diff --git a/AGENTS.md b/AGENTS.md
index 35f4819ff..b28db77af 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -78,6 +78,8 @@
 | 国内船节点向海外接柜门禁事件 | `firstleg/`、`common-event-contract/`、`lastleg-service/` |
 | 海外仓库目录、海外库位、海外托盘、资源锁 | 国内仓库目录归 `warehouse/`，海外资源归 `warehouse-overseas-service/` |
 | Lastleg 内部模块化与依赖基线 | `lastleg-service/` |
+| 自营领星采集、经营统计、SKU 日销量 | `lastleg-service/selfoperated/` 查询与采集编排；领星签名/分页/外部接口查 `integration-service/`，不因采集页面任务同时读取两服务 |
+| 跨客户同仓预约、预约跟进、到港日历 | `lastleg-service/inboundplan/`、`appointmentplanning/`；到港事实查 `firstleg/portschedule/` |
 | 车辆、司机证照、车次、外接预订、车队报价、出车记录 | `lastleg-service/fleet/`；先读 `lastleg-service/AGENTS.md` 对应入口，客户排车关联再沿 `dispatch/fleet/` 实际调用 |
 | PDF 标签、审计、业务事件直投 | `print/`、`audit-service/`、`common-event-contract/` |
 
@@ -104,6 +106,19 @@
 - 装柜、船节点、卸柜、暂扣、派送、费用与资金按统一通信契约的逐事件表直接投递。保留本地 Outbox、消费幂等、重试与失败处置，不携带用户 JWT；旧 Bridge 源码已退出聚合和发布清单，退役待清理；实际停机仍须替代链验证与授权，不得据源码状态认定已部署。
 - `lastleg-service` 不读取头程数据库，`warehouse-overseas-service` 不读取尾程订单库。共用测试 MySQL 实例不改变服务数据归属。准确路由、ACK、撤销矩阵和切换门槛只维护在新的两份主契约中。
 
+## 数据库访问与中文代码注释（所有服务及公共模块强制）
+
+- 本节适用于全部后端服务和公共模块；新增、修改的方法必须执行，触及的存量代码同步整改。登记本约束不代表存量代码已全部完成迁移和注释补齐。
+- 生产代码的关系型数据库读写统一经 MyBatis/MyBatis-Plus Mapper 执行；Controller、Service、定时任务、消费者、编号生成器和公共基础组件不得直接使用 `JdbcTemplate`、`NamedParameterJdbcTemplate`、原生 JDBC/Connection/Statement 或其他通道执行 SQL。仅改成 Repository 包装 JDBC 不算整改，SQL 必须进入 Mapper；无数据库职责的模块不得为满足本条新增数据库访问。
+- 正常业务数据库访问路径统一为 `Controller → Service → Repository → Mapper`，四层职责明确，不得省略 Repository，也不得由 Controller 直接调用 Repository/Mapper，或由 Service 直接调用 Mapper。定时任务、消费者等非 HTTP 入口从 Service 进入，同样经 Repository → Mapper 完成持久化访问。
+- Controller 负责请求接收、参数校验、入口权限和响应转换；Service 负责业务规则、编排及业务事务；Repository 负责领域数据访问封装、查询组合与持久化模型转换，对 Service 提供有业务含义的数据操作；Mapper 负责 SQL 执行及数据库记录映射。Repository 不承载业务状态流转，不直接用 JDBC 执行 SQL；Service 不继承 MyBatis-Plus `ServiceImpl` 等方式绕过 Repository。
+- 复杂查询、批量处理、原子计数、锁定读取、Outbox 和数据库监控查询同样经 Repository → Mapper，不以 SQL 特殊或实现方便为由跳层。公共模块需要数据库能力时，按现有模块边界定义 Repository/持久化接口，由所属服务的 Repository → Mapper 实现，禁止借此跨服务读库。
+- 迁移数据库操作须保留客户隔离条件、事务传播、行锁、幂等和并发语义；`LAST_INSERT_ID()` 等连接级操作必须在同一事务连接完成，并明确关闭相关读取缓存，不能仅机械搬移 SQL。Mapper 注册及扫描仍遵守下文统一规范。
+- 测试代码可用 `JdbcTemplate` 创建隔离测试表、准备数据及核对结果；被测生产路径仍必须调用实际 Mapper，不得把测试造数做法带入生产。数据库基线和迁移脚本按现有部署契约管理。
+- 每个手写方法及构造器均须添加简短中文注释，通常 1—3 行说明业务用途；接口方法和 Mapper 方法优先使用中文 Javadoc。覆盖方法同样须有简短中文说明，实现中的关键规则仍须就地注释；自动生成的方法不手工逐个补注释。
+- 核心业务、复杂 SQL、状态流转、资金与库存变更、权限隔离、事务、锁、幂等、并发、重试和补偿逻辑，须在关键代码前增加适量中文注释，解释业务规则、处理原因、约束边界及失败影响；不逐行翻译代码，不添加无信息量或与实现不符的注释。
+- 新增和修改的代码说明注释统一使用中文；必要的技术标识、协议名、类名可保留原文，第三方许可证和生成标记保持原样。修改方法时同步更新相关存量英文或过期说明；审查时同时核对 Controller → Service → Repository → Mapper 分层及中文方法、核心逻辑注释。
+
 ## 契约、数据库与验证入口
 
 - 对外 Controller/API 新增、改名或删除时，同时核对调用端、统一 Gateway、OpenAPI 和权限；提交前运行 `node --test scripts/gateway-route-contract.test.mjs`，自动发现生产 Controller 并校验网关目标服务与内部路径隔离。失败不得提交或标记完成；网关配置变化必须列入部署清单，不以业务服务单测代替入口检查。
diff --git a/audit-service/AGENTS.md b/audit-service/AGENTS.md
index 781ddd2ab..d266c053d 100644
--- a/audit-service/AGENTS.md
+++ b/audit-service/AGENTS.md
@@ -1,5 +1,10 @@
 # Audit Service 模块指引
 
+## 数据库访问与中文注释约束
+
+- 强制遵守根 `../AGENTS.md` 的“数据库访问与中文代码注释”全部规则：正常业务访问统一为 `Controller → Service → Repository → Mapper`，不得省略 Repository 或跨层直调；生产 SQL 由 Mapper 执行，Repository 不得直接使用 JdbcTemplate 或原生 JDBC。非 HTTP 入口从 Service 进入；无数据库模块不引入数据库访问。
+- 每个手写方法及构造器须有简短中文说明；核心业务规则、复杂 SQL、事务、锁、幂等、并发及失败处理须补充适量中文注释，重点说明原因和边界。新增、修改方法立即执行，触及的存量代码同步整改。
+
 ## 职责边界
 
 - Mapper 只由 `BaiyueAuditApplication.java` 对 `com.baiyue.audit` 根包按 `@Mapper` 过滤扫描；新增或移动 Mapper 后从后端根运行 `node scripts/mapper-scan-contract.mjs`，不得增加子域扫描配置。
diff --git a/auth/AGENTS.md b/auth/AGENTS.md
index 5decc247f..f6ff8ce7e 100644
--- a/auth/AGENTS.md
+++ b/auth/AGENTS.md
@@ -1,5 +1,10 @@
 # Auth Service 模块指引
 
+## 数据库访问与中文注释约束
+
+- 强制遵守根 `../AGENTS.md` 的“数据库访问与中文代码注释”全部规则：正常业务访问统一为 `Controller → Service → Repository → Mapper`，不得省略 Repository 或跨层直调；生产 SQL 由 Mapper 执行，Repository 不得直接使用 JdbcTemplate 或原生 JDBC。非 HTTP 入口从 Service 进入；无数据库模块不引入数据库访问。
+- 每个手写方法及构造器须有简短中文说明；核心业务规则、复杂 SQL、事务、锁、幂等、并发及失败处理须补充适量中文注释，重点说明原因和边界。新增、修改方法立即执行，触及的存量代码同步整改。
+
 ## 职责与边界
 
 - Mapper 只由 `BaiyueAuthApplication.java` 对 `com.baiyue.auth` 根包按 `@Mapper` 过滤扫描；新增或移动 Mapper 后从后端根运行 `node scripts/mapper-scan-contract.mjs`，不得增加子域扫描配置。
diff --git a/common-audit/AGENTS.md b/common-audit/AGENTS.md
index e34c18bea..6298f658b 100644
--- a/common-audit/AGENTS.md
+++ b/common-audit/AGENTS.md
@@ -1,5 +1,10 @@
 # Common Audit 模块指引
 
+## 数据库访问与中文注释约束
+
+- 强制遵守根 `../AGENTS.md` 的“数据库访问与中文代码注释”全部规则：正常业务访问统一为 `Controller → Service → Repository → Mapper`，不得省略 Repository 或跨层直调；生产 SQL 由 Mapper 执行，Repository 不得直接使用 JdbcTemplate 或原生 JDBC。非 HTTP 入口从 Service 进入；无数据库模块不引入数据库访问。
+- 每个手写方法及构造器须有简短中文说明；核心业务规则、复杂 SQL、事务、锁、幂等、并发及失败处理须补充适量中文注释，重点说明原因和边界。新增、修改方法立即执行，触及的存量代码同步整改。
+
 ## 职责边界
 
 - 负责业务审计事件采集、注解切面、敏感字段脱敏以及日志/HTTP 输出。
diff --git a/common-core/AGENTS.md b/common-core/AGENTS.md
index e725c4e21..6bb66fff6 100644
--- a/common-core/AGENTS.md
+++ b/common-core/AGENTS.md
@@ -1,5 +1,10 @@
 # Common Core 模块指引
 
+## 数据库访问与中文注释约束
+
+- 强制遵守根 `../AGENTS.md` 的“数据库访问与中文代码注释”全部规则：正常业务访问统一为 `Controller → Service → Repository → Mapper`，不得省略 Repository 或跨层直调；生产 SQL 由 Mapper 执行，Repository 不得直接使用 JdbcTemplate 或原生 JDBC。非 HTTP 入口从 Service 进入；无数据库模块不引入数据库访问。
+- 每个手写方法及构造器须有简短中文说明；核心业务规则、复杂 SQL、事务、锁、幂等、并发及失败处理须补充适量中文注释，重点说明原因和边界。新增、修改方法立即执行，触及的存量代码同步整改。
+
 ## 职责边界
 
 - 提供不依赖具体业务域的返回模型、异常、基础实体和 MyBatis-Plus 通用配置。
diff --git a/common-event-contract/AGENTS.md b/common-event-contract/AGENTS.md
index ab5e442cc..46745428d 100644
--- a/common-event-contract/AGENTS.md
+++ b/common-event-contract/AGENTS.md
@@ -1,5 +1,10 @@
 # Common Event Contract 模块指引
 
+## 数据库访问与中文注释约束
+
+- 强制遵守根 `../AGENTS.md` 的“数据库访问与中文代码注释”全部规则：正常业务访问统一为 `Controller → Service → Repository → Mapper`，不得省略 Repository 或跨层直调；生产 SQL 由 Mapper 执行，Repository 不得直接使用 JdbcTemplate 或原生 JDBC。非 HTTP 入口从 Service 进入；无数据库模块不引入数据库访问。
+- 每个手写方法及构造器须有简短中文说明；核心业务规则、复杂 SQL、事务、锁、幂等、并发及失败处理须补充适量中文注释，重点说明原因和边界。新增、修改方法立即执行，触及的存量代码同步整改。
+
 ## 职责边界
 
 - 维护 Firstleg、Lastleg、Finance 之间稳定、可版本化的业务事件契约。
diff --git a/common-openapi/AGENTS.md b/common-openapi/AGENTS.md
index 41c12e6e7..fdffb1d7f 100644
--- a/common-openapi/AGENTS.md
+++ b/common-openapi/AGENTS.md
@@ -1,5 +1,10 @@
 # Common OpenAPI 模块指引
 
+## 数据库访问与中文注释约束
+
+- 强制遵守根 `../AGENTS.md` 的“数据库访问与中文代码注释”全部规则：正常业务访问统一为 `Controller → Service → Repository → Mapper`，不得省略 Repository 或跨层直调；生产 SQL 由 Mapper 执行，Repository 不得直接使用 JdbcTemplate 或原生 JDBC。非 HTTP 入口从 Service 进入；无数据库模块不引入数据库访问。
+- 每个手写方法及构造器须有简短中文说明；核心业务规则、复杂 SQL、事务、锁、幂等、并发及失败处理须补充适量中文注释，重点说明原因和边界。新增、修改方法立即执行，触及的存量代码同步整改。
+
 ## 职责边界
 
 - 为 Spring MVC 服务提供 SpringDoc/OpenAPI 自动配置和统一文档元数据。
diff --git a/common-security/AGENTS.md b/common-security/AGENTS.md
index cf49042bd..e9bd2a2da 100644
--- a/common-security/AGENTS.md
+++ b/common-security/AGENTS.md
@@ -1,5 +1,10 @@
 # Common Security 模块指引
 
+## 数据库访问与中文注释约束
+
+- 强制遵守根 `../AGENTS.md` 的“数据库访问与中文代码注释”全部规则：正常业务访问统一为 `Controller → Service → Repository → Mapper`，不得省略 Repository 或跨层直调；生产 SQL 由 Mapper 执行，Repository 不得直接使用 JdbcTemplate 或原生 JDBC。非 HTTP 入口从 Service 进入；无数据库模块不引入数据库访问。
+- 每个手写方法及构造器须有简短中文说明；核心业务规则、复杂 SQL、事务、锁、幂等、并发及失败处理须补充适量中文注释，重点说明原因和边界。新增、修改方法立即执行，触及的存量代码同步整改。
+
 ## 职责边界
 
 - 提供业务服务通用的 JWT 解码、认证过滤、Redis Access Token 会话校验、认证用户上下文及 401/403 JSON 响应。
diff --git a/common-web/AGENTS.md b/common-web/AGENTS.md
index 3820a631b..16a878e89 100644
--- a/common-web/AGENTS.md
+++ b/common-web/AGENTS.md
@@ -1,5 +1,10 @@
 # Common Web 模块指引
 
+## 数据库访问与中文注释约束
+
+- 强制遵守根 `../AGENTS.md` 的“数据库访问与中文代码注释”全部规则：正常业务访问统一为 `Controller → Service → Repository → Mapper`，不得省略 Repository 或跨层直调；生产 SQL 由 Mapper 执行，Repository 不得直接使用 JdbcTemplate 或原生 JDBC。非 HTTP 入口从 Service 进入；无数据库模块不引入数据库访问。
+- 每个手写方法及构造器须有简短中文说明；核心业务规则、复杂 SQL、事务、锁、幂等、并发及失败处理须补充适量中文注释，重点说明原因和边界。新增、修改方法立即执行，触及的存量代码同步整改。
+
 ## 职责边界
 
 - 提供 Servlet Web 通用能力：请求链路标识、上下文和统一异常响应。
diff --git a/config/nacos/test/file-service.yml b/config/nacos/test/file-service.yml
index 48155dcdb..740fdf618 100644
--- a/config/nacos/test/file-service.yml
+++ b/config/nacos/test/file-service.yml
@@ -141,6 +141,15 @@ baiyue:
           max-rows: 200000
           max-attempts: 3
           batch-size: 200
+        SELFOP_INVENTORY_TURNOVER:
+          provider-service: lastleg-service
+          provider-path: /internal/exports/v1/SELFOP_INVENTORY_TURNOVER/batches
+          required-permission: platform:self-operated-analytics:export
+          app-scope: PLATFORM
+          enabled: true
+          max-rows: 200000
+          max-attempts: 3
+          batch-size: 100
         OVERSEAS_INVENTORY_LEDGER:
           provider-service: lastleg-service
           provider-path: /internal/exports/v1/OVERSEAS_INVENTORY_LEDGER/batches
diff --git a/deploy/docker-compose.yml b/deploy/docker-compose.yml
index 56f4febb3..a32c3906f 100644
--- a/deploy/docker-compose.yml
+++ b/deploy/docker-compose.yml
@@ -218,6 +218,12 @@ services:
     environment:
       <<: *common-environment
       SERVER_PORT: 9210
+      LINGXING_WMS_ENABLED: ${LINGXING_WMS_ENABLED:-false}
+      LINGXING_COLLECTION_MODE: ${SELFOP_COLLECTION_MODE:-OFF}
+      LINGXING_ENVIRONMENT_LABEL: ${DEPLOY_ENV:-test}
+      LINGXING_SOURCE_ACCOUNT: ${SELFOP_SOURCE_ACCOUNT:-lingxing-primary}
+      LINGXING_OMS_APP_KEY: ${LINGXING_OMS_APP_KEY:-}
+      LINGXING_OMS_APP_SECRET: ${LINGXING_OMS_APP_SECRET:-}
       BAIDU_OCR_ENABLED: ${BAIDU_OCR_ENABLED:-false}
       BAIDU_OCR_API_KEY: ${BAIDU_OCR_API_KEY:-}
       BAIDU_OCR_SECRET_KEY: ${BAIDU_OCR_SECRET_KEY:-}
@@ -282,6 +288,12 @@ services:
     environment:
       <<: *common-environment
       SERVER_PORT: 9303
+      SELFOP_EXECUTION_ENABLED: ${SELFOP_EXECUTION_ENABLED:-false}
+      SELFOP_COLLECTION_MODE: ${SELFOP_COLLECTION_MODE:-OFF}
+      SELFOP_SOURCE_ACCOUNT: ${SELFOP_SOURCE_ACCOUNT:-lingxing-primary}
+      SELFOP_DAILY_REQUEST_BUDGET: ${SELFOP_DAILY_REQUEST_BUDGET:-0}
+      SELFOP_MIN_REQUEST_INTERVAL_MS: ${SELFOP_MIN_REQUEST_INTERVAL_MS:-5000}
+      SELFOP_SALES_PUBLICATION_ENABLED: ${SELFOP_SALES_PUBLICATION_ENABLED:-false}
       EVENT_CONNECT_TIMEOUT_MS: ${EVENT_CONNECT_TIMEOUT_MS:-3000}
       EVENT_READ_TIMEOUT_MS: ${EVENT_READ_TIMEOUT_MS:-15000}
       EVENT_LEASE_SECONDS: ${EVENT_LEASE_SECONDS:-60}
diff --git a/deploy/env/.env.test.example b/deploy/env/.env.test.example
index 13dcc01d5..4af28c729 100644
--- a/deploy/env/.env.test.example
+++ b/deploy/env/.env.test.example
@@ -21,6 +21,16 @@ IMAGE_TAG=
 FILE_UPLOADS_HOST_DIR=/data/firstleg/uploads
 CORS_ALLOWED_ORIGINS=
 INTERNAL_SERVICE_TOKEN=
+# 领星唯一账号；凭据仅注入 integration-service。
+LINGXING_OMS_APP_KEY=
+LINGXING_OMS_APP_SECRET=
+LINGXING_WMS_ENABLED=false
+SELFOP_COLLECTION_MODE=OFF
+SELFOP_SOURCE_ACCOUNT=lingxing-primary
+# 未核准额度使用0，真实出口拒绝请求；有效模式仍需显式的独占交接证明与截止时间。
+SELFOP_DAILY_REQUEST_BUDGET=0
+SELFOP_MIN_REQUEST_INTERVAL_MS=5000
+SELFOP_SALES_PUBLICATION_ENABLED=false
 REDIS_PASSWORD=
 AUTH_DB_URL=jdbc:mysql://host.docker.internal:3306/baiyue_auth?useUnicode=true&characterEncoding=utf8&serverTimezone=Asia/Shanghai
 AUTH_DB_USERNAME=
diff --git a/deploy/sql/20261016-数据库变更汇总.md b/deploy/sql/20261016-数据库变更汇总.md
new file mode 100644
index 000000000..eb2172ede
--- /dev/null
+++ b/deploy/sql/20261016-数据库变更汇总.md
@@ -0,0 +1,63 @@
+# 2026-10-16 拉取合并数据库变更汇总
+
+范围：IDEA 更新前暂存基点 `cda5f3dc3` 到远程 `test` 的 `4e2ea8940`，加上本次恢复的本地改动。不是任意历史版本的一键全量升级脚本。没有连接或执行实际数据库。
+
+## 数据库对应关系
+
+| 服务 | 数据库 | 本次处理 |
+|---|---|---|
+| lastleg-service | `baiyue_lastleg` | 执行下列 V28 增量，新增表、字段、索引并放宽四个字段的可空性 |
+| warehouse-overseas-service | `baiyue_lastlag_warehouse` | 仅业务代码变化，无新增表或字段，无需 SQL；数据库名称保留正式的 lastlag 拼写 |
+| 其他服务 | 各服务原数据库 | 本次比较范围内无 SQL 结构新增，无需 SQL |
+
+已有尾程库使用：[V28 可重复执行 SQL](migrations/overseas/baiyue_lastleg/V28__merge_transfer_measurement_and_compact_numbers.sql)。文件显式指定 `USE baiyue_lastleg`，不访问其他服务数据库。
+
+## 新表与字段
+
+| 表 | 字段 | 定义/用途 |
+|---|---|---|
+| `ll_compact_number_clock`（新表） | `number_key` | VARCHAR(16)，主键，业务前缀及客户名称缩写 |
+| 同上 | `last_second` | BIGINT NOT NULL，短单号分配逻辑秒，防止同秒及多实例重号 |
+| `ll_warehouse_transfer_item` | `declared_quantity` | BIGINT NULL，SKU 申报件数，独立于箱数 |
+| `ll_warehouse_transfer_carton` | `length_cm`、`width_cm`、`height_cm`、`gross_weight_kg` | DECIMAL(12,2) NULL，逐箱实测尺寸、重量 |
+| 同上 | `counted_quantity` | BIGINT NULL，实点 SKU 件数 |
+| 同上 | `count_idempotency_key` | VARCHAR(255) NULL，清点幂等键 |
+| 同上 | `count_request_hash` | VARCHAR(64) NULL，清点请求摘要 |
+| 同上 | `counted_by` | VARCHAR(128) NULL，清点操作人 |
+| 同上 | `counted_at` | DATETIME(3) NULL，清点时间 |
+| 同上 | `discrepancy_reason` | VARCHAR(1000) NULL，实收差异原因 |
+| 同上 | `transfer_pallet_id` | BIGINT NULL，所属转运托盘事实 ID |
+| 同上 | `sku_items_json` | JSON NULL，一箱多 SKU 清点明细 |
+| 同上 | `customer_carton_mark` | VARCHAR(255) NULL，客户原箱唛及现场换标绑定 |
+
+合计：1 张新表（2 列）、既有表补齐 14 列。逐箱清点等字段在旧版独立增量中已有，本次合并统一纳入 V28，避免漏执行；已存在的列会跳过。
+
+## 索引及既有字段调整
+
+| 表 | 调整 |
+|---|---|
+| `ll_cargo_discard_item` | 缺失时增加普通索引 `idx_ll_cargo_discard_return_carton(customer_id,return_carton_id)` |
+| `ll_warehouse_transfer_order` | `estimated_arrival_at` 改为 DATETIME(3) NULL，库存转运无需填写预计入仓时间 |
+| `ll_delivery_order` | `total_volume_cbm` 改为 DECIMAL(18,4) NULL，未知体积保持空值 |
+| `ll_outbound_order`、`ll_outbound_pallet_item` | `volume_cbm` 改为 DECIMAL(18,4) NULL，未知体积保持空值 |
+
+远程同时完善了 `ll_relabel_application.delivery_method` 的业务说明及照片、预约表的中文注释，没有新增对应字段，不需要因此另建表。照片回显和箱子订单归属校验复用已有结构。
+
+## 执行与重跑
+
+1. 确认连接为需要升级的 MySQL 8 实例，已有 `baiyue_lastleg` 及之前版本的业务表。通过数据库客户端打开并完整执行 V28，失败时停止，不启用忽略错误继续执行。
+2. 新表采用 `CREATE TABLE IF NOT EXISTS`；每个新增字段和索引单独检查 `information_schema`，部分完成后可重跑。四个可空字段仅在当前为 NOT NULL 时调整。不会回填、删除或重算历史业务数据。
+3. DDL 在 MySQL 中会自动提交，不能整体事务回滚；脚本不会修复同名但定义不一致的已有列、索引或新表，执行前应核对这些对象的结构。脚本末尾提供字段结构查询。
+4. 此前 V1–V27 和其他已发布增量仍按原版本顺序管理，V28 不替代它们；缺失整个业务表的旧库应先完成对应历史升级。
+
+空库使用原有海外统一初始化入口，已同步最终建表结构与 209 张表计数。名称含“增量”的海外统一文件仍仅用于空库，不应向已有业务库执行。
+
+## 本地合并记录
+
+远程分支已拉取，当前本地 HEAD 与 `origin/test` 一致。本次异常来自 IDEA 恢复更新前暂存补丁不完整；48 个文件按当前文件、原始基点、暂存内容做三方合并。唯一文本冲突保留远程 `bindingGuard` 与本地 `compactNumbers` 两项测试依赖初始化。
+
+恢复前文件及三方版本保存在 `D:/project/.codex-temp/pull-resolution-20261016`；IDEA 原 shelf 保留。没有自动提交或推送代码。
+
+本地验证：相关业务 Maven 定向测试通过；初始化基线、入库费用/扣货及网关路由合同共 27 项通过；Git 无未解决索引、无残留冲突标记，差异格式检查通过。SQL 仅完成离线核对，未进行 MySQL 实库执行或二次重跑验证。
+
+指引索引检查 `scripts/agents-index-contract.ps1` 因工作区缺少 `D:/project/docs/业务快速索引.md` 而中止，此项未通过；未为消除检查错误而创建替代业务文档。
diff --git a/deploy/sql/README.md b/deploy/sql/README.md
index 909f61a79..10ac3e7aa 100644
--- a/deploy/sql/README.md
+++ b/deploy/sql/README.md
@@ -1,5 +1,9 @@
 # 单测试环境数据库空库初始化
 
+`migrations/overseas/baiyue_lastleg/V23__align_return_movement_collation.sql` 将退货进销存 UNION 涉及的八张表、22 个文本字段及表默认规则显式统一为 `utf8mb4_unicode_ci`，同步 Lastleg 两份源基线与海外统一空库基线。执行前核对字段长度、默认值、可空性及目标规则下唯一索引无冲突；只修改规则，不回填或删除数据，不重放空库基线。DDL 非事务，失败时停止并复查实际已完成项；可按最终定义重跑。脚本存在不表示测试库已执行，执行后用原始计数/分页查询验证，无需发布查询转换代码。
+
+`migrations/overseas/baiyue_lastleg/V22__selfop_warehouse_daily_sales.sql` 新增自营仓库每日汇总表及销量版本 `warehouse_daily_ready` 标记。与匹配 Lastleg 一起发布；汇总随 SKU 日事实批次原子构建，完整性验证后方可发布。已有未构建汇总的销量版本须重新构建发布，不回填旧版本、不回退旧查询；空版本同样必须有就绪证据。源基线与海外空库基线同步。
+
 `migrations/overseas/baiyue_lastleg/V21__procurement_fee_confirmation_origin.sql` 增加采购费用核定入口，区分业务节点与财务操作，用于独立新增费用、替代核定及其重试权限。同步源基线和海外统一空库基线；不回填测试存量，不表示已执行。
 
 `migrations/overseas/baiyue_lastleg/V20__procurement_exception_control.sql` 增加采购事实更正/阻断说明、异常关闭及逐来源最终去向三表。服务端保持原收货和发运记录，关闭不产生库存、退款或退货运输；需与采购详情聚合和节点阻断校验的匹配版本发布。源基线和海外统一基线同步，本文件存在不表示已执行。
@@ -22,14 +26,27 @@
 
 内部拼车需求池的当前结构在 Lastleg 源基线和海外统一空库基线同步维护，独立五项权限在 IAM 源种子和国内统一基线维护。已存在基础表的指定环境结构补齐使用 `migrations/overseas/baiyue_lastleg/V10__fleet_capacity_pool.sql` 与 `migrations/cn/baiyue_iam/V4__fleet_capacity_offer_permissions.sql`；执行前确认三张新表、六个新增字段均未存在，并单独核对目标环境。随后 `V11__align_capacity_pool_collation.sql` 将预订与商业桥的客户关联字段显式统一为 `utf8mb4_unicode_ci`，与原订单域一致，避免依赖MySQL实例默认排序规则导致JOIN失败。它们不回填、删除或重置业务数据，不能重放整个空库基线。候选文件存在不表示已经执行。
 
+平台自营领星统计十张 `ll_selfop_*` 表直接同步 Lastleg 源基线及海外统一空库基线；时间使用 UTC 存储及已确认北京时间业务日，数量使用 DECIMAL 保留 PCS 精度，维持独立发布版本。包含账号共享预算/冷却、验证根用途与硬预算、TEST BUSINESS 根会话持久预算、稳定任务号、阶段进度/心跳和旧版替代时间；任务的 `business_root_task_id` 标记共享根，只有根保存 `business_budget_json`，生产任务不使用该测试预算。库存 run 包含每日代表日期、选择规则及账号/仓库/日期唯一约束，代表库存与 profile 不适用销量副本淘汰。IAM 权限源为 `iam/src/main/resources/db/selfoperated-analytics-permissions.sql`，自营业务下经营总览、销量分析、库存分析、数据采集的菜单资源与独立读写权限同步国内统一基线，仅平台管理员默认授权。执行和部署状态只维护于工作区测试环境主契约；真实采集模式默认 OFF。
+
+客户/商品资料基线为 `lastleg-service/src/main/resources/db/selfop-master-data.sql`，仅新增 `ll_selfop_owner`、`ll_selfop_product` 两表，并同步在 Lastleg 和海外统一空库基线。按来源账号、货主编码、SKU 和完整资料版本关联，不创建平台客户、收费对象或独立映射表；未知实测尺寸保持 NULL。对 TEST 已有库只审阅并授权这两张新表的 CREATE，不能重放统一初始化文件，也不重置采集数据。
+
+历史库存还原基线为 `lastleg-service/src/main/resources/db/selfop-inventory-history.sql`，新增流水事实、历史日版本和日库存三表；同步 Lastleg 与海外空库基线。仅执行这三表 CREATE，不重放原始库存或销量表。匹配版本复用 `sync_task/run/stage` 的 `INVENTORY_FLOW_HISTORY`、`INVENTORY_HISTORY_BUILD` 与 `INVENTORY_FLOW/HISTORY_INPUT`，原库存快照不改写。完成三表并部署 Integration、Lastleg、Admin 后，才启用 `baiyue.self-operated-analytics.inventory-history-enabled=true`；默认关闭，历史目标30日优先再60日。保留当前账号出口、1200ms间隔和所有被历史版本引用的证据；现有销量副本淘汰不得删除这些引用。
+
+预约工作事项新增结构由 `lastleg-service/src/main/resources/db/appointment-work.sql` 提供五张表：完整范围协调锁、工作关系、不可变历史、承诺影响版本与逐票批次实物分配，已同步 Lastleg 和海外空库初始化入口；对已有 TEST 仅审阅并授权这五表 CREATE 及协调锁初始行。直送目的仓实际卸货独立表由 `firstleg/src/main/resources/db/phase3-direct-delivery-schema.sql` 提供并同步国内空库入口，不产生海外库存。两项独立写权限见 `iam/src/main/resources/db/appointment-work-permissions.sql`，先校验精确权限身份再写入；默认只授权平台管理员。旧预约表的有损重建只允许单独审阅 `reset-test-fba-appointments.sql`；若历史、核实或工作/分配表已存在，前置检查会在 DROP 前拒绝，不能重放或擅自扩大重置范围。以上只维护脚本，不代表已执行或已部署。
+
+换标直接出库的实物体积快照在 `ll_outbound_order.volume_cbm`、`ll_outbound_pallet_item.volume_cbm`、`ll_delivery_order.total_volume_cbm` 三列均允许 NULL，表示来源尚未确认；已有实盘尺寸按箱计算，不能用默认 0 代替未知，也不按 SKU 件数重复累计。两份初始化基线同步此定义，已有 TEST 只能在核对结构和授权后精确调整这三列，不重放空库文件或回填历史行。
+
 ## 唯一入口与区域边界
 
+V13 收货覆盖由 `lastleg-service/src/main/resources/db/appointment-receiving.sql` 提供四表：独立收货预约、当前/历史客户成员、待确认变化和不可变覆盖版本；同步 Lastleg 与海外空库基线。有效外部约号唯一性归收货预约的目的仓与约号，批次头表不再独立占用约号。部署前必须核对四表及旧头表唯一索引；本批只准备基线，不提供测试存量回填或自动重置。旧 `reset-test-fba-appointments.sql` 已拒绝存在这些新表的环境，不能用于重放 V13 初始化。实际 SQL 与部署须逐项授权。
+
 两个统一 SQL 文件仍只用于空库初始化，名称中的“增量”不表示可向已有业务库重放。已有生产库的受控结构补齐单独放在 `migrations/`，只允许明确审阅过的增量变更；不提供存量数据回填、清理或兼容入口。
 
 | 区域 | 完整入口 | 服务 schema | 表数 |
 |---|---|---|---:|
-| 国内 | `头程数据库统一增量-MySQL8.sql` | `baiyue_auth`、`baiyue_iam`、`baiyue_order`、`baiyue_warehouse`、`baiyue_firstleg`、`baiyue_file`、`baiyue_audit`、`baiyue_finance` | 226 |
-| 海外 | `海外区域统一增量-MySQL8.sql` | `baiyue_lastleg`、`baiyue_lastlag_warehouse` | 181 |
+| 国内 | `头程数据库统一增量-MySQL8.sql` | `baiyue_auth`、`baiyue_iam`、`baiyue_order`、`baiyue_warehouse`、`baiyue_firstleg`、`baiyue_file`、`baiyue_audit`、`baiyue_finance` | 227 |
+| 海外 | `海外区域统一增量-MySQL8.sql` | `baiyue_lastleg`、`baiyue_lastlag_warehouse` | 214 |
+
 
 - 所有服务位于同一测试环境；两份文件只分组组织服务 schema，不代表两个部署区域。`baiyue_lastlag_warehouse` 保留当前正式的 `lastlag` 拼写。
 - 两份文件必须在同一测试数据库实例中完成初始化；业务服务仍只访问本服务 schema，经内部接口访问 IAM/Warehouse。已移除事件桥两个 schema 的创建，不对已有数据库执行 DROP。
@@ -51,7 +68,7 @@
 5. DDL 隐式提交，不可整体回滚。失败后停止并保留错误；经另行授权准备空库后从头执行，不针对半初始化库追加迁移或从失败行续跑。
 6. Firstleg 测量项与拆分项互为外键：建空表期间暂设会话 `foreign_key_checks=0`，随后立即恢复 `1`，再插入种子。失败时关闭连接。两边外键完整保留在 CREATE TABLE 内。
 
-成功时只在最末输出一行 `initialization_status=PASS`，并带 `region=CN/OVERSEAS`、`initialized_tables=226/181`。必须同时确认客户端退出码 0；忽略错误后出现的 PASS 不算成功。
+成功时只在最末输出一行 `initialization_status=PASS`，并带 `region=CN/OVERSEAS`、`initialized_tables=227/214`。必须同时确认客户端退出码 0；忽略错误后出现的 PASS 不算成功。
 
 ## 平台管理员密码
 
@@ -67,7 +84,7 @@
 
 | 所属库 | 保留内容 | 不包含 |
 |---|---|---|
-| Auth / IAM | 平台主体、唯一平台管理员、8 个系统角色及企业管理员模板、417 个权限、598 条角色权限、7 个数据范围、客户编号起点；无人工完成订单权限 | 测试客户、固定客户账号、额外扩权 |
+| Auth / IAM | 平台主体、唯一平台管理员、8 个系统角色及企业管理员模板、419 个权限、600 条角色权限、7 个数据范围、客户编号起点；无人工完成订单权限 | 测试客户、固定客户账号、额外扩权 |
 | Warehouse | 既有公共仓目录 318 条及地址；义乌、东莞、洛杉矶、纽约 4 个作业仓收货能力 | 示例供应商、快递、往来单位、托盘、库位、预占、库存 |
 | Firstleg | 112 个费用项目、15 个渠道目录、7 个始发地别名、4 个公共仓映射 | 客户报价、订单、入库、实测或履约记录 |
 | File / Finance | 导出互斥键 `GLOBAL_CREATE`、默认平台财务主体 | 文件任务、资金、账单或交易流水 |
@@ -139,3 +156,11 @@ node --test scripts/admin-test-env-modules/initialization-baseline-contract.test
 本次整理使用隔离 MySQL 8.4，国内与海外分别在不存在对方区域 schema 的空库执行两轮，逐表比对整理前最终字段、默认值、索引、约束、注释及业务触发器。SHOW CREATE 的冗余字符集显示与运行态自增计数不视为结构差异；移除示例种子和强制改密是明确行为变更。这不代表已部署或完成真实 HTTP 验收。
 
 码头车队邮件配置见 [Firstleg 车队邮件](../../firstleg/docs/terminal-drayage-mail.md)。
+
+`migrations/overseas/baiyue_lastleg/V24__cargo_discard_photos.sql` 仅新增废弃照片关联表，按客户、申请和托盘关联文件及提交时间。与 Lastleg、File 和三端照片功能共同发布；不回填历史废弃单，不修改库存。脚本存在不表示目标环境已执行。
+
+自营库存周转后端导出权限见 `selfop-turnover-export-permission.sql`，仅新增 `platform:self-operated-analytics:export` 并授予平台管理员；同步 IAM 自营权限源及国内统一基线。配套部署 Lastleg、File、Admin，File 注册 `SELFOP_INVENTORY_TURNOVER`（Nacos同名配置同步）；无业务建表及采集配置变更。执行前须逐项授权。
+
+货物废弃通用库存与散箱字段迁移：`migrations/overseas/baiyue_lastleg/V25__cargo_discard_generic_inventory.sql`。新增库存仓位关联及箱唛快照，须先迁移再部署 Lastleg；不回填历史废弃单。
+
+2026-10-16 拉取合并配套结构清单及执行边界见 [数据库变更汇总](20261016-数据库变更汇总.md)，已有尾程库使用 `migrations/overseas/baiyue_lastleg/V28__merge_transfer_measurement_and_compact_numbers.sql`；空库初始化海外表数同步为 209。该增量可重复执行，尚未执行到任何实际数据库。
diff --git a/deploy/sql/migrations/cn/baiyue_iam/V6__cargo_discard_customer_confirmation_permission.sql b/deploy/sql/migrations/cn/baiyue_iam/V6__cargo_discard_customer_confirmation_permission.sql
new file mode 100644
index 000000000..b4952fe4f
--- /dev/null
+++ b/deploy/sql/migrations/cn/baiyue_iam/V6__cargo_discard_customer_confirmation_permission.sql
@@ -0,0 +1,21 @@
+-- 仅 baiyue_iam，新增客户废弃确认按钮权限并授权默认客户管理员。
+-- 自定义客户角色由管理员按需分配；不自动扩大其权限。
+-- 可重复执行；授权和持久化安全版本在同一事务提交。
+START TRANSACTION;
+INSERT INTO iam_permission(id,tenant_id,app_code,permission_type,parent_id,permission_code,permission_name,route_path,http_method,sort_no,status,built_in,deleted)
+VALUES (5306183,0,'MERCHANT','BUTTON',5306180,'merchant:overseas-warehouse:discard:confirm','确认废弃完成',NULL,'POST',30,'ACTIVE',1,0)
+ON DUPLICATE KEY UPDATE permission_name=VALUES(permission_name),status='ACTIVE',deleted=0;
+INSERT IGNORE INTO iam_role_permission(tenant_id,role_id,permission_id,created_at)
+SELECT 0,r.id,p.id,NOW(3) FROM iam_role r JOIN iam_permission p
+  ON p.tenant_id=0 AND p.app_code='MERCHANT' AND p.permission_code='merchant:overseas-warehouse:discard:confirm'
+WHERE r.tenant_id=0 AND r.app_code='MERCHANT' AND r.role_code='MERCHANT_OWNER' AND r.status='ACTIVE' AND r.deleted=0;
+INSERT INTO iam_security_subject_version(auth_user_id,permission_version)
+SELECT DISTINCT u.auth_user_id,1 FROM iam_user u
+JOIN iam_membership m ON m.user_id=u.id
+JOIN iam_membership_role mr ON mr.membership_id=m.id AND mr.tenant_id=m.tenant_id
+JOIN iam_role r ON r.id=mr.role_id
+WHERE u.auth_user_id IS NOT NULL AND u.status='ACTIVE' AND u.deleted=0
+  AND m.status='ACTIVE' AND m.deleted=0 AND r.tenant_id=0 AND r.app_code='MERCHANT'
+  AND r.role_code='MERCHANT_OWNER' AND r.status='ACTIVE' AND r.deleted=0
+ON DUPLICATE KEY UPDATE permission_version=permission_version+1;
+COMMIT;
diff --git a/deploy/sql/migrations/overseas/baiyue_lastleg/V22__selfop_warehouse_daily_sales.sql b/deploy/sql/migrations/overseas/baiyue_lastleg/V22__selfop_warehouse_daily_sales.sql
new file mode 100644
index 000000000..fc0c9f2b4
--- /dev/null
+++ b/deploy/sql/migrations/overseas/baiyue_lastleg/V22__selfop_warehouse_daily_sales.sql
@@ -0,0 +1,21 @@
+CREATE TABLE IF NOT EXISTS ll_selfop_warehouse_daily_sales (
+  sales_run_id BIGINT NOT NULL COMMENT '完整销量计算版本标识',
+  source_account VARCHAR(64) NOT NULL COMMENT '受控来源账号别名，不保存密钥',
+  warehouse_code VARCHAR(64) NOT NULL COMMENT '来源仓库原始编码',
+  business_date DATE NOT NULL COMMENT '已核准业务日',
+  observed_quantity DECIMAL(38,6) NULL COMMENT '该日PCS非负有效出库量之和，无有效行时为空',
+  invalid_row_count BIGINT NOT NULL COMMENT '该日数量为空或负数或单位非PCS的日事实行数',
+  source_row_count BIGINT NOT NULL COMMENT '该日参与仓库汇总的SKU日事实总行数',
+  created_at DATETIME(3) NOT NULL COMMENT 'UTC创建时间',
+  updated_at DATETIME(3) NOT NULL COMMENT 'UTC更新时间',
+  PRIMARY KEY (sales_run_id,source_account,warehouse_code,business_date),
+  CONSTRAINT chk_selfop_warehouse_daily_sales CHECK (source_row_count > 0 AND invalid_row_count >= 0 AND invalid_row_count <= source_row_count AND (observed_quantity IS NULL OR observed_quantity >= 0))
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_bin COMMENT='完整销量版本按仓按日汇总，随SKU日事实批次原子构建';
+
+SET @selfop_warehouse_daily_ready_ddl = IF(
+  EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_selfop_sync_run' AND column_name='warehouse_daily_ready'),
+  'SELECT 1',
+  'ALTER TABLE ll_selfop_sync_run ADD COLUMN warehouse_daily_ready TINYINT NOT NULL DEFAULT 0 COMMENT ''仓库日汇总已完整构建并校验，含完整空版本''');
+PREPARE selfop_warehouse_daily_ready_stmt FROM @selfop_warehouse_daily_ready_ddl;
+EXECUTE selfop_warehouse_daily_ready_stmt;
+DEALLOCATE PREPARE selfop_warehouse_daily_ready_stmt;
diff --git a/deploy/sql/migrations/overseas/baiyue_lastleg/V23__align_return_movement_collation.sql b/deploy/sql/migrations/overseas/baiyue_lastleg/V23__align_return_movement_collation.sql
new file mode 100644
index 000000000..588c40a39
--- /dev/null
+++ b/deploy/sql/migrations/overseas/baiyue_lastleg/V23__align_return_movement_collation.sql
@@ -0,0 +1,44 @@
+-- Region: OVERSEAS
+-- Schema: baiyue_lastleg
+-- Purpose: 统一退货进销存 UNION 文本列排序规则，去除查询转换需求
+-- Preconditions: 八张退货表已存在；核对字段长度、可空性、默认值及唯一索引无目标规则冲突
+-- Postconditions: 指定文本字段及表默认规则统一为 utf8mb4_unicode_ci；不修改数量、状态或业务标识
+-- 不重放空库基线；本文件可重复执行。DDL 非事务，失败停止并核对后续执行范围。
+ALTER TABLE ll_return_order
+  DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci,
+  MODIFY COLUMN customer_id VARCHAR(128) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL COMMENT '客户ID和隔离键',
+  MODIFY COLUMN overseas_warehouse_id VARCHAR(128) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL COMMENT '操作海外仓ID';
+ALTER TABLE ll_return_order_item
+  DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci,
+  MODIFY COLUMN sku_code VARCHAR(128) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL COMMENT 'SKU编码',
+  MODIFY COLUMN product_name_zh VARCHAR(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NULL COMMENT '中文品名';
+ALTER TABLE ll_return_receipt
+  DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci,
+  MODIFY COLUMN receipt_no VARCHAR(128) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL COMMENT '签收单号';
+ALTER TABLE ll_return_receipt_item
+  DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci,
+  MODIFY COLUMN sku_code VARCHAR(128) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL COMMENT 'SKU编码';
+ALTER TABLE ll_return_inventory_carton
+  DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci,
+  MODIFY COLUMN customer_id VARCHAR(128) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL COMMENT '客户ID和隔离键',
+  MODIFY COLUMN overseas_warehouse_id VARCHAR(128) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL COMMENT '海外仓ID',
+  MODIFY COLUMN carton_mark VARCHAR(128) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL COMMENT '退货箱号和箱唛编码';
+ALTER TABLE ll_return_inventory_carton_item
+  DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci,
+  MODIFY COLUMN sku_code VARCHAR(128) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL COMMENT 'SKU编码',
+  MODIFY COLUMN product_name_zh VARCHAR(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NULL COMMENT '中文品名';
+ALTER TABLE ll_return_inventory_outbound_movement
+  DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci,
+  MODIFY COLUMN customer_id VARCHAR(128) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL COMMENT '库存所属客户ID和隔离键',
+  MODIFY COLUMN overseas_warehouse_id VARCHAR(128) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL COMMENT '实际出库海外仓ID',
+  MODIFY COLUMN sku_code VARCHAR(128) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL COMMENT '本次出库SKU编码快照',
+  MODIFY COLUMN product_name_zh VARCHAR(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NULL COMMENT '中文品名快照',
+  MODIFY COLUMN outbound_no VARCHAR(64) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL COMMENT '本次退货出库业务单号';
+ALTER TABLE ll_return_sku_conversion
+  DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci,
+  MODIFY COLUMN customer_id VARCHAR(128) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL COMMENT '客户隔离键',
+  MODIFY COLUMN overseas_warehouse_id VARCHAR(128) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL COMMENT '操作海外仓ID',
+  MODIFY COLUMN old_sku_code VARCHAR(128) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL COMMENT '换标前SKU',
+  MODIFY COLUMN new_sku_code VARCHAR(128) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL COMMENT '换标后SKU',
+  MODIFY COLUMN product_name_zh VARCHAR(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NULL COMMENT '中文品名快照',
+  MODIFY COLUMN relabel_no VARCHAR(64) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL COMMENT '换标单号';
diff --git a/deploy/sql/migrations/overseas/baiyue_lastleg/V24__cargo_discard_photos.sql b/deploy/sql/migrations/overseas/baiyue_lastleg/V24__cargo_discard_photos.sql
new file mode 100644
index 000000000..1373e87ce
--- /dev/null
+++ b/deploy/sql/migrations/overseas/baiyue_lastleg/V24__cargo_discard_photos.sql
@@ -0,0 +1,16 @@
+CREATE TABLE IF NOT EXISTS ll_cargo_discard_photo (
+  id BIGINT NOT NULL,
+  customer_id VARCHAR(64) NOT NULL,
+  application_id BIGINT NOT NULL,
+  pallet_no VARCHAR(128) NOT NULL,
+  file_id BIGINT NOT NULL,
+  file_name VARCHAR(255) NOT NULL,
+  content_type VARCHAR(128) NOT NULL,
+  size_bytes BIGINT NOT NULL,
+  operator_id VARCHAR(64) NOT NULL,
+  created_at DATETIME(6) NOT NULL,
+  submitted_at DATETIME(6) NULL,
+  PRIMARY KEY (id),
+  UNIQUE KEY uk_cargo_discard_photo_file (file_id),
+  KEY idx_cargo_discard_photo_application (customer_id, application_id, pallet_no)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
diff --git a/deploy/sql/migrations/overseas/baiyue_lastleg/V25__cargo_discard_generic_inventory.sql b/deploy/sql/migrations/overseas/baiyue_lastleg/V25__cargo_discard_generic_inventory.sql
new file mode 100644
index 000000000..4e79aa929
--- /dev/null
+++ b/deploy/sql/migrations/overseas/baiyue_lastleg/V25__cargo_discard_generic_inventory.sql
@@ -0,0 +1,24 @@
+-- 货物废弃支持所有入库来源及散箱全量作业；不回填或修改历史单据。
+SET @ddl = IF(NOT EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_cargo_discard_item' AND column_name='inventory_position_id'),
+  'ALTER TABLE ll_cargo_discard_item ADD COLUMN inventory_position_id BIGINT NULL COMMENT ''废弃来源库存仓位ID''', 'SELECT 1');
+PREPARE stmt FROM @ddl; EXECUTE stmt; DEALLOCATE PREPARE stmt;
+
+SET @ddl = IF(NOT EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_cargo_discard_item' AND column_name='carton_marks_json'),
+  'ALTER TABLE ll_cargo_discard_item ADD COLUMN carton_marks_json TEXT NULL COMMENT ''本次废弃所选真实箱唛快照JSON数组''', 'SELECT 1');
+PREPARE stmt FROM @ddl; EXECUTE stmt; DEALLOCATE PREPARE stmt;
+
+SET @ddl = IF(NOT EXISTS (SELECT 1 FROM information_schema.statistics WHERE table_schema=DATABASE() AND table_name='ll_cargo_discard_item' AND index_name='uk_ll_discard_position_sku'),
+  'ALTER TABLE ll_cargo_discard_item ADD UNIQUE KEY uk_ll_discard_position_sku(application_id,inventory_position_id,sku_code)', 'SELECT 1');
+PREPARE stmt FROM @ddl; EXECUTE stmt; DEALLOCATE PREPARE stmt;
+
+ALTER TABLE ll_cargo_discard_item MODIFY COLUMN source_type VARCHAR(32) NOT NULL DEFAULT 'DROPSHIP' COMMENT '库存来源：一件代发DROPSHIP、退货箱RETURN_CARTON、通用库存INVENTORY';
+
+SET @ddl = IF(NOT EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_cargo_discard_item' AND column_name='carton_scan_required'),
+  'ALTER TABLE ll_cargo_discard_item ADD COLUMN carton_scan_required TINYINT(1) NOT NULL DEFAULT 0 COMMENT ''是否需要逐箱核对本次所选箱子''', 'SELECT 1');
+PREPARE stmt FROM @ddl; EXECUTE stmt; DEALLOCATE PREPARE stmt;
+ALTER TABLE ll_cargo_discard_item MODIFY COLUMN carton_marks_json TEXT NULL COMMENT '本次废弃所选真实箱唛快照JSON数组';
+ALTER TABLE ll_inbound_plan_carton MODIFY COLUMN status VARCHAR(32) NOT NULL COMMENT '箱唛状态：未绑定UNASSIGNED、已绑托ON_PALLET、整票收货BULK_RECEIVED、可用AVAILABLE、待废弃DISCARD_PENDING、已废弃DISCARDED';
+
+SET @ddl = IF(NOT EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_cargo_discard_carton' AND column_name='source_type'),
+  'ALTER TABLE ll_cargo_discard_carton ADD COLUMN source_type VARCHAR(32) NOT NULL DEFAULT ''DROPSHIP'' COMMENT ''箱子来源：一件代发DROPSHIP、入仓箱INBOUND、转运箱TRANSFER''', 'SELECT 1');
+PREPARE stmt FROM @ddl; EXECUTE stmt; DEALLOCATE PREPARE stmt;
diff --git a/deploy/sql/migrations/overseas/baiyue_lastleg/V26__allow_zero_return_carton_item_quantity.sql b/deploy/sql/migrations/overseas/baiyue_lastleg/V26__allow_zero_return_carton_item_quantity.sql
new file mode 100644
index 000000000..7f5a22c6b
--- /dev/null
+++ b/deploy/sql/migrations/overseas/baiyue_lastleg/V26__allow_zero_return_carton_item_quantity.sql
@@ -0,0 +1,13 @@
+-- 整箱废弃后保留SKU明细，剩余数量允许归零，仍禁止负库存。
+-- 原子替换约束，可重复执行；不修改业务记录。
+SET @ddl = IF(EXISTS (
+  SELECT 1 FROM information_schema.table_constraints
+  WHERE constraint_schema=DATABASE() AND table_name='ll_return_inventory_carton_item'
+    AND constraint_name='chk_ll_return_inventory_carton_item_quantity'
+),
+  'ALTER TABLE ll_return_inventory_carton_item DROP CHECK chk_ll_return_inventory_carton_item_quantity, ADD CONSTRAINT chk_ll_return_inventory_carton_item_quantity CHECK(quantity>=0)',
+  'ALTER TABLE ll_return_inventory_carton_item ADD CONSTRAINT chk_ll_return_inventory_carton_item_quantity CHECK(quantity>=0)'
+);
+PREPARE stmt FROM @ddl;
+EXECUTE stmt;
+DEALLOCATE PREPARE stmt;
diff --git a/deploy/sql/migrations/overseas/baiyue_lastleg/V27__cargo_discard_customer_confirmation.sql b/deploy/sql/migrations/overseas/baiyue_lastleg/V27__cargo_discard_customer_confirmation.sql
new file mode 100644
index 000000000..c8109e3c2
--- /dev/null
+++ b/deploy/sql/migrations/overseas/baiyue_lastleg/V27__cargo_discard_customer_confirmation.sql
@@ -0,0 +1,3 @@
+-- 客户确认废弃完结时间，可重复执行；仅结构变更。
+SET @ddl = IF(NOT EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_cargo_discard_application' AND column_name='customer_confirmed_at'), 'ALTER TABLE ll_cargo_discard_application ADD COLUMN customer_confirmed_at DATETIME(3) NULL COMMENT ''客户确认废弃完结时间''', 'SELECT 1');
+PREPARE stmt FROM @ddl; EXECUTE stmt; DEALLOCATE PREPARE stmt;
diff --git a/deploy/sql/migrations/overseas/baiyue_lastleg/V28__merge_transfer_measurement_and_compact_numbers.sql b/deploy/sql/migrations/overseas/baiyue_lastleg/V28__merge_transfer_measurement_and_compact_numbers.sql
new file mode 100644
index 000000000..54d74c3c1
--- /dev/null
+++ b/deploy/sql/migrations/overseas/baiyue_lastleg/V28__merge_transfer_measurement_and_compact_numbers.sql
@@ -0,0 +1,70 @@
+-- 2026-10-16 拉取合并及本地恢复配套增量，MySQL 8。
+-- 目标：lastleg-service / baiyue_lastleg；前置：已有业务表及此前迁移。
+-- 只调整结构，不回填、删除或重算业务数据；执行失败应停止，修复后可重跑。
+SET NAMES utf8mb4;
+USE baiyue_lastleg;
+
+CREATE TABLE IF NOT EXISTS ll_compact_number_clock (
+  number_key VARCHAR(16) NOT NULL COMMENT '业务前缀和客户名称缩写',
+  last_second BIGINT NOT NULL COMMENT '最后分配的Unix逻辑秒',
+  PRIMARY KEY (number_key)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci COMMENT='海外业务短单号分配时钟';
+
+-- 仓储转运逐箱测量与清点；仅增加字段，不修改业务数据。
+USE baiyue_lastleg;
+SET @ddl = (SELECT IF(EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_warehouse_transfer_carton' AND column_name='length_cm'), 'SELECT 1', 'ALTER TABLE ll_warehouse_transfer_carton ADD COLUMN length_cm DECIMAL(12,2) NULL COMMENT ''箱子实测长度厘米'''));
+PREPARE transfer_count_stmt FROM @ddl; EXECUTE transfer_count_stmt; DEALLOCATE PREPARE transfer_count_stmt;
+SET @ddl = (SELECT IF(EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_warehouse_transfer_carton' AND column_name='width_cm'), 'SELECT 1', 'ALTER TABLE ll_warehouse_transfer_carton ADD COLUMN width_cm DECIMAL(12,2) NULL COMMENT ''箱子实测宽度厘米'''));
+PREPARE transfer_count_stmt FROM @ddl; EXECUTE transfer_count_stmt; DEALLOCATE PREPARE transfer_count_stmt;
+SET @ddl = (SELECT IF(EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_warehouse_transfer_carton' AND column_name='height_cm'), 'SELECT 1', 'ALTER TABLE ll_warehouse_transfer_carton ADD COLUMN height_cm DECIMAL(12,2) NULL COMMENT ''箱子实测高度厘米'''));
+PREPARE transfer_count_stmt FROM @ddl; EXECUTE transfer_count_stmt; DEALLOCATE PREPARE transfer_count_stmt;
+SET @ddl = (SELECT IF(EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_warehouse_transfer_carton' AND column_name='gross_weight_kg'), 'SELECT 1', 'ALTER TABLE ll_warehouse_transfer_carton ADD COLUMN gross_weight_kg DECIMAL(12,2) NULL COMMENT ''箱子实测重量千克'''));
+PREPARE transfer_count_stmt FROM @ddl; EXECUTE transfer_count_stmt; DEALLOCATE PREPARE transfer_count_stmt;
+SET @ddl = (SELECT IF(EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_warehouse_transfer_carton' AND column_name='counted_quantity'), 'SELECT 1', 'ALTER TABLE ll_warehouse_transfer_carton ADD COLUMN counted_quantity BIGINT NULL COMMENT ''箱内SKU实点件数'''));
+PREPARE transfer_count_stmt FROM @ddl; EXECUTE transfer_count_stmt; DEALLOCATE PREPARE transfer_count_stmt;
+SET @ddl = (SELECT IF(EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_warehouse_transfer_carton' AND column_name='count_idempotency_key'), 'SELECT 1', 'ALTER TABLE ll_warehouse_transfer_carton ADD COLUMN count_idempotency_key VARCHAR(255) NULL COMMENT ''箱内清点幂等键'''));
+PREPARE transfer_count_stmt FROM @ddl; EXECUTE transfer_count_stmt; DEALLOCATE PREPARE transfer_count_stmt;
+SET @ddl = (SELECT IF(EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_warehouse_transfer_carton' AND column_name='count_request_hash'), 'SELECT 1', 'ALTER TABLE ll_warehouse_transfer_carton ADD COLUMN count_request_hash VARCHAR(64) NULL COMMENT ''箱内清点请求摘要'''));
+PREPARE transfer_count_stmt FROM @ddl; EXECUTE transfer_count_stmt; DEALLOCATE PREPARE transfer_count_stmt;
+SET @ddl = (SELECT IF(EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_warehouse_transfer_carton' AND column_name='counted_by'), 'SELECT 1', 'ALTER TABLE ll_warehouse_transfer_carton ADD COLUMN counted_by VARCHAR(128) NULL COMMENT ''箱内清点操作人'''));
+PREPARE transfer_count_stmt FROM @ddl; EXECUTE transfer_count_stmt; DEALLOCATE PREPARE transfer_count_stmt;
+SET @ddl = (SELECT IF(EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_warehouse_transfer_carton' AND column_name='counted_at'), 'SELECT 1', 'ALTER TABLE ll_warehouse_transfer_carton ADD COLUMN counted_at DATETIME(3) NULL COMMENT ''箱内清点完成时间'''));
+PREPARE transfer_count_stmt FROM @ddl; EXECUTE transfer_count_stmt; DEALLOCATE PREPARE transfer_count_stmt;
+
+SET @ddl = (SELECT IF(EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_warehouse_transfer_carton' AND column_name='discrepancy_reason'), 'SELECT 1', 'ALTER TABLE ll_warehouse_transfer_carton ADD COLUMN discrepancy_reason VARCHAR(1000) NULL COMMENT ''实收与预报箱数差异原因'''));
+PREPARE transfer_count_stmt FROM @ddl; EXECUTE transfer_count_stmt; DEALLOCATE PREPARE transfer_count_stmt;
+
+SET @ddl = (SELECT IF(EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_warehouse_transfer_carton' AND column_name='transfer_pallet_id'), 'SELECT 1', 'ALTER TABLE ll_warehouse_transfer_carton ADD COLUMN transfer_pallet_id BIGINT NULL COMMENT ''签收箱所属转运托盘事实ID'''));
+PREPARE transfer_count_stmt FROM @ddl; EXECUTE transfer_count_stmt; DEALLOCATE PREPARE transfer_count_stmt;
+
+-- SKU 申报件数独立于预计箱数；历史未申报件数保持 NULL，实收以 PDA 清点为准。
+SET @ddl = (SELECT IF(EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_warehouse_transfer_item' AND column_name='declared_quantity'), 'SELECT 1', 'ALTER TABLE ll_warehouse_transfer_item ADD COLUMN declared_quantity BIGINT NULL COMMENT ''SKU申报件数，非预计或实收箱数'''));
+PREPARE transfer_quantity_stmt FROM @ddl; EXECUTE transfer_quantity_stmt; DEALLOCATE PREPARE transfer_quantity_stmt;
+
+-- 仓储转运一箱多SKU清点；仅增加结构，不回填历史业务数据。
+USE baiyue_lastleg;
+SET @ddl = (SELECT IF(EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_warehouse_transfer_carton' AND column_name='sku_items_json'), 'SELECT 1', 'ALTER TABLE ll_warehouse_transfer_carton ADD COLUMN sku_items_json JSON NULL COMMENT ''实收箱内SKU及逐项件数明细'''));
+PREPARE transfer_sku_stmt FROM @ddl; EXECUTE transfer_sku_stmt; DEALLOCATE PREPARE transfer_sku_stmt;
+
+SET @ddl = IF(NOT EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_warehouse_transfer_carton' AND column_name='customer_carton_mark'), 'ALTER TABLE ll_warehouse_transfer_carton ADD COLUMN customer_carton_mark VARCHAR(255) NULL COMMENT ''客户原箱唛，用于换标现场绑定''', 'SELECT 1');
+PREPARE merge_schema_stmt FROM @ddl; EXECUTE merge_schema_stmt; DEALLOCATE PREPARE merge_schema_stmt;
+
+SET @ddl = IF(NOT EXISTS (SELECT 1 FROM information_schema.statistics WHERE table_schema=DATABASE() AND table_name='ll_cargo_discard_item' AND index_name='idx_ll_cargo_discard_return_carton'), 'ALTER TABLE ll_cargo_discard_item ADD KEY idx_ll_cargo_discard_return_carton(customer_id,return_carton_id)', 'SELECT 1');
+PREPARE merge_schema_stmt FROM @ddl; EXECUTE merge_schema_stmt; DEALLOCATE PREPARE merge_schema_stmt;
+
+SET @ddl = IF(EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_warehouse_transfer_order' AND column_name='estimated_arrival_at' AND is_nullable='NO'), 'ALTER TABLE ll_warehouse_transfer_order MODIFY COLUMN estimated_arrival_at DATETIME(3) NULL COMMENT ''预计入仓时间，库存转运不填写''', 'SELECT 1');
+PREPARE merge_schema_stmt FROM @ddl; EXECUTE merge_schema_stmt; DEALLOCATE PREPARE merge_schema_stmt;
+
+SET @ddl = IF(EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_delivery_order' AND column_name='total_volume_cbm' AND is_nullable='NO'), 'ALTER TABLE ll_delivery_order MODIFY COLUMN total_volume_cbm DECIMAL(18,4) NULL COMMENT ''体积（立方米），来源未确认时为空''', 'SELECT 1');
+PREPARE merge_schema_stmt FROM @ddl; EXECUTE merge_schema_stmt; DEALLOCATE PREPARE merge_schema_stmt;
+
+SET @ddl = IF(EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_outbound_order' AND column_name='volume_cbm' AND is_nullable='NO'), 'ALTER TABLE ll_outbound_order MODIFY COLUMN volume_cbm DECIMAL(18,4) NULL COMMENT ''体积（立方米），来源未确认时为空''', 'SELECT 1');
+PREPARE merge_schema_stmt FROM @ddl; EXECUTE merge_schema_stmt; DEALLOCATE PREPARE merge_schema_stmt;
+
+SET @ddl = IF(EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_outbound_pallet_item' AND column_name='volume_cbm' AND is_nullable='NO'), 'ALTER TABLE ll_outbound_pallet_item MODIFY COLUMN volume_cbm DECIMAL(18,4) NULL COMMENT ''体积（立方米），来源未确认时为空''', 'SELECT 1');
+PREPARE merge_schema_stmt FROM @ddl; EXECUTE merge_schema_stmt; DEALLOCATE PREPARE merge_schema_stmt;
+
+-- 执行后核对本次结构；这不是应用功能验收。
+SELECT table_name,column_name,column_type,is_nullable,column_comment FROM information_schema.columns
+WHERE table_schema=DATABASE() AND table_name IN ('ll_compact_number_clock','ll_warehouse_transfer_carton','ll_warehouse_transfer_item','ll_warehouse_transfer_order','ll_delivery_order','ll_outbound_order','ll_outbound_pallet_item')
+ORDER BY table_name,ordinal_position;
diff --git a/deploy/sql/migrations/overseas/baiyue_lastleg/V29__allow_unbound_transfer_forecast_cartons.sql b/deploy/sql/migrations/overseas/baiyue_lastleg/V29__allow_unbound_transfer_forecast_cartons.sql
new file mode 100644
index 000000000..5f26df5f5
--- /dev/null
+++ b/deploy/sql/migrations/overseas/baiyue_lastleg/V29__allow_unbound_transfer_forecast_cartons.sql
@@ -0,0 +1,2 @@
+-- 对应数据库：baiyue_lastleg；可重复执行，不修改原箱号、SKU预报件数和实测数据。
+ALTER TABLE ll_warehouse_transfer_carton MODIFY COLUMN transfer_item_id BIGINT NULL COMMENT '实际箱内首项SKU明细ID，预报补箱可为空';
diff --git a/deploy/sql/reset-test-fba-appointments.sql b/deploy/sql/reset-test-fba-appointments.sql
index b49fb888a..647947332 100644
--- a/deploy/sql/reset-test-fba-appointments.sql
+++ b/deploy/sql/reset-test-fba-appointments.sql
@@ -1,9 +1,27 @@
 -- TEST ONLY. Rebuild the explicitly authorized appointment header and item tables.
--- The new command-history table MUST NOT already exist; check this before executing any DROP.
--- If it exists, stop and inspect the prior outcome. Do not clear command history or blindly retry.
+-- The command-history and cargo-verification tables MUST NOT already exist; check both before any DROP.
+-- If either exists, stop and inspect the prior outcome. Do not clear history or blindly retry.
 -- Requires explicit approval; never run against production or as automatic startup SQL.
 -- Caller must verify the TEST connection before executing.
 USE baiyue_lastleg;
+DROP PROCEDURE IF EXISTS assert_test_appointment_reset_preconditions;
+DELIMITER $$
+CREATE PROCEDURE assert_test_appointment_reset_preconditions()
+BEGIN
+  IF EXISTS(SELECT 1 FROM information_schema.tables WHERE table_schema=DATABASE()
+      AND table_name IN ('ll_fba_appointment_command','ll_appointment_cargo_verification',
+        'll_appointment_work','ll_dispatch_appointment_allocation','ll_fba_receiving_agreement',
+        'll_fba_receiving_member','ll_fba_receiving_change','ll_fba_receiving_revision','ll_fba_receiving_plan')) THEN
+    SIGNAL SQLSTATE '45000' SET MESSAGE_TEXT='Stop: appointment history or work/allocation schema already exists; inspect before any reset';
+  END IF;
+  IF (SELECT COUNT(*) FROM information_schema.tables WHERE table_schema=DATABASE()
+      AND table_name IN ('ll_inbound_fba_appointment','ll_inbound_fba_appointment_item')) <> 2 THEN
+    SIGNAL SQLSTATE '45000' SET MESSAGE_TEXT='Stop: expected both legacy appointment tables; inspect partial or new schema';
+  END IF;
+END$$
+DELIMITER ;
+CALL assert_test_appointment_reset_preconditions();
+DROP PROCEDURE assert_test_appointment_reset_preconditions;
 DROP TABLE ll_inbound_fba_appointment_item;
 DROP TABLE ll_inbound_fba_appointment;
 CREATE TABLE ll_inbound_fba_appointment (
@@ -24,12 +42,14 @@ CREATE TABLE ll_inbound_fba_appointment (
   appointment_remark VARCHAR(1000) NULL COMMENT '备注或取消原因',
   fba_warehouse_code VARCHAR(128) NOT NULL COMMENT 'FBA目的仓编码',
   selected_count INT NOT NULL DEFAULT 0 COMMENT '真实货源票数',
+  replacement_nos_json LONGTEXT NULL COMMENT '分批或合并后的新预约业务号列表，非空时原批次只读',
+  replacement_keys_json LONGTEXT NULL COMMENT '替代批次不可变键列表，只用于内部业务关联',
+  repartition_reason VARCHAR(1000) NULL COMMENT '分批或合并原因，原安排及来源明细保留',
   created_by VARCHAR(128) NOT NULL COMMENT '登录操作人',
   created_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) COMMENT '创建UTC时间',
   updated_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) COMMENT '更新UTC时间',
   PRIMARY KEY (id),
   UNIQUE KEY uk_ll_fba_appointment_no (appointment_no),
-  UNIQUE KEY uk_ll_fba_external_confirmation (fba_warehouse_code,confirmation_no),
   KEY idx_ll_fba_appointment_list (appointment_at,appointment_status,fba_warehouse_code),
   KEY idx_ll_fba_appointment_planned (planned_at,appointment_status)
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci COMMENT='FBA预约安排与正式确认唯一主记录';
@@ -43,19 +63,42 @@ CREATE TABLE ll_inbound_fba_appointment_item (
   order_id BIGINT NULL COMMENT '尚未形成尾程订单时为空',
   inbound_code VARCHAR(128) NULL COMMENT '真实入仓码，不伪造',
   fba_warehouse_code VARCHAR(128) NOT NULL COMMENT '目的FBA仓编码',
-  package_count INT NULL COMMENT '所选整票预报箱数，未知保持空',
-  active TINYINT(1) NOT NULL DEFAULT 1 COMMENT '取消或失败后释放货源占用',
-  active_source_key VARCHAR(160) GENERATED ALWAYS AS (CASE WHEN active=1 THEN source_key ELSE NULL END) STORED COMMENT '有效货源唯一占用键',
-  active_order_id BIGINT GENERATED ALWAYS AS (CASE WHEN active=1 THEN order_id ELSE NULL END) STORED COMMENT '有效订单唯一占用键',
+  package_count INT NULL COMMENT '本批分配箱数，未知保持空；同一原来源总量守恒',
+  cargo_verification_version INT NULL COMMENT '采用的预约货物核实版本，未核实时为空',
+  shipment_references_json LONGTEXT NULL COMMENT '本次采用的货件或追踪号核实快照',
+  active TINYINT(1) NOT NULL DEFAULT 1 COMMENT '当前批次数量分配有效；取消、未约成和完成均保留，仅替代时释放',
   created_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) COMMENT '创建UTC时间',
   PRIMARY KEY (id),
   UNIQUE KEY uk_ll_fba_item_source (appointment_id,source_key),
-  UNIQUE KEY uk_ll_fba_active_source (active_source_key),
-  UNIQUE KEY uk_ll_fba_active_order (active_order_id),
+  KEY idx_ll_fba_active_source (customer_id,source_key,active),
+  KEY idx_ll_fba_active_order (customer_id,order_id,active),
   KEY idx_ll_fba_item_source_lookup (source_key,customer_id),
   KEY idx_ll_fba_item_customer_order (customer_id,order_id)
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci COMMENT='入仓前后共用的预约真实货源';
 
+CREATE TABLE ll_appointment_cargo_verification (
+  id BIGINT NOT NULL COMMENT '核实记录主键',
+  customer_id VARCHAR(128) NOT NULL COMMENT '原货源所属客户',
+  source_key VARCHAR(160) NOT NULL COMMENT '稳定ORDER或BOOKING原来源键',
+  destination_key VARCHAR(160) NOT NULL COMMENT '核实时的原目的地',
+  source_version VARCHAR(160) NULL COMMENT '核实时的原来源版本',
+  source_packages INT NULL COMMENT '核实时的原来源箱数，未知为空',
+  version INT NOT NULL COMMENT '同一来源的核实版本，从一递增',
+  package_count INT NULL COMMENT '独立核实箱数，不回写原订单',
+  shipment_references_json LONGTEXT NOT NULL COMMENT '本票货件号或追踪号列表，不回写原订单',
+  remark VARCHAR(1000) NULL COMMENT '核实说明',
+  operator_id VARCHAR(128) NOT NULL COMMENT '登录操作人',
+  operator_name VARCHAR(200) NULL COMMENT '操作人名称快照',
+  command_key VARCHAR(64) NOT NULL COMMENT '来源内幂等命令键',
+  request_hash CHAR(64) NOT NULL COMMENT '来源、操作人及请求摘要',
+  created_at DATETIME(3) NOT NULL COMMENT '核实UTC时间',
+  PRIMARY KEY (id),
+  UNIQUE KEY uk_ll_cargo_verification_version (customer_id,source_key,version),
+  UNIQUE KEY uk_ll_cargo_verification_command (customer_id,source_key,command_key),
+  CONSTRAINT chk_ll_cargo_verification_quantity CHECK (package_count IS NULL OR package_count > 0),
+  CONSTRAINT chk_ll_cargo_verification_version CHECK (version > 0)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci COMMENT='预约货物核实资料及不可覆盖的版本历史';
+
 CREATE TABLE ll_fba_appointment_command (
   command_key VARCHAR(128) NOT NULL COMMENT '持久化幂等键',
   request_hash CHAR(64) NOT NULL COMMENT '操作、操作者和请求摘要',
diff --git a/deploy/sql/selfop-turnover-export-permission.sql b/deploy/sql/selfop-turnover-export-permission.sql
new file mode 100644
index 000000000..a1a03d44c
--- /dev/null
+++ b/deploy/sql/selfop-turnover-export-permission.sql
@@ -0,0 +1,11 @@
+-- 自营库存周转后端导出权限；不建表，不修改销量、库存或采集任务。
+USE baiyue_iam;
+SET NAMES utf8mb4;
+START TRANSACTION;
+INSERT INTO iam_permission (id,tenant_id,app_code,permission_type,parent_id,permission_code,permission_name,route_path,http_method,sort_no,status,built_in,created_at,updated_at,deleted) VALUES
+  (5118002,0,'PLATFORM','API',5118120,'platform:self-operated-analytics:export','导出平台自营库存周转','/api/platform/v1/files/export-tasks','POST',20,'ACTIVE',1,CURRENT_TIMESTAMP(3),CURRENT_TIMESTAMP(3),0)
+ON DUPLICATE KEY UPDATE permission_name=VALUES(permission_name),route_path=VALUES(route_path),http_method=VALUES(http_method),status='ACTIVE',deleted=0,updated_at=CURRENT_TIMESTAMP(3);
+INSERT INTO iam_role_permission (role_id,permission_id,tenant_id,created_at)
+SELECT 4000001,5118002,0,CURRENT_TIMESTAMP(3)
+WHERE NOT EXISTS (SELECT 1 FROM iam_role_permission WHERE role_id=4000001 AND permission_id=5118002 AND tenant_id=0);
+COMMIT;
diff --git a/deploy/sql/头程数据库统一增量-MySQL8.sql b/deploy/sql/头程数据库统一增量-MySQL8.sql
index cd4b64281..d58001da3 100644
--- a/deploy/sql/头程数据库统一增量-MySQL8.sql
+++ b/deploy/sql/头程数据库统一增量-MySQL8.sql
@@ -2,7 +2,7 @@
 -- MySQL 8.0+；只允许目标测试环境的服务 schema 为空，已有表立即报错；禁止 --force/遇错继续。
 -- 字段、索引、约束及注释直接定义在 CREATE TABLE 内；不回填、不清理、不改造存量。
 -- 国内 IAM 管理两区域权限；海外不访问国内库。执行方法及系统种子清单见同目录 README.md。
--- DDL 隐式提交；失败后停止，不从中间续跑，也不把部分初始化当成成功。
+-- DDL 隐式提交；失败后停止，不从中间续跑，也不把部分初始化当成成功。utf8mb4_0900_ai_ci
 SET NAMES utf8mb4 COLLATE utf8mb4_0900_ai_ci;
 SET SESSION sql_mode = 'ONLY_FULL_GROUP_BY,STRICT_TRANS_TABLES,NO_ZERO_IN_DATE,NO_ZERO_DATE,ERROR_FOR_DIVISION_BY_ZERO,NO_ENGINE_SUBSTITUTION';
 
@@ -1422,7 +1422,6 @@ CREATE TABLE fl_consumed_event (
 
 CREATE TABLE fl_container_booking (
   id bigint unsigned NOT NULL COMMENT '货柜预订ID（雪花ID）',
-  booking_no varchar(40) NOT NULL COMMENT '平台唯一货柜预订单号',
   container_no varchar(64) CHARACTER SET utf8mb4 COLLATE utf8mb4_0900_ai_ci DEFAULT NULL COMMENT '真实集装箱号权威快照；同一订舱内唯一，不同提单允许复用；确认前允许修订',
   cabinet_no varchar(64) NOT NULL COMMENT '平台唯一内部柜号',
   source_type varchar(24) NOT NULL DEFAULT 'SIMULATION' COMMENT '记录来源：SIMULATION内部模拟柜、OCEAN_BOOKING订舱真实柜',
@@ -1477,7 +1476,6 @@ CREATE TABLE fl_container_booking (
   updated_at datetime(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3) COMMENT '货柜资料最后更新时间',
   version int unsigned NOT NULL DEFAULT '0' COMMENT '乐观锁版本号',
   PRIMARY KEY (id),
-  UNIQUE KEY uk_container_booking_no (booking_no),
   UNIQUE KEY uk_container_booking_cabinet (cabinet_no),
   UNIQUE KEY uk_container_booking_ocean_container (ocean_booking_id,container_no),
   KEY idx_container_booking_container_no (container_no,updated_at,id),
@@ -4104,6 +4102,27 @@ CREATE TABLE fl_split_operation (
   CONSTRAINT fk_split_operation_inbound FOREIGN KEY (inbound_id) REFERENCES fl_inbound_order (id)
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci COMMENT='分柜操作幂等与审计索引';
 
+-- Current schema for actual destination unloading; never an overseas warehouse receipt.
+CREATE TABLE fl_direct_delivery_unloading (
+  container_booking_id BIGINT UNSIGNED NOT NULL,
+  inbound_id BIGINT UNSIGNED NOT NULL COMMENT 'Immutable physically loaded inbound source',
+  actual_at DATETIME(3) NOT NULL COMMENT 'Actual destination local time',
+  timezone VARCHAR(64) NOT NULL COMMENT 'Explicit destination IANA timezone',
+  received_by VARCHAR(128) NOT NULL COMMENT 'Actual recipient',
+  evidence_no VARCHAR(128) NOT NULL COMMENT 'Actual delivery receipt reference',
+  remark VARCHAR(1000) NULL,
+  version INT NOT NULL DEFAULT 1,
+  idempotency_key VARCHAR(128) NOT NULL,
+  request_hash CHAR(64) NOT NULL,
+  created_by BIGINT UNSIGNED NOT NULL,
+  created_by_name VARCHAR(64) NULL,
+  created_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+  PRIMARY KEY (container_booking_id,inbound_id),
+  UNIQUE KEY uk_direct_unloading_command (container_booking_id,idempotency_key),
+  CONSTRAINT fk_direct_unloading_container FOREIGN KEY (container_booking_id) REFERENCES fl_container_booking(id)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci COMMENT='直送目的仓真实卸货凭据';
+
+
 CREATE TABLE fl_terminal_drayage (
   id bigint unsigned NOT NULL COMMENT '目的港码头拖车聚合ID',
   container_booking_id bigint unsigned NOT NULL COMMENT '唯一归属物理货柜ID',
@@ -5337,7 +5356,7 @@ CREATE TRIGGER trg_container_booking_before_update BEFORE UPDATE ON fl_container
   SELECT MAX(plan_status) INTO current_plan_status
     FROM baiyue_firstleg.fl_loading_plan WHERE container_booking_id = OLD.id;
   IF current_plan_status IN ('LOADING', 'COMPLETED') AND (
-       NOT (OLD.id <=> NEW.id) OR NOT (OLD.booking_no <=> NEW.booking_no)
+       NOT (OLD.id <=> NEW.id)
     OR NOT (OLD.cabinet_no <=> NEW.cabinet_no)
     OR NOT (OLD.channel_group_code <=> NEW.channel_group_code)
     OR NOT (OLD.channel_code <=> NEW.channel_code) OR NOT (OLD.channel_name <=> NEW.channel_name)
@@ -7123,7 +7142,9 @@ INSERT INTO iam_role_permission (role_id, permission_id, tenant_id, created_at)
 INSERT INTO iam_role_permission (role_id, permission_id, tenant_id, created_at) VALUES (4000100,5306172,0,CURRENT_TIMESTAMP(3));
 INSERT INTO iam_role_permission (role_id, permission_id, tenant_id, created_at) VALUES (4000100,5306180,0,CURRENT_TIMESTAMP(3));
 INSERT INTO iam_role_permission (role_id, permission_id, tenant_id, created_at) VALUES (4000100,5306181,0,CURRENT_TIMESTAMP(3));
+INSERT INTO iam_permission (id, tenant_id, app_code, permission_type, parent_id, permission_code, permission_name, route_path, http_method, sort_no, status, built_in, created_at, updated_at, deleted) VALUES (5306183,0,'MERCHANT','BUTTON',5306180,'merchant:overseas-warehouse:discard:confirm','确认废弃完成',NULL,'POST',30,'ACTIVE',1,CURRENT_TIMESTAMP(3),CURRENT_TIMESTAMP(3),0);
 INSERT INTO iam_role_permission (role_id, permission_id, tenant_id, created_at) VALUES (4000100,5306182,0,CURRENT_TIMESTAMP(3));
+INSERT INTO iam_role_permission (role_id, permission_id, tenant_id, created_at) VALUES (4000100,5306183,0,CURRENT_TIMESTAMP(3));
 INSERT INTO iam_role_permission (role_id, permission_id, tenant_id, created_at) VALUES (4000100,5306190,0,CURRENT_TIMESTAMP(3));
 INSERT INTO iam_role_permission (role_id, permission_id, tenant_id, created_at) VALUES (4000100,5306191,0,CURRENT_TIMESTAMP(3));
 INSERT INTO iam_role_permission (role_id, permission_id, tenant_id, created_at) VALUES (4000100,5306192,0,CURRENT_TIMESTAMP(3));
@@ -8315,4 +8336,33 @@ SELECT 0,r.id,p.id,NOW(3) FROM iam_role r JOIN iam_permission p
 WHERE r.tenant_id=0 AND r.app_code='PLATFORM' AND UPPER(r.role_code) IN('PLATFORM_ADMIN','PLATFORM_CUSTOM_ADMIN')
   AND r.status='ACTIVE' AND r.deleted=0;
 
-SELECT 'PASS' AS initialization_status, 'CN' AS region, 226 AS initialized_tables;
+-- 自营业务菜单资源用于菜单管理；四个页面和所有只读接口统一由 list 授权，采集写权限独立。
+USE baiyue_iam;
+SET NAMES utf8mb4;
+INSERT INTO iam_permission (id,tenant_id,app_code,permission_type,parent_id,permission_code,permission_name,route_path,http_method,sort_no,status,built_in,created_at,updated_at,deleted) VALUES
+  (5118100,0,'PLATFORM','MENU',0,'platform:self-operated:menu','自营业务',NULL,NULL,1100,'ACTIVE',1,CURRENT_TIMESTAMP(3),CURRENT_TIMESTAMP(3),0),
+  (5118140,0,'PLATFORM','MENU',5118100,'platform:self-operated:overview:menu','经营总览','/self-operated/overview','GET',5,'ACTIVE',1,CURRENT_TIMESTAMP(3),CURRENT_TIMESTAMP(3),0),
+  (5118110,0,'PLATFORM','MENU',5118100,'platform:self-operated:sales:menu','销量分析','/self-operated/sales','GET',10,'ACTIVE',1,CURRENT_TIMESTAMP(3),CURRENT_TIMESTAMP(3),0),
+  (5118120,0,'PLATFORM','MENU',5118100,'platform:self-operated:inventory:menu','库存分析','/self-operated/inventory','GET',20,'ACTIVE',1,CURRENT_TIMESTAMP(3),CURRENT_TIMESTAMP(3),0),
+  (5118130,0,'PLATFORM','MENU',5118100,'platform:self-operated:collection:menu','数据采集','/self-operated/collection','GET',30,'ACTIVE',1,CURRENT_TIMESTAMP(3),CURRENT_TIMESTAMP(3),0),
+  (5118000,0,'PLATFORM','API',5118100,'platform:self-operated-analytics:list','读取平台自营出库销量与库存分析','/api/platform/v1/last-leg/self-operated-analytics','GET',40,'ACTIVE',1,CURRENT_TIMESTAMP(3),CURRENT_TIMESTAMP(3),0),
+  (5118002,0,'PLATFORM','API',5118120,'platform:self-operated-analytics:export','导出平台自营库存周转','/api/platform/v1/files/export-tasks','POST',20,'ACTIVE',1,CURRENT_TIMESTAMP(3),CURRENT_TIMESTAMP(3),0),
+  (5118001,0,'PLATFORM','API',5118130,'platform:self-operated-analytics:sync','平台自营采集重试与重采集','/api/platform/v1/last-leg/self-operated-analytics/sync-tasks','POST',10,'ACTIVE',1,CURRENT_TIMESTAMP(3),CURRENT_TIMESTAMP(3),0);
+INSERT INTO iam_role_permission (role_id,permission_id,tenant_id,created_at) VALUES
+  (4000001,5118000,0,CURRENT_TIMESTAMP(3)),
+  (4000001,5118001,0,CURRENT_TIMESTAMP(3)),
+  (4000001,5118002,0,CURRENT_TIMESTAMP(3)),
+  (4000001,5118100,0,CURRENT_TIMESTAMP(3)),
+  (4000001,5118140,0,CURRENT_TIMESTAMP(3)),
+  (4000001,5118110,0,CURRENT_TIMESTAMP(3)),
+  (4000001,5118120,0,CURRENT_TIMESTAMP(3)),
+  (4000001,5118130,0,CURRENT_TIMESTAMP(3));
+
+-- Appointment work independent write permissions (current baseline).
+USE baiyue_iam;
+INSERT INTO iam_permission (id, tenant_id, app_code, permission_type, parent_id, permission_code, permission_name, route_path, http_method, sort_no, status, built_in, created_at, updated_at, deleted) VALUES (5107283,0,'PLATFORM','BUTTON',5107280,'platform:appointment:manage-work','维护预约工作安排',NULL,'POST',743,'ACTIVE',1,CURRENT_TIMESTAMP(3),CURRENT_TIMESTAMP(3),0);
+INSERT INTO iam_role_permission (role_id, permission_id, tenant_id, created_at) VALUES (4000001,5107283,0,CURRENT_TIMESTAMP(3));
+INSERT INTO iam_permission (id, tenant_id, app_code, permission_type, parent_id, permission_code, permission_name, route_path, http_method, sort_no, status, built_in, created_at, updated_at, deleted) VALUES (5102213,0,'PLATFORM','BUTTON',5102200,'platform:firstleg:terminal-drayage:direct-unload:confirm','登记直送目的仓实际卸货',NULL,'POST',60,'ACTIVE',1,CURRENT_TIMESTAMP(3),CURRENT_TIMESTAMP(3),0);
+INSERT INTO iam_role_permission (role_id, permission_id, tenant_id, created_at) VALUES (4000001,5102213,0,CURRENT_TIMESTAMP(3));
+
+SELECT 'PASS' AS initialization_status, 'CN' AS region, 227 AS initialized_tables;
diff --git a/deploy/sql/海外区域统一增量-MySQL8.sql b/deploy/sql/海外区域统一增量-MySQL8.sql
index 8ec8d2b43..970c1e4a6 100644
--- a/deploy/sql/海外区域统一增量-MySQL8.sql
+++ b/deploy/sql/海外区域统一增量-MySQL8.sql
@@ -48,6 +48,7 @@ CREATE TABLE ll_cargo_discard_carton (
   customer_id varchar(128) COLLATE utf8mb4_unicode_ci NOT NULL COMMENT '客户租户ID',
   carton_id bigint NOT NULL COMMENT '箱唛记录ID',
   carton_mark varchar(128) COLLATE utf8mb4_unicode_ci NOT NULL COMMENT '箱唛',
+  source_type VARCHAR(32) NOT NULL DEFAULT 'DROPSHIP' COMMENT '箱子来源：一件代发DROPSHIP、入仓箱INBOUND、转运箱TRANSFER',
   created_at datetime(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) COMMENT '创建时间',
   PRIMARY KEY (id),
   UNIQUE KEY uk_ll_cargo_discard_carton (application_id,carton_id),
@@ -60,13 +61,16 @@ CREATE TABLE ll_cargo_discard_item (
   application_id bigint NOT NULL COMMENT '申请单ID',
   customer_id varchar(128) COLLATE utf8mb4_unicode_ci NOT NULL COMMENT '客户租户ID',
   order_id bigint DEFAULT NULL COMMENT '一件代发订单ID',
-  source_type varchar(32) COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT 'DROPSHIP' COMMENT '库存来源：一件代发DROPSHIP、退货箱RETURN_CARTON',
+  source_type varchar(32) COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT 'DROPSHIP' COMMENT '库存来源：一件代发DROPSHIP、退货箱RETURN_CARTON、通用库存INVENTORY',
   return_carton_id bigint DEFAULT NULL COMMENT '退货库存箱ID',
   inbound_code varchar(128) COLLATE utf8mb4_unicode_ci NOT NULL COMMENT '入仓单号快照',
   profile_id bigint DEFAULT NULL COMMENT '托盘档案ID',
   sku_inventory_id bigint DEFAULT NULL COMMENT 'SKU库存记录ID',
   sku_code varchar(128) COLLATE utf8mb4_unicode_ci NOT NULL COMMENT 'SKU编码',
   product_name varchar(255) COLLATE utf8mb4_unicode_ci DEFAULT NULL COMMENT '产品名称',
+  inventory_position_id BIGINT NULL COMMENT '废弃来源库存仓位ID',
+  carton_marks_json TEXT NULL COMMENT '本次废弃所选真实箱唛快照JSON数组',
+  carton_scan_required TINYINT(1) NOT NULL DEFAULT 0 COMMENT '是否需要逐箱核对本次所选箱子',
   available_packages_snapshot int NOT NULL COMMENT '可用箱数快照',
   discard_packages int NOT NULL COMMENT '申请废弃箱数',
   completion_photo_file_ids text COLLATE utf8mb4_unicode_ci DEFAULT NULL COMMENT 'PDA完工照片文件ID JSON数组',
@@ -77,6 +81,7 @@ CREATE TABLE ll_cargo_discard_item (
   created_at datetime(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) COMMENT '创建时间',
   PRIMARY KEY (id),
   UNIQUE KEY uk_ll_cargo_discard_item (application_id,profile_id,sku_code),
+  UNIQUE KEY uk_ll_discard_position_sku(application_id,inventory_position_id,sku_code),
   KEY idx_ll_cargo_discard_item_list (customer_id,application_id),
   KEY idx_ll_cargo_discard_item_inbound (customer_id,inbound_code,sku_code)
   ,KEY idx_ll_cargo_discard_return_carton (customer_id,return_carton_id)
@@ -266,7 +271,7 @@ CREATE TABLE ll_delivery_order (
   package_count int NOT NULL DEFAULT '0' COMMENT '派送箱数',
   pallet_count int NOT NULL DEFAULT '0' COMMENT '派送托盘数',
   total_weight_kg DECIMAL(18,4) NULL COMMENT '总重量（千克），任一来源未确认时为空',
-  total_volume_cbm decimal(18,4) NOT NULL DEFAULT '0.0000' COMMENT '总体积（立方米）',
+  total_volume_cbm DECIMAL(18,4) NULL COMMENT '体积（立方米），来源未确认时为空',
   planned_delivery_at datetime(3) DEFAULT NULL COMMENT '预计派送时间',
   dispatched_at datetime(3) DEFAULT NULL COMMENT '实际派送时间',
   expected_arrival_at datetime(3) DEFAULT NULL COMMENT '预计到达时间',
@@ -844,6 +849,57 @@ CREATE TABLE ll_finance_fee_source (
   CONSTRAINT chk_ll_finance_fee_status CHECK ((source_status in (_utf8mb4'ACTIVE',_utf8mb4'SUPERSEDED',_utf8mb4'VOIDED')))
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci COMMENT='海外业务不可变费用来源版本；发布后经跨区事件进入Finance';
 
+-- V13 receiving coverage and pending changes; baseline only, no test data migration.
+CREATE TABLE ll_fba_receiving_agreement (
+  agreement_key VARCHAR(64) NOT NULL COMMENT '收货预约独立业务键',
+  version INT NOT NULL COMMENT '预约覆盖范围与确认资料版本',
+  status VARCHAR(24) NOT NULL COMMENT '有效、取消或已替代状态',
+  destination_key VARCHAR(128) NOT NULL COMMENT '权威目的仓关联键',
+  confirmation_no VARCHAR(128) NULL COMMENT '当前有效外部约号，失效后清空以释放覆盖',
+  snapshot_json LONGTEXT NOT NULL COMMENT '客户逐来源覆盖、确认时区及仓库依据快照',
+  PRIMARY KEY (agreement_key),
+  UNIQUE KEY uk_fba_receiving_confirmation (destination_key, confirmation_no)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci COMMENT='独立于送货批次的收货预约';
+
+CREATE TABLE ll_fba_receiving_member (
+  agreement_key VARCHAR(64) NOT NULL COMMENT '所属收货预约业务键',
+  batch_key VARCHAR(128) NOT NULL COMMENT '稳定送货批次键',
+  customer_id VARCHAR(128) NOT NULL COMMENT '货物所属客户标识',
+  active_ref VARCHAR(260) NULL COMMENT '有效批次与客户唯一引用，退出后清空且历史保留',
+  PRIMARY KEY (agreement_key,batch_key,customer_id),
+  UNIQUE KEY uk_fba_receiving_active_member (active_ref),
+  KEY idx_fba_receiving_batch (batch_key,customer_id)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci COMMENT='收货预约当前覆盖关联及退出历史';
+
+CREATE TABLE ll_fba_receiving_change (
+  change_key VARCHAR(64) NOT NULL COMMENT '客户预约变化业务键',
+  version INT NOT NULL COMMENT '变化续办版本',
+  status VARCHAR(24) NOT NULL COMMENT '待仓库确认、已应用或已撤回状态',
+  batch_key VARCHAR(128) NOT NULL COMMENT '受影响原送货批次键',
+  customer_id VARCHAR(128) NOT NULL COMMENT '本次变化所属客户',
+  snapshot_json LONGTEXT NOT NULL COMMENT '原覆盖快照、逐来源拟保留量、负责人及跟进资料',
+  result_json LONGTEXT NULL COMMENT '确认后的实际批次去向及逐步骤结果',
+  active_ref VARCHAR(260) NULL COMMENT '同批同客户唯一未解决变化引用',
+  PRIMARY KEY (change_key),
+  UNIQUE KEY uk_fba_receiving_pending (active_ref),
+  KEY idx_fba_receiving_pending_batch (batch_key,status)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci COMMENT='保留原安排且阻止误发车的客户变化';
+
+CREATE TABLE ll_fba_receiving_revision (
+  agreement_key VARCHAR(64) NOT NULL COMMENT '收货预约业务键',
+  version INT NOT NULL COMMENT '不可变覆盖与确认版本',
+  snapshot_json LONGTEXT NOT NULL COMMENT '该版本完整客户覆盖、确认时段及回复依据',
+  PRIMARY KEY (agreement_key,version)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci COMMENT='收货预约覆盖与确认不可变历史';
+
+CREATE TABLE ll_fba_receiving_plan (
+  batch_key VARCHAR(128) NOT NULL COMMENT '稳定送货批次键',
+  customer_id VARCHAR(128) NOT NULL COMMENT '计划所属客户标识',
+  snapshot_json LONGTEXT NOT NULL COMMENT '本客户未确认计划、目标窗口及业务时区，不含有效预约确认',
+  PRIMARY KEY (batch_key,customer_id)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci COMMENT='按批次及客户保存的未确认收货计划';
+
+
 CREATE TABLE ll_inbound_fba_appointment (
   id BIGINT NOT NULL COMMENT '主键ID',
   appointment_no VARCHAR(64) NOT NULL COMMENT '系统预约业务单号，不是外部约号',
@@ -862,12 +918,14 @@ CREATE TABLE ll_inbound_fba_appointment (
   appointment_remark VARCHAR(1000) NULL COMMENT '备注或取消原因',
   fba_warehouse_code VARCHAR(128) NOT NULL COMMENT 'FBA目的仓编码',
   selected_count INT NOT NULL DEFAULT 0 COMMENT '真实货源票数',
+  replacement_nos_json LONGTEXT NULL COMMENT '分批或合并后的新预约业务号列表，非空时原批次只读',
+  replacement_keys_json LONGTEXT NULL COMMENT '替代批次不可变键列表，只用于内部业务关联',
+  repartition_reason VARCHAR(1000) NULL COMMENT '分批或合并原因，原安排及来源明细保留',
   created_by VARCHAR(128) NOT NULL COMMENT '登录操作人',
   created_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) COMMENT '创建UTC时间',
   updated_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) COMMENT '更新UTC时间',
   PRIMARY KEY (id),
   UNIQUE KEY uk_ll_fba_appointment_no (appointment_no),
-  UNIQUE KEY uk_ll_fba_external_confirmation (fba_warehouse_code,confirmation_no),
   KEY idx_ll_fba_appointment_list (appointment_at,appointment_status,fba_warehouse_code),
   KEY idx_ll_fba_appointment_planned (planned_at,appointment_status)
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci COMMENT='FBA预约安排与正式确认唯一主记录';
@@ -881,19 +939,42 @@ CREATE TABLE ll_inbound_fba_appointment_item (
   order_id BIGINT NULL COMMENT '尚未形成尾程订单时为空',
   inbound_code VARCHAR(128) NULL COMMENT '真实入仓码，不伪造',
   fba_warehouse_code VARCHAR(128) NOT NULL COMMENT '目的FBA仓编码',
-  package_count INT NULL COMMENT '所选整票预报箱数，未知保持空',
-  active TINYINT(1) NOT NULL DEFAULT 1 COMMENT '取消或失败后释放货源占用',
-  active_source_key VARCHAR(160) GENERATED ALWAYS AS (CASE WHEN active=1 THEN source_key ELSE NULL END) STORED COMMENT '有效货源唯一占用键',
-  active_order_id BIGINT GENERATED ALWAYS AS (CASE WHEN active=1 THEN order_id ELSE NULL END) STORED COMMENT '有效订单唯一占用键',
+  package_count INT NULL COMMENT '本批分配箱数，未知保持空；同一原来源总量守恒',
+  cargo_verification_version INT NULL COMMENT '采用的预约货物核实版本，未核实时为空',
+  shipment_references_json LONGTEXT NULL COMMENT '本次采用的货件或追踪号核实快照',
+  active TINYINT(1) NOT NULL DEFAULT 1 COMMENT '当前批次数量分配有效；取消、未约成和完成均保留，仅替代时释放',
   created_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) COMMENT '创建UTC时间',
   PRIMARY KEY (id),
   UNIQUE KEY uk_ll_fba_item_source (appointment_id,source_key),
-  UNIQUE KEY uk_ll_fba_active_source (active_source_key),
-  UNIQUE KEY uk_ll_fba_active_order (active_order_id),
+  KEY idx_ll_fba_active_source (customer_id,source_key,active),
+  KEY idx_ll_fba_active_order (customer_id,order_id,active),
   KEY idx_ll_fba_item_source_lookup (source_key,customer_id),
   KEY idx_ll_fba_item_customer_order (customer_id,order_id)
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci COMMENT='入仓前后共用的预约真实货源';
 
+CREATE TABLE ll_appointment_cargo_verification (
+  id BIGINT NOT NULL COMMENT '核实记录主键',
+  customer_id VARCHAR(128) NOT NULL COMMENT '原货源所属客户',
+  source_key VARCHAR(160) NOT NULL COMMENT '稳定ORDER或BOOKING原来源键',
+  destination_key VARCHAR(160) NOT NULL COMMENT '核实时的原目的地',
+  source_version VARCHAR(160) NULL COMMENT '核实时的原来源版本',
+  source_packages INT NULL COMMENT '核实时的原来源箱数，未知为空',
+  version INT NOT NULL COMMENT '同一来源的核实版本，从一递增',
+  package_count INT NULL COMMENT '独立核实箱数，不回写原订单',
+  shipment_references_json LONGTEXT NOT NULL COMMENT '本票货件号或追踪号列表，不回写原订单',
+  remark VARCHAR(1000) NULL COMMENT '核实说明',
+  operator_id VARCHAR(128) NOT NULL COMMENT '登录操作人',
+  operator_name VARCHAR(200) NULL COMMENT '操作人名称快照',
+  command_key VARCHAR(64) NOT NULL COMMENT '来源内幂等命令键',
+  request_hash CHAR(64) NOT NULL COMMENT '来源、操作人及请求摘要',
+  created_at DATETIME(3) NOT NULL COMMENT '核实UTC时间',
+  PRIMARY KEY (id),
+  UNIQUE KEY uk_ll_cargo_verification_version (customer_id,source_key,version),
+  UNIQUE KEY uk_ll_cargo_verification_command (customer_id,source_key,command_key),
+  CONSTRAINT chk_ll_cargo_verification_quantity CHECK (package_count IS NULL OR package_count > 0),
+  CONSTRAINT chk_ll_cargo_verification_version CHECK (version > 0)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci COMMENT='预约货物核实资料及不可覆盖的版本历史';
+
 CREATE TABLE ll_fba_appointment_command (
   command_key VARCHAR(128) NOT NULL COMMENT '持久化幂等键',
   request_hash CHAR(64) NOT NULL COMMENT '操作、操作者和请求摘要',
@@ -1072,7 +1153,7 @@ CREATE TABLE ll_inbound_plan_carton (
   warehouse_pallet_id bigint DEFAULT NULL COMMENT '海外实物托盘ID',
   warehouse_location_id bigint DEFAULT NULL COMMENT '海外库位ID',
   pda_task_id bigint DEFAULT NULL COMMENT '首次扫码PDA任务ID',
-  status varchar(32) COLLATE utf8mb4_unicode_ci NOT NULL COMMENT '箱唛状态：UNASSIGNED、ON_PALLET、BULK_RECEIVED、AVAILABLE',
+  status varchar(32) COLLATE utf8mb4_unicode_ci NOT NULL COMMENT '箱唛状态：未绑定UNASSIGNED、已绑托ON_PALLET、整票收货BULK_RECEIVED、可用AVAILABLE、待废弃DISCARD_PENDING、已废弃DISCARDED',
   version int NOT NULL DEFAULT '0' COMMENT '乐观锁版本',
   bound_at datetime(3) DEFAULT NULL COMMENT '绑定托盘时间',
   received_at datetime(3) DEFAULT NULL COMMENT '完成入库时间',
@@ -1694,7 +1775,7 @@ CREATE TABLE ll_outbound_order (
   pallet_count int NOT NULL DEFAULT '0' COMMENT '托盘数',
   gross_weight_kg DECIMAL(18,3) NULL COMMENT '毛重（千克），来源未确认时为空',
   volume_weight_kg decimal(18,3) NOT NULL DEFAULT '0.000' COMMENT '材积重（千克）',
-  volume_cbm decimal(18,4) NOT NULL DEFAULT '0.0000' COMMENT '体积（立方米）',
+  volume_cbm DECIMAL(18,4) NULL COMMENT '体积（立方米），来源未确认时为空',
   fee_coverage_json JSON NULL COMMENT '本次发运引用的原费用版本、实际货物及明确服务覆盖确认快照',
   idempotency_key varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL COMMENT '业务幂等键',
   created_by varchar(128) COLLATE utf8mb4_unicode_ci DEFAULT NULL COMMENT '创建人ID',
@@ -1723,7 +1804,7 @@ CREATE TABLE ll_outbound_pallet_item (
   package_count int NOT NULL DEFAULT '0' COMMENT '箱数',
   gross_weight_kg DECIMAL(18,3) NULL COMMENT '毛重（千克），来源未确认时为空',
   volume_weight_kg decimal(18,3) NOT NULL DEFAULT '0.000' COMMENT '材积重（千克）',
-  volume_cbm decimal(18,4) NOT NULL DEFAULT '0.0000' COMMENT '体积（立方米）',
+  volume_cbm DECIMAL(18,4) NULL COMMENT '体积（立方米），来源未确认时为空',
   picked_package_count int NOT NULL DEFAULT '0' COMMENT '已拣箱数',
   status varchar(32) COLLATE utf8mb4_unicode_ci NOT NULL DEFAULT 'WAIT_PICK' COMMENT '拣货状态',
   sku_code varchar(128) COLLATE utf8mb4_unicode_ci DEFAULT NULL COMMENT '一件代发SKU',
@@ -2184,7 +2265,7 @@ CREATE TABLE ll_relabel_application (
   label_deadline datetime(3) NOT NULL COMMENT '换标截止时间',
   contact_name varchar(128) COLLATE utf8mb4_unicode_ci NOT NULL COMMENT '联系人姓名',
   contact_phone varchar(64) COLLATE utf8mb4_unicode_ci NOT NULL COMMENT '联系人电话',
-  delivery_method varchar(32) COLLATE utf8mb4_unicode_ci DEFAULT NULL COMMENT '派送方式：TRUCK卡车、PICKUP自提、EXPRESS快递；仅涉及箱唛换标时必填',
+  delivery_method varchar(32) COLLATE utf8mb4_unicode_ci DEFAULT NULL COMMENT '派送方式：TRUCK平台卡车、EXPRESS快递、PICKUP自提、AMAZON_PICKUP亚马逊自提、CUSTOMER_PICKUP客户自提；仅平台卡车进入预排车',
   print_shipping_label tinyint(1) NOT NULL DEFAULT '0' COMMENT '是否需要打印面单',
   shipping_label_file_id varchar(128) COLLATE utf8mb4_unicode_ci DEFAULT NULL COMMENT '客户上传面单文件ID',
   shipping_label_file_name varchar(255) COLLATE utf8mb4_unicode_ci DEFAULT NULL COMMENT '客户上传面单文件名',
@@ -2373,13 +2454,13 @@ CREATE TABLE ll_relabel_status_history (
 CREATE TABLE ll_return_inventory_outbound_movement (
  id BIGINT NOT NULL COMMENT '退货出库SKU流水ID',
  outbound_pick_id BIGINT NOT NULL COMMENT '同事务PDA出库拣货记录ID',
- customer_id VARCHAR(128) NOT NULL COMMENT '库存所属客户ID和隔离键',
- overseas_warehouse_id VARCHAR(128) NOT NULL COMMENT '实际出库海外仓ID',
+ customer_id VARCHAR(128) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL COMMENT '库存所属客户ID和隔离键',
+ overseas_warehouse_id VARCHAR(128) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL COMMENT '实际出库海外仓ID',
  carton_id BIGINT NOT NULL COMMENT '真实退货库存箱ID',
  carton_mark VARCHAR(128) NOT NULL COMMENT '冻结的真实退货箱业务码',
- outbound_no VARCHAR(64) NOT NULL COMMENT '本次退货出库业务单号',
- sku_code VARCHAR(128) NOT NULL COMMENT '本次出库SKU编码快照', return_sku_quantity BIGINT NULL COMMENT '退货单SKU本来源计划出库件数快照，NULL为历史整箱出库',
- product_name_zh VARCHAR(255) NULL COMMENT '中文品名快照',
+ outbound_no VARCHAR(64) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL COMMENT '本次退货出库业务单号',
+ sku_code VARCHAR(128) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL COMMENT '本次出库SKU编码快照', return_sku_quantity BIGINT NULL COMMENT '退货单SKU本来源计划出库件数快照，NULL为历史整箱出库',
+ product_name_zh VARCHAR(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NULL COMMENT '中文品名快照',
  quantity BIGINT NOT NULL COMMENT '本箱该SKU实际出库件数，始终为正',
  total_before BIGINT NOT NULL COMMENT '客户仓SKU出库前实物总数量',
  total_after BIGINT NOT NULL COMMENT '客户仓SKU出库后实物总数量',
@@ -2395,7 +2476,7 @@ CREATE TABLE ll_return_inventory_outbound_movement (
  CONSTRAINT chk_ll_return_outbound_movement_delta CHECK(quantity>0 AND total_after>=0 AND available_after>=0
    AND total_before-total_after=quantity AND available_before-available_after=quantity
    AND cartons_after>=0 AND cartons_before-cartons_after IN (0,1) AND total_after>=available_after)
-) ENGINE=InnoDB COMMENT='不可变退货出库SKU库存流水';
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci COMMENT='不可变退货出库SKU库存流水';
 
 CREATE TABLE ll_return_inventory_balance (
   id bigint NOT NULL COMMENT '退货库存余额ID',
@@ -2414,15 +2495,17 @@ CREATE TABLE ll_return_inventory_balance (
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci COMMENT='退货库存按客户海外仓SKU汇总余额';
 
 CREATE TABLE ll_return_inventory_carton (
+  original_packaging TINYINT(1) NULL COMMENT '是否使用原箱原包装',
+  label_status varchar(32) DEFAULT NULL COMMENT 'WAIT_LABEL待贴标 CONFIRMED已扫码确认标签',
   new_carton_mark varchar(255) COLLATE utf8mb4_unicode_ci DEFAULT NULL COMMENT '换标后新箱唛',
   id bigint NOT NULL COMMENT '退货库存箱ID',
-  customer_id varchar(128) COLLATE utf8mb4_unicode_ci NOT NULL COMMENT '客户ID和隔离键',
-  overseas_warehouse_id varchar(128) COLLATE utf8mb4_unicode_ci NOT NULL COMMENT '海外仓ID',
+  customer_id varchar(128) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL COMMENT '客户ID和隔离键',
+  overseas_warehouse_id varchar(128) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL COMMENT '海外仓ID',
   source_receipt_id bigint DEFAULT NULL COMMENT '来源PDA签收单ID',
   source_batch_no text COLLATE utf8mb4_unicode_ci COMMENT '实际消耗来源签收批次号，多个批次逗号分隔',
   source_return_no text COLLATE utf8mb4_unicode_ci COMMENT '实际消耗来源退货单号，多个单号逗号分隔',
   pallet_code varchar(128) COLLATE utf8mb4_unicode_ci DEFAULT NULL COMMENT '签收时绑定的托盘码',
-  carton_mark varchar(128) COLLATE utf8mb4_unicode_ci NOT NULL COMMENT '退货箱号和箱唛编码',
+  carton_mark varchar(128) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL COMMENT '退货箱号和箱唛编码',
   fba_carton_mark varchar(255) COLLATE utf8mb4_unicode_ci DEFAULT NULL COMMENT 'FBA箱唛',
   destination_warehouse_code varchar(128) COLLATE utf8mb4_unicode_ci DEFAULT NULL COMMENT '目的仓编码',
   destination_warehouse_name varchar(255) COLLATE utf8mb4_unicode_ci DEFAULT NULL COMMENT '目的仓名称',
@@ -2459,13 +2542,14 @@ CREATE TABLE ll_return_inventory_carton_item (
   id bigint NOT NULL COMMENT '退货库存箱SKU明细ID',
   carton_id bigint NOT NULL COMMENT '退货库存箱ID',
   customer_id varchar(128) COLLATE utf8mb4_unicode_ci NOT NULL COMMENT '客户ID和隔离键',
-  sku_code varchar(128) COLLATE utf8mb4_unicode_ci NOT NULL COMMENT 'SKU编码',
-  product_name_zh varchar(255) COLLATE utf8mb4_unicode_ci DEFAULT NULL COMMENT '中文品名',
+  sku_code varchar(128) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL COMMENT 'SKU编码',
+  product_name_zh varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci DEFAULT NULL COMMENT '中文品名',
   quantity bigint NOT NULL COMMENT '该SKU箱内数量',
+  relabelled_quantity BIGINT NOT NULL DEFAULT 0 COMMENT '当前SKU已经换标的实物件数，不可二次换标',
   PRIMARY KEY (id),
   UNIQUE KEY uk_ll_return_inventory_carton_item (carton_id,sku_code),
   KEY idx_ll_return_inventory_carton_item_customer (customer_id,sku_code),
-  CONSTRAINT chk_ll_return_inventory_carton_item_quantity CHECK ((quantity > 0)),
+  CONSTRAINT chk_ll_return_inventory_carton_item_quantity CHECK ((quantity >= 0)),
   packing_reserved_quantity BIGINT NOT NULL DEFAULT 0 COMMENT '合箱计划预占件数'
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci COMMENT='退货库存箱内SKU和数量';
 
@@ -2486,9 +2570,9 @@ CREATE TABLE ll_return_inventory_operation (
 
 CREATE TABLE ll_return_order (
   id bigint NOT NULL COMMENT '退货订单ID',
-  customer_id varchar(128) COLLATE utf8mb4_unicode_ci NOT NULL COMMENT '客户ID和隔离键',
+  customer_id varchar(128) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL COMMENT '客户ID和隔离键',
   return_no varchar(128) COLLATE utf8mb4_unicode_ci NOT NULL COMMENT '退货订单号',
-  overseas_warehouse_id varchar(128) COLLATE utf8mb4_unicode_ci NOT NULL COMMENT '操作海外仓ID',
+  overseas_warehouse_id varchar(128) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL COMMENT '操作海外仓ID',
   warehouse_contact_name varchar(128) COLLATE utf8mb4_unicode_ci DEFAULT NULL COMMENT '中转仓联系人快照',
   warehouse_contact_phone varchar(64) COLLATE utf8mb4_unicode_ci DEFAULT NULL COMMENT '中转仓联系电话快照',
   customer_reference_no varchar(128) COLLATE utf8mb4_unicode_ci DEFAULT NULL COMMENT '客户参考号',
@@ -2521,8 +2605,8 @@ CREATE TABLE ll_return_order_item (
   id bigint NOT NULL COMMENT '退货预报明细ID',
   return_order_id bigint NOT NULL COMMENT '退货订单ID',
   customer_id varchar(128) COLLATE utf8mb4_unicode_ci NOT NULL COMMENT '客户ID和隔离键',
-  sku_code varchar(128) COLLATE utf8mb4_unicode_ci NOT NULL COMMENT 'SKU编码',
-  product_name_zh varchar(255) COLLATE utf8mb4_unicode_ci DEFAULT NULL COMMENT '中文品名',
+  sku_code varchar(128) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL COMMENT 'SKU编码',
+  product_name_zh varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci DEFAULT NULL COMMENT '中文品名',
   expected_quantity bigint NOT NULL COMMENT 'SKU预报数量',
   received_quantity bigint NOT NULL DEFAULT '0' COMMENT 'SKU累计实收数量',
   created_at datetime(3) NOT NULL COMMENT '创建时间',
@@ -2537,7 +2621,7 @@ CREATE TABLE ll_return_receipt (
   id bigint NOT NULL COMMENT 'PDA退货签收单ID',
   return_order_id bigint NOT NULL COMMENT '退货订单ID',
   customer_id varchar(128) COLLATE utf8mb4_unicode_ci NOT NULL COMMENT '客户ID和隔离键',
-  receipt_no varchar(128) COLLATE utf8mb4_unicode_ci NOT NULL COMMENT '签收单号',
+  receipt_no varchar(128) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL COMMENT '签收单号',
   receipt_batch_no varchar(128) COLLATE utf8mb4_unicode_ci NOT NULL COMMENT '签收批次号',
   pallet_code varchar(128) COLLATE utf8mb4_unicode_ci DEFAULT NULL COMMENT '本次签收绑定的托盘码',
   carton_mark varchar(128) COLLATE utf8mb4_unicode_ci DEFAULT NULL COMMENT '签收生成或绑定的退货箱号',
@@ -2564,7 +2648,9 @@ CREATE TABLE ll_return_receipt (
   length DECIMAL(12,3) NULL COMMENT '实测尺寸cm',
   width DECIMAL(12,3) NULL COMMENT '实测尺寸cm',
   height DECIMAL(12,3) NULL COMMENT '实测尺寸cm',
-  weight DECIMAL(12,3) NULL COMMENT '实测重量kg'
+  weight DECIMAL(12,3) NULL COMMENT '实测重量kg',
+  original_packaging TINYINT(1) NULL COMMENT '是否使用原箱原包装',
+  measurement_source VARCHAR(32) NULL COMMENT '尺寸重量来源'
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci COMMENT='PDA退货实收签收事实';
 
 CREATE TABLE ll_return_receipt_batch (
@@ -2588,7 +2674,7 @@ CREATE TABLE ll_return_receipt_item (
   receipt_id bigint NOT NULL COMMENT 'PDA退货签收单ID',
   return_order_item_id bigint NOT NULL COMMENT '退货预报明细ID',
   customer_id varchar(128) COLLATE utf8mb4_unicode_ci NOT NULL COMMENT '客户ID和隔离键',
-  sku_code varchar(128) COLLATE utf8mb4_unicode_ci NOT NULL COMMENT 'SKU编码',
+  sku_code varchar(128) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL COMMENT 'SKU编码',
   received_quantity bigint NOT NULL COMMENT '本次SKU实收数量',
   PRIMARY KEY (id),
   KEY idx_ll_return_receipt_item_receipt (receipt_id),
@@ -3170,9 +3256,21 @@ CREATE TABLE ll_wallet_event_inbox (
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci COMMENT='跨区客户资金结果幂等收件箱';
 
 CREATE TABLE ll_warehouse_transfer_carton (
+  length_cm DECIMAL(12,2) NULL COMMENT '箱子实测长度厘米',
+  width_cm DECIMAL(12,2) NULL COMMENT '箱子实测宽度厘米',
+  height_cm DECIMAL(12,2) NULL COMMENT '箱子实测高度厘米',
+  gross_weight_kg DECIMAL(12,2) NULL COMMENT '箱子实测重量千克',
+  counted_quantity BIGINT NULL COMMENT '箱内SKU实点件数',
+  count_idempotency_key VARCHAR(255) NULL COMMENT '箱内清点幂等键',
+  count_request_hash VARCHAR(64) NULL COMMENT '箱内清点请求摘要',
+  counted_by VARCHAR(128) NULL COMMENT '箱内清点操作人',
+  counted_at DATETIME(3) NULL COMMENT '箱内清点完成时间',
+  discrepancy_reason VARCHAR(1000) NULL COMMENT '实收与预报箱数差异原因',
+  transfer_pallet_id BIGINT NULL COMMENT '签收箱所属转运托盘事实ID',
+  sku_items_json JSON NULL COMMENT '实收箱内SKU及逐项件数明细',
   id bigint NOT NULL COMMENT '预报箱主键',
   transfer_order_id bigint NOT NULL COMMENT '转运单ID',
-  transfer_item_id bigint NOT NULL COMMENT '转运申报明细ID',
+  transfer_item_id bigint DEFAULT NULL COMMENT '转运申报明细ID',
   customer_id varchar(128) COLLATE utf8mb4_unicode_ci NOT NULL COMMENT '客户租户ID',
   carton_mark varchar(255) COLLATE utf8mb4_unicode_ci NOT NULL COMMENT '系统生成的一箱一码箱唛',
   customer_carton_mark varchar(255) COLLATE utf8mb4_unicode_ci DEFAULT NULL COMMENT '客户原箱唛，用于换标现场绑定',
@@ -3213,6 +3311,7 @@ CREATE TABLE ll_warehouse_transfer_inventory_allocation (
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci COMMENT='转仓单来源库存分配记录';
 
 CREATE TABLE ll_warehouse_transfer_item (
+  declared_quantity BIGINT NULL COMMENT 'SKU申报件数，非预计或实收箱数',
   id bigint NOT NULL COMMENT '主键ID',
   transfer_order_id bigint NOT NULL COMMENT '转仓单ID',
   customer_id varchar(128) COLLATE utf8mb4_unicode_ci NOT NULL COMMENT '客户租户ID',
@@ -3249,7 +3348,7 @@ CREATE TABLE ll_warehouse_transfer_order (
   pickup_contact_phone varchar(64) COLLATE utf8mb4_unicode_ci DEFAULT NULL COMMENT '提货联系电话',
   package_count int NOT NULL COMMENT '箱数',
   delivery_method varchar(64) COLLATE utf8mb4_unicode_ci NOT NULL COMMENT '入仓方式',
-  estimated_arrival_at datetime(3) NOT NULL COMMENT '预计入仓时间',
+  estimated_arrival_at datetime(3) NULL COMMENT '预计入仓时间，库存转运不填写',
   estimated_ship_at datetime(3) DEFAULT NULL COMMENT '预计发货时间',
   fba_shipment_no varchar(128) COLLATE utf8mb4_unicode_ci DEFAULT NULL COMMENT '可选FBA货件编号',
   tracking_no varchar(255) COLLATE utf8mb4_unicode_ci DEFAULT NULL COMMENT '物流跟踪号',
@@ -3907,10 +4006,332 @@ CREATE TABLE ll_procurement_closure_item (
   CONSTRAINT chk_procurement_closure_quantity CHECK(quantity>0)
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci COMMENT='异常关闭逐来源剩余货物最终去向，不产生新发运';
 
-SELECT 'PASS' AS initialization_status, 'OVERSEAS' AS region, 181 AS initialized_tables;
+USE baiyue_lastleg;
+
+-- 平台自营领星统计：独立事实与不可变发布版本；仅空库初始化，不自动执行。
+CREATE TABLE ll_selfop_outbound_discovery_scope (
+  id BIGINT NOT NULL COMMENT '应用生成的记录标识',
+  created_at DATETIME(3) NOT NULL COMMENT 'UTC创建时间',
+  updated_at DATETIME(3) NOT NULL COMMENT 'UTC更新时间',
+  source_account VARCHAR(64) NOT NULL COMMENT '受控来源账号别名，不保存密钥',
+  catalog_from_utc DATETIME(3) NULL COMMENT '账号完整目录连续覆盖UTC下界，不等同销量覆盖',
+  catalog_until_utc DATETIME(3) NULL COMMENT '账号完整目录连续覆盖UTC上界，不等同销量覆盖',
+  next_sequence BIGINT NOT NULL DEFAULT 1 COMMENT '新发现任务的单调调度序号；重试沿用，只安排任务，不判断对象内容的新旧',
+  next_observation_sequence BIGINT NOT NULL DEFAULT 1 COMMENT '每次实际出库详情请求前分配的单调采集代次；与 task 调度序号独立，重试请求也分配新代次',
+  active_task_id BIGINT NULL COMMENT '当前共享发现／详情补齐任务',
+  lease_owner VARCHAR(128) NULL COMMENT '账号发现执行者',
+  lease_until_utc DATETIME(3) NULL COMMENT '账号发现租约到期时刻',
+  fence_token BIGINT NOT NULL DEFAULT 0 COMMENT '防止过期发现进程继续写共享暂存或派发任务',
+  request_budget INT NOT NULL COMMENT '一次调度允许的目录、详情请求总预算，必须为正',
+  time_budget_seconds INT NOT NULL COMMENT '一次调度允许占用的执行时长，必须为正',
+  min_request_interval_ms INT NOT NULL COMMENT '同账号请求最小间隔，按已核准配额配置',
+  api_budget_json JSON NULL COMMENT '账号所有采集族共用的预算、统计日、保守预留及确认消耗、尝试许可和独占交接依据',
+  api_cooldown_until_utc DATETIME(3) NULL COMMENT '账号全部真实请求共用冷却UTC截止，重启与跨日不清除',
+  api_pause_reason VARCHAR(64) NULL COMMENT '账号停止或等待的固定原因码，不保存供应商原始错误或凭据',
+  PRIMARY KEY (id),
+  UNIQUE KEY uk_selfop_discovery_account (source_account),
+  CONSTRAINT chk_selfop_outbound_discovery_scope CHECK (request_budget > 0 AND time_budget_seconds > 0 AND min_request_interval_ms > 0 AND fence_token >= 0 AND next_sequence > 0 AND next_observation_sequence > 0)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_bin COMMENT='账号共享出库目录与详情发现协调作用域';
+
+CREATE TABLE ll_selfop_sync_scope (
+  id BIGINT NOT NULL COMMENT '应用生成的记录标识',
+  created_at DATETIME(3) NOT NULL COMMENT 'UTC创建时间',
+  updated_at DATETIME(3) NOT NULL COMMENT 'UTC更新时间',
+  source_account VARCHAR(64) NOT NULL COMMENT '受控来源账号别名，不保存密钥',
+  warehouse_code VARCHAR(64) NOT NULL COMMENT '来源仓库原始编码，按仓独立统计',
+  data_family VARCHAR(16) NOT NULL COMMENT 'OUTBOUND 或 INVENTORY；按账号＋仓库＋任务族互斥',
+  scope_json JSON NOT NULL COMMENT '本仓范围规则，customerMode=ALL_AUTHORIZED，库存为全部品质；当前账号全部授权货主均自营，不将当天出现的货主列表当白名单',
+  scope_hash CHAR(64) NOT NULL COMMENT '仓库、货主范围规则、品质、时区及单位口径的规范化摘要；不包含当天观测到的客户／SKU 集合',
+  business_timezone VARCHAR(64) NOT NULL COMMENT '本仓报表及调度时区，初始建议值为 Asia/Shanghai，各仓独立核准',
+  source_timezone VARCHAR(64) NULL COMMENT '本仓已核准的出库源时间时区',
+  schedule_cron VARCHAR(128) NOT NULL COMMENT '本仓、本任务族的调度表达式，按 business_timezone 执行',
+  stale_after_seconds INT NOT NULL COMMENT '本仓、本任务族数据过期阈值，必须为正；库存初始可采用 26 小时，后续按仓调整',
+  warehouse_policy_ref VARCHAR(128) NULL COMMENT '未来按仓告警／补货策略的稳定引用；一期为空，不建告警规则表',
+  initial_from_utc DATETIME(3) NULL COMMENT '首采固定UTC下界，按本仓业务时区减一个月',
+  initial_until_utc DATETIME(3) NULL COMMENT '首采固定UTC截止，重试不重新取当前时间',
+  discovery_from_utc DATETIME(3) NULL COMMENT '本仓已发布的连续销量覆盖UTC下界',
+  discovery_until_utc DATETIME(3) NULL COMMENT '本仓已发布的连续销量覆盖UTC上界，不含端点',
+  fact_revision BIGINT NOT NULL DEFAULT 0 COMMENT '出库事实归并修订号；内容实际变化才增加',
+  published_fact_revision BIGINT NOT NULL DEFAULT 0 COMMENT '本仓最后已发布销量版所使用的事实修订号',
+  rebuild_required TINYINT NOT NULL DEFAULT 0 COMMENT '事实变化待重建标记；跨仓修订同时置旧、新仓为 1',
+  invalidated_at_utc DATETIME(3) NULL COMMENT '最近一次因事实修订使当前版待重建的时刻',
+  published_run_id BIGINT NULL COMMENT '唯一对外可见版本，指向本任务族已发布执行批次',
+  lease_owner VARCHAR(128) NULL COMMENT '当前执行者令牌，不使用仅进程内锁',
+  lease_until_utc DATETIME(3) NULL COMMENT '租约到期时刻',
+  fence_token BIGINT NOT NULL DEFAULT 0 COMMENT '每次取得租约递增，事实提交和发布均校验',
+  known_order_cursor_id BIGINT NULL COMMENT '本仓已可靠处理的稳定订单内部标识游标',
+  known_order_round_max_id BIGINT NULL COMMENT '本轮已知单复查固定最大内部标识',
+  known_order_round_started_at_utc DATETIME(3) NULL COMMENT '本仓已知单复查轮次开始UTC时间',
+  known_order_round_finished_at_utc DATETIME(3) NULL COMMENT '本仓已知单完整轮转完成UTC时间',
+  history_round_from_utc DATETIME(3) NULL COMMENT '本仓历史核对固定UTC下界',
+  history_round_until_utc DATETIME(3) NULL COMMENT '本仓历史核对固定UTC上界',
+  history_slice_cursor_utc DATETIME(3) NULL COMMENT '本仓下一待核对历史切片UTC位置',
+  history_round_finished_at_utc DATETIME(3) NULL COMMENT '上一轮历史时间片全部完成时刻',
+  review_request_budget INT NOT NULL COMMENT '本仓单次复查最大请求数，必须为正',
+  review_time_budget_seconds INT NOT NULL COMMENT '本仓单次复查最大执行秒数，必须为正',
+  review_target_days INT NOT NULL DEFAULT 7 COMMENT '建议每 7 天轮转一遍，属于待配额验证的目标，不保证首次大量详情在单次调度内完成',
+  PRIMARY KEY (id),
+  UNIQUE KEY uk_selfop_scope (source_account,warehouse_code,data_family),
+  KEY idx_selfop_scope_lease (lease_until_utc),
+  CONSTRAINT chk_selfop_sync_scope CHECK (data_family IN ('OUTBOUND','INVENTORY') AND stale_after_seconds > 0 AND review_request_budget > 0 AND review_time_budget_seconds > 0 AND review_target_days > 0 AND fact_revision >= 0 AND published_fact_revision >= 0 AND fence_token >= 0)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_bin COMMENT='分仓任务族租约及发布指针';
+
+CREATE TABLE ll_selfop_sync_task (
+  id BIGINT NOT NULL COMMENT '应用生成的记录标识',
+  created_at DATETIME(3) NOT NULL COMMENT 'UTC创建时间',
+  updated_at DATETIME(3) NOT NULL COMMENT 'UTC更新时间',
+  task_no VARCHAR(64) NOT NULL COMMENT '稳定采集业务任务号，重试沿用，不展示内部数据库标识',
+  execution_purpose VARCHAR(16) NOT NULL COMMENT 'BUSINESS或VALIDATION；由服务端冻结用途，子任务继承',
+  validation_root_task_id BIGINT NULL COMMENT '验证会话唯一预算根任务，根引用自身，正式任务为空',
+  validation_budget_json JSON NULL COMMENT '验证根冻结硬预算、累计消耗、库存分仓页数、截止时刻及停止原因',
+  business_root_task_id BIGINT NULL COMMENT '测试人工正式采集共享预算根任务；生产任务为空',
+  business_budget_json JSON NULL COMMENT '仅测试正式采集根保存冻结请求上限、截止时间、消耗及停止原因',
+  source_account VARCHAR(64) NOT NULL COMMENT '受控来源账号别名，不保存密钥',
+  task_role VARCHAR(24) NOT NULL COMMENT 'ACCOUNT_DISCOVERY 或 WAREHOUSE_SYNC',
+  scope_id BIGINT NULL COMMENT '分仓任务必须引用分仓作用域；仅账号共享发现为空',
+  warehouse_code VARCHAR(64) NULL COMMENT '来源仓库原始编码，按仓独立统计',
+  discovery_scope_id BIGINT NULL COMMENT '共享发现必填，引用账号发现协调器',
+  upstream_task_id BIGINT NULL COMMENT '出库分仓任务引用已持久化目录的共享发现切片；库存无此上游',
+  discovery_sequence BIGINT NULL COMMENT '共享任务及分仓子任务继承的调度顺序；重试保持不变，不用于事实覆盖判定',
+  observation_baseline BIGINT NULL COMMENT '共享任务建立时已分配的最大详情采集代次，分仓子任务继承；用于识别旧任务恢复期间出现的其他任务新观测',
+  request_key VARCHAR(128) NOT NULL COMMENT '共享发现包含切片／计划槽位；分仓任务包含仓库、任务族及切片或计划槽位；人工附请求幂等键',
+  request_hash CHAR(64) NOT NULL COMMENT '请求类型、查询范围、范围摘要的指纹；同键不同请求拒绝',
+  task_type VARCHAR(24) NOT NULL COMMENT '计划、补采、复核、重建与验证；INVENTORY_FLOW_HISTORY为流水片，INVENTORY_HISTORY_BUILD为本地历史还原',
+  planned_at_utc DATETIME(3) NULL COMMENT '计划时点；人工请求可空',
+  query_from_utc DATETIME(3) NULL COMMENT '出库查询区间UTC下界，库存不填',
+  query_until_utc DATETIME(3) NULL COMMENT '出库查询区间UTC上界，不含端点，库存不填',
+  query_scope_json JSON NOT NULL COMMENT '不变的账号、货主、仓库、品质和查询条件快照；按单补查在此记录单号',
+  routing_manifest_json JSON NULL COMMENT '共享切片目录完整标记、每仓对象键集合／数量和详情就绪状态；各对象记录 effectiveStageId，需新代次复查时记录 refreshTaskId，完成后指向新有效暂存；不改写旧载荷',
+  scope_hash CHAR(64) NOT NULL COMMENT '建任务时的业务范围摘要',
+  status VARCHAR(20) NOT NULL COMMENT 'WAITING_SOURCE、READY、RUNNING、RETRY_WAIT、SUCCEEDED、DEAD、SAMPLE_DONE；样本结束不等于正式成功',
+  apply_state VARCHAR(20) NOT NULL COMMENT '正式出库归并NOT_STARTED、APPLYING、BLOCKED、APPLIED；共享发现、库存、重建及验证为NOT_APPLICABLE',
+  affected_warehouse_codes_json JSON NULL COMMENT '本次归并可能改变的仓集合，包含原仓与新仓；首段事实写入前登记，扩大集合须先取得新增仓租约并锁 scope，不能写完再补',
+  apply_started_at_utc DATETIME(3) NULL COMMENT '首段事实提交UTC时间',
+  apply_completed_at_utc DATETIME(3) NULL COMMENT '全部必需事实归并完成UTC时间，失败不填',
+  attempt_count INT NOT NULL DEFAULT 0 COMMENT '已创建的执行尝试数',
+  next_retry_at_utc DATETIME(3) NULL COMMENT '有限退避后下一次可执行时刻',
+  requested_by VARCHAR(128) NULL COMMENT '人工请求的平台操作人，仅内部审计',
+  result_published_run_id BIGINT NULL COMMENT '正式成功任务实际发布或复用的版本；验证和共享发现为空',
+  progress_json JSON NULL COMMENT '与可靠检查点一起提交的有界阶段、单位、尝试和质量进度，不保存单据集合',
+  progress_updated_at_utc DATETIME(3) NULL COMMENT '最后可靠业务检查点UTC时间，与执行心跳分开',
+  PRIMARY KEY (id),
+  UNIQUE KEY uk_selfop_task_no (task_no),
+  UNIQUE KEY uk_selfop_task_request (source_account,request_key),
+  KEY idx_selfop_task_poll (status,next_retry_at_utc,id),
+  KEY idx_selfop_task_upstream (upstream_task_id,warehouse_code),
+  KEY idx_selfop_task_apply (apply_state,id),
+  KEY idx_selfop_task_scope_list (scope_id,created_at,id),
+  KEY idx_selfop_task_account_list (source_account,task_role,created_at,id),
+  KEY idx_selfop_task_business_root (business_root_task_id,status,id),
+  CONSTRAINT chk_selfop_business_budget CHECK ((business_root_task_id IS NULL AND business_budget_json IS NULL) OR (execution_purpose='BUSINESS' AND business_root_task_id IS NOT NULL AND ((business_root_task_id=id AND business_budget_json IS NOT NULL) OR (business_root_task_id<>id AND business_budget_json IS NULL)))),
+  CONSTRAINT chk_selfop_sync_task CHECK (attempt_count >= 0 AND execution_purpose IN ('BUSINESS','VALIDATION') AND ((execution_purpose = 'BUSINESS' AND validation_root_task_id IS NULL AND validation_budget_json IS NULL) OR (execution_purpose = 'VALIDATION' AND validation_root_task_id IS NOT NULL AND apply_state = 'NOT_APPLICABLE' AND result_published_run_id IS NULL AND status <> 'SUCCEEDED')) AND ((task_role = 'ACCOUNT_DISCOVERY' AND scope_id IS NULL AND warehouse_code IS NULL AND discovery_scope_id IS NOT NULL) OR (task_role = 'WAREHOUSE_SYNC' AND scope_id IS NOT NULL AND warehouse_code IS NOT NULL)))
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_bin COMMENT='一次计划或人工请求';
+
+CREATE TABLE ll_selfop_sync_run (
+  id BIGINT NOT NULL COMMENT '应用生成的记录标识',
+  created_at DATETIME(3) NOT NULL COMMENT 'UTC创建时间',
+  updated_at DATETIME(3) NOT NULL COMMENT 'UTC更新时间',
+  task_id BIGINT NOT NULL COMMENT '本次执行请求',
+  execution_purpose VARCHAR(16) NOT NULL COMMENT '从逻辑任务冻结继承，验证尝试不能作为正式统计版本',
+  scope_id BIGINT NULL COMMENT '仅账号共享发现为空；分仓执行必须有作用域',
+  source_account VARCHAR(64) NOT NULL COMMENT '受控来源账号别名，不保存密钥',
+  warehouse_code VARCHAR(64) NULL COMMENT '来源仓库原始编码，按仓独立统计',
+  run_role VARCHAR(24) NOT NULL COMMENT 'ACCOUNT_DISCOVERY 或 WAREHOUSE_SYNC',
+  upstream_task_id BIGINT NULL COMMENT '分仓出库计算引用的共享切片及其稳定暂存集合',
+  attempt_no INT NOT NULL COMMENT '同一请求从 1 起递增',
+  scope_hash CHAR(64) NOT NULL COMMENT '本版本的业务范围摘要',
+  scope_snapshot_json JSON NOT NULL COMMENT '分仓版只含本仓货主／品质、固定首采 [B,E0)、时区、调度与过期阈值；账号发现保存待路由仓集合，不冒充业务版',
+  observed_dimensions_json JSON NULL COMMENT '本次实际出现的仓库／货主集合及数量摘要，仅作采集证据；例如已观测 70 货主不等于固定授权范围',
+  fence_token BIGINT NOT NULL COMMENT '本尝试持有的栅栏版本',
+  base_published_run_id BIGINT NULL COMMENT '执行开始时的上一可见版本',
+  reference_sales_run_id BIGINT NULL COMMENT '库存构建开始时固定的本仓已发布销量版，用其不可变 SKU 维度生成出库已知商品占位；没有已发布销量版时为空，不读取半归并订单事实',
+  inventory_daily_sample_date DATE NULL COMMENT '北京时间当日首个合格计划库存发布代表日期，非代表为空',
+  inventory_sample_rule_version VARCHAR(32) NULL COMMENT '日库存代表选择规则 DAILY_SCHEDULED_FIRST_V1，与日标记原子保存',
+  status VARCHAR(24) NOT NULL COMMENT 'FETCHING、VALIDATED、ROUTED、FACTS_APPLIED、BUILDING、READY、PUBLISHED、REUSED、YIELDED、FAILED、ABORTED、SAMPLE_DONE；复用和验证不是版本头',
+  last_phase VARCHAR(24) NOT NULL COMMENT '失败／中止前所在阶段，支持判断是否已经归并事实',
+  fetch_started_at_utc DATETIME(3) NULL COMMENT '实际采集开始UTC时间',
+  fetch_finished_at_utc DATETIME(3) NULL COMMENT '实际采集完成UTC时间，未完成为空',
+  build_started_at_utc DATETIME(3) NULL COMMENT '实际开始有界候选构建UTC时间，用于构建耗时及首采合并间隔',
+  warehouse_daily_ready TINYINT NOT NULL DEFAULT 0 COMMENT '仓库日汇总已完整构建并校验，含完整空版本',
+  finished_at_utc DATETIME(3) NULL COMMENT '本次尝试终止UTC时间',
+  published_at_utc DATETIME(3) NULL COMMENT '实际原子切换发布指针UTC时间',
+  superseded_at_utc DATETIME(3) NULL COMMENT '被新发布版替代的首次UTC时间，同事务填写且重试不重置',
+  page_count INT NOT NULL DEFAULT 0 COMMENT '已完整获取页数',
+  source_total_count BIGINT NULL COMMENT '上游可靠返回的总数；未返回则为空',
+  unique_object_count BIGINT NOT NULL DEFAULT 0 COMMENT '规范化去重后对象数',
+  progress_snapshot_json JSON NULL COMMENT '尝试终止时冻结的有界可靠进度摘要，历史尝试不随逻辑任务改写',
+  heartbeat_at_utc DATETIME(3) NULL COMMENT '有效执行者最新UTC心跳，不代表业务检查点推进',
+  coverage_status VARCHAR(16) NOT NULL COMMENT 'UNKNOWN、PARTIAL、COMPLETE；分页完整与数值有效性分别判断',
+  covered_from_utc DATETIME(3) NULL COMMENT '本仓销量版本实际连续覆盖UTC下界',
+  covered_until_utc DATETIME(3) NULL COMMENT '本仓销量版本实际连续覆盖UTC上界，不含端点',
+  complete_day_from DATE NULL COMMENT '本仓完整自然日区间首日，包含',
+  complete_day_until DATE NULL COMMENT '本仓完整自然日区间末日，不含',
+  applied_fact_revision BIGINT NULL COMMENT '本次尝试归并后的事实修订号，库存为空',
+  calculated_fact_revision BIGINT NULL COMMENT '候选销量版本计算所依据的固定事实修订号',
+  error_code VARCHAR(64) NULL COMMENT '内部可诊断错误分类，不保存认证信息',
+  error_message VARCHAR(500) NULL COMMENT '脱敏后的固定错误摘要',
+  PRIMARY KEY (id),
+  UNIQUE KEY uk_selfop_run_attempt (task_id,attempt_no),
+  UNIQUE KEY uk_selfop_inventory_daily (source_account,warehouse_code,inventory_daily_sample_date),
+  KEY idx_selfop_run_scope (scope_id,id),
+  KEY idx_selfop_run_status (status,updated_at),
+  CONSTRAINT chk_selfop_inventory_daily CHECK ((inventory_daily_sample_date IS NULL AND inventory_sample_rule_version IS NULL) OR (inventory_daily_sample_date IS NOT NULL AND inventory_sample_rule_version IS NOT NULL AND inventory_sample_rule_version = 'DAILY_SCHEDULED_FIRST_V1' AND execution_purpose = 'BUSINESS' AND run_role = 'WAREHOUSE_SYNC' AND status = 'PUBLISHED' AND coverage_status = 'COMPLETE')),
+  CONSTRAINT chk_selfop_sync_run CHECK (attempt_no > 0 AND page_count >= 0 AND unique_object_count >= 0 AND execution_purpose IN ('BUSINESS','VALIDATION') AND (execution_purpose <> 'VALIDATION' OR status NOT IN ('PUBLISHED','REUSED')) AND (source_total_count IS NULL OR source_total_count >= 0) AND ((run_role = 'ACCOUNT_DISCOVERY' AND scope_id IS NULL AND warehouse_code IS NULL) OR (run_role = 'WAREHOUSE_SYNC' AND scope_id IS NOT NULL AND warehouse_code IS NOT NULL)))
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_bin COMMENT='执行尝试、覆盖证明和版本头';
+
+CREATE TABLE ll_selfop_sync_stage (
+  id BIGINT NOT NULL COMMENT '应用生成的记录标识',
+  created_at DATETIME(3) NOT NULL COMMENT 'UTC创建时间',
+  updated_at DATETIME(3) NOT NULL COMMENT 'UTC更新时间',
+  run_id BIGINT NOT NULL COMMENT '首次写入该暂存对象的执行尝试',
+  stage_batch_id BIGINT NOT NULL COMMENT '出库取共享发现 task.id，便于断点续取；库存取本次 run.id，严禁跨尝试混页',
+  last_fetch_run_id BIGINT NOT NULL COMMENT '最后一次补齐该对象的执行尝试，保留重试来源',
+  observation_sequence BIGINT NULL COMMENT '该完整出库详情实际请求的采集代次；有效出库对象必填，目录待补对象和库存为空；不能填 task 调度序号',
+  warehouse_code VARCHAR(64) NOT NULL COMMENT '来源仓库原始编码，按仓独立统计',
+  previous_warehouse_code VARCHAR(64) NULL COMMENT '路由时从已有单据识别的原仓库；归并前再校验，跨仓时通知两仓',
+  object_type VARCHAR(16) NOT NULL COMMENT 'OUTBOUND_ORDER 或 PRODUCT_STOCK',
+  object_key_hash CHAR(64) NOT NULL COMMENT '规范化业务键摘要；原业务键保留在载荷中并核对',
+  first_page_no INT NOT NULL COMMENT '首次发现页码',
+  observed_at_utc DATETIME(3) NOT NULL COMMENT '实际接收该对象的时刻',
+  content_hash CHAR(64) NOT NULL COMMENT '完整规范化对象摘要',
+  payload_json JSON NOT NULL COMMENT '目录阶段可先存订单头，详情齐后补完整 SKU；VALID 后不再修改；库存保存产品库存字段',
+  before_payload_json JSON NULL COMMENT '订单归并事务内记录归并前的完整规范化事实；新增单为空',
+  validation_status VARCHAR(16) NOT NULL COMMENT '暂存校验状态：PENDING待核验、VALID有效、INVALID异常',
+  validation_code VARCHAR(64) NULL COMMENT '字段缺失、冲突、未知时区等原因',
+  PRIMARY KEY (id),
+  UNIQUE KEY uk_selfop_stage_object (stage_batch_id,object_type,object_key_hash),
+  KEY idx_selfop_stage_history (object_type,object_key_hash,stage_batch_id),
+  KEY idx_selfop_stage_observation (object_type,object_key_hash,validation_status,observation_sequence),
+  KEY idx_selfop_stage_fact_observation (observation_sequence,warehouse_code,object_type,validation_status,run_id,observed_at_utc),
+  KEY idx_selfop_stage_route (stage_batch_id,warehouse_code,validation_status),
+  CONSTRAINT chk_selfop_sync_stage CHECK (first_page_no > 0 AND (object_type <> 'OUTBOUND_ORDER' OR validation_status <> 'VALID' OR observation_sequence IS NOT NULL))
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_bin COMMENT='待验证事实与修订证据';
+
+CREATE TABLE ll_selfop_outbound_order (
+  id BIGINT NOT NULL COMMENT '应用生成的记录标识',
+  created_at DATETIME(3) NOT NULL COMMENT 'UTC创建时间',
+  updated_at DATETIME(3) NOT NULL COMMENT 'UTC更新时间',
+  source_account VARCHAR(64) NOT NULL COMMENT '受控来源账号别名，不保存密钥',
+  customer_code VARCHAR(64) NOT NULL COMMENT '领星货主原始编码，不等同平台客户标识',
+  warehouse_code VARCHAR(64) NOT NULL COMMENT '来源仓库原始编码，按仓独立统计',
+  delivery_no VARCHAR(128) NOT NULL COMMENT 'OMP 发货单号，采用列表及详情同一身份',
+  source_no VARCHAR(128) NULL COMMENT 'WMS 来源出库单号，缺失不以内部 ID 回退展示',
+  source_status INT NOT NULL COMMENT '原始状态，100 已出库、99 已取消；不改造成内部状态码',
+  source_created_time VARCHAR(64) NULL COMMENT '来源创建时间原始字符串，不使用采集时间替代',
+  source_outbound_time VARCHAR(64) NULL COMMENT '来源实际出库时间原始字符串，不使用采集时间替代',
+  source_timezone VARCHAR(64) NULL COMMENT '解析采用的源时区',
+  outbound_at_utc DATETIME(3) NULL COMMENT '已核准的实际出库时间点；非出库状态可空',
+  business_date DATE NULL COMMENT '已核准业务时区下的出库日',
+  business_timezone VARCHAR(64) NOT NULL COMMENT '该事实当前归属仓所用业务时区，迁仓后重新确定业务日',
+  sales_eligible TINYINT NOT NULL DEFAULT 0 COMMENT '仅已出库、时间与全部数量有效时为 1',
+  revision_no BIGINT NOT NULL DEFAULT 1 COMMENT '该单内容变更次数，不等于拉取次数',
+  content_hash CHAR(64) NOT NULL COMMENT '订单头及完整 SKU 明细规范化摘要',
+  last_run_id BIGINT NOT NULL COMMENT '最后一次确认或修订的执行尝试',
+  last_observation_sequence BIGINT NOT NULL COMMENT '最后接受的完整详情采集代次；仅防旧观测重放，不按 task 调度序号拒绝较晚实际读取的事实，不冒充领星源版本号',
+  PRIMARY KEY (id),
+  UNIQUE KEY uk_selfop_order (source_account,customer_code,delivery_no),
+  KEY idx_selfop_order_daily (source_account,warehouse_code,sales_eligible,business_date,id),
+  KEY idx_selfop_order_run (last_run_id),
+  CONSTRAINT chk_selfop_outbound_order CHECK (revision_no > 0 AND last_observation_sequence > 0 AND sales_eligible IN (0,1) AND (sales_eligible = 0 OR (source_status = 100 AND source_timezone IS NOT NULL AND outbound_at_utc IS NOT NULL AND business_date IS NOT NULL)))
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_bin COMMENT='最后确认的单据事实';
+
+CREATE TABLE ll_selfop_outbound_item (
+  id BIGINT NOT NULL COMMENT '应用生成的记录标识',
+  created_at DATETIME(3) NOT NULL COMMENT 'UTC创建时间',
+  updated_at DATETIME(3) NOT NULL COMMENT 'UTC更新时间',
+  order_id BIGINT NOT NULL COMMENT '对应外部出库事实',
+  sku_code VARCHAR(128) NOT NULL COMMENT '原始 productSku',
+  product_name VARCHAR(255) NULL COMMENT '来源商品名称，仅作展示',
+  actual_quantity DECIMAL(20,6) NOT NULL COMMENT '详情 actualDeliveryQty，必须为非负有效数值',
+  quantity_unit VARCHAR(32) NOT NULL COMMENT '已核准业务单位；未确认单位不发布正式数量统计',
+  PRIMARY KEY (id),
+  UNIQUE KEY uk_selfop_order_sku (order_id,sku_code),
+  KEY idx_selfop_item_sku (sku_code,order_id),
+  CONSTRAINT chk_selfop_outbound_item CHECK (actual_quantity >= 0)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_bin COMMENT='整单替换的实际出库明细';
+
+CREATE TABLE ll_selfop_inventory_snapshot (
+  id BIGINT NOT NULL COMMENT '应用生成的记录标识',
+  created_at DATETIME(3) NOT NULL COMMENT 'UTC创建时间',
+  updated_at DATETIME(3) NOT NULL COMMENT 'UTC更新时间',
+  snapshot_run_id BIGINT NOT NULL COMMENT 'INVENTORY 执行尝试；发布后该批明细不可修改',
+  source_account VARCHAR(64) NOT NULL COMMENT '受控来源账号别名，不保存密钥',
+  customer_code VARCHAR(64) NOT NULL COMMENT '领星货主原始编码，不等同平台客户标识',
+  warehouse_code VARCHAR(64) NOT NULL COMMENT '来源仓库原始编码，按仓独立统计',
+  sku_code VARCHAR(128) NOT NULL COMMENT '原始产品 SKU',
+  product_quality SMALLINT NOT NULL COMMENT '来源品质，当前 0 正品、1 次品；全量均保存，不套用整箱库存',
+  product_name VARCHAR(255) NULL COMMENT '来源名称',
+  physical_quantity DECIMAL(20,6) NULL COMMENT '来源stkQty实物库存，未知为空',
+  available_quantity DECIMAL(20,6) NULL COMMENT '来源useStkQty可用库存，未知为空，不再次扣冻结',
+  frozen_quantity DECIMAL(20,6) NULL COMMENT '来源freezeQty冻结库存，未知为空',
+  transit_quantity DECIMAL(20,6) NULL COMMENT '来源transitQty在途数量，未知为空，不计可售库存',
+  source_unique_key VARCHAR(512) NULL COMMENT '原 uniqueKey4tenant，只作来源证据',
+  observed_at_utc DATETIME(3) NOT NULL COMMENT '所在页实际采集时间；缺行占位取本批采集完成时间',
+  quality_status VARCHAR(16) NOT NULL COMMENT 'VALID、UNKNOWN、INVALID；STALE 按批次年龄实时派生',
+  quality_reason VARCHAR(64) NULL COMMENT 'SOURCE_ROW_MISSING、FIELD_MISSING、NEGATIVE_QUANTITY 等',
+  PRIMARY KEY (id),
+  UNIQUE KEY uk_selfop_stock_snapshot (snapshot_run_id,source_account,customer_code,warehouse_code,sku_code,product_quality),
+  KEY idx_selfop_stock_lookup (source_account,customer_code,warehouse_code,sku_code,product_quality,snapshot_run_id)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_bin COMMENT='产品库存全量批次明细';
+
+CREATE TABLE ll_selfop_sku_daily_sales (
+  id BIGINT NOT NULL COMMENT '应用生成的记录标识',
+  created_at DATETIME(3) NOT NULL COMMENT 'UTC创建时间',
+  updated_at DATETIME(3) NOT NULL COMMENT 'UTC更新时间',
+  sales_run_id BIGINT NOT NULL COMMENT 'OUTBOUND 执行尝试，同时是计算版本',
+  source_account VARCHAR(64) NOT NULL COMMENT '受控来源账号别名，不保存密钥',
+  customer_code VARCHAR(64) NOT NULL COMMENT '领星货主原始编码，不等同平台客户标识',
+  warehouse_code VARCHAR(64) NOT NULL COMMENT '来源仓库原始编码，按仓独立统计',
+  sku_code VARCHAR(128) NOT NULL COMMENT '原始产品 SKU',
+  business_date DATE NOT NULL COMMENT '已核准业务日',
+  outbound_quantity DECIMAL(20,6) NOT NULL COMMENT '有效出库实际件数之和，非负',
+  outbound_order_count BIGINT NOT NULL COMMENT '该维度去重发货单数，非负',
+  quantity_unit VARCHAR(32) NOT NULL COMMENT '同一统计维度内一致的业务单位',
+  PRIMARY KEY (id),
+  UNIQUE KEY uk_selfop_daily_version (sales_run_id,source_account,customer_code,warehouse_code,sku_code,business_date),
+  KEY idx_selfop_daily_window_cover (sales_run_id,source_account,warehouse_code,business_date,customer_code,sku_code,outbound_quantity,outbound_order_count,quantity_unit),
+  KEY idx_selfop_daily_sku_cover (sales_run_id,source_account,warehouse_code,customer_code,sku_code,business_date,outbound_quantity,outbound_order_count,quantity_unit),
+  CONSTRAINT chk_selfop_sku_daily_sales CHECK (outbound_quantity >= 0 AND outbound_order_count >= 0)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_bin COMMENT='完整销量版本的稀疏日事实';
+
+CREATE TABLE ll_selfop_warehouse_daily_sales (
+  sales_run_id BIGINT NOT NULL COMMENT '完整销量计算版本标识',
+  source_account VARCHAR(64) NOT NULL COMMENT '受控来源账号别名，不保存密钥',
+  warehouse_code VARCHAR(64) NOT NULL COMMENT '来源仓库原始编码',
+  business_date DATE NOT NULL COMMENT '已核准业务日',
+  observed_quantity DECIMAL(38,6) NULL COMMENT '该日PCS非负有效出库量之和，无有效行时为空',
+  invalid_row_count BIGINT NOT NULL COMMENT '该日数量为空或负数或单位非PCS的日事实行数',
+  source_row_count BIGINT NOT NULL COMMENT '该日参与仓库汇总的SKU日事实总行数',
+  created_at DATETIME(3) NOT NULL COMMENT 'UTC创建时间',
+  updated_at DATETIME(3) NOT NULL COMMENT 'UTC更新时间',
+  PRIMARY KEY (sales_run_id,source_account,warehouse_code,business_date),
+  CONSTRAINT chk_selfop_warehouse_daily_sales CHECK (source_row_count > 0 AND invalid_row_count >= 0 AND invalid_row_count <= source_row_count AND (observed_quantity IS NULL OR observed_quantity >= 0))
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_bin COMMENT='完整销量版本按仓按日汇总，随SKU日事实批次原子构建';
+
+CREATE TABLE ll_selfop_sku_profile (
+  id BIGINT NOT NULL COMMENT '应用生成的记录标识',
+  created_at DATETIME(3) NOT NULL COMMENT 'UTC创建时间',
+  updated_at DATETIME(3) NOT NULL COMMENT 'UTC更新时间',
+  profile_run_id BIGINT NOT NULL COMMENT '本仓销量或库存候选版本；与对应 daily／snapshot 使用同一 run，发布后该版本全部维度行不可修改',
+  source_account VARCHAR(64) NOT NULL COMMENT '受控来源账号别名，不保存密钥',
+  customer_code VARCHAR(64) NOT NULL COMMENT '领星货主原始编码，不等同平台客户标识',
+  warehouse_code VARCHAR(64) NOT NULL COMMENT '来源仓库原始编码，按仓独立统计',
+  sku_code VARCHAR(128) NOT NULL COMMENT '原始产品 SKU',
+  product_name VARCHAR(255) NULL COMMENT '本版本确认的名称，不实时连接其他版本名称',
+  quantity_unit VARCHAR(32) NULL COMMENT '本版本已核准单位；未知或两版本单位冲突时不计算混合指标',
+  first_seen_at_utc DATETIME(3) NULL COMMENT '本证据族真实观测到本仓商品的最早接收时刻；缺行占位不能生成观察证据',
+  earliest_evidence_at_utc DATETIME(3) NULL COMMENT '库存版取真实库存首次观察时刻；销量版从该版有效事实重新求最早已核准出库时间，可随改期、取消或迁仓撤回／后移',
+  evidence_type VARCHAR(24) NOT NULL COMMENT 'INVENTORY_OBSERVATION、VALID_OUTBOUND、NONE；不得将销量证据复制成库存真实观察证据',
+  evidence_run_id BIGINT NULL COMMENT '本证据族真实依据的采集批次，无证据占位为空',
+  last_seen_run_id BIGINT NULL COMMENT '本证据族最近真实观测批次，无证据占位为空',
+  PRIMARY KEY (id),
+  UNIQUE KEY uk_selfop_profile_version (profile_run_id,source_account,customer_code,warehouse_code,sku_code),
+  KEY idx_selfop_profile_evidence (profile_run_id,earliest_evidence_at_utc,customer_code,sku_code)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_bin COMMENT='随发布版本固定的 SKU 维度与观察依据';
 
 
-CREATE TABLE IF NOT EXISTS ll_appointment_impact (
+
+CREATE TABLE ll_appointment_impact (
   container_booking_id VARCHAR(64) NOT NULL COMMENT '稳定柜次关联键，不作业务编号展示',
   impact_no VARCHAR(40) NOT NULL COMMENT '船期核对事项业务号',
   baseline_json LONGTEXT NOT NULL COMMENT '已核对基准或首次变化前观察，原来源时间口径',
@@ -3928,7 +4349,7 @@ CREATE TABLE IF NOT EXISTS ll_appointment_impact (
   CONSTRAINT chk_appointment_impact_status CHECK (status IN ('MONITORING','OPEN','RESOLVED'))
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COMMENT='一柜一个稳定船期变化核对事项，不改写预约或运输';
 
-CREATE TABLE IF NOT EXISTS ll_appointment_impact_history (
+CREATE TABLE ll_appointment_impact_history (
   id BIGINT NOT NULL COMMENT '历史记录标识',
   container_booking_id VARCHAR(64) NOT NULL COMMENT '关联柜次标识',
   version INT NOT NULL COMMENT '记录版本',
@@ -3948,3 +4369,256 @@ CREATE TABLE IF NOT EXISTS ll_appointment_impact_history (
   CONSTRAINT fk_appointment_impact_history FOREIGN KEY (container_booking_id) REFERENCES ll_appointment_impact(container_booking_id),
   CONSTRAINT chk_appointment_impact_action CHECK (action IN ('OBSERVED','CLAIM','RECORD','RESOLVE'))
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COMMENT='船期观察及人工处理追加历史';
+
+-- SKU 换标实物转换：先执行本增量，再部署服务。不会自动改写存量业务事实。
+CREATE TABLE ll_return_sku_conversion (
+ id BIGINT NOT NULL COMMENT 'SKU库存转换记录ID',
+ customer_id VARCHAR(128) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL COMMENT '客户隔离键',
+ overseas_warehouse_id VARCHAR(128) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL COMMENT '操作海外仓ID',
+ application_id BIGINT NOT NULL COMMENT '换标申请ID',
+ relabel_no VARCHAR(64) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL COMMENT '换标单号',
+ item_id BIGINT NOT NULL COMMENT '换标箱级明细ID',
+ round_key VARCHAR(64) NOT NULL COMMENT '作业轮次，退回重做使用新轮次',
+ carton_id BIGINT NOT NULL COMMENT '实物来源包裹或箱ID',
+ carton_mark VARCHAR(128) NOT NULL COMMENT '完工时仓库识别码',
+ old_sku_code VARCHAR(128) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL COMMENT '换标前SKU',
+ new_sku_code VARCHAR(128) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL COMMENT '换标后SKU',
+ product_name_zh VARCHAR(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NULL COMMENT '中文品名快照',
+ quantity BIGINT NOT NULL COMMENT '实际完成转换件数',
+ status VARCHAR(32) NOT NULL COMMENT 'APPLIED待客户确认/CONFIRMED已确认/REVERSED退回冲回',
+ ownership_json LONGTEXT NOT NULL COMMENT '本次转换件数的来源退货单快照，供精确冲回',
+ completed_at DATETIME(3) NOT NULL COMMENT '实物SKU转换时间',
+ confirmed_at DATETIME(3) NULL COMMENT '客户确认时间',
+ reversed_at DATETIME(3) NULL COMMENT '退回冲回时间',
+ PRIMARY KEY(id),
+ UNIQUE KEY uk_return_sku_conversion_round(item_id,round_key,old_sku_code,new_sku_code),
+ KEY idx_return_sku_conversion_app(customer_id,application_id,status),
+ KEY idx_return_sku_conversion_carton(customer_id,carton_id),
+ CONSTRAINT chk_return_sku_conversion_quantity CHECK(quantity>0)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci COMMENT='退货实物SKU换标库存转换和冲回记录';
+
+-- PDA cargo discard photo evidence
+CREATE TABLE ll_cargo_discard_photo (
+  id BIGINT NOT NULL COMMENT '照片记录标识',
+  customer_id VARCHAR(64) NOT NULL COMMENT '所属客户标识',
+  application_id BIGINT NOT NULL COMMENT '废弃申请标识',
+  pallet_no VARCHAR(128) NOT NULL COMMENT '托盘业务码',
+  file_id BIGINT NOT NULL COMMENT '照片文件标识',
+  file_name VARCHAR(255) NOT NULL COMMENT '原始文件名',
+  content_type VARCHAR(128) NOT NULL COMMENT '文件媒体类型',
+  size_bytes BIGINT NOT NULL COMMENT '文件字节数',
+  operator_id VARCHAR(64) NOT NULL COMMENT '上传操作人标识',
+  created_at DATETIME(6) NOT NULL COMMENT '照片创建时间',
+  submitted_at DATETIME(6) NULL COMMENT '照片提交时间',
+  PRIMARY KEY (id),
+  UNIQUE KEY uk_cargo_discard_photo_file (file_id),
+  KEY idx_cargo_discard_photo_application (customer_id, application_id, pallet_no)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci COMMENT='海外PDA货物废弃照片凭证';
+
+-- 货物废弃支持所有入库来源及散箱全量作业；不回填或修改历史单据。
+
+
+
+
+
+
+CREATE TABLE ll_selfop_owner (
+  id BIGINT NOT NULL COMMENT '主键',
+  run_id BIGINT NOT NULL COMMENT '完整资料采集版本',
+  source_account VARCHAR(64) COLLATE utf8mb4_bin NOT NULL COMMENT '来源账号',
+  customer_code VARCHAR(64) COLLATE utf8mb4_bin NOT NULL COMMENT '领星货主编码',
+  customer_name VARCHAR(255) NULL COMMENT '领星货主名称',
+  source_status VARCHAR(32) NULL COMMENT '来源启停状态',
+  observed_at_utc DATETIME(6) NOT NULL COMMENT '资料观测时间',
+  PRIMARY KEY (id),
+  UNIQUE KEY uk_selfop_owner_version (run_id,source_account,customer_code),
+  KEY idx_selfop_owner_lookup (source_account,customer_code,run_id)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COMMENT='自营领星货主资料版本';
+
+CREATE TABLE ll_selfop_product (
+  id BIGINT NOT NULL COMMENT '主键',
+  run_id BIGINT NOT NULL COMMENT '完整资料采集版本',
+  source_account VARCHAR(64) COLLATE utf8mb4_bin NOT NULL COMMENT '来源账号',
+  customer_code VARCHAR(64) COLLATE utf8mb4_bin NOT NULL COMMENT '领星货主编码',
+  sku_code VARCHAR(128) COLLATE utf8mb4_bin NOT NULL COMMENT '货主商品编码',
+  product_name VARCHAR(255) NULL COMMENT '商品名称',
+  declared_length DECIMAL(24,6) NULL COMMENT '商品资料长度',
+  declared_width DECIMAL(24,6) NULL COMMENT '商品资料宽度',
+  declared_height DECIMAL(24,6) NULL COMMENT '商品资料高度',
+  declared_size_unit VARCHAR(32) NULL COMMENT '商品资料尺寸单位',
+  measured_length DECIMAL(24,6) NULL COMMENT '仓库实测长度',
+  measured_width DECIMAL(24,6) NULL COMMENT '仓库实测宽度',
+  measured_height DECIMAL(24,6) NULL COMMENT '仓库实测高度',
+  measured_size_unit VARCHAR(32) NULL COMMENT '仓库实测尺寸单位',
+  observed_at_utc DATETIME(6) NOT NULL COMMENT '资料观测时间',
+  PRIMARY KEY (id),
+  UNIQUE KEY uk_selfop_product_version (run_id,source_account,customer_code,sku_code),
+  KEY idx_selfop_product_lookup (source_account,customer_code,sku_code,run_id)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COMMENT='自营领星商品资料版本';
+
+
+-- 仓储转运逐箱测量与清点；仅增加字段，不修改业务数据。
+USE baiyue_lastleg;
+
+
+
+-- SKU 申报件数独立于预计箱数；历史未申报件数保持 NULL，实收以 PDA 清点为准。
+
+USE baiyue_lastleg;
+
+-- 历史库存基线；执行前必须取得指定环境的建表授权。
+CREATE TABLE ll_selfop_inventory_flow (
+  id BIGINT NOT NULL COMMENT '应用生成的流水记录标识',
+  source_account VARCHAR(64) NOT NULL COMMENT '受控来源账号',
+  warehouse_code VARCHAR(64) NOT NULL COMMENT '来源仓库编码',
+  customer_code VARCHAR(64) NOT NULL COMMENT '来源货主编码',
+  sku_code VARCHAR(128) NOT NULL COMMENT '来源商品编码',
+  source_flow_id VARCHAR(64) NOT NULL COMMENT '来源流水字符串标识',
+  product_quality INT NOT NULL COMMENT '来源品质，零正品一次品，其他未知',
+  cell_no VARCHAR(128) NULL COMMENT '来源库位编码',
+  inner_batch_no VARCHAR(128) NULL COMMENT '来源内部批次号',
+  bill_no VARCHAR(128) NULL COMMENT '来源业务单号',
+  source_no VARCHAR(128) NULL COMMENT '来源关联单号',
+  bill_type VARCHAR(32) NULL COMMENT '来源业务类型，未验证类型不得参与正式还原',
+  book_qty DECIMAL(20,6) NULL COMMENT '来源记账增减量，未知为空',
+  book_change_qty_raw VARCHAR(64) NULL COMMENT '来源带符号变动量原文',
+  delta_quantity DECIMAL(20,6) NULL COMMENT '解析后的有符号实物变动量',
+  close_quantity DECIMAL(20,6) NULL COMMENT '对应库位批次品质链的结存',
+  source_create_time VARCHAR(64) NULL COMMENT '来源北京时间原文',
+  event_at_utc DATETIME(3) NULL COMMENT '流水发生UTC时刻，无法解析时为空',
+  business_date DATE NULL COMMENT '北京时间业务日期',
+  quantity_unit VARCHAR(16) NULL COMMENT '已确认数量单位，未知为空',
+  content_hash CHAR(64) NOT NULL COMMENT '当前事实内容摘要',
+  revision_no BIGINT NOT NULL COMMENT '同来源流水单调增加的修订号',
+  stage_id BIGINT NOT NULL COMMENT '当前事实对应不可变暂存证据',
+  first_run_id BIGINT NOT NULL COMMENT '首次观察执行尝试',
+  last_run_id BIGINT NOT NULL COMMENT '最近确认执行尝试',
+  last_observed_at DATETIME(3) NOT NULL COMMENT '最近观察UTC时刻',
+  validation_status VARCHAR(16) NOT NULL COMMENT '字段资格，有效或未知',
+  validation_reason VARCHAR(64) NULL COMMENT '数量或身份待核验原因',
+  PRIMARY KEY (id),
+  UNIQUE KEY uk_selfop_flow_source (source_account,warehouse_code,source_flow_id),
+  KEY idx_selfop_flow_sku (source_account,warehouse_code,customer_code,sku_code,event_at_utc),
+  KEY idx_selfop_flow_day (source_account,warehouse_code,business_date),
+  CONSTRAINT chk_selfop_flow_revision CHECK (revision_no > 0)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_bin COMMENT='自营历史库存流水最新事实，旧版本保留于暂存证据';
+
+CREATE TABLE ll_selfop_inventory_day_version (
+  id BIGINT NOT NULL COMMENT '不可变历史日版本标识',
+  source_account VARCHAR(64) NOT NULL COMMENT '受控来源账号',
+  warehouse_code VARCHAR(64) NOT NULL COMMENT '来源仓库编码',
+  business_date DATE NOT NULL COMMENT '北京时间日末所属日期',
+  scope_hash CHAR(64) NOT NULL COMMENT '业务范围摘要',
+  rule_version VARCHAR(32) NOT NULL COMMENT '日末库存还原规则版本',
+  build_run_id BIGINT NOT NULL COMMENT '历史重建执行尝试',
+  publication_group_id BIGINT NOT NULL COMMENT '必须一起切换的发布组标识',
+  sales_run_id BIGINT NULL COMMENT '构建时固定的销量证据版本',
+  anchor_run_id BIGINT NOT NULL COMMENT '固定的独立库存锚点版本',
+  input_hash CHAR(64) NOT NULL COMMENT '冻结流水修订与覆盖及锚点输入摘要',
+  evidence_json JSON NOT NULL COMMENT '固定输入清单及不可变证据引用',
+  status VARCHAR(16) NOT NULL COMMENT '构建中、就绪、已发布、已替代或失败',
+  head_slot TINYINT NULL COMMENT '当前日头为一，非当前版本为空',
+  valid_sku_count BIGINT NOT NULL DEFAULT 0 COMMENT '合格商品数',
+  unknown_sku_count BIGINT NOT NULL DEFAULT 0 COMMENT '待核验商品数',
+  created_at DATETIME(3) NOT NULL COMMENT '版本创建UTC时刻',
+  published_at DATETIME(3) NULL COMMENT '发布组提交UTC时刻',
+  superseded_at DATETIME(3) NULL COMMENT '被新组替代的UTC时刻',
+  invalidated_at DATETIME(3) NULL COMMENT '已确认输入失效的UTC时刻',
+  invalidation_reason VARCHAR(64) NULL COMMENT '旧版本失效原因',
+  rebuild_run_id BIGINT NULL COMMENT '处理失效版本的重建尝试',
+  PRIMARY KEY (id),
+  UNIQUE KEY uk_selfop_history_head (source_account,warehouse_code,business_date,head_slot),
+  UNIQUE KEY uk_selfop_history_build_day (build_run_id,business_date),
+  KEY idx_selfop_history_group (publication_group_id,status),
+  CONSTRAINT chk_selfop_history_head CHECK (head_slot IS NULL OR (head_slot=1 AND status='PUBLISHED'))
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_bin COMMENT='历史日库存不可变版本及原子发布日头';
+
+CREATE TABLE ll_selfop_inventory_daily (
+  day_version_id BIGINT NOT NULL COMMENT '所属历史日版本',
+  customer_code VARCHAR(64) NOT NULL COMMENT '来源货主编码',
+  sku_code VARCHAR(128) NOT NULL COMMENT '来源商品编码',
+  product_quality INT NOT NULL COMMENT '来源库存品质',
+  physical_quantity DECIMAL(20,6) NULL COMMENT '日末实物库存，未知为空，已确认零为零',
+  quality_status VARCHAR(16) NOT NULL COMMENT '日末资格，有效或未知',
+  quality_reason VARCHAR(64) NULL COMMENT '缺覆盖或锚点等未知原因',
+  anchor_reference BIGINT NULL COMMENT '独立库存锚点版本',
+  evidence_hash CHAR(64) NOT NULL COMMENT '该日计算证据摘要',
+  source VARCHAR(32) NOT NULL COMMENT '库存来源标记，流水还原',
+  PRIMARY KEY (day_version_id,customer_code,sku_code,product_quality),
+  KEY idx_selfop_daily_identity (customer_code,sku_code,day_version_id),
+  CONSTRAINT chk_selfop_daily_quantity CHECK ((quality_status='VALID' AND physical_quantity IS NOT NULL AND physical_quantity>=0) OR (quality_status='UNKNOWN' AND physical_quantity IS NULL))
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_bin COMMENT='历史日末分货主商品品质实物库存';
+
+-- 仓储转运一箱多SKU清点；仅增加结构，不回填历史业务数据。
+USE baiyue_lastleg;
+
+
+-- Appointment work scope, audit and physical batch allocation.
+USE baiyue_lastleg;
+CREATE TABLE ll_dispatch_appointment_allocation (
+  dispatch_id BIGINT NOT NULL COMMENT '排车单标识',
+  dispatch_item_id BIGINT NOT NULL COMMENT '排车明细标识',
+  plan_pallet_id BIGINT NOT NULL COMMENT '入仓计划托盘标识',
+  batch_key VARCHAR(96) NOT NULL COMMENT '预约稳定批次键',
+  customer_id VARCHAR(64) NOT NULL COMMENT '所属客户标识',
+  source_key VARCHAR(160) NOT NULL COMMENT '货物来源稳定键',
+  destination_key VARCHAR(160) NOT NULL COMMENT '目的地稳定键',
+  package_count INT NOT NULL COMMENT '本票分配实物箱数',
+  PRIMARY KEY(dispatch_item_id,batch_key,source_key,destination_key),
+  KEY idx_dispatch_appointment_batch(batch_key,customer_id),
+  KEY idx_dispatch_appointment_dispatch(dispatch_id)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci COMMENT='排车实物与预约批次逐票分配，原执行域事实';
+CREATE TABLE ll_appointment_work_commitment (
+  entity_key VARCHAR(160) NOT NULL COMMENT '原业务实体稳定键',
+  state_json LONGTEXT NOT NULL COMMENT '原业务命令产生的只读语义影响基线，不是第二份可编辑计划',
+  impact_version BIGINT NOT NULL DEFAULT 0 COMMENT '承诺影响单调递增版本',
+  PRIMARY KEY (entity_key)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci COMMENT='工作事项承诺影响审计基线';
+CREATE TABLE ll_appointment_work_guard (
+  id INT NOT NULL COMMENT '工作事项协调锁，固定1',
+  scan_cursor VARCHAR(128) NULL COMMENT '已开船来源同步游标',
+  initialized BOOLEAN NOT NULL DEFAULT FALSE COMMENT '是否完成首次完整来源扫描',
+  scope_version VARCHAR(128) NULL COMMENT '完整同步已确认的权威来源集合版本',
+  scan_scope_version VARCHAR(128) NULL COMMENT '当前扫描来源集合版本，防跨页漂移',
+  completed_at DATETIME(3) NULL COMMENT '最近完整同步UTC时间',
+  requirement_version BIGINT NOT NULL DEFAULT 0 COMMENT '原域命令在同一事务推进的需求版本',
+  synchronized_requirement_version BIGINT NOT NULL DEFAULT 0 COMMENT '完整扫描已消费需求版本',
+  scan_requirement_version BIGINT NOT NULL DEFAULT 0 COMMENT '当前扫描需求版本，防跨页漂移',
+  PRIMARY KEY (id)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci COMMENT='预约工作事项同步与命令串行守卫';
+INSERT INTO ll_appointment_work_guard (id,initialized) VALUES (1,FALSE);
+
+CREATE TABLE ll_appointment_work (
+  work_item_key VARCHAR(96) NOT NULL COMMENT '不可变事项键，业务身份确定性生成',
+  container_booking_id VARCHAR(64) NOT NULL COMMENT '来源柜次内部关联标识，不作展示编号',
+  version INT NOT NULL DEFAULT 0 COMMENT '工作命令乐观锁版本',
+  retired BOOLEAN NOT NULL DEFAULT FALSE COMMENT '已替代或已完成路线需求，不计活动工作',
+  state_json LONGTEXT NOT NULL COMMENT '工作关系责任跟进及影响基线，不保存可编辑业务执行事实',
+  PRIMARY KEY (work_item_key),
+  KEY idx_appointment_work_container (container_booking_id,retired)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci COMMENT='预约工作事项需求与关系';
+
+CREATE TABLE ll_appointment_work_history (
+  id VARCHAR(36) NOT NULL COMMENT '历史记录标识',
+  work_item_key VARCHAR(96) NOT NULL COMMENT '事项稳定键',
+  operator_id VARCHAR(64) NOT NULL COMMENT '真实操作人员标识',
+  operator_name VARCHAR(128) NULL COMMENT '操作人显示名称',
+  action VARCHAR(48) NOT NULL COMMENT '工作命令或观察动作',
+  summary VARCHAR(2000) NOT NULL COMMENT '处理或责任变更依据',
+  command_key VARCHAR(64) NULL COMMENT '请求幂等键，观察记录为空',
+  request_hash VARCHAR(64) NULL COMMENT '包含操作者的规范请求摘要',
+  response_json LONGTEXT NULL COMMENT '原命令响应快照，重放不随当前状态改变',
+  occurred_at DATETIME(3) NOT NULL COMMENT '历史发生UTC时间',
+  PRIMARY KEY (id),
+  UNIQUE KEY uk_appointment_work_command (work_item_key,command_key),
+  KEY idx_appointment_work_history (work_item_key,occurred_at)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci COMMENT='预约工作事项历史与幂等命令';
+
+-- 海外业务短单号分配时钟。
+CREATE TABLE ll_compact_number_clock (
+  number_key VARCHAR(16) NOT NULL COMMENT '业务前缀和客户名称缩写',
+  last_second BIGINT NOT NULL COMMENT '最后分配的Unix逻辑秒',
+  PRIMARY KEY (number_key)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci COMMENT='海外业务短单号分配时钟';
+
+SELECT 'PASS' AS initialization_status, 'OVERSEAS' AS region, 214 AS initialized_tables;
diff --git a/docs/backend-business-index.md b/docs/backend-business-index.md
index c28c57c98..fcd5cec42 100644
--- a/docs/backend-business-index.md
+++ b/docs/backend-business-index.md
@@ -56,3 +56,5 @@
 | PDF 标签、审计、跨区双向事件 | `print/`、`audit-service/`、`event-bridge-service/` | 事件模型先读 `common-event-contract/AGENTS.md`；国内真实生产验收 `firstleg/.../TaillegRealProducerAcceptanceTest.java`、海外真实消费验收 `lastleg-service/.../TaillegRealConsumerAcceptanceTest.java`；可靠投递与 CN/OVERSEAS 目标路由读 `event-bridge-service/AGENTS.md` |
 
