         BridgeDeliveryAttempt attempt = startAttempt(event, deliveryAttemptNo);
@@ -57,8 +66,8 @@ public class OverseasEventDispatcher {
                     : "FAILED_LEASE_LOST";
             finishAttempt(attempt, attemptStatus, null, error);
             metrics.recordTransport(event, EventBridgeMetrics.TransportResult.valueOf(attemptStatus));
-            log.warn("跨区事件投递失败 eventId={}, retryAttempt={}, deliveryAttempt={}, reason={}",
-                    eventId, retryAttempt, deliveryAttemptNo, error);
+            log.warn("跨区事件投递失败 eventId={}, retryAttempt={}, deliveryAttempt={}, traceId={}, reason={}",
+                    eventId, retryAttempt, deliveryAttemptNo, MDC.get(CorrelationContext.TRACE_ID), error);
             return;
         }
 
@@ -66,7 +75,8 @@ public class OverseasEventDispatcher {
             String error = "下游已确认成功，但事件租约已失效；保留当前 Inbox 状态并由新租约持有者幂等续投";
             finishAttempt(attempt, "ACKNOWLEDGED_LEASE_LOST", responseCode, error);
             metrics.recordTransport(event, EventBridgeMetrics.TransportResult.ACKNOWLEDGED_LEASE_LOST);
-            log.warn("跨区事件成功确认时租约已失效 eventId={}, deliveryAttempt={}", eventId, deliveryAttemptNo);
+            log.warn("跨区事件成功确认时租约已失效 eventId={}, deliveryAttempt={}, traceId={}",
+                    eventId, deliveryAttemptNo, MDC.get(CorrelationContext.TRACE_ID));
             return;
         }
         finishAttempt(attempt, "DELIVERED", responseCode, null);
diff --git a/event-bridge-service/src/main/java/com/baiyue/eventbridge/trace/EventBridgeHttpTracePropagation.java b/event-bridge-service/src/main/java/com/baiyue/eventbridge/trace/EventBridgeHttpTracePropagation.java
new file mode 100644
index 000000000..dc2c78bd3
--- /dev/null
+++ b/event-bridge-service/src/main/java/com/baiyue/eventbridge/trace/EventBridgeHttpTracePropagation.java
@@ -0,0 +1,19 @@
+package com.baiyue.eventbridge.trace;
+
+import com.baiyue.common.web.CorrelationContext;
+import com.baiyue.common.web.OutboundTraceHeaders;
+import org.springframework.stereotype.Component;
+
+import java.net.http.HttpRequest;
+
+/** Applies a fresh child span to one raw JDK HttpClient request. */
+@Component
+public class EventBridgeHttpTracePropagation {
+    public HttpRequest.Builder apply(HttpRequest.Builder builder) {
+        OutboundTraceHeaders outbound = OutboundTraceHeaders.fromCurrentOrNew();
+        return builder
+                .setHeader(CorrelationContext.REQUEST_ID_HEADER, outbound.requestId())
+                .setHeader(CorrelationContext.TRACE_ID_HEADER, outbound.traceId())
+                .setHeader(CorrelationContext.TRACE_PARENT_HEADER, outbound.traceParent());
+    }
+}
diff --git a/event-bridge-service/src/main/java/com/baiyue/eventbridge/trace/EventBridgeTraceScope.java b/event-bridge-service/src/main/java/com/baiyue/eventbridge/trace/EventBridgeTraceScope.java
new file mode 100644
index 000000000..82139ab51
--- /dev/null
+++ b/event-bridge-service/src/main/java/com/baiyue/eventbridge/trace/EventBridgeTraceScope.java
@@ -0,0 +1,35 @@
+package com.baiyue.eventbridge.trace;
+
+import com.baiyue.common.web.CorrelationContext;
+import com.baiyue.common.web.OutboundTraceHeaders;
+import com.baiyue.eventbridge.domain.BridgeInbox;
+import org.slf4j.MDC;
+
+import java.util.Map;
+
+/** Establishes one trusted MDC context for an Event Bridge delivery attempt. */
+public final class EventBridgeTraceScope implements AutoCloseable {
+    private final Map<String, String> previous;
+
+    private EventBridgeTraceScope(Map<String, String> previous) {
+        this.previous = previous;
+    }
+
+    public static EventBridgeTraceScope open(BridgeInbox event) {
+        Map<String, String> previous = MDC.getCopyOfContextMap();
+        OutboundTraceHeaders local = OutboundTraceHeaders.fromTrustedTraceOrNew(event.getTraceId());
+        MDC.put(CorrelationContext.REQUEST_ID, local.requestId());
+        MDC.put(CorrelationContext.TRACE_ID, local.traceId());
+        MDC.put(CorrelationContext.SPAN_ID, local.spanId());
+        return new EventBridgeTraceScope(previous);
+    }
+
+    @Override
+    public void close() {
+        if (previous == null) {
+            MDC.clear();
+        } else {
+            MDC.setContextMap(previous);
+        }
+    }
+}
diff --git a/event-bridge-service/src/main/resources/application.yml b/event-bridge-service/src/main/resources/application.yml
index fc5524546..b20743a41 100644
--- a/event-bridge-service/src/main/resources/application.yml
+++ b/event-bridge-service/src/main/resources/application.yml
@@ -33,7 +33,7 @@ baiyue:
   event-dispatcher:
     consumer-url: ${EVENT_CONSUMER_URL:${LASTLEG_CONSUMER_URL:http://127.0.0.1:9303/internal/lastleg/events}}
     firstleg-consumer-url: ${FIRSTLEG_CONTAINER_EVENT_CONSUMER_URL:http://127.0.0.1:9202/internal/firstleg/v1/container-events}
-    security-consumer-url: ${OVERSEAS_SECURITY_EVENT_CONSUMER_URL:http://127.0.0.1:9307/internal/overseas-security/v1/events}
+    security-consumer-url: ${LASTLEG_SECURITY_EVENT_CONSUMER_URL:http://127.0.0.1:9303/internal/lastleg/security/v1/events}
     fixed-delay: ${EVENT_DISPATCH_FIXED_DELAY:3000}
     batch-size: ${EVENT_DISPATCH_BATCH_SIZE:50}
     max-attempts: ${EVENT_DISPATCH_MAX_ATTEMPTS:10}
diff --git a/event-bridge-service/src/test/java/com/baiyue/eventbridge/metrics/EventBridgeMetricsTest.java b/event-bridge-service/src/test/java/com/baiyue/eventbridge/metrics/EventBridgeMetricsTest.java
index 39a229241..636db964f 100644
--- a/event-bridge-service/src/test/java/com/baiyue/eventbridge/metrics/EventBridgeMetricsTest.java
+++ b/event-bridge-service/src/test/java/com/baiyue/eventbridge/metrics/EventBridgeMetricsTest.java
@@ -8,12 +8,32 @@ import org.junit.jupiter.api.Test;
 import java.lang.reflect.Modifier;
 import java.util.Arrays;
 
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.context.annotation.AnnotationConfigApplicationContext;
+
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatCode;
 import static org.mockito.Mockito.mock;
 
 class EventBridgeMetricsTest {
 
+    @Test
+    void productionConstructorIsExplicitForSpringWhenTestClockConstructorAlsoExists() throws Exception {
+        assertThat(EventBridgeMetrics.class.getConstructor(MeterRegistry.class)
+                .isAnnotationPresent(Autowired.class)).isTrue();
+    }
+
+    @Test
+    void springContextCreatesMetricsBeanWithTheAnnotatedProductionConstructor() {
+        try (AnnotationConfigApplicationContext context = new AnnotationConfigApplicationContext()) {
+            context.registerBean(MeterRegistry.class, SimpleMeterRegistry::new);
+            context.register(EventBridgeMetrics.class);
+            context.refresh();
+
+            assertThat(context.getBean(EventBridgeMetrics.class)).isNotNull();
+        }
+    }
+
     @Test
     void collapsesUnboundedRegionAndEventTypeLabelsToOther() {
         SimpleMeterRegistry registry = new SimpleMeterRegistry();
diff --git a/event-bridge-service/src/test/java/com/baiyue/eventbridge/service/EventInboxServiceTest.java b/event-bridge-service/src/test/java/com/baiyue/eventbridge/service/EventInboxServiceTest.java
index c8ee93232..6789ed520 100644
--- a/event-bridge-service/src/test/java/com/baiyue/eventbridge/service/EventInboxServiceTest.java
+++ b/event-bridge-service/src/test/java/com/baiyue/eventbridge/service/EventInboxServiceTest.java
@@ -65,6 +65,22 @@ class EventInboxServiceTest {
         assertThat(receiveCount("DUPLICATE")).isEqualTo(1.0);
     }
 
+    @Test
+    void 数据库毫秒精度截断后相同事件仍判定为重复() {
+        EventEnvelope source = envelope("sha256:placeholder");
+        EventEnvelope precise = new EventEnvelope(source.eventId(), source.eventType(), source.eventVersion(),
+                Instant.parse("2026-07-29T08:30:00.123456789Z"), source.sourceRegion(), source.targetRegion(),
+                source.tenantId(), source.aggregateType(), source.aggregateId(), source.aggregateVersion(),
+                source.handoverVersion(), source.traceId(), source.correlationId(), source.causationId(),
+                source.payload(), source.payloadHash());
+        EventEnvelope envelope = withHash(precise);
+        BridgeInbox existing = existing(envelope, envelope.payloadHash());
+        existing.setOccurredAt(Instant.parse("2026-07-29T08:30:00.123Z"));
+        when(store.findByEventId(envelope.eventId())).thenReturn(existing);
+
+        assertThat(service.receive(envelope).result()).isEqualTo("重复");
+    }
+
     @Test
     void 相同事件但摘要不同时拒绝覆盖() {
         EventEnvelope envelope = withHash(envelope("sha256:placeholder"));
diff --git a/event-bridge-service/src/test/java/com/baiyue/eventbridge/service/HttpSecurityProjectionEventClientTest.java b/event-bridge-service/src/test/java/com/baiyue/eventbridge/service/HttpSecurityProjectionEventClientTest.java
new file mode 100644
index 000000000..9a31b6db0
--- /dev/null
+++ b/event-bridge-service/src/test/java/com/baiyue/eventbridge/service/HttpSecurityProjectionEventClientTest.java
@@ -0,0 +1,44 @@
+package com.baiyue.eventbridge.service;
+
+import com.fasterxml.jackson.databind.ObjectMapper;
+import org.junit.jupiter.api.Test;
+
+import java.nio.file.Files;
+import java.nio.file.Path;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatCode;
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
+
+class HttpSecurityProjectionEventClientTest {
+    private final ObjectMapper objectMapper = new ObjectMapper();
+
+    @Test
+    void onlyMatchingLastlegAcknowledgementCompletesBridgeDelivery() throws Exception {
+        var acknowledged = objectMapper.readTree("""
+            {"code":"200","data":{"eventId":"event-1","result":"APPLIED"}}
+            """);
+        var businessFailure = objectMapper.readTree("""
+            {"code":"A0409","message":"payloadHash 冲突","data":{"eventId":"event-1"}}
+            """);
+        var wrongEvent = objectMapper.readTree("""
+            {"code":"200","data":{"eventId":"event-2","result":"DUPLICATE"}}
+            """);
+
+        assertThatCode(() -> HttpSecurityProjectionEventClient.requireAcknowledgement(
+            200, acknowledged, "event-1")).doesNotThrowAnyException();
+        assertThatThrownBy(() -> HttpSecurityProjectionEventClient.requireAcknowledgement(
+            200, businessFailure, "event-1")).isInstanceOf(IllegalStateException.class);
+        assertThatThrownBy(() -> HttpSecurityProjectionEventClient.requireAcknowledgement(
+            200, wrongEvent, "event-1")).isInstanceOf(IllegalStateException.class);
+    }
+
+    @Test
+    void defaultConsumerUrlTargetsLastlegSecurityEndpoint() throws Exception {
+        String application = Files.readString(Path.of("src/main/resources/application.yml"));
+
+        assertThat(application).contains(
+            "LASTLEG_SECURITY_EVENT_CONSUMER_URL:http://127.0.0.1:9303/internal/lastleg/security/v1/events")
+            .doesNotContain("/internal/overseas-security/v1/events");
+    }
+}
diff --git a/event-bridge-service/src/test/java/com/baiyue/eventbridge/service/OverseasEventDispatcherTest.java b/event-bridge-service/src/test/java/com/baiyue/eventbridge/service/OverseasEventDispatcherTest.java
index aa9f11d14..5224a11e5 100644
--- a/event-bridge-service/src/test/java/com/baiyue/eventbridge/service/OverseasEventDispatcherTest.java
+++ b/event-bridge-service/src/test/java/com/baiyue/eventbridge/service/OverseasEventDispatcherTest.java
@@ -7,11 +7,13 @@ import com.baiyue.eventbridge.domain.BridgeInbox;
 import com.baiyue.eventbridge.mapper.BridgeDeliveryAttemptMapper;
 import com.baiyue.eventbridge.mapper.BridgeInboxMapper;
 import com.baiyue.eventbridge.metrics.EventBridgeMetrics;
+import com.baiyue.common.web.CorrelationContext;
 import io.micrometer.core.instrument.simple.SimpleMeterRegistry;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 import org.mockito.ArgumentCaptor;
 import org.springframework.test.util.ReflectionTestUtils;
+import org.slf4j.MDC;
 
 import java.net.URI;
 import java.time.Duration;
@@ -63,7 +65,12 @@ class OverseasEventDispatcherTest {
 
     @Test
     void successfulDeliveryIsConfirmedAndAudited() throws Exception {
-        when(eventClient.deliver(event)).thenReturn("200");
+        event.setTraceId("550e8400-e29b-41d4-a716-446655440000");
+        when(eventClient.deliver(event)).thenAnswer(invocation -> {
+            assertThat(MDC.get(CorrelationContext.TRACE_ID))
+                    .isEqualTo("550e8400e29b41d4a716446655440000");
+            return "200";
+        });
         when(inboxMapper.markProcessed(eq("event-1"), anyString())).thenReturn(1);
 
         dispatcher.dispatchOne("event-1");
@@ -74,6 +81,7 @@ class OverseasEventDispatcherTest {
         assertThat(updatedAttempt().getStatus()).isEqualTo("DELIVERED");
         assertThat(transportCount("DELIVERED")).isEqualTo(1.0);
         assertThat(registry.get(EventBridgeMetrics.DELIVERY_LATENCY_METRIC).timer().count()).isEqualTo(1);
+        assertThat(MDC.get(CorrelationContext.TRACE_ID)).isNull();
     }
 
     @Test
diff --git a/event-bridge-service/src/test/java/com/baiyue/eventbridge/trace/EventBridgeTracePropagationTest.java b/event-bridge-service/src/test/java/com/baiyue/eventbridge/trace/EventBridgeTracePropagationTest.java
new file mode 100644
index 000000000..1dbf17567
--- /dev/null
+++ b/event-bridge-service/src/test/java/com/baiyue/eventbridge/trace/EventBridgeTracePropagationTest.java
@@ -0,0 +1,65 @@
+package com.baiyue.eventbridge.trace;
+
+import com.baiyue.common.web.CorrelationContext;
+import com.baiyue.eventbridge.domain.BridgeInbox;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.Test;
+import org.slf4j.MDC;
+
+import java.net.URI;
+import java.net.http.HttpRequest;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+class EventBridgeTracePropagationTest {
+
+    @AfterEach
+    void clearMdc() {
+        MDC.clear();
+    }
+
+    @Test
+    void envelopeUuidFlowsThroughMdcAndRawHttpAsAChildSpan() {
+        BridgeInbox event = new BridgeInbox();
+        event.setTraceId("550e8400-e29b-41d4-a716-446655440000");
+        event.setCorrelationId("ORDER:customer-99:booking-123");
+        event.setEventId("event-business-id");
+
+        try (EventBridgeTraceScope ignored = EventBridgeTraceScope.open(event)) {
+            String localSpan = MDC.get(CorrelationContext.SPAN_ID);
+            HttpRequest.Builder builder = HttpRequest.newBuilder(URI.create("http://127.0.0.1/internal"))
+                    .header(CorrelationContext.REQUEST_ID_HEADER, event.getEventId())
+                    .header(CorrelationContext.TRACE_ID_HEADER, event.getCorrelationId())
+                    .header(CorrelationContext.TRACE_PARENT_HEADER,
+                            "00-aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-bbbbbbbbbbbbbbbb-00");
+            HttpRequest request = new EventBridgeHttpTracePropagation().apply(builder).GET().build();
+
+            assertThat(MDC.get(CorrelationContext.TRACE_ID))
+                    .isEqualTo("550e8400e29b41d4a716446655440000");
+            assertThat(request.headers().firstValue(CorrelationContext.TRACE_ID_HEADER))
+                    .contains("550e8400e29b41d4a716446655440000");
+            assertThat(request.headers().firstValue(CorrelationContext.REQUEST_ID_HEADER).orElseThrow())
+                    .matches("[0-9a-f-]{36}").isNotEqualTo(event.getEventId());
+            assertThat(request.headers().firstValue(CorrelationContext.TRACE_PARENT_HEADER).orElseThrow())
+                    .matches("00-550e8400e29b41d4a716446655440000-[0-9a-f]{16}-01")
+                    .doesNotContain(localSpan);
+        }
+
+        assertThat(MDC.get(CorrelationContext.TRACE_ID)).isNull();
+    }
+
+    @Test
+    void invalidLegacyEnvelopeTraceIsSafelyRebuiltAndPreviousMdcIsRestored() {
+        MDC.put("existing", "preserved");
+        BridgeInbox event = new BridgeInbox();
+        event.setTraceId("JWT-or-business-id-value");
+
+        try (EventBridgeTraceScope ignored = EventBridgeTraceScope.open(event)) {
+            assertThat(MDC.get(CorrelationContext.TRACE_ID)).matches("[0-9a-f]{32}")
+                    .isNotEqualTo(event.getTraceId());
+        }
+
+        assertThat(MDC.get("existing")).isEqualTo("preserved");
+        assertThat(MDC.get(CorrelationContext.TRACE_ID)).isNull();
+    }
+}
diff --git a/file/src/main/java/com/baiyue/file/controller/PlatformProductImageController.java b/file/src/main/java/com/baiyue/file/controller/PlatformProductImageController.java
new file mode 100644
index 000000000..4ffcf47d0
--- /dev/null
+++ b/file/src/main/java/com/baiyue/file/controller/PlatformProductImageController.java
@@ -0,0 +1,55 @@
+package com.baiyue.file.controller;
+
+import com.baiyue.common.core.api.ResultCode;
+import com.baiyue.common.core.exception.BizException;
+import com.baiyue.common.security.AuthenticatedUser;
+import com.baiyue.file.service.ProductImageService;
+import jakarta.annotation.Resource;
+import org.springframework.http.CacheControl;
+import org.springframework.http.ContentDisposition;
+import org.springframework.http.HttpHeaders;
+import org.springframework.http.MediaType;
+import org.springframework.http.ResponseEntity;
+import org.springframework.security.access.prepost.PreAuthorize;
+import org.springframework.security.core.annotation.AuthenticationPrincipal;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.PathVariable;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+import java.nio.charset.StandardCharsets;
+
+/** 鐢ㄤ簬骞冲彴绔鍗曡鎯呮煡鐪嬪晢鎴峰晢鍝佸浘鐗囥€? */
+@RestController
+@RequestMapping("/api/platform/v1/files/product-images")
+public class PlatformProductImageController {
+    @Resource private ProductImageService images;
+
+    @GetMapping("/{tenantId}/{fileId}")
+    @PreAuthorize("hasAuthority('platform:order:list')")
+    public ResponseEntity<byte[]> download(
+        @AuthenticationPrincipal AuthenticatedUser user,
+        @PathVariable long tenantId,
+        @PathVariable long fileId) {
+        requirePlatform(user);
+        if (tenantId <= 0 || fileId <= 0) {
+            throw new BizException(ResultCode.BAD_REQUEST, "瀹㈡埛鍜屾枃浠禝D蹇呴』澶т簬0");
+        }
+        var image = images.download(tenantId, fileId);
+        return ResponseEntity.ok()
+            .cacheControl(CacheControl.noStore())
+            .contentType(MediaType.parseMediaType(image.contentType()))
+            .contentLength(image.content().length)
+            .header(HttpHeaders.CONTENT_DISPOSITION, ContentDisposition.inline()
+                .filename(image.fileName(), StandardCharsets.UTF_8).build().toString())
+            .body(image.content());
+    }
+
+    private static void requirePlatform(AuthenticatedUser user) {
+        if (user == null || !"PLATFORM".equalsIgnoreCase(user.appCode())
+            || user.tenantId() == null || user.tenantId() != 0L
+            || user.userId() == null || user.userId() <= 0) {
+            throw new BizException(ResultCode.FORBIDDEN, "闇€瑕佸钩鍙扮韬唤");
+        }
+    }
+}
diff --git a/file/src/main/java/com/baiyue/file/service/InternalBusinessFileService.java b/file/src/main/java/com/baiyue/file/service/InternalBusinessFileService.java
index 6ee3f5737..2ec986c99 100644
--- a/file/src/main/java/com/baiyue/file/service/InternalBusinessFileService.java
+++ b/file/src/main/java/com/baiyue/file/service/InternalBusinessFileService.java
@@ -20,7 +20,7 @@ public class InternalBusinessFileService {
         "CUSTOMS_RECEIPT",
         "FINANCE_VOUCHER",
         "CONTAINER_CLEARANCE_DOCUMENT",
-        "LOADING_CUSTOMS_DOCUMENT",
+        "LOADING_CUSTOMS_DECLARATION",
         "CONTAINER_DELIVERY_ORDER",
         "CONTAINER_PICKUP_ORDER",
         "OVERSEAS_UNLOAD_PHOTO",
diff --git a/file/src/test/java/com/baiyue/file/client/ExportProviderFeignConfigurationTest.java b/file/src/test/java/com/baiyue/file/client/ExportProviderFeignConfigurationTest.java
index 11fbd6567..964b44893 100644
--- a/file/src/test/java/com/baiyue/file/client/ExportProviderFeignConfigurationTest.java
+++ b/file/src/test/java/com/baiyue/file/client/ExportProviderFeignConfigurationTest.java
@@ -9,9 +9,14 @@ import org.springframework.boot.autoconfigure.http.HttpMessageConverters;
 import java.nio.charset.StandardCharsets;
 import java.util.Map;
 
+import static org.junit.jupiter.api.Assertions.assertDoesNotThrow;
 import static org.junit.jupiter.api.Assertions.assertThrows;
 
 class ExportProviderFeignConfigurationTest {
+    @Test void keepsOpenFeignFormEncoderOnTheRuntimeClasspath() {
+        assertDoesNotThrow(() -> Class.forName("feign.form.spring.SpringFormEncoder"));
+    }
+
     @Test void rejectsAnOversizedProviderResponseBeforeJsonDeserialization() {
         ExportProviderFeignConfiguration configuration=new ExportProviderFeignConfiguration();
         Decoder decoder=configuration.exportProviderDecoder(HttpMessageConverters::new);
diff --git a/file/src/test/java/com/baiyue/file/controller/InternalBusinessFileControllerTest.java b/file/src/test/java/com/baiyue/file/controller/InternalBusinessFileControllerTest.java
index 96c7bb064..04819c77e 100644
--- a/file/src/test/java/com/baiyue/file/controller/InternalBusinessFileControllerTest.java
+++ b/file/src/test/java/com/baiyue/file/controller/InternalBusinessFileControllerTest.java
@@ -35,14 +35,14 @@ class InternalBusinessFileControllerTest {
     }
 
     @Test void zeroTenantDownloadReturnsOwnedContentWithoutCaching() {
-        when(service.download(0L, "LOADING_CUSTOMS_DOCUMENT", "51", 91L))
+        when(service.download(0L, "LOADING_CUSTOMS_DECLARATION", "51", 91L))
             .thenReturn(new InternalBusinessFileService.Download("declaration.pdf", "application/pdf", new byte[]{1, 2}));
 
-        var response = controller.download("internal-token", 0L, "LOADING_CUSTOMS_DOCUMENT", "51", 91L);
+        var response = controller.download("internal-token", 0L, "LOADING_CUSTOMS_DECLARATION", "51", 91L);
 
         assertThat(response.getBody()).containsExactly(1, 2);
         assertThat(response.getHeaders().getCacheControl()).contains("no-store");
-        verify(service).download(0L, "LOADING_CUSTOMS_DOCUMENT", "51", 91L);
+        verify(service).download(0L, "LOADING_CUSTOMS_DECLARATION", "51", 91L);
     }
 
     @Test void rejectsInvalidTokenAndNegativeTenantBeforeServiceAccess() {
diff --git a/file/src/test/java/com/baiyue/file/controller/ProductImageControllerContractTest.java b/file/src/test/java/com/baiyue/file/controller/ProductImageControllerContractTest.java
index d9828b371..eaff89224 100644
--- a/file/src/test/java/com/baiyue/file/controller/ProductImageControllerContractTest.java
+++ b/file/src/test/java/com/baiyue/file/controller/ProductImageControllerContractTest.java
@@ -77,6 +77,26 @@ class ProductImageControllerContractTest {
         assertThatThrownBy(() -> controller.upload(platform, file)).isInstanceOf(BizException.class);
     }
 
+    @Test
+    void platformDownloadUsesTenantScopeAndOrderListPermission() throws Exception {
+        RequestMapping mapping = PlatformProductImageController.class.getAnnotation(RequestMapping.class);
+        assertThat(mapping.value()).contains("/api/platform/v1/files/product-images");
+        var download = PlatformProductImageController.class.getDeclaredMethod(
+            "download", AuthenticatedUser.class, long.class, long.class);
+        assertThat(download.getAnnotation(PreAuthorize.class).value())
+            .isEqualTo("hasAuthority('platform:order:list')");
+
+        ProductImageService service = mock(ProductImageService.class);
+        PlatformProductImageController controller = new PlatformProductImageController();
+        ReflectionTestUtils.setField(controller, "images", service);
+        when(service.download(10001L, 31L)).thenReturn(
+            new ProductImageService.Download("product.png", "image/png", new byte[] {1}));
+
+        var platform = new AuthenticatedUser(1L, 0L, 0L, 1L, "admin", "PLATFORM", "WEB", Set.of());
+        assertThat(controller.download(platform, 10001L, 31L).getBody()).containsExactly(1);
+        verify(service).download(10001L, 31L);
+    }
+
     private static AuthenticatedUser merchant(long tenantId) {
         return new AuthenticatedUser(2L, tenantId, tenantId, 2L, "merchant", "MERCHANT", "WEB", Set.of());
     }
diff --git a/file/src/test/java/com/baiyue/file/service/InternalBusinessFileServiceTest.java b/file/src/test/java/com/baiyue/file/service/InternalBusinessFileServiceTest.java
index f0cc94a06..b5a5100e1 100644
--- a/file/src/test/java/com/baiyue/file/service/InternalBusinessFileServiceTest.java
+++ b/file/src/test/java/com/baiyue/file/service/InternalBusinessFileServiceTest.java
@@ -47,7 +47,7 @@ class InternalBusinessFileServiceTest {
         });
 
         var clearance = service.upload(0L, "CONTAINER_CLEARANCE_DOCUMENT", "41", 7L, file);
-        var customs = service.upload(0L, "LOADING_CUSTOMS_DOCUMENT", "51", 7L, file);
+        var customs = service.upload(0L, "LOADING_CUSTOMS_DECLARATION", "51", 7L, file);
         var deliveryOrder = service.upload(0L, "CONTAINER_DELIVERY_ORDER", "41", 7L, file);
         var pickupOrder = service.upload(0L, "CONTAINER_PICKUP_ORDER", "41", 7L, file);
         var unloadPhoto = service.upload(11L, "OVERSEAS_UNLOAD_PHOTO", "51", 7L, file);
@@ -57,7 +57,7 @@ class InternalBusinessFileServiceTest {
             InternalBusinessFileService.Metadata::businessId).containsExactly(0L, "CONTAINER_CLEARANCE_DOCUMENT", "41");
         assertThat(customs).extracting(InternalBusinessFileService.Metadata::tenantId,
             InternalBusinessFileService.Metadata::businessType,
-            InternalBusinessFileService.Metadata::businessId).containsExactly(0L, "LOADING_CUSTOMS_DOCUMENT", "51");
+            InternalBusinessFileService.Metadata::businessId).containsExactly(0L, "LOADING_CUSTOMS_DECLARATION", "51");
         assertThat(deliveryOrder.businessType()).isEqualTo("CONTAINER_DELIVERY_ORDER");
         assertThat(pickupOrder.businessType()).isEqualTo("CONTAINER_PICKUP_ORDER");
         assertThat(unloadPhoto).extracting(InternalBusinessFileService.Metadata::tenantId,
@@ -119,22 +119,23 @@ class InternalBusinessFileServiceTest {
 
     @Test void platformMetadataAndDownloadRequireExactCompositeOwnership() {
         FileObjectEntity value = new FileObjectEntity(); value.setId(91L); value.setTenantId(0L);
-        value.setBusinessType("LOADING_CUSTOMS_DOCUMENT"); value.setBusinessId("51");
+        value.setBusinessType("LOADING_CUSTOMS_DECLARATION"); value.setBusinessId("51");
         value.setOriginalName("declaration.pdf"); value.setObjectKey("business-files/0/51/declaration.pdf");
         value.setContentType("application/pdf"); value.setSha256("c".repeat(64)); value.setSizeBytes(8L);
         when(files.selectOne(any())).thenReturn(value, value, null, null, null);
         when(storage.read(value.getObjectKey())).thenReturn("document".getBytes());
 
-        assertThat(service.metadata(0L, "LOADING_CUSTOMS_DOCUMENT", "51", 91L).fileName())
+        assertThat(service.metadata(0L, "LOADING_CUSTOMS_DECLARATION", "51", 91L).fileName())
             .isEqualTo("declaration.pdf");
-        assertThat(service.download(0L, "LOADING_CUSTOMS_DOCUMENT", "51", 91L).content())
+        assertThat(service.download(0L, "LOADING_CUSTOMS_DECLARATION", "51", 91L).content())
             .isEqualTo("document".getBytes());
         assertThatThrownBy(() -> service.metadata(0L, "CONTAINER_CLEARANCE_DOCUMENT", "51", 91L))
             .isInstanceOf(BizException.class).hasMessageContaining("归属不匹配");
-        assertThatThrownBy(() -> service.metadata(0L, "LOADING_CUSTOMS_DOCUMENT", "52", 91L))
+        assertThatThrownBy(() -> service.metadata(0L, "LOADING_CUSTOMS_DECLARATION", "52", 91L))
             .isInstanceOf(BizException.class).hasMessageContaining("归属不匹配");
-        assertThatThrownBy(() -> service.metadata(0L, "LOADING_CUSTOMS_DOCUMENT", "51", 92L))
+        assertThatThrownBy(() -> service.metadata(0L, "LOADING_CUSTOMS_DECLARATION", "51", 92L))
             .isInstanceOf(BizException.class).hasMessageContaining("归属不匹配");
         verify(storage).read(value.getObjectKey());
     }
+
 }
diff --git a/finance/src/main/java/com/baiyue/finance/service/ReconciliationStatementService.java b/finance/src/main/java/com/baiyue/finance/service/ReconciliationStatementService.java
index cb2a5669e..7311d5375 100644
--- a/finance/src/main/java/com/baiyue/finance/service/ReconciliationStatementService.java
+++ b/finance/src/main/java/com/baiyue/finance/service/ReconciliationStatementService.java
@@ -68,7 +68,9 @@ public class ReconciliationStatementService {
         CustomerProfile customer = customer(request.customerId());
         long subjectId = activeSubject();
         List<Source> sources = eligibleSources(request);
-        if (sources.isEmpty()) throw error("FIN_409", "没有符合结算条件的CNY应收费用来源");
+        if (sources.isEmpty()) {
+            throw error("FIN_409", "当前客户在所选账期内没有可生成的CNY应收费用，请调整账期或选择其他客户后重试");
+        }
         BigDecimal total = sources.stream().map(Source::amount).reduce(BigDecimal.ZERO, BigDecimal::add);
         LocalDate dueDate = request.periodEnd().plusDays(customer.creditDays());
         String statementNo = documentNumbers.next("REC");
diff --git a/firstleg/AGENTS.md b/firstleg/AGENTS.md
index a9afeb4a0..36b45e079 100644
--- a/firstleg/AGENTS.md
+++ b/firstleg/AGENTS.md
@@ -10,6 +10,7 @@
 
 | 目标 | 入口 |
 |---|---|
+| 内部模块化基线与依赖分析 | `docs/firstleg-internal-modularization-baseline.md`、`scripts/analyze-firstleg-dependencies.mjs`、`scripts/analyze-firstleg-dependencies.test.mjs`、`src/test/resources/architecture/firstleg-slice-dependencies.json`；只约束本服务内部包依赖，不改变部署单元或数据库边界 |
 | 履约任务/分配 | `controller/PlatformFulfillmentAssignmentController.java`、`service/FulfillmentTaskService.java` |
 | 入库单查询/聚合 | `controller/PlatformInboundOrderController.java`、`service/InboundOrderQueryService.java` |
 | 平台测量/OCR | `controller/PlatformInboundMeasurementController.java`、`service/InboundMeasurementService.java`、`service/CartonMeasurementService.java`；手工单箱测量也从该 Controller 与 `CartonMeasurementService` 进入 |
@@ -22,6 +23,7 @@
 | 客户费用查询 | `controller/MerchantInboundBillingController.java`、`service/MerchantInboundBillingService.java` |
 | 客户运营统计/在途柜量 | `customerstatistics/controller/PlatformCustomerTransitStatisticsController.java`、`customerstatistics/service/CustomerTransitStatisticsService.java`；契约见 `src/main/resources/openapi/customer-statistics-v1.yaml` |
 | 费用项目与价格簿 | `controller/PlatformFeeItemController.java`、`PlatformPriceBookController.java`、`MerchantPriceBookController.java` |
+| 价格簿查询内部切片 | `pricebookquery/application/port/in/PriceBookQueryUseCase.java`、`application/PriceBookQueryService.java`、`application/port/out/PriceBookQueryReader.java`、`adapter/out/persistence/PriceBookQueryMapper.java`；查询行模型位于 `application/model/PriceBookQueryRows.java` |
 | 财务费用来源快照 | `controller/InternalFinanceFeeSourceController.java`；入库费用与柜次费用分别按来源 ID、版本向 Finance 提供不可变快照 |
 | 柜次费用明细 | `controller/PlatformContainerFeeDetailController.java`、`service/ContainerFeeDetailService.java`、`dto/ContainerFeeDetailDtos.java`；Admin 消费端见 `../../apps/admin-web/src/modules/loading-lists/api/containerFees.ts` |
 | 财务整柜成本分摊快照 | `loading/controller/InternalFinanceCostSnapshotController.java`、`loading/service/FinanceCostSnapshotService.java` |
@@ -30,7 +32,7 @@
 | PDA 拣货与装柜 | `controller/PlatformLoadingPdaController.java`、`loading/controller/PlatformLoadingDeliveryController.java` |
 | 装柜完成跨区事件 | `service/LoadingCompletedOutboxService.java`、`LoadingCompletedOutboxRelay.java`、`repository/LoadingCompletedOutboxRepository.java`、`mapper/LoadingCartonManifestMapper.java`、`client/EventBridgeClient.java`；从 `fl_inbound_order.destination_type` 冻结 V2 `orders[].destinationType=FBA|OVERSEAS`，OVERSEAS 按最终实装与稳定箱码冻结，FBA 可仅冻结箱数；真实生产验收 `src/test/java/com/baiyue/firstleg/service/TaillegRealProducerAcceptanceTest.java`；事件模型见 `../common-event-contract/AGENTS.md` |
 | 海外卸柜完成事件回写 | 内部入口 `controller/InternalOverseasContainerEventController.java`、消费者 `service/OverseasContainerEventConsumer.java`、Inbox `entity/ContainerEventInboxEntity.java` 与 `mapper/ContainerEventInboxMapper.java`；事件模型见 `../common-event-contract/AGENTS.md` |
-| 三期海运订舱与出仓前船期资料 | `oceanbooking/controller/PlatformOceanBookingController.java`、`oceanbooking/service/OceanBookingService.java`、`portschedule/controller/PlatformPortScheduleController.java`；订舱契约见 `src/main/resources/openapi/ocean-bookings-v1.yaml`，表结构见 `src/main/resources/db/phase3-ocean-booking-schema.sql` |
+| 三期海运订舱、关联候选与出仓前船期资料 | `oceanbooking/controller/PlatformOceanBookingController.java`、`oceanbooking/service/OceanBookingService.java`、`oceanbooking/mapper/OceanBookingMapper.java`、`portschedule/controller/PlatformPortScheduleController.java`；关联候选入口 `/api/platform/v1/ocean-bookings/link-candidates`，订舱契约见 `src/main/resources/openapi/ocean-bookings-v1.yaml`，表结构见 `src/main/resources/db/phase3-ocean-booking-schema.sql` |
 | 四期国内出仓后船节点定时查询 | `outbound/dispatch/service/OutboundDispatchService.java` 在确认出仓事务内幂等创建现有 `CarrierScheduleQuery`；编排与租约 `portschedule/service/CarrierScheduleQueryScheduler.java`，任务/十节点事实/异常事实/不可变 attempt `CarrierScheduleQueryService.java`，平台查询与人工补录入口 `PlatformCarrierScheduleQueryController.java` 的 `/{queryId}/manual-nodes`；停止只由实际 `EMPTY_RETURNED` 节点触发，不提供无节点停止入口；外部船司/轨迹调用经 `integration-service/`；标准见 `../../docs/四期/船节点标准化契约.md` |
 | 船节点跨区交接事件 | `portschedule/service/CarrierScheduleNodeOutboxService.java`；实际节点落库后发布 `FIRST_LEG_CONTAINER_SHIPPING_NODE_RECORDED` V1，复用 `LoadingCompletedOutboxRepository`/Relay 投 Event Bridge；海外消费见 `../lastleg-service/src/main/java/com/baiyue/lastleg/shipping/service/ContainerShippingNodeConsumer.java` |
 | Firstleg 业务单据编号 | `service/FirstlegDocumentNumberGenerator.java`；当前支持 `OB`、`TA`、`CB`、`CAB`、`LP` 前缀，按北京时间每日独立编号；具体业务归属以各调用服务为准 |
@@ -44,7 +46,9 @@
 
 ## 修改约束
 
+- 移动包、拆分端口/适配器或引入新的跨切片依赖时，先核对内部模块化基线并运行 `node --test scripts/analyze-firstleg-dependencies.test.mjs`；确需更新依赖基线时必须说明稳定边界变化，不能把临时循环依赖登记为长期豁免。
 - 平台接口必须校验目标客户、权限、乐观锁、幂等键、历史和审计；商户查询只能使用登录态客户。
+- 价格簿查询消费者依赖 `PriceBookQueryUseCase` 或稳定查询端口，不得反向依赖持久化 Mapper；移动旧查询类时同步更新生产调用、测试、Mock 与 import，避免同一职责在根 `repository/mapper` 和 `pricebookquery/` 双写。
 - 第三方回传必须签名、时间窗、防重放、请求哈希，并绑定订单货物和 File 证据；不得信任外部客户字段。
 - 稳定箱码映射以入库快照和 Order 货物明细为事实；订单审核创建入库单时必须幂等生成，打印接口只复用或补齐同一映射，用户是否下载箱唛不得决定箱码有效性。手工测量、墨家设备和 PDA 扫码统一通过 `InboundCartonLabelService` 校验客户、入库单、货物明细、总箱数/下标和有效批次，不得在测量时临时伪造箱码或接受跨客户、跨入库箱码。
 - 测量审核通过后直接进入 `WAIT_SPLIT`，费用仅作为独立初算和人工维护结果，不得阻塞或回退订单主流程；计费量、单价和附加费调整必须版本化并由服务端重算金额。状态或 DTO 变更时逐个检查 Order/Warehouse/File/Integration 消费者。
@@ -52,6 +56,7 @@
 - 订舱状态固定为 `DRAFT → RELEASED`：草稿允许资料不完整并可替换或删除，放舱时校验完整持久化聚合，放舱后永久只读。创建草稿和放舱都只维护订舱聚合、三类参与方及柜型需求，不创建真实 `containerNo`、货柜行或分配关系；真实货柜只在后续提柜关联时占用已放舱柜型需求。
 - 订舱柜型需求至少一项、最多 20 项，数量必须为正整数，容量和限重必须匹配平台柜型规格。起运仓必须是启用的国内中转仓；物流渠道必须来自该仓当前 ACTIVE 价格版本，服务端保存渠道名称快照，渠道失效时失败关闭。
 - 订舱号统一使用 `OB-yyMMdd-####`，按北京时间创建日每日独立递增且单日最多 9999；不得以实体 ID 拼接生成。放舱不要求真实柜号，也不得为满足放舱校验伪造柜号。
+- 订舱列表 `containerCount` 固定为该订舱全部柜型需求 `quantity` 之和，与真实柜关联/解除无关；关联候选只返回 `RELEASED`、剩余数量大于 0 且 `warehouseId + channelCode + containerType` 精确匹配的需求，由服务端集合查询 ACTIVE 分配量。前端不得扇出详情计算或用已关联柜数覆盖该字段，最终关联命令仍须重验目标货柜可修改性。
 - 四期船节点任务从确认柜子离开国内仓库后启用，必须绑定真实订舱和柜次；十个标准节点、预计/实际时间、异常事实、供应商缺失节点和还柜停止规则统一以 `../../docs/四期/船节点标准化契约.md` 为准。`CarrierScheduleQuery` 的正常业务查询槽位固定为 `Asia/Shanghai` 每日 09:00、12:30、16:00；每分钟任务只扫描已到期 `next_allowed_at`，不是每分钟请求船司。成功、无变化、需人工或永久失败进入下一固定槽位；仅技术性 `RETRYABLE_FAILURE` 在当前槽内按15/30分钟退避，含首次最多3次且不得跨下一槽，实际 `EMPTY_RETURNED` 后停止。错过的正常槽位直接顺延，不在服务恢复时补跑；单轮按受控批次持续领取并受最大任务数保护。租约、调度尝试和内部停止入口不得暴露为平台页面 API，外部失败不得推进业务节点，不得在三期另建查询任务。
 - 海外卸柜完成事件只接受 `OVERSEAS -> CN` 的 `OVERSEAS_CONTAINER_UNLOADED` V1，并通过内部服务令牌进入。消费者必须校验信封、Payload 哈希、来源货柜和时间顺序，以 event ID + Payload 哈希幂等，使用事件聚合版本阻止乱序覆盖；预计报空时间固定按卸柜照片上传时间加两天计算，实际报空时间可为空。
 - Firstleg 只拥有业务费用及履约事实；Finance 拥有费用入池、账期、账单、收款、成本分摊结果和财务状态。修改费用来源版本、发布条件、柜次归属或体积快照时同步检查 `../finance/src/main/java/com/baiyue/finance/client/FirstlegFeeSourceClient.java`、同目录 `FirstlegCostSnapshotClient.java` 及双方契约测试，不在 Firstleg 复制财务状态机。
diff --git a/firstleg/docs/firstleg-internal-modularization-baseline.md b/firstleg/docs/firstleg-internal-modularization-baseline.md
index 7dbecb0d3..df1b0fc9e 100644
--- a/firstleg/docs/firstleg-internal-modularization-baseline.md
+++ b/firstleg/docs/firstleg-internal-modularization-baseline.md
@@ -1,4 +1,4 @@
-# Firstleg 内部模块化基线与首切片方案
+# Firstleg 内部模块化基线与切片实施记录
 
 ## 1. 范围与生成方式
 
@@ -198,3 +198,53 @@ mvn -pl firstleg -am -Dtest=CustomerTransitStatisticsServiceTest,CustomerTransit
 - 根 Mapper 扫描只把旧精确包替换为新精确包，没有扩大扫描范围或增加兼容 Bean。
 - 验证结果：Node 合同 3/3；`test-compile` 成功；客户统计加根扫描定向测试 7/7；`mvn -pl firstleg -am test` 共 854 个测试，0 失败、0 错误、3 跳过，构建成功。
 - 首次并发执行 `test-compile` 时，其他专项同时写入共享 `target/classes` 导致若干无关 class 文件瞬时缺失；源符号核对正常，独立重跑 `test-compile` 与完整测试均成功。
+
+## 12. 第二切片：价格簿只读查询
+
+### 12.1 选择证据
+
+第二切片选择 `pricebook-query`，而没有选择报关、拖车、出仓或船节点：
+
+- 原实现只有 `PriceBookQueryRows`、`PriceBookQueryRepository`、`PriceBookQueryMapper` 三个核心文件，全部为只读查询，不承载 Controller、权限或状态机。
+- `PriceBookQueryMapper -> repository.PriceBookQueryRows` 是主源码唯一 `mapper -> repository` 反向依赖，也是物理包 SCC `mapper <-> repository` 的唯一成因。
+- 报关和拖车均涉及 MultipartFile、Feign、装柜或出仓门禁；出仓和船节点属于当前业务热点，风险高于只读价格簿查询。
+- 本切片不触碰 `LoadingPickService`、客户尺寸初始化、IAM 解环、POM、CI、AGENTS、SQL 或部署配置。
+
+### 12.2 目标结构与依赖方向
+
+```text
+pricebookquery/
+  application/
+    PriceBookQueryService.java
+    model/PriceBookQueryRows.java
+    port/in/PriceBookQueryUseCase.java
+    port/out/PriceBookQueryReader.java
+  adapter/out/persistence/
+    PriceBookQueryMapper.java
+```
+
+依赖由“多个业务 Service -> 全局 Repository -> 全局 Mapper -> Repository Rows”改为：
+
+```text
+业务消费者 -> PriceBookQueryUseCase
+PriceBookQueryService -> PriceBookQueryReader
+PriceBookQueryMapper -> PriceBookQueryReader + PriceBookQueryRows
+```
+
+消费者只能访问 In Port 和只读模型；application 不依赖 Spring MVC、MyBatis、MyBatis-Plus 或其他 Firstleg 切片。Mapper 的七段 `@Select` SQL 文本和方法参数保持不变。
+
+### 12.3 依赖图变化
+
+- 主源码由 430 类/949 条内部依赖/67 包变为 432 类/953 条内部依赖/72 包；新增项为 In Port、Out Port 和 Application Service，原 Repository 被删除。
+- 物理包多节点 SCC 从 1 个降为 0 个。
+- `pricebook-query` 是零出向边的叶子，不进入逻辑 SCC；显式入向仅为订舱、测量计价、分柜装柜三个消费者切片。
+- 原 `split-loading -> measurement-pricing` 两条价格簿引用被替换为显式 `split-loading -> pricebook-query`；Node 合同没有简单放宽旧边。
+- 既有 88 条跨切片 Entity/DTO 泄漏和 31 条 Mapper 泄漏均未增加。
+
+### 12.4 棘轮与回滚边界
+
+- Node 合同锁定五个目标类位置、application 依赖禁令、零出向/三类入向和消费者只能访问 In Port/模型，并断言物理包 SCC 为空。
+- `PriceBookQueryArchitectureTest` 用 ArchUnit 执行同等边界，持久化 Mapper 必须实现 Out Port。
+- 回滚仅恢复原三文件及消费者类型引用；不涉及 URI、权限、JSON、SQL、表结构、业务状态或环境配置。
+- 只读模型仍保留原 Lombok 可变 Bean 形态以维持 MyBatis 映射行为；本轮不顺带改造成不可变领域对象。
+- 验证结果：七段 `@Select` SQL 文本逐块完全一致；Node 合同 5/5；`test-compile` 成功；价格簿、ArchUnit、根扫描及三个消费者切片定向测试 78/78；Firstleg 聚合全量 878 个测试，0 失败、0 错误、3 跳过，构建成功。
diff --git a/firstleg/scripts/analyze-firstleg-dependencies.mjs b/firstleg/scripts/analyze-firstleg-dependencies.mjs
index 5b252d7a8..302d466c7 100644
--- a/firstleg/scripts/analyze-firstleg-dependencies.mjs
+++ b/firstleg/scripts/analyze-firstleg-dependencies.mjs
@@ -13,6 +13,7 @@ const internalPrefix = 'com.baiyue.firstleg.';
 
 const sliceRules = [
   ['customer-statistics', /(?:^|\.)(?:customerstatistics)(?:\.|$)/],
+  ['pricebook-query', /(?:^|\.)(?:pricebookquery)(?:\.|$)/],
   ['finance-integration', /(?:InternalFinance|FinanceFeeSource|FinanceCostSnapshot|FeePaymentVoucher|FeePaymentSnapshot|ContainerFeeSourceSnapshot)/],
   ['shipping-nodes', /(?:CarrierScheduleQuery|CarrierScheduleNode|CarrierScheduleAdapter|CarrierScheduleAttempt|CarrierScheduleException)/],
   ['booking-customs-trucking', /(?:^|\.)(?:oceanbooking|customs)(?:\.|$)|(?:TruckAppointment|WarehouseSupplier|PortSchedule|DispatchGate)/],
@@ -273,8 +274,9 @@ function checkContract(report, contractPath) {
     if (!actualClass) violations.push(`required class missing: ${fqcn}`);
     else if (actualClass.file !== expectedFile) violations.push(`class location changed: ${fqcn} (${actualClass.file})`);
   }
-  const applicationRule = contract.applicationDependencyRule;
-  if (applicationRule) {
+  const applicationRules = contract.applicationDependencyRules
+    ?? (contract.applicationDependencyRule ? [contract.applicationDependencyRule] : []);
+  for (const applicationRule of applicationRules) {
     const applicationClasses = report.classes.filter(entry => entry.packageName.startsWith(applicationRule.packagePrefix));
     for (const entry of applicationClasses) {
       for (const imported of entry.imports) {
@@ -291,6 +293,15 @@ function checkContract(report, contractPath) {
       }
     }
   }
+  for (const exposureRule of contract.sliceExposureRules ?? []) {
+    for (const edge of report.classDependencies) {
+      if (!edge.source.startsWith(exposureRule.slicePrefix)
+          && edge.target.startsWith(exposureRule.slicePrefix)
+          && !(exposureRule.allowedTargetPrefixes ?? []).some(prefix => edge.target.startsWith(prefix))) {
+        violations.push(`forbidden slice implementation dependency: ${edge.source} -> ${edge.target}`);
+      }
+    }
+  }
   for (const [slice, rule] of Object.entries(contract.sliceSpecificRules ?? {})) {
     const outgoing = report.sliceEdges.filter(edge => edge.source === slice).map(edge => edge.target).sort();
     const incoming = report.sliceEdges.filter(edge => edge.target === slice).map(edge => edge.source).sort();
diff --git a/firstleg/scripts/analyze-firstleg-dependencies.test.mjs b/firstleg/scripts/analyze-firstleg-dependencies.test.mjs
index 9bcb61d64..101c2f807 100644
--- a/firstleg/scripts/analyze-firstleg-dependencies.test.mjs
+++ b/firstleg/scripts/analyze-firstleg-dependencies.test.mjs
@@ -52,3 +52,43 @@ test('customer statistics application layer only depends inward', () => {
     && edge.target.startsWith('com.baiyue.firstleg.') && !edge.target.startsWith(prefix));
   assert.deepEqual(outwardDependencies, []);
 });
+
+test('price book query is a leaf slice and removes the package cycle', () => {
+  const report = analyze();
+  const classes = report.classes.filter(entry => entry.slice === 'pricebook-query');
+  assert.deepEqual(classes.map(entry => entry.fqcn).sort(), [
+    'com.baiyue.firstleg.pricebookquery.adapter.out.persistence.PriceBookQueryMapper',
+    'com.baiyue.firstleg.pricebookquery.application.PriceBookQueryService',
+    'com.baiyue.firstleg.pricebookquery.application.model.PriceBookQueryRows',
+    'com.baiyue.firstleg.pricebookquery.application.port.in.PriceBookQueryUseCase',
+    'com.baiyue.firstleg.pricebookquery.application.port.out.PriceBookQueryReader',
+  ]);
+  assert.deepEqual(report.sliceEdges.filter(edge => edge.source === 'pricebook-query'), []);
+  assert.deepEqual(report.sliceEdges.filter(edge => edge.target === 'pricebook-query')
+    .map(edge => edge.source).sort(), ['booking-customs-trucking', 'measurement-pricing', 'split-loading']);
+  assert.equal(report.sliceSccs.some(component => component.includes('pricebook-query')), false);
+  assert.deepEqual(report.packageSccs, []);
+});
+
+test('price book query application and consumers respect ports', () => {
+  const report = analyze();
+  const prefix = 'com.baiyue.firstleg.pricebookquery.application';
+  const applicationClasses = report.classes.filter(entry => entry.packageName.startsWith(prefix));
+  assert.equal(applicationClasses.length, 4);
+  for (const entry of applicationClasses) {
+    assert.equal(entry.imports.some(imported => imported.startsWith('org.springframework.web')), false);
+    assert.equal(entry.imports.some(imported => imported.startsWith('org.apache.ibatis')), false);
+    assert.equal(entry.imports.some(imported => imported.startsWith('com.baomidou.mybatisplus')), false);
+  }
+  const outwardDependencies = report.classDependencies.filter(edge => edge.source.startsWith(prefix)
+    && edge.target.startsWith('com.baiyue.firstleg.') && !edge.target.startsWith(prefix));
+  assert.deepEqual(outwardDependencies, []);
+  const allowedTargets = [
+    'com.baiyue.firstleg.pricebookquery.application.model.',
+    'com.baiyue.firstleg.pricebookquery.application.port.in.',
+  ];
+  const implementationLeaks = report.classDependencies.filter(edge => !edge.source.startsWith('com.baiyue.firstleg.pricebookquery.')
+    && edge.target.startsWith('com.baiyue.firstleg.pricebookquery.')
+    && !allowedTargets.some(prefixValue => edge.target.startsWith(prefixValue)));
+  assert.deepEqual(implementationLeaks, []);
+});
diff --git a/firstleg/src/main/java/com/baiyue/firstleg/BaiyueFirstlegApplication.java b/firstleg/src/main/java/com/baiyue/firstleg/BaiyueFirstlegApplication.java
index 8c071e0be..595ec1411 100644
--- a/firstleg/src/main/java/com/baiyue/firstleg/BaiyueFirstlegApplication.java
+++ b/firstleg/src/main/java/com/baiyue/firstleg/BaiyueFirstlegApplication.java
@@ -18,7 +18,8 @@ import org.springframework.scheduling.annotation.EnableScheduling;
         "com.baiyue.firstleg.outbound.dispatch.mapper",
         "com.baiyue.firstleg.portschedule.mapper",
         "com.baiyue.firstleg.customs.mapper",
-        "com.baiyue.firstleg.customerstatistics.adapter.out.persistence"
+        "com.baiyue.firstleg.customerstatistics.adapter.out.persistence",
+        "com.baiyue.firstleg.pricebookquery.adapter.out.persistence"
 })
 @EnableFeignClients(basePackages = "com.baiyue.firstleg")
 @EnableScheduling
diff --git a/firstleg/src/main/java/com/baiyue/firstleg/controller/PlatformContainerController.java b/firstleg/src/main/java/com/baiyue/firstleg/controller/PlatformContainerController.java
index 0decb1063..cfbb44d48 100644
--- a/firstleg/src/main/java/com/baiyue/firstleg/controller/PlatformContainerController.java
+++ b/firstleg/src/main/java/com/baiyue/firstleg/controller/PlatformContainerController.java
@@ -128,6 +128,21 @@ public class PlatformContainerController {
         return ApiResponse.success(loadingLists.containerClearance(id));
     }
 
+    @GetMapping("/{id}/clearance/document/{fileId}/download")
+    @PreAuthorize("hasAuthority('platform:firstleg:customs:manage')")
+    @Operation(summary = "下载货柜目的港清关附件", description = "校验当前清关附件和 File 业务归属，完成态仍可下载。")
+    public ResponseEntity<byte[]> downloadClearance(
+        @AuthenticationPrincipal AuthenticatedUser user, @PathVariable @Positive long id,
+        @PathVariable @Positive long fileId) {
+        FirstlegScopeGuard.platform(user);
+        var download = loadingLists.downloadContainerClearance(id, fileId);
+        return ResponseEntity.ok().cacheControl(CacheControl.noStore())
+            .header(HttpHeaders.CONTENT_DISPOSITION, org.springframework.http.ContentDisposition.attachment()
+                .filename(download.fileName(), StandardCharsets.UTF_8).build().toString())
+            .contentType(download.contentType()).contentLength(download.content().length)
+            .body(download.content());
+    }
+
     @PostMapping("/{id}/clearance/document")
     @PreAuthorize("hasAuthority('platform:firstleg:customs:manage')")
     @Operation(summary = "上传或替换货柜目的港清关资料")
diff --git a/firstleg/src/main/java/com/baiyue/firstleg/controller/PlatformLoadingListController.java b/firstleg/src/main/java/com/baiyue/firstleg/controller/PlatformLoadingListController.java
index 153ae3d48..803be7cda 100644
--- a/firstleg/src/main/java/com/baiyue/firstleg/controller/PlatformLoadingListController.java
+++ b/firstleg/src/main/java/com/baiyue/firstleg/controller/PlatformLoadingListController.java
@@ -25,6 +25,10 @@ import jakarta.validation.constraints.Min;
 import jakarta.validation.constraints.Positive;
 import jakarta.validation.constraints.Size;
 import org.springframework.http.MediaType;
+import org.springframework.http.CacheControl;
+import org.springframework.http.ContentDisposition;
+import org.springframework.http.HttpHeaders;
+import org.springframework.http.ResponseEntity;
 import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.security.core.annotation.AuthenticationPrincipal;
 import org.springframework.validation.annotation.Validated;
@@ -40,6 +44,8 @@ import org.springframework.web.bind.annotation.RestController;
 import org.springframework.web.bind.annotation.RequestPart;
 import org.springframework.web.multipart.MultipartFile;
 
+import java.nio.charset.StandardCharsets;
+
 /** 基于同一装柜计划聚合提供平台预装清单和已确认装柜清单。 */
 @Tag(name = "平台预装与装柜清单", description = "预装单向推进和已确认装柜清单只读查询")
 @Validated
@@ -124,6 +130,21 @@ public class PlatformLoadingListController {
         return ApiResponse.success(service.loadingDeclaration(planId, warehouseId));
     }
 
+    @Operation(summary = "下载装柜清单出口报关附件", description = "完成态仍可下载；服务端校验装柜计划、仓库、当前附件及 File 业务归属。")
+    @GetMapping("/loading-lists/{planId}/customs/document/{fileId}/download")
+    @PreAuthorize("hasAuthority('platform:firstleg:loading-list:list')")
+    public ResponseEntity<byte[]> downloadDeclaration(
+        @AuthenticationPrincipal AuthenticatedUser user, @PathVariable @Positive long planId,
+        @PathVariable @Positive long fileId, @RequestParam @Positive long warehouseId) {
+        FirstlegScopeGuard.platform(user);
+        var download = service.downloadLoadingDeclaration(planId, warehouseId, fileId);
+        return ResponseEntity.ok().cacheControl(CacheControl.noStore())
+            .header(HttpHeaders.CONTENT_DISPOSITION, ContentDisposition.attachment()
+                .filename(download.fileName(), StandardCharsets.UTF_8).build().toString())
+            .contentType(download.contentType()).contentLength(download.content().length)
+            .body(download.content());
+    }
+
     @Operation(summary = "上传或替换装柜清单出口报关文档")
     @PostMapping("/loading-lists/{planId}/customs/document")
     @PreAuthorize("hasAuthority('platform:firstleg:customs:manage')")
diff --git a/firstleg/src/main/java/com/baiyue/firstleg/customs/mapper/CustomsCaseMapper.java b/firstleg/src/main/java/com/baiyue/firstleg/customs/mapper/CustomsCaseMapper.java
index 8f12886f8..68a968aa4 100644
--- a/firstleg/src/main/java/com/baiyue/firstleg/customs/mapper/CustomsCaseMapper.java
+++ b/firstleg/src/main/java/com/baiyue/firstleg/customs/mapper/CustomsCaseMapper.java
@@ -2,4 +2,10 @@ package com.baiyue.firstleg.customs.mapper;
 import com.baomidou.mybatisplus.core.mapper.BaseMapper;
 import com.baiyue.firstleg.customs.entity.CustomsCaseEntity;
 import org.apache.ibatis.annotations.Mapper;
-@Mapper public interface CustomsCaseMapper extends BaseMapper<CustomsCaseEntity> {}
+import org.apache.ibatis.annotations.Param;
+import org.apache.ibatis.annotations.Select;
+@Mapper public interface CustomsCaseMapper extends BaseMapper<CustomsCaseEntity> {
+    @Select("SELECT COUNT(*) FROM fl_container_document WHERE container_booking_id=#{containerBookingId} "
+        + "AND document_type='CUSTOMS_DECLARATION' AND completed_at IS NOT NULL")
+    int completedLoadingDeclaration(@Param("containerBookingId") long containerBookingId);
+}
diff --git a/firstleg/src/main/java/com/baiyue/firstleg/customs/repository/CustomsRepository.java b/firstleg/src/main/java/com/baiyue/firstleg/customs/repository/CustomsRepository.java
index f33063e95..3d8a35e42 100644
--- a/firstleg/src/main/java/com/baiyue/firstleg/customs/repository/CustomsRepository.java
+++ b/firstleg/src/main/java/com/baiyue/firstleg/customs/repository/CustomsRepository.java
@@ -81,6 +81,9 @@ public class CustomsRepository {
             .eq(CustomsCaseEntity::getContainerBookingId, containerBookingId)
             .orderByDesc(CustomsCaseEntity::getUpdatedAt).last("LIMIT 1"));
     }
+    public boolean loadingDeclarationCompleted(long containerBookingId) {
+        return cases.completedLoadingDeclaration(containerBookingId) == 1;
+    }
     public boolean containerCarriesOrder(long containerId, long tenantId, long orderId) {
         LoadingPlanEntity plan = loadingPlans.selectOne(new LambdaQueryWrapper<LoadingPlanEntity>()
             .eq(LoadingPlanEntity::getContainerBookingId, containerId));
diff --git a/firstleg/src/main/java/com/baiyue/firstleg/customs/service/CustomsDispatchGateContributor.java b/firstleg/src/main/java/com/baiyue/firstleg/customs/service/CustomsDispatchGateContributor.java
index 94eb4cc89..61a048f5a 100644
--- a/firstleg/src/main/java/com/baiyue/firstleg/customs/service/CustomsDispatchGateContributor.java
+++ b/firstleg/src/main/java/com/baiyue/firstleg/customs/service/CustomsDispatchGateContributor.java
@@ -1,6 +1,5 @@
 package com.baiyue.firstleg.customs.service;
 
-import com.baiyue.firstleg.customs.entity.CustomsCaseEntity;
 import com.baiyue.firstleg.customs.repository.CustomsRepository;
 import com.baiyue.firstleg.outbound.dispatch.dto.OutboundDispatchDtos.GateItem;
 import com.baiyue.firstleg.outbound.dispatch.gate.OutboundDispatchGateContributor;
@@ -18,13 +17,11 @@ public class CustomsDispatchGateContributor implements OutboundDispatchGateContr
         if (context.tenantId() <= 0 || context.customerId() <= 0) {
             return gate(false, "INVALID_CUSTOMER_SCOPE");
         }
-        CustomsCaseEntity value = repository.gateCase(context.tenantId(), context.orderId(),
-            context.inboundId(), context.containerBookingId());
-        if (value == null) return gate(false, "MISSING");
-        return gate("CLEARANCE_COMPLETED".equals(value.getStatus()), value.getStatus());
+        boolean completed = repository.loadingDeclarationCompleted(context.containerBookingId());
+        return gate(completed, completed ? "COMPLETED" : "MISSING");
     }
 
     private static GateItem gate(boolean passed, String actual) {
-        return new GateItem("CUSTOMS_CLEARANCE", "报关完成", passed, actual, "CLEARANCE_COMPLETED");
+        return new GateItem("CUSTOMS_CLEARANCE", "报关完成", passed, actual, "COMPLETED");
     }
 }
diff --git a/firstleg/src/main/java/com/baiyue/firstleg/dto/InboundMeasurementRequests.java b/firstleg/src/main/java/com/baiyue/firstleg/dto/InboundMeasurementRequests.java
index 260ac1924..6f899c510 100644
--- a/firstleg/src/main/java/com/baiyue/firstleg/dto/InboundMeasurementRequests.java
+++ b/firstleg/src/main/java/com/baiyue/firstleg/dto/InboundMeasurementRequests.java
@@ -41,9 +41,15 @@ public final class InboundMeasurementRequests {
         @NotBlank @Size(max = 32) String itemNo,
         @NotBlank @Size(max = 64) String boxSpecification,
         @NotNull @Positive @Max(1000000) Integer packageCount,
-        @NotNull @DecimalMin("0.001") @Digits(integer = 9, fraction = 3) BigDecimal lengthCm,
-        @NotNull @DecimalMin("0.001") @Digits(integer = 9, fraction = 3) BigDecimal widthCm,
-        @NotNull @DecimalMin("0.001") @Digits(integer = 9, fraction = 3) BigDecimal heightCm,
+        @NotNull @DecimalMin(value = "0.001", message = "箱规长度必须大于等于 0.001 cm")
+        @DecimalMax(value = "999999999.999", message = "箱规长度不能超过 999,999,999.999 cm")
+        @Digits(integer = 9, fraction = 3, message = "箱规长度最多 9 位整数、3 位小数") BigDecimal lengthCm,
+        @NotNull @DecimalMin(value = "0.001", message = "箱规宽度必须大于等于 0.001 cm")
+        @DecimalMax(value = "999999999.999", message = "箱规宽度不能超过 999,999,999.999 cm")
+        @Digits(integer = 9, fraction = 3, message = "箱规宽度最多 9 位整数、3 位小数") BigDecimal widthCm,
+        @NotNull @DecimalMin(value = "0.001", message = "箱规高度必须大于等于 0.001 cm")
+        @DecimalMax(value = "999999999.999", message = "箱规高度不能超过 999,999,999.999 cm")
+        @Digits(integer = 9, fraction = 3, message = "箱规高度最多 9 位整数、3 位小数") BigDecimal heightCm,
         @Positive Long intelligentImageFileId,
         @Size(max = 500) String overLimitWarning,
         @DecimalMin("0.000") @Digits(integer = 9, fraction = 3) BigDecimal outerLengthCm,
diff --git a/firstleg/src/main/java/com/baiyue/firstleg/mapper/ContainerBookingMapper.java b/firstleg/src/main/java/com/baiyue/firstleg/mapper/ContainerBookingMapper.java
index f5e905ab8..62599bc9f 100644
--- a/firstleg/src/main/java/com/baiyue/firstleg/mapper/ContainerBookingMapper.java
+++ b/firstleg/src/main/java/com/baiyue/firstleg/mapper/ContainerBookingMapper.java
@@ -171,8 +171,6 @@ public interface ContainerBookingMapper extends BaseMapper<ContainerBookingEntit
     @Select("SELECT COUNT(*) FROM fl_loading_pick_task t JOIN fl_loading_plan p ON p.id=t.loading_plan_id WHERE p.container_booking_id=#{id}") int hasPickTask(@Param("id") long id);
     @Select("SELECT COUNT(*) FROM fl_loading_evidence e JOIN fl_loading_plan_item i ON i.inbound_id=e.inbound_id AND i.account_id=e.tenant_id JOIN fl_loading_plan p ON p.id=i.loading_plan_id WHERE p.container_booking_id=#{id} AND i.deleted=0 AND e.status='ACTIVE'") int hasEvidence(@Param("id") long id);
     @Select("SELECT COUNT(*) FROM fl_container_document WHERE container_booking_id=#{id}") int hasDocuments(@Param("id") long id);
-    @Select("SELECT COUNT(*) FROM fl_loading_plan_item i JOIN fl_loading_plan p ON p.id=i.loading_plan_id WHERE p.container_booking_id=#{id} AND i.deleted=0 AND i.account_id<>#{customerId}") int hasMismatchedCustomerItems(@Param("id") long id, @Param("customerId") long customerId);
-
     @Update("""
         UPDATE fl_container_booking SET container_no=#{containerNo}, voyage_no=#{voyageNo},
           updated_by=#{operatorId}, updated_by_name=#{operatorName},
diff --git a/firstleg/src/main/java/com/baiyue/firstleg/mapper/ContainerOverviewMapper.java b/firstleg/src/main/java/com/baiyue/firstleg/mapper/ContainerOverviewMapper.java
index 2614509e7..f19381c0c 100644
--- a/firstleg/src/main/java/com/baiyue/firstleg/mapper/ContainerOverviewMapper.java
+++ b/firstleg/src/main/java/com/baiyue/firstleg/mapper/ContainerOverviewMapper.java
@@ -4,7 +4,7 @@ import com.baiyue.firstleg.entity.ContainerTransportHistoryEntity;
 import org.apache.ibatis.annotations.*;
 import java.util.List;
 @Mapper public interface ContainerOverviewMapper {
- @Select("SELECT * FROM fl_container_document WHERE container_booking_id=#{id} AND document_type IN ('DELIVERY_ORDER','PICKUP_ORDER') ORDER BY document_type") List<ContainerDocumentEntity> documents(@Param("id") long id);
+ @Select("SELECT * FROM fl_container_document WHERE container_booking_id=#{id} AND document_type IN ('DESTINATION_CLEARANCE','CUSTOMS_DECLARATION','DELIVERY_ORDER','PICKUP_ORDER') ORDER BY document_type") List<ContainerDocumentEntity> documents(@Param("id") long id);
  @Select("SELECT * FROM fl_container_transport_history WHERE container_booking_id=#{id} ORDER BY created_at,id") List<ContainerTransportHistoryEntity> transport(@Param("id") long id);
  @Select("SELECT id,action,reason,operator_id operatorId,operator_name operatorName,occurred_at occurredAt,request_hash requestHash FROM fl_container_exception_history WHERE container_booking_id=#{id} ORDER BY occurred_at,id") List<ExceptionRow> exceptions(@Param("id") long id);
  @Insert("INSERT INTO fl_container_exception_history(id,container_booking_id,action,reason,operator_id,operator_name,operation_id,request_hash,occurred_at) VALUES(#{id},#{bookingId},#{action},#{reason},#{operatorId},#{operatorName},#{operationId},#{requestHash},CURRENT_TIMESTAMP(3))") int insertException(@Param("id") long id,@Param("bookingId") long bookingId,@Param("action") String action,@Param("reason") String reason,@Param("operatorId") long operatorId,@Param("operatorName") String operatorName,@Param("operationId") String operationId,@Param("requestHash") String requestHash);
diff --git a/firstleg/src/main/java/com/baiyue/firstleg/mapper/LoadingCompletedEventMapper.java b/firstleg/src/main/java/com/baiyue/firstleg/mapper/LoadingCompletedEventMapper.java
index a5032b3d4..691cd03d3 100644
--- a/firstleg/src/main/java/com/baiyue/firstleg/mapper/LoadingCompletedEventMapper.java
+++ b/firstleg/src/main/java/com/baiyue/firstleg/mapper/LoadingCompletedEventMapper.java
@@ -29,6 +29,14 @@ public interface LoadingCompletedEventMapper {
           FROM fl_loading_plan p
           JOIN fl_container_booking b ON b.id = p.container_booking_id
           JOIN fl_loading_plan_item i ON i.loading_plan_id = p.id AND i.deleted = 0
+          JOIN fl_loading_pick_item actual_pick
+            ON actual_pick.loading_plan_item_id = i.id
+           AND actual_pick.item_status IN ('PICKED','PARTIAL')
+           AND actual_pick.picked_package_count > 0
+           AND actual_pick.picked_package_count = i.package_count
+          JOIN fl_loading_pick_task actual_task
+            ON actual_task.id = actual_pick.pick_task_id
+           AND actual_task.loading_plan_id = p.id
           JOIN fl_inbound_order o ON o.id = i.inbound_id AND o.tenant_id = i.account_id AND o.deleted = 0
           LEFT JOIN fl_inbound_order root_order ON root_order.id = COALESCE(o.root_inbound_id, o.id)
          WHERE p.id = #{planId} AND p.plan_status = 'COMPLETED'
@@ -46,12 +54,20 @@ public interface LoadingCompletedEventMapper {
                i.product_name_zh, i.package_count, i.product_quantity,
                label.box_code
           FROM fl_loading_plan_item i
+          JOIN fl_loading_pick_item actual_pick
+            ON actual_pick.loading_plan_item_id = i.id
+           AND actual_pick.item_status IN ('PICKED','PARTIAL')
+           AND actual_pick.picked_package_count > 0
+           AND actual_pick.picked_package_count = i.package_count
+          JOIN fl_loading_pick_task actual_task
+            ON actual_task.id = actual_pick.pick_task_id
+           AND actual_task.loading_plan_id = #{planId}
           JOIN fl_inbound_pallet_allocation a
             ON a.tenant_id = i.account_id AND a.inbound_id = i.inbound_id
            AND a.allocation_status IN ('CONFIRMED','TRANSFERRED','RELEASED')
            AND a.picked_package_count > 0
           LEFT JOIN fl_inbound_carton_label label
-            ON label.tenant_id = i.account_id AND label.inbound_id = i.inbound_id
+            ON label.tenant_id = i.account_id
            AND label.inbound_detail_id = i.inbound_detail_id AND label.batch_status = 'ACTIVE'
          WHERE i.loading_plan_id = #{planId} AND i.deleted = 0
          ORDER BY i.account_id, i.inbound_id, a.allocation_no,
diff --git a/firstleg/src/main/java/com/baiyue/firstleg/oceanbooking/controller/PlatformOceanBookingController.java b/firstleg/src/main/java/com/baiyue/firstleg/oceanbooking/controller/PlatformOceanBookingController.java
index a6ed9d70d..486fb960e 100644
--- a/firstleg/src/main/java/com/baiyue/firstleg/oceanbooking/controller/PlatformOceanBookingController.java
+++ b/firstleg/src/main/java/com/baiyue/firstleg/oceanbooking/controller/PlatformOceanBookingController.java
@@ -27,6 +27,11 @@ public class PlatformOceanBookingController {
 
     @GetMapping @PreAuthorize("hasAuthority('platform:firstleg:ocean-booking:list')")
     public ApiResponse<PageResult<OceanBookingEntity>> page(@AuthenticationPrincipal AuthenticatedUser user, @Valid Query query) { FirstlegScopeGuard.platform(user); return ApiResponse.success(service.page(query)); }
+    @GetMapping("/link-candidates") @PreAuthorize("hasAuthority('platform:firstleg:ocean-booking:list')")
+    public ApiResponse<PageResult<LinkCandidate>> linkCandidates(
+        @AuthenticationPrincipal AuthenticatedUser user, @Valid LinkCandidateQuery query) {
+        FirstlegScopeGuard.platform(user); return ApiResponse.success(service.linkCandidates(query));
+    }
     @GetMapping("/channels") @PreAuthorize("hasAuthority('platform:firstleg:ocean-booking:list')")
     public ApiResponse<List<ChannelOption>> channels(@AuthenticationPrincipal AuthenticatedUser user,
                                                       @RequestParam long originWarehouseId) {
diff --git a/firstleg/src/main/java/com/baiyue/firstleg/oceanbooking/dto/OceanBookingDtos.java b/firstleg/src/main/java/com/baiyue/firstleg/oceanbooking/dto/OceanBookingDtos.java
index 044d6b76f..6d049a277 100644
--- a/firstleg/src/main/java/com/baiyue/firstleg/oceanbooking/dto/OceanBookingDtos.java
+++ b/firstleg/src/main/java/com/baiyue/firstleg/oceanbooking/dto/OceanBookingDtos.java
@@ -26,6 +26,22 @@ public final class OceanBookingDtos {
         public Query { if (page == 0) page = 1; if (size == 0) size = 20; }
     }
 
+    public record LinkCandidateQuery(@NotNull @Positive Long warehouseId,
+                                     @NotBlank @Size(max = 64) String channelCode,
+                                     @NotBlank @Size(max = 32) String containerType,
+                                     @Min(1) Long page,
+                                     @Min(1) @Max(200) Long size) {
+        public LinkCandidateQuery {
+            if (page == null) page = 1L;
+            if (size == null) size = 20L;
+        }
+    }
+
+    public record LinkCandidate(Long oceanBookingId, String bookingNo, Long requirementId,
+                                String containerType, BigDecimal capacityCbm, BigDecimal maxWeightKg,
+                                int requiredQuantity, long allocatedQuantity, long remainingQuantity,
+                                String customerName, String warehouseName, String channelName) {}
+
     public record PartyRequest(@NotBlank @Size(max = 24) String partyType,
                                @NotBlank @Size(max = 255) String partyName,
                                @Size(max = 1000) String address,
@@ -44,6 +60,7 @@ public final class OceanBookingDtos {
                             @Size(max = 128) String billOfLadingNo,
                             @Positive Long shippingCompanyId,
                             @Size(max = 128) String shippingCompanyName,
+                            @Size(max = 16) String carrierCode,
                             @Positive Long bookingAgentId,
                             @Size(max = 128) String bookingAgentName,
                             @Size(max = 128) String vesselName,
diff --git a/firstleg/src/main/java/com/baiyue/firstleg/oceanbooking/entity/OceanBookingEntity.java b/firstleg/src/main/java/com/baiyue/firstleg/oceanbooking/entity/OceanBookingEntity.java
index f7cc765f5..4e79948fd 100644
--- a/firstleg/src/main/java/com/baiyue/firstleg/oceanbooking/entity/OceanBookingEntity.java
+++ b/firstleg/src/main/java/com/baiyue/firstleg/oceanbooking/entity/OceanBookingEntity.java
@@ -27,6 +27,7 @@ public class OceanBookingEntity {
     private String billOfLadingNo;
     private Long shippingCompanyId;
     private String shippingCompanyName;
+    private String carrierCode;
     private Long bookingAgentId;
     private String bookingAgentName;
     private String vesselName;
diff --git a/firstleg/src/main/java/com/baiyue/firstleg/oceanbooking/mapper/OceanBookingContainerAllocationMapper.java b/firstleg/src/main/java/com/baiyue/firstleg/oceanbooking/mapper/OceanBookingContainerAllocationMapper.java
index cca20bf30..77b31e191 100644
--- a/firstleg/src/main/java/com/baiyue/firstleg/oceanbooking/mapper/OceanBookingContainerAllocationMapper.java
+++ b/firstleg/src/main/java/com/baiyue/firstleg/oceanbooking/mapper/OceanBookingContainerAllocationMapper.java
@@ -3,8 +3,21 @@ import com.baomidou.mybatisplus.core.mapper.BaseMapper;
 import com.baiyue.firstleg.oceanbooking.entity.OceanBookingContainerAllocationEntity;
 import org.apache.ibatis.annotations.Mapper;
 import org.apache.ibatis.annotations.Param;
+import org.apache.ibatis.annotations.Select;
 import org.apache.ibatis.annotations.Update;
 @Mapper public interface OceanBookingContainerAllocationMapper extends BaseMapper<OceanBookingContainerAllocationEntity> {
     @Update("UPDATE fl_ocean_booking_container_allocation SET container_booking_id=#{targetId} WHERE container_booking_id=#{sourceId}")
     int reassign(@Param("sourceId") long sourceId, @Param("targetId") long targetId);
+
+    @Select("""
+        SELECT COUNT(*) FROM fl_ocean_booking_container_allocation allocation
+        JOIN fl_container_booking container ON container.id=allocation.container_booking_id
+          AND container.record_status='ACTIVE'
+          AND container.ocean_booking_id=allocation.ocean_booking_id
+          AND container.ocean_booking_requirement_id=allocation.requirement_id
+        WHERE allocation.ocean_booking_id=#{oceanBookingId}
+          AND allocation.requirement_id=#{requirementId}
+        """)
+    long countActiveLinked(@Param("oceanBookingId") long oceanBookingId,
+                           @Param("requirementId") long requirementId);
 }
diff --git a/firstleg/src/main/java/com/baiyue/firstleg/oceanbooking/mapper/OceanBookingMapper.java b/firstleg/src/main/java/com/baiyue/firstleg/oceanbooking/mapper/OceanBookingMapper.java
index d806df7a9..a8aa3e557 100644
--- a/firstleg/src/main/java/com/baiyue/firstleg/oceanbooking/mapper/OceanBookingMapper.java
+++ b/firstleg/src/main/java/com/baiyue/firstleg/oceanbooking/mapper/OceanBookingMapper.java
@@ -3,6 +3,8 @@ package com.baiyue.firstleg.oceanbooking.mapper;
 import com.baomidou.mybatisplus.core.mapper.BaseMapper;
 import com.baomidou.mybatisplus.extension.plugins.pagination.Page;
 import com.baiyue.firstleg.oceanbooking.dto.OceanBookingDtos.Query;
+import com.baiyue.firstleg.oceanbooking.dto.OceanBookingDtos.LinkCandidate;
+import com.baiyue.firstleg.oceanbooking.dto.OceanBookingDtos.LinkCandidateQuery;
 import com.baiyue.firstleg.oceanbooking.entity.OceanBookingEntity;
 import org.apache.ibatis.annotations.Mapper;
 import org.apache.ibatis.annotations.Delete;
@@ -13,7 +15,7 @@ import org.apache.ibatis.annotations.Update;
 
 @Mapper
 public interface OceanBookingMapper extends BaseMapper<OceanBookingEntity> {
-    @Update("UPDATE fl_ocean_booking SET customer_id=#{value.customerId},customer_name=#{value.customerName},channel_code=#{value.channelCode},channel_name=#{value.channelName},warehouse_id=#{value.warehouseId},warehouse_name=#{value.warehouseName},bill_of_lading_no=#{value.billOfLadingNo},shipping_company_id=#{value.shippingCompanyId},shipping_company_name=#{value.shippingCompanyName},booking_agent_id=#{value.bookingAgentId},booking_agent_name=#{value.bookingAgentName},vessel_name=#{value.vesselName},voyage_no=#{value.voyageNo},departure_port_code=#{value.departurePortCode},departure_port_name=#{value.departurePortName},destination_port_code=#{value.destinationPortCode},destination_port_name=#{value.destinationPortName},place_of_delivery=#{value.placeOfDelivery},service_term=#{value.serviceTerm},freight_term=#{value.freightTerm},estimated_sailing_at=#{value.estimatedSailingAt},estimated_arrival_at=#{value.estimatedArrivalAt},remark=#{value.remark},updated_by=#{operatorId},updated_by_name=#{operatorName},version=version+1,updated_at=NOW() WHERE id=#{id} AND status='DRAFT' AND version=#{version}")
+    @Update("UPDATE fl_ocean_booking SET customer_id=#{value.customerId},customer_name=#{value.customerName},channel_code=#{value.channelCode},channel_name=#{value.channelName},warehouse_id=#{value.warehouseId},warehouse_name=#{value.warehouseName},bill_of_lading_no=#{value.billOfLadingNo},shipping_company_id=#{value.shippingCompanyId},shipping_company_name=#{value.shippingCompanyName},carrier_code=#{value.carrierCode},booking_agent_id=#{value.bookingAgentId},booking_agent_name=#{value.bookingAgentName},vessel_name=#{value.vesselName},voyage_no=#{value.voyageNo},departure_port_code=#{value.departurePortCode},departure_port_name=#{value.departurePortName},destination_port_code=#{value.destinationPortCode},destination_port_name=#{value.destinationPortName},place_of_delivery=#{value.placeOfDelivery},service_term=#{value.serviceTerm},freight_term=#{value.freightTerm},estimated_sailing_at=#{value.estimatedSailingAt},estimated_arrival_at=#{value.estimatedArrivalAt},remark=#{value.remark},updated_by=#{operatorId},updated_by_name=#{operatorName},version=version+1,updated_at=NOW() WHERE id=#{id} AND status='DRAFT' AND version=#{version}")
     int updateDraft(@Param("id") long id, @Param("value") OceanBookingEntity value, @Param("version") int version, @Param("operatorId") long operatorId, @Param("operatorName") String operatorName);
     @Delete("DELETE FROM fl_ocean_booking WHERE id=#{id} AND status='DRAFT' AND version=#{version}")
     int deleteDraft(@Param("id") long id, @Param("version") int version);
@@ -24,9 +26,9 @@ public interface OceanBookingMapper extends BaseMapper<OceanBookingEntity> {
             WHERE party.ocean_booking_id=booking.id AND party.party_type='SHIPPER' LIMIT 1) shipper_name,
           (SELECT party.party_name FROM fl_ocean_booking_party party
             WHERE party.ocean_booking_id=booking.id AND party.party_type='CONSIGNEE' LIMIT 1) consignee_name,
-          (SELECT COUNT(*) FROM fl_ocean_booking_container_allocation allocation
-            JOIN fl_container_booking container ON container.id=allocation.container_booking_id
-           WHERE allocation.ocean_booking_id=booking.id AND container.record_status='ACTIVE') container_count
+          COALESCE((SELECT SUM(requirement.quantity)
+            FROM fl_ocean_booking_container_requirement requirement
+           WHERE requirement.ocean_booking_id=booking.id),0) container_count
           FROM fl_ocean_booking booking
          WHERE (#{query.customerId} IS NULL OR booking.customer_id=#{query.customerId})
            AND booking.status IN ('DRAFT','RELEASED')
@@ -41,6 +43,36 @@ public interface OceanBookingMapper extends BaseMapper<OceanBookingEntity> {
         """)
     Page<OceanBookingEntity> selectPage(Page<OceanBookingEntity> page, @Param("query") Query query);
 
+    @Select("""
+        SELECT booking.id ocean_booking_id,booking.booking_no,requirement.id requirement_id,
+          requirement.container_type,requirement.capacity_cbm,requirement.max_weight_kg,
+          requirement.quantity required_quantity,
+          COALESCE(allocated.allocated_quantity,0) allocated_quantity,
+          requirement.quantity-COALESCE(allocated.allocated_quantity,0) remaining_quantity,
+          booking.customer_name,booking.warehouse_name,booking.channel_name
+        FROM fl_ocean_booking booking
+        JOIN fl_ocean_booking_container_requirement requirement
+          ON requirement.ocean_booking_id=booking.id
+        LEFT JOIN (
+          SELECT allocation.ocean_booking_id,allocation.requirement_id,COUNT(*) allocated_quantity
+          FROM fl_ocean_booking_container_allocation allocation
+          JOIN fl_container_booking container ON container.id=allocation.container_booking_id
+            AND container.record_status='ACTIVE'
+            AND container.ocean_booking_id=allocation.ocean_booking_id
+            AND container.ocean_booking_requirement_id=allocation.requirement_id
+          GROUP BY allocation.ocean_booking_id,allocation.requirement_id
+        ) allocated ON allocated.ocean_booking_id=booking.id
+          AND allocated.requirement_id=requirement.id
+        WHERE booking.status='RELEASED'
+          AND booking.warehouse_id=#{query.warehouseId}
+          AND booking.channel_code=#{query.channelCode}
+          AND requirement.container_type=#{query.containerType}
+          AND requirement.quantity>COALESCE(allocated.allocated_quantity,0)
+        ORDER BY booking.updated_at DESC,booking.id DESC,requirement.sort_no ASC,requirement.id ASC
+        """)
+    Page<LinkCandidate> selectLinkCandidates(Page<LinkCandidate> page,
+                                              @Param("query") LinkCandidateQuery query);
+
     @Update("""
         UPDATE fl_ocean_booking SET status=#{toStatus},
           updated_by=#{operatorId},updated_by_name=#{operatorName},
diff --git a/firstleg/src/main/java/com/baiyue/firstleg/oceanbooking/repository/OceanBookingRepository.java b/firstleg/src/main/java/com/baiyue/firstleg/oceanbooking/repository/OceanBookingRepository.java
index 1f5f9b27c..ca7f77216 100644
--- a/firstleg/src/main/java/com/baiyue/firstleg/oceanbooking/repository/OceanBookingRepository.java
+++ b/firstleg/src/main/java/com/baiyue/firstleg/oceanbooking/repository/OceanBookingRepository.java
@@ -5,6 +5,8 @@ import com.baomidou.mybatisplus.extension.plugins.pagination.Page;
 import com.baiyue.common.core.api.PageResult;
 import com.baiyue.firstleg.oceanbooking.dto.OceanBookingDtos.Query;
 import com.baiyue.firstleg.oceanbooking.dto.OceanBookingDtos.RealContainer;
+import com.baiyue.firstleg.oceanbooking.dto.OceanBookingDtos.LinkCandidate;
+import com.baiyue.firstleg.oceanbooking.dto.OceanBookingDtos.LinkCandidateQuery;
 import com.baiyue.firstleg.oceanbooking.entity.*;
 import com.baiyue.firstleg.oceanbooking.mapper.*;
 import com.baiyue.firstleg.entity.ContainerBookingEntity;
@@ -30,6 +32,9 @@ public class OceanBookingRepository {
     public PageResult<OceanBookingEntity> page(Query query) {
         return PageResult.from(bookings.selectPage(new Page<>(query.page(), query.size()), query));
     }
+    public PageResult<LinkCandidate> linkCandidates(LinkCandidateQuery query) {
+        return PageResult.from(bookings.selectLinkCandidates(new Page<>(query.page(), query.size()), query));
+    }
     public OceanBookingEntity find(long id) { return bookings.selectById(id); }
     public void insert(OceanBookingEntity value) { bookings.insert(value); }
     public int transition(long id, String from, String to, int version, long operatorId, String operatorName) {
@@ -44,6 +49,9 @@ public class OceanBookingRepository {
     public List<OceanBookingPartyEntity> parties(long id) { return parties.selectList(new LambdaQueryWrapper<OceanBookingPartyEntity>().eq(OceanBookingPartyEntity::getOceanBookingId, id).orderByAsc(OceanBookingPartyEntity::getId)); }
     public List<OceanBookingContainerRequirementEntity> requirements(long id) { return requirements.selectList(new LambdaQueryWrapper<OceanBookingContainerRequirementEntity>().eq(OceanBookingContainerRequirementEntity::getOceanBookingId, id).orderByAsc(OceanBookingContainerRequirementEntity::getSortNo)); }
     public List<OceanBookingContainerAllocationEntity> allocations(long id) { return allocations.selectList(new LambdaQueryWrapper<OceanBookingContainerAllocationEntity>().eq(OceanBookingContainerAllocationEntity::getOceanBookingId, id).orderByAsc(OceanBookingContainerAllocationEntity::getAllocatedAt)); }
+    public long activeLinkedCount(long oceanBookingId, long requirementId) {
+        return allocations.countActiveLinked(oceanBookingId, requirementId);
+    }
     public List<RealContainer> containers(long id) {
         Map<Long, OceanBookingContainerRequirementEntity> requirementById = requirements(id).stream()
             .collect(Collectors.toMap(OceanBookingContainerRequirementEntity::getId, Function.identity()));
diff --git a/firstleg/src/main/java/com/baiyue/firstleg/oceanbooking/service/OceanBookingService.java b/firstleg/src/main/java/com/baiyue/firstleg/oceanbooking/service/OceanBookingService.java
index 5db6c6f52..624a2f2b8 100644
--- a/firstleg/src/main/java/com/baiyue/firstleg/oceanbooking/service/OceanBookingService.java
+++ b/firstleg/src/main/java/com/baiyue/firstleg/oceanbooking/service/OceanBookingService.java
@@ -11,9 +11,9 @@ import com.baiyue.firstleg.domain.ContainerSpecificationCatalog;
 import com.baiyue.firstleg.oceanbooking.dto.OceanBookingDtos.*;
 import com.baiyue.firstleg.oceanbooking.entity.*;
 import com.baiyue.firstleg.oceanbooking.repository.OceanBookingRepository;
-import com.baiyue.firstleg.repository.PriceBookQueryRepository;
-import com.baiyue.firstleg.repository.PriceBookQueryRows.ChannelRow;
-import com.baiyue.firstleg.repository.PriceBookQueryRows.ChannelTaxModeRow;
+import com.baiyue.firstleg.pricebookquery.application.model.PriceBookQueryRows.ChannelRow;
+import com.baiyue.firstleg.pricebookquery.application.model.PriceBookQueryRows.ChannelTaxModeRow;
+import com.baiyue.firstleg.pricebookquery.application.port.in.PriceBookQueryUseCase;
 import com.baiyue.firstleg.service.WarehouseSupplierSnapshotService;
 import com.baiyue.firstleg.service.FirstlegDocumentNumberGenerator;
 import com.fasterxml.jackson.core.JsonProcessingException;
@@ -36,10 +36,11 @@ import java.util.Set;
 @Service
 public class OceanBookingService {
     private static final Set<String> PARTY_TYPES = Set.of("SHIPPER", "CONSIGNEE", "NOTIFY_PARTY");
+    private static final Set<String> CARRIER_CODES = Set.of("MATSON", "SML", "ZIM", "COSCO", "EMC", "HEDE", "OTHER");
     private static final Set<OceanBookingStatus> OPERATIONAL_LIST_STATUSES = Set.of(
         OceanBookingStatus.DRAFT, OceanBookingStatus.RELEASED);
     @Resource private OceanBookingRepository repository;
-    @Resource private PriceBookQueryRepository priceBooks;
+    @Resource private PriceBookQueryUseCase priceBooks;
     @Resource private ObjectMapper objectMapper;
     @Resource private WarehouseSupplierSnapshotService suppliers;
     @Resource private WarehouseMasterDataClient warehouses;
@@ -55,6 +56,11 @@ public class OceanBookingService {
         return repository.page(new Query(query.customerId(), status, trim(query.keyword()), query.page(), query.size()));
     }
 
+    public PageResult<LinkCandidate> linkCandidates(LinkCandidateQuery query) {
+        return repository.linkCandidates(new LinkCandidateQuery(query.warehouseId(),
+            query.channelCode().trim(), query.containerType().trim(), query.page(), query.size()));
+    }
+
     public List<ChannelOption> channels(long originWarehouseId) {
         if (originWarehouseId <= 0) throw badRequest("请选择有效起运仓");
         Long versionId = priceBooks.activeVersionId();
@@ -191,6 +197,10 @@ public class OceanBookingService {
                 ContainerSpecificationCatalog.requireMatch(container.containerType(), container.capacityCbm(), container.maxWeightKg());
             }
         }
+        if (StringUtils.hasText(data.carrierCode())
+            && !CARRIER_CODES.contains(data.carrierCode().trim().toUpperCase())) {
+            throw badRequest("carrierCode仅支持MATSON、SML、ZIM、COSCO、EMC、HEDE或OTHER");
+        }
     }
     private static void validateRange(LocalDateTime from, LocalDateTime to) { if (from != null && to != null && to.isBefore(from)) throw badRequest("预计到港时间不能早于预计开船时间"); }
     private static void validateRelease(OceanBookingEntity booking, List<OceanBookingPartyEntity> parties,
@@ -201,6 +211,7 @@ public class OceanBookingService {
             || !StringUtils.hasText(booking.getVoyageNo()) || !StringUtils.hasText(booking.getServiceTerm())
             || !StringUtils.hasText(booking.getFreightTerm()) || booking.getEstimatedSailingAt() == null
             || booking.getEstimatedArrivalAt() == null || booking.getShippingCompanyId() == null
+            || !StringUtils.hasText(booking.getCarrierCode())
             || booking.getBookingAgentId() == null || parties == null || parties.size() != 3
             || requirements == null || requirements.isEmpty()) throw badRequest("订舱资料尚未填写完整，无法发布");
         validateRange(booking.getEstimatedSailingAt(), booking.getEstimatedArrivalAt());
@@ -247,6 +258,7 @@ public class OceanBookingService {
         v.setWarehouseId(d.warehouseId()); v.setWarehouseName(resolved.warehouseName());
         v.setBillOfLadingNo(trim(d.billOfLadingNo()));
         v.setShippingCompanyId(d.shippingCompanyId()); v.setShippingCompanyName(trim(d.shippingCompanyName()));
+        v.setCarrierCode(d.carrierCode() == null ? null : d.carrierCode().trim().toUpperCase());
         v.setBookingAgentId(d.bookingAgentId()); v.setBookingAgentName(resolved.bookingAgentName());
         v.setVesselName(trim(d.vesselName())); v.setVoyageNo(trim(d.voyageNo()));
         v.setDeparturePortCode(trim(d.departurePortCode())); v.setDeparturePortName(trim(d.departurePortName()));
diff --git a/firstleg/src/main/java/com/baiyue/firstleg/outbound/dispatch/controller/PlatformOutboundDispatchController.java b/firstleg/src/main/java/com/baiyue/firstleg/outbound/dispatch/controller/PlatformOutboundDispatchController.java
index 36f8e7bd7..73e73b70c 100644
--- a/firstleg/src/main/java/com/baiyue/firstleg/outbound/dispatch/controller/PlatformOutboundDispatchController.java
+++ b/firstleg/src/main/java/com/baiyue/firstleg/outbound/dispatch/controller/PlatformOutboundDispatchController.java
@@ -28,33 +28,39 @@ public class PlatformOutboundDispatchController {
         FirstlegScopeGuard.platform(user); return ApiResponse.success(service.list(query));
     }
 
-    @GetMapping("/detail")
+    @GetMapping("/{containerBookingId}")
     @PreAuthorize("hasAuthority('platform:firstleg:outbound-dispatch:view')")
-    public ApiResponse<Detail> detail(@AuthenticationPrincipal AuthenticatedUser user, @Valid Query query) {
-        FirstlegScopeGuard.platform(user); return ApiResponse.success(service.detail(query));
+    public ApiResponse<Detail> detail(@AuthenticationPrincipal AuthenticatedUser user,
+                                      @PathVariable @jakarta.validation.constraints.Positive long containerBookingId) {
+        FirstlegScopeGuard.platform(user); return ApiResponse.success(service.detail(containerBookingId));
     }
 
-    @GetMapping("/check-gate")
+    @GetMapping("/{containerBookingId}/gate")
     @PreAuthorize("hasAuthority('platform:firstleg:outbound-dispatch:check')")
-    public ApiResponse<GateResult> checkGate(@AuthenticationPrincipal AuthenticatedUser user, @Valid Query query) {
-        FirstlegScopeGuard.platform(user); return ApiResponse.success(service.checkGate(query));
+    public ApiResponse<ContainerGateResult> checkGate(@AuthenticationPrincipal AuthenticatedUser user,
+        @PathVariable @jakarta.validation.constraints.Positive long containerBookingId) {
+        FirstlegScopeGuard.platform(user); return ApiResponse.success(service.checkGate(containerBookingId));
     }
 
-    @PostMapping("/confirm-dispatch")
+    @PostMapping("/{containerBookingId}/confirm")
     @PreAuthorize("hasAuthority('platform:firstleg:outbound-dispatch:confirm')")
-    @BusinessAudit(event="OUTBOUND_CONFIRM_DISPATCH",resourceType="INBOUND",resourceId="#request.inboundId",description="确认国内出仓")
+    @BusinessAudit(event="OUTBOUND_CONFIRM_DISPATCH",resourceType="CONTAINER_BOOKING",resourceId="#containerBookingId",description="柜级确认国内出仓")
     public ApiResponse<Detail> confirm(@AuthenticationPrincipal AuthenticatedUser user,
+                                       @PathVariable @jakarta.validation.constraints.Positive long containerBookingId,
                                        @RequestHeader("Idempotency-Key") String key,
                                        @Valid @RequestBody ActionRequest request) {
-        FirstlegScopeGuard.platform(user); return ApiResponse.success(service.confirm(user.userId(), user.username(), key, request));
+        FirstlegScopeGuard.platform(user); return ApiResponse.success(service.confirm(
+            containerBookingId, user.userId(), user.username(), key, request));
     }
 
-    @PostMapping("/reverse-dispatch")
+    @PostMapping("/{containerBookingId}/reverse")
     @PreAuthorize("hasAuthority('platform:firstleg:outbound-dispatch:reverse')")
-    @BusinessAudit(event="OUTBOUND_REVERSE_DISPATCH",resourceType="INBOUND",resourceId="#request.inboundId",description="撤销国内出仓")
+    @BusinessAudit(event="OUTBOUND_REVERSE_DISPATCH",resourceType="CONTAINER_BOOKING",resourceId="#containerBookingId",description="柜级撤销国内出仓")
     public ApiResponse<Detail> reverse(@AuthenticationPrincipal AuthenticatedUser user,
+                                       @PathVariable @jakarta.validation.constraints.Positive long containerBookingId,
                                        @RequestHeader("Idempotency-Key") String key,
                                        @Valid @RequestBody ActionRequest request) {
-        FirstlegScopeGuard.platform(user); return ApiResponse.success(service.reverse(user.userId(), user.username(), key, request));
+        FirstlegScopeGuard.platform(user); return ApiResponse.success(service.reverse(
+            containerBookingId, user.userId(), user.username(), key, request));
     }
 }
diff --git a/firstleg/src/main/java/com/baiyue/firstleg/outbound/dispatch/dto/OutboundDispatchDtos.java b/firstleg/src/main/java/com/baiyue/firstleg/outbound/dispatch/dto/OutboundDispatchDtos.java
index 38c848ca6..b7c8dc1b6 100644
--- a/firstleg/src/main/java/com/baiyue/firstleg/outbound/dispatch/dto/OutboundDispatchDtos.java
+++ b/firstleg/src/main/java/com/baiyue/firstleg/outbound/dispatch/dto/OutboundDispatchDtos.java
@@ -2,6 +2,7 @@ package com.baiyue.firstleg.outbound.dispatch.dto;
 
 import jakarta.validation.constraints.Positive;
 import jakarta.validation.constraints.PositiveOrZero;
+import jakarta.validation.constraints.NotNull;
 import jakarta.validation.constraints.Size;
 
 import java.time.LocalDateTime;
@@ -10,21 +11,27 @@ import java.util.List;
 public final class OutboundDispatchDtos {
     private OutboundDispatchDtos() {}
 
-    public record Query(@Positive Long orderId, @Positive Long inboundId, @Positive Long containerBookingId) {}
+    public record Query(@NotNull @Positive Long containerBookingId) {}
 
-    public record ActionRequest(@Positive Long inboundId, @Positive Long containerBookingId,
-                                @PositiveOrZero int expectedVersion, @Size(max = 500) String remark) {}
+    public record ActionRequest(@NotNull @PositiveOrZero Integer expectedVersion,
+                                @Size(max = 500) String remark) {}
 
     public record GateItem(String code, String name, boolean passed, String actual, String requirement) {}
     public record GateResult(boolean passed, List<GateItem> items, LocalDateTime checkedAt) {}
 
-    public record Aggregate(Long orderId, String orderNo, Long inboundId, String inboundCode, Long tenantId,
-                            Long customerId, String customerName, String inboundStatus,
-                            Long containerBookingId, String cabinetNo, String containerNo,
+    public record InboundBinding(Long orderId, String orderNo, Long inboundId, String inboundCode,
+                                 Long tenantId, Long customerId, String customerName,
+                                 String inboundStatus, Long pickTaskId, String pickTaskStatus) {}
+
+    public record InboundGate(Long inboundId, String inboundCode, GateResult gate) {}
+    public record ContainerGateResult(boolean passed, List<InboundGate> inbounds, LocalDateTime checkedAt) {}
+
+    public record Aggregate(Long containerBookingId, String cabinetNo, String containerNo,
                             Long loadingPlanId, String loadingPlanStatus,
-                            Long pickTaskId, String pickTaskStatus, Long oceanBookingId, String oceanBookingStatus,
+                            Long oceanBookingId, String oceanBookingStatus,
                             Long truckAppointmentId, String truckAppointmentStatus,
-                            String dispatchStatus, Integer version, GateResult gate) {}
+                            String dispatchStatus, Integer version, List<InboundBinding> inbounds,
+                            ContainerGateResult gate) {}
 
     public record TimelineItem(String module, String action, String fromStatus, String toStatus,
                                Long operatorId, String operatorName, String remark, LocalDateTime occurredAt) {}
diff --git a/firstleg/src/main/java/com/baiyue/firstleg/outbound/dispatch/mapper/OutboundDispatchMapper.java b/firstleg/src/main/java/com/baiyue/firstleg/outbound/dispatch/mapper/OutboundDispatchMapper.java
index 09fb7a8a7..9bbcf97e8 100644
--- a/firstleg/src/main/java/com/baiyue/firstleg/outbound/dispatch/mapper/OutboundDispatchMapper.java
+++ b/firstleg/src/main/java/com/baiyue/firstleg/outbound/dispatch/mapper/OutboundDispatchMapper.java
@@ -14,6 +14,11 @@ public interface OutboundDispatchMapper extends BaseMapper<OutboundDispatchEntit
     OutboundDispatchEntity find(@Param("tenantId") long tenantId, @Param("inboundId") long inboundId,
                                 @Param("containerBookingId") long containerBookingId);
 
+    @Select("SELECT * FROM fl_outbound_dispatch WHERE tenant_id=#{tenantId} AND inbound_id=#{inboundId} "
+        + "AND container_booking_id=#{containerBookingId} FOR UPDATE")
+    OutboundDispatchEntity findForUpdate(@Param("tenantId") long tenantId, @Param("inboundId") long inboundId,
+                                         @Param("containerBookingId") long containerBookingId);
+
     @Update("UPDATE fl_outbound_dispatch SET status='WAITING_FOR_LOADING',confirmed_by=#{operatorId},"
         + "confirmed_by_name=#{operatorName},confirmed_at=CURRENT_TIMESTAMP(3),reversed_by=NULL,reversed_by_name=NULL,"
         + "reversed_at=NULL,remark=#{remark},version=version+1,updated_at=CURRENT_TIMESTAMP(3) "
diff --git a/firstleg/src/main/java/com/baiyue/firstleg/outbound/dispatch/mapper/OutboundDispatchReadMapper.java b/firstleg/src/main/java/com/baiyue/firstleg/outbound/dispatch/mapper/OutboundDispatchReadMapper.java
index 9778a6012..519cc03e8 100644
--- a/firstleg/src/main/java/com/baiyue/firstleg/outbound/dispatch/mapper/OutboundDispatchReadMapper.java
+++ b/firstleg/src/main/java/com/baiyue/firstleg/outbound/dispatch/mapper/OutboundDispatchReadMapper.java
@@ -11,7 +11,6 @@ import java.util.List;
 @Mapper
 public interface OutboundDispatchReadMapper {
     @Select("""
-        <script>
         SELECT DISTINCT inbound.order_id orderId,inbound.order_no orderNo,inbound.id inboundId,
           inbound.inbound_code inboundCode,inbound.tenant_id tenantId,inbound.customer_id customerId,
           inbound.customer_name customerName,inbound.process_status inboundStatus,
@@ -22,45 +21,62 @@ public interface OutboundDispatchReadMapper {
         JOIN fl_container_booking booking ON booking.id=plan.container_booking_id
         JOIN fl_inbound_order inbound ON inbound.id=item.inbound_id AND inbound.tenant_id=item.account_id AND inbound.deleted=0
         WHERE item.deleted=0
-          <if test="orderId != null">AND inbound.order_id=#{orderId}</if>
-          <if test="inboundId != null">AND inbound.id=#{inboundId}</if>
-          <if test="containerBookingId != null">AND booking.id=#{containerBookingId}</if>
+          AND booking.id=#{containerBookingId}
         ORDER BY inbound.id,booking.id
-        </script>
         """)
-    List<Binding> bindings(@Param("orderId") Long orderId, @Param("inboundId") Long inboundId,
-                           @Param("containerBookingId") Long containerBookingId);
+    List<Binding> bindings(@Param("containerBookingId") long containerBookingId);
+
+    @Select("""
+        SELECT inbound.order_id orderId,inbound.order_no orderNo,inbound.id inboundId,
+          inbound.inbound_code inboundCode,inbound.tenant_id tenantId,inbound.customer_id customerId,
+          inbound.customer_name customerName,inbound.process_status inboundStatus,
+          booking.id containerBookingId,booking.cabinet_no cabinetNo,booking.container_no containerNo,
+          plan.id loadingPlanId,plan.plan_status loadingPlanStatus
+        FROM fl_loading_plan_item item
+        JOIN fl_loading_plan plan ON plan.id=item.loading_plan_id
+        JOIN fl_container_booking booking ON booking.id=plan.container_booking_id
+        JOIN fl_inbound_order inbound ON inbound.id=item.inbound_id AND inbound.tenant_id=item.account_id AND inbound.deleted=0
+        WHERE item.deleted=0 AND booking.id=#{containerBookingId}
+        ORDER BY inbound.id,booking.id
+        FOR UPDATE
+        """)
+    List<Binding> bindingsForUpdate(@Param("containerBookingId") long containerBookingId);
 
     @Select("SELECT id,task_status status FROM fl_loading_pick_task WHERE loading_plan_id=#{planId} "
         + "ORDER BY started_at DESC,id DESC LIMIT 1")
     IdStatus pick(@Param("planId") long planId);
 
     @Select("""
-        SELECT booking.id,booking.status
+        SELECT booking.id,booking.status,booking.customer_id customerId
         FROM fl_ocean_booking_container_allocation allocation
         JOIN fl_ocean_booking booking ON booking.id=allocation.ocean_booking_id
-        WHERE allocation.container_booking_id=#{containerBookingId} AND booking.customer_id=#{tenantId}
+        WHERE allocation.container_booking_id=#{containerBookingId}
         ORDER BY booking.updated_at DESC,booking.id DESC LIMIT 1
         """)
-    IdStatus ocean(@Param("containerBookingId") long containerBookingId, @Param("tenantId") long tenantId);
+    OceanBinding ocean(@Param("containerBookingId") long containerBookingId);
 
     @Select("""
         SELECT id,status FROM fl_truck_appointment
         WHERE container_booking_id=#{containerBookingId} AND loading_plan_id=#{loadingPlanId}
-          AND customer_id=#{tenantId}
         ORDER BY updated_at DESC,id DESC LIMIT 1
         """)
-    IdStatus truck(@Param("containerBookingId") long containerBookingId, @Param("loadingPlanId") long loadingPlanId,
-                   @Param("tenantId") long tenantId);
+    IdStatus truck(@Param("containerBookingId") long containerBookingId, @Param("loadingPlanId") long loadingPlanId);
 
     @Select("""
-        SELECT COUNT(DISTINCT CASE WHEN status='ACTIVE' AND file_id IS NOT NULL AND evidence_type IN
-          ('PHOTO_STEP_1','PHOTO_STEP_2','PHOTO_STEP_3','PHOTO_STEP_4','SEAL') THEN evidence_type END) evidenceCount,
-          MAX(CASE WHEN status='ACTIVE' AND evidence_type='SEAL' AND file_id IS NOT NULL AND seal_no IS NOT NULL
-                       AND seal_no<>'' THEN 1 ELSE 0 END) validSeal
-        FROM fl_loading_evidence WHERE tenant_id=#{tenantId} AND inbound_id=#{inboundId}
+        SELECT COUNT(DISTINCT CASE WHEN evidence.status='ACTIVE' AND evidence.file_id IS NOT NULL
+          AND evidence.evidence_type IN ('PHOTO_STEP_1','PHOTO_STEP_2','PHOTO_STEP_3','PHOTO_STEP_4','SEAL')
+          THEN evidence.evidence_type END) evidenceCount,
+          MAX(CASE WHEN evidence.status='ACTIVE' AND evidence.evidence_type='SEAL'
+                       AND evidence.file_id IS NOT NULL AND evidence.seal_no IS NOT NULL
+                       AND evidence.seal_no<>'' THEN 1 ELSE 0 END) validSeal
+        FROM fl_loading_plan plan
+        JOIN fl_loading_plan_item item ON item.loading_plan_id=plan.id AND item.deleted=0
+        JOIN fl_loading_evidence evidence ON evidence.inbound_id=item.inbound_id
+          AND evidence.tenant_id=item.account_id
+        WHERE plan.id=#{loadingPlanId} AND plan.container_booking_id=#{containerBookingId}
         """)
-    Evidence evidence(@Param("tenantId") long tenantId, @Param("inboundId") long inboundId);
+    Evidence evidence(@Param("containerBookingId") long containerBookingId,
+                      @Param("loadingPlanId") long loadingPlanId);
 
     @Select("""
         SELECT module,action,fromStatus,toStatus,operatorId,operatorName,remark,occurredAt FROM (
@@ -122,5 +138,6 @@ public interface OutboundDispatchReadMapper {
                    Long customerId, String customerName, String inboundStatus, Long containerBookingId,
                    String cabinetNo, String containerNo, Long loadingPlanId, String loadingPlanStatus) {}
     record IdStatus(Long id, String status) {}
+    record OceanBinding(Long id, String status, Long customerId) {}
     record Evidence(Integer evidenceCount, Integer validSeal) {}
 }
diff --git a/firstleg/src/main/java/com/baiyue/firstleg/outbound/dispatch/repository/OutboundDispatchRepository.java b/firstleg/src/main/java/com/baiyue/firstleg/outbound/dispatch/repository/OutboundDispatchRepository.java
index a0f87004a..cf510a1e8 100644
--- a/firstleg/src/main/java/com/baiyue/firstleg/outbound/dispatch/repository/OutboundDispatchRepository.java
+++ b/firstleg/src/main/java/com/baiyue/firstleg/outbound/dispatch/repository/OutboundDispatchRepository.java
@@ -1,7 +1,6 @@
 package com.baiyue.firstleg.outbound.dispatch.repository;
 
 import com.baomidou.mybatisplus.core.toolkit.IdWorker;
-import com.baiyue.firstleg.outbound.dispatch.dto.OutboundDispatchDtos.Query;
 import com.baiyue.firstleg.outbound.dispatch.dto.OutboundDispatchDtos.TimelineItem;
 import com.baiyue.firstleg.outbound.dispatch.entity.OutboundDispatchEntity;
 import com.baiyue.firstleg.outbound.dispatch.entity.OutboundDispatchHistoryEntity;
@@ -22,22 +21,24 @@ public class OutboundDispatchRepository {
     @Resource private OutboundDispatchOperationMapper operations;
     @Resource private OutboundDispatchReadMapper reads;
 
-    public List<OutboundDispatchReadMapper.Binding> bindings(Query query) {
-        return reads.bindings(query.orderId(), query.inboundId(), query.containerBookingId());
+    public List<OutboundDispatchReadMapper.Binding> bindings(long containerId) { return reads.bindings(containerId); }
+    public List<OutboundDispatchReadMapper.Binding> lockBindings(long containerId) {
+        return reads.bindingsForUpdate(containerId);
     }
     public OutboundDispatchReadMapper.IdStatus pick(long planId) { return reads.pick(planId); }
-    public OutboundDispatchReadMapper.IdStatus ocean(long containerId, long tenantId) {
-        return reads.ocean(containerId, tenantId);
+    public OutboundDispatchReadMapper.OceanBinding ocean(long containerId) { return reads.ocean(containerId); }
+    public OutboundDispatchReadMapper.IdStatus truck(long containerId, long planId) {
+        return reads.truck(containerId, planId);
     }
-    public OutboundDispatchReadMapper.IdStatus truck(long containerId, long planId, long tenantId) {
-        return reads.truck(containerId, planId, tenantId);
-    }
-    public OutboundDispatchReadMapper.Evidence evidence(long tenantId, long inboundId) {
-        return reads.evidence(tenantId, inboundId);
+    public OutboundDispatchReadMapper.Evidence evidence(long containerId, long loadingPlanId) {
+        return reads.evidence(containerId, loadingPlanId);
     }
     public OutboundDispatchEntity dispatch(long tenantId, long inboundId, long containerId) {
         return dispatches.find(tenantId, inboundId, containerId);
     }
+    public OutboundDispatchEntity dispatchLocked(long tenantId, long inboundId, long containerId) {
+        return dispatches.findForUpdate(tenantId, inboundId, containerId);
+    }
     public void insert(OutboundDispatchEntity value) { dispatches.insert(value); }
     public int confirm(long id, int version, long operatorId, String operatorName, String remark) {
         return dispatches.confirm(id, version, operatorId, operatorName, remark);
diff --git a/firstleg/src/main/java/com/baiyue/firstleg/outbound/dispatch/service/OutboundDispatchService.java b/firstleg/src/main/java/com/baiyue/firstleg/outbound/dispatch/service/OutboundDispatchService.java
index fad3762c1..0568fef73 100644
--- a/firstleg/src/main/java/com/baiyue/firstleg/outbound/dispatch/service/OutboundDispatchService.java
+++ b/firstleg/src/main/java/com/baiyue/firstleg/outbound/dispatch/service/OutboundDispatchService.java
@@ -23,8 +23,7 @@ import java.util.*;
 
 @Service
 public class OutboundDispatchService {
-    private static final Set<String> REQUIRED_CONTRIBUTORS = Set.of("CUSTOMS_CLEARANCE", "SAILING_SCHEDULE");
-    private static final Set<String> TRUCK_READY = Set.of("DEPARTED", "COMPLETED");
+    private static final Set<String> REQUIRED_CONTRIBUTORS = Set.of("CUSTOMS_CLEARANCE");
 
     private final OutboundDispatchRepository repository;
     private final Map<String, OutboundDispatchGateContributor> contributors;
@@ -51,94 +50,134 @@ public class OutboundDispatchService {
     }
 
     public List<Aggregate> list(Query query) {
-        requireSelector(query);
-        return repository.bindings(query).stream().map(this::aggregate).toList();
+        return List.of(aggregate(bindings(query.containerBookingId())));
     }
 
-    public Detail detail(Query query) {
-        OutboundDispatchReadMapper.Binding binding = single(query);
-        Aggregate aggregate = aggregate(binding);
-        return new Detail(aggregate, repository.timeline(binding, aggregate.oceanBookingId(), aggregate.truckAppointmentId()));
+    public Detail detail(long containerBookingId) {
+        List<OutboundDispatchReadMapper.Binding> bindings = bindings(containerBookingId);
+        Aggregate aggregate = aggregate(bindings);
+        List<TimelineItem> timeline = bindings.stream()
+            .flatMap(binding -> repository.timeline(binding, aggregate.oceanBookingId(), aggregate.truckAppointmentId()).stream())
+            .distinct()
+            .sorted(Comparator.comparing(TimelineItem::occurredAt,
+                Comparator.nullsLast(Comparator.naturalOrder())).thenComparing(TimelineItem::module))
+            .toList();
+        return new Detail(aggregate, timeline);
     }
 
-    public GateResult checkGate(Query query) { return aggregate(single(query)).gate(); }
+    public ContainerGateResult checkGate(long containerBookingId) {
+        return aggregate(bindings(containerBookingId)).gate();
+    }
 
     @Transactional
-    public Detail confirm(long operatorId, String operatorName, String key, ActionRequest request) {
+    public Detail confirm(long containerBookingId, long operatorId, String operatorName,
+                          String key, ActionRequest request) {
         validateKey(key);
-        Query query = new Query(null, request.inboundId(), request.containerBookingId());
-        OutboundDispatchReadMapper.Binding binding = single(query);
-        String hash = hash("CONFIRM", request);
-        Detail replay = replay(operatorId, "CONFIRM_DISPATCH", key, hash, query);
+        String hash = hash("CONFIRM", containerBookingId, request);
+        Detail replay = replay(containerBookingId, operatorId, "CONFIRM_DISPATCH", key, hash);
         if (replay != null) return replay;
 
-        Aggregate before = aggregate(binding);
-        if (!before.gate().passed()) throw conflict("国内出仓门禁未通过");
-        OutboundDispatchEntity state = state(binding);
-        if (!Objects.equals(state.getVersion(), request.expectedVersion())) throw concurrent();
-        if (OutboundDispatchStatus.WAITING_FOR_LOADING.name().equals(state.getStatus())) {
-            throw conflict("当前出仓单已确认派车");
+        List<OutboundDispatchReadMapper.Binding> bindings = lockedBindings(containerBookingId);
+        Aggregate before = aggregate(bindings);
+        if (!before.gate().passed()) throw conflict("柜内全部入库绑定尚未通过国内出仓门禁");
+        List<OutboundDispatchEntity> states = bindings.stream().map(this::stateLocked).toList();
+        StateView visible = visibleState(states);
+        if (!Objects.equals(visible.version(), request.expectedVersion())) throw concurrent();
+        if (OutboundDispatchStatus.WAITING_FOR_LOADING.name().equals(visible.status())) {
+            throw conflict("当前货柜已确认离仓");
         }
-        if (repository.confirm(state.getId(), state.getVersion(), operatorId, operatorName, request.remark()) != 1) {
-            throw concurrent();
+        for (OutboundDispatchEntity state : states) {
+            if (repository.confirm(state.getId(), state.getVersion(), operatorId, operatorName, request.remark()) != 1) {
+                throw concurrent();
+            }
         }
-        history(state, "CONFIRM_DISPATCH", OutboundDispatchStatus.READY_FOR_DISPATCH.name(),
+        OutboundDispatchEntity representative = states.get(0);
+        history(representative, "CONFIRM_DISPATCH", OutboundDispatchStatus.READY_FOR_DISPATCH.name(),
             OutboundDispatchStatus.WAITING_FOR_LOADING.name(), request.remark(), operatorId, operatorName);
+
+        OutboundDispatchReadMapper.OceanBinding ocean = repository.ocean(containerBookingId);
         if (carrierSchedules != null) {
-            carrierSchedules.ensureFromOutboundConfirm(binding.tenantId(), before.oceanBookingId(),
-                binding.containerBookingId(), operatorId, operatorName);
+            if (ocean == null || ocean.id() == null || ocean.customerId() == null) {
+                throw conflict("当前货柜未关联有效订舱，无法创建船司查询任务");
+            }
+            carrierSchedules.ensureFromOutboundConfirm(ocean.customerId(), ocean.id(), containerBookingId,
+                operatorId, operatorName);
         }
-        if (repository.completeOperation(state.getId(), operatorId, "CONFIRM_DISPATCH", key) != 1) throw concurrent();
-        return detail(query);
+        if (repository.completeOperation(representative.getId(), operatorId, "CONFIRM_DISPATCH", key) != 1) {
+            throw concurrent();
+        }
+        return detail(containerBookingId);
     }
 
     @Transactional
-    public Detail reverse(long operatorId, String operatorName, String key, ActionRequest request) {
+    public Detail reverse(long containerBookingId, long operatorId, String operatorName,
+                          String key, ActionRequest request) {
         validateKey(key);
-        Query query = new Query(null, request.inboundId(), request.containerBookingId());
-        OutboundDispatchReadMapper.Binding binding = single(query);
-        String hash = hash("REVERSE", request);
-        Detail replay = replay(operatorId, "REVERSE_DISPATCH", key, hash, query);
+        String hash = hash("REVERSE", containerBookingId, request);
+        Detail replay = replay(containerBookingId, operatorId, "REVERSE_DISPATCH", key, hash);
         if (replay != null) return replay;
 
-        OutboundDispatchEntity state = repository.dispatch(binding.tenantId(), binding.inboundId(), binding.containerBookingId());
-        if (state == null || !OutboundDispatchStatus.WAITING_FOR_LOADING.name().equals(state.getStatus())) {
-            throw conflict("当前出仓单不在等待装船状态");
+        List<OutboundDispatchReadMapper.Binding> bindings = lockedBindings(containerBookingId);
+        List<OutboundDispatchEntity> states = bindings.stream().map(this::existingStateLocked).toList();
+        StateView visible = visibleState(states);
+        if (!OutboundDispatchStatus.WAITING_FOR_LOADING.name().equals(visible.status())) {
+            throw conflict("当前货柜不在已确认离仓状态");
         }
-        if (!Objects.equals(state.getVersion(), request.expectedVersion())) throw concurrent();
-        OutboundDispatchReadMapper.IdStatus ocean = repository.ocean(binding.containerBookingId(), binding.tenantId());
-        if (carrierSchedules != null && ocean != null && carrierSchedules.hasOutboundDepartureFact(
-            binding.tenantId(), ocean.id(), binding.containerBookingId())) {
-            throw conflict("已产生实际DEPARTED_WAREHOUSE船节点，禁止撤销国内出仓");
+        if (!Objects.equals(visible.version(), request.expectedVersion())) throw concurrent();
+        OutboundDispatchReadMapper.OceanBinding ocean = repository.ocean(containerBookingId);
+        if (carrierSchedules != null) {
+            if (ocean == null || ocean.id() == null || ocean.customerId() == null) {
+                throw conflict("无法核验货柜后续船节点，禁止撤销国内出仓");
+            }
+            if (carrierSchedules.hasOutboundDepartureFact(ocean.customerId(), ocean.id(), containerBookingId)) {
+                throw conflict("已产生实际DEPARTED_WAREHOUSE船节点，禁止撤销国内出仓");
+            }
         }
-        if (repository.reverse(state.getId(), state.getVersion(), operatorId, operatorName, request.remark()) != 1) {
+        for (OutboundDispatchEntity state : states) {
+            if (repository.reverse(state.getId(), state.getVersion(), operatorId, operatorName, request.remark()) != 1) {
+                throw concurrent();
+            }
+        }
+        OutboundDispatchEntity representative = states.get(0);
+        history(representative, "REVERSE_DISPATCH", OutboundDispatchStatus.WAITING_FOR_LOADING.name(),
+            OutboundDispatchStatus.READY_FOR_DISPATCH.name(), request.remark(), operatorId, operatorName);
+        if (repository.completeOperation(representative.getId(), operatorId, "REVERSE_DISPATCH", key) != 1) {
             throw concurrent();
         }
-        history(state, "REVERSE_DISPATCH", OutboundDispatchStatus.WAITING_FOR_LOADING.name(),
-            OutboundDispatchStatus.READY_FOR_DISPATCH.name(), request.remark(), operatorId, operatorName);
-        if (repository.completeOperation(state.getId(), operatorId, "REVERSE_DISPATCH", key) != 1) throw concurrent();
-        return detail(query);
+        return detail(containerBookingId);
     }
 
-    private Aggregate aggregate(OutboundDispatchReadMapper.Binding binding) {
-        var pick = repository.pick(binding.loadingPlanId());
-        var ocean = repository.ocean(binding.containerBookingId(), binding.tenantId());
-        var truck = repository.truck(binding.containerBookingId(), binding.loadingPlanId(), binding.tenantId());
-        var evidence = repository.evidence(binding.tenantId(), binding.inboundId());
-        var dispatch = repository.dispatch(binding.tenantId(), binding.inboundId(), binding.containerBookingId());
-        GateResult gate = gate(binding, pick, ocean, truck, evidence);
-        return new Aggregate(binding.orderId(), binding.orderNo(), binding.inboundId(), binding.inboundCode(),
-            binding.tenantId(), binding.customerId(), binding.customerName(), binding.inboundStatus(),
-            binding.containerBookingId(), binding.cabinetNo(), binding.containerNo(),
-            binding.loadingPlanId(), binding.loadingPlanStatus(),
-            id(pick), status(pick), id(ocean), status(ocean), id(truck), status(truck),
-            dispatch == null ? OutboundDispatchStatus.READY_FOR_DISPATCH.name() : dispatch.getStatus(),
-            dispatch == null ? 0 : dispatch.getVersion(), gate);
+    private Aggregate aggregate(List<OutboundDispatchReadMapper.Binding> bindings) {
+        OutboundDispatchReadMapper.Binding first = validateContainer(bindings);
+        var pick = repository.pick(first.loadingPlanId());
+        var ocean = repository.ocean(first.containerBookingId());
+        var truck = repository.truck(first.containerBookingId(), first.loadingPlanId());
+        var evidence = repository.evidence(first.containerBookingId(), first.loadingPlanId());
+        List<GateItem> containerContributorGates = contributorGates(first, ocean);
+        List<InboundGate> inboundGates = new ArrayList<>();
+        List<InboundBinding> inboundDtos = new ArrayList<>();
+        List<OutboundDispatchEntity> states = new ArrayList<>();
+        for (OutboundDispatchReadMapper.Binding binding : bindings) {
+            GateResult gate = gate(binding, pick, ocean, evidence, containerContributorGates);
+            inboundGates.add(new InboundGate(binding.inboundId(), binding.inboundCode(), gate));
+            inboundDtos.add(new InboundBinding(binding.orderId(), binding.orderNo(), binding.inboundId(),
+                binding.inboundCode(), binding.tenantId(), binding.customerId(), binding.customerName(),
+                binding.inboundStatus(), id(pick), status(pick)));
+            OutboundDispatchEntity state = repository.dispatch(binding.tenantId(), binding.inboundId(),
+                binding.containerBookingId());
+            if (state != null) states.add(state);
+        }
+        StateView visible = visibleStateForRead(states, bindings.size());
+        ContainerGateResult containerGate = new ContainerGateResult(
+            inboundGates.stream().allMatch(value -> value.gate().passed()), List.copyOf(inboundGates), LocalDateTime.now());
+        return new Aggregate(first.containerBookingId(), first.cabinetNo(), first.containerNo(),
+            first.loadingPlanId(), first.loadingPlanStatus(), id(ocean), status(ocean), id(truck), status(truck),
+            visible.status(), visible.version(), List.copyOf(inboundDtos), containerGate);
     }
 
     private GateResult gate(OutboundDispatchReadMapper.Binding binding, OutboundDispatchReadMapper.IdStatus pick,
-                            OutboundDispatchReadMapper.IdStatus ocean, OutboundDispatchReadMapper.IdStatus truck,
-                            OutboundDispatchReadMapper.Evidence evidence) {
+                            OutboundDispatchReadMapper.OceanBinding ocean, OutboundDispatchReadMapper.Evidence evidence,
+                            List<GateItem> containerContributorGates) {
         List<GateItem> items = new ArrayList<>();
         items.add(item("INBOUND_LOADED", "入库单装柜完成", "LOADED".equals(binding.inboundStatus()),
             binding.inboundStatus(), "LOADED"));
@@ -148,14 +187,19 @@ public class OutboundDispatchService {
             status(pick), "COMPLETED"));
         items.add(item("OCEAN_BOOKING_RELEASED", "订舱已放舱且分配当前柜次",
             ocean != null && "RELEASED".equals(ocean.status()), status(ocean), "RELEASED"));
-        items.add(item("TRUCK_DEPARTED", "关联拖车已离仓", truck != null && TRUCK_READY.contains(truck.status()),
-            status(truck), "DEPARTED或COMPLETED"));
         boolean evidenceReady = evidence != null && evidence.evidenceCount() != null
             && evidence.evidenceCount() >= 5 && Objects.equals(evidence.validSeal(), 1);
         items.add(item("LOADING_EVIDENCE_COMPLETE", "四步照片与铅封完整", evidenceReady,
             evidence == null ? null : evidence.evidenceCount() + "个证据/有效铅封=" + evidence.validSeal(),
             "PHOTO_STEP_1..4和含铅封号的SEAL"));
 
+        items.addAll(containerContributorGates);
+        return new GateResult(items.stream().allMatch(GateItem::passed), List.copyOf(items), LocalDateTime.now());
+    }
+
+    private List<GateItem> contributorGates(OutboundDispatchReadMapper.Binding binding,
+                                            OutboundDispatchReadMapper.OceanBinding ocean) {
+        List<GateItem> items = new ArrayList<>();
         var context = new OutboundDispatchGateContributor.Context(binding.tenantId(), binding.customerId(),
             binding.orderId(), binding.inboundId(), binding.containerBookingId(), binding.loadingPlanId(), id(ocean));
         for (String code : REQUIRED_CONTRIBUTORS.stream().sorted().toList()) {
@@ -171,77 +215,136 @@ public class OutboundDispatchService {
                 items.add(item(code, contributorName(code), false, "ASSESSMENT_ERROR", "模块返回可放行状态"));
             }
         }
-        return new GateResult(items.stream().allMatch(GateItem::passed), List.copyOf(items), LocalDateTime.now());
+        return List.copyOf(items);
     }
 
-    private Detail replay(long operatorId, String operation, String key, String hash, Query query) {
+    private Detail replay(long containerBookingId, long operatorId, String operation, String key, String hash) {
         if (repository.claim(operatorId, operation, key, hash)) return null;
         var existing = repository.operation(operatorId, operation, key);
         if (existing == null || !Objects.equals(existing.getRequestHash(), hash)) {
             throw conflict("Idempotency-Key已用于不同请求");
         }
         if (!"SUCCESS".equals(existing.getStatus())) throw conflict("相同请求正在处理中");
-        return detail(query);
+        return detail(containerBookingId);
     }
 
-    private OutboundDispatchEntity state(OutboundDispatchReadMapper.Binding binding) {
-        OutboundDispatchEntity state = repository.dispatch(binding.tenantId(), binding.inboundId(), binding.containerBookingId());
+    private OutboundDispatchEntity stateLocked(OutboundDispatchReadMapper.Binding binding) {
+        OutboundDispatchEntity state = repository.dispatchLocked(binding.tenantId(), binding.inboundId(),
+            binding.containerBookingId());
         if (state != null) return state;
         state = new OutboundDispatchEntity();
-        state.setId(IdWorker.getId()); state.setTenantId(binding.tenantId()); state.setOrderId(binding.orderId());
-        state.setInboundId(binding.inboundId()); state.setContainerBookingId(binding.containerBookingId());
-        state.setStatus(OutboundDispatchStatus.READY_FOR_DISPATCH.name()); state.setVersion(0);
-        try { repository.insert(state); }
-        catch (DuplicateKeyException ex) {
-            state = repository.dispatch(binding.tenantId(), binding.inboundId(), binding.containerBookingId());
+        state.setId(IdWorker.getId());
+        state.setTenantId(binding.tenantId());
+        state.setOrderId(binding.orderId());
+        state.setInboundId(binding.inboundId());
+        state.setContainerBookingId(binding.containerBookingId());
+        state.setStatus(OutboundDispatchStatus.READY_FOR_DISPATCH.name());
+        state.setVersion(0);
+        try {
+            repository.insert(state);
+        } catch (DuplicateKeyException ex) {
+            state = repository.dispatchLocked(binding.tenantId(), binding.inboundId(), binding.containerBookingId());
             if (state == null) throw ex;
         }
         return state;
     }
 
+    private OutboundDispatchEntity existingStateLocked(OutboundDispatchReadMapper.Binding binding) {
+        OutboundDispatchEntity state = repository.dispatchLocked(binding.tenantId(), binding.inboundId(),
+            binding.containerBookingId());
+        if (state == null) throw conflict("当前货柜尚未确认离仓");
+        return state;
+    }
+
     private void history(OutboundDispatchEntity state, String action, String from, String to, String remark,
                          long operatorId, String operatorName) {
         OutboundDispatchHistoryEntity history = new OutboundDispatchHistoryEntity();
-        history.setId(IdWorker.getId()); history.setDispatchId(state.getId()); history.setTenantId(state.getTenantId());
-        history.setInboundId(state.getInboundId()); history.setContainerBookingId(state.getContainerBookingId());
-        history.setAction(action); history.setFromStatus(from); history.setToStatus(to); history.setRemark(remark);
-        history.setOperatorId(operatorId); history.setOperatorName(operatorName); repository.history(history);
+        history.setId(IdWorker.getId());
+        history.setDispatchId(state.getId());
+        history.setTenantId(state.getTenantId());
+        history.setInboundId(state.getInboundId());
+        history.setContainerBookingId(state.getContainerBookingId());
+        history.setAction(action);
+        history.setFromStatus(from);
+        history.setToStatus(to);
+        history.setRemark(remark);
+        history.setOperatorId(operatorId);
+        history.setOperatorName(operatorName);
+        repository.history(history);
     }
 
-    private OutboundDispatchReadMapper.Binding single(Query query) {
-        requireSelector(query);
-        List<OutboundDispatchReadMapper.Binding> bindings = repository.bindings(query);
-        if (bindings.isEmpty()) throw new BizException(ResultCode.NOT_FOUND, "未找到匹配的入库单与柜次关联");
-        if (bindings.size() != 1) throw new BizException(ResultCode.BAD_REQUEST, "查询条件匹配多个出仓聚合，请同时指定inboundId和containerBookingId");
-        return bindings.get(0);
+    private List<OutboundDispatchReadMapper.Binding> bindings(long containerBookingId) {
+        return normalize(repository.bindings(containerBookingId));
     }
 
-    private static void requireSelector(Query query) {
-        if (query == null || query.orderId() == null && query.inboundId() == null && query.containerBookingId() == null) {
-            throw new BizException(ResultCode.BAD_REQUEST, "orderId、inboundId、containerBookingId至少提供一个");
+    private List<OutboundDispatchReadMapper.Binding> lockedBindings(long containerBookingId) {
+        return normalize(repository.lockBindings(containerBookingId));
+    }
+
+    private static List<OutboundDispatchReadMapper.Binding> normalize(List<OutboundDispatchReadMapper.Binding> values) {
+        if (values == null || values.isEmpty()) {
+            throw new BizException(ResultCode.NOT_FOUND, "未找到当前货柜的真实入库绑定");
         }
+        LinkedHashMap<Long, OutboundDispatchReadMapper.Binding> unique = new LinkedHashMap<>();
+        for (OutboundDispatchReadMapper.Binding value : values) unique.putIfAbsent(value.inboundId(), value);
+        return List.copyOf(unique.values());
     }
+
+    private static OutboundDispatchReadMapper.Binding validateContainer(List<OutboundDispatchReadMapper.Binding> bindings) {
+        OutboundDispatchReadMapper.Binding first = bindings.get(0);
+        boolean inconsistent = bindings.stream().anyMatch(binding ->
+            !Objects.equals(first.containerBookingId(), binding.containerBookingId())
+                || !Objects.equals(first.loadingPlanId(), binding.loadingPlanId()));
+        if (inconsistent) throw conflict("货柜入库绑定存在跨柜次数据冲突");
+        return first;
+    }
+
+    private static StateView visibleStateForRead(List<OutboundDispatchEntity> states, int bindingCount) {
+        if (states.isEmpty()) return new StateView(OutboundDispatchStatus.READY_FOR_DISPATCH.name(), 0);
+        if (states.size() != bindingCount) throw conflict("货柜出仓状态不完整，请联系管理员处理");
+        return visibleState(states);
+    }
+
+    private static StateView visibleState(List<OutboundDispatchEntity> states) {
+        if (states.isEmpty()) throw conflict("货柜出仓状态不存在");
+        String status = states.get(0).getStatus();
+        Integer version = states.get(0).getVersion();
+        if (states.stream().anyMatch(value -> !Objects.equals(status, value.getStatus())
+            || !Objects.equals(version, value.getVersion()))) {
+            throw conflict("货柜出仓状态或版本不一致，请联系管理员处理");
+        }
+        return new StateView(status, version);
+    }
+
     private static void validateKey(String key) {
         if (key == null || key.isBlank() || key.length() > 128) {
             throw new BizException(ResultCode.BAD_REQUEST, "Idempotency-Key不能为空且长度不能超过128");
         }
     }
-    private static String hash(String action, ActionRequest request) {
-        String source = action + "|" + request.inboundId() + "|" + request.containerBookingId() + "|"
-            + request.expectedVersion() + "|" + Objects.toString(request.remark(), "");
+
+    private static String hash(String action, long containerBookingId, ActionRequest request) {
+        String source = action + "|" + containerBookingId + "|" + request.expectedVersion() + "|"
+            + Objects.toString(request.remark(), "");
         try {
             byte[] digest = MessageDigest.getInstance("SHA-256").digest(source.getBytes(StandardCharsets.UTF_8));
             return HexFormat.of().formatHex(digest);
-        } catch (Exception ex) { throw new IllegalStateException(ex); }
+        } catch (Exception ex) {
+            throw new IllegalStateException(ex);
+        }
     }
+
     private static Long id(OutboundDispatchReadMapper.IdStatus value) { return value == null ? null : value.id(); }
+    private static Long id(OutboundDispatchReadMapper.OceanBinding value) { return value == null ? null : value.id(); }
     private static String status(OutboundDispatchReadMapper.IdStatus value) { return value == null ? null : value.status(); }
+    private static String status(OutboundDispatchReadMapper.OceanBinding value) { return value == null ? null : value.status(); }
     private static GateItem item(String code, String name, boolean pass, String actual, String requirement) {
         return new GateItem(code, name, pass, actual, requirement);
     }
     private static String contributorName(String code) {
-        return "CUSTOMS_CLEARANCE".equals(code) ? "报关协同完成" : "船期有效且未过期";
+        return "报关协同完成";
     }
     private static BizException conflict(String message) { return new BizException(ResultCode.CONFLICT, message); }
     private static BizException concurrent() { return conflict("数据已被其他人修改，请刷新后重试"); }
+
+    private record StateView(String status, Integer version) {}
 }
diff --git a/firstleg/src/main/java/com/baiyue/firstleg/portschedule/controller/PlatformCarrierScheduleQueryController.java b/firstleg/src/main/java/com/baiyue/firstleg/portschedule/controller/PlatformCarrierScheduleQueryController.java
index 4153fa1e2..4b76ab3a0 100644
--- a/firstleg/src/main/java/com/baiyue/firstleg/portschedule/controller/PlatformCarrierScheduleQueryController.java
+++ b/firstleg/src/main/java/com/baiyue/firstleg/portschedule/controller/PlatformCarrierScheduleQueryController.java
@@ -97,6 +97,8 @@ public class PlatformCarrierScheduleQueryController {
 
     @PostMapping("/{queryId}/manual-nodes")
     @PreAuthorize("hasAuthority('platform:firstleg:port-schedule-query:manual')")
+    @Operation(summary = "人工补录预计或实际标准船节点",
+        description = "预计节点不推进实际进度；人工实际节点必须严格晚于当前最新实际节点，同级或更早节点返回 A0409。")
     @BusinessAudit(event = "CARRIER_SCHEDULE_QUERY_MANUAL_NODE", resourceType = "CARRIER_SCHEDULE_QUERY",
         resourceId = "#queryId", description = "人工补录船节点事实")
     public ApiResponse<Detail> manualNode(@AuthenticationPrincipal AuthenticatedUser user,
diff --git a/firstleg/src/main/java/com/baiyue/firstleg/portschedule/service/CarrierScheduleAdapterRegistry.java b/firstleg/src/main/java/com/baiyue/firstleg/portschedule/service/CarrierScheduleAdapterRegistry.java
index 50a5919ec..cd7ed02d5 100644
--- a/firstleg/src/main/java/com/baiyue/firstleg/portschedule/service/CarrierScheduleAdapterRegistry.java
+++ b/firstleg/src/main/java/com/baiyue/firstleg/portschedule/service/CarrierScheduleAdapterRegistry.java
@@ -36,23 +36,26 @@ public class CarrierScheduleAdapterRegistry {
 
     public PreparedAttempt prepare(String carrierCode, String trackingType, String trackingNo) {
         Definition definition = required(carrierCode);
+        boolean automated = automated(definition);
         return new PreparedAttempt(definition.code(), definition.accessMode(),
-            officialUrl(definition, trackingType, trackingNo), automated(definition) ? "READY" : "MANUAL_REQUIRED",
-            definition.coverageGapCode(), definition.manualReason());
+            officialUrl(definition, trackingType, trackingNo), automated ? "READY" : "MANUAL_REQUIRED",
+            definition.coverageGapCode(), automated ? null : manualReason(definition));
+    }
+
+    /** Outbound confirmation is a physical fact and must not be blocked by provider coverage. */
+    public PreparedAttempt prepareOutbound(String carrierCode, String trackingType, String trackingNo) {
+        String normalized = carrierCode == null ? "" : carrierCode.trim().toUpperCase(Locale.ROOT);
+        if (normalized.isEmpty() || "OTHER".equals(normalized)) {
+            return new PreparedAttempt("OTHER", "MANUAL", "", "MANUAL_REQUIRED",
+                "UNSUPPORTED_CARRIER", "船司未接入自动查询，需人工补录船节点");
+        }
+        return prepare(normalized, trackingType, trackingNo);
     }
 
     public String normalize(String carrierCode) {
         return required(carrierCode).code();
     }
 
-    public String resolve(String carrierName) {
-        String normalized = carrierName == null ? "" : carrierName.trim().toUpperCase(Locale.ROOT);
-        return DEFINITIONS.values().stream().filter(value -> value.matches(normalized))
-            .findFirst().map(Definition::code)
-            .orElseThrow(() -> new BizException(ResultCode.BAD_REQUEST,
-                "出仓订舱船司无法映射至已支持的船节点供应商：" + carrierName));
-    }
-
     private static Definition required(String carrierCode) {
         String normalized = carrierCode == null ? "" : carrierCode.trim().toUpperCase(Locale.ROOT);
         Definition value = DEFINITIONS.get(normalized);
@@ -105,6 +108,12 @@ public class CarrierScheduleAdapterRegistry {
         };
     }
 
+    private static String manualReason(Definition definition) {
+        return definition.manualReason() == null
+            ? definition.name() + "自动查询当前未启用，需人工补录船节点"
+            : definition.manualReason();
+    }
+
     private record Definition(String code, String name, String officialUrl, String accessMode,
                               String coverageGapCode, String manualReason) {
         CarrierDescriptor descriptor(boolean automated) {
diff --git a/firstleg/src/main/java/com/baiyue/firstleg/portschedule/service/CarrierScheduleQueryService.java b/firstleg/src/main/java/com/baiyue/firstleg/portschedule/service/CarrierScheduleQueryService.java
index 4ab755ac0..417ab2d60 100644
--- a/firstleg/src/main/java/com/baiyue/firstleg/portschedule/service/CarrierScheduleQueryService.java
+++ b/firstleg/src/main/java/com/baiyue/firstleg/portschedule/service/CarrierScheduleQueryService.java
@@ -35,6 +35,7 @@ import com.fasterxml.jackson.core.JsonProcessingException;
 import com.fasterxml.jackson.databind.ObjectMapper;
 import jakarta.annotation.Resource;
 import org.springframework.dao.DuplicateKeyException;
+import org.springframework.dao.DataIntegrityViolationException;
 import org.springframework.beans.factory.annotation.Value;
 import org.springframework.stereotype.Service;
 import org.springframework.transaction.annotation.Transactional;
@@ -95,7 +96,6 @@ public class CarrierScheduleQueryService {
         ContainerBookingEntity container = portSchedules.containerBooking(containerBookingId);
         if (booking == null || container == null) throw new BizException(ResultCode.NOT_FOUND, "出仓订舱或柜次不存在");
         validateLinks(customerId, oceanBookingId, containerBookingId);
-        String carrierCode = adapters.resolve(booking.getShippingCompanyName());
         String trackingType;
         String trackingNo;
         if (StringUtils.hasText(container.getContainerNo())) {
@@ -107,36 +107,58 @@ public class CarrierScheduleQueryService {
         } else {
             throw badRequest("确认国内出仓前必须具备柜号、提单号或订舱号之一");
         }
-        PreparedAttempt strategy = adapters.prepare(carrierCode, trackingType, trackingNo);
+        PreparedAttempt strategy = adapters.prepareOutbound(booking.getCarrierCode(), trackingType, trackingNo);
         LocalDateTime now = now();
         CarrierScheduleQueryEntity value = new CarrierScheduleQueryEntity();
         value.setId(IdWorker.getId()); value.setQueryNo("CSQ" + value.getId());
         value.setCustomerId(customerId); value.setOceanBookingId(oceanBookingId);
-        value.setContainerBookingId(containerBookingId); value.setCarrierCode(carrierCode);
+        value.setContainerBookingId(containerBookingId); value.setCarrierCode(strategy.carrierCode());
         value.setTrackingType(trackingType); value.setTrackingNo(trackingNo);
         value.setOfficialUrl(strategy.officialUrl()); value.setAccessMode(strategy.accessMode());
-        value.setStatus("READY"); value.setTriggerSource("OUTBOUND_CONFIRM");
+        value.setStatus(strategy.status()); value.setTriggerSource("OUTBOUND_CONFIRM");
         value.setLatestStandardNode(CarrierScheduleNode.DEPARTED_WAREHOUSE.name());
         value.setLatestNodeObservedAt(now); value.setWindowStartedAt(now); value.setAttemptCount(0);
-        value.setConsecutiveFailures(0); value.setNextAllowedAt(CarrierScheduleQuerySlots.nextSlot(now));
+        value.setConsecutiveFailures(0); value.setNextAllowedAt("MANUAL".equals(strategy.accessMode())
+            ? null : CarrierScheduleQuerySlots.nextSlot(now));
+        value.setManualReason(outboundManualReason(strategy, booking));
         value.setCreatedBy(operatorId); value.setCreatedByName(operatorName);
         value.setUpdatedBy(operatorId); value.setUpdatedByName(operatorName); value.setVersion(0);
-        try { repository.insert(value); }
-        catch (DuplicateKeyException exception) {
-            CarrierScheduleQueryEntity concurrent = repository.findByBusinessScope(customerId, oceanBookingId,
-                containerBookingId);
-            if (concurrent != null) return concurrent;
-            throw exception;
+        String persistenceStage = "QUERY_TASK";
+        try {
+            try { repository.insert(value); }
+            catch (DuplicateKeyException exception) {
+                CarrierScheduleQueryEntity concurrent = repository.findByBusinessScope(customerId, oceanBookingId,
+                    containerBookingId);
+                if (concurrent != null) return concurrent;
+                throw exception;
+            }
+            persistenceStage = "NODE_FACT";
+            CarrierScheduleNodeFactEntity departed = addNode(value.getId(), "FIRSTLEG", "OUTBOUND_CONFIRM", "OUTBOUND_CONFIRM",
+                CarrierScheduleNode.DEPARTED_WAREHOUSE, now, null, now, null, null, "OUTBOUND_CONFIRM",
+                sha256("OUTBOUND_CONFIRM|" + containerBookingId));
+            if (departed != null) {
+                persistenceStage = "CROSS_REGION_OUTBOX";
+                nodeOutbox.publish(value, departed, requireContainerNo(containerBookingId));
+            }
+            persistenceStage = "QUERY_HISTORY";
+            addHistory(value.getId(), "AUTO_CREATE", null, 0, "国内确认出仓自动创建", null, value,
+                operatorId, operatorName);
+        } catch (DataIntegrityViolationException exception) {
+            throw conflict("船节点持久化契约与当前服务不一致（" + persistenceStage
+                + "），请确认OTHER/MANUAL约束及节点事实表已初始化");
         }
-        CarrierScheduleNodeFactEntity departed = addNode(value.getId(), "FIRSTLEG", "OUTBOUND_CONFIRM", "OUTBOUND_CONFIRM",
-            CarrierScheduleNode.DEPARTED_WAREHOUSE, now, null, now, null, null, "OUTBOUND_CONFIRM",
-            sha256("OUTBOUND_CONFIRM|" + containerBookingId));
-        if (departed != null) nodeOutbox.publish(value, departed, requireContainerNo(containerBookingId));
-        addHistory(value.getId(), "AUTO_CREATE", null, 0, "国内确认出仓自动创建", null, value,
-            operatorId, operatorName);
         return value;
     }
 
+    private static String outboundManualReason(PreparedAttempt strategy, OceanBookingEntity booking) {
+        if (!"MANUAL_REQUIRED".equals(strategy.status())) return null;
+        String reason = strategy.manualReason();
+        if (!"MANUAL".equals(strategy.accessMode())) return reason;
+        return reason + "；carrierCode=" + Objects.toString(booking.getCarrierCode(), "")
+            + "；shippingCompanyId=" + booking.getShippingCompanyId()
+            + "；shippingCompanyName=" + Objects.toString(booking.getShippingCompanyName(), "");
+    }
+
     @Transactional
     public Detail applyProviderObservation(long id, ProviderObservationRequest request) {
         CarrierScheduleQueryEntity value = requiredLocked(id);
@@ -183,6 +205,7 @@ public class CarrierScheduleQueryService {
         }
         CarrierScheduleQueryEntity value = requiredLockedVersion(id, request.expectedVersion());
         CarrierScheduleNode node = CarrierScheduleNode.require(request.standardNode());
+        requireManualActualAdvance(value, node, request.actualAt());
         CarrierScheduleQueryEntity before = copy(value);
         String providerEventId = sha256("MANUAL|" + id + '|' + key);
         CarrierScheduleNodeFactEntity fact = addNode(id, "MANUAL", providerEventId, node.name(), node,
@@ -204,6 +227,15 @@ public class CarrierScheduleQueryService {
         return complete(id, operatorId, key, detail(after));
     }
 
+    private void requireManualActualAdvance(CarrierScheduleQueryEntity value, CarrierScheduleNode node,
+                                            LocalDateTime actualAt) {
+        if (actualAt == null || value.getLatestStandardNode() == null) return;
+        CarrierScheduleNode current = CarrierScheduleNode.require(value.getLatestStandardNode());
+        if (node.sequence() <= current.sequence()) {
+            throw conflict("人工实际节点必须严格晚于当前最新实际节点");
+        }
+    }
+
     private boolean advanceActualNode(CarrierScheduleQueryEntity value, CarrierScheduleNode node,
                                       LocalDateTime actualAt, LocalDateTime observedAt,
                                       long operatorId, String operatorName) {
diff --git a/firstleg/src/main/java/com/baiyue/firstleg/mapper/PriceBookQueryMapper.java b/firstleg/src/main/java/com/baiyue/firstleg/pricebookquery/adapter/out/persistence/PriceBookQueryMapper.java
similarity index 93%
rename from firstleg/src/main/java/com/baiyue/firstleg/mapper/PriceBookQueryMapper.java
rename to firstleg/src/main/java/com/baiyue/firstleg/pricebookquery/adapter/out/persistence/PriceBookQueryMapper.java
index f86961189..8b708f74d 100644
--- a/firstleg/src/main/java/com/baiyue/firstleg/mapper/PriceBookQueryMapper.java
+++ b/firstleg/src/main/java/com/baiyue/firstleg/pricebookquery/adapter/out/persistence/PriceBookQueryMapper.java
@@ -1,9 +1,10 @@
-package com.baiyue.firstleg.mapper;
+package com.baiyue.firstleg.pricebookquery.adapter.out.persistence;
 
-import com.baiyue.firstleg.repository.PriceBookQueryRows.ChannelRow;
-import com.baiyue.firstleg.repository.PriceBookQueryRows.ChannelTaxModeRow;
-import com.baiyue.firstleg.repository.PriceBookQueryRows.RateRow;
-import com.baiyue.firstleg.repository.PriceBookQueryRows.ChannelPrefixRow;
+import com.baiyue.firstleg.pricebookquery.application.model.PriceBookQueryRows.ChannelRow;
+import com.baiyue.firstleg.pricebookquery.application.model.PriceBookQueryRows.ChannelTaxModeRow;
+import com.baiyue.firstleg.pricebookquery.application.model.PriceBookQueryRows.RateRow;
+import com.baiyue.firstleg.pricebookquery.application.model.PriceBookQueryRows.ChannelPrefixRow;
+import com.baiyue.firstleg.pricebookquery.application.port.out.PriceBookQueryReader;
 import org.apache.ibatis.annotations.Mapper;
 import org.apache.ibatis.annotations.Param;
 import org.apache.ibatis.annotations.Select;
@@ -12,7 +13,7 @@ import java.util.List;
 
 /** Dedicated read model for merchant channel selection and reference estimates. */
 @Mapper
-public interface PriceBookQueryMapper {
+public interface PriceBookQueryMapper extends PriceBookQueryReader {
     @Select("""
         SELECT channel_code AS channelCode, inbound_code_prefix AS inboundCodePrefix,
                overseas_inbound_code_prefix AS overseasInboundCodePrefix
diff --git a/firstleg/src/main/java/com/baiyue/firstleg/pricebookquery/application/PriceBookQueryService.java b/firstleg/src/main/java/com/baiyue/firstleg/pricebookquery/application/PriceBookQueryService.java
new file mode 100644
index 000000000..094003ec2
--- /dev/null
+++ b/firstleg/src/main/java/com/baiyue/firstleg/pricebookquery/application/PriceBookQueryService.java
@@ -0,0 +1,45 @@
+package com.baiyue.firstleg.pricebookquery.application;
+
+import com.baiyue.firstleg.pricebookquery.application.model.PriceBookQueryRows.ChannelPrefixRow;
+import com.baiyue.firstleg.pricebookquery.application.model.PriceBookQueryRows.ChannelRow;
+import com.baiyue.firstleg.pricebookquery.application.model.PriceBookQueryRows.ChannelTaxModeRow;
+import com.baiyue.firstleg.pricebookquery.application.model.PriceBookQueryRows.RateRow;
+import com.baiyue.firstleg.pricebookquery.application.port.in.PriceBookQueryUseCase;
+import com.baiyue.firstleg.pricebookquery.application.port.out.PriceBookQueryReader;
+import jakarta.annotation.Resource;
+import org.springframework.stereotype.Service;
+
+import java.util.List;
+
+@Service
+public class PriceBookQueryService implements PriceBookQueryUseCase {
+    @Resource private PriceBookQueryReader reader;
+
+    @Override public Long activeVersionId() { return reader.findActiveVersionId(); }
+    @Override public List<ChannelRow> channels(long versionId, long originWarehouseId) {
+        return reader.findChannels(versionId, originWarehouseId);
+    }
+    @Override public List<ChannelTaxModeRow> channelTaxModes(long versionId, long originWarehouseId) {
+        return reader.findChannelTaxModes(versionId, originWarehouseId);
+    }
+    @Override public List<RateRow> fbaRates(long versionId, long originWarehouseId, String channelCode,
+                                             String destinationCode, String pricingTaxMode) {
+        return reader.findFbaRates(versionId, originWarehouseId, channelCode, destinationCode, pricingTaxMode);
+    }
+    @Override public List<RateRow> overseasRates(long versionId, long originWarehouseId, String channelCode,
+                                                  long destinationWarehouseId, String pricingTaxMode) {
+        return reader.findOverseasRates(versionId, originWarehouseId, channelCode, destinationWarehouseId,
+            pricingTaxMode);
+    }
+    @Override public List<RateRow> regionTiers(long versionId, long originWarehouseId, String channelCode,
+                                                String regionCode, String pricingTaxMode) {
+        return reader.findRegionTiers(versionId, originWarehouseId, channelCode, regionCode, pricingTaxMode);
+    }
+    @Override public boolean channelAvailable(long versionId, long originWarehouseId, String channelCode) {
+        return channels(versionId, originWarehouseId).stream()
+            .anyMatch(channel -> channelCode.equals(channel.getChannelCode()));
+    }
+    @Override public ChannelPrefixRow channelPrefix(String channelCode) {
+        return reader.findChannelPrefix(channelCode);
+    }
+}
diff --git a/firstleg/src/main/java/com/baiyue/firstleg/repository/PriceBookQueryRows.java b/firstleg/src/main/java/com/baiyue/firstleg/pricebookquery/application/model/PriceBookQueryRows.java
similarity index 96%
rename from firstleg/src/main/java/com/baiyue/firstleg/repository/PriceBookQueryRows.java
rename to firstleg/src/main/java/com/baiyue/firstleg/pricebookquery/application/model/PriceBookQueryRows.java
index dc8395fc6..0ca9c0b8a 100644
--- a/firstleg/src/main/java/com/baiyue/firstleg/repository/PriceBookQueryRows.java
+++ b/firstleg/src/main/java/com/baiyue/firstleg/pricebookquery/application/model/PriceBookQueryRows.java
@@ -1,4 +1,4 @@
-package com.baiyue.firstleg.repository;
+package com.baiyue.firstleg.pricebookquery.application.model;
 
 import lombok.Getter;
 import lombok.Setter;
diff --git a/firstleg/src/main/java/com/baiyue/firstleg/pricebookquery/application/port/in/PriceBookQueryUseCase.java b/firstleg/src/main/java/com/baiyue/firstleg/pricebookquery/application/port/in/PriceBookQueryUseCase.java
new file mode 100644
index 000000000..980c86ad7
--- /dev/null
+++ b/firstleg/src/main/java/com/baiyue/firstleg/pricebookquery/application/port/in/PriceBookQueryUseCase.java
@@ -0,0 +1,22 @@
+package com.baiyue.firstleg.pricebookquery.application.port.in;
+
+import com.baiyue.firstleg.pricebookquery.application.model.PriceBookQueryRows.ChannelPrefixRow;
+import com.baiyue.firstleg.pricebookquery.application.model.PriceBookQueryRows.ChannelRow;
+import com.baiyue.firstleg.pricebookquery.application.model.PriceBookQueryRows.ChannelTaxModeRow;
+import com.baiyue.firstleg.pricebookquery.application.model.PriceBookQueryRows.RateRow;
+
+import java.util.List;
+
+public interface PriceBookQueryUseCase {
+    Long activeVersionId();
+    List<ChannelRow> channels(long versionId, long originWarehouseId);
+    List<ChannelTaxModeRow> channelTaxModes(long versionId, long originWarehouseId);
+    List<RateRow> fbaRates(long versionId, long originWarehouseId, String channelCode,
+                           String destinationCode, String pricingTaxMode);
+    List<RateRow> overseasRates(long versionId, long originWarehouseId, String channelCode,
+                                long destinationWarehouseId, String pricingTaxMode);
+    List<RateRow> regionTiers(long versionId, long originWarehouseId, String channelCode,
+                              String regionCode, String pricingTaxMode);
+    boolean channelAvailable(long versionId, long originWarehouseId, String channelCode);
+    ChannelPrefixRow channelPrefix(String channelCode);
+}
diff --git a/firstleg/src/main/java/com/baiyue/firstleg/pricebookquery/application/port/out/PriceBookQueryReader.java b/firstleg/src/main/java/com/baiyue/firstleg/pricebookquery/application/port/out/PriceBookQueryReader.java
new file mode 100644
index 000000000..04d852aab
--- /dev/null
+++ b/firstleg/src/main/java/com/baiyue/firstleg/pricebookquery/application/port/out/PriceBookQueryReader.java
@@ -0,0 +1,21 @@
+package com.baiyue.firstleg.pricebookquery.application.port.out;
+
+import com.baiyue.firstleg.pricebookquery.application.model.PriceBookQueryRows.ChannelPrefixRow;
+import com.baiyue.firstleg.pricebookquery.application.model.PriceBookQueryRows.ChannelRow;
+import com.baiyue.firstleg.pricebookquery.application.model.PriceBookQueryRows.ChannelTaxModeRow;
+import com.baiyue.firstleg.pricebookquery.application.model.PriceBookQueryRows.RateRow;
+
+import java.util.List;
+
+public interface PriceBookQueryReader {
+    Long findActiveVersionId();
+    List<ChannelRow> findChannels(long versionId, long originWarehouseId);
+    List<ChannelTaxModeRow> findChannelTaxModes(long versionId, long originWarehouseId);
+    List<RateRow> findFbaRates(long versionId, long originWarehouseId, String channelCode,
+                               String destinationCode, String pricingTaxMode);
+    List<RateRow> findOverseasRates(long versionId, long originWarehouseId, String channelCode,
+                                    long destinationWarehouseId, String pricingTaxMode);
+    List<RateRow> findRegionTiers(long versionId, long originWarehouseId, String channelCode,
+                                  String regionCode, String pricingTaxMode);
+    ChannelPrefixRow findChannelPrefix(String channelCode);
+}
diff --git a/firstleg/src/main/java/com/baiyue/firstleg/pricing/ActivePriceBookEstimator.java b/firstleg/src/main/java/com/baiyue/firstleg/pricing/ActivePriceBookEstimator.java
index e1733566e..003b4085e 100644
--- a/firstleg/src/main/java/com/baiyue/firstleg/pricing/ActivePriceBookEstimator.java
+++ b/firstleg/src/main/java/com/baiyue/firstleg/pricing/ActivePriceBookEstimator.java
@@ -7,9 +7,9 @@ import com.baiyue.firstleg.domain.PriceRegion;
 import com.baiyue.firstleg.domain.PricingDestinationType;
 import com.baiyue.firstleg.domain.PricingTaxMode;
 import com.baiyue.firstleg.dto.PriceBookDtos.EstimateRequest;
-import com.baiyue.firstleg.repository.PriceBookQueryRepository;
-import com.baiyue.firstleg.repository.PriceBookQueryRows.ChannelRow;
-import com.baiyue.firstleg.repository.PriceBookQueryRows.RateRow;
+import com.baiyue.firstleg.pricebookquery.application.model.PriceBookQueryRows.ChannelRow;
+import com.baiyue.firstleg.pricebookquery.application.model.PriceBookQueryRows.RateRow;
+import com.baiyue.firstleg.pricebookquery.application.port.in.PriceBookQueryUseCase;
 import jakarta.annotation.Resource;
 import org.springframework.stereotype.Component;
 import org.springframework.util.StringUtils;
@@ -21,7 +21,7 @@ import java.util.Locale;
 /** Single active-price-book lookup used by merchant estimates and inbound automatic billing. */
 @Component
 public class ActivePriceBookEstimator {
-    @Resource private PriceBookQueryRepository repository;
+    @Resource private PriceBookQueryUseCase repository;
     @Resource private FbaWarehouseRateEstimator fbaEstimator;
     @Resource private RegionWeightTierEstimator regionEstimator;
     @Resource private PriceBookWarehouseRegionResolver warehouseRegionResolver;
diff --git a/firstleg/src/main/java/com/baiyue/firstleg/pricing/FbaWarehouseRateEstimator.java b/firstleg/src/main/java/com/baiyue/firstleg/pricing/FbaWarehouseRateEstimator.java
index 463252d34..897aef553 100644
--- a/firstleg/src/main/java/com/baiyue/firstleg/pricing/FbaWarehouseRateEstimator.java
+++ b/firstleg/src/main/java/com/baiyue/firstleg/pricing/FbaWarehouseRateEstimator.java
@@ -2,7 +2,7 @@ package com.baiyue.firstleg.pricing;
 
 import com.baiyue.common.core.api.ResultCode;
 import com.baiyue.common.core.exception.BizException;
-import com.baiyue.firstleg.repository.PriceBookQueryRows.RateRow;
+import com.baiyue.firstleg.pricebookquery.application.model.PriceBookQueryRows.RateRow;
 import org.springframework.stereotype.Component;
 
 import java.math.BigDecimal;
diff --git a/firstleg/src/main/java/com/baiyue/firstleg/pricing/RegionWeightTierEstimator.java b/firstleg/src/main/java/com/baiyue/firstleg/pricing/RegionWeightTierEstimator.java
index 426593a10..3b9d25f6e 100644
--- a/firstleg/src/main/java/com/baiyue/firstleg/pricing/RegionWeightTierEstimator.java
+++ b/firstleg/src/main/java/com/baiyue/firstleg/pricing/RegionWeightTierEstimator.java
@@ -2,7 +2,7 @@ package com.baiyue.firstleg.pricing;
 
 import com.baiyue.common.core.api.ResultCode;
 import com.baiyue.common.core.exception.BizException;
-import com.baiyue.firstleg.repository.PriceBookQueryRows.RateRow;
+import com.baiyue.firstleg.pricebookquery.application.model.PriceBookQueryRows.RateRow;
 import org.springframework.stereotype.Component;
 
 import java.math.BigDecimal;
diff --git a/firstleg/src/main/java/com/baiyue/firstleg/repository/ContainerRepository.java b/firstleg/src/main/java/com/baiyue/firstleg/repository/ContainerRepository.java
index 60fbe9d8c..9a425a5e9 100644
--- a/firstleg/src/main/java/com/baiyue/firstleg/repository/ContainerRepository.java
+++ b/firstleg/src/main/java/com/baiyue/firstleg/repository/ContainerRepository.java
@@ -46,7 +46,6 @@ public class ContainerRepository {
     public boolean hasPickTask(long id) { return mapper.hasPickTask(id) > 0; }
     public boolean hasEvidence(long id) { return mapper.hasEvidence(id) > 0; }
     public boolean hasDocuments(long id) { return mapper.hasDocuments(id) > 0; }
-    public boolean hasMismatchedCustomerItems(long id, long customerId) { return mapper.hasMismatchedCustomerItems(id, customerId) > 0; }
     public int updateTransport(long id, String containerNo, String voyageNo, int version,
                                long operatorId, String operatorName) {
         return mapper.updateTransport(id, containerNo, voyageNo, version, operatorId, operatorName);
diff --git a/firstleg/src/main/java/com/baiyue/firstleg/repository/LoadingListRepository.java b/firstleg/src/main/java/com/baiyue/firstleg/repository/LoadingListRepository.java
index 86fad576e..e363c9a2d 100644
--- a/firstleg/src/main/java/com/baiyue/firstleg/repository/LoadingListRepository.java
+++ b/firstleg/src/main/java/com/baiyue/firstleg/repository/LoadingListRepository.java
@@ -106,9 +106,13 @@ public class LoadingListRepository {
                               String fromStatus, String toStatus, String beforeSnapshot,
                               String afterSnapshot, long operatorId, String operatorName,
                               String operationReason) {
-        mapper.insertHistory(new HistoryWrite(IdWorker.getId(), planId, operationId, actionType,
+        int changed = mapper.insertHistory(new HistoryWrite(IdWorker.getId(), planId, operationId, actionType,
             fromStatus, toStatus, beforeSnapshot, afterSnapshot, operatorId, operatorName,
             operationReason));
+        if (changed != 1) {
+            throw new com.baiyue.common.core.exception.BizException(
+                com.baiyue.common.core.api.ResultCode.CONFLICT, "装柜历史已变化，请刷新后重试");
+        }
     }
 
     private Map<Long, List<Customer>> customerMap(List<AggregateRow> rows) {
diff --git a/firstleg/src/main/java/com/baiyue/firstleg/repository/PriceBookQueryRepository.java b/firstleg/src/main/java/com/baiyue/firstleg/repository/PriceBookQueryRepository.java
deleted file mode 100644
index 1161bf9e3..000000000
--- a/firstleg/src/main/java/com/baiyue/firstleg/repository/PriceBookQueryRepository.java
+++ /dev/null
@@ -1,53 +0,0 @@
-package com.baiyue.firstleg.repository;
-
-import com.baiyue.firstleg.mapper.PriceBookQueryMapper;
-import jakarta.annotation.Resource;
-import org.springframework.stereotype.Repository;
-
-import java.util.List;
-
-@Repository
-public class PriceBookQueryRepository {
-    @Resource
-    private PriceBookQueryMapper mapper;
-
-    public Long activeVersionId() {
-        return mapper.findActiveVersionId();
-    }
-
-    public List<PriceBookQueryRows.ChannelRow> channels(long versionId, long originWarehouseId) {
-        return mapper.findChannels(versionId, originWarehouseId);
-    }
-
-    public List<PriceBookQueryRows.ChannelTaxModeRow> channelTaxModes(long versionId, long originWarehouseId) {
-        return mapper.findChannelTaxModes(versionId, originWarehouseId);
-    }
-
-    public List<PriceBookQueryRows.RateRow> fbaRates(long versionId, long originWarehouseId,
-                                                      String channelCode, String destinationCode,
-                                                      String pricingTaxMode) {
-        return mapper.findFbaRates(versionId, originWarehouseId, channelCode, destinationCode, pricingTaxMode);
-    }
-
-    public List<PriceBookQueryRows.RateRow> overseasRates(long versionId, long originWarehouseId,
-                                                           String channelCode, long destinationWarehouseId,
-                                                           String pricingTaxMode) {
-        return mapper.findOverseasRates(versionId, originWarehouseId, channelCode, destinationWarehouseId,
-            pricingTaxMode);
-    }
-
-    public List<PriceBookQueryRows.RateRow> regionTiers(long versionId, long originWarehouseId,
-                                                        String channelCode, String regionCode,
-                                                        String pricingTaxMode) {
-        return mapper.findRegionTiers(versionId, originWarehouseId, channelCode, regionCode, pricingTaxMode);
-    }
-
-    public boolean channelAvailable(long versionId, long originWarehouseId, String channelCode) {
-        return channels(versionId, originWarehouseId).stream()
-            .anyMatch(channel -> channelCode.equals(channel.getChannelCode()));
-    }
-
-    public PriceBookQueryRows.ChannelPrefixRow channelPrefix(String channelCode) {
-        return mapper.findChannelPrefix(channelCode);
-    }
-}
diff --git a/firstleg/src/main/java/com/baiyue/firstleg/service/ContainerService.java b/firstleg/src/main/java/com/baiyue/firstleg/service/ContainerService.java
index cfc7553c4..8a9d5571e 100644
--- a/firstleg/src/main/java/com/baiyue/firstleg/service/ContainerService.java
+++ b/firstleg/src/main/java/com/baiyue/firstleg/service/ContainerService.java
@@ -22,8 +22,8 @@ import com.baiyue.firstleg.mapper.ContainerTransportHistoryMapper;
 import com.baiyue.firstleg.repository.ContainerRepository;
 import com.baiyue.firstleg.repository.LoadingPickRepository;
 import com.baiyue.firstleg.repository.SmartLoadingRepository;
-import com.baiyue.firstleg.repository.PriceBookQueryRepository;
-import com.baiyue.firstleg.repository.PriceBookQueryRows.ChannelRow;
+import com.baiyue.firstleg.pricebookquery.application.model.PriceBookQueryRows.ChannelRow;
+import com.baiyue.firstleg.pricebookquery.application.port.in.PriceBookQueryUseCase;
 import com.baiyue.firstleg.oceanbooking.repository.OceanBookingRepository;
 import com.baiyue.firstleg.oceanbooking.entity.OceanBookingEntity;
 import com.baiyue.firstleg.oceanbooking.entity.OceanBookingContainerRequirementEntity;
@@ -44,7 +44,7 @@ public class ContainerService {
     @Resource private SmartLoadingRepository smartLoadingRepository;
     @Resource private LoadingPickRepository loadingPickRepository;
     @Resource private LoadingPickService loadingPickService;
-    @Resource private PriceBookQueryRepository priceBooks;
+    @Resource private PriceBookQueryUseCase priceBooks;
     @Resource private OceanBookingRepository oceanBookings;
     @Resource private WarehouseSupplierSnapshotService suppliers;
     @Resource private FirstlegDocumentNumberGenerator documentNumbers;
@@ -85,17 +85,14 @@ public class ContainerService {
         if (booking == null || !"RELEASED".equals(booking.getStatus())) throw conflict("只能关联已发布订舱");
         OceanBookingContainerRequirementEntity requirement = oceanBookings.requirement(request.oceanBookingId(), request.requirementId());
         if (requirement == null) throw new BizException(ResultCode.NOT_FOUND, "订舱箱型需求不存在");
-        long allocated = oceanBookings.allocations(request.oceanBookingId()).stream().filter(a -> request.requirementId().equals(a.getRequirementId())).count();
+        long allocated = oceanBookings.activeLinkedCount(request.oceanBookingId(), request.requirementId());
         if (allocated >= requirement.getQuantity()) throw conflict("该订舱箱型需求已达到数量上限");
         if (repository.containerNoExists(request.containerNo().trim(), id)) throw conflict("集装箱号已存在");
         if (!java.util.Objects.equals(container.getWarehouseId(), booking.getWarehouseId())
             || !java.util.Objects.equals(container.getChannelCode(), booking.getChannelCode())
-            || !java.util.Objects.equals(container.getContainerType(), requirement.getContainerType())
-            || container.getCapacityCbm() == null || requirement.getCapacityCbm() == null
-            || container.getMaxWeightKg() == null || requirement.getMaxWeightKg() == null
-            || container.getCapacityCbm().compareTo(requirement.getCapacityCbm()) != 0
-            || container.getMaxWeightKg().compareTo(requirement.getMaxWeightKg()) != 0) throw conflict("模拟柜与真实订舱柜仓库、渠道、箱型或容量不一致");
-        if (booking.getCustomerId() != null && repository.hasMismatchedCustomerItems(id, booking.getCustomerId())) throw conflict("模拟柜已排货客户与真实订舱客户范围不一致");
+            || !java.util.Objects.equals(container.getContainerType(), requirement.getContainerType())) {
+            throw conflict("模拟柜与真实订舱柜仓库、渠道或柜型不一致");
+        }
         if (repository.linkReleasedBooking(id, request.oceanBookingId(), request.requirementId(), request.containerNo().trim(), booking,
             request.expectedVersion(), operatorId, operatorName) != 1) {
             throw conflict("真实订舱柜已被消费或货柜版本发生变化，请刷新后重试");
diff --git a/firstleg/src/main/java/com/baiyue/firstleg/service/FbaPricingService.java b/firstleg/src/main/java/com/baiyue/firstleg/service/FbaPricingService.java
index a5f92a869..025f1776b 100644
--- a/firstleg/src/main/java/com/baiyue/firstleg/service/FbaPricingService.java
+++ b/firstleg/src/main/java/com/baiyue/firstleg/service/FbaPricingService.java
@@ -14,7 +14,7 @@ import com.baiyue.firstleg.entity.InboundFeeItemEntity;
 import com.baiyue.firstleg.entity.InboundPricingEntity;
 import com.baiyue.firstleg.entity.InboundPricingIdempotencyEntity;
 import com.baiyue.firstleg.pricing.ActivePriceBookEstimator;
-import com.baiyue.firstleg.repository.PriceBookQueryRows.RateRow;
+import com.baiyue.firstleg.pricebookquery.application.model.PriceBookQueryRows.RateRow;
 import com.baiyue.firstleg.repository.FbaPricingRepository;
 import org.springframework.stereotype.Service;
 import org.springframework.transaction.annotation.Transactional;
diff --git a/firstleg/src/main/java/com/baiyue/firstleg/service/LoadingListService.java b/firstleg/src/main/java/com/baiyue/firstleg/service/LoadingListService.java
index 2b287f49d..c77be6c49 100644
--- a/firstleg/src/main/java/com/baiyue/firstleg/service/LoadingListService.java
+++ b/firstleg/src/main/java/com/baiyue/firstleg/service/LoadingListService.java
@@ -31,6 +31,7 @@ import com.baomidou.mybatisplus.core.toolkit.IdWorker;
 import feign.FeignException;
 import org.springframework.beans.factory.annotation.Value;
 import org.springframework.dao.DuplicateKeyException;
+import org.springframework.dao.DataIntegrityViolationException;
 import org.springframework.stereotype.Service;
 import org.springframework.context.annotation.Lazy;
 import org.springframework.transaction.annotation.Transactional;
@@ -55,7 +56,7 @@ public class LoadingListService {
     public static final String DELIVERY_ORDER = "DELIVERY_ORDER";
     public static final String PICKUP_ORDER = "PICKUP_ORDER";
     private static final String CLEARANCE_FILE_TYPE = "CONTAINER_CLEARANCE_DOCUMENT";
-    private static final String DECLARATION_FILE_TYPE = "LOADING_CUSTOMS_DOCUMENT";
+    private static final String DECLARATION_FILE_TYPE = "LOADING_CUSTOMS_DECLARATION";
     private static final String DO_FILE_TYPE = "CONTAINER_DELIVERY_ORDER";
     private static final String PU_FILE_TYPE = "CONTAINER_PICKUP_ORDER";
     @Resource
@@ -128,6 +129,41 @@ public class LoadingListService {
         }
         catch(FeignException e){throw new BizException(ResultCode.SERVICE_UNAVAILABLE,"文件服务暂不可用");}
     }
+    public DocumentDownload downloadContainerClearance(long bookingId, long fileId) {
+        requireBookingPlan(bookingId);
+        ContainerDocumentEntity document = repository.document(bookingId, DESTINATION_CLEARANCE);
+        if (document == null || !Long.valueOf(fileId).equals(document.getFileId())) {
+            throw notFound("目的港清关附件不存在或不属于当前货柜");
+        }
+        String businessId = Long.toString(bookingId);
+        try {
+            var metadata = documentFiles.metadata(internalToken, 0, CLEARANCE_FILE_TYPE, businessId, fileId);
+            if (metadata == null || !metadata.successful() || metadata.data() == null
+                || !Long.valueOf(fileId).equals(metadata.data().fileId())
+                || !Long.valueOf(0).equals(metadata.data().tenantId())
+                || !CLEARANCE_FILE_TYPE.equals(metadata.data().businessType())
+                || !businessId.equals(metadata.data().businessId())) {
+                throw notFound("目的港清关附件不存在或归属不匹配");
+            }
+            var response = documentFiles.download(internalToken, 0, CLEARANCE_FILE_TYPE, businessId, fileId);
+            if (response == null || !response.getStatusCode().is2xxSuccessful() || response.getBody() == null) {
+                throw notFound("目的港清关附件不存在");
+            }
+            MediaType contentType;
+            try {
+                contentType = MediaType.parseMediaType(metadata.data().contentType());
+            } catch (RuntimeException exception) {
+                contentType = MediaType.APPLICATION_OCTET_STREAM;
+            }
+            String fileName = StringUtils.hasText(document.getFileName())
+                ? document.getFileName() : metadata.data().fileName();
+            return new DocumentDownload(fileName, contentType, response.getBody());
+        } catch (FeignException.NotFound exception) {
+            throw notFound("目的港清关附件不存在或归属不匹配");
+        } catch (FeignException exception) {
+            throw new BizException(ResultCode.SERVICE_UNAVAILABLE, "文件服务暂不可用");
+        }
+    }
     public record DocumentDownload(String fileName,MediaType contentType,byte[] content) {}
     private static void requireLogisticsType(String type){ if(!DELIVERY_ORDER.equals(type)&&!PICKUP_ORDER.equals(type)) throw badRequest("documentType只能是DELIVERY_ORDER或PICKUP_ORDER"); }
     private static String fileType(String type){ return switch(type){case DELIVERY_ORDER->DO_FILE_TYPE; case PICKUP_ORDER->PU_FILE_TYPE; default->throw badRequest("documentType只能是DELIVERY_ORDER或PICKUP_ORDER");}; }
@@ -169,6 +205,44 @@ public class LoadingListService {
         return document(repository.document(plan.getContainerBookingId(), CUSTOMS_DECLARATION));
     }
 
+    public DocumentDownload downloadLoadingDeclaration(long planId, long warehouseId, long fileId) {
+        AggregateRow plan = requirePlan(planId);
+        requireWarehouse(plan, warehouseId);
+        requireCompletedPlan(plan);
+        ContainerDocumentEntity document = repository.document(plan.getContainerBookingId(), CUSTOMS_DECLARATION);
+        if (document == null || !Long.valueOf(fileId).equals(document.getFileId())) {
+            throw notFound("出口报关附件不存在或不属于当前装柜计划");
+        }
+        String businessId = Long.toString(planId);
+        try {
+            var metadata = documentFiles.metadata(internalToken, 0, DECLARATION_FILE_TYPE, businessId, fileId);
+            if (metadata == null || !metadata.successful() || metadata.data() == null
+                || !Long.valueOf(fileId).equals(metadata.data().fileId())
+                || !Long.valueOf(0).equals(metadata.data().tenantId())
+                || !DECLARATION_FILE_TYPE.equals(metadata.data().businessType())
+                || !businessId.equals(metadata.data().businessId())) {
+                throw notFound("出口报关附件不存在或归属不匹配");
+            }
+            var response = documentFiles.download(internalToken, 0, DECLARATION_FILE_TYPE, businessId, fileId);
+            if (response == null || !response.getStatusCode().is2xxSuccessful() || response.getBody() == null) {
+                throw notFound("出口报关附件不存在");
+            }
+            MediaType contentType;
+            try {
+                contentType = MediaType.parseMediaType(metadata.data().contentType());
+            } catch (RuntimeException exception) {
+                contentType = MediaType.APPLICATION_OCTET_STREAM;
+            }
+            String fileName = StringUtils.hasText(document.getFileName())
+                ? document.getFileName() : metadata.data().fileName();
+            return new DocumentDownload(fileName, contentType, response.getBody());
+        } catch (FeignException.NotFound exception) {
+            throw notFound("出口报关附件不存在或归属不匹配");
+        } catch (FeignException exception) {
+            throw new BizException(ResultCode.SERVICE_UNAVAILABLE, "文件服务暂不可用");
+        }
+    }
+
     @Transactional
     @BusinessAudit(event = "LOADING_CUSTOMS_DOCUMENT_ATTACH", resourceType = "LOADING_PLAN",
         resourceId = "#planId", description = "上传出口报关文档")
@@ -264,12 +338,18 @@ public class LoadingListService {
             if (changed != 1) throw conflict("资料版本已变化，请刷新后重试");
         } catch (DuplicateKeyException exception) {
             throw conflict("资料已被其他操作上传，请刷新后重试");
+        } catch (DataIntegrityViolationException exception) {
+            throw conflict("资料状态或数据库约束已变化，请刷新后重试");
         }
         ContainerDocumentEntity saved = requireDocumentEntity(plan.getContainerBookingId(), documentType);
-        repository.appendHistory(plan.getPlanId(), operationId, actionType,
-            plan.getPlanStatus(), plan.getPlanStatus(), json(beforeSnapshot),
-            json(values("requestHash", requestHash, "document", documentSnapshot(saved))),
-            operatorId, trim(operatorName), trim(operationReason));
+        try {
+            repository.appendHistory(plan.getPlanId(), operationId, actionType,
+                plan.getPlanStatus(), plan.getPlanStatus(), json(beforeSnapshot),
+                json(values("requestHash", requestHash, "document", documentSnapshot(saved))),
+                operatorId, trim(operatorName), trim(operationReason));
+        } catch (DataIntegrityViolationException exception) {
+            throw conflict("资料历史约束已变化，请刷新后重试");
+        }
         return document(saved);
     }
 
diff --git a/firstleg/src/main/java/com/baiyue/firstleg/service/LoadingPickService.java b/firstleg/src/main/java/com/baiyue/firstleg/service/LoadingPickService.java
index 4faf88928..1dcd6ad1a 100644
--- a/firstleg/src/main/java/com/baiyue/firstleg/service/LoadingPickService.java
+++ b/firstleg/src/main/java/com/baiyue/firstleg/service/LoadingPickService.java
@@ -462,10 +462,12 @@ public class LoadingPickService {
         for (LoadingPickItemMapper.InboundOwner owner : owners) {
             LoadingInboundMapper.Snapshot snapshot = repository.inboundForUpdate(owner.tenantId(), owner.inboundId());
             if (snapshot == null) throw conflict("PDA任务关联入库单不存在");
-            loadingDeliveryService.requirePdaCompletionReady(owner.tenantId(), owner.inboundId(),
-                evidenceOwner.inboundId());
+            completionStage(taskId, "完成前业务门禁", () ->
+                loadingDeliveryService.requirePdaCompletionReady(owner.tenantId(), owner.inboundId(),
+                    evidenceOwner.inboundId()));
         }
-        settlementService.settle(taskId, operatorId, operatorName);
+        completionStage(taskId, "拆单与库位结算", () ->
+            settlementService.settle(taskId, operatorId, operatorName));
         if (!repository.allPlanItemsPicked(task.getLoadingPlanId())) {
             throw conflict("柜次仍有未完成PDA拣货的箱数");
         }
@@ -473,18 +475,33 @@ public class LoadingPickService {
             throw conflict("PDA任务已经复核");
         }
         insertOperation(taskId, operationId, requestHash, "COMPLETE_LOADING", operatorId, operatorName);
-        loadingListService.finishFromPda(task.getLoadingPlanId(), taskId, operatorId, operatorName);
+        completionStage(taskId, "装柜计划完成", () ->
+            loadingListService.finishFromPda(task.getLoadingPlanId(), taskId, operatorId, operatorName));
         repository.syncInboundProjections(taskId, operatorId, operatorName);
         for (LoadingPickItemMapper.InboundOwner owner : owners) {
-            loadingDeliveryService.completeAfterPdaSettlement(owner.tenantId(), owner.inboundId(),
-                evidenceOwner.inboundId(), operatorId, operatorName,
-                "PDA-" + operationId + '-' + owner.inboundId(), remark);
+            completionStage(taskId, "入库单状态完成", () ->
+                loadingDeliveryService.completeAfterPdaSettlement(owner.tenantId(), owner.inboundId(),
+                    evidenceOwner.inboundId(), operatorId, operatorName,
+                    "PDA-" + operationId + '-' + owner.inboundId(), remark));
         }
-        loadingListService.publishCompletedEvent(task.getLoadingPlanId());
+        completionStage(taskId, "完成事件发布", () ->
+            loadingListService.publishCompletedEvent(task.getLoadingPlanId()));
         completeTruckAfterCommit(task.getContainerBookingId(), taskId, operatorId, operatorName);
         return view(requiredTask(taskId), null);
     }
 
+    private void completionStage(long taskId, String stage, Runnable action) {
+        try {
+            action.run();
+        } catch (BizException exception) {
+            throw exception;
+        } catch (RuntimeException exception) {
+            log.error("Unexpected PDA loading completion failure taskId={} stage={}", taskId, stage, exception);
+            throw new BizException(ResultCode.INTERNAL_ERROR,
+                "装柜完成在【" + stage + "】阶段处理异常，请联系管理员并提供请求编号");
+        }
+    }
+
     private void completeTruckAfterCommit(long containerBookingId, long taskId,
                                           long operatorId, String operatorName) {
         Runnable completion = () -> {
diff --git a/firstleg/src/main/java/com/baiyue/firstleg/service/MeasurementBatchService.java b/firstleg/src/main/java/com/baiyue/firstleg/service/MeasurementBatchService.java
index eca3c10c2..960dcb8b1 100644
--- a/firstleg/src/main/java/com/baiyue/firstleg/service/MeasurementBatchService.java
+++ b/firstleg/src/main/java/com/baiyue/firstleg/service/MeasurementBatchService.java
@@ -35,6 +35,8 @@ public class MeasurementBatchService {
     /** 已接收第三方测量数据，待平台提交审核。 */
     static final String STATUS_RECEIVED = "RECEIVED";
     static final BigDecimal VOLUME_WEIGHT_FACTOR = new BigDecimal("167");
+    private static final BigDecimal MAX_RAW_VOLUME_CBM = new BigDecimal("999999999999.999999");
+    private static final BigDecimal MAX_TOTAL_VOLUME_CBM = new BigDecimal("99999999999999.9999");
     @Resource
     private InboundMeasurementRepository repository;
     @Resource
@@ -140,7 +142,16 @@ public class MeasurementBatchService {
             BigDecimal unitVolume = weighted.unitVolumeCbm();
             BigDecimal packageCount = BigDecimal.valueOf(source.packageCount());
             BigDecimal totalVolumeRaw = unitVolumeRaw.multiply(packageCount).setScale(6, RoundingMode.HALF_UP);
-            BigDecimal totalVolume = unitVolume.multiply(packageCount).setScale(4, RoundingMode.UNNECESSARY);
+            BigDecimal totalVolume;
+            try {
+                totalVolume = unitVolume.multiply(packageCount).setScale(4, RoundingMode.UNNECESSARY);
+            } catch (ArithmeticException exception) {
+                throw measurementRangeExceeded(source);
+            }
+            if (totalVolumeRaw.compareTo(MAX_RAW_VOLUME_CBM) > 0
+                || totalVolume.compareTo(MAX_TOTAL_VOLUME_CBM) > 0) {
+                throw measurementRangeExceeded(source);
+            }
 
             InboundMeasurementItemEntity item = new InboundMeasurementItemEntity();
             item.setInboundDetailId(source.inboundDetailId());
@@ -169,6 +180,13 @@ public class MeasurementBatchService {
         }).toList();
     }
 
+    private static BizException measurementRangeExceeded(MeasurementBatchCommand.Item source) {
+        return new BizException(ResultCode.VALIDATION_FAILED,
+            "箱规尺寸或箱数超出系统允许范围，明细 " + source.itemNo() + "："
+                + source.lengthCm() + " × " + source.widthCm() + " × " + source.heightCm()
+                + " cm，箱数 " + source.packageCount());
+    }
+
     private void applyTotals(InboundMeasurementEntity measurement,
                              List<InboundMeasurementItemEntity> items) {
         long packages = items.stream().mapToLong(InboundMeasurementItemEntity::getPackageCount).sum();
diff --git a/firstleg/src/main/java/com/baiyue/firstleg/service/MerchantPriceBookService.java b/firstleg/src/main/java/com/baiyue/firstleg/service/MerchantPriceBookService.java
index 87d608bca..d913613d4 100644
--- a/firstleg/src/main/java/com/baiyue/firstleg/service/MerchantPriceBookService.java
+++ b/firstleg/src/main/java/com/baiyue/firstleg/service/MerchantPriceBookService.java
@@ -9,9 +9,9 @@ import com.baiyue.firstleg.dto.PriceBookDtos.EstimateRequest;
 import com.baiyue.firstleg.dto.PriceBookDtos.EstimateResponse;
 import com.baiyue.firstleg.dto.PriceBookChannelValidation.Response;
 import com.baiyue.firstleg.pricing.ActivePriceBookEstimator;
-import com.baiyue.firstleg.repository.PriceBookQueryRepository;
-import com.baiyue.firstleg.repository.PriceBookQueryRows.ChannelRow;
-import com.baiyue.firstleg.repository.PriceBookQueryRows.ChannelTaxModeRow;
+import com.baiyue.firstleg.pricebookquery.application.model.PriceBookQueryRows.ChannelRow;
+import com.baiyue.firstleg.pricebookquery.application.model.PriceBookQueryRows.ChannelTaxModeRow;
+import com.baiyue.firstleg.pricebookquery.application.port.in.PriceBookQueryUseCase;
 import jakarta.annotation.Resource;
 import org.springframework.stereotype.Service;
 import org.springframework.util.StringUtils;
@@ -26,7 +26,7 @@ import java.util.Map;
 public class MerchantPriceBookService {
     public static final String DISCLAIMER = "仅供参考，不含附加费，最终以实际结算为准";
 
-    @Resource private PriceBookQueryRepository repository;
+    @Resource private PriceBookQueryUseCase repository;
     @Resource private ActivePriceBookEstimator estimator;
 
     public List<CurrentChannel> channels(long merchantTenantId, long originWarehouseId) {
diff --git a/firstleg/src/main/resources/db/phase3-carrier-schedule-query-schema.sql b/firstleg/src/main/resources/db/phase3-carrier-schedule-query-schema.sql
index f37916125..0f47efd54 100644
--- a/firstleg/src/main/resources/db/phase3-carrier-schedule-query-schema.sql
+++ b/firstleg/src/main/resources/db/phase3-carrier-schedule-query-schema.sql
@@ -8,11 +8,11 @@ CREATE TABLE IF NOT EXISTS fl_carrier_schedule_query (
   ocean_booking_id BIGINT UNSIGNED NOT NULL COMMENT '关联海运订舱ID',
   container_booking_id BIGINT UNSIGNED NULL COMMENT '指定查询的柜次ID；整票订舱查询时为空',
   container_scope_id BIGINT UNSIGNED GENERATED ALWAYS AS (COALESCE(container_booking_id,0)) STORED COMMENT '柜次唯一作用域计算值；整票订舱查询固定为0',
-  carrier_code VARCHAR(16) NOT NULL COMMENT '船公司编码：MATSON美森、SML森罗、ZIM以星、COSCO中远海运、EMC长荣、HEDE合德',
+  carrier_code VARCHAR(16) NOT NULL COMMENT '船公司标准编码；OTHER表示人工跟踪',
   tracking_type VARCHAR(32) NOT NULL COMMENT '官网跟踪类型：BOOKING_NO订舱号、BILL_OF_LADING提单号、CONTAINER_NO箱号',
   tracking_no VARCHAR(128) NOT NULL COMMENT '提交至船公司官网的跟踪号码',
   official_url VARCHAR(500) NOT NULL COMMENT '船公司官网查询入口地址快照',
-  access_mode VARCHAR(32) NOT NULL COMMENT '船司访问方式：PUBLIC_FORM、PUBLIC_WEB_PROXY、PUBLIC_HTML、HCAPTCHA、OFFICIAL_API',
+  access_mode VARCHAR(32) NOT NULL COMMENT '船司访问方式；MANUAL表示仅人工补录节点',
   status VARCHAR(24) NOT NULL COMMENT '任务操作状态：READY、MANUAL_REQUIRED、STOPPED',
   trigger_source VARCHAR(32) NOT NULL DEFAULT 'MANUAL' COMMENT '任务触发来源：OUTBOUND_CONFIRM或MANUAL',
   latest_standard_node VARCHAR(32) NULL COMMENT '最近实际标准船节点；预计事实不推进',
@@ -54,11 +54,11 @@ CREATE TABLE IF NOT EXISTS fl_carrier_schedule_query (
   CONSTRAINT fk_carrier_schedule_query_result FOREIGN KEY (result_port_schedule_id) REFERENCES fl_port_schedule(id),
   CONSTRAINT chk_carrier_schedule_query_customer CHECK (customer_id > 0),
   CONSTRAINT chk_carrier_schedule_query_carrier CHECK
-    (carrier_code IN ('MATSON','SML','ZIM','COSCO','EMC','HEDE')),
+    (carrier_code IN ('MATSON','SML','ZIM','COSCO','EMC','HEDE','OTHER')),
   CONSTRAINT chk_carrier_schedule_query_tracking CHECK
     (tracking_type IN ('BOOKING_NO','BILL_OF_LADING','CONTAINER_NO')),
   CONSTRAINT chk_carrier_schedule_query_access CHECK
-    (access_mode IN ('PUBLIC_FORM','PUBLIC_WEB_PROXY','PUBLIC_HTML','HCAPTCHA','OFFICIAL_API')),
+    (access_mode IN ('PUBLIC_FORM','PUBLIC_WEB_PROXY','PUBLIC_HTML','HCAPTCHA','OFFICIAL_API','MANUAL')),
   CONSTRAINT chk_carrier_schedule_query_status CHECK
     (status IN ('READY','MANUAL_REQUIRED','STOPPED')),
   CONSTRAINT chk_carrier_schedule_query_node CHECK
diff --git a/firstleg/src/main/resources/db/phase3-ocean-booking-schema.sql b/firstleg/src/main/resources/db/phase3-ocean-booking-schema.sql
index 6512d8b88..3e9a30339 100644
--- a/firstleg/src/main/resources/db/phase3-ocean-booking-schema.sql
+++ b/firstleg/src/main/resources/db/phase3-ocean-booking-schema.sql
@@ -14,6 +14,7 @@ CREATE TABLE IF NOT EXISTS fl_ocean_booking (
   bill_of_lading_no VARCHAR(128) NULL COMMENT '提单号',
   shipping_company_id BIGINT UNSIGNED NULL COMMENT '船公司逻辑ID快照',
   shipping_company_name VARCHAR(128) NULL COMMENT '船公司名称快照',
+  carrier_code VARCHAR(16) NULL COMMENT '船司标准编码：MATSON/SML/ZIM/COSCO/EMC/HEDE/OTHER；发布前必填',
   booking_agent_id BIGINT UNSIGNED NULL COMMENT '订舱代理逻辑ID快照',
   booking_agent_name VARCHAR(128) NULL COMMENT '订舱代理名称快照',
   vessel_name VARCHAR(128) NULL COMMENT '当前确认船名快照',
@@ -42,6 +43,8 @@ CREATE TABLE IF NOT EXISTS fl_ocean_booking (
   CONSTRAINT chk_ocean_booking_customer CHECK (customer_id > 0),
   CONSTRAINT chk_ocean_booking_status CHECK (status IN
     ('DRAFT','RELEASED')),
+  CONSTRAINT chk_ocean_booking_carrier_code CHECK
+    (carrier_code IS NULL OR carrier_code IN ('MATSON','SML','ZIM','COSCO','EMC','HEDE','OTHER')),
   CONSTRAINT chk_ocean_booking_schedule CHECK
     (estimated_sailing_at IS NULL OR estimated_arrival_at IS NULL OR estimated_arrival_at >= estimated_sailing_at)
 ) ENGINE=InnoDB COMMENT='独立海运订舱聚合；柜次仍由fl_container_booking承载';
diff --git a/firstleg/src/main/resources/db/phase3-simple-customs-document-migration.sql b/firstleg/src/main/resources/db/phase3-simple-customs-document-migration.sql
index 552d13600..1ee186d2b 100644
--- a/firstleg/src/main/resources/db/phase3-simple-customs-document-migration.sql
+++ b/firstleg/src/main/resources/db/phase3-simple-customs-document-migration.sql
@@ -70,7 +70,7 @@ BEGIN
   SELECT MAX(plan_status) INTO current_plan_status FROM fl_loading_plan
    WHERE container_booking_id = NEW.container_booking_id;
   IF current_plan_status = 'COMPLETED'
-     AND NEW.document_type NOT IN ('DESTINATION_CLEARANCE', 'CUSTOMS_DECLARATION') THEN
+     AND NEW.document_type NOT IN ('DESTINATION_CLEARANCE', 'CUSTOMS_DECLARATION', 'DELIVERY_ORDER', 'PICKUP_ORDER') THEN
     SIGNAL SQLSTATE '45000' SET MESSAGE_TEXT = '装柜完成后货柜物流文件不可新增';
   END IF;
 END$$
@@ -84,7 +84,7 @@ BEGIN
   SELECT MAX(plan_status) INTO current_plan_status FROM fl_loading_plan
    WHERE container_booking_id = OLD.container_booking_id;
   IF current_plan_status = 'COMPLETED'
-     AND OLD.document_type NOT IN ('DESTINATION_CLEARANCE', 'CUSTOMS_DECLARATION') THEN
+     AND OLD.document_type NOT IN ('DESTINATION_CLEARANCE', 'CUSTOMS_DECLARATION', 'DELIVERY_ORDER', 'PICKUP_ORDER') THEN
     SIGNAL SQLSTATE '45000' SET MESSAGE_TEXT = '装柜完成后货柜物流文件不可修改';
   END IF;
 END$$
diff --git a/firstleg/src/main/resources/db/phase3-smart-loading-schema.sql b/firstleg/src/main/resources/db/phase3-smart-loading-schema.sql
index ab4efc31c..5033d5924 100644
--- a/firstleg/src/main/resources/db/phase3-smart-loading-schema.sql
+++ b/firstleg/src/main/resources/db/phase3-smart-loading-schema.sql
@@ -1122,7 +1122,7 @@ BEGIN
   SELECT MAX(plan_status) INTO current_plan_status FROM fl_loading_plan
    WHERE container_booking_id = NEW.container_booking_id;
   IF current_plan_status = 'COMPLETED'
-     AND NEW.document_type NOT IN ('DESTINATION_CLEARANCE', 'CUSTOMS_DECLARATION') THEN
+     AND NEW.document_type NOT IN ('DESTINATION_CLEARANCE', 'CUSTOMS_DECLARATION', 'DELIVERY_ORDER', 'PICKUP_ORDER') THEN
     SIGNAL SQLSTATE '45000' SET MESSAGE_TEXT = '装柜完成后货柜文件不可新增';
   END IF;
 END$$
@@ -1138,7 +1138,7 @@ BEGIN
   SELECT MAX(plan_status) INTO current_plan_status FROM fl_loading_plan
    WHERE container_booking_id = OLD.container_booking_id;
   IF current_plan_status = 'COMPLETED'
-     AND OLD.document_type NOT IN ('DESTINATION_CLEARANCE', 'CUSTOMS_DECLARATION') THEN
+     AND OLD.document_type NOT IN ('DESTINATION_CLEARANCE', 'CUSTOMS_DECLARATION', 'DELIVERY_ORDER', 'PICKUP_ORDER') THEN
     SIGNAL SQLSTATE '45000' SET MESSAGE_TEXT = '装柜完成后货柜文件不可修改';
   END IF;
 END$$
diff --git a/firstleg/src/main/resources/openapi/carrier-schedule-query-v1.yaml b/firstleg/src/main/resources/openapi/carrier-schedule-query-v1.yaml
index 4f6dd8f73..5fac3399f 100644
--- a/firstleg/src/main/resources/openapi/carrier-schedule-query-v1.yaml
+++ b/firstleg/src/main/resources/openapi/carrier-schedule-query-v1.yaml
@@ -18,7 +18,7 @@ paths:
         - {name: customerId, in: query, schema: {type: integer, format: int64, minimum: 1}}
         - {name: oceanBookingId, in: query, schema: {type: integer, format: int64, minimum: 1}}
         - {name: containerBookingId, in: query, schema: {type: integer, format: int64, minimum: 1}}
-        - {name: carrierCode, in: query, schema: {$ref: '#/components/schemas/CarrierCode'}}
+        - {name: carrierCode, in: query, schema: {$ref: '#/components/schemas/TaskCarrierCode'}}
         - {name: status, in: query, schema: {$ref: '#/components/schemas/QueryStatus'}}
         - {name: expired, in: query, schema: {type: boolean}}
         - {name: keyword, in: query, schema: {type: string, maxLength: 128}}
@@ -82,7 +82,9 @@ paths:
             schema: {$ref: '#/components/schemas/ManualNodeRequest'}
       responses:
         '200':
-          description: Idempotent fact append; only actualAt advances and actual EMPTY_RETURNED stops
+          description: Idempotent fact append; estimated facts never advance actual progress, while a manual actual fact must have a strictly greater standard-node sequence than latestActualNode and actual EMPTY_RETURNED stops
+        '409':
+          description: A0409 when expectedVersion is stale or a manual actual node is equal to or earlier than latestActualNode
           content: {application/json: {schema: {$ref: '#/components/schemas/DetailEnvelope'}}}
 components:
   parameters:
@@ -90,6 +92,10 @@ components:
     IdempotencyKey: {name: Idempotency-Key, in: header, required: true, schema: {type: string, minLength: 1, maxLength: 128}}
   schemas:
     CarrierCode: {type: string, enum: [MATSON, SML, ZIM, COSCO, EMC, HEDE]}
+    TaskCarrierCode:
+      type: string
+      enum: [MATSON, SML, ZIM, COSCO, EMC, HEDE, OTHER]
+      description: OTHER is frozen on the ocean booking and creates a manual-only task after outbound confirmation.
     TrackingType: {type: string, enum: [BOOKING_NO, BILL_OF_LADING, CONTAINER_NO]}
     QueryStatus: {type: string, enum: [READY, MANUAL_REQUIRED, STOPPED]}
     StandardNode:
@@ -118,7 +124,7 @@ components:
     ManualNodeRequest:
       type: object
       required: [expectedVersion, standardNode, observedAt, reason]
-      description: estimatedAt and actualAt cannot both be null; estimatedAt never advances the latest actual node.
+      description: estimatedAt and actualAt cannot both be null; estimatedAt never advances the latest actual node; when actualAt is present, standardNode must have a strictly greater sequence than latestActualNode.
       properties:
         expectedVersion: {type: integer, minimum: 0}
         standardNode: {$ref: '#/components/schemas/StandardNode'}
@@ -137,11 +143,15 @@ components:
         customerId: {type: integer, format: int64}
         oceanBookingId: {type: integer, format: int64}
         containerBookingId: {type: integer, format: int64, nullable: true}
-        carrierCode: {$ref: '#/components/schemas/CarrierCode'}
+        carrierCode: {$ref: '#/components/schemas/TaskCarrierCode'}
         trackingType: {$ref: '#/components/schemas/TrackingType'}
         trackingNo: {type: string}
         officialUrl: {type: string, nullable: true}
-        accessMode: {type: string, nullable: true}
+        accessMode:
+          type: string
+          enum: [PUBLIC_FORM, PUBLIC_WEB_PROXY, PUBLIC_HTML, HCAPTCHA, OFFICIAL_API, MANUAL]
+          nullable: true
+          description: MANUAL tasks preserve physical outbound confirmation and accept platform manual node facts without scheduler/provider calls.
         status: {$ref: '#/components/schemas/QueryStatus'}
         triggerSource: {type: string}
         latestActualNode: {allOf: [{$ref: '#/components/schemas/StandardNode'}], nullable: true}
@@ -150,7 +160,10 @@ components:
         sourceUpdatedAt: {type: string, format: date-time, nullable: true}
         expiresAt: {type: string, format: date-time, nullable: true}
         resultPortScheduleId: {type: integer, format: int64, nullable: true}
-        manualReason: {type: string, nullable: true}
+        manualReason:
+          type: string
+          nullable: true
+          description: Explicit provider-disabled or unsupported-carrier reason; unsupported outbound carriers retain the booking shippingCompanyId/name here and through oceanBookingId.
         lastErrorCode: {type: string, nullable: true}
         lastErrorMessage: {type: string, nullable: true}
         stoppedAt: {type: string, format: date-time, nullable: true}
diff --git a/firstleg/src/main/resources/openapi/firstleg-v1.yaml b/firstleg/src/main/resources/openapi/firstleg-v1.yaml
index 652cd8003..6b4dc5e8e 100644
--- a/firstleg/src/main/resources/openapi/firstleg-v1.yaml
+++ b/firstleg/src/main/resources/openapi/firstleg-v1.yaml
@@ -356,6 +356,16 @@ paths:
         required: true
         content: {application/json: {schema: {$ref: '#/components/schemas/ContainerDocumentAttachRequest'}}}
       responses: {'200': {description: 成功、文件归属不匹配或版本冲突}}
+  /api/platform/v1/containers/{id}/clearance/document/{fileId}/download:
+    get:
+      summary: 下载货柜目的港清关附件
+      description: 需要 platform:firstleg:customs:manage 权限；服务端校验当前 DESTINATION_CLEARANCE fileId 及 File 业务归属，完成态仍可下载，响应禁止缓存
+      parameters:
+        - {$ref: '#/components/parameters/ContainerBookingId'}
+        - {name: fileId, in: path, required: true, schema: {type: string, pattern: '^[1-9][0-9]*$'}}
+      responses:
+        '200': {description: 附件二进制内容，包含 Content-Disposition 与 Cache-Control no-store}
+        '404': {description: 当前附件不存在或归属不匹配}
   /api/platform/v1/containers/{id}/clearance/document/upload:
     post:
       summary: 直接选择文件上传或替换货柜目的港清关资料
diff --git a/firstleg/src/main/resources/openapi/loading-lists-v1.yaml b/firstleg/src/main/resources/openapi/loading-lists-v1.yaml
index 59c5fbc0d..18b436f15 100644
--- a/firstleg/src/main/resources/openapi/loading-lists-v1.yaml
+++ b/firstleg/src/main/resources/openapi/loading-lists-v1.yaml
@@ -99,6 +99,29 @@ paths:
         content: {application/json: {schema: {$ref: '#/components/schemas/DocumentAttachRequest'}}}
       responses:
         '200': {$ref: '#/components/responses/BusinessDocumentResponse'}
+  /api/platform/v1/first-leg/loading-lists/{planId}/customs/document/{fileId}/download:
+    get:
+      summary: 下载装柜清单出口报关附件
+      description: 完成态仍可下载。服务端校验 planId、warehouseId、当前 CUSTOMS_DECLARATION 的 fileId，以及 File 元数据 tenantId=0、businessType=LOADING_CUSTOMS_DECLARATION、businessId=planId；错误 fileId 或归属返回 A0404。响应使用 attachment 文件名并禁止缓存。
+      x-permission: platform:firstleg:loading-list:list
+      parameters:
+        - {$ref: '#/components/parameters/PlanId'}
+        - {$ref: '#/components/parameters/WarehouseId'}
+        - name: fileId
+          in: path
+          required: true
+          description: File 服务长整型文件 ID
+          schema: {$ref: '#/components/schemas/LongId'}
+      responses:
+        '200':
+          description: 报关附件二进制内容；包含 Content-Disposition，Cache-Control 为 no-store
+          headers:
+            Content-Disposition: {schema: {type: string}}
+            Cache-Control: {schema: {type: string, example: no-store}}
+          content:
+            application/octet-stream:
+              schema: {type: string, format: binary}
+        '404': {description: 装柜计划、仓库、当前附件或 File 归属不匹配}
   /api/platform/v1/first-leg/loading-lists/{planId}/customs/document/upload:
     post:
       summary: 直接选择文件上传或替换装柜清单出口报关文档
diff --git a/firstleg/src/main/resources/openapi/ocean-bookings-v1.yaml b/firstleg/src/main/resources/openapi/ocean-bookings-v1.yaml
index 363e22b73..85d652016 100644
--- a/firstleg/src/main/resources/openapi/ocean-bookings-v1.yaml
+++ b/firstleg/src/main/resources/openapi/ocean-bookings-v1.yaml
@@ -2,7 +2,12 @@ openapi: 3.0.3
 info: {title: Ocean Booking API, version: 2.0.0}
 paths:
   /api/platform/v1/ocean-bookings:
-    get: {summary: List DRAFT and RELEASED bookings, responses: {'200': {description: Booking page}}}
+    get:
+      summary: List DRAFT and RELEASED bookings
+      description: containerCount is the sum of quantity across all container requirements for the booking. It is zero when no requirement exists and never represents linked or ACTIVE containers.
+      responses:
+        '200':
+          description: Booking page; each row uses the frozen requirement-total containerCount semantic
     post:
       summary: Create an editable DRAFT
       description: Creates only the booking aggregate and container requirements; no containerNo, container row, or allocation is created.
@@ -28,6 +33,23 @@ paths:
       parameters: [{$ref: '#/components/parameters/OceanBookingId'}, {$ref: '#/components/parameters/IdempotencyKey'}]
       requestBody: {required: true, content: {application/json: {schema: {$ref: '#/components/schemas/ReleaseRequest'}}}}
       responses: {'200': {description: RELEASED detail}}
+  /api/platform/v1/ocean-bookings/link-candidates:
+    get:
+      summary: Page released booking requirement candidates for one container
+      description: Requires platform:firstleg:ocean-booking:list. Returns only linkable requirement candidates: RELEASED, remainingQuantity greater than zero, and exact warehouseId, channelCode and containerType. Capacity and max weight are derived display snapshots and never eligibility fields. Allocated quantity counts only ACTIVE containers still pointing to the same booking requirement and is calculated by one bounded set query; booking detail calls are not used. An empty result is a normal successful page. Final target-container mutability is revalidated by the link command.
+      x-permission: platform:firstleg:ocean-booking:list
+      parameters:
+        - {name: warehouseId, in: query, required: true, schema: {type: integer, format: int64, minimum: 1}}
+        - {name: channelCode, in: query, required: true, schema: {type: string, maxLength: 64}}
+        - {name: containerType, in: query, required: true, schema: {type: string, maxLength: 32}}
+        - {name: page, in: query, required: false, schema: {type: integer, format: int64, minimum: 1, default: 1}}
+        - {name: size, in: query, required: false, schema: {type: integer, format: int64, minimum: 1, maximum: 200, default: 20}}
+      responses:
+        '200':
+          description: Business envelope containing a bounded candidate page
+          content:
+            application/json:
+              schema: {$ref: '#/components/schemas/LinkCandidateResponse'}
   /api/platform/v1/ocean-bookings/channels:
     get:
       summary: List ACTIVE channels for an origin warehouse
@@ -58,6 +80,11 @@ components:
         billOfLadingNo: {type: string, nullable: true}
         shippingCompanyId: {type: integer, format: int64, nullable: true}
         shippingCompanyName: {type: string, nullable: true}
+        carrierCode:
+          type: string
+          enum: [MATSON, SML, ZIM, COSCO, EMC, HEDE, OTHER]
+          nullable: true
+          description: Frozen standard carrier code. Required before RELEASE; OTHER means manual carrier-node tracking.
         bookingAgentId:
           type: integer
           format: int64
@@ -94,6 +121,46 @@ components:
         channelName: {type: string}
         priceModel: {type: string}
         pricingTaxModes: {type: array, items: {type: string}}
+    LinkCandidate:
+      type: object
+      required: [oceanBookingId, bookingNo, requirementId, containerType, capacityCbm, maxWeightKg, requiredQuantity, allocatedQuantity, remainingQuantity, customerName, warehouseName, channelName]
+      properties:
+        oceanBookingId: {type: string, pattern: '^[0-9]+$'}
+        bookingNo: {type: string}
+        requirementId: {type: string, pattern: '^[0-9]+$'}
+        containerType: {type: string}
+        capacityCbm: {type: number}
+        maxWeightKg: {type: number}
+        requiredQuantity: {type: integer, minimum: 1}
+        allocatedQuantity: {type: integer, format: int64, minimum: 0}
+        remainingQuantity: {type: integer, format: int64, minimum: 1}
+        customerName: {type: string}
+        warehouseName: {type: string}
+        channelName: {type: string}
+    LinkCandidatePage:
+      type: object
+      required: [records, page, size, total, pages]
+      properties:
+        records: {type: array, items: {$ref: '#/components/schemas/LinkCandidate'}}
+        page: {type: integer, format: int64, minimum: 1}
+        size: {type: integer, format: int64, minimum: 1}
+        total: {type: integer, format: int64, minimum: 0}
+        pages: {type: integer, format: int64, minimum: 0}
+    LinkCandidateResponse:
+      type: object
+      required: [code, data]
+      properties:
+        code: {type: string, example: '200'}
+        message: {type: string, nullable: true}
+        data: {$ref: '#/components/schemas/LinkCandidatePage'}
+    OceanBookingListRow:
+      type: object
+      properties:
+        containerCount:
+          type: integer
+          format: int64
+          minimum: 0
+          description: Sum of all container requirement quantities; independent of allocation, linking or unlinking.
     Detail:
       type: object
       required: [oceanBooking, parties, containerRequirements, containers, histories]
diff --git a/firstleg/src/main/resources/openapi/phase3-container-overview-v1.yaml b/firstleg/src/main/resources/openapi/phase3-container-overview-v1.yaml
index 2b7420a4d..47bf7403f 100644
--- a/firstleg/src/main/resources/openapi/phase3-container-overview-v1.yaml
+++ b/firstleg/src/main/resources/openapi/phase3-container-overview-v1.yaml
@@ -36,6 +36,12 @@ paths:
       description: '权限：platform:firstleg:container:list；Firstleg代理File内部下载，不向调用方暴露内部令牌'
       parameters: [{$ref: '#/components/parameters/ContainerId'}, {$ref: '#/components/parameters/DocumentType'}, {name: fileId, in: path, required: true, schema: {type: integer, format: int64}}]
       responses: {'200': {description: file bytes, content: {application/octet-stream: {schema: {type: string, format: binary}}}}}
+  /api/platform/v1/containers/{id}/clearance/document/{fileId}/download:
+    get:
+      operationId: downloadContainerDestinationClearance
+      description: '权限：platform:firstleg:customs:manage；校验当前 DESTINATION_CLEARANCE fileId 以及 File tenantId=0、businessType=CONTAINER_CLEARANCE_DOCUMENT、businessId=id；返回 attachment 与 no-store，完成态仍可下载'
+      parameters: [{$ref: '#/components/parameters/ContainerId'}, {name: fileId, in: path, required: true, schema: {type: integer, format: int64}}]
+      responses: {'200': {description: clearance file bytes, content: {application/octet-stream: {schema: {type: string, format: binary}}}}, '404': {description: current file or ownership mismatch}}
 components:
   parameters:
     ContainerId: {name: id, in: path, required: true, schema: {type: integer, format: int64}}
@@ -51,7 +57,7 @@ components:
         container: {$ref: '#/components/schemas/Container'}
         loadingPlanId: {type: integer, format: int64}
         pda: {$ref: '#/components/schemas/PdaSummary'}
-        documents: {type: array, items: {$ref: '#/components/schemas/Document'}}
+        documents: {type: array, description: '按 documentType 稳定排序返回 DESTINATION_CLEARANCE、CUSTOMS_DECLARATION、DELIVERY_ORDER、PICKUP_ORDER 的当前唯一记录和真实 version', items: {$ref: '#/components/schemas/Document'}}
         exception: {$ref: '#/components/schemas/ExceptionState'}
         exceptionHistory: {type: array, items: {$ref: '#/components/schemas/ExceptionHistory'}}
         timeline: {type: array, items: {$ref: '#/components/schemas/TimelineEntry'}}
@@ -59,7 +65,7 @@ components:
     PdaSummary: {type: object, properties: {taskId: {type: integer, format: int64}, loadingPlanId: {type: integer, format: int64}, containerBookingId: {type: integer, format: int64}, taskStatus: {type: string, description: '持久化任务态：LOADING/COMPLETED'}, workflowStatus: {type: string, enum: [IN_PROGRESS, AWAITING_REVIEW, COMPLETED], description: 'PDA作业展示态'}, taskVersion: {type: integer}, itemCount: {type: integer}, completedItemCount: {type: integer}, unresolvedItemCount: {type: integer}, photoCounts: {type: array, items: {$ref: '#/components/schemas/PhotoCount'}}, photos: {type: array, items: {$ref: '#/components/schemas/Photo'}}, exceptionReasons: {type: array, items: {type: string}}}}
     PhotoCount: {type: object, properties: {evidenceType: {type: string}, count: {type: integer}}}
     Photo: {type: object, properties: {evidenceId: {type: integer, format: int64}, tenantId: {type: integer, format: int64}, inboundId: {type: integer, format: int64}, evidenceType: {type: string}, fileId: {type: integer, format: int64}, fileName: {type: string}, status: {type: string, enum: [ACTIVE, VOID]}, downloadPath: {type: string, nullable: true, description: '仅 ACTIVE 照片提供鉴权下载路径；VOID 历史照片为空'}, uploadedAt: {type: string, format: date-time}}}
-    Document: {type: object, properties: {id: {type: integer, format: int64}, documentType: {type: string}, fileId: {type: integer, format: int64}, fileName: {type: string}, fileHash: {type: string}, uploadedBy: {type: integer, format: int64}, uploadedByName: {type: string}, uploadedAt: {type: string, format: date-time}, version: {type: integer}, completed: {type: boolean}}}
+    Document: {type: object, properties: {id: {type: integer, format: int64}, documentType: {type: string, enum: [DESTINATION_CLEARANCE, CUSTOMS_DECLARATION, DELIVERY_ORDER, PICKUP_ORDER]}, fileId: {type: integer, format: int64}, fileName: {type: string}, fileHash: {type: string}, uploadedBy: {type: integer, format: int64}, uploadedByName: {type: string}, uploadedAt: {type: string, format: date-time}, version: {type: integer, description: '当前唯一记录的真实乐观锁版本；更新时必须原样作为 expectedVersion'}, completed: {type: boolean}}}
     ExceptionState: {type: object, properties: {active: {type: boolean}, reason: {type: string}, markedBy: {type: integer, format: int64}, markedByName: {type: string}, markedAt: {type: string, format: date-time}}}
     ExceptionHistory: {type: object, properties: {id: {type: integer, format: int64}, action: {type: string, enum: [MARK, CANCEL]}, reason: {type: string}, operatorId: {type: integer, format: int64}, operatorName: {type: string}, occurredAt: {type: string, format: date-time}}}
     TimelineEntry: {type: object, properties: {eventType: {type: string}, detail: {type: string}, operatorId: {type: integer, format: int64}, operatorName: {type: string}, occurredAt: {type: string, format: date-time}}}
diff --git a/firstleg/src/main/resources/openapi/phase3-outbound-dispatch-v1.yaml b/firstleg/src/main/resources/openapi/phase3-outbound-dispatch-v1.yaml
index 8553a2767..364c0b142 100644
--- a/firstleg/src/main/resources/openapi/phase3-outbound-dispatch-v1.yaml
+++ b/firstleg/src/main/resources/openapi/phase3-outbound-dispatch-v1.yaml
@@ -1,85 +1,117 @@
 openapi: 3.0.3
 info:
-  title: Phase 3 Domestic Outbound Dispatch API
-  version: 1.0.0
+  title: Phase 3 Container-level Domestic Outbound Dispatch API
+  version: 2.0.0
 paths:
   /api/platform/v1/first-leg/outbound-dispatches:
     get:
-      summary: Query outbound aggregates by order, inbound or container
+      summary: Query the outbound aggregate for one container booking
+      description: Returns one container-level aggregate containing every real inbound binding. No per-inbound partial outbound aggregate is exposed.
+      x-permission: platform:firstleg:outbound-dispatch:list
       parameters:
-        - {$ref: '#/components/parameters/OrderId'}
-        - {$ref: '#/components/parameters/InboundId'}
-        - {$ref: '#/components/parameters/ContainerBookingId'}
+        - {$ref: '#/components/parameters/ContainerBookingIdQuery'}
       responses:
         '200':
-          description: Business envelope containing matching aggregates, each with stable cabinetNo and real containerNo
+          description: Business envelope containing a single matching aggregate in a list
           content:
             application/json:
               schema:
                 type: object
                 properties:
                   data: {type: array, items: {$ref: '#/components/schemas/Aggregate'}}
-  /api/platform/v1/first-leg/outbound-dispatches/detail:
+  /api/platform/v1/first-leg/outbound-dispatches/{containerBookingId}:
     get:
-      summary: Query one aggregate and its unified timeline
+      summary: Query one container-level aggregate and unified timeline
+      x-permission: platform:firstleg:outbound-dispatch:view
       parameters:
-        - {$ref: '#/components/parameters/OrderId'}
-        - {$ref: '#/components/parameters/InboundId'}
-        - {$ref: '#/components/parameters/ContainerBookingId'}
+        - {$ref: '#/components/parameters/ContainerBookingIdPath'}
       responses:
         '200':
-          description: Business envelope containing aggregate detail
+          description: Business envelope containing all inbound bindings and one visible dispatch version
           content:
             application/json:
               schema:
                 type: object
                 properties:
-                  data:
-                    type: object
-                    properties:
-                      aggregate: {$ref: '#/components/schemas/Aggregate'}
-  /api/platform/v1/first-leg/outbound-dispatches/check-gate:
+                  data: {$ref: '#/components/schemas/Detail'}
+  /api/platform/v1/first-leg/outbound-dispatches/{containerBookingId}/gate:
     get:
-      summary: Evaluate the fail-closed domestic outbound gate
+      summary: Evaluate every inbound binding in the fail-closed container outbound gate
+      description: Loading evidence is evaluated once for the physical container/loading plan and the same result applies to every inbound binding. The customs gate is resolved once from the current container CUSTOMS_DECLARATION whose completedAt must be non-null; upload alone remains blocked and fl_customs_case is not an alternative gate fact. A missing standalone sailing schedule is reference-only and never affects gate.passed.
+      x-permission: platform:firstleg:outbound-dispatch:check
       parameters:
-        - {$ref: '#/components/parameters/OrderId'}
-        - {$ref: '#/components/parameters/InboundId'}
-        - {$ref: '#/components/parameters/ContainerBookingId'}
+        - {$ref: '#/components/parameters/ContainerBookingIdPath'}
       responses:
-        '200': {description: Business envelope containing every gate item}
-  /api/platform/v1/first-leg/outbound-dispatches/confirm-dispatch:
+        '200': {description: Business envelope containing the container gate and per-inbound gate results}
+  /api/platform/v1/first-leg/outbound-dispatches/{containerBookingId}/confirm:
     post:
-      summary: Confirm domestic dispatch and enter WAITING_FOR_LOADING
+      summary: Atomically confirm domestic departure for the entire container
+      description: Locks every real inbound binding, requires every gate to pass, advances all technical rows in one transaction, records one visible history, and creates the CarrierScheduleQuery/DEPARTED_WAREHOUSE fact once. No partial success is possible.
+      x-permission: platform:firstleg:outbound-dispatch:confirm
       parameters:
+        - {$ref: '#/components/parameters/ContainerBookingIdPath'}
         - {$ref: '#/components/parameters/IdempotencyKey'}
       requestBody:
         required: true
         content:
           application/json: {schema: {$ref: '#/components/schemas/ActionRequest'}}
       responses:
-        '200': {description: Business envelope; gate or version failures use business error code}
-  /api/platform/v1/first-leg/outbound-dispatches/reverse-dispatch:
+        '200': {description: Same key and same payload replays the single container-level result; stale version or changed payload returns A0409}
+  /api/platform/v1/first-leg/outbound-dispatches/{containerBookingId}/reverse:
     post:
-      summary: Reverse WAITING_FOR_LOADING only before maritime tracking starts
-      description: Once an actual DEPARTED_WAREHOUSE node exists, reversal is rejected with business code A0409 so READY_FOR_DISPATCH cannot coexist with maritime tracking.
+      summary: Atomically reverse the entire container before any actual shipping node exists
+      description: Once an actual DEPARTED_WAREHOUSE node exists, reversal is rejected with business code A0409 so an outbound fact can never coexist with READY_FOR_DISPATCH.
+      x-permission: platform:firstleg:outbound-dispatch:reverse
       parameters:
+        - {$ref: '#/components/parameters/ContainerBookingIdPath'}
         - {$ref: '#/components/parameters/IdempotencyKey'}
       requestBody:
         required: true
         content:
           application/json: {schema: {$ref: '#/components/schemas/ActionRequest'}}
       responses:
-        '200': {description: Business envelope containing reverted aggregate}
+        '200': {description: Business envelope containing the reverted container aggregate}
 components:
   parameters:
-    OrderId: {name: orderId, in: query, schema: {type: integer, format: int64, minimum: 1}}
-    InboundId: {name: inboundId, in: query, schema: {type: integer, format: int64, minimum: 1}}
-    ContainerBookingId: {name: containerBookingId, in: query, schema: {type: integer, format: int64, minimum: 1}}
-    IdempotencyKey: {name: Idempotency-Key, in: header, required: true, schema: {type: string, maxLength: 128}}
+    ContainerBookingIdQuery:
+      name: containerBookingId
+      in: query
+      required: true
+      schema: {type: integer, format: int64, minimum: 1}
+    ContainerBookingIdPath:
+      name: containerBookingId
+      in: path
+      required: true
+      schema: {type: integer, format: int64, minimum: 1}
+    IdempotencyKey:
+      name: Idempotency-Key
+      in: header
+      required: true
+      schema: {type: string, maxLength: 128}
   schemas:
     Aggregate:
       type: object
-      required: [orderId, orderNo, inboundId, inboundCode, tenantId, inboundStatus, containerBookingId, cabinetNo, loadingPlanId, loadingPlanStatus, dispatchStatus, version, gate]
+      required: [containerBookingId, cabinetNo, loadingPlanId, loadingPlanStatus, dispatchStatus, version, inbounds, gate]
+      properties:
+        containerBookingId: {type: integer, format: int64}
+        cabinetNo: {type: string, description: Stable cabinet number}
+        containerNo: {type: string, nullable: true, description: Real container number}
+        loadingPlanId: {type: integer, format: int64}
+        loadingPlanStatus: {type: string}
+        oceanBookingId: {type: integer, format: int64, nullable: true}
+        oceanBookingStatus: {type: string, nullable: true, description: Booking reference retained independently from the non-blocking standalone sailing schedule}
+        truckAppointmentId: {type: integer, format: int64, nullable: true, description: Reference-only truck appointment; absence never blocks manual outbound confirmation}
+        truckAppointmentStatus: {type: string, nullable: true, description: Reference-only status; PENDING or any non-terminal state never affects gate.passed}
+        dispatchStatus: {type: string, description: One visible container-level status}
+        version: {type: integer, minimum: 0, description: One optimistic-lock version shared by all technical inbound rows}
+        inbounds:
+          type: array
+          minItems: 1
+          items: {$ref: '#/components/schemas/InboundBinding'}
+        gate: {$ref: '#/components/schemas/ContainerGateResult'}
+    InboundBinding:
+      type: object
+      required: [orderId, orderNo, inboundId, inboundCode, tenantId, inboundStatus]
       properties:
         orderId: {type: integer, format: int64}
         orderNo: {type: string}
@@ -89,25 +121,35 @@ components:
         customerId: {type: integer, format: int64, nullable: true}
         customerName: {type: string, nullable: true}
         inboundStatus: {type: string}
-        containerBookingId: {type: integer, format: int64}
-        cabinetNo: {type: string, description: 稳定柜次号}
-        containerNo: {type: string, nullable: true, description: 真实集装箱号}
-        loadingPlanId: {type: integer, format: int64}
-        loadingPlanStatus: {type: string}
         pickTaskId: {type: integer, format: int64, nullable: true}
         pickTaskStatus: {type: string, nullable: true}
-        oceanBookingId: {type: integer, format: int64, nullable: true}
-        oceanBookingStatus: {type: string, nullable: true}
-        truckAppointmentId: {type: integer, format: int64, nullable: true}
-        truckAppointmentStatus: {type: string, nullable: true}
-        dispatchStatus: {type: string}
-        version: {type: integer, minimum: 0}
-        gate: {type: object}
+    ContainerGateResult:
+      type: object
+      required: [passed, inbounds, checkedAt]
+      properties:
+        passed: {type: boolean}
+        inbounds:
+          type: array
+          items:
+            type: object
+            required: [inboundId, inboundCode, gate]
+            properties:
+              inboundId: {type: integer, format: int64}
+              inboundCode: {type: string}
+              gate: {type: object}
+        checkedAt: {type: string, format: date-time}
+    Detail:
+      type: object
+      required: [aggregate, timeline]
+      properties:
+        aggregate: {$ref: '#/components/schemas/Aggregate'}
+        timeline:
+          type: array
+          description: Unified immutable facts; a container confirm or reverse contributes one visible history item.
+          items: {type: object}
     ActionRequest:
       type: object
-      required: [inboundId, containerBookingId, expectedVersion]
+      required: [expectedVersion]
       properties:
-        inboundId: {type: integer, format: int64, minimum: 1}
-        containerBookingId: {type: integer, format: int64, minimum: 1}
         expectedVersion: {type: integer, minimum: 0}
         remark: {type: string, maxLength: 500}
diff --git a/firstleg/src/test/java/com/baiyue/firstleg/BaiyueFirstlegApplicationContractTest.java b/firstleg/src/test/java/com/baiyue/firstleg/BaiyueFirstlegApplicationContractTest.java
index 2b9409161..c9ca3a8af 100644
--- a/firstleg/src/test/java/com/baiyue/firstleg/BaiyueFirstlegApplicationContractTest.java
+++ b/firstleg/src/test/java/com/baiyue/firstleg/BaiyueFirstlegApplicationContractTest.java
@@ -21,6 +21,7 @@ class BaiyueFirstlegApplicationContractTest {
             .contains("com.baiyue.firstleg.portschedule.mapper")
             .contains("com.baiyue.firstleg.customs.mapper")
             .contains("com.baiyue.firstleg.customerstatistics.adapter.out.persistence")
+            .contains("com.baiyue.firstleg.pricebookquery.adapter.out.persistence")
             .doesNotContain("com.baiyue.firstleg.customerstatistics.mapper");
     }
 
diff --git a/firstleg/src/test/java/com/baiyue/firstleg/controller/ContainerControllerContractTest.java b/firstleg/src/test/java/com/baiyue/firstleg/controller/ContainerControllerContractTest.java
index d94c7e2b7..33327afb2 100644
--- a/firstleg/src/test/java/com/baiyue/firstleg/controller/ContainerControllerContractTest.java
+++ b/firstleg/src/test/java/com/baiyue/firstleg/controller/ContainerControllerContractTest.java
@@ -33,6 +33,7 @@ class ContainerControllerContractTest {
         assertPermission("logisticsDocument", "platform:firstleg:container:list");
         assertPermission("uploadLogisticsDocument", "platform:firstleg:container:edit");
         assertPermission("downloadDocument", "platform:firstleg:container:list");
+        assertPermission("downloadClearance", "platform:firstleg:customs:manage");
     }
 
     @Test void overviewOpenApiFreezesContainerIdBasedPdaContract() throws Exception {
@@ -40,6 +41,8 @@ class ContainerControllerContractTest {
             .getContentAsString(StandardCharsets.UTF_8);
         assertThat(openapi).contains("/api/platform/v1/containers/{id}/overview:",
             "/documents/{documentType}/{fileId}/download:", "ExceptionRequest",
+            "/clearance/document/{fileId}/download:",
+            "DESTINATION_CLEARANCE、CUSTOMS_DECLARATION、DELIVERY_ORDER、PICKUP_ORDER",
             "enum: [DELIVERY_ORDER, PICKUP_ORDER]", "Idempotency-Key", "photoCounts:",
             "/pda/photos/{fileId}/download:", "downloadPath:", "workflowStatus:",
             "AWAITING_REVIEW", "version: {type: integer, minimum: 0}",
@@ -77,6 +80,8 @@ class ContainerControllerContractTest {
             .doesNotContain("tenantId")
             .doesNotContain("accountId");
         assertThat(openapi)
+            .contains("/api/platform/v1/containers/{id}/clearance/document/{fileId}/download:")
+            .contains("Content-Disposition 与 Cache-Control no-store")
             .contains("required: [oceanBookingId, requirementId, containerNo, expectedVersion]")
             .contains("required: [id, bookingNo, cabinetNo, sourceType, recordStatus")
             .contains("sourceType: {type: string, enum: [SIMULATION, OCEAN_BOOKING]")
diff --git a/firstleg/src/test/java/com/baiyue/firstleg/controller/LoadingListControllerContractTest.java b/firstleg/src/test/java/com/baiyue/firstleg/controller/LoadingListControllerContractTest.java
index d228c6137..28be884a7 100644
--- a/firstleg/src/test/java/com/baiyue/firstleg/controller/LoadingListControllerContractTest.java
+++ b/firstleg/src/test/java/com/baiyue/firstleg/controller/LoadingListControllerContractTest.java
@@ -16,6 +16,8 @@ import org.springframework.core.io.ClassPathResource;
 import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.web.bind.annotation.RequestParam;
 import org.springframework.web.bind.annotation.RequestPart;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.http.ResponseEntity;
 import org.springframework.web.multipart.MultipartFile;
 
 import java.lang.reflect.Method;
@@ -41,6 +43,8 @@ class LoadingListControllerContractTest {
             ConfirmedQuery.class);
         authority("confirmedDetail", "platform:firstleg:loading-list:list", AuthenticatedUser.class, long.class, long.class);
         authority("declaration", "platform:firstleg:loading-list:list", AuthenticatedUser.class, long.class, long.class);
+        authority("downloadDeclaration", "platform:firstleg:loading-list:list", AuthenticatedUser.class,
+            long.class, long.class, long.class);
         authority("attachDeclaration", "platform:firstleg:customs:manage", AuthenticatedUser.class,
             long.class, long.class, String.class, DocumentAttachRequest.class);
         authority("uploadDeclaration", "platform:firstleg:customs:manage", AuthenticatedUser.class,
@@ -88,6 +92,8 @@ class LoadingListControllerContractTest {
             .contains("oceanBookingStatus")
             .contains("pdaTaskId")
             .contains("cabinetNo")
+            .contains("LOADING_CUSTOMS_DECLARATION")
+            .contains("Cache-Control 为 no-store")
             .doesNotContain("internalContainerNo")
             .doesNotContain("rollback")
             .doesNotContain("delete:")
@@ -118,6 +124,18 @@ class LoadingListControllerContractTest {
         assertThat(method.getParameters()[6].getAnnotation(RequestPart.class)).isNull();
     }
 
+    @Test
+    void customsDownloadUsesStablePlanPathAndBinaryResponse() throws Exception {
+        Method method = PlatformLoadingListController.class.getDeclaredMethod("downloadDeclaration",
+            AuthenticatedUser.class, long.class, long.class, long.class);
+        assertThat(method.getAnnotation(GetMapping.class).value()).containsExactly(
+            "/loading-lists/{planId}/customs/document/{fileId}/download");
+        assertThat(method.getReturnType()).isEqualTo(ResponseEntity.class);
+        assertThat(method.getParameters()[1].getName()).isEqualTo("planId");
+        assertThat(method.getParameters()[2].getName()).isEqualTo("fileId");
+        assertThat(method.getParameters()[3].getName()).isEqualTo("warehouseId");
+    }
+
     @Test
     void yamlParses() throws Exception {
         String yaml = new ClassPathResource("openapi/loading-lists-v1.yaml")
@@ -134,6 +152,7 @@ class LoadingListControllerContractTest {
             "/api/platform/v1/first-leg/loading-lists/{planId}",
             "/api/platform/v1/first-leg/loading-lists/{planId}/customs",
             "/api/platform/v1/first-leg/loading-lists/{planId}/customs/document",
+            "/api/platform/v1/first-leg/loading-lists/{planId}/customs/document/{fileId}/download",
             "/api/platform/v1/first-leg/loading-lists/{planId}/customs/document/upload",
             "/api/platform/v1/first-leg/loading-lists/{planId}/customs/complete");
         Map<String, Object> components = stringMap(document.get("components"));
diff --git a/firstleg/src/test/java/com/baiyue/firstleg/controller/PriceBookContractTest.java b/firstleg/src/test/java/com/baiyue/firstleg/controller/PriceBookContractTest.java
index cccb0a153..5a9a269a2 100644
--- a/firstleg/src/test/java/com/baiyue/firstleg/controller/PriceBookContractTest.java
+++ b/firstleg/src/test/java/com/baiyue/firstleg/controller/PriceBookContractTest.java
@@ -6,7 +6,7 @@ import com.baiyue.firstleg.domain.PriceModel;
 import com.baiyue.firstleg.domain.PricingTaxMode;
 import com.baiyue.firstleg.domain.PricingDestinationType;
 import com.baiyue.firstleg.dto.PriceBookDtos;
-import com.baiyue.firstleg.mapper.PriceBookQueryMapper;
+import com.baiyue.firstleg.pricebookquery.adapter.out.persistence.PriceBookQueryMapper;
 import org.apache.ibatis.annotations.Select;
 import org.junit.jupiter.api.DisplayName;
 import org.junit.jupiter.api.Test;
diff --git a/firstleg/src/test/java/com/baiyue/firstleg/customs/service/CustomsDispatchGateContributorTest.java b/firstleg/src/test/java/com/baiyue/firstleg/customs/service/CustomsDispatchGateContributorTest.java
index 6695ea5d8..dc499e353 100644
--- a/firstleg/src/test/java/com/baiyue/firstleg/customs/service/CustomsDispatchGateContributorTest.java
+++ b/firstleg/src/test/java/com/baiyue/firstleg/customs/service/CustomsDispatchGateContributorTest.java
@@ -1,7 +1,7 @@
 package com.baiyue.firstleg.customs.service;
 
-import com.baiyue.firstleg.customs.entity.CustomsCaseEntity;
 import com.baiyue.firstleg.customs.repository.CustomsRepository;
+import com.baiyue.firstleg.customs.mapper.CustomsCaseMapper;
 import com.baiyue.firstleg.outbound.dispatch.gate.OutboundDispatchGateContributor.Context;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
@@ -22,17 +22,36 @@ class CustomsDispatchGateContributorTest {
             .isEqualTo("INVALID_CUSTOMER_SCOPE");
     }
 
-    @Test void passesOnlyCanonicalClearanceCompletedCase() {
-        CustomsCaseEntity value = new CustomsCaseEntity();
-        value.setStatus("RECEIPT_AVAILABLE");
-        when(repository.gateCase(10001L, 21L, 31L, 81L)).thenReturn(value);
-        assertThat(contributor.assess(context()).passed()).isFalse();
-        value.setStatus("CLEARANCE_COMPLETED");
-        assertThat(contributor.assess(context()))
-            .satisfies(item -> {
-                assertThat(item.passed()).isTrue();
-                assertThat(item.requirement()).isEqualTo("CLEARANCE_COMPLETED");
-            });
+    @Test void uploadedButIncompleteDeclarationRemainsBlocked() {
+        when(repository.loadingDeclarationCompleted(81L)).thenReturn(false);
+
+        assertThat(contributor.assess(context())).satisfies(item -> {
+            assertThat(item.passed()).isFalse();
+            assertThat(item.actual()).isEqualTo("MISSING");
+            assertThat(item.requirement()).isEqualTo("COMPLETED");
+        });
+    }
+
+    @Test void completedLoadingDeclarationPassesWithoutReadingCustomsCase() {
+        when(repository.loadingDeclarationCompleted(81L)).thenReturn(true);
+
+        assertThat(contributor.assess(context())).satisfies(item -> {
+            assertThat(item.passed()).isTrue();
+            assertThat(item.actual()).isEqualTo("COMPLETED");
+            assertThat(item.requirement()).isEqualTo("COMPLETED");
+        });
+        verify(repository).loadingDeclarationCompleted(81L);
+        verify(repository, never()).gateCase(anyLong(), anyLong(), anyLong(), anyLong());
+    }
+
+    @Test void mapperUsesOnlyCompletedLoadingDeclarationDocumentFact() throws Exception {
+        String sql = String.join(" ", CustomsCaseMapper.class
+            .getMethod("completedLoadingDeclaration", long.class)
+            .getAnnotation(org.apache.ibatis.annotations.Select.class).value());
+        assertThat(sql)
+            .contains("FROM fl_container_document", "container_booking_id=#{containerBookingId}")
+            .contains("document_type='CUSTOMS_DECLARATION'", "completed_at IS NOT NULL")
+            .doesNotContain("fl_customs_case", "CLEARANCE_COMPLETED");
     }
 
     private static Context context() { return new Context(10001L, 10002L, 21L, 31L, 81L, 91L, null); }
diff --git a/firstleg/src/test/java/com/baiyue/firstleg/oceanbooking/controller/PlatformOceanBookingControllerContractTest.java b/firstleg/src/test/java/com/baiyue/firstleg/oceanbooking/controller/PlatformOceanBookingControllerContractTest.java
index df43c1be5..df0b2fca1 100644
--- a/firstleg/src/test/java/com/baiyue/firstleg/oceanbooking/controller/PlatformOceanBookingControllerContractTest.java
+++ b/firstleg/src/test/java/com/baiyue/firstleg/oceanbooking/controller/PlatformOceanBookingControllerContractTest.java
@@ -20,6 +20,7 @@ class PlatformOceanBookingControllerContractTest {
             .containsExactly("/api/platform/v1/ocean-bookings");
         Map<String, String> permissions = Map.ofEntries(
             Map.entry("page", "platform:firstleg:ocean-booking:list"),
+            Map.entry("linkCandidates", "platform:firstleg:ocean-booking:list"),
             Map.entry("channels", "platform:firstleg:ocean-booking:list"),
             Map.entry("detail", "platform:firstleg:ocean-booking:list"),
             Map.entry("create", "platform:firstleg:ocean-booking:create"),
@@ -30,7 +31,8 @@ class PlatformOceanBookingControllerContractTest {
             Method method = method(name);
             assertThat(method.getAnnotation(PreAuthorize.class).value())
                 .isEqualTo("hasAuthority('" + permission + "')");
-            if (!name.equals("page") && !name.equals("detail") && !name.equals("channels")) {
+            if (!name.equals("page") && !name.equals("detail") && !name.equals("channels")
+                && !name.equals("linkCandidates")) {
                 assertThat(method.getAnnotation(BusinessAudit.class)).isNotNull();
             }
         });
@@ -57,6 +59,43 @@ class PlatformOceanBookingControllerContractTest {
             .doesNotContain("change-request", "change-confirm", "/cancel:", "containers[].containerNo");
     }
 
+    @Test
+    void linkCandidatesUsesDedicatedGetPathAndStablePageContract() throws Exception {
+        Method method = method("linkCandidates");
+        assertThat(method.getAnnotation(org.springframework.web.bind.annotation.GetMapping.class).value())
+            .containsExactly("/link-candidates");
+        String yaml = Files.readString(Path.of("src/main/resources/openapi/ocean-bookings-v1.yaml"));
+        assertThat(yaml)
+            .contains("/api/platform/v1/ocean-bookings/link-candidates:")
+            .contains("x-permission: platform:firstleg:ocean-booking:list")
+            .contains("warehouseId", "channelCode", "containerType")
+            .contains("LinkCandidateResponse", "requiredQuantity", "allocatedQuantity", "remainingQuantity")
+            .contains("Capacity and max weight are derived display snapshots and never eligibility fields")
+            .contains("Returns only linkable requirement candidates")
+            .contains("An empty result is a normal successful page")
+            .contains("booking detail calls are not used")
+            .doesNotContain("mismatchReasons", "disabledReason");
+    }
+
+    @Test
+    void openApiDefinesContainerCountAsRequirementQuantityTotal() throws Exception {
+        String yaml = Files.readString(Path.of("src/main/resources/openapi/ocean-bookings-v1.yaml"));
+        assertThat(yaml)
+            .contains("containerCount is the sum of quantity across all container requirements")
+            .contains("never represents linked or ACTIVE containers")
+            .contains("Sum of all container requirement quantities; independent of allocation, linking or unlinking.");
+    }
+
+    @Test
+    void openApiFreezesStandardCarrierCodeOnBooking() throws Exception {
+        String yaml = Files.readString(Path.of("src/main/resources/openapi/ocean-bookings-v1.yaml"));
+        assertThat(yaml)
+            .contains("carrierCode:")
+            .contains("enum: [MATSON, SML, ZIM, COSCO, EMC, HEDE, OTHER]")
+            .contains("Required before RELEASE")
+            .contains("OTHER means manual carrier-node tracking");
+    }
+
     private static Method method(String name) {
         return Arrays.stream(PlatformOceanBookingController.class.getDeclaredMethods())
             .filter(method -> method.getName().equals(name)).findFirst().orElseThrow();
diff --git a/firstleg/src/test/java/com/baiyue/firstleg/oceanbooking/repository/OceanBookingMapperContractTest.java b/firstleg/src/test/java/com/baiyue/firstleg/oceanbooking/repository/OceanBookingMapperContractTest.java
index 050195e76..d4557b21e 100644
--- a/firstleg/src/test/java/com/baiyue/firstleg/oceanbooking/repository/OceanBookingMapperContractTest.java
+++ b/firstleg/src/test/java/com/baiyue/firstleg/oceanbooking/repository/OceanBookingMapperContractTest.java
@@ -1,6 +1,8 @@
 package com.baiyue.firstleg.oceanbooking.repository;
 
 import com.baiyue.firstleg.oceanbooking.mapper.OceanBookingMapper;
+import com.baiyue.firstleg.oceanbooking.mapper.OceanBookingContainerAllocationMapper;
+import com.baiyue.firstleg.oceanbooking.dto.OceanBookingDtos.LinkCandidateQuery;
 import org.apache.ibatis.annotations.Select;
 import org.apache.ibatis.annotations.Update;
 import org.junit.jupiter.api.Test;
@@ -20,7 +22,10 @@ class OceanBookingMapperContractTest {
             .contains("booking.status=#{query.status}")
             .contains("booking.booking_no LIKE")
             .contains("party.party_type='SHIPPER'", "party.party_type='CONSIGNEE'")
-            .contains("fl_ocean_booking_container_allocation", "container.record_status='ACTIVE'", "container_count")
+            .contains("COALESCE((SELECT SUM(requirement.quantity)")
+            .contains("FROM fl_ocean_booking_container_requirement requirement")
+            .contains("requirement.ocean_booking_id=booking.id),0) container_count")
+            .doesNotContain("fl_ocean_booking_container_allocation allocation\n            JOIN fl_container_booking")
             .contains("ORDER BY booking.updated_at DESC,booking.id DESC");
     }
 
@@ -36,4 +41,39 @@ class OceanBookingMapperContractTest {
             .contains("status='DRAFT' AND version=#{version}")
             .doesNotContain("CONFIRMED", "CHANGE_PENDING", "CANCELLED", "SUBMITTED", "FAILED");
     }
+
+    @Test
+    void linkCandidatesUsesOneBoundedSetQueryAndExactRemainingSemantics() throws Exception {
+        String sql = String.join("\n", OceanBookingMapper.class.getDeclaredMethod("selectLinkCandidates",
+            com.baomidou.mybatisplus.extension.plugins.pagination.Page.class, LinkCandidateQuery.class)
+            .getAnnotation(Select.class).value());
+        assertThat(sql)
+            .contains("booking.status='RELEASED'")
+            .contains("booking.warehouse_id=#{query.warehouseId}")
+            .contains("booking.channel_code=#{query.channelCode}")
+            .contains("requirement.container_type=#{query.containerType}")
+            .contains("FROM fl_ocean_booking_container_allocation")
+            .contains("container.record_status='ACTIVE'")
+            .contains("container.ocean_booking_id=allocation.ocean_booking_id")
+            .contains("container.ocean_booking_requirement_id=allocation.requirement_id")
+            .contains("GROUP BY allocation.ocean_booking_id,allocation.requirement_id")
+            .contains("requirement.quantity-COALESCE(allocated.allocated_quantity,0) remaining_quantity")
+            .contains("requirement.quantity>COALESCE(allocated.allocated_quantity,0)")
+            .doesNotContain("SELECT booking.*",
+                "requirement.capacity_cbm=#{query.capacityCbm}",
+                "requirement.max_weight_kg=#{query.maxWeightKg}");
+    }
+
+    @Test
+    void finalLinkLimitCountsOnlyActiveContainersStillPointingAtTheSameRequirement() throws Exception {
+        String sql = String.join("\n", OceanBookingContainerAllocationMapper.class
+            .getDeclaredMethod("countActiveLinked", long.class, long.class)
+            .getAnnotation(Select.class).value());
+        assertThat(sql)
+            .contains("container.record_status='ACTIVE'")
+            .contains("container.ocean_booking_id=allocation.ocean_booking_id")
+            .contains("container.ocean_booking_requirement_id=allocation.requirement_id")
+            .contains("allocation.ocean_booking_id=#{oceanBookingId}")
+            .contains("allocation.requirement_id=#{requirementId}");
+    }
 }
diff --git a/firstleg/src/test/java/com/baiyue/firstleg/oceanbooking/repository/OceanBookingSqlContractTest.java b/firstleg/src/test/java/com/baiyue/firstleg/oceanbooking/repository/OceanBookingSqlContractTest.java
index 9f2df34e0..5d73959ff 100644
--- a/firstleg/src/test/java/com/baiyue/firstleg/oceanbooking/repository/OceanBookingSqlContractTest.java
+++ b/firstleg/src/test/java/com/baiyue/firstleg/oceanbooking/repository/OceanBookingSqlContractTest.java
@@ -24,6 +24,8 @@ class OceanBookingSqlContractTest {
             .contains("MODIFY COLUMN customer_name VARCHAR(128) NULL COMMENT '可选客户名称快照'")
             .contains("service_term VARCHAR(32) NULL COMMENT '运输服务条款快照；发布前必填'")
             .contains("freight_term VARCHAR(32) NULL COMMENT '海运费支付条款快照；发布前必填'")
+            .contains("carrier_code VARCHAR(16) NULL COMMENT '船司标准编码")
+            .contains("carrier_code IS NULL OR carrier_code IN ('MATSON','SML','ZIM','COSCO','EMC','HEDE','OTHER')")
             .contains("container_booking_id BIGINT UNSIGNED NOT NULL COMMENT '明确引用现有柜次ID'")
             .contains("REFERENCES fl_container_booking(id)")
             .contains("REFERENCES fl_ocean_booking(id) ON DELETE CASCADE")
diff --git a/firstleg/src/test/java/com/baiyue/firstleg/oceanbooking/service/OceanBookingServiceTest.java b/firstleg/src/test/java/com/baiyue/firstleg/oceanbooking/service/OceanBookingServiceTest.java
index 06019bc33..2b846c7ba 100644
--- a/firstleg/src/test/java/com/baiyue/firstleg/oceanbooking/service/OceanBookingServiceTest.java
+++ b/firstleg/src/test/java/com/baiyue/firstleg/oceanbooking/service/OceanBookingServiceTest.java
@@ -1,6 +1,7 @@
 package com.baiyue.firstleg.oceanbooking.service;
 
 import com.baiyue.common.core.api.ApiResponse;
+import com.baiyue.common.core.api.PageResult;
 import com.baiyue.common.core.exception.BizException;
 import com.baiyue.firstleg.client.WarehouseMasterDataClient;
 import com.baiyue.firstleg.client.WarehouseSupplierClient;
@@ -9,8 +10,8 @@ import com.baiyue.firstleg.oceanbooking.entity.OceanBookingContainerRequirementE
 import com.baiyue.firstleg.oceanbooking.entity.OceanBookingEntity;
 import com.baiyue.firstleg.oceanbooking.entity.OceanBookingOperationEntity;
 import com.baiyue.firstleg.oceanbooking.repository.OceanBookingRepository;
-import com.baiyue.firstleg.repository.PriceBookQueryRepository;
-import com.baiyue.firstleg.repository.PriceBookQueryRows.ChannelRow;
+import com.baiyue.firstleg.pricebookquery.application.model.PriceBookQueryRows.ChannelRow;
+import com.baiyue.firstleg.pricebookquery.application.port.in.PriceBookQueryUseCase;
 import com.baiyue.firstleg.service.WarehouseSupplierSnapshotService;
 import com.baiyue.firstleg.service.FirstlegDocumentNumberGenerator;
 import com.fasterxml.jackson.databind.ObjectMapper;
@@ -33,7 +34,7 @@ import static org.mockito.Mockito.*;
 
 class OceanBookingServiceTest {
     @Mock private OceanBookingRepository repository;
-    @Mock private PriceBookQueryRepository priceBooks;
+    @Mock private PriceBookQueryUseCase priceBooks;
     @Mock private WarehouseSupplierSnapshotService suppliers;
     @Mock private WarehouseMasterDataClient warehouses;
     @Mock private FirstlegDocumentNumberGenerator documentNumbers;
@@ -170,6 +171,60 @@ class OceanBookingServiceTest {
         verify(repository, times(2)).page(any());
     }
 
+    @Test
+    void pagePreservesRequirementTotalContainerCountsForSingleMultipleAndEmptyDrafts() {
+        OceanBookingEntity one45Hc = booking("RELEASED", 1); one45Hc.setContainerCount(1L);
+        OceanBookingEntity multipleTypes = booking("RELEASED", 1); multipleTypes.setId(2L);
+        multipleTypes.setContainerCount(4L);
+        OceanBookingEntity emptyDraft = booking("DRAFT", 0); emptyDraft.setId(3L);
+        emptyDraft.setContainerCount(0L);
+        when(repository.page(any())).thenReturn(new PageResult<>(
+            List.of(one45Hc, multipleTypes, emptyDraft), 1, 20, 3, 1));
+
+        PageResult<OceanBookingEntity> result = service.page(new Query(null, null, null, 1, 20));
+
+        assertThat(result.records()).extracting(OceanBookingEntity::getContainerCount)
+            .containsExactly(1L, 4L, 0L);
+    }
+
+    @Test
+    void linkCandidatesDefaultsPaginationAndDelegatesOneNormalizedSetQuery() {
+        LinkCandidate candidate = new LinkCandidate(101L, "OB-260818-0001", 201L, "40HC",
+            new BigDecimal("76"), new BigDecimal("28000"), 3, 1, 2,
+            "客户A", "深圳中转仓", "美西海运");
+        when(repository.linkCandidates(any())).thenReturn(new PageResult<>(List.of(candidate), 1, 20, 1, 1));
+
+        PageResult<LinkCandidate> result = service.linkCandidates(new LinkCandidateQuery(701L,
+            " SEA-US ", " 40HC ", null, null));
+
+        assertThat(result.records()).containsExactly(candidate);
+        assertThat(result.records().get(0).remainingQuantity()).isEqualTo(2);
+        ArgumentCaptor<LinkCandidateQuery> query = ArgumentCaptor.forClass(LinkCandidateQuery.class);
+        verify(repository).linkCandidates(query.capture());
+        assertThat(query.getValue().channelCode()).isEqualTo("SEA-US");
+        assertThat(query.getValue().containerType()).isEqualTo("40HC");
+        assertThat(query.getValue().page()).isEqualTo(1L);
+        assertThat(query.getValue().size()).isEqualTo(20L);
+        verify(repository, never()).find(anyLong());
+        verify(repository, never()).requirements(anyLong());
+        verify(repository, never()).containers(anyLong());
+    }
+
+    @Test
+    void linkCandidatesReturnsNormalEmptyPageWithOneSetQueryAndNoDiagnosticFields() {
+        when(repository.linkCandidates(any())).thenReturn(new PageResult<>(List.of(), 1, 20, 0, 0));
+
+        PageResult<LinkCandidate> result = service.linkCandidates(
+            new LinkCandidateQuery(701L, "SEA-US", "45HC", null, null));
+
+        assertThat(result.records()).isEmpty();
+        assertThat(result.total()).isZero();
+        assertThat(result.pages()).isZero();
+        verify(repository, times(1)).linkCandidates(any());
+        assertThat(LinkCandidate.class.getRecordComponents()).extracting(java.lang.reflect.RecordComponent::getName)
+            .doesNotContain("mismatchReasons", "disabledReason", "warehouseId", "channelCode");
+    }
+
     @Test
     void releaseRejectsInvalidScheduleWithoutTransition() {
         OceanBookingEntity draft = completeBooking("DRAFT", 3);
@@ -204,12 +259,12 @@ class OceanBookingServiceTest {
     }
 
     private static DraftData partialDraft(String remark) {
-        return new DraftData(null, null, null, null, null, null, null, null, null,
+        return new DraftData(null, null, null, null, null, null, null, null, null, null,
             null, null, null, null, null, null, null, null, null, null, null, remark, null, null);
     }
 
     private static DraftData completeDraft() {
-        return new DraftData(100L, "客户", "SEA-US", 701L, "BL-001", 71L, "船公司",
+        return new DraftData(100L, "客户", "SEA-US", 701L, "BL-001", 71L, "船公司", "MATSON",
             81L, null, "VESSEL", "V001", "CNSZX", "深圳", "USLAX", "洛杉矶",
             "LAX", "CY-CY", "PREPAID", LocalDateTime.of(2026, 9, 1, 0, 0),
             LocalDateTime.of(2026, 9, 20, 0, 0), null,
@@ -224,6 +279,7 @@ class OceanBookingServiceTest {
         OceanBookingEntity value = booking(status, version);
         value.setCustomerId(100L); value.setCustomerName("客户"); value.setChannelCode("SEA-US");
         value.setWarehouseId(701L); value.setBillOfLadingNo("BL-001"); value.setShippingCompanyId(71L);
+        value.setCarrierCode("MATSON");
         value.setBookingAgentId(81L); value.setVesselName("VESSEL"); value.setVoyageNo("V001");
         value.setServiceTerm("CY-CY"); value.setFreightTerm("PREPAID");
         value.setEstimatedSailingAt(LocalDateTime.of(2026, 9, 1, 0, 0));
diff --git a/firstleg/src/test/java/com/baiyue/firstleg/outbound/dispatch/OutboundDispatchReadMapperContractTest.java b/firstleg/src/test/java/com/baiyue/firstleg/outbound/dispatch/OutboundDispatchReadMapperContractTest.java
index d4f2eebfd..1efcea3a3 100644
--- a/firstleg/src/test/java/com/baiyue/firstleg/outbound/dispatch/OutboundDispatchReadMapperContractTest.java
+++ b/firstleg/src/test/java/com/baiyue/firstleg/outbound/dispatch/OutboundDispatchReadMapperContractTest.java
@@ -10,9 +10,25 @@ class OutboundDispatchReadMapperContractTest {
     @Test
     void bindingProjectsStableCabinetAndRealContainerNumbersSeparately() throws Exception {
         String sql = String.join("\n", OutboundDispatchReadMapper.class
-            .getMethod("bindings", Long.class, Long.class, Long.class)
+            .getMethod("bindings", long.class)
             .getAnnotation(Select.class).value());
-        assertThat(sql).contains("booking.cabinet_no cabinetNo", "booking.container_no containerNo");
+        assertThat(sql)
+            .contains("booking.cabinet_no cabinetNo", "booking.container_no containerNo")
+            .contains("booking.id=#{containerBookingId}")
+            .doesNotContain("#{orderId}", "#{inboundId}");
+    }
+
+    @Test
+    void actionQueryLocksEveryRealInboundBindingForTheContainer() throws Exception {
+        String sql = String.join("\n", OutboundDispatchReadMapper.class
+            .getMethod("bindingsForUpdate", long.class)
+            .getAnnotation(Select.class).value());
+
+        assertThat(sql)
+            .contains("booking.id=#{containerBookingId}")
+            .contains("item.deleted=0", "inbound.deleted=0")
+            .contains("FOR UPDATE")
+            .doesNotContain("LIMIT 1");
     }
 
     @Test
@@ -31,19 +47,37 @@ class OutboundDispatchReadMapperContractTest {
             .getAnnotation(Select.class).value()[0];
 
         assertThat(sql)
-            .contains("seal_no<>''")
+            .contains("evidence.seal_no<>''")
             .doesNotContain("&lt;", "&gt;");
     }
 
     @Test
-    void oceanAndTruckQueriesUseTenantIsolationKey() throws Exception {
-        String oceanSql = OutboundDispatchReadMapper.class.getMethod("ocean", long.class, long.class)
-            .getAnnotation(Select.class).value()[0];
-        String truckSql = OutboundDispatchReadMapper.class.getMethod("truck", long.class, long.class, long.class)
+    void evidenceGateAggregatesOnePhysicalEvidenceSetAcrossTheWholeLoadingPlan() throws Exception {
+        String sql = OutboundDispatchReadMapper.class.getMethod("evidence", long.class, long.class)
             .getAnnotation(Select.class).value()[0];
 
-        assertThat(oceanSql).contains("booking.customer_id=#{tenantId}").doesNotContain("#{customerId}");
-        assertThat(truckSql).contains("customer_id=#{tenantId}").doesNotContain("#{customerId}");
+        assertThat(sql)
+            .contains("plan.id=#{loadingPlanId}", "plan.container_booking_id=#{containerBookingId}")
+            .contains("item.loading_plan_id=plan.id", "item.deleted=0")
+            .contains("evidence.inbound_id=item.inbound_id", "evidence.tenant_id=item.account_id")
+            .contains("COUNT(DISTINCT CASE", "evidence.evidence_type")
+            .doesNotContain("WHERE tenant_id=#{tenantId}", "inbound_id=#{inboundId}");
+    }
+
+    @Test
+    void oceanAndTruckQueriesAreResolvedOnceFromTheContainerRoot() throws Exception {
+        String oceanSql = OutboundDispatchReadMapper.class.getMethod("ocean", long.class)
+            .getAnnotation(Select.class).value()[0];
+        String truckSql = OutboundDispatchReadMapper.class.getMethod("truck", long.class, long.class)
+            .getAnnotation(Select.class).value()[0];
+
+        assertThat(oceanSql)
+            .contains("allocation.container_booking_id=#{containerBookingId}")
+            .contains("booking.customer_id customerId")
+            .doesNotContain("#{tenantId}");
+        assertThat(truckSql)
+            .contains("container_booking_id=#{containerBookingId}", "loading_plan_id=#{loadingPlanId}")
+            .doesNotContain("#{tenantId}");
     }
 
     @Test
diff --git a/firstleg/src/test/java/com/baiyue/firstleg/outbound/dispatch/OutboundDispatchServiceTest.java b/firstleg/src/test/java/com/baiyue/firstleg/outbound/dispatch/OutboundDispatchServiceTest.java
index 8c4bf583f..09c38aef4 100644
--- a/firstleg/src/test/java/com/baiyue/firstleg/outbound/dispatch/OutboundDispatchServiceTest.java
+++ b/firstleg/src/test/java/com/baiyue/firstleg/outbound/dispatch/OutboundDispatchServiceTest.java
@@ -9,9 +9,12 @@ import com.baiyue.firstleg.outbound.dispatch.mapper.OutboundDispatchReadMapper;
 import com.baiyue.firstleg.outbound.dispatch.repository.OutboundDispatchRepository;
 import com.baiyue.firstleg.outbound.dispatch.service.OutboundDispatchService;
 import com.baiyue.firstleg.portschedule.service.CarrierScheduleQueryService;
+import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 
 import java.util.List;
+import java.util.concurrent.atomic.AtomicReference;
+import java.util.stream.LongStream;
 
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatThrownBy;
@@ -19,159 +22,264 @@ import static org.mockito.ArgumentMatchers.*;
 import static org.mockito.Mockito.*;
 
 class OutboundDispatchServiceTest {
-    private final OutboundDispatchRepository repository = mock(OutboundDispatchRepository.class);
+    private OutboundDispatchRepository repository;
+
+    @BeforeEach
+    void setUp() {
+        repository = mock(OutboundDispatchRepository.class);
+        when(repository.timeline(any(), any(), any())).thenReturn(List.of());
+    }
 
     @Test
-    void gateFailsClosedWhenCustomsAndScheduleModulesAreUnavailable() {
-        OutboundDispatchService service = new OutboundDispatchService(repository, List.of());
-        stubReadyChain();
+    void containerEvidenceFailureFailsEveryBindingConsistently() {
+        OutboundDispatchService service = serviceWithoutCarrier();
+        stubContainer();
+        when(repository.evidence(22L, 44L)).thenReturn(new OutboundDispatchReadMapper.Evidence(4, 1));
 
-        GateResult result = service.checkGate(new Query(null, 11L, 22L));
+        ContainerGateResult result = service.checkGate(22L);
 
         assertThat(result.passed()).isFalse();
-        assertThat(result.items()).filteredOn(item -> !item.passed())
-            .extracting(GateItem::code).containsExactlyInAnyOrder("CUSTOMS_CLEARANCE", "SAILING_SCHEDULE");
+        assertThat(result.inbounds()).hasSize(2);
+        assertThat(result.inbounds()).allSatisfy(inbound -> assertThat(inbound.gate().items())
+            .filteredOn(item -> "LOADING_EVIDENCE_COMPLETE".equals(item.code()))
+            .extracting(GateItem::passed).containsExactly(false));
+        verify(repository, times(1)).evidence(22L, 44L);
     }
 
     @Test
-    void aggregateUsesTenantKeyWhenCustomerEntityIdDiffers() {
-        OutboundDispatchService service = new OutboundDispatchService(repository, List.of());
-        stubReadyChain();
+    void tenInboundBindingsShareOneCompleteEvidenceSetAndOneContainerCustomsResult() {
+        OutboundDispatchGateContributor customs = mock(OutboundDispatchGateContributor.class);
+        when(customs.code()).thenReturn("CUSTOMS_CLEARANCE");
+        when(customs.assess(any())).thenReturn(new GateItem(
+            "CUSTOMS_CLEARANCE", "报关完成", true, "CLEARANCE_COMPLETED", "CLEARANCE_COMPLETED"));
+        OutboundDispatchService service = new OutboundDispatchService(repository, List.of(customs), null);
+        List<OutboundDispatchReadMapper.Binding> tenBindings = LongStream.rangeClosed(11L, 20L)
+            .mapToObj(id -> binding(id, "I-" + id)).toList();
+        stubContainer(tenBindings);
 
-        service.checkGate(new Query(null, 11L, 22L));
+        ContainerGateResult result = service.checkGate(22L);
 
-        verify(repository).ocean(22L, 7L);
-        verify(repository).truck(22L, 44L, 7L);
-        verify(repository, never()).ocean(22L, 8L);
-        verify(repository, never()).truck(22L, 44L, 8L);
+        assertThat(result.passed()).isTrue();
+        assertThat(result.inbounds()).hasSize(10).allSatisfy(value -> assertThat(value.gate().passed()).isTrue());
+        verify(repository, times(1)).evidence(22L, 44L);
+        verify(customs, times(1)).assess(any());
     }
 
     @Test
-    void confirmAdvancesDispatchWithoutMutatingLoadedInbound() {
-        OutboundDispatchService service = new OutboundDispatchService(repository,
-            List.of(passing("CUSTOMS_CLEARANCE"), passing("SAILING_SCHEDULE")));
-        stubReadyChain();
-        OutboundDispatchEntity state = new OutboundDispatchEntity();
-        state.setId(33L); state.setTenantId(7L); state.setOrderId(10L); state.setInboundId(11L);
-        state.setContainerBookingId(22L); state.setStatus("READY_FOR_DISPATCH"); state.setVersion(0);
-        when(repository.dispatch(7L, 11L, 22L)).thenReturn(state);
-        when(repository.claim(eq(9L), eq("CONFIRM_DISPATCH"), eq("confirm-1"), anyString())).thenReturn(true);
-        when(repository.confirm(33L, 0, 9L, "admin", "ok")).thenReturn(1);
-        when(repository.completeOperation(33L, 9L, "CONFIRM_DISPATCH", "confirm-1")).thenReturn(1);
-        when(repository.timeline(any(), any(), any())).thenReturn(List.of());
+    void confirmAllowsMissingTruckAppointmentWhenEveryAuthoritativeGatePasses() {
+        OutboundDispatchService service = serviceWithoutCarrier();
+        stubContainer();
+        when(repository.truck(22L, 44L)).thenReturn(null);
+        stubConfirmMutation("no-truck");
 
-        service.confirm(9L, "admin", "confirm-1", new ActionRequest(11L, 22L, 0, "ok"));
+        Detail result = service.confirm(22L, 9L, "admin", "no-truck", new ActionRequest(0, null));
 
-        verify(repository).confirm(33L, 0, 9L, "admin", "ok");
-        verify(repository).history(argThat(history -> "CONFIRM_DISPATCH".equals(history.getAction())
-            && "WAITING_FOR_LOADING".equals(history.getToStatus())));
-        verify(repository).completeOperation(33L, 9L, "CONFIRM_DISPATCH", "confirm-1");
+        assertThat(result.aggregate().truckAppointmentId()).isNull();
+        assertThat(result.aggregate().gate().passed()).isTrue();
+        verify(repository, times(2)).confirm(anyLong(), eq(0), eq(9L), eq("admin"), isNull());
     }
 
     @Test
-    void confirmCreatesCanonicalCarrierScheduleTaskInTheSameTransaction() {
+    void confirmAllowsPendingTruckAppointmentWhenEveryAuthoritativeGatePasses() {
+        OutboundDispatchService service = serviceWithoutCarrier();
+        stubContainer();
+        when(repository.truck(22L, 44L)).thenReturn(new OutboundDispatchReadMapper.IdStatus(77L, "PENDING"));
+        stubConfirmMutation("pending-truck");
+
+        Detail result = service.confirm(22L, 9L, "admin", "pending-truck", new ActionRequest(0, null));
+
+        assertThat(result.aggregate().truckAppointmentStatus()).isEqualTo("PENDING");
+        assertThat(result.aggregate().gate().passed()).isTrue();
+        verify(repository, times(2)).confirm(anyLong(), eq(0), eq(9L), eq("admin"), isNull());
+    }
+
+    @Test
+    void confirmAllowsMissingSailingScheduleContributor() {
+        OutboundDispatchService service = serviceWithoutCarrier();
+        stubContainer();
+        stubConfirmMutation("no-schedule");
+
+        Detail result = service.confirm(22L, 9L, "admin", "no-schedule", new ActionRequest(0, null));
+
+        assertThat(result.aggregate().gate().passed()).isTrue();
+        assertThat(result.aggregate().gate().inbounds()).allSatisfy(inbound -> assertThat(inbound.gate().items())
+            .extracting(GateItem::code).doesNotContain("SAILING_SCHEDULE"));
+    }
+
+    @Test
+    void detailReturnsOneVersionAndAllInboundBindings() {
+        OutboundDispatchService service = serviceWithoutCarrier();
+        stubContainer();
+        OutboundDispatchEntity first = state(31L, 11L, "WAITING_FOR_LOADING", 3);
+        OutboundDispatchEntity second = state(32L, 12L, "WAITING_FOR_LOADING", 3);
+        when(repository.dispatch(7L, 11L, 22L)).thenReturn(first);
+        when(repository.dispatch(7L, 12L, 22L)).thenReturn(second);
+
+        Detail detail = service.detail(22L);
+
+        assertThat(detail.aggregate().inbounds()).extracting(InboundBinding::inboundId).containsExactly(11L, 12L);
+        assertThat(detail.aggregate().dispatchStatus()).isEqualTo("WAITING_FOR_LOADING");
+        assertThat(detail.aggregate().version()).isEqualTo(3);
+    }
+
+    @Test
+    void confirmLocksAndAdvancesAllBindingsButWritesOneHistoryAndOneShippingFact() {
         CarrierScheduleQueryService carrierSchedules = mock(CarrierScheduleQueryService.class);
-        OutboundDispatchService service = new OutboundDispatchService(repository,
-            List.of(passing("CUSTOMS_CLEARANCE"), passing("SAILING_SCHEDULE")), carrierSchedules);
-        stubReadyChain();
-        OutboundDispatchEntity state = new OutboundDispatchEntity();
-        state.setId(33L); state.setTenantId(7L); state.setInboundId(11L);
-        state.setContainerBookingId(22L); state.setStatus("READY_FOR_DISPATCH"); state.setVersion(0);
-        when(repository.dispatch(7L, 11L, 22L)).thenReturn(state);
-        when(repository.claim(eq(9L), eq("CONFIRM_DISPATCH"), eq("confirm-carrier"), anyString())).thenReturn(true);
-        when(repository.confirm(33L, 0, 9L, "admin", null)).thenReturn(1);
-        when(repository.completeOperation(33L, 9L, "CONFIRM_DISPATCH", "confirm-carrier")).thenReturn(1);
-        when(repository.timeline(any(), any(), any())).thenReturn(List.of());
+        OutboundDispatchService service = service(carrierSchedules);
+        stubContainer();
+        when(repository.lockBindings(22L)).thenReturn(bindings());
+        OutboundDispatchEntity first = state(31L, 11L, "READY_FOR_DISPATCH", 0);
+        OutboundDispatchEntity second = state(32L, 12L, "READY_FOR_DISPATCH", 0);
+        when(repository.dispatchLocked(7L, 11L, 22L)).thenReturn(first);
+        when(repository.dispatchLocked(7L, 12L, 22L)).thenReturn(second);
+        when(repository.claim(eq(9L), eq("CONFIRM_DISPATCH"), eq("confirm-container"), anyString())).thenReturn(true);
+        when(repository.confirm(anyLong(), eq(0), eq(9L), eq("admin"), eq("ok"))).thenReturn(1);
+        when(repository.completeOperation(31L, 9L, "CONFIRM_DISPATCH", "confirm-container")).thenReturn(1);
 
-        service.confirm(9L, "admin", "confirm-carrier", new ActionRequest(11L, 22L, 0, null));
+        service.confirm(22L, 9L, "admin", "confirm-container", new ActionRequest(0, "ok"));
 
-        verify(carrierSchedules).ensureFromOutboundConfirm(7L, 66L, 22L, 9L, "admin");
+        verify(repository).lockBindings(22L);
+        verify(repository).confirm(31L, 0, 9L, "admin", "ok");
+        verify(repository).confirm(32L, 0, 9L, "admin", "ok");
+        verify(repository, times(1)).history(argThat(value -> "CONFIRM_DISPATCH".equals(value.getAction())
+            && value.getContainerBookingId().equals(22L)));
+        verify(carrierSchedules, times(1)).ensureFromOutboundConfirm(7L, 66L, 22L, 9L, "admin");
     }
 
     @Test
-    void confirmNeverWritesStateWhenAnyRealGateFails() {
-        OutboundDispatchService service = new OutboundDispatchService(repository,
-            List.of(passing("CUSTOMS_CLEARANCE"), passing("SAILING_SCHEDULE")));
-        stubReadyChain();
-        when(repository.pick(44L)).thenReturn(new OutboundDispatchReadMapper.IdStatus(55L, "LOADING"));
-        when(repository.claim(eq(9L), eq("CONFIRM_DISPATCH"), eq("confirm-2"), anyString())).thenReturn(true);
+    void confirmDoesNotWriteAnyRowWhenOneInboundGateFails() {
+        OutboundDispatchService service = serviceWithoutCarrier();
+        stubContainer();
+        when(repository.lockBindings(22L)).thenReturn(bindings());
+        when(repository.evidence(22L, 44L)).thenReturn(new OutboundDispatchReadMapper.Evidence(4, 1));
+        when(repository.claim(eq(9L), eq("CONFIRM_DISPATCH"), eq("blocked"), anyString())).thenReturn(true);
 
-        assertThatThrownBy(() -> service.confirm(9L, "admin", "confirm-2",
-            new ActionRequest(11L, 22L, 0, null))).isInstanceOf(BizException.class).hasMessageContaining("门禁");
+        assertThatThrownBy(() -> service.confirm(22L, 9L, "admin", "blocked", new ActionRequest(0, null)))
+            .isInstanceOf(BizException.class).hasMessageContaining("全部入库绑定");
+
+        verify(repository, never()).confirm(anyLong(), anyInt(), anyLong(), anyString(), any());
+        verify(repository, never()).history(any());
+    }
+
+    @Test
+    void differingTechnicalRowVersionsAreRejectedAsContainerConflict() {
+        OutboundDispatchService service = serviceWithoutCarrier();
+        stubContainer();
+        when(repository.lockBindings(22L)).thenReturn(bindings());
+        when(repository.dispatchLocked(7L, 11L, 22L)).thenReturn(state(31L, 11L, "READY_FOR_DISPATCH", 0));
+        when(repository.dispatchLocked(7L, 12L, 22L)).thenReturn(state(32L, 12L, "READY_FOR_DISPATCH", 1));
+        when(repository.claim(eq(9L), eq("CONFIRM_DISPATCH"), eq("mixed"), anyString())).thenReturn(true);
+
+        assertThatThrownBy(() -> service.confirm(22L, 9L, "admin", "mixed", new ActionRequest(0, null)))
+            .isInstanceOf(BizException.class).hasMessageContaining("版本不一致");
 
         verify(repository, never()).confirm(anyLong(), anyInt(), anyLong(), anyString(), any());
     }
 
     @Test
-    void reverseIsRejectedAfterActualDepartedWarehouseFactExists() {
+    void actualDepartedWarehouseFactBlocksContainerReverseBeforeAnyRowChanges() {
         CarrierScheduleQueryService carrierSchedules = mock(CarrierScheduleQueryService.class);
-        OutboundDispatchService service = new OutboundDispatchService(repository, List.of(), carrierSchedules);
-        stubReadyChain();
-        OutboundDispatchEntity state = new OutboundDispatchEntity();
-        state.setId(33L); state.setTenantId(7L); state.setInboundId(11L); state.setContainerBookingId(22L);
-        state.setStatus("WAITING_FOR_LOADING"); state.setVersion(1);
-        when(repository.dispatch(7L, 11L, 22L)).thenReturn(state);
+        OutboundDispatchService service = service(carrierSchedules);
+        stubContainer();
+        when(repository.lockBindings(22L)).thenReturn(bindings());
+        when(repository.dispatchLocked(7L, 11L, 22L)).thenReturn(state(31L, 11L, "WAITING_FOR_LOADING", 1));
+        when(repository.dispatchLocked(7L, 12L, 22L)).thenReturn(state(32L, 12L, "WAITING_FOR_LOADING", 1));
         when(repository.claim(eq(9L), eq("REVERSE_DISPATCH"), eq("reverse-blocked"), anyString())).thenReturn(true);
         when(carrierSchedules.hasOutboundDepartureFact(7L, 66L, 22L)).thenReturn(true);
 
-        assertThatThrownBy(() -> service.reverse(9L, "admin", "reverse-blocked",
-            new ActionRequest(11L, 22L, 1, "误操作")))
-            .isInstanceOf(BizException.class).hasMessageContaining("DEPARTED_WAREHOUSE");
+        assertThatThrownBy(() -> service.reverse(22L, 9L, "admin", "reverse-blocked",
+            new ActionRequest(1, "误操作"))).isInstanceOf(BizException.class)
+            .hasMessageContaining("DEPARTED_WAREHOUSE");
 
         verify(repository, never()).reverse(anyLong(), anyInt(), anyLong(), anyString(), any());
     }
 
     @Test
-    void selectorsThatMatchMultipleContainerBindingsRequireDisambiguation() {
-        OutboundDispatchService service = new OutboundDispatchService(repository, List.of());
-        when(repository.bindings(any())).thenReturn(List.of(binding(), binding()));
-        assertThatThrownBy(() -> service.detail(new Query(10L, null, null)))
-            .isInstanceOf(BizException.class).hasMessageContaining("多个出仓聚合");
+    void sameIdempotencyKeyAndPayloadReplaysContainerResultWithoutMutation() {
+        OutboundDispatchService service = serviceWithoutCarrier();
+        stubContainer();
+        AtomicReference<String> requestHash = new AtomicReference<>();
+        when(repository.claim(eq(9L), eq("CONFIRM_DISPATCH"), eq("replay"), anyString())).thenAnswer(invocation -> {
+            requestHash.set(invocation.getArgument(3));
+            return false;
+        });
+        OutboundDispatchOperationEntity existing = new OutboundDispatchOperationEntity();
+        existing.setStatus("SUCCESS");
+        when(repository.operation(9L, "CONFIRM_DISPATCH", "replay")).thenAnswer(invocation -> {
+            existing.setRequestHash(requestHash.get());
+            return existing;
+        });
+
+        Detail replay = service.confirm(22L, 9L, "admin", "replay", new ActionRequest(0, null));
+
+        assertThat(replay.aggregate().containerBookingId()).isEqualTo(22L);
+        verify(repository, never()).confirm(anyLong(), anyInt(), anyLong(), anyString(), any());
     }
 
     @Test
-    void staleDispatchVersionIsRejectedWithoutPartialInboundAdvance() {
-        OutboundDispatchService service = new OutboundDispatchService(repository,
-            List.of(passing("CUSTOMS_CLEARANCE"), passing("SAILING_SCHEDULE")));
-        stubReadyChain();
-        OutboundDispatchEntity state = new OutboundDispatchEntity();
-        state.setId(33L); state.setTenantId(7L); state.setInboundId(11L); state.setContainerBookingId(22L);
-        state.setStatus("READY_FOR_DISPATCH"); state.setVersion(2);
-        when(repository.dispatch(7L, 11L, 22L)).thenReturn(state);
-        when(repository.claim(eq(9L), eq("CONFIRM_DISPATCH"), eq("stale"), anyString())).thenReturn(true);
-
-        assertThatThrownBy(() -> service.confirm(9L, "admin", "stale",
-            new ActionRequest(11L, 22L, 1, null))).isInstanceOf(BizException.class).hasMessageContaining("刷新");
-    }
-
-    @Test
-    void reusedIdempotencyKeyWithDifferentHashIsRejected() {
-        OutboundDispatchService service = new OutboundDispatchService(repository,
-            List.of(passing("CUSTOMS_CLEARANCE"), passing("SAILING_SCHEDULE")));
-        stubReadyChain();
+    void reusedIdempotencyKeyWithDifferentPayloadIsRejected() {
+        OutboundDispatchService service = serviceWithoutCarrier();
         when(repository.claim(eq(9L), eq("CONFIRM_DISPATCH"), eq("reused"), anyString())).thenReturn(false);
         OutboundDispatchOperationEntity existing = new OutboundDispatchOperationEntity();
-        existing.setRequestHash("different"); existing.setStatus("SUCCESS");
+        existing.setRequestHash("different");
+        existing.setStatus("SUCCESS");
         when(repository.operation(9L, "CONFIRM_DISPATCH", "reused")).thenReturn(existing);
 
-        assertThatThrownBy(() -> service.confirm(9L, "admin", "reused",
-            new ActionRequest(11L, 22L, 0, null))).isInstanceOf(BizException.class)
-            .hasMessageContaining("用于不同请求");
+        assertThatThrownBy(() -> service.confirm(22L, 9L, "admin", "reused", new ActionRequest(0, null)))
+            .isInstanceOf(BizException.class).hasMessageContaining("用于不同请求");
     }
 
-    private void stubReadyChain() {
-        when(repository.bindings(any())).thenReturn(List.of(binding()));
+    private OutboundDispatchService serviceWithoutCarrier() {
+        return service(null);
+    }
+
+    private OutboundDispatchService service(CarrierScheduleQueryService carrierSchedules) {
+        return new OutboundDispatchService(repository,
+            List.of(passing("CUSTOMS_CLEARANCE")), carrierSchedules);
+    }
+
+    private void stubContainer() {
+        stubContainer(bindings());
+    }
+
+    private void stubContainer(List<OutboundDispatchReadMapper.Binding> values) {
+        when(repository.bindings(22L)).thenReturn(values);
         when(repository.pick(44L)).thenReturn(new OutboundDispatchReadMapper.IdStatus(55L, "COMPLETED"));
-        when(repository.ocean(22L, 7L)).thenReturn(new OutboundDispatchReadMapper.IdStatus(66L, "RELEASED"));
-        when(repository.truck(22L, 44L, 7L)).thenReturn(new OutboundDispatchReadMapper.IdStatus(77L, "DEPARTED"));
-        when(repository.evidence(7L, 11L)).thenReturn(new OutboundDispatchReadMapper.Evidence(5, 1));
+        when(repository.ocean(22L)).thenReturn(new OutboundDispatchReadMapper.OceanBinding(66L, "RELEASED", 7L));
+        when(repository.truck(22L, 44L)).thenReturn(new OutboundDispatchReadMapper.IdStatus(77L, "DEPARTED"));
+        when(repository.evidence(22L, 44L)).thenReturn(new OutboundDispatchReadMapper.Evidence(5, 1));
     }
 