 散货托盘码与跨区传递：`firstleg/` 的 `LoadingPalletLabelService.java` 生成冻结标签并调用 Print 输出 PDF，`LoadingCompletedOutboxService.java` 传递装柜快照；`lastleg-service/` 通过 `LastlegSourcePalletMapper.java` 保存来源托盘，`InboundPlanService.java` 和 `ContainerInboundPlanConversionCoordinator.java` 消费。标签与资源预留的细节继续读对应服务指引。
+
+平台自营销量、产品库存与采集：正式入口为 ../docs/自营业务/README.md；适配从 integration-service/AGENTS.md 进入，持久化、指标和平台运行查询从 lastleg-service/AGENTS.md 进入 selfoperated/analytics/，权限源为 iam/src/main/resources/db/selfoperated-analytics-permissions.sql。Admin 从 ../apps/admin-web/src/modules/self-operated/AGENTS.md 进入；与客户物流订单和仓储作业库存分开。
diff --git a/file/AGENTS.md b/file/AGENTS.md
index 33f23e85c..cdfc798e0 100644
--- a/file/AGENTS.md
+++ b/file/AGENTS.md
@@ -1,5 +1,10 @@
 # File Service 模块指引
 
+## 数据库访问与中文注释约束
+
+- 强制遵守根 `../AGENTS.md` 的“数据库访问与中文代码注释”全部规则：正常业务访问统一为 `Controller → Service → Repository → Mapper`，不得省略 Repository 或跨层直调；生产 SQL 由 Mapper 执行，Repository 不得直接使用 JdbcTemplate 或原生 JDBC。非 HTTP 入口从 Service 进入；无数据库模块不引入数据库访问。
+- 每个手写方法及构造器须有简短中文说明；核心业务规则、复杂 SQL、事务、锁、幂等、并发及失败处理须补充适量中文注释，重点说明原因和边界。新增、修改方法立即执行，触及的存量代码同步整改。
+
 ## 职责与边界
 
 - Mapper 只由 `FileServiceApplication.java` 对 `com.baiyue.file` 根包按 `@Mapper` 过滤扫描；新增或移动 Mapper 后从后端根运行 `node scripts/mapper-scan-contract.mjs`，不得增加子域扫描配置。
diff --git a/file/src/main/java/com/baiyue/file/service/BusinessFileCategory.java b/file/src/main/java/com/baiyue/file/service/BusinessFileCategory.java
index d88862760..52f3dc3ba 100644
--- a/file/src/main/java/com/baiyue/file/service/BusinessFileCategory.java
+++ b/file/src/main/java/com/baiyue/file/service/BusinessFileCategory.java
@@ -31,6 +31,7 @@ enum BusinessFileCategory {
     CONTAINER_DELIVERY_ORDER(false, FormatPolicy.STANDARD, Limits.STANDARD, BusinessIdPolicy.POSITIVE_LONG),
     CONTAINER_PICKUP_ORDER(false, FormatPolicy.STANDARD, Limits.STANDARD, BusinessIdPolicy.POSITIVE_LONG),
     OVERSEAS_UNLOAD_PHOTO(false, FormatPolicy.STANDARD, Limits.STANDARD, BusinessIdPolicy.POSITIVE_LONG),
+    OVERSEAS_CARGO_DISCARD_PHOTO(true, FormatPolicy.IMAGE, Limits.STANDARD, BusinessIdPolicy.POSITIVE_LONG),
     OVERSEAS_RELABEL_PHOTO(true, FormatPolicy.STANDARD, Limits.STANDARD, BusinessIdPolicy.POSITIVE_LONG),
     OVERSEAS_TRANSFER_MEASUREMENT_PHOTO(true, FormatPolicy.STANDARD, Limits.STANDARD, BusinessIdPolicy.POSITIVE_LONG),
     OVERSEAS_RELABEL_TOTAL_DOCUMENT(true, FormatPolicy.PDF, Limits.STANDARD, BusinessIdPolicy.POSITIVE_LONG),
diff --git a/file/src/main/java/com/baiyue/file/service/ExportTaskService.java b/file/src/main/java/com/baiyue/file/service/ExportTaskService.java
index 2bf1f64fb..dca2e30c0 100644
--- a/file/src/main/java/com/baiyue/file/service/ExportTaskService.java
+++ b/file/src/main/java/com/baiyue/file/service/ExportTaskService.java
@@ -21,9 +21,11 @@ import java.time.LocalDateTime;
 import java.util.Locale;
 import java.util.Map;
 import java.util.TreeMap;
+import java.util.Set;
 
 @Service
 public class ExportTaskService {
+    private static final String TURNOVER = "SELFOP_INVENTORY_TURNOVER";
     @Resource private ExportTaskRepository repository;
     @Resource private ExportStorage storage;
     @Resource private ObjectMapper objectMapper;
@@ -34,6 +36,7 @@ public class ExportTaskService {
     public ExportTaskResponse create(AuthenticatedUser user, CreateExportTaskRequest request) {
         requirePlatform(user);
         String type = request.exportType().trim().toUpperCase(Locale.ROOT);
+        if (TURNOVER.equals(type) && user.impersonated()) throw new BizException(ResultCode.FORBIDDEN, "平台自营导出不支持代登录");
         String format = request.format().trim().toUpperCase(Locale.ROOT);
         var definition = registry.require(type);
         if (!"XLSX".equals(format)) throw new BizException(ResultCode.VALIDATION_FAILED, "当前仅支持 XLSX 格式");
@@ -135,6 +138,9 @@ public class ExportTaskService {
     }
 
     private void requireExportCostAccess(AuthenticatedUser user, FileExportTask task) {
+        if (TURNOVER.equals(task.getExportType()) && (user.impersonated() || !user.permissions().contains("platform:self-operated-analytics:export"))) {
+            throw new BizException(ResultCode.FORBIDDEN, "缺少平台自营导出权限");
+        }
         if (!"TRIP_OPERATIONS_LIST".equals(task.getExportType())) return;
         try {
             if (objectMapper.readTree(task.getParametersJson()).path("costVisible").asBoolean(false)
@@ -172,11 +178,14 @@ public class ExportTaskService {
         }
         values.forEach((key, value) -> {
             if (key == null || key.isBlank() || key.length() > 64) throw new BizException(ResultCode.VALIDATION_FAILED, "导出筛选键无效");
-            validateParameterValue(value, 1);
+            if (TURNOVER.equals(type) && "snapshotContext".equals(key)) {
+                if (!(value instanceof String text) || text.isBlank() || text.length() > 16000)
+                    throw new BizException(ResultCode.VALIDATION_FAILED, "库存周转查询版本无效，请刷新后重新导出");
+            } else validateParameterValue(value, 1);
         });
         try {
             int maxBytes = ExportSchemaContracts.DOMESTIC_WAREHOUSE_ORDER_LIST.equals(type)
-                ? 512 * 1024 : 4096;
+                ? 512 * 1024 : TURNOVER.equals(type) ? 64 * 1024 : 4096;
             if (objectMapper.writeValueAsBytes(values).length > maxBytes) {
                 throw new BizException(ResultCode.VALIDATION_FAILED,
                     "导出筛选条件不能超过 " + (maxBytes / 1024) + "KB");
@@ -210,6 +219,22 @@ public class ExportTaskService {
     }
 
     private void validateTypeParameters(String type, Map<String, Object> parameters) {
+        if (TURNOVER.equals(type)) {
+            Map<String,Object> values=parameters==null?Map.of():parameters;
+            if (!values.keySet().containsAll(Set.of("sourceAccount","warehouseCode","endDate","baseWindowDays","snapshotContext","columns","expectedTotal"))
+                || !Set.of("sourceAccount","warehouseCode","endDate","baseWindowDays","groupBy","customerCodes","sku","focus","coverageDaysThreshold","turnoverStatus","sortBy","hideZeroInventory","snapshotContext","columns","expectedTotal").containsAll(values.keySet()))
+                throw new BizException(ResultCode.VALIDATION_FAILED, "库存周转导出筛选无效");
+            if (!(values.get("columns") instanceof java.util.List<?> columns) || columns.isEmpty() || columns.size()>30
+                || columns.stream().anyMatch(v -> !(v instanceof String)) || new java.util.HashSet<>(columns).size()!=columns.size())
+                throw new BizException(ResultCode.VALIDATION_FAILED, "库存周转导出列无效");
+            if (values.containsKey("customerCodes") && (!(values.get("customerCodes") instanceof java.util.List<?> owners) || owners.size()>100 || owners.stream().anyMatch(v -> !(v instanceof String))))
+                throw new BizException(ResultCode.VALIDATION_FAILED, "库存周转货主范围无效");
+            try {
+                long count=new java.math.BigDecimal(String.valueOf(values.get("expectedTotal"))).longValueExact();
+                if(count<0 || count>200000) throw new ArithmeticException();
+            } catch(RuntimeException e) { throw new BizException(ResultCode.VALIDATION_FAILED, "库存周转导出条数无效"); }
+            return;
+        }
         if (!ExportSchemaContracts.BUY_DECLARATION_ITEMS.equals(type)) return;
         Map<String, Object> values = parameters == null ? Map.of() : parameters;
         if (!values.keySet().equals(java.util.Set.of("loadingPlanId"))) {
diff --git a/file/src/main/resources/application.yml b/file/src/main/resources/application.yml
index 1dc24570c..001eb5dc2 100644
--- a/file/src/main/resources/application.yml
+++ b/file/src/main/resources/application.yml
@@ -224,6 +224,15 @@ baiyue:
           max-rows: 200000
           max-attempts: 3
           batch-size: 200
+        SELFOP_INVENTORY_TURNOVER:
+          provider-service: lastleg-service
+          provider-path: /internal/exports/v1/SELFOP_INVENTORY_TURNOVER/batches
+          required-permission: platform:self-operated-analytics:export
+          app-scope: PLATFORM
+          enabled: true
+          max-rows: 200000
+          max-attempts: 3
+          batch-size: 100
         OVERSEAS_INVENTORY_LEDGER:
           provider-service: lastleg-service
           provider-path: /internal/exports/v1/OVERSEAS_INVENTORY_LEDGER/batches
diff --git a/file/src/main/resources/openapi/cargo-discard-photo-v1.yaml b/file/src/main/resources/openapi/cargo-discard-photo-v1.yaml
new file mode 100644
index 000000000..f9c2f6779
--- /dev/null
+++ b/file/src/main/resources/openapi/cargo-discard-photo-v1.yaml
@@ -0,0 +1,12 @@
+openapi: 3.0.3
+info:
+  title: Cargo discard photo storage ownership contract
+  version: 1.0.0
+  description: >-
+    Uses the existing internal business-file upload, metadata and content endpoints, protected
+    by X-Internal-Service-Token. businessType is OVERSEAS_CARGO_DISCARD_PHOTO; tenantId is a
+    positive customer ID and businessId is the positive cargo discard application ID.
+    File enforces composite ownership and non-empty JPG/PNG bytes with image signature and
+    10 MiB limit. Lastleg owns the pallet binding, submitted visibility and immutable confirmation.
+    No anonymous or public file endpoint is introduced.
+paths: {}
diff --git a/file/src/main/resources/openapi/selfop-turnover-export-v1.yaml b/file/src/main/resources/openapi/selfop-turnover-export-v1.yaml
new file mode 100644
index 000000000..b43137b17
--- /dev/null
+++ b/file/src/main/resources/openapi/selfop-turnover-export-v1.yaml
@@ -0,0 +1,50 @@
+openapi: 3.0.3
+info:
+  title: 库存周转后台导出
+  version: 1.0.0
+  description: File 下载中心生成 XLSX，Lastleg 内部 Provider 按固定库存周转版本供数。浏览器不分页取数、不生成文件。
+paths:
+  /api/platform/v1/files/export-tasks:
+    post:
+      summary: 提交库存周转 Excel 导出
+      description: |
+        仅平台、非代登录身份及 platform:self-operated-analytics:export 权限。
+        保留列表的 sourceAccount、warehouseCode、endDate、baseWindowDays、groupBy、customerCodes、sku、focus、coverageDaysThreshold、turnoverStatus、sortBy、hideZeroInventory、snapshotContext。
+        columns 为当前显示列的有序白名单键，服务端决定列名、格式并追加周转率证据列；expectedTotal 为已查询总条数，范围0至200000。
+        不接受 current/size/includeOverview。snapshotContext 最长16000字符，整组参数最大64KiB。空结果生成只有表头的文件。
+        后台每批最多100条，沿用固定上下文30分钟有效期；过期、服务重启或历史版本失效须刷新列表重新提交，不自动改用新版本。
+        版本或条数变化、分页缺失、超行数、生成失败时不提供部分文件。下载中心复用进度、临时失败退避重试、归属校验及过期规则。
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required: [exportType, format, taskName, parameters]
+              properties:
+                exportType: {type: string, enum: [SELFOP_INVENTORY_TURNOVER]}
+                format: {type: string, enum: [XLSX]}
+                taskName: {type: string, maxLength: 128}
+                parameters:
+                  type: object
+                  required: [sourceAccount, warehouseCode, endDate, baseWindowDays, snapshotContext, columns, expectedTotal]
+                  properties:
+                    snapshotContext: {type: string, minLength: 1, maxLength: 16000}
+                    columns: {type: array, minItems: 1, maxItems: 30, uniqueItems: true, items: {type: string}}
+                    expectedTotal: {type: integer, minimum: 0, maximum: 200000}
+                  additionalProperties: true
+      responses:
+        '200': {description: ApiResponse 包装下载中心任务；业务错误遵循通用 code 契约}
+        '403': {description: 无平台自营导出权限或非平台身份}
+  /api/platform/v1/files/export-tasks/{taskId}/download:
+    get:
+      summary: 下载后台生成的库存周转 Excel
+      description: 校验任务归属、完成状态、有效期，以及当前非代登录身份和平台自营导出权限。
+      parameters:
+        - {name: taskId, in: path, required: true, schema: {type: string}}
+      responses:
+        '200':
+          description: XLSX 文件
+          content:
+            application/vnd.openxmlformats-officedocument.spreadsheetml.sheet:
+              schema: {type: string, format: binary}
diff --git a/file/src/test/java/com/baiyue/file/config/LastlegExportDefinitionContractTest.java b/file/src/test/java/com/baiyue/file/config/LastlegExportDefinitionContractTest.java
index 15c4872e9..8485da15c 100644
--- a/file/src/test/java/com/baiyue/file/config/LastlegExportDefinitionContractTest.java
+++ b/file/src/test/java/com/baiyue/file/config/LastlegExportDefinitionContractTest.java
@@ -13,6 +13,7 @@ class LastlegExportDefinitionContractTest {
         Map<?, ?> nacos = definitions(Path.of("../config/nacos/test/file-service.yml"));
         Map<String, String> expected = Map.ofEntries(
             Map.entry("LAST_MILE_ORDER_LIST", "platform:overseas-warehouse:last-mile-order:export"),
+            Map.entry("SELFOP_INVENTORY_TURNOVER", "platform:self-operated-analytics:export"),
             Map.entry("OVERSEAS_INVENTORY_BALANCE", "platform:overseas-warehouse:inventory:export"),
             Map.entry("OVERSEAS_INVENTORY_LEDGER", "platform:overseas-warehouse:inventory:export"),
             Map.entry("OVERSEAS_QUOTE_LIST", "platform:overseas-master-data:quote:export"),
@@ -28,7 +29,7 @@ class LastlegExportDefinitionContractTest {
             assertEquals("/internal/exports/v1/" + entry.getKey() + "/batches", definition.get("provider-path"));
             assertEquals(entry.getValue(), definition.get("required-permission"));
             assertEquals("PLATFORM", definition.get("app-scope"));
-            assertEquals(200, definition.get("batch-size"));
+            assertEquals(entry.getKey().equals("SELFOP_INVENTORY_TURNOVER") ? 100 : 200, definition.get("batch-size"));
             var controlled = new ExportDefinitionRegistry.Definition();
             controlled.setProviderService("lastleg-service");
             controlled.setProviderPath(String.valueOf(definition.get("provider-path")));
diff --git a/file/src/test/java/com/baiyue/file/service/CargoDiscardPhotoStorageTest.java b/file/src/test/java/com/baiyue/file/service/CargoDiscardPhotoStorageTest.java
new file mode 100644
index 000000000..91c0ebf0f
--- /dev/null
+++ b/file/src/test/java/com/baiyue/file/service/CargoDiscardPhotoStorageTest.java
@@ -0,0 +1,25 @@
+package com.baiyue.file.service;
+
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+import org.springframework.mock.web.MockMultipartFile;
+import org.springframework.test.util.ReflectionTestUtils;
+import java.nio.file.Path;
+import static org.assertj.core.api.Assertions.*;
+
+class CargoDiscardPhotoStorageTest {
+    @TempDir Path root;
+    @Test void discardEvidenceIsCustomerOwnedAndRequiresRealImageSignature() throws Exception {
+        var category = BusinessFileCategory.require("OVERSEAS_CARGO_DISCARD_PHOTO");
+        category.validateOwner(7);
+        assertThatThrownBy(() -> category.validateOwner(0)).isInstanceOf(com.baiyue.common.core.exception.BizException.class);
+        assertThatThrownBy(() -> category.storageBusinessId("0")).isInstanceOf(com.baiyue.common.core.exception.BizException.class);
+        var storage = new BusinessFileStorage(); ReflectionTestUtils.setField(storage, "configuredRoot", root); storage.initializeRoot();
+        byte[] bytes = {(byte)0x89, 0x50, 0x4e, 0x47, 13, 10, 26, 10};
+        var result = storage.store(7, "11", new MockMultipartFile("file", "discard.png", "image/png", bytes), category);
+        assertThat(storage.read(result.objectKey())).isEqualTo(bytes);
+        assertThatThrownBy(() -> storage.store(7, "11", new MockMultipartFile("file", "fake.png", "image/png", "fake".getBytes()), category)).hasMessageContaining("不是有效图片");
+        assertThatThrownBy(() -> storage.store(7, "11", new MockMultipartFile("file", "doc.pdf", "application/pdf", "%PDF-test".getBytes()), category)).hasMessageContaining("仅支持JPG");
+        assertThatThrownBy(() -> storage.store(7, "11", new MockMultipartFile("file", "large.png", "image/png", new byte[10*1024*1024+1]), category)).isInstanceOf(com.baiyue.common.core.exception.BizException.class);
+    }
+}
diff --git a/file/src/test/java/com/baiyue/file/service/ExportTaskServiceTest.java b/file/src/test/java/com/baiyue/file/service/ExportTaskServiceTest.java
index de2d60427..c35fb8dc5 100644
--- a/file/src/test/java/com/baiyue/file/service/ExportTaskServiceTest.java
+++ b/file/src/test/java/com/baiyue/file/service/ExportTaskServiceTest.java
@@ -39,6 +39,23 @@ class ExportTaskServiceTest {
     @MockBean private ExportStateService states;
     @MockBean private ExportMetrics metrics;
     @Resource private ExportTaskService service;
+    @Test void turnoverKeepsBoundedSignedContextAndRequiresIndependentExportPermission() {
+        var definition=definition();definition.setRequiredPermission("platform:self-operated-analytics:export");
+        when(registry.require("SELFOP_INVENTORY_TURNOVER")).thenReturn(definition);
+        when(states.createConstrained(any(FileExportTask.class))).thenAnswer(c->new ExportStateService.CreationResult(c.getArgument(0),true));
+        Map<String,Object> parameters=new LinkedHashMap<>();
+        parameters.put("sourceAccount","demo");parameters.put("warehouseCode","W");parameters.put("endDate","2026-10-14");parameters.put("baseWindowDays",30);
+        parameters.put("snapshotContext","x".repeat(15000));parameters.put("columns",List.of("sku","quantityTurnoverRate"));parameters.put("expectedTotal",205);
+        var request=new CreateExportTaskRequest("SELFOP_INVENTORY_TURNOVER","XLSX","库存周转",parameters);
+        assertThrows(BizException.class,()->service.create(user(1L,Set.of("platform:self-operated-analytics:list")),request));
+        assertEquals("PENDING",service.create(user(1L,Set.of("platform:self-operated-analytics:export")),request).status());
+        parameters.put("snapshotContext","x".repeat(16001));
+        assertThrows(BizException.class,()->service.create(user(1L,Set.of("platform:self-operated-analytics:export")),request));
+        parameters.put("snapshotContext","fixed");parameters.put("current",2);
+        assertThrows(BizException.class,()->service.create(user(1L,Set.of("platform:self-operated-analytics:export")),request));
+        parameters.remove("current");parameters.remove("columns");
+        assertThrows(BizException.class,()->service.create(user(1L,Set.of("platform:self-operated-analytics:export")),request));
+    }
     @Test
     void createsPersistedTaskOnlyWhenSourceExportPermissionIsPresent() {
         when(registry.require("CUSTOMER_LIST")).thenReturn(definition());
@@ -94,6 +111,15 @@ class ExportTaskServiceTest {
         assertEquals("9", service.get(user(1L, Set.of("platform:download:all")), 9L).id());
     }
 
+    @Test void turnoverDownloadAndRetryRecheckExportPermissionEvenWithDownloadAll() {
+        var task=new FileExportTask();task.setId(9L);task.setTenantId(0L);task.setAppCode("PLATFORM");task.setRequestedBy(2L);
+        task.setExportType("SELFOP_INVENTORY_TURNOVER");task.setStatus("SUCCEEDED");when(repository.find(9L)).thenReturn(task);
+        var reader=user(1L,Set.of("platform:download:all","platform:self-operated-analytics:list"));
+        assertEquals(ResultCode.FORBIDDEN,assertThrows(BizException.class,()->service.download(reader,9L)).getResultCode());
+        assertEquals(ResultCode.FORBIDDEN,assertThrows(BizException.class,()->service.retry(reader,9L)).getResultCode());
+        verifyNoInteractions(storage);
+    }
+
     @Test
     void rejectsParametersDeeperThanTwoLevels() {
         when(registry.require("CUSTOMER_LIST")).thenReturn(definition());
diff --git a/file/src/test/java/com/baiyue/file/service/GenericXlsxExportRunnerTest.java b/file/src/test/java/com/baiyue/file/service/GenericXlsxExportRunnerTest.java
index 50efcf033..815b76abe 100644
--- a/file/src/test/java/com/baiyue/file/service/GenericXlsxExportRunnerTest.java
+++ b/file/src/test/java/com/baiyue/file/service/GenericXlsxExportRunnerTest.java
@@ -66,6 +66,24 @@ class GenericXlsxExportRunnerTest {
         assertNull(requests.getAllValues().get(0).snapshotToken());assertEquals("snapshot-9",requests.getAllValues().get(1).snapshotToken());
     }
 
+    @Test void turnoverWorkbookPreservesColumnOrderPercentUnknownAndLiteralSku() throws Exception {
+        var columns=List.of(new ExportColumn("quantityTurnoverRate","期间周转率",ExportColumnType.STRING,24),
+            new ExportColumn("sku","SKU",ExportColumnType.STRING,24),new ExportColumn("historyDays","合格历史库存天数",ExportColumnType.STRING,24));
+        var batch=new ExportBatchResponse(1,"sha256:turnover","fixed",columns,List.of(
+            Map.of("quantityTurnoverRate","125%","sku","=SUM(1,2)","historyDays","30/30"),
+            Map.of("quantityTurnoverRate","—","sku","未知商品","historyDays","29/30"),
+            Map.of("quantityTurnoverRate","0%","sku","零销量","historyDays","30/30")),"3",false,3L);
+        when(provider.batch(anyString(),eq("SELFOP_INVENTORY_TURNOVER"),any(),any())).thenReturn(ApiResponse.success(batch));
+        var task=new FileExportTask();task.setId(18L);task.setTenantId(0L);task.setAppCode("PLATFORM");task.setRequestedBy(7L);task.setDispatchVersion(1);
+        task.setExportType("SELFOP_INVENTORY_TURNOVER");task.setTaskName("库存周转");task.setParametersJson("{\"snapshotContext\":\"fixed\"}");
+        var definition=new ExportDefinitionRegistry.Definition();definition.setMaxRows(200000);definition.setBatchSize(100);
+        var result=runner.run(task,definition,new AtomicBoolean(),ignored->{});
+        try(var workbook=new XSSFWorkbook(storage.load(result.objectKey()).getInputStream())) {
+            var sheet=workbook.getSheetAt(0);assertEquals("期间周转率",sheet.getRow(0).getCell(0).getStringCellValue());
+            assertEquals("125%",sheet.getRow(1).getCell(0).getStringCellValue());assertEquals("'=SUM(1,2)",sheet.getRow(1).getCell(1).getStringCellValue());
+            assertEquals("—",sheet.getRow(2).getCell(0).getStringCellValue());assertEquals("0%",sheet.getRow(3).getCell(0).getStringCellValue());assertEquals(3,result.rows());
+        }
+    }
     @Test void deletesTheCompletedFileWhenReadingItsFinalSizeFails() throws Exception {
         var batch=new ExportBatchResponse(1,"sha256:test","snapshot-9",
                 List.of(new ExportColumn("text","文本",ExportColumnType.STRING,18)),
diff --git a/finance/AGENTS.md b/finance/AGENTS.md
index c59e2fdb1..8f055025b 100644
--- a/finance/AGENTS.md
+++ b/finance/AGENTS.md
@@ -1,5 +1,10 @@
 # Finance Service Instructions
 
+## 数据库访问与中文注释约束
+
+- 强制遵守根 `../AGENTS.md` 的“数据库访问与中文代码注释”全部规则：正常业务访问统一为 `Controller → Service → Repository → Mapper`，不得省略 Repository 或跨层直调；生产 SQL 由 Mapper 执行，Repository 不得直接使用 JdbcTemplate 或原生 JDBC。非 HTTP 入口从 Service 进入；无数据库模块不引入数据库访问。
+- 每个手写方法及构造器须有简短中文说明；核心业务规则、复杂 SQL、事务、锁、幂等、并发及失败处理须补充适量中文注释，重点说明原因和边界。新增、修改方法立即执行，触及的存量代码同步整改。
+
 ## 模块定位
 
 - 本模块是独立财务服务，拥有客户结算条款、财务费用来源、CNY 账单与明细、客户资金账户及充值申请、应收款月度统计、客户对账确认、收款及分配、成本及分摊、账单修订、单据编号、幂等记录和财务审计状态。
diff --git a/firstleg/AGENTS.md b/firstleg/AGENTS.md
index 2d60e5d5e..fdbf7eb7c 100644
--- a/firstleg/AGENTS.md
+++ b/firstleg/AGENTS.md
@@ -1,5 +1,10 @@
 # Firstleg Service 模块指引
 
+## 数据库访问与中文注释约束
+
+- 强制遵守根 `../AGENTS.md` 的“数据库访问与中文代码注释”全部规则：正常业务访问统一为 `Controller → Service → Repository → Mapper`，不得省略 Repository 或跨层直调；生产 SQL 由 Mapper 执行，Repository 不得直接使用 JdbcTemplate 或原生 JDBC。非 HTTP 入口从 Service 进入；无数据库模块不引入数据库访问。
+- 每个手写方法及构造器须有简短中文说明；核心业务规则、复杂 SQL、事务、锁、幂等、并发及失败处理须补充适量中文注释，重点说明原因和边界。新增、修改方法立即执行，触及的存量代码同步整改。
+
 ## 职责与边界
 
 - Mapper 统一显式使用 `@Mapper`，仅由 `BaiyueFirstlegApplication.java` 对 `com.baiyue.firstleg` 根包按 `annotationClass = Mapper.class` 扫描；禁止恢复业务子域 Mapper 包白名单。静态门禁见根 `scripts/mapper-scan-contract.mjs`，模块内编译门禁见 `MapperRegistrationArchitectureTest.java`、`BaiyueFirstlegApplicationContractTest.java`。
@@ -54,7 +59,9 @@
 | 海外派送完成回写 | 同一内部事件入口、消费者 `service/OverseasDeliveryCompletedConsumer.java`；按来源入仓单、订单、入仓码和 FBA 仓校验后推进当前入仓单 `LOADED→DELIVERED`，同一 Order 全部有效入仓单完成后才经 `OrderFulfillmentCompletionClient` 推进 Order `COMPLETED` |
 | 国内货柜履约海运订舱、资料/打印、关联候选与出仓前船期资料 | `oceanbooking/controller/PlatformOceanBookingController.java`、`oceanbooking/service/OceanBookingService.java`、`OceanBookingDocumentService.java`、`OceanBookingPrintService.java`、`oceanbooking/mapper/OceanBookingMapper.java`、`portschedule/controller/PlatformPortScheduleController.java`；文件经 `client/OceanBookingFileClient.java` 进入 File，关联候选 `/api/platform/v1/ocean-bookings/link-candidates`，契约 `src/main/resources/openapi/ocean-bookings-v1.yaml`，表结构见 `src/main/resources/db/phase3-ocean-booking-schema.sql` |
 | 海外仓业务国内出仓后船节点定时查询 | `outbound/dispatch/service/OutboundDispatchService.java` 在确认出仓事务内幂等创建现有 `CarrierScheduleQuery`；编排与租约 `portschedule/service/CarrierScheduleQueryScheduler.java`，任务/十节点事实/异常事实/不可变 attempt `CarrierScheduleQueryService.java`，平台查询与人工补录入口 `PlatformCarrierScheduleQueryController.java` 的 `/{queryId}/manual-nodes`；停止只由实际 `EMPTY_RETURNED` 节点触发，不提供无节点停止入口；外部船司/轨迹调用经 `integration-service/`；标准见 `../../docs/海外仓业务/船节点标准化契约.md` |
-| 目的港码头拖车与还空预警 | `terminaldrayage/controller/PlatformTerminalDrayageController.java`、`service/TerminalDrayageService.java`、`mapper/TerminalDrayageMapper.java`；货柜实际到港后引用 Warehouse `ACTIVE/TRUCKING/OVERSEAS` 海外车队供应商，依次选择车队、预约提柜、确认实际提柜，海外卸柜收货完成后确认还柜；服务端按卸柜完成时间加 72 小时返回报空预警，实际提柜和还柜通过现有 `CarrierScheduleQueryService` 推进 `PICKED_UP/EMPTY_RETURNED`，不复制船节点或车队主档。契约 `src/main/resources/openapi/terminal-drayage-v1.yaml`，基线 `src/main/resources/db/phase3-terminal-drayage-schema.sql` 邮件由 `terminaldrayage/service/TerminalDrayageMailService.java` 入队，`TerminalDrayageMailDispatcher.java` 顺序投递，模板与 SMTP 配置见 `docs/terminal-drayage-mail.md`；首次选队不发信，换队事务内生成取消与请求两封邮件。 |
+| 已开船预约事项完整来源 | `portschedule/controller/InternalAppointmentWorkSourceController.java`、`service/AppointmentWorkSourceService.java`、`mapper/AppointmentWorkSourceMapper.java`；按完整来源版本游标提供所有实际开船或后续节点的有效货柜，保留无仓绑定与完成货柜；原始当地时间无时区时不得转UTC；契约 `src/main/resources/openapi/appointment-work-source-v1.yaml` |
+| 直送目的仓实际卸货 | `terminaldrayage/controller/PlatformDirectDeliveryController.java`、`service/DirectDeliveryService.java`、`UnloadingEvidenceGuard.java`；按实装入仓来源逐票记录签收人与凭据，必须经 Lastleg 确认 DIRECT 路线且已提柜；不创建海外库存，全柜卸毕才可人工还空；契约 `src/main/resources/openapi/direct-delivery-v1.yaml`，基线 `src/main/resources/db/phase3-direct-delivery-schema.sql` |
+| 目的港码头拖车与还空预警 | `terminaldrayage/controller/PlatformTerminalDrayageController.java`、`service/TerminalDrayageService.java`、`mapper/TerminalDrayageMapper.java`；货柜实际到港后引用 Warehouse `ACTIVE/TRUCKING/OVERSEAS` 海外车队供应商，依次选择车队、预约提柜、确认实际提柜，海外仓卸柜或全部直送目的仓实际卸货完成后确认还柜；服务端按卸柜完成时间加 72 小时返回报空预警，实际提柜和还柜通过现有 `CarrierScheduleQueryService` 推进 `PICKED_UP/EMPTY_RETURNED`，不复制船节点或车队主档。契约 `src/main/resources/openapi/terminal-drayage-v1.yaml`，基线 `src/main/resources/db/phase3-terminal-drayage-schema.sql` 邮件由 `terminaldrayage/service/TerminalDrayageMailService.java` 入队，`TerminalDrayageMailDispatcher.java` 顺序投递，模板与 SMTP 配置见 `docs/terminal-drayage-mail.md`；首次选队不发信，换队事务内生成取消与请求两封邮件。 |
 | 船节点交接事件 | `portschedule/service/CarrierScheduleNodeOutboxService.java`；实际节点落库后按 `containerBookingId` 柜级发布 `FIRST_LEG_CONTAINER_SHIPPING_NODE_RECORDED` V1，信封固定使用 `tenantId=0` 平台技术范围且 Payload 不携带客户，复用 `LoadingCompletedOutboxRepository`/Relay 直投 Lastleg `/internal/lastleg/events`；消费见 `../lastleg-service/src/main/java/com/baiyue/lastleg/shipping/service/ContainerShippingNodeConsumer.java`，ACK/重试按 `../../docs/统一认证与服务通信契约.md` |
 | Firstleg 业务单据编号 | `service/FirstlegDocumentNumberGenerator.java`；当前支持 `OB`、`TA`、`CB`、`CAB`、`LP` 前缀，按北京时间每日独立编号；具体业务归属以各调用服务为准 |
 | 订舱级拖车与整柜出仓调度 | `controller/PlatformTruckAppointmentController.java` 的 `/candidates`、`service/TruckAppointmentService.java`、`repository/TruckAppointmentRepository.java`、`outbound/dispatch/controller/PlatformOutboundDispatchController.java`；拖车契约 `src/main/resources/openapi/truck-appointments-v1.yaml`。预约只绑定 `RELEASED` 订舱，候选排除缺提单/有效订舱文件或已有非终态预约的订舱；API 不含客户、柜次、装柜计划或真实柜号，每订舱最多一张有效预约，已有完成单不得重建收费；PDA 完成不推进拖车状态，全部要求货柜确认国内离仓后由 `TruckAppointmentCompletionService` 自动完成并经 `TruckAppointmentFeeService` 发布应付 |
diff --git a/firstleg/docs/firstleg-internal-modularization-baseline.md b/firstleg/docs/firstleg-internal-modularization-baseline.md
index df1b0fc9e..c0bd8fc5a 100644
--- a/firstleg/docs/firstleg-internal-modularization-baseline.md
+++ b/firstleg/docs/firstleg-internal-modularization-baseline.md
@@ -248,3 +248,10 @@ PriceBookQueryMapper -> PriceBookQueryReader + PriceBookQueryRows
 - 回滚仅恢复原三文件及消费者类型引用；不涉及 URI、权限、JSON、SQL、表结构、业务状态或环境配置。
 - 只读模型仍保留原 Lombok 可变 Bean 形态以维持 MyBatis 映射行为；本轮不顺带改造成不可变领域对象。
 - 验证结果：七段 `@Select` SQL 文本逐块完全一致；Node 合同 5/5；`test-compile` 成功；价格簿、ArchUnit、根扫描及三个消费者切片定向测试 78/78；Firstleg 聚合全量 878 个测试，0 失败、0 错误、3 跳过，构建成功。
+
+
+## 预约工作集成时的精确边界核对
+
+`PlatformContainerShippingNodeController` 归船节点切片，`sailingcalendar` 归订舱船期切片；不再误归共享技术层。既有海外事件适配、实装费用重算和渠道目录读取在 `reviewedClassDependencies` 按具体调用者、目标类型和理由登记，不放开整个切片。
+
+现存全局 service 包同时承载暂扣、装柜费用和订舱文档编排，形成 loading.bridge.service、loading.service、oceanbooking.service、service 四包 SCC。它是尚未拆分的既有包级债务，本轮未宣称消除；`reviewedPackageCycles` 只冻结这一精确集合，新增节点或第二个环仍失败，价格簿查询与客户统计仍必须处于所有环之外。合同有新增消费者与新增环的负向测试。预约新增提供端通过原域适配接口消费事实，不增加该包环。
diff --git a/firstleg/scripts/analyze-firstleg-dependencies.mjs b/firstleg/scripts/analyze-firstleg-dependencies.mjs
index cdcc88bd8..263522193 100644
--- a/firstleg/scripts/analyze-firstleg-dependencies.mjs
+++ b/firstleg/scripts/analyze-firstleg-dependencies.mjs
@@ -3,6 +3,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import process from 'node:process';
+import { pathToFileURL } from 'node:url';
 
 const moduleRoot = path.resolve(import.meta.dirname, '..');
 const sourceRoots = {
@@ -15,8 +16,8 @@ const sliceRules = [
   ['customer-statistics', /(?:^|\.)(?:customerstatistics)(?:\.|$)/],
   ['pricebook-query', /(?:^|\.)(?:pricebookquery)(?:\.|$)/],
   ['finance-integration', /(?:InternalFinance|FinanceFeeSource|FinanceCostSnapshot|FeePaymentVoucher|FeePaymentSnapshot|ContainerFeeSourceSnapshot)/],
-  ['shipping-nodes', /(?:CarrierScheduleQuery|CarrierScheduleNode|CarrierScheduleAdapter|CarrierScheduleAttempt|CarrierScheduleException)/],
-  ['booking-customs-trucking', /(?:^|\.)(?:oceanbooking|customs|terminaldrayage)(?:\.|$)|(?:TruckAppointment|WarehouseSupplier|PortSchedule|DispatchGate)/],
+  ['shipping-nodes', /(?:CarrierScheduleQuery|CarrierScheduleNode|CarrierScheduleAdapter|CarrierScheduleAttempt|CarrierScheduleException|ContainerShippingNode)/],
+  ['booking-customs-trucking', /(?:^|\.)(?:oceanbooking|customs|terminaldrayage|sailingcalendar)(?:\.|$)|(?:TruckAppointment|WarehouseSupplier|PortSchedule|DispatchGate)/],
   ['outbound', /(?:^|\.)outbound(?:\.|$)|(?:OutboundDispatch|ContainerTransport|OverseasContainerEvent)/],
   ['split-loading', /(?:^|\.)(?:split|loading)(?:\.|$)|(?:Loading|SmartLoading|Container(?:Booking|Overview|Service|Dtos)|PdaPick)/],
   ['measurement-pricing', /(?:^|\.)pricing(?:\.|$)|(?:Measurement|MeasureReview|Mojia|Pricing|PriceBook|PriceChannel|PriceOrigin|PriceWarehouse|Fba|Dimension|FeeItem|MerchantInboundBilling|InboundFee)/],
@@ -261,14 +262,28 @@ function renderDot(report) {
   return lines.join('\n');
 }
 
-function checkContract(report, contractPath) {
-  const absolute = path.resolve(process.cwd(), contractPath);
-  const contract = JSON.parse(fs.readFileSync(absolute, 'utf8'));
+export function contractViolations(report, contract) {
   const allowed = new Set(contract.allowedSliceEdges ?? []);
-  const actual = report.sliceEdges.map(edge => `${edge.source}->${edge.target}`);
-  const additions = actual.filter(edge => !allowed.has(edge));
-  const violations = additions.map(edge => `new slice dependency: ${edge}`);
+  const violations = [];
+  const cycles=new Set((contract.reviewedPackageCycles ?? []).filter(c=>c.reason?.trim()
+    && c.packages?.length>1 && c.packages.every(p=>!p.includes('*'))).map(c=>[...c.packages].sort().join('|')));
+  for (const cycle of report.packageSccs ?? []) {
+    if (!cycles.has([...cycle].sort().join('|'))) violations.push(`unreviewed package cycle: ${cycle.join(' -> ')}`);
+  }
+  const reviewed = new Set();
+  for (const edge of contract.reviewedClassDependencies ?? []) {
+    if (!edge.source || !edge.target || !edge.reason?.trim() || /[*]/.test(edge.source + edge.target)) {
+      violations.push('reviewed dependency requires exact classes and a rationale');
+      continue;
+    }
+    reviewed.add(`${edge.source}->${edge.target}`);
+  }
   const classesByName = new Map(report.classes.map(entry => [entry.fqcn, entry]));
+  for (const edge of report.classDependencies) {
+    const from=classesByName.get(edge.source)?.slice, to=classesByName.get(edge.target)?.slice;
+    if (from && to && from!==to && !allowed.has(`${from}->${to}`) && !reviewed.has(`${edge.source}->${edge.target}`))
+      violations.push(`unreviewed slice dependency: ${from}->${to}: ${edge.source}->${edge.target}`);
+  }
   for (const [fqcn, expectedFile] of Object.entries(contract.requiredClassLocations ?? {})) {
     const actualClass = classesByName.get(fqcn);
     if (!actualClass) violations.push(`required class missing: ${fqcn}`);
@@ -312,12 +327,19 @@ function checkContract(report, contractPath) {
       violations.push(`${slice} incoming dependencies changed: ${incoming.join(', ')}`);
     }
   }
+  return violations;
+}
+
+function checkContract(report, contractPath) {
+  const contract=JSON.parse(fs.readFileSync(path.resolve(process.cwd(),contractPath),'utf8'));
+  const violations=contractViolations(report,contract);
   if (violations.length > 0) {
     process.stderr.write(`Firstleg dependency contract violations in ${contractPath}:\n${violations.map(item => `- ${item}`).join('\n')}\n`);
     process.exitCode = 1;
   }
 }
 
+if (process.argv[1] && import.meta.url === pathToFileURL(path.resolve(process.argv[1])).href) {
 const options = parseArgs(process.argv.slice(2));
 const report = buildReport(options.sourceSet);
 if (options.check) checkContract(report, options.check);
@@ -328,3 +350,5 @@ const rendered = options.format === 'json'
     : renderDot(report);
 if (options.output) fs.writeFileSync(path.resolve(process.cwd(), options.output), rendered, 'utf8');
 else process.stdout.write(rendered);
+
+}
diff --git a/firstleg/scripts/analyze-firstleg-dependencies.test.mjs b/firstleg/scripts/analyze-firstleg-dependencies.test.mjs
index 101c2f807..d0bc18efd 100644
--- a/firstleg/scripts/analyze-firstleg-dependencies.test.mjs
+++ b/firstleg/scripts/analyze-firstleg-dependencies.test.mjs
@@ -1,5 +1,7 @@
 import assert from 'node:assert/strict';
 import { execFileSync } from 'node:child_process';
+import { readFileSync } from 'node:fs';
+import { contractViolations } from './analyze-firstleg-dependencies.mjs';
 import path from 'node:path';
 import test from 'node:test';
 
@@ -7,6 +9,17 @@ const moduleRoot = path.resolve(import.meta.dirname, '..');
 const analyzer = path.join(moduleRoot, 'scripts', 'analyze-firstleg-dependencies.mjs');
 const contract = path.join(moduleRoot, 'src', 'test', 'resources', 'architecture', 'firstleg-slice-dependencies.json');
 
+test('reviewed original-domain calls do not open an entire slice or allow wildcard grants', () => {
+  const report=analyze(); const baseline=JSON.parse(readFileSync(contract,'utf8'));
+  assert.deepEqual(contractViolations(report,baseline),[]);
+  report.classDependencies.push({source:'com.baiyue.firstleg.service.SmartLoadingService',target:'com.baiyue.firstleg.domain.PriceBookChannelCatalog'});
+  assert.ok(contractViolations(report,baseline).some(message=>message.includes('SmartLoadingService->com.baiyue.firstleg.domain.PriceBookChannelCatalog')));
+  baseline.reviewedClassDependencies.push({source:'com.baiyue.firstleg.*',target:'com.baiyue.firstleg.service.FbaPricingService',reason:'invalid wildcard'});
+  assert.ok(contractViolations(report,baseline).some(message=>message.includes('exact classes')));
+  report.packageSccs.push(['com.baiyue.firstleg.service','com.baiyue.firstleg.pricebookquery.application']);
+  assert.ok(contractViolations(report,baseline).some(message=>message.includes('unreviewed package cycle')));
+});
+
 function analyze() {
   return JSON.parse(execFileSync(process.execPath, [analyzer, '--source-set', 'main', '--format', 'json'], {
     cwd: moduleRoot,
@@ -53,7 +66,7 @@ test('customer statistics application layer only depends inward', () => {
   assert.deepEqual(outwardDependencies, []);
 });
 
-test('price book query is a leaf slice and removes the package cycle', () => {
+test('price book query remains a leaf slice outside reviewed pre-existing package cycles', () => {
   const report = analyze();
   const classes = report.classes.filter(entry => entry.slice === 'pricebook-query');
   assert.deepEqual(classes.map(entry => entry.fqcn).sort(), [
@@ -67,7 +80,9 @@ test('price book query is a leaf slice and removes the package cycle', () => {
   assert.deepEqual(report.sliceEdges.filter(edge => edge.target === 'pricebook-query')
     .map(edge => edge.source).sort(), ['booking-customs-trucking', 'measurement-pricing', 'split-loading']);
   assert.equal(report.sliceSccs.some(component => component.includes('pricebook-query')), false);
-  assert.deepEqual(report.packageSccs, []);
+  assert.equal(report.packageSccs.some(cycle=>cycle.some(pkg=>pkg.startsWith('com.baiyue.firstleg.pricebookquery'))),false);
+  const reviewed=JSON.parse(readFileSync(contract,'utf8')).reviewedPackageCycles.map(c=>c.packages);
+  assert.deepEqual(report.packageSccs,reviewed);
 });
 
 test('price book query application and consumers respect ports', () => {
diff --git a/firstleg/src/main/java/com/baiyue/firstleg/client/AppointmentWorkRouteClient.java b/firstleg/src/main/java/com/baiyue/firstleg/client/AppointmentWorkRouteClient.java
new file mode 100644
index 000000000..03879f376
--- /dev/null
+++ b/firstleg/src/main/java/com/baiyue/firstleg/client/AppointmentWorkRouteClient.java
@@ -0,0 +1,12 @@
+package com.baiyue.firstleg.client;
+
+import com.baiyue.common.core.api.ApiResponse;
+import org.springframework.cloud.openfeign.FeignClient;
+import org.springframework.web.bind.annotation.*;
+
+@FeignClient(name="lastleg-service",contextId="appointmentWorkRouteClient",url="${LASTLEG_SERVICE_URL:${baiyue.clients.lastleg.url:}}")
+public interface AppointmentWorkRouteClient {
+    record Route(String flow) { }
+    @GetMapping("/internal/lastleg/appointment-work/containers/{id}/route")
+    ApiResponse<Route> route(@RequestHeader("X-Internal-Service-Token") String token,@PathVariable("id") long id);
+}
diff --git a/firstleg/src/main/java/com/baiyue/firstleg/dto/ContainerOverviewDtos.java b/firstleg/src/main/java/com/baiyue/firstleg/dto/ContainerOverviewDtos.java
index 0a742df39..5a892a742 100644
--- a/firstleg/src/main/java/com/baiyue/firstleg/dto/ContainerOverviewDtos.java
+++ b/firstleg/src/main/java/com/baiyue/firstleg/dto/ContainerOverviewDtos.java
@@ -13,7 +13,7 @@ public final class ContainerOverviewDtos {
     public record Overview(ContainerBookingEntityView container, Long loadingPlanId, PdaSummary pda,
                            List<Document> documents, ExceptionState exception, List<ExceptionHistory> exceptionHistory,
                            List<TimelineEntry> timeline) {}
-    public record ContainerBookingEntityView(Long id, String bookingNo, String cabinetNo, String containerNo,
+    public record ContainerBookingEntityView(Long id, String cabinetNo, String containerNo,
         String status, Long warehouseId, String warehouseName, String voyageNo, String vesselName,
         String billOfLadingNo, Long shippingCompanyId, String shippingCompanyName,
         String departurePortCode, String departurePortName, String destinationPortCode,
diff --git a/firstleg/src/main/java/com/baiyue/firstleg/dto/MerchantWorkbenchFilters.java b/firstleg/src/main/java/com/baiyue/firstleg/dto/MerchantWorkbenchFilters.java
index cdde0b81e..589488bf6 100644
--- a/firstleg/src/main/java/com/baiyue/firstleg/dto/MerchantWorkbenchFilters.java
+++ b/firstleg/src/main/java/com/baiyue/firstleg/dto/MerchantWorkbenchFilters.java
@@ -10,7 +10,8 @@ public final class MerchantWorkbenchFilters {
     private MerchantWorkbenchFilters() {}
 
     public record Request(@NotNull @Positive Long tenantId,
-        @Pattern(regexp = "WAIT_MEASURE|WAIT_PALLETIZE|WAIT_SPLIT|LOADING|LOADED|DELIVERED") String mainStatus) {}
+        @Pattern(regexp = "WAIT_MEASURE|WAIT_PALLETIZE|WAIT_SPLIT|LOADING|LOADED|DELIVERED") String mainStatus,
+        @jakarta.validation.constraints.Size(min=1,max=200) List<@NotNull @Positive Long> orderIds) {}
 
     public record Response(List<Long> matchingStatusOrderIds, List<Long> feeOrderIds,
                            List<Long> customsOrderIds, List<Progress> progress) {}
diff --git a/firstleg/src/main/java/com/baiyue/firstleg/dto/SmartLoadingDtos.java b/firstleg/src/main/java/com/baiyue/firstleg/dto/SmartLoadingDtos.java
index 7374c753a..7b9e6f6f4 100644
--- a/firstleg/src/main/java/com/baiyue/firstleg/dto/SmartLoadingDtos.java
+++ b/firstleg/src/main/java/com/baiyue/firstleg/dto/SmartLoadingDtos.java
@@ -48,7 +48,7 @@ public final class SmartLoadingDtos { private SmartLoadingDtos(){}
    if (size == 0) size = 20;
   }
  }
- public record WorkbenchContainer(Long bookingId, String bookingNo, String cabinetNo, String containerNo,
+ public record WorkbenchContainer(Long bookingId, String cabinetNo, String containerNo,
   Long warehouseId, String warehouseName, String channelGroupCode, String channelCode, String channelName, String containerType,
   BigDecimal capacityCbm, BigDecimal maxWeightKg,
   Long planId, String planNo, String planStatus, Integer version) {}
diff --git a/firstleg/src/main/java/com/baiyue/firstleg/entity/ContainerBookingEntity.java b/firstleg/src/main/java/com/baiyue/firstleg/entity/ContainerBookingEntity.java
index fd19f6105..9c3829cbd 100644
--- a/firstleg/src/main/java/com/baiyue/firstleg/entity/ContainerBookingEntity.java
+++ b/firstleg/src/main/java/com/baiyue/firstleg/entity/ContainerBookingEntity.java
@@ -19,7 +19,6 @@ import java.time.LocalDateTime;
 @TableName("fl_container_booking")
 public class ContainerBookingEntity {
     @TableId(type = IdType.ASSIGN_ID) private Long id;
-    private String bookingNo;
     private String containerNo;
     private String cabinetNo;
     private String sourceType;
diff --git a/firstleg/src/main/java/com/baiyue/firstleg/mapper/MerchantWorkbenchFilterMapper.java b/firstleg/src/main/java/com/baiyue/firstleg/mapper/MerchantWorkbenchFilterMapper.java
index 8e81bcdd3..12b1223ea 100644
--- a/firstleg/src/main/java/com/baiyue/firstleg/mapper/MerchantWorkbenchFilterMapper.java
+++ b/firstleg/src/main/java/com/baiyue/firstleg/mapper/MerchantWorkbenchFilterMapper.java
@@ -65,6 +65,7 @@ public interface MerchantWorkbenchFilterMapper {
     List<Long> pendingCustoms(@Param("tenantId") long tenantId);
     /** Only physically loaded fragments can expose container milestones to the customer. */
     @Select("""
+        <script>
         SELECT o.order_id, CASE WHEN owned.container_booking_id IS NULL THEN 0
                WHEN EXISTS (SELECT 1 FROM fl_carrier_schedule_node_fact n
                  WHERE n.container_booking_id=owned.container_booking_id
@@ -76,6 +77,11 @@ public interface MerchantWorkbenchFilterMapper {
         LEFT JOIN (
           SELECT DISTINCT i.inbound_id, i.account_id, p.id AS loading_plan_id, p.container_booking_id
           FROM fl_loading_plan_item i
+          <if test="orderIds != null">
+          JOIN fl_inbound_order selected ON selected.id=i.inbound_id AND selected.tenant_id=i.account_id
+            AND selected.deleted=0 AND selected.order_id IN
+            <foreach collection="orderIds" item="id" open="(" separator="," close=")">#{id}</foreach>
+          </if>
           JOIN fl_loading_plan p ON p.id=i.loading_plan_id AND p.plan_status='COMPLETED'
           JOIN fl_loading_pick_task t ON t.loading_plan_id=p.id AND t.task_status='COMPLETED'
           JOIN fl_loading_pick_item picked ON picked.pick_task_id=t.id AND picked.loading_plan_item_id=i.id
@@ -84,8 +90,12 @@ public interface MerchantWorkbenchFilterMapper {
             AND picked.item_status IN ('PICKED','PARTIAL') AND picked.picked_package_count>0
         ) owned ON owned.inbound_id=o.id AND owned.account_id=o.tenant_id
         WHERE o.tenant_id=#{tenantId} AND o.deleted=0 AND o.order_id IS NOT NULL
-          AND o.process_status <> 'CANCELLED'
+          AND o.process_status &lt;&gt; 'CANCELLED'
+          <if test="orderIds != null">
+            AND o.order_id IN <foreach collection="orderIds" item="id" open="(" separator="," close=")">#{id}</foreach>
+          </if>
         ORDER BY o.order_id
+        </script>
         """)
-    List<com.baiyue.firstleg.dto.MerchantWorkbenchFilters.Fragment> progressFragments(@Param("tenantId") long tenantId);
+    List<com.baiyue.firstleg.dto.MerchantWorkbenchFilters.Fragment> progressFragments(@Param("tenantId") long tenantId, @Param("orderIds") List<Long> orderIds);
 }
diff --git a/firstleg/src/main/java/com/baiyue/firstleg/mapper/SmartLoadingCandidateMapper.java b/firstleg/src/main/java/com/baiyue/firstleg/mapper/SmartLoadingCandidateMapper.java
index fbf5a11c9..22a75c851 100644
--- a/firstleg/src/main/java/com/baiyue/firstleg/mapper/SmartLoadingCandidateMapper.java
+++ b/firstleg/src/main/java/com/baiyue/firstleg/mapper/SmartLoadingCandidateMapper.java
@@ -335,7 +335,7 @@ import com.baomidou.mybatisplus.extension.plugins.pagination.Page; import com.ba
 
  @Select("""
   <script>
-  SELECT b.id bookingId,b.booking_no bookingNo,b.cabinet_no cabinetNo,b.container_no containerNo,
+  SELECT b.id bookingId,b.cabinet_no cabinetNo,b.container_no containerNo,
          b.warehouse_id warehouseId,b.warehouse_name warehouseName,b.channel_group_code channelGroupCode,b.channel_code channelCode,
          b.channel_name channelName,b.container_type containerType,b.capacity_cbm capacityCbm,
          b.max_weight_kg maxWeightKg,p.id planId,p.plan_no planNo,
diff --git a/firstleg/src/main/java/com/baiyue/firstleg/portschedule/controller/InternalAppointmentWorkSourceController.java b/firstleg/src/main/java/com/baiyue/firstleg/portschedule/controller/InternalAppointmentWorkSourceController.java
new file mode 100644
index 000000000..1c4b006d8
--- /dev/null
+++ b/firstleg/src/main/java/com/baiyue/firstleg/portschedule/controller/InternalAppointmentWorkSourceController.java
@@ -0,0 +1,36 @@
+package com.baiyue.firstleg.portschedule.controller;
+
+import com.baiyue.common.core.api.ApiResponse;
+import com.baiyue.firstleg.portschedule.dto.AppointmentWorkSourceDtos.*;
+import com.baiyue.firstleg.portschedule.service.AppointmentWorkSourceService;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.web.bind.annotation.*;
+import org.springframework.http.HttpStatus;
+import org.springframework.web.server.ResponseStatusException;
+import java.nio.charset.StandardCharsets;
+import java.security.MessageDigest;
+import java.util.List;
+
+@RestController
+@RequestMapping("/internal/firstleg/appointment-work")
+public class InternalAppointmentWorkSourceController {
+    private final AppointmentWorkSourceService service;
+    private final String token;
+    public InternalAppointmentWorkSourceController(AppointmentWorkSourceService service,
+        @Value("${baiyue.security.internal-service-token:}") String token) { this.service=service; this.token=token; }
+    @GetMapping("/containers")
+    public ApiResponse<SourcePage> discover(@RequestHeader(value="X-Internal-Service-Token",required=false) String supplied,
+        @RequestParam(required=false) String after,@RequestParam(defaultValue="200") int size) {
+        authorize(supplied); return ApiResponse.success(service.discover(after,size));
+    }
+    @GetMapping("/containers/{id}")
+    public ApiResponse<ContainerSource> container(@RequestHeader(value="X-Internal-Service-Token",required=false) String supplied,
+        @PathVariable long id) { authorize(supplied); return ApiResponse.success(service.container(id)); }
+    @PostMapping("/facts")
+    public ApiResponse<List<Fact>> facts(@RequestHeader(value="X-Internal-Service-Token",required=false) String supplied,
+        @RequestBody List<FactRequest> requests) { authorize(supplied); return ApiResponse.success(service.facts(requests)); }
+    private void authorize(String supplied) {
+        if(token==null || token.isBlank() || supplied==null || !MessageDigest.isEqual(token.getBytes(StandardCharsets.UTF_8),supplied.getBytes(StandardCharsets.UTF_8)))
+            throw new ResponseStatusException(HttpStatus.UNAUTHORIZED,"内部身份无效");
+    }
+}
diff --git a/firstleg/src/main/java/com/baiyue/firstleg/portschedule/dto/AppointmentWorkSourceDtos.java b/firstleg/src/main/java/com/baiyue/firstleg/portschedule/dto/AppointmentWorkSourceDtos.java
new file mode 100644
index 000000000..2631b4263
--- /dev/null
+++ b/firstleg/src/main/java/com/baiyue/firstleg/portschedule/dto/AppointmentWorkSourceDtos.java
@@ -0,0 +1,29 @@
+package com.baiyue.firstleg.portschedule.dto;
+
+import java.time.*;
+import java.util.List;
+
+/** Internal wire values. Unzoned source timestamps are never converted using the server zone. */
+public final class AppointmentWorkSourceDtos {
+    private AppointmentWorkSourceDtos() { }
+    public record Reference(String kind, String key, String businessNo, String label) { }
+    public record SourceReference(String customerId,String sourceKey,String destinationKey) { }
+    public record Requirement(String requirementKey, String batchKey, String batchNo, String destinationKind,
+        String originName, String destinationName, String timezone, List<Reference> references, List<String> replacesRequirementKeys,
+        List<SourceReference> sources) { }
+    public record ContainerSource(String containerBookingId, String containerNo, Instant departedAt,
+        LocalDateTime departedLocalAt, LocalDateTime sailedEvidenceLocalAt, String sourceVersion, String establishedFlow, String timezone, List<Requirement> requirements) { }
+    public record SourcePage(List<ContainerSource> containers, String nextCursor, boolean complete, String scopeVersion) { }
+    public record ContainerReference(String containerBookingId, String bookingNo, String containerNo) { }
+    public record FactRequest(String workItemKey, String type, String flow, String containerBookingId,
+        String requirementKey, String batchKey, String tripKey, List<String> batchKeys, List<ContainerReference> containers,List<SourceReference> sources) { }
+    public record Slot(LocalDate date, LocalTime startTime, LocalDate endDate, LocalTime endTime, String timezone) { }
+    public record Actual(Instant occurredAt, LocalDateTime localOccurredAt, String timezone) { }
+    public record Target(String kind, String containerBookingId) { }
+    public record Action(String code, String label, String targetWorkItemKey, Target target) { }
+    public record Responsibility(String kind, String id, String name) { }
+    public record Fact(String workItemKey, String fingerprint, String impactToken, boolean planExists, String planStatus,
+        String executionStatus, Slot target, Slot confirmed, Actual actual, String timezone, String businessNo, String tripKey,
+        List<String> readPermissions, List<String> actionPermissions, Action action, List<String> blockReasons,
+        List<String> missingFields, List<Reference> references, Responsibility responsibility) { }
+}
diff --git a/firstleg/src/main/java/com/baiyue/firstleg/portschedule/dto/ArrivalCalendarEntry.java b/firstleg/src/main/java/com/baiyue/firstleg/portschedule/dto/ArrivalCalendarEntry.java
index e27bc347d..44a1f13c4 100644
--- a/firstleg/src/main/java/com/baiyue/firstleg/portschedule/dto/ArrivalCalendarEntry.java
+++ b/firstleg/src/main/java/com/baiyue/firstleg/portschedule/dto/ArrivalCalendarEntry.java
@@ -2,6 +2,6 @@ package com.baiyue.firstleg.portschedule.dto;
 
 import java.time.LocalDateTime;
 
-public record ArrivalCalendarEntry(Long containerBookingId, String bookingNo, String containerNo,
+public record ArrivalCalendarEntry(Long containerBookingId, String cabinetNo, String containerNo,
     String vesselName, String voyageNo, String destinationPortName, String destinationWarehouseCode,
     LocalDateTime arrivalAt, String arrivalType) {}
diff --git a/firstleg/src/main/java/com/baiyue/firstleg/portschedule/mapper/AppointmentWorkSourceMapper.java b/firstleg/src/main/java/com/baiyue/firstleg/portschedule/mapper/AppointmentWorkSourceMapper.java
new file mode 100644
index 000000000..c84449fce
--- /dev/null
+++ b/firstleg/src/main/java/com/baiyue/firstleg/portschedule/mapper/AppointmentWorkSourceMapper.java
@@ -0,0 +1,64 @@
+package com.baiyue.firstleg.portschedule.mapper;
+
+import org.apache.ibatis.annotations.*;
+import java.time.LocalDateTime;
+import java.util.List;
+
+@Mapper
+public interface AppointmentWorkSourceMapper {
+    record Source(long id, String cabinetNo, String containerNo, String departurePortName,
+        String destinationWarehouseName, LocalDateTime departedLocalAt, LocalDateTime sailedEvidenceLocalAt, int version, long factVersion, long deliveryVersion) { }
+    record Cargo(long inboundId, long customerId, long orderId, String orderNo, String inboundCode,
+        String destinationKind, String destinationCode, String destinationName, int packageCount) { }
+    record ContainerCargo(long containerBookingId,long inboundId,long customerId,long orderId,String orderNo,String inboundCode,
+        String destinationKind,String destinationCode,String destinationName,int packageCount) {
+        public Cargo cargo() { return new Cargo(inboundId,customerId,orderId,orderNo,inboundCode,destinationKind,destinationCode,destinationName,packageCount); }
+    }
+
+    String SOURCE_ROWS = """
+        SELECT b.id,b.cabinet_no,b.container_no,b.departure_port_name,b.destination_warehouse_name,
+          MIN(CASE WHEN f.standard_node='DEPARTED_ORIGIN_PORT' THEN f.actual_at END) departed_local_at,
+          MIN(f.actual_at) sailed_evidence_local_at,
+          b.version,MAX(f.id) fact_version,
+          (SELECT COUNT(*) FROM fl_direct_delivery_unloading d WHERE d.container_booking_id=b.id) delivery_version
+        FROM fl_container_booking b JOIN fl_carrier_schedule_node_fact f ON f.container_booking_id=b.id
+        WHERE b.record_status='ACTIVE' AND f.actual_at IS NOT NULL
+          AND f.standard_node IN ('DEPARTED_ORIGIN_PORT','IN_TRANSIT','ARRIVED_DESTINATION_PORT',
+            'DISCHARGED_FROM_VESSEL','PICKUP_READY','PICKED_UP','EMPTY_RETURNED')
+        """;
+    String SOURCE_ORDER = """
+        GROUP BY b.id,b.cabinet_no,b.container_no,b.departure_port_name,b.destination_warehouse_name,b.version
+        ORDER BY b.id
+        """;
+    // A complete identity/version manifest also detects deletions or edits between cursor pages.
+    @Select(SOURCE_ROWS + SOURCE_ORDER)
+    List<Source> sources();
+
+    /** Same live eligibility and aggregate facts as the manifest, restricted before aggregation. */
+    @Select("<script>" + SOURCE_ROWS + """
+        <choose>
+          <when test="ids != null and !ids.isEmpty()">
+            AND b.id IN <foreach collection='ids' item='id' open='(' separator=',' close=')'>#{id}</foreach>
+          </when>
+          <otherwise>AND 1=0</otherwise>
+        </choose>
+        """ + SOURCE_ORDER + "</script>")
+    List<Source> sourcesByIds(@Param("ids") List<Long> ids);
+
+    @Select("""
+        <script>
+        SELECT p.container_booking_id,i.inbound_id, i.account_id customer_id, i.order_id, i.order_no,i.inbound_code,
+          o.destination_type destination_kind,i.destination_warehouse_code destination_code,
+          i.destination_warehouse_name destination_name,SUM(i.package_count) package_count
+        FROM fl_loading_plan p JOIN fl_loading_plan_item i ON i.loading_plan_id=p.id AND i.deleted=0
+          JOIN fl_inbound_order o ON o.id=i.inbound_id
+        WHERE p.container_booking_id IN
+          <foreach collection='ids' item='id' open='(' separator=',' close=')'>#{id}</foreach>
+          AND p.plan_status='COMPLETED'
+        GROUP BY p.container_booking_id,i.inbound_id,i.account_id,i.order_id,i.order_no,i.inbound_code,o.destination_type,
+          i.destination_warehouse_code,i.destination_warehouse_name
+        ORDER BY p.container_booking_id,i.inbound_id
+        </script>
+        """)
+    List<ContainerCargo> cargo(@Param("ids") List<Long> ids);
+}
diff --git a/firstleg/src/main/java/com/baiyue/firstleg/portschedule/mapper/CarrierScheduleQueryMapper.java b/firstleg/src/main/java/com/baiyue/firstleg/portschedule/mapper/CarrierScheduleQueryMapper.java
index 630b2bdfe..f256e9c9a 100644
--- a/firstleg/src/main/java/com/baiyue/firstleg/portschedule/mapper/CarrierScheduleQueryMapper.java
+++ b/firstleg/src/main/java/com/baiyue/firstleg/portschedule/mapper/CarrierScheduleQueryMapper.java
@@ -15,6 +15,15 @@ import java.util.List;
 
 @Mapper
 public interface CarrierScheduleQueryMapper extends BaseMapper<CarrierScheduleQueryEntity> {
+    @Select("""
+        SELECT container_booking_id FROM fl_carrier_schedule_node_fact
+        WHERE standard_node='PICKED_UP' AND actual_at IS NOT NULL
+        GROUP BY container_booking_id
+        HAVING MAX(actual_at)>=#{from} AND MAX(actual_at)<#{to}
+        ORDER BY MAX(actual_at),container_booking_id LIMIT 1001
+        """)
+    List<Long> selectPickupCalendarContainers(@Param("from") LocalDateTime from,@Param("to") LocalDateTime to);
+
     @Select("""
         <script>
         SELECT * FROM fl_carrier_schedule_query
diff --git a/firstleg/src/main/java/com/baiyue/firstleg/portschedule/mapper/PortScheduleMapper.java b/firstleg/src/main/java/com/baiyue/firstleg/portschedule/mapper/PortScheduleMapper.java
index 2dabdd692..49422bae7 100644
--- a/firstleg/src/main/java/com/baiyue/firstleg/portschedule/mapper/PortScheduleMapper.java
+++ b/firstleg/src/main/java/com/baiyue/firstleg/portschedule/mapper/PortScheduleMapper.java
@@ -12,7 +12,7 @@ import org.apache.ibatis.annotations.Update;
 @Mapper
 public interface PortScheduleMapper extends BaseMapper<PortScheduleEntity> {
     @Select("""
-        SELECT c.id containerBookingId,c.booking_no bookingNo,c.container_no containerNo,
+        SELECT c.id containerBookingId,c.cabinet_no cabinetNo,c.container_no containerNo,
           c.vessel_name vesselName,c.voyage_no voyageNo,c.destination_port_name destinationPortName,
           c.destination_warehouse_code destinationWarehouseCode,
           COALESCE(n.actual_at,c.actual_port_arrival_at,c.estimated_port_arrival_at) arrivalAt,
diff --git a/firstleg/src/main/java/com/baiyue/firstleg/portschedule/repository/CarrierScheduleQueryRepository.java b/firstleg/src/main/java/com/baiyue/firstleg/portschedule/repository/CarrierScheduleQueryRepository.java
index e71a2e5a2..3deaefa2b 100644
--- a/firstleg/src/main/java/com/baiyue/firstleg/portschedule/repository/CarrierScheduleQueryRepository.java
+++ b/firstleg/src/main/java/com/baiyue/firstleg/portschedule/repository/CarrierScheduleQueryRepository.java
@@ -49,6 +49,9 @@ public class CarrierScheduleQueryRepository {
     public List<ContainerActualFacts> containerActualFacts(List<Long> containerBookingIds) {
         return queries.selectContainerActualFacts(containerBookingIds);
     }
+    public List<Long> pickupCalendarContainers(LocalDateTime from, LocalDateTime to) {
+        return queries.selectPickupCalendarContainers(from, to);
+    }
     public List<CarrierScheduleQueryEntity> due(LocalDateTime now, int limit) { return queries.selectDue(now, limit); }
     public boolean claimLease(long id, String owner, LocalDateTime now, LocalDateTime leaseUntil) {
         return queries.claimLease(id, owner, now, leaseUntil) == 1;
diff --git a/firstleg/src/main/java/com/baiyue/firstleg/portschedule/service/AppointmentWorkSourceService.java b/firstleg/src/main/java/com/baiyue/firstleg/portschedule/service/AppointmentWorkSourceService.java
new file mode 100644
index 000000000..17abf27f0
--- /dev/null
+++ b/firstleg/src/main/java/com/baiyue/firstleg/portschedule/service/AppointmentWorkSourceService.java
@@ -0,0 +1,90 @@
+package com.baiyue.firstleg.portschedule.service;
+
+import com.baiyue.firstleg.portschedule.dto.AppointmentWorkSourceDtos.*;
+import com.baiyue.firstleg.portschedule.mapper.AppointmentWorkSourceMapper;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Transactional;
+import org.springframework.http.HttpStatus;
+import org.springframework.web.server.ResponseStatusException;
+import java.security.MessageDigest;
+import java.util.*;
+
+@Service
+public class AppointmentWorkSourceService {
+    public interface OriginalFacts {
+        Map<Long,String> establishedFlows(List<Long> containerBookingIds);
+        List<Fact> read(List<FactRequest> requests, Map<Long,ContainerSource> sources);
+    }
+    private final AppointmentWorkSourceMapper mapper;
+    private final OriginalFacts original;
+    private final ObjectMapper json;
+    public AppointmentWorkSourceService(AppointmentWorkSourceMapper mapper,OriginalFacts original,ObjectMapper json) {
+        this.mapper=mapper; this.original=original; this.json=json;
+    }
+    @Transactional(readOnly=true, isolation=org.springframework.transaction.annotation.Isolation.REPEATABLE_READ)
+    public SourcePage discover(String after,int size) {
+        if(size<1 || size>200) throw bad("分页大小必须为1至200");
+        var rows=mapper.sources();
+        String scope=hash(rows); long last=0;
+        if(after!=null) {
+            String[] parts=after.split(":",-1);
+            if(parts.length!=2) throw bad("来源游标无效");
+            if(!scope.equals(parts[0])) throw new ResponseStatusException(HttpStatus.CONFLICT,"已开船来源已变化，请重新同步");
+            last=id(parts[1]);
+        }
+        final long cursor=last;
+        var page=rows.stream().filter(row->row.id()>cursor).limit(size+1L).toList();
+        boolean complete=page.size()<=size;
+        var selected=page.stream().limit(size).toList();
+        return new SourcePage(sources(selected),complete?null:scope+":"+selected.get(selected.size()-1).id(),complete,scope);
+    }
+    public ContainerSource container(long id) {
+        var row=mapper.sources().stream().filter(candidate->candidate.id()==id).findFirst()
+            .orElseThrow(()->new ResponseStatusException(HttpStatus.NOT_FOUND,"未找到有效已开船柜次"));
+        return sources(List.of(row)).get(0);
+    }
+    private List<ContainerSource> sources(List<AppointmentWorkSourceMapper.Source> rows) {
+        if(rows.isEmpty()) return List.of();
+        var ids=rows.stream().map(AppointmentWorkSourceMapper.Source::id).toList();
+        var cargo=new HashMap<Long,List<AppointmentWorkSourceMapper.Cargo>>();
+        for(var item:mapper.cargo(ids)) cargo.computeIfAbsent(item.containerBookingId(),ignored->new ArrayList<>()).add(item.cargo());
+        var flows=original.establishedFlows(ids);
+        return rows.stream().map(row->source(row,cargo.getOrDefault(row.id(),List.of()),flows.get(row.id()))).toList();
+    }
+    private ContainerSource source(AppointmentWorkSourceMapper.Source row,List<AppointmentWorkSourceMapper.Cargo> cargo,String flow) {
+        if(flow==null) throw new ResponseStatusException(HttpStatus.SERVICE_UNAVAILABLE,"柜次路线事实读取不完整");
+        var requirements=cargo.stream().map(c->new Requirement("INBOUND:"+c.inboundId(),null,null,
+            c.destinationKind(),row.departurePortName(),c.destinationName(),null,
+            List.of(new Reference("CUSTOMER",Long.toString(c.customerId()),null,"所属客户"),
+                new Reference("ORDER",Long.toString(c.orderId()),c.orderNo(),"原订单"),
+                new Reference("INBOUND",Long.toString(c.inboundId()),c.inboundCode(),"入仓单"),
+                new Reference("CONTAINER",Long.toString(row.id()),row.cabinetNo(),"柜次")),List.of(),List.of())).toList();
+        return new ContainerSource(Long.toString(row.id()),row.containerNo(),null,row.departedLocalAt(),row.sailedEvidenceLocalAt(),
+            hash(List.of(row,cargo)),flow,null,requirements);
+    }
+    public List<Fact> facts(List<FactRequest> requests) {
+        if(requests==null || requests.isEmpty() || requests.size()>200) throw bad("事实请求须包含1至200项");
+        Set<String> keys=new HashSet<>(); var ids=new LinkedHashSet<Long>();
+        for(var request:requests) {
+            if(request==null || request.workItemKey()==null || request.workItemKey().isBlank() || !keys.add(request.workItemKey())
+                || !("PICKUP".equals(request.type()) || "EMPTY_RETURN".equals(request.type()) || "DELIVERY".equals(request.type()) && "DIRECT".equals(request.flow())))
+                throw bad("事项身份或事实类型无效");
+            ids.add(id(request.containerBookingId()));
+        }
+        var selected=mapper.sourcesByIds(List.copyOf(ids));
+        if(selected.size()!=ids.size()) throw new ResponseStatusException(HttpStatus.NOT_FOUND,"未找到有效已开船柜次");
+        var sources=new LinkedHashMap<Long,ContainerSource>();
+        sources(selected).forEach(source->sources.put(Long.parseLong(source.containerBookingId()),source));
+        return original.read(requests,sources);
+    }
+    public String hash(Object value) {
+        try {return HexFormat.of().formatHex(MessageDigest.getInstance("SHA-256").digest(json.writeValueAsBytes(value)));}
+        catch(Exception error){throw new IllegalStateException("不能生成来源版本",error);}
+    }
+    private static long id(String value) {
+        try {long id=Long.parseLong(value); if(id>0)return id;} catch(RuntimeException ignored) { }
+        throw bad("柜次或游标无效");
+    }
+    private static ResponseStatusException bad(String message){return new ResponseStatusException(HttpStatus.BAD_REQUEST,message);}
+}
diff --git a/firstleg/src/main/java/com/baiyue/firstleg/portschedule/service/CarrierScheduleQueryService.java b/firstleg/src/main/java/com/baiyue/firstleg/portschedule/service/CarrierScheduleQueryService.java
index a18b494b5..6f05c6b98 100644
--- a/firstleg/src/main/java/com/baiyue/firstleg/portschedule/service/CarrierScheduleQueryService.java
+++ b/firstleg/src/main/java/com/baiyue/firstleg/portschedule/service/CarrierScheduleQueryService.java
@@ -68,6 +68,7 @@ public class CarrierScheduleQueryService {
     @Resource private CarrierScheduleAdapterRegistry adapters;
     @Resource private CarrierScheduleNodeOutboxService nodeOutbox;
     @Resource private ObjectMapper objectMapper;
+    @Resource private EmptyReturnPrerequisite emptyReturnPrerequisite;
     @Value("${baiyue.carrier-schedule.scheduler.zone:Asia/Shanghai}")
     private String scheduleZone = "Asia/Shanghai";
     private Clock clock = Clock.systemDefaultZone();
@@ -81,6 +82,14 @@ public class CarrierScheduleQueryService {
             source.page(), source.size(), source.total(), source.pages());
     }
 
+    public List<Long> pickupCalendarContainers(LocalDateTime from, LocalDateTime to) {
+        if (from == null || to == null || !to.isAfter(from)
+            || java.time.Duration.between(from, to).compareTo(java.time.Duration.ofDays(42)) > 0) {
+            throw badRequest("提柜日历查询范围必须为1至42天");
+        }
+        return repository.pickupCalendarContainers(from, to);
+    }
+
     public List<ContainerActualFacts> containerActualFacts(List<Long> containerBookingIds) {
         if (containerBookingIds == null || containerBookingIds.isEmpty() || containerBookingIds.size() > 200) {
             throw badRequest("containerBookingIds数量必须在1到200之间");
@@ -223,6 +232,7 @@ public class CarrierScheduleQueryService {
         CarrierScheduleQueryEntity value = requiredLockedVersion(id, request.expectedVersion());
         CarrierScheduleNode node = CarrierScheduleNode.require(request.standardNode());
         requireManualActualAdvance(value, node, request.actualAt());
+        requireEmptyReturnEvidence(value.getContainerBookingId(), node, request.actualAt());
         CarrierScheduleQueryEntity before = copy(value);
         String providerEventId = sha256("MANUAL|" + id + '|' + key);
         CarrierScheduleNodeFactEntity fact = addNode(value, "MANUAL", providerEventId, node.name(), node,
@@ -266,6 +276,7 @@ public class CarrierScheduleQueryService {
         CarrierScheduleQueryEntity query = found == null ? null : requiredLocked(found.getId());
         String providerEventId = sha256("CONTAINER_MANUAL|" + containerBookingId + '|' + key);
         String payloadHash = hash("CONTAINER_MANUAL_NODE", containerBookingId, request);
+        requireEmptyReturnEvidence(containerBookingId, node, request.actualAt());
         CarrierScheduleNodeFactEntity fact = addNode(query == null ? null : query.getId(), containerBookingId,
             "MANUAL", providerEventId,
             node.name(), node, request.observedAt(), request.estimatedAt(), request.actualAt(),
@@ -331,6 +342,11 @@ public class CarrierScheduleQueryService {
         }
     }
 
+    private void requireEmptyReturnEvidence(long containerBookingId,CarrierScheduleNode node,LocalDateTime actualAt) {
+        if(node==CarrierScheduleNode.EMPTY_RETURNED && actualAt!=null)
+            emptyReturnPrerequisite.requireUnloaded(containerBookingId,actualAt);
+    }
+
     public boolean hasOutboundDepartureFact(long customerId, long oceanBookingId, long containerBookingId) {
         CarrierScheduleQueryEntity query = repository.findByBusinessScope(customerId, oceanBookingId,
             containerBookingId);
diff --git a/firstleg/src/main/java/com/baiyue/firstleg/portschedule/service/EmptyReturnPrerequisite.java b/firstleg/src/main/java/com/baiyue/firstleg/portschedule/service/EmptyReturnPrerequisite.java
new file mode 100644
index 000000000..45f365c43
--- /dev/null
+++ b/firstleg/src/main/java/com/baiyue/firstleg/portschedule/service/EmptyReturnPrerequisite.java
@@ -0,0 +1,9 @@
+package com.baiyue.firstleg.portschedule.service;
+
+import java.time.LocalDateTime;
+
+/** Actual unloading evidence owned by its original domain; not a work-item completion flag. */
+public interface EmptyReturnPrerequisite {
+    LocalDateTime completedUnloading(long containerBookingId);
+    void requireUnloaded(long containerBookingId, LocalDateTime returnedAt);
+}
diff --git a/firstleg/src/main/java/com/baiyue/firstleg/service/ContainerOverviewService.java b/firstleg/src/main/java/com/baiyue/firstleg/service/ContainerOverviewService.java
index 6556b6a4c..fa799492b 100644
--- a/firstleg/src/main/java/com/baiyue/firstleg/service/ContainerOverviewService.java
+++ b/firstleg/src/main/java/com/baiyue/firstleg/service/ContainerOverviewService.java
@@ -42,7 +42,7 @@ public class ContainerOverviewService {
             .toList();
         PdaSummary pda = task == null ? null : pda(task);
         List<TimelineEntry> timeline = timeline(id, task == null ? null : task.id(), exceptionHistory);
-        return new Overview(new ContainerBookingEntityView(booking.getId(), booking.getBookingNo(),
+        return new Overview(new ContainerBookingEntityView(booking.getId(),
             booking.getCabinetNo(), booking.getContainerNo(), booking.getPlanStatus(), booking.getWarehouseId(),
             booking.getWarehouseName(), booking.getVoyageNo(), booking.getVesselName(), booking.getBillOfLadingNo(),
             booking.getShippingCompanyId(), booking.getShippingCompanyName(), booking.getDeparturePortCode(),
diff --git a/firstleg/src/main/java/com/baiyue/firstleg/service/ContainerService.java b/firstleg/src/main/java/com/baiyue/firstleg/service/ContainerService.java
index abf45f64a..33ead8723 100644
--- a/firstleg/src/main/java/com/baiyue/firstleg/service/ContainerService.java
+++ b/firstleg/src/main/java/com/baiyue/firstleg/service/ContainerService.java
@@ -63,7 +63,7 @@ public class ContainerService {
             .map(ChannelRow::getChannelCode).anyMatch(channelGroup.channelCodes()::contains);
         if (!activeGroup) throw conflict("所选物流渠道分组在当前仓库已失效，请重新选择");
         ContainerBookingEntity value = new ContainerBookingEntity(); value.setId(IdWorker.getId());
-        value.setBookingNo(documentNumbers.next("CB")); value.setCabinetNo(documentNumbers.nextCabinetNo());
+        value.setCabinetNo(documentNumbers.nextCabinetNo());
         value.setSourceType("SIMULATION"); value.setRecordStatus("ACTIVE");
         value.setChannelGroupCode(channelGroup.code()); value.setChannelCode(null); value.setChannelName(null);
         value.setWarehouseId(warehouse.id()); value.setWarehouseName(warehouse.warehouseName());
diff --git a/firstleg/src/main/java/com/baiyue/firstleg/service/FirstlegDocumentNumberGenerator.java b/firstleg/src/main/java/com/baiyue/firstleg/service/FirstlegDocumentNumberGenerator.java
index 382e54e53..6fc7b24c8 100644
--- a/firstleg/src/main/java/com/baiyue/firstleg/service/FirstlegDocumentNumberGenerator.java
+++ b/firstleg/src/main/java/com/baiyue/firstleg/service/FirstlegDocumentNumberGenerator.java
@@ -19,7 +19,7 @@ import java.util.Set;
 public class FirstlegDocumentNumberGenerator {
     private static final ZoneId BUSINESS_ZONE = ZoneId.of("Asia/Shanghai");
     private static final DateTimeFormatter DATE_FORMAT = DateTimeFormatter.ofPattern("yyMMdd", Locale.ROOT);
-    private static final Set<String> SUPPORTED_PREFIXES = Set.of("OB", "TA", "CB", "LP", "DP");
+    private static final Set<String> SUPPORTED_PREFIXES = Set.of("OB", "TA", "LP", "DP");
     private static final long MAX_DAILY_SEQUENCE = 9_999L;
 
     private final JdbcTemplate jdbc;
diff --git a/firstleg/src/main/java/com/baiyue/firstleg/service/MerchantWorkbenchFilterService.java b/firstleg/src/main/java/com/baiyue/firstleg/service/MerchantWorkbenchFilterService.java
index 65df89291..ef0880e5d 100644
--- a/firstleg/src/main/java/com/baiyue/firstleg/service/MerchantWorkbenchFilterService.java
+++ b/firstleg/src/main/java/com/baiyue/firstleg/service/MerchantWorkbenchFilterService.java
@@ -12,11 +12,15 @@ public class MerchantWorkbenchFilterService {
 
     @org.springframework.transaction.annotation.Transactional(readOnly=true)
     public MerchantWorkbenchFilters.Response read(MerchantWorkbenchFilters.Request request) {
+        if (request.orderIds() != null) {
+            return new MerchantWorkbenchFilters.Response(null, java.util.List.of(), java.util.List.of(),
+                progress(mapper.progressFragments(request.tenantId(), request.orderIds())));
+        }
         return new MerchantWorkbenchFilters.Response(
             request.mainStatus() == null ? null : mapper.byProcessStatuses(request.tenantId(),
                 unified.internalStatuses(request.mainStatus())),
             mapper.pendingFees(request.tenantId()), mapper.pendingCustoms(request.tenantId()),
-            progress(mapper.progressFragments(request.tenantId())));
+            progress(mapper.progressFragments(request.tenantId(), null)));
     }
 
     static java.util.List<MerchantWorkbenchFilters.Progress> progress(java.util.List<MerchantWorkbenchFilters.Fragment> facts) {
diff --git a/firstleg/src/main/java/com/baiyue/firstleg/terminaldrayage/controller/PlatformDirectDeliveryController.java b/firstleg/src/main/java/com/baiyue/firstleg/terminaldrayage/controller/PlatformDirectDeliveryController.java
new file mode 100644
index 000000000..be30496e6
--- /dev/null
+++ b/firstleg/src/main/java/com/baiyue/firstleg/terminaldrayage/controller/PlatformDirectDeliveryController.java
@@ -0,0 +1,30 @@
+package com.baiyue.firstleg.terminaldrayage.controller;
+
+import com.baiyue.common.core.api.ApiResponse;
+import com.baiyue.common.security.AuthenticatedUser;
+import org.springframework.security.access.prepost.PreAuthorize;
+import org.springframework.security.core.annotation.AuthenticationPrincipal;
+import com.baiyue.firstleg.service.FirstlegScopeGuard;
+import com.baiyue.firstleg.terminaldrayage.service.DirectDeliveryService;
+import jakarta.validation.Valid;
+import org.springframework.web.bind.annotation.*;
+import java.util.List;
+
+@RestController
+@RequestMapping("/api/platform/v1/terminal-drayages/{containerBookingId}/direct-deliveries")
+public class PlatformDirectDeliveryController {
+    private final DirectDeliveryService service;
+    public PlatformDirectDeliveryController(DirectDeliveryService service){this.service=service;}
+    @GetMapping
+    @PreAuthorize("hasAuthority('platform:firstleg:terminal-drayage:list')")
+    public ApiResponse<List<DirectDeliveryService.View>> list(@AuthenticationPrincipal AuthenticatedUser user,@PathVariable long containerBookingId) {
+        FirstlegScopeGuard.platform(user); return ApiResponse.success(service.list(containerBookingId));
+    }
+    @PostMapping("/{inboundId}")
+    @PreAuthorize("hasAuthority('platform:firstleg:terminal-drayage:direct-unload:confirm')")
+    public ApiResponse<DirectDeliveryService.View> record(@AuthenticationPrincipal AuthenticatedUser user,@PathVariable long containerBookingId,
+        @PathVariable long inboundId,@RequestHeader("Idempotency-Key") String key,@Valid @RequestBody DirectDeliveryService.Request request) {
+        FirstlegScopeGuard.platform(user);
+        return ApiResponse.success(service.record(containerBookingId,inboundId,user.userId(),user.username(),key,request));
+    }
+}
diff --git a/firstleg/src/main/java/com/baiyue/firstleg/terminaldrayage/dto/PickupCalendarEntry.java b/firstleg/src/main/java/com/baiyue/firstleg/terminaldrayage/dto/PickupCalendarEntry.java
index 7a9befaa3..0c39bc0de 100644
--- a/firstleg/src/main/java/com/baiyue/firstleg/terminaldrayage/dto/PickupCalendarEntry.java
+++ b/firstleg/src/main/java/com/baiyue/firstleg/terminaldrayage/dto/PickupCalendarEntry.java
@@ -3,6 +3,6 @@ package com.baiyue.firstleg.terminaldrayage.dto;
 import java.time.LocalDateTime;
 
 /** Original pickup appointment wall time; the source does not establish a port time zone. */
-public record PickupCalendarEntry(Long containerBookingId, String bookingNo, String containerNo,
+public record PickupCalendarEntry(Long containerBookingId, String cabinetNo, String containerNo,
     String destinationPortName, String destinationWarehouseCode, String fleetSupplierName,
     LocalDateTime pickupAppointmentAt, LocalDateTime actualPickupAt) { }
diff --git a/firstleg/src/main/java/com/baiyue/firstleg/terminaldrayage/mapper/DirectDeliveryMapper.java b/firstleg/src/main/java/com/baiyue/firstleg/terminaldrayage/mapper/DirectDeliveryMapper.java
new file mode 100644
index 000000000..98b29d26a
--- /dev/null
+++ b/firstleg/src/main/java/com/baiyue/firstleg/terminaldrayage/mapper/DirectDeliveryMapper.java
@@ -0,0 +1,77 @@
+package com.baiyue.firstleg.terminaldrayage.mapper;
+
+import org.apache.ibatis.annotations.*;
+import java.time.LocalDateTime;
+import java.util.List;
+
+@Mapper
+public interface DirectDeliveryMapper {
+    record Delivery(long inboundId,String inboundCode,String orderNo,String destinationName,int packageCount,
+        int version,LocalDateTime actualAt,String timezone,String receivedBy,String evidenceNo,String remark,
+        String idempotencyKey,String requestHash) { }
+    record Container(long id,String recordStatus,LocalDateTime warehouseUnloadedAt) { }
+    record FlowEvidence(long id,LocalDateTime warehouseUnloadedAt,long evidenceCount) { }
+    record ContainerDelivery(long containerBookingId,long inboundId,String inboundCode,String orderNo,String destinationName,int packageCount,
+        int version,LocalDateTime actualAt,String timezone,String receivedBy,String evidenceNo,String remark,
+        String idempotencyKey,String requestHash) {
+        public Delivery delivery(){return new Delivery(inboundId,inboundCode,orderNo,destinationName,packageCount,version,
+            actualAt,timezone,receivedBy,evidenceNo,remark,idempotencyKey,requestHash);}
+    }
+    @Select("""
+        <script>
+        SELECT c.id,c.unloading_completed_at warehouse_unloaded_at,COUNT(d.inbound_id) evidence_count
+        FROM fl_container_booking c LEFT JOIN fl_direct_delivery_unloading d ON d.container_booking_id=c.id
+        WHERE c.id IN <foreach collection="ids" item="id" open="(" separator="," close=")">#{id}</foreach>
+        GROUP BY c.id,c.unloading_completed_at
+        </script>
+        """)
+    List<FlowEvidence> flowEvidence(@Param("ids") List<Long> ids);
+    @Select("""
+        <script>SELECT id,record_status,unloading_completed_at warehouse_unloaded_at FROM fl_container_booking
+        WHERE id IN <foreach collection="ids" item="id" open="(" separator="," close=")">#{id}</foreach></script>
+        """)
+    List<Container> containers(@Param("ids") List<Long> ids);
+    @Select("""
+        <script>
+        SELECT p.container_booking_id,i.inbound_id,MAX(i.inbound_code) inbound_code,MAX(i.order_no) order_no,
+          MAX(i.destination_warehouse_name) destination_name,SUM(i.package_count) package_count,
+          COALESCE(d.version,0) version,d.actual_at,d.timezone,d.received_by,d.evidence_no,d.remark,d.idempotency_key,d.request_hash
+        FROM fl_loading_plan p JOIN fl_loading_plan_item i ON i.loading_plan_id=p.id AND i.deleted=0
+        LEFT JOIN fl_direct_delivery_unloading d ON d.container_booking_id=p.container_booking_id AND d.inbound_id=i.inbound_id
+        WHERE p.container_booking_id IN <foreach collection="ids" item="id" open="(" separator="," close=")">#{id}</foreach>
+          AND p.plan_status='COMPLETED'
+        GROUP BY p.container_booking_id,i.inbound_id,d.version,d.actual_at,d.timezone,d.received_by,d.evidence_no,d.remark,d.idempotency_key,d.request_hash
+        ORDER BY p.container_booking_id,i.inbound_id
+        </script>
+        """)
+    List<ContainerDelivery> deliveriesBatch(@Param("ids") List<Long> ids);
+    @Select("SELECT id,record_status,unloading_completed_at warehouse_unloaded_at FROM fl_container_booking WHERE id=#{id} FOR UPDATE")
+    @Options(flushCache=Options.FlushCachePolicy.TRUE,useCache=false)
+    Container lockContainer(@Param("id") long id);
+    @Select("SELECT id,record_status,unloading_completed_at warehouse_unloaded_at FROM fl_container_booking WHERE id=#{id}")
+    Container container(@Param("id") long id);
+    @Select("""
+        SELECT i.inbound_id,MAX(i.inbound_code) inbound_code,MAX(i.order_no) order_no,
+          MAX(i.destination_warehouse_name) destination_name,SUM(i.package_count) package_count,
+          COALESCE(d.version,0) version,d.actual_at,d.timezone,d.received_by,d.evidence_no,d.remark,d.idempotency_key,d.request_hash
+        FROM fl_loading_plan p JOIN fl_loading_plan_item i ON i.loading_plan_id=p.id AND i.deleted=0
+        LEFT JOIN fl_direct_delivery_unloading d ON d.container_booking_id=p.container_booking_id AND d.inbound_id=i.inbound_id
+        WHERE p.container_booking_id=#{id} AND p.plan_status='COMPLETED'
+        GROUP BY i.inbound_id,d.version,d.actual_at,d.timezone,d.received_by,d.evidence_no,d.remark,d.idempotency_key,d.request_hash
+        ORDER BY i.inbound_id
+        """)
+    List<Delivery> deliveries(@Param("id") long id);
+    @Select("SELECT COUNT(*) FROM fl_direct_delivery_unloading WHERE container_booking_id=#{id}")
+    int evidenceCount(@Param("id") long id);
+    @Select("SELECT COUNT(*) FROM fl_direct_delivery_unloading WHERE container_booking_id=#{id} AND idempotency_key=#{key}")
+    int keyCount(@Param("id") long id,@Param("key") String key);
+    @Insert("""
+        INSERT INTO fl_direct_delivery_unloading(container_booking_id,inbound_id,actual_at,timezone,received_by,
+          evidence_no,remark,version,idempotency_key,request_hash,created_by,created_by_name)
+        VALUES(#{id},#{inboundId},#{actualAt},#{timezone},#{receivedBy},#{evidenceNo},#{remark},1,#{key},#{hash},#{operatorId},#{operatorName})
+        """)
+    int insert(@Param("id") long id,@Param("inboundId") long inboundId,@Param("actualAt") LocalDateTime actualAt,
+        @Param("timezone") String timezone,@Param("receivedBy") String receivedBy,@Param("evidenceNo") String evidenceNo,
+        @Param("remark") String remark,@Param("key") String key,@Param("hash") String hash,
+        @Param("operatorId") long operatorId,@Param("operatorName") String operatorName);
+}
diff --git a/firstleg/src/main/java/com/baiyue/firstleg/terminaldrayage/mapper/TerminalDrayageMapper.java b/firstleg/src/main/java/com/baiyue/firstleg/terminaldrayage/mapper/TerminalDrayageMapper.java
index d835d49dc..b80cee070 100644
--- a/firstleg/src/main/java/com/baiyue/firstleg/terminaldrayage/mapper/TerminalDrayageMapper.java
+++ b/firstleg/src/main/java/com/baiyue/firstleg/terminaldrayage/mapper/TerminalDrayageMapper.java
@@ -15,7 +15,7 @@ import java.util.List;
 @Mapper
 public interface TerminalDrayageMapper extends BaseMapper<TerminalDrayageEntity> {
     @Select("""
-        SELECT c.id containerBookingId,c.booking_no bookingNo,c.container_no containerNo,
+        SELECT c.id containerBookingId,c.cabinet_no cabinetNo,c.container_no containerNo,
           c.destination_port_name destinationPortName,c.destination_warehouse_code destinationWarehouseCode,
           t.fleet_supplier_name fleetSupplierName,t.pickup_appointment_at pickupAppointmentAt,NULL actualPickupAt
         FROM fl_terminal_drayage t JOIN fl_container_booking c ON c.id=t.container_booking_id
@@ -27,6 +27,21 @@ public interface TerminalDrayageMapper extends BaseMapper<TerminalDrayageEntity>
     List<com.baiyue.firstleg.terminaldrayage.dto.PickupCalendarEntry> calendar(
         @Param("from") LocalDateTime from,@Param("to") LocalDateTime to,@Param("limit") int limit);
 
+    @Select("""
+        <script>
+        SELECT c.id containerBookingId,c.cabinet_no cabinetNo,c.container_no containerNo,
+          c.destination_port_name destinationPortName,c.destination_warehouse_code destinationWarehouseCode,
+          t.fleet_supplier_name fleetSupplierName,t.pickup_appointment_at pickupAppointmentAt,NULL actualPickupAt
+        FROM fl_container_booking c LEFT JOIN fl_terminal_drayage t ON t.container_booking_id=c.id
+        WHERE c.record_status='ACTIVE' AND c.id IN
+          <foreach collection='ids' item='id' open='(' separator=',' close=')'>#{id}</foreach>
+          AND EXISTS(SELECT 1 FROM fl_outbound_dispatch d WHERE d.container_booking_id=c.id
+            AND d.confirmed_at IS NOT NULL AND d.reversed_at IS NULL AND d.status='WAITING_FOR_LOADING')
+        ORDER BY c.id
+        </script>
+        """)
+    List<com.baiyue.firstleg.terminaldrayage.dto.PickupCalendarEntry> calendarByContainers(@Param("ids") List<Long> ids);
+
     @Select("""
         SELECT b.id AS containerBookingId,b.container_no AS containerNo,b.ocean_booking_id AS oceanBookingId,
                b.record_status AS recordStatus,b.unloading_completed_at AS unloadingCompletedAt
@@ -99,6 +114,16 @@ public interface TerminalDrayageMapper extends BaseMapper<TerminalDrayageEntity>
          ORDER BY created_at DESC,id DESC
         """)
     List<History> histories(@Param("containerBookingId") long containerBookingId);
+    record PickupChanges(long containerBookingId,long schedules,long fleets) { }
+    @Select("""
+        <script>SELECT container_booking_id,
+          SUM(CASE WHEN action='SCHEDULE_PICKUP' THEN 1 ELSE 0 END) schedules,
+          SUM(CASE WHEN action='SELECT_FLEET' THEN 1 ELSE 0 END) fleets
+        FROM fl_terminal_drayage_history WHERE container_booking_id IN
+        <foreach collection="ids" item="id" open="(" separator="," close=")">#{id}</foreach>
+        GROUP BY container_booking_id</script>
+        """)
+    List<PickupChanges> pickupChanges(@Param("ids") List<Long> ids);
 
     @Insert("""
         INSERT INTO fl_terminal_drayage_history(id,drayage_id,container_booking_id,action,from_status,to_status,
diff --git a/firstleg/src/main/java/com/baiyue/firstleg/terminaldrayage/service/AppointmentWorkTerminalFacts.java b/firstleg/src/main/java/com/baiyue/firstleg/terminaldrayage/service/AppointmentWorkTerminalFacts.java
new file mode 100644
index 000000000..efcc9bda9
--- /dev/null
+++ b/firstleg/src/main/java/com/baiyue/firstleg/terminaldrayage/service/AppointmentWorkTerminalFacts.java
@@ -0,0 +1,127 @@
+package com.baiyue.firstleg.terminaldrayage.service;
+
+import com.baiyue.firstleg.portschedule.dto.AppointmentWorkSourceDtos.*;
+import com.baiyue.firstleg.portschedule.service.AppointmentWorkSourceService.OriginalFacts;
+import com.baiyue.firstleg.portschedule.service.CarrierScheduleQueryService;
+import com.baiyue.firstleg.portschedule.dto.CarrierScheduleQueryDtos.ContainerActualFacts;
+import com.baiyue.firstleg.terminaldrayage.entity.TerminalDrayageEntity;
+import com.baiyue.firstleg.terminaldrayage.mapper.DirectDeliveryMapper;
+import com.baiyue.firstleg.terminaldrayage.mapper.TerminalDrayageMapper;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import org.springframework.stereotype.Component;
+import org.springframework.http.HttpStatus;
+import org.springframework.web.server.ResponseStatusException;
+import java.time.*;
+import java.security.MessageDigest;
+import java.util.*;
+
+/** The terminal domain adapts its facts to a wire port; the work service never imports its persistence. */
+@Component
+public class AppointmentWorkTerminalFacts implements OriginalFacts {
+    private static final String READ="platform:firstleg:terminal-drayage:list";
+    private final TerminalDrayageMapper terminal;
+    private final DirectDeliveryMapper direct;
+    private final CarrierScheduleQueryService nodes;
+    private final UnloadingEvidenceGuard unloading;
+    private final ObjectMapper json;
+    public AppointmentWorkTerminalFacts(TerminalDrayageMapper terminal,DirectDeliveryMapper direct,
+        CarrierScheduleQueryService nodes,UnloadingEvidenceGuard unloading,ObjectMapper json) {
+        this.terminal=terminal;this.direct=direct;this.nodes=nodes;this.unloading=unloading;this.json=json;
+    }
+    public Map<Long,String> establishedFlows(List<Long> ids) {
+        var result=new HashMap<Long,String>();
+        if(ids.isEmpty()) return result;
+        for(var row:direct.flowEvidence(ids)) {
+            boolean transfer=row.warehouseUnloadedAt()!=null;
+            boolean delivery=row.evidenceCount()>0;
+            if(transfer && delivery) throw new ResponseStatusException(HttpStatus.CONFLICT,"货柜存在冲突的中转和直送执行事实");
+            result.put(row.id(),transfer?"TRANSFER":delivery?"DIRECT":"UNKNOWN");
+        }
+        return result;
+    }
+    public List<Fact> read(List<FactRequest> requests,Map<Long,ContainerSource> sources) {
+        var ids=requests.stream().map(r->Long.parseLong(r.containerBookingId())).distinct().toList();
+        if(ids.isEmpty()) return List.of();
+        var actuals=new HashMap<Long,ContainerActualFacts>();
+        for(var row:nodes.containerActualFacts(ids)) actuals.put(row.containerBookingId(),row);
+        var plans=new HashMap<Long,TerminalDrayageEntity>();
+        for(var row:terminal.findAll(ids)) plans.put(row.getContainerBookingId(),row);
+        var pickupIds=requests.stream().filter(r->"PICKUP".equals(r.type())).map(r->Long.parseLong(r.containerBookingId())).distinct().toList();
+        var changes=new HashMap<Long,TerminalDrayageMapper.PickupChanges>();
+        if(!pickupIds.isEmpty()) for(var row:terminal.pickupChanges(pickupIds)) changes.put(row.containerBookingId(),row);
+        var deliveryIds=requests.stream().filter(r->"DELIVERY".equals(r.type())).map(r->Long.parseLong(r.containerBookingId())).distinct().toList();
+        var deliveries=new HashMap<Long,List<DirectDeliveryMapper.Delivery>>();
+        if(!deliveryIds.isEmpty()) for(var row:direct.deliveriesBatch(deliveryIds))
+            deliveries.computeIfAbsent(row.containerBookingId(),ignored->new ArrayList<>()).add(row.delivery());
+        var returnIds=requests.stream().filter(r->"EMPTY_RETURN".equals(r.type())).map(r->Long.parseLong(r.containerBookingId())).distinct()
+            .filter(id->(actuals.get(id)==null || actuals.get(id).emptyReturnedAt()==null)
+                && (plans.get(id)==null || plans.get(id).getActualEmptyReturnAt()==null)).toList();
+        var completed=returnIds.isEmpty()?Map.<Long,LocalDateTime>of():unloading.completedUnloading(returnIds);
+        return requests.stream().map(request->{
+            long id=Long.parseLong(request.containerBookingId());
+            return read(request,sources.get(id),actuals.get(id),plans.get(id),changes.get(id),
+                deliveries.getOrDefault(id,List.of()),completed.get(id));
+        }).toList();
+    }
+    private Fact read(FactRequest request,ContainerSource source,ContainerActualFacts node,TerminalDrayageEntity plan,
+        TerminalDrayageMapper.PickupChanges changes,List<DirectDeliveryMapper.Delivery> deliveries,LocalDateTime completedUnloading) {
+        var references=new ArrayList<Reference>();
+        source.requirements().forEach(r->r.references().forEach(ref->{if(!references.contains(ref))references.add(ref);}));
+        var blocks=new ArrayList<String>(); var missing=new ArrayList<String>();
+        LocalDateTime at=null; String zone=null; Slot confirmed=null; boolean exists=false;
+        String code=null,label=null,permission=null; Responsibility responsibility=null;
+        String businessNo=references.stream().filter(r->"CONTAINER".equals(r.kind())).map(Reference::businessNo).filter(Objects::nonNull).findFirst().orElse(null);
+        String impact="BASELINE";
+        switch(request.type()) {
+            case "PICKUP" -> {
+                at=node==null?null:node.pickedUpAt();
+                if(plan!=null && plan.getPickupAppointmentAt()!=null) {
+                    var time=plan.getPickupAppointmentAt(); confirmed=new Slot(time.toLocalDate(),time.toLocalTime(),null,null,null); exists=true;
+                }
+                if(plan!=null && plan.getFleetSupplierId()!=null)
+                    responsibility=new Responsibility("SUPPLIER",plan.getFleetSupplierId().toString(),plan.getFleetSupplierName());
+                // The initial arrangement/assignment establishes a baseline. Only later changes invalidate dependants.
+                long reschedules=Math.max(0,(changes==null?0:changes.schedules())-1);
+                long reassignments=Math.max(0,(changes==null?0:changes.fleets())-1);
+                impact=reschedules+":"+reassignments;
+                if(at==null) {
+                    if(node==null || node.arrivedDestinationPortAt()==null) blocks.add("实际到港后才能安排提柜");
+                    else if(plan==null || plan.getFleetSupplierId()==null) {code="SAVE_PLAN";label="选择码头车队";permission="platform:firstleg:terminal-drayage:fleet:edit";}
+                    else if(confirmed==null) {code="REQUEST_BOOKING";label="预约提柜";permission="platform:firstleg:terminal-drayage:pickup-appointment:edit";}
+                    else {code="RECORD_EXECUTION";label="记录实际提柜";permission="platform:firstleg:port-schedule-query:manual";}
+                }
+            }
+            case "EMPTY_RETURN" -> {
+                at=node==null?null:node.emptyReturnedAt();
+                if(at==null && plan!=null) at=plan.getActualEmptyReturnAt();
+                if(at==null && completedUnloading==null) blocks.add("海外仓卸柜或全部直送目的仓实际卸货后才能还空");
+                else if(at==null) {code="RECORD_EXECUTION";label="确认实际还空";permission="platform:firstleg:terminal-drayage:empty-return:confirm";}
+                // Return responsibility belongs to the work handoff, not the historical pickup carrier.
+            }
+            case "DELIVERY" -> {
+                var requirement=source.requirements().stream().filter(r->Objects.equals(r.requirementKey(),request.requirementKey())).findFirst()
+                    .orElseThrow(()->new ResponseStatusException(HttpStatus.CONFLICT,"直送需求与原柜来源不一致"));
+                references.clear(); references.addAll(requirement.references());
+                var row=deliveries.stream().filter(d->("INBOUND:"+d.inboundId()).equals(request.requirementKey())).findFirst()
+                    .orElseThrow(()->new ResponseStatusException(HttpStatus.CONFLICT,"直送需求与实际装柜来源不一致"));
+                at=row.actualAt();zone=row.timezone();businessNo=row.inboundCode();
+                if(at==null && (node==null || node.pickedUpAt()==null)) blocks.add("实际提柜后才能记录直送卸货");
+                else if(at==null) {code="RECORD_EXECUTION";label="登记目的仓实际卸货";permission="platform:firstleg:terminal-drayage:direct-unload:confirm";}
+            }
+            default -> throw new ResponseStatusException(HttpStatus.BAD_REQUEST,"不支持的Firstleg事实类型");
+        }
+        if((at!=null || confirmed!=null) && zone==null) missing.add("SOURCE_TIMEZONE");
+        Actual actual=at==null?null:new Actual(zone==null?null:at.atZone(ZoneId.of(zone)).toInstant(),at,zone);
+        Action action=code==null?null:new Action(code,label,null,new Target("FIRSTLEG_CONTAINER",source.containerBookingId()));
+        var fact=new Fact(request.workItemKey(),"pending",impact,exists,confirmed==null?"UNPLANNED":"CONFIRMED",
+            actual!=null?"COMPLETED":"PENDING",null,confirmed,actual,zone,businessNo,null,List.of(READ),
+            permission==null?List.of():List.of(permission),action,List.copyOf(blocks),List.copyOf(missing),List.copyOf(references),responsibility);
+        return new Fact(fact.workItemKey(),hash(fact),fact.impactToken(),fact.planExists(),fact.planStatus(),fact.executionStatus(),
+            fact.target(),fact.confirmed(),fact.actual(),fact.timezone(),fact.businessNo(),fact.tripKey(),fact.readPermissions(),
+            fact.actionPermissions(),fact.action(),fact.blockReasons(),fact.missingFields(),fact.references(),fact.responsibility());
+    }
+    private String hash(Object value) {
+        try{return HexFormat.of().formatHex(MessageDigest.getInstance("SHA-256").digest(json.writeValueAsBytes(value)));}
+        catch(Exception error){throw new IllegalStateException(error);}
+    }
+}
diff --git a/firstleg/src/main/java/com/baiyue/firstleg/terminaldrayage/service/DirectDeliveryRouteGuard.java b/firstleg/src/main/java/com/baiyue/firstleg/terminaldrayage/service/DirectDeliveryRouteGuard.java
new file mode 100644
index 000000000..85cc6b379
--- /dev/null
+++ b/firstleg/src/main/java/com/baiyue/firstleg/terminaldrayage/service/DirectDeliveryRouteGuard.java
@@ -0,0 +1,22 @@
+package com.baiyue.firstleg.terminaldrayage.service;
+
+import com.baiyue.firstleg.client.AppointmentWorkRouteClient;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.stereotype.Service;
+import org.springframework.http.HttpStatus;
+import org.springframework.web.server.ResponseStatusException;
+
+@Service
+public class DirectDeliveryRouteGuard {
+    private final AppointmentWorkRouteClient client;
+    private final String token;
+    public DirectDeliveryRouteGuard(AppointmentWorkRouteClient client,@Value("${baiyue.security.internal-service-token:}") String token){this.client=client;this.token=token;}
+    public void requireDirect(long id) {
+        if(token==null || token.isBlank()) throw unavailable();
+        com.baiyue.common.core.api.ApiResponse<AppointmentWorkRouteClient.Route> response;
+        try {response=client.route(token,id);} catch(RuntimeException error){throw unavailable();}
+        if(response==null || !response.successful() || response.data()==null) throw unavailable();
+        if(!"DIRECT".equals(response.data().flow())) throw new ResponseStatusException(HttpStatus.CONFLICT,"请先在预约工作中确认整柜直送路线");
+    }
+    private ResponseStatusException unavailable(){return new ResponseStatusException(HttpStatus.SERVICE_UNAVAILABLE,"无法核实已确认路线，请稍后重试");}
+}
diff --git a/firstleg/src/main/java/com/baiyue/firstleg/terminaldrayage/service/DirectDeliveryService.java b/firstleg/src/main/java/com/baiyue/firstleg/terminaldrayage/service/DirectDeliveryService.java
new file mode 100644
index 000000000..da5e2cb91
--- /dev/null
+++ b/firstleg/src/main/java/com/baiyue/firstleg/terminaldrayage/service/DirectDeliveryService.java
@@ -0,0 +1,77 @@
+package com.baiyue.firstleg.terminaldrayage.service;
+
+import com.baiyue.common.core.api.ResultCode;
+import com.baiyue.common.core.exception.BizException;
+import com.baiyue.firstleg.portschedule.service.CarrierScheduleQueryService;
+import com.baiyue.firstleg.terminaldrayage.mapper.DirectDeliveryMapper;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import jakarta.validation.constraints.*;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Transactional;
+import java.security.MessageDigest;
+import java.time.*;
+import java.util.*;
+
+/** Actual direct delivery evidence. It does not call warehouse receipt or create stock. */
+@Service
+public class DirectDeliveryService {
+    public record Request(@Min(0) int expectedVersion,@NotNull LocalDateTime actualAt,@NotBlank String timezone,
+        @NotBlank @Size(max=128) String receivedBy,@NotBlank @Size(max=128) String evidenceNo,@Size(max=1000) String remark) { }
+    public record View(String requirementKey,String inboundCode,String orderNo,String destinationName,int packageCount,
+        int version,LocalDateTime actualAt,String timezone,String receivedBy,String evidenceNo,String remark) { }
+    private final DirectDeliveryMapper mapper;
+    private final CarrierScheduleQueryService nodes;
+    private final ObjectMapper json;
+    private final DirectDeliveryRouteGuard routes;
+    public DirectDeliveryService(DirectDeliveryMapper mapper,CarrierScheduleQueryService nodes,ObjectMapper json,DirectDeliveryRouteGuard routes) {
+        this.mapper=mapper;this.nodes=nodes;this.json=json;this.routes=routes;
+    }
+    public List<View> list(long id) {
+        var container=mapper.container(id);
+        if(container==null || !"ACTIVE".equals(container.recordStatus())) throw new BizException(ResultCode.NOT_FOUND,"货柜不存在");
+        return mapper.deliveries(id).stream().map(this::view).toList();
+    }
+    @Transactional
+    public View record(long id,long inboundId,long operatorId,String operatorName,String key,Request request) {
+        if(key==null || key.isBlank() || key.length()>128 || request==null) throw bad("请提供有效幂等键及卸货记录");
+        var container=mapper.lockContainer(id);
+        if(container==null || !"ACTIVE".equals(container.recordStatus())) throw new BizException(ResultCode.NOT_FOUND,"货柜不存在");
+        var current=mapper.deliveries(id).stream().filter(row->row.inboundId()==inboundId).findFirst()
+            .orElseThrow(()->bad("该入仓来源不在本柜实际装柜清单内"));
+        String hash=hash(request);
+        if(key.equals(current.idempotencyKey())) {
+            if(!hash.equals(current.requestHash())) throw conflict("同一幂等键对应的卸货内容已变化");
+            return view(current);
+        }
+        if(mapper.keyCount(id,key)>0) throw conflict("幂等键已被其他卸货记录使用");
+        if(current.version()!=request.expectedVersion() || current.actualAt()!=null) throw conflict("实际卸货已确认，请刷新核对");
+        if(container.warehouseUnloadedAt()!=null) throw conflict("已有海外仓卸柜事实，不能改记为直送");
+        routes.requireDirect(id);
+        ZoneId zone;
+        try {if(!ZoneId.getAvailableZoneIds().contains(request.timezone())) throw new IllegalArgumentException(); zone=ZoneId.of(request.timezone());} catch(RuntimeException e){throw bad("请选择有效目的地时区");}
+        if(request.actualAt()==null || zone.getRules().getValidOffsets(request.actualAt()).size()!=1)
+            throw bad("实际卸货时间缺失或处于夏令时歧义区间，请核对");
+        if(request.actualAt().atZone(zone).toInstant().isAfter(Instant.now())) throw bad("实际卸货时间不能在未来");
+        if(request.receivedBy()==null || request.receivedBy().isBlank() || request.evidenceNo()==null || request.evidenceNo().isBlank())
+            throw bad("请填写真实签收人及签收凭据号");
+        var facts=nodes.containerActualFacts(List.of(id));
+        var fact=facts.stream().filter(f->f.containerBookingId()==id).findFirst().orElse(null);
+        if(fact==null || fact.pickedUpAt()==null) throw conflict("实际提柜后才能记录直送卸货");
+        if(fact.emptyReturnedAt()!=null) throw conflict("货柜已实际还空，不能新增卸货事实");
+        // Pickup has no source zone. Its local clock cannot order a destination-zone actual;
+        // require the real pickup fact, without inventing an offset for it.
+        mapper.insert(id,inboundId,request.actualAt(),zone.getId(),request.receivedBy().trim(),request.evidenceNo().trim(),
+            request.remark(),key,hash,operatorId,operatorName);
+        return mapper.deliveries(id).stream().filter(row->row.inboundId()==inboundId).findFirst().map(this::view).orElseThrow();
+    }
+    private View view(DirectDeliveryMapper.Delivery row) {
+        return new View("INBOUND:"+row.inboundId(),row.inboundCode(),row.orderNo(),row.destinationName(),row.packageCount(),
+            row.version(),row.actualAt(),row.timezone(),row.receivedBy(),row.evidenceNo(),row.remark());
+    }
+    private String hash(Object value) {
+        try{return HexFormat.of().formatHex(MessageDigest.getInstance("SHA-256").digest(json.writeValueAsBytes(value)));}
+        catch(Exception e){throw new IllegalStateException(e);}
+    }
+    private static BizException bad(String message){return new BizException(ResultCode.BAD_REQUEST,message);}
+    private static BizException conflict(String message){return new BizException(ResultCode.CONFLICT,message);}
+}
diff --git a/firstleg/src/main/java/com/baiyue/firstleg/terminaldrayage/service/TerminalDrayageCalendarService.java b/firstleg/src/main/java/com/baiyue/firstleg/terminaldrayage/service/TerminalDrayageCalendarService.java
index 46873bc55..346e51f23 100644
--- a/firstleg/src/main/java/com/baiyue/firstleg/terminaldrayage/service/TerminalDrayageCalendarService.java
+++ b/firstleg/src/main/java/com/baiyue/firstleg/terminaldrayage/service/TerminalDrayageCalendarService.java
@@ -23,11 +23,18 @@ public class TerminalDrayageCalendarService {
         @Value("${baiyue.security.internal-service-token}") String token) {this.mapper=mapper;this.warehouses=warehouses;this.shipping=shipping;this.token=token;}
     public record Calendar(List<PickupCalendarEntry> records,boolean truncated,int unclassifiedCount,
                            String scopeBasis,String timeBasis) { }
+    @org.springframework.transaction.annotation.Transactional(readOnly=true)
     public Calendar calendar(LocalDate from,LocalDate to) {
         if(from==null || to==null || !to.isAfter(from) || ChronoUnit.DAYS.between(from,to)>42)
             throw new ResponseStatusException(HttpStatus.BAD_REQUEST,"日历查询范围必须为1至42天");
-        var rows=mapper.calendar(from.atStartOfDay(),to.atStartOfDay(),1001);
-        if(rows.isEmpty()) return result(List.of(),false,0);
+        var planned=mapper.calendar(from.atStartOfDay(),to.atStartOfDay(),1001);
+        var actualIds=shipping.pickupCalendarContainers(from.atStartOfDay(),to.atStartOfDay());
+        var candidates=new LinkedHashMap<Long,PickupCalendarEntry>();
+        planned.stream().limit(1000).forEach(row->candidates.put(row.containerBookingId(),row));
+        if(!actualIds.isEmpty()) mapper.calendarByContainers(actualIds.stream().limit(1000).toList())
+            .forEach(row->candidates.put(row.containerBookingId(),row));
+        boolean truncated=planned.size()>1000 || actualIds.size()>1000;
+        if(candidates.isEmpty()) return result(List.of(),truncated,0);
         final Map<String,String> countries=new HashMap<>();
         try {
             var response=warehouses.catalog(token);
@@ -36,7 +43,7 @@ public class TerminalDrayageCalendarService {
                 countries.put(warehouse.warehouseCode(),warehouse.countryCode());
         } catch(RuntimeException error) {throw new ResponseStatusException(HttpStatus.SERVICE_UNAVAILABLE,"提柜目的仓范围暂不可核实",error);}
         var records=new ArrayList<PickupCalendarEntry>();int unknown=0;
-        for(var row:rows.stream().limit(1000).toList()) {
+        for(var row:candidates.values()) {
             var country=countries.get(row.destinationWarehouseCode());
             if(country==null || country.isBlank()) unknown++;
             else if("US".equals(country)) records.add(row);
@@ -47,9 +54,14 @@ public class TerminalDrayageCalendarService {
             for(var fact:shipping.containerActualFacts(ids.subList(start,Math.min(start+200,ids.size()))))
                 if(fact.pickedUpAt()!=null) actual.put(fact.containerBookingId(),fact.pickedUpAt());
         }
-        var enriched=records.stream().map(row->new PickupCalendarEntry(row.containerBookingId(),row.bookingNo(),row.containerNo(),
-            row.destinationPortName(),row.destinationWarehouseCode(),row.fleetSupplierName(),row.pickupAppointmentAt(),actual.get(row.containerBookingId()))).toList();
-        return result(enriched,rows.size()>1000,unknown);
+        var enriched=records.stream().map(row->new PickupCalendarEntry(row.containerBookingId(),row.cabinetNo(),row.containerNo(),
+            row.destinationPortName(),row.destinationWarehouseCode(),row.fleetSupplierName(),row.pickupAppointmentAt(),actual.get(row.containerBookingId())))
+            .filter(row->{var at=occurrence(row);return at!=null && !at.isBefore(from.atStartOfDay()) && at.isBefore(to.atStartOfDay());})
+            .sorted(Comparator.comparing(TerminalDrayageCalendarService::occurrence).thenComparing(PickupCalendarEntry::containerBookingId)).toList();
+        return result(enriched.stream().limit(1000).toList(),truncated || enriched.size()>1000,unknown);
+    }
+    private static java.time.LocalDateTime occurrence(PickupCalendarEntry row) {
+        return row.actualPickupAt()!=null?row.actualPickupAt():row.pickupAppointmentAt();
     }
     private Calendar result(List<PickupCalendarEntry> records,boolean truncated,int unknown) {
         return new Calendar(List.copyOf(records),truncated,unknown,"US_DESTINATION_WAREHOUSE","SOURCE_LOCAL_UNSPECIFIED");
diff --git a/firstleg/src/main/java/com/baiyue/firstleg/terminaldrayage/service/TerminalDrayageService.java b/firstleg/src/main/java/com/baiyue/firstleg/terminaldrayage/service/TerminalDrayageService.java
index 2035ae70f..639405693 100644
--- a/firstleg/src/main/java/com/baiyue/firstleg/terminaldrayage/service/TerminalDrayageService.java
+++ b/firstleg/src/main/java/com/baiyue/firstleg/terminaldrayage/service/TerminalDrayageService.java
@@ -48,6 +48,7 @@ public class TerminalDrayageService {
     private final CarrierScheduleQueryService carrierSchedules;
     private final ObjectMapper objectMapper;
     private final TerminalDrayageMailService mails;
+    private final UnloadingEvidenceGuard unloadingEvidence;
     private Clock clock = Clock.systemDefaultZone();
 
     public View detail(long containerBookingId) {
@@ -145,10 +146,10 @@ public class TerminalDrayageService {
         TerminalDrayageEntity value = mapper.lock(containerBookingId);
         requireVersion(value, request.expectedVersion());
         LocalDateTime pickupAt = actualPickupAt(context, value);
-        if (context.base().unloadingCompletedAt() == null) throw conflict("海外卸柜收货完成后才能确认还柜");
-        LocalDateTime earliest = pickupAt != null && pickupAt.isAfter(context.base().unloadingCompletedAt())
-            ? pickupAt : context.base().unloadingCompletedAt();
-        if (request.actualAt().isBefore(earliest)) throw badRequest("实际还柜时间不能早于提柜或卸柜完成时间");
+        if (completedUnloading(context) == null) throw conflict("海外仓卸柜或全部直送目的仓实际卸货完成后才能确认还柜");
+        LocalDateTime earliest = context.base().unloadingCompletedAt();
+        if (pickupAt != null && (earliest == null || pickupAt.isAfter(earliest))) earliest = pickupAt;
+        if (earliest != null && request.actualAt().isBefore(earliest)) throw badRequest("实际还柜时间不能早于提柜或卸柜完成时间");
         if (actualEmptyReturnAt(context, value) != null) throw conflict("实际还柜时间已确认");
         advanceNode(context, CarrierScheduleNode.EMPTY_RETURNED, request.actualAt(), action, key,
             request.remark(), operatorId, operatorName);
@@ -229,23 +230,25 @@ public class TerminalDrayageService {
     }
 
     private void applyAuthoritativeDeadline(WorkContext context, TerminalDrayageEntity value) {
-        if (context.base().unloadingCompletedAt() != null) {
-            value.setEstimatedEmptyReturnAt(context.base().unloadingCompletedAt().plusHours(EMPTY_RETURN_WARNING_HOURS));
+        if (completedUnloading(context) != null) {
+            value.setEstimatedEmptyReturnAt(returnDeadline(context));
         }
     }
 
     private View view(WorkContext context, TerminalDrayageEntity value) {
         String status = status(context, value);
-        LocalDateTime deadline = context.base().unloadingCompletedAt() == null ? null
-            : context.base().unloadingCompletedAt().plusHours(EMPTY_RETURN_WARNING_HOURS);
+        LocalDateTime deadline = returnDeadline(context);
+        Duration remaining = deadline == null ? null : context.directCompletion() == null
+            ? Duration.between(LocalDateTime.now(clock), deadline)
+            : Duration.between(clock.instant(), context.directCompletion().instant().plus(Duration.ofHours(EMPTY_RETURN_WARNING_HOURS)));
         LocalDateTime returnedAt = actualEmptyReturnAt(context, value);
         String warningStatus;
         long overdueHours = 0;
         if (returnedAt != null) warningStatus = "RESOLVED";
         else if (deadline == null) warningStatus = "NOT_APPLICABLE";
-        else if (LocalDateTime.now(clock).isAfter(deadline)) {
+        else if (remaining.isNegative()) {
             warningStatus = "OVERDUE";
-            overdueHours = Math.max(0, Duration.between(deadline, LocalDateTime.now(clock)).toHours());
+            overdueHours = Math.max(0, remaining.negated().toHours());
         } else warningStatus = "PENDING";
         Warning warning = new Warning(warningStatus, deadline, overdueHours, overdueHours / 24);
         return new View(context.base().containerBookingId(), context.base().containerNo(), context.base().oceanBookingId(), status,
@@ -253,14 +256,14 @@ public class TerminalDrayageService {
             value == null ? null : value.getFleetSupplierName(),
             value == null ? null : value.getPickupAppointmentAt(),
             actualPickupAt(context, value), deadline, returnedAt,
-            context.base().unloadingCompletedAt(), warning, allowedActions(context, value), context.facts(),
+            completedUnloading(context), warning, allowedActions(context, value), context.facts(),
             value == null ? null : value.getUpdatedAt());
     }
 
     private List<String> allowedActions(WorkContext context, TerminalDrayageEntity value) {
         List<String> result = new ArrayList<>();
         if (value != null && value.getFleetSupplierId() != null && actualPickupAt(context, value) == null
-            && actualEmptyReturnAt(context, value) == null && context.base().unloadingCompletedAt() == null) result.add("SEND_PICKUP_EMAIL");
+            && actualEmptyReturnAt(context, value) == null && completedUnloading(context) == null) result.add("SEND_PICKUP_EMAIL");
         CarrierScheduleNode current = currentNode(context);
         if (current != null && current.sequence() >= CarrierScheduleNode.ARRIVED_DESTINATION_PORT.sequence()
             && current.sequence() < CarrierScheduleNode.PICKED_UP.sequence()
@@ -268,14 +271,14 @@ public class TerminalDrayageService {
             result.add("SELECT_FLEET");
             if (value != null && value.getFleetSupplierId() != null) result.add("SCHEDULE_PICKUP");
         }
-        if (context.base().unloadingCompletedAt() != null
+        if (completedUnloading(context) != null
             && actualEmptyReturnAt(context, value) == null) result.add("RECORD_EMPTY_RETURN");
         return List.copyOf(result);
     }
 
     private String status(WorkContext context, TerminalDrayageEntity value) {
         if (actualEmptyReturnAt(context, value) != null) return "EMPTY_RETURNED";
-        if (context.base().unloadingCompletedAt() != null) return "UNLOADED";
+        if (completedUnloading(context) != null) return "UNLOADED";
         if (actualPickupAt(context, value) != null) return "PICKED_UP";
         if (value != null && value.getPickupAppointmentAt() != null) return "PICKUP_SCHEDULED";
         CarrierScheduleNode current = currentNode(context);
@@ -300,6 +303,14 @@ public class TerminalDrayageService {
         return context.facts() == null ? null : node(context.facts().latestActualNode());
     }
 
+    private LocalDateTime completedUnloading(WorkContext context) {
+        return context.completedUnloadingAt();
+    }
+    private LocalDateTime returnDeadline(WorkContext context) {
+        if(context.directCompletion()!=null) return context.directCompletion().deadline(EMPTY_RETURN_WARNING_HOURS);
+        return completedUnloading(context)==null?null:completedUnloading(context).plusHours(EMPTY_RETURN_WARNING_HOURS);
+    }
+
     private LocalDateTime actualPickupAt(WorkContext context, TerminalDrayageEntity value) {
         if (context.facts() != null && context.facts().pickedUpAt() != null) return context.facts().pickedUpAt();
         return context.base().unloadingCompletedAt();
@@ -334,10 +345,12 @@ public class TerminalDrayageService {
 
     private WorkContext context(Context base, ContainerActualFacts facts) {
         if (base == null || !"ACTIVE".equals(base.recordStatus())) return null;
-        return new WorkContext(base, facts);
+        var direct=base.unloadingCompletedAt()==null?unloadingEvidence.directCompletion(base.containerBookingId()):null;
+        return new WorkContext(base, facts,base.unloadingCompletedAt()!=null?base.unloadingCompletedAt():direct==null?null:direct.localAt(),direct);
     }
 
-    private record WorkContext(Context base, ContainerActualFacts facts) {}
+    private record WorkContext(Context base, ContainerActualFacts facts,LocalDateTime completedUnloadingAt,
+        UnloadingEvidenceGuard.DirectCompletion directCompletion) {}
 
     private TerminalDrayageEntity requiredAggregate(long id) {
         TerminalDrayageEntity value = mapper.lock(id);
diff --git a/firstleg/src/main/java/com/baiyue/firstleg/terminaldrayage/service/UnloadingEvidenceGuard.java b/firstleg/src/main/java/com/baiyue/firstleg/terminaldrayage/service/UnloadingEvidenceGuard.java
new file mode 100644
index 000000000..27c3d6173
--- /dev/null
+++ b/firstleg/src/main/java/com/baiyue/firstleg/terminaldrayage/service/UnloadingEvidenceGuard.java
@@ -0,0 +1,63 @@
+package com.baiyue.firstleg.terminaldrayage.service;
+
+import com.baiyue.firstleg.portschedule.service.EmptyReturnPrerequisite;
+import com.baiyue.firstleg.terminaldrayage.mapper.DirectDeliveryMapper;
+import com.baiyue.common.core.api.ResultCode;
+import com.baiyue.common.core.exception.BizException;
+import org.springframework.stereotype.Service;
+import java.time.*;
+import java.util.*;
+
+@Service
+public class UnloadingEvidenceGuard implements EmptyReturnPrerequisite {
+    private final DirectDeliveryMapper mapper;
+    public UnloadingEvidenceGuard(DirectDeliveryMapper mapper){this.mapper=mapper;}
+    public record DirectCompletion(LocalDateTime localAt,String timezone) {
+        public Instant instant(){return localAt.atZone(ZoneId.of(timezone)).toInstant();}
+        public LocalDateTime deadline(int hours){return instant().plus(Duration.ofHours(hours)).atZone(ZoneId.of(timezone)).toLocalDateTime();}
+    }
+    public DirectCompletion directCompletion(long id) {
+        return directCompletion(mapper.deliveries(id));
+    }
+    private DirectCompletion directCompletion(List<DirectDeliveryMapper.Delivery> rows) {
+        if(rows.isEmpty() || rows.stream().anyMatch(row->row.actualAt()==null)) return null;
+        return rows.stream().map(row->new DirectCompletion(row.actualAt(),row.timezone()))
+            .max(java.util.Comparator.comparing(DirectCompletion::instant)).orElse(null);
+    }
+    public Map<Long,LocalDateTime> completedUnloading(List<Long> ids) {
+        var result=new HashMap<Long,LocalDateTime>();
+        if(ids.isEmpty()) return result;
+        var pending=new ArrayList<Long>();
+        for(var container:mapper.containers(ids)) {
+            if(!"ACTIVE".equals(container.recordStatus())) continue;
+            if(container.warehouseUnloadedAt()!=null) result.put(container.id(),container.warehouseUnloadedAt());
+            else pending.add(container.id());
+        }
+        if(!pending.isEmpty()) {
+            var deliveries=new HashMap<Long,List<DirectDeliveryMapper.Delivery>>();
+            for(var row:mapper.deliveriesBatch(pending)) deliveries.computeIfAbsent(row.containerBookingId(),ignored->new ArrayList<>()).add(row.delivery());
+            for(long id:pending) {
+                var completed=directCompletion(deliveries.getOrDefault(id,List.of()));
+                if(completed!=null) result.put(id,completed.localAt());
+            }
+        }
+        return result;
+    }
+    public LocalDateTime completedUnloading(long id) {
+        var container=mapper.container(id);
+        if(container==null || !"ACTIVE".equals(container.recordStatus())) return null;
+        if(container.warehouseUnloadedAt()!=null) return container.warehouseUnloadedAt();
+        var direct=directCompletion(id);
+        return direct==null?null:direct.localAt();
+    }
+    public void requireUnloaded(long id,LocalDateTime returnedAt) {
+        var container=mapper.lockContainer(id);
+        if(container==null) throw new BizException(ResultCode.NOT_FOUND,"货柜不存在");
+        LocalDateTime completed=completedUnloading(id);
+        if(completed==null) throw new BizException(ResultCode.CONFLICT,"海外仓卸柜或全部直送目的仓实际卸货完成后才能确认还柜");
+        // Original return nodes have no zone. Preserve the existing warehouse-local check,
+        // but do not compare that unzoned value with another destination's wall clock.
+        if(container.warehouseUnloadedAt()!=null && returnedAt.isBefore(completed))
+            throw new BizException(ResultCode.BAD_REQUEST,"实际还柜时间不能早于卸货完成时间");
+    }
+}
diff --git a/firstleg/src/main/resources/db/phase3-channel-container-migration.sql b/firstleg/src/main/resources/db/phase3-channel-container-migration.sql
index c7ca8bad3..5cde7af51 100644
--- a/firstleg/src/main/resources/db/phase3-channel-container-migration.sql
+++ b/firstleg/src/main/resources/db/phase3-channel-container-migration.sql
@@ -94,7 +94,7 @@ BEGIN
   SELECT MAX(plan_status) INTO current_plan_status
     FROM fl_loading_plan WHERE container_booking_id = OLD.id;
   IF current_plan_status IN ('LOADING', 'COMPLETED') AND (
-       NOT (OLD.id <=> NEW.id) OR NOT (OLD.booking_no <=> NEW.booking_no)
+       NOT (OLD.id <=> NEW.id)
     OR NOT (OLD.cabinet_no <=> NEW.cabinet_no)
     OR NOT (OLD.channel_group_code <=> NEW.channel_group_code)
     OR NOT (OLD.channel_code <=> NEW.channel_code) OR NOT (OLD.channel_name <=> NEW.channel_name)
diff --git a/firstleg/src/main/resources/db/phase3-direct-delivery-schema.sql b/firstleg/src/main/resources/db/phase3-direct-delivery-schema.sql
new file mode 100644
index 000000000..537561dbf
--- /dev/null
+++ b/firstleg/src/main/resources/db/phase3-direct-delivery-schema.sql
@@ -0,0 +1,19 @@
+-- Current schema for actual destination unloading; never an overseas warehouse receipt.
+CREATE TABLE IF NOT EXISTS fl_direct_delivery_unloading (
+  container_booking_id BIGINT UNSIGNED NOT NULL,
+  inbound_id BIGINT UNSIGNED NOT NULL COMMENT 'Immutable physically loaded inbound source',
+  actual_at DATETIME(3) NOT NULL COMMENT 'Actual destination local time',
+  timezone VARCHAR(64) NOT NULL COMMENT 'Explicit destination IANA timezone',
+  received_by VARCHAR(128) NOT NULL COMMENT 'Actual recipient',
+  evidence_no VARCHAR(128) NOT NULL COMMENT 'Actual delivery receipt reference',
+  remark VARCHAR(1000) NULL,
+  version INT NOT NULL DEFAULT 1,
+  idempotency_key VARCHAR(128) NOT NULL,
+  request_hash CHAR(64) NOT NULL,
+  created_by BIGINT UNSIGNED NOT NULL,
+  created_by_name VARCHAR(64) NULL,
+  created_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+  PRIMARY KEY (container_booking_id,inbound_id),
+  UNIQUE KEY uk_direct_unloading_command (container_booking_id,idempotency_key),
+  CONSTRAINT fk_direct_unloading_container FOREIGN KEY (container_booking_id) REFERENCES fl_container_booking(id)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci COMMENT='直送目的仓真实卸货凭据';
diff --git a/firstleg/src/main/resources/db/phase3-smart-loading-schema.sql b/firstleg/src/main/resources/db/phase3-smart-loading-schema.sql
index cbb43637f..8d264ff4a 100644
--- a/firstleg/src/main/resources/db/phase3-smart-loading-schema.sql
+++ b/firstleg/src/main/resources/db/phase3-smart-loading-schema.sql
@@ -35,7 +35,6 @@ CREATE TABLE IF NOT EXISTS fl_document_sequence (
 
 CREATE TABLE IF NOT EXISTS fl_container_booking (
   id BIGINT UNSIGNED NOT NULL COMMENT '货柜预订ID（雪花ID）',
-  booking_no VARCHAR(40) NOT NULL COMMENT '平台唯一货柜预订单号',
   container_no VARCHAR(64) NULL COMMENT '国内柜次真实集装箱号权威快照；ISO 6346标准格式；同一订舱内唯一，不同提单允许复用；订舱关联可选写入、提柜后可原子补录、预装纠错命令可修改',
   cabinet_no VARCHAR(64) NOT NULL COMMENT '平台唯一内部柜号',
   source_type VARCHAR(24) NOT NULL DEFAULT 'SIMULATION' COMMENT '记录来源：SIMULATION内部模拟柜、OCEAN_BOOKING订舱真实柜',
@@ -90,7 +89,6 @@ CREATE TABLE IF NOT EXISTS fl_container_booking (
   updated_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3) COMMENT '货柜资料最后更新时间',
   version INT UNSIGNED NOT NULL DEFAULT 0 COMMENT '乐观锁版本号',
   PRIMARY KEY (id),
-  UNIQUE KEY uk_container_booking_no (booking_no),
   UNIQUE KEY uk_container_booking_cabinet (cabinet_no),
   UNIQUE KEY uk_container_booking_ocean_container (ocean_booking_id,container_no),
   KEY idx_container_booking_container_no (container_no,updated_at,id),
@@ -895,7 +893,7 @@ BEGIN
   SELECT MAX(plan_status) INTO current_plan_status
     FROM fl_loading_plan WHERE container_booking_id = OLD.id;
   IF current_plan_status IN ('LOADING', 'COMPLETED') AND (
-       NOT (OLD.id <=> NEW.id) OR NOT (OLD.booking_no <=> NEW.booking_no)
+       NOT (OLD.id <=> NEW.id)
     OR NOT (OLD.cabinet_no <=> NEW.cabinet_no)
     OR NOT (OLD.channel_code <=> NEW.channel_code)
     OR NOT (OLD.channel_name <=> NEW.channel_name)
@@ -1542,9 +1540,9 @@ BEGIN
   END IF;
   IF (SELECT COUNT(*) FROM information_schema.columns
        WHERE table_schema = 'baiyue_firstleg' AND table_name = 'fl_container_booking'
-         AND column_name IN ('booking_no', 'cabinet_no', 'warehouse_id', 'bill_of_lading_no',
+         AND column_name IN ('cabinet_no', 'warehouse_id', 'bill_of_lading_no',
                              'vessel_name', 'voyage_no', 'container_type', 'capacity_cbm',
-                             'max_weight_kg', 'terminal_trucking_company_id', 'terminal_trucking_company')) <> 11 THEN
+                             'max_weight_kg', 'terminal_trucking_company_id', 'terminal_trucking_company')) <> 10 THEN
     SIGNAL SQLSTATE '45000' SET MESSAGE_TEXT = '智能装柜迁移失败：货柜原型字段缺失';
   END IF;
   IF (SELECT COUNT(*) FROM information_schema.columns
diff --git a/firstleg/src/main/resources/openapi/appointment-work-source-v1.yaml b/firstleg/src/main/resources/openapi/appointment-work-source-v1.yaml
new file mode 100644
index 000000000..ea5898aaf
--- /dev/null
+++ b/firstleg/src/main/resources/openapi/appointment-work-source-v1.yaml
@@ -0,0 +1,178 @@
+openapi: 3.0.3
+info: {title: Firstleg appointment work authoritative sources, version: 1.0.0}
+security: [{InternalServiceToken: []}]
+paths:
+  /internal/firstleg/appointment-work/containers:
+    get:
+      summary: Complete actual-sailed container scope
+      description: Includes missing warehouses, private destinations and stopped tracking tasks. An actual departure or later maritime milestone is required. GET never creates work. Scope-versioned cursors reject changes between pages with 409; consumers restart a full scan. Original local times without a source timezone are never converted to UTC.
+      parameters:
+        - {name: after, in: query, schema: {type: string, maxLength: 128}}
+        - {name: size, in: query, schema: {type: integer, minimum: 1, maximum: 200, default: 200}}
+      responses:
+        '200':
+          description: ApiResponse
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  data: {$ref: '#/components/schemas/SourcePage'}
+        '401': {description: Invalid internal service identity}
+        '409': {description: Scope changed; restart from the first page}
+  /internal/firstleg/appointment-work/containers/{id}:
+    get:
+      summary: Read one authoritative sailed container and physical cargo lineage
+      parameters: [{name: id, in: path, required: true, schema: {type: integer, format: int64, minimum: 1}}]
+      responses:
+        '200':
+          description: ApiResponse
+          content:
+            application/json:
+              schema:
+                type: object
+                properties: {data: {$ref: '#/components/schemas/ContainerSource'}}
+        '401': {description: Invalid internal service identity}
+        '404': {description: No active actual-sailed source}
+  /internal/firstleg/appointment-work/facts:
+    post:
+      summary: Read pickup, direct unloading and empty-return facts; no writes
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema: {type: array, minItems: 1, maxItems: 200, items: {$ref: '#/components/schemas/FactRequest'}}
+      responses:
+        '200':
+          description: Exactly one result per requested work key, never a partial success
+          content:
+            application/json:
+              schema:
+                type: object
+                properties: {data: {type: array, items: {$ref: '#/components/schemas/Fact'}}}
+        '400': {description: Invalid type or duplicate identity}
+        '401': {description: Invalid internal service identity}
+        '409': {description: Direct requirement does not match physical cargo}
+components:
+  securitySchemes:
+    InternalServiceToken: {type: apiKey, in: header, name: X-Internal-Service-Token}
+  schemas:
+    Reference:
+      type: object
+      required: [kind, key, label]
+      properties:
+        kind: {type: string}
+        key: {type: string, description: Internal association only}
+        businessNo: {type: string, nullable: true}
+        label: {type: string}
+    SourceReference:
+      type: object
+      properties:
+        customerId: {type: string}
+        sourceKey: {type: string}
+        destinationKey: {type: string, nullable: true}
+    Requirement:
+      type: object
+      required: [requirementKey, references, replacesRequirementKeys, sources]
+      properties:
+        requirementKey: {type: string, description: 'Immutable INBOUND:<physical inbound id>'}
+        batchKey: {type: string, nullable: true}
+        batchNo: {type: string, nullable: true}
+        destinationKind: {type: string, nullable: true}
+        originName: {type: string, nullable: true}
+        destinationName: {type: string, nullable: true}
+        timezone: {type: string, nullable: true}
+        references: {type: array, items: {$ref: '#/components/schemas/Reference'}}
+        replacesRequirementKeys: {type: array, items: {type: string}}
+        sources: {type: array, items: {$ref: '#/components/schemas/SourceReference'}, description: Empty until Lastleg resolves its canonical source; domestic ORDER references are not tail-leg ORDER keys}
+    ContainerSource:
+      type: object
+      required: [containerBookingId, sourceVersion, establishedFlow, requirements]
+      properties:
+        containerBookingId: {type: string}
+        containerNo: {type: string, nullable: true}
+        departedAt: {type: string, format: date-time, nullable: true}
+        departedLocalAt: {type: string, nullable: true, description: Exact actual departure only; source local timestamp without offset}
+        sailedEvidenceLocalAt: {type: string, nullable: true, description: Actual departure-or-later node proving sailed eligibility; never presented as an actual departure time}
+        sourceVersion: {type: string}
+        establishedFlow: {type: string, enum: [UNKNOWN, DIRECT, TRANSFER]}
+        timezone: {type: string, nullable: true}
+        requirements: {type: array, items: {$ref: '#/components/schemas/Requirement'}}
+    SourcePage:
+      type: object
+      required: [containers, complete, scopeVersion]
+      properties:
+        containers: {type: array, items: {$ref: '#/components/schemas/ContainerSource'}}
+        nextCursor: {type: string, nullable: true}
+        complete: {type: boolean}
+        scopeVersion: {type: string}
+    ContainerReference:
+      type: object
+      properties:
+        containerBookingId: {type: string}
+        bookingNo: {type: string, nullable: true}
+        containerNo: {type: string, nullable: true}
+    FactRequest:
+      type: object
+      required: [workItemKey, type, flow, containerBookingId]
+      properties:
+        workItemKey: {type: string}
+        type: {type: string, enum: [PICKUP, EMPTY_RETURN, DELIVERY]}
+        flow: {type: string, enum: [TRANSFER, DIRECT, UNKNOWN]}
+        containerBookingId: {type: string}
+        requirementKey: {type: string, nullable: true}
+        batchKey: {type: string, nullable: true}
+        tripKey: {type: string, nullable: true}
+        batchKeys: {type: array, items: {type: string}}
+        containers: {type: array, items: {$ref: '#/components/schemas/ContainerReference'}}
+        sources: {type: array, items: {$ref: '#/components/schemas/SourceReference'}}
+    Slot:
+      type: object
+      properties:
+        date: {type: string, format: date}
+        startTime: {type: string, nullable: true}
+        endDate: {type: string, format: date, nullable: true}
+        endTime: {type: string, nullable: true}
+        timezone: {type: string, nullable: true, description: Null for unzoned original plans; source-local date is retained}
+    Actual:
+      type: object
+      description: At least one time is required. Unzoned source facts contain localOccurredAt only.
+      properties:
+        occurredAt: {type: string, format: date-time, nullable: true}
+        localOccurredAt: {type: string, nullable: true}
+        timezone: {type: string, nullable: true}
+    Fact:
+      type: object
+      required: [workItemKey, fingerprint, impactToken, planExists, planStatus, executionStatus, readPermissions, actionPermissions, blockReasons, missingFields, references]
+      properties:
+        workItemKey: {type: string}
+        fingerprint: {type: string}
+        impactToken: {type: string, description: First scheduling and first carrier assignment do not increase semantic impact}
+        planExists: {type: boolean}
+        planStatus: {type: string, enum: [UNPLANNED, TARGET_SET, AWAITING_REPLY, CONFIRMED, NOT_REQUIRED]}
+        executionStatus: {type: string, enum: [PENDING, IN_PROGRESS, COMPLETED]}
+        target: {$ref: '#/components/schemas/Slot'}
+        confirmed: {$ref: '#/components/schemas/Slot'}
+        actual: {$ref: '#/components/schemas/Actual'}
+        timezone: {type: string, nullable: true}
+        businessNo: {type: string, nullable: true}
+        tripKey: {type: string, nullable: true}
+        readPermissions: {type: array, items: {type: string}}
+        actionPermissions: {type: array, items: {type: string}}
+        blockReasons: {type: array, items: {type: string}}
+        missingFields: {type: array, items: {type: string}}
+        references: {type: array, items: {$ref: '#/components/schemas/Reference'}}
+        responsibility:
+          type: object
+          nullable: true
+          properties: {kind: {type: string}, id: {type: string, nullable: true}, name: {type: string}}
+        action:
+          type: object
+          nullable: true
+          properties:
+            code: {type: string}
+            label: {type: string}
+            targetWorkItemKey: {type: string, nullable: true}
+            target:
+              type: object
+              properties: {kind: {type: string, enum: [FIRSTLEG_CONTAINER]}, containerBookingId: {type: string}}
diff --git a/firstleg/src/main/resources/openapi/arrival-calendar-v1.yaml b/firstleg/src/main/resources/openapi/arrival-calendar-v1.yaml
index 6868e6850..4d2151eb1 100644
--- a/firstleg/src/main/resources/openapi/arrival-calendar-v1.yaml
+++ b/firstleg/src/main/resources/openapi/arrival-calendar-v1.yaml
@@ -28,7 +28,7 @@ paths:
                       type: object
                       properties:
                         containerBookingId: {type: string}
-                        bookingNo: {type: string}
+                        cabinetNo: {type: string}
                         containerNo: {type: string, nullable: true}
                         vesselName: {type: string, nullable: true}
                         voyageNo: {type: string, nullable: true}
diff --git a/firstleg/src/main/resources/openapi/direct-delivery-v1.yaml b/firstleg/src/main/resources/openapi/direct-delivery-v1.yaml
new file mode 100644
index 000000000..30b814db6
--- /dev/null
+++ b/firstleg/src/main/resources/openapi/direct-delivery-v1.yaml
@@ -0,0 +1,70 @@
+openapi: 3.0.3
+info: {title: Direct destination unloading evidence, version: 1.0.0}
+paths:
+  /api/platform/v1/terminal-drayages/{containerBookingId}/direct-deliveries:
+    get:
+      summary: Physical loaded inbound sources and immutable direct unloading evidence
+      x-permission: platform:firstleg:terminal-drayage:list
+      parameters: [{$ref: '#/components/parameters/Container'}]
+      responses:
+        '200':
+          description: ApiResponse
+          content:
+            application/json:
+              schema:
+                type: object
+                properties: {data: {type: array, items: {$ref: '#/components/schemas/View'}}}
+        '403': {description: Requires platform identity and list permission}
+  /api/platform/v1/terminal-drayages/{containerBookingId}/direct-deliveries/{inboundId}:
+    post:
+      summary: Record actual unloading for one complete physically loaded source
+      description: Locks the physical container. Requires Lastleg's persisted confirmed DIRECT route, actual pickup, a real recipient and receipt reference, an unambiguous IANA local time, and no warehouse unloading or empty-return fact. Route source failure returns 503. Exact retries replay; changed retries conflict. Does not create warehouse stock. Every loaded source must complete before manual empty return. Unzoned pickup/return timestamps are not compared to destination wall-clock times; cross-location chronology cannot be proven without the source zone. Direct completion and its 72-hour reminder use the latest evidence Instant.
+      x-permission: platform:firstleg:terminal-drayage:direct-unload:confirm
+      parameters:
+        - {$ref: '#/components/parameters/Container'}
+        - {name: inboundId, in: path, required: true, schema: {type: integer, format: int64, minimum: 1}}
+        - {name: Idempotency-Key, in: header, required: true, schema: {type: string, maxLength: 128}}
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required: [expectedVersion, actualAt, timezone, receivedBy, evidenceNo]
+              properties:
+                expectedVersion: {type: integer, minimum: 0}
+                actualAt: {type: string, description: Local YYYY-MM-DDTHH:mm:ss without offset}
+                timezone: {type: string, description: Explicit destination IANA zone}
+                receivedBy: {type: string, minLength: 1, maxLength: 128}
+                evidenceNo: {type: string, minLength: 1, maxLength: 128}
+                remark: {type: string, maxLength: 1000, nullable: true}
+      responses:
+        '200':
+          description: ApiResponse
+          content:
+            application/json:
+              schema:
+                type: object
+                properties: {data: {$ref: '#/components/schemas/View'}}
+        '400': {description: Invalid source, time or evidence}
+        '403': {description: Requires platform identity and independent unloading permission}
+        '409': {description: Invalid business prerequisites, version or replay content}
+        '503': {description: Cannot verify authoritative route}
+components:
+  parameters:
+    Container: {name: containerBookingId, in: path, required: true, schema: {type: integer, format: int64, minimum: 1}}
+  schemas:
+    View:
+      type: object
+      properties:
+        requirementKey: {type: string, description: 'INBOUND:<id>, association only, not a visible business number'}
+        inboundCode: {type: string, nullable: true}
+        orderNo: {type: string, nullable: true}
+        destinationName: {type: string, nullable: true}
+        packageCount: {type: integer}
+        version: {type: integer, description: Zero until first actual unloading}
+        actualAt: {type: string, nullable: true}
+        timezone: {type: string, nullable: true}
+        receivedBy: {type: string, nullable: true}
+        evidenceNo: {type: string, nullable: true}
+        remark: {type: string, nullable: true}
diff --git a/firstleg/src/main/resources/openapi/firstleg-v1.yaml b/firstleg/src/main/resources/openapi/firstleg-v1.yaml
index 415b08cb6..f22a25424 100644
--- a/firstleg/src/main/resources/openapi/firstleg-v1.yaml
+++ b/firstleg/src/main/resources/openapi/firstleg-v1.yaml
@@ -355,7 +355,7 @@ paths:
   /internal/firstleg/v1/inbounds/unified-orders/workbench-filters:
     post:
       summary: 查询单一客户工作台履约筛选标识（Order内部）
-      description: 只读返回命中状态、最新待确认费用及待上传资料的订单标识。客户必须明确且为正数；不创建报关聚合，不跨Schema读取。
+      description: 只读返回命中状态、最新待确认费用及待上传资料的订单标识。客户必须明确且为正数；不创建报关聚合，不跨Schema读取。传入orderIds为精确进度模式，仅计算progress，matchingStatusOrderIds为null，feeOrderIds和customsOrderIds为空；mainStatus在该模式不参与查询。
       security: [{internalServiceToken: []}]
       requestBody:
         required: true
@@ -367,6 +367,13 @@ paths:
               properties:
                 tenantId: {type: integer, format: int64, minimum: 1}
                 mainStatus: {type: string, nullable: true, enum: [WAIT_MEASURE, WAIT_PALLETIZE, WAIT_SPLIT, LOADING, LOADED, DELIVERED]}
+                orderIds:
+                  type: array
+                  nullable: true
+                  minItems: 1
+                  maxItems: 200
+                  items: {type: integer, format: int64, minimum: 1}
+                  description: 省略或null查询当前客户全部进度；传入时仅在SQL内查询这些来源Order订单，空数组拒绝，不允许扩大到全客户。
       responses:
         '200':
           description: 按响应code判断，标识只供Order在自身客户范围内过滤、计数和分页
@@ -2323,13 +2330,12 @@ components:
         allowedActions: {type: array, items: {type: string, enum: [SELECT_FLEET, SCHEDULE_PICKUP, RECORD_EMPTY_RETURN, SEND_PICKUP_EMAIL]}}
     ContainerBooking:
       type: object
-      required: [id, bookingNo, cabinetNo, sourceType, recordStatus, warehouseId, warehouseName, channelGroupCode, containerType, capacityCbm, maxWeightKg, planStatus, exceptionActive, destinationClearanceDocumentStatus, customsDeclarationDocumentStatus, deliveryOrderDocumentStatus, version]
+      required: [id, cabinetNo, sourceType, recordStatus, warehouseId, warehouseName, channelGroupCode, containerType, capacityCbm, maxWeightKg, planStatus, exceptionActive, destinationClearanceDocumentStatus, customsDeclarationDocumentStatus, deliveryOrderDocumentStatus, version]
       properties:
         id: {type: string, pattern: '^[1-9][0-9]*$'}
         currentPortScheduleId: {type: string, pattern: '^[1-9][0-9]*$', nullable: true, readOnly: true, description: 当前运输读模型由 latestForDispatch 选中的船期记录 ID；无匹配时为空，仅用于定位关联船期，不作为业务编号展示}
         planId: {type: string, pattern: '^[1-9][0-9]*$', nullable: true, description: 关联智能装柜计划ID；未创建计划时为空}
         planNo: {type: string, nullable: true, pattern: '^LP-[0-9]{6}-[0-9]{4}$', example: LP-260818-0001, description: 预装与确认装柜清单共用的稳定编号；未创建计划时为空}
-        bookingNo: {type: string, pattern: '^CB-[0-9]{6}-[0-9]{4}$', example: CB-260818-0001, description: 平台内部货柜登记号}
         containerNo: {type: string, maxLength: 64, nullable: true}
         cabinetNo: {type: string, pattern: '^D[0-9]{4,}$', example: D0001, description: 平台全局连续且不按日期重置的稳定柜次号}
         sourceType: {type: string, enum: [SIMULATION, OCEAN_BOOKING], description: SIMULATION 为内部模拟柜；OCEAN_BOOKING 为订舱登记直接生成的真实柜}
@@ -2606,11 +2612,10 @@ components:
             pages: {type: string, pattern: '^[0-9]+$'}
     SmartLoadingWorkbenchContainer:
       type: object
-      required: [bookingId, bookingNo, cabinetNo, warehouseId, warehouseName, channelGroupCode,
+      required: [bookingId, cabinetNo, warehouseId, warehouseName, channelGroupCode,
         containerType, capacityCbm, maxWeightKg, planStatus, version]
       properties:
         bookingId: {type: string, pattern: '^[1-9][0-9]*$', description: containerBookingId 技术关联}
-        bookingNo: {type: string, description: 货柜登记业务号}
         cabinetNo: {type: string, description: 稳定柜次业务号}
         containerNo: {type: string, nullable: true, description: 真实集装箱号，允许在装柜前后补}
         warehouseId: {type: string, pattern: '^[1-9][0-9]*$'}
diff --git a/firstleg/src/main/resources/openapi/phase3-container-overview-v1.yaml b/firstleg/src/main/resources/openapi/phase3-container-overview-v1.yaml
index 3b7d0f913..65cf09583 100644
--- a/firstleg/src/main/resources/openapi/phase3-container-overview-v1.yaml
+++ b/firstleg/src/main/resources/openapi/phase3-container-overview-v1.yaml
@@ -74,7 +74,7 @@ components:
         exception: {$ref: '#/components/schemas/ExceptionState'}
         exceptionHistory: {type: array, items: {$ref: '#/components/schemas/ExceptionHistory'}}
         timeline: {type: array, items: {$ref: '#/components/schemas/TimelineEntry'}}
-    Container: {type: object, properties: {id: {type: integer, format: int64}, bookingNo: {type: string, pattern: '^CB-[0-9]{6}-[0-9]{4}$', example: CB-260818-0001}, cabinetNo: {type: string, pattern: '^D[0-9]{4,}$', example: D0001}, containerNo: {type: string}, status: {type: string}, warehouseId: {type: integer, format: int64}, warehouseName: {type: string}, voyageNo: {type: string}, vesselName: {type: string}, pickupCode: {type: string, pattern: '^[0-9]{1,64}$', nullable: true}, pickupCodeUpdatedBy: {type: integer, format: int64, nullable: true}, pickupCodeUpdatedByName: {type: string, nullable: true}, pickupCodeUpdatedAt: {type: string, format: date-time, nullable: true}, version: {type: integer, minimum: 0}}}
+    Container: {type: object, properties: {id: {type: integer, format: int64}, cabinetNo: {type: string, pattern: '^D[0-9]{4,}$', example: D0001}, containerNo: {type: string}, status: {type: string}, warehouseId: {type: integer, format: int64}, warehouseName: {type: string}, voyageNo: {type: string}, vesselName: {type: string}, pickupCode: {type: string, pattern: '^[0-9]{1,64}$', nullable: true}, pickupCodeUpdatedBy: {type: integer, format: int64, nullable: true}, pickupCodeUpdatedByName: {type: string, nullable: true}, pickupCodeUpdatedAt: {type: string, format: date-time, nullable: true}, version: {type: integer, minimum: 0}}}
     PdaSummary: {type: object, properties: {taskId: {type: integer, format: int64}, loadingPlanId: {type: integer, format: int64}, containerBookingId: {type: integer, format: int64}, taskStatus: {type: string, description: '持久化任务态：LOADING/COMPLETED'}, workflowStatus: {type: string, enum: [IN_PROGRESS, AWAITING_REVIEW, COMPLETED], description: 'PDA作业展示态'}, taskVersion: {type: integer}, itemCount: {type: integer}, completedItemCount: {type: integer}, unresolvedItemCount: {type: integer}, photoCounts: {type: array, items: {$ref: '#/components/schemas/PhotoCount'}}, photos: {type: array, items: {$ref: '#/components/schemas/Photo'}}, exceptionReasons: {type: array, items: {type: string}}}}
     PhotoCount: {type: object, properties: {evidenceType: {type: string}, count: {type: integer}}}
     Photo: {type: object, properties: {evidenceId: {type: integer, format: int64}, tenantId: {type: integer, format: int64}, inboundId: {type: integer, format: int64}, evidenceType: {type: string}, fileId: {type: integer, format: int64}, fileName: {type: string}, status: {type: string, enum: [ACTIVE, VOID]}, downloadPath: {type: string, nullable: true, description: '仅 ACTIVE 照片提供鉴权下载路径；VOID 历史照片为空'}, uploadedAt: {type: string, format: date-time}}}
diff --git a/firstleg/src/main/resources/openapi/terminal-drayage-v1.yaml b/firstleg/src/main/resources/openapi/terminal-drayage-v1.yaml
index a6b2dc43e..b6ac31d49 100644
--- a/firstleg/src/main/resources/openapi/terminal-drayage-v1.yaml
+++ b/firstleg/src/main/resources/openapi/terminal-drayage-v1.yaml
@@ -4,7 +4,7 @@ paths:
   /api/platform/v1/terminal-drayages/calendar:
     get:
       summary: 美国目的仓相关的提柜预约日历
-      description: 平台身份，同时要求预约列表和码头拖车列表权限。按原业务预约提柜日期查询，不将实际提柜或预计到仓替代预约时间。美国范围按启用目的仓国家确认，不代表已确认港口所在国。原字段未提供港口时区，timeBasis明确待核实，禁止当作UTC或套用收货仓时区。最多42天、读取1001条以检测截断；返回最多1000条中的美国范围记录，未知目的仓计入unclassifiedCount，不能将缺失数据当零。
+      description: 平台身份，同时要求预约列表和码头拖车列表权限。已提柜按船节点权威实际提柜日期、尚未提柜按原预约日期查询，改期不移动已执行事实；原预约与实际时间分别返回，不以预计到仓替代。美国范围按启用目的仓国家确认，不代表已确认港口所在国。原字段未提供港口时区，timeBasis明确待核实，禁止当作UTC或套用收货仓时区。最多42天，原预约和船节点实际日期候选分别读取1001条检测截断，经各自所属服务读取并按柜去重；返回最多1000条美国范围记录，未知目的仓计入unclassifiedCount，不能将缺失数据当零。
       x-permissions: [platform:appointment:list, 'platform:firstleg:terminal-drayage:list']
       parameters:
         - {name: from, in: query, required: true, schema: {type: string, format: date}, description: 包含的原业务当地日期}
@@ -33,12 +33,12 @@ paths:
                           type: object
                           properties:
                             containerBookingId: {type: string, description: 仅用于来源详情定位}
-                            bookingNo: {type: string}
+                            cabinetNo: {type: string}
                             containerNo: {type: string, nullable: true}
                             destinationPortName: {type: string, nullable: true}
                             destinationWarehouseCode: {type: string, nullable: true}
                             fleetSupplierName: {type: string, nullable: true}
-                            pickupAppointmentAt: {type: string, description: 原业务当地时间，无时区偏移，不是UTC时间点}
+                            pickupAppointmentAt: {type: string, nullable: true, description: 原业务当地预约时间，无时区偏移；仅有实际提柜事实时可为空}
                             actualPickupAt: {type: string, nullable: true}
         '400': {description: 日期范围非法}
         '403': {description: 非平台身份或权限不足}
@@ -82,8 +82,8 @@ paths:
       responses: {'200': {$ref: '#/components/responses/ViewResponse'}}
   /api/platform/v1/terminal-drayages/{containerBookingId}/empty-return:
     post:
-      summary: 海外卸柜收货完成后确认实际还柜并推进EMPTY_RETURNED节点
-      description: 以海外卸柜完成事实开放还柜；无需已有车队、预约或实际提柜记录。无拖车记录时提交 expectedVersion=0，由命令创建记录，不补造提柜时间。实际还柜时间不得早于卸柜完成时间及已有实际提柜时间。
+      summary: 海外仓卸柜或全部直送目的仓实际卸货完成后确认实际还柜并推进EMPTY_RETURNED节点
+      description: 海外仓卸柜或全部直送目的仓实际卸货完成后开放还柜。无需已有车队或预约；海外仓卸柜可无实际提柜记录。无拖车记录时提交 expectedVersion=0，不补造提柜时间。保留原海外仓卸柜及已有船节点实际提柜的当地时间先后校验；直送目的仓时区不能套用于缺少时区的还柜时间，不比较不同地点的当地钟面值。
       x-permission: platform:firstleg:terminal-drayage:empty-return:confirm
       parameters: [{$ref: '#/components/parameters/ContainerBookingId'}, {$ref: '#/components/parameters/IdempotencyKey'}]
       requestBody: {required: true, content: {application/json: {schema: {$ref: '#/components/schemas/ActualTimeRequest'}}}}
@@ -173,7 +173,7 @@ components:
       required: [status, overdueHours, overdueDays]
       properties:
         status: {type: string, enum: [NOT_APPLICABLE, PENDING, OVERDUE, RESOLVED]}
-        deadlineAt: {type: string, format: date-time, nullable: true, description: 卸柜完成时间加72小时}
+        deadlineAt: {type: string, format: date-time, nullable: true, description: 原海外仓卸柜时间加72小时；直送按最晚真实卸货Instant加72小时后保留该目的地当地时间}
         overdueHours: {type: integer, format: int64, minimum: 0}
         overdueDays: {type: integer, format: int64, minimum: 0}
     TerminalDrayageView:
@@ -189,7 +189,7 @@ components:
         fleetSupplierName: {type: string, nullable: true}
         pickupAppointmentAt: {type: string, format: date-time, nullable: true}
         actualPickupAt: {type: string, format: date-time, nullable: true, description: 优先使用实际船节点提柜时间；缺失时在海外PDA确认整柜拆柜完成后使用卸柜完成时间}
-        estimatedEmptyReturnAt: {type: string, format: date-time, nullable: true, description: 服务端权威值，卸柜完成时间加72小时}
+        estimatedEmptyReturnAt: {type: string, format: date-time, nullable: true, description: 服务端权威值；直送72小时按绝对时长计算，时区不明的原海外仓事实保留原规则}
         actualEmptyReturnAt: {type: string, format: date-time, nullable: true}
         unloadingCompletedAt: {type: string, format: date-time, nullable: true}
         emptyReturnWarning: {$ref: '#/components/schemas/Warning'}
diff --git a/firstleg/src/test/java/com/baiyue/firstleg/controller/ContainerControllerContractTest.java b/firstleg/src/test/java/com/baiyue/firstleg/controller/ContainerControllerContractTest.java
index f294caa1b..7da4e3849 100644
--- a/firstleg/src/test/java/com/baiyue/firstleg/controller/ContainerControllerContractTest.java
+++ b/firstleg/src/test/java/com/baiyue/firstleg/controller/ContainerControllerContractTest.java
@@ -128,7 +128,7 @@ class ContainerControllerContractTest {
             .contains("required: [oceanBookingId, requirementId, expectedVersion]")
             .contains("containerNo: {type: string, nullable: true")
             .doesNotContain("required: [oceanBookingId, requirementId, containerNo, expectedVersion]")
-            .contains("required: [id, bookingNo, cabinetNo, sourceType, recordStatus")
+            .contains("required: [id, cabinetNo, sourceType, recordStatus")
             .contains("sourceType: {type: string, enum: [SIMULATION, OCEAN_BOOKING]")
             .contains("recordStatus: {type: string, enum: [ACTIVE, MERGED]")
             .contains("mergedIntoContainerBookingId: {type: string, pattern: '^[1-9][0-9]*$', nullable: true");
diff --git a/firstleg/src/test/java/com/baiyue/firstleg/controller/InternalInboundOrderReferenceControllerTest.java b/firstleg/src/test/java/com/baiyue/firstleg/controller/InternalInboundOrderReferenceControllerTest.java
index a7f41e878..c72e432b4 100644
--- a/firstleg/src/test/java/com/baiyue/firstleg/controller/InternalInboundOrderReferenceControllerTest.java
+++ b/firstleg/src/test/java/com/baiyue/firstleg/controller/InternalInboundOrderReferenceControllerTest.java
@@ -45,7 +45,7 @@ class InternalInboundOrderReferenceControllerTest {
     private InternalInboundOrderController controller;
 