-    private static OutboundDispatchReadMapper.Binding binding() {
-        return new OutboundDispatchReadMapper.Binding(10L, "O-10", 11L, "I-11", 7L, 8L, "客户A",
+    private void stubConfirmMutation(String key) {
+        when(repository.lockBindings(22L)).thenReturn(bindings());
+        when(repository.dispatchLocked(7L, 11L, 22L)).thenReturn(state(31L, 11L, "READY_FOR_DISPATCH", 0));
+        when(repository.dispatchLocked(7L, 12L, 22L)).thenReturn(state(32L, 12L, "READY_FOR_DISPATCH", 0));
+        when(repository.claim(eq(9L), eq("CONFIRM_DISPATCH"), eq(key), anyString())).thenReturn(true);
+        when(repository.confirm(anyLong(), eq(0), eq(9L), eq("admin"), isNull())).thenReturn(1);
+        when(repository.completeOperation(31L, 9L, "CONFIRM_DISPATCH", key)).thenReturn(1);
+    }
+
+    private static List<OutboundDispatchReadMapper.Binding> bindings() {
+        return List.of(binding(11L, "I-11"), binding(12L, "I-12"));
+    }
+
+    private static OutboundDispatchReadMapper.Binding binding(long inboundId, String inboundCode) {
+        return new OutboundDispatchReadMapper.Binding(10L, "O-10", inboundId, inboundCode, 7L, 8L, "客户A",
             "LOADED", 22L, "CAB-22", "C-22", 44L, "COMPLETED");
     }
 
+    private static OutboundDispatchEntity state(long id, long inboundId, String status, int version) {
+        OutboundDispatchEntity value = new OutboundDispatchEntity();
+        value.setId(id);
+        value.setTenantId(7L);
+        value.setOrderId(10L);
+        value.setInboundId(inboundId);
+        value.setContainerBookingId(22L);
+        value.setStatus(status);
+        value.setVersion(version);
+        return value;
+    }
+
     private static OutboundDispatchGateContributor passing(String code) {
         return new OutboundDispatchGateContributor() {
             @Override public String code() { return code; }
@@ -180,4 +288,5 @@ class OutboundDispatchServiceTest {
             }
         };
     }
+
 }
diff --git a/firstleg/src/test/java/com/baiyue/firstleg/outbound/dispatch/OutboundDispatchSqlContractTest.java b/firstleg/src/test/java/com/baiyue/firstleg/outbound/dispatch/OutboundDispatchSqlContractTest.java
index e587f38f1..0480e784e 100644
--- a/firstleg/src/test/java/com/baiyue/firstleg/outbound/dispatch/OutboundDispatchSqlContractTest.java
+++ b/firstleg/src/test/java/com/baiyue/firstleg/outbound/dispatch/OutboundDispatchSqlContractTest.java
@@ -38,17 +38,25 @@ class OutboundDispatchSqlContractTest {
     }
 
     @Test
-    void openApiPublishesSelectorsGateAndBothVersionedActions() throws Exception {
+    void openApiPublishesOnlyContainerLevelGateDetailAndVersionedActions() throws Exception {
         String openApi = resource("openapi/phase3-outbound-dispatch-v1.yaml");
         assertThat(openApi)
             .contains("outbound-dispatches:")
-            .contains("outbound-dispatches/detail:")
-            .contains("outbound-dispatches/check-gate:")
-            .contains("outbound-dispatches/confirm-dispatch:")
-            .contains("outbound-dispatches/reverse-dispatch:")
+            .contains("outbound-dispatches/{containerBookingId}:")
+            .contains("outbound-dispatches/{containerBookingId}/gate:")
+            .contains("outbound-dispatches/{containerBookingId}/confirm:")
+            .contains("outbound-dispatches/{containerBookingId}/reverse:")
+            .contains("every real inbound binding", "No partial success is possible")
             .contains("Once an actual DEPARTED_WAREHOUSE node exists")
+            .contains("absence never blocks manual outbound confirmation")
+            .contains("PENDING or any non-terminal state never affects gate.passed")
+            .contains("Loading evidence is evaluated once for the physical container/loading plan")
+            .contains("CUSTOMS_DECLARATION whose completedAt must be non-null")
+            .contains("fl_customs_case is not an alternative gate fact")
+            .contains("missing standalone sailing schedule is reference-only")
             .contains("expectedVersion")
-            .contains("Idempotency-Key");
+            .contains("Idempotency-Key")
+            .doesNotContain("confirm-dispatch", "reverse-dispatch", "check-gate", "inboundId, containerBookingId");
     }
 
     private static String migration() throws Exception { return resource("db/phase3-outbound-dispatch-schema.sql"); }
diff --git a/firstleg/src/test/java/com/baiyue/firstleg/outbound/dispatch/PlatformOutboundDispatchControllerContractTest.java b/firstleg/src/test/java/com/baiyue/firstleg/outbound/dispatch/PlatformOutboundDispatchControllerContractTest.java
new file mode 100644
index 000000000..83af6945e
--- /dev/null
+++ b/firstleg/src/test/java/com/baiyue/firstleg/outbound/dispatch/PlatformOutboundDispatchControllerContractTest.java
@@ -0,0 +1,65 @@
+package com.baiyue.firstleg.outbound.dispatch;
+
+import com.baiyue.common.audit.BusinessAudit;
+import com.baiyue.firstleg.outbound.dispatch.controller.PlatformOutboundDispatchController;
+import com.baiyue.firstleg.outbound.dispatch.dto.OutboundDispatchDtos.ActionRequest;
+import org.junit.jupiter.api.Test;
+import org.springframework.security.access.prepost.PreAuthorize;
+import org.springframework.web.bind.annotation.*;
+
+import java.lang.reflect.Method;
+import java.util.Arrays;
+import java.util.List;
+import java.util.Map;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+class PlatformOutboundDispatchControllerContractTest {
+    @Test
+    void exposesOnlyContainerLevelResourcePathsAndExistingPermissions() {
+        assertThat(PlatformOutboundDispatchController.class.getAnnotation(RequestMapping.class).value())
+            .containsExactly("/api/platform/v1/first-leg/outbound-dispatches");
+        Map<String, String> permissions = Map.of(
+            "list", "platform:firstleg:outbound-dispatch:list",
+            "detail", "platform:firstleg:outbound-dispatch:view",
+            "checkGate", "platform:firstleg:outbound-dispatch:check",
+            "confirm", "platform:firstleg:outbound-dispatch:confirm",
+            "reverse", "platform:firstleg:outbound-dispatch:reverse");
+        permissions.forEach((name, permission) -> assertThat(method(name).getAnnotation(PreAuthorize.class).value())
+            .isEqualTo("hasAuthority('" + permission + "')"));
+
+        assertThat(method("detail").getAnnotation(GetMapping.class).value()).containsExactly("/{containerBookingId}");
+        assertThat(method("checkGate").getAnnotation(GetMapping.class).value())
+            .containsExactly("/{containerBookingId}/gate");
+        assertThat(method("confirm").getAnnotation(PostMapping.class).value())
+            .containsExactly("/{containerBookingId}/confirm");
+        assertThat(method("reverse").getAnnotation(PostMapping.class).value())
+            .containsExactly("/{containerBookingId}/reverse");
+    }
+
+    @Test
+    void actionBodyContainsOnlyContainerVersionAndRemarkAndAuditsContainerRoot() {
+        assertThat(Arrays.stream(ActionRequest.class.getRecordComponents()).map(value -> value.getName()))
+            .containsExactly("expectedVersion", "remark")
+            .doesNotContain("inboundId", "containerBookingId");
+        for (String name : List.of("confirm", "reverse")) {
+            BusinessAudit audit = method(name).getAnnotation(BusinessAudit.class);
+            assertThat(audit.resourceType()).isEqualTo("CONTAINER_BOOKING");
+            assertThat(audit.resourceId()).isEqualTo("#containerBookingId");
+        }
+    }
+
+    @Test
+    void everyNonListOperationUsesOnlyContainerBookingIdPathTarget() {
+        for (String name : List.of("detail", "checkGate", "confirm", "reverse")) {
+            assertThat(Arrays.stream(method(name).getParameters())
+                .filter(value -> value.isAnnotationPresent(PathVariable.class))
+                .map(value -> value.getName())).containsExactly("containerBookingId");
+        }
+    }
+
+    private static Method method(String name) {
+        return Arrays.stream(PlatformOutboundDispatchController.class.getDeclaredMethods())
+            .filter(value -> value.getName().equals(name)).findFirst().orElseThrow();
+    }
+}
diff --git a/firstleg/src/test/java/com/baiyue/firstleg/portschedule/controller/CarrierScheduleQueryOpenApiContractTest.java b/firstleg/src/test/java/com/baiyue/firstleg/portschedule/controller/CarrierScheduleQueryOpenApiContractTest.java
index 563955f74..9c3fccd91 100644
--- a/firstleg/src/test/java/com/baiyue/firstleg/portschedule/controller/CarrierScheduleQueryOpenApiContractTest.java
+++ b/firstleg/src/test/java/com/baiyue/firstleg/portschedule/controller/CarrierScheduleQueryOpenApiContractTest.java
@@ -24,6 +24,8 @@ class CarrierScheduleQueryOpenApiContractTest {
             .contains("enum: [READY, MANUAL_REQUIRED, STOPPED]")
             .contains("latestActualNode:")
             .contains("latestActualAt:")
+            .contains("manual actual node is equal to or earlier than latestActualNode")
+            .contains("strictly greater sequence than latestActualNode")
             .contains("internal execution fields are intentionally absent")
             .doesNotContain("enum: [READY, MANUAL_REQUIRED, ARRIVED")
             .doesNotContain("/{queryId}/attempts:")
diff --git a/firstleg/src/test/java/com/baiyue/firstleg/portschedule/repository/CarrierScheduleQuerySqlContractTest.java b/firstleg/src/test/java/com/baiyue/firstleg/portschedule/repository/CarrierScheduleQuerySqlContractTest.java
index ed8d27e52..1c8463923 100644
--- a/firstleg/src/test/java/com/baiyue/firstleg/portschedule/repository/CarrierScheduleQuerySqlContractTest.java
+++ b/firstleg/src/test/java/com/baiyue/firstleg/portschedule/repository/CarrierScheduleQuerySqlContractTest.java
@@ -63,6 +63,8 @@ class CarrierScheduleQuerySqlContractTest {
             .contains("'EXCEPTION_OBSERVED','PROVIDER_QUERY','STOP'")
             .contains("provider_event_id")
             .contains("'PUBLIC_FORM','PUBLIC_WEB_PROXY','PUBLIC_HTML','HCAPTCHA','OFFICIAL_API'")
+            .contains("'MATSON','SML','ZIM','COSCO','EMC','HEDE','OTHER'")
+            .contains("'OFFICIAL_API','MANUAL'")
             .contains("lease_owner")
             .contains("consecutive_failures")
             .doesNotContain("status IN ('READY','MANUAL_REQUIRED','ARRIVED'");
@@ -102,11 +104,14 @@ class CarrierScheduleQuerySqlContractTest {
             .contains("ADD COLUMN next_allowed_at DATETIME(3) NULL")
             .contains("ADD KEY idx_carrier_schedule_query_due (status,next_allowed_at,id)")
             .contains("DROP CHECK chk_carrier_schedule_query_access")
+            .contains("DROP CHECK chk_carrier_schedule_query_carrier")
             .contains("DROP CHECK chk_carrier_schedule_query_status")
             .contains("DROP INDEX uk_carrier_schedule_query_scope")
             .contains("ADD UNIQUE KEY uk_carrier_schedule_query_scope")
             .contains("(customer_id,ocean_booking_id,container_scope_id)")
             .contains("'PUBLIC_FORM','PUBLIC_WEB_PROXY','PUBLIC_HTML','HCAPTCHA','OFFICIAL_API'")
+            .contains("'MATSON','SML','ZIM','COSCO','EMC','HEDE','OTHER'")
+            .contains("'OFFICIAL_API','MANUAL'")
             .contains("status IN ('READY','MANUAL_REQUIRED','STOPPED')")
             .contains("ARRIVED_DESTINATION_PORT")
             .contains("EMPTY_RETURNED")
diff --git a/firstleg/src/test/java/com/baiyue/firstleg/portschedule/service/CarrierScheduleAdapterRegistryTest.java b/firstleg/src/test/java/com/baiyue/firstleg/portschedule/service/CarrierScheduleAdapterRegistryTest.java
index 04f896a2b..2778ca65e 100644
--- a/firstleg/src/test/java/com/baiyue/firstleg/portschedule/service/CarrierScheduleAdapterRegistryTest.java
+++ b/firstleg/src/test/java/com/baiyue/firstleg/portschedule/service/CarrierScheduleAdapterRegistryTest.java
@@ -39,4 +39,16 @@ class CarrierScheduleAdapterRegistryTest {
         assertThatThrownBy(() -> registry.prepare("UNKNOWN", "BOOKING_NO", "X"))
             .hasMessageContaining("仅支持MATSON");
     }
+
+    @Test
+    void outboundUnknownCarrierFallsBackToManualWithoutPretendingToBeAnotherProvider() {
+        var result = registry.prepareOutbound("OTHER", "CONTAINER_NO", "CSNU1234567");
+
+        assertThat(result.carrierCode()).isEqualTo("OTHER");
+        assertThat(result.accessMode()).isEqualTo("MANUAL");
+        assertThat(result.status()).isEqualTo("MANUAL_REQUIRED");
+        assertThat(result.coverageGapCode()).isEqualTo("UNSUPPORTED_CARRIER");
+        assertThat(result.officialUrl()).isEmpty();
+        assertThat(registry.prepareOutbound(null, "BOOKING_NO", "OB-1").carrierCode()).isEqualTo("OTHER");
+    }
 }
diff --git a/firstleg/src/test/java/com/baiyue/firstleg/portschedule/service/CarrierScheduleNodeOutboxServiceTest.java b/firstleg/src/test/java/com/baiyue/firstleg/portschedule/service/CarrierScheduleNodeOutboxServiceTest.java
index ee314b6d1..0f5bea2a6 100644
--- a/firstleg/src/test/java/com/baiyue/firstleg/portschedule/service/CarrierScheduleNodeOutboxServiceTest.java
+++ b/firstleg/src/test/java/com/baiyue/firstleg/portschedule/service/CarrierScheduleNodeOutboxServiceTest.java
@@ -61,6 +61,25 @@ class CarrierScheduleNodeOutboxServiceTest {
         verify(mapper, never()).insert(org.mockito.ArgumentMatchers.any(InboundOutboxEntity.class));
     }
 
+    @Test
+    void initialOutboundDepartureUsesVersionZeroWithoutEnvelopeFailure() throws Exception {
+        CarrierScheduleQueryEntity query = query();
+        query.setVersion(0);
+        CarrierScheduleNodeFactEntity fact = fact();
+        fact.setStandardNode("DEPARTED_WAREHOUSE"); fact.setNodeSequence(10);
+        fact.setProviderCode("FIRSTLEG"); fact.setProviderEventId("OUTBOUND_CONFIRM");
+        fact.setProviderNodeCode("OUTBOUND_CONFIRM");
+
+        service.publish(query, fact, "CSNU1234567");
+
+        ArgumentCaptor<InboundOutboxEntity> captor = ArgumentCaptor.forClass(InboundOutboxEntity.class);
+        verify(mapper).insert(captor.capture());
+        EventEnvelope envelope = objectMapper.readValue(captor.getValue().getPayloadJson(), EventEnvelope.class);
+        assertThat(envelope.aggregateVersion()).isZero();
+        assertThat(envelope.handoverVersion()).isEqualTo(1L);
+        assertThat(envelope.payload().path("standardNode").asText()).isEqualTo("DEPARTED_WAREHOUSE");
+    }
+
     private static CarrierScheduleQueryEntity query() {
         CarrierScheduleQueryEntity value = new CarrierScheduleQueryEntity();
         value.setId(2088000000000000001L); value.setCustomerId(2088000000000000002L);
diff --git a/firstleg/src/test/java/com/baiyue/firstleg/portschedule/service/CarrierScheduleQueryServiceTest.java b/firstleg/src/test/java/com/baiyue/firstleg/portschedule/service/CarrierScheduleQueryServiceTest.java
index e88ed6f9c..78b425d42 100644
--- a/firstleg/src/test/java/com/baiyue/firstleg/portschedule/service/CarrierScheduleQueryServiceTest.java
+++ b/firstleg/src/test/java/com/baiyue/firstleg/portschedule/service/CarrierScheduleQueryServiceTest.java
@@ -23,6 +23,7 @@ import org.mockito.Mock;
 import org.mockito.ArgumentCaptor;
 import org.mockito.MockitoAnnotations;
 import org.springframework.test.util.ReflectionTestUtils;
+import org.springframework.dao.DataIntegrityViolationException;
 
 import java.time.Clock;
 import java.time.Instant;
@@ -47,12 +48,14 @@ class CarrierScheduleQueryServiceTest {
     @Mock private PortScheduleRepository portSchedules;
     @Mock private CarrierScheduleNodeOutboxService nodeOutbox;
     @InjectMocks private CarrierScheduleQueryService service;
+    private CarrierScheduleAdapterRegistry adapters;
 
     @BeforeEach
     void setUp() throws Exception {
         MockitoAnnotations.openMocks(this);
         set("objectMapper", new ObjectMapper().findAndRegisterModules());
-        set("adapters", new CarrierScheduleAdapterRegistry());
+        adapters = new CarrierScheduleAdapterRegistry();
+        set("adapters", adapters);
         set("clock", Clock.fixed(Instant.parse("2026-08-10T04:00:00Z"), ZoneOffset.UTC));
         when(repository.claimOperation(any(), anyLong(), anyString(), anyString(), anyString())).thenReturn(true);
         when(repository.completeOperation(anyLong(), anyLong(), anyString(), anyString())).thenReturn(1);
@@ -85,7 +88,7 @@ class CarrierScheduleQueryServiceTest {
     @Test
     void outboundConfirmationCreatesTaskWithContainerTrackingAndDepartureNode() {
         OceanBookingEntity booking = new OceanBookingEntity(); booking.setCustomerId(10001L);
-        booking.setShippingCompanyName("中远海运"); booking.setBookingNo("OB-260810-0001");
+        booking.setShippingCompanyName("中远海运"); booking.setCarrierCode("COSCO"); booking.setBookingNo("OB-260810-0001");
         var container = new com.baiyue.firstleg.entity.ContainerBookingEntity();
         container.setContainerNo("CSNU1234567");
         when(portSchedules.oceanBooking(10L)).thenReturn(booking);
@@ -96,12 +99,94 @@ class CarrierScheduleQueryServiceTest {
 
         assertThat(result.getTriggerSource()).isEqualTo("OUTBOUND_CONFIRM");
         assertThat(result.getCarrierCode()).isEqualTo("COSCO");
+        assertThat(result.getStatus()).isEqualTo("MANUAL_REQUIRED");
+        assertThat(result.getAccessMode()).isEqualTo("OFFICIAL_API");
+        assertThat(result.getManualReason()).contains("Cargo Tracking API");
         assertThat(result.getTrackingType()).isEqualTo("CONTAINER_NO");
         assertThat(result.getLatestStandardNode()).isEqualTo("DEPARTED_WAREHOUSE");
         assertThat(result.getNextAllowedAt()).isEqualTo(LocalDateTime.of(2026, 8, 10, 12, 30));
         verify(repository).insertIfAbsent(any(com.baiyue.firstleg.portschedule.entity.CarrierScheduleNodeFactEntity.class));
     }
 
+    @Test
+    void outboundUnknownCarrierCreatesManualTaskAndPreservesBookingCarrierIdentity() {
+        OceanBookingEntity booking = new OceanBookingEntity(); booking.setCustomerId(10001L);
+        booking.setShippingCompanyId(9988L); booking.setShippingCompanyName("示例船公司"); booking.setCarrierCode("OTHER");
+        var container = new com.baiyue.firstleg.entity.ContainerBookingEntity();
+        container.setContainerNo("CSNU1234567");
+        when(portSchedules.oceanBooking(10L)).thenReturn(booking);
+        when(portSchedules.containerBooking(20L)).thenReturn(container);
+        when(portSchedules.allocation(10L, 20L)).thenReturn(new OceanBookingContainerAllocationEntity());
+
+        CarrierScheduleQueryEntity result = service.ensureFromOutboundConfirm(10001L, 10L, 20L, 7L, "admin");
+
+        assertThat(result.getCarrierCode()).isEqualTo("OTHER");
+        assertThat(result.getAccessMode()).isEqualTo("MANUAL");
+        assertThat(result.getStatus()).isEqualTo("MANUAL_REQUIRED");
+        assertThat(result.getManualReason()).contains("carrierCode=OTHER", "shippingCompanyId=9988", "shippingCompanyName=示例船公司");
+        assertThat(result.getNextAllowedAt()).isNull();
+        assertThat(result.getLatestStandardNode()).isEqualTo("DEPARTED_WAREHOUSE");
+    }
+
+    @Test
+    void outboundSupportedCarrierCreatesReadyTask() {
+        ReflectionTestUtils.setField(adapters, "matsonAutomated", true);
+        OceanBookingEntity booking = new OceanBookingEntity(); booking.setCustomerId(10001L);
+        booking.setShippingCompanyName("美森"); booking.setCarrierCode("MATSON");
+        var container = new com.baiyue.firstleg.entity.ContainerBookingEntity();
+        container.setContainerNo("MATU4646247");
+        when(portSchedules.oceanBooking(10L)).thenReturn(booking);
+        when(portSchedules.containerBooking(20L)).thenReturn(container);
+        when(portSchedules.allocation(10L, 20L)).thenReturn(new OceanBookingContainerAllocationEntity());
+
+        CarrierScheduleQueryEntity result = service.ensureFromOutboundConfirm(10001L, 10L, 20L, 7L, "admin");
+
+        assertThat(result.getCarrierCode()).isEqualTo("MATSON");
+        assertThat(result.getStatus()).isEqualTo("READY");
+        assertThat(result.getAccessMode()).isEqualTo("PUBLIC_WEB_PROXY");
+        assertThat(result.getManualReason()).isNull();
+        assertThat(result.getNextAllowedAt()).isEqualTo(LocalDateTime.of(2026, 8, 10, 12, 30));
+    }
+
+    @Test
+    void outboundReplayKeepsSingleTaskAndSingleDepartureFact() {
+        OceanBookingEntity booking = new OceanBookingEntity(); booking.setCustomerId(10001L);
+        booking.setShippingCompanyName("示例船公司"); booking.setCarrierCode("OTHER");
+        var container = new com.baiyue.firstleg.entity.ContainerBookingEntity();
+        container.setContainerNo("CSNU1234567");
+        when(portSchedules.oceanBooking(10L)).thenReturn(booking);
+        when(portSchedules.containerBooking(20L)).thenReturn(container);
+        when(portSchedules.allocation(10L, 20L)).thenReturn(new OceanBookingContainerAllocationEntity());
+
+        CarrierScheduleQueryEntity first = service.ensureFromOutboundConfirm(10001L, 10L, 20L, 7L, "admin");
+        when(repository.findByBusinessScope(10001L, 10L, 20L)).thenReturn(first);
+        CarrierScheduleQueryEntity replay = service.ensureFromOutboundConfirm(10001L, 10L, 20L, 7L, "admin");
+
+        assertThat(replay).isSameAs(first);
+        verify(repository, times(1)).insert(any(CarrierScheduleQueryEntity.class));
+        verify(repository, times(1)).insertIfAbsent(any(CarrierScheduleNodeFactEntity.class));
+    }
+
+    @Test
+    void outboundPersistenceContractMismatchReturnsExplicitBusinessConflict() {
+        OceanBookingEntity booking = new OceanBookingEntity(); booking.setCustomerId(10001L);
+        booking.setShippingCompanyName("示例船公司"); booking.setCarrierCode("OTHER");
+        var container = new com.baiyue.firstleg.entity.ContainerBookingEntity();
+        container.setContainerNo("CSNU1234567");
+        when(portSchedules.oceanBooking(10L)).thenReturn(booking);
+        when(portSchedules.containerBooking(20L)).thenReturn(container);
+        when(portSchedules.allocation(10L, 20L)).thenReturn(new OceanBookingContainerAllocationEntity());
+        org.mockito.Mockito.doThrow(new DataIntegrityViolationException("check constraint rejected"))
+            .when(repository).insert(any(CarrierScheduleQueryEntity.class));
+
+        assertThatThrownBy(() -> service.ensureFromOutboundConfirm(10001L, 10L, 20L, 7L, "admin"))
+            .isInstanceOf(BizException.class)
+            .hasMessageContaining("船节点持久化契约与当前服务不一致")
+            .hasMessageContaining("QUERY_TASK")
+            .hasMessageContaining("OTHER/MANUAL");
+        verify(repository, never()).insertIfAbsent(any(CarrierScheduleNodeFactEntity.class));
+    }
+
     @Test
     void providerActualObservationAdvancesBusinessNodeWithoutChangingTaskStatus() {
         CarrierScheduleQueryEntity task = task(0, 0);
@@ -207,6 +292,34 @@ class CarrierScheduleQueryServiceTest {
         verify(repository).completeOperation(eq(1L), eq(7L), eq("manual-empty-1"), anyString());
     }
 
+    @Test
+    void manualActualRejectsSameAndEarlierNodesIncludingSameKeyRetryWithoutDrift() {
+        CarrierScheduleQueryEntity task = task(0, 3);
+        task.setStatus("READY"); task.setLatestStandardNode("PICKED_UP");
+        task.setLatestNodeObservedAt(NOW.minusDays(1));
+        when(repository.lock(1L)).thenReturn(task);
+
+        ManualNodeRequest sameNode = new ManualNodeRequest(3, "PICKED_UP", NOW, null,
+            NOW.plusDays(1), null, "Los Angeles", "重复确认提柜");
+        assertThatThrownBy(() -> service.addManualNode(1L, 7L, "admin", "manual-picked-up-again", sameNode))
+            .isInstanceOf(BizException.class)
+            .hasMessage("人工实际节点必须严格晚于当前最新实际节点");
+        assertThatThrownBy(() -> service.addManualNode(1L, 7L, "admin", "manual-picked-up-again", sameNode))
+            .isInstanceOf(BizException.class)
+            .hasMessage("人工实际节点必须严格晚于当前最新实际节点");
+        assertThatThrownBy(() -> service.addManualNode(1L, 7L, "admin", "manual-pickup-ready-late",
+            new ManualNodeRequest(3, "PICKUP_READY", NOW, null, NOW.plusDays(2), null,
+                "Los Angeles", "倒序补录可提柜")))
+            .isInstanceOf(BizException.class)
+            .hasMessage("人工实际节点必须严格晚于当前最新实际节点");
+
+        verify(repository, never()).insertIfAbsent(any(CarrierScheduleNodeFactEntity.class));
+        verify(repository, never()).updateState(any(), any(Integer.class), anyLong(), anyString());
+        verify(repository, never()).insert(any(com.baiyue.firstleg.portschedule.entity.CarrierScheduleQueryHistoryEntity.class));
+        verify(repository, never()).completeOperation(anyLong(), anyLong(), anyString(), anyString());
+        verify(nodeOutbox, never()).publish(any(), any(), anyString());
+    }
+
     @Test
     void manualEstimatedFactAdvancesVersionWithoutAdvancingActualProgress() {
         CarrierScheduleQueryEntity before = task(0, 3);
diff --git a/firstleg/src/test/java/com/baiyue/firstleg/pricebookquery/PriceBookQueryArchitectureTest.java b/firstleg/src/test/java/com/baiyue/firstleg/pricebookquery/PriceBookQueryArchitectureTest.java
new file mode 100644
index 000000000..3f9734d86
--- /dev/null
+++ b/firstleg/src/test/java/com/baiyue/firstleg/pricebookquery/PriceBookQueryArchitectureTest.java
@@ -0,0 +1,67 @@
+package com.baiyue.firstleg.pricebookquery;
+
+import com.baiyue.firstleg.pricebookquery.application.port.out.PriceBookQueryReader;
+import com.tngtech.archunit.core.domain.JavaClasses;
+import com.tngtech.archunit.core.importer.ClassFileImporter;
+import com.tngtech.archunit.core.importer.ImportOption;
+import org.junit.jupiter.api.Test;
+
+import static com.tngtech.archunit.core.domain.JavaClass.Predicates.resideInAPackage;
+import static com.tngtech.archunit.core.domain.JavaClass.Predicates.resideOutsideOfPackage;
+import static com.tngtech.archunit.lang.syntax.ArchRuleDefinition.classes;
+import static com.tngtech.archunit.lang.syntax.ArchRuleDefinition.noClasses;
+
+class PriceBookQueryArchitectureTest {
+    private static final String FIRSTLEG = "com.baiyue.firstleg..";
+    private static final String SLICE = "com.baiyue.firstleg.pricebookquery..";
+    private static final String APPLICATION = "com.baiyue.firstleg.pricebookquery.application..";
+    private static final String INPUT_PORT = "com.baiyue.firstleg.pricebookquery.application.port.in..";
+    private static final String OUTPUT_PORT = "com.baiyue.firstleg.pricebookquery.application.port.out..";
+    private static final String MODEL = "com.baiyue.firstleg.pricebookquery.application.model..";
+    private static final String PERSISTENCE = "com.baiyue.firstleg.pricebookquery.adapter.out.persistence..";
+
+    private static final JavaClasses PRODUCTION_CLASSES = new ClassFileImporter()
+        .withImportOption(ImportOption.Predefined.DO_NOT_INCLUDE_TESTS)
+        .withImportOption(ImportOption.Predefined.DO_NOT_INCLUDE_JARS)
+        .importPackages("com.baiyue.firstleg");
+
+    @Test
+    void applicationStaysFreeOfWebAndPersistenceFrameworks() {
+        noClasses().that().resideInAPackage(APPLICATION)
+            .should().dependOnClassesThat().resideInAnyPackage(
+                "org.springframework.web..",
+                "org.apache.ibatis..",
+                "com.baomidou.mybatisplus..")
+            .check(PRODUCTION_CLASSES);
+    }
+
+    @Test
+    void applicationOnlyDependsOnItsOwnSliceWithinFirstleg() {
+        classes().that().resideInAPackage(APPLICATION)
+            .should().onlyDependOnClassesThat(
+                resideOutsideOfPackage(FIRSTLEG).or(resideInAPackage(APPLICATION)))
+            .check(PRODUCTION_CLASSES);
+    }
+
+    @Test
+    void persistenceAdapterCollaboratesThroughTheOutputPortAndModel() {
+        classes().that().resideInAPackage(PERSISTENCE)
+            .should().onlyDependOnClassesThat(
+                resideOutsideOfPackage(SLICE)
+                    .or(resideInAPackage(PERSISTENCE))
+                    .or(resideInAPackage(OUTPUT_PORT))
+                    .or(resideInAPackage(MODEL)))
+            .andShould().beAssignableTo(PriceBookQueryReader.class)
+            .check(PRODUCTION_CLASSES);
+    }
+
+    @Test
+    void consumersOnlySeeTheInputPortAndReadModel() {
+        noClasses().that().resideOutsideOfPackage(SLICE)
+            .should().dependOnClassesThat(
+                resideInAPackage(SLICE)
+                    .and(resideOutsideOfPackage(INPUT_PORT))
+                    .and(resideOutsideOfPackage(MODEL)))
+            .check(PRODUCTION_CLASSES);
+    }
+}
diff --git a/firstleg/src/test/java/com/baiyue/firstleg/pricebookquery/PriceBookQueryServiceTest.java b/firstleg/src/test/java/com/baiyue/firstleg/pricebookquery/PriceBookQueryServiceTest.java
new file mode 100644
index 000000000..db339e20a
--- /dev/null
+++ b/firstleg/src/test/java/com/baiyue/firstleg/pricebookquery/PriceBookQueryServiceTest.java
@@ -0,0 +1,46 @@
+package com.baiyue.firstleg.pricebookquery;
+
+import com.baiyue.firstleg.pricebookquery.application.PriceBookQueryService;
+import com.baiyue.firstleg.pricebookquery.application.model.PriceBookQueryRows.ChannelPrefixRow;
+import com.baiyue.firstleg.pricebookquery.application.model.PriceBookQueryRows.ChannelRow;
+import com.baiyue.firstleg.pricebookquery.application.port.out.PriceBookQueryReader;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+
+import java.util.List;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+@ExtendWith(MockitoExtension.class)
+class PriceBookQueryServiceTest {
+    @Mock private PriceBookQueryReader reader;
+    @InjectMocks private PriceBookQueryService service;
+
+    @Test
+    void delegatesStableReadOperationsToTheOutputPort() {
+        ChannelPrefixRow prefix = new ChannelPrefixRow("SEA", "IN", "OUT");
+        when(reader.findActiveVersionId()).thenReturn(9L);
+        when(reader.findChannelPrefix("SEA")).thenReturn(prefix);
+
+        assertThat(service.activeVersionId()).isEqualTo(9L);
+        assertThat(service.channelPrefix("SEA")).isSameAs(prefix);
+        verify(reader).findActiveVersionId();
+        verify(reader).findChannelPrefix("SEA");
+    }
+
+    @Test
+    void keepsChannelAvailabilityAsApplicationLogic() {
+        ChannelRow channel = new ChannelRow();
+        channel.setChannelCode("SEA");
+        when(reader.findChannels(9L, 3L)).thenReturn(List.of(channel));
+
+        assertThat(service.channelAvailable(9L, 3L, "SEA")).isTrue();
+        assertThat(service.channelAvailable(9L, 3L, "AIR")).isFalse();
+        verify(reader, org.mockito.Mockito.times(2)).findChannels(9L, 3L);
+    }
+}
diff --git a/firstleg/src/test/java/com/baiyue/firstleg/pricing/FbaWarehouseRateEstimatorTest.java b/firstleg/src/test/java/com/baiyue/firstleg/pricing/FbaWarehouseRateEstimatorTest.java
index c1b94e43d..7fdcef6cd 100644
--- a/firstleg/src/test/java/com/baiyue/firstleg/pricing/FbaWarehouseRateEstimatorTest.java
+++ b/firstleg/src/test/java/com/baiyue/firstleg/pricing/FbaWarehouseRateEstimatorTest.java
@@ -1,7 +1,7 @@
 package com.baiyue.firstleg.pricing;
 
 import com.baiyue.common.core.exception.BizException;
-import com.baiyue.firstleg.repository.PriceBookQueryRows.RateRow;
+import com.baiyue.firstleg.pricebookquery.application.model.PriceBookQueryRows.RateRow;
 import org.junit.jupiter.api.Test;
 
 import java.math.BigDecimal;
diff --git a/firstleg/src/test/java/com/baiyue/firstleg/pricing/RegionWeightTierEstimatorTest.java b/firstleg/src/test/java/com/baiyue/firstleg/pricing/RegionWeightTierEstimatorTest.java
index 06fe39203..6c9af0572 100644
--- a/firstleg/src/test/java/com/baiyue/firstleg/pricing/RegionWeightTierEstimatorTest.java
+++ b/firstleg/src/test/java/com/baiyue/firstleg/pricing/RegionWeightTierEstimatorTest.java
@@ -1,7 +1,7 @@
 package com.baiyue.firstleg.pricing;
 
 import com.baiyue.common.core.exception.BizException;
-import com.baiyue.firstleg.repository.PriceBookQueryRows.RateRow;
+import com.baiyue.firstleg.pricebookquery.application.model.PriceBookQueryRows.RateRow;
 import org.junit.jupiter.api.Test;
 
 import java.math.BigDecimal;
diff --git a/firstleg/src/test/java/com/baiyue/firstleg/repository/ContainerBookingMapperContractTest.java b/firstleg/src/test/java/com/baiyue/firstleg/repository/ContainerBookingMapperContractTest.java
index 68a9ec0f3..16944ca9c 100644
--- a/firstleg/src/test/java/com/baiyue/firstleg/repository/ContainerBookingMapperContractTest.java
+++ b/firstleg/src/test/java/com/baiyue/firstleg/repository/ContainerBookingMapperContractTest.java
@@ -53,15 +53,6 @@ class ContainerBookingMapperContractTest {
             .contains("customer_item.account_id = #{query.customerId}");
     }
 
-    @Test
-    @DisplayName("首次关联客户隔离查询使用原生不等号")
-    void customerMismatchQueryUsesNativeSqlOperator() throws Exception {
-        String sql = ContainerBookingMapper.class
-            .getDeclaredMethod("hasMismatchedCustomerItems", long.class, long.class)
-            .getAnnotation(Select.class).value()[0];
-        assertThat(sql).contains("i.account_id<>#{customerId}").doesNotContain("&lt;&gt;");
-    }
-
     @Test
     @DisplayName("关联订舱 SQL 的预计到港参数与 Mapper 参数名一致")
     void linkReleasedBookingUsesDeclaredEstimatedArrivalParameter() {
diff --git a/firstleg/src/test/java/com/baiyue/firstleg/repository/ContainerOverviewSqlContractTest.java b/firstleg/src/test/java/com/baiyue/firstleg/repository/ContainerOverviewSqlContractTest.java
index afecb8b9e..b19652ad9 100644
--- a/firstleg/src/test/java/com/baiyue/firstleg/repository/ContainerOverviewSqlContractTest.java
+++ b/firstleg/src/test/java/com/baiyue/firstleg/repository/ContainerOverviewSqlContractTest.java
@@ -12,6 +12,14 @@ import java.nio.file.Path;
 import static org.assertj.core.api.Assertions.assertThat;
 
 class ContainerOverviewSqlContractTest {
+    @Test void overviewIncludesExactlyTheFourCurrentBusinessDocumentTypes() throws Exception {
+        String sql = String.join(" ", ContainerOverviewMapper.class.getDeclaredMethod("documents", long.class)
+            .getAnnotation(Select.class).value());
+        assertThat(sql)
+            .contains("'DESTINATION_CLEARANCE'", "'CUSTOMS_DECLARATION'", "'DELIVERY_ORDER'", "'PICKUP_ORDER'")
+            .contains("ORDER BY document_type");
+    }
+
     @Test void pdaSummarySelectsRecordFieldsExplicitlyIncludingTaskVersion() throws Exception {
         String sql = String.join(" ", ContainerOverviewMapper.class.getDeclaredMethod("pickTask", long.class)
             .getAnnotation(Select.class).value());
diff --git a/firstleg/src/test/java/com/baiyue/firstleg/repository/LoadingListQueryMapperContractTest.java b/firstleg/src/test/java/com/baiyue/firstleg/repository/LoadingListQueryMapperContractTest.java
index 11e77ed09..d25d76a32 100644
--- a/firstleg/src/test/java/com/baiyue/firstleg/repository/LoadingListQueryMapperContractTest.java
+++ b/firstleg/src/test/java/com/baiyue/firstleg/repository/LoadingListQueryMapperContractTest.java
@@ -116,6 +116,21 @@ class LoadingListQueryMapperContractTest {
             .contains("operator_id");
     }
 
+    @Test
+    void deliveryAndPickupUseTheCanonicalDocumentInsertAndPlanHistoryMapper() throws Exception {
+        String documentInsert = sql("insertDocument", Insert.class);
+        String historyInsert = sql("insertHistory", Insert.class);
+        assertThat(documentInsert)
+            .contains("INSERT INTO fl_container_document")
+            .contains("#{documentType}", "#{fileId}", "#{fileHash}")
+            .contains("CURRENT_TIMESTAMP(3)", "version")
+            .doesNotContain("CUSTOMS_DECLARATION", "DESTINATION_CLEARANCE");
+        assertThat(historyInsert)
+            .contains("INSERT INTO fl_loading_plan_history")
+            .contains("#{planId}", "#{operationId}", "#{actionType}")
+            .contains("#{beforeSnapshot}", "#{afterSnapshot}");
+    }
+
     private static String sql(String methodName, Class<?> annotationType) throws Exception {
         Method method = java.util.Arrays.stream(LoadingListQueryMapper.class.getDeclaredMethods())
             .filter(candidate -> candidate.getName().equals(methodName))
diff --git a/firstleg/src/test/java/com/baiyue/firstleg/repository/SmartLoadingSqlContractTest.java b/firstleg/src/test/java/com/baiyue/firstleg/repository/SmartLoadingSqlContractTest.java
index 27c6c17a3..e5c1ddc08 100644
--- a/firstleg/src/test/java/com/baiyue/firstleg/repository/SmartLoadingSqlContractTest.java
+++ b/firstleg/src/test/java/com/baiyue/firstleg/repository/SmartLoadingSqlContractTest.java
@@ -151,8 +151,8 @@ class SmartLoadingSqlContractTest {
             .contains("CREATE TRIGGER trg_container_booking_before_update")
             .contains("current_plan_status IN ('LOADING','COMPLETED')")
             .contains("装柜作业开始后仅允许修改集装箱号与放舱运输数据")
-            .contains("NEW.document_type NOT IN ('DESTINATION_CLEARANCE', 'CUSTOMS_DECLARATION')")
-            .contains("OLD.document_type NOT IN ('DESTINATION_CLEARANCE', 'CUSTOMS_DECLARATION')");
+            .contains("NEW.document_type NOT IN ('DESTINATION_CLEARANCE', 'CUSTOMS_DECLARATION', 'DELIVERY_ORDER', 'PICKUP_ORDER')")
+            .contains("OLD.document_type NOT IN ('DESTINATION_CLEARANCE', 'CUSTOMS_DECLARATION', 'DELIVERY_ORDER', 'PICKUP_ORDER')");
     }
 
     private static void assertSimpleCustomsDocumentContract(String sql) {
@@ -161,8 +161,8 @@ class SmartLoadingSqlContractTest {
             .contains("file_hash VARCHAR(64) NULL")
             .contains("completed_by BIGINT UNSIGNED NULL")
             .contains("completed_at DATETIME(3) NULL")
-            .contains("NEW.document_type NOT IN ('DESTINATION_CLEARANCE', 'CUSTOMS_DECLARATION')")
-            .contains("OLD.document_type NOT IN ('DESTINATION_CLEARANCE', 'CUSTOMS_DECLARATION')")
+            .contains("NEW.document_type NOT IN ('DESTINATION_CLEARANCE', 'CUSTOMS_DECLARATION', 'DELIVERY_ORDER', 'PICKUP_ORDER')")
+            .contains("OLD.document_type NOT IN ('DESTINATION_CLEARANCE', 'CUSTOMS_DECLARATION', 'DELIVERY_ORDER', 'PICKUP_ORDER')")
             .doesNotContain("OLD.document_type NOT IN ('DESTINATION_CLEARANCE', 'CUSTOMS_DECLARATION') THEN\n    SIGNAL SQLSTATE '45000' SET MESSAGE_TEXT = '装柜完成后货柜全部只读");
     }
 
diff --git a/firstleg/src/test/java/com/baiyue/firstleg/service/ContainerOverviewServiceTest.java b/firstleg/src/test/java/com/baiyue/firstleg/service/ContainerOverviewServiceTest.java
index 0a7ea777f..114968d92 100644
--- a/firstleg/src/test/java/com/baiyue/firstleg/service/ContainerOverviewServiceTest.java
+++ b/firstleg/src/test/java/com/baiyue/firstleg/service/ContainerOverviewServiceTest.java
@@ -47,7 +47,13 @@ class ContainerOverviewServiceTest {
                 71L, 81L, 91L, "LOADING_DOOR_OPEN", 101L, "door.jpg", "ACTIVE", LocalDateTime.now()),
             new ContainerOverviewMapper.PhotoRow(
                 72L, 81L, 91L, "LOADING_DOOR_OPEN", 102L, "void.jpg", "VOID", LocalDateTime.now())));
-        when(mapper.documents(41L)).thenReturn(java.util.List.of());
+        com.baiyue.firstleg.entity.ContainerDocumentEntity customs = new com.baiyue.firstleg.entity.ContainerDocumentEntity();
+        customs.setId(103L); customs.setDocumentType("CUSTOMS_DECLARATION"); customs.setFileId(104L);
+        customs.setFileName("customs.pdf"); customs.setVersion(3);
+        com.baiyue.firstleg.entity.ContainerDocumentEntity clearance = new com.baiyue.firstleg.entity.ContainerDocumentEntity();
+        clearance.setId(105L); clearance.setDocumentType("DESTINATION_CLEARANCE"); clearance.setFileId(106L);
+        clearance.setFileName("clearance.pdf"); clearance.setVersion(1);
+        when(mapper.documents(41L)).thenReturn(java.util.List.of(customs, clearance));
         when(mapper.exceptions(41L)).thenReturn(java.util.List.of());
         when(mapper.transport(41L)).thenReturn(java.util.List.of());
         when(mapper.pickTimeline(61L)).thenReturn(java.util.List.of());
@@ -66,6 +72,15 @@ class ContainerOverviewServiceTest {
             assertThat(count.evidenceType()).isEqualTo("LOADING_DOOR_OPEN");
             assertThat(count.count()).isEqualTo(1);
         });
+        assertThat(overview.documents()).extracting(document -> document.documentType())
+            .containsExactly("CUSTOMS_DECLARATION", "DESTINATION_CLEARANCE");
+        assertThat(overview.documents()).filteredOn(document -> "CUSTOMS_DECLARATION".equals(document.documentType()))
+            .singleElement().satisfies(document -> assertThat(document.version()).isEqualTo(3));
+        assertThat(overview.documents()).filteredOn(document -> "DESTINATION_CLEARANCE".equals(document.documentType()))
+            .singleElement().satisfies(document -> {
+                assertThat(document.fileId()).isEqualTo(106L);
+                assertThat(document.version()).isEqualTo(1);
+            });
     }
 
     @Test void downloadsOnlyActivePhotoOwnedByContainerLoadingPlan() {
diff --git a/firstleg/src/test/java/com/baiyue/firstleg/service/ContainerServiceTest.java b/firstleg/src/test/java/com/baiyue/firstleg/service/ContainerServiceTest.java
index 9ac608ba6..4dba3b293 100644
--- a/firstleg/src/test/java/com/baiyue/firstleg/service/ContainerServiceTest.java
+++ b/firstleg/src/test/java/com/baiyue/firstleg/service/ContainerServiceTest.java
@@ -17,8 +17,8 @@ import com.baiyue.firstleg.mapper.ContainerTransportHistoryMapper;
 import com.baiyue.firstleg.repository.ContainerRepository;
 import com.baiyue.firstleg.repository.LoadingPickRepository;
 import com.baiyue.firstleg.repository.SmartLoadingRepository;
-import com.baiyue.firstleg.repository.PriceBookQueryRepository;
-import com.baiyue.firstleg.repository.PriceBookQueryRows.ChannelRow;
+import com.baiyue.firstleg.pricebookquery.application.model.PriceBookQueryRows.ChannelRow;
+import com.baiyue.firstleg.pricebookquery.application.port.in.PriceBookQueryUseCase;
 import com.baiyue.firstleg.oceanbooking.repository.OceanBookingRepository;
 import com.baiyue.firstleg.oceanbooking.entity.OceanBookingEntity;
 import com.baiyue.firstleg.oceanbooking.entity.OceanBookingContainerAllocationEntity;
@@ -51,7 +51,7 @@ class ContainerServiceTest {
     @MockBean private SmartLoadingRepository smartLoadingRepository;
     @MockBean private LoadingPickRepository loadingPickRepository;
     @MockBean private LoadingPickService loadingPickService;
-    @MockBean private PriceBookQueryRepository priceBooks;
+    @MockBean private PriceBookQueryUseCase priceBooks;
     @MockBean private OceanBookingRepository oceanBookings;
     @MockBean private WarehouseSupplierSnapshotService suppliers;
     @MockBean private FirstlegDocumentNumberGenerator documentNumbers;
@@ -288,7 +288,7 @@ class ContainerServiceTest {
     void linksReleasedBookingAfterPreloading() {
         ContainerBookingEntity container = booking("EDITING", 2);
         container.setWarehouseId(101L); container.setChannelCode("SEA-US"); container.setContainerType("40HC");
-        container.setCapacityCbm(new BigDecimal("76.0000")); container.setMaxWeightKg(new BigDecimal("28000.000"));
+        container.setCapacityCbm(new BigDecimal("85.5000")); container.setMaxWeightKg(new BigDecimal("27500.000"));
         OceanBookingEntity booking = new OceanBookingEntity();
         booking.setId(21L); booking.setStatus("RELEASED"); booking.setWarehouseId(101L); booking.setChannelCode("SEA-US");
         OceanBookingContainerRequirementEntity requirement = new OceanBookingContainerRequirementEntity();
@@ -296,7 +296,7 @@ class ContainerServiceTest {
         when(repository.find(11L)).thenReturn(container, container);
         when(oceanBookings.find(21L)).thenReturn(booking);
         when(oceanBookings.requirement(21L, 31L)).thenReturn(requirement);
-        when(oceanBookings.allocations(21L)).thenReturn(List.of());
+        when(oceanBookings.activeLinkedCount(21L, 31L)).thenReturn(0L);
         when(repository.linkReleasedBooking(eq(11L), eq(21L), eq(31L), eq("MSCU7654321"),
             same(booking), eq(2), eq(9L), eq("admin"))).thenReturn(1);
 
@@ -311,6 +311,24 @@ class ContainerServiceTest {
         verify(oceanBookings).insert(any(OceanBookingContainerAllocationEntity.class));
     }
 
+    @Test
+    @DisplayName("首次关联拒绝装柜仓库不一致")
+    void rejectsLinkWhenWarehouseDiffers() {
+        assertThreeFieldMismatch(102L, "SEA-US", "40HC");
+    }
+
+    @Test
+    @DisplayName("首次关联拒绝物流渠道不一致")
+    void rejectsLinkWhenChannelDiffers() {
+        assertThreeFieldMismatch(101L, "SEA-EU", "40HC");
+    }
+
+    @Test
+    @DisplayName("首次关联拒绝柜型不一致")
+    void rejectsLinkWhenContainerTypeDiffers() {
+        assertThreeFieldMismatch(101L, "SEA-US", "45HC");
+    }
+
     @Test
     @DisplayName("未发布订舱不可关联")
     void rejectsDraftBooking() {
@@ -333,12 +351,10 @@ class ContainerServiceTest {
         booking.setId(21L); booking.setStatus("RELEASED");
         OceanBookingContainerRequirementEntity requirement = new OceanBookingContainerRequirementEntity();
         requirement.setId(31L); requirement.setQuantity(1);
-        OceanBookingContainerAllocationEntity allocation = new OceanBookingContainerAllocationEntity();
-        allocation.setRequirementId(31L);
         when(repository.find(11L)).thenReturn(container);
         when(oceanBookings.find(21L)).thenReturn(booking);
         when(oceanBookings.requirement(21L, 31L)).thenReturn(requirement);
-        when(oceanBookings.allocations(21L)).thenReturn(List.of(allocation));
+        when(oceanBookings.activeLinkedCount(21L, 31L)).thenReturn(1L);
 
         assertThatThrownBy(() -> service.linkOceanBooking(11L, 9L, "admin",
             new OceanBookingLinkRequest(21L, 31L, "MSCU7654321", 2)))
@@ -347,6 +363,28 @@ class ContainerServiceTest {
             any(), anyInt(), anyLong(), anyString());
     }
 
+    private void assertThreeFieldMismatch(long bookingWarehouseId, String bookingChannel,
+                                          String requirementType) {
+        ContainerBookingEntity container = booking("WAIT_LOADING", 2);
+        container.setWarehouseId(101L); container.setChannelCode("SEA-US");
+        container.setContainerType("40HC");
+        OceanBookingEntity oceanBooking = new OceanBookingEntity();
+        oceanBooking.setId(21L); oceanBooking.setStatus("RELEASED");
+        oceanBooking.setWarehouseId(bookingWarehouseId); oceanBooking.setChannelCode(bookingChannel);
+        OceanBookingContainerRequirementEntity requirement = new OceanBookingContainerRequirementEntity();
+        requirement.setId(31L); requirement.setQuantity(2); requirement.setContainerType(requirementType);
+        when(repository.find(11L)).thenReturn(container);
+        when(oceanBookings.find(21L)).thenReturn(oceanBooking);
+        when(oceanBookings.requirement(21L, 31L)).thenReturn(requirement);
+        when(oceanBookings.activeLinkedCount(21L, 31L)).thenReturn(0L);
+
+        assertThatThrownBy(() -> service.linkOceanBooking(11L, 9L, "admin",
+            new OceanBookingLinkRequest(21L, 31L, "MSCU7654321", 2)))
+            .isInstanceOf(BizException.class).hasMessageContaining("仓库、渠道或柜型不一致");
+        verify(repository, never()).linkReleasedBooking(anyLong(), anyLong(), anyLong(), anyString(),
+            any(), anyInt(), anyLong(), anyString());
+    }
+
     @Test
     @DisplayName("完全空的模拟柜直接解绑并删除当前allocation，不依赖MERGED来源柜")
     void unlinksEmptySimulationDirectly() {
diff --git a/firstleg/src/test/java/com/baiyue/firstleg/service/CustomerDimensionPricingFlowTest.java b/firstleg/src/test/java/com/baiyue/firstleg/service/CustomerDimensionPricingFlowTest.java
index 6f2434cf3..33616c9f5 100644
--- a/firstleg/src/test/java/com/baiyue/firstleg/service/CustomerDimensionPricingFlowTest.java
+++ b/firstleg/src/test/java/com/baiyue/firstleg/service/CustomerDimensionPricingFlowTest.java
@@ -4,7 +4,7 @@ import com.baiyue.firstleg.domain.CustomerDimensionBoxType;
 import com.baiyue.firstleg.entity.CustomerDimensionConfigEntity;
 import com.baiyue.firstleg.pricing.FbaWarehouseRateEstimator;
 import com.baiyue.firstleg.repository.CustomerDimensionConfigRepository;
-import com.baiyue.firstleg.repository.PriceBookQueryRows.RateRow;
+import com.baiyue.firstleg.pricebookquery.application.model.PriceBookQueryRows.RateRow;
 import org.junit.jupiter.api.Test;
 
 import java.math.BigDecimal;
diff --git a/firstleg/src/test/java/com/baiyue/firstleg/service/FbaPricingServiceTest.java b/firstleg/src/test/java/com/baiyue/firstleg/service/FbaPricingServiceTest.java
index 823e35dd3..0cefc7b02 100644
--- a/firstleg/src/test/java/com/baiyue/firstleg/service/FbaPricingServiceTest.java
+++ b/firstleg/src/test/java/com/baiyue/firstleg/service/FbaPricingServiceTest.java
@@ -11,7 +11,7 @@ import com.baiyue.firstleg.entity.InboundPricingEntity;
 import com.baiyue.firstleg.entity.InboundPricingIdempotencyEntity;
 import com.baiyue.firstleg.pricing.ActivePriceBookEstimator;
 import com.baiyue.firstleg.repository.FbaPricingRepository;
-import com.baiyue.firstleg.repository.PriceBookQueryRows.RateRow;
+import com.baiyue.firstleg.pricebookquery.application.model.PriceBookQueryRows.RateRow;
 import jakarta.annotation.Resource;
 import org.junit.jupiter.api.DisplayName;
 import org.junit.jupiter.api.Test;
diff --git a/firstleg/src/test/java/com/baiyue/firstleg/service/LoadingCompletedOutboxServiceTest.java b/firstleg/src/test/java/com/baiyue/firstleg/service/LoadingCompletedOutboxServiceTest.java
index 461aca213..50ff2452d 100644
--- a/firstleg/src/test/java/com/baiyue/firstleg/service/LoadingCompletedOutboxServiceTest.java
+++ b/firstleg/src/test/java/com/baiyue/firstleg/service/LoadingCompletedOutboxServiceTest.java
@@ -138,11 +138,30 @@ class LoadingCompletedOutboxServiceTest {
     }
 
     @Test void snapshotOnlyPublishesFinalizedLoadedInbounds() throws Exception {
-        String sql = String.join(" ", LoadingCompletedEventMapper.class.getMethod("rows", long.class)
+        String rowsSql = String.join(" ", LoadingCompletedEventMapper.class.getMethod("rows", long.class)
+            .getAnnotation(Select.class).value()).replaceAll("\\s+", " ");
+        String palletsSql = String.join(" ", LoadingCompletedEventMapper.class.getMethod("palletRows", long.class)
             .getAnnotation(Select.class).value()).replaceAll("\\s+", " ");
 
-        assertThat(sql).contains("p.plan_status = 'COMPLETED'")
+        assertThat(rowsSql).contains("p.plan_status = 'COMPLETED'")
             .contains("o.process_status = 'LOADED'");
+        for (String sql : List.of(rowsSql, palletsSql)) {
+            assertThat(sql)
+                .contains("actual_pick.loading_plan_item_id = i.id")
+                .contains("actual_pick.item_status IN ('PICKED','PARTIAL')")
+                .contains("actual_pick.picked_package_count > 0")
+                .contains("actual_pick.picked_package_count = i.package_count")
+                .contains("actual_task.id = actual_pick.pick_task_id")
+                .contains("actual_task.loading_plan_id =")
+                .doesNotContain("'SKIPPED'")
+                .doesNotContain("'PENDING'")
+                .doesNotContain("'PICKING'");
+        }
+        assertThat(palletsSql)
+            .contains("label.tenant_id = i.account_id")
+            .contains("label.inbound_detail_id = i.inbound_detail_id")
+            .contains("label.batch_status = 'ACTIVE'")
+            .doesNotContain("label.inbound_id = i.inbound_id");
     }
 
     @Test void publishesDropshipPalletSkuAndCartonSnapshots() throws Exception {
diff --git a/firstleg/src/test/java/com/baiyue/firstleg/service/LoadingListServiceTest.java b/firstleg/src/test/java/com/baiyue/firstleg/service/LoadingListServiceTest.java
index aac76e2e6..212b488d3 100644
--- a/firstleg/src/test/java/com/baiyue/firstleg/service/LoadingListServiceTest.java
+++ b/firstleg/src/test/java/com/baiyue/firstleg/service/LoadingListServiceTest.java
@@ -36,7 +36,9 @@ import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatThrownBy;
 import static org.mockito.ArgumentMatchers.anyString;
 import static org.mockito.ArgumentMatchers.anyLong;
+import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.ArgumentMatchers.isNull;
 import static org.mockito.Mockito.never;
 import static org.mockito.Mockito.times;
 import static org.mockito.Mockito.verify;
@@ -450,16 +452,16 @@ class LoadingListServiceTest {
         String contentHash = sha256Bytes(content);
         var file = new MockMultipartFile("file", "customs.pdf", "application/pdf", content);
         var metadata = new LoadingDocumentFileClient.Metadata(101L, 0L,
-            "LOADING_CUSTOMS_DOCUMENT", "10", "customs.pdf", contentHash, "application/pdf",
+            "LOADING_CUSTOMS_DECLARATION", "10", "customs.pdf", contentHash, "application/pdf",
             (long) content.length);
         ContainerDocumentEntity saved = document(41L, LoadingListService.CUSTOMS_DECLARATION, 0, false);
         saved.setFileId(101L); saved.setFileName("customs.pdf"); saved.setFileHash(contentHash);
         when(repository.aggregate(10L)).thenReturn(plan);
         when(repository.history(anyString())).thenReturn(null);
         when(repository.document(30L, LoadingListService.CUSTOMS_DECLARATION)).thenReturn(null, saved);
-        when(documentFiles.upload(anyString(), eq(9L), eq(0L), eq("LOADING_CUSTOMS_DOCUMENT"),
+        when(documentFiles.upload(anyString(), eq(9L), eq(0L), eq("LOADING_CUSTOMS_DECLARATION"),
             eq("10"), eq(file))).thenReturn(ApiResponse.success(metadata));
-        when(documentFiles.metadata(anyString(), eq(0L), eq("LOADING_CUSTOMS_DOCUMENT"),
+        when(documentFiles.metadata(anyString(), eq(0L), eq("LOADING_CUSTOMS_DECLARATION"),
             eq("10"), eq(101L))).thenReturn(ApiResponse.success(metadata));
         when(repository.createDocument(org.mockito.ArgumentMatchers.any())).thenReturn(1);
 
@@ -467,10 +469,108 @@ class LoadingListServiceTest {
             10L, 100L, 9L, "operator", "customs-upload", 0, null, file);
 
         assertThat(result.documentType()).isEqualTo(LoadingListService.CUSTOMS_DECLARATION);
-        verify(documentFiles).upload(anyString(), eq(9L), eq(0L), eq("LOADING_CUSTOMS_DOCUMENT"),
+        verify(documentFiles).upload(anyString(), eq(9L), eq(0L), eq("LOADING_CUSTOMS_DECLARATION"),
             eq("10"), eq(file));
     }
 
+    @Test
+    void downloadsCompletedLoadingDeclarationWithExactLongFileOwnership() {
+        long planId = 9_007_199_254_740_993L;
+        long fileId = 9_007_199_254_740_995L;
+        AggregateRow plan = row("COMPLETED", 4);
+        plan.setPlanId(planId);
+        ContainerDocumentEntity document = document(41L, LoadingListService.CUSTOMS_DECLARATION, 4, true);
+        document.setFileId(fileId);
+        document.setFileName("出口报关单.pdf");
+        byte[] content = new byte[]{1, 2, 3};
+        var metadata = new LoadingDocumentFileClient.Metadata(fileId, 0L,
+            "LOADING_CUSTOMS_DECLARATION", Long.toString(planId), "出口报关单.pdf", hash(),
+            "application/pdf", (long) content.length);
+        when(repository.aggregate(planId)).thenReturn(plan);
+        when(repository.document(30L, LoadingListService.CUSTOMS_DECLARATION)).thenReturn(document);
+        when(documentFiles.metadata(anyString(), eq(0L), eq("LOADING_CUSTOMS_DECLARATION"),
+            eq(Long.toString(planId)), eq(fileId))).thenReturn(ApiResponse.success(metadata));
+        when(documentFiles.download(anyString(), eq(0L), eq("LOADING_CUSTOMS_DECLARATION"),
+            eq(Long.toString(planId)), eq(fileId))).thenReturn(org.springframework.http.ResponseEntity.ok(content));
+
+        var result = service.downloadLoadingDeclaration(planId, 100L, fileId);
+
+        assertThat(result.fileName()).isEqualTo("出口报关单.pdf");
+        assertThat(result.content()).containsExactly(1, 2, 3);
+        verify(documentFiles).download(anyString(), eq(0L), eq("LOADING_CUSTOMS_DECLARATION"),
+            eq("9007199254740993"), eq(fileId));
+    }
+
+    @Test
+    void rejectsNonCurrentLoadingDeclarationFileIdBeforeFileService() {
+        AggregateRow plan = row("COMPLETED", 4);
+        when(repository.aggregate(10L)).thenReturn(plan);
+        when(repository.document(30L, LoadingListService.CUSTOMS_DECLARATION))
+            .thenReturn(document(41L, LoadingListService.CUSTOMS_DECLARATION, 4, true));
+
+        assertThatThrownBy(() -> service.downloadLoadingDeclaration(10L, 100L, 100L))
+            .isInstanceOf(BizException.class)
+            .extracting(error -> ((BizException) error).getResultCode()).isEqualTo(ResultCode.NOT_FOUND);
+        verify(documentFiles, never()).metadata(anyString(), anyLong(), anyString(), anyString(), anyLong());
+    }
+
+    @Test
+    void rejectsLoadingDeclarationFileWithMismatchedBusinessOwnership() {
+        AggregateRow plan = row("COMPLETED", 4);
+        ContainerDocumentEntity document = document(41L, LoadingListService.CUSTOMS_DECLARATION, 4, true);
+        when(repository.aggregate(10L)).thenReturn(plan);
+        when(repository.document(30L, LoadingListService.CUSTOMS_DECLARATION)).thenReturn(document);
+        var metadata = new LoadingDocumentFileClient.Metadata(99L, 0L,
+            "LOADING_CUSTOMS_DECLARATION", "other-plan", "customs.pdf", hash(),
+            "application/pdf", 3L);
+        when(documentFiles.metadata(anyString(), eq(0L), eq("LOADING_CUSTOMS_DECLARATION"),
+            eq("10"), eq(99L))).thenReturn(ApiResponse.success(metadata));
+
+        assertThatThrownBy(() -> service.downloadLoadingDeclaration(10L, 100L, 99L))
+            .isInstanceOf(BizException.class)
+            .extracting(error -> ((BizException) error).getResultCode()).isEqualTo(ResultCode.NOT_FOUND);
+        verify(documentFiles, never()).download(anyString(), anyLong(), anyString(), anyString(), anyLong());
+    }
+
+    @Test
+    void downloadsCurrentDestinationClearanceWithExactContainerOwnership() {
+        long bookingId = 9_007_199_254_740_993L;
+        long fileId = 9_007_199_254_740_995L;
+        AggregateRow plan = row("COMPLETED", 4);
+        ContainerDocumentEntity document = document(41L, LoadingListService.DESTINATION_CLEARANCE, 1, true);
+        document.setContainerBookingId(bookingId);
+        document.setFileId(fileId);
+        document.setFileName("destination-clearance.pdf");
+        byte[] content = new byte[]{4, 5, 6};
+        var metadata = new LoadingDocumentFileClient.Metadata(fileId, 0L,
+            "CONTAINER_CLEARANCE_DOCUMENT", Long.toString(bookingId), "destination-clearance.pdf",
+            hash(), "application/pdf", (long) content.length);
+        when(repository.aggregateByBooking(bookingId)).thenReturn(plan);
+        when(repository.document(bookingId, LoadingListService.DESTINATION_CLEARANCE)).thenReturn(document);
+        when(documentFiles.metadata(anyString(), eq(0L), eq("CONTAINER_CLEARANCE_DOCUMENT"),
+            eq(Long.toString(bookingId)), eq(fileId))).thenReturn(ApiResponse.success(metadata));
+        when(documentFiles.download(anyString(), eq(0L), eq("CONTAINER_CLEARANCE_DOCUMENT"),
+            eq(Long.toString(bookingId)), eq(fileId))).thenReturn(org.springframework.http.ResponseEntity.ok(content));
+
+        var result = service.downloadContainerClearance(bookingId, fileId);
+
+        assertThat(result.fileName()).isEqualTo("destination-clearance.pdf");
+        assertThat(result.content()).containsExactly(4, 5, 6);
+    }
+
+    @Test
+    void rejectsNonCurrentDestinationClearanceFileIdAsNotFound() {
+        AggregateRow plan = row("COMPLETED", 4);
+        when(repository.aggregateByBooking(30L)).thenReturn(plan);
+        when(repository.document(30L, LoadingListService.DESTINATION_CLEARANCE))
+            .thenReturn(document(41L, LoadingListService.DESTINATION_CLEARANCE, 1, true));
+
+        assertThatThrownBy(() -> service.downloadContainerClearance(30L, 100L))
+            .isInstanceOf(BizException.class)
+            .extracting(error -> ((BizException) error).getResultCode()).isEqualTo(ResultCode.NOT_FOUND);
+        verify(documentFiles, never()).metadata(anyString(), anyLong(), anyString(), anyString(), anyLong());
+    }
+
     @Test
     void rejectsReusedIdempotencyKeyWithDifferentAttachRequest() {
         AggregateRow plan = row("LOADING", 2);
@@ -499,6 +599,125 @@ class LoadingListServiceTest {
         verify(repository, never()).aggregateByBooking(30L);
     }
 
+    @Test
+    void firstDeliveryOrderUploadPersistsDocumentAndImmutablePlanHistory() {
+        AggregateRow plan = row("COMPLETED", 4);
+        byte[] content = "delivery-order".getBytes(java.nio.charset.StandardCharsets.UTF_8);
+        var file = new MockMultipartFile("file", "do.pdf", "application/pdf", content);
+        String contentHash = sha256Bytes(content);
+        var metadata = new LoadingDocumentFileClient.Metadata(101L, 0L,
+            "CONTAINER_DELIVERY_ORDER", "30", "do.pdf", contentHash, "application/pdf", (long) content.length);
+        ContainerDocumentEntity saved = document(51L, LoadingListService.DELIVERY_ORDER, 0, false);
+        saved.setFileId(101L); saved.setFileName("do.pdf"); saved.setFileHash(contentHash);
+        when(repository.aggregateByBooking(30L)).thenReturn(plan);
+        when(repository.history(anyString())).thenReturn(null);
+        when(repository.document(30L, LoadingListService.DELIVERY_ORDER)).thenReturn(null, saved);
+        when(documentFiles.upload(anyString(), eq(9L), eq(0L), eq("CONTAINER_DELIVERY_ORDER"),
+            eq("30"), eq(file))).thenReturn(ApiResponse.success(metadata));
+        when(documentFiles.metadata(anyString(), eq(0L), eq("CONTAINER_DELIVERY_ORDER"),
+            eq("30"), eq(101L))).thenReturn(ApiResponse.success(metadata));
+        when(repository.createDocument(any())).thenReturn(1);
+
+        var result = service.uploadContainerLogisticsDocument(30L, LoadingListService.DELIVERY_ORDER,
+            9L, "operator", "do-first", 0, null, file);
+
+        assertThat(result).extracting(value -> value.documentType(), value -> value.fileId(), value -> value.version())
+            .containsExactly(LoadingListService.DELIVERY_ORDER, 101L, 0);
+        verify(repository).appendHistory(eq(10L), anyString(), eq("UPLOAD_DELIVERY_ORDER"),
+            eq("COMPLETED"), eq("COMPLETED"), anyString(), anyString(), eq(9L), eq("operator"), isNull());
+    }
+
+    @Test
+    void pickupOrderUpdateUsesCurrentVersionAndReturnsUpdatedDocument() {
+        AggregateRow plan = row("COMPLETED", 4);
+        byte[] content = "pickup-order".getBytes(java.nio.charset.StandardCharsets.UTF_8);
+        var file = new MockMultipartFile("file", "pu.pdf", "application/pdf", content);
+        String contentHash = sha256Bytes(content);
+        ContainerDocumentEntity current = document(52L, LoadingListService.PICKUP_ORDER, 2, false);
+        ContainerDocumentEntity saved = document(52L, LoadingListService.PICKUP_ORDER, 3, false);
+        saved.setFileId(102L); saved.setFileName("pu.pdf"); saved.setFileHash(contentHash);
+        var metadata = new LoadingDocumentFileClient.Metadata(102L, 0L,
+            "CONTAINER_PICKUP_ORDER", "30", "pu.pdf", contentHash, "application/pdf", (long) content.length);
+        when(repository.aggregateByBooking(30L)).thenReturn(plan);
+        when(repository.history(anyString())).thenReturn(null);
+        when(repository.document(30L, LoadingListService.PICKUP_ORDER)).thenReturn(current, saved);
+        when(documentFiles.upload(anyString(), eq(9L), eq(0L), eq("CONTAINER_PICKUP_ORDER"),
+            eq("30"), eq(file))).thenReturn(ApiResponse.success(metadata));
+        when(documentFiles.metadata(anyString(), eq(0L), eq("CONTAINER_PICKUP_ORDER"),
+            eq("30"), eq(102L))).thenReturn(ApiResponse.success(metadata));
+        when(repository.replaceDocument(any())).thenReturn(1);
+
+        var result = service.uploadContainerLogisticsDocument(30L, LoadingListService.PICKUP_ORDER,
+            9L, "operator", "pu-update", 2, null, file);
+
+        assertThat(result.fileId()).isEqualTo(102L);
+        assertThat(result.version()).isEqualTo(3);
+        verify(repository).replaceDocument(any());
+        verify(repository).appendHistory(eq(10L), anyString(), eq("UPLOAD_PICKUP_ORDER"),
+            eq("COMPLETED"), eq("COMPLETED"), anyString(), anyString(), eq(9L), eq("operator"), isNull());
+    }
+
+    @Test
+    void staleDeliveryOrderVersionReturnsConflictBeforeUploadingAnotherFile() {
+        AggregateRow plan = row("COMPLETED", 4);
+        when(repository.aggregateByBooking(30L)).thenReturn(plan);
+        when(repository.history(anyString())).thenReturn(null);
+        when(repository.document(30L, LoadingListService.DELIVERY_ORDER))
+            .thenReturn(document(51L, LoadingListService.DELIVERY_ORDER, 2, false));
+        var file = new MockMultipartFile("file", "do.pdf", "application/pdf", "do".getBytes());
+
+        assertThatThrownBy(() -> service.uploadContainerLogisticsDocument(30L,
+            LoadingListService.DELIVERY_ORDER, 9L, "operator", "do-stale", 1, null, file))
+            .isInstanceOf(BizException.class)
+            .extracting(error -> ((BizException) error).getResultCode()).isEqualTo(ResultCode.CONFLICT);
+        verify(documentFiles, never()).upload(anyString(), anyLong(), anyLong(), anyString(), anyString(), any());
+    }
+
+    @Test
+    void sameDeliveryOrderUploadKeyReplaysWithoutUploadingAgain() {
+        AggregateRow plan = row("COMPLETED", 4);
+        byte[] content = "delivery-order".getBytes(java.nio.charset.StandardCharsets.UTF_8);
+        var file = new MockMultipartFile("file", "do.pdf", "application/pdf", content);
+        String requestHash = sha256("UPLOAD|DELIVERY_ORDER|30|0|null|" + sha256Bytes(content));
+        HistoryRow replay = new HistoryRow();
+        replay.setAfterSnapshot("{\"requestHash\":\"" + requestHash + "\"}");
+        when(repository.aggregateByBooking(30L)).thenReturn(plan);
+        when(repository.history(anyString())).thenReturn(replay);
+        when(repository.document(30L, LoadingListService.DELIVERY_ORDER))
+            .thenReturn(document(51L, LoadingListService.DELIVERY_ORDER, 0, false));
+
+        var result = service.uploadContainerLogisticsDocument(30L, LoadingListService.DELIVERY_ORDER,
+            9L, "operator", "do-replay", 0, null, file);
+
+        assertThat(result.documentType()).isEqualTo(LoadingListService.DELIVERY_ORDER);
+        verify(documentFiles, never()).upload(anyString(), anyLong(), anyLong(), anyString(), anyString(), any());
+    }
+
+    @Test
+    void deliveryOrderDatabaseConstraintFailureReturnsBusinessConflictInsteadOfUnknownError() {
+        AggregateRow plan = row("COMPLETED", 4);
+        byte[] content = "delivery-order".getBytes(java.nio.charset.StandardCharsets.UTF_8);
+        var file = new MockMultipartFile("file", "do.pdf", "application/pdf", content);
+        String contentHash = sha256Bytes(content);
+        var metadata = new LoadingDocumentFileClient.Metadata(103L, 0L,
+            "CONTAINER_DELIVERY_ORDER", "30", "do.pdf", contentHash, "application/pdf", (long) content.length);
+        when(repository.aggregateByBooking(30L)).thenReturn(plan);
+        when(repository.history(anyString())).thenReturn(null);
+        when(repository.document(30L, LoadingListService.DELIVERY_ORDER)).thenReturn(null);
+        when(documentFiles.upload(anyString(), eq(9L), eq(0L), eq("CONTAINER_DELIVERY_ORDER"),
+            eq("30"), eq(file))).thenReturn(ApiResponse.success(metadata));
+        when(documentFiles.metadata(anyString(), eq(0L), eq("CONTAINER_DELIVERY_ORDER"),
+            eq("30"), eq(103L))).thenReturn(ApiResponse.success(metadata));
+        when(repository.createDocument(any())).thenThrow(
+            new org.springframework.dao.DataIntegrityViolationException("trigger rejected"));
+
+        assertThatThrownBy(() -> service.uploadContainerLogisticsDocument(30L,
+            LoadingListService.DELIVERY_ORDER, 9L, "operator", "do-db-fail", 0, null, file))
+            .isInstanceOf(BizException.class)
+            .extracting(error -> ((BizException) error).getResultCode()).isEqualTo(ResultCode.CONFLICT);
+    }
+
+
     @Test
     void confirmsEveryLinkedPreloadAndCreatesSinglePdaTaskAtomically() {
         AggregateRow before = row("EDITING", 3);
diff --git a/firstleg/src/test/java/com/baiyue/firstleg/service/LoadingPickServiceTest.java b/firstleg/src/test/java/com/baiyue/firstleg/service/LoadingPickServiceTest.java
index 6279bf6bd..437c62dcd 100644
--- a/firstleg/src/test/java/com/baiyue/firstleg/service/LoadingPickServiceTest.java
+++ b/firstleg/src/test/java/com/baiyue/firstleg/service/LoadingPickServiceTest.java
@@ -591,6 +591,28 @@ class LoadingPickServiceTest {
         verify(loadingListService, never()).publishCompletedEvent(anyLong());
     }
 
+    @Test
+    void translatesUnexpectedSettlementFailureIntoActionableStageMessage() {
+        LoadingPickTaskEntity task = task();
+        when(repository.taskForUpdate(20L)).thenReturn(task);
+        when(repository.allTaskItemsResolved(20L)).thenReturn(true);
+        var owner = new LoadingPickItemMapper.InboundOwner(101L, 50L);
+        when(repository.inboundOwners(20L)).thenReturn(List.of(owner));
+        when(repository.inboundForUpdate(101L, 50L)).thenReturn(
+            new LoadingInboundMapper.Snapshot(50L, 101L, "LOADING", 7));
+        doThrow(new IllegalStateException("unexpected database failure"))
+            .when(settlementService).settle(20L, 9L, "operator");
+
+        assertThatThrownBy(() -> service.complete(20L,
+            new CompleteLoadingRequest(0, "complete-stage-error", "checked"), 9L, "operator"))
+            .isInstanceOf(BizException.class)
+            .hasMessageContaining("拆单与库位结算")
+            .hasMessageContaining("请求编号");
+
+        verify(repository, never()).approve(anyLong(), anyLong(), anyString(), anyString());
+        verify(loadingListService, never()).finishFromPda(anyLong(), anyLong(), anyLong(), anyString());
+    }
+
     @Test
     void atomicallySubmitsCompleteBatchAndReplaysSameResult() {
         LoadingPickTaskEntity task = task();
diff --git a/firstleg/src/test/java/com/baiyue/firstleg/service/MerchantPriceBookServiceTest.java b/firstleg/src/test/java/com/baiyue/firstleg/service/MerchantPriceBookServiceTest.java
index 9412f0928..8f6329212 100644
--- a/firstleg/src/test/java/com/baiyue/firstleg/service/MerchantPriceBookServiceTest.java
+++ b/firstleg/src/test/java/com/baiyue/firstleg/service/MerchantPriceBookServiceTest.java
@@ -13,11 +13,11 @@ import com.baiyue.firstleg.pricing.FbaWarehouseRateEstimator;
 import com.baiyue.firstleg.pricing.PriceBookWarehouseRegionResolver;
 import com.baiyue.firstleg.pricing.PriceRegionResolver;
 import com.baiyue.firstleg.pricing.RegionWeightTierEstimator;
-import com.baiyue.firstleg.repository.PriceBookQueryRepository;
-import com.baiyue.firstleg.repository.PriceBookQueryRows.ChannelRow;
-import com.baiyue.firstleg.repository.PriceBookQueryRows.ChannelTaxModeRow;
-import com.baiyue.firstleg.repository.PriceBookQueryRows.ChannelPrefixRow;
-import com.baiyue.firstleg.repository.PriceBookQueryRows.RateRow;
+import com.baiyue.firstleg.pricebookquery.application.model.PriceBookQueryRows.ChannelRow;
+import com.baiyue.firstleg.pricebookquery.application.model.PriceBookQueryRows.ChannelTaxModeRow;
+import com.baiyue.firstleg.pricebookquery.application.model.PriceBookQueryRows.ChannelPrefixRow;
+import com.baiyue.firstleg.pricebookquery.application.model.PriceBookQueryRows.RateRow;
+import com.baiyue.firstleg.pricebookquery.application.port.in.PriceBookQueryUseCase;
 import jakarta.annotation.Resource;
 import org.junit.jupiter.api.Test;
 import org.springframework.boot.test.mock.mockito.MockBean;
@@ -38,7 +38,7 @@ import static org.mockito.Mockito.when;
     PriceBookWarehouseRegionResolver.class})
 @TestPropertySource(properties = "baiyue.security.internal-service-token=internal-token")
 class MerchantPriceBookServiceTest {
-    @MockBean private PriceBookQueryRepository repository;
+    @MockBean private PriceBookQueryUseCase repository;
     @MockBean private PriceBookWarehouseClient warehouses;
     @Resource private MerchantPriceBookService service;
 
diff --git a/firstleg/src/test/resources/architecture/firstleg-slice-dependencies.json b/firstleg/src/test/resources/architecture/firstleg-slice-dependencies.json
index 308cda8bc..4ffb1a909 100644
--- a/firstleg/src/test/resources/architecture/firstleg-slice-dependencies.json
+++ b/firstleg/src/test/resources/architecture/firstleg-slice-dependencies.json
@@ -5,6 +5,7 @@
     "booking-customs-trucking->inbound",
     "booking-customs-trucking->measurement-pricing",
     "booking-customs-trucking->outbound",
+    "booking-customs-trucking->pricebook-query",
     "booking-customs-trucking->shared-technical",
     "booking-customs-trucking->split-loading",
     "customer-statistics->shared-technical",
@@ -19,6 +20,7 @@
     "measurement-pricing->booking-customs-trucking",
     "measurement-pricing->finance-integration",
     "measurement-pricing->inbound",
+    "measurement-pricing->pricebook-query",
     "measurement-pricing->shared-technical",
     "outbound->booking-customs-trucking",
     "outbound->shared-technical",
@@ -35,8 +37,8 @@
     "shipping-nodes->split-loading",
     "split-loading->booking-customs-trucking",
     "split-loading->inbound",
-    "split-loading->measurement-pricing",
     "split-loading->outbound",
+    "split-loading->pricebook-query",
     "split-loading->shared-technical"
   ],
   "requiredClassLocations": {
@@ -44,21 +46,50 @@
     "com.baiyue.firstleg.customerstatistics.adapter.out.persistence.CustomerTransitStatisticsMapper": "src/main/java/com/baiyue/firstleg/customerstatistics/adapter/out/persistence/CustomerTransitStatisticsMapper.java",
     "com.baiyue.firstleg.customerstatistics.application.CustomerTransitStatisticsService": "src/main/java/com/baiyue/firstleg/customerstatistics/application/CustomerTransitStatisticsService.java",
     "com.baiyue.firstleg.customerstatistics.application.model.CustomerTransitStatisticsDtos": "src/main/java/com/baiyue/firstleg/customerstatistics/application/model/CustomerTransitStatisticsDtos.java",
-    "com.baiyue.firstleg.customerstatistics.application.port.out.CustomerTransitStatisticsReader": "src/main/java/com/baiyue/firstleg/customerstatistics/application/port/out/CustomerTransitStatisticsReader.java"
-  },
-  "applicationDependencyRule": {
-    "packagePrefix": "com.baiyue.firstleg.customerstatistics.application",
-    "allowedInternalPrefix": "com.baiyue.firstleg.customerstatistics.application",
-    "forbiddenImportPrefixes": [
-      "org.springframework.web",
-      "org.apache.ibatis",
-      "com.baomidou.mybatisplus"
-    ]
+    "com.baiyue.firstleg.customerstatistics.application.port.out.CustomerTransitStatisticsReader": "src/main/java/com/baiyue/firstleg/customerstatistics/application/port/out/CustomerTransitStatisticsReader.java",
+    "com.baiyue.firstleg.pricebookquery.adapter.out.persistence.PriceBookQueryMapper": "src/main/java/com/baiyue/firstleg/pricebookquery/adapter/out/persistence/PriceBookQueryMapper.java",
+    "com.baiyue.firstleg.pricebookquery.application.PriceBookQueryService": "src/main/java/com/baiyue/firstleg/pricebookquery/application/PriceBookQueryService.java",
+    "com.baiyue.firstleg.pricebookquery.application.model.PriceBookQueryRows": "src/main/java/com/baiyue/firstleg/pricebookquery/application/model/PriceBookQueryRows.java",
+    "com.baiyue.firstleg.pricebookquery.application.port.in.PriceBookQueryUseCase": "src/main/java/com/baiyue/firstleg/pricebookquery/application/port/in/PriceBookQueryUseCase.java",
+    "com.baiyue.firstleg.pricebookquery.application.port.out.PriceBookQueryReader": "src/main/java/com/baiyue/firstleg/pricebookquery/application/port/out/PriceBookQueryReader.java"
   },
+  "applicationDependencyRules": [
+    {
+      "packagePrefix": "com.baiyue.firstleg.customerstatistics.application",
+      "allowedInternalPrefix": "com.baiyue.firstleg.customerstatistics.application",
+      "forbiddenImportPrefixes": [
+        "org.springframework.web",
+        "org.apache.ibatis",
+        "com.baomidou.mybatisplus"
+      ]
+    },
+    {
+      "packagePrefix": "com.baiyue.firstleg.pricebookquery.application",
+      "allowedInternalPrefix": "com.baiyue.firstleg.pricebookquery.application",
+      "forbiddenImportPrefixes": [
+        "org.springframework.web",
+        "org.apache.ibatis",
+        "com.baomidou.mybatisplus"
+      ]
+    }
+  ],
+  "sliceExposureRules": [
+    {
+      "slicePrefix": "com.baiyue.firstleg.pricebookquery.",
+      "allowedTargetPrefixes": [
+        "com.baiyue.firstleg.pricebookquery.application.model.",
+        "com.baiyue.firstleg.pricebookquery.application.port.in."
+      ]
+    }
+  ],
   "sliceSpecificRules": {
     "customer-statistics": {
       "allowedOutgoing": ["shared-technical"],
       "allowedIncoming": []
+    },
+    "pricebook-query": {
+      "allowedOutgoing": [],
+      "allowedIncoming": ["booking-customs-trucking", "measurement-pricing", "split-loading"]
     }
   }
 }
diff --git a/gateway-overseas/src/main/java/com/baiyue/gateway/config/OverseasSecurityProjectionProperties.java b/gateway-overseas/src/main/java/com/baiyue/gateway/config/OverseasSecurityProjectionProperties.java
index 9edcfad81..e488beaa9 100644
--- a/gateway-overseas/src/main/java/com/baiyue/gateway/config/OverseasSecurityProjectionProperties.java
+++ b/gateway-overseas/src/main/java/com/baiyue/gateway/config/OverseasSecurityProjectionProperties.java
@@ -7,7 +7,7 @@ import java.time.Duration;
 @ConfigurationProperties(prefix = "baiyue.security.overseas-projection")
 public record OverseasSecurityProjectionProperties(String serviceUrl, String internalServiceToken, Duration timeout) {
     public OverseasSecurityProjectionProperties {
-        if (serviceUrl == null || serviceUrl.isBlank()) throw new IllegalArgumentException("必须配置 OVERSEAS_SECURITY_SERVICE_URL");
+        if (serviceUrl == null || serviceUrl.isBlank()) throw new IllegalArgumentException("必须配置 LASTLEG_SECURITY_SERVICE_URL");
         if (internalServiceToken == null || internalServiceToken.getBytes(java.nio.charset.StandardCharsets.UTF_8).length < 32) {
             throw new IllegalArgumentException("INTERNAL_SERVICE_TOKEN 至少需要 32 字节");
         }
diff --git a/gateway-overseas/src/main/java/com/baiyue/gateway/filter/HttpOverseasSecurityValidationClient.java b/gateway-overseas/src/main/java/com/baiyue/gateway/filter/HttpOverseasSecurityValidationClient.java
index 6d75282df..17f3af48b 100644
--- a/gateway-overseas/src/main/java/com/baiyue/gateway/filter/HttpOverseasSecurityValidationClient.java
+++ b/gateway-overseas/src/main/java/com/baiyue/gateway/filter/HttpOverseasSecurityValidationClient.java
@@ -9,7 +9,7 @@ import reactor.core.publisher.Mono;
 
 @Component
 public class HttpOverseasSecurityValidationClient implements OverseasSecurityValidationClient {
-    private static final String PATH = "/internal/overseas-security/v1/validate";
+    private static final String PATH = "/internal/lastleg/security/v1/validate";
     private final WebClient client;
     private final OverseasSecurityProjectionProperties properties;
 
@@ -19,10 +19,10 @@ public class HttpOverseasSecurityValidationClient implements OverseasSecurityVal
     }
 
     @Override
-    public Mono<Result> validate(long userId, long tenantId, long tokenVersion, long permissionVersion) {
+    public Mono<Result> validate(long userId, long tenantId, long permissionVersion) {
         return client.post().uri(properties.serviceUrl() + PATH).contentType(MediaType.APPLICATION_JSON)
                 .header("X-Internal-Service-Token", properties.internalServiceToken())
-                .bodyValue(new Request(userId, tenantId, tokenVersion, permissionVersion))
+                .bodyValue(new Request(userId, tenantId, permissionVersion))
                 .retrieve().bodyToMono(JsonNode.class).timeout(properties.timeout()).flatMap(body -> {
                     JsonNode data = body == null ? null : body.path("data");
                     if (data == null || data.isMissingNode() || !data.has("valid")) {
@@ -33,5 +33,5 @@ public class HttpOverseasSecurityValidationClient implements OverseasSecurityVal
                 });
     }
 
-    private record Request(long userId, long tenantId, long tokenVersion, long permissionVersion) { }
+    private record Request(long userId, long tenantId, long permissionVersion) { }
 }
diff --git a/gateway-overseas/src/main/java/com/baiyue/gateway/filter/OverseasSecurityProjectionFilter.java b/gateway-overseas/src/main/java/com/baiyue/gateway/filter/OverseasSecurityProjectionFilter.java
index cdbb4e727..91fc516cb 100644
--- a/gateway-overseas/src/main/java/com/baiyue/gateway/filter/OverseasSecurityProjectionFilter.java
+++ b/gateway-overseas/src/main/java/com/baiyue/gateway/filter/OverseasSecurityProjectionFilter.java
@@ -38,12 +38,11 @@ public class OverseasSecurityProjectionFilter implements GlobalFilter, Ordered {
                                 JwtAuthenticationToken authentication) {
         Long userId = number(authentication.getToken().getSubject());
         Long tenantId = number(authentication.getToken().getClaim("tenant_id"));
-        Long tokenVersion = number(authentication.getToken().getClaim("token_version"));
         Long permissionVersion = number(authentication.getToken().getClaim("permission_version"));
-        if (userId == null || tenantId == null || tokenVersion == null || permissionVersion == null) {
+        if (userId == null || tenantId == null || permissionVersion == null) {
             return Mono.error(new SecurityProjectionFailure("A0401", "海外令牌安全版本声明缺失"));
         }
-        return client.validate(userId, tenantId, tokenVersion, permissionVersion)
+        return client.validate(userId, tenantId, permissionVersion)
                 .switchIfEmpty(Mono.error(new SecurityProjectionFailure("A0401", "海外安全状态校验不可用")))
                 .flatMap(result -> {
                     if (result.valid()) return chain.filter(exchange);
diff --git a/gateway-overseas/src/main/java/com/baiyue/gateway/filter/OverseasSecurityValidationClient.java b/gateway-overseas/src/main/java/com/baiyue/gateway/filter/OverseasSecurityValidationClient.java
index 2ce22a244..a267cb233 100644
--- a/gateway-overseas/src/main/java/com/baiyue/gateway/filter/OverseasSecurityValidationClient.java
+++ b/gateway-overseas/src/main/java/com/baiyue/gateway/filter/OverseasSecurityValidationClient.java
@@ -3,6 +3,6 @@ package com.baiyue.gateway.filter;
 import reactor.core.publisher.Mono;
 
 public interface OverseasSecurityValidationClient {
-    Mono<Result> validate(long userId, long tenantId, long tokenVersion, long permissionVersion);
+    Mono<Result> validate(long userId, long tenantId, long permissionVersion);
     record Result(boolean valid, String failureReason) { }
 }
diff --git a/gateway-overseas/src/main/resources/application.yml b/gateway-overseas/src/main/resources/application.yml
index 3e7ce51f2..d61d0ec19 100644
--- a/gateway-overseas/src/main/resources/application.yml
+++ b/gateway-overseas/src/main/resources/application.yml
@@ -47,9 +47,9 @@ baiyue:
       internal-service-token: ${INTERNAL_SERVICE_TOKEN}
       timeout: ${PDA_SESSION_VALIDATION_TIMEOUT:2s}
     overseas-projection:
-      service-url: ${OVERSEAS_SECURITY_SERVICE_URL}
+      service-url: ${LASTLEG_SECURITY_SERVICE_URL:http://lastleg-service:9303}
       internal-service-token: ${INTERNAL_SERVICE_TOKEN}
-      timeout: ${OVERSEAS_SECURITY_VALIDATION_TIMEOUT:2s}
+      timeout: ${LASTLEG_SECURITY_VALIDATION_TIMEOUT:2s}
     permit-paths:
       - /actuator/health
       - /swagger-ui/**
diff --git a/gateway-overseas/src/test/java/com/baiyue/gateway/config/OverseasSecurityValidationDeploymentContractTest.java b/gateway-overseas/src/test/java/com/baiyue/gateway/config/OverseasSecurityValidationDeploymentContractTest.java
new file mode 100644
index 000000000..45bd73e1d
--- /dev/null
+++ b/gateway-overseas/src/test/java/com/baiyue/gateway/config/OverseasSecurityValidationDeploymentContractTest.java
@@ -0,0 +1,42 @@
+package com.baiyue.gateway.config;
+
+import org.junit.jupiter.api.Test;
+
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.Path;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+class OverseasSecurityValidationDeploymentContractTest {
+    @Test
+    void gatewayAndEventBridgeUseLastlegSecurityEndpointsWithoutTheRetiredService() throws Exception {
+        String client = read("gateway-overseas/src/main/java/com/baiyue/gateway/filter/HttpOverseasSecurityValidationClient.java");
+        String gatewayApplication = read("gateway-overseas/src/main/resources/application.yml");
+        String gatewayNacos = read("config/nacos/overseas/gateway-overseas.yml");
+        String bridgeApplication = read("event-bridge-service/src/main/resources/application.yml");
+        String bridgeNacos = read("config/nacos/overseas/event-bridge-service.yml");
+        String compose = read("deploy/docker-compose.overseas.yml");
+
+        assertThat(client).contains("/internal/lastleg/security/v1/validate")
+            .contains("new Request(userId, tenantId, permissionVersion)")
+            .doesNotContain("new Request(userId, tenantId, tokenVersion")
+            .doesNotContain("/internal/overseas-security/");
+        for (String source : new String[]{gatewayApplication, gatewayNacos, compose}) {
+            assertThat(source).contains("LASTLEG_SECURITY_SERVICE_URL", "http://lastleg-service:9303");
+        }
+        for (String source : new String[]{bridgeApplication, bridgeNacos, compose}) {
+            assertThat(source).contains("LASTLEG_SECURITY_EVENT_CONSUMER_URL",
+                "/internal/lastleg/security/v1/events");
+        }
+        assertThat(gatewayApplication + gatewayNacos + bridgeApplication + bridgeNacos + compose)
+            .doesNotContain("overseas-security-service", "9307", "OVERSEAS_SECURITY_DB_URL",
+                "OVERSEAS_SECURITY_SERVICE_URL", "OVERSEAS_SECURITY_EVENT_CONSUMER_URL");
+    }
+
+    private static String read(String relative) throws Exception {
+        Path path = Path.of(relative);
+        if (!Files.exists(path)) path = Path.of("..").resolve(relative);
+        return Files.readString(path, StandardCharsets.UTF_8);
+    }
+}
diff --git a/gateway-overseas/src/test/java/com/baiyue/gateway/filter/OverseasSecurityProjectionFilterTest.java b/gateway-overseas/src/test/java/com/baiyue/gateway/filter/OverseasSecurityProjectionFilterTest.java
index ff9f935f0..1857158e8 100644
--- a/gateway-overseas/src/test/java/com/baiyue/gateway/filter/OverseasSecurityProjectionFilterTest.java
+++ b/gateway-overseas/src/test/java/com/baiyue/gateway/filter/OverseasSecurityProjectionFilterTest.java
@@ -26,7 +26,7 @@ class OverseasSecurityProjectionFilterTest {
     private final OverseasSecurityProjectionFilter filter = new OverseasSecurityProjectionFilter(client, new ObjectMapper());
 
     @Test void disabledUserFailsWithA0401() {
-        when(client.validate(42, 0, 3, 8)).thenReturn(Mono.just(
+        when(client.validate(42, 0, 8)).thenReturn(Mono.just(
                 new OverseasSecurityValidationClient.Result(false, "USER_DISABLED")));
         var exchange = exchange("/api/platform/v1/last-leg/orders");
         StepVerifier.create(filter.filter(exchange, ignored -> Mono.empty())).verifyComplete();
@@ -36,7 +36,7 @@ class OverseasSecurityProjectionFilterTest {
 
     @Test void disabledTenantAndStalePermissionFailWithA0403() {
         for (String reason : new String[]{"TENANT_DISABLED", "PERMISSION_VERSION_STALE"}) {
-            when(client.validate(42, 0, 3, 8)).thenReturn(Mono.just(
+            when(client.validate(42, 0, 8)).thenReturn(Mono.just(
                     new OverseasSecurityValidationClient.Result(false, reason)));
             var exchange = exchange("/api/merchant/v1/last-leg/orders");
             StepVerifier.create(filter.filter(exchange, ignored -> Mono.empty())).verifyComplete();
@@ -46,14 +46,14 @@ class OverseasSecurityProjectionFilterTest {
     }
 
     @Test void projectionUnavailableFailsClosed() {
-        when(client.validate(42, 0, 3, 8)).thenReturn(Mono.error(new IllegalStateException("down")));
+        when(client.validate(42, 0, 8)).thenReturn(Mono.error(new IllegalStateException("down")));
         var exchange = exchange("/api/platform/v1/last-leg/orders");
         StepVerifier.create(filter.filter(exchange, ignored -> Mono.empty())).verifyComplete();
         assertThat(exchange.getResponse().getStatusCode()).isEqualTo(HttpStatus.UNAUTHORIZED);
     }
 
     @Test void acceptedSecurityStateContinuesAndNonApiPathsDoNotCallProjection() {
-        when(client.validate(42, 0, 3, 8)).thenReturn(Mono.just(
+        when(client.validate(42, 0, 8)).thenReturn(Mono.just(
                 new OverseasSecurityValidationClient.Result(true, null)));
         AtomicBoolean routed = new AtomicBoolean();
         StepVerifier.create(filter.filter(exchange("/api/platform/v1/last-leg/orders"), ignored -> {
diff --git a/iam/AGENTS.md b/iam/AGENTS.md
index b085e38c4..be2a0b5e5 100644
--- a/iam/AGENTS.md
+++ b/iam/AGENTS.md
@@ -12,10 +12,12 @@
 | 目标 | 入口 |
 |---|---|
 | 客户资料/审核 | `controller/PlatformTenantController.java`、`service/TenantService.java` |
+| 客户默认尺寸初始化、重试与补偿 | `service/CustomerDimensionRuleInitializationService.java`、`CustomerDimensionInitializationRelay.java`、`repository/CustomerDimensionInitializationRepository.java`、`client/CustomerDimensionRuleClient.java`、`model/CustomerDimensionInitializationTask.java`；持久任务异步调用 Firstleg `/internal/firstleg/v1/customer-dimension-configs/defaults` |
 | 商户成员与个人资料 | `controller/MerchantTenantController.java`、`service/MemberService.java`、`service/PersonalProfileService.java` |
-| 平台用户 | `controller/PlatformUserManagementController.java`、`service/PlatformUserManagementService.java` |
+| 平台用户与海外 PDA 仓绑定 | `controller/PlatformUserManagementController.java`、`service/PlatformUserManagementService.java`、`dto/PlatformUserManagementDtos.java`、`entity/IamMembership.java`；`WAREHOUSE_PICKER` 必须且只能绑定一个 `overseasWarehouseId` |
 | 角色/权限/RBAC | `controller/RbacController.java`、`service/RbacService.java` |
 | 授权快照/内部资格 | `controller/AuthorizationController.java`、`InternalAuthorizationController.java`、`service/AuthorizationSnapshotService.java` |
+| 海外安全状态事件 Outbox | `service/SecurityEventOutboxService.java`、`SecurityEventOutboxRelay.java`、`client/SecurityEventBridgeClient.java`；账号、授权或客户状态变更经版本化事件投影到 `../lastleg-service/security/` |
 | 消息中心/站内通知 | `notification/controller/NotificationInboxController.java`、`notification/controller/PlatformNotificationController.java`、`notification/service/NotificationService.java`；模板、任务、收件箱及事件消费均在 `notification/` |
 | File 资质元数据协作 | `controller/InternalTenantController.java`、`service/ProfileResourceService.java`、`client/AuthAccountClient.java` |
 | DTO/持久化 | `dto/`、`entity/`、`mapper/`、`repository/` |
@@ -26,7 +28,10 @@
 
 - 所有客户查询按 `tenant_id` 过滤；平台用户只能 `tenant_id=0`。必填资质审核通过才具备下单资格。
 - 成员/账号跨 IAM/Auth 保持幂等补偿；资质跨 IAM/File 不保存文件内容。
+- 客户建档只在 IAM 事务内落持久初始化意图，远端投递由带租约、退避和最大次数的 Relay 完成；只有状态为 `READY` 才能审核通过。注册补偿必须投递 `COMPENSATE`，不得在建档事务中同步依赖 Firstleg。
 - 权限资源 code/type 不可变；按钮隐藏不能替代后端权限校验。
+- 只有平台 `WAREHOUSE_PICKER` 可保存 `overseasWarehouseId`，且必须为单个有效海外仓；非拣货员必须为空。仓绑定、账号状态、角色权限或客户状态变化要在同一业务事务内推进安全事件 Outbox，不得依赖海外服务回查国内 IAM。
+- `IamTenantStatusChanged` 是安全可用性快照，不暴露客户建档/审核流程状态：仅 IAM 业务状态 `ACTIVE` 发布 `ACTIVE`，`PROFILE_REQUIRED`、`PENDING`、`REJECTED`、`DISABLED`、`ARCHIVED` 及其他不可用状态统一发布 `DISABLED`。
 
 ## 全量验收导航
 
diff --git a/iam/SECURITY-EVENT-AUDIT.md b/iam/SECURITY-EVENT-AUDIT.md
index 0f0a49f51..856b61edf 100644
--- a/iam/SECURITY-EVENT-AUDIT.md
+++ b/iam/SECURITY-EVENT-AUDIT.md
@@ -25,9 +25,11 @@ IAM 使用独立的 `iam_security_event_outbox`。业务状态、权限版本与
 ## 当前接入
 
 - 企业成员、平台内部用户和平台用户启停均写 `IamUserStatusChanged`。
-- 客户启停写 `IamTenantStatusChanged`。
+- 客户创建、审核结果及启停写 `IamTenantStatusChanged`。
 - 成员角色、平台内部用户角色及角色权限变更写 `IamPermissionVersionChanged`。
 
+普通 Admin/Client 的即时失效只覆盖用户停用、客户停用和权限版本推进。`token_version` 不进入 V1 投影，也不传给 Lastleg 校验；其即时权威比对只用于海外 PDA 向 Auth 核验仓绑定与会话版本。
+
 ## 尾程权限
 
 `lastleg-permissions.sql` 初始化以下平台权限，并授予 `PLATFORM_ADMIN`：
diff --git a/iam/src/main/java/com/baiyue/iam/client/SecurityEventBridgeClient.java b/iam/src/main/java/com/baiyue/iam/client/SecurityEventBridgeClient.java
index 4adf81539..c68eac775 100644
--- a/iam/src/main/java/com/baiyue/iam/client/SecurityEventBridgeClient.java
+++ b/iam/src/main/java/com/baiyue/iam/client/SecurityEventBridgeClient.java
@@ -7,7 +7,8 @@ import org.springframework.web.bind.annotation.PostMapping;
 import org.springframework.web.bind.annotation.RequestBody;
 import org.springframework.web.bind.annotation.RequestHeader;
 
-@FeignClient(name = "event-bridge-service", contextId = "iamSecurityEventBridgeClient")
+@FeignClient(name = "event-bridge-service", contextId = "iamSecurityEventBridgeClient",
+    url = "${baiyue.security-event.event-bridge-url:}")
 public interface SecurityEventBridgeClient {
     @PostMapping("/internal/event-bridge/events")
     ApiResponse<Acknowledgement> receive(@RequestHeader("X-Internal-Service-Token") String token,
diff --git a/iam/src/main/java/com/baiyue/iam/controller/PlatformTenantController.java b/iam/src/main/java/com/baiyue/iam/controller/PlatformTenantController.java
index d51fe0878..9a5e0642c 100644
--- a/iam/src/main/java/com/baiyue/iam/controller/PlatformTenantController.java
+++ b/iam/src/main/java/com/baiyue/iam/controller/PlatformTenantController.java
@@ -17,6 +17,7 @@ import com.baiyue.iam.dto.TenantDtos.PendingReviewResponse;
 import com.baiyue.iam.service.TenantGuard;
 import com.baiyue.iam.service.TenantService;
 import com.baiyue.iam.service.MemberService;
+import com.baiyue.iam.model.CustomerDimensionInitializationStatus;
 import com.baiyue.iam.dto.PlatformCustomerMemberDtos;
 import io.swagger.v3.oas.annotations.Operation;
 import io.swagger.v3.oas.annotations.Parameter;
@@ -77,6 +78,24 @@ public class PlatformTenantController {
         return ApiResponse.success(service.merchant(tenantId));
     }
 
+    @PostMapping("/tenants/{tenantId:\\d+}/dimension-initialization/retry")
+    @PreAuthorize("hasAuthority('platform:customer:edit')")
+    @Operation(summary = "重试客户默认尺寸初始化")
+    public ApiResponse<TenantResponse> retryDimensionInitialization(
+            @PathVariable long tenantId, @AuthenticationPrincipal AuthenticatedUser user) {
+        TenantGuard.tenant(user, "PLATFORM");
+        return ApiResponse.success(service.retryDimensionInitialization(tenantId));
+    }
+
+    @GetMapping("/tenants/{tenantId:\\d+}/dimension-initialization")
+    @PreAuthorize("hasAuthority('platform:customer:list')")
+    @Operation(summary = "查询客户默认尺寸初始化诊断")
+    public ApiResponse<CustomerDimensionInitializationStatus> dimensionInitializationStatus(
+            @PathVariable long tenantId, @AuthenticationPrincipal AuthenticatedUser user) {
+        TenantGuard.tenant(user, "PLATFORM");
+        return ApiResponse.success(service.dimensionInitializationStatus(tenantId));
+    }
+
     @GetMapping("/tenants/contact-phone-availability")
     @PreAuthorize("hasAnyAuthority('platform:customer:create','platform:customer:edit')")
     @Operation(summary = "校验客户联系电话唯一性")
diff --git a/iam/src/main/java/com/baiyue/iam/dto/OnboardingDtos.java b/iam/src/main/java/com/baiyue/iam/dto/OnboardingDtos.java
index b00df77b8..266bd6c2d 100644
--- a/iam/src/main/java/com/baiyue/iam/dto/OnboardingDtos.java
+++ b/iam/src/main/java/com/baiyue/iam/dto/OnboardingDtos.java
@@ -20,7 +20,8 @@ public final class OnboardingDtos {
             String address
     ) { }
 
-    public record MerchantRegistrationResponse(Long tenantId, Long membershipId, String tenantStatus) { }
+    public record MerchantRegistrationResponse(Long tenantId, Long membershipId, String tenantStatus,
+                                               String dimensionInitializationStatus) { }
 
     public record QualificationSubmissionRequest(
             @NotNull Long tenantId,
diff --git a/iam/src/main/java/com/baiyue/iam/dto/TenantDtos.java b/iam/src/main/java/com/baiyue/iam/dto/TenantDtos.java
index 40e3422e9..69a08ec1c 100644
--- a/iam/src/main/java/com/baiyue/iam/dto/TenantDtos.java
+++ b/iam/src/main/java/com/baiyue/iam/dto/TenantDtos.java
@@ -133,6 +133,7 @@ public final class TenantDtos {
 
     @Schema(name = "TenantResponse", description = "Enterprise tenant summary / 企业租户概要")
     public record TenantResponse(Long id, String tenantCode, String tenantName, String status,
+                                 String dimensionInitializationStatus,
                                  String legalName, String legalRepresentative, String unifiedSocialCreditCode, String contactName,
                                  String contactPhone, String contactEmail, String contactWechat,
                                  String servicePackage, String salesOwnerName, Integer paymentTermDays, String enterpriseType,
diff --git a/iam/src/main/java/com/baiyue/iam/entity/IamTenant.java b/iam/src/main/java/com/baiyue/iam/entity/IamTenant.java
index 1761b7a81..bc3971d9b 100644
--- a/iam/src/main/java/com/baiyue/iam/entity/IamTenant.java
+++ b/iam/src/main/java/com/baiyue/iam/entity/IamTenant.java
@@ -22,6 +22,7 @@ public class IamTenant extends BaseEntity {
     private String tenantName;
     private String tenantType;
     private String status;
+    private String dimensionInitializationStatus;
     private String legalName;
     private String legalRepresentative;
     private String unifiedSocialCreditCode;
diff --git a/iam/src/main/java/com/baiyue/iam/model/CustomerDimensionInitializationStatus.java b/iam/src/main/java/com/baiyue/iam/model/CustomerDimensionInitializationStatus.java
new file mode 100644
index 000000000..eaf32fa8b
--- /dev/null
+++ b/iam/src/main/java/com/baiyue/iam/model/CustomerDimensionInitializationStatus.java
@@ -0,0 +1,13 @@
+package com.baiyue.iam.model;
+
+import java.time.LocalDateTime;
+
+public record CustomerDimensionInitializationStatus(
+    long tenantId,
+    String status,
+    int attemptCount,
+    LocalDateTime nextRetryAt,
+    String lastErrorCode,
+    String lastErrorMessage,
+    LocalDateTime updatedAt
+) { }
diff --git a/iam/src/main/java/com/baiyue/iam/model/CustomerDimensionInitializationTask.java b/iam/src/main/java/com/baiyue/iam/model/CustomerDimensionInitializationTask.java
new file mode 100644
index 000000000..51b3aea9a
--- /dev/null
+++ b/iam/src/main/java/com/baiyue/iam/model/CustomerDimensionInitializationTask.java
@@ -0,0 +1,12 @@
+package com.baiyue.iam.model;
+
+public record CustomerDimensionInitializationTask(
+        long tenantId,
+        long operatorId,
+        String initializationKey,
+        String action,
+        String status,
+        int attemptCount,
+        int taskVersion) {
+}
+
diff --git a/iam/src/main/java/com/baiyue/iam/repository/CustomerDimensionInitializationRepository.java b/iam/src/main/java/com/baiyue/iam/repository/CustomerDimensionInitializationRepository.java
new file mode 100644
index 000000000..cc9d35ba8
--- /dev/null
+++ b/iam/src/main/java/com/baiyue/iam/repository/CustomerDimensionInitializationRepository.java
@@ -0,0 +1,123 @@
+package com.baiyue.iam.repository;
+
+import com.baiyue.iam.model.CustomerDimensionInitializationTask;
+import com.baiyue.iam.model.CustomerDimensionInitializationStatus;
+import jakarta.annotation.Resource;
+import org.springframework.jdbc.core.JdbcTemplate;
+import org.springframework.stereotype.Repository;
+import org.springframework.transaction.annotation.Transactional;
+
+import java.time.LocalDateTime;
+import java.util.List;
+import java.util.Optional;
+
+@Repository
+public class CustomerDimensionInitializationRepository {
+    @Resource private JdbcTemplate jdbc;
+
+    public void enqueue(long tenantId, long operatorId, String initializationKey) {
+        jdbc.update("INSERT INTO iam_customer_dimension_initialization_task(tenant_id,operator_id,"
+                + "initialization_key,action,status,attempt_count,next_retry_at,task_version) "
+                + "VALUES(?,?,?,'INITIALIZE','PENDING',0,NOW(3),0)",
+            tenantId, operatorId, initializationKey);
+    }
+
+    public void requestCompensation(long tenantId, long operatorId, String initializationKey) {
+        int updated = jdbc.update("UPDATE iam_customer_dimension_initialization_task SET operator_id=?,"
+                + "initialization_key=?,action='COMPENSATE',status='PENDING',attempt_count=0,"
+                + "next_retry_at=NOW(3),lease_owner=NULL,lease_until=NULL,last_error_code=NULL,"
+                + "last_error_message=NULL,task_version=task_version+1,updated_at=NOW(3) WHERE tenant_id=?",
+            operatorId, initializationKey, tenantId);
+        if (updated == 0) {
+            jdbc.update("INSERT INTO iam_customer_dimension_initialization_task(tenant_id,operator_id,"
+                    + "initialization_key,action,status,attempt_count,next_retry_at,task_version) "
+                    + "VALUES(?,?,?,'COMPENSATE','PENDING',0,NOW(3),0)",
+                tenantId, operatorId, initializationKey);
+        }
+    }
+
+    public boolean manualRetry(long tenantId) {
+        return jdbc.update("UPDATE iam_customer_dimension_initialization_task SET action='INITIALIZE',"
+                + "status='PENDING',attempt_count=0,next_retry_at=NOW(3),lease_owner=NULL,lease_until=NULL,"
+                + "last_error_code=NULL,last_error_message=NULL,task_version=task_version+1,updated_at=NOW(3) "
+                + "WHERE tenant_id=? AND status='FAILED'", tenantId) == 1;
+    }
+
+    public Optional<CustomerDimensionInitializationStatus> findStatus(long tenantId) {
+        List<CustomerDimensionInitializationStatus> rows = jdbc.query(
+            "SELECT tenant_id,status,attempt_count,next_retry_at,last_error_code,last_error_message,updated_at "
+                + "FROM iam_customer_dimension_initialization_task WHERE tenant_id=?",
+            (rs, row) -> new CustomerDimensionInitializationStatus(
+                rs.getLong("tenant_id"), rs.getString("status"), rs.getInt("attempt_count"),
+                rs.getTimestamp("next_retry_at").toLocalDateTime(), rs.getString("last_error_code"),
+                rs.getString("last_error_message"), rs.getTimestamp("updated_at").toLocalDateTime()), tenantId);
+        return rows.stream().findFirst();
+    }
+
+    public void recoverExpiredLeases() {
+        jdbc.update("UPDATE iam_customer_dimension_initialization_task SET status='PENDING',lease_owner=NULL,"
+            + "lease_until=NULL,next_retry_at=NOW(3),task_version=task_version+1,updated_at=NOW(3) "
+            + "WHERE status='SENDING' AND lease_until<NOW(3)");
+    }
+
+    public List<Long> candidates(int limit) {
+        return jdbc.queryForList("SELECT tenant_id FROM iam_customer_dimension_initialization_task "
+            + "WHERE status='PENDING' AND next_retry_at<=NOW(3) ORDER BY next_retry_at,tenant_id LIMIT "
+            + Math.max(1, Math.min(limit, 200)), Long.class);
+    }
+
+    @Transactional
+    public CustomerDimensionInitializationTask claim(long tenantId, String workerId, LocalDateTime now) {
+        int claimed = jdbc.update("UPDATE iam_customer_dimension_initialization_task SET status='SENDING',"
+                + "lease_owner=?,lease_until=?,task_version=task_version+1,updated_at=? "
+                + "WHERE tenant_id=? AND status='PENDING' AND next_retry_at<=?",
+            workerId, now.plusMinutes(2), now, tenantId, now);
+        if (claimed != 1) return null;
+        return jdbc.queryForObject("SELECT tenant_id,operator_id,initialization_key,action,status,"
+                + "attempt_count,task_version FROM iam_customer_dimension_initialization_task "
+                + "WHERE tenant_id=? AND status='SENDING' AND lease_owner=?",
+            (rs, row) -> new CustomerDimensionInitializationTask(
+                rs.getLong("tenant_id"), rs.getLong("operator_id"), rs.getString("initialization_key"),
+                rs.getString("action"), rs.getString("status"), rs.getInt("attempt_count"),
+                rs.getInt("task_version")), tenantId, workerId);
+    }
+
+    @Transactional
+    public boolean markReady(CustomerDimensionInitializationTask task, String workerId, Long configId) {
+        int updated = jdbc.update("UPDATE iam_customer_dimension_initialization_task SET status='READY',"
+                + "remote_config_id=?,lease_owner=NULL,lease_until=NULL,last_error_code=NULL,"
+                + "last_error_message=NULL,completed_at=NOW(3),updated_at=NOW(3) "
+                + "WHERE tenant_id=? AND action='INITIALIZE' AND status='SENDING' AND lease_owner=? AND task_version=?",
+            configId, task.tenantId(), workerId, task.taskVersion());
+        if (updated == 1) {
+            jdbc.update("UPDATE iam_tenant SET dimension_initialization_status='READY',updated_at=NOW(3) "
+                + "WHERE id=? AND deleted=0", task.tenantId());
+        }
+        return updated == 1;
+    }
+
+    public boolean markCancelled(CustomerDimensionInitializationTask task, String workerId) {
+        return jdbc.update("UPDATE iam_customer_dimension_initialization_task SET status='CANCELLED',"
+                + "lease_owner=NULL,lease_until=NULL,last_error_code=NULL,last_error_message=NULL,"
+                + "completed_at=NOW(3),updated_at=NOW(3) WHERE tenant_id=? AND action='COMPENSATE' "
+                + "AND status='SENDING' AND lease_owner=? AND task_version=?",
+            task.tenantId(), workerId, task.taskVersion()) == 1;
+    }
+
+    @Transactional
+    public boolean recordFailure(CustomerDimensionInitializationTask task, String workerId, int nextAttempt,
+                                 LocalDateTime nextRetryAt, String code, String message, boolean exhausted) {
+        String status = exhausted ? "FAILED" : "PENDING";
+        int updated = jdbc.update("UPDATE iam_customer_dimension_initialization_task SET status=?,attempt_count=?,"
+                + "next_retry_at=?,lease_owner=NULL,lease_until=NULL,last_error_code=?,last_error_message=?,"
+                + "task_version=task_version+1,updated_at=NOW(3) WHERE tenant_id=? AND action=? "
+                + "AND status='SENDING' AND lease_owner=? AND task_version=?",
+            status, nextAttempt, nextRetryAt, code, message, task.tenantId(), task.action(), workerId,
+            task.taskVersion());
+        if (updated == 1 && exhausted && "INITIALIZE".equals(task.action())) {
+            jdbc.update("UPDATE iam_tenant SET dimension_initialization_status='FAILED',updated_at=NOW(3) "
+                + "WHERE id=? AND deleted=0", task.tenantId());
+        }
+        return updated == 1;
+    }
+}
diff --git a/iam/src/main/java/com/baiyue/iam/service/CustomerDimensionInitializationRelay.java b/iam/src/main/java/com/baiyue/iam/service/CustomerDimensionInitializationRelay.java
new file mode 100644
index 000000000..817d7eb81
--- /dev/null
+++ b/iam/src/main/java/com/baiyue/iam/service/CustomerDimensionInitializationRelay.java
@@ -0,0 +1,101 @@
+package com.baiyue.iam.service;
+
+import com.baiyue.common.core.api.ApiResponse;
+import com.baiyue.iam.client.CustomerDimensionRuleClient;
+import com.baiyue.iam.model.CustomerDimensionInitializationTask;
+import com.baiyue.iam.repository.CustomerDimensionInitializationRepository;
+import jakarta.annotation.Resource;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.scheduling.annotation.Scheduled;
+import org.springframework.stereotype.Component;
+
+import java.time.LocalDateTime;
+import java.util.Set;
+import java.util.UUID;
+
+@Component
+@Slf4j
+public class CustomerDimensionInitializationRelay {
+    private static final Set<String> PERMANENT_CODES = Set.of("A0400", "A0403", "A0404", "A0409", "A0422");
+    @Resource private CustomerDimensionInitializationRepository repository;
+    @Resource private CustomerDimensionRuleClient client;
+    @Value("${baiyue.security.internal-service-token}") private String internalToken;
+    @Value("${baiyue.customer-dimension-initialization.max-attempts:12}") private int maxAttempts;
+    private final String workerId = UUID.randomUUID().toString();
+
+    @Scheduled(fixedDelayString = "${baiyue.customer-dimension-initialization.fixed-delay-ms:5000}")
+    public void relay() {
+        repository.recoverExpiredLeases();
+        for (Long tenantId : repository.candidates(50)) deliver(tenantId);
+    }
+
+    void deliver(long tenantId) {
+        CustomerDimensionInitializationTask task = repository.claim(tenantId, workerId, LocalDateTime.now());
+        if (task == null) return;
+        try {
+            if ("COMPENSATE".equals(task.action())) {
+                ApiResponse<Void> response = client.compensate(
+                    internalToken, task.tenantId(), task.initializationKey());
+                requireSuccess(response, false);
+                repository.markCancelled(task, workerId);
+                return;
+            }
+            ApiResponse<CustomerDimensionRuleClient.InitializationResponse> response = client.initialize(
+                internalToken, new CustomerDimensionRuleClient.InitializationRequest(
+                    task.tenantId(), task.operatorId(), task.initializationKey()));
+            requireSuccess(response, true);
+            if (response.data() == null || response.data().configId() == null) {
+                throw new DeliveryFailure("S0503", "Firstleg 未返回默认尺寸配置ID", false);
+            }
+            repository.markReady(task, workerId, response.data().configId());
+        } catch (Exception failure) {
+            int nextAttempt = task.attemptCount() + 1;
+            boolean permanent = failure instanceof DeliveryFailure delivery && delivery.permanent;
+            boolean exhausted = permanent || nextAttempt >= maxAttempts;
+            String code = failure instanceof DeliveryFailure delivery ? delivery.code : "S0503";
+            String message = safeMessage(failure);
+            repository.recordFailure(task, workerId, nextAttempt,
+                LocalDateTime.now().plusSeconds(backoffSeconds(nextAttempt)), code, message, exhausted);
+            log.warn("客户默认尺寸后台初始化失败 tenantId={}, action={}, attempt={}, exhausted={}, code={}, reason={}",
+                tenantId, task.action(), nextAttempt, exhausted, code, message);
+        }
+    }
+
+    private static void requireSuccess(ApiResponse<?> response, boolean requireData) {
+        if (response != null && response.successful() && (!requireData || response.data() != null)) return;
+        String code = response == null || response.code() == null ? "S0503" : response.code();
+        String message = response == null || response.message() == null || response.message().isBlank()
+            ? "Firstleg 服务未确认客户默认尺寸初始化" : response.message();
+        throw new DeliveryFailure(code, message, PERMANENT_CODES.contains(code));
+    }
+
+    private static long backoffSeconds(int attempt) {
+        return switch (Math.min(Math.max(attempt, 1), 5)) {
+            case 1 -> 10;
+            case 2 -> 30;
+            case 3 -> 120;
+            case 4 -> 600;
+            default -> 1800;
+        };
+    }
+
+    private static String safeMessage(Exception failure) {
+        String value = failure.getMessage();
+        if (value == null || value.isBlank()) value = failure.getClass().getSimpleName();
+        value = value.replaceAll("[\\r\\n\\t]+", " ");
+        value = value.replaceAll("(?i)Bearer\\s+[^\\s,;]+", "Bearer ***")
+            .replaceAll("(?i)(token|password)=([^\\s&,;]+)", "$1=***");
+        return value.length() > 1000 ? value.substring(0, 1000) : value;
+    }
+
+    private static final class DeliveryFailure extends RuntimeException {
+        private final String code;
+        private final boolean permanent;
+        private DeliveryFailure(String code, String message, boolean permanent) {
+            super(message);
+            this.code = code;
+            this.permanent = permanent;
+        }
+    }
+}
diff --git a/iam/src/main/java/com/baiyue/iam/service/CustomerDimensionRuleInitializationService.java b/iam/src/main/java/com/baiyue/iam/service/CustomerDimensionRuleInitializationService.java
index 32bd7217c..c5aaca617 100644
--- a/iam/src/main/java/com/baiyue/iam/service/CustomerDimensionRuleInitializationService.java
+++ b/iam/src/main/java/com/baiyue/iam/service/CustomerDimensionRuleInitializationService.java
@@ -1,119 +1,50 @@
 package com.baiyue.iam.service;
 
-import com.baiyue.common.core.api.ApiResponse;
 import com.baiyue.common.core.api.ResultCode;
 import com.baiyue.common.core.exception.BizException;
-import com.baiyue.iam.client.CustomerDimensionRuleClient;
+import com.baiyue.iam.repository.CustomerDimensionInitializationRepository;
+import com.baiyue.iam.model.CustomerDimensionInitializationStatus;
 import jakarta.annotation.Resource;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-import org.springframework.beans.factory.annotation.Value;
 import org.springframework.stereotype.Service;
-import org.springframework.transaction.support.TransactionSynchronization;
-import org.springframework.transaction.support.TransactionSynchronizationManager;
 
-/** Provisions four default box-size dimensions and compensates them when customer creation rolls back. */
+/** Owns IAM's durable customer-dimension initialization intent; remote delivery is always background. */
 @Service
 public class CustomerDimensionRuleInitializationService {
-    private static final Logger log = LoggerFactory.getLogger(CustomerDimensionRuleInitializationService.class);
-    private static final int MAX_ATTEMPTS = 3;
     private static final String KEY_PREFIX = "iam-customer-create:";
-
-    @Resource
-    private CustomerDimensionRuleClient client;
-    @Value("${baiyue.security.internal-service-token}")
-    private String internalToken;
+    @Resource private CustomerDimensionInitializationRepository repository;
 
     public InitializationResult initialize(long tenantId, long operatorId) {
         String initializationKey = initializationKey(tenantId);
-        RuntimeException lastFailure = null;
-        for (int attempt = 1; attempt <= MAX_ATTEMPTS; attempt++) {
-            try {
-                ApiResponse<CustomerDimensionRuleClient.InitializationResponse> response = client.initialize(
-                        internalToken,
-                        new CustomerDimensionRuleClient.InitializationRequest(
-                                tenantId, operatorId, initializationKey));
-                if (response != null && response.successful() && response.data() != null) {
-                    InitializationResult result = new InitializationResult(
-                            response.data().createdByThisInitialization(), initializationKey);
-                    registerRollbackCompensation(tenantId, result);
-                    return result;
-                }
-                lastFailure = unavailable(response);
-                log.warn("客户4条默认箱规尺寸初始化失败，tenantId={}, attempt={}, code={}, requestId={}, traceId={}",
-                        tenantId, attempt, response == null ? null : response.code(),
-                        response == null ? null : response.requestId(),
-                        response == null ? null : response.traceId());
-            } catch (RuntimeException failure) {
-                lastFailure = failure;
-                log.warn("客户4条默认箱规尺寸初始化调用异常，tenantId={}, attempt={}", tenantId, attempt, failure);
-            }
-        }
-        compensateAfterUncertainInitialization(tenantId, initializationKey);
-        throw unavailable(lastFailure);
+        repository.enqueue(tenantId, operatorId, initializationKey);
+        return new InitializationResult(false, initializationKey, "PENDING");
     }
 
     /** Used when Auth compensates a committed client registration. */
     public void compensateRegistration(long tenantId) {
-        compensateRequired(tenantId, initializationKey(tenantId));
+        repository.requestCompensation(tenantId, 0L, initializationKey(tenantId));
     }
 
-    private void registerRollbackCompensation(long tenantId, InitializationResult result) {
-        if (!result.created() || !TransactionSynchronizationManager.isSynchronizationActive()) return;
-        TransactionSynchronizationManager.registerSynchronization(new TransactionSynchronization() {
-            @Override
-            public void afterCompletion(int status) {
-                if (status != STATUS_ROLLED_BACK) return;
-                try {
-                    compensateRequired(tenantId, result.initializationKey());
-                } catch (RuntimeException compensationFailure) {
-                    log.error("客户创建事务回滚后4条默认箱规尺寸补偿失败，tenantId={}, initializationKey={}",
-                            tenantId, result.initializationKey(), compensationFailure);
-                }
-            }
-        });
-    }
-
-    private void compensateAfterUncertainInitialization(long tenantId, String initializationKey) {
-        try {
-            compensateRequired(tenantId, initializationKey);
-        } catch (RuntimeException compensationFailure) {
-            log.error("客户4条默认箱规尺寸初始化结果不确定且补偿失败，tenantId={}, initializationKey={}",
-                    tenantId, initializationKey, compensationFailure);
+    public void retry(long tenantId) {
+        if (!repository.manualRetry(tenantId)) {
+            throw new BizException(ResultCode.CONFLICT, "默认尺寸初始化当前不可人工重试");
         }
     }
 
-    private void compensateRequired(long tenantId, String initializationKey) {
-        RuntimeException lastFailure = null;
-        for (int attempt = 1; attempt <= MAX_ATTEMPTS; attempt++) {
-            try {
-                ApiResponse<Void> response = client.compensate(internalToken, tenantId, initializationKey);
-                if (response != null && response.successful()) return;
-                lastFailure = unavailable(response);
-            } catch (RuntimeException failure) {
-                lastFailure = failure;
-            }
+    public CustomerDimensionInitializationStatus status(long tenantId) {
+        return repository.findStatus(tenantId).orElseThrow(
+            () -> new BizException(ResultCode.NOT_FOUND, "默认尺寸初始化任务不存在"));
+    }
+
+    public void requireReady(String status) {
+        if (!"READY".equals(status)) {
+            throw new BizException(ResultCode.CONFLICT,
+                "客户默认尺寸尚未就绪，当前状态: " + (status == null ? "PENDING" : status));
         }
-        throw new BizException(ResultCode.SERVICE_UNAVAILABLE,
-                "客户4条默认箱规尺寸补偿失败，请根据客户ID修复数据一致性: " + tenantId);
-    }
-
-    private static BizException unavailable(ApiResponse<?> response) {
-        String detail = response == null || response.message() == null || response.message().isBlank()
-                ? "Firstleg 服务未返回有效响应" : response.message();
-        return new BizException(ResultCode.SERVICE_UNAVAILABLE, "4条默认箱规尺寸初始化失败: " + detail);
-    }
-
-    private static BizException unavailable(RuntimeException cause) {
-        String detail = cause == null || cause.getMessage() == null || cause.getMessage().isBlank()
-                ? "Firstleg 服务暂时不可用" : cause.getMessage();
-        return new BizException(ResultCode.SERVICE_UNAVAILABLE,
-                "4条默认箱规尺寸初始化失败，已重试 3 次: " + detail);
     }
 
     private static String initializationKey(long tenantId) {
         return KEY_PREFIX + tenantId;
     }
 
-    public record InitializationResult(boolean created, String initializationKey) { }
+    public record InitializationResult(boolean created, String initializationKey, String status) { }
 }
diff --git a/iam/src/main/java/com/baiyue/iam/service/MemberService.java b/iam/src/main/java/com/baiyue/iam/service/MemberService.java
index a2a9088a2..cc35971c5 100644
--- a/iam/src/main/java/com/baiyue/iam/service/MemberService.java
+++ b/iam/src/main/java/com/baiyue/iam/service/MemberService.java
@@ -104,6 +104,8 @@ public class MemberService {
             membership.setMemberType(request.memberType()); membership.setMemberNo(request.memberNo());
             membership.setStatus("ACTIVE"); membership.setJoinedAt(LocalDateTime.now()); repository.insert(membership);
             repository.replaceRoles(tenantId, membershipId, request.roleIds());
+            securityEvents.userStatus(authId, tenantId, "MERCHANT", "ACTIVE");
+            securityEvents.permissionChanged(authId, tenantId, "MERCHANT", "INITIAL_AUTHORIZATION");
             return response(tenantId, membership, user);
         } catch (RuntimeException exception) {
             try {
diff --git a/iam/src/main/java/com/baiyue/iam/service/MerchantOnboardingService.java b/iam/src/main/java/com/baiyue/iam/service/MerchantOnboardingService.java
index db8c43964..a393d5cac 100644
--- a/iam/src/main/java/com/baiyue/iam/service/MerchantOnboardingService.java
+++ b/iam/src/main/java/com/baiyue/iam/service/MerchantOnboardingService.java
@@ -42,6 +42,7 @@ public class MerchantOnboardingService {
     @Resource private IamTenantReviewMapper reviewMapper;
     @Resource private CustomerDimensionRuleInitializationService dimensionRuleInitialization;
     @Resource private OverseasStorageFeeInitializationService overseasStorageFeeInitialization;
+    @Resource private SecurityEventOutboxService securityEvents;
 
     @Transactional
     public MerchantRegistrationResponse register(MerchantRegistrationRequest request) {
@@ -69,6 +70,7 @@ public class MerchantOnboardingService {
         tenant.setTenantName(request.companyName());
         tenant.setTenantType("MERCHANT");
         tenant.setStatus("PROFILE_REQUIRED");
+        tenant.setDimensionInitializationStatus("PENDING");
         tenant.setLegalName(request.companyName());
         tenant.setLegalRepresentative(request.legalPerson());
         tenant.setContactName(request.displayName());
@@ -77,6 +79,7 @@ public class MerchantOnboardingService {
         tenant.setDeleted(false);
         tenant.setVersion(0);
         tenantMapper.insert(tenant);
+        securityEvents.tenantStatus(tenantId, tenant.getStatus());
 
         IamUser user = new IamUser();
         user.setId(userId);
@@ -108,6 +111,8 @@ public class MerchantOnboardingService {
         membershipRole.setTenantId(tenantId);
         membershipRole.setCreatedAt(LocalDateTime.now());
         membershipRoleMapper.insert(membershipRole);
+        securityEvents.userStatus(request.authUserId(), tenantId, "MERCHANT", "ACTIVE");
+        securityEvents.permissionChanged(request.authUserId(), tenantId, "MERCHANT", "INITIAL_AUTHORIZATION");
 
         if (StringUtils.hasText(request.address())) {
             IamTenantAddress address = new IamTenantAddress();
@@ -122,7 +127,8 @@ public class MerchantOnboardingService {
         }
         dimensionRuleInitialization.initialize(tenantId, request.authUserId());
         overseasStorageFeeInitialization.initialize(tenantId, request.authUserId(), tenant.getTenantName());
-        return new MerchantRegistrationResponse(tenantId, membershipId, tenant.getStatus());
+        return new MerchantRegistrationResponse(tenantId, membershipId, tenant.getStatus(),
+            tenant.getDimensionInitializationStatus());
     }
 
     /**
diff --git a/iam/src/main/java/com/baiyue/iam/service/PlatformInternalUserService.java b/iam/src/main/java/com/baiyue/iam/service/PlatformInternalUserService.java
index f0285949a..baa3d4658 100644
--- a/iam/src/main/java/com/baiyue/iam/service/PlatformInternalUserService.java
+++ b/iam/src/main/java/com/baiyue/iam/service/PlatformInternalUserService.java
@@ -77,6 +77,7 @@ public class PlatformInternalUserService {
             repository.insertUser(user);
             repository.insert(membership);
             repository.replaceRoles(PLATFORM_TENANT_ID, membershipId, roleIds);
+            publishInitialSecurityProjection(user);
             return response(membership, user, request.username(), roleIds);
         } catch (RuntimeException localFailure) {
             compensateCreate(authUserId, localFailure);
@@ -196,9 +197,16 @@ public class PlatformInternalUserService {
         IamMembership membership = newMembership(membershipId, user.getId(), memberNo);
         repository.insert(membership);
         repository.replaceRoles(PLATFORM_TENANT_ID, membershipId, roleIds);
+        publishInitialSecurityProjection(user);
         return response(membership, user, authAccount.username(), roleIds);
     }
 
+    private void publishInitialSecurityProjection(IamUser user) {
+        securityEvents.userStatus(user.getAuthUserId(), PLATFORM_TENANT_ID, "PLATFORM", user.getStatus());
+        securityEvents.permissionChanged(user.getAuthUserId(), PLATFORM_TENANT_ID, "PLATFORM",
+                "INITIAL_AUTHORIZATION");
+    }
+
     private InternalUserResponse response(IamMembership membership) {
         IamUser user = requiredUser(membership.getUserId());
         AuthAccountClient.AccountSummary authAccount = account(user.getAuthUserId());
diff --git a/iam/src/main/java/com/baiyue/iam/service/PlatformUserManagementService.java b/iam/src/main/java/com/baiyue/iam/service/PlatformUserManagementService.java
index 296100ffb..b7e719747 100644
--- a/iam/src/main/java/com/baiyue/iam/service/PlatformUserManagementService.java
+++ b/iam/src/main/java/com/baiyue/iam/service/PlatformUserManagementService.java
@@ -106,6 +106,8 @@ public class PlatformUserManagementService {
             membership.setLeftAt("DISABLED".equals(request.status()) ? LocalDateTime.now() : null);
             members.insert(membership);
             members.replaceRoles(tenantId, membershipId, roleIds);
+            securityEvents.userStatus(authUserId, tenantId, appCode, request.status());
+            securityEvents.permissionChanged(authUserId, tenantId, appCode, "INITIAL_AUTHORIZATION");
             return response(membership);
         } catch (RuntimeException localFailure) {
             compensateCreate(authUserId, localFailure);
diff --git a/iam/src/main/java/com/baiyue/iam/service/SecurityEventOutboxRelay.java b/iam/src/main/java/com/baiyue/iam/service/SecurityEventOutboxRelay.java
index 32b9bd9e4..de41c5d9d 100644
--- a/iam/src/main/java/com/baiyue/iam/service/SecurityEventOutboxRelay.java
+++ b/iam/src/main/java/com/baiyue/iam/service/SecurityEventOutboxRelay.java
@@ -2,6 +2,7 @@ package com.baiyue.iam.service;
 
 import com.baiyue.common.event.EventEnvelope;
 import com.baiyue.common.event.EventEnvelopeValidator;
+import com.baiyue.common.event.RegionCode;
 import com.baiyue.iam.client.SecurityEventBridgeClient;
 import com.fasterxml.jackson.databind.ObjectMapper;
 import jakarta.annotation.Resource;
@@ -45,6 +46,9 @@ public class SecurityEventOutboxRelay {
         try {
             EventEnvelope envelope = objectMapper.readValue(json, EventEnvelope.class);
             EventEnvelopeValidator.requireValid(envelope);
+            if (envelope.sourceRegion() != RegionCode.CN || envelope.targetRegion() != RegionCode.OVERSEAS) {
+                throw new IllegalStateException("IAM 安全事件必须从 CN 投影到 OVERSEAS");
+            }
             var response = client.receive(internalToken, envelope);
             if (response == null || !response.successful() || response.data() == null
                     || !eventId.equals(response.data().eventId())) {
diff --git a/iam/src/main/java/com/baiyue/iam/service/SecurityEventOutboxService.java b/iam/src/main/java/com/baiyue/iam/service/SecurityEventOutboxService.java
index fcc158420..520689a86 100644
--- a/iam/src/main/java/com/baiyue/iam/service/SecurityEventOutboxService.java
+++ b/iam/src/main/java/com/baiyue/iam/service/SecurityEventOutboxService.java
@@ -32,8 +32,9 @@ public class SecurityEventOutboxService {
             + "ON DUPLICATE KEY UPDATE status_version=status_version+1", tenantId);
         long version = jdbc.queryForObject(
             "SELECT status_version FROM iam_security_tenant_version WHERE tenant_id=?", Long.class, tenantId);
+        String securityStatus = "ACTIVE".equals(status) ? "ACTIVE" : "DISABLED";
         write(EventTypes.IAM_TENANT_STATUS_CHANGED, "TENANT", String.valueOf(tenantId), tenantId, version,
-            new IamSecurityEventsV1.TenantStatusChanged(tenantId, status, Instant.now()));
+            new IamSecurityEventsV1.TenantStatusChanged(tenantId, securityStatus, Instant.now()));
     }
 
     public void permissionChanged(long authUserId, long tenantId, String appCode, String reason) {
diff --git a/iam/src/main/java/com/baiyue/iam/service/TenantAdministratorProvisioningService.java b/iam/src/main/java/com/baiyue/iam/service/TenantAdministratorProvisioningService.java
index 7eb7d502b..6e1a6adbc 100644
--- a/iam/src/main/java/com/baiyue/iam/service/TenantAdministratorProvisioningService.java
+++ b/iam/src/main/java/com/baiyue/iam/service/TenantAdministratorProvisioningService.java
@@ -43,6 +43,8 @@ public class TenantAdministratorProvisioningService implements TenantApprovalIni
     private IamRoleMapper roles;
     @Resource
     private AuthAccountClient authClient;
+    @Resource
+    private SecurityEventOutboxService securityEvents;
     @Value("${baiyue.security.internal-service-token}")
     private String internalToken;
     private SecureRandom random = new SecureRandom();
@@ -112,6 +114,7 @@ public class TenantAdministratorProvisioningService implements TenantApprovalIni
             membership.setUpdatedBy(operatorId);
             members.insert(membership);
             members.replaceRoles(tenant.getId(), membershipId, List.of(ownerRole.getId()));
+            publishInitialSecurityProjection(authUserId, tenant.getId());
             return result;
         } catch (RuntimeException localFailure) {
             compensate(context, result);
@@ -152,6 +155,7 @@ public class TenantAdministratorProvisioningService implements TenantApprovalIni
             String password = temporaryPassword();
             String username = createAuthAccountWithUniqueUsername(user.getAuthUserId(), password,
                     tenant, owner.getId());
+            publishInitialSecurityProjection(user.getAuthUserId(), tenant.getId());
             return ProvisioningResult.created(user.getAuthUserId(), username, password);
         }
         if (!"ACTIVE".equals(account.status())
@@ -166,6 +170,8 @@ public class TenantAdministratorProvisioningService implements TenantApprovalIni
             List<Long> repairedRoleIds = new java.util.ArrayList<>(roleIds);
             repairedRoleIds.add(ownerRole.getId());
             members.replaceRoles(tenant.getId(), owner.getId(), repairedRoleIds.stream().distinct().toList());
+            securityEvents.permissionChanged(user.getAuthUserId(), tenant.getId(), "MERCHANT",
+                    "MEMBER_ROLES_CHANGED");
         }
         return ProvisioningResult.existing();
     }
@@ -230,6 +236,11 @@ public class TenantAdministratorProvisioningService implements TenantApprovalIni
         }
     }
 
+    private void publishInitialSecurityProjection(long authUserId, long tenantId) {
+        securityEvents.userStatus(authUserId, tenantId, "MERCHANT", "ACTIVE");
+        securityEvents.permissionChanged(authUserId, tenantId, "MERCHANT", "INITIAL_AUTHORIZATION");
+    }
+
     private void compensate(long authUserId) {
         try {
             ApiResponse<Void> response = authClient.compensate(internalToken, authUserId);
diff --git a/iam/src/main/java/com/baiyue/iam/service/TenantService.java b/iam/src/main/java/com/baiyue/iam/service/TenantService.java
index 5d4195185..f93c268cc 100644
--- a/iam/src/main/java/com/baiyue/iam/service/TenantService.java
+++ b/iam/src/main/java/com/baiyue/iam/service/TenantService.java
@@ -16,6 +16,7 @@ import com.baiyue.iam.client.AuthAccountClient;
 import com.baiyue.iam.repository.MemberRepository;
 import com.baiyue.iam.entity.IamMembership;
 import com.baiyue.iam.entity.IamUser;
+import com.baiyue.iam.model.CustomerDimensionInitializationStatus;
 import com.baiyue.iam.dto.TenantDtos.ResetCustomerOwnerPasswordRequest;
 import com.baiyue.iam.dto.OnboardingDtos.OrderEligibilityResponse;
 
@@ -169,6 +170,7 @@ public class TenantService {
         tenant.setTenantName(request.tenantName());
         tenant.setTenantType("MERCHANT");
         tenant.setStatus("PROFILE_REQUIRED");
+        tenant.setDimensionInitializationStatus("PENDING");
         tenant.setLegalName(request.legalName());
         tenant.setLegalRepresentative(request.legalRepresentative());
         tenant.setUnifiedSocialCreditCode(null);
@@ -188,6 +190,7 @@ public class TenantService {
         tenant.setCreatedBy(operatorId);
         tenant.setUpdatedBy(operatorId);
         repository.insertTenant(tenant);
+        securityEvents.tenantStatus(tenant.getId(), tenant.getStatus());
         dimensionRuleInitialization.initialize(tenant.getId(), operatorId);
         overseasStorageFeeInitialization.initialize(tenant.getId(), operatorId, tenant.getTenantName());
         var administrator = administratorProvisioning.provisionPlatformCreatedTenant(tenant, operatorId);
@@ -271,6 +274,9 @@ public class TenantService {
         if (tenant == null) {
             throw new BizException(ResultCode.NOT_FOUND, "Tenant not found / 企业不存在");
         }
+        if (approve) {
+            dimensionRuleInitialization.requireReady(tenant.getDimensionInitializationStatus());
+        }
 
         var initializationContext = new TenantApprovalInitializer.ApprovalContext(
                 tenant, reviewId, reviewerId, comment);
@@ -292,6 +298,7 @@ public class TenantService {
             tenant.setApprovedAt(approve ? LocalDateTime.now() : null);
             tenant.setApprovedBy(approve ? reviewerId : null);
             repository.saveTenant(tenant);
+            securityEvents.tenantStatus(tenant.getId(), tenant.getStatus());
             for (var qualification : profileRepository.findQualifications(tenant.getId())) {
                 if ("PENDING".equals(qualification.getStatus())) {
                     qualification.setStatus(approve ? "APPROVED" : "REJECTED");
@@ -321,6 +328,10 @@ public class TenantService {
             return new OrderEligibilityResponse(false, tenant.getStatus(),
                     "Enterprise information must be approved before ordering");
         }
+        if (!"READY".equals(tenant.getDimensionInitializationStatus())) {
+            return new OrderEligibilityResponse(false, tenant.getStatus(),
+                "Customer default dimensions are not ready");
+        }
         if (!hasAllQualificationsWithStatus(profileRepository.findQualifications(tenantId), "APPROVED")) {
             return new OrderEligibilityResponse(false, tenant.getStatus(),
                     "All required enterprise qualifications must be approved");
@@ -338,6 +349,22 @@ public class TenantService {
         return response(requireMerchant(tenantId));
     }
 
+    @Transactional
+    @BusinessAudit(event = "PLATFORM_CUSTOMER_DIMENSION_INITIALIZATION_RETRY", resourceType = "TENANT",
+        resourceId = "#tenantId", description = "平台重试客户默认尺寸初始化", captureBefore = false)
+    public TenantResponse retryDimensionInitialization(long tenantId) {
+        IamTenant tenant = requireMerchantForUpdate(tenantId);
+        dimensionRuleInitialization.retry(tenantId);
+        tenant.setDimensionInitializationStatus("PENDING");
+        repository.saveTenant(tenant);
+        return response(tenant);
+    }
+
+    public CustomerDimensionInitializationStatus dimensionInitializationStatus(long tenantId) {
+        requireMerchant(tenantId);
+        return dimensionRuleInitialization.status(tenantId);
+    }
+
     public boolean contactPhoneAvailable(String contactPhone, Long tenantId) {
         String normalized = normalizeContactPhone(contactPhone);
         return tenantId == null
@@ -505,6 +532,7 @@ public class TenantService {
     private TenantResponse response(IamTenant tenant) {
         return new TenantResponse(
             tenant.getId(), tenant.getTenantCode(), tenant.getTenantName(), tenant.getStatus(),
+            tenant.getDimensionInitializationStatus(),
             tenant.getLegalName(), tenant.getLegalRepresentative(), tenant.getUnifiedSocialCreditCode(), tenant.getContactName(),
             tenant.getContactPhone(), tenant.getContactEmail(), tenant.getContactWechat(),
             tenant.getServicePackage(), tenant.getSalesOwnerName(), tenant.getPaymentTermDays(), tenant.getEnterpriseType(),
@@ -527,6 +555,7 @@ public class TenantService {
     private TenantResponse summaryResponse(IamTenant tenant) {
         TenantResponse response = response(tenant);
         return new TenantResponse(response.id(), response.tenantCode(), response.tenantName(), response.status(),
+            response.dimensionInitializationStatus(),
             response.legalName(), response.legalRepresentative(), response.unifiedSocialCreditCode(), response.contactName(),
             maskPhone(response.contactPhone()), maskEmail(response.contactEmail()), response.contactWechat(),
             response.servicePackage(), response.salesOwnerName(), response.paymentTermDays(), response.enterpriseType(),
@@ -537,6 +566,7 @@ public class TenantService {
     private TenantResponse merchantVisibleResponse(IamTenant tenant) {
         TenantResponse response = response(tenant);
         return new TenantResponse(response.id(), response.tenantCode(), response.tenantName(), response.status(),
+            response.dimensionInitializationStatus(),
             response.legalName(), response.legalRepresentative(), response.unifiedSocialCreditCode(), response.contactName(),
             response.contactPhone(), response.contactEmail(), response.contactWechat(), response.servicePackage(), response.salesOwnerName(),
             response.paymentTermDays(), response.enterpriseType(), response.establishedDate(),
diff --git a/iam/src/main/resources/application.yml b/iam/src/main/resources/application.yml
index e724fd6a4..5faf2522f 100644
--- a/iam/src/main/resources/application.yml
+++ b/iam/src/main/resources/application.yml
@@ -23,6 +23,11 @@ spring:
         namespace: ${NACOS_NAMESPACE:public}
         encode: UTF-8
 baiyue:
+  security-event:
+    event-bridge-url: ${SECURITY_EVENT_BRIDGE_URL:http://event-bridge-overseas:9312}
+  customer-dimension-initialization:
+    fixed-delay-ms: ${CUSTOMER_DIMENSION_INITIALIZATION_FIXED_DELAY_MS:5000}
+    max-attempts: ${CUSTOMER_DIMENSION_INITIALIZATION_MAX_ATTEMPTS:12}
   notification:
     scheduler-enabled: ${NOTIFICATION_SCHEDULER_ENABLED:false}
     dispatch-timeout-seconds: ${NOTIFICATION_DISPATCH_TIMEOUT_SECONDS:300}
diff --git a/iam/src/main/resources/db/admin-prototype-menu-permissions.sql b/iam/src/main/resources/db/admin-prototype-menu-permissions.sql
index 4508de070..097bed02a 100644
--- a/iam/src/main/resources/db/admin-prototype-menu-permissions.sql
+++ b/iam/src/main/resources/db/admin-prototype-menu-permissions.sql
@@ -29,7 +29,9 @@ VALUES
   (5105053,0,'PLATFORM','BUTTON',5105043,'platform:finance:settlement-ar:export','导出应收结算单',NULL,'POST',90,'ACTIVE',1,0),
   (5105054,0,'PLATFORM','BUTTON',5105044,'platform:finance:settlement-ap:export','导出应付结算单',NULL,'POST',90,'ACTIVE',1,0),
   (5105055,0,'PLATFORM','BUTTON',5105045,'platform:finance:receivable-statistics:export','导出应收款统计表',NULL,'POST',90,'ACTIVE',1,0),
-  (5205012,10001,'MERCHANT','BUTTON',5205000,'merchant:finance:statement:confirm','确认客户对账单',NULL,'POST',30,'ACTIVE',1,0),
+  (5305000,0,'MERCHANT','MENU',5300000,'merchant:finance:statement','财务账单','/finance/statements',NULL,40,'ACTIVE',1,0),
+  (5305010,0,'MERCHANT','BUTTON',5305000,'merchant:finance:statement:list','查看账单',NULL,'GET',10,'ACTIVE',1,0),
+  (5305011,0,'MERCHANT','BUTTON',5305000,'merchant:finance:statement:view','查看账单详情及收款',NULL,'GET',20,'ACTIVE',1,0),
   (5305012,0,'MERCHANT','BUTTON',5305000,'merchant:finance:statement:confirm','确认客户对账单',NULL,'POST',30,'ACTIVE',1,0)
 ON DUPLICATE KEY UPDATE
   permission_type=VALUES(permission_type), parent_id=VALUES(parent_id),
@@ -101,18 +103,12 @@ UPDATE iam_permission p
    SET p.parent_id=mapping.parent_id
  WHERE p.tenant_id=0 AND p.app_code='PLATFORM' AND p.permission_type='BUTTON';
 
-INSERT IGNORE INTO iam_role_permission (tenant_id, role_id, permission_id, created_at)
-SELECT 10001, r.id, p.id, CURRENT_TIMESTAMP(3)
-  FROM iam_role r
-  JOIN iam_permission p ON p.tenant_id=10001 AND p.app_code='MERCHANT'
- WHERE r.tenant_id=10001 AND r.app_code='MERCHANT' AND r.role_code IN ('MERCHANT_OWNER','MERCHANT_ADMIN')
-   AND p.permission_code='merchant:finance:statement:confirm';
-
 INSERT IGNORE INTO iam_role_permission (tenant_id, role_id, permission_id, created_at)
 SELECT 0, r.id, p.id, CURRENT_TIMESTAMP(3)
   FROM iam_role r
   JOIN iam_permission p ON p.tenant_id=0 AND p.app_code='MERCHANT'
  WHERE r.tenant_id=0 AND r.app_code='MERCHANT' AND r.role_code='MERCHANT_OWNER'
    AND r.status='ACTIVE' AND r.deleted=0
-   AND p.permission_code='merchant:finance:statement:confirm'
+   AND p.permission_code IN ('merchant:finance:statement','merchant:finance:statement:list',
+                             'merchant:finance:statement:view','merchant:finance:statement:confirm')
    AND p.status='ACTIVE' AND p.deleted=0;
diff --git a/iam/src/main/resources/db/customer-dimension-initialization-task.sql b/iam/src/main/resources/db/customer-dimension-initialization-task.sql
new file mode 100644
index 000000000..2f1794d8e
--- /dev/null
+++ b/iam/src/main/resources/db/customer-dimension-initialization-task.sql
@@ -0,0 +1,33 @@
+SET NAMES utf8mb4;
+USE baiyue_iam;
+
+SET @customer_dimension_status_ddl = (SELECT IF(
+  EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE()
+    AND table_name='iam_tenant' AND column_name='dimension_initialization_status'),
+  'SELECT 1',
+  'ALTER TABLE iam_tenant ADD COLUMN dimension_initialization_status VARCHAR(16) NOT NULL DEFAULT ''READY'' COMMENT ''默认尺寸初始化状态：PENDING待处理、READY已就绪、FAILED失败'' AFTER status'));
+PREPARE customer_dimension_status_stmt FROM @customer_dimension_status_ddl;
+EXECUTE customer_dimension_status_stmt;
+DEALLOCATE PREPARE customer_dimension_status_stmt;
+
+CREATE TABLE IF NOT EXISTS iam_customer_dimension_initialization_task (
+  tenant_id BIGINT NOT NULL COMMENT '客户ID及任务聚合ID',
+  operator_id BIGINT NOT NULL COMMENT '触发初始化的操作人ID；系统补偿为0',
+  initialization_key VARCHAR(128) NOT NULL COMMENT '稳定初始化幂等键：iam-customer-create:{tenantId}',
+  action VARCHAR(16) NOT NULL DEFAULT 'INITIALIZE' COMMENT '目标动作：INITIALIZE初始化、COMPENSATE补偿',
+  status VARCHAR(16) NOT NULL DEFAULT 'PENDING' COMMENT '投递状态：PENDING待投递、SENDING投递中、READY已就绪、FAILED失败、CANCELLED已补偿',
+  attempt_count INT NOT NULL DEFAULT 0 COMMENT '当前动作已失败尝试次数',
+  next_retry_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) COMMENT '下次允许投递时间',
+  lease_owner VARCHAR(128) NULL COMMENT '当前任务租约持有者',
+  lease_until DATETIME(3) NULL COMMENT '当前任务租约截止时间',
+  last_error_code VARCHAR(32) NULL COMMENT '最后下游错误码',
+  last_error_message VARCHAR(1000) NULL COMMENT '最后诊断错误，不保存敏感凭证',
+  remote_config_id BIGINT NULL COMMENT 'Firstleg返回的首条默认尺寸配置ID',
+  task_version INT NOT NULL DEFAULT 0 COMMENT '任务乐观版本；切换动作或认领时递增',
+  created_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) COMMENT '任务创建时间',
+  updated_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3) COMMENT '任务更新时间',
+  completed_at DATETIME(3) NULL COMMENT 'READY或CANCELLED完成时间',
+  PRIMARY KEY (tenant_id),
+  KEY idx_customer_dimension_task_dispatch (status,next_retry_at,lease_until),
+  KEY idx_customer_dimension_task_diagnosis (status,updated_at)
+) ENGINE=InnoDB COMMENT='IAM客户默认尺寸可靠后台初始化任务及诊断状态';
diff --git a/iam/src/main/resources/db/iam.sql b/iam/src/main/resources/db/iam.sql
index c2dfaffb3..bc250abe7 100644
--- a/iam/src/main/resources/db/iam.sql
+++ b/iam/src/main/resources/db/iam.sql
@@ -11,6 +11,7 @@ CREATE TABLE IF NOT EXISTS iam_tenant (
   tenant_name VARCHAR(128) NOT NULL COMMENT '客户企业名称',
   tenant_type VARCHAR(20) NOT NULL DEFAULT 'MERCHANT' COMMENT '主体类型：MERCHANT企业客户',
   status VARCHAR(20) NOT NULL DEFAULT 'PROFILE_REQUIRED' COMMENT '客户状态：PROFILE_REQUIRED待完善资料、PENDING待审核、ACTIVE正常、REJECTED已驳回、DISABLED已停用、ARCHIVED已归档',
+  dimension_initialization_status VARCHAR(16) NOT NULL DEFAULT 'READY' COMMENT '默认尺寸初始化状态：PENDING待处理、READY已就绪、FAILED失败',
   legal_name VARCHAR(128) NULL COMMENT '企业法定名称',
   legal_representative VARCHAR(64) NULL COMMENT '法定代表人',
   unified_social_credit_code VARCHAR(32) NULL COMMENT '统一社会信用代码',
@@ -42,6 +43,28 @@ CREATE TABLE IF NOT EXISTS iam_tenant (
   KEY idx_iam_tenant_status (status, created_at)
 ) ENGINE=InnoDB COMMENT='客户企业主档表：保存企业资料、审核结果和启停状态；ID同时作为客户数据隔离键';
 
+CREATE TABLE IF NOT EXISTS iam_customer_dimension_initialization_task (
+  tenant_id BIGINT NOT NULL COMMENT '客户ID及任务聚合ID',
+  operator_id BIGINT NOT NULL COMMENT '触发初始化的操作人ID；系统补偿为0',
+  initialization_key VARCHAR(128) NOT NULL COMMENT '稳定初始化幂等键：iam-customer-create:{tenantId}',
+  action VARCHAR(16) NOT NULL DEFAULT 'INITIALIZE' COMMENT '目标动作：INITIALIZE初始化、COMPENSATE补偿',
+  status VARCHAR(16) NOT NULL DEFAULT 'PENDING' COMMENT '投递状态：PENDING待投递、SENDING投递中、READY已就绪、FAILED失败、CANCELLED已补偿',
+  attempt_count INT NOT NULL DEFAULT 0 COMMENT '当前动作已失败尝试次数',
+  next_retry_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) COMMENT '下次允许投递时间',
+  lease_owner VARCHAR(128) NULL COMMENT '当前任务租约持有者',
+  lease_until DATETIME(3) NULL COMMENT '当前任务租约截止时间',
+  last_error_code VARCHAR(32) NULL COMMENT '最后下游错误码',
+  last_error_message VARCHAR(1000) NULL COMMENT '最后诊断错误，不保存敏感凭证',
+  remote_config_id BIGINT NULL COMMENT 'Firstleg返回的首条默认尺寸配置ID',
+  task_version INT NOT NULL DEFAULT 0 COMMENT '任务乐观版本；切换动作或认领时递增',
+  created_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) COMMENT '任务创建时间',
+  updated_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3) COMMENT '任务更新时间',
+  completed_at DATETIME(3) NULL COMMENT 'READY或CANCELLED完成时间',
+  PRIMARY KEY (tenant_id),
+  KEY idx_customer_dimension_task_dispatch (status,next_retry_at,lease_until),
+  KEY idx_customer_dimension_task_diagnosis (status,updated_at)
+) ENGINE=InnoDB COMMENT='IAM客户默认尺寸可靠后台初始化任务及诊断状态';
+
 CREATE TABLE IF NOT EXISTS iam_tenant_review (
   id BIGINT NOT NULL COMMENT '审核记录ID',
   tenant_id BIGINT NOT NULL COMMENT '被审核客户ID和数据隔离键',
diff --git a/iam/src/main/resources/db/phase1-admin-rbac.sql b/iam/src/main/resources/db/phase1-admin-rbac.sql
index fcc5d4bde..0f00deb81 100644
--- a/iam/src/main/resources/db/phase1-admin-rbac.sql
+++ b/iam/src/main/resources/db/phase1-admin-rbac.sql
@@ -26,10 +26,7 @@ INSERT INTO iam_tenant (
   approved_at, approved_by, created_by, deleted, version
 ) VALUES
   (0, 'PLATFORM', '虫虫出海平台', 'PLATFORM', 'ACTIVE', '虫虫出海平台',
-   NULL, '平台系统管理员', NULL, NULL, NOW(3), 1000001, 1000001, 0, 0),
-  (10001, 'IT_TEST', 'IT 测试客户', 'MERCHANT', 'ACTIVE', 'IT 测试客户',
-   '91310000ITTEST0001', 'IT 测试客户管理员', '13800000000', 'it-test@example.com',
-   NOW(3), 1000001, 1000001, 0, 0)
+   NULL, '平台系统管理员', NULL, NULL, NOW(3), 1000001, 1000001, 0, 0)
 ON DUPLICATE KEY UPDATE
   tenant_code = VALUES(tenant_code), tenant_name = VALUES(tenant_name), tenant_type = VALUES(tenant_type),
   status = 'ACTIVE', legal_name = VALUES(legal_name),
@@ -38,28 +35,10 @@ ON DUPLICATE KEY UPDATE
   contact_email = VALUES(contact_email), approved_at = COALESCE(approved_at, NOW(3)),
   approved_by = VALUES(approved_by), deleted = 0;
 
--- The built-in IT customer must be immediately usable for order acceptance tests.
--- These approved metadata rows intentionally have no document URL: initialization must not
--- point at qualification files that do not exist in File service storage.
-INSERT INTO iam_tenant_qualification (
-  id, tenant_id, qualification_type, certificate_no, document_url,
-  valid_from, valid_to, status, review_comment, deleted
-) VALUES
-  (2100001, 10001, 'BUSINESS_LICENSE', '91310000ITTEST0001', NULL,
-   NULL, NULL, 'APPROVED', '开发测试初始化资质，无文件附件', 0),
-  (2100002, 10001, 'LEGAL_PERSON_ID', NULL, NULL,
-   NULL, NULL, 'APPROVED', '开发测试初始化资质，无文件附件', 0)
-ON DUPLICATE KEY UPDATE
-  tenant_id = VALUES(tenant_id), qualification_type = VALUES(qualification_type),
-  certificate_no = VALUES(certificate_no), status = 'APPROVED',
-  review_comment = VALUES(review_comment), deleted = 0;
-
 INSERT INTO iam_user (
   id, auth_user_id, user_type, display_name, phone, email, status, deleted, version
 ) VALUES
-  (2000001, 1000001, 'INTERNAL', '平台系统管理员', NULL, NULL, 'ACTIVE', 0, 0),
-  (2000002, 1000002, 'ENTERPRISE', 'IT 测试客户管理员', '13800000000',
-   'it-test@example.com', 'ACTIVE', 0, 0)
+  (2000001, 1000001, 'INTERNAL', '平台系统管理员', NULL, NULL, 'ACTIVE', 0, 0)
 ON DUPLICATE KEY UPDATE
   display_name = VALUES(display_name), phone = VALUES(phone), email = VALUES(email),
   status = 'ACTIVE', deleted = 0;
@@ -67,8 +46,7 @@ ON DUPLICATE KEY UPDATE
 INSERT INTO iam_membership (
   id, tenant_id, user_id, member_type, member_no, status, joined_at, deleted, version
 ) VALUES
-  (3000001, 0, 2000001, 'EMPLOYEE', 'PLATFORM-ADMIN-001', 'ACTIVE', NOW(3), 0, 0),
-  (3000002, 10001, 2000002, 'OWNER', 'MERCHANT-OWNER-001', 'ACTIVE', NOW(3), 0, 0)
+  (3000001, 0, 2000001, 'EMPLOYEE', 'PLATFORM-ADMIN-001', 'ACTIVE', NOW(3), 0, 0)
 ON DUPLICATE KEY UPDATE
   member_type = VALUES(member_type), member_no = VALUES(member_no),
   status = 'ACTIVE', joined_at = COALESCE(joined_at, NOW(3)), left_at = NULL, deleted = 0;
@@ -78,9 +56,7 @@ INSERT INTO iam_role (
 ) VALUES
   (4000001, 0, 'PLATFORM', 'PLATFORM_ADMIN', '平台超级管理员', 'SYSTEM', 'ACTIVE', '一期平台全部菜单和按钮', 0, 0),
   (4000002, 0, 'PLATFORM', 'CUSTOMER_REVIEWER', '企业审核员', 'SYSTEM', 'ACTIVE', '企业资料与入驻审核', 0, 0),
-  (4000003, 0, 'PLATFORM', 'ORDER_OPERATOR', '平台订单运营', 'SYSTEM', 'ACTIVE', '头程订单审核与履约处理', 0, 0),
-  (4000101, 10001, 'MERCHANT', 'MERCHANT_OWNER', '企业管理员', 'SYSTEM', 'ACTIVE', '本企业一期全部菜单和按钮', 0, 0),
-  (4000102, 10001, 'MERCHANT', 'MERCHANT_ORDER_MANAGER', '企业订单管理员', 'SYSTEM', 'ACTIVE', '本企业头程订单操作', 0, 0)
+  (4000003, 0, 'PLATFORM', 'ORDER_OPERATOR', '平台订单运营', 'SYSTEM', 'ACTIVE', '头程订单审核与履约处理', 0, 0)
 ON DUPLICATE KEY UPDATE
   role_name = VALUES(role_name), role_type = VALUES(role_type), status = 'ACTIVE',
   description = VALUES(description), deleted = 0;
@@ -167,40 +143,8 @@ SELECT 4000003, id, 0 FROM iam_permission
 WHERE id IN (5102019, 5102024, 5102025)
 ON DUPLICATE KEY UPDATE tenant_id = VALUES(tenant_id);
 
--- Merchant: level-one menus, level-two menus and buttons.
-INSERT INTO iam_permission
-  (id, tenant_id, app_code, permission_type, parent_id, permission_code, permission_name, route_path, http_method, sort_no, status, deleted)
-VALUES
-  (5200000, 10001, 'MERCHANT', 'MENU', 0, 'merchant:enterprise', '企业管理', '/enterprise', NULL, 10, 'ACTIVE', 0),
-  (5201000, 10001, 'MERCHANT', 'MENU', 0, 'merchant:order', '头程订单', '/first-leg-orders', NULL, 20, 'ACTIVE', 0),
-  (5202000, 10001, 'MERCHANT', 'MENU', 0, 'merchant:master-data', '基础资料', '/master-data', NULL, 30, 'ACTIVE', 0),
-  (5200010, 10001, 'MERCHANT', 'MENU', 5200000, 'merchant:profile:view', '企业资料', '/enterprise/profile', NULL, 10, 'ACTIVE', 0),
-  (5200020, 10001, 'MERCHANT', 'MENU', 5200000, 'merchant:member:list', '企业成员', '/enterprise/members', NULL, 20, 'ACTIVE', 0),
-  (5200030, 10001, 'MERCHANT', 'MENU', 5200000, 'merchant:role:list', '角色管理', '/enterprise/roles', NULL, 30, 'ACTIVE', 0),
-  (5201010, 10001, 'MERCHANT', 'MENU', 5201000, 'merchant:order:list', '我的订单', '/first-leg-orders/list', NULL, 10, 'ACTIVE', 0),
-  (5201020, 10001, 'MERCHANT', 'MENU', 5201000, 'merchant:order:create-page', '新建订单', '/first-leg-orders/create', NULL, 20, 'ACTIVE', 0),
-  (5202010, 10001, 'MERCHANT', 'MENU', 5202000, 'merchant:warehouse:list', '收货仓选择', '/master-data/warehouses', NULL, 10, 'ACTIVE', 0),
-  (5202020, 10001, 'MERCHANT', 'MENU', 5202000, 'merchant:counterparty:list', '往来单位', '/master-data/counterparties', NULL, 20, 'ACTIVE', 0),
-  (5200011, 10001, 'MERCHANT', 'BUTTON', 5200010, 'merchant:profile:edit', '编辑企业资料', NULL, NULL, 10, 'ACTIVE', 0),
-  (5200012, 10001, 'MERCHANT', 'BUTTON', 5200010, 'merchant:qualification:upload', '上传企业资质', NULL, NULL, 20, 'ACTIVE', 0),
-  (5200021, 10001, 'MERCHANT', 'BUTTON', 5200020, 'merchant:member:create', '新增成员', NULL, NULL, 10, 'ACTIVE', 0),
-  (5200022, 10001, 'MERCHANT', 'BUTTON', 5200020, 'merchant:member:grant-role', '分配角色', NULL, NULL, 20, 'ACTIVE', 0),
-  (5200031, 10001, 'MERCHANT', 'BUTTON', 5200030, 'merchant:role:create', '新增角色', NULL, NULL, 10, 'ACTIVE', 0),
-  (5200032, 10001, 'MERCHANT', 'BUTTON', 5200030, 'merchant:role:grant', '角色授权', NULL, NULL, 20, 'ACTIVE', 0),
-  (5201011, 10001, 'MERCHANT', 'BUTTON', 5201010, 'merchant:order:view', '查看订单', NULL, NULL, 10, 'ACTIVE', 0),
-  (5201012, 10001, 'MERCHANT', 'BUTTON', 5201010, 'merchant:order:cancel', '取消订单', NULL, NULL, 20, 'ACTIVE', 0),
-  (5201021, 10001, 'MERCHANT', 'BUTTON', 5201020, 'merchant:order:create', '创建草稿', NULL, NULL, 10, 'ACTIVE', 0),
-  (5201022, 10001, 'MERCHANT', 'BUTTON', 5201020, 'merchant:order:edit', '编辑草稿', NULL, NULL, 20, 'ACTIVE', 0),
-  (5201023, 10001, 'MERCHANT', 'BUTTON', 5201020, 'merchant:order:submit', '提交订单', NULL, NULL, 30, 'ACTIVE', 0),
-  (5201024, 10001, 'MERCHANT', 'BUTTON', 5201020, 'merchant:order:quick-create', '快速下单', NULL, NULL, 40, 'ACTIVE', 0)
-ON DUPLICATE KEY UPDATE
-  permission_type = VALUES(permission_type), parent_id = VALUES(parent_id),
-  permission_name = VALUES(permission_name), route_path = VALUES(route_path),
-  http_method = NULL, sort_no = VALUES(sort_no), status = 'ACTIVE', deleted = 0;
-
 INSERT INTO iam_membership_role (membership_id, role_id, tenant_id) VALUES
-  (3000001, 4000001, 0),
-  (3000002, 4000101, 10001)
+  (3000001, 4000001, 0)
 ON DUPLICATE KEY UPDATE tenant_id = VALUES(tenant_id);
 
 -- Full administrator roles receive all phase-one permissions in their application scope.
@@ -209,11 +153,6 @@ SELECT 4000001, id, 0 FROM iam_permission
 WHERE app_code = 'PLATFORM' AND tenant_id = 0 AND permission_type IN ('MENU', 'BUTTON')
 ON DUPLICATE KEY UPDATE tenant_id = VALUES(tenant_id);
 
-INSERT INTO iam_role_permission (role_id, permission_id, tenant_id)
-SELECT 4000101, id, 10001 FROM iam_permission
-WHERE app_code = 'MERCHANT' AND tenant_id = 10001 AND permission_type IN ('MENU', 'BUTTON')
-ON DUPLICATE KEY UPDATE tenant_id = VALUES(tenant_id);
-
 -- Limited platform and merchant operational roles.
 INSERT INTO iam_role_permission (role_id, permission_id, tenant_id)
 SELECT 4000002, id, 0 FROM iam_permission
@@ -229,15 +168,8 @@ SELECT 4000003, id, 0 FROM iam_permission
 WHERE permission_code LIKE 'platform:order%' OR permission_code LIKE 'platform:firstleg%'
 ON DUPLICATE KEY UPDATE tenant_id = VALUES(tenant_id);
 
-INSERT INTO iam_role_permission (role_id, permission_id, tenant_id)
-SELECT 4000102, id, 10001 FROM iam_permission
-WHERE permission_code LIKE 'merchant:order%' OR permission_code IN ('merchant:master-data', 'merchant:warehouse:list')
-ON DUPLICATE KEY UPDATE tenant_id = VALUES(tenant_id);
-
 INSERT INTO iam_data_scope (id, role_id, tenant_id, scope_type, scope_expression) VALUES
   (6000001, 4000001, 0, 'TENANT', NULL),
   (6000002, 4000002, 0, 'TENANT', NULL),
-  (6000003, 4000003, 0, 'TENANT', NULL),
-  (6000101, 4000101, 10001, 'TENANT', NULL),
-  (6000102, 4000102, 10001, 'TENANT', NULL)
+  (6000003, 4000003, 0, 'TENANT', NULL)
 ON DUPLICATE KEY UPDATE tenant_id = VALUES(tenant_id), scope_type = VALUES(scope_type), scope_expression = NULL;
diff --git a/iam/src/main/resources/db/phase1-member-permissions.sql b/iam/src/main/resources/db/phase1-member-permissions.sql
index 8a88a7896..bddb3b44d 100644
--- a/iam/src/main/resources/db/phase1-member-permissions.sql
+++ b/iam/src/main/resources/db/phase1-member-permissions.sql
@@ -17,20 +17,11 @@ DEALLOCATE PREPARE member_no_index_stmt;
 INSERT INTO iam_permission
   (id, tenant_id, app_code, permission_type, parent_id, permission_code, permission_name, sort_no, status, deleted)
 VALUES
-  (5200023, 10001, 'MERCHANT', 'BUTTON', 5200020, 'merchant:member:edit', '编辑成员', 30, 'ACTIVE', 0),
-  (5200024, 10001, 'MERCHANT', 'BUTTON', 5200020, 'merchant:member:status', '启停成员', 40, 'ACTIVE', 0),
-  (5200025, 10001, 'MERCHANT', 'BUTTON', 5200020, 'merchant:member:reset-password', '重置成员密码', 50, 'ACTIVE', 0),
   (5300023, 0, 'MERCHANT', 'BUTTON', 5300020, 'merchant:member:edit', '编辑成员', 30, 'ACTIVE', 0),
   (5300024, 0, 'MERCHANT', 'BUTTON', 5300020, 'merchant:member:status', '启停成员', 40, 'ACTIVE', 0),
   (5300025, 0, 'MERCHANT', 'BUTTON', 5300020, 'merchant:member:reset-password', '重置成员密码', 50, 'ACTIVE', 0)
 ON DUPLICATE KEY UPDATE permission_name = VALUES(permission_name), status = VALUES(status), deleted = 0;
 
-INSERT INTO iam_role_permission (role_id, permission_id, tenant_id)
-SELECT 4000101, id, 10001 FROM iam_permission
-WHERE tenant_id = 10001 AND permission_code IN
-  ('merchant:member:edit', 'merchant:member:status', 'merchant:member:reset-password')
-ON DUPLICATE KEY UPDATE tenant_id = VALUES(tenant_id);
-
 INSERT INTO iam_role_permission (role_id, permission_id, tenant_id)
 SELECT 4000100, id, 0 FROM iam_permission
 WHERE tenant_id = 0 AND permission_code IN
diff --git a/iam/src/main/resources/db/phase1-onboarding.sql b/iam/src/main/resources/db/phase1-onboarding.sql
index a31f31127..27a7da36e 100644
--- a/iam/src/main/resources/db/phase1-onboarding.sql
+++ b/iam/src/main/resources/db/phase1-onboarding.sql
@@ -41,17 +41,34 @@ INSERT INTO iam_role (
 )
 ON DUPLICATE KEY UPDATE status='ACTIVE', deleted=0;
 
--- Clone the一期 merchant menu/button template into the global scope.
+-- Global merchant permission template used by every formally onboarded customer.
 INSERT INTO iam_permission (
   id, tenant_id, app_code, permission_type, parent_id, permission_code,
   permission_name, route_path, http_method, sort_no, status, deleted
 )
-SELECT id + 100000, 0, app_code, permission_type,
-       CASE WHEN parent_id = 0 THEN 0 ELSE parent_id + 100000 END,
-       permission_code, permission_name, route_path, NULL, sort_no, 'ACTIVE', 0
-FROM iam_permission
-WHERE tenant_id = 10001 AND app_code = 'MERCHANT'
-  AND permission_type IN ('MENU', 'BUTTON')
+VALUES
+  (5300000, 0, 'MERCHANT', 'MENU', 0, 'merchant:enterprise', '企业管理', '/enterprise', NULL, 10, 'ACTIVE', 0),
+  (5301000, 0, 'MERCHANT', 'MENU', 0, 'merchant:order', '头程订单', '/first-leg-orders', NULL, 20, 'ACTIVE', 0),
+  (5302000, 0, 'MERCHANT', 'MENU', 0, 'merchant:master-data', '基础资料', '/master-data', NULL, 30, 'ACTIVE', 0),
+  (5300010, 0, 'MERCHANT', 'MENU', 5300000, 'merchant:profile:view', '企业资料', '/enterprise/profile', NULL, 10, 'ACTIVE', 0),
+  (5300020, 0, 'MERCHANT', 'MENU', 5300000, 'merchant:member:list', '企业成员', '/enterprise/members', NULL, 20, 'ACTIVE', 0),
+  (5300030, 0, 'MERCHANT', 'MENU', 5300000, 'merchant:role:list', '角色管理', '/enterprise/roles', NULL, 30, 'ACTIVE', 0),
+  (5301010, 0, 'MERCHANT', 'MENU', 5301000, 'merchant:order:list', '我的订单', '/first-leg-orders/list', NULL, 10, 'ACTIVE', 0),
+  (5301020, 0, 'MERCHANT', 'MENU', 5301000, 'merchant:order:create-page', '新建订单', '/first-leg-orders/create', NULL, 20, 'ACTIVE', 0),
+  (5302010, 0, 'MERCHANT', 'MENU', 5302000, 'merchant:warehouse:list', '收货仓选择', '/master-data/warehouses', NULL, 10, 'ACTIVE', 0),
+  (5302020, 0, 'MERCHANT', 'MENU', 5302000, 'merchant:counterparty:list', '往来单位', '/master-data/counterparties', NULL, 20, 'ACTIVE', 0),
+  (5300011, 0, 'MERCHANT', 'BUTTON', 5300010, 'merchant:profile:edit', '编辑企业资料', NULL, NULL, 10, 'ACTIVE', 0),
+  (5300012, 0, 'MERCHANT', 'BUTTON', 5300010, 'merchant:qualification:upload', '上传企业资质', NULL, NULL, 20, 'ACTIVE', 0),
+  (5300021, 0, 'MERCHANT', 'BUTTON', 5300020, 'merchant:member:create', '新增成员', NULL, NULL, 10, 'ACTIVE', 0),
+  (5300022, 0, 'MERCHANT', 'BUTTON', 5300020, 'merchant:member:grant-role', '分配成员角色', NULL, NULL, 20, 'ACTIVE', 0),
+  (5300031, 0, 'MERCHANT', 'BUTTON', 5300030, 'merchant:role:create', '新增角色', NULL, NULL, 10, 'ACTIVE', 0),
+  (5300032, 0, 'MERCHANT', 'BUTTON', 5300030, 'merchant:role:grant', '角色授权', NULL, NULL, 20, 'ACTIVE', 0),
+  (5301011, 0, 'MERCHANT', 'BUTTON', 5301010, 'merchant:order:view', '查看订单', NULL, NULL, 10, 'ACTIVE', 0),
+  (5301012, 0, 'MERCHANT', 'BUTTON', 5301010, 'merchant:order:cancel', '取消订单', NULL, NULL, 20, 'ACTIVE', 0),
+  (5301021, 0, 'MERCHANT', 'BUTTON', 5301020, 'merchant:order:create', '创建草稿', NULL, NULL, 10, 'ACTIVE', 0),
+  (5301022, 0, 'MERCHANT', 'BUTTON', 5301020, 'merchant:order:edit', '编辑草稿', NULL, NULL, 20, 'ACTIVE', 0),
+  (5301023, 0, 'MERCHANT', 'BUTTON', 5301020, 'merchant:order:submit', '提交订单', NULL, NULL, 30, 'ACTIVE', 0),
+  (5301024, 0, 'MERCHANT', 'BUTTON', 5301020, 'merchant:order:quick-create', '快速下单', NULL, NULL, 40, 'ACTIVE', 0)
 ON DUPLICATE KEY UPDATE
   permission_name=VALUES(permission_name), route_path=VALUES(route_path),
   parent_id=VALUES(parent_id), sort_no=VALUES(sort_no), status='ACTIVE', deleted=0;
diff --git a/iam/src/main/resources/db/rbac-role-management-v2.sql b/iam/src/main/resources/db/rbac-role-management-v2.sql
index 5228b9b71..87f2ea5de 100644
--- a/iam/src/main/resources/db/rbac-role-management-v2.sql
+++ b/iam/src/main/resources/db/rbac-role-management-v2.sql
@@ -19,9 +19,6 @@ VALUES
   (5101013, 0, 'PLATFORM', 'BUTTON', 5101010, 'platform:user:status', '启停用户', 30, 'ACTIVE', 0),
   (5101014, 0, 'PLATFORM', 'BUTTON', 5101010, 'platform:user:reset-password', '重置密码', 40, 'ACTIVE', 0),
   (5101015, 0, 'PLATFORM', 'BUTTON', 5101010, 'platform:user:grant-role', '分配内部用户角色', 50, 'ACTIVE', 0),
-  (5200033, 10001, 'MERCHANT', 'BUTTON', 5200030, 'merchant:role:edit', '编辑角色', 30, 'ACTIVE', 0),
-  (5200034, 10001, 'MERCHANT', 'BUTTON', 5200030, 'merchant:role:status', '启停角色', 40, 'ACTIVE', 0),
-  (5200035, 10001, 'MERCHANT', 'BUTTON', 5200030, 'merchant:role:delete', '删除角色', 50, 'ACTIVE', 0),
   (5300033, 0, 'MERCHANT', 'BUTTON', 5300030, 'merchant:role:edit', '编辑角色', 30, 'ACTIVE', 0),
   (5300034, 0, 'MERCHANT', 'BUTTON', 5300030, 'merchant:role:status', '启停角色', 40, 'ACTIVE', 0),
   (5300035, 0, 'MERCHANT', 'BUTTON', 5300030, 'merchant:role:delete', '删除角色', 50, 'ACTIVE', 0)
@@ -40,12 +37,6 @@ WHERE tenant_id = 0 AND app_code = 'PLATFORM'
                           'platform:user:grant-role')
 ON DUPLICATE KEY UPDATE tenant_id = VALUES(tenant_id);
 
-INSERT INTO iam_role_permission (role_id, permission_id, tenant_id)
-SELECT 4000101, id, 10001 FROM iam_permission
-WHERE tenant_id = 10001 AND app_code = 'MERCHANT'
-  AND permission_code IN ('merchant:role:edit', 'merchant:role:status', 'merchant:role:delete')
-ON DUPLICATE KEY UPDATE tenant_id = VALUES(tenant_id);
-
 INSERT INTO iam_role_permission (role_id, permission_id, tenant_id)
 SELECT 4000100, id, 0 FROM iam_permission
 WHERE tenant_id = 0 AND app_code = 'MERCHANT'
diff --git a/iam/src/main/resources/openapi/iam-v1.yaml b/iam/src/main/resources/openapi/iam-v1.yaml
index 4fa22a7e6..a3d146541 100644
--- a/iam/src/main/resources/openapi/iam-v1.yaml
+++ b/iam/src/main/resources/openapi/iam-v1.yaml
@@ -59,7 +59,7 @@ paths:
     post:
       tags: [Platform Tenant / 平台租户]
       summary: Register enterprise tenant / 创建企业客户草稿
-      description: Create a `PROFILE_REQUIRED` enterprise draft and its OWNER account, returning one-time credentials. Saving the customer does not create a review task. / 创建待完善企业客户草稿及 OWNER 账号并返回一次性凭据，保存客户不会创建审核单。
+      description: Create a `PROFILE_REQUIRED` enterprise draft and its OWNER account, returning one-time credentials. Customer creation succeeds after IAM commits; default dimensions initialize reliably in background and are exposed as `PENDING/READY/FAILED`. / 创建待完善企业客户草稿及 OWNER 账号并返回一次性凭据；IAM 提交即代表客户创建成功，默认尺寸在后台可靠初始化并显式返回 PENDING/READY/FAILED。
       requestBody:
         required: true
         content:
@@ -123,6 +123,38 @@ paths:
                 $ref: '#/components/schemas/PlatformCustomerMembersApiResponse'
         '403': {$ref: '#/components/responses/Forbidden'}
         '404': {$ref: '#/components/responses/NotFound'}
+  /api/platform/v1/iam/tenants/{tenantId}/dimension-initialization:
+    parameters:
+      - {$ref: '#/components/parameters/TenantId'}
+    get:
+      tags: [Platform Tenant / 平台租户]
+      summary: 查询客户默认尺寸初始化诊断
+      description: 返回任务状态、尝试次数、下次重试时间和最后失败原因；不会把远端失败转换为空数据或成功。
+      responses:
+        '200':
+          description: 初始化诊断查询成功
+          content:
+            application/json:
+              schema:
+                allOf:
+                  - {$ref: '#/components/schemas/ApiResponse'}
+                  - type: object
+                    properties:
+                      data: {$ref: '#/components/schemas/CustomerDimensionInitializationStatus'}
+        '403': {$ref: '#/components/responses/Forbidden'}
+        '404': {$ref: '#/components/responses/NotFound'}
+  /api/platform/v1/iam/tenants/{tenantId}/dimension-initialization/retry:
+    parameters:
+      - {$ref: '#/components/parameters/TenantId'}
+    post:
+      tags: [Platform Tenant / 平台租户]
+      summary: 人工重试失败的客户默认尺寸初始化
+      description: 只允许 FAILED 任务重新进入 PENDING；稳定 initializationKey 不变。
+      responses:
+        '200': {$ref: '#/components/responses/TenantSuccess'}
+        '403': {$ref: '#/components/responses/Forbidden'}
+        '404': {$ref: '#/components/responses/NotFound'}
+        '409': {$ref: '#/components/responses/Conflict'}
   /api/platform/v1/iam/tenants/{tenantId}/submit-review:
     parameters:
       - {$ref: '#/components/parameters/TenantId'}
@@ -1085,12 +1117,13 @@ components:
                 pages: {type: integer, minimum: 0}
     TenantResponse:
       type: object
-      required: [id, tenantCode, tenantName, status, servicePackage]
+      required: [id, tenantCode, tenantName, status, dimensionInitializationStatus, servicePackage]
       properties:
         id: {type: string, pattern: '^\d+$', example: '190000000000000001'}
         tenantCode: {type: string}
         tenantName: {type: string}
         status: {type: string, enum: [PROFILE_REQUIRED, PENDING, ACTIVE, REJECTED, DISABLED, ARCHIVED]}
+        dimensionInitializationStatus: {type: string, enum: [PENDING, READY, FAILED], description: 客户默认尺寸初始化状态；未 READY 时依赖该配置的业务失败关闭}
         legalName: {type: string}
         legalRepresentative: {type: string, maxLength: 64}
         unifiedSocialCreditCode: {type: string}
@@ -1109,6 +1142,17 @@ components:
         internalRemark: {type: string, maxLength: 1000, description: 仅平台端可见}
         createdAt: {type: string, format: date-time, description: 入驻时间}
         approvedAt: {type: string, format: date-time, description: 审批通过时间}
+    CustomerDimensionInitializationStatus:
+      type: object
+      required: [tenantId, status, attemptCount, nextRetryAt, updatedAt]
+      properties:
+        tenantId: {type: string, pattern: '^\d+$'}
+        status: {type: string, enum: [PENDING, SENDING, READY, FAILED, CANCELLED]}
+        attemptCount: {type: integer, minimum: 0}
+        nextRetryAt: {type: string, format: date-time}
+        lastErrorCode: {type: string, nullable: true}
+        lastErrorMessage: {type: string, nullable: true, description: 已清洗且截断的最后失败诊断}
+        updatedAt: {type: string, format: date-time}
     FinanceCustomerSummary:
       type: object
       required: [id, tenantCode, tenantName, status]
diff --git a/iam/src/test/java/com/baiyue/iam/client/SecurityEventBridgeClientContractTest.java b/iam/src/test/java/com/baiyue/iam/client/SecurityEventBridgeClientContractTest.java
new file mode 100644
index 000000000..92692f92d
--- /dev/null
+++ b/iam/src/test/java/com/baiyue/iam/client/SecurityEventBridgeClientContractTest.java
@@ -0,0 +1,35 @@
+package com.baiyue.iam.client;
+
+import org.junit.jupiter.api.Test;
+import org.springframework.cloud.openfeign.FeignClient;
+
+import java.nio.file.Files;
+import java.nio.file.Path;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+class SecurityEventBridgeClientContractTest {
+    private static final Path REPOSITORY_ROOT = Path.of("..").toAbsolutePath().normalize();
+
+    @Test
+    void feignUsesTheExplicitOverseasBridgePropertyInsteadOfSameNameDiscovery() {
+        FeignClient annotation = SecurityEventBridgeClient.class.getAnnotation(FeignClient.class);
+
+        assertThat(annotation.name()).isEqualTo("event-bridge-service");
+        assertThat(annotation.url()).isEqualTo("${baiyue.security-event.event-bridge-url:}");
+    }
+
+    @Test
+    void cnIamConfigurationTargetsTheOverseasBridgeNetworkAlias() throws Exception {
+        String application = Files.readString(REPOSITORY_ROOT.resolve("iam/src/main/resources/application.yml"));
+        String nacos = Files.readString(REPOSITORY_ROOT.resolve("config/nacos/cn/iam-service.yml"));
+        String compose = Files.readString(REPOSITORY_ROOT.resolve("deploy/docker-compose.yml"));
+
+        assertThat(application).contains(
+            "event-bridge-url: ${SECURITY_EVENT_BRIDGE_URL:http://event-bridge-overseas:9312}");
+        assertThat(nacos).contains(
+            "event-bridge-url: ${SECURITY_EVENT_BRIDGE_URL:http://event-bridge-overseas:9312}");
+        assertThat(compose).contains(
+            "SECURITY_EVENT_BRIDGE_URL: ${SECURITY_EVENT_BRIDGE_URL:-http://event-bridge-overseas:9312}");
+    }
+}
diff --git a/iam/src/test/java/com/baiyue/iam/repository/AdminPrototypeMenuPermissionSqlContractTest.java b/iam/src/test/java/com/baiyue/iam/repository/AdminPrototypeMenuPermissionSqlContractTest.java
index 2190fbe70..f8cd21e76 100644
--- a/iam/src/test/java/com/baiyue/iam/repository/AdminPrototypeMenuPermissionSqlContractTest.java
+++ b/iam/src/test/java/com/baiyue/iam/repository/AdminPrototypeMenuPermissionSqlContractTest.java
@@ -31,6 +31,9 @@ class AdminPrototypeMenuPermissionSqlContractTest {
             assertThat(sql).contains("(" + (5105050 + index) + ",0,'PLATFORM','BUTTON'," + (5105040 + index) + ",'" + FINANCE_EXPORTS[index] + "'");
         }
         assertThat(sql)
+            .contains("(5305000,0,'MERCHANT','MENU',5300000,'merchant:finance:statement'")
+            .contains("(5305010,0,'MERCHANT','BUTTON',5305000,'merchant:finance:statement:list'")
+            .contains("(5305011,0,'MERCHANT','BUTTON',5305000,'merchant:finance:statement:view'")
             .contains("(5305012,0,'MERCHANT','BUTTON',5305000,'merchant:finance:statement:confirm'")
             .contains("r.tenant_id=0 AND r.app_code='MERCHANT' AND r.role_code='MERCHANT_OWNER'")
             .contains("'platform:finance:fee-source:review' code, 5105041 parent_id")
@@ -60,8 +63,8 @@ class AdminPrototypeMenuPermissionSqlContractTest {
             .contains("permission_code LIKE 'platform:finance:%' AND status='ACTIVE' AND deleted=0) <> 32")
             .contains("(p.permission_code='platform:finance' OR p.permission_code LIKE 'platform:finance:%')) <> 33")
             .contains("Finance 导出和下载中心授权不完整")
-            .contains("merchant:finance:statement:confirm")
-            .contains("客户全局管理员缺少对账单确认权限")
+            .contains("客户全局 Finance 权限模板不完整")
+            .contains("客户全局管理员 Finance 模板授权不完整")
             .satisfies(content -> assertThat(content.indexOf("(5105050,0,'PLATFORM','BUTTON'"))
                 .isLessThan(content.indexOf("CREATE PROCEDURE assert_finance_permissions()")));
     }
diff --git a/iam/src/test/java/com/baiyue/iam/repository/CustomerDimensionInitializationSqlContractTest.java b/iam/src/test/java/com/baiyue/iam/repository/CustomerDimensionInitializationSqlContractTest.java
new file mode 100644
index 000000000..0c22f9ecf
--- /dev/null
+++ b/iam/src/test/java/com/baiyue/iam/repository/CustomerDimensionInitializationSqlContractTest.java
@@ -0,0 +1,64 @@
+package com.baiyue.iam.repository;
+
+import org.junit.jupiter.api.Test;
+import org.springframework.core.io.ClassPathResource;
+
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.Path;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+class CustomerDimensionInitializationSqlContractTest {
+    @Test
+    void latestIamSqlContainsStatusAndDurableTask() throws Exception {
+        String sql = new ClassPathResource("db/iam.sql").getContentAsString(StandardCharsets.UTF_8);
+        assertContract(sql);
+    }
+
+    @Test
+    void idempotentStandaloneAndUnifiedSqlContainTheSameTaskContract() throws Exception {
+        String standalone = new ClassPathResource("db/customer-dimension-initialization-task.sql")
+            .getContentAsString(StandardCharsets.UTF_8);
+        Path direct = Path.of("deploy", "sql", "头程数据库统一增量-MySQL8.sql");
+        Path unifiedPath = Files.exists(direct) ? direct
+            : Path.of("..", "deploy", "sql", "头程数据库统一增量-MySQL8.sql");
+        String unified = Files.readString(unifiedPath, StandardCharsets.UTF_8);
+
+        assertContract(standalone);
+        assertContract(unified);
+        assertThat(standalone).contains("information_schema.columns", "CREATE TABLE IF NOT EXISTS");
+        assertThat(unified).contains("information_schema.columns", "CREATE TABLE IF NOT EXISTS");
+    }
+
+    @Test
+    void schedulerRetryBudgetHasSafeOverridableDefaultsInAllDomesticProfiles() throws Exception {
+        String application = new ClassPathResource("application.yml").getContentAsString(StandardCharsets.UTF_8);
+        assertSchedulerConfig(application);
+        for (String profile : new String[] {"local", "cn"}) {
+            Path direct = Path.of("config", "nacos", profile, "iam-service.yml");
+            Path config = Files.exists(direct) ? direct
+                : Path.of("..", "config", "nacos", profile, "iam-service.yml");
+            assertSchedulerConfig(Files.readString(config, StandardCharsets.UTF_8));
+        }
+    }
+
+    private static void assertContract(String sql) {
+        assertThat(sql)
+            .contains("dimension_initialization_status")
+            .contains("iam_customer_dimension_initialization_task")
+            .contains("initialization_key")
+            .contains("attempt_count")
+            .contains("next_retry_at")
+            .contains("lease_until")
+            .contains("last_error_code")
+            .contains("task_version");
+    }
+
+    private static void assertSchedulerConfig(String yaml) {
+        assertThat(yaml)
+            .contains("customer-dimension-initialization:")
+            .contains("${CUSTOMER_DIMENSION_INITIALIZATION_FIXED_DELAY_MS:5000}")
+            .contains("${CUSTOMER_DIMENSION_INITIALIZATION_MAX_ATTEMPTS:12}");
+    }
+}
diff --git a/iam/src/test/java/com/baiyue/iam/repository/InitialIdentitySeedSqlContractTest.java b/iam/src/test/java/com/baiyue/iam/repository/InitialIdentitySeedSqlContractTest.java
index 86f26ec04..64008a223 100644
--- a/iam/src/test/java/com/baiyue/iam/repository/InitialIdentitySeedSqlContractTest.java
+++ b/iam/src/test/java/com/baiyue/iam/repository/InitialIdentitySeedSqlContractTest.java
@@ -11,25 +11,42 @@ import static org.assertj.core.api.Assertions.assertThat;
 
 class InitialIdentitySeedSqlContractTest {
     @Test
-    void initializesPlatformAndItTestCustomerIdentitiesWithStableIds() throws Exception {
-        assertIdentitySeed(new ClassPathResource("db/phase1-admin-rbac.sql")
-            .getContentAsString(StandardCharsets.UTF_8));
-        assertIdentitySeed(Files.readString(unifiedSql(), StandardCharsets.UTF_8));
+    void initializesOnlyPlatformIdentityAndGlobalMerchantTemplates() throws Exception {
+        String identitySeed = new ClassPathResource("db/phase1-admin-rbac.sql")
+            .getContentAsString(StandardCharsets.UTF_8);
+        String templateSeed = new ClassPathResource("db/phase1-onboarding.sql")
+            .getContentAsString(StandardCharsets.UTF_8);
+        String unified = Files.readString(unifiedSql(), StandardCharsets.UTF_8);
+        assertPlatformIdentitySeed(identitySeed);
+        assertPlatformIdentitySeed(unified);
+        assertGlobalMerchantTemplate(templateSeed);
+        assertGlobalMerchantTemplate(unified);
     }
 
-    private static void assertIdentitySeed(String sql) {
+    private static void assertPlatformIdentitySeed(String sql) {
         assertThat(sql)
             .contains("(0, 'PLATFORM', '虫虫出海平台'")
-            .contains("(10001, 'IT_TEST', 'IT 测试客户'")
             .contains("(2000001, 1000001, 'INTERNAL', '平台系统管理员'")
-            .contains("(2000002, 1000002, 'ENTERPRISE', 'IT 测试客户管理员'")
             .contains("(3000001, 0, 2000001, 'EMPLOYEE'")
-            .contains("(3000002, 10001, 2000002, 'OWNER'")
             .contains("tenant_code = VALUES(tenant_code)")
+            .doesNotContain("merchant_admin")
+            .doesNotContain("IT_TEST")
+            .doesNotContain("(10001,")
+            .doesNotContain("(2000002,")
+            .doesNotContain("(3000002,")
+            .doesNotContain("4000101, 10001")
             .doesNotContain("PHASE1_DEMO")
             .doesNotContain("一期演示企业");
     }
 
+    private static void assertGlobalMerchantTemplate(String sql) {
+        assertThat(sql)
+            .contains("4000100, 0, 'MERCHANT', 'MERCHANT_OWNER'")
+            .contains("5300000, 0, 'MERCHANT', 'MENU'")
+            .contains("5301024, 0, 'MERCHANT', 'BUTTON'")
+            .doesNotContain("WHERE tenant_id = 10001 AND app_code = 'MERCHANT'");
+    }
+
     private static Path unifiedSql() {
         Path path = Path.of("deploy", "sql", "头程数据库统一增量-MySQL8.sql");
         return Files.exists(path) ? path : Path.of("..", "deploy", "sql", "头程数据库统一增量-MySQL8.sql");
diff --git a/iam/src/test/java/com/baiyue/iam/service/CustomerDimensionInitializationRelayTest.java b/iam/src/test/java/com/baiyue/iam/service/CustomerDimensionInitializationRelayTest.java
new file mode 100644
index 000000000..bdd692767
--- /dev/null
+++ b/iam/src/test/java/com/baiyue/iam/service/CustomerDimensionInitializationRelayTest.java
@@ -0,0 +1,105 @@
+package com.baiyue.iam.service;
+
+import com.baiyue.common.core.api.ApiResponse;
+import com.baiyue.common.core.api.ResultCode;
+import com.baiyue.iam.client.CustomerDimensionRuleClient;
+import com.baiyue.iam.model.CustomerDimensionInitializationTask;
+import com.baiyue.iam.repository.CustomerDimensionInitializationRepository;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.ArgumentCaptor;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+import org.springframework.test.util.ReflectionTestUtils;
+
+import java.time.LocalDateTime;
+
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.anyLong;
+import static org.mockito.ArgumentMatchers.anyInt;
+import static org.mockito.ArgumentMatchers.anyString;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+@ExtendWith(MockitoExtension.class)
+class CustomerDimensionInitializationRelayTest {
+    @Mock private CustomerDimensionInitializationRepository repository;
+    @Mock private CustomerDimensionRuleClient client;
+    @InjectMocks private CustomerDimensionInitializationRelay relay;
+
+    @BeforeEach
+    void configure() {
+        ReflectionTestUtils.setField(relay, "internalToken", "internal-token");
+        ReflectionTestUtils.setField(relay, "maxAttempts", 12);
+    }
+
+    @Test
+    void successfulBackgroundInitializationMarksTenantReady() {
+        CustomerDimensionInitializationTask task = task("INITIALIZE", 0);
+        when(repository.claim(anyLong(), anyString(), any(LocalDateTime.class))).thenReturn(task);
+        when(client.initialize(anyString(), any())).thenReturn(ApiResponse.success(
+            new CustomerDimensionRuleClient.InitializationResponse(91L, true)));
+
+        relay.deliver(10001L);
+
+        verify(repository).markReady(task, workerId(), 91L);
+        verify(repository, never()).recordFailure(any(), anyString(), anyInt(), any(), anyString(),
+            anyString(), any(Boolean.class));
+    }
+
+    @Test
+    void transientFailureStaysPendingWithDiagnosticAndBackoff() {
+        CustomerDimensionInitializationTask task = task("INITIALIZE", 0);
+        when(repository.claim(anyLong(), anyString(), any(LocalDateTime.class))).thenReturn(task);
+        when(client.initialize(anyString(), any())).thenThrow(new RuntimeException("read timeout"));
+
+        relay.deliver(10001L);
+
+        ArgumentCaptor<Boolean> exhausted = ArgumentCaptor.forClass(Boolean.class);
+        verify(repository).recordFailure(any(), anyString(), anyInt(), any(), anyString(),
+            anyString(), exhausted.capture());
+        assertFalse(exhausted.getValue());
+    }
+
+    @Test
+    void permanentRemoteRejectionBecomesFailedWithoutDefaultSuccess() {
+        CustomerDimensionInitializationTask task = task("INITIALIZE", 0);
+        when(repository.claim(anyLong(), anyString(), any(LocalDateTime.class))).thenReturn(task);
+        when(client.initialize(anyString(), any())).thenReturn(ApiResponse.failure(
+            ResultCode.CONFLICT, "invalid customer", "request-1", "trace-1"));
+
+        relay.deliver(10001L);
+
+        ArgumentCaptor<Boolean> exhausted = ArgumentCaptor.forClass(Boolean.class);
+        verify(repository).recordFailure(any(), anyString(), anyInt(), any(), anyString(),
+            anyString(), exhausted.capture());
+        assertTrue(exhausted.getValue());
+        verify(repository, never()).markReady(any(), anyString(), any());
+    }
+
+    @Test
+    void compensationIsAlsoDurableAndUsesTheStableKey() {
+        CustomerDimensionInitializationTask task = task("COMPENSATE", 0);
+        when(repository.claim(anyLong(), anyString(), any(LocalDateTime.class))).thenReturn(task);
+        when(client.compensate("internal-token", 10001L, "iam-customer-create:10001"))
+            .thenReturn(ApiResponse.success(null));
+
+        relay.deliver(10001L);
+
+        verify(repository).markCancelled(task, workerId());
+    }
+
+    private CustomerDimensionInitializationTask task(String action, int attempts) {
+        return new CustomerDimensionInitializationTask(10001L, 9001L, "iam-customer-create:10001",
+            action, "SENDING", attempts, 3);
+    }
+
+    private String workerId() {
+        return (String) ReflectionTestUtils.getField(relay, "workerId");
+    }
+}
diff --git a/iam/src/test/java/com/baiyue/iam/service/CustomerDimensionRuleInitializationServiceTest.java b/iam/src/test/java/com/baiyue/iam/service/CustomerDimensionRuleInitializationServiceTest.java
index 459a72fab..b56e9c63d 100644
--- a/iam/src/test/java/com/baiyue/iam/service/CustomerDimensionRuleInitializationServiceTest.java
+++ b/iam/src/test/java/com/baiyue/iam/service/CustomerDimensionRuleInitializationServiceTest.java
@@ -1,138 +1,61 @@
 package com.baiyue.iam.service;
 
-import com.baiyue.common.core.api.ApiResponse;
 import com.baiyue.common.core.api.ResultCode;
 import com.baiyue.common.core.exception.BizException;
-import com.baiyue.iam.client.CustomerDimensionRuleClient;
-import jakarta.annotation.Resource;
-import org.junit.jupiter.api.AfterEach;
+import com.baiyue.iam.repository.CustomerDimensionInitializationRepository;
 import org.junit.jupiter.api.Test;
-import org.mockito.ArgumentCaptor;
-import org.springframework.boot.test.mock.mockito.MockBean;
-import org.springframework.test.context.TestPropertySource;
-import org.springframework.test.context.junit.jupiter.SpringJUnitConfig;
-import org.springframework.transaction.support.TransactionSynchronization;
-import org.springframework.transaction.support.TransactionSynchronizationManager;
-
-import java.util.List;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertFalse;
 import static org.junit.jupiter.api.Assertions.assertThrows;
-import static org.junit.jupiter.api.Assertions.assertTrue;
-import static org.mockito.ArgumentMatchers.any;
-import static org.mockito.ArgumentMatchers.anyLong;
-import static org.mockito.ArgumentMatchers.anyString;
-import static org.mockito.Mockito.never;
-import static org.mockito.Mockito.times;
 import static org.mockito.Mockito.verify;
 import static org.mockito.Mockito.when;
 
-@SpringJUnitConfig(CustomerDimensionRuleInitializationService.class)
-@TestPropertySource(properties = "baiyue.security.internal-service-token=internal-token")
+@ExtendWith(MockitoExtension.class)
 class CustomerDimensionRuleInitializationServiceTest {
-    @MockBean private CustomerDimensionRuleClient client;
-    @Resource private CustomerDimensionRuleInitializationService service;
-
-    @AfterEach
-    void clearSynchronization() {
-        if (TransactionSynchronizationManager.isSynchronizationActive()) {
-            TransactionSynchronizationManager.clearSynchronization();
-        }
-    }
+    @Mock private CustomerDimensionInitializationRepository repository;
+    @InjectMocks private CustomerDimensionRuleInitializationService service;
 
     @Test
-    void retriesOneAtomicFourBoxDefaultsCallWithAStableKey() {
-        when(client.initialize(anyString(), any()))
-                .thenThrow(new RuntimeException("timeout"))
-                .thenReturn(ApiResponse.failure(ResultCode.SERVICE_UNAVAILABLE,
-                        "temporarily unavailable", "request-1", "trace-1"))
-                .thenReturn(ApiResponse.success(new CustomerDimensionRuleClient.InitializationResponse(91L, false)));
-
+    void customerCreationOnlyPersistsBackgroundIntentWithStableKey() {
         var result = service.initialize(10001L, 9001L);
 
         assertFalse(result.created());
-        ArgumentCaptor<CustomerDimensionRuleClient.InitializationRequest> requests =
-                ArgumentCaptor.forClass(CustomerDimensionRuleClient.InitializationRequest.class);
-        verify(client, times(3)).initialize(anyString(), requests.capture());
-        assertEquals(List.of("iam-customer-create:10001", "iam-customer-create:10001",
-                "iam-customer-create:10001"),
-                requests.getAllValues().stream().map(
-                        CustomerDimensionRuleClient.InitializationRequest::initializationKey).toList());
-        assertEquals(List.of(9001L, 9001L, 9001L), requests.getAllValues().stream()
-                .map(CustomerDimensionRuleClient.InitializationRequest::operatorId).toList());
-        assertEquals(List.of(10001L, 10001L, 10001L), requests.getAllValues().stream()
-                .map(CustomerDimensionRuleClient.InitializationRequest::tenantId).toList());
+        assertEquals("PENDING", result.status());
+        assertEquals("iam-customer-create:10001", result.initializationKey());
+        verify(repository).enqueue(10001L, 9001L, "iam-customer-create:10001");
     }
 
     @Test
-    void reportsServiceUnavailableWhenFourBoxDefaultsFailThreeTimesAndTriesCompensation() {
-        when(client.initialize(anyString(), any())).thenThrow(new RuntimeException("timeout"));
-        when(client.compensate(anyString(), anyLong(), anyString())).thenReturn(ApiResponse.success(null));
-
-        BizException failure = assertThrows(BizException.class, () -> service.initialize(10001L, 9001L));
-
-        assertEquals(ResultCode.SERVICE_UNAVAILABLE, failure.getResultCode());
-        verify(client, times(3)).initialize(anyString(), any());
-        verify(client).compensate("internal-token", 10001L, "iam-customer-create:10001");
-    }
-
-    @Test
-    void localRollbackCompensatesFourBoxDefaultsCreatedByThisRegistration() {
-        when(client.initialize(anyString(), any()))
-                .thenReturn(ApiResponse.success(new CustomerDimensionRuleClient.InitializationResponse(91L, true)));
-        when(client.compensate(anyString(), anyLong(), anyString())).thenReturn(ApiResponse.success(null));
-        TransactionSynchronizationManager.initSynchronization();
-
-        var result = service.initialize(10001L, 9001L);
-        List<TransactionSynchronization> synchronizations =
-                TransactionSynchronizationManager.getSynchronizations();
-        TransactionSynchronizationManager.clearSynchronization();
-        synchronizations.forEach(value -> value.afterCompletion(TransactionSynchronization.STATUS_ROLLED_BACK));
-
-        assertTrue(result.created());
-        verify(client).compensate("internal-token", 10001L, "iam-customer-create:10001");
-    }
-
-    @Test
-    void localRollbackKeepsFourBoxDefaultsThatAlreadyExisted() {
-        when(client.initialize(anyString(), any()))
-                .thenReturn(ApiResponse.success(new CustomerDimensionRuleClient.InitializationResponse(91L, false)));
-        TransactionSynchronizationManager.initSynchronization();
-
-        service.initialize(10001L, 9001L);
-        List<TransactionSynchronization> synchronizations =
-                TransactionSynchronizationManager.getSynchronizations();
-        TransactionSynchronizationManager.clearSynchronization();
-        synchronizations.forEach(value -> value.afterCompletion(TransactionSynchronization.STATUS_ROLLED_BACK));
-
-        verify(client, never()).compensate(anyString(), anyLong(), anyString());
-    }
-
-    @Test
-    void responseTimeoutThenIdempotentFourBoxSuccessStillCompensatesOnLocalRollback() {
-        when(client.initialize(anyString(), any()))
-                .thenThrow(new RuntimeException("response timeout"))
-                .thenReturn(ApiResponse.success(new CustomerDimensionRuleClient.InitializationResponse(91L, true)));
-        when(client.compensate(anyString(), anyLong(), anyString())).thenReturn(ApiResponse.success(null));
-        TransactionSynchronizationManager.initSynchronization();
-
-        service.initialize(10001L, 9001L);
-        List<TransactionSynchronization> synchronizations =
-                TransactionSynchronizationManager.getSynchronizations();
-        TransactionSynchronizationManager.clearSynchronization();
-        synchronizations.forEach(value -> value.afterCompletion(TransactionSynchronization.STATUS_ROLLED_BACK));
-
-        verify(client, times(2)).initialize(anyString(), any());
-        verify(client).compensate("internal-token", 10001L, "iam-customer-create:10001");
-    }
-
-    @Test
-    void committedClientRegistrationCanBeCompensatedWithItsDeterministicKey() {
-        when(client.compensate(anyString(), anyLong(), anyString())).thenReturn(ApiResponse.success(null));
-
+    void committedRegistrationCompensationUsesTheSameStableKey() {
         service.compensateRegistration(10001L);
+        verify(repository).requestCompensation(10001L, 0L, "iam-customer-create:10001");
+    }
 
-        verify(client).compensate("internal-token", 10001L, "iam-customer-create:10001");
+    @Test
+    void failedTaskCanBeManuallyRequeued() {
+        when(repository.manualRetry(10001L)).thenReturn(true);
+        service.retry(10001L);
+        verify(repository).manualRetry(10001L);
+    }
+
+    @Test
+    void nonFailedTaskCannotBeSilentlyRequeued() {
+        when(repository.manualRetry(10001L)).thenReturn(false);
+        BizException failure = assertThrows(BizException.class, () -> service.retry(10001L));
+        assertEquals(ResultCode.CONFLICT, failure.getResultCode());
+    }
+
+    @Test
+    void dimensionsDependentFlowFailsClosedUntilReady() {
+        BizException pending = assertThrows(BizException.class, () -> service.requireReady("PENDING"));
+        BizException failed = assertThrows(BizException.class, () -> service.requireReady("FAILED"));
+        assertEquals(ResultCode.CONFLICT, pending.getResultCode());
+        assertEquals(ResultCode.CONFLICT, failed.getResultCode());
+        service.requireReady("READY");
     }
 }
diff --git a/iam/src/test/java/com/baiyue/iam/service/MemberServiceTest.java b/iam/src/test/java/com/baiyue/iam/service/MemberServiceTest.java
index e653c4c01..b69d85274 100644
--- a/iam/src/test/java/com/baiyue/iam/service/MemberServiceTest.java
+++ b/iam/src/test/java/com/baiyue/iam/service/MemberServiceTest.java
@@ -14,6 +14,7 @@ import com.baiyue.iam.repository.MemberRepository;
 import com.baiyue.iam.repository.TenantRepository;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
+import org.mockito.ArgumentCaptor;
 import jakarta.annotation.Resource;
 import org.springframework.boot.test.mock.mockito.MockBean;
 import org.springframework.test.context.TestPropertySource;
@@ -135,6 +136,27 @@ class MemberServiceTest {
         verify(repository, never()).insert(any());
     }
 
+    @Test void createPublishesActiveUserAndInitialAuthorizationAfterRoleAssignment() {
+        IamRole role = activeMerchantRole(50L, 100L);
+        when(roleMapper.selectById(50L)).thenReturn(role);
+        when(auth.create(eq("internal-token"), any())).thenReturn(ApiResponse.success(null));
+        when(auth.summary(eq("internal-token"), anyLong())).thenAnswer(invocation -> ApiResponse.success(
+                new AuthAccountClient.AccountSummary(invocation.getArgument(1), "member02", "成员", "ACTIVE")));
+        when(repository.findRoleIds(eq(100L), anyLong())).thenReturn(List.of(50L));
+        CreateMemberRequest request = new CreateMemberRequest("member02", "Password1", "成员",
+                null, null, "EMPLOYEE", "M-002", List.of(50L));
+
+        service.create(100L, request, Set.of("merchant:member:create", "merchant:member:grant-role"));
+
+        ArgumentCaptor<AuthAccountClient.CreateAccountRequest> account =
+                ArgumentCaptor.forClass(AuthAccountClient.CreateAccountRequest.class);
+        verify(auth).create(eq("internal-token"), account.capture());
+        long authUserId = account.getValue().accountId();
+        verify(repository).replaceRoles(eq(100L), anyLong(), eq(List.of(50L)));
+        verify(securityEvents).userStatus(authUserId, 100L, "MERCHANT", "ACTIVE");
+        verify(securityEvents).permissionChanged(authUserId, 100L, "MERCHANT", "INITIAL_AUTHORIZATION");
+    }
+
     @Test void shouldHandleCase08() {
         IamRole role = activeMerchantRole(50L, 100L);
         when(roleMapper.selectById(50L)).thenReturn(role);
diff --git a/iam/src/test/java/com/baiyue/iam/service/MerchantOnboardingServiceTest.java b/iam/src/test/java/com/baiyue/iam/service/MerchantOnboardingServiceTest.java
index ade730ea0..2b48686ef 100644
--- a/iam/src/test/java/com/baiyue/iam/service/MerchantOnboardingServiceTest.java
+++ b/iam/src/test/java/com/baiyue/iam/service/MerchantOnboardingServiceTest.java
@@ -41,6 +41,7 @@ class MerchantOnboardingServiceTest {
     @MockBean private IamTenantReviewMapper reviews;
     @MockBean private CustomerDimensionRuleInitializationService dimensionRuleInitialization;
     @MockBean private OverseasStorageFeeInitializationService overseasStorageFeeInitialization;
+    @MockBean private SecurityEventOutboxService securityEvents;
     @Resource private MerchantOnboardingService service;
     @Test
     void clientRegistrationCreatesOwnerAndAssignsGlobalMerchantOwnerRole() {
@@ -67,8 +68,14 @@ class MerchantOnboardingServiceTest {
         verify(membershipRoles).insert(roleGrant.capture());
         verify(dimensionRuleInitialization).initialize(result.tenantId(), 9001L);
         verify(overseasStorageFeeInitialization).initialize(result.tenantId(), 9001L, "测试企业");
+        verify(securityEvents).tenantStatus(result.tenantId(), "PROFILE_REQUIRED");
+        verify(securityEvents).userStatus(9001L, result.tenantId(), "MERCHANT", "ACTIVE");
+        verify(securityEvents).permissionChanged(9001L, result.tenantId(), "MERCHANT",
+                "INITIAL_AUTHORIZATION");
 
         assertEquals("PROFILE_REQUIRED", result.tenantStatus());
+        assertEquals("PENDING", result.dimensionInitializationStatus());
+        assertEquals("PENDING", tenant.getValue().getDimensionInitializationStatus());
         assertEquals(result.tenantId(), tenant.getValue().getId());
         assertEquals("测试企业", tenant.getValue().getLegalName());
         assertEquals("张三", tenant.getValue().getLegalRepresentative());
@@ -117,7 +124,7 @@ class MerchantOnboardingServiceTest {
     }
 
     @Test
-    void clientRegistrationFailsWhenFourDefaultBoxDimensionsCannotBeInitialized() {
+    void clientRegistrationFailsWhenDurableInitializationIntentCannotBePersisted() {
         IamRole ownerRole = new IamRole();
         ownerRole.setId(4000100L);
         ownerRole.setTenantId(0L);
diff --git a/iam/src/test/java/com/baiyue/iam/service/PlatformInternalUserServiceTest.java b/iam/src/test/java/com/baiyue/iam/service/PlatformInternalUserServiceTest.java
index adaccd1b1..6e8da47c5 100644
--- a/iam/src/test/java/com/baiyue/iam/service/PlatformInternalUserServiceTest.java
+++ b/iam/src/test/java/com/baiyue/iam/service/PlatformInternalUserServiceTest.java
@@ -85,6 +85,39 @@ class PlatformInternalUserServiceTest {
         verify(repository).insertUser(any(IamUser.class));
         verify(repository).insert(any(IamMembership.class));
         verify(repository).replaceRoles(eq(0L), anyLong(), eq(List.of(40L)));
+        long authUserId = captor.getValue().accountId();
+        verify(securityEvents).userStatus(authUserId, 0L, "PLATFORM", "ACTIVE");
+        verify(securityEvents).permissionChanged(authUserId, 0L, "PLATFORM", "INITIAL_AUTHORIZATION");
+    }
+
+    @Test
+    void linkingExistingAccountPublishesInitialProjectionOnlyForNewMembership() {
+        IamRole role = new IamRole();
+        role.setId(40L); role.setTenantId(0L); role.setAppCode("PLATFORM"); role.setStatus("ACTIVE");
+        when(roleMapper.selectById(40L)).thenReturn(role);
+        when(repository.findUserByAuthId(10L)).thenReturn(user);
+        when(repository.findByTenantAndAuthUser(0L, 10L)).thenReturn(null);
+        CreateInternalUserRequest request = new CreateInternalUserRequest(10L, null, "平台运营",
+                "13800138000", null, null, null, "PLATFORM-LINK", List.of(40L));
+
+        service.create(request);
+
+        verify(repository).replaceRoles(eq(0L), anyLong(), eq(List.of(40L)));
+        verify(securityEvents).userStatus(10L, 0L, "PLATFORM", "ACTIVE");
+        verify(securityEvents).permissionChanged(10L, 0L, "PLATFORM", "INITIAL_AUTHORIZATION");
+        verify(auth, never()).create(anyString(), any());
+    }
+
+    @Test
+    void relinkingExistingMembershipDoesNotDuplicateInitialProjection() {
+        when(repository.findByTenantAndAuthUser(0L, 10L)).thenReturn(membership);
+        CreateInternalUserRequest request = new CreateInternalUserRequest(10L, null, "平台运营",
+                "13800138000", null, null, null, "PLATFORM-30", List.of());
+
+        service.create(request);
+
+        verifyNoInteractions(securityEvents);
+        verify(repository, never()).replaceRoles(anyLong(), anyLong(), anyList());
     }
 
     @Test
diff --git a/iam/src/test/java/com/baiyue/iam/service/PlatformUserManagementServiceTest.java b/iam/src/test/java/com/baiyue/iam/service/PlatformUserManagementServiceTest.java
index 4dd7ddfb6..fb4949914 100644
--- a/iam/src/test/java/com/baiyue/iam/service/PlatformUserManagementServiceTest.java
+++ b/iam/src/test/java/com/baiyue/iam/service/PlatformUserManagementServiceTest.java
@@ -12,6 +12,7 @@ import com.baiyue.iam.mapper.IamRoleMapper;
 import com.baiyue.iam.repository.MemberRepository;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
+import org.mockito.ArgumentCaptor;
 import jakarta.annotation.Resource;
 import org.springframework.boot.test.mock.mockito.MockBean;
 import org.springframework.test.context.TestPropertySource;
@@ -20,6 +21,7 @@ import org.springframework.test.context.junit.jupiter.SpringJUnitConfig;
 import java.time.LocalDateTime;
 import java.util.List;
 import java.util.Set;
+import java.util.concurrent.atomic.AtomicReference;
 
 import static org.junit.jupiter.api.Assertions.*;
 import static org.mockito.ArgumentMatchers.*;
@@ -85,6 +87,30 @@ class PlatformUserManagementServiceTest {
         verify(auth, never()).create(anyString(), any());
     }
 
+    @Test
+    void createPublishesActualStatusAndInitialAuthorizationAfterRolesAreStored() {
+        AtomicReference<IamUser> createdUser = new AtomicReference<>();
+        doAnswer(invocation -> { createdUser.set(invocation.getArgument(0)); return null; })
+                .when(members).insertUser(any(IamUser.class));
+        when(members.findUser(anyLong())).thenAnswer(invocation -> createdUser.get());
+        when(members.findRoleIds(eq(0L), anyLong())).thenReturn(List.of(40001L));
+        when(auth.create(eq("internal-token"), any())).thenReturn(ApiResponse.success(null));
+        when(auth.summary(eq("internal-token"), anyLong())).thenAnswer(invocation -> ApiResponse.success(
+                new AuthAccountClient.AccountSummary(invocation.getArgument(1), "newuser", "新用户", "DISABLED")));
+        CreateUserRequest request = new CreateUserRequest("newuser", "新用户", "13900139000",
+                "new@example.com", 0L, List.of(40001L), "Password1", "DISABLED");
+
+        service.create(request);
+
+        ArgumentCaptor<AuthAccountClient.CreateAccountRequest> account =
+                ArgumentCaptor.forClass(AuthAccountClient.CreateAccountRequest.class);
+        verify(auth).create(eq("internal-token"), account.capture());
+        long authUserId = account.getValue().accountId();
+        verify(members).replaceRoles(eq(0L), anyLong(), eq(List.of(40001L)));
+        verify(securityEvents).userStatus(authUserId, 0L, "PLATFORM", "DISABLED");
+        verify(securityEvents).permissionChanged(authUserId, 0L, "PLATFORM", "INITIAL_AUTHORIZATION");
+    }
+
     @Test
     void optionsContainOnlyPlatformTenantAndPlatformRoles() {
         UserOptions result = service.options();
diff --git a/iam/src/test/java/com/baiyue/iam/service/SecurityEventOutboxRelayTest.java b/iam/src/test/java/com/baiyue/iam/service/SecurityEventOutboxRelayTest.java
new file mode 100644
index 000000000..aa212d14b
--- /dev/null
+++ b/iam/src/test/java/com/baiyue/iam/service/SecurityEventOutboxRelayTest.java
@@ -0,0 +1,91 @@
+package com.baiyue.iam.service;
+
+import com.baiyue.common.core.api.ApiResponse;
+import com.baiyue.common.event.EventEnvelope;
+import com.baiyue.common.event.EventPayloadCanonicalizer;
+import com.baiyue.common.event.EventPayloadHash;
+import com.baiyue.common.event.EventTypes;
+import com.baiyue.common.event.IamSecurityEventsV1;
+import com.baiyue.common.event.RegionCode;
+import com.baiyue.iam.client.SecurityEventBridgeClient;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.ArgumentCaptor;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+import org.springframework.jdbc.core.JdbcTemplate;
+import org.springframework.test.util.ReflectionTestUtils;
+
+import java.time.Instant;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.anyString;
+import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+@ExtendWith(MockitoExtension.class)
+class SecurityEventOutboxRelayTest {
+    @Mock private JdbcTemplate jdbc;
+    @Mock private SecurityEventBridgeClient client;
+    private final ObjectMapper objectMapper = new ObjectMapper().findAndRegisterModules();
+    private SecurityEventOutboxRelay relay;
+
+    @BeforeEach
+    void setUp() {
+        relay = new SecurityEventOutboxRelay();
+        ReflectionTestUtils.setField(relay, "jdbc", jdbc);
+        ReflectionTestUtils.setField(relay, "client", client);
+        ReflectionTestUtils.setField(relay, "objectMapper", objectMapper);
+        ReflectionTestUtils.setField(relay, "internalToken", "internal-token");
+        ReflectionTestUtils.setField(relay, "maxAttempts", 12);
+    }
+
+    @Test
+    void cnToOverseasEventIsSentOnlyAfterMatchingBridgeAcknowledgement() throws Exception {
+        EventEnvelope envelope = envelope(RegionCode.OVERSEAS);
+        when(jdbc.update(anyString(), any(Object[].class))).thenReturn(1);
+        when(jdbc.queryForObject(anyString(), eq(String.class), any(), any()))
+            .thenReturn(objectMapper.writeValueAsString(envelope));
+        when(client.receive(eq("internal-token"), any(EventEnvelope.class))).thenReturn(ApiResponse.success(
+            new SecurityEventBridgeClient.Acknowledgement(envelope.eventId(), "ACCEPTED", "2026-08-25T07:00:00Z")));
+
+        relay.deliver(envelope.eventId());
+
+        ArgumentCaptor<EventEnvelope> sent = ArgumentCaptor.forClass(EventEnvelope.class);
+        verify(client).receive(eq("internal-token"), sent.capture());
+        assertThat(sent.getValue().sourceRegion()).isEqualTo(RegionCode.CN);
+        assertThat(sent.getValue().targetRegion()).isEqualTo(RegionCode.OVERSEAS);
+        verify(jdbc).update(anyString(), any(), any(), eq(envelope.eventId()), anyString());
+    }
+
+    @Test
+    void nonOverseasTargetNeverReachesTheBridge() throws Exception {
+        EventEnvelope envelope = envelope(RegionCode.CN);
+        when(jdbc.update(anyString(), any(Object[].class))).thenReturn(1);
+        when(jdbc.queryForObject(anyString(), eq(String.class), any(), any()))
+            .thenReturn(objectMapper.writeValueAsString(envelope));
+        when(jdbc.queryForObject(anyString(), eq(Integer.class), eq(envelope.eventId()))).thenReturn(0);
+
+        relay.deliver(envelope.eventId());
+
+        verify(client, never()).receive(anyString(), any(EventEnvelope.class));
+        verify(jdbc).update(anyString(), eq("PENDING"), eq(1), any(), anyString(), any(),
+            eq(envelope.eventId()), anyString());
+    }
+
+    private EventEnvelope envelope(RegionCode target) {
+        var value = new IamSecurityEventsV1.PermissionVersionChanged(
+            101L, 0L, "PLATFORM", 3L, "contract", Instant.parse("2026-08-25T07:00:00Z"));
+        var payload = objectMapper.valueToTree(value);
+        return new EventEnvelope("00000000-0000-4000-8000-000000000081",
+            EventTypes.IAM_PERMISSION_VERSION_CHANGED, IamSecurityEventsV1.VERSION,
+            Instant.parse("2026-08-25T07:00:00Z"), RegionCode.CN, target, "0",
+            "AUTHORIZATION", "101", 3L, null, "trace-12345678", "correlation-12345678",
+            null, payload, EventPayloadHash.sha256(EventPayloadCanonicalizer.canonicalize(payload)));
+    }
+}
diff --git a/iam/src/test/java/com/baiyue/iam/service/SecurityEventOutboxServiceTest.java b/iam/src/test/java/com/baiyue/iam/service/SecurityEventOutboxServiceTest.java
index 432587f3f..fb1ce9e8b 100644
--- a/iam/src/test/java/com/baiyue/iam/service/SecurityEventOutboxServiceTest.java
+++ b/iam/src/test/java/com/baiyue/iam/service/SecurityEventOutboxServiceTest.java
@@ -1,10 +1,13 @@
 package com.baiyue.iam.service;
 
 import com.baiyue.common.event.EventEnvelope;
+import com.baiyue.common.event.IamSecurityEventsV1;
 import com.fasterxml.jackson.databind.ObjectMapper;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.extension.ExtendWith;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.CsvSource;
 import org.mockito.ArgumentCaptor;
 import org.mockito.Mock;
 import org.mockito.junit.jupiter.MockitoExtension;
@@ -43,4 +46,29 @@ class SecurityEventOutboxServiceTest {
         EventEnvelope envelope = objectMapper.readValue(String.valueOf(parameters.getValue()[4]), EventEnvelope.class);
         assertThat(envelope.requireValid().correlationId()).isNotBlank().isEqualTo(envelope.traceId());
     }
+
+    @ParameterizedTest
+    @CsvSource({
+        "ACTIVE,ACTIVE",
+        "PROFILE_REQUIRED,DISABLED",
+        "PENDING,DISABLED",
+        "REJECTED,DISABLED",
+        "DISABLED,DISABLED",
+        "ARCHIVED,DISABLED"
+    })
+    void tenantWorkflowStatusIsNormalizedToTheSecurityContract(String businessStatus,
+                                                                 String expectedSecurityStatus) throws Exception {
+        when(jdbc.queryForObject(anyString(), eq(Long.class), any())).thenReturn(3L);
+
+        service.tenantStatus(10001L, businessStatus);
+
+        ArgumentCaptor<Object[]> parameters = ArgumentCaptor.forClass(Object[].class);
+        verify(jdbc).update(eq("INSERT INTO iam_security_event_outbox(event_id,event_type,aggregate_type,aggregate_id,payload_json) "
+            + "VALUES (?,?,?,?,CAST(? AS JSON))"), parameters.capture());
+        EventEnvelope envelope = objectMapper.readValue(String.valueOf(parameters.getValue()[4]), EventEnvelope.class);
+        IamSecurityEventsV1.TenantStatusChanged payload = objectMapper.treeToValue(
+            envelope.payload(), IamSecurityEventsV1.TenantStatusChanged.class);
+        assertThat(payload.status()).isEqualTo(expectedSecurityStatus);
+        assertThat(envelope.aggregateVersion()).isEqualTo(3L);
+    }
 }
diff --git a/iam/src/test/java/com/baiyue/iam/service/TenantAdministratorProvisioningServiceTest.java b/iam/src/test/java/com/baiyue/iam/service/TenantAdministratorProvisioningServiceTest.java
index 8dfbe466c..8e76d8a1d 100644
--- a/iam/src/test/java/com/baiyue/iam/service/TenantAdministratorProvisioningServiceTest.java
+++ b/iam/src/test/java/com/baiyue/iam/service/TenantAdministratorProvisioningServiceTest.java
@@ -34,6 +34,7 @@ import static org.mockito.ArgumentMatchers.eq;
 import static org.mockito.Mockito.doThrow;
 import static org.mockito.Mockito.never;
 import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.verifyNoInteractions;
 import static org.mockito.Mockito.times;
 import static org.mockito.Mockito.when;
 
@@ -43,6 +44,7 @@ class TenantAdministratorProvisioningServiceTest {
     @MockBean private MemberRepository members;
     @MockBean private IamRoleMapper roles;
     @MockBean private AuthAccountClient auth;
+    @MockBean private SecurityEventOutboxService securityEvents;
     @Resource private TenantAdministratorProvisioningService service;
     private IamTenant tenant;
 
@@ -101,6 +103,9 @@ class TenantAdministratorProvisioningServiceTest {
         verify(members).insertUser(any(IamUser.class));
         verify(members).insert(any(IamMembership.class));
         verify(members).replaceRoles(eq(tenant.getId()), anyLong(), eq(List.of(4000100L)));
+        verify(securityEvents).userStatus(account.getValue().accountId(), tenant.getId(), "MERCHANT", "ACTIVE");
+        verify(securityEvents).permissionChanged(account.getValue().accountId(), tenant.getId(), "MERCHANT",
+                "INITIAL_AUTHORIZATION");
     }
 
     @Test
@@ -135,6 +140,7 @@ class TenantAdministratorProvisioningServiceTest {
         assertEquals(null, result.temporaryPassword());
         verify(auth, never()).create(anyString(), any());
         verify(members, never()).replaceRoles(anyLong(), anyLong(), any());
+        verifyNoInteractions(securityEvents);
     }
 
     @Test
@@ -153,6 +159,8 @@ class TenantAdministratorProvisioningServiceTest {
         assertFalse(result.created());
         verify(auth, never()).create(anyString(), any());
         verify(members).replaceRoles(tenant.getId(), owner.getId(), List.of(4000200L, 4000100L));
+        verify(securityEvents).permissionChanged(user.getAuthUserId(), tenant.getId(), "MERCHANT",
+                "MEMBER_ROLES_CHANGED");
     }
 
     @Test
@@ -190,6 +198,9 @@ class TenantAdministratorProvisioningServiceTest {
         verify(members, never()).insertUser(any());
         verify(members, never()).insert(any());
         verify(members, never()).replaceRoles(anyLong(), anyLong(), any());
+        verify(securityEvents).userStatus(user.getAuthUserId(), tenant.getId(), "MERCHANT", "ACTIVE");
+        verify(securityEvents).permissionChanged(user.getAuthUserId(), tenant.getId(), "MERCHANT",
+                "INITIAL_AUTHORIZATION");
     }
 
     @Test
diff --git a/iam/src/test/java/com/baiyue/iam/service/TenantServiceTest.java b/iam/src/test/java/com/baiyue/iam/service/TenantServiceTest.java
index ca4291de3..eb7bb54dc 100644
--- a/iam/src/test/java/com/baiyue/iam/service/TenantServiceTest.java
+++ b/iam/src/test/java/com/baiyue/iam/service/TenantServiceTest.java
@@ -313,6 +313,7 @@ class TenantServiceTest {
             9001L);
 
         assertEquals("PROFILE_REQUIRED", created.tenant().status());
+        assertEquals("PENDING", created.tenant().dimensionInitializationStatus());
         assertEquals("Bob", created.tenant().legalRepresentative());
         assertEquals("基础版", created.tenant().servicePackage());
         assertEquals("13800138000", created.administratorUsername());
@@ -320,12 +321,13 @@ class TenantServiceTest {
         verify(repository).insertTenant(argThat(tenant -> Long.valueOf(9001L).equals(tenant.getCreatedBy())
                 && Long.valueOf(9001L).equals(tenant.getUpdatedBy())));
         verify(dimensionRuleInitialization).initialize(created.tenant().id(), 9001L);
+        verify(securityEvents).tenantStatus(created.tenant().id(), "PROFILE_REQUIRED");
         verify(provisioning).provisionPlatformCreatedTenant(any(), eq(9001L));
         verify(repository, never()).insertReview(any());
     }
 
     @Test
-    void platformRegistrationFailsWhenFourDefaultBoxDimensionsCannotBeInitialized() {
+    void platformRegistrationFailsWhenDurableInitializationIntentCannotBePersisted() {
         doThrow(new BizException(ResultCode.SERVICE_UNAVAILABLE, "初始化失败"))
                 .when(dimensionRuleInitialization).initialize(any(Long.class), any(Long.class));
 
@@ -428,6 +430,7 @@ class TenantServiceTest {
         assertEquals("ACTIVE", tenant.getStatus());
         verify(repository).saveReview(review);
         verify(repository).saveTenant(tenant);
+        verify(securityEvents).tenantStatus(10001L, "ACTIVE");
     }
 
     @Test
@@ -489,12 +492,26 @@ class TenantServiceTest {
         assertEquals(true, withQualification.eligible());
     }
 
+    @Test
+    void activeCustomerCannotOrderUntilDefaultDimensionsAreReady() {
+        IamTenant tenant = merchant(10001L, "ACTIVE");
+        tenant.setDimensionInitializationStatus("FAILED");
+        when(repository.findTenant(10001L)).thenReturn(tenant);
+
+        var result = service.orderEligibility(10001L);
+
+        assertEquals(false, result.eligible());
+        assertEquals("Customer default dimensions are not ready", result.reason());
+        verify(profileRepository, never()).findQualifications(10001L);
+    }
+
     private IamTenant merchant(long id, String status) {
         IamTenant tenant = new IamTenant();
         tenant.setId(id);
         tenant.setTenantCode("TEN" + id);
         tenant.setTenantType("MERCHANT");
         tenant.setStatus(status);
+        tenant.setDimensionInitializationStatus("READY");
         tenant.setTenantName("Example Merchant");
         tenant.setLegalName("Example Merchant Ltd");
         tenant.setUnifiedSocialCreditCode("91330100EXAMPLE001");
diff --git a/iam/src/test/resources/db/verify-phase1-admin-rbac.sql b/iam/src/test/resources/db/verify-phase1-admin-rbac.sql
index e2942472f..24dce2749 100644
--- a/iam/src/test/resources/db/verify-phase1-admin-rbac.sql
+++ b/iam/src/test/resources/db/verify-phase1-admin-rbac.sql
@@ -1,13 +1,17 @@
 -- Any returned row represents a failed phase-one seed assertion.
 SELECT 'missing_auth_accounts' AS failure
 WHERE (SELECT COUNT(*) FROM baiyue_auth.auth_account
-       WHERE username IN ('platform_admin', 'merchant_admin') AND account_status = 'ACTIVE') <> 2
+       WHERE username = 'platform_admin' AND account_status = 'ACTIVE') <> 1
 UNION ALL
 SELECT 'missing_active_identities'
 WHERE (SELECT COUNT(*) FROM baiyue_iam.iam_user u
        JOIN baiyue_iam.iam_membership m ON m.user_id = u.id
-       WHERE u.auth_user_id IN (1000001, 1000002)
-         AND u.status = 'ACTIVE' AND m.status = 'ACTIVE') <> 2
+       WHERE u.auth_user_id = 1000001
+         AND u.status = 'ACTIVE' AND m.status = 'ACTIVE') <> 1
+UNION ALL
+SELECT 'unexpected_fixed_customer_seed'
+WHERE EXISTS (SELECT 1 FROM baiyue_iam.iam_tenant WHERE tenant_code = 'IT_TEST')
+   OR EXISTS (SELECT 1 FROM baiyue_auth.auth_account WHERE username = 'merchant_admin')
 UNION ALL
 SELECT 'unexpected_permission_type'
 WHERE EXISTS (SELECT 1 FROM baiyue_iam.iam_permission
@@ -34,10 +38,6 @@ SELECT 'platform_admin_not_fully_granted'
 WHERE (SELECT COUNT(*) FROM baiyue_iam.iam_role_permission WHERE role_id = 4000001)
    <> (SELECT COUNT(*) FROM baiyue_iam.iam_permission WHERE tenant_id = 0 AND app_code = 'PLATFORM' AND permission_type IN ('MENU', 'BUTTON'))
 UNION ALL
-SELECT 'merchant_owner_not_fully_granted'
-WHERE (SELECT COUNT(*) FROM baiyue_iam.iam_role_permission WHERE role_id = 4000101)
-   <> (SELECT COUNT(*) FROM baiyue_iam.iam_permission WHERE tenant_id = 10001 AND app_code = 'MERCHANT' AND permission_type IN ('MENU', 'BUTTON'))
-UNION ALL
 SELECT 'missing_global_merchant_owner_template'
 WHERE NOT EXISTS (
   SELECT 1 FROM baiyue_iam.iam_role
diff --git a/lastleg-service/AGENTS.md b/lastleg-service/AGENTS.md
index 0c374a698..477b6158d 100644
--- a/lastleg-service/AGENTS.md
+++ b/lastleg-service/AGENTS.md
@@ -2,7 +2,7 @@
 
 ## 职责与边界
 
-- 负责消费头程装柜完成事件，保存业务 Inbox，并按最终实装入仓单建立尾程订单、明细冻结快照和初始状态历史。
+- 负责消费头程装柜完成事件，保存业务 Inbox，并按最终实装入仓单建立待分配尾程订单、明细冻结快照和初始状态历史；事件不得自动创建入仓计划，平台人工调用 `/api/platform/v1/last-leg/inbound-plans/convert` 后才生成计划并推进订单。
 - 负责尾程订单列表、详情、导出和目的仓调整，以及海外入仓计划、托盘分配与 PDA 入仓作业；PDA 卸柜完成后通过本地 Outbox 向国内头程回传货柜报空事实。
 - 不查询头程数据库，不调用头程接口补齐建单字段；事件快照缺失时应拒绝消费并保留可诊断错误。
 
@@ -10,6 +10,7 @@
 
 | 功能 | 入口 |
 |---|---|
+| 内部模块化基线与依赖分析 | `docs/lastleg-internal-modularization-baseline.md`、`scripts/analyze-lastleg-dependencies.mjs`、`scripts/analyze-lastleg-dependencies.test.mjs`、`src/test/resources/architecture/lastleg-slice-dependencies.json`；只约束本服务内部包依赖，不改变部署单元或数据库边界 |
 | 事件接收、平台订单列表/详情/导出、目的仓调整 | `src/main/java/com/baiyue/lastleg/controller/LastlegOrderController.java` |
 | 客户尾程订单列表与详情 | `controller/MerchantLastlegOrderController.java`；客户范围只取认证身份，稳定类型/状态见 `model/LastlegOrderType.java`、`LastlegOrderStatus.java` |
 | 装柜完成事件消费 | `service/LoadingCompletedConsumer.java`；当前生产信封为 `FIRST_LEG_LOADING_PLAN_COMPLETED` V2，消费端冻结 `destinationType`：FBA 可按箱数且不生成逐箱作业账，OVERSEAS 必须逐箱校验并生成箱级事实；历史缺字段事件仅按明确 FBA 单号或目的仓与接柜仓一致性安全推断，歧义直接拒绝 |
@@ -19,6 +20,7 @@
 | 尾程订单、明细、状态历史 | `entity/LastlegOrder.java`、`LastlegOrderDetail.java`、`LastlegOrderStatusHistory.java` 及对应 Mapper |
 | 独立尾程入仓单快照 | `entity/LastlegInboundOrder.java`、`mapper/LastlegInboundOrderMapper.java`；按客户与来源入仓标识冻结 inboundCode、来源/根订单及目的仓，不以尾程订单行代替入仓单聚合 |
 | 内部令牌保护 | `security/InternalServiceTokenGuard.java` |
+| IAM 海外安全投影与实时校验 | 内部入口 `security/controller/LastlegSecurityController.java`，固定 `/internal/lastleg/security/v1/events`、`/validate` 且复用 `InternalServiceTokenGuard`；投影/校验 `security/service/`，DTO `security/dto/`，表固定 `ll_security_event_inbox`、`ll_security_projection`；MySQL 投影缺失、落后或不可用一律 fail-closed，Redis 仅为提交后可重建镜像；业务切片不得直接依赖投影内部类，边界由 `SecurityProjectionArchitectureTest` 与 Node 合同锁定 |
 | 入仓计划分页、转换与详情 | `inboundplan/controller/InboundPlanController.java`、`inboundplan/dto/InboundPlanRequests.java`、`InboundPlanListResponse.java`、`inboundplan/mapper/InboundPlanQueryMapper.java`、`inboundplan/service/InboundPlanService.java` |
 | 托盘分配算法 | `inboundplan/service/PalletAllocator.java` |
 | FBA 预约创建、详情与编辑 | `InboundPlanController.java` 的 `/fba-appointments/**`、`inboundplan/service/InboundFbaAppointmentService.java`、`BatchFbaAppointmentRequest.java`、`UpdateFbaAppointmentRequest.java` |
@@ -36,7 +38,8 @@
 | 海外采购、客户下单、采购审核、客户/采购仓候选与操作流水 | `procurement/controller/`、`procurement/service/OverseasProcurementService.java`；OpenAPI `src/main/resources/openapi/overseas-business-v1.yaml` |
 | 美国/本土卡车订单 | `trucking/controller/PlatformUsTruckOrderController.java`、`MerchantUsTruckOrderController.java` 及同子域 Service/DTO |
 | 本土散板订单 | `looseboard/controller/PlatformLocalLooseboardController.java` 及同子域 Service/DTO/Entity/Mapper；OpenAPI `src/main/resources/openapi/overseas-business-v1.yaml` |
-| 海外仓报价、月度汇率、车辆主数据 | `masterdata/quote/`、`masterdata/exchange/`、`masterdata/vehicle/`；OpenAPI `src/main/resources/openapi/overseas-master-data-v1.yaml`；车辆档案不含派送履约历史 |
+| 海外仓报价、月度汇率、车辆主数据 | 报价 `masterdata/quote/`、汇率 `masterdata/exchange/`；车辆入口 `masterdata/vehicle/adapter/in/web/PlatformVehicleController.java`，应用服务 `application/VehicleApplicationService.java`，持久化端口与适配器 `application/port/out/VehicleRepository.java`、`adapter/out/persistence/`；OpenAPI `src/main/resources/openapi/overseas-master-data-v1.yaml`，车辆档案不含派送履约历史 |
+| 跨服务 HTTP 客户端装配 | `config/LastlegRestClientFactory.java`、`config/LastlegRestClientProperties.java`；目标地址与内部服务令牌只来自配置，不在业务子域手工创建客户端 |
 | 数据库基线、表索引与中文注释契约 | `src/main/resources/db/lastleg.sql`、`src/test/java/com/baiyue/lastleg/schema/SchemaChineseCommentContractTest.java` |
 | 测试 | `src/test/java/com/baiyue/lastleg/` |
 | 真实事件消费验收 | `src/test/java/com/baiyue/lastleg/service/TaillegRealConsumerAcceptanceTest.java`；覆盖真实 V2 建单、独立入仓单快照及下游转运/换标可消费性 |
@@ -46,7 +49,7 @@
 - 四期在本服务内只进入尾程订单、入仓计划/PDA 入仓、换标、产品与箱唛快照、库存、海外采购和本土卡车；本土散板新增实现也归本服务的独立稳定子域。
 - `dispatch/`、`delivery/`、出库单、PDA 出库拣货、派送和其他库存离仓能力虽然已存在于服务代码或表结构中，但不属于当前四期开发与验收范围，不得因代码已存在而自动纳入。
 - 历史排车编辑/取消/出库、PDA 出库和 `delivery/` Controller 默认不注册；只有后续阶段明确启用 `lastleg.future-outbound-api.enabled=true` 才可恢复。平台排车列表与详情由 `lastleg.dispatch-query-api.enabled=true` 独立启用；入库单智能排车候选、草稿锁定/解锁/释放和预排创建由 `lastleg.smart-dispatch-api.enabled=true` 独立启用。这些排车平台入口均不接收 `customerId`：排车列表跨客户分页，详情按全局排车单号定位后使用记录自身客户范围加载明细；智能排车候选未传计划 ID 时跨客户查询，传入时根据计划 ID 解析范围；托盘移入草稿时立即以操作人和随机草稿标识锁定，移除或关闭时释放，草稿锁超时失效；预排创建根据所选托盘 ID 在服务端解析并校验唯一客户范围，并将当前操作人的草稿锁原子转换为正式排车锁。预排只能创建待出库排车并锁定托盘，不得借此开放编辑、取消、depart、PDA 出库或派送。四期平台库存 Controller 不映射 allocate、unallocate、pick、ship。
-- 海外仓库、库位、实物托盘和资源锁归 `warehouse-overseas-service/`；浏览器 API 统一经 `gateway-overseas/`，本服务不得复制仓储资源主数据或另建公网认证入口。
+- 仓库 ID、类型、状态、地址和能力唯一权威归国内 `warehouse-service`；海外库位、实物托盘和资源锁归 `warehouse-overseas-service/` 且只引用同一国内 `warehouseId`。Lastleg PDA 通过 Warehouse Overseas 内部资源入口校验该国内共享收货仓，不得要求海外数据库重复建仓；浏览器 API 统一经 `gateway-overseas/`。
 
 ## 数据库表索引与注释约束
 
@@ -60,6 +63,7 @@
 | 一件代发与废弃 | `ll_dropship_*`、`ll_cargo_discard_*` | 托盘/箱唛库存、流水和废弃审批 |
 | 采购、卡车与本土散板 | `ll_overseas_procurement_*`、`ll_us_truck_*`、`ll_local_looseboard_*` | 海外采购、美国卡车运输及本土散板订单 |
 | 通用资料 | `ll_overseas_quote*`、`ll_monthly_exchange_rate*`、`ll_vehicle` | 海外仓报价、月度汇率及车辆档案；不保存车辆派送履约历史 |
+| 海外安全投影 | `ll_security_event_inbox`、`ll_security_projection` | IAM 安全事件可靠收件箱与 Lastleg 本地授权投影；只允许内部服务入口访问，不作为 loading、shipping、inbound 等业务模型 |
 
 - 新增或修改表时，表 `COMMENT` 和每个普通字段的 `COMMENT` 必须填写准确的中文业务含义，不得只写英文、字段名或类型名。
 - `SchemaChineseCommentContractTest` 自动扫描全部 `ll_` 表，无需维护表名白名单；新增字段必须同步更新基线 SQL、建表增量和存量备注迁移，增量脚本的 `ADD/MODIFY COLUMN` 不得丢失中文备注。
@@ -73,7 +77,11 @@
 - 其他订单类型建立入仓单维度的尾程订单与冻结明细，并保留头程推荐托数；尾程入仓计划至少按推荐托数生成计划托盘，PDA 再把箱级事实绑定到海外仓实物托盘。
 - 整个事件消费在一个事务内完成；任意订单失败时不得留下部分订单。
 - 相同事件重复投递返回既有结果，不重新生成单号或插入明细。来源入仓单唯一约束是最终防线。
+- 装柜完成事件只把尾程订单建立为 `PENDING_ASSIGNMENT`。`FIRST_LEG` 在途库存使用不可变来源入仓码作为计划生成前的 `inbound_order_no` 展示快照；平台人工转换成功后，同一事务将订单推进为 `INBOUND_PLANNED`，并把对应库存余额的该快照收口为新 `planNo`。
 - 内部接口先执行常量时间令牌校验；缺失或错误令牌不得进入消费事务。
+- IAM 安全事件只能进入 `/internal/lastleg/security/v1/events`；通用 `/internal/lastleg/events` 只白名单接收装柜完成与实际船节点事件，禁止把 IAM 事件交给 `LoadingCompletedConsumer`。
+- Lastleg 安全投影只接受 `ACTIVE`/`DISABLED` 两态安全语义；客户建档和审核的 `PROFILE_REQUIRED`/`PENDING`/`REJECTED`/`ARCHIVED` 由 IAM 在发布前统一折叠为 `DISABLED`，Lastleg 不兼容或解释国内工作流状态。
+- 开发基线只为国内固定 `authUserId=1000001`、`tenantId=0` 的 `platform_admin` 写 USER/AUTHORIZATION version=0 投影；使用 `INSERT IGNORE`，后续 IAM version>=1 事件单调覆盖。不得扩大为历史账号运行时补齐或缺失投影默认放行。
 - PDA 入仓任务完成前必须先通过 `/unload-photos` 保存非空且不重复的卸柜照片文件 ID；照片上传时间由服务端记录，预计报空时间固定为照片上传时间加两天。完成入仓时，库存入账、计划/任务状态推进与 `OVERSEAS_CONTAINER_UNLOADED` V1 Outbox 必须处于同一事务；事件绑定来源头程货柜身份，不得从前端请求拼装或回查头程数据库。
 - 海外 PDA 柜号签收只允许平台 `WAREHOUSE_PICKER` 使用 `lastleg:pda:operate`；PDA 不接收 `customerId`，候选跨客户读取，选柜时从柜内计划唯一解析并冻结真实客户。未完成会话按平台操作账号和柜号分别全局唯一，后续照片、扫码、实收、库存与完成操作只使用会话客户范围；平台管理员和客户账号不得进入该作业入口。
 
@@ -91,6 +99,8 @@
 
 ## 修改与验证
 
+- 移动包、拆分端口/适配器或引入新的跨子域依赖时，先核对内部模块化基线并运行 `node --test scripts/analyze-lastleg-dependencies.test.mjs`；确需更新依赖基线时必须说明稳定边界变化，不能把临时循环依赖登记为长期豁免。
+- 安全投影边界变更同时运行 `SecurityProjectionArchitectureTest` 与 `LastlegSecurityContractTest`；`security/controller|dto|service` 只允许依赖本子域和根 `InternalServiceTokenGuard`，其他 Lastleg 业务包不得直接依赖这些投影内部包。
 - 表字段、注释和索引同步维护基线 SQL 与统一增量 SQL；生产/存量库只执行增量脚本。
 - 事件契约变化同时检查 `common-event-contract` 版本、Event Bridge 消费方和旧 Payload 哈希兼容。
 - 定向验证：`mvn -pl lastleg -am test`。
diff --git a/lastleg-service/docs/lastleg-internal-modularization-baseline.md b/lastleg-service/docs/lastleg-internal-modularization-baseline.md
index 0acced4c7..f0627b41b 100644
--- a/lastleg-service/docs/lastleg-internal-modularization-baseline.md
+++ b/lastleg-service/docs/lastleg-internal-modularization-baseline.md
@@ -2,7 +2,7 @@
 
 ## 1. 范围与生成方式
 
-本基线只分析 `lastleg-service` 同一部署单元，不拆微服务，不修改业务代码、POM、数据库、OpenAPI、权限、接口或跨服务契约。统计时工作区同时存在 RestClient 超时专项的在途修改；本专项不修改 `client/`、`config/*RestClient*` 或各业务 HTTP Gateway。
+本基线只分析 `lastleg-service` 同一部署单元，不拆微服务，不修改业务流程、数据库、OpenAPI、权限、接口或跨服务契约。统计时工作区同时存在其他专项的在途修改；本专项不修改 `client/`、`config/*RestClient*` 或各业务 HTTP Gateway。模块内 POM 只增加由根 POM 统一版本管理的 ArchUnit 测试依赖。
 