     @Test void workbenchFiltersRejectMissingAndWrongInternalIdentity() {
-        var request = new com.baiyue.firstleg.dto.MerchantWorkbenchFilters.Request(11L, "LOADED");
+        var request = new com.baiyue.firstleg.dto.MerchantWorkbenchFilters.Request(11L, "LOADED", null);
         assertThatThrownBy(() -> controller.workbenchFilters(null, request)).isInstanceOf(BizException.class);
         assertThatThrownBy(() -> controller.workbenchFilters("wrong", request)).isInstanceOf(BizException.class);
         org.mockito.Mockito.verifyNoInteractions(workbenchFilters);
@@ -143,4 +143,18 @@ class InternalInboundOrderReferenceControllerTest {
             carrierId == null ? null : "承运商", null, null, null, null,
             null, null, null, null, null, null);
     }
+
+    @Test void optionalExactScopeRejectsEmptyOversizeNullOrNonPositiveItems() {
+        try(var factory=jakarta.validation.Validation.buildDefaultValidatorFactory()) {
+            var validator=factory.getValidator();
+            for(java.util.List<Long> ids: java.util.List.of(java.util.List.<Long>of(),java.util.List.of(0L),
+                java.util.Arrays.asList(1L,null),java.util.stream.LongStream.rangeClosed(1,201).boxed().toList())) {
+                assertThat(validator.validate(new com.baiyue.firstleg.dto.MerchantWorkbenchFilters.Request(11L,null,ids))).isNotEmpty();
+            }
+            for(java.util.List<Long> ids: java.util.Arrays.asList(null,java.util.List.of(1L),java.util.stream.LongStream.rangeClosed(1,200).boxed().toList())) {
+                assertThat(validator.validate(new com.baiyue.firstleg.dto.MerchantWorkbenchFilters.Request(11L,null,ids))).isEmpty();
+            }
+        }
+    }
+
 }
diff --git a/firstleg/src/test/java/com/baiyue/firstleg/controller/UnifiedInboundOpenApiContractTest.java b/firstleg/src/test/java/com/baiyue/firstleg/controller/UnifiedInboundOpenApiContractTest.java
index 7ae30b21b..258f214fb 100644
--- a/firstleg/src/test/java/com/baiyue/firstleg/controller/UnifiedInboundOpenApiContractTest.java
+++ b/firstleg/src/test/java/com/baiyue/firstleg/controller/UnifiedInboundOpenApiContractTest.java
@@ -74,4 +74,16 @@ class UnifiedInboundOpenApiContractTest {
             .containsOnlyKeys("standardNode","nodeSequence","providerCode","estimatedAt","actualAt","locationCode","locationName");
     }
 
+
+    @Test @SuppressWarnings("unchecked") void documentsBoundedOptionalExactOrderScope() throws Exception {
+        var document=(java.util.Map<String,Object>)new org.yaml.snakeyaml.Yaml().load(
+            new org.springframework.core.io.ClassPathResource("openapi/firstleg-v1.yaml").getContentAsString(java.nio.charset.StandardCharsets.UTF_8));
+        var paths=(java.util.Map<String,Object>)document.get("paths");
+        var operation=(java.util.Map<String,Object>)((java.util.Map<String,Object>)paths.get("/internal/firstleg/v1/inbounds/unified-orders/workbench-filters")).get("post");
+        var content=(java.util.Map<String,Object>)((java.util.Map<String,Object>)operation.get("requestBody")).get("content");
+        var schema=(java.util.Map<String,Object>)((java.util.Map<String,Object>)content.get("application/json")).get("schema");
+        var ids=(java.util.Map<String,Object>)((java.util.Map<String,Object>)schema.get("properties")).get("orderIds");
+        assertThat(ids).containsEntry("minItems",1).containsEntry("maxItems",200).containsEntry("nullable",true);
+        assertThat((java.util.List<String>)schema.get("required")).doesNotContain("orderIds");
+    }
 }
diff --git a/firstleg/src/test/java/com/baiyue/firstleg/portschedule/mapper/AppointmentWorkSourceMapperTest.java b/firstleg/src/test/java/com/baiyue/firstleg/portschedule/mapper/AppointmentWorkSourceMapperTest.java
new file mode 100644
index 000000000..972a4d8b4
--- /dev/null
+++ b/firstleg/src/test/java/com/baiyue/firstleg/portschedule/mapper/AppointmentWorkSourceMapperTest.java
@@ -0,0 +1,42 @@
+package com.baiyue.firstleg.portschedule.mapper;
+
+import com.baomidou.mybatisplus.core.MybatisConfiguration;
+import com.baomidou.mybatisplus.core.MybatisSqlSessionFactoryBuilder;
+import org.apache.ibatis.mapping.Environment;
+import org.apache.ibatis.transaction.jdbc.JdbcTransactionFactory;
+import org.h2.jdbcx.JdbcDataSource;
+import org.junit.jupiter.api.Test;
+import java.util.UUID;
+import static org.junit.jupiter.api.Assertions.*;
+
+class AppointmentWorkSourceMapperTest {
+    @Test void actualSailedScopeHasNoWarehouseDestinationOrOpenQueryFilter() throws Exception {
+        var ds=new JdbcDataSource();ds.setURL("jdbc:h2:mem:"+UUID.randomUUID()+";MODE=MySQL;DB_CLOSE_DELAY=-1");
+        try(var c=ds.getConnection();var s=c.createStatement()) {
+            s.execute("CREATE TABLE fl_container_booking(id BIGINT,cabinet_no VARCHAR,container_no VARCHAR,departure_port_name VARCHAR,destination_warehouse_name VARCHAR,version INT,record_status VARCHAR)");
+            s.execute("CREATE TABLE fl_carrier_schedule_node_fact(id BIGINT,container_booking_id BIGINT,standard_node VARCHAR,actual_at TIMESTAMP)");
+            s.execute("CREATE TABLE fl_direct_delivery_unloading(container_booking_id BIGINT)");
+            s.execute("INSERT INTO fl_container_booking VALUES(1,'D1',NULL,'上海',NULL,1,'ACTIVE'),(2,'D2','C2','上海','私人仓',1,'ACTIVE'),(3,'D3','C3','上海',NULL,1,'ACTIVE'),(4,'D4','C4','上海',NULL,1,'MERGED')");
+            s.execute("INSERT INTO fl_carrier_schedule_node_fact VALUES(10,1,'DEPARTED_ORIGIN_PORT','2026-10-01'),(20,2,'EMPTY_RETURNED','2026-10-03'),(30,3,'LOADED_ON_VESSEL','2026-10-04'),(40,4,'DEPARTED_ORIGIN_PORT','2026-10-01'),(50,3,'DEPARTED_ORIGIN_PORT',NULL)");
+            s.execute("INSERT INTO fl_direct_delivery_unloading VALUES(2),(2)");
+            s.execute("INSERT INTO fl_carrier_schedule_node_fact VALUES(60,1,'IN_TRANSIT','2026-10-02'),(70,1,'ARRIVED_DESTINATION_PORT','2026-10-03'),(80,2,'EMPTY_RETURNED',NULL)");
+        }
+        var config=new MybatisConfiguration();config.setMapUnderscoreToCamelCase(true);
+        config.setEnvironment(new Environment("test",new JdbcTransactionFactory(),ds));config.addMapper(AppointmentWorkSourceMapper.class);
+        try(var session=new MybatisSqlSessionFactoryBuilder().build(config).openSession()) {
+            var mapper=session.getMapper(AppointmentWorkSourceMapper.class);
+            var rows=mapper.sources();
+            assertEquals(2,rows.size());assertEquals(1,rows.get(0).id());assertEquals(2,rows.get(1).id());
+            assertNull(rows.get(0).destinationWarehouseName());assertEquals(2,rows.get(1).deliveryVersion());
+            assertNull(rows.get(1).departedLocalAt());assertNotNull(rows.get(1).sailedEvidenceLocalAt());
+            assertEquals(70,rows.get(0).factVersion());assertEquals(20,rows.get(1).factVersion());
+            // The optimized path must equal the former full-manifest + Java filter, including
+            // dates, versions, null names, unloading counts, duplicate IDs and ineligible sources.
+            for(var ids:java.util.List.of(java.util.List.of(2L,1L),java.util.List.of(1L,1L),
+                java.util.List.of(2L,3L,4L,999L),java.util.List.of(3L,4L),java.util.List.<Long>of())) {
+                assertEquals(rows.stream().filter(row->ids.contains(row.id())).toList(),mapper.sourcesByIds(ids));
+            }
+            assertTrue(mapper.sourcesByIds(null).isEmpty());
+        }
+    }
+}
diff --git a/firstleg/src/test/java/com/baiyue/firstleg/portschedule/mapper/ArrivalCalendarMapperTest.java b/firstleg/src/test/java/com/baiyue/firstleg/portschedule/mapper/ArrivalCalendarMapperTest.java
new file mode 100644
index 000000000..08bc5f32e
--- /dev/null
+++ b/firstleg/src/test/java/com/baiyue/firstleg/portschedule/mapper/ArrivalCalendarMapperTest.java
@@ -0,0 +1,37 @@
+package com.baiyue.firstleg.portschedule.mapper;
+
+import com.baomidou.mybatisplus.core.MybatisConfiguration;
+import com.baomidou.mybatisplus.core.MybatisSqlSessionFactoryBuilder;
+import org.apache.ibatis.mapping.Environment;
+import org.apache.ibatis.transaction.jdbc.JdbcTransactionFactory;
+import org.h2.jdbcx.JdbcDataSource;
+import org.junit.jupiter.api.Test;
+import java.time.LocalDateTime;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+
+class ArrivalCalendarMapperTest {
+    @Test
+    void readsTheExistingCabinetNumberWithoutASecondContainerNumberColumn() throws Exception {
+        var ds = new JdbcDataSource();
+        ds.setURL("jdbc:h2:mem:arrival-cabinet-number;MODE=MySQL;DB_CLOSE_DELAY=-1");
+        try (var connection = ds.getConnection(); var sql = connection.createStatement()) {
+            sql.execute("CREATE TABLE fl_container_booking(id BIGINT,cabinet_no VARCHAR,container_no VARCHAR," +
+                "vessel_name VARCHAR,voyage_no VARCHAR,destination_port_name VARCHAR,destination_warehouse_code VARCHAR," +
+                "actual_port_arrival_at TIMESTAMP,estimated_port_arrival_at TIMESTAMP,record_status VARCHAR)");
+            sql.execute("CREATE TABLE fl_carrier_schedule_node_fact(id BIGINT,container_booking_id BIGINT," +
+                "standard_node VARCHAR,actual_at TIMESTAMP,observed_at TIMESTAMP)");
+            sql.execute("INSERT INTO fl_container_booking VALUES(1,'D0007','TEST-CONT','Vessel','Voyage','Port'," +
+                "'US-W',NULL,'2026-11-25 08:00:00','ACTIVE')");
+        }
+        var config = new MybatisConfiguration();
+        config.setEnvironment(new Environment("test", new JdbcTransactionFactory(), ds));
+        config.addMapper(PortScheduleMapper.class);
+        try (var session = new MybatisSqlSessionFactoryBuilder().build(config).openSession()) {
+            var rows = session.getMapper(PortScheduleMapper.class).arrivalCalendar(
+                LocalDateTime.parse("2026-11-01T00:00:00"), LocalDateTime.parse("2026-12-01T00:00:00"));
+            assertEquals(1, rows.size());
+            assertEquals("D0007", rows.get(0).cabinetNo());
+            assertEquals(1L, rows.get(0).containerBookingId());
+        }
+    }
+}
diff --git a/firstleg/src/test/java/com/baiyue/firstleg/portschedule/mapper/PickupActualCalendarMapperTest.java b/firstleg/src/test/java/com/baiyue/firstleg/portschedule/mapper/PickupActualCalendarMapperTest.java
new file mode 100644
index 000000000..6b8ac26f4
--- /dev/null
+++ b/firstleg/src/test/java/com/baiyue/firstleg/portschedule/mapper/PickupActualCalendarMapperTest.java
@@ -0,0 +1,34 @@
+package com.baiyue.firstleg.portschedule.mapper;
+
+import com.baomidou.mybatisplus.core.MybatisConfiguration;
+import com.baomidou.mybatisplus.core.MybatisSqlSessionFactoryBuilder;
+import org.apache.ibatis.mapping.Environment;
+import org.apache.ibatis.transaction.jdbc.JdbcTransactionFactory;
+import org.h2.jdbcx.JdbcDataSource;
+import org.junit.jupiter.api.Test;
+import java.time.LocalDateTime;
+import java.util.List;
+import java.util.UUID;
+import static org.junit.jupiter.api.Assertions.*;
+
+class PickupActualCalendarMapperTest {
+    @Test void selectsCanonicalActualPickupOnceInAHalfOpenRangeAndDetectsTruncation() throws Exception {
+        var ds=new JdbcDataSource();ds.setURL("jdbc:h2:mem:"+UUID.randomUUID()+";MODE=MySQL;DB_CLOSE_DELAY=-1");
+        try(var connection=ds.getConnection();var sql=connection.createStatement()) {
+            sql.execute("CREATE TABLE fl_carrier_schedule_node_fact(container_booking_id BIGINT,standard_node VARCHAR,actual_at TIMESTAMP)");
+            sql.execute("INSERT INTO fl_carrier_schedule_node_fact VALUES(1,'PICKED_UP','2026-09-30 23:59:59'),(2,'PICKED_UP','2026-10-01 00:00:00'),(3,'PICKED_UP','2026-10-31 23:59:59'),(4,'PICKED_UP','2026-11-01 00:00:00'),(5,'ARRIVED_DESTINATION_PORT','2026-10-10'),(6,'PICKED_UP',NULL)");
+            sql.execute("INSERT INTO fl_carrier_schedule_node_fact VALUES(2,'PICKED_UP','2026-10-01 00:00:00'),(4,'PICKED_UP','2026-10-10')");
+        }
+        var config=new MybatisConfiguration();config.setEnvironment(new Environment("test",new JdbcTransactionFactory(),ds));config.addMapper(CarrierScheduleQueryMapper.class);
+        try(var session=new MybatisSqlSessionFactoryBuilder().build(config).openSession()) {
+            var mapper=session.getMapper(CarrierScheduleQueryMapper.class);
+            var from=LocalDateTime.parse("2026-10-01T00:00:00");var to=LocalDateTime.parse("2026-11-01T00:00:00");
+            assertEquals(List.of(2L,3L),mapper.selectPickupCalendarContainers(from,to));
+            try(var connection=ds.getConnection();var sql=connection.prepareStatement("INSERT INTO fl_carrier_schedule_node_fact VALUES(?,'PICKED_UP','2026-10-15')")) {
+                for(long id=10;id<1012;id++){sql.setLong(1,id);sql.addBatch();}sql.executeBatch();
+            }
+            session.clearCache();
+            assertEquals(1001,mapper.selectPickupCalendarContainers(from,to).size());
+        }
+    }
+}
diff --git a/firstleg/src/test/java/com/baiyue/firstleg/portschedule/service/AppointmentWorkSourceServiceTest.java b/firstleg/src/test/java/com/baiyue/firstleg/portschedule/service/AppointmentWorkSourceServiceTest.java
new file mode 100644
index 000000000..a1ce5e101
--- /dev/null
+++ b/firstleg/src/test/java/com/baiyue/firstleg/portschedule/service/AppointmentWorkSourceServiceTest.java
@@ -0,0 +1,92 @@
+package com.baiyue.firstleg.portschedule.service;
+
+import com.baiyue.firstleg.portschedule.mapper.AppointmentWorkSourceMapper;
+import com.baiyue.firstleg.portschedule.controller.InternalAppointmentWorkSourceController;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import org.junit.jupiter.api.Test;
+import org.springframework.web.server.ResponseStatusException;
+import java.time.LocalDateTime;
+import java.util.List;
+import java.util.Map;
+import java.util.stream.Collectors;
+import java.util.stream.IntStream;
+import com.baiyue.firstleg.portschedule.dto.AppointmentWorkSourceDtos.*;
+import static org.mockito.Mockito.*;
+import static org.junit.jupiter.api.Assertions.*;
+
+class AppointmentWorkSourceServiceTest {
+    private final AppointmentWorkSourceMapper mapper=mock(AppointmentWorkSourceMapper.class);
+    private final AppointmentWorkSourceService.OriginalFacts facts=mock(AppointmentWorkSourceService.OriginalFacts.class);
+    private final AppointmentWorkSourceService service=new AppointmentWorkSourceService(mapper,facts,new ObjectMapper().findAndRegisterModules());
+    private AppointmentWorkSourceMapper.Source source(long id,int version) {
+        return new AppointmentWorkSourceMapper.Source(id,"D000"+id,null,"上海",null,LocalDateTime.parse("2026-10-01T12:00:00"),LocalDateTime.parse("2026-10-01T12:00:00"),version,10L,0L);
+    }
+    @Test void completeCursorManifestIncludesUnboundSourcesAndRejectsScopeDrift() {
+        when(mapper.sources()).thenReturn(List.of(source(1,1),source(2,1)));
+        when(mapper.cargo(anyList())).thenReturn(List.of()); stubFlows("UNKNOWN");
+        var first=service.discover(null,1);
+        assertFalse(first.complete()); assertNotNull(first.nextCursor());
+        assertNull(first.containers().get(0).departedAt());
+        assertEquals(LocalDateTime.parse("2026-10-01T12:00:00"),first.containers().get(0).departedLocalAt());
+        var next=service.discover(first.nextCursor(),1);
+        assertTrue(next.complete());assertEquals("2",next.containers().get(0).containerBookingId());
+        when(mapper.sources()).thenReturn(List.of(source(1,2),source(2,1)));
+        assertEquals(409,assertThrows(ResponseStatusException.class,()->service.discover(first.nextCursor(),1)).getStatusCode().value());
+    }
+    @Test void sourceKeepsCustomerAndPhysicalInboundLineageWithoutDisplayingIdsAsNumbers() {
+        when(mapper.sources()).thenReturn(List.of(source(1,1)));
+        when(mapper.cargo(List.of(1L))).thenReturn(List.of(new AppointmentWorkSourceMapper.ContainerCargo(1,8,9,10,"ORDER-10","IN-8","PRIVATE","P","客户仓",12)));
+        stubFlows("DIRECT");
+        var source=service.container(1);var requirement=source.requirements().get(0);
+        assertEquals(service.hash(List.of(source(1,1),List.of(new AppointmentWorkSourceMapper.Cargo(8,9,10,"ORDER-10","IN-8","PRIVATE","P","客户仓",12)))),source.sourceVersion());
+        assertEquals(source,service.discover(null,200).containers().get(0));
+        assertEquals("INBOUND:8",requirement.requirementKey());assertEquals("PRIVATE",requirement.destinationKind());
+        assertTrue(requirement.references().stream().anyMatch(r->r.kind().equals("CUSTOMER") && r.key().equals("9") && r.businessNo()==null));
+    }
+    @Test void internalControllerFailsClosedBeforeReadingSources() {
+        var guarded=new InternalAppointmentWorkSourceController(service,"secret");
+        assertEquals(401,assertThrows(ResponseStatusException.class,()->guarded.discover(null,null,20)).getStatusCode().value());
+        verifyNoInteractions(mapper);
+    }
+    @Test void missingFlowEvidenceIsNotSilentlyPresentedAsUnknown() {
+        when(mapper.sources()).thenReturn(List.of(source(1,1)));
+        assertEquals(503,assertThrows(ResponseStatusException.class,()->service.container(1)).getStatusCode().value());
+    }
+    @Test void factBatchReadsOnlyRequestedSourcesAndPreservesEachContainerIdentity() {
+        when(mapper.sourcesByIds(anyList())).thenReturn(IntStream.rangeClosed(1,100).mapToObj(id->source(id,1)).toList());
+        when(mapper.cargo(anyList())).thenReturn(List.of());
+        stubFlows("UNKNOWN");
+        var fact=mock(Fact.class);
+        when(facts.read(any(),any())).thenAnswer(invocation->{
+            List<FactRequest> requests=invocation.getArgument(0); Map<Long,ContainerSource> sources=invocation.getArgument(1);
+            assertEquals(100,sources.size());
+            requests.forEach(request->assertEquals(request.containerBookingId(),sources.get(Long.parseLong(request.containerBookingId())).containerBookingId()));
+            return requests.stream().map(request->fact).toList();
+        });
+        var requests=IntStream.rangeClosed(1,100).boxed().flatMap(id->List.of(
+            request("PICKUP-"+id,"PICKUP",id),request("RETURN-"+id,"EMPTY_RETURN",id)).stream()).toList();
+        assertEquals(200,service.facts(requests).size());
+        verify(mapper,times(1)).sourcesByIds(IntStream.rangeClosed(1,100).mapToObj(Long::valueOf).toList());
+        verify(mapper,never()).sources();
+        verify(mapper,times(1)).cargo(IntStream.rangeClosed(1,100).mapToObj(Long::valueOf).toList());
+        verify(facts,times(1)).establishedFlows(anyList());
+        verify(facts,times(1)).read(any(),any());
+    }
+    @Test void nextFactBatchReadsFreshSourcesAndRejectsRemovedContainer() {
+        when(mapper.sourcesByIds(List.of(1L))).thenReturn(List.of(source(1,1)),List.of());
+        when(mapper.cargo(List.of(1L))).thenReturn(List.of());
+        stubFlows("UNKNOWN");
+        var request=request("PICKUP-1","PICKUP",1);
+        service.facts(List.of(request));
+        assertEquals(404,assertThrows(ResponseStatusException.class,()->service.facts(List.of(request))).getStatusCode().value());
+        verify(mapper,times(2)).sourcesByIds(List.of(1L));
+        verify(mapper,never()).sources();
+        verify(facts,times(1)).read(any(),any());
+    }
+    private void stubFlows(String flow) {
+        when(facts.establishedFlows(anyList())).thenAnswer(invocation->((List<Long>)invocation.getArgument(0)).stream().collect(Collectors.toMap(id->id,id->flow)));
+    }
+    private FactRequest request(String key,String type,long id) {
+        return new FactRequest(key,type,"TRANSIT",Long.toString(id),null,null,null,List.of(),List.of(),List.of());
+    }
+}
diff --git a/firstleg/src/test/java/com/baiyue/firstleg/portschedule/service/CarrierScheduleQueryServiceTest.java b/firstleg/src/test/java/com/baiyue/firstleg/portschedule/service/CarrierScheduleQueryServiceTest.java
index 1351048a4..52e4846b0 100644
--- a/firstleg/src/test/java/com/baiyue/firstleg/portschedule/service/CarrierScheduleQueryServiceTest.java
+++ b/firstleg/src/test/java/com/baiyue/firstleg/portschedule/service/CarrierScheduleQueryServiceTest.java
@@ -53,6 +53,7 @@ class CarrierScheduleQueryServiceTest {
     @Mock private CarrierScheduleQueryRepository repository;
     @Mock private PortScheduleRepository portSchedules;
     @Mock private CarrierScheduleNodeOutboxService nodeOutbox;
+    @Mock private EmptyReturnPrerequisite emptyReturnPrerequisite;
     @InjectMocks private CarrierScheduleQueryService service;
     private CarrierScheduleAdapterRegistry adapters;
 
@@ -84,6 +85,19 @@ class CarrierScheduleQueryServiceTest {
         verify(repository).containerActualFacts(List.of(20L, 21L));
     }
 
+    @Test
+    void containerManualEmptyReturnCannotBypassRealUnloadingEvidence() {
+        org.mockito.Mockito.doThrow(new BizException(com.baiyue.common.core.api.ResultCode.CONFLICT,"未卸货"))
+            .when(emptyReturnPrerequisite).requireUnloaded(20L,NOW);
+        assertThatThrownBy(()->service.addContainerManualNode(20L,7L,"admin","empty-no-unload",
+            new com.baiyue.firstleg.portschedule.dto.CarrierScheduleQueryDtos.ContainerManualNodeRequest(
+                "EMPTY_RETURNED",NOW,null,NOW,null,null,"还柜")))
+            .isInstanceOf(BizException.class).hasMessage("未卸货");
+        verifyNoNodePublication();
+    }
+
+    private void verifyNoNodePublication() { org.mockito.Mockito.verifyNoInteractions(nodeOutbox); }
+
     @Test
     void rejectsInvalidActualFactBatchBeforeRepositoryAccess() {
         assertThatThrownBy(() -> service.containerActualFacts(null))
diff --git a/firstleg/src/test/java/com/baiyue/firstleg/repository/MerchantWorkbenchFilterMapperTest.java b/firstleg/src/test/java/com/baiyue/firstleg/repository/MerchantWorkbenchFilterMapperTest.java
index 1ebb617d3..00b029a6d 100644
--- a/firstleg/src/test/java/com/baiyue/firstleg/repository/MerchantWorkbenchFilterMapperTest.java
+++ b/firstleg/src/test/java/com/baiyue/firstleg/repository/MerchantWorkbenchFilterMapperTest.java
@@ -83,19 +83,28 @@ class MerchantWorkbenchFilterMapperTest {
     }
 
     @Test void onlyActualLoadedOwnedFragmentsAndActualClearanceAdvanceProgress() {
-        assertThat(mapper.progressFragments(11)).allMatch(f->f.stage()==0);
+        assertThat(mapper.progressFragments(11, null)).allMatch(f->f.stage()==0);
         jdbc.update("INSERT INTO fl_loading_pick_task VALUES(900,100,'COMPLETED')");
         jdbc.update("INSERT INTO fl_loading_pick_item SELECT 900,id,'PICKED',2 FROM fl_loading_plan_item");
-        assertThat(mapper.progressFragments(11)).allMatch(f->f.stage()==1).noneMatch(f->f.orderId()==103||f.orderId()==104);
+        assertThat(mapper.progressFragments(11, null)).allMatch(f->f.stage()==1).noneMatch(f->f.orderId()==103||f.orderId()==104);
         jdbc.update("INSERT INTO fl_customs_container VALUES(200,100,'DECLARING')");
-        assertThat(mapper.progressFragments(11)).allMatch(f->f.stage()==1);
+        assertThat(mapper.progressFragments(11, null)).allMatch(f->f.stage()==1);
         jdbc.update("UPDATE fl_customs_container SET status='COMPLETED'");
-        assertThat(mapper.progressFragments(11)).allMatch(f->f.stage()==2);
+        assertThat(mapper.progressFragments(11, null)).allMatch(f->f.stage()==2);
         jdbc.update("INSERT INTO fl_carrier_schedule_node_fact VALUES(100,'PICKUP_READY',NULL)");
-        assertThat(mapper.progressFragments(11)).allMatch(f->f.stage()==2);
+        assertThat(mapper.progressFragments(11, null)).allMatch(f->f.stage()==2);
         jdbc.update("UPDATE fl_carrier_schedule_node_fact SET actual_at=CURRENT_TIMESTAMP");
-        assertThat(mapper.progressFragments(11)).allMatch(f->f.stage()==3);
+        assertThat(mapper.progressFragments(11, null)).allMatch(f->f.stage()==3);
+        assertThat(mapper.progressFragments(11,List.of(101L))).singleElement().satisfies(f->{assertThat(f.orderId()).isEqualTo(101);assertThat(f.stage()).isEqualTo(3);});
         jdbc.update("UPDATE fl_container_booking SET record_status='CANCELLED'");
-        assertThat(mapper.progressFragments(11)).allMatch(f->f.stage()==0);
+        assertThat(mapper.progressFragments(11, null)).allMatch(f->f.stage()==0);
     }
+
+    @Test void exactOrderScopeKeepsAllItsFragmentsAndCannotReadForeignOrDeletedOrders() {
+        jdbc.update("INSERT INTO fl_inbound_order(id,tenant_id,order_id,deleted,tax_mode,process_status) VALUES(50,11,101,0,'TAX_REFUND','LOADED')");
+        assertThat(mapper.progressFragments(11,List.of(101L,103L,104L))).extracting(f->f.orderId()).containsExactly(101L,101L);
+        assertThat(mapper.progressFragments(11,List.of(999L))).isEmpty();
+        assertThat(mapper.progressFragments(22,List.of(101L))).isEmpty();
+    }
+
 }
diff --git a/firstleg/src/test/java/com/baiyue/firstleg/repository/Phase3FinalUnifiedSqlContractTest.java b/firstleg/src/test/java/com/baiyue/firstleg/repository/Phase3FinalUnifiedSqlContractTest.java
index 0b9bc9808..fc8bb1ade 100644
--- a/firstleg/src/test/java/com/baiyue/firstleg/repository/Phase3FinalUnifiedSqlContractTest.java
+++ b/firstleg/src/test/java/com/baiyue/firstleg/repository/Phase3FinalUnifiedSqlContractTest.java
@@ -80,7 +80,7 @@ class Phase3FinalUnifiedSqlContractTest {
     @Test
     void initializationPassIsUniqueAndFinal() throws Exception {
         String sql = sql();
-        int expectedTables = 226;
+        int expectedTables = 227;
         long actualTables = java.util.regex.Pattern.compile("(?m)^CREATE TABLE\\s+")
             .matcher(sql).results().count();
         assertThat(actualTables).isEqualTo(expectedTables);
diff --git a/firstleg/src/test/java/com/baiyue/firstleg/sailingcalendar/service/SailingCalendarServiceTest.java b/firstleg/src/test/java/com/baiyue/firstleg/sailingcalendar/service/SailingCalendarServiceTest.java
index 1c7a8635a..8381c951c 100644
--- a/firstleg/src/test/java/com/baiyue/firstleg/sailingcalendar/service/SailingCalendarServiceTest.java
+++ b/firstleg/src/test/java/com/baiyue/firstleg/sailingcalendar/service/SailingCalendarServiceTest.java
@@ -13,6 +13,7 @@ import org.mockito.MockitoAnnotations;
 
 import java.math.BigDecimal;
 import java.time.LocalDateTime;
+import java.time.ZoneId;
 import java.util.List;
 
 import static org.assertj.core.api.Assertions.assertThat;
@@ -25,6 +26,7 @@ import static org.mockito.Mockito.when;
 class SailingCalendarServiceTest {
     @Mock private SailingCalendarRepository repository;
     @InjectMocks private SailingCalendarService service;
+    private final LocalDateTime copiedDeparture = LocalDateTime.now(ZoneId.of("Asia/Shanghai")).plusDays(14);
 
     @BeforeEach
     void setUp() {
@@ -33,8 +35,8 @@ class SailingCalendarServiceTest {
 
     @Test
     void replaysAnExistingCopyInsteadOfReturningAnInternalError() {
-        SailingEntity source = sailing(1L, "SL-SOURCE", "MANUAL", "QA-20261005", LocalDateTime.of(2026, 10, 5, 10, 0));
-        SailingEntity existing = sailing(2L, "SL-COPY", "COPY", "QA-20261005", LocalDateTime.of(2026, 10, 12, 10, 0));
+        SailingEntity source = sailing(1L, "SL-SOURCE", "MANUAL", "QA-20261005", copiedDeparture.minusDays(7));
+        SailingEntity existing = sailing(2L, "SL-COPY", "COPY", "QA-20261005", copiedDeparture);
         SailingHistoryEntity history = new SailingHistoryEntity();
         history.setAction("COPY"); history.setReason("复制自SL-SOURCE"); history.setSailingId(2L);
         when(repository.sailing(1L)).thenReturn(source);
@@ -45,7 +47,7 @@ class SailingCalendarServiceTest {
         when(repository.bookingSummary(any(SailingEntity.class))).thenReturn(null);
 
         var result = service.copy(1L, 7L, "admin",
-            new CopyRequest(existing.getEtdAt(), LocalDateTime.of(2026, 10, 9, 18, 0)));
+            new CopyRequest(existing.getEtdAt(), copiedDeparture.minusDays(3)));
 
         assertThat(result.sailing().id()).isEqualTo(2L);
         verify(repository, never()).insert(any(SailingEntity.class));
@@ -53,13 +55,13 @@ class SailingCalendarServiceTest {
 
     @Test
     void reportsBusinessConflictForAnUnrelatedExistingSailing() {
-        SailingEntity source = sailing(1L, "SL-SOURCE", "MANUAL", "QA-20261005", LocalDateTime.of(2026, 10, 5, 10, 0));
-        SailingEntity existing = sailing(2L, "SL-OTHER", "TEMPLATE", "QA-20261005", LocalDateTime.of(2026, 10, 12, 10, 0));
+        SailingEntity source = sailing(1L, "SL-SOURCE", "MANUAL", "QA-20261005", copiedDeparture.minusDays(7));
+        SailingEntity existing = sailing(2L, "SL-OTHER", "TEMPLATE", "QA-20261005", copiedDeparture);
         when(repository.sailing(1L)).thenReturn(source);
         when(repository.sailingByBusinessKey(8L, "MATSON", "CNNGB", "USLGB", existing.getEtdAt(), "QA-20261005")).thenReturn(existing);
 
         assertThatThrownBy(() -> service.copy(1L, 7L, "admin",
-            new CopyRequest(existing.getEtdAt(), LocalDateTime.of(2026, 10, 9, 18, 0))))
+            new CopyRequest(existing.getEtdAt(), copiedDeparture.minusDays(3))))
             .isInstanceOf(BizException.class)
             .hasMessageContaining("已存在航次 QA-20261005");
         verify(repository, never()).insert(any(SailingEntity.class));
@@ -67,11 +69,11 @@ class SailingCalendarServiceTest {
 
     @Test
     void rejectsCutoffAtOrAfterCopiedDeparture() {
-        SailingEntity source = sailing(1L, "SL-SOURCE", "MANUAL", "QA-20261005", LocalDateTime.of(2026, 10, 5, 10, 0));
+        SailingEntity source = sailing(1L, "SL-SOURCE", "MANUAL", "QA-20261005", copiedDeparture.minusDays(7));
         when(repository.sailing(1L)).thenReturn(source);
 
         assertThatThrownBy(() -> service.copy(1L, 7L, "admin",
-            new CopyRequest(LocalDateTime.of(2026, 10, 12, 10, 0), LocalDateTime.of(2026, 10, 12, 10, 0))))
+            new CopyRequest(copiedDeparture, copiedDeparture)))
             .isInstanceOf(BizException.class)
             .hasMessageContaining("收货截止必须早于开船");
         verify(repository, never()).insert(any(SailingEntity.class));
diff --git a/firstleg/src/test/java/com/baiyue/firstleg/service/ContainerServiceTest.java b/firstleg/src/test/java/com/baiyue/firstleg/service/ContainerServiceTest.java
index e241e630f..4d4834e08 100644
--- a/firstleg/src/test/java/com/baiyue/firstleg/service/ContainerServiceTest.java
+++ b/firstleg/src/test/java/com/baiyue/firstleg/service/ContainerServiceTest.java
@@ -52,7 +52,6 @@ class ContainerServiceTest {
 
     @BeforeEach
     void setUpWarehouse() {
-        when(documentNumbers.next("CB")).thenReturn("CB-260818-0001");
         when(documentNumbers.nextCabinetNo()).thenReturn("D0001");
         when(smartLoadingService.createForContainer(anyLong(), anyLong(), anyString())).thenAnswer(invocation ->
             new com.baiyue.firstleg.dto.SmartLoadingDtos.Plan(501L, "LP-260818-0001", "EDITING",
@@ -76,8 +75,9 @@ class ContainerServiceTest {
         verify(repository).insert(captor.capture());
         ContainerBookingEntity saved = captor.getValue();
         assertThat(created).isSameAs(saved);
-        assertThat(saved.getBookingNo()).isEqualTo("CB-260818-0001");
         assertThat(saved.getCabinetNo()).isEqualTo("D0001");
+        verify(documentNumbers).nextCabinetNo();
+        verify(documentNumbers, never()).next("CB");
         assertThat(saved.getContainerNo()).isNull();
         assertThat(saved.getOceanBookingId()).isNull();
         assertThat(saved.getChannelGroupCode()).isEqualTo("MATSON_CLX");
diff --git a/firstleg/src/test/java/com/baiyue/firstleg/service/FirstlegDocumentNumberGeneratorTest.java b/firstleg/src/test/java/com/baiyue/firstleg/service/FirstlegDocumentNumberGeneratorTest.java
index 783adf9fe..e0cd6f665 100644
--- a/firstleg/src/test/java/com/baiyue/firstleg/service/FirstlegDocumentNumberGeneratorTest.java
+++ b/firstleg/src/test/java/com/baiyue/firstleg/service/FirstlegDocumentNumberGeneratorTest.java
@@ -41,7 +41,7 @@ class FirstlegDocumentNumberGeneratorTest {
 
         assertThat(generator.next("OB")).isEqualTo("OB-260818-0001");
         assertThat(generator.next("TA")).isEqualTo("TA-260818-0001");
-        assertThat(generator.next("CB")).isEqualTo("CB-260818-0001");
+        assertThatThrownBy(() -> generator.next("CB")).isInstanceOf(IllegalArgumentException.class);
         assertThat(generator.next("LP")).isEqualTo("LP-260818-0001");
         assertThat(generator.nextCabinetNo()).isEqualTo("D0001");
 
diff --git a/firstleg/src/test/java/com/baiyue/firstleg/service/MerchantWorkbenchFilterServiceTest.java b/firstleg/src/test/java/com/baiyue/firstleg/service/MerchantWorkbenchFilterServiceTest.java
new file mode 100644
index 000000000..b2c74a883
--- /dev/null
+++ b/firstleg/src/test/java/com/baiyue/firstleg/service/MerchantWorkbenchFilterServiceTest.java
@@ -0,0 +1,26 @@
+package com.baiyue.firstleg.service;
+
+import com.baiyue.firstleg.dto.MerchantWorkbenchFilters;
+import com.baiyue.firstleg.mapper.MerchantWorkbenchFilterMapper;
+import org.junit.jupiter.api.Test;
+import org.springframework.test.util.ReflectionTestUtils;
+import java.util.List;
+import static org.assertj.core.api.Assertions.*;
+import static org.mockito.Mockito.*;
+
+class MerchantWorkbenchFilterServiceTest {
+    @Test void exactDetailProgressSkipsUnrelatedCustomerQueues() {
+        var mapper=mock(MerchantWorkbenchFilterMapper.class);
+        var unified=mock(UnifiedInboundQueryService.class);
+        var service=new MerchantWorkbenchFilterService();
+        ReflectionTestUtils.setField(service,"mapper",mapper);
+        ReflectionTestUtils.setField(service,"unified",unified);
+        when(mapper.progressFragments(11,List.of(101L))).thenReturn(List.of(
+            new MerchantWorkbenchFilters.Fragment(101,3),new MerchantWorkbenchFilters.Fragment(101,1)));
+        var response=service.read(new MerchantWorkbenchFilters.Request(11L,null,List.of(101L)));
+        assertThat(response.progress()).containsExactly(new MerchantWorkbenchFilters.Progress(101,"cleared",true));
+        assertThat(response.feeOrderIds()).isEmpty();assertThat(response.customsOrderIds()).isEmpty();
+        assertThat(response.matchingStatusOrderIds()).isNull();
+        verify(mapper).progressFragments(11,List.of(101L));verifyNoMoreInteractions(mapper);verifyNoInteractions(unified);
+    }
+}
diff --git a/firstleg/src/test/java/com/baiyue/firstleg/service/SmartLoadingServiceTest.java b/firstleg/src/test/java/com/baiyue/firstleg/service/SmartLoadingServiceTest.java
index e1065048f..33232b39c 100644
--- a/firstleg/src/test/java/com/baiyue/firstleg/service/SmartLoadingServiceTest.java
+++ b/firstleg/src/test/java/com/baiyue/firstleg/service/SmartLoadingServiceTest.java
@@ -627,7 +627,7 @@ class SmartLoadingServiceTest {
 
     @Test
     void pagesWorkbenchContainersWithTheSameGlobalFilters() {
-        WorkbenchContainer container = new WorkbenchContainer(99L, "CB-1", "CAB-1", null,
+        WorkbenchContainer container = new WorkbenchContainer(99L, "D0001", null,
             100L, "义乌仓", "MATSON_CLX", null, null, "40HQ",
             new BigDecimal("68"), new BigDecimal("19500"),
             1L, "LP-1", "EDITING", 2);
diff --git a/firstleg/src/test/java/com/baiyue/firstleg/service/TaillegRealProducerAcceptanceTest.java b/firstleg/src/test/java/com/baiyue/firstleg/service/TaillegRealProducerAcceptanceTest.java
index 3a43c1dce..5e31d5059 100644
--- a/firstleg/src/test/java/com/baiyue/firstleg/service/TaillegRealProducerAcceptanceTest.java
+++ b/firstleg/src/test/java/com/baiyue/firstleg/service/TaillegRealProducerAcceptanceTest.java
@@ -71,10 +71,10 @@ class TaillegRealProducerAcceptanceTest {
     }
 
     private void seedCompletedLoadingPlan() {
-        jdbc.update("INSERT IGNORE INTO fl_container_booking(id,booking_no,container_no,cabinet_no,warehouse_id," +
+        jdbc.update("INSERT IGNORE INTO fl_container_booking(id,container_no,cabinet_no,warehouse_id," +
             "warehouse_name,customer_id,customer_name,estimated_port_arrival_at,container_type,created_by,updated_by) " +
-            "VALUES(?,?,?,?,?,?,?,?,?,?,1,1)",
-            BOOKING, MARKER + "-BOOK", MARKER + "-CNTR", MARKER + "-CAB", 92L, "真实验收海外仓",
+            "VALUES(?,?,?,?,?,?,?,?,?,1,1)",
+            BOOKING, MARKER + "-CNTR", MARKER + "-CAB", 92L, "真实验收海外仓",
             CUSTOMER, "真实验收客户", java.time.LocalDateTime.of(2026, 9, 30, 12, 0), "40HQ");
         jdbc.update("INSERT IGNORE INTO fl_loading_plan(id,plan_no,container_booking_id,plan_status,created_by," +
             "updated_by,version) VALUES(?,?,?,'LOADING',1,1,0)", PLAN, MARKER + "-PLAN", BOOKING);
diff --git a/firstleg/src/test/java/com/baiyue/firstleg/terminaldrayage/controller/TerminalDrayageOpenApiContractTest.java b/firstleg/src/test/java/com/baiyue/firstleg/terminaldrayage/controller/TerminalDrayageOpenApiContractTest.java
index fdc975777..c7baa1099 100644
--- a/firstleg/src/test/java/com/baiyue/firstleg/terminaldrayage/controller/TerminalDrayageOpenApiContractTest.java
+++ b/firstleg/src/test/java/com/baiyue/firstleg/terminaldrayage/controller/TerminalDrayageOpenApiContractTest.java
@@ -51,7 +51,8 @@ class TerminalDrayageOpenApiContractTest {
             "emptyReturnWarning", "actualFacts", "deadlineAt", "overdueHours", "overdueDays",
             "船节点跟踪任务尚未建立也返回WAITING_FOR_ARRIVAL空详情",
             "允许读取空邮件列表，不以船节点跟踪任务是否已经建立作为货柜存在性条件");
-        assertThat(yaml).contains("description: 卸柜完成时间加72小时");
+        assertThat(yaml).contains("原海外仓卸柜时间加72小时", "直送按最晚真实卸货Instant加72小时",
+            "直送72小时按绝对时长计算", "不比较不同地点的当地钟面值");
         assertThat(yaml).doesNotContain("/api/platform/v1/terminal-drayages/{containerBookingId}/pickup:",
             "platform:firstleg:terminal-drayage:pickup:confirm", "RECORD_PICKUP");
     }
diff --git a/firstleg/src/test/java/com/baiyue/firstleg/terminaldrayage/mapper/DirectDeliveryMapperTest.java b/firstleg/src/test/java/com/baiyue/firstleg/terminaldrayage/mapper/DirectDeliveryMapperTest.java
new file mode 100644
index 000000000..bde05b582
--- /dev/null
+++ b/firstleg/src/test/java/com/baiyue/firstleg/terminaldrayage/mapper/DirectDeliveryMapperTest.java
@@ -0,0 +1,61 @@
+package com.baiyue.firstleg.terminaldrayage.mapper;
+
+import com.baomidou.mybatisplus.core.MybatisConfiguration;
+import com.baomidou.mybatisplus.core.MybatisSqlSessionFactoryBuilder;
+import org.apache.ibatis.mapping.Environment;
+import org.apache.ibatis.transaction.jdbc.JdbcTransactionFactory;
+import org.h2.jdbcx.JdbcDataSource;
+import org.junit.jupiter.api.Test;
+import java.time.LocalDateTime;
+import java.util.UUID;
+import java.util.List;
+import com.baiyue.firstleg.portschedule.mapper.AppointmentWorkSourceMapper;
+import static org.junit.jupiter.api.Assertions.*;
+
+class DirectDeliveryMapperTest {
+    @Test void physicalSourceAggregationAndImmutableEvidenceSurviveActualPersistence() throws Exception {
+        var ds=new JdbcDataSource();ds.setURL("jdbc:h2:mem:"+UUID.randomUUID()+";MODE=MySQL;DB_CLOSE_DELAY=-1");
+        try(var c=ds.getConnection();var s=c.createStatement()) {
+            s.execute("CREATE TABLE fl_container_booking(id BIGINT PRIMARY KEY,record_status VARCHAR,unloading_completed_at TIMESTAMP)");
+            s.execute("CREATE TABLE fl_loading_plan(id BIGINT,container_booking_id BIGINT,plan_status VARCHAR)");
+            s.execute("CREATE TABLE fl_loading_plan_item(loading_plan_id BIGINT,inbound_id BIGINT,inbound_code VARCHAR,order_no VARCHAR,destination_warehouse_name VARCHAR,package_count INT,deleted INT)");
+            s.execute("CREATE TABLE fl_direct_delivery_unloading(container_booking_id BIGINT,inbound_id BIGINT,actual_at TIMESTAMP,timezone VARCHAR,received_by VARCHAR,evidence_no VARCHAR,remark VARCHAR,version INT,idempotency_key VARCHAR,request_hash VARCHAR,created_by BIGINT,created_by_name VARCHAR,PRIMARY KEY(container_booking_id,inbound_id),UNIQUE(container_booking_id,idempotency_key))");
+            s.execute("INSERT INTO fl_container_booking VALUES(1,'ACTIVE',NULL)");s.execute("INSERT INTO fl_loading_plan VALUES(10,1,'COMPLETED')");
+            s.execute("INSERT INTO fl_loading_plan_item VALUES(10,20,'I20','O20','D',3,0),(10,20,'I20','O20','D',4,0),(10,21,'I21','O21','D',5,0),(10,22,'I22','O22','D',100,1)");
+            s.execute("INSERT INTO fl_container_booking VALUES(2,'ACTIVE','2026-01-02 12:00:00'),(3,'ACTIVE',NULL)");
+            s.execute("INSERT INTO fl_loading_plan VALUES(11,2,'COMPLETED'),(12,3,'DRAFT')");
+            s.execute("INSERT INTO fl_loading_plan_item VALUES(11,20,'I20','O20','D',2,0),(12,20,'I20','O20','D',100,0)");
+            s.execute("ALTER TABLE fl_loading_plan_item ADD account_id BIGINT DEFAULT 7");
+            s.execute("ALTER TABLE fl_loading_plan_item ADD order_id BIGINT DEFAULT 8");
+            s.execute("ALTER TABLE fl_loading_plan_item ADD destination_warehouse_code VARCHAR DEFAULT 'D'");
+            s.execute("CREATE TABLE fl_inbound_order(id BIGINT,destination_type VARCHAR)");
+            s.execute("INSERT INTO fl_inbound_order VALUES(20,'PRIVATE'),(21,'AMAZON'),(22,'PRIVATE')");
+            s.execute("CREATE TABLE fl_terminal_drayage_history(container_booking_id BIGINT,action VARCHAR)");
+            s.execute("INSERT INTO fl_terminal_drayage_history VALUES(1,'SELECT_FLEET'),(1,'SCHEDULE_PICKUP'),(1,'SCHEDULE_PICKUP'),(1,'OTHER'),(2,'SELECT_FLEET')");
+        }
+        var config=new MybatisConfiguration();config.setMapUnderscoreToCamelCase(true);config.setEnvironment(new Environment("test",new JdbcTransactionFactory(),ds));config.addMapper(DirectDeliveryMapper.class);
+        config.addMapper(AppointmentWorkSourceMapper.class);config.addMapper(TerminalDrayageMapper.class);
+        try(var session=new MybatisSqlSessionFactoryBuilder().build(config).openSession()) {
+            var mapper=session.getMapper(DirectDeliveryMapper.class);assertEquals(1,mapper.lockContainer(1).id());
+            assertEquals(2,mapper.deliveries(1).size());assertEquals(7,mapper.deliveries(1).get(0).packageCount());
+            var at=LocalDateTime.parse("2026-01-01T10:30:00");
+            mapper.insert(1,20,at,"America/Los_Angeles","签收人","POD20",null,"key","hash",7,"admin");
+            assertEquals(1,mapper.evidenceCount(1));assertEquals(1,mapper.keyCount(1,"key"));
+            assertEquals(at,mapper.deliveries(1).get(0).actualAt());assertNull(mapper.deliveries(1).get(1).actualAt());
+            var batch=mapper.deliveriesBatch(List.of(1L,2L,3L));
+            assertEquals(3,batch.size());assertEquals(mapper.deliveries(1),batch.stream().filter(r->r.containerBookingId()==1).map(DirectDeliveryMapper.ContainerDelivery::delivery).toList());
+            assertEquals(2,batch.get(2).packageCount());assertNull(batch.get(2).actualAt());
+            assertEquals(3,mapper.containers(List.of(1L,2L,3L)).size());
+            var flows=mapper.flowEvidence(List.of(1L,2L,3L));
+            assertEquals(1,flows.stream().filter(r->r.id()==1).findFirst().orElseThrow().evidenceCount());
+            assertNotNull(flows.stream().filter(r->r.id()==2).findFirst().orElseThrow().warehouseUnloadedAt());
+            var cargo=session.getMapper(AppointmentWorkSourceMapper.class).cargo(List.of(1L,2L,3L));
+            assertEquals(3,cargo.size());assertEquals(7,cargo.get(0).packageCount());assertEquals(1,cargo.get(0).containerBookingId());
+            assertEquals(2,cargo.get(2).containerBookingId());assertEquals(2,cargo.get(2).packageCount());
+            var changes=session.getMapper(TerminalDrayageMapper.class).pickupChanges(List.of(1L,2L,3L));
+            assertEquals(new TerminalDrayageMapper.PickupChanges(1,2,1),changes.stream().filter(r->r.containerBookingId()==1).findFirst().orElseThrow());
+            assertThrows(RuntimeException.class,()->mapper.insert(1,20,at,"America/Los_Angeles","签收人","POD20",null,"another","hash",7,"admin"));
+            session.rollback();
+        }
+    }
+}
diff --git a/firstleg/src/test/java/com/baiyue/firstleg/terminaldrayage/mapper/DirectDeliverySchemaContractTest.java b/firstleg/src/test/java/com/baiyue/firstleg/terminaldrayage/mapper/DirectDeliverySchemaContractTest.java
new file mode 100644
index 000000000..1b95bf344
--- /dev/null
+++ b/firstleg/src/test/java/com/baiyue/firstleg/terminaldrayage/mapper/DirectDeliverySchemaContractTest.java
@@ -0,0 +1,30 @@
+package com.baiyue.firstleg.terminaldrayage.mapper;
+
+import org.junit.jupiter.api.Test;
+import java.nio.file.*;
+import java.util.regex.Pattern;
+import static org.junit.jupiter.api.Assertions.*;
+
+class DirectDeliverySchemaContractTest {
+    @Test void immutableDirectEvidenceAndIndependentWritePermissionsReachDeploymentBaseline() throws Exception {
+        String source=Files.readString(Path.of("src/main/resources/db/phase3-direct-delivery-schema.sql"));
+        String release=Files.readString(Path.of("../deploy/sql/头程数据库统一增量-MySQL8.sql"));
+        assertEquals(definition(source),definition(release));
+        assertTrue(source.contains("PRIMARY KEY (container_booking_id,inbound_id)"));
+        assertTrue(source.contains("UNIQUE KEY uk_direct_unloading_command"));
+        String permissions=Files.readString(Path.of("../iam/src/main/resources/db/appointment-work-permissions.sql"));
+        for(String code:java.util.List.of("platform:appointment:manage-work","platform:firstleg:terminal-drayage:direct-unload:confirm")) {
+            assertTrue(release.contains("'"+code+"'"));assertTrue(permissions.contains("'"+code+"'"));
+        }
+        assertTrue(release.contains("VALUES (4000001,5107283,0,CURRENT_TIMESTAMP(3))"));
+        assertTrue(release.contains("VALUES (4000001,5102213,0,CURRENT_TIMESTAMP(3))"));
+        assertTrue(permissions.indexOf("CALL check_appointment_work_permission_identity")<permissions.indexOf("INSERT INTO iam_permission"));
+        assertTrue(permissions.contains("platform:firstleg:terminal-drayage:direct-unload:confirm"));
+        assertTrue(permissions.contains("platform:appointment:manage-work"));
+    }
+    private String definition(String sql) {
+        var match=Pattern.compile("CREATE TABLE(?: IF NOT EXISTS)? fl_direct_delivery_unloading \\([\\s\\S]*?\\) ENGINE=InnoDB[^\\r\\n]*;").matcher(sql);
+        assertTrue(match.find());String result=match.group().replace("CREATE TABLE IF NOT EXISTS","CREATE TABLE").replace("\r\n","\n");
+        assertFalse(match.find());return result;
+    }
+}
diff --git a/firstleg/src/test/java/com/baiyue/firstleg/terminaldrayage/mapper/TerminalDrayageCalendarMapperTest.java b/firstleg/src/test/java/com/baiyue/firstleg/terminaldrayage/mapper/TerminalDrayageCalendarMapperTest.java
index b961e9520..e742f68e0 100644
--- a/firstleg/src/test/java/com/baiyue/firstleg/terminaldrayage/mapper/TerminalDrayageCalendarMapperTest.java
+++ b/firstleg/src/test/java/com/baiyue/firstleg/terminaldrayage/mapper/TerminalDrayageCalendarMapperTest.java
@@ -14,11 +14,11 @@ class TerminalDrayageCalendarMapperTest {
     @Test void respectsExclusiveRangeActiveDepartureWithoutDuplicatingContainersOrOwningShippingFacts() throws Exception {
         var ds=new JdbcDataSource();ds.setURL("jdbc:h2:mem:pickup-calendar;MODE=MySQL;DB_CLOSE_DELAY=-1");
         try(var c=ds.getConnection();var s=c.createStatement()) {
-            s.execute("CREATE TABLE fl_container_booking(id BIGINT,booking_no VARCHAR,container_no VARCHAR,destination_port_name VARCHAR,destination_warehouse_code VARCHAR,record_status VARCHAR)");
+            s.execute("CREATE TABLE fl_container_booking(id BIGINT,cabinet_no VARCHAR,container_no VARCHAR,destination_port_name VARCHAR,destination_warehouse_code VARCHAR,record_status VARCHAR)");
             s.execute("CREATE TABLE fl_terminal_drayage(container_booking_id BIGINT,fleet_supplier_name VARCHAR,pickup_appointment_at TIMESTAMP)");
             s.execute("CREATE TABLE fl_outbound_dispatch(container_booking_id BIGINT,confirmed_at TIMESTAMP,reversed_at TIMESTAMP,status VARCHAR)");
             for(int id=1;id<=5;id++) {
-                s.execute("INSERT INTO fl_container_booking VALUES("+id+",'CB','CONT','Port','US-W','"+(id==4?"CANCELLED":"ACTIVE")+"')");
+                s.execute("INSERT INTO fl_container_booking VALUES("+id+",'D000"+id+"','CONT','Port','US-W','"+(id==4?"CANCELLED":"ACTIVE")+"')");
                 s.execute("INSERT INTO fl_terminal_drayage VALUES("+id+",'Fleet','"+(id==3?"2026-11-01 00:00:00":"2026-10-01 09:00:00")+"')");
                 s.execute("INSERT INTO fl_outbound_dispatch VALUES("+id+",'2026-09-01',"+(id==5?"'2026-09-02'":"NULL")+",'WAITING_FOR_LOADING')");
             }
@@ -28,6 +28,16 @@ class TerminalDrayageCalendarMapperTest {
         try(var session=new MybatisSqlSessionFactoryBuilder().build(config).openSession()) {
             var rows=session.getMapper(TerminalDrayageMapper.class).calendar(LocalDateTime.parse("2026-10-01T00:00:00"),LocalDateTime.parse("2026-11-01T00:00:00"),1001);
             assertEquals(List.of(1L,2L),rows.stream().map(r->r.containerBookingId()).toList());assertNull(rows.get(0).actualPickupAt());
+            assertEquals("D0001", rows.get(0).cabinetNo());
+            try(var c=ds.getConnection();var s=c.createStatement()) {
+                s.execute("UPDATE fl_terminal_drayage SET pickup_appointment_at='2026-12-01' WHERE container_booking_id=3");
+                s.execute("DELETE FROM fl_terminal_drayage WHERE container_booking_id=2");
+            }
+            session.clearCache();
+            rows=session.getMapper(TerminalDrayageMapper.class).calendarByContainers(List.of(1L,2L,3L,4L,5L));
+            assertEquals(List.of(1L,2L,3L),rows.stream().map(r->r.containerBookingId()).toList());
+            assertNull(rows.get(1).pickupAppointmentAt());
+            assertEquals(LocalDateTime.parse("2026-12-01T00:00:00"),rows.get(2).pickupAppointmentAt());
         }
     }
 }
diff --git a/firstleg/src/test/java/com/baiyue/firstleg/terminaldrayage/service/AppointmentWorkTerminalFactsTest.java b/firstleg/src/test/java/com/baiyue/firstleg/terminaldrayage/service/AppointmentWorkTerminalFactsTest.java
new file mode 100644
index 000000000..bcf2a3324
--- /dev/null
+++ b/firstleg/src/test/java/com/baiyue/firstleg/terminaldrayage/service/AppointmentWorkTerminalFactsTest.java
@@ -0,0 +1,77 @@
+package com.baiyue.firstleg.terminaldrayage.service;
+
+import com.baiyue.firstleg.portschedule.dto.AppointmentWorkSourceDtos.*;
+import com.baiyue.firstleg.portschedule.dto.CarrierScheduleQueryDtos.ContainerActualFacts;
+import com.baiyue.firstleg.portschedule.service.CarrierScheduleQueryService;
+import com.baiyue.firstleg.terminaldrayage.mapper.*;
+import com.baiyue.firstleg.terminaldrayage.entity.TerminalDrayageEntity;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import org.junit.jupiter.api.Test;
+import java.time.LocalDateTime;
+import java.util.List;
+import java.util.Map;
+import static org.mockito.Mockito.*;
+import static org.junit.jupiter.api.Assertions.*;
+
+class AppointmentWorkTerminalFactsTest {
+    private final TerminalDrayageMapper terminal=mock(TerminalDrayageMapper.class);
+    private final DirectDeliveryMapper direct=mock(DirectDeliveryMapper.class);
+    private final CarrierScheduleQueryService nodes=mock(CarrierScheduleQueryService.class);
+    private final UnloadingEvidenceGuard guard=mock(UnloadingEvidenceGuard.class);
+    private final AppointmentWorkTerminalFacts adapter=new AppointmentWorkTerminalFacts(terminal,direct,nodes,guard,new ObjectMapper().findAndRegisterModules());
+    private final LocalDateTime at=LocalDateTime.parse("2026-01-01T12:30:00");
+    private ContainerSource source(){return new ContainerSource("1","C1",null,at,at,"v","UNKNOWN",null,List.of());}
+    private FactRequest request(String type){return new FactRequest("W1",type,"DIRECT","1",null,null,null,List.of(),List.of(),List.of());}
+    private Fact read(FactRequest request,ContainerSource source) {return adapter.read(List.of(request),Map.of(1L,source)).get(0);}
+    @Test void twoHundredRequestsReadEachFactSetOnceAndKeepMissingFactsVisible() {
+        var ids=java.util.stream.LongStream.rangeClosed(1,100).boxed().toList();
+        var sources=new java.util.HashMap<Long,ContainerSource>();
+        var requests=new java.util.ArrayList<FactRequest>();
+        for(long id:ids) {
+            sources.put(id,new ContainerSource(Long.toString(id),"C"+id,null,at,at,"v","UNKNOWN",null,List.of()));
+            requests.add(new FactRequest("P"+id,"PICKUP","TRANSIT",Long.toString(id),null,null,null,List.of(),List.of(),List.of()));
+            requests.add(new FactRequest("R"+id,"EMPTY_RETURN","TRANSIT",Long.toString(id),null,null,null,List.of(),List.of(),List.of()));
+        }
+        var results=adapter.read(requests,sources);
+        assertEquals(200,results.size());
+        for(int i=0;i<results.size();i++) {assertEquals(requests.get(i).workItemKey(),results.get(i).workItemKey());assertFalse(results.get(i).blockReasons().isEmpty());}
+        verify(nodes).containerActualFacts(ids);verify(terminal).findAll(ids);verify(terminal).pickupChanges(ids);
+        verify(guard).completedUnloading(ids);verifyNoMoreInteractions(nodes,terminal,guard);verifyNoInteractions(direct);
+    }
+    @Test void batchedFlowConflictsStillFailClosed() {
+        when(direct.flowEvidence(List.of(1L,2L))).thenReturn(List.of(new DirectDeliveryMapper.FlowEvidence(1,null,1),new DirectDeliveryMapper.FlowEvidence(2,at,1)));
+        assertEquals(409,assertThrows(org.springframework.web.server.ResponseStatusException.class,()->adapter.establishedFlows(List.of(1L,2L))).getStatusCode().value());
+    }
+    @Test void initialPickupPlanRetainsLocalDateAndDoesNotInventZoneOrReview() {
+        var plan=new TerminalDrayageEntity();plan.setContainerBookingId(1L);plan.setPickupAppointmentAt(at);plan.setFleetSupplierId(4L);plan.setFleetSupplierName("车队");
+        when(terminal.findAll(List.of(1L))).thenReturn(List.of(plan));
+        when(terminal.pickupChanges(List.of(1L))).thenReturn(List.of(new TerminalDrayageMapper.PickupChanges(1,1,1)));
+        var fact=read(request("PICKUP"),source());
+        assertEquals("0:0",fact.impactToken());assertEquals(at.toLocalDate(),fact.confirmed().date());
+        assertNull(fact.timezone());assertTrue(fact.missingFields().contains("SOURCE_TIMEZONE"));
+        var returnRequest=new FactRequest("W2","EMPTY_RETURN","DIRECT","1",null,null,null,List.of(),List.of(),List.of());
+        assertEquals(fact,adapter.read(List.of(request("PICKUP"),returnRequest),Map.of(1L,source())).get(0));
+        when(terminal.pickupChanges(List.of(1L))).thenReturn(List.of(new TerminalDrayageMapper.PickupChanges(1,2,1)));
+        assertEquals("1:0",read(request("PICKUP"),source()).impactToken());
+    }
+    @Test void emptyReturnActualIsCompleteEvenWhenOriginalTimezoneIsUnknownAndDoesNotCopyPickupResponsibility() {
+        var plan=new TerminalDrayageEntity();plan.setContainerBookingId(1L);plan.setFleetSupplierId(4L);plan.setFleetSupplierName("提柜承运人");
+        when(terminal.findAll(List.of(1L))).thenReturn(List.of(plan));
+        when(nodes.containerActualFacts(List.of(1L))).thenReturn(List.of(new ContainerActualFacts(1L,2L,3,"STOPPED","EMPTY_RETURNED",at,null,null,null,null,at.minusDays(1),at)));
+        var fact=read(request("EMPTY_RETURN"),source());
+        assertEquals("COMPLETED",fact.executionStatus());assertNull(fact.actual().occurredAt());assertEquals(at,fact.actual().localOccurredAt());
+        assertNull(fact.responsibility());assertNull(fact.action());assertNull(fact.businessNo());
+    }
+    @Test void directDeliveryReferencesOnlyItsOwnPhysicalSourceAndCustomer() {
+        var own=List.of(new Reference("CUSTOMER","7",null,"客户A"),new Reference("INBOUND","2","IN2","入仓单"));
+        var other=List.of(new Reference("CUSTOMER","8",null,"客户B"),new Reference("INBOUND","3","IN3","入仓单"));
+        var source=new ContainerSource("1","C1",null,at,at,"v","DIRECT",null,List.of(
+            new Requirement("INBOUND:2",null,null,"PRIVATE","港","A",null,own,List.of(),List.of()),
+            new Requirement("INBOUND:3",null,null,"PRIVATE","港","B",null,other,List.of(),List.of())));
+        when(direct.deliveriesBatch(List.of(1L))).thenReturn(List.of(new DirectDeliveryMapper.ContainerDelivery(1,2,"IN2","O2","A",4,1,at,"America/Los_Angeles","a","P2",null,"k","h")));
+        var request=new FactRequest("W1","DELIVERY","DIRECT","1","INBOUND:2",null,null,List.of(),List.of(),List.of());
+        var fact=read(request,source);
+        assertEquals(own,fact.references());assertEquals("IN2",fact.businessNo());assertEquals("COMPLETED",fact.executionStatus());
+        assertEquals(fact,adapter.read(List.of(request,new FactRequest("W2","PICKUP","DIRECT","1",null,null,null,List.of(),List.of(),List.of())),Map.of(1L,source)).get(0));
+    }
+}
diff --git a/firstleg/src/test/java/com/baiyue/firstleg/terminaldrayage/service/ContainerWorkbenchServiceTest.java b/firstleg/src/test/java/com/baiyue/firstleg/terminaldrayage/service/ContainerWorkbenchServiceTest.java
index 74175e9c0..73a53dcf7 100644
--- a/firstleg/src/test/java/com/baiyue/firstleg/terminaldrayage/service/ContainerWorkbenchServiceTest.java
+++ b/firstleg/src/test/java/com/baiyue/firstleg/terminaldrayage/service/ContainerWorkbenchServiceTest.java
@@ -132,7 +132,7 @@ class ContainerWorkbenchServiceTest {
         var mapper = mock(com.baiyue.firstleg.terminaldrayage.mapper.TerminalDrayageMapper.class);
         var json = new com.fasterxml.jackson.databind.ObjectMapper().findAndRegisterModules();
         var realDrayages = new TerminalDrayageService(mapper,
-            mock(com.baiyue.firstleg.service.WarehouseSupplierSnapshotService.class), carrierSchedules, json, mock(TerminalDrayageMailService.class));
+            mock(com.baiyue.firstleg.service.WarehouseSupplierSnapshotService.class), carrierSchedules, json, mock(TerminalDrayageMailService.class), mock(UnloadingEvidenceGuard.class));
         ReflectionTestUtils.setField(service, "terminalDrayages", realDrayages);
         ContainerBookingEntity container = container();
         container.setUnloadingCompletedAt(LocalDateTime.of(2026, 9, 5, 8, 0));
@@ -176,7 +176,7 @@ class ContainerWorkbenchServiceTest {
         var mapper = mock(com.baiyue.firstleg.terminaldrayage.mapper.TerminalDrayageMapper.class);
         var realDrayages = new TerminalDrayageService(mapper,
             mock(com.baiyue.firstleg.service.WarehouseSupplierSnapshotService.class), carrierSchedules,
-            new com.fasterxml.jackson.databind.ObjectMapper().findAndRegisterModules(), mock(TerminalDrayageMailService.class));
+            new com.fasterxml.jackson.databind.ObjectMapper().findAndRegisterModules(), mock(TerminalDrayageMailService.class), mock(UnloadingEvidenceGuard.class));
         ReflectionTestUtils.setField(service, "terminalDrayages", realDrayages);
         ContainerBookingEntity container = container();
         LocalDateTime unloadedAt = LocalDateTime.of(2026, 9, 5, 8, 0);
diff --git a/firstleg/src/test/java/com/baiyue/firstleg/terminaldrayage/service/DirectDeliveryRouteGuardTest.java b/firstleg/src/test/java/com/baiyue/firstleg/terminaldrayage/service/DirectDeliveryRouteGuardTest.java
new file mode 100644
index 000000000..ecdd95a33
--- /dev/null
+++ b/firstleg/src/test/java/com/baiyue/firstleg/terminaldrayage/service/DirectDeliveryRouteGuardTest.java
@@ -0,0 +1,22 @@
+package com.baiyue.firstleg.terminaldrayage.service;
+
+import com.baiyue.firstleg.client.AppointmentWorkRouteClient;
+import com.baiyue.common.core.api.ApiResponse;
+import org.junit.jupiter.api.Test;
+import org.springframework.web.server.ResponseStatusException;
+import static org.mockito.Mockito.*;
+import static org.junit.jupiter.api.Assertions.*;
+
+class DirectDeliveryRouteGuardTest {
+    @Test void onlyConfirmedDirectRouteCanExecuteAndRemoteFailureIsNotUnknownSuccess() {
+        var client=mock(AppointmentWorkRouteClient.class);var guard=new DirectDeliveryRouteGuard(client,"token");
+        for(String flow:new String[]{"UNKNOWN","TRANSFER"}) {
+            when(client.route("token",1)).thenReturn(ApiResponse.success(new AppointmentWorkRouteClient.Route(flow)));
+            assertEquals(409,assertThrows(ResponseStatusException.class,()->guard.requireDirect(1)).getStatusCode().value());
+        }
+        when(client.route("token",1)).thenReturn(ApiResponse.success(new AppointmentWorkRouteClient.Route("DIRECT")));
+        assertDoesNotThrow(()->guard.requireDirect(1));
+        when(client.route("token",1)).thenThrow(new IllegalStateException("offline"));
+        assertEquals(503,assertThrows(ResponseStatusException.class,()->guard.requireDirect(1)).getStatusCode().value());
+    }
+}
diff --git a/firstleg/src/test/java/com/baiyue/firstleg/terminaldrayage/service/DirectDeliveryServiceTest.java b/firstleg/src/test/java/com/baiyue/firstleg/terminaldrayage/service/DirectDeliveryServiceTest.java
new file mode 100644
index 000000000..c7f3b3701
--- /dev/null
+++ b/firstleg/src/test/java/com/baiyue/firstleg/terminaldrayage/service/DirectDeliveryServiceTest.java
@@ -0,0 +1,50 @@
+package com.baiyue.firstleg.terminaldrayage.service;
+
+import com.baiyue.firstleg.terminaldrayage.mapper.DirectDeliveryMapper;
+import com.baiyue.firstleg.portschedule.service.CarrierScheduleQueryService;
+import com.baiyue.firstleg.portschedule.dto.CarrierScheduleQueryDtos.ContainerActualFacts;
+import com.baiyue.common.core.exception.BizException;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import org.junit.jupiter.api.Test;
+import java.time.LocalDateTime;
+import java.util.List;
+import static org.mockito.Mockito.*;
+import static org.mockito.ArgumentMatchers.*;
+import static org.junit.jupiter.api.Assertions.*;
+
+class DirectDeliveryServiceTest {
+    private final DirectDeliveryMapper mapper=mock(DirectDeliveryMapper.class);
+    private final CarrierScheduleQueryService nodes=mock(CarrierScheduleQueryService.class);
+    private final DirectDeliveryService service=new DirectDeliveryService(mapper,nodes,new ObjectMapper().findAndRegisterModules(),mock(DirectDeliveryRouteGuard.class));
+    private final LocalDateTime at=LocalDateTime.parse("2026-01-03T12:00:00");
+    private DirectDeliveryMapper.Delivery pending(){return new DirectDeliveryMapper.Delivery(2,"IN2","O2","客户仓",4,0,null,null,null,null,null,null,null);}
+    private DirectDeliveryService.Request request(){return new DirectDeliveryService.Request(0,at,"America/Los_Angeles","收货人","POD-2","直送签收");}
+    @Test void recordsOnlyActualLoadedSourceAfterPickupAndReplaysWithoutDuplicateWrite() {
+        when(mapper.lockContainer(1)).thenReturn(new DirectDeliveryMapper.Container(1,"ACTIVE",null));
+        when(mapper.deliveries(1)).thenReturn(List.of(pending()));
+        // Unknown pickup zone: a numerically later source-local clock is not evidence
+        // that the explicitly Los Angeles destination actual occurred first.
+        when(nodes.containerActualFacts(List.of(1L))).thenReturn(List.of(new ContainerActualFacts(1L,2L,3,"READY","PICKED_UP",at.plusHours(1),null,null,null,null,at.plusHours(1),null)));
+        doAnswer(inv->{
+            when(mapper.deliveries(1)).thenReturn(List.of(new DirectDeliveryMapper.Delivery(2,"IN2","O2","客户仓",4,1,at,"America/Los_Angeles","收货人","POD-2","直送签收","k",inv.getArgument(8))));
+            return 1;
+        }).when(mapper).insert(anyLong(),anyLong(),any(),anyString(),anyString(),anyString(),any(),anyString(),anyString(),anyLong(),anyString());
+        assertEquals(1,service.record(1,2,7,"admin","k",request()).version());
+        assertEquals(1,service.record(1,2,7,"admin","k",request()).version());
+        verify(mapper,times(1)).insert(eq(1L),eq(2L),eq(at),eq("America/Los_Angeles"),eq("收货人"),eq("POD-2"),any(),eq("k"),anyString(),eq(7L),eq("admin"));
+    }
+    @Test void refusesForeignSourceAndWarehouseReceiptWithoutWriting() {
+        when(mapper.lockContainer(1)).thenReturn(new DirectDeliveryMapper.Container(1,"ACTIVE",at.minusDays(1)));
+        when(mapper.deliveries(1)).thenReturn(List.of(pending()));
+        assertThrows(BizException.class,()->service.record(1,99,7,"a","k",request()));
+        assertThrows(BizException.class,()->service.record(1,2,7,"a","k",request()));
+        verifyNoInteractions(nodes);
+        verify(mapper,never()).insert(anyLong(),anyLong(),any(),anyString(),anyString(),anyString(),any(),anyString(),anyString(),anyLong(),anyString());
+    }
+    @Test void refusesAmbiguousLocalTimeInsteadOfGuessingAnOffset() {
+        when(mapper.lockContainer(1)).thenReturn(new DirectDeliveryMapper.Container(1,"ACTIVE",null));
+        when(mapper.deliveries(1)).thenReturn(List.of(pending()));
+        var ambiguous=new DirectDeliveryService.Request(0,LocalDateTime.parse("2025-11-02T01:30:00"),"America/Los_Angeles","收货人","POD",null);
+        assertThrows(BizException.class,()->service.record(1,2,7,"a","k",ambiguous));verifyNoInteractions(nodes);
+    }
+}
diff --git a/firstleg/src/test/java/com/baiyue/firstleg/terminaldrayage/service/TerminalDrayageCalendarServiceTest.java b/firstleg/src/test/java/com/baiyue/firstleg/terminaldrayage/service/TerminalDrayageCalendarServiceTest.java
index 261f645f1..14deae53a 100644
--- a/firstleg/src/test/java/com/baiyue/firstleg/terminaldrayage/service/TerminalDrayageCalendarServiceTest.java
+++ b/firstleg/src/test/java/com/baiyue/firstleg/terminaldrayage/service/TerminalDrayageCalendarServiceTest.java
@@ -18,7 +18,7 @@ class TerminalDrayageCalendarServiceTest {
     final com.baiyue.firstleg.portschedule.service.CarrierScheduleQueryService shipping=mock(com.baiyue.firstleg.portschedule.service.CarrierScheduleQueryService.class);
     final TerminalDrayageCalendarService service=new TerminalDrayageCalendarService(mapper,warehouses,shipping,"test");
     final LocalDate from=LocalDate.of(2026,10,1),to=from.plusDays(31);
-    PickupCalendarEntry row(long id,String code) {return new PickupCalendarEntry(id,"CB-"+id,"TEST-CONT","Port",code,"Fleet",from.atTime(9,0),null);}
+    PickupCalendarEntry row(long id,String code) {return new PickupCalendarEntry(id,"D000"+id,"TEST-CONT","Port",code,"Fleet",from.atTime(9,0),null);}
     @Test void batchesTheCatalogAndKeepsUnknownScopeVisibleWithoutGuessingPortTimeZone() {
         when(mapper.calendar(any(),any(),eq(1001))).thenReturn(List.of(row(1,"US-W"),row(2,"CA-W"),row(3,"UNKNOWN")));
         when(warehouses.catalog("test")).thenReturn(ApiResponse.success(List.of(
@@ -46,8 +46,35 @@ class TerminalDrayageCalendarServiceTest {
         when(mapper.calendar(any(),any(),anyInt())).thenReturn(List.of());assertTrue(service.calendar(from,to).records().isEmpty());verifyNoInteractions(warehouses);
     }
     @Test void reportsTruncationInsteadOfClaimingCompleteResults() {
-        when(mapper.calendar(any(),any(),anyInt())).thenReturn(Collections.nCopies(1001,row(1,"US-W")));
+        when(mapper.calendar(any(),any(),anyInt())).thenReturn(java.util.stream.LongStream.rangeClosed(1,1001).mapToObj(id->row(id,"US-W")).toList());
         when(warehouses.catalog("test")).thenReturn(ApiResponse.success(List.of(new WarehouseMasterDataClient.CatalogWarehouse(1L,"US-W","US","OVERSEAS","US"))));
         var result=service.calendar(from,to);assertTrue(result.truncated());assertEquals(1000,result.records().size());
     }
+    @Test void mergesActualMonthWithoutMovingExecutedWorkWhenPlansChangeOrDuplicatingTheContainer() {
+        when(mapper.calendar(any(),any(),anyInt())).thenReturn(List.of(row(1,"US-W"),row(2,"US-W")));
+        when(shipping.pickupCalendarContainers(any(),any())).thenReturn(List.of(2L,3L));
+        var movedPlan=new PickupCalendarEntry(3L,"D0003","CONT3","Port","US-W","Fleet",to.plusDays(20).atStartOfDay(),null);
+        when(mapper.calendarByContainers(List.of(2L,3L))).thenReturn(List.of(row(2,"US-W"),movedPlan));
+        when(warehouses.catalog("test")).thenReturn(ApiResponse.success(List.of(new WarehouseMasterDataClient.CatalogWarehouse(1L,"US-W","US","OVERSEAS","US"))));
+        when(shipping.containerActualFacts(List.of(1L,2L,3L))).thenReturn(List.of(
+            fact(1L,to.atStartOfDay()),fact(2L,from.atStartOfDay()),fact(3L,from.plusDays(1).atStartOfDay())));
+        var result=service.calendar(from,to);
+        assertEquals(List.of(2L,3L),result.records().stream().map(PickupCalendarEntry::containerBookingId).toList());
+        assertEquals(to.plusDays(20).atStartOfDay(),result.records().get(1).pickupAppointmentAt());
+        assertEquals(from.plusDays(1).atStartOfDay(),result.records().get(1).actualPickupAt());
+        assertFalse(result.truncated());
+    }
+    private com.baiyue.firstleg.portschedule.dto.CarrierScheduleQueryDtos.ContainerActualFacts fact(long id,java.time.LocalDateTime at) {
+        return new com.baiyue.firstleg.portschedule.dto.CarrierScheduleQueryDtos.ContainerActualFacts(id,null,null,null,null,null,null,null,null,null,at,null);
+    }
+    @Test void includesAnActualPickupWithoutInventingAnAppointment() {
+        when(shipping.pickupCalendarContainers(any(),any())).thenReturn(List.of(3L));
+        when(mapper.calendarByContainers(List.of(3L))).thenReturn(List.of(new PickupCalendarEntry(3L,"D0003","CONT3","Port","US-W",null,null,null)));
+        when(warehouses.catalog("test")).thenReturn(ApiResponse.success(List.of(new WarehouseMasterDataClient.CatalogWarehouse(1L,"US-W","US","OVERSEAS","US"))));
+        when(shipping.containerActualFacts(List.of(3L))).thenReturn(List.of(fact(3L,from.atStartOfDay())));
+        var result=service.calendar(from,to);
+        assertEquals(1,result.records().size());
+        assertNull(result.records().get(0).pickupAppointmentAt());
+        assertEquals(from.atStartOfDay(),result.records().get(0).actualPickupAt());
+    }
 }
diff --git a/firstleg/src/test/java/com/baiyue/firstleg/terminaldrayage/service/TerminalDrayageServiceTest.java b/firstleg/src/test/java/com/baiyue/firstleg/terminaldrayage/service/TerminalDrayageServiceTest.java
index c25510484..c5e6ef656 100644
--- a/firstleg/src/test/java/com/baiyue/firstleg/terminaldrayage/service/TerminalDrayageServiceTest.java
+++ b/firstleg/src/test/java/com/baiyue/firstleg/terminaldrayage/service/TerminalDrayageServiceTest.java
@@ -47,6 +47,7 @@ class TerminalDrayageServiceTest {
     private CarrierScheduleQueryService carrierSchedules;
     private TerminalDrayageService service;
     private TerminalDrayageMailService mails;
+    private UnloadingEvidenceGuard unloadingEvidence;
     private Deque<ContainerActualFacts> facts;
 
     @BeforeEach
@@ -60,7 +61,8 @@ class TerminalDrayageServiceTest {
             return List.of(facts.size() > 1 ? facts.removeFirst() : facts.peekFirst());
         });
         mails = mock(TerminalDrayageMailService.class);
-        service = new TerminalDrayageService(mapper, suppliers, carrierSchedules, new ObjectMapper().findAndRegisterModules(), mails);
+        unloadingEvidence = mock(UnloadingEvidenceGuard.class);
+        service = new TerminalDrayageService(mapper, suppliers, carrierSchedules, new ObjectMapper().findAndRegisterModules(), mails, unloadingEvidence);
         service.setClock(Clock.fixed(Instant.parse("2026-09-05T02:00:00Z"), ZoneOffset.UTC));
     }
 
@@ -115,7 +117,7 @@ class TerminalDrayageServiceTest {
         assertThatThrownBy(() -> service.recordEmptyReturn(11L, 7L, "admin", "return-1",
             new ActualTimeRequest(3, LocalDateTime.of(2026, 9, 4, 10, 0), null)))
             .isInstanceOf(BizException.class)
-            .hasMessage("海外卸柜收货完成后才能确认还柜");
+            .hasMessage("海外仓卸柜或全部直送目的仓实际卸货完成后才能确认还柜");
         verify(carrierSchedules, never()).addContainerManualNode(anyLong(), anyLong(), anyString(), anyString(), any());
     }
 
@@ -138,6 +140,19 @@ class TerminalDrayageServiceTest {
         assertThat(service.detail(11L).emptyReturnWarning().overdueHours()).isZero();
     }
 
+    @Test
+    void directReturnWarningUsesDestinationInstantInsteadOfServerWallClock() {
+        when(mapper.context(11L)).thenReturn(context("PICKED_UP", null));
+        when(mapper.find(11L)).thenReturn(row(3));
+        when(unloadingEvidence.directCompletion(11L)).thenReturn(new UnloadingEvidenceGuard.DirectCompletion(
+            LocalDateTime.parse("2026-09-01T22:00:00"), "America/Los_Angeles"));
+        var result=service.detail(11L);
+        assertThat(result.estimatedEmptyReturnAt()).isEqualTo(LocalDateTime.parse("2026-09-04T22:00:00"));
+        assertThat(result.emptyReturnWarning().status()).isEqualTo("PENDING");
+        service.setClock(Clock.fixed(Instant.parse("2026-09-05T06:00:00Z"), ZoneOffset.ofHours(9)));
+        assertThat(service.detail(11L).emptyReturnWarning().overdueHours()).isEqualTo(1);
+    }
+
     @Test
     void offersEmptyReturnAfterUnloadWithoutDrayageAggregateOrPickupFact() {
         LocalDateTime unloadedAt = LocalDateTime.of(2026, 9, 3, 0, 0);
diff --git a/firstleg/src/test/java/com/baiyue/firstleg/terminaldrayage/service/UnloadingEvidenceGuardTest.java b/firstleg/src/test/java/com/baiyue/firstleg/terminaldrayage/service/UnloadingEvidenceGuardTest.java
new file mode 100644
index 000000000..2a667b66c
--- /dev/null
+++ b/firstleg/src/test/java/com/baiyue/firstleg/terminaldrayage/service/UnloadingEvidenceGuardTest.java
@@ -0,0 +1,56 @@
+package com.baiyue.firstleg.terminaldrayage.service;
+
+import com.baiyue.firstleg.terminaldrayage.mapper.DirectDeliveryMapper;
+import com.baiyue.common.core.exception.BizException;
+import org.junit.jupiter.api.Test;
+import java.time.LocalDateTime;
+import java.util.List;
+import static org.mockito.Mockito.*;
+import static org.junit.jupiter.api.Assertions.*;
+
+class UnloadingEvidenceGuardTest {
+    @Test void batchRetainsInactiveMissingPartialAndZonedCompletionRules() {
+        var mapper=mock(DirectDeliveryMapper.class);var guard=new UnloadingEvidenceGuard(mapper);
+        var at=LocalDateTime.parse("2026-10-10T12:00:00");
+        var ids=List.of(1L,2L,3L,4L,5L,6L);
+        when(mapper.containers(ids)).thenReturn(List.of(new DirectDeliveryMapper.Container(1,"ACTIVE",at),
+            new DirectDeliveryMapper.Container(2,"ACTIVE",null),new DirectDeliveryMapper.Container(3,"ACTIVE",null),
+            new DirectDeliveryMapper.Container(4,"CANCELLED",at),new DirectDeliveryMapper.Container(5,"ACTIVE",null)));
+        when(mapper.deliveriesBatch(List.of(2L,3L,5L))).thenReturn(List.of(
+            new DirectDeliveryMapper.ContainerDelivery(2,20,"I20","O20","D",1,1,at,"America/New_York",null,null,null,null,null),
+            new DirectDeliveryMapper.ContainerDelivery(2,21,"I21","O21","D",1,1,at.minusHours(2),"America/Los_Angeles",null,null,null,null,null),
+            new DirectDeliveryMapper.ContainerDelivery(3,30,"I30","O30","D",1,1,at,"America/New_York",null,null,null,null,null),
+            new DirectDeliveryMapper.ContainerDelivery(3,31,"I31","O31","D",1,0,null,null,null,null,null,null,null)));
+        assertEquals(java.util.Map.of(1L,at,2L,at.minusHours(2)),guard.completedUnloading(ids));
+        verify(mapper).containers(ids);verify(mapper).deliveriesBatch(List.of(2L,3L,5L));verifyNoMoreInteractions(mapper);
+    }
+    @Test void requiresEveryPhysicalInboundSourceAndAcceptsLatestActualEvidence() {
+        var mapper=mock(DirectDeliveryMapper.class);var guard=new UnloadingEvidenceGuard(mapper);
+        var container=new DirectDeliveryMapper.Container(1,"ACTIVE",null);
+        when(mapper.container(1)).thenReturn(container);when(mapper.lockContainer(1)).thenReturn(container);
+        var at=LocalDateTime.parse("2026-10-10T12:00:00");
+        var first=new DirectDeliveryMapper.Delivery(2,"IN2","O2","D",4,1,at,"America/Los_Angeles","张三","POD2",null,"k","h");
+        var pending=new DirectDeliveryMapper.Delivery(3,"IN3","O3","D",6,0,null,null,null,null,null,null,null);
+        when(mapper.deliveries(1)).thenReturn(List.of(first,pending));
+        assertNull(guard.completedUnloading(1));assertThrows(BizException.class,()->guard.requireUnloaded(1,at.plusDays(1)));
+        var second=new DirectDeliveryMapper.Delivery(3,"IN3","O3","D",6,1,at.plusHours(1),"America/Los_Angeles","李四","POD3",null,"k3","h3");
+        when(mapper.deliveries(1)).thenReturn(List.of(first,second));
+        assertEquals(at.plusHours(1),guard.completedUnloading(1));
+        assertDoesNotThrow(()->guard.requireUnloaded(1,at)); // Return has no source zone.
+        assertDoesNotThrow(()->guard.requireUnloaded(1,at.plusDays(1)));
+        var warehouse=new DirectDeliveryMapper.Container(1,"ACTIVE",at.plusHours(1));
+        when(mapper.container(1)).thenReturn(warehouse);when(mapper.lockContainer(1)).thenReturn(warehouse);
+        assertThrows(BizException.class,()->guard.requireUnloaded(1,at));
+    }
+    @Test void comparesDestinationEvidenceByInstantAndMeasuresSeventyTwoHoursAcrossDst() {
+        var mapper=mock(DirectDeliveryMapper.class);var guard=new UnloadingEvidenceGuard(mapper);
+        var ny=LocalDateTime.parse("2026-10-10T12:00:00");
+        var la=LocalDateTime.parse("2026-10-10T10:00:00");
+        when(mapper.deliveries(1)).thenReturn(List.of(
+            new DirectDeliveryMapper.Delivery(2,"IN2","O2","D",4,1,ny,"America/New_York","a","P2",null,"k2","h2"),
+            new DirectDeliveryMapper.Delivery(3,"IN3","O3","D",6,1,la,"America/Los_Angeles","a","P3",null,"k3","h3")));
+        assertEquals(la,guard.directCompletion(1).localAt());
+        var beforeFallback=new UnloadingEvidenceGuard.DirectCompletion(LocalDateTime.parse("2026-10-31T12:00:00"),"America/Los_Angeles");
+        assertEquals(LocalDateTime.parse("2026-11-03T11:00:00"),beforeFallback.deadline(72));
+    }
+}
diff --git a/firstleg/src/test/resources/architecture/firstleg-slice-dependencies.json b/firstleg/src/test/resources/architecture/firstleg-slice-dependencies.json
index 89298259e..885f6cd5f 100644
--- a/firstleg/src/test/resources/architecture/firstleg-slice-dependencies.json
+++ b/firstleg/src/test/resources/architecture/firstleg-slice-dependencies.json
@@ -85,12 +85,56 @@
   ],
   "sliceSpecificRules": {
     "customer-statistics": {
-      "allowedOutgoing": ["shared-technical"],
+      "allowedOutgoing": [
+        "shared-technical"
+      ],
       "allowedIncoming": []
     },
     "pricebook-query": {
       "allowedOutgoing": [],
-      "allowedIncoming": ["booking-customs-trucking", "measurement-pricing", "split-loading"]
+      "allowedIncoming": [
+        "booking-customs-trucking",
+        "measurement-pricing",
+        "split-loading"
+      ]
     }
-  }
+  },
+  "reviewedClassDependencies": [
+    {
+      "source": "com.baiyue.firstleg.controller.InternalOverseasContainerEventController",
+      "target": "com.baiyue.firstleg.service.OverseasInboundOrderDetainedConsumer",
+      "reason": "海外事件HTTP适配器按事件类型派发到暂扣消费者；入仓数据仍由消费者维护。"
+    },
+    {
+      "source": "com.baiyue.firstleg.loading.service.LoadingDeliveryService",
+      "target": "com.baiyue.firstleg.service.FbaPricingService",
+      "reason": "装柜实物完成时按真实分配刷新费用，调用既有计价应用服务，不读取计价持久化。"
+    },
+    {
+      "source": "com.baiyue.firstleg.service.LoadingListService",
+      "target": "com.baiyue.firstleg.domain.PriceBookChannelCatalog",
+      "reason": "分柜按当前有效渠道目录校验，复用纯领域目录，不访问价格簿实现。"
+    },
+    {
+      "source": "com.baiyue.firstleg.service.LoadingListService",
+      "target": "com.baiyue.firstleg.service.FbaPricingService",
+      "reason": "装柜分配变动触发既有计价服务按客户重算，费用冻结门槛保留在原服务。"
+    },
+    {
+      "source": "com.baiyue.firstleg.service.SmartLoadingService",
+      "target": "com.baiyue.firstleg.service.FbaPricingService",
+      "reason": "智能排柜分配后调用原计价服务守恒重算，不跨域修改费用表。"
+    }
+  ],
+  "reviewedPackageCycles": [
+    {
+      "packages": [
+        "com.baiyue.firstleg.loading.bridge.service",
+        "com.baiyue.firstleg.loading.service",
+        "com.baiyue.firstleg.oceanbooking.service",
+        "com.baiyue.firstleg.service"
+      ],
+      "reason": "既有全局service包混合了入仓暂扣、装柜费用与订舱文档的应用编排。本轮不拆分这些无关既有服务；仅冻结当前四包SCC，新增节点或第二环继续失败。价格簿查询切片仍必须独立无环。"
+    }
+  ]
 }
diff --git a/gateway/AGENTS.md b/gateway/AGENTS.md
index fc63cac7f..116d80555 100644
--- a/gateway/AGENTS.md
+++ b/gateway/AGENTS.md
@@ -1,5 +1,10 @@
 # Gateway 模块指引
 
+## 数据库访问与中文注释约束
+
+- 强制遵守根 `../AGENTS.md` 的“数据库访问与中文代码注释”全部规则：正常业务访问统一为 `Controller → Service → Repository → Mapper`，不得省略 Repository 或跨层直调；生产 SQL 由 Mapper 执行，Repository 不得直接使用 JdbcTemplate 或原生 JDBC。非 HTTP 入口从 Service 进入；无数据库模块不引入数据库访问。
+- 每个手写方法及构造器须有简短中文说明；核心业务规则、复杂 SQL、事务、锁、幂等、并发及失败处理须补充适量中文注释，重点说明原因和边界。新增、修改方法立即执行，触及的存量代码同步整改。
+
 ## 职责与边界
 
 - 负责路由、CORS、JWT/Redis 会话校验、平台/客户访问域隔离、请求标识和 Swagger 聚合。
diff --git a/iam/AGENTS.md b/iam/AGENTS.md
index d7663b79e..d59414bd2 100644
--- a/iam/AGENTS.md
+++ b/iam/AGENTS.md
@@ -1,5 +1,10 @@
 # IAM Service 模块指引
 
+## 数据库访问与中文注释约束
+
+- 强制遵守根 `../AGENTS.md` 的“数据库访问与中文代码注释”全部规则：正常业务访问统一为 `Controller → Service → Repository → Mapper`，不得省略 Repository 或跨层直调；生产 SQL 由 Mapper 执行，Repository 不得直接使用 JdbcTemplate 或原生 JDBC。非 HTTP 入口从 Service 进入；无数据库模块不引入数据库访问。
+- 每个手写方法及构造器须有简短中文说明；核心业务规则、复杂 SQL、事务、锁、幂等、并发及失败处理须补充适量中文注释，重点说明原因和边界。新增、修改方法立即执行，触及的存量代码同步整改。
+
 ## 职责与边界
 
 - Mapper 只由 `BaiyueIamApplication.java` 对 `com.baiyue.iam` 根包按 `@Mapper` 过滤扫描；新增或移动 Mapper 后从后端根运行 `node scripts/mapper-scan-contract.mjs`，不得增加子域扫描配置。
@@ -17,6 +22,8 @@
 | 商户成员、登录手机号与个人资料 | `controller/MerchantTenantController.java`、`service/MemberService.java`、`service/PersonalProfileService.java`、`client/AuthAccountClient.java`；成员手机号是可选登录标识，变更时同步 Auth、撤销该账号全部会话并审计，不与公司联系电话联动 |
 | 平台用户与海外 PDA 仓绑定 | `controller/PlatformUserManagementController.java`、`service/PlatformUserManagementService.java`、`dto/PlatformUserManagementDtos.java`、`entity/IamMembership.java`；`OVERSEAS_WAREHOUSE_PDA_OPERATOR` 必须且只能绑定一个 `overseasWarehouseId` |
 | 角色/权限/RBAC | `controller/RbacController.java`、`service/RbacService.java` |
+| 平台自营领星统计权限 | `src/main/resources/db/selfoperated-analytics-permissions.sql`；自营业务下经营总览、销量分析、库存分析、数据采集菜单资源同步国内统一空库基线；四个页面和所有只读接口统一使用 `platform:self-operated-analytics:list`，采集写入独立使用 `platform:self-operated-analytics:sync`。菜单资源不替代服务端读写授权。 |
+| 预约负责人权威目录 | `controller/InternalAuthorizationController.java` 的 `/internal/iam/platform-owners/{authUserId}`、`service/PlatformOwnerDirectoryService.java`；仅有效平台成员与 PLATFORM 角色，返回 Auth 主体 ID 和权威姓名；新工作安排及直送卸货写权限种子 `src/main/resources/db/appointment-work-permissions.sql` |
 | 授权快照/内部资格 | `controller/AuthorizationController.java`、`InternalAuthorizationController.java`、`service/AuthorizationSnapshotService.java` |
 | 持久化安全版本 | `service/SecurityVersionService.java`、`src/main/resources/db/security-version.sql`；安全变更与 subject/customer 版本同事务提交，Auth 在线核对单 SQL 授权快照，无专用安全事件投影 |
 | 消息中心/站内通知 | `notification/controller/NotificationInboxController.java`、`notification/controller/PlatformNotificationController.java`、`notification/service/NotificationService.java`；模板、任务、收件箱及事件消费均在 `notification/` |
diff --git a/iam/src/main/java/com/baiyue/iam/controller/InternalAuthorizationController.java b/iam/src/main/java/com/baiyue/iam/controller/InternalAuthorizationController.java
index 46a0f711c..2854f8200 100644
--- a/iam/src/main/java/com/baiyue/iam/controller/InternalAuthorizationController.java
+++ b/iam/src/main/java/com/baiyue/iam/controller/InternalAuthorizationController.java
@@ -15,6 +15,10 @@ import org.springframework.web.bind.annotation.RequestBody;
 import org.springframework.web.bind.annotation.RequestHeader;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RestController;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.PathVariable;
+import com.baiyue.iam.service.PlatformOwnerDirectoryService;
+import com.baiyue.iam.dto.PlatformOwner;
 
 import java.nio.charset.StandardCharsets;
 import java.security.MessageDigest;
@@ -27,6 +31,7 @@ import java.security.MessageDigest;
 public class InternalAuthorizationController {
     @Resource
     private AuthorizationSnapshotService service;
+    @Resource private PlatformOwnerDirectoryService owners;
     @Value("${baiyue.security.internal-service-token}")
     private String internalTokenValue;
     private byte[] internalToken;
@@ -49,4 +54,13 @@ public class InternalAuthorizationController {
         }
         return ApiResponse.success(service.load(request));
     }
+
+    @GetMapping("/platform-owners/{authUserId}")
+    public ApiResponse<PlatformOwner> owner(@RequestHeader(value="X-Internal-Service-Token",required=false) String token,
+        @PathVariable long authUserId) {
+        byte[] supplied=token==null?new byte[0]:token.getBytes(StandardCharsets.UTF_8);
+        if(internalToken==null || !MessageDigest.isEqual(internalToken,supplied))
+            throw new BizException(ResultCode.FORBIDDEN,"无效的服务间凭据");
+        return ApiResponse.success(owners.require(authUserId));
+    }
 }
diff --git a/iam/src/main/java/com/baiyue/iam/dto/PlatformOwner.java b/iam/src/main/java/com/baiyue/iam/dto/PlatformOwner.java
new file mode 100644
index 000000000..1ad582e7b
--- /dev/null
+++ b/iam/src/main/java/com/baiyue/iam/dto/PlatformOwner.java
@@ -0,0 +1,4 @@
+package com.baiyue.iam.dto;
+
+/** Auth subject identity, not the IAM profile or membership primary key. */
+public record PlatformOwner(String id,String name) { }
diff --git a/iam/src/main/java/com/baiyue/iam/mapper/AuthorizationQueryMapper.java b/iam/src/main/java/com/baiyue/iam/mapper/AuthorizationQueryMapper.java
index 42a525c93..d98f433e4 100644
--- a/iam/src/main/java/com/baiyue/iam/mapper/AuthorizationQueryMapper.java
+++ b/iam/src/main/java/com/baiyue/iam/mapper/AuthorizationQueryMapper.java
@@ -11,6 +11,18 @@ import java.util.List;
  */
 @Mapper
 public interface AuthorizationQueryMapper {
+    @Select("""
+        SELECT CONCAT('',u.auth_user_id) id,u.display_name name
+        FROM iam_user u
+        WHERE u.auth_user_id=#{authUserId} AND u.status='ACTIVE' AND u.deleted=0
+          AND u.display_name IS NOT NULL AND TRIM(u.display_name)<>''
+          AND EXISTS (
+            SELECT 1 FROM iam_membership m JOIN iam_membership_role mr ON mr.membership_id=m.id AND mr.tenant_id=0
+              JOIN iam_role r ON r.id=mr.role_id AND r.tenant_id=0 AND r.app_code='PLATFORM' AND r.status='ACTIVE' AND r.deleted=0
+            WHERE m.user_id=u.id AND m.tenant_id=0 AND m.status='ACTIVE' AND m.deleted=0)
+        """)
+    com.baiyue.iam.dto.PlatformOwner findActivePlatformOwner(@Param("authUserId") long authUserId);
+
     @Select("""
         SELECT r.role_code AS roleCode, p.permission_code AS permissionCode,
                COALESCE(sv.permission_version,0) AS permissionVersion,
diff --git a/iam/src/main/java/com/baiyue/iam/service/PlatformOwnerDirectoryService.java b/iam/src/main/java/com/baiyue/iam/service/PlatformOwnerDirectoryService.java
new file mode 100644
index 000000000..a7082a489
--- /dev/null
+++ b/iam/src/main/java/com/baiyue/iam/service/PlatformOwnerDirectoryService.java
@@ -0,0 +1,19 @@
+package com.baiyue.iam.service;
+
+import com.baiyue.iam.dto.PlatformOwner;
+import com.baiyue.iam.mapper.AuthorizationQueryMapper;
+import com.baiyue.common.core.exception.BizException;
+import com.baiyue.common.core.api.ResultCode;
+import org.springframework.stereotype.Service;
+
+@Service
+public class PlatformOwnerDirectoryService {
+    private final AuthorizationQueryMapper mapper;
+    public PlatformOwnerDirectoryService(AuthorizationQueryMapper mapper){this.mapper=mapper;}
+    public PlatformOwner require(long authUserId) {
+        if(authUserId<=0) throw new BizException(ResultCode.BAD_REQUEST,"平台操作人员标识无效");
+        var owner=mapper.findActivePlatformOwner(authUserId);
+        if(owner==null) throw new BizException(ResultCode.NOT_FOUND,"未找到有效平台操作人员");
+        return owner;
+    }
+}
diff --git a/iam/src/main/resources/db/appointment-work-permissions.sql b/iam/src/main/resources/db/appointment-work-permissions.sql
new file mode 100644
index 000000000..0f5279dcf
--- /dev/null
+++ b/iam/src/main/resources/db/appointment-work-permissions.sql
@@ -0,0 +1,45 @@
+USE baiyue_iam;
+
+-- Reject identity collisions before any permission or grant is changed.
+DROP PROCEDURE IF EXISTS check_appointment_work_permission_identity;
+DELIMITER $$
+CREATE PROCEDURE check_appointment_work_permission_identity()
+BEGIN
+  IF EXISTS(SELECT 1 FROM iam_permission WHERE
+      (id=5107283 AND permission_code<>'platform:appointment:manage-work')
+      OR (id=5102213 AND permission_code<>'platform:firstleg:terminal-drayage:direct-unload:confirm')
+      OR (permission_code='platform:appointment:manage-work' AND id<>5107283)
+      OR (permission_code='platform:firstleg:terminal-drayage:direct-unload:confirm' AND id<>5102213)) THEN
+    SIGNAL SQLSTATE '45000' SET MESSAGE_TEXT='Appointment work permission identity conflict';
+  END IF;
+END$$
+DELIMITER ;
+CALL check_appointment_work_permission_identity();
+DROP PROCEDURE check_appointment_work_permission_identity;
+
+-- Two independent write capabilities; appointment/list remains read-only.
+INSERT INTO iam_permission
+  (id,tenant_id,app_code,permission_type,parent_id,permission_code,permission_name,route_path,http_method,sort_no,status,built_in,deleted)
+VALUES
+  (5107283,0,'PLATFORM','BUTTON',5107280,'platform:appointment:manage-work','维护预约工作安排',NULL,'POST',743,'ACTIVE',1,0),
+  (5102213,0,'PLATFORM','BUTTON',5102200,'platform:firstleg:terminal-drayage:direct-unload:confirm','登记直送目的仓实际卸货',NULL,'POST',60,'ACTIVE',1,0)
+ON DUPLICATE KEY UPDATE permission_name=VALUES(permission_name),parent_id=VALUES(parent_id),status='ACTIVE',deleted=0;
+
+INSERT IGNORE INTO iam_role_permission(tenant_id,role_id,permission_id,created_at)
+SELECT 0,r.id,p.id,CURRENT_TIMESTAMP(3)
+FROM iam_role r JOIN iam_permission p ON p.tenant_id=0 AND p.id IN (5107283,5102213)
+WHERE r.tenant_id=0 AND r.app_code='PLATFORM' AND r.role_code='PLATFORM_ADMIN' AND r.status='ACTIVE' AND r.deleted=0;
+
+DROP PROCEDURE IF EXISTS assert_appointment_work_permissions;
+DELIMITER $$
+CREATE PROCEDURE assert_appointment_work_permissions()
+BEGIN
+  IF (SELECT COUNT(*) FROM iam_permission WHERE tenant_id=0 AND app_code='PLATFORM' AND status='ACTIVE' AND deleted=0
+      AND ((id=5107283 AND permission_code='platform:appointment:manage-work' AND parent_id=5107280)
+        OR (id=5102213 AND permission_code='platform:firstleg:terminal-drayage:direct-unload:confirm' AND parent_id=5102200))) <> 2 THEN
+    SIGNAL SQLSTATE '45000' SET MESSAGE_TEXT='Appointment work permission identity conflict';
+  END IF;
+END$$
+DELIMITER ;
+CALL assert_appointment_work_permissions();
+DROP PROCEDURE assert_appointment_work_permissions;
diff --git a/iam/src/main/resources/db/lastleg-permissions.sql b/iam/src/main/resources/db/lastleg-permissions.sql
index 6b4c39d13..cb9388409 100644
--- a/iam/src/main/resources/db/lastleg-permissions.sql
+++ b/iam/src/main/resources/db/lastleg-permissions.sql
@@ -142,6 +142,7 @@ VALUES
   (5306180,0,'MERCHANT','MENU',0,'merchant:overseas-warehouse:discard:list','货物废弃','/overseas-warehouse/cargo-disposal','GET',130,'ACTIVE',1,0),
   (5306181,0,'MERCHANT','BUTTON',5306180,'merchant:overseas-warehouse:discard:create','创建货物废弃申请',NULL,'POST',10,'ACTIVE',1,0),
   (5306182,0,'MERCHANT','BUTTON',5306180,'merchant:overseas-warehouse:discard:cancel','取消货物废弃申请',NULL,'POST',20,'ACTIVE',1,0),
+  (5306183,0,'MERCHANT','BUTTON',5306180,'merchant:overseas-warehouse:discard:confirm','确认废弃完成',NULL,'POST',30,'ACTIVE',1,0),
   (5306190,0,'MERCHANT','MENU',0,'merchant:overseas-warehouse:return-order:list','退货换标','/overseas-warehouse/return-relabel','GET',140,'ACTIVE',1,0),
   (5306191,0,'MERCHANT','BUTTON',5306190,'merchant:overseas-warehouse:return-order:create','创建退货预报',NULL,'POST',10,'ACTIVE',1,0),
   (5306192,0,'MERCHANT','BUTTON',5306190,'merchant:overseas-warehouse:return-order:relabel','退货转换标申请',NULL,'POST',20,'ACTIVE',1,0)
@@ -336,6 +337,7 @@ JOIN iam_permission permission ON permission.tenant_id=0 AND permission.app_code
     'merchant:overseas-warehouse:discard:list',
     'merchant:overseas-warehouse:discard:create',
     'merchant:overseas-warehouse:discard:cancel',
+    'merchant:overseas-warehouse:discard:confirm',
     'merchant:overseas-warehouse:return-order:list',
     'merchant:overseas-warehouse:return-order:create',
     'merchant:overseas-warehouse:return-order:relabel'
@@ -371,9 +373,10 @@ BEGIN
            'merchant:overseas-warehouse:discard:list',
            'merchant:overseas-warehouse:discard:create',
            'merchant:overseas-warehouse:discard:cancel',
+    'merchant:overseas-warehouse:discard:confirm',
            'merchant:overseas-warehouse:return-order:list',
            'merchant:overseas-warehouse:return-order:create',
-           'merchant:overseas-warehouse:return-order:relabel')) <> 24 THEN
+           'merchant:overseas-warehouse:return-order:relabel')) <> 25 THEN
     SIGNAL SQLSTATE '45000' SET MESSAGE_TEXT='海外客户权限初始化失败：权限资源不完整';
   END IF;
   IF (SELECT COUNT(*) FROM iam_role_permission grant_row
@@ -405,9 +408,10 @@ BEGIN
            'merchant:overseas-warehouse:discard:list',
            'merchant:overseas-warehouse:discard:create',
            'merchant:overseas-warehouse:discard:cancel',
+    'merchant:overseas-warehouse:discard:confirm',
            'merchant:overseas-warehouse:return-order:list',
            'merchant:overseas-warehouse:return-order:create',
-           'merchant:overseas-warehouse:return-order:relabel')) <> 24 THEN
+           'merchant:overseas-warehouse:return-order:relabel')) <> 25 THEN
     SIGNAL SQLSTATE '45000' SET MESSAGE_TEXT='海外客户权限初始化失败：客户默认管理员授权不完整';
   END IF;
 END$$
diff --git a/iam/src/main/resources/db/selfoperated-analytics-permissions.sql b/iam/src/main/resources/db/selfoperated-analytics-permissions.sql
new file mode 100644
index 000000000..ab2a0d0fd
--- /dev/null
+++ b/iam/src/main/resources/db/selfoperated-analytics-permissions.sql
@@ -0,0 +1,21 @@
+-- 自营业务菜单资源用于菜单管理；四个页面和所有只读接口统一由 list 授权，采集写权限及后台导出权限独立。
+USE baiyue_iam;
+SET NAMES utf8mb4;
+INSERT INTO iam_permission (id,tenant_id,app_code,permission_type,parent_id,permission_code,permission_name,route_path,http_method,sort_no,status,built_in,created_at,updated_at,deleted) VALUES
+  (5118100,0,'PLATFORM','MENU',0,'platform:self-operated:menu','自营业务',NULL,NULL,1100,'ACTIVE',1,CURRENT_TIMESTAMP(3),CURRENT_TIMESTAMP(3),0),
+  (5118140,0,'PLATFORM','MENU',5118100,'platform:self-operated:overview:menu','经营总览','/self-operated/overview','GET',5,'ACTIVE',1,CURRENT_TIMESTAMP(3),CURRENT_TIMESTAMP(3),0),
+  (5118110,0,'PLATFORM','MENU',5118100,'platform:self-operated:sales:menu','销量分析','/self-operated/sales','GET',10,'ACTIVE',1,CURRENT_TIMESTAMP(3),CURRENT_TIMESTAMP(3),0),
+  (5118120,0,'PLATFORM','MENU',5118100,'platform:self-operated:inventory:menu','库存分析','/self-operated/inventory','GET',20,'ACTIVE',1,CURRENT_TIMESTAMP(3),CURRENT_TIMESTAMP(3),0),
+  (5118130,0,'PLATFORM','MENU',5118100,'platform:self-operated:collection:menu','数据采集','/self-operated/collection','GET',30,'ACTIVE',1,CURRENT_TIMESTAMP(3),CURRENT_TIMESTAMP(3),0),
+  (5118000,0,'PLATFORM','API',5118100,'platform:self-operated-analytics:list','读取平台自营出库销量与库存分析','/api/platform/v1/last-leg/self-operated-analytics','GET',40,'ACTIVE',1,CURRENT_TIMESTAMP(3),CURRENT_TIMESTAMP(3),0),
+  (5118002,0,'PLATFORM','API',5118120,'platform:self-operated-analytics:export','导出平台自营库存周转','/api/platform/v1/files/export-tasks','POST',20,'ACTIVE',1,CURRENT_TIMESTAMP(3),CURRENT_TIMESTAMP(3),0),
+  (5118001,0,'PLATFORM','API',5118130,'platform:self-operated-analytics:sync','平台自营采集重试与重采集','/api/platform/v1/last-leg/self-operated-analytics/sync-tasks','POST',10,'ACTIVE',1,CURRENT_TIMESTAMP(3),CURRENT_TIMESTAMP(3),0);
+INSERT INTO iam_role_permission (role_id,permission_id,tenant_id,created_at) VALUES
+  (4000001,5118000,0,CURRENT_TIMESTAMP(3)),
+  (4000001,5118001,0,CURRENT_TIMESTAMP(3)),
+  (4000001,5118002,0,CURRENT_TIMESTAMP(3)),
+  (4000001,5118100,0,CURRENT_TIMESTAMP(3)),
+  (4000001,5118140,0,CURRENT_TIMESTAMP(3)),
+  (4000001,5118110,0,CURRENT_TIMESTAMP(3)),
+  (4000001,5118120,0,CURRENT_TIMESTAMP(3)),
+  (4000001,5118130,0,CURRENT_TIMESTAMP(3));
diff --git a/iam/src/main/resources/openapi/iam-v1.yaml b/iam/src/main/resources/openapi/iam-v1.yaml
index 28e223b91..cd0957681 100644
--- a/iam/src/main/resources/openapi/iam-v1.yaml
+++ b/iam/src/main/resources/openapi/iam-v1.yaml
@@ -17,6 +17,28 @@ tags:
   - name: RBAC
     description: Platform and merchant role-permission management / 平台端与商户端角色权限管理
 paths:
+  /internal/iam/platform-owners/{authUserId}:
+    get:
+      summary: Read active platform operator identity and authoritative display name
+      description: Internal service identity only. Auth subject ID is distinct from IAM profile and membership IDs. Requires active undeleted user, platform membership and PLATFORM role; no caller-supplied name fallback.
+      security: []
+      parameters:
+        - {$ref: '#/components/parameters/InternalServiceToken'}
+        - {name: authUserId, in: path, required: true, schema: {type: integer, format: int64, minimum: 1}}
+      responses:
+        '200':
+          description: ApiResponse
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  data:
+                    type: object
+                    required: [id, name]
+                    properties: {id: {type: string}, name: {type: string}}
+        '403': {description: Invalid internal service credential}
+        '404': {description: No eligible active platform operator}
   /api/merchant/v1/iam/profile:
     get:
       tags: [Merchant Tenant / 商户企业]
diff --git a/iam/src/test/java/com/baiyue/iam/controller/PlatformOwnerDirectoryControllerTest.java b/iam/src/test/java/com/baiyue/iam/controller/PlatformOwnerDirectoryControllerTest.java
new file mode 100644
index 000000000..f1c7573a9
--- /dev/null
+++ b/iam/src/test/java/com/baiyue/iam/controller/PlatformOwnerDirectoryControllerTest.java
@@ -0,0 +1,21 @@
+package com.baiyue.iam.controller;
+
+import com.baiyue.iam.service.PlatformOwnerDirectoryService;
+import com.baiyue.iam.dto.PlatformOwner;
+import com.baiyue.common.core.exception.BizException;
+import org.junit.jupiter.api.Test;
+import org.springframework.test.util.ReflectionTestUtils;
+import static org.mockito.Mockito.*;
+import static org.junit.jupiter.api.Assertions.*;
+
+class PlatformOwnerDirectoryControllerTest {
+    @Test void internalIdentityIsRequiredBeforeReadingDirectory() {
+        var service=mock(PlatformOwnerDirectoryService.class);var controller=new InternalAuthorizationController();
+        String token="test-internal-token-at-least-32-characters";
+        ReflectionTestUtils.setField(controller,"owners",service);ReflectionTestUtils.setField(controller,"internalTokenValue",token);
+        controller.initializeInternalToken();
+        assertThrows(BizException.class,()->controller.owner(null,101));verifyNoInteractions(service);
+        when(service.require(101)).thenReturn(new PlatformOwner("101","运营甲"));
+        assertEquals("运营甲",controller.owner(token,101).data().name());
+    }
+}
diff --git a/iam/src/test/java/com/baiyue/iam/mapper/PlatformOwnerDirectoryMapperTest.java b/iam/src/test/java/com/baiyue/iam/mapper/PlatformOwnerDirectoryMapperTest.java
new file mode 100644
index 000000000..e769cc5e1
--- /dev/null
+++ b/iam/src/test/java/com/baiyue/iam/mapper/PlatformOwnerDirectoryMapperTest.java
@@ -0,0 +1,33 @@
+package com.baiyue.iam.mapper;
+
+import com.baomidou.mybatisplus.core.MybatisConfiguration;
+import com.baomidou.mybatisplus.core.MybatisSqlSessionFactoryBuilder;
+import org.apache.ibatis.mapping.Environment;
+import org.apache.ibatis.transaction.jdbc.JdbcTransactionFactory;
+import org.h2.jdbcx.JdbcDataSource;
+import org.junit.jupiter.api.Test;
+import java.util.UUID;
+import static org.junit.jupiter.api.Assertions.*;
+
+class PlatformOwnerDirectoryMapperTest {
+    @Test void returnsAuthSubjectAndNameOnlyForActivePlatformMembershipAndRole() throws Exception {
+        var ds=new JdbcDataSource();ds.setURL("jdbc:h2:mem:"+UUID.randomUUID()+";MODE=MySQL;DB_CLOSE_DELAY=-1");
+        try(var c=ds.getConnection();var s=c.createStatement()) {
+            s.execute("CREATE TABLE iam_user(id BIGINT,auth_user_id BIGINT,display_name VARCHAR,status VARCHAR,deleted INT)");
+            s.execute("CREATE TABLE iam_membership(id BIGINT,user_id BIGINT,tenant_id BIGINT,status VARCHAR,deleted INT)");
+            s.execute("CREATE TABLE iam_membership_role(membership_id BIGINT,tenant_id BIGINT,role_id BIGINT)");
+            s.execute("CREATE TABLE iam_role(id BIGINT,tenant_id BIGINT,app_code VARCHAR,status VARCHAR,deleted INT)");
+            s.execute("INSERT INTO iam_user VALUES(1,101,'运营甲','ACTIVE',0),(2,102,'客户乙','ACTIVE',0),(3,103,'停用丙','DISABLED',0),(4,104,'失效成员','ACTIVE',0)");
+            s.execute("INSERT INTO iam_membership VALUES(11,1,0,'ACTIVE',0),(12,2,88,'ACTIVE',0),(13,3,0,'ACTIVE',0),(14,4,0,'DISABLED',0)");
+            s.execute("INSERT INTO iam_membership_role VALUES(11,0,21),(12,88,21),(13,0,21),(14,0,21)");
+            s.execute("INSERT INTO iam_role VALUES(21,0,'PLATFORM','ACTIVE',0)");
+        }
+        var config=new MybatisConfiguration();config.setEnvironment(new Environment("test",new JdbcTransactionFactory(),ds));config.addMapper(AuthorizationQueryMapper.class);
+        try(var session=new MybatisSqlSessionFactoryBuilder().build(config).openSession()) {
+            var mapper=session.getMapper(AuthorizationQueryMapper.class);
+            assertEquals("101",mapper.findActivePlatformOwner(101).id());assertEquals("运营甲",mapper.findActivePlatformOwner(101).name());
+            assertNull(mapper.findActivePlatformOwner(1));assertNull(mapper.findActivePlatformOwner(102));
+            assertNull(mapper.findActivePlatformOwner(103));assertNull(mapper.findActivePlatformOwner(104));
+        }
+    }
+}
diff --git a/iam/src/test/java/com/baiyue/iam/repository/MerchantReturnInventoryPermissionSqlContractTest.java b/iam/src/test/java/com/baiyue/iam/repository/MerchantReturnInventoryPermissionSqlContractTest.java
index d7deb63ea..6768e66bd 100644
--- a/iam/src/test/java/com/baiyue/iam/repository/MerchantReturnInventoryPermissionSqlContractTest.java
+++ b/iam/src/test/java/com/baiyue/iam/repository/MerchantReturnInventoryPermissionSqlContractTest.java
@@ -20,7 +20,7 @@ class MerchantReturnInventoryPermissionSqlContractTest {
         assertThat(sql).contains(
             "(5306140,0,'MERCHANT','MENU',0,'" + PERMISSION + "','退货库存'",
             "role.role_code='MERCHANT_OWNER'",
-            ")) <> 24 THEN",
+            ")) <> 25 THEN",
             "客户默认管理员授权不完整");
 
         int grantStart = sql.indexOf("-- 客户默认管理员获得当前客户海外业务入口");
diff --git a/iam/src/test/java/com/baiyue/iam/repository/OverseasCustomerPermissionSqlContractTest.java b/iam/src/test/java/com/baiyue/iam/repository/OverseasCustomerPermissionSqlContractTest.java
index ba27c34e8..3bf4205bb 100644
--- a/iam/src/test/java/com/baiyue/iam/repository/OverseasCustomerPermissionSqlContractTest.java
+++ b/iam/src/test/java/com/baiyue/iam/repository/OverseasCustomerPermissionSqlContractTest.java
@@ -36,6 +36,7 @@ class OverseasCustomerPermissionSqlContractTest {
         "merchant:overseas-warehouse:discard:list",
         "merchant:overseas-warehouse:discard:create",
         "merchant:overseas-warehouse:discard:cancel",
+        "merchant:overseas-warehouse:discard:confirm",
         "merchant:overseas-warehouse:return-order:list",
         "merchant:overseas-warehouse:return-order:create",
         "merchant:overseas-warehouse:return-order:relabel");
@@ -85,7 +86,7 @@ class OverseasCustomerPermissionSqlContractTest {
             "海外客户权限初始化失败：客户默认管理员授权不完整",
             "permission.app_code='MERCHANT'",
             "role.role_code='MERCHANT_OWNER'",
-            ")) <> 24 THEN");
+            ")) <> 25 THEN");
     }
 
     @Test
diff --git a/iam/src/test/java/com/baiyue/iam/repository/OverseasPhase4PermissionSqlContractTest.java b/iam/src/test/java/com/baiyue/iam/repository/OverseasPhase4PermissionSqlContractTest.java
index c7cdc23e9..4314ad8fe 100644
--- a/iam/src/test/java/com/baiyue/iam/repository/OverseasPhase4PermissionSqlContractTest.java
+++ b/iam/src/test/java/com/baiyue/iam/repository/OverseasPhase4PermissionSqlContractTest.java
@@ -150,6 +150,8 @@ class OverseasPhase4PermissionSqlContractTest {
             .getContentAsString(StandardCharsets.UTF_8)).stream()
             .filter(code -> code.startsWith("platform:"))
             .forEach(moduleCatalog::add);
+        codes(new ClassPathResource("db/procurement-permissions.sql")
+            .getContentAsString(StandardCharsets.UTF_8)).forEach(moduleCatalog::add);
         Set<String> serviceCatalog = new LinkedHashSet<>();
         serviceCatalog.addAll(codes(repositoryFile(
             "lastleg-service/src/main/java/com/baiyue/lastleg/security/OverseasPermissions.java")));
diff --git a/integration-service/.env.example b/integration-service/.env.example
new file mode 100644
index 000000000..a246fea07
--- /dev/null
+++ b/integration-service/.env.example
@@ -0,0 +1,3 @@
+# Copy to .env.local for local WMS connectivity verification.
+LINGXING_OMS_APP_KEY=
+LINGXING_OMS_APP_SECRET=
diff --git a/integration-service/AGENTS.md b/integration-service/AGENTS.md
index 8347661ef..34361a2c5 100644
--- a/integration-service/AGENTS.md
+++ b/integration-service/AGENTS.md
@@ -1,5 +1,10 @@
 # Integration Service 模块指引
 
+## 数据库访问与中文注释约束
+
+- 强制遵守根 `../AGENTS.md` 的“数据库访问与中文代码注释”全部规则：正常业务访问统一为 `Controller → Service → Repository → Mapper`，不得省略 Repository 或跨层直调；生产 SQL 由 Mapper 执行，Repository 不得直接使用 JdbcTemplate 或原生 JDBC。非 HTTP 入口从 Service 进入；无数据库模块不引入数据库访问。
+- 每个手写方法及构造器须有简短中文说明；核心业务规则、复杂 SQL、事务、锁、幂等、并发及失败处理须补充适量中文注释，重点说明原因和边界。新增、修改方法立即执行，触及的存量代码同步整改。
+
 ## 职责与边界
 
 - 负责百度 OCR、Amazon Logistics/SP-API、海外仓业务船司/船舶轨迹查询等第三方适配和能力开关；不保存业务主数据。
@@ -9,6 +14,7 @@
 