 可重复命令：
 
@@ -16,15 +16,15 @@ node lastleg-service/scripts/analyze-lastleg-dependencies.mjs --source-set all -
 node lastleg-service/scripts/analyze-lastleg-dependencies.mjs --source-set main --format dot --graph slice
 ```
 
-分析器解析显式内部 `import`、静态 `import` 及同包类型引用，输出类依赖、物理包图、逻辑切片图、Tarjan SCC、Entity/DTO/Model 泄漏与 Mapper 泄漏。`test` 单独输出测试包节点及测试类之间的边；当前测试主要引用生产类型，因此 test-only 图有 67 个包节点但没有测试类之间的内部边。`all` 把 `src/main/java` 和 `src/test/java` 合并解析，是观察测试对生产类型耦合的主图。Spring 扫描字符串、反射、MyBatis SQL 表引用和跨服务运行时调用不属于 Java 类型图。
+分析器解析显式内部 `import`、静态 `import` 及同包类型引用，输出类依赖、物理包图、逻辑切片图、Tarjan SCC、Entity/DTO/Model 泄漏与 Mapper 泄漏。`test` 单独输出测试包节点及测试类之间的边；当前测试主要引用生产类型，因此 test-only 图有 68 个包节点但没有测试类之间的内部边。`all` 把 `src/main/java` 和 `src/test/java` 合并解析，是观察测试对生产类型耦合的主图。Spring 扫描字符串、反射、MyBatis SQL 表引用和跨服务运行时调用不属于 Java 类型图。
 
 ## 2. 当前规模与 SCC
 
 | 源集 | Java 文件 | 内部类依赖 | 物理包 | 跨切片类依赖 | 模型泄漏 | Mapper 泄漏 |
 |---|---:|---:|---:|---:|---:|---:|
-| main | 347 | 672 | 157 | 137 | 60 | 38 |
-| test only | 98 | 0 | 67 | 0 | 0 | 0 |
-| main + test | 445 | 1,195 | 161 | 256 | 108 | 76 |
+| main | 353 | 679 | 160 | 138 | 60 | 38 |
+| test only | 103 | 0 | 68 | 0 | 0 | 0 |
+| main + test | 456 | 1,206 | 164 | 257 | 108 | 76 |
 
 主源码物理包图没有多节点 SCC。主源码逻辑切片图存在一个四节点 SCC：
 
@@ -57,7 +57,8 @@ com.baiyue.lastleg.transfer.service
 | 换标/转运/废弃 `relabel-transfer-discard` | `relabel/`、`transfer/`、`discard/`，其 PDA 子包保持本域归属 | 61 | 31/0 | 直接使用尾程、库存和一件代发持久化模型；业务事务边界复杂 |
 | 一件代发 `dropship` | `dropship/` | 12 | 4/11 | 与尾程消费及废弃库存双向耦合，位于主 SCC |
 | 采购/卡车/散板 `procurement-trucking-looseboard` | `procurement/`、`trucking/`、`looseboard/` | 35 | 11/0 | 依赖尾程核心，采购另读取报价目录；仍由四期业务专项维护 |
-| 海外主数据 `overseas-master-data` | `masterdata/quote`、`exchange`、`vehicle` | 26 | 3/1 | 不在任何 SCC；仅出向共享权限常量，入向来自采购对报价目录的使用 |
+| 海外主数据 `overseas-master-data` | `masterdata/quote`、`exchange`、`vehicle` | 28 | 3/1 | 不在任何 SCC；仅出向共享权限常量，入向来自采购对报价目录的使用 |
+| 海外安全投影 `security-projection` | `security/controller`、`security/dto`、`security/service` | 6 | 1/0 | 独立于业务切片与主 SCC；唯一出向为内部 Controller 复用根 `InternalServiceTokenGuard`，无业务切片入向依赖 |
 
 另有 6 个 `shared-technical` 类：应用启动类、Event Bridge Client、RestClient 配置、内部令牌保护和海外权限常量。该分类不授权移动这些共享类。
 
@@ -86,12 +87,13 @@ com.baiyue.lastleg.transfer.service
 | relabel-transfer-discard | inventory | 6 |
 | relabel-transfer-discard | shared-technical | 3 |
 | relabel-transfer-discard | tailleg-handoff | 14 |
+| security-projection | shared-technical | 1 |
 | tailleg-handoff | dropship | 2 |
 | tailleg-handoff | inbound-pda | 6 |
 | tailleg-handoff | inventory | 2 |
 | tailleg-handoff | shared-technical | 2 |
 
-当前 25 条切片边冻结在 `src/test/resources/architecture/lastleg-slice-dependencies.json`。合同允许删除历史边，不允许增加新边；海外主数据继续锁定为只允许出向 `shared-technical`，只允许采购/卡车/散板切片入向。
+当前 26 条切片边冻结在 `src/test/resources/architecture/lastleg-slice-dependencies.json`。合同允许删除历史边，不允许增加新边；海外主数据继续锁定为只允许出向 `shared-technical`，只允许采购/卡车/散板切片入向；安全投影只允许出向 `shared-technical` 且禁止任何业务切片入向依赖。
 
 ## 5. Entity/DTO/Mapper 泄漏基线
 
@@ -175,8 +177,9 @@ Web Adapter 可继续依赖 Spring Web、common-security 和 `OverseasPermission
 ## 9. 当前只读合同
 
 - `scripts/analyze-lastleg-dependencies.mjs`：生成 JSON、Markdown、逻辑切片 DOT、main/test/all 物理包 DOT 和 Tarjan SCC。
-- `src/test/resources/architecture/lastleg-slice-dependencies.json`：冻结 25 条 main 切片边；历史边可减少，不可增加。
-- `scripts/analyze-lastleg-dependencies.test.mjs`：校验基线、main/test/all 包图输出，以及车辆候选的 5 类、零入向、唯一权限出向、零 Client/RestClient 和不进入 SCC。
+- `src/test/resources/architecture/lastleg-slice-dependencies.json`：冻结 26 条 main 切片边；历史边可减少，不可增加，并锁定安全投影 6 个类的位置、单一出向与零入向。
+- `scripts/analyze-lastleg-dependencies.test.mjs`：校验基线、main/test/all 包图输出、车辆切片边界及安全投影隔离。
+- `src/test/java/com/baiyue/lastleg/security/SecurityProjectionArchitectureTest.java`：用 ArchUnit 锁定投影内部只依赖本子域和根安全技术类、业务包不得反向依赖投影、DTO/Service 不依赖内部 Web Adapter。
 
 最小验证：
 
@@ -197,3 +200,11 @@ node lastleg-service/scripts/analyze-lastleg-dependencies.mjs --source-set all -
 - 验证结果：Node 合同 4/4；`mvn -pl lastleg-service -am test-compile` 成功；车辆定向测试 5/5；`mvn -pl lastleg-service -am test` 中 lastleg-service 370 个测试，0 失败、0 错误、2 个环境验收跳过，构建成功。
 
 首切片完成后停止，不进入第二切片。
+
+## 11. 海外安全投影合入后的边界
+
+- 用户确认安全投影保留在 `lastleg-service` 部署单元内，不拆新微服务；逻辑上独立为 `security-projection` 切片。
+- Controller 仅映射 `/internal/lastleg/security/v1/events` 与 `/validate`，使用 `@Hidden` 并在进入投影或校验服务前调用根 `InternalServiceTokenGuard`。
+- MySQL 表固定使用 Lastleg 前缀 `ll_security_event_inbox`、`ll_security_projection`；没有 `overseas_security_*` 表或独立数据库归属。
+- `loading`、`shipping`、`inboundplan` 及其他业务切片不得直接依赖 `security/controller|dto|service`；当前 Java 类型图零入向，Node 与 ArchUnit 双重锁定。
+- 安全投影不进入主逻辑 SCC，唯一出向为内部 Controller 复用共享令牌守卫，不注册为 loading/shipping/inbound 的模型、Mapper 或应用服务。
diff --git a/lastleg-service/pom.xml b/lastleg-service/pom.xml
index 938233013..d1274b7a8 100644
--- a/lastleg-service/pom.xml
+++ b/lastleg-service/pom.xml
@@ -19,6 +19,7 @@
         <dependency><groupId>org.springframework.boot</groupId><artifactId>spring-boot-starter-actuator</artifactId></dependency>
         <dependency><groupId>com.mysql</groupId><artifactId>mysql-connector-j</artifactId><scope>runtime</scope></dependency>
         <dependency><groupId>org.springframework.boot</groupId><artifactId>spring-boot-starter-test</artifactId><scope>test</scope></dependency>
+        <dependency><groupId>com.tngtech.archunit</groupId><artifactId>archunit</artifactId><scope>test</scope></dependency>
     </dependencies>
     <build><plugins><plugin><groupId>org.springframework.boot</groupId><artifactId>spring-boot-maven-plugin</artifactId></plugin></plugins></build>
 </project>
diff --git a/lastleg-service/scripts/analyze-lastleg-dependencies.mjs b/lastleg-service/scripts/analyze-lastleg-dependencies.mjs
index c639c1bcd..a2488d164 100644
--- a/lastleg-service/scripts/analyze-lastleg-dependencies.mjs
+++ b/lastleg-service/scripts/analyze-lastleg-dependencies.mjs
@@ -12,6 +12,7 @@ const sourceRoots = {
 const internalPrefix = 'com.baiyue.lastleg.';
 
 const sliceRules = [
+  ['security-projection', /(?:^|\.)security\.(?:controller|dto|service)(?:\.|$)/],
   ['dispatch-delivery', /(?:^|\.)(?:dispatch|delivery|outbound)(?:\.|$)/],
   ['relabel-transfer-discard', /(?:^|\.)(?:relabel|transfer|discard)(?:\.|$)/],
   ['inbound-pda', /(?:^|\.)(?:inboundplan|palletops|pda)(?:\.|$)/],
diff --git a/lastleg-service/scripts/analyze-lastleg-dependencies.test.mjs b/lastleg-service/scripts/analyze-lastleg-dependencies.test.mjs
index bb8a6a945..28469687c 100644
--- a/lastleg-service/scripts/analyze-lastleg-dependencies.test.mjs
+++ b/lastleg-service/scripts/analyze-lastleg-dependencies.test.mjs
@@ -74,3 +74,25 @@ test('vehicle application only depends inward and stays free of adapter framewor
     && edge.target.startsWith('com.baiyue.lastleg.') && !edge.target.startsWith(prefix));
   assert.deepEqual(outwardDependencies, []);
 });
+
+test('security projection stays isolated from Lastleg business slices', () => {
+  const report = analyze();
+  const projectionClasses = report.classes.filter(entry => entry.slice === 'security-projection');
+  const projectionNames = new Set(projectionClasses.map(entry => entry.fqcn));
+  assert.deepEqual(projectionClasses.map(entry => entry.fqcn).sort(), [
+    'com.baiyue.lastleg.security.controller.LastlegSecurityController',
+    'com.baiyue.lastleg.security.dto.LastlegSecurityDtos',
+    'com.baiyue.lastleg.security.service.LastlegSecurityProjectionRedisMirror',
+    'com.baiyue.lastleg.security.service.LastlegSecurityProjectionService',
+    'com.baiyue.lastleg.security.service.LastlegSecurityValidationService',
+    'com.baiyue.lastleg.security.service.SecurityProjectionMonotonicity',
+  ]);
+  assert.deepEqual(report.sliceEdges.filter(edge => edge.source === 'security-projection'), [
+    { source: 'security-projection', target: 'shared-technical', count: 1 },
+  ]);
+  assert.deepEqual(report.sliceEdges.filter(edge => edge.target === 'security-projection'), []);
+  assert.equal(report.sliceSccs.some(component => component.includes('security-projection')), false);
+  const businessConsumers = report.classDependencies.filter(edge => projectionNames.has(edge.target)
+    && !projectionNames.has(edge.source));
+  assert.deepEqual(businessConsumers, []);
+});
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/controller/InboundPlanController.java b/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/controller/InboundPlanController.java
index 3bdb1f82d..3f8c3da74 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/controller/InboundPlanController.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/controller/InboundPlanController.java
@@ -44,8 +44,9 @@ public class InboundPlanController {
 
     @PostMapping("/convert")
     @PreAuthorize("hasAuthority('" + OverseasPermissions.INBOUND_ORDER_CREATE + "')")
-    /** 将入仓单转换为入仓计划。 */
-    @Operation(summary = "入仓单转入仓计划", description = "Required authority: " + OverseasPermissions.INBOUND_ORDER_CREATE)
+    /** 由平台人工将待分配尾程订单转换为入仓计划。 */
+    @Operation(summary = "人工创建入仓计划", description = "头程装柜完成只生成待分配尾程订单；平台确认后调用本接口创建入仓计划。Required authority: "
+        + OverseasPermissions.INBOUND_ORDER_CREATE)
     public ApiResponse<InboundPlanResponse> convert(@AuthenticationPrincipal AuthenticatedUser user,
                                                     @Valid @RequestBody ConvertInboundPlanRequest request) {
         return ApiResponse.success(service.convert(scope(user, request.customerId()), request.orderId()));
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/pda/dto/ReceivingContainerRequests.java b/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/pda/dto/ReceivingContainerRequests.java
index 4b3e93b8b..1b02cf639 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/pda/dto/ReceivingContainerRequests.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/pda/dto/ReceivingContainerRequests.java
@@ -3,6 +3,7 @@ package com.baiyue.lastleg.inboundplan.pda.dto;
 import jakarta.validation.Valid;
 import jakarta.validation.constraints.NotBlank;
 import jakarta.validation.constraints.NotNull;
+import jakarta.validation.constraints.Pattern;
 import jakarta.validation.constraints.Positive;
 import jakarta.validation.constraints.Size;
 
@@ -14,7 +15,8 @@ public final class ReceivingContainerRequests {
     public record Action(@NotBlank @Size(max = 255) String idempotencyKey) { }
     public record Sign(@NotNull @Size(min = 3, max = 3) List<@Valid SignedPhoto> photos,
                        @NotBlank @Size(max = 255) String idempotencyKey) { }
-    public record SignedPhoto(@NotNull ReceivingPhotoRole role, @Positive long fileId) { }
+    public record SignedPhoto(@NotNull ReceivingPhotoRole role,
+                              @NotBlank @Pattern(regexp = "^[1-9][0-9]{0,18}$") String fileId) { }
     public record CartonResolve(@NotBlank String cartonMark) { }
     public record SkuResolve(@NotBlank @Size(max = 128) String skuCode) { }
     public record PalletResolve(@NotBlank String palletCode, @NotBlank String inboundCode) { }
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/pda/dto/ReceivingContainerResponses.java b/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/pda/dto/ReceivingContainerResponses.java
index 656c83a1a..dda326fbe 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/pda/dto/ReceivingContainerResponses.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/pda/dto/ReceivingContainerResponses.java
@@ -17,7 +17,7 @@ public final class ReceivingContainerResponses {
                           int totalPackages, int receivedPackages, int pendingPackages,
                           List<Inbound> inbounds) { }
 
-    public record SignedPhoto(ReceivingPhotoRole role, long fileId) { }
+    public record SignedPhoto(ReceivingPhotoRole role, String fileId) { }
 
     public record Inbound(String inboundCode, String destinationType,
                           String overseasWarehouseId, String overseasWarehouseName,
@@ -48,5 +48,5 @@ public final class ReceivingContainerResponses {
                           String destinationType, String palletCode, int acceptedPackages,
                           int receivedPackages, int pendingPackages, String sessionStatus) { }
 
-    public record Photo(long fileId, String fileName, String contentType, long sizeBytes) { }
+    public record Photo(String fileId, String fileName, String contentType, long sizeBytes) { }
 }
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/pda/service/ReceivingContainerService.java b/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/pda/service/ReceivingContainerService.java
index 092e88c99..cab86a93b 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/pda/service/ReceivingContainerService.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/pda/service/ReceivingContainerService.java
@@ -169,7 +169,7 @@ public class ReceivingContainerService {
         String customerId = session.getCustomerId();
         if (!"WAIT_SIGN".equals(session.getStatus())) throw conflict("Unload photos can only be uploaded before signing");
         UnloadPhotoFileGateway.UploadedFile uploaded = unloadPhotos.upload(customerId, session.getId(), operatorId, file);
-        return new ReceivingContainerResponses.Photo(uploaded.fileId(), uploaded.fileName(), uploaded.contentType(), uploaded.sizeBytes());
+        return new ReceivingContainerResponses.Photo(Long.toString(uploaded.fileId()), uploaded.fileName(), uploaded.contentType(), uploaded.sizeBytes());
     }
 
     @Transactional
@@ -181,7 +181,7 @@ public class ReceivingContainerService {
         String customerId = session.getCustomerId();
         if (!"WAIT_SIGN".equals(session.getStatus())) throw conflict("Container has already been signed");
         List<ReceivingContainerResponses.SignedPhoto> photos = validateSignPhotos(request);
-        List<Long> photoFileIds = photos.stream().map(ReceivingContainerResponses.SignedPhoto::fileId).toList();
+        List<Long> photoFileIds = photos.stream().map(photo -> positiveFileId(photo.fileId())).toList();
         photoFileIds.forEach(fileId -> unloadPhotos.validate(customerId, session.getId(), fileId));
         LocalDateTime now = LocalDateTime.now();
         session.setSignPhotos(write(photos)); session.setStatus("SIGNED"); session.setSignedAt(now);
@@ -513,9 +513,9 @@ public class ReceivingContainerService {
         Set<com.baiyue.lastleg.inboundplan.pda.dto.ReceivingPhotoRole> roles = request.photos().stream()
             .map(ReceivingContainerRequests.SignedPhoto::role).collect(Collectors.toSet());
         if (roles.size() != 3 || roles.contains(null)) throw conflict("Each unload photo role is required exactly once");
-        Set<Long> fileIds = request.photos().stream().map(ReceivingContainerRequests.SignedPhoto::fileId)
+        Set<Long> fileIds = request.photos().stream().map(value -> positiveFileId(value.fileId()))
             .collect(Collectors.toSet());
-        if (fileIds.size() != 3 || fileIds.stream().anyMatch(value -> value == null || value <= 0)) {
+        if (fileIds.size() != 3) {
             throw conflict("Unload photo file IDs must be positive and unique");
         }
         return request.photos().stream()
@@ -523,6 +523,16 @@ public class ReceivingContainerService {
             .map(value -> new ReceivingContainerResponses.SignedPhoto(value.role(), value.fileId())).toList();
     }
 
+    private long positiveFileId(String value) {
+        try {
+            long fileId = Long.parseLong(value);
+            if (fileId > 0) return fileId;
+        } catch (NumberFormatException ignored) {
+            // Validation normally rejects this before the service; keep the domain fail-closed.
+        }
+        throw conflict("Unload photo file ID must be a positive decimal string");
+    }
+
     private SkuRef requireSku(InboundRef ref, String skuCode) {
         SkuRef result = skuRef(ref, skuCode);
         if (result == null) throw notFound("SKU is not part of the selected inbound code");
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/service/InboundPlanService.java b/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/service/InboundPlanService.java
index 7e43558ff..90e8c7df0 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/service/InboundPlanService.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/service/InboundPlanService.java
@@ -18,6 +18,7 @@ import com.baiyue.lastleg.inboundplan.mapper.InboundPlanPalletAllocationMapper;
 import com.baiyue.lastleg.inboundplan.mapper.InboundPlanPalletMapper;
 import com.baiyue.lastleg.inboundplan.mapper.InboundPlanQueryMapper;
 import com.baiyue.lastleg.inboundplan.model.SourceOrderSnapshot;
+import com.baiyue.lastleg.inventory.mapper.InventoryBalanceMapper;
 import jakarta.annotation.Resource;
 import org.springframework.http.HttpStatus;
 import org.springframework.stereotype.Service;
@@ -41,6 +42,7 @@ public class InboundPlanService {
     @Resource private InboundPlanPalletAllocationMapper allocationMapper;
     @Resource private InboundPlanOrderMapper orderMapper;
     @Resource private InboundPlanQueryMapper queryMapper;
+    @Resource private InventoryBalanceMapper inventoryBalanceMapper;
 
     @Transactional(readOnly = true)
     public PageResult<InboundPlanListResponse> page(String customerId, InboundPlanRequests.Query query) {
@@ -147,6 +149,8 @@ public class InboundPlanService {
             if (orderMapper.markPlanned(customerId, order.orderId(), plan.getPlanNo(), count, now) != 1) {
                 throw new IllegalStateException("Failed to update order " + order.orderId());
             }
+            inventoryBalanceMapper.bindInboundPlan(customerId, order.orderId(), order.inboundCode(),
+                plan.getPlanNo(), now);
             orderMapper.insertHistory(customerId, order.orderId(), order.currentStatus(),
                 "Inbound order converted to inbound plan " + plan.getPlanNo(), now);
         }
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/inventory/mapper/InventoryBalanceMapper.java b/lastleg-service/src/main/java/com/baiyue/lastleg/inventory/mapper/InventoryBalanceMapper.java
index 437a9dcab..9fddae72c 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/inventory/mapper/InventoryBalanceMapper.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/inventory/mapper/InventoryBalanceMapper.java
@@ -5,7 +5,9 @@ import com.baiyue.lastleg.inventory.model.InventorySummary;
 import com.baomidou.mybatisplus.core.mapper.BaseMapper;
 import org.apache.ibatis.annotations.Param;
 import org.apache.ibatis.annotations.Select;
+import org.apache.ibatis.annotations.Update;
 
+import java.time.LocalDateTime;
 import java.util.List;
 
 public interface InventoryBalanceMapper extends BaseMapper<InventoryBalance> {
@@ -29,6 +31,14 @@ public interface InventoryBalanceMapper extends BaseMapper<InventoryBalance> {
                                    @Param("inboundOrderId") Long inboundOrderId,
                                    @Param("inboundCode") String inboundCode);
 
+    @Update("UPDATE ll_inventory_balance SET inbound_order_no=#{planNo},updated_at=#{updatedAt} " +
+        "WHERE customer_id=#{customerId} AND inbound_order_id=#{inboundOrderId} AND inbound_code=#{inboundCode}")
+    int bindInboundPlan(@Param("customerId") String customerId,
+                        @Param("inboundOrderId") Long inboundOrderId,
+                        @Param("inboundCode") String inboundCode,
+                        @Param("planNo") String planNo,
+                        @Param("updatedAt") LocalDateTime updatedAt);
+
     @Select("<script>SELECT * FROM ll_inventory_balance WHERE customer_id=#{customerId}" +
         "<if test='overseasWarehouseId != null and overseasWarehouseId != \"\"'> AND overseas_warehouse_id=#{overseasWarehouseId}</if>" +
         "<if test='destinationWarehouseCode != null and destinationWarehouseCode != \"\"'> AND destination_warehouse_code=#{destinationWarehouseCode}</if>" +
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/masterdata/exchange/ExchangeMapperConfiguration.java b/lastleg-service/src/main/java/com/baiyue/lastleg/masterdata/exchange/ExchangeMapperConfiguration.java
deleted file mode 100644
index 7a1d22ad4..000000000
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/masterdata/exchange/ExchangeMapperConfiguration.java
+++ /dev/null
@@ -1,10 +0,0 @@
-package com.baiyue.lastleg.masterdata.exchange;
-
-import org.mybatis.spring.annotation.MapperScan;
-import org.springframework.context.annotation.Configuration;
-
-/** 注册尾程主数据域的所有 Mapper。 */
-@Configuration
-@MapperScan("com.baiyue.lastleg.masterdata")
-public class ExchangeMapperConfiguration {
-}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/palletops/mapper/PdaPalletOperationMapper.java b/lastleg-service/src/main/java/com/baiyue/lastleg/palletops/mapper/PdaPalletOperationMapper.java
index 91be448d6..f28f4c05a 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/palletops/mapper/PdaPalletOperationMapper.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/palletops/mapper/PdaPalletOperationMapper.java
@@ -24,7 +24,7 @@ public interface PdaPalletOperationMapper extends BaseMapper<PdaPalletOperation>
                                      @Param("idempotencyKey") String idempotencyKey);
 
     @Select(CONTENT_SELECT + "WHERE b.overseas_warehouse_id=#{warehouseId} AND p.pallet_id=#{palletId} " +
-        "AND (p.available_packages+p.hold_packages+p.allocated_packages+p.picked_packages+p.receiving_packages)&gt;0 " +
+        "AND (p.available_packages+p.hold_packages+p.allocated_packages+p.picked_packages+p.receiving_packages)>0 " +
         "ORDER BY b.customer_id,b.inbound_code,p.id")
     List<PalletInventoryRow> content(@Param("warehouseId") String warehouseId,
                                      @Param("palletId") long palletId);
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/palletops/service/PdaPalletOperationService.java b/lastleg-service/src/main/java/com/baiyue/lastleg/palletops/service/PdaPalletOperationService.java
index 3bc77d10c..35bcdee74 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/palletops/service/PdaPalletOperationService.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/palletops/service/PdaPalletOperationService.java
@@ -71,6 +71,9 @@ public class PdaPalletOperationService {
 
     public PalletOperationResponses.Operation assemble(PdaWarehouseIdentity identity,
                                                         PalletOperationRequests.Assemble request) {
+        PalletOperationResponses.Operation replay = replayIfPresent(identity, "PALLET_ASSEMBLE",
+            request.idempotencyKey(), request);
+        if (replay != null) return replay;
         Map<String, PalletPhysicalGateway.PalletReference> pallets = resolvePallets(identity.overseasWarehouseId(),
             request.target(), request.sources());
         PalletPhysicalGateway.PalletReference target = pallets.get(code(request.target().palletCode()));
@@ -85,6 +88,9 @@ public class PdaPalletOperationService {
 
     public PalletOperationResponses.Operation disassemble(PdaWarehouseIdentity identity,
                                                            PalletOperationRequests.Disassemble request) {
+        PalletOperationResponses.Operation replay = replayIfPresent(identity, "PALLET_DISASSEMBLE",
+            request.idempotencyKey(), request);
+        if (replay != null) return replay;
         LinkedHashMap<String, PalletOperationRequests.PalletExpectation> expectations = new LinkedHashMap<>();
         expectations.put(code(request.source().palletCode()), request.source());
         request.targets().forEach(value -> expectations.put(code(value.target().palletCode()), value.target()));
@@ -109,6 +115,9 @@ public class PdaPalletOperationService {
 
     public PalletOperationResponses.Operation swap(PdaWarehouseIdentity identity,
                                                     PalletOperationRequests.Swap request) {
+        PalletOperationResponses.Operation replay = replayIfPresent(identity, "PALLET_SWAP",
+            request.idempotencyKey(), request);
+        if (replay != null) return replay;
         Map<String, PalletPhysicalGateway.PalletReference> pallets = resolvePallets(identity.overseasWarehouseId(),
             request.source(), List.of(request.target()));
         PalletPhysicalGateway.PalletReference source = pallets.get(code(request.source().palletCode()));
@@ -129,6 +138,9 @@ public class PdaPalletOperationService {
 
     public PalletOperationResponses.Operation unbind(PdaWarehouseIdentity identity,
                                                       PalletOperationRequests.Unbind request) {
+        PalletOperationResponses.Operation replay = replayIfPresent(identity, "PALLET_UNBIND",
+            request.idempotencyKey(), request);
+        if (replay != null) return replay;
         Map<String, PalletPhysicalGateway.PalletReference> pallets = resolvePallets(identity.overseasWarehouseId(),
             List.of(request.source()));
         PalletPhysicalGateway.PalletReference source = pallets.get(code(request.source().palletCode()));
@@ -264,7 +276,8 @@ public class PdaPalletOperationService {
         ledger.setBusinessType(operation.getOperationType()); ledger.setBusinessOrderId(operation.getId());
         ledger.setBusinessOrderNo(String.valueOf(operation.getId())); ledger.setInboundCode(balance.getInboundCode());
         ledger.setInboundOrderNo(balance.getInboundOrderNo()); ledger.setIdempotencyKey(idempotencyKey);
-        ledger.setStatusFrom("PALLET:" + sourcePallet); ledger.setStatusTo("PALLET:" + targetPallet);
+        ledger.setStatusFrom("OCCUPIED");
+        ledger.setStatusTo("UNBOUND".equals(targetPallet) ? "UNBOUND" : "OCCUPIED");
         ledger.setBeforePackages(before); ledger.setDeltaPackages(delta); ledger.setAfterPackages(after);
         ledger.setOperatorId(identity.operatorKey()); ledger.setRemark(trim(reason));
         ledger.setOccurredAt(LocalDateTime.now()); ledger.setCreatedAt(ledger.getOccurredAt()); ledgers.insert(ledger);
@@ -412,6 +425,15 @@ public class PdaPalletOperationService {
         return value;
     }
 
+    private PalletOperationResponses.Operation replayIfPresent(PdaWarehouseIdentity identity, String type,
+                                                                String key, Object request) {
+        String normalizedKey = required(key, "幂等键不能为空");
+        PdaPalletOperation existing = mapper.findOperation(identity.operatorKey(), normalizedKey);
+        if (existing == null) return null;
+        validateExisting(existing, type, hash(request));
+        return read(existing).asReplay();
+    }
+
     private void saveTransitions(long operationId, List<PalletPhysicalGateway.Transition> transitions) {
         newTransaction.executeWithoutResult(status -> {
             PdaPalletOperation operation = mapper.selectById(operationId);
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/pda/move/service/PdaInventoryMoveService.java b/lastleg-service/src/main/java/com/baiyue/lastleg/pda/move/service/PdaInventoryMoveService.java
index 03be9225d..ab7b71d58 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/pda/move/service/PdaInventoryMoveService.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/pda/move/service/PdaInventoryMoveService.java
@@ -117,8 +117,7 @@ public class PdaInventoryMoveService {
             position.setWarehouseLocationId(target.locationId()); position.setWarehouseLocationCode(target.locationCode());
             position.setVersion(value(position.getVersion()) + 1); position.setUpdatedAt(completedAt);
             positions.updateById(position);
-            ledger(operation, position, balance, operatorKey, key, request.reason(), source.locationCode(),
-                target.locationCode(), completedAt);
+            ledger(operation, position, balance, operatorKey, key, request.reason(), completedAt);
         }
         operation.setPalletVersionAfter(relocated.afterVersion()); operation.setStatus("COMPLETED");
         operation.setCompletedAt(completedAt);
@@ -150,18 +149,18 @@ public class PdaInventoryMoveService {
     }
 
     private void ledger(PdaInventoryMove operation, InventoryPosition position, InventoryBalance balance,
-                        String operator, String key, String reason, String source, String target,
-                        LocalDateTime now) {
+                        String operator, String key, String reason, LocalDateTime now) {
         InventoryLedger row = new InventoryLedger(); row.setId(IdWorker.getId()); row.setCustomerId(position.getCustomerId());
         row.setBalanceId(balance.getId()); row.setPositionId(position.getId());
         row.setOverseasWarehouseId(String.valueOf(operation.getOverseasWarehouseId()));
         row.setDestinationWarehouseCode(balance.getDestinationWarehouseCode()); row.setInboundOrderId(balance.getInboundOrderId());
         row.setPalletId(position.getPalletId()); row.setPalletNo(position.getPalletNo()); row.setBatchNo(position.getBatchNo());
-        row.setSkuCode(balance.getSkuCode()); row.setWarehouseLocationCode(target); row.setBusinessType("INTERNAL_MOVE");
+        row.setSkuCode(balance.getSkuCode()); row.setWarehouseLocationCode(position.getWarehouseLocationCode());
+        row.setBusinessType("INTERNAL_MOVE");
         row.setBusinessOrderId(operation.getId()); row.setBusinessOrderNo(operation.getMoveNo());
         row.setInboundCode(balance.getInboundCode()); row.setInboundOrderNo(balance.getInboundOrderNo());
         row.setIdempotencyKey("MOVE:" + operation.getId() + ":" + position.getId());
-        row.setStatusFrom(source); row.setStatusTo(target); long packages = physical(position);
+        row.setStatusFrom("OCCUPIED"); row.setStatusTo("OCCUPIED"); long packages = physical(position);
         row.setBeforePackages(packages); row.setDeltaPackages(0L); row.setAfterPackages(packages);
         row.setOperatorId(operator); row.setRemark(reason.trim()); row.setOccurredAt(now); row.setCreatedAt(now);
         ledgers.insert(row);
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/pda/stocktake/mapper/PdaStocktakeItemMapper.java b/lastleg-service/src/main/java/com/baiyue/lastleg/pda/stocktake/mapper/PdaStocktakeItemMapper.java
index e74e61729..4347c6a68 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/pda/stocktake/mapper/PdaStocktakeItemMapper.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/pda/stocktake/mapper/PdaStocktakeItemMapper.java
@@ -55,7 +55,7 @@ public interface PdaStocktakeItemMapper extends BaseMapper<PdaStocktakeItem> {
     int counted(@Param("taskId") long taskId);
 
     @Select("SELECT COUNT(*) FROM ll_pda_stocktake_item WHERE task_id=#{taskId} " +
-        "AND actual_packages IS NOT NULL AND difference_packages&lt;&gt;0")
+        "AND actual_packages IS NOT NULL AND difference_packages<>0")
     int differences(@Param("taskId") long taskId);
 
     @Select("SELECT id item_id,customer_id,balance_id,position_id,sku_code,product_name,inbound_code," +
diff --git a/overseas-security-service/src/main/java/com/baiyue/overseassecurity/controller/OverseasSecurityController.java b/lastleg-service/src/main/java/com/baiyue/lastleg/security/controller/LastlegSecurityController.java
similarity index 60%
rename from overseas-security-service/src/main/java/com/baiyue/overseassecurity/controller/OverseasSecurityController.java
rename to lastleg-service/src/main/java/com/baiyue/lastleg/security/controller/LastlegSecurityController.java
index 05fe60b65..6b3cb5093 100644
--- a/overseas-security-service/src/main/java/com/baiyue/overseassecurity/controller/OverseasSecurityController.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/security/controller/LastlegSecurityController.java
@@ -1,13 +1,13 @@
-package com.baiyue.overseassecurity.controller;
+package com.baiyue.lastleg.security.controller;
 
 import com.baiyue.common.core.api.ApiResponse;
 import com.baiyue.common.event.EventEnvelope;
-import com.baiyue.overseassecurity.dto.OverseasSecurityDtos.Acknowledgement;
-import com.baiyue.overseassecurity.dto.OverseasSecurityDtos.ValidationRequest;
-import com.baiyue.overseassecurity.dto.OverseasSecurityDtos.ValidationResponse;
-import com.baiyue.overseassecurity.security.InternalServiceTokenGuard;
-import com.baiyue.overseassecurity.service.OverseasSecurityValidationService;
-import com.baiyue.overseassecurity.service.SecurityProjectionService;
+import com.baiyue.lastleg.security.InternalServiceTokenGuard;
+import com.baiyue.lastleg.security.dto.LastlegSecurityDtos.Acknowledgement;
+import com.baiyue.lastleg.security.dto.LastlegSecurityDtos.ValidationRequest;
+import com.baiyue.lastleg.security.dto.LastlegSecurityDtos.ValidationResponse;
+import com.baiyue.lastleg.security.service.LastlegSecurityProjectionService;
+import com.baiyue.lastleg.security.service.LastlegSecurityValidationService;
 import io.swagger.v3.oas.annotations.Hidden;
 import jakarta.validation.Valid;
 import org.springframework.web.bind.annotation.PostMapping;
@@ -20,14 +20,15 @@ import java.time.Instant;
 
 @Hidden
 @RestController
-@RequestMapping("/internal/overseas-security/v1")
-public class OverseasSecurityController {
+@RequestMapping("/internal/lastleg/security/v1")
+public class LastlegSecurityController {
     private final InternalServiceTokenGuard tokenGuard;
-    private final SecurityProjectionService projections;
-    private final OverseasSecurityValidationService validations;
+    private final LastlegSecurityProjectionService projections;
+    private final LastlegSecurityValidationService validations;
 
-    public OverseasSecurityController(InternalServiceTokenGuard tokenGuard, SecurityProjectionService projections,
-                                      OverseasSecurityValidationService validations) {
+    public LastlegSecurityController(InternalServiceTokenGuard tokenGuard,
+                                     LastlegSecurityProjectionService projections,
+                                     LastlegSecurityValidationService validations) {
         this.tokenGuard = tokenGuard;
         this.projections = projections;
         this.validations = validations;
diff --git a/overseas-security-service/src/main/java/com/baiyue/overseassecurity/dto/OverseasSecurityDtos.java b/lastleg-service/src/main/java/com/baiyue/lastleg/security/dto/LastlegSecurityDtos.java
similarity index 74%
rename from overseas-security-service/src/main/java/com/baiyue/overseassecurity/dto/OverseasSecurityDtos.java
rename to lastleg-service/src/main/java/com/baiyue/lastleg/security/dto/LastlegSecurityDtos.java
index 7560da9b2..cb301fd7f 100644
--- a/overseas-security-service/src/main/java/com/baiyue/overseassecurity/dto/OverseasSecurityDtos.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/security/dto/LastlegSecurityDtos.java
@@ -1,26 +1,29 @@
-package com.baiyue.overseassecurity.dto;
+package com.baiyue.lastleg.security.dto;
 
 import jakarta.validation.constraints.Min;
 import jakarta.validation.constraints.NotNull;
 
 import java.time.Instant;
 
-public final class OverseasSecurityDtos {
-    private OverseasSecurityDtos() { }
+public final class LastlegSecurityDtos {
+    private LastlegSecurityDtos() { }
 
     public record Acknowledgement(String eventId, String result, Instant receivedAt) { }
 
     public record ValidationRequest(@NotNull @Min(1) Long userId,
                                     @NotNull @Min(0) Long tenantId,
-                                    @NotNull @Min(0) Long tokenVersion,
                                     @NotNull @Min(0) Long permissionVersion) { }
 
     public record ValidationResponse(boolean valid, FailureReason failureReason) {
         public static ValidationResponse accepted() { return new ValidationResponse(true, null); }
-        public static ValidationResponse rejected(FailureReason reason) { return new ValidationResponse(false, reason); }
+        public static ValidationResponse rejected(FailureReason reason) {
+            return new ValidationResponse(false, reason);
+        }
     }
 
     public enum FailureReason {
+        SECURITY_PROJECTION_MISSING,
+        SECURITY_PROJECTION_NOT_READY,
         USER_DISABLED,
         TENANT_DISABLED,
         PERMISSION_VERSION_STALE
diff --git a/overseas-security-service/src/main/java/com/baiyue/overseassecurity/service/SecurityProjectionRedisMirror.java b/lastleg-service/src/main/java/com/baiyue/lastleg/security/service/LastlegSecurityProjectionRedisMirror.java
similarity index 82%
rename from overseas-security-service/src/main/java/com/baiyue/overseassecurity/service/SecurityProjectionRedisMirror.java
rename to lastleg-service/src/main/java/com/baiyue/lastleg/security/service/LastlegSecurityProjectionRedisMirror.java
index e022e01cb..5e888487b 100644
--- a/overseas-security-service/src/main/java/com/baiyue/overseassecurity/service/SecurityProjectionRedisMirror.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/security/service/LastlegSecurityProjectionRedisMirror.java
@@ -1,4 +1,4 @@
-package com.baiyue.overseassecurity.service;
+package com.baiyue.lastleg.security.service;
 
 import com.fasterxml.jackson.databind.ObjectMapper;
 import lombok.extern.slf4j.Slf4j;
@@ -11,19 +11,19 @@ import org.springframework.transaction.event.TransactionalEventListener;
 /** 非授权真相的可重建 Redis 镜像；失败不影响已提交的 MySQL 投影。 */
 @Component
 @Slf4j
-public class SecurityProjectionRedisMirror {
+public class LastlegSecurityProjectionRedisMirror {
     private final StringRedisTemplate redis;
     private final ObjectMapper objectMapper;
     @Value("${baiyue.security.permission-snapshot-key-prefix:baiyue:permission-snapshot}")
     private String keyPrefix;
 
-    public SecurityProjectionRedisMirror(StringRedisTemplate redis, ObjectMapper objectMapper) {
+    public LastlegSecurityProjectionRedisMirror(StringRedisTemplate redis, ObjectMapper objectMapper) {
         this.redis = redis;
         this.objectMapper = objectMapper;
     }
 
     @TransactionalEventListener(phase = TransactionPhase.AFTER_COMMIT)
-    public void mirror(SecurityProjectionService.ProjectionChanged event) {
+    public void mirror(LastlegSecurityProjectionService.ProjectionChanged event) {
         var value = event.projection();
         try {
             redis.opsForValue().set(keyPrefix + ':' + value.aggregateType() + ':' + value.aggregateId(),
diff --git a/overseas-security-service/src/main/java/com/baiyue/overseassecurity/service/SecurityProjectionService.java b/lastleg-service/src/main/java/com/baiyue/lastleg/security/service/LastlegSecurityProjectionService.java
similarity index 66%
rename from overseas-security-service/src/main/java/com/baiyue/overseassecurity/service/SecurityProjectionService.java
rename to lastleg-service/src/main/java/com/baiyue/lastleg/security/service/LastlegSecurityProjectionService.java
index d76d77932..dcfe0ab4b 100644
--- a/overseas-security-service/src/main/java/com/baiyue/overseassecurity/service/SecurityProjectionService.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/security/service/LastlegSecurityProjectionService.java
@@ -1,8 +1,10 @@
-package com.baiyue.overseassecurity.service;
+package com.baiyue.lastleg.security.service;
 
 import com.baiyue.common.core.api.ResultCode;
 import com.baiyue.common.core.exception.BizException;
 import com.baiyue.common.event.EventEnvelope;
+import com.baiyue.common.event.EventPayloadCanonicalizer;
+import com.baiyue.common.event.EventPayloadHash;
 import com.baiyue.common.event.EventTypes;
 import com.baiyue.common.event.IamSecurityEventsV1;
 import com.baiyue.common.event.RegionCode;
@@ -15,17 +17,19 @@ import org.springframework.transaction.annotation.Transactional;
 
 import java.time.Instant;
 import java.util.List;
+import java.util.Locale;
 import java.util.Objects;
 
 @Service
-public class SecurityProjectionService {
+public class LastlegSecurityProjectionService {
     private static final List<String> TYPES = List.of(EventTypes.IAM_USER_STATUS_CHANGED,
             EventTypes.IAM_TENANT_STATUS_CHANGED, EventTypes.IAM_PERMISSION_VERSION_CHANGED);
     private final JdbcTemplate jdbc;
     private final ObjectMapper objectMapper;
     private final ApplicationEventPublisher events;
 
-    public SecurityProjectionService(JdbcTemplate jdbc, ObjectMapper objectMapper, ApplicationEventPublisher events) {
+    public LastlegSecurityProjectionService(JdbcTemplate jdbc, ObjectMapper objectMapper,
+                                             ApplicationEventPublisher events) {
         this.jdbc = jdbc;
         this.objectMapper = objectMapper;
         this.events = events;
@@ -35,35 +39,38 @@ public class SecurityProjectionService {
     public ConsumeResult consume(EventEnvelope envelope) {
         envelope.requireValid();
         requireSecurityEnvelope(envelope);
+        String payloadHash = validatedStorageHash(envelope);
         String payloadJson = envelope.payload().toString();
         try {
-            jdbc.update("INSERT INTO overseas_security_event_inbox(event_id,event_type,payload_hash,payload_json,status,received_at) "
+            jdbc.update("INSERT INTO ll_security_event_inbox(event_id,event_type,payload_hash,payload_json,status,received_at) "
                     + "VALUES (?,?,?,?, 'RECEIVED', NOW(3))", envelope.eventId(), envelope.eventType(),
-                    envelope.payloadHash(), payloadJson);
+                    payloadHash, payloadJson);
         } catch (DuplicateKeyException duplicate) {
-            InboxRow existing = jdbc.queryForObject("SELECT event_type,payload_hash,status FROM overseas_security_event_inbox "
+            InboxRow existing = jdbc.queryForObject(
+                    "SELECT event_type,payload_hash,status FROM ll_security_event_inbox "
                             + "WHERE event_id=? FOR UPDATE",
                     (rs, row) -> new InboxRow(rs.getString(1), rs.getString(2), rs.getString(3)),
                     envelope.eventId());
             if (existing == null || !Objects.equals(existing.eventType(), envelope.eventType())
-                    || !Objects.equals(existing.payloadHash(), envelope.payloadHash())) {
+                    || existing.payloadHash() == null
+                    || !existing.payloadHash().equalsIgnoreCase(payloadHash)) {
                 throw new BizException(ResultCode.CONFLICT, "相同 eventId 的 payloadHash 冲突");
             }
             if ("PROCESSED".equals(existing.status())) return new ConsumeResult("DUPLICATE", null);
         }
 
-        ProjectionInput input = input(envelope);
+        ProjectionInput input = input(envelope, payloadHash);
         ProjectionRow current = findForUpdate(input.aggregateType(), input.aggregateId());
-        ProjectionMonotonicity.Decision decision = ProjectionMonotonicity.decide(
+        SecurityProjectionMonotonicity.Decision decision = SecurityProjectionMonotonicity.decide(
                 current == null ? null : current.aggregateVersion(), current == null ? null : current.payloadHash(),
                 input.aggregateVersion(), input.payloadHash());
         String result = decision.name();
-        if (decision == ProjectionMonotonicity.Decision.APPLY) {
+        if (decision == SecurityProjectionMonotonicity.Decision.APPLY) {
             upsert(input);
             result = "APPLIED";
             events.publishEvent(new ProjectionChanged(input));
         }
-        jdbc.update("UPDATE overseas_security_event_inbox SET status='PROCESSED',result=?,processed_at=NOW(3) "
+        jdbc.update("UPDATE ll_security_event_inbox SET status='PROCESSED',result=?,processed_at=NOW(3) "
                 + "WHERE event_id=?", result, envelope.eventId());
         return new ConsumeResult(result, input);
     }
@@ -75,31 +82,48 @@ public class SecurityProjectionService {
         }
     }
 
-    private ProjectionInput input(EventEnvelope envelope) {
+    static String validatedStorageHash(EventEnvelope envelope) {
+        if (!EventPayloadHash.matches(EventPayloadCanonicalizer.canonicalize(envelope.payload()),
+                envelope.payloadHash())) {
+            throw new BizException(ResultCode.BAD_REQUEST, "payloadHash 与 IAM 安全事件负载不一致");
+        }
+        // 表内只保存固定 64 位摘要；信封传输契约仍保留 sha256: 前缀。
+        return envelope.payloadHash().substring("sha256:".length()).toLowerCase(Locale.ROOT);
+    }
+
+    private ProjectionInput input(EventEnvelope envelope, String payloadHash) {
         try {
             return switch (envelope.eventType()) {
                 case EventTypes.IAM_USER_STATUS_CHANGED -> {
-                    var value = objectMapper.treeToValue(envelope.payload(), IamSecurityEventsV1.UserStatusChanged.class);
+                    var value = objectMapper.treeToValue(envelope.payload(),
+                            IamSecurityEventsV1.UserStatusChanged.class);
                     requireIdentity(envelope, "USER", value.authUserId(), value.tenantId());
-                    requirePayload(value.status(), value.changedAt(), value.permissionVersion(), envelope.aggregateVersion());
+                    requirePayload(value.status(), value.changedAt(), value.permissionVersion(),
+                            envelope.aggregateVersion());
+                    requireStatus(value.status());
                     yield new ProjectionInput("USER", String.valueOf(value.authUserId()), value.tenantId(),
-                            value.status(), value.permissionVersion(), envelope.aggregateVersion(), envelope.payloadHash(),
-                            envelope.eventId(), value.changedAt());
+                            value.status(), value.permissionVersion(), envelope.aggregateVersion(),
+                            payloadHash, envelope.eventId(), value.changedAt());
                 }
                 case EventTypes.IAM_TENANT_STATUS_CHANGED -> {
-                    var value = objectMapper.treeToValue(envelope.payload(), IamSecurityEventsV1.TenantStatusChanged.class);
+                    var value = objectMapper.treeToValue(envelope.payload(),
+                            IamSecurityEventsV1.TenantStatusChanged.class);
                     requireIdentity(envelope, "TENANT", value.tenantId(), value.tenantId());
-                    requirePayload(value.status(), value.changedAt(), envelope.aggregateVersion(), envelope.aggregateVersion());
+                    requirePayload(value.status(), value.changedAt(), envelope.aggregateVersion(),
+                            envelope.aggregateVersion());
+                    requireStatus(value.status());
                     yield new ProjectionInput("TENANT", String.valueOf(value.tenantId()), value.tenantId(),
-                            value.status(), null, envelope.aggregateVersion(), envelope.payloadHash(), envelope.eventId(),
-                            value.changedAt());
+                            value.status(), null, envelope.aggregateVersion(), payloadHash,
+                            envelope.eventId(), value.changedAt());
                 }
                 case EventTypes.IAM_PERMISSION_VERSION_CHANGED -> {
-                    var value = objectMapper.treeToValue(envelope.payload(), IamSecurityEventsV1.PermissionVersionChanged.class);
+                    var value = objectMapper.treeToValue(envelope.payload(),
+                            IamSecurityEventsV1.PermissionVersionChanged.class);
                     requireIdentity(envelope, "AUTHORIZATION", value.authUserId(), value.tenantId());
-                    requirePayload(value.appCode(), value.changedAt(), value.permissionVersion(), envelope.aggregateVersion());
+                    requirePayload(value.appCode(), value.changedAt(), value.permissionVersion(),
+                            envelope.aggregateVersion());
                     yield new ProjectionInput("AUTHORIZATION", String.valueOf(value.authUserId()), value.tenantId(),
-                            null, value.permissionVersion(), envelope.aggregateVersion(), envelope.payloadHash(),
+                            null, value.permissionVersion(), envelope.aggregateVersion(), payloadHash,
                             envelope.eventId(), value.changedAt());
                 }
                 default -> throw new IllegalArgumentException("unsupported type");
@@ -111,7 +135,8 @@ public class SecurityProjectionService {
         }
     }
 
-    private static void requireIdentity(EventEnvelope envelope, String aggregateType, long aggregateId, long tenantId) {
+    private static void requireIdentity(EventEnvelope envelope, String aggregateType,
+                                        long aggregateId, long tenantId) {
         if (!aggregateType.equals(envelope.aggregateType())
                 || !String.valueOf(aggregateId).equals(envelope.aggregateId())
                 || !String.valueOf(tenantId).equals(envelope.tenantId())) {
@@ -119,28 +144,38 @@ public class SecurityProjectionService {
         }
     }
 
-    private static void requirePayload(String requiredText, Instant changedAt, long payloadVersion, long aggregateVersion) {
-        if (requiredText == null || requiredText.isBlank() || changedAt == null || payloadVersion != aggregateVersion) {
+    private static void requirePayload(String requiredText, Instant changedAt,
+                                       long payloadVersion, long aggregateVersion) {
+        if (requiredText == null || requiredText.isBlank() || changedAt == null
+                || payloadVersion != aggregateVersion) {
             throw new BizException(ResultCode.CONFLICT, "IAM 安全事件 payload 版本或必填字段无效");
         }
     }
 
+    private static void requireStatus(String status) {
+        if (!"ACTIVE".equals(status) && !"DISABLED".equals(status)) {
+            throw new BizException(ResultCode.BAD_REQUEST, "IAM 安全状态仅允许 ACTIVE 或 DISABLED");
+        }
+    }
+
     private ProjectionRow findForUpdate(String type, String id) {
-        List<ProjectionRow> rows = jdbc.query("SELECT aggregate_version,payload_hash FROM overseas_security_projection "
+        List<ProjectionRow> rows = jdbc.query(
+                "SELECT aggregate_version,payload_hash FROM ll_security_projection "
                         + "WHERE aggregate_type=? AND aggregate_id=? FOR UPDATE",
                 (rs, row) -> new ProjectionRow(rs.getLong(1), rs.getString(2)), type, id);
         return rows.isEmpty() ? null : rows.get(0);
     }
 
     private void upsert(ProjectionInput value) {
-        jdbc.update("INSERT INTO overseas_security_projection(aggregate_type,aggregate_id,tenant_id,security_status,"
+        jdbc.update("INSERT INTO ll_security_projection(aggregate_type,aggregate_id,tenant_id,security_status,"
                         + "permission_version,aggregate_version,payload_hash,last_event_id,changed_at,updated_at) "
                         + "VALUES (?,?,?,?,?,?,?,?,?,NOW(3)) ON DUPLICATE KEY UPDATE tenant_id=VALUES(tenant_id),"
                         + "security_status=VALUES(security_status),permission_version=VALUES(permission_version),"
                         + "aggregate_version=VALUES(aggregate_version),payload_hash=VALUES(payload_hash),"
                         + "last_event_id=VALUES(last_event_id),changed_at=VALUES(changed_at),updated_at=NOW(3)",
-                value.aggregateType(), value.aggregateId(), value.tenantId(), value.status(), value.permissionVersion(),
-                value.aggregateVersion(), value.payloadHash(), value.eventId(), value.changedAt());
+                value.aggregateType(), value.aggregateId(), value.tenantId(), value.status(),
+                value.permissionVersion(), value.aggregateVersion(), value.payloadHash(), value.eventId(),
+                value.changedAt());
     }
 
     private record InboxRow(String eventType, String payloadHash, String status) { }
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/security/service/LastlegSecurityValidationService.java b/lastleg-service/src/main/java/com/baiyue/lastleg/security/service/LastlegSecurityValidationService.java
new file mode 100644
index 000000000..b23605379
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/security/service/LastlegSecurityValidationService.java
@@ -0,0 +1,60 @@
+package com.baiyue.lastleg.security.service;
+
+import com.baiyue.lastleg.security.dto.LastlegSecurityDtos.FailureReason;
+import com.baiyue.lastleg.security.dto.LastlegSecurityDtos.ValidationRequest;
+import com.baiyue.lastleg.security.dto.LastlegSecurityDtos.ValidationResponse;
+import org.springframework.jdbc.core.JdbcTemplate;
+import org.springframework.stereotype.Service;
+
+import java.util.List;
+
+@Service
+public class LastlegSecurityValidationService {
+    private final JdbcTemplate jdbc;
+
+    public LastlegSecurityValidationService(JdbcTemplate jdbc) {
+        this.jdbc = jdbc;
+    }
+
+    public ValidationResponse validate(ValidationRequest request) {
+        String userStatus = status("USER", String.valueOf(request.userId()), request.tenantId());
+        if (userStatus == null) {
+            return ValidationResponse.rejected(FailureReason.SECURITY_PROJECTION_MISSING);
+        }
+        if (!"ACTIVE".equals(userStatus)) {
+            return ValidationResponse.rejected(FailureReason.USER_DISABLED);
+        }
+        if (request.tenantId() > 0) {
+            String tenantStatus = status("TENANT", String.valueOf(request.tenantId()), request.tenantId());
+            if (tenantStatus == null) {
+                return ValidationResponse.rejected(FailureReason.SECURITY_PROJECTION_MISSING);
+            }
+            if (!"ACTIVE".equals(tenantStatus)) {
+                return ValidationResponse.rejected(FailureReason.TENANT_DISABLED);
+            }
+        }
+        List<Long> projectedVersions = jdbc.query(
+                "SELECT MAX(permission_version) FROM ll_security_projection "
+                        + "WHERE aggregate_id=? AND tenant_id=? "
+                        + "AND aggregate_type IN ('USER','AUTHORIZATION') HAVING COUNT(permission_version)>0",
+                (rs, row) -> rs.getLong(1), String.valueOf(request.userId()), request.tenantId());
+        if (projectedVersions.isEmpty()) {
+            return ValidationResponse.rejected(FailureReason.SECURITY_PROJECTION_MISSING);
+        }
+        long projectedVersion = projectedVersions.get(0);
+        if (request.permissionVersion() < projectedVersion) {
+            return ValidationResponse.rejected(FailureReason.PERMISSION_VERSION_STALE);
+        }
+        if (request.permissionVersion() > projectedVersion) {
+            return ValidationResponse.rejected(FailureReason.SECURITY_PROJECTION_NOT_READY);
+        }
+        return ValidationResponse.accepted();
+    }
+
+    private String status(String type, String id, long tenantId) {
+        List<String> values = jdbc.query("SELECT security_status FROM ll_security_projection "
+                        + "WHERE aggregate_type=? AND aggregate_id=? AND tenant_id=?",
+                (rs, row) -> rs.getString(1), type, id, tenantId);
+        return values.isEmpty() ? null : values.get(0);
+    }
+}
diff --git a/overseas-security-service/src/main/java/com/baiyue/overseassecurity/service/ProjectionMonotonicity.java b/lastleg-service/src/main/java/com/baiyue/lastleg/security/service/SecurityProjectionMonotonicity.java
similarity index 82%
rename from overseas-security-service/src/main/java/com/baiyue/overseassecurity/service/ProjectionMonotonicity.java
rename to lastleg-service/src/main/java/com/baiyue/lastleg/security/service/SecurityProjectionMonotonicity.java
index 958e5e44b..4085bc4de 100644
--- a/overseas-security-service/src/main/java/com/baiyue/overseassecurity/service/ProjectionMonotonicity.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/security/service/SecurityProjectionMonotonicity.java
@@ -1,12 +1,12 @@
-package com.baiyue.overseassecurity.service;
+package com.baiyue.lastleg.security.service;
 
 import com.baiyue.common.core.api.ResultCode;
 import com.baiyue.common.core.exception.BizException;
 
 import java.util.Objects;
 
-final class ProjectionMonotonicity {
-    private ProjectionMonotonicity() { }
+final class SecurityProjectionMonotonicity {
+    private SecurityProjectionMonotonicity() { }
 
     static Decision decide(Long currentVersion, String currentHash, long incomingVersion, String incomingHash) {
         if (currentVersion == null || incomingVersion > currentVersion) return Decision.APPLY;
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/service/LoadingCompletedConsumer.java b/lastleg-service/src/main/java/com/baiyue/lastleg/service/LoadingCompletedConsumer.java
index 0fcdae84e..f904547a6 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/service/LoadingCompletedConsumer.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/service/LoadingCompletedConsumer.java
@@ -7,8 +7,6 @@ import com.baiyue.lastleg.dropship.dto.DropshipRequests;
 import com.baiyue.lastleg.dropship.service.DropshipOrderService;
 import com.baiyue.lastleg.inboundplan.entity.InboundPlanCarton;
 import com.baiyue.lastleg.inboundplan.mapper.InboundPlanCartonMapper;
-import com.baiyue.lastleg.inboundplan.service.InboundPlanService;
-import com.baiyue.lastleg.inboundplan.dto.InboundPlanResponse;
 import com.baiyue.lastleg.inventory.command.dto.InventoryCommandRequests;
 import com.baiyue.lastleg.inventory.command.service.InventoryCommandService;
 import com.baiyue.lastleg.shipping.mapper.ContainerShippingGateMapper;
@@ -37,7 +35,6 @@ public class LoadingCompletedConsumer {
     @Resource private LastlegOrderDetailMapper detailMapper;
     @Resource private LastlegOrderStatusHistoryMapper historyMapper;
     @Resource private InboundPlanCartonMapper cartonMapper;
-    @Resource private InboundPlanService inboundPlans;
     @Resource private ObjectMapper objectMapper;
     @Resource private LastlegOrderNoGenerator orderNoGenerator;
     @Resource private DropshipOrderService dropshipOrders;
@@ -228,12 +225,9 @@ public class LoadingCompletedConsumer {
         history.setOrderId(order.getId()); history.setToStatus("PENDING_ASSIGNMENT"); history.setEventId(event.eventId());
         history.setRemark("头程装柜完成自动生成"); history.setCreatedAt(LocalDateTime.now()); historyMapper.insert(history);
         if ("FIRST_LEG".equals(orderType)) {
-            List<String> sourcePalletNos = source.pallets() == null ? List.of() : source.pallets().stream()
-                .map(FirstLegLoadingPlanCompletedV1.PalletSnapshot::palletNo).filter(Objects::nonNull).toList();
-            InboundPlanResponse plan = sourcePalletNos.isEmpty()
-                ? inboundPlans.convert(customerId, order.getId())
-                : inboundPlans.convert(customerId, order.getId(), sourcePalletNos);
-            registerInTransit(event, payload, source, order, plan.planNo());
+            // The cross-region handover freezes the source inbound code only. An inbound plan is
+            // created later by an explicit platform conversion, which replaces this display snapshot.
+            registerInTransit(event, payload, source, order, source.inboundCode());
         }
         if ("ONE_CLICK_DROPSHIP".equals(orderType)) {
             long warehouseId;
@@ -241,11 +235,6 @@ public class LoadingCompletedConsumer {
             catch (Exception exception) { throw new IllegalArgumentException("One-click dropship warehouseId is invalid", exception); }
             dropshipOrders.receive(new DropshipRequests.Receive(customerId, order.getId(), warehouseId,
                 event.eventId() + ":DROPSHIP", dropshipPallets));
-            InboundPlanResponse plan = inboundPlans.convertDropship(customerId, order.getId(), dropshipPallets.stream()
-                .map(pallet -> new InboundPlanService.WholePalletInput(pallet.palletNo(), pallet.skuPackages().stream()
-                    .mapToInt(sku -> Math.toIntExact(sku.packageCount())).sum()))
-                .toList());
-            registerInTransit(event, payload, source, order, plan.planNo());
         }
     }
 
diff --git a/lastleg-service/src/main/resources/application.yml b/lastleg-service/src/main/resources/application.yml
index dfdda1790..634c08534 100644
--- a/lastleg-service/src/main/resources/application.yml
+++ b/lastleg-service/src/main/resources/application.yml
@@ -75,7 +75,7 @@ baiyue:
       lease-seconds: ${FIRSTLEG_OUTBOX_RELAY_LEASE_SECONDS:60}
       retry-seconds: ${FIRSTLEG_OUTBOX_RELAY_RETRY_SECONDS:30}
   security:
-    internal-service-token: ${INTERNAL_SERVICE_TOKEN:phase1-local-internal-token-at-least-32-bytes}
+    internal-service-token: ${INTERNAL_SERVICE_TOKEN:}
     jwt-mode: jwks
     session-mode: claims
     issuer: ${JWT_ISSUER:auth-service}
diff --git a/lastleg-service/src/main/resources/db/lastleg.sql b/lastleg-service/src/main/resources/db/lastleg.sql
index 4c6221194..f40b89f94 100644
--- a/lastleg-service/src/main/resources/db/lastleg.sql
+++ b/lastleg-service/src/main/resources/db/lastleg.sql
@@ -1750,3 +1750,41 @@ CREATE TABLE IF NOT EXISTS ll_customer_visit (
   KEY idx_ll_customer_visit_list(customer_id,status,delivery_completed_at),
   KEY idx_ll_customer_visit_delivery_no(customer_id,delivery_no)
 ) ENGINE=InnoDB COMMENT='派送单维度客户回访记录';
+CREATE TABLE IF NOT EXISTS ll_security_event_inbox (
+  event_id VARCHAR(64) NOT NULL COMMENT '跨区安全事件ID',
+  event_type VARCHAR(96) NOT NULL COMMENT 'IAM安全事件类型',
+  payload_hash CHAR(64) NOT NULL COMMENT '规范化载荷SHA-256哈希',
+  payload_json JSON NOT NULL COMMENT '冻结事件载荷JSON',
+  status VARCHAR(16) NOT NULL COMMENT '消费状态：RECEIVED或PROCESSED',
+  result VARCHAR(32) NULL COMMENT '处理结果：APPLIED、STALE、DUPLICATE或DUPLICATE_VERSION',
+  received_at DATETIME(3) NOT NULL COMMENT '接收时间',
+  processed_at DATETIME(3) NULL COMMENT '处理完成时间',
+  PRIMARY KEY (event_id),
+  KEY idx_security_inbox_type_time (event_type,received_at)
+) ENGINE=InnoDB COMMENT='海外IAM安全事件消费者收件箱';
+
+CREATE TABLE IF NOT EXISTS ll_security_projection (
+  aggregate_type VARCHAR(32) NOT NULL COMMENT '聚合类型：USER、TENANT或AUTHORIZATION',
+  aggregate_id VARCHAR(64) NOT NULL COMMENT '用户或客户聚合ID',
+  tenant_id BIGINT NOT NULL COMMENT '平台0或客户ID',
+  security_status VARCHAR(24) NULL COMMENT '当前安全状态：ACTIVE或DISABLED',
+  permission_version BIGINT NULL COMMENT '当前单调权限版本',
+  aggregate_version BIGINT NOT NULL COMMENT '事件聚合单调版本',
+  payload_hash CHAR(64) NOT NULL COMMENT '当前版本载荷哈希',
+  last_event_id VARCHAR(64) NOT NULL COMMENT '最后应用的事件ID',
+  changed_at DATETIME(3) NOT NULL COMMENT '国内IAM事实发生时间',
+  updated_at DATETIME(3) NOT NULL COMMENT '投影更新时间',
+  PRIMARY KEY (aggregate_type,aggregate_id),
+  KEY idx_security_projection_tenant (tenant_id),
+  KEY idx_security_projection_permission (aggregate_id,permission_version)
+) ENGINE=InnoDB COMMENT='海外IAM安全状态与权限版本投影';
+
+-- 开发基线固定管理员；后续真实 IAM 事件从 aggregate_version=1 单调覆盖该 version=0 投影。
+INSERT IGNORE INTO ll_security_projection (
+  aggregate_type,aggregate_id,tenant_id,security_status,permission_version,aggregate_version,
+  payload_hash,last_event_id,changed_at,updated_at
+) VALUES
+  ('USER','1000001',0,'ACTIVE',0,0,SHA2('lastleg-baseline:platform_admin:USER:0',256),
+   'baseline-platform-admin-user-v0','1970-01-01 00:00:00.000','1970-01-01 00:00:00.000'),
+  ('AUTHORIZATION','1000001',0,NULL,0,0,SHA2('lastleg-baseline:platform_admin:AUTHORIZATION:0',256),
+   'baseline-platform-admin-authorization-v0','1970-01-01 00:00:00.000','1970-01-01 00:00:00.000');
diff --git a/lastleg-service/src/main/resources/openapi/overseas-business-v1.yaml b/lastleg-service/src/main/resources/openapi/overseas-business-v1.yaml
index 04ae37a68..b01b57ae5 100644
--- a/lastleg-service/src/main/resources/openapi/overseas-business-v1.yaml
+++ b/lastleg-service/src/main/resources/openapi/overseas-business-v1.yaml
@@ -677,7 +677,7 @@ components:
       required: [role, fileId]
       properties:
         role: { type: string, enum: [LICENSE_PLATE, CONTAINER_SEAL, DOOR_OPEN] }
-        fileId: { type: integer, format: int64, minimum: 1 }
+        fileId: { type: string, pattern: '^[1-9][0-9]{0,18}$', description: Snowflake file ID kept as a decimal string }
     ReceivingBulk:
       type: object
       required: [inboundCode, skuCode, palletCode, packageCount, idempotencyKey]
@@ -755,7 +755,7 @@ components:
       type: object
       required: [fileId, fileName, contentType, sizeBytes]
       properties:
-        fileId: { type: integer, format: int64 }
+        fileId: { type: string, pattern: '^[1-9][0-9]{0,18}$', description: Snowflake file ID kept as a decimal string }
         fileName: { type: string }
         contentType: { type: string }
         sizeBytes: { type: integer, format: int64 }
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/inboundplan/pda/service/ReceivingContainerServiceBehaviorTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/inboundplan/pda/service/ReceivingContainerServiceBehaviorTest.java
index fcd4ef4a4..6fedbef7b 100644
--- a/lastleg-service/src/test/java/com/baiyue/lastleg/inboundplan/pda/service/ReceivingContainerServiceBehaviorTest.java
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/inboundplan/pda/service/ReceivingContainerServiceBehaviorTest.java
@@ -304,16 +304,18 @@ class ReceivingContainerServiceBehaviorTest {
         when(sessions.updateById(any(ReceivingContainerSession.class))).thenReturn(1);
         when(operations.insert(any(ReceivingContainerOperation.class))).thenReturn(1);
         ReceivingContainerRequests.Sign request = new ReceivingContainerRequests.Sign(List.of(
-            new ReceivingContainerRequests.SignedPhoto(ReceivingPhotoRole.DOOR_OPEN, 3L),
-            new ReceivingContainerRequests.SignedPhoto(ReceivingPhotoRole.LICENSE_PLATE, 1L),
-            new ReceivingContainerRequests.SignedPhoto(ReceivingPhotoRole.CONTAINER_SEAL, 2L)), "sign-key");
+            new ReceivingContainerRequests.SignedPhoto(ReceivingPhotoRole.DOOR_OPEN, "3"),
+            new ReceivingContainerRequests.SignedPhoto(ReceivingPhotoRole.LICENSE_PLATE, "2092476334483931138"),
+            new ReceivingContainerRequests.SignedPhoto(ReceivingPhotoRole.CONTAINER_SEAL, "2")), "sign-key");
 
         var response = service.sign("7", "receiver", request);
 
         org.assertj.core.api.Assertions.assertThat(response.photos()).extracting("role")
             .containsExactly(ReceivingPhotoRole.LICENSE_PLATE, ReceivingPhotoRole.CONTAINER_SEAL,
                 ReceivingPhotoRole.DOOR_OPEN);
-        verify(unloadPhotos).validate("100", 8L, 1L);
+        org.assertj.core.api.Assertions.assertThat(response.photos()).extracting("fileId")
+            .containsExactly("2092476334483931138", "2", "3");
+        verify(unloadPhotos).validate("100", 8L, 2092476334483931138L);
         verify(unloadPhotos).validate("100", 8L, 2L);
         verify(unloadPhotos).validate("100", 8L, 3L);
     }
@@ -322,9 +324,9 @@ class ReceivingContainerServiceBehaviorTest {
     void signRejectsDuplicateRolesBeforeFileValidation() {
         when(sessions.lockActiveByOperator("OPERATOR:7")).thenReturn(session("CONT-A", "WAIT_SIGN"));
         ReceivingContainerRequests.Sign request = new ReceivingContainerRequests.Sign(List.of(
-            new ReceivingContainerRequests.SignedPhoto(ReceivingPhotoRole.LICENSE_PLATE, 1L),
-            new ReceivingContainerRequests.SignedPhoto(ReceivingPhotoRole.LICENSE_PLATE, 2L),
-            new ReceivingContainerRequests.SignedPhoto(ReceivingPhotoRole.DOOR_OPEN, 3L)), "invalid-sign");
+            new ReceivingContainerRequests.SignedPhoto(ReceivingPhotoRole.LICENSE_PLATE, "1"),
+            new ReceivingContainerRequests.SignedPhoto(ReceivingPhotoRole.LICENSE_PLATE, "2"),
+            new ReceivingContainerRequests.SignedPhoto(ReceivingPhotoRole.DOOR_OPEN, "3")), "invalid-sign");
 
         assertThatThrownBy(() -> service.sign("7", "receiver", request))
             .isInstanceOf(ResponseStatusException.class).hasMessageContaining("409");
@@ -345,9 +347,9 @@ class ReceivingContainerServiceBehaviorTest {
     void signRejectsDuplicateFileIdsBeforeFileValidation() {
         when(sessions.lockActiveByOperator("OPERATOR:7")).thenReturn(session("CONT-A", "WAIT_SIGN"));
         ReceivingContainerRequests.Sign request = new ReceivingContainerRequests.Sign(List.of(
-            new ReceivingContainerRequests.SignedPhoto(ReceivingPhotoRole.LICENSE_PLATE, 1L),
-            new ReceivingContainerRequests.SignedPhoto(ReceivingPhotoRole.CONTAINER_SEAL, 1L),
-            new ReceivingContainerRequests.SignedPhoto(ReceivingPhotoRole.DOOR_OPEN, 3L)), "invalid-files");
+            new ReceivingContainerRequests.SignedPhoto(ReceivingPhotoRole.LICENSE_PLATE, "1"),
+            new ReceivingContainerRequests.SignedPhoto(ReceivingPhotoRole.CONTAINER_SEAL, "1"),
+            new ReceivingContainerRequests.SignedPhoto(ReceivingPhotoRole.DOOR_OPEN, "3")), "invalid-files");
 
         assertThatThrownBy(() -> service.sign("7", "receiver", request))
             .isInstanceOf(ResponseStatusException.class).hasMessageContaining("409");
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/inboundplan/service/InboundPlanServiceTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/inboundplan/service/InboundPlanServiceTest.java
index 8d5586ed1..5b0395ca4 100644
--- a/lastleg-service/src/test/java/com/baiyue/lastleg/inboundplan/service/InboundPlanServiceTest.java
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/inboundplan/service/InboundPlanServiceTest.java
@@ -11,6 +11,7 @@ import com.baiyue.lastleg.inboundplan.mapper.InboundPlanOrderMapper;
 import com.baiyue.lastleg.inboundplan.mapper.InboundPlanPalletAllocationMapper;
 import com.baiyue.lastleg.inboundplan.mapper.InboundPlanPalletMapper;
 import com.baiyue.lastleg.inboundplan.model.SourceOrderSnapshot;
+import com.baiyue.lastleg.inventory.mapper.InventoryBalanceMapper;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.extension.ExtendWith;
@@ -41,6 +42,7 @@ class InboundPlanServiceTest {
     @Mock InboundPlanPalletMapper palletMapper;
     @Mock InboundPlanPalletAllocationMapper allocationMapper;
     @Mock InboundPlanOrderMapper orderMapper;
+    @Mock InventoryBalanceMapper inventoryBalanceMapper;
 
     private InboundPlanService service;
 
@@ -52,6 +54,7 @@ class InboundPlanServiceTest {
         ReflectionTestUtils.setField(service, "palletMapper", palletMapper);
         ReflectionTestUtils.setField(service, "allocationMapper", allocationMapper);
         ReflectionTestUtils.setField(service, "orderMapper", orderMapper);
+        ReflectionTestUtils.setField(service, "inventoryBalanceMapper", inventoryBalanceMapper);
         org.mockito.Mockito.lenient().when(lineMapper.selectList(any())).thenReturn(List.of());
         org.mockito.Mockito.lenient().when(palletMapper.selectList(any())).thenReturn(List.of());
         org.mockito.Mockito.lenient().when(allocationMapper.selectList(any())).thenReturn(List.of());
@@ -89,6 +92,9 @@ class InboundPlanServiceTest {
         assertEquals(1, allocations.getAllValues().stream()
             .filter(item -> "PENDING_COUNT".equals(item.getStatus())).count());
         verify(orderMapper).markPlanned(any(), org.mockito.ArgumentMatchers.eq(2L), any(), org.mockito.ArgumentMatchers.anyInt(), any());
+        verify(inventoryBalanceMapper).bindInboundPlan(org.mockito.ArgumentMatchers.eq("100"),
+            org.mockito.ArgumentMatchers.eq(2L), org.mockito.ArgumentMatchers.eq("RK-2"),
+            org.mockito.ArgumentMatchers.eq(result.planNo()), any());
         verify(orderMapper).insertHistory(any(), org.mockito.ArgumentMatchers.eq(2L), any(), any(), any());
         verify(orderMapper).lockOrder("100", 2L);
         assertEquals(2L, result.sourceOrderId());
@@ -133,6 +139,7 @@ class InboundPlanServiceTest {
         assertEquals(1L, result.sourceOrderId());
         verify(planMapper, never()).insert(any(InboundPlan.class));
         verify(orderMapper, never()).markPlanned(any(), any(), any(), org.mockito.ArgumentMatchers.anyInt(), any());
+        verify(inventoryBalanceMapper, never()).bindInboundPlan(any(), any(), any(), any(), any());
     }
 
     @Test
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/masterdata/MasterDataMapperConfigurationTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/masterdata/MasterDataMapperConfigurationTest.java
index 9bf3ebe8d..a38935e41 100644
--- a/lastleg-service/src/test/java/com/baiyue/lastleg/masterdata/MasterDataMapperConfigurationTest.java
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/masterdata/MasterDataMapperConfigurationTest.java
@@ -5,6 +5,7 @@ import org.junit.jupiter.api.Test;
 import org.mybatis.spring.annotation.MapperScan;
 
 import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
 
 class MasterDataMapperConfigurationTest {
     @Test
@@ -14,4 +15,11 @@ class MasterDataMapperConfigurationTest {
         assertThat(mapperScan.basePackages()).containsExactly("com.baiyue.lastleg.masterdata");
         assertThat(mapperScan.annotationClass()).isEqualTo(Mapper.class);
     }
+
+    @Test
+    void broadExchangeMapperScanMustNotBeReintroduced() {
+        assertThatThrownBy(() -> Class.forName(
+            "com.baiyue.lastleg.masterdata.exchange.ExchangeMapperConfiguration"))
+            .isInstanceOf(ClassNotFoundException.class);
+    }
 }
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/palletops/controller/PdaPalletOperationControllerContractTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/palletops/controller/PdaPalletOperationControllerContractTest.java
index 1f728cc1d..fc8416556 100644
--- a/lastleg-service/src/test/java/com/baiyue/lastleg/palletops/controller/PdaPalletOperationControllerContractTest.java
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/palletops/controller/PdaPalletOperationControllerContractTest.java
@@ -1,5 +1,7 @@
 package com.baiyue.lastleg.palletops.controller;
 
+import com.baiyue.lastleg.palletops.mapper.PdaPalletOperationMapper;
+import org.apache.ibatis.annotations.Select;
 import org.junit.jupiter.api.Test;
 import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.web.bind.annotation.PostMapping;
@@ -24,4 +26,12 @@ class PdaPalletOperationControllerContractTest {
             .flatMap(annotation -> Arrays.stream(annotation.value())).collect(Collectors.toSet());
         assertEquals(Set.of("/pallets/resolve", "/assemble", "/disassemble", "/swap", "/unbind"), paths);
     }
+
+    @Test void palletContentAnnotationUsesNativeGreaterThanOperator() throws Exception {
+        String sql = String.join("", PdaPalletOperationMapper.class.getMethod("content", String.class, long.class)
+            .getAnnotation(Select.class).value());
+        assertTrue(sql.contains("receiving_packages)>0"));
+        assertFalse(sql.contains("&lt;"));
+        assertFalse(sql.contains("&gt;"));
+    }
 }
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/palletops/service/PdaPalletOperationServiceTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/palletops/service/PdaPalletOperationServiceTest.java
index 59301bc76..ed82fcf29 100644
--- a/lastleg-service/src/test/java/com/baiyue/lastleg/palletops/service/PdaPalletOperationServiceTest.java
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/palletops/service/PdaPalletOperationServiceTest.java
@@ -3,6 +3,9 @@ package com.baiyue.lastleg.palletops.service;
 import com.baiyue.lastleg.inventory.mapper.InventoryBalanceMapper;
 import com.baiyue.lastleg.inventory.mapper.InventoryLedgerMapper;
 import com.baiyue.lastleg.inventory.mapper.InventoryPositionMapper;
+import com.baiyue.lastleg.inventory.entity.InventoryBalance;
+import com.baiyue.lastleg.inventory.entity.InventoryLedger;
+import com.baiyue.lastleg.inventory.entity.InventoryPosition;
 import com.baiyue.lastleg.palletops.dto.PalletOperationRequests;
 import com.baiyue.lastleg.palletops.entity.PdaPalletOperation;
 import com.baiyue.lastleg.palletops.gateway.PalletPhysicalGateway;
@@ -15,6 +18,7 @@ import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.extension.ExtendWith;
 import org.mockito.Mock;
+import org.mockito.ArgumentCaptor;
 import org.mockito.junit.jupiter.MockitoExtension;
 import org.springframework.test.util.ReflectionTestUtils;
 import org.springframework.transaction.TransactionDefinition;
@@ -23,6 +27,7 @@ import org.springframework.transaction.support.DefaultTransactionStatus;
 import org.springframework.web.server.ResponseStatusException;
 
 import java.util.List;
+import java.time.LocalDateTime;
 import java.util.concurrent.atomic.AtomicReference;
 
 import static org.junit.jupiter.api.Assertions.*;
@@ -94,6 +99,46 @@ class PdaPalletOperationServiceTest {
         verifyNoInteractions(ledgers, history);
     }
 
+    @Test void inventoryLedgerStoresStateSemanticsInsteadOfLongPalletCodes() {
+        InventoryBalance balance = new InventoryBalance(); balance.setId(200L); balance.setCustomerId("100");
+        balance.setOverseasWarehouseId("88"); balance.setInboundOrderId(300L); balance.setInboundCode("IN-1");
+        InventoryPosition position = new InventoryPosition(); position.setId(100L); position.setPalletId(20L);
+        position.setPalletNo("PDAOPS-ADMIN-API-20260825095854036-SWAP-TARGET");
+        position.setBatchNo("DEFAULT"); position.setWarehouseLocationCode("PDAOPS-LONG-LOCATION-CODE");
+        PdaPalletOperation operation = new PdaPalletOperation(); operation.setId(400L);
+        operation.setOperationType("PALLET_SWAP");
+
+        ReflectionTestUtils.invokeMethod(service, "ledger", identity(), operation, balance, position,
+            "idem:out", 5L, -5L, 0L,
+            "PDAOPS-ADMIN-API-20260825095854036-SOURCE",
+            "PDAOPS-ADMIN-API-20260825095854036-TARGET", "swap");
+
+        ArgumentCaptor<InventoryLedger> ledger = ArgumentCaptor.forClass(InventoryLedger.class);
+        verify(ledgers).insert(ledger.capture());
+        assertEquals("OCCUPIED", ledger.getValue().getStatusFrom());
+        assertEquals("OCCUPIED", ledger.getValue().getStatusTo());
+        assertEquals("PDAOPS-LONG-LOCATION-CODE", ledger.getValue().getWarehouseLocationCode());
+    }
+
+    @Test void exactReplayReturnsStoredResultBeforeValidatingChangedPalletVersions() throws Exception {
+        var request = new PalletOperationRequests.Swap("idem-replay",
+            new PalletOperationRequests.PalletExpectation("SOURCE", 1),
+            new PalletOperationRequests.PalletExpectation("TARGET", 2), "swap");
+        PdaPalletOperation existing = new PdaPalletOperation(); existing.setId(500L);
+        existing.setOperationType("PALLET_SWAP"); existing.setStatus("COMPLETED");
+        existing.setRequestHash(ReflectionTestUtils.invokeMethod(service, "hash", request));
+        var stored = new com.baiyue.lastleg.palletops.dto.PalletOperationResponses.Operation(
+            500L, "PALLET_SWAP", "idem-replay", "COMPLETED", false, LocalDateTime.now(), List.of());
+        existing.setResultJson(new ObjectMapper().findAndRegisterModules().writeValueAsString(stored));
+        when(mapper.findOperation("7", "idem-replay")).thenReturn(existing);
+
+        var replay = service.swap(identity(), request);
+
+        assertTrue(replay.replayed());
+        assertEquals(500L, replay.operationId());
+        verifyNoInteractions(physical);
+    }
+
     private static PdaWarehouseIdentity identity() { return new PdaWarehouseIdentity("7", "picker", 88L); }
     private static PalletPhysicalGateway.PalletReference pallet(long id, String code, long warehouse, int version) {
         return new PalletPhysicalGateway.PalletReference(id, code, warehouse, 1000L + id,
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/pda/PdaInventoryOperationContractTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/pda/PdaInventoryOperationContractTest.java
index eaef73a37..b67a31d65 100644
--- a/lastleg-service/src/test/java/com/baiyue/lastleg/pda/PdaInventoryOperationContractTest.java
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/pda/PdaInventoryOperationContractTest.java
@@ -4,6 +4,8 @@ import com.baiyue.lastleg.pda.move.controller.PdaInventoryMoveController;
 import com.baiyue.lastleg.pda.move.dto.PdaInventoryMoveRequest;
 import com.baiyue.lastleg.pda.stocktake.controller.PdaStocktakeController;
 import com.baiyue.lastleg.pda.stocktake.dto.PdaStocktakeRequests;
+import com.baiyue.lastleg.pda.stocktake.mapper.PdaStocktakeItemMapper;
+import org.apache.ibatis.annotations.Select;
 import org.junit.jupiter.api.Test;
 import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.web.bind.annotation.RequestMapping;
@@ -38,4 +40,11 @@ class PdaInventoryOperationContractTest {
             assertThat(fields).doesNotContainAnyElementsOf(forbidden);
         }
     }
+
+    @Test
+    void stocktakeAnnotationSqlUsesNativeComparisonOperators() throws Exception {
+        String sql = String.join("", PdaStocktakeItemMapper.class.getMethod("differences", long.class)
+            .getAnnotation(Select.class).value());
+        assertThat(sql).contains("difference_packages<>0").doesNotContain("&lt;", "&gt;");
+    }
 }
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/pda/move/service/PdaInventoryMoveServiceTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/pda/move/service/PdaInventoryMoveServiceTest.java
index cdb3714ae..7207e9c2f 100644
--- a/lastleg-service/src/test/java/com/baiyue/lastleg/pda/move/service/PdaInventoryMoveServiceTest.java
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/pda/move/service/PdaInventoryMoveServiceTest.java
@@ -60,9 +60,10 @@ class PdaInventoryMoveServiceTest {
 
     @Test
     void atomicallyRelocatesPhysicalPalletAndEveryWarehouseScopedPosition() {
+        String targetLocationCode = "PDAOPS-ADMIN-API-20260825095854036-MOVE";
         when(warehouse.resolvePallet("PAL-1")).thenReturn(pallet(900L, 20L, 2));
         when(warehouse.resolveLocation(900L, 20L)).thenReturn(location(20L, "A-01"));
-        when(warehouse.resolveLocation(900L, "B-01")).thenReturn(location(21L, "B-01"));
+        when(warehouse.resolveLocation(900L, targetLocationCode)).thenReturn(location(21L, targetLocationCode));
         InventoryPosition position = new InventoryPosition(); position.setId(11L); position.setCustomerId("100");
         position.setBalanceId(10L); position.setOverseasWarehouseId("900"); position.setPalletId(30L);
         position.setPalletNo("PAL-1"); position.setWarehouseLocationId(20L); position.setWarehouseLocationCode("A-01");
@@ -76,7 +77,7 @@ class PdaInventoryMoveServiceTest {
             eq(21L), anyString(), eq("库位优化"))).thenReturn(transition(false));
 
         var response = service.move(900L, "operator-1",
-            new PdaInventoryMoveRequest("PAL-1", "B-01", 2, "move-1", "库位优化"));
+            new PdaInventoryMoveRequest("PAL-1", targetLocationCode, 2, "move-1", "库位优化"));
 
         verify(physical).apply(eq(900L), argThat(value -> value.palletId() == 30L
             && value.locationId() == 20L && value.version() == 2), eq("OCCUPIED"),
@@ -84,11 +85,16 @@ class PdaInventoryMoveServiceTest {
         ArgumentCaptor<InventoryPosition> updated = ArgumentCaptor.forClass(InventoryPosition.class);
         verify(positions).updateById(updated.capture());
         assertThat(updated.getValue().getWarehouseLocationId()).isEqualTo(21L);
-        assertThat(updated.getValue().getWarehouseLocationCode()).isEqualTo("B-01");
+        assertThat(updated.getValue().getWarehouseLocationCode()).isEqualTo(targetLocationCode);
         assertThat(response.packageCount()).isEqualTo(6L);
         assertThat(response.palletVersion()).isEqualTo(3);
         assertThat(response.status()).isEqualTo("COMPLETED");
-        verify(ledgers).insert(any(InventoryLedger.class)); verify(moves).updateById(any(PdaInventoryMove.class));
+        ArgumentCaptor<InventoryLedger> ledger = ArgumentCaptor.forClass(InventoryLedger.class);
+        verify(ledgers).insert(ledger.capture());
+        assertThat(ledger.getValue().getStatusFrom()).isEqualTo("OCCUPIED");
+        assertThat(ledger.getValue().getStatusTo()).isEqualTo("OCCUPIED");
+        assertThat(ledger.getValue().getWarehouseLocationCode()).isEqualTo(targetLocationCode);
+        verify(moves).updateById(any(PdaInventoryMove.class));
     }
 
     @Test
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/security/InternalServiceTokenGuardTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/security/InternalServiceTokenGuardTest.java
index 49b0a41a3..400699222 100644
--- a/lastleg-service/src/test/java/com/baiyue/lastleg/security/InternalServiceTokenGuardTest.java
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/security/InternalServiceTokenGuardTest.java
@@ -9,4 +9,10 @@ class InternalServiceTokenGuardTest {
         assertEquals(401,assertThrows(ResponseStatusException.class,()->guard.verify("wrong")).getStatusCode().value());
         assertEquals(401,assertThrows(ResponseStatusException.class,()->guard.verify(null)).getStatusCode().value());
     }
+
+    @Test void missingServerConfigurationFailsClosed() {
+        InternalServiceTokenGuard guard = new InternalServiceTokenGuard("");
+        assertEquals(503, assertThrows(ResponseStatusException.class,
+                () -> guard.verify("any-token")).getStatusCode().value());
+    }
 }
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/security/LastlegSecurityContractTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/security/LastlegSecurityContractTest.java
new file mode 100644
index 000000000..a004dd8d4
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/security/LastlegSecurityContractTest.java
@@ -0,0 +1,75 @@
+package com.baiyue.lastleg.security;
+
+import org.junit.jupiter.api.Test;
+
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.Path;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+class LastlegSecurityContractTest {
+    @Test void securityProjectionLivesInLastlegDatabaseWithReliableInbox() throws Exception {
+        String baseline = read("lastleg-service/src/main/resources/db/lastleg.sql");
+        String migration = read("deploy/sql/海外区域统一增量-MySQL8.sql");
+        String authSeed = read("auth/src/main/resources/db/phase1-admin-accounts.sql");
+        String service = read("lastleg-service/src/main/java/com/baiyue/lastleg/security/service/LastlegSecurityProjectionService.java");
+        String validation = read("lastleg-service/src/main/java/com/baiyue/lastleg/security/service/LastlegSecurityValidationService.java");
+        String validationDto = read("lastleg-service/src/main/java/com/baiyue/lastleg/security/dto/LastlegSecurityDtos.java");
+        String mirror = read("lastleg-service/src/main/java/com/baiyue/lastleg/security/service/LastlegSecurityProjectionRedisMirror.java");
+        assertThat(baseline).contains("CREATE TABLE IF NOT EXISTS ll_security_event_inbox",
+                "PRIMARY KEY (event_id)", "payload_hash CHAR(64)",
+                "CREATE TABLE IF NOT EXISTS ll_security_projection",
+                "PRIMARY KEY (aggregate_type,aggregate_id)", "aggregate_version BIGINT",
+                "permission_version BIGINT");
+        for (String sql : new String[]{baseline, migration}) {
+            assertThat(sql).contains("('USER','1000001',0,'ACTIVE',0,0",
+                    "('AUTHORIZATION','1000001',0,NULL,0,0",
+                    "baseline-platform-admin-user-v0",
+                    "baseline-platform-admin-authorization-v0")
+                    .doesNotContain("baseline-merchant-admin");
+        }
+        assertThat(authSeed).contains("(1000001, 'platform_admin'", "default_tenant_id",
+                "default_app_code");
+        assertThat(migration).contains("USE baiyue_lastleg;", "table_schema='baiyue_lastleg'")
+                .doesNotContain("CREATE DATABASE IF NOT EXISTS baiyue_overseas_security",
+                        "USE baiyue_overseas_security;", "CREATE TABLE IF NOT EXISTS overseas_security_event_inbox",
+                        "CREATE TABLE IF NOT EXISTS overseas_security_projection");
+        assertThat(service).contains("SecurityProjectionMonotonicity.decide", "Decision.APPLY");
+        assertThat(service).contains("EventPayloadHash.matches", "validatedStorageHash")
+                .doesNotContain("LoadingCompletedConsumer");
+        assertThat(mirror).contains("TransactionPhase.AFTER_COMMIT", "Redis 镜像写入失败");
+        assertThat(validation).contains("SELECT MAX(permission_version)", "tenant_id=?",
+                "SECURITY_PROJECTION_MISSING", "SECURITY_PROJECTION_NOT_READY", "USER_DISABLED",
+                "TENANT_DISABLED", "PERMISSION_VERSION_STALE");
+        assertThat(validationDto).contains("Long userId", "Long tenantId", "Long permissionVersion")
+                .doesNotContain("Long tokenVersion");
+    }
+
+    @Test void genericLastlegEventEndpointWhitelistsBusinessEventsOnly() throws Exception {
+        String controller = read("lastleg-service/src/main/java/com/baiyue/lastleg/controller/LastlegOrderController.java");
+        assertThat(controller).contains("FIRST_LEG_CONTAINER_SHIPPING_NODE_RECORDED",
+                "FIRST_LEG_LOADING_PLAN_COMPLETED", "Lastleg 不消费该事件类型")
+                .doesNotContain("IAM_USER_STATUS_CHANGED", "IAM_TENANT_STATUS_CHANGED",
+                        "IAM_PERMISSION_VERSION_CHANGED");
+    }
+
+    @Test void internalControllerUsesLastlegOwnedPathsAndExistingTokenGuard() throws Exception {
+        String controller = read("lastleg-service/src/main/java/com/baiyue/lastleg/security/controller/LastlegSecurityController.java");
+        String guard = read("lastleg-service/src/main/java/com/baiyue/lastleg/security/InternalServiceTokenGuard.java");
+        String application = read("lastleg-service/src/main/resources/application.yml");
+        assertThat(controller).contains("@RequestMapping(\"/internal/lastleg/security/v1\")",
+                "@PostMapping(\"/events\")", "@PostMapping(\"/validate\")",
+                "com.baiyue.lastleg.security.InternalServiceTokenGuard")
+                .doesNotContain("/internal/overseas-security/v1");
+        assertThat(guard).contains("MessageDigest.isEqual", "SERVICE_UNAVAILABLE", "UNAUTHORIZED");
+        assertThat(application).contains("internal-service-token: ${INTERNAL_SERVICE_TOKEN:}")
+                .doesNotContain("phase1-local-internal-token");
+    }
+
+    private static String read(String relative) throws Exception {
+        Path path = Path.of(relative);
+        if (!Files.exists(path)) path = Path.of("..").resolve(relative);
+        return Files.readString(path, StandardCharsets.UTF_8);
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/security/SecurityProjectionArchitectureTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/security/SecurityProjectionArchitectureTest.java
new file mode 100644
index 000000000..27a8de243
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/security/SecurityProjectionArchitectureTest.java
@@ -0,0 +1,49 @@
+package com.baiyue.lastleg.security;
+
+import com.tngtech.archunit.core.domain.JavaClasses;
+import com.tngtech.archunit.core.importer.ClassFileImporter;
+import com.tngtech.archunit.core.importer.ImportOption;
+import org.junit.jupiter.api.Test;
+
+import static com.tngtech.archunit.core.domain.JavaClass.Predicates.resideInAPackage;
+import static com.tngtech.archunit.core.domain.JavaClass.Predicates.resideOutsideOfPackage;
+import static com.tngtech.archunit.lang.syntax.ArchRuleDefinition.classes;
+import static com.tngtech.archunit.lang.syntax.ArchRuleDefinition.noClasses;
+
+class SecurityProjectionArchitectureTest {
+    private static final String LASTLEG = "com.baiyue.lastleg..";
+    private static final String CONTROLLER = "com.baiyue.lastleg.security.controller..";
+    private static final String DTO = "com.baiyue.lastleg.security.dto..";
+    private static final String SERVICE = "com.baiyue.lastleg.security.service..";
+
+    private static final JavaClasses PRODUCTION_CLASSES = new ClassFileImporter()
+        .withImportOption(ImportOption.Predefined.DO_NOT_INCLUDE_TESTS)
+        .withImportOption(ImportOption.Predefined.DO_NOT_INCLUDE_JARS)
+        .importPackages("com.baiyue.lastleg");
+
+    @Test
+    void projectionInternalsDoNotDependOnLastlegBusinessSlices() {
+        classes().that().resideInAnyPackage(CONTROLLER, DTO, SERVICE)
+            .should().onlyDependOnClassesThat(
+                resideOutsideOfPackage(LASTLEG)
+                    .or(resideInAPackage(CONTROLLER))
+                    .or(resideInAPackage(DTO))
+                    .or(resideInAPackage(SERVICE))
+                    .or(resideInAPackage("com.baiyue.lastleg.security")))
+            .check(PRODUCTION_CLASSES);
+    }
+
+    @Test
+    void businessSlicesDoNotDependOnProjectionInternals() {
+        noClasses().that().resideOutsideOfPackages(CONTROLLER, DTO, SERVICE)
+            .should().dependOnClassesThat().resideInAnyPackage(CONTROLLER, DTO, SERVICE)
+            .check(PRODUCTION_CLASSES);
+    }
+
+    @Test
+    void dtoAndServicesStayIndependentFromInternalWebAdapter() {
+        noClasses().that().resideInAnyPackage(DTO, SERVICE)
+            .should().dependOnClassesThat().resideInAPackage(CONTROLLER)
+            .check(PRODUCTION_CLASSES);
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/security/service/LastlegSecurityProjectionTransportTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/security/service/LastlegSecurityProjectionTransportTest.java
new file mode 100644
index 000000000..39d78d387
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/security/service/LastlegSecurityProjectionTransportTest.java
@@ -0,0 +1,54 @@
+package com.baiyue.lastleg.security.service;
+
+import com.baiyue.common.core.exception.BizException;
+import com.baiyue.common.event.EventEnvelope;
+import com.baiyue.common.event.EventPayloadCanonicalizer;
+import com.baiyue.common.event.EventPayloadHash;
+import com.baiyue.common.event.EventTypes;
+import com.baiyue.common.event.IamSecurityEventsV1;
+import com.baiyue.common.event.RegionCode;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import org.junit.jupiter.api.Test;
+
+import java.time.Instant;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
+
+class LastlegSecurityProjectionTransportTest {
+    private final ObjectMapper objectMapper = new ObjectMapper().findAndRegisterModules();
+
+    @Test
+    void validatesEnvelopeHashAndStoresTheSixtyFourCharacterDigest() {
+        EventEnvelope envelope = envelope();
+
+        String stored = LastlegSecurityProjectionService.validatedStorageHash(envelope);
+
+        assertThat(stored).hasSize(64).doesNotStartWith("sha256:");
+        assertThat(envelope.payloadHash()).isEqualTo("sha256:" + stored);
+    }
+
+    @Test
+    void rejectsTamperedPayloadBeforeInboxMutation() {
+        EventEnvelope source = envelope();
+        EventEnvelope tampered = new EventEnvelope(source.eventId(), source.eventType(), source.eventVersion(),
+            source.occurredAt(), source.sourceRegion(), source.targetRegion(), source.tenantId(),
+            source.aggregateType(), source.aggregateId(), source.aggregateVersion(), source.handoverVersion(),
+            source.traceId(), source.correlationId(), source.causationId(), source.payload(),
+            "sha256:" + "0".repeat(64));
+
+        assertThatThrownBy(() -> LastlegSecurityProjectionService.validatedStorageHash(tampered))
+            .isInstanceOf(BizException.class).hasMessageContaining("payloadHash");
+    }
+
+    private EventEnvelope envelope() {
+        var value = new IamSecurityEventsV1.PermissionVersionChanged(
+            101L, 0L, "PLATFORM", 3L, "contract", Instant.parse("2026-08-25T07:00:00Z"));
+        var payload = objectMapper.valueToTree(value);
+        return new EventEnvelope("00000000-0000-4000-8000-000000000091",
+            EventTypes.IAM_PERMISSION_VERSION_CHANGED, IamSecurityEventsV1.VERSION,
+            Instant.parse("2026-08-25T07:00:00Z"), RegionCode.CN, RegionCode.OVERSEAS, "0",
+            "AUTHORIZATION", "101", 3L, null, "trace-12345678", "correlation-12345678",
+            null, payload, EventPayloadHash.sha256(EventPayloadCanonicalizer.canonicalize(payload)));
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/security/service/LastlegSecurityValidationServiceTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/security/service/LastlegSecurityValidationServiceTest.java
new file mode 100644
index 000000000..5b934e0c6
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/security/service/LastlegSecurityValidationServiceTest.java
@@ -0,0 +1,67 @@
+package com.baiyue.lastleg.security.service;
+
+import com.baiyue.lastleg.security.dto.LastlegSecurityDtos.FailureReason;
+import com.baiyue.lastleg.security.dto.LastlegSecurityDtos.ValidationRequest;
+import org.junit.jupiter.api.Test;
+import org.springframework.jdbc.core.JdbcTemplate;
+import org.springframework.jdbc.core.RowMapper;
+
+import java.util.List;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.anyString;
+import static org.mockito.Mockito.doReturn;
+import static org.mockito.Mockito.mock;
+
+class LastlegSecurityValidationServiceTest {
+    private final JdbcTemplate jdbc = mock(JdbcTemplate.class);
+    private final LastlegSecurityValidationService service = new LastlegSecurityValidationService(jdbc);
+
+    @Test void disabledUserFailsClosed() {
+        doReturn(List.of("DISABLED")).when(jdbc)
+                .query(anyString(), any(RowMapper.class), any(Object[].class));
+        assertThat(service.validate(new ValidationRequest(42L, 0L, 8L)).failureReason())
+                .isEqualTo(FailureReason.USER_DISABLED);
+    }
+
+    @Test void disabledCustomerFailsClosed() {
+        doReturn(List.of("ACTIVE"), List.of("DISABLED")).when(jdbc)
+                .query(anyString(), any(RowMapper.class), any(Object[].class));
+        assertThat(service.validate(new ValidationRequest(42L, 100L, 8L)).failureReason())
+                .isEqualTo(FailureReason.TENANT_DISABLED);
+    }
+
+    @Test void missingUserProjectionFailsClosed() {
+        doReturn(List.of()).when(jdbc)
+                .query(anyString(), any(RowMapper.class), any(Object[].class));
+        assertThat(service.validate(new ValidationRequest(42L, 0L, 8L)).failureReason())
+                .isEqualTo(FailureReason.SECURITY_PROJECTION_MISSING);
+    }
+
+    @Test void customerProjectionIsMandatoryButPlatformTenantDoesNotNeedOne() {
+        doReturn(List.of("ACTIVE"), List.of(), List.of("ACTIVE"), List.of(8L)).when(jdbc)
+                .query(anyString(), any(RowMapper.class), any(Object[].class));
+        assertThat(service.validate(new ValidationRequest(42L, 100L, 8L)).failureReason())
+                .isEqualTo(FailureReason.SECURITY_PROJECTION_MISSING);
+        assertThat(service.validate(new ValidationRequest(42L, 0L, 8L)).valid()).isTrue();
+    }
+
+    @Test void permissionVersionMustExactlyMatchReliableProjection() {
+        doReturn(List.of("ACTIVE"), List.of(9L), List.of("ACTIVE"), List.of(9L),
+                List.of("ACTIVE"), List.of(9L)).when(jdbc)
+                .query(anyString(), any(RowMapper.class), any(Object[].class));
+        assertThat(service.validate(new ValidationRequest(42L, 0L, 8L)).failureReason())
+                .isEqualTo(FailureReason.PERMISSION_VERSION_STALE);
+        assertThat(service.validate(new ValidationRequest(42L, 0L, 10L)).failureReason())
+                .isEqualTo(FailureReason.SECURITY_PROJECTION_NOT_READY);
+        assertThat(service.validate(new ValidationRequest(42L, 0L, 9L)).valid()).isTrue();
+    }
+
+    @Test void missingPermissionProjectionFailsClosed() {
+        doReturn(List.of("ACTIVE"), List.of()).when(jdbc)
+                .query(anyString(), any(RowMapper.class), any(Object[].class));
+        assertThat(service.validate(new ValidationRequest(42L, 0L, 9L)).failureReason())
+                .isEqualTo(FailureReason.SECURITY_PROJECTION_MISSING);
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/security/service/SecurityProjectionMonotonicityTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/security/service/SecurityProjectionMonotonicityTest.java
new file mode 100644
index 000000000..b385e2aea
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/security/service/SecurityProjectionMonotonicityTest.java
@@ -0,0 +1,28 @@
+package com.baiyue.lastleg.security.service;
+
+import com.baiyue.common.core.exception.BizException;
+import org.junit.jupiter.api.Test;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
+
+class SecurityProjectionMonotonicityTest {
+    @Test void appliesFirstAndNewerVersions() {
+        assertThat(SecurityProjectionMonotonicity.decide(null, null, 1, "hash-1"))
+                .isEqualTo(SecurityProjectionMonotonicity.Decision.APPLY);
+        assertThat(SecurityProjectionMonotonicity.decide(1L, "hash-1", 2, "hash-2"))
+                .isEqualTo(SecurityProjectionMonotonicity.Decision.APPLY);
+    }
+
+    @Test void ignoresOlderAndSameHashVersions() {
+        assertThat(SecurityProjectionMonotonicity.decide(3L, "hash-3", 2, "hash-2"))
+                .isEqualTo(SecurityProjectionMonotonicity.Decision.STALE);
+        assertThat(SecurityProjectionMonotonicity.decide(3L, "hash-3", 3, "hash-3"))
+                .isEqualTo(SecurityProjectionMonotonicity.Decision.DUPLICATE_VERSION);
+    }
+
+    @Test void rejectsSameVersionWithDifferentHash() {
+        assertThatThrownBy(() -> SecurityProjectionMonotonicity.decide(3L, "hash-a", 3, "hash-b"))
+                .isInstanceOf(BizException.class).hasMessageContaining("payloadHash 冲突");
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/service/LoadingCompletedConsumerTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/service/LoadingCompletedConsumerTest.java
index 4ebc979bb..bd54604ef 100644
--- a/lastleg-service/src/test/java/com/baiyue/lastleg/service/LoadingCompletedConsumerTest.java
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/service/LoadingCompletedConsumerTest.java
@@ -1,10 +1,10 @@
 package com.baiyue.lastleg.service;
-import com.baiyue.common.event.*; import com.baiyue.lastleg.entity.*; import com.baiyue.lastleg.mapper.*; import com.baiyue.lastleg.dropship.dto.DropshipRequests; import com.baiyue.lastleg.dropship.service.DropshipOrderService; import com.baiyue.lastleg.inboundplan.dto.InboundPlanResponse; import com.baiyue.lastleg.inboundplan.entity.InboundPlanCarton; import com.baiyue.lastleg.inboundplan.mapper.InboundPlanCartonMapper; import com.baiyue.lastleg.inboundplan.service.InboundPlanService; import com.baiyue.lastleg.inventory.command.dto.InventoryCommandRequests; import com.baiyue.lastleg.inventory.command.service.InventoryCommandService; import com.fasterxml.jackson.databind.*; import org.junit.jupiter.api.*; import org.junit.jupiter.api.extension.ExtendWith; import org.mockito.*; import org.springframework.test.util.ReflectionTestUtils; import java.math.BigDecimal; import java.time.Instant; import java.util.*; import static org.junit.jupiter.api.Assertions.*; import static org.mockito.ArgumentMatchers.*; import static org.mockito.Mockito.*;
+import com.baiyue.common.event.*; import com.baiyue.lastleg.entity.*; import com.baiyue.lastleg.mapper.*; import com.baiyue.lastleg.dropship.dto.DropshipRequests; import com.baiyue.lastleg.dropship.service.DropshipOrderService; import com.baiyue.lastleg.inboundplan.entity.InboundPlanCarton; import com.baiyue.lastleg.inboundplan.mapper.InboundPlanCartonMapper; import com.baiyue.lastleg.inventory.command.dto.InventoryCommandRequests; import com.baiyue.lastleg.inventory.command.service.InventoryCommandService; import com.fasterxml.jackson.databind.*; import org.junit.jupiter.api.*; import org.junit.jupiter.api.extension.ExtendWith; import org.mockito.*; import org.springframework.test.util.ReflectionTestUtils; import java.math.BigDecimal; import java.time.Instant; import java.util.*; import static org.junit.jupiter.api.Assertions.*; import static org.mockito.ArgumentMatchers.*; import static org.mockito.Mockito.*;
 @ExtendWith(org.mockito.junit.jupiter.MockitoExtension.class)
 class LoadingCompletedConsumerTest {
- @Mock LastlegEventInboxMapper inbox; @Mock LastlegOrderMapper orders; @Mock LastlegInboundOrderMapper inboundOrders; @Mock LastlegOrderDetailMapper details; @Mock LastlegOrderStatusHistoryMapper histories; @Mock InboundPlanCartonMapper cartons; @Mock DropshipOrderService dropshipOrders; @Mock InboundPlanService inboundPlans; @Mock InventoryCommandService inventory; @Mock com.baiyue.lastleg.shipping.mapper.ContainerShippingGateMapper shippingGates; ObjectMapper json=new ObjectMapper().findAndRegisterModules(); LoadingCompletedConsumer service;
- @BeforeEach void setup(){ service=new LoadingCompletedConsumer(); ReflectionTestUtils.setField(service,"inboxMapper",inbox); ReflectionTestUtils.setField(service,"orderMapper",orders); ReflectionTestUtils.setField(service,"inboundOrderMapper",inboundOrders); ReflectionTestUtils.setField(service,"detailMapper",details); ReflectionTestUtils.setField(service,"historyMapper",histories); ReflectionTestUtils.setField(service,"cartonMapper",cartons); ReflectionTestUtils.setField(service,"dropshipOrders",dropshipOrders); ReflectionTestUtils.setField(service,"inboundPlans",inboundPlans); ReflectionTestUtils.setField(service,"inventory",inventory); ReflectionTestUtils.setField(service,"shippingGates",shippingGates); ReflectionTestUtils.setField(service,"objectMapper",json); ReflectionTestUtils.setField(service,"orderNoGenerator",new LastlegOrderNoGenerator()); lenient().doAnswer(i->{ LastlegOrder o=i.getArgument(0); o.setId(Math.abs(o.getSourceInboundId().hashCode())+1L); return 1; }).when(orders).insert(any(LastlegOrder.class)); var plan=new InboundPlanResponse(1L,"LIP-1","100",1L,"MSCU1","PENDING_ASSIGNMENT",1,1,BigDecimal.ONE,List.of(),List.of(),List.of()); lenient().when(inboundPlans.convert(anyString(),anyLong())).thenReturn(plan); lenient().when(inboundPlans.convertDropship(anyString(),anyLong(),anyList())).thenReturn(plan); }
- @Test void createsOneOrderAndOneInboundPlanPerInbound(){ EventEnvelope event=event(); assertEquals(2,service.consume(event)); verify(orders,times(2)).insert(any(LastlegOrder.class)); verify(inboundPlans,times(2)).convert(eq("100"),anyLong()); verify(inventory,times(2)).registerInTransit(eq("100"),eq("SYSTEM"),any(InventoryCommandRequests.InTransit.class)); verify(details,times(2)).insert(any(LastlegOrderDetail.class)); verify(histories,times(2)).insert(any(LastlegOrderStatusHistory.class)); ArgumentCaptor<LastlegOrder> c=ArgumentCaptor.forClass(LastlegOrder.class); verify(orders,times(2)).insert(c.capture()); assertEquals(Set.of("in-1","in-2"),c.getAllValues().stream().map(LastlegOrder::getSourceInboundId).collect(java.util.stream.Collectors.toSet())); assertTrue(c.getAllValues().stream().allMatch(o->"PENDING_ASSIGNMENT".equals(o.getCurrentStatus()))); assertTrue(c.getAllValues().stream().allMatch(o->o.getId()!=null)); assertTrue(c.getAllValues().stream().allMatch(o->"MSCU1".equals(o.getContainerNo()))); assertTrue(c.getAllValues().stream().allMatch(o->"FBA".equals(o.getDestinationType()))); assertTrue(c.getAllValues().stream().allMatch(o->"ow-1".equals(o.getSourceWarehouseId())&&o.getOverseasWarehouseId()==null)); ArgumentCaptor<LastlegInboundOrder> snapshots=ArgumentCaptor.forClass(LastlegInboundOrder.class); verify(inboundOrders,times(2)).insert(snapshots.capture()); assertTrue(snapshots.getAllValues().stream().allMatch(o->"100".equals(o.getCustomerId())&&"FBA".equals(o.getDestinationType()))); assertEquals(1,c.getAllValues().stream().map(LastlegOrder::getOrderNo).distinct().count()); assertEquals(new LastlegOrderNoGenerator().forContainerNo("MSCU1"),c.getAllValues().get(0).getOrderNo()); }
+ @Mock LastlegEventInboxMapper inbox; @Mock LastlegOrderMapper orders; @Mock LastlegInboundOrderMapper inboundOrders; @Mock LastlegOrderDetailMapper details; @Mock LastlegOrderStatusHistoryMapper histories; @Mock InboundPlanCartonMapper cartons; @Mock DropshipOrderService dropshipOrders; @Mock InventoryCommandService inventory; @Mock com.baiyue.lastleg.shipping.mapper.ContainerShippingGateMapper shippingGates; ObjectMapper json=new ObjectMapper().findAndRegisterModules(); LoadingCompletedConsumer service;
+ @BeforeEach void setup(){ service=new LoadingCompletedConsumer(); ReflectionTestUtils.setField(service,"inboxMapper",inbox); ReflectionTestUtils.setField(service,"orderMapper",orders); ReflectionTestUtils.setField(service,"inboundOrderMapper",inboundOrders); ReflectionTestUtils.setField(service,"detailMapper",details); ReflectionTestUtils.setField(service,"historyMapper",histories); ReflectionTestUtils.setField(service,"cartonMapper",cartons); ReflectionTestUtils.setField(service,"dropshipOrders",dropshipOrders); ReflectionTestUtils.setField(service,"inventory",inventory); ReflectionTestUtils.setField(service,"shippingGates",shippingGates); ReflectionTestUtils.setField(service,"objectMapper",json); ReflectionTestUtils.setField(service,"orderNoGenerator",new LastlegOrderNoGenerator()); lenient().doAnswer(i->{ LastlegOrder o=i.getArgument(0); o.setId(Math.abs(o.getSourceInboundId().hashCode())+1L); return 1; }).when(orders).insert(any(LastlegOrder.class)); }
+ @Test void createsPendingOrdersAndInTransitSnapshotsWithoutInboundPlans(){ EventEnvelope event=event(); assertEquals(2,service.consume(event)); assertThrows(NoSuchFieldException.class,()->LoadingCompletedConsumer.class.getDeclaredField("inboundPlans")); verify(orders,times(2)).insert(any(LastlegOrder.class)); ArgumentCaptor<InventoryCommandRequests.InTransit> inTransit=ArgumentCaptor.forClass(InventoryCommandRequests.InTransit.class); verify(inventory,times(2)).registerInTransit(eq("100"),eq("SYSTEM"),inTransit.capture()); assertEquals(Set.of("RK1","RK2"),inTransit.getAllValues().stream().map(InventoryCommandRequests.InTransit::inboundOrderNo).collect(java.util.stream.Collectors.toSet())); verify(details,times(2)).insert(any(LastlegOrderDetail.class)); verify(histories,times(2)).insert(any(LastlegOrderStatusHistory.class)); ArgumentCaptor<LastlegOrder> c=ArgumentCaptor.forClass(LastlegOrder.class); verify(orders,times(2)).insert(c.capture()); assertEquals(Set.of("in-1","in-2"),c.getAllValues().stream().map(LastlegOrder::getSourceInboundId).collect(java.util.stream.Collectors.toSet())); assertTrue(c.getAllValues().stream().allMatch(o->"PENDING_ASSIGNMENT".equals(o.getCurrentStatus()))); assertTrue(c.getAllValues().stream().allMatch(o->o.getInboundOrderNo()==null)); assertTrue(c.getAllValues().stream().allMatch(o->o.getId()!=null)); assertTrue(c.getAllValues().stream().allMatch(o->"MSCU1".equals(o.getContainerNo()))); assertTrue(c.getAllValues().stream().allMatch(o->"FBA".equals(o.getDestinationType()))); assertTrue(c.getAllValues().stream().allMatch(o->"ow-1".equals(o.getSourceWarehouseId())&&o.getOverseasWarehouseId()==null)); ArgumentCaptor<LastlegInboundOrder> snapshots=ArgumentCaptor.forClass(LastlegInboundOrder.class); verify(inboundOrders,times(2)).insert(snapshots.capture()); assertTrue(snapshots.getAllValues().stream().allMatch(o->"100".equals(o.getCustomerId())&&"FBA".equals(o.getDestinationType()))); assertEquals(1,c.getAllValues().stream().map(LastlegOrder::getOrderNo).distinct().count()); assertEquals(new LastlegOrderNoGenerator().forContainerNo("MSCU1"),c.getAllValues().get(0).getOrderNo()); }
  @Test void loadingCreatesAwaitingPickupReadyGateWithoutPollutingShippingVersion(){ service.consume(event()); verify(shippingGates).initialize("book-1","100","","MSCU1",0L,1L); }
  @Test void repeatedEventReturnsExistingEffect(){ EventEnvelope event=event(); LastlegEventInbox row=new LastlegEventInbox(); row.setPayloadHash(event.payloadHash()); when(inbox.selectById(event.eventId())).thenReturn(row); when(orders.countContainer("100","MSCU1")).thenReturn(2L); assertEquals(2,service.consume(event)); verify(orders).countContainer("100","MSCU1"); verify(orders,never()).insert(any(LastlegOrder.class)); verify(details,never()).insert(any(LastlegOrderDetail.class)); }
  @Test void sameEventWithDifferentHashIsRejected(){ EventEnvelope event=event(); LastlegEventInbox row=new LastlegEventInbox(); row.setPayloadHash("sha256:"+"0".repeat(64)); when(inbox.selectById(event.eventId())).thenReturn(row); assertThrows(IllegalArgumentException.class,()->service.consume(event)); }
@@ -17,7 +17,7 @@ class LoadingCompletedConsumerTest {
   assertTrue(table.contains("customer_id")); assertFalse(table.contains("tenant_id"));
  }
  @Test void rejectsEventFromWrongRegion(){ EventEnvelope source=event(); EventEnvelope invalid=new EventEnvelope(source.eventId(),source.eventType(),source.eventVersion(),source.occurredAt(),RegionCode.OVERSEAS,RegionCode.CN,source.tenantId(),source.aggregateType(),source.aggregateId(),source.aggregateVersion(),source.handoverVersion(),source.traceId(),source.correlationId(),source.causationId(),source.payload(),source.payloadHash()); assertThrows(IllegalArgumentException.class,()->service.consume(invalid)); }
- @Test void consumesFormalDropshipPalletSnapshots(){ var sku=new FirstLegLoadingPlanCompletedV1.SkuPackageSnapshot("SKU-A","Product A",2,20,List.of("BOX-1","BOX-2")); var pallet=new FirstLegLoadingPlanCompletedV1.PalletSnapshot("PLT-1",List.of(sku)); var item=new FirstLegLoadingPlanCompletedV1.Item("d-1","SKU-A","Product A","Product A",2,20,1,BigDecimal.ONE,BigDecimal.ONE,BigDecimal.ONE,BigDecimal.ONE,"wh-1","ONT8","ONT8",null,null,"MARK",null,List.of()); var order=new FirstLegLoadingPlanCompletedV1.Order("in-d","root-d","ord-d","FL-D","root-od","RK-D","wh-1","ONT8","ONT8",2,20,1,BigDecimal.ONE,BigDecimal.ONE,BigDecimal.ONE,List.of(item),"100","ONE_CLICK_DROPSHIP",List.of(pallet),"FBA"); var payload=new FirstLegLoadingPlanCompletedV1("plan-d","LP-D","book-d","CONT-D","CAB-D","92","Warehouse",List.of(order)); JsonNode node=json.valueToTree(payload); String hash=EventPayloadHash.sha256(EventPayloadCanonicalizer.canonicalize(node)); var event=new EventEnvelope("123e4567-e89b-12d3-a456-426614174010",EventTypes.FIRST_LEG_LOADING_PLAN_COMPLETED,1,Instant.now(),RegionCode.CN,RegionCode.OVERSEAS,"100","LOADING_PLAN","plan-d",2,1L,"123e4567-e89b-12d3-a456-426614174011","FIRSTLEG_LOADING_COMPLETED:plan-d:100:1",null,node,hash); assertEquals(1,service.consume(event)); ArgumentCaptor<DropshipRequests.Receive> captor=ArgumentCaptor.forClass(DropshipRequests.Receive.class); verify(dropshipOrders).receive(captor.capture()); assertEquals("100",captor.getValue().customerId()); assertEquals(1,captor.getValue().pallets().size()); assertEquals("PLT-1",captor.getValue().pallets().get(0).palletNo()); assertEquals(List.of("BOX-1","BOX-2"),captor.getValue().pallets().get(0).skuPackages().get(0).cartonMarks()); ArgumentCaptor<List<InboundPlanService.WholePalletInput>> plans=ArgumentCaptor.forClass(List.class); verify(inboundPlans).convertDropship(eq("100"),anyLong(),plans.capture()); assertEquals(List.of(new InboundPlanService.WholePalletInput("PLT-1",2)),plans.getValue()); verify(inventory).registerInTransit(eq("100"),eq("SYSTEM"),any()); }
+ @Test void consumesFormalDropshipPalletSnapshots(){ var sku=new FirstLegLoadingPlanCompletedV1.SkuPackageSnapshot("SKU-A","Product A",2,20,List.of("BOX-1","BOX-2")); var pallet=new FirstLegLoadingPlanCompletedV1.PalletSnapshot("PLT-1",List.of(sku)); var item=new FirstLegLoadingPlanCompletedV1.Item("d-1","SKU-A","Product A","Product A",2,20,1,BigDecimal.ONE,BigDecimal.ONE,BigDecimal.ONE,BigDecimal.ONE,"wh-1","ONT8","ONT8",null,null,"MARK",null,List.of()); var order=new FirstLegLoadingPlanCompletedV1.Order("in-d","root-d","ord-d","FL-D","root-od","RK-D","wh-1","ONT8","ONT8",2,20,1,BigDecimal.ONE,BigDecimal.ONE,BigDecimal.ONE,List.of(item),"100","ONE_CLICK_DROPSHIP",List.of(pallet),"FBA"); var payload=new FirstLegLoadingPlanCompletedV1("plan-d","LP-D","book-d","CONT-D","CAB-D","92","Warehouse",List.of(order)); JsonNode node=json.valueToTree(payload); String hash=EventPayloadHash.sha256(EventPayloadCanonicalizer.canonicalize(node)); var event=new EventEnvelope("123e4567-e89b-12d3-a456-426614174010",EventTypes.FIRST_LEG_LOADING_PLAN_COMPLETED,1,Instant.now(),RegionCode.CN,RegionCode.OVERSEAS,"100","LOADING_PLAN","plan-d",2,1L,"123e4567-e89b-12d3-a456-426614174011","FIRSTLEG_LOADING_COMPLETED:plan-d:100:1",null,node,hash); assertEquals(1,service.consume(event)); ArgumentCaptor<DropshipRequests.Receive> captor=ArgumentCaptor.forClass(DropshipRequests.Receive.class); verify(dropshipOrders).receive(captor.capture()); verify(inventory,never()).registerInTransit(anyString(),anyString(),any()); assertEquals("100",captor.getValue().customerId()); assertEquals(1,captor.getValue().pallets().size()); assertEquals("PLT-1",captor.getValue().pallets().get(0).palletNo()); assertEquals(List.of("BOX-1","BOX-2"),captor.getValue().pallets().get(0).skuPackages().get(0).cartonMarks()); }
  @Test void oneDropshipInboundWithMultipleSkusCreatesOneOrderAndMultipleSkuDetails(){
   var itemA=new FirstLegLoadingPlanCompletedV1.Item("d-a","SKU-A","产品A","Product A",2,20,1,BigDecimal.ONE,BigDecimal.ONE,BigDecimal.ONE,BigDecimal.ONE,"wh-1","ONT8","ONT8",null,"SHIP-A","MARK-A",null,List.of("BOX-A1","BOX-A2"));
   var itemB=new FirstLegLoadingPlanCompletedV1.Item("d-b","SKU-B","产品B","Product B",3,15,1,BigDecimal.ONE,BigDecimal.ONE,BigDecimal.ONE,BigDecimal.ONE,"wh-1","ONT8","ONT8",null,"SHIP-B","MARK-B",null,List.of("BOX-B1","BOX-B2","BOX-B3"));
diff --git a/lastleg-service/src/test/resources/architecture/lastleg-slice-dependencies.json b/lastleg-service/src/test/resources/architecture/lastleg-slice-dependencies.json
index cc5660ecb..2966a26c2 100644
--- a/lastleg-service/src/test/resources/architecture/lastleg-slice-dependencies.json
+++ b/lastleg-service/src/test/resources/architecture/lastleg-slice-dependencies.json
@@ -23,6 +23,7 @@
     "relabel-transfer-discard->inventory",
     "relabel-transfer-discard->shared-technical",
     "relabel-transfer-discard->tailleg-handoff",
+    "security-projection->shared-technical",
     "tailleg-handoff->dropship",
     "tailleg-handoff->inbound-pda",
     "tailleg-handoff->inventory",
@@ -35,7 +36,13 @@
     "com.baiyue.lastleg.masterdata.vehicle.adapter.out.persistence.VehicleRecord": "src/main/java/com/baiyue/lastleg/masterdata/vehicle/adapter/out/persistence/VehicleRecord.java",
     "com.baiyue.lastleg.masterdata.vehicle.application.VehicleApplicationService": "src/main/java/com/baiyue/lastleg/masterdata/vehicle/application/VehicleApplicationService.java",
     "com.baiyue.lastleg.masterdata.vehicle.application.model.VehicleModels": "src/main/java/com/baiyue/lastleg/masterdata/vehicle/application/model/VehicleModels.java",
-    "com.baiyue.lastleg.masterdata.vehicle.application.port.out.VehicleRepository": "src/main/java/com/baiyue/lastleg/masterdata/vehicle/application/port/out/VehicleRepository.java"
+    "com.baiyue.lastleg.masterdata.vehicle.application.port.out.VehicleRepository": "src/main/java/com/baiyue/lastleg/masterdata/vehicle/application/port/out/VehicleRepository.java",
+    "com.baiyue.lastleg.security.controller.LastlegSecurityController": "src/main/java/com/baiyue/lastleg/security/controller/LastlegSecurityController.java",
+    "com.baiyue.lastleg.security.dto.LastlegSecurityDtos": "src/main/java/com/baiyue/lastleg/security/dto/LastlegSecurityDtos.java",
+    "com.baiyue.lastleg.security.service.LastlegSecurityProjectionRedisMirror": "src/main/java/com/baiyue/lastleg/security/service/LastlegSecurityProjectionRedisMirror.java",
+    "com.baiyue.lastleg.security.service.LastlegSecurityProjectionService": "src/main/java/com/baiyue/lastleg/security/service/LastlegSecurityProjectionService.java",
+    "com.baiyue.lastleg.security.service.LastlegSecurityValidationService": "src/main/java/com/baiyue/lastleg/security/service/LastlegSecurityValidationService.java",
+    "com.baiyue.lastleg.security.service.SecurityProjectionMonotonicity": "src/main/java/com/baiyue/lastleg/security/service/SecurityProjectionMonotonicity.java"
   },
   "applicationDependencyRule": {
     "packagePrefix": "com.baiyue.lastleg.masterdata.vehicle.application",
@@ -49,6 +56,10 @@
     ]
   },
   "sliceSpecificRules": {
+    "security-projection": {
+      "allowedOutgoing": ["shared-technical"],
+      "allowedIncoming": []
+    },
     "overseas-master-data": {
       "allowedOutgoing": ["shared-technical"],
       "allowedIncoming": ["procurement-trucking-looseboard"]
diff --git a/order/src/main/java/com/baiyue/order/service/UnifiedOrderQueryService.java b/order/src/main/java/com/baiyue/order/service/UnifiedOrderQueryService.java
index 5e3401d97..b50c0d987 100644
--- a/order/src/main/java/com/baiyue/order/service/UnifiedOrderQueryService.java
+++ b/order/src/main/java/com/baiyue/order/service/UnifiedOrderQueryService.java
@@ -19,6 +19,7 @@ import org.springframework.beans.factory.annotation.Value;
 import org.springframework.stereotype.Service;
 import org.springframework.util.StringUtils;
 
+import java.math.BigDecimal;
 import java.util.ArrayList;
 import java.time.LocalDateTime;
 import java.util.Comparator;
@@ -181,10 +182,10 @@ public class UnifiedOrderQueryService {
                 order.getChannelName(), order.getReceivingWarehouseId(), order.getReceivingWarehouseName(),
                 order.getDestinationWarehouseId(), order.getDestinationWarehouseName(), null, null,
                 order.getInboundCode(),
-                order.getExpectedShipDate(), totalPackageCount(cargo), null, null, null,
-                null, null, null, null, null, order.getPickupMethod(), order.getTaxMode(), order.getContainerMode(),
+                order.getExpectedShipDate(), totalPackageCount(cargo), null, null, grossWeightKg(cargo), volumeCbm(cargo),
+                null, null, null, null, order.getPickupMethod(), order.getTaxMode(), order.getContainerMode(),
                 order.getCustomsInspection(), order.getDestinationType(), order.getAmazonWarehouseCode(),
-                null, null, null, null, null, null, null, order.getExpressCompany(), order.getExpressTrackingNo(),
+                null, null, null, null, netWeightKg(cargo), null, null, order.getExpressCompany(), order.getExpressTrackingNo(),
                 string(order.getCreatedBy()), skuNos(cargo), totalQuantity(cargo), order.getShipmentId(), order.getReferenceId(),
                 null, null, null, null, null,
                 order.getCustomerRemark(), latestInternalNote,
@@ -196,11 +197,13 @@ public class UnifiedOrderQueryService {
             order.getCustomerId(), order.getCustomerName(),
             order.getChannelName(), order.getReceivingWarehouseId(), order.getReceivingWarehouseName(),
             order.getDestinationWarehouseId(), order.getDestinationWarehouseName(), inbound.id(), inbound.version(), inbound.inboundCode(),
-            order.getExpectedShipDate(), inbound.totalPackageCount(), null, inbound.locationCodes(),
-            inbound.actualGrossWeightKg(), inbound.actualVolumeCbm(), inbound.expectedArrivalAt(), inbound.feeReviewStatus(),
+            order.getExpectedShipDate(), inbound.totalPackageCount() != null ? inbound.totalPackageCount() : totalPackageCount(cargo), null, inbound.locationCodes(),
+            inbound.actualGrossWeightKg() != null ? inbound.actualGrossWeightKg() : grossWeightKg(cargo),
+            inbound.actualVolumeCbm() != null ? inbound.actualVolumeCbm() : volumeCbm(cargo), inbound.expectedArrivalAt(), inbound.feeReviewStatus(),
             inbound.companyName(), inbound.businessType(), order.getPickupMethod(), inbound.taxMode(), inbound.containerMode(),
             inbound.customsInspection(), inbound.destinationType(), inbound.destinationCode(), inbound.palletCount(),
-            inbound.chargeableWeightKg(), inbound.chargeableVolumeCbm(), inbound.volumeWeightKg(), inbound.actualNetWeightKg(),
+            inbound.chargeableWeightKg(), inbound.chargeableVolumeCbm(), inbound.volumeWeightKg(),
+            inbound.actualNetWeightKg() != null ? inbound.actualNetWeightKg() : netWeightKg(cargo),
             inbound.measureCompletedAt(), inbound.inboundedAt(), inbound.expressCompanyName(), inbound.expressTrackingNo(),
             inbound.createdByName(), skuNos(cargo), totalQuantity(cargo), order.getShipmentId(), order.getReferenceId(), measurement(inbound),
             preload(summary.preload()), loading(summary.loading()),
@@ -217,12 +220,16 @@ public class UnifiedOrderQueryService {
             parseOrderStatus(inbound.orderStatusSnapshot()),
             inbound.customerId(), inbound.customerName(), inbound.channelName(), inbound.warehouseId(),
             inbound.warehouseName(), inbound.deliveryWarehouseId(), inbound.deliveryWarehouseName(),
-            inbound.id(), inbound.version(), inbound.inboundCode(), null, inbound.totalPackageCount(),
-            null, inbound.locationCodes(), inbound.actualGrossWeightKg(),
-            inbound.actualVolumeCbm(), inbound.expectedArrivalAt(), inbound.feeReviewStatus(), inbound.companyName(),
+            inbound.id(), inbound.version(), inbound.inboundCode(), null,
+            inbound.totalPackageCount() != null ? inbound.totalPackageCount() : totalPackageCount(cargo),
+            null, inbound.locationCodes(),
+            inbound.actualGrossWeightKg() != null ? inbound.actualGrossWeightKg() : grossWeightKg(cargo),
+            inbound.actualVolumeCbm() != null ? inbound.actualVolumeCbm() : volumeCbm(cargo),
+            inbound.expectedArrivalAt(), inbound.feeReviewStatus(), inbound.companyName(),
             inbound.businessType(), order == null ? null : order.getPickupMethod(), inbound.taxMode(), inbound.containerMode(),
             inbound.customsInspection(), inbound.destinationType(), inbound.destinationCode(), inbound.palletCount(),
-            inbound.chargeableWeightKg(), inbound.chargeableVolumeCbm(), inbound.volumeWeightKg(), inbound.actualNetWeightKg(),
+            inbound.chargeableWeightKg(), inbound.chargeableVolumeCbm(), inbound.volumeWeightKg(),
+            inbound.actualNetWeightKg() != null ? inbound.actualNetWeightKg() : netWeightKg(cargo),
             inbound.measureCompletedAt(), inbound.inboundedAt(), inbound.expressCompanyName(), inbound.expressTrackingNo(),
             inbound.createdByName(), skuNos(cargo), totalQuantity(cargo), order == null ? null : order.getShipmentId(),
             order == null ? null : order.getReferenceId(), measurement(inbound), preload(summary.preload()), loading(summary.loading()),
@@ -282,7 +289,20 @@ public class UnifiedOrderQueryService {
         return cargo == null ? null : cargo.totalPackageCount();
     }
 
-    private record CargoSummary(List<String> skuNos, Integer totalQuantity, Integer totalPackageCount) {
+    private BigDecimal grossWeightKg(CargoSummary cargo) {
+        return cargo == null ? null : cargo.grossWeightKg();
+    }
+
+    private BigDecimal netWeightKg(CargoSummary cargo) {
+        return cargo == null ? null : cargo.netWeightKg();
+    }
+
+    private BigDecimal volumeCbm(CargoSummary cargo) {
+        return cargo == null ? null : cargo.volumeCbm();
+    }
+
+    private record CargoSummary(List<String> skuNos, Integer totalQuantity, Integer totalPackageCount,
+                                BigDecimal grossWeightKg, BigDecimal netWeightKg, BigDecimal volumeCbm) {
         private static CargoSummary from(List<OrderCargoEntity> cargoes) {
             List<String> skuNos = cargoes.stream().map(OrderCargoEntity::getSkuNo)
                 .filter(Objects::nonNull).map(String::trim).filter(value -> !value.isEmpty()).distinct().toList();
@@ -292,7 +312,16 @@ public class UnifiedOrderQueryService {
                 .filter(Objects::nonNull).toList();
             Integer totalPackageCount = packageCounts.isEmpty() ? null
                 : Math.toIntExact(packageCounts.stream().mapToLong(Integer::longValue).sum());
-            return new CargoSummary(skuNos, totalQuantity, totalPackageCount);
+            BigDecimal grossWeightKg = sum(cargoes, OrderCargoEntity::getGrossWeightKg);
+            BigDecimal netWeightKg = sum(cargoes, OrderCargoEntity::getNetWeightKg);
+            BigDecimal volumeCbm = sum(cargoes, OrderCargoEntity::getVolumeCbm);
+            return new CargoSummary(skuNos, totalQuantity, totalPackageCount, grossWeightKg, netWeightKg, volumeCbm);
+        }
+
+        private static BigDecimal sum(List<OrderCargoEntity> cargoes,
+                                      Function<OrderCargoEntity, BigDecimal> value) {
+            List<BigDecimal> values = cargoes.stream().map(value).filter(Objects::nonNull).toList();
+            return values.isEmpty() ? null : values.stream().reduce(BigDecimal.ZERO, BigDecimal::add);
         }
     }
     private String inboundMainStatus(String status) {
diff --git a/order/src/test/java/com/baiyue/order/service/UnifiedOrderQueryServiceTest.java b/order/src/test/java/com/baiyue/order/service/UnifiedOrderQueryServiceTest.java
index aa5c9a3d6..b0e6e56e6 100644
--- a/order/src/test/java/com/baiyue/order/service/UnifiedOrderQueryServiceTest.java
+++ b/order/src/test/java/com/baiyue/order/service/UnifiedOrderQueryServiceTest.java
@@ -84,13 +84,20 @@ class UnifiedOrderQueryServiceTest {
         OrderCargoEntity cargo = new OrderCargoEntity();
         cargo.setOrderId(77L);
         cargo.setPackageCount(100);
+        cargo.setGrossWeightKg(new BigDecimal("12.5"));
+        cargo.setNetWeightKg(new BigDecimal("11.2"));
+        cargo.setVolumeCbm(new BigDecimal("0.375"));
         when(orders.unifiedPage(eq(10001L), eq(query), any()))
             .thenReturn(new PageResult<>(List.of(order), 1, 20, 1, 1));
         when(firstleg.summaries(eq("internal-token"), any())).thenReturn(ApiResponse.success(List.of()));
         when(orders.findCargoByOrderIds(10001L, List.of(77L))).thenReturn(List.of(cargo));
 
-        assertThat(service.page(10001L, query).records()).singleElement()
-            .extracting(UnifiedOrderResponse.Row::totalPackageCount).isEqualTo(100);
+        assertThat(service.page(10001L, query).records()).singleElement().satisfies(row -> {
+            assertThat(row.totalPackageCount()).isEqualTo(100);
+            assertThat(row.actualGrossWeightKg()).isEqualByComparingTo("12.5");
+            assertThat(row.totalNetWeightKg()).isEqualByComparingTo("11.2");
+            assertThat(row.actualVolumeCbm()).isEqualByComparingTo("0.375");
+        });
         verify(orders).findCargoByOrderIds(10001L, List.of(77L));
     }
 
diff --git a/overseas-security-service/AGENTS.md b/overseas-security-service/AGENTS.md
deleted file mode 100644
index 01cb5953f..000000000
--- a/overseas-security-service/AGENTS.md
+++ /dev/null
@@ -1,14 +0,0 @@
-# Overseas Security Service 模块指引
-
-## 职责边界
-
-- 消费 IAM 三类跨区安全事件，维护海外可靠 Inbox 与单调安全投影，并为海外 Gateway 提供内部实时校验。
-- MySQL 是恢复源；Redis 仅为可重建镜像，不能成为授权真相或在失败时默认放行。
-- 不签发 Token、不保存 raw Token/凭据、不承载 Lastleg 业务，也不解释 Event Bridge 的重试状态。
-
-## 入口
-
-- 内部事件与校验：`controller/OverseasSecurityController.java`
-- 幂等、单调投影：`service/SecurityProjectionService.java`
-- Token 校验：`service/OverseasSecurityValidationService.java`
-- SQL：`src/main/resources/db/overseas-security.sql`
diff --git a/overseas-security-service/pom.xml b/overseas-security-service/pom.xml
deleted file mode 100644
index a8c5cd7fd..000000000
--- a/overseas-security-service/pom.xml
+++ /dev/null
@@ -1,22 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
-    <modelVersion>4.0.0</modelVersion>
-    <parent><groupId>com.baiyue.firstleg</groupId><artifactId>baiyue-firstleg-platform</artifactId>
-        <version>1.0.0-SNAPSHOT</version><relativePath>../pom.xml</relativePath></parent>
-    <artifactId>overseas-security-service</artifactId>
-    <dependencies>
-        <dependency><groupId>com.baiyue.shared</groupId><artifactId>baiyue-common-core</artifactId><version>${project.version}</version></dependency>
-        <dependency><groupId>com.baiyue.shared</groupId><artifactId>baiyue-common-web</artifactId><version>${project.version}</version></dependency>
-        <dependency><groupId>com.baiyue.shared</groupId><artifactId>baiyue-common-openapi</artifactId><version>${project.version}</version></dependency>
-        <dependency><groupId>com.baiyue.shared</groupId><artifactId>common-event-contract</artifactId><version>${project.version}</version></dependency>
-        <dependency><groupId>org.springframework.boot</groupId><artifactId>spring-boot-starter-jdbc</artifactId></dependency>
-        <dependency><groupId>org.springframework.boot</groupId><artifactId>spring-boot-starter-data-redis</artifactId></dependency>
-        <dependency><groupId>com.mysql</groupId><artifactId>mysql-connector-j</artifactId><scope>runtime</scope></dependency>
-        <dependency><groupId>com.alibaba.cloud</groupId><artifactId>spring-cloud-starter-alibaba-nacos-discovery</artifactId></dependency>
-        <dependency><groupId>com.alibaba.cloud</groupId><artifactId>spring-cloud-starter-alibaba-nacos-config</artifactId></dependency>
-        <dependency><groupId>org.springframework.boot</groupId><artifactId>spring-boot-starter-actuator</artifactId></dependency>
-        <dependency><groupId>org.springframework.boot</groupId><artifactId>spring-boot-starter-test</artifactId><scope>test</scope></dependency>
-    </dependencies>
-    <build><plugins><plugin><groupId>org.springframework.boot</groupId><artifactId>spring-boot-maven-plugin</artifactId></plugin></plugins></build>
-</project>
diff --git a/overseas-security-service/src/main/java/com/baiyue/overseassecurity/OverseasSecurityApplication.java b/overseas-security-service/src/main/java/com/baiyue/overseassecurity/OverseasSecurityApplication.java
deleted file mode 100644
index cfe7c82a6..000000000
--- a/overseas-security-service/src/main/java/com/baiyue/overseassecurity/OverseasSecurityApplication.java
+++ /dev/null
@@ -1,11 +0,0 @@
-package com.baiyue.overseassecurity;
-
-import org.springframework.boot.SpringApplication;
-import org.springframework.boot.autoconfigure.SpringBootApplication;
-
-@SpringBootApplication
-public class OverseasSecurityApplication {
-    public static void main(String[] args) {
-        SpringApplication.run(OverseasSecurityApplication.class, args);
-    }
-}
diff --git a/overseas-security-service/src/main/java/com/baiyue/overseassecurity/security/InternalServiceTokenGuard.java b/overseas-security-service/src/main/java/com/baiyue/overseassecurity/security/InternalServiceTokenGuard.java
deleted file mode 100644
index 1a6aa6b7c..000000000