 - 应用/配置：`IntegrationServiceApplication.java`、`config/IntegrationProperties.java`
 - 内部接口：`controller/IntegrationProviderController.java`、`WeightOcrController.java`
+- 领星 WMS 自研系统出库只读查询：`controller/LingxingInternalController.java`、`provider/lingxing/`、`dto/lingxing/`、`config/LingxingWmsProperties.java`；内部契约 `openapi/lingxing-wms-v1.yaml` 位于 `src/main/resources/`。内部提供出库单页摘要、独立按单定位、出库详情、仓库目录及单仓产品库存单页查询；统一账号节流、有限退避和严格分页校验，保留未知数量与源时间原值。不编排定时采集、多页库存同步或业务持久化；本地隔离启动与环境变量入口见 `README.md`，真实调用默认关闭。
 - OCR 编排：`service/ocr/WeightOcrBatchService.java`、`ImageCropper.java`、`WeightCandidateSelector.java`
 - 供应商适配：`provider/IntegrationProviderAdapter.java`、`BaiduOcrAdapter.java`、`AmazonLogisticsAdapter.java`
 - 海外仓业务船节点外部适配：内部契约 `controller/IntegrationProviderController.java` 的 `/internal/integrations/carrier-schedules/query`，统一十节点与四类异常 DTO `dto/CarrierScheduleDtos.java`，provider SPI `provider/CarrierScheduleProviderAdapter.java`，标准枚举 `domain/CarrierScheduleStandardNode.java`、`CarrierScheduleExceptionCode.java`；美森网页会话、动态 `ttr` 与公开查询代理适配见 `provider/MatsonTrackingClient.java`、`MatsonCarrierScheduleProviderAdapter.java`，由 `MATSON_TRACKING_ENABLED` 显式启用；SML 的 122→125→124→126 JSON 调用链与 A/E 时间解析见 `provider/SmlTrackingClient.java`、`SmlCarrierScheduleProviderAdapter.java`，由 `SML_TRACKING_ENABLED` 显式启用；ZIM 正式 Tracing API 的 OAuth2 token 缓存、401 单次刷新及柜号活动解析见 `provider/ZimTrackingClient.java`、`ZimCarrierScheduleProviderAdapter.java`，凭据只从外部 secret 注入并由 `ZIM_TRACKING_ENABLED` 显式启用；长荣柜号→关联提单两段 UTF-8 HTML 查询、表头定位与日粒度事实解析见 `provider/EvergreenTrackingClient.java`、`EvergreenCarrierScheduleProviderAdapter.java`，由 `EMC_TRACKING_ENABLED` 显式启用且不输出完整提单号；合德 UTF-8 HTML 主表解析见 `provider/HedeTrackingClient.java`、`HedeCarrierScheduleProviderAdapter.java`，由 `HEDE_TRACKING_ENABLED` 显式启用且当前只自动解析柜号；轮询任务、租约、订舱/柜次关联、最新实际节点、节点/异常事实和历史归 `firstleg/portschedule/`，标准见 `../../docs/海外仓业务/船节点标准化契约.md`
diff --git a/integration-service/README.md b/integration-service/README.md
new file mode 100644
index 000000000..14974e443
--- /dev/null
+++ b/integration-service/README.md
@@ -0,0 +1,102 @@
+# Integration 本地领星 WMS 查询
+
+本入口用于在现有 Java 服务内验证 WMS 只读调用。仅返回单页出库摘要，不启动月度采集、库存全量同步、定时任务或数据库写入。业务方案见[领星一件代发数据统计一期方案](../../docs/自营业务/领星一件代发数据统计一期方案.md)。
+
+后续开发交接见[接口联调手册](../../docs/自营业务/领星WMS接口联调手册.md)：已另行用只读 HTTP 验证仓库发现、一件代发详情和按仓产品库存全分页。此处现有 Java 接口仍只有出库摘要；库存内部接口、分仓任务和持久化尚待开发，不能以外部直连成功推定 Java 功能已经具备。
+
+## 凭据与开关
+
+从 WMS 管理后台的“个人中心 → API 信息 → 自研系统”获取 `appKey` 和 `appSecret`，填写本目录 Git 忽略的 `.env.local`，格式参考 [.env.example](.env.example)。这两个值分别加载为 `LINGXING_OMS_APP_KEY` 和 `LINGXING_OMS_APP_SECRET` 进程环境变量，不提交真实值。Spring 本身不会自动读取 `.env.local`，应在启动 Java 的同一终端加载。该凭据属于 OMP 服务商内部系统对接，不使用 OMS 货主或 WMS 智能设备协议。
+
+正式应用配置默认 `LINGXING_WMS_ENABLED=false`。下面的本地命令显式启用适配器，为该本地实例生成内部调用令牌。不要复用共享环境令牌。
+
+测试部署通过 `deploy/docker-compose.yml` 将 `LINGXING_OMS_APP_KEY`、`LINGXING_OMS_APP_SECRET` 传入 Integration 容器。现有 Jenkins 下游部署任务读取 `firstleg-test-env` Secret File；可将这两项加入该文件，或在实际执行部署的下游服务任务中以凭据绑定注入同名环境变量。只在上游总控任务设置变量不会自动传给下游任务。变量命名采用用户指定的 `OMS`，接口协议仍为当前 WMS 自研系统（OMP）；真实凭据是否有该接口权限仍待联调核验。不要将密钥作为普通构建参数或打印完整 Compose 配置。
+
+2026-10-12 用户确认唯一账号、所有源时间按北京时间、数量按 SKU 件数。Lastleg 应用配置使用 `source-account=lingxing-primary`（内部稳定标识，不是 appKey）、`source-query-timezone=Asia/Shanghai`、`quantity-unit=PCS`，分仓配置的源时区默认 `Asia/Shanghai`；数量仍保留十进制精度。仓库编码须在获得真实仓库目录后配置到 `baiyue.self-operated-analytics.warehouses`，不预填虚构仓库。`SELFOP_EXECUTION_ENABLED` 和 `SELFOP_SALES_PUBLICATION_ENABLED` 均默认关闭。
+
+## 本地启动
+
+先在后端仓库根目录执行构建，包含相关模块的编译与测试：
+
+```powershell
+mvn -pl integration-service -am package
+```
+
+然后在同一目录的 PowerShell 中执行。只加载明确允许的两个名称，不执行环境文件内的代码：
+
+```powershell
+$credentialNames = @('LINGXING_OMS_APP_KEY', 'LINGXING_OMS_APP_SECRET')
+foreach ($line in [IO.File]::ReadAllLines((Join-Path (Get-Location) 'integration-service/.env.local'))) {
+    if ($line -match '^\s*(LINGXING_OMS_APP_KEY|LINGXING_OMS_APP_SECRET)\s*=(.*)$') {
+        $credentialName = $matches[1]
+        $credentialValue = $matches[2].Trim()
+        if ($credentialValue.Length -ge 2 -and
+            (($credentialValue.StartsWith('"') -and $credentialValue.EndsWith('"')) -or
+             ($credentialValue.StartsWith("'") -and $credentialValue.EndsWith("'")))) {
+            $credentialValue = $credentialValue.Substring(1, $credentialValue.Length - 2)
+        }
+        [Environment]::SetEnvironmentVariable($credentialName, $credentialValue, 'Process')
+    }
+}
+foreach ($credentialName in $credentialNames) {
+    if ([string]::IsNullOrWhiteSpace([Environment]::GetEnvironmentVariable($credentialName, 'Process'))) {
+        throw "Missing credential: $credentialName"
+    }
+}
+$env:INTERNAL_SERVICE_TOKEN = [guid]::NewGuid().ToString()
+$localInternalToken = $env:INTERNAL_SERVICE_TOKEN
+$env:INTEGRATION_LOCAL_PORT = '19210'
+$buildJar = (Resolve-Path 'integration-service/target/integration-service-1.0.0-SNAPSHOT.jar').Path
+$localJava = Start-Process -FilePath (Get-Command java).Source -WindowStyle Hidden -PassThru `
+    -ArgumentList @('-jar', ('"' + $buildJar + '"'),
+        '--spring.config.location=classpath:/application-lingxing-local.yml',
+        '--baiyue.integration.lingxing-wms.enabled=true') `
+    -RedirectStandardOutput 'integration-service/target/lingxing-local.stdout.log' `
+    -RedirectStandardError 'integration-service/target/lingxing-local.stderr.log'
+```
+
+该配置仅监听 `127.0.0.1`，关闭 Nacos Config、Discovery、服务注册及 Spring 定时任务，不导入共享环境配置。若端口占用，选择其他本地端口并同步替换后续 URL，不停止未知进程。确认 `http://127.0.0.1:19210/actuator/health` 返回 `UP` 后再查询。
+
+## 读取一条出库单
+
+在保留上述变量的同一 PowerShell 中执行一次：
+
+```powershell
+$businessZone = [TimeZoneInfo]::FindSystemTimeZoneById('China Standard Time')
+$queryEnd = [TimeZoneInfo]::ConvertTimeFromUtc([DateTime]::UtcNow, $businessZone)
+$query = @{
+    startTime = $queryEnd.AddMonths(-1).ToString('yyyy-MM-ddTHH:mm:ss')
+    endTime = $queryEnd.ToString('yyyy-MM-ddTHH:mm:ss')
+    current = 1
+    size = 1
+} | ConvertTo-Json -Compress
+$result = Invoke-RestMethod -Method Post `
+    -Uri 'http://127.0.0.1:19210/internal/integrations/lingxing/wms/outbound-orders/query' `
+    -Headers @{'X-Internal-Service-Token' = $localInternalToken} `
+    -ContentType 'application/json' -Body $query
+$result | ConvertTo-Json -Depth 6
+```
+
+返回摘要只包含出库单号、来源单号、货主编码、仓库编码、状态、创建时间和出库时间，不返回收件人或地址。业务 `code="200"` 且 `records` 包含一条才表示已读到样本；空页表示调用成功但未取得样本；`B0001`／`S0503` 表示明确失败，保留 `errorCode`、来源数值错误码及请求标识排查，不能当作零销量。
+
+当前调用 OMP `POST /openapi/v2/order/delivery/page`，固定 `timeType=outboundTime`、`status=100` 已出库，窗口最多向前一个自然月。该本地保护不代表供应商历史上限；单页样本也不代表整月采集完成。订单详情、全量库存、增量任务和统计落库仍按业务方案后续实现。
+
+测试完毕，在同一终端停止本次启动的进程，并清理当前终端注入的变量：
+
+```powershell
+if (-not $localJava.HasExited) { Stop-Process -Id $localJava.Id }
+foreach ($credentialName in @('LINGXING_OMS_APP_KEY', 'LINGXING_OMS_APP_SECRET', 'INTERNAL_SERVICE_TOKEN')) {
+    [Environment]::SetEnvironmentVariable($credentialName, $null, 'Process')
+}
+$localInternalToken = $null
+$credentialValue = $null
+```
+
+## 接口与验证
+
+- 2026-10-12 已通过本地 Java 实例调用 OMP WMS 出库分页，按最近 1 个月、`current=1`、`size=1` 成功返回 1 条已出库摘要；无内部令牌请求被拒绝。验证后本地进程已停止。该结果仅证明当前只读链路可用，不代表全量采集或库存同步完成。
+- 实测成功响应为数值 `code=200`，但缺少官方示例及 Schema 中的 `success`。客户端以成功码和有效分页结构共同判定；`success` 出现时仍须为布尔 `true`。此差异已加入回归测试，失败响应不转换为空页。
+- 内部前缀为 `POST /internal/integrations/lingxing/wms`，提供 `/outbound-orders/query`、`/outbound-orders/locate`、`/outbound-orders/detail`、`/warehouses/query`、`/product-inventory/query`；仅接受 `X-Internal-Service-Token`，不经公网 Gateway。各请求只返回一页或一单，多页与业务版本归 Lastleg 编排。定位不传时间/状态；产品库存必须指定仓库、保留全部品质和零库存。源时间原值与 BigDecimal 数量未知值保留，不推断时区或单位。
+- [OpenAPI](src/main/resources/openapi/lingxing-wms-v1.yaml)定义输入、分页摘要和失败结构。
+- 从后端根执行 `mvn -pl integration-service -am test` 与 `node --test scripts/gateway-route-contract.test.mjs`。
+- 本地模拟 HTTP 单测验证签名、请求体、敏感信息隔离和错误处理；不能代替真实领星样本验证。官方入口为[服务商内部系统对接](https://apidoc-omp.xlwms.com/)与[一件代发出库单 WMS 分页查询](https://apidoc-omp.xlwms.com/reference/post_openapi-v2-order-delivery-page-1)。
diff --git a/integration-service/src/main/java/com/baiyue/integration/config/LingxingEgressProperties.java b/integration-service/src/main/java/com/baiyue/integration/config/LingxingEgressProperties.java
new file mode 100644
index 000000000..5a2ec5ca4
--- /dev/null
+++ b/integration-service/src/main/java/com/baiyue/integration/config/LingxingEgressProperties.java
@@ -0,0 +1,37 @@
+package com.baiyue.integration.config;
+
+import com.baiyue.integration.dto.lingxing.LingxingEgressDtos.CollectionMode;
+import org.springframework.boot.context.properties.ConfigurationProperties;
+import org.springframework.boot.context.properties.bind.DefaultValue;
+import java.net.URI;
+import java.time.Duration;
+import java.time.Instant;
+
+/** Exclusive grant identity; externalExclusiveUntil bounds VALIDATION only, not BUSINESS. */
+@ConfigurationProperties(prefix = "baiyue.integration.lingxing-wms.egress")
+public record LingxingEgressProperties(@DefaultValue("OFF") CollectionMode collectionMode,
+        @DefaultValue("test") String environmentLabel, String sourceAccount, String externalExclusiveGrantId,
+        Instant externalExclusiveUntil, URI budgetAuthorityBaseUri, @DefaultValue("5s") Duration minStartInterval,
+        @DefaultValue("5m") Duration cooldownFallback,
+        @DefaultValue("false") boolean continuousBusinessCollectionEnabled) {
+    public LingxingEgressProperties {
+        collectionMode = collectionMode == null ? CollectionMode.OFF : collectionMode;
+        environmentLabel = environmentLabel == null ? "test" : environmentLabel;
+        minStartInterval = minStartInterval == null ? Duration.ofSeconds(5) : minStartInterval;
+        cooldownFallback = cooldownFallback == null ? Duration.ofMinutes(5) : cooldownFallback;
+        Duration minimumInterval = collectionMode == CollectionMode.VALIDATION ? Duration.ofSeconds(5) : Duration.ofMillis(1);
+        if (minStartInterval.compareTo(minimumInterval) < 0 || minStartInterval.compareTo(Duration.ofMinutes(5)) > 0
+            || cooldownFallback.compareTo(Duration.ofSeconds(5)) < 0 || cooldownFallback.compareTo(Duration.ofDays(1)) > 0) {
+            throw new IllegalArgumentException("领星 VALIDATION 出口间隔至少5秒，其他模式至少1毫秒；间隔和冷却配置须为有界正值");
+        }
+        if (budgetAuthorityBaseUri != null && (budgetAuthorityBaseUri.getHost() == null
+            || !("http".equals(budgetAuthorityBaseUri.getScheme()) || "https".equals(budgetAuthorityBaseUri.getScheme()))
+            || budgetAuthorityBaseUri.getUserInfo() != null || budgetAuthorityBaseUri.getQuery() != null
+            || budgetAuthorityBaseUri.getFragment() != null || !budgetAuthorityBaseUri.getPath().isEmpty())) {
+            throw new IllegalArgumentException("领星预算授权地址必须为受控内部服务源地址");
+        }
+    }
+    @Override public String toString() {
+        return "LingxingEgressProperties[collectionMode=" + collectionMode + ", environmentLabel=" + environmentLabel + "]";
+    }
+}
diff --git a/integration-service/src/main/java/com/baiyue/integration/config/LingxingQuantityCaptureProperties.java b/integration-service/src/main/java/com/baiyue/integration/config/LingxingQuantityCaptureProperties.java
new file mode 100644
index 000000000..95d4099e1
--- /dev/null
+++ b/integration-service/src/main/java/com/baiyue/integration/config/LingxingQuantityCaptureProperties.java
@@ -0,0 +1,6 @@
+package com.baiyue.integration.config;
+import org.springframework.boot.context.properties.ConfigurationProperties;
+import org.springframework.boot.context.properties.bind.DefaultValue;
+/** Feature gate only. Explicit, durable grants and deadlines are owned by Lastleg. */
+@ConfigurationProperties("baiyue.integration.lingxing-wms.quantity-capture")
+public record LingxingQuantityCaptureProperties(@DefaultValue("false") boolean enabled,String sourceAccount) {}
diff --git a/integration-service/src/main/java/com/baiyue/integration/config/LingxingWmsProperties.java b/integration-service/src/main/java/com/baiyue/integration/config/LingxingWmsProperties.java
new file mode 100644
index 000000000..07ba44975
--- /dev/null
+++ b/integration-service/src/main/java/com/baiyue/integration/config/LingxingWmsProperties.java
@@ -0,0 +1,46 @@
+package com.baiyue.integration.config;
+
+import org.springframework.boot.context.properties.ConfigurationProperties;
+import org.springframework.boot.context.properties.bind.DefaultValue;
+
+import java.net.URI;
+import java.time.Duration;
+
+@ConfigurationProperties(prefix = "baiyue.integration.lingxing-wms")
+public record LingxingWmsProperties(
+    @DefaultValue("false") boolean enabled,
+    @DefaultValue("https://api.xlwms.com") URI baseUri,
+    String appKey,
+    String appSecret,
+    @DefaultValue("5s") Duration connectTimeout,
+    @DefaultValue("15s") Duration requestTimeout
+) {
+    public LingxingWmsProperties {
+        baseUri = baseUri == null ? URI.create("https://api.xlwms.com") : baseUri;
+        connectTimeout = connectTimeout == null ? Duration.ofSeconds(5) : connectTimeout;
+        requestTimeout = requestTimeout == null ? Duration.ofSeconds(15) : requestTimeout;
+        if (connectTimeout.isZero() || connectTimeout.isNegative()
+            || requestTimeout.isZero() || requestTimeout.isNegative()) {
+            throw new IllegalArgumentException("领星 WMS 超时必须为正数");
+        }
+        String host = baseUri.getHost();
+        boolean loopback = "localhost".equalsIgnoreCase(host) || "127.0.0.1".equals(host)
+            || "[::1]".equals(host);
+        boolean secureScheme = "https".equalsIgnoreCase(baseUri.getScheme())
+            || ("http".equalsIgnoreCase(baseUri.getScheme()) && loopback);
+        if (host == null || !secureScheme || baseUri.getUserInfo() != null
+            || baseUri.getQuery() != null || baseUri.getFragment() != null
+            || (!baseUri.getPath().isEmpty() && !"/".equals(baseUri.getPath()))) {
+            throw new IllegalArgumentException("领星 WMS base-uri 必须是 HTTPS 源地址；仅本机测试允许 HTTP");
+        }
+    }
+
+    public boolean hasCredentials() {
+        return appKey != null && !appKey.isBlank() && appSecret != null && !appSecret.isBlank();
+    }
+
+    @Override
+    public String toString() {
+        return "LingxingWmsProperties[enabled=" + enabled + ", credentialsConfigured=" + hasCredentials() + "]";
+    }
+}
diff --git a/integration-service/src/main/java/com/baiyue/integration/controller/LingxingEgressRuntimeController.java b/integration-service/src/main/java/com/baiyue/integration/controller/LingxingEgressRuntimeController.java
new file mode 100644
index 000000000..13a329a75
--- /dev/null
+++ b/integration-service/src/main/java/com/baiyue/integration/controller/LingxingEgressRuntimeController.java
@@ -0,0 +1,32 @@
+package com.baiyue.integration.controller;
+
+import com.baiyue.common.core.api.ApiResponse;
+import com.baiyue.integration.config.LingxingWmsProperties;
+import com.baiyue.integration.dto.lingxing.LingxingEgressRuntimeSnapshot;
+import com.baiyue.integration.provider.lingxing.LingxingEgressGate;
+import com.baiyue.integration.security.InternalServiceTokenGuard;
+import io.swagger.v3.oas.annotations.Operation;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.RequestHeader;
+import org.springframework.web.bind.annotation.RestController;
+
+/** Internal token is checked before the active gate is inspected. Never calls the provider. */
+@RestController
+public class LingxingEgressRuntimeController {
+    private final InternalServiceTokenGuard guard;
+    private final LingxingEgressGate gate;
+    private final LingxingWmsProperties provider;
+
+    public LingxingEgressRuntimeController(InternalServiceTokenGuard guard, LingxingEgressGate gate,
+            LingxingWmsProperties provider) {
+        this.guard = guard; this.gate = gate; this.provider = provider;
+    }
+
+    @Operation(summary = "读取实际领星出口绑定配置的脱敏快照，无供应商或许可副作用")
+    @GetMapping("/internal/integrations/lingxing/wms/egress/runtime")
+    public ApiResponse<LingxingEgressRuntimeSnapshot> runtime(
+            @RequestHeader(value = "X-Internal-Service-Token", required = false) String token) {
+        guard.verify(token);
+        return ApiResponse.success(gate.runtimeSnapshot(provider.enabled()));
+    }
+}
diff --git a/integration-service/src/main/java/com/baiyue/integration/controller/LingxingInternalController.java b/integration-service/src/main/java/com/baiyue/integration/controller/LingxingInternalController.java
new file mode 100644
index 000000000..25ca5f81d
--- /dev/null
+++ b/integration-service/src/main/java/com/baiyue/integration/controller/LingxingInternalController.java
@@ -0,0 +1,154 @@
+package com.baiyue.integration.controller;
+
+import com.baiyue.common.core.api.ApiResponse;
+import com.baiyue.common.core.api.ResultCode;
+import com.baiyue.common.web.CorrelationContext;
+import com.baiyue.integration.dto.lingxing.LingxingWmsDtos.PageResult;
+import com.baiyue.integration.dto.lingxing.LingxingWmsDtos.QueryRequest;
+import com.baiyue.integration.dto.lingxing.LingxingWmsDtos.*;
+import com.baiyue.integration.dto.lingxing.LingxingEgressDtos.*;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.fasterxml.jackson.databind.DeserializationFeature;
+import com.fasterxml.jackson.core.JsonParser;
+import com.baiyue.integration.provider.lingxing.LingxingWmsClient;
+import com.baiyue.integration.provider.lingxing.LingxingWmsException;
+import com.baiyue.integration.security.InternalServiceTokenGuard;
+import io.swagger.v3.oas.annotations.Operation;
+import io.swagger.v3.oas.annotations.tags.Tag;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.validation.Valid;
+import org.springframework.web.bind.annotation.ExceptionHandler;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.RequestHeader;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+@Tag(name = "领星 WMS 内部查询", description = "仅内部服务令牌认证，不提供公网路由")
+@RestController
+@RequestMapping("/internal/integrations/lingxing/wms")
+public class LingxingInternalController {
+    private final InternalServiceTokenGuard tokenGuard;
+    private final LingxingWmsClient client;
+    private final ObjectMapper mapper;
+
+    public LingxingInternalController(InternalServiceTokenGuard tokenGuard, LingxingWmsClient client, ObjectMapper mapper) {
+        this.tokenGuard = tokenGuard;
+        this.client = client;
+        this.mapper = mapper;
+    }
+
+    @Operation(summary = "按出库时间分页只读查询 WMS 已出库摘要")
+    @PostMapping("/outbound-orders/query")
+    public ApiResponse<PageResult> query(
+            @RequestHeader(value = "X-Internal-Service-Token", required = false) String token,
+            @RequestHeader(value = "X-Lingxing-Egress-Context", required = false) String context,
+            @Valid @RequestBody QueryRequest request) {
+        tokenGuard.verify(token);
+        return ApiResponse.success(client.queryPage(request, context(context)));
+    }
+
+    @Operation(summary = "读取正常仓库目录单页")
+    @PostMapping("/warehouses/query")
+    public ApiResponse<QueryPage<Warehouse>> warehouses(
+            @RequestHeader(value = "X-Internal-Service-Token", required = false) String token,
+            @RequestHeader(value = "X-Lingxing-Egress-Context", required = false) String context,
+            @Valid @RequestBody WarehouseQueryRequest request) {
+        tokenGuard.verify(token);
+        return ApiResponse.success(client.queryWarehouses(request, context(context)));
+    }
+
+    @Operation(summary = "按单号定位单页，不附加时间或状态筛选")
+    @PostMapping("/outbound-orders/locate")
+    public ApiResponse<PageResult> locate(
+            @RequestHeader(value = "X-Internal-Service-Token", required = false) String token,
+            @RequestHeader(value = "X-Lingxing-Egress-Context", required = false) String context,
+            @Valid @RequestBody LocateRequest request) {
+        tokenGuard.verify(token);
+        return ApiResponse.success(client.locate(request, context(context)));
+    }
+
+    @Operation(summary = "按仓库、货主、发货单号读取完整 SKU 详情")
+    @PostMapping("/outbound-orders/detail")
+    public ApiResponse<OrderDetail> detail(
+            @RequestHeader(value = "X-Internal-Service-Token", required = false) String token,
+            @RequestHeader(value = "X-Lingxing-Egress-Context", required = false) String context,
+            @Valid @RequestBody DetailRequest request) {
+        tokenGuard.verify(token);
+        return ApiResponse.success(client.queryDetail(request, context(context)));
+    }
+
+    @Operation(summary = "单SKU最多31日库存流水诊断，仅第一页最多1000条")
+    @PostMapping("/inventory-flow/query")
+    public ApiResponse<QueryPage<InventoryFlow>> inventoryFlow(
+        @RequestHeader(value="X-Internal-Service-Token",required=false) String token,
+        @RequestHeader(value="X-Lingxing-Egress-Context",required=false) String context,
+        @Valid @RequestBody InventoryFlowRequest request) {
+        tokenGuard.verify(token);return ApiResponse.success(client.queryInventoryFlow(request,context(context)));
+    }
+
+    @Operation(summary = "读取固定单仓最多一天的全部货主品质库存流水单页")
+    @PostMapping("/inventory-flow-page/query")
+    public ApiResponse<QueryPage<InventoryFlow>> inventoryFlowPage(
+        @RequestHeader(value="X-Internal-Service-Token",required=false) String token,
+        @RequestHeader(value="X-Lingxing-Egress-Context",required=false) String context,
+        @Valid @RequestBody InventoryFlowPageRequest request) {
+        tokenGuard.verify(token);return ApiResponse.success(client.queryInventoryFlowPage(request,context(context)));
+    }
+
+    @Operation(summary = "读取单仓全部货主、全部品质且保留零库存的产品库存单页")
+    @PostMapping("/product-inventory/query")
+    public ApiResponse<QueryPage<ProductStock>> inventory(
+            @RequestHeader(value = "X-Internal-Service-Token", required = false) String token,
+            @RequestHeader(value = "X-Lingxing-Egress-Context", required = false) String context,
+            @Valid @RequestBody InventoryQueryRequest request) {
+        tokenGuard.verify(token);
+        return ApiResponse.success(client.queryInventory(request, context(context)));
+    }
+
+    @PostMapping("/customers/query")
+    public ApiResponse<QueryPage<Customer>> customers(
+            @RequestHeader(value="X-Internal-Service-Token",required=false) String token,
+            @RequestHeader(value="X-Lingxing-Egress-Context",required=false) String context,
+            @Valid @RequestBody WarehouseQueryRequest request) {
+        tokenGuard.verify(token);
+        return ApiResponse.success(client.queryCustomers(request,context(context)));
+    }
+
+    @PostMapping("/products/query")
+    public ApiResponse<QueryPage<Product>> products(
+            @RequestHeader(value="X-Internal-Service-Token",required=false) String token,
+            @RequestHeader(value="X-Lingxing-Egress-Context",required=false) String context,
+            @Valid @RequestBody ProductQueryRequest request) {
+        tokenGuard.verify(token);
+        return ApiResponse.success(client.queryProducts(request,context(context)));
+    }
+
+    private EgressContext context(String header) {
+        if (header == null || header.isBlank() || header.length() > 2048 || !header.chars().allMatch(c -> c >= 32 && c <= 126))
+            throw invalidContext();
+        try {
+            EgressContext context = mapper.readerFor(EgressContext.class).with(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES,
+                DeserializationFeature.FAIL_ON_TRAILING_TOKENS).with(JsonParser.Feature.STRICT_DUPLICATE_DETECTION).readValue(header);
+            if (context == null || !context.wellFormed()) throw invalidContext();
+            return context;
+        } catch (Exception ignored) { throw invalidContext(); }
+    }
+    private static LingxingWmsException invalidContext() {
+        return new LingxingWmsException("LINGXING_WMS_EGRESS_CONTEXT_INVALID", "领星安全出口控制上下文缺失或无效", false, null, null);
+    }
+
+    @ExceptionHandler(LingxingWmsException.class)
+    public ApiResponse<ProviderFailure> handleProviderFailure(LingxingWmsException exception,
+                                                              HttpServletRequest request) {
+        ResultCode code = exception.retryable() ? ResultCode.SERVICE_UNAVAILABLE : ResultCode.BUSINESS_ERROR;
+        return ApiResponse.of(code, exception.getMessage(),
+                new ProviderFailure(exception.code(), exception.retryable(),
+                        exception.upstreamStatus(), exception.sourceCode(), exception.egress() == null
+                            ? new AttemptMetadata(null, 0, false, null) : exception.egress(), exception.denial()),
+                CorrelationContext.requestId(request), CorrelationContext.traceId(request));
+    }
+
+    public record ProviderFailure(String errorCode, boolean retryable,
+                                  Integer upstreamStatus, Integer sourceCode, AttemptMetadata egress, AuthorizationDenial denial) { }
+}
diff --git a/integration-service/src/main/java/com/baiyue/integration/dto/lingxing/LingxingEgressDtos.java b/integration-service/src/main/java/com/baiyue/integration/dto/lingxing/LingxingEgressDtos.java
new file mode 100644
index 000000000..70b95d999
--- /dev/null
+++ b/integration-service/src/main/java/com/baiyue/integration/dto/lingxing/LingxingEgressDtos.java
@@ -0,0 +1,31 @@
+package com.baiyue.integration.dto.lingxing;
+
+import java.time.Instant;
+
+/** Control identities are supplied by the collector and revalidated by its durable authority. */
+public final class LingxingEgressDtos {
+    private LingxingEgressDtos() { }
+    public enum CollectionMode { OFF, VALIDATION, BUSINESS }
+    public enum Operation { WAREHOUSES, OUTBOUND_QUERY, OUTBOUND_LOCATE, OUTBOUND_DETAIL, PRODUCT_INVENTORY, CUSTOMERS, PRODUCTS, INVENTORY_FLOW }
+    public record EgressContext(String sourceAccount, CollectionMode executionPurpose, String rootTaskId,
+                                String sessionId, String attemptId, String exclusiveGrantId) {
+        public boolean wellFormed() {
+            return (executionPurpose == CollectionMode.VALIDATION || executionPurpose == CollectionMode.BUSINESS)
+                && identifier(sourceAccount, 64) && identifier(rootTaskId, 128) && identifier(sessionId, 128)
+                && identifier(attemptId, 128) && identifier(exclusiveGrantId, 128);
+        }
+        private static boolean identifier(String value, int maximum) {
+            return value != null && value.length() <= maximum && value.matches("[A-Za-z0-9][A-Za-z0-9._:-]*");
+        }
+    }
+    public record AuthorizationRequest(EgressContext context, Operation operation, String requestHash) { }
+    public record AttemptPermit(EgressContext context, Operation operation, String requestHash,
+                                int allowedAttempts, Instant expiresAt, boolean exclusiveConfirmed,
+                                boolean budgetConsumed) { }
+    public record CompletionRequest(EgressContext context, Operation operation, String requestHash,
+                                    int actualHttpAttempts, String errorCode, Integer upstreamStatus,
+                                    Integer sourceCode, boolean accountPaused, Instant cooldownUntil) { }
+    public record AttemptMetadata(String attemptId, int actualHttpAttempts, boolean accountPaused,
+                                  Instant cooldownUntil) { }
+    public record AuthorizationDenial(String errorCode, boolean sampleDone, Instant waitUntil) { }
+}
diff --git a/integration-service/src/main/java/com/baiyue/integration/dto/lingxing/LingxingEgressRuntimeSnapshot.java b/integration-service/src/main/java/com/baiyue/integration/dto/lingxing/LingxingEgressRuntimeSnapshot.java
new file mode 100644
index 000000000..521478ed9
--- /dev/null
+++ b/integration-service/src/main/java/com/baiyue/integration/dto/lingxing/LingxingEgressRuntimeSnapshot.java
@@ -0,0 +1,9 @@
+package com.baiyue.integration.dto.lingxing;
+
+import java.time.Instant;
+
+/** Bound runtime configuration only. No credentials, addresses or execution attestation. */
+public record LingxingEgressRuntimeSnapshot(int schemaVersion, String service, Instant observedAt,
+        String mode, String environment, boolean continuousEnabled, String sourceAccountFingerprint,
+        boolean grantPresent, String grantFingerprint, long intervalMs, int permitMaxSeconds,
+        boolean providerEnabled, String budgetAuthorityFingerprint) { }
diff --git a/integration-service/src/main/java/com/baiyue/integration/dto/lingxing/LingxingWmsDtos.java b/integration-service/src/main/java/com/baiyue/integration/dto/lingxing/LingxingWmsDtos.java
new file mode 100644
index 000000000..19cc34506
--- /dev/null
+++ b/integration-service/src/main/java/com/baiyue/integration/dto/lingxing/LingxingWmsDtos.java
@@ -0,0 +1,70 @@
+package com.baiyue.integration.dto.lingxing;
+
+import jakarta.validation.constraints.Max;
+import jakarta.validation.constraints.Min;
+import jakarta.validation.constraints.NotNull;
+import jakarta.validation.constraints.NotBlank;
+import jakarta.validation.constraints.Size;
+import java.math.BigDecimal;
+
+import java.time.Instant;
+import java.time.LocalDateTime;
+import java.util.List;
+import com.baiyue.integration.dto.lingxing.LingxingEgressDtos.AttemptMetadata;
+
+public final class LingxingWmsDtos {
+    private LingxingWmsDtos() { }
+
+    public record QueryRequest(@NotNull LocalDateTime startTime, @NotNull LocalDateTime endTime,
+                               @Min(1) int current, @Min(1) @Max(100) int size) { }
+
+    public record WarehouseQueryRequest(@Min(1) int current, @Min(1) @Max(1000) int size) { }
+    public record ProductQueryRequest(@Min(1) int current, @Min(1) @Max(100) int size) { }
+    public record InventoryFlowRequest(@NotBlank @Size(max=64) String warehouseCode,
+        @NotBlank @Size(max=64) String customerCode, @NotBlank @Size(max=128) String sku,
+        @NotNull LocalDateTime startTime, @NotNull LocalDateTime endTime) { }
+    public record InventoryFlowPageRequest(@NotBlank @Size(max=64) String warehouseCode,
+        @NotNull LocalDateTime startTime,@NotNull LocalDateTime endTime,
+        @Min(1) int current,@Min(1) @Max(1000) int size) { }
+    public record InventoryFlow(String id, String customerCode, String whCode, String productSku,
+        String cellNo, String innerBatchNo, String billNo, String billType, Integer productQuality,
+        BigDecimal bookQty, String bookChangQty, BigDecimal closeQty, String createTime, String sourceNo) { }
+    public record Customer(String customerCode, String customerName, String status) { }
+    public record Product(String customerCode, String sku, String productName,
+                          BigDecimal length, BigDecimal width, BigDecimal height, String sizeUnit,
+                          BigDecimal wmsLength, BigDecimal wmsWidth, BigDecimal wmsHeight, String wmsSizeUnit) { }
+    public record LocateRequest(@NotBlank @Size(max=128) String deliveryNo,
+                                @Min(1) int current, @Min(1) @Max(1000) int size) { }
+    public record DetailRequest(@NotBlank @Size(max=64) String warehouseCode,
+                                @NotBlank @Size(max=64) String customerCode,
+                                @NotBlank @Size(max=128) String deliveryNo) { }
+    public record InventoryQueryRequest(@NotBlank @Size(max=64) String warehouseCode,
+                                        @Min(1) int current, @Min(1) @Max(1000) int size) { }
+    public record Warehouse(String whCode, String whNameCn, Integer warehouseType,
+                            Integer status, String timeZone) { }
+    public record SkuLine(String productSku, String productName, BigDecimal actualDeliveryQty,
+                          BigDecimal deliveryQty) { }
+    public record OrderDetail(String deliveryNo, String sourceNo, String customerCode, String whCode,
+                              Integer status, String orderCreateTime, String outboundTime,
+                              List<SkuLine> skuVOList, int sourceCode, Instant observedAt, AttemptMetadata egress) {
+        public OrderDetail { skuVOList = List.copyOf(skuVOList); }
+    }
+    public record ProductStock(String customerCode, String whCode, String productSku, String productName,
+                               Integer productQuality, BigDecimal stkQty, BigDecimal freezeQty,
+                               BigDecimal useStkQty, BigDecimal transitQty, String innerBatchNo,
+                               String outBatchNo, String uniqueKey4tenant) { }
+    public record QueryPage<T>(List<T> records, Long total, int current, int size, int pages,
+                               int sourceCurrent, int sourceSize, int sourceCode, Instant observedAt, AttemptMetadata egress) {
+        public QueryPage { records = List.copyOf(records); }
+    }
+
+    // Preserve source strings; the collector interprets confirmed Asia/Shanghai source time.
+    public record ListSku(String productSku, String productName, BigDecimal qty) { }
+    public record OrderSummary(String deliveryNo, String sourceNo, String customerCode, String whCode,
+                               Integer status, String createTime, String outboundTime, List<ListSku> productList) { }
+
+    public record PageResult(List<OrderSummary> records, Long total, int current, int size,
+                             int pages, int sourceCurrent, int sourceSize, int sourceCode, Instant observedAt, AttemptMetadata egress) {
+        public PageResult { records = List.copyOf(records); }
+    }
+}
diff --git a/integration-service/src/main/java/com/baiyue/integration/provider/lingxing/LingxingBudgetAuthority.java b/integration-service/src/main/java/com/baiyue/integration/provider/lingxing/LingxingBudgetAuthority.java
new file mode 100644
index 000000000..bd51b96fd
--- /dev/null
+++ b/integration-service/src/main/java/com/baiyue/integration/provider/lingxing/LingxingBudgetAuthority.java
@@ -0,0 +1,9 @@
+package com.baiyue.integration.provider.lingxing;
+
+import com.baiyue.integration.dto.lingxing.LingxingEgressDtos.*;
+
+/** authorize must consume a persisted single-use attempt before returning; never refund on lost response. */
+public interface LingxingBudgetAuthority {
+    AttemptPermit authorize(AuthorizationRequest request);
+    void complete(CompletionRequest request);
+}
diff --git a/integration-service/src/main/java/com/baiyue/integration/provider/lingxing/LingxingBudgetDeniedException.java b/integration-service/src/main/java/com/baiyue/integration/provider/lingxing/LingxingBudgetDeniedException.java
new file mode 100644
index 000000000..b86578610
--- /dev/null
+++ b/integration-service/src/main/java/com/baiyue/integration/provider/lingxing/LingxingBudgetDeniedException.java
@@ -0,0 +1,11 @@
+package com.baiyue.integration.provider.lingxing;
+import com.baiyue.integration.dto.lingxing.LingxingEgressDtos.AuthorizationDenial;
+
+/** A known, authenticated authority decision; distinct from a lost/ambiguous response. */
+public final class LingxingBudgetDeniedException extends RuntimeException {
+    private final AuthorizationDenial denial;
+    public LingxingBudgetDeniedException(AuthorizationDenial denial) {
+        super("领星持久预算授权拒绝"); this.denial = denial;
+    }
+    public AuthorizationDenial denial() { return denial; }
+}
diff --git a/integration-service/src/main/java/com/baiyue/integration/provider/lingxing/LingxingEgressGate.java b/integration-service/src/main/java/com/baiyue/integration/provider/lingxing/LingxingEgressGate.java
new file mode 100644
index 000000000..05a4e7393
--- /dev/null
+++ b/integration-service/src/main/java/com/baiyue/integration/provider/lingxing/LingxingEgressGate.java
@@ -0,0 +1,170 @@
+package com.baiyue.integration.provider.lingxing;
+
+import com.baiyue.integration.config.LingxingEgressProperties;
+import com.baiyue.integration.dto.lingxing.LingxingEgressDtos.*;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.stereotype.Component;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import java.time.Clock;
+import java.time.Instant;
+import java.nio.charset.StandardCharsets;
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
+import java.util.HexFormat;
+import com.baiyue.integration.dto.lingxing.LingxingEgressRuntimeSnapshot;
+import java.util.concurrent.Semaphore;
+import java.util.concurrent.TimeUnit;
+
+/** Local serialization supplements the exclusive grant and durable account protection. */
+@Component
+public final class LingxingEgressGate {
+    private static final int PERMIT_MAX_SECONDS = 30;
+    private static final Logger log = LoggerFactory.getLogger(LingxingEgressGate.class);
+    private final LingxingEgressProperties properties;
+    private final LingxingBudgetAuthority authority;
+    private final Clock clock;
+    private final Waiter waiter;
+    private final Semaphore inFlight = new Semaphore(1, true);
+    private volatile boolean paused;
+    private volatile boolean recoverableRatePause;
+    private Instant lastStart;
+    private Instant cooldownUntil;
+    @Autowired public LingxingEgressGate(LingxingEgressProperties properties, LingxingBudgetAuthority authority) {
+        this(properties, authority, Clock.systemUTC(), Thread::sleep);
+    }
+    LingxingEgressGate(LingxingEgressProperties properties, LingxingBudgetAuthority authority, Clock clock, Waiter waiter) {
+        this.properties = properties; this.authority = authority; this.clock = clock; this.waiter = waiter;
+    }
+    /** The very properties and clock used by execute; no semaphore, authority, budget or HTTP work. */
+    public LingxingEgressRuntimeSnapshot runtimeSnapshot(boolean providerEnabled) {
+        String grant = properties.externalExclusiveGrantId();
+        return new LingxingEgressRuntimeSnapshot(1, "integration", clock.instant(),
+            properties.collectionMode().name(), properties.environmentLabel(),
+            properties.continuousBusinessCollectionEnabled(), fingerprint("source-account", properties.sourceAccount()),
+            grant != null && !grant.isBlank(), fingerprint("grant", grant), properties.minStartInterval().toMillis(),
+            PERMIT_MAX_SECONDS, providerEnabled, fingerprint("budget-authority", properties.budgetAuthorityBaseUri() == null ? null
+                : properties.budgetAuthorityBaseUri().toString()));
+    }
+    private static String fingerprint(String domain, String value) {
+        if (value == null || value.isBlank()) return null;
+        try {
+            return HexFormat.of().formatHex(MessageDigest.getInstance("SHA-256")
+                .digest(("selfop-runtime:v1:" + domain + "\n" + value).getBytes(StandardCharsets.UTF_8)));
+        } catch (NoSuchAlgorithmException impossible) { throw new IllegalStateException("SHA256_UNAVAILABLE", impossible); }
+    }
+    public <T> T execute(EgressContext context, Operation operation, String hash, AuthorizedCall<T> call) {
+        try { return guarded(context, operation, hash, call); }
+        catch (LingxingWmsException error) {
+            if (error.egress() == null) error.withEgress(new AttemptMetadata(
+                context != null && identifier(context.attemptId(), 128) ? context.attemptId() : null, 0, paused, cooldownUntil));
+            throw error;
+        }
+    }
+    private <T> T guarded(EgressContext context, Operation operation, String hash, AuthorizedCall<T> call) {
+        check(context);
+        if (operation == null || hash == null || !hash.matches("[a-f0-9]{64}")) throw failure("EGRESS_CONTEXT_INVALID");
+        boolean acquired = false;
+        try {
+            while (!(acquired = inFlight.tryAcquire(100, TimeUnit.MILLISECONDS))) check(context);
+            check(context);
+            if (lastStart != null) {
+                Instant next = lastStart.plus(properties.minStartInterval());
+                long wait = java.time.Duration.between(clock.instant(), next).toMillis();
+                if (wait > 0) waiter.sleep(wait + 1);
+            }
+            check(context);
+            AuthorizationRequest request = new AuthorizationRequest(context, operation, hash);
+            AttemptPermit permit;
+            try { permit = authority.authorize(request); }
+            catch (LingxingBudgetDeniedException knownDecision) {
+                throw failure("BUDGET_AUTHORIZATION_DENIED").withDenial(knownDecision.denial());
+            }
+            catch (RuntimeException error) { recoverableRatePause = false; paused = true; throw failure("BUDGET_AUTHORITY_UNAVAILABLE"); }
+            if (permit == null || !context.equals(permit.context()) || operation != permit.operation()
+                || !hash.equals(permit.requestHash()) || permit.allowedAttempts() != 1 || !permit.exclusiveConfirmed()
+                || !permit.budgetConsumed() || permit.expiresAt() == null || !clock.instant().isBefore(permit.expiresAt())
+                || permit.expiresAt().isAfter(clock.instant().plusSeconds(PERMIT_MAX_SECONDS))
+                || (!business() && permit.expiresAt().isAfter(properties.externalExclusiveUntil()))) {
+                recoverableRatePause = false; paused = true; throw failure("BUDGET_PERMIT_INVALID");
+            }
+            // A new persisted permit proves the coordinator accepted the account's cooldown/budget/root state.
+            // Time alone never clears the pause. VALIDATION and uncertain callbacks cannot reach this branch.
+            if (paused && recoverableRatePause && properties.collectionMode() == CollectionMode.BUSINESS) {
+                paused = false; recoverableRatePause = false; cooldownUntil = null;
+            }
+            AttemptHandle handle = new AttemptHandle(context, permit.expiresAt());
+            T result = null;
+            LingxingWmsException failure = null;
+            try { result = call.run(handle); }
+            catch (LingxingWmsException error) { failure = error; }
+            catch (RuntimeException error) { failure = failure("LOCAL_PROCESSING_FAILED"); }
+            Instant callFinishedAt = clock.instant();
+            CompletionRequest completion = new CompletionRequest(context, operation, hash, handle.actualHttpAttempts,
+                failure == null ? null : failure.code(), failure == null ? Integer.valueOf(200) : failure.upstreamStatus(),
+                failure == null ? Integer.valueOf(200) : failure.sourceCode(), paused, cooldownUntil);
+            boolean completionConfirmed = false;
+            try { authority.complete(completion); completionConfirmed = true; }
+            catch (RuntimeException error) {
+                recoverableRatePause = false; paused = true;
+                // Unconfirmed completion must remain distinguishable even when the provider already failed.
+                failure = failure("BUDGET_COMPLETION_UNCONFIRMED");
+            }
+            log.debug("lingxingAttempt operation={} start={} end={} upstreamStatus={} sourceCode={} errorCode={} completionConfirmed={}",
+                operation, handle.startedAt, callFinishedAt, completion.upstreamStatus(), completion.sourceCode(),
+                completion.errorCode(), completionConfirmed);
+            if (failure != null) throw failure.withEgress(handle.metadata());
+            return result;
+        } catch (InterruptedException ignored) {
+            Thread.currentThread().interrupt(); throw failure("INTERRUPTED");
+        } finally { if (acquired) inFlight.release(); }
+    }
+    private void check(EgressContext context) {
+        if (properties.collectionMode() == CollectionMode.OFF) throw failure("EGRESS_OFF");
+        if (properties.collectionMode() == CollectionMode.BUSINESS
+            && !("production".equals(properties.environmentLabel()) || "test".equals(properties.environmentLabel())))
+            throw failure("BUSINESS_ENVIRONMENT_REJECTED");
+        if (paused && (!recoverableRatePause || properties.collectionMode() != CollectionMode.BUSINESS
+            || cooldownUntil == null || clock.instant().isBefore(cooldownUntil))) throw failure("ACCOUNT_PAUSED");
+        if (context == null || context.executionPurpose() != properties.collectionMode()
+            || !context.wellFormed()
+            || !context.sourceAccount().equals(properties.sourceAccount())) throw failure("EGRESS_CONTEXT_INVALID");
+        if (properties.externalExclusiveGrantId() == null || properties.externalExclusiveGrantId().isBlank()
+            || !properties.externalExclusiveGrantId().equals(context.exclusiveGrantId())
+            || (!business() && (properties.externalExclusiveUntil() == null || !clock.instant().isBefore(properties.externalExclusiveUntil())))
+            || properties.budgetAuthorityBaseUri() == null) throw failure("EXCLUSIVE_WINDOW_UNCONFIRMED");
+    }
+    private boolean business() {
+        // The account authority validates the original task identity, including manual roots.
+        // BUSINESS has no operator session cutoff; each individual permit remains finite.
+        return properties.collectionMode() == CollectionMode.BUSINESS;
+    }
+    private static boolean identifier(String value, int maximum) {
+        return value != null && value.length() <= maximum && value.matches("[A-Za-z0-9][A-Za-z0-9._:-]*");
+    }
+    private static LingxingWmsException failure(String code) {
+        return new LingxingWmsException("LINGXING_WMS_" + code, "领星安全出口拒绝请求（" + code + "）", false, null, null);
+    }
+    public final class AttemptHandle {
+        private final EgressContext context;
+        private final Instant expiresAt;
+        private int actualHttpAttempts;
+        private Instant startedAt;
+        private AttemptHandle(EgressContext context, Instant expiresAt) { this.context = context; this.expiresAt = expiresAt; }
+        /** Immediately before send, after signing. One permit can never send twice. */
+        public void startHttp() {
+            check(context);
+            if (actualHttpAttempts != 0 || !clock.instant().isBefore(expiresAt)) throw failure("ATTEMPT_NOT_SENDABLE");
+            actualHttpAttempts = 1; lastStart = clock.instant(); startedAt = lastStart;
+        }
+        public void rateLimited(Instant retryAfter) {
+            Instant fallback = clock.instant().plus(properties.cooldownFallback());
+            cooldownUntil = retryAfter != null && retryAfter.isAfter(fallback) ? retryAfter : fallback;
+            recoverableRatePause = properties.collectionMode() == CollectionMode.BUSINESS;
+            paused = true;
+        }
+        public AttemptMetadata metadata() { return new AttemptMetadata(context.attemptId(), actualHttpAttempts, paused, cooldownUntil); }
+    }
+    @FunctionalInterface interface Waiter { void sleep(long millis) throws InterruptedException; }
+    @FunctionalInterface public interface AuthorizedCall<T> { T run(AttemptHandle handle); }
+}
diff --git a/integration-service/src/main/java/com/baiyue/integration/provider/lingxing/LingxingHttpBudgetAuthority.java b/integration-service/src/main/java/com/baiyue/integration/provider/lingxing/LingxingHttpBudgetAuthority.java
new file mode 100644
index 000000000..37e85301d
--- /dev/null
+++ b/integration-service/src/main/java/com/baiyue/integration/provider/lingxing/LingxingHttpBudgetAuthority.java
@@ -0,0 +1,73 @@
+package com.baiyue.integration.provider.lingxing;
+
+import com.baiyue.integration.config.LingxingEgressProperties;
+import com.baiyue.integration.dto.lingxing.LingxingEgressDtos.*;
+import com.fasterxml.jackson.databind.DeserializationFeature;
+import com.fasterxml.jackson.databind.JsonNode;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.stereotype.Component;
+import java.net.http.*;
+import java.nio.charset.StandardCharsets;
+import java.time.Duration;
+
+/** Fixed server-configured authority only. No retries, redirects or user-selected callback URLs. */
+@Component
+public final class LingxingHttpBudgetAuthority implements LingxingBudgetAuthority {
+    private static final String PREFIX = "/internal/lastleg/self-operated-analytics/egress/";
+    private final LingxingEgressProperties properties;
+    private final ObjectMapper mapper;
+    private final String internalToken;
+    private final HttpClient client = HttpClient.newBuilder().connectTimeout(Duration.ofSeconds(3))
+        .followRedirects(HttpClient.Redirect.NEVER).build();
+    public LingxingHttpBudgetAuthority(LingxingEgressProperties properties, ObjectMapper mapper,
+            @Value("${baiyue.security.internal-service-token:}") String internalToken) {
+        this.properties = properties; this.mapper = mapper; this.internalToken = internalToken;
+    }
+    @Override public AttemptPermit authorize(AuthorizationRequest request) {
+        JsonNode data = post("authorize", request);
+        if (!data.isObject() || !data.path("allowedAttempts").isIntegralNumber()
+            || data.path("allowedAttempts").intValue() != 1 || !data.path("exclusiveConfirmed").isBoolean()
+            || !data.path("exclusiveConfirmed").booleanValue() || !data.path("budgetConsumed").isBoolean()
+            || !data.path("budgetConsumed").booleanValue() || !data.path("context").isObject()
+            || !data.path("expiresAt").isTextual()) throw unavailable();
+        try { return mapper.readerFor(AttemptPermit.class).with(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES).readValue(data.traverse(mapper)); }
+        catch (Exception ignored) { throw unavailable(); }
+    }
+    @Override public void complete(CompletionRequest request) {
+        JsonNode data = post("complete", request);
+        if (!data.isBoolean() || !data.booleanValue()) throw unavailable();
+    }
+    private JsonNode post(String suffix, Object payload) {
+        if (properties.budgetAuthorityBaseUri() == null || internalToken == null || internalToken.isBlank()
+            || internalToken.getBytes(StandardCharsets.UTF_8).length < 32) throw unavailable();
+        try {
+            HttpRequest request = HttpRequest.newBuilder(properties.budgetAuthorityBaseUri().resolve(PREFIX + suffix))
+                .timeout(Duration.ofSeconds(5)).header("X-Internal-Service-Token", internalToken)
+                .header("Content-Type", "application/json; charset=UTF-8")
+                .POST(HttpRequest.BodyPublishers.ofString(mapper.writeValueAsString(payload), StandardCharsets.UTF_8)).build();
+            HttpResponse<String> response = client.send(request, HttpResponse.BodyHandlers.ofString(StandardCharsets.UTF_8));
+            if (response.statusCode() != 200) throw unavailable();
+            JsonNode root = mapper.reader().with(DeserializationFeature.FAIL_ON_TRAILING_TOKENS).readTree(response.body());
+            if (root == null || !root.isObject() || !root.path("code").isTextual()
+                || !root.hasNonNull("data")) throw unavailable();
+            if ("authorize".equals(suffix) && "B0001".equals(root.path("code").textValue())) {
+                JsonNode data = root.get("data");
+                if (!data.isObject() || !data.path("errorCode").isTextual()
+                    || !data.path("errorCode").textValue().matches("[A-Z][A-Z0-9_]{0,63}")
+                    || !data.path("sampleDone").isBoolean() || !data.has("waitUntil")) throw unavailable();
+                AuthorizationDenial denial = mapper.readerFor(AuthorizationDenial.class)
+                    .with(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES).readValue(data.traverse(mapper));
+                throw new LingxingBudgetDeniedException(denial);
+            }
+            if (!"200".equals(root.path("code").textValue())) throw unavailable();
+            return root.get("data");
+        } catch (LingxingBudgetDeniedException knownDecision) { throw knownDecision;
+        } catch (InterruptedException ignored) {
+            Thread.currentThread().interrupt(); throw unavailable();
+        } catch (Exception ignored) { throw unavailable(); }
+    }
+    private static LingxingWmsException unavailable() {
+        return new LingxingWmsException("LINGXING_WMS_BUDGET_AUTHORITY_UNAVAILABLE", "领星持久预算授权不可用，出口已拒绝", false, null, null);
+    }
+}
diff --git a/integration-service/src/main/java/com/baiyue/integration/provider/lingxing/LingxingQuantityCapture.java b/integration-service/src/main/java/com/baiyue/integration/provider/lingxing/LingxingQuantityCapture.java
new file mode 100644
index 000000000..976cc06df
--- /dev/null
+++ b/integration-service/src/main/java/com/baiyue/integration/provider/lingxing/LingxingQuantityCapture.java
@@ -0,0 +1,122 @@
+package com.baiyue.integration.provider.lingxing;
+
+import static com.baiyue.integration.provider.lingxing.LingxingQuantityEvidence.*;
+import com.baiyue.integration.config.LingxingQuantityCaptureProperties;
+import com.baiyue.integration.dto.lingxing.LingxingEgressDtos.EgressContext;
+import com.baiyue.integration.dto.lingxing.LingxingEgressDtos.Operation;
+import com.fasterxml.jackson.databind.JsonNode;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import jakarta.annotation.PreDestroy;
+import org.springframework.beans.factory.ObjectProvider;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.stereotype.Component;
+import java.math.BigDecimal;
+import java.time.*;
+import java.util.*;
+import java.util.concurrent.*;
+import java.util.concurrent.atomic.AtomicReference;
+import java.util.concurrent.locks.ReentrantLock;
+
+/** Passive whitelist snapshots only. No JSON serialization, HTTP or waiting locks on egress threads. */
+@Component
+public final class LingxingQuantityCapture {
+ private static final int MAX_BYTES=2097152,MAX_ROWS=2000,MAX_QUEUE=100;
+ private final LingxingQuantityCaptureProperties config;private final Sink sink;private final Clock clock;
+ private final String producer=UUID.randomUUID().toString();
+ private final ScheduledExecutorService worker;
+ private final ReentrantLock intake=new ReentrantLock();
+ private final ArrayDeque<Queued> queue=new ArrayDeque<>();
+ private final Set<String> selected=new HashSet<>(),details=new HashSet<>();
+ private final AtomicReference<String> failure=new AtomicReference<>();
+ private String observedRoot;
+ private volatile View grant;private volatile boolean closed;private int bytes,rows;private boolean attached;
+ @Autowired public LingxingQuantityCapture(LingxingQuantityCaptureProperties config,ObjectMapper mapper,ObjectProvider<Sink> sink){this(config,mapper,sink.getIfAvailable(),Clock.systemUTC());}
+ LingxingQuantityCapture(LingxingQuantityCaptureProperties config,ObjectMapper mapper,Sink sink,Clock clock){this(config,sink,clock,true);}
+ LingxingQuantityCapture(LingxingQuantityCaptureProperties config,Sink sink,Clock clock,boolean start){
+  this.config=config;this.sink=sink;this.clock=clock;
+  worker=Executors.newSingleThreadScheduledExecutor(r->{Thread t=new Thread(r,"lingxing-quantity-capture");t.setDaemon(true);return t;});
+  if(start&&config.enabled()&&sink!=null)worker.scheduleWithFixedDelay(this::pump,0,2,TimeUnit.SECONDS);
+ }
+ public void observe(JsonNode data,Operation operation,EgressContext context,Instant observedAt){
+  View current=grant;
+  if(closed||!config.enabled()||failure.get()!=null||current==null||"TERMINAL".equals(current.state())||"DRAINING".equals(current.state())||!clock.instant().isBefore(current.expiresAt()))return;
+  if(context==null||!context.wellFormed()||!"BUSINESS".equals(String.valueOf(context.executionPurpose()))||!Objects.equals(config.sourceAccount(),context.sourceAccount()))return;
+  if(operation!=Operation.OUTBOUND_QUERY&&operation!=Operation.OUTBOUND_DETAIL)return;
+  if(current.rootTaskId()!=null&&!current.rootTaskId().equals(context.rootTaskId())||Objects.equals(current.excludedRootTaskId(),context.rootTaskId()))return;
+  if(!intake.tryLock()){failure.compareAndSet(null,"OBSERVER_FAILED");return;}
+  try{
+   if(current!=grant){failure.compareAndSet(null,"OBSERVER_FAILED");return;}
+   if(operation==Operation.OUTBOUND_DETAIL)snapshot(data,true,context,observedAt,current);
+   else {JsonNode records=data.path("records");if(!records.isArray()||records.size()>100){failure.compareAndSet(null,"OBSERVER_FAILED");return;}
+    for(JsonNode row:records){if(failure.get()!=null)break;snapshot(row,false,context,observedAt,current);}}
+  }catch(RuntimeException bad){failure.compareAndSet(null,"OBSERVER_FAILED");}finally{intake.unlock();}
+ }
+ private void snapshot(JsonNode data,boolean detail,EgressContext c,Instant time,View g){
+  String warehouse=text(data,"whCode",64),owner=text(data,"customerCode",128),order=text(data,"deliveryNo",128);
+  if(!g.warehouseCodes().contains(warehouse)||!("*".equals(g.ownerCode())||g.ownerCode().equals(owner)))return;
+  if(observedRoot!=null&&!observedRoot.equals(c.rootTaskId()))return;
+  String key=key(c.rootTaskId(),warehouse,owner,order);
+  if(detail&&(!selected.contains(key)||details.contains(key)))return;
+  if(!detail&&(selected.contains(key)||selected.size()>=100))return;
+  JsonNode items=data.path(detail?"skuVOList":"productList");boolean complete=items.isArray()&&!items.isEmpty();
+  if(items.size()>200){failure.compareAndSet(null,"OBSERVER_FAILED");return;}
+  // Conservative UTF-8 bound: identifiers <=128 chars, quantity <=38 digits, bounded metadata.
+  int retained=4096+items.size()*1024;
+  if(queue.size()>=MAX_QUEUE||rows+items.size()>MAX_ROWS||bytes+retained>MAX_BYTES){failure.compareAndSet(null,"QUEUE_FULL");return;}
+  var quantities=new TreeMap<String,Sku>();
+  if(items.isArray())for(JsonNode item:items){String sku=text(item,"productSku",128);
+   Sku value=new Sku(sku,detail?null:quantity(item.get("qty")),detail?quantity(item.get("deliveryQty")):null,detail?quantity(item.get("actualDeliveryQty")):null);
+   quantities.merge(sku,value,(a,b)->new Sku(sku,sum(a.listQty(),b.listQty()),sum(a.forecastQty(),b.forecastQty()),sum(a.actualQty(),b.actualQty())));
+  }
+  String status=data.path("status").isIntegralNumber()?data.path("status").asText():null;
+  if(status!=null&&status.length()>32)throw new IllegalArgumentException();
+  Event event=new Event(g.diagnosticSessionId(),c.sourceAccount(),producer,c.rootTaskId(),c.sessionId(),detail?"OUTBOUND_DETAIL":"OUTBOUND_QUERY",warehouse,owner,order,detail?"DETAIL":"LIST",new Observation(status,optional(data,"outboundTime",64),time,c.attemptId(),complete),List.copyOf(quantities.values()));
+  queue.addLast(new Queued(event,retained,items.size()));bytes+=retained;rows+=items.size();
+  if(detail)details.add(key);else {selected.add(key);observedRoot=c.rootTaskId();}
+ }
+ /** Single worker owns HTTP; status(drained) occurs only after previously queued observations finish. */
+ void pump(){
+  if(closed||!config.enabled()||sink==null)return;
+  try{
+   if(grant==null||"TERMINAL".equals(grant.state())){
+    View next=sink.status(new Status(config.sourceAccount(),producer,!attached,false));attached=true;
+    if(next==null)return;
+    if(grant==null||!grant.diagnosticSessionId().equals(next.diagnosticSessionId()))reset(next);else grant=next;
+   }
+   if(grant==null||"TERMINAL".equals(grant.state()))return;
+   if(failure.get()!=null){grant=sink.stop(new Stop(grant.diagnosticSessionId(),config.sourceAccount(),producer,failure.get()));clearQueue();return;}
+   while(true){
+    if(failure.get()!=null)break;
+    Queued next=poll();if(next==null)break;
+    try{
+     if(!clock.instant().isBefore(grant.expiresAt())){failure.compareAndSet(null,"INCOMPLETE");break;}
+     Receipt receipt=sink.observe(next.event());if(receipt==null||receipt.session()==null)throw new IllegalStateException();
+     grant=receipt.session();
+     if("TERMINAL".equals(grant.state())){clearQueue();break;}
+    }finally{release(next);}
+   }
+   if(failure.get()!=null&&!"TERMINAL".equals(grant.state())){grant=sink.stop(new Stop(grant.diagnosticSessionId(),config.sourceAccount(),producer,failure.get()));clearQueue();return;}
+   if(!"TERMINAL".equals(grant.state())){
+    View next=sink.status(new Status(config.sourceAccount(),producer,false,false));if(next==null)throw new IllegalStateException();grant=next;
+    if("TERMINAL".equals(next.state()))clearQueue();
+    // After DRAINING is visible to intake, a later pump drains its tail before acknowledging.
+    if("DRAINING".equals(next.state())&&empty())grant=sink.status(new Status(config.sourceAccount(),producer,false,true));
+   }
+  }catch(Exception failed){failure.compareAndSet(null,"INCOMPLETE");}
+ }
+ private Queued poll(){intake.lock();try{return queue.pollFirst();}finally{intake.unlock();}}
+ private void release(Queued q){intake.lock();try{bytes-=q.bytes();rows-=q.rows();}finally{intake.unlock();}}
+ private boolean empty(){intake.lock();try{return queue.isEmpty();}finally{intake.unlock();}}
+ private void clearQueue(){intake.lock();try{for(Queued q:queue){bytes-=q.bytes();rows-=q.rows();}queue.clear();}finally{intake.unlock();}}
+ private void reset(View v){intake.lock();try{queue.clear();bytes=0;rows=0;selected.clear();details.clear();failure.set(null);observedRoot=v.rootTaskId();
+  for(Key k:v.selected()){String key=key(v.rootTaskId(),k.warehouseCode(),k.ownerCode(),k.orderNo());selected.add(key);if(k.paired())details.add(key);}grant=v;
+ }finally{intake.unlock();}}
+ private static String key(String root,String warehouse,String owner,String order){return root+"\u001f"+warehouse+"\u001f"+owner+"\u001f"+order;}
+ public String stopReason(){return failure.get()!=null?failure.get():grant==null?null:grant.stopReason();}
+ @PreDestroy public void close(){closed=true;worker.shutdownNow();clearQueue();}
+ private static String text(JsonNode n,String field,int max){String s=optional(n,field,max);if(s==null||s.isBlank())throw new IllegalArgumentException();return s;}
+ private static String optional(JsonNode n,String field,int max){JsonNode v=n.get(field);if(v==null||v.isNull())return null;if(!v.isTextual()||v.textValue().length()>max||v.textValue().codePoints().anyMatch(Character::isISOControl))throw new IllegalArgumentException();return v.textValue();}
+ private static BigDecimal quantity(JsonNode n){if(n==null||!n.isNumber())return null;BigDecimal value=n.decimalValue();return value.signum()<0||value.scale()>6||value.precision()-value.scale()>32?null:value.stripTrailingZeros();}
+ private static BigDecimal sum(BigDecimal a,BigDecimal b){return a==null||b==null?null:a.add(b);}
+ private record Queued(Event event,int bytes,int rows){}
+}
diff --git a/integration-service/src/main/java/com/baiyue/integration/provider/lingxing/LingxingQuantityEvidence.java b/integration-service/src/main/java/com/baiyue/integration/provider/lingxing/LingxingQuantityEvidence.java
new file mode 100644
index 000000000..4b3601e0d
--- /dev/null
+++ b/integration-service/src/main/java/com/baiyue/integration/provider/lingxing/LingxingQuantityEvidence.java
@@ -0,0 +1,17 @@
+package com.baiyue.integration.provider.lingxing;
+import java.math.BigDecimal;
+import java.time.Instant;
+import java.util.List;
+/** Internal diagnostic whitelist; excludes raw payloads, addresses and supplier credentials. */
+public final class LingxingQuantityEvidence {
+ private LingxingQuantityEvidence(){}
+ public record Status(String sourceAccount,String producerId,boolean attach,boolean drained){}
+ public record Stop(String diagnosticSessionId,String sourceAccount,String producerId,String reason){}
+ public record Observation(String status,String outboundTime,Instant observedAt,String attemptId,Boolean skuSetComplete){}
+ public record Sku(String sku,BigDecimal listQty,BigDecimal forecastQty,BigDecimal actualQty){}
+ public record Event(String diagnosticSessionId,String sourceAccount,String producerId,String rootTaskId,String collectionSessionId,String operation,String warehouseCode,String ownerCode,String orderNo,String side,Observation observation,List<Sku> skus){}
+ public record Key(String warehouseCode,String ownerCode,String orderNo,boolean paired){}
+ public record View(String diagnosticSessionId,String sourceAccount,String rootTaskId,String collectionSessionId,String state,String stopReason,Instant startsAt,Instant expiresAt,Instant bindBefore,List<String> warehouseCodes,String ownerCode,String excludedRootTaskId,int candidates,int pairedOrders,int retainedRows,long retainedBytes,boolean deliveryUncertain,List<Key> selected){}
+ public record Receipt(String outcome,String comparison,View session){}
+ public interface Sink {View status(Status request);Receipt observe(Event event);View stop(Stop request);}
+}
diff --git a/integration-service/src/main/java/com/baiyue/integration/provider/lingxing/LingxingQuantityHttpSink.java b/integration-service/src/main/java/com/baiyue/integration/provider/lingxing/LingxingQuantityHttpSink.java
new file mode 100644
index 000000000..897baff0e
--- /dev/null
+++ b/integration-service/src/main/java/com/baiyue/integration/provider/lingxing/LingxingQuantityHttpSink.java
@@ -0,0 +1,50 @@
+package com.baiyue.integration.provider.lingxing;
+import static com.baiyue.integration.provider.lingxing.LingxingQuantityEvidence.*;
+import com.baiyue.integration.config.LingxingEgressProperties;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.stereotype.Component;
+import java.net.URI;
+import java.net.http.*;
+import java.nio.charset.StandardCharsets;
+import java.time.Duration;
+
+/** Invoked only by the bounded observer worker. Never retries or contacts the supplier. */
+@Component
+public final class LingxingQuantityHttpSink implements Sink {
+ private static final String PATH="/internal/lastleg/self-operated-analytics/quantity-diagnostics/";
+ private final URI baseUri;private final ObjectMapper json;private final String token;
+ private final HttpClient client=HttpClient.newBuilder().connectTimeout(Duration.ofSeconds(2)).followRedirects(HttpClient.Redirect.NEVER).build();
+ public LingxingQuantityHttpSink(LingxingEgressProperties config,ObjectMapper json,@Value("${baiyue.security.internal-service-token:}") String token){this.baseUri=config.budgetAuthorityBaseUri();this.json=json.copy().disable(com.fasterxml.jackson.databind.SerializationFeature.WRITE_DATES_AS_TIMESTAMPS);this.token=token;}
+ public View status(Status request){return call("status",request,View.class);}
+ public Receipt observe(Event event){return call("observe",event,Receipt.class);}
+ public View stop(Stop request){return call("stop",request,View.class);}
+ private <T>T call(String path,Object payload,Class<T> type){
+  try{
+   if(baseUri==null||token==null||token.getBytes(StandardCharsets.UTF_8).length<32)throw unavailable();
+   byte[] body=json.writeValueAsBytes(payload);if(body.length>262144)throw unavailable();
+   HttpRequest request=HttpRequest.newBuilder(baseUri.resolve(PATH+path)).timeout(Duration.ofSeconds(3)).header("X-Internal-Service-Token",token).header("Content-Type","application/json; charset=UTF-8").POST(HttpRequest.BodyPublishers.ofByteArray(body)).build();
+   // Limit while receiving, not after allocating an arbitrary response String.
+   HttpResponse<byte[]> response=client.send(request,info->new LimitedBody(262144));
+   if(response.statusCode()!=200)throw unavailable();
+   var root=json.readTree(response.body());if(root==null||!"200".equals(root.path("code").asText()))throw unavailable();
+   if(root.path("data").isNull())return null;
+   return json.treeToValue(root.path("data"),type);
+  }catch(InterruptedException e){Thread.currentThread().interrupt();throw unavailable();}
+  catch(Exception e){throw unavailable();}
+ }
+ private static IllegalStateException unavailable(){return new IllegalStateException("DIAGNOSTIC_RECEIVER_UNAVAILABLE");}
+ static final class LimitedBody implements HttpResponse.BodySubscriber<byte[]> {
+  private final int limit;private final java.io.ByteArrayOutputStream out=new java.io.ByteArrayOutputStream();
+  private final java.util.concurrent.CompletableFuture<byte[]> result=new java.util.concurrent.CompletableFuture<>();
+  private java.util.concurrent.Flow.Subscription subscription;
+  LimitedBody(int limit){this.limit=limit;}
+  public java.util.concurrent.CompletionStage<byte[]> getBody(){return result;}
+  public void onSubscribe(java.util.concurrent.Flow.Subscription s){subscription=s;s.request(1);}
+  public void onNext(java.util.List<java.nio.ByteBuffer> buffers){
+   for(var buffer:buffers){if(buffer.remaining()>limit-out.size()){subscription.cancel();result.completeExceptionally(unavailable());return;}byte[] bytes=new byte[buffer.remaining()];buffer.get(bytes);out.writeBytes(bytes);}subscription.request(1);
+  }
+  public void onError(Throwable error){result.completeExceptionally(error);}
+  public void onComplete(){result.complete(out.toByteArray());}
+ }
+}
diff --git a/integration-service/src/main/java/com/baiyue/integration/provider/lingxing/LingxingWmsClient.java b/integration-service/src/main/java/com/baiyue/integration/provider/lingxing/LingxingWmsClient.java
new file mode 100644
index 000000000..e04c31ed7
--- /dev/null
+++ b/integration-service/src/main/java/com/baiyue/integration/provider/lingxing/LingxingWmsClient.java
@@ -0,0 +1,507 @@
+package com.baiyue.integration.provider.lingxing;
+
+import com.baiyue.integration.config.LingxingWmsProperties;
+import com.baiyue.integration.dto.lingxing.LingxingWmsDtos.OrderSummary;
+import com.baiyue.integration.dto.lingxing.LingxingWmsDtos.PageResult;
+import com.baiyue.integration.dto.lingxing.LingxingWmsDtos.QueryRequest;
+import com.baiyue.integration.dto.lingxing.LingxingWmsDtos.*;
+import com.baiyue.integration.dto.lingxing.LingxingEgressDtos.*;
+import java.util.function.BiFunction;
+import java.security.MessageDigest;
+import java.util.HexFormat;
+import java.time.Instant;
+import java.time.ZonedDateTime;
+import java.math.BigDecimal;
+import java.util.HashSet;
+import java.util.function.Function;
+import com.fasterxml.jackson.core.JsonProcessingException;
+import com.fasterxml.jackson.databind.DeserializationFeature;
+import com.fasterxml.jackson.databind.JsonNode;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.fasterxml.jackson.databind.SerializationFeature;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.stereotype.Component;
+
+import java.io.IOException;
+import java.net.http.HttpClient;
+import java.net.http.HttpRequest;
+import java.net.http.HttpResponse;
+import java.net.http.HttpTimeoutException;
+import java.nio.charset.StandardCharsets;
+import java.time.Clock;
+import java.time.format.DateTimeFormatter;
+import java.time.temporal.ChronoUnit;
+import java.util.ArrayList;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+
+@Component
+public final class LingxingWmsClient {
+    private static final String PAGE_PATH = "/openapi/v2/order/delivery/page";
+    private static final Set<Integer> AUTH_ERROR_CODES = Set.of(11002, 11003, 11004, 11005, 11006, 11007, 11008, 11010, 31001);
+    private static final DateTimeFormatter SOURCE_TIME = DateTimeFormatter.ofPattern("yyyy-MM-dd HH:mm:ss");
+    private final LingxingWmsProperties properties;
+    private final ObjectMapper mapper;
+    private final LingxingWmsSigner signer;
+    private final HttpClient httpClient;
+    private final Clock clock;
+    private final LingxingEgressGate egressGate;
+    private LingxingQuantityCapture quantityCapture;
+
+    @Autowired
+    void setQuantityCapture(LingxingQuantityCapture quantityCapture) {
+        this.quantityCapture = quantityCapture;
+    }
+
+    @Autowired
+    public LingxingWmsClient(LingxingWmsProperties properties, ObjectMapper mapper, LingxingEgressGate egressGate) {
+        this(properties, mapper, Clock.systemUTC(), egressGate);
+    }
+
+    LingxingWmsClient(LingxingWmsProperties properties, ObjectMapper mapper, Clock clock, LingxingEgressGate egressGate) {
+        this.properties = properties;
+        this.mapper = mapper.copy().disable(SerializationFeature.ORDER_MAP_ENTRIES_BY_KEYS);
+        this.clock = clock;
+        this.egressGate = egressGate;
+        signer = new LingxingWmsSigner(this.mapper);
+        httpClient = HttpClient.newBuilder().connectTimeout(properties.connectTimeout())
+            .followRedirects(HttpClient.Redirect.NEVER).build();
+    }
+
+    public PageResult queryPage(QueryRequest request, EgressContext context) {
+        validate(request);
+        Map<String, Object> data = pagination(request.current(), request.size());
+        data.put("timeType", "outboundTime");
+        data.put("startTime", SOURCE_TIME.format(request.startTime()));
+        data.put("endTime", SOURCE_TIME.format(request.endTime()));
+        data.put("status", 100);
+        return execute(PAGE_PATH, data, context, Operation.OUTBOUND_QUERY,
+            (json, metadata) -> orders(json, request.current(), request.size(), null, metadata));
+    }
+
+    public PageResult locate(LocateRequest request, EgressContext context) {
+        if (request == null) throw badRequest();
+        requireInput(request.deliveryNo(), 128);
+        validatePagination(request.current(), request.size(), 1000);
+        Map<String, Object> data = pagination(request.current(), request.size());
+        data.put("deliveryNo", request.deliveryNo());
+        return execute(PAGE_PATH, data, context, Operation.OUTBOUND_LOCATE,
+            (json, metadata) -> orders(json, request.current(), request.size(), request.deliveryNo(), metadata));
+    }
+
+    public QueryPage<Warehouse> queryWarehouses(WarehouseQueryRequest request, EgressContext context) {
+        if (request == null) throw badRequest();
+        validatePagination(request.current(), request.size(), 1000);
+        return execute("/openapi/v2/warehouse/page", pagination(request.current(), request.size()), context, Operation.WAREHOUSES,
+            (data, metadata) -> mappedPage(data, request.current(), request.size(), "page", "pageSize", false, metadata, row ->
+            new Warehouse(requiredText(row, "whCode", 64), optionalText(row, "whNameCn"),
+                requiredInt(row.get("warehouseType"), "WAREHOUSE_TYPE"), requiredInt(row.get("status"), "STATUS"),
+                optionalText(row, "timeZone"))));
+    }
+
+    public OrderDetail queryDetail(DetailRequest request, EgressContext context) {
+        if (request == null) throw badRequest();
+        requireInput(request.warehouseCode(), 64);
+        requireInput(request.customerCode(), 64);
+        requireInput(request.deliveryNo(), 128);
+        Map<String, Object> body = new LinkedHashMap<>();
+        body.put("whCode", request.warehouseCode());
+        body.put("customerCode", request.customerCode());
+        body.put("deliveryNo", request.deliveryNo());
+        return execute("/openapi/v2/order/delivery/detail", body, context, Operation.OUTBOUND_DETAIL,
+            (data, metadata) -> detail(data, request, metadata));
+    }
+
+    private OrderDetail detail(JsonNode data, DetailRequest request, AttemptMetadata metadata) {
+        String deliveryNo = requiredText(data, "deliveryNo", 128);
+        String customer = requiredText(data, "customerCode", 64);
+        String warehouse = requiredText(data, "whCode", 64);
+        if (!deliveryNo.equals(request.deliveryNo()) || !customer.equals(request.customerCode())
+            || !warehouse.equals(request.warehouseCode())) throw invalidResponse("DETAIL_IDENTITY_MISMATCH", 200);
+        JsonNode rows = data.get("skuVOList");
+        if (rows == null || !rows.isArray() || rows.isEmpty()) throw invalidResponse("SKU_LIST_INVALID", 200);
+        List<SkuLine> lines = new ArrayList<>();
+        for (JsonNode row : rows) {
+            if (!row.isObject()) throw invalidResponse("SKU_ROW_INVALID", 200);
+            lines.add(new SkuLine(requiredText(row, "productSku", 128), optionalText(row, "productName"),
+                quantity(row.get("actualDeliveryQty")), quantity(row.get("deliveryQty"))));
+        }
+        return new OrderDetail(deliveryNo, optionalText(data, "sourceNo"), customer, warehouse,
+            requiredInt(data.get("status"), "STATUS"), optionalText(data, "orderCreateTime"),
+            optionalText(data, "outboundTime"), lines, 200, clock.instant(), metadata);
+    }
+
+    public QueryPage<Customer> queryCustomers(WarehouseQueryRequest request, EgressContext context) {
+        if (request == null) throw badRequest();
+        validatePagination(request.current(), request.size(), 1000);
+        return execute("/openapi/v2/customer/list", pagination(request.current(), request.size()), context, Operation.CUSTOMERS,
+            (data, metadata) -> mappedPage(data, request.current(), request.size(), "page", "pageSize", false, metadata,
+                row -> new Customer(requiredText(row,"customerCode",64), optionalText(row,"customerName"), optionalText(row,"status"))));
+    }
+
+    public QueryPage<Product> queryProducts(ProductQueryRequest request, EgressContext context) {
+        if (request == null) throw badRequest();
+        validatePagination(request.current(), request.size(), 100);
+        return execute("/openapi/v2/product/page", pagination(request.current(), request.size()), context, Operation.PRODUCTS,
+            (data, metadata) -> mappedPage(data, request.current(), request.size(), "page", "pageSize", false, metadata,
+                row -> new Product(requiredText(row,"customerCode",64), requiredText(row,"sku",128), optionalText(row,"productName"),
+                    quantity(row.get("length")),quantity(row.get("width")),quantity(row.get("height")),optionalText(row,"sizeUnit"),
+                    quantity(row.get("wmsLength")),quantity(row.get("wmsWidth")),quantity(row.get("wmsHeight")),optionalText(row,"wmsSizeUnit"))));
+    }
+
+    public QueryPage<ProductStock> queryInventory(InventoryQueryRequest request, EgressContext context) {
+        if (request == null) throw badRequest();
+        requireInput(request.warehouseCode(), 64);
+        validatePagination(request.current(), request.size(), 1000);
+        Map<String, Object> body = pagination(request.current(), request.size());
+        body.put("whCode", request.warehouseCode());
+        body.put("isHideInventory", 0);
+        return execute("/openapi/v2/stock/stockSku/page", body, context, Operation.PRODUCT_INVENTORY,
+            (data, metadata) -> inventory(data, request, metadata));
+    }
+
+    /** Single bounded diagnostic page; never changes the current-inventory collection protocol. */
+    public QueryPage<InventoryFlow> queryInventoryFlow(InventoryFlowRequest request, EgressContext context) {
+        if(request==null)throw badRequest();
+        requireInput(request.warehouseCode(),64);requireInput(request.customerCode(),64);requireInput(request.sku(),128);
+        if(request.startTime()==null||request.endTime()==null||!request.startTime().isBefore(request.endTime())
+            ||request.endTime().isAfter(request.startTime().plusDays(31)))throw badRequest();
+        Map<String,Object> body=pagination(1,1000);
+        body.put("whCode",request.warehouseCode());body.put("customerCode",request.customerCode());
+        body.put("barcodeAccurate",request.sku());body.put("startTime",SOURCE_TIME.format(request.startTime()));
+        body.put("endTime",SOURCE_TIME.format(request.endTime()));body.put("sortName","createTime");body.put("sortOrder","asc");
+        return execute("/openapi/v2/stock/stockCellBook/page",body,context,Operation.INVENTORY_FLOW,
+            (data,metadata)->mappedPage(data,1,1000,"current","size",true,metadata,row->{
+                if(!request.warehouseCode().equals(requiredText(row,"whCode",64))
+                    ||!request.customerCode().equals(requiredText(row,"customerCode",64))
+                    ||!request.sku().equals(requiredText(row,"productSku",128)))throw invalidResponse("FLOW_IDENTITY_MISMATCH",200);
+                String id=requiredText(row,"id",64);
+                return new InventoryFlow(id,request.customerCode(),request.warehouseCode(),request.sku(),
+                    optionalText(row,"cellNo"),optionalText(row,"innerBatchNo"),optionalText(row,"billNo"),optionalText(row,"billType"),
+                    requiredInt(row.get("productQuality"),"PRODUCT_QUALITY"),quantity(row.get("bookQty")),
+                    optionalText(row,"bookChangQty"),quantity(row.get("closeQty")),optionalText(row,"createTime"),optionalText(row,"sourceNo"));
+            }));
+    }
+
+    /** One fixed warehouse interval page. Scheduling and coverage belong to Lastleg. */
+    public QueryPage<InventoryFlow> queryInventoryFlowPage(InventoryFlowPageRequest request,EgressContext context) {
+        if(request==null) throw badRequest();
+        requireInput(request.warehouseCode(),64);validatePagination(request.current(),request.size(),1000);
+        if(request.startTime()==null || request.endTime()==null || !request.startTime().isBefore(request.endTime())
+            || request.endTime().isAfter(request.startTime().plusDays(1))) throw badRequest();
+        Map<String,Object> body=pagination(request.current(),request.size());
+        body.put("whCode",request.warehouseCode());body.put("startTime",SOURCE_TIME.format(request.startTime()));
+        body.put("endTime",SOURCE_TIME.format(request.endTime()));body.put("sortName","createTime");body.put("sortOrder","asc");
+        return execute("/openapi/v2/stock/stockCellBook/page",body,context,Operation.INVENTORY_FLOW,
+            (data,metadata)->mappedPage(data,request.current(),request.size(),"current","size",true,metadata,row->{
+                String warehouse=requiredText(row,"whCode",64);
+                if(!request.warehouseCode().equals(warehouse)) throw invalidResponse("FLOW_IDENTITY_MISMATCH",200);
+                return new InventoryFlow(requiredText(row,"id",64),requiredText(row,"customerCode",64),warehouse,
+                    requiredText(row,"productSku",128),optionalText(row,"cellNo"),optionalText(row,"innerBatchNo"),
+                    optionalText(row,"billNo"),optionalText(row,"billType"),requiredInt(row.get("productQuality"),"PRODUCT_QUALITY"),
+                    quantity(row.get("bookQty")),optionalText(row,"bookChangQty"),quantity(row.get("closeQty")),optionalText(row,"createTime"),optionalText(row,"sourceNo"));
+            }));
+    }
+
+    private QueryPage<ProductStock> inventory(JsonNode data, InventoryQueryRequest request, AttemptMetadata metadata) {
+        Set<List<Object>> keys = new HashSet<>();
+        return mappedPage(data, request.current(), request.size(), "current", "size", false, metadata, row -> {
+            String customer = requiredText(row, "customerCode", 64);
+            String warehouse = requiredText(row, "whCode", 64);
+            String sku = requiredText(row, "productSku", 128);
+            int quality = requiredInt(row.get("productQuality"), "PRODUCT_QUALITY");
+            if (!warehouse.equals(request.warehouseCode())) throw invalidResponse("INVENTORY_WAREHOUSE_MISMATCH", 200);
+            if (!keys.add(List.of(customer, warehouse, sku, quality))) throw invalidResponse("DUPLICATE_INVENTORY_KEY", 200);
+            return new ProductStock(customer, warehouse, sku, optionalText(row, "productName"), quality,
+                quantity(row.get("stkQty")), quantity(row.get("freezeQty")), quantity(row.get("useStkQty")),
+                quantity(row.get("transitQty")), optionalText(row, "innerBatchNo"), optionalText(row, "outBatchNo"),
+                optionalText(row, "uniqueKey4tenant"));
+        });
+    }
+
+    private <T> T execute(String path, Map<String, Object> data, EgressContext context, Operation operation,
+                          BiFunction<JsonNode, AttemptMetadata, T> projection) {
+        if (!properties.enabled()) throw failure("DISABLED", "领星 WMS 接入未启用", false);
+        if (!properties.hasCredentials()) throw failure("MISSING_CREDENTIALS", "领星 WMS 授权配置不完整", false);
+        if (context != null && context.executionPurpose() == CollectionMode.VALIDATION
+            && data.containsKey("size") && (int)data.get("size") > 10) throw badRequest();
+        String hash;
+        try {
+            hash = HexFormat.of().formatHex(MessageDigest.getInstance("SHA-256").digest(
+                (path + "\n" + mapper.writer().without(SerializationFeature.INDENT_OUTPUT,
+                    SerializationFeature.WRAP_ROOT_VALUE).writeValueAsString(data)).getBytes(StandardCharsets.UTF_8)));
+        } catch (Exception ignored) { throw failure("REQUEST_HASH_FAILED", "领星请求授权摘要生成失败", false); }
+        return egressGate.execute(context, operation, hash, handle -> {
+            var signed = signer.sign(properties.appKey(), properties.appSecret(), path, data, clock.instant());
+            HttpRequest httpRequest = HttpRequest.newBuilder(properties.baseUri().resolve(path))
+                .timeout(properties.requestTimeout()).header("Accept", "application/json")
+                .header("Content-Type", "application/json; charset=UTF-8")
+                .POST(HttpRequest.BodyPublishers.ofString(signed.body(), StandardCharsets.UTF_8)).build();
+            handle.startHttp();
+            HttpResponse<String> response = send(httpRequest);
+            if (response.statusCode() == 429) handle.rateLimited(retryAfter(response));
+            validateStatus(response.statusCode());
+            JsonNode json;
+            try { json = envelope(response.body()); }
+            catch (LingxingWmsException error) {
+                // This optional endpoint may lack permission while ordinary collection remains authorized.
+                if(operation==Operation.INVENTORY_FLOW&&Integer.valueOf(11008).equals(error.sourceCode()))
+                    throw upstreamFailure("FLOW_PERMISSION_DENIED","当前账号没有库存流水接口权限",false,200,11008);
+                if (Integer.valueOf(31001).equals(error.sourceCode()) || Integer.valueOf(429).equals(error.sourceCode())) {
+                    handle.rateLimited(retryAfter(response));
+                }
+                throw error;
+            }
+            T result = projection.apply(json, handle.metadata());
+            if (quantityCapture != null && (operation == Operation.OUTBOUND_QUERY
+                || operation == Operation.OUTBOUND_DETAIL)) {
+                // Diagnostics must never alter the normal projection or the egress completion result.
+                try { quantityCapture.observe(json, operation, context, clock.instant()); }
+                catch (RuntimeException ignored) { /* Passive diagnostic failure is isolated. */ }
+            }
+            return result;
+        });
+    }
+
+    private Instant retryAfter(HttpResponse<?> response) {
+        String value = response.headers().firstValue("Retry-After").orElse(null);
+        if (value == null || value.length() > 128) return null;
+        try {
+            if (value.matches("[0-9]{1,9}")) return clock.instant().plusSeconds(Long.parseLong(value));
+            Instant time = ZonedDateTime.parse(value, DateTimeFormatter.RFC_1123_DATE_TIME).toInstant();
+            return time.isAfter(clock.instant()) ? time : null;
+        } catch (RuntimeException ignored) { return null; }
+    }
+
+    private static Map<String, Object> pagination(int current, int size) {
+        Map<String, Object> data = new LinkedHashMap<>();
+        data.put("current", current);
+        data.put("size", size);
+        return data;
+    }
+
+    private static void validatePagination(int current, int size, int maximum) {
+        if (current < 1 || size < 1 || size > maximum) throw badRequest();
+    }
+
+    private static void requireInput(String value, int maximum) {
+        if (value == null || value.isBlank() || value.length() > maximum) throw badRequest();
+    }
+
+    private static LingxingWmsException badRequest() {
+        return failure("INVALID_REQUEST", "领星 WMS 查询参数不符合内部契约", false);
+    }
+
+    private void validate(QueryRequest request) {
+        if (request == null || request.startTime() == null || request.endTime() == null
+            || !request.startTime().truncatedTo(ChronoUnit.SECONDS).isBefore(request.endTime().truncatedTo(ChronoUnit.SECONDS))
+            || request.startTime().isBefore(request.endTime().minusMonths(1))
+            || request.current() < 1 || request.size() < 1 || request.size() > 100) {
+            // These are local request bounds, not a claim about the supplier's pagination limits.
+            throw failure("INVALID_REQUEST", "领星 WMS 查询范围最多一个自然月，每页条数须为 1 至 100", false);
+        }
+    }
+
+
+    private HttpResponse<String> send(HttpRequest request) {
+        try {
+            return httpClient.send(request, HttpResponse.BodyHandlers.ofString(StandardCharsets.UTF_8));
+        } catch (HttpTimeoutException exception) {
+            throw failure("TIMEOUT", "领星 WMS 请求超时", true);
+        } catch (InterruptedException exception) {
+            Thread.currentThread().interrupt();
+            throw failure("INTERRUPTED", "领星 WMS 请求被中断", true);
+        } catch (IOException exception) {
+            throw failure("IO_FAILED", "领星 WMS 网络请求失败", true);
+        }
+    }
+
+    private void validateStatus(int status) {
+        if (status == 429) throw upstreamFailure("HTTP_RATE_LIMITED", "领星 WMS 请求受到限流，账号已暂停", false, status, null);
+        if (status == 401 || status == 403) {
+            throw upstreamFailure("AUTHORIZATION_REJECTED", "领星 WMS 拒绝授权，请核对凭据与账号权限", false, status, null);
+        }
+        if (status != 200) {
+            throw upstreamFailure("HTTP_FAILED", "领星 WMS 返回异常 HTTP 状态", status >= 500, status, null);
+        }
+    }
+
+    private JsonNode envelope(String body) {
+        JsonNode root;
+        try {
+            root = mapper.reader().with(DeserializationFeature.FAIL_ON_TRAILING_TOKENS,
+                DeserializationFeature.USE_BIG_DECIMAL_FOR_FLOATS).readTree(body);
+        } catch (JsonProcessingException exception) {
+            throw invalidResponse("JSON", null);
+        }
+        if (root == null || !root.isObject()) throw invalidResponse("ROOT_TYPE_" + nodeType(root), null);
+        JsonNode sourceCode = root.get("code");
+        // Official OMP ErrorResponse is distinct from its integer-code business response.
+        if (sourceCode != null && sourceCode.isTextual()) {
+            Integer errorCode = diagnosticCode(sourceCode);
+            if (errorCode != null && AUTH_ERROR_CODES.contains(errorCode)) throw sourceRejected(errorCode);
+            throw invalidResponse("CODE_TYPE_STRING", errorCode);
+        }
+        if (sourceCode == null || !sourceCode.isIntegralNumber() || !sourceCode.canConvertToInt()) {
+            throw invalidResponse("CODE_TYPE_" + nodeType(sourceCode), diagnosticCode(sourceCode));
+        }
+        if (sourceCode.intValue() != 200) {
+            throw sourceRejected(sourceCode.intValue());
+        }
+        JsonNode success = root.get("success");
+        // OMP marks success required, but the verified WMS response omits it; validate it when present.
+        if (success != null) {
+            if (!success.isBoolean()) throw invalidResponse("SUCCESS_TYPE_" + nodeType(success), 200);
+            if (!success.booleanValue()) throw sourceRejected(200);
+        }
+        JsonNode data = root.get("data");
+        if (data == null || !data.isObject()) throw invalidResponse("DATA_TYPE_" + nodeType(data), 200);
+        return data;
+    }
+
+    private PageResult orders(JsonNode data, int current, int size, String exactDeliveryNo, AttemptMetadata metadata) {
+        QueryPage<OrderSummary> page = mappedPage(data, current, size, "current", "size", size == 100, metadata, record -> {
+            String deliveryNo = requiredText(record, "deliveryNo", 128);
+            if (exactDeliveryNo != null && !exactDeliveryNo.equals(deliveryNo)) throw invalidResponse("LOCATE_DELIVERY_NO_MISMATCH", 200);
+            int status = requiredInt(record.get("status"), "STATUS");
+            if (exactDeliveryNo == null && status != 100) throw invalidResponse("DISCOVERY_STATUS_MISMATCH", 200);
+            return new OrderSummary(deliveryNo, optionalText(record, "sourceNo"), requiredText(record, "customerCode", 64),
+                requiredText(record, "whCode", 64), status, optionalText(record, "createTime"), optionalText(record, "outboundTime"), listSkus(record.get("productList")));
+        });
+        return new PageResult(page.records(), page.total(), current, size, page.pages(), page.sourceCurrent(),
+            page.sourceSize(), 200, page.observedAt(), metadata);
+    }
+
+    private List<ListSku> listSkus(JsonNode products) {
+        if (products == null || products.isNull()) return null;
+        if (!products.isArray()) throw invalidResponse("PRODUCT_LIST_TYPE_INVALID", 200);
+        List<ListSku> items = new ArrayList<>();
+        for (JsonNode item : products) {
+            if (!item.isObject()) throw invalidResponse("PRODUCT_LIST_ROW_INVALID", 200);
+            items.add(new ListSku(optionalText(item, "productSku"), optionalText(item, "productName"), quantity(item.get("qty"))));
+        }
+        return List.copyOf(items);
+    }
+
+    private <T> QueryPage<T> mappedPage(JsonNode data, int current, int size, String currentField,
+                                        String sizeField, boolean allowEmptyDefaultSize, AttemptMetadata metadata, Function<JsonNode, T> projection) {
+        JsonNode records = data.get("records");
+        if (records == null || !records.isArray()) throw invalidResponse("RECORDS_TYPE_" + nodeType(records), 200);
+        if (records.size() > size) throw invalidResponse("RECORDS_OVER_PAGE_SIZE", 200);
+        Long total = optionalTotal(data.get("total"));
+        if (total == null) throw invalidResponse("TOTAL_MISSING", 200);
+        int sourceCurrent = requiredInt(data.get(currentField), "CURRENT");
+        int sourceSize = requiredInt(data.get(sizeField), "SIZE");
+        int pages = requiredInt(data.get("pages"), "PAGES");
+        if (sourceCurrent != current) throw invalidResponse("CURRENT_MISMATCH", 200);
+        // Verified for outbound size 100 and the bounded inventory-flow query only.
+        boolean emptyException = allowEmptyDefaultSize && current == 1 && sourceCurrent == 1
+            && sourceSize == 10 && total == 0 && pages == 0 && records.isEmpty();
+        if (sourceSize != size && !emptyException) throw invalidResponse("SIZE_MISMATCH", 200);
+        long expectedPages = total / size + (total % size == 0 ? 0 : 1);
+        if (pages < 0 || pages != expectedPages || (total == 0 && current != 1)
+            || (total > 0 && current > pages)) throw invalidResponse("PAGES_MISMATCH", 200);
+        long expectedRows = total == 0 ? 0 : Math.min(size, total - (long)(current - 1) * size);
+        if (records.size() != expectedRows) throw invalidResponse("PAGE_ROW_COUNT_MISMATCH", 200);
+        List<T> summaries = new ArrayList<>();
+        for (JsonNode record : records) {
+            if (!record.isObject()) throw invalidResponse("ROW_TYPE_" + nodeType(record), 200);
+            summaries.add(projection.apply(record));
+        }
+        return new QueryPage<>(summaries, total, current, size, pages, sourceCurrent, sourceSize, 200, clock.instant(), metadata);
+    }
+
+    private static String requiredText(JsonNode row, String field, int maximum) {
+        String text = optionalText(row, field);
+        if (text == null || text.isBlank() || text.length() > maximum) throw invalidResponse("IDENTITY_INVALID", 200);
+        return text;
+    }
+
+    private static int requiredInt(JsonNode value, String stage) {
+        if (value == null || !value.isIntegralNumber() || !value.canConvertToInt()) throw invalidResponse(stage + "_TYPE_" + nodeType(value), 200);
+        return value.intValue();
+    }
+
+    private static BigDecimal quantity(JsonNode value) {
+        if (missingNumber(value)) return null;
+        if (value.isNumber()) return value.decimalValue();
+        // Nonempty malformed quantities are a contract failure, never invented zero.
+        throw invalidResponse("QUANTITY_TYPE_" + nodeType(value), 200);
+    }
+
+    private static String optionalText(JsonNode record, String field) {
+        JsonNode value = record.get(field);
+        if (value == null || value.isNull()) return null;
+        if (!value.isTextual()) {
+            String stage = switch (field) {
+                case "deliveryNo" -> "DELIVERY_NO";
+                case "sourceNo" -> "SOURCE_NO";
+                case "customerCode" -> "CUSTOMER_CODE";
+                case "whCode" -> "WAREHOUSE_CODE";
+                case "createTime" -> "CREATE_TIME";
+                case "outboundTime" -> "OUTBOUND_TIME";
+                default -> "TEXT_FIELD";
+            };
+            throw invalidResponse(stage + "_TYPE_" + nodeType(value), 200);
+        }
+        return value.textValue();
+    }
+
+    private static Long optionalTotal(JsonNode value) {
+        if (missingNumber(value)) return null;
+        if (!value.isIntegralNumber() || !value.canConvertToLong()) {
+            throw invalidResponse("TOTAL_TYPE_" + nodeType(value), 200);
+        }
+        if (value.longValue() < 0) throw invalidResponse("TOTAL_NEGATIVE", 200);
+        return value.longValue();
+    }
+
+    private static Integer diagnosticCode(JsonNode value) {
+        if (value == null) return null;
+        if (value.isIntegralNumber() && value.canConvertToInt()) return value.intValue();
+        // Only the documented authentication error envelope accepts string error codes.
+        if (!value.isTextual() || !value.textValue().matches("[0-9]{1,10}")) return null;
+        try {
+            return Integer.valueOf(value.textValue());
+        } catch (NumberFormatException exception) {
+            return null;
+        }
+    }
+
+    private static String nodeType(JsonNode value) {
+        return value == null ? "MISSING" : value.getNodeType().name();
+    }
+
+    private static boolean missingNumber(JsonNode value) {
+        // OMP explicitly serializes null numeric fields as an empty string or null.
+        return value == null || value.isNull() || (value.isTextual() && value.textValue().isEmpty());
+    }
+
+    private static LingxingWmsException sourceRejected(int code) {
+        if (code == 31001 || code == 429) return upstreamFailure("SOURCE_RATE_LIMITED", "领星 WMS 来源限流，账号已暂停", false, 200, code);
+        if (code == 11008) {
+            return upstreamFailure("AUTHORIZATION_REJECTED",
+                "领星 WMS 未授予查询接口权限，请核对管理后台自研系统授权", false, 200, code);
+        }
+        if (code == 11006) {
+            return upstreamFailure("SIGNATURE_REJECTED", "领星 WMS 请求验签未通过", false, 200, code);
+        }
+        return upstreamFailure("SOURCE_REJECTED", "领星 WMS 业务请求失败，请核对来源错误码", false, 200, code);
+    }
+
+    private static LingxingWmsException invalidResponse(String stage, Integer sourceCode) {
+        return upstreamFailure("INVALID_RESPONSE", "领星 WMS 返回内容不符合接口契约（" + stage + "）",
+            false, 200, sourceCode);
+    }
+
+    private static LingxingWmsException failure(String code, String message, boolean retryable) {
+        return upstreamFailure(code, message, retryable, null, null);
+    }
+
+    private static LingxingWmsException upstreamFailure(String code, String message, boolean retryable,
+                                                        Integer status, Integer sourceCode) {
+        return new LingxingWmsException("LINGXING_WMS_" + code, message, retryable, status, sourceCode);
+    }
+}
diff --git a/integration-service/src/main/java/com/baiyue/integration/provider/lingxing/LingxingWmsException.java b/integration-service/src/main/java/com/baiyue/integration/provider/lingxing/LingxingWmsException.java
new file mode 100644
index 000000000..0131730b1
--- /dev/null
+++ b/integration-service/src/main/java/com/baiyue/integration/provider/lingxing/LingxingWmsException.java
@@ -0,0 +1,32 @@
+package com.baiyue.integration.provider.lingxing;
+import com.baiyue.integration.dto.lingxing.LingxingEgressDtos.AttemptMetadata;
+import com.baiyue.integration.dto.lingxing.LingxingEgressDtos.AuthorizationDenial;
+
+/** Only fixed messages and numeric upstream metadata may leave the adapter. */
+public final class LingxingWmsException extends RuntimeException {
+    private final String code;
+    private final boolean retryable;
+    private final Integer upstreamStatus;
+    private final Integer sourceCode;
+    private AttemptMetadata egress;
+    private AuthorizationDenial denial;
+
+    public LingxingWmsException(String code, String message, boolean retryable,
+                                Integer upstreamStatus, Integer sourceCode) {
+        // Upstream exceptions can contain signed URLs or response fragments; never attach them.
+        super(message);
+        this.code = code;
+        this.retryable = retryable;
+        this.upstreamStatus = upstreamStatus;
+        this.sourceCode = sourceCode;
+    }
+
+    public String code() { return code; }
+    public boolean retryable() { return retryable; }
+    public Integer upstreamStatus() { return upstreamStatus; }
+    public Integer sourceCode() { return sourceCode; }
+    public AttemptMetadata egress() { return egress; }
+    public LingxingWmsException withEgress(AttemptMetadata metadata) { this.egress = metadata; return this; }
+    public AuthorizationDenial denial() { return denial; }
+    public LingxingWmsException withDenial(AuthorizationDenial metadata) { this.denial = metadata; return this; }
+}
diff --git a/integration-service/src/main/java/com/baiyue/integration/provider/lingxing/LingxingWmsSigner.java b/integration-service/src/main/java/com/baiyue/integration/provider/lingxing/LingxingWmsSigner.java
new file mode 100644
index 000000000..7293fdf1e
--- /dev/null
+++ b/integration-service/src/main/java/com/baiyue/integration/provider/lingxing/LingxingWmsSigner.java
@@ -0,0 +1,74 @@
+package com.baiyue.integration.provider.lingxing;
+
+import com.fasterxml.jackson.core.JsonProcessingException;
+import com.fasterxml.jackson.databind.JsonNode;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.fasterxml.jackson.databind.ObjectWriter;
+import com.fasterxml.jackson.databind.SerializationFeature;
+import com.fasterxml.jackson.databind.node.ObjectNode;
+
+import javax.crypto.Mac;
+import javax.crypto.spec.SecretKeySpec;
+import java.nio.charset.StandardCharsets;
+import java.security.GeneralSecurityException;
+import java.time.Instant;
+import java.util.HexFormat;
+import java.util.Map;
+import java.util.StringJoiner;
+
+/** OMP service-provider signature; the data object keeps its transmitted insertion order. */
+public final class LingxingWmsSigner {
+    private final ObjectMapper mapper;
+    private final ObjectWriter writer;
+
+    public LingxingWmsSigner(ObjectMapper mapper) {
+        this.mapper = mapper;
+        writer = mapper.writer().without(SerializationFeature.INDENT_OUTPUT, SerializationFeature.WRAP_ROOT_VALUE);
+    }
+
+    public SignedRequest sign(String appKey, String appSecret, String path, Map<String, ?> data, Instant requestedAt) {
+        if (appKey == null || appKey.isBlank() || appSecret == null || appSecret.isBlank()
+            || path == null || !path.startsWith("/openapi/v2/") || path.contains("?")
+            || data == null || requestedAt == null) throw failure();
+        try {
+            JsonNode dataNode = mapper.valueToTree(data);
+            String timestamp = Long.toString(requestedAt.getEpochSecond());
+            // Official OMP sample uses Map/List string form, not JSON, and includes parameter names.
+            String input = appSecret + path + "appKey" + appKey + "data" + parameterValue(dataNode)
+                + "timestamp" + timestamp + appSecret;
+            Mac mac = Mac.getInstance("HmacSHA256");
+            mac.init(new SecretKeySpec(appSecret.getBytes(StandardCharsets.UTF_8), "HmacSHA256"));
+            String signature = HexFormat.of().formatHex(mac.doFinal(input.getBytes(StandardCharsets.UTF_8)));
+            ObjectNode body = mapper.createObjectNode();
+            body.put("appKey", appKey);
+            body.set("data", dataNode);
+            body.put("timestamp", timestamp);
+            body.put("sign", signature);
+            return new SignedRequest(writer.writeValueAsString(body));
+        } catch (JsonProcessingException | GeneralSecurityException | IllegalArgumentException exception) {
+            throw failure();
+        }
+    }
+
+    private static String parameterValue(JsonNode value) {
+        if (value.isObject()) {
+            StringJoiner rendered = new StringJoiner(", ", "{", "}");
+            value.fields().forEachRemaining(field -> rendered.add(field.getKey() + "=" + parameterValue(field.getValue())));
+            return rendered.toString();
+        }
+        if (value.isArray()) {
+            StringJoiner rendered = new StringJoiner(", ", "[", "]");
+            value.forEach(child -> rendered.add(parameterValue(child)));
+            return rendered.toString();
+        }
+        return value.isNull() ? "null" : value.asText();
+    }
+
+    private static LingxingWmsException failure() {
+        return new LingxingWmsException("LINGXING_WMS_SIGNATURE_ERROR", "领星 WMS 请求签名失败", false, null, null);
+    }
+
+    public record SignedRequest(String body) {
+        @Override public String toString() { return "SignedRequest[REDACTED]"; }
+    }
+}
diff --git a/integration-service/src/main/resources/application-lingxing-local.yml b/integration-service/src/main/resources/application-lingxing-local.yml
new file mode 100644
index 000000000..d216886d9
--- /dev/null
+++ b/integration-service/src/main/resources/application-lingxing-local.yml
@@ -0,0 +1,77 @@
+# Select explicitly with --spring.config.location=classpath:/application-lingxing-local.yml.
+# No remote imports, database, registry or scheduled jobs are used by this local instance.
+server:
+  address: 127.0.0.1
+  port: ${INTEGRATION_LOCAL_PORT:19210}
+
+spring:
+  application:
+    name: integration-service
+  autoconfigure:
+    exclude:
+      - org.springframework.boot.autoconfigure.jdbc.DataSourceAutoConfiguration
+      - com.baomidou.mybatisplus.autoconfigure.MybatisPlusAutoConfiguration
+  cloud:
+    bootstrap:
+      enabled: false
+    discovery:
+      enabled: false
+    service-registry:
+      auto-registration:
+        enabled: false
+    nacos:
+      config:
+        enabled: false
+        import-check:
+          enabled: false
+      discovery:
+        enabled: false
+        register-enabled: false
+
+baiyue:
+  runtime:
+    scheduling-enabled: false
+  security:
+    internal-service-token: ${INTERNAL_SERVICE_TOKEN:}
+  integration:
+    lingxing-wms:
+      enabled: ${LINGXING_WMS_ENABLED:false}
+      base-uri: https://api.xlwms.com
+      app-key: ${LINGXING_OMS_APP_KEY:}
+      app-secret: ${LINGXING_OMS_APP_SECRET:}
+      connect-timeout: 5s
+      request-timeout: 15s
+      egress:
+        collection-mode: ${LINGXING_COLLECTION_MODE:OFF}
+        environment-label: ${LINGXING_ENVIRONMENT_LABEL:test}
+        source-account: ${LINGXING_SOURCE_ACCOUNT:lingxing-primary}
+        external-exclusive-grant-id: ${LINGXING_EXTERNAL_EXCLUSIVE_GRANT_ID:}
+        budget-authority-base-uri: ${LINGXING_BUDGET_AUTHORITY_BASE_URI:http://lastleg-service:9303}
+        min-start-interval: 5s
+        cooldown-fallback: 5m
+        # Explicitly inject external-exclusive-until (ISO Instant) and budget-authority-base-uri.
+        # Missing proof/authority fails closed even when the old enabled switch is true.
+    baidu-ocr:
+      enabled: false
+    amazon-sp-api:
+      enabled: false
+    carrier-schedule:
+      matson:
+        enabled: false
+      hede:
+        enabled: false
+      sml:
+        enabled: false
+      zim:
+        enabled: false
+      evergreen:
+        enabled: false
+
+management:
+  endpoints:
+    web:
+      exposure:
+        include: health
+  endpoint:
+    health:
+      show-details: never
diff --git a/integration-service/src/main/resources/application.yml b/integration-service/src/main/resources/application.yml
index 7916af7b8..51fa8a5d3 100644
--- a/integration-service/src/main/resources/application.yml
+++ b/integration-service/src/main/resources/application.yml
@@ -35,6 +35,24 @@ baiyue:
   security:
     internal-service-token: ${INTERNAL_SERVICE_TOKEN:}
   integration:
+    lingxing-wms:
+      enabled: ${LINGXING_WMS_ENABLED:false}
+      base-uri: https://api.xlwms.com
+      app-key: ${LINGXING_OMS_APP_KEY:}
+      app-secret: ${LINGXING_OMS_APP_SECRET:}
+      connect-timeout: 5s
+      request-timeout: 15s
+      egress:
+        collection-mode: ${LINGXING_COLLECTION_MODE:OFF}
+        continuous-business-collection-enabled: ${LINGXING_CONTINUOUS_BUSINESS_COLLECTION_ENABLED:false}
+        environment-label: ${LINGXING_ENVIRONMENT_LABEL:test}
+        source-account: ${LINGXING_SOURCE_ACCOUNT:lingxing-primary}
+        external-exclusive-grant-id: ${LINGXING_EXTERNAL_EXCLUSIVE_GRANT_ID:}
+        budget-authority-base-uri: ${LINGXING_BUDGET_AUTHORITY_BASE_URI:http://lastleg-service:9303}
+        min-start-interval: 5s
+        cooldown-fallback: 5m
+        # Finite sessions require external-exclusive-until; continuous BUSINESS still requires the exclusive grant ID and authority.
+        # Missing proof/authority fails closed even when the old enabled switch is true.
     baidu-ocr:
       enabled: ${BAIDU_OCR_ENABLED:false}
       api-key: ${BAIDU_OCR_API_KEY:}
diff --git a/integration-service/src/main/resources/openapi/lingxing-wms-v1.yaml b/integration-service/src/main/resources/openapi/lingxing-wms-v1.yaml
new file mode 100644
index 000000000..a54b25396
--- /dev/null
+++ b/integration-service/src/main/resources/openapi/lingxing-wms-v1.yaml
@@ -0,0 +1,646 @@
+openapi: 3.0.3
+info:
+  title: Lingxing WMS Internal Read API
+  version: 1.0.0
+  description: >-
+    Single-page or single-order adapter. No scheduling, business persistence or public Gateway route.
+    Source times remain uninterpreted strings; warehouse timeZone does not certify source timezone.
+    Server-side collection mode defaults to OFF. VALIDATION requires an externally confirmed exclusive
+    account window; BUSINESS requires environmentLabel exactly production or test. TEST business task creation is restricted by Lastleg to controlled commands and their legitimate derived work; the adapter does not schedule work. Provider-query endpoints apply the same gate.
+    Missing exclusive proof, persistent account budget authorization or control context fails closed before egress.
+    At most one account request is in flight; request starts obey the bound minStartInterval (VALIDATION at least 5 seconds).
+    A JVM lock is only local protection and is not proof of cross-environment account exclusivity.
+    Each invocation performs at most one supplier HTTP attempt. No mode uses implicit HTTP retries;
+    429 is never retried, immediately pauses the account and returns persistent cooldown metadata.
+    VALIDATION page size must not exceed 10. Lastleg owns root/session budgets and cooldown persistence.
+    External server configuration supplies externalExclusiveGrantId and a VALIDATION externalExclusiveUntil;
+    the nonempty grant must match context.exclusiveGrantId. BUSINESS has no grant, session or root time cutoff;
+    explicit stops, persistent account protections and each short single-attempt permit remain enforced.
+    A BUSINESS rate-limit pause is recoverable after both the persistently returned
+    cooldown and the local minimum fallback cooldown have elapsed, and after the authority issues a new
+    strictly valid single-attempt permit confirming account budget, cooldown, stop limits and root state.
+    Time alone never permits egress. VALIDATION 429 does not automatically recover. Unavailable, lost
+    or malformed authorization and uncertain completion hold an unrecoverable local pause until
+    operations verify persistent account state. Completion failure never automatically recovers.
+    A well-formed explicit authorization denial is deterministic and does not cause a permanent pause.
+    sourceAccount defaults to lingxing-primary and budgetAuthorityBaseUri defaults internally to
+    http://lastleg-service:9303; neither default enables egress.
+x-lastleg-egress-coordination:
+  description: >-
+    Integration calls these Lastleg endpoints with X-Internal-Service-Token. These are dependencies,
+    not Integration Controller paths. Lastleg prepares attemptId server-side and binds context and operation
+    before authorization. authorize only consumes an already prepared attempt, first binds the opaque
+    requestHash and atomically consumes persistent account/root/session budget. Duplicate authorization
+    is refused; arbitrary client-created attempts are refused. complete verifies the same bindings.
+    A permit is bound to its full context, operation and requestHash, requires exclusiveConfirmed=true
+    and budgetConsumed=true, expires after now but no later than now plus 30 seconds (also within externalExclusiveUntil for VALIDATION),
+    and cannot be reused. Explicit denial uses HTTP 200 with ApiResponse code string B0001 and
+    AuthorizationDenial data. A valid denial is not an uncertain authorization and does not impose
+    a permanent local pause. Unavailable, lost or malformed authorization or an unconfirmed callback blocks further egress;
+    pending or ambiguous attempts remain conservatively consumed, including after restart.
+  authorize:
+    method: POST
+    path: /internal/lastleg/self-operated-analytics/egress/authorize
+    requestSchema: '#/components/schemas/AuthorizationRequest'
+    responseSchema: '#/components/schemas/AttemptPermitResponse'
+  complete:
+    method: POST
+    path: /internal/lastleg/self-operated-analytics/egress/complete
+    requestSchema: '#/components/schemas/CompletionRequest'
+    responseSchema: '#/components/schemas/CompletionResponse'
+security:
+  - InternalServiceToken: []
+paths:
+  /internal/integrations/lingxing/wms/inventory-flow-page/query:
+    post:
+      summary: One frozen warehouse inventory-flow page
+      description: >-
+        Shared INVENTORY_FLOW permit, one upstream request, no automatic retry. Fixed warehouse and
+        inclusive Beijing start/end bounds at most one day, current>=1, size 1..1000, sorted by createTime asc.
+        Customer/SKU filters are absent. Lastleg validates persisted task/page binding, page counts,
+        duplicate IDs and ordering before admitting coverage. Only quantity/identity whitelist fields return.
+        Empty first-page current=1,size=10,total=0,pages=0,records=[] is normalized to the requested size.
+      parameters:
+        - {$ref: '#/components/parameters/LingxingEgressContext'}
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              additionalProperties: false
+              required: [warehouseCode, startTime, endTime, current, size]
+              properties:
+                warehouseCode: {type: string, minLength: 1, maxLength: 64}
+                startTime: {type: string, format: date-time, description: Beijing local datetime without offset}
+                endTime: {type: string, format: date-time, description: Inclusive bound, at most one day after start}
+                current: {type: integer, minimum: 1}
+                size: {type: integer, minimum: 1, maximum: 1000}
+      responses:
+        '200':
+          description: Envelope of QueryPage with current/size/total/pages/records and source pagination evidence, or sanitized ProviderFailure. Rows retain string id, customerCode, whCode, productSku, cellNo, innerBatchNo, billNo, sourceNo, billType, productQuality, numeric bookQty/closeQty and string bookChangQty/createTime.
+  /internal/integrations/lingxing/wms/inventory-flow/query:
+    post:
+      summary: One SKU inventory-flow diagnostic page
+      description: >-
+        Calls stock/stockCellBook/page through the existing INVENTORY_FLOW permit. Exact warehouse/customer/SKU,
+        at most 31 days, current=1 and size=1000 fixed. No automatic next page or retry. Source quality and signed
+        quantities are preserved, not translated to inventory-snapshot quality. Source 11008 only rejects this optional
+        operation; authentication, rate-limit and uncertain-result account protection remain effective.
+        Source movement IDs must be strings. An empty first response with current=1, size=10, total=0,
+        pages=0 and records=[] is normalized to requested size=1000 while retaining sourceSize=10.
+        Other pagination mismatches remain errors.
+      parameters:
+        - {$ref: '#/components/parameters/LingxingEgressContext'}
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required: [warehouseCode, customerCode, sku, startTime, endTime]
+              properties:
+                warehouseCode: {type: string, maxLength: 64}
+                customerCode: {type: string, maxLength: 64}
+                sku: {type: string, maxLength: 128}
+                startTime: {type: string, format: date-time, description: Beijing local datetime without offset}
+                endTime: {type: string, format: date-time, description: Beijing local datetime without offset}
+      responses:
+        '200':
+          description: Standard envelope with QueryPage or sanitized ProviderFailure. Flow rows retain id as string, customerCode, whCode, productSku, cellNo, innerBatchNo, billNo, sourceNo, billType, productQuality, numeric bookQty/closeQty, string bookChangQty/createTime. Unknown source fields remain null; no calculated inventory is published.
+  /internal/integrations/lingxing/wms/customers/query:
+    post:
+      summary: Query one page of customers using the existing account egress permit
+      description: Calls /openapi/v2/customer/list. BUSINESS MASTER_DATA tasks only; no retries or separate egress path. Dimensions and units remain separate; blanks are null.
+      parameters:
+        - {$ref: '#/components/parameters/LingxingEgressContext'}
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema: {$ref: '#/components/schemas/WarehouseQueryRequest'}
+      responses:
+        '200':
+          description: Standard envelope with one page or sanitized ProviderFailure.
+          content:
+            application/json:
+              schema: {$ref: '#/components/schemas/CustomerResponse'}
+  /internal/integrations/lingxing/wms/products/query:
+    post:
+      summary: Query one page of products using the existing account egress permit
+      description: Calls /openapi/v2/product/page. BUSINESS MASTER_DATA tasks only; no retries or separate egress path. Dimensions and units remain separate; blanks are null.
+      parameters:
+        - {$ref: '#/components/parameters/LingxingEgressContext'}
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema: {$ref: '#/components/schemas/ProductQueryRequest'}
+      responses:
+        '200':
+          description: Standard envelope with one page or sanitized ProviderFailure.
+          content:
+            application/json:
+              schema: {$ref: '#/components/schemas/ProductResponse'}
+  /internal/integrations/lingxing/wms/egress/runtime:
+    get:
+      operationId: lingxingEgressRuntime
+      summary: Read sanitized configuration from the active egress gate
+      description: >-
+        Internal token authentication only. No provider, database, budget-authority, permit or persistence side effect.
+        Returns actual bound configuration, not a verified claim or a commit identity. Fingerprints use lowercase
+        SHA-256 of UTF-8 "selfop-runtime:v1:<domain>\n" plus the exact original nonblank value, without trimming.
+        Domains are source-account, grant and budget-authority. Missing/blank values yield null, never an empty-value hash.
+      security: [{InternalServiceToken: []}]
+      responses:
+        '200':
+          description: ApiResponse code 200 with runtime snapshot, or A0401 for missing/invalid internal token
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  code: {type: string}
+                  data: {$ref: '#/components/schemas/EgressRuntimeSnapshot'}
+  /internal/integrations/lingxing/wms/warehouses/query:
+    post:
+      summary: Query one page of normal warehouses
+      parameters:
+        - {$ref: '#/components/parameters/LingxingEgressContext'}
+      description: Calls /openapi/v2/warehouse/page without filters. Maps page/pageSize into current/size; preserves original metadata.
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema: {$ref: '#/components/schemas/WarehouseQueryRequest'}
+      responses:
+        '200':
+          description: Standard envelope with WarehousePage or sanitized ProviderFailure.
+          content:
+            application/json:
+              schema: {$ref: '#/components/schemas/WarehouseResponse'}
+  /internal/integrations/lingxing/wms/outbound-orders/query:
+    post:
+      summary: Query one page of completed outbound orders by source outbound time
+      parameters:
+        - {$ref: '#/components/parameters/LingxingEgressContext'}
+      description: Calls /openapi/v2/order/delivery/page with timeType=outboundTime and status=100. No external warehouse filter. At current=1,size=100 only, records=[],total=0,pages=0,sourceCurrent=1,sourceSize=10 is accepted and internal size remains 100. All other pagination metadata is strictly required. No completeness claim across pages.
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema: {$ref: '#/components/schemas/QueryRequest'}
+      responses:
+        '200':
+          description: Standard envelope with OrderPage or sanitized ProviderFailure.
+          content:
+            application/json:
+              schema: {$ref: '#/components/schemas/OrderResponse'}
+  /internal/integrations/lingxing/wms/outbound-orders/locate:
+    post:
+      summary: Locate one page by delivery number without time or status filters
+      parameters:
+        - {$ref: '#/components/parameters/LingxingEgressContext'}
+      description: Sends only current,size,deliveryNo to delivery/page. Every returned deliveryNo must match exactly. Caller reads all required pages and verifies original customer identity and uniqueness before accepting the current warehouse. Missing results do not prove cancellation.
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema: {$ref: '#/components/schemas/LocateRequest'}
+      responses:
+        '200':
+          description: Standard envelope with OrderPage or sanitized ProviderFailure.
+          content:
+            application/json:
+              schema: {$ref: '#/components/schemas/OrderResponse'}
+  /internal/integrations/lingxing/wms/outbound-orders/detail:
+    post:
+      summary: Read one order using warehouse, customer and delivery identifiers
+      parameters:
+        - {$ref: '#/components/parameters/LingxingEgressContext'}
+      description: Maps warehouseCode to whCode for delivery/detail. All three returned identifiers must match. Returns only skuVOList; packageList is never added to quantities. Duplicate SKU lines remain separate for caller normalization. Missing quantities remain null; no quantity unit is inferred.
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema: {$ref: '#/components/schemas/DetailRequest'}
+      responses:
+        '200':
+          description: Standard envelope with OrderDetail or sanitized ProviderFailure.
+          content:
+            application/json:
+              schema: {$ref: '#/components/schemas/DetailResponse'}
+  /internal/integrations/lingxing/wms/product-inventory/query:
+    post:
+      summary: Query one page of all qualities and customers in a required warehouse
+      parameters:
+        - {$ref: '#/components/parameters/LingxingEgressContext'}
+      description: Calls stock/stockSku/page with whCode and isHideInventory=0. No SKU, quality, customer or quantity filters. Warehouse mismatch and duplicate business keys within a page fail closed. Caller validates cross-page keys and counts. Unknown quantities stay null, negative quantities remain evidence, stockCompare is not accumulated.
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema: {$ref: '#/components/schemas/InventoryQueryRequest'}
+      responses:
+        '200':
+          description: Standard envelope with InventoryPage or sanitized ProviderFailure.
+          content:
+            application/json:
+              schema: {$ref: '#/components/schemas/InventoryResponse'}
+components:
+  parameters:
+    LingxingEgressContext:
+      name: X-Lingxing-Egress-Context
+      in: header
+      required: true
+      description: >-
+        JSON control context; no credentials. Maximum 2048 characters, all printable ASCII (32 through 126).
+        Unknown fields, duplicate fields and trailing JSON are rejected. Identifiers are strings supplied
+        by the server-side coordinator and do not confer authorization by themselves.
+      content:
+        application/json:
+          schema: {$ref: '#/components/schemas/EgressContext'}
+  securitySchemes:
+    InternalServiceToken:
+      type: apiKey
+      in: header
+      name: X-Internal-Service-Token
+  schemas:
+    CustomerPage:
+      allOf:
+        - {$ref: '#/components/schemas/Pagination'}
+        - type: object
+          required: [records]
+          properties:
+            records: {type: array, items: {$ref: '#/components/schemas/Customer'}}
+    CustomerResponse:
+      allOf:
+        - {$ref: '#/components/schemas/Envelope'}
+        - type: object
+          properties:
+            data:
+              nullable: true
+              oneOf:
+                - {$ref: '#/components/schemas/CustomerPage'}
+                - {$ref: '#/components/schemas/ProviderFailure'}
+    ProductPage:
+      allOf:
+        - {$ref: '#/components/schemas/Pagination'}
+        - type: object
+          required: [records]
+          properties:
+            records: {type: array, items: {$ref: '#/components/schemas/Product'}}
+    ProductResponse:
+      allOf:
+        - {$ref: '#/components/schemas/Envelope'}
+        - type: object
+          properties:
+            data:
+              nullable: true
+              oneOf:
+                - {$ref: '#/components/schemas/ProductPage'}
+                - {$ref: '#/components/schemas/ProviderFailure'}
+    ProductQueryRequest:
+      type: object
+      required: [current, size]
+      properties:
+        current: {type: integer, minimum: 1}
+        size: {type: integer, minimum: 1, maximum: 100}
+    Customer:
+      type: object
+      required: [customerCode]
+      properties:
+        customerCode: {type: string}
+        customerName: {type: string, nullable: true}
+        status: {type: string, nullable: true}
+    Product:
+      type: object
+      required: [customerCode, sku]
+      properties:
+        customerCode: {type: string}
+        sku: {type: string}
+        productName: {type: string, nullable: true}
+        length: {type: number, nullable: true}
+        width: {type: number, nullable: true}
+        height: {type: number, nullable: true}
+        wmsLength: {type: number, nullable: true}
+        wmsWidth: {type: number, nullable: true}
+        wmsHeight: {type: number, nullable: true}
+        sizeUnit: {type: string, nullable: true}
+        wmsSizeUnit: {type: string, nullable: true}
+    EgressRuntimeSnapshot:
+      type: object
+      additionalProperties: false
+      required: [schemaVersion, service, observedAt, mode, environment, continuousEnabled, grantPresent, intervalMs, permitMaxSeconds, providerEnabled]
+      properties:
+        schemaVersion: {type: integer, enum: [1]}
+        service: {type: string, enum: [integration]}
+        observedAt: {type: string, format: date-time}
+        mode: {type: string, enum: [OFF, VALIDATION, BUSINESS]}
+        environment: {type: string}
+        continuousEnabled: {type: boolean}
+        sourceAccountFingerprint: {type: string, nullable: true, pattern: '^[a-f0-9]{64}$'}
+        grantPresent: {type: boolean}
+        grantFingerprint: {type: string, nullable: true, pattern: '^[a-f0-9]{64}$'}
+        intervalMs:
+          oneOf: [{type: integer, format: int64}, {type: string, pattern: '^[0-9]+$'}]
+          description: Actual bound interval; shared long-value JSON serialization may encode it as a decimal string.
+        permitMaxSeconds: {type: integer, enum: [30]}
+        providerEnabled: {type: boolean}
+        budgetAuthorityFingerprint: {type: string, nullable: true, pattern: '^[a-f0-9]{64}$'}
+    EgressContext:
+      type: object
+      additionalProperties: false
+      required: [sourceAccount, executionPurpose, rootTaskId, sessionId, attemptId, exclusiveGrantId]
+      properties:
+        sourceAccount: {type: string, minLength: 1, maxLength: 64, pattern: '^[A-Za-z0-9][A-Za-z0-9._:-]*$', description: 'Server-configured account alias, never App Key or Secret.'}
+        executionPurpose: {type: string, enum: [VALIDATION, BUSINESS]}
+        rootTaskId: {type: string, minLength: 1, maxLength: 128, pattern: '^[A-Za-z0-9][A-Za-z0-9._:-]*$', description: Stable root control identifier; child tasks share root budget.}
+        sessionId: {type: string, minLength: 1, maxLength: 128, pattern: '^[A-Za-z0-9][A-Za-z0-9._:-]*$', description: Stable session control identifier; reopening or restart does not reset it.}
+        attemptId: {type: string, minLength: 1, maxLength: 128, pattern: '^[A-Za-z0-9][A-Za-z0-9._:-]*$', description: Prepared unique single-attempt control identifier; duplicate authorization is refused.}
+        exclusiveGrantId: {type: string, minLength: 1, maxLength: 128, pattern: '^[A-Za-z0-9][A-Za-z0-9._:-]*$', description: Must equal the valid externalExclusiveGrantId configured server-side.}
+    EgressRequestHash:
+      type: string
+      pattern: '^[0-9a-f]{64}$'
+      description: >-
+        Lowercase hexadecimal SHA256 of UTF-8 bytes of OMP path, one LF character and compact
+        insertion-ordered external business JSON. Lastleg treats this digest as opaque and binds
+        it on the first authorization of an already prepared attempt.
+      example: fa60a92c78b4803878930e5914e6db03591acc31b7c09abad53c91912fa3d627
+      x-preimage-example: |-
+        /openapi/v2/stock/stockSku/page
+        {"current":1,"size":2,"whCode":"WH-DEMO","isHideInventory":0}
+    EgressOperation:
+      type: string
+      enum: [WAREHOUSES, OUTBOUND_QUERY, OUTBOUND_LOCATE, OUTBOUND_DETAIL, PRODUCT_INVENTORY, CUSTOMERS, PRODUCTS, INVENTORY_FLOW]
+    EgressMetadata:
+      type: object
+      required: [attemptId, actualHttpAttempts, accountPaused]
+      properties:
+        attemptId: {type: string, nullable: true, description: Null only if no valid control context was accepted.}
+        actualHttpAttempts: {type: integer, minimum: 0, maximum: 1, description: 'Supplier HTTP attempts actually started, including failed calls; authorization callbacks do not count.'}
+        accountPaused: {type: boolean}
+        cooldownUntil: {type: string, format: date-time, nullable: true, description: Account cooldown deadline to persist; valid supplier retry time must not be shortened.}
+    AuthorizationRequest:
+      type: object
+      required: [context, operation, requestHash]
+      properties:
+        context: {$ref: '#/components/schemas/EgressContext'}
+        operation: {$ref: '#/components/schemas/EgressOperation'}
+        requestHash: {$ref: '#/components/schemas/EgressRequestHash'}
+    AuthorizationDenial:
+      type: object
+      required: [errorCode, sampleDone]
+      properties:
+        errorCode: {type: string, pattern: '^[A-Z][A-Z0-9_]{0,63}$'}
+        sampleDone: {type: boolean, description: Strict JSON boolean; validation budget normal completion is distinct from a failure.}
+        waitUntil: {type: string, format: date-time, nullable: true, description: Nullable ISO-8601 Instant from the persistent authority.}
+    AuthorizationDenialResponse:
+      allOf:
+        - {$ref: '#/components/schemas/Envelope'}
+        - type: object
+          properties:
+            code: {type: string, enum: [B0001]}
+            data: {$ref: '#/components/schemas/AuthorizationDenial'}
+    AttemptPermit:
+      type: object
+      required: [context, operation, requestHash, allowedAttempts, expiresAt, exclusiveConfirmed, budgetConsumed]
+      properties:
+        context: {$ref: '#/components/schemas/EgressContext'}
+        operation: {$ref: '#/components/schemas/EgressOperation'}
+        requestHash: {$ref: '#/components/schemas/EgressRequestHash'}
+        allowedAttempts: {type: integer, enum: [1]}
+        expiresAt: {type: string, format: date-time, description: Must be after now and no later than now plus 30 seconds and configured externalExclusiveUntil.}
+        exclusiveConfirmed: {type: boolean, enum: [true]}
+        budgetConsumed: {type: boolean, enum: [true], description: Lastleg has atomically consumed persistent account and root/session budget before returning this permit.}
+    CompletionRequest:
+      type: object
+      required: [context, operation, requestHash, actualHttpAttempts, accountPaused]
+      properties:
+        context: {$ref: '#/components/schemas/EgressContext'}
+        operation: {$ref: '#/components/schemas/EgressOperation'}
+        requestHash: {$ref: '#/components/schemas/EgressRequestHash'}
+        actualHttpAttempts: {type: integer, minimum: 0, maximum: 1}
+        errorCode: {type: string, nullable: true, description: Sanitized local error code; null on success.}
+        upstreamStatus: {type: integer, nullable: true}
+        sourceCode: {type: integer, nullable: true}
+        accountPaused: {type: boolean, description: True on 429 or explicit provider rate limiting; all account request families must pause.}
+        cooldownUntil: {type: string, format: date-time, nullable: true}
+    AttemptPermitResponse:
+      allOf:
+        - {$ref: '#/components/schemas/Envelope'}
+        - type: object
+          properties:
+            code: {type: string, enum: ['200', B0001]}
+            data:
+              oneOf:
+                - {$ref: '#/components/schemas/AttemptPermit'}
+                - {$ref: '#/components/schemas/AuthorizationDenial'}
+              description: Code 200 requires AttemptPermit; code B0001 requires AuthorizationDenial. Lost or malformed responses are uncertain and fail closed with a local pause.
+    CompletionResponse:
+      allOf:
+        - {$ref: '#/components/schemas/Envelope'}
+        - type: object
+          properties:
+            data: {type: boolean, enum: [true], description: Successful acknowledgement confirms durable completion and cooldown persistence; any other result fails closed.}
+    WarehouseQueryRequest:
+      type: object
+      required: [current, size]
+      properties:
+        current: {type: integer, minimum: 1}
+        size: {type: integer, minimum: 1, maximum: 1000}
+    QueryRequest:
+      type: object
+      required: [startTime, endTime, current, size]
+      properties:
+        startTime: {type: string, example: '2026-09-12T08:00:00', description: Source local datetime. Must precede endTime and be no earlier than endTime minus one calendar month. No source timezone inference.}
+        endTime: {type: string, example: '2026-10-12T08:00:00'}
+        current: {type: integer, minimum: 1}
+        size: {type: integer, minimum: 1, maximum: 100, description: 'Local request cap, not supplier quota.'}
+    LocateRequest:
+      type: object
+      required: [deliveryNo, current, size]
+      properties:
+        deliveryNo: {type: string, minLength: 1, maxLength: 128}
+        current: {type: integer, minimum: 1}
+        size: {type: integer, minimum: 1, maximum: 1000}
+    DetailRequest:
+      type: object
+      required: [warehouseCode, customerCode, deliveryNo]
+      properties:
+        warehouseCode: {type: string, minLength: 1, maxLength: 64}
+        customerCode: {type: string, minLength: 1, maxLength: 64}
+        deliveryNo: {type: string, minLength: 1, maxLength: 128}
+    InventoryQueryRequest:
+      type: object
+      required: [warehouseCode, current, size]
+      properties:
+        warehouseCode: {type: string, minLength: 1, maxLength: 64}
+        current: {type: integer, minimum: 1}
+        size: {type: integer, minimum: 1, maximum: 1000}
+    Pagination:
+      type: object
+      required: [total, current, size, pages, sourceCurrent, sourceSize, sourceCode, observedAt, egress]
+      properties:
+        egress: {$ref: '#/components/schemas/EgressMetadata'}
+        total: {type: string, pattern: '^[0-9]+$', description: Required provider total. Long follows platform string serialization.}
+        current: {type: integer}
+        size: {type: integer}
+        pages: {type: integer, minimum: 0}
+        sourceCurrent: {type: integer}
+        sourceSize: {type: integer}
+        sourceCode: {type: integer, enum: [200]}
+        observedAt: {type: string, format: date-time}
+    OrderSummary:
+      type: object
+      required: [deliveryNo, customerCode, whCode, status]
+      properties:
+        deliveryNo: {type: string}
+        sourceNo: {type: string, nullable: true}
+        customerCode: {type: string}
+        whCode: {type: string}
+        status: {type: integer}
+        createTime: {type: string, nullable: true}
+        outboundTime: {type: string, nullable: true}
+        productList:
+          type: array
+          nullable: true
+          description: Per-SKU list quantities; missing items, SKU or qty require one detail supplement for this order. Zero is a known quantity.
+          items:
+            type: object
+            properties:
+              productSku: {type: string, nullable: true}
+              productName: {type: string, nullable: true}
+              qty: {type: number, nullable: true}
+    Warehouse:
+      type: object
+      required: [whCode, warehouseType, status]
+      properties:
+        whCode: {type: string}
+        whNameCn: {type: string, nullable: true}
+        warehouseType: {type: integer}
+        status: {type: integer}
+        timeZone: {type: string, nullable: true, description: Warehouse metadata only.}
+    SkuLine:
+      type: object
+      required: [productSku]
+      properties:
+        productSku: {type: string}
+        productName: {type: string, nullable: true}
+        actualDeliveryQty: {type: number, nullable: true, description: 'BigDecimal actual quantity, unknown is null.'}
+        deliveryQty: {type: number, nullable: true, description: Forecast only; never a replacement for actual quantity.}
+    OrderDetail:
+      type: object
+      required: [deliveryNo, customerCode, whCode, status, skuVOList, sourceCode, observedAt, egress]
+      properties:
+        egress: {$ref: '#/components/schemas/EgressMetadata'}
+        deliveryNo: {type: string}
+        sourceNo: {type: string, nullable: true}
+        customerCode: {type: string}
+        whCode: {type: string}
+        status: {type: integer}
+        orderCreateTime: {type: string, nullable: true}
+        outboundTime: {type: string, nullable: true}
+        skuVOList: {type: array, minItems: 1, items: {$ref: '#/components/schemas/SkuLine'}}
+        sourceCode: {type: integer, enum: [200]}
+        observedAt: {type: string, format: date-time}
+    ProductStock:
+      type: object
+      required: [customerCode, whCode, productSku, productQuality]
+      properties:
+        customerCode: {type: string}
+        whCode: {type: string}
+        productSku: {type: string}
+        productName: {type: string, nullable: true}
+        productQuality: {type: integer}
+        stkQty: {type: number, nullable: true}
+        freezeQty: {type: number, nullable: true}
+        useStkQty: {type: number, nullable: true}
+        transitQty: {type: number, nullable: true}
+        innerBatchNo: {type: string, nullable: true}
+        outBatchNo: {type: string, nullable: true}
+        uniqueKey4tenant: {type: string, nullable: true}
+    OrderPage:
+      allOf:
+        - {$ref: '#/components/schemas/Pagination'}
+        - type: object
+          required: [records]
+          properties:
+            records: {type: array, items: {$ref: '#/components/schemas/OrderSummary'}}
+    WarehousePage:
+      allOf:
+        - {$ref: '#/components/schemas/Pagination'}
+        - type: object
+          required: [records]
+          properties:
+            records: {type: array, items: {$ref: '#/components/schemas/Warehouse'}}
+    InventoryPage:
+      allOf:
+        - {$ref: '#/components/schemas/Pagination'}
+        - type: object
+          required: [records]
+          properties:
+            records: {type: array, items: {$ref: '#/components/schemas/ProductStock'}}
+    ProviderFailure:
+      type: object
+      required: [errorCode, retryable, egress]
+      properties:
+        egress: {$ref: '#/components/schemas/EgressMetadata'}
+        denial:
+          nullable: true
+          allOf:
+            - {$ref: '#/components/schemas/AuthorizationDenial'}
+          description: Well-formed deterministic authority denial, alongside egress; null for other failures.
+        errorCode: {type: string}
+        retryable: {type: boolean, description: Caller scheduling hint only; never authorizes implicit retries or reuse of an attempt. False for 429 and validation session failure.}
+        upstreamStatus: {type: integer, nullable: true}
+        sourceCode: {type: integer, nullable: true}
+    Envelope:
+      type: object
+      required: [code, message, data, timestamp]
+      properties:
+        code: {type: string, description: '200 success; A0401 identity; A0422 validation; B0001 or S0503 provider/configuration failure.'}
+        message: {type: string, description: 'Sanitized fixed local message, never raw supplier content.'}
+        requestId: {type: string, nullable: true}
+        traceId: {type: string, nullable: true}
+        timestamp: {type: string, format: date-time}
+    OrderResponse:
+      allOf:
+        - {$ref: '#/components/schemas/Envelope'}
+        - type: object
+          properties:
+            data:
+              nullable: true
+              oneOf:
+                - {$ref: '#/components/schemas/OrderPage'}
+                - {$ref: '#/components/schemas/ProviderFailure'}
+    WarehouseResponse:
+      allOf:
+        - {$ref: '#/components/schemas/Envelope'}
+        - type: object
+          properties:
+            data:
+              nullable: true
+              oneOf:
+                - {$ref: '#/components/schemas/WarehousePage'}
+                - {$ref: '#/components/schemas/ProviderFailure'}
+    DetailResponse:
+      allOf:
+        - {$ref: '#/components/schemas/Envelope'}
+        - type: object
+          properties:
+            data:
+              nullable: true
+              oneOf:
+                - {$ref: '#/components/schemas/OrderDetail'}
+                - {$ref: '#/components/schemas/ProviderFailure'}
+    InventoryResponse:
+      allOf:
+        - {$ref: '#/components/schemas/Envelope'}
+        - type: object
+          properties:
+            data:
+              nullable: true
+              oneOf:
+                - {$ref: '#/components/schemas/InventoryPage'}
+                - {$ref: '#/components/schemas/ProviderFailure'}
diff --git a/integration-service/src/test/java/com/baiyue/integration/config/LingxingEgressPropertiesTest.java b/integration-service/src/test/java/com/baiyue/integration/config/LingxingEgressPropertiesTest.java
new file mode 100644
index 000000000..ad3667d9b
--- /dev/null
+++ b/integration-service/src/test/java/com/baiyue/integration/config/LingxingEgressPropertiesTest.java
@@ -0,0 +1,71 @@
+package com.baiyue.integration.config;
+
+import com.baiyue.integration.dto.lingxing.LingxingEgressDtos.CollectionMode;
+import org.junit.jupiter.api.Test;
+import java.time.Duration;
+import java.util.List;
+import static org.assertj.core.api.Assertions.*;
+
+class LingxingEgressPropertiesTest {
+    @Test void continuousBusinessFlagBindsOnlyWhenExplicitlyEnabled() {
+        String prefix = "baiyue.integration.lingxing-wms.egress";
+        var input = new java.util.HashMap<String, String>();
+        input.put(prefix + ".collection-mode", "BUSINESS");
+        var source = new org.springframework.boot.context.properties.source.MapConfigurationPropertySource(input);
+        var binder = new org.springframework.boot.context.properties.bind.Binder(source);
+        var target = org.springframework.boot.context.properties.bind.Bindable.of(LingxingEgressProperties.class);
+        assertThat(binder.bind(prefix, target).get().continuousBusinessCollectionEnabled()).isFalse();
+        source.put(prefix + ".continuous-business-collection-enabled", "true");
+        assertThat(binder.bind(prefix, target).get().continuousBusinessCollectionEnabled()).isTrue();
+    }
+    private LingxingEgressProperties properties(CollectionMode mode, Duration interval, Duration cooldown) {
+        return new LingxingEgressProperties(mode, "test", null, null, null, null, interval, cooldown, false);
+    }
+
+    @Test void businessAcceptsPositiveMillisecondIntervalsIncludingProbeSteps() {
+        for (long millis : new long[]{1, 1200, 1500, 2000, 3000, 5000, 300000}) {
+            assertThat(properties(CollectionMode.BUSINESS, Duration.ofMillis(millis), null).minStartInterval())
+                    .isEqualTo(Duration.ofMillis(millis));
+        }
+    }
+
+    @Test void businessRejectsSubMillisecondNonPositiveAndExcessiveIntervals() {
+        for (Duration interval : List.of(Duration.ofMillis(-1), Duration.ZERO,
+                Duration.ofNanos(999999), Duration.ofMinutes(5).plusMillis(1))) {
+            assertThatThrownBy(() -> properties(CollectionMode.BUSINESS, interval, null))
+                    .isInstanceOf(IllegalArgumentException.class);
+        }
+    }
+
+    @Test void validationRetainsFiveSecondMinimumAndAllModesDefaultToFiveSeconds() {
+        for (CollectionMode mode : CollectionMode.values()) {
+            assertThat(properties(mode, null, null).minStartInterval()).isEqualTo(Duration.ofSeconds(5));
+            if (mode == CollectionMode.VALIDATION) {
+                assertThatThrownBy(() -> properties(mode, Duration.ofMillis(4999), null))
+                        .isInstanceOf(IllegalArgumentException.class);
+                assertThat(properties(mode, Duration.ofSeconds(5), null).minStartInterval())
+                        .isEqualTo(Duration.ofSeconds(5));
+            }
+        }
+        assertThat(properties(null, null, null).collectionMode()).isEqualTo(CollectionMode.OFF);
+    }
+
+    @Test void switchingBusinessOffCanRetainItsThreeSecondInterval() {
+        var business = properties(CollectionMode.BUSINESS, Duration.ofSeconds(3), null);
+        assertThat(properties(CollectionMode.OFF, business.minStartInterval(), null).minStartInterval())
+                .isEqualTo(Duration.ofSeconds(3));
+        assertThatThrownBy(() -> properties(CollectionMode.OFF, Duration.ZERO, null))
+                .isInstanceOf(IllegalArgumentException.class);
+    }
+
+    @Test void businessIntervalChangeDoesNotRelaxCooldownBounds() {
+        for (Duration cooldown : List.of(Duration.ofMillis(4999), Duration.ofDays(1).plusMillis(1))) {
+            assertThatThrownBy(() -> properties(CollectionMode.BUSINESS, Duration.ofMillis(1), cooldown))
+                    .isInstanceOf(IllegalArgumentException.class);
+        }
+        for (Duration cooldown : List.of(Duration.ofSeconds(5), Duration.ofDays(1))) {
+            assertThat(properties(CollectionMode.BUSINESS, Duration.ofMillis(1), cooldown).cooldownFallback())
+                    .isEqualTo(cooldown);
+        }
+    }
+}
diff --git a/integration-service/src/test/java/com/baiyue/integration/controller/LingxingEgressRuntimeControllerTest.java b/integration-service/src/test/java/com/baiyue/integration/controller/LingxingEgressRuntimeControllerTest.java
new file mode 100644
index 000000000..d6c608107
--- /dev/null
+++ b/integration-service/src/test/java/com/baiyue/integration/controller/LingxingEgressRuntimeControllerTest.java
@@ -0,0 +1,48 @@
+package com.baiyue.integration.controller;
+
+import com.baiyue.common.web.GlobalExceptionHandler;
+import com.baiyue.integration.config.LingxingWmsProperties;
+import com.baiyue.integration.dto.lingxing.LingxingEgressRuntimeSnapshot;
+import com.baiyue.integration.provider.lingxing.LingxingEgressGate;
+import com.baiyue.integration.security.InternalServiceTokenGuard;
+import com.fasterxml.jackson.databind.SerializationFeature;
+import java.time.Instant;
+import java.util.UUID;
+import org.junit.jupiter.api.Test;
+import org.springframework.http.converter.json.Jackson2ObjectMapperBuilder;
+import org.springframework.http.converter.json.MappingJackson2HttpMessageConverter;
+import org.springframework.test.util.ReflectionTestUtils;
+import org.springframework.test.web.servlet.setup.MockMvcBuilders;
+import static org.mockito.Mockito.*;
+import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
+import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.*;
+
+class LingxingEgressRuntimeControllerTest {
+    @Test void internalTokenIsRequiredBeforeGateInspectionAndPublicPathDoesNotExist() throws Exception {
+        String token = UUID.randomUUID().toString();var guard = new InternalServiceTokenGuard();
+        ReflectionTestUtils.setField(guard, "token", token);ReflectionTestUtils.invokeMethod(guard, "initializeToken");
+        var gate = mock(LingxingEgressGate.class);var provider = new LingxingWmsProperties(false,null,null,null,null,null);
+        var converter = new MappingJackson2HttpMessageConverter(Jackson2ObjectMapperBuilder.json()
+            .featuresToDisable(SerializationFeature.WRITE_DATES_AS_TIMESTAMPS).build());
+        var mvc = MockMvcBuilders.standaloneSetup(new LingxingEgressRuntimeController(guard,gate,provider))
+            .setMessageConverters(converter).setControllerAdvice(new GlobalExceptionHandler()).build();
+        String path = "/internal/integrations/lingxing/wms/egress/runtime";
+        for (String bad : new String[] {"", "wrong", "Bearer user-jwt"}) {
+            mvc.perform(get(path).header("X-Internal-Service-Token",bad)).andExpect(status().isOk()).andExpect(jsonPath("$.code").value("A0401"));
+        }
+        verifyNoInteractions(gate);
+        mvc.perform(get("/api/integrations/lingxing/wms/egress/runtime")).andExpect(status().isOk())
+            .andExpect(jsonPath("$.code").value(org.hamcrest.Matchers.not("200")))
+            .andExpect(jsonPath("$.data.service").doesNotExist());
+        verifyNoInteractions(gate);
+        var snapshot = new LingxingEgressRuntimeSnapshot(1,"integration",Instant.parse("2026-10-13T14:00:00Z"),
+            "OFF","test",false,null,false,null,5000,30,false,null);
+        when(gate.runtimeSnapshot(false)).thenReturn(snapshot);
+        mvc.perform(get(path).header("X-Internal-Service-Token",token)).andExpect(status().isOk())
+            .andExpect(jsonPath("$.code").value("200")).andExpect(jsonPath("$.data.service").value("integration"))
+            .andExpect(jsonPath("$.data.observedAt").value("2026-10-13T14:00:00Z"))
+            .andExpect(jsonPath("$.data.mode").value("OFF")).andExpect(jsonPath("$.data.providerEnabled").value(false))
+            .andExpect(jsonPath("$.data.verified").doesNotExist()).andExpect(jsonPath("$.data.grant").doesNotExist());
+        verify(gate).runtimeSnapshot(false);verifyNoMoreInteractions(gate);
+    }
+}
diff --git a/integration-service/src/test/java/com/baiyue/integration/controller/LingxingInternalControllerTest.java b/integration-service/src/test/java/com/baiyue/integration/controller/LingxingInternalControllerTest.java
new file mode 100644
index 000000000..a6de263c6
--- /dev/null
+++ b/integration-service/src/test/java/com/baiyue/integration/controller/LingxingInternalControllerTest.java
@@ -0,0 +1,163 @@
+package com.baiyue.integration.controller;
+
+import com.baiyue.common.web.GlobalExceptionHandler;
+import com.baiyue.common.web.LongIdJacksonConfiguration;
+import com.baiyue.integration.dto.lingxing.LingxingWmsDtos.OrderSummary;
+import com.baiyue.integration.dto.lingxing.LingxingWmsDtos.PageResult;
+import com.baiyue.integration.provider.lingxing.LingxingWmsClient;
+import com.baiyue.integration.provider.lingxing.LingxingWmsException;
+import com.baiyue.integration.security.InternalServiceTokenGuard;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.CsvSource;
+import org.springframework.http.MediaType;
+import org.springframework.http.converter.json.Jackson2ObjectMapperBuilder;
+import org.springframework.http.converter.json.MappingJackson2HttpMessageConverter;
+import org.springframework.boot.autoconfigure.jackson.Jackson2ObjectMapperBuilderCustomizer;
+import org.springframework.context.annotation.AnnotationConfigApplicationContext;
+import org.springframework.test.util.ReflectionTestUtils;
+import org.springframework.test.web.servlet.MockMvc;
+import org.springframework.test.web.servlet.setup.MockMvcBuilders;
+
+import java.time.Instant;
+import java.util.List;
+import java.util.UUID;
+
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verifyNoInteractions;
+import static org.mockito.Mockito.when;
+import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post;
+import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.jsonPath;
+import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
+
+class LingxingInternalControllerTest {
+    private static final String PATH = "/internal/integrations/lingxing/wms/outbound-orders/query";
+    private static final String BODY = """
+            {"startTime":"2026-09-12T08:00:00","endTime":"2026-10-12T08:00:00","current":1,"size":1}
+            """;
+    private static final String CONTEXT = "{\"sourceAccount\":\"demo\",\"executionPurpose\":\"VALIDATION\",\"rootTaskId\":\"root-1\",\"sessionId\":\"session-1\",\"attemptId\":\"attempt-1\",\"exclusiveGrantId\":\"grant-1\"}";
+    private final String token = UUID.randomUUID().toString();
+    private LingxingWmsClient client;
+    private MockMvc mvc;
+
+    @BeforeEach
+    void setUp() {
+        var guard = new InternalServiceTokenGuard();
+        ReflectionTestUtils.setField(guard, "token", token);
+        ReflectionTestUtils.invokeMethod(guard, "initializeToken");
+        client = mock(LingxingWmsClient.class);
+        var builder = Jackson2ObjectMapperBuilder.json();
+        try (var context = new AnnotationConfigApplicationContext(LongIdJacksonConfiguration.class)) {
+            context.getBean(Jackson2ObjectMapperBuilderCustomizer.class).customize(builder);
+        }
+        mvc = MockMvcBuilders.standaloneSetup(new LingxingInternalController(guard, client, builder.build()))
+                .setMessageConverters(new MappingJackson2HttpMessageConverter(builder.build()))
+                .setControllerAdvice(new GlobalExceptionHandler()).build();
+    }
+
+    @Test
+    void missingOrWrongInternalTokenCannotCallProvider() throws Exception {
+        mvc.perform(post(PATH).contentType(MediaType.APPLICATION_JSON).content(BODY))
+                .andExpect(status().isOk()).andExpect(jsonPath("$.code").value("A0401"));
+        mvc.perform(post(PATH).header("X-Internal-Service-Token", "wrong")
+                        .contentType(MediaType.APPLICATION_JSON).content(BODY))
+                .andExpect(status().isOk()).andExpect(jsonPath("$.code").value("A0401"));
+        verifyNoInteractions(client);
+    }
+
+    @ParameterizedTest
+    @CsvSource(value = {
+        "/warehouses/query|{\"current\":1,\"size\":1000}",
+        "/outbound-orders/locate|{\"deliveryNo\":\"DO-DEMO\",\"current\":1,\"size\":10}",
+        "/outbound-orders/detail|{\"warehouseCode\":\"W-DEMO\",\"customerCode\":\"C-DEMO\",\"deliveryNo\":\"DO-DEMO\"}",
+        "/product-inventory/query|{\"warehouseCode\":\"W-DEMO\",\"current\":1,\"size\":1000}"
+    }, delimiter = '|')
+    void everyNewEndpointRequiresInternalIdentity(String suffix, String request) throws Exception {
+        String path = "/internal/integrations/lingxing/wms" + suffix;
+        for (String invalidToken : new String[] {"", "wrong", "Bearer user-jwt"}) {
+            mvc.perform(post(path).header("X-Internal-Service-Token", invalidToken)
+                    .contentType(MediaType.APPLICATION_JSON).content(request))
+                .andExpect(status().isOk()).andExpect(jsonPath("$.code").value("A0401"));
+        }
+        verifyNoInteractions(client);
+    }
+
+    @ParameterizedTest
+    @CsvSource(value = {
+        "/outbound-orders/query|{\"startTime\":\"2026-09-12T08:00:00\",\"endTime\":\"2026-10-12T08:00:00\",\"current\":1,\"size\":1}",
+        "/warehouses/query|{\"current\":1,\"size\":10}",
+        "/outbound-orders/locate|{\"deliveryNo\":\"DO-DEMO\",\"current\":1,\"size\":10}",
+        "/outbound-orders/detail|{\"warehouseCode\":\"W-DEMO\",\"customerCode\":\"C-DEMO\",\"deliveryNo\":\"DO-DEMO\"}",
+        "/product-inventory/query|{\"warehouseCode\":\"W-DEMO\",\"current\":1,\"size\":10}"
+    }, delimiter = '|')
+    void everyEndpointRejectsMissingControlContextBeforeProvider(String suffix, String request) throws Exception {
+        mvc.perform(post("/internal/integrations/lingxing/wms" + suffix).header("X-Internal-Service-Token", token)
+                .contentType(MediaType.APPLICATION_JSON).content(request))
+            .andExpect(status().isOk()).andExpect(jsonPath("$.code").value("B0001"))
+            .andExpect(jsonPath("$.data.errorCode").value("LINGXING_WMS_EGRESS_CONTEXT_INVALID"))
+            .andExpect(jsonPath("$.data.egress.actualHttpAttempts").value(0));
+        verifyNoInteractions(client);
+    }
+
+    @Test
+    void controlHeaderRejectsUnknownDuplicateAndTrailingFields() throws Exception {
+        for (String header : new String[] {
+            CONTEXT.replace("\"sourceAccount\":", "\"extra\":1,\"sourceAccount\":"),
+            CONTEXT.replace("\"sourceAccount\":", "\"sourceAccount\":\"other\",\"sourceAccount\":"),
+            CONTEXT + " {}", " ", "x".repeat(2049), "{}", "null",
+            CONTEXT.replace("VALIDATION", "OFF"), CONTEXT.replace("root-1", "root with spaces")
+        }) {
+            mvc.perform(post(PATH).header("X-Internal-Service-Token", token).header("X-Lingxing-Egress-Context", header)
+                    .contentType(MediaType.APPLICATION_JSON).content(BODY))
+                .andExpect(status().isOk()).andExpect(jsonPath("$.data.errorCode").value("LINGXING_WMS_EGRESS_CONTEXT_INVALID"));
+        }
+        verifyNoInteractions(client);
+    }
+
+    @Test
+    void inventoryRequiresWarehouseAndDetailRequiresAllThreeIdentifiers() throws Exception {
+        for (String suffix : new String[] {"/product-inventory/query", "/outbound-orders/detail"}) {
+            mvc.perform(post("/internal/integrations/lingxing/wms" + suffix)
+                    .header("X-Internal-Service-Token", token).header("X-Lingxing-Egress-Context", CONTEXT).contentType(MediaType.APPLICATION_JSON)
+                    .content("{\"current\":1,\"size\":1000,\"deliveryNo\":\"DO-DEMO\"}"))
+                .andExpect(status().isOk()).andExpect(jsonPath("$.code").value("A0422"));
+        }
+        verifyNoInteractions(client);
+    }
+
+    @Test
+    void authenticatedReadReturnsOnlyOutboundSummary() throws Exception {
+        when(client.queryPage(any(), any())).thenReturn(new PageResult(
+                List.of(new OrderSummary("TEST-OUT-001", "TEST-SRC-001", "TEST-CUSTOMER", "TEST-WH", 100,
+                        "2026-10-01 08:00:00", "2026-10-02 08:00:00", null)),
+                1L, 1, 1, 1, 1, 1, 200, Instant.parse("2026-10-12T00:00:00Z"), null));
+        mvc.perform(post(PATH).header("X-Internal-Service-Token", token).header("X-Lingxing-Egress-Context", CONTEXT)
+                        .contentType(MediaType.APPLICATION_JSON).content(BODY))
+                .andExpect(status().isOk()).andExpect(jsonPath("$.code").value("200"))
+                .andExpect(jsonPath("$.data.total").isString()).andExpect(jsonPath("$.data.total").value("1"))
+                .andExpect(jsonPath("$.data.records[0].deliveryNo").value("TEST-OUT-001"))
+                .andExpect(jsonPath("$.data.records[0].recipient").doesNotExist());
+    }
+
+    @Test
+    void invalidPageCannotReachProvider() throws Exception {
+        mvc.perform(post(PATH).header("X-Internal-Service-Token", token).header("X-Lingxing-Egress-Context", CONTEXT)
+                        .contentType(MediaType.APPLICATION_JSON).content(BODY.replace("\"current\":1", "\"current\":0")))
+                .andExpect(status().isOk()).andExpect(jsonPath("$.code").value("A0422"));
+        verifyNoInteractions(client);
+    }
+
+    @Test
+    void providerFailureRemainsAnExplicitBusinessFailure() throws Exception {
+        when(client.queryPage(any(), any())).thenThrow(new LingxingWmsException(
+                "LINGXING_WMS_HTTP_RATE_LIMITED", "领星 WMS 请求受到限流", true, 429, null));
+        mvc.perform(post(PATH).header("X-Internal-Service-Token", token).header("X-Lingxing-Egress-Context", CONTEXT)
+                        .contentType(MediaType.APPLICATION_JSON).content(BODY))
+                .andExpect(status().isOk()).andExpect(jsonPath("$.code").value("S0503"))
+                .andExpect(jsonPath("$.data.errorCode").value("LINGXING_WMS_HTTP_RATE_LIMITED"))
+                .andExpect(jsonPath("$.data.upstreamStatus").value(429))
+                .andExpect(jsonPath("$.data.records").doesNotExist());
+    }
+}
diff --git a/integration-service/src/test/java/com/baiyue/integration/provider/lingxing/LingxingEgressGateTest.java b/integration-service/src/test/java/com/baiyue/integration/provider/lingxing/LingxingEgressGateTest.java
new file mode 100644
index 000000000..006c4955f
--- /dev/null
+++ b/integration-service/src/test/java/com/baiyue/integration/provider/lingxing/LingxingEgressGateTest.java
@@ -0,0 +1,384 @@
+package com.baiyue.integration.provider.lingxing;
+
+import com.baiyue.integration.config.LingxingEgressProperties;
+import com.baiyue.integration.dto.lingxing.LingxingEgressDtos.*;
+import org.junit.jupiter.api.Test;
+import java.net.URI;
+import java.time.*;
+import java.util.*;
+import java.util.concurrent.*;
+import java.util.concurrent.atomic.AtomicInteger;
+import java.util.function.UnaryOperator;
+import static org.assertj.core.api.Assertions.*;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+
+class LingxingEgressGateTest {
+    @Test void debugTimingRecordsActualCallAndCompletionWithoutContextOrPayload() {
+        var logger = (ch.qos.logback.classic.Logger) org.slf4j.LoggerFactory.getLogger(LingxingEgressGate.class);
+        var previous = logger.getLevel();
+        var appender = new ch.qos.logback.core.read.ListAppender<ch.qos.logback.classic.spi.ILoggingEvent>();
+        appender.start(); logger.addAppender(appender); logger.setLevel(ch.qos.logback.classic.Level.DEBUG);
+        try {
+            var gate = gate();
+            Object body = new Object();
+            assertThat(gate.<Object>execute(context("private-attempt"), Operation.OUTBOUND_DETAIL, HASH, handle -> {
+                handle.startHttp(); clock.advanceMillis(123); return body;
+            })).isSameAs(body);
+            assertThat(appender.list).hasSize(1);
+            assertThat(appender.list.get(0).getFormattedMessage())
+                .contains("operation=OUTBOUND_DETAIL", "start=" + NOW, "end=" + NOW.plusMillis(123),
+                    "upstreamStatus=200", "errorCode=null", "completionConfirmed=true")
+                .doesNotContain("demo-account", "private-attempt", "demo-grant", HASH);
+            ledger.failComplete = true;
+            var failure = assertThrows(LingxingWmsException.class, () -> gate.execute(context("private-failure"),
+                Operation.OUTBOUND_DETAIL, HASH, handle -> {
+                    handle.startHttp(); clock.advanceMillis(50); throw rateLimit();
+                }));
+            assertThat(failure.code()).isEqualTo("LINGXING_WMS_BUDGET_COMPLETION_UNCONFIRMED");
+            assertThat(appender.list).hasSize(2);
+            assertThat(appender.list.get(1).getFormattedMessage())
+                .contains("upstreamStatus=429", "errorCode=RATE_LIMIT", "completionConfirmed=false")
+                .doesNotContain("private-failure", "synthetic rate limit", "demo-account", HASH);
+            logger.setLevel(ch.qos.logback.classic.Level.INFO);
+            ledger.failComplete = false;
+            gate().execute(context("debug-disabled"), Operation.WAREHOUSES, HASH, handle -> body);
+            assertThat(appender.list).hasSize(2);
+        } finally {
+            logger.detachAppender(appender); appender.stop(); logger.setLevel(previous);
+        }
+    }
+    static final Instant NOW = Instant.parse("2026-10-12T00:00:00Z");
+    static final String HASH = "a".repeat(64);
+    private final MutableClock clock = new MutableClock(NOW);
+    private final LedgerAuthority ledger = new LedgerAuthority(clock);
+    private LingxingEgressGate gate() { return new LingxingEgressGate(props(CollectionMode.VALIDATION, "test"), ledger, clock, clock::advanceMillis); }
+    static EgressContext context(String attempt) { return new EgressContext("demo-account", CollectionMode.VALIDATION, "root", "session", attempt, "demo-grant"); }
+    static LingxingEgressProperties props(CollectionMode mode, String environment) {
+        return new LingxingEgressProperties(mode, environment, "demo-account", "demo-grant", NOW.plusSeconds(3600), URI.create("http://127.0.0.1"), null, null, false);
+    }
+    private LingxingEgressGate continuousGate(CollectionMode mode, String grant, Instant until) {
+        return new LingxingEgressGate(new LingxingEgressProperties(mode, "test", "demo-account", grant, until,
+            URI.create("http://127.0.0.1"), null, null, true), ledger, clock, clock::advanceMillis);
+    }
+    @Test void continuousBusinessCrossesOldGrantExpiryButKeepsFiniteSingleUsePermits() {
+        var gate = continuousGate(CollectionMode.BUSINESS, "demo-grant", NOW.minusSeconds(1));
+        assertThat(gate.execute(businessContext("continuous"), Operation.WAREHOUSES, HASH,
+            h -> { h.startHttp(); return h.metadata(); }).actualHttpAttempts()).isEqualTo(1);
+        clock.advanceMillis(86400000);
+        var restarted = continuousGate(CollectionMode.BUSINESS, "demo-grant", null);
+        assertThat(restarted.execute(businessContext("next-day"), Operation.WAREHOUSES, HASH,
+            h -> { h.startHttp(); return h.metadata(); }).actualHttpAttempts()).isEqualTo(1);
+        ledger.mutation = p -> new AttemptPermit(p.context(), p.operation(), p.requestHash(), 1,
+            clock.instant().plusSeconds(31), true, true);
+        assertThatThrownBy(() -> restarted.execute(businessContext("too-long"), Operation.WAREHOUSES, HASH, h -> true))
+            .hasMessageContaining("BUDGET_PERMIT_INVALID");
+        assertThat(ledger.completions).hasSize(2);
+    }
+    @Test void continuousFlagNeverReplacesMatchingGrantOrFiniteValidationWindow() {
+        for (String grant : Arrays.asList(null, "", "other-grant")) {
+            var gate = continuousGate(CollectionMode.BUSINESS, grant, null);
+            assertThatThrownBy(() -> gate.execute(businessContext("missing-grant"), Operation.WAREHOUSES, HASH, h -> true))
+                .hasMessageContaining("EXCLUSIVE_WINDOW_UNCONFIRMED");
+        }
+        for (Instant until : Arrays.asList(null, NOW)) {
+            var gate = continuousGate(CollectionMode.VALIDATION, "demo-grant", until);
+            assertThatThrownBy(() -> gate.execute(context("validation"), Operation.WAREHOUSES, HASH, h -> true))
+                .hasMessageContaining("EXCLUSIVE_WINDOW_UNCONFIRMED");
+        }
+        assertThat(ledger.authorizations).isZero();
+    }
+    @Test void continuousBusinessStillPausesOnUnconfirmedCompletion() {
+        var gate = continuousGate(CollectionMode.BUSINESS, "demo-grant", null);
+        ledger.failComplete = true;
+        assertThatThrownBy(() -> gate.execute(businessContext("lost"), Operation.WAREHOUSES, HASH,
+            h -> { h.startHttp(); return true; })).hasMessageContaining("BUDGET_COMPLETION_UNCONFIRMED");
+        ledger.failComplete = false; clock.advanceMillis(86400000);
+        assertThatThrownBy(() -> gate.execute(businessContext("after-lost"), Operation.WAREHOUSES, HASH, h -> true))
+            .hasMessageContaining("ACCOUNT_PAUSED");
+        assertThat(ledger.authorizations).isEqualTo(1);
+    }
+    @Test void manualBusinessWithContinuousFlagOffCrossesOldCutoffButRejectsExpiredSinglePermit() {
+        var gate = new LingxingEgressGate(new LingxingEgressProperties(CollectionMode.BUSINESS, "test",
+            "demo-account", "demo-grant", NOW, URI.create("http://127.0.0.1"), Duration.ofMillis(1200), null, false),
+            ledger, clock, clock::advanceMillis);
+        var manual = new EgressContext("demo-account", CollectionMode.BUSINESS, "6", "selfop-6", "manual-after-cutoff", "demo-grant");
+        assertThat(gate.execute(manual, Operation.OUTBOUND_DETAIL, HASH,
+            h -> { h.startHttp(); return h.metadata(); }).actualHttpAttempts()).isEqualTo(1);
+        assertThat(ledger.completions).singleElement().satisfies(c -> assertThat(c.context()).isEqualTo(manual));
+        ledger.mutation = p -> new AttemptPermit(p.context(), p.operation(), p.requestHash(), 1,
+            clock.instant(), true, true);
+        assertThatThrownBy(() -> gate.execute(new EgressContext("demo-account", CollectionMode.BUSINESS, "6", "selfop-6", "manual-expired-permit", "demo-grant"),
+            Operation.OUTBOUND_DETAIL, HASH, h -> { h.startHttp(); return true; })).hasMessageContaining("BUDGET_PERMIT_INVALID");
+        assertThat(ledger.authorizations).isEqualTo(2);assertThat(ledger.completions).hasSize(1);
+    }
+    @Test void manualBusinessWithoutGrantCutoffStillRejectsPermitExpiringWhileSigning() {
+        var gate = new LingxingEgressGate(new LingxingEgressProperties(CollectionMode.BUSINESS, "test",
+            "demo-account", "demo-grant", null, URI.create("http://127.0.0.1"), Duration.ofMillis(1200), null, false),
+            ledger, clock, clock::advanceMillis);
+        assertThatThrownBy(() -> gate.execute(businessContext("manual-signing-expired"), Operation.OUTBOUND_DETAIL, HASH,
+            h -> { clock.advanceMillis(30000); h.startHttp(); return true; })).hasMessageContaining("ATTEMPT_NOT_SENDABLE");
+        assertThat(ledger.completions).singleElement().satisfies(c -> assertThat(c.actualHttpAttempts()).isZero());
+    }
+    @Test void continuousBusinessRetains1200MillisSpacingAndOneHttpPerPermit() {
+        var gate = new LingxingEgressGate(new LingxingEgressProperties(CollectionMode.BUSINESS, "test",
+            "demo-account", "demo-grant", null, URI.create("http://127.0.0.1"), Duration.ofMillis(1200), null, true),
+            ledger, clock, clock::advanceMillis);
+        gate.execute(businessContext("first-spaced"), Operation.WAREHOUSES, HASH, h -> { h.startHttp(); return true; });
+        gate.execute(businessContext("second-spaced"), Operation.WAREHOUSES, HASH, h -> { h.startHttp(); return true; });
+        assertThat(Duration.between(NOW, clock.instant()).toMillis()).isGreaterThanOrEqualTo(1200);
+        assertThatThrownBy(() -> gate.execute(businessContext("one-send"), Operation.WAREHOUSES, HASH,
+            h -> { h.startHttp(); h.startHttp(); return true; })).hasMessageContaining("ATTEMPT_NOT_SENDABLE");
+        assertThat(ledger.completions).hasSize(3).allSatisfy(c -> assertThat(c.actualHttpAttempts()).isEqualTo(1));
+    }
+    @Test void continuousBusinessCannotSendWithExpiredPermitAfterSigning() {
+        var gate = continuousGate(CollectionMode.BUSINESS, "demo-grant", null);
+        assertThatThrownBy(() -> gate.execute(businessContext("expired-permit"), Operation.OUTBOUND_DETAIL, HASH,
+            h -> { clock.advanceMillis(30000); h.startHttp(); return true; })).hasMessageContaining("ATTEMPT_NOT_SENDABLE");
+        assertThat(ledger.completions).singleElement().satisfies(c -> assertThat(c.actualHttpAttempts()).isZero());
+    }
+    @Test void continuousBusinessRateCooldownStillRequiresFreshAuthorityApproval() {
+        var gate = continuousGate(CollectionMode.BUSINESS, "demo-grant", null);
+        assertThrows(LingxingWmsException.class, () -> gate.execute(businessContext("continuous-rate"), Operation.WAREHOUSES, HASH,
+            h -> { h.startHttp(); h.rateLimited(null); throw rateLimit(); }));
+        assertThatThrownBy(() -> gate.execute(businessContext("during-cooldown"), Operation.WAREHOUSES, HASH, h -> true))
+            .hasMessageContaining("ACCOUNT_PAUSED");
+        clock.advanceMillis(300000);ledger.denial = new AuthorizationDenial("ACCOUNT_REQUIRES_REVIEW", false, null);
+        assertThatThrownBy(() -> gate.execute(businessContext("authority-denied"), Operation.WAREHOUSES, HASH, h -> true))
+            .hasMessageContaining("BUDGET_AUTHORIZATION_DENIED");
+        assertThat(ledger.completions).hasSize(1);
+        ledger.denial = null;
+        assertThat(gate.execute(businessContext("fresh-approved"), Operation.WAREHOUSES, HASH,
+            h -> { h.startHttp(); return h.metadata(); }).accountPaused()).isFalse();
+        assertThat(ledger.completions).hasSize(2);
+    }
+    @Test void failureCompletionPreservesNullableTransportAndSourceCodes() {
+        for (Integer status : new Integer[] {null, 503}) {
+            var gate = gate();
+            var error = assertThrows(LingxingWmsException.class, () -> gate.execute(context("nullable-" + status),
+                Operation.WAREHOUSES, HASH, handle -> {
+                    handle.startHttp();
+                    throw new LingxingWmsException("LINGXING_WMS_IO_FAILED", "固定失败摘要", true, status, null);
+                }));
+            assertThat(error.egress().actualHttpAttempts()).isEqualTo(1);
+            var completion = ledger.completions.get(ledger.completions.size() - 1);
+            assertThat(completion.actualHttpAttempts()).isEqualTo(1);
+            assertThat(completion.upstreamStatus()).isEqualTo(status);
+            assertThat(completion.sourceCode()).isNull();
+        }
+    }
+    @Test void defaultOffAndUnknownBusinessEnvironmentsNeverAuthorize() {
+        var defaults = new LingxingEgressProperties(null, null, null, null, null, null, null, null, false);
+        assertThat(defaults.collectionMode()).isEqualTo(CollectionMode.OFF);
+        assertThat(defaults.continuousBusinessCollectionEnabled()).isFalse();
+        assertThat(defaults.minStartInterval()).isEqualTo(Duration.ofSeconds(5));
+        var off = new LingxingEgressGate(defaults, ledger, clock, clock::advanceMillis);
+        assertThatThrownBy(() -> off.execute(context("a"), Operation.WAREHOUSES, HASH, h -> { h.startHttp(); return true; })).hasMessageContaining("EGRESS_OFF");
+        for(String environment:List.of("dev","gray","staging","prod","TEST","")) {
+            var business = new LingxingEgressGate(props(CollectionMode.BUSINESS, environment), ledger, clock, clock::advanceMillis);
+            assertThatThrownBy(() -> business.execute(businessContext("rejected"), Operation.WAREHOUSES, HASH, h -> true)).hasMessageContaining("BUSINESS_ENVIRONMENT_REJECTED");
+        }
+        assertThat(ledger.authorizations).isZero();
+    }
+    @Test void testAndProductionBusinessUseTheSameSingleConsumedPermitAndCompletionProtocol() {
+        for(String environment:List.of("test","production")) {
+            var gate=new LingxingEgressGate(props(CollectionMode.BUSINESS,environment),ledger,clock,clock::advanceMillis);
+            var result=gate.execute(businessContext(environment+"-inventory"),Operation.PRODUCT_INVENTORY,HASH,handle->{handle.startHttp();return handle.metadata();});
+            assertThat(result.actualHttpAttempts()).isEqualTo(1);assertThat(result.accountPaused()).isFalse();
+        }
+        assertThat(ledger.authorizations).isEqualTo(2);assertThat(ledger.consumed).hasSize(2);assertThat(ledger.completions).hasSize(2);
+        assertThat(ledger.completions).allSatisfy(c->{assertThat(c.context().executionPurpose()).isEqualTo(CollectionMode.BUSINESS);assertThat(c.operation()).isEqualTo(Operation.PRODUCT_INVENTORY);assertThat(c.actualHttpAttempts()).isEqualTo(1);});
+    }
+    @Test void testBusinessStillRejectsPurposeAccountAndGrantMismatchBeforeAuthorization() {
+        var gate=new LingxingEgressGate(props(CollectionMode.BUSINESS,"test"),ledger,clock,clock::advanceMillis);
+        assertThatThrownBy(()->gate.execute(context("wrong-purpose"),Operation.WAREHOUSES,HASH,h->true)).hasMessageContaining("EGRESS_CONTEXT_INVALID");
+        assertThatThrownBy(()->gate.execute(new EgressContext("other-account",CollectionMode.BUSINESS,"root","session","wrong-account","demo-grant"),Operation.WAREHOUSES,HASH,h->true)).hasMessageContaining("EGRESS_CONTEXT_INVALID");
+        assertThatThrownBy(()->gate.execute(new EgressContext("demo-account",CollectionMode.BUSINESS,"root","session","wrong-grant","other-grant"),Operation.WAREHOUSES,HASH,h->true)).hasMessageContaining("EXCLUSIVE_WINDOW_UNCONFIRMED");
+        assertThat(ledger.authorizations).isZero();assertThat(ledger.completions).isEmpty();
+    }
+    @Test void testBusinessUnconfirmedCompletionStillRequiresManualReviewAfterTimePasses() {
+        var gate=new LingxingEgressGate(props(CollectionMode.BUSINESS,"test"),ledger,clock,clock::advanceMillis);
+        ledger.failComplete=true;
+        var failure=assertThrows(LingxingWmsException.class,()->gate.execute(businessContext("test-lost-ack"),Operation.PRODUCT_INVENTORY,HASH,h->{h.startHttp();return true;}));
+        assertThat(failure.code()).isEqualTo("LINGXING_WMS_BUDGET_COMPLETION_UNCONFIRMED");
+        assertThat(failure.egress().actualHttpAttempts()).isEqualTo(1);assertThat(failure.egress().accountPaused()).isTrue();
+        clock.advanceMillis(600000);ledger.failComplete=false;
+        assertThatThrownBy(()->gate.execute(businessContext("test-after-uncertainty"),Operation.PRODUCT_INVENTORY,HASH,h->{h.startHttp();return true;})).hasMessageContaining("ACCOUNT_PAUSED");
+        assertThat(ledger.authorizations).isEqualTo(1);assertThat(ledger.completions).hasSize(1);
+    }
+    @Test void proofAndContextAreServerBoundBeforeAuthorization() {
+        var contexts = Arrays.asList(null, new EgressContext("other", CollectionMode.VALIDATION, "root", "session", "a", "demo-grant"),
+            new EgressContext("demo-account", CollectionMode.BUSINESS, "root", "session", "a", "demo-grant"),
+            new EgressContext("demo-account", CollectionMode.VALIDATION, "root", "session", "a", "client-claimed-grant"),
+            new EgressContext("demo-account", CollectionMode.VALIDATION, "", "session", "a", "demo-grant"),
+            new EgressContext("demo-account", CollectionMode.VALIDATION, "root", "bad session", "a", "demo-grant"));
+        for (var c : contexts) assertThrows(LingxingWmsException.class, () -> gate().execute(c, Operation.WAREHOUSES, HASH, h -> true));
+        clock.advanceMillis(3600000);
+        assertThrows(LingxingWmsException.class, () -> gate().execute(context("a"), Operation.WAREHOUSES, HASH, h -> true));
+        assertThat(ledger.authorizations).isZero();
+    }
+    @Test void budgetPermitMustBeOneConsumedExclusiveUnexpiredAndExactlyBound() {
+        List<UnaryOperator<AttemptPermit>> mutations = List.of(
+            p -> null,
+            p -> new AttemptPermit(p.context(), p.operation(), p.requestHash(), 2, p.expiresAt(), true, true),
+            p -> new AttemptPermit(p.context(), p.operation(), p.requestHash(), 1, clock.instant(), true, true),
+            p -> new AttemptPermit(p.context(), p.operation(), p.requestHash(), 1, clock.instant().plusSeconds(31), true, true),
+            p -> new AttemptPermit(context("different"), p.operation(), p.requestHash(), 1, p.expiresAt(), true, true),
+            p -> new AttemptPermit(p.context(), Operation.OUTBOUND_DETAIL, p.requestHash(), 1, p.expiresAt(), true, true),
+            p -> new AttemptPermit(p.context(), p.operation(), "b".repeat(64), 1, p.expiresAt(), true, true),
+            p -> new AttemptPermit(p.context(), p.operation(), p.requestHash(), 1, p.expiresAt(), false, true),
+            p -> new AttemptPermit(p.context(), p.operation(), p.requestHash(), 1, p.expiresAt(), true, false));
+        var calls = new AtomicInteger(); int n = 0;
+        for (var mutation : mutations) {
+            ledger.mutation = mutation; var gate = gate(); var c = context("attempt-" + ++n);
+            assertThatThrownBy(() -> gate.execute(c, Operation.WAREHOUSES, HASH, h -> calls.incrementAndGet())).hasMessageContaining("BUDGET_PERMIT_INVALID");
+            assertThatThrownBy(() -> gate.execute(context("next-" + c.attemptId()), Operation.WAREHOUSES, HASH, h -> true)).hasMessageContaining("ACCOUNT_PAUSED");
+        }
+        assertThat(calls).hasValue(0); assertThat(ledger.completions).isEmpty();
+    }
+    @Test void everyAttemptIsPersistentlyConsumedAndCannotReplayEvenAcrossGateInstances() {
+        var c = context("single-use");
+        assertThat(gate().execute(c, Operation.WAREHOUSES, HASH, h -> { h.startHttp(); return h.metadata(); }).actualHttpAttempts()).isEqualTo(1);
+        assertThat(ledger.consumed).containsExactly("single-use");
+        var second = gate(); var sends = new AtomicInteger();
+        assertThatThrownBy(() -> second.execute(c, Operation.WAREHOUSES, HASH, h -> { h.startHttp(); return sends.incrementAndGet(); })).hasMessageContaining("BUDGET_AUTHORITY_UNAVAILABLE");
+        assertThat(sends).hasValue(0); assertThat(ledger.completions).hasSize(1);
+    }
+    @Test void handleCanStartOnlyOnceAndExpiredHandleCannotSend() {
+        var error = assertThrows(LingxingWmsException.class, () -> gate().execute(context("once"), Operation.WAREHOUSES, HASH,
+            h -> { h.startHttp(); h.startHttp(); return true; }));
+        assertThat(error.code()).endsWith("ATTEMPT_NOT_SENDABLE");
+        assertThat(error.egress().actualHttpAttempts()).isEqualTo(1);
+        error = assertThrows(LingxingWmsException.class, () -> gate().execute(context("expires"), Operation.WAREHOUSES, HASH,
+            h -> { clock.advanceMillis(30000); h.startHttp(); return true; }));
+        assertThat(error.egress().actualHttpAttempts()).isZero();
+        assertThat(ledger.completions).extracting(CompletionRequest::actualHttpAttempts).containsExactly(1, 0);
+    }
+    @Test void authorizationAndCompletionFailuresPauseAllFurtherCalls() {
+        ledger.failAuthorize = true; var gate = gate();
+        var error = assertThrows(LingxingWmsException.class, () -> gate.execute(context("unavailable"), Operation.WAREHOUSES, HASH, h -> true));
+        assertThat(error.egress().actualHttpAttempts()).isZero(); assertThat(error.egress().accountPaused()).isTrue();
+        assertThatThrownBy(() -> gate.execute(context("next"), Operation.OUTBOUND_DETAIL, HASH, h -> true)).hasMessageContaining("ACCOUNT_PAUSED");
+        ledger.failAuthorize = false; ledger.failComplete = true; var fresh = gate();
+        error = assertThrows(LingxingWmsException.class, () -> fresh.execute(context("callback"), Operation.WAREHOUSES, HASH, h -> { h.startHttp(); return true; }));
+        assertThat(error.code()).endsWith("BUDGET_COMPLETION_UNCONFIRMED");
+        assertThat(error.egress().actualHttpAttempts()).isEqualTo(1); assertThat(error.egress().accountPaused()).isTrue();
+        assertThatThrownBy(() -> fresh.execute(context("after-callback"), Operation.OUTBOUND_DETAIL, HASH, h -> true)).hasMessageContaining("ACCOUNT_PAUSED");
+    }
+    @Test void startsAreSerializedAndSpacedByAtLeastFiveSeconds() throws Exception {
+        var gate = gate(); var executor = Executors.newFixedThreadPool(2);
+        var entered = new CountDownLatch(1); var release = new CountDownLatch(1);
+        var starts = new CopyOnWriteArrayList<Instant>();
+        try {
+            var first = executor.submit(() -> gate.execute(context("first"), Operation.WAREHOUSES, HASH, h -> {
+                h.startHttp(); starts.add(clock.instant()); entered.countDown();
+                try { if (!release.await(2, TimeUnit.SECONDS)) throw new IllegalStateException("fixture timeout"); }
+                catch (InterruptedException e) { throw new IllegalStateException(e); }
+                return true;
+            }));
+            assertThat(entered.await(2, TimeUnit.SECONDS)).isTrue();
+            var secondReady = new CountDownLatch(1);
+            var second = executor.submit(() -> { secondReady.countDown(); return gate.execute(context("second"), Operation.OUTBOUND_DETAIL, HASH,
+                h -> { h.startHttp(); starts.add(clock.instant()); return true; }); });
+            assertThat(secondReady.await(2, TimeUnit.SECONDS)).isTrue();
+            assertThat(ledger.authorizations).isEqualTo(1); assertThat(second.isDone()).isFalse();
+            release.countDown(); assertThat(first.get(2, TimeUnit.SECONDS)).isTrue(); assertThat(second.get(2, TimeUnit.SECONDS)).isTrue();
+            assertThat(starts).hasSize(2); assertThat(Duration.between(starts.get(0), starts.get(1))).isGreaterThanOrEqualTo(Duration.ofSeconds(5));
+            assertThat(ledger.completions).hasSize(2);
+        } finally { release.countDown(); executor.shutdownNow(); }
+    }
+    @Test void intervalCannotBeConfiguredBelowFiveSecondsAndPropertiesHideGrant() {
+        assertThatThrownBy(() -> new LingxingEgressProperties(CollectionMode.VALIDATION, null, null, null, null, null, Duration.ofMillis(4999), null, false)).isInstanceOf(IllegalArgumentException.class);
+        assertThat(props(CollectionMode.VALIDATION, "test").toString()).doesNotContain("demo-grant", "demo-account", "127.0.0.1");
+    }
+    @Test void knownBudgetDenialDoesNotPermanentlyPauseOrConsumeHttp() {
+        var gate = gate(); ledger.denial = new AuthorizationDenial("VALIDATION_TOTAL_LIMIT", true, null);
+        var error = assertThrows(LingxingWmsException.class, () -> gate.execute(context("denied"), Operation.WAREHOUSES, HASH, h -> { h.startHttp(); return true; }));
+        assertThat(error.denial()).isEqualTo(ledger.denial);
+        assertThat(error.egress().actualHttpAttempts()).isZero(); assertThat(error.egress().accountPaused()).isFalse();
+        assertThat(ledger.consumed).isEmpty(); assertThat(ledger.completions).isEmpty();
+        ledger.denial = null;
+        assertThat(gate.execute(context("fresh-session-attempt"), Operation.WAREHOUSES, HASH, h -> { h.startHttp(); return h.metadata(); }).actualHttpAttempts()).isEqualTo(1);
+    }
+    private static EgressContext businessContext(String attempt) {
+        return new EgressContext("demo-account", CollectionMode.BUSINESS, "root", "session", attempt, "demo-grant");
+    }
+    private LingxingWmsException rateLimit() { return new LingxingWmsException("RATE_LIMIT", "synthetic rate limit", false, 429, null); }
+    @Test void businessCooldownRequiresFreshDurablePermitBeforeRecovery() {
+        var gate = new LingxingEgressGate(props(CollectionMode.BUSINESS, "production"), ledger, clock, clock::advanceMillis);
+        assertThrows(LingxingWmsException.class, () -> gate.execute(businessContext("limited"), Operation.WAREHOUSES, HASH, h -> {
+            h.startHttp(); h.rateLimited(clock.instant().plusSeconds(600)); throw rateLimit();
+        }));
+        int used = ledger.authorizations;
+        assertThatThrownBy(() -> gate.execute(businessContext("too-early"), Operation.OUTBOUND_DETAIL, HASH, h -> true)).hasMessageContaining("ACCOUNT_PAUSED");
+        assertThat(ledger.authorizations).isEqualTo(used);
+        clock.advanceMillis(600000); ledger.denial = new AuthorizationDenial("ACCOUNT_COOLDOWN", false, clock.instant().plusSeconds(60));
+        var denied = assertThrows(LingxingWmsException.class, () -> gate.execute(businessContext("still-denied"), Operation.OUTBOUND_DETAIL, HASH, h -> { h.startHttp(); return true; }));
+        assertThat(denied.egress().actualHttpAttempts()).isZero(); assertThat(denied.egress().accountPaused()).isTrue();
+        ledger.denial = null;
+        var accepted = gate.execute(businessContext("accepted"), Operation.OUTBOUND_DETAIL, HASH, h -> { h.startHttp(); return h.metadata(); });
+        assertThat(accepted.actualHttpAttempts()).isEqualTo(1); assertThat(accepted.accountPaused()).isFalse(); assertThat(accepted.cooldownUntil()).isNull();
+        assertThat(ledger.completions).hasSize(2);
+    }
+    @Test void committedRateCompletionWithLostAckReturnsUncertaintyInsteadOfRecoverableRateError() {
+        var gate=new LingxingEgressGate(props(CollectionMode.BUSINESS,"production"),ledger,clock,clock::advanceMillis);
+        ledger.failComplete=true;
+        var error=assertThrows(LingxingWmsException.class,()->gate.execute(businessContext("rate-lost-ack"),Operation.WAREHOUSES,HASH,handle->{
+            handle.startHttp();handle.rateLimited(clock.instant().plusSeconds(600));throw rateLimit();
+        }));
+        assertThat(error.code()).isEqualTo("LINGXING_WMS_BUDGET_COMPLETION_UNCONFIRMED");
+        assertThat(error.egress().actualHttpAttempts()).isEqualTo(1);assertThat(error.egress().accountPaused()).isTrue();
+        assertThat(error.egress().cooldownUntil()).isEqualTo(NOW.plusSeconds(600));
+        assertThat(ledger.completions).singleElement().satisfies(result->{
+            assertThat(result.upstreamStatus()).isEqualTo(429);assertThat(result.actualHttpAttempts()).isEqualTo(1);
+            assertThat(result.accountPaused()).isTrue();
+        });
+        clock.advanceMillis(601000);ledger.failComplete=false;
+        assertThatThrownBy(()->gate.execute(businessContext("after-uncertain-ack"),Operation.WAREHOUSES,HASH,handle->true)).hasMessageContaining("ACCOUNT_PAUSED");
+        assertThat(ledger.authorizations).isEqualTo(1);
+    }
+    @Test void validationRatePauseAndUnconfirmedCallbackNeverRecoverByTime() {
+        var gate = gate();
+        assertThrows(LingxingWmsException.class, () -> gate.execute(context("limited"), Operation.WAREHOUSES, HASH, h -> {
+            h.startHttp(); h.rateLimited(null); throw rateLimit();
+        }));
+        clock.advanceMillis(600000);
+        assertThatThrownBy(() -> gate.execute(context("next"), Operation.WAREHOUSES, HASH, h -> true)).hasMessageContaining("ACCOUNT_PAUSED");
+        assertThat(ledger.authorizations).isEqualTo(1);
+        var business = new LingxingEgressGate(props(CollectionMode.BUSINESS, "production"), ledger, clock, clock::advanceMillis);
+        ledger.failComplete = true;
+        assertThrows(LingxingWmsException.class, () -> business.execute(businessContext("lost-complete"), Operation.WAREHOUSES, HASH, h -> {
+            h.startHttp(); h.rateLimited(null); throw rateLimit();
+        }));
+        clock.advanceMillis(600000); ledger.failComplete = false;
+        assertThatThrownBy(() -> business.execute(businessContext("no-recover"), Operation.OUTBOUND_DETAIL, HASH, h -> true)).hasMessageContaining("ACCOUNT_PAUSED");
+        assertThat(ledger.authorizations).isEqualTo(2);
+    }
+    static final class MutableClock extends Clock {
+        private Instant now;
+        MutableClock(Instant now) { this.now = now; }
+        synchronized void advanceMillis(long millis) { now = now.plusMillis(millis); }
+        @Override public ZoneId getZone() { return ZoneOffset.UTC; }
+        @Override public Clock withZone(ZoneId zone) { return this; }
+        @Override public synchronized Instant instant() { return now; }
+    }
+    /** Synthetic durable single-use ledger, shared between independently constructed gates. */
+    static class LedgerAuthority implements LingxingBudgetAuthority {
+        final Clock clock;
+        final Set<String> consumed = new LinkedHashSet<>();
+        final List<CompletionRequest> completions = new ArrayList<>();
+        volatile int authorizations;
+        boolean failAuthorize, failComplete;
+        AuthorizationDenial denial;
+        UnaryOperator<AttemptPermit> mutation = UnaryOperator.identity();
+        LedgerAuthority(Clock clock) { this.clock = clock; }
+        @Override public synchronized AttemptPermit authorize(AuthorizationRequest request) {
+            authorizations++;
+            if (denial != null) throw new LingxingBudgetDeniedException(denial);
+            if (failAuthorize || !consumed.add(request.context().attemptId())) throw new IllegalStateException("budget refused");
+            return mutation.apply(new AttemptPermit(request.context(), request.operation(), request.requestHash(), 1, clock.instant().plusSeconds(30), true, true));
+        }
+        @Override public synchronized void complete(CompletionRequest request) {
+            completions.add(request); if (failComplete) throw new IllegalStateException("completion not durable");
+        }
+    }
+}
diff --git a/integration-service/src/test/java/com/baiyue/integration/provider/lingxing/LingxingEgressRuntimeSnapshotTest.java b/integration-service/src/test/java/com/baiyue/integration/provider/lingxing/LingxingEgressRuntimeSnapshotTest.java
new file mode 100644
index 000000000..a87b6342f
--- /dev/null
+++ b/integration-service/src/test/java/com/baiyue/integration/provider/lingxing/LingxingEgressRuntimeSnapshotTest.java
@@ -0,0 +1,57 @@
+package com.baiyue.integration.provider.lingxing;
+
+import com.baiyue.integration.config.LingxingEgressProperties;
+import com.baiyue.integration.dto.lingxing.LingxingEgressDtos.CollectionMode;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import java.net.URI;
+import java.nio.charset.StandardCharsets;
+import java.security.MessageDigest;
+import java.time.*;
+import java.util.HexFormat;
+import org.junit.jupiter.api.Test;
+import static org.assertj.core.api.Assertions.*;
+import static org.mockito.Mockito.*;
+
+class LingxingEgressRuntimeSnapshotTest {
+    private static final Instant NOW = Instant.parse("2026-10-13T14:00:00Z");
+    private final LingxingBudgetAuthority authority = mock(LingxingBudgetAuthority.class);
+    private LingxingEgressGate gate(CollectionMode mode, String account, String grant, URI uri) {
+        return new LingxingEgressGate(new LingxingEgressProperties(mode, "test", account, grant, null, uri,
+            mode == CollectionMode.VALIDATION ? Duration.ofSeconds(5) : Duration.ofMillis(1200), null, true),
+            authority, Clock.fixed(NOW, ZoneOffset.UTC), millis -> { throw new AssertionError("DIAGNOSTIC_MUST_NOT_WAIT"); });
+    }
+    private static String hash(String domain, String value) throws Exception {
+        return HexFormat.of().formatHex(MessageDigest.getInstance("SHA-256")
+            .digest(("selfop-runtime:v1:" + domain + "\n" + value).getBytes(StandardCharsets.UTF_8)));
+    }
+    @Test void sameGateReturnsActualBindingsWithDomainSeparatedExactRawFingerprints() throws Exception {
+        var snapshot = gate(CollectionMode.BUSINESS, "same-raw-value", "same-raw-value", URI.create("http://authority:9303")).runtimeSnapshot(true);
+        assertThat(snapshot.schemaVersion()).isEqualTo(1);assertThat(snapshot.service()).isEqualTo("integration");
+        assertThat(snapshot.observedAt()).isEqualTo(NOW);assertThat(snapshot.mode()).isEqualTo("BUSINESS");
+        assertThat(snapshot.environment()).isEqualTo("test");assertThat(snapshot.continuousEnabled()).isTrue();
+        assertThat(snapshot.providerEnabled()).isTrue();assertThat(snapshot.grantPresent()).isTrue();
+        assertThat(snapshot.intervalMs()).isEqualTo(1200);assertThat(snapshot.permitMaxSeconds()).isEqualTo(30);
+        assertThat(snapshot.sourceAccountFingerprint()).isEqualTo(hash("source-account", "same-raw-value"));
+        assertThat(snapshot.grantFingerprint()).isEqualTo(hash("grant", "same-raw-value")).isNotEqualTo(snapshot.sourceAccountFingerprint());
+        assertThat(snapshot.budgetAuthorityFingerprint()).isEqualTo(hash("budget-authority", "http://authority:9303"));
+        assertThat(gate(CollectionMode.BUSINESS, " raw ", " raw ", null).runtimeSnapshot(false).grantFingerprint())
+            .isEqualTo(hash("grant", " raw ")).isNotEqualTo(hash("grant", "raw"));
+        verifyNoInteractions(authority);
+    }
+    @Test void offAndValidationAreObservableAndAbsentOrBlankValuesAreNotHashed() {
+        for (String value : new String[] {null, "", "  "}) {
+            var s = gate(CollectionMode.OFF, value, value, null).runtimeSnapshot(false);
+            assertThat(s.mode()).isEqualTo("OFF");assertThat(s.sourceAccountFingerprint()).isNull();
+            assertThat(s.grantPresent()).isFalse();assertThat(s.grantFingerprint()).isNull();
+            assertThat(s.budgetAuthorityFingerprint()).isNull();assertThat(s.providerEnabled()).isFalse();
+        }
+        assertThat(gate(CollectionMode.VALIDATION, null, null, null).runtimeSnapshot(false).intervalMs()).isEqualTo(5000);
+        verifyNoInteractions(authority);
+    }
+    @Test void serializedSnapshotContainsNoRawIdentityAddressCredentialOrVerifiedClaim() throws Exception {
+        var raw = new ObjectMapper().findAndRegisterModules().writeValueAsString(
+            gate(CollectionMode.BUSINESS, "private-account", "private-grant", URI.create("http://private-host:9303")).runtimeSnapshot(true));
+        assertThat(raw).doesNotContain("private-account", "private-grant", "private-host", "http://", "verified", "appSecret", "internalServiceToken");
+        verifyNoInteractions(authority);
+    }
+}
diff --git a/integration-service/src/test/java/com/baiyue/integration/provider/lingxing/LingxingHttpBudgetAuthorityTest.java b/integration-service/src/test/java/com/baiyue/integration/provider/lingxing/LingxingHttpBudgetAuthorityTest.java
new file mode 100644
index 000000000..1df6dc50d
--- /dev/null
+++ b/integration-service/src/test/java/com/baiyue/integration/provider/lingxing/LingxingHttpBudgetAuthorityTest.java
@@ -0,0 +1,143 @@
+package com.baiyue.integration.provider.lingxing;
+
+import com.baiyue.integration.config.LingxingEgressProperties;
+import com.baiyue.integration.dto.lingxing.LingxingEgressDtos.*;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.fasterxml.jackson.databind.SerializationFeature;
+import com.fasterxml.jackson.datatype.jsr310.JavaTimeModule;
+import com.sun.net.httpserver.HttpServer;
+import org.junit.jupiter.api.*;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.ValueSource;
+import java.io.IOException;
+import java.net.*;
+import java.nio.charset.StandardCharsets;
+import java.util.concurrent.atomic.*;
+import static org.assertj.core.api.Assertions.*;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+
+/** Loopback authority only; the persisted collector ledger is tested by its own service. */
+class LingxingHttpBudgetAuthorityTest {
+    private final ObjectMapper mapper = new ObjectMapper().registerModule(new JavaTimeModule())
+        .disable(SerializationFeature.WRITE_DATES_AS_TIMESTAMPS);
+    private final AtomicReference<String> response = new AtomicReference<>();
+    private final AtomicInteger status = new AtomicInteger(200);
+    private final AtomicInteger calls = new AtomicInteger();
+    private final AtomicReference<String> path = new AtomicReference<>(), token = new AtomicReference<>(), body = new AtomicReference<>();
+    private HttpServer server;
+    private static final String TOKEN = "synthetic-internal-token-0123456789";
+    private final AuthorizationRequest request = new AuthorizationRequest(LingxingEgressGateTest.context("attempt"), Operation.WAREHOUSES, LingxingEgressGateTest.HASH);
+    @BeforeEach void start() throws IOException {
+        response.set("{\"code\":\"200\",\"data\":true}");
+        server = HttpServer.create(new InetSocketAddress("127.0.0.1", 0), 0);
+        server.createContext("/", exchange -> {
+            calls.incrementAndGet(); path.set(exchange.getRequestURI().getPath());
+            token.set(exchange.getRequestHeaders().getFirst("X-Internal-Service-Token"));
+            body.set(new String(exchange.getRequestBody().readAllBytes(), StandardCharsets.UTF_8));
+            exchange.getResponseHeaders().set("Location", "/redirect-must-not-follow");
+            byte[] bytes = response.get().getBytes(StandardCharsets.UTF_8);
+            exchange.sendResponseHeaders(status.get(), bytes.length); exchange.getResponseBody().write(bytes); exchange.close();
+        });
+        server.start();
+    }
+    @AfterEach void stop() { server.stop(0); }
+    private LingxingHttpBudgetAuthority authority(String serviceToken) {
+        return new LingxingHttpBudgetAuthority(new LingxingEgressProperties(CollectionMode.VALIDATION, "test", "demo-account", "demo-grant",
+            LingxingEgressGateTest.NOW.plusSeconds(3600), URI.create("http://127.0.0.1:" + server.getAddress().getPort()), null, null, false), mapper, serviceToken);
+    }
+    private CompletionRequest completion() { return new CompletionRequest(request.context(), request.operation(), request.requestHash(), 1, null, 200, 200, false, null); }
+    private String permit() throws Exception { return mapper.writeValueAsString(new AttemptPermit(request.context(), request.operation(), request.requestHash(), 1,
+        LingxingEgressGateTest.NOW.plusSeconds(30), true, true)); }
+    @Test void fixedInternalEndpointsAndTokenCarryExactAuthorizationAndCompletionContext() throws Exception {
+        response.set("{\"code\":\"200\",\"data\":" + permit() + "}");
+        var permit = authority(TOKEN).authorize(request);
+        assertThat(permit.context()).isEqualTo(request.context()); assertThat(permit.allowedAttempts()).isEqualTo(1);
+        assertThat(path.get()).isEqualTo("/internal/lastleg/self-operated-analytics/egress/authorize");
+        assertThat(token.get()).isEqualTo(TOKEN);
+        assertThat(mapper.readTree(body.get())).isEqualTo(mapper.valueToTree(request));
+        response.set("{\"code\":\"200\",\"data\":true}");
+        authority(TOKEN).complete(completion());
+        assertThat(path.get()).endsWith("/egress/complete"); assertThat(mapper.readTree(body.get())).isEqualTo(mapper.valueToTree(completion()));
+        assertThat(calls.get()).isEqualTo(2);
+    }
+    @ParameterizedTest @ValueSource(strings = {"false", "\"true\"", "1", "{}", "null"})
+    void completionRequiresLiteralBooleanAcknowledgment(String data) {
+        response.set("{\"code\":\"200\",\"data\":" + data + "}");
+        assertThrows(LingxingWmsException.class, () -> authority(TOKEN).complete(completion()));
+        assertThat(calls.get()).isEqualTo(1);
+    }
+    @ParameterizedTest @ValueSource(strings = {"200", "\"201\"", "null"})
+    void envelopeRequiresExactStringSuccessCode(String code) {
+        response.set("{\"code\":" + code + ",\"data\":true}");
+        assertThrows(LingxingWmsException.class, () -> authority(TOKEN).complete(completion()));
+        assertThat(calls.get()).isEqualTo(1);
+    }
+    @ParameterizedTest @ValueSource(ints = {302, 401, 429, 503})
+    void statusErrorsNeverRetryOrFollowRedirectAndNeverEchoAuthorityBody(int code) {
+        status.set(code); response.set("private-fixture@example.test");
+        var error = assertThrows(LingxingWmsException.class, () -> authority(TOKEN).authorize(request));
+        assertThat(error.getCause()).isNull(); assertThat(error.getMessage()).doesNotContain("private-fixture", "synthetic-token");
+        assertThat(calls.get()).isEqualTo(1);
+    }
+    @Test void missingTokenPreventsAllAuthorityHttp() {
+        assertThrows(LingxingWmsException.class, () -> authority("").authorize(request));
+        assertThrows(LingxingWmsException.class, () -> authority(null).complete(completion()));
+        assertThat(calls.get()).isZero();
+    }
+    @Test void missingServerConfiguredAuthorityPreventsHttp() {
+        var authority = new LingxingHttpBudgetAuthority(new LingxingEgressProperties(CollectionMode.VALIDATION, "test", "demo-account", "demo-grant",
+            LingxingEgressGateTest.NOW.plusSeconds(3600), null, null, null, false), mapper, "synthetic-token");
+        assertThrows(LingxingWmsException.class, () -> authority.authorize(request)); assertThat(calls.get()).isZero();
+    }
+    @Test void permitRejectsCoercedBooleansExtraFieldsAndInvalidAttemptCount() throws Exception {
+        String valid = permit();
+        String[] invalid = {valid.replace("\"allowedAttempts\":1", "\"allowedAttempts\":2"),
+            valid.replace("\"allowedAttempts\":1", "\"allowedAttempts\":\"1\""),
+            valid.replace("\"exclusiveConfirmed\":true", "\"exclusiveConfirmed\":\"true\""),
+            valid.replace("\"budgetConsumed\":true", "\"budgetConsumed\":false"),
+            valid.substring(0, valid.length() - 1) + ",\"untrusted\":true}",
+            valid.replace("\"operation\":\"WAREHOUSES\"", "\"operation\":\"UNKNOWN\"")};
+        for (var data : invalid) {
+            response.set("{\"code\":\"200\",\"data\":" + data + "}");
+            assertThrows(LingxingWmsException.class, () -> authority(TOKEN).authorize(request));
+        }
+        assertThat(calls.get()).isEqualTo(invalid.length);
+    }
+    @Test void trailingTokensAndMalformedResponseFailClosed() {
+        for (String value : new String[] {"{\"code\":\"200\",\"data\":true} {}", "[]", "{"}) {
+            response.set(value); assertThrows(LingxingWmsException.class, () -> authority(TOKEN).complete(completion()));
+        }
+        assertThat(calls.get()).isEqualTo(3);
+    }
+    @Test void knownAuthorityDenialIsTypedAndDoesNotBecomeUnavailability() {
+        response.set("{\"code\":\"B0001\",\"data\":{\"errorCode\":\"SESSION_EXPIRED\",\"sampleDone\":true,\"waitUntil\":null}}");
+        var error = assertThrows(LingxingBudgetDeniedException.class, () -> authority(TOKEN).authorize(request));
+        assertThat(error.denial()).isEqualTo(new AuthorizationDenial("SESSION_EXPIRED", true, null));
+        assertThat(calls.get()).isEqualTo(1);
+        response.set("{\"code\":\"B0001\",\"data\":{\"errorCode\":\"ACCOUNT_COOLDOWN\",\"sampleDone\":false,\"waitUntil\":\"2026-10-12T00:10:00Z\"}}");
+        error = assertThrows(LingxingBudgetDeniedException.class, () -> authority(TOKEN).authorize(request));
+        assertThat(error.denial().waitUntil()).isEqualTo(LingxingEgressGateTest.NOW.plusSeconds(600));
+        assertThrows(LingxingWmsException.class, () -> authority(TOKEN).complete(completion()));
+    }
+    @ParameterizedTest @ValueSource(strings = {
+        "{\"errorCode\":\"private@example.test\",\"sampleDone\":true,\"waitUntil\":null}",
+        "{\"errorCode\":\"ACCOUNT_COOLDOWN\",\"sampleDone\":\"true\",\"waitUntil\":null}",
+        "{\"errorCode\":\"ACCOUNT_COOLDOWN\",\"sampleDone\":true}",
+        "{\"errorCode\":\"ACCOUNT_COOLDOWN\",\"sampleDone\":true,\"waitUntil\":\"invalid\"}",
+        "{\"errorCode\":\"ACCOUNT_COOLDOWN\",\"sampleDone\":true,\"waitUntil\":null,\"extra\":true}"
+    })
+    void malformedDenialFailsAsUnavailability(String data) {
+        response.set("{\"code\":\"B0001\",\"data\":" + data + "}");
+        var error = assertThrows(LingxingWmsException.class, () -> authority(TOKEN).authorize(request));
+        assertThat(error.code()).endsWith("BUDGET_AUTHORITY_UNAVAILABLE");
+        assertThat(error.getMessage()).doesNotContain("private@example.test"); assertThat(calls.get()).isEqualTo(1);
+    }
+    @Test void allControlDtosRoundTripWithProductionTimeSerialization() throws Exception {
+        var permit = new AttemptPermit(request.context(), request.operation(), request.requestHash(), 1, LingxingEgressGateTest.NOW.plusSeconds(30), true, true);
+        var metadata = new AttemptMetadata("attempt", 1, true, LingxingEgressGateTest.NOW.plusSeconds(600));
+        var denial = new AuthorizationDenial("ACCOUNT_COOLDOWN", false, metadata.cooldownUntil());
+        for (var dto : new Object[] {request.context(), request, permit, completion(), metadata, denial}) {
+            assertThat(mapper.readValue(mapper.writeValueAsString(dto), dto.getClass())).isEqualTo(dto);
+        }
+    }
+}
diff --git a/integration-service/src/test/java/com/baiyue/integration/provider/lingxing/LingxingQuantityCaptureTest.java b/integration-service/src/test/java/com/baiyue/integration/provider/lingxing/LingxingQuantityCaptureTest.java
new file mode 100644
index 000000000..d6b50bd31
--- /dev/null
+++ b/integration-service/src/test/java/com/baiyue/integration/provider/lingxing/LingxingQuantityCaptureTest.java
@@ -0,0 +1,50 @@
+package com.baiyue.integration.provider.lingxing;
+import static com.baiyue.integration.provider.lingxing.LingxingQuantityEvidence.*;
+import static org.assertj.core.api.Assertions.*;
+import com.baiyue.integration.config.LingxingQuantityCaptureProperties;
+import com.baiyue.integration.dto.lingxing.LingxingEgressDtos.*;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import java.time.*;
+import java.util.*;
+import java.util.concurrent.*;
+import org.junit.jupiter.api.Test;
+class LingxingQuantityCaptureTest {
+ final Instant now=Instant.parse("2026-10-14T00:00:00Z");final ObjectMapper json=new ObjectMapper();
+ final EgressContext context=new EgressContext("account",CollectionMode.BUSINESS,"2","selfop-2","attempt","grant");
+ View view(){return new View("diag","account",null,null,"ARMED",null,now,now.plusSeconds(36000),now.plusSeconds(21600),List.of("W"),"*","1",0,0,0,0,false,List.of());}
+ com.fasterxml.jackson.databind.JsonNode list(String id)throws Exception{return json.readTree("{\"records\":[{\"whCode\":\"W\",\"customerCode\":\"C\",\"deliveryNo\":\""+id+"\",\"productList\":[{\"productSku\":\"S\",\"qty\":10}]}]}");}
+ class Fake implements Sink {View state=view();List<Event> received=new ArrayList<>();String stopped;public View status(Status s){return state;}public Receipt observe(Event e){received.add(e);return new Receipt("ACCEPTED",null,state);}public View stop(Stop s){stopped=s.reason();return state;}}
+ LingxingQuantityCapture capture(Sink sink){return new LingxingQuantityCapture(new LingxingQuantityCaptureProperties(true,"account"),sink,Clock.fixed(now,ZoneOffset.UTC),false);}
+ @Test void observationDoesNotCallReceiverAndLocateNeverBinds()throws Exception{
+  Fake sink=new Fake();try(var c=new TestClose(capture(sink))){c.value.pump();c.value.observe(list("a"),Operation.OUTBOUND_LOCATE,context,now);c.value.pump();assertThat(sink.received).isEmpty();
+   c.value.observe(list("a"),Operation.OUTBOUND_QUERY,context,now);assertThat(sink.received).isEmpty();c.value.pump();assertThat(sink.received).hasSize(1);assertThat(sink.received.get(0).operation()).isEqualTo("OUTBOUND_QUERY");}
+ }
+ @Test void slowReceiverNeverBlocksNormalObservationAndFullQueueStopsOnlyDiagnosis()throws Exception{
+  CountDownLatch entered=new CountDownLatch(1),release=new CountDownLatch(1);Fake sink=new Fake(){public Receipt observe(Event e){entered.countDown();try{release.await(3,TimeUnit.SECONDS);}catch(InterruptedException x){Thread.currentThread().interrupt();}return super.observe(e);}};
+  var c=capture(sink);c.pump();c.observe(list("first"),Operation.OUTBOUND_QUERY,context,now);var worker=Executors.newSingleThreadExecutor();try{var pending=worker.submit(c::pump);assertThat(entered.await(1,TimeUnit.SECONDS)).isTrue();
+   assertThatCode(()->{for(int i=0;i<100;i++)c.observe(list("o"+i),Operation.OUTBOUND_QUERY,context,now);}).doesNotThrowAnyException();
+   release.countDown();pending.get(5,TimeUnit.SECONDS);
+  }finally{release.countDown();worker.shutdownNow();c.close();}
+ }
+ @Test void failureIsolatedAndNoRearmOfSameGrant()throws Exception{
+  Fake sink=new Fake(){public Receipt observe(Event e){throw new IllegalStateException("receiver down");}};var c=capture(sink);try{c.pump();c.observe(list("a"),Operation.OUTBOUND_QUERY,context,now);assertThatCode(c::pump).doesNotThrowAnyException();assertThat(c.stopReason()).isEqualTo("INCOMPLETE");c.pump();assertThat(sink.stopped).isEqualTo("INCOMPLETE");}finally{c.close();}
+ }
+ @Test void selectedCandidatesRecoveredWithoutReobservingList()throws Exception{
+  Fake sink=new Fake();sink.state=new View("diag","account","2","selfop-2","BOUND",null,now,now.plusSeconds(14400),now.plusSeconds(21600),List.of("W"),"*","1",1,0,1,100,true,List.of(new Key("W","C","a",false)));
+  var c=capture(sink);try{c.pump();c.observe(list("a"),Operation.OUTBOUND_QUERY,context,now);c.observe(json.readTree("{\"whCode\":\"W\",\"customerCode\":\"C\",\"deliveryNo\":\"a\",\"skuVOList\":[{\"productSku\":\"S\",\"deliveryQty\":10,\"actualDeliveryQty\":10}]}"),Operation.OUTBOUND_DETAIL,context,now);c.pump();assertThat(sink.received).hasSize(1);assertThat(sink.received.get(0).side()).isEqualTo("DETAIL");}finally{c.close();}
+ }
+ @Test void malformedOrOversizedSnapshotsAreIsolated()throws Exception{
+  Fake sink=new Fake();var c=capture(sink);try{c.pump();var data=json.createObjectNode();var records=data.putArray("records");for(int i=0;i<101;i++)records.addObject();assertThatCode(()->c.observe(data,Operation.OUTBOUND_QUERY,context,now)).doesNotThrowAnyException();c.pump();assertThat(sink.stopped).isEqualTo("OBSERVER_FAILED");assertThat(sink.received).isEmpty();}finally{c.close();}
+ }
+ @Test void queueIsBoundedAndNoProducerWaitsForIt()throws Exception{
+  Fake sink=new Fake();var c=capture(sink);try{c.pump();for(int i=0;i<100;i++)c.observe(list("o"+i),Operation.OUTBOUND_QUERY,context,now);
+   var detail=json.readTree("{\"whCode\":\"W\",\"customerCode\":\"C\",\"deliveryNo\":\"o0\",\"skuVOList\":[{\"productSku\":\"S\",\"deliveryQty\":10,\"actualDeliveryQty\":10}]}");
+   c.observe(detail,Operation.OUTBOUND_DETAIL,context,now);assertThat(c.stopReason()).isEqualTo("QUEUE_FULL");c.pump();assertThat(sink.stopped).isEqualTo("QUEUE_FULL");assertThat(sink.received).isEmpty();
+  }finally{c.close();}
+ }
+ @Test void diagnosticLockContentionNeverWaitsOnCollector()throws Exception{
+  Fake sink=new Fake();var c=capture(sink);c.pump();var field=LingxingQuantityCapture.class.getDeclaredField("intake");field.setAccessible(true);var lock=(java.util.concurrent.locks.ReentrantLock)field.get(c);
+  var pool=Executors.newSingleThreadExecutor();lock.lock();try{var observation=pool.submit(()->{try{c.observe(list("a"),Operation.OUTBOUND_QUERY,context,now);}catch(Exception e){throw new RuntimeException(e);}});observation.get(500,TimeUnit.MILLISECONDS);assertThat(c.stopReason()).isEqualTo("OBSERVER_FAILED");}finally{lock.unlock();pool.shutdownNow();c.close();}
+ }
+ record TestClose(LingxingQuantityCapture value)implements AutoCloseable{public void close(){value.close();}}
+}
diff --git a/integration-service/src/test/java/com/baiyue/integration/provider/lingxing/LingxingQuantityHttpSinkTest.java b/integration-service/src/test/java/com/baiyue/integration/provider/lingxing/LingxingQuantityHttpSinkTest.java
new file mode 100644
index 000000000..2592d581b
--- /dev/null
+++ b/integration-service/src/test/java/com/baiyue/integration/provider/lingxing/LingxingQuantityHttpSinkTest.java
@@ -0,0 +1,32 @@
+package com.baiyue.integration.provider.lingxing;
+import org.junit.jupiter.api.Test;
+import java.nio.ByteBuffer;
+import java.util.List;
+import java.util.concurrent.Flow;
+import static org.assertj.core.api.Assertions.*;
+class LingxingQuantityHttpSinkTest {
+ @Test void internalWireContractAuthenticatesAndDoesNotRetry()throws Exception{
+  var server=com.sun.net.httpserver.HttpServer.create(new java.net.InetSocketAddress("127.0.0.1",0),0);var calls=new java.util.concurrent.atomic.AtomicInteger();var header=new java.util.concurrent.atomic.AtomicReference<String>();var path=new java.util.concurrent.atomic.AtomicReference<String>();
+  server.createContext("/internal/lastleg/self-operated-analytics/quantity-diagnostics/",exchange->{calls.incrementAndGet();header.set(exchange.getRequestHeaders().getFirst("X-Internal-Service-Token"));path.set(exchange.getRequestURI().getPath());exchange.getRequestBody().readAllBytes();byte[] payload="{\"code\":\"200\",\"data\":null}".getBytes(java.nio.charset.StandardCharsets.UTF_8);exchange.sendResponseHeaders(200,payload.length);exchange.getResponseBody().write(payload);exchange.close();});server.start();
+  try{
+   var props=new com.baiyue.integration.config.LingxingEgressProperties(com.baiyue.integration.dto.lingxing.LingxingEgressDtos.CollectionMode.OFF,"test",null,null,null,java.net.URI.create("http://127.0.0.1:"+server.getAddress().getPort()),null,null,false);
+   String token="synthetic-internal-token-000000000000";var sink=new LingxingQuantityHttpSink(props,new com.fasterxml.jackson.databind.ObjectMapper().findAndRegisterModules(),token);
+   assertThat(sink.status(new LingxingQuantityEvidence.Status("account","producer",true,false))).isNull();assertThat(header.get()).isEqualTo(token);assertThat(path.get()).endsWith("/status");assertThat(calls.get()).isEqualTo(1);
+   sink.stop(new LingxingQuantityEvidence.Stop("diag","account","producer","INCOMPLETE"));assertThat(path.get()).endsWith("/stop");assertThat(calls.get()).isEqualTo(2);
+  }finally{server.stop(0);}
+ }
+ @Test void bodyLimitCancelsBeforeRetainingOversizedResponse(){
+  var body=new LingxingQuantityHttpSink.LimitedBody(16);boolean[] cancelled={false};body.onSubscribe(new Flow.Subscription(){public void request(long n){}public void cancel(){cancelled[0]=true;}});
+  body.onNext(List.of(ByteBuffer.wrap(new byte[8])));body.onNext(List.of(ByteBuffer.wrap(new byte[9])));
+  assertThat(cancelled[0]).isTrue();assertThat(body.getBody().toCompletableFuture()).isCompletedExceptionally();
+ }
+ @Test void hundredFullUnicodeKeysFitTheBoundedResponse()throws Exception{
+  var keys=new java.util.ArrayList<LingxingQuantityEvidence.Key>();for(int i=0;i<100;i++)keys.add(new LingxingQuantityEvidence.Key("倉".repeat(64),"客".repeat(128),"単".repeat(125)+i,false));
+  byte[] payload=new com.fasterxml.jackson.databind.ObjectMapper().writeValueAsBytes(java.util.Map.of("code","200","data",java.util.Map.of("selected",keys)));
+  assertThat(payload.length).isGreaterThan(65536).isLessThan(262144);
+  var body=new LingxingQuantityHttpSink.LimitedBody(262144);body.onSubscribe(new Flow.Subscription(){public void request(long n){}public void cancel(){}});body.onNext(List.of(ByteBuffer.wrap(payload)));body.onComplete();assertThat(body.getBody().toCompletableFuture().join()).isEqualTo(payload);
+ }
+ @Test void boundedSuccessfulBodyIsExact(){
+  var body=new LingxingQuantityHttpSink.LimitedBody(16);body.onSubscribe(new Flow.Subscription(){public void request(long n){}public void cancel(){}});body.onNext(List.of(ByteBuffer.wrap(new byte[]{1,2})));body.onComplete();assertThat(body.getBody().toCompletableFuture().join()).containsExactly(1,2);
+ }
+}
diff --git a/integration-service/src/test/java/com/baiyue/integration/provider/lingxing/LingxingWmsClientTest.java b/integration-service/src/test/java/com/baiyue/integration/provider/lingxing/LingxingWmsClientTest.java
new file mode 100644
index 000000000..bbd3a6718
--- /dev/null
+++ b/integration-service/src/test/java/com/baiyue/integration/provider/lingxing/LingxingWmsClientTest.java
@@ -0,0 +1,424 @@
+package com.baiyue.integration.provider.lingxing;
+
+import com.baiyue.integration.config.LingxingWmsProperties;
+import com.baiyue.integration.config.LingxingEgressProperties;
+import com.baiyue.integration.dto.lingxing.LingxingEgressDtos.*;
+import com.baiyue.integration.dto.lingxing.LingxingWmsDtos.*;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.fasterxml.jackson.datatype.jsr310.JavaTimeModule;
+import com.sun.net.httpserver.HttpServer;
+import org.junit.jupiter.api.*;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.ValueSource;
+import java.io.IOException;
+import java.net.InetSocketAddress;
+import java.net.URI;
+import java.nio.charset.StandardCharsets;
+import java.time.*;
+import java.util.concurrent.atomic.AtomicInteger;
+import java.util.concurrent.atomic.AtomicReference;
+import static org.assertj.core.api.Assertions.*;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+
+/** Synthetic loopback transport only; no supplier or application services. */
+class LingxingWmsClientTest {
+    @Test void warehouseFlowPageKeepsScopeAndUsesSharedPermit() throws Exception {
+        response.set(page("current","size",2,1,2,2,"{\"id\":\"F2\",\"productQuality\":0,\"customerCode\":\"C\",\"whCode\":\"W\",\"productSku\":\"SKU\",\"sourceNo\":\"SOURCE\",\"bookChangQty\":\"-1\"}"));
+        var request=new InventoryFlowPageRequest("W",LocalDateTime.parse("2026-10-01T00:00:00"),LocalDateTime.parse("2026-10-02T00:00:00"),2,1);
+        var result=client().queryInventoryFlowPage(request,context());
+        assertThat(result.records().get(0).sourceNo()).isEqualTo("SOURCE");
+        var business=mapper.readTree(body.get()).path("data");
+        assertThat(business.path("whCode").asText()).isEqualTo("W");
+        assertThat(business.has("customerCode")).isFalse();assertThat(business.has("productSku")).isFalse();
+        assertThat(business.path("current").asInt()).isEqualTo(2);
+        assertThat(completion.get().operation()).isEqualTo(Operation.INVENTORY_FLOW);
+        assertThrows(LingxingWmsException.class,()->client().queryInventoryFlowPage(new InventoryFlowPageRequest("W",request.startTime(),request.endTime().plusSeconds(1),1,1000),context()));
+        assertThat(calls.get()).isEqualTo(1);
+    }
+    @Test void customerDirectoryKeepsNamesAndUsesAccountGate() {
+        response.set(page("page","pageSize",1,1000,1,1,"{\"customerCode\":\"C\",\"customerName\":\"示例货主\",\"status\":\"0\",\"telephoneNo\":\"not-forwarded\"}"));
+        var result=client().queryCustomers(new WarehouseQueryRequest(1,1000),context());
+        assertThat(path.get()).isEqualTo("/openapi/v2/customer/list");
+        assertThat(result.records()).containsExactly(new Customer("C","示例货主","0"));
+        assertThat(completion.get().operation()).isEqualTo(Operation.CUSTOMERS);
+    }
+    @Test void productDirectoryRetainsDeclaredDimensionsAndUnknownMeasurements() {
+        response.set(page("page","pageSize",1,100,1,1,"{\"customerCode\":\"C\",\"sku\":\"SKU\",\"productName\":\"商品\",\"length\":5,\"width\":11,\"height\":5,\"sizeUnit\":\"cm\",\"wmsLength\":\"\",\"wmsWidth\":\"\",\"wmsHeight\":\"\",\"wmsSizeUnit\":\"\"}"));
+        var result=client().queryProducts(new ProductQueryRequest(1,100),context());
+        assertThat(result.records().get(0).length()).isEqualByComparingTo("5");
+        assertThat(result.records().get(0).wmsLength()).isNull();
+        assertThat(result.records().get(0).sku()).isEqualTo("SKU");
+        assertThat(completion.get().operation()).isEqualTo(Operation.PRODUCTS);
+        assertThatThrownBy(()->client().queryProducts(new ProductQueryRequest(1,101),context())).isInstanceOf(LingxingWmsException.class);
+        assertThat(calls.get()).isEqualTo(1);
+    }
+    @Test void masterDataUsesSupplierResponsePaginationAndRejectsWrongPage() throws Exception {
+        response.set(page("page","pageSize",2,1,2,2,"{\"customerCode\":\"C\",\"sku\":\"SKU\"}"));
+        var result=client().queryProducts(new ProductQueryRequest(2,1),context());
+        assertThat(result.current()).isEqualTo(2);
+        assertThat(result.sourceCurrent()).isEqualTo(2);
+        assertThat(result.sourceSize()).isEqualTo(1);
+        var request=mapper.readTree(body.get()).path("data");
+        assertThat(request.path("current").asInt()).isEqualTo(2);
+        assertThat(request.path("size").asInt()).isEqualTo(1);
+        assertThat(request.has("page")).isFalse();
+        response.set(page("page","pageSize",1,1,2,2,"{\"customerCode\":\"C\",\"sku\":\"SKU\"}"));
+        assertThatThrownBy(()->client().queryProducts(new ProductQueryRequest(2,1),context()))
+            .isInstanceOf(LingxingWmsException.class).hasMessageContaining("CURRENT_MISMATCH");
+    }
+    private static final Instant NOW = Instant.parse("2026-10-12T00:00:00Z");
+    private static final String PRIVATE = "private-secret@example.test";
+    private static final String ORDER = """
+        {"deliveryNo":"DO-DEMO","sourceNo":"SRC-DEMO","customerCode":"C-DEMO","whCode":"W-DEMO",
+         "status":100,"outboundTime":"2026-10-01 01:00:00"}
+        """;
+    private final ObjectMapper mapper = new ObjectMapper().registerModule(new JavaTimeModule());
+    private final AtomicInteger calls = new AtomicInteger();
+    private final AtomicInteger status = new AtomicInteger(200);
+    private final AtomicReference<String> response = new AtomicReference<>();
+    private final AtomicReference<String> body = new AtomicReference<>();
+    private final AtomicReference<String> path = new AtomicReference<>();
+    private HttpServer server;
+    private final AtomicInteger attempts = new AtomicInteger();
+    private final AtomicReference<String> retryAfter = new AtomicReference<>();
+    private final AtomicReference<CompletionRequest> completion = new AtomicReference<>();
+    @BeforeEach void start() throws IOException {
+        response.set(page("current", "size", 1, 1, 1, 1, ORDER));
+        server = HttpServer.create(new InetSocketAddress("127.0.0.1", 0), 0);
+        server.createContext("/openapi/v2/", exchange -> {
+            calls.incrementAndGet(); path.set(exchange.getRequestURI().getPath());
+            body.set(new String(exchange.getRequestBody().readAllBytes(), StandardCharsets.UTF_8));
+            byte[] bytes = response.get().getBytes(StandardCharsets.UTF_8);
+            if (retryAfter.get() != null) exchange.getResponseHeaders().set("Retry-After", retryAfter.get());
+            exchange.sendResponseHeaders(status.get(), bytes.length);
+            exchange.getResponseBody().write(bytes); exchange.close();
+        });
+        server.start();
+    }
+    @AfterEach void stop() { server.stop(0); }
+    @Test void observerFailureCannotChangeBusinessResponseOrIssueExtraRequests() {
+        var observer = org.mockito.Mockito.mock(LingxingQuantityCapture.class);
+        org.mockito.Mockito.doThrow(new IllegalStateException("diagnostic failure")).when(observer)
+            .observe(org.mockito.ArgumentMatchers.any(), org.mockito.ArgumentMatchers.any(Operation.class),
+                org.mockito.ArgumentMatchers.any(), org.mockito.ArgumentMatchers.any());
+        var c = client(); c.setQuantityCapture(observer);
+        assertThat(c.queryPage(query(1, 1), context()).records()).hasSize(1);
+        assertThat(calls.get()).isEqualTo(1);
+    }
+    @Test void deniedOrRateLimitedRequestsNeverReachObserver() {
+        var observer = org.mockito.Mockito.mock(LingxingQuantityCapture.class);
+        var disabled = client(CollectionMode.OFF, true, true); disabled.setQuantityCapture(observer);
+        assertThrows(LingxingWmsException.class, () -> disabled.queryPage(query(1, 1), context()));
+        assertThat(calls.get()).isZero();
+        var enabled = client(); enabled.setQuantityCapture(observer); status.set(429);
+        assertThrows(LingxingWmsException.class, () -> enabled.queryPage(query(1, 1), context()));
+        org.mockito.Mockito.verifyNoInteractions(observer); assertThat(calls.get()).isEqualTo(1);
+    }
+    @Test void discoveryFiltersOutboundTimeAndUsesWhitelist() throws Exception {
+        var result = client().queryPage(query(1, 1), context());
+        var data = mapper.readTree(body.get()).path("data");
+        assertThat(data.size()).isEqualTo(6);
+        assertThat(data.path("timeType").asText()).isEqualTo("outboundTime");
+        assertThat(data.path("status").intValue()).isEqualTo(100);
+        assertThat(data.has("whCode")).isFalse();
+        assertThat(path.get()).isEqualTo("/openapi/v2/order/delivery/page");
+        assertThat(result.observedAt()).isEqualTo(NOW);
+        assertThat(result.pages()).isEqualTo(1);
+    }
+    @Test void listProductsPreserveDecimalsZeroAndMissingQuantity() {
+        response.set(page("current","size",1,1,1,1,ORDER.strip().replace("}","""
+            ,"productList":[{"productSku":"SKU","qty":2.123456},{"productSku":"ZERO","qty":0},
+            {"productSku":"UNKNOWN"},{"qty":4}]}""")));
+        var products=client().queryPage(query(1,1),context()).records().get(0).productList();
+        assertThat(products).hasSize(4);
+        assertThat(products.get(0).qty()).isEqualByComparingTo("2.123456");
+        assertThat(products.get(1).qty()).isEqualByComparingTo("0");
+        assertThat(products.get(2).qty()).isNull();assertThat(products.get(3).productSku()).isNull();
+        assertThat(calls.get()).isEqualTo(1);
+    }
+    @Test void cancelledLocateOmitsTimeAndStatusAndRejectsFuzzyMatch() throws Exception {
+        response.set(page("current", "size", 1, 1, 1, 1, ORDER.replace("100", "99").replace("2026-10-01 01:00:00", "")));
+        var observer = org.mockito.Mockito.mock(LingxingQuantityCapture.class);
+        var c = client(); c.setQuantityCapture(observer);
+        var result = c.locate(new LocateRequest("DO-DEMO", 1, 1), context());
+        org.mockito.Mockito.verifyNoInteractions(observer);
+        var data = mapper.readTree(body.get()).path("data");
+        assertThat(data.size()).isEqualTo(3);
+        assertThat(data.has("status")).isFalse(); assertThat(data.has("startTime")).isFalse();
+        assertThat(result.records().get(0).status()).isEqualTo(99);
+        assertThat(result.records().get(0).outboundTime()).isEmpty();
+        response.set(page("current", "size", 1, 1, 1, 1, ORDER.replace("DO-DEMO", "DO-DEMO-X")));
+        contract(() -> client().locate(new LocateRequest("DO-DEMO", 1, 1), context()), "LOCATE_DELIVERY_NO_MISMATCH");
+    }
+    @Test void exactEmptyExceptionKeepsSourceSizeAndNeverAppliesToInventory() {
+        response.set(page("current", "size", 1, 10, 0, 0, ""));
+        var result = client().queryPage(query(1, 100), context());
+        assertThat(result.records()).isEmpty(); assertThat(result.total()).isZero();
+        assertThat(result.size()).isEqualTo(100); assertThat(result.sourceSize()).isEqualTo(10);
+        contract(() -> client().queryPage(query(1, 99), context()), "SIZE_MISMATCH");
+        contract(() -> client().queryPage(query(2, 100), context()), "CURRENT_MISMATCH");
+        contract(() -> client().queryInventory(new InventoryQueryRequest("W-DEMO", 1, 100), context()), "SIZE_MISMATCH");
+        response.set(page("current", "size", 1, 10, 1, 1, ORDER));
+        contract(() -> client().queryPage(query(1, 100), context()), "SIZE_MISMATCH");
+    }
+    @Test void warehousesMapPageAndPageSizeWithoutTreatingTimezoneAsSource() throws Exception {
+        response.set(page("page", "pageSize", 1, 1000, 1, 1, """
+            {"whCode":"W-DEMO","whNameCn":"Demo","warehouseType":1,"status":0,"timeZone":"America/New_York","address":"private"}
+            """));
+        var result = client().queryWarehouses(new WarehouseQueryRequest(1, 1000), context());
+        assertThat(result.sourceSize()).isEqualTo(1000);
+        assertThat(result.records().get(0).timeZone()).isEqualTo("America/New_York");
+        assertThat(mapper.readTree(body.get()).path("data").size()).isEqualTo(2);
+        assertThat(path.get()).isEqualTo("/openapi/v2/warehouse/page");
+        assertThat(mapper.writeValueAsString(result)).doesNotContain("address");
+    }
+    @Test void detailPreservesDecimalLinesAndIgnoresPackageDuplicates() throws Exception {
+        response.set("""
+            {"code":200,"data":{"deliveryNo":"DO-DEMO","customerCode":"C-DEMO","whCode":"W-DEMO","status":100,
+            "orderCreateTime":"2026-09-01 01:00:00","outboundTime":"2026-10-01 01:00:00",
+            "skuVOList":[{"productSku":"SKU","actualDeliveryQty":2.123456,"deliveryQty":6},
+                         {"productSku":"SKU","actualDeliveryQty":3,"deliveryQty":6}],
+            "packageList":[{"skuList":[{"actualDeliveryQty":"5"}]}],"email":"private"}}
+            """);
+        var result = client().queryDetail(detail(), context());
+        assertThat(result.skuVOList()).hasSize(2);
+        assertThat(result.skuVOList().get(0).actualDeliveryQty()).isEqualByComparingTo("2.123456");
+        assertThat(result.orderCreateTime()).isEqualTo("2026-09-01 01:00:00");
+        assertThat(mapper.writeValueAsString(result.skuVOList())).doesNotContain("email", "packageList");
+        assertThat(mapper.readTree(body.get()).path("data").toString())
+            .isEqualTo("{\"whCode\":\"W-DEMO\",\"customerCode\":\"C-DEMO\",\"deliveryNo\":\"DO-DEMO\"}");
+        response.set(response.get().replace("W-DEMO", "OTHER"));
+        contract(() -> client().queryDetail(detail(), context()), "DETAIL_IDENTITY_MISMATCH");
+    }
+    @Test void cancelledDetailRetainsUnknownQuantityAndEmptyTime() {
+        response.set("""
+            {"code":200,"data":{"deliveryNo":"DO-DEMO","customerCode":"C-DEMO","whCode":"W-DEMO","status":99,
+            "outboundTime":"","skuVOList":[{"productSku":"SKU","actualDeliveryQty":"","deliveryQty":1}]}}
+            """);
+        var result = client().queryDetail(detail(), context());
+        assertThat(result.status()).isEqualTo(99); assertThat(result.outboundTime()).isEmpty();
+        assertThat(result.skuVOList().get(0).actualDeliveryQty()).isNull();
+    }
+    @Test void inventoryPreservesIndependentNumbersAndUnknownsAndRejectsDuplicates() throws Exception {
+        String stock = """
+            {"customerCode":"C-DEMO","whCode":"W-DEMO","productSku":"SKU","productQuality":0,
+             "stkQty":120.123456,"freezeQty":20,"useStkQty":100,"transitQty":30,"innerBatchNo":"",
+             "stockCompare":{"stkQty":999},"phone":"private"}
+            """;
+        response.set(page("current", "size", 1, 1000, 1, 1, stock));
+        var result = client().queryInventory(new InventoryQueryRequest("W-DEMO", 1, 1000), context());
+        assertThat(mapper.readTree(body.get()).path("data").toString())
+            .isEqualTo("{\"current\":1,\"size\":1000,\"whCode\":\"W-DEMO\",\"isHideInventory\":0}");
+        var row = result.records().get(0);
+        assertThat(row.stkQty()).isEqualByComparingTo("120.123456");
+        assertThat(row.useStkQty()).isEqualByComparingTo("100"); assertThat(row.transitQty()).isEqualByComparingTo("30");
+        assertThat(row.innerBatchNo()).isEmpty();
+        assertThat(mapper.writeValueAsString(result.records())).doesNotContain("phone", "stockCompare");
+        response.set(page("current", "size", 1, 1000, 1, 1, stock.replace("120.123456", "0")
+            .replace("\"freezeQty\":20", "\"freezeQty\":\"\"").replace("\"useStkQty\":100", "\"useStkQty\":null")
+            .replace("\"transitQty\":30", "\"transitQty\":-1")));
+        row = client().queryInventory(new InventoryQueryRequest("W-DEMO", 1, 1000), context()).records().get(0);
+        assertThat(row.stkQty()).isZero(); assertThat(row.freezeQty()).isNull(); assertThat(row.useStkQty()).isNull();
+        assertThat(row.transitQty()).isEqualByComparingTo("-1");
+        response.set(page("current", "size", 1, 1000, 2, 1, stock + "," + stock));
+        contract(() -> client().queryInventory(new InventoryQueryRequest("W-DEMO", 1, 1000), context()), "DUPLICATE_INVENTORY_KEY");
+        response.set(page("current", "size", 1, 1000, 1, 1, stock.replace("W-DEMO", "OTHER")));
+        contract(() -> client().queryInventory(new InventoryQueryRequest("W-DEMO", 1, 1000), context()), "INVENTORY_WAREHOUSE_MISMATCH");
+    }
+    @ParameterizedTest @ValueSource(strings = {"total", "pages", "current", "size"})
+    void missingPaginationIsRejected(String field) {
+        response.set(page("current", "size", 1, 1, 1, 1, ORDER).replace("\"" + field + "\":1,", ""));
+        contract(() -> client().queryPage(query(1, 1), context()), "");
+    }
+    @Test void shortPageAndWrongPageCountAreRejected() {
+        response.set(page("current", "size", 1, 2, 2, 1, ORDER));
+        contract(() -> client().queryPage(query(1, 2), context()), "PAGE_ROW_COUNT_MISMATCH");
+        response.set(page("current", "size", 1, 1, 1, 2, ORDER));
+        contract(() -> client().queryPage(query(1, 1), context()), "PAGES_MISMATCH");
+    }
+    @ParameterizedTest @ValueSource(ints = {401, 403, 302})
+    void nonretryableHttpNeverEchoesOrRetries(int code) {
+        status.set(code); response.set(PRIVATE);
+        var error = assertThrows(LingxingWmsException.class, () -> client().queryPage(query(1, 1), context()));
+        assertThat(error.retryable()).isFalse(); assertThat(error.getCause()).isNull();
+        assertThat(error.getMessage()).doesNotContain(PRIVATE); assertThat(calls.get()).isEqualTo(1);
+    }
+    @ParameterizedTest @ValueSource(ints = {429, 500, 503})
+    void everyFailureHasOneHttpAttemptAndNeverImplicitRetry(int code) {
+        status.set(code); response.set(PRIVATE);
+        var error = assertThrows(LingxingWmsException.class, () -> client().queryPage(query(1, 1), context()));
+        assertThat(calls.get()).isEqualTo(1);
+        assertThat(error.getMessage()).doesNotContain(PRIVATE);
+        assertThat(error.egress().actualHttpAttempts()).isEqualTo(1);
+        assertThat(completion.get().actualHttpAttempts()).isEqualTo(1);
+        assertThat(completion.get().upstreamStatus()).isEqualTo(code);
+    }
+    @ParameterizedTest @ValueSource(strings = {"600", "Mon, 12 Oct 2026 00:10:00 GMT", "invalid"})
+    void rateLimitPausesAccountAcrossAllEntrypointsAndReportsCooldown(String header) {
+        status.set(429); response.set(PRIVATE); retryAfter.set(header);
+        var client = client();
+        var error = assertThrows(LingxingWmsException.class, () -> client.queryPage(query(1, 1), context()));
+        assertThat(error.egress().accountPaused()).isTrue();
+        assertThat(error.egress().cooldownUntil()).isEqualTo(NOW.plusSeconds(header.equals("invalid") ? 300 : 600));
+        assertThat(completion.get().accountPaused()).isTrue();
+        assertThat(completion.get().cooldownUntil()).isEqualTo(error.egress().cooldownUntil());
+        assertThatThrownBy(() -> client.locate(new LocateRequest("DO-DEMO", 1, 1), context())).hasMessageContaining("ACCOUNT_PAUSED");
+        assertThatThrownBy(() -> client.queryWarehouses(new WarehouseQueryRequest(1, 1), context())).hasMessageContaining("ACCOUNT_PAUSED");
+        assertThatThrownBy(() -> client.queryDetail(detail(), context())).hasMessageContaining("ACCOUNT_PAUSED");
+        assertThatThrownBy(() -> client.queryInventory(new InventoryQueryRequest("W-DEMO", 1, 1), context())).hasMessageContaining("ACCOUNT_PAUSED");
+        assertThat(calls.get()).isEqualTo(1);
+    }
+    @Test void validationRejectsLargePageBeforeHttpOrBudget() {
+        var c = client(CollectionMode.VALIDATION, true, true);
+        assertThatThrownBy(() -> c.queryPage(query(1, 11), context(CollectionMode.VALIDATION))).hasMessageContaining("参数");
+        assertThatThrownBy(() -> c.locate(new LocateRequest("DO-DEMO", 1, 11), context(CollectionMode.VALIDATION))).hasMessageContaining("参数");
+        assertThatThrownBy(() -> c.queryWarehouses(new WarehouseQueryRequest(1, 11), context(CollectionMode.VALIDATION))).hasMessageContaining("参数");
+        assertThatThrownBy(() -> c.queryInventory(new InventoryQueryRequest("W-DEMO", 1, 11), context(CollectionMode.VALIDATION))).hasMessageContaining("参数");
+        assertThat(calls.get()).isZero(); assertThat(completion.get()).isNull();
+    }
+    @Test void validationNeverRetriesEvenServerError() {
+        status.set(503); response.set(PRIVATE);
+        assertThrows(LingxingWmsException.class, () -> client(CollectionMode.VALIDATION, true, true)
+            .queryPage(query(1, 1), context(CollectionMode.VALIDATION)));
+        assertThat(calls.get()).isEqualTo(1);
+    }
+    @ParameterizedTest @ValueSource(strings = {"31001", "\"429\""})
+    void businessRateLimitCodesPauseWithoutHttpRetry(String sourceCode) {
+        response.set("{\"code\":" + sourceCode + ",\"msg\":\"" + PRIVATE + "\"}");
+        var c = client();
+        var error = assertThrows(LingxingWmsException.class, () -> c.queryPage(query(1, 1), context()));
+        assertThat(error.egress().actualHttpAttempts()).isEqualTo(1); assertThat(error.egress().accountPaused()).isTrue();
+        assertThat(completion.get().sourceCode()).isIn(31001, 429);
+        assertThatThrownBy(() -> c.queryDetail(detail(), context())).hasMessageContaining("ACCOUNT_PAUSED");
+        assertThat(calls.get()).isEqualTo(1); assertThat(error.getMessage()).doesNotContain(PRIVATE);
+    }
+    @Test void allFiveEntrypointsRequireControlContext() {
+        var c = client();
+        assertThrows(LingxingWmsException.class, () -> c.queryPage(query(1, 1), null));
+        assertThrows(LingxingWmsException.class, () -> c.locate(new LocateRequest("DO-DEMO", 1, 1), null));
+        assertThrows(LingxingWmsException.class, () -> c.queryDetail(detail(), null));
+        assertThrows(LingxingWmsException.class, () -> c.queryWarehouses(new WarehouseQueryRequest(1, 1), null));
+        assertThrows(LingxingWmsException.class, () -> c.queryInventory(new InventoryQueryRequest("W-DEMO", 1, 1), null));
+        assertThat(calls.get()).isZero(); assertThat(completion.get()).isNull();
+    }
+    @Test void allFiveEntrypointsFailClosedForOffMissingGrantOrBudget() {
+        for (var c : new LingxingWmsClient[] {client(CollectionMode.OFF, true, true),
+                client(CollectionMode.BUSINESS, false, true), client(CollectionMode.BUSINESS, true, false)}) {
+            assertThrows(LingxingWmsException.class, () -> c.queryPage(query(1, 1), context()));
+            assertThrows(LingxingWmsException.class, () -> c.locate(new LocateRequest("DO-DEMO", 1, 1), context()));
+            assertThrows(LingxingWmsException.class, () -> c.queryWarehouses(new WarehouseQueryRequest(1, 1), context()));
+            assertThrows(LingxingWmsException.class, () -> c.queryDetail(detail(), context()));
+            assertThrows(LingxingWmsException.class, () -> c.queryInventory(new InventoryQueryRequest("W-DEMO", 1, 1), context()));
+        }
+        assertThat(calls.get()).isZero(); assertThat(completion.get()).isNull();
+    }
+    @ParameterizedTest @ValueSource(strings = {"\"11006\"", "11008", "\"200\"", "null"})
+    void rejectedEnvelopesNeverEchoRawMessage(String code) {
+        response.set("{\"code\":" + code + ",\"msg\":\"" + PRIVATE + "\"}");
+        var error = assertThrows(LingxingWmsException.class, () -> client().queryPage(query(1, 1), context()));
+        assertThat(error.getMessage()).doesNotContain(PRIVATE); assertThat(error.getCause()).isNull();
+        assertThat(calls.get()).isEqualTo(1);
+    }
+    @ParameterizedTest @ValueSource(strings = {"false", "null", "\"true\""})
+    void presentSuccessMustBeBooleanTrue(String success) {
+        response.set(page("current", "size", 1, 1, 1, 1, ORDER).replace("\"code\":200", "\"code\":200,\"success\":" + success));
+        assertThrows(LingxingWmsException.class, () -> client().queryPage(query(1, 1), context()));
+    }
+    private InventoryFlowRequest flow() {return new InventoryFlowRequest("W-DEMO","C-DEMO","SKU-DEMO",
+        LocalDateTime.of(2026,9,14,8,0),LocalDateTime.of(2026,10,14,8,0));}
+    @Test void flowUsesExactScopeSinglePageAndPreservesSignedChangeAndLargeId() throws Exception {
+        response.set(page("current","size",1,1000,1,1,"""
+            {"id":"9223372036854775806","customerCode":"C-DEMO","whCode":"W-DEMO","productSku":"SKU-DEMO",
+             "productQuality":0,"bookQty":-3,"bookChangQty":"-3","closeQty":17,"createTime":"2026-10-13 12:00:00"}
+            """));
+        var result=client().queryInventoryFlow(flow(),context());
+        assertThat(path.get()).isEqualTo("/openapi/v2/stock/stockCellBook/page");
+        var sent=mapper.readTree(body.get()).path("data");
+        assertThat(sent.path("barcodeAccurate").asText()).isEqualTo("SKU-DEMO");
+        assertThat(sent.path("size").asInt()).isEqualTo(1000);assertThat(sent.has("productQuality")).isFalse();
+        assertThat(result.records().get(0).id()).isEqualTo("9223372036854775806");
+        assertThat(result.records().get(0).productQuality()).isZero();
+        assertThat(result.records().get(0).bookQty()).isEqualByComparingTo("-3");
+        assertThat(result.records().get(0).bookChangQty()).isEqualTo("-3");assertThat(calls.get()).isEqualTo(1);
+        assertThat(completion.get().operation()).isEqualTo(Operation.INVENTORY_FLOW);
+    }
+    @Test void flowRejectsNumericIdInsteadOfCoercingUnverifiedSourceTypes() {
+        response.set(page("current","size",1,1000,1,1,"""
+            {"id":123,"customerCode":"C-DEMO","whCode":"W-DEMO","productSku":"SKU-DEMO",
+             "productQuality":0,"bookQty":-1,"bookChangQty":"-1","closeQty":9}
+            """));
+        contract(()->client().queryInventoryFlow(flow(),context()),"TEXT_FIELD_TYPE_NUMBER");
+    }
+    @Test void flowAcceptsVerifiedEmptyFirstPageAndPreservesSourcePagination() {
+        response.set(page("current","size",1,10,0,0,""));
+        var result=client().queryInventoryFlow(flow(),context());
+        assertThat(result.records()).isEmpty();
+        assertThat(result.total()).isZero();
+        assertThat(result.current()).isEqualTo(1);
+        assertThat(result.size()).isEqualTo(1000);
+        assertThat(result.sourceSize()).isEqualTo(10);
+        assertThat(calls.get()).isEqualTo(1);
+        assertThat(completion.get().operation()).isEqualTo(Operation.INVENTORY_FLOW);
+    }
+    @Test void flowEmptyExceptionDoesNotAcceptNonemptyOrMalformedPagination() {
+        var c=client();
+        response.set(page("current","size",1,10,1,1,"{}"));
+        contract(()->c.queryInventoryFlow(flow(),context()),"SIZE_MISMATCH");
+        response.set(page("current","size",2,10,0,0,""));
+        contract(()->c.queryInventoryFlow(flow(),context()),"CURRENT_MISMATCH");
+        response.set(page("current","size",1,10,0,1,""));
+        contract(()->c.queryInventoryFlow(flow(),context()),"SIZE_MISMATCH");
+        response.set(page("current","size",1,20,0,0,""));
+        contract(()->c.queryInventoryFlow(flow(),context()),"SIZE_MISMATCH");
+    }
+    @Test void flowEmptyExceptionDoesNotRelaxInventoryOrOtherOutboundSizes() {
+        var c=client();response.set(page("current","size",1,10,0,0,""));
+        contract(()->c.queryInventory(new InventoryQueryRequest("W-DEMO",1,1000),context()),"SIZE_MISMATCH");
+        contract(()->c.queryPage(query(1,20),context()),"SIZE_MISMATCH");
+    }
+    @Test void flowPermissionDenialIsScopedAndDoesNotStopOrdinaryQueries() {
+        var c=client();response.set("{\"code\":11008,\"msg\":\"private\"}");
+        var error=assertThrows(LingxingWmsException.class,()->c.queryInventoryFlow(flow(),context()));
+        assertThat(error.code()).isEqualTo("LINGXING_WMS_FLOW_PERMISSION_DENIED");
+        assertThat(completion.get().accountPaused()).isFalse();
+        response.set(page("current","size",1,1,1,1,ORDER));
+        assertThat(c.queryPage(query(1,1),context()).records()).hasSize(1);assertThat(calls.get()).isEqualTo(2);
+    }
+    @Test void flowRejectsUnboundedWindowBeforeSendingAndWrongSkuAfterResponse() {
+        var q=flow();var c=client();
+        assertThrows(LingxingWmsException.class,()->c.queryInventoryFlow(new InventoryFlowRequest(q.warehouseCode(),q.customerCode(),q.sku(),q.startTime(),q.startTime().plusDays(32)),context()));
+        assertThat(calls.get()).isZero();
+        response.set(page("current","size",1,1000,1,1,"{\"whCode\":\"W-DEMO\",\"customerCode\":\"C-DEMO\",\"productSku\":\"OTHER\"}"));
+        contract(()->c.queryInventoryFlow(q,context()),"FLOW_IDENTITY_MISMATCH");
+    }
+    private LingxingWmsClient client() { return client(CollectionMode.BUSINESS, true, true); }
+    private LingxingWmsClient client(CollectionMode mode, boolean grant, boolean budget) {
+        var clock = new LingxingEgressGateTest.MutableClock(NOW);
+        var p = new LingxingWmsProperties(true, URI.create("http://127.0.0.1:" + server.getAddress().getPort()),
+            "synthetic-key", "synthetic-secret", Duration.ofSeconds(2), Duration.ofSeconds(2));
+        var props = new LingxingEgressProperties(mode, "production", "demo-account", grant ? "demo-grant" : null,
+            NOW.plusSeconds(3600), budget ? URI.create("http://127.0.0.1") : null, null, null, false);
+        var ledger = new LingxingEgressGateTest.LedgerAuthority(clock) {
+            @Override public void complete(CompletionRequest request) { super.complete(request); completion.set(request); }
+        };
+        var gate = new LingxingEgressGate(props, ledger, clock, clock::advanceMillis);
+        return new LingxingWmsClient(p, mapper, clock, gate);
+    }
+    private EgressContext context() { return context(CollectionMode.BUSINESS); }
+    private EgressContext context(CollectionMode mode) {
+        return new EgressContext("demo-account", mode, "demo-root", "demo-session", "attempt-" + attempts.incrementAndGet(), "demo-grant");
+    }
+    private static QueryRequest query(int current, int size) {
+        var end = LocalDateTime.of(2026, 10, 12, 8, 0); return new QueryRequest(end.minusMonths(1), end, current, size);
+    }
+    private static DetailRequest detail() { return new DetailRequest("W-DEMO", "C-DEMO", "DO-DEMO"); }
+    private static String page(String c, String s, int current, int size, long total, int pages, String rows) {
+        return "{\"code\":200,\"data\":{\"" + c + "\":" + current + ",\"" + s + "\":" + size
+            + ",\"total\":" + total + ",\"pages\":" + pages + ",\"records\":[" + rows + "]}}";
+    }
+    private static void contract(Runnable action, String stage) {
+        var error = assertThrows(LingxingWmsException.class, action::run);
+        assertThat(error.code()).isEqualTo("LINGXING_WMS_INVALID_RESPONSE");
+        assertThat(error.getMessage()).contains(stage).doesNotContain(PRIVATE); assertThat(error.retryable()).isFalse();
+    }
+}
diff --git a/integration-service/src/test/java/com/baiyue/integration/provider/lingxing/LingxingWmsSignerTest.java b/integration-service/src/test/java/com/baiyue/integration/provider/lingxing/LingxingWmsSignerTest.java
new file mode 100644
index 000000000..a6eb7b538
--- /dev/null
+++ b/integration-service/src/test/java/com/baiyue/integration/provider/lingxing/LingxingWmsSignerTest.java
@@ -0,0 +1,90 @@
+package com.baiyue.integration.provider.lingxing;
+
+import com.baiyue.integration.config.LingxingWmsProperties;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.fasterxml.jackson.databind.SerializationFeature;
+import org.junit.jupiter.api.Test;
+import org.springframework.boot.context.properties.bind.Bindable;
+import org.springframework.boot.context.properties.bind.Binder;
+import org.springframework.boot.context.properties.source.MapConfigurationPropertySource;
+
+import javax.crypto.Mac;
+import javax.crypto.spec.SecretKeySpec;
+import java.net.URI;
+import java.nio.charset.StandardCharsets;
+import java.time.Duration;
+import java.time.Instant;
+import java.util.ArrayList;
+import java.util.HexFormat;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
+
+class LingxingWmsSignerTest {
+    @Test
+    void matchesOfficialOmpParameterRenderingIncludingNamesPathAndBothSecrets() throws Exception {
+        var mapper = new ObjectMapper().enable(SerializationFeature.INDENT_OUTPUT);
+        var signer = new LingxingWmsSigner(mapper);
+        var data = new LinkedHashMap<String, Object>();
+        data.put("status", 0);
+        data.put("current", 1);
+        data.put("size", 10);
+        var signed = signer.sign("YOUR_APP_KEY", "YOUR_APP_SECRET", "/openapi/v2/customer/list", data,
+            Instant.ofEpochSecond(1790056664));
+        var body = mapper.readTree(signed.body());
+        String officialInput = "YOUR_APP_SECRET/openapi/v2/customer/listappKeyYOUR_APP_KEYdata{status=0, current=1, size=10}timestamp1790056664YOUR_APP_SECRET";
+        assertThat(body.path("sign").textValue()).isEqualTo(hmac("YOUR_APP_SECRET", officialInput));
+        var fieldNames = new ArrayList<String>();
+        body.path("data").fieldNames().forEachRemaining(fieldNames::add);
+        assertThat(fieldNames).containsExactly("status", "current", "size");
+        assertThat(signed.body()).doesNotContain("\n", "YOUR_APP_SECRET", "authcode", "reqTime");
+        assertThat(signed.toString()).doesNotContain("YOUR_APP_KEY", "YOUR_APP_SECRET", body.path("sign").textValue());
+    }
+
+    @Test
+    void nestedDataUsesTransmittedOrderAndMapListValueSyntax() throws Exception {
+        var mapper = new ObjectMapper();
+        var signer = new LingxingWmsSigner(mapper);
+        var child = new LinkedHashMap<String, Object>();
+        child.put("z", "中文");
+        child.put("A", 2);
+        var data = new LinkedHashMap<String, Object>();
+        data.put("items", List.of(child));
+        var signed = signer.sign("key", "secret", "/openapi/v2/customer/list", data, Instant.ofEpochSecond(1770000000));
+        String input = "secret/openapi/v2/customer/listappKeykeydata{items=[{z=中文, A=2}]}timestamp1770000000secret";
+        assertThat(mapper.readTree(signed.body()).path("sign").textValue()).isEqualTo(hmac("secret", input));
+    }
+
+    @Test
+    void propertiesBindWmsOnlyAndRedactBothCredentials() {
+        var source = new MapConfigurationPropertySource(Map.of(
+            "baiyue.integration.lingxing-wms.enabled", "true",
+            "baiyue.integration.lingxing-wms.app-key", "example-key",
+            "baiyue.integration.lingxing-wms.app-secret", "example-secret"));
+        var properties = new Binder(source).bind("baiyue.integration.lingxing-wms", Bindable.of(LingxingWmsProperties.class)).get();
+        assertThat(properties.enabled()).isTrue();
+        assertThat(properties.hasCredentials()).isTrue();
+        assertThat(properties.baseUri()).isEqualTo(URI.create("https://api.xlwms.com"));
+        assertThat(properties.connectTimeout()).isEqualTo(Duration.ofSeconds(5));
+        assertThat(properties.requestTimeout()).isEqualTo(Duration.ofSeconds(15));
+        assertThat(properties.toString()).doesNotContain("example-key", "example-secret");
+    }
+
+    @Test
+    void disabledIsDefaultAndPlainHttpOutsideLoopbackIsRejected() {
+        var properties = new LingxingWmsProperties(false, null, null, null, null, null);
+        assertThat(properties.enabled()).isFalse();
+        assertThat(properties.hasCredentials()).isFalse();
+        assertThatThrownBy(() -> new LingxingWmsProperties(true, URI.create("http://example.test"), "key", "secret", null, null))
+            .isInstanceOf(IllegalArgumentException.class);
+    }
+
+    private static String hmac(String key, String input) throws Exception {
+        Mac mac = Mac.getInstance("HmacSHA256");
+        mac.init(new SecretKeySpec(key.getBytes(StandardCharsets.UTF_8), "HmacSHA256"));
+        return HexFormat.of().formatHex(mac.doFinal(input.getBytes(StandardCharsets.UTF_8)));
+    }
+}
diff --git a/lastleg-service/AGENTS.md b/lastleg-service/AGENTS.md
index 96083fde7..6e6fbc6e6 100644
--- a/lastleg-service/AGENTS.md
+++ b/lastleg-service/AGENTS.md
@@ -1,5 +1,10 @@
 # Lastleg Service 模块指引
 