--- a/overseas-security-service/src/main/java/com/baiyue/overseassecurity/security/InternalServiceTokenGuard.java
+++ /dev/null
@@ -1,26 +0,0 @@
-package com.baiyue.overseassecurity.security;
-
-import com.baiyue.common.core.api.ResultCode;
-import com.baiyue.common.core.exception.BizException;
-import jakarta.annotation.PostConstruct;
-import org.springframework.beans.factory.annotation.Value;
-import org.springframework.stereotype.Component;
-
-import java.nio.charset.StandardCharsets;
-import java.security.MessageDigest;
-
-@Component
-public class InternalServiceTokenGuard {
-    @Value("${baiyue.security.internal-service-token:}") private String configuredToken;
-    private byte[] expected;
-
-    @PostConstruct void initialize() {
-        expected = configuredToken == null ? new byte[0] : configuredToken.getBytes(StandardCharsets.UTF_8);
-        if (expected.length < 32) throw new IllegalStateException("INTERNAL_SERVICE_TOKEN 至少需要 32 字节");
-    }
-
-    public void verify(String supplied) {
-        byte[] actual = supplied == null ? new byte[0] : supplied.getBytes(StandardCharsets.UTF_8);
-        if (!MessageDigest.isEqual(expected, actual)) throw new BizException(ResultCode.FORBIDDEN, "内部服务令牌无效");
-    }
-}
diff --git a/overseas-security-service/src/main/java/com/baiyue/overseassecurity/service/OverseasSecurityValidationService.java b/overseas-security-service/src/main/java/com/baiyue/overseassecurity/service/OverseasSecurityValidationService.java
deleted file mode 100644
index 4b7ee66cf..000000000
--- a/overseas-security-service/src/main/java/com/baiyue/overseassecurity/service/OverseasSecurityValidationService.java
+++ /dev/null
@@ -1,44 +0,0 @@
-package com.baiyue.overseassecurity.service;
-
-import com.baiyue.overseassecurity.dto.OverseasSecurityDtos.FailureReason;
-import com.baiyue.overseassecurity.dto.OverseasSecurityDtos.ValidationRequest;
-import com.baiyue.overseassecurity.dto.OverseasSecurityDtos.ValidationResponse;
-import org.springframework.jdbc.core.JdbcTemplate;
-import org.springframework.stereotype.Service;
-
-import java.util.List;
-
-@Service
-public class OverseasSecurityValidationService {
-    private final JdbcTemplate jdbc;
-
-    public OverseasSecurityValidationService(JdbcTemplate jdbc) {
-        this.jdbc = jdbc;
-    }
-
-    public ValidationResponse validate(ValidationRequest request) {
-        String userStatus = status("USER", String.valueOf(request.userId()));
-        if (userStatus != null && !"ACTIVE".equals(userStatus)) {
-            return ValidationResponse.rejected(FailureReason.USER_DISABLED);
-        }
-        String tenantStatus = status("TENANT", String.valueOf(request.tenantId()));
-        if (tenantStatus != null && !"ACTIVE".equals(tenantStatus)) {
-            return ValidationResponse.rejected(FailureReason.TENANT_DISABLED);
-        }
-        Long projectedVersion = jdbc.queryForObject(
-                "SELECT MAX(permission_version) FROM overseas_security_projection "
-                        + "WHERE aggregate_id=? AND aggregate_type IN ('USER','AUTHORIZATION')",
-                Long.class, String.valueOf(request.userId()));
-        if (projectedVersion != null && request.permissionVersion() < projectedVersion) {
-            return ValidationResponse.rejected(FailureReason.PERMISSION_VERSION_STALE);
-        }
-        return ValidationResponse.accepted();
-    }
-
-    private String status(String type, String id) {
-        List<String> values = jdbc.query("SELECT security_status FROM overseas_security_projection "
-                        + "WHERE aggregate_type=? AND aggregate_id=?",
-                (rs, row) -> rs.getString(1), type, id);
-        return values.isEmpty() ? null : values.get(0);
-    }
-}
diff --git a/overseas-security-service/src/main/resources/application.yml b/overseas-security-service/src/main/resources/application.yml
deleted file mode 100644
index 6817568d2..000000000
--- a/overseas-security-service/src/main/resources/application.yml
+++ /dev/null
@@ -1,28 +0,0 @@
-server:
-  port: ${OVERSEAS_SECURITY_PORT:9307}
-spring:
-  application.name: overseas-security-service
-  config.import:
-    - optional:nacos:baiyue-common.yml?group=BAIYUE&refreshEnabled=true
-    - optional:nacos:${spring.application.name}.yml?group=BAIYUE&refreshEnabled=true
-  datasource:
-    driver-class-name: com.mysql.cj.jdbc.Driver
-    url: ${OVERSEAS_SECURITY_DB_URL}
-    username: ${OVERSEAS_SECURITY_DB_USERNAME}
-    password: ${OVERSEAS_SECURITY_DB_PASSWORD}
-  data.redis:
-    host: ${REDIS_HOST:127.0.0.1}
-    port: ${REDIS_PORT:6379}
-    password: ${REDIS_PASSWORD:}
-    database: ${REDIS_DATABASE:0}
-  cloud.nacos:
-    server-addr: ${NACOS_SERVER_ADDR:127.0.0.1:8848}
-    username: ${NACOS_USERNAME:nacos}
-    password: ${NACOS_PASSWORD:nacos}
-    discovery:
-      group: ${NACOS_GROUP:BAIYUE}
-      namespace: ${NACOS_NAMESPACE:prod-overseas}
-baiyue.security:
-  internal-service-token: ${INTERNAL_SERVICE_TOKEN}
-  permission-snapshot-key-prefix: ${PERMISSION_SNAPSHOT_KEY_PREFIX:baiyue:permission-snapshot}
-management.endpoints.web.exposure.include: health,info,prometheus
diff --git a/overseas-security-service/src/main/resources/db/overseas-security.sql b/overseas-security-service/src/main/resources/db/overseas-security.sql
deleted file mode 100644
index 7553fba93..000000000
--- a/overseas-security-service/src/main/resources/db/overseas-security.sql
+++ /dev/null
@@ -1,31 +0,0 @@
-CREATE DATABASE IF NOT EXISTS baiyue_overseas_security DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_0900_ai_ci;
-USE baiyue_overseas_security;
-
-CREATE TABLE IF NOT EXISTS overseas_security_event_inbox (
-  event_id VARCHAR(64) NOT NULL COMMENT '跨区事件ID',
-  event_type VARCHAR(96) NOT NULL COMMENT 'IAM安全事件类型',
-  payload_hash CHAR(64) NOT NULL COMMENT '规范化Payload SHA-256',
-  payload_json JSON NOT NULL COMMENT '冻结事件Payload',
-  status VARCHAR(16) NOT NULL COMMENT 'RECEIVED/PROCESSED',
-  result VARCHAR(32) NULL COMMENT 'APPLIED/STALE/DUPLICATE_VERSION',
-  received_at DATETIME(3) NOT NULL,
-  processed_at DATETIME(3) NULL,
-  PRIMARY KEY (event_id),
-  KEY idx_security_inbox_type_time (event_type, received_at)
-) ENGINE=InnoDB COMMENT='海外IAM安全事件消费者Inbox';
-
-CREATE TABLE IF NOT EXISTS overseas_security_projection (
-  aggregate_type VARCHAR(32) NOT NULL COMMENT 'USER/TENANT/AUTHORIZATION',
-  aggregate_id VARCHAR(64) NOT NULL COMMENT '用户或客户聚合ID',
-  tenant_id BIGINT NOT NULL COMMENT '平台0或客户ID',
-  security_status VARCHAR(24) NULL COMMENT 'ACTIVE/DISABLED等当前状态',
-  permission_version BIGINT NULL COMMENT '当前单调权限版本',
-  aggregate_version BIGINT NOT NULL COMMENT '事件聚合单调版本',
-  payload_hash CHAR(64) NOT NULL COMMENT '当前版本Payload哈希',
-  last_event_id VARCHAR(64) NOT NULL COMMENT '最后应用事件ID',
-  changed_at DATETIME(3) NOT NULL COMMENT '国内IAM事实发生时间',
-  updated_at DATETIME(3) NOT NULL,
-  PRIMARY KEY (aggregate_type, aggregate_id),
-  KEY idx_security_projection_tenant (tenant_id),
-  KEY idx_security_projection_permission (aggregate_id, permission_version)
-) ENGINE=InnoDB COMMENT='海外IAM安全状态与权限版本投影';
diff --git a/overseas-security-service/src/main/resources/openapi/internal-overseas-security-v1.yaml b/overseas-security-service/src/main/resources/openapi/internal-overseas-security-v1.yaml
deleted file mode 100644
index e228e9386..000000000
--- a/overseas-security-service/src/main/resources/openapi/internal-overseas-security-v1.yaml
+++ /dev/null
@@ -1,26 +0,0 @@
-openapi: 3.0.3
-info:
-  title: Overseas Security Projection Internal API
-  version: 1.0.0
-paths:
-  /internal/overseas-security/v1/events:
-    post:
-      summary: Consume one IAM security EventEnvelope
-      security: [{ internalServiceToken: [] }]
-      responses:
-        '200':
-          description: "Acknowledgement contains eventId, result and receivedAt"
-  /internal/overseas-security/v1/validate:
-    post:
-      summary: Validate locally verified overseas JWT claim versions
-      description: Accepts userId, tenantId, tokenVersion and permissionVersion; raw tokens and credentials are forbidden.
-      security: [{ internalServiceToken: [] }]
-      responses:
-        '200':
-          description: "valid plus optional USER_DISABLED, TENANT_DISABLED or PERMISSION_VERSION_STALE reason"
-components:
-  securitySchemes:
-    internalServiceToken:
-      type: apiKey
-      in: header
-      name: X-Internal-Service-Token
diff --git a/overseas-security-service/src/test/java/com/baiyue/overseassecurity/OverseasSecurityContractTest.java b/overseas-security-service/src/test/java/com/baiyue/overseassecurity/OverseasSecurityContractTest.java
deleted file mode 100644
index b626bb89b..000000000
--- a/overseas-security-service/src/test/java/com/baiyue/overseassecurity/OverseasSecurityContractTest.java
+++ /dev/null
@@ -1,51 +0,0 @@
-package com.baiyue.overseassecurity;
-
-import org.junit.jupiter.api.Test;
-
-import java.nio.charset.StandardCharsets;
-import java.nio.file.Files;
-import java.nio.file.Path;
-
-import static org.assertj.core.api.Assertions.assertThat;
-
-class OverseasSecurityContractTest {
-    @Test void sqlFreezesReliableInboxProjectionAndRedisRecoveryBoundary() throws Exception {
-        String sql = read("overseas-security-service/src/main/resources/db/overseas-security.sql");
-        String service = read("overseas-security-service/src/main/java/com/baiyue/overseassecurity/service/SecurityProjectionService.java");
-        String validation = read("overseas-security-service/src/main/java/com/baiyue/overseassecurity/service/OverseasSecurityValidationService.java");
-        String mirror = read("overseas-security-service/src/main/java/com/baiyue/overseassecurity/service/SecurityProjectionRedisMirror.java");
-        assertThat(sql).contains("PRIMARY KEY (event_id)", "payload_hash CHAR(64)",
-                "PRIMARY KEY (aggregate_type, aggregate_id)", "aggregate_version BIGINT", "permission_version BIGINT");
-        assertThat(service).contains("ProjectionMonotonicity.decide", "Decision.APPLY");
-        assertThat(mirror).contains("TransactionPhase.AFTER_COMMIT", "Redis 镜像写入失败");
-        assertThat(validation).contains("SELECT MAX(permission_version)", "USER_DISABLED",
-                "TENANT_DISABLED", "PERMISSION_VERSION_STALE");
-    }
-
-    @Test void eventBridgeRoutesIamTypesWithoutInspectingTheirPayload() throws Exception {
-        String dispatcher = read("event-bridge-service/src/main/java/com/baiyue/eventbridge/service/OverseasEventDispatcher.java");
-        String client = read("event-bridge-service/src/main/java/com/baiyue/eventbridge/service/HttpSecurityProjectionEventClient.java");
-        String lastleg = read("lastleg-service/src/main/java/com/baiyue/lastleg/controller/LastlegOrderController.java");
-        assertThat(dispatcher).contains("IAM_USER_STATUS_CHANGED", "IAM_TENANT_STATUS_CHANGED",
-                "IAM_PERMISSION_VERSION_CHANGED", "securityProjectionEventClient.deliver(event)");
-        assertThat(dispatcher).doesNotContain("IamSecurityEventsV1", "permissionVersion()", "status()");
-        assertThat(client).contains("path(\"data\").path(\"eventId\")", "row.getEventId().equals")
-                .doesNotContain("IamSecurityEventsV1");
-        assertThat(lastleg).contains("Lastleg 不消费该事件类型")
-                .doesNotContain("? shippingNodeConsumer.consume(event) : consumer.consume(event)");
-    }
-
-    @Test void internalOpenApiNeverAcceptsRawTokensOrCredentials() throws Exception {
-        String openapi = read("overseas-security-service/src/main/resources/openapi/internal-overseas-security-v1.yaml");
-        assertThat(openapi).contains("/internal/overseas-security/v1/events:",
-                "/internal/overseas-security/v1/validate:", "X-Internal-Service-Token",
-                "userId, tenantId, tokenVersion and permissionVersion");
-        assertThat(openapi).doesNotContain("accessToken", "refreshToken", "password:", "Authorization");
-    }
-
-    private static String read(String relative) throws Exception {
-        Path path = Path.of(relative);
-        if (!Files.exists(path)) path = Path.of("..").resolve(relative);
-        return Files.readString(path, StandardCharsets.UTF_8);
-    }
-}
diff --git a/overseas-security-service/src/test/java/com/baiyue/overseassecurity/service/OverseasSecurityValidationServiceTest.java b/overseas-security-service/src/test/java/com/baiyue/overseassecurity/service/OverseasSecurityValidationServiceTest.java
deleted file mode 100644
index f38834f99..000000000
--- a/overseas-security-service/src/test/java/com/baiyue/overseassecurity/service/OverseasSecurityValidationServiceTest.java
+++ /dev/null
@@ -1,36 +0,0 @@
-package com.baiyue.overseassecurity.service;
-
-import com.baiyue.overseassecurity.dto.OverseasSecurityDtos.FailureReason;
-import com.baiyue.overseassecurity.dto.OverseasSecurityDtos.ValidationRequest;
-import org.junit.jupiter.api.Test;
-import org.springframework.jdbc.core.JdbcTemplate;
-import org.springframework.jdbc.core.RowMapper;
-
-import java.util.List;
-
-import static org.assertj.core.api.Assertions.assertThat;
-import static org.mockito.ArgumentMatchers.any;
-import static org.mockito.ArgumentMatchers.anyString;
-import static org.mockito.Mockito.mock;
-import static org.mockito.Mockito.when;
-
-class OverseasSecurityValidationServiceTest {
-    private final JdbcTemplate jdbc = mock(JdbcTemplate.class);
-    private final OverseasSecurityValidationService service = new OverseasSecurityValidationService(jdbc);
-
-    @Test void disabledUserAndTenantFailClosed() {
-        when(jdbc.query(anyString(), any(RowMapper.class), any(Object[].class)))
-                .thenReturn(List.of("DISABLED"));
-        assertThat(service.validate(new ValidationRequest(42L, 0L, 3L, 8L)).failureReason())
-                .isEqualTo(FailureReason.USER_DISABLED);
-    }
-
-    @Test void stalePermissionVersionFailsAndCurrentVersionPasses() {
-        when(jdbc.query(anyString(), any(RowMapper.class), any(Object[].class)))
-                .thenReturn(List.of(), List.of());
-        when(jdbc.queryForObject(anyString(), any(Class.class), any(Object[].class))).thenReturn(9L, 9L);
-        assertThat(service.validate(new ValidationRequest(42L, 0L, 3L, 8L)).failureReason())
-                .isEqualTo(FailureReason.PERMISSION_VERSION_STALE);
-        assertThat(service.validate(new ValidationRequest(42L, 0L, 3L, 9L)).valid()).isTrue();
-    }
-}
diff --git a/overseas-security-service/src/test/java/com/baiyue/overseassecurity/service/ProjectionMonotonicityTest.java b/overseas-security-service/src/test/java/com/baiyue/overseassecurity/service/ProjectionMonotonicityTest.java
deleted file mode 100644
index 89560963c..000000000
--- a/overseas-security-service/src/test/java/com/baiyue/overseassecurity/service/ProjectionMonotonicityTest.java
+++ /dev/null
@@ -1,28 +0,0 @@
-package com.baiyue.overseassecurity.service;
-
-import com.baiyue.common.core.exception.BizException;
-import org.junit.jupiter.api.Test;
-
-import static org.assertj.core.api.Assertions.assertThat;
-import static org.assertj.core.api.Assertions.assertThatThrownBy;
-
-class ProjectionMonotonicityTest {
-    @Test void appliesFirstAndNewerVersions() {
-        assertThat(ProjectionMonotonicity.decide(null, null, 1, "hash-1"))
-                .isEqualTo(ProjectionMonotonicity.Decision.APPLY);
-        assertThat(ProjectionMonotonicity.decide(1L, "hash-1", 2, "hash-2"))
-                .isEqualTo(ProjectionMonotonicity.Decision.APPLY);
-    }
-
-    @Test void ignoresOlderAndSameHashVersions() {
-        assertThat(ProjectionMonotonicity.decide(3L, "hash-3", 2, "hash-2"))
-                .isEqualTo(ProjectionMonotonicity.Decision.STALE);
-        assertThat(ProjectionMonotonicity.decide(3L, "hash-3", 3, "hash-3"))
-                .isEqualTo(ProjectionMonotonicity.Decision.DUPLICATE_VERSION);
-    }
-
-    @Test void rejectsSameVersionWithDifferentHash() {
-        assertThatThrownBy(() -> ProjectionMonotonicity.decide(3L, "hash-a", 3, "hash-b"))
-                .isInstanceOf(BizException.class).hasMessageContaining("payloadHash 冲突");
-    }
-}
diff --git a/pom.xml b/pom.xml
index 2cd812fb5..20134475d 100644
--- a/pom.xml
+++ b/pom.xml
@@ -39,7 +39,6 @@
         <module>common-event-contract</module>
         <module>gateway</module>
         <module>gateway-overseas</module>
-        <module>overseas-security-service</module>
         <module>auth</module>
         <module>iam</module>
         <module>order</module>
diff --git a/scripts/README.md b/scripts/README.md
index bfb9577f0..360871a62 100644
--- a/scripts/README.md
+++ b/scripts/README.md
@@ -31,7 +31,8 @@ node scripts/create-pending-review-orders.mjs
 | Admin/Client 本地测试与类型检查 | `scripts/frontend-full-regression.ps1` |
 | PDA 本地页面和状态测试 | `../apps/pda-uniapp/tests/*.test.mjs` |
 | 本地数据库 SQL 静态/受控验收 | `scripts/local-db-full-acceptance.ps1` |
-| AGENTS 快速索引一致性 | `scripts/agents-index-contract.ps1`；只读核对根快速表唯一性、部署单元、业务模块、Client active 路由、海外 Gateway 覆盖、PDA 注册页面、Maven 模块、关键入口与排除目录 |
+| AGENTS 快速索引一致性 | `scripts/agents-index-contract.ps1`；只读核对根快速表唯一性、部署单元、业务模块、Client active 路由、四期范围漂移、订舱候选与柜量语义、海外 Gateway 覆盖、PDA 页面/运行配置/能力开关、Maven 模块、Lastleg 海外安全投影、同步 Trace、关键入口与排除目录 |
+| Java 质量聚合摘要 | `node --test scripts/java-quality-summary.test.mjs`、`node scripts/java-quality-summary.mjs --output target/java-quality-summary.json`；聚合 Maven/服务拓扑、OpenAPI 覆盖、JaCoCo 和 SpotBugs 报告，默认只报告存量缺口，CI 用显式 `--require-jacoco --require-spotbugs` 检查报告完整性且当前允许失败 |
 | 单服务部署失败回滚合同 | `scripts/deploy-built-service-rollback.test.mjs`；模拟成功、健康失败和启动失败，确认仅恢复同服务先前健康镜像且部署任务仍失败 |
 
 Admin/Client HTTP 脚本的离线合同只验证脚本结构、参数和模块边界，不访问测试环境：
diff --git a/scripts/admin-test-env-acceptance.mjs b/scripts/admin-test-env-acceptance.mjs
index 91fa0303d..7e214efc1 100644
--- a/scripts/admin-test-env-acceptance.mjs
+++ b/scripts/admin-test-env-acceptance.mjs
@@ -5,9 +5,11 @@ import { dirname, resolve } from 'node:path'
 import { pathToFileURL } from 'node:url'
 import process from 'node:process'
 
-const CONFIGURED_MODULES = ['merchant-qualification-fixture', 'customers', 'overseas-storage-fees', 'system', 'notifications', 'master-data', 'suppliers', 'domestic-container', 'orders', 'fee-items', 'pricing', 'downloads', 'inbound-weight-ocr', 'inbound-measurement', 'inbound-fees', 'phase3-container-loading', 'phase3-container-overview', 'phase3-loading', 'phase3-loading-model-bridge', 'phase3-pda-convergence', 'phase3-evidence-gate', 'supplemental', 'supplemental-boundaries', 'ocean-bookings', 'truck-appointments', 'service-center-flow', 'phase3-loading-finalize', 'phase3-customs', 'phase3-port-schedules', 'phase3-carrier-schedule-queries', 'phase3-outbound-dispatch', 'phase3-outbound-aggregate', 'phase3-dispatch-gate', 'phase3-waiting-for-loading', 'phase3-warehouse-rbac', 'phase3-order-splitting', 'manual-state-matrix', 'phase4-overseas-warehouse', 'phase4-carrier-pickup-ready', 'phase4-overseas-pda', 'phase4-overseas-pda-operations', 'phase4-overseas-inbound-operations', 'phase4-overseas-client-services', 'phase4-overseas-dispatch', 'phase4-cross-region-events', 'phase4-overseas-business', 'phase4-overseas-master-data', 'phase4-carrier-nodes', 'finance', 'finance-full-fixtures', 'finance-reconciliation-full', 'finance-settlement-full', 'finance-downloads', 'customer-operating-statistics']
+const CONFIGURED_MODULES = ['merchant-qualification-fixture', 'customers', 'overseas-storage-fees', 'system', 'notifications', 'master-data', 'suppliers', 'domestic-container', 'orders', 'fee-items', 'pricing', 'downloads', 'inbound-weight-ocr', 'inbound-measurement', 'inbound-fees', 'phase3-container-loading', 'phase3-container-overview', 'phase3-loading', 'phase3-loading-model-bridge', 'phase3-pda-convergence', 'phase3-evidence-gate', 'supplemental', 'supplemental-boundaries', 'ocean-bookings', 'truck-appointments', 'service-center-flow', 'phase3-loading-finalize', 'phase3-container-documents', 'phase3-customs', 'phase3-port-schedules', 'phase3-carrier-schedule-queries', 'phase3-outbound-dispatch', 'phase3-outbound-aggregate', 'phase3-dispatch-gate', 'phase3-waiting-for-loading', 'phase3-warehouse-rbac', 'phase3-order-splitting', 'manual-state-matrix', 'phase4-overseas-warehouse', 'phase4-carrier-pickup-ready', 'phase4-overseas-pda', 'phase4-overseas-pda-operations', 'phase4-overseas-inbound-operations', 'phase4-overseas-client-services', 'phase4-overseas-dispatch', 'phase4-cross-region-events', 'phase4-overseas-business', 'phase4-overseas-master-data', 'phase4-carrier-nodes', 'finance', 'finance-full-fixtures', 'finance-reconciliation-full', 'finance-settlement-full', 'finance-downloads', 'customer-operating-statistics']
 
 const MODULE_DEPENDENCIES = new Map([
+  ['suppliers', ['merchant-qualification-fixture']],
+  ['supplemental', ['merchant-qualification-fixture']],
   ['orders', ['merchant-qualification-fixture']],
   ['inbound-measurement', ['orders']],
   ['phase3-container-loading', ['inbound-measurement']],
@@ -20,9 +22,10 @@ const MODULE_DEPENDENCIES = new Map([
   ['truck-appointments', ['merchant-qualification-fixture']],
   ['service-center-flow', ['ocean-bookings', 'truck-appointments']],
   ['phase3-loading-finalize', ['phase3-loading', 'phase3-evidence-gate']],
+  ['phase3-container-documents', ['phase3-loading-finalize']],
   ['phase3-customs', ['phase3-loading-finalize']],
   ['phase3-port-schedules', ['ocean-bookings']],
-  ['phase3-outbound-dispatch', ['phase3-customs', 'phase3-port-schedules', 'service-center-flow']],
+  ['phase3-outbound-dispatch', ['phase3-container-documents', 'phase3-customs', 'phase3-port-schedules', 'service-center-flow']],
   ['phase3-outbound-aggregate', ['phase3-outbound-dispatch']],
   ['phase3-dispatch-gate', ['phase3-outbound-dispatch']],
   ['phase3-waiting-for-loading', ['phase3-outbound-dispatch']],
@@ -232,11 +235,20 @@ function usage() {
   --username <name>     必填，管理员账号
   --password <value>    必填，管理员密码
   --modules <names>     逗号分隔，默认 ${DEFAULT_MODULES.join(',')}
+  --customer-name <name> 指定本轮隔离客户名称，默认自动生成
+  --merchant-username <name> 复用既有已审核客户账号，不再创建客户
+  --merchant-password <value> 复用客户账号密码，不写入报告
+  --origin-warehouse-name <name> 固定国内起运仓名称
+  --channel-name <name> 固定物流渠道名称
+  --channel-code <code> 固定物流渠道编码
+  --order-profile-mode <mode> 订单档案模式：fixed 或 randomized，默认fixed
+  --wait-split-count <n> 同一客户创建的 WAIT_SPLIT 订单数，1-100，默认1
   --output <path>       JSON 报告路径，默认 reports/
   --help                显示帮助
 
 也可使用环境变量: ADMIN_TEST_GATEWAY, ADMIN_OVERSEAS_GATEWAY, ADMIN_TEST_USERNAME, ADMIN_TEST_PASSWORD,
-ADMIN_TEST_WEIGHT_IMAGE_PATH`)
+ADMIN_TEST_WEIGHT_IMAGE_PATH, ADMIN_TEST_CUSTOMER_NAME, MERCHANT_TEST_USERNAME,
+MERCHANT_TEST_PASSWORD, ADMIN_WAIT_SPLIT_COUNT`)
 }
 
 export function parseArguments(argv) {
@@ -255,12 +267,27 @@ export function parseArguments(argv) {
       values.set(name, next); index += 1
     }
   }
+  const merchantUsername = values.get('merchant-username') || process.env.MERCHANT_TEST_USERNAME || ''
+  const merchantPassword = values.get('merchant-password') || process.env.MERCHANT_TEST_PASSWORD || ''
+  const modules = normalizeModuleOrder((values.get('modules') || DEFAULT_MODULES.join(',')).split(',').map((v) => v.trim()).filter(Boolean))
+  if (merchantUsername && merchantPassword) {
+    const fixtureIndex = modules.indexOf('merchant-qualification-fixture')
+    if (fixtureIndex >= 0) modules.splice(fixtureIndex, 1)
+  }
   return {
     gateway: (values.get('gateway') || process.env.ADMIN_TEST_GATEWAY || '').replace(/\/$/, ''),
     overseasGateway: (values.get('overseas-gateway') || process.env.ADMIN_OVERSEAS_GATEWAY || '').replace(/\/$/, ''),
     username: values.get('username') || process.env.ADMIN_TEST_USERNAME || '',
     password: values.get('password') || process.env.ADMIN_TEST_PASSWORD || '',
-    modules: normalizeModuleOrder((values.get('modules') || DEFAULT_MODULES.join(',')).split(',').map((v) => v.trim()).filter(Boolean)),
+    modules,
+    customerName: values.get('customer-name') || process.env.ADMIN_TEST_CUSTOMER_NAME || '',
+    merchantUsername,
+    merchantPassword,
+    originWarehouseName: values.get('origin-warehouse-name') || '',
+    channelName: values.get('channel-name') || '',
+    channelCode: values.get('channel-code') || '',
+    orderProfileMode: values.get('order-profile-mode') || 'fixed',
+    waitSplitCount: Number(values.get('wait-split-count') || process.env.ADMIN_WAIT_SPLIT_COUNT || 1),
     output: values.get('output') || '',
   }
 }
@@ -273,6 +300,32 @@ export function validateExecutionOptions(options) {
       && (!options.overseasGateway || options.overseasGateway.trim() === '')) {
     throw new Error('四期海外模块缺少必填执行参数: overseas-gateway')
   }
+  if (!Number.isInteger(options.waitSplitCount) || options.waitSplitCount < 1 || options.waitSplitCount > 100) {
+    throw new Error('wait-split-count必须是1-100的整数')
+  }
+  if (options.customerName && options.customerName.trim().length > 128) {
+    throw new Error('customer-name不能超过128个字符')
+  }
+  if (Boolean(options.merchantUsername) !== Boolean(options.merchantPassword)) {
+    throw new Error('merchant-username和merchant-password必须同时提供')
+  }
+  for (const [name, value] of [['origin-warehouse-name', options.originWarehouseName],
+    ['channel-name', options.channelName], ['channel-code', options.channelCode]]) {
+    if (value && value.trim().length > 128) throw new Error(`${name}不能超过128个字符`)
+  }
+  if (!['fixed', 'randomized'].includes(options.orderProfileMode)) {
+    throw new Error('order-profile-mode必须为fixed或randomized')
+  }
+  if (options.orderProfileMode === 'randomized'
+      && (!options.originWarehouseName || !options.channelName || !options.channelCode)) {
+    throw new Error('randomized订单档案必须同时固定起运仓、渠道名称和渠道编码')
+  }
+  if (options.waitSplitCount > 1) {
+    const fixtureModules = new Set(['merchant-qualification-fixture', 'orders', 'inbound-measurement'])
+    if (options.modules.some((module) => !fixtureModules.has(module))) {
+      throw new Error('批量WAIT_SPLIT只允许执行merchant-qualification-fixture、orders、inbound-measurement')
+    }
+  }
   return options
 }
 
@@ -350,7 +403,9 @@ export class AcceptanceRun {
     this.coverageGaps = []
     this.context = {}
     this.token = ''
+    this.refreshToken = ''
     this.overseasToken = ''
+    this.overseasExpiresAt = 0
     this.fatal = null
   }
 
@@ -553,6 +608,148 @@ export class AcceptanceRun {
     this.modules.push({ name, startedAt, finishedAt: new Date().toISOString(), success: fatal === null && steps.every((s) => s.passed), passed: steps.filter((s) => s.passed).length, failed: steps.filter((s) => !s.passed).length, fatal })
   }
 
+  captureWaitSplitFixture(sequence) {
+    const order = this.createdResources.orders || {}
+    const measurement = this.createdResources.inboundMeasurement || {}
+    const ready = Boolean(order.orderId && measurement.inboundId
+      && String(order.tenantId) === String(measurement.tenantId)
+      && measurement.processStatus === 'WAIT_SPLIT' && measurement.finalStatus === 'APPROVED')
+    this.assert('wait-split-fixtures', `固定客户第 ${sequence} 单停在待分柜`, null, ready,
+      `tenantId=${measurement.tenantId || 'missing'}, orderId=${order.orderId || 'missing'}, inboundId=${measurement.inboundId || 'missing'}, processStatus=${measurement.processStatus || 'missing'}, reviewStatus=${measurement.finalStatus || 'missing'}`,
+      { scenario: 'fixed-customer-wait-split', deploymentBlocker: true })
+    if (!ready) return false
+    this.createdResources.waitSplitFixtures ??= []
+    this.createdResources.waitSplitFixtures.push({
+      sequence, tenantId: String(measurement.tenantId), orderId: String(order.orderId),
+      orderNo: order.orderNo || null, inboundId: String(measurement.inboundId),
+      inboundCode: order.inboundCode || null, processStatus: measurement.processStatus,
+      reviewStatus: measurement.finalStatus, skuCount: order.skuLines?.length || null,
+      totalPackageCount: (order.skuLines || []).reduce((sum, item) => sum + Number(item.packageCount || 0), 0),
+      palletCount: measurement.palletCount || null,
+      actualGrossWeightKg: measurement.actualGrossWeightKg || null,
+      actualNetWeightKg: measurement.actualNetWeightKg || null,
+      measurementProfile: this.context.waitSplitVariant?.measurementProfile || null,
+      receivingWarehouseId: order.receivingWarehouseId || null,
+      receivingWarehouseName: order.receivingWarehouseName || null,
+      destinationWarehouseId: order.destinationWarehouseId || null,
+      destinationWarehouseCode: order.destinationWarehouseCode || null,
+      destinationWarehouseName: order.destinationWarehouseName || null,
+      channelCode: order.channelCode || null,
+      channelName: order.channelName || null,
+      pricingTaxMode: order.pricingTaxMode || null,
+      destinationType: order.destinationType || null,
+      fulfillmentType: order.fulfillmentType || null,
+      pickupMethod: order.pickupMethod || null,
+      taxMode: order.taxMode || null,
+      containerMode: order.containerMode || null,
+      customsInspection: order.customsInspection ?? null,
+    })
+    return true
+  }
+
+  waitSplitVariant(sequence) {
+    const dimensionProfiles = [
+      { code: 'SMALL', first: { length: 29.1, width: 19.1, height: 18.1 }, replacement: { length: 29.5, width: 19.5, height: 18.5 }, outer: { length: 34, width: 24, height: 24 } },
+      { code: 'MEDIUM', first: { length: 39.1, width: 29.1, height: 28.1 }, replacement: { length: 39.5, width: 29.5, height: 28.5 }, outer: { length: 44, width: 34, height: 34 } },
+      { code: 'LARGE', first: { length: 49.1, width: 39.1, height: 38.1 }, replacement: { length: 49.5, width: 39.5, height: 38.5 }, outer: { length: 54, width: 44, height: 44 } },
+      { code: 'EXTRA_LARGE', first: { length: 59.1, width: 49.1, height: 48.1 }, replacement: { length: 59.5, width: 49.5, height: 48.5 }, outer: { length: 64, width: 54, height: 54 } },
+    ]
+    const skuCount = 1 + ((sequence - 1) % 4)
+    const packageCountPerSku = 1 + (Math.floor((sequence - 1) / 4) % 5)
+    const palletCount = 1 + ((sequence - 1) % 3)
+    const grossWeightPerPalletKg = 45 + ((sequence - 1) % 6) * 15
+    return {
+      sequence, skuCount, packageCountPerSku, palletCount, grossWeightPerPalletKg,
+      measurementProfile: dimensionProfiles[(sequence - 1) % dimensionProfiles.length],
+    }
+  }
+
+  randomizedOrderProfile(sequence) {
+    const combinations = [
+      ['FBA', 'STANDARD'],
+      ['OVERSEAS', 'STANDARD'],
+      ['PRIVATE', 'STANDARD'],
+      ['FBA', 'ONE_CLICK_DROPSHIP'],
+      ['OVERSEAS', 'ONE_CLICK_DROPSHIP'],
+      ['PRIVATE', 'ONE_CLICK_DROPSHIP'],
+    ]
+    const [destinationType, fulfillmentType] = combinations[(sequence * 5 + 1) % combinations.length]
+    const pickupMethods = ['PICKUP', 'SELF_EXPRESS', 'SELF_TRUCK']
+    return {
+      destinationType,
+      fulfillmentType,
+      pickupMethod: pickupMethods[(sequence * 7 + 2) % pickupMethods.length],
+      taxMode: sequence % 2 === 0 ? 'TAX_REFUND' : 'BUY_DECLARATION',
+      containerMode: sequence % 2 === 0 ? 'FULL_CONTAINER' : 'LCL',
+      customsInspection: sequence % 4 === 0,
+    }
+  }
+
+  applyWaitSplitVariant(sequence) {
+    const variant = this.waitSplitVariant(sequence)
+    this.context.waitSplitVariant = variant
+    this.context.phase3LoadingIncrementalDetailCount = variant.skuCount
+    this.context.phase3LoadingIncrementalPackageCount = variant.packageCountPerSku
+    const profile = this.options.orderProfileMode === 'randomized'
+      ? this.randomizedOrderProfile(sequence)
+      : { destinationType: 'FBA', fulfillmentType: 'STANDARD', pickupMethod: 'PICKUP',
+          taxMode: 'BUY_DECLARATION', containerMode: 'LCL', customsInspection: false }
+    this.context.orderProfile = profile
+    this.context.orderDestinationType = profile.destinationType
+    this.context.orderFulfillmentType = profile.fulfillmentType
+    this.context.waitSplitRoute = {
+      originWarehouseName: this.options.originWarehouseName || '',
+      channelName: this.options.channelName || '',
+      channelCode: this.options.channelCode || '',
+      destinationIndex: (sequence * 17 + 11),
+      taxModeIndex: sequence - 1,
+    }
+  }
+
+  async createAdditionalWaitSplitFixtures() {
+    const total = this.options.waitSplitCount
+    if (total <= 1) return
+    const baseMarker = this.marker
+    const orders = await import(new URL('./admin-test-env-modules/orders.mjs', import.meta.url))
+    const measurement = await import(new URL('./admin-test-env-modules/inbound-measurement.mjs', import.meta.url))
+    try {
+      for (let sequence = 2; sequence <= total; sequence += 1) {
+        this.marker = `${baseMarker}-WS${String(sequence).padStart(2, '0')}`
+        this.applyWaitSplitVariant(sequence)
+        await this.executeModule('orders', () => orders.run(this))
+        if (this.modules.at(-1)?.success !== true) break
+        await this.executeModule('inbound-measurement', () => measurement.run(this))
+        if (this.modules.at(-1)?.success !== true || !this.captureWaitSplitFixture(sequence)) break
+      }
+    } finally {
+      this.marker = baseMarker
+    }
+  }
+
+  async refreshSession(reason) {
+    const response = await this.request('POST', '/api/auth/refresh',
+      { refreshToken: this.refreshToken }, '')
+    const next = this.apiSuccess('authentication', '国内 refresh 签发新双区域会话', response,
+      `reason=${reason}`, { scenario: 'dual-token-refresh', deploymentBlocker: true })
+    const valid = Boolean(next?.accessToken) && Boolean(next?.refreshToken)
+      && Boolean(next?.overseasAccessToken) && Number(next?.overseasExpiresIn) > 0
+    this.assert('authentication', '刷新响应完整后原子替换国内与海外Token', response, valid,
+      `accessTokenPresent=${Boolean(next?.accessToken)}, refreshTokenPresent=${Boolean(next?.refreshToken)}, overseasTokenPresent=${Boolean(next?.overseasAccessToken)}, overseasExpiresIn=${next?.overseasExpiresIn ?? 'missing'}`,
+      { scenario: 'dual-token-refresh', deploymentBlocker: true })
+    if (!valid) return false
+    const replacement = {
+      token: next.accessToken,
+      refreshToken: next.refreshToken,
+      overseasToken: next.overseasAccessToken,
+      overseasExpiresAt: Date.now() + Number(next.overseasExpiresIn) * 1000,
+    }
+    this.token = replacement.token
+    this.refreshToken = replacement.refreshToken
+    this.overseasToken = replacement.overseasToken
+    this.overseasExpiresAt = replacement.overseasExpiresAt
+    return true
+  }
+
   async findAvailablePhone(module = 'customers') {
     const seed = BigInt(Date.now() % 10_000_000_000)
     for (let attempt = 0; attempt < 20; attempt += 1) {
@@ -987,11 +1184,15 @@ export class AcceptanceRun {
     }
   }
 
-  async runPhase4ProducerVariant(label, destinationType, fulfillmentType = 'STANDARD') {
+  async runPhase4ProducerVariant(label, destinationType, fulfillmentType = 'STANDARD', pickupRequired = false) {
     const matrixMarker = this.marker
     const variantMarker = `${matrixMarker}-P4-${label}`
     const contextKeys = ['orderDestinationType', 'orderFulfillmentType', 'phase4ProducerMatrixMarker']
-    const createdKeys = ['phase3Loading', 'phase3LoadingCompletedProducer', 'orchestrationFixtures', 'oceanBooking']
+    const createdKeys = [
+      'phase3Loading', 'phase3LoadingCompletedProducer', 'phase3ContainerDocuments', 'orchestrationFixtures', 'oceanBooking',
+      'phase3CustomsSupplier', 'phase3Customs', 'serviceCenterFlow', 'portSchedule',
+      'phase3OutboundDispatch', 'phase3CarrierScheduleQuery', 'phase4CarrierPickupReady',
+    ]
     const contextSnapshot = new Map(contextKeys.map((key) => [key, {
       present: Object.hasOwn(this.context, key), value: this.context[key],
     }]))
@@ -999,6 +1200,10 @@ export class AcceptanceRun {
       present: Object.hasOwn(this.createdResources, key), value: this.createdResources[key],
     }]))
     let restoreFixture = null
+    // Each producer variant must create and advance its own loading, outbound and carrier facts.
+    // Keeping the outer run's objects here can make a later container write PICKUP_READY nodes
+    // to an earlier carrier task while still reporting the variant as ready.
+    for (const key of createdKeys) delete this.createdResources[key]
     this.marker = variantMarker
     this.context.orderDestinationType = destinationType
     this.context.orderFulfillmentType = fulfillmentType
@@ -1009,6 +1214,47 @@ export class AcceptanceRun {
       await this.executeModule(`phase3-loading-phase4-${label}`, () => loading.run(this))
       const finalize = await import(new URL('./admin-test-env-modules/phase3-loading-finalize.mjs', import.meta.url))
       await this.executeModule(`phase3-loading-finalize-phase4-${label}`, () => finalize.run(this))
+      const documents = await import(new URL('./admin-test-env-modules/phase3-container-documents.mjs', import.meta.url))
+      await this.executeModule(`phase3-container-documents-phase4-${label}`, () => documents.run(this))
+      const producerKey = this.createdResources.phase3LoadingCompletedProducer?.resourceKey
+      const writeShippingEvidence = (shippingReady, carrierScheduleQueryId = null) => {
+        const matrix = this.createdResources.phase4InboundProducerFixtures
+        const records = [matrix?.containers, matrix?.byDestinationType?.FBA,
+          matrix?.byDestinationType?.OVERSEAS].filter(Array.isArray)
+        for (const values of records) {
+          const target = values.find((item) => item?.resourceKey === producerKey)
+          if (target) Object.assign(target, { shippingReady, carrierScheduleQueryId })
+        }
+      }
+      if (producerKey) writeShippingEvidence(false)
+      if (pickupRequired && !producerKey) {
+        this.assert('phase4-overseas-pda-fixture', `${label}产生者身份完整`, null, false,
+          'phase3LoadingCompletedProducer.resourceKey=missing',
+          { scenario: 'phase3-phase4-producer-fixture', deploymentBlocker: true })
+      }
+      if (pickupRequired && producerKey) {
+        const customs = await import(new URL('./admin-test-env-modules/phase3-customs.mjs', import.meta.url))
+        await this.executeModule(`phase3-customs-phase4-${label}`, () => customs.run(this))
+        const serviceCenter = await import(new URL('./admin-test-env-modules/service-center-flow.mjs', import.meta.url))
+        await this.executeModule(`service-center-flow-phase4-${label}`, () => serviceCenter.run(this))
+        const portSchedules = await import(new URL('./admin-test-env-modules/phase3-port-schedules.mjs', import.meta.url))
+        await this.executeModule(`phase3-port-schedules-phase4-${label}`, () => portSchedules.run(this))
+        const outbound = await import(new URL('./admin-test-env-modules/phase3-outbound-dispatch.mjs', import.meta.url))
+        await this.executeModule(`phase3-outbound-dispatch-phase4-${label}`, () => outbound.run(this))
+        const carrierQueries = await import(new URL('./admin-test-env-modules/phase3-carrier-schedule-queries.mjs', import.meta.url))
+        await this.executeModule(`phase3-carrier-schedule-queries-phase4-${label}`, () => carrierQueries.run(this))
+        const carrierNodes = await import(new URL('./admin-test-env-modules/phase4-carrier-nodes.mjs', import.meta.url))
+        await this.executeModule(`phase4-carrier-pickup-ready-phase4-${label}`,
+          () => carrierNodes.runUntilPickupReady(this))
+        const pickup = this.createdResources.phase4CarrierPickupReady
+        const shippingReady = pickup?.marker === variantMarker && pickup?.ready === true
+          && Boolean(pickup?.queryId)
+        writeShippingEvidence(shippingReady, shippingReady ? String(pickup.queryId) : null)
+        this.assert('phase4-overseas-pda-fixture', `${label}通过真实出仓与船节点进入PICKUP_READY`, null,
+          shippingReady,
+          `resourceKey=${producerKey}, queryId=${pickup?.queryId || 'missing'}, ready=${pickup?.ready === true}`,
+          { scenario: 'phase3-phase4-producer-fixture', deploymentBlocker: true })
+      }
     } finally {
       if (restoreFixture) restoreFixture()
       this.marker = matrixMarker
@@ -1026,21 +1272,32 @@ export class AcceptanceRun {
   async ensurePhase4PdaProducerMatrix() {
     const readiness = () => this.createdResources.phase4InboundProducerFixtures?.readiness || {}
     if (Number(readiness().dropshipContainerCount || 0) < 1) {
-      await this.runPhase4ProducerVariant('DROPSHIP-PRIMARY', 'FBA', 'ONE_CLICK_DROPSHIP')
+      await this.runPhase4ProducerVariant('DROPSHIP-PRIMARY', 'FBA', 'ONE_CLICK_DROPSHIP', true)
     }
     if (Number(readiness().fbaContainerCount || 0) < 2) {
-      await this.runPhase4ProducerVariant('FBA-STANDARD', 'FBA')
+      await this.runPhase4ProducerVariant('FBA-STANDARD', 'FBA', 'STANDARD', false)
     }
     if (Number(readiness().overseasContainerCount || 0) < 1) {
-      await this.runPhase4ProducerVariant('OVERSEAS-PRIMARY', 'OVERSEAS')
+      await this.runPhase4ProducerVariant('OVERSEAS-PRIMARY', 'OVERSEAS', 'STANDARD', true)
     }
     if (Number(readiness().distinctContainerCount || 0) < 4) {
-      await this.runPhase4ProducerVariant('SECONDARY', 'FBA')
+      await this.runPhase4ProducerVariant('SECONDARY', 'FBA', 'STANDARD', false)
     }
     const matrix = this.createdResources.phase4InboundProducerFixtures
+    const containers = Array.isArray(matrix?.containers) ? matrix.containers : []
+    const dropshipReady = containers.find((item) => item?.fulfillmentType === 'ONE_CLICK_DROPSHIP')
+    const overseasReady = containers.find((item) => item?.destinationType === 'OVERSEAS')
+    const awaitingVariants = containers.filter((item) => ['FBA-STANDARD', 'SECONDARY']
+      .some((label) => String(item?.resourceKey || '').includes(`-P4-${label}:`)))
+    const shippingMatrixReady = dropshipReady?.shippingReady === true
+      && Boolean(dropshipReady?.carrierScheduleQueryId)
+      && overseasReady?.shippingReady === true && Boolean(overseasReady?.carrierScheduleQueryId)
+      && awaitingVariants.length >= 1
+      && awaitingVariants.every((item) => item.shippingReady === false
+        && item.carrierScheduleQueryId == null)
     this.assert('phase4-overseas-pda-fixture', '本轮三期跨区生产矩阵已就绪', null,
-      matrix?.marker === this.marker && matrix?.readiness?.readyForPhase4Pda === true,
-      `marker=${matrix?.marker || 'missing'}, FBA=${matrix?.readiness?.fbaContainerCount ?? 0}, OVERSEAS=${matrix?.readiness?.overseasContainerCount ?? 0}, DROPSHIP=${matrix?.readiness?.dropshipContainerCount ?? 0}, containers=${matrix?.readiness?.distinctContainerCount ?? 0}`,
+      matrix?.marker === this.marker && matrix?.readiness?.readyForPhase4Pda === true && shippingMatrixReady,
+      `marker=${matrix?.marker || 'missing'}, FBA=${matrix?.readiness?.fbaContainerCount ?? 0}, OVERSEAS=${matrix?.readiness?.overseasContainerCount ?? 0}, DROPSHIP=${matrix?.readiness?.dropshipContainerCount ?? 0}, containers=${matrix?.readiness?.distinctContainerCount ?? 0}, shippingReady=${containers.filter((item) => item?.shippingReady === true).length}, awaiting=${awaitingVariants.length}`,
       { scenario: 'phase3-phase4-producer-fixture', deploymentBlocker: true })
   }
 
@@ -1100,12 +1357,20 @@ export class AcceptanceRun {
   }
 
   async run() {
+    if (this.options.merchantUsername && this.options.merchantPassword) {
+      process.env.MERCHANT_TEST_USERNAME = this.options.merchantUsername
+      process.env.MERCHANT_TEST_PASSWORD = this.options.merchantPassword
+    }
+    if (this.options.waitSplitCount > 1) this.applyWaitSplitVariant(1)
     const loginResponse = await this.request('POST', '/api/auth/login', { username: this.options.username, password: this.options.password }, '')
     const login = this.apiSuccess('authentication', '平台管理员登录', loginResponse)
     if (!login?.accessToken) this.fatal = '平台管理员登录失败，未执行业务模块'
     else {
       this.token = login.accessToken
+      this.refreshToken = login.refreshToken || ''
       this.overseasToken = login.overseasAccessToken || ''
+      this.overseasExpiresAt = Number(login.overseasExpiresIn) > 0
+        ? Date.now() + Number(login.overseasExpiresIn) * 1000 : 0
       const requiresOverseas = this.options.modules.some((module) => module.startsWith('phase4-overseas-'))
       if (requiresOverseas) {
         this.assert('authentication', '登录响应包含有效海外访问令牌', loginResponse,
@@ -1116,6 +1381,10 @@ export class AcceptanceRun {
       const handlers = { customers: () => this.runCustomers() }
       for (let moduleIndex = 0; moduleIndex < this.options.modules.length; moduleIndex += 1) {
         const module = this.options.modules[moduleIndex]
+        if (module.startsWith('phase4-overseas-')
+            && this.overseasExpiresAt > 0 && Date.now() + 120_000 >= this.overseasExpiresAt) {
+          await this.refreshSession(`海外模块 ${module} 执行前Token临近到期`)
+        }
         const fullFinanceChain = ['finance-full-fixtures', 'finance-reconciliation-full', 'finance-settlement-full'].every((name) => this.options.modules.includes(name))
         if (module === 'finance' && fullFinanceChain) {
           this.modules.push({ name: module, startedAt: new Date().toISOString(), finishedAt: new Date().toISOString(), success: true, passed: 0, failed: 0, fatal: null, skipped: 'finance-full-chain owns the finance source locks' })
@@ -1179,6 +1448,22 @@ export class AcceptanceRun {
         } finally {
           if (restoreFixture) restoreFixture()
         }
+        if (module === 'inbound-measurement' && this.captureWaitSplitFixture(1)) {
+          await this.createAdditionalWaitSplitFixtures()
+        }
+        const laterOverseasModule = this.options.modules.slice(moduleIndex + 1)
+          .some((name) => name.startsWith('phase4-overseas-'))
+        if (module === 'system' && laterOverseasModule) {
+          const refreshed = await this.refreshSession('system模块权限与角色变更完成')
+          if (refreshed) {
+            const probe = await this.requestOverseas('GET',
+              '/api/platform/v1/last-leg/orders?page=1&size=1')
+            this.assert('authentication', 'system后新admin海外Token只读探针可用', probe,
+              probe.http === 200 && String(probe.body?.code) === '200',
+              `HTTP=${probe.http}, code=${probe.body?.code ?? 'missing'}, requestId=${probe.requestId || 'missing'}, traceId=${probe.traceId || 'missing'}`,
+              { scenario: 'dual-token-refresh', deploymentBlocker: true })
+          }
+        }
       }
     }
     const reportSurface = JSON.stringify({
@@ -1186,7 +1471,9 @@ export class AcceptanceRun {
       deploymentBlockers: this.deploymentBlockers, coverageGaps: this.coverageGaps,
       createdResources: this.createdResources,
     })
-    const forbiddenValues = [this.options.password, this.token, this.overseasToken].filter((value) => typeof value === 'string' && value.length >= 8)
+    const forbiddenValues = [this.options.password, this.options.merchantPassword,
+      this.token, this.refreshToken, this.overseasToken]
+      .filter((value) => typeof value === 'string' && value.length >= 8)
     const sensitivePatterns = [
       /"(?:password|newPassword|temporaryPassword|accessToken|refreshToken|authorization)"\s*:/i,
       /\bBearer\s+[A-Za-z0-9._~-]{16,}/i,
diff --git a/scripts/admin-test-env-modules/README.md b/scripts/admin-test-env-modules/README.md
index 30398eadd..38908e6e9 100644
--- a/scripts/admin-test-env-modules/README.md
+++ b/scripts/admin-test-env-modules/README.md
@@ -2,6 +2,8 @@
 
 总入口是 `../admin-test-env-acceptance.mjs`。每个业务模块使用独立的同名 `.mjs` 文件，避免多个对话同时修改总入口。
 
+需要为人工联调批量准备同一客户、同一国内仓和同一渠道的 `WAIT_SPLIT` 数据时，使用[《批量待分柜数据生成指南》](批量待分柜数据生成指南.md)。该入口通过正式下单、入库、称重和测量接口生成数据，支持 FBA、海外仓、私人地址及一件代发等稳定随机组合；不得直接写库或用于生产环境。
+
 例如 `--modules system,inbound-weight-ocr` 会依次加载：
 
 - `system.mjs`
@@ -47,7 +49,7 @@ export async function run(context) {
 | 订单创建、可计价主数据与审核异步收敛 | `orders.mjs` | `orders-pricing-fixture-contract.test.mjs`、`orders-approval-convergence-contract.test.mjs` |
 | 入库测量、首次打印冻结箱码与墨家扫码 | `inbound-measurement.mjs` | `inbound-measurement-box-code-contract.test.mjs` |
 | 入仓自动头程费用、派生详情、人工发布与 MANUAL 其他费用版本 | `inbound-fees.mjs`（前置：`merchant-qualification-fixture,orders,inbound-measurement`） | `inbound-fees-contract.test.mjs` |
-| 三期模拟柜关联、柜次概览、渠道隔离、装柜模型桥接、PDA、动态增量、报关与证据/出仓门禁 | `phase3-container-loading.mjs`、`ocean-booking-fixture.mjs`、`phase3-container-overview.mjs`、`phase3-loading.mjs`、`phase3-loading-model-bridge.mjs`、`phase3-pda-convergence.mjs`、`phase3-evidence-gate.mjs`、`phase3-customs.mjs`、`phase3-loading-finalize.mjs`、`phase3-outbound-dispatch.mjs` | `container-simulation-association-contract.test.mjs`、`container-specification-fixture-contract.test.mjs`、`ocean-booking-channel-contract.test.mjs`、`phase3-container-regression-contract.test.mjs`、`phase3-loading-model-bridge-contract.test.mjs`、`phase3-loading-dynamic-final-contract.test.mjs`、`phase3-producer-chain-contract.test.mjs`、`manual-state-loading-pda-contract.test.mjs` |
+| 三期模拟柜关联、柜次概览、渠道隔离、装柜模型桥接、PDA、动态增量、四类货柜资料、报关与证据/出仓门禁 | `phase3-container-loading.mjs`、`ocean-booking-fixture.mjs`、`phase3-container-overview.mjs`、`phase3-loading.mjs`、`phase3-loading-model-bridge.mjs`、`phase3-pda-convergence.mjs`、`phase3-evidence-gate.mjs`、`phase3-loading-finalize.mjs`、`phase3-container-documents.mjs`、`phase3-customs.mjs`、`phase3-outbound-dispatch.mjs` | `container-simulation-association-contract.test.mjs`、`container-specification-fixture-contract.test.mjs`、`ocean-booking-channel-contract.test.mjs`、`phase3-container-regression-contract.test.mjs`、`phase3-loading-model-bridge-contract.test.mjs`、`phase3-loading-dynamic-final-contract.test.mjs`、`phase3-container-documents-contract.test.mjs`、`phase3-phase4-departure-pickup-chain-contract.test.mjs`、`phase3-producer-chain-contract.test.mjs`、`manual-state-loading-pda-contract.test.mjs` |
 | 分柜与父子入库单数量守恒 | `phase3-order-splitting.mjs` | `phase3-order-splitting-contract.test.mjs` |
 | 订舱共享主数据前置与订舱验收 | `ocean-booking-fixture.mjs`、`ocean-bookings.mjs`、`phase3-port-schedules.mjs`、`phase3-carrier-schedule-queries.mjs`（DRAFT 可编辑；RELEASED 冻结；船司查询只创建并写当前 marker 登记任务） | `ocean-booking-prototype-contract.test.mjs`、`ocean-booking-fixture-contract.test.mjs`、`phase3-carrier-schedule-queries.test.mjs` |
 | 独立拖车预约与可选履约关联 | `truck-appointments.mjs`（同 marker 客户 + ACTIVE TRUCKING 承运商；订舱/柜次/计划可空；DISPATCH 前需提单号和有效 `BILL_OF_LADING` 文件） | `truck-appointments-contract.test.mjs` |
@@ -57,6 +59,7 @@ export async function run(context) {
 | 四期海外仓 HTTP 生命周期 | `phase4-overseas-warehouse.mjs` | `phase4-overseas-warehouse-contract.test.mjs` |
 | 四期海外 PDA 柜号收货与库内操作 HTTP 生命周期 | `phase4-overseas-pda.mjs`（按柜完成签收和实收，成功后仅以内存上下文交接操作员会话和已完成库存事实）、`phase4-overseas-pda-operations.mjs`（紧随收货执行 P2 盘点、P3 整托移库、P4 托盘拆装换绑、P5 换标复核；finally 停用双操作员并清空临时 Token；任何真实 fixture 缺失均 fail-closed） | `phase4-overseas-pda-contract.test.mjs`、`phase4-overseas-pda-operations-contract.test.mjs` |
 | 三四期跨区事件与安全门禁 | `phase4-cross-region-events.mjs`（双 Token Audience 互斥、canonical 权限 403、国内装柜完成到 Lastleg 建单、海外柜完成到 Firstleg 回写、轮询重试/幂等/诊断证据；缺本轮 marker 前置时阻断） | `phase4-cross-region-events-contract.test.mjs` |
+| 国内离仓至海外 PDA 可见人工验收节点 | `phase3-customs.mjs`（四类柜资料与整柜照片）、`phase3-outbound-dispatch.mjs`（柜级离仓）、`phase3-carrier-schedule-queries.mjs`、`phase4-carrier-pickup-ready.mjs`、`phase4-overseas-pda.mjs`（同柜候选） | `phase3-phase4-departure-pickup-chain-contract.test.mjs` |
 | 四期海外业务 HTTP 生命周期 | `phase4-overseas-business.mjs` | `phase4-overseas-business-contract.test.mjs` |
 | 四期海外主数据 HTTP 生命周期 | `phase4-overseas-master-data.mjs` | `phase4-overseas-master-data-contract.test.mjs` |
 | 四期船节点安全冒烟 | `phase4-carrier-nodes.mjs`（standalone 对历史任务只读；仅复用当前 marker 的 `phase3CarrierScheduleQuery` 时补录预计事实） | `phase4-carrier-nodes-contract.test.mjs` |
@@ -66,6 +69,8 @@ export async function run(context) {
 
 四期 HTTP 验收使用国内登录响应同时签发的短时海外 Token。总入口通过 `--gateway` 访问国内 Gateway，通过 `--overseas-gateway` 访问海外 Gateway。海外仓、海外业务和海外主数据模块只对带本轮 marker 的资源执行已确认的新增、编辑、状态与导出，并在结束前按契约停用；PDA 收货模块使用本轮临时 WAREHOUSE_PICKER 海外 Token，只调用 `/api/pda/v1/last-leg/receiving-containers/**` 柜号收货入口，不接受 `customerId`、`planNo` 或分配 ID。收货成功后由相邻的 `phase4-overseas-pda-operations` 消费仅存在于进程内存、不会进入 JSON 报告的 Token 与库存事实，执行盘点、整托移库、托盘操作和换标；新模块无论成功失败都在 finally 停用两个 picker 并清空临时凭据。两模块均不调用出库、退货出库、派送或内部接口；任何真实柜、箱唛、托盘、库存或换标前置缺失都必须形成 deployment blocker，不能按空场景通过；船节点禁止手工创建任务。
 
+节点全链定向入口为 `--modules phase4-overseas-pda`。依赖展开固定经过本轮 `LOADED` 柜次的 `DESTINATION_CLEARANCE`、`CUSTOMS_DECLARATION`、`DELIVERY_ORDER`、`PICKUP_ORDER` 四类资料生命周期，再确认国内出仓、核对自动创建的 `OUTBOUND_CONFIRM` 船节点任务、人工补录至实际 `PICKUP_READY`，最后验证海外 PDA 候选可见。四类资料模块只写本轮 marker 柜次，覆盖上传/完成重放、同键异载荷 `A0409`、冲突后零漂移和聚合回读；任一 fixture 或 Trace 缺失均为 deployment blocker。
+
 ```powershell
 node scripts/admin-test-env-acceptance.mjs --gateway <development-gateway> --overseas-gateway <development-overseas-gateway> --modules phase4-overseas-warehouse,phase4-overseas-pda,phase4-overseas-pda-operations,phase4-cross-region-events,phase4-overseas-business,phase4-overseas-master-data,phase4-carrier-nodes
 ```
diff --git a/scripts/admin-test-env-modules/customer-system-contract.test.mjs b/scripts/admin-test-env-modules/customer-system-contract.test.mjs
index 64527c588..80f236ad0 100644
--- a/scripts/admin-test-env-modules/customer-system-contract.test.mjs
+++ b/scripts/admin-test-env-modules/customer-system-contract.test.mjs
@@ -30,6 +30,16 @@ test('系统验收覆盖后端四种权限资源类型并清理测试资源', ()
   assert.match(system, /DELETE.*permissions\/\$\{additionalPermissionId\}/s)
 })
 
+test('system后刷新双Token且受限海外权限只接受403语义', () => {
+  assert.match(acceptance, /module === 'system' && laterOverseasModule/)
+  assert.match(acceptance, /refreshSession\('system模块权限与角色变更完成'\)/)
+  assert.match(acceptance, /system后新admin海外Token只读探针可用/)
+  assert.match(acceptance, /Date\.now\(\) \+ 120_000 >= this\.overseasExpiresAt/)
+  assert.match(system, /缺少canonical海外订单权限必须403/)
+  assert.match(system, /denied\.http === 403 \|\| \['403', 'A0403'\]\.includes/)
+  assert.doesNotMatch(system, /A0401[^\r\n]{0,120}(必须403|includes)/)
+})
+
 test('客户验收覆盖客户维度操作日志列表和详情快照', () => {
   assert.match(acceptance, /audit\/logs\?accountId=\$\{tenantId\}&eventType=PLATFORM_TENANT_UPDATE&resourceType=TENANT&resourceId=\$\{tenantId\}/)
   assert.match(acceptance, /PLATFORM_TENANT_UPDATE/)
diff --git a/scripts/admin-test-env-modules/fee-items.mjs b/scripts/admin-test-env-modules/fee-items.mjs
index dd3472bdd..f943c9e96 100644
--- a/scripts/admin-test-env-modules/fee-items.mjs
+++ b/scripts/admin-test-env-modules/fee-items.mjs
@@ -5,8 +5,8 @@ const BASE = '/api/platform/v1/fee-items'
 const BASELINE_COUNT = 111
 const DOMESTIC_COUNT = 84
 const INTERNATIONAL_COUNT = 27
-const MERCHANT_USERNAME = process.env.MERCHANT_TEST_USERNAME || 'merchant_admin'
-const MERCHANT_PASSWORD = process.env.MERCHANT_TEST_PASSWORD || 'ChangeMe123!'
+const MERCHANT_USERNAME = process.env.MERCHANT_TEST_USERNAME || ''
+const MERCHANT_PASSWORD = process.env.MERCHANT_TEST_PASSWORD || ''
 
 function id(value) { return value == null ? '' : String(value) }
 function records(value) { return Array.isArray(value?.records) ? value.records : [] }
diff --git a/scripts/admin-test-env-modules/finance-demo-fixtures-contract.test.mjs b/scripts/admin-test-env-modules/finance-demo-fixtures-contract.test.mjs
index 6482476d2..a67d138ee 100644
--- a/scripts/admin-test-env-modules/finance-demo-fixtures-contract.test.mjs
+++ b/scripts/admin-test-env-modules/finance-demo-fixtures-contract.test.mjs
@@ -7,10 +7,12 @@ import { fileURLToPath } from 'node:url'
 const here = path.dirname(fileURLToPath(import.meta.url))
 const source = fs.readFileSync(path.join(here, 'finance-demo-fixtures.mjs'), 'utf8')
 
-test('演示数据只消费本轮固定 marker 和客户 10001', () => {
+test('演示数据只消费本轮固定 marker 和动态正式客户 fixture', () => {
   assert.match(source, /const MARKER = 'FIN-DEMO-20260812'/)
   assert.match(source, /fixture\.marker !== runMarker/)
-  assert.match(source, /fixture\.customerId !== '10001'/)
+  assert.match(source, /customerId !== id\(qualificationFixture\?\.tenantId\)/)
+  assert.match(source, /context\.context\.merchantQualificationFixture/)
+  assert.doesNotMatch(source, /customerId:\s*['"]?10001|accountId=10001/)
   assert.match(source, /const runMarker = `\$\{MARKER\}-/)
   assert.match(source, /禁止借历史来源/)
   assert.doesNotMatch(source, /DELETE|cleanup|remove/i)
@@ -41,8 +43,8 @@ test('所有财务写操作使用 marker 幂等键并上传真实凭证', () =>
 })
 
 test('额外应付审核路径先追加 feeId 再追加 accountId 查询参数', () => {
-  assert.match(source, /`\$\{basePath\}\/\$\{created\.id\}\/approve\?accountId=10001`/)
-  assert.doesNotMatch(source, /fee-details\?accountId=10001\/\$\{created\.id\}/)
+  assert.match(source, /`\$\{basePath\}\/\$\{created\.id\}\/approve\?accountId=\$\{encodeURIComponent\(customerId\)\}`/)
+  assert.doesNotMatch(source, /fee-details\?accountId=.*\/\$\{created\.id\}/)
 })
 
 test('费用来源使用 operationVersion，应付供应商长整型保持字符串精度', () => {
diff --git a/scripts/admin-test-env-modules/finance-demo-fixtures.mjs b/scripts/admin-test-env-modules/finance-demo-fixtures.mjs
index 4ce0c5dc7..255375182 100644
--- a/scripts/admin-test-env-modules/finance-demo-fixtures.mjs
+++ b/scripts/admin-test-env-modules/finance-demo-fixtures.mjs
@@ -30,10 +30,10 @@ function blocker(context, name, response, evidence, category) {
   })
 }
 
-async function waitForSources(context, sourceFeeIds) {
+async function waitForSources(context, customerId, sourceFeeIds) {
   let pool = []
   for (let attempt = 0; attempt < 30; attempt += 1) {
-    const response = await context.request('GET', `${BASE}/fee-pool?customerId=10001&direction=ALL`)
+    const response = await context.request('GET', `${BASE}/fee-pool?customerId=${encodeURIComponent(customerId)}&direction=ALL`)
     pool = rows(data(response)).concat(rows(data(response)?.items))
     const visible = new Set(pool.map((item) => id(item.sourceId)))
     if (sourceFeeIds.every((sourceId) => visible.has(sourceId))) return pool
@@ -80,10 +80,11 @@ async function createExtraPayable(context, fixture, index) {
     unitPrice: 90 + index * 10, amount: 90 + index * 10, currency: 'CNY',
     supplierId, remark: `${MARKER}-AP-${index}` }
   const basePath = `/api/platform/v1/inbounds/${inboundId}/fee-details`
-  const createdResponse = await write(context, 'POST', `${basePath}?accountId=10001`, body, `extra-payable-${index}`)
+  const customerId = id(fixture.customerId)
+  const createdResponse = await write(context, 'POST', `${basePath}?accountId=${encodeURIComponent(customerId)}`, body, `extra-payable-${index}`)
   const created = data(createdResponse)
   if (!ok(createdResponse) || !created?.id) return null
-  const approveResponse = await write(context, 'POST', `${basePath}/${created.id}/approve?accountId=10001`, undefined, `extra-payable-${index}-approve`)
+  const approveResponse = await write(context, 'POST', `${basePath}/${created.id}/approve?accountId=${encodeURIComponent(customerId)}`, undefined, `extra-payable-${index}-approve`)
   record(context, `创建第 ${index} 条额外应付来源`, approveResponse, ok(approveResponse),
     `sourceFeeId=${created.id}, inboundId=${inboundId}, supplierId=${supplierId}`)
   return { sourceFeeId: id(created.id), direction: 'PAYABLE', businessDate: body.businessDate,
@@ -91,7 +92,7 @@ async function createExtraPayable(context, fixture, index) {
 }
 
 async function createStatement(context, source, role, targetStatus) {
-  const body = { customerId: '10001', currency: 'CNY', generationMode: 'SELECTED',
+  const body = { customerId: id(source.customerId), currency: 'CNY', generationMode: 'SELECTED',
     feeSourceIds: [source.feeSourceId], periodStart: source.businessDate, periodEnd: source.businessDate,
     remark: `${MARKER}-${role}` }
   const response = await write(context, 'POST', `${BASE}/statements`, body, `statement-${role}-create`)
@@ -120,7 +121,7 @@ async function createAr(context, statement, role) {
 
 async function receive(context, fixture, settlement, amount, role) {
   const response = await write(context, 'POST', `${BASE}/receipts`, {
-    customerId: 10001, receivedDate: new Date().toISOString().slice(0, 10), amount, currency: 'CNY',
+    customerId: id(fixture.customerId), receivedDate: new Date().toISOString().slice(0, 10), amount, currency: 'CNY',
     paymentMethod: 'BANK_TRANSFER', voucherFileIds: [fixture.voucherFileId], remark: `${MARKER}-${role}`,
     allocations: [{ billId: Number(settlement.reconciliationStatementId), amount }],
   }, `receipt-${role}`)
@@ -130,7 +131,7 @@ async function receive(context, fixture, settlement, amount, role) {
 
 async function createAp(context, fixture, source, role) {
   const response = await write(context, 'POST', `${BASE}/payable-settlements`, {
-    customerId: 10001, supplierId: id(source.supplierId), feeSourceIds: [Number(source.feeSourceId)],
+    customerId: id(fixture.customerId), supplierId: id(source.supplierId), feeSourceIds: [Number(source.feeSourceId)],
     dueDate: new Date().toISOString().slice(0, 10), currency: 'CNY',
   }, `ap-${role}-${source.feeSourceId}-${source.supplierId}-create`)
   const value = data(response)
@@ -165,8 +166,9 @@ async function recoverExistingDemo(context, reportPath) {
   const report = JSON.parse(await readFile(reportPath, 'utf8'))
   const fixture = report?.createdResources?.financeFullFixtures
   const matrix = structuredClone(report?.createdResources?.financeDemo ?? {})
-  if (fixture?.marker !== matrix.runMarker || matrix.marker !== MARKER || matrix.customerId !== '10001') {
-    throw new Error('恢复报告不是 FIN-DEMO-20260812 / 客户 10001 的同一轮 fixture')
+  if (fixture?.marker !== matrix.runMarker || matrix.marker !== MARKER
+      || !id(matrix.customerId) || id(matrix.customerId) !== id(fixture.customerId)) {
+    throw new Error('恢复报告不是 FIN-DEMO-20260812 同一轮动态客户 fixture')
   }
   context.marker = matrix.runMarker
   await verifyUnfilteredLists(context)
@@ -189,7 +191,7 @@ async function recoverExistingDemo(context, reportPath) {
     const role = roles[index]
     const detail = await sourceDetail(context, payableIds[index])
     const source = detail.value
-    if (!ok(detail.response) || source?.direction !== 'PAYABLE' || source?.customerId !== '10001'
+    if (!ok(detail.response) || source?.direction !== 'PAYABLE' || id(source?.customerId) !== id(matrix.customerId)
       || !id(source?.sourceFeeId)) {
       blocker(context, `${role} 恢复来源属于本轮 fixture`, detail.response,
         `feeSourceId=${payableIds[index]}, sourceFeeId=${source?.sourceFeeId ?? 'missing'}`,
@@ -276,9 +278,12 @@ export async function run(context) {
   const producer = await import('./finance-full-fixtures.mjs')
   await producer.run(context)
   const fixture = context.createdResources.financeFullFixtures
-  if (!fixture || fixture.marker !== runMarker || fixture.customerId !== '10001') {
+  const qualificationFixture = context.context.merchantQualificationFixture
+  const customerId = id(fixture?.customerId)
+  if (!fixture || fixture.marker !== runMarker || !customerId
+      || customerId !== id(qualificationFixture?.tenantId)) {
     blocker(context, '取得演示企业真实 Finance fixture', null,
-      'finance-full-fixtures 未返回 marker=FIN-DEMO-20260812、customerId=10001 的独立资源，禁止借历史来源',
+      'finance-full-fixtures 未返回与 merchant-qualification-fixture 同客户的本轮独立资源，禁止借历史来源',
       'missing-finance-demo-fixture')
     return
   }
@@ -289,10 +294,10 @@ export async function run(context) {
     if (value) extraPayables.push(value)
   }
   const produced = [...fixture.feeSources.map((item) => ({ ...item, sourceFeeId: id(item.feeSourceId) })), ...extraPayables]
-  const pool = await waitForSources(context, produced.map((item) => item.sourceFeeId).filter(Boolean))
+  const pool = await waitForSources(context, customerId, produced.map((item) => item.sourceFeeId).filter(Boolean))
   const poolBySource = new Map(pool.map((item) => [id(item.sourceId), item]))
   const sources = produced.map((source) => ({ ...source,
-    feeSourceId: financeId(poolBySource.get(source.sourceFeeId)), marker: runMarker,
+    feeSourceId: financeId(poolBySource.get(source.sourceFeeId)), marker: runMarker, customerId,
     supplierId: id(source.supplierId ?? fixture.supplier?.supplierId) }))
     .filter((source) => source.feeSourceId)
   const receivables = sources.filter((source) => source.direction === 'RECEIVABLE')
@@ -304,7 +309,8 @@ export async function run(context) {
     return
   }
 
-  const matrix = { marker: MARKER, runMarker, customerId: '10001', customerLabel: '一期演示企业 10001',
+  const matrix = { marker: MARKER, runMarker, customerId,
+    customerLabel: qualificationFixture?.tenantName || `动态验收客户 ${customerId}`,
     feeSources: {}, statements: {}, receivableSettlements: {}, payableSettlements: {},
     voucherFileId: id(fixture.voucherFileId), container: fixture.container, allocations: fixture.allocations }
 
diff --git a/scripts/admin-test-env-modules/fulfillment-list-field-contract.mjs b/scripts/admin-test-env-modules/fulfillment-list-field-contract.mjs
index 05894ba14..9450f1031 100644
--- a/scripts/admin-test-env-modules/fulfillment-list-field-contract.mjs
+++ b/scripts/admin-test-env-modules/fulfillment-list-field-contract.mjs
@@ -146,22 +146,23 @@ export function customsCaseFieldGaps(record) {
 
 export function outboundAggregateFieldGaps(record) {
   const aggregate = record?.aggregate ?? record
-  return gaps(aggregate, {
-    orderId: isPositiveId,
-    inboundId: isPositiveId,
-    inboundCode: isNonBlank,
-    customerId: isPositiveId,
-    customerName: isNonBlank,
+  const result = gaps(aggregate, {
     containerBookingId: isPositiveId,
     containerNo: isNonBlank,
     loadingPlanId: isPositiveId,
     loadingPlanStatus: isNonBlank,
-    pickTaskId: isPositiveId,
-    pickTaskStatus: isNonBlank,
     oceanBookingId: isPositiveId,
     oceanBookingStatus: isNonBlank,
     dispatchStatus: isNonBlank,
     version: isNonNegativeNumber,
-    'gate.items': (value) => Array.isArray(value),
+    inbounds: (value) => Array.isArray(value) && value.length > 0,
+    'gate.inbounds': (value) => Array.isArray(value) && value.length > 0,
   })
+  for (const [index, inbound] of (Array.isArray(aggregate?.inbounds) ? aggregate.inbounds : []).entries()) {
+    result.push(...gaps(inbound, {
+      orderId: isPositiveId, inboundId: isPositiveId, inboundCode: isNonBlank,
+      tenantId: isPositiveId, inboundStatus: isNonBlank,
+    }).map((field) => `inbounds[${index}].${field}`))
+  }
+  return result
 }
diff --git a/scripts/admin-test-env-modules/fulfillment-prototype-field-matrix-contract.test.mjs b/scripts/admin-test-env-modules/fulfillment-prototype-field-matrix-contract.test.mjs
index 33330e2b0..b1320a6d9 100644
--- a/scripts/admin-test-env-modules/fulfillment-prototype-field-matrix-contract.test.mjs
+++ b/scripts/admin-test-env-modules/fulfillment-prototype-field-matrix-contract.test.mjs
@@ -91,7 +91,7 @@ test('字段校验器接受正式完整投影并精确暴露缺字段', () => {
     [portScheduleFieldGaps, { portSchedule: { schedule: { id: ids.id, scheduleNo: 'PS-1', sourceName: '船公司', vesselName: 'VESSEL', voyageNo: 'V1', departurePortCode: 'CNNGB', destinationPortCode: 'USLAX', etdAt: at, etaAt: at, observedAt: at, updatedAt: at, expiresAt: at }, expired: false } }, undefined, 'sourceName'],
     [truckAppointmentFieldGaps, { id: ids.id, appointmentNo: 'TA-1', oceanBookingId: ids.id, containerBookingId: ids.container, loadingPlanId: ids.plan, warehouseId: ids.id, warehouseName: '宁波仓', customerId: ids.id, customerName: '测试客户', carrierId: ids.id, carrierName: '拖车商', plannedLoadingAt: at, status: 'DRAFT', attachmentCount: 0 }, undefined, 'appointmentNo'],
     [customsCaseFieldGaps, { customsCase: { id: ids.id, customsNo: 'CUS-1', orderId: ids.order, inboundId: ids.inbound, containerBookingId: ids.container, checklistVersionId: ids.id, checklistCode: 'CHECK', checklistVersionNo: 'V1', status: 'DOCUMENTS_PENDING', updatedAt: at } }, undefined, 'checklistCode'],
-    [outboundAggregateFieldGaps, { orderId: ids.order, inboundId: ids.inbound, inboundCode: 'IN-1', customerId: ids.id, customerName: '测试客户', containerBookingId: ids.container, containerNo: 'MSCU1234567', loadingPlanId: ids.plan, loadingPlanStatus: 'COMPLETED', pickTaskId: ids.task, pickTaskStatus: 'COMPLETED', oceanBookingId: ids.id, oceanBookingStatus: 'RELEASED', dispatchStatus: 'READY_FOR_DISPATCH', version: 1, gate: { items: [] } }, undefined, 'inboundCode'],
+    [outboundAggregateFieldGaps, { containerBookingId: ids.container, containerNo: 'MSCU1234567', loadingPlanId: ids.plan, loadingPlanStatus: 'COMPLETED', oceanBookingId: ids.id, oceanBookingStatus: 'RELEASED', dispatchStatus: 'READY_FOR_DISPATCH', version: 1, inbounds: [{ orderId: ids.order, inboundId: ids.inbound, inboundCode: 'IN-1', tenantId: ids.id, inboundStatus: 'LOADED', pickTaskId: ids.task, pickTaskStatus: 'COMPLETED' }], gate: { inbounds: [{ inboundId: ids.inbound, inboundCode: 'IN-1', gate: { items: [] } }] } }, undefined, 'containerNo'],
   ]
   for (const [validator, sample, options, missing] of samples) {
     assert.deepEqual(validator(sample, options), [])
diff --git a/scripts/admin-test-env-modules/inbound-measurement-box-code-contract.test.mjs b/scripts/admin-test-env-modules/inbound-measurement-box-code-contract.test.mjs
index 4704d790d..0fed93283 100644
--- a/scripts/admin-test-env-modules/inbound-measurement-box-code-contract.test.mjs
+++ b/scripts/admin-test-env-modules/inbound-measurement-box-code-contract.test.mjs
@@ -22,7 +22,9 @@ test('measurement submission confirms weight evidence before submit', () => {
 })
 
 test('measurement fixture derives pallet resources from confirmed image count', () => {
-  assert.match(source, /palletCount: WEIGHING_IMAGE_COUNT/)
+  assert.match(source, /waitSplitVariant\?\.palletCount \|\| 1/)
+  assert.match(source, /palletIds: warehouseResourcesReady\.palletIds/)
+  assert.match(source, /confirmedRows\.length === palletIds\.length/)
   assert.doesNotMatch(source, /Math\.ceil\(Number\(totalVolumeCbm\)/)
   assert.doesNotMatch(source, /Math\.ceil\(totalVolume \/ DEFAULT_PALLET_CAPACITY_CBM\)/)
 })
diff --git a/scripts/admin-test-env-modules/inbound-measurement.mjs b/scripts/admin-test-env-modules/inbound-measurement.mjs
index 6c2f7e14d..f68f7d3d0 100644
--- a/scripts/admin-test-env-modules/inbound-measurement.mjs
+++ b/scripts/admin-test-env-modules/inbound-measurement.mjs
@@ -1,7 +1,6 @@
 const MODULE = 'inbound-measurement'
 const SCENARIO = 'mojia-carton-measurement'
 const OPTIONS = { scenario: SCENARIO, deploymentBlocker: true }
-const WEIGHING_IMAGE_COUNT = 1
 const FIXTURE_PALLET_CAPACITY_CBM = 1.2
 const WEIGHT_IMAGE = Uint8Array.from([137, 80, 78, 71, 13, 10, 26, 10, 0, 0, 0, 13, 73, 72, 68, 82,
   0, 0, 0, 1, 0, 0, 0, 1, 8, 6, 0, 0, 0, 31, 21, 196, 137, 0, 0, 0, 13, 73, 68, 65, 84,
@@ -44,16 +43,17 @@ async function provisionWarehouseResources(context, { inboundId, warehouseId, pa
   if (!warehouseId || !Number.isInteger(palletCount) || palletCount < 1) return null
 
   const suffix = `${String(context.marker).replace(/\D/g, '').slice(-8)}${String(inboundId).slice(-6)}`
-  const palletResponse = await context.request('POST', '/api/platform/v1/pallets?tenantId=0', {
-    warehouseId, palletType: 'STANDARD', capacityCbm: FIXTURE_PALLET_CAPACITY_CBM,
-    weightKg: 8, color: '蓝色', remark: `${context.marker}-INBOUND-${inboundId}`,
-  })
-  const palletId = asId(context.apiSuccess(MODULE, '创建称重托盘主数据', palletResponse,
-    `warehouseId=${warehouseId}`, OPTIONS))
-  if (!palletId) return null
-
   const resources = []
+  const palletIds = []
   for (let index = 1; index <= palletCount; index += 1) {
+    const palletResponse = await context.request('POST', '/api/platform/v1/pallets?tenantId=0', {
+      warehouseId, palletType: 'STANDARD', capacityCbm: FIXTURE_PALLET_CAPACITY_CBM,
+      weightKg: 8, color: '蓝色', remark: `${context.marker}-INBOUND-${inboundId}-PALLET-${index}`,
+    })
+    const palletId = asId(context.apiSuccess(MODULE, `创建称重托盘主数据 ${index}/${palletCount}`,
+      palletResponse, `warehouseId=${warehouseId}`, OPTIONS))
+    if (!palletId) return null
+    palletIds.push(palletId)
     const resourceSuffix = `${suffix}${String(index).padStart(2, '0')}`
     let locationId = null
     if (context.context?.phase3LoadingRequireSharedOverflow !== true) {
@@ -75,54 +75,65 @@ async function provisionWarehouseResources(context, { inboundId, warehouseId, pa
     marker: context.marker, tenantId: '0', warehouseId: asId(warehouseId), palletCount,
     palletCapacityCbm: FIXTURE_PALLET_CAPACITY_CBM, resources,
   }
-  return { palletId, palletCount, resources }
+  return { palletId: palletIds[0], palletIds, palletCount, resources }
 }
 
-async function createConfirmedWeightEvidence(context, { inboundId, tenantId, palletId }) {
-  const uploadResponse = await context.requestMultipart('POST',
-    `/api/platform/v1/files/measurements/${tenantId}/${inboundId}`, {
-      content: WEIGHT_IMAGE, type: 'image/png', name: `weight-${inboundId}.png`,
-    })
-  const upload = context.apiSuccess(MODULE, '上传称重图片并执行 OCR', uploadResponse,
-    `inboundId=${inboundId}`, OPTIONS)
-  const fileId = asId(upload?.fileId)
-  if (!fileId) return null
+async function createConfirmedWeightEvidence(context, {
+  inboundId, tenantId, palletIds, grossWeightPerPalletKg,
+}) {
+  if (!Array.isArray(palletIds) || palletIds.length < 1) return null
+  const confirmedResults = []
+  for (let index = 0; index < palletIds.length; index += 1) {
+    const palletId = palletIds[index]
+    const uploadResponse = await context.requestMultipart('POST',
+      `/api/platform/v1/files/measurements/${tenantId}/${inboundId}`, {
+        content: WEIGHT_IMAGE, type: 'image/png', name: `weight-${inboundId}-${index + 1}.png`,
+      })
+    const upload = context.apiSuccess(MODULE, `上传称重图片并执行 OCR ${index + 1}/${palletIds.length}`,
+      uploadResponse, `inboundId=${inboundId}`, OPTIONS)
+    const fileId = asId(upload?.fileId)
+    if (!fileId) return null
 
-  const createResponse = await context.request('POST',
-    `/api/platform/v1/first-leg/inbounds/${inboundId}/weight-results?${query(tenantId)}`, {
-      fileId, palletId, ocrProvider: 'ADMIN_ACCEPTANCE', ocrRawText: null,
-      ocrWeightValue: null, ocrWeightUnit: null, confidence: null,
-    })
-  const created = context.apiSuccess(MODULE, '登记称重图片与托盘快照', createResponse,
-    `fileId=${fileId}, palletId=${palletId}`, OPTIONS)
-  if (!created?.id) return null
+    const createResponse = await context.request('POST',
+      `/api/platform/v1/first-leg/inbounds/${inboundId}/weight-results?${query(tenantId)}`, {
+        fileId, palletId, ocrProvider: 'ADMIN_ACCEPTANCE', ocrRawText: null,
+        ocrWeightValue: null, ocrWeightUnit: null, confidence: null,
+      })
+    const created = context.apiSuccess(MODULE, `登记称重图片与托盘快照 ${index + 1}/${palletIds.length}`,
+      createResponse, `fileId=${fileId}, palletId=${palletId}`, OPTIONS)
+    if (!created?.id) return null
 
-  const confirmResponse = await context.request('POST',
-    `/api/platform/v1/first-leg/inbounds/${inboundId}/weight-results/${created.id}/confirm?${query(tenantId)}`, {
-      version: Number(created.version), adjustedWeightValue: 100,
-      adjustedWeightUnit: 'KG', adjustmentReason: `${context.marker} 自动化人工确认称重`,
-    })
-  const confirmed = context.apiSuccess(MODULE, '人工确认称重图片净重', confirmResponse,
-    `resultId=${created.id}, palletId=${palletId}`, OPTIONS)
-  const netWeightKg = Number(confirmed?.netWeightKg)
-  const grossWeightKg = Number(confirmed?.grossWeightKg)
-  if (confirmed?.recognitionStatus !== 'CONFIRMED' || !Number.isFinite(netWeightKg) || netWeightKg <= 0) {
-    return null
+    const grossWeight = Number(grossWeightPerPalletKg) + index * 5
+    const confirmResponse = await context.request('POST',
+      `/api/platform/v1/first-leg/inbounds/${inboundId}/weight-results/${created.id}/confirm?${query(tenantId)}`, {
+        version: Number(created.version), adjustedWeightValue: grossWeight,
+        adjustedWeightUnit: 'KG', adjustmentReason: `${context.marker} 自动化人工确认称重`,
+      })
+    const confirmed = context.apiSuccess(MODULE, `人工确认称重图片净重 ${index + 1}/${palletIds.length}`,
+      confirmResponse, `resultId=${created.id}, palletId=${palletId}`, OPTIONS)
+    const netWeightKg = Number(confirmed?.netWeightKg)
+    const grossWeightKg = Number(confirmed?.grossWeightKg)
+    if (confirmed?.recognitionStatus !== 'CONFIRMED' || !Number.isFinite(netWeightKg) || netWeightKg <= 0) {
+      return null
+    }
+    confirmedResults.push({ id: asId(created.id), palletId, netWeightKg, grossWeightKg })
   }
 
   const workspaceResponse = await context.request('GET',
     `/api/platform/v1/first-leg/inbounds/${inboundId}/measurement?${query(tenantId)}`)
   const workspace = context.apiSuccess(MODULE, '回查已确认称重图片和货物总重量', workspaceResponse,
-    `resultId=${created.id}`, OPTIONS)
+    `resultIds=${confirmedResults.map((result) => result.id).join(',')}`, OPTIONS)
   const confirmedRows = (workspace?.weightResults || [])
     .filter((result) => result?.recognitionStatus === 'CONFIRMED')
-  const persisted = confirmedRows.length === WEIGHING_IMAGE_COUNT
-    && asId(confirmedRows[0]?.id) === asId(created.id)
-    && asId(confirmedRows[0]?.palletId) === palletId
+  const grossWeightKg = confirmedResults.reduce((sum, result) => sum + result.grossWeightKg, 0)
+  const netWeightKg = confirmedResults.reduce((sum, result) => sum + result.netWeightKg, 0)
+  const persisted = confirmedRows.length === palletIds.length
+    && confirmedResults.every((expected) => confirmedRows.some((row) =>
+      asId(row?.id) === expected.id && asId(row?.palletId) === expected.palletId))
     && closeTo(workspace?.actualGrossWeightKg, grossWeightKg, 0.001)
     && closeTo(workspace?.actualNetWeightKg, netWeightKg, 0.001)
   context.assert(MODULE, '图片张数决定托数且净重汇总已落地', workspaceResponse, persisted,
-    `confirmedImages=${confirmedRows.length}, expectedPallets=${WEIGHING_IMAGE_COUNT}, grossWeight=${grossWeightKg}, netWeight=${netWeightKg}, actualGross=${workspace?.actualGrossWeightKg ?? 'missing'}, actualNet=${workspace?.actualNetWeightKg ?? 'missing'}`,
+    `confirmedImages=${confirmedRows.length}, expectedPallets=${palletIds.length}, grossWeight=${grossWeightKg}, netWeight=${netWeightKg}, actualGross=${workspace?.actualGrossWeightKg ?? 'missing'}, actualNet=${workspace?.actualNetWeightKg ?? 'missing'}`,
     OPTIONS)
   return persisted ? { count: confirmedRows.length, grossWeightKg, netWeightKg } : null
 }
@@ -280,8 +291,8 @@ export async function run(context) {
   }
 
   const scanPath = `/api/platform/v1/first-leg/inbounds/${inboundId}/measurement/carton-scans?${query(tenantId)}`
-  // Keep the isolated sample inside the customer's largest configured inner box (60x50x50cm).
-  const firstDimensions = { length: 59.1, width: 40.2, height: 30.3 }
+  const measurementProfile = context.context?.waitSplitVariant?.measurementProfile
+  const firstDimensions = measurementProfile?.first || { length: 59.1, width: 40.2, height: 30.3 }
   const firstShipmentId = `FBA-${context.marker.slice(-12)}-01`
   const firstScanResponse = await multipartRequest(context, scanPath, {
     boxCode, ...firstDimensions, scannedShipmentId: firstShipmentId,
@@ -325,7 +336,7 @@ export async function run(context) {
       && Number(countResult?.measurementVersion) === Number(firstScan.measurementVersion) + 1,
     `version=${countResult?.measurementVersion ?? 'missing'}`, OPTIONS)
 
-  const replacement = { length: 59.5, width: 41.2, height: 31.3 }
+  const replacement = measurementProfile?.replacement || { length: 59.5, width: 41.2, height: 31.3 }
   const replacementShipmentId = `FBA-${context.marker.slice(-12)}-02`
   const rescanResponse = await multipartRequest(context, scanPath, {
     boxCode, ...replacement, scannedShipmentId: replacementShipmentId,
@@ -342,8 +353,7 @@ export async function run(context) {
   let measuredResponse = await context.request('GET', measurementPath)
   let measured = context.apiSuccess(MODULE, '回查覆盖后的尺寸与体积结果', measuredResponse, '', OPTIONS)
   let measuredItem = measured?.items?.find((item) => asId(item.id) === asId(firstScan.itemId))
-  // The verified customer rule maps this scan to EXTRA_LARGE 60x50x50cm and adds 2cm per edge.
-  const weightedOuter = { length: 64, width: 54, height: 54 }
+  const weightedOuter = measurementProfile?.outer || { length: 64, width: 54, height: 54 }
   const unitVolume = halfUp(
     weightedOuter.length * weightedOuter.width * weightedOuter.height / 1_000_000, 3)
   const totalVolume = unitVolume * originalPackageCount
@@ -374,7 +384,7 @@ export async function run(context) {
         `/api/platform/v1/first-leg/inbounds/${inboundId}/measurement/items/${firstScan.itemId}/confirmed-package-count?${query(tenantId)}`,
         { measurementVersion: Number(measured?.version), confirmedPackageCount: packagesPerDetail })
       const resetFirstCount = context.apiSuccess(MODULE,
-        '增量 fixture 将首条货物确认箱数恢复为自身两箱', resetFirstCountResponse,
+        '增量 fixture 将首条货物确认箱数恢复为自身箱数', resetFirstCountResponse,
         `itemId=${asId(firstScan.itemId)}, confirmedPackageCount=${packagesPerDetail}`, OPTIONS)
       context.assert(MODULE, '增量首条货物箱数和版本更新正确', resetFirstCountResponse,
         Number(resetFirstCount?.confirmedPackageCount) === packagesPerDetail
@@ -409,10 +419,10 @@ export async function run(context) {
           `measurementVersion=${countDetail?.measurementVersion ?? 'missing'}`, OPTIONS)
       }
       measuredResponse = await context.request('GET', measurementPath)
-      measured = context.apiSuccess(MODULE, '回查增量 fixture 四条测量明细', measuredResponse, '', OPTIONS)
+      measured = context.apiSuccess(MODULE, '回查增量 fixture 动态测量明细', measuredResponse, '', OPTIONS)
       measuredItem = measured?.items?.find((item) => asId(item.id) === asId(firstScan.itemId))
       const detailIds = new Set((measured?.items || []).map((item) => asId(item?.inboundDetailId)).filter(Boolean))
-      context.assert(MODULE, '增量 fixture 形成四条真实独立货物测量明细', measuredResponse,
+      context.assert(MODULE, '增量 fixture 形成动态真实独立货物测量明细', measuredResponse,
         detailIds.size >= incrementalDetailCount
           && measured.items.filter((item) => detailIds.has(asId(item?.inboundDetailId))).length >= incrementalDetailCount,
         `measurementItems=${measured?.items?.length ?? 'missing'}, distinctInboundDetails=${detailIds.size}`, OPTIONS)
@@ -482,12 +492,13 @@ export async function run(context) {
     return
   }
 
+  const palletCount = Math.max(1, Number(context.context?.waitSplitVariant?.palletCount || 1))
   const warehouseResourcesReady = await provisionWarehouseResources(context, {
-    inboundId, warehouseId: asId(summary?.warehouseId), palletCount: WEIGHING_IMAGE_COUNT,
+    inboundId, warehouseId: asId(summary?.warehouseId), palletCount,
   })
   context.assert(MODULE, '测量提交前按称重图片数准备真实库位', draftResponse,
     Boolean(warehouseResourcesReady),
-    `warehouseId=${asId(summary?.warehouseId) || 'missing'}, palletCount=${WEIGHING_IMAGE_COUNT}`,
+    `warehouseId=${asId(summary?.warehouseId) || 'missing'}, palletCount=${palletCount}`,
     OPTIONS)
   if (!warehouseResourcesReady) {
     finishScenario(context, start)
@@ -495,11 +506,12 @@ export async function run(context) {
   }
 
   const weightEvidence = await createConfirmedWeightEvidence(context, {
-    inboundId, tenantId, palletId: warehouseResourcesReady.palletId,
+    inboundId, tenantId, palletIds: warehouseResourcesReady.palletIds,
+    grossWeightPerPalletKg: Number(context.context?.waitSplitVariant?.grossWeightPerPalletKg || 100),
   })
   context.assert(MODULE, '测量提交前已通过正式接口确认称重图片', draftResponse,
     Boolean(weightEvidence),
-    `confirmedImages=${weightEvidence?.count ?? 0}, expected=${WEIGHING_IMAGE_COUNT}`,
+    `confirmedImages=${weightEvidence?.count ?? 0}, expected=${palletCount}`,
     OPTIONS)
   if (!weightEvidence) {
     finishScenario(context, start)
diff --git a/scripts/admin-test-env-modules/initialization-baseline-contract.test.mjs b/scripts/admin-test-env-modules/initialization-baseline-contract.test.mjs
index 746730c2a..37a023f43 100644
--- a/scripts/admin-test-env-modules/initialization-baseline-contract.test.mjs
+++ b/scripts/admin-test-env-modules/initialization-baseline-contract.test.mjs
@@ -7,23 +7,23 @@ const iamSeed = readFileSync(new URL('../../iam/src/main/resources/db/phase1-adm
 const oceanBookingSchema = readFileSync(new URL('../../firstleg/src/main/resources/db/phase3-ocean-booking-schema.sql', import.meta.url), 'utf8')
 const truckAppointmentSchema = readFileSync(new URL('../../firstleg/src/main/resources/db/phase3-truck-appointment-schema.sql', import.meta.url), 'utf8')
 
-test('统一初始化 SQL 保留最小登录与客户主体', () => {
-  assert.match(sql, /一个平台系统管理员和一个 IT 测试客户管理员/)
+test('统一初始化 SQL 只保留平台管理员且不创建固定客户', () => {
+  assert.match(sql, /最小登录基线只保留平台系统管理员/)
   assert.equal((sql.match(/'platform_admin'/g) || []).length, 1)
-  assert.equal((sql.match(/'merchant_admin'/g) || []).length, 1)
-  assert.match(sql, /\(10001, 'IT_TEST', 'IT 测试客户'/)
+  assert.doesNotMatch(sql, /'merchant_admin'|'IT_TEST'|'IT 测试客户'/)
+  assert.doesNotMatch(iamSeed, /'IT_TEST'|'IT 测试客户'|\(10001,/)
   const accountSeed = sql.match(/INSERT INTO auth_account \([\s\S]*?deleted = 0;/)?.[0]
   assert.ok(accountSeed, 'missing auth account seed')
   assert.doesNotMatch(accountSeed, /ON DUPLICATE KEY UPDATE[\s\S]*?password_hash\s*=/,
     're-running the unified SQL must not reset an existing account password')
 })
 
-test('IT 测试客户初始化后具备已审核的必填资质和下单资格', () => {
-  for (const source of [sql, iamSeed]) {
-    assert.match(source, /\(2100001, 10001, 'BUSINESS_LICENSE', '91310000ITTEST0001', NULL,[\s\S]*?'APPROVED'/)
-    assert.match(source, /\(2100002, 10001, 'LEGAL_PERSON_ID', NULL, NULL,[\s\S]*?'APPROVED'/)
-    assert.match(source, /status = 'APPROVED'/)
-  }
+test('统一初始化直接提供tenant0商户角色与权限模板', () => {
+  assert.match(sql, /4000100, 0, 'MERCHANT', 'MERCHANT_OWNER'/)
+  assert.match(sql, /5300000, 0, 'MERCHANT', 'MENU',[\s\S]*?'merchant:enterprise'/)
+  assert.match(sql, /5301024, 0, 'MERCHANT', 'BUTTON',[\s\S]*?'merchant:order:quick-create'/)
+  assert.match(sql, /5305000, 0, 'MERCHANT', 'MENU',[\s\S]*?'merchant:finance:statement'/)
+  assert.match(sql, /r\.id=4000100[\s\S]*?客户全局管理员 Finance 模板授权不完整/)
 })
 
 test('统一初始化 SQL 提供人工验收所需公共仓储主数据', () => {
@@ -32,6 +32,9 @@ test('统一初始化 SQL 提供人工验收所需公共仓储主数据', () =>
     "'CAR-001'", "'CARRIER'", "'SHIPPER'", "'EXP-TEST'", "'IT 测试快递'",
   ]) assert.ok(sql.includes(marker), `missing initialization marker: ${marker}`)
   assert.match(sql, /'EXP-TEST', 'IT 测试快递'[\s\S]*?'ACTIVE'/)
+  assert.match(sql, /193000000000400003,0,193000000000200003,'RECEIVING','海外收货',1,'16:00:00',[\s\S]*?'洛杉矶仓海外接柜入仓收货能力'/)
+  assert.match(sql, /193000000000400004,0,193000000000200004,'RECEIVING','海外收货',1,'16:00:00',[\s\S]*?'纽约仓海外接柜入仓收货能力'/)
+  assert.match(sql, /固定平台作业仓收货能力写入校验失败/)
 
   const palletSeed = sql.match(/INSERT INTO wh_pallet \([\s\S]*?remark = VALUES\(remark\);/)?.[0]
   assert.ok(palletSeed, 'missing pallet initialization seed')
diff --git a/scripts/admin-test-env-modules/merchant-qualification-fixture-contract.test.mjs b/scripts/admin-test-env-modules/merchant-qualification-fixture-contract.test.mjs
index 8d080ea93..ac4d215a1 100644
--- a/scripts/admin-test-env-modules/merchant-qualification-fixture-contract.test.mjs
+++ b/scripts/admin-test-env-modules/merchant-qualification-fixture-contract.test.mjs
@@ -4,6 +4,7 @@ import test from 'node:test'
 
 const acceptance = readFileSync(new URL('../admin-test-env-acceptance.mjs', import.meta.url), 'utf8')
 const fixture = readFileSync(new URL('./merchant-qualification-fixture.mjs', import.meta.url), 'utf8')
+const orders = readFileSync(new URL('./orders.mjs', import.meta.url), 'utf8')
 
 test('默认全量验收先准备已审核商户再运行订单链路', () => {
   const modules = acceptance.match(/const CONFIGURED_MODULES = \[([^\n]+)\]/)?.[1] || ''
@@ -15,9 +16,45 @@ test('默认全量验收先准备已审核商户再运行订单链路', () => {
 test('商户夹具通过正式 File 和 IAM 审核流程建立下单资格', () => {
   assert.match(fixture, /files\/qualifications\/\$\{encodeURIComponent\(tenantId\)\}\/required-package/)
   assert.match(fixture, /iam\/tenants\/\$\{encodeURIComponent\(tenantId\)\}\/submit-review/)
+  assert.match(fixture, /iam\/tenants\/\$\{encodeURIComponent\(tenantId\)\}\/dimension-initialization/)
+  assert.match(fixture, /status === 'READY'/)
+  assert.match(fixture, /setTimeout\(resolve, 500\)/)
   assert.match(fixture, /iam\/reviews\/\$\{encodeURIComponent\(review\.id\)\}\/approve/)
   assert.match(fixture, /item\.status === 'APPROVED'/)
   assert.match(fixture, /MERCHANT_TEST_USERNAME/)
   assert.match(fixture, /MERCHANT_TEST_PASSWORD/)
+  assert.match(fixture, /context\.options\?\.customerName/)
   assert.doesNotMatch(fixture, /internal\/iam|UPDATE\s+iam_|INSERT\s+INTO\s+iam_/i)
 })
+
+test('批量待分柜参数固定同一客户并限制为订单测量链', () => {
+  assert.match(acceptance, /--customer-name <name>/)
+  assert.match(acceptance, /--merchant-username <name>/)
+  assert.match(acceptance, /--origin-warehouse-name <name>/)
+  assert.match(acceptance, /--channel-name <name>/)
+  assert.match(acceptance, /--wait-split-count <n>/)
+  assert.match(acceptance, /--order-profile-mode <mode>/)
+  assert.match(acceptance, /merchant-username和merchant-password必须同时提供/)
+  assert.match(acceptance, /modules\.splice\(fixtureIndex, 1\)/)
+  assert.match(acceptance, /wait-split-count必须是1-100的整数/)
+  assert.match(acceptance, /批量WAIT_SPLIT只允许执行merchant-qualification-fixture、orders、inbound-measurement/)
+  assert.match(acceptance, /createAdditionalWaitSplitFixtures/)
+  assert.match(acceptance, /measurement\.processStatus === 'WAIT_SPLIT'/)
+  assert.match(acceptance, /measurement\.finalStatus === 'APPROVED'/)
+  assert.match(acceptance, /waitSplitVariant\(sequence\)/)
+  assert.match(acceptance, /packageCountPerSku/)
+  assert.match(acceptance, /grossWeightPerPalletKg/)
+  assert.match(acceptance, /randomizedOrderProfile\(sequence\)/)
+  assert.match(acceptance, /\['PRIVATE', 'STANDARD'\]/)
+  assert.match(acceptance, /ONE_CLICK_DROPSHIP/)
+  assert.match(acceptance, /destinationWarehouseCode: order\.destinationWarehouseCode/)
+  assert.match(acceptance, /channelName: order\.channelName/)
+  assert.match(acceptance, /pricingTaxMode: order\.pricingTaxMode/)
+  assert.match(orders, /customerId: profile\.id/)
+  assert.match(orders, /customerName: companyName/)
+  assert.match(orders, /\['FBA', 'OVERSEAS', 'PRIVATE'\]\.includes/)
+  assert.match(orders, /destinationType === 'PRIVATE'/)
+  assert.match(orders, /PRIVATE_ADDRESS/)
+  assert.match(orders, /eligible\.length < 1/)
+  assert.doesNotMatch(orders, /customerName: master\.partner\?\.partnerName/)
+})
diff --git a/scripts/admin-test-env-modules/merchant-qualification-fixture.mjs b/scripts/admin-test-env-modules/merchant-qualification-fixture.mjs
index 6e586c0e5..a21a9053c 100644
--- a/scripts/admin-test-env-modules/merchant-qualification-fixture.mjs
+++ b/scripts/admin-test-env-modules/merchant-qualification-fixture.mjs
@@ -9,12 +9,30 @@ function id(value) {
   return value === undefined || value === null ? '' : String(value)
 }
 
+async function waitForDimensionInitialization(context, tenantId) {
+  let response = null
+  let status = 'PENDING'
+  let attempt = 0
+  for (; attempt < 30; attempt += 1) {
+    response = await context.request('GET',
+      `/api/platform/v1/iam/tenants/${encodeURIComponent(tenantId)}/dimension-initialization`)
+    status = response.http === 200 && String(response.body?.code) === '200'
+      ? response.body?.data?.status : 'REQUEST_FAILED'
+    if (status === 'READY' || status === 'FAILED') break
+    await new Promise((resolve) => setTimeout(resolve, 500))
+  }
+  context.assert(MODULE, '客户默认尺寸后台初始化已就绪', response, status === 'READY',
+    `tenantId=${tenantId}, status=${status}, attempts=${attempt + 1}`, { deploymentBlocker: true })
+  if (status !== 'READY') throw new Error(`客户默认尺寸初始化未就绪: ${status}`)
+}
+
 export async function run(context) {
   const suffix = context.marker.replace(/[^0-9A-Z]/gi, '').slice(-10).padStart(10, '0')
+  const customerName = String(context.options?.customerName || '').trim()
   const phone = await context.findAvailablePhone(MODULE)
   const createResponse = await context.request('POST', '/api/platform/v1/iam/tenants', {
-    tenantName: `全量验收下单客户-${suffix}`,
-    legalName: `全量验收下单有限公司-${suffix}`,
+    tenantName: customerName || `全量验收下单客户-${suffix}`,
+    legalName: customerName ? `${customerName}有限公司` : `全量验收下单有限公司-${suffix}`,
     legalRepresentative: '全量验收法人',
     contactName: '全量验收管理员',
     contactPhone: phone,
@@ -63,6 +81,8 @@ export async function run(context) {
     `tenantId=${tenantId}, reviewId=${id(review?.id) || 'missing'}`, { deploymentBlocker: true })
   if (!review?.id) throw new Error('未找到隔离下单客户的待审核单')
 
+  await waitForDimensionInitialization(context, tenantId)
+
   const approveResponse = await context.request('POST',
     `/api/platform/v1/iam/reviews/${encodeURIComponent(review.id)}/approve`,
     { comment: `${context.marker} 全量验收正式资质审核通过` })
diff --git a/scripts/admin-test-env-modules/order-inbound-status-fixtures.mjs b/scripts/admin-test-env-modules/order-inbound-status-fixtures.mjs
index fdfe9b1b9..246386f9e 100644
--- a/scripts/admin-test-env-modules/order-inbound-status-fixtures.mjs
+++ b/scripts/admin-test-env-modules/order-inbound-status-fixtures.mjs
@@ -2,8 +2,8 @@ import { findPricedOrderRouteAcrossOrigins } from './orders.mjs'
 
 const MODULE = 'order-inbound-status-fixtures'
 const OPTIONS = { scenario: 'manual-order-inbound-status-matrix', deploymentBlocker: true }
-const MERCHANT_USERNAME = process.env.MERCHANT_TEST_USERNAME || 'merchant_admin'
-const MERCHANT_PASSWORD = process.env.MERCHANT_TEST_PASSWORD || 'ChangeMe123!'
+const MERCHANT_USERNAME = process.env.MERCHANT_TEST_USERNAME || ''
+const MERCHANT_PASSWORD = process.env.MERCHANT_TEST_PASSWORD || ''
 
 const ORDER_TARGETS = [
   ['DRAFT', []],
diff --git a/scripts/admin-test-env-modules/orders.mjs b/scripts/admin-test-env-modules/orders.mjs
index 3e7b83c41..d3d3c5954 100644
--- a/scripts/admin-test-env-modules/orders.mjs
+++ b/scripts/admin-test-env-modules/orders.mjs
@@ -1,7 +1,7 @@
 const MODULE = 'orders'
 const CONTRACT_OPTIONS = { scenario: 'isolated-order-chain', deploymentBlocker: true }
-const MERCHANT_USERNAME = process.env.MERCHANT_TEST_USERNAME || 'merchant_admin'
-const MERCHANT_PASSWORD = process.env.MERCHANT_TEST_PASSWORD || 'ChangeMe123!'
+const MERCHANT_USERNAME = process.env.MERCHANT_TEST_USERNAME || ''
+const MERCHANT_PASSWORD = process.env.MERCHANT_TEST_PASSWORD || ''
 const BOXES = [
   { boxType: 'SMALL', lengthCm: 30, widthCm: 20, heightCm: 20 },
   { boxType: 'MEDIUM', lengthCm: 40, widthCm: 30, heightCm: 30 },
@@ -21,8 +21,8 @@ function success(response) { return Boolean(response) && response.http === 200 &
 function sleep(milliseconds) { return new Promise((resolve) => setTimeout(resolve, milliseconds)) }
 function key(context, operation) { return `${context.marker}-${operation}`.slice(0, 128) }
 export function requestedOrderDestinationType(context) {
-  return String(context?.context?.orderDestinationType || 'FBA').trim().toUpperCase() === 'OVERSEAS'
-    ? 'OVERSEAS' : 'FBA'
+  const value = String(context?.context?.orderDestinationType || 'FBA').trim().toUpperCase()
+  return ['FBA', 'OVERSEAS', 'PRIVATE'].includes(value) ? value : 'FBA'
 }
 export function approvedInboundReady(orderDetail, taskResponse, tenantId, orderId) {
   const summary = orderDetail?.summary
@@ -202,35 +202,88 @@ async function assertProductImageDownload(context, merchantToken, fileId) {
 
 async function loadMasterData(context, merchantToken) {
   const destinationType = requestedOrderDestinationType(context)
+  const fixedRoute = context.context?.waitSplitRoute || {}
   const domesticResponse = await request(context, 'GET',
     '/api/merchant/v1/warehouses?page=1&size=200&status=ACTIVE&warehouseType=DOMESTIC', undefined, merchantToken)
   const domesticPage = context.apiSuccess(MODULE, 'Client 查询国内收货仓', domesticResponse)
   context.assert(MODULE, '存在可用国内收货仓', domesticResponse, records(domesticPage).length > 0,
     `count=${records(domesticPage).length}`)
 
-  const destinationResponse = await request(context, 'GET',
-    `/api/merchant/v1/warehouses?page=1&size=200&status=ACTIVE&warehouseType=${encodeURIComponent(destinationType)}`,
-    undefined, merchantToken)
-  const destinationPage = context.apiSuccess(MODULE, `Client 查询 ${destinationType} 目的仓`, destinationResponse)
-  context.assert(MODULE, `存在可用 ${destinationType} 目的仓`, destinationResponse,
-    records(destinationPage).length > 0, `count=${records(destinationPage).length}`)
+  let destinationResponse = null
+  let destinationPage = null
+  if (destinationType !== 'PRIVATE') {
+    destinationResponse = await request(context, 'GET',
+      `/api/merchant/v1/warehouses?page=1&size=200&status=ACTIVE&warehouseType=${encodeURIComponent(destinationType)}`,
+      undefined, merchantToken)
+    destinationPage = context.apiSuccess(MODULE, `Client 查询 ${destinationType} 目的仓`, destinationResponse)
+    context.assert(MODULE, `存在可用 ${destinationType} 目的仓`, destinationResponse,
+      records(destinationPage).length > 0, `count=${records(destinationPage).length}`)
+  }
   const receivings = records(domesticPage).filter((warehouse) => warehouse?.status === 'ACTIVE')
-  const destinations = records(destinationPage).filter((warehouse) => warehouse?.status === 'ACTIVE')
-  if (receivings.length === 0 || destinations.length === 0) throw new Error('缺少创建测试订单所需的收货仓或目的仓')
+  let destinations = records(destinationPage).filter((warehouse) => warehouse?.status === 'ACTIVE')
+  if (Number(destinationPage?.total) > destinations.length) {
+    const nextResponse = await request(context, 'GET',
+      `/api/merchant/v1/warehouses?page=2&size=200&status=ACTIVE&warehouseType=${encodeURIComponent(destinationType)}`,
+      undefined, merchantToken)
+    const nextPage = context.apiSuccess(MODULE, `Client 查询 ${destinationType} 目的仓第二页`, nextResponse)
+    destinations = [...destinations, ...records(nextPage).filter((warehouse) => warehouse?.status === 'ACTIVE')]
+  }
+  if (receivings.length === 0 || (destinationType !== 'PRIVATE' && destinations.length === 0)) {
+    throw new Error('缺少创建测试订单所需的收货仓或目的仓')
+  }
 
-  const pricingResult = await findPricedOrderRouteAcrossOrigins({
-    receivings, destinations,
-    loadChannels: (receiving) => request(context, 'GET',
+  let pricingResult
+  if (fixedRoute.originWarehouseName && (fixedRoute.channelCode || fixedRoute.channelName)) {
+    const receiving = receivings.find((warehouse) => warehouse.warehouseName === fixedRoute.originWarehouseName)
+    if (!receiving) throw new Error(`未找到固定起运仓: ${fixedRoute.originWarehouseName}`)
+    const channelsResponse = await request(context, 'GET',
       `/api/merchant/v1/first-leg/pricing/channels?originWarehouseId=${encodeURIComponent(receiving.id)}`,
-      undefined, merchantToken),
-    estimate: (body) => request(context, 'POST', '/api/merchant/v1/first-leg/pricing/estimate', body, merchantToken),
-    destinationType,
-  })
+      undefined, merchantToken)
+    const channels = context.apiSuccess(MODULE, 'Client 查询固定起运仓物流渠道', channelsResponse)
+    const channel = (Array.isArray(channels) ? channels : []).find((item) =>
+      (!fixedRoute.channelCode || item.channelCode === fixedRoute.channelCode)
+      && (!fixedRoute.channelName || item.channelName === fixedRoute.channelName))
+    if (!channel) throw new Error(`未找到固定物流渠道: ${fixedRoute.channelCode || fixedRoute.channelName}`)
+    const modes = Array.isArray(channel.pricingTaxModes) ? [...channel.pricingTaxModes] : []
+    if (modes.length === 0) throw new Error('固定物流渠道没有可用报价税制')
+    const shift = modes.length ? Number(fixedRoute.taxModeIndex || 0) % modes.length : 0
+    const selectedChannel = { ...channel, pricingTaxModes: [...modes.slice(shift), ...modes.slice(0, shift)] }
+    if (destinationType === 'PRIVATE') {
+      pricingResult = { receiving, priced: { channel: selectedChannel,
+        pricingTaxMode: selectedChannel.pricingTaxModes[0], destination: null },
+        response: channelsResponse, attempts: 0, failures: [], originFailures: [] }
+    } else {
+      const detailResponse = await context.request('GET',
+        `/api/platform/v1/fba-pricing/carrier-rates/price-books/${encodeURIComponent(channel.priceBookVersionId)}`)
+      const detail = context.apiSuccess(MODULE, 'Admin 查询固定渠道当前价格明细', detailResponse)
+      const pricedCodes = new Set((detail?.rates || [])
+        .filter((rate) => rate.channelCode === channel.channelCode && rate.destinationType === destinationType)
+        .map((rate) => String(rate.destinationCode || '').trim()).filter(Boolean))
+      const eligible = destinations.filter((destination) => pricedCodes.has(String(destination.warehouseCode)))
+      if (eligible.length < 1) throw new Error(`固定渠道没有可计价目的仓: ${destinationType}`)
+      const destination = eligible[Number(fixedRoute.destinationIndex || 0) % eligible.length]
+      const result = await findPricedOrderRoute({
+        receiving, destinations: [destination], channels: [selectedChannel],
+        estimate: (body) => request(context, 'POST', '/api/merchant/v1/first-leg/pricing/estimate', body, merchantToken),
+        destinationType,
+      })
+      pricingResult = { receiving, ...result, originFailures: [] }
+    }
+  } else {
+    pricingResult = await findPricedOrderRouteAcrossOrigins({
+      receivings, destinations,
+      loadChannels: (receiving) => request(context, 'GET',
+        `/api/merchant/v1/first-leg/pricing/channels?originWarehouseId=${encodeURIComponent(receiving.id)}`,
+        undefined, merchantToken),
+      estimate: (body) => request(context, 'POST', '/api/merchant/v1/first-leg/pricing/estimate', body, merchantToken),
+      destinationType,
+    })
+  }
   const priced = pricingResult.priced
   const receiving = pricingResult.receiving
   context.addStep(MODULE, 'Client 从 ACTIVE 国内仓选择具有真实价格覆盖的渠道和目的仓', pricingResult.response, Boolean(priced),
     priced
-      ? `origin=${receiving.id}, priceBookVersionId=${priced.channel.priceBookVersionId}, channel=${priced.channel.channelCode}, pricingTaxMode=${priced.pricingTaxMode}, destination=${priced.destination.warehouseCode}, attempts=${pricingResult.attempts}`
+      ? `origin=${receiving.id}, priceBookVersionId=${priced.channel.priceBookVersionId}, channel=${priced.channel.channelCode}, pricingTaxMode=${priced.pricingTaxMode}, destination=${priced.destination?.warehouseCode || 'PRIVATE_ADDRESS'}, attempts=${pricingResult.attempts}`
       : originPricingFailureEvidence(pricingResult),
     CONTRACT_OPTIONS)
   if (!priced) throw new Error(`当前 ACTIVE 国内收货仓、渠道、报价税制和 ${destinationType} 目的仓没有可计价组合`)
@@ -249,22 +302,39 @@ function buildPayload(context, profile, master, productImageFileId) {
   const shipmentId = `SHIP-${context.marker}`.slice(0, 64)
   const referenceId = `REF-${context.marker}`.slice(0, 64)
   const companyName = profile.tenantName || `订单验收客户-${context.marker}`
+  const requestedSkuCount = Number(context.context?.waitSplitVariant?.skuCount || BOXES.length)
+  const skuCount = Math.max(1, Math.min(BOXES.length, requestedSkuCount))
+  const packageCountPerSku = Math.max(1,
+    Number(context.context?.waitSplitVariant?.packageCountPerSku
+      || context.context?.phase3LoadingIncrementalPackageCount || 1))
+  const selectedBoxes = BOXES.slice(0, skuCount)
+  const orderProfile = context.context?.orderProfile || {}
+  const isPrivate = master.destinationType === 'PRIVATE'
+  const pickupMethod = orderProfile.pickupMethod || 'PICKUP'
+  const receiver = isPrivate ? {
+    companyName: `${companyName} 私人收件人`, contactName: `收件人-${context.marker}`.slice(0, 64),
+    phone: '12025550188', email: 'private-receiver@example.com', countryCode: 'US',
+    province: 'New York', city: 'New York', district: 'Queens',
+    addressLine: `${context.marker} 88 Randomized Test Ave`, postalCode: '11354',
+  } : null
   return {
     fulfillmentType: String(context.context?.orderFulfillmentType || 'STANDARD').trim().toUpperCase(),
-    customerId: master.partner?.id ?? null,
-    customerName: master.partner?.partnerName ?? companyName,
+    customerId: profile.id,
+    customerName: companyName,
     transportMode: 'SEA', tradeTerm: 'FOB',
-    destinationCountryCode: master.destination.countryCode || 'US',
-    destinationWarehouseId: master.destination.id,
-    destinationWarehouseName: master.destination.warehouseName,
+    destinationCountryCode: master.destination?.countryCode || receiver?.countryCode || 'US',
+    destinationWarehouseId: master.destination?.id || null,
+    destinationWarehouseName: master.destination?.warehouseName || (isPrivate ? '私人地址' : null),
     expectedShipDate: tomorrow(), customerRemark: `${context.marker} Client 创建隔离订单`,
-    pickupMethod: 'PICKUP', receivingWarehouseId: master.receiving.id,
+    pickupMethod, requestedPickupAt: pickupMethod === 'PICKUP'
+      ? new Date(Date.now() + 7 * 86_400_000).toISOString().slice(0, 19) : null,
+    receivingWarehouseId: master.receiving.id,
     receivingWarehouseName: master.receiving.warehouseName,
     channelCode: master.channel.channelCode, channelName: master.channel.channelName,
-    carrierId: null, carrierName: null, taxMode: 'BUY_DECLARATION',
-    pricingTaxMode: master.pricingTaxMode, containerMode: 'LCL',
-    customsInspection: false, destinationType: master.destinationType,
-    amazonWarehouseCode: master.destinationType === 'FBA' ? master.destination.warehouseCode : null,
+    carrierId: null, carrierName: null, taxMode: orderProfile.taxMode || 'BUY_DECLARATION',
+    pricingTaxMode: master.pricingTaxMode, containerMode: orderProfile.containerMode || 'LCL',
+    customsInspection: orderProfile.customsInspection ?? false, destinationType: master.destinationType,
+    amazonWarehouseCode: master.destinationType === 'FBA' ? master.destination?.warehouseCode : null,
     shipmentId: master.destinationType === 'FBA' ? shipmentId : null,
     referenceId: master.destinationType === 'FBA' ? referenceId : null,
     sender: {
@@ -272,11 +342,11 @@ function buildPayload(context, profile, master, productImageFileId) {
       email: 'order-acceptance@example.com', countryCode: 'CN', province: '广东省',
       city: '深圳市', district: '南山区', addressLine: `${context.marker} 测试地址`, postalCode: '518000',
     },
-    receiver: null,
-    cargoes: BOXES.map((box, index) => {
+    receiver,
+    cargoes: selectedBoxes.map((box, index) => {
       const volumeCbm = box.lengthCm * box.widthCm * box.heightCm / 1_000_000
       const unitsPerPackage = 10 + index
-      const packageCount = Number(context.context?.phase3LoadingIncrementalPackageCount) === 2 ? 2 : 1
+      const packageCount = packageCountPerSku
       return {
         skuNo: `SKU-${box.boxType}-${context.marker}`.slice(0, 64),
         cargoName: `${box.boxType} 测试产品`, cargoNameEn: `${box.boxType} test product`,
@@ -300,11 +370,12 @@ function buildPayload(context, profile, master, productImageFileId) {
 }
 
 function assertCargoContract(context, response, cargoes, payload) {
-  const complete = Array.isArray(cargoes) && cargoes.length === BOXES.length
-    && BOXES.every((box, index) => {
-      const actual = cargoes[index]; const expected = payload.cargoes[index]
-      return Number(actual?.lengthCm) === box.lengthCm && Number(actual?.widthCm) === box.widthCm
-        && Number(actual?.heightCm) === box.heightCm && id(actual?.productImageFileId) === id(expected.productImageFileId)
+  const expectedCargoes = payload.cargoes || []
+  const complete = Array.isArray(cargoes) && cargoes.length === expectedCargoes.length
+    && expectedCargoes.every((expected, index) => {
+      const actual = cargoes[index]
+      return Number(actual?.lengthCm) === expected.lengthCm && Number(actual?.widthCm) === expected.widthCm
+        && Number(actual?.heightCm) === expected.heightCm && id(actual?.productImageFileId) === id(expected.productImageFileId)
         && actual?.skuNo === expected.skuNo && actual?.cargoName === expected.cargoName
         && actual?.cargoNameEn === expected.cargoNameEn && actual?.customsHsCode === expected.customsHsCode
         && Number(actual?.unitsPerPackage) === expected.unitsPerPackage
@@ -320,7 +391,7 @@ function assertCargoContract(context, response, cargoes, payload) {
         && (actual?.referenceId ?? null) === (expected.referenceId ?? null)
         && actual?.upcNo === expected.upcNo && actual?.cargoRemark.includes(context.marker)
     })
-  context.assert(MODULE, '四箱型产品字段及图片契约完整回显', response, complete,
+  context.assert(MODULE, '动态SKU产品字段及图片契约完整回显', response, complete,
     `cargoes=${Array.isArray(cargoes) ? cargoes.length : 'n/a'}, imageFileId=${payload.cargoes[0].productImageFileId}`,
     CONTRACT_OPTIONS)
 }
@@ -405,9 +476,18 @@ export async function run(context) {
     })),
     boxTypes: BOXES.map((box) => box.boxType), inboundId: null,
     receivingWarehouseId: id(master.receiving.id),
+    receivingWarehouseName: master.receiving.warehouseName,
     destinationType: master.destinationType,
-    destinationWarehouseId: id(master.destination.id),
-    destinationWarehouseCode: master.destination.warehouseCode,
+    destinationWarehouseId: id(master.destination?.id),
+    destinationWarehouseCode: master.destination?.warehouseCode || null,
+    destinationWarehouseName: master.destination?.warehouseName || (master.destinationType === 'PRIVATE' ? '私人地址' : null),
+    channelCode: master.channel.channelCode,
+    channelName: master.channel.channelName,
+    pricingTaxMode: master.pricingTaxMode,
+    pickupMethod: payload.pickupMethod,
+    taxMode: payload.taxMode,
+    containerMode: payload.containerMode,
+    customsInspection: payload.customsInspection,
   }
 
   const replayResponse = await request(context, 'POST', createPath, payload, merchantToken,
diff --git a/scripts/admin-test-env-modules/phase3-carrier-schedule-queries.mjs b/scripts/admin-test-env-modules/phase3-carrier-schedule-queries.mjs
index d9d46f29c..886f39387 100644
--- a/scripts/admin-test-env-modules/phase3-carrier-schedule-queries.mjs
+++ b/scripts/admin-test-env-modules/phase3-carrier-schedule-queries.mjs
@@ -92,6 +92,12 @@ export async function run(context) {
 
   const task = matches[0].query
   const queryId = id(task.id)
+  const automatedCarrier = AUTOMATED_CARRIERS.includes(task?.carrierCode)
+  const manualCarrier = task?.carrierCode === 'OTHER' || !AUTOMATED_CARRIERS.includes(task?.carrierCode)
+  context.assert(MODULE, '出仓自动建任务兼容自动船司与未知船司人工处理', pageResponse,
+    (automatedCarrier && ['READY', 'MANUAL_REQUIRED'].includes(task?.status))
+      || (manualCarrier && task?.status === 'MANUAL_REQUIRED' && Boolean(task?.manualReason)),
+    `carrierCode=${task?.carrierCode || 'missing'}, status=${task?.status || 'missing'}, manualReason=${task?.manualReason || 'none'}`, OPTIONS)
   const detailResponse = await request(context, 'GET', `${BASE}/${encodeURIComponent(queryId)}`)
   const detail = context.apiSuccess(MODULE, '回查本轮出仓船节点详情', detailResponse, `queryId=${queryId}`, OPTIONS)
   const departed = (detail?.nodes || []).filter((item) => item.standardNode === 'DEPARTED_WAREHOUSE'
@@ -107,6 +113,7 @@ export async function run(context) {
     queryId, marker: context.marker, ownedByModule: true, triggerSource: 'OUTBOUND_CONFIRM',
     customerId: fixture.customerId, oceanBookingId: fixture.oceanBookingId,
     containerBookingId: fixture.containerBookingId, trackingNo: fixture.trackingNo,
+    carrierCode: task?.carrierCode, initialStatus: task?.status,
     version: Number(data(detailResponse)?.query?.query?.version),
   }
 }
diff --git a/scripts/admin-test-env-modules/phase3-container-documents-contract.test.mjs b/scripts/admin-test-env-modules/phase3-container-documents-contract.test.mjs
new file mode 100644
index 000000000..24d896cd5
--- /dev/null
+++ b/scripts/admin-test-env-modules/phase3-container-documents-contract.test.mjs
@@ -0,0 +1,43 @@
+import assert from 'node:assert/strict'
+import { readFileSync } from 'node:fs'
+import test from 'node:test'
+
+import { DOCUMENT_TYPES } from './phase3-container-documents.mjs'
+import { normalizeModuleOrder } from '../admin-test-env-acceptance.mjs'
+
+const source = readFileSync(new URL('./phase3-container-documents.mjs', import.meta.url), 'utf8')
+const entry = readFileSync(new URL('../admin-test-env-acceptance.mjs', import.meta.url), 'utf8')
+
+test('four canonical container documents are frozen and use only public platform APIs', () => {
+  assert.deepEqual(DOCUMENT_TYPES, [
+    'DESTINATION_CLEARANCE', 'CUSTOMS_DECLARATION', 'DELIVERY_ORDER', 'PICKUP_ORDER',
+  ])
+  for (const token of [
+    '/clearance/document/upload', '/clearance/complete', '/customs/document/upload', '/customs/complete',
+    '/documents/${type}/upload', '/overview', 'requestMultipart', 'Idempotency-Key',
+  ]) assert.ok(source.includes(token), token)
+  assert.doesNotMatch(source, /\/internal\/|https?:\/\/|process\.env|\bfetch\s*\(/)
+})
+
+test('document lifecycle is fail-closed, traceable and covers replay, hash conflict and zero drift', () => {
+  for (const token of [
+    'finalizeSucceeded !== true', "finalStatus !== 'LOADED'", 'deploymentBlocker: true',
+    '同键同载荷重放', '同键异文件返回A0409', '完成同键重放', '完成同键异载荷返回A0409',
+    '负向请求后持久事实零漂移', 'requestId=', 'traceId=', 'phase3ContainerDocuments',
+  ]) assert.ok(source.includes(token), token)
+})
+
+test('focused pickup-ready chain orders documents before outbound and candidate visibility', () => {
+  const modules = normalizeModuleOrder(['phase4-overseas-pda'])
+  const required = [
+    'phase3-loading-finalize', 'phase3-container-documents', 'phase3-customs',
+    'phase3-outbound-dispatch', 'phase3-carrier-schedule-queries',
+    'phase4-carrier-pickup-ready', 'phase4-overseas-pda',
+  ]
+  for (const module of required) assert.ok(modules.includes(module), module)
+  for (let index = 1; index < required.length; index += 1) {
+    assert.ok(modules.indexOf(required[index - 1]) < modules.indexOf(required[index]), required[index])
+  }
+  assert.match(entry, /phase3-container-documents/)
+  assert.match(entry, /phase3-container-documents-phase4-/)
+})
diff --git a/scripts/admin-test-env-modules/phase3-container-documents.mjs b/scripts/admin-test-env-modules/phase3-container-documents.mjs
new file mode 100644
index 000000000..44df3e249
--- /dev/null
+++ b/scripts/admin-test-env-modules/phase3-container-documents.mjs
@@ -0,0 +1,147 @@
+const MODULE = 'phase3-container-documents'
+const OPTIONS = { scenario: 'phase3-container-four-documents', deploymentBlocker: true }
+const CONTAINERS = '/api/platform/v1/containers'
+const FIRST_LEG = '/api/platform/v1/first-leg'
+
+export const DOCUMENT_TYPES = Object.freeze([
+  'DESTINATION_CLEARANCE', 'CUSTOMS_DECLARATION', 'DELIVERY_ORDER', 'PICKUP_ORDER',
+])
+
+function id(value) { return value == null ? '' : String(value) }
+function codeOf(response) { return response?.body?.code == null ? 'missing' : String(response.body.code) }
+function success(response) { return response?.http === 200 && codeOf(response) === '200' }
+function conflict(response) { return response?.http === 200 && codeOf(response) === 'A0409' }
+function traced(response) { return Boolean(response?.requestId) && Boolean(response?.traceId) }
+function key(context, label) { return `${context.marker}-four-documents-${label}`.slice(0, 128) }
+function validDocument(document, type, completed) {
+  return Boolean(document?.id) && Boolean(document?.fileId) && document?.documentType === type
+    && /^[0-9a-f]{64}$/i.test(String(document?.fileHash || ''))
+    && Number.isInteger(Number(document?.version))
+    && (completed ? Boolean(document?.completedAt) : document?.completedAt == null)
+}
+
+function documentForm(context, type, expectedVersion, operationReason, altered = false) {
+  const form = new FormData()
+  const suffix = altered ? '-altered' : ''
+  form.append('file', new Blob([`${context.marker}-${type}${suffix}`], { type: 'text/plain' }),
+    `${type.toLowerCase()}${suffix}.txt`)
+  form.append('expectedVersion', String(expectedVersion))
+  form.append('operationReason', operationReason)
+  return form
+}
+
+async function upload(context, path, type, expectedVersion, operationReason, idempotencyKey, altered = false) {
+  return context.requestMultipart('POST', path,
+    documentForm(context, type, expectedVersion, operationReason, altered), context.token,
+    { 'Idempotency-Key': idempotencyKey })
+}
+
+async function uploadAndVerify(context, { type, uploadPath, readPath, completePath = null }) {
+  const operationReason = `${context.marker} 四类货柜资料全链验收`
+  const uploadKey = key(context, `${type}-upload`)
+  const response = await upload(context, uploadPath, type, 0, operationReason, uploadKey)
+  let document = context.apiSuccess(MODULE, `上传${type}`, response, `documentType=${type}`, OPTIONS)
+  context.assert(MODULE, `${type}上传返回归属、文件哈希和草稿版本`, response,
+    validDocument(document, type, false) && traced(response),
+    `documentId=${id(document?.id) || 'missing'}, fileId=${id(document?.fileId) || 'missing'}, version=${document?.version ?? 'missing'}`, OPTIONS)
+  if (!validDocument(document, type, false)) return null
+
+  const replay = await upload(context, uploadPath, type, 0, operationReason, uploadKey)
+  const replayed = context.apiSuccess(MODULE, `${type}同键同载荷重放`, replay, '', OPTIONS)
+  context.assert(MODULE, `${type}上传重放不新增资料或递增版本`, replay,
+    id(replayed?.id) === id(document.id) && id(replayed?.fileId) === id(document.fileId)
+      && Number(replayed?.version) === Number(document.version),
+    `documentId=${id(replayed?.id) || 'missing'}, version=${replayed?.version ?? 'missing'}`, OPTIONS)
+
+  const hashConflict = await upload(context, uploadPath, type, 0, operationReason, uploadKey, true)
+  context.addStep(MODULE, `${type}同键异文件返回A0409`, hashConflict,
+    conflict(hashConflict) && traced(hashConflict),
+    `HTTP=${hashConflict.http}, code=${codeOf(hashConflict)}, requestId=${hashConflict.requestId || 'missing'}, traceId=${hashConflict.traceId || 'missing'}`, OPTIONS)
+
+  if (completePath) {
+    const completeKey = key(context, `${type}-complete`)
+    const completeBody = { expectedVersion: Number(document.version), operationReason }
+    const completeResponse = await context.request('POST', completePath, completeBody, context.token,
+      { 'Idempotency-Key': completeKey })
+    document = context.apiSuccess(MODULE, `完成${type}`, completeResponse, '', OPTIONS)
+    context.assert(MODULE, `${type}完成后锁定且版本递增`, completeResponse,
+      validDocument(document, type, true) && Number(document.version) === Number(completeBody.expectedVersion) + 1,
+      `completedAt=${document?.completedAt || 'missing'}, version=${document?.version ?? 'missing'}`, OPTIONS)
+
+    const completeReplay = await context.request('POST', completePath, completeBody, context.token,
+      { 'Idempotency-Key': completeKey })
+    const replayedComplete = context.apiSuccess(MODULE, `${type}完成同键重放`, completeReplay, '', OPTIONS)
+    context.assert(MODULE, `${type}完成重放保持同一终态`, completeReplay,
+      id(replayedComplete?.id) === id(document.id)
+        && Number(replayedComplete?.version) === Number(document.version)
+        && replayedComplete?.completedAt === document.completedAt,
+      `documentId=${id(replayedComplete?.id) || 'missing'}, version=${replayedComplete?.version ?? 'missing'}`, OPTIONS)
+
+    const completeConflict = await context.request('POST', completePath,
+      { ...completeBody, operationReason: `${operationReason}-altered` }, context.token,
+      { 'Idempotency-Key': completeKey })
+    context.addStep(MODULE, `${type}完成同键异载荷返回A0409`, completeConflict,
+      conflict(completeConflict) && traced(completeConflict),
+      `HTTP=${completeConflict.http}, code=${codeOf(completeConflict)}`, OPTIONS)
+  }
+
+  const readResponse = await context.request('GET', readPath)
+  const stored = context.apiSuccess(MODULE, `回读${type}`, readResponse, '', OPTIONS)
+  const expectedCompleted = Boolean(completePath)
+  context.assert(MODULE, `${type}负向请求后持久事实零漂移`, readResponse,
+    validDocument(stored, type, expectedCompleted) && id(stored.id) === id(document.id)
+      && id(stored.fileId) === id(document.fileId) && Number(stored.version) === Number(document.version),
+    `documentId=${id(stored?.id) || 'missing'}, version=${stored?.version ?? 'missing'}`, OPTIONS)
+  return stored
+}
+
+export async function run(context) {
+  const fixture = context.createdResources?.phase3Loading
+  const containerId = id(fixture?.containerBookingId)
+  const planId = id(fixture?.loadingPlanId)
+  const warehouseId = id(fixture?.warehouseId)
+  if (fixture?.marker !== context.marker || fixture?.finalizeSucceeded !== true
+      || fixture?.finalStatus !== 'LOADED' || !containerId || !planId || !warehouseId) {
+    context.addStep(MODULE, '取得本轮LOADED柜次四类资料前置', null, false,
+      `marker=${fixture?.marker || 'missing'}, status=${fixture?.finalStatus || 'missing'}, containerBookingId=${containerId || 'missing'}, loadingPlanId=${planId || 'missing'}, warehouseId=${warehouseId || 'missing'}`,
+      OPTIONS)
+    return
+  }
+
+  const specs = [
+    {
+      type: 'DESTINATION_CLEARANCE',
+      uploadPath: `${CONTAINERS}/${containerId}/clearance/document/upload`,
+      readPath: `${CONTAINERS}/${containerId}/clearance`,
+      completePath: `${CONTAINERS}/${containerId}/clearance/complete`,
+    },
+    {
+      type: 'CUSTOMS_DECLARATION',
+      uploadPath: `${FIRST_LEG}/loading-lists/${planId}/customs/document/upload?warehouseId=${encodeURIComponent(warehouseId)}`,
+      readPath: `${FIRST_LEG}/loading-lists/${planId}/customs?warehouseId=${encodeURIComponent(warehouseId)}`,
+      completePath: `${FIRST_LEG}/loading-lists/${planId}/customs/complete?warehouseId=${encodeURIComponent(warehouseId)}`,
+    },
+    ...['DELIVERY_ORDER', 'PICKUP_ORDER'].map((type) => ({
+      type,
+      uploadPath: `${CONTAINERS}/${containerId}/documents/${type}/upload`,
+      readPath: `${CONTAINERS}/${containerId}/documents/${type}`,
+    })),
+  ]
+
+  const documents = []
+  for (const spec of specs) documents.push(await uploadAndVerify(context, spec))
+  const overviewResponse = await context.request('GET', `${CONTAINERS}/${containerId}/overview`)
+  const overview = context.apiSuccess(MODULE, '回查货柜四类资料聚合', overviewResponse, '', OPTIONS)
+  const storedTypes = new Set((overview?.documents || []).map((item) => item?.documentType))
+  context.assert(MODULE, '同一LOADED柜次聚合返回四类资料且身份未漂移', overviewResponse,
+    id(overview?.container?.id) === containerId && documents.every(Boolean)
+      && DOCUMENT_TYPES.every((type) => storedTypes.has(type)),
+    `containerBookingId=${containerId}, documentTypes=${[...storedTypes].join('|') || 'none'}`, OPTIONS)
+  if (documents.every(Boolean) && DOCUMENT_TYPES.every((type) => storedTypes.has(type))) {
+    context.createdResources.phase3ContainerDocuments = {
+      marker: context.marker, containerBookingId: containerId, loadingPlanId: planId,
+      warehouseId, finalStatus: 'COMPLETED', documentTypes: [...DOCUMENT_TYPES],
+      documentIds: Object.fromEntries(documents.map((item) => [item.documentType, id(item.id)])),
+    }
+  }
+}
diff --git a/scripts/admin-test-env-modules/phase3-customs.mjs b/scripts/admin-test-env-modules/phase3-customs.mjs
index de3230435..99b554543 100644
--- a/scripts/admin-test-env-modules/phase3-customs.mjs
+++ b/scripts/admin-test-env-modules/phase3-customs.mjs
@@ -4,8 +4,8 @@ const MODULE = 'phase3-customs'
 const OPTIONS = { scenario: 'phase3-customs-collaboration', deploymentBlocker: true }
 const PLATFORM = '/api/platform/v1/customs'
 const MERCHANT = '/api/merchant/v1/customs'
-const MERCHANT_USERNAME = process.env.MERCHANT_TEST_USERNAME || 'merchant_admin'
-const MERCHANT_PASSWORD = process.env.MERCHANT_TEST_PASSWORD || 'ChangeMe123!'
+const MERCHANT_USERNAME = process.env.MERCHANT_TEST_USERNAME || ''
+const MERCHANT_PASSWORD = process.env.MERCHANT_TEST_PASSWORD || ''
 
 function id(value) { return value == null ? '' : String(value) }
 function codeOf(response) { return response?.body?.code == null ? 'missing' : String(response.body.code) }
@@ -113,6 +113,99 @@ async function ensureReleasedOceanBooking(context, container) {
   return true
 }
 
+async function uploadVersion(context, path, label, expectedVersion, operation, content) {
+  const response = await upload(context, path, {
+    expectedVersion, operationReason: `${context.marker}-${operation}`,
+  }, content, `${context.marker}-${operation}.txt`, context.token, key(context, operation))
+  const document = context.apiSuccess(MODULE, label, response, '', OPTIONS)
+  context.assert(MODULE, `${label}返回当前唯一文件事实`, response,
+    Boolean(document?.id) && Boolean(document?.fileId) && Number.isInteger(Number(document?.version))
+      && /^[0-9a-f]{64}$/i.test(String(document?.fileHash || '')),
+    `documentId=${id(document?.id) || 'missing'}, fileId=${id(document?.fileId) || 'missing'}, version=${document?.version ?? 'missing'}`, OPTIONS)
+  return { response, document }
+}
+
+async function verifyFourContainerDocuments(context, { containerBookingId, loadingPlanId, warehouseId }) {
+  const reason = `${context.marker}-人工验收节点资料`
+  const simpleDocuments = [
+    { type: 'DESTINATION_CLEARANCE', base: `/api/platform/v1/containers/${containerBookingId}/clearance`,
+      uploadPath: `/api/platform/v1/containers/${containerBookingId}/clearance/document/upload` },
+    { type: 'CUSTOMS_DECLARATION', base: `/api/platform/v1/first-leg/loading-lists/${loadingPlanId}/customs`,
+      query: `warehouseId=${encodeURIComponent(warehouseId)}`,
+      uploadPath: `/api/platform/v1/first-leg/loading-lists/${loadingPlanId}/customs/document/upload?warehouseId=${encodeURIComponent(warehouseId)}` },
+  ]
+  const completed = []
+  for (const document of simpleDocuments) {
+    const first = await uploadVersion(context, document.uploadPath, `首次上传${document.type}`, 0,
+      `${document.type.toLowerCase()}-v1`, `${context.marker} ${document.type} v1`)
+    if (!first.document?.fileId) return false
+    const readPath = `${document.base}${document.query ? `?${document.query}` : ''}`
+    const firstRead = await context.request('GET', readPath)
+    const firstEcho = context.apiSuccess(MODULE, `回显${document.type}首版`, firstRead, '', OPTIONS)
+    context.assert(MODULE, `${document.type}首版回显身份一致`, firstRead,
+      id(firstEcho?.id) === id(first.document.id) && id(firstEcho?.fileId) === id(first.document.fileId),
+      `documentId=${id(firstEcho?.id) || 'missing'}, version=${firstEcho?.version ?? 'missing'}`, OPTIONS)
+    const firstDownloadPath = document.type === 'DESTINATION_CLEARANCE'
+      ? `${document.base}/document/${id(first.document.fileId)}/download`
+      : `${document.base}/document/${id(first.document.fileId)}/download?${document.query}`
+    const firstDownload = await download(context, firstDownloadPath, context.token)
+    context.assert(MODULE, `下载${document.type}首版`, firstDownload,
+      firstDownload.http === 200 && firstDownload.bytes.length > 0 && firstDownload.contentType.includes('text/plain'),
+      `HTTP=${firstDownload.http}, bytes=${firstDownload.bytes.length}`, OPTIONS)
+    const second = await uploadVersion(context, document.uploadPath, `更新${document.type}为第二版`,
+      Number(firstEcho?.version), `${document.type.toLowerCase()}-v2`, `${context.marker} ${document.type} v2`)
+    context.assert(MODULE, `${document.type}更新保持同一聚合并递增版本`, second.response,
+      id(second.document?.id) === id(first.document.id) && Number(second.document?.version) === Number(firstEcho?.version) + 1,
+      `documentId=${id(second.document?.id) || 'missing'}, version=${second.document?.version ?? 'missing'}`, OPTIONS)
+    const completeResponse = await request(context, 'POST', `${document.base}/complete${document.query ? `?${document.query}` : ''}`, {
+      expectedVersion: Number(second.document?.version), operationReason: reason,
+    }, context.token, { 'Idempotency-Key': key(context, `${document.type.toLowerCase()}-complete`) })
+    const complete = context.apiSuccess(MODULE, `完成${document.type}`, completeResponse, '', OPTIONS)
+    context.assert(MODULE, `${document.type}完成态、时间和版本可回读`, completeResponse,
+      id(complete?.id) === id(first.document.id) && Boolean(complete?.completedAt)
+        && Number(complete?.version) === Number(second.document?.version) + 1,
+      `completedAt=${complete?.completedAt || 'missing'}, version=${complete?.version ?? 'missing'}`, OPTIONS)
+    completed.push(complete)
+  }
+
+  for (const type of ['DELIVERY_ORDER', 'PICKUP_ORDER']) {
+    const base = `/api/platform/v1/containers/${containerBookingId}/documents/${type}`
+    const first = await uploadVersion(context, `${base}/upload`, `首次上传${type}`, 0,
+      `${type.toLowerCase()}-v1`, `${context.marker} ${type} v1`)
+    if (!first.document?.fileId) return false
+    const firstDownload = await download(context, `${base}/${id(first.document.fileId)}/download`, context.token)
+    context.assert(MODULE, `下载${type}首版`, firstDownload,
+      firstDownload.http === 200 && firstDownload.bytes.length > 0 && firstDownload.contentType.includes('text/plain'),
+      `HTTP=${firstDownload.http}, bytes=${firstDownload.bytes.length}`, OPTIONS)
+    const second = await uploadVersion(context, `${base}/upload`, `更新${type}为第二版`,
+      Number(first.document.version), `${type.toLowerCase()}-v2`, `${context.marker} ${type} v2`)
+    const echoResponse = await context.request('GET', base)
+    const echo = context.apiSuccess(MODULE, `回显${type}当前版本`, echoResponse, '', OPTIONS)
+    context.assert(MODULE, `${type}首次与更新保持同一聚合且当前版本唯一`, echoResponse,
+      id(echo?.id) === id(first.document.id) && id(echo?.fileId) === id(second.document?.fileId)
+        && Number(echo?.version) === Number(first.document.version) + 1,
+      `documentId=${id(echo?.id) || 'missing'}, version=${echo?.version ?? 'missing'}`, OPTIONS)
+  }
+
+  const overviewResponse = await context.request('GET', `/api/platform/v1/containers/${containerBookingId}/overview`)
+  const overview = context.apiSuccess(MODULE, '四类资料完成后回查整柜聚合', overviewResponse, '', OPTIONS)
+  const documents = Array.isArray(overview?.documents) ? overview.documents : []
+  const photos = Array.isArray(overview?.pda?.photos) ? overview.pda.photos.filter((item) => item?.status === 'ACTIVE') : []
+  context.assert(MODULE, '整柜聚合回显四类当前资料与真实PDA照片证据', overviewResponse,
+    ['DESTINATION_CLEARANCE', 'CUSTOMS_DECLARATION', 'DELIVERY_ORDER', 'PICKUP_ORDER']
+      .every((type) => documents.some((item) => item?.documentType === type))
+      && completed.every((item) => documents.some((value) => id(value?.id) === id(item?.id) && value?.completed === true))
+      && photos.length >= 5 && photos.every((item) => /^\/api\/platform\/v1\/containers\/\d+\/pda\/photos\/\d+\/download$/.test(String(item?.downloadPath || ''))),
+    `documents=${documents.map((item) => item?.documentType).join('|') || 'none'}, activePhotos=${photos.length}`, OPTIONS)
+  for (const [index, photo] of photos.entries()) {
+    const response = await download(context, photo.downloadPath, context.token)
+    context.assert(MODULE, `下载整柜PDA照片证据${index + 1}`, response,
+      response.http === 200 && response.bytes.length > 0 && !response.contentType.includes('application/json'),
+      `fileId=${id(photo?.fileId) || 'missing'}, bytes=${response.bytes.length}`, OPTIONS)
+  }
+  return true
+}
+
 export async function run(context) {
   const { fixture, container } = selectCustomsFlow(context.createdResources)
   const tenantId = id(fixture?.tenantId)
@@ -120,7 +213,8 @@ export async function run(context) {
   const inboundId = id(fixture?.inboundId)
   const containerBookingId = id(container?.containerBookingId)
   const loadingPlanId = id(container?.loadingPlanId)
-  if (!tenantId || !parentOrderId || !inboundId || !containerBookingId
+  const warehouseId = id(container?.warehouseId || fixture?.warehouseId)
+  if (!tenantId || !parentOrderId || !inboundId || !containerBookingId || !loadingPlanId || !warehouseId
       || !['AWAITING_REVIEW', 'LOADED'].includes(container?.finalStatus)
       || (container?.finalStatus === 'AWAITING_REVIEW'
         && (container?.loadingPlanStatus !== 'LOADING' || !container?.canonicalPdaTaskId))) {
@@ -380,6 +474,12 @@ export async function run(context) {
   context.addStep(MODULE, '回执 fileId 不能伪造为客户报关资料引用', forgedReference, failure(forgedReference),
     `HTTP=${forgedReference.http}, code=${codeOf(forgedReference)}`, OPTIONS)
 
+  if (!(await verifyFourContainerDocuments(context, { containerBookingId, loadingPlanId, warehouseId }))) {
+    context.addStep(MODULE, '四类整柜资料必须完成后才允许进入出仓确认', null, false,
+      `containerBookingId=${containerBookingId}, loadingPlanId=${loadingPlanId}, warehouseId=${warehouseId}`, OPTIONS)
+    return
+  }
+
   context.createdResources.phase3Customs = {
     marker: context.marker, tenantId, parentOrderId, orderId: actualOrderId, inboundId, containerBookingId, loadingPlanId,
     customsCaseId: caseId, submissionBatchId: batchId, releasedReceiptId: releasedId,
diff --git a/scripts/admin-test-env-modules/phase3-dispatch-gate.mjs b/scripts/admin-test-env-modules/phase3-dispatch-gate.mjs
index 2dcc9aada..a93505f8e 100644
--- a/scripts/admin-test-env-modules/phase3-dispatch-gate.mjs
+++ b/scripts/admin-test-env-modules/phase3-dispatch-gate.mjs
@@ -12,15 +12,16 @@ export async function run(context) {
       '本轮未取得 phase3-outbound-dispatch 的 marker 隔离聚合，未使用历史资源', 'fixture')
     return
   }
-  const selector = `inboundId=${encodeURIComponent(fixture.inboundId)}&containerBookingId=${encodeURIComponent(fixture.containerBookingId)}`
-  const response = await context.request('GET', `${BASE}/check-gate?${selector}`)
-  const gate = context.apiSuccess(MODULE, '复核国内出仓统一硬门禁', response, selector, OPTIONS)
-  const items = Array.isArray(gate?.items) ? gate.items : []
+  const response = await context.request('GET', `${BASE}/${encodeURIComponent(fixture.containerBookingId)}/gate`)
+  const gate = context.apiSuccess(MODULE, '复核国内出仓柜级统一硬门禁', response,
+    `containerBookingId=${fixture.containerBookingId}`, OPTIONS)
+  const items = Array.isArray(gate?.inbounds)