+## 数据库访问与中文注释约束
+
+- 强制遵守根 `../AGENTS.md` 的“数据库访问与中文代码注释”全部规则：正常业务访问统一为 `Controller → Service → Repository → Mapper`，不得省略 Repository 或跨层直调；生产 SQL 由 Mapper 执行，Repository 不得直接使用 JdbcTemplate 或原生 JDBC。非 HTTP 入口从 Service 进入；无数据库模块不引入数据库访问。
+- 每个手写方法及构造器须有简短中文说明；核心业务规则、复杂 SQL、事务、锁、幂等、并发及失败处理须补充适量中文注释，重点说明原因和边界。新增、修改方法立即执行，触及的存量代码同步整改。
+
 ## 职责与边界
 
 - Mapper 必须标注 `@Mapper`，仅由 `BaiyueLastlegApplication.java` 对 `com.baiyue.lastleg` 根包按 `annotationClass = Mapper.class` 扫描；禁止局部 `*MapperConfiguration` 和包白名单。验证：`scripts/mapper-scan-contract.mjs`、`MapperRegistrationArchitectureTest.java`。
@@ -22,6 +27,7 @@
 | 功能 | 首个入口 |
 |---|---|
 | 内部模块化基线与依赖分析 | `docs/lastleg-internal-modularization-baseline.md` |
+| 自营领星统计 | `selfoperated/analytics/`；平台入口 `controller/PlatformAnalyticsController.java`，契约见 `../../docs/自营业务/README.md`；权限源 `../iam/src/main/resources/db/selfoperated-analytics-permissions.sql`。 |
 | 订单查询与控制 / 导出 | `controller/LastlegOrderController.java`；异步导出见 `export/` 与 `lastleg-exports-v1.yaml` |
 | 尾程订单完整计划、柜级到仓时间、暂扣与人工节点 | `controller/LastlegOrderController.java` |
 | 客户尾程订单列表与详情 | `controller/MerchantLastlegOrderController.java` |
@@ -105,17 +111,7 @@
 
 ## 数据库表索引与注释约束
 
-| 业务域 | 表名 | 中文含义 |
-|---|---|---|
-| 车次外接 | `ll_fleet_external_booking` | 外接询价、约定报价与承运容量预订；历史进入车次历史快照 |
-| 核心订单与事件 | `ll_loading_*`、`ll_event_*`、`ll_order*`、`ll_inbound_order*` | 事件收件/发件、尾程订单、明细及状态历史 |
-| 入仓计划与作业 | `ll_inbound_plan*`、`ll_inbound_pda*`、`ll_inbound_pallet_merge`、`ll_inbound_fba_appointment*` | 入仓计划、托盘分配、PDA 作业、合托及 FBA 预约 |
-| 库存 | `ll_inventory_*`、`ll_inbound_stock_receipt`、`ll_return_stock_receipt` | 库存余额、仓位、流水、幂等及原入仓/退回实收来源；同托多票数量逐明细核平，重派按实际退回凭据扣减额度 |
-| 派车与出库 | `ll_dispatch_*`、`ll_outbound_*`、`ll_delivery_order` | 派车、PDA 拣货、出库及派送 |
-| 转仓与换标 | `ll_warehouse_transfer_*`、`ll_relabel_*` | 转仓单、库存转移、目标收货及换标 |
-| 一件代发与废弃 | `ll_dropship_*`、`ll_cargo_discard_*` | 托盘/箱唛库存、流水和废弃审批 |
-| 采购、卡车与本土散板 | `ll_overseas_procurement_*`、`ll_us_truck_*`、`ll_local_looseboard_*` | 海外采购、美国卡车运输及本土散板订单 |
-| 通用资料 | `ll_overseas_quote*`、`ll_monthly_exchange_rate*`、`ll_vehicle` | 海外仓报价、月度汇率及车辆档案；不保存车辆派送履约历史 |
+表名与中文含义按需查 `docs/business-index.md` 的“数据库表索引”；修改约束如下。
 
 - 新增或修改表时，表 `COMMENT` 和每个普通字段的 `COMMENT` 必须填写准确的中文业务含义，不得只写英文、字段名或类型名。
 - `SchemaChineseCommentContractTest` 自动扫描全部 `ll_` 表，无需维护表名白名单；新增字段必须同步更新基线 SQL、建表增量和存量备注迁移，增量脚本的 `ADD/MODIFY COLUMN` 不得丢失中文备注。
diff --git a/lastleg-service/docs/business-index.md b/lastleg-service/docs/business-index.md
index 72fbaa3bf..0ec4d6a1e 100644
--- a/lastleg-service/docs/business-index.md
+++ b/lastleg-service/docs/business-index.md
@@ -44,7 +44,7 @@
 | 派送完成回传 | `delivery/service/DeliveryCompletedOutboxService.java`；签收资料保存并自动完成时在业务事务内按关联 `sourceInboundId` 分别写 `OVERSEAS_DELIVERY_COMPLETED` Outbox，同车不同 FBA 派送单互不代完成；不保留人工完成入口 |
 | 入仓后 SKU 库存余额、库位和流水 | `inventory/`；平台只读查询与非出库库存命令分别从 `inventory/query/controller/InventoryQueryController.java`、`inventory/command/controller/InventoryCommandController.java` 进入 |
 | 海外PDA盘点、同仓整托移库、托盘组拆换绑与换标现场作业 | `pda/stocktake/`、`pda/move/`、`palletops/`、`relabel/pda/`；版本化契约 `src/main/resources/openapi/overseas-pda-operations-v1.yaml`；全部范围取自PDA Token，排车和出库使用独立 PDA Controller |
-| 贴标申请、箱唛/SKU/组合换标与 PDA 完工 | `relabel/`、`relabel/pda/`；一条 `ll_relabel_item` 对应一个客户填写的我方箱唛任务，`CARTON_LABEL`、`SKU_LABEL`、`CARTON_AND_SKU` 分别保存箱唛、SKU 或组合需求，SKU 子项 JSON 数量按件；涉及箱唛换标时整张申请只能有一个 FBA 目的仓，服务端拒绝明细目的仓不一致的请求。普通尾程入库没有箱唛到实物托盘的精确快照，历史入仓库存仓位只能作为冻结记账锚点和现场大概位置，禁止把该仓位解释为箱唛已绑定具体托盘。库存只按箱任务冻结一次。涉及箱唛换标时申请必须选择 `TRUCK/EXPRESS/TRUCK_PICKUP/EXPRESS_PICKUP`，两种快递方式可要求打印并上传面单；PDA 扫我方箱唛完成逐箱事实和照片，仓库复核后等待客户查看照片确认。对外换标状态只投影为 `PENDING_PROCESSING/COMPLETED`（待处理/换标完成），`PROCESSING`、`CUSTOMER_CONFIRM_PENDING`、`READY_FOR_OUTBOUND` 只属于内部作业节点且不得直接出现在业务列表；客户确认后仅卡车派送进入 `WAIT_PRE_DISPATCH`，快递派送和两种自提直接创建换标出库单。客户确认前不得进入出库 |
+| 贴标申请、箱唛/SKU/组合换标与 PDA 完工 | `relabel/`、`relabel/pda/`；一条 `ll_relabel_item` 对应一个客户填写的我方箱唛任务，`CARTON_LABEL`、`SKU_LABEL`、`CARTON_AND_SKU` 分别保存箱唛、SKU 或组合需求，SKU 子项 JSON 数量按件；涉及箱唛换标时整张申请只能有一个 FBA 目的仓，服务端拒绝明细目的仓不一致的请求。普通尾程入库没有箱唛到实物托盘的精确快照，历史入仓库存仓位只能作为冻结记账锚点和现场大概位置，禁止把该仓位解释为箱唛已绑定具体托盘。库存只按箱任务冻结一次。涉及箱唛换标时申请必须选择 `TRUCK/EXPRESS/PICKUP/AMAZON_PICKUP/CUSTOMER_PICKUP`，仅快递方式可要求打印并上传面单；PDA 扫我方箱唛完成逐箱事实和照片，仓库复核后等待客户查看照片确认。对外换标状态只投影为 `PENDING_PROCESSING/COMPLETED`（待处理/换标完成），`PROCESSING`、`CUSTOMER_CONFIRM_PENDING`、`READY_FOR_OUTBOUND` 只属于内部作业节点且不得直接出现在业务列表；客户确认后仅平台卡车 `TRUCK` 进入 `WAIT_PRE_DISPATCH`；快递及普通自提、亚马逊自提、客户自提均直接创建换标出库单，普通库存仍复验实际托盘绑定，已分配仓储转运保留原转运出库链。客户确认前不得进入出库 |
 | PDA 仓内通用扫码与操作历史 | `pda/warehouse/controller/PdaWarehouseController.java`、`pda/warehouse/service/PdaWarehouseService.java`；解析库存、库位和托盘码并查询操作历史，固定要求 `lastleg:pda:operate` 与 `ROLE_WAREHOUSE_PICKER`，仓库范围只能取自 PDA Token |
 | 船节点接收与海外 PDA 可收货门禁 | `shipping/service/ContainerShippingNodeConsumer.java`、`shipping/entity/ContainerShippingGate.java`、`shipping/mapper/ContainerShippingGateMapper.java`；按 `containerBookingId` 柜级接收，信封使用 `tenantId=0` 且门禁不存客户；只单调接受实际标准节点，`PICKUP_READY` 及以后才允许对应柜进入 PDA 收货候选 |
 | 平台排车列表/详情与智能预排 | `dispatch/controller/DispatchQueryController.java`、`SmartDispatchController.java`、`dispatch/mapper/DispatchCandidateMapper.java`、`dispatch/service/DispatchService.java`；草稿柜 `entity/DispatchDraftContainer.java`、`mapper/DispatchDraftContainerMapper.java`，托盘锁 `DispatchPalletLock.java`；入口 `/api/platform/v1/last-leg/dispatches`，路线由当前已排托盘的 FBA 仓编码去重后按稳定顺序以英文逗号连接，预排与普通编辑请求均不接收路线；查询、预排与执行边界见“海外仓全流程开发路由” |
@@ -66,3 +66,17 @@
 | 数据库基线、表索引与中文注释契约 | `src/main/resources/db/lastleg.sql`、`src/test/java/com/baiyue/lastleg/schema/SchemaChineseCommentContractTest.java` |
 | 测试 | `src/test/java/com/baiyue/lastleg/` |
 | 真实事件消费验收 | `src/test/java/com/baiyue/lastleg/service/TaillegRealConsumerAcceptanceTest.java`；覆盖真实 V2 建单、独立入仓单快照及下游转运/换标可消费性 |
+
+## 数据库表索引
+
+| 业务域 | 表名 | 中文含义 |
+|---|---|---|
+| 车次外接 | `ll_fleet_external_booking` | 外接询价、约定报价与承运容量预订；历史进入车次历史快照 |
+| 核心订单与事件 | `ll_loading_*`、`ll_event_*`、`ll_order*`、`ll_inbound_order*` | 事件收件/发件、尾程订单、明细及状态历史 |
+| 入仓计划与作业 | `ll_inbound_plan*`、`ll_inbound_pda*`、`ll_inbound_pallet_merge`、`ll_inbound_fba_appointment*` | 入仓计划、托盘分配、PDA 作业、合托及 FBA 预约 |
+| 库存 | `ll_inventory_*`、`ll_inbound_stock_receipt`、`ll_return_stock_receipt` | 库存余额、仓位、流水、幂等及原入仓/退回实收来源；同托多票数量逐明细核平，重派按实际退回凭据扣减额度 |
+| 派车与出库 | `ll_dispatch_*`、`ll_outbound_*`、`ll_delivery_order` | 派车、PDA 拣货、出库及派送 |
+| 转仓与换标 | `ll_warehouse_transfer_*`、`ll_relabel_*` | 转仓单、库存转移、目标收货及换标 |
+| 一件代发与废弃 | `ll_dropship_*`、`ll_cargo_discard_*` | 托盘/箱唛库存、流水和废弃审批 |
+| 采购、卡车与本土散板 | `ll_overseas_procurement_*`、`ll_us_truck_*`、`ll_local_looseboard_*` | 海外采购、美国卡车运输及本土散板订单 |
+| 通用资料 | `ll_overseas_quote*`、`ll_monthly_exchange_rate*`、`ll_vehicle` | 海外仓报价、月度汇率及车辆档案；不保存车辆派送履约历史 |
diff --git a/lastleg-service/docs/lastleg-internal-modularization-baseline.md b/lastleg-service/docs/lastleg-internal-modularization-baseline.md
index 3be67471e..68b4e6ef4 100644
--- a/lastleg-service/docs/lastleg-internal-modularization-baseline.md
+++ b/lastleg-service/docs/lastleg-internal-modularization-baseline.md
@@ -7,11 +7,23 @@
 现行门禁为 `scripts/analyze-lastleg-dependencies.mjs`、对应 `.test.mjs` 和 `src/test/resources/architecture/lastleg-slice-dependencies.json`。下文第2至8节的规模、原安全投影和首切片说明保留为早期对比，不覆盖本节及当前正式统一认证契约。此次校正不修改既有跨业务流程，也不以新增模块级通配许可接受未知依赖。
 
 - 统一认证使用common-security及Auth权威会话。旧6个LastlegSecurity投影类型不再要求存在，改为禁止恢复该切片及引用其退役类型；不存在的退役类被重新import也会失败。
-- 25条已核对的既有类引用逐条写入 `reviewedClassDependencies`，必须有完整源类、目标类及原因，拒绝通配符。尾程订单直接换标审核委托换标服务；退货实收转换标在同服务事务中建立申请及明细；仓储转运实测入仓同步计划/分配/收货事实并复用资源网关；PDA入口共用冻结仓身份；费用换算只由既有换算器读取月度汇率。此记录不授权同一模块其他类使用这些实现。
+- 已核对的既有类引用逐条写入 `reviewedClassDependencies`，必须有完整源类、目标类及原因，拒绝通配符。尾程订单直接换标审核委托换标服务；退货实收转换标在同服务事务中建立申请及明细；仓储转运实测入仓同步计划/分配/收货事实并复用资源网关；PDA入口共用冻结仓身份；费用换算只由既有换算器读取月度汇率。此记录不授权同一模块其他类使用这些实现。
 - 未审阅的新增类引用仍按原切片门禁拦截；车辆应用层的向内依赖规则对所有引用执行，不能通过逐类记录绕过。fleet继续只消费车辆应用端口/服务，不读取车辆持久化适配器。
 - 主源码禁止包循环。`DeliveryDocumentSnapshot` 是DTO快照解析和摘要装配，已从 `delivery/model` 移至 `delivery/service`，消除原DTO与model互相引用；枚举及公开JSON结构不变。不为循环设长期例外。
 - 离线反向测试覆盖未授权新消费者、退役类型恢复/引用、通配记录、绕过车辆应用层和新增包环。通过门禁只证明这些结构规则，不证明消除了所有存量耦合或完成部署/业务验收。
 
+### 预约、车队与导出依赖收口（2026-10-12）
+
+- 预约规划只声明 `AppointmentSourceLinker` 端口；入仓域负责创建入口与关联明细实现，入仓请求声明自己的来源 DTO，再映射到规划模型。公开 JSON、事务及来源校验保持不变，规划包不反向依赖入仓实现。
+- 车队商业单使用本域的收货证据和签收快照；派送域实现车队声明的证据端口并提供完整签收事实，车队不再导入派送实体、Mapper 或完成策略。商业单编号保持原 LB/TR 规则，由本域生成；`fleet.business` 不反向依赖 `fleet.trip`。既有散板、卡车商业单的同库写入不在此次拆分范围，本次门禁通过不代表完成全域解耦。
+- 退货客户引用与转仓 FBA 目录各由本域内部客户端读取原权威服务，移除对车队客户端的借用；接口、令牌及 URL 配置不变。退货合箱共用 PDA 仓身份、转仓实收共用仓储资源网关，两条精确类边在基线中登记。
+- 平台导出作为组合入口，仅登记 `LastlegExportProviderService` 对 12 个公开查询服务与 DTO/投影的引用，不开放整个切片；车辆仍限应用层。排车规划适配器只使用车队公开规划和收货端口。采购对海外主数据的旧依赖已不存在，移除该旧许可及入向断言。
+- 反向检查继续拒绝新消费者、导出直连持久化、车辆应用层外向依赖和任何主源码包循环。分析器继续按既有显式 import、静态 import 及同包类型引用规则检查；本次不改变其识别范围。
+
+### 平台自营统计边界
+
+`selfoperated/analytics/` 在依赖分析器中作为独立 `selfoperated-analytics` 切片优先匹配，其 `outbound`、`inventory` 和 `model` 子包不归入客户出库、客户库存或尾程交接切片。该子域通过内部 HTTP 使用 Integration，持久化十张独立 `ll_selfop_*` 表，不引用现有客户履约实体或 Mapper。唯一基础能力引用为 `SelfopEgressController → security.InternalServiceTokenGuard`，复用内部令牌校验；基线仅登记此精确类边，不增加共享技术切片通配许可，包循环仍按同一门禁拒绝。
+
 ### 车次接入边界
 
 车次关联客户排车单新增 `dispatch-delivery→fleet`：fleet声明 `FleetDispatchGateway`，dispatch内适配器锁定自身排车/出库/派送并同步车和司机快照；子排车修改与发车使用fleet公开的关联门禁。fleet不导入dispatch实体、Mapper或业务服务，因此不新增双向切片依赖。车次与客户单据的归属不变，关联和同步处于同一Lastleg事务；客户单据已经开工时不允许通过改派覆盖执行事实。
diff --git a/lastleg-service/scripts/analyze-lastleg-dependencies.mjs b/lastleg-service/scripts/analyze-lastleg-dependencies.mjs
index cd4f87a92..b051f695d 100644
--- a/lastleg-service/scripts/analyze-lastleg-dependencies.mjs
+++ b/lastleg-service/scripts/analyze-lastleg-dependencies.mjs
@@ -13,6 +13,7 @@ const sourceRoots = {
 const internalPrefix = 'com.baiyue.lastleg.';
 
 const sliceRules = [
+  ['selfoperated-analytics', /^com\.baiyue\.lastleg\.selfoperated\.analytics(?:\.|$)/],
   ['fleet', /^com\.baiyue\.lastleg\.fleet(?:\.|$)/],
   ['security-projection', /(?:^|\.)security\.(?:controller|dto|service)(?:\.|$)/],
   ['dispatch-delivery', /(?:^|\.)(?:dispatch|delivery|outbound)(?:\.|$)/],
diff --git a/lastleg-service/scripts/analyze-lastleg-dependencies.test.mjs b/lastleg-service/scripts/analyze-lastleg-dependencies.test.mjs
index d1adbc7cd..404ea68be 100644
--- a/lastleg-service/scripts/analyze-lastleg-dependencies.test.mjs
+++ b/lastleg-service/scripts/analyze-lastleg-dependencies.test.mjs
@@ -10,6 +10,29 @@ const analyzer = path.join(moduleRoot, 'scripts', 'analyze-lastleg-dependencies.
 const contract = path.join(moduleRoot, 'src', 'test', 'resources', 'architecture', 'lastleg-slice-dependencies.json');
 const vehiclePrefix = 'com.baiyue.lastleg.masterdata.vehicle';
 
+test('selfoperated analytics is independent of customer outbound and inventory slices', () => {
+  const report = analyze();
+  const prefix = 'com.baiyue.lastleg.selfoperated.analytics.';
+  const classes = report.classes.filter(entry => entry.fqcn.startsWith(prefix));
+  assert.ok(classes.length > 0);
+  assert.ok(classes.some(entry => entry.packageName.endsWith('.inventory')));
+  assert.ok(classes.some(entry => entry.packageName.endsWith('.outbound')));
+  assert.ok(classes.every(entry => entry.slice === 'selfoperated-analytics'));
+  assert.deepEqual(report.sliceEdges.filter(edge => edge.source === 'selfoperated-analytics'
+    || edge.target === 'selfoperated-analytics'), [{ source: 'selfoperated-analytics', target: 'shared-technical', count: 2 }, { source: 'shared-technical', target: 'selfoperated-analytics', count: 1 }]);
+  assert.deepEqual(report.classDependencies.filter(edge => edge.source.startsWith(prefix) && !edge.target.startsWith(prefix)), [{
+    source: prefix + 'diagnostic.QuantityDiagnosticController', target: 'com.baiyue.lastleg.security.InternalServiceTokenGuard',
+  }, {
+    source: prefix + 'request.SelfopEgressController', target: 'com.baiyue.lastleg.security.InternalServiceTokenGuard',
+  }]);
+  assert.deepEqual(report.packageSccs.filter(cycle => cycle.some(pkg => pkg.startsWith(prefix))), []);
+  const baseline = JSON.parse(readFileSync(contract, 'utf8'));
+  const source = classes.find(entry => entry.packageName.endsWith('.inventory')).fqcn;
+  const target = 'com.baiyue.lastleg.inventory.query.service.InventoryQueryService';
+  report.classDependencies.push({ source, target });
+  assert.ok(contractViolations(report, baseline).some(message => message.includes(`${source}->${target}`)));
+});
+
 test('fleet stays a business slice and its policies have no infrastructure dependencies', () => {
   const report = analyze();
   const classes = report.classes.filter(entry => entry.fqcn.startsWith('com.baiyue.lastleg.fleet.'));
@@ -30,6 +53,10 @@ test('fleet stays a business slice and its policies have no infrastructure depen
     && edge.target.startsWith('com.baiyue.lastleg.fleet.'));
   assert.ok(dispatchEdges.length > 0);
   assert.ok(dispatchEdges.every(edge => /\.(FleetDispatchGateway|FleetDispatchBindingGuard|FleetTripExecutionService|FleetExecutionModels|FleetCompletionModels)$/.test(edge.target)
+    || edge.source === 'com.baiyue.lastleg.dispatch.fleet.FleetDispatchPlanningAdapter'
+      && /\.(FleetBookingIncomingGateway|FleetDispatchPlanningGateway)$/.test(edge.target)
+    || edge.source === 'com.baiyue.lastleg.dispatch.fleet.FleetDispatchPlanningMapper'
+      && edge.target === 'com.baiyue.lastleg.fleet.trip.FleetDispatchPlanningGateway'
     || edge.source === 'com.baiyue.lastleg.dispatch.fleet.PdaFleetHandoverController'
       && edge.target === 'com.baiyue.lastleg.fleet.exception.FleetHandoverPdaQuery'),
     'dispatch must use fleet ports and guards, not its persistence mappers');
@@ -42,6 +69,7 @@ function analyze(sourceSet = 'main') {
   return JSON.parse(execFileSync(process.execPath, [analyzer, '--source-set', sourceSet, '--format', 'json'], {
     cwd: moduleRoot,
     encoding: 'utf8',
+    maxBuffer: 8 * 1024 * 1024,
   }));
 }
 
@@ -85,7 +113,10 @@ test('vehicle master data remains the reviewed low-coupling first-slice candidat
     target: 'com.baiyue.lastleg.security.OverseasPermissions',
   }]);
   assert.ok(incoming.length > 0);
-  assert.ok(incoming.every(edge => edge.source.startsWith('com.baiyue.lastleg.fleet.') && edge.target.startsWith(vehiclePrefix + '.application.')));
+  assert.ok(incoming.every(edge => edge.source.startsWith('com.baiyue.lastleg.fleet.') && edge.target.startsWith(vehiclePrefix + '.application.')
+    || edge.source === 'com.baiyue.lastleg.export.LastlegExportProviderService'
+      && [vehiclePrefix + '.application.VehicleApplicationService', vehiclePrefix + '.application.model.VehicleModels'].includes(edge.target)),
+    'vehicle consumers use application contracts; the export composition has two exact read-only references');
   assert.equal(report.packageSccs.some(component => component.some(name => name.startsWith(vehiclePrefix))), false);
   assert.equal(classes.some(entry => entry.kind === 'cross-service-adapter'), false);
   assert.equal(classes.some(entry => entry.imports.some(imported => /RestClient|\.client\./.test(imported))), false);
@@ -126,6 +157,22 @@ test('reviewed references do not allow another consumer into the same slice', ()
   assert.ok(contractViolations(report, baseline).some(message => message.includes(`${source}->${target}`)));
 });
 
+test('export composition approvals do not grant persistence access or new consumers', () => {
+  const baseline = JSON.parse(readFileSync(contract, 'utf8'));
+  const source = 'com.baiyue.lastleg.export.LastlegExportProviderService';
+  const cases = [
+    { source, target: vehiclePrefix + '.adapter.out.persistence.VehicleMapper' },
+    { source, target: 'com.baiyue.lastleg.masterdata.exchange.mapper.MonthlyExchangeRateMapper' },
+    { source: 'com.baiyue.lastleg.export.LastlegExportColumns', target: 'com.baiyue.lastleg.fleet.quote.FleetQuoteService' },
+  ];
+  for (const edge of cases) {
+    const report = analyze();
+    report.classDependencies.push(edge);
+    assert.ok(contractViolations(report, baseline).some(message => message.includes(`${edge.source}->${edge.target}`)),
+      'each unreviewed consumer/target pair must still fail');
+  }
+});
+
 test('restoring a retired projection or importing its missing type still fails', () => {
   const baseline = JSON.parse(readFileSync(contract, 'utf8'));
   const report = analyze();
diff --git a/lastleg-service/scripts/selfoperated-test-env-acceptance.mjs b/lastleg-service/scripts/selfoperated-test-env-acceptance.mjs
new file mode 100644
index 000000000..610dddf5d
--- /dev/null
+++ b/lastleg-service/scripts/selfoperated-test-env-acceptance.mjs
@@ -0,0 +1,308 @@
+/**
+ * TEST-only Gateway acceptance. Default is a local plan; --execute performs login,
+ * read-only queries and, with --probe-off-command, one deliberately rejected INVENTORY
+ * command after verifying OFF. Never collects, publishes, creates fixtures or changes config.
+ * Credentials: node --env-file=<explicit test-*.env> BEFORE this script; this script does not read credential files.
+ * Required env: CHONGCHONG_ENV=TEST, CHONGCHONG_ADMIN_API_BASE_URL (ends /api),
+ * CHONGCHONG_ADMIN_USERNAME/PASSWORD, CHONGCHONG_MERCHANT_USERNAME/PASSWORD,
+ * SELFOP_READONLY_USERNAME/PASSWORD (read permission only),
+ * SELFOP_DENIED_USERNAME/PASSWORD (platform without read or sync permission).
+ * Example: node --env-file=<test file> <script> --environment TEST --source-account <account>
+ *   --warehouse <configured warehouse> --other-warehouse <second configured warehouse>
+ *   --report <local json> --synthetic-fixture <fixture notes json> --execute --probe-off-command
+ * Reports contain case IDs, status, machine codes and request/trace IDs only; no payloads,
+ * URLs, credentials or customer identifiers. Partial/missing evidence is BLOCKED (exit 2).
+ * Re-run reads current state and uses a fresh rejection request key. No deletion or SQL.
+ * Register this service-local entry in the maintained script index before release.
+ */
+import { readFileSync, writeFileSync, mkdirSync } from 'node:fs';
+import { dirname, resolve } from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { randomUUID } from 'node:crypto';
+
+const ROOT='/platform/v1/last-leg/self-operated-analytics';
+const READ='platform:self-operated-analytics:list', SYNC='platform:self-operated-analytics:sync';
+export const READ_ROUTES=Object.freeze(['sku-sales-summary','sku-daily-sales','hot-skus','slow-skus',
+  'inventory-coverage','owners','owner-overview','sync-overview','sync-tasks','sync-runs']);
+export const SAMPLE_REQUIREMENTS=Object.freeze([
+  'Two configured warehouses with BUSINESS/PUBLISHED outbound and inventory versions; do not collect or publish via this script.',
+  'At least two owners sharing one SKU, with distinguishable quantities and complete/partial/unknown days.',
+  'At least one existing warehouse sync task and attempt for task-detail and task/run warehouse isolation.',
+]);
+const demand=(condition,code)=>{if(!condition)throw new Error(code);};
+const success=r=>r.http===200&&String(r.body?.code)==='200';
+export const denied=r=>[401,403].includes(r.http)||(r.http===200&&['A0401','A0403'].includes(String(r.body?.code)));
+export const businessRejected=r=>r.http===200&&['B0001','A0400','A0404','A0409','A0422'].includes(String(r.body?.code));
+// A wrong scope, generic business error or infrastructure failure is not evidence of the OFF gate.
+export const offRejected=r=>businessRejected(r)&&r.body?.message==='采集功能未启用，当前环境不允许执行采集或重试';
+const safeCode=value=>typeof value==='string'&&/^[A-Za-z0-9_-]{1,80}$/.test(value)?value:null;
+export function evidence(r){return {http:r.http,code:safeCode(String(r.body?.code??'')),
+  requestId:safeCode(r.body?.requestId??r.requestId),traceId:safeCode(r.body?.traceId??r.traceId)};}
+
+export function parseArguments(args){
+  const o={execute:false,probeOff:false};
+  const names={'--environment':'environment','--source-account':'account','--warehouse':'warehouse',
+    '--other-warehouse':'otherWarehouse','--report':'report','--synthetic-fixture':'syntheticFixture'};
+  const seen=new Set();
+  for(let i=0;i<args.length;i++){
+    const key=args[i];demand(!seen.has(key),'DUPLICATE_ARGUMENT');seen.add(key);
+    if(key==='--execute'){o.execute=true;continue;}
+    if(key==='--probe-off-command'){o.probeOff=true;continue;}
+    demand(names[key]&&args[i+1]&&!args[i+1].startsWith('--'),'INVALID_ARGUMENT');o[names[key]]=args[++i];
+  }
+  demand(o.environment==='TEST','EXPLICIT_TEST_REQUIRED');
+  if(o.execute){demand(o.account&&o.warehouse&&o.report,'SCOPE_AND_REPORT_REQUIRED');}
+  if(o.otherWarehouse)demand(o.otherWarehouse!==o.warehouse,'SECOND_WAREHOUSE_MUST_DIFFER');
+  return o;
+}
+export function validateEnvironment(env){
+  demand(env.CHONGCHONG_ENV?.toUpperCase()==='TEST','TEST_ENV_REQUIRED');
+  let base;try{base=new URL(env.CHONGCHONG_ADMIN_API_BASE_URL);}catch{throw new Error('INVALID_GATEWAY');}
+  demand(['https:','http:'].includes(base.protocol)&&!base.username&&!base.password&&!base.search&&!base.hash&&
+    /\/api\/?$/.test(base.pathname),'INVALID_GATEWAY');
+  return base.href.replace(/\/$/,'');
+}
+export function plan(){return {environment:'TEST',mode:'PLAN',thirdPartyCalls:false,fixtureWrites:false,
+  routes:READ_ROUTES,authentication:['anonymous','authorized platform','read-only platform','denied platform','merchant'],
+  offProbe:'Opt-in only; rechecks OFF immediately before one rejected INVENTORY command. S0500 is a failure.',
+  syntheticEvidence:'--synthetic-fixture <reviewed notes JSON> enables thirteen numerical/isolation checks; never proves provider coverage.',
+  samples:SAMPLE_REQUIREMENTS,report:'Only case identifiers, outcomes, machine codes and request/trace IDs.'};}
+const query=(values)=>new URLSearchParams(Object.entries(values).filter(([,v])=>v!==null&&v!==undefined).map(([k,v])=>[k,String(v)])).toString();
+export function pin(context){
+  demand(context&&context.salesRunId!==null&&context.inventoryRunId!==null&&context.queryAsOf,'CONTEXT_MISSING');
+  return Object.fromEntries(['salesRunId','inventoryRunId','salesScopeHash','inventoryScopeHash','queryAsOf'].map(k=>[k,context[k]]));
+}
+function sameContext(a,b){return ['salesRunId','inventoryRunId','salesScopeHash','inventoryScopeHash','queryAsOf'].every(k=>a?.[k]===b?.[k]);}
+
+export function fixtureDate(anchor,offset=0){
+  demand(/^\d{4}-\d{2}-\d{2}$/.test(anchor??''),'FIXTURE_ANCHOR_REQUIRED');
+  const date=new Date(anchor+'T00:00:00Z');date.setUTCDate(date.getUTCDate()+offset);return date.toISOString().slice(0,10);
+}
+export function validateSyntheticNotes(notes,options){
+  demand(notes?.synthetic===true&&notes.fixtureId==='SYNTHETIC-SELFOP-20261012'&&notes.sourceAccount==='lingxing-primary'&&
+    options.account===notes.sourceAccount&&options.warehouse==='SELFOP-TEST-A'&&options.otherWarehouse==='SELFOP-TEST-B'&&
+    notes.currentVersions?.A?.salesRunId&&notes.currentVersions?.B?.inventoryRunId&&notes.oldSalesRunId&&
+    Array.isArray(notes.assertions),'SYNTHETIC_SCOPE_MISMATCH');
+}
+// TEST uses Jackson NON_NULL; these nullable OpenAPI fields are optional. Missing is unknown, never zero.
+const nullish=value=>value===null||value===undefined;
+const quantity=(actual,expected)=>expected===null?nullish(actual):!nullish(actual)&&Number.isFinite(Number(actual))&&Number(actual)===Number(expected);
+const fieldsMatch=(actual,expected)=>actual&&Object.entries(expected).every(([key,value])=>value===null?nullish(actual[key]):typeof value==='number'?quantity(actual[key],value):actual[key]===value);
+
+/** Expectations come from the reviewed synthetic manifest; only GET requests are returned. */
+export function syntheticCases(notes,context){
+  const d=context.anchorDate,from=fixtureDate(d,-2),until=fixtureDate(d,-1),window={rangePreset:'CUSTOM',startDate:from,endDate:until,bucket:'DAY'};
+  const shared='SYNTH-SHARED-SKU',owner='SYNTH-OWNER-A';
+  const assertion=(endpoint,predicate=()=>true)=>{
+    const rows=notes.assertions.filter(a=>a.endpoint===endpoint&&predicate(a));demand(rows.length===1,'FIXTURE_EXPECTATION_AMBIGUOUS');return rows[0];
+  };
+  const pair=(actual,version,hash)=>actual&&String(actual.salesRunId)===String(version.salesRunId)&&String(actual.inventoryRunId)===String(version.inventoryRunId)&&
+    actual.salesScopeHash===hash&&actual.inventoryScopeHash===hash;
+  const scopedRows=(data,warehouse)=>Array.isArray(data?.records)&&data.records.every(r=>r.warehouseCode===warehouse&&r.sourceAccount===notes.sourceAccount);
+  const cases=[];
+  const add=(id,route,params,verify,{warehouse='SELFOP-TEST-A',version=notes.currentVersions.A,pinned=true}={})=>cases.push({id:'synthetic.'+id,route,
+    params:{sourceAccount:notes.sourceAccount,warehouseCode:warehouse,current:1,size:100,...(pinned?pin(context):{}),...params},
+    verify:data=>['sync-overview'].includes(route)?verify(data):pair(data?.context,version,notes.hashes[warehouse==='SELFOP-TEST-A'?'A':'B'])&&
+      (!pinned||data.context.queryAsOf===context.queryAsOf)&&verify(data)});
+  const owners=assertion('owners').expected;
+  add('owners','owners',{},data=>quantity(data.total,owners.total)&&data.records.length===owners.total&&
+    JSON.stringify(data.records.map(r=>r.customerCode).sort())===JSON.stringify([...owners.customerCodes].sort())&&data.records.every(r=>nullish(r.customerName)));
+  const historical=assertion('sku-sales-summary',a=>a.expected?.records).expected;
+  add('date-range-and-owner-isolation','sku-sales-summary',{...window,sku:shared},data=>scopedRows(data,'SELFOP-TEST-A')&&quantity(data.total,historical.total)&&
+    data.records.length===historical.total&&Object.entries(historical.records).every(([code,expected])=>{
+      const rows=data.records.filter(r=>r.customerCode===code&&r.sku===shared);return rows.length===1&&fieldsMatch(rows[0],expected);
+    }));
+  const daily=assertion('sku-daily-sales').expected;
+  add('daily-exact-axis','sku-daily-sales',{...window,customerCode:owner,sku:shared},data=>data.points?.length===daily.points.length&&
+    data.points.every((p,i)=>p.businessDate===fixtureDate(d,Number(daily.points[i].businessDate.slice(1)))&&
+      quantity(p.outboundQuantity,daily.points[i].outboundQuantity)&&p.dataStatus===daily.points[i].dataStatus)&&
+    quantity(data.summary?.outboundQuantity,daily.summaryOutboundQuantity)&&data.summary.customerCode===owner&&data.summary.sku===shared);
+  const today=assertion('sku-sales-summary',a=>a.params?.rangePreset==='TODAY'&&typeof a.expected==='object').expected;
+  add('today-partial','sku-sales-summary',{rangePreset:'TODAY',sku:shared},data=>scopedRows(data,'SELFOP-TEST-A')&&data.records.length===2&&
+    Object.entries(today).every(([code,expected])=>fieldsMatch(data.records.find(r=>r.customerCode===code&&r.sku===shared),expected)));
+  const old=assertion('sku-sales-summary',a=>a.params?.salesRunId).expected;
+  add('old-version-fixed','sku-sales-summary',{...window,customerCode:owner,sku:shared,salesRunId:notes.oldSalesRunId},data=>
+    scopedRows(data,'SELFOP-TEST-A')&&data.records.length===1&&fieldsMatch(data.records[0],old),
+    {version:{...notes.currentVersions.A,salesRunId:notes.oldSalesRunId}});
+  const inventory=assertion('inventory-coverage').expected;
+  add('inventory-zero-unknown-and-age','inventory-coverage',{},data=>{
+    if(!scopedRows(data,'SELFOP-TEST-A')||!quantity(data.total,inventory.total)||data.records.length!==inventory.total)return false;
+    const row=sku=>data.records.find(r=>r.customerCode===owner&&r.sku===sku);
+    return Object.entries(inventory.sharedByOwner).every(([code,expected])=>fieldsMatch(data.records.find(r=>r.customerCode===code&&r.sku===shared),expected))&&
+      fieldsMatch(row(inventory.zero.sku),{physicalQuantity:0,availableQuantity:0})&&
+      fieldsMatch(row(inventory.unknown.sku),{physicalQuantity:null,availableQuantity:null,inventoryCoverageDays:null})&&
+      row(inventory.unknown.sku)?.quantityStatuses?.physicalQuantity==='UNKNOWN'&&row(inventory.unknown.sku)?.quantityStatuses?.availableQuantity==='UNKNOWN'&&
+      fieldsMatch(row(inventory.new.sku),{observationEligible:false,inventoryCoverageDays:null});
+  });
+  for(const route of ['hot-skus','slow-skus']){
+    const expected=assertion(route).expected;
+    add(route+'-eligibility-order',route,route==='hot-skus'?{windowDays:30}:{},data=>scopedRows(data,'SELFOP-TEST-A')&&quantity(data.total,expected.total)&&
+      data.records.length===expected.total&&data.records.every((r,i)=>r.customerCode===expected.order[i]&&r.sku===expected.sku&&quantity(r.outboundQuantity,expected.outboundQuantities[i])));
+  }
+  const other=assertion('sku-sales-summary',a=>a.params?.warehouseCode==='SELFOP-TEST-B').expected;
+  add('warehouse-b-positive','sku-sales-summary',{rangePreset:'CUSTOM',startDate:until,endDate:until,bucket:'DAY',sku:shared},data=>
+    scopedRows(data,'SELFOP-TEST-B')&&quantity(data.total,other.total)&&data.records.length===1&&fieldsMatch(data.records[0],{customerCode:other.customerCode,outboundQuantity:other.outboundQuantity}),
+    {warehouse:'SELFOP-TEST-B',version:notes.currentVersions.B,pinned:false});
+  add('zero-sales-versus-unknown','sku-daily-sales',{...window,customerCode:owner,sku:'SYNTH-ZERO'},data=>data.points?.length===2&&
+    data.points.every((p,i)=>p.businessDate===fixtureDate(d,i-2)&&p.dataStatus==='COMPLETE'&&quantity(p.outboundQuantity,0)&&quantity(p.observedQuantity,0)));
+  add('pre-existence-is-unknown','sku-daily-sales',{...window,customerCode:owner,sku:'SYNTH-NEW'},data=>data.points?.length===2&&
+    data.points[0].businessDate===from&&data.points[0].dataStatus==='UNKNOWN'&&nullish(data.points[0].outboundQuantity)&&nullish(data.points[0].observedQuantity)&&
+    data.points[1].businessDate===until&&data.points[1].dataStatus==='COMPLETE'&&quantity(data.points[1].outboundQuantity,0));
+  const overview=assertion('sync-overview').expected;
+  for(const [letter,warehouse] of [['A','SELFOP-TEST-A'],['B','SELFOP-TEST-B']]){
+    const expected=overview[letter];
+    const present=new Set((expected.sampleDates??[]).map(date=>fixtureDate(d,Number(date.slice(1)))));
+    const missing=Array.from({length:30},(_,i)=>fixtureDate(d,i-30)).filter(date=>!present.has(date));
+    add('daily-sample-gaps-'+letter,'sync-overview',{},data=>data.collectionMode==='OFF'&&data.warehouses?.some(w=>{
+      const samples=w.inventoryDailySamples;return w.warehouseCode===warehouse&&w.dataFamily==='INVENTORY'&&!w.executionEnabled&&!w.publicationEnabled&&samples&&
+        samples.windowFrom===fixtureDate(d,-30)&&samples.windowUntil===d&&samples.expectedDays===30&&quantity(samples.sampleCount,expected.sampleCount)&&
+        (expected.accumulationStartedOn===null?nullish(samples.accumulationStartedOn):samples.accumulationStartedOn===fixtureDate(d,Number(expected.accumulationStartedOn.slice(1))))&&
+        JSON.stringify(samples.missingDates)===JSON.stringify(missing);
+    }),{warehouse,pinned:false});
+  }
+  return cases;
+}
+
+export async function runAcceptance(options,{env=process.env,fetchImpl=fetch,save=()=>{},syntheticNotes}={}){
+  if(!options.execute)return plan();
+  demand(options.environment==='TEST','EXPLICIT_TEST_REQUIRED');
+  const base=validateEnvironment(env),sessions=[];
+  const notes=syntheticNotes??(options.syntheticFixture?JSON.parse(readFileSync(resolve(options.syntheticFixture),'utf8')):null);
+  if(notes)validateSyntheticNotes(notes,options);
+  const result={environment:'TEST',mode:'EXECUTE',evidenceType:notes?'SYNTHETIC_QUERY_FIXTURE_NOT_PROVIDER_EVIDENCE':'HTTP_ACCESS_AND_QUERY_CHECKS',
+    synthetic:!!notes,startedAt:new Date().toISOString(),cases:[],sampleRequirements:SAMPLE_REQUIREMENTS,
+    uncovered:['Actual context expiration after 30 elapsed minutes is deferred; not exercised by backdating queryAsOf.',
+      'Upstream Lingxing coverage, collection and publication transactions, real concurrency and performance are not verified.',
+      'Impersonated platform identity is not prepared or exercised.']};
+  const checkpoint=()=>save(result);
+  const record=(id,status,response,reason)=>{result.cases.push({id,status,...(response?evidence(response):{}),...(reason?{reason}: {})});checkpoint();};
+  const call=async(method,route,session,body)=>{
+    demand(method==='GET'||(method==='POST'&&['/auth/login','/auth/logout',ROOT+'/sync-tasks'].includes(route)),'UNAUTHORIZED_ROUTE');
+    let response;try{response=await fetchImpl(base+route,{method,redirect:'error',signal:AbortSignal.timeout(20000),
+      headers:{Accept:'application/json',...(session?{Authorization:`Bearer ${session.accessToken}`} :{}),
+        ...(body===undefined?{}:{'Content-Type':'application/json'})},...(body===undefined?{}:{body:JSON.stringify(body)})});}
+    catch{throw new Error('HTTP_TRANSPORT_FAILED');}
+    let payload;try{payload=await response.json();}catch{throw new Error('HTTP_JSON_REQUIRED');}
+    return {http:response.status,body:payload,requestId:response.headers?.get('x-request-id'),traceId:response.headers?.get('x-trace-id')};
+  };
+  const login=async(label,prefix,check)=>{
+    if(!env[prefix+'_USERNAME']||!env[prefix+'_PASSWORD']){record(label+'.login','BLOCKED',null,'CREDENTIALS_MISSING');return null;}
+    const r=await call('POST','/auth/login',null,{loginId:env[prefix+'_USERNAME'],password:env[prefix+'_PASSWORD']});
+    if(!success(r)||!r.body.data?.accessToken){record(label+'.login','FAIL',r,'LOGIN_FAILED');return null;}
+    const session=r.body.data;sessions.push(session);
+    if(!check(new Set(session.authorities??[]))){record(label+'.login','BLOCKED',r,'PERMISSION_FIXTURE_MISMATCH');return null;}
+    record(label+'.login','PASS',r);return session;
+  };
+  const scoped={sourceAccount:options.account,warehouseCode:options.warehouse,current:1,size:20};
+  const get=(route,session,params=scoped)=>call('GET',ROOT+'/'+route+'?'+query(params),session);
+  const check=async(id,route,session,params,predicate)=>{
+    const r=await get(route,session,params);const passed=predicate(r);record(id,passed?'PASS':'FAIL',r);return passed?r.body.data:null;
+  };
+  try{
+    for(const route of [...READ_ROUTES,'sync-tasks/SELFOP-NOT-EXIST'])
+      await check('anonymous.'+route,route,null,scoped,denied);
+    const admin=await login('platform','CHONGCHONG_ADMIN',a=>a.has(READ)&&a.has(SYNC));
+    const readonly=await login('readonly','SELFOP_READONLY',a=>a.has(READ)&&!a.has(SYNC));
+    const forbidden=await login('denied','SELFOP_DENIED',a=>!a.has(READ)&&!a.has(SYNC));
+    const merchant=await login('merchant','CHONGCHONG_MERCHANT',()=>true);
+    for(const [label,session] of [['denied',forbidden],['merchant',merchant]])if(session){
+      for(const route of [...READ_ROUTES,'sync-tasks/SELFOP-NOT-EXIST'])await check(label+'.'+route,route,session,scoped,denied);
+    }
+    if(!admin){record('business.reads','BLOCKED',null,'AUTHORIZED_PLATFORM_REQUIRED');return result;}
+    const overview=await check('off.overview','sync-overview',admin,scoped,r=>success(r)&&r.body.data?.collectionMode==='OFF'&&
+      r.body.data.warehouses?.length>0&&r.body.data.warehouses.every(w=>w.warehouseCode===options.warehouse&&!w.executionEnabled&&!w.publicationEnabled));
+    if(!overview){record('off.commands','BLOCKED',null,'OFF_PREFLIGHT_REQUIRED');return result;}
+    if(readonly)await check('readonly.query','sync-overview',readonly,scoped,r=>success(r)&&r.body.data.collectionMode==='OFF');
+    const sales=await check('query.sales','sku-sales-summary',admin,{...scoped,rangePreset:'LAST_3_DAYS',bucket:'DAY'},r=>
+      success(r)&&Array.isArray(r.body.data?.records)&&r.body.data.records.every(row=>row.sourceAccount===options.account&&row.warehouseCode===options.warehouse));
+    const context=sales?pin(sales.context):null;
+    const fixed=context?{...scoped,...context}:scoped;
+    for(const route of ['hot-skus','slow-skus','inventory-coverage','owners'])await check('query.'+route,route,admin,fixed,r=>
+      success(r)&&Array.isArray(r.body.data?.records)&&(!context||sameContext(sales.context,r.body.data.context))&&
+      r.body.data.records.every(row=>row.warehouseCode===undefined||row.warehouseCode===options.warehouse));
+    for(const route of ['sync-tasks','sync-runs']){
+      const data=await check('query.'+route,route,admin,scoped,r=>success(r)&&Array.isArray(r.body.data?.records)&&
+        (route!=='sync-tasks'||r.body.data.records.every(t=>t.warehouseCode===options.warehouse&&t.taskRole==='WAREHOUSE_SYNC')));
+      if(route==='sync-runs'){
+        if(data?.records.length){
+          for(const taskNo of new Set(data.records.map(r=>r.taskNo))){
+            if(!taskNo){record('scope.run-warehouse','FAIL',null,'ATTEMPT_TASK_NUMBER_REQUIRED');continue;}
+            await check('scope.run-warehouse','sync-tasks/'+encodeURIComponent(taskNo),admin,scoped,r=>success(r)&&
+              r.body.data.task?.taskNo===taskNo&&r.body.data.task.warehouseCode===options.warehouse);
+          }
+        }else record('query.attempt-sample','BLOCKED',null,'EXISTING_WAREHOUSE_ATTEMPT_REQUIRED');
+      }
+    }
+    await check('scope.foreign-account','sync-overview',admin,{...scoped,sourceAccount:'SELFOP-UNCONFIGURED-'+randomUUID()},businessRejected);
+    await check('scope.foreign-warehouse','sku-sales-summary',admin,{...scoped,warehouseCode:'SELFOP-UNCONFIGURED-'+randomUUID(),rangePreset:'TODAY'},businessRejected);
+    if(context){
+      await check('context.second-page','sku-sales-summary',admin,{...fixed,current:2,rangePreset:'LAST_3_DAYS',bucket:'DAY'},r=>success(r)&&sameContext(sales.context,r.body.data.context));
+      await check('context.future-clock','sku-sales-summary',admin,{...fixed,queryAsOf:new Date(Date.now()+86400000).toISOString(),rangePreset:'TODAY'},businessRejected);
+      if(options.otherWarehouse&&(Number(context.salesRunId)>0||Number(context.inventoryRunId)>0)){
+        const configured=await check('scope.second-warehouse-configured','sync-overview',admin,{...scoped,warehouseCode:options.otherWarehouse},r=>success(r)&&
+          r.body.data.warehouses?.some(w=>w.warehouseCode===options.otherWarehouse));
+        if(configured)await check('context.cross-warehouse','sku-sales-summary',admin,{...fixed,warehouseCode:options.otherWarehouse,rangePreset:'TODAY'},businessRejected);
+      }
+      else record('context.cross-warehouse','BLOCKED',null,'SECOND_CONFIGURED_WAREHOUSE_REQUIRED');
+    }
+    const sample=sales?.records?.[0];
+    if(sample){
+      await check('scope.exact-owner-sku','sku-sales-summary',admin,{...fixed,customerCode:sample.customerCode,sku:sample.sku,rangePreset:'LAST_3_DAYS'},r=>success(r)&&
+        r.body.data.records.length>0&&r.body.data.records.every(row=>row.customerCode===sample.customerCode&&row.sku===sample.sku));
+      await check('query.daily','sku-daily-sales',admin,{...fixed,customerCode:sample.customerCode,sku:sample.sku,rangePreset:'LAST_3_DAYS',bucket:'DAY'},r=>success(r)&&
+        r.body.data.summary?.customerCode===sample.customerCode&&r.body.data.summary?.sku===sample.sku&&r.body.data.points?.length===3&&
+        r.body.data.points.every((p,i,arr)=>['COMPLETE','PARTIAL','UNKNOWN'].includes(p.dataStatus)&&(!i||p.businessDate>arr[i-1].businessDate)&&
+          (p.dataStatus!=='UNKNOWN'||nullish(p.outboundQuantity)&&nullish(p.observedQuantity))));
+      const {current:unusedCurrent,size:unusedSize,...overviewScope}=fixed;
+      await check('query.owner-overview','owner-overview',admin,{...overviewScope,customerCode:sample.customerCode},r=>success(r)&&r.body.data.customerCode===sample.customerCode);
+      const peer=sales.records.find(row=>row.sku===sample.sku&&row.customerCode!==sample.customerCode);
+      if(peer)await check('scope.same-sku-other-owner','sku-sales-summary',admin,{...fixed,customerCode:peer.customerCode,sku:peer.sku,rangePreset:'LAST_3_DAYS'},r=>success(r)&&
+        r.body.data.records.length===1&&r.body.data.records[0].customerCode===peer.customerCode&&r.body.data.records[0].sku===peer.sku&&
+        r.body.data.records[0].observedQuantity===peer.observedQuantity);
+      else record('scope.same-sku-other-owner','BLOCKED',null,'SECOND_OWNER_SAME_SKU_REQUIRED');
+    }else record('query.sample-dependent','BLOCKED',null,'PUBLISHED_SALES_SAMPLE_REQUIRED');
+    if(notes&&sales){
+      demand(sales.context.anchorDate,'FIXTURE_ANCHOR_REQUIRED');
+      for(const scenario of syntheticCases(notes,sales.context))await check(scenario.id,scenario.route,admin,scenario.params,r=>success(r)&&scenario.verify(r.body.data));
+    }else if(notes)record('synthetic.business','BLOCKED',null,'FIRST_SCREEN_CONTEXT_REQUIRED');
+    else result.uncovered.push('Reviewed synthetic fixture numerical, old-version and daily representative assertions were not requested.');
+    const taskPage=await get('sync-tasks',admin,scoped);const task=success(taskPage)?taskPage.body.data.records?.[0]:null;
+    if(task?.taskNo){await check('query.task-detail','sync-tasks/'+encodeURIComponent(task.taskNo),admin,scoped,r=>success(r)&&r.body.data.task?.taskNo===task.taskNo);
+      if(options.otherWarehouse)await check('scope.cross-warehouse-task','sync-tasks/'+encodeURIComponent(task.taskNo),admin,{...scoped,warehouseCode:options.otherWarehouse},businessRejected);
+    }else record('query.task-detail','BLOCKED',null,'EXISTING_WAREHOUSE_TASK_REQUIRED');
+    // Probe is opt-in and OFF is checked again, immediately before any command request.
+    if(options.probeOff){
+      const before=await get('sync-overview',admin,scoped);
+      demand(success(before)&&before.body.data?.collectionMode==='OFF','OFF_CHANGED_STOPPED');
+      const command={requestKey:'off-acceptance-'+randomUUID(),warehouseCode:options.warehouse,action:'INVENTORY'};
+      for(const [label,session] of [['anonymous',null],['readonly',readonly],['denied',forbidden],['merchant',merchant]]){
+        if(label!=='anonymous'&&!session)continue;
+        const r=await call('POST',ROOT+'/sync-tasks',session,command);record('sync.permission.'+label,denied(r)?'PASS':'FAIL',r);
+        demand(!success(r),'UNEXPECTED_ACCEPTANCE_STOPPED');
+      }
+      const immediatelyBefore=await get('sync-overview',admin,scoped);
+      demand(success(immediatelyBefore)&&immediatelyBefore.body.data.collectionMode==='OFF','OFF_CHANGED_STOPPED');
+      const tasksBefore=await get('sync-tasks',admin,scoped);demand(success(tasksBefore),'TASK_BASELINE_REQUIRED');
+      const r=await call('POST',ROOT+'/sync-tasks',admin,command);
+      record('sync.off-controlled-rejection',offRejected(r)?'PASS':'FAIL',r);
+      demand(!success(r),'UNEXPECTED_ACCEPTANCE_STOPPED');
+      const tasksAfter=await get('sync-tasks',admin,scoped);
+      record('sync.off-no-task-created',success(tasksAfter)&&tasksBefore.body.data.total===tasksAfter.body.data.total?'PASS':'FAIL',tasksAfter);
+    }else record('sync.off-controlled-rejection','BLOCKED',null,'OPT_IN_PROBE_REQUIRED');
+  }catch(error){record('run.blocker','FAIL',null,safeCode(error.message)??'UNEXPECTED_ERROR');}
+  finally{
+    for(const session of sessions)if(session.refreshToken){try{const r=await call('POST','/auth/logout',session,{refreshToken:session.refreshToken});record('session.logout',success(r)?'PASS':'FAIL',r);}catch{record('session.logout','FAIL',null,'LOGOUT_FAILED');}}
+    result.finishedAt=new Date().toISOString();result.outcome=result.cases.some(c=>c.status==='FAIL')?'FAIL':result.cases.some(c=>c.status==='BLOCKED')?'BLOCKED':'PASS';checkpoint();
+  }
+  return result;
+}
+
+if(process.argv[1]&&import.meta.url===pathToFileURL(resolve(process.argv[1])).href){
+  try{
+    const options=parseArguments(process.argv.slice(2));
+    const save=result=>{if(options.report){mkdirSync(dirname(resolve(options.report)),{recursive:true});writeFileSync(resolve(options.report),JSON.stringify(result,null,2));}};
+    const report=await runAcceptance(options,{save});
+    if(!options.execute)console.log(JSON.stringify(report,null,2));
+    else {console.log(JSON.stringify({outcome:report.outcome,cases:report.cases.length}));process.exitCode=report.outcome==='PASS'?0:report.outcome==='BLOCKED'?2:1;}
+  }catch{console.error('SELFOP_ACCEPTANCE_CONFIGURATION_FAILED');process.exitCode=1;}
+}
diff --git a/lastleg-service/scripts/selfoperated-test-env-acceptance.test.mjs b/lastleg-service/scripts/selfoperated-test-env-acceptance.test.mjs
new file mode 100644
index 000000000..a6df5eb08
--- /dev/null
+++ b/lastleg-service/scripts/selfoperated-test-env-acceptance.test.mjs
@@ -0,0 +1,210 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {parseArguments,validateEnvironment,runAcceptance,businessRejected,offRejected,evidence,pin,fixtureDate,validateSyntheticNotes,syntheticCases} from './selfoperated-test-env-acceptance.mjs';
+
+const env={CHONGCHONG_ENV:'TEST',CHONGCHONG_ADMIN_API_BASE_URL:'https://test.example.invalid/api',
+  CHONGCHONG_ADMIN_USERNAME:'admin-secret',CHONGCHONG_ADMIN_PASSWORD:'password-secret',
+  CHONGCHONG_MERCHANT_USERNAME:'merchant-secret',CHONGCHONG_MERCHANT_PASSWORD:'merchant-password-secret',
+  SELFOP_READONLY_USERNAME:'readonly-secret',SELFOP_READONLY_PASSWORD:'readonly-password-secret',
+  SELFOP_DENIED_USERNAME:'denied-secret',SELFOP_DENIED_PASSWORD:'denied-password-secret'};
+const options={execute:true,environment:'TEST',probeOff:true,account:'fixture-account',warehouse:'W1',otherWarehouse:'W2',report:'unused.json'};
+const READ='platform:self-operated-analytics:list',SYNC='platform:self-operated-analytics:sync';
+function fixture({mode='OFF',offCode='B0001',offMessage='采集功能未启用，当前环境不允许执行采集或重试',acceptCommand=false,changeMode=false}={}){
+  const requests=[];
+  const context={salesRunId:'11',inventoryRunId:'22',salesScopeHash:'sales-hash',inventoryScopeHash:'stock-hash',queryAsOf:new Date().toISOString()};
+  const sales=[{sourceAccount:options.account,warehouseCode:'W1',customerCode:'owner-secret-A',sku:'sku-secret',observedQuantity:4},
+    {sourceAccount:options.account,warehouseCode:'W1',customerCode:'owner-secret-B',sku:'sku-secret',observedQuantity:8}];
+  const response=(code='200',data=null,http=200,message='do-not-report-sensitive-message')=>({status:http,headers:new Headers({'x-request-id':'request-1','x-trace-id':'trace-1'}),
+    json:async()=>({code,data,requestId:'request-1',traceId:'trace-1',message})});
+  const fetchImpl=async(url,init)=>{
+    const u=new URL(url),path=u.pathname.substring(4),params=u.searchParams,body=init.body?JSON.parse(init.body):null;
+    requests.push({url,method:init.method,body,headers:init.headers});
+    if(path==='/auth/login'){
+      const label=body.loginId.split('-')[0];const authorities=label==='admin'?[READ,SYNC]:label==='readonly'?[READ]:[];
+      return response('200',{accessToken:'token-secret-'+label,refreshToken:'refresh-secret-'+label,authorities});
+    }
+    if(path==='/auth/logout')return response();
+    const bearer=init.headers.Authorization??'';
+    if(!bearer)return response('A0401',null,401);
+    if(bearer.endsWith('denied')||bearer.endsWith('merchant'))return response('A0403');
+    if(init.method==='POST'){
+      if(bearer.endsWith('readonly'))return response('A0403');
+      return response(acceptCommand?'200':offCode,acceptCommand?{taskNo:'unexpected'}:null,200,offMessage);
+    }
+    const route=path.split('/').at(-1),warehouse=params.get('warehouseCode');
+    if(params.get('sourceAccount')?.startsWith('SELFOP-UNCONFIGURED')||warehouse?.startsWith('SELFOP-UNCONFIGURED'))return response('B0001');
+    if(route==='sync-overview'){
+      const count=requests.filter(r=>new URL(r.url).pathname.endsWith('/sync-overview')).length;
+      return response('200',{collectionMode:changeMode&&count>6?'BUSINESS':mode,warehouses:[{warehouseCode:warehouse,executionEnabled:false,publicationEnabled:false}]});
+    }
+    if(params.has('queryAsOf')&&(params.get('queryAsOf')!==context.queryAsOf||warehouse==='W2'))return response('B0001');
+    if(route==='sku-sales-summary')return response('200',{context,records:params.get('current')==='2'?[]:sales.filter(r=>
+      !params.has('customerCode')||r.customerCode===params.get('customerCode')),total:2});
+    if(route==='sku-daily-sales')return response('200',{context,summary:{customerCode:params.get('customerCode'),sku:params.get('sku')},points:[
+      {businessDate:'2026-10-10',dataStatus:'COMPLETE',outboundQuantity:4,observedQuantity:4},
+      {businessDate:'2026-10-11',dataStatus:'UNKNOWN',outboundQuantity:null,observedQuantity:null},
+      {businessDate:'2026-10-12',dataStatus:'PARTIAL',outboundQuantity:null,observedQuantity:1}]});
+    if(route==='owner-overview')return params.has('current')||params.has('size')?response('B0001'):response('200',{context,customerCode:params.get('customerCode')});
+    if(path.includes('/sync-tasks/'))return warehouse==='W1'?response('200',{task:{taskNo:'TASK-FIXTURE',warehouseCode:'W1'}}):response('B0001');
+    if(route==='sync-tasks')return response('200',{records:[{taskNo:'TASK-FIXTURE',warehouseCode:warehouse,taskRole:'WAREHOUSE_SYNC'}],total:1});
+    if(route==='sync-runs')return response('200',{records:[{taskNo:'TASK-FIXTURE'}],total:1});
+    return response('200',{context,records:[],total:0});
+  };
+  return {requests,fetchImpl};
+}
+
+test('explicit TEST execution and independent warehouse are required',()=>{
+  assert.throws(()=>parseArguments(['--environment','prod']),/TEST/);
+  assert.throws(()=>parseArguments(['--environment','TEST','--execute']),/SCOPE/);
+  assert.throws(()=>parseArguments(['--environment','TEST','--warehouse','W1','--other-warehouse','W1']),/DIFFER/);
+  assert.throws(()=>parseArguments(['--environment','TEST','--execute','--execute']),/DUPLICATE/);
+  assert.equal(parseArguments(['--environment','TEST']).execute,false);
+  assert.throws(()=>validateEnvironment({...env,CHONGCHONG_ENV:'DEV'}),/TEST/);
+  assert.throws(()=>validateEnvironment({...env,CHONGCHONG_ADMIN_API_BASE_URL:'https://user:secret@test.example.invalid/api'}),/GATEWAY/);
+  assert.throws(()=>validateEnvironment({...env,CHONGCHONG_ADMIN_API_BASE_URL:'https://test.example.invalid/api?token=secret'}),/GATEWAY/);
+});
+test('plan makes no network requests and never reads env files',async()=>{
+  const p=await runAcceptance({execute:false},{env:{},fetchImpl:()=>{throw Error('network');}});
+  assert.equal(p.mode,'PLAN');assert.equal(p.fixtureWrites,false);assert.equal(p.thirdPartyCalls,false);
+});
+test('real protocol coverage passes without printing or saving sensitive payloads',async()=>{
+  const f=fixture(),snapshots=[];const result=await runAcceptance(options,{env,fetchImpl:f.fetchImpl,save:r=>snapshots.push(JSON.stringify(r))});
+  assert.equal(result.outcome,'PASS',JSON.stringify(result));
+  for(const id of ['scope.same-sku-other-owner','context.cross-warehouse','sync.off-controlled-rejection','sync.off-no-task-created'])
+    assert.equal(result.cases.find(c=>c.id===id)?.status,'PASS',id);
+  const serialized=snapshots.join('');
+  for(const forbidden of ['password-secret','token-secret','refresh-secret','owner-secret','sku-secret','test.example.invalid','sensitive-message'])assert.ok(!serialized.includes(forbidden),forbidden);
+  const commands=f.requests.filter(r=>r.method==='POST'&&!new URL(r.url).pathname.startsWith('/api/auth/'));
+  assert.equal(commands.length,5);assert.ok(commands.every(r=>new URL(r.url).pathname.endsWith('/sync-tasks')&&r.body.action==='INVENTORY'));
+  assert.equal(f.requests.filter(r=>new URL(r.url).pathname.endsWith('/auth/logout')).length,4);
+});
+test('OFF preflight blocks every command when mode is not OFF',async()=>{
+  const f=fixture({mode:'VALIDATION'});const result=await runAcceptance(options,{env,fetchImpl:f.fetchImpl});
+  assert.equal(result.outcome,'FAIL');assert.ok(!f.requests.some(r=>r.method==='POST'&&new URL(r.url).pathname.endsWith('/sync-tasks')));
+});
+test('without opt-in no sync POST occurs; missing permission identity stays blocked',async()=>{
+  const f=fixture();const result=await runAcceptance({...options,probeOff:false},{env:{...env,SELFOP_READONLY_PASSWORD:''},fetchImpl:f.fetchImpl});
+  assert.equal(result.outcome,'BLOCKED');assert.ok(!f.requests.some(r=>r.method==='POST'&&new URL(r.url).pathname.endsWith('/sync-tasks')));
+});
+test('a changed OFF preflight stops before all sync POST requests',async()=>{
+  const f=fixture({changeMode:true});const result=await runAcceptance(options,{env,fetchImpl:f.fetchImpl});
+  assert.equal(result.outcome,'FAIL');assert.ok(!f.requests.some(r=>r.method==='POST'&&new URL(r.url).pathname.endsWith('/sync-tasks')));
+  assert.equal(result.cases.find(c=>c.id==='run.blocker').reason,'OFF_CHANGED_STOPPED');
+});
+test('internal errors never pass as controlled OFF rejection; unexpected acceptance aborts',async()=>{
+  assert.equal(businessRejected({http:200,body:{code:'S0500'}}),false);
+  assert.equal(businessRejected({http:503,body:{code:'B0001'}}),false);
+  assert.equal(offRejected({http:200,body:{code:'B0001',message:'SELFOP_WAREHOUSE_UNCONFIGURED'}}),false);
+  for(const config of [{offCode:'S0500'},{offMessage:'SELFOP_WAREHOUSE_UNCONFIGURED'},{acceptCommand:true}]){
+    const f=fixture(config);const result=await runAcceptance(options,{env,fetchImpl:f.fetchImpl});
+    assert.equal(result.outcome,'FAIL');assert.equal(result.cases.find(c=>c.id==='sync.off-controlled-rejection').status,'FAIL');
+  }
+});
+test('evidence whitelist retains diagnosis and drops arbitrary body content',()=>{
+  assert.deepEqual(evidence({http:200,body:{code:'B0001',requestId:'request-2',traceId:'trace-2',password:'secret',data:{accessToken:'secret'}}}),
+    {http:200,code:'B0001',requestId:'request-2',traceId:'trace-2'});
+  assert.equal(evidence({http:500,body:{code:'secret with spaces'}}).code,null);
+  assert.throws(()=>pin({salesRunId:0,inventoryRunId:0}),/CONTEXT/);
+  assert.equal(pin({salesRunId:0,inventoryRunId:0,queryAsOf:'2026-10-12T00:00:00Z'}).salesRunId,0);
+});
+
+function syntheticFixture(){
+  const notes={synthetic:true,fixtureId:'SYNTHETIC-SELFOP-20261012',sourceAccount:'lingxing-primary',hashes:{A:'hash-A',B:'hash-B'},
+    currentVersions:{A:{salesRunId:'202',inventoryRunId:'203'},B:{salesRunId:'206',inventoryRunId:'207'}},oldSalesRunId:'201',assertions:[
+      {endpoint:'owners',expected:{total:2,customerCodes:['SYNTH-OWNER-A','SYNTH-OWNER-B']}},
+      {endpoint:'sku-sales-summary',expected:{total:2,records:{'SYNTH-OWNER-A':{outboundQuantity:30,observedQuantity:30,dataStatus:'COMPLETE',completeDayCount:2,partialDayCount:0,unknownDayCount:0},
+        'SYNTH-OWNER-B':{outboundQuantity:10,observedQuantity:10,dataStatus:'COMPLETE'}}}},
+      {endpoint:'sku-daily-sales',expected:{points:[{businessDate:'D-2',outboundQuantity:10,dataStatus:'COMPLETE'},{businessDate:'D-1',outboundQuantity:20,dataStatus:'COMPLETE'}],summaryOutboundQuantity:30}},
+      {endpoint:'sku-sales-summary',params:{rangePreset:'TODAY'},expected:{'SYNTH-OWNER-A':{outboundQuantity:null,observedQuantity:5,dataStatus:'PARTIAL'},'SYNTH-OWNER-B':{outboundQuantity:null,observedQuantity:2,dataStatus:'PARTIAL'}}},
+      {endpoint:'sku-sales-summary',params:{salesRunId:'201'},expected:{outboundQuantity:3,observedQuantity:3,dataStatus:'COMPLETE'}},
+      {endpoint:'inventory-coverage',expected:{total:5,sharedByOwner:{'SYNTH-OWNER-A':{physicalQuantity:60,availableQuantity:60,outboundQuantity30d:30,inventoryCoverageDays:60},
+        'SYNTH-OWNER-B':{physicalQuantity:20,availableQuantity:20,outboundQuantity30d:10,inventoryCoverageDays:60}},zero:{sku:'SYNTH-ZERO'},unknown:{sku:'SYNTH-UNKNOWN'},new:{sku:'SYNTH-NEW'}}},
+      {endpoint:'hot-skus',expected:{total:2,order:['SYNTH-OWNER-A','SYNTH-OWNER-B'],sku:'SYNTH-SHARED-SKU',outboundQuantities:[30,10]}},
+      {endpoint:'slow-skus',expected:{total:2,order:['SYNTH-OWNER-B','SYNTH-OWNER-A'],sku:'SYNTH-SHARED-SKU',outboundQuantities:[10,30]}},
+      {endpoint:'sku-sales-summary',params:{warehouseCode:'SELFOP-TEST-B'},expected:{total:1,customerCode:'SYNTH-OWNER-A',outboundQuantity:999}},
+      {endpoint:'sync-overview',expected:{A:{sampleCount:2,sampleDates:['D-3','D-1'],accumulationStartedOn:'D-3'},B:{sampleCount:0,accumulationStartedOn:null}}},
+    ]};
+  const context={...notes.currentVersions.A,salesScopeHash:'hash-A',inventoryScopeHash:'hash-A',queryAsOf:'2026-10-12T04:00:00Z',anchorDate:'2026-10-12'};
+  const cases=syntheticCases(notes,context),payloads=new Map();
+  const row=(customerCode,sku,fields={})=>({sourceAccount:notes.sourceAccount,warehouseCode:'SELFOP-TEST-A',customerCode,sku,...fields});
+  for(const scenario of cases){
+    const id=scenario.id.substring(10),data={context:{...context},records:[],total:0};
+    if(id==='owners'){data.records=['SYNTH-OWNER-A','SYNTH-OWNER-B'].map(customerCode=>({customerCode,customerName:null}));data.total=2;}
+    if(id==='date-range-and-owner-isolation'){data.records=Object.entries(notes.assertions[1].expected.records).map(([code,fields])=>row(code,'SYNTH-SHARED-SKU',fields));data.total=2;}
+    if(id==='daily-exact-axis'){data.summary={customerCode:'SYNTH-OWNER-A',sku:'SYNTH-SHARED-SKU',outboundQuantity:30};data.points=notes.assertions[2].expected.points.map((p,i)=>({...p,businessDate:fixtureDate(context.anchorDate,i-2)}));}
+    if(id==='today-partial'){data.records=Object.entries(notes.assertions[3].expected).map(([code,fields])=>row(code,'SYNTH-SHARED-SKU',fields));data.total=2;}
+    if(id==='old-version-fixed'){data.context.salesRunId='201';data.records=[row('SYNTH-OWNER-A','SYNTH-SHARED-SKU',notes.assertions[4].expected)];data.total=1;}
+    if(id==='inventory-zero-unknown-and-age'){
+      data.records=Object.entries(notes.assertions[5].expected.sharedByOwner).map(([code,fields])=>row(code,'SYNTH-SHARED-SKU',fields));
+      data.records.push(row('SYNTH-OWNER-A','SYNTH-ZERO',{physicalQuantity:0,availableQuantity:0}),
+        row('SYNTH-OWNER-A','SYNTH-UNKNOWN',{physicalQuantity:null,availableQuantity:null,inventoryCoverageDays:null,quantityStatuses:{physicalQuantity:'UNKNOWN',availableQuantity:'UNKNOWN'}}),
+        row('SYNTH-OWNER-A','SYNTH-NEW',{observationEligible:false,inventoryCoverageDays:null}));data.total=5;
+    }
+    if(id==='hot-skus-eligibility-order'||id==='slow-skus-eligibility-order'){
+      const expected=notes.assertions[id.startsWith('hot')?6:7].expected;
+      data.records=expected.order.map((code,i)=>row(code,expected.sku,{outboundQuantity:expected.outboundQuantities[i]}));data.total=2;
+    }
+    if(id==='warehouse-b-positive'){
+      data.context={...context,...notes.currentVersions.B,salesScopeHash:'hash-B',inventoryScopeHash:'hash-B'};
+      data.records=[{...row('SYNTH-OWNER-A','SYNTH-SHARED-SKU',{outboundQuantity:999}),warehouseCode:'SELFOP-TEST-B'}];data.total=1;
+    }
+    if(id==='zero-sales-versus-unknown')data.points=[-2,-1].map(offset=>({businessDate:fixtureDate(context.anchorDate,offset),dataStatus:'COMPLETE',outboundQuantity:'0.000000',observedQuantity:0}));
+    if(id==='pre-existence-is-unknown')data.points=[{businessDate:'2026-10-10',dataStatus:'UNKNOWN',outboundQuantity:null,observedQuantity:null},
+      {businessDate:'2026-10-11',dataStatus:'COMPLETE',outboundQuantity:0}];
+    if(id.startsWith('daily-sample-gaps-')){
+      const letter=id.at(-1),expected=notes.assertions[9].expected[letter],present=new Set((expected.sampleDates??[]).map(p=>fixtureDate(context.anchorDate,Number(p.slice(1)))));
+      data.collectionMode='OFF';data.warehouses=[{warehouseCode:'SELFOP-TEST-'+letter,dataFamily:'INVENTORY',executionEnabled:false,publicationEnabled:false,
+        inventoryDailySamples:{windowFrom:'2026-09-12',windowUntil:'2026-10-12',expectedDays:30,sampleCount:expected.sampleCount,
+          accumulationStartedOn:expected.accumulationStartedOn===null?null:'2026-10-09',missingDates:Array.from({length:30},(_,i)=>fixtureDate(context.anchorDate,i-30)).filter(p=>!present.has(p))}}];
+    }
+    payloads.set(scenario.id,data);
+  }
+  return {notes,context,cases,payloads};
+}
+test('reviewed synthetic fixture covers all thirteen business checks with bound old/current version pairs',()=>{
+  const f=syntheticFixture();assert.equal(f.cases.length,13);
+  validateSyntheticNotes(f.notes,{account:'lingxing-primary',warehouse:'SELFOP-TEST-A',otherWarehouse:'SELFOP-TEST-B'});
+  assert.throws(()=>validateSyntheticNotes({...f.notes,synthetic:false},options),/SYNTHETIC/);
+  for(const c of f.cases)assert.equal(c.verify(f.payloads.get(c.id)),true,c.id);
+  const old=f.cases.find(c=>c.id==='synthetic.old-version-fixed');
+  assert.equal(old.params.salesRunId,'201');assert.equal(old.params.inventoryRunId,'203');assert.equal(old.params.queryAsOf,f.context.queryAsOf);
+  assert.ok(f.cases.every(c=>c.route!=='sync-tasks'&&!c.route.includes('publish')));
+  assert.equal(fixtureDate('2026-03-01',-1),'2026-02-28');
+});
+test('synthetic checks reject mixed owners/warehouses, silent current-version fallback, zero-filling and ineligible Top rows',()=>{
+  const f=syntheticFixture();
+  const reject=(id,mutate)=>{const c=f.cases.find(c=>c.id==='synthetic.'+id),data=structuredClone(f.payloads.get(c.id));mutate(data);assert.equal(c.verify(data),false,id);};
+  reject('date-range-and-owner-isolation',d=>{d.records[0].observedQuantity+=999;});
+  reject('date-range-and-owner-isolation',d=>{d.records[1].customerCode='SYNTH-OWNER-A';});
+  reject('warehouse-b-positive',d=>{d.records[0].warehouseCode='SELFOP-TEST-A';});
+  reject('old-version-fixed',d=>{d.context.salesRunId='202';});
+  reject('inventory-zero-unknown-and-age',d=>{d.records[3].availableQuantity=0;});
+  reject('pre-existence-is-unknown',d=>{d.points[0].observedQuantity=0;});
+  reject('daily-exact-axis',d=>{d.points[1].businessDate='2026-10-12';});
+  reject('hot-skus-eligibility-order',d=>{d.records[0].sku='SYNTH-NEW';});
+  reject('slow-skus-eligibility-order',d=>{d.records.reverse();});
+  reject('daily-sample-gaps-A',d=>{d.warehouses[0].inventoryDailySamples.missingDates.push('2026-10-11');});
+  reject('daily-sample-gaps-B',d=>{d.warehouses[0].inventoryDailySamples.sampleCount=1;});
+});
+test('synthetic report explicitly marks provider evidence and elapsed expiration as unverified without adding a wait blocker',async()=>{
+  const f=syntheticFixture();const result=await runAcceptance({...options,account:'lingxing-primary',warehouse:'SELFOP-TEST-A',otherWarehouse:'SELFOP-TEST-B'},
+    {env:{CHONGCHONG_ENV:'TEST',CHONGCHONG_ADMIN_API_BASE_URL:env.CHONGCHONG_ADMIN_API_BASE_URL},syntheticNotes:f.notes,
+      fetchImpl:async()=>({status:401,headers:new Headers(),json:async()=>({code:'A0401'})})});
+  assert.equal(result.synthetic,true);assert.equal(result.evidenceType,'SYNTHETIC_QUERY_FIXTURE_NOT_PROVIDER_EVIDENCE');
+  assert.ok(result.uncovered.some(item=>item.includes('30 elapsed minutes')));
+  assert.ok(!result.cases.some(c=>c.id==='context.expired'));
+  assert.equal(parseArguments(['--environment','TEST','--synthetic-fixture','notes.json']).syntheticFixture,'notes.json');
+});
+test('optional nullable fields survive NON_NULL wire serialization while zero-filling stays rejected',()=>{
+  const f=syntheticFixture();
+  const omitNulls=value=>Array.isArray(value)?value.map(omitNulls):value&&typeof value==='object'?
+    Object.fromEntries(Object.entries(value).filter(([,v])=>v!==null).map(([k,v])=>[k,omitNulls(v)])):value;
+  for(const c of f.cases)assert.equal(c.verify(omitNulls(f.payloads.get(c.id))),true,c.id);
+  for(const id of ['synthetic.today-partial','synthetic.pre-existence-is-unknown','synthetic.inventory-zero-unknown-and-age']){
+    const c=f.cases.find(c=>c.id===id),data=omitNulls(f.payloads.get(id));
+    if(id.endsWith('today-partial'))data.records[0].outboundQuantity=0;
+    else if(id.endsWith('pre-existence-is-unknown'))data.points[0].observedQuantity=0;
+    else data.records[3].availableQuantity=0;
+    assert.equal(c.verify(data),false,id);
+  }
+});
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentplanning/AppointmentBatchPreviewMapper.java b/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentplanning/AppointmentBatchPreviewMapper.java
index 03b0e15cb..f1a091b5f 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentplanning/AppointmentBatchPreviewMapper.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentplanning/AppointmentBatchPreviewMapper.java
@@ -13,7 +13,7 @@ public interface AppointmentBatchPreviewMapper {
           EXISTS(SELECT 1 FROM ll_order_detail d WHERE d.order_id=o.id AND d.customer_id=o.customer_id
             AND d.destination_warehouse_code IS NOT NULL AND d.destination_warehouse_code&lt;&gt;o.fba_warehouse_code) AS mixedDestinations,
           EXISTS(SELECT 1 FROM ll_inbound_fba_appointment_item i JOIN ll_inbound_fba_appointment a ON a.id=i.appointment_id
-            WHERE i.order_id=o.id AND i.customer_id=o.customer_id AND a.appointment_status NOT IN ('CANCELLED','FAILED')) AS activeAppointment
+            WHERE i.order_id=o.id AND i.customer_id=o.customer_id AND i.active=1 AND a.appointment_status NOT IN ('CANCELLED','FAILED')) AS activeAppointment
         FROM ll_order o WHERE o.id IN
         <foreach collection='ids' item='id' open='(' separator=',' close=')'>#{id}</foreach>
         """ + "</script>")
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentplanning/AppointmentBatchPreviewService.java b/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentplanning/AppointmentBatchPreviewService.java
index d879d084e..fd9a8edb8 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentplanning/AppointmentBatchPreviewService.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentplanning/AppointmentBatchPreviewService.java
@@ -12,14 +12,17 @@ import java.util.stream.Collectors;
 public class AppointmentBatchPreviewService {
     private final AppointmentSourceService sources;
     private final AppointmentBatchPreviewMapper mapper;
-    public AppointmentBatchPreviewService(AppointmentSourceService sources,AppointmentBatchPreviewMapper mapper) {
-        this.sources=sources;this.mapper=mapper;
+    private final AppointmentCargoVerificationService verification;
+    public AppointmentBatchPreviewService(AppointmentSourceService sources,AppointmentBatchPreviewMapper mapper,AppointmentCargoVerificationService verification) {
+        this.sources=sources;this.mapper=mapper;this.verification=verification;
     }
     public record Preview(AppointmentPlanningPolicy.Group group,String originWarehouseName,
                           String destinationWarehouseCode,String destinationTimezone,List<AppointmentSourceService.Source> sources,
-                          List<String> missingFields) { }
+                          List<String> missingFields,List<AppointmentCargoVerificationService.Context> cargoVerification) { }
     public Preview preview(List<AppointmentCoverageService.SourceRef> refs) {
         var resolved=sources.resolveBatch(refs);
+        var verified=resolved.stream().map(verification::inspect).toList();
+        var bySource=verified.stream().collect(Collectors.toMap(v->v.source().sourceKey(),Function.identity()));
         var ids=resolved.stream().map(AppointmentSourceService.Source::orderId).filter(Objects::nonNull).distinct().toList();
         var flags=ids.isEmpty()?java.util.Map.<Long,AppointmentBatchPreviewMapper.Flags>of():mapper.flags(ids).stream()
             .collect(Collectors.toMap(AppointmentBatchPreviewMapper.Flags::orderId,Function.identity()));
@@ -30,17 +33,19 @@ public class AppointmentBatchPreviewService {
             else if(state!=null) {
                 if(state.detained()) reason="货物暂扣，请先处理后再合批";
                 else if(state.mixedDestinations()) reason="货物含多个目的地，请先核对明细";
-                else if(state.activeAppointment()) reason="货物已有有效预约，请编辑原预约";
             }
+            var context=bySource.get(source.sourceKey());
+            if(context.sourceChanged() || context.unknownAllocationCount()>0 || context.effectivePackages()!=null && context.allocatedPackages()>context.effectivePackages()) reason="来源或已有分配待核实，请先处理原安排";
+            else if(context.availablePackages()!=null && context.availablePackages()<=0) reason="原来源箱数已全部分配，请继续已有批次";
             // Arrival/warehouse ETA is not a cargo-ready window. Until an authoritative producer exists it stays unknown.
             return new AppointmentPlanningPolicy.Cargo(source.sourceKey(),source.customerId(),source.originWarehouseId(),
-                source.destinationKey(),"US","US",source.packages(),null,null,reason==null,reason);
+                source.destinationKey(),"US","US",context.availablePackages()==null?null:Math.toIntExact(context.availablePackages()),null,null,reason==null,reason);
         }).toList();
         try {
             var group=AppointmentPlanningPolicy.group(cargo);
             return new Preview(group,resolved.get(0).originWarehouseName(),resolved.get(0).destinationWarehouseCode(),
                 sources.destinationTimezone(resolved.get(0).destinationWarehouseCode()),resolved,
-                group.unknownQuantitySources()>0?List.of("READY_WINDOW_UNVERIFIED","CARGO_QUANTITY_REVIEW"):List.of("READY_WINDOW_UNVERIFIED"));
+                group.unknownQuantitySources()>0?List.of("READY_WINDOW_UNVERIFIED","CARGO_QUANTITY_REVIEW"):List.of("READY_WINDOW_UNVERIFIED"),verified);
         } catch(IllegalArgumentException error) {
             throw new ResponseStatusException(HttpStatus.BAD_REQUEST,error.getMessage(),error);
         }
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentplanning/AppointmentCargoMapper.java b/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentplanning/AppointmentCargoMapper.java
index d19787cd8..0ebf79da8 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentplanning/AppointmentCargoMapper.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentplanning/AppointmentCargoMapper.java
@@ -35,7 +35,7 @@ public interface AppointmentCargoMapper {
           g.observed_at AS shipping_observed_at,g.provider_code AS shipping_provider,o.detained,
           EXISTS(SELECT 1 FROM ll_inbound_plan p WHERE p.source_order_id=o.id AND p.customer_id=o.customer_id) AS has_inbound_plan,
           EXISTS(SELECT 1 FROM ll_inbound_fba_appointment_item i JOIN ll_inbound_fba_appointment a ON a.id=i.appointment_id
-            WHERE i.order_id=o.id AND i.customer_id=o.customer_id AND a.appointment_status NOT IN ('CANCELLED','FAILED')) AS has_active_appointment,
+            WHERE i.order_id=o.id AND i.customer_id=o.customer_id AND i.active=1 AND a.appointment_status NOT IN ('CANCELLED','FAILED')) AS has_active_appointment,
           EXISTS(SELECT 1 FROM ll_order_detail d WHERE d.order_id=o.id AND d.customer_id=o.customer_id
             AND d.destination_warehouse_code IS NOT NULL AND d.destination_warehouse_code&lt;&gt;o.fba_warehouse_code) AS mixed_destinations
         """ + FILTER + " ORDER BY o.created_at DESC,o.id DESC LIMIT #{size} OFFSET #{offset}</script>")
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentplanning/AppointmentCargoVerification.java b/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentplanning/AppointmentCargoVerification.java
new file mode 100644
index 000000000..29bd0dd38
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentplanning/AppointmentCargoVerification.java
@@ -0,0 +1,27 @@
+package com.baiyue.lastleg.appointmentplanning;
+
+import com.baomidou.mybatisplus.annotation.TableId;
+import com.baomidou.mybatisplus.annotation.TableName;
+import lombok.Data;
+import java.time.LocalDateTime;
+
+/** Append-only appointment evidence; never updates an order or its declared cargo. */
+@Data
+@TableName("ll_appointment_cargo_verification")
+public class AppointmentCargoVerification {
+    @TableId private Long id;
+    private String customerId;
+    private String sourceKey;
+    private String destinationKey;
+    private String sourceVersion;
+    private Integer sourcePackages;
+    private Integer version;
+    private Integer packageCount;
+    private String shipmentReferencesJson;
+    private String remark;
+    private String operatorId;
+    private String operatorName;
+    private String commandKey;
+    private String requestHash;
+    private LocalDateTime createdAt;
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentplanning/AppointmentCargoVerificationController.java b/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentplanning/AppointmentCargoVerificationController.java
new file mode 100644
index 000000000..28cc4049e
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentplanning/AppointmentCargoVerificationController.java
@@ -0,0 +1,32 @@
+package com.baiyue.lastleg.appointmentplanning;
+
+import com.baiyue.common.core.api.ApiResponse;
+import com.baiyue.common.security.AuthenticatedUser;
+import com.baiyue.lastleg.security.OverseasPermissions;
+import jakarta.validation.Valid;
+import org.springframework.security.access.prepost.PreAuthorize;
+import org.springframework.security.core.annotation.AuthenticationPrincipal;
+import org.springframework.web.bind.annotation.*;
+
+@RestController
+@RequestMapping("/api/platform/v1/last-leg/appointment-planning/sources/{sourceKey}/cargo-verification")
+public class AppointmentCargoVerificationController {
+    private final AppointmentCargoVerificationService service;
+    public AppointmentCargoVerificationController(AppointmentCargoVerificationService service) {this.service=service;}
+
+    @GetMapping
+    @PreAuthorize("hasAuthority('platform:appointment:list') and hasAuthority('platform:overseas-warehouse:last-mile-order:list')")
+    public ApiResponse<AppointmentCargoVerificationService.Context> get(@AuthenticationPrincipal AuthenticatedUser user,
+        @PathVariable String sourceKey,@RequestParam String customerId,@RequestParam(required=false) String destinationKey) {
+        AppointmentPlanningController.requirePlatform(user);
+        return ApiResponse.success(service.get(sourceKey,customerId,destinationKey));
+    }
+
+    @PostMapping
+    @PreAuthorize("hasAuthority('platform:appointment:list') and hasAuthority('platform:overseas-warehouse:last-mile-order:list') and hasAuthority('"+OverseasPermissions.INBOUND_ORDER_FBA_APPOINTMENT+"')")
+    public ApiResponse<AppointmentCargoVerificationService.Verification> save(@AuthenticationPrincipal AuthenticatedUser user,
+        @PathVariable String sourceKey,@RequestParam String customerId,@Valid @RequestBody AppointmentCargoVerificationService.Save request) {
+        AppointmentPlanningController.requirePlatform(user);
+        return ApiResponse.success(service.save(sourceKey,customerId,request,user.userId().toString(),user.displayName()==null?user.username():user.displayName()));
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentplanning/AppointmentCargoVerificationMapper.java b/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentplanning/AppointmentCargoVerificationMapper.java
new file mode 100644
index 000000000..dc4710531
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentplanning/AppointmentCargoVerificationMapper.java
@@ -0,0 +1,52 @@
+package com.baiyue.lastleg.appointmentplanning;
+
+import com.baomidou.mybatisplus.core.mapper.BaseMapper;
+import org.apache.ibatis.annotations.Mapper;
+import org.apache.ibatis.annotations.Options;
+import org.apache.ibatis.annotations.Param;
+import org.apache.ibatis.annotations.Select;
+
+@Mapper
+public interface AppointmentCargoVerificationMapper extends BaseMapper<AppointmentCargoVerification> {
+    /** Same canonical source row used by allocation; flush pre-lock observations before re-reading. */
+    @Select("SELECT id FROM ll_order WHERE id=#{orderId} FOR UPDATE")
+    @Options(flushCache = Options.FlushCachePolicy.TRUE, useCache = false)
+    Long lockSourceOrder(@Param("orderId") Long orderId);
+
+    @Select("SELECT * FROM ll_appointment_cargo_verification WHERE customer_id=#{customerId} AND source_key=#{sourceKey} ORDER BY version DESC LIMIT 1")
+    AppointmentCargoVerification latest(@Param("customerId") String customerId,@Param("sourceKey") String sourceKey);
+
+    @Select("""
+        <script>
+        SELECT ranked.* FROM (
+          SELECT v.*,ROW_NUMBER() OVER(PARTITION BY customer_id,source_key ORDER BY version DESC) work_row
+          FROM ll_appointment_cargo_verification v WHERE
+          <foreach collection='refs' item='ref' separator=' OR '>(customer_id=#{ref.customerId} AND source_key=#{ref.sourceKey})</foreach>
+        ) ranked WHERE work_row=1
+        </script>
+        """)
+    java.util.List<AppointmentCargoVerification> latestBatch(@Param("refs") java.util.List<AppointmentCoverageService.SourceRef> refs);
+
+    @Select("SELECT * FROM ll_appointment_cargo_verification WHERE customer_id=#{customerId} AND source_key=#{sourceKey} AND command_key=#{key}")
+    AppointmentCargoVerification command(@Param("customerId") String customerId,@Param("sourceKey") String sourceKey,@Param("key") String key);
+
+    record Allocation(long packages, long unknownItems) { }
+    @Select("""
+        SELECT COALESCE(SUM(package_count),0) AS packages,
+               COUNT(*)-COUNT(package_count) AS unknownItems
+        FROM ll_inbound_fba_appointment_item
+        WHERE customer_id=#{customerId} AND source_key=#{sourceKey} AND active=1
+        """)
+    Allocation allocated(@Param("customerId") String customerId,@Param("sourceKey") String sourceKey);
+
+    record SourceAllocation(String customerId,String sourceKey,long packages,long unknownItems) { }
+    @Select("""
+        <script>
+        SELECT customer_id,source_key,COALESCE(SUM(package_count),0) packages,COUNT(*)-COUNT(package_count) unknown_items
+        FROM ll_inbound_fba_appointment_item WHERE active=1 AND (
+          <foreach collection='refs' item='ref' separator=' OR '>(customer_id=#{ref.customerId} AND source_key=#{ref.sourceKey})</foreach>
+        ) GROUP BY customer_id,source_key
+        </script>
+        """)
+    java.util.List<SourceAllocation> allocatedBatch(@Param("refs") java.util.List<AppointmentCoverageService.SourceRef> refs);
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentplanning/AppointmentCargoVerificationService.java b/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentplanning/AppointmentCargoVerificationService.java
new file mode 100644
index 000000000..e0bc99167
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentplanning/AppointmentCargoVerificationService.java
@@ -0,0 +1,171 @@
+package com.baiyue.lastleg.appointmentplanning;
+
+import com.baomidou.mybatisplus.core.toolkit.IdWorker;
+import com.fasterxml.jackson.core.type.TypeReference;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import jakarta.validation.constraints.*;
+import org.springframework.dao.DuplicateKeyException;
+import org.springframework.http.HttpStatus;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Isolation;
+import org.springframework.transaction.annotation.Transactional;
+import org.springframework.web.server.ResponseStatusException;
+import java.nio.charset.StandardCharsets;
+import java.security.MessageDigest;
+import java.time.*;
+import java.time.temporal.ChronoUnit;
+import java.util.*;
+
+@Service
+public class AppointmentCargoVerificationService {
+    private final AppointmentSourceService sources;
+    private final AppointmentCargoVerificationMapper mapper;
+    private final ObjectMapper json;
+
+    public AppointmentCargoVerificationService(AppointmentSourceService sources, AppointmentCargoVerificationMapper mapper,
+                                               ObjectMapper json) {
+        this.sources=sources; this.mapper=mapper; this.json=json;
+    }
+    public record Save(@NotBlank @Size(max=160) String destinationKey, @Size(max=160) String expectedSourceVersion,
+                       @Min(0) int expectedVersion, @Positive Integer packageCount,
+                       @NotNull @Size(max=100) List<@NotBlank @Size(max=128) String> shipmentReferences,
+                       @Size(max=1000) String remark, @NotBlank @Size(max=64) String idempotencyKey) { }
+    public record Verification(int version, String sourceVersion, String destinationKey, Integer sourcePackages,
+                               Integer packageCount, List<String> shipmentReferences, String remark,
+                               String operatorName, Instant verifiedAt) { }
+    public record Context(AppointmentSourceService.Source source, Verification verification,
+                          long allocatedPackages, long unknownAllocationCount, Integer effectivePackages,
+                          Long availablePackages, boolean sourceChanged, List<String> allowedActions,
+                          List<String> blockReasons) { }
+
+    @Transactional(readOnly=true)
+    public Context get(String sourceKey,String customerId,String destinationKey) {
+        return inspect(sourceKey,customerId,destinationKey);
+    }
+    /** Caller-owned transaction: a handled read prerequisite must not mark the whole work scan rollback-only. */
+    public Context inspect(String sourceKey,String customerId,String destinationKey) {
+        var source=sources.resolve(sourceKey,customerId,destinationKey);
+        return inspect(source);
+    }
+    public record Inspection(AppointmentCoverageService.SourceRef reference,Context context,ResponseStatusException error) {
+        public Context requireContext() { if(error!=null) throw error; return context; }
+    }
+    /** Shares source and warehouse reads within this call only; never caches mutable business facts across requests. */
+    public List<Inspection> inspectBatch(List<AppointmentCoverageService.SourceRef> refs) {
+        var result=new ArrayList<Inspection>();
+        for(int start=0;start<refs.size();start+=100) {
+            var batch=refs.subList(start,Math.min(start+100,refs.size()));
+            var resolved=sources.inspectBatch(batch);
+            var valid=resolved.stream().filter(r->r.error()==null).map(AppointmentSourceService.Resolution::reference).toList();
+            var latest=new HashMap<List<String>,AppointmentCargoVerification>();
+            var allocations=new HashMap<List<String>,AppointmentCargoVerificationMapper.Allocation>();
+            if(!valid.isEmpty()) {
+                mapper.latestBatch(valid).forEach(r->latest.put(List.of(r.getCustomerId(),r.getSourceKey()),r));
+                mapper.allocatedBatch(valid).forEach(r->allocations.put(List.of(r.customerId(),r.sourceKey()),new AppointmentCargoVerificationMapper.Allocation(r.packages(),r.unknownItems())));
+            }
+            for(var resolution:resolved) {
+                var key=List.of(resolution.reference().customerId(),resolution.reference().sourceKey());
+                result.add(new Inspection(resolution.reference(),resolution.error()==null?inspect(resolution.source(),latest.get(key),allocations.getOrDefault(key,new AppointmentCargoVerificationMapper.Allocation(0,0))):null,resolution.error()));
+            }
+        }
+        return List.copyOf(result);
+    }
+    /** Uses an already-authorized batched source resolution; never repeats warehouse HTTP lookups per row. */
+    public Context inspect(AppointmentSourceService.Source source) {
+        var row=mapper.latest(source.customerId(),source.sourceKey());
+        var allocation=mapper.allocated(source.customerId(),source.sourceKey());
+        return inspect(source,row,allocation);
+    }
+    private Context inspect(AppointmentSourceService.Source source,AppointmentCargoVerification row,AppointmentCargoVerificationMapper.Allocation allocation) {
+        boolean changed=row!=null && changed(row,source);
+        Integer total=row==null?source.packages():row.getPackageCount();
+        var reasons=new ArrayList<>(source.blockReasons());
+        if(changed) reasons.add("原来源资料已变化，请重新核实预约货物资料");
+        if(total==null || total<=0) reasons.add("箱数尚未核实");
+        if(allocation.unknownItems()>0) reasons.add("已有预约的分配箱数待核实");
+        if(total!=null && allocation.packages()>total) reasons.add("已有分配超过当前货量，请先复核原安排");
+        Long available=changed || total==null || total<=0 || allocation.unknownItems()>0 || allocation.packages()>total
+            ?null:total.longValue()-allocation.packages();
+        // Actions describe this endpoint's business capability; controller permissions remain mandatory.
+        var actions=source.canFollowup()?List.of("VERIFY_CARGO"):List.<String>of();
+        return new Context(source,row==null?null:view(row),allocation.packages(),allocation.unknownItems(),total,
+            available,changed,actions,List.copyOf(reasons));
+    }
+
+    @Transactional(isolation=Isolation.READ_COMMITTED)
+    public Verification save(String sourceKey,String customerId,Save request,String operatorId,String operatorName) {
+        validate(request,operatorId);
+        String hash=hash(customerId,sourceKey,operatorId,request);
+        var replay=mapper.command(customerId,sourceKey,request.idempotencyKey());
+        if(replay!=null) return replay(replay,hash);
+        var refs=List.of(new AppointmentCoverageService.SourceRef(customerId,sourceKey,request.destinationKey()));
+        sources.lockForWrite(refs);
+        var before=sources.resolveBatch(refs).get(0);
+        if(before.orderId()!=null && mapper.lockSourceOrder(before.orderId())==null) throw conflict("原货源已变化，请重新查询");
+        var source=sources.resolveBatch(refs).get(0);
+        if(!Objects.equals(before.orderId(),source.orderId())) throw conflict("货源关联已变化，请重新查询");
+        // The order/booking lock serializes verification with allocation and invalidates pre-lock facts.
+        replay=mapper.command(customerId,sourceKey,request.idempotencyKey());
+        if(replay!=null) return replay(replay,hash);
+        if(!source.canFollowup()) throw conflict("当前货源已完成、取消或尚未具备安排资格");
+        if(!Objects.equals(source.sourceVersion(),request.expectedSourceVersion())) throw conflict("原来源版本已变化，请重新核实");
+        var latest=mapper.latest(customerId,sourceKey);
+        if((latest==null?0:latest.getVersion())!=request.expectedVersion()) throw conflict("货物核实资料已更新，请刷新后提交");
+        Integer count=request.packageCount();
+        if(count!=null && source.packages()!=null && count>source.packages()) throw conflict("核实箱数不能超过原来源箱数，请先核对来源");
+        var allocation=mapper.allocated(customerId,sourceKey);
+        if(allocation.packages()>0 && (count==null || count<allocation.packages())) throw conflict("核实箱数不能低于已有预约分配总量");
+        var row=new AppointmentCargoVerification(); row.setId(IdWorker.getId());row.setCustomerId(customerId);row.setSourceKey(sourceKey);
+        row.setDestinationKey(source.destinationKey());row.setSourceVersion(source.sourceVersion());row.setSourcePackages(source.packages());
+        row.setVersion(request.expectedVersion()+1);row.setPackageCount(count);
+        row.setShipmentReferencesJson(encode(request.shipmentReferences().stream().map(String::trim).distinct().toList()));
+        row.setRemark(clean(request.remark()));row.setOperatorId(operatorId);row.setOperatorName(clean(operatorName));
+        row.setCommandKey(request.idempotencyKey());row.setRequestHash(hash);row.setCreatedAt(LocalDateTime.now(ZoneOffset.UTC).truncatedTo(ChronoUnit.MILLIS));
+        try { mapper.insert(row); }
+        catch(DuplicateKeyException error) {
+            var raced=mapper.command(customerId,sourceKey,request.idempotencyKey());
+            if(raced!=null) return replay(raced,hash);
+            throw conflict("核实资料版本已更新，请刷新后提交");
+        }
+        return view(row);
+    }
+
+    /** Caller already holds the original source lock when using this evidence to allocate or confirm. */
+    public Verification current(AppointmentSourceService.Source source) {
+        var row=mapper.latest(source.customerId(),source.sourceKey());
+        if(row!=null && changed(row,source)) throw conflict("原来源已变化，请重新核实预约货物资料");
+        return row==null?null:view(row);
+    }
+    private static boolean changed(AppointmentCargoVerification row,AppointmentSourceService.Source source) {
+        return !Objects.equals(row.getSourceVersion(),source.sourceVersion()) || !Objects.equals(row.getDestinationKey(),source.destinationKey())
+            || !Objects.equals(row.getSourcePackages(),source.packages());
+    }
+    private Verification replay(AppointmentCargoVerification row,String hash) {
+        if(!Objects.equals(row.getRequestHash(),hash)) throw conflict("同一保存请求的内容或操作人不一致，请核对核实记录");
+        return view(row);
+    }
+    private Verification view(AppointmentCargoVerification row) {
+        try {
+            return new Verification(row.getVersion(),row.getSourceVersion(),row.getDestinationKey(),row.getSourcePackages(),
+                row.getPackageCount(),json.readValue(row.getShipmentReferencesJson(),new TypeReference<List<String>>(){}),row.getRemark(),
+                row.getOperatorName(),row.getCreatedAt().toInstant(ZoneOffset.UTC));
+        } catch(com.fasterxml.jackson.core.JsonProcessingException error) {throw new IllegalStateException("核实资料不可读",error);}
+    }
+    private String hash(String customer,String source,String operator,Save request) {
+        try {return HexFormat.of().formatHex(MessageDigest.getInstance("SHA-256").digest((customer+"\n"+source+"\n"+operator+"\n"+encode(request)).getBytes(StandardCharsets.UTF_8)));}
+        catch(java.security.NoSuchAlgorithmException error) {throw new IllegalStateException(error);}
+    }
+    private String encode(Object value) {
+        try {return json.writeValueAsString(value);} catch(com.fasterxml.jackson.core.JsonProcessingException error) {throw new IllegalStateException("核实资料无法保存",error);}
+    }
+    private static void validate(Save request,String operator) {
+        if(request==null || clean(operator)==null || clean(request.idempotencyKey())==null || request.idempotencyKey().length()>64
+            || clean(request.destinationKey())==null || request.destinationKey().length()>160 || request.expectedVersion()<0
+            || request.packageCount()!=null && request.packageCount()<=0 || request.shipmentReferences()==null || request.shipmentReferences().size()>100
+            || request.shipmentReferences().stream().anyMatch(ref->clean(ref)==null || ref.length()>128)
+            || request.remark()!=null && request.remark().length()>1000 || request.expectedSourceVersion()!=null && request.expectedSourceVersion().length()>160)
+            throw new ResponseStatusException(HttpStatus.BAD_REQUEST,"请核对货物箱数、货件号及保存版本");
+    }
+    private static String clean(String value) {return value==null || value.isBlank()?null:value.trim();}
+    private static ResponseStatusException conflict(String message) {return new ResponseStatusException(HttpStatus.CONFLICT,message);}
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentplanning/AppointmentCoverageMapper.java b/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentplanning/AppointmentCoverageMapper.java
index 18f87dec6..2f31d1832 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentplanning/AppointmentCoverageMapper.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentplanning/AppointmentCoverageMapper.java
@@ -19,7 +19,7 @@ public interface AppointmentCoverageMapper {
     record Fact(Long orderId, String customerId, String appointmentNo, String status,
                 LocalDateTime appointmentAt, LocalDateTime appointmentEndAt, LocalDateTime updatedAt,
                 Long itemId, Integer packages, String warehouseCode,String sourceKey,String sourceVersion,
-                String confirmationNo,String timezone) { }
+                String confirmationNo,String timezone,Integer cargoVerificationVersion) { }
 
     @Select({"<script>SELECT o.id AS orderId,o.customer_id AS customerId,"+DESTINATION_TYPE+" AS destinationType,",
         DESTINATION_CODE+" AS fbaWarehouseCode,o.package_count AS packages,o.version,o.updated_at AS updatedAt, ",
@@ -31,11 +31,18 @@ public interface AppointmentCoverageMapper {
     @Select({"<script>SELECT i.order_id AS orderId,i.customer_id AS customerId,a.appointment_no AS appointmentNo,",
         "a.appointment_status AS status,a.appointment_at AS appointmentAt,a.appointment_end_at AS appointmentEndAt,",
         "a.updated_at AS updatedAt,i.id AS itemId,i.package_count AS packages,i.fba_warehouse_code AS warehouseCode, ",
-        "i.source_key AS sourceKey,i.source_version AS sourceVersion,a.confirmation_no AS confirmationNo,a.timezone ",
+        "i.source_key AS sourceKey,i.source_version AS sourceVersion,a.confirmation_no AS confirmationNo,a.timezone,i.cargo_verification_version AS cargoVerificationVersion ",
         "FROM ll_inbound_fba_appointment_item i JOIN ll_inbound_fba_appointment a ON a.id=i.appointment_id ",
         "WHERE i.active=1 AND a.appointment_status NOT IN ('FAILED','CANCELLED') AND ",
         "<foreach collection='sources' item='s' open='(' separator=' OR ' close=')'>",
         "(i.source_key=#{s.sourceKey} AND i.customer_id=#{s.customerId})</foreach>",
         " ORDER BY a.appointment_at,a.id,i.id</script>"})
     List<Fact> appointments(@Param("sources") List<AppointmentCoverageService.SourceRef> sources);
+
+    @Select({"<script>SELECT v.* FROM ll_appointment_cargo_verification v WHERE ",
+        "<foreach collection='sources' item='s' open='(' separator=' OR ' close=')'>",
+        "(v.source_key=#{s.sourceKey} AND v.customer_id=#{s.customerId})</foreach>",
+        " AND v.version=(SELECT MAX(latest.version) FROM ll_appointment_cargo_verification latest",
+        " WHERE latest.source_key=v.source_key AND latest.customer_id=v.customer_id)</script>"})
+    List<AppointmentCargoVerification> verifications(@Param("sources") List<AppointmentCoverageService.SourceRef> sources);
 }
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentplanning/AppointmentCoverageService.java b/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentplanning/AppointmentCoverageService.java
index edff9311b..bd0212c61 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentplanning/AppointmentCoverageService.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentplanning/AppointmentCoverageService.java
@@ -49,6 +49,7 @@ public class AppointmentCoverageService {
         var orders=unique.isEmpty() ? List.<AppointmentCoverageMapper.Source>of() : mapper.sources(unique);
         var orderMap=orders.stream().collect(Collectors.toMap(s -> new AppointmentCoverageMapper.OrderRef(s.customerId(),s.orderId()),s -> s));
         var facts=mapper.appointments(requested);
+        var verified=mapper.verifications(requested).stream().collect(Collectors.toMap(v->key(v.getCustomerId(),v.getSourceKey()),v->v));
         var bySource=facts.stream().collect(Collectors.groupingBy(f -> key(f.customerId(),f.sourceKey())));
         var output=new ArrayList<Coverage>();
         for (var source:requested) {
@@ -75,25 +76,30 @@ public class AppointmentCoverageService {
                 output.add(empty(source,"DESTINATION_MISMATCH","DESTINATION",version(order.version()),true)); continue;
             }
             var distinct=new LinkedHashMap<String,Appointment>();
+            var evidence=verified.get(key(source.customerId(),source.sourceKey()));
+            String currentVersion=(booking==null?"":"BOOKING:"+version(booking.recordVersion())+"/")+"ORDER:"+version(order.version());
+            Integer packages=evidence==null?order.packages():evidence.getPackageCount();
             var seen=new HashSet<Long>(); long confirmed=0, covered=0; boolean invalid=false, changed=false;
+            if(evidence!=null) changed=!Objects.equals(currentVersion,evidence.getSourceVersion())
+                || !Objects.equals(source.destinationKey(),evidence.getDestinationKey()) || !Objects.equals(order.packages(),evidence.getSourcePackages());
             for (var fact:relevant) {
                 if (fact.orderId()!=null && !Objects.equals(order.orderId(),fact.orderId()) || !Objects.equals(order.fbaWarehouseCode(),fact.warehouseCode()) || fact.packages()==null || fact.packages()<=0 || !seen.add(fact.itemId())) { invalid=true; continue; }
                 covered+=fact.packages();
                 boolean success="SUCCESS".equals(fact.status()) && fact.appointmentAt()!=null && !blank(fact.confirmationNo()) && !blank(fact.timezone());
                 if (success) confirmed+=fact.packages();
                 distinct.putIfAbsent(fact.appointmentNo(),new Appointment(fact.appointmentNo(),success ? fact.confirmationNo() : null,fact.status(),success ? fact.appointmentAt() : null,success ? fact.appointmentEndAt() : null,fact.timezone()));
-                String currentVersion=(booking==null?"":"BOOKING:"+version(booking.recordVersion())+"/")+"ORDER:"+version(order.version());
                 changed|=!Objects.equals(currentVersion,fact.sourceVersion());
+                if(evidence!=null) changed|=!Objects.equals(evidence.getVersion(),fact.cargoVerificationVersion());
             }
             var missing=new ArrayList<String>();
             String status;
-            if (invalid || order.packages()==null || order.packages()<=0 || covered>order.packages()) { status="REVIEW_REQUIRED"; missing.add("CARGO_QUANTITY_REVIEW"); }
+            if (invalid || packages==null || packages<=0 || covered>packages) { status="REVIEW_REQUIRED"; missing.add("CARGO_QUANTITY_REVIEW"); }
             else if (covered==0) { status="UNASSIGNED"; missing.add("RECEIVING_APPOINTMENT"); }
-            else if (covered<order.packages()) { status="PARTIAL"; missing.add("UNCOVERED_CARGO"); }
-            else if (confirmed<order.packages()) { status="PENDING"; missing.add("RECEIVING_CONFIRMATION"); }
+            else if (covered<packages) { status="PARTIAL"; missing.add("UNCOVERED_CARGO"); }
+            else if (confirmed<packages) { status="PENDING"; missing.add("RECEIVING_CONFIRMATION"); }
             else { status="CONFIRMED"; }
             if (relevant.stream().anyMatch(f->"SUCCESS".equals(f.status()) && blank(f.timezone()))) missing.add("APPOINTMENT_TIMEZONE_UNVERIFIED");
-            if (order.shipmentReferencesMissing()) missing.add("FBA_SHIPMENT_REFERENCES");
+            if (evidence==null ? order.shipmentReferencesMissing() : !hasReferences(evidence.getShipmentReferencesJson())) missing.add("FBA_SHIPMENT_REFERENCES");
             if (changed) missing.add("SOURCE_CHANGED_REVIEW");
             output.add(new Coverage(source.customerId(),source.sourceKey(),source.destinationKey(),status,List.copyOf(distinct.values()),List.copyOf(missing),
                 (booking==null ? "" : "BOOKING:"+version(booking.recordVersion())+"/")+"ORDER:"+version(order.version()),changed || invalid));
@@ -106,4 +112,13 @@ public class AppointmentCoverageService {
     private static String key(String customerId,String sourceKey) { return customerId+"\n"+sourceKey; }
     private static String version(Number version) { return version==null ? null : version.toString(); }
     private static boolean blank(String value) { return value==null || value.isBlank(); }
+    private static boolean hasReferences(String json) {
+        if(blank(json)) return false;
+        try {
+            var refs=new com.fasterxml.jackson.databind.ObjectMapper().readTree(json);
+            if(!refs.isArray() || refs.isEmpty()) return false;
+            for(var ref:refs) if(!ref.isTextual() || ref.asText().isBlank()) return false;
+            return true;
+        } catch(com.fasterxml.jackson.core.JsonProcessingException error) {throw new IllegalStateException("预约核实资料不可读",error);}
+    }
 }
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentplanning/AppointmentPlanningController.java b/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentplanning/AppointmentPlanningController.java
index c87933150..752a0c99f 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentplanning/AppointmentPlanningController.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentplanning/AppointmentPlanningController.java
@@ -29,6 +29,20 @@ public class AppointmentPlanningController {
     }
     public record Resolved(AppointmentSourceService.Source source, AppointmentCoverageService.Coverage coverage) { }
 
+    @GetMapping("/sources/resolve-order")
+    @PreAuthorize("hasAuthority('platform:appointment:list') and hasAuthority('platform:overseas-warehouse:last-mile-order:list')")
+    public ApiResponse<Resolved> resolveOrder(@AuthenticationPrincipal AuthenticatedUser user,
+        @RequestParam Long orderId, @RequestParam String customerId, @RequestParam(required=false) String destinationKey) {
+        requirePlatform(user);
+        if(orderId==null || orderId<=0 || customerId==null || customerId.isBlank() || customerId.length()>128)
+            throw new ResponseStatusException(HttpStatus.BAD_REQUEST,"请选择真实订单及所属客户");
+        var ref=sources.canonicalOrders(java.util.List.of(new AppointmentExternalSourceGateway.OrderRef(customerId,orderId))).get(0);
+        var source=sources.resolve(ref.sourceKey(),customerId,destinationKey);
+        if(!orderId.equals(source.orderId())) throw new ResponseStatusException(HttpStatus.CONFLICT,"订单与原来源关联已变化，请刷新后核对");
+        var result=coverage.query(java.util.List.of(new AppointmentCoverageService.SourceRef(source.customerId(),source.sourceKey(),source.destinationKey())));
+        return ApiResponse.success(new Resolved(source,result.get(0)));
+    }
+
     @GetMapping("/sources/resolve")
     @PreAuthorize("hasAuthority('platform:appointment:list') and hasAuthority('platform:overseas-warehouse:last-mile-order:list')")
     public ApiResponse<Resolved> resolve(@AuthenticationPrincipal AuthenticatedUser user,
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentplanning/AppointmentSourceLinker.java b/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentplanning/AppointmentSourceLinker.java
index cc32dcb5f..3325e85c2 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentplanning/AppointmentSourceLinker.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentplanning/AppointmentSourceLinker.java
@@ -1,42 +1,6 @@
 package com.baiyue.lastleg.appointmentplanning;
 
-import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
-import com.baomidou.mybatisplus.core.conditions.update.LambdaUpdateWrapper;
-import com.baiyue.lastleg.inboundplan.entity.InboundFbaAppointmentItem;
-import com.baiyue.lastleg.inboundplan.mapper.InboundFbaAppointmentItemMapper;
-import com.baiyue.lastleg.mapper.LastlegOrderMapper;
-import org.springframework.stereotype.Service;
-import org.springframework.transaction.annotation.Propagation;
-import org.springframework.transaction.annotation.Transactional;
-import org.springframework.web.server.ResponseStatusException;
-import org.springframework.http.HttpStatus;
-import java.util.List;
-import java.util.Objects;
-
-/** Called by actual incoming materialization, never as a migration or historical data repair. */
-@Service
-public class AppointmentSourceLinker {
-    private final LastlegOrderMapper orders;
-    private final InboundFbaAppointmentItemMapper items;
-    private final AppointmentExternalSourceGateway bookings;
-    public AppointmentSourceLinker(LastlegOrderMapper orders,InboundFbaAppointmentItemMapper items,AppointmentExternalSourceGateway bookings) {this.orders=orders;this.items=items;this.bookings=bookings;}
-    @Transactional(propagation=Propagation.MANDATORY)
-    public void materialized(String customerId,String bookingNo,Long orderId) {
-        var ref=new AppointmentExternalSourceGateway.SourceRef(customerId,bookingNo);
-        bookings.lockForAppointment(List.of(ref));
-        var matched=bookings.resolve(List.of(ref));
-        if(matched.size()!=1 || !Objects.equals(matched.get(0).customerId(),customerId) || !Objects.equals(matched.get(0).bookingNo(),bookingNo) || !Objects.equals(matched.get(0).orderId(),orderId)) throw conflict("来货与原登记的归属不一致，请核对");
-        var order=orderId==null?null:orders.selectById(orderId);
-        if(order==null || !Objects.equals(order.getCustomerId(),customerId)) throw conflict("来货尚未形成对应客户的真实货物");
-        var rows=items.selectList(new LambdaQueryWrapper<InboundFbaAppointmentItem>().eq(InboundFbaAppointmentItem::getSourceKey,"BOOKING:"+bookingNo)
-            .eq(InboundFbaAppointmentItem::getCustomerId,customerId).eq(InboundFbaAppointmentItem::getActive,true).last("FOR UPDATE"));
-        for(var row:rows) {
-            if(row.getOrderId()!=null && !row.getOrderId().equals(orderId)) throw conflict("原预约已关联其他来货，不能自动改绑");
-            if(Objects.equals(row.getOrderId(),orderId) && Objects.equals(row.getInboundCode(),order.getInboundCode())) continue;
-            try {items.update(null,new LambdaUpdateWrapper<InboundFbaAppointmentItem>().eq(InboundFbaAppointmentItem::getId,row.getId()).eq(InboundFbaAppointmentItem::getActive,true)
-                .set(InboundFbaAppointmentItem::getOrderId,orderId).set(InboundFbaAppointmentItem::getInboundCode,order.getInboundCode()));}
-            catch(org.springframework.dao.DuplicateKeyException duplicate){throw conflict("该来货已有其他有效预约，请先核对原安排");}
-        }
-    }
-    private static ResponseStatusException conflict(String message){return new ResponseStatusException(HttpStatus.CONFLICT,message);}
+/** Associates a newly materialized source with its receiving appointment in the caller's transaction. */
+public interface AppointmentSourceLinker {
+    void materialized(String customerId, String bookingNo, Long orderId);
 }
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentplanning/AppointmentSourceService.java b/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentplanning/AppointmentSourceService.java
index 1aa501921..62757c22c 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentplanning/AppointmentSourceService.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentplanning/AppointmentSourceService.java
@@ -60,12 +60,22 @@ public class AppointmentSourceService {
     }
     /** One catalog request and batched source reads, including mixed first-leg and external bookings. */
     public List<Source> resolveBatch(List<AppointmentCoverageService.SourceRef> requested) {
+        return resolveBatch(requested,true).stream().map(Resolution::requireSource).toList();
+    }
+    /** Read-only inspection keeps each source's prerequisite failure separate; infrastructure errors still escape. */
+    public record Resolution(AppointmentCoverageService.SourceRef reference,Source source,ResponseStatusException error) {
+        public Source requireSource() { if(error!=null) throw error; return source; }
+    }
+    public List<Resolution> inspectBatch(List<AppointmentCoverageService.SourceRef> requested) {
+        return resolveBatch(requested,false);
+    }
+    private List<Resolution> resolveBatch(List<AppointmentCoverageService.SourceRef> requested,boolean strict) {
         if(requested==null || requested.isEmpty() || requested.size()>100) throw bad("每批请选择1至100票真实货源");
         var keys=new LinkedHashSet<String>(); var orderIds=new LinkedHashSet<Long>();
         var bookingRefs=new java.util.ArrayList<AppointmentExternalSourceGateway.SourceRef>();
         for(var ref:requested) {
             if(ref==null || blank(ref.sourceKey()) || ref.sourceKey().length()>160 || blank(ref.customerId()) || ref.customerId().length()>128) throw bad("请选择完整的真实货源");
-            if(!keys.add(ref.sourceKey())) throw bad("同一来源货物不能重复选择");
+            if(!keys.add(ref.sourceKey()) && strict) throw bad("同一来源货物不能重复选择");
             if(ref.sourceKey().startsWith("ORDER:")) orderIds.add(orderId(ref.sourceKey()));
             else if(ref.sourceKey().startsWith("BOOKING:") && !blank(ref.sourceKey().substring(8))) bookingRefs.add(new AppointmentExternalSourceGateway.SourceRef(ref.customerId(),ref.sourceKey().substring(8)));
             else throw bad("不支持的货源类型");
@@ -77,17 +87,28 @@ public class AppointmentSourceService {
             if(booking.orderId()!=null) orderIds.add(booking.orderId());
         }
         var orderRows=orderIds.isEmpty()?List.<com.baiyue.lastleg.entity.LastlegOrder>of():orders.selectBatchIds(orderIds);
-        var directOrders=requested.stream().filter(ref->ref.sourceKey().startsWith("ORDER:")).map(ref->new AppointmentExternalSourceGateway.OrderRef(ref.customerId(),orderId(ref.sourceKey()))).toList();
-        if(!directOrders.isEmpty() && !external.resolveOrders(directOrders).isEmpty()) throw bad("该货物来自外接登记，请使用原登记来源继续预约");
+        var directOrders=requested.stream().filter(ref->ref.sourceKey().startsWith("ORDER:")).map(ref->new AppointmentExternalSourceGateway.OrderRef(ref.customerId(),orderId(ref.sourceKey()))).distinct().toList();
+        var externalOrders=directOrders.isEmpty()?Set.<AppointmentExternalSourceGateway.OrderRef>of():external.resolveOrders(directOrders).stream()
+            .map(s->new AppointmentExternalSourceGateway.OrderRef(s.customerId(),s.orderId())).collect(Collectors.toSet());
+        if(strict && !externalOrders.isEmpty()) throw bad("该货物来自外接登记，请使用原登记来源继续预约");
         var orderMap=orderRows.stream().collect(Collectors.toMap(com.baiyue.lastleg.entity.LastlegOrder::getId,Function.identity()));
         var transferRefs=orderRows.stream().filter(o->"WAREHOUSE_TRANSFER".equals(o.getOrderType())).map(o->new AppointmentCoverageMapper.OrderRef(o.getCustomerId(),o.getId())).toList();
         var destinations=transferRefs.isEmpty()?Map.<Long,AppointmentCoverageMapper.Source>of():destinationFacts.sources(transferRefs).stream().collect(Collectors.toMap(AppointmentCoverageMapper.Source::orderId,Function.identity()));
         var containerIds=orderRows.stream().filter(o->"FIRST_LEG".equals(o.getOrderType())).map(com.baiyue.lastleg.entity.LastlegOrder::getSourceContainerBookingId).filter(Objects::nonNull).distinct().toList();
         var gates=containerIds.isEmpty()?Map.<String,Boolean>of():shipping.selectBatchIds(containerIds).stream().collect(Collectors.toMap(g->g.getContainerBookingId(),g->g.getNodeSequence()!=null && g.getNodeSequence()>=40));
         var catalog=catalog();
-        var result=requested.stream().map(ref->resolve(ref.sourceKey(),ref.customerId(),ref.destinationKey(),orderMap,bookingMap,gates,catalog,destinations)).toList();
+        var result=requested.stream().map(ref->{
+            try {
+                if(ref.sourceKey().startsWith("ORDER:") && externalOrders.contains(new AppointmentExternalSourceGateway.OrderRef(ref.customerId(),orderId(ref.sourceKey()))))
+                    throw bad("该货物来自外接登记，请使用原登记来源继续预约");
+                return new Resolution(ref,resolve(ref.sourceKey(),ref.customerId(),ref.destinationKey(),orderMap,bookingMap,gates,catalog,destinations),null);
+            } catch(ResponseStatusException error) {
+                if(strict || error.getStatusCode().value()>=500) throw error;
+                return new Resolution(ref,null,error);
+            }
+        }).toList();
         var materialized=new java.util.HashSet<Long>();
-        for(var source:result) if(source.orderId()!=null && !materialized.add(source.orderId())) throw bad("同一货物存在重复来源，请保留原登记来源");
+        if(strict) for(var resolution:result) { var source=resolution.requireSource(); if(source.orderId()!=null && !materialized.add(source.orderId())) throw bad("同一货物存在重复来源，请保留原登记来源"); }
         return result;
     }
     private Source resolve(String sourceKey,String customerId,String destinationKey,
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkChanges.java b/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkChanges.java
new file mode 100644
index 000000000..8e57b4b66
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkChanges.java
@@ -0,0 +1,16 @@
+package com.baiyue.lastleg.appointmentwork;
+
+import org.springframework.stereotype.Component;
+import org.springframework.transaction.annotation.Propagation;
+import org.springframework.transaction.annotation.Transactional;
+
+/** Original business commands invalidate the manifest atomically with their business write. */
+@Component
+public class AppointmentWorkChanges {
+    private final AppointmentWorkMapper mapper;
+    public AppointmentWorkChanges(AppointmentWorkMapper mapper) { this.mapper=mapper; }
+    @Transactional(propagation=Propagation.MANDATORY)
+    public void requirementsChanged() {
+        if(mapper.invalidateRequirements()!=1) throw AppointmentWorkPolicy.unavailable("工作事项同步守卫未初始化");
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkCommandService.java b/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkCommandService.java
new file mode 100644
index 000000000..00130f914
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkCommandService.java
@@ -0,0 +1,177 @@
+package com.baiyue.lastleg.appointmentwork;
+
+import com.fasterxml.jackson.databind.JsonNode;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Transactional;
+import java.time.*;
+import java.util.*;
+import static com.baiyue.lastleg.appointmentwork.AppointmentWorkModels.*;
+import static com.baiyue.lastleg.appointmentwork.AppointmentWorkFactGateway.*;
+import static com.baiyue.lastleg.appointmentwork.AppointmentWorkPolicy.*;
+
+@Service
+public class AppointmentWorkCommandService {
+    private final AppointmentWorkStore store;
+    private final AppointmentWorkFactGateway gateway;
+    private final AppointmentWorkSyncService sync;
+    private final AppointmentWorkQueryService queries;
+    public AppointmentWorkCommandService(AppointmentWorkStore store,AppointmentWorkFactGateway gateway,AppointmentWorkSyncService sync,AppointmentWorkQueryService queries) {
+        this.store=store; this.gateway=gateway; this.sync=sync; this.queries=queries;
+    }
+    @Transactional
+    public CommandResult execute(String key,CommandRequest request,Actor actor) {
+        if(request==null || request.command()==null || request.expectedVersion()<0 || request.idempotencyKey()==null || request.idempotencyKey().isBlank() || request.idempotencyKey().length()>64 || request.payload()==null || !request.payload().isObject()) throw bad("工作命令参数无效");
+        String permission=switch(request.command()) { case SAVE_FOLLOWUP,RESOLVE_REVIEW->FOLLOWUP; default->MANAGE; };
+        if(!actor.has(LIST) || !actor.has(permission)) throw forbidden("缺少工作操作权限");
+        store.lock();
+        var state=store.get(key);
+        var hash=digest(actor.id()+"\n"+request.command()+"\n"+request.expectedVersion()+"\n"+canonical(request.payload()));
+        var replay=store.replay(key,request.idempotencyKey());
+        if(replay!=null) {
+            if(!Objects.equals(actor.id(),replay.getOperatorId()) || !Objects.equals(hash,replay.getRequestHash())) throw conflict("同一请求编号的操作者或内容不一致");
+            if(state.getReadPermissions().isEmpty() || !state.getReadPermissions().stream().allMatch(actor::has)) throw forbidden("关联来源读取权限已失效");
+            return store.read(replay.getResponseJson(),CommandResult.class);
+        }
+        var current=gateway.facts(state.getType()==Type.ROUTE?List.of():List.of(state)); var fact=current.get(key);
+        if(!canRead(state,fact,actor)) throw forbidden("无权读取关联业务来源");
+        state.setReadPermissions(state.getType()==Type.ROUTE?List.of(ORDER_READ):List.copyOf(fact.readPermissions()));
+        if(state.getVersion()!=request.expectedVersion()) throw conflict("事项已更新，请刷新后保留输入重新提交");
+        if(state.isRetired() || completed(fact)) throw conflict("该事项已完成或已替代，只能查看历史");
+        var payload=request.payload(); var affected=new LinkedHashSet<String>(); String summary;
+        switch(request.command()) {
+            case CONFIRM_ROUTE -> {
+                fields(payload,Set.of("flow","reason"),Set.of("flow"));
+                if(state.getType()!=Type.ROUTE) throw bad("只能在路线需求确认运输方式");
+                Flow flow; try { flow=Flow.valueOf(text(payload,"flow",true,16)); } catch(IllegalArgumentException e) { throw bad("运输路线无效"); }
+                if(flow==Flow.UNKNOWN) throw bad("请选择中转或直送");
+                var source=gateway.container(state.getContainerBookingId()); AppointmentWorkSyncService.validateSource(source);
+                if(!Objects.equals(state.getSourceVersion(),source.sourceVersion())) throw conflict("柜次来源版本变化，请先同步核对");
+                if(source.establishedFlow()!=Flow.UNKNOWN && source.establishedFlow()!=flow) throw conflict("选择路线与原业务既定路线不一致");
+                var existing=store.container(state.getContainerBookingId());
+                if(existing.stream().anyMatch(s->s.getType()!=Type.ROUTE)) throw conflict("该柜已生成路线工作，不能切换抹去已有安排");
+                affected.addAll(sync.generate(source,flow,existing,actor)); state.setFlow(flow); state.setRetired(true); state.setRetirementReason("ROUTE_CONFIRMED"); state.setReplacementKeys(List.copyOf(affected));
+                summary="确认"+(flow==Flow.TRANSFER?"海外仓中转":"整柜直送")+"；"+Objects.toString(text(payload,"reason",false,1000),"");
+            }
+            case SAVE_FOLLOWUP -> {
+                fields(payload,Set.of("ownerId","followupDate","note"),Set.of("ownerId","followupDate","note"));
+                state.setOwner(gateway.owner(text(payload,"ownerId",true,64),actor));
+                state.setFollowupDate(date(payload.get("followupDate")));
+                summary=text(payload,"note",true,1000);
+                // This command never clears pending acceptance, review, or original work requirements.
+            }
+            case RESOLVE_REVIEW -> {
+                fields(payload,Set.of("reviewVersion","note"),Set.of("reviewVersion","note"));
+                int version=integer(payload,"reviewVersion");
+                if(!state.isReviewRequired() || state.getReviewVersion()!=version) throw conflict("影响版本已变化，请重新核对");
+                if(changed(state,fact) || fact!=null && state.getObservedImpactToken()!=null
+                    && !Objects.equals(state.getObservedImpactToken(),fact.impactToken())) throw conflict("原业务已有更新，须先同步最新影响");
+                requireCurrentImpacts(state);
+                if(fact!=null && !fact.blockReasons().isEmpty()) throw conflict("原业务仍有阻断，请先处理原安排");
+                summary=text(payload,"note",true,1000); state.setReviewRequired(false); state.setReviewReason(null);
+            }
+            case SAVE_REQUIREMENT -> {
+                fields(payload,Set.of("target","bookingRequired","receivingRequirements","reason"),Set.of("target","bookingRequired","receivingRequirements","reason"));
+                if(!requirementOwned(state,fact)) throw conflict("该计划由原业务维护，请从原安排入口处理");
+                if(!payload.get("bookingRequired").isBoolean()) throw bad("预约要求须为布尔值");
+                boolean bookingRequired=payload.get("bookingRequired").asBoolean();
+                String requirements=text(payload,"receivingRequirements",false,1000),reason=text(payload,"reason",true,1000);
+                if(!bookingRequired && (state.getType()!=Type.DELIVERY || !"CUSTOMER".equals(state.getDestinationKind()) || requirements==null)) throw bad("仅客户仓可凭明确收货要求登记无需预约");
+                Slot target=slot(payload.get("target")); validateSlot(target);
+                String authorityZone=fact!=null && fact.timezone()!=null?fact.timezone():state.getTimezone();
+                if(target!=null && !Objects.equals(authorityZone,target.timezone())) throw conflict("作业地点时区尚未核实或已变化");
+                boolean hadPlan=arranged(state,fact);
+                boolean change=!Objects.equals(target,state.getTarget()) || state.isBookingRequired()!=bookingRequired || !Objects.equals(requirements,state.getReceivingRequirements());
+                state.setTarget(target); state.setBookingRequired(bookingRequired); state.setReceivingRequirements(requirements); state.setRequirementReason(reason);
+                if(hadPlan && change) affected.addAll(markDownstream(state,reason,actor));
+                summary=reason;
+            }
+            case HANDOFF_RETURN -> {
+                fields(payload,Set.of("recipient","reason"),Set.of("recipient","reason")); requireReturn(state);
+                var recipient=responsibility(payload.get("recipient"),actor);
+                String reason=text(payload,"reason",true,1000);
+                var previous=state.getResponsibility();
+                if(previous==null && fact!=null) previous=fact.responsibility();
+                if(previous==null) previous=new Responsibility(ResponsibilityKind.EXTERNAL,null,"原责任方待核实");
+                int version=state.getReturnHandoff()==null?1:state.getReturnHandoff().version()+1;
+                state.setReturnHandoff(new ReturnHandoff(version,previous,recipient,HandoffStatus.PENDING_ACCEPTANCE,reason));
+                if(state.getOwner()==null) state.setOwner(new Owner(actor.id(),actor.name()));
+                var localZone=queries.current(state,fact,actor).timezone();
+                state.setFollowupDate(LocalDate.now(localZone==null?REMINDER_ZONE:zone(localZone)));
+                summary="还空责任转交："+previous.name()+" → "+recipient.name()+"；待接手；"+reason;
+            }
+            case ACCEPT_RETURN -> {
+                fields(payload,Set.of("handoffVersion","note"),Set.of("handoffVersion","note")); requireReturn(state);
+                var handoff=state.getReturnHandoff();
+                if(handoff==null || handoff.status()!=HandoffStatus.PENDING_ACCEPTANCE || handoff.version()!=integer(payload,"handoffVersion")) throw conflict("还空转交版本变化或已经接手");
+                if(handoff.to().kind()==ResponsibilityKind.USER && !actor.id().equals(handoff.to().id())) throw forbidden("仅当前指定接手人可确认接手");
+                String note=text(payload,"note",handoff.to().kind()!=ResponsibilityKind.USER,1000);
+                state.setResponsibility(handoff.to()); state.setReturnHandoff(new ReturnHandoff(handoff.version(),handoff.from(),handoff.to(),HandoffStatus.ACCEPTED,handoff.reason()));
+                if(handoff.to().kind()==ResponsibilityKind.USER) state.setOwner(new Owner(actor.id(),actor.name()));
+                summary="已确认接手："+handoff.to().name()+"；"+Objects.toString(note,"本人确认");
+            }
+            default -> throw bad("不支持的工作命令");
+        }
+        store.save(state); affected.add(key);
+        var result=new CommandResult(queries.current(state,fact,actor),List.copyOf(affected));
+        store.history(state,actor,request.command().name(),summary,request.idempotencyKey(),hash,result);
+        return result;
+    }
+    private void requireCurrentImpacts(AppointmentWorkState state) {
+        store.requireInitialized();
+        var prerequisites=AppointmentWorkSyncService.impactPrerequisites(state,store.all());
+        if(prerequisites.isEmpty()) return;
+        var current=gateway.facts(prerequisites);
+        for(var prior:prerequisites) {
+            if(prior.getType()==Type.ROUTE) continue;
+            var fact=current.get(prior.getWorkItemKey());
+            if(fact==null) throw unavailable("关联安排权威事实缺失，不能完成复核");
+            if(prior.isObservedArranged() && prior.getObservedDependentImpactToken()!=null
+                && !Objects.equals(prior.getObservedDependentImpactToken(),fact.dependentImpactToken()))
+                throw conflict("关联安排已有新变化，须先同步最新影响再复核");
+        }
+    }
+    private List<String> markDownstream(AppointmentWorkState source,String reason,Actor actor) {
+        var states=store.all(); var keys=new LinkedHashSet<String>(); AppointmentWorkSyncService.expandDependents(source.getWorkItemKey(),states,keys); keys.remove(source.getWorkItemKey());
+        var candidates=states.stream().filter(s->keys.contains(s.getWorkItemKey()) && !s.isRetired()).toList(); var facts=gateway.facts(candidates); var affected=new ArrayList<String>();
+        for(var state:candidates) { var fact=facts.get(state.getWorkItemKey()); if(!completed(fact) && arranged(state,fact)) {
+            state.setReviewRequired(true); state.setReviewVersion(state.getReviewVersion()+1); state.setReviewReason(reason); store.save(state);
+            store.history(state,actor,"RELATED_CHANGE",reason,null,null,null); affected.add(state.getWorkItemKey());
+        } }
+        return affected;
+    }
+    private Responsibility responsibility(JsonNode node,Actor actor) {
+        fields(node,Set.of("kind","id","name"),Set.of("kind","id","name"));
+        ResponsibilityKind kind; try { kind=ResponsibilityKind.valueOf(text(node,"kind",true,16)); } catch(IllegalArgumentException e) { throw bad("责任方类型无效"); }
+        var id=text(node,"id",false,64); var name=text(node,"name",true,200);
+        if(kind==ResponsibilityKind.USER) { var owner=gateway.owner(id,actor); return new Responsibility(kind,owner.id(),owner.name()); }
+        if(kind==ResponsibilityKind.SUPPLIER) { if(!actor.has("platform:supplier:list")) throw forbidden("缺少供应商读取权限"); return gateway.supplier(id); }
+        if(id!=null) throw bad("外部责任方不接受未经核验的内部标识");
+        return new Responsibility(kind,null,name);
+    }
+    private static void requireReturn(AppointmentWorkState state) { if(state.getType()!=Type.EMPTY_RETURN) throw bad("仅还空事项可交接责任"); }
+    static void fields(JsonNode node,Set<String> allowed,Set<String> required) {
+        if(node==null || !node.isObject()) throw bad("命令payload须为对象");
+        var names=new HashSet<String>(); node.fieldNames().forEachRemaining(names::add);
+        if(!allowed.containsAll(names) || !names.containsAll(required)) throw bad("命令payload包含不支持的字段或缺少必需字段");
+    }
+    static String text(JsonNode node,String field,boolean required,int max) {
+        var value=node.get(field);
+        if(value==null || value.isNull()) { if(required) throw bad("请填写"+field); return null; }
+        if(!value.isTextual() || value.textValue().length()>max) throw bad(field+"格式无效");
+        var result=value.textValue().trim(); if(required && result.isEmpty()) throw bad("请填写"+field); return result.isEmpty()?null:result;
+    }
+    private int integer(JsonNode node,String name) { var value=node.get(name); if(value==null || !value.isIntegralNumber() || !value.canConvertToInt() || value.intValue()<0) throw bad(name+"必须为有效版本"); return value.intValue(); }
+    private LocalDate date(JsonNode value) { if(value==null || value.isNull()) return null; try { if(!value.isTextual()) throw bad("日期格式无效"); return LocalDate.parse(value.textValue()); } catch(java.time.DateTimeException e) { throw bad("日期格式无效"); } }
+    private Slot slot(JsonNode node) {
+        if(node==null || node.isNull()) return null;
+        fields(node,Set.of("date","startTime","endDate","endTime","timezone"),Set.of("date","startTime","endDate","endTime","timezone"));
+        try { return new Slot(date(node.get("date")),time(node.get("startTime")),date(node.get("endDate")),time(node.get("endTime")),text(node,"timezone",true,64)); }
+        catch(java.time.DateTimeException e) { throw bad("目标日期或时段格式无效"); }
+    }
+    private LocalTime time(JsonNode value) { if(value.isNull()) return null; if(!value.isTextual() || !value.textValue().matches("\\d{2}:\\d{2}")) throw bad("时段须为HH:mm"); return LocalTime.parse(value.textValue()); }
+    static String canonical(JsonNode node) {
+        if(node.isObject()) { var parts=new TreeMap<String,String>(); node.fields().forEachRemaining(e->parts.put(e.getKey(),canonical(e.getValue()))); return parts.toString(); }
+        if(node.isArray()) { var parts=new ArrayList<String>(); node.forEach(v->parts.add(canonical(v))); return parts.toString(); }
+        return node.toString();
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkCommitmentService.java b/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkCommitmentService.java
new file mode 100644
index 000000000..c6e8fe981
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkCommitmentService.java
@@ -0,0 +1,47 @@
+package com.baiyue.lastleg.appointmentwork;
+
+import com.fasterxml.jackson.databind.ObjectMapper;
+import org.springframework.stereotype.Component;
+import org.springframework.transaction.annotation.Propagation;
+import org.springframework.transaction.annotation.Transactional;
+import java.util.Objects;
+import static com.baiyue.lastleg.appointmentwork.AppointmentWorkModels.*;
+
+/** Audit baseline for semantic impacts. Written only by original business transactions, never by reads. */
+@Component
+public class AppointmentWorkCommitmentService {
+    public record Commitment(Slot target,Slot confirmed,String assignment,String cargoToken,boolean cancelled) { }
+    private final AppointmentWorkMapper mapper;
+    private final ObjectMapper json;
+    public AppointmentWorkCommitmentService(AppointmentWorkMapper mapper,ObjectMapper json) { this.mapper=mapper; this.json=json; }
+    @Transactional(propagation=Propagation.MANDATORY)
+    public void record(String key,Commitment current) {
+        var row=mapper.lockCommitment(key);
+        try {
+            if(row==null) mapper.insertCommitment(key,json.writeValueAsString(current));
+            else {
+                var previous=json.readValue(row.getStateJson(),Commitment.class);
+                mapper.updateCommitment(key,json.writeValueAsString(current),row.getImpactVersion()+(impacts(previous,current)?1:0));
+            }
+        } catch(com.fasterxml.jackson.core.JsonProcessingException error) { throw new IllegalStateException("无法保存原业务承诺影响依据",error); }
+    }
+    public String impactToken(String key) {
+        var row=mapper.commitment(key);
+        return key+":"+(row==null?0:row.getImpactVersion());
+    }
+    public java.util.Map<String,String> impactTokens(java.util.List<String> keys) {
+        var tokens=new java.util.HashMap<String,String>();
+        keys.forEach(key->tokens.put(key,key+":0"));
+        if(!keys.isEmpty()) mapper.commitments(keys).forEach(row->tokens.put(row.getEntityKey(),row.getEntityKey()+":"+row.getImpactVersion()));
+        return tokens;
+    }
+    public static boolean impacts(Commitment old,Commitment now) {
+        if(old.cancelled()!=now.cancelled()) return true;
+        boolean firstSameDayConfirmation=old.confirmed()==null && now.confirmed()!=null && old.target()!=null && old.target().date().equals(now.confirmed().date());
+        if(old.target()!=null && !Objects.equals(old.target(),now.target()) && !(firstSameDayConfirmation && now.target()==null)) return true;
+        if(old.confirmed()!=null && !Objects.equals(old.confirmed(),now.confirmed())) return true;
+        if(old.confirmed()==null && now.confirmed()!=null && old.target()!=null && !old.target().date().equals(now.confirmed().date())) return true;
+        if(old.assignment()!=null && !Objects.equals(old.assignment(),now.assignment())) return true;
+        return old.cargoToken()!=null && !Objects.equals(old.cargoToken(),now.cargoToken());
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkController.java b/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkController.java
new file mode 100644
index 000000000..7b18697f3
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkController.java
@@ -0,0 +1,53 @@
+package com.baiyue.lastleg.appointmentwork;
+
+import com.baiyue.common.core.api.ApiResponse;
+import com.baiyue.common.core.api.PageResult;
+import com.baiyue.common.security.AuthenticatedUser;
+import jakarta.validation.Valid;
+import org.springframework.security.access.prepost.PreAuthorize;
+import org.springframework.security.core.annotation.AuthenticationPrincipal;
+import org.springframework.web.bind.annotation.*;
+import java.time.LocalDate;
+import java.util.Set;
+import static com.baiyue.lastleg.appointmentwork.AppointmentWorkModels.*;
+import static com.baiyue.lastleg.appointmentwork.AppointmentWorkPolicy.*;
+
+@RestController
+@RequestMapping("/api/platform/v1/last-leg/appointment-work")
+@PreAuthorize("hasAuthority('platform:appointment:list')")
+public class AppointmentWorkController {
+    private final AppointmentWorkQueryService queries;
+    private final AppointmentWorkCommandService commands;
+    public AppointmentWorkController(AppointmentWorkQueryService queries,AppointmentWorkCommandService commands) { this.queries=queries; this.commands=commands; }
+    @GetMapping("/calendar")
+    public ApiResponse<CalendarResult> calendar(@AuthenticationPrincipal AuthenticatedUser user,
+        @RequestParam LocalDate from,@RequestParam LocalDate to,@RequestParam(required=false) Flow flow,@RequestParam(required=false) Set<Type> types) {
+        return ApiResponse.success(queries.calendar(from,to,flow,types,actor(user)));
+    }
+    @GetMapping("/summary")
+    public ApiResponse<Summary> summary(@AuthenticationPrincipal AuthenticatedUser user) { return ApiResponse.success(queries.summary(actor(user))); }
+    @GetMapping("/items")
+    public ApiResponse<PageResult<WorkItem>> items(@AuthenticationPrincipal AuthenticatedUser user,
+        @RequestParam(defaultValue="ALL") View view,@RequestParam(defaultValue="1") int page,@RequestParam(defaultValue="20") int size,
+        @RequestParam(required=false) LocalDate date,@RequestParam(required=false) Flow flow,@RequestParam(required=false) Set<Type> types,
+        @RequestParam(required=false) String containerBookingId,@RequestParam(required=false) Bucket bucket,@RequestParam(required=false) String keyword) {
+        return ApiResponse.success(queries.items(view,page,size,date,flow,types,containerBookingId,bucket,keyword,actor(user)));
+    }
+    @GetMapping("/items/resolve")
+    public ApiResponse<BatchWorkResolution> resolve(@AuthenticationPrincipal AuthenticatedUser user,@RequestParam String batchKey,@RequestParam(required=false) String customerId) {
+        return ApiResponse.success(queries.resolveBatch(batchKey,customerId,actor(user)));
+    }
+    @GetMapping("/items/{workItemKey}")
+    public ApiResponse<WorkDetail> detail(@AuthenticationPrincipal AuthenticatedUser user,@PathVariable String workItemKey) {
+        return ApiResponse.success(queries.detail(workItemKey,actor(user)));
+    }
+    @PostMapping("/items/{workItemKey}/commands")
+    public ApiResponse<CommandResult> command(@AuthenticationPrincipal AuthenticatedUser user,@PathVariable String workItemKey,@Valid @RequestBody CommandRequest request) {
+        return ApiResponse.success(commands.execute(workItemKey,request,actor(user)));
+    }
+    static Actor actor(AuthenticatedUser user) {
+        if(user==null || user.userId()==null) throw new org.springframework.web.server.ResponseStatusException(org.springframework.http.HttpStatus.UNAUTHORIZED);
+        if(!"PLATFORM".equals(user.appCode()) || !Long.valueOf(0).equals(user.tenantId()) || !user.permissions().contains(LIST)) throw forbidden("仅平台有权访问工作事项");
+        return new Actor(user.userId().toString(),user.displayName()==null?user.username():user.displayName(),user.permissions());
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkDirectTransportProvider.java b/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkDirectTransportProvider.java
new file mode 100644
index 000000000..47d2a4d22
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkDirectTransportProvider.java
@@ -0,0 +1,43 @@
+package com.baiyue.lastleg.appointmentwork;
+
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.stereotype.Component;
+import java.util.*;
+import static com.baiyue.lastleg.appointmentwork.AppointmentWorkFactGateway.*;
+import static com.baiyue.lastleg.appointmentwork.AppointmentWorkModels.*;
+import static com.baiyue.lastleg.appointmentwork.AppointmentWorkPolicy.*;
+
+/** Direct transport uses terminal carrier arrangements and real destination unloading, never warehouse stock. */
+@Component
+public class AppointmentWorkDirectTransportProvider implements BusinessProvider {
+    private final AppointmentWorkFirstlegClient firstleg;
+    private final String token;
+    public AppointmentWorkDirectTransportProvider(AppointmentWorkFirstlegClient firstleg,@Value("${baiyue.security.internal-service-token:}") String token) { this.firstleg=firstleg; this.token=token; }
+    public boolean supports(Type type,Flow flow) { return type==Type.TRANSPORT && flow==Flow.DIRECT; }
+    public List<Fact> read(List<FactRequest> requests) {
+        if(token==null || token.isBlank()) throw unavailable("内部服务身份未配置");
+        var input=new ArrayList<FactRequest>();
+        for(var r:requests) { input.add(request(r,Type.PICKUP,"/carrier")); input.add(request(r,Type.DELIVERY,"/delivery")); }
+        var facts=new HashMap<String,Fact>();
+        for(int start=0;start<input.size();start+=200) {
+            var batch=input.subList(start,Math.min(start+200,input.size())); var response=firstleg.facts(token,batch);
+            if(response==null || !response.successful()) throw unavailable("直送承运及卸货事实不可用");
+            AppointmentWorkFactAdapter.append(facts,batch,response.data());
+        }
+        return requests.stream().map(r->{
+            var carrier=facts.get(r.workItemKey()+"/carrier"); var delivery=facts.get(r.workItemKey()+"/delivery");
+            var original=carrier.executionStatus()==ExecutionStatus.COMPLETED?delivery.action():carrier.action();
+            var action=original==null?null:new Action(original.code(),original.label(),r.workItemKey(),original.target());
+            var read=new LinkedHashSet<>(carrier.readPermissions());read.addAll(delivery.readPermissions());
+            var missing=new LinkedHashSet<>(carrier.missingFields());missing.addAll(delivery.missingFields());
+            var refs=new LinkedHashSet<>(carrier.references());refs.addAll(delivery.references());
+            boolean done=delivery.executionStatus()==ExecutionStatus.COMPLETED;
+            return new Fact(r.workItemKey(),digest(carrier.fingerprint()+":"+delivery.fingerprint()),carrier.impactToken(),carrier.planExists(),carrier.planStatus(),
+                done?ExecutionStatus.COMPLETED:carrier.executionStatus()==ExecutionStatus.COMPLETED?ExecutionStatus.IN_PROGRESS:ExecutionStatus.PENDING,
+                carrier.target(),carrier.confirmed(),done?delivery.actual():null,done?delivery.timezone():carrier.timezone(),delivery.businessNo(),null,
+                List.copyOf(read),action==null?List.of():carrier.executionStatus()==ExecutionStatus.COMPLETED?delivery.actionPermissions():carrier.actionPermissions(),action,
+                done?List.of():carrier.executionStatus()==ExecutionStatus.COMPLETED?delivery.blockReasons():carrier.blockReasons(),List.copyOf(missing),List.copyOf(refs),carrier.responsibility(),null);
+        }).toList();
+    }
+    private FactRequest request(FactRequest r,Type type,String suffix) { return new FactRequest(r.workItemKey()+suffix,type,r.flow(),r.containerBookingId(),r.requirementKey(),r.batchKey(),null,r.batchKeys(),r.containers(),r.sources()); }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkDispatchPort.java b/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkDispatchPort.java
new file mode 100644
index 000000000..0428cd0ff
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkDispatchPort.java
@@ -0,0 +1,22 @@
+package com.baiyue.lastleg.appointmentwork;
+
+import jakarta.validation.constraints.*;
+import java.util.List;
+
+/** Real dispatch allocation boundary, implemented by the original appointment domain. */
+public interface AppointmentWorkDispatchPort {
+    record Allocation(@NotNull Long planPalletId,@NotBlank String batchKey,@NotBlank String customerId,
+                      @NotBlank String sourceKey,@NotBlank String destinationKey,@Positive int packageCount) { }
+    record PhysicalItem(Long itemId,Long planPalletId,String sourceStage,Integer packages) { }
+    record BatchSource(String sourceKey,String destinationKey,int packageCount) { }
+    record BatchReference(String batchKey,String batchNo,String customerId,List<BatchSource> sources) { }
+    /** Current original allocations, grouped for authorized dispatches; historical copies are read-only evidence. */
+    java.util.Map<Long,List<BatchReference>> references(List<Long> dispatchIds);
+    void bind(String customerId,long dispatchId,List<PhysicalItem> items,List<Allocation> allocations);
+    void requireReplay(String customerId,long dispatchId,List<Allocation> allocations);
+    void requireDeparture(String dispatchNo);
+    /** Read-only explanation; departure must repeat the same authority checks while holding batch locks. */
+    String departureBlockReason(String dispatchNo);
+    void removeItem(long dispatchId,long itemId);
+    void requireTripBinding(String dispatchNo,long tripId);
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkFactAdapter.java b/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkFactAdapter.java
new file mode 100644
index 000000000..3f9e71762
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkFactAdapter.java
@@ -0,0 +1,116 @@
+package com.baiyue.lastleg.appointmentwork;
+
+import org.springframework.beans.factory.ObjectProvider;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.stereotype.Component;
+import java.util.*;
+import static com.baiyue.lastleg.appointmentwork.AppointmentWorkModels.*;
+import static com.baiyue.lastleg.appointmentwork.AppointmentWorkFactGateway.*;
+import static com.baiyue.lastleg.appointmentwork.AppointmentWorkPolicy.*;
+
+@Component
+public class AppointmentWorkFactAdapter implements AppointmentWorkFactGateway {
+    private final AppointmentWorkFirstlegClient firstleg;
+    private final List<BusinessProvider> providers;
+    private final ObjectProvider<OwnerDirectory> directory;
+    private final ObjectProvider<RequirementProvider> requirements;
+    private final ObjectProvider<SupplierDirectory> suppliers;
+    private final String token;
+    public AppointmentWorkFactAdapter(AppointmentWorkFirstlegClient firstleg, ObjectProvider<BusinessProvider> providers,
+        ObjectProvider<OwnerDirectory> directory, ObjectProvider<RequirementProvider> requirements, ObjectProvider<SupplierDirectory> suppliers,
+        @Value("${baiyue.security.internal-service-token:}") String token) {
+        this.firstleg=firstleg; this.providers=providers.orderedStream().toList(); this.directory=directory; this.requirements=requirements; this.suppliers=suppliers; this.token=token;
+    }
+    public SourcePage discover(String after, int size) {
+        requireToken();
+        try { var response=firstleg.discover(token,after,size);
+            if(response==null || !response.successful() || response.data()==null) throw unavailable("已开船来源读取失败");
+            var page=response.data();
+            if(page.scopeVersion()==null || page.scopeVersion().isBlank() || page.containers()==null || page.containers().size()>size || !page.complete() && (page.nextCursor()==null || page.containers().isEmpty() || Objects.equals(after,page.nextCursor())))
+                throw unavailable("已开船来源分页不完整");
+            return page;
+        } catch(RuntimeException error) { throw unavailable("已开船来源不可用，不能计算完整工作范围",error); }
+    }
+    public ContainerSource container(String id) {
+        requireToken();
+        try { var response=firstleg.container(token,id);
+            if(response==null || !response.successful() || response.data()==null || !id.equals(response.data().containerBookingId())) throw unavailable("柜次事实缺失");
+            return response.data();
+        } catch(RuntimeException error) { throw unavailable("柜次权威事实不可用",error); }
+    }
+    public Map<String,Fact> facts(List<AppointmentWorkState> states) {
+        var result=new LinkedHashMap<String,Fact>();
+        var remote=new ArrayList<FactRequest>();
+        var groups=new LinkedHashMap<BusinessProvider,List<FactRequest>>();
+        for(var state:states) {
+            if(state.getType()==Type.ROUTE) continue;
+            var request=new FactRequest(state.getWorkItemKey(),state.getType(),state.getFlow(),state.getContainerBookingId(),state.getRequirementKey(),state.getBatchKey(),state.getTripKey(),state.getBatchKeys(),state.getContainers(),state.getSources());
+            if(state.getType()==Type.PICKUP || state.getType()==Type.EMPTY_RETURN || state.getType()==Type.DELIVERY && state.getFlow()==Flow.DIRECT) remote.add(request);
+            else {
+                var matches=providers.stream().filter(p->p.supports(state.getType(),state.getFlow())).toList();
+                if(matches.size()!=1) throw unavailable("原业务事实适配尚未就绪："+state.getType());
+                groups.computeIfAbsent(matches.get(0),ignored->new ArrayList<>()).add(request);
+            }
+        }
+        for(int start=0; start<remote.size(); start+=200) {
+            var requests=remote.subList(start,Math.min(start+200,remote.size())); requireToken();
+            try { var response=firstleg.facts(token,requests);
+                if(response==null || !response.successful()) throw unavailable("提柜及还空事实读取失败");
+                append(result,requests,response.data());
+            } catch(RuntimeException error) { throw unavailable("Firstleg工作事实不可用",error); }
+        }
+        groups.forEach((provider,requests)->{
+            for(int start=0; start<requests.size(); start+=200) {
+                var batch=requests.subList(start,Math.min(start+200,requests.size()));
+                try { append(result,batch,provider.read(batch)); }
+                catch(RuntimeException error) { throw unavailable("预约/收货/运输事实不可用",error); }
+            }
+        });
+        return result;
+    }
+    public List<Requirement> requirements(ContainerSource source,Flow effectiveFlow) {
+        var provider=requirements.getIfAvailable();
+        if(provider==null) throw unavailable("原预约需求与批次清单适配尚未接入，不能生成不完整工作清单");
+        var result=provider.requirements(source,effectiveFlow);
+        if(result==null || result.isEmpty()) throw unavailable("原预约需求清单缺失，不能以空清单完成路线生成");
+        return List.copyOf(result);
+    }
+    static void append(Map<String,Fact> target,List<FactRequest> requests,List<Fact> facts) {
+        if(facts==null || facts.size()!=requests.size()) throw unavailable("工作事实响应不完整");
+        var requestByKey=new HashMap<String,FactRequest>();requests.forEach(r->requestByKey.put(r.workItemKey(),r));
+        var expected=new HashSet<>(requestByKey.keySet());
+        for(var fact:facts) {
+            if(fact==null || !expected.remove(fact.workItemKey()) || fact.fingerprint()==null || fact.fingerprint().isBlank() || fact.impactToken()==null || fact.impactToken().isBlank() || fact.planStatus()==null || fact.executionStatus()==null
+                || fact.readPermissions()==null || fact.readPermissions().isEmpty() || fact.actionPermissions()==null || fact.blockReasons()==null || fact.missingFields()==null || fact.references()==null)
+                throw unavailable("工作事实缺少身份、版本或资格");
+            if(fact.executionStatus()==ExecutionStatus.COMPLETED && fact.actual()==null) throw unavailable("完成事实缺少实际时间");
+            var request=requestByKey.get(fact.workItemKey());
+            if(request.type()==Type.TRANSPORT && request.flow()==Flow.TRANSFER && (fact.transportPlanImpactToken()==null || fact.transportPlanImpactToken().isBlank()))
+                throw unavailable("共享车次事实缺少独立计划影响版本");
+            if(fact.actual()!=null) validateActual(fact.actual());
+            if(!fact.planExists() && (fact.target()!=null || fact.confirmed()!=null || fact.planStatus()==PlanStatus.CONFIRMED)) throw unavailable("原计划存在性与计划结果冲突");
+            validateSourceSlot(fact.target()); validateSourceSlot(fact.confirmed());
+            if(fact.timezone()!=null) zone(fact.timezone());
+            if(fact.actual()!=null && fact.actual().timezone()!=null) zone(fact.actual().timezone());
+            if(fact.action()!=null && (fact.action().target()==null || fact.action().target() instanceof WorkTarget || fact.actionPermissions().isEmpty())) throw unavailable("原业务动作缺少独立权限或越过工作命令边界");
+            if(target.putIfAbsent(fact.workItemKey(),fact)!=null) throw unavailable("工作事实重复");
+        }
+    }
+    public Owner owner(String id,Actor actor) {
+        if(id==null || id.isBlank()) throw bad("请选择负责人");
+        var resolver=directory.getIfAvailable();
+        if(resolver==null) throw unavailable("负责人目录尚未接入，不能确认其他接手人");
+        var owner=resolver.activePlatformOwner(id);
+        if(owner==null || !id.equals(owner.id())) throw bad("接手人不是有效平台操作人员");
+        return owner;
+    }
+    public Responsibility supplier(String id) {
+        if(id==null || id.isBlank()) throw bad("请选择供应商责任方");
+        var provider=suppliers.getIfAvailable();
+        if(provider==null) throw unavailable("供应商权威目录适配尚未接入");
+        var result=provider.activeSupplier(id);
+        if(result==null || result.kind()!=ResponsibilityKind.SUPPLIER || !id.equals(result.id()) || result.name()==null || result.name().isBlank()) throw bad("供应商责任方无效");
+        return result;
+    }
+    private void requireToken() { if(token==null || token.isBlank()) throw unavailable("内部服务身份未配置"); }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkFactGateway.java b/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkFactGateway.java
new file mode 100644
index 000000000..e37882ed9
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkFactGateway.java
@@ -0,0 +1,45 @@
+package com.baiyue.lastleg.appointmentwork;
+
+import java.time.Instant;
+import java.util.*;
+import static com.baiyue.lastleg.appointmentwork.AppointmentWorkModels.*;
+
+/** Authority ports. A missing entity must be explicitly represented; missing responses are failures. */
+public interface AppointmentWorkFactGateway {
+    record Requirement(String requirementKey, String batchKey, String batchNo, String destinationKind,
+        String originName, String destinationName, String timezone, List<BusinessReference> references,
+        List<String> replacesRequirementKeys, List<SourceReference> sources) { }
+    record ContainerSource(String containerBookingId, String containerNo, Instant departedAt, java.time.LocalDateTime departedLocalAt, java.time.LocalDateTime sailedEvidenceLocalAt,
+        String sourceVersion, Flow establishedFlow, String timezone, List<Requirement> requirements) { }
+    record SourcePage(List<ContainerSource> containers, String nextCursor, boolean complete, String scopeVersion) { }
+    record FactRequest(String workItemKey, Type type, Flow flow, String containerBookingId,
+        String requirementKey, String batchKey, String tripKey, List<String> batchKeys, List<ContainerReference> containers,
+        List<SourceReference> sources) { }
+    /** impactToken changes only for real changes to an existing commitment, never first arrangement/assignment. */
+    record Fact(String workItemKey, String fingerprint, String impactToken, boolean planExists, PlanStatus planStatus,
+        ExecutionStatus executionStatus, Slot target, Slot confirmed, Actual actual, String timezone,
+        String businessNo, String tripKey, List<String> readPermissions, List<String> actionPermissions,
+        Action action, List<String> blockReasons, List<String> missingFields, List<BusinessReference> references,
+        Responsibility responsibility, String transportPlanImpactToken) {
+        /** Shared fleet transport separates its own cargo impact from changes affecting receiving appointments. */
+        public String dependentImpactToken() { return transportPlanImpactToken==null?impactToken:transportPlanImpactToken; }
+        public boolean arranged() { return planStatus == PlanStatus.CONFIRMED || planStatus == PlanStatus.NOT_REQUIRED || target != null || confirmed != null; }
+    }
+    SourcePage discover(String after, int size);
+    ContainerSource container(String containerBookingId);
+    /** Original appointment core supplies the complete current obligation/batch manifest, including explicit replacement keys. */
+    List<Requirement> requirements(ContainerSource source,Flow effectiveFlow);
+    Map<String, Fact> facts(List<AppointmentWorkState> states);
+    Owner owner(String id, Actor actor);
+    Responsibility supplier(String id);
+
+    /** Implemented in original Lastleg business domains; they may depend on this port, never vice versa. */
+    interface BusinessProvider {
+        boolean supports(Type type, Flow flow);
+        List<Fact> read(List<FactRequest> requests);
+    }
+    /** IAM-backed active platform operators; display names supplied by callers are never trusted. */
+    interface OwnerDirectory { Owner activePlatformOwner(String id); }
+    interface SupplierDirectory { Responsibility activeSupplier(String id); }
+    interface RequirementProvider { List<Requirement> requirements(ContainerSource source,Flow effectiveFlow); }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkFirstlegClient.java b/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkFirstlegClient.java
new file mode 100644
index 000000000..4051cf1f5
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkFirstlegClient.java
@@ -0,0 +1,20 @@
+package com.baiyue.lastleg.appointmentwork;
+
+import com.baiyue.common.core.api.ApiResponse;
+import org.springframework.cloud.openfeign.FeignClient;
+import org.springframework.web.bind.annotation.*;
+import java.util.List;
+import static com.baiyue.lastleg.appointmentwork.AppointmentWorkFactGateway.*;
+
+/** Provider contract pending original-domain integration; HTTP errors are never treated as empty facts. */
+@FeignClient(name="firstleg-service", contextId="appointmentWorkFirstlegClient",
+    url="${FIRSTLEG_SERVICE_URL:${baiyue.clients.firstleg.url:}}")
+public interface AppointmentWorkFirstlegClient {
+    @GetMapping("/internal/firstleg/appointment-work/containers")
+    ApiResponse<SourcePage> discover(@RequestHeader("X-Internal-Service-Token") String token,
+        @RequestParam(value="after", required=false) String after, @RequestParam("size") int size);
+    @GetMapping("/internal/firstleg/appointment-work/containers/{id}")
+    ApiResponse<ContainerSource> container(@RequestHeader("X-Internal-Service-Token") String token, @PathVariable("id") String id);
+    @PostMapping("/internal/firstleg/appointment-work/facts")
+    ApiResponse<List<Fact>> facts(@RequestHeader("X-Internal-Service-Token") String token, @RequestBody List<FactRequest> requests);
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkFollowupInheritance.java b/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkFollowupInheritance.java
new file mode 100644
index 000000000..acf9cf65f
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkFollowupInheritance.java
@@ -0,0 +1,72 @@
+package com.baiyue.lastleg.appointmentwork;
+
+import org.springframework.stereotype.Component;
+import org.springframework.transaction.annotation.Propagation;
+import org.springframework.transaction.annotation.Transactional;
+import java.time.LocalDate;
+import java.util.*;
+import static com.baiyue.lastleg.appointmentwork.AppointmentWorkModels.*;
+import static com.baiyue.lastleg.appointmentwork.AppointmentWorkPolicy.*;
+
+/** A future work key may receive an audited follow-up seed before source discovery creates its work row. */
+@Component
+public class AppointmentWorkFollowupInheritance {
+    public record Member(String batchKey,String customerId) { }
+    private final AppointmentWorkStore store;
+    private final AppointmentWorkFactGateway.OwnerDirectory directory;
+    public AppointmentWorkFollowupInheritance(AppointmentWorkStore store,AppointmentWorkFactGateway.OwnerDirectory directory) {
+        this.store=store;this.directory=directory;
+    }
+    public AppointmentWorkStore.Followup resolve(String ownerId,LocalDate nextFollowupDate) {
+        if(ownerId==null || ownerId.isBlank()) throw bad("请选择有效平台负责人");
+        var owner=directory.activePlatformOwner(ownerId);
+        if(owner==null || !ownerId.equals(owner.id()) || owner.name()==null || owner.name().isBlank()) throw bad("负责人不是有效平台操作人员");
+        return new AppointmentWorkStore.Followup(owner,nextFollowupDate);
+    }
+    @Transactional(propagation=Propagation.MANDATORY)
+    public void seed(Member original,Member later,AppointmentWorkStore.Followup followup,String operatorId) {
+        key(original);key(later);
+        if(!original.customerId().equals(later.customerId()) || original.batchKey().equals(later.batchKey())) throw bad("跟进继承必须来自同一客户的原批次和新批次");
+        if(followup==null || followup.owner()==null || followup.owner().id()==null || followup.owner().id().isBlank() || followup.owner().name()==null || followup.owner().name().isBlank()) throw bad("后送跟进缺少真实负责人");
+        store.lock();write(later,followup,operatorId);
+    }
+    @Transactional(propagation=Propagation.MANDATORY)
+    public void inherit(List<Member> originals,List<Member> successors,String operatorId) {
+        validate(originals);validate(successors);store.lock();
+        var values=new HashMap<String,Set<AppointmentWorkStore.Followup>>();
+        for(var original:originals) {
+            var key=key(original);var state=store.find(key);
+            var current=state==null?store.inheritedFollowup(key):new AppointmentWorkStore.Followup(state.getOwner(),state.getFollowupDate());
+            if(current!=null) values.computeIfAbsent(original.customerId(),ignored->new HashSet<>()).add(current);
+        }
+        // Validate every target before writing; caller transaction still supplies rollback for all original-domain writes.
+        for(var successor:successors) if(values.getOrDefault(successor.customerId(),Set.of()).size()>1)
+            throw conflict("合批来源的负责人或跟进日期不同，请先在原工作事项统一后再合批");
+        for(var successor:successors) {
+            var current=values.getOrDefault(successor.customerId(),Set.of());
+            if(!current.isEmpty()) write(successor,current.iterator().next(),operatorId);
+        }
+    }
+    private void write(Member target,AppointmentWorkStore.Followup followup,String operatorId) {
+        if(operatorId==null || operatorId.isBlank()) throw bad("跟进继承缺少真实操作人");
+        var key=key(target);var state=store.find(key);var previous=store.inheritedFollowup(key);
+        if(state!=null) {
+            if(Objects.equals(state.getOwner(),followup.owner()) && Objects.equals(state.getFollowupDate(),followup.nextFollowupDate())) return;
+            throw conflict("目标工作已存在独立跟进，不能用继承覆盖");
+        }
+        if(previous!=null) {
+            if(previous.equals(followup)) return;
+            throw conflict("目标批次已有不同的跟进继承记录");
+        }
+        var future=new AppointmentWorkState();future.setWorkItemKey(key);
+        store.history(future,new Actor(operatorId,null,Set.of()),"FOLLOWUP_INHERITED","继承原送仓事项的负责人及跟进日期",null,null,followup);
+    }
+    private static String key(Member member) {
+        if(member==null || member.batchKey()==null || !member.batchKey().matches("FBA_APPOINTMENT:[1-9][0-9]*") || member.customerId()==null || member.customerId().isBlank()) throw bad("跟进继承缺少真实批次客户范围");
+        return AppointmentWorkPolicy.key("BATCH:"+member.batchKey(),Type.DELIVERY,customerRequirement(member.batchKey(),member.customerId()));
+    }
+    private static void validate(List<Member> members) {
+        if(members==null || members.isEmpty() || members.size()>2000 || new HashSet<>(members).size()!=members.size()) throw bad("跟进继承范围须为1至2000个不重复客户批次");
+        members.forEach(AppointmentWorkFollowupInheritance::key);
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkInternalController.java b/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkInternalController.java
new file mode 100644
index 000000000..cbdda7cc5
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkInternalController.java
@@ -0,0 +1,25 @@
+package com.baiyue.lastleg.appointmentwork;
+
+import com.baiyue.common.core.api.ApiResponse;
+import com.baiyue.lastleg.security.InternalServiceTokenGuard;
+import jakarta.validation.Valid;
+import org.springframework.web.bind.annotation.*;
+import static com.baiyue.lastleg.appointmentwork.AppointmentWorkModels.*;
+
+/** Internal orchestration only, not exposed through the public gateway. */
+@RestController
+@RequestMapping("/internal/lastleg/appointment-work")
+public class AppointmentWorkInternalController {
+    private final InternalServiceTokenGuard guard;
+    private final AppointmentWorkSyncService sync;
+    private final AppointmentWorkRouteService routes;
+    public AppointmentWorkInternalController(InternalServiceTokenGuard guard,AppointmentWorkSyncService sync,AppointmentWorkRouteService routes) { this.guard=guard; this.sync=sync; this.routes=routes; }
+    @GetMapping("/containers/{id}/route")
+    public ApiResponse<AppointmentWorkRouteService.Route> route(@RequestHeader(value="X-Internal-Service-Token",required=false) String token,@PathVariable String id) {
+        guard.verify(token); return ApiResponse.success(routes.route(id));
+    }
+    @PostMapping("/synchronize")
+    public ApiResponse<SyncResult> synchronize(@RequestHeader(value="X-Internal-Service-Token",required=false) String token,@Valid @RequestBody SyncRequest request) {
+        guard.verify(token); return ApiResponse.success(sync.synchronize(request));
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkMapper.java b/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkMapper.java
new file mode 100644
index 000000000..bb308b663
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkMapper.java
@@ -0,0 +1,71 @@
+package com.baiyue.lastleg.appointmentwork;
+
+import lombok.Data;
+import org.apache.ibatis.annotations.*;
+import java.time.LocalDateTime;
+import java.util.List;
+
+@Mapper
+public interface AppointmentWorkMapper {
+    @Data class Row {
+        private String workItemKey;
+        private String containerBookingId;
+        private int version;
+        private boolean retired;
+        private String stateJson;
+    }
+    @Data class Guard {
+        private int id;
+        private String scanCursor;
+        private boolean initialized;
+        private String scopeVersion;
+        private String scanScopeVersion;
+        private LocalDateTime completedAt;
+        private long requirementVersion;
+        private long synchronizedRequirementVersion;
+        private long scanRequirementVersion;
+    }
+    @Data class History {
+        private String id;
+        private String workItemKey;
+        private String operatorId;
+        private String operatorName;
+        private String action;
+        private String summary;
+        private String commandKey;
+        private String requestHash;
+        private String responseJson;
+        private LocalDateTime occurredAt;
+    }
+    @Data class CommitmentRow {
+        private String entityKey;
+        private String stateJson;
+        private long impactVersion;
+    }
+    @Select("SELECT * FROM ll_appointment_work_commitment WHERE entity_key=#{key} FOR UPDATE") CommitmentRow lockCommitment(String key);
+    @Select("SELECT * FROM ll_appointment_work_commitment WHERE entity_key=#{key}") CommitmentRow commitment(String key);
+    @Select("<script>SELECT * FROM ll_appointment_work_commitment WHERE entity_key IN <foreach collection='keys' item='key' open='(' separator=',' close=')'>#{key}</foreach></script>")
+    List<CommitmentRow> commitments(@Param("keys") List<String> keys);
+    @Insert("INSERT INTO ll_appointment_work_commitment(entity_key,state_json,impact_version) VALUES(#{key},#{json},0)")
+    int insertCommitment(@Param("key") String key,@Param("json") String json);
+    @Update("UPDATE ll_appointment_work_commitment SET state_json=#{json},impact_version=#{version} WHERE entity_key=#{key}")
+    int updateCommitment(@Param("key") String key,@Param("json") String json,@Param("version") long version);
+    @Select("SELECT * FROM ll_appointment_work_guard WHERE id=1 FOR UPDATE") Guard lockGuard();
+    @Select("SELECT * FROM ll_appointment_work_guard WHERE id=1") Guard guard();
+    @Update("UPDATE ll_appointment_work_guard SET scan_cursor=#{scanCursor},initialized=#{initialized},completed_at=#{completedAt},scope_version=#{scopeVersion},scan_scope_version=#{scanScopeVersion},synchronized_requirement_version=#{synchronizedRequirementVersion},scan_requirement_version=#{scanRequirementVersion} WHERE id=1") int saveGuard(Guard row);
+    @Update("UPDATE ll_appointment_work_guard SET requirement_version=requirement_version+1 WHERE id=1") int invalidateRequirements();
+    @Select("SELECT * FROM ll_appointment_work WHERE work_item_key=#{key}") Row get(String key);
+    @Select("SELECT * FROM ll_appointment_work ORDER BY work_item_key LIMIT #{limit}") List<Row> all(int limit);
+    @Select("SELECT * FROM ll_appointment_work WHERE container_booking_id=#{id} ORDER BY work_item_key") List<Row> container(String id);
+    @Insert("INSERT INTO ll_appointment_work(work_item_key,container_booking_id,version,retired,state_json) VALUES(#{workItemKey},#{containerBookingId},#{version},#{retired},#{stateJson})") int insert(Row row);
+    @Update("UPDATE ll_appointment_work SET version=#{version},retired=#{retired},state_json=#{stateJson} WHERE work_item_key=#{workItemKey} AND version=#{version}-1") int update(Row row);
+    @Select("SELECT * FROM ll_appointment_work_history WHERE work_item_key=#{key} AND command_key=#{commandKey}")
+    History command(@Param("key") String key,@Param("commandKey") String commandKey);
+    @Insert("""
+        INSERT INTO ll_appointment_work_history(id,work_item_key,operator_id,operator_name,action,summary,command_key,request_hash,response_json,occurred_at)
+        VALUES(#{id},#{workItemKey},#{operatorId},#{operatorName},#{action},#{summary},#{commandKey},#{requestHash},#{responseJson},#{occurredAt})
+        """) int insertHistory(History row);
+    @Select("SELECT * FROM ll_appointment_work_history WHERE work_item_key=#{key} ORDER BY occurred_at DESC,id DESC LIMIT 1001") List<History> selectHistory(@Param("key") String key);
+    @Select("SELECT * FROM ll_appointment_work_history WHERE work_item_key=#{key} AND action='FOLLOWUP_INHERITED' ORDER BY occurred_at DESC,id DESC LIMIT 1")
+    History inheritedFollowup(String key);
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkModels.java b/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkModels.java
new file mode 100644
index 000000000..6eca27ecd
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkModels.java
@@ -0,0 +1,77 @@
+package com.baiyue.lastleg.appointmentwork;
+
+import com.fasterxml.jackson.databind.JsonNode;
+import com.fasterxml.jackson.annotation.JsonSubTypes;
+import com.fasterxml.jackson.annotation.JsonTypeInfo;
+import com.fasterxml.jackson.annotation.JsonFormat;
+import jakarta.validation.constraints.*;
+import java.time.*;
+import java.util.*;
+
+/** Public v1 contracts. No editable cargo quantities or execution commands live here. */
+public final class AppointmentWorkModels {
+    private AppointmentWorkModels() { }
+    public enum Type { ROUTE, PICKUP, WAREHOUSE_RECEIPT, DELIVERY, TRANSPORT, EMPTY_RETURN }
+    public enum Flow { TRANSFER, DIRECT, UNKNOWN }
+    public enum PlanStatus { UNPLANNED, TARGET_SET, AWAITING_REPLY, CONFIRMED, NOT_REQUIRED }
+    public enum ExecutionStatus { PENDING, IN_PROGRESS, COMPLETED }
+    public enum DateBasis { ACTUAL, CONFIRMED, TARGET, NONE }
+    public enum View { ALL, FOLLOW_TODAY, OVERDUE, UNDATED, REVIEW }
+    public enum TargetKind { WORK_COMMAND, CARGO_VERIFICATION, FBA_APPOINTMENT, FIRSTLEG_CONTAINER, FLEET_TRIP, WAREHOUSE_RECEIPT, READ_ONLY }
+    public enum Command { CONFIRM_ROUTE, SAVE_FOLLOWUP, RESOLVE_REVIEW, SAVE_REQUIREMENT, HANDOFF_RETURN, ACCEPT_RETURN }
+    public enum Bucket { PENDING, CONFIRMED, NO_BOOKING_REQUIRED, REVIEW, COMPLETED }
+    public enum ActionCode { VIEW_DETAIL, SAVE_PLAN, REQUEST_BOOKING, RECORD_CONFIRMATION, CHANGE_BOOKING, CANCEL_BOOKING, VERIFY_CARGO, EDIT_BATCH, ARRANGE_TRANSPORT, RECORD_EXECUTION, CONFIRM_ROUTE, SAVE_FOLLOWUP, RESOLVE_REVIEW, SAVE_REQUIREMENT, HANDOFF_RETURN, ACCEPT_RETURN, VIEW_HISTORY }
+    public record Slot(LocalDate date, @com.fasterxml.jackson.databind.annotation.JsonSerialize(using=com.fasterxml.jackson.databind.ser.std.ToStringSerializer.class) LocalTime startTime, LocalDate endDate,
+        @com.fasterxml.jackson.databind.annotation.JsonSerialize(using=com.fasterxml.jackson.databind.ser.std.ToStringSerializer.class) LocalTime endTime, String timezone) { }
+    public record Actual(Instant occurredAt, LocalDateTime localOccurredAt, String timezone) { }
+    public record Owner(String id, String name) { }
+    public record ContainerReference(String containerBookingId, String bookingNo, String containerNo) { }
+    public record SourceReference(String customerId, String sourceKey, String destinationKey) { }
+    @JsonTypeInfo(use=JsonTypeInfo.Id.NAME, property="kind")
+    @JsonSubTypes({@JsonSubTypes.Type(value=WorkTarget.class,name="WORK_COMMAND"), @JsonSubTypes.Type(value=CargoTarget.class,name="CARGO_VERIFICATION"),
+        @JsonSubTypes.Type(value=AppointmentTarget.class,name="FBA_APPOINTMENT"), @JsonSubTypes.Type(value=ContainerTarget.class,name="FIRSTLEG_CONTAINER"),
+        @JsonSubTypes.Type(value=TripTarget.class,name="FLEET_TRIP"), @JsonSubTypes.Type(value=ReceiptTarget.class,name="WAREHOUSE_RECEIPT"), @JsonSubTypes.Type(value=ReadTarget.class,name="READ_ONLY")})
+    public sealed interface ActionTarget permits WorkTarget,CargoTarget,AppointmentTarget,ContainerTarget,TripTarget,ReceiptTarget,ReadTarget { }
+    public record WorkTarget(Command command) implements ActionTarget { }
+    public record CargoTarget(SourceReference source) implements ActionTarget { }
+    public record AppointmentTarget(String appointmentId,String batchKey,List<SourceReference> sources) implements ActionTarget { }
+    public record ContainerTarget(String containerBookingId) implements ActionTarget { }
+    public record TripTarget(String tripId,List<String> batchKeys) implements ActionTarget { }
+    public record ReceiptTarget(String inboundPlanId,String inboundPlanNo,String customerId,String containerBookingId) implements ActionTarget { }
+    public record ReadTarget(List<BusinessReference> references) implements ActionTarget { }
+    public record Action(ActionCode code, String label, String targetWorkItemKey, ActionTarget target) { }
+    public record WorkItem(String workItemKey, int version, Type type, Flow flow, String title,
+        String businessNo, List<ContainerReference> containers, String requirementKey,
+        String batchKey, String batchNo, String originName, String destinationName,
+        PlanStatus planStatus, ExecutionStatus executionStatus, boolean reviewRequired,
+        Slot target, Slot confirmed, Actual actual, LocalDate calendarDate, DateBasis dateBasis,
+        String timezone, Owner owner, LocalDate followupDate, List<String> overdueReasons,
+        List<Action> allowedActions, Action nextAction, List<String> blockReasons, List<String> missingFields) { }
+    public record BusinessReference(String kind, String key, String businessNo, String label) { }
+    public record HistoryEntry(Instant occurredAt, String operatorName, String action, String summary) { }
+    public record WorkDetail(WorkItem item, List<WorkItem> relatedItems,
+        List<BusinessReference> references, List<HistoryEntry> history, Review review, RequirementDetails requirement, ReturnHandoff returnHandoff) { }
+    public record BatchWorkCandidate(String customerId,String workItemKey,String batchNo) { }
+    public record BatchWorkResolution(String batchKey,String customerId,WorkDetail detail,List<BatchWorkCandidate> candidates) { }
+    public record Review(int version,List<String> reasons) { }
+    public record RequirementDetails(boolean bookingRequired,String receivingRequirements,String reason) { }
+    public enum ResponsibilityKind { USER, SUPPLIER, EXTERNAL }
+    public record Responsibility(ResponsibilityKind kind,String id,String name) { }
+    public enum HandoffStatus { PENDING_ACCEPTANCE, ACCEPTED }
+    public record ReturnHandoff(int version,Responsibility from,Responsibility to,HandoffStatus status,String reason) { }
+    public record Summary(long all, long followToday, long overdue, long undated, long review) { }
+    public record BucketCounts(long pending, long confirmed, long noBookingRequired, long review, long completed) { }
+    public record DayAggregate(LocalDate date, long total, Map<Type, Long> typeCounts, BucketCounts counts) { }
+    public record CalendarResult(LocalDate from, LocalDate to, long total, BucketCounts counts, List<DayAggregate> days) { }
+    public record CommandRequest(@NotNull Command command, @Min(0) int expectedVersion,
+        @NotBlank @Size(max=64) String idempotencyKey, @NotNull JsonNode payload) { }
+    public record CommandResult(WorkItem item, List<String> affectedWorkItemKeys) { }
+    public record SyncRequest(@Size(max=128) String afterContainerBookingId, @Min(1) @Max(100) int size) { }
+    public record SyncResult(int sources, int created, String nextCursor, boolean complete) { }
+    public record Actor(String id, String name, Set<String> permissions) {
+        public boolean has(String permission) { return permissions.contains(permission); }
+    }
+    public static final String LIST = "platform:appointment:list";
+    public static final String FOLLOWUP = "platform:appointment:followup";
+    public static final String MANAGE = "platform:appointment:manage-work";
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkOwnerClient.java b/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkOwnerClient.java
new file mode 100644
index 000000000..3f58df68f
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkOwnerClient.java
@@ -0,0 +1,11 @@
+package com.baiyue.lastleg.appointmentwork;
+
+import com.baiyue.common.core.api.ApiResponse;
+import org.springframework.cloud.openfeign.FeignClient;
+import org.springframework.web.bind.annotation.*;
+
+@FeignClient(name="iam-service",contextId="appointmentWorkOwnerClient",url="${baiyue.clients.iam.url:}")
+public interface AppointmentWorkOwnerClient {
+    @GetMapping("/internal/iam/platform-owners/{authUserId}")
+    ApiResponse<AppointmentWorkModels.Owner> active(@RequestHeader("X-Internal-Service-Token") String token,@PathVariable("authUserId") String id);
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkOwnerDirectory.java b/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkOwnerDirectory.java
new file mode 100644
index 000000000..5b02e466b
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkOwnerDirectory.java
@@ -0,0 +1,20 @@
+package com.baiyue.lastleg.appointmentwork;
+
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.stereotype.Component;
+import static com.baiyue.lastleg.appointmentwork.AppointmentWorkPolicy.*;
+
+@Component
+public class AppointmentWorkOwnerDirectory implements AppointmentWorkFactGateway.OwnerDirectory {
+    private final AppointmentWorkOwnerClient client;
+    private final String token;
+    public AppointmentWorkOwnerDirectory(AppointmentWorkOwnerClient client,@Value("${baiyue.security.internal-service-token:}") String token) { this.client=client; this.token=token; }
+    public AppointmentWorkModels.Owner activePlatformOwner(String id) {
+        if(token==null || token.isBlank()) throw unavailable("内部服务身份未配置");
+        var response=client.active(token,id);
+        if(response==null || !response.successful() || response.data()==null) throw unavailable("平台人员权威目录读取失败");
+        var owner=response.data();
+        if(!id.equals(owner.id()) || owner.name()==null || owner.name().isBlank()) throw unavailable("平台人员目录返回身份或姓名不完整");
+        return owner;
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkPolicy.java b/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkPolicy.java
new file mode 100644
index 000000000..2fe920bbc
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkPolicy.java
@@ -0,0 +1,174 @@
+package com.baiyue.lastleg.appointmentwork;
+
+import org.springframework.http.HttpStatus;
+import org.springframework.web.server.ResponseStatusException;
+import java.nio.charset.StandardCharsets;
+import java.security.MessageDigest;
+import java.time.*;
+import java.util.*;
+import static com.baiyue.lastleg.appointmentwork.AppointmentWorkModels.*;
+import static com.baiyue.lastleg.appointmentwork.AppointmentWorkFactGateway.*;
+
+public final class AppointmentWorkPolicy {
+    /** Explicit business fallback for reminder dates only; never used to fabricate actual/appointment time. */
+    public static final ZoneId REMINDER_ZONE=ZoneId.of("America/Los_Angeles");
+    public static final String ORDER_READ="platform:overseas-warehouse:last-mile-order:list";
+    private AppointmentWorkPolicy() { }
+    public static String customerRequirement(String batchKey,String customerId) {
+        if(batchKey==null || customerId==null || customerId.isBlank()) throw unavailable("送仓需求缺少批次或客户身份");
+        return batchKey+"|CUSTOMER:"+customerId;
+    }
+    public static String deliveryCustomer(List<SourceReference> sources) {
+        var customers=sources.stream().map(SourceReference::customerId).distinct().toList();
+        if(customers.size()!=1 || customers.get(0)==null || customers.get(0).isBlank()) throw unavailable("送仓事项须明确唯一客户货物范围");
+        return customers.get(0);
+    }
+    public static String key(String containerId,Type type,String requirementKey) {
+        return "AW-"+type.name()+"-"+digest(containerId+"\n"+Objects.toString(requirementKey,"")).substring(0,32);
+    }
+    public static String digest(String value) {
+        try { return HexFormat.of().formatHex(MessageDigest.getInstance("SHA-256").digest(value.getBytes(StandardCharsets.UTF_8))); }
+        catch(Exception e) { throw new IllegalStateException(e); }
+    }
+    public static void validateSlot(Slot slot) {
+        if(slot==null) return;
+        if(slot.date()==null || slot.timezone()==null || slot.timezone().isBlank()) throw bad("目标日期与地点时区必填");
+        validateSourceSlot(slot);
+        var zone=zone(slot.timezone());
+        for(int index=0; index<2; index++) { var time=index==0?slot.startTime():slot.endTime(); if(time==null) continue;
+            if(time.getSecond()!=0 || time.getNano()!=0) throw bad("时间精度须为分钟");
+            if(zone.getRules().getValidOffsets(LocalDateTime.of(index==0?slot.date():slot.endDate(),time)).size()!=1) throw bad("当地时段存在夏令时跳变或歧义，请重新选择");
+        }
+    }
+    /** Original local plans remain visible even when their source did not record a timezone. */
+    public static void validateSourceSlot(Slot slot) {
+        if(slot==null) return;
+        if(slot.date()==null) throw unavailable("原计划缺少当地日期");
+        if(slot.timezone()!=null) zone(slot.timezone());
+        if((slot.endDate()==null)!=(slot.endTime()==null) || slot.startTime()==null && slot.endTime()!=null) throw bad("结束日期与时间须同时填写，并先明确开始时间");
+        if(slot.endTime()!=null && !LocalDateTime.of(slot.endDate(),slot.endTime()).isAfter(LocalDateTime.of(slot.date(),slot.startTime()))) throw bad("完整结束时间必须晚于开始时间，不自动推断次日");
+    }
+    public static void validateActual(Actual actual) {
+        if(actual.occurredAt()==null && actual.localOccurredAt()==null) throw unavailable("实际事实缺少发生时间");
+        if(actual.timezone()!=null) {
+            var zone=zone(actual.timezone());
+            if(actual.occurredAt()!=null && actual.localOccurredAt()!=null && !actual.occurredAt().atZone(zone).toLocalDateTime().equals(actual.localOccurredAt()))
+                throw unavailable("实际发生时刻与当地时间不一致");
+        }
+    }
+    public static ZoneId zone(String value) {
+        if(value==null || !ZoneId.getAvailableZoneIds().contains(value)) throw bad("需要有效IANA地点时区");
+        return ZoneId.of(value);
+    }
+    public static boolean pendingHandoff(AppointmentWorkState state) {
+        return state.getReturnHandoff()!=null && state.getReturnHandoff().status()==HandoffStatus.PENDING_ACCEPTANCE;
+    }
+    public static boolean canRead(AppointmentWorkState state,Fact fact,Actor actor) {
+        return actor.has(LIST) && (state.getType()==Type.ROUTE ? actor.has(ORDER_READ) : fact!=null && fact.readPermissions().stream().allMatch(actor::has));
+    }
+    public static boolean arranged(AppointmentWorkState state,Fact fact) {
+        return state.getTarget()!=null || !state.isBookingRequired() || fact!=null && fact.arranged();
+    }
+    public static boolean changed(AppointmentWorkState state,Fact fact) {
+        return fact!=null && state.getObservedFingerprint()!=null && !Objects.equals(state.getObservedFingerprint(),fact.fingerprint());
+    }
+    public static boolean completed(Fact fact) { return fact!=null && fact.executionStatus()==ExecutionStatus.COMPLETED; }
+    public static WorkItem project(AppointmentWorkState state,Fact fact,Actor actor,Clock clock) {
+        boolean route=state.getType()==Type.ROUTE;
+        if(!route && fact==null) throw unavailable("缺少事项权威事实");
+        var target=fact!=null && fact.planExists()?fact.target():state.getTarget();
+        var confirmed=fact==null?null:fact.confirmed();
+        var actual=fact==null?null:fact.actual();
+        var execution=route?state.isRetired()?ExecutionStatus.COMPLETED:ExecutionStatus.PENDING:fact.executionStatus();
+        var plan=!state.isBookingRequired()?PlanStatus.NOT_REQUIRED:fact!=null && fact.planExists()?fact.planStatus():target!=null?PlanStatus.TARGET_SET:PlanStatus.UNPLANNED;
+        var basis=actual!=null?DateBasis.ACTUAL:confirmed!=null?DateBasis.CONFIRMED:target!=null?DateBasis.TARGET:DateBasis.NONE;
+        String timezone=actual!=null?actual.timezone():confirmed!=null?confirmed.timezone():target!=null?target.timezone():fact!=null && fact.timezone()!=null?fact.timezone():state.getTimezone();
+        LocalDate date=null;
+        var blocks=new ArrayList<String>(); var missing=new ArrayList<String>();
+        if(fact!=null) { blocks.addAll(fact.blockReasons()); missing.addAll(fact.missingFields()); }
+        if(actual!=null) {
+            validateActual(actual);
+            if(timezone!=null && actual.occurredAt()!=null) date=actual.occurredAt().atZone(zone(timezone)).toLocalDate();
+            else if(actual.localOccurredAt()!=null) date=actual.localOccurredAt().toLocalDate();
+            if(timezone==null && !missing.contains("SOURCE_TIMEZONE")) missing.add("SOURCE_TIMEZONE");
+        }
+        else if(confirmed!=null) { validateSourceSlot(confirmed); date=confirmed.date(); }
+        else if(target!=null) { validateSourceSlot(target); date=target.date(); }
+        if((confirmed!=null || target!=null) && timezone==null && !missing.contains("SOURCE_TIMEZONE")) missing.add("SOURCE_TIMEZONE");
+        var today=LocalDate.now(clock.withZone(timezone==null?REMINDER_ZONE:zone(timezone)));
+        if(timezone==null) missing.add("跟进日期按业务默认时区America/Los_Angeles判断；作业时区待核实");
+        if(state.getOwner()==null && execution!=ExecutionStatus.COMPLETED) missing.add("负责人待分配");
+        if(state.getFollowupDate()==null && execution!=ExecutionStatus.COMPLETED && !state.isRetired()) missing.add("下次跟进日期待安排");
+        var overdue=new ArrayList<String>();
+        if(execution!=ExecutionStatus.COMPLETED && !state.isRetired()) {
+            if(state.getFollowupDate()!=null && state.getFollowupDate().isBefore(today)) overdue.add("跟进日期已过");
+            if(date!=null && date.isBefore(today)) overdue.add("作业日期已过，尚未完成");
+        }
+        if(pendingHandoff(state) && execution!=ExecutionStatus.COMPLETED) blocks.add("还空接手尚未确认，继续跟进");
+        if(changed(state,fact)) blocks.add("原业务事实已变化，须同步影响后再复核");
+        var actions=new ArrayList<Action>();
+        if(execution!=ExecutionStatus.COMPLETED && !state.isRetired()) {
+            if(actor.has(FOLLOWUP)) actions.add(work(state,Command.SAVE_FOLLOWUP,"记录回复与跟进"));
+            if(route && actor.has(MANAGE)) actions.add(work(state,Command.CONFIRM_ROUTE,"确认路线"));
+            if(state.isReviewRequired() && actor.has(FOLLOWUP) && !changed(state,fact)) actions.add(work(state,Command.RESOLVE_REVIEW,"复核安排"));
+            if(actor.has(MANAGE) && requirementOwned(state,fact)) actions.add(work(state,Command.SAVE_REQUIREMENT,"登记作业要求"));
+            if(state.getType()==Type.EMPTY_RETURN && actor.has(MANAGE)) {
+                actions.add(work(state,Command.HANDOFF_RETURN,"转交还空责任"));
+                if(pendingHandoff(state) && (state.getReturnHandoff().to().kind()!=ResponsibilityKind.USER || actor.id().equals(state.getReturnHandoff().to().id()))) actions.add(work(state,Command.ACCEPT_RETURN,"确认接手反馈"));
+            }
+            if(fact!=null && fact.action()!=null) {
+                boolean executionBlocked=fact.action().code()==ActionCode.RECORD_EXECUTION && (!fact.blockReasons().isEmpty() || state.getType()!=Type.EMPTY_RETURN && (state.isReviewRequired() || changed(state,fact)));
+                if(fact.actionPermissions().stream().allMatch(actor::has) && !executionBlocked) actions.add(fact.action());
+                else if(!fact.actionPermissions().stream().allMatch(actor::has)) blocks.add("缺少原业务操作权限，可查看安排并联系有权限人员处理");
+            }
+        }
+        var read=new Action(execution==ExecutionStatus.COMPLETED?ActionCode.VIEW_HISTORY:ActionCode.VIEW_DETAIL,"查看详情",state.getWorkItemKey(),new ReadTarget(state.getReferences()));
+        actions.add(read);
+        Action next=actions.stream().filter(a->a.code()==ActionCode.ACCEPT_RETURN).findFirst().orElse(null);
+        if(next==null && pendingHandoff(state)) next=actions.stream().filter(a->a.code()==ActionCode.SAVE_FOLLOWUP).findFirst().orElse(read);
+        if(next==null) next=actions.stream().filter(a->a.code()==ActionCode.CONFIRM_ROUTE || a.code()==ActionCode.RESOLVE_REVIEW).findFirst().orElse(null);
+        if(next==null && fact!=null && fact.action()!=null && actions.contains(fact.action())) next=fact.action();
+        if(next==null) next=actions.stream().filter(a->a.code()==ActionCode.SAVE_REQUIREMENT || a.code()==ActionCode.SAVE_FOLLOWUP).findFirst().orElse(read);
+        var names=Map.of(Type.ROUTE,"确认路线",Type.PICKUP,"提柜",Type.WAREHOUSE_RECEIPT,"接仓卸柜",Type.DELIVERY,"送仓",Type.TRANSPORT,"用车",Type.EMPTY_RETURN,"还空柜");
+        var businessNo=fact==null?null:fact.businessNo();
+        var label=businessNo!=null?businessNo:state.getBatchNo()!=null?state.getBatchNo():state.getContainerNo()!=null?state.getContainerNo():"—";
+        return new WorkItem(state.getWorkItemKey(),state.getVersion(),state.getType(),state.getFlow(),label+" · "+names.get(state.getType()),businessNo,
+            state.getContainers().isEmpty()?List.of(new ContainerReference(state.getContainerBookingId(),null,state.getContainerNo())):List.copyOf(state.getContainers()),state.getRequirementKey(),state.getBatchKey(),state.getBatchNo(),
+            state.getOriginName(),state.getDestinationName(),plan,execution,state.isReviewRequired() && execution!=ExecutionStatus.COMPLETED,
+            target,confirmed,actual,date,basis,timezone,state.getOwner(),state.getFollowupDate(),List.copyOf(overdue),List.copyOf(actions),next,List.copyOf(blocks),List.copyOf(missing));
+    }
+    public static boolean requirementOwned(AppointmentWorkState state,Fact fact) {
+        return (fact==null || !fact.planExists()) && (state.getType()==Type.WAREHOUSE_RECEIPT || state.getType()==Type.EMPTY_RETURN || state.getType()==Type.DELIVERY && "CUSTOMER".equals(state.getDestinationKind()));
+    }
+    public static Action work(AppointmentWorkState state,Command command,String label) {
+        return new Action(ActionCode.valueOf(command.name()),label,state.getWorkItemKey(),new WorkTarget(command));
+    }
+    public static boolean followToday(WorkItem item,Clock clock) {
+        var today=LocalDate.now(clock.withZone(item.timezone()==null?REMINDER_ZONE:zone(item.timezone())));
+        return item.followupDate()!=null && !item.followupDate().isAfter(today) || item.blockReasons().contains("还空接手尚未确认，继续跟进");
+    }
+    public static Bucket bucket(WorkItem item) {
+        return item.executionStatus()==ExecutionStatus.COMPLETED?Bucket.COMPLETED:item.reviewRequired()?Bucket.REVIEW:
+            item.planStatus()==PlanStatus.CONFIRMED?Bucket.CONFIRMED:item.planStatus()==PlanStatus.NOT_REQUIRED?Bucket.NO_BOOKING_REQUIRED:Bucket.PENDING;
+    }
+    public static BucketCounts counts(List<WorkItem> items) {
+        var counts=new EnumMap<Bucket,Long>(Bucket.class); items.forEach(i->counts.merge(bucket(i),1L,Long::sum));
+        return new BucketCounts(counts.getOrDefault(Bucket.PENDING,0L),counts.getOrDefault(Bucket.CONFIRMED,0L),counts.getOrDefault(Bucket.NO_BOOKING_REQUIRED,0L),counts.getOrDefault(Bucket.REVIEW,0L),counts.getOrDefault(Bucket.COMPLETED,0L));
+    }
+    public static List<String> effectiveKeys(Collection<String> keys,Map<String,AppointmentWorkState> states) {
+        var pending=new ArrayDeque<>(keys); var seen=new HashSet<String>(); var effective=new LinkedHashSet<String>();
+        while(!pending.isEmpty()) {
+            var key=pending.remove(); if(!seen.add(key)) continue;
+            var state=states.get(key);
+            if(state!=null && state.isRetired() && !state.getReplacementKeys().isEmpty()) pending.addAll(state.getReplacementKeys());
+            else effective.add(key);
+        }
+        return List.copyOf(effective);
+    }
+    public static ResponseStatusException bad(String text) { return new ResponseStatusException(HttpStatus.BAD_REQUEST,text); }
+    public static ResponseStatusException conflict(String text) { return new ResponseStatusException(HttpStatus.CONFLICT,text); }
+    public static ResponseStatusException missing(String text) { return new ResponseStatusException(HttpStatus.NOT_FOUND,text); }
+    public static ResponseStatusException forbidden(String text) { return new ResponseStatusException(HttpStatus.FORBIDDEN,text); }
+    public static ResponseStatusException unavailable(String text) { return new ResponseStatusException(HttpStatus.SERVICE_UNAVAILABLE,text); }
+    public static ResponseStatusException unavailable(String text,Throwable cause) { return new ResponseStatusException(HttpStatus.SERVICE_UNAVAILABLE,text,cause); }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkQueryService.java b/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkQueryService.java
new file mode 100644
index 000000000..b8be03d3a
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkQueryService.java
@@ -0,0 +1,157 @@
+package com.baiyue.lastleg.appointmentwork;
+
+import com.baiyue.common.core.api.PageResult;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Transactional;
+import java.time.*;
+import java.time.temporal.ChronoUnit;
+import java.util.*;
+import java.util.function.Function;
+import java.util.function.Predicate;
+import java.util.stream.Collectors;
+import static com.baiyue.lastleg.appointmentwork.AppointmentWorkModels.*;
+import static com.baiyue.lastleg.appointmentwork.AppointmentWorkFactGateway.*;
+import static com.baiyue.lastleg.appointmentwork.AppointmentWorkPolicy.*;
+
+@Service
+@Transactional(readOnly=true)
+public class AppointmentWorkQueryService {
+    private final AppointmentWorkStore store;
+    private final AppointmentWorkFactGateway facts;
+    private final Clock clock;
+    @org.springframework.beans.factory.annotation.Autowired
+    public AppointmentWorkQueryService(AppointmentWorkStore store,AppointmentWorkFactGateway facts) { this(store,facts,Clock.systemUTC()); }
+    AppointmentWorkQueryService(AppointmentWorkStore store,AppointmentWorkFactGateway facts,Clock clock) { this.store=store; this.facts=facts; this.clock=clock; }
+    record Snapshot(List<AppointmentWorkState> states,Map<String,Fact> facts,List<WorkItem> items) { }
+    Snapshot snapshot(Actor actor) {
+        return snapshot(actor,s->true,true);
+    }
+    private Snapshot snapshot(Actor actor,Predicate<AppointmentWorkState> selected,boolean includeNext) {
+        String scopeVersion=store.requireInitialized();
+        if(!Objects.equals(scopeVersion,facts.discover(null,1).scopeVersion())) throw conflict("已开船工作范围变化，请先完成服务端同步");
+        var all=store.all();
+        var stateByKey=all.stream().collect(Collectors.toMap(AppointmentWorkState::getWorkItemKey,Function.identity()));
+        var selectedKeys=all.stream().filter(s->!s.isRetired() && selected.test(s)).map(AppointmentWorkState::getWorkItemKey).collect(Collectors.toSet());
+        var needed=new HashSet<>(selectedKeys);
+        if(includeNext) {
+            var pending=new ArrayDeque<>(selectedKeys);
+            while(!pending.isEmpty()) {
+                var state=stateByKey.get(pending.remove());
+                for(var key:effectiveKeys(state.getPrerequisites(),stateByKey)) if(stateByKey.containsKey(key) && needed.add(key)) pending.add(key);
+            }
+        }
+        var states=all.stream().filter(s->!s.isRetired() && needed.contains(s.getWorkItemKey())).toList();
+        var current=facts.facts(states);
+        var visible=states.stream().filter(s->canRead(s,current.get(s.getWorkItemKey()),actor)).toList();
+        var items=visible.stream().map(s->project(s,current.get(s.getWorkItemKey()),actor,clock)).toList();
+        var byKey=items.stream().collect(Collectors.toMap(WorkItem::workItemKey,Function.identity()));
+        return new Snapshot(all,current,items.stream().filter(i->selectedKeys.contains(i.workItemKey()))
+            .map(i->includeNext?withNext(i,next(i,byKey,stateByKey,new HashSet<>())):i).toList());
+    }
+    private Action next(WorkItem item,Map<String,WorkItem> items,Map<String,AppointmentWorkState> states,Set<String> visited) {
+        if(!visited.add(item.workItemKey()) || item.reviewRequired()) return item.nextAction();
+        if(item.type()==Type.DELIVERY && item.executionStatus()!=ExecutionStatus.COMPLETED && item.blockReasons().isEmpty()
+            && (item.planStatus()==PlanStatus.CONFIRMED || item.planStatus()==PlanStatus.NOT_REQUIRED)) {
+            for(var key:effectiveKeys(states.get(item.workItemKey()).getPrerequisites(),states)) {
+                var transport=items.get(key);
+                if(transport==null || transport.type()!=Type.TRANSPORT || transport.executionStatus()==ExecutionStatus.COMPLETED) continue;
+                var action=transport.nextAction();
+                if(action==null) continue;
+                if(action.code()==ActionCode.RESOLVE_REVIEW)
+                    return new Action(action.code(),"先复核车辆安排",transport.workItemKey(),action.target());
+                if(action.code()==ActionCode.ARRANGE_TRANSPORT && action.target() instanceof TripTarget target)
+                    return new Action(action.code(),target.tripId()==null?"继续安排本批车辆":"核对本车发车安排",transport.workItemKey(),target);
+            }
+        }
+        if(item.blockReasons().isEmpty()) return item.nextAction();
+        for(var key:effectiveKeys(states.get(item.workItemKey()).getPrerequisites(),states)) {
+            var prior=items.get(key);
+            if(prior!=null && prior.executionStatus()!=ExecutionStatus.COMPLETED && (prior.reviewRequired() || prior.planStatus()==PlanStatus.UNPLANNED || prior.planStatus()==PlanStatus.AWAITING_REPLY)) {
+                var action=next(prior,items,states,visited);
+                if(action!=null) return new Action(action.code(),"先"+action.label().replaceFirst("^先",""),action.targetWorkItemKey(),action.target());
+            }
+        }
+        return item.nextAction();
+    }
+    public Summary summary(Actor actor) {
+        var items=snapshot(actor,s->true,false).items().stream().filter(i->i.executionStatus()!=ExecutionStatus.COMPLETED).toList();
+        return new Summary(items.size(),items.stream().filter(i->followToday(i,clock)).count(),items.stream().filter(i->!i.overdueReasons().isEmpty()).count(),items.stream().filter(i->i.calendarDate()==null).count(),items.stream().filter(WorkItem::reviewRequired).count());
+    }
+    public CalendarResult calendar(LocalDate from,LocalDate to,Flow flow,Set<Type> types,Actor actor) {
+        if(from==null || to==null || to.isBefore(from) || ChronoUnit.DAYS.between(from,to)>=62) throw bad("日历范围须为1至62天");
+        if(types!=null && types.contains(Type.ROUTE)) throw bad("路线待确认需求请从全局待办查看");
+        var items=snapshot(actor,s->s.getType()!=Type.ROUTE && matches(s,flow,types,null),false).items().stream().filter(i->i.type()!=Type.ROUTE && i.calendarDate()!=null && !i.calendarDate().isBefore(from) && !i.calendarDate().isAfter(to))
+            .filter(i->flow==null || i.flow()==flow).filter(i->types==null || types.contains(i.type())).toList();
+        var groups=items.stream().collect(Collectors.groupingBy(WorkItem::calendarDate,TreeMap::new,Collectors.toList()));
+        var days=groups.entrySet().stream().map(e->new DayAggregate(e.getKey(),e.getValue().size(),e.getValue().stream().collect(Collectors.groupingBy(WorkItem::type,()->new EnumMap<>(Type.class),Collectors.counting())),counts(e.getValue()))).toList();
+        return new CalendarResult(from,to,items.size(),counts(items),days);
+    }
+    public PageResult<WorkItem> items(View view,int page,int size,LocalDate date,Flow flow,Set<Type> types,String containerId,Bucket bucket,String keyword,Actor actor) {
+        if(page<1 || size<1 || size>100 || keyword!=null && keyword.length()>128) throw bad("分页或搜索条件无效");
+        var word=keyword==null?"":keyword.trim().toLowerCase(Locale.ROOT);
+        var items=snapshot(actor,s->matches(s,flow,types,containerId) && candidate(s,view),true).items().stream()
+            .filter(i->date!=null || i.executionStatus()!=ExecutionStatus.COMPLETED)
+            .filter(i->date==null || date.equals(i.calendarDate()))
+            .filter(i->flow==null || flow==i.flow()).filter(i->types==null || types.contains(i.type()))
+            .filter(i->containerId==null || i.containers().stream().anyMatch(c->containerId.equals(c.containerBookingId())))
+            .filter(i->bucket==null || bucket==bucket(i))
+            .filter(i->word.isEmpty() || searchable(i).contains(word))
+            .filter(i->switch(view) { case ALL->true; case FOLLOW_TODAY->i.executionStatus()!=ExecutionStatus.COMPLETED && followToday(i,clock); case OVERDUE->!i.overdueReasons().isEmpty(); case UNDATED->i.calendarDate()==null; case REVIEW->i.reviewRequired(); })
+            .sorted(Comparator.comparing(WorkItem::followupDate,Comparator.nullsLast(Comparator.naturalOrder())).thenComparing(WorkItem::workItemKey)).toList();
+        long offset=(long)(page-1)*size; int start=(int)Math.min(offset,items.size());
+        return new PageResult<>(items.subList(start,Math.min(start+size,items.size())),page,size,items.size(),(items.size()+size-1L)/size);
+    }
+    public BatchWorkResolution resolveBatch(String batchKey,String customerId,Actor actor) {
+        if(batchKey==null || !batchKey.matches("(?:FBA_APPOINTMENT|DISPATCH):[1-9][0-9]*")) throw bad("请提供原业务返回的完整批次键");
+        if(customerId!=null && customerId.isBlank()) throw bad("客户身份不能为空");
+        if(!Objects.equals(store.requireInitialized(),facts.discover(null,1).scopeVersion())) throw conflict("已开船工作范围变化，请先完成服务端同步");
+        var matches=store.all().stream().filter(s->!s.isRetired() && s.getType()==Type.DELIVERY && batchKey.equals(s.getBatchKey()))
+            .filter(s->customerId==null || customerId.equals(deliveryCustomer(s.getSources()))).toList();
+        if(matches.isEmpty()) throw missing("当前批次的送仓事项尚不存在，请先同步当前批次");
+        var current=facts.facts(matches);
+        var visible=matches.stream().filter(s->canRead(s,current.get(s.getWorkItemKey()),actor)).toList();
+        if(visible.isEmpty()) throw forbidden("无权读取关联来源");
+        var candidates=visible.stream().map(s->new BatchWorkCandidate(deliveryCustomer(s.getSources()),s.getWorkItemKey(),s.getBatchNo())).sorted(Comparator.comparing(BatchWorkCandidate::customerId)).toList();
+        if(candidates.stream().map(BatchWorkCandidate::customerId).distinct().count()!=candidates.size()) throw conflict("同一批次客户存在重复送仓事项");
+        if(candidates.size()>1) return new BatchWorkResolution(batchKey,null,null,candidates);
+        var selected=candidates.get(0);
+        return new BatchWorkResolution(batchKey,selected.customerId(),detail(selected.workItemKey(),actor),candidates);
+    }
+    public WorkDetail detail(String key,Actor actor) {
+        var snapshot=snapshot(actor); var state=store.get(key);
+        var fact=snapshot.facts().get(key);
+        if(state.isRetired() && state.getType()!=Type.ROUTE) fact=facts.facts(List.of(state)).get(key);
+        if(!canRead(state,fact,actor)) throw forbidden("无权读取关联来源");
+        var item=state.isRetired()?project(state,fact,actor,clock):snapshot.items().stream().filter(i->i.workItemKey().equals(key)).findFirst().orElseThrow(()->missing("事项不存在"));
+        var relatedKeys=new HashSet<>(state.getPrerequisites()); relatedKeys.addAll(state.getReplacementKeys());
+        var statesByKey=snapshot.states().stream().collect(Collectors.toMap(AppointmentWorkState::getWorkItemKey,Function.identity()));
+        relatedKeys.addAll(effectiveKeys(relatedKeys,statesByKey));
+        snapshot.states().stream().filter(s->effectiveKeys(s.getPrerequisites(),statesByKey).contains(key)).map(AppointmentWorkState::getWorkItemKey).forEach(relatedKeys::add);
+        var refs=new ArrayList<>(state.getReferences()); if(fact!=null) refs.addAll(fact.references());
+        return new WorkDetail(item,snapshot.items().stream().filter(i->relatedKeys.contains(i.workItemKey())).toList(),refs.stream().distinct().toList(),store.history(key),
+            state.isReviewRequired()?new Review(state.getReviewVersion(),List.of(Objects.toString(state.getReviewReason(),"关联安排变化"))):null,
+            requirementOwned(state,fact)?new RequirementDetails(state.isBookingRequired(),Objects.toString(state.getReceivingRequirements(),""),state.getRequirementReason()):null,state.getReturnHandoff());
+    }
+    WorkItem current(AppointmentWorkState state,Fact fact,Actor actor) { return project(state,fact,actor,clock); }
+    private boolean matches(AppointmentWorkState state,Flow flow,Set<Type> types,String containerId) {
+        return (flow==null || state.getFlow()==flow) && (types==null || types.contains(state.getType()))
+            && (containerId==null || (state.getContainers().isEmpty()?containerId.equals(state.getContainerBookingId()):state.getContainers().stream().anyMatch(c->containerId.equals(c.containerBookingId()))));
+    }
+    private boolean candidate(AppointmentWorkState state,View view) {
+        // Follow-up dates and handoffs belong to the work state. Use the latest possible local day,
+        // not its stored timezone: the authoritative fact can supply a different current zone.
+        // Exact local-day, completion and permission checks still run after the live fact read.
+        return switch(view) {
+            case FOLLOW_TODAY -> pendingHandoff(state) || state.getFollowupDate()!=null
+                && !state.getFollowupDate().isAfter(LocalDate.now(clock.withZone(ZoneOffset.MAX)));
+            case REVIEW -> state.isReviewRequired();
+            default -> true;
+        };
+    }
+    private String searchable(WorkItem i) {
+        return String.join(" ",Objects.toString(i.businessNo(),""),Objects.toString(i.batchNo(),""),Objects.toString(i.originName(),""),Objects.toString(i.destinationName(),""),i.containers().stream().map(c->Objects.toString(c.containerNo(),"")+" "+Objects.toString(c.bookingNo(),"")).collect(Collectors.joining(" "))).toLowerCase(Locale.ROOT);
+    }
+    private WorkItem withNext(WorkItem i,Action next) {
+        return new WorkItem(i.workItemKey(),i.version(),i.type(),i.flow(),i.title(),i.businessNo(),i.containers(),i.requirementKey(),i.batchKey(),i.batchNo(),i.originName(),i.destinationName(),i.planStatus(),i.executionStatus(),i.reviewRequired(),i.target(),i.confirmed(),i.actual(),i.calendarDate(),i.dateBasis(),i.timezone(),i.owner(),i.followupDate(),i.overdueReasons(),i.allowedActions(),next,i.blockReasons(),i.missingFields());
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkRouteService.java b/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkRouteService.java
new file mode 100644
index 000000000..835e9fffc
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkRouteService.java
@@ -0,0 +1,19 @@
+package com.baiyue.lastleg.appointmentwork;
+
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Transactional;
+import static com.baiyue.lastleg.appointmentwork.AppointmentWorkModels.*;
+
+@Service
+public class AppointmentWorkRouteService {
+    public record Route(Flow flow) { }
+    private final AppointmentWorkStore store;
+    public AppointmentWorkRouteService(AppointmentWorkStore store) { this.store=store; }
+    /** Local committed state only. No guard lock and no upstream HTTP calls. */
+    @Transactional(readOnly=true)
+    public Route route(String container) {
+        var flows=store.container(container).stream().filter(s->!s.isRetired()).map(AppointmentWorkState::getFlow).filter(f->f!=null && f!=Flow.UNKNOWN).distinct().toList();
+        if(flows.size()>1) throw AppointmentWorkPolicy.conflict("柜次持久路线冲突，不能执行原业务写入");
+        return new Route(flows.isEmpty()?Flow.UNKNOWN:flows.get(0));
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkState.java b/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkState.java
new file mode 100644
index 000000000..7dbe839f6
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkState.java
@@ -0,0 +1,50 @@
+package com.baiyue.lastleg.appointmentwork;
+
+import lombok.Data;
+import java.time.*;
+import java.util.*;
+import static com.baiyue.lastleg.appointmentwork.AppointmentWorkModels.*;
+
+/** Work-owned state only. observedFingerprint is an audit baseline, never a second business plan. */
+@Data
+public class AppointmentWorkState {
+    private String workItemKey;
+    private int version;
+    private Type type;
+    private Flow flow;
+    private String containerBookingId;
+    private String containerNo;
+    private String requirementKey;
+    private String batchKey;
+    private String batchNo;
+    private String tripKey;
+    private List<String> batchKeys = new ArrayList<>();
+    private List<ContainerReference> containers = new ArrayList<>();
+    private String destinationKind;
+    private String originName;
+    private String destinationName;
+    private String timezone;
+    private String sourceVersion;
+    private Slot target;
+    private boolean bookingRequired = true;
+    private String receivingRequirements;
+    private String requirementReason;
+    private Owner owner;
+    private LocalDate followupDate;
+    private boolean reviewRequired;
+    private int reviewVersion;
+    private String reviewReason;
+    private String observedFingerprint;
+    private String observedImpactToken;
+    private String observedDependentImpactToken;
+    private boolean observedArranged;
+    private Responsibility responsibility;
+    private ReturnHandoff returnHandoff;
+    private boolean retired;
+    private String retirementReason;
+    private List<String> replacementKeys = new ArrayList<>();
+    private List<String> prerequisites = new ArrayList<>();
+    private List<BusinessReference> references = new ArrayList<>();
+    private List<SourceReference> sources = new ArrayList<>();
+    private List<String> readPermissions = new ArrayList<>();
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkStore.java b/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkStore.java
new file mode 100644
index 000000000..64b174221
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkStore.java
@@ -0,0 +1,64 @@
+package com.baiyue.lastleg.appointmentwork;
+
+import com.fasterxml.jackson.databind.ObjectMapper;
+import org.springframework.stereotype.Component;
+import java.time.*;
+import java.util.*;
+import static com.baiyue.lastleg.appointmentwork.AppointmentWorkModels.*;
+import static com.baiyue.lastleg.appointmentwork.AppointmentWorkPolicy.*;
+
+@Component
+public class AppointmentWorkStore {
+    public static final int MAX_ITEMS=10000;
+    private final AppointmentWorkMapper mapper;
+    private final ObjectMapper json;
+    public AppointmentWorkStore(AppointmentWorkMapper mapper,ObjectMapper json) { this.mapper=mapper; this.json=json; }
+    public AppointmentWorkMapper.Guard lock() {
+        var guard=mapper.lockGuard(); if(guard==null) throw unavailable("工作事项DDL尚未集成"); return guard;
+    }
+    public String requireInitialized() {
+        var guard=mapper.guard();
+        if(guard==null || !guard.isInitialized()) throw unavailable("完整工作范围尚未完成同步，不能显示零项");
+        if(guard.getRequirementVersion()!=guard.getSynchronizedRequirementVersion()) throw conflict("预约批次或运输关联已变化，服务端正在协调完整工作清单");
+        return guard.getScopeVersion();
+    }
+    public void checkpoint(AppointmentWorkMapper.Guard guard) { mapper.saveGuard(guard); }
+    public List<AppointmentWorkState> all() {
+        var rows=mapper.all(MAX_ITEMS+1);
+        if(rows.size()>MAX_ITEMS) throw conflict("工作事项超过当前全量核对上限，不能返回截断统计");
+        return rows.stream().map(this::decode).toList();
+    }
+    public List<AppointmentWorkState> container(String id) { return all().stream().filter(s->id.equals(s.getContainerBookingId()) || s.getContainers().stream().anyMatch(c->id.equals(c.containerBookingId()))).toList(); }
+    public AppointmentWorkState get(String key) {
+        var row=mapper.get(key); if(row==null) throw missing("事项不存在"); return decode(row);
+    }
+    public AppointmentWorkState find(String key) { var row=mapper.get(key);return row==null?null:decode(row); }
+    public record Followup(Owner owner,LocalDate nextFollowupDate) { }
+    public Followup inheritedFollowup(String key) {
+        var row=mapper.inheritedFollowup(key);return row==null?null:read(row.getResponseJson(),Followup.class);
+    }
+    public void insert(AppointmentWorkState state) { mapper.insert(row(state)); }
+    public void save(AppointmentWorkState state) {
+        state.setVersion(state.getVersion()+1);
+        if(mapper.update(row(state))!=1) throw conflict("事项版本已变化，请刷新后处理");
+    }
+    public AppointmentWorkMapper.History replay(String key,String commandKey) { return mapper.command(key,commandKey); }
+    public void history(AppointmentWorkState state,Actor actor,String action,String summary,String commandKey,String hash,Object result) {
+        var row=new AppointmentWorkMapper.History(); row.setId(UUID.randomUUID().toString()); row.setWorkItemKey(state.getWorkItemKey());
+        row.setOperatorId(actor.id()); row.setOperatorName(actor.name()); row.setAction(action); row.setSummary(summary);
+        row.setCommandKey(commandKey); row.setRequestHash(hash); row.setResponseJson(result==null?null:write(result));
+        row.setOccurredAt(LocalDateTime.now(ZoneOffset.UTC).truncatedTo(java.time.temporal.ChronoUnit.MILLIS)); mapper.insertHistory(row);
+    }
+    public List<HistoryEntry> history(String key) {
+        var rows=mapper.selectHistory(key);
+        if(rows.size()>1000) throw conflict("事项历史超过详情上限，需接入历史分页后查看");
+        return rows.stream().map(r->new HistoryEntry(r.getOccurredAt().toInstant(ZoneOffset.UTC),r.getOperatorName(),r.getAction(),r.getSummary())).toList();
+    }
+    public String write(Object value) { try { return json.writeValueAsString(value); } catch(Exception e) { throw new IllegalStateException("工作事项序列化失败",e); } }
+    public <T> T read(String value,Class<T> type) { try { return json.readValue(value,type); } catch(Exception e) { throw new IllegalStateException("工作事项记录读取失败",e); } }
+    private AppointmentWorkState decode(AppointmentWorkMapper.Row row) { return read(row.getStateJson(),AppointmentWorkState.class); }
+    private AppointmentWorkMapper.Row row(AppointmentWorkState state) {
+        var row=new AppointmentWorkMapper.Row(); row.setWorkItemKey(state.getWorkItemKey()); row.setContainerBookingId(state.getContainerBookingId());
+        row.setVersion(state.getVersion()); row.setRetired(state.isRetired()); row.setStateJson(write(state)); return row;
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkSyncService.java b/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkSyncService.java
new file mode 100644
index 000000000..d91ead756
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkSyncService.java
@@ -0,0 +1,263 @@
+package com.baiyue.lastleg.appointmentwork;
+
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Transactional;
+import java.time.*;
+import java.util.*;
+import java.util.function.Function;
+import java.util.stream.Collectors;
+import static com.baiyue.lastleg.appointmentwork.AppointmentWorkModels.*;
+import static com.baiyue.lastleg.appointmentwork.AppointmentWorkFactGateway.*;
+import static com.baiyue.lastleg.appointmentwork.AppointmentWorkPolicy.*;
+
+@Service
+public class AppointmentWorkSyncService {
+    private static final Actor SYSTEM=new Actor("appointment-work-sync","服务端工作范围同步",Set.of(LIST,ORDER_READ));
+    private final AppointmentWorkStore store;
+    private final AppointmentWorkFactGateway gateway;
+    public AppointmentWorkSyncService(AppointmentWorkStore store,AppointmentWorkFactGateway gateway) { this.store=store; this.gateway=gateway; }
+    /** Called by trusted server orchestration, never by GET or by opening a particular container. */
+    @Transactional
+    public SyncResult synchronize(SyncRequest request) {
+        if(request==null || request.size()<1 || request.size()>100) throw bad("同步批次须为1至100柜");
+        var guard=store.lock();
+        if(request.afterContainerBookingId()!=null && !Objects.equals(guard.getScanCursor(),request.afterContainerBookingId())) throw conflict("来源同步游标已变化，请从首批重新核对");
+        var page=gateway.discover(request.afterContainerBookingId(),request.size());
+        if(request.afterContainerBookingId()==null) { guard.setScanScopeVersion(page.scopeVersion()); guard.setScanRequirementVersion(guard.getRequirementVersion()); }
+        else if(!Objects.equals(guard.getScanScopeVersion(),page.scopeVersion())) throw conflict("来源范围扫描中变化，请从首批重试");
+        else if(guard.getScanRequirementVersion()!=guard.getRequirementVersion()) throw conflict("预约需求扫描中变化，请从首批重试");
+        int created=0; var ids=new HashSet<String>();
+        for(var source:page.containers()) {
+            validateSource(source);
+            if(!ids.add(source.containerBookingId())) throw unavailable("来源响应重复柜次");
+            var existing=store.container(source.containerBookingId());
+            if(existing.isEmpty()) {
+                if(source.establishedFlow()==Flow.UNKNOWN) {
+                    var route=create(source,Type.ROUTE,null,Flow.UNKNOWN); route.setFollowupDate(LocalDate.now(route.getTimezone()==null?REMINDER_ZONE:zone(route.getTimezone()))); store.insert(route); created++;
+                } else created+=generate(source,source.establishedFlow(),existing,SYSTEM).size();
+            } else {
+                var activeFlow=existing.stream().filter(s->s.getType()!=Type.ROUTE && !s.isRetired()).map(AppointmentWorkState::getFlow).findFirst().orElse(null);
+                if(activeFlow!=null) created+=generate(source,activeFlow,existing,SYSTEM).size();
+                else for(var route:existing) if(route.getType()==Type.ROUTE && !route.isRetired()) {
+                    if(source.establishedFlow()!=Flow.UNKNOWN) {
+                        var generated=generate(source,source.establishedFlow(),existing,SYSTEM); created+=generated.size();
+                        route.setFlow(source.establishedFlow()); route.setRetired(true); route.setRetirementReason("ROUTE_CONFIRMED"); route.setReplacementKeys(generated); store.save(route);
+                    } else if(!Objects.equals(route.getSourceVersion(),source.sourceVersion())) {
+                        route.setSourceVersion(source.sourceVersion()); route.setContainerNo(source.containerNo()); route.setTimezone(source.timezone()); store.save(route);
+                    }
+                }
+            }
+        }
+        // An existing row is never deleted because an order left the active source page.
+        // Empty return and other unfinished work continue to read their original authority.
+        var all=new ArrayList<>(store.all());
+        var facts=gateway.facts(all.stream().filter(s->s.getType()!=Type.ROUTE && s.getTripKey()==null && !"BATCH_REPLACED".equals(s.getRetirementReason())).toList());
+        reconcileTransport(all,facts);
+        all=new ArrayList<>(store.all());
+        facts=gateway.facts(all.stream().filter(s->!s.isRetired()).toList());
+        observe(all,facts,SYSTEM);
+        guard.setScanCursor(page.complete()?null:page.nextCursor());
+        if(page.complete()) { guard.setInitialized(true); guard.setScopeVersion(page.scopeVersion()); guard.setSynchronizedRequirementVersion(guard.getRequirementVersion()); guard.setCompletedAt(LocalDateTime.now(ZoneOffset.UTC)); }
+        store.checkpoint(guard);
+        return new SyncResult(page.containers().size(),created,page.nextCursor(),page.complete());
+    }
+    static void validateSource(ContainerSource source) {
+        if(source==null || source.containerBookingId()==null || source.containerBookingId().isBlank() || source.departedAt()==null && source.departedLocalAt()==null && source.sailedEvidenceLocalAt()==null || source.sourceVersion()==null || source.establishedFlow()==null || source.requirements()==null)
+            throw unavailable("已开船来源缺少身份或真实开船依据");
+        if(source.timezone()!=null) zone(source.timezone());
+        var seen=new HashSet<String>(); var batches=new HashSet<String>();
+        for(var requirement:source.requirements()) {
+            if(requirement==null || requirement.requirementKey()==null || requirement.requirementKey().isBlank() || !seen.add(requirement.requirementKey()) || requirement.references()==null || requirement.replacesRequirementKeys()==null || requirement.sources()==null)
+                throw unavailable("送货需求缺少稳定身份或重复");
+            if(requirement.batchKey()!=null) {
+                var identity=requirement.batchKey().startsWith("FBA_APPOINTMENT:")?customerRequirement(requirement.batchKey(),deliveryCustomer(requirement.sources())):requirement.batchKey();
+                if(!batches.add(identity)) throw unavailable("同柜批次客户需求重复，必须由原域归并来源");
+            }
+            if(requirement.timezone()!=null) zone(requirement.timezone());
+        }
+    }
+    /** Caller holds work guard and validates the route against current original facts. */
+    List<String> generate(ContainerSource source,Flow flow,List<AppointmentWorkState> existing,Actor actor) {
+        validateSource(source);
+        if(flow==Flow.UNKNOWN) throw conflict("真实送货路线尚未明确");
+        var requirements=gateway.requirements(source,flow);
+        source=new ContainerSource(source.containerBookingId(),source.containerNo(),source.departedAt(),source.departedLocalAt(),source.sailedEvidenceLocalAt(),source.sourceVersion(),source.establishedFlow(),source.timezone(),requirements);
+        validateSource(source);
+        if(requirements.isEmpty()) throw conflict("真实送货需求尚未明确，不能生成空清单");
+        var known=store.all().stream().collect(Collectors.toMap(AppointmentWorkState::getWorkItemKey,Function.identity(),(a,b)->a));
+        var created=new ArrayList<AppointmentWorkState>();
+        for(var type:flow==Flow.TRANSFER?List.of(Type.PICKUP,Type.WAREHOUSE_RECEIPT,Type.EMPTY_RETURN):List.of(Type.PICKUP,Type.EMPTY_RETURN)) add(source,type,null,flow,known,created);
+        for(var requirement:source.requirements()) {
+            add(source,Type.DELIVERY,requirement,flow,known,created);
+            add(source,Type.TRANSPORT,requirement,flow,known,created);
+        }
+        for(var state:created) {
+            state.setOwner(actor.id().equals(SYSTEM.id())?null:new Owner(actor.id(),actor.name()));
+            state.setFollowupDate(LocalDate.now(state.getTimezone()==null?REMINDER_ZONE:zone(state.getTimezone())));
+            var inherited=store.inheritedFollowup(state.getWorkItemKey());
+            if(inherited!=null) { state.setOwner(inherited.owner());state.setFollowupDate(inherited.nextFollowupDate()); }
+            String pickup=key(source.containerBookingId(),Type.PICKUP,null),receipt=key(source.containerBookingId(),Type.WAREHOUSE_RECEIPT,null);
+            if(state.getType()==Type.WAREHOUSE_RECEIPT) state.setPrerequisites(List.of(pickup));
+            if(state.getType()==Type.DELIVERY) state.setPrerequisites(List.of(flow==Flow.TRANSFER?receipt:pickup,requirementKey(source.containerBookingId(),Type.TRANSPORT,state.getRequirementKey(),state.getBatchKey())));
+            if(state.getType()==Type.TRANSPORT) {
+                var prerequisites=new LinkedHashSet<String>();prerequisites.add(flow==Flow.TRANSFER?receipt:pickup);
+                for(var r:requirements) if(Objects.equals(state.getBatchKey(),r.batchKey()) && (r.batchKey()!=null || Objects.equals(state.getRequirementKey(),r.requirementKey())))
+                    prerequisites.add(requirementKey(source.containerBookingId(),Type.DELIVERY,r.requirementKey(),r.batchKey()));
+                state.setPrerequisites(List.copyOf(prerequisites));
+            }
+            if(state.getType()==Type.EMPTY_RETURN) {
+                String containerId=source.containerBookingId();
+                state.setPrerequisites(flow==Flow.TRANSFER?List.of(receipt):source.requirements().stream().map(r->requirementKey(containerId,Type.DELIVERY,r.requirementKey(),r.batchKey())).toList());
+            }
+            store.insert(state); store.history(state,actor,"GENERATED","根据已确认路线建立工作需求",null,null,null);
+        }
+        String generationContainerId=source.containerBookingId();
+        // Rebuild each batch vehicle's customer edges from the complete current manifest.
+        // A shared vehicle retains every customer delivery; no last customer wins the edge.
+        for(var batch:requirements.stream().map(Requirement::batchKey).filter(Objects::nonNull).distinct().toList()) {
+            var vehicle=known.get(requirementKey(generationContainerId,Type.TRANSPORT,null,batch));
+            var dependencies=new LinkedHashSet<>(vehicle.getPrerequisites());
+            dependencies.removeIf(k->{var s=known.get(k);return s!=null && s.getType()==Type.DELIVERY && batch.equals(s.getBatchKey());});
+            requirements.stream().filter(r->batch.equals(r.batchKey())).map(r->requirementKey(generationContainerId,Type.DELIVERY,r.requirementKey(),batch)).forEach(dependencies::add);
+            var sources=requirements.stream().filter(r->batch.equals(r.batchKey())).flatMap(r->r.sources().stream()).distinct().toList();
+            if(!vehicle.getPrerequisites().equals(List.copyOf(dependencies)) || !vehicle.getSources().equals(sources)) {
+                vehicle.setPrerequisites(List.copyOf(dependencies));vehicle.setSources(sources);store.save(vehicle);
+            }
+        }
+        var activeKeys=new HashSet<String>(); requirements.forEach(r->{ activeKeys.add(requirementKey(generationContainerId,Type.DELIVERY,r.requirementKey(),r.batchKey())); activeKeys.add(requirementKey(generationContainerId,Type.TRANSPORT,r.requirementKey(),r.batchKey())); });
+        for(var old:existing) if(old.getRequirementKey()!=null && !"BATCH_REPLACED".equals(old.getRetirementReason()) && !activeKeys.contains(old.getWorkItemKey())) {
+            String containerId=source.containerBookingId();
+            // A mutable original dispatch can remove this container's cargo while keeping other containers.
+            // This scan is a complete authority manifest for this container, including its remaining obligations.
+            var retained=old.getContainers().stream().filter(c->!containerId.equals(c.containerBookingId())).toList();
+            if(old.getBatchKey()!=null && old.getBatchKey().startsWith("DISPATCH:") && !retained.isEmpty()) {
+                old.setContainers(retained);
+                if(containerId.equals(old.getContainerBookingId())) { old.setContainerBookingId(retained.get(0).containerBookingId());old.setContainerNo(retained.get(0).containerNo()); }
+                var removedDependency=key(containerId,flow==Flow.TRANSFER?Type.WAREHOUSE_RECEIPT:Type.PICKUP,null);
+                old.setPrerequisites(old.getPrerequisites().stream().filter(k->!removedDependency.equals(k)).toList());
+                store.save(old);store.history(old,actor,"SOURCE_REMOVED","原排车已移除该柜实物，保留其他柜的当前关联",null,null,null);continue;
+            }
+            var replacements=requirements.stream().filter(r->r.replacesRequirementKeys().contains(old.getRequirementKey()))
+                .filter(r->old.getType()!=Type.DELIVERY || old.getSources().isEmpty() || r.sources().isEmpty() || r.sources().stream().anyMatch(s->old.getSources().stream().anyMatch(o->Objects.equals(o.customerId(),s.customerId()))))
+                .map(r->requirementKey(containerId,old.getType(),r.requirementKey(),r.batchKey())).distinct().toList();
+            // Removed dispatch items no longer exist in the original allocation table. Its full current
+            // container manifest restores the unallocated demand or names the newly assigned dispatch.
+            if(replacements.isEmpty() && old.getBatchKey()!=null && old.getBatchKey().startsWith("DISPATCH:"))
+                replacements=requirements.stream().filter(r->"CUSTOMER".equals(r.destinationKind()) && r.sources().stream().anyMatch(old.getSources()::contains)).map(r->requirementKey(containerId,old.getType(),r.requirementKey(),r.batchKey())).distinct().toList();
+            if(replacements.isEmpty()) throw conflict("原需求离开有效清单但没有明确替代关系，不能隐藏剩余工作");
+            old.setRetired(true); old.setRetirementReason("BATCH_REPLACED"); old.setReplacementKeys(replacements); store.save(old); store.history(old,actor,"REPLACED","原预约域已提供完整替代需求",null,null,null);
+        }
+        return created.stream().map(AppointmentWorkState::getWorkItemKey).toList();
+    }
+    private static String requirementKey(String container,Type type,String requirement,String batch) {
+        return batch==null?key(container,type,requirement):key("BATCH:"+batch,type,type==Type.DELIVERY && batch.startsWith("FBA_APPOINTMENT:")?requirement:null);
+    }
+    private void add(ContainerSource source,Type type,Requirement requirement,Flow flow,Map<String,AppointmentWorkState> known,List<AppointmentWorkState> created) {
+        var state=create(source,type,requirement,flow); var old=known.get(state.getWorkItemKey());
+        if(old==null) { created.add(state); known.put(state.getWorkItemKey(),state); }
+        else if(requirement!=null) {
+            if("BATCH_REPLACED".equals(old.getRetirementReason())) {
+                // The full authority manifest explicitly reopens a cancelled obligation/restored original appointment.
+                // Repartitioned batches never appear here: the provider excludes replacement-bearing originals.
+                old.setRetired(false); old.setRetirementReason(null); old.setReplacementKeys(List.of()); store.save(old);
+            }
+            if(old.getFlow()!=flow) throw conflict("同一批次不能混合中转与直送路线");
+            var containers=new ArrayList<>(old.getContainers());
+            boolean update=!Objects.equals(old.getBatchNo(),requirement.batchNo()) || !Objects.equals(old.getOriginName(),requirement.originName()) || !Objects.equals(old.getDestinationName(),requirement.destinationName())
+                || !Objects.equals(old.getDestinationKind(),requirement.destinationKind()) || !Objects.equals(old.getReferences(),requirement.references()) || !Objects.equals(old.getSources(),requirement.sources()) || type==Type.DELIVERY && !Objects.equals(old.getTimezone(),requirement.timezone());
+            if(containers.stream().noneMatch(c->c.containerBookingId().equals(source.containerBookingId()))) {
+                containers.addAll(state.getContainers()); old.setContainers(List.copyOf(containers));
+                var dependencies=new LinkedHashSet<>(old.getPrerequisites()); dependencies.add(key(source.containerBookingId(),flow==Flow.TRANSFER?Type.WAREHOUSE_RECEIPT:Type.PICKUP,null));
+                old.setPrerequisites(List.copyOf(dependencies)); update=true;
+            }
+            old.setBatchNo(requirement.batchNo()); old.setOriginName(requirement.originName()); old.setDestinationName(requirement.destinationName()); old.setDestinationKind(requirement.destinationKind()); old.setReferences(requirement.references()); old.setSources(requirement.sources());
+            if(type==Type.DELIVERY) old.setTimezone(requirement.timezone());
+            if(update && !created.contains(old)) store.save(old);
+        }
+    }
+    private AppointmentWorkState create(ContainerSource source,Type type,Requirement requirement,Flow flow) {
+        var state=new AppointmentWorkState(); state.setWorkItemKey(requirement==null?key(source.containerBookingId(),type,null):requirementKey(source.containerBookingId(),type,requirement.requirementKey(),requirement.batchKey()));
+        state.setType(type); state.setFlow(flow); state.setContainerBookingId(source.containerBookingId()); state.setContainerNo(source.containerNo()); state.setSourceVersion(source.sourceVersion());
+        state.setTimezone(type==Type.ROUTE?source.timezone():null); state.setContainers(List.of(new ContainerReference(source.containerBookingId(),null,source.containerNo())));
+        if(requirement!=null) { state.setRequirementKey(type==Type.TRANSPORT && requirement.batchKey()!=null?requirement.batchKey():requirement.requirementKey()); state.setBatchKey(requirement.batchKey()); state.setBatchNo(requirement.batchNo()); state.setDestinationKind(requirement.destinationKind());
+            state.setOriginName(requirement.originName()); state.setDestinationName(requirement.destinationName()); state.setTimezone(type==Type.DELIVERY?requirement.timezone():null); state.setReferences(requirement.references()); state.setSources(requirement.sources());
+            if(requirement.batchKey()!=null) state.setBatchKeys(List.of(requirement.batchKey())); }
+        return state;
+    }
+    void observe(List<AppointmentWorkState> states,Map<String,Fact> facts,Actor actor) {
+        var affected=new LinkedHashSet<String>();
+        for(var state:states) {
+            if(state.isRetired()) continue;
+            var fact=facts.get(state.getWorkItemKey()); if(fact==null) continue;
+            if(fact!=null && state.getObservedImpactToken()!=null && !Objects.equals(state.getObservedImpactToken(),fact.impactToken()) && state.isObservedArranged()) {
+                affected.add(state.getWorkItemKey());
+                if(state.getObservedDependentImpactToken()!=null && !Objects.equals(state.getObservedDependentImpactToken(),fact.dependentImpactToken()))
+                    expandDependents(state.getWorkItemKey(),states,affected);
+            }
+        }
+        for(var state:states) {
+            if(state.isRetired()) continue;
+            var fact=facts.get(state.getWorkItemKey()); if(fact==null) continue;
+            boolean changed=changed(state,fact) || !Objects.equals(state.getObservedImpactToken(),fact.impactToken()) || !Objects.equals(state.getObservedDependentImpactToken(),fact.dependentImpactToken()) || state.isObservedArranged()!=fact.arranged() || !state.getReadPermissions().equals(fact.readPermissions()),baseline=state.getObservedFingerprint()==null;
+            boolean review=affected.contains(state.getWorkItemKey()) && arranged(state,fact) && !completed(fact);
+            if(review) { state.setReviewRequired(true); state.setReviewVersion(state.getReviewVersion()+1); state.setReviewReason("原业务时间、货量或执行关联发生变化，请核对已有安排"); }
+            if(changed || baseline || review) {
+                state.setObservedFingerprint(fact.fingerprint()); state.setObservedImpactToken(fact.impactToken()); state.setObservedDependentImpactToken(fact.dependentImpactToken()); state.setObservedArranged(fact.arranged()); state.setReadPermissions(List.copyOf(fact.readPermissions())); store.save(state);
+                store.history(state,actor,review?"IMPACT_OBSERVED":"BASELINE_OBSERVED",review?state.getReviewReason():"记录当前原业务基线，不生成执行事实",null,null,null);
+            }
+        }
+    }
+    static void expandDependents(String key,List<AppointmentWorkState> states,Set<String> affected) {
+        var queue=new ArrayDeque<String>(); queue.add(key); var seen=new HashSet<String>();
+        var byKey=states.stream().collect(Collectors.toMap(AppointmentWorkState::getWorkItemKey,Function.identity()));
+        while(!queue.isEmpty()) { var current=queue.remove(); if(!seen.add(current)) continue;
+            // A changed customer batch requires its shared vehicle to be checked. That does not
+            // make the vehicle's other customers' appointments change. A change originating in
+            // the vehicle itself still reaches all of its current dependent appointments.
+            var currentState=byKey.get(current);
+            if(!current.equals(key) && currentState!=null && currentState.getType()==Type.TRANSPORT) continue;
+            for(var candidate:states) if(!candidate.isRetired() && effectiveKeys(candidate.getPrerequisites(),byKey).contains(current) && affected.add(candidate.getWorkItemKey())) queue.add(candidate.getWorkItemKey());
+        }
+    }
+    /** Reverse of the impact traversal: a shared vehicle is an authority, not a sibling bridge. */
+    static List<AppointmentWorkState> impactPrerequisites(AppointmentWorkState target,List<AppointmentWorkState> states) {
+        var byKey=states.stream().collect(Collectors.toMap(AppointmentWorkState::getWorkItemKey,Function.identity()));
+        var pending=new ArrayDeque<>(effectiveKeys(target.getPrerequisites(),byKey));
+        var seen=new HashSet<String>(); seen.add(target.getWorkItemKey());
+        var result=new ArrayList<AppointmentWorkState>();
+        while(!pending.isEmpty()) {
+            var key=pending.remove(); if(!seen.add(key)) continue;
+            var state=byKey.get(key);
+            if(state==null || state.isRetired()) throw conflict("关联安排已变化，须先同步当前工作关系");
+            result.add(state);
+            if(state.getType()!=Type.TRANSPORT) pending.addAll(effectiveKeys(state.getPrerequisites(),byKey));
+        }
+        return List.copyOf(result);
+    }
+    private void reconcileTransport(List<AppointmentWorkState> all,Map<String,Fact> facts) {
+        var members=all.stream().filter(s->s.getType()==Type.TRANSPORT && s.getTripKey()==null && facts.containsKey(s.getWorkItemKey()) && facts.get(s.getWorkItemKey()).tripKey()!=null)
+            .collect(Collectors.groupingBy(s->facts.get(s.getWorkItemKey()).tripKey()));
+        var liveCanonical=new HashSet<String>();
+        for(var entry:members.entrySet()) {
+            var group=entry.getValue(); group.sort(Comparator.comparing(AppointmentWorkState::getWorkItemKey));
+            String canonicalKey=key("TRIP:"+entry.getKey(),Type.TRANSPORT,null); liveCanonical.add(canonicalKey);
+            var canonical=all.stream().filter(s->s.getWorkItemKey().equals(canonicalKey)).findFirst().orElse(null);
+            boolean fresh=canonical==null;
+            if(fresh) { canonical=store.read(store.write(group.get(0)),AppointmentWorkState.class); canonical.setWorkItemKey(canonicalKey); canonical.setVersion(0); canonical.setTripKey(entry.getKey()); canonical.setRequirementKey(null); canonical.setBatchKey(null); canonical.setBatchNo(null); canonical.setReplacementKeys(List.of()); }
+            var containers=group.stream().flatMap(s->s.getContainers().stream()).distinct().sorted(Comparator.comparing(ContainerReference::containerBookingId)).toList();
+            var batches=group.stream().map(AppointmentWorkState::getBatchKey).filter(Objects::nonNull).distinct().sorted().toList();
+            var prerequisites=group.stream().flatMap(s->s.getPrerequisites().stream()).distinct().sorted().toList();
+            boolean changed=canonical.isRetired() || !containers.equals(canonical.getContainers()) || !batches.equals(canonical.getBatchKeys()) || !prerequisites.equals(canonical.getPrerequisites());
+            canonical.setContainers(containers); canonical.setBatchKeys(batches); canonical.setPrerequisites(prerequisites); canonical.setRetired(false); canonical.setRetirementReason(null);
+            canonical.setReferences(group.stream().flatMap(s->s.getReferences().stream()).distinct().toList());
+            canonical.setSources(group.stream().flatMap(s->s.getSources().stream()).distinct().toList());
+            if(fresh) store.insert(canonical); else if(changed) store.save(canonical);
+            for(var member:group) if(!member.isRetired() || !member.getReplacementKeys().equals(List.of(canonicalKey))) { member.setRetired(true); member.setRetirementReason("TRIP_LINKED"); member.setReplacementKeys(List.of(canonicalKey)); store.save(member); }
+        }
+        for(var state:all) {
+            if(state.getTripKey()!=null && !liveCanonical.contains(state.getWorkItemKey()) && !state.isRetired()) { state.setRetired(true); state.setRetirementReason("TRIP_UNLINKED"); store.save(state); }
+            if(state.getType()==Type.TRANSPORT && state.getTripKey()==null && "TRIP_LINKED".equals(state.getRetirementReason()) && facts.containsKey(state.getWorkItemKey()) && facts.get(state.getWorkItemKey()).tripKey()==null) { state.setRetired(false); state.setRetirementReason(null); state.setReplacementKeys(List.of()); store.save(state); }
+        }
+        // Keep requirement edges stable; query traversal follows retired transport replacement keys.
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkSynchronizationJob.java b/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkSynchronizationJob.java
new file mode 100644
index 000000000..9137ff83c
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkSynchronizationJob.java
@@ -0,0 +1,40 @@
+package com.baiyue.lastleg.appointmentwork;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.scheduling.annotation.EnableScheduling;
+import org.springframework.scheduling.annotation.Scheduled;
+import org.springframework.stereotype.Component;
+
+/** Periodic full scan also compensates remote changes and process restarts; no GET performs writes. */
+@Component
+@EnableScheduling
+public class AppointmentWorkSynchronizationJob {
+    private static final Logger log=LoggerFactory.getLogger(AppointmentWorkSynchronizationJob.class);
+    private final AppointmentWorkSyncService synchronization;
+    private String cursor;
+    public AppointmentWorkSynchronizationJob(AppointmentWorkSyncService synchronization) { this.synchronization=synchronization; }
+    @Scheduled(initialDelayString="${baiyue.appointment-work.sync-initial-delay-ms:30000}",fixedDelayString="${baiyue.appointment-work.sync-delay-ms:10000}")
+    public void run() {
+        try {
+            var result=synchronization.synchronize(new AppointmentWorkModels.SyncRequest(cursor,100));
+            cursor=result.complete()?null:result.nextCursor();
+        } catch(RuntimeException error) {
+            cursor=null;
+            log.warn("Appointment work synchronization incomplete; next scan restarts from first page: {}",failureDiagnostic(error));
+        }
+    }
+    /** Keep causes and code locations, never exception messages that may contain remote payloads or credentials. */
+    static String failureDiagnostic(Throwable error) {
+        var causes=new java.util.ArrayList<String>();
+        var seen=java.util.Collections.newSetFromMap(new java.util.IdentityHashMap<Throwable,Boolean>());
+        for(var current=error;current!=null && causes.size()<6 && seen.add(current);current=current.getCause()) {
+            String status=current instanceof org.springframework.web.server.ResponseStatusException response?"["+response.getStatusCode().value()+"]":"";
+            String location=java.util.Arrays.stream(current.getStackTrace())
+                .filter(frame->frame.getClassName().startsWith("com.baiyue.") && !frame.getClassName().equals(AppointmentWorkPolicy.class.getName()))
+                .findFirst().map(frame->"@"+frame.getClassName()+":"+frame.getLineNumber()).orElse("");
+            causes.add(current.getClass().getSimpleName()+status+location);
+        }
+        return String.join(" <- ",causes);
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/config/LastlegRestClientProperties.java b/lastleg-service/src/main/java/com/baiyue/lastleg/config/LastlegRestClientProperties.java
index b647f3a9b..1efa078ce 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/config/LastlegRestClientProperties.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/config/LastlegRestClientProperties.java
@@ -9,6 +9,7 @@ import java.time.Duration;
 @ConfigurationProperties(prefix = "baiyue.http.clients")
 public class LastlegRestClientProperties {
     private ClientTimeouts unloadPhotoFile = new ClientTimeouts(Duration.ofSeconds(3), Duration.ofSeconds(30));
+    private ClientTimeouts cargoDiscardPhotoFile = new ClientTimeouts(Duration.ofSeconds(3), Duration.ofSeconds(30));
     private ClientTimeouts relabelPhotoFile = new ClientTimeouts(Duration.ofSeconds(3), Duration.ofSeconds(30));
     private ClientTimeouts customerVisitFile = new ClientTimeouts(Duration.ofSeconds(3), Duration.ofSeconds(30));
     private ClientTimeouts procurementFile = new ClientTimeouts(Duration.ofSeconds(3), Duration.ofSeconds(30));
@@ -18,6 +19,8 @@ public class LastlegRestClientProperties {
 
     public ClientTimeouts getUnloadPhotoFile() { return unloadPhotoFile; }
     public void setUnloadPhotoFile(ClientTimeouts value) { unloadPhotoFile = required(value, "unload-photo-file"); }
+    public ClientTimeouts getCargoDiscardPhotoFile() { return cargoDiscardPhotoFile; }
+    public void setCargoDiscardPhotoFile(ClientTimeouts value) { cargoDiscardPhotoFile = required(value, "cargo-discard-photo-file"); }
     public ClientTimeouts getRelabelPhotoFile() { return relabelPhotoFile; }
     public void setRelabelPhotoFile(ClientTimeouts value) { relabelPhotoFile = required(value, "relabel-photo-file"); }
     public ClientTimeouts getCustomerVisitFile() { return customerVisitFile; }
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/controller/InternalCustomerOrderProgressController.java b/lastleg-service/src/main/java/com/baiyue/lastleg/controller/InternalCustomerOrderProgressController.java
index 3b0f1f763..8ede1e4c2 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/controller/InternalCustomerOrderProgressController.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/controller/InternalCustomerOrderProgressController.java
@@ -20,6 +20,6 @@ public class InternalCustomerOrderProgressController {
         @RequestHeader(value="X-Internal-Service-Token", required=false) String token,
         @Valid @RequestBody CustomerOrderProgress.Request request) {
         guard.verify(token);
-        return ApiResponse.success(service.read(request.customerId()));
+        return ApiResponse.success(service.read(request.customerId(), request.orderIds()));
     }
 }
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/delivery/fleet/FleetPoolDeliveryAdapter.java b/lastleg-service/src/main/java/com/baiyue/lastleg/delivery/fleet/FleetPoolDeliveryAdapter.java
new file mode 100644
index 000000000..be24cdf27
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/delivery/fleet/FleetPoolDeliveryAdapter.java
@@ -0,0 +1,31 @@
+package com.baiyue.lastleg.delivery.fleet;
+
+import com.baiyue.lastleg.delivery.mapper.DeliverySourceEvidenceMapper;
+import com.baiyue.lastleg.delivery.model.SourceDeliveryCompletionPolicy;
+import com.baiyue.lastleg.fleet.business.FleetPoolDeliveryEvidence;
+import org.springframework.stereotype.Component;
+import java.util.ArrayList;
+import java.util.HashSet;
+
+/** Same-transaction delivery proof; no persistence model escapes into fleet. */
+@Component
+public class FleetPoolDeliveryAdapter implements FleetPoolDeliveryEvidence {
+    private final DeliverySourceEvidenceMapper evidence;
+    public FleetPoolDeliveryAdapter(DeliverySourceEvidenceMapper evidence){this.evidence=evidence;}
+    @Override public boolean fullySigned(String customerId,String incomingNo,long orderId,int expectedPackages) {
+        var dispatchIds=evidence.dispatchIds(customerId,orderId);
+        if(dispatchIds==null||dispatchIds.isEmpty()||new HashSet<>(dispatchIds).size()!=dispatchIds.size())return false;
+        var deliveries=new ArrayList<SourceDeliveryCompletionPolicy.Delivery>();
+        var picks=new ArrayList<SourceDeliveryCompletionPolicy.Pick>();
+        var returns=new ArrayList<SourceDeliveryCompletionPolicy.Returned>();
+        for(Long dispatchId:dispatchIds){
+            if(dispatchId==null||dispatchId<=0)return false;
+            var d=evidence.deliveries(customerId,dispatchId);var p=evidence.picks(customerId,dispatchId);
+            var r=evidence.returns(customerId,dispatchId);
+            if(d==null||d.isEmpty()||p==null||p.isEmpty()||r==null)return false;
+            deliveries.addAll(d);picks.addAll(p);returns.addAll(r);
+        }
+        return SourceDeliveryCompletionPolicy.evaluate(new SourceDeliveryCompletionPolicy.Source(incomingNo,orderId,expectedPackages),
+            deliveries,picks,returns,true).fullySigned();
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/delivery/service/DeliveryDocumentService.java b/lastleg-service/src/main/java/com/baiyue/lastleg/delivery/service/DeliveryDocumentService.java
index 21a80490b..dc7b541a0 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/delivery/service/DeliveryDocumentService.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/delivery/service/DeliveryDocumentService.java
@@ -1,4 +1,5 @@
 package com.baiyue.lastleg.delivery.service;
+import com.baiyue.lastleg.fleet.business.FleetPoolOrderModels.SignedDelivery;
 
 import com.baiyue.lastleg.delivery.dto.DeliveryDocumentDtos;
 import com.baiyue.lastleg.delivery.dto.DeliveryDocumentDtos.*;
@@ -115,7 +116,9 @@ public class DeliveryDocumentService {
         orders.updateById(order);
         if (autoCompleted) {
             var completion = completeRelatedOrders(order, operatorId, now);
-            fleetPool.signed(order, completion.sourcePackages(), operatorId, now);
+            fleetPool.signed(new SignedDelivery(
+                order.getCustomerId(),order.getDispatchNo(),order.getDeliveryNo(),"DELIVERED".equals(order.getStatus()),order.getSignedAt()),
+                completion.sourcePackages(),operatorId,now);
             deliveryCompletedOutbox.publish(order, completion.orders(), completion.proofs(), now.atZone(executionZone).toInstant());
             customerVisits.ensureForCompletedDelivery(order, now);
         }
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/delivery/service/DeliveryTransferService.java b/lastleg-service/src/main/java/com/baiyue/lastleg/delivery/service/DeliveryTransferService.java
index c037053ad..793774c8b 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/delivery/service/DeliveryTransferService.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/delivery/service/DeliveryTransferService.java
@@ -486,7 +486,6 @@ public class DeliveryTransferService {
     public List<DeliveryResponses.ReturnOutboundCandidate> returnOutboundCandidates(String customerId, String warehouseId) {
         if (!StringUtils.hasText(warehouseId)) return List.of();
         return returnCartons.findAvailable(required(customerId, "Customer is required"), warehouseId.trim()).stream()
-            .filter(carton -> !"PARCEL".equals(carton.getSourceUnitType()))
             .map(c -> new DeliveryResponses.ReturnOutboundCandidate(c.getSourceReturnNo(), c.getOverseasWarehouseId(),
                 c.getCartonMark(), c.getPalletCode(), c.getFbaCartonMark(), c.getDestinationWarehouseCode(), c.getDestinationWarehouseName(),
                 value(c.getTotalQuantity()), c.getStatus())).toList();
@@ -499,23 +498,16 @@ public class DeliveryTransferService {
         OutboundOrder existing = outboundOrders.findByIdempotency(customerId, request.idempotencyKey().trim());
         if (existing != null) return replayReturnOutbound(customerId, existing, requestHash);
         String warehouseId = request.overseasWarehouseId().trim();
-        boolean itemMode = request.items() != null;
-        boolean skuMode = itemMode || StringUtils.hasText(request.skuCode());
-        Map<String, DeliveryRequests.ReturnSkuOutboundItem> requestedItems = new LinkedHashMap<>();
-        if (itemMode) {
-            if (request.items().isEmpty() || StringUtils.hasText(request.skuCode()) || request.quantity() != null || "PALLET".equals(request.unitType()))
-                throw conflict("散件明细出库不可同时提交统一SKU、数量或整托方式");
-            for (var line : request.items()) {
-                if (line == null || !StringUtils.hasText(line.cartonMark()) || !StringUtils.hasText(line.skuCode()) || line.quantity() == null || line.quantity() <= 0
-                    || requestedItems.putIfAbsent(line.cartonMark().trim(), line) != null) throw conflict("散件出库明细不能为空、数量必须大于0且来源不可重复");
-            }
-        }
-        if (request.quantity() != null && (!StringUtils.hasText(request.skuCode()) || request.quantity() <= 0
-            || "PALLET".equals(request.unitType()))) throw conflict("按件数出库必须选择单SKU，不能同时整托出库");
+        // A return outbound is always a physical package/carton operation. SKU and
+        // quantity are selection fields for the packing workflow, never a direct
+        // outbound command. Partial package/carton quantities must be materialized
+        // into a new labelled carton before they can be picked.
+        boolean itemMode = request.items() != null && !request.items().isEmpty();
+        boolean skuMode = itemMode || StringUtils.hasText(request.skuCode()) || request.quantity() != null;
+        if (skuMode)
+            throw conflict("退货出库最小单位为包裹/箱；部分数量请先合箱并打印新箱标签后再出库");
         List<String> marks = request.cartonMarks().stream().map(String::trim).filter(StringUtils::hasText).distinct().toList();
         if (marks.size() != request.cartonMarks().size()) throw conflict("箱唛不能为空且不可重复");
-        if (itemMode && (marks.size() != requestedItems.size() || !requestedItems.keySet().containsAll(marks)))
-            throw conflict("散件出库明细与所选来源不一致");
         LocalDateTime now = LocalDateTime.now();
         List<ReturnInventoryCarton> locked = new ArrayList<>();
         for (String mark : marks.stream().sorted().toList()) {
@@ -529,37 +521,18 @@ public class DeliveryTransferService {
         existing = outboundOrders.findByIdempotency(customerId, request.idempotencyKey().trim());
         if (existing != null) return replayReturnOutbound(customerId, existing, requestHash);
         for (ReturnInventoryCarton carton : locked) {
-            if (skuMode && !"PARCEL".equals(carton.getSourceUnitType()))
-                throw conflict("单SKU出库只允许散件库存；箱内库存请按箱或托盘出库");
-            if ("PARCEL".equals(carton.getSourceUnitType()) && !skuMode)
-                throw conflict("包裹散件只能按 SKU 出库，不能按箱号或托盘出库");
+            if ("PACKING_RESERVED".equals(carton.getStatus()))
+                throw conflict("该包裹/箱正在合箱，请先完成或取消合箱");
             com.baiyue.lastleg.returnreceipt.service.ReturnCartonCountGuard.requireConfirmed(carton);
             if (!"AVAILABLE".equals(carton.getStatus())) throw conflict("退货箱已被其他作业占用：" + carton.getCartonMark());
             var contents = returnCartonItems.lockCarton(carton.getId());
             if (contents.isEmpty() || contents.stream().anyMatch(line -> value(line.getPackingReservedQuantity()) > 0))
                 throw conflict("退货箱缺少明细或已被合箱计划锁定：" + carton.getCartonMark());
-            String selectedSku = itemMode ? requestedItems.get(carton.getCartonMark()).skuCode().trim() : trim(request.skuCode());
-            if (skuMode && (contents.size() != 1
-                || !selectedSku.equals(contents.get(0).getSkuCode())))
-                throw conflict("所选散件来源必须仅包含指定SKU");
-            if (itemMode && requestedItems.get(carton.getCartonMark()).quantity() > value(contents.get(0).getQuantity()))
-                throw conflict("出库件数超过所选散件来源可用数量：" + carton.getCartonMark());
             if ("PALLET".equals(request.unitType()) && !StringUtils.hasText(carton.getPalletCode()))
                 throw conflict("整托出库必须存在托盘绑定");
         }
-        Map<String, Long> skuQuantities = new LinkedHashMap<>();
-        if (itemMode) requestedItems.forEach((mark, line) -> skuQuantities.put(mark, line.quantity()));
-        else if (StringUtils.hasText(request.skuCode())) {
-            long available = locked.stream().mapToLong(c -> value(c.getTotalQuantity())).sum();
-            long remaining = request.quantity() == null ? available : request.quantity();
-            if (remaining > available) throw conflict("出库件数超过所选来源库存数量");
-            for (ReturnInventoryCarton carton : locked) {
-                long selected = Math.min(remaining, value(carton.getTotalQuantity()));
-                if (selected > 0) skuQuantities.put(carton.getCartonMark(), selected);
-                remaining -= selected;
-            }
-            locked = locked.stream().filter(c -> skuQuantities.containsKey(c.getCartonMark())).toList();
-        }
+        // No quantity allocation is performed here. The selected physical units
+        // are shipped whole; partials arrive only as newly-created merge cartons.
         if ("PALLET".equals(request.unitType())) {
             String pallet = locked.get(0).getPalletCode();
             if (locked.stream().anyMatch(c -> !Objects.equals(pallet, c.getPalletCode()))) throw conflict("整托出库只能选择同一托盘");
@@ -580,9 +553,8 @@ public class DeliveryTransferService {
             OutboundPalletItem item = new OutboundPalletItem(); item.setId(IdWorker.getId()); item.setCustomerId(customerId);
             item.setOutboundOrderId(outbound.getId()); item.setPackageCount(1); item.setPickedPackageCount(0); item.setStatus("WAIT_PICK");
             item.setCartonMarks(carton.getCartonMark()); item.setInboundCode(carton.getSourceReturnNo());
-            // Packed stock is still picked by its physical carton mark; loose parcels use SKU scanning.
-            item.setSkuCode("PARCEL".equals(carton.getSourceUnitType()) ? itemMode ? requestedItems.get(carton.getCartonMark()).skuCode().trim() : trim(request.skuCode()) : null);
-            item.setReturnSkuQuantity(skuQuantities.get(carton.getCartonMark()));
+            // Packages and cartons are picked by their physical barcode.
+            item.setSkuCode(null); item.setReturnSkuQuantity(null);
             item.setPalletNo("PALLET".equals(request.unitType()) ? carton.getPalletCode() : null);
             item.setCreatedAt(now); outboundPallets.insert(item);
             carton.setStatus("OUTBOUND_PENDING"); carton.setUpdatedAt(now); returnCartons.updateById(carton);
@@ -1186,6 +1158,7 @@ public class DeliveryTransferService {
         required(request == null ? null : request.reason(), "取消原因不能为空");
         OutboundOrder observed = outboundOrders.findGlobalByNo(trim(outboundNo));
         if (observed == null) throw notFound("Outbound order not found");
+        if ("DISCARD_OUTBOUND".equals(observed.getOutboundType())) throw conflict("请通过废弃单取消，废弃出库单随申请同步取消");
         // Match dispatch picking and relabel confirmation lock order before locking outbound.
         DispatchOrder dispatch = observed.getDispatchOrderId() == null ? null
             : dispatchOrders.lockById(observed.getCustomerId(), observed.getDispatchOrderId());
@@ -1453,6 +1426,7 @@ public class DeliveryTransferService {
             new LambdaQueryWrapper<OutboundOrder>().eq(StringUtils.hasText(customerId), OutboundOrder::getCustomerId, customerId)
                 .like(StringUtils.hasText(query.documentNo()), OutboundOrder::getOutboundNo, query.documentNo())
                 .like(StringUtils.hasText(query.lxCode()), OutboundOrder::getLxCodes, query.lxCode())
+                .ne(StringUtils.hasText(query.lxCode()), OutboundOrder::getOutboundType, "DISCARD_OUTBOUND")
                 .eq(StringUtils.hasText(query.warehouseId()), OutboundOrder::getOverseasWarehouseId, query.warehouseId())
                 .eq(StringUtils.hasText(query.status()), OutboundOrder::getStatus, query.status())
                 .eq(StringUtils.hasText(query.outboundType()), OutboundOrder::getOutboundType, query.outboundType())
@@ -1504,10 +1478,18 @@ public class DeliveryTransferService {
                     && !Objects.equals(delivery.getDestinationWarehouseCode(), item.getDestinationWarehouseCode())) continue;
                 ReturnInventoryCarton carton = returnCartons.findCustomerMark(customerId, item.getCartonMarks());
                 if (carton == null) throw conflict("退货派送单来源箱记录缺失");
-                for (var line : returnCartonItems.listCarton(carton.getId()))
+                boolean relabelCarton = "RELABEL_OUTBOUND".equals(sourceOutbound.getOutboundType());
+                boolean firstSku = true;
+                // Match receipt cargo semantics: stable first SKU carries the physical box once, never per piece.
+                for (var line : returnCartonItems.listCarton(carton.getId())) {
                     cargo.add(new DeliveryResponses.DeliverySku(item.getInboundCode(), delivery.getCustomerName(),
-                        carton.getDestinationWarehouseCode(), delivery.getDeliveryAddress(), null, null,
-                        line.getSkuCode(), line.getProductNameZh(), 1, null, null, line.getQuantity()));
+                        relabelCarton ? item.getDestinationWarehouseCode() : carton.getDestinationWarehouseCode(),
+                        delivery.getDeliveryAddress(), null, null,
+                        line.getSkuCode(), line.getProductNameZh(), !relabelCarton || firstSku ? 1 : 0,
+                        relabelCarton && firstSku ? item.getGrossWeightKg() : null,
+                        relabelCarton && firstSku ? item.getVolumeCbm() : null, line.getQuantity()));
+                    firstSku = false;
+                }
             }
             return new DeliveryResponses.DeliveryDetail(deliveryRow(delivery), cargo,
                 feeSources.listForBusiness(customerId, "DELIVERY_ORDER", delivery.getId()).stream().map(this::feeRow).toList(),
@@ -1638,7 +1620,7 @@ public class DeliveryTransferService {
                 d.getDeliveryNo(), d.getStatus(), d.getDestinationWarehouseId(), d.getDestinationWarehouseCode(),
                 d.getDestinationWarehouseName(), value(d.getPalletCount()), value(d.getPackageCount()))).toList(), replayed);
     }
-    private DeliveryResponses.OutboundRow outboundRow(OutboundOrder o) { return new DeliveryResponses.OutboundRow(o.getId(), o.getOutboundNo(), o.getDispatchNo(), o.getOverseasWarehouseId(), o.getLxCodes(), o.getStatus(), o.getPalletCount(), o.getPackageCount(), o.getGrossWeightKg(), o.getVolumeWeightKg(), o.getVolumeCbm(), o.getCreatedAt(), o.getOutboundType()); }
+    private DeliveryResponses.OutboundRow outboundRow(OutboundOrder o) { return new DeliveryResponses.OutboundRow(o.getId(), o.getOutboundNo(), o.getDispatchNo(), o.getOverseasWarehouseId(), "DISCARD_OUTBOUND".equals(o.getOutboundType()) ? null : o.getLxCodes(), o.getStatus(), o.getPalletCount(), o.getPackageCount(), o.getGrossWeightKg(), o.getVolumeWeightKg(), o.getVolumeCbm(), o.getCreatedAt(), o.getOutboundType()); }
     private DeliveryResponses.OutboundPalletRow outboundPalletRow(OutboundPalletItem item) {
         return new DeliveryResponses.OutboundPalletRow(item.getId(), item.getPalletNo(), item.getCartonMarks(),
             item.getInboundCode(), item.getDestinationWarehouseCode(), item.getDestinationWarehouseName(),
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/discard/controller/CargoDiscardController.java b/lastleg-service/src/main/java/com/baiyue/lastleg/discard/controller/CargoDiscardController.java
index 60d987237..560138fe0 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/discard/controller/CargoDiscardController.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/discard/controller/CargoDiscardController.java
@@ -52,6 +52,16 @@ public class CargoDiscardController {
         return ApiResponse.success(service.detail(scope(user, customerId), discardNo));
     }
 
+    @GetMapping("/{discardNo}/photos/files/{fileId}/download")
+    @org.springframework.security.access.prepost.PreAuthorize("hasAuthority('platform:overseas-warehouse:discard:list')")
+    public org.springframework.http.ResponseEntity<byte[]> downloadPhoto(@AuthenticationPrincipal AuthenticatedUser user,
+        @RequestParam String customerId, @PathVariable String discardNo, @PathVariable long fileId) {
+        var file = service.downloadPhoto(scope(user, customerId), discardNo, fileId);
+        return org.springframework.http.ResponseEntity.ok().cacheControl(org.springframework.http.CacheControl.noStore())
+            .header(org.springframework.http.HttpHeaders.CONTENT_DISPOSITION,
+                org.springframework.http.ContentDisposition.inline().filename(file.fileName(), java.nio.charset.StandardCharsets.UTF_8).build().toString())
+            .contentType(org.springframework.http.MediaType.parseMediaType(file.contentType())).body(file.content());
+    }
     @PostMapping("/{discardNo}/review")
     public ApiResponse<CargoDiscardResponses.Detail> review(@AuthenticationPrincipal AuthenticatedUser user,
         @RequestParam(required = false) String customerId, @PathVariable String discardNo,
@@ -67,13 +77,6 @@ public class CargoDiscardController {
         return ApiResponse.success(service.cancel(scope(user, customerId), discardNo, operator(user), true));
     }
 
-    @PostMapping("/{discardNo}/complete")
-    public ApiResponse<CargoDiscardResponses.Detail> complete(@AuthenticationPrincipal AuthenticatedUser user,
-        @RequestParam(required = false) String customerId, @PathVariable String discardNo) {
-        requireApprovalPermission(user);
-        return ApiResponse.success(service.complete(scope(user, customerId), discardNo, operator(user)));
-    }
-
     private String scope(AuthenticatedUser user, String requested) {
         if (user == null || user.tenantId() == null) throw new ResponseStatusException(HttpStatus.UNAUTHORIZED);
         if ("PLATFORM".equals(user.appCode()) && user.tenantId() == 0L) {
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/discard/controller/MerchantCargoDiscardController.java b/lastleg-service/src/main/java/com/baiyue/lastleg/discard/controller/MerchantCargoDiscardController.java
index f49e899da..300108ecc 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/discard/controller/MerchantCargoDiscardController.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/discard/controller/MerchantCargoDiscardController.java
@@ -36,6 +36,22 @@ public class MerchantCargoDiscardController {
     @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_DISCARD_LIST + "')")
     public ApiResponse<CargoDiscardResponses.Detail> detail(@AuthenticationPrincipal AuthenticatedUser user,
         @PathVariable String discardNo) { return ApiResponse.success(service.detail(customer(user), discardNo)); }
+    @GetMapping("/{discardNo}/photos/files/{fileId}/download")
+    @org.springframework.security.access.prepost.PreAuthorize("hasAuthority('merchant:overseas-warehouse:discard:list')")
+    public org.springframework.http.ResponseEntity<byte[]> downloadPhoto(@AuthenticationPrincipal AuthenticatedUser user,
+        @PathVariable String discardNo, @PathVariable long fileId) {
+        var file = service.downloadPhoto(customer(user), discardNo, fileId);
+        return org.springframework.http.ResponseEntity.ok().cacheControl(org.springframework.http.CacheControl.noStore())
+            .header(org.springframework.http.HttpHeaders.CONTENT_DISPOSITION,
+                org.springframework.http.ContentDisposition.inline().filename(file.fileName(), java.nio.charset.StandardCharsets.UTF_8).build().toString())
+            .contentType(org.springframework.http.MediaType.parseMediaType(file.contentType())).body(file.content());
+    }
+    @PostMapping("/{discardNo}/confirm-completion")
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_DISCARD_CONFIRM + "')")
+    public ApiResponse<CargoDiscardResponses.Detail> confirmCompletion(@AuthenticationPrincipal AuthenticatedUser user,
+        @PathVariable String discardNo) {
+        return ApiResponse.success(service.confirmCompletion(customer(user), discardNo, operator(user)));
+    }
     @PostMapping("/{discardNo}/cancel")
     @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_DISCARD_CANCEL + "')")
     public ApiResponse<CargoDiscardResponses.Detail> cancel(@AuthenticationPrincipal AuthenticatedUser user,
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/discard/dto/CargoDiscardRequests.java b/lastleg-service/src/main/java/com/baiyue/lastleg/discard/dto/CargoDiscardRequests.java
index f368e7224..8cbac94b8 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/discard/dto/CargoDiscardRequests.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/discard/dto/CargoDiscardRequests.java
@@ -20,7 +20,14 @@ public final class CargoDiscardRequests {
                          @Size(max = 1000) String remark) {}
 
     public record Item(Long orderId, Long returnCartonId, @NotBlank @Size(max = 128) String skuCode,
-                       @Positive int discardPackages) {}
+                       @Positive int discardPackages, Long inventoryPositionId, @Size(max = 5000) List<@NotNull @Positive Long> cartonIds) {
+        public Item(Long orderId, Long returnCartonId, String skuCode, int discardPackages, Long inventoryPositionId) {
+            this(orderId, returnCartonId, skuCode, discardPackages, inventoryPositionId, null);
+        }
+        public Item(Long orderId, Long returnCartonId, String skuCode, int discardPackages) {
+            this(orderId, returnCartonId, skuCode, discardPackages, null, null);
+        }
+    }
 
     public record Review(@NotBlank String decision, @Size(max = 1000) String remark) {}
 
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/discard/dto/CargoDiscardResponses.java b/lastleg-service/src/main/java/com/baiyue/lastleg/discard/dto/CargoDiscardResponses.java
index 14fb36737..efde17c22 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/discard/dto/CargoDiscardResponses.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/discard/dto/CargoDiscardResponses.java
@@ -11,21 +11,45 @@ public final class CargoDiscardResponses {
                             String inboundCode, String inboundOrderNo,
                             String overseasWarehouseId, String overseasWarehouseName,
                             LocalDateTime inboundCreatedAt, long availablePackages,
-                            List<CandidateSku> skus) {}
+                            List<CandidateSku> skus, Long inventoryPositionId, String palletNo, List<Box> cartons, boolean cartonSelectionSupported, String cartonSelectionBlockReason) {
+        public Candidate(Long orderId, String sourceType, Long returnCartonId, String cartonMark,
+                         String inboundCode, String inboundOrderNo, String overseasWarehouseId,
+                         String overseasWarehouseName, LocalDateTime inboundCreatedAt, long availablePackages,
+                         List<CandidateSku> skus, Long inventoryPositionId, String palletNo) {
+            this(orderId, sourceType, returnCartonId, cartonMark, inboundCode, inboundOrderNo,
+                overseasWarehouseId, overseasWarehouseName, inboundCreatedAt, availablePackages, skus,
+                inventoryPositionId, palletNo, List.of(), false, "当前库存缺少可核对的箱级记录，可按全部库存废弃");
+        }
+        public Candidate(Long orderId, String sourceType, Long returnCartonId, String cartonMark,
+                         String inboundCode, String inboundOrderNo, String overseasWarehouseId,
+                         String overseasWarehouseName, LocalDateTime inboundCreatedAt, long availablePackages,
+                         List<CandidateSku> skus) {
+            this(orderId, sourceType, returnCartonId, cartonMark, inboundCode, inboundOrderNo,
+                overseasWarehouseId, overseasWarehouseName, inboundCreatedAt, availablePackages, skus, null, null);
+        }
+    }
+    public record Box(Long cartonId, String cartonMark, String palletNo, List<CandidateSku> skus) {}
     public record CandidateSku(String skuCode, String productName, long availablePackages) {}
 
     public record Summary(Long id, String customerId, String discardNo, String inboundCodes,
                           String overseasWarehouseId, String overseasWarehouseName,
                           int totalPackages, BigDecimal totalFee, String currency, String status,
-                          String createdBy, LocalDateTime createdAt, LocalDateTime reviewedAt) {}
+                          String createdBy, LocalDateTime createdAt, LocalDateTime reviewedAt, String outboundNo, LocalDateTime customerConfirmedAt) {}
 
     public record Item(Long id, Long orderId, String inboundCode, String skuCode,
-                       String productName, int availablePackagesSnapshot, int discardPackages) {}
+                       String productName, int availablePackagesSnapshot, int discardPackages, List<String> cartonMarks) {
+        public Item(Long id, Long orderId, String inboundCode, String skuCode, String productName, int availablePackagesSnapshot, int discardPackages) {
+            this(id, orderId, inboundCode, skuCode, productName, availablePackagesSnapshot, discardPackages, List.of());
+        }
+    }
 
     public record History(String fromStatus, String toStatus, String operatorId,
                           String remark, LocalDateTime createdAt) {}
 
+    public record Photo(Long fileId, String palletNo, String fileName, String contentType, Long sizeBytes,
+                        String operatorId, LocalDateTime createdAt, LocalDateTime submittedAt) {}
+
     public record Detail(Summary summary, BigDecimal feePerPackage, String remark,
                          String reviewedBy, String reviewRemark, List<Item> items,
-                         List<History> histories) {}
+                         List<History> histories, List<Photo> photos) {}
 }
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/discard/entity/CargoDiscardApplication.java b/lastleg-service/src/main/java/com/baiyue/lastleg/discard/entity/CargoDiscardApplication.java
index 369ece1f4..0997f55a0 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/discard/entity/CargoDiscardApplication.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/discard/entity/CargoDiscardApplication.java
@@ -28,6 +28,7 @@ public class CargoDiscardApplication {
     private String createdBy;
     private String reviewedBy;
     private String reviewRemark;
+    private LocalDateTime customerConfirmedAt;
     private LocalDateTime reviewedAt;
     private LocalDateTime createdAt;
     private LocalDateTime updatedAt;
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/discard/entity/CargoDiscardCarton.java b/lastleg-service/src/main/java/com/baiyue/lastleg/discard/entity/CargoDiscardCarton.java
index b8319c505..2e4f89bbb 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/discard/entity/CargoDiscardCarton.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/discard/entity/CargoDiscardCarton.java
@@ -15,6 +15,7 @@ public class CargoDiscardCarton {
     private Long itemId;
     private String customerId;
     private Long cartonId;
+    private String sourceType;
     private String cartonMark;
     private LocalDateTime createdAt;
 }
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/discard/entity/CargoDiscardItem.java b/lastleg-service/src/main/java/com/baiyue/lastleg/discard/entity/CargoDiscardItem.java
index bd21d4164..eb89faa2f 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/discard/entity/CargoDiscardItem.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/discard/entity/CargoDiscardItem.java
@@ -16,6 +16,9 @@ public class CargoDiscardItem {
     private Long orderId;
     private String sourceType;
     private Long returnCartonId;
+    private Long inventoryPositionId;
+    private String cartonMarksJson;
+    private Boolean cartonScanRequired;
     private String inboundCode;
     private Long profileId;
     private Long skuInventoryId;
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/discard/entity/CargoDiscardPhoto.java b/lastleg-service/src/main/java/com/baiyue/lastleg/discard/entity/CargoDiscardPhoto.java
new file mode 100644
index 000000000..3fe05d37d
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/discard/entity/CargoDiscardPhoto.java
@@ -0,0 +1,22 @@
+package com.baiyue.lastleg.discard.entity;
+
+import com.baomidou.mybatisplus.annotation.TableId;
+import com.baomidou.mybatisplus.annotation.TableName;
+import lombok.Data;
+import java.time.LocalDateTime;
+
+@Data
+@TableName("ll_cargo_discard_photo")
+public class CargoDiscardPhoto {
+    @TableId private Long id;
+    private String customerId;
+    private Long applicationId;
+    private String palletNo;
+    private Long fileId;
+    private String fileName;
+    private String contentType;
+    private Long sizeBytes;
+    private String operatorId;
+    private LocalDateTime createdAt;
+    private LocalDateTime submittedAt;
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/discard/gateway/CargoDiscardPhotoFileGateway.java b/lastleg-service/src/main/java/com/baiyue/lastleg/discard/gateway/CargoDiscardPhotoFileGateway.java
new file mode 100644
index 000000000..b27f510ce
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/discard/gateway/CargoDiscardPhotoFileGateway.java
@@ -0,0 +1,12 @@
+package com.baiyue.lastleg.discard.gateway;
+
+import org.springframework.web.multipart.MultipartFile;
+
+public interface CargoDiscardPhotoFileGateway {
+    UploadedFile upload(String customerId, long taskId, long operatorId, MultipartFile file);
+    void validate(String customerId, long taskId, long fileId);
+    DownloadedFile download(String customerId, long taskId, long fileId);
+
+    record UploadedFile(long fileId, String fileName, String contentType, long sizeBytes) { }
+    record DownloadedFile(byte[] content, String fileName, String contentType) { }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/discard/gateway/HttpCargoDiscardPhotoFileGateway.java b/lastleg-service/src/main/java/com/baiyue/lastleg/discard/gateway/HttpCargoDiscardPhotoFileGateway.java
new file mode 100644
index 000000000..c84bc2290
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/discard/gateway/HttpCargoDiscardPhotoFileGateway.java
@@ -0,0 +1,135 @@
+package com.baiyue.lastleg.discard.gateway;
+
+import com.baiyue.lastleg.config.LastlegRestClientFactory;
+import com.baiyue.lastleg.config.LastlegRestClientProperties;
+import jakarta.annotation.PostConstruct;
+import jakarta.annotation.Resource;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.core.io.ByteArrayResource;
+import org.springframework.http.HttpStatus;
+import org.springframework.http.HttpStatusCode;
+import org.springframework.http.MediaType;
+import org.springframework.http.client.MultipartBodyBuilder;
+import org.springframework.http.ResponseEntity;
+import org.springframework.stereotype.Component;
+import org.springframework.web.client.RestClient;
+import org.springframework.web.multipart.MultipartFile;
+import org.springframework.web.server.ResponseStatusException;
+
+import java.io.IOException;
+
+@Component
+public class HttpCargoDiscardPhotoFileGateway implements CargoDiscardPhotoFileGateway {
+    private static final String BUSINESS_TYPE = "OVERSEAS_CARGO_DISCARD_PHOTO";
+    @Resource private RestClient.Builder restClientBuilder;
+    @Resource private LastlegRestClientFactory restClientFactory;
+    @Resource private LastlegRestClientProperties restClientProperties;
+    @Value("${baiyue.clients.file.url:http://127.0.0.1:9205}") private String baseUrl;
+    @Value("${baiyue.security.internal-service-token:}") private String internalToken;
+    private RestClient client;
+
+    @PostConstruct
+    void initializeClient() {
+        client = restClientFactory.build(restClientBuilder, baseUrl,
+            restClientProperties.getCargoDiscardPhotoFile());
+    }
+
+    @Override
+    public UploadedFile upload(String customerId, long taskId, long operatorId, MultipartFile file) {
+        long tenantId = tenantId(customerId);
+        MultipartBodyBuilder body = new MultipartBodyBuilder();
+        try {
+            body.part("file", new ByteArrayResource(file.getBytes()) {
+                @Override public String getFilename() { return file.getOriginalFilename(); }
+            }).contentType(file.getContentType() == null ? MediaType.APPLICATION_OCTET_STREAM
+                : MediaType.parseMediaType(file.getContentType()));
+        } catch (IOException exception) {
+            throw new IllegalArgumentException("Cannot read cargo-discard photo", exception);
+        }
+        MetadataEnvelope response = client.post()
+            .uri("/internal/file/v1/business-files/{tenantId}/{businessType}/{businessId}",
+                tenantId, BUSINESS_TYPE, taskId)
+            .header("X-Internal-Service-Token", internalToken)
+            .header("X-Operator-Id", String.valueOf(operatorId))
+            .contentType(MediaType.MULTIPART_FORM_DATA).body(body.build()).retrieve()
+            .onStatus(HttpStatusCode::isError, (request, result) -> {
+                throw new ResponseStatusException(result.getStatusCode().is4xxClientError()
+                    ? HttpStatus.BAD_REQUEST : HttpStatus.SERVICE_UNAVAILABLE,
+                    "Cargo discard photo upload failed");
+            }).body(MetadataEnvelope.class);
+        requireSuccess(response, "Cargo discard photo upload failed");
+        Metadata data = response == null ? null : response.data();
+        if (data == null || data.fileId() == null) {
+            throw new ResponseStatusException(HttpStatus.SERVICE_UNAVAILABLE,
+                "File service returned no cargo-discard photo metadata");
+        }
+        return new UploadedFile(data.fileId(), data.fileName(), data.contentType(),
+            data.sizeBytes() == null ? 0L : data.sizeBytes());
+    }
+
+    @Override
+    public void validate(String customerId, long taskId, long fileId) {
+        long tenantId = tenantId(customerId);
+        MetadataEnvelope response = client.get()
+            .uri("/internal/file/v1/business-files/{tenantId}/{businessType}/{businessId}/{fileId}",
+                tenantId, BUSINESS_TYPE, taskId, fileId)
+            .header("X-Internal-Service-Token", internalToken).retrieve()
+            .onStatus(HttpStatusCode::isError, (request, result) -> {
+                throw new ResponseStatusException(result.getStatusCode().is4xxClientError()
+                    ? HttpStatus.BAD_REQUEST : HttpStatus.SERVICE_UNAVAILABLE,
+                    "Cargo discard photo does not exist or its ownership is invalid");
+            }).body(MetadataEnvelope.class);
+        requireSuccess(response, "Cargo discard photo does not exist or its ownership is invalid");
+        Metadata data = response == null ? null : response.data();
+        if (data == null || data.fileId() == null || data.fileId() != fileId
+            || data.tenantId() == null || data.tenantId() != tenantId
+            || !BUSINESS_TYPE.equals(data.businessType())
+            || !String.valueOf(taskId).equals(data.businessId())) {
+            throw new ResponseStatusException(HttpStatus.BAD_REQUEST,
+                "Cargo discard photo metadata does not match the PDA task");
+        }
+    }
+
+    @Override
+    public DownloadedFile download(String customerId, long taskId, long fileId) {
+        validate(customerId, taskId, fileId);
+        ResponseEntity<byte[]> response = client.get()
+            .uri("/internal/file/v1/business-files/{tenantId}/{businessType}/{businessId}/{fileId}/content",
+                tenantId(customerId), BUSINESS_TYPE, taskId, fileId)
+            .header("X-Internal-Service-Token", internalToken).retrieve()
+            .onStatus(HttpStatusCode::isError, (request, result) -> {
+                throw new ResponseStatusException(result.getStatusCode().is4xxClientError()
+                    ? HttpStatus.NOT_FOUND : HttpStatus.SERVICE_UNAVAILABLE, "Cargo discard photo download failed");
+            }).toEntity(byte[].class);
+        String fileName = response.getHeaders().getContentDisposition().getFilename();
+        String contentType = response.getHeaders().getContentType() == null
+            ? MediaType.APPLICATION_OCTET_STREAM_VALUE : response.getHeaders().getContentType().toString();
+        return new DownloadedFile(response.getBody() == null ? new byte[0] : response.getBody(),
+            fileName == null ? "cargo-discard-photo" : fileName, contentType);
+    }
+
+    private static long tenantId(String customerId) {
+        try { return Long.parseLong(customerId); }
+        catch (NumberFormatException exception) {
+            throw new ResponseStatusException(HttpStatus.BAD_REQUEST,
+                "Customer ID must be numeric", exception);
+        }
+    }
+
+    private static void requireSuccess(MetadataEnvelope response, String fallback) {
+        if (response == null) throw new ResponseStatusException(HttpStatus.SERVICE_UNAVAILABLE, fallback);
+        if ("200".equals(response.code())) return;
+        HttpStatus status = switch (String.valueOf(response.code())) {
+            case "A0400", "A0422" -> HttpStatus.BAD_REQUEST;
+            case "A0403" -> HttpStatus.FORBIDDEN;
+            case "A0404" -> HttpStatus.NOT_FOUND;
+            default -> HttpStatus.SERVICE_UNAVAILABLE;
+        };
+        throw new ResponseStatusException(status,
+            response.message() == null || response.message().isBlank() ? fallback : response.message());
+    }
+
+    private record MetadataEnvelope(String code, String message, Metadata data) { }
+    private record Metadata(Long fileId, Long tenantId, String businessType, String businessId,
+                            String fileName, String contentType, Long sizeBytes) { }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/discard/mapper/CargoDiscardApplicationMapper.java b/lastleg-service/src/main/java/com/baiyue/lastleg/discard/mapper/CargoDiscardApplicationMapper.java
index 3b314f9bc..7c53ccf11 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/discard/mapper/CargoDiscardApplicationMapper.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/discard/mapper/CargoDiscardApplicationMapper.java
@@ -19,4 +19,7 @@ public interface CargoDiscardApplicationMapper extends BaseMapper<CargoDiscardAp
 