+    ? gate.inbounds.flatMap((item) => Array.isArray(item?.gate?.items) ? item.gate.items : []) : []
   const required = ['INBOUND_LOADED', 'LOADING_PLAN_COMPLETED', 'PDA_PICK_COMPLETED',
-    'OCEAN_BOOKING_RELEASED', 'TRUCK_DEPARTED', 'LOADING_EVIDENCE_COMPLETE',
-    'CUSTOMS_CLEARANCE', 'SAILING_SCHEDULE']
-  context.assert(MODULE, '八项业务门禁全部由服务端真实判定并通过', response,
+    'OCEAN_BOOKING_RELEASED', 'LOADING_EVIDENCE_COMPLETE', 'CUSTOMS_CLEARANCE']
+  context.assert(MODULE, '六项硬门禁全部由服务端真实判定并通过', response,
     gate?.passed === true && required.every((code) => items.some((item) => item.code === code
-      && item.passed === true && item.actual !== 'MODULE_UNAVAILABLE' && item.actual !== 'ASSESSMENT_ERROR')),
+      && item.passed === true && item.actual !== 'MODULE_UNAVAILABLE' && item.actual !== 'ASSESSMENT_ERROR'))
+      && items.every((item) => !['TRUCK_DEPARTED', 'SAILING_SCHEDULE'].includes(item.code)),
     `passed=${gate?.passed ?? 'missing'}, gates=${items.map((item) => `${item.code}:${item.passed}`).join(',')}`, OPTIONS)
 }
diff --git a/scripts/admin-test-env-modules/phase3-http-fail-closed-contract.test.mjs b/scripts/admin-test-env-modules/phase3-http-fail-closed-contract.test.mjs
index 36331259e..1a4f1bfa4 100644
--- a/scripts/admin-test-env-modules/phase3-http-fail-closed-contract.test.mjs
+++ b/scripts/admin-test-env-modules/phase3-http-fail-closed-contract.test.mjs
@@ -32,8 +32,12 @@ test('phase3 inventory mutation and downstream gates cannot pass as coverage gap
   const aggregate = read('phase3-outbound-aggregate.mjs')
   assert.match(loading, /自动制造库存变化并验证旧 snapshot token A0409[\s\S]{0,300}false/)
   assert.match(convergence, /PDA 真实库存变化后旧 token A0409 与刷新重试[\s\S]{0,300}false/)
-  assert.match(dispatch, /国内出仓八项门禁必须在同轮全部通过[\s\S]{0,300}false/)
-  assert.match(aggregate, /'CUSTOMS', 'SAILING_SCHEDULE'/)
+  assert.match(dispatch, /国内出仓六项硬门禁必须在同轮全部通过[\s\S]{0,300}false/)
+  assert.match(dispatch, /拖车与独立船期仅作聚合参考且不参与出仓门禁/)
+  assert.match(dispatch, /'CUSTOMS_CLEARANCE'/)
+  assert.match(dispatch, /const expectedCodes = \['INBOUND_LOADED', 'LOADING_PLAN_COMPLETED', 'PDA_PICK_COMPLETED',[\s\S]{0,120}'CUSTOMS_CLEARANCE'\]/)
+  assert.match(aggregate, /'OCEAN_BOOKING', 'CUSTOMS', 'OUTBOUND_DISPATCH'/)
+  assert.match(aggregate, /拖车和独立船期时间线只作参考/)
   assert.doesNotMatch(aggregate, /报关与船期历史并入统一时间线|当前服务端聚合未公开/)
 })
 
@@ -59,4 +63,5 @@ test('outbound lifecycle checks confirm replay, immutable departure reverse boun
   assert.match(waiting, /confirmations\.length === 1 && reversed\.length === 0/)
   assert.match(waiting, /实际离仓节点冻结后保持一次确认且零次成功撤销/)
   assert.match(waiting, /detail\?\.aggregate\?\.dispatchStatus === 'WAITING_FOR_LOADING'/)
+  assert.match(waiting, /inbounds\?\.every/)
 })
diff --git a/scripts/admin-test-env-modules/phase3-loading.mjs b/scripts/admin-test-env-modules/phase3-loading.mjs
index 9059f6a91..060f643d0 100644
--- a/scripts/admin-test-env-modules/phase3-loading.mjs
+++ b/scripts/admin-test-env-modules/phase3-loading.mjs
@@ -3,8 +3,8 @@ import { createHash } from 'node:crypto'
 
 const MODULE = 'phase3-loading'
 const OPTIONS = { scenario: 'phase3-split-preload-loading', deploymentBlocker: true }
-const MERCHANT_USERNAME = process.env.MERCHANT_TEST_USERNAME || 'merchant_admin'
-const MERCHANT_PASSWORD = process.env.MERCHANT_TEST_PASSWORD || 'ChangeMe123!'
+const MERCHANT_USERNAME = process.env.MERCHANT_TEST_USERNAME || ''
+const MERCHANT_PASSWORD = process.env.MERCHANT_TEST_PASSWORD || ''
 const MATSON_SUPPLIER_NAME = 'MATSON 开发联调船司'
 
 function id(value) { return value == null ? '' : String(value) }
diff --git a/scripts/admin-test-env-modules/phase3-order-splitting.mjs b/scripts/admin-test-env-modules/phase3-order-splitting.mjs
index d42339d61..eaddf6079 100644
--- a/scripts/admin-test-env-modules/phase3-order-splitting.mjs
+++ b/scripts/admin-test-env-modules/phase3-order-splitting.mjs
@@ -1,8 +1,8 @@
 const MODULE = 'phase3-order-splitting'
 const SCENARIO = 'source-loaded-single-remainder-chain'
 const OPTIONS = { scenario: SCENARIO, deploymentBlocker: true }
-const MERCHANT_USERNAME = process.env.MERCHANT_TEST_USERNAME || 'merchant_admin'
-const MERCHANT_PASSWORD = process.env.MERCHANT_TEST_PASSWORD || 'ChangeMe123!'
+const MERCHANT_USERNAME = process.env.MERCHANT_TEST_USERNAME || ''
+const MERCHANT_PASSWORD = process.env.MERCHANT_TEST_PASSWORD || ''
 const CONTAINERS = '/api/platform/v1/containers'
 const SMART = '/api/platform/v1/first-leg/smart-loading'
 const PDA = '/api/platform/v1/first-leg/pda-loading'
diff --git a/scripts/admin-test-env-modules/phase3-outbound-aggregate.mjs b/scripts/admin-test-env-modules/phase3-outbound-aggregate.mjs
index 6ab6c718f..282305e19 100644
--- a/scripts/admin-test-env-modules/phase3-outbound-aggregate.mjs
+++ b/scripts/admin-test-env-modules/phase3-outbound-aggregate.mjs
@@ -23,29 +23,27 @@ export async function run(context) {
       '本轮未取得 phase3-outbound-dispatch 的 marker 隔离聚合，未使用历史资源', 'fixture')
     return
   }
-  const selector = `inboundId=${encodeURIComponent(fixture.inboundId)}&containerBookingId=${encodeURIComponent(fixture.containerBookingId)}`
-  const response = await context.request('GET', `${BASE}/detail?${selector}`)
-  const detail = context.apiSuccess(MODULE, '复核出仓主聚合与统一时间线', response, selector, OPTIONS)
+  const response = await context.request('GET', `${BASE}/${encodeURIComponent(fixture.containerBookingId)}`)
+  const detail = context.apiSuccess(MODULE, '复核柜级出仓主聚合与统一时间线', response,
+    `containerBookingId=${fixture.containerBookingId}`, OPTIONS)
   const aggregate = detail?.aggregate
+  const inbound = aggregate?.inbounds?.find?.((item) => id(item?.inboundId) === id(fixture.inboundId))
   const timeline = Array.isArray(detail?.timeline) ? detail.timeline : []
   const expectedModules = ['INBOUND', 'LOADING_PLAN', 'PDA_PICK', 'LOADING_EVIDENCE',
-    'OCEAN_BOOKING', 'TRUCK_APPOINTMENT', 'CUSTOMS', 'SAILING_SCHEDULE', 'OUTBOUND_DISPATCH']
+    'OCEAN_BOOKING', 'CUSTOMS', 'OUTBOUND_DISPATCH']
   context.assert(MODULE, '聚合唯一关联本轮订单、入库单、柜次和客户', response,
-    id(aggregate?.orderId) === id(fixture.orderId) && id(aggregate?.tenantId) === id(fixture.tenantId)
-      && id(aggregate?.inboundId) === id(fixture.inboundId)
+    id(inbound?.orderId) === id(fixture.orderId) && id(inbound?.tenantId) === id(fixture.tenantId)
+      && id(inbound?.inboundId) === id(fixture.inboundId)
       && id(aggregate?.containerBookingId) === id(fixture.containerBookingId),
-    `orderId=${id(aggregate?.orderId) || 'missing'}, inboundId=${id(aggregate?.inboundId) || 'missing'}, containerBookingId=${id(aggregate?.containerBookingId) || 'missing'}`, OPTIONS)
+    `orderId=${id(inbound?.orderId) || 'missing'}, inboundId=${id(inbound?.inboundId) || 'missing'}, containerBookingId=${id(aggregate?.containerBookingId) || 'missing'}`, OPTIONS)
   context.assert(MODULE, '统一时间线有序且各子流程包含审计字段', response,
     timeline.length > 0 && ordered(timeline)
       && expectedModules.every((module) => timeline.some((item) => item.module === module))
       && timeline.every((item) => Boolean(item.action) && Boolean(item.occurredAt)),
     `timeline=${timeline.length}, modules=${[...new Set(timeline.map((item) => item.module))].join(',')}`, OPTIONS)
 
-  const other = context.createdResources?.phase3ContainerLoading
-  if (other?.inboundId && other?.containerBookingId
-      && (id(other.inboundId) !== id(fixture.inboundId) || id(other.containerBookingId) !== id(fixture.containerBookingId))) {
-    const forged = await context.request('GET', `${BASE}/detail?inboundId=${encodeURIComponent(fixture.inboundId)}&containerBookingId=${encodeURIComponent(other.containerBookingId)}`)
-    context.addStep(MODULE, '伪造跨资源入库单与柜次组合不可匹配', forged, rejected(forged),
-      `HTTP=${forged.http}, code=${codeOf(forged)}`, OPTIONS)
-  }
+  context.assert(MODULE, '拖车和独立船期时间线只作参考', response,
+    ['TRUCK_APPOINTMENT', 'SAILING_SCHEDULE'].every((module) => timeline
+      .filter((item) => item.module === module).every((item) => Boolean(item.action) && Boolean(item.occurredAt))),
+    `referenceModules=${timeline.filter((item) => ['TRUCK_APPOINTMENT', 'SAILING_SCHEDULE'].includes(item.module)).length}`, OPTIONS)
 }
diff --git a/scripts/admin-test-env-modules/phase3-outbound-dispatch.mjs b/scripts/admin-test-env-modules/phase3-outbound-dispatch.mjs
index a489ba65c..cd8a4ae98 100644
--- a/scripts/admin-test-env-modules/phase3-outbound-dispatch.mjs
+++ b/scripts/admin-test-env-modules/phase3-outbound-dispatch.mjs
@@ -43,52 +43,50 @@ export async function run(context) {
       '本轮未取得 marker 隔离的柜次装柜 fixture，未使用历史资源', 'fixture')
     return
   }
-  const selector = `inboundId=${encodeURIComponent(inboundId)}&containerBookingId=${encodeURIComponent(containerBookingId)}`
+  const selector = `containerBookingId=${encodeURIComponent(containerBookingId)}`
   const listResponse = await request(context, 'GET', `${BASE}?${selector}`)
-  const aggregates = context.apiSuccess(MODULE, '按入库单和柜次查询出仓主聚合', listResponse, selector, OPTIONS)
-  const aggregate = Array.isArray(aggregates) ? aggregates.find((item) => id(item.inboundId) === inboundId
-    && id(item.containerBookingId) === containerBookingId) : null
+  const aggregates = context.apiSuccess(MODULE, '按柜次查询唯一出仓主聚合', listResponse, selector, OPTIONS)
+  const aggregate = Array.isArray(aggregates) ? aggregates.find((item) => id(item.containerBookingId) === containerBookingId) : null
+  const inboundBinding = aggregate?.inbounds?.find?.((item) => id(item?.inboundId) === inboundId)
   const outboundFieldGaps = outboundAggregateFieldGaps(aggregate)
   context.assert(MODULE, '主聚合串联订单、入库单、柜次、计划与客户隔离键', listResponse,
-    Boolean(aggregate?.orderId) && Boolean(aggregate?.tenantId) && Boolean(aggregate?.loadingPlanId)
-      && id(aggregate?.inboundId) === inboundId && id(aggregate?.containerBookingId) === containerBookingId,
-    `orderId=${id(aggregate?.orderId) || 'missing'}, tenantId=${id(aggregate?.tenantId) || 'missing'}, planId=${id(aggregate?.loadingPlanId) || 'missing'}`, OPTIONS)
+    Boolean(inboundBinding?.orderId) && Boolean(inboundBinding?.tenantId) && Boolean(aggregate?.loadingPlanId)
+      && id(aggregate?.containerBookingId) === containerBookingId,
+    `orderId=${id(inboundBinding?.orderId) || 'missing'}, tenantId=${id(inboundBinding?.tenantId) || 'missing'}, planId=${id(aggregate?.loadingPlanId) || 'missing'}, inbounds=${aggregate?.inbounds?.length ?? 'missing'}`, OPTIONS)
   context.assert(MODULE, '国内出仓列表客户、订单入库、柜次计划、PDA订舱与门禁摘要完整', listResponse,
     outboundFieldGaps.length === 0, `missing=${outboundFieldGaps.join(',') || 'none'}`, OPTIONS)
   if (!aggregate) return
 
-  const orderResponse = await request(context, 'GET', `${BASE}?orderId=${encodeURIComponent(id(aggregate.orderId))}`)
-  const orderAggregates = context.apiSuccess(MODULE, '按 orderId 查询全部出仓柜次', orderResponse, '', OPTIONS)
-  context.assert(MODULE, 'orderId 查询包含本轮入库单柜次', orderResponse,
-    Array.isArray(orderAggregates) && orderAggregates.some((item) => id(item.inboundId) === inboundId
-      && id(item.containerBookingId) === containerBookingId), `records=${orderAggregates?.length ?? 'n/a'}`, OPTIONS)
-
-  const detailResponse = await request(context, 'GET', `${BASE}/detail?${selector}`)
+  const detailResponse = await request(context, 'GET', `${BASE}/${encodeURIComponent(containerBookingId)}`)
   const detail = context.apiSuccess(MODULE, '查询出仓主聚合与整体时间线', detailResponse, '', OPTIONS)
   context.assert(MODULE, '整体时间线返回稳定数组且聚合定位不漂移', detailResponse,
-    Array.isArray(detail?.timeline) && id(detail?.aggregate?.inboundId) === inboundId
-      && id(detail?.aggregate?.containerBookingId) === containerBookingId,
+    Array.isArray(detail?.timeline) && id(detail?.aggregate?.containerBookingId) === containerBookingId
+      && detail?.aggregate?.inbounds?.some?.((item) => id(item?.inboundId) === inboundId),
     `timeline=${detail?.timeline?.length ?? 'n/a'}`, OPTIONS)
 
-  const gateResponse = await request(context, 'GET', `${BASE}/check-gate?${selector}`)
+  const gateResponse = await request(context, 'GET', `${BASE}/${encodeURIComponent(containerBookingId)}/gate`)
   const gate = context.apiSuccess(MODULE, '执行国内出仓统一门禁', gateResponse, '', OPTIONS)
-  const gateItems = Array.isArray(gate?.items) ? gate.items : []
+  const gateItems = Array.isArray(gate?.inbounds)
+    ? gate.inbounds.flatMap((item) => Array.isArray(item?.gate?.items) ? item.gate.items : []) : []
   const expectedCodes = ['INBOUND_LOADED', 'LOADING_PLAN_COMPLETED', 'PDA_PICK_COMPLETED',
-    'OCEAN_BOOKING_RELEASED', 'TRUCK_DEPARTED', 'LOADING_EVIDENCE_COMPLETE',
-    'CUSTOMS_CLEARANCE', 'SAILING_SCHEDULE']
+    'OCEAN_BOOKING_RELEASED', 'LOADING_EVIDENCE_COMPLETE', 'CUSTOMS_CLEARANCE']
   context.assert(MODULE, '门禁逐项公开真实状态且不省略下游模块', gateResponse,
-    expectedCodes.every((code) => gateItems.some((item) => item.code === code && typeof item.passed === 'boolean')),
+    expectedCodes.every((code) => gateItems.some((item) => item.code === code && typeof item.passed === 'boolean'))
+      && gateItems.every((item) => !['TRUCK_DEPARTED', 'SAILING_SCHEDULE'].includes(item.code)),
     `codes=${gateItems.map((item) => item.code).join(',')}`, OPTIONS)
+  context.assert(MODULE, '拖车与独立船期仅作聚合参考且不参与出仓门禁', gateResponse,
+    Object.hasOwn(aggregate, 'truckAppointmentStatus') && Object.hasOwn(aggregate, 'oceanBookingStatus')
+      && gateItems.every((item) => !['TRUCK_DEPARTED', 'SAILING_SCHEDULE'].includes(item.code)),
+    `truck=${aggregate?.truckAppointmentStatus || 'none'}, ocean=${aggregate?.oceanBookingStatus || 'none'}`, OPTIONS)
 
   const expectedVersion = Number(aggregate.version)
-  const actionBody = { inboundId, containerBookingId, expectedVersion, remark: context.marker }
   const confirmKey = `${context.marker}-outbound-confirm`.slice(0, 128)
   if (!gate?.passed) {
-    const blocked = await request(context, 'POST', `${BASE}/confirm-dispatch`, actionBody,
+    const blocked = await request(context, 'POST', `${BASE}/${encodeURIComponent(containerBookingId)}/confirm`, { expectedVersion, remark: context.marker },
       { 'Idempotency-Key': confirmKey })
     context.addStep(MODULE, '门禁未通过时 confirm-dispatch fail-closed', blocked, rejected(blocked),
       `HTTP=${blocked.http}, code=${codeOf(blocked)}`, OPTIONS)
-    context.addStep(MODULE, '国内出仓八项门禁必须在同轮全部通过', gateResponse, false,
+    context.addStep(MODULE, '国内出仓六项硬门禁必须在同轮全部通过', gateResponse, false,
       `failed=${gateItems.filter((item) => !item.passed).map((item) => `${item.code}:${item.actual || 'missing'}`).join(',') || 'gate.passed=false'}`,
       OPTIONS)
     for (const item of gateItems.filter((value) => !value.passed)) {
@@ -99,17 +97,18 @@ export async function run(context) {
     return
   }
 
-  const confirmResponse = await request(context, 'POST', `${BASE}/confirm-dispatch`, actionBody,
+  const confirmBody = { expectedVersion, remark: context.marker }
+  const confirmResponse = await request(context, 'POST', `${BASE}/${encodeURIComponent(containerBookingId)}/confirm`, confirmBody,
     { 'Idempotency-Key': confirmKey })
   const confirmed = context.apiSuccess(MODULE, '确认国内出仓进入等待装船', confirmResponse, '', OPTIONS)
   context.assert(MODULE, 'confirm-dispatch 推进 WAITING_FOR_LOADING 并递增版本', confirmResponse,
     confirmed?.aggregate?.dispatchStatus === 'WAITING_FOR_LOADING'
-      && confirmed?.aggregate?.inboundStatus === 'LOADED'
+      && confirmed?.aggregate?.inbounds?.every?.((item) => item?.inboundStatus === 'LOADED')
       && Number(confirmed?.aggregate?.version) === expectedVersion + 1,
-    `dispatch=${confirmed?.aggregate?.dispatchStatus || 'missing'}, inbound=${confirmed?.aggregate?.inboundStatus || 'missing'}, version=${confirmed?.aggregate?.version ?? 'missing'}`, OPTIONS)
+    `dispatch=${confirmed?.aggregate?.dispatchStatus || 'missing'}, inbounds=${confirmed?.aggregate?.inbounds?.length ?? 'missing'}, version=${confirmed?.aggregate?.version ?? 'missing'}`, OPTIONS)
   if (!confirmed?.aggregate) return
 
-  const replayResponse = await request(context, 'POST', `${BASE}/confirm-dispatch`, actionBody,
+  const replayResponse = await request(context, 'POST', `${BASE}/${encodeURIComponent(containerBookingId)}/confirm`, confirmBody,
     { 'Idempotency-Key': confirmKey })
   const replay = context.apiSuccess(MODULE, 'confirm-dispatch 幂等重放', replayResponse, '', OPTIONS)
   context.assert(MODULE, '确认重放保持同一终态和版本', replayResponse,
@@ -117,49 +116,49 @@ export async function run(context) {
       && Number(replay?.aggregate?.version) === Number(confirmed?.aggregate?.version),
     `version=${replay?.aggregate?.version ?? 'missing'}`, OPTIONS)
 
-  const hashConflict = await request(context, 'POST', `${BASE}/confirm-dispatch`, { ...actionBody, remark: 'forged' },
+  const hashConflict = await request(context, 'POST', `${BASE}/${encodeURIComponent(containerBookingId)}/confirm`, { ...confirmBody, remark: 'forged' },
     { 'Idempotency-Key': confirmKey })
   context.addStep(MODULE, '相同 Idempotency-Key 不同请求拒绝', hashConflict,
     hashConflict.http === 200 && codeOf(hashConflict) === 'A0409',
     `HTTP=${hashConflict.http}, code=${codeOf(hashConflict)}`, OPTIONS)
 
   const reverseKey = `${context.marker}-outbound-reverse`.slice(0, 128)
-  const reverseResponse = await request(context, 'POST', `${BASE}/reverse-dispatch`, {
-    inboundId, containerBookingId, expectedVersion: Number(confirmed.aggregate.version), remark: context.marker,
+  const reverseResponse = await request(context, 'POST', `${BASE}/${encodeURIComponent(containerBookingId)}/reverse`, {
+    expectedVersion: Number(confirmed.aggregate.version), remark: context.marker,
   }, { 'Idempotency-Key': reverseKey })
   context.addStep(MODULE, '实际DEPARTED_WAREHOUSE节点产生后撤销精确返回A0409', reverseResponse,
     reverseResponse.http === 200 && codeOf(reverseResponse) === 'A0409'
       && String(reverseResponse.body?.message || '').includes('DEPARTED_WAREHOUSE')
       && String(reverseResponse.body?.message || '').includes('禁止撤销'),
     `HTTP=${reverseResponse.http}, code=${codeOf(reverseResponse)}, message=${reverseResponse.body?.message || 'missing'}`, OPTIONS)
-  const reverseReplayResponse = await request(context, 'POST', `${BASE}/reverse-dispatch`, {
-    inboundId, containerBookingId, expectedVersion: Number(confirmed.aggregate.version), remark: context.marker,
+  const reverseReplayResponse = await request(context, 'POST', `${BASE}/${encodeURIComponent(containerBookingId)}/reverse`, {
+    expectedVersion: Number(confirmed.aggregate.version), remark: context.marker,
   }, { 'Idempotency-Key': reverseKey })
   context.addStep(MODULE, '禁止撤销边界重复请求仍精确返回A0409', reverseReplayResponse,
     reverseReplayResponse.http === 200 && codeOf(reverseReplayResponse) === 'A0409'
       && String(reverseReplayResponse.body?.message || '').includes('DEPARTED_WAREHOUSE'),
     `HTTP=${reverseReplayResponse.http}, code=${codeOf(reverseReplayResponse)}`, OPTIONS)
 
-  const finalDetailResponse = await request(context, 'GET', `${BASE}/detail?${selector}`)
+  const finalDetailResponse = await request(context, 'GET', `${BASE}/${encodeURIComponent(containerBookingId)}`)
   const finalDetail = context.apiSuccess(MODULE, '负向与幂等验证后回查出仓聚合', finalDetailResponse, '', OPTIONS)
   context.assert(MODULE, '出仓聚合保持 WAITING_FOR_LOADING、LOADED 且无成功撤销历史', finalDetailResponse,
     finalDetail?.aggregate?.dispatchStatus === 'WAITING_FOR_LOADING'
-      && finalDetail?.aggregate?.inboundStatus === 'LOADED'
+      && finalDetail?.aggregate?.inbounds?.every?.((item) => item?.inboundStatus === 'LOADED')
       && Number(finalDetail?.aggregate?.version) === Number(confirmed?.aggregate?.version)
       && finalDetail?.timeline?.filter?.((item) => item.module === 'OUTBOUND_DISPATCH'
         && item.action === 'CONFIRM_DISPATCH').length === 1
       && !finalDetail?.timeline?.some?.((item) => item.module === 'OUTBOUND_DISPATCH'
         && item.action === 'REVERSE_DISPATCH'),
-    `dispatch=${finalDetail?.aggregate?.dispatchStatus || 'missing'}, inbound=${finalDetail?.aggregate?.inboundStatus || 'missing'}, version=${finalDetail?.aggregate?.version ?? 'missing'}`, OPTIONS)
+    `dispatch=${finalDetail?.aggregate?.dispatchStatus || 'missing'}, inbounds=${finalDetail?.aggregate?.inbounds?.length ?? 'missing'}, version=${finalDetail?.aggregate?.version ?? 'missing'}`, OPTIONS)
   if (confirmed?.aggregate) {
     context.createdResources.phase3OutboundDispatch = {
       marker: context.marker, inboundId, containerBookingId,
-      orderId: id(confirmed.aggregate.orderId), tenantId: id(confirmed.aggregate.tenantId),
+      orderId: id(inboundBinding?.orderId), tenantId: id(inboundBinding?.tenantId),
       confirmedStatus: confirmed.aggregate.dispatchStatus,
-      confirmedInboundStatus: confirmed.aggregate.inboundStatus,
+      confirmedInboundStatus: confirmed.aggregate.inbounds?.every?.((item) => item?.inboundStatus === 'LOADED') ? 'LOADED' : null,
       confirmedVersion: Number(confirmed.aggregate.version),
       finalStatus: confirmed.aggregate.dispatchStatus,
-      finalInboundStatus: confirmed.aggregate.inboundStatus,
+      finalInboundStatus: confirmed.aggregate.inbounds?.every?.((item) => item?.inboundStatus === 'LOADED') ? 'LOADED' : null,
       finalVersion: Number(confirmed.aggregate.version),
     }
   }
diff --git a/scripts/admin-test-env-modules/phase3-phase4-departure-pickup-chain-contract.test.mjs b/scripts/admin-test-env-modules/phase3-phase4-departure-pickup-chain-contract.test.mjs
new file mode 100644
index 000000000..2ee659802
--- /dev/null
+++ b/scripts/admin-test-env-modules/phase3-phase4-departure-pickup-chain-contract.test.mjs
@@ -0,0 +1,43 @@
+import assert from 'node:assert/strict'
+import { readFileSync } from 'node:fs'
+import { dirname, resolve } from 'node:path'
+import test from 'node:test'
+import { fileURLToPath } from 'node:url'
+
+const here = dirname(fileURLToPath(import.meta.url))
+const read = (name) => readFileSync(resolve(here, name), 'utf8')
+
+test('current-marker departure batch proves four documents photos customs and container-level confirm', () => {
+  const customs = read('phase3-customs.mjs')
+  const outbound = read('phase3-outbound-dispatch.mjs')
+  for (const type of ['DESTINATION_CLEARANCE', 'CUSTOMS_DECLARATION', 'DELIVERY_ORDER', 'PICKUP_ORDER']) {
+    assert.match(customs, new RegExp(type))
+  }
+  for (const evidence of ['首次上传', '回显', '下载', '更新', '完成']) assert.match(customs, new RegExp(evidence))
+  assert.match(customs, /photos\.length >= 5/)
+  assert.match(customs, /四类整柜资料必须完成后才允许进入出仓确认/)
+  assert.match(outbound, /CUSTOMS_CLEARANCE/)
+  assert.match(outbound, /拖车与独立船期仅作聚合参考且不参与出仓门禁/)
+  assert.match(outbound, /\$\{BASE\}\/\$\{encodeURIComponent\(containerBookingId\)\}\/confirm/)
+  assert.match(outbound, /confirm-dispatch 幂等重放/)
+  assert.match(outbound, /相同 Idempotency-Key 不同请求拒绝/)
+  assert.match(outbound, /实际DEPARTED_WAREHOUSE节点产生后撤销精确返回A0409/)
+  assert.doesNotMatch(outbound, /\/confirm-dispatch|\/reverse-dispatch|\/check-gate\?/) 
+})
+
+test('outbound-created query supports automated or manual carrier then reaches PICKUP_READY PDA candidate', () => {
+  const query = read('phase3-carrier-schedule-queries.mjs')
+  const nodes = read('phase4-carrier-nodes.mjs')
+  const pda = read('phase4-overseas-pda.mjs')
+  assert.match(query, /出仓自动建任务兼容自动船司与未知船司人工处理/)
+  assert.match(query, /manualCarrier && task\?\.status === 'MANUAL_REQUIRED'/)
+  assert.match(nodes, /'DISCHARGED_FROM_VESSEL', 'PICKUP_READY'/)
+  assert.match(nodes, /const pickupReadyIndex = STANDARD_NODES\.indexOf\('PICKUP_READY'\)/)
+  assert.match(nodes, /createdResources\.phase4CarrierPickupReady/)
+  assert.match(pda, /targetContainerNo[\s\S]*phase3Loading\?\.containerNo/)
+  assert.match(pda, /id\(carrierQuery\?\.trackingNo\) === targetContainerNo/)
+  assert.match(pda, /seen\.has\(targetContainerNo\)/)
+  assert.match(pda, /targetCorrelated/)
+  assert.match(pda, /deploymentBlocker: true/)
+  assert.doesNotMatch(pda, /addCoverageGap\([^\n]*PICKUP_READY/)
+})
diff --git a/scripts/admin-test-env-modules/phase3-phase4-producer-fixture-contract.test.mjs b/scripts/admin-test-env-modules/phase3-phase4-producer-fixture-contract.test.mjs
index 6574c4e2c..df0841e3e 100644
--- a/scripts/admin-test-env-modules/phase3-phase4-producer-fixture-contract.test.mjs
+++ b/scripts/admin-test-env-modules/phase3-phase4-producer-fixture-contract.test.mjs
@@ -81,7 +81,7 @@ test('measurement and loading pass destination identity into the LOADED producer
   assert.match(finalize, /resourceKey: `\$\{context\.marker\}:\$\{fixture\.destinationType \|\| 'UNKNOWN'\}:\$\{fixture\.containerNo \|\| containerBookingId\}`/)
   assert.match(finalize, /phase4InboundProducerFixtures = collectPhase4InboundProducerFixture/)
   const entry = read('../admin-test-env-acceptance.mjs')
-  assert.match(entry, /runPhase4ProducerVariant\('DROPSHIP-PRIMARY', 'FBA', 'ONE_CLICK_DROPSHIP'\)/)
+  assert.match(entry, /runPhase4ProducerVariant\('DROPSHIP-PRIMARY', 'FBA', 'ONE_CLICK_DROPSHIP', true\)/)
   assert.match(entry, /orderFulfillmentType/)
   assert.match(entry, /fulfillmentType: fixtureOrder\.fulfillmentType \|\| 'STANDARD'/)
   assert.match(entry, /skuCodes: Array\.isArray\(fixtureOrder\.skuCodes\) \? fixtureOrder\.skuCodes : \[\]/)
@@ -90,3 +90,36 @@ test('measurement and loading pass destination identity into the LOADED producer
   assert.match(pda, /find\(\(item\) => item\?\.fulfillmentType === 'ONE_CLICK_DROPSHIP'\)/)
   assert.match(pda, /skuFixtures\(context, producer\)/)
 })
+
+test('only PDA-operated variants traverse real outbound and carrier nodes before overseas receiving', () => {
+  const entry = read('../admin-test-env-acceptance.mjs')
+  assert.match(entry, /runPhase4ProducerVariant\('OVERSEAS-PRIMARY', 'OVERSEAS', 'STANDARD', true\)/)
+  assert.match(entry, /runPhase4ProducerVariant\('FBA-STANDARD', 'FBA', 'STANDARD', false\)/)
+  assert.match(entry, /runPhase4ProducerVariant\('SECONDARY', 'FBA', 'STANDARD', false\)/)
+  const start = entry.indexOf('if (pickupRequired && producerKey)')
+  const end = entry.indexOf('} finally {', start)
+  const pickupChain = entry.slice(start, end)
+  const ordered = [
+    'phase3-customs.mjs', 'service-center-flow.mjs', 'phase3-port-schedules.mjs',
+    'phase3-outbound-dispatch.mjs', 'phase3-carrier-schedule-queries.mjs',
+    'phase4-carrier-nodes.mjs', 'runUntilPickupReady(this)',
+  ]
+  let cursor = -1
+  for (const token of ordered) {
+    const next = pickupChain.indexOf(token)
+    assert.ok(next > cursor, `${token} must follow the real prerequisite chain`)
+    cursor = next
+  }
+  for (const key of ['phase3Customs', 'serviceCenterFlow', 'portSchedule', 'phase3OutboundDispatch',
+    'phase3CarrierScheduleQuery', 'phase4CarrierPickupReady']) assert.match(entry, new RegExp(`'${key}'`))
+  assert.match(entry, /for \(const key of createdKeys\) delete this\.createdResources\[key\]/)
+  assert.match(pickupChain, /shippingReady/)
+  assert.match(entry, /carrierScheduleQueryId/)
+  assert.match(pickupChain, /pickup\?\.marker === variantMarker/)
+  assert.doesNotMatch(pickupChain, /internal\/event-bridge|ll_container_shipping_gate|requestOverseas/)
+  assert.match(entry, /dropshipReady\?\.shippingReady === true/)
+  assert.match(entry, /overseasReady\?\.shippingReady === true/)
+  assert.match(entry, /awaitingVariants\.length >= 1/)
+  assert.doesNotMatch(entry, /awaitingVariants\.length === 2/)
+  assert.match(entry, /awaitingVariants\.every\(\(item\) => item\.shippingReady === false/)
+})
diff --git a/scripts/admin-test-env-modules/phase3-waiting-for-loading.mjs b/scripts/admin-test-env-modules/phase3-waiting-for-loading.mjs
index 6729d98f0..95e5ee054 100644
--- a/scripts/admin-test-env-modules/phase3-waiting-for-loading.mjs
+++ b/scripts/admin-test-env-modules/phase3-waiting-for-loading.mjs
@@ -12,9 +12,9 @@ export async function run(context) {
       '本轮未取得 phase3-outbound-dispatch 的 marker 隔离聚合，未使用历史资源', 'fixture')
     return
   }
-  const selector = `inboundId=${encodeURIComponent(fixture.inboundId)}&containerBookingId=${encodeURIComponent(fixture.containerBookingId)}`
-  const response = await context.request('GET', `${BASE}/detail?${selector}`)
-  const detail = context.apiSuccess(MODULE, '回查 WAITING_FOR_LOADING 状态历史', response, selector, OPTIONS)
+  const response = await context.request('GET', `${BASE}/${encodeURIComponent(fixture.containerBookingId)}`)
+  const detail = context.apiSuccess(MODULE, '回查柜级 WAITING_FOR_LOADING 状态历史', response,
+    `containerBookingId=${fixture.containerBookingId}`, OPTIONS)
   const history = Array.isArray(detail?.timeline)
     ? detail.timeline.filter((item) => item.module === 'OUTBOUND_DISPATCH') : []
   const confirmations = history.filter((item) => item.action === 'CONFIRM_DISPATCH')
@@ -27,7 +27,8 @@ export async function run(context) {
       && Boolean(confirmed?.operatorId) && Boolean(confirmed?.operatorName) && Boolean(confirmed?.occurredAt),
     `confirmed=${confirmed?.fromStatus || 'missing'}->${confirmed?.toStatus || 'missing'}, version=${fixture.confirmedVersion ?? 'missing'}`, OPTIONS)
   context.assert(MODULE, '实际离仓节点冻结后保持一次确认且零次成功撤销', response,
-    detail?.aggregate?.dispatchStatus === 'WAITING_FOR_LOADING' && detail?.aggregate?.inboundStatus === 'LOADED'
+    detail?.aggregate?.dispatchStatus === 'WAITING_FOR_LOADING'
+      && detail?.aggregate?.inbounds?.every?.((item) => item?.inboundStatus === 'LOADED')
       && confirmations.length === 1 && reversed.length === 0,
     `current=${detail?.aggregate?.dispatchStatus || 'missing'}, confirmations=${confirmations.length}, reversals=${reversed.length}`, OPTIONS)
 }
diff --git a/scripts/admin-test-env-modules/phase4-cross-region-events-contract.test.mjs b/scripts/admin-test-env-modules/phase4-cross-region-events-contract.test.mjs
index 7405b5832..dc99c6d41 100644
--- a/scripts/admin-test-env-modules/phase4-cross-region-events-contract.test.mjs
+++ b/scripts/admin-test-env-modules/phase4-cross-region-events-contract.test.mjs
@@ -80,7 +80,14 @@ test('cross-region normalization keeps existing producers ahead of every phase-t
 test('phase-four producer variants restore the primary orchestration fixture after each matrix branch', async () => {
   const source = await import('node:fs/promises').then((fs) => fs.readFile(
     new URL('../admin-test-env-acceptance.mjs', import.meta.url), 'utf8'))
-  assert.match(source, /const createdKeys = \['phase3Loading', 'phase3LoadingCompletedProducer', 'orchestrationFixtures', 'oceanBooking'\]/)
+  const start = source.indexOf('const createdKeys = [', source.indexOf('async runPhase4ProducerVariant'))
+  const end = source.indexOf(']', start)
+  const createdKeys = source.slice(start, end)
+  for (const key of [
+    'phase3Loading', 'phase3LoadingCompletedProducer', 'orchestrationFixtures', 'oceanBooking',
+    'phase3CustomsSupplier', 'phase3Customs', 'serviceCenterFlow', 'portSchedule',
+    'phase3OutboundDispatch', 'phase3CarrierScheduleQuery', 'phase4CarrierPickupReady',
+  ]) assert.match(createdKeys, new RegExp(`'${key}'`))
 })
 
 test('contract covers dual audience, canonical 403, both event directions and diagnostics', () => {
diff --git a/scripts/admin-test-env-modules/phase4-overseas-pda-contract.test.mjs b/scripts/admin-test-env-modules/phase4-overseas-pda-contract.test.mjs
index 6b0e61040..61ac6ec3a 100644
--- a/scripts/admin-test-env-modules/phase4-overseas-pda-contract.test.mjs
+++ b/scripts/admin-test-env-modules/phase4-overseas-pda-contract.test.mjs
@@ -35,26 +35,51 @@ test('PDA module covers the container-number receiving contract and excludes out
   assert.match(source, /第二仓库操作员抢占同柜返回409/)
   assert.match(source, /WAREHOUSE_PICKER/)
   assert.match(source, /lastleg:pda:operate/)
+  assert.match(source, /安全投影已收敛/)
+  assert.match(source, /projectionReady = success\(projectionResponse\) \|\| notFound\(projectionResponse\)/)
+  assert.match(source, /setTimeout\(resolve, 500\)/)
   assert.match(source, /超收被拒绝/)
   assert.match(source, /重复箱新键被拒绝/)
   assert.match(source, /key\(context, `fba-bulk-\$\{index\}`\)/)
+  assert.match(source, /packageCount = Number\(resolved\.data\?\.pendingPackages \|\| 0\)/)
+  assert.match(source, /if \(packageCount <= 0\) continue/)
   assert.match(source, /key\(context, `overseas-carton-\$\{index\}`\)/)
   assert.match(source, /模式硬拒绝/)
   assert.match(source, /current返回404正常空态/)
   assert.match(source, /安全扫描返回A0400/)
-  assert.match(source, /customerId: 0/)
+  assert.match(source, /warehouse-admin\?tenantId=0&.*capabilityCode=RECEIVING&warehouseType=OVERSEAS&status=ACTIVE/)
+  assert.match(source, /193000000000200003.*193000000000200004/)
+  assert.doesNotMatch(source, /requestOverseas\('POST', '\/api\/platform\/v1\/warehouse-admin'/)
   assert.match(source, /overseasWarehouseId, password/)
   assert.match(source, /inbound\?\.overseasWarehouseId/)
   assert.doesNotMatch(source, /const warehouseId = id\(inbound\?\.destinationWarehouseId\)/)
   assert.match(source, /目的仓 .* 不得代替物理仓/)
   assert.match(source, /retained as acceptance evidence/)
   assert.match(source, /preferredProducer\?\.cartonMarks\?\.length/)
-  assert.match(source, /for \(const \[index, cartonMark\] of cartonMarks\.entries\(\)\)/)
+  assert.match(source, /const cartonCandidates =/)
+  assert.match(source, /candidateExcluded = notFound\(response\)/)
+  assert.match(source, /if \(candidateExcluded\) continue/)
+  assert.match(source, /const fixturesConserved = cartonFixtures\.length === expectedPending/)
+  assert.match(source, /OVERSEAS实装箱唛与待收箱数守恒/)
+  assert.match(source, /for \(const \[index, fixture\] of cartonFixtures\.entries\(\)\)/)
+  assert.doesNotMatch(source, /for \(const \[index, cartonMark\] of cartonMarks\.entries\(\)\)/)
   assert.match(source, /last-leg\/orders\?page=1&size=200&containerNo=/)
   assert.match(source, /phase4OverseasPda\.orderId = id\(order\.id\)/)
   assert.match(source, /phase4OverseasPda\.customerId = id\(order\.customerId\)/)
   assert.match(source, /现场库存查询只返回Token绑定仓且包含库存位置/)
   assert.match(source, /作业历史包含本轮柜号收货动作且分页稳定/)
+  assert.match(source, /awaitProducerConsumption\(context, allProducers\)/)
+  assert.match(source, /last-leg\/orders\?page=1&size=200&containerNo=/)
+  assert.match(source, /跨区消费生成尾程订单/)
+  assert.match(source, /awaitPickupReadyCandidates\(context, primary\.token, producers, allProducers\)/)
+  assert.match(source, /missingPickupReady=/)
+  assert.match(source, /item\?\.shippingReady === false/)
+  assert.match(source, /!expectedSet\.has\(id\(item\?\.containerNo\)\)/)
+  assert.match(source, /unexpectedAwaiting=/)
+  assert.match(source, /missingPickupReady\.length === 0 && unexpectedAwaiting\.length === 0/)
+  assert.doesNotMatch(source, /shippingReady == null|shippingReady !== true/)
+  assert.match(source, /unexpectedHistorical=/)
+  assert.doesNotMatch(source, /awaitProducerCandidates/)
 })
 
 test('missing WAREHOUSE_PICKER overseas authority is a deployment blocker', async () => {
@@ -97,6 +122,10 @@ test('empty candidate response cannot become a zero-business-request pass', asyn
       if (method === 'GET' && requestPath.endsWith('/permissions')) return response([
         { id: permissionId, permissionCode: 'lastleg:pda:operate' },
       ], requestPath, method)
+      if (method === 'GET' && requestPath.startsWith('/api/platform/v1/warehouse-admin?')) return response({
+        records: [{ id: '193000000000200003', warehouseName: '洛杉矶仓', warehouseType: 'OVERSEAS', status: 'ACTIVE' }],
+        page: 1, size: 200, total: 1, pages: 1,
+      }, requestPath, method)
       if (method === 'POST' && requestPath.endsWith('/users')) return response({
         membershipId: String(9000 + userSequence), username: body.username, tenantId: '0', roleIds: [roleId],
         overseasWarehouseId: String(body.overseasWarehouseId), status: 'ACTIVE',
@@ -107,7 +136,6 @@ test('empty candidate response cannot become a zero-business-request pass', asyn
     },
     async requestOverseas(method, requestPath, body, headers, token) {
       calls.push({ channel: 'overseas', method, requestPath })
-      if (method === 'POST' && requestPath === '/api/platform/v1/warehouse-admin') return response('900', requestPath, method)
       if (requestPath.endsWith('/current')) return { method, path: requestPath, http: 200,
         body: { code: 'A0404', message: 'not found' }, requestId: 'req-current', traceId: 'trace-current' }
       return response([], requestPath, method)
diff --git a/scripts/admin-test-env-modules/phase4-overseas-pda.mjs b/scripts/admin-test-env-modules/phase4-overseas-pda.mjs
index e7e7040c1..ba7c333d3 100644
--- a/scripts/admin-test-env-modules/phase4-overseas-pda.mjs
+++ b/scripts/admin-test-env-modules/phase4-overseas-pda.mjs
@@ -111,7 +111,21 @@ async function createPicker(context, index, overseasWarehouseId, access) {
   const token = success(login) ? login.body?.data?.overseasAccessToken : null
   context.addStep(MODULE, `海外PDA操作员${index}登录取得双区域海外令牌`, login, nonBlank(token),
     `overseasTokenPresent=${nonBlank(token)}; ${trace(login)}`, OPTIONS)
-  return { membershipId, username, token: nonBlank(token) ? token : null }
+  if (!nonBlank(token)) return { membershipId, username, token: null }
+
+  let projectionResponse = null
+  let projectionReady = false
+  let projectionAttempt = 0
+  for (; projectionAttempt < 30; projectionAttempt += 1) {
+    projectionResponse = await context.requestOverseas('GET',
+      '/api/pda/v1/last-leg/receiving-containers/current', undefined, {}, token)
+    projectionReady = success(projectionResponse) || notFound(projectionResponse)
+    if (projectionReady || !forbidden(projectionResponse)) break
+    await new Promise((resolve) => setTimeout(resolve, 500))
+  }
+  context.addStep(MODULE, `海外PDA操作员${index}安全投影已收敛`, projectionResponse, projectionReady,
+    `attempts=${projectionAttempt + 1}; ${trace(projectionResponse)}`, OPTIONS)
+  return { membershipId, username, token: projectionReady ? token : null }
 }
 
 async function disablePicker(context, picker, index) {
@@ -205,22 +219,70 @@ async function uploadPhotos(context, token) {
   return photos
 }
 
-async function awaitProducerCandidates(context, token, producers) {
+async function awaitProducerConsumption(context, producers) {
   const expected = [...new Set(producers.map((item) => id(item?.containerNo)).filter(nonBlank))]
+  if (!expected.length) return true
+  const consumed = new Set()
+  const lastResponses = new Map()
+  for (let attempt = 1; attempt <= 30; attempt += 1) {
+    const missing = expected.filter((containerNo) => !consumed.has(containerNo))
+    const results = await Promise.all(missing.map(async (containerNo) => {
+      const response = await context.requestOverseas('GET',
+        `/api/platform/v1/last-leg/orders?page=1&size=200&containerNo=${encodeURIComponent(containerNo)}`)
+      return { containerNo, response }
+    }))
+    for (const { containerNo, response } of results) {
+      lastResponses.set(containerNo, response)
+      const rows = records(response?.body?.data)
+      if (success(response) && rows.some((item) => id(item?.containerNo) === containerNo)) {
+        consumed.add(containerNo)
+      }
+    }
+    if (expected.every((containerNo) => consumed.has(containerNo))) break
+    await new Promise((resolve) => setTimeout(resolve, 1000))
+  }
+  for (const containerNo of expected) {
+    const response = lastResponses.get(containerNo) || null
+    context.addStep(MODULE, `跨区消费生成尾程订单 ${containerNo}`, response,
+      consumed.has(containerNo),
+      `containerNo=${containerNo}, consumed=${consumed.has(containerNo)}; ${trace(response)}`, OPTIONS)
+  }
+  return expected.every((containerNo) => consumed.has(containerNo))
+}
+
+async function awaitPickupReadyCandidates(context, token, producers, allProducers) {
+  const expected = [...new Set(producers.map((item) => id(item?.containerNo)).filter(nonBlank))]
+  const expectedSet = new Set(expected)
+  const awaiting = [...new Set(allProducers
+    .filter((item) => item?.shippingReady === false && !expectedSet.has(id(item?.containerNo)))
+    .map((item) => id(item?.containerNo)).filter(nonBlank))]
+  const known = new Set(allProducers.map((item) => id(item?.containerNo)).filter(nonBlank))
   if (!expected.length) return false
   let response = null
   let seen = new Set()
   for (let attempt = 1; attempt <= 30; attempt += 1) {
     response = await context.requestOverseas('GET',
       '/api/pda/v1/last-leg/receiving-containers/candidates', undefined, {}, token)
-    const records = success(response) && Array.isArray(response.body?.data) ? response.body.data : []
-    seen = new Set(records.map((item) => id(item?.containerNo)).filter(nonBlank))
-    if (expected.every((containerNo) => seen.has(containerNo))) break
+    const candidateRows = success(response) && Array.isArray(response.body?.data) ? response.body.data : []
+    seen = new Set(candidateRows.map((item) => id(item?.containerNo)).filter(nonBlank))
+    if (expected.every((containerNo) => seen.has(containerNo))
+        && awaiting.every((containerNo) => !seen.has(containerNo))) break
     await new Promise((resolve) => setTimeout(resolve, 1000))
   }
-  const ready = expected.every((containerNo) => seen.has(containerNo))
-  context.addStep(MODULE, '三期生产矩阵全部进入海外待收候选后再开始PDA', response, ready,
-    `expected=${expected.join('|')}, seen=${[...seen].join('|')}; ${trace(response)}`, OPTIONS)
+  const seenExpected = expected.filter((containerNo) => seen.has(containerNo))
+  const missingPickupReady = expected.filter((containerNo) => !seen.has(containerNo))
+  const unexpectedAwaiting = awaiting.filter((containerNo) => seen.has(containerNo))
+  const unexpectedHistorical = [...seen].filter((containerNo) => !known.has(containerNo))
+  const targetContainerNo = id(context.createdResources?.phase3Loading?.containerNo)
+  const carrierQuery = context.createdResources?.phase3CarrierScheduleQuery
+  const pickup = context.createdResources?.phase4CarrierPickupReady
+  const targetCorrelated = nonBlank(targetContainerNo) && expectedSet.has(targetContainerNo)
+    && seen.has(targetContainerNo) && carrierQuery?.marker === context.marker
+    && id(carrierQuery?.trackingNo) === targetContainerNo && pickup?.marker === context.marker
+    && pickup?.ready === true && id(pickup?.queryId) === id(carrierQuery?.queryId)
+  const ready = missingPickupReady.length === 0 && unexpectedAwaiting.length === 0 && targetCorrelated
+  context.addStep(MODULE, '实际处理柜全部达到PICKUP_READY并进入PDA候选', response, ready,
+    `targetContainerNo=${targetContainerNo || 'missing'}, targetCorrelated=${targetCorrelated}, expected=${expected.join('|')}, awaiting=${awaiting.join('|') || 'none'}, seenExpected=${seenExpected.join('|') || 'none'}, missingPickupReady=${missingPickupReady.join('|') || 'none'}, unexpectedAwaiting=${unexpectedAwaiting.join('|') || 'none'}, unexpectedHistorical=${unexpectedHistorical.join('|') || 'none'}; ${trace(response)}`, OPTIONS)
   return ready
 }
 
@@ -253,13 +315,15 @@ async function receiveFba(context, token, inbound, pallet, producer) {
   }
   let accepted = 0
   for (const [index, sku] of skus.entries()) {
-    const { skuCode, packageCount } = sku
+    const { skuCode } = sku
     const resolvedResponse = await context.requestOverseas('POST',
       '/api/pda/v1/last-leg/receiving-containers/current/skus/resolve', { skuCode }, {}, token)
     const resolvable = success(resolvedResponse) || notFound(resolvedResponse)
     context.addStep(MODULE, `解析FBA SKU候选 ${index + 1}`, resolvedResponse, resolvable, trace(resolvedResponse), OPTIONS)
     const resolved = { response: resolvedResponse, data: success(resolvedResponse) ? resolvedResponse.body?.data : null }
     if (!success(resolved.response) || resolved.data?.inboundCode !== inbound.inboundCode || resolved.data?.destinationType !== 'FBA') continue
+    const packageCount = Number(resolved.data?.pendingPackages || 0)
+    if (packageCount <= 0) continue
     const body = { inboundCode: inbound.inboundCode, skuCode, palletCode: pallet.palletCode,
       packageCount, idempotencyKey: key(context, `fba-bulk-${index}`) }
     const first = await pda(context, token, 'POST', `FBA SKU ${skuCode}按箱数实收`, '/api/pda/v1/last-leg/receiving-containers/current/receipts/bulk', body)
@@ -281,23 +345,52 @@ async function receiveFba(context, token, inbound, pallet, producer) {
 }
 
 async function receiveOverseas(context, token, inbounds, pallets, producerCartonMarks = []) {
-  const cartonMarks = [...new Set((Array.isArray(producerCartonMarks) ? producerCartonMarks : [producerCartonMarks])
+  const cartonCandidates = [...new Set((Array.isArray(producerCartonMarks) ? producerCartonMarks : [producerCartonMarks])
     .map(id).filter(nonBlank))]
-  if (!cartonMarks.length) {
+  if (!cartonCandidates.length) {
     blockerGap(context, 'OVERSEAS逐箱链', '缺少本轮PDA任务冻结箱唛，逐箱实收不能使用伪造箱号')
     return false
   }
-  for (const [index, cartonMark] of cartonMarks.entries()) {
-    const resolved = await pda(context, token, 'POST', `解析OVERSEAS冻结箱唛${index + 1}`,
-      '/api/pda/v1/last-leg/receiving-containers/current/cartons/resolve', { cartonMark })
-    const inbound = inbounds.find((item) => item.inboundCode === resolved.data?.inboundCode)
-    const pallet = inbound ? pallets.get(inbound.inboundCode) : null
-    if (!success(resolved.response) || !inbound || !pallet) {
-      blockerGap(context, `OVERSEAS箱唛${cartonMark}归属`,
-        `冻结箱唛未解析到带真实托盘的本柜入仓码；inboundCode=${resolved.data?.inboundCode || 'missing'}`,
-        'fixture-mismatch', resolved.response)
+  const expectedPending = inbounds.reduce((total, inbound) => total + Number(inbound.pendingPackages || 0), 0)
+  const cartonFixtures = []
+  let lastResponse = null
+  for (const [index, cartonMark] of cartonCandidates.entries()) {
+    const response = await context.requestOverseas('POST',
+      '/api/pda/v1/last-leg/receiving-containers/current/cartons/resolve', { cartonMark }, {}, token)
+    lastResponse = response
+    const candidateExcluded = notFound(response)
+    context.addStep(MODULE, `筛选OVERSEAS实装箱唛候选${index + 1}`, response,
+      success(response) || candidateExcluded,
+      `${candidateExcluded ? 'candidateSelected=false' : 'candidateSelected=true'}; ${trace(response)}`, OPTIONS)
+    if (candidateExcluded) continue
+    if (!success(response)) {
+      blockerGap(context, `OVERSEAS箱唛候选${cartonMark}预检`,
+        '候选箱唛既非本柜冻结事实，也不是未被最终实装选中的A0404；禁止继续收货',
+        'fixture-mismatch', response)
       return false
     }
+    const resolved = response.body?.data
+    const inbound = inbounds.find((item) => item.inboundCode === resolved?.inboundCode)
+    const pallet = inbound ? pallets.get(inbound.inboundCode) : null
+    if (!inbound || !pallet) {
+      blockerGap(context, `OVERSEAS箱唛${cartonMark}归属`,
+        `冻结箱唛未解析到带真实托盘的本柜入仓码；inboundCode=${resolved?.inboundCode || 'missing'}`,
+        'fixture-mismatch', response)
+      return false
+    }
+    cartonFixtures.push({ cartonMark, pallet })
+  }
+  const fixturesConserved = cartonFixtures.length === expectedPending
+  context.assert(MODULE, 'OVERSEAS实装箱唛与待收箱数守恒', lastResponse, fixturesConserved,
+    `resolvedFixtures=${cartonFixtures.length}, pendingPackages=${expectedPending}; ${trace(lastResponse)}`, OPTIONS)
+  if (!fixturesConserved) {
+    blockerGap(context, 'OVERSEAS逐箱冻结事实',
+      `候选池未完整覆盖本柜真实冻结箱唛；resolvedFixtures=${cartonFixtures.length}, pendingPackages=${expectedPending}`,
+      'fixture-mismatch', lastResponse)
+    return false
+  }
+  for (const [index, fixture] of cartonFixtures.entries()) {
+    const { cartonMark, pallet } = fixture
     const body = { cartonMark, palletCode: pallet.palletCode,
       idempotencyKey: key(context, `overseas-carton-${index}`) }
     const first = await pda(context, token, 'POST', `OVERSEAS逐箱实收${index + 1}`,
@@ -466,9 +559,9 @@ export async function run(context) {
   const merchantToken = await loginMerchantForNegativeProbe(context)
   const pickerAccess = await resolvePickerAccess(context)
   if (!pickerAccess) return
-  const sharedWarehouse = await createSharedWarehouse(context)
+  const sharedWarehouse = await resolveSharedWarehouse(context)
   if (!sharedWarehouse) {
-    blockerGap(context, '海外PDA共享实际收货仓', '无法通过平台正式API创建customerId=0共享物理仓')
+    blockerGap(context, '海外PDA共享实际收货仓', '国内Warehouse主数据没有ACTIVE且启用RECEIVING的OVERSEAS固定作业仓')
     return
   }
   context.createdResources.phase4OverseasPda.overseasWarehouseId = sharedWarehouse.id
@@ -501,9 +594,14 @@ export async function run(context) {
     const producers = [dropship || matrix?.byDestinationType?.FBA?.[0], matrix?.byDestinationType?.OVERSEAS?.[0]]
       .filter((item) => nonBlank(item?.containerNo))
     const allProducers = Array.isArray(matrix?.containers) ? matrix.containers : producers
-    if (allProducers.length && !(await awaitProducerCandidates(context, primary.token, allProducers))) {
-      blockerGap(context, '海外待收柜生产矩阵',
-        '三期已发布的FBA、OVERSEAS和第二柜尚未全部被海外事件消费者提交，禁止与消费事务并发入库')
+    if (allProducers.length && !(await awaitProducerConsumption(context, allProducers))) {
+      blockerGap(context, '跨区消费生产矩阵',
+        '三期已发布的四柜尚未全部由海外消费者生成尾程订单，禁止把PICKUP_READY缺口与事件消费混为一谈')
+      return
+    }
+    if (producers.length && !(await awaitPickupReadyCandidates(context, primary.token, producers, allProducers))) {
+      blockerGap(context, '实际处理柜PICKUP_READY门禁',
+        'Dropship/FBA与OVERSEAS实际处理柜尚未全部达到PICKUP_READY；跨区消费已独立验证，不回退处理历史柜')
       return
     }
     for (const [index, producer] of (producers.length ? producers : [null]).entries()) {
@@ -525,21 +623,14 @@ export async function run(context) {
   }
 }
 
-async function createSharedWarehouse(context) {
-  const suffix = markerSuffix(context)
-  const payload = {
-    customerId: 0, warehouseCode: `PDA-${suffix}`.slice(0, 50),
-    warehouseName: `PDA共享收货仓-${suffix}`.slice(0, 120), warehouseType: 'OVERSEAS',
-    countryCode: 'US', timezone: 'America/Los_Angeles', contactName: 'PDA Acceptance',
-    contactPhone: '+1-213-555-0198', contactEmail: `pda-${suffix.toLowerCase()}@example.com`,
-    status: 'ACTIVE', remark: `${context.marker}-shared-receiving`,
-    address: { addressType: 'WAREHOUSE', countryCode: 'US', stateProvince: 'CA', city: 'Los Angeles',
-      district: 'Commerce', postalCode: '90040', addressLine1: '1 Acceptance Logistics Ave' },
-    capabilities: [{ capabilityCode: 'RECEIVING', capabilityName: '收货', enabled: true }],
-  }
-  const created = await context.requestOverseas('POST', '/api/platform/v1/warehouse-admin', payload)
-  const warehouseId = id(created?.body?.data)
-  context.addStep(MODULE, '创建本轮PDA共享实际收货仓', created,
-    success(created) && longId(warehouseId), `warehouseId=${warehouseId || 'missing'}; ${trace(created)}`, OPTIONS)
-  return longId(warehouseId) ? { id: warehouseId, name: payload.warehouseName } : null
+async function resolveSharedWarehouse(context) {
+  const path = '/api/platform/v1/warehouse-admin?tenantId=0&page=1&size=200&capabilityCode=RECEIVING&warehouseType=OVERSEAS&status=ACTIVE'
+  const response = await context.request('GET', path)
+  const rows = records(response?.body?.data)
+  const fixedIds = new Set(['193000000000200003', '193000000000200004'])
+  const warehouse = success(response) ? rows.find((item) => fixedIds.has(id(item?.id))) : null
+  context.addStep(MODULE, '读取国内Warehouse权威海外PDA实际收货仓', response,
+    Boolean(warehouse) && warehouse?.warehouseType === 'OVERSEAS' && warehouse?.status === 'ACTIVE',
+    `warehouseId=${id(warehouse?.id) || 'missing'}, warehouseName=${warehouse?.warehouseName || warehouse?.name || 'missing'}; ${trace(response)}`, OPTIONS)
+  return warehouse ? { id: id(warehouse.id), name: warehouse.warehouseName || warehouse.name } : null
 }
diff --git a/scripts/admin-test-env-modules/supplemental.mjs b/scripts/admin-test-env-modules/supplemental.mjs
index 24a95aa72..28bef19f7 100644
--- a/scripts/admin-test-env-modules/supplemental.mjs
+++ b/scripts/admin-test-env-modules/supplemental.mjs
@@ -46,6 +46,10 @@ export async function run(context) {
   const module = 'supplemental'
   const scenario = 'service-health-and-auth-boundary'
   const blocker = { scenario, deploymentBlocker: true }
+  const customerId = String(context.context.merchantQualificationFixture?.tenantId || '')
+  context.assert(module, '客户作用域负向检查使用本轮正式客户', null, Boolean(customerId),
+    `customerId=${customerId || 'missing'}`, blocker)
+  if (!customerId) return
 
   // Health endpoints are part of the deployed service contract.  Warehouse is
   // special: a schema/readiness failure is intentionally HTTP 503, not a fake
@@ -102,7 +106,7 @@ export async function run(context) {
   }
   for (const [name, path] of [
     ['仓库非法状态', '/api/platform/v1/warehouse-admin?page=1&size=5&status=NOT_A_STATUS'],
-    ['仓库客户作用域', '/api/platform/v1/warehouse-admin?page=1&size=5&tenantId=10001'],
+    ['仓库客户作用域', `/api/platform/v1/warehouse-admin?page=1&size=5&tenantId=${encodeURIComponent(customerId)}`],
   ]) {
     const response = await context.request('GET', path)
     context.addStep(module, `${name}安全失败`, response, isBusinessFailure(response),
@@ -118,8 +122,8 @@ export async function run(context) {
     await checkPage(context, module, '托盘仓库筛选', `${palletBase}&warehouseId=${warehouseId}`, { scenario: 'warehouse-resources' })
   }
   const resourceScopeChecks = [
-    ['库位客户作用域', '/api/platform/v1/locations?page=1&size=5&tenantId=10001'],
-    ['托盘客户作用域', '/api/platform/v1/pallets?page=1&size=5&tenantId=10001'],
+    ['库位客户作用域', `/api/platform/v1/locations?page=1&size=5&tenantId=${encodeURIComponent(customerId)}`],
+    ['托盘客户作用域', `/api/platform/v1/pallets?page=1&size=5&tenantId=${encodeURIComponent(customerId)}`],
     ['库位非法状态', `${locationBase}&status=ALLOCATED`],
   ]
   for (const [name, path] of resourceScopeChecks) {
diff --git a/scripts/admin-test-env-modules/suppliers.mjs b/scripts/admin-test-env-modules/suppliers.mjs
index abb38b91a..ae2b96255 100644
--- a/scripts/admin-test-env-modules/suppliers.mjs
+++ b/scripts/admin-test-env-modules/suppliers.mjs
@@ -1,8 +1,8 @@
 const MODULE = 'suppliers'
 const OPTIONS = { scenario: 'platform-public-suppliers', deploymentBlocker: true }
 const BASE = '/api/platform/v1/suppliers'
-const MERCHANT_USERNAME = process.env.MERCHANT_TEST_USERNAME || 'merchant_admin'
-const MERCHANT_PASSWORD = process.env.MERCHANT_TEST_PASSWORD || 'ChangeMe123!'
+const MERCHANT_USERNAME = process.env.MERCHANT_TEST_USERNAME || ''
+const MERCHANT_PASSWORD = process.env.MERCHANT_TEST_PASSWORD || ''
 
 function ok(response) { return response?.http === 200 && String(response?.body?.code) === '200' }
 function code(response, expected) { return response?.http === 200 && String(response?.body?.code) === expected }
diff --git a/scripts/admin-test-env-modules/批量待分柜数据生成指南.md b/scripts/admin-test-env-modules/批量待分柜数据生成指南.md
new file mode 100644
index 000000000..2e52faa80
--- /dev/null
+++ b/scripts/admin-test-env-modules/批量待分柜数据生成指南.md
@@ -0,0 +1,155 @@
+# 批量待分柜数据生成指南
+
+本文说明如何复用 `scripts/admin-test-env-acceptance.mjs`，通过正式 HTTP 业务接口批量生成停在“测量完成待分柜”的头程订单。生成链路包含客户登录、下单、平台审核、入库、称重、测量、测量审核，不直接写业务数据库，也不模拟成功。
+
+## 适用范围
+
+- 用于开发、联调或经明确授权的验收环境准备人工操作数据。
+- 生成结果固定为入库单 `processStatus=WAIT_SPLIT`、测量审核 `APPROVED`。
+- 单次支持 `1-100` 条；更大批量分多次执行并分别保存报告。
+- 不负责后续分柜、装柜、订舱、国内出仓、海外入仓或 PDA 收货。
+- 禁止用于生产环境。对任何共享环境执行前，必须在当前对话明确获得该环境的写数据授权。
+
+## 固定项与随机项
+
+批量模式可固定以下三个线路字段：
+
+1. 国内起运仓名称：`--origin-warehouse-name`
+2. 渠道名称：`--channel-name`
+3. 渠道编码：`--channel-code`
+
+客户通过复用已审核商户账号固定；服务端从登录身份解析客户，脚本不会手填客户 ID。
+
+使用 `--order-profile-mode randomized` 后，脚本在服务端允许的真实组合中轮换：
+
+- 目的类型：`FBA`、`OVERSEAS`、`PRIVATE`
+- 履约类型：`STANDARD`、`ONE_CLICK_DROPSHIP`
+- 提货方式：`PICKUP`、`SELF_EXPRESS`、`SELF_TRUCK`
+- 买单/退税：`BUY_DECLARATION`、`TAX_REFUND`
+- 报价税制：`TAX_INCLUDED`、`TAX_EXCLUDED`，以固定渠道实际支持项为准
+- 装载方式：`LCL`、`FULL_CONTAINER`
+- 是否查验
+- SKU 数、每 SKU 箱数、托数、重量和测量箱型
+- FBA/海外仓目的仓：只从固定渠道当前价格簿真实可计价仓库中选择
+
+随机档案是可重复的稳定轮换，不是不可复现的纯随机数。每六条覆盖一次“3 种目的类型 × 2 种履约类型”的核心组合，便于复核覆盖率。
+
+特殊规则：
+
+- `PRIVATE` 不引用公共目的仓 ID，必须携带收件人地址；当前契约不对私人地址做自动报价。
+- `FBA` 必须使用真实可计价 FBA 目的仓，并冻结 Amazon 仓码、Shipment ID 和 Reference ID。
+- `OVERSEAS` 必须使用真实可计价海外仓；固定渠道只有一个可用海外仓时允许重复使用，不伪造第二个仓。
+- 默认 `--order-profile-mode fixed` 仍生成 FBA + STANDARD，不启用上述随机组合。
+
+## 执行前置
+
+执行前确认：
+
+- 目标 Gateway 和服务已部署当前接口。
+- 平台管理员账号可用。
+- 复用客户已审核通过，商户账号可登录。
+- 客户固定箱型初始化完成。
+- 固定国内仓为 `ACTIVE` 且具备收货能力。
+- 固定渠道存在当前 `ACTIVE` 价格簿和进仓码前缀。
+- FBA/OVERSEAS 至少存在一个与固定渠道价格明细匹配的目的仓。
+- File、Order、Firstleg、Warehouse、IAM、Auth 等链路可用。
+
+账号、密码、环境域名和 Token 不得写入本文、源码、提交记录或报告。建议由本地未提交环境文件或当前终端环境变量提供。
+
+## PowerShell 命令模板
+
+先在当前终端提供敏感执行参数：
+
+```powershell
+$env:ADMIN_TEST_GATEWAY = '<目标环境国内 Gateway>'
+$env:ADMIN_TEST_USERNAME = '<平台管理员账号>'
+$env:ADMIN_TEST_PASSWORD = '<平台管理员密码>'
+$env:MERCHANT_TEST_USERNAME = '<已审核商户账号>'
+$env:MERCHANT_TEST_PASSWORD = '<已审核商户密码>'
+```
+
+从 `baiyue-firstleg/` 执行：
+
+```powershell
+node scripts/admin-test-env-acceptance.mjs `
+  --modules inbound-measurement `
+  --merchant-username $env:MERCHANT_TEST_USERNAME `
+  --merchant-password $env:MERCHANT_TEST_PASSWORD `
+  --origin-warehouse-name '<固定国内仓名称>' `
+  --channel-name '<固定渠道名称>' `
+  --channel-code '<固定渠道编码>' `
+  --order-profile-mode randomized `
+  --wait-split-count 100 `
+  --output '<本地报告绝对路径>.json'
+```
+
+`inbound-measurement` 会自动展开 `orders` 前置。提供完整商户账号和密码后，总入口会复用该客户并移除自动创建客户的 `merchant-qualification-fixture`；两个商户参数必须同时提供。
+
+如果需要自动新建并审核一个隔离客户，不传复用商户账号，改用：
+
+```powershell
+node scripts/admin-test-env-acceptance.mjs `
+  --modules merchant-qualification-fixture,orders,inbound-measurement `
+  --customer-name '<本轮客户名称>' `
+  --origin-warehouse-name '<固定国内仓名称>' `
+  --channel-name '<固定渠道名称>' `
+  --channel-code '<固定渠道编码>' `
+  --order-profile-mode randomized `
+  --wait-split-count 100 `
+  --output '<本地报告绝对路径>.json'
+```
+
+## 报告核验
+
+成功报告中的 `createdResources.waitSplitFixtures` 每条至少应核对：
+
+- `tenantId`、`orderId`、`inboundId`、`inboundCode`
+- `processStatus=WAIT_SPLIT`
+- `reviewStatus=APPROVED`
+- `receivingWarehouseName`、`channelCode`、`channelName`
+- `destinationType`、目的仓字段、`fulfillmentType`
+- `pickupMethod`、`taxMode`、`pricingTaxMode`、`containerMode`、`customsInspection`
+- SKU 数、总箱数、托数、毛重、净重和测量档案
+
+建议同时检查：
+
+- fixture 数量等于本轮 `--wait-split-count`
+- `inboundCode` 去重数等于 fixture 数量
+- 固定客户、国内仓和渠道只有一个唯一值
+- `failed=0` 且报告顶层 `success=true`
+- 随机批次包含预期目的类型和履约类型
+
+报告生成前会扫描密码、Token、文件二进制、base64 和 OCR 原文等敏感内容。报告仍属于本地验收证据，不应提交到源码仓库。
+
+## 失败、重跑与批量拆分
+
+- 批次遇到第一条失败即停止，已经成功创建的订单不会自动删除或回滚。
+- 先查看日志和 JSON 报告中最后一个成功 fixture、失败接口的 `code/requestId/traceId`，修复前置后再运行剩余数量。
+- 重跑会生成新业务单号和入仓码，不覆盖旧订单；不要假设跨多次运行的入仓码一定连续。
+- 每次运行的随机序列从 1 重新开始；分批执行时组合可能重复，但仍保持固定三项和真实契约。
+- 大于 100 条时建议按 50-100 条拆批，并为每批使用独立报告文件名。
+- 若固定渠道只有少量目的仓，目的仓重复是合法结果；脚本只保证从真实可计价集合选择，不保证每批目的仓均匀分布。
+
+## 常见阻断
+
+| 现象 | 核对项 |
+|---|---|
+| 未找到固定起运仓 | 仓库名称是否精确一致、状态是否 ACTIVE、类型是否 DOMESTIC |
+| 未找到固定物流渠道 | 渠道编码/名称是否精确一致、价格簿是否 ACTIVE、起运仓是否匹配 |
+| 没有可计价目的仓 | 价格簿目的类型、目的仓映射、报价税制和仓库状态 |
+| 私人地址创建失败 | `destinationWarehouseId` 必须为空，收件人字段必须完整 |
+| 测量审核未到 WAIT_SPLIT | 称重图片、托数、净重、总箱数和测量箱数是否精确核平 |
+| 报告数量不足 | 查看首个失败模块；已成功数据不会因后续失败回滚 |
+
+## 离线验证
+
+修改生成器或本文关联参数后，至少运行：
+
+```powershell
+node --check scripts/admin-test-env-acceptance.mjs
+node --check scripts/admin-test-env-modules/orders.mjs
+node --test scripts/admin-test-env-modules/merchant-qualification-fixture-contract.test.mjs scripts/admin-test-env-modules/inbound-measurement-box-code-contract.test.mjs
+git diff --check
+```
+
+离线检查不访问环境，也不代表 HTTP 批量生成已经通过。真实生成必须另行获得目标环境写数据授权。
diff --git a/scripts/agents-index-contract.ps1 b/scripts/agents-index-contract.ps1
index ad8e06621..b160d35e0 100644
--- a/scripts/agents-index-contract.ps1
+++ b/scripts/agents-index-contract.ps1
@@ -28,6 +28,13 @@ function Assert-Contains([string]$text, [string]$needle, [string]$scope) {
     }
 }
 
+function Assert-NotContains([string]$text, [string]$needle, [string]$scope) {
+    $script:checked++
+    if ($text.Contains($needle)) {
+        Add-Failure "$scope 仍残留: $needle"
+    }
+}
+
 function Assert-Matches([string]$text, [string]$pattern, [string]$scope) {
     $script:checked++
     if ($text -notmatch $pattern) {
@@ -77,6 +84,13 @@ $clientAgents = Read-RequiredText $clientAgentsPath
 $pdaAgents = Read-RequiredText $pdaAgentsPath
 $overseasPdaAgents = Read-RequiredText $overseasPdaAgentsPath
 $backendAgents = Read-RequiredText $backendAgentsPath
+$engineeringConstraints = Read-RequiredText (Join-Path $workspaceRoot 'docs/AI工程执行与协作约束.md')
+
+# 当前未上线阶段的无兼容原则必须覆盖全部实现与运行状态，不能再次缩窄为文件或数据库专项规则。
+Assert-Contains $rootAgents '源码结构、接口与 DTO、字段、状态机、权限、配置键、数据库结构与初始化 SQL、事件、路由、页面、Mock/Fixture、测试和脚本' '根无兼容收敛范围'
+Assert-Contains $rootAgents '数据库记录、上传文件、缓存、会话、消息、搜索索引和其他运行状态均视为可丢弃' '根开发运行状态范围'
+Assert-Contains $engineeringConstraints '禁止为旧代码、旧调用或开发环境存量保留旧接口/旧字段别名' '工程无兼容执行规则'
+Assert-Contains $engineeringConstraints '不授权自动重置数据库、删除数据/文件、执行 SQL、部署或修改环境' '无兼容安全边界'
 
 # 部署单元必须能从根索引进入。
 Get-ChildItem -LiteralPath (Join-Path $workspaceRoot 'apps') -Directory |
@@ -156,6 +170,57 @@ foreach ($gatewayPath in @(
 Assert-Contains $overseasGatewayConfig 'uri: lb://lastleg-service' 'Overseas Gateway Lastleg 路由'
 Assert-Contains $overseasGatewayConfig 'uri: lb://warehouse-overseas-service' 'Overseas Gateway Warehouse 路由'
 
+# 海外安全投影已并入 Lastleg，Gateway 校验和 Event Bridge 消费均指向同一海外服务。
+$serviceMap = Read-RequiredText (Join-Path $backendRoot 'deploy/service-map.yml')
+$overseasCompose = Read-RequiredText (Join-Path $backendRoot 'deploy/docker-compose.overseas.yml')
+$serviceJenkinsfile = Read-RequiredText (Join-Path $backendRoot 'Jenkinsfile.service')
+Assert-Contains $serviceMap 'lastleg-service:' 'Lastleg 服务部署映射'
+Assert-Contains $overseasCompose '/internal/lastleg/security/v1/events' 'Lastleg 安全事件消费地址'
+Assert-Contains $overseasCompose 'LASTLEG_SECURITY_SERVICE_URL' 'Lastleg 安全校验地址'
+Assert-NotContains $serviceJenkinsfile "'overseas-security-service'" '独立海外安全服务构建入口'
+
+# 高变化语义必须在最近指引与服务契约中保持一致。
+Assert-Contains $adminAgents '海外出库（范围外现存代码）' 'Admin 四期范围边界'
+Assert-Contains $pdaAgents 'VITE_H5_API_BASE_URL' '国内 PDA H5 运行配置'
+Assert-Contains $overseasPdaAgents 'tests/app-icons.test.mjs' '海外 PDA 图标合同'
+Assert-Contains $backendAgents 'RestClientTraceInterceptor.java' '后端同步 Trace 入口'
+$oceanBookingOpenApi = Read-RequiredText (Join-Path $backendRoot 'firstleg/src/main/resources/openapi/ocean-bookings-v1.yaml')
+Assert-Contains $oceanBookingOpenApi 'never represents linked or ACTIVE containers' '订舱柜量语义'
+Assert-Contains $oceanBookingOpenApi '/api/platform/v1/ocean-bookings/link-candidates:' '订舱关联候选契约'
+Assert-Contains $oceanBookingOpenApi 'exact warehouseId, channelCode and containerType' '订舱关联候选筛选语义'
+
+$adminOceanBookingApi = Read-RequiredText (Join-Path $workspaceRoot 'apps/admin-web/src/modules/ocean-bookings/api/platformOceanBookings.ts')
+$adminOceanBookingView = Read-RequiredText (Join-Path $workspaceRoot 'apps/admin-web/src/modules/ocean-bookings/pages/OceanBookingsView.vue')
+$adminOceanBookingViewTest = Read-RequiredText (Join-Path $workspaceRoot 'apps/admin-web/src/modules/ocean-bookings/pages/OceanBookingsView.test.ts')
+Assert-Contains $adminOceanBookingApi '/link-candidates' 'Admin 订舱关联候选调用'
+Assert-Contains $adminOceanBookingView "label: '订舱柜量'" 'Admin 订舱柜量文案'
+Assert-Contains $adminOceanBookingViewTest 'without detail N+1' 'Admin 订舱列表无详情扇出合同'
+
+# 已注册但超出当前四期边界的海外出库只能作为范围漂移事实存在，不得进入根正式业务路由。
+$adminOverseasRoutes = Read-RequiredText (Join-Path $workspaceRoot 'apps/admin-web/src/modules/overseas-warehouse/routes.ts')
+Assert-Contains $adminOverseasRoutes "path: 'overseas-warehouse/outbounds'" 'Admin 海外出库现存路由'
+Assert-Contains $adminAgents '海外出库（范围外现存代码）' 'Admin 海外出库范围警示'
+Assert-NotContains $rootAgents 'OutboundsView.vue' '根正式四期业务路由'
+
+# Admin 仅对静态资源过期做一次受控恢复，不能吞掉普通路由错误或覆盖未保存编辑。
+$navigationRecovery = Read-RequiredText (Join-Path $workspaceRoot 'apps/admin-web/src/core/routing/navigationRecovery.ts')
+Assert-Contains $navigationRecovery 'const RECOVERY_WINDOW_MS = 30_000' 'Admin 路由恢复窗口'
+Assert-Contains $navigationRecovery 'if (dependencies.hasUnsavedWork() && !await dependencies.confirmDiscard()) return true' 'Admin 未保存编辑保护'
+Assert-Contains $navigationRecovery 'if (!isStaleRouteAssetError(error))' 'Admin 普通路由错误边界'
+
+# 国内 PDA 的 H5 地址必须来自当前构建和同源代理，不能被历史登录缓存覆盖。
+$domesticPdaRuntime = Read-RequiredText (Join-Path $workspaceRoot 'apps/pda-uniapp/config/runtime.js')
+$domesticPdaVite = Read-RequiredText (Join-Path $workspaceRoot 'apps/pda-uniapp/vite.config.js')
+$domesticPdaSession = Read-RequiredText (Join-Path $workspaceRoot 'apps/pda-uniapp/stores/session.js')
+Assert-Contains $domesticPdaRuntime "VITE_H5_API_BASE_URL || '/api'" '国内 PDA H5 同源 API'
+Assert-Contains $domesticPdaVite 'API_PROXY_TARGET' '国内 PDA H5 代理上游'
+Assert-Contains $domesticPdaSession 'session.apiBase = PLATFORM_API_ROOT' '国内 PDA 当前构建 API'
+Assert-NotContains $domesticPdaSession 'apiBase: session.apiBase' '国内 PDA 会话持久化'
+
+# 同步 RestClient Trace 必须注册为公共自动配置，不能只有孤立拦截器源码。
+$commonWebAutoConfigurations = Read-RequiredText (Join-Path $backendRoot 'common-web/src/main/resources/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports')
+Assert-Contains $commonWebAutoConfigurations 'com.baiyue.common.web.RestClientTracePropagationAutoConfiguration' 'RestClient Trace 自动配置注册'
+
 # Maven 聚合声明的全部历史/当前模块必须在后端根指引中可定位。
 [xml]$pom = Get-Content -LiteralPath (Join-Path $backendRoot 'pom.xml') -Raw
 foreach ($module in $pom.project.modules.module) {
@@ -173,7 +238,17 @@ $criticalPaths = @(
     'apps/admin-web/src/modules/overseas-warehouse/pages/DispatchDetailView.vue',
     'apps/admin-web/src/modules/overseas-warehouse/components/SmartDispatchDialog.vue',
     'apps/admin-web/src/modules/container-loading/pages/SmartLoadingWorkbenchView.vue',
+    'apps/admin-web/src/modules/container-loading/pages/ContainerDetailView.vue',
+    'apps/admin-web/src/modules/container-loading/components/ContainerOverviewPanel.vue',
     'apps/admin-web/src/modules/container-loading/api/platformContainerLoading.ts',
+    'apps/admin-web/src/modules/ocean-bookings/api/platformOceanBookings.ts',
+    'apps/admin-web/src/modules/ocean-bookings/pages/OceanBookingsView.vue',
+    'apps/admin-web/src/core/routing/navigationRecovery.ts',
+    'apps/admin-web/src/core/routing/navigationRecovery.test.ts',
+    'apps/admin-web/src/modules/overseas-warehouse/api/outbounds.ts',
+    'apps/admin-web/src/modules/overseas-warehouse/pages/OutboundsView.vue',
+    'apps/admin-web/src/modules/iam/pages/InternalUsersView.vue',
+    'apps/admin-web/src/modules/iam/api/platformIam.ts',
     'apps/client-web/src/api/overseasHttp.ts',
     'apps/client-web/src/modules/overseas-warehouse/routes.ts',
     'apps/client-web/src/modules/overseas-warehouse/api/warehouseServices.ts',
@@ -181,6 +256,9 @@ $criticalPaths = @(
     'apps/admin-web/src/modules/overseas-business/api/platformOverseasBusiness.ts',
     'apps/admin-web/src/modules/overseas-master-data/api/overseasMasterData.ts',
     'apps/pda-uniapp/pages/tasks/tasks.vue',
+    'apps/pda-uniapp/config/runtime.js',
+    'apps/pda-uniapp/.env.example',
+    'apps/pda-uniapp/vite.config.js',
     'apps/pda-uniapp/utils/evidence-upload-queue.js',
     'apps/pda-overseas-uniapp/package.json',
     'apps/pda-overseas-uniapp/src/pages.json',
@@ -192,6 +270,8 @@ $criticalPaths = @(
     'apps/pda-overseas-uniapp/src/api/receiving-adapter.js',
     'apps/pda-overseas-uniapp/src/api/overseas.js',
     'apps/pda-overseas-uniapp/src/utils/scan-broadcast.js',
+    'apps/pda-overseas-uniapp/src/manifest.json',
+    'apps/pda-overseas-uniapp/tests/app-icons.test.mjs',
     'baiyue-firstleg/firstleg/src/main/java/com/baiyue/firstleg/service/FeePaymentSnapshotValidator.java',
     'baiyue-firstleg/firstleg/src/main/java/com/baiyue/firstleg/client/FeePaymentVoucherFileClient.java',
     'baiyue-firstleg/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/mapper/InboundPlanQueryMapper.java',
@@ -203,10 +283,39 @@ $criticalPaths = @(
     'baiyue-firstleg/lastleg-service/src/main/java/com/baiyue/lastleg/dispatch/mapper/DispatchDraftContainerMapper.java',
     'baiyue-firstleg/firstleg/src/main/java/com/baiyue/firstleg/controller/PlatformSmartLoadingController.java',
     'baiyue-firstleg/firstleg/src/main/java/com/baiyue/firstleg/service/SmartLoadingService.java',
+    'baiyue-firstleg/firstleg/src/main/java/com/baiyue/firstleg/oceanbooking/controller/PlatformOceanBookingController.java',
+    'baiyue-firstleg/firstleg/src/main/java/com/baiyue/firstleg/oceanbooking/mapper/OceanBookingMapper.java',
+    'baiyue-firstleg/firstleg/src/main/resources/openapi/ocean-bookings-v1.yaml',
+    'baiyue-firstleg/firstleg/src/main/java/com/baiyue/firstleg/pricebookquery/application/port/in/PriceBookQueryUseCase.java',
+    'baiyue-firstleg/firstleg/src/main/java/com/baiyue/firstleg/pricebookquery/application/PriceBookQueryService.java',
+    'baiyue-firstleg/firstleg/src/main/java/com/baiyue/firstleg/pricebookquery/application/port/out/PriceBookQueryReader.java',
+    'baiyue-firstleg/firstleg/src/main/java/com/baiyue/firstleg/pricebookquery/adapter/out/persistence/PriceBookQueryMapper.java',
+    'baiyue-firstleg/firstleg/docs/firstleg-internal-modularization-baseline.md',
+    'baiyue-firstleg/firstleg/scripts/analyze-firstleg-dependencies.mjs',
+    'baiyue-firstleg/firstleg/scripts/analyze-firstleg-dependencies.test.mjs',
+    'baiyue-firstleg/firstleg/src/test/resources/architecture/firstleg-slice-dependencies.json',
     'baiyue-firstleg/auth/src/main/java/com/baiyue/auth/service/OverseasTokenService.java',
     'baiyue-firstleg/auth/src/main/java/com/baiyue/auth/service/OverseasSessionValidationService.java',
+    'baiyue-firstleg/iam/src/main/java/com/baiyue/iam/service/PlatformUserManagementService.java',
+    'baiyue-firstleg/iam/src/main/java/com/baiyue/iam/service/SecurityEventOutboxService.java',
+    'baiyue-firstleg/iam/src/main/java/com/baiyue/iam/service/SecurityEventOutboxRelay.java',
+    'baiyue-firstleg/iam/src/main/java/com/baiyue/iam/entity/IamMembership.java',
+    'baiyue-firstleg/iam/src/main/java/com/baiyue/iam/service/CustomerDimensionRuleInitializationService.java',
+    'baiyue-firstleg/iam/src/main/java/com/baiyue/iam/service/CustomerDimensionInitializationRelay.java',
+    'baiyue-firstleg/iam/src/main/java/com/baiyue/iam/repository/CustomerDimensionInitializationRepository.java',
+    'baiyue-firstleg/iam/src/main/java/com/baiyue/iam/client/CustomerDimensionRuleClient.java',
+    'baiyue-firstleg/iam/src/main/resources/db/customer-dimension-initialization-task.sql',
+    'baiyue-firstleg/common-security/src/main/java/com/baiyue/common/security/AuthenticatedUser.java',
+    'baiyue-firstleg/common-security/src/main/java/com/baiyue/common/security/JwtClaimsMapper.java',
+    'baiyue-firstleg/common-openapi/src/test/java/com/baiyue/common/openapi/PdaOpenApiGroupContractTest.java',
+    'baiyue-firstleg/common-web/src/main/java/com/baiyue/common/web/RestClientTraceInterceptor.java',
+    'baiyue-firstleg/common-web/src/main/java/com/baiyue/common/web/RestClientTracePropagationAutoConfiguration.java',
+    'baiyue-firstleg/common-web/src/test/java/com/baiyue/common/web/RestClientTraceInterceptorTest.java',
     'baiyue-firstleg/gateway-overseas/src/main/java/com/baiyue/gateway/filter/PdaSessionValidationFilter.java',
     'baiyue-firstleg/gateway-overseas/src/main/java/com/baiyue/gateway/filter/HttpPdaSessionValidationClient.java',
+    'baiyue-firstleg/lastleg-service/src/main/java/com/baiyue/lastleg/security/controller/LastlegSecurityController.java',
+    'baiyue-firstleg/lastleg-service/src/main/java/com/baiyue/lastleg/security/service/LastlegSecurityProjectionService.java',
+    'baiyue-firstleg/lastleg-service/src/main/java/com/baiyue/lastleg/security/service/LastlegSecurityValidationService.java',
     'baiyue-firstleg/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/pda/controller/ReceivingContainerController.java',
     'baiyue-firstleg/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/pda/service/ReceivingContainerService.java',
     'baiyue-firstleg/lastleg-service/src/main/java/com/baiyue/lastleg/pda/stocktake/controller/PdaStocktakeController.java',
@@ -220,6 +329,18 @@ $criticalPaths = @(
     'baiyue-firstleg/lastleg-service/src/main/java/com/baiyue/lastleg/pda/warehouse/controller/PdaWarehouseController.java',
     'baiyue-firstleg/lastleg-service/src/main/java/com/baiyue/lastleg/pda/warehouse/service/PdaWarehouseService.java',
     'baiyue-firstleg/lastleg-service/src/main/resources/openapi/overseas-pda-operations-v1.yaml',
+    'baiyue-firstleg/warehouse-overseas-service/src/main/java/com/baiyue/warehouse/controller/InternalPdaPalletTransitionController.java',
+    'baiyue-firstleg/warehouse-overseas-service/src/main/java/com/baiyue/warehouse/service/WarehousePalletTransitionService.java',
+    'baiyue-firstleg/warehouse-overseas-service/src/main/java/com/baiyue/warehouse/entity/WarehousePalletOperationEntity.java',
+    'baiyue-firstleg/lastleg-service/docs/lastleg-internal-modularization-baseline.md',
+    'baiyue-firstleg/lastleg-service/scripts/analyze-lastleg-dependencies.mjs',
+    'baiyue-firstleg/lastleg-service/scripts/analyze-lastleg-dependencies.test.mjs',
+    'baiyue-firstleg/lastleg-service/src/test/resources/architecture/lastleg-slice-dependencies.json',
+    'baiyue-firstleg/lastleg-service/src/main/java/com/baiyue/lastleg/masterdata/vehicle/adapter/in/web/PlatformVehicleController.java',
+    'baiyue-firstleg/lastleg-service/src/main/java/com/baiyue/lastleg/masterdata/vehicle/application/VehicleApplicationService.java',
+    'baiyue-firstleg/lastleg-service/src/main/java/com/baiyue/lastleg/masterdata/vehicle/application/port/out/VehicleRepository.java',
+    'baiyue-firstleg/lastleg-service/src/main/java/com/baiyue/lastleg/masterdata/vehicle/adapter/out/persistence/VehiclePersistenceAdapter.java',
+    'baiyue-firstleg/lastleg-service/src/main/java/com/baiyue/lastleg/config/LastlegRestClientFactory.java',
     'baiyue-firstleg/lastleg-service/src/main/java/com/baiyue/lastleg/controller/MerchantLastlegOrderController.java',
     'baiyue-firstleg/lastleg-service/src/main/java/com/baiyue/lastleg/model/LastlegOrderType.java',
     'baiyue-firstleg/lastleg-service/src/main/java/com/baiyue/lastleg/model/LastlegOrderStatus.java',
@@ -240,6 +361,8 @@ $criticalPaths = @(
     'baiyue-firstleg/lastleg-service/src/test/java/com/baiyue/lastleg/service/TaillegRealConsumerAcceptanceTest.java',
     'baiyue-firstleg/deploy/scripts/deploy-built-service.sh',
     'baiyue-firstleg/scripts/deploy-built-service-rollback.test.mjs',
+    'baiyue-firstleg/scripts/java-quality-summary.mjs',
+    'baiyue-firstleg/scripts/java-quality-summary.test.mjs',
     'docs/四期/船节点标准化契约.md'
 )
 $criticalPaths | ForEach-Object { Assert-Path $_ }
@@ -255,13 +378,19 @@ $indexedAgentFiles = @(
     (Join-Path $backendRoot 'firstleg/AGENTS.md'),
     (Join-Path $backendRoot 'finance/AGENTS.md'),
     (Join-Path $backendRoot 'lastleg-service/AGENTS.md'),
+    (Join-Path $backendRoot 'iam/AGENTS.md'),
+    (Join-Path $backendRoot 'common-security/AGENTS.md'),
+    (Join-Path $backendRoot 'common-web/AGENTS.md'),
+    (Join-Path $backendRoot 'common-openapi/AGENTS.md'),
+    (Join-Path $backendRoot 'warehouse-overseas-service/AGENTS.md'),
     (Join-Path $backendRoot 'event-bridge-service/AGENTS.md'),
     (Join-Path $backendRoot 'file/AGENTS.md'),
     (Join-Path $backendRoot 'common-event-contract/AGENTS.md')
 )
-$excludedTargetPattern = '(?i)`(?:[^`]*/)?(node_modules|node_modules\.broken-by-path|dist|target|reports|output|outputs|uni_modules|\.git|\.codex[^/`]*|\.runtime[^/`]*)(?:/|`)'
+$excludedTargetPattern = '(?i)`(?:[^`]*/)?(node_modules(?:\.[^/`]*)?|dist|target|reports|output|outputs|uni_modules|\.git|\.codex[^/`]*|\.runtime[^/`]*)(?:/|`)'
 $excludedPatternSamples = @(
     '| 错误入口 | `node_modules/pkg/` |',
+    '| 错误入口 | `node_modules.corrupt/.bin/vite` |',
     '| 错误入口 | `src/target/classes/` |',
     '| 错误入口 | `.codex-temp/task/` |',
     '| 错误入口 | `.runtime-tailleg/DbQuery.java` |'
@@ -293,5 +422,5 @@ if ($failures.Count -gt 0) {
     exit 1
 }
 
-Write-Host "AGENTS 索引合同通过：$checked 项检查，覆盖快速表唯一性、部署单元、前端模块、Client active 路由、Gateway 覆盖、PDA 注册页面与能力开关、Maven 模块、关键入口和排除目录。" -ForegroundColor Green
+Write-Host "AGENTS 索引合同通过：$checked 项检查，覆盖快速表唯一性、部署单元、前端模块、Client active 路由、四期范围漂移、订舱候选与柜量语义、Gateway 覆盖、PDA 页面/运行配置/能力开关、Maven 模块、Lastleg 海外安全投影、同步 Trace、关键入口和排除目录。" -ForegroundColor Green
 exit 0
diff --git a/scripts/client-phase2-test-env-acceptance.mjs b/scripts/client-phase2-test-env-acceptance.mjs
index b3981a78a..1815ee4d5 100644
--- a/scripts/client-phase2-test-env-acceptance.mjs
+++ b/scripts/client-phase2-test-env-acceptance.mjs
@@ -19,7 +19,7 @@ const args = parseArgs(process.argv.slice(2))
 const gateway = trimSlash(args.gateway ?? process.env.CLIENT_PHASE2_TEST_GATEWAY
   ?? 'http://8.163.30.128:9000')
 const clientUsername = args['client-username'] ?? process.env.CLIENT_PHASE2_USERNAME
-  ?? await promptText('二期客户端账号', 'merchant_admin')
+  ?? await promptText('二期客户端账号（必须由正式注册/建档产生）', '')
 const clientPassword = args['client-password'] ?? process.env.CLIENT_PHASE2_PASSWORD
   ?? await promptSecret('二期客户端密码')
 const platformUsername = args['platform-username'] ?? process.env.PLATFORM_USERNAME
@@ -30,8 +30,8 @@ const forcedOrderId = args['order-id'] ?? process.env.CLIENT_PHASE2_ORDER_ID ??
 const reportDir = resolve(args['report-dir'] ?? process.env.CLIENT_PHASE2_REPORT_DIR ?? 'reports')
 const timeoutMs = Number(args['timeout-ms'] ?? process.env.CLIENT_PHASE2_TIMEOUT_MS ?? 30_000)
 
-if (!clientPassword || !platformPassword) {
-  console.error('Client and platform passwords are required')
+if (!clientUsername || !clientPassword || !platformPassword) {
+  console.error('An onboarded Client account and platform credentials are required')
   process.exit(2)
 }
 if (!Number.isFinite(timeoutMs) || timeoutMs < 1_000) {
diff --git a/scripts/client-test-env-acceptance.mjs b/scripts/client-test-env-acceptance.mjs
index 034057e97..b7afa8553 100644
--- a/scripts/client-test-env-acceptance.mjs
+++ b/scripts/client-test-env-acceptance.mjs
@@ -24,14 +24,14 @@ const platformUsername = args['platform-username'] ?? process.env.PLATFORM_USERN
 const platformPassword = args['platform-password'] ?? process.env.PLATFORM_PASSWORD
   ?? await promptSecret('平台审核密码')
 const existingClientUsername = args['existing-client-username'] ?? process.env.EXISTING_CLIENT_USERNAME
-  ?? await promptText('跨客户隔离测试账号', 'merchant_admin')
+  ?? await promptText('跨客户隔离测试账号（必须由正式注册/建档产生）', '')
 const existingClientPassword = args['existing-client-password'] ?? process.env.EXISTING_CLIENT_PASSWORD
   ?? await promptSecret('跨客户隔离测试密码')
 const reportDir = resolve(args['report-dir'] ?? process.env.CLIENT_TEST_REPORT_DIR ?? 'reports')
 const timeoutMs = Number(args['timeout-ms'] ?? process.env.CLIENT_TEST_TIMEOUT_MS ?? 30_000)
 
-if (!platformPassword) {
-  console.error('Platform password is required')
+if (!platformPassword || !existingClientUsername || !existingClientPassword) {
+  console.error('Platform password and an independently onboarded client account are required')
   process.exit(2)
 }
 if (!Number.isFinite(timeoutMs) || timeoutMs < 1_000) {
diff --git a/scripts/java-quality-baseline.json b/scripts/java-quality-baseline.json
new file mode 100644
index 000000000..1ed545842
--- /dev/null
+++ b/scripts/java-quality-baseline.json
@@ -0,0 +1,59 @@
+{
+  "schemaVersion": 1,
+  "mode": "report-only",
+  "tools": {
+    "jacocoMavenPlugin": "0.8.12",
+    "spotbugsMavenPlugin": "4.9.8.5"
+  },
+  "topology": {
+    "modules": 22,
+    "codeModules": 21,
+    "services": 15
+  },
+  "openapi": {
+    "documents": 26,
+    "coveredServices": 7,
+    "codeFirstServices": 8
+  },
+  "reports": {
+    "jacocoPresent": 21,
+    "spotbugsPresent": 21,
+    "spotbugsFindings": 780,
+    "spotbugsByPriority": {
+      "1": 1,
+      "2": 779
+    },
+    "spotbugsByCategory": {
+      "BAD_PRACTICE": 10,
+      "CORRECTNESS": 3,
+      "EXPERIMENTAL": 4,
+      "MALICIOUS_CODE": 699,
+      "MT_CORRECTNESS": 2,
+      "PERFORMANCE": 18,
+      "STYLE": 44
+    }
+  },
+  "modules": [
+    { "module": "common-core", "jacocoCovered": 32, "jacocoTotal": 78, "jacocoPercentage": 41.03, "spotbugsFindings": 6 },
+    { "module": "common-web", "jacocoCovered": 164, "jacocoTotal": 188, "jacocoPercentage": 87.23, "spotbugsFindings": 1 },
+    { "module": "common-security", "jacocoCovered": 109, "jacocoTotal": 202, "jacocoPercentage": 53.96, "spotbugsFindings": 6 },
+    { "module": "common-openapi", "jacocoCovered": 17, "jacocoTotal": 37, "jacocoPercentage": 45.95, "spotbugsFindings": 0 },
+    { "module": "common-audit", "jacocoCovered": 168, "jacocoTotal": 244, "jacocoPercentage": 68.85, "spotbugsFindings": 8 },
+    { "module": "common-event-contract", "jacocoCovered": 146, "jacocoTotal": 164, "jacocoPercentage": 89.02, "spotbugsFindings": 18 },
+    { "module": "gateway", "jacocoCovered": 110, "jacocoTotal": 156, "jacocoPercentage": 70.51, "spotbugsFindings": 4 },
+    { "module": "gateway-overseas", "jacocoCovered": 134, "jacocoTotal": 272, "jacocoPercentage": 49.26, "spotbugsFindings": 2 },
+    { "module": "auth", "jacocoCovered": 372, "jacocoTotal": 619, "jacocoPercentage": 60.10, "spotbugsFindings": 5 },
+    { "module": "iam", "jacocoCovered": 1872, "jacocoTotal": 3032, "jacocoPercentage": 61.74, "spotbugsFindings": 60 },
+    { "module": "order", "jacocoCovered": 1116, "jacocoTotal": 1605, "jacocoPercentage": 69.53, "spotbugsFindings": 47 },
+    { "module": "firstleg", "jacocoCovered": 7891, "jacocoTotal": 11592, "jacocoPercentage": 68.07, "spotbugsFindings": 223 },
+    { "module": "warehouse", "jacocoCovered": 1767, "jacocoTotal": 2922, "jacocoPercentage": 60.47, "spotbugsFindings": 64 },
+    { "module": "warehouse-overseas-service", "jacocoCovered": 403, "jacocoTotal": 778, "jacocoPercentage": 51.80, "spotbugsFindings": 8 },
+    { "module": "lastleg-service", "jacocoCovered": 5088, "jacocoTotal": 7832, "jacocoPercentage": 64.96, "spotbugsFindings": 162 },
+    { "module": "file", "jacocoCovered": 1046, "jacocoTotal": 1614, "jacocoPercentage": 64.81, "spotbugsFindings": 33 },
+    { "module": "print", "jacocoCovered": 596, "jacocoTotal": 695, "jacocoPercentage": 85.76, "spotbugsFindings": 12 },
+    { "module": "audit-service", "jacocoCovered": 76, "jacocoTotal": 153, "jacocoPercentage": 49.67, "spotbugsFindings": 0 },
+    { "module": "finance", "jacocoCovered": 1665, "jacocoTotal": 2236, "jacocoPercentage": 74.46, "spotbugsFindings": 97 },
+    { "module": "integration-service", "jacocoCovered": 1040, "jacocoTotal": 1420, "jacocoPercentage": 73.24, "spotbugsFindings": 23 },
+    { "module": "event-bridge-service", "jacocoCovered": 318, "jacocoTotal": 419, "jacocoPercentage": 75.89, "spotbugsFindings": 1 }
+  ]
+}
diff --git a/scripts/java-quality-summary.mjs b/scripts/java-quality-summary.mjs
new file mode 100644
index 000000000..23c84d407
--- /dev/null
+++ b/scripts/java-quality-summary.mjs
@@ -0,0 +1,175 @@
+import { mkdir, readFile, readdir, stat, writeFile } from 'node:fs/promises'
+import path from 'node:path'
+import { fileURLToPath, pathToFileURL } from 'node:url'
+
+export const repositoryRoot = path.resolve(fileURLToPath(new URL('..', import.meta.url)))
+
+const normalize = (value) => value.replaceAll('\\', '/')
+const attribute = (source, name) => source.match(new RegExp(`\\b${name}=(?:"([^"]*)"|'([^']*)')`))?.slice(1).find((value) => value !== undefined)
+
+async function exists(file) {
+  try {
+    await stat(file)
+    return true
+  } catch (error) {
+    if (error?.code === 'ENOENT') return false
+    throw error
+  }
+}
+
+async function javaSourceCount(moduleDirectory) {
+  const root = path.join(moduleDirectory, 'src', 'main', 'java')
+  if (!await exists(root)) return 0
+  let count = 0
+  async function walk(directory) {
+    for (const entry of await readdir(directory, { withFileTypes: true })) {
+      const target = path.join(directory, entry.name)
+      if (entry.isDirectory()) await walk(target)
+      else if (entry.isFile() && entry.name.endsWith('.java')) count += 1
+    }
+  }
+  await walk(root)
+  return count
+}
+
+async function openApiFiles(moduleDirectory, module) {
+  const root = path.join(moduleDirectory, 'src', 'main', 'resources', 'openapi')
+  if (!await exists(root)) return []
+  const files = []
+  async function walk(directory) {
+    for (const entry of await readdir(directory, { withFileTypes: true })) {
+      const target = path.join(directory, entry.name)
+      if (entry.isDirectory()) await walk(target)
+      else if (entry.isFile() && /\.(?:json|ya?ml)$/i.test(entry.name)) {
+        files.push(normalize(path.join(module, path.relative(moduleDirectory, target))))
+      }
+    }
+  }
+  await walk(root)
+  return files.sort()
+}
+
+export function parseModules(pom) {
+  const block = pom.match(/<modules>([\s\S]*?)<\/modules>/)?.[1] ?? ''
+  return [...block.matchAll(/<module>([^<]+)<\/module>/g)].map((match) => match[1].trim())
+}
+
+export function parseServices(serviceMap) {
+  return [...serviceMap.matchAll(/^  ([a-z][a-z0-9-]+):$/gm)].map((match) => match[1]).sort()
+}
+
+export function parseJacocoReport(xml) {
+  if (!/<report\b/.test(xml) || !/<\/report>/.test(xml)) throw new Error('not a JaCoCo report')
+  const counters = [...xml.matchAll(/<counter\b([^>]*)\/?\s*>/g)]
+    .map((match) => match[1])
+    .filter((source) => attribute(source, 'type') === 'LINE')
+  if (counters.length === 0) throw new Error('JaCoCo LINE counter is missing')
+  const summary = counters.at(-1)
+  const missed = Number(attribute(summary, 'missed'))
+  const covered = Number(attribute(summary, 'covered'))
+  if (!Number.isInteger(missed) || !Number.isInteger(covered)) throw new Error('invalid JaCoCo LINE counter')
+  const total = missed + covered
+  return { missed, covered, percentage: total === 0 ? null : Number((covered * 100 / total).toFixed(2)) }
+}
+
+export function parseSpotbugsReport(xml) {
+  if (!/<BugCollection\b/.test(xml) || !/<\/BugCollection>/.test(xml)) throw new Error('not a SpotBugs report')
+  const findings = [...xml.matchAll(/<BugInstance\b([^>]*)>/g)].map((match) => match[1])
+  const byPriority = {}
+  const byCategory = {}
+  for (const finding of findings) {
+    const priority = attribute(finding, 'priority') ?? 'unknown'
+    const category = attribute(finding, 'category') ?? 'unknown'
+    byPriority[priority] = (byPriority[priority] ?? 0) + 1
+    byCategory[category] = (byCategory[category] ?? 0) + 1
+  }
+  return { findings: findings.length, byPriority, byCategory }
+}
+
+async function reportState(file, parser, root) {
+  const relative = normalize(path.relative(root, file))
+  if (!await exists(file)) return { status: 'missing', path: relative }
+  try {
+    return { status: 'valid', path: relative, ...parser(await readFile(file, 'utf8')) }
+  } catch (error) {
+    return { status: 'invalid', path: relative, error: error instanceof Error ? error.message : String(error) }
+  }
+}
+
+export async function buildQualitySummary(root = repositoryRoot) {
+  const modules = parseModules(await readFile(path.join(root, 'pom.xml'), 'utf8'))
+  const services = parseServices((await readFile(path.join(root, 'deploy', 'service-map.yml'), 'utf8')).replaceAll('\r\n', '\n'))
+  const moduleRows = []
+  const documents = []
+  for (const module of modules) {
+    const moduleDirectory = path.join(root, module)
+    const sources = await javaSourceCount(moduleDirectory)
+    documents.push(...await openApiFiles(moduleDirectory, module))
+    if (sources === 0) continue
+    const jacoco = await reportState(path.join(moduleDirectory, 'target', 'site', 'jacoco', 'jacoco.xml'), parseJacocoReport, root)
+    const spotbugs = await reportState(path.join(moduleDirectory, 'target', 'spotbugsXml.xml'), parseSpotbugsReport, root)
+    spotbugs.html = await exists(path.join(moduleDirectory, 'target', 'site', 'spotbugs.html'))
+    moduleRows.push({ module, javaSources: sources, jacoco, spotbugs })
+  }
+  const coveredServices = [...new Set(documents.map((file) => file.split('/')[0]))]
+    .filter((module) => services.includes(module)).sort()
+  const codeFirstServices = services.filter((service) => !coveredServices.includes(service))
+  const count = (kind, status) => moduleRows.filter((row) => row[kind].status === status).length
+  return {
+    topology: { modules: modules.length, codeModules: moduleRows.length, services: services.length },
+    openapi: { documents: documents.length, coveredServices, codeFirstServices, files: documents.sort() },
+    jacoco: {
+      present: count('jacoco', 'valid'), invalid: count('jacoco', 'invalid'), missing: count('jacoco', 'missing')
+    },
+    spotbugs: {
+      present: count('spotbugs', 'valid'), invalid: count('spotbugs', 'invalid'),
+      missing: count('spotbugs', 'missing'), findings: moduleRows.reduce((sum, row) => sum + (row.spotbugs.findings ?? 0), 0)
+    },
+    modules: moduleRows
+  }
+}
+
+export function requirementFailures(summary, options = {}) {
+  const failures = []
+  for (const row of summary.modules) {
+    if (row.jacoco.status === 'invalid') failures.push(`${row.module}: invalid JaCoCo report (${row.jacoco.error})`)
+    if (row.spotbugs.status === 'invalid') failures.push(`${row.module}: invalid SpotBugs report (${row.spotbugs.error})`)
+    if (row.spotbugs.status === 'valid' && !row.spotbugs.html) failures.push(`${row.module}: SpotBugs HTML report is missing`)
+    if (options.requireJacoco && row.jacoco.status === 'missing') failures.push(`${row.module}: JaCoCo report is missing`)
+    if (options.requireSpotbugs && row.spotbugs.status === 'missing') failures.push(`${row.module}: SpotBugs report is missing`)
+  }
+  return failures
+}
+
+function printSummary(summary) {
+  process.stdout.write(`Java quality summary: ${summary.topology.modules} modules, ${summary.topology.codeModules} code modules, ${summary.topology.services} services.\n`)
+  process.stdout.write(`OpenAPI: ${summary.openapi.documents} documents, ${summary.openapi.coveredServices.length}/${summary.topology.services} services; gaps: ${summary.openapi.codeFirstServices.join(', ')}.\n`)
+  process.stdout.write(`JaCoCo: ${summary.jacoco.present} valid, ${summary.jacoco.missing} missing, ${summary.jacoco.invalid} invalid.\n`)
+  process.stdout.write(`SpotBugs: ${summary.spotbugs.present} valid, ${summary.spotbugs.missing} missing, ${summary.spotbugs.invalid} invalid, ${summary.spotbugs.findings} findings.\n`)
+}
+
+async function main() {
+  const args = process.argv.slice(2)
+  const rootIndex = args.indexOf('--root')
+  const outputIndex = args.indexOf('--output')
+  const root = rootIndex >= 0 ? path.resolve(args[rootIndex + 1]) : repositoryRoot
+  const summary = await buildQualitySummary(root)
+  printSummary(summary)
+  if (outputIndex >= 0) {
+    const output = path.resolve(args[outputIndex + 1])
+    await mkdir(path.dirname(output), { recursive: true })
+    await writeFile(output, `${JSON.stringify(summary, null, 2)}\n`, 'utf8')
+  }
+  const failures = requirementFailures(summary, {
+    requireJacoco: args.includes('--require-jacoco'),
+    requireSpotbugs: args.includes('--require-spotbugs')
+  })
+  if (failures.length > 0) throw new Error(`Quality report contract failed:\n${failures.map((failure) => `- ${failure}`).join('\n')}`)
+}
+
+if (import.meta.url === pathToFileURL(process.argv[1]).href) {
+  main().catch((error) => {
+    process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`)
+    process.exitCode = 1
+  })
+}
diff --git a/scripts/java-quality-summary.test.mjs b/scripts/java-quality-summary.test.mjs
new file mode 100644
index 000000000..989dcfe43
--- /dev/null
+++ b/scripts/java-quality-summary.test.mjs
@@ -0,0 +1,87 @@
+import assert from 'node:assert/strict'
+import { mkdir, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import path from 'node:path'
+import test from 'node:test'
+
+import {
+  buildQualitySummary,
+  parseJacocoReport,
+  parseSpotbugsReport,
+  requirementFailures,
+  repositoryRoot
+} from './java-quality-summary.mjs'
+
+test('parses JaCoCo line coverage and SpotBugs findings without quality thresholds', () => {
+  assert.deepEqual(parseJacocoReport('<report><counter type="LINE" missed="3" covered="7"/></report>'), {
+    missed: 3, covered: 7, percentage: 70
+  })
+  assert.deepEqual(parseSpotbugsReport('<BugCollection><BugInstance priority="1" category="CORRECTNESS"/><BugInstance priority="2" category="STYLE"/></BugCollection>'), {
+    findings: 2,
+    byPriority: { 1: 1, 2: 1 },
+    byCategory: { CORRECTNESS: 1, STYLE: 1 }
+  })
+  assert.deepEqual(parseSpotbugsReport("<BugCollection><BugInstance priority='2' category='MALICIOUS_CODE'/></BugCollection>"), {
+    findings: 1,
+    byPriority: { 2: 1 },
+    byCategory: { MALICIOUS_CODE: 1 }
+  })
+  assert.throws(() => parseJacocoReport('<report/>'), /not a JaCoCo report/)
+  assert.throws(() => parseSpotbugsReport('<BugCollection/>'), /not a SpotBugs report/)
+})
+
+test('aggregates code modules, report presence and the OpenAPI service matrix', async (t) => {
+  const root = await mkdtemp(path.join(tmpdir(), 'baiyue-quality-summary-'))
+  t.after(() => rm(root, { recursive: true, force: true }))
+  await writeFile(path.join(root, 'pom.xml'), '<modules><module>bom</module><module>alpha</module><module>beta</module></modules>', 'utf8')
+  await mkdir(path.join(root, 'deploy'), { recursive: true })
+  await writeFile(path.join(root, 'deploy', 'service-map.yml'), 'services:\n  alpha:\n    port: 1\n  beta:\n    port: 2\n', 'utf8')
+  await mkdir(path.join(root, 'alpha', 'src', 'main', 'java'), { recursive: true })
+  await mkdir(path.join(root, 'beta', 'src', 'main', 'java'), { recursive: true })
+  await writeFile(path.join(root, 'alpha', 'src', 'main', 'java', 'Alpha.java'), 'class Alpha {}', 'utf8')
+  await writeFile(path.join(root, 'beta', 'src', 'main', 'java', 'Beta.java'), 'class Beta {}', 'utf8')
+  await mkdir(path.join(root, 'alpha', 'src', 'main', 'resources', 'openapi'), { recursive: true })
+  await writeFile(path.join(root, 'alpha', 'src', 'main', 'resources', 'openapi', 'alpha.yaml'), 'openapi: 3.0.3\n', 'utf8')
+  await mkdir(path.join(root, 'alpha', 'target', 'site', 'jacoco'), { recursive: true })
+  await writeFile(path.join(root, 'alpha', 'target', 'site', 'jacoco', 'jacoco.xml'), '<report><counter type="LINE" missed="1" covered="9"/></report>', 'utf8')
+  await mkdir(path.join(root, 'alpha', 'target', 'site'), { recursive: true })
+  await writeFile(path.join(root, 'alpha', 'target', 'spotbugsXml.xml'), '<BugCollection><BugInstance priority="2" category="STYLE"/></BugCollection>', 'utf8')
+  await writeFile(path.join(root, 'alpha', 'target', 'site', 'spotbugs.html'), '<html></html>', 'utf8')
+
+  const summary = await buildQualitySummary(root)
+  assert.deepEqual(summary.topology, { modules: 3, codeModules: 2, services: 2 })
+  assert.equal(summary.openapi.documents, 1)
+  assert.deepEqual(summary.openapi.coveredServices, ['alpha'])
+  assert.deepEqual(summary.openapi.codeFirstServices, ['beta'])
+  assert.deepEqual(summary.jacoco, { present: 1, invalid: 0, missing: 1 })
+  assert.deepEqual(summary.spotbugs, { present: 1, invalid: 0, missing: 1, findings: 1 })
+  assert.deepEqual(requirementFailures(summary), [])
+  assert.deepEqual(requirementFailures(summary, { requireJacoco: true, requireSpotbugs: true }), [
+    'beta: JaCoCo report is missing', 'beta: SpotBugs report is missing'
+  ])
+})
+
+test('repository freezes the current topology and non-blocking aggregate summary wiring', async () => {
+  const summary = await buildQualitySummary(repositoryRoot)
+  const baseline = JSON.parse(await readFile(path.join(repositoryRoot, 'scripts', 'java-quality-baseline.json'), 'utf8'))
+  assert.deepEqual(summary.topology, { modules: 22, codeModules: 21, services: 15 })
+  assert.equal(summary.openapi.documents, 26)
+  assert.equal(summary.openapi.coveredServices.length, 7)
+  assert.equal(summary.openapi.codeFirstServices.length, 8)
+  assert.equal(baseline.mode, 'report-only')
+  assert.deepEqual(baseline.topology, summary.topology)
+  assert.equal(baseline.modules.length, 21)
+  assert.equal(baseline.modules.reduce((total, row) => total + row.spotbugsFindings, 0), baseline.reports.spotbugsFindings)
+
+  const gitlab = (await readFile(path.join(repositoryRoot, '.gitlab-ci.yml'), 'utf8')).replaceAll('\r\n', '\n')
+  const job = gitlab.match(/^质量摘要:\n([\s\S]*?)(?=^[^\s#].*:\n)/m)?.[1] ?? ''
+  const packageJob = gitlab.match(/^打包服务:\n([\s\S]*)/m)?.[1] ?? ''
+  assert.match(job, /^  allow_failure: true$/m)
+  assert.match(job, /java-quality-summary\.test\.mjs/)
+  assert.match(job, /java-quality-summary\.mjs --output target\/java-quality-summary\.json --require-jacoco --require-spotbugs/)
+  assert.match(job, /^    - job: 校验与测试$/m)
+  assert.match(job, /^    - job: 静态分析报告$/m)
+  assert.match(job, /^      - target\/java-quality-summary\.json$/m)
+  assert.doesNotMatch(job, /threshold|ratchet/i)
+  assert.doesNotMatch(packageJob, /^    - 质量摘要$/m)
+})
diff --git a/scripts/java-topology-contract.test.mjs b/scripts/java-topology-contract.test.mjs
index 6c094c6e3..31f96cf24 100644
--- a/scripts/java-topology-contract.test.mjs
+++ b/scripts/java-topology-contract.test.mjs
@@ -62,13 +62,13 @@ const parseCompose = (yaml) => {
   }))
 }
 
-test('root POM freezes 23 modules and service-map freezes 16 executable services', async () => {
+test('root POM freezes 22 modules and service-map freezes 15 executable services', async () => {
   const modules = parseRootModules(await read('pom.xml'))
   const services = parseServiceMap(await read('deploy/service-map.yml'))
 
-  assert.equal(modules.length, 23)
-  assert.equal(new Set(modules).size, 23)
-  assert.equal(services.size, 16)
+  assert.equal(modules.length, 22)
+  assert.equal(new Set(modules).size, 22)
+  assert.equal(services.size, 15)
 
   const bootModules = []
   for (const module of modules) {
diff --git a/scripts/overseas-deployment-contract.test.mjs b/scripts/overseas-deployment-contract.test.mjs
index b1f89decb..72155a2ea 100644
--- a/scripts/overseas-deployment-contract.test.mjs
+++ b/scripts/overseas-deployment-contract.test.mjs
@@ -8,18 +8,18 @@ const read = async (path) => (await readFile(new URL(`../${path}`, import.meta.u
 test('Jenkins pipelines recognize all overseas deployable modules', async () => {
   const controller = await read('Jenkinsfile')
   const service = await read('Jenkinsfile.service')
-  for (const module of ['gateway-overseas', 'lastleg-service', 'warehouse-overseas-service', 'overseas-security-service']) {
+  for (const module of ['gateway-overseas', 'lastleg-service', 'warehouse-overseas-service']) {
     assert.match(controller, new RegExp(`'${module}'`))
     assert.match(service, new RegExp(`'${module}'`))
   }
   assert.match(controller, /'gateway-overseas': 'SERVICE_GATEWAY_OVERSEAS'/)
   assert.match(controller, /'lastleg-service': 'SERVICE_LASTLEG'/)
   assert.match(controller, /'warehouse-overseas-service': 'SERVICE_WAREHOUSE_OVERSEAS'/)
-  assert.match(controller, /'overseas-security-service': 'SERVICE_OVERSEAS_SECURITY'/)
   assert.match(service, /gateway-overseas\/target\/gateway-overseas-1\.0\.0-SNAPSHOT\.jar/)
   assert.match(service, /lastleg-service\/target\/lastleg-service-1\.0\.0-SNAPSHOT\.jar/)
   assert.match(service, /warehouse-overseas-service\/target\/warehouse-overseas-service-1\.0\.0-SNAPSHOT\.jar/)
-  assert.match(service, /overseas-security-service\/target\/overseas-security-service-1\.0\.0-SNAPSHOT\.jar/)
+  assert.doesNotMatch(controller, /overseas-security-service|SERVICE_OVERSEAS_SECURITY/)
+  assert.doesNotMatch(service, /overseas-security-service/)
   assert.match(controller, /EVENT_BRIDGE_REGION/)
   assert.match(service, /EVENT_BRIDGE_REGION_OVERRIDE=\$\{bridgeRegion\}/)
   assert.match(controller, /choices: \['BOTH', 'CN', 'OVERSEAS'\]/)
@@ -32,12 +32,11 @@ test('service map freezes unique internal ports and moves event bridge away from
   assert.match(map, /^  gateway-overseas:[\s\S]*?port: 9300$/m)
   assert.match(map, /^  lastleg-service:[\s\S]*?port: 9303$/m)
   assert.match(map, /^  warehouse-overseas-service:[\s\S]*?port: 9305$/m)
-  assert.match(map, /^  overseas-security-service:[\s\S]*?port: 9307$/m)
   assert.match(map, /^  event-bridge-service:[\s\S]*?port: 9312$/m)
   assert.match(map, /^  gateway-overseas:[\s\S]*?regions: \[OVERSEAS\]$/m)
   assert.match(map, /^  lastleg-service:[\s\S]*?regions: \[OVERSEAS\]$/m)
   assert.match(map, /^  warehouse-overseas-service:[\s\S]*?regions: \[OVERSEAS\]$/m)
-  assert.match(map, /^  overseas-security-service:[\s\S]*?regions: \[OVERSEAS\]$/m)
+  assert.doesNotMatch(map, /overseas-security-service|9307/)
   assert.match(map, /^  event-bridge-service:[\s\S]*?regions: \[CN, OVERSEAS\]$/m)
 })
 
@@ -50,7 +49,6 @@ test('overseas compose is isolated from CN defaults and disables implicit schema
   assert.match(compose, /^  gateway-overseas:\s*$/m)
   assert.match(compose, /^  lastleg-service:\s*$/m)
   assert.match(compose, /^  warehouse-overseas-service:\s*$/m)
-  assert.match(compose, /^  overseas-security-service:\s*$/m)
   assert.match(compose, /^  event-bridge-service:\s*$/m)
   assert.match(compose, /EVENT_BRIDGE_OVERSEAS_PORT:-9313}:9312/)
   assert.match(compose, /INTERNAL_SERVICE_TOKEN: \$\{INTERNAL_SERVICE_TOKEN\}/)
@@ -58,8 +56,9 @@ test('overseas compose is isolated from CN defaults and disables implicit schema
   assert.match(compose, /EVENT_BRIDGE_DB_URL: \$\{EVENT_BRIDGE_OVERSEAS_DB_URL\}/)
   assert.match(compose, /EVENT_BRIDGE_DB_USERNAME: \$\{EVENT_BRIDGE_OVERSEAS_DB_USERNAME\}/)
   assert.match(compose, /EVENT_BRIDGE_DB_PASSWORD: \$\{EVENT_BRIDGE_OVERSEAS_DB_PASSWORD\}/)
-  assert.match(compose, /OVERSEAS_SECURITY_DB_URL: \$\{OVERSEAS_SECURITY_DB_URL\}/)
-  assert.match(compose, /OVERSEAS_SECURITY_EVENT_CONSUMER_URL:/)
+  assert.match(compose, /LASTLEG_SECURITY_SERVICE_URL: \$\{LASTLEG_SECURITY_SERVICE_URL:-http:\/\/lastleg-service:9303\}/)
+  assert.match(compose, /LASTLEG_SECURITY_EVENT_CONSUMER_URL: \$\{LASTLEG_SECURITY_EVENT_CONSUMER_URL:-http:\/\/lastleg-service:9303\/internal\/lastleg\/security\/v1\/events\}/)
+  assert.doesNotMatch(compose, /overseas-security-service|9307|OVERSEAS_SECURITY_DB|OVERSEAS_SECURITY_SERVICE_URL|OVERSEAS_SECURITY_EVENT_CONSUMER_URL/)
   assert.match(compose, /CN_EVENT_BRIDGE_URL: \$\{CN_EVENT_BRIDGE_TARGET_URL:-http:\/\/event-bridge-cn:9312\}/)
   assert.match(compose, /FIRSTLEG_EVENT_BRIDGE_URL: \$\{CN_EVENT_BRIDGE_TARGET_URL:-http:\/\/event-bridge-cn:9312\}/)
   assert.doesNotMatch(compose, /CN_EVENT_BRIDGE_URL: \$\{CN_EVENT_BRIDGE_URL:/)
@@ -72,7 +71,11 @@ test('CN and overseas event bridges have explicit opposite-region consumers', as
   const cn = await read('config/nacos/cn/event-bridge-service.yml')
   const overseas = await read('config/nacos/overseas/event-bridge-service.yml')
   const firstleg = await read('config/nacos/cn/firstleg-service.yml')
+  const iam = await read('config/nacos/cn/iam-service.yml')
+  const iamApplication = await read('iam/src/main/resources/application.yml')
+  const iamClient = await read('iam/src/main/java/com/baiyue/iam/client/SecurityEventBridgeClient.java')
   const lastleg = await read('config/nacos/overseas/lastleg-service.yml')
+  const gatewayOverseas = await read('config/nacos/overseas/gateway-overseas.yml')
   const scripts = `${await read('deploy/scripts/deploy-built-service.sh')}\n${await read('deploy/scripts/deploy-services.sh')}`
   assert.match(cn, /EVENT_CONSUMER_URL:http:\/\/firstleg:9202\/internal\/firstleg\/v1\/container-events/)
   assert.match(overseas, /EVENT_CONSUMER_URL:http:\/\/lastleg-service:9303\/internal\/lastleg\/events/)
@@ -80,9 +83,17 @@ test('CN and overseas event bridges have explicit opposite-region consumers', as
   assert.match(cnCompose, /aliases: \[event-bridge-cn\]/)
   assert.match(overseasCompose, /EVENT_CONSUMER_URL: \$\{EVENT_CONSUMER_URL:-http:\/\/lastleg-service:9303\/internal\/lastleg\/events\}/)
   assert.match(firstleg, /LASTLEG_EVENT_BRIDGE_URL/)
+  assert.match(iamClient, /url = "\$\{baiyue\.security-event\.event-bridge-url:\}"/)
+  assert.match(iam, /SECURITY_EVENT_BRIDGE_URL:http:\/\/event-bridge-overseas:9312/)
+  assert.match(iamApplication, /SECURITY_EVENT_BRIDGE_URL:http:\/\/event-bridge-overseas:9312/)
+  assert.match(cnCompose, /SECURITY_EVENT_BRIDGE_URL: \$\{SECURITY_EVENT_BRIDGE_URL:-http:\/\/event-bridge-overseas:9312\}/)
+  assert.match(overseasCompose, /aliases: \[event-bridge-overseas\]/)
   assert.match(firstleg, /LASTLEG_OUTBOX_RELAY_LEASE_SECONDS/)
   assert.match(lastleg, /CN_EVENT_BRIDGE_URL:\$\{FIRSTLEG_EVENT_BRIDGE_URL\}/)
   assert.match(lastleg, /WAREHOUSE_OVERSEAS_SERVICE_URL:http:\/\/warehouse-overseas-service:9305/)
+  assert.match(gatewayOverseas, /LASTLEG_SECURITY_SERVICE_URL:http:\/\/lastleg-service:9303/)
+  assert.match(overseas, /LASTLEG_SECURITY_EVENT_CONSUMER_URL:http:\/\/lastleg-service:9303\/internal\/lastleg\/security\/v1\/events/)
+  assert.doesNotMatch(`${gatewayOverseas}\n${overseas}`, /overseas-security-service|9307|OVERSEAS_SECURITY_/)
   assert.match(scripts, /FIRSTLEG_EVENT_BRIDGE_URL/)
   assert.match(scripts, /LASTLEG_EVENT_BRIDGE_URL/)
   assert.match(scripts, /docker-compose\.overseas\.yml/)
@@ -120,3 +131,21 @@ test('domestic event bridge SQL converges legacy tenant columns to the customer
   assert.match(incremental, /bridge_inbox_customer_column = 0 AND @bridge_inbox_tenant_column = 1/)
   assert.match(incremental, /bridge_outbox_customer_column = 0 AND @bridge_outbox_tenant_column = 1/)
 })
+
+test('overseas unified SQL initializes the isolated Event Bridge database before services start', async () => {
+  const overseas = await read('deploy/sql/海外区域统一增量-MySQL8.sql')
+  assert.match(overseas, /CREATE DATABASE IF NOT EXISTS baiyue_event_bridge_overseas/)
+  assert.match(overseas, /USE baiyue_event_bridge_overseas;/)
+  for (const table of ['bridge_outbox', 'bridge_inbox', 'bridge_delivery_attempt']) {
+    assert.match(overseas, new RegExp(`CREATE TABLE IF NOT EXISTS ${table}`))
+  }
+  for (const index of [
+    'uk_bridge_outbox_idempotency', 'idx_bridge_outbox_schedule',
+    'uk_bridge_inbox_idempotency', 'idx_bridge_inbox_consume',
+    'uk_bridge_attempt', 'idx_bridge_attempt_event'
+  ]) assert.match(overseas, new RegExp(index))
+  assert.match(overseas, /COUNT\(DISTINCT CONCAT\(table_name, ':', index_name\)\)/)
+  assert.match(overseas, /CALL assert_overseas_event_bridge_schema\(\);/)
+  assert.ok(overseas.indexOf('USE baiyue_event_bridge_overseas;') < overseas.indexOf('USE baiyue_lastleg;'),
+    'overseas Event Bridge schema must be initialized before Lastleg tables')
+})
diff --git a/scripts/phase4-overseas-acceptance-entry-contract.test.mjs b/scripts/phase4-overseas-acceptance-entry-contract.test.mjs
index 05baae375..11b3dfb67 100644
--- a/scripts/phase4-overseas-acceptance-entry-contract.test.mjs
+++ b/scripts/phase4-overseas-acceptance-entry-contract.test.mjs
@@ -44,10 +44,47 @@ test('entry accepts a separate overseas Gateway without exposing token state', (
   assert.equal(options.gateway, 'http://localhost:9000')
   assert.equal(options.overseasGateway, 'http://localhost:9300')
   assert.match(source, /this\.overseasToken = login\.overseasAccessToken \|\| ''/)
+  assert.match(source, /this\.refreshToken = login\.refreshToken \|\| ''/)
+  assert.match(source, /this\.overseasExpiresAt = Number\(login\.overseasExpiresIn\)/)
+  assert.match(source, /async refreshSession\(reason\)/)
+  assert.match(source, /refreshToken: this\.refreshToken/)
+  assert.match(source, /const replacement = \{[\s\S]*token: next\.accessToken[\s\S]*refreshToken: next\.refreshToken[\s\S]*overseasToken: next\.overseasAccessToken/)
+  assert.match(source, /module === 'system' && laterOverseasModule/)
+  assert.match(source, /system后新admin海外Token只读探针可用/)
+  assert.match(source, /module\.startsWith\('phase4-overseas-'\)[\s\S]*Date\.now\(\) \+ 120_000 >= this\.overseasExpiresAt/)
+  assert.match(source, /海外模块 \$\{module\} 执行前Token临近到期/)
   assert.match(source, /async requestOverseas\(/)
   assert.match(source, /async requestOverseasBinary\(/)
   assert.match(source, /async requestOverseasMultipart\(/)
-  assert.match(source, /forbiddenValues = \[this\.options\.password, this\.token, this\.overseasToken\]/)
+  assert.match(source, /forbiddenValues = \[this\.options\.password, this\.options\.merchantPassword,[\s\S]*this\.token, this\.refreshToken, this\.overseasToken\]/)
+})
+
+test('dual-token refresh replaces the whole session only after a complete response', async () => {
+  const run = new AcceptanceRun({ gateway: 'http://localhost:9000', overseasGateway: 'http://localhost:9300',
+    username: 'contract-user', password: 'contract-password', modules: [], output: '' })
+  Object.assign(run, { token: 'old-access', refreshToken: 'old-refresh', overseasToken: 'old-overseas', overseasExpiresAt: 1 })
+  run.request = async (method, path, body, token) => {
+    assert.equal(method, 'POST'); assert.equal(path, '/api/auth/refresh')
+    assert.deepEqual(body, { refreshToken: 'old-refresh' }); assert.equal(token, '')
+    return { method, path, http: 200, body: { code: '200', data: {
+      accessToken: 'new-access', refreshToken: 'new-refresh', overseasAccessToken: 'new-overseas',
+      overseasExpiresIn: 900,
+    } }, requestId: 'refresh-request', traceId: 'refresh-trace' }
+  }
+  assert.equal(await run.refreshSession('contract'), true)
+  assert.equal(run.token, 'new-access')
+  assert.equal(run.refreshToken, 'new-refresh')
+  assert.equal(run.overseasToken, 'new-overseas')
+  assert.ok(run.overseasExpiresAt > Date.now())
+
+  const frozen = { token: run.token, refreshToken: run.refreshToken,
+    overseasToken: run.overseasToken, overseasExpiresAt: run.overseasExpiresAt }
+  run.request = async (method, path) => ({ method, path, http: 200,
+    body: { code: '200', data: { accessToken: 'partial-only' } },
+    requestId: 'partial-request', traceId: 'partial-trace' })
+  assert.equal(await run.refreshSession('incomplete-contract'), false)
+  assert.deepEqual({ token: run.token, refreshToken: run.refreshToken,
+    overseasToken: run.overseasToken, overseasExpiresAt: run.overseasExpiresAt }, frozen)
 })
 
 test('entry has no built-in environment address or password and requires explicit execution options', () => {
@@ -80,8 +117,12 @@ test('PDA entry expands the real phase-three producer chain and builds an FBA/OV
     assert.ok(modules.indexOf(prerequisite) >= 0 && modules.indexOf(prerequisite) < modules.indexOf('phase4-overseas-pda'))
   }
   assert.match(source, /async ensurePhase4PdaProducerMatrix\(\)/)
-  assert.match(source, /runPhase4ProducerVariant\('OVERSEAS-PRIMARY', 'OVERSEAS'\)/)
-  assert.match(source, /runPhase4ProducerVariant\('SECONDARY', 'FBA'\)/)
+  assert.match(source, /runPhase4ProducerVariant\('DROPSHIP-PRIMARY', 'FBA', 'ONE_CLICK_DROPSHIP', true\)/)
+  assert.match(source, /runPhase4ProducerVariant\('OVERSEAS-PRIMARY', 'OVERSEAS', 'STANDARD', true\)/)
+  assert.match(source, /runPhase4ProducerVariant\('FBA-STANDARD', 'FBA', 'STANDARD', false\)/)
+  assert.match(source, /runPhase4ProducerVariant\('SECONDARY', 'FBA', 'STANDARD', false\)/)
+  assert.match(source, /runUntilPickupReady\(this\)/)
+  assert.match(source, /carrierScheduleQueryId/)
   assert.match(source, /readyForPhase4Pda === true/)
   assert.equal(modules.indexOf('phase4-overseas-pda-operations'), modules.indexOf('phase4-overseas-pda') + 1)
 })
diff --git a/scripts/provision-development-service-jobs.groovy b/scripts/provision-development-service-jobs.groovy
index baa57b467..e4c7ced35 100644
--- a/scripts/provision-development-service-jobs.groovy
+++ b/scripts/provision-development-service-jobs.groovy
@@ -6,7 +6,7 @@ boolean applyChanges = false
 String templateName = 'baiyue-firstleg-dev-print'
 List<String> serviceModules = [
     'gateway', 'gateway-overseas', 'auth', 'iam', 'firstleg', 'finance', 'order', 'warehouse', 'file', 'print',
-    'integration-service', 'lastleg-service', 'warehouse-overseas-service', 'overseas-security-service', 'event-bridge-service', 'audit-service'
+    'integration-service', 'lastleg-service', 'warehouse-overseas-service', 'event-bridge-service', 'audit-service'
 ]
 
 Jenkins jenkins = Jenkins.get()
diff --git a/scripts/synchronous-dependency-baseline.mjs b/scripts/synchronous-dependency-baseline.mjs
index 0e829bb6f..aba1424d1 100644
--- a/scripts/synchronous-dependency-baseline.mjs
+++ b/scripts/synchronous-dependency-baseline.mjs
@@ -64,7 +64,8 @@ export const SYNCHRONOUS_CLIENTS = Object.freeze([
   feign('firstleg/src/main/java/com/baiyue/firstleg/client/MeasurementImageClient.java',
     'firstleg-service', 'file-service', ['REQUEST'], 'READ_WRITE', 'MIXED', '图片上传/作废非安全重放，查询可重复'),
   feign('firstleg/src/main/java/com/baiyue/firstleg/client/OrderCargoClient.java',
-    'firstleg-service', 'order-service', ['REQUEST'], 'READ', 'SAFE_READ', '读取订单货物/来源快照'),
+    'firstleg-service', 'order-service', ['REQUEST', 'BACKGROUND'], 'READ', 'SAFE_READ',
+    '在线测量/箱号/排柜读取；Order 审核 Outbox 创建 Firstleg 入库及箱号时也会后台回读订单货物'),
   feign('firstleg/src/main/java/com/baiyue/firstleg/client/OrderFulfillmentSplitClient.java',
     'firstleg-service', 'order-service', ['REQUEST'], 'WRITE', 'IDEMPOTENCY_KEY', 'PDA 结算拆单携带 idempotencyKey/operationId'),
   feign('firstleg/src/main/java/com/baiyue/firstleg/client/PriceBookFileClient.java',
@@ -88,7 +89,8 @@ export const SYNCHRONOUS_CLIENTS = Object.freeze([
   feign('iam/src/main/java/com/baiyue/iam/client/AuthAccountClient.java',
     'iam-service', 'auth-service', ['REQUEST'], 'READ_WRITE', 'MIXED', '账号查询可重复，写操作按账号/命令业务键收敛'),
   feign('iam/src/main/java/com/baiyue/iam/client/CustomerDimensionRuleClient.java',
-    'iam-service', 'firstleg-service', ['REQUEST'], 'WRITE', 'BUSINESS_KEY', '初始化/补偿使用 initializationKey'),
+    'iam-service', 'firstleg-service', ['BACKGROUND'], 'WRITE', 'BUSINESS_KEY',
+    'IAM 持久化任务租约投递；初始化/补偿复用稳定 initializationKey，不在客户创建请求内调用'),
   feign('iam/src/main/java/com/baiyue/iam/client/OverseasStorageFeeClient.java',
     'iam-service', 'warehouse-service', ['REQUEST'], 'WRITE', 'BUSINESS_KEY', '初始化/补偿使用 initializationKey'),
   feign('iam/src/main/java/com/baiyue/iam/client/SecurityEventBridgeClient.java',
@@ -98,6 +100,9 @@ export const SYNCHRONOUS_CLIENTS = Object.freeze([
     'lastleg-service', 'event-bridge-service', ['BACKGROUND'], 'WRITE', 'EVENT_ID', '卸柜完成 Outbox 按 eventId 投递'),
   feign('lastleg-service/src/main/java/com/baiyue/lastleg/masterdata/quote/client/DomesticPartnerWarehouseClient.java',
     'lastleg-service', 'warehouse-service', ['REQUEST'], 'READ', 'SAFE_READ', '报价创建时读取国内合作仓快照'),
+  feign('warehouse-overseas-service/src/main/java/com/baiyue/warehouse/client/DomesticWarehouseDirectoryClient.java',
+    'warehouse-overseas-service', 'warehouse-service', ['REQUEST'], 'READ', 'SAFE_READ',
+    '海外库位、托盘和资源锁写入前读取国内共享收货仓权威目录'),
 
   feign('order/src/main/java/com/baiyue/order/client/FirstlegInboundClient.java',
     'order-service', 'firstleg-service', ['REQUEST', 'BACKGROUND'], 'READ_WRITE', 'BUSINESS_KEY',
@@ -120,9 +125,9 @@ export const SYNCHRONOUS_CLIENTS = Object.freeze([
   http('event-bridge-service/src/main/java/com/baiyue/eventbridge/service/HttpLastlegEventClient.java',
     'event-bridge-service', 'lastleg-service', ['BACKGROUND'], 'WRITE', 'EVENT_ID', 'Inbox 租约投递，目标按 eventId 幂等'),
   http('event-bridge-service/src/main/java/com/baiyue/eventbridge/service/HttpSecurityProjectionEventClient.java',
-    'event-bridge-service', 'overseas-security-service', ['BACKGROUND'], 'WRITE', 'EVENT_ID', 'IAM 安全事件投影按 eventId/版本单调幂等'),
+    'event-bridge-service', 'lastleg-service', ['BACKGROUND'], 'WRITE', 'EVENT_ID', 'IAM 安全事件投影按 eventId/版本单调幂等'),
   http('gateway-overseas/src/main/java/com/baiyue/gateway/filter/HttpOverseasSecurityValidationClient.java',
-    'gateway-overseas', 'overseas-security-service', ['INFRASTRUCTURE'], 'READ', 'SAFE_READ', 'POST 实时校验，失败关闭'),
+    'gateway-overseas', 'lastleg-service', ['INFRASTRUCTURE'], 'READ', 'SAFE_READ', 'POST 实时校验，失败关闭'),
   http('gateway-overseas/src/main/java/com/baiyue/gateway/filter/HttpPdaSessionValidationClient.java',
     'gateway-overseas', 'auth-service', ['INFRASTRUCTURE'], 'READ', 'SAFE_READ', 'POST PDA 会话校验，失败关闭'),
   http('lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/pda/gateway/HttpUnloadPhotoFileGateway.java',
diff --git a/scripts/synchronous-dependency-contract.test.mjs b/scripts/synchronous-dependency-contract.test.mjs
index a36533f8c..7f00cb335 100644
--- a/scripts/synchronous-dependency-contract.test.mjs
+++ b/scripts/synchronous-dependency-contract.test.mjs
@@ -13,7 +13,7 @@ const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..')
 const serviceModules = [
   'auth', 'iam', 'order', 'firstleg', 'finance', 'file', 'warehouse',
   'integration-service', 'print', 'event-bridge-service', 'lastleg-service',
-  'warehouse-overseas-service', 'overseas-security-service'
+  'warehouse-overseas-service'
 ]
 
 const canonicalSource = new Map(serviceModules.map(name => [name, `${name}${name.endsWith('-service') ? '' : '-service'}`]))
@@ -32,7 +32,6 @@ const expectedOnlineEdges = [
   'firstleg-service->print-service',
   'firstleg-service->warehouse-service',
   'iam-service->auth-service',
-  'iam-service->firstleg-service',
   'iam-service->warehouse-service',
   'lastleg-service->file-service',
   'lastleg-service->warehouse-overseas-service',
@@ -40,13 +39,13 @@ const expectedOnlineEdges = [
   'order-service->file-service',
   'order-service->firstleg-service',
   'order-service->iam-service',
-  'order-service->warehouse-service'
+  'order-service->warehouse-service',
+  'warehouse-overseas-service->warehouse-service'
 ]
 
 const expectedBackgroundEdges = [
   'event-bridge-service->firstleg-service',
   'event-bridge-service->lastleg-service',
-  'event-bridge-service->overseas-security-service',
   'file-service->finance-service',
   'file-service->firstleg-service',
   'file-service->iam-service',
@@ -56,7 +55,9 @@ const expectedBackgroundEdges = [
   'firstleg-service->event-bridge-service',
   'firstleg-service->finance-service',
   'firstleg-service->integration-service',
+  'firstleg-service->order-service',
   'iam-service->event-bridge-service',
+  'iam-service->firstleg-service',
   'lastleg-service->event-bridge-service',
   'order-service->firstleg-service'
 ]
@@ -95,11 +96,11 @@ async function discoverFeignEdges() {
   return clients.sort((left, right) => left.path.localeCompare(right.path))
 }
 
-test('all 44 Feign clients have reviewed context, access and idempotency metadata', async () => {
+test('all 45 Feign clients have reviewed context, access and idempotency metadata', async () => {
   const reviewed = SYNCHRONOUS_CLIENTS.filter(client => client.transport === 'FEIGN')
     .map(({ path, source, target }) => ({ path, source, target }))
     .sort((left, right) => left.path.localeCompare(right.path))
-  assert.equal(reviewed.length, 44)
+  assert.equal(reviewed.length, 45)
   assert.deepEqual(await discoverFeignEdges(), reviewed)
 })
 
@@ -131,6 +132,20 @@ test('every reviewed synchronous client has a complete and exclusive executable
   }
 })
 
+test('IAM customer dimension Feign is reachable only from the background relay', async () => {
+  const references = []
+  for (const file of await javaFiles(path.join(root, 'iam', 'src', 'main', 'java'))) {
+    const source = await readFile(file, 'utf8')
+    if (source.includes('CustomerDimensionRuleClient')) {
+      references.push(path.relative(root, file).replaceAll('\\', '/'))
+    }
+  }
+  assert.deepEqual(references.sort(), [
+    'iam/src/main/java/com/baiyue/iam/client/CustomerDimensionRuleClient.java',
+    'iam/src/main/java/com/baiyue/iam/service/CustomerDimensionInitializationRelay.java'
+  ])
+})
+
 test('all four Lastleg RestClient gateways use explicit bounded transports', async () => {
   const clients = new Map([
     ['lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/pda/gateway/HttpUnloadPhotoFileGateway.java', 'getUnloadPhotoFile'],
@@ -170,13 +185,14 @@ test('REQUEST, BACKGROUND and full graphs remain separate executable baselines',
   assert.deepEqual(graphEdges('INFRASTRUCTURE'), [
     'common-audit->audit-service',
     'gateway-overseas->auth-service',
-    'gateway-overseas->overseas-security-service'
+    'gateway-overseas->lastleg-service'
+  ])
+  assert.deepEqual(stronglyConnectedComponents(graphEdges('REQUEST')), [
+    ['auth-service', 'iam-service'],
+    ['firstleg-service', 'order-service']
   ])
-  assert.deepEqual(stronglyConnectedComponents(graphEdges('REQUEST')), [[
-    'auth-service', 'file-service', 'firstleg-service', 'iam-service', 'order-service'
-  ]])
   assert.deepEqual(stronglyConnectedComponents(graphEdges('BACKGROUND')), [[
-    'event-bridge-service', 'finance-service', 'firstleg-service', 'lastleg-service'
+    'event-bridge-service', 'finance-service', 'firstleg-service', 'lastleg-service', 'order-service'
   ]])
   assert.deepEqual(stronglyConnectedComponents(graphEdges('ALL')), [[
     'auth-service', 'event-bridge-service', 'file-service', 'finance-service',
@@ -184,10 +200,29 @@ test('REQUEST, BACKGROUND and full graphs remain separate executable baselines',
   ]])
 })
 
-test('overseas security edges never become online business dependencies', () => {
-  assert.ok(!graphEdges('REQUEST').some(edge => edge.includes('overseas-security-service')))
-  assert.ok(graphEdges('INFRASTRUCTURE').includes('gateway-overseas->overseas-security-service'))
-  assert.ok(graphEdges('BACKGROUND').includes('event-bridge-service->overseas-security-service'))
+test('overseas security projection stays in Lastleg infrastructure and background edges', () => {
+  assert.ok(!graphEdges('REQUEST').some(edge => edge === 'gateway-overseas->lastleg-service'))
+  assert.ok(graphEdges('INFRASTRUCTURE').includes('gateway-overseas->lastleg-service'))
+  assert.ok(graphEdges('BACKGROUND').includes('event-bridge-service->lastleg-service'))
+})
+
+test('Order and Firstleg remain a bilateral REQUEST SCC until loading-complete timing is frozen', () => {
+  const requestClients = SYNCHRONOUS_CLIENTS.filter(client => client.contexts.includes('REQUEST'))
+  const orderToFirstleg = requestClients.filter(client =>
+    client.source === 'order-service' && client.target === 'firstleg-service')
+  const firstlegToOrder = requestClients.filter(client =>
+    client.source === 'firstleg-service' && client.target === 'order-service')
+  assert.deepEqual(orderToFirstleg.map(client => client.path).sort(), [
+    'order/src/main/java/com/baiyue/order/client/FirstlegInboundClient.java',
+    'order/src/main/java/com/baiyue/order/client/FirstlegPricingClient.java',
+    'order/src/main/java/com/baiyue/order/client/FirstlegUnifiedOrderClient.java'
+  ])
+  assert.deepEqual(firstlegToOrder.map(client => client.path).sort(), [
+    'firstleg/src/main/java/com/baiyue/firstleg/client/OrderCargoClient.java',
+    'firstleg/src/main/java/com/baiyue/firstleg/client/OrderFulfillmentSplitClient.java'
+  ])
+  assert.ok(stronglyConnectedComponents(graphEdges('REQUEST')).some(component =>
+    component.includes('firstleg-service') && component.includes('order-service')))
 })
 
 test('known user entries expose every longest simple REQUEST path over the two-hop budget', () => {
@@ -196,37 +231,37 @@ test('known user entries expose every longest simple REQUEST path over the two-h
     return [entry.service, { hops: paths[0].length - 1, paths: paths.map(path => path.join('->')) }]
   }))
   assert.deepEqual(summary, {
-    'auth-service': { hops: 5, paths: [
-      'auth-service->iam-service->firstleg-service->order-service->file-service->integration-service'
+    'auth-service': { hops: 2, paths: [
+      'auth-service->iam-service->warehouse-service'
     ] },
-    'iam-service': { hops: 4, paths: [
-      'iam-service->firstleg-service->order-service->file-service->integration-service'
+    'iam-service': { hops: 1, paths: [
+      'iam-service->auth-service',
+      'iam-service->warehouse-service'
     ] },
     'order-service': { hops: 4, paths: [
-      'order-service->file-service->iam-service->firstleg-service->print-service',
-      'order-service->file-service->iam-service->firstleg-service->warehouse-service',
       'order-service->firstleg-service->file-service->iam-service->auth-service',
-      'order-service->firstleg-service->file-service->iam-service->warehouse-service',
-      'order-service->iam-service->firstleg-service->file-service->integration-service'
+      'order-service->firstleg-service->file-service->iam-service->warehouse-service'
     ] },
     'firstleg-service': { hops: 4, paths: [
       'firstleg-service->order-service->file-service->iam-service->auth-service',
       'firstleg-service->order-service->file-service->iam-service->warehouse-service'
     ] },
     'finance-service': { hops: 5, paths: [
-      'finance-service->file-service->iam-service->firstleg-service->order-service->warehouse-service',
       'finance-service->firstleg-service->order-service->file-service->iam-service->auth-service',
-      'finance-service->firstleg-service->order-service->file-service->iam-service->warehouse-service',
-      'finance-service->iam-service->firstleg-service->order-service->file-service->integration-service'
+      'finance-service->firstleg-service->order-service->file-service->iam-service->warehouse-service'
     ] },
-    'file-service': { hops: 4, paths: [
-      'file-service->iam-service->firstleg-service->order-service->warehouse-service'
+    'file-service': { hops: 2, paths: [
+      'file-service->iam-service->auth-service',
+      'file-service->iam-service->warehouse-service'
     ] },
-    'lastleg-service': { hops: 5, paths: [
-      'lastleg-service->file-service->iam-service->firstleg-service->order-service->warehouse-service'
+    'lastleg-service': { hops: 3, paths: [
+      'lastleg-service->file-service->iam-service->auth-service',
+      'lastleg-service->file-service->iam-service->warehouse-service'
     ] },
     'warehouse-service': { hops: 0, paths: ['warehouse-service'] },
-    'warehouse-overseas-service': { hops: 0, paths: ['warehouse-overseas-service'] }
+    'warehouse-overseas-service': { hops: 1, paths: [
+      'warehouse-overseas-service->warehouse-service'
+    ] }
   })
   for (const entry of USER_ENTRIES) {
     const result = summary[entry.service]
diff --git a/scripts/test-environment-pipeline-contract.test.mjs b/scripts/test-environment-pipeline-contract.test.mjs
index 22eaf133c..2215862cb 100644
--- a/scripts/test-environment-pipeline-contract.test.mjs
+++ b/scripts/test-environment-pipeline-contract.test.mjs
@@ -57,6 +57,8 @@ test('Java builds use the shared builder pool and serialize incremental target d
   assert.doesNotMatch(directDeployScript, /docker save "\$IMAGE"/)
   assert.match(directDeployScript, /up -d --no-deps --pull never/)
   assert.doesNotMatch(directDeployScript, /--remove-orphans/)
+  assert.match(directDeployScript, /--project-name "\$PROJECT_NAME"/)
+  assert.doesNotMatch(directDeployScript, /overseas-security-service|remove_legacy_overseas_security_container/)
   assert.match(directDeployScript, /--pull never/)
 })
 
@@ -85,13 +87,12 @@ test('development and test deployment locks are acquired before target executors
   assert.ok(lockIndex < nodeIndex, 'deployment lock must be acquired before target node allocation')
 })
 
-test('development exposes gateways for remote acceptance and keeps internal services on loopback', () => {
+test('development publishes every service on loopback without changing test defaults', () => {
   assert.match(serviceCompose, /\$\{PUBLISHED_BIND_ADDRESS:-0\.0\.0\.0\}:\$\{GATEWAY_PORT:-9000\}:9000/)
   assert.match(overseasCompose, /\$\{PUBLISHED_BIND_ADDRESS:-0\.0\.0\.0\}:\$\{GATEWAY_OVERSEAS_PORT:-9300\}:9300/)
-  assert.match(directDeployScript, /gateway\|gateway-overseas\) PUBLISHED_BIND_ADDRESS=0\.0\.0\.0/)
-  assert.match(directDeployScript, /\*\) PUBLISHED_BIND_ADDRESS=127\.0\.0\.1/)
-  assert.match(directDeployScript, /gateway\|gateway-overseas\) export PUBLISHED_BIND_ADDRESS=0\.0\.0\.0/)
-  assert.match(directDeployScript, /\*\) export PUBLISHED_BIND_ADDRESS=127\.0\.0\.1/)
+  assert.match(directDeployScript, /if \[ "\$DEPLOY_ENV" = "development" \]; then\s+PUBLISHED_BIND_ADDRESS=127\.0\.0\.1/)
+  assert.match(directDeployScript, /if \[ "\$deploy_env" = "development" \]; then\s+export PUBLISHED_BIND_ADDRESS=127\.0\.0\.1/)
+  assert.doesNotMatch(directDeployScript, /gateway\|gateway-overseas\) (?:export )?PUBLISHED_BIND_ADDRESS=0\.0\.0\.0/)
 })
 
 test('parallel image publications isolate registry credentials per Jenkins job', () => {
diff --git a/warehouse-overseas-service/AGENTS.md b/warehouse-overseas-service/AGENTS.md
index c0357deda..e0f3ff78e 100644
--- a/warehouse-overseas-service/AGENTS.md
+++ b/warehouse-overseas-service/AGENTS.md
@@ -2,18 +2,19 @@
 
 ## 职责与边界
 
-- 负责海外仓库、地址、服务能力、库位、托盘及业务资源锁定/释放。
-- 尾程入仓计划通过内部网关请求资源；本模块不读取尾程订单库或头程数据库。
+- 负责海外库位、托盘及业务资源锁定/释放；只保存国内仓库 ID 引用，不保存仓库、地址或能力主档。
+- 国内 `warehouse-service` 是仓库 ID、类型、状态、地址和能力的唯一权威；本服务通过内部目录校验平台共享 `OVERSEAS + ACTIVE + RECEIVING` 仓。尾程入仓计划通过内部网关请求资源；本模块不读取尾程订单库或头程数据库。
 
 ## 快速索引
 
 | 功能 | 入口 |
 |---|---|
-| 平台仓库管理 | `src/main/java/com/baiyue/warehouse/controller/PlatformWarehouseController.java` |
-| 商户仓库查询 | `controller/MerchantWarehouseController.java` |
+| 国内仓库只读目录 | `client/DomesticWarehouseDirectoryClient.java`、`service/DomesticWarehouseDirectory.java`；正结果缓存 30 分钟，空值和不存在不得长缓存 |
 | 平台/商户库位与托盘 | `controller/PlatformWarehouseResourceController.java`、`MerchantWarehouseResourceController.java` |
 | 内部资源锁定、释放、报废 | `controller/InternalWarehouseResourceLockController.java` |
-| 仓库与资源服务 | `service/WarehouseApplicationService.java`、`WarehouseResourceService.java`、`WarehouseResourceLockService.java` |
+| PDA 托盘状态流转与补偿 | `controller/InternalPdaPalletTransitionController.java`、`service/WarehousePalletTransitionService.java`、`mapper/WarehousePalletTransitionMapper.java`；内部前缀 `/internal/v1/pda-pallet-transitions` |
+| 托盘解析与业务绑定 | `controller/InternalWarehousePalletController.java`、`dto/WarehousePalletResolveResponse.java`、`entity/WarehousePalletBindingEntity.java` |
+| 仓储资源服务 | `service/WarehouseResourceService.java`、`WarehouseResourceLockService.java` |
 | 内部服务令牌 | `security/InternalServiceTokenGuard.java` |
 | 数据库基线与中文注释契约 | `src/main/resources/db/warehouse.sql`、`src/test/java/com/baiyue/warehouse/schema/SchemaChineseCommentContractTest.java` |
 | 测试 | `src/test/java/com/baiyue/warehouse/` |
@@ -24,6 +25,7 @@
 - 平台维护的海外库位与实物托盘是公共资源，固定使用 `customer_id=0`；平台资源 API 不接收目标客户参数。资源锁记录仍使用真实业务客户 ID 隔离，但其托盘、库位查找和状态更新必须落到公共资源作用域。
 - 资源锁定以业务幂等键和 reservation 标识防重；释放/报废操作必须验证当前状态。
 - 内部资源接口必须校验服务令牌；普通用户不得直接调用。
+- 本服务不得注册仓库主档创建、编辑、状态或商户仓库查询 Controller；所有资源写入先以相同 `warehouseId` 校验国内只读目录。
 
 ## 数据库表索引与注释约束
 
@@ -32,15 +34,14 @@
 | 库位 | `wh_location` | 海外仓库位资源 |
 | 托盘 | `wh_pallet` | 海外仓实物托盘资源 |
 | 资源锁 | `wh_resource_lock` | 仓储资源锁定记录 |
-| 仓库 | `wh_warehouse` | 海外仓档案 |
-| 仓库地址 | `wh_warehouse_address` | 海外仓地址 |
-| 服务能力 | `wh_service_capability` | 海外仓服务能力 |
 | 托盘绑定 | `wh_pallet_business_binding` | 托盘业务绑定关系 |
+| 托盘操作 | `wh_pallet_operation` | PDA 托盘物理状态流转、幂等与补偿记录 |
 
 - 新增或修改表时，表 `COMMENT` 和每个普通字段的 `COMMENT` 必须填写准确的中文业务含义。
 - `SchemaChineseCommentContractTest` 自动扫描全部 `wh_` 表；新增字段必须同步更新基线 SQL、统一增量 SQL 和存量备注迁移。
 
 ## 修改与验证
 
-- 字段、注释和索引同步维护基线 SQL 与统一增量 SQL。
+- 字段、注释和索引同步维护基线 SQL 与统一增量 SQL；海外数据库禁止新增 `wh_warehouse`、`wh_warehouse_address`、`wh_service_capability` 或指向它们的外键。
+- PDA 托盘流转必须校验内部服务令牌、仓库范围、当前物理状态和幂等键；跨服务业务失败只能通过显式补偿接口恢复，不得由 Lastleg 直接修改 `wh_` 资源表。
 - 定向验证：`mvn -pl warehouse-overseas-service -am test`。
diff --git a/warehouse-overseas-service/pom.xml b/warehouse-overseas-service/pom.xml
index 2fe0001e9..acce7f683 100644
--- a/warehouse-overseas-service/pom.xml
+++ b/warehouse-overseas-service/pom.xml
@@ -40,6 +40,10 @@
             <groupId>com.alibaba.cloud</groupId>
             <artifactId>spring-cloud-starter-alibaba-nacos-discovery</artifactId>
         </dependency>
+        <dependency>
+            <groupId>org.springframework.cloud</groupId>
+            <artifactId>spring-cloud-starter-openfeign</artifactId>
+        </dependency>
         <dependency>
             <groupId>com.alibaba.cloud</groupId>
             <artifactId>spring-cloud-starter-alibaba-nacos-config</artifactId>
diff --git a/warehouse-overseas-service/src/main/java/com/baiyue/warehouse/BaiyueWarehouseOverseasApplication.java b/warehouse-overseas-service/src/main/java/com/baiyue/warehouse/BaiyueWarehouseOverseasApplication.java
index 1e8de8582..58358b7ba 100644
--- a/warehouse-overseas-service/src/main/java/com/baiyue/warehouse/BaiyueWarehouseOverseasApplication.java
+++ b/warehouse-overseas-service/src/main/java/com/baiyue/warehouse/BaiyueWarehouseOverseasApplication.java
@@ -3,11 +3,13 @@ package com.baiyue.warehouse;
 import org.mybatis.spring.annotation.MapperScan;
 import org.springframework.boot.SpringApplication;
 import org.springframework.boot.autoconfigure.SpringBootApplication;
+import org.springframework.cloud.openfeign.EnableFeignClients;
 
 /**
  * 仓库微服务启动入口，启用 Spring Boot 自动配置并扫描仓库服务的 MyBatis Mapper。
  */
 @MapperScan("com.baiyue.warehouse.mapper")
+@EnableFeignClients(basePackages = "com.baiyue.warehouse.client")
 @SpringBootApplication(scanBasePackages = "com.baiyue")
 public class BaiyueWarehouseOverseasApplication {
     public static void main(String[] args) { SpringApplication.run(BaiyueWarehouseOverseasApplication.class, args); }
diff --git a/warehouse-overseas-service/src/main/java/com/baiyue/warehouse/client/DomesticWarehouseDirectoryClient.java b/warehouse-overseas-service/src/main/java/com/baiyue/warehouse/client/DomesticWarehouseDirectoryClient.java
new file mode 100644
index 000000000..2e9c636e4
--- /dev/null
+++ b/warehouse-overseas-service/src/main/java/com/baiyue/warehouse/client/DomesticWarehouseDirectoryClient.java
@@ -0,0 +1,25 @@
+package com.baiyue.warehouse.client;
+
+import com.baiyue.common.core.api.ApiResponse;
+import org.springframework.cloud.openfeign.FeignClient;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.PathVariable;
+import org.springframework.web.bind.annotation.RequestHeader;
+
+import java.util.List;
+
+@FeignClient(name = "warehouse-service", contextId = "sharedOverseasWarehouseDirectoryClient",
+    url = "${baiyue.clients.domestic-warehouse.url:}")
+public interface DomesticWarehouseDirectoryClient {
+    @GetMapping("/internal/warehouses/shared-overseas")
+    ApiResponse<List<WarehouseReference>> activeSharedWarehouses(
+        @RequestHeader("X-Internal-Service-Token") String internalToken);
+
+    @GetMapping("/internal/warehouses/shared-overseas/{warehouseId}")
+    ApiResponse<WarehouseReference> activeSharedWarehouse(
+        @RequestHeader("X-Internal-Service-Token") String internalToken,
+        @PathVariable long warehouseId);
+
+    record WarehouseReference(Long warehouseId, String warehouseCode, String warehouseName,
+                              String countryCode, String status) { }
+}
diff --git a/warehouse-overseas-service/src/main/java/com/baiyue/warehouse/controller/InternalWarehouseResourceLockController.java b/warehouse-overseas-service/src/main/java/com/baiyue/warehouse/controller/InternalWarehouseResourceLockController.java
index 94b636b8e..5dff5af01 100644
--- a/warehouse-overseas-service/src/main/java/com/baiyue/warehouse/controller/InternalWarehouseResourceLockController.java
+++ b/warehouse-overseas-service/src/main/java/com/baiyue/warehouse/controller/InternalWarehouseResourceLockController.java
@@ -10,7 +10,7 @@ import com.baiyue.warehouse.entity.WarehouseLocationEntity;
 import com.baiyue.warehouse.security.InternalServiceTokenGuard;
 import com.baiyue.warehouse.service.WarehouseResourceLockService;
 import com.baiyue.warehouse.service.WarehouseResourceService;
-import com.baiyue.warehouse.service.WarehouseApplicationService;
+import com.baiyue.warehouse.service.DomesticWarehouseDirectory;
 import jakarta.validation.Valid;
 import jakarta.annotation.Resource;
 import org.springframework.web.bind.annotation.PathVariable;
@@ -27,7 +27,7 @@ import org.springframework.web.bind.annotation.RestController;
 public class InternalWarehouseResourceLockController {
     @Resource private WarehouseResourceLockService service;
     @Resource private WarehouseResourceService resourceService;
-    @Resource private WarehouseApplicationService warehouses;
+    @Resource private DomesticWarehouseDirectory warehouses;
     @Resource private InternalServiceTokenGuard tokenGuard;
 
     @PostMapping
@@ -79,7 +79,7 @@ public class InternalWarehouseResourceLockController {
         @RequestHeader(value = "X-Internal-Service-Token", required = false) String token,
         @PathVariable long warehouseId) {
         tokenGuard.verify(token);
-        return ApiResponse.success(warehouses.activeSharedReference(warehouseId));
+        return ApiResponse.success(warehouses.required(warehouseId));
     }
 
     @GetMapping("/locations/resolve/{locationCode}")
diff --git a/warehouse-overseas-service/src/main/java/com/baiyue/warehouse/controller/MerchantWarehouseController.java b/warehouse-overseas-service/src/main/java/com/baiyue/warehouse/controller/MerchantWarehouseController.java
deleted file mode 100644
index 29d409b18..000000000
--- a/warehouse-overseas-service/src/main/java/com/baiyue/warehouse/controller/MerchantWarehouseController.java
+++ /dev/null
@@ -1,67 +0,0 @@
-package com.baiyue.warehouse.controller;
-
-import com.baiyue.common.core.api.ApiResponse;
-import com.baiyue.common.core.api.PageResult;
-import com.baiyue.common.security.AuthenticatedUser;
-import com.baiyue.warehouse.dto.WarehouseDetailResponse;
-import com.baiyue.warehouse.dto.WarehouseRequests;
-import com.baiyue.warehouse.entity.WarehouseEntity;
-import com.baiyue.warehouse.service.WarehouseApplicationService;
-import io.swagger.v3.oas.annotations.Operation;
-import io.swagger.v3.oas.annotations.Parameter;
-import io.swagger.v3.oas.annotations.responses.ApiResponses;
-import io.swagger.v3.oas.annotations.tags.Tag;
-import jakarta.annotation.Resource;
-import jakarta.validation.Valid;
-import org.springframework.security.core.annotation.AuthenticationPrincipal;
-import org.springframework.web.bind.annotation.GetMapping;
-import org.springframework.web.bind.annotation.PathVariable;
-import org.springframework.web.bind.annotation.RequestMapping;
-import org.springframework.web.bind.annotation.RestController;
-
-/**
- * 商户端仓库查询接口，仅允许在认证令牌所属租户范围内读取仓库列表和详情。
- */
-@Tag(
-    name = "Merchant warehouses / 商户仓库",
-    description = "Merchant read APIs restricted to the tenant in the authenticated JWT. / 商户端只读接口，租户范围取自认证 JWT。"
-)
-@RestController
-@RequestMapping("/api/merchant/v1/warehouses")
-public class MerchantWarehouseController {
-    @Resource
-    private WarehouseApplicationService service;
-
-    @Operation(
-        summary = "List available warehouses / 查询可用仓库",
-        description = "Customer scope comes only from the authenticated JWT; any customerId query value is ignored. / 客户范围仅从认证 JWT 获取，查询中的 customerId 不生效。"
-    )
-    @ApiResponses({
-        @io.swagger.v3.oas.annotations.responses.ApiResponse(responseCode = "200", description = "Query succeeded / 查询成功"),
-        @io.swagger.v3.oas.annotations.responses.ApiResponse(responseCode = "400", description = "Invalid query / 查询参数无效"),
-        @io.swagger.v3.oas.annotations.responses.ApiResponse(responseCode = "401", description = "Authentication required / 需要登录")
-    })
-    @GetMapping
-    public ApiResponse<PageResult<WarehouseEntity>> page(
-        @AuthenticationPrincipal AuthenticatedUser user,
-        @Valid WarehouseRequests.QueryRequest query) {
-        return ApiResponse.success(service.page(user.tenantId(), query));
-    }
-
-    @Operation(
-        summary = "Get warehouse details / 查询仓库详情",
-        description = "Returns warehouse details only within the authenticated merchant tenant. / 仅返回当前认证商户租户内的仓库详情。"
-    )
-    @ApiResponses({
-        @io.swagger.v3.oas.annotations.responses.ApiResponse(responseCode = "200", description = "Query succeeded / 查询成功"),
-        @io.swagger.v3.oas.annotations.responses.ApiResponse(responseCode = "401", description = "Authentication required / 需要登录"),
-        @io.swagger.v3.oas.annotations.responses.ApiResponse(responseCode = "404", description = "Warehouse not found in current tenant / 当前租户下仓库不存在")
-    })
-    @GetMapping("/{id}")
-    public ApiResponse<WarehouseDetailResponse> detail(
-        @AuthenticationPrincipal AuthenticatedUser user,
-        @Parameter(description = "Warehouse ID / 仓库 ID", example = "190000000000000001", required = true)
-        @PathVariable long id) {
-        return ApiResponse.success(service.detail(user.tenantId(), id));
-    }
-}
diff --git a/warehouse-overseas-service/src/main/java/com/baiyue/warehouse/controller/PlatformWarehouseController.java b/warehouse-overseas-service/src/main/java/com/baiyue/warehouse/controller/PlatformWarehouseController.java
deleted file mode 100644
index e4b27dfbc..000000000
--- a/warehouse-overseas-service/src/main/java/com/baiyue/warehouse/controller/PlatformWarehouseController.java
+++ /dev/null
@@ -1,171 +0,0 @@
-package com.baiyue.warehouse.controller;
-
-import com.baiyue.common.core.api.ApiResponse;
-import com.baiyue.common.core.api.PageResult;
-import com.baiyue.common.core.api.ResultCode;
-import com.baiyue.common.core.exception.BizException;
-import com.baiyue.common.security.AuthenticatedUser;
-import com.baiyue.warehouse.dto.WarehouseDetailResponse;
-import com.baiyue.warehouse.dto.WarehouseRequests;
-import com.baiyue.warehouse.entity.WarehouseEntity;
-import com.baiyue.warehouse.service.WarehouseApplicationService;
-import com.baiyue.warehouse.security.OverseasWarehousePermissions;
-import io.swagger.v3.oas.annotations.Operation;
-import io.swagger.v3.oas.annotations.Parameter;
-import io.swagger.v3.oas.annotations.responses.ApiResponses;
-import io.swagger.v3.oas.annotations.tags.Tag;
-import jakarta.annotation.Resource;
-import jakarta.validation.Valid;
-import jakarta.validation.constraints.NotNull;
-import org.springframework.security.core.annotation.AuthenticationPrincipal;
-import org.springframework.security.access.prepost.PreAuthorize;
-import org.springframework.validation.annotation.Validated;
-import org.springframework.web.bind.annotation.GetMapping;
-import org.springframework.web.bind.annotation.PatchMapping;
-import org.springframework.web.bind.annotation.PathVariable;
-import org.springframework.web.bind.annotation.PostMapping;
-import org.springframework.web.bind.annotation.PutMapping;
-import org.springframework.web.bind.annotation.RequestBody;
-import org.springframework.web.bind.annotation.RequestMapping;
-import org.springframework.web.bind.annotation.RequestParam;
-import org.springframework.web.bind.annotation.RestController;
-
-/**
- * 平台端仓库管理接口，提供跨租户管理场景下的仓库创建、修改、查询和状态维护能力。
- */
-@Validated
-@Tag(
-    name = "Platform warehouse administration / 平台仓库管理",
-    description = "Platform APIs for managing warehouses across tenants. / 平台端按租户管理仓库的接口。"
-)
-@RestController
-@RequestMapping("/api/platform/v1/warehouse-admin")
-public class PlatformWarehouseController {
-    @Resource
-    private WarehouseApplicationService service;
-
-    @Operation(
-        summary = "Create warehouse / 新建仓库",
-        description = "Required authority: " + OverseasWarehousePermissions.WAREHOUSE_CREATE + ". Creates a warehouse, address and service capabilities for the target customer."
-    )
-    @ApiResponses({
-        @io.swagger.v3.oas.annotations.responses.ApiResponse(responseCode = "200", description = "Created successfully / 创建成功"),
-        @io.swagger.v3.oas.annotations.responses.ApiResponse(responseCode = "400", description = "Invalid request / 请求参数无效"),
-        @io.swagger.v3.oas.annotations.responses.ApiResponse(responseCode = "403", description = "Platform access required / 需要平台端权限"),
-        @io.swagger.v3.oas.annotations.responses.ApiResponse(responseCode = "409", description = "Warehouse code already exists / 仓库编码已存在")
-    })
-    @PostMapping
-    @PreAuthorize("hasAuthority('" + OverseasWarehousePermissions.WAREHOUSE_CREATE + "')")
-    public ApiResponse<Long> create(@AuthenticationPrincipal AuthenticatedUser user,
-                                    @Valid @RequestBody WarehouseRequests.SaveRequest request) {
-        requirePlatform(user);
-        requireTenant(request.customerId());
-        return ApiResponse.success(service.create(request));
-    }
-
-    @Operation(
-        summary = "Update warehouse / 更新仓库",
-        description = "Required authority: " + OverseasWarehousePermissions.WAREHOUSE_EDIT + ". Updates the warehouse and replaces its address and capabilities."
-    )
-    @ApiResponses({
-        @io.swagger.v3.oas.annotations.responses.ApiResponse(responseCode = "200", description = "Updated successfully / 更新成功"),
-        @io.swagger.v3.oas.annotations.responses.ApiResponse(responseCode = "400", description = "Invalid request / 请求参数无效"),
-        @io.swagger.v3.oas.annotations.responses.ApiResponse(responseCode = "403", description = "Platform access or tenant validation failed / 平台权限或租户校验失败"),
-        @io.swagger.v3.oas.annotations.responses.ApiResponse(responseCode = "404", description = "Warehouse not found / 仓库不存在"),
-        @io.swagger.v3.oas.annotations.responses.ApiResponse(responseCode = "409", description = "Warehouse code already exists / 仓库编码已存在")
-    })
-    @PutMapping("/{id}")
-    @PreAuthorize("hasAuthority('" + OverseasWarehousePermissions.WAREHOUSE_EDIT + "')")
-    public ApiResponse<Void> update(
-        @AuthenticationPrincipal AuthenticatedUser user,
-        @Parameter(description = "Target tenant ID / 目标租户 ID", example = "10001", required = true)
-        @RequestParam @NotNull Long customerId,
-        @Parameter(description = "Warehouse ID / 仓库 ID", example = "190000000000000001", required = true)
-        @PathVariable long id,
-        @Valid @RequestBody WarehouseRequests.SaveRequest request) {
-        requirePlatform(user);
-        requireTenant(customerId);
-        service.update(customerId, id, request);
-        return ApiResponse.success(null);
-    }
-
-    @Operation(
-        summary = "List warehouses / 查询仓库",
-        description = "Required authority: " + OverseasWarehousePermissions.WAREHOUSE_LIST
-            + ". Returns warehouses across customers, or only the optional customerId scope when supplied."
-    )
-    @ApiResponses({
-        @io.swagger.v3.oas.annotations.responses.ApiResponse(responseCode = "200", description = "Query succeeded / 查询成功"),
-        @io.swagger.v3.oas.annotations.responses.ApiResponse(responseCode = "400", description = "Invalid query / 查询参数无效"),
-        @io.swagger.v3.oas.annotations.responses.ApiResponse(responseCode = "403", description = "Platform access required / 需要平台端权限")
-    })
-    @GetMapping
-    @PreAuthorize("hasAnyAuthority('" + OverseasWarehousePermissions.WAREHOUSE_LIST + "', '"
-        + OverseasWarehousePermissions.PALLET_LIST + "', '" + OverseasWarehousePermissions.LOCATION_LIST + "')")
-    public ApiResponse<PageResult<WarehouseEntity>> page(
-        @AuthenticationPrincipal AuthenticatedUser user,
-        @Valid WarehouseRequests.QueryRequest request) {
-        requirePlatform(user);
-        return ApiResponse.success(service.pageAll(request));
-    }
-
-    @Operation(
-        summary = "Get tenant warehouse details / 查询租户仓库详情",
-        description = "Required authority: " + OverseasWarehousePermissions.WAREHOUSE_LIST + ". Returns the warehouse, addresses and service capabilities for the target customer."
-    )
-    @ApiResponses({
-        @io.swagger.v3.oas.annotations.responses.ApiResponse(responseCode = "200", description = "Query succeeded / 查询成功"),
-        @io.swagger.v3.oas.annotations.responses.ApiResponse(responseCode = "403", description = "Platform access required / 需要平台端权限"),
-        @io.swagger.v3.oas.annotations.responses.ApiResponse(responseCode = "404", description = "Warehouse not found / 仓库不存在")
-    })
-    @GetMapping("/{id}")
-    @PreAuthorize("hasAuthority('" + OverseasWarehousePermissions.WAREHOUSE_LIST + "')")
-    public ApiResponse<WarehouseDetailResponse> detail(
-        @AuthenticationPrincipal AuthenticatedUser user,
-        @Parameter(description = "Target tenant ID / 目标租户 ID", example = "10001", required = true)
-        @RequestParam @NotNull Long customerId,
-        @Parameter(description = "Warehouse ID / 仓库 ID", example = "190000000000000001", required = true)
-        @PathVariable long id) {
-        requirePlatform(user);
-        requireTenant(customerId);
-        return ApiResponse.success(service.detail(customerId, id));
-    }
-
-    @Operation(
-        summary = "Enable or disable warehouse / 启用或停用仓库",
-        description = "Required authority: " + OverseasWarehousePermissions.WAREHOUSE_STATUS + ". Changes warehouse status to ACTIVE or INACTIVE."
-    )
-    @ApiResponses({
-        @io.swagger.v3.oas.annotations.responses.ApiResponse(responseCode = "200", description = "Status changed / 状态变更成功"),
-        @io.swagger.v3.oas.annotations.responses.ApiResponse(responseCode = "400", description = "Invalid status / 状态无效"),
-        @io.swagger.v3.oas.annotations.responses.ApiResponse(responseCode = "403", description = "Platform access required / 需要平台端权限"),
-        @io.swagger.v3.oas.annotations.responses.ApiResponse(responseCode = "404", description = "Warehouse not found / 仓库不存在")
-    })
-    @PatchMapping("/{id}/status")
-    @PreAuthorize("hasAuthority('" + OverseasWarehousePermissions.WAREHOUSE_STATUS + "')")
-    public ApiResponse<Void> status(
-        @AuthenticationPrincipal AuthenticatedUser user,
-        @Parameter(description = "Target tenant ID / 目标租户 ID", example = "10001", required = true)
-        @RequestParam @NotNull Long customerId,
-        @Parameter(description = "Warehouse ID / 仓库 ID", example = "190000000000000001", required = true)
-        @PathVariable long id,
-        @Parameter(description = "Target status: ACTIVE or INACTIVE / 目标状态：ACTIVE 或 INACTIVE", example = "ACTIVE", required = true)
-        @RequestParam String status) {
-        requirePlatform(user);
-        requireTenant(customerId);
-        service.changeStatus(customerId, id, status);
-        return ApiResponse.success(null);
-    }
-
-    private static void requirePlatform(AuthenticatedUser user) {
-        if (user == null || !"PLATFORM".equals(user.appCode()) || user.tenantId() == null || user.tenantId() != 0L) {
-            throw new BizException(ResultCode.FORBIDDEN, "Platform application required / 仅允许平台端访问");
-        }
-    }
-
-    private static void requireTenant(Long customerId) {
-        if (customerId == null || customerId < 0) {
-            throw new BizException(ResultCode.BAD_REQUEST, "Target customer scope is required / 必须指定有效客户或平台共享范围");
-        }
-    }
-}
diff --git a/warehouse-overseas-service/src/main/java/com/baiyue/warehouse/dto/WarehouseDetailResponse.java b/warehouse-overseas-service/src/main/java/com/baiyue/warehouse/dto/WarehouseDetailResponse.java
deleted file mode 100644
index f9ec1c882..000000000
--- a/warehouse-overseas-service/src/main/java/com/baiyue/warehouse/dto/WarehouseDetailResponse.java
+++ /dev/null
@@ -1,19 +0,0 @@
-package com.baiyue.warehouse.dto;
-
-import com.baiyue.warehouse.entity.ServiceCapabilityEntity;
-import com.baiyue.warehouse.entity.WarehouseAddressEntity;
-import com.baiyue.warehouse.entity.WarehouseEntity;
-import io.swagger.v3.oas.annotations.media.Schema;
-
-import java.util.List;
-
-/**
- * 仓库聚合详情响应，组合仓库主数据、地址列表和服务能力列表。
- */
-@Schema(name = "WarehouseDetailResponse", description = "Warehouse aggregate details / 仓库聚合详情")
-public record WarehouseDetailResponse(
-    @Schema(description = "Warehouse master data / 仓库主数据") WarehouseEntity warehouse,
-    @Schema(description = "Warehouse addresses / 仓库地址列表") List<WarehouseAddressEntity> addresses,
-    @Schema(description = "Warehouse service capabilities / 仓库服务能力列表") List<ServiceCapabilityEntity> capabilities
-) {
-}
diff --git a/warehouse-overseas-service/src/main/java/com/baiyue/warehouse/dto/WarehouseRequests.java b/warehouse-overseas-service/src/main/java/com/baiyue/warehouse/dto/WarehouseRequests.java
deleted file mode 100644
index d762b3a30..000000000
--- a/warehouse-overseas-service/src/main/java/com/baiyue/warehouse/dto/WarehouseRequests.java
+++ /dev/null
@@ -1,120 +0,0 @@
-package com.baiyue.warehouse.dto;
-
-import io.swagger.v3.oas.annotations.media.Schema;
-import jakarta.validation.Valid;
-import jakarta.validation.constraints.Email;
-import jakarta.validation.constraints.Max;
-import jakarta.validation.constraints.Min;
-import jakarta.validation.constraints.NotBlank;
-import jakarta.validation.constraints.NotNull;
-import jakarta.validation.constraints.Pattern;
-import jakarta.validation.constraints.PositiveOrZero;
-import jakarta.validation.constraints.Size;
-
-import java.math.BigDecimal;
-import java.time.LocalTime;
-import java.util.List;
-
-/**
- * 仓库接口请求模型容器，集中定义仓库保存、地址、服务能力、查询和状态变更请求契约。
- */
-public final class WarehouseRequests {
-    private WarehouseRequests() {
-    }
-
-    @Schema(name = "WarehouseSaveRequest", description = "Warehouse create or update request / 仓库新增或更新请求")
-    public record SaveRequest(
-        @Schema(description = "Target tenant ID / 目标租户 ID", example = "10001", requiredMode = Schema.RequiredMode.REQUIRED)
-        @NotNull Long customerId,
-        @Schema(description = "Tenant-unique warehouse code / 租户内唯一仓库编码", example = "US-LAX-01", maxLength = 50, requiredMode = Schema.RequiredMode.REQUIRED)
-        @NotBlank @Size(max = 50) String warehouseCode,
-        @Schema(description = "Warehouse name / 仓库名称", example = "Los Angeles Main Warehouse / 洛杉矶主仓", maxLength = 120, requiredMode = Schema.RequiredMode.REQUIRED)
-        @NotBlank @Size(max = 120) String warehouseName,
-        @Schema(description = "Warehouse type / 仓库类型", example = "OVERSEAS", requiredMode = Schema.RequiredMode.REQUIRED)
-        @NotBlank String warehouseType,
-        @Schema(description = "ISO 3166-1 alpha-2 country code / ISO 两位国家代码", example = "US", pattern = "[A-Z]{2}", requiredMode = Schema.RequiredMode.REQUIRED)
-        @NotBlank @Pattern(regexp = "[A-Z]{2}") String countryCode,
-        @Schema(description = "IANA timezone / IANA 时区", example = "America/Los_Angeles", requiredMode = Schema.RequiredMode.REQUIRED)
-        @NotBlank String timezone,
-        @Schema(description = "Contact name / 联系人姓名", example = "Alex Chen", maxLength = 64)
-        @Size(max = 64) String contactName,
-        @Schema(description = "Contact phone / 联系电话", example = "+1-213-555-0100", maxLength = 32)
-        @Size(max = 32) String contactPhone,
-        @Schema(description = "Contact email / 联系邮箱", example = "warehouse@example.com")
-        @Email String contactEmail,
-        @Schema(description = "Warehouse status / 仓库状态", example = "ACTIVE", allowableValues = {"ACTIVE", "INACTIVE"}, requiredMode = Schema.RequiredMode.REQUIRED)
-        @NotBlank String status,
-        @Schema(description = "Remark / 备注", example = "Supports appointment receiving / 支持预约入库", maxLength = 500)
-        @Size(max = 500) String remark,
-        @Schema(description = "Primary warehouse address / 仓库主地址", requiredMode = Schema.RequiredMode.REQUIRED)
-        @Valid @NotNull AddressRequest address,
-        @Schema(description = "Supported service capabilities / 支持的服务能力")
-        @Valid List<CapabilityRequest> capabilities
-    ) {
-    }
-
-    @Schema(name = "WarehouseAddressRequest", description = "Warehouse address / 仓库地址")
-    public record AddressRequest(
-        @Schema(description = "Address type / 地址类型", example = "WAREHOUSE", requiredMode = Schema.RequiredMode.REQUIRED)
-        @NotBlank String addressType,
-        @Schema(description = "ISO two-letter country code / ISO 两位国家代码", example = "US", requiredMode = Schema.RequiredMode.REQUIRED)
-        @NotBlank @Pattern(regexp = "[A-Z]{2}") String countryCode,
-        @Schema(description = "State or province / 州或省", example = "California", maxLength = 100)
-        @Size(max = 100) String stateProvince,
-        @Schema(description = "City / 城市", example = "Los Angeles", maxLength = 100, requiredMode = Schema.RequiredMode.REQUIRED)
-        @NotBlank @Size(max = 100) String city,
-        @Schema(description = "District / 区县", example = "Commerce", maxLength = 100)
-        @Size(max = 100) String district,
-        @Schema(description = "Postal code / 邮政编码", example = "90040", maxLength = 20)
-        @Size(max = 20) String postalCode,
-        @Schema(description = "Address line 1 / 地址第一行", example = "123 Logistics Ave", maxLength = 255, requiredMode = Schema.RequiredMode.REQUIRED)
-        @NotBlank @Size(max = 255) String addressLine1,
-        @Schema(description = "Address line 2 / 地址第二行", example = "Building A", maxLength = 255)
-        @Size(max = 255) String addressLine2,
-        @Schema(description = "Latitude / 纬度", example = "34.052235")
-        BigDecimal latitude,
-        @Schema(description = "Longitude / 经度", example = "-118.243683")
-        BigDecimal longitude
-    ) {
-    }
-
-    @Schema(name = "WarehouseCapabilityRequest", description = "Warehouse service capability / 仓库服务能力")
-    public record CapabilityRequest(
-        @Schema(description = "Capability code / 能力编码", example = "STORAGE", maxLength = 50, requiredMode = Schema.RequiredMode.REQUIRED)
-        @NotBlank @Size(max = 50) String capabilityCode,
-        @Schema(description = "Capability name / 能力名称", example = "Storage / 仓储", maxLength = 100, requiredMode = Schema.RequiredMode.REQUIRED)
-        @NotBlank @Size(max = 100) String capabilityName,
-        @Schema(description = "Whether enabled / 是否启用", example = "true", defaultValue = "true")
-        Boolean enabled,
-        @Schema(description = "Daily cutoff time / 每日截单时间", example = "16:00:00", type = "string", format = "time")
-        LocalTime cutoffTime,
-        @Schema(description = "Capability description / 能力说明", example = "Standard pallet storage / 标准托盘仓储", maxLength = 500)
-        @Size(max = 500) String description
-    ) {
-    }
-
-    @Schema(name = "WarehouseQueryRequest", description = "Warehouse page query / 仓库分页查询条件")
-    public record QueryRequest(
-        @Schema(description = "Optional target customer ID for platform queries; merchant queries always use the authenticated customer / 平台查询可选目标客户 ID，商户查询始终使用认证客户", example = "10001", nullable = true)
-        @PositiveOrZero Long customerId,
-        @Schema(description = "Page number, starting at 1 / 页码，从 1 开始", example = "1", defaultValue = "1", minimum = "1")
-        @Min(1) long page,
-        @Schema(description = "Page size / 每页条数", example = "20", defaultValue = "20", minimum = "1", maximum = "200")
-        @Min(1) @Max(200) long size,
-        @Schema(description = "Country filter / 国家筛选", example = "US")
-        String countryCode,
-        @Schema(description = "Enabled capability code filter / 已启用能力编码筛选", example = "STORAGE")
-        String capabilityCode,
-        @Schema(description = "Status filter / 状态筛选", example = "ACTIVE", allowableValues = {"ACTIVE", "INACTIVE"})
-        String status
-    ) {
-        public QueryRequest {
-            if (page == 0) {
-                page = 1;
-            }
-            if (size == 0) {
-                size = 20;
-            }
-        }
-    }
-}
diff --git a/warehouse-overseas-service/src/main/java/com/baiyue/warehouse/entity/ServiceCapabilityEntity.java b/warehouse-overseas-service/src/main/java/com/baiyue/warehouse/entity/ServiceCapabilityEntity.java
deleted file mode 100644
index 2ed0103e1..000000000
--- a/warehouse-overseas-service/src/main/java/com/baiyue/warehouse/entity/ServiceCapabilityEntity.java
+++ /dev/null
@@ -1,57 +0,0 @@
-package com.baiyue.warehouse.entity;
-
-import lombok.Getter;
-import lombok.Setter;
-
-import com.baomidou.mybatisplus.annotation.IdType;
-import com.baomidou.mybatisplus.annotation.TableId;
-import com.baomidou.mybatisplus.annotation.TableName;
-import com.baiyue.common.core.model.BaseEntity;
-import io.swagger.v3.oas.annotations.media.Schema;
-
-import java.time.LocalTime;
-
-/**
- * 仓库服务能力持久化实体，对应 {@code wh_service_capability} 表。
- * 用于记录租户仓库可提供的能力、启用状态和每日截单时间。
- */
-@Schema(name = "WarehouseServiceCapability", description = "仓库服务能力")
-@Getter
-@Setter
-@TableName("wh_service_capability")
-public class ServiceCapabilityEntity extends BaseEntity {
-    @Schema(description = "能力记录编号", example = "190000000000000021")
-    @TableId(type = IdType.ASSIGN_ID)
-    private Long id;
-    @Schema(description = "租户编号", example = "10001")
-    private Long customerId;
-    @Schema(description = "仓库编号", example = "190000000000000001")
-    private Long warehouseId;
-    @Schema(description = "能力编码", example = "STORAGE")
-    private String capabilityCode;
-    @Schema(description = "能力名称", example = "仓储")
-    private String capabilityName;
-    @Schema(description = "是否启用", example = "true")
-    private Boolean enabled;
-    @Schema(description = "每日截单时间", example = "16:00:00", type = "string", format = "time")
-    private LocalTime cutoffTime;
-    @Schema(description = "能力说明", example = "标准托盘仓储")
-    private String description;
-
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-}
diff --git a/warehouse-overseas-service/src/main/java/com/baiyue/warehouse/entity/WarehouseAddressEntity.java b/warehouse-overseas-service/src/main/java/com/baiyue/warehouse/entity/WarehouseAddressEntity.java
deleted file mode 100644
index e43afda65..000000000
--- a/warehouse-overseas-service/src/main/java/com/baiyue/warehouse/entity/WarehouseAddressEntity.java
+++ /dev/null
@@ -1,77 +0,0 @@
-package com.baiyue.warehouse.entity;
-
-import lombok.Getter;
-import lombok.Setter;
-
-import com.baomidou.mybatisplus.annotation.IdType;
-import com.baomidou.mybatisplus.annotation.TableId;
-import com.baomidou.mybatisplus.annotation.TableName;
-import com.baiyue.common.core.model.BaseEntity;
-import io.swagger.v3.oas.annotations.media.Schema;
-
-import java.math.BigDecimal;
-
-/**
- * 仓库地址持久化实体，对应 {@code wh_warehouse_address} 表。
- * 用于保存租户仓库的结构化地址与经纬度信息。
- */
-@Schema(name = "WarehouseAddress", description = "仓库地址数据")
-@Getter
-@Setter
-@TableName("wh_warehouse_address")
-public class WarehouseAddressEntity extends BaseEntity {
-    @Schema(description = "地址编号", example = "190000000000000011")
-    @TableId(type = IdType.ASSIGN_ID)
-    private Long id;
-    @Schema(description = "租户编号", example = "10001")
-    private Long customerId;
-    @Schema(description = "仓库编号", example = "190000000000000001")
-    private Long warehouseId;
-    @Schema(description = "地址类型", example = "WAREHOUSE")
-    private String addressType;
-    @Schema(description = "ISO 两位国家代码", example = "US")
-    private String countryCode;
-    @Schema(description = "州或省", example = "California")
-    private String stateProvince;
-    @Schema(description = "城市", example = "Los Angeles")
-    private String city;
-    @Schema(description = "区县", example = "Commerce")
-    private String district;
-    @Schema(description = "邮政编码", example = "90040")
-    private String postalCode;
-    @Schema(description = "地址第一行", example = "123 Logistics Ave")
-    private String addressLine1;
-    @Schema(description = "地址第二行", example = "Building A")
-    private String addressLine2;
-    @Schema(description = "纬度", example = "34.052235")
-    private BigDecimal latitude;
-    @Schema(description = "经度", example = "-118.243683")
-    private BigDecimal longitude;
-
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-}
diff --git a/warehouse-overseas-service/src/main/java/com/baiyue/warehouse/entity/WarehouseEntity.java b/warehouse-overseas-service/src/main/java/com/baiyue/warehouse/entity/WarehouseEntity.java
deleted file mode 100644
index 2a8c43527..000000000
--- a/warehouse-overseas-service/src/main/java/com/baiyue/warehouse/entity/WarehouseEntity.java
+++ /dev/null
@@ -1,71 +0,0 @@
-package com.baiyue.warehouse.entity;
-
-import lombok.Getter;
-import lombok.Setter;
-
-import com.baomidou.mybatisplus.annotation.IdType;
-import com.baomidou.mybatisplus.annotation.TableId;
-import com.baomidou.mybatisplus.annotation.TableName;
-import com.baiyue.common.core.model.BaseEntity;
-import io.swagger.v3.oas.annotations.media.Schema;
-
-/**
- * 仓库主数据持久化实体，对应 {@code wh_warehouse} 表。
- * 用于记录租户下仓库的编码、类型、国家、联系方式和启停状态。
- */
-@Schema(name = "Warehouse", description = "仓库主数据")
-@Getter
-@Setter
-@TableName("wh_warehouse")
-public class WarehouseEntity extends BaseEntity {
-    @Schema(description = "仓库编号", example = "190000000000000001")
-    @TableId(type = IdType.ASSIGN_ID)
-    private Long id;
-    @Schema(description = "租户编号", example = "10001")
-    private Long customerId;
-    @Schema(description = "仓库编码", example = "US-LAX-01")
-    private String warehouseCode;
-    @Schema(description = "仓库名称", example = "洛杉矶主仓")
-    private String warehouseName;
-    @Schema(description = "仓库类型", example = "OVERSEAS")
-    private String warehouseType;
-    @Schema(description = "ISO 两位国家代码", example = "US")
-    private String countryCode;
-    @Schema(description = "IANA 时区", example = "America/Los_Angeles")
-    private String timezone;
-    @Schema(description = "联系人", example = "陈先生")
-    private String contactName;
-    @Schema(description = "联系电话", example = "+1-213-555-0100")
-    private String contactPhone;
-    @Schema(description = "联系邮箱", example = "warehouse@example.com")
-    private String contactEmail;
-    @Schema(description = "仓库状态", example = "ACTIVE", allowableValues = {"ACTIVE", "INACTIVE"})
-    private String status;
-    @Schema(description = "备注", example = "支持预约入库")
-    private String remark;
-
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-    
-}
diff --git a/warehouse-overseas-service/src/main/java/com/baiyue/warehouse/mapper/ServiceCapabilityMapper.java b/warehouse-overseas-service/src/main/java/com/baiyue/warehouse/mapper/ServiceCapabilityMapper.java
deleted file mode 100644
index 7f265bccb..000000000
--- a/warehouse-overseas-service/src/main/java/com/baiyue/warehouse/mapper/ServiceCapabilityMapper.java
+++ /dev/null
@@ -1,16 +0,0 @@
-package com.baiyue.warehouse.mapper;
-
-import com.baomidou.mybatisplus.core.mapper.BaseMapper;
-import com.baiyue.warehouse.entity.ServiceCapabilityEntity;
-import org.apache.ibatis.annotations.Delete;
-import org.apache.ibatis.annotations.Param;
-
-/**
- * 仓库服务能力 MyBatis-Plus Mapper，负责 {@code wh_service_capability} 表访问及仓库子记录的物理清理。
- */
-public interface ServiceCapabilityMapper extends BaseMapper<ServiceCapabilityEntity> {
-
-    @Delete("DELETE FROM wh_service_capability WHERE customer_id = #{customerId} AND warehouse_id = #{warehouseId}")
-    int physicallyDeleteByWarehouse(@Param("customerId") long customerId,
-                                    @Param("warehouseId") long warehouseId);
-}
diff --git a/warehouse-overseas-service/src/main/java/com/baiyue/warehouse/mapper/WarehouseAddressMapper.java b/warehouse-overseas-service/src/main/java/com/baiyue/warehouse/mapper/WarehouseAddressMapper.java
deleted file mode 100644
index 620f0e0c8..000000000
--- a/warehouse-overseas-service/src/main/java/com/baiyue/warehouse/mapper/WarehouseAddressMapper.java
+++ /dev/null
@@ -1,16 +0,0 @@
-package com.baiyue.warehouse.mapper;
-
-import com.baomidou.mybatisplus.core.mapper.BaseMapper;
-import com.baiyue.warehouse.entity.WarehouseAddressEntity;
-import org.apache.ibatis.annotations.Delete;
-import org.apache.ibatis.annotations.Param;
-
-/**
- * 仓库地址 MyBatis-Plus Mapper，负责 {@code wh_warehouse_address} 表访问及仓库子记录的物理清理。
- */
-public interface WarehouseAddressMapper extends BaseMapper<WarehouseAddressEntity> {
-
-    @Delete("DELETE FROM wh_warehouse_address WHERE customer_id = #{customerId} AND warehouse_id = #{warehouseId}")
-    int physicallyDeleteByWarehouse(@Param("customerId") long customerId,
-                                    @Param("warehouseId") long warehouseId);
-}
diff --git a/warehouse-overseas-service/src/main/java/com/baiyue/warehouse/mapper/WarehouseMapper.java b/warehouse-overseas-service/src/main/java/com/baiyue/warehouse/mapper/WarehouseMapper.java
deleted file mode 100644
index 5c9ef0172..000000000
--- a/warehouse-overseas-service/src/main/java/com/baiyue/warehouse/mapper/WarehouseMapper.java
+++ /dev/null
@@ -1,6 +0,0 @@
-package com.baiyue.warehouse.mapper; import com.baomidou.mybatisplus.core.mapper.BaseMapper; import com.baiyue.warehouse.entity.WarehouseEntity;
-
-/**
- * 仓库主数据 MyBatis-Plus Mapper，提供 {@code wh_warehouse} 表的单表持久化访问。
- */
-public interface WarehouseMapper extends BaseMapper<WarehouseEntity> {}
diff --git a/warehouse-overseas-service/src/main/java/com/baiyue/warehouse/mapper/WarehousePalletTransitionMapper.java b/warehouse-overseas-service/src/main/java/com/baiyue/warehouse/mapper/WarehousePalletTransitionMapper.java
index 751a848c0..9f4b423ba 100644
--- a/warehouse-overseas-service/src/main/java/com/baiyue/warehouse/mapper/WarehousePalletTransitionMapper.java
+++ b/warehouse-overseas-service/src/main/java/com/baiyue/warehouse/mapper/WarehousePalletTransitionMapper.java
@@ -20,12 +20,12 @@ public interface WarehousePalletTransitionMapper extends BaseMapper<WarehousePal
                                            @Param("palletId") long palletId);
 
     @Select("SELECT COUNT(*) FROM wh_location WHERE id=#{locationId} AND customer_id=0 " +
-        "AND warehouse_id=#{warehouseId} AND status&lt;&gt;'INACTIVE' AND deleted=0")
+        "AND warehouse_id=#{warehouseId} AND status<>'INACTIVE' AND deleted=0")
     long countActiveLocation(@Param("warehouseId") long warehouseId, @Param("locationId") long locationId);
 
     @Update("UPDATE wh_pallet SET status=#{targetStatus},location_id=#{targetLocationId},version=version+1," +
         "updated_at=CURRENT_TIMESTAMP(3) WHERE id=#{palletId} AND customer_id=0 " +
-        "AND warehouse_id=#{warehouseId} AND version=#{expectedVersion} AND status&lt;&gt;'SCRAPPED' AND deleted=0")
+        "AND warehouse_id=#{warehouseId} AND version=#{expectedVersion} AND status<>'SCRAPPED' AND deleted=0")
     int transition(@Param("warehouseId") long warehouseId, @Param("palletId") long palletId,
                    @Param("targetStatus") String targetStatus, @Param("targetLocationId") long targetLocationId,
                    @Param("expectedVersion") int expectedVersion);
diff --git a/warehouse-overseas-service/src/main/java/com/baiyue/warehouse/repository/WarehouseRepository.java b/warehouse-overseas-service/src/main/java/com/baiyue/warehouse/repository/WarehouseRepository.java
deleted file mode 100644
index cfb36643f..000000000
--- a/warehouse-overseas-service/src/main/java/com/baiyue/warehouse/repository/WarehouseRepository.java
+++ /dev/null
@@ -1,137 +0,0 @@
-package com.baiyue.warehouse.repository;
-
-import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
-import com.baomidou.mybatisplus.extension.plugins.pagination.Page;
-import com.baiyue.common.core.api.PageResult;
-import com.baiyue.warehouse.dto.WarehouseRequests;
-import com.baiyue.warehouse.entity.ServiceCapabilityEntity;
-import com.baiyue.warehouse.entity.WarehouseAddressEntity;
-import com.baiyue.warehouse.entity.WarehouseEntity;
-import com.baiyue.warehouse.entity.WarehouseLocationEntity;
-import com.baiyue.warehouse.mapper.ServiceCapabilityMapper;
-import com.baiyue.warehouse.mapper.WarehouseAddressMapper;
-import com.baiyue.warehouse.mapper.WarehouseMapper;
-import com.baiyue.warehouse.mapper.WarehouseLocationMapper;
-import org.springframework.stereotype.Repository;
-import org.springframework.util.StringUtils;
-import jakarta.annotation.Resource;
-
-import java.util.List;
-
-/**
- * 仓库聚合持久化仓储，组合仓库、地址和服务能力 Mapper，并强制按租户范围执行查询与写入。
- */
-@Repository
-public class WarehouseRepository {
-    @Resource private WarehouseMapper warehouses;
-    @Resource private WarehouseLocationMapper locations;
-    @Resource private WarehouseAddressMapper addresses;
-    @Resource private ServiceCapabilityMapper capabilities;
-
-    public void insertWarehouse(WarehouseEntity warehouse) {
-        warehouses.insert(warehouse);
-    }
-
-    public void insertLocation(WarehouseLocationEntity location) {
-        locations.insert(location);
-    }
-
-    public boolean existsLocationCode(long customerId, long warehouseId, String locationCode) {
-        return locations.selectCount(new LambdaQueryWrapper<WarehouseLocationEntity>()
-            .eq(WarehouseLocationEntity::getCustomerId, customerId)
-            .eq(WarehouseLocationEntity::getWarehouseId, warehouseId)
-            .eq(WarehouseLocationEntity::getLocationCode, locationCode)) > 0;
-    }
-
-    public void saveWarehouse(WarehouseEntity warehouse) {
-        warehouses.updateById(warehouse);
-    }
-
-    public WarehouseEntity findOwned(long customerId, long id) {
-        return warehouses.selectOne(new LambdaQueryWrapper<WarehouseEntity>()
-            .eq(WarehouseEntity::getCustomerId, customerId)
-            .eq(WarehouseEntity::getId, id));
-    }
-
-    public boolean existsCode(long customerId, String code, Long excludedId) {
-        return warehouses.selectCount(new LambdaQueryWrapper<WarehouseEntity>()
-            .eq(WarehouseEntity::getCustomerId, customerId)
-            .eq(WarehouseEntity::getWarehouseCode, code)
-            .ne(excludedId != null, WarehouseEntity::getId, excludedId)) > 0;
-    }
-
-    public PageResult<WarehouseEntity> page(long customerId, WarehouseRequests.QueryRequest query) {
-        LambdaQueryWrapper<WarehouseEntity> wrapper = new LambdaQueryWrapper<WarehouseEntity>()
-            .eq(WarehouseEntity::getCustomerId, customerId)
-            .eq(StringUtils.hasText(query.status()), WarehouseEntity::getStatus, query.status())
-            .eq(StringUtils.hasText(query.countryCode()), WarehouseEntity::getCountryCode, query.countryCode())
-            .orderByDesc(WarehouseEntity::getCreatedAt);
-
-        if (StringUtils.hasText(query.capabilityCode())) {
-            List<Long> ids = capabilities.selectList(new LambdaQueryWrapper<ServiceCapabilityEntity>()
-                    .select(ServiceCapabilityEntity::getWarehouseId)
-                    .eq(ServiceCapabilityEntity::getCustomerId, customerId)
-                    .eq(ServiceCapabilityEntity::getCapabilityCode, query.capabilityCode())
-                    .eq(ServiceCapabilityEntity::getEnabled, true))
-                .stream()
-                .map(ServiceCapabilityEntity::getWarehouseId)
-                .distinct()
-                .toList();
-            if (ids.isEmpty()) {
-                return new PageResult<>(List.of(), query.page(), query.size(), 0, 0);
-            }
-            wrapper.in(WarehouseEntity::getId, ids);
-        }
-        return PageResult.from(warehouses.selectPage(new Page<>(query.page(), query.size()), wrapper));
-    }
-
-    public PageResult<WarehouseEntity> pageAll(WarehouseRequests.QueryRequest query) {
-        LambdaQueryWrapper<WarehouseEntity> wrapper = new LambdaQueryWrapper<WarehouseEntity>()
-            .eq(query.customerId() != null, WarehouseEntity::getCustomerId, query.customerId())
-            .eq(StringUtils.hasText(query.status()), WarehouseEntity::getStatus, query.status())
-            .eq(StringUtils.hasText(query.countryCode()), WarehouseEntity::getCountryCode, query.countryCode())
-            .orderByDesc(WarehouseEntity::getCreatedAt);
-
-        if (StringUtils.hasText(query.capabilityCode())) {
-            List<Long> ids = capabilities.selectList(new LambdaQueryWrapper<ServiceCapabilityEntity>()
-                    .select(ServiceCapabilityEntity::getWarehouseId)
-                    .eq(query.customerId() != null, ServiceCapabilityEntity::getCustomerId, query.customerId())
-                    .eq(ServiceCapabilityEntity::getCapabilityCode, query.capabilityCode())
-                    .eq(ServiceCapabilityEntity::getEnabled, true))
-                .stream()
-                .map(ServiceCapabilityEntity::getWarehouseId)
-                .distinct()
-                .toList();
-            if (ids.isEmpty()) {
-                return new PageResult<>(List.of(), query.page(), query.size(), 0, 0);
-            }
-            wrapper.in(WarehouseEntity::getId, ids);
-        }
-        return PageResult.from(warehouses.selectPage(new Page<>(query.page(), query.size()), wrapper));
-    }
-
-    public List<WarehouseAddressEntity> findAddresses(long customerId, long warehouseId) {
-        return addresses.selectList(new LambdaQueryWrapper<WarehouseAddressEntity>()
-            .eq(WarehouseAddressEntity::getCustomerId, customerId)
-            .eq(WarehouseAddressEntity::getWarehouseId, warehouseId));
-    }
-
-    public List<ServiceCapabilityEntity> findCapabilities(long customerId, long warehouseId) {
-        return capabilities.selectList(new LambdaQueryWrapper<ServiceCapabilityEntity>()
-            .eq(ServiceCapabilityEntity::getCustomerId, customerId)
-            .eq(ServiceCapabilityEntity::getWarehouseId, warehouseId));
-    }
-
-    public void physicallyDeleteChildren(long customerId, long warehouseId) {
-        addresses.physicallyDeleteByWarehouse(customerId, warehouseId);
-        capabilities.physicallyDeleteByWarehouse(customerId, warehouseId);
-    }
-
-    public void insertAddress(WarehouseAddressEntity address) {
-        addresses.insert(address);
-    }
-
-    public void insertCapability(ServiceCapabilityEntity capability) {
-        capabilities.insert(capability);
-    }
-}
diff --git a/warehouse-overseas-service/src/main/java/com/baiyue/warehouse/repository/WarehouseResourceRepository.java b/warehouse-overseas-service/src/main/java/com/baiyue/warehouse/repository/WarehouseResourceRepository.java
index 7603cd9e6..32b854ea8 100644
--- a/warehouse-overseas-service/src/main/java/com/baiyue/warehouse/repository/WarehouseResourceRepository.java
+++ b/warehouse-overseas-service/src/main/java/com/baiyue/warehouse/repository/WarehouseResourceRepository.java
@@ -5,11 +5,9 @@ import com.baomidou.mybatisplus.extension.plugins.pagination.Page;
 import com.baiyue.common.core.api.PageResult;
 import com.baiyue.warehouse.dto.LocationRequests;
 import com.baiyue.warehouse.dto.PalletRequests;
-import com.baiyue.warehouse.entity.WarehouseEntity;
 import com.baiyue.warehouse.entity.WarehouseLocationEntity;
 import com.baiyue.warehouse.entity.WarehousePalletEntity;
 import com.baiyue.warehouse.mapper.WarehouseLocationMapper;
-import com.baiyue.warehouse.mapper.WarehouseMapper;
 import com.baiyue.warehouse.mapper.WarehousePalletMapper;
 import com.baiyue.warehouse.mapper.WarehousePalletBindingMapper;
 import com.baiyue.warehouse.entity.WarehousePalletBindingEntity;
@@ -21,7 +19,6 @@ import java.util.List;
 
 @Repository
 public class WarehouseResourceRepository {
-    @Resource private WarehouseMapper warehouses;
     @Resource private WarehouseLocationMapper locations;
     @Resource private WarehousePalletMapper pallets;
     @Resource private WarehousePalletBindingMapper bindings;
@@ -35,22 +32,6 @@ public class WarehouseResourceRepository {
         bindings.insert(entity);
     }
 
-    public boolean warehouseOwned(long customerId, long warehouseId) {
-        return warehouses.selectCount(new LambdaQueryWrapper<WarehouseEntity>()
-            .eq(WarehouseEntity::getCustomerId, customerId)
-            .eq(WarehouseEntity::getId, warehouseId)) > 0;
-    }
-
-    public WarehouseEntity findWarehouse(long customerId, long warehouseId) {
-        return warehouses.selectOne(new LambdaQueryWrapper<WarehouseEntity>()
-            .eq(WarehouseEntity::getCustomerId, customerId)
-            .eq(WarehouseEntity::getId, warehouseId));
-    }
-
-    public WarehouseEntity findWarehouseById(long warehouseId) {
-        return warehouses.selectById(warehouseId);
-    }
-
     public WarehouseLocationEntity findDefaultVirtualLocation(long customerId, long warehouseId) {
         return locations.selectOne(new LambdaQueryWrapper<WarehouseLocationEntity>()
             .eq(WarehouseLocationEntity::getCustomerId, customerId)
diff --git a/warehouse-overseas-service/src/main/java/com/baiyue/warehouse/service/DomesticWarehouseDirectory.java b/warehouse-overseas-service/src/main/java/com/baiyue/warehouse/service/DomesticWarehouseDirectory.java
new file mode 100644
index 000000000..8e4d6e408
--- /dev/null
+++ b/warehouse-overseas-service/src/main/java/com/baiyue/warehouse/service/DomesticWarehouseDirectory.java
@@ -0,0 +1,69 @@
+package com.baiyue.warehouse.service;
+
+import com.baiyue.common.core.api.ResultCode;
+import com.baiyue.common.core.exception.BizException;
+import com.baiyue.warehouse.client.DomesticWarehouseDirectoryClient;
+import com.baiyue.warehouse.dto.SharedWarehouseReference;
+import jakarta.annotation.Resource;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.stereotype.Component;
+import org.springframework.util.StringUtils;
+
+import java.time.Clock;
+import java.time.Duration;
+import java.time.Instant;
+import java.util.List;
+import java.util.concurrent.ConcurrentHashMap;
+
+@Component
+public class DomesticWarehouseDirectory {
+    @Resource private DomesticWarehouseDirectoryClient client;
+    @Value("${baiyue.security.internal-service-token:${baiyue.internal-service.token}}")
+    private String internalToken;
+    @Value("${baiyue.clients.domestic-warehouse.cache-ttl:30m}") private Duration ttl;
+    private final ConcurrentHashMap<Long, CachedWarehouse> cache = new ConcurrentHashMap<>();
+    private Clock clock = Clock.systemUTC();
+
+    public SharedWarehouseReference required(long warehouseId) {
+        CachedWarehouse current = cache.get(warehouseId);
+        Instant now = clock.instant();
+        if (current != null && now.isBefore(current.expiresAt())) return current.warehouse();
+        var response = client.activeSharedWarehouse(internalToken, warehouseId);
+        if (response == null || !response.successful() || response.data() == null
+            || !valid(response.data())) {
+            cache.remove(warehouseId);
+            throw new BizException(ResultCode.NOT_FOUND,
+                "启用的公共海外收货仓不存在");
+        }
+        SharedWarehouseReference warehouse = toReference(response.data());
+        cache.put(warehouseId, new CachedWarehouse(warehouse, now.plus(ttl)));
+        return warehouse;
+    }
+
+    public List<SharedWarehouseReference> options() {
+        var response = client.activeSharedWarehouses(internalToken);
+        if (response == null || !response.successful() || response.data() == null) {
+            throw new BizException(ResultCode.SERVICE_UNAVAILABLE, "国内仓库目录暂不可用");
+        }
+        List<SharedWarehouseReference> warehouses = response.data().stream()
+            .filter(this::valid).map(this::toReference).toList();
+        if (!warehouses.isEmpty()) {
+            Instant expiresAt = clock.instant().plus(ttl);
+            warehouses.forEach(value -> cache.put(value.warehouseId(), new CachedWarehouse(value, expiresAt)));
+        }
+        return warehouses;
+    }
+
+    private boolean valid(DomesticWarehouseDirectoryClient.WarehouseReference value) {
+        return value.warehouseId() != null && value.warehouseId() > 0
+            && StringUtils.hasText(value.warehouseCode())
+            && StringUtils.hasText(value.warehouseName()) && "ACTIVE".equals(value.status());
+    }
+
+    private SharedWarehouseReference toReference(DomesticWarehouseDirectoryClient.WarehouseReference value) {
+        return new SharedWarehouseReference(value.warehouseId(), value.warehouseCode().trim(),
+            value.warehouseName().trim(), value.status());
+    }
+
+    private record CachedWarehouse(SharedWarehouseReference warehouse, Instant expiresAt) { }
+}
diff --git a/warehouse-overseas-service/src/main/java/com/baiyue/warehouse/service/WarehouseApplicationService.java b/warehouse-overseas-service/src/main/java/com/baiyue/warehouse/service/WarehouseApplicationService.java
deleted file mode 100644
index 89b7ded73..000000000
--- a/warehouse-overseas-service/src/main/java/com/baiyue/warehouse/service/WarehouseApplicationService.java
+++ /dev/null
@@ -1,206 +0,0 @@
-package com.baiyue.warehouse.service;
-import jakarta.annotation.Resource;
-
-import com.baiyue.common.audit.BusinessAudit;
-import com.baiyue.common.core.api.PageResult;
-import com.baiyue.common.core.api.ResultCode;
-import com.baiyue.common.core.exception.BizException;
-import com.baiyue.warehouse.dto.WarehouseDetailResponse;
-import com.baiyue.warehouse.dto.WarehouseRequests;
-import com.baiyue.warehouse.dto.SharedWarehouseReference;
-import com.baiyue.warehouse.entity.ServiceCapabilityEntity;
-import com.baiyue.warehouse.entity.WarehouseAddressEntity;
-import com.baiyue.warehouse.entity.WarehouseEntity;
-import com.baiyue.warehouse.entity.WarehouseLocationEntity;
-import com.baiyue.warehouse.repository.WarehouseRepository;
-import org.springframework.stereotype.Service;
-import org.springframework.transaction.annotation.Transactional;
-
-import java.util.List;
-import java.math.BigDecimal;
-
-/**
- * 仓库应用服务，负责仓库主数据、地址和服务能力的租户级用例编排、事务控制与业务校验。
- */
-@Service
-public class WarehouseApplicationService {
-    @Resource
-    private WarehouseRepository repository;
-
-
-    @Transactional
-    @BusinessAudit(
-        event = "WAREHOUSE_CREATE",
-        resourceType = "WAREHOUSE",
-        resourceId = "#r.warehouseCode",
-        description = "新建仓库",
-        captureBefore = false
-    )
-    public Long create(WarehouseRequests.SaveRequest request) {
-        validateSharedWarehouse(request);
-        ensureCodeUnique(request.customerId(), request.warehouseCode(), null);
-        WarehouseEntity warehouse = toEntity(request);
-        repository.insertWarehouse(warehouse);
-        ensureDefaultVirtualLocation(warehouse);
-        insertChildren(warehouse.getCustomerId(), warehouse.getId(), request.address(), request.capabilities());
-        return warehouse.getId();
-    }
-
-    private void ensureDefaultVirtualLocation(WarehouseEntity warehouse) {
-        String locationCode = "LOC-" + warehouse.getWarehouseCode() + "-DEFAULT";
-        if (repository.existsLocationCode(warehouse.getCustomerId(), warehouse.getId(), locationCode)) {
-            return;
-        }
-        WarehouseLocationEntity location = new WarehouseLocationEntity();
-        location.setCustomerId(warehouse.getCustomerId());
-        location.setWarehouseId(warehouse.getId());
-        location.setZoneCode("DEFAULT");
-        location.setLocationCode(locationCode);
-        location.setLocationType("VIRTUAL");
-        location.setMaxLoadKg(new BigDecimal("999999999.000"));
-        location.setStatus("ACTIVE");
-        location.setRemark("System default virtual location");
-        repository.insertLocation(location);
-    }
-
-    @Transactional
-    @BusinessAudit(
-        event = "WAREHOUSE_UPDATE",
-        resourceType = "WAREHOUSE",
-        resourceId = "#id",
-        description = "更新仓库"
-    )
-    public void update(long customerId, long id, WarehouseRequests.SaveRequest request) {
-        if (request.customerId() == null || customerId != request.customerId()) {
-            throw new BizException(ResultCode.FORBIDDEN, "租户不匹配");
-        }
-        validateSharedWarehouse(request);
-        WarehouseEntity old = owned(customerId, id);
-        ensureCodeUnique(customerId, request.warehouseCode(), id);
-
-        WarehouseEntity warehouse = toEntity(request);
-        warehouse.setId(old.getId());
-        repository.saveWarehouse(warehouse);
-
-        repository.physicallyDeleteChildren(customerId, id);
-        insertChildren(customerId, id, request.address(), request.capabilities());
-    }
-
-    public PageResult<WarehouseEntity> page(long customerId, WarehouseRequests.QueryRequest query) {
-        return repository.page(customerId, query);
-    }
-
-    public PageResult<WarehouseEntity> pageAll(WarehouseRequests.QueryRequest query) {
-        return repository.pageAll(query);
-    }
-
-    public WarehouseDetailResponse detail(long customerId, long id) {
-        WarehouseEntity warehouse = owned(customerId, id);
-        List<WarehouseAddressEntity> addresses = repository.findAddresses(customerId, id);
-        List<ServiceCapabilityEntity> capabilities = repository.findCapabilities(customerId, id);
-        return new WarehouseDetailResponse(warehouse, addresses, capabilities);
-    }
-
-    public SharedWarehouseReference activeSharedReference(long warehouseId) {
-        WarehouseEntity warehouse = repository.findOwned(0L, warehouseId);
-        boolean receiving = warehouse != null && repository.findCapabilities(0L, warehouseId).stream()
-            .anyMatch(value -> "RECEIVING".equals(value.getCapabilityCode()) && Boolean.TRUE.equals(value.getEnabled()));
-        if (warehouse == null || !"ACTIVE".equals(warehouse.getStatus())
-            || !"OVERSEAS".equals(warehouse.getWarehouseType()) || !receiving) {
-            throw new BizException(ResultCode.NOT_FOUND, "Active shared overseas warehouse not found");
-        }
-        return new SharedWarehouseReference(warehouse.getId(), warehouse.getWarehouseCode(),
-            warehouse.getWarehouseName(), warehouse.getStatus());
-    }
-
-    private void validateSharedWarehouse(WarehouseRequests.SaveRequest request) {
-        if (request.customerId() == null || request.customerId() != 0L) return;
-        boolean receiving = request.capabilities() != null && request.capabilities().stream()
-            .anyMatch(value -> "RECEIVING".equals(value.capabilityCode())
-                && !Boolean.FALSE.equals(value.enabled()));
-        if (!"OVERSEAS".equals(request.warehouseType()) || !receiving) {
-            throw new BizException(ResultCode.BAD_REQUEST,
-                "Shared physical warehouse must be OVERSEAS with RECEIVING enabled");
-        }
-    }
-
-    @Transactional
-    @BusinessAudit(
-        event = "WAREHOUSE_STATUS_CHANGE",
-        resourceType = "WAREHOUSE",
-        resourceId = "#id",
-        description = "启用或停用仓库"
-    )
-    public void changeStatus(long customerId, long id, String status) {
-        if (!"ACTIVE".equals(status) && !"INACTIVE".equals(status)) {
-            throw new BizException("无效状态");
-        }
-        WarehouseEntity warehouse = owned(customerId, id);
-        warehouse.setStatus(status);
-        repository.saveWarehouse(warehouse);
-    }
-
-    private WarehouseEntity owned(long customerId, long id) {
-        WarehouseEntity warehouse = repository.findOwned(customerId, id);
-        if (warehouse == null) {
-            throw new BizException(ResultCode.NOT_FOUND, "仓库不存在");
-        }
-        return warehouse;
-    }
-
-    private void ensureCodeUnique(long customerId, String code, Long excludedId) {
-        if (repository.existsCode(customerId, code, excludedId)) {
-            throw new BizException(ResultCode.CONFLICT, "仓库编码已存在");
-        }
-    }
-
-    private WarehouseEntity toEntity(WarehouseRequests.SaveRequest request) {
-        WarehouseEntity warehouse = new WarehouseEntity();
-        warehouse.setCustomerId(request.customerId());
-        warehouse.setWarehouseCode(request.warehouseCode());
-        warehouse.setWarehouseName(request.warehouseName());
-        warehouse.setWarehouseType(request.warehouseType());
-        warehouse.setCountryCode(request.countryCode());
-        warehouse.setTimezone(request.timezone());
-        warehouse.setContactName(request.contactName());
-        warehouse.setContactPhone(request.contactPhone());
-        warehouse.setContactEmail(request.contactEmail());
-        warehouse.setStatus(request.status());
-        warehouse.setRemark(request.remark());
-        return warehouse;
-    }
-
-    private void insertChildren(long customerId, long warehouseId,
-                                WarehouseRequests.AddressRequest address,
-                                List<WarehouseRequests.CapabilityRequest> requestedCapabilities) {
-        WarehouseAddressEntity addressEntity = new WarehouseAddressEntity();
-        addressEntity.setCustomerId(customerId);
-        addressEntity.setWarehouseId(warehouseId);
-        addressEntity.setAddressType(address.addressType());
-        addressEntity.setCountryCode(address.countryCode());
-        addressEntity.setStateProvince(address.stateProvince());
-        addressEntity.setCity(address.city());
-        addressEntity.setDistrict(address.district());
-        addressEntity.setPostalCode(address.postalCode());
-        addressEntity.setAddressLine1(address.addressLine1());
-        addressEntity.setAddressLine2(address.addressLine2());
-        addressEntity.setLatitude(address.latitude());
-        addressEntity.setLongitude(address.longitude());
-        repository.insertAddress(addressEntity);
-
-        if (requestedCapabilities == null) {
-            return;
-        }
-        for (WarehouseRequests.CapabilityRequest capability : requestedCapabilities) {
-            ServiceCapabilityEntity entity = new ServiceCapabilityEntity();
-            entity.setCustomerId(customerId);
-            entity.setWarehouseId(warehouseId);
-            entity.setCapabilityCode(capability.capabilityCode());
-            entity.setCapabilityName(capability.capabilityName());
-            entity.setEnabled(capability.enabled() == null || capability.enabled());
-            entity.setCutoffTime(capability.cutoffTime());
-            entity.setDescription(capability.description());
-            repository.insertCapability(entity);
-        }
-    }
-}
diff --git a/warehouse-overseas-service/src/main/java/com/baiyue/warehouse/service/WarehouseResourceService.java b/warehouse-overseas-service/src/main/java/com/baiyue/warehouse/service/WarehouseResourceService.java
index 796d9890e..d44e16759 100644
--- a/warehouse-overseas-service/src/main/java/com/baiyue/warehouse/service/WarehouseResourceService.java
+++ b/warehouse-overseas-service/src/main/java/com/baiyue/warehouse/service/WarehouseResourceService.java
@@ -7,9 +7,9 @@ import com.baiyue.warehouse.dto.LocationRequests;
 import com.baiyue.warehouse.dto.PalletRequests;
 import com.baiyue.warehouse.dto.WarehousePalletResolveResponse;
 import com.baiyue.warehouse.dto.WarehouseLocationResolveResponse;
+import com.baiyue.warehouse.dto.SharedWarehouseReference;
 import com.baiyue.warehouse.entity.WarehouseLocationEntity;
 import com.baiyue.warehouse.entity.WarehousePalletEntity;
-import com.baiyue.warehouse.entity.WarehouseEntity;
 import com.baiyue.warehouse.entity.WarehousePalletBindingEntity;
 import com.baiyue.warehouse.repository.WarehouseResourceRepository;
 import com.baomidou.mybatisplus.core.toolkit.IdWorker;
@@ -29,6 +29,7 @@ public class WarehouseResourceService {
     private static final Set<String> PALLET_STATUSES = Set.of("IDLE", "OCCUPIED", "SCRAPPED");
 
     @Resource private WarehouseResourceRepository repository;
+    @Resource private DomesticWarehouseDirectory warehouseDirectory;
 
     @Transactional
     public Long createLocation(long customerId, long warehouseId, LocationRequests.SaveRequest request) {
@@ -78,11 +79,11 @@ public class WarehouseResourceService {
 
     @Transactional
     public Long createPallet(long customerId, long warehouseId, PalletRequests.SaveRequest request) {
-        WarehouseEntity warehouse = requireWarehouseEntity(customerId, warehouseId);
+        SharedWarehouseReference warehouse = requireWarehouseReference(warehouseId);
         validatePalletStatus(request.status());
         Long palletId = IdWorker.getId();
         String palletCode = StringUtils.hasText(request.palletCode()) ? request.palletCode().trim()
-            : generatedPalletCode(warehouse.getWarehouseCode(), palletId);
+            : generatedPalletCode(warehouse.warehouseCode(), palletId);
         Long locationId = request.locationId();
         if (locationId == null) {
             locationId = ensureDefaultVirtualLocation(customerId, warehouseId).getId();
@@ -121,8 +122,8 @@ public class WarehouseResourceService {
      */
     @Transactional
     public WarehouseLocationEntity ensureDefaultVirtualLocation(long customerId, long warehouseId) {
-        WarehouseEntity warehouse = requireWarehouseEntity(customerId, warehouseId);
-        String locationCode = defaultLocationCode(warehouse.getWarehouseCode());
+        SharedWarehouseReference warehouse = requireWarehouseReference(warehouseId);
+        String locationCode = defaultLocationCode(warehouse.warehouseCode());
         WarehouseLocationEntity existing = repository.findLocationByCode(customerId, warehouseId, locationCode);
         if (existing != null) {
             if (!"VIRTUAL".equals(existing.getLocationType()) || !"ACTIVE".equals(existing.getStatus())) {
@@ -230,24 +231,11 @@ public class WarehouseResourceService {
     }
 
     private void requireWarehouse(long customerId, long warehouseId) {
-        if (customerId == PUBLIC_RESOURCE_SCOPE) {
-            if (repository.findWarehouseById(warehouseId) == null) {
-                throw new BizException(ResultCode.NOT_FOUND, "Warehouse not found");
-            }
-            return;
-        }
-        if (!repository.warehouseOwned(customerId, warehouseId)) {
-            throw new BizException(ResultCode.NOT_FOUND, "当前租户下仓库不存在");
-        }
+        warehouseDirectory.required(warehouseId);
     }
 
-    private WarehouseEntity requireWarehouseEntity(long customerId, long warehouseId) {
-        WarehouseEntity warehouse = customerId == PUBLIC_RESOURCE_SCOPE
-            ? repository.findWarehouseById(warehouseId) : repository.findWarehouse(customerId, warehouseId);
-        if (warehouse == null) {
-            throw new BizException(ResultCode.NOT_FOUND, "Tenant warehouse not found");
-        }
-        return warehouse;
+    private SharedWarehouseReference requireWarehouseReference(long warehouseId) {
+        return warehouseDirectory.required(warehouseId);
     }
 
     private WarehouseLocationEntity requireLocation(long customerId, long warehouseId, long id) {
diff --git a/warehouse-overseas-service/src/main/resources/application.yml b/warehouse-overseas-service/src/main/resources/application.yml
index 212a72cae..d7387e408 100644
--- a/warehouse-overseas-service/src/main/resources/application.yml
+++ b/warehouse-overseas-service/src/main/resources/application.yml
@@ -38,6 +38,10 @@ spring:
 management.endpoints.web.exposure.include: health,info,prometheus
 
 baiyue:
+  clients:
+    domestic-warehouse:
+      url: ${DOMESTIC_WAREHOUSE_URL:}
+      cache-ttl: ${DOMESTIC_WAREHOUSE_CACHE_TTL:30m}
   internal-service:
     token: ${INTERNAL_SERVICE_TOKEN:phase1-local-internal-token-at-least-32-bytes}
   security:
diff --git a/warehouse-overseas-service/src/main/resources/db/warehouse.sql b/warehouse-overseas-service/src/main/resources/db/warehouse.sql
index 7665093d0..fd952af77 100644
--- a/warehouse-overseas-service/src/main/resources/db/warehouse.sql
+++ b/warehouse-overseas-service/src/main/resources/db/warehouse.sql
@@ -79,77 +79,8 @@ CREATE TABLE IF NOT EXISTS wh_resource_lock (
   KEY idx_resource_lock_business (customer_id, business_type, business_id)
 ) ENGINE=InnoDB COMMENT='仓储资源锁定记录';
 
-CREATE TABLE IF NOT EXISTS wh_warehouse (
-  id BIGINT UNSIGNED NOT NULL COMMENT '仓库ID（雪花ID）',
-  customer_id BIGINT UNSIGNED NOT NULL COMMENT '仓库所属租户ID',
-  warehouse_code VARCHAR(50) NOT NULL COMMENT '租户内唯一仓库编码',
-  warehouse_name VARCHAR(120) NOT NULL COMMENT '仓库名称',
-  warehouse_type VARCHAR(32) NOT NULL DEFAULT 'OVERSEAS' COMMENT '仓库类型',
-  country_code CHAR(2) NOT NULL COMMENT '所在国家二字码',
-  timezone VARCHAR(64) NOT NULL COMMENT '仓库所在地IANA时区',
-  contact_name VARCHAR(64) DEFAULT NULL COMMENT '仓库联系人',
-  contact_phone VARCHAR(32) DEFAULT NULL COMMENT '联系电话',
-  contact_email VARCHAR(128) DEFAULT NULL COMMENT '联系邮箱',
-  status VARCHAR(20) NOT NULL DEFAULT 'ACTIVE' COMMENT '仓库状态',
-  remark VARCHAR(500) DEFAULT NULL COMMENT '仓库备注',
-  created_by BIGINT UNSIGNED DEFAULT NULL COMMENT '创建人ID',
-  created_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) COMMENT '创建时间',
-  updated_by BIGINT UNSIGNED DEFAULT NULL COMMENT '最后修改人ID',
-  updated_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3) COMMENT '更新时间',
-  deleted TINYINT(1) NOT NULL DEFAULT 0 COMMENT '逻辑删除标记',
-  version INT NOT NULL DEFAULT 0 COMMENT '乐观锁版本号',
-  PRIMARY KEY (id),
-  UNIQUE KEY uk_wh_tenant_code (customer_id, warehouse_code, deleted),
-  KEY idx_wh_tenant_status (customer_id, status, deleted),
-  KEY idx_wh_country (customer_id, country_code, deleted)
-) ENGINE=InnoDB COMMENT='仓库主数据表：以租户为边界维护仓库编码、名称、国家、时区和启停状态';
-
-CREATE TABLE IF NOT EXISTS wh_warehouse_address (
-  id BIGINT UNSIGNED NOT NULL COMMENT '仓库地址ID',
-  customer_id BIGINT UNSIGNED NOT NULL COMMENT '数据所属租户ID',
-  warehouse_id BIGINT UNSIGNED NOT NULL COMMENT '所属仓库ID',
-  address_type VARCHAR(20) NOT NULL DEFAULT 'OPERATING' COMMENT '地址类型，例如OPERATING或RETURN',
-  country_code CHAR(2) NOT NULL COMMENT '国家二字码',
-  state_province VARCHAR(100) DEFAULT NULL COMMENT '省或州',
-  city VARCHAR(100) NOT NULL COMMENT '城市',
-  district VARCHAR(100) DEFAULT NULL COMMENT '区县',
-  postal_code VARCHAR(20) DEFAULT NULL COMMENT '邮政编码',
-  address_line1 VARCHAR(255) NOT NULL COMMENT '主地址行',
-  address_line2 VARCHAR(255) DEFAULT NULL COMMENT '补充地址行',
-  latitude DECIMAL(10,7) DEFAULT NULL COMMENT '纬度',
-  longitude DECIMAL(10,7) DEFAULT NULL COMMENT '经度',
-  created_by BIGINT UNSIGNED DEFAULT NULL COMMENT '创建人ID',
-  created_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) COMMENT '创建时间',
-  updated_by BIGINT UNSIGNED DEFAULT NULL COMMENT '最后修改人ID',
-  updated_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3) COMMENT '更新时间',
-  deleted TINYINT(1) NOT NULL DEFAULT 0 COMMENT '逻辑删除标记',
-  version INT NOT NULL DEFAULT 0 COMMENT '乐观锁版本号',
-  PRIMARY KEY (id),
-  UNIQUE KEY uk_address_type (customer_id, warehouse_id, address_type, deleted),
-  KEY idx_address_warehouse (customer_id, warehouse_id, deleted)
-) ENGINE=InnoDB COMMENT='仓库地址表：保存运营、退货等不同用途的地址及可选经纬度';
-
-CREATE TABLE IF NOT EXISTS wh_service_capability (
-  id BIGINT UNSIGNED NOT NULL COMMENT '服务能力ID',
-  customer_id BIGINT UNSIGNED NOT NULL COMMENT '数据所属租户ID',
-  warehouse_id BIGINT UNSIGNED NOT NULL COMMENT '所属仓库ID',
-  capability_code VARCHAR(50) NOT NULL COMMENT '能力编码：RECEIVING、STORAGE、PICK_PACK、RETURN等',
-  capability_name VARCHAR(100) NOT NULL COMMENT '能力名称',
-  enabled TINYINT(1) NOT NULL DEFAULT 1 COMMENT '是否启用',
-  cutoff_time TIME DEFAULT NULL COMMENT '当日作业截单时间',
-  description VARCHAR(500) DEFAULT NULL COMMENT '能力说明',
-  created_by BIGINT UNSIGNED DEFAULT NULL COMMENT '创建人ID',
-  created_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) COMMENT '创建时间',
-  updated_by BIGINT UNSIGNED DEFAULT NULL COMMENT '最后修改人ID',
-  updated_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3) COMMENT '更新时间',
-  deleted TINYINT(1) NOT NULL DEFAULT 0 COMMENT '逻辑删除标记',
-  version INT NOT NULL DEFAULT 0 COMMENT '乐观锁版本号',
-  PRIMARY KEY (id),
-  UNIQUE KEY uk_capability (customer_id, warehouse_id, capability_code, deleted),
-  KEY idx_capability_query (customer_id, warehouse_id, enabled, deleted)
-) ENGINE=InnoDB COMMENT='仓库服务能力表：声明仓库可提供的收货、仓储、拣包、退货等能力及截单时间';
-
--- 不使用跨服务数据库外键；仓库聚合内的归属由服务代码通过 customer_id 与 warehouse_id 共同校验。
+-- warehouse_id references the domestic warehouse-service authority. This overseas database does
+-- not duplicate warehouse master, address or capability tables and has no cross-database FK.
 
 -- 修复既有数据库中因历史脚本编码错误或英文初始化产生的表与字段注释。
 ALTER TABLE wh_location COMMENT='仓库库位表：按租户和仓库维护库位及承重信息';
@@ -192,18 +123,6 @@ CREATE TABLE IF NOT EXISTS wh_pallet_operation (
   KEY idx_wh_pallet_operation_pallet (warehouse_id,pallet_id,created_at)
 ) ENGINE=InnoDB COMMENT='实物托盘状态幂等变更与补偿记录';
 
--- Every warehouse has one non-occupiable virtual location used for inventory history.
-INSERT INTO wh_location (id, customer_id, warehouse_id, zone_code, location_code, location_type,
-                         max_load_kg, status, remark)
-SELECT UUID_SHORT(), w.customer_id, w.id, 'DEFAULT', CONCAT('LOC-', w.warehouse_code, '-DEFAULT'),
-       'VIRTUAL', 999999999.000, 'ACTIVE', 'System default virtual location'
-FROM wh_warehouse w
-WHERE NOT EXISTS (
-    SELECT 1 FROM wh_location l
-    WHERE l.customer_id = w.customer_id AND l.warehouse_id = w.id
-      AND l.location_code = CONCAT('LOC-', w.warehouse_code, '-DEFAULT') AND l.deleted = 0
-);
-
 ALTER TABLE wh_pallet COMMENT='仓库托盘表：按租户和仓库维护托盘、容量、单价及状态';
 ALTER TABLE wh_pallet
   MODIFY COLUMN id BIGINT UNSIGNED NOT NULL COMMENT '托盘ID（雪花ID）',
@@ -223,63 +142,3 @@ ALTER TABLE wh_pallet
   MODIFY COLUMN updated_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3) COMMENT '更新时间',
   MODIFY COLUMN deleted TINYINT(1) NOT NULL DEFAULT 0 COMMENT '逻辑删除标记',
   MODIFY COLUMN version INT NOT NULL DEFAULT 0 COMMENT '乐观锁版本号';
-
-ALTER TABLE wh_warehouse COMMENT='仓库主数据表：以租户为边界维护仓库编码、名称、国家、时区和启停状态';
-ALTER TABLE wh_warehouse
-  MODIFY COLUMN id BIGINT UNSIGNED NOT NULL COMMENT '仓库ID（雪花ID）',
-  MODIFY COLUMN customer_id BIGINT UNSIGNED NOT NULL COMMENT '仓库所属租户ID',
-  MODIFY COLUMN warehouse_code VARCHAR(50) NOT NULL COMMENT '租户内唯一仓库编码',
-  MODIFY COLUMN warehouse_name VARCHAR(120) NOT NULL COMMENT '仓库名称',
-  MODIFY COLUMN warehouse_type VARCHAR(32) NOT NULL DEFAULT 'OVERSEAS' COMMENT '仓库类型',
-  MODIFY COLUMN country_code CHAR(2) NOT NULL COMMENT '所在国家二字码',
-  MODIFY COLUMN timezone VARCHAR(64) NOT NULL COMMENT '仓库所在地IANA时区',
-  MODIFY COLUMN contact_name VARCHAR(64) NULL COMMENT '仓库联系人',
-  MODIFY COLUMN contact_phone VARCHAR(32) NULL COMMENT '联系电话',
-  MODIFY COLUMN contact_email VARCHAR(128) NULL COMMENT '联系邮箱',
-  MODIFY COLUMN status VARCHAR(20) NOT NULL DEFAULT 'ACTIVE' COMMENT '仓库状态',
-  MODIFY COLUMN remark VARCHAR(500) NULL COMMENT '仓库备注',
-  MODIFY COLUMN created_by BIGINT UNSIGNED NULL COMMENT '创建人ID',
-  MODIFY COLUMN created_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) COMMENT '创建时间',
-  MODIFY COLUMN updated_by BIGINT UNSIGNED NULL COMMENT '最后修改人ID',
-  MODIFY COLUMN updated_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3) COMMENT '更新时间',
-  MODIFY COLUMN deleted TINYINT(1) NOT NULL DEFAULT 0 COMMENT '逻辑删除标记',
-  MODIFY COLUMN version INT NOT NULL DEFAULT 0 COMMENT '乐观锁版本号';
-
-ALTER TABLE wh_warehouse_address COMMENT='仓库地址表：保存运营、退货等不同用途的地址及可选经纬度';
-ALTER TABLE wh_warehouse_address
-  MODIFY COLUMN id BIGINT UNSIGNED NOT NULL COMMENT '仓库地址ID',
-  MODIFY COLUMN customer_id BIGINT UNSIGNED NOT NULL COMMENT '数据所属租户ID',
-  MODIFY COLUMN warehouse_id BIGINT UNSIGNED NOT NULL COMMENT '所属仓库ID',
-  MODIFY COLUMN address_type VARCHAR(20) NOT NULL DEFAULT 'OPERATING' COMMENT '地址类型：OPERATING运营、RETURN退货',
-  MODIFY COLUMN country_code CHAR(2) NOT NULL COMMENT '国家二字码',
-  MODIFY COLUMN state_province VARCHAR(100) NULL COMMENT '省或州',
-  MODIFY COLUMN city VARCHAR(100) NOT NULL COMMENT '城市',
-  MODIFY COLUMN district VARCHAR(100) NULL COMMENT '区县',
-  MODIFY COLUMN postal_code VARCHAR(20) NULL COMMENT '邮政编码',
-  MODIFY COLUMN address_line1 VARCHAR(255) NOT NULL COMMENT '主地址行',
-  MODIFY COLUMN address_line2 VARCHAR(255) NULL COMMENT '补充地址行',
-  MODIFY COLUMN latitude DECIMAL(10,7) NULL COMMENT '纬度',
-  MODIFY COLUMN longitude DECIMAL(10,7) NULL COMMENT '经度',
-  MODIFY COLUMN created_by BIGINT UNSIGNED NULL COMMENT '创建人ID',
-  MODIFY COLUMN created_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) COMMENT '创建时间',
-  MODIFY COLUMN updated_by BIGINT UNSIGNED NULL COMMENT '最后修改人ID',
-  MODIFY COLUMN updated_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3) COMMENT '更新时间',
-  MODIFY COLUMN deleted TINYINT(1) NOT NULL DEFAULT 0 COMMENT '逻辑删除标记',
-  MODIFY COLUMN version INT NOT NULL DEFAULT 0 COMMENT '乐观锁版本号';
-
-ALTER TABLE wh_service_capability COMMENT='仓库服务能力表：声明仓库可提供的收货、仓储、拣包、退货等能力及截单时间';
-ALTER TABLE wh_service_capability
-  MODIFY COLUMN id BIGINT UNSIGNED NOT NULL COMMENT '服务能力ID',
-  MODIFY COLUMN customer_id BIGINT UNSIGNED NOT NULL COMMENT '数据所属租户ID',
-  MODIFY COLUMN warehouse_id BIGINT UNSIGNED NOT NULL COMMENT '所属仓库ID',
-  MODIFY COLUMN capability_code VARCHAR(50) NOT NULL COMMENT '能力编码：RECEIVING收货、STORAGE仓储、PICK_PACK拣包、RETURN退货',
-  MODIFY COLUMN capability_name VARCHAR(100) NOT NULL COMMENT '能力名称',
-  MODIFY COLUMN enabled TINYINT(1) NOT NULL DEFAULT 1 COMMENT '是否启用',
-  MODIFY COLUMN cutoff_time TIME NULL COMMENT '当日作业截单时间',
-  MODIFY COLUMN description VARCHAR(500) NULL COMMENT '能力说明',
-  MODIFY COLUMN created_by BIGINT UNSIGNED NULL COMMENT '创建人ID',
-  MODIFY COLUMN created_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) COMMENT '创建时间',
-  MODIFY COLUMN updated_by BIGINT UNSIGNED NULL COMMENT '最后修改人ID',
-  MODIFY COLUMN updated_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3) COMMENT '更新时间',
-  MODIFY COLUMN deleted TINYINT(1) NOT NULL DEFAULT 0 COMMENT '逻辑删除标记',
-  MODIFY COLUMN version INT NOT NULL DEFAULT 0 COMMENT '乐观锁版本号';
diff --git a/warehouse-overseas-service/src/test/java/com/baiyue/warehouse/controller/MerchantWarehouseControllerTest.java b/warehouse-overseas-service/src/test/java/com/baiyue/warehouse/controller/MerchantWarehouseControllerTest.java
deleted file mode 100644
index 2a5b57d42..000000000
--- a/warehouse-overseas-service/src/test/java/com/baiyue/warehouse/controller/MerchantWarehouseControllerTest.java
+++ /dev/null
@@ -1,36 +0,0 @@
-package com.baiyue.warehouse.controller;
-
-import com.baiyue.common.core.api.PageResult;
-import com.baiyue.common.security.AuthenticatedUser;
-import com.baiyue.warehouse.dto.WarehouseRequests;
-import com.baiyue.warehouse.service.WarehouseApplicationService;
-import org.junit.jupiter.api.Test;
-import org.springframework.test.util.ReflectionTestUtils;
-
-import java.util.List;
-import java.util.Set;
-
-import static org.mockito.Mockito.mock;
-import static org.mockito.Mockito.verify;
-import static org.mockito.Mockito.when;
-
-class MerchantWarehouseControllerTest {
-    @Test
-    void merchantPageIgnoresRequestedCustomerAndUsesAuthenticatedCustomer() {
-        WarehouseApplicationService service = mock(WarehouseApplicationService.class);
-        MerchantWarehouseController controller = new MerchantWarehouseController();
-        ReflectionTestUtils.setField(controller, "service", service);
-        WarehouseRequests.QueryRequest query = new WarehouseRequests.QueryRequest(
-            99999L, 1, 20, "US", null, "ACTIVE");
-        when(service.page(10001L, query)).thenReturn(new PageResult<>(List.of(), 1, 20, 0, 0));
-
-        controller.page(merchant(10001L), query);
-
-        verify(service).page(10001L, query);
-    }
-
-    private static AuthenticatedUser merchant(long customerId) {
-        return new AuthenticatedUser(1L, customerId, customerId, 1L,
-            "merchant", "MERCHANT", "WEB", Set.of());
-    }
-}
diff --git a/warehouse-overseas-service/src/test/java/com/baiyue/warehouse/controller/PlatformWarehouseControllerTest.java b/warehouse-overseas-service/src/test/java/com/baiyue/warehouse/controller/PlatformWarehouseControllerTest.java
deleted file mode 100644
index ac330716f..000000000
--- a/warehouse-overseas-service/src/test/java/com/baiyue/warehouse/controller/PlatformWarehouseControllerTest.java
+++ /dev/null
@@ -1,83 +0,0 @@
-package com.baiyue.warehouse.controller;
-
-import com.baiyue.common.core.api.PageResult;
-import com.baiyue.common.security.AuthenticatedUser;
-import com.baiyue.warehouse.dto.WarehouseRequests;
-import com.baiyue.warehouse.security.OverseasWarehousePermissions;
-import com.baiyue.warehouse.service.WarehouseApplicationService;
-import io.swagger.v3.oas.annotations.Operation;
-import io.swagger.v3.oas.annotations.media.Schema;
-import org.junit.jupiter.api.Test;
-import org.springframework.security.access.prepost.PreAuthorize;
-import org.springframework.test.util.ReflectionTestUtils;
-
-import java.util.List;
-import java.util.Set;
-
-import static org.mockito.Mockito.mock;
-import static org.mockito.Mockito.verify;
-import static org.mockito.Mockito.when;
-import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertTrue;
-
-class PlatformWarehouseControllerTest {
-    @Test
-    void platformPageAllowsWarehousePalletAndLocationListAuthorities() throws Exception {
-        PreAuthorize preAuthorize = PlatformWarehouseController.class
-            .getMethod("page", AuthenticatedUser.class, WarehouseRequests.QueryRequest.class)
-            .getAnnotation(PreAuthorize.class);
-
-        assertEquals("hasAnyAuthority('" + OverseasWarehousePermissions.WAREHOUSE_LIST + "', '"
-            + OverseasWarehousePermissions.PALLET_LIST + "', '" + OverseasWarehousePermissions.LOCATION_LIST + "')",
-            preAuthorize.value());
-    }
-
-    @Test
-    void platformPagePassesOptionalCustomerFilterToApplicationService() {
-        WarehouseApplicationService service = mock(WarehouseApplicationService.class);
-        PlatformWarehouseController controller = new PlatformWarehouseController();
-        ReflectionTestUtils.setField(controller, "service", service);
-        WarehouseRequests.QueryRequest query = new WarehouseRequests.QueryRequest(10001L, 1, 20, null, null, "ACTIVE");
-        when(service.pageAll(query)).thenReturn(new PageResult<>(List.of(), 1, 20, 0, 0));
-
-        controller.page(platform(), query);
-
-        verify(service).pageAll(query);
-    }
-
-    @Test
-    void platformPageOpenApiExposesOptionalCustomerScope() throws Exception {
-        var customerId = WarehouseRequests.QueryRequest.class.getRecordComponents()[0];
-        Schema schema = WarehouseRequests.QueryRequest.class.getDeclaredMethod("customerId")
-            .getAnnotation(Schema.class);
-        Operation operation = PlatformWarehouseController.class
-            .getMethod("page", AuthenticatedUser.class, WarehouseRequests.QueryRequest.class)
-            .getAnnotation(Operation.class);
-
-        assertEquals("customerId", customerId.getName());
-        assertEquals(Long.class, customerId.getType());
-        assertTrue(schema.nullable());
-        assertTrue(schema.description().contains("platform"));
-        assertTrue(operation.description().contains("customerId"));
-    }
-
-    @Test
-    void platformCanCreateSharedWarehouseInCustomerZeroScope() {
-        WarehouseApplicationService service = mock(WarehouseApplicationService.class);
-        PlatformWarehouseController controller = new PlatformWarehouseController();
-        ReflectionTestUtils.setField(controller, "service", service);
-        WarehouseRequests.AddressRequest address = new WarehouseRequests.AddressRequest(
-            "WAREHOUSE", "US", "CA", "Los Angeles", null, "90001", "1 Shared Ave", null, null, null);
-        WarehouseRequests.SaveRequest request = new WarehouseRequests.SaveRequest(0L, "SHARED-LAX", "Shared LAX",
-            "OVERSEAS", "US", "America/Los_Angeles", null, null, null, "ACTIVE", null, address,
-            List.of(new WarehouseRequests.CapabilityRequest("RECEIVING", "收货", true, null, null)));
-        when(service.create(request)).thenReturn(900L);
-
-        assertEquals(900L, controller.create(platform(), request).data());
-        verify(service).create(request);
-    }
-
-    private static AuthenticatedUser platform() {
-        return new AuthenticatedUser(1L, 0L, 0L, 1L, "operator", "PLATFORM", "WEB", Set.of());
-    }
-}
diff --git a/warehouse-overseas-service/src/test/java/com/baiyue/warehouse/mapper/WarehousePalletTransitionMapperContractTest.java b/warehouse-overseas-service/src/test/java/com/baiyue/warehouse/mapper/WarehousePalletTransitionMapperContractTest.java
new file mode 100644
index 000000000..06f4c4d57
--- /dev/null
+++ b/warehouse-overseas-service/src/test/java/com/baiyue/warehouse/mapper/WarehousePalletTransitionMapperContractTest.java
@@ -0,0 +1,32 @@
+package com.baiyue.warehouse.mapper;
+
+import org.apache.ibatis.annotations.Select;
+import org.apache.ibatis.annotations.Update;
+import org.junit.jupiter.api.Test;
+
+import java.lang.reflect.Method;
+import java.util.Arrays;
+
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+class WarehousePalletTransitionMapperContractTest {
+
+    @Test
+    void annotationSqlUsesNativeComparisonOperatorsInsteadOfXmlEntities() throws Exception {
+        Method locationQuery = WarehousePalletTransitionMapper.class.getMethod(
+            "countActiveLocation", long.class, long.class);
+        String selectSql = String.join(" ", locationQuery.getAnnotation(Select.class).value());
+
+        Method transition = Arrays.stream(WarehousePalletTransitionMapper.class.getMethods())
+            .filter(method -> method.getName().equals("transition"))
+            .findFirst()
+            .orElseThrow();
+        String updateSql = String.join(" ", transition.getAnnotation(Update.class).value());
+
+        assertTrue(selectSql.contains("status<>'INACTIVE'"));
+        assertTrue(updateSql.contains("status<>'SCRAPPED'"));
+        assertFalse(selectSql.contains("&lt;") || selectSql.contains("&gt;"));
+        assertFalse(updateSql.contains("&lt;") || updateSql.contains("&gt;"));
+    }
+}
diff --git a/warehouse-overseas-service/src/test/java/com/baiyue/warehouse/repository/WarehouseRepositoryTest.java b/warehouse-overseas-service/src/test/java/com/baiyue/warehouse/repository/WarehouseRepositoryTest.java
deleted file mode 100644
index 821981179..000000000
--- a/warehouse-overseas-service/src/test/java/com/baiyue/warehouse/repository/WarehouseRepositoryTest.java
+++ /dev/null
@@ -1,42 +0,0 @@
-package com.baiyue.warehouse.repository;
-
-import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
-import com.baomidou.mybatisplus.core.MybatisConfiguration;
-import com.baomidou.mybatisplus.core.metadata.TableInfoHelper;
-import com.baomidou.mybatisplus.extension.plugins.pagination.Page;
-import com.baiyue.warehouse.dto.WarehouseRequests;
-import com.baiyue.warehouse.entity.WarehouseEntity;
-import com.baiyue.warehouse.mapper.ServiceCapabilityMapper;
-import com.baiyue.warehouse.mapper.WarehouseMapper;
-import org.junit.jupiter.api.Test;
-import org.apache.ibatis.builder.MapperBuilderAssistant;
-import org.springframework.test.util.ReflectionTestUtils;
-
-import static org.assertj.core.api.Assertions.assertThat;
-import static org.mockito.ArgumentMatchers.any;
-import static org.mockito.Mockito.mock;
-import static org.mockito.Mockito.when;
-
-class WarehouseRepositoryTest {
-    @SuppressWarnings({"unchecked", "rawtypes"})
-    @Test
-    void platformPageAllFiltersByOptionalCustomerId() {
-        WarehouseMapper warehouses = mock(WarehouseMapper.class);
-        WarehouseRepository repository = new WarehouseRepository();
-        ReflectionTestUtils.setField(repository, "warehouses", warehouses);
-        ReflectionTestUtils.setField(repository, "capabilities", mock(ServiceCapabilityMapper.class));
-        TableInfoHelper.initTableInfo(
-            new MapperBuilderAssistant(new MybatisConfiguration(), "warehouse-overseas-query-test"),
-            WarehouseEntity.class);
-        when(warehouses.selectPage(any(Page.class), any(LambdaQueryWrapper.class)))
-            .thenReturn(new Page<WarehouseEntity>(1, 20));
-
-        repository.pageAll(new WarehouseRequests.QueryRequest(10001L, 1, 20, "US", null, "ACTIVE"));
-
-        var queryCaptor = org.mockito.ArgumentCaptor.forClass(LambdaQueryWrapper.class);
-        org.mockito.Mockito.verify(warehouses).selectPage(any(Page.class), queryCaptor.capture());
-        LambdaQueryWrapper<WarehouseEntity> query = queryCaptor.getValue();
-        assertThat(query.getSqlSegment()).contains("customer_id");
-        assertThat(query.getParamNameValuePairs()).containsValue(10001L);
-    }
-}
diff --git a/warehouse-overseas-service/src/test/java/com/baiyue/warehouse/schema/SchemaChineseCommentContractTest.java b/warehouse-overseas-service/src/test/java/com/baiyue/warehouse/schema/SchemaChineseCommentContractTest.java
index 678cdbb21..040873e9e 100644
--- a/warehouse-overseas-service/src/test/java/com/baiyue/warehouse/schema/SchemaChineseCommentContractTest.java
+++ b/warehouse-overseas-service/src/test/java/com/baiyue/warehouse/schema/SchemaChineseCommentContractTest.java
@@ -29,7 +29,10 @@ class SchemaChineseCommentContractTest {
             Path.of("..", "scripts", "db", "incremental.sql"), StandardCharsets.UTF_8);
 
         List<TableDefinition> tables = parseAndAssert(baseline, "仓储基线 SQL");
-        assertEquals(8, tables.size(), "仓储表数量变化时必须同步表索引和备注迁移");
+        assertEquals(5, tables.size(), "海外仓资源表数量变化时必须同步表索引和备注迁移");
+        assertFalse(baseline.contains("CREATE TABLE IF NOT EXISTS wh_warehouse ("));
+        assertFalse(baseline.contains("CREATE TABLE IF NOT EXISTS wh_warehouse_address ("));
+        assertFalse(baseline.contains("CREATE TABLE IF NOT EXISTS wh_service_capability ("));
         parseAndAssert(incremental, "统一增量 SQL");
 
         int marker = incremental.indexOf("2026-08-18 / 025 Chinese table and column comments");
diff --git a/warehouse-overseas-service/src/test/java/com/baiyue/warehouse/schema/WarehouseUnifiedIncrementalContractTest.java b/warehouse-overseas-service/src/test/java/com/baiyue/warehouse/schema/WarehouseUnifiedIncrementalContractTest.java
index 0492c6281..8c5aee650 100644
--- a/warehouse-overseas-service/src/test/java/com/baiyue/warehouse/schema/WarehouseUnifiedIncrementalContractTest.java
+++ b/warehouse-overseas-service/src/test/java/com/baiyue/warehouse/schema/WarehouseUnifiedIncrementalContractTest.java
@@ -16,6 +16,9 @@ class WarehouseUnifiedIncrementalContractTest {
             Path.of("..", "deploy", "sql", "海外区域统一增量-MySQL8.sql"), StandardCharsets.UTF_8);
 
         assertTrue(sql.contains("USE baiyue_lastlag_warehouse"));
+        assertTrue(sql.contains("DROP TABLE IF EXISTS wh_service_capability"));
+        assertTrue(sql.contains("DROP TABLE IF EXISTS wh_warehouse_address"));
+        assertTrue(sql.contains("DROP TABLE IF EXISTS wh_warehouse"));
         assertTrue(sql.contains("ALTER TABLE wh_pallet ADD COLUMN fba_warehouse_code VARCHAR(128) NULL"));
         assertTrue(sql.contains("@warehouse_pallet_fba_ready"));
         assertTrue(sql.contains("wh_pallet.fba_warehouse_code migration is incomplete"));
diff --git a/warehouse-overseas-service/src/test/java/com/baiyue/warehouse/service/DomesticWarehouseDirectoryTest.java b/warehouse-overseas-service/src/test/java/com/baiyue/warehouse/service/DomesticWarehouseDirectoryTest.java
new file mode 100644
index 000000000..09b71f950
--- /dev/null
+++ b/warehouse-overseas-service/src/test/java/com/baiyue/warehouse/service/DomesticWarehouseDirectoryTest.java
@@ -0,0 +1,63 @@
+package com.baiyue.warehouse.service;
+
+import com.baiyue.common.core.api.ApiResponse;
+import com.baiyue.common.core.exception.BizException;
+import com.baiyue.warehouse.client.DomesticWarehouseDirectoryClient;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+import org.springframework.test.util.ReflectionTestUtils;
+
+import java.time.Duration;
+import java.util.List;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
+import static org.mockito.Mockito.times;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+@ExtendWith(MockitoExtension.class)
+class DomesticWarehouseDirectoryTest {
+    @Mock DomesticWarehouseDirectoryClient client;
+    private DomesticWarehouseDirectory directory;
+
+    @BeforeEach
+    void setUp() {
+        directory = new DomesticWarehouseDirectory();
+        ReflectionTestUtils.setField(directory, "client", client);
+        ReflectionTestUtils.setField(directory, "internalToken", "internal-token");
+        ReflectionTestUtils.setField(directory, "ttl", Duration.ofMinutes(30));
+    }
+
+    @Test
+    void cachesPositiveWarehouseForThirtyMinutes() {
+        var warehouse = new DomesticWarehouseDirectoryClient.WarehouseReference(
+            92L, "US-LAX-01", "Los Angeles", "US", "ACTIVE");
+        when(client.activeSharedWarehouse("internal-token", 92L))
+            .thenReturn(ApiResponse.success(warehouse));
+
+        assertThat(directory.required(92L)).isEqualTo(directory.required(92L));
+        verify(client, times(1)).activeSharedWarehouse("internal-token", 92L);
+    }
+
+    @Test
+    void doesNotCacheMissingWarehouse() {
+        when(client.activeSharedWarehouse("internal-token", 93L))
+            .thenReturn(ApiResponse.success(null));
+
+        assertThatThrownBy(() -> directory.required(93L)).isInstanceOf(BizException.class);
+        assertThatThrownBy(() -> directory.required(93L)).isInstanceOf(BizException.class);
+        verify(client, times(2)).activeSharedWarehouse("internal-token", 93L);
+    }
+
+    @Test
+    void emptyOptionDirectoryDoesNotCreatePositiveCacheEntries() {
+        when(client.activeSharedWarehouses("internal-token"))
+            .thenReturn(ApiResponse.success(List.of()));
+
+        assertThat(directory.options()).isEmpty();
+    }
+}
diff --git a/warehouse-overseas-service/src/test/java/com/baiyue/warehouse/service/WarehouseApplicationServiceTest.java b/warehouse-overseas-service/src/test/java/com/baiyue/warehouse/service/WarehouseApplicationServiceTest.java
deleted file mode 100644
index 37699e071..000000000
--- a/warehouse-overseas-service/src/test/java/com/baiyue/warehouse/service/WarehouseApplicationServiceTest.java
+++ /dev/null
@@ -1,109 +0,0 @@
-package com.baiyue.warehouse.service;
-
-import com.baiyue.warehouse.dto.WarehouseRequests;
-import com.baiyue.warehouse.entity.WarehouseEntity;
-import com.baiyue.warehouse.entity.WarehouseLocationEntity;
-import com.baiyue.warehouse.entity.ServiceCapabilityEntity;
-import com.baiyue.common.core.exception.BizException;
-import com.baiyue.warehouse.repository.WarehouseRepository;
-import org.junit.jupiter.api.BeforeEach;
-import org.junit.jupiter.api.Test;
-import org.junit.jupiter.api.extension.ExtendWith;
-import org.mockito.ArgumentCaptor;
-import org.mockito.Mock;
-import org.mockito.junit.jupiter.MockitoExtension;
-import org.springframework.test.util.ReflectionTestUtils;
-
-import java.util.List;
-
-import static org.assertj.core.api.Assertions.assertThat;
-import static org.assertj.core.api.Assertions.assertThatThrownBy;
-import static org.mockito.ArgumentMatchers.any;
-import static org.mockito.Mockito.doAnswer;
-import static org.mockito.Mockito.verify;
-import static org.mockito.Mockito.when;
-
-@ExtendWith(MockitoExtension.class)
-class WarehouseApplicationServiceTest {
-    @Mock WarehouseRepository repository;
-    private WarehouseApplicationService service;
-
-    @BeforeEach
-    void setUp() {
-        service = new WarehouseApplicationService();
-        ReflectionTestUtils.setField(service, "repository", repository);
-    }
-
-    @Test
-    void warehouseCreationAlsoCreatesActiveDefaultVirtualLocation() {
-        doAnswer(call -> {
-            ((WarehouseEntity) call.getArgument(0)).setId(20001L);
-            return null;
-        }).when(repository).insertWarehouse(any());
-
-        service.create(request());
-
-        ArgumentCaptor<WarehouseLocationEntity> location = ArgumentCaptor.forClass(WarehouseLocationEntity.class);
-        verify(repository).insertLocation(location.capture());
-        assertThat(location.getValue().getCustomerId()).isEqualTo(10001L);
-        assertThat(location.getValue().getWarehouseId()).isEqualTo(20001L);
-        assertThat(location.getValue().getLocationCode()).isEqualTo("LOC-US-LAX-01-DEFAULT");
-        assertThat(location.getValue().getLocationType()).isEqualTo("VIRTUAL");
-        assertThat(location.getValue().getStatus()).isEqualTo("ACTIVE");
-    }
-
-    @Test
-    void platformWarehousePagePassesCustomerScopedQueryToRepository() {
-        WarehouseRequests.QueryRequest query = new WarehouseRequests.QueryRequest(10001L, 1, 20, "US", null, "ACTIVE");
-        when(repository.pageAll(query)).thenReturn(new com.baiyue.common.core.api.PageResult<>(List.of(), 1, 20, 0, 0));
-
-        service.pageAll(query);
-
-        verify(repository).pageAll(query);
-    }
-
-    @Test
-    void sharedReceivingWarehouseMustBeOverseasAndResolvesCanonicalReference() {
-        WarehouseRequests.SaveRequest shared = sharedRequest("OVERSEAS", true);
-        doAnswer(call -> { ((WarehouseEntity) call.getArgument(0)).setId(900L); return null; })
-            .when(repository).insertWarehouse(any());
-
-        assertThat(service.create(shared)).isEqualTo(900L);
-
-        WarehouseEntity warehouse = new WarehouseEntity(); warehouse.setId(900L); warehouse.setCustomerId(0L);
-        warehouse.setWarehouseCode("SHARED-LAX"); warehouse.setWarehouseName("Shared LAX");
-        warehouse.setWarehouseType("OVERSEAS"); warehouse.setStatus("ACTIVE");
-        ServiceCapabilityEntity receiving = new ServiceCapabilityEntity();
-        receiving.setCapabilityCode("RECEIVING"); receiving.setEnabled(true);
-        when(repository.findOwned(0L, 900L)).thenReturn(warehouse);
-        when(repository.findCapabilities(0L, 900L)).thenReturn(List.of(receiving));
-
-        assertThat(service.activeSharedReference(900L).warehouseName()).isEqualTo("Shared LAX");
-    }
-
-    @Test
-    void sharedWarehouseRejectsNonOverseasOrMissingReceivingCapability() {
-        assertThatThrownBy(() -> service.create(sharedRequest("FBA", true))).isInstanceOf(BizException.class);
-        assertThatThrownBy(() -> service.create(sharedRequest("OVERSEAS", false))).isInstanceOf(BizException.class);
-    }
-
-    private static WarehouseRequests.SaveRequest request() {
-        WarehouseRequests.AddressRequest address = new WarehouseRequests.AddressRequest(
-            "WAREHOUSE", "US", "CA", "Los Angeles", null, "90001",
-            "1 Logistics Ave", null, null, null);
-        return new WarehouseRequests.SaveRequest(10001L, "US-LAX-01", "LAX Warehouse",
-            "OVERSEAS", "US", "America/Los_Angeles", null, null, null,
-            "ACTIVE", null, address, List.of());
-    }
-
-    private static WarehouseRequests.SaveRequest sharedRequest(String type, boolean receiving) {
-        WarehouseRequests.AddressRequest address = new WarehouseRequests.AddressRequest(
-            "WAREHOUSE", "US", "CA", "Los Angeles", null, "90001",
-            "1 Logistics Ave", null, null, null);
-        List<WarehouseRequests.CapabilityRequest> capabilities = receiving
-            ? List.of(new WarehouseRequests.CapabilityRequest("RECEIVING", "收货", true, null, null))
-            : List.of();
-        return new WarehouseRequests.SaveRequest(0L, "SHARED-LAX", "Shared LAX", type,
-            "US", "America/Los_Angeles", null, null, null, "ACTIVE", null, address, capabilities);
-    }
-}
diff --git a/warehouse-overseas-service/src/test/java/com/baiyue/warehouse/service/WarehouseResourceServiceTest.java b/warehouse-overseas-service/src/test/java/com/baiyue/warehouse/service/WarehouseResourceServiceTest.java
index 5907572f9..c56bcbd9e 100644
--- a/warehouse-overseas-service/src/test/java/com/baiyue/warehouse/service/WarehouseResourceServiceTest.java
+++ b/warehouse-overseas-service/src/test/java/com/baiyue/warehouse/service/WarehouseResourceServiceTest.java
@@ -7,7 +7,7 @@ import com.baiyue.warehouse.dto.LocationRequests;
 import com.baiyue.warehouse.dto.PalletRequests;
 import com.baiyue.warehouse.entity.WarehouseLocationEntity;
 import com.baiyue.warehouse.entity.WarehousePalletEntity;
-import com.baiyue.warehouse.entity.WarehouseEntity;
+import com.baiyue.warehouse.dto.SharedWarehouseReference;
 import com.baiyue.warehouse.repository.WarehouseResourceRepository;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
@@ -33,6 +33,8 @@ class WarehouseResourceServiceTest {
 
     @Mock
     private WarehouseResourceRepository repository;
+    @Mock
+    private DomesticWarehouseDirectory warehouseDirectory;
 
     private WarehouseResourceService service;
 
@@ -40,6 +42,9 @@ class WarehouseResourceServiceTest {
     void setUp() {
         service = new WarehouseResourceService();
         ReflectionTestUtils.setField(service, "repository", repository);
+        ReflectionTestUtils.setField(service, "warehouseDirectory", warehouseDirectory);
+        org.mockito.Mockito.lenient().when(warehouseDirectory.required(WAREHOUSE))
+            .thenReturn(warehouse());
     }
 
     @Test
@@ -65,7 +70,6 @@ class WarehouseResourceServiceTest {
 
     @Test
     void createsLocationWithSnowflakeAssignedByMapper() {
-        when(repository.warehouseOwned(TENANT, WAREHOUSE)).thenReturn(true);
         doAnswer(invocation -> {
             ((WarehouseLocationEntity) invocation.getArgument(0)).setId(2089000000000000001L);
             return null;
@@ -82,8 +86,6 @@ class WarehouseResourceServiceTest {
 
     @Test
     void platformPalletUsesPublicScopeAgainstAnyExistingWarehouse() {
-        WarehouseEntity warehouse = warehouse();
-        when(repository.findWarehouseById(WAREHOUSE)).thenReturn(warehouse);
         WarehouseLocationEntity location = new WarehouseLocationEntity();
         location.setId(30001L);
         when(repository.findLocation(0L, WAREHOUSE, 30001L)).thenReturn(location);
@@ -99,7 +101,8 @@ class WarehouseResourceServiceTest {
 
     @Test
     void rejectsResourceAccessWhenWarehouseDoesNotBelongToTenant() {
-        when(repository.warehouseOwned(TENANT, WAREHOUSE)).thenReturn(false);
+        when(warehouseDirectory.required(WAREHOUSE)).thenThrow(new BizException(
+            com.baiyue.common.core.api.ResultCode.NOT_FOUND, "仓库不存在"));
 
         assertThatThrownBy(() -> service.createLocation(TENANT, WAREHOUSE, locationRequest("A-01")))
             .isInstanceOf(BizException.class)
@@ -109,7 +112,6 @@ class WarehouseResourceServiceTest {
 
     @Test
     void rejectsDuplicateLocationCodeWithinWarehouse() {
-        when(repository.warehouseOwned(TENANT, WAREHOUSE)).thenReturn(true);
         when(repository.locationCodeExists(TENANT, WAREHOUSE, "A-01", null)).thenReturn(true);
 
         assertThatThrownBy(() -> service.createLocation(TENANT, WAREHOUSE, locationRequest("A-01")))
@@ -119,8 +121,6 @@ class WarehouseResourceServiceTest {
 
     @Test
     void palletDefaultsToTwoCubicMetresAndBindsOwnedLocation() {
-        when(repository.warehouseOwned(TENANT, WAREHOUSE)).thenReturn(true);
-        when(repository.findWarehouse(TENANT, WAREHOUSE)).thenReturn(warehouse());
         WarehouseLocationEntity location = new WarehouseLocationEntity();
         location.setId(30001L);
         when(repository.findLocation(TENANT, WAREHOUSE, 30001L)).thenReturn(location);
@@ -142,8 +142,6 @@ class WarehouseResourceServiceTest {
 
     @Test
     void rejectsLocationFromAnotherWarehouseWhenBindingPallet() {
-        when(repository.warehouseOwned(TENANT, WAREHOUSE)).thenReturn(true);
-        when(repository.findWarehouse(TENANT, WAREHOUSE)).thenReturn(warehouse());
         when(repository.findLocation(TENANT, WAREHOUSE, 30002L)).thenReturn(null);
 
         assertThatThrownBy(() -> service.createPallet(TENANT, WAREHOUSE,
@@ -156,7 +154,6 @@ class WarehouseResourceServiceTest {
 
     @Test
     void preventsDeletingLocationThatStillHasPallets() {
-        when(repository.warehouseOwned(TENANT, WAREHOUSE)).thenReturn(true);
         when(repository.findLocation(TENANT, WAREHOUSE, 30001L)).thenReturn(new WarehouseLocationEntity());
         when(repository.locationHasPallets(TENANT, WAREHOUSE, 30001L)).thenReturn(true);
 
@@ -168,7 +165,6 @@ class WarehouseResourceServiceTest {
 
     @Test
     void preventsDeletingOccupiedPallet() {
-        when(repository.warehouseOwned(TENANT, WAREHOUSE)).thenReturn(true);
         WarehousePalletEntity pallet = new WarehousePalletEntity();
         pallet.setStatus("OCCUPIED");
         when(repository.findPallet(TENANT, WAREHOUSE, 40001L)).thenReturn(pallet);
@@ -181,7 +177,6 @@ class WarehouseResourceServiceTest {
 
     @Test
     void preventsDeletingScrappedPalletSoItsIdentityCannotBeReused() {
-        when(repository.warehouseOwned(TENANT, WAREHOUSE)).thenReturn(true);
         WarehousePalletEntity pallet = new WarehousePalletEntity();
         pallet.setStatus("SCRAPPED");
         when(repository.findPallet(TENANT, WAREHOUSE, 40003L)).thenReturn(pallet);
@@ -194,7 +189,6 @@ class WarehouseResourceServiceTest {
 
     @Test
     void rejectsUnknownPalletStatus() {
-        when(repository.findWarehouse(TENANT, WAREHOUSE)).thenReturn(warehouse());
 
         assertThatThrownBy(() -> service.createPallet(TENANT, WAREHOUSE,
             new PalletRequests.SaveRequest("PLT-01", "STANDARD", null,
@@ -210,14 +204,12 @@ class WarehouseResourceServiceTest {
 
     @Test
     void generatesRestartSafePalletCodeAndUsesDefaultVirtualLocation() {
-        when(repository.findWarehouse(TENANT, WAREHOUSE)).thenReturn(warehouse());
         WarehouseLocationEntity location = new WarehouseLocationEntity();
         location.setId(30003L);
         location.setLocationType("VIRTUAL");
         location.setStatus("ACTIVE");
         when(repository.findLocationByCode(TENANT, WAREHOUSE, "LOC-US-LAX-01-DEFAULT"))
             .thenReturn(location);
-        when(repository.warehouseOwned(TENANT, WAREHOUSE)).thenReturn(true);
         when(repository.findLocation(TENANT, WAREHOUSE, 30003L)).thenReturn(location);
 
         service.createPallet(TENANT, WAREHOUSE,
@@ -232,7 +224,6 @@ class WarehouseResourceServiceTest {
 
     @Test
     void defaultVirtualLocationIsInsertedIdempotentlyForAnExistingWarehouse() {
-        when(repository.findWarehouse(TENANT, WAREHOUSE)).thenReturn(warehouse());
         WarehouseLocationEntity resolved = new WarehouseLocationEntity();
         resolved.setId(30004L);
         resolved.setLocationType("VIRTUAL");
@@ -252,7 +243,6 @@ class WarehouseResourceServiceTest {
 
     @Test
     void rejectsAConflictingDefaultLocationCode() {
-        when(repository.findWarehouse(TENANT, WAREHOUSE)).thenReturn(warehouse());
         WarehouseLocationEntity conflict = new WarehouseLocationEntity();
         conflict.setLocationType("STORAGE");
         conflict.setStatus("ACTIVE");
@@ -267,7 +257,6 @@ class WarehouseResourceServiceTest {
 
     @Test
     void scrappedPalletCannotBeReactivated() {
-        when(repository.warehouseOwned(TENANT, WAREHOUSE)).thenReturn(true);
         WarehousePalletEntity existing = new WarehousePalletEntity();
         existing.setId(40002L);
         existing.setPalletCode("PLT-OLD");
@@ -283,7 +272,6 @@ class WarehouseResourceServiceTest {
 
     @Test
     void updatePalletChangesCodeAndFbaWarehouseCode() {
-        when(repository.warehouseOwned(TENANT, WAREHOUSE)).thenReturn(true);
         WarehousePalletEntity existing = new WarehousePalletEntity();
         existing.setId(40003L);
         existing.setPalletCode("PLT-OLD");
@@ -306,7 +294,6 @@ class WarehouseResourceServiceTest {
 
     @Test
     void updatePalletRejectsDuplicateCodeInSameWarehouse() {
-        when(repository.warehouseOwned(TENANT, WAREHOUSE)).thenReturn(true);
         WarehousePalletEntity existing = new WarehousePalletEntity();
         existing.setId(40004L);
         existing.setPalletCode("PLT-OLD");
@@ -325,7 +312,6 @@ class WarehouseResourceServiceTest {
 
     @Test
     void updatePalletRejectsStaleVersionBeforeMutation() {
-        when(repository.warehouseOwned(TENANT, WAREHOUSE)).thenReturn(true);
         WarehousePalletEntity existing = new WarehousePalletEntity();
         existing.setId(40005L);
         existing.setPalletCode("PLT-OLD");
@@ -344,11 +330,7 @@ class WarehouseResourceServiceTest {
         verify(repository, never()).updatePallet(org.mockito.ArgumentMatchers.any());
     }
 
-    private static WarehouseEntity warehouse() {
-        WarehouseEntity warehouse = new WarehouseEntity();
-        warehouse.setId(WAREHOUSE);
-        warehouse.setCustomerId(TENANT);
-        warehouse.setWarehouseCode("US-LAX-01");
-        return warehouse;
+    private static SharedWarehouseReference warehouse() {
+        return new SharedWarehouseReference(WAREHOUSE, "US-LAX-01", "Los Angeles", "ACTIVE");
     }
 }
diff --git a/warehouse/src/main/java/com/baiyue/warehouse/controller/InternalWarehouseController.java b/warehouse/src/main/java/com/baiyue/warehouse/controller/InternalWarehouseController.java
index e0f9c4b62..5cb2fce13 100644
--- a/warehouse/src/main/java/com/baiyue/warehouse/controller/InternalWarehouseController.java
+++ b/warehouse/src/main/java/com/baiyue/warehouse/controller/InternalWarehouseController.java
@@ -5,6 +5,7 @@ import com.baiyue.common.core.api.ResultCode;
 import com.baiyue.common.core.exception.BizException;
 import com.baiyue.warehouse.dto.WarehouseDetailResponse;
 import com.baiyue.warehouse.dto.OverseasPartnerWarehouseResponse;
+import com.baiyue.warehouse.dto.SharedOverseasWarehouseResponse;
 import com.baiyue.warehouse.service.WarehouseApplicationService;
 import jakarta.annotation.Resource;
 import jakarta.annotation.PostConstruct;
@@ -48,6 +49,21 @@ public class InternalWarehouseController {
         return ApiResponse.success(service.activeOverseasPartners());
     }
 
+    @GetMapping("/shared-overseas")
+    public ApiResponse<List<SharedOverseasWarehouseResponse>> sharedOverseasWarehouses(
+            @RequestHeader(value="X-Internal-Service-Token", required=false) String token) {
+        verifyToken(token);
+        return ApiResponse.success(service.activeSharedOverseasWarehouses());
+    }
+
+    @GetMapping("/shared-overseas/{warehouseId}")
+    public ApiResponse<SharedOverseasWarehouseResponse> sharedOverseasWarehouse(
+            @RequestHeader(value="X-Internal-Service-Token", required=false) String token,
+            @PathVariable long warehouseId) {
+        verifyToken(token);
+        return ApiResponse.success(service.activeSharedOverseasWarehouse(warehouseId));
+    }
+
     private void verifyToken(String token) {
         byte[] supplied = token == null ? new byte[0] : token.getBytes(StandardCharsets.UTF_8);
         if (!MessageDigest.isEqual(expected, supplied)) {
diff --git a/warehouse/src/main/java/com/baiyue/warehouse/dto/MasterDataQueries.java b/warehouse/src/main/java/com/baiyue/warehouse/dto/MasterDataQueries.java
index bc845596b..2f4e5b403 100644
--- a/warehouse/src/main/java/com/baiyue/warehouse/dto/MasterDataQueries.java
+++ b/warehouse/src/main/java/com/baiyue/warehouse/dto/MasterDataQueries.java
@@ -71,6 +71,9 @@ public final class MasterDataQueries {
         @NotBlank @Size(max = 128) String partnerName,
         @Schema(description = "单值单位类型", allowableValues = {"CARRIER", "SHIPPER", "CONSIGNEE"})
         @Pattern(regexp = "^(CARRIER|SHIPPER|CONSIGNEE)$") String partnerType,
+        @Schema(description = "船司标准编码；包含 CARRIER 类型时必填，其他类型必须为空",
+            allowableValues = {"MATSON", "SML", "ZIM", "COSCO", "EMC", "HEDE", "OTHER"})
+        @Pattern(regexp = "^(MATSON|SML|ZIM|COSCO|EMC|HEDE|OTHER)$") String carrierCode,
         @Schema(description = "联系人", example = "张三")
         @NotBlank @Size(max = 64) String contactName,
         @Schema(description = "联系电话", example = "13800138000")
diff --git a/warehouse/src/main/java/com/baiyue/warehouse/dto/SharedOverseasWarehouseResponse.java b/warehouse/src/main/java/com/baiyue/warehouse/dto/SharedOverseasWarehouseResponse.java
new file mode 100644
index 000000000..c3d31cfcc
--- /dev/null
+++ b/warehouse/src/main/java/com/baiyue/warehouse/dto/SharedOverseasWarehouseResponse.java
@@ -0,0 +1,19 @@
+package com.baiyue.warehouse.dto;
+
+import com.baiyue.warehouse.entity.WarehouseEntity;
+import io.swagger.v3.oas.annotations.media.Schema;
+
+@Schema(name = "SharedOverseasWarehouseResponse",
+    description = "Domestic-authoritative active shared overseas receiving warehouse")
+public record SharedOverseasWarehouseResponse(
+    Long warehouseId,
+    String warehouseCode,
+    String warehouseName,
+    String countryCode,
+    String status
+) {
+    public static SharedOverseasWarehouseResponse of(WarehouseEntity warehouse) {
+        return new SharedOverseasWarehouseResponse(warehouse.getId(), warehouse.getWarehouseCode(),
+            warehouse.getWarehouseName(), warehouse.getCountryCode(), warehouse.getStatus());
+    }
+}
diff --git a/warehouse/src/main/java/com/baiyue/warehouse/entity/PartnerEntity.java b/warehouse/src/main/java/com/baiyue/warehouse/entity/PartnerEntity.java
index a476c5133..ad39a13e5 100644
--- a/warehouse/src/main/java/com/baiyue/warehouse/entity/PartnerEntity.java
+++ b/warehouse/src/main/java/com/baiyue/warehouse/entity/PartnerEntity.java
@@ -28,6 +28,9 @@ public class PartnerEntity extends BaseEntity {
     private String partnerName;
     @Schema(description = "类型", example = "CARRIER", allowableValues = {"CARRIER", "SHIPPER", "CONSIGNEE"})
     private String partnerType;
+    @Schema(description = "船司标准编码；船公司必填，其他类型必须为空", example = "MATSON",
+        allowableValues = {"MATSON", "SML", "ZIM", "COSCO", "EMC", "HEDE", "OTHER"})
+    private String carrierCode;
     @TableField(exist = false)
     @Schema(description = "单位类型集合", allowableValues = {"CARRIER", "SHIPPER", "CONSIGNEE"})
     private List<String> types;
diff --git a/warehouse/src/main/java/com/baiyue/warehouse/service/PartnerImportService.java b/warehouse/src/main/java/com/baiyue/warehouse/service/PartnerImportService.java
index 2069c48ac..0d5487a25 100644
--- a/warehouse/src/main/java/com/baiyue/warehouse/service/PartnerImportService.java
+++ b/warehouse/src/main/java/com/baiyue/warehouse/service/PartnerImportService.java
@@ -35,10 +35,12 @@ public class PartnerImportService {
     private static final String TEMPLATE_VERSION = "1";
     private static final Set<String> ALLOWED_TYPES = Set.of(
         "CARRIER", "SHIPPER", "CONSIGNEE");
+    private static final Set<String> ALLOWED_CARRIER_CODES = Set.of(
+        "MATSON", "SML", "ZIM", "COSCO", "EMC", "HEDE", "OTHER");
     private static final Pattern EMAIL = Pattern.compile("^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$");
     private static final String[] HEADERS = {
         "单位编码*", "单位名称*", "单位类型*", "联系人*", "联系电话*", "联系邮箱",
-        "国家二字码*", "省/州", "城市*", "区/县", "详细地址*", "邮政编码", "状态*", "备注"
+        "船司标准编码", "国家二字码*", "省/州", "城市*", "区/县", "详细地址*", "邮政编码", "状态*", "备注"
     };
 
     @Resource
@@ -107,9 +109,9 @@ public class PartnerImportService {
                 ImportRow item = new ImportRow(index + 1,
                     value(row, 0, formatter), value(row, 1, formatter), parseTypes(value(row, 2, formatter)),
                     value(row, 3, formatter), value(row, 4, formatter), value(row, 5, formatter),
-                    value(row, 6, formatter).toUpperCase(Locale.ROOT), value(row, 7, formatter),
-                    value(row, 8, formatter), value(row, 9, formatter), value(row, 10, formatter),
-                    value(row, 11, formatter), value(row, 12, formatter).toUpperCase(Locale.ROOT), value(row, 13, formatter));
+                    value(row, 6, formatter).toUpperCase(Locale.ROOT), value(row, 7, formatter).toUpperCase(Locale.ROOT),
+                    value(row, 8, formatter), value(row, 9, formatter), value(row, 10, formatter), value(row, 11, formatter),
+                    value(row, 12, formatter), value(row, 13, formatter).toUpperCase(Locale.ROOT), value(row, 14, formatter));
                 validate(tenantId, item, rows, errors);
                 rows.add(item);
             }
@@ -134,6 +136,11 @@ public class PartnerImportService {
         if (row.types.isEmpty()) errors.add(error(row, "单位类型", "至少填写一个类型"));
         row.types.stream().filter(type -> !ALLOWED_TYPES.contains(type))
             .forEach(type -> errors.add(error(row, "单位类型", "不支持类型 " + type)));
+        if (row.types.contains("CARRIER") && !ALLOWED_CARRIER_CODES.contains(row.carrierCode)) {
+            errors.add(error(row, "船司标准编码", "船公司必须选择 MATSON、SML、ZIM、COSCO、EMC、HEDE 或 OTHER"));
+        } else if (!row.types.contains("CARRIER") && !row.carrierCode.isBlank()) {
+            errors.add(error(row, "船司标准编码", "非船公司必须留空"));
+        }
         required(row, errors, "联系人", row.contactName, 64);
         required(row, errors, "联系电话", row.contactPhone, 32);
         if (row.email.length() > 128 || (!row.email.isBlank() && !EMAIL.matcher(row.email).matches())) {
@@ -162,7 +169,8 @@ public class PartnerImportService {
         entity.setPartnerCode(row.code);
         entity.setPartnerName(row.name);
         entity.setTypes(row.types);
-        entity.setPartnerType(row.types.get(0));
+        entity.setPartnerType(row.types.contains("CARRIER") ? "CARRIER" : row.types.get(0));
+        entity.setCarrierCode(nullable(row.carrierCode));
         entity.setContactName(row.contactName);
         entity.setContactPhone(row.contactPhone);
         entity.setContactEmail(nullable(row.email));
@@ -216,6 +224,6 @@ public class PartnerImportService {
     }
 
     private record ImportRow(int row, String code, String name, List<String> types, String contactName,
-                             String contactPhone, String email, String countryCode, String province, String city,
+                             String contactPhone, String email, String carrierCode, String countryCode, String province, String city,
                              String district, String address, String postalCode, String status, String remark) { }
 }
diff --git a/warehouse/src/main/java/com/baiyue/warehouse/service/PlatformPartnerQueryService.java b/warehouse/src/main/java/com/baiyue/warehouse/service/PlatformPartnerQueryService.java
index 4b668d769..f906ead93 100644
--- a/warehouse/src/main/java/com/baiyue/warehouse/service/PlatformPartnerQueryService.java
+++ b/warehouse/src/main/java/com/baiyue/warehouse/service/PlatformPartnerQueryService.java
@@ -24,6 +24,8 @@ public class PlatformPartnerQueryService {
     private static final long PUBLIC_TENANT_ID = 0L;
     private static final Set<String> ALLOWED_QUERY_TYPES = Set.of(
         "CARRIER", "SHIPPER", "CONSIGNEE");
+    private static final Set<String> ALLOWED_CARRIER_CODES = Set.of(
+        "MATSON", "SML", "ZIM", "COSCO", "EMC", "HEDE", "OTHER");
     @Resource
     private PartnerRepository repository;
 
@@ -121,10 +123,12 @@ public class PlatformPartnerQueryService {
 
     private static void copy(PartnerEntity entity, PartnerSaveRequest request) {
         List<String> types = normalizeTypes(request.types(), request.partnerType());
+        String carrierCode = normalizeCarrierCode(types, request.carrierCode());
         entity.setPartnerCode(request.partnerCode());
         entity.setPartnerName(request.partnerName());
         entity.setTypes(types);
         entity.setPartnerType(legacyType(types));
+        entity.setCarrierCode(carrierCode);
         entity.setContactName(request.contactName());
         entity.setContactPhone(request.contactPhone());
         entity.setContactEmail(request.contactEmail());
@@ -154,6 +158,25 @@ public class PlatformPartnerQueryService {
     }
 
     private static String legacyType(List<String> types) {
-        return types.get(0);
+        return types.contains("CARRIER") ? "CARRIER" : types.get(0);
+    }
+
+    static String normalizeCarrierCode(List<String> types, String carrierCode) {
+        boolean carrier = types.contains("CARRIER");
+        if (!carrier) {
+            if (carrierCode != null && !carrierCode.isBlank()) {
+                throw new BizException(ResultCode.VALIDATION_FAILED, "非船公司不得设置船司标准编码");
+            }
+            return null;
+        }
+        if (carrierCode == null || carrierCode.isBlank()) {
+            throw new BizException(ResultCode.BAD_REQUEST, "船公司必须选择船司标准编码");
+        }
+        String normalized = carrierCode.trim().toUpperCase(Locale.ROOT);
+        if (!ALLOWED_CARRIER_CODES.contains(normalized)) {
+            throw new BizException(ResultCode.VALIDATION_FAILED,
+                "船司标准编码仅支持 MATSON、SML、ZIM、COSCO、EMC、HEDE 或 OTHER");
+        }
+        return normalized;
     }
 }
diff --git a/warehouse/src/main/java/com/baiyue/warehouse/service/WarehouseApplicationService.java b/warehouse/src/main/java/com/baiyue/warehouse/service/WarehouseApplicationService.java
index 06badc425..0728ba84d 100644
--- a/warehouse/src/main/java/com/baiyue/warehouse/service/WarehouseApplicationService.java
+++ b/warehouse/src/main/java/com/baiyue/warehouse/service/WarehouseApplicationService.java
@@ -9,6 +9,7 @@ import com.baiyue.warehouse.dto.WarehouseDetailResponse;
 import com.baiyue.warehouse.dto.WarehouseRequests;
 import com.baiyue.warehouse.dto.OverseasPartnerWarehouseResponse;
 import com.baiyue.warehouse.dto.WarehouseSummaryResponse;
+import com.baiyue.warehouse.dto.SharedOverseasWarehouseResponse;
 import com.baiyue.warehouse.entity.ServiceCapabilityEntity;
 import com.baiyue.warehouse.entity.WarehouseAddressEntity;
 import com.baiyue.warehouse.entity.WarehouseEntity;
@@ -95,6 +96,32 @@ public class WarehouseApplicationService {
             .toList();
     }
 
+    public List<SharedOverseasWarehouseResponse> activeSharedOverseasWarehouses() {
+        return repository.findActiveByType(WarehouseSaveNormalizer.PUBLIC_TENANT_ID,
+                WarehouseSaveNormalizer.TYPE_OVERSEAS)
+            .stream()
+            .filter(warehouse -> hasReceivingCapability(warehouse.getId()))
+            .map(SharedOverseasWarehouseResponse::of)
+            .toList();
+    }
+
+    public SharedOverseasWarehouseResponse activeSharedOverseasWarehouse(long warehouseId) {
+        WarehouseEntity warehouse = repository.findOwned(WarehouseSaveNormalizer.PUBLIC_TENANT_ID, warehouseId);
+        if (warehouse == null || !"ACTIVE".equals(warehouse.getStatus())
+            || !WarehouseSaveNormalizer.TYPE_OVERSEAS.equals(warehouse.getWarehouseType())
+            || !hasReceivingCapability(warehouseId)) {
+            throw new BizException(ResultCode.NOT_FOUND,
+                "启用的公共海外收货仓不存在");
+        }
+        return SharedOverseasWarehouseResponse.of(warehouse);
+    }
+
+    private boolean hasReceivingCapability(long warehouseId) {
+        return repository.findCapabilities(WarehouseSaveNormalizer.PUBLIC_TENANT_ID, warehouseId).stream()
+            .anyMatch(capability -> "RECEIVING".equals(capability.getCapabilityCode())
+                && Boolean.TRUE.equals(capability.getEnabled()));
+    }
+
     public WarehouseDetailResponse activeDetail(long tenantId, long id) {
         WarehouseEntity warehouse = repository.findOwned(tenantId, id);
         if (warehouse == null) {
diff --git a/warehouse/src/main/resources/db/warehouse-public-master-data.sql b/warehouse/src/main/resources/db/warehouse-public-master-data.sql
index 6ea011f7c..e14c622a6 100644
--- a/warehouse/src/main/resources/db/warehouse-public-master-data.sql
+++ b/warehouse/src/main/resources/db/warehouse-public-master-data.sql
@@ -162,7 +162,7 @@ JOIN wh_warehouse warehouse
 ON DUPLICATE KEY UPDATE
   tenant_id = VALUES(tenant_id);
 
--- 国内固定作业仓必须启用收货能力，FBA 目的地址仍不得创建作业能力。
+-- 四个固定平台作业仓必须启用收货能力，FBA 目的地址仍不得创建作业能力。
 INSERT INTO wh_service_capability (
   id, tenant_id, warehouse_id, capability_code, capability_name, enabled, cutoff_time,
   description, created_by, created_at, updated_by, updated_at, deleted, version
@@ -171,7 +171,11 @@ VALUES
   (193000000000400001,0,193000000000200001,'RECEIVING','头程收货',1,'16:00:00',
    '义乌仓头程订单收货能力',NULL,CURRENT_TIMESTAMP(3),NULL,CURRENT_TIMESTAMP(3),0,0),
   (193000000000400002,0,193000000000200002,'RECEIVING','头程收货',1,'16:00:00',
-   '东莞仓头程订单收货能力',NULL,CURRENT_TIMESTAMP(3),NULL,CURRENT_TIMESTAMP(3),0,0)
+   '东莞仓头程订单收货能力',NULL,CURRENT_TIMESTAMP(3),NULL,CURRENT_TIMESTAMP(3),0,0),
+  (193000000000400003,0,193000000000200003,'RECEIVING','海外收货',1,'16:00:00',
+   '洛杉矶仓海外接柜入仓收货能力',NULL,CURRENT_TIMESTAMP(3),NULL,CURRENT_TIMESTAMP(3),0,0),
+  (193000000000400004,0,193000000000200004,'RECEIVING','海外收货',1,'16:00:00',
+   '纽约仓海外接柜入仓收货能力',NULL,CURRENT_TIMESTAMP(3),NULL,CURRENT_TIMESTAMP(3),0,0)
 ON DUPLICATE KEY UPDATE
   capability_name = VALUES(capability_name),
   enabled = VALUES(enabled),
@@ -677,11 +681,11 @@ BEGIN
   IF (SELECT COUNT(*)
         FROM wh_service_capability capability
        WHERE capability.tenant_id = 0
-         AND capability.warehouse_id IN (193000000000200001,193000000000200002)
+         AND capability.warehouse_id IN (193000000000200001,193000000000200002,193000000000200003,193000000000200004)
          AND capability.capability_code = 'RECEIVING'
          AND capability.enabled = 1
-         AND capability.deleted = 0) <> 2 THEN
-    SIGNAL SQLSTATE '45000' SET MESSAGE_TEXT = '国内固定作业仓收货能力写入校验失败';
+         AND capability.deleted = 0) <> 4 THEN
+    SIGNAL SQLSTATE '45000' SET MESSAGE_TEXT = '固定平台作业仓收货能力写入校验失败';
   END IF;
 END//
 DELIMITER ;
diff --git a/warehouse/src/test/java/com/baiyue/warehouse/controller/InternalWarehouseControllerTest.java b/warehouse/src/test/java/com/baiyue/warehouse/controller/InternalWarehouseControllerTest.java
index ae64a2e25..f246fcd69 100644
--- a/warehouse/src/test/java/com/baiyue/warehouse/controller/InternalWarehouseControllerTest.java
+++ b/warehouse/src/test/java/com/baiyue/warehouse/controller/InternalWarehouseControllerTest.java
@@ -4,6 +4,7 @@ import com.baiyue.common.core.api.ResultCode;
 import com.baiyue.common.core.exception.BizException;
 import com.baiyue.warehouse.dto.WarehouseDetailResponse;
 import com.baiyue.warehouse.dto.OverseasPartnerWarehouseResponse;
+import com.baiyue.warehouse.dto.SharedOverseasWarehouseResponse;
 import com.baiyue.warehouse.entity.WarehouseEntity;
 import com.baiyue.warehouse.service.WarehouseApplicationService;
 import org.junit.jupiter.api.BeforeEach;
@@ -83,4 +84,17 @@ class InternalWarehouseControllerTest {
         assertThat(response.data()).containsExactly(option);
         verify(service).activeOverseasPartners();
     }
+
+    @Test
+    void exposesSharedOverseasReceivingDirectoryOnlyWithInternalToken() {
+        var warehouse = new SharedOverseasWarehouseResponse(200003L, "US-LAX-01",
+            "洛杉矶海外仓", "US", "ACTIVE");
+        when(service.activeSharedOverseasWarehouse(200003L)).thenReturn(warehouse);
+
+        assertThat(controller.sharedOverseasWarehouse(INTERNAL_TOKEN, 200003L).data())
+            .isEqualTo(warehouse);
+        assertThatThrownBy(() -> controller.sharedOverseasWarehouse("bad", 200003L))
+            .isInstanceOf(BizException.class);
+        verify(service).activeSharedOverseasWarehouse(200003L);
+    }
 }
diff --git a/warehouse/src/test/java/com/baiyue/warehouse/repository/WarehouseSchemaContractTest.java b/warehouse/src/test/java/com/baiyue/warehouse/repository/WarehouseSchemaContractTest.java
index 96ef04a60..443be6318 100644
--- a/warehouse/src/test/java/com/baiyue/warehouse/repository/WarehouseSchemaContractTest.java
+++ b/warehouse/src/test/java/com/baiyue/warehouse/repository/WarehouseSchemaContractTest.java
@@ -109,7 +109,7 @@ class WarehouseSchemaContractTest {
     }
 
     @Test
-    void shouldSeedReceivingCapabilityForDomesticOperatingWarehouses() throws IOException {
+    void shouldSeedReceivingCapabilityForFixedOperatingWarehouses() throws IOException {
         String masterData = read("warehouse-public-master-data.sql");
         String unified = Files.readString(Path.of("..", "deploy", "sql", "头程数据库统一增量-MySQL8.sql"));
 
@@ -117,7 +117,11 @@ class WarehouseSchemaContractTest {
             assertThat(sql)
                 .contains("193000000000200001,'RECEIVING','头程收货',1")
                 .contains("193000000000200002,'RECEIVING','头程收货',1")
-                .contains("国内固定作业仓收货能力写入校验失败")
+                .contains("193000000000400003,0,193000000000200003,'RECEIVING','海外收货',1")
+                .contains("'洛杉矶仓海外接柜入仓收货能力'")
+                .contains("193000000000400004,0,193000000000200004,'RECEIVING','海外收货',1")
+                .contains("'纽约仓海外接柜入仓收货能力'")
+                .contains("固定平台作业仓收货能力写入校验失败")
                 .contains("warehouse.warehouse_type = 'FBA'")
                 .contains("FBA公共地址不得创建平台作业能力");
         }
diff --git a/warehouse/src/test/java/com/baiyue/warehouse/service/PartnerImportServiceTest.java b/warehouse/src/test/java/com/baiyue/warehouse/service/PartnerImportServiceTest.java
index 17618504f..e4e514289 100644
--- a/warehouse/src/test/java/com/baiyue/warehouse/service/PartnerImportServiceTest.java
+++ b/warehouse/src/test/java/com/baiyue/warehouse/service/PartnerImportServiceTest.java
@@ -40,7 +40,7 @@ class PartnerImportServiceTest {
     void shouldImportValidMultiTypeRow() throws Exception {
         byte[] file = withRows(service.template(), new String[][] {
             {"CAR-100", "测试船公司", "CARRIER，SHIPPER", "张三", "13800138000", "test@example.com",
-                "CN", "广东省", "深圳市", "南山区", "测试路 1 号", "518000", "ACTIVE", "测试备注"}
+                "MATSON", "CN", "广东省", "深圳市", "南山区", "测试路 1 号", "518000", "ACTIVE", "测试备注"}
         });
 
         PartnerImportResult result = service.importFile(0L, "partners.xlsx", file);
@@ -52,6 +52,7 @@ class PartnerImportServiceTest {
         assertThat(captor.getValue().getTenantId()).isZero();
         assertThat(captor.getValue().getDataScopeId()).isZero();
         assertThat(captor.getValue().getTypes()).containsExactly("CARRIER", "SHIPPER");
+        assertThat(captor.getValue().getCarrierCode()).isEqualTo("MATSON");
         assertThat(captor.getValue().getRemark()).isEqualTo("测试备注");
     }
 
@@ -59,8 +60,8 @@ class PartnerImportServiceTest {
     @DisplayName("文件内任一错误时整批零写入并返回行号")
     void shouldRejectWholeBatchWhenAnyRowIsInvalid() throws Exception {
         byte[] file = withRows(service.template(), new String[][] {
-            {"CAR-100", "测试船公司一", "CARRIER", "张三", "13800138000", "", "CN", "", "深圳市", "", "测试路 1 号", "", "ACTIVE", ""},
-            {"CAR-100", "测试单位二", "UNKNOWN", "李四", "13900139000", "bad-email", "C", "", "", "", "", "", "ENABLED", ""}
+            {"CAR-100", "测试船公司一", "CARRIER", "张三", "13800138000", "", "MATSON", "CN", "", "深圳市", "", "测试路 1 号", "", "ACTIVE", ""},
+            {"CAR-100", "测试单位二", "UNKNOWN", "李四", "13900139000", "bad-email", "", "C", "", "", "", "", "", "ENABLED", ""}
         });
 
         PartnerImportResult result = service.importFile(0L, "partners.xlsx", file);
diff --git a/warehouse/src/test/java/com/baiyue/warehouse/service/PlatformMasterDataManagementServiceTest.java b/warehouse/src/test/java/com/baiyue/warehouse/service/PlatformMasterDataManagementServiceTest.java
index 453e3bb6d..2f5ae5bb6 100644
--- a/warehouse/src/test/java/com/baiyue/warehouse/service/PlatformMasterDataManagementServiceTest.java
+++ b/warehouse/src/test/java/com/baiyue/warehouse/service/PlatformMasterDataManagementServiceTest.java
@@ -79,6 +79,7 @@ class PlatformMasterDataManagementServiceTest {
         assertThat(entity.getValue().getPartnerCode()).isEqualTo("CUS-001");
         assertThat(entity.getValue().getPartnerName()).isEqualTo("示例客户");
         assertThat(entity.getValue().getTypes()).containsExactly("CARRIER", "SHIPPER");
+        assertThat(entity.getValue().getCarrierCode()).isEqualTo("OTHER");
         assertThat(entity.getValue().getRemark()).isEqualTo("测试备注");
     }
 
@@ -210,7 +211,7 @@ class PlatformMasterDataManagementServiceTest {
     }
 
     private static PartnerSaveRequest partnerRequest() {
-        return new PartnerSaveRequest("CUS-001", "示例客户", "CARRIER", "张三", "13800138000",
+        return new PartnerSaveRequest("CUS-001", "示例客户", "CARRIER", "OTHER", "张三", "13800138000",
             "test@example.com", "CN", "广东省", "深圳市", "南山区", "示例地址", "518000", "ACTIVE",
             java.util.List.of("CARRIER", "SHIPPER"), "测试备注");
     }
diff --git a/warehouse/src/test/java/com/baiyue/warehouse/service/WarehouseApplicationServiceTest.java b/warehouse/src/test/java/com/baiyue/warehouse/service/WarehouseApplicationServiceTest.java
index bd35a1d56..e22cc4b92 100644
--- a/warehouse/src/test/java/com/baiyue/warehouse/service/WarehouseApplicationServiceTest.java
+++ b/warehouse/src/test/java/com/baiyue/warehouse/service/WarehouseApplicationServiceTest.java
@@ -149,4 +149,23 @@ class WarehouseApplicationServiceTest {
             .containsExactly(tuple(2L, "US-PARTNER-LAX", "洛杉矶合作仓", "US"));
         verify(repository).findActiveByType(0L, "OVERSEAS_PARTNER");
     }
+
+    @Test
+    void exposesOnlyActiveSharedOverseasWarehousesWithReceivingCapability() {
+        WarehouseEntity receiving = new WarehouseEntity();
+        receiving.setId(3L); receiving.setWarehouseCode("US-LAX-01");
+        receiving.setWarehouseName("洛杉矶海外仓"); receiving.setCountryCode("US");
+        receiving.setWarehouseType("OVERSEAS"); receiving.setStatus("ACTIVE");
+        ServiceCapabilityEntity capability = new ServiceCapabilityEntity();
+        capability.setCapabilityCode("RECEIVING"); capability.setEnabled(true);
+        when(repository.findActiveByType(0L, "OVERSEAS")).thenReturn(java.util.List.of(receiving));
+        when(repository.findOwned(0L, 3L)).thenReturn(receiving);
+        when(repository.findCapabilities(0L, 3L)).thenReturn(java.util.List.of(capability));
+
+        assertThat(service.activeSharedOverseasWarehouses())
+            .extracting("warehouseId", "warehouseCode", "status")
+            .containsExactly(tuple(3L, "US-LAX-01", "ACTIVE"));
+        assertThat(service.activeSharedOverseasWarehouse(3L).warehouseName())
+            .isEqualTo("洛杉矶海外仓");
+    }
 }
diff --git a/warehouse/src/test/resources/db/verify-warehouse-public-master-data.sql b/warehouse/src/test/resources/db/verify-warehouse-public-master-data.sql
index a7beada7f..5303ff3d2 100644
--- a/warehouse/src/test/resources/db/verify-warehouse-public-master-data.sql
+++ b/warehouse/src/test/resources/db/verify-warehouse-public-master-data.sql
@@ -19,6 +19,38 @@ SELECT COUNT(*) AS fixed_platform_address_count
    AND address.deleted = 0
    AND warehouse.deleted = 0;
 
+SELECT COUNT(*) AS fixed_platform_receiving_capability_count
+  FROM wh_service_capability capability
+ WHERE capability.tenant_id = 0
+   AND capability.warehouse_id IN (
+     193000000000200001, 193000000000200002,
+     193000000000200003, 193000000000200004
+   )
+   AND capability.capability_code = 'RECEIVING'
+   AND capability.enabled = 1
+   AND capability.deleted = 0;
+
+SELECT COUNT(*) AS overseas_receiving_capability_violations
+  FROM wh_service_capability capability
+ WHERE capability.tenant_id = 0
+   AND (
+     (capability.id = 193000000000400003
+       AND (capability.warehouse_id <> 193000000000200003
+         OR capability.capability_code <> 'RECEIVING'
+         OR capability.capability_name <> '海外收货'
+         OR capability.description <> '洛杉矶仓海外接柜入仓收货能力'
+         OR capability.enabled <> 1
+         OR capability.deleted <> 0))
+     OR
+     (capability.id = 193000000000400004
+       AND (capability.warehouse_id <> 193000000000200004
+         OR capability.capability_code <> 'RECEIVING'
+         OR capability.capability_name <> '海外收货'
+         OR capability.description <> '纽约仓海外接柜入仓收货能力'
+         OR capability.enabled <> 1
+         OR capability.deleted <> 0))
+   );
+
 SELECT COUNT(*) AS fba_public_warehouse_count
   FROM wh_warehouse
  WHERE tenant_id = 0
diff --git a/warehouse/src/test/scripts/warehouse-public-master-data-contract.test.mjs b/warehouse/src/test/scripts/warehouse-public-master-data-contract.test.mjs
index 72214465c..363e10047 100644
--- a/warehouse/src/test/scripts/warehouse-public-master-data-contract.test.mjs
+++ b/warehouse/src/test/scripts/warehouse-public-master-data-contract.test.mjs
@@ -111,8 +111,11 @@ assert.doesNotMatch(sql, /contact_name\s*=\s*VALUES\(contact_name\)/)
 assert.doesNotMatch(sql, /contact_phone\s*=\s*VALUES\(contact_phone\)/)
 assert.doesNotMatch(sql, /contact_email\s*=\s*VALUES\(contact_email\)/)
 assert.doesNotMatch(sql, /remark\s*=\s*VALUES\(remark\)/)
-assert.match(sql, /国内固定作业仓必须启用收货能力/)
+assert.match(sql, /四个固定平台作业仓必须启用收货能力/)
 assert.match(sql, /INSERT INTO wh_service_capability[\s\S]+?'RECEIVING'/i)
+assert.match(sql, /193000000000400003,0,193000000000200003,'RECEIVING','海外收货',1,'16:00:00',[\s\S]*?'洛杉矶仓海外接柜入仓收货能力'/)
+assert.match(sql, /193000000000400004,0,193000000000200004,'RECEIVING','海外收货',1,'16:00:00',[\s\S]*?'纽约仓海外接柜入仓收货能力'/)
+assert.match(sql, /warehouse_id IN \(193000000000200001,193000000000200002,193000000000200003,193000000000200004\)[\s\S]*?<> 4 THEN[\s\S]*?固定平台作业仓收货能力写入校验失败/)
 const fbaBlock = sql.slice(sql.indexOf('CREATE TEMPORARY TABLE tmp_wh_fba_public_master_data'))
 assert.doesNotMatch(fbaBlock, /INSERT INTO wh_service_capability/i)
 assert.match(sql, /FBA公共主数据地址种子ID与既有数据冲突/)