     @Select("SELECT * FROM ll_cargo_discard_application WHERE discard_no=#{discardNo} AND overseas_warehouse_id=#{warehouseId} LIMIT 1 FOR UPDATE")
     CargoDiscardApplication findNoByWarehouse(@Param("discardNo") String discardNo, @Param("warehouseId") String warehouseId);
+
+    @Select("SELECT * FROM ll_cargo_discard_application WHERE discard_no=#{discardNo} AND overseas_warehouse_id=#{warehouseId} LIMIT 1")
+    CargoDiscardApplication readNoByWarehouse(@Param("discardNo") String discardNo, @Param("warehouseId") String warehouseId);
 }
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/discard/mapper/CargoDiscardInventoryMapper.java b/lastleg-service/src/main/java/com/baiyue/lastleg/discard/mapper/CargoDiscardInventoryMapper.java
index 6b642d1da..67cad5b89 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/discard/mapper/CargoDiscardInventoryMapper.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/discard/mapper/CargoDiscardInventoryMapper.java
@@ -12,6 +12,66 @@ import java.util.List;
 
 @Mapper
 public interface CargoDiscardInventoryMapper {
+
+    @Select("SELECT p.* FROM ll_inventory_position p WHERE p.customer_id=#{customerId} AND p.id=#{positionId} FOR UPDATE")
+    com.baiyue.lastleg.inventory.entity.InventoryPosition lockGenericPosition(@Param("customerId") String customerId, @Param("positionId") Long positionId);
+
+    @Select("""
+        SELECT c.id,c.carton_mark,c.sku_code,'INBOUND' source_type
+          FROM ll_inbound_plan_carton c
+          JOIN ll_inventory_balance b ON b.customer_id=c.customer_id AND b.inbound_order_id=c.order_id
+          JOIN ll_inventory_position p ON p.customer_id=b.customer_id AND p.balance_id=b.id AND p.pallet_id=c.warehouse_pallet_id
+         WHERE p.customer_id=#{customerId} AND p.id=#{positionId} AND c.status='AVAILABLE' AND c.received_at IS NOT NULL
+           AND COALESCE(b.destination_warehouse_code,'')=COALESCE(c.destination_warehouse_code,'')
+        UNION ALL
+        SELECT c.id,c.carton_mark,i.sku_code,'TRANSFER' source_type
+          FROM ll_inventory_position p
+          JOIN ll_inventory_balance b ON b.customer_id=p.customer_id AND b.id=p.balance_id
+          JOIN ll_warehouse_transfer_order t ON t.customer_id=p.customer_id AND t.inbound_order_id=b.inbound_order_id
+             AND t.transfer_no=p.batch_no AND t.operating_warehouse_id=p.overseas_warehouse_id
+          JOIN ll_warehouse_transfer_carton c ON c.customer_id=t.customer_id AND c.transfer_order_id=t.id AND c.status='EXPECTED'
+          JOIN ll_warehouse_transfer_item i ON i.customer_id=c.customer_id AND i.id=c.transfer_item_id
+         WHERE p.customer_id=#{customerId} AND p.id=#{positionId}
+           AND (SELECT COUNT(*) FROM ll_inventory_position current_position
+                 WHERE current_position.customer_id=p.customer_id AND current_position.balance_id=p.balance_id
+                   AND current_position.batch_no=p.batch_no AND current_position.overseas_warehouse_id=p.overseas_warehouse_id
+                   AND current_position.available_packages+current_position.hold_packages+current_position.allocated_packages+current_position.picked_packages>0)=1
+         ORDER BY id
+        """)
+    List<com.baiyue.lastleg.discard.model.CargoDiscardStockCartonRow> genericCartons(@Param("customerId") String customerId, @Param("positionId") Long positionId);
+
+    @Update("UPDATE ll_warehouse_transfer_carton SET status=#{toStatus},updated_at=NOW(3) " +
+        "WHERE customer_id=#{customerId} AND id=#{cartonId} AND status=#{fromStatus}")
+    int changeTransferCartonStatus(@Param("customerId") String customerId, @Param("cartonId") Long cartonId,
+        @Param("fromStatus") String fromStatus, @Param("toStatus") String toStatus);
+
+    @Update("UPDATE ll_inbound_plan_carton SET status=#{toStatus},version=version+1,updated_at=NOW(3) " +
+        "WHERE customer_id=#{customerId} AND id=#{cartonId} AND status=#{fromStatus}")
+    int changeGenericCartonStatus(@Param("customerId") String customerId, @Param("cartonId") Long cartonId,
+        @Param("fromStatus") String fromStatus, @Param("toStatus") String toStatus);
+
+    @Select("SELECT c.* FROM ll_dropship_carton c WHERE c.customer_id=#{customerId} AND c.order_id=#{orderId} AND c.status='AVAILABLE' ORDER BY c.profile_id,c.id")
+    List<DropshipCarton> availableOrderCartons(@Param("customerId") String customerId, @Param("orderId") Long orderId);
+
+    @Select("<script>SELECT c.* FROM ll_dropship_carton c WHERE c.customer_id=#{customerId} AND c.order_id=#{orderId} " +
+        "AND c.status='AVAILABLE' AND c.id IN <foreach collection='cartonIds' item='id' open='(' separator=',' close=')'>#{id}</foreach> " +
+        "AND EXISTS(SELECT 1 FROM ll_dropship_carton_sku cs WHERE cs.customer_id=c.customer_id AND cs.carton_id=c.id AND cs.sku_code=#{skuCode}) ORDER BY c.profile_id,c.id FOR UPDATE</script>")
+    List<DropshipCarton> lockSelected(@Param("customerId") String customerId, @Param("orderId") Long orderId,
+        @Param("skuCode") String skuCode, @Param("cartonIds") List<Long> cartonIds);
+
+    @Select("<script>SELECT p.* FROM ll_inventory_position p JOIN ll_inventory_balance b ON b.customer_id=p.customer_id AND b.id=p.balance_id " +
+        "WHERE p.customer_id=#{customerId} AND p.available_packages&gt;0 AND b.available_packages&gt;0 " +
+        "AND NOT EXISTS(SELECT 1 FROM ll_warehouse_transfer_inventory_allocation a WHERE a.customer_id=p.customer_id AND a.inventory_position_id=p.id AND a.status='RESERVED') " +
+        "AND NOT EXISTS(SELECT 1 FROM ll_dropship_order_profile d WHERE d.customer_id=p.customer_id AND d.inventory_position_id=p.id) " +
+        "<if test='keyword != null and keyword != \"\"'>AND b.inbound_code LIKE CONCAT('%',#{keyword},'%')</if> ORDER BY p.id</script>")
+    List<com.baiyue.lastleg.inventory.entity.InventoryPosition> genericPositions(@Param("customerId") String customerId, @Param("keyword") String keyword);
+
+    @Select("SELECT COUNT(*) FROM ll_dropship_order_profile WHERE customer_id=#{customerId} AND inventory_position_id=#{positionId}")
+    long isDropshipPosition(@Param("customerId") String customerId, @Param("positionId") Long positionId);
+
+    @Select("SELECT DISTINCT carton_mark FROM ll_inventory_ledger WHERE customer_id=#{customerId} AND position_id=#{positionId} " +
+        "AND business_type IN ('STOCK_IN','RETURN_STOCK_IN') AND carton_mark IS NOT NULL AND carton_mark<>'' ORDER BY carton_mark")
+    List<String> looseCartonMarks(@Param("customerId") String customerId, @Param("positionId") Long positionId);
     @Select("<script>SELECT o.id order_id,o.inbound_code,o.inbound_order_no,o.overseas_warehouse_id," +
         "o.overseas_warehouse_name,o.created_at,p.id profile_id,s.id sku_inventory_id,s.sku_code,s.product_name," +
         "COUNT(c.id) available_packages FROM ll_order o " +
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/discard/mapper/CargoDiscardPhotoMapper.java b/lastleg-service/src/main/java/com/baiyue/lastleg/discard/mapper/CargoDiscardPhotoMapper.java
new file mode 100644
index 000000000..b51e1bc35
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/discard/mapper/CargoDiscardPhotoMapper.java
@@ -0,0 +1,14 @@
+package com.baiyue.lastleg.discard.mapper;
+
+import com.baomidou.mybatisplus.core.mapper.BaseMapper;
+import com.baiyue.lastleg.discard.entity.CargoDiscardPhoto;
+import org.apache.ibatis.annotations.Mapper;
+import org.apache.ibatis.annotations.Param;
+import org.apache.ibatis.annotations.Select;
+import java.util.List;
+
+@Mapper
+public interface CargoDiscardPhotoMapper extends BaseMapper<CargoDiscardPhoto> {
+    @Select("SELECT * FROM ll_cargo_discard_photo WHERE customer_id=#{customerId} AND application_id=#{applicationId} ORDER BY created_at,id")
+    List<CargoDiscardPhoto> listApplication(@Param("customerId") String customerId, @Param("applicationId") Long applicationId);
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/discard/model/CargoDiscardStockCartonRow.java b/lastleg-service/src/main/java/com/baiyue/lastleg/discard/model/CargoDiscardStockCartonRow.java
new file mode 100644
index 000000000..3a3f8d15e
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/discard/model/CargoDiscardStockCartonRow.java
@@ -0,0 +1,12 @@
+package com.baiyue.lastleg.discard.model;
+
+import lombok.Data;
+
+/** A real carton whose current stock position can be established from warehouse facts. */
+@Data
+public class CargoDiscardStockCartonRow {
+    private Long id;
+    private String cartonMark;
+    private String skuCode;
+    private String sourceType;
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/discard/pda/controller/PdaCargoDiscardController.java b/lastleg-service/src/main/java/com/baiyue/lastleg/discard/pda/controller/PdaCargoDiscardController.java
index 16c3f1400..2f9b693e7 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/discard/pda/controller/PdaCargoDiscardController.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/discard/pda/controller/PdaCargoDiscardController.java
@@ -22,7 +22,28 @@ public class PdaCargoDiscardController {
     }
     @PostMapping("/resolve") public ApiResponse<PdaCargoDiscardDtos.PalletTask> resolve(@AuthenticationPrincipal AuthenticatedUser user,
         @Valid @RequestBody PdaCargoDiscardDtos.Scan request) {
-        return ApiResponse.success(service.resolve(PdaWarehouseIdentity.require(user), request.palletNo()));
+        return ApiResponse.success(service.resolve(PdaWarehouseIdentity.require(user), request.palletNo(), request.discardNo()));
+    }
+    @PostMapping(value = "/{discardNo}/pallets/{palletNo}/photos/files", consumes = org.springframework.http.MediaType.MULTIPART_FORM_DATA_VALUE)
+    public ApiResponse<com.baiyue.lastleg.discard.dto.CargoDiscardResponses.Photo> uploadPhoto(
+        @AuthenticationPrincipal AuthenticatedUser user, @PathVariable String discardNo, @PathVariable String palletNo,
+        @RequestParam("file") org.springframework.web.multipart.MultipartFile file) {
+        return ApiResponse.success(service.uploadPhoto(PdaWarehouseIdentity.require(user), discardNo, palletNo,
+            user.userId() == null ? 0L : user.userId(), file));
+    }
+    @GetMapping("/{discardNo}/pallets/{palletNo}/photos/files")
+    public ApiResponse<List<com.baiyue.lastleg.discard.dto.CargoDiscardResponses.Photo>> photos(
+        @AuthenticationPrincipal AuthenticatedUser user, @PathVariable String discardNo, @PathVariable String palletNo) {
+        return ApiResponse.success(service.photos(PdaWarehouseIdentity.require(user), discardNo, palletNo));
+    }
+    @GetMapping("/{discardNo}/pallets/{palletNo}/photos/files/{fileId}/download")
+    public org.springframework.http.ResponseEntity<byte[]> downloadPhoto(@AuthenticationPrincipal AuthenticatedUser user,
+        @PathVariable String discardNo, @PathVariable String palletNo, @PathVariable long fileId) {
+        var file = service.downloadPhoto(PdaWarehouseIdentity.require(user), discardNo, palletNo, fileId);
+        return org.springframework.http.ResponseEntity.ok().cacheControl(org.springframework.http.CacheControl.noStore())
+            .header(org.springframework.http.HttpHeaders.CONTENT_DISPOSITION,
+                org.springframework.http.ContentDisposition.inline().filename(file.fileName(), java.nio.charset.StandardCharsets.UTF_8).build().toString())
+            .contentType(org.springframework.http.MediaType.parseMediaType(file.contentType())).body(file.content());
     }
     @PostMapping("/{discardNo}/pallets/{palletNo}/confirm")
     public ApiResponse<PdaCargoDiscardDtos.PalletTask> confirm(@AuthenticationPrincipal AuthenticatedUser user,
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/discard/pda/dto/PdaCargoDiscardDtos.java b/lastleg-service/src/main/java/com/baiyue/lastleg/discard/pda/dto/PdaCargoDiscardDtos.java
index feb1ca451..24b6a37fe 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/discard/pda/dto/PdaCargoDiscardDtos.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/discard/pda/dto/PdaCargoDiscardDtos.java
@@ -10,11 +10,18 @@ import java.util.List;
 
 public final class PdaCargoDiscardDtos {
     private PdaCargoDiscardDtos() { }
-    public record Scan(@NotBlank @Size(max = 128) String palletNo) { }
+    public record Scan(@NotBlank @Size(max = 128) String palletNo, @Size(max = 128) String discardNo) {
+        public Scan(String palletNo) { this(palletNo, null); }
+    }
     public record ActualLine(@NotNull Long itemId, @PositiveOrZero int actualPackages) { }
-    public record Confirm(@NotEmpty List<@Valid ActualLine> lines) { }
+    public record Confirm(@NotEmpty List<@Valid ActualLine> lines,
+                          @NotEmpty @Size(max = 20) List<@NotNull @jakarta.validation.constraints.Positive Long> photoFileIds,
+                          List<@NotBlank String> scannedCartonMarks, Boolean confirmAllCartons) {
+        public Confirm(List<ActualLine> lines, List<Long> photoFileIds) { this(lines, photoFileIds, null, false); }
+    }
     public record Sku(Long itemId, String skuCode, String productName, int plannedPackages,
                       Integer actualPackages, String status) { }
     public record PalletTask(String discardNo, String customerId, String overseasWarehouseId,
-                             String palletNo, Long profileId, String status, List<Sku> skus) { }
+                             String palletNo, Long profileId, String status, List<Sku> skus, String outboundNo,
+                             String scanMode, List<String> cartonMarks) { }
 }
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/discard/pda/service/PdaCargoDiscardService.java b/lastleg-service/src/main/java/com/baiyue/lastleg/discard/pda/service/PdaCargoDiscardService.java
index b496842bb..ac5707bfa 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/discard/pda/service/PdaCargoDiscardService.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/discard/pda/service/PdaCargoDiscardService.java
@@ -23,13 +23,16 @@ import java.util.stream.Collectors;
 
 @Service
 public class PdaCargoDiscardService {
+    @Resource private com.baiyue.lastleg.discard.service.CargoDiscardPhotoService photoService;
     @Resource private CargoDiscardApplicationMapper applications;
+    @Resource private com.baiyue.lastleg.discard.service.CargoDiscardOutboundService outboundService;
     @Resource private CargoDiscardItemMapper items;
     @Resource private CargoDiscardCartonMapper cartons;
     @Resource private DropshipOrderProfileMapper profiles;
     @Resource private CargoDiscardInventoryAdjustmentService adjustments;
     @Resource private CargoDiscardService discardService;
     @Resource private ReturnInventoryCartonMapper returnCartons;
+    @Resource private com.baiyue.lastleg.discard.service.CargoDiscardStockService stockService;
 
     public List<PdaCargoDiscardDtos.PalletTask> tasks(PdaWarehouseIdentity identity) {
         return applications.selectList(new LambdaQueryWrapper<CargoDiscardApplication>()
@@ -40,7 +43,14 @@ public class PdaCargoDiscardService {
     }
 
     public PdaCargoDiscardDtos.PalletTask resolve(PdaWarehouseIdentity identity, String palletNo) {
-        return tasks(identity).stream().filter(t -> t.palletNo().equals(palletNo.trim())).findFirst()
+        return resolve(identity, palletNo, null);
+    }
+
+    public PdaCargoDiscardDtos.PalletTask resolve(PdaWarehouseIdentity identity, String palletNo, String discardNo) {
+        var matches = tasks(identity).stream().filter(t -> t.palletNo().equals(palletNo.trim()) || t.cartonMarks().contains(palletNo.trim()))
+            .filter(t -> discardNo == null || discardNo.isBlank() || t.discardNo().equals(discardNo.trim())).toList();
+        if (matches.size() > 1) throw conflict("该托盘有多个废弃任务，请先选择废弃单");
+        return matches.stream().findFirst()
             .orElseThrow(() -> new ResponseStatusException(HttpStatus.NOT_FOUND, "该仓库没有此托盘的待废弃任务"));
     }
 
@@ -61,12 +71,19 @@ public class PdaCargoDiscardService {
         if (!actuals.keySet().equals(task.skus().stream().map(PdaCargoDiscardDtos.Sku::itemId).collect(Collectors.toSet()))) {
             throw conflict("必须提交该托盘全部 SKU 的实际废弃数量");
         }
+        if (task.skus().stream().anyMatch(line -> !Objects.equals(actuals.get(line.itemId()), line.plannedPackages())))
+            throw conflict("必须完成本次废弃单所选全部箱子，不能漏出");
+        if ("CARTON".equals(task.scanMode()) && !Boolean.TRUE.equals(request.confirmAllCartons())) {
+            var scanned = request.scannedCartonMarks() == null ? List.<String>of() : request.scannedCartonMarks();
+            if (scanned.size() != task.cartonMarks().size() || !new HashSet<>(scanned).equals(new HashSet<>(task.cartonMarks())))
+                throw conflict("必须扫描全部箱唛，或选择一键全部废弃");
+        }
         List<CargoDiscardItem> palletItems = new ArrayList<>();
         for (PdaCargoDiscardDtos.Sku line : task.skus()) {
             CargoDiscardItem item = items.selectById(line.itemId());
             if (item == null || !application.getCustomerId().equals(item.getCustomerId())
                 || !Objects.equals(application.getId(), item.getApplicationId())
-                || !Objects.equals(task.profileId(), isReturnItem(item) ? item.getReturnCartonId() : item.getProfileId()))
+                || !physicalCode(application, item).equals(task.palletNo()))
                 throw conflict("废弃明细不属于当前申请或托盘");
             if ("COMPLETED".equals(item.getPdaStatus())
                 && !Objects.equals(item.getActualDiscardPackages(), actuals.get(item.getId())))
@@ -78,6 +95,8 @@ public class PdaCargoDiscardService {
                 || !application.getCustomerId().equals(item.getCustomerId())
                 || !Objects.equals(application.getId(), item.getApplicationId())))
             throw conflict("废弃申请终态存在未完成明细，不能恢复作业结果");
+        photoService.confirm(application, task.palletNo(), request.photoFileIds(),
+            palletItems.stream().allMatch(item -> "COMPLETED".equals(item.getPdaStatus())));
         // A completed pallet is an immutable result, including the final pallet after application completion.
         if (palletItems.stream().allMatch(item -> "COMPLETED".equals(item.getPdaStatus()))) return task;
         if (terminal) throw conflict("废弃终态不能执行未完成托盘");
@@ -103,33 +122,85 @@ public class PdaCargoDiscardService {
             application.setTotalPackages(actualTotal);
             application.setTotalFee(application.getFeePerPackage().multiply(java.math.BigDecimal.valueOf(actualTotal)));
             discardService.updateLinkedStatus(application.getCustomerId(), application, CargoDiscardService.APPROVED,
-                CargoDiscardService.PDA_COMPLETED, identity.operatorKey(), "全部托盘 PDA 废弃作业完成，待仓库确认");
+                CargoDiscardService.PDA_COMPLETED, identity.operatorKey(), "全部托盘 PDA 废弃作业完成，待客户确认");
         }
+        outboundService.sync(application);
         return palletTasks(application).stream().filter(value -> value.palletNo().equals(palletNo.trim()))
             .findFirst().orElseThrow(() -> new ResponseStatusException(HttpStatus.NOT_FOUND, "托盘不属于该废弃单"));
     }
 
-    private List<PdaCargoDiscardDtos.PalletTask> palletTasks(CargoDiscardApplication application) {
-        return items.listApplication(application.getCustomerId(), application.getId()).stream()
-            .collect(Collectors.groupingBy(this::physicalGroupKey, LinkedHashMap::new, Collectors.toList()))
-            .entrySet().stream().map(entry -> {
-                CargoDiscardItem first = entry.getValue().get(0);
-                boolean returnSource = isReturnItem(first);
-                DropshipOrderProfile profile = returnSource ? null : profiles.selectById(first.getProfileId());
-                ReturnInventoryCarton returnCarton = returnSource ? returnCartons.selectById(first.getReturnCartonId()) : null;
-                if (!returnSource && (profile == null || !application.getCustomerId().equals(profile.getCustomerId()))) throw conflict("废弃明细关联托盘不存在");
-                if (returnSource && (returnCarton == null || !application.getCustomerId().equals(returnCarton.getCustomerId()))) throw conflict("废弃明细关联退货箱不存在");
-                List<PdaCargoDiscardDtos.Sku> skus = entry.getValue().stream().map(i -> new PdaCargoDiscardDtos.Sku(
-                    i.getId(), i.getSkuCode(), i.getProductName(), i.getDiscardPackages(), i.getActualDiscardPackages(),
-                    i.getPdaStatus() == null ? "PENDING" : i.getPdaStatus())).toList();
-                String status = skus.stream().allMatch(s -> "COMPLETED".equals(s.status())) ? "COMPLETED" : "PENDING";
-                return new PdaCargoDiscardDtos.PalletTask(application.getDiscardNo(), application.getCustomerId(),
-                    application.getOverseasWarehouseId(), returnSource ? firstNonBlank(returnCarton.getPalletCode(), returnCarton.getCartonMark()) : profile.getPalletNo(),
-                    returnSource ? returnCarton.getId() : profile.getId(), status, skus);
-            }).toList();
+    @Transactional
+    public CargoDiscardResponses.Photo uploadPhoto(PdaWarehouseIdentity identity, String discardNo, String palletNo,
+                                                   long operatorUserId, org.springframework.web.multipart.MultipartFile file) {
+        CargoDiscardApplication application = photoApplication(identity, discardNo, palletNo, true);
+        var task = palletTasks(application).stream().filter(t -> t.palletNo().equals(palletNo.trim())).findFirst().orElseThrow();
+        if (!CargoDiscardService.APPROVED.equals(application.getStatus()) || "COMPLETED".equals(task.status()))
+            throw conflict("已完成或未审核的废弃托盘不能上传照片");
+        return photoService.upload(application, task.palletNo(), identity.operatorKey(), operatorUserId, file);
     }
-    private String physicalGroupKey(CargoDiscardItem item) {
-        return isReturnItem(item) ? "RETURN:" + item.getReturnCartonId() : "DROPSHIP:" + item.getProfileId();
+
+    @Transactional(readOnly = true)
+    public List<CargoDiscardResponses.Photo> photos(PdaWarehouseIdentity identity, String discardNo, String palletNo) {
+        return photoService.list(photoApplication(identity, discardNo, palletNo, false), palletNo.trim(), false);
+    }
+
+    @Transactional(readOnly = true)
+    public com.baiyue.lastleg.discard.gateway.CargoDiscardPhotoFileGateway.DownloadedFile downloadPhoto(
+        PdaWarehouseIdentity identity, String discardNo, String palletNo, long fileId) {
+        return photoService.download(photoApplication(identity, discardNo, palletNo, false), palletNo.trim(), fileId, false);
+    }
+
+    private CargoDiscardApplication photoApplication(PdaWarehouseIdentity identity, String discardNo, String palletNo, boolean lock) {
+        var warehouseId = String.valueOf(identity.overseasWarehouseId());
+        var application = lock ? applications.findNoByWarehouse(discardNo, warehouseId) : applications.readNoByWarehouse(discardNo, warehouseId);
+        if (application == null) throw new ResponseStatusException(HttpStatus.NOT_FOUND, "废弃任务不存在或不属于当前仓库");
+        if (palletTasks(application).stream().noneMatch(t -> t.palletNo().equals(palletNo.trim())))
+            throw new ResponseStatusException(HttpStatus.NOT_FOUND, "托盘不属于该废弃单");
+        return application;
+    }
+
+    private static final String LOOSE = "散箱";
+    private List<PdaCargoDiscardDtos.PalletTask> palletTasks(CargoDiscardApplication application) {
+        var allItems = items.listApplication(application.getCustomerId(), application.getId());
+        var grouped = allItems.stream().collect(Collectors.groupingBy(i -> physicalCode(application, i), LinkedHashMap::new, Collectors.toList()));
+        return grouped.entrySet().stream().map(entry -> {
+            CargoDiscardItem first = entry.getValue().get(0);
+            var skus = entry.getValue().stream().map(i -> new PdaCargoDiscardDtos.Sku(i.getId(), i.getSkuCode(), i.getProductName(),
+                i.getDiscardPackages(), i.getActualDiscardPackages(), i.getPdaStatus() == null ? "PENDING" : i.getPdaStatus())).toList();
+            String status = skus.stream().allMatch(i -> "COMPLETED".equals(i.status())) ? "COMPLETED" : "PENDING";
+            var marks = entry.getValue().stream().flatMap(i -> cartonMarks(application, i).stream()).distinct().sorted().toList();
+            boolean cartonScan = LOOSE.equals(entry.getKey()) || entry.getValue().stream().anyMatch(i -> Boolean.TRUE.equals(i.getCartonScanRequired()));
+            if (cartonScan && marks.isEmpty()) throw conflict("散箱废弃任务缺少箱唛");
+            return new PdaCargoDiscardDtos.PalletTask(application.getDiscardNo(), application.getCustomerId(), application.getOverseasWarehouseId(),
+                entry.getKey(), first.getInventoryPositionId() != null ? first.getInventoryPositionId() : isReturnItem(first) ? first.getReturnCartonId() : first.getProfileId(),
+                status, skus, outboundService.outboundNo(application), cartonScan ? "CARTON" : "PALLET", marks);
+        }).toList();
+    }
+    private String physicalCode(CargoDiscardApplication application, CargoDiscardItem item) {
+        String code;
+        if ("INVENTORY".equals(item.getSourceType())) {
+            var position = stockService.position(application.getCustomerId(), item.getInventoryPositionId());
+            if (!application.getOverseasWarehouseId().equals(position.getOverseasWarehouseId())) throw conflict("废弃库存不属于当前仓库");
+            code = position.getPalletNo();
+        } else if (isReturnItem(item)) {
+            var carton = returnCartons.selectById(item.getReturnCartonId());
+            if (carton == null || !application.getCustomerId().equals(carton.getCustomerId())) throw conflict("废弃明细关联退货箱不存在");
+            code = carton.getPalletCode();
+        } else {
+            var profile = profiles.selectById(item.getProfileId());
+            if (profile == null || !application.getCustomerId().equals(profile.getCustomerId())) throw conflict("废弃明细关联托盘不存在");
+            code = profile.getPalletNo();
+        }
+        return code == null || code.isBlank() ? LOOSE : code.trim();
+    }
+    private List<String> cartonMarks(CargoDiscardApplication application, CargoDiscardItem item) {
+        if ("INVENTORY".equals(item.getSourceType())) return stockService.cartonMarks(item);
+        if (isReturnItem(item)) {
+            var carton = returnCartons.selectById(item.getReturnCartonId());
+            return carton.getCartonMark() == null ? List.of() : List.of(carton.getCartonMark());
+        }
+        return cartons.listApplication(application.getCustomerId(), application.getId()).stream()
+            .filter(c -> Objects.equals(c.getItemId(), item.getId())).map(CargoDiscardCarton::getCartonMark).filter(Objects::nonNull).toList();
     }
     private boolean isReturnItem(CargoDiscardItem item) {
         return "RETURN_CARTON".equals(item.getSourceType()) || item.getReturnCartonId() != null;
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/discard/service/CargoDiscardInventoryAdjustmentService.java b/lastleg-service/src/main/java/com/baiyue/lastleg/discard/service/CargoDiscardInventoryAdjustmentService.java
index 3eef8cdd8..82020dc5e 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/discard/service/CargoDiscardInventoryAdjustmentService.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/discard/service/CargoDiscardInventoryAdjustmentService.java
@@ -34,6 +34,7 @@ import java.util.Map;
 @Service
 public class CargoDiscardInventoryAdjustmentService {
     @Resource private CargoDiscardInventoryMapper inventory;
+    @Resource private CargoDiscardStockService stockService;
     @Resource private DropshipCartonLedgerMapper cartonLedgers;
     @Resource private DropshipCartonSkuMapper cartonSkus;
     @Resource private DropshipSkuInventoryMapper skuInventories;
@@ -47,6 +48,11 @@ public class CargoDiscardInventoryAdjustmentService {
     public AdjustmentResult discardPalletItem(String customerId, CargoDiscardApplication application,
                                                CargoDiscardItem item, List<CargoDiscardCarton> links,
                                                int actualPackages, String operatorId, LocalDateTime occurredAt) {
+        if (actualPackages != item.getDiscardPackages()) throw conflict("必须完成本次废弃单所选全部箱子，不能漏出");
+        if ("INVENTORY".equals(item.getSourceType())) {
+            stockService.discard(customerId, operatorId, application, item, actualPackages);
+            return new AdjustmentResult(item.getDiscardPackages(), actualPackages, 0);
+        }
         if (isReturnItem(item)) return discardReturnItem(customerId, item, actualPackages);
         if (actualPackages < 0 || actualPackages > links.size()) throw conflict("实际废弃数量超出该托盘申请数量");
         DropshipSkuInventory sku = inventory.lockSkuInventory(customerId, item.getSkuInventoryId());
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/discard/service/CargoDiscardOutboundService.java b/lastleg-service/src/main/java/com/baiyue/lastleg/discard/service/CargoDiscardOutboundService.java
new file mode 100644
index 000000000..0fc044fe6
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/discard/service/CargoDiscardOutboundService.java
@@ -0,0 +1,124 @@
+package com.baiyue.lastleg.discard.service;
+
+import com.baomidou.mybatisplus.core.toolkit.IdWorker;
+import com.baiyue.lastleg.delivery.entity.OutboundOrder;
+import com.baiyue.lastleg.delivery.entity.OutboundPalletItem;
+import com.baiyue.lastleg.delivery.mapper.OutboundOrderMapper;
+import com.baiyue.lastleg.delivery.mapper.OutboundPalletItemMapper;
+import com.baiyue.lastleg.discard.entity.CargoDiscardApplication;
+import com.baiyue.lastleg.discard.mapper.CargoDiscardItemMapper;
+import com.baiyue.lastleg.discard.mapper.CargoDiscardCartonMapper;
+import com.baiyue.lastleg.dropship.mapper.DropshipOrderProfileMapper;
+import com.baiyue.lastleg.returnreceipt.mapper.ReturnInventoryCartonMapper;
+import com.baiyue.lastleg.service.LastlegOrderNoGenerator;
+import jakarta.annotation.Resource;
+import org.springframework.stereotype.Service;
+import org.springframework.http.HttpStatus;
+import org.springframework.web.server.ResponseStatusException;
+import java.math.BigDecimal;
+import java.time.LocalDateTime;
+import java.util.Objects;
+
+/** Outbound projection; inventory writes belong exclusively to the discard workflow. */
+@Service
+public class CargoDiscardOutboundService {
+    public static final String TYPE = "DISCARD_OUTBOUND";
+    @Resource private OutboundOrderMapper outbounds;
+    @Resource private OutboundPalletItemMapper pallets;
+    @Resource private CargoDiscardItemMapper items;
+    @Resource private CargoDiscardCartonMapper cartons;
+    @Resource private DropshipOrderProfileMapper profiles;
+    @Resource private ReturnInventoryCartonMapper returnCartons;
+    @Resource private LastlegOrderNoGenerator orderNoGenerator;
+    @Resource private CargoDiscardStockService stockService;
+
+    private String key(CargoDiscardApplication application) { return "CARGO_DISCARD:" + application.getId(); }
+
+    public String outboundNo(CargoDiscardApplication application) {
+        var outbound = outbounds.findByIdempotency(application.getCustomerId(), key(application));
+        return outbound == null ? null : outbound.getOutboundNo();
+    }
+
+    // The caller holds the application lock and owns the approval transaction.
+    public void create(CargoDiscardApplication application, String operatorId) {
+        if (outbounds.findByIdempotency(application.getCustomerId(), key(application)) != null) return;
+        var lines = items.listApplication(application.getCustomerId(), application.getId());
+        if (lines.isEmpty()) throw conflict("废弃单没有可出库明细");
+        var links = cartons.listApplication(application.getCustomerId(), application.getId());
+        LocalDateTime at = LocalDateTime.now();
+        OutboundOrder outbound = new OutboundOrder();
+        outbound.setId(IdWorker.getId()); outbound.setCustomerId(application.getCustomerId());
+        outbound.setOutboundNo(orderNoGenerator.next("OUTBOUND", application.getOverseasWarehouseId(), outbound.getId()));
+        outbound.setOverseasWarehouseId(application.getOverseasWarehouseId()); outbound.setOutboundType(TYPE);
+        outbound.setLxCodes(null); outbound.setRecipientInfo("废弃单 " + application.getDiscardNo());
+        outbound.setStatus("WAIT_PICK"); outbound.setPackageCount(application.getTotalPackages());
+        outbound.setIdempotencyKey(key(application)); outbound.setRequestHash(key(application));
+        outbound.setVolumeWeightKg(BigDecimal.ZERO); outbound.setVolumeCbm(BigDecimal.ZERO);
+        outbound.setCreatedBy(operatorId); outbound.setCreatedAt(at); outbound.setUpdatedAt(at);
+        var snapshots = new java.util.ArrayList<OutboundPalletItem>();
+        var palletCodes = new java.util.HashSet<String>();
+        for (var line : lines) {
+            boolean returned = line.getReturnCartonId() != null || "RETURN_CARTON".equals(line.getSourceType());
+            String palletNo;
+            String cartonMarks;
+            if ("INVENTORY".equals(line.getSourceType())) {
+                var position = stockService.position(application.getCustomerId(), line.getInventoryPositionId());
+                if (!application.getOverseasWarehouseId().equals(position.getOverseasWarehouseId())) throw conflict("废弃库存仓库不匹配");
+                palletNo = position.getPalletNo();
+                cartonMarks = String.join(",", stockService.cartonMarks(line));
+            } else if (returned) {
+                var carton = returnCartons.selectById(line.getReturnCartonId());
+                if (carton == null || !application.getCustomerId().equals(carton.getCustomerId())
+                    || !application.getOverseasWarehouseId().equals(carton.getOverseasWarehouseId()))
+                    throw conflict("废弃明细关联退货箱不存在或仓库不匹配");
+                palletNo = carton.getPalletCode() == null || carton.getPalletCode().isBlank() ? null : carton.getPalletCode();
+                cartonMarks = carton.getCartonMark();
+            } else {
+                var profile = profiles.selectById(line.getProfileId());
+                if (profile == null || !application.getCustomerId().equals(profile.getCustomerId()))
+                    throw conflict("废弃明细关联托盘不存在");
+                palletNo = profile.getPalletNo();
+                cartonMarks = links.stream().filter(c -> Objects.equals(c.getItemId(), line.getId()))
+                    .map(c -> c.getCartonMark()).filter(Objects::nonNull).collect(java.util.stream.Collectors.joining(","));
+            }
+            if (palletNo != null && !palletNo.isBlank()) palletCodes.add(palletNo);
+            OutboundPalletItem snapshot = new OutboundPalletItem();
+            // Stable one-to-one projection key in a separate table, never used to deduct stock.
+            snapshot.setId(line.getId()); snapshot.setCustomerId(application.getCustomerId()); snapshot.setOutboundOrderId(outbound.getId());
+            snapshot.setPalletNo(palletNo); snapshot.setSkuCode(line.getSkuCode()); snapshot.setInboundCode(line.getInboundCode());
+            snapshot.setOrderRefs(application.getDiscardNo()); snapshot.setCartonMarks(cartonMarks);
+            snapshot.setPackageCount(line.getDiscardPackages()); snapshot.setPickedPackageCount(0); snapshot.setStatus("WAIT_PICK");
+            if (returned) snapshot.setReturnSkuQuantity((long) line.getDiscardPackages());
+            snapshot.setVolumeWeightKg(BigDecimal.ZERO); snapshot.setVolumeCbm(BigDecimal.ZERO); snapshot.setCreatedAt(at);
+            snapshots.add(snapshot);
+        }
+        outbound.setPalletCount(palletCodes.size()); outbounds.insert(outbound);
+        snapshots.forEach(pallets::insert);
+    }
+
+    public void sync(CargoDiscardApplication application) {
+        OutboundOrder outbound = outbounds.lockByIdempotency(application.getCustomerId(), key(application));
+        if (outbound == null) throw conflict("废弃出库单不存在，请联系平台核对审核结果");
+        var lines = items.listApplication(application.getCustomerId(), application.getId());
+        for (var snapshot : pallets.findByOutbound(application.getCustomerId(), outbound.getId())) {
+            var line = lines.stream().filter(i -> Objects.equals(i.getId(), snapshot.getId())).findFirst()
+                .orElseThrow(() -> conflict("废弃出库明细关联失效"));
+            if ("COMPLETED".equals(line.getPdaStatus())) {
+                snapshot.setPickedPackageCount(Objects.requireNonNullElse(line.getActualDiscardPackages(), 0));
+                snapshot.setStatus("PICKED");
+            }
+            if (CargoDiscardService.CANCELLED.equals(application.getStatus())) snapshot.setStatus("CANCELLED");
+            pallets.updateById(snapshot);
+        }
+        String status = switch (application.getStatus()) {
+            case CargoDiscardService.PDA_COMPLETED, CargoDiscardService.COMPLETED -> "OUTBOUNDED";
+            case CargoDiscardService.CANCELLED -> "CANCELLED";
+            default -> lines.stream().anyMatch(i -> "COMPLETED".equals(i.getPdaStatus())) ? "PICKING" : "WAIT_PICK";
+        };
+        outbound.setStatus(status);
+        outbound.setLxCodes(null);
+        if ("OUTBOUNDED".equals(status)) outbound.setPackageCount(application.getTotalPackages());
+        outbound.setUpdatedAt(LocalDateTime.now()); outbounds.updateById(outbound);
+    }
+    private static ResponseStatusException conflict(String message) { return new ResponseStatusException(HttpStatus.CONFLICT, message); }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/discard/service/CargoDiscardPhotoService.java b/lastleg-service/src/main/java/com/baiyue/lastleg/discard/service/CargoDiscardPhotoService.java
new file mode 100644
index 000000000..39de34a6f
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/discard/service/CargoDiscardPhotoService.java
@@ -0,0 +1,75 @@
+package com.baiyue.lastleg.discard.service;
+
+import com.baiyue.lastleg.discard.dto.CargoDiscardResponses;
+import com.baiyue.lastleg.discard.entity.CargoDiscardApplication;
+import com.baiyue.lastleg.discard.entity.CargoDiscardPhoto;
+import com.baiyue.lastleg.discard.gateway.CargoDiscardPhotoFileGateway;
+import com.baiyue.lastleg.discard.mapper.CargoDiscardPhotoMapper;
+import jakarta.annotation.Resource;
+import org.springframework.http.HttpStatus;
+import org.springframework.stereotype.Service;
+import org.springframework.web.multipart.MultipartFile;
+import org.springframework.web.server.ResponseStatusException;
+import java.time.LocalDateTime;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Objects;
+
+@Service
+public class CargoDiscardPhotoService {
+    @Resource private CargoDiscardPhotoMapper photos;
+    @Resource private CargoDiscardPhotoFileGateway files;
+
+    public List<CargoDiscardResponses.Photo> list(CargoDiscardApplication application, String palletNo, boolean submittedOnly) {
+        return rows(application, palletNo).stream().filter(p -> !submittedOnly || p.getSubmittedAt() != null)
+            .map(this::view).toList();
+    }
+
+    public CargoDiscardResponses.Photo upload(CargoDiscardApplication application, String palletNo,
+                                               String operatorId, long operatorUserId, MultipartFile file) {
+        if (rows(application, palletNo).size() >= 20) throw conflict("每个托盘最多上传 20 张废弃照片");
+        var uploaded = files.upload(application.getCustomerId(), application.getId(), operatorUserId, file);
+        CargoDiscardPhoto photo = new CargoDiscardPhoto();
+        photo.setCustomerId(application.getCustomerId()); photo.setApplicationId(application.getId());
+        photo.setPalletNo(palletNo); photo.setFileId(uploaded.fileId()); photo.setFileName(uploaded.fileName());
+        photo.setContentType(uploaded.contentType()); photo.setSizeBytes(uploaded.sizeBytes());
+        photo.setOperatorId(operatorId); photo.setCreatedAt(LocalDateTime.now()); photos.insert(photo);
+        return view(photo);
+    }
+
+    // Called under the application row lock, in the same transaction as inventory deduction.
+    public void confirm(CargoDiscardApplication application, String palletNo, List<Long> fileIds, boolean completed) {
+        if (fileIds == null || fileIds.isEmpty() || fileIds.size() > 20
+            || fileIds.stream().anyMatch(id -> id == null || id <= 0) || new HashSet<>(fileIds).size() != fileIds.size())
+            throw conflict("每个托盘须提交 1–20 张不重复的废弃照片");
+        var rows = rows(application, palletNo);
+        var submitted = rows.stream().filter(p -> p.getSubmittedAt() != null).map(CargoDiscardPhoto::getFileId).toList();
+        if (completed) {
+            if (!new HashSet<>(submitted).equals(new HashSet<>(fileIds))) throw conflict("已完成托盘的废弃照片不能修改");
+            return;
+        }
+        var selected = rows.stream().filter(p -> fileIds.contains(p.getFileId())).toList();
+        if (selected.size() != fileIds.size()) throw conflict("照片不属于当前废弃单或托盘");
+        selected.forEach(p -> files.validate(application.getCustomerId(), application.getId(), p.getFileId()));
+        var now = LocalDateTime.now();
+        selected.forEach(p -> { p.setSubmittedAt(now); photos.updateById(p); });
+    }
+
+    public CargoDiscardPhotoFileGateway.DownloadedFile download(CargoDiscardApplication application, String palletNo,
+                                                                 long fileId, boolean submittedOnly) {
+        var photo = rows(application, palletNo).stream().filter(p -> Objects.equals(p.getFileId(), fileId))
+            .filter(p -> !submittedOnly || p.getSubmittedAt() != null).findFirst()
+            .orElseThrow(() -> new ResponseStatusException(HttpStatus.NOT_FOUND, "废弃照片不存在或尚未提交"));
+        return files.download(application.getCustomerId(), application.getId(), photo.getFileId());
+    }
+
+    private List<CargoDiscardPhoto> rows(CargoDiscardApplication application, String palletNo) {
+        return photos.listApplication(application.getCustomerId(), application.getId()).stream()
+            .filter(p -> palletNo == null || palletNo.equals(p.getPalletNo())).toList();
+    }
+    private CargoDiscardResponses.Photo view(CargoDiscardPhoto photo) {
+        return new CargoDiscardResponses.Photo(photo.getFileId(), photo.getPalletNo(), photo.getFileName(),
+            photo.getContentType(), photo.getSizeBytes(), photo.getOperatorId(), photo.getCreatedAt(), photo.getSubmittedAt());
+    }
+    private static ResponseStatusException conflict(String message) { return new ResponseStatusException(HttpStatus.CONFLICT, message); }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/discard/service/CargoDiscardService.java b/lastleg-service/src/main/java/com/baiyue/lastleg/discard/service/CargoDiscardService.java
index 56fccc1b7..ad35cd767 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/discard/service/CargoDiscardService.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/discard/service/CargoDiscardService.java
@@ -60,6 +60,11 @@ public class CargoDiscardService {
     public static final String COMPLETED = "COMPLETED";
     private static final Set<String> STATUSES = Set.of(PENDING_REVIEW, APPROVED, REJECTED, CANCELLED, PDA_COMPLETED, COMPLETED);
 
+    @Resource private CargoDiscardPhotoService photoService;
+    @Resource private CargoDiscardOutboundService outboundService;
+    @Resource private CargoDiscardStockService stockService;
+    @Resource private com.baiyue.lastleg.dropship.mapper.DropshipCartonSkuMapper cartonSkus;
+    @Resource private com.baiyue.lastleg.dropship.mapper.DropshipOrderProfileMapper profiles;
     @Resource private CargoDiscardApplicationMapper applications;
     @Resource private CargoDiscardItemMapper items;
     @Resource private CargoDiscardCartonMapper discardCartons;
@@ -71,6 +76,8 @@ public class CargoDiscardService {
     @Resource private ReturnInventoryCartonMapper returnCartons;
     @Resource private ReturnInventoryCartonItemMapper returnCartonItems;
     @Resource private ObjectMapper objectMapper;
+    @Resource private com.baiyue.lastleg.client.DomesticWarehouseDirectoryClient warehouseDirectory;
+    @Value("${baiyue.security.internal-service-token:}") private String internalToken;
     @Value("${baiyue.lastleg.cargo-discard.fee-per-package-usd:5.00}")
     private BigDecimal feePerPackage = new BigDecimal("5.00");
 
@@ -84,6 +91,7 @@ public class CargoDiscardService {
         List<CargoDiscardResponses.Candidate> result = grouped.values().stream()
             .map(value -> value.response(inventory.countAvailableOrder(customerId, value.first.getOrderId())))
             .collect(java.util.stream.Collectors.toCollection(java.util.ArrayList::new));
+        result.addAll(stockService.candidates(customerId, trim(inboundCode)));
         String keyword = trim(inboundCode);
         if (returnCartons == null || returnCartonItems == null) return result;
         for (ReturnInventoryCarton carton : returnCartons.findAvailable(customerId, null)) {
@@ -99,7 +107,35 @@ public class CargoDiscardService {
                 carton.getSourceReturnNo(), carton.getSourceReturnNo(), carton.getOverseasWarehouseId(), null,
                 null, available, skus));
         }
-        return result;
+        Map<String, String> names = result.stream().anyMatch(c -> !StringUtils.hasText(c.overseasWarehouseName()))
+            ? warehouseNames() : Map.of();
+        return result.stream().map(candidate -> withBoxes(customerId, new CargoDiscardResponses.Candidate(
+            candidate.orderId(), candidate.sourceType(), candidate.returnCartonId(), candidate.cartonMark(),
+            candidate.inboundCode(), candidate.inboundOrderNo(), candidate.overseasWarehouseId(),
+            StringUtils.hasText(candidate.overseasWarehouseName()) ? candidate.overseasWarehouseName() : names.get(candidate.overseasWarehouseId()),
+            candidate.inboundCreatedAt(), candidate.availablePackages(), candidate.skus(), candidate.inventoryPositionId(),
+            candidate.palletNo(), candidate.cartons(), candidate.cartonSelectionSupported(), candidate.cartonSelectionBlockReason()))).toList();
+    }
+
+    private CargoDiscardResponses.Candidate withBoxes(String customer, CargoDiscardResponses.Candidate candidate) {
+        if ("INVENTORY".equals(candidate.sourceType())) return candidate;
+        List<CargoDiscardResponses.Box> boxes;
+        if ("RETURN_CARTON".equals(candidate.sourceType())) {
+            var carton = returnCartons.selectById(candidate.returnCartonId());
+            boxes = List.of(new CargoDiscardResponses.Box(candidate.returnCartonId(), candidate.cartonMark(), carton == null ? null : carton.getPalletCode(), candidate.skus()));
+        } else {
+            boxes = inventory.availableOrderCartons(customer, candidate.orderId()).stream().map(carton -> {
+                var profile = profiles.selectById(carton.getProfileId());
+                var skus = cartonSkus.listCarton(customer, carton.getId()).stream().map(sku -> new CargoDiscardResponses.CandidateSku(sku.getSkuCode(), sku.getProductName(), 1)).toList();
+                if (skus.isEmpty()) skus = List.of(new CargoDiscardResponses.CandidateSku(carton.getSkuCode(), null, 1));
+                return new CargoDiscardResponses.Box(carton.getId(), carton.getCartonMark(), profile == null ? null : profile.getPalletNo(), skus);
+            }).toList();
+        }
+        boolean supported = !boxes.isEmpty() && boxes.stream().allMatch(box -> box.cartonMark() != null && !box.cartonMark().isBlank());
+        return new CargoDiscardResponses.Candidate(candidate.orderId(), candidate.sourceType(), candidate.returnCartonId(), candidate.cartonMark(),
+            candidate.inboundCode(), candidate.inboundOrderNo(), candidate.overseasWarehouseId(), candidate.overseasWarehouseName(), candidate.inboundCreatedAt(),
+            candidate.availablePackages(), candidate.skus(), candidate.inventoryPositionId(), candidate.palletNo(), boxes, supported,
+            supported ? null : "当前库存缺少完整箱唛，可按全部库存废弃");
     }
 
     @Transactional
@@ -115,6 +151,7 @@ public class CargoDiscardService {
             return detail(customerId, replay.getDiscardNo());
         }
         Set<String> requestedDimensions = new LinkedHashSet<>();
+        Set<String> requestedBoxes = new LinkedHashSet<>();
         Map<Long, LastlegOrder> orderCache = new HashMap<>();
         Map<Long, ReturnInventoryCarton> returnCartonCache = new HashMap<>();
         String warehouseId = null;
@@ -122,19 +159,29 @@ public class CargoDiscardService {
         int total = 0;
         for (CargoDiscardRequests.Item input : request.items()) {
             boolean returnSource = input.returnCartonId() != null;
-            if (returnSource == (input.orderId() != null)) {
+            if (input.cartonIds() != null) {
+                if (input.cartonIds().isEmpty() || input.cartonIds().size() != input.discardPackages()) throw badRequest("请选择具体废弃箱子，箱数须与选择一致");
+                String source = input.inventoryPositionId() != null ? "INVENTORY" : "DROPSHIP";
+                for (Long cartonId : input.cartonIds()) if (!requestedBoxes.add(source + ":" + cartonId)) throw badRequest("同一个箱子不能重复废弃");
+            }
+            int sources = (returnSource ? 1 : 0) + (input.orderId() != null ? 1 : 0) + (input.inventoryPositionId() != null ? 1 : 0);
+            if (sources != 1) {
                 throw badRequest("Each discard item must identify exactly one inventory source");
             }
-            String dimension = (returnSource ? "RETURN:" + input.returnCartonId() : "ORDER:" + input.orderId())
+            String dimension = (input.inventoryPositionId() != null ? "INVENTORY:" + input.inventoryPositionId() : returnSource ? "RETURN:" + input.returnCartonId() : "ORDER:" + input.orderId())
                 + ":" + input.skuCode().trim();
             if (!requestedDimensions.add(dimension)) throw badRequest("Duplicate order/SKU discard item: " + dimension);
             String itemWarehouseId;
             String itemWarehouseName;
-            if (returnSource) {
+            if (input.inventoryPositionId() != null) {
+                var balance = stockService.validate(customerId, input);
+                itemWarehouseId = balance.getOverseasWarehouseId();
+                itemWarehouseName = balance.getOverseasWarehouseName();
+            } else if (returnSource) {
                 ReturnInventoryCarton carton = requireReturnCarton(customerId, input.returnCartonId());
                 ReturnInventoryCartonItem sku = returnCartonItems.lockSku(carton.getId(), input.skuCode().trim());
-                if (sku == null || value(sku.getQuantity()) < input.discardPackages()) {
-                    throw conflict("Insufficient return inventory for SKU " + input.skuCode().trim());
+                if (sku == null || value(sku.getQuantity()) != input.discardPackages()) {
+                    throw conflict("目前仅支持全部废弃，退货 SKU 数量不匹配: " + input.skuCode().trim());
                 }
                 returnCartonCache.put(carton.getId(), carton);
                 itemWarehouseId = carton.getOverseasWarehouseId();
@@ -154,13 +201,23 @@ public class CargoDiscardService {
             total = Math.addExact(total, input.discardPackages());
         }
 
+        for (Long cartonId : returnCartonCache.keySet()) {
+            Set<String> availableSkus = returnCartonItems.lockCarton(cartonId).stream()
+                .filter(sku -> value(sku.getQuantity()) > 0).map(ReturnInventoryCartonItem::getSkuCode)
+                .collect(java.util.stream.Collectors.toSet());
+            Set<String> requestedSkus = request.items().stream().filter(i -> cartonId.equals(i.returnCartonId()))
+                .map(i -> i.skuCode().trim()).collect(java.util.stream.Collectors.toSet());
+            if (!availableSkus.equals(requestedSkus)) throw conflict("目前不支持部分废弃，必须选择退货箱内全部 SKU 库存");
+        }
         LocalDateTime now = LocalDateTime.now();
+        if (!StringUtils.hasText(warehouseName)) warehouseName = warehouseNames().get(warehouseId);
         CargoDiscardApplication application = new CargoDiscardApplication();
         application.setId(IdWorker.getId()); application.setCustomerId(customerId);
         application.setDiscardNo(orderNoGenerator.next("DISCARD", warehouseId, application.getId()));
         application.setOverseasWarehouseId(warehouseId); application.setOverseasWarehouseName(warehouseName);
         application.setInboundCodes(java.util.stream.Stream.concat(
-            orderCache.values().stream().map(LastlegOrder::getInboundCode),
+            java.util.stream.Stream.concat(orderCache.values().stream().map(LastlegOrder::getInboundCode),
+                request.items().stream().filter(i -> i.inventoryPositionId() != null).map(i -> stockService.validate(customerId, i).getInboundCode())),
             returnCartonCache.values().stream().map(ReturnInventoryCarton::getSourceReturnNo))
             .distinct().sorted().collect(java.util.stream.Collectors.joining(",")));
         application.setTotalPackages(total); application.setFeePerPackage(feePerPackage);
@@ -175,7 +232,9 @@ public class CargoDiscardService {
 
         Set<Long> reservedReturnCartons = new LinkedHashSet<>();
         for (CargoDiscardRequests.Item input : request.items()) {
-            if (input.returnCartonId() != null) {
+            if (input.inventoryPositionId() != null) {
+                stockService.reserve(customerId, operatorId, application, input, now);
+            } else if (input.returnCartonId() != null) {
                 reserveReturn(customerId, application, returnCartonCache.get(input.returnCartonId()), input, now,
                     reservedReturnCartons);
             } else {
@@ -186,6 +245,16 @@ public class CargoDiscardService {
         return detail(customerId, application.getDiscardNo());
     }
 
+    private List<String> selectedMarks(String customer, CargoDiscardApplication application, CargoDiscardItem line) {
+        if ("INVENTORY".equals(line.getSourceType())) return stockService.cartonMarks(line);
+        if (isReturnItem(line)) {
+            var carton = returnCartons.selectById(line.getReturnCartonId());
+            return carton == null || carton.getCartonMark() == null ? List.of() : List.of(carton.getCartonMark());
+        }
+        return discardCartons.listApplication(customer, application.getId()).stream().filter(link -> link.getItemId().equals(line.getId()))
+            .map(CargoDiscardCarton::getCartonMark).distinct().sorted().toList();
+    }
+
     public PageResult<CargoDiscardResponses.Summary> page(String customerId, CargoDiscardRequests.Query query) {
         validateQuery(query);
         LambdaQueryWrapper<CargoDiscardApplication> wrapper = new LambdaQueryWrapper<CargoDiscardApplication>()
@@ -199,7 +268,9 @@ public class CargoDiscardService {
             .le(query.createdTo() != null, CargoDiscardApplication::getCreatedAt, query.createdTo())
             .orderByDesc(CargoDiscardApplication::getCreatedAt).orderByDesc(CargoDiscardApplication::getId);
         Page<CargoDiscardApplication> result = applications.selectPage(Page.of(query.page(), query.size()), wrapper);
-        List<CargoDiscardResponses.Summary> records = result.getRecords().stream().map(this::summary).toList();
+        Map<String, String> names = result.getRecords().stream().anyMatch(a -> !StringUtils.hasText(a.getOverseasWarehouseName()))
+            ? warehouseNames() : Map.of();
+        List<CargoDiscardResponses.Summary> records = result.getRecords().stream().map(a -> summary(a, names)).toList();
         return new PageResult<>(records, query.page(), query.size(), result.getTotal(), result.getPages());
     }
 
@@ -208,13 +279,19 @@ public class CargoDiscardService {
         if (application == null) throw notFound("Cargo discard application not found");
         List<CargoDiscardResponses.Item> itemViews = items.listApplication(customerId, application.getId()).stream()
             .map(value -> new CargoDiscardResponses.Item(value.getId(), value.getOrderId(), value.getInboundCode(),
-                value.getSkuCode(), value.getProductName(), value.getAvailablePackagesSnapshot(), value.getDiscardPackages()))
+                value.getSkuCode(), value.getProductName(), value.getAvailablePackagesSnapshot(), value.getDiscardPackages(), selectedMarks(customerId, application, value)))
             .toList();
         List<CargoDiscardResponses.History> historyViews = histories.listApplication(customerId, application.getId()).stream()
             .map(value -> new CargoDiscardResponses.History(value.getFromStatus(), value.getToStatus(),
                 value.getOperatorId(), value.getRemark(), value.getCreatedAt())).toList();
         return new CargoDiscardResponses.Detail(summary(application), application.getFeePerPackage(),
-            application.getRemark(), application.getReviewedBy(), application.getReviewRemark(), itemViews, historyViews);
+            application.getRemark(), application.getReviewedBy(), application.getReviewRemark(), itemViews, historyViews, photoService.list(application, null, true));
+    }
+
+    public com.baiyue.lastleg.discard.gateway.CargoDiscardPhotoFileGateway.DownloadedFile downloadPhoto(String customerId, String discardNo, long fileId) {
+        CargoDiscardApplication application = applications.findNo(customerId, discardNo);
+        if (application == null) throw notFound("Cargo discard application not found");
+        return photoService.download(application, null, fileId, true);
     }
 
     @Transactional
@@ -237,9 +314,10 @@ public class CargoDiscardService {
             .collect(java.util.stream.Collectors.groupingBy(CargoDiscardCarton::getItemId));
         String historyRemark = request.remark();
         if (REJECTED.equals(next)) {
-            release(customerId, links, applicationItems);
+            release(customerId, application, links, applicationItems);
         }
 
+        if (APPROVED.equals(next)) outboundService.create(application, operatorId);
         LocalDateTime reviewedAt = now();
         application.setStatus(next); application.setReviewedBy(operatorId);
         application.setReviewRemark(trim(request.remark())); application.setReviewedAt(reviewedAt);
@@ -259,12 +337,13 @@ public class CargoDiscardService {
     }
 
     @Transactional
-    public CargoDiscardResponses.Detail complete(String customerId, String discardNo, String operatorId) {
+    public CargoDiscardResponses.Detail confirmCompletion(String customerId, String discardNo, String operatorId) {
         CargoDiscardApplication application = applications.lockNo(customerId, discardNo);
         if (application == null) throw notFound("Cargo discard application not found");
         if (COMPLETED.equals(application.getStatus())) return detail(customerId, discardNo);
         if (!PDA_COMPLETED.equals(application.getStatus())) throw conflict("全部托盘 PDA 作业完成后才能确认废弃完成");
-        updateLinkedStatus(customerId, application, PDA_COMPLETED, COMPLETED, operatorId, "仓库确认废弃完成");
+        application.setCustomerConfirmedAt(now());
+        updateLinkedStatus(customerId, application, PDA_COMPLETED, COMPLETED, operatorId, "客户确认废弃完成");
         return detail(customerId, discardNo);
     }
 
@@ -280,6 +359,7 @@ public class CargoDiscardService {
             LastlegOrderStatusHistory h = new LastlegOrderStatusHistory(); h.setId(IdWorker.getId()); h.setCustomerId(customerId); h.setOrderId(linked.getId());
             h.setFromStatus(linkedFrom); h.setToStatus(linkedTo); h.setEventId("CARGO_DISCARD_STATUS:" + application.getId() + ":" + linkedTo); h.setRemark(remark); h.setCreatedAt(at); orderHistories.insert(h);
         }
+        outboundService.sync(application);
         history(customerId, application.getId(), from, to, operatorId, remark, at);
     }
 
@@ -297,7 +377,7 @@ public class CargoDiscardService {
             throw conflict("客户只能取消待审核的废弃申请");
         }
         List<CargoDiscardCarton> links = discardCartons.listApplication(customerId, application.getId());
-        release(customerId, links, items.listApplication(customerId, application.getId()));
+        release(customerId, application, links, items.listApplication(customerId, application.getId()));
         LocalDateTime at = now();
         String from = application.getStatus();
         application.setStatus(CANCELLED); application.setReviewedBy(platform ? operatorId : application.getReviewedBy());
@@ -311,6 +391,7 @@ public class CargoDiscardService {
             h.setFromStatus(from); h.setToStatus(CANCELLED); h.setEventId("CARGO_DISCARD_CANCEL:" + application.getId()); h.setRemark("废弃申请已取消"); h.setCreatedAt(at);
             orderHistories.insert(h);
         }
+        if (APPROVED.equals(from)) outboundService.sync(application);
         history(customerId, application.getId(), from, CANCELLED, operatorId, "废弃申请已取消", at);
         return detail(customerId, discardNo);
     }
@@ -318,11 +399,14 @@ public class CargoDiscardService {
     private void reserve(String customerId, CargoDiscardApplication application, LastlegOrder order,
                          CargoDiscardRequests.Item input, LocalDateTime now) {
         String skuCode = input.skuCode().trim();
-        if (inventory.countAvailable(customerId, order.getId(), skuCode) < input.discardPackages()) {
-            throw conflict("Insufficient available packages for SKU " + skuCode + " on inbound " + order.getInboundCode());
+        List<DropshipCarton> selected;
+        if (input.cartonIds() != null) {
+            selected = inventory.lockSelected(customerId, order.getId(), skuCode, input.cartonIds());
+        } else {
+            if (inventory.countAvailable(customerId, order.getId(), skuCode) != input.discardPackages()) throw conflict("部分废弃必须选择具体箱子，不能只填写数量");
+            selected = inventory.lockAvailable(customerId, order.getId(), skuCode, input.discardPackages());
         }
-        List<DropshipCarton> selected = inventory.lockAvailable(customerId, order.getId(), skuCode, input.discardPackages());
-        if (selected.size() != input.discardPackages()) throw conflict("Available cargo changed; retry the discard request");
+        if (selected.size() != input.discardPackages()) throw conflict("箱子已被占用、SKU 不匹配或不属于当前库存，请刷新后重选");
         Map<Long, List<DropshipCarton>> byProfile = selected.stream()
             .collect(java.util.stream.Collectors.groupingBy(DropshipCarton::getProfileId, LinkedHashMap::new,
                 java.util.stream.Collectors.toList()));
@@ -336,6 +420,7 @@ public class CargoDiscardService {
             item.setSkuInventoryId(sku.getId()); item.setSkuCode(skuCode); item.setProductName(sku.getProductName());
             item.setAvailablePackagesSnapshot(Math.toIntExact(inventory.countAvailableProfile(
                 customerId, order.getId(), entry.getKey(), skuCode)));
+            item.setCartonScanRequired(input.cartonIds() != null && entry.getValue().size() < inventory.availableOrderCartons(customerId, order.getId()).stream().filter(c -> c.getProfileId().equals(entry.getKey())).count());
             item.setDiscardPackages(entry.getValue().size()); item.setCreatedAt(now); items.insert(item);
             for (DropshipCarton carton : entry.getValue()) {
                 if (inventory.changeCartonStatus(customerId, carton.getId(), "AVAILABLE", "DISCARD_PENDING") != 1) {
@@ -349,12 +434,15 @@ public class CargoDiscardService {
         }
     }
 
-    private void release(String customerId, List<CargoDiscardCarton> links, List<CargoDiscardItem> applicationItems) {
+    private void release(String customerId, CargoDiscardApplication application, List<CargoDiscardCarton> links, List<CargoDiscardItem> applicationItems) {
+        Set<Long> genericItems = applicationItems.stream().filter(i -> "INVENTORY".equals(i.getSourceType())).map(CargoDiscardItem::getId).collect(java.util.stream.Collectors.toSet());
         for (CargoDiscardCarton link : links) {
+            if (genericItems.contains(link.getItemId())) continue;
             if (inventory.changeCartonStatus(customerId, link.getCartonId(), "DISCARD_PENDING", "AVAILABLE") != 1) {
                 throw conflict("Reserved cargo status changed before rejection");
             }
         }
+        applicationItems.stream().filter(i -> "INVENTORY".equals(i.getSourceType())).forEach(i -> stockService.release(customerId, application, i));
         applicationItems.stream().filter(this::isReturnItem).map(CargoDiscardItem::getReturnCartonId)
             .filter(java.util.Objects::nonNull).distinct().forEach(cartonId -> {
                 if (returnCartons.releaseDiscard(cartonId, customerId) != 1) {
@@ -366,7 +454,7 @@ public class CargoDiscardService {
     private void reserveReturn(String customerId, CargoDiscardApplication application, ReturnInventoryCarton carton,
                                CargoDiscardRequests.Item input, LocalDateTime now, Set<Long> reservedCartons) {
         ReturnInventoryCartonItem sku = returnCartonItems.lockSku(carton.getId(), input.skuCode().trim());
-        if (sku == null || value(sku.getQuantity()) < input.discardPackages()) {
+        if (sku == null || value(sku.getQuantity()) != input.discardPackages()) {
             throw conflict("Available return inventory changed; retry the discard request");
         }
         if (reservedCartons.add(carton.getId()) && returnCartons.markDiscardPending(carton.getId(), customerId) != 1) {
@@ -403,10 +491,26 @@ public class CargoDiscardService {
     }
 
     private CargoDiscardResponses.Summary summary(CargoDiscardApplication value) {
+        return summary(value, StringUtils.hasText(value.getOverseasWarehouseName()) ? Map.of() : warehouseNames());
+    }
+
+    private Map<String, String> warehouseNames() {
+        var response = warehouseDirectory.receivingWarehouses(internalToken);
+        if (response == null || !response.successful() || response.data() == null)
+            throw new ResponseStatusException(HttpStatus.SERVICE_UNAVAILABLE, "海外仓库目录暂不可用");
+        Map<String, String> names = new HashMap<>();
+        for (var warehouse : response.data()) {
+            if (warehouse.warehouseId() != null && StringUtils.hasText(warehouse.warehouseName()))
+                names.put(warehouse.warehouseId().toString(), warehouse.warehouseName());
+        }
+        return names;
+    }
+
+    private CargoDiscardResponses.Summary summary(CargoDiscardApplication value, Map<String, String> names) {
         return new CargoDiscardResponses.Summary(value.getId(), value.getCustomerId(), value.getDiscardNo(), value.getInboundCodes(),
-            value.getOverseasWarehouseId(), value.getOverseasWarehouseName(), value.getTotalPackages(),
+            value.getOverseasWarehouseId(), StringUtils.hasText(value.getOverseasWarehouseName()) ? value.getOverseasWarehouseName() : names.get(value.getOverseasWarehouseId()), value.getTotalPackages(),
             value.getTotalFee(), value.getCurrency(), value.getStatus(), value.getCreatedBy(), value.getCreatedAt(),
-            value.getReviewedAt());
+            value.getReviewedAt(), outboundService.outboundNo(value), value.getCustomerConfirmedAt());
     }
 
     private void history(String customerId, Long applicationId, String from, String to, String operatorId,
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/discard/service/CargoDiscardStockService.java b/lastleg-service/src/main/java/com/baiyue/lastleg/discard/service/CargoDiscardStockService.java
new file mode 100644
index 000000000..57b06fa14
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/discard/service/CargoDiscardStockService.java
@@ -0,0 +1,142 @@
+package com.baiyue.lastleg.discard.service;
+
+import com.baiyue.lastleg.discard.dto.*;
+import com.baiyue.lastleg.discard.entity.*;
+import com.baiyue.lastleg.discard.mapper.*;
+import com.baiyue.lastleg.inventory.command.dto.InventoryCommandRequests;
+import com.baiyue.lastleg.inventory.command.service.InventoryCommandService;
+import com.baiyue.lastleg.inventory.entity.*;
+import com.baiyue.lastleg.inventory.mapper.*;
+import com.baomidou.mybatisplus.core.toolkit.IdWorker;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import jakarta.annotation.Resource;
+import org.springframework.stereotype.Service;
+import org.springframework.http.HttpStatus;
+import org.springframework.web.server.ResponseStatusException;
+import java.util.*;
+import java.time.LocalDateTime;
+
+/** Stock eligibility is based on physical available positions, independent of the source document type. */
+@Service
+public class CargoDiscardStockService {
+    @Resource private CargoDiscardInventoryMapper stock;
+    @Resource private InventoryPositionMapper positions;
+    @Resource private InventoryBalanceMapper balances;
+    @Resource private InventoryCommandService commands;
+    @Resource private CargoDiscardItemMapper items;
+    @Resource private CargoDiscardCartonMapper links;
+    @Resource private ObjectMapper objectMapper;
+
+    public List<CargoDiscardResponses.Candidate> candidates(String customer, String keyword) {
+        return stock.genericPositions(customer, keyword).stream().map(position -> {
+            var balance = balances.selectById(position.getBalanceId());
+            if (balance == null || !customer.equals(balance.getCustomerId())) throw conflict("库存余额不存在");
+            long available = Math.min(value(position.getAvailablePackages()), value(balance.getAvailablePackages()));
+            var cartons = stock.genericCartons(customer, position.getId());
+            boolean complete = cartons.size() == available && cartons.stream().allMatch(c -> c.getCartonMark() != null && !c.getCartonMark().isBlank())
+                && cartons.stream().map(c -> c.getCartonMark()).distinct().count() == cartons.size();
+            var boxes = complete ? cartons.stream().map(c -> new CargoDiscardResponses.Box(c.getId(), c.getCartonMark(), position.getPalletNo(),
+                List.of(new CargoDiscardResponses.CandidateSku(c.getSkuCode(), balance.getProductNameZh(), 1)))).toList() : List.<CargoDiscardResponses.Box>of();
+            return new CargoDiscardResponses.Candidate(null, "INVENTORY", null, null,
+                balance.getInboundCode(), balance.getInboundOrderNo(), balance.getOverseasWarehouseId(),
+                balance.getOverseasWarehouseName(), position.getCreatedAt(), available,
+                List.of(new CargoDiscardResponses.CandidateSku(sku(balance), balance.getProductNameZh(), available)),
+                position.getId(), position.getPalletNo(), boxes, complete,
+                complete ? null : "当前库存缺少完整箱唛与托盘对应记录，可按全部库存废弃");
+        }).filter(c -> c.availablePackages() > 0).toList();
+    }
+
+    public InventoryBalance validate(String customer, CargoDiscardRequests.Item request) {
+        var position = position(customer, request.inventoryPositionId());
+        var balance = balances.selectById(position.getBalanceId());
+        if (balance == null || !customer.equals(balance.getCustomerId())
+            || !Objects.equals(position.getOverseasWarehouseId(), balance.getOverseasWarehouseId()))
+            throw conflict("库存不属于当前客户或仓库");
+        if (!sku(balance).equals(request.skuCode().trim())) throw conflict("SKU 不属于所选库存");
+        long available = Math.min(value(position.getAvailablePackages()), value(balance.getAvailablePackages()));
+        if (available <= 0 || request.discardPackages() <= 0 || request.discardPackages() > available) throw conflict("所选废弃库存数量不足");
+        if (request.cartonIds() != null) {
+            if (request.cartonIds().size() != request.discardPackages() || new HashSet<>(request.cartonIds()).size() != request.cartonIds().size())
+                throw conflict("废弃箱子数量与所选箱子不一致或重复");
+            var cartons = stock.genericCartons(customer, position.getId());
+            var ids = cartons.stream().map(c -> c.getId()).collect(java.util.stream.Collectors.toSet());
+            if (cartons.size() != available || cartons.stream().anyMatch(c -> c.getCartonMark() == null || c.getCartonMark().isBlank()) || cartons.stream().map(c -> c.getCartonMark()).distinct().count() != cartons.size() || !ids.containsAll(request.cartonIds())) throw conflict("箱唛库存已变化或不属于所选托盘，请刷新后重选");
+        } else if (request.discardPackages() != available) throw conflict("部分废弃必须选择具体箱子，不能只填写数量");
+        if (stock.isDropshipPosition(customer, position.getId()) > 0) throw conflict("一件代发库存必须按真实箱唛选择，不能绕过箱级预留");
+        return balance;
+    }
+
+    public void reserve(String customer, String operator, CargoDiscardApplication application, CargoDiscardRequests.Item request, LocalDateTime at) {
+        if (stock.lockGenericPosition(customer, request.inventoryPositionId()) == null) throw conflict("库存仓位不存在");
+        var balance = validate(customer, request);
+        var position = position(customer, request.inventoryPositionId());
+        var line = new CargoDiscardItem(); line.setId(IdWorker.getId()); line.setApplicationId(application.getId());
+        line.setCustomerId(customer); line.setSourceType("INVENTORY"); line.setInventoryPositionId(position.getId());
+        line.setInboundCode(balance.getInboundCode()); line.setSkuCode(sku(balance)); line.setProductName(balance.getProductNameZh());
+        line.setAvailablePackagesSnapshot(Math.toIntExact(Math.min(value(position.getAvailablePackages()), value(balance.getAvailablePackages())))); line.setDiscardPackages(request.discardPackages()); line.setCreatedAt(at);
+        var availableCartons = stock.genericCartons(customer, position.getId());
+        var selected = request.cartonIds() == null
+            ? (availableCartons.size() == request.discardPackages() ? availableCartons : List.<com.baiyue.lastleg.discard.model.CargoDiscardStockCartonRow>of())
+            : availableCartons.stream().filter(c -> request.cartonIds().contains(c.getId())).toList();
+        if (!selected.isEmpty()) {
+            for (var carton : selected) {
+                if (changeBox(customer, carton.getId(), carton.getSourceType(), "TRANSFER".equals(carton.getSourceType()) ? "EXPECTED" : "AVAILABLE", "DISCARD_PENDING") != 1) throw conflict("箱子已被其他作业占用，请刷新后重选");
+                var link = new CargoDiscardCarton(); link.setId(IdWorker.getId()); link.setCustomerId(customer); link.setApplicationId(application.getId());
+                link.setItemId(line.getId()); link.setSourceType(carton.getSourceType()); link.setCartonId(carton.getId()); link.setCartonMark(carton.getCartonMark()); link.setCreatedAt(at); links.insert(link);
+            }
+            snapshotMarks(line, selected.stream().map(c -> c.getCartonMark()).toList());
+            line.setCartonScanRequired(request.discardPackages() < value(position.getAvailablePackages()) + value(position.getHoldPackages()) + value(position.getAllocatedPackages()) + value(position.getPickedPackages()));
+        } else if (position.getPalletNo() == null || position.getPalletNo().isBlank()) {
+            var marks = stock.looseCartonMarks(customer, position.getId());
+            if (marks.size() != request.discardPackages() || marks.stream().distinct().count() != marks.size()) throw conflict("散箱库存缺少完整箱唛，请先核对实物箱级入库记录");
+            snapshotMarks(line, marks);
+        }
+        commands.hold(customer, operator, move(application, line, request.discardPackages(), "HOLD"));
+        items.insert(line);
+    }
+
+    public void release(String customer, CargoDiscardApplication application, CargoDiscardItem line) {
+        changeSelectedCartons(customer, application, line, "AVAILABLE");
+        commands.release(customer, application.getCreatedBy(), move(application, line, line.getDiscardPackages(), "RELEASE"));
+    }
+
+    public void discard(String customer, String operator, CargoDiscardApplication application, CargoDiscardItem line, int actual) {
+        if (actual != line.getDiscardPackages()) throw conflict("必须完成本次申请所选全部箱子，不能漏出");
+        changeSelectedCartons(customer, application, line, "DISCARDED");
+        commands.discardHeld(customer, operator, move(application, line, actual, "DISCARD"));
+    }
+
+    private int changeBox(String customer, Long cartonId, String source, String from, String to) {
+        if ("TRANSFER".equals(source)) return stock.changeTransferCartonStatus(customer, cartonId, from, to);
+        if (!"INBOUND".equals(source)) throw conflict("箱子库存来源不正确");
+        return stock.changeGenericCartonStatus(customer, cartonId, from, to);
+    }
+    private void snapshotMarks(CargoDiscardItem line, List<String> marks) {
+        try { line.setCartonMarksJson(objectMapper.writeValueAsString(marks)); }
+        catch (Exception e) { throw new IllegalStateException("Cannot snapshot carton marks", e); }
+    }
+    private void changeSelectedCartons(String customer, CargoDiscardApplication application, CargoDiscardItem line, String status) {
+        for (var link : links.listApplication(customer, application.getId())) {
+            if (Objects.equals(link.getItemId(), line.getId()) && changeBox(customer, link.getCartonId(), link.getSourceType(), "DISCARD_PENDING", "TRANSFER".equals(link.getSourceType()) && "AVAILABLE".equals(status) ? "EXPECTED" : status) != 1)
+                throw conflict("预留箱子的库存状态发生变化");
+        }
+    }
+    private InventoryCommandRequests.Move move(CargoDiscardApplication application, CargoDiscardItem line, int count, String action) {
+        String cycle = "CARGO_DISCARD:" + application.getId() + ":" + line.getId();
+        return new InventoryCommandRequests.Move(line.getInventoryPositionId(), count, application.getDiscardNo(),
+            null, cycle, cycle + ":" + action, "货物废弃 " + action);
+    }
+    public InventoryPosition position(String customer, Long id) {
+        var position = positions.findTenantPosition(customer, id);
+        if (position == null) throw conflict("废弃库存仓位不存在或不属于当前客户");
+        return position;
+    }
+    public List<String> cartonMarks(CargoDiscardItem line) {
+        if (line.getCartonMarksJson() == null) return List.of();
+        try { return objectMapper.readValue(line.getCartonMarksJson(), new com.fasterxml.jackson.core.type.TypeReference<List<String>>() {}); }
+        catch (Exception e) { throw new IllegalStateException("Cannot read carton marks", e); }
+    }
+    private static String sku(InventoryBalance balance) { return balance.getSkuCode() == null || balance.getSkuCode().isBlank() ? "UNSPECIFIED" : balance.getSkuCode(); }
+    private static long value(Long value) { return value == null ? 0 : value; }
+    private static ResponseStatusException conflict(String message) { return new ResponseStatusException(HttpStatus.CONFLICT, message); }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/dispatch/dto/DispatchRequests.java b/lastleg-service/src/main/java/com/baiyue/lastleg/dispatch/dto/DispatchRequests.java
index a8d9e405d..2088889b7 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/dispatch/dto/DispatchRequests.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/dispatch/dto/DispatchRequests.java
@@ -9,6 +9,7 @@ import jakarta.validation.constraints.Size;
 
 import java.time.LocalDateTime;
 import java.util.List;
+import com.baiyue.lastleg.appointmentwork.AppointmentWorkDispatchPort.Allocation;
 
 public final class DispatchRequests {
     private DispatchRequests() {
@@ -37,10 +38,15 @@ public final class DispatchRequests {
                              @Size(max = 32) String vehicleAppointmentStatus,
                              @Size(max = 64) String draftToken,
                              @Size(max = 64) String relabelNo,
-                             @Size(max = 500) List<@NotNull Long> returnReceiptIds) {
+                             @Size(max = 500) List<@NotNull Long> returnReceiptIds,
+                             @Size(max = 1000) List<@jakarta.validation.Valid Allocation> batchAllocations) {
         public PreArrange {
             planPalletIds = planPalletIds == null ? List.of() : List.copyOf(planPalletIds);
             returnReceiptIds = returnReceiptIds == null ? List.of() : List.copyOf(returnReceiptIds);
+            batchAllocations = batchAllocations == null ? List.of() : List.copyOf(batchAllocations);
+        }
+        public PreArrange(List<Long> planPalletIds,String fbaAppointmentNo,String fbaAppointmentStatus,String vehicleAppointmentStatus,String draftToken,String relabelNo,List<Long> returnReceiptIds) {
+            this(planPalletIds,fbaAppointmentNo,fbaAppointmentStatus,vehicleAppointmentStatus,draftToken,relabelNo,returnReceiptIds,List.of());
         }
         public PreArrange(List<Long> planPalletIds, String fbaAppointmentNo, String fbaAppointmentStatus,
                           String vehicleAppointmentStatus, String draftToken, String relabelNo) {
@@ -74,11 +80,14 @@ public final class DispatchRequests {
 
     public record DraftGroup(@NotNull Long draftContainerId,
                              @Size(max = 500) List<@NotNull Long> planPalletIds,
-                             @Size(max = 500) List<@NotNull Long> returnReceiptIds) {
+                             @Size(max = 500) List<@NotNull Long> returnReceiptIds,
+                             @Size(max = 1000) List<@jakarta.validation.Valid Allocation> batchAllocations) {
         public DraftGroup {
             planPalletIds = planPalletIds == null ? List.of() : List.copyOf(planPalletIds);
             returnReceiptIds = returnReceiptIds == null ? List.of() : List.copyOf(returnReceiptIds);
+            batchAllocations = batchAllocations == null ? List.of() : List.copyOf(batchAllocations);
         }
+        public DraftGroup(Long id,List<Long> pallets,List<Long> receipts) { this(id,pallets,receipts,List.of()); }
     }
 
     public record DraftRelease(@NotBlank @Size(max = 64) String draftToken) {
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/dispatch/dto/DispatchResponse.java b/lastleg-service/src/main/java/com/baiyue/lastleg/dispatch/dto/DispatchResponse.java
index 1eacc603e..aadcd1ebe 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/dispatch/dto/DispatchResponse.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/dispatch/dto/DispatchResponse.java
@@ -12,7 +12,8 @@ public record DispatchResponse(Long id, String dispatchNo, String vehiclePlate,
                                int itemCount, int palletCount, int packageCount, int pickedPackageCount,
                                int shippedPackageCount, int remainingPackageCount, String partialCompletionReason,
                                LocalDateTime createdAt,
-                               List<Item> items, List<BolLine> bolLines, com.baiyue.lastleg.fleet.trip.FleetDispatchWorkflowQuery.Workflow workflow) {
+                               List<Item> items, List<BolLine> bolLines, com.baiyue.lastleg.fleet.trip.FleetDispatchWorkflowQuery.Workflow workflow,
+                               List<com.baiyue.lastleg.appointmentwork.AppointmentWorkDispatchPort.BatchReference> appointmentBatches) {
     public record Item(Long id, Long planPalletId, Long warehousePalletId, String palletNo,
                        String overseasWarehouseId, String overseasWarehouseName,
                        String orderNo, String orderRefs, String inboundCode, String destinationWarehouseCode,
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/dispatch/fleet/DispatchFleetAdapter.java b/lastleg-service/src/main/java/com/baiyue/lastleg/dispatch/fleet/DispatchFleetAdapter.java
index fdabb5351..b4ee57d61 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/dispatch/fleet/DispatchFleetAdapter.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/dispatch/fleet/DispatchFleetAdapter.java
@@ -45,6 +45,8 @@ public class DispatchFleetAdapter implements FleetDispatchGateway {
     private final DispatchItemMapper items;
     private final DispatchPdaPickMapper picks;
     private final DispatchPdaWorkflowService workflow;
+    @jakarta.annotation.Resource @org.springframework.context.annotation.Lazy
+    private com.baiyue.lastleg.dispatch.service.DispatchService dispatchService;
 
     public DispatchFleetAdapter(DispatchOrderMapper orders, DispatchPdaTaskMapper tasks,
                                 OutboundOrderMapper outbounds, DeliveryOrderMapper deliveries, DispatchItemMapper items,
@@ -54,6 +56,9 @@ public class DispatchFleetAdapter implements FleetDispatchGateway {
         this.deliveryOperations = deliveryOperations;
     }
 
+    @Override
+    public void removeItem(String dispatchNo,long itemId) { dispatchService.removeItem(dispatchNo,itemId); }
+
     @Override
     public Snapshot lockForPlanning(String dispatchNo) {
         return lockBeforeDeparture(dispatchNo, false);
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/dispatch/mapper/DispatchCandidateMapper.java b/lastleg-service/src/main/java/com/baiyue/lastleg/dispatch/mapper/DispatchCandidateMapper.java
index e8d326718..52151dd76 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/dispatch/mapper/DispatchCandidateMapper.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/dispatch/mapper/DispatchCandidateMapper.java
@@ -11,12 +11,14 @@ import java.util.List;
 public interface DispatchCandidateMapper {
     // Only the receiving party's confirmed appointment is a transport reference; it is not a loading plan.
     String CONFIRMED_APPOINTMENT_AT =
-        "(SELECT MAX(fa.appointment_at) FROM ll_inbound_plan_pallet_allocation pa " +
+        "(SELECT CASE WHEN COUNT(DISTINCT fa.id)=1 THEN MAX(fa.appointment_at) END FROM ll_inbound_plan_pallet_allocation pa " +
         "JOIN ll_inbound_plan_line al ON al.id=pa.line_id AND al.customer_id=pa.customer_id AND al.plan_id=p.plan_id " +
         "JOIN ll_inbound_fba_appointment_item fi ON fi.order_id=al.order_id AND fi.customer_id=al.customer_id " +
         "JOIN ll_inbound_fba_appointment fa ON fa.id=fi.appointment_id " +
         "WHERE pa.pallet_id=p.id AND pa.customer_id=ip.customer_id AND fi.active=1 AND fa.appointment_status='SUCCESS' " +
         "AND fi.fba_warehouse_code=fa.fba_warehouse_code " +
+        "AND NOT EXISTS (SELECT 1 FROM ll_inbound_fba_appointment_item other_batch " +
+        "WHERE other_batch.order_id=fi.order_id AND other_batch.customer_id=fi.customer_id AND other_batch.active=1 AND other_batch.appointment_id!=fi.appointment_id) " +
         "AND fa.fba_warehouse_code=COALESCE(NULLIF(TRIM(p.destination_warehouse_code),''),NULLIF(TRIM(al.fba_warehouse_code),'')))";
     // Billing volume weight is never a substitute for physical cargo mass.
     String SOURCE_GROSS_WEIGHT =
@@ -227,7 +229,7 @@ public interface DispatchCandidateMapper {
 
     @Select("<script>" +
         "SELECT NULL AS planId,NULL AS planPalletId,pos.pallet_id AS warehousePalletId,a.lastleg_order_id AS orderId," +
-        "a.customer_id AS customerId,NULL AS customerName,NULL AS planNo,'RELABEL_APPLICATION' AS orderType,NULL AS volumeWeightKg,NULL AS grossWeightKg,NULL AS containerNo," +
+        "a.customer_id AS customerId,NULL AS customerName,NULL AS planNo,'RELABEL_APPLICATION' AS orderType,NULL AS volumeWeightKg,MAX(wtp.gross_weight_kg) AS grossWeightKg,NULL AS containerNo," +
         "NULL AS appointmentAt,NULL AS expectedLoadingAt,a.overseas_warehouse_id AS overseasWarehouseId,MIN(ri.source_warehouse_code) AS overseasWarehouseCode,MIN(ri.source_warehouse_name) AS overseasWarehouseName," +
         "MIN(COALESCE(NULLIF(ri.source_inbound_order_no,''),NULLIF(a.customer_order_no,''),a.relabel_no)) AS orderNo,a.relabel_no AS orderRefs,MIN(ri.source_inbound_code) AS inboundCode,pos.pallet_no AS palletNo,NULL AS destinationWarehouseId," +
         "GROUP_CONCAT(DISTINCT ri.destination_fba_warehouse_code ORDER BY ri.destination_fba_warehouse_code SEPARATOR ',') AS destinationWarehouseCode," +
@@ -258,11 +260,13 @@ public interface DispatchCandidateMapper {
                                                     @Param("relabelNo") String relabelNo);
 
     @Select("<script>SELECT a.customer_id AS customerId,a.lastleg_order_id AS orderId,a.overseas_warehouse_id AS overseasWarehouseId," +
-        "MIN(ri.source_warehouse_name) AS overseasWarehouseName,a.relabel_no AS orderNo,a.relabel_no AS orderRefs," +
+        "MIN(ri.source_warehouse_name) AS overseasWarehouseName,'RETURN_RELABEL' AS orderType,a.relabel_no AS orderNo,a.relabel_no AS orderRefs," +
         "GROUP_CONCAT(DISTINCT c.source_return_no ORDER BY c.source_return_no SEPARATOR ',') AS inboundCode," +
         "c.pallet_code AS palletNo,COUNT(DISTINCT c.id) AS packageCount,'RELABEL' AS sourceStage,1 AS returnCartonSource," +
         "GROUP_CONCAT(DISTINCT c.carton_mark ORDER BY c.carton_mark SEPARATOR ',') AS relabelCartonMarks," +
         "GROUP_CONCAT(DISTINCT ri.destination_fba_warehouse_code ORDER BY ri.destination_fba_warehouse_code SEPARATOR ',') AS fbaWarehouseCode," +
+        "COALESCE((SELECT CASE WHEN COUNT(*)=COUNT(x.weight) THEN SUM(x.weight) END FROM (SELECT DISTINCT c2.id,c2.weight FROM ll_return_inventory_carton c2 JOIN ll_relabel_item ri2 ON ri2.return_carton_id=c2.id AND ri2.customer_id=c2.customer_id JOIN ll_relabel_application a2 ON a2.id=ri2.application_id AND a2.customer_id=ri2.customer_id WHERE c2.customer_id=a.customer_id AND c2.pallet_code=c.pallet_code AND c2.status='RELABEL_PENDING' AND a2.id=a.id) x),(SELECT rr.weight FROM ll_return_receipt rr WHERE rr.customer_id=a.customer_id AND rr.unit_type='PALLET' AND rr.unit_code=c.pallet_code ORDER BY rr.signed_at DESC LIMIT 1)) AS grossWeightKg," +
+        "COALESCE((SELECT CASE WHEN COUNT(*)=COUNT(x.volume) THEN SUM(x.volume) END FROM (SELECT DISTINCT c2.id,(c2.length*c2.width*c2.height)/1000000 AS volume FROM ll_return_inventory_carton c2 JOIN ll_relabel_item ri2 ON ri2.return_carton_id=c2.id AND ri2.customer_id=c2.customer_id JOIN ll_relabel_application a2 ON a2.id=ri2.application_id AND a2.customer_id=ri2.customer_id WHERE c2.customer_id=a.customer_id AND c2.pallet_code=c.pallet_code AND c2.status='RELABEL_PENDING' AND a2.id=a.id) x),(SELECT rr.length*rr.width*rr.height/1000000 FROM ll_return_receipt rr WHERE rr.customer_id=a.customer_id AND rr.unit_type='PALLET' AND rr.unit_code=c.pallet_code ORDER BY rr.signed_at DESC LIMIT 1)) AS volumeCbm," +
         "GROUP_CONCAT(DISTINCT ri.destination_fba_warehouse_code ORDER BY ri.destination_fba_warehouse_code SEPARATOR ',') AS destinationWarehouseCode " +
         "FROM ll_relabel_application a JOIN ll_relabel_item ri ON ri.application_id=a.id AND ri.customer_id=a.customer_id " +
         "JOIN ll_return_inventory_carton c ON c.id=ri.return_carton_id AND c.customer_id=a.customer_id " +
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/dispatch/service/DispatchService.java b/lastleg-service/src/main/java/com/baiyue/lastleg/dispatch/service/DispatchService.java
index 0ce8e808d..9a6667969 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/dispatch/service/DispatchService.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/dispatch/service/DispatchService.java
@@ -52,6 +52,8 @@ import java.util.stream.Collectors;
 
 @Service
 public class DispatchService {
+    @Resource private com.baiyue.lastleg.appointmentwork.AppointmentWorkDispatchPort appointmentAllocations;
+    @Resource private com.baiyue.lastleg.appointmentwork.AppointmentWorkChanges workChanges;
     public static final String PENDING_DEPARTURE = "PENDING_DEPARTURE";
     public static final String CANCELLED = "CANCELLED";
 
@@ -79,6 +81,22 @@ public class DispatchService {
     @Resource private RelabelApplicationMapper relabelApplications;
     @Resource private com.baiyue.lastleg.relabel.service.RelabelBindingGuard relabelBindingGuard;
     @Resource private ReturnRelabelDispatchStock returnRelabelStock;
+    @Resource private com.baiyue.lastleg.relabel.service.RelabelPalletMeasurementService relabelMeasurements;
+
+    private List<DispatchPalletCandidate> measuredRelabelCandidates(List<DispatchPalletCandidate> rows) {
+        var cache = new java.util.HashMap<String, List<com.baiyue.lastleg.relabel.service.RelabelPalletMeasurementService.Measurement>>();
+        for (var row : rows) {
+            var values = cache.computeIfAbsent(row.customerId() + ":" + row.orderRefs(), ignored -> {
+                var app = relabelApplications.findAnyByRelabelNo(row.orderRefs());
+                return app != null && Objects.equals(app.getCustomerId(), row.customerId()) ? relabelMeasurements.snapshots(app) : List.of();
+            });
+            if (!values.isEmpty()) {
+                var p = values.stream().filter(value -> Objects.equals(value.palletId(), row.warehousePalletId())).findFirst().orElse(null);
+                row.grossWeightKg(p == null ? null : p.grossWeightKg()); row.volumeCbm(p == null ? null : p.volumeCbm());
+            }
+        }
+        return rows;
+    }
 
     public String resolveCustomerScopeForPlans(List<Long> planIds) {
         return requireSingleCustomerScope(candidates.findCustomerScopesByPlanIds(normalizeIds(planIds, "Plan IDs")),
@@ -99,7 +117,7 @@ public class DispatchService {
             throw new ResponseStatusException(HttpStatus.CONFLICT, "换标尚未完成或客户尚未确认，无法进行排车");
         }
         if (!"TRUCK".equals(application.getDeliveryMethod())) {
-            throw new ResponseStatusException(HttpStatus.CONFLICT, "该换标单不是卡车派送，无需进行排车");
+            throw new ResponseStatusException(HttpStatus.CONFLICT, "只有平台卡车派送的换标单可以排车");
         }
         return application.getCustomerId();
     }
@@ -124,7 +142,7 @@ public class DispatchService {
             trimToNull(sourceStage), trimToNull(draftToken));
         if (!StringUtils.hasText(sourceStage) || Set.of("RECEIVED", "RELABEL").contains(sourceStage)) {
             List<DispatchPalletCandidate> relabel = java.util.stream.Stream.concat(
-                candidates.relabelAvailable(null, trimToNull(orderNo), null).stream(),
+                measuredRelabelCandidates(candidates.relabelAvailable(null, trimToNull(orderNo), null)).stream(),
                 returnRelabelStock.candidates(null, trimToNull(orderNo), null).stream()).toList();
             if (relabel != null && !relabel.isEmpty()) {
                 result = java.util.stream.Stream.concat(result.stream(), relabel.stream().filter(item ->
@@ -189,7 +207,12 @@ public class DispatchService {
         DispatchDraft draft = ensureDraft(operatorId, request.draftToken());
         DispatchDraftContainer boundContainer = request.draftContainerId() == null ? null : draftContainers.selectById(request.draftContainerId());
         if (boundContainer == null && request.draftContainerId() == null) {
-            boundContainer = new DispatchDraftContainer(); boundContainer.setId(IdWorker.getId()); boundContainer.setDraftId(draft.getId()); boundContainer.setDraftToken(request.draftToken()); boundContainer.setSequenceNo(1); boundContainer.setCapacity(500); boundContainer.setCreatedAt(LocalDateTime.now()); boundContainer.setUpdatedAt(LocalDateTime.now()); draftContainers.insert(boundContainer);
+            var existing = draftContainers.findByToken(request.draftToken());
+            if (existing.size() > 1) throw new ResponseStatusException(HttpStatus.BAD_REQUEST, "存在多个装车分组，请明确选择目标分组");
+            if (existing.size() == 1) boundContainer = existing.get(0);
+            else {
+                boundContainer = new DispatchDraftContainer(); boundContainer.setId(IdWorker.getId()); boundContainer.setDraftId(draft.getId()); boundContainer.setDraftToken(request.draftToken()); boundContainer.setSequenceNo(1); boundContainer.setCapacity(30); boundContainer.setCreatedAt(LocalDateTime.now()); boundContainer.setUpdatedAt(LocalDateTime.now()); draftContainers.insert(boundContainer);
+            }
         }
         if (boundContainer == null || !request.draftToken().equals(boundContainer.getDraftToken()) || !Objects.equals(boundContainer.getDraftId(), draft.getId())) throw new ResponseStatusException(HttpStatus.BAD_REQUEST, "装车托盘不存在");
         DispatchPalletCandidate candidate = requireDraftSource(customerId, request);
@@ -201,7 +224,11 @@ public class DispatchService {
         }
         if (active != null) {
             if (request.draftToken().equals(active.getDraftToken())
-                && Objects.equals(trimToNull(operatorId), active.getOperatorId())) return;
+                && Objects.equals(trimToNull(operatorId), active.getOperatorId())) {
+                if (!Objects.equals(boundContainer.getId(), active.getDraftContainerId()))
+                    throw new ResponseStatusException(HttpStatus.CONFLICT, "托盘已锁定到其他装车分组，请先移除后重新选择");
+                return;
+            }
             throw new ResponseStatusException(HttpStatus.CONFLICT,
                 "Pallet is already locked by another dispatch draft: " + candidate.palletNo());
         }
@@ -217,7 +244,7 @@ public class DispatchService {
         lock.setReturnReceiptId(candidate.returnReceiptId());
         lock.setWarehousePalletId(candidate.warehousePalletId());
         lock.setDraftToken(request.draftToken());
-        lock.setDraftContainerId(request.draftContainerId());
+        lock.setDraftContainerId(boundContainer.getId());
         lock.setOperatorId(trimToNull(operatorId));
         lock.setStatus("ACTIVE");
         lock.setLockedAt(now);
@@ -308,7 +335,9 @@ public class DispatchService {
             actualGroups.add(container.getId());
             var group = groups.get(container.getId());
             if (group == null) throw new ResponseStatusException(HttpStatus.CONFLICT, "草稿分组已变化，请重新加载");
-            if (container.getCapacity() == null || bound.size() > container.getCapacity())
+            if (container.getCapacity() == null || !Set.of(15, 30).contains(container.getCapacity()))
+                throw new ResponseStatusException(HttpStatus.CONFLICT, "车辆大小仅支持15托或30托");
+            if (bound.size() > container.getCapacity())
                 throw new ResponseStatusException(HttpStatus.CONFLICT, "装车分组超过车型托位容量");
             Set<String> actual = new HashSet<>();
             Set<String> customers = new HashSet<>();
@@ -334,7 +363,7 @@ public class DispatchService {
         var results = new java.util.ArrayList<com.baiyue.lastleg.dispatch.dto.DispatchDraftGroupResult>();
         for (var group : prepared) {
             var command = new DispatchRequests.PreArrange(group.request().planPalletIds(), null, null, null,
-                token, null, group.request().returnReceiptIds());
+                token, null, group.request().returnReceiptIds(),group.request().batchAllocations());
             var response = preArrangeContainer(group.customerId(), operatorId, command, group.containerId(), true);
             results.add(new com.baiyue.lastleg.dispatch.dto.DispatchDraftGroupResult(group.containerId(), response));
         }
@@ -359,6 +388,8 @@ public class DispatchService {
 
     private DispatchResponse preArrangeContainer(String customerId, String operatorId,
         DispatchRequests.PreArrange request, Long expectedContainerId, boolean preserveExactReplay) {
+        if(StringUtils.hasText(request.fbaAppointmentNo()) && request.batchAllocations().isEmpty())
+            throw new ResponseStatusException(HttpStatus.BAD_REQUEST,"预约关联必须提供不可变批次键及逐票实物分配，不能仅填写预约号");
         if (StringUtils.hasText(request.relabelNo())) {
             if (!request.returnReceiptIds().isEmpty()) throw new ResponseStatusException(HttpStatus.BAD_REQUEST, "换标与退回来源不能混用");
             return preArrangeRelabel(customerId, operatorId, request);
@@ -428,7 +459,7 @@ public class DispatchService {
             var existing = items.findByDispatchOrder(customerId, dispatch.getId());
             if (existing.size() == selected.size() && existing.stream().map(DispatchService::selectionKey).collect(Collectors.toSet())
                 .equals(selected.stream().map(DispatchService::selectionKey).collect(Collectors.toSet())))
-                return response(dispatch, existing);
+                { appointmentAllocations.requireReplay(customerId,dispatch.getId(),request.batchAllocations()); return response(dispatch, existing); }
         }
         if (refreshing) {
             requirePalletEditingAllowed(dispatch);
@@ -565,7 +596,9 @@ public class DispatchService {
         DispatchOrder responseOrder = preserveExactReplay
             ? Objects.requireNonNull(orders.lockById(customerId, dispatch.getId()), "Saved dispatch is missing")
             : dispatch;
-        return response(responseOrder, items.findByDispatchOrder(customerId, dispatch.getId()));
+        var assignedItems=items.findByDispatchOrder(customerId, dispatch.getId());
+        appointmentAllocations.bind(customerId,dispatch.getId(),assignedItems.stream().map(i->new com.baiyue.lastleg.appointmentwork.AppointmentWorkDispatchPort.PhysicalItem(i.getId(),i.getPlanPalletId(),i.getSourceStage(),i.getPackageCount())).toList(),request.batchAllocations());
+        return response(responseOrder, assignedItems);
     }
 
     @Transactional
@@ -574,11 +607,13 @@ public class DispatchService {
         if (application == null || !RelabelApplicationService.READY_FOR_OUTBOUND.equals(application.getStatus())) {
             throw new ResponseStatusException(HttpStatus.CONFLICT, "换标尚未完成或客户尚未确认，无法进行排车");
         }
-        relabelBindingGuard.requireBound(application);
-        if (!"TRUCK".equals(application.getDeliveryMethod()) || !"WAIT_PRE_DISPATCH".equals(application.getFulfillmentStatus()))
+        if (!"TRUCK".equals(application.getDeliveryMethod())
+            || !"WAIT_PRE_DISPATCH".equals(application.getFulfillmentStatus()))
             throw new ResponseStatusException(HttpStatus.CONFLICT, "换标单不是待排车状态");
+        relabelBindingGuard.requireBound(application);
+        relabelMeasurements.requireMeasured(application);
         List<DispatchPalletCandidate> selected = java.util.stream.Stream.concat(
-            candidates.relabelAvailable(customerId, null, request.relabelNo()).stream(),
+            measuredRelabelCandidates(candidates.relabelAvailable(customerId, null, request.relabelNo())).stream(),
             returnRelabelStock.candidates(customerId, null, request.relabelNo()).stream()).toList();
         Set<Long> requested = request.planPalletIds().stream().map(Long::valueOf).collect(Collectors.toSet());
         if (selected.stream().anyMatch(DispatchPalletCandidate::returnCartonSource)
@@ -647,9 +682,10 @@ public class DispatchService {
                 .orderByDesc(DispatchOrder::getCreatedAt));
         var workflows = acrossCustomers ? fleetWorkflow.read(page.getRecords().stream()
             .map(DispatchOrder::getDispatchNo).toList()) : java.util.Map.<String, com.baiyue.lastleg.fleet.trip.FleetDispatchWorkflowQuery.Workflow>of();
+        var appointmentReferences=appointmentAllocations.references(page.getRecords().stream().map(DispatchOrder::getId).toList());
         List<DispatchResponse> records = page.getRecords().stream()
             .map(order -> response(order, items.findByDispatchOrder(order.getCustomerId(), order.getId()),
-                List.of(), workflows.get(order.getDispatchNo()))).toList();
+                List.of(), workflows.get(order.getDispatchNo()),appointmentReferences.getOrDefault(order.getId(),List.of()))).toList();
         return new PageResult<>(records, page.getCurrent(), page.getSize(), page.getTotal(), page.getPages());
     }
 
@@ -719,6 +755,7 @@ public class DispatchService {
         LocalDateTime now = LocalDateTime.now();
         matchingLocks.forEach(lock -> releaseLock(lock, now));
         items.deleteById(item.getId());
+        appointmentAllocations.removeItem(dispatch.getId(),item.getId());
 
         List<DispatchItem> remaining = items.findByDispatchOrder(dispatch.getCustomerId(), dispatch.getId());
         dispatch.setItemCount(remaining.size());
@@ -758,6 +795,7 @@ public class DispatchService {
             throw new ResponseStatusException(HttpStatus.CONFLICT, "已生成出库单，请先取消对应出库单再取消排车");
         LocalDateTime now = LocalDateTime.now();
         dispatch.setStatus(CANCELLED);
+        workChanges.requirementsChanged();
         dispatch.setUpdatedAt(now);
         orders.updateById(dispatch);
         for (DispatchItem item : items.findByDispatchOrder(customerId, dispatch.getId())) {
@@ -800,6 +838,11 @@ public class DispatchService {
 
     private DispatchResponse response(DispatchOrder order, List<DispatchItem> itemList,
                                       List<DispatchResponse.BolLine> bolLineList, com.baiyue.lastleg.fleet.trip.FleetDispatchWorkflowQuery.Workflow workflow) {
+        return response(order,itemList,bolLineList,workflow,appointmentAllocations.references(List.of(order.getId())).getOrDefault(order.getId(),List.of()));
+    }
+    private DispatchResponse response(DispatchOrder order, List<DispatchItem> itemList,
+                                      List<DispatchResponse.BolLine> bolLineList, com.baiyue.lastleg.fleet.trip.FleetDispatchWorkflowQuery.Workflow workflow,
+                                      List<com.baiyue.lastleg.appointmentwork.AppointmentWorkDispatchPort.BatchReference> appointmentBatches) {
         String orderNos = itemList.stream().flatMap(item -> splitOrderRefs(item.getOrderRefs(), item.getOrderNo()).stream())
             .distinct().collect(Collectors.joining(","));
         return new DispatchResponse(order.getId(), order.getDispatchNo(), order.getVehiclePlate(), order.getDriverName(),
@@ -818,7 +861,7 @@ public class DispatchService {
                 item.getDestinationWarehouseCode(), item.getDestinationWarehouseName(), item.getFbaWarehouseCode(),
                 Objects.requireNonNullElse(item.getPackageCount(), 0), item.getGrossWeightKg(),
                 item.getVolumeWeightKg(), item.getVolumeCbm(), item.getSourceStage())).toList(),
-            bolLineList == null ? List.of() : bolLineList, workflow);
+            bolLineList == null ? List.of() : bolLineList, workflow,appointmentBatches);
     }
 
     private static String candidateRoute(List<DispatchPalletCandidate> selected) {
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/dto/CustomerOrderProgress.java b/lastleg-service/src/main/java/com/baiyue/lastleg/dto/CustomerOrderProgress.java
index 744a8a4cc..07564821e 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/dto/CustomerOrderProgress.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/dto/CustomerOrderProgress.java
@@ -6,7 +6,8 @@ import java.util.List;
 
 public final class CustomerOrderProgress {
     private CustomerOrderProgress() {}
-    public record Request(@NotNull @Positive Long customerId) {}
+    public record Request(@NotNull @Positive Long customerId,
+        @jakarta.validation.constraints.Size(min=1,max=200) List<@NotNull @Positive Long> orderIds) {}
     public record Source(String orderId, long packages, long scheduledPackages, long deliveringPackages) {}
     public record Progress(long orderId, String stage, boolean partial) {}
     public record Response(List<Progress> progress) {}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/dto/RelabelSubOrder.java b/lastleg-service/src/main/java/com/baiyue/lastleg/dto/RelabelSubOrder.java
index b9e4bac5e..15b22c027 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/dto/RelabelSubOrder.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/dto/RelabelSubOrder.java
@@ -4,4 +4,9 @@ import java.time.LocalDateTime;
 
 /** A relabel application keeps its own status within the received parent order. */
 public record RelabelSubOrder(Long lastlegOrderId, String relabelNo, String status,
-                             Integer quantity, LocalDateTime createdAt) { }
+                             Integer quantity, String quantityUnit, LocalDateTime createdAt) {
+    public RelabelSubOrder(Long lastlegOrderId, String relabelNo, String status,
+                           Integer quantity, LocalDateTime createdAt) {
+        this(lastlegOrderId, relabelNo, status, quantity, "件", createdAt);
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/export/LastlegExportProviderService.java b/lastleg-service/src/main/java/com/baiyue/lastleg/export/LastlegExportProviderService.java
index 53df619ac..3d3544477 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/export/LastlegExportProviderService.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/export/LastlegExportProviderService.java
@@ -16,6 +16,7 @@ import com.baiyue.lastleg.fleet.quote.FleetQuoteModels;
 import com.baiyue.lastleg.fleet.quote.FleetQuoteService;
 import com.baiyue.lastleg.fleet.reporting.TripOperationsModels;
 import com.baiyue.lastleg.fleet.reporting.TripOperationsService;
+import com.baiyue.lastleg.selfoperated.analytics.query.InventoryTurnoverExport;
 import com.fasterxml.jackson.databind.JsonNode;
 import com.fasterxml.jackson.databind.ObjectMapper;
 import jakarta.annotation.Resource;
@@ -41,6 +42,7 @@ public class LastlegExportProviderService {
     @Resource private VehicleApplicationService vehicles;
     @Resource private FleetQuoteService fleetQuotes;
     @Resource private TripOperationsService operations;
+    @Resource private InventoryTurnoverExport turnover;
     @Resource private ObjectMapper json;
     @Resource private Validator validator;
     @Value("${baiyue.security.internal-service-token}") private String signingKey;
@@ -51,15 +53,16 @@ public class LastlegExportProviderService {
         }
         if (request.taskId() == null || request.requestedBy() == null || request.dispatchVersion() < 1
                 || request.limit() < 1 || request.limit() > 200) throw invalid("导出批次参数无效");
-        List<ExportColumn> columns;
-        try { columns = LastlegExportColumns.columns(type); }
-        catch (IllegalArgumentException e) { throw invalid("不支持该导出类型"); }
         int offset = cursor(request.cursor());
         if (offset % request.limit() != 0) throw invalid("导出游标无效");
         String snapshot = signature(type, request);
         boolean first = request.snapshotToken() == null;
         if ((first && offset != 0) || (!first && !MessageDigest.isEqual(snapshot.getBytes(StandardCharsets.UTF_8),
                 request.snapshotToken().getBytes(StandardCharsets.UTF_8)))) throw invalid("导出筛选快照不匹配");
+        if (InventoryTurnoverExport.TYPE.equals(type)) return turnover.batch(request, offset, snapshot);
+        List<ExportColumn> columns;
+        try { columns = LastlegExportColumns.columns(type); }
+        catch (IllegalArgumentException e) { throw invalid("不支持该导出类型"); }
         Map<String, Object> parameters = new TreeMap<>(request.parameters() == null ? Map.of() : request.parameters());
         String customer = text(parameters.remove("customerId"));
         if (customer != null && !customer.matches("[1-9][0-9]*")) throw invalid("客户参数无效");
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/fleet/business/FleetPoolDeliveryEvidence.java b/lastleg-service/src/main/java/com/baiyue/lastleg/fleet/business/FleetPoolDeliveryEvidence.java
new file mode 100644
index 000000000..93a312062
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/fleet/business/FleetPoolDeliveryEvidence.java
@@ -0,0 +1,6 @@
+package com.baiyue.lastleg.fleet.business;
+
+/** Delivery owns source attribution, returns and full-signature proof. */
+public interface FleetPoolDeliveryEvidence {
+    boolean fullySigned(String customerId,String incomingNo,long orderId,int expectedPackages);
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/fleet/business/FleetPoolOrderBridge.java b/lastleg-service/src/main/java/com/baiyue/lastleg/fleet/business/FleetPoolOrderBridge.java
index 1cc646b23..96d7e93db 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/fleet/business/FleetPoolOrderBridge.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/fleet/business/FleetPoolOrderBridge.java
@@ -1,15 +1,12 @@
 package com.baiyue.lastleg.fleet.business;
 
 import com.baomidou.mybatisplus.core.toolkit.IdWorker;
-import com.baiyue.lastleg.fleet.trip.FleetBookingIncomingGateway;
+
 import com.baiyue.lastleg.looseboard.entity.*;
 import com.baiyue.lastleg.looseboard.mapper.*;
 import com.baiyue.lastleg.trucking.entity.*;
 import com.baiyue.lastleg.trucking.mapper.*;
-import com.baiyue.lastleg.service.LastlegOrderNoGenerator;
-import com.baiyue.lastleg.delivery.entity.DeliveryOrder;
-import com.baiyue.lastleg.delivery.mapper.DeliverySourceEvidenceMapper;
-import com.baiyue.lastleg.delivery.model.SourceDeliveryCompletionPolicy;
+
 import com.fasterxml.jackson.databind.ObjectMapper;
 import org.springframework.http.HttpStatus;
 import org.springframework.stereotype.Service;
@@ -30,13 +27,13 @@ public class FleetPoolOrderBridge {
     private final LocalLooseboardHistoryMapper looseHistory;
     private final UsTruckOrderMapper trucks;
     private final UsTruckOrderStatusHistoryMapper truckHistory;
-    private final LastlegOrderNoGenerator numbers;
+    private final FleetPoolOrderNumberGenerator numbers;
     private final ObjectMapper json;
-    private final DeliverySourceEvidenceMapper deliveryEvidence;
+    private final FleetPoolDeliveryEvidence deliveryEvidence;
     private final com.baiyue.lastleg.appointmentplanning.AppointmentSourceLinker appointmentSources;
     public FleetPoolOrderBridge(FleetPoolOrderMapper links,LocalLooseboardOrderMapper loose,
         LocalLooseboardHistoryMapper looseHistory,UsTruckOrderMapper trucks,
-        UsTruckOrderStatusHistoryMapper truckHistory,LastlegOrderNoGenerator numbers,ObjectMapper json,DeliverySourceEvidenceMapper deliveryEvidence,
+        UsTruckOrderStatusHistoryMapper truckHistory,FleetPoolOrderNumberGenerator numbers,ObjectMapper json,FleetPoolDeliveryEvidence deliveryEvidence,
         com.baiyue.lastleg.appointmentplanning.AppointmentSourceLinker appointmentSources) {
         this.links=links;this.loose=loose;this.looseHistory=looseHistory;this.trucks=trucks;
         this.truckHistory=truckHistory;this.numbers=numbers;this.json=json;this.deliveryEvidence=deliveryEvidence;
@@ -111,7 +108,7 @@ public class FleetPoolOrderBridge {
         if("WAITING_INBOUND".equals(row.getFulfillmentStage()))move(row,"RECEIVING",operator,"PDA开始实际收货 "+incomingNo,LocalDateTime.now());
     }
     @Transactional(propagation=Propagation.MANDATORY)
-    public void acceptedReceipt(long bookingId,FleetBookingIncomingGateway.Evidence evidence,int palletSpaces,String operator) {
+    public void acceptedReceipt(long bookingId,Receipt evidence,int palletSpaces,String operator) {
         var row=requiredBooking(bookingId);
         if(evidence==null||!Objects.equals(row.getIncomingNo(),evidence.incomingNo())
             ||!Objects.equals(row.getWarehouseId(),evidence.warehouseId())||!Objects.equals(row.getDestinationKey(),evidence.destinationKey())
@@ -157,33 +154,19 @@ public class FleetPoolOrderBridge {
         }
     }
     @Transactional(propagation=Propagation.MANDATORY)
-    public void signed(DeliveryOrder delivery,Map<Long,Long> actualSourcePackages,String operator,LocalDateTime at) {
-        if(delivery.getDispatchNo()==null)return;
-        for(var row:links.lockDispatch(delivery.getCustomerId(),delivery.getDispatchNo())) {
+    public void signed(SignedDelivery delivery,Map<Long,Long> actualSourcePackages,String operator,LocalDateTime at) {
+        if(delivery.dispatchNo()==null)return;
+        for(var row:links.lockDispatch(delivery.customerId(),delivery.dispatchNo())) {
             if(!actualSourcePackages.containsKey(row.getLastlegOrderId()))continue;
             if(row.getActualPackageCount()==null||actualSourcePackages.get(row.getLastlegOrderId())!=row.getActualPackageCount().longValue())throw conflict("商业单签收实际来源数量不完整");
             if("COMPLETED".equals(row.getFulfillmentStage()))continue;
             if(!"IN_TRANSIT".equals(row.getFulfillmentStage()))throw conflict("商业单须实际出库后才能签收完成");
-            if("DELIVERED".equals(delivery.getStatus())&&delivery.getSignedAt()!=null&&wholeSourceSigned(row))
-                move(row,"COMPLETED",operator,"真实全部签收 "+delivery.getDeliveryNo(),at);
+            if(delivery.delivered()&&delivery.signedAt()!=null&&wholeSourceSigned(row))
+                move(row,"COMPLETED",operator,"真实全部签收 "+delivery.deliveryNo(),at);
         }
     }
     private boolean wholeSourceSigned(FleetPoolOrderLink row) {
-        var dispatchIds=deliveryEvidence.dispatchIds(row.getCustomerId(),row.getLastlegOrderId());
-        if(dispatchIds==null||dispatchIds.isEmpty()||new HashSet<>(dispatchIds).size()!=dispatchIds.size())return false;
-        var deliveries=new ArrayList<SourceDeliveryCompletionPolicy.Delivery>();
-        var picks=new ArrayList<SourceDeliveryCompletionPolicy.Pick>();
-        var returns=new ArrayList<SourceDeliveryCompletionPolicy.Returned>();
-        for(Long dispatchId:dispatchIds) {
-            if(dispatchId==null||dispatchId<=0)return false;
-            var d=deliveryEvidence.deliveries(row.getCustomerId(),dispatchId);
-            var p=deliveryEvidence.picks(row.getCustomerId(),dispatchId);
-            var r=deliveryEvidence.returns(row.getCustomerId(),dispatchId);
-            if(d==null||d.isEmpty()||p==null||p.isEmpty()||r==null)return false;
-            deliveries.addAll(d);picks.addAll(p);returns.addAll(r);
-        }
-        return SourceDeliveryCompletionPolicy.evaluate(new SourceDeliveryCompletionPolicy.Source(row.getIncomingNo(),
-            row.getLastlegOrderId(),row.getActualPackageCount()),deliveries,picks,returns,true).fullySigned();
+        return deliveryEvidence.fullySigned(row.getCustomerId(),row.getIncomingNo(),row.getLastlegOrderId(),row.getActualPackageCount());
     }
     public Map<Long,String> businessOrderNumbers(Collection<Long> ids) {
         if(ids==null||ids.isEmpty())return Map.of();var result=new HashMap<Long,String>();
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/fleet/business/FleetPoolOrderModels.java b/lastleg-service/src/main/java/com/baiyue/lastleg/fleet/business/FleetPoolOrderModels.java
index 1d5d3aaf4..8f9938d21 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/fleet/business/FleetPoolOrderModels.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/fleet/business/FleetPoolOrderModels.java
@@ -3,6 +3,7 @@ package com.baiyue.lastleg.fleet.business;
 import java.math.BigDecimal;
 import java.time.LocalDateTime;
 import java.time.Instant;
+import java.util.List;
 
 public final class FleetPoolOrderModels {
     private FleetPoolOrderModels() { }
@@ -13,6 +14,14 @@ public final class FleetPoolOrderModels {
         BigDecimal weightKg, BigDecimal volumeCbm, String currency, String contactName, String contactPhone,
         String remark) { }
     public record BusinessOrderRef(String businessType, String businessOrderNo) { }
+    /** Receiving facts needed by commercial fulfillment, independent of trip planning DTOs. */
+    public record ReceivedPallet(String warehousePalletId,int packages) { }
+    public record Receipt(String incomingNo,String warehouseId,String destinationKey,String status,
+        List<ReceivedPallet> pallets,int receivedPackages) {
+        public Receipt { pallets=List.copyOf(pallets); }
+    }
+    public record SignedDelivery(String customerId,String dispatchNo,String deliveryNo,
+        boolean delivered,LocalDateTime signedAt) { }
     public record OrderKey(String customerId, String businessType, long businessOrderId) { }
     public record Arrangement(String sourceType, String businessType, String businessOrderNo, String bookingNo,
         String tripNo, Instant plannedDepartureAt, String originWarehouseName, String destinationLabel,
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/fleet/business/FleetPoolOrderNumberGenerator.java b/lastleg-service/src/main/java/com/baiyue/lastleg/fleet/business/FleetPoolOrderNumberGenerator.java
new file mode 100644
index 000000000..894686ddb
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/fleet/business/FleetPoolOrderNumberGenerator.java
@@ -0,0 +1,23 @@
+package com.baiyue.lastleg.fleet.business;
+
+import org.springframework.stereotype.Component;
+import java.time.LocalDate;
+import java.time.format.DateTimeFormatter;
+import java.util.Locale;
+import java.util.regex.Pattern;
+
+/** Commercial pool orders own LB/TR numbering; no tail-leg order sequence is consumed. */
+@Component
+public class FleetPoolOrderNumberGenerator {
+    private static final Pattern LOCATION=Pattern.compile("LAX|ONT|NYC|JFK|LGB|EWR|SFO|SEA|DFW|ORD|ATL|MIA|PHX|LAS|YYZ|YVR|AMS|LHR|FRA|CDG|HKG|NRT|SYD");
+    public String next(String businessType,String destination,long uniqueId){
+        String prefix=switch(businessType){case "TRUCK"->"TR";case "LOOSEBOARD"->"LB";default->throw new IllegalArgumentException("Unsupported pool business type");};
+        return prefix+"-"+location(destination)+"-"+LocalDate.now().format(DateTimeFormatter.BASIC_ISO_DATE)
+            +"-"+String.format(Locale.ROOT,"%06d",Math.floorMod(uniqueId,1_000_000));
+    }
+    private static String location(String value){
+        String code=value==null?"":value.trim().toUpperCase(Locale.ROOT);var match=LOCATION.matcher(code);
+        if(Pattern.matches(".*("+LOCATION.pattern()+").*",code)&&match.find())return match.group();
+        return code.matches("[A-Z0-9]{2,8}")?code:"WH";
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/fleet/trip/FleetBookingService.java b/lastleg-service/src/main/java/com/baiyue/lastleg/fleet/trip/FleetBookingService.java
index 01e8144a0..154c15bd2 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/fleet/trip/FleetBookingService.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/fleet/trip/FleetBookingService.java
@@ -1,4 +1,6 @@
 package com.baiyue.lastleg.fleet.trip;
+import com.baiyue.lastleg.fleet.business.FleetPoolOrderModels.Receipt;
+import com.baiyue.lastleg.fleet.business.FleetPoolOrderModels.ReceivedPallet;
 
 import com.baomidou.mybatisplus.core.toolkit.IdWorker;
 import com.baiyue.lastleg.fleet.customer.FleetCustomerDirectory;
@@ -168,7 +170,10 @@ public class FleetBookingService {
         if(!"READY_FOR_DISPATCH".equals(confirmed.status())||!Objects.equals(confirmed.receiptHash(),evidence.receiptHash()))throw conflict("来货实收确认未完成或内容发生变化，请重新核对");
         row.setReceiptJson(write(new FleetBookingModels.AcceptedReceipt(confirmed,java.util.List.copyOf(request.pallets()),operator,java.time.Instant.now())));
         row.setStatus("RECEIVED");row.setReceiptKey(request.idempotencyKey());row.setReceiptHash(hash);
-        if(row.getOfferId()!=null)poolOrders.acceptedReceipt(row.getId(),confirmed,totalSpaces,operator);
+        if(row.getOfferId()!=null)poolOrders.acceptedReceipt(row.getId(),new Receipt(
+            confirmed.incomingNo(),confirmed.warehouseId(),confirmed.destinationKey(),confirmed.status(),
+            confirmed.pallets().stream().map(p->new ReceivedPallet(p.warehousePalletId(),p.packages())).toList(),
+            confirmed.receivedPackages()),totalSpaces,operator);
         save(trip,row,operator,"BOOKING_RECEIPT","确认外接实收货量及约定运费 "+row.getBookingNo());return result(trip,row,false);
     }
     @Transactional
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/fleet/trip/FleetDispatchGateway.java b/lastleg-service/src/main/java/com/baiyue/lastleg/fleet/trip/FleetDispatchGateway.java
index efcacaa39..5891cafe9 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/fleet/trip/FleetDispatchGateway.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/fleet/trip/FleetDispatchGateway.java
@@ -21,10 +21,25 @@ public interface FleetDispatchGateway {
     Snapshot lockForPlanning(String dispatchNo);
     /** Allows pre-departure resource/time changes without changing cargo or recorded picking. */
     Snapshot lockForAssignment(String dispatchNo);
+    /** Original dispatch command; caller must first detach the dispatch from its vehicle. */
+    void removeItem(String dispatchNo,long itemId);
     /** Caller holds the dispatch lock for the entire transaction, including downstream snapshots. */
     void assign(Snapshot dispatch, Assignment assignment);
     FleetExecutionModels.Manifest manifest(String dispatchNo, boolean lock);
     FleetCompletionModels.DispatchCompletion completion(String dispatchNo, boolean lock);
+    record ReturnedReceipt(String itemId,String palletId,int packages,Instant receivedAt) { }
+    record TerminalDelivery(String customerId,String deliveryNo,String destinationKey,int packages,
+                            Instant terminalAt,String status,long recordVersion,java.util.List<ReturnedReceipt> receipts) { }
+    record TerminalEvidence(String dispatchNo,String customerId,String warehouseId,int shippedPackages,
+                            java.util.List<TerminalDelivery> deliveries) { }
+    /** Narrow execution facts for appointment eligibility, derived from the original verified evidence. */
+    default TerminalEvidence terminalEvidence(String dispatchNo,boolean lock) {
+        var evidence=transitEvidence(dispatchNo,lock);
+        return new TerminalEvidence(evidence.dispatchNo(),evidence.customerId(),evidence.warehouseId(),evidence.shippedPackages(),
+            evidence.deliveries().stream().map(d->new TerminalDelivery(d.cargo().customerId(),d.cargo().deliveryNo(),
+                d.cargo().destinationKey(),d.cargo().packages(),d.cargo().terminalAt(),d.status(),d.recordVersion(),
+                d.cargo().returnedCargo().stream().map(r->new ReturnedReceipt(r.itemId(),r.palletId(),r.packages(),r.receivedAt())).toList())).toList());
+    }
     /** Actual departure/terminal evidence for an in-transit handover; does not replay departure. */
     com.baiyue.lastleg.fleet.exception.FleetTransitEvidence transitEvidence(String dispatchNo, boolean lock);
     /** Updates only unfinished delivery resource snapshots; departure and financial facts stay immutable. */
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/fleet/trip/FleetTripExecutionService.java b/lastleg-service/src/main/java/com/baiyue/lastleg/fleet/trip/FleetTripExecutionService.java
index ad64c030a..39481891c 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/fleet/trip/FleetTripExecutionService.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/fleet/trip/FleetTripExecutionService.java
@@ -23,6 +23,7 @@ import java.util.*;
 
 @Service
 public class FleetTripExecutionService {
+    @jakarta.annotation.Resource private com.baiyue.lastleg.appointmentwork.AppointmentWorkDispatchPort appointmentAllocations;
     private final FleetTripMapper trips;
     private final FleetTripDispatchMapper bindings;
     private final FleetResourceMapper resources;
@@ -149,6 +150,10 @@ public class FleetTripExecutionService {
         String warning = null;
         if (reason == null) reason = loadBlockReason(trip, cargo(manifest));
         if (reason == null) reason = loadingReviewBlockReason(trip);
+        if (reason == null) for (var member : bindings.listByTrip(trip.getId())) {
+            reason = appointmentAllocations.departureBlockReason(member.getDispatchNo());
+            if (reason != null) break;
+        }
         if (reason == null) {
             var driver = drivers.detail(trip.getDriverId(), trip.getExpectedDriverEndAt().toInstant(ZoneOffset.UTC));
             if (!driver.qualification().canDispatch()) reason = "司机资格不满足本次任务，请在平台核对";
@@ -228,6 +233,7 @@ public class FleetTripExecutionService {
         if (reason == null) reason = loadingReviewBlockReason(trip);
         if (reason != null) throw conflict(reason);
         // Store the same precision in DATETIME(3), the immutable DEPART snapshot and replay result.
+        for(var member:members) appointmentAllocations.requireDeparture(member.getDispatchNo());
         Instant now = Instant.now().truncatedTo(java.time.temporal.ChronoUnit.MILLIS);
         trip.setStatus("DEPARTING");
         if (trips.updateById(trip) != 1) throw conflict("车次状态已变化");
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/fleet/trip/FleetTripHistoryMapper.java b/lastleg-service/src/main/java/com/baiyue/lastleg/fleet/trip/FleetTripHistoryMapper.java
index 0e6603e89..674800343 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/fleet/trip/FleetTripHistoryMapper.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/fleet/trip/FleetTripHistoryMapper.java
@@ -2,6 +2,11 @@ package com.baiyue.lastleg.fleet.trip;
 
 import com.baomidou.mybatisplus.core.mapper.BaseMapper;
 import org.apache.ibatis.annotations.Mapper;
+import org.apache.ibatis.annotations.Select;
+import org.apache.ibatis.annotations.Param;
 
 @Mapper
-public interface FleetTripHistoryMapper extends BaseMapper<FleetTripHistory> { }
+public interface FleetTripHistoryMapper extends BaseMapper<FleetTripHistory> {
+    @Select("SELECT * FROM ll_fleet_trip_history WHERE trip_id=#{tripId} AND action='BIND_DISPATCH' ORDER BY record_version DESC LIMIT 1001")
+    java.util.List<FleetTripHistory> bindingHistory(@Param("tripId") long tripId);
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/fleet/trip/FleetTripMapper.java b/lastleg-service/src/main/java/com/baiyue/lastleg/fleet/trip/FleetTripMapper.java
index f9cf3a49d..01617e259 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/fleet/trip/FleetTripMapper.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/fleet/trip/FleetTripMapper.java
@@ -7,7 +7,14 @@ import org.apache.ibatis.annotations.Select;
 
 @Mapper
 public interface FleetTripMapper extends BaseMapper<FleetTripEntity> {
-    @Select("SELECT trip_no,status,warehouse_id,warehouse_code,warehouse_name,planned_departure_at,expected_driver_end_at,departed_at,completed_at,stops_json FROM ll_fleet_trip WHERE planned_departure_at>=#{from} AND planned_departure_at<#{to} ORDER BY planned_departure_at,trip_no LIMIT 2001")
+    @Select("""
+        SELECT trip_no,status,warehouse_id,warehouse_code,warehouse_name,planned_departure_at,
+          expected_driver_end_at,departed_at,completed_at,stops_json
+        FROM ll_fleet_trip
+        WHERE (departed_at IS NOT NULL AND departed_at>=#{from} AND departed_at<#{to})
+           OR (departed_at IS NULL AND planned_departure_at>=#{from} AND planned_departure_at<#{to})
+        ORDER BY COALESCE(departed_at,planned_departure_at),trip_no LIMIT 2001
+        """)
     java.util.List<FleetTripEntity> calendar(@Param("from") java.time.LocalDateTime from,@Param("to") java.time.LocalDateTime to);
     @Select("SELECT * FROM ll_fleet_trip WHERE trip_no=#{tripNo} FOR UPDATE")
     FleetTripEntity lockByNo(@Param("tripNo") String tripNo);
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/fleet/trip/FleetTripModels.java b/lastleg-service/src/main/java/com/baiyue/lastleg/fleet/trip/FleetTripModels.java
index 0d59736d0..1c036eab9 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/fleet/trip/FleetTripModels.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/fleet/trip/FleetTripModels.java
@@ -31,14 +31,19 @@ public final class FleetTripModels {
     public record ReviewState(String status, String reason, String reviewerId, Instant reviewedAt, Long recordVersion) {
         public static ReviewState pending() { return new ReviewState("PENDING", null, null, null, null); }
     }
-    public record DispatchBinding(String dispatchNo, String customerId, int packageCount, String boundBy, Instant boundAt, ReviewState review) { }
+    public record DispatchBinding(String dispatchNo, String customerId, int packageCount, String boundBy, Instant boundAt, ReviewState review,
+                                  List<com.baiyue.lastleg.appointmentwork.AppointmentWorkDispatchPort.BatchReference> appointmentBatches) { }
+    /** Original bound references only; these quantities never authorize current allocation. */
+    public record PreviousDispatch(String dispatchNo,String customerId,long recordVersion,Instant recordedAt,
+                                   List<com.baiyue.lastleg.appointmentwork.AppointmentWorkDispatchPort.BatchReference> appointmentBatches) { }
     public record Response(String tripNo, String status, String warehouseId, String warehouseCode, String warehouseName,
                            String vehicleId, String vehiclePlate, String driverId, String driverName, String driverPhone,
                            Integer maxPalletSpaces, BigDecimal maxLoadKg, BigDecimal maxVolumeCbm,
                            Instant plannedDepartureAt, Instant expectedDriverEndAt, Instant departedAt, Instant completedAt,
                            List<Stop> stops, String remark, long recordVersion, Instant updatedAt,
                            FleetCompletionModels.ReleaseInfo vehicleRelease, FleetCompletionModels.ReleaseInfo driverRelease) { }
-    public record Detail(Response trip, DriverQualificationPolicy.Qualification driverQualification, List<DispatchBinding> dispatches, ReviewState loadingReview) { }
+    public record Detail(Response trip, DriverQualificationPolicy.Qualification driverQualification, List<DispatchBinding> dispatches, ReviewState loadingReview,
+                         List<PreviousDispatch> previousDispatches,String appointmentHistoryUnavailableReason) { }
     public record AuditSnapshot(Response trip, List<DispatchBinding> dispatches, FleetExecutionModels.ConfirmedLoad confirmedLoad,
                                 FleetCompletionModels.Completed completion, ReviewState loadingReview,
                                 FleetExecutionModels.PlannedLoad capacityPlan, List<FleetBookingModels.Response> externalBookings) { }
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/fleet/trip/FleetTripService.java b/lastleg-service/src/main/java/com/baiyue/lastleg/fleet/trip/FleetTripService.java
index 00df73c67..967680592 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/fleet/trip/FleetTripService.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/fleet/trip/FleetTripService.java
@@ -27,6 +27,8 @@ import java.util.*;
 
 @Service
 public class FleetTripService {
+    @jakarta.annotation.Resource private com.baiyue.lastleg.fleet.trip.work.AppointmentWorkTripChanges workChanges;
+    @jakarta.annotation.Resource private com.baiyue.lastleg.appointmentwork.AppointmentWorkDispatchPort appointmentAllocations;
     private final FleetTripMapper trips;
     private final FleetResourceMapper resources;
     private final FleetTripHistoryMapper histories;
@@ -133,7 +135,9 @@ public class FleetTripService {
             dispatches.assign(dispatch, assignment(trip));
         }
         persist(trip, request.recordVersion(), "ASSIGN", request.reason(), operator);
-        return new FleetTripModels.Detail(response(trip), driver.qualification(), bindingResponses(trip), FleetTripReview.read(json, trip.getLoadingReviewJson()));
+        var currentBindings=bindingResponses(trip);
+        var history=previousDispatches(trip,currentBindings);
+        return new FleetTripModels.Detail(response(trip), driver.qualification(), currentBindings, FleetTripReview.read(json, trip.getLoadingReviewJson()),history.dispatches(),history.unavailableReason());
     }
 
     @Transactional
@@ -205,6 +209,7 @@ public class FleetTripService {
         requireReason(request.reason());
         if (trip.getVehicleId() == null || trip.getDriverId() == null) throw conflict("请先分配车辆和司机");
         var dispatch = dispatches.lockForPlanning(request.dispatchNo().trim());
+        appointmentAllocations.requireTripBinding(dispatch.dispatchNo(),trip.getId());
         if (!trip.getWarehouseId().toString().equals(dispatch.warehouseId())) throw bad("排车单与车次必须使用同一起运仓");
         var bound = bindings.lockByDispatch(dispatch.dispatchId());
         if (bound != null) throw conflict("排车单已关联车次 " + bound.getTripNo());
@@ -299,12 +304,43 @@ public class FleetTripService {
         return detail(trip);
     }
     private FleetTripModels.Detail detail(FleetTripEntity trip) {
+        var currentBindings=bindingResponses(trip);
+        var history=previousDispatches(trip,currentBindings);
         return new FleetTripModels.Detail(response(trip), trip.getDriverId() == null ? null
-            : drivers.detail(trip.getDriverId(), instant(trip.getExpectedDriverEndAt())).qualification(), bindingResponses(trip), FleetTripReview.read(json, trip.getLoadingReviewJson()));
+            : drivers.detail(trip.getDriverId(), instant(trip.getExpectedDriverEndAt())).qualification(), currentBindings, FleetTripReview.read(json, trip.getLoadingReviewJson()),history.dispatches(),history.unavailableReason());
     }
     private List<FleetTripModels.DispatchBinding> bindingResponses(FleetTripEntity trip) {
-        return bindings.listByTrip(trip.getId()).stream().map(binding -> new FleetTripModels.DispatchBinding(binding.getDispatchNo(),
-            binding.getCustomerId(), binding.getPackageCount(), binding.getBoundBy(), instant(binding.getBoundAt()), FleetTripReview.read(json, binding.getReviewJson()))).toList();
+        var current=bindings.listByTrip(trip.getId());
+        var references=appointmentAllocations.references(current.stream().map(FleetTripDispatch::getDispatchId).toList());
+        return current.stream().map(binding -> new FleetTripModels.DispatchBinding(binding.getDispatchNo(),
+            binding.getCustomerId(), binding.getPackageCount(), binding.getBoundBy(), instant(binding.getBoundAt()), FleetTripReview.read(json, binding.getReviewJson()),references.getOrDefault(binding.getDispatchId(),List.of()))).toList();
+    }
+    private record AppointmentHistory(List<FleetTripModels.PreviousDispatch> dispatches,String unavailableReason) { }
+    private AppointmentHistory previousDispatches(FleetTripEntity trip,List<FleetTripModels.DispatchBinding> current) {
+        var history=histories.bindingHistory(trip.getId());
+        if(history.size()>1000) return new AppointmentHistory(List.of(),"原车绑定历史超过完整读取上限，请分页核对车次历史");
+        String unavailableReason=null;
+        var seen=new HashSet<List<String>>();
+        current.forEach(binding->binding.appointmentBatches().forEach(batch->batch.sources().forEach(source->seen.add(referenceKey(batch,source)))));
+        var previous=new ArrayList<FleetTripModels.PreviousDispatch>();
+        for(var event:history) {
+            var snapshot=read(event.getSnapshotJson(),FleetTripModels.AuditSnapshot.class);
+            if(snapshot.dispatches()==null) { unavailableReason="原车历史缺少批次来源依据，已移出客户的历史追踪不完整";continue; }
+            for(var binding:snapshot.dispatches()) {
+                if(binding.appointmentBatches()==null) { unavailableReason="原车历史缺少批次来源依据，已移出客户的历史追踪不完整";continue; }
+                var references=new ArrayList<com.baiyue.lastleg.appointmentwork.AppointmentWorkDispatchPort.BatchReference>();
+                for(var batch:binding.appointmentBatches()) {
+                    var missing=batch.sources().stream().filter(source->seen.add(referenceKey(batch,source))).toList();
+                    if(!missing.isEmpty()) references.add(new com.baiyue.lastleg.appointmentwork.AppointmentWorkDispatchPort.BatchReference(batch.batchKey(),batch.batchNo(),batch.customerId(),missing));
+                }
+                if(!references.isEmpty()) previous.add(new FleetTripModels.PreviousDispatch(binding.dispatchNo(),binding.customerId(),event.getRecordVersion(),instant(event.getOccurredAt()),List.copyOf(references)));
+            }
+        }
+        return new AppointmentHistory(List.copyOf(previous),unavailableReason);
+    }
+    private static List<String> referenceKey(com.baiyue.lastleg.appointmentwork.AppointmentWorkDispatchPort.BatchReference batch,
+                                             com.baiyue.lastleg.appointmentwork.AppointmentWorkDispatchPort.BatchSource source) {
+        return List.of(batch.batchKey(),batch.customerId(),source.sourceKey(),source.destinationKey());
     }
     private static FleetDispatchGateway.Assignment assignment(FleetTripEntity trip) {
         return new FleetDispatchGateway.Assignment(trip.getVehiclePlate(), trip.getDriverName(), trip.getDriverPhone());
@@ -339,6 +375,7 @@ public class FleetTripService {
         record(trip, action, reason, operator);
     }
     private void record(FleetTripEntity trip, String action, String reason, String operator) {
+        workChanges.changed(trip);
         var event = new FleetTripHistory(); event.setId(IdWorker.getId()); event.setTripId(trip.getId()); event.setRecordVersion(trip.getRecordVersion());
         event.setAction(action); event.setReason(trim(reason)); event.setOperatorId(operator); event.setOccurredAt(trip.getUpdatedAt());
         event.setSnapshotJson(write(new FleetTripModels.AuditSnapshot(response(trip), bindingResponses(trip), trip.getLoadJson() == null ? null
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/fleet/trip/work/AppointmentWorkSupplierDirectory.java b/lastleg-service/src/main/java/com/baiyue/lastleg/fleet/trip/work/AppointmentWorkSupplierDirectory.java
new file mode 100644
index 000000000..d673d4ad1
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/fleet/trip/work/AppointmentWorkSupplierDirectory.java
@@ -0,0 +1,26 @@
+package com.baiyue.lastleg.fleet.trip.work;
+
+import com.baiyue.lastleg.appointmentwork.AppointmentWorkFactGateway.SupplierDirectory;
+import com.baiyue.lastleg.appointmentwork.AppointmentWorkModels.*;
+import com.baiyue.lastleg.fleet.quote.FleetQuoteSupplierClient;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.stereotype.Component;
+import static com.baiyue.lastleg.appointmentwork.AppointmentWorkPolicy.*;
+
+@Component
+public class AppointmentWorkSupplierDirectory implements SupplierDirectory {
+    private final FleetQuoteSupplierClient suppliers;
+    private final String token;
+    public AppointmentWorkSupplierDirectory(FleetQuoteSupplierClient suppliers,@Value("${baiyue.security.internal-service-token:}") String token) { this.suppliers=suppliers; this.token=token; }
+    public Responsibility activeSupplier(String id) {
+        final long number;
+        try { number=Long.parseLong(id); if(number<=0 || !Long.toString(number).equals(id)) throw new NumberFormatException(); }
+        catch(RuntimeException error) { throw bad("供应商关联标识无效"); }
+        if(token==null || token.isBlank()) throw unavailable("内部服务身份未配置");
+        var response=suppliers.get(token,number,true,"TRUCKING");
+        if(response==null || !response.successful() || response.data()==null) throw unavailable("供应商权威目录读取失败");
+        var supplier=response.data();
+        if(supplier.supplierId()!=number || !"ACTIVE".equals(supplier.status()) || !"TRUCKING".equals(supplier.category()) || !"OVERSEAS".equals(supplier.truckingScope()) || supplier.name()==null || supplier.name().isBlank()) throw bad("还空责任方须为有效海外车队");
+        return new Responsibility(ResponsibilityKind.SUPPLIER,id,supplier.name());
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/fleet/trip/work/AppointmentWorkTransportProvider.java b/lastleg-service/src/main/java/com/baiyue/lastleg/fleet/trip/work/AppointmentWorkTransportProvider.java
new file mode 100644
index 000000000..2106e6080
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/fleet/trip/work/AppointmentWorkTransportProvider.java
@@ -0,0 +1,70 @@
+package com.baiyue.lastleg.fleet.trip.work;
+
+import com.baiyue.lastleg.appointmentwork.*;
+import com.baiyue.lastleg.fleet.driver.FleetWarehouseClient;
+import com.baiyue.lastleg.fleet.trip.FleetTripEntity;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.stereotype.Component;
+import java.time.*;
+import java.util.*;
+import static com.baiyue.lastleg.appointmentwork.AppointmentWorkFactGateway.*;
+import static com.baiyue.lastleg.appointmentwork.AppointmentWorkModels.*;
+import static com.baiyue.lastleg.appointmentwork.AppointmentWorkPolicy.*;
+
+@Component
+public class AppointmentWorkTransportProvider implements AppointmentWorkFactGateway.BusinessProvider {
+    private final AppointmentWorkTripMapper mapper;
+    private final FleetWarehouseClient warehouses;
+    private final AppointmentWorkCommitmentService commitments;
+    private final String token;
+    public AppointmentWorkTransportProvider(AppointmentWorkTripMapper mapper,FleetWarehouseClient warehouses,AppointmentWorkCommitmentService commitments,@Value("${baiyue.security.internal-service-token:}") String token) { this.mapper=mapper; this.warehouses=warehouses; this.commitments=commitments; this.token=token; }
+    public boolean supports(Type type,Flow flow) { return type==Type.TRANSPORT && flow==Flow.TRANSFER; }
+    public List<Fact> read(List<FactRequest> requests) { return requests.stream().map(this::read).toList(); }
+    private Fact read(FactRequest request) {
+        FleetTripEntity trip=null;
+        if(request.tripKey()!=null) {
+            try { trip=mapper.trip(Long.parseLong(request.tripKey())); }
+            catch(NumberFormatException error) { throw unavailable("车次关联键无效",error); }
+            if(trip==null) throw unavailable("已关联原车次缺失");
+        } else if(request.batchKey()!=null) {
+            var trips=mapper.batchTrips(request.batchKey());
+            if(trips.size()>1) throw conflict("同一预约批次关联多个车次，请在原业务核对分批与实物关系");
+            if(!trips.isEmpty()) trip=trips.get(0);
+        }
+        if(trip==null) {
+            var action=new Action(ActionCode.ARRANGE_TRANSPORT,"按批次选择实物并安排车次",request.workItemKey(),new TripTarget(null,request.batchKeys()));
+            return new Fact(request.workItemKey(),"UNASSIGNED","UNASSIGNED",false,PlanStatus.UNPLANNED,ExecutionStatus.PENDING,null,null,null,null,null,null,
+                List.of(ORDER_READ),List.of("platform:fleet:trip:create","platform:fleet:trip:edit"),action,
+                request.batchKey()==null?List.of("请先明确原送货批次，再按真实实物安排车次"):List.of(),List.of(),List.of(),null,"UNASSIGNED");
+        }
+        String timezone=timezone(trip.getWarehouseId());
+        var missing=timezone==null?List.of("SOURCE_TIMEZONE"):List.<String>of();
+        var target=localSlot(trip.getPlannedDepartureAt(),trip.getExpectedDriverEndAt(),timezone);
+        boolean complete="COMPLETED".equals(trip.getStatus()) && trip.getCompletedAt()!=null;
+        var occurred=complete?trip.getCompletedAt():null;
+        var actual=occurred==null?null:new Actual(occurred.toInstant(ZoneOffset.UTC),null,timezone);
+        var execution=complete?ExecutionStatus.COMPLETED:trip.getDepartedAt()!=null?ExecutionStatus.IN_PROGRESS:ExecutionStatus.PENDING;
+        var action=complete?null:new Action(ActionCode.ARRANGE_TRANSPORT,"维护原车次安排",request.workItemKey(),new TripTarget(trip.getId().toString(),mapper.batches(trip.getId())));
+        return new Fact(request.workItemKey(),"TRIP:"+trip.getId()+":"+trip.getRecordVersion(),commitments.impactToken("TRIP:"+trip.getId()),true,
+            target==null?PlanStatus.UNPLANNED:trip.getVehicleId()!=null && trip.getDriverId()!=null?PlanStatus.CONFIRMED:PlanStatus.TARGET_SET,
+            execution,target,trip.getVehicleId()!=null && trip.getDriverId()!=null?target:null,actual,timezone,trip.getTripNo(),trip.getId().toString(),
+            List.of(ORDER_READ,"platform:fleet:trip:list"),action==null?List.of():List.of("platform:fleet:trip:edit"),action,
+            "CANCELLED".equals(trip.getStatus())?List.of("车次已取消，请重新安排运输"):List.of(),missing,List.of(new BusinessReference("FLEET_TRIP",trip.getId().toString(),trip.getTripNo(),"真实车次")),null,commitments.impactToken("TRIP_PLAN:"+trip.getId()));
+    }
+    private String timezone(Long warehouse) {
+        if(warehouse==null) return null;
+        if(token==null || token.isBlank()) throw unavailable("内部服务身份未配置");
+        var response=warehouses.platformMetadata(token,new FleetWarehouseClient.MetadataRequest(List.of(warehouse)));
+        if(response==null || !response.successful() || response.data()==null || response.data().records()==null || response.data().missingIds()==null) throw unavailable("车次地点目录读取不完整");
+        var matches=response.data().records().stream().filter(w->warehouse.equals(w.id())).toList();
+        if(matches.size()>1 || matches.isEmpty() && !response.data().missingIds().contains(warehouse)) throw unavailable("车次地点目录遗漏请求结果");
+        if(matches.isEmpty() || matches.get(0).timezone()==null) return null;
+        zone(matches.get(0).timezone()); return matches.get(0).timezone();
+    }
+    private Slot localSlot(LocalDateTime start,LocalDateTime end,String timezone) {
+        // An absolute UTC plan cannot be relabelled as unknown local time.
+        if(start==null || timezone==null) return null;
+        var local=start.toInstant(ZoneOffset.UTC).atZone(zone(timezone)); var finish=end==null?null:end.toInstant(ZoneOffset.UTC).atZone(zone(timezone));
+        return new Slot(local.toLocalDate(),local.toLocalTime(),finish==null?null:finish.toLocalDate(),finish==null?null:finish.toLocalTime(),timezone);
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/fleet/trip/work/AppointmentWorkTripChanges.java b/lastleg-service/src/main/java/com/baiyue/lastleg/fleet/trip/work/AppointmentWorkTripChanges.java
new file mode 100644
index 000000000..e3337ee47
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/fleet/trip/work/AppointmentWorkTripChanges.java
@@ -0,0 +1,26 @@
+package com.baiyue.lastleg.fleet.trip.work;
+
+import com.baiyue.lastleg.appointmentwork.*;
+import com.baiyue.lastleg.fleet.trip.FleetTripEntity;
+import org.springframework.stereotype.Component;
+import java.util.Objects;
+
+@Component
+public class AppointmentWorkTripChanges {
+    private final AppointmentWorkChanges changes;
+    private final AppointmentWorkCommitmentService commitments;
+    private final AppointmentWorkTripMapper mapper;
+    public AppointmentWorkTripChanges(AppointmentWorkChanges changes,AppointmentWorkCommitmentService commitments,AppointmentWorkTripMapper mapper) { this.changes=changes; this.commitments=commitments; this.mapper=mapper; }
+    public void changed(FleetTripEntity trip) {
+        changes.requirementsChanged();
+        String assignment=trip.getVehicleId()==null && trip.getDriverId()==null?null:trip.getVehicleId()+":"+trip.getDriverId();
+        String cargo=AppointmentWorkPolicy.digest(mapper.batches(trip.getId()).stream().distinct().sorted().toList()+":"+Objects.toString(trip.getStopsJson(),""));
+        // Fleet plan storage is explicitly UTC. This is an audit baseline, not a location-time projection.
+        var start=trip.getPlannedDepartureAt(); var end=trip.getExpectedDriverEndAt();
+        var slot=start==null?null:new AppointmentWorkModels.Slot(start.toLocalDate(),start.toLocalTime(),end==null?null:end.toLocalDate(),end==null?null:end.toLocalTime(),"UTC");
+        commitments.record("TRIP:"+trip.getId(),new AppointmentWorkCommitmentService.Commitment(slot,null,assignment,cargo,"CANCELLED".equals(trip.getStatus())));
+        // Cargo/stop membership changes require this vehicle to be rechecked, but do not
+        // invalidate unchanged customers' receiving appointments. Common plan changes do.
+        commitments.record("TRIP_PLAN:"+trip.getId(),new AppointmentWorkCommitmentService.Commitment(slot,null,assignment,null,"CANCELLED".equals(trip.getStatus())));
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/fleet/trip/work/AppointmentWorkTripMapper.java b/lastleg-service/src/main/java/com/baiyue/lastleg/fleet/trip/work/AppointmentWorkTripMapper.java
new file mode 100644
index 000000000..7f4fab5a7
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/fleet/trip/work/AppointmentWorkTripMapper.java
@@ -0,0 +1,14 @@
+package com.baiyue.lastleg.fleet.trip.work;
+
+import com.baiyue.lastleg.fleet.trip.FleetTripEntity;
+import org.apache.ibatis.annotations.*;
+import java.util.List;
+
+@Mapper
+public interface AppointmentWorkTripMapper {
+    @Select("SELECT DISTINCT t.* FROM ll_dispatch_appointment_allocation a JOIN ll_dispatch_order d ON d.id=a.dispatch_id AND d.status<>'CANCELLED' JOIN ll_fleet_trip_dispatch b ON b.dispatch_id=d.id JOIN ll_fleet_trip t ON t.id=b.trip_id AND t.status<>'CANCELLED' WHERE a.batch_key=#{batch}")
+    List<FleetTripEntity> batchTrips(String batch);
+    @Select("SELECT * FROM ll_fleet_trip WHERE id=#{id}") FleetTripEntity trip(long id);
+    @Select("SELECT DISTINCT a.batch_key FROM ll_dispatch_appointment_allocation a JOIN ll_fleet_trip_dispatch b ON b.dispatch_id=a.dispatch_id JOIN ll_dispatch_order d ON d.id=a.dispatch_id AND d.status<>'CANCELLED' WHERE b.trip_id=#{id} ORDER BY a.batch_key")
+    List<String> batches(long id);
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentplanning/AppointmentSourceCreateController.java b/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/controller/AppointmentSourceCreateController.java
similarity index 60%
rename from lastleg-service/src/main/java/com/baiyue/lastleg/appointmentplanning/AppointmentSourceCreateController.java
rename to lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/controller/AppointmentSourceCreateController.java
index 05b52d95f..489e1f711 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/appointmentplanning/AppointmentSourceCreateController.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/controller/AppointmentSourceCreateController.java
@@ -1,4 +1,4 @@
-package com.baiyue.lastleg.appointmentplanning;
+package com.baiyue.lastleg.inboundplan.controller;
 
 import com.baiyue.common.core.api.ApiResponse;
 import com.baiyue.common.core.api.PageResult;
@@ -10,6 +10,8 @@ import jakarta.validation.Valid;
 import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.security.core.annotation.AuthenticationPrincipal;
 import org.springframework.web.bind.annotation.*;
+import org.springframework.http.HttpStatus;
+import org.springframework.web.server.ResponseStatusException;
 
 @RestController
 @RequestMapping("/api/platform/v1/last-leg/appointment-planning/appointments")
@@ -19,13 +21,23 @@ public class AppointmentSourceCreateController {
     @PostMapping
     @PreAuthorize("hasAuthority('platform:appointment:list') and hasAuthority('platform:overseas-warehouse:last-mile-order:list') and hasAuthority('"+OverseasPermissions.INBOUND_ORDER_FBA_APPOINTMENT+"')")
     public ApiResponse<FbaAppointmentResponse> create(@AuthenticationPrincipal AuthenticatedUser user,@Valid @RequestBody SourceFbaAppointmentRequest request) {
-        AppointmentPlanningController.requirePlatform(user);
+        requirePlatform(user);
         return ApiResponse.success(service.createFromSources(String.valueOf(user.userId()),request));
     }
+    @PostMapping("/repartition")
+    @PreAuthorize("hasAuthority('platform:appointment:list') and hasAuthority('platform:overseas-warehouse:last-mile-order:list') and hasAuthority('"+OverseasPermissions.INBOUND_ORDER_FBA_APPOINTMENT+"')")
+    public ApiResponse<RepartitionFbaAppointmentsResponse> repartition(@AuthenticationPrincipal AuthenticatedUser user,@Valid @RequestBody RepartitionFbaAppointmentsRequest request) {
+        requirePlatform(user);
+        return ApiResponse.success(service.repartition(String.valueOf(user.userId()),request));
+    }
     @GetMapping("/unscheduled")
     @PreAuthorize("hasAuthority('platform:appointment:list')")
     public ApiResponse<PageResult<FbaAppointmentResponse>> unscheduled(@AuthenticationPrincipal AuthenticatedUser user,@RequestParam(defaultValue="1") int page,@RequestParam(defaultValue="20") int size) {
-        AppointmentPlanningController.requirePlatform(user);
+        requirePlatform(user);
         return ApiResponse.success(service.unscheduled(page,size));
     }
+    private static void requirePlatform(AuthenticatedUser user) {
+        if (user == null || user.userId()==null) throw new ResponseStatusException(HttpStatus.UNAUTHORIZED);
+        if (!"PLATFORM".equals(user.appCode()) || !Long.valueOf(0).equals(user.tenantId())) throw new ResponseStatusException(HttpStatus.FORBIDDEN);
+    }
 }
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/controller/FbaAppointmentBatchController.java b/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/controller/FbaAppointmentBatchController.java
new file mode 100644
index 000000000..f9685d71c
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/controller/FbaAppointmentBatchController.java
@@ -0,0 +1,26 @@
+package com.baiyue.lastleg.inboundplan.controller;
+
+import com.baiyue.common.core.api.ApiResponse;
+import com.baiyue.common.security.AuthenticatedUser;
+import com.baiyue.lastleg.inboundplan.dto.FbaAppointmentBatchContext;
+import com.baiyue.lastleg.inboundplan.service.InboundFbaAppointmentService;
+import org.springframework.http.HttpStatus;
+import org.springframework.security.access.prepost.PreAuthorize;
+import org.springframework.security.core.annotation.AuthenticationPrincipal;
+import org.springframework.web.bind.annotation.*;
+import org.springframework.web.server.ResponseStatusException;
+
+@RestController
+@RequestMapping("/api/platform/v1/last-leg/appointment-planning/batches")
+public class FbaAppointmentBatchController {
+    private final InboundFbaAppointmentService service;
+    public FbaAppointmentBatchController(InboundFbaAppointmentService service) {this.service=service;}
+
+    @GetMapping("/{batchKey}")
+    @PreAuthorize("hasAuthority('platform:appointment:list') and hasAuthority('platform:overseas-warehouse:last-mile-order:list')")
+    public ApiResponse<FbaAppointmentBatchContext> detail(@AuthenticationPrincipal AuthenticatedUser user,@PathVariable String batchKey) {
+        if(user==null || user.userId()==null) throw new ResponseStatusException(HttpStatus.UNAUTHORIZED);
+        if(!"PLATFORM".equals(user.appCode()) || !Long.valueOf(0).equals(user.tenantId())) throw new ResponseStatusException(HttpStatus.FORBIDDEN);
+        return ApiResponse.success(service.batchContext(batchKey));
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/dto/FbaAppointmentBatchContext.java b/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/dto/FbaAppointmentBatchContext.java
new file mode 100644
index 000000000..071767d88
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/dto/FbaAppointmentBatchContext.java
@@ -0,0 +1,12 @@
+package com.baiyue.lastleg.inboundplan.dto;
+
+import java.util.List;
+
+public record FbaAppointmentBatchContext(FbaAppointmentResponse appointment,List<SourceAllocation> sources,
+                                        List<String> allowedActions,List<String> blockReasons,
+                                        List<FbaAppointmentResponse> currentBatches,List<SourceRef> originalSourceRefs) {
+    public record SourceRef(String customerId,String sourceKey,String destinationKey) { }
+    public record SourceAllocation(String customerId,String sourceKey,String destinationKey,Integer packageCount,
+                                   Integer originalPackages,String sourceVersion,Integer cargoVerificationVersion,
+                                   List<String> shipmentReferences) { }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/dto/FbaAppointmentResponse.java b/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/dto/FbaAppointmentResponse.java
index a2f2d06a4..b3713fffc 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/dto/FbaAppointmentResponse.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/dto/FbaAppointmentResponse.java
@@ -24,9 +24,14 @@ public record FbaAppointmentResponse(
     LocalDateTime createdAt,
     LocalDateTime updatedAt,
     List<Item> items,
-    Integer version
+    Integer version,
+    List<String> replacementAppointmentNos,
+    String repartitionReason,
+    String batchKey,
+    List<String> replacementBatchKeys
 ) {
     public record Item(Long id, String sourceKey, String sourceVersion, Long orderId, String inboundCode,
-                       String fbaWarehouseCode, String customerId, Integer packageCount) {
+                       String fbaWarehouseCode, String customerId, Integer packageCount,
+                       Integer cargoVerificationVersion, List<String> shipmentReferences, String destinationKey) {
     }
 }
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/dto/InboundPlanRequests.java b/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/dto/InboundPlanRequests.java
index a1c844d0d..ac822d54a 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/dto/InboundPlanRequests.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/dto/InboundPlanRequests.java
@@ -21,7 +21,7 @@ public final class InboundPlanRequests {
         String destinationWarehouseCode,
         String warehouse,
         String fbaWarehouseCode,
-        @Pattern(regexp = "UNAPPOINTED|PENDING|SUCCESS|FAILED|CANCELLED")
+        @Pattern(regexp = "UNAPPOINTED|PENDING|SUCCESS|FAILED|CANCELLED|MULTIPLE")
         String appointmentStatus,
         @Pattern(regexp = "UNSCHEDULED|SCHEDULED")
         String dispatchStatus,
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/dto/RepartitionFbaAppointmentsRequest.java b/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/dto/RepartitionFbaAppointmentsRequest.java
new file mode 100644
index 000000000..1e4a5f343
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/dto/RepartitionFbaAppointmentsRequest.java
@@ -0,0 +1,20 @@
+package com.baiyue.lastleg.inboundplan.dto;
+
+import jakarta.validation.Valid;
+import jakarta.validation.constraints.*;
+import java.time.LocalDate;
+import java.util.List;
+
+public record RepartitionFbaAppointmentsRequest(
+    @NotEmpty @Size(max=20) List<@NotNull @Valid Original> originals,
+    @NotEmpty @Size(max=20) List<@NotNull @Valid Batch> batches,
+    @NotBlank @Size(max=1000) String reason,
+    @NotBlank @Size(max=64) String idempotencyKey
+) {
+    public record Original(@NotBlank @Size(max=64) String appointmentNo,@NotNull @Min(0) Integer version) { }
+    public record Batch(LocalDate plannedDate,@Size(max=1000) String remark,
+                        @NotEmpty @Size(max=100) List<@NotNull @Valid Allocation> allocations) { }
+    public record Allocation(@NotBlank @Size(max=128) String customerId,@NotBlank @Size(max=160) String sourceKey,
+                             @NotNull @Positive Integer packageCount,@Size(max=160) String expectedSourceVersion,
+                             @Min(1) Integer expectedVerificationVersion) { }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/dto/RepartitionFbaAppointmentsResponse.java b/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/dto/RepartitionFbaAppointmentsResponse.java
new file mode 100644
index 000000000..76876149a
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/dto/RepartitionFbaAppointmentsResponse.java
@@ -0,0 +1,6 @@
+package com.baiyue.lastleg.inboundplan.dto;
+
+import java.util.List;
+
+public record RepartitionFbaAppointmentsResponse(List<String> replacedBatchKeys,List<String> replacedAppointmentNos,
+                                                 List<FbaAppointmentResponse> appointments) { }
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/dto/SourceFbaAppointmentRequest.java b/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/dto/SourceFbaAppointmentRequest.java
index 2d4951339..252e175a0 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/dto/SourceFbaAppointmentRequest.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/dto/SourceFbaAppointmentRequest.java
@@ -1,6 +1,5 @@
 package com.baiyue.lastleg.inboundplan.dto;
 
-import com.baiyue.lastleg.appointmentplanning.AppointmentCoverageService.SourceRef;
 import jakarta.validation.Valid;
 import jakarta.validation.constraints.*;
 import java.util.List;
@@ -11,4 +10,6 @@ public record SourceFbaAppointmentRequest(
     @NotBlank @Size(max=64) String fbaWarehouseCode,
     @NotNull @Valid FbaAppointmentDetails details,
     @NotBlank @Size(max=64) String idempotencyKey
-) { }
+) {
+    public record SourceRef(String customerId, String sourceKey, String destinationKey) { }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/entity/InboundFbaAppointment.java b/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/entity/InboundFbaAppointment.java
index fc4bf5c49..224cc8d4d 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/entity/InboundFbaAppointment.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/entity/InboundFbaAppointment.java
@@ -38,6 +38,9 @@ public class InboundFbaAppointment {
     private String appointmentRemark;
     private String fbaWarehouseCode;
     private Integer selectedCount;
+    private String replacementNosJson;
+    private String replacementKeysJson;
+    private String repartitionReason;
     private String createdBy;
     private LocalDateTime createdAt;
     private LocalDateTime updatedAt;
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/entity/InboundFbaAppointmentItem.java b/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/entity/InboundFbaAppointmentItem.java
index 8832e937d..503616a53 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/entity/InboundFbaAppointmentItem.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/entity/InboundFbaAppointmentItem.java
@@ -19,6 +19,10 @@ public class InboundFbaAppointmentItem {
     private String sourceVersion;
     @com.baomidou.mybatisplus.annotation.TableField(updateStrategy = com.baomidou.mybatisplus.annotation.FieldStrategy.ALWAYS)
     private Integer packageCount;
+    @com.baomidou.mybatisplus.annotation.TableField(updateStrategy = com.baomidou.mybatisplus.annotation.FieldStrategy.ALWAYS)
+    private Integer cargoVerificationVersion;
+    @com.baomidou.mybatisplus.annotation.TableField(updateStrategy = com.baomidou.mybatisplus.annotation.FieldStrategy.ALWAYS)
+    private String shipmentReferencesJson;
     private Boolean active;
     @com.baomidou.mybatisplus.annotation.TableField(updateStrategy = com.baomidou.mybatisplus.annotation.FieldStrategy.ALWAYS)
     private Long orderId;
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/mapper/InboundFbaAppointmentQueryMapper.java b/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/mapper/InboundFbaAppointmentQueryMapper.java
index 053585692..216503c41 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/mapper/InboundFbaAppointmentQueryMapper.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/mapper/InboundFbaAppointmentQueryMapper.java
@@ -14,11 +14,19 @@ public interface InboundFbaAppointmentQueryMapper {
     @Options(flushCache = Options.FlushCachePolicy.TRUE, useCache = false)
     List<Long> lockOrders(@Param("ids") List<Long> ids);
 
-    @Select("<script>SELECT COUNT(*) FROM ll_inbound_fba_appointment_item WHERE active=1 " +
-        "<if test='excludedId != null'>AND appointment_id&lt;&gt;#{excludedId} </if>AND (source_key IN " +
-        "<foreach collection='keys' item='key' open='(' separator=',' close=')'>#{key}</foreach> " +
-        "<if test='orderIds != null and !orderIds.isEmpty()'>OR order_id IN <foreach collection='orderIds' item='id' open='(' separator=',' close=')'>#{id}</foreach></if>)</script>")
-    long countActiveSources(@Param("keys") List<String> keys,@Param("orderIds") List<Long> orderIds,@Param("excludedId") Long excludedId);
+    record Allocation(long packages,long count,long unknownCount) { }
+    @Select("<script>SELECT COALESCE(SUM(package_count),0) AS packages,COUNT(*) AS count,COUNT(*)-COUNT(package_count) AS unknownCount " +
+        "FROM ll_inbound_fba_appointment_item WHERE active=1 AND customer_id=#{customerId} " +
+        "<if test='excludedId != null'>AND appointment_id&lt;&gt;#{excludedId} </if>" +
+        "AND (source_key=#{sourceKey}<if test='orderId != null'> OR order_id=#{orderId}</if>)</script>")
+    Allocation allocation(@Param("customerId") String customerId,@Param("sourceKey") String sourceKey,
+                          @Param("orderId") Long orderId,@Param("excludedId") Long excludedId);
+
+    @Select({"<script>SELECT DISTINCT appointment_id FROM ll_inbound_fba_appointment_item WHERE ",
+        "<foreach collection='sources' item='s' open='(' separator=' OR ' close=')'>",
+        "(customer_id=#{s.customerId} AND source_key=#{s.sourceKey} AND CONCAT('FBA:',fba_warehouse_code)=#{s.destinationKey})</foreach>",
+        " ORDER BY appointment_id DESC LIMIT 1001</script>"})
+    List<Long> relatedBatchIds(@Param("sources") List<com.baiyue.lastleg.appointmentplanning.AppointmentCoverageService.SourceRef> sources);
 
     @Select("<script>SELECT COUNT(*) FROM ll_order o "+com.baiyue.lastleg.appointmentplanning.AppointmentCoverageMapper.TRANSFER_JOIN+
         " WHERE o.id IN <foreach collection='ids' item='id' open='(' separator=',' close=')'>#{id}</foreach> AND ("+
@@ -34,16 +42,10 @@ public interface InboundFbaAppointmentQueryMapper {
         "</script>")
     List<FbaAppointmentLineSnapshot> selectedLines(@Param("lineIds") List<Long> lineIds);
 
-    @Select("<script>SELECT COUNT(*) FROM ll_inbound_fba_appointment_item i WHERE i.active=1 " +
-        "<if test='excludedId != null'>AND i.appointment_id&lt;&gt;#{excludedId} </if>AND i.order_id IN " +
-        "(SELECT l.order_id FROM ll_inbound_plan_line l WHERE l.id IN <foreach collection='lineIds' item='id' open='(' separator=',' close=')'>#{id}</foreach>)</script>")
-    long countActiveAppointments(@Param("lineIds") List<Long> lineIds, @Param("excludedId") Long excludedId);
-
     @Select("""
-        SELECT COUNT(*) FROM ll_inbound_fba_appointment_item i
-        JOIN ll_dispatch_item di ON di.order_id=i.order_id AND di.customer_id=i.customer_id
-        JOIN ll_dispatch_order d ON d.id=di.dispatch_order_id AND d.customer_id=di.customer_id
-        WHERE i.appointment_id=#{appointmentId} AND d.status<>'CANCELLED'
+        SELECT COUNT(DISTINCT d.id) FROM ll_dispatch_appointment_allocation a
+        JOIN ll_dispatch_order d ON d.id=a.dispatch_id AND d.customer_id=a.customer_id
+        WHERE a.batch_key=CONCAT('FBA_APPOINTMENT:',#{appointmentId}) AND d.status<>'CANCELLED'
         """)
     long countActiveDispatches(@Param("appointmentId") Long appointmentId);
 }
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/mapper/InboundPlanMapper.java b/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/mapper/InboundPlanMapper.java
index a5e454b58..d52eb554e 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/mapper/InboundPlanMapper.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/mapper/InboundPlanMapper.java
@@ -13,6 +13,7 @@ import java.util.List;
 
 @Mapper
 public interface InboundPlanMapper extends BaseMapper<InboundPlan> {
+    String APPOINTMENT_STATUS="CASE WHEN (SELECT COUNT(DISTINCT current_item.appointment_id) FROM ll_inbound_fba_appointment_item current_item WHERE current_item.order_id=p.source_order_id AND current_item.customer_id=p.customer_id AND current_item.active=1)&gt;1 THEN 'MULTIPLE' ELSE COALESCE((SELECT a.appointment_status FROM ll_inbound_fba_appointment_item ai JOIN ll_inbound_fba_appointment a ON a.id=ai.appointment_id WHERE ai.order_id=p.source_order_id AND ai.customer_id=p.customer_id AND a.replacement_nos_json IS NULL ORDER BY ai.active DESC,a.created_at DESC,a.id DESC LIMIT 1),'NOT_APPOINTED') END";
     String PAGE_FROM = " FROM ll_inbound_plan p JOIN ll_order o ON o.id=p.source_order_id AND o.customer_id=p.customer_id " +
         "LEFT JOIN ll_inbound_plan_line l ON l.plan_id=p.id AND l.order_id=p.source_order_id " +
         "WHERE p.customer_id=#{customerId}" +
@@ -23,8 +24,7 @@ public interface InboundPlanMapper extends BaseMapper<InboundPlan> {
         "<if test='q.destinationWarehouseCode != null and q.destinationWarehouseCode != \"\"'> AND l.destination_warehouse_code=#{q.destinationWarehouseCode}</if>" +
         "<if test='q.fbaWarehouseCode != null and q.fbaWarehouseCode != \"\"'> AND l.fba_warehouse_code=#{q.fbaWarehouseCode}</if>" +
         "<if test='q.appointmentStatus != null and q.appointmentStatus != \"\" and q.appointmentStatus != \"NOT_APPOINTED\"'> " +
-        "AND EXISTS (SELECT 1 FROM ll_inbound_fba_appointment_item ai JOIN ll_inbound_fba_appointment a ON a.id=ai.appointment_id " +
-        "WHERE ai.order_id=p.source_order_id AND ai.customer_id=#{customerId} AND a.appointment_status=#{q.appointmentStatus})</if>" +
+        "AND ("+APPOINTMENT_STATUS+")=#{q.appointmentStatus}</if>" +
         "<if test='q.appointmentStatus == \"NOT_APPOINTED\"'> AND NOT EXISTS (SELECT 1 FROM ll_inbound_fba_appointment_item ai " +
         "WHERE ai.order_id=p.source_order_id AND ai.customer_id=p.customer_id AND ai.active=1)</if>" +
         "<if test='q.createdFrom != null'> AND p.created_at &gt;=#{q.createdFrom}</if>" +
@@ -34,9 +34,7 @@ public interface InboundPlanMapper extends BaseMapper<InboundPlan> {
         "l.inbound_code,p.container_no,o.overseas_warehouse_id,o.overseas_warehouse_name," +
         "l.destination_warehouse_id,l.destination_warehouse_code,l.destination_warehouse_name,l.fba_warehouse_code," +
         "COALESCE(l.required_package_count,o.package_count,0) package_count,p.total_volume_cbm,p.pallet_count,p.status," +
-        "COALESCE((SELECT a.appointment_status FROM ll_inbound_fba_appointment_item ai " +
-        "JOIN ll_inbound_fba_appointment a ON a.id=ai.appointment_id WHERE ai.order_id=p.source_order_id AND ai.customer_id=p.customer_id " +
-        "ORDER BY a.created_at DESC,a.id DESC LIMIT 1),'NOT_APPOINTED') appointment_status,p.created_at,p.updated_at" +
+        APPOINTMENT_STATUS+" appointment_status,p.created_at,p.updated_at" +
         PAGE_FROM + " ORDER BY p.created_at DESC,p.id DESC LIMIT #{limit} OFFSET #{offset}</script>")
     List<InboundPlanSummary> pageRows(@Param("customerId") String customerId,
                                       @Param("q") InboundPlanRequests.Query query,
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/mapper/InboundPlanQueryMapper.java b/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/mapper/InboundPlanQueryMapper.java
index 13729a99f..2e24d2207 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/mapper/InboundPlanQueryMapper.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/mapper/InboundPlanQueryMapper.java
@@ -10,6 +10,8 @@ import java.util.List;
 
 @Mapper
 public interface InboundPlanQueryMapper {
+    String ACTIVE_APPOINTMENT_COUNT="(SELECT COUNT(DISTINCT current_item.appointment_id) FROM ll_inbound_fba_appointment_item current_item WHERE current_item.order_id=l.order_id AND current_item.customer_id=p.customer_id AND current_item.fba_warehouse_code=l.fba_warehouse_code AND current_item.active=1)";
+    String APPOINTMENT_STATUS="CASE WHEN "+ACTIVE_APPOINTMENT_COUNT+"&gt;1 THEN 'MULTIPLE' ELSE a.appointment_status END";
     String SCHEDULED_DISPATCH = "EXISTS (SELECT 1 FROM ll_dispatch_item di" +
         " JOIN ll_dispatch_order dispatch ON dispatch.id=di.dispatch_order_id" +
         " AND dispatch.customer_id=di.customer_id" +
@@ -24,7 +26,7 @@ public interface InboundPlanQueryMapper {
         " AND ai.id=(SELECT ai2.id FROM ll_inbound_fba_appointment_item ai2" +
         " JOIN ll_inbound_fba_appointment a2 ON a2.id=ai2.appointment_id" +
         " WHERE ai2.order_id=l.order_id AND ai2.customer_id=p.customer_id AND ai2.fba_warehouse_code=l.fba_warehouse_code" +
-        " ORDER BY a2.created_at DESC,ai2.id DESC LIMIT 1)" +
+        " AND a2.replacement_nos_json IS NULL ORDER BY ai2.active DESC,a2.created_at DESC,ai2.id DESC LIMIT 1)" +
         " LEFT JOIN ll_inbound_fba_appointment a ON a.id=ai.appointment_id" +
         " WHERE 1=1" +
         "<if test='q.planNo != null and q.planNo != \"\"'> AND p.plan_no LIKE CONCAT('%',#{q.planNo},'%')</if>" +
@@ -36,7 +38,7 @@ public interface InboundPlanQueryMapper {
         "<if test='q.warehouse != null and q.warehouse != \"\"'> AND (l.destination_warehouse_id LIKE CONCAT('%',#{q.warehouse},'%') OR l.destination_warehouse_code LIKE CONCAT('%',#{q.warehouse},'%') OR l.destination_warehouse_name LIKE CONCAT('%',#{q.warehouse},'%'))</if>" +
         "<if test='q.fbaWarehouseCode != null and q.fbaWarehouseCode != \"\"'> AND l.fba_warehouse_code LIKE CONCAT('%',#{q.fbaWarehouseCode},'%')</if>" +
         "<choose><when test='q.appointmentStatus == \"UNAPPOINTED\"'> AND (ai.id IS NULL OR ai.active=0)</when>" +
-        "<when test='q.appointmentStatus != null and q.appointmentStatus != \"\"'> AND a.appointment_status=#{q.appointmentStatus}</when></choose>" +
+        "<when test='q.appointmentStatus != null and q.appointmentStatus != \"\"'> AND ("+APPOINTMENT_STATUS+")=#{q.appointmentStatus}</when></choose>" +
         "<choose><when test='q.dispatchStatus == \"SCHEDULED\"'> AND " + SCHEDULED_DISPATCH + "</when>" +
         "<when test='q.dispatchStatus == \"UNSCHEDULED\"'> AND NOT " + SCHEDULED_DISPATCH + "</when></choose>" +
         "<if test='q.createdFrom != null'> AND p.created_at &gt;=#{q.createdFrom}</if>" +
@@ -55,8 +57,8 @@ public interface InboundPlanQueryMapper {
         "(SELECT i.net_weight_kg FROM ll_inbound_order i WHERE i.id=l.order_id AND i.customer_id=p.customer_id),0) netWeightKg," +
         "l.volume_cbm volumeCbm," +
         "l.planned_pallet_count palletCount,p.assigned_flag assigned,p.merge_required mergeAllowed," +
-        "p.urgent_flag urgent,p.status status,a.appointment_no appointmentNo," +
-        "a.appointment_status appointmentStatus,a.appointment_at appointmentAt," +
+        "p.urgent_flag urgent,p.status status,CASE WHEN "+ACTIVE_APPOINTMENT_COUNT+"&gt;1 THEN NULL ELSE a.appointment_no END appointmentNo," +
+        APPOINTMENT_STATUS+" appointmentStatus,CASE WHEN "+ACTIVE_APPOINTMENT_COUNT+"&gt;1 THEN NULL ELSE a.appointment_at END appointmentAt," +
         "NULL expectedLoadingAt," +
         "CASE WHEN " + SCHEDULED_DISPATCH +
         " THEN 'SCHEDULED' ELSE 'UNSCHEDULED' END dispatchStatus,p.created_at createdAt,p.version version" +
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/pda/service/ReceivingContainerService.java b/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/pda/service/ReceivingContainerService.java
index b4998a5e3..2963f9be1 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/pda/service/ReceivingContainerService.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/pda/service/ReceivingContainerService.java
@@ -102,6 +102,7 @@ public class ReceivingContainerService {
     @Resource private ContainerLoadingEvidenceMapper domesticEvidence;
     @Resource private InboundPdaWorkflowService workflow;
     @Resource private ObjectMapper sourceObjectMapper;
+    @Resource private com.baiyue.lastleg.inboundplan.work.AppointmentWorkReceivingGuard workRouteGuard;
 
     private ObjectMapper objectMapper;
 
@@ -638,6 +639,7 @@ public class ReceivingContainerService {
         ReceivingContainerSession session = lock ? sessions.lockActiveByOperator(key)
             : sessions.findActiveByOperator(key);
         if (session == null) throw notFound("Current receiving container session was not found");
+        if (lock) workRouteGuard.requireWarehouseFlow(session.getSourceContainerBookingId());
         requireStableSessionFacts(session, lock);
         return session;
     }
@@ -646,6 +648,7 @@ public class ReceivingContainerService {
                                                       long overseasWarehouseId, boolean lock) {
         String bookingId = trim(sourceContainerBookingId);
         if (bookingId == null) throw conflict("sourceContainerBookingId is required");
+        if (lock) workRouteGuard.requireWarehouseFlow(bookingId);
         LambdaQueryWrapper<LastlegOrder> query = new LambdaQueryWrapper<LastlegOrder>()
             .eq(LastlegOrder::getContainerNo, containerNo)
             .eq(LastlegOrder::getSourceContainerBookingId, bookingId)
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/receiving/FbaAppointmentExecutionPort.java b/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/receiving/FbaAppointmentExecutionPort.java
new file mode 100644
index 000000000..9bf6eae1e
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/receiving/FbaAppointmentExecutionPort.java
@@ -0,0 +1,13 @@
+package com.baiyue.lastleg.inboundplan.receiving;
+
+import java.util.List;
+
+/** Original execution evidence, scoped by customer; work projections cannot authorize rebooking. */
+public interface FbaAppointmentExecutionPort {
+    record Member(String batchKey,String customerId) { }
+    record Eligibility(Member member,boolean completed,boolean canRebook,String reason) { }
+    record Scope(String version,List<Eligibility> members) { }
+    Scope inspect(List<Member> members);
+    /** Locks original trips and selected customers' dispatch/execution rows before core batch locks. */
+    Scope lockAndInspect(List<Member> members,String expectedVersion);
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/receiving/FbaAppointmentTransportPort.java b/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/receiving/FbaAppointmentTransportPort.java
new file mode 100644
index 000000000..17bff899f
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/receiving/FbaAppointmentTransportPort.java
@@ -0,0 +1,18 @@
+package com.baiyue.lastleg.inboundplan.receiving;
+
+import java.util.List;
+
+/** Original Dispatch/Fleet authority; implementations never invent physical pallet splits. */
+public interface FbaAppointmentTransportPort {
+    record Vehicle(String tripNo, Integer version, String dispatchNo, String customerId,
+                   String batchKey, String status, int packageCount) { }
+    record Scope(String version, List<Vehicle> vehicles, List<String> blockReasons) { }
+    record Move(String batchKey, String customerId, String sourceKey, String destinationKey,
+                int originalPackages, int retainedPackages, String laterBatchKey) { }
+    record Result(List<Vehicle> vehicles, List<String> nextActions) { }
+    Scope inspect(List<String> batchKeys);
+    /** Lock order: trip -> dispatch -> outbound/PDA -> appointment; called BEFORE core locks batches. */
+    Scope lockAndInspect(List<String> batchKeys, String expectedVersion);
+    /** Same transaction as core allocation. Throw on failure so physical/allocation changes roll back together. */
+    Result apply(Scope locked, List<Move> moves, String operator, String reason);
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/receiving/FbaAppointmentWorkPort.java b/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/receiving/FbaAppointmentWorkPort.java
new file mode 100644
index 000000000..7b2857867
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/receiving/FbaAppointmentWorkPort.java
@@ -0,0 +1,13 @@
+package com.baiyue.lastleg.inboundplan.receiving;
+
+import java.time.LocalDate;
+import java.util.List;
+
+/** Work domain owns the verified responsible person and durable follow-up inheritance. */
+public interface FbaAppointmentWorkPort {
+    record Member(String batchKey,String customerId) { }
+    record Followup(String ownerId,String ownerName,LocalDate nextFollowupDate) { }
+    Followup resolveFollowup(String ownerId,LocalDate nextFollowupDate);
+    void seedFollowup(Member original,Member later,Followup followup,String operatorId);
+    void inheritFollowup(List<Member> originals,List<Member> successors,String operatorId);
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/receiving/FbaReceivingContracts.java b/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/receiving/FbaReceivingContracts.java
new file mode 100644
index 000000000..f0931e32d
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/receiving/FbaReceivingContracts.java
@@ -0,0 +1,64 @@
+package com.baiyue.lastleg.inboundplan.receiving;
+
+import com.baiyue.lastleg.inboundplan.dto.FbaAppointmentDetails;
+import com.baiyue.lastleg.inboundplan.dto.FbaAppointmentResponse;
+import jakarta.validation.Valid;
+import jakarta.validation.constraints.*;
+import java.time.LocalDate;
+import java.util.List;
+
+/** Receiving coverage is separate from a stable cargo batch and from shared vehicles. */
+public final class FbaReceivingContracts {
+    private FbaReceivingContracts() { }
+    public record Member(String batchKey, String appointmentNo, int batchVersion, String customerId,
+                         List<Source> sources, String customerName) { }
+    public record Source(String sourceKey, String destinationKey, int packageCount,
+                         String sourceVersion, Integer verificationVersion, String inboundCode) { }
+    public record Agreement(String agreementKey, int version, String status, String destinationKey,
+                            FbaAppointmentDetails details, String timezone, List<Member> members,
+                            String warehouseEvidence) { }
+    public record Excluded(Member member, String reason, String currentAgreementKey) { }
+    public record Pending(String changeKey, int version, String status, ChangeIntent intent,
+                          List<Member> originalMembers, List<Agreement> originalAgreements,FbaAppointmentWorkPort.Followup followup) { }
+    public record CustomerPlan(String batchKey,String customerId,FbaAppointmentDetails details,String timezone) { }
+    public record BatchReceiving(String batchKey, List<Agreement> agreements, List<Pending> pendingChanges,List<CustomerPlan> plans) { }
+    public record Context(FbaAppointmentResponse batch, List<Agreement> agreements,
+                          List<Pending> pendingChanges, FbaAppointmentTransportPort.Scope transport,
+                          List<String> allowedActions, List<String> blockReasons,FbaAppointmentExecutionPort.Scope executionScope,List<CustomerPlan> plans) { }
+    public record GroupContext(Agreement agreement, List<Member> eligibleMembers, List<Excluded> excludedMembers,
+                               FbaAppointmentTransportPort.Scope transport,FbaAppointmentExecutionPort.Scope executionScope) { }
+    public record Selection(@NotBlank String batchKey, @Min(0) int batchVersion,
+                            @NotBlank String customerId) { }
+    public record Plan(@NotBlank @Size(max=64) String idempotencyKey,@NotNull @Valid Selection member,
+                       @NotNull @Valid FbaAppointmentDetails details,@NotBlank String executionVersion) { }
+    public record ExecutionQuery(@NotEmpty @Size(max=200) List<FbaAppointmentExecutionPort.Member> members) { }
+    public record CargoVersion(@NotBlank String sourceKey,@NotBlank String destinationKey,
+                               @NotBlank String expectedSourceVersion,@Min(1) Integer expectedVerificationVersion) { }
+    public record RefreshCargo(@NotBlank @Size(max=64) String idempotencyKey,@NotNull @Valid Selection member,
+                               @NotEmpty @Size(max=100) List<@NotNull @Valid CargoVersion> sources,
+                               @NotBlank String executionVersion) { }
+    public record Quantity(@NotBlank String sourceKey, @NotBlank String destinationKey,
+                           @Min(0) int retainedPackages, @NotBlank String expectedSourceVersion,
+                           Integer expectedVerificationVersion) { }
+    public record ChangeIntent(@NotBlank String batchKey, @Min(0) int batchVersion,
+                               @NotBlank String customerId, @NotEmpty @Valid List<Quantity> quantities,
+                               LocalDate laterDate, @NotBlank @Size(max=64) String ownerId,
+                               LocalDate nextFollowupDate, @NotBlank @Size(max=1000) String reason,
+                               @NotBlank String transportVersion) { }
+    public record Propose(@NotBlank @Size(max=64) String idempotencyKey, @NotNull @Valid ChangeIntent intent) { }
+    public record Resolve(@NotBlank @Size(max=64) String idempotencyKey, @Min(0) int version,
+                          @NotBlank String decision, @Size(max=1000) String warehouseEvidence,
+                          @NotBlank String transportVersion) { }
+    public record Booking(@NotEmpty @Valid List<Selection> members, @NotNull @Valid FbaAppointmentDetails details,
+                          @NotBlank @Size(max=1000) String warehouseEvidence) { }
+    public record Book(@NotBlank @Size(max=64) String idempotencyKey, @NotEmpty @Valid List<Booking> bookings,
+                       String cancelledAgreementKey, Integer cancelledAgreementVersion,
+                       @NotBlank String executionVersion) { }
+    public record GroupChange(@NotBlank @Size(max=64) String idempotencyKey, @Min(0) int version,
+                              @NotBlank String action, @Valid FbaAppointmentDetails details,
+                              @NotBlank @Size(max=1000) String warehouseEvidence,
+                              @NotBlank String transportVersion) { }
+    public record Step(String step, String status, String targetKey, String message) { }
+    public record Result(String changeKey, String status, List<FbaAppointmentResponse> batches,
+                         List<Agreement> agreements, List<Step> steps, List<String> nextActions) { }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/receiving/FbaReceivingController.java b/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/receiving/FbaReceivingController.java
new file mode 100644
index 000000000..aee698762
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/receiving/FbaReceivingController.java
@@ -0,0 +1,52 @@
+package com.baiyue.lastleg.inboundplan.receiving;
+
+import com.baiyue.common.core.api.ApiResponse;
+import com.baiyue.common.security.AuthenticatedUser;
+import jakarta.validation.Valid;
+import org.springframework.security.access.prepost.PreAuthorize;
+import org.springframework.security.core.annotation.AuthenticationPrincipal;
+import org.springframework.web.bind.annotation.*;
+import org.springframework.web.server.ResponseStatusException;
+import org.springframework.http.HttpStatus;
+import static com.baiyue.lastleg.inboundplan.receiving.FbaReceivingContracts.*;
+
+@RestController
+@RequestMapping("/api/platform/v1/last-leg/appointment-receiving")
+public class FbaReceivingController {
+    private static final String READ="hasAuthority('platform:appointment:list')";
+    private static final String EDIT="hasAuthority('platform:overseas-warehouse:inbound-order:fba-appointment')";
+    private static final String DELETE="hasAuthority('platform:appointment:delete')";
+    private final FbaReceivingService service;
+    public FbaReceivingController(FbaReceivingService service) {this.service=service;}
+    @GetMapping("/batches/{batchKey}") @PreAuthorize(READ)
+    public ApiResponse<Context> context(@AuthenticationPrincipal AuthenticatedUser user,@PathVariable String batchKey) {platform(user);return ApiResponse.success(service.context(batchKey));}
+    @GetMapping("/agreements/{agreementKey}") @PreAuthorize(READ)
+    public ApiResponse<GroupContext> group(@AuthenticationPrincipal AuthenticatedUser user,@PathVariable String agreementKey) {platform(user);return ApiResponse.success(service.groupContext(agreementKey));}
+    @PostMapping("/execution-scope") @PreAuthorize(READ)
+    public ApiResponse<FbaAppointmentExecutionPort.Scope> executionScope(@AuthenticationPrincipal AuthenticatedUser user,@Valid @RequestBody ExecutionQuery request) {platform(user);return ApiResponse.success(service.executionScope(request));}
+    @PostMapping("/changes") @PreAuthorize(EDIT+" and "+DELETE)
+    public ApiResponse<Result> propose(@AuthenticationPrincipal AuthenticatedUser user,@Valid @RequestBody Propose request) {return ApiResponse.success(service.propose(platform(user),request));}
+    @PostMapping("/changes/{changeKey}/resolve") @PreAuthorize(EDIT+" and "+DELETE)
+    public ApiResponse<Result> resolve(@AuthenticationPrincipal AuthenticatedUser user,@PathVariable String changeKey,@Valid @RequestBody Resolve request) {return ApiResponse.success(service.resolve(platform(user),changeKey,request));}
+    @PostMapping("/bookings") @PreAuthorize(EDIT)
+    public ApiResponse<Result> book(@AuthenticationPrincipal AuthenticatedUser user,@Valid @RequestBody Book request) {return ApiResponse.success(service.book(platform(user),request));}
+    @PostMapping("/plans") @PreAuthorize(EDIT)
+    public ApiResponse<Result> plan(@AuthenticationPrincipal AuthenticatedUser user,@Valid @RequestBody Plan request) {return ApiResponse.success(service.plan(platform(user),request));}
+    @PostMapping("/cargo-refresh") @PreAuthorize(EDIT)
+    public ApiResponse<Result> refreshCargo(@AuthenticationPrincipal AuthenticatedUser user,@Valid @RequestBody RefreshCargo request) {return ApiResponse.success(service.refreshCargo(platform(user),request));}
+    @PostMapping("/agreements/{agreementKey}/reschedule") @PreAuthorize(EDIT)
+    public ApiResponse<Result> reschedule(@AuthenticationPrincipal AuthenticatedUser user,@PathVariable String agreementKey,@Valid @RequestBody GroupChange request) {
+        var operator=platform(user);if(!"RESCHEDULE".equals(request.action())) throw new ResponseStatusException(HttpStatus.BAD_REQUEST,"此入口只允许改期");
+        return ApiResponse.success(service.changeGroup(operator,agreementKey,request));
+    }
+    @PostMapping("/agreements/{agreementKey}/cancel") @PreAuthorize(DELETE)
+    public ApiResponse<Result> cancel(@AuthenticationPrincipal AuthenticatedUser user,@PathVariable String agreementKey,@Valid @RequestBody GroupChange request) {
+        var operator=platform(user);if(!"CANCEL".equals(request.action())) throw new ResponseStatusException(HttpStatus.BAD_REQUEST,"此入口只允许取消");
+        return ApiResponse.success(service.changeGroup(operator,agreementKey,request));
+    }
+    private static String platform(AuthenticatedUser user) {
+        if(user==null || user.userId()==null) throw new ResponseStatusException(HttpStatus.UNAUTHORIZED);
+        if(!"PLATFORM".equals(user.appCode()) || !Long.valueOf(0).equals(user.tenantId())) throw new ResponseStatusException(HttpStatus.FORBIDDEN);
+        return String.valueOf(user.userId());
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/receiving/FbaReceivingMapper.java b/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/receiving/FbaReceivingMapper.java
new file mode 100644
index 000000000..446cffaea
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/receiving/FbaReceivingMapper.java
@@ -0,0 +1,66 @@
+package com.baiyue.lastleg.inboundplan.receiving;
+
+import org.apache.ibatis.annotations.*;
+import java.util.List;
+
+@Mapper
+public interface FbaReceivingMapper {
+    record GroupRow(String agreementKey, int version, String status, String destinationKey, String confirmationNo, String snapshotJson) { }
+    record ChangeRow(String changeKey, int version, String status, String batchKey, String customerId, String snapshotJson, String resultJson) { }
+    record BatchJson(String batchKey,String snapshotJson) { }
+    record CustomerLabel(String customerId,String customerName) { }
+    record PlanRow(String batchKey,String customerId,String snapshotJson) { }
+    @Select("<script>SELECT p.batch_key,p.customer_id,p.snapshot_json FROM ll_fba_receiving_plan p JOIN ll_inbound_fba_appointment a ON p.batch_key=CONCAT('FBA_APPOINTMENT:',a.id) WHERE a.replacement_nos_json IS NULL AND EXISTS (SELECT 1 FROM ll_inbound_fba_appointment_item i WHERE i.appointment_id=a.id AND i.customer_id=p.customer_id AND i.active=1) AND p.batch_key IN <foreach collection='keys' item='key' open='(' separator=',' close=')'>#{key}</foreach> ORDER BY p.batch_key,p.customer_id</script>")
+    List<PlanRow> plans(@Param("keys") List<String> keys);
+    @Delete("DELETE FROM ll_fba_receiving_plan WHERE batch_key=#{batch} AND customer_id=#{customer}")
+    int deletePlan(@Param("batch") String batch,@Param("customer") String customer);
+    @Insert("INSERT INTO ll_fba_receiving_plan(batch_key,customer_id,snapshot_json) VALUES(#{batchKey},#{customerId},#{snapshotJson})")
+    int insertPlan(PlanRow row);
+    @Select("SELECT DISTINCT i.customer_id,o.customer_name FROM ll_inbound_fba_appointment_item i JOIN ll_order o ON o.id=i.order_id AND o.customer_id=i.customer_id WHERE CONCAT('FBA_APPOINTMENT:',i.appointment_id)=#{batch} AND i.active=1")
+    List<CustomerLabel> labels(String batch);
+    record LiveSource(String customerId,String sourceKey,String destinationKey,Integer packageCount) { }
+    @Select("SELECT customer_id,source_key,CONCAT('FBA:',fba_warehouse_code) AS destination_key,package_count FROM ll_inbound_fba_appointment_item WHERE CONCAT('FBA_APPOINTMENT:',appointment_id)=#{batch} AND active=1")
+    List<LiveSource> liveSources(String batch);
+    @Select("<script>SELECT DISTINCT m.batch_key,a.snapshot_json FROM ll_fba_receiving_member m JOIN ll_fba_receiving_agreement a ON a.agreement_key=m.agreement_key WHERE m.active_ref IS NOT NULL AND m.batch_key IN <foreach collection='keys' item='key' open='(' separator=',' close=')'>#{key}</foreach> ORDER BY m.batch_key</script>")
+    List<BatchJson> currentGroups(@Param("keys") List<String> keys);
+    @Select("<script>SELECT batch_key,snapshot_json FROM ll_fba_receiving_change WHERE status='WAITING' AND batch_key IN <foreach collection='keys' item='key' open='(' separator=',' close=')'>#{key}</foreach> ORDER BY batch_key,change_key</script>")
+    List<BatchJson> pendingGroups(@Param("keys") List<String> keys);
+    @Select("SELECT agreement_key,version,status,destination_key,confirmation_no,snapshot_json FROM ll_fba_receiving_agreement WHERE agreement_key=#{key}")
+    GroupRow group(String key);
+    @Select("SELECT agreement_key,version,status,destination_key,confirmation_no,snapshot_json FROM ll_fba_receiving_agreement WHERE agreement_key=#{key} FOR UPDATE")
+    @Options(flushCache=Options.FlushCachePolicy.TRUE,useCache=false)
+    GroupRow lockGroup(String key);
+    @Insert("INSERT INTO ll_fba_receiving_agreement(agreement_key,version,status,destination_key,confirmation_no,snapshot_json) VALUES(#{agreementKey},#{version},#{status},#{destinationKey},#{confirmationNo},#{snapshotJson})")
+    int insertGroup(GroupRow row);
+    @Update("UPDATE ll_fba_receiving_agreement SET version=#{version},status=#{status},confirmation_no=#{confirmationNo},snapshot_json=#{snapshotJson} WHERE agreement_key=#{agreementKey}")
+    int updateGroup(GroupRow row);
+    @Insert("INSERT INTO ll_fba_receiving_revision(agreement_key,version,snapshot_json) VALUES(#{agreementKey},#{version},#{snapshotJson})")
+    int revision(GroupRow row);
+    @Select("SELECT DISTINCT agreement_key FROM ll_fba_receiving_member WHERE batch_key=#{batch} ORDER BY agreement_key")
+    List<String> groupKeys(String batch);
+    @Select("SELECT agreement_key FROM ll_fba_receiving_member WHERE batch_key=#{batch} AND customer_id=#{customer} AND active_ref IS NOT NULL")
+    String currentKey(@Param("batch") String batch,@Param("customer") String customer);
+    @Insert("INSERT INTO ll_fba_receiving_member(agreement_key,batch_key,customer_id,active_ref) VALUES(#{group},#{batch},#{customer},#{activeRef})")
+    int addMember(@Param("group") String group,@Param("batch") String batch,@Param("customer") String customer,@Param("activeRef") String activeRef);
+    @Update("UPDATE ll_fba_receiving_member SET active_ref=NULL WHERE agreement_key=#{group}")
+    int releaseGroup(String group);
+    @Update("UPDATE ll_fba_receiving_member SET active_ref=NULL WHERE agreement_key=#{group} AND batch_key=#{batch} AND customer_id=#{customer}")
+    int releaseMember(@Param("group") String group,@Param("batch") String batch,@Param("customer") String customer);
+    @Select("SELECT change_key,version,status,batch_key,customer_id,snapshot_json,result_json FROM ll_fba_receiving_change WHERE change_key=#{key}")
+    ChangeRow change(String key);
+    @Select("SELECT change_key,version,status,batch_key,customer_id,snapshot_json,result_json FROM ll_fba_receiving_change WHERE change_key=#{key} FOR UPDATE")
+    @Options(flushCache=Options.FlushCachePolicy.TRUE,useCache=false)
+    ChangeRow lockChange(String key);
+    @Select("SELECT change_key,version,status,batch_key,customer_id,snapshot_json,result_json FROM ll_fba_receiving_change WHERE batch_key=#{batch} AND status='WAITING' ORDER BY change_key")
+    List<ChangeRow> pending(String batch);
+    @Select("SELECT result_json FROM ll_fba_receiving_change WHERE batch_key=#{batch} AND status='APPLIED' ORDER BY change_key")
+    List<String> appliedResults(String batch);
+    @Select("SELECT snapshot_json FROM ll_fba_receiving_change WHERE batch_key=#{batch} AND status='APPLIED' ORDER BY change_key")
+    List<String> appliedChanges(String batch);
+    @Select("SELECT COUNT(*) FROM ll_fba_receiving_change WHERE batch_key=#{batch} AND customer_id=#{customer} AND status='WAITING'")
+    long pendingCount(@Param("batch") String batch,@Param("customer") String customer);
+    @Insert("INSERT INTO ll_fba_receiving_change(change_key,version,status,batch_key,customer_id,snapshot_json,active_ref) VALUES(#{changeKey},#{version},#{status},#{batchKey},#{customerId},#{snapshotJson},CONCAT(#{batchKey},'/',#{customerId}))")
+    int insertChange(ChangeRow row);
+    @Update("UPDATE ll_fba_receiving_change SET version=#{version},status=#{status},snapshot_json=#{snapshotJson},result_json=#{resultJson},active_ref=NULL WHERE change_key=#{changeKey}")
+    int finishChange(ChangeRow row);
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/receiving/FbaReceivingService.java b/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/receiving/FbaReceivingService.java
new file mode 100644
index 000000000..0edb7b049
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/receiving/FbaReceivingService.java
@@ -0,0 +1,284 @@
+package com.baiyue.lastleg.inboundplan.receiving;
+
+import com.baiyue.lastleg.inboundplan.dto.FbaAppointmentResponse;
+import com.baiyue.lastleg.inboundplan.mapper.FbaAppointmentCommandMapper;
+import com.baiyue.lastleg.inboundplan.service.InboundFbaAppointmentService;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.*;
+import org.springframework.dao.DuplicateKeyException;
+import org.springframework.http.HttpStatus;
+import org.springframework.web.server.ResponseStatusException;
+import java.time.*;
+import java.util.*;
+import java.util.function.Supplier;
+import static com.baiyue.lastleg.inboundplan.receiving.FbaReceivingContracts.*;
+import static com.baiyue.lastleg.inboundplan.receiving.FbaReceivingStore.conflict;
+
+@Service
+@Transactional(isolation=Isolation.READ_COMMITTED)
+public class FbaReceivingService {
+    private final FbaReceivingStore store;
+    private final InboundFbaAppointmentService batches;
+    private final FbaAppointmentTransportPort transport;
+    private final FbaAppointmentCommandMapper commands;
+    private final FbaAppointmentWorkPort work;
+    private final FbaAppointmentExecutionPort execution;
+    public FbaReceivingService(FbaReceivingStore store,InboundFbaAppointmentService batches,FbaAppointmentTransportPort transport,FbaAppointmentCommandMapper commands,FbaAppointmentWorkPort work,FbaAppointmentExecutionPort execution) {
+        this.store=store;this.batches=batches;this.transport=transport;this.commands=commands;this.work=work;this.execution=execution;
+    }
+    @Transactional(readOnly=true)
+    public FbaAppointmentExecutionPort.Scope executionScope(ExecutionQuery request) { return execution.inspect(request.members()); }
+    @Transactional(readOnly=true)
+    public Context context(String key) {
+        var batch=batches.batchSnapshots(List.of(key)).get(0);var pending=store.pending(key);
+        var agreements=store.agreements(key);
+        var scope=transport.inspect(List.of(key));var blocks=new ArrayList<>(scope.blockReasons());
+        if(!batch.replacementAppointmentNos().isEmpty()) blocks.add("原批次已全部转入后续安排，请进入当前批次");
+        var actions=new ArrayList<String>();
+        var customers=batch.items().stream().map(FbaAppointmentResponse.Item::customerId).collect(java.util.stream.Collectors.toSet());
+        var covered=agreements.stream().filter(a->"ACTIVE".equals(a.status())).flatMap(a->a.members().stream()).filter(m->key.equals(m.batchKey())).map(Member::customerId).collect(java.util.stream.Collectors.toSet());
+        var waiting=pending.stream().map(p->p.intent().customerId()).collect(java.util.stream.Collectors.toSet());
+        var executionScope=execution.inspect(customers.stream().sorted().map(c->new FbaAppointmentExecutionPort.Member(key,c)).toList());
+        if(blocks.isEmpty()) {
+            if(customers.stream().anyMatch(c->!waiting.contains(c))) actions.add("PROPOSE_CUSTOMER_CHANGE");
+        }
+        if(batch.replacementAppointmentNos().isEmpty() && executionScope.members().stream().anyMatch(e->e.canRebook() && !e.completed() && !covered.contains(e.member().customerId()) && !waiting.contains(e.member().customerId()))) {
+            actions.add("BOOK_RECEIVING");actions.add("PLAN_RECEIVING");actions.add("REFRESH_CARGO");
+        }
+        return new Context(batch,agreements,pending,scope,List.copyOf(actions),List.copyOf(blocks),executionScope,store.plans(key));
+    }
+    @Transactional(readOnly=true)
+    public GroupContext groupContext(String key) {
+        var group=store.agreement(key,false);var eligible=new ArrayList<Member>();var excluded=new ArrayList<Excluded>();
+        var executionScope=execution.inspect(group.members().stream().map(m->new FbaAppointmentExecutionPort.Member(m.batchKey(),m.customerId())).toList());
+        for(var old:group.members()) {
+            var snapshot=batches.batchSnapshots(List.of(old.batchKey())).get(0);
+            var current=store.currentAgreement(old.batchKey(),old.customerId());
+            var member=snapshot.replacementAppointmentNos().isEmpty()?store.members(snapshot).stream().filter(m->m.customerId().equals(old.customerId())).findFirst().orElse(null):null;
+            String reason=!snapshot.replacementAppointmentNos().isEmpty()?"原批次已转入其他批次":member==null?"客户已移出本批":
+                store.hasPending(old.batchKey(),old.customerId())?"正在处理其他待确认变化":
+                current!=null && !current.agreementKey().equals(key)?"已另行预约":null;
+            var eligibility=executionScope.members().stream().filter(e->e.member().batchKey().equals(old.batchKey()) && e.member().customerId().equals(old.customerId())).findFirst().orElseThrow(()->conflict("客户执行资格读取不完整"));
+            if(reason==null && (eligibility.completed() || !eligibility.canRebook())) reason=eligibility.completed()?"本客户货物已实际履约完成":eligibility.reason();
+            if(reason==null && !eligibility.canRebook()) reason="本客户已开始执行，请从原运输异常处理";
+            if(reason==null) eligible.add(member);else excluded.add(new Excluded(old,reason,current==null?null:current.agreementKey()));
+        }
+        var transportMembers="CANCELLED".equals(group.status()) && !eligible.isEmpty()?eligible:group.members();
+        var scope=transport.inspect(transportMembers.stream().map(Member::batchKey).distinct().sorted().toList());
+        // Executed authority may block all further ordinary changes; no synthetic completion here.
+        var bookingScope=execution.inspect(eligible.stream().map(m->new FbaAppointmentExecutionPort.Member(m.batchKey(),m.customerId())).toList());
+        return new GroupContext(group,List.copyOf(eligible),List.copyOf(excluded),scope,bookingScope);
+    }
+    public Result propose(String operator,Propose request) {
+        return command("RECEIVING_PROPOSE",operator,request.idempotencyKey(),request,()->{
+            var intent=request.intent();var followup=work.resolveFollowup(intent.ownerId(),intent.nextFollowupDate());
+            var scope=transport.lockAndInspect(List.of(intent.batchKey()),intent.transportVersion());requireMutable(scope);
+            var batch=batches.lockReceivingBatch(intent.batchKey());requireVersion(batch,intent.batchVersion());
+            recheckTransport(List.of(intent.batchKey()),scope);
+            if(store.hasPending(intent.batchKey(),intent.customerId())) throw conflict("本客户已有待确认变化，请继续原记录");
+            var member=store.members(batch).stream().filter(m->m.customerId().equals(intent.customerId())).findFirst().orElseThrow(()->bad("客户不属于本批次"));
+            validateQuantities(member,intent);
+            var group=store.currentAgreement(batch.batchKey(),intent.customerId());
+            if(group!=null) {group=store.agreement(group.agreementKey(),true);requireActive(group);}
+            var pending=new Pending("CH-"+UUID.randomUUID().toString().replace("-","").toUpperCase(Locale.ROOT),0,"WAITING",intent,List.of(member),group==null?List.of():List.of(group),followup);
+            store.save(pending);
+            batches.receivingChanged(List.of(batch));
+            return new Result(pending.changeKey(),"WAITING",List.of(batch),pending.originalAgreements(),List.of(new Step("RECORD_CHANGE","SUCCESS",pending.changeKey(),"原安排及数量保留，待确认变化已阻止相关发车")),List.of("CONTINUE_WAREHOUSE_CONFIRMATION"));
+        });
+    }
+    public Result resolve(String operator,String changeKey,Resolve request) {
+        return command("RECEIVING_RESOLVE:"+changeKey,operator,request.idempotencyKey(),request,()->{
+            var initial=store.change(changeKey,false);var intent=initial.intent();
+            // Withdrawing only removes the pending proposal. It must remain possible after
+            // picking starts, without editing cargo, the appointment, or vehicle facts.
+            var withdrawing="WITHDRAW".equals(request.decision());
+            var followup=withdrawing?null:work.resolveFollowup(intent.ownerId(),intent.nextFollowupDate());
+            var scope=withdrawing?null:transport.lockAndInspect(List.of(intent.batchKey()),request.transportVersion());
+            if(!withdrawing) requireMutable(scope);
+            var batch=batches.lockReceivingBatch(intent.batchKey());var pending=store.change(changeKey,true);
+            if(pending.version()!=request.version() || !"WAITING".equals(pending.status())) throw conflict("变化已被处理，请重新读取当前结果");
+            if(withdrawing) {
+                var result=new Result(changeKey,"WITHDRAWN",List.of(batch),pending.originalAgreements(),List.of(new Step("WITHDRAW_CHANGE","SUCCESS",changeKey,"变化已撤回，原安排保留")),List.of("REVIEW_TRANSPORT"));
+                store.finish(pending,"WITHDRAWN",result);batches.receivingChanged(List.of(batch));return result;
+            }
+            if(!"CONFIRM".equals(request.decision()) || blank(request.warehouseEvidence())) throw bad("请填写仓库明确同意保留量及移出量的回复依据");
+            requireVersion(batch,intent.batchVersion());
+            Agreement original=null;
+            for(var expected:pending.originalAgreements()) {
+                var current=store.agreement(expected.agreementKey(),true);
+                if(current.version()!=expected.version() || !"ACTIVE".equals(current.status())) throw conflict("仓库预约覆盖已变化，不能沿旧回复处理");
+                original=current;
+            }
+            var currentKey=store.currentAgreement(intent.batchKey(),intent.customerId());
+            if(!Objects.equals(currentKey==null?null:currentKey.agreementKey(),original==null?null:original.agreementKey())) throw conflict("本客户有效预约关系已变化");
+            var changed=batches.moveReceivingCustomer(operator,intent);var retained=changed.get(0);var later=changed.get(1);
+            work.seedFollowup(new FbaAppointmentWorkPort.Member(intent.batchKey(),intent.customerId()),new FbaAppointmentWorkPort.Member(later.batchKey(),intent.customerId()),followup,operator);
+            var movements=new ArrayList<FbaAppointmentTransportPort.Move>();
+            for(var source:pending.originalMembers().get(0).sources()) {
+                var q=intent.quantities().stream().filter(v->v.sourceKey().equals(source.sourceKey()) && v.destinationKey().equals(source.destinationKey())).findFirst().orElseThrow();
+                movements.add(new FbaAppointmentTransportPort.Move(intent.batchKey(),intent.customerId(),source.sourceKey(),source.destinationKey(),source.packageCount(),q.retainedPackages(),later.batchKey()));
+            }
+            var physical=transport.apply(scope,List.copyOf(movements),operator,intent.reason());
+            var agreements=new ArrayList<Agreement>();
+            if(original!=null) {
+                var members=new ArrayList<>(original.members());members.removeIf(m->m.batchKey().equals(intent.batchKey()) && m.customerId().equals(intent.customerId()));
+                var remaining=store.members(retained).stream().filter(m->m.customerId().equals(intent.customerId())).findFirst();
+                if(remaining.isPresent()) members.add(remaining.get());else store.releaseMember(original.agreementKey(),intent.batchKey(),intent.customerId());
+                agreements.add(members.isEmpty()?store.cancel(original,"SUPERSEDED",request.warehouseEvidence()):store.update(original,members,original.details(),request.warehouseEvidence()));
+            }
+            var projected=retained.items().isEmpty()?retained:batches.projectReceiving(intent.batchKey(),false);
+            var steps=List.of(new Step("ALLOCATE_CARGO","SUCCESS",later.batchKey(),"原来源总量不变，后送量已落在新批次"),new Step("ADJUST_TRANSPORT","SUCCESS",intent.batchKey(),"原车辆按实际保留货物调整"));
+            var actions=new ArrayList<String>();actions.add("BOOK_LATER_BATCH");actions.addAll(physical.nextActions());
+            var result=new Result(changeKey,"APPLIED",List.of(projected,later),List.copyOf(agreements),steps,List.copyOf(actions));
+            store.finish(pending,"APPLIED",result);batches.receivingChanged(result.batches());return result;
+        });
+    }
+    public Result refreshCargo(String operator,RefreshCargo request) {
+        return command("RECEIVING_REFRESH_CARGO",operator,request.idempotencyKey(),request,()->{
+            var selection=request.member();var selected=List.of(new FbaAppointmentExecutionPort.Member(selection.batchKey(),selection.customerId()));
+            var locked=execution.lockAndInspect(selected,request.executionVersion());requireRebookable(selected,locked);
+            var batch=batches.lockReceivingBatch(selection.batchKey());requireVersion(batch,selection.batchVersion());
+            var current=execution.inspect(selected);
+            if(!Objects.equals(locked.version(),current.version())) throw conflict("客户执行关联已变化，请重新核对当前范围");
+            requireRebookable(selected,current);
+            if(store.hasPending(selection.batchKey(),selection.customerId())) throw conflict("本客户有待确认变化，请先处理或撤回原变化再核对资料");
+            if(store.currentAgreement(selection.batchKey(),selection.customerId())!=null) throw conflict("本客户已有正式确认，不能直接采用新货物资料，请先处理其有效预约");
+            var refreshed=batches.refreshReceivingCargo(selection.batchKey(),selection.customerId(),request.sources());
+            boolean changed=refreshed.version()!=batch.version();
+            return new Result(null,changed?"APPLIED":"UNCHANGED",List.of(refreshed),List.of(),changed?List.of(new Step("REFRESH_CARGO","SUCCESS",batch.batchKey(),"本客户已采用核对后的最新资料，批次数量及其他客户安排保留")):List.of(),List.of("CONTINUE_CUSTOMER_PLAN"));
+        });
+    }
+    public Result plan(String operator,Plan request) {
+        return command("RECEIVING_PLAN",operator,request.idempotencyKey(),request,()->{
+            var selection=request.member();var memberKey=new FbaAppointmentExecutionPort.Member(selection.batchKey(),selection.customerId());
+            var selected=List.of(memberKey);var locked=execution.lockAndInspect(selected,request.executionVersion());requireRebookable(selected,locked);
+            var batch=batches.lockReceivingBatch(selection.batchKey());requireVersion(batch,selection.batchVersion());
+            var current=execution.inspect(selected);
+            if(!Objects.equals(locked.version(),current.version())) throw conflict("客户执行关联已变化，请重新核对当前范围");
+            requireRebookable(selected,current);
+            if(store.hasPending(selection.batchKey(),selection.customerId())) throw conflict("本客户有待确认变化，请先处理原变化");
+            if(store.currentAgreement(selection.batchKey(),selection.customerId())!=null) throw conflict("本客户已有正式确认，请使用明确范围的改期或取消操作");
+            var member=store.member(batch,selection.customerId());if(member==null) throw conflict("客户已移出原批次");
+            var timezone=batches.validateReceivingPlan(member,request.details());
+            var plan=new CustomerPlan(batch.batchKey(),selection.customerId(),FbaReceivingStore.normalized(request.details()),timezone);
+            if(plan.equals(store.plan(batch.batchKey(),selection.customerId()))) return new Result(null,"UNCHANGED",List.of(batch),List.of(),List.of(),List.of("CONTINUE_CUSTOMER_PLAN"));
+            store.freezeUnconfirmedPlans(batch);
+            store.savePlan(plan);var projected=batches.projectReceiving(batch.batchKey(),false);
+            return new Result(null,"APPLIED",List.of(projected),List.of(),List.of(new Step("PLAN_RECEIVING","SUCCESS",batch.batchKey(),"仅本客户计划已保存，其他客户安排及货量保留")),List.of("CONTINUE_CUSTOMER_PLAN"));
+        });
+    }
+    public Result book(String operator,Book request) {
+        return command("RECEIVING_BOOK",operator,request.idempotencyKey(),request,()->{
+            if(request.bookings()==null || request.bookings().isEmpty() || request.bookings().size()>100) throw bad("请选择需要重新预约的客户");
+            var selections=request.bookings().stream().flatMap(b->b.members().stream()).toList();
+            var keys=selections.stream().map(Selection::batchKey).distinct().sorted().toList();
+            var executionMembers=selections.stream().map(s->new FbaAppointmentExecutionPort.Member(s.batchKey(),s.customerId())).distinct().toList();
+            var executionScope=execution.lockAndInspect(executionMembers,request.executionVersion());
+            requireRebookable(executionMembers,executionScope);
+            var snapshots=lock(keys);
+            // An unbound customer can acquire a new dispatch before we obtain the batch lock.
+            // Binding shares that batch lock, so rereading here closes the gap without reversing locks.
+            var currentExecution=execution.inspect(executionMembers);
+            if(!Objects.equals(executionScope.version(),currentExecution.version())) throw conflict("客户执行关联已变化，请重新核对当前范围");
+            requireRebookable(executionMembers,currentExecution);
+            snapshots.values().forEach(store::freezeUnconfirmedPlans);
+            Agreement cancelled=null;
+            if(request.cancelledAgreementKey()!=null) {
+                cancelled=store.agreement(request.cancelledAgreementKey(),true);
+                if(!"CANCELLED".equals(cancelled.status()) || !Objects.equals(cancelled.version(),request.cancelledAgreementVersion())) throw conflict("取消组版本已变化，请重新读取待重约范围");
+            }
+            var seen=new HashSet<String>();var saved=new ArrayList<Agreement>();
+            for(var booking:request.bookings()) {
+                if(blank(booking.warehouseEvidence()) || booking.members()==null || booking.members().isEmpty()) throw bad("请记录仓库确认覆盖本次客户和货量的依据");
+                var members=new ArrayList<Member>();
+                for(var selection:booking.members()) {
+                    if(!seen.add(selection.batchKey()+"/"+selection.customerId())) throw bad("同客户批次不能重复预约");
+                    var batch=snapshots.get(selection.batchKey());requireVersion(batch,selection.batchVersion());
+                    if(store.hasPending(selection.batchKey(),selection.customerId())) throw conflict("该客户有其他待确认变化，不能直接重约");
+                    if(store.currentAgreement(selection.batchKey(),selection.customerId())!=null) throw conflict("该客户已有有效收货预约，请明确变更当前预约范围");
+                    if(cancelled!=null && cancelled.members().stream().noneMatch(m->m.batchKey().equals(selection.batchKey()) && m.customerId().equals(selection.customerId()))) throw conflict("所选客户不属于该取消组的原覆盖范围");
+                    members.add(store.members(batch).stream().filter(m->m.customerId().equals(selection.customerId())).findFirst().orElseThrow(()->conflict("客户已移出原批次")));
+                }
+                var timezone=batches.validateReceiving(members,booking.details());saved.add(store.create(members,booking.details(),timezone,booking.warehouseEvidence()));
+                members.forEach(m->store.deletePlan(m.batchKey(),m.customerId()));
+            }
+            var projected=keys.stream().map(k->batches.projectReceiving(k,false)).toList();
+            return new Result(null,"APPLIED",projected,List.copyOf(saved),saved.stream().map(a->new Step("BOOK_RECEIVING","SUCCESS",a.agreementKey(),"使用原批次形成新的有效收货预约" )).toList(),List.of("REVIEW_TRANSPORT"));
+        });
+    }
+    public Result changeGroup(String operator,String key,GroupChange request) {
+        return command("RECEIVING_GROUP:"+key,operator,request.idempotencyKey(),request,()->{
+            var initial=store.agreement(key,false);var keys=initial.members().stream().map(Member::batchKey).distinct().sorted().toList();
+            var scope=transport.lockAndInspect(keys,request.transportVersion());requireMutable(scope);var snapshots=lock(keys);
+            recheckTransport(keys,scope);
+            var group=store.agreement(key,true);requireActive(group);
+            if(group.version()!=request.version()) throw conflict("共同预约范围已变化，请重新核对全部客户");
+            var members=new ArrayList<Member>();
+            for(var old:group.members()) {
+                if(store.hasPending(old.batchKey(),old.customerId())) throw conflict("当前成员有待确认变化，请先处理其实际范围");
+                var current=store.currentAgreement(old.batchKey(),old.customerId());
+                if(current==null || !key.equals(current.agreementKey())) throw conflict("成员已退出本预约，请重新读取范围");
+                members.add(store.members(snapshots.get(old.batchKey())).stream().filter(m->m.customerId().equals(old.customerId())).findFirst().orElseThrow(()->conflict("当前覆盖货物已变化")));
+            }
+            if(blank(request.warehouseEvidence())) throw bad("请记录本次仓库回复依据");
+            Agreement changed;
+            if("CANCEL".equals(request.action())) {
+                changed=store.cancel(group,"CANCELLED",request.warehouseEvidence());
+                members.forEach(m->store.deletePlan(m.batchKey(),m.customerId()));
+            }
+            else if("RESCHEDULE".equals(request.action())) {
+                batches.validateReceiving(members,request.details());
+                if(Objects.equals(group.details(),request.details())) return new Result(null,"UNCHANGED",List.copyOf(snapshots.values()),List.of(group),List.of(),List.of("REVIEW_TRANSPORT"));
+                changed=store.update(group,members,request.details(),request.warehouseEvidence());
+                if(changed.equals(group)) return new Result(null,"UNCHANGED",List.copyOf(snapshots.values()),List.of(group),List.of(),List.of("REVIEW_TRANSPORT"));
+            } else throw bad("请选择整份改期或整份取消");
+            var projected=keys.stream().map(k->batches.projectReceiving(k,"CANCEL".equals(request.action()))).toList();
+            return new Result(null,"APPLIED",projected,List.of(changed),List.of(new Step(request.action(),"SUCCESS",key,"按服务端当前覆盖成员处理，车辆和批次数量保留")),List.of("CANCEL".equals(request.action())?"REBOOK_GROUP":"REVIEW_TRANSPORT"));
+        });
+    }
+    private Map<String,FbaAppointmentResponse> lock(List<String> keys) {var result=new LinkedHashMap<String,FbaAppointmentResponse>();for(var key:keys) result.put(key,batches.lockReceivingBatch(key));return result;}
+    private void recheckTransport(List<String> keys,FbaAppointmentTransportPort.Scope locked) {
+        // Original bindings also lock the batch. Re-read after acquiring it to reject a new
+        // association created between the initial transport locks and the batch lock.
+        var current=transport.inspect(keys);
+        if(!Objects.equals(locked.version(),current.version())) throw conflict("运输关联已变化，请重新核对当前范围");
+        requireMutable(current);
+    }
+    private static void requireRebookable(List<FbaAppointmentExecutionPort.Member> members,FbaAppointmentExecutionPort.Scope scope) {
+        if(scope==null || scope.members()==null || !new HashSet<>(members).equals(scope.members().stream().map(FbaAppointmentExecutionPort.Eligibility::member).collect(java.util.stream.Collectors.toSet()))) throw conflict("客户执行资格读取不完整");
+        for(var member:scope.members()) if(member.completed() || !member.canRebook()) throw conflict(member.completed()?"已完成货物不能重新预约":blank(member.reason())?"本客户已开始执行，请从原运输异常处理":member.reason());
+    }
+    private static void validateQuantities(Member member,ChangeIntent intent) {
+        if(intent.quantities()==null || intent.quantities().size()!=member.sources().size()) throw bad("请填写本客户每票原来源的本次先送箱数");
+        var seen=new HashSet<String>();boolean changed=false;
+        for(var q:intent.quantities()) {
+            if(!seen.add(q.sourceKey()+"/"+q.destinationKey())) throw bad("来源不可重复");
+            var source=member.sources().stream().filter(s->s.sourceKey().equals(q.sourceKey()) && s.destinationKey().equals(q.destinationKey())).findFirst().orElseThrow(()->bad("所选来源不属于本客户批次"));
+            if(q.retainedPackages()<0 || q.retainedPackages()>source.packageCount()) throw bad("本次先送量须在零至本批箱数之间");
+            if(!Objects.equals(q.expectedSourceVersion(),source.sourceVersion()) || !Objects.equals(q.expectedVerificationVersion(),source.verificationVersion())) throw conflict("来源或核实版本已变化");
+            changed|=q.retainedPackages()!=source.packageCount();
+        }
+        if(!changed) throw bad("本次货量没有变化，无需保存调整");
+    }
+    private Result command(String operation,String operator,String key,Object request,Supplier<Result> action) {
+        if(blank(operator)||blank(key)||key.length()>64) throw bad("操作人及请求标识不能为空");
+        String hash;
+        try {hash=HexFormat.of().formatHex(java.security.MessageDigest.getInstance("SHA-256").digest((operation+"\n"+operator+"\n"+store.write(request)).getBytes(java.nio.charset.StandardCharsets.UTF_8)));}catch(Exception e){throw new IllegalStateException(e);}
+        var existing=commands.find(key);if(existing!=null) return replay(existing,hash);
+        try {commands.begin(key,hash,operation,operator,LocalDateTime.now(ZoneOffset.UTC));}catch(DuplicateKeyException duplicate){return replay(commands.find(key),hash);}
+        try {
+            var result=action.get();
+            if(commands.finish(key,result.batches().isEmpty()?null:result.batches().get(0).appointmentNo(),store.write(result))!=1) throw conflict("命令结果未保存");
+            return result;
+        } catch(DuplicateKeyException duplicate) {throw conflict("当前目的仓约号或客户覆盖已被其他预约使用，请重新读取范围");}
+    }
+    private Result replay(FbaAppointmentCommandMapper.Command row,String hash) {
+        if(row==null || !hash.equals(row.requestHash()) || row.responseJson()==null) throw conflict("同一请求标识的内容不同或结果尚未就绪");
+        return store.read(row.responseJson(),Result.class);
+    }
+    private static void requireVersion(FbaAppointmentResponse batch,int version) {if(batch.version()!=version) throw conflict("批次已更新，请刷新后重新核对");}
+    private static void requireActive(Agreement group) {if(!"ACTIVE".equals(group.status())) throw conflict("原收货预约已失效，请使用重新预约入口");}
+    private static void requireMutable(FbaAppointmentTransportPort.Scope scope) {if(!scope.blockReasons().isEmpty()) throw conflict(String.join("；",scope.blockReasons()));}
+    private static boolean blank(String s) {return s==null || s.isBlank();}
+    private static ResponseStatusException bad(String message) {return new ResponseStatusException(HttpStatus.BAD_REQUEST,message);}
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/receiving/FbaReceivingStore.java b/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/receiving/FbaReceivingStore.java
new file mode 100644
index 000000000..daed8dea8
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/receiving/FbaReceivingStore.java
@@ -0,0 +1,147 @@
+package com.baiyue.lastleg.inboundplan.receiving;
+
+import com.baiyue.lastleg.inboundplan.dto.*;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import org.springframework.stereotype.Component;
+import org.springframework.http.HttpStatus;
+import org.springframework.web.server.ResponseStatusException;
+import java.util.*;
+import static com.baiyue.lastleg.inboundplan.receiving.FbaReceivingContracts.*;
+
+/** Persisted receiving authority. All mutations run inside the caller's batch-locked transaction. */
+@Component
+public class FbaReceivingStore {
+    private final FbaReceivingMapper mapper;
+    private final ObjectMapper json;
+    public FbaReceivingStore(FbaReceivingMapper mapper,ObjectMapper json) { this.mapper=mapper;this.json=json; }
+    public boolean hasPending(String batchKey,String customerId) { return mapper.pendingCount(batchKey,customerId)>0; }
+    /** Three bounded queries for calendar/work providers; never a per-batch query loop. */
+    public List<BatchReceiving> snapshots(List<String> batchKeys) {
+        if(batchKeys==null || batchKeys.isEmpty()) return List.of();
+        if(batchKeys.size()>200 || batchKeys.stream().anyMatch(k->k==null || !k.matches("FBA_APPOINTMENT:[1-9][0-9]*"))) throw new ResponseStatusException(HttpStatus.BAD_REQUEST,"每次最多读取200个有效批次");
+        var groups=new HashMap<String,List<Agreement>>();var pending=new HashMap<String,List<Pending>>();var plans=new HashMap<String,List<CustomerPlan>>();
+        for(var row:mapper.currentGroups(batchKeys)) groups.computeIfAbsent(row.batchKey(),k->new ArrayList<>()).add(read(row.snapshotJson(),Agreement.class));
+        for(var row:mapper.pendingGroups(batchKeys)) pending.computeIfAbsent(row.batchKey(),k->new ArrayList<>()).add(read(row.snapshotJson(),Pending.class));
+        for(var row:mapper.plans(batchKeys)) plans.computeIfAbsent(row.batchKey(),k->new ArrayList<>()).add(read(row.snapshotJson(),CustomerPlan.class));
+        return batchKeys.stream().distinct().map(k->new BatchReceiving(k,List.copyOf(groups.getOrDefault(k,List.of())),List.copyOf(pending.getOrDefault(k,List.of())),List.copyOf(plans.getOrDefault(k,List.of())))).toList();
+    }
+    public List<CustomerPlan> plans(String batchKey) { return mapper.plans(List.of(batchKey)).stream().map(r->read(r.snapshotJson(),CustomerPlan.class)).toList(); }
+    public CustomerPlan plan(String batchKey,String customerId) { return plans(batchKey).stream().filter(p->customerId.equals(p.customerId())).findFirst().orElse(null); }
+    public CustomerPlan savePlan(CustomerPlan input) {
+        var saved=new CustomerPlan(input.batchKey(),input.customerId(),normalized(input.details()),input.timezone());
+        mapper.deletePlan(saved.batchKey(),saved.customerId());
+        mapper.insertPlan(new FbaReceivingMapper.PlanRow(saved.batchKey(),saved.customerId(),write(saved)));return saved;
+    }
+    public void deletePlan(String batchKey,String customerId) { mapper.deletePlan(batchKey,customerId); }
+    /** Preserve each still-unconfirmed customer's old target before changing the aggregate header. */
+    public void freezeUnconfirmedPlans(FbaAppointmentResponse batch) {
+        if(!Set.of("PENDING","FAILED").contains(batch.appointmentStatus())) return;
+        var existing=plans(batch.batchKey()).stream().map(CustomerPlan::customerId).collect(java.util.stream.Collectors.toSet());
+        var covered=agreements(batch.batchKey()).stream().filter(a->"ACTIVE".equals(a.status())).flatMap(a->a.members().stream()).filter(m->batch.batchKey().equals(m.batchKey())).map(Member::customerId).collect(java.util.stream.Collectors.toSet());
+        var details=new FbaAppointmentDetails(batch.plannedDate(),batch.plannedAt(),batch.plannedEndAt(),null,null,null,batch.appointmentStatus(),batch.appointmentRemark(),null,null);
+        for(var customer:batch.items().stream().map(FbaAppointmentResponse.Item::customerId).distinct().toList())
+            if(!existing.contains(customer) && !covered.contains(customer)) savePlan(new CustomerPlan(batch.batchKey(),customer,details,batch.timezone()));
+    }
+    public Agreement currentAgreement(String batchKey,String customerId) {
+        var key=mapper.currentKey(batchKey,customerId);return key==null?null:agreement(key,false);
+    }
+    public List<Agreement> agreements(String batchKey) { return mapper.groupKeys(batchKey).stream().map(k->agreement(k,false)).toList(); }
+    public List<Pending> pending(String batchKey) { return mapper.pending(batchKey).stream().map(r->read(r.snapshotJson(),Pending.class)).toList(); }
+    public List<String> successorKeys(String batchKey) {
+        return mapper.appliedResults(batchKey).stream().map(r->read(r,Result.class)).flatMap(r->r.batches().stream())
+            .map(FbaAppointmentResponse::batchKey).filter(k->!k.equals(batchKey)).distinct().toList();
+    }
+    public List<com.baiyue.lastleg.appointmentplanning.AppointmentCoverageService.SourceRef> originalSources(String batchKey) {
+        return mapper.appliedChanges(batchKey).stream().map(r->read(r,Pending.class)).flatMap(p->p.originalMembers().stream())
+            .flatMap(m->m.sources().stream().map(s->new com.baiyue.lastleg.appointmentplanning.AppointmentCoverageService.SourceRef(m.customerId(),s.sourceKey(),s.destinationKey()))).distinct().toList();
+    }
+    public Agreement agreement(String key,boolean lock) {
+        var row=lock?mapper.lockGroup(key):mapper.group(key);
+        if(row==null) throw new ResponseStatusException(HttpStatus.NOT_FOUND,"收货预约不存在");
+        return read(row.snapshotJson(),Agreement.class);
+    }
+    public List<Member> members(FbaAppointmentResponse batch) {
+        return members(batch,null);
+    }
+    public Member member(FbaAppointmentResponse batch,String customerId) {return members(batch,customerId).stream().findFirst().orElse(null);}
+    private List<Member> members(FbaAppointmentResponse batch,String customerId) {
+        var labels=new HashMap<String,String>();for(var label:mapper.labels(batch.batchKey())) if(label.customerName()!=null) labels.putIfAbsent(label.customerId(),label.customerName());
+        var grouped=new LinkedHashMap<String,List<Source>>();
+        for(var i:batch.items()) {
+            if(customerId!=null && !customerId.equals(i.customerId())) continue;
+            if(i.packageCount()==null || i.packageCount()<=0) throw conflict("请先核实本批各票箱数，再调整收货范围");
+            grouped.computeIfAbsent(i.customerId(),ignored->new ArrayList<>()).add(new Source(i.sourceKey(),i.destinationKey(),i.packageCount(),i.sourceVersion(),i.cargoVerificationVersion(),i.inboundCode()));
+        }
+        return grouped.entrySet().stream().map(e->new Member(batch.batchKey(),batch.appointmentNo(),batch.version(),e.getKey(),List.copyOf(e.getValue()),labels.get(e.getKey()))).toList();
+    }
+    public Agreement create(List<Member> members,FbaAppointmentDetails details,String timezone,String evidence) {
+        details=normalized(details);
+        String destination=members.get(0).sources().get(0).destinationKey();
+        var group=new Agreement("RA-"+UUID.randomUUID().toString().replace("-","").toUpperCase(Locale.ROOT),0,"ACTIVE",destination,details,timezone,List.copyOf(members),evidence);
+        try {
+            mapper.insertGroup(row(group));mapper.revision(row(group));
+            for(var member:members) mapper.addMember(group.agreementKey(),member.batchKey(),member.customerId(),member.batchKey()+"/"+member.customerId());
+        } catch(org.springframework.dao.DuplicateKeyException duplicate) {throw conflict("该目的仓约号或客户覆盖已被其他有效预约使用");}
+        return group;
+    }
+    public Agreement update(Agreement old,List<Member> members,FbaAppointmentDetails details,String evidence) {
+        details=normalized(details);
+        if(Objects.equals(old.details(),details) && coverage(old.members()).equals(coverage(members))) return old;
+        var group=new Agreement(old.agreementKey(),old.version()+1,old.status(),old.destinationKey(),details,old.timezone(),List.copyOf(members),evidence);
+        try {mapper.updateGroup(row(group));mapper.revision(row(group));} catch(org.springframework.dao.DuplicateKeyException duplicate) {throw conflict("该目的仓约号已被其他有效预约使用");}return group;
+    }
+    public Agreement cancel(Agreement old,String status,String evidence) {
+        var group=new Agreement(old.agreementKey(),old.version()+1,status,old.destinationKey(),old.details(),old.timezone(),old.members(),evidence);
+        mapper.releaseGroup(old.agreementKey());mapper.updateGroup(row(group));mapper.revision(row(group));return group;
+    }
+    public void releaseMember(String group,String batch,String customer) { mapper.releaseMember(group,batch,customer); }
+    public void assertLegacyEditable(String batchKey) {
+        assertRepartitionable(batchKey);
+        if(!plans(batchKey).isEmpty()) throw conflict("本批已有按客户维护的计划，请按客户继续处理，不能整批覆盖或取消");
+    }
+    public void assertRepartitionable(String batchKey) {
+        if(!pending(batchKey).isEmpty()) throw conflict("本批有待仓库确认的变化，请从变化记录继续处理");
+        var active=agreements(batchKey).stream().filter(a->"ACTIVE".equals(a.status())).toList();
+        if(active.size()>1 || active.stream().anyMatch(a->a.members().stream().anyMatch(m->!m.batchKey().equals(batchKey))))
+            throw conflict("本批属于独立收货或跨批共同预约，请使用明确范围的收货预约操作");
+        if(!active.isEmpty()) {
+            var actual=new HashSet<>(mapper.liveSources(batchKey));
+            var covered=new HashSet<FbaReceivingMapper.LiveSource>();
+            for(var member:active.get(0).members()) {
+                if(!Objects.equals(mapper.currentKey(batchKey,member.customerId()),active.get(0).agreementKey())) throw conflict("本批客户覆盖关系已变化，请按当前收货范围操作");
+                for(var source:member.sources()) covered.add(new FbaReceivingMapper.LiveSource(member.customerId(),source.sourceKey(),source.destinationKey(),source.packageCount()));
+            }
+            if(!actual.equals(covered)) throw conflict("本批仅部分客户已取得确认，请分别处理当前客户或明确共同预约范围");
+        }
+    }
+    /** Existing single-batch commands produce the same receiving authority; no read-time reconstruction. */
+    public void synchronize(Object result) {
+        if(!(result instanceof FbaAppointmentResponse batch)) return;
+        var active=agreements(batch.batchKey()).stream().filter(a->"ACTIVE".equals(a.status())).toList();
+        if("SUCCESS".equals(batch.appointmentStatus())) {
+            var details=new FbaAppointmentDetails(batch.plannedDate(),batch.plannedAt(),batch.plannedEndAt(),batch.confirmationNo(),batch.appointmentAt(),batch.appointmentEndAt(),"SUCCESS",batch.appointmentRemark(),null,null);
+            if(active.isEmpty()) create(members(batch),details,batch.timezone(),"登记收货方正式确认");
+            else update(active.get(0),members(batch),details,"登记收货方正式确认");
+        } else for(var agreement:active) cancel(agreement,"CANCELLED".equals(batch.appointmentStatus())?"CANCELLED":"SUPERSEDED","原预约结果已变更");
+    }
+    public Pending change(String key,boolean lock) {
+        var row=lock?mapper.lockChange(key):mapper.change(key);
+        if(row==null) throw new ResponseStatusException(HttpStatus.NOT_FOUND,"预约变化记录不存在");
+        return read(row.snapshotJson(),Pending.class);
+    }
+    public void save(Pending change) { mapper.insertChange(new FbaReceivingMapper.ChangeRow(change.changeKey(),change.version(),change.status(),change.intent().batchKey(),change.intent().customerId(),write(change),null)); }
+    public void finish(Pending old,String status,Result result) {
+        var updated=new Pending(old.changeKey(),old.version()+1,status,old.intent(),old.originalMembers(),old.originalAgreements(),old.followup());
+        mapper.finishChange(new FbaReceivingMapper.ChangeRow(old.changeKey(),updated.version(),status,old.intent().batchKey(),old.intent().customerId(),write(updated),write(result)));
+    }
+    private static List<String> coverage(List<Member> members) {
+        return members.stream().flatMap(m->m.sources().stream().map(s->List.of(m.batchKey(),m.customerId(),s.sourceKey(),s.destinationKey(),s.packageCount(),Objects.toString(s.sourceVersion(),""),Objects.toString(s.verificationVersion(),"")).toString())).sorted().toList();
+    }
+    static FbaAppointmentDetails normalized(FbaAppointmentDetails d) {
+        return new FbaAppointmentDetails(d.plannedAt()==null?d.plannedDate():d.plannedAt().toLocalDate(),d.plannedAt(),d.plannedEndAt(),d.confirmationNo()==null?null:d.confirmationNo().trim(),d.appointmentAt(),d.appointmentEndAt(),d.appointmentStatus(),d.appointmentRemark()==null?null:d.appointmentRemark().trim(),d.startOffset(),d.endOffset());
+    }
+    private FbaReceivingMapper.GroupRow row(Agreement a) { return new FbaReceivingMapper.GroupRow(a.agreementKey(),a.version(),a.status(),a.destinationKey(),"ACTIVE".equals(a.status())?a.details().confirmationNo():null,write(a)); }
+    public String write(Object value) {try{return json.writeValueAsString(value);}catch(Exception e){throw new IllegalStateException("预约记录无法保存",e);} }
+    public <T>T read(String value,Class<T> type) {try{return json.readValue(value,type);}catch(Exception e){throw new IllegalStateException("预约记录无法读取",e);} }
+    static ResponseStatusException conflict(String message) { return new ResponseStatusException(HttpStatus.CONFLICT,message); }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/service/InboundAppointmentSourceLinker.java b/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/service/InboundAppointmentSourceLinker.java
new file mode 100644
index 000000000..fbc023c9d
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/service/InboundAppointmentSourceLinker.java
@@ -0,0 +1,46 @@
+package com.baiyue.lastleg.inboundplan.service;
+
+import com.baiyue.lastleg.appointmentplanning.AppointmentSourceLinker;
+import com.baiyue.lastleg.appointmentplanning.AppointmentExternalSourceGateway;
+
+import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
+import com.baomidou.mybatisplus.core.conditions.update.LambdaUpdateWrapper;
+import com.baiyue.lastleg.inboundplan.entity.InboundFbaAppointmentItem;
+import com.baiyue.lastleg.inboundplan.mapper.InboundFbaAppointmentItemMapper;
+import com.baiyue.lastleg.mapper.LastlegOrderMapper;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Propagation;
+import org.springframework.transaction.annotation.Transactional;
+import org.springframework.web.server.ResponseStatusException;
+import org.springframework.http.HttpStatus;
+import java.util.List;
+import java.util.Objects;
+
+/** Called by actual incoming materialization, never as a migration or historical data repair. */
+@Service
+public class InboundAppointmentSourceLinker implements AppointmentSourceLinker {
+    private final LastlegOrderMapper orders;
+    private final InboundFbaAppointmentItemMapper items;
+    private final AppointmentExternalSourceGateway bookings;
+    public InboundAppointmentSourceLinker(LastlegOrderMapper orders,InboundFbaAppointmentItemMapper items,AppointmentExternalSourceGateway bookings) {this.orders=orders;this.items=items;this.bookings=bookings;}
+    @Override
+    @Transactional(propagation=Propagation.MANDATORY)
+    public void materialized(String customerId,String bookingNo,Long orderId) {
+        var ref=new AppointmentExternalSourceGateway.SourceRef(customerId,bookingNo);
+        bookings.lockForAppointment(List.of(ref));
+        var matched=bookings.resolve(List.of(ref));
+        if(matched.size()!=1 || !Objects.equals(matched.get(0).customerId(),customerId) || !Objects.equals(matched.get(0).bookingNo(),bookingNo) || !Objects.equals(matched.get(0).orderId(),orderId)) throw conflict("来货与原登记的归属不一致，请核对");
+        var order=orderId==null?null:orders.selectById(orderId);
+        if(order==null || !Objects.equals(order.getCustomerId(),customerId)) throw conflict("来货尚未形成对应客户的真实货物");
+        var rows=items.selectList(new LambdaQueryWrapper<InboundFbaAppointmentItem>().eq(InboundFbaAppointmentItem::getSourceKey,"BOOKING:"+bookingNo)
+            .eq(InboundFbaAppointmentItem::getCustomerId,customerId).eq(InboundFbaAppointmentItem::getActive,true).last("FOR UPDATE"));
+        for(var row:rows) {
+            if(row.getOrderId()!=null && !row.getOrderId().equals(orderId)) throw conflict("原预约已关联其他来货，不能自动改绑");
+            if(Objects.equals(row.getOrderId(),orderId) && Objects.equals(row.getInboundCode(),order.getInboundCode())) continue;
+            try {items.update(null,new LambdaUpdateWrapper<InboundFbaAppointmentItem>().eq(InboundFbaAppointmentItem::getId,row.getId()).eq(InboundFbaAppointmentItem::getActive,true)
+                .set(InboundFbaAppointmentItem::getOrderId,orderId).set(InboundFbaAppointmentItem::getInboundCode,order.getInboundCode()));}
+            catch(org.springframework.dao.DuplicateKeyException duplicate){throw conflict("该来货已有其他有效预约，请先核对原安排");}
+        }
+    }
+    private static ResponseStatusException conflict(String message){return new ResponseStatusException(HttpStatus.CONFLICT,message);}
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/service/InboundFbaAppointmentService.java b/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/service/InboundFbaAppointmentService.java
index 5e5a52ebc..cec90b860 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/service/InboundFbaAppointmentService.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/service/InboundFbaAppointmentService.java
@@ -29,13 +29,18 @@ public class InboundFbaAppointmentService {
     @Resource private FbaAppointmentCommandMapper commands;
     @Resource private AppointmentSourceService sources;
     @Resource private AppointmentBatchPreviewMapper flags;
+    @Resource private AppointmentCargoVerificationService verification;
     @Resource private ObjectMapper json;
+    @Resource private com.baiyue.lastleg.inboundplan.receiving.FbaReceivingStore receiving;
+    @Resource private com.baiyue.lastleg.inboundplan.receiving.FbaAppointmentWorkPort receivingWork;
+    @Resource private com.baiyue.lastleg.inboundplan.work.AppointmentWorkAppointmentChanges workChanges;
 
     @Transactional(readOnly=true)
     public List<FbaAppointmentResponse> calendar(LocalDate from,LocalDate to) {
         if(from==null || to==null || !to.isAfter(from) || ChronoUnit.DAYS.between(from,to)>42) throw bad("日历查询范围必须为1至42天");
         var query=new LambdaQueryWrapper<InboundFbaAppointment>()
-            .notIn(InboundFbaAppointment::getAppointmentStatus,List.of("CANCELLED","FAILED"))
+            .isNull(InboundFbaAppointment::getReplacementNosJson)
+            .ne(InboundFbaAppointment::getAppointmentStatus,"CANCELLED")
             .apply("COALESCE(appointment_at,planned_at,planned_date)<{1} AND (COALESCE(appointment_at,planned_at,planned_date)>={0} OR CASE WHEN appointment_at IS NOT NULL THEN appointment_end_at WHEN planned_at IS NOT NULL THEN planned_end_at ELSE NULL END>{0})",from.atStartOfDay(),to.atStartOfDay())
             .orderByAsc(InboundFbaAppointment::getId);
         return responses(appointmentMapper.selectList(query));
@@ -44,9 +49,9 @@ public class InboundFbaAppointmentService {
     public PageResult<FbaAppointmentResponse> unscheduled(int page,int size) {
         if(page<1 || size<1 || size>100) throw bad("分页参数无效");
         var query=new LambdaQueryWrapper<InboundFbaAppointment>()
+            .isNull(InboundFbaAppointment::getReplacementNosJson)
             .isNull(InboundFbaAppointment::getAppointmentAt).isNull(InboundFbaAppointment::getPlannedAt)
-            .isNull(InboundFbaAppointment::getPlannedDate)
-            .notIn(InboundFbaAppointment::getAppointmentStatus,List.of("CANCELLED","FAILED"));
+            .isNull(InboundFbaAppointment::getPlannedDate);
         long total=appointmentMapper.selectCount(query);
         var rows=appointmentMapper.selectList(query.orderByDesc(InboundFbaAppointment::getCreatedAt)
             .last("LIMIT "+size+" OFFSET "+(long)(page-1)*size));
@@ -66,10 +71,13 @@ public class InboundFbaAppointmentService {
     }
     @Transactional(isolation=org.springframework.transaction.annotation.Isolation.READ_COMMITTED)
     public FbaAppointmentResponse createFromSources(String operatorId,SourceFbaAppointmentRequest request) {
-        return command("CREATE_FROM_SOURCES",operatorId,request.idempotencyKey(),request,()->create(operatorId,request.sources(),request.originWarehouseId(),request.fbaWarehouseCode(),request.details()));
+        return command("CREATE_FROM_SOURCES",operatorId,request.idempotencyKey(),request,()->create(operatorId,
+            request.sources()==null?null:request.sources().stream().map(source->source==null?null:
+                new AppointmentCoverageService.SourceRef(source.customerId(),source.sourceKey(),source.destinationKey())).toList(),
+            request.originWarehouseId(),request.fbaWarehouseCode(),request.details()));
     }
     private FbaAppointmentResponse create(String operator,List<AppointmentCoverageService.SourceRef> refs,String expectedOrigin,String expectedDestination,FbaAppointmentDetails details) {
-        var resolved=resolveForWrite(refs,null);
+        var resolved=resolveForWrite(refs);
         var group=group(resolved);
         if(clean(expectedOrigin)==null || clean(expectedDestination)==null) throw bad("请选择接仓点和目的仓后重新核对货物");
         if(!Objects.equals(group.originWarehouseId(),expectedOrigin) || !Objects.equals(group.destinationKey(),"FBA:"+expectedDestination)) throw conflict("接仓点或目的仓已变化，请重新核对预约货物");
@@ -80,11 +88,12 @@ public class InboundFbaAppointmentService {
         appointment.setFbaWarehouseCode(resolved.get(0).destinationWarehouseCode());
         appointment.setSelectedCount(resolved.size());appointment.setVersion(0);
         appointment.setCreatedBy(operator);appointment.setCreatedAt(now());appointment.setUpdatedAt(appointment.getCreatedAt());
-        apply(appointment,details,resolved);
+        var evidence=verification(resolved);
+        apply(appointment,details,resolved,evidence);
         if(Set.of("FAILED","CANCELLED").contains(appointment.getAppointmentStatus())) throw bad("新安排请先保存待确认或登记已取得的正式确认");
         try {appointmentMapper.insert(appointment);}
         catch(DuplicateKeyException duplicate){throw conflict("该目的仓的外部约号已有记录，请继续原预约");}
-        writeItems(appointment,resolved,List.of());
+        writeItems(appointment,resolved,List.of(),evidence,Map.of());
         return response(appointment,items(appointment.getId()));
     }
 
@@ -93,28 +102,132 @@ public class InboundFbaAppointmentService {
         var appointment=find(appointmentNo,false);if(appointment==null) throw missing();
         return response(appointment,items(appointment.getId()));
     }
+    /** Internal read boundary. Caller authorizes source access; includes cancelled/replaced history so demand is not silently erased. */
+    @Transactional(readOnly=true)
+    public List<FbaAppointmentResponse> relatedBatchSnapshots(List<AppointmentCoverageService.SourceRef> refs) {
+        if(refs==null || refs.isEmpty()) return List.of();
+        if(refs.size()>100 || refs.stream().anyMatch(ref->ref==null || clean(ref.customerId())==null || clean(ref.sourceKey())==null || clean(ref.destinationKey())==null)) throw bad("每次最多读取100个完整原来源的关联批次");
+        var ids=queryMapper.relatedBatchIds(refs.stream().distinct().toList());
+        if(ids.size()>1000) throw new ResponseStatusException(HttpStatus.SERVICE_UNAVAILABLE,"关联批次超过读取范围，请缩小原来源范围后继续核对");
+        return ids.isEmpty()?List.of():responses(appointmentMapper.selectBatchIds(ids));
+    }
+    @Transactional(readOnly=true)
+    public FbaAppointmentBatchContext batchContext(String key) {
+        final long id;
+        try {id=Long.parseLong(key.substring("FBA_APPOINTMENT:".length()));if(id<=0 || !key.equals(batchKey(id))) throw new IllegalArgumentException();}
+        catch(RuntimeException error) {throw bad("批次关联键无效");}
+        var appointment=appointmentMapper.selectById(id);if(appointment==null) throw missing();
+        var rows=items(id);if(appointment.getReplacementNosJson()==null) rows=rows.stream().filter(i->Boolean.TRUE.equals(i.getActive())).toList();var snapshot=response(appointment,rows);
+        var originalRefs=originalSourceRefs(snapshot);
+        var reasons=new ArrayList<String>();var actions=new ArrayList<String>();
+        if(appointment.getReplacementNosJson()!=null) reasons.add("原批次已被分批或合并，请进入替代批次");
+        if(!"PENDING".equals(appointment.getAppointmentStatus())) reasons.add("仅未取得正式确认的活动批次可分批或合并");
+        if(queryMapper.countActiveDispatches(id)>0) reasons.add("已关联排车，请先处理运输安排");
+        try {receiving.assertRepartitionable(key);} catch(ResponseStatusException error) {
+            if(error.getStatusCode().value()!=409) throw error;
+            reasons.add(error.getReason());
+        }
+        if(!reasons.isEmpty()) return new FbaAppointmentBatchContext(snapshot,List.of(),List.of(),List.copyOf(reasons),currentBatches(snapshot,originalRefs),originalRefs);
+        var refs=rows.stream().map(item->new AppointmentCoverageService.SourceRef(item.getCustomerId(),item.getSourceKey(),"FBA:"+appointment.getFbaWarehouseCode())).toList();
+        var resolved=sources.resolveBatch(refs);var evidence=verification(resolved);
+        if(resolved.stream().anyMatch(s->!Objects.equals(s.originWarehouseId(),appointment.getOriginWarehouseId()) || !Objects.equals(s.destinationWarehouseCode(),appointment.getFbaWarehouseCode()))) reasons.add("原来源起讫点已变化，请先复核原批次");
+        var originalItems=rows.stream().collect(Collectors.toMap(InboundFbaAppointmentItem::getSourceKey,item->item));
+        var allocations=new ArrayList<FbaAppointmentBatchContext.SourceAllocation>();
+        for(var source:resolved) {
+            var item=originalItems.get(source.sourceKey());var verified=evidence.get(source.sourceKey());
+            var other=queryMapper.allocation(source.customerId(),source.sourceKey(),source.orderId(),id);
+            Integer total=quantity(source,evidence),count=item.getPackageCount();
+            if(count==null && total!=null && other.unknownCount()==0 && other.packages()<total) count=Math.toIntExact(total-other.packages());
+            if(!source.canFollowup()) reasons.add(source.blockReasons().isEmpty()?"原来源当前不可安排":String.join("；",source.blockReasons()));
+            if(!Objects.equals(source.sourceVersion(),item.getSourceVersion())) reasons.add("原批次来源版本已变化，请先保存核对后的预约安排");
+            if(total==null || count==null || count<=0 || other.unknownCount()>0 || (long)count+other.packages()>total) reasons.add("原来源箱数或分配总量待核实");
+            allocations.add(new FbaAppointmentBatchContext.SourceAllocation(source.customerId(),source.sourceKey(),source.destinationKey(),count,
+                source.packages(),source.sourceVersion(),verified==null?null:verified.version(),verified==null?List.of():verified.shipmentReferences()));
+        }
+        if(resolved.stream().allMatch(AppointmentSourceService.Source::canFollowup)) actions.add("VERIFY_CARGO");
+        if(reasons.isEmpty()) {
+            if(allocations.stream().mapToLong(a->a.packageCount()).sum()>1) actions.add("SPLIT");
+            actions.add("MERGE");
+        }
+        return new FbaAppointmentBatchContext(snapshot,List.copyOf(allocations),List.copyOf(actions),reasons.stream().distinct().toList(),currentBatches(snapshot,originalRefs),originalRefs);
+    }
+    private List<FbaAppointmentBatchContext.SourceRef> originalSourceRefs(FbaAppointmentResponse original) {
+        var refs=new LinkedHashSet<FbaAppointmentBatchContext.SourceRef>();
+        original.items().forEach(item->refs.add(new FbaAppointmentBatchContext.SourceRef(item.customerId(),item.sourceKey(),item.destinationKey())));
+        receiving.originalSources(original.batchKey()).forEach(ref->refs.add(new FbaAppointmentBatchContext.SourceRef(ref.customerId(),ref.sourceKey(),ref.destinationKey())));
+        return List.copyOf(refs);
+    }
+    /** Follow all replacement branches. Shared merge descendants are returned once, never just the first branch. */
+    private List<FbaAppointmentResponse> currentBatches(FbaAppointmentResponse original,List<FbaAppointmentBatchContext.SourceRef> originalRefs) {
+        var sourceRefs=new HashSet<>(originalRefs);
+        var graph=new LinkedHashMap<String,FbaAppointmentResponse>();graph.put(original.batchKey(),original);
+        var pending=new LinkedHashSet<>(original.replacementBatchKeys());
+        pending.addAll(receiving.successorKeys(original.batchKey()));
+        while(!pending.isEmpty()) {
+            if(graph.size()+pending.size()>1000) throw new ResponseStatusException(HttpStatus.SERVICE_UNAVAILABLE,"批次去向超过读取范围，请缩小范围后核对");
+            var keys=new ArrayList<>(pending);pending.clear();
+            for(int start=0;start<keys.size();start+=200) {
+                for(var batch:batchSnapshots(keys.subList(start,Math.min(start+200,keys.size())))) graph.put(batch.batchKey(),batch);
+            }
+            for(var batch:graph.values()) {
+                var nextKeys=new ArrayList<>(batch.replacementBatchKeys());nextKeys.addAll(receiving.successorKeys(batch.batchKey()));
+                for(var next:nextKeys) if(!graph.containsKey(next)) pending.add(next);
+            }
+        }
+        var visiting=new HashSet<String>();var visited=new HashSet<String>();
+        verifyReplacementGraph(original.batchKey(),graph,visiting,visited);
+        return graph.values().stream().filter(batch->batch.replacementAppointmentNos().isEmpty())
+            .filter(batch->batch.items().stream().anyMatch(item->sourceRefs.contains(new FbaAppointmentBatchContext.SourceRef(item.customerId(),item.sourceKey(),item.destinationKey()))))
+            .toList();
+    }
+    private static void verifyReplacementGraph(String key,Map<String,FbaAppointmentResponse> graph,Set<String> visiting,Set<String> visited) {
+        if(visited.contains(key)) return;
+        if(!visiting.add(key)) throw conflict("批次去向存在循环，请核对原业务记录");
+        for(var next:graph.get(key).replacementBatchKeys()) verifyReplacementGraph(next,graph,visiting,visited);
+        visiting.remove(key);visited.add(key);
+    }
+    /** Original persisted appointment facts only; reading work status must not run split/merge eligibility. */
+    @Transactional(readOnly=true)
+    public List<FbaAppointmentResponse> batchSnapshots(List<String> keys) {
+        if(keys==null || keys.isEmpty()) return List.of();
+        if(keys.size()>200) throw bad("每次最多读取200个预约批次");
+        var ids=keys.stream().map(key->{
+            try {long id=Long.parseLong(key.substring("FBA_APPOINTMENT:".length()));if(id>0 && key.equals(batchKey(id))) return id;}
+            catch(RuntimeException ignored) { }
+            throw bad("批次关联键无效");
+        }).distinct().toList();
+        var rows=appointmentMapper.selectBatchIds(ids);
+        if(rows.size()!=ids.size()) throw missing();
+        return responses(rows);
+    }
     @Transactional(isolation=org.springframework.transaction.annotation.Isolation.READ_COMMITTED)
     public FbaAppointmentResponse update(String operatorId,String appointmentNo,UpdateFbaAppointmentRequest request) {
         if ("CANCELLED".equals(status(request.details().appointmentStatus()))) throw bad("取消预约请使用取消操作并填写实际取消原因");
         return command("UPDATE:"+appointmentNo,operatorId,request.idempotencyKey(),request,()->{
             var appointment=find(appointmentNo,true);if(appointment==null) throw missing();
+            requireCurrent(appointment);
+            receiving.assertLegacyEditable(batchKey(appointment.getId()));
             if(!Objects.equals(appointment.getVersion(),request.version())) throw conflict("预约已更新，请重新读取后操作");
             if(queryMapper.countActiveDispatches(appointment.getId())>0) throw conflict("已关联有效排车，请先核对并处理运输安排后再改约");
-            var current=items(appointment.getId());
+            var current=items(appointment.getId()).stream().filter(i->Boolean.TRUE.equals(i.getActive())).toList();
+            var before=response(appointment,current);
             String status=status(request.details().appointmentStatus());
+            if("SUCCESS".equals(appointment.getAppointmentStatus()) && !"SUCCESS".equals(status)) throw bad("已确认预约不能直接退回待确认或未约成，请使用取消操作并记录原因");
             if("FAILED".equals(status)) {
                 if(clean(request.details().appointmentRemark())==null) throw bad("未约成时请填写原因");
-                // Keep the last planned and confirmed times as historical facts.
+                // Failure releases receiving coverage, not the cargo allocation owned by this batch.
                 appointment.setAppointmentStatus(status);appointment.setAppointmentRemark(request.details().appointmentRemark().trim());
-                current.forEach(item->{item.setActive(false);itemMapper.updateById(item);});
+                clearConfirmation(appointment);
             } else {
                 var refs=current.stream().map(item->new AppointmentCoverageService.SourceRef(item.getCustomerId(),item.getSourceKey(),"FBA:"+appointment.getFbaWarehouseCode())).toList();
-                var resolved=resolveForWrite(refs,appointment.getId());
+                var resolved=resolveForWrite(refs);
                 if(!Objects.equals(group(resolved).originWarehouseId(),appointment.getOriginWarehouseId())) throw conflict("接仓点已变化，请重新核对安排");
                 if("SUCCESS".equals(appointment.getAppointmentStatus()) && !"SUCCESS".equals(status)) throw bad("已确认预约不能直接退回待确认，请记录取消原因后重新安排");
-                apply(appointment,request.details(),resolved);
-                writeItems(appointment,resolved,current);
+                var evidence=verification(resolved);
+                apply(appointment,request.details(),resolved,evidence);
+                writeItems(appointment,resolved,current,evidence,Map.of());
             }
+            if(before.equals(response(appointment,items(appointment.getId())))) return before;
             appointment.setVersion(request.version()+1);appointment.setUpdatedAt(now());
             if(appointmentMapper.update(appointment,new LambdaQueryWrapper<InboundFbaAppointment>().eq(InboundFbaAppointment::getId,appointment.getId()).eq(InboundFbaAppointment::getVersion,request.version()))!=1) throw conflict("预约版本已变化");
             return response(appointment,items(appointment.getId()));
@@ -127,16 +240,293 @@ public class InboundFbaAppointmentService {
         var cancellation=new CancelFbaAppointmentRequest(version,request.cancelReason().trim());
         command("CANCEL:"+appointmentNo,operatorId,"CANCEL:"+appointmentNo+":"+version,cancellation,()->{
             var appointment=find(appointmentNo,true);if(appointment==null) throw missing();
+            requireCurrent(appointment);
+            receiving.assertLegacyEditable(batchKey(appointment.getId()));
             if(!Objects.equals(appointment.getVersion(),version)) throw conflict("预约已更新，请重新读取后操作");
             if(queryMapper.countActiveDispatches(appointment.getId())>0) throw conflict("预约货物已关联排车，不允许取消，请先处理关联排车");
             appointment.setAppointmentStatus("CANCELLED");
-            appointment.setVersion(version+1);appointment.setUpdatedAt(now());appointmentMapper.updateById(appointment);
-            var rows=items(appointment.getId());rows.forEach(item->{item.setActive(false);itemMapper.updateById(item);});
-            return response(appointment,rows);
+            appointment.setVersion(version+1);appointment.setUpdatedAt(now());
+            var rows=items(appointment.getId());
+            // Persist the cancelled plan in the immutable command history; the active demand has no valid date/confirmation.
+            var cancelledSnapshot=response(appointment,rows);
+            clearConfirmation(appointment);
+            appointment.setPlannedDate(null);appointment.setPlannedAt(null);appointment.setPlannedEndAt(null);
+            appointmentMapper.updateById(appointment);
+            return cancelledSnapshot;
         });
     }
 
-    private List<AppointmentSourceService.Source> resolveForWrite(List<AppointmentCoverageService.SourceRef> refs,Long excludedId) {
+    private static void clearConfirmation(InboundFbaAppointment appointment) {
+        appointment.setConfirmationNo(null);appointment.setAppointmentAt(null);appointment.setAppointmentEndAt(null);
+        appointment.setAppointmentStartUtc(null);appointment.setAppointmentEndUtc(null);
+    }
+
+    @Transactional(isolation=org.springframework.transaction.annotation.Isolation.READ_COMMITTED)
+    public RepartitionFbaAppointmentsResponse repartition(String operator,RepartitionFbaAppointmentsRequest request) {
+        validateRepartition(request);
+        return executeCommand("REPARTITION",operator,request.idempotencyKey(),request,RepartitionFbaAppointmentsResponse.class,
+            result->result.appointments().get(0).appointmentNo(),()->{
+                var originals=new ArrayList<InboundFbaAppointment>();
+                var originalItems=new LinkedHashMap<Long,List<InboundFbaAppointmentItem>>();
+                var refs=new LinkedHashMap<String,AppointmentCoverageService.SourceRef>();
+                var intents=request.originals().stream().collect(Collectors.toMap(RepartitionFbaAppointmentsRequest.Original::appointmentNo,i->i));
+                var ordered=request.originals().stream().map(i->{var row=find(i.appointmentNo(),false);if(row==null)throw missing();return row;})
+                    .sorted(Comparator.comparing(row->batchKey(row.getId()))).toList();
+                for(var candidate:ordered) {
+                    var intent=intents.get(candidate.getAppointmentNo());
+                    var row=find(intent.appointmentNo(),true);if(row==null) throw missing();
+                    requireCurrent(row);
+                    if(!Objects.equals(row.getVersion(),intent.version())) throw conflict("原预约已更新，请重新核对分批资料");
+                    if(!"PENDING".equals(row.getAppointmentStatus()) || row.getConfirmationNo()!=null || row.getAppointmentAt()!=null)
+                        throw conflict("仅未取得正式确认的批次可以分批或合并，请先处理已确认预约");
+                    if(queryMapper.countActiveDispatches(row.getId())>0) throw conflict("原批次已有关联排车，请先处理运输安排");
+                    if(!originals.isEmpty() && (!Objects.equals(originals.get(0).getOriginWarehouseId(),row.getOriginWarehouseId())
+                        || !Objects.equals(originals.get(0).getFbaWarehouseCode(),row.getFbaWarehouseCode()))) throw bad("仅同一起运仓、同一目的仓可以合并");
+                    receiving.assertRepartitionable(batchKey(row.getId()));
+                    var items=items(row.getId()).stream().filter(i->Boolean.TRUE.equals(i.getActive())).toList();
+                    if(items.isEmpty() || items.stream().anyMatch(item->!Boolean.TRUE.equals(item.getActive()))) throw conflict("原批次货物已变化，请重新核对");
+                    for(var item:items) {
+                        var ref=new AppointmentCoverageService.SourceRef(item.getCustomerId(),item.getSourceKey(),"FBA:"+row.getFbaWarehouseCode());
+                        var previous=refs.putIfAbsent(item.getSourceKey(),ref);
+                        if(previous!=null && !previous.equals(ref)) throw conflict("同一原来源的客户或目的地不一致");
+                    }
+                    originals.add(row);originalItems.put(row.getId(),items);
+                }
+                if(refs.size()>100) throw bad("一次最多重新分配100票原来源");
+                var resolved=resolveForWrite(List.copyOf(refs.values()));
+                var bySource=resolved.stream().collect(Collectors.toMap(AppointmentSourceService.Source::sourceKey,s->s));
+                var grouped=group(resolved);
+                if(!Objects.equals(grouped.originWarehouseId(),originals.get(0).getOriginWarehouseId())
+                    || !Objects.equals(grouped.destinationKey(),"FBA:"+originals.get(0).getFbaWarehouseCode())) throw conflict("原来源起讫点已变化，请先复核原批次");
+                var evidence=verification(resolved);
+                var totals=new LinkedHashMap<String,Long>();
+                for(var rows:originalItems.values()) for(var item:rows) {
+                    var source=bySource.get(item.getSourceKey());
+                    if(!Objects.equals(item.getSourceVersion(),source.sourceVersion())) throw conflict("原来源版本已变化，请先复核原批次");
+                    Integer count=item.getPackageCount();
+                    if(count==null) {
+                        var other=queryMapper.allocation(source.customerId(),source.sourceKey(),source.orderId(),item.getAppointmentId());
+                        var total=quantity(source,evidence);
+                        if(total==null || other.unknownCount()>0 || other.packages()>=total) throw conflict("原批次箱数尚未核实，不能分批");
+                        count=Math.toIntExact(total-other.packages());
+                    }
+                    if(count<=0) throw conflict("原批次箱数无效，请核实");
+                    totals.merge(source.sourceKey(),count.longValue(),Long::sum);
+                }
+                var allocated=new LinkedHashMap<String,Long>();
+                for(var batch:request.batches()) for(var allocation:batch.allocations()) {
+                    var source=bySource.get(allocation.sourceKey());
+                    if(source==null || !Objects.equals(source.customerId(),allocation.customerId())) throw bad("新批次只能使用原批次的真实来源及客户归属");
+                    var verified=evidence.get(source.sourceKey());
+                    if(!Objects.equals(source.sourceVersion(),allocation.expectedSourceVersion())
+                        || !Objects.equals(verified==null?null:verified.version(),allocation.expectedVerificationVersion())) throw conflict("所选来源或货物核实版本已变化，请刷新后重新分配");
+                    allocated.merge(source.sourceKey(),allocation.packageCount().longValue(),Long::sum);
+                }
+                if(!totals.equals(allocated)) throw bad("分批或合并前后每票原来源的分配箱数必须完全相等");
+                // Release only these old batches while holding every original source lock. All inserts and replacements roll back together.
+                originalItems.values().forEach(rows->rows.forEach(item->{item.setActive(false);itemMapper.updateById(item);}));
+                var replacements=new ArrayList<FbaAppointmentResponse>();
+                for(var batch:request.batches()) {
+                    var rows=batch.allocations().stream().map(a->bySource.get(a.sourceKey())).toList();
+                    var quantities=batch.allocations().stream().collect(Collectors.toMap(RepartitionFbaAppointmentsRequest.Allocation::sourceKey,RepartitionFbaAppointmentsRequest.Allocation::packageCount));
+                    var row=new InboundFbaAppointment();row.setId(IdWorker.getId());
+                    row.setAppointmentNo("AP-"+LocalDate.now(ZoneOffset.UTC).toString().replace("-","")+"-"+UUID.randomUUID().toString().replace("-","").substring(0,12).toUpperCase(Locale.ROOT));
+                    row.setOriginWarehouseId(grouped.originWarehouseId());row.setFbaWarehouseCode(rows.get(0).destinationWarehouseCode());row.setSelectedCount(rows.size());row.setVersion(0);
+                    row.setCreatedBy(operator);row.setCreatedAt(now());row.setUpdatedAt(row.getCreatedAt());
+                    apply(row,new FbaAppointmentDetails(batch.plannedDate(),null,null,null,null,null,"PENDING",batch.remark(),null,null),rows,evidence);
+                    appointmentMapper.insert(row);writeItems(row,rows,List.of(),evidence,quantities);
+                    replacements.add(response(row,items(row.getId())));
+                }
+                String replacementsJson,replacementKeysJson;
+                try {replacementsJson=json.writeValueAsString(replacements.stream().map(FbaAppointmentResponse::appointmentNo).toList());
+                    replacementKeysJson=json.writeValueAsString(replacements.stream().map(FbaAppointmentResponse::batchKey).toList());}
+                catch(com.fasterxml.jackson.core.JsonProcessingException error) {throw new IllegalStateException("分批关系无法保存",error);}
+                for(var row:originals) {
+                    row.setReplacementNosJson(replacementsJson);row.setReplacementKeysJson(replacementKeysJson);row.setRepartitionReason(request.reason().trim());row.setVersion(row.getVersion()+1);row.setUpdatedAt(now());
+                    if(appointmentMapper.updateById(row)!=1) throw conflict("原批次替代关系未保存");
+                }
+                var oldMembers=originalItems.entrySet().stream().flatMap(e->e.getValue().stream().map(i->new com.baiyue.lastleg.inboundplan.receiving.FbaAppointmentWorkPort.Member(batchKey(e.getKey()),i.getCustomerId()))).distinct().toList();
+                var newMembers=replacements.stream().flatMap(b->b.items().stream().map(i->new com.baiyue.lastleg.inboundplan.receiving.FbaAppointmentWorkPort.Member(b.batchKey(),i.customerId()))).distinct().toList();
+                receivingWork.inheritFollowup(oldMembers,newMembers,operator);
+                return new RepartitionFbaAppointmentsResponse(originals.stream().map(row->batchKey(row.getId())).toList(),originals.stream().map(InboundFbaAppointment::getAppointmentNo).toList(),List.copyOf(replacements));
+            });
+    }
+    private static void validateRepartition(RepartitionFbaAppointmentsRequest request) {
+        if(request==null || request.originals()==null || request.batches()==null || request.originals().isEmpty() || request.batches().isEmpty()
+            || request.originals().size()>20 || request.batches().size()>20 || clean(request.reason())==null || request.reason().length()>1000
+            || clean(request.idempotencyKey())==null || request.idempotencyKey().length()>64) throw bad("请填写有效原批次、新批次、调整原因和请求标识");
+        if(!(request.originals().size()==1 && request.batches().size()>1 || request.originals().size()>1 && request.batches().size()==1))
+            throw bad("分批须为一批分为多批，合并须为多批合为一批");
+        var originals=new HashSet<String>();
+        for(var row:request.originals()) if(row==null || clean(row.appointmentNo())==null || row.version()==null || row.version()<0 || !originals.add(row.appointmentNo())) throw bad("请选择不重复的原预约及有效版本");
+        for(var batch:request.batches()) {
+            if(batch==null || batch.allocations()==null || batch.allocations().isEmpty() || batch.allocations().size()>100 || batch.remark()!=null && batch.remark().length()>1000) throw bad("每批请选择1至100票来源");
+            var keys=new HashSet<String>();
+            for(var row:batch.allocations()) if(row==null || clean(row.customerId())==null || clean(row.sourceKey())==null
+                || row.packageCount()==null || row.packageCount()<=0 || row.expectedVerificationVersion()!=null && row.expectedVerificationVersion()<1
+                || !keys.add(row.sourceKey())) throw bad("同批来源不可重复，每票箱数必须为正整数");
+        }
+    }
+
+    /** Receiving orchestration acquires transport locks first, then invokes this boundary. */
+    @Transactional(propagation=org.springframework.transaction.annotation.Propagation.MANDATORY)
+    public FbaAppointmentResponse lockReceivingBatch(String key) {
+        long id=parseBatchKey(key);
+        var row=appointmentMapper.selectOne(new LambdaQueryWrapper<InboundFbaAppointment>().eq(InboundFbaAppointment::getId,id).last("FOR UPDATE"));
+        if(row==null) throw missing();requireCurrent(row);
+        return response(row,items(id));
+    }
+
+    /** Explicit adoption updates only the chosen customer's evidence, never their allocated amount. */
+    @Transactional(propagation=org.springframework.transaction.annotation.Propagation.MANDATORY)
+    public FbaAppointmentResponse refreshReceivingCargo(String key,String customerId,List<com.baiyue.lastleg.inboundplan.receiving.FbaReceivingContracts.CargoVersion> expected) {
+        var snapshot=lockReceivingBatch(key);var row=appointmentMapper.selectById(snapshot.id());
+        var current=items(row.getId()).stream().filter(i->Boolean.TRUE.equals(i.getActive())).toList();
+        var selected=current.stream().filter(i->Objects.equals(customerId,i.getCustomerId())).toList();
+        if(selected.isEmpty() || expected==null || expected.size()!=selected.size() || expected.size()>100) throw bad("请完整核对本客户当前批次的每票来源资料");
+        var versions=new HashMap<String,com.baiyue.lastleg.inboundplan.receiving.FbaReceivingContracts.CargoVersion>();
+        for(var value:expected) {
+            if(value==null || clean(value.sourceKey())==null || clean(value.destinationKey())==null || clean(value.expectedSourceVersion())==null || value.expectedVerificationVersion()!=null && value.expectedVerificationVersion()<1 || versions.putIfAbsent(value.sourceKey(),value)!=null)
+                throw bad("来源不能重复，必须明确当前来源及核实版本");
+        }
+        var refs=selected.stream().map(i->new AppointmentCoverageService.SourceRef(i.getCustomerId(),i.getSourceKey(),"FBA:"+i.getFbaWarehouseCode())).toList();
+        var resolved=resolveForWrite(refs);var evidence=verification(resolved);
+        var bySource=resolved.stream().collect(Collectors.toMap(AppointmentSourceService.Source::sourceKey,s->s));
+        for(var item:selected) {
+            var requested=versions.get(item.getSourceKey());var source=bySource.get(item.getSourceKey());
+            var verified=source==null?null:evidence.get(source.sourceKey());
+            if(requested==null || source==null || !Objects.equals(customerId,source.customerId()) || !Objects.equals("FBA:"+item.getFbaWarehouseCode(),source.destinationKey())
+                || !Objects.equals(source.destinationKey(),requested.destinationKey()) || !Objects.equals(row.getOriginWarehouseId(),source.originWarehouseId())
+                || !Objects.equals(source.sourceVersion(),requested.expectedSourceVersion()) || !Objects.equals(verified==null?null:verified.version(),requested.expectedVerificationVersion()))
+                throw conflict("本票归属、目的地或最新资料版本已变化，请重新预览后确认");
+            var total=quantity(source,evidence);var count=item.getPackageCount();
+            var other=queryMapper.allocation(customerId,source.sourceKey(),source.orderId(),row.getId());
+            if(count==null || count<=0 || total==null || other.unknownCount()>0 || (long)count+other.packages()>total) throw conflict("最新核实量不足以覆盖当前全部批次，请先处理数量差异，不能直接采用资料");
+            item.setSourceVersion(source.sourceVersion());item.setCargoVerificationVersion(verified==null?null:verified.version());
+            try {item.setShipmentReferencesJson(verified==null?null:json.writeValueAsString(verified.shipmentReferences()));}
+            catch(com.fasterxml.jackson.core.JsonProcessingException error) {throw new IllegalStateException("核实货件资料无法保存",error);}
+        }
+        if(snapshot.equals(response(row,current))) return snapshot;
+        selected.forEach(itemMapper::updateById);
+        row.setVersion(row.getVersion()+1);row.setUpdatedAt(now());appointmentMapper.updateById(row);
+        var result=response(row,current);workChanges.changed(result);return result;
+    }
+
+    @Transactional(propagation=org.springframework.transaction.annotation.Propagation.MANDATORY)
+    public String validateReceiving(List<com.baiyue.lastleg.inboundplan.receiving.FbaReceivingContracts.Member> members,FbaAppointmentDetails details) {
+        if(members==null || members.isEmpty() || members.size()>100 || details==null || !"SUCCESS".equals(details.appointmentStatus())) throw bad("请填写明确覆盖货物的正式收货确认");
+        return validateReceivingDetails(members,details);
+    }
+    @Transactional(propagation=org.springframework.transaction.annotation.Propagation.MANDATORY)
+    public String validateReceivingPlan(com.baiyue.lastleg.inboundplan.receiving.FbaReceivingContracts.Member member,FbaAppointmentDetails details) {
+        if(details==null || !Set.of("PENDING","FAILED").contains(details.appointmentStatus())) throw bad("客户计划只允许待确认或未约成，正式确认请使用登记确认操作");
+        if(details.confirmationNo()!=null || details.appointmentAt()!=null || details.appointmentEndAt()!=null) throw bad("客户计划不能填写外部约号或确认时段");
+        if(details.plannedAt()==null && (clean(details.startOffset())!=null || clean(details.endOffset())!=null)) throw bad("未填写计划开始时刻，不能指定计划时差");
+        if("FAILED".equals(details.appointmentStatus()) && clean(details.appointmentRemark())==null) throw bad("未约成时请填写原因");
+        var timezone=validateReceivingDetails(List.of(member),details);
+        if(details.plannedDate()!=null || details.plannedAt()!=null) {
+            if(timezone==null || !ZoneId.getAvailableZoneIds().contains(timezone)) throw bad("填写目标日期前请补齐目的仓IANA时区");
+            try {ZoneId.of(timezone);} catch(DateTimeException error) {throw bad("目的仓IANA时区无效");}
+        }
+        if(details.plannedAt()!=null) {
+            try {AppointmentTimePolicy.resolve(details.plannedAt(),details.plannedEndAt(),timezone,offset(details.startOffset()),offset(details.endOffset()));}
+            catch(IllegalArgumentException | DateTimeException error) {throw bad(error.getMessage());}
+        }
+        return timezone;
+    }
+    private String validateReceivingDetails(List<com.baiyue.lastleg.inboundplan.receiving.FbaReceivingContracts.Member> members,FbaAppointmentDetails details) {
+        var refs=members.stream().flatMap(m->m.sources().stream().map(s->new AppointmentCoverageService.SourceRef(m.customerId(),s.sourceKey(),s.destinationKey()))).distinct().toList();
+        var resolved=resolveForWrite(refs);var evidence=verification(resolved);var bySource=resolved.stream().collect(Collectors.toMap(AppointmentSourceService.Source::sourceKey,s->s));
+        for(var m:members) for(var s:m.sources()) {
+            var current=bySource.get(s.sourceKey());var verified=evidence.get(s.sourceKey());
+            if(current==null || !Objects.equals(current.customerId(),m.customerId()) || !Objects.equals(current.destinationKey(),s.destinationKey())
+                || !Objects.equals(current.sourceVersion(),s.sourceVersion()) || !Objects.equals(verified==null?null:verified.version(),s.verificationVersion())) throw conflict("原来源或核实版本已变化，请先核对货物");
+        }
+        var grouped=group(resolved);var row=new InboundFbaAppointment();row.setOriginWarehouseId(grouped.originWarehouseId());row.setFbaWarehouseCode(resolved.get(0).destinationWarehouseCode());
+        apply(row,details,resolved,evidence);return row.getTimezone();
+    }
+
+    @Transactional(propagation=org.springframework.transaction.annotation.Propagation.MANDATORY)
+    public List<FbaAppointmentResponse> moveReceivingCustomer(String operator,com.baiyue.lastleg.inboundplan.receiving.FbaReceivingContracts.ChangeIntent intent) {
+        var original=find(lockReceivingBatch(intent.batchKey()).appointmentNo(),false);
+        if(!Objects.equals(original.getVersion(),intent.batchVersion())) throw conflict("原批次版本已变化，请重新核对调整范围");
+        var all=items(original.getId()).stream().filter(i->Boolean.TRUE.equals(i.getActive())).toList();
+        receiving.freezeUnconfirmedPlans(response(original,all));
+        var selected=all.stream().filter(i->intent.customerId().equals(i.getCustomerId())).toList();
+        if(selected.isEmpty() || selected.size()!=intent.quantities().size()) throw bad("请完整选择本客户的各票货物");
+        var amounts=new HashMap<String,com.baiyue.lastleg.inboundplan.receiving.FbaReceivingContracts.Quantity>();
+        for(var q:intent.quantities()) if(amounts.put(q.sourceKey(),q)!=null) throw bad("逐票来源不能重复");
+        var refs=selected.stream().map(i->new AppointmentCoverageService.SourceRef(i.getCustomerId(),i.getSourceKey(),"FBA:"+i.getFbaWarehouseCode())).toList();
+        var resolved=resolveForWrite(refs);var evidence=verification(resolved);var bySource=resolved.stream().collect(Collectors.toMap(AppointmentSourceService.Source::sourceKey,s->s));
+        var laterAmounts=new LinkedHashMap<String,Integer>();
+        for(var item:selected) {
+            var q=amounts.get(item.getSourceKey());var src=bySource.get(item.getSourceKey());var v=evidence.get(item.getSourceKey());
+            if(q==null || src==null || !Objects.equals(src.destinationKey(),q.destinationKey()) || !Objects.equals(src.sourceVersion(),q.expectedSourceVersion())
+                || !Objects.equals(v==null?null:v.version(),q.expectedVerificationVersion()) || !Objects.equals(src.sourceVersion(),item.getSourceVersion())) throw conflict("原来源或核实资料版本已变化");
+            Integer total=quantity(src,evidence),count=item.getPackageCount();
+            var other=queryMapper.allocation(src.customerId(),src.sourceKey(),src.orderId(),original.getId());
+            if(count==null || total==null || other.unknownCount()>0 || (long)count+other.packages()>total || q.retainedPackages()<0 || q.retainedPackages()>count) throw conflict("本次保留量及原来源分配总量不一致");
+            int later=count-q.retainedPackages();if(later>0) laterAmounts.put(item.getSourceKey(),later);
+            item.setPackageCount(q.retainedPackages());item.setActive(q.retainedPackages()>0);itemMapper.updateById(item);
+        }
+        if(laterAmounts.isEmpty()) throw bad("本次货量没有变化，无需创建变化记录");
+        var laterRows=resolved.stream().filter(s->laterAmounts.containsKey(s.sourceKey())).toList();
+        var later=new InboundFbaAppointment();later.setId(IdWorker.getId());later.setAppointmentNo("AP-"+LocalDate.now(ZoneOffset.UTC).toString().replace("-","")+"-"+UUID.randomUUID().toString().replace("-","").substring(0,12).toUpperCase(Locale.ROOT));
+        later.setOriginWarehouseId(original.getOriginWarehouseId());later.setFbaWarehouseCode(original.getFbaWarehouseCode());later.setVersion(0);later.setSelectedCount(laterRows.size());later.setCreatedBy(operator);later.setCreatedAt(now());later.setUpdatedAt(now());
+        apply(later,new FbaAppointmentDetails(intent.laterDate(),null,null,null,null,null,"PENDING",intent.reason(),null,null),laterRows,evidence);
+        appointmentMapper.insert(later);writeItems(later,laterRows,List.of(),evidence,laterAmounts);
+        var retained=all.stream().filter(i->Boolean.TRUE.equals(i.getActive())).toList();
+        if(retained.stream().noneMatch(i->intent.customerId().equals(i.getCustomerId()))) receiving.deletePlan(intent.batchKey(),intent.customerId());
+        original.setSelectedCount(retained.size());original.setVersion(original.getVersion()+1);original.setUpdatedAt(now());
+        if(retained.isEmpty()) {original.setReplacementNosJson(receiving.write(List.of(later.getAppointmentNo())));original.setReplacementKeysJson(receiving.write(List.of(batchKey(later.getId()))));original.setRepartitionReason(intent.reason());}
+        appointmentMapper.updateById(original);
+        return List.of(response(original,retained),response(later,items(later.getId())));
+    }
+
+    /** Header is only an aggregate projection; per-customer receiving identity remains authoritative. */
+    @Transactional(propagation=org.springframework.transaction.annotation.Propagation.MANDATORY)
+    public FbaAppointmentResponse projectReceiving(String key,boolean cancelled) {
+        var row=appointmentMapper.selectById(parseBatchKey(key));var rows=items(row.getId()).stream().filter(i->Boolean.TRUE.equals(i.getActive())).toList();
+        var groups=rows.stream().map(InboundFbaAppointmentItem::getCustomerId).distinct().map(c->receiving.currentAgreement(key,c)).toList();
+        var active=groups.stream().filter(Objects::nonNull).toList();
+        clearConfirmation(row);
+        if(!groups.isEmpty() && groups.size()==active.size() && active.stream().map(a->a.agreementKey()).distinct().count()==1) {
+            var a=active.get(0);var d=a.details();row.setAppointmentStatus("SUCCESS");row.setConfirmationNo(d.confirmationNo());row.setAppointmentAt(d.appointmentAt());row.setAppointmentEndAt(d.appointmentEndAt());row.setTimezone(a.timezone());
+            var window=AppointmentTimePolicy.resolve(d.appointmentAt(),d.appointmentEndAt(),a.timezone(),offset(d.startOffset()),offset(d.endOffset()));
+            row.setAppointmentStartUtc(LocalDateTime.ofInstant(window.start(),ZoneOffset.UTC));row.setAppointmentEndUtc(window.end()==null?null:LocalDateTime.ofInstant(window.end(),ZoneOffset.UTC));
+            row.setPlannedDate(d.plannedDate());row.setPlannedAt(d.plannedAt());row.setPlannedEndAt(d.plannedEndAt());
+        } else {
+            var plans=receiving.plans(key).stream().collect(Collectors.toMap(com.baiyue.lastleg.inboundplan.receiving.FbaReceivingContracts.CustomerPlan::customerId,p->p));
+            var customerIds=rows.stream().map(InboundFbaAppointmentItem::getCustomerId).distinct().toList();
+            var details=new ArrayList<FbaAppointmentDetails>();var zones=new ArrayList<String>();
+            for(int i=0;i<customerIds.size();i++) {
+                var agreement=groups.get(i);var plan=plans.get(customerIds.get(i));
+                if(agreement!=null) {details.add(agreement.details());zones.add(agreement.timezone());}
+                else if(plan!=null) {details.add(plan.details());zones.add(plan.timezone());}
+            }
+            boolean complete=details.size()==customerIds.size() && !details.isEmpty();
+            boolean failed=complete && active.isEmpty() && details.stream().allMatch(d->"FAILED".equals(d.appointmentStatus()));
+            row.setAppointmentStatus(failed?"FAILED":cancelled && active.isEmpty() && plans.isEmpty()?"CANCELLED":"PENDING");
+            row.setPlannedDate(null);row.setPlannedAt(null);row.setPlannedEndAt(null);row.setAppointmentRemark(null);
+            if(complete) {
+                var first=details.get(0);var zone=zones.get(0);
+                if(details.stream().allMatch(d->Objects.equals(d.plannedDate(),first.plannedDate()) && Objects.equals(d.plannedAt(),first.plannedAt()) && Objects.equals(d.plannedEndAt(),first.plannedEndAt())) && zones.stream().allMatch(z->Objects.equals(z,zone))) {
+                    row.setPlannedDate(first.plannedDate());row.setPlannedAt(first.plannedAt());row.setPlannedEndAt(first.plannedEndAt());row.setTimezone(zone);
+                }
+                if(details.stream().allMatch(first::equals)) row.setAppointmentRemark(first.appointmentRemark());
+            }
+        }
+        row.setVersion(row.getVersion()+1);row.setUpdatedAt(now());appointmentMapper.updateById(row);
+        var snapshot=response(row,rows);workChanges.changed(snapshot);return snapshot;
+    }
+    @Transactional(propagation=org.springframework.transaction.annotation.Propagation.MANDATORY)
+    public void receivingChanged(List<FbaAppointmentResponse> snapshots) {snapshots.forEach(workChanges::changed);}
+    private static long parseBatchKey(String key) {
+        try {long id=Long.parseLong(key.substring("FBA_APPOINTMENT:".length()));if(id>0 && key.equals(batchKey(id)))return id;} catch(RuntimeException ignored) { }
+        throw bad("批次关联键无效");
+    }
+
+    private List<AppointmentSourceService.Source> resolveForWrite(List<AppointmentCoverageService.SourceRef> refs) {
         sources.lockForWrite(refs);
         var resolved=sources.resolveBatch(refs);
         var ids=resolved.stream().map(AppointmentSourceService.Source::orderId).filter(Objects::nonNull).distinct().sorted().toList();
@@ -150,14 +540,26 @@ public class InboundFbaAppointmentService {
             if(states.size()!=ids.size() || states.stream().anyMatch(s->s.detained() || s.mixedDestinations())) throw conflict("货物暂扣或含多个目的地，请先核对");
         }
         if(resolved.stream().anyMatch(s->!s.canFollowup())) throw conflict("所选来源不再具备安排资格");
-        if(queryMapper.countActiveSources(resolved.stream().map(AppointmentSourceService.Source::sourceKey).toList(),ids,excludedId)>0) throw conflict("所选货物已有有效预约安排，请继续原单");
         return resolved;
     }
     private AppointmentPlanningPolicy.Group group(List<AppointmentSourceService.Source> rows) {
         try { return AppointmentPlanningPolicy.group(rows.stream().map(s->new AppointmentPlanningPolicy.Cargo(s.sourceKey(),s.customerId(),s.originWarehouseId(),s.destinationKey(),"US","US",s.packages(),null,null,s.canFollowup(),String.join("；",s.blockReasons()))).toList()); }
         catch(IllegalArgumentException error) {throw bad(error.getMessage());}
     }
-    private void apply(InboundFbaAppointment appointment,FbaAppointmentDetails details,List<AppointmentSourceService.Source> rows) {
+    private Map<String,AppointmentCargoVerificationService.Verification> verification(List<AppointmentSourceService.Source> rows) {
+        var result=new HashMap<String,AppointmentCargoVerificationService.Verification>();
+        for(var source:rows) {
+            var current=verification.current(source);
+            if(current!=null) result.put(source.sourceKey(),current);
+        }
+        return result;
+    }
+    private static Integer quantity(AppointmentSourceService.Source source,Map<String,AppointmentCargoVerificationService.Verification> evidence) {
+        var verified=evidence.get(source.sourceKey());
+        return verified==null?source.packages():verified.packageCount();
+    }
+    private void apply(InboundFbaAppointment appointment,FbaAppointmentDetails details,List<AppointmentSourceService.Source> rows,
+                       Map<String,AppointmentCargoVerificationService.Verification> evidence) {
         String status=status(details.appointmentStatus());
         String timezone=sources.destinationTimezone(appointment.getFbaWarehouseCode());
         if(details.plannedAt()==null && details.plannedEndAt()!=null || details.plannedAt()!=null && details.plannedEndAt()!=null && !details.plannedEndAt().isAfter(details.plannedAt())) throw bad("计划结束时间必须晚于开始时间");
@@ -168,7 +570,11 @@ public class InboundFbaAppointmentService {
         if("SUCCESS".equals(status)) {
             if(clean(details.confirmationNo())==null || details.appointmentAt()==null) throw bad("登记对方确认时请填写外部约号和确认时间");
             var ids=rows.stream().map(AppointmentSourceService.Source::orderId).filter(Objects::nonNull).distinct().toList();
-            if(ids.size()!=rows.size() || rows.stream().anyMatch(s->s.packages()==null || s.packages()<=0) || queryMapper.countMissingShipmentReferences(ids)>0) throw bad("正式确认前请核实货量并补齐真实FBA货件号或追踪号");
+            var unverifiedIds=rows.stream().filter(s->!evidence.containsKey(s.sourceKey())).map(AppointmentSourceService.Source::orderId).filter(Objects::nonNull).distinct().toList();
+            if(ids.size()!=rows.size() || rows.stream().anyMatch(s->quantity(s,evidence)==null || quantity(s,evidence)<=0)
+                || evidence.values().stream().anyMatch(v->v.shipmentReferences().isEmpty())
+                || !unverifiedIds.isEmpty() && queryMapper.countMissingShipmentReferences(unverifiedIds)>0)
+                throw bad("正式确认前请核实货量并补齐各票FBA货件号或追踪号");
             final AppointmentTimePolicy.Window window;
             try {window=AppointmentTimePolicy.resolve(details.appointmentAt(),details.appointmentEndAt(),timezone,offset(details.startOffset()),offset(details.endOffset()));}
             catch(IllegalArgumentException | DateTimeException error) {throw bad(error.getMessage());}
@@ -179,32 +585,55 @@ public class InboundFbaAppointmentService {
             appointment.setConfirmationNo(null);appointment.setAppointmentAt(null);appointment.setAppointmentEndAt(null);appointment.setAppointmentStartUtc(null);appointment.setAppointmentEndUtc(null);
         }
     }
-    private void writeItems(InboundFbaAppointment appointment,List<AppointmentSourceService.Source> rows,List<InboundFbaAppointmentItem> previous) {
+    private void writeItems(InboundFbaAppointment appointment,List<AppointmentSourceService.Source> rows,List<InboundFbaAppointmentItem> previous,
+                            Map<String,AppointmentCargoVerificationService.Verification> evidence,Map<String,Integer> requested) {
         var existing=previous.stream().collect(Collectors.toMap(InboundFbaAppointmentItem::getSourceKey,item->item));
         for(var source:rows) {
             var item=existing.get(source.sourceKey());boolean fresh=item==null;
+            var allocated=queryMapper.allocation(source.customerId(),source.sourceKey(),source.orderId(),appointment.getId());
+            Integer total=quantity(source,evidence);
+            if(allocated.unknownCount()>0) throw conflict("原来源已有箱数待核实的安排，请先核对原预约");
+            Integer count=requested.get(source.sourceKey());
+            if(count==null && !fresh) count=item.getPackageCount();
+            if(count==null && total!=null) {
+                long remaining=total.longValue()-allocated.packages();
+                if(remaining<=0) throw conflict("原来源箱数已分配完，请继续已有预约");
+                count=Math.toIntExact(remaining);
+            }
+            if(total==null && (count!=null || allocated.count()>0)) throw conflict("原来源总箱数待核实，不能继续分配");
+            if(count!=null && (count<=0 || (long)count+allocated.packages()>total)) throw conflict("本批及其他活动预约的分配总量超过原来源可分配箱数");
             if(fresh){item=new InboundFbaAppointmentItem();item.setId(IdWorker.getId());item.setAppointmentId(appointment.getId());item.setCreatedAt(now());}
             item.setSourceKey(source.sourceKey());item.setSourceVersion(source.sourceVersion());item.setCustomerId(source.customerId());item.setOrderId(source.orderId());item.setInboundCode(source.inboundCode());
-            item.setFbaWarehouseCode(source.destinationWarehouseCode());item.setPackageCount(source.packages());item.setActive(true);
+            item.setFbaWarehouseCode(source.destinationWarehouseCode());item.setPackageCount(count);item.setActive(true);
+            var verified=evidence.get(source.sourceKey());
+            item.setCargoVerificationVersion(verified==null?null:verified.version());
+            try {item.setShipmentReferencesJson(verified==null?null:json.writeValueAsString(verified.shipmentReferences()));}
+            catch(com.fasterxml.jackson.core.JsonProcessingException error) {throw new IllegalStateException("核实货件资料无法保存",error);}
             try {if(fresh)itemMapper.insert(item);else itemMapper.updateById(item);}
             catch(DuplicateKeyException duplicate){throw conflict("所选货物刚被其他安排占用，请刷新后核对");}
         }
     }
     private FbaAppointmentResponse command(String operation,String operator,String key,Object request,Supplier<FbaAppointmentResponse> action) {
+        return executeCommand(operation,operator,key,request,FbaAppointmentResponse.class,FbaAppointmentResponse::appointmentNo,action);
+    }
+    private <T> T executeCommand(String operation,String operator,String key,Object request,Class<T> type,
+                                 java.util.function.Function<T,String> appointmentNumber,Supplier<T> action) {
         if(clean(operator)==null || clean(key)==null || key.length()>128) throw bad("缺少操作人或有效请求标识");
         final String hash;
         try {hash=HexFormat.of().formatHex(java.security.MessageDigest.getInstance("SHA-256").digest((operation+"\n"+operator+"\n"+json.writeValueAsString(request)).getBytes(java.nio.charset.StandardCharsets.UTF_8)));}
         catch(Exception error){throw new IllegalStateException("无法记录预约命令",error);}
         var existing=commands.find(key);
-        if(existing!=null)return replay(existing,hash);
+        if(existing!=null)return replay(existing,hash,type);
         try {commands.begin(key,hash,operation,operator,now());}
-        catch(DuplicateKeyException duplicate){return replay(commands.find(key),hash);}
+        catch(DuplicateKeyException duplicate){return replay(commands.find(key),hash,type);}
         var response=action.get();
-        try {if(commands.finish(key,response.appointmentNo(),commandSnapshot(response,request))!=1)throw conflict("预约命令结果未能保存");}
+        receiving.synchronize(response);
+        workChanges.changed(response);
+        try {if(commands.finish(key,appointmentNumber.apply(response),commandSnapshot(response,request))!=1)throw conflict("预约命令结果未能保存");}
         catch(com.fasterxml.jackson.core.JsonProcessingException error){throw new IllegalStateException("无法保存预约命令结果",error);}
         return response;
     }
-    private String commandSnapshot(FbaAppointmentResponse response,Object request) throws com.fasterxml.jackson.core.JsonProcessingException {
+    private String commandSnapshot(Object response,Object request) throws com.fasterxml.jackson.core.JsonProcessingException {
         var node=json.valueToTree(response);
         if(request instanceof CancelFbaAppointmentRequest cancellation) ((com.fasterxml.jackson.databind.node.ObjectNode)node).put("cancelReason",cancellation.cancelReason());
         return json.writeValueAsString(node);
@@ -238,9 +667,9 @@ public class InboundFbaAppointmentService {
         }).toList();
         return new PageResult<>(records,page,size,total,(total+size-1)/size);
     }
-    private FbaAppointmentResponse replay(FbaAppointmentCommandMapper.Command value,String hash) {
+    private <T> T replay(FbaAppointmentCommandMapper.Command value,String hash,Class<T> type) {
         if(value==null || !hash.equals(value.requestHash()) || value.responseJson()==null)throw conflict("重复请求内容不一致或结果尚未就绪，请重新核对");
-        try {return readSnapshot(value.responseJson());}
+        try {var node=(com.fasterxml.jackson.databind.node.ObjectNode)json.readTree(value.responseJson());node.remove("cancelReason");return json.treeToValue(node,type);}
         catch(com.fasterxml.jackson.core.JsonProcessingException error){throw new IllegalStateException("预约命令记录不可读",error);}
     }
     private InboundFbaAppointment find(String number,boolean lock) {
@@ -254,10 +683,23 @@ public class InboundFbaAppointmentService {
         return rows.stream().map(row->response(row,grouped.getOrDefault(row.getId(),List.of()))).toList();
     }
     private FbaAppointmentResponse response(InboundFbaAppointment row,List<InboundFbaAppointmentItem> items) {
+        if(row.getReplacementNosJson()==null) items=items.stream().filter(i->Boolean.TRUE.equals(i.getActive())).toList();
         return new FbaAppointmentResponse(row.getId(),row.getAppointmentNo(),row.getConfirmationNo(),row.getPlannedDate(),row.getPlannedAt(),row.getPlannedEndAt(),row.getAppointmentAt(),row.getAppointmentEndAt(),
             utc(row.getAppointmentStartUtc()),utc(row.getAppointmentEndUtc()),row.getTimezone(),row.getAppointmentStatus(),row.getAppointmentRemark(),row.getOriginWarehouseId(),row.getFbaWarehouseCode(),row.getSelectedCount(),row.getCreatedBy(),row.getCreatedAt(),row.getUpdatedAt(),
-            items.stream().map(item->new FbaAppointmentResponse.Item(item.getId(),item.getSourceKey(),item.getSourceVersion(),item.getOrderId(),item.getInboundCode(),item.getFbaWarehouseCode(),item.getCustomerId(),item.getPackageCount())).toList(),row.getVersion());
+            items.stream().map(item->new FbaAppointmentResponse.Item(item.getId(),item.getSourceKey(),item.getSourceVersion(),item.getOrderId(),item.getInboundCode(),item.getFbaWarehouseCode(),item.getCustomerId(),item.getPackageCount(),item.getCargoVerificationVersion(),shipmentReferences(item),"FBA:"+item.getFbaWarehouseCode())).toList(),row.getVersion(),stringList(row.getReplacementNosJson()),row.getRepartitionReason(),batchKey(row.getId()),stringList(row.getReplacementKeysJson()));
     }
+    private List<String> shipmentReferences(InboundFbaAppointmentItem item) {
+        return stringList(item.getShipmentReferencesJson());
+    }
+    private List<String> stringList(String value) {
+        if(value==null) return List.of();
+        try {return json.readValue(value,new com.fasterxml.jackson.core.type.TypeReference<List<String>>(){});}
+        catch(com.fasterxml.jackson.core.JsonProcessingException error) {throw new IllegalStateException("预约货件快照不可读",error);}
+    }
+    private static void requireCurrent(InboundFbaAppointment appointment) {
+        if(appointment.getReplacementNosJson()!=null) throw conflict("该批次已被分批或合并，请进入替代批次继续操作");
+    }
+    public static String batchKey(Long id) {return "FBA_APPOINTMENT:"+id;}
     private static String clean(String value){return value==null || value.isBlank()?null:value.trim();}
     private static String status(String value){try{return FbaAppointmentStatus.valueOf(value.trim().toUpperCase(Locale.ROOT)).name();}catch(RuntimeException error){throw bad("请选择有效预约状态");}}
     private static ZoneOffset offset(String value){return clean(value)==null?null:ZoneOffset.of(value);}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/work/AppointmentWorkAppointmentChanges.java b/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/work/AppointmentWorkAppointmentChanges.java
new file mode 100644
index 000000000..5f3a6cad0
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/work/AppointmentWorkAppointmentChanges.java
@@ -0,0 +1,69 @@
+package com.baiyue.lastleg.inboundplan.work;
+
+import com.baiyue.lastleg.appointmentwork.*;
+import com.baiyue.lastleg.inboundplan.dto.FbaAppointmentResponse;
+import com.baiyue.lastleg.inboundplan.dto.RepartitionFbaAppointmentsResponse;
+import org.springframework.stereotype.Component;
+import com.baiyue.lastleg.inboundplan.receiving.FbaReceivingStore;
+import com.baiyue.lastleg.inboundplan.receiving.FbaReceivingContracts.*;
+import java.time.*;
+import java.util.*;
+import static com.baiyue.lastleg.appointmentwork.AppointmentWorkModels.*;
+
+@Component
+public class AppointmentWorkAppointmentChanges {
+    private final AppointmentWorkCommitmentService commitments;
+    private final AppointmentWorkChanges changes;
+    private final FbaReceivingStore receiving;
+    public AppointmentWorkAppointmentChanges(AppointmentWorkCommitmentService commitments,AppointmentWorkChanges changes,FbaReceivingStore receiving) { this.commitments=commitments; this.changes=changes;this.receiving=receiving; }
+    public void changed(Object response) {
+        changes.requirementsChanged();
+        if(response instanceof FbaAppointmentResponse appointment) record(appointment);
+        else if(response instanceof RepartitionFbaAppointmentsResponse partition) partition.appointments().forEach(this::record);
+        else throw new IllegalArgumentException("预约命令缺少原业务响应");
+    }
+    private void record(FbaAppointmentResponse a) {
+        var snapshot=receiving.snapshots(List.of(a.batchKey())).get(0);
+        for(var customer:a.items().stream().map(i->i.customerId()).distinct().sorted().toList()) {
+            var view=receiving(a,customer,snapshot);
+            var cargo=a.items().stream().filter(i->customer.equals(i.customerId())).map(i->List.of(i.customerId(),i.sourceKey(),Objects.toString(i.destinationKey(),""),Objects.toString(i.packageCount(),""),Objects.toString(i.shipmentReferences(),""))).sorted(Comparator.comparing(Object::toString)).toList();
+            commitments.record(AppointmentWorkPolicy.customerRequirement(a.batchKey(),customer),new AppointmentWorkCommitmentService.Commitment(view.target(),view.confirmed(),null,AppointmentWorkPolicy.digest(cargo.toString()),view.cancelled()));
+        }
+    }
+    record Receiving(Agreement agreement,Pending pending,Slot target,Slot confirmed,String timezone,boolean cancelled,String status) { }
+    static Receiving receiving(FbaAppointmentResponse batch,String customer,BatchReceiving snapshot) {
+        if(snapshot==null || !batch.batchKey().equals(snapshot.batchKey())) throw AppointmentWorkPolicy.unavailable("收货预约批量读取不完整");
+        var groups=snapshot.agreements().stream().filter(a->"ACTIVE".equals(a.status()) && a.members().stream().anyMatch(m->batch.batchKey().equals(m.batchKey()) && customer.equals(m.customerId()))).toList();
+        if(groups.size()>1) throw AppointmentWorkPolicy.unavailable("同一客户批次存在多个有效收货预约");
+        var waiting=snapshot.pendingChanges().stream().filter(p->"WAITING".equals(p.status()) && batch.batchKey().equals(p.intent().batchKey()) && customer.equals(p.intent().customerId())).toList();
+        if(waiting.size()>1) throw AppointmentWorkPolicy.unavailable("同一客户批次存在多个待确认变化");
+        var agreement=groups.isEmpty()?null:groups.get(0);
+        var plans=snapshot.plans().stream().filter(p->batch.batchKey().equals(p.batchKey()) && customer.equals(p.customerId())).toList();
+        if(plans.size()>1) throw AppointmentWorkPolicy.unavailable("同一客户批次存在多个独立计划");
+        boolean independentlyCovered=snapshot.agreements().stream().anyMatch(a->"ACTIVE".equals(a.status()) && a.members().stream().anyMatch(m->batch.batchKey().equals(m.batchKey())));
+        String status=null,timezone=null;Slot target=null,confirmed=null;
+        if(agreement!=null) {
+            var details=agreement.details();timezone=agreement.timezone();
+            if(details==null || !"SUCCESS".equals(details.appointmentStatus()) || details.appointmentAt()==null) throw AppointmentWorkPolicy.unavailable("有效收货预约缺少正式确认时间");
+            target=target(details,timezone);status=details.appointmentStatus();
+            confirmed=slot(details.appointmentAt(),details.appointmentEndAt(),timezone);
+        } else if(!plans.isEmpty()) {
+            var plan=plans.get(0);var details=plan.details();timezone=plan.timezone();
+            if(details==null || !Set.of("PENDING","FAILED").contains(Objects.toString(details.appointmentStatus(),"")) || details.confirmationNo()!=null || details.appointmentAt()!=null || details.appointmentEndAt()!=null)
+                throw AppointmentWorkPolicy.unavailable("客户独立计划包含无效状态或正式确认字段");
+            target=target(details,timezone);status=details.appointmentStatus();
+        } else if(!independentlyCovered) {
+            // Only a batch still without independent receiving coverage can supply its original shared plan.
+            status=batch.appointmentStatus();timezone=batch.timezone();target="CANCELLED".equals(status)?null:target(batch);
+        }
+        return new Receiving(agreement,waiting.isEmpty()?null:waiting.get(0),target,confirmed,timezone,"CANCELLED".equals(status),status);
+    }
+    private static Slot target(com.baiyue.lastleg.inboundplan.dto.FbaAppointmentDetails details,String timezone) {
+        return details.plannedAt()!=null?slot(details.plannedAt(),details.plannedEndAt(),timezone):details.plannedDate()==null?null:new Slot(details.plannedDate(),null,null,null,timezone);
+    }
+    public static Slot target(FbaAppointmentResponse a) {
+        return a.plannedAt()!=null?slot(a.plannedAt(),a.plannedEndAt(),a.timezone()):a.plannedDate()==null?null:new Slot(a.plannedDate(),null,null,null,a.timezone());
+    }
+    public static Slot confirmed(FbaAppointmentResponse a) { return "SUCCESS".equals(a.appointmentStatus())?slot(a.appointmentAt(),a.appointmentEndAt(),a.timezone()):null; }
+    public static Slot slot(LocalDateTime start,LocalDateTime end,String timezone) { return start==null?null:new Slot(start.toLocalDate(),start.toLocalTime(),end==null?null:end.toLocalDate(),end==null?null:end.toLocalTime(),timezone); }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/work/AppointmentWorkDeliveryMapper.java b/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/work/AppointmentWorkDeliveryMapper.java
new file mode 100644
index 000000000..8b4a7e76b
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/work/AppointmentWorkDeliveryMapper.java
@@ -0,0 +1,35 @@
+package com.baiyue.lastleg.inboundplan.work;
+
+import org.apache.ibatis.annotations.*;
+import java.time.LocalDateTime;
+import java.util.List;
+
+@Mapper
+public interface AppointmentWorkDeliveryMapper {
+    record CustomerDelivery(long orderId,String customerId,long pickedPackages,String deliveryNo,String status,Integer packages,Integer signedPackages,LocalDateTime signedAt,LocalDateTime plannedDeliveryAt) { }
+    String CUSTOMER_SELECT="SELECT o.id order_id,o.customer_id,SUM(a.packages) picked_packages,x.delivery_no,x.status,x.package_count packages,x.signed_packages,x.signed_at,x.planned_delivery_at FROM ll_order o JOIN ll_dispatch_pda_pick_order a ON a.order_id=o.id AND a.customer_id=o.customer_id JOIN ll_dispatch_pda_pick p ON p.id=a.pick_id AND p.customer_id=a.customer_id JOIN ll_dispatch_item i ON i.id=p.dispatch_item_id AND i.customer_id=p.customer_id JOIN ll_dispatch_order d ON d.id=i.dispatch_order_id AND d.status<>'CANCELLED' JOIN ll_delivery_order x ON x.dispatch_order_id=i.dispatch_order_id AND x.customer_id=i.customer_id AND x.destination_type='PRIVATE' AND x.delivery_address=i.delivery_address AND (x.postal_code=i.postal_code OR (x.postal_code IS NULL AND i.postal_code IS NULL)) ";
+    String CUSTOMER_GROUP=" GROUP BY o.id,o.customer_id,x.id,x.delivery_no,x.status,x.package_count,x.signed_packages,x.signed_at,x.planned_delivery_at ORDER BY o.id,x.id LIMIT 1001";
+    @Select(CUSTOMER_SELECT+" WHERE o.source_container_booking_id=#{container} AND o.source_inbound_id=#{inbound}"+CUSTOMER_GROUP)
+    List<CustomerDelivery> customer(@Param("container") String container,@Param("inbound") String inbound);
+    @Select(CUSTOMER_SELECT+" WHERE CONCAT('DISPATCH:',i.dispatch_order_id)=#{batch}"+CUSTOMER_GROUP)
+    List<CustomerDelivery> privateBatch(String batch);
+    record Delivery(String customerId,String sourceKey,String destinationKey,Integer allocatedPackages,String dispatchStatus,String deliveryNo,String status,Integer packages,Integer signedPackages,LocalDateTime signedAt) { }
+    @Select("SELECT b.customer_id,b.source_key,b.destination_key,b.package_count allocated_packages,d.status dispatch_status,x.delivery_no,x.status,x.package_count packages,x.signed_packages,x.signed_at FROM ll_dispatch_appointment_allocation b JOIN ll_dispatch_order d ON d.id=b.dispatch_id AND d.status<>'CANCELLED' LEFT JOIN ll_delivery_order x ON x.dispatch_order_id=b.dispatch_id AND x.customer_id=b.customer_id AND CONCAT('FBA:',x.destination_warehouse_code)=b.destination_key WHERE b.batch_key=#{batch} ORDER BY b.dispatch_item_id,b.source_key,x.id LIMIT 1001")
+    List<Delivery> batch(String batch);
+    record BatchDelivery(String batchKey,String customerId,String sourceKey,String destinationKey,Integer allocatedPackages,String dispatchStatus,String deliveryNo,String status,Integer packages,Integer signedPackages,LocalDateTime signedAt) {
+        public Delivery delivery() { return new Delivery(customerId,sourceKey,destinationKey,allocatedPackages,dispatchStatus,deliveryNo,status,packages,signedPackages,signedAt); }
+    }
+    @Select("""
+        <script>
+        SELECT batch_key,customer_id,source_key,destination_key,allocated_packages,dispatch_status,delivery_no,status,packages,signed_packages,signed_at FROM (
+          SELECT b.batch_key,b.customer_id,b.source_key,b.destination_key,b.package_count allocated_packages,d.status dispatch_status,
+            x.delivery_no,x.status,x.package_count packages,x.signed_packages,x.signed_at,
+            ROW_NUMBER() OVER(PARTITION BY b.batch_key ORDER BY b.dispatch_item_id,b.source_key,x.id) work_row
+          FROM ll_dispatch_appointment_allocation b JOIN ll_dispatch_order d ON d.id=b.dispatch_id AND d.status&lt;&gt;'CANCELLED'
+          LEFT JOIN ll_delivery_order x ON x.dispatch_order_id=b.dispatch_id AND x.customer_id=b.customer_id AND CONCAT('FBA:',x.destination_warehouse_code)=b.destination_key
+          WHERE b.batch_key IN <foreach collection='batches' item='batch' open='(' separator=',' close=')'>#{batch}</foreach>
+        ) ranked WHERE work_row &lt;= 1001 ORDER BY batch_key,work_row
+        </script>
+        """)
+    List<BatchDelivery> batches(@Param("batches") List<String> batches);
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/work/AppointmentWorkDeliveryProvider.java b/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/work/AppointmentWorkDeliveryProvider.java
new file mode 100644
index 000000000..bf80098b6
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/work/AppointmentWorkDeliveryProvider.java
@@ -0,0 +1,158 @@
+package com.baiyue.lastleg.inboundplan.work;
+
+import com.baiyue.lastleg.appointmentplanning.*;
+import com.baiyue.lastleg.appointmentwork.*;
+import com.baiyue.lastleg.inboundplan.service.InboundFbaAppointmentService;
+import com.baiyue.lastleg.inboundplan.dto.FbaAppointmentResponse;
+import com.baiyue.lastleg.inboundplan.receiving.FbaReceivingStore;
+import com.baiyue.lastleg.inboundplan.receiving.FbaReceivingContracts.BatchReceiving;
+import com.baiyue.lastleg.security.OverseasPermissions;
+import org.springframework.stereotype.Component;
+import java.util.*;
+import static com.baiyue.lastleg.appointmentwork.AppointmentWorkFactGateway.*;
+import static com.baiyue.lastleg.appointmentwork.AppointmentWorkModels.*;
+import static com.baiyue.lastleg.appointmentwork.AppointmentWorkPolicy.*;
+import static com.baiyue.lastleg.inboundplan.work.AppointmentWorkAppointmentChanges.*;
+
+@Component
+public class AppointmentWorkDeliveryProvider implements AppointmentWorkFactGateway.BusinessProvider {
+    private final InboundFbaAppointmentService appointments;
+    private final AppointmentCargoVerificationService cargo;
+    private final AppointmentWorkCommitmentService commitments;
+    private final AppointmentWorkDeliveryMapper deliveries;
+    private final AppointmentWorkSourceMapper sourceMapping;
+    private final FbaReceivingStore receiving;
+    public AppointmentWorkDeliveryProvider(InboundFbaAppointmentService appointments,AppointmentCargoVerificationService cargo,AppointmentWorkCommitmentService commitments,AppointmentWorkDeliveryMapper deliveries,AppointmentWorkSourceMapper sourceMapping,FbaReceivingStore receiving) {
+        this.appointments=appointments; this.cargo=cargo; this.commitments=commitments; this.deliveries=deliveries; this.sourceMapping=sourceMapping;this.receiving=receiving;
+    }
+    public boolean supports(Type type,Flow flow) { return type==Type.DELIVERY && flow==Flow.TRANSFER; }
+    public List<Fact> read(List<FactRequest> requests) {
+        var mapped=new HashMap<String,List<AppointmentWorkSourceMapper.Source>>();
+        var privateSources=new HashMap<String,List<AppointmentWorkSourceMapper.Source>>();
+        var containers=requests.stream().filter(r->r.batchKey()==null && r.requirementKey()!=null && r.requirementKey().startsWith("INBOUND:")).map(FactRequest::containerBookingId).distinct().toList();
+        if(!containers.isEmpty()) sourceMapping.containerSourcesBatch(containers).forEach(s->mapped.computeIfAbsent(s.containerBookingId(),ignored->new ArrayList<>()).add(s.source()));
+        for(var request:requests) if(request.batchKey()==null && request.requirementKey()!=null && request.requirementKey().startsWith("INBOUND:")) {
+            var sources=mapped.getOrDefault(request.containerBookingId(),List.of());
+            if(sources.size()>1000) throw unavailable("柜次尾程来源超过完整读取上限");
+            var related=sources.stream().filter(s->request.requirementKey().equals("INBOUND:"+s.sourceInboundId())).toList();
+            if(!related.isEmpty() && related.stream().allMatch(s->"PRIVATE".equals(s.destinationType()))) privateSources.put(request.workItemKey(),related);
+        }
+        var refs=requests.stream().filter(r->r.batchKey()==null && !privateSources.containsKey(r.workItemKey())).flatMap(r->r.sources().stream())
+            .map(s->new AppointmentCoverageService.SourceRef(s.customerId(),s.sourceKey(),s.destinationKey())).distinct().toList();
+        var inspections=new HashMap<AppointmentCoverageService.SourceRef,AppointmentCargoVerificationService.Inspection>();
+        if(!refs.isEmpty()) cargo.inspectBatch(refs).forEach(i->inspections.put(i.reference(),i));
+        var batches=requests.stream().map(FactRequest::batchKey).filter(k->k!=null && !k.startsWith("DISPATCH:")).distinct().toList();
+        var snapshots=new HashMap<String,FbaAppointmentResponse>();
+        var deliveryRows=new HashMap<String,List<AppointmentWorkDeliveryMapper.Delivery>>();
+        Map<String,String> impacts=Map.of();
+        var receivingSnapshots=new HashMap<String,BatchReceiving>();
+        if(!batches.isEmpty()) {
+            appointments.batchSnapshots(batches).forEach(a->snapshots.put(a.batchKey(),a));
+            deliveries.batches(batches).forEach(d->deliveryRows.computeIfAbsent(d.batchKey(),ignored->new ArrayList<>()).add(d.delivery()));
+            receiving.snapshots(batches).forEach(s->receivingSnapshots.put(s.batchKey(),s));
+            impacts=commitments.impactTokens(requests.stream().filter(r->r.batchKey()!=null && r.batchKey().startsWith("FBA_APPOINTMENT:")).map(r->customerRequirement(r.batchKey(),deliveryCustomer(r.sources()))).distinct().toList());
+        }
+        var context=new BatchFacts(snapshots,deliveryRows,impacts,receivingSnapshots);
+        return requests.stream().map(r->read(r,privateSources.get(r.workItemKey()),inspections,context)).toList();
+    }
+    private record BatchFacts(Map<String,FbaAppointmentResponse> appointments,Map<String,List<AppointmentWorkDeliveryMapper.Delivery>> deliveries,Map<String,String> impacts,Map<String,BatchReceiving> receiving) { }
+    private Fact read(FactRequest request,List<AppointmentWorkSourceMapper.Source> privateSources,Map<AppointmentCoverageService.SourceRef,AppointmentCargoVerificationService.Inspection> inspections,BatchFacts context) {
+        if(request.batchKey()==null) return privateSources!=null?customer(request,privateSources):unbatched(request,inspections);
+        if(request.batchKey().startsWith("DISPATCH:")) return customerBatch(request);
+        var a=context.appointments().get(request.batchKey());
+        var customer=deliveryCustomer(request.sources());
+        var impact=context.impacts().get(customerRequirement(request.batchKey(),customer));
+        if(a==null || impact==null) throw unavailable("预约批次事实批量读取不完整");
+        var receiving=receiving(a,customer,context.receiving().get(a.batchKey()));
+        boolean unsuccessful=receiving.agreement()==null && (receiving.cancelled() || "FAILED".equals(receiving.status()));
+        var target=receiving.target();var confirmed=receiving.confirmed();
+        var customerItems=a.items().stream().filter(i->customer.equals(i.customerId())).toList();
+        var sourceRefs=customerItems.stream().map(i->new SourceReference(i.customerId(),i.sourceKey(),i.destinationKey())).distinct().toList();
+        if(customerItems.isEmpty() || !new HashSet<>(sourceRefs).equals(new HashSet<>(request.sources()))) throw conflict("当前客户批次来源已变化，请先同步工作清单");
+        var batchRows=context.deliveries().getOrDefault(a.batchKey(),List.of());
+        if(batchRows.size()>1000) throw unavailable("批次派送事实超过完整读取上限");
+        var rows=batchRows.stream().filter(d->customer.equals(d.customerId())).toList();
+        boolean complete=!rows.isEmpty() && rows.stream().allMatch(d->d.status()!=null && Set.of("DELIVERED","RETURN_PENDING","RETURNED").contains(d.status()) && d.signedAt()!=null && d.packages()!=null && d.packages().equals(d.signedPackages()));
+        // Every original source allocation must have real dispatch coverage, not just one signed fragment.
+        for(var item:customerItems) {
+            long allocated=rows.stream().filter(d->item.customerId().equals(d.customerId()) && item.sourceKey().equals(d.sourceKey()) && item.destinationKey().equals(d.destinationKey())).mapToLong(d->d.allocatedPackages()).sum();
+            if(item.packageCount()==null || allocated!=item.packageCount()) complete=false;
+        }
+        if(rows.stream().anyMatch(d->sourceRefs.stream().noneMatch(s->Objects.equals(s.sourceKey(),d.sourceKey()) && Objects.equals(s.destinationKey(),d.destinationKey())))) complete=false;
+        var actual=complete?new Actual(null,rows.stream().map(AppointmentWorkDeliveryMapper.Delivery::signedAt).max(Comparator.naturalOrder()).orElseThrow(),null):null;
+        var execution=complete?ExecutionStatus.COMPLETED:rows.stream().anyMatch(d->"DEPARTED".equals(d.dispatchStatus()) || "PARTIAL_DEPARTED".equals(d.dispatchStatus()))?ExecutionStatus.IN_PROGRESS:ExecutionStatus.PENDING;
+        var blocks=new ArrayList<String>();
+        if(unsuccessful) blocks.add("原预约已取消或未约成，需求须继续安排");
+        if(!a.replacementBatchKeys().isEmpty()) blocks.add("原批次已替代，请进入新批次");
+        if(receiving.pending()!=null) blocks.add("本客户收货范围变化待仓库明确回复，暂不可发车");
+        if(execution==ExecutionStatus.IN_PROGRESS) blocks.add("本客户运输已执行，普通改约已停止，请从原运输异常处理");
+        var action=execution!=ExecutionStatus.PENDING?null:new Action(receiving.pending()!=null?ActionCode.CHANGE_BOOKING:confirmed==null?ActionCode.RECORD_CONFIRMATION:ActionCode.CHANGE_BOOKING,receiving.pending()!=null?"继续处理待确认变化":unsuccessful?"沿原批次重新预约":confirmed==null?"维护原预约并登记确认":"核对或变更原预约",request.workItemKey(),new AppointmentTarget(a.id().toString(),a.batchKey(),sourceRefs));
+        var references=new ArrayList<BusinessReference>(); references.add(new BusinessReference("FBA_APPOINTMENT",a.batchKey(),a.appointmentNo(),"送仓预约"));
+        if(receiving.pending()!=null) references.add(new BusinessReference("RECEIVING_CHANGE",receiving.pending().changeKey(),null,"待仓库确认的变化"));
+        rows.stream().filter(d->d.deliveryNo()!=null).map(d->new BusinessReference("DELIVERY",d.deliveryNo(),d.deliveryNo(),"实际派送")).distinct().forEach(references::add);
+        return new Fact(request.workItemKey(),digest(customerItems+":"+target+":"+confirmed+":"+receiving.pending()+":"+receiving.status()+":"+rows),impact,true,
+            receiving.pending()!=null?PlanStatus.AWAITING_REPLY:confirmed!=null?PlanStatus.CONFIRMED:target!=null?PlanStatus.TARGET_SET:PlanStatus.UNPLANNED,execution,target,confirmed,actual,receiving.timezone(),a.appointmentNo(),null,
+            List.of(ORDER_READ),action==null?List.of():receiving.pending()!=null?List.of(OverseasPermissions.INBOUND_ORDER_FBA_APPOINTMENT,"platform:appointment:delete"):List.of(OverseasPermissions.INBOUND_ORDER_FBA_APPOINTMENT),action,blocks,
+            actual!=null?List.of("SOURCE_TIMEZONE"):List.of(),List.copyOf(references),null,null);
+    }
+    private Fact unbatched(FactRequest request,Map<AppointmentCoverageService.SourceRef,AppointmentCargoVerificationService.Inspection> inspections) {
+        var blocks=new ArrayList<String>(); var missing=new ArrayList<String>(); Action action=null;
+        var fingerprints=new ArrayList<String>();
+        if(request.sources().isEmpty()) { blocks.add("尾程货源尚未建立，请先核对整柜来源与入仓计划"); missing.add("LASTLEG_SOURCE"); }
+        else {
+            for(var source:request.sources()) {
+                try {
+                    var inspection=inspections.get(new AppointmentCoverageService.SourceRef(source.customerId(),source.sourceKey(),source.destinationKey()));
+                    if(inspection==null) throw unavailable("预约货源批量读取不完整");
+                    var context=inspection.requireContext();
+                    fingerprints.add(context.toString()); blocks.addAll(context.blockReasons());
+                } catch(org.springframework.web.server.ResponseStatusException error) {
+                    if(!AppointmentWorkSourceAvailability.unresolved(error)) throw error;
+                    fingerprints.add(source+":"+error.getReason());blocks.add(error.getReason());missing.add("SOURCE_CONFIGURATION");
+                }
+            }
+            var first=request.sources().get(0);
+            if(missing.isEmpty()) action=new Action(ActionCode.VERIFY_CARGO,"核实货物并建立预约",request.workItemKey(),new CargoTarget(first));
+        }
+        return new Fact(request.workItemKey(),digest(request.requirementKey()+":"+fingerprints),"UNBATCHED",false,PlanStatus.UNPLANNED,ExecutionStatus.PENDING,
+            null,null,null,null,null,null,List.of(ORDER_READ),action==null?List.of():List.of(OverseasPermissions.INBOUND_ORDER_FBA_APPOINTMENT),action,
+            blocks.stream().distinct().toList(),missing,List.of(),null,null);
+    }
+    private Fact customer(FactRequest request,List<AppointmentWorkSourceMapper.Source> sources) {
+        var rows=deliveries.customer(request.containerBookingId(),request.requirementKey().substring(8));
+        var expected=sources.stream().map(s->new Expected(s.id(),s.customerId(),s.packageCount()==null?null:s.packageCount().longValue())).toList();
+        return customerFact(request,rows,expected,null);
+    }
+    private record Expected(long orderId,String customerId,Long packages) { }
+    private Fact customerBatch(FactRequest request) {
+        var sources=sourceMapping.privateBatch(request.batchKey());
+        if(sources.size()>1000) throw unavailable("客户仓实物批次超过完整读取上限");
+        // A complete scan may not have reached this changed dispatch's container yet. Represent its
+        // removal explicitly so compensation can advance to that page and restore the original demand.
+        if(sources.isEmpty() || sources.stream().anyMatch(s->"CANCELLED".equals(s.status())))
+            return new Fact(request.workItemKey(),digest("REMOVED:"+sources),"REMOVED",false,PlanStatus.UNPLANNED,ExecutionStatus.PENDING,null,null,null,null,
+                sources.isEmpty()?null:sources.get(0).dispatchNo(),null,List.of(ORDER_READ),List.of(),null,List.of("原客户仓排车已取消或移除实物，待完整需求同步"),List.of(),List.of(),null,null);
+        return customerFact(request,deliveries.privateBatch(request.batchKey()),sources.stream().map(s->new Expected(s.orderId(),s.customerId(),s.packages())).toList(),sources.get(0).dispatchNo());
+    }
+    private Fact customerFact(FactRequest request,List<AppointmentWorkDeliveryMapper.CustomerDelivery> rows,List<Expected> sources,String dispatchNo) {
+        if(rows.size()>1000) throw unavailable("客户仓派送事实超过完整读取上限");
+        boolean complete=!rows.isEmpty() && rows.stream().allMatch(d->d.status()!=null && Set.of("DELIVERED","RETURN_PENDING","RETURNED").contains(d.status()) && d.signedAt()!=null && d.packages()!=null && d.packages().equals(d.signedPackages()));
+        for(var source:sources) {
+            long delivered=rows.stream().filter(r->r.orderId()==source.orderId() && source.customerId().equals(r.customerId())).mapToLong(AppointmentWorkDeliveryMapper.CustomerDelivery::pickedPackages).sum();
+            if(source.packages()==null || source.packages()<=0 || delivered!=source.packages()) complete=false;
+        }
+        if(rows.stream().anyMatch(r->sources.stream().noneMatch(s->s.orderId()==r.orderId() && s.customerId().equals(r.customerId())))) complete=false;
+        var dates=rows.stream().map(AppointmentWorkDeliveryMapper.CustomerDelivery::plannedDeliveryAt).filter(Objects::nonNull).distinct().sorted().toList();
+        var target=dates.isEmpty()?null:slot(dates.get(0),null,null);
+        var actual=complete?new Actual(null,rows.stream().map(AppointmentWorkDeliveryMapper.CustomerDelivery::signedAt).max(Comparator.naturalOrder()).orElseThrow(),null):null;
+        var refs=new ArrayList<BusinessReference>();
+        if(dispatchNo!=null) refs.add(new BusinessReference("DISPATCH",request.batchKey(),dispatchNo,"客户仓排车"));
+        rows.stream().map(r->new BusinessReference("DELIVERY",r.deliveryNo(),r.deliveryNo(),"客户仓实际派送")).distinct().forEach(refs::add);
+        sources.stream().map(s->new BusinessReference("CUSTOMER",s.customerId(),null,"所属客户")).distinct().forEach(refs::add);
+        var action=rows.isEmpty() || complete?null:new Action(ActionCode.VIEW_DETAIL,"查看原派送进度",request.workItemKey(),new ReadTarget(List.copyOf(refs)));
+        return new Fact(request.workItemKey(),digest(sources+":"+rows),digest(sources+":"+dates),!rows.isEmpty(),target==null?PlanStatus.UNPLANNED:PlanStatus.TARGET_SET,
+            complete?ExecutionStatus.COMPLETED:rows.isEmpty()?ExecutionStatus.PENDING:ExecutionStatus.IN_PROGRESS,target,null,actual,null,dispatchNo!=null?dispatchNo:rows.size()==1?rows.get(0).deliveryNo():null,null,
+            List.of(ORDER_READ),action==null?List.of():List.of("platform:overseas-warehouse:delivery:list"),action,
+            dates.size()>1?List.of("同一收货需求存在多个派送日期，请在原派送单核对"):List.of(),target!=null || actual!=null?List.of("SOURCE_TIMEZONE"):List.of(),List.copyOf(refs),null,null);
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/work/AppointmentWorkDispatchBinding.java b/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/work/AppointmentWorkDispatchBinding.java
new file mode 100644
index 000000000..5bc4fbd0a
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/work/AppointmentWorkDispatchBinding.java
@@ -0,0 +1,197 @@
+package com.baiyue.lastleg.inboundplan.work;
+
+import com.baiyue.lastleg.appointmentplanning.*;
+import com.baiyue.lastleg.appointmentwork.*;
+import com.baiyue.lastleg.inboundplan.service.InboundFbaAppointmentService;
+import org.springframework.stereotype.Component;
+import org.springframework.transaction.annotation.*;
+import java.util.*;
+import java.util.stream.Collectors;
+import static com.baiyue.lastleg.appointmentwork.AppointmentWorkPolicy.*;
+
+@Component
+@Transactional(propagation=Propagation.MANDATORY)
+public class AppointmentWorkDispatchBinding implements AppointmentWorkDispatchPort {
+    @Transactional(readOnly=true,propagation=Propagation.SUPPORTS)
+    public Map<Long,List<BatchReference>> references(List<Long> dispatchIds) {
+        if(dispatchIds==null || dispatchIds.isEmpty()) return Map.of();
+        if(dispatchIds.stream().anyMatch(id->id==null || id<=0)) throw bad("排车引用缺少真实排车身份");
+        var rows=mapper.references(dispatchIds.stream().distinct().sorted().toList());
+        if(rows.size()>20000) throw unavailable("排车批次引用超过完整读取上限");
+        record Group(long dispatchId,String batchKey,String batchNo,String customerId) { }
+        var groups=new LinkedHashMap<Group,Map<List<String>,Integer>>();
+        for(var row:rows) {
+            if(!dispatchIds.contains(row.dispatchId()) || row.batchKey()==null || row.customerId()==null || row.sourceKey()==null || row.destinationKey()==null || row.packages()<=0)
+                throw unavailable("原排车逐票批次引用不完整");
+            groups.computeIfAbsent(new Group(row.dispatchId(),row.batchKey(),row.batchNo(),row.customerId()),ignored->new LinkedHashMap<>())
+                .merge(List.of(row.sourceKey(),row.destinationKey()),row.packages(),Math::addExact);
+        }
+        var result=new LinkedHashMap<Long,List<BatchReference>>();dispatchIds.forEach(id->result.put(id,new ArrayList<>()));
+        groups.forEach((group,sources)->result.get(group.dispatchId()).add(new BatchReference(group.batchKey(),group.batchNo(),group.customerId(),
+            sources.entrySet().stream().map(e->new BatchSource(e.getKey().get(0),e.getKey().get(1),e.getValue())).toList())));
+        result.replaceAll((id,refs)->List.copyOf(refs));return Collections.unmodifiableMap(result);
+    }
+    private final AppointmentWorkDispatchMapper mapper;
+    private final InboundFbaAppointmentService appointments;
+    private final AppointmentSourceService sources;
+    private final AppointmentWorkChanges changes;
+    private final com.baiyue.lastleg.inboundplan.receiving.FbaReceivingStore receiving;
+    public AppointmentWorkDispatchBinding(AppointmentWorkDispatchMapper mapper,InboundFbaAppointmentService appointments,AppointmentSourceService sources,AppointmentWorkChanges changes,
+        com.baiyue.lastleg.inboundplan.receiving.FbaReceivingStore receiving) {
+        this.mapper=mapper; this.appointments=appointments; this.sources=sources; this.changes=changes;this.receiving=receiving;
+    }
+    public void bind(String customer,long dispatch,List<PhysicalItem> items,List<Allocation> allocations) {
+        if(allocations==null) throw bad("批次实物分配清单必填");
+        if(allocations.isEmpty()) {
+            if(mapper.byDispatch(dispatch).stream().anyMatch(a->a.batchKey().startsWith("FBA_APPOINTMENT:"))) throw conflict("已关联预约批次，修改实物时须同时提交完整批次分配");
+            for(var item:items) if(item.planPalletId()!=null) requireNoBatch(customer,item.planPalletId());
+            var privateRows=new ArrayList<AppointmentWorkDispatchMapper.Bound>();
+            for(var item:items) if(item.planPalletId()!=null) privateRows.addAll(privateAllocation(customer,dispatch,item));
+            if(!privateRows.isEmpty() || mapper.count(dispatch)>0) { mapper.remove(dispatch);privateRows.forEach(mapper::insert);changes.requirementsChanged(); }
+            return;
+        }
+        if(allocations.size()>1000) throw bad("批次实物分配最多1000条");
+        var byPallet=items.stream().filter(i->i.planPalletId()!=null).collect(Collectors.toMap(PhysicalItem::planPalletId,i->i));
+        var seen=new HashSet<String>();
+        for(var row:allocations) {
+            if(row==null || row.packageCount()<=0 || !customer.equals(row.customerId()) || !byPallet.containsKey(row.planPalletId())) throw conflict("批次分配必须属于本客户已选择的实物托盘");
+            if(!seen.add(row.planPalletId()+"/"+row.batchKey()+"/"+row.sourceKey()+"/"+row.destinationKey())) throw bad("批次实物分配重复");
+        }
+        var batches=new TreeSet<>(allocations.stream().map(Allocation::batchKey).toList());
+        for(var batch:batches) lock(batch);
+        var persisted=new ArrayList<AppointmentWorkDispatchMapper.Bound>();
+        for(var item:byPallet.values()) {
+            var selected=allocations.stream().filter(a->item.planPalletId().equals(a.planPalletId())).toList();
+            if(selected.isEmpty()) {
+                var privateRows=privateAllocation(customer,dispatch,item);
+                if(privateRows.isEmpty()) throw conflict("批次排车须明确每个托盘的逐票实物分配");
+                persisted.addAll(privateRows);continue;
+            }
+            validatePhysical(customer,item,selected,"RECEIVED".equals(item.sourceStage()),false);
+            for(var a:selected) persisted.add(new AppointmentWorkDispatchMapper.Bound(dispatch,item.itemId(),item.planPalletId(),a.batchKey(),customer,a.sourceKey(),a.destinationKey(),a.packageCount()));
+        }
+        for(var batch:batches) {
+            var context=appointments.batchContext(batch); var appointment=context.appointment();
+            // Pre-arrangement reserves real cargo only. requireReceiving separately gates actual departure per customer.
+            if(!appointment.replacementBatchKeys().isEmpty()) throw conflict("不能绑定已被替代的预约批次");
+            requireCurrentAllocation(appointment,customer,dispatch,allocations.stream().filter(a->batch.equals(a.batchKey())).toList());
+        }
+        mapper.remove(dispatch); persisted.forEach(mapper::insert); changes.requirementsChanged();
+    }
+    public void requireReplay(String customer,long dispatch,List<Allocation> allocations) {
+        if(allocations==null || allocations.stream().anyMatch(a->a==null || !customer.equals(a.customerId()))) throw conflict("重放排车的逐票批次分配不一致");
+        var original=mapper.byDispatch(dispatch).stream().filter(a->!a.batchKey().startsWith("DISPATCH:"))
+            .map(a->new Allocation(a.palletId(),a.batchKey(),a.customerId(),a.sourceKey(),a.destinationKey(),a.packages())).toList();
+        if(allocations.size()!=original.size() || !new HashSet<>(allocations).equals(new HashSet<>(original))) throw conflict("原排车已存在，不能通过重放请求改写批次分配");
+    }
+    private void validatePhysical(String customer,PhysicalItem item,List<Allocation> selected,boolean received,boolean picked) {
+        var physical=picked?mapper.pickedPhysical(item.itemId(),customer):mapper.physical(item.planPalletId(),customer);
+        if(physical.isEmpty()) throw conflict("托盘缺少真实逐票分配，不能按整票或整托总数猜测批次");
+        var canonical=AppointmentWorkPhysicalSources.canonical(physical,sources);
+        var remaining=new HashMap<String,Long>();
+        for(int i=0;i<physical.size();i++) {
+            var p=physical.get(i); Integer count=received?p.countedPackages():p.plannedPackages();
+            if(count==null || count<=0) throw conflict("托盘逐票实物箱数未核实");
+            remaining.merge(AppointmentWorkPhysicalSources.ref(canonical,p).sourceKey()+"/"+p.destinationKey(),count.longValue(),Long::sum);
+        }
+        for(var a:selected) remaining.merge(a.sourceKey()+"/"+a.destinationKey(),-(long)a.packageCount(),Long::sum);
+        if(remaining.values().stream().anyMatch(n->n!=0)) throw conflict("批次逐票分配必须与所选托盘实际货物完全一致");
+        if(item.packages()!=null && selected.stream().mapToLong(Allocation::packageCount).sum()!=item.packages()) throw conflict("逐票分配与所选托盘箱数不一致");
+    }
+    public void requireDeparture(String dispatchNo) { checkDeparture(dispatchNo,true); }
+    public String departureBlockReason(String dispatchNo) {
+        try { checkDeparture(dispatchNo,false);return null; }
+        catch(org.springframework.web.server.ResponseStatusException error) {
+            if(error.getStatusCode().value()!=409) throw error;
+            return error.getReason();
+        }
+    }
+    private void checkDeparture(String dispatchNo,boolean locked) {
+        var rows=mapper.bindings(dispatchNo);
+        var linked=rows.stream().map(AppointmentWorkDispatchMapper.Bound::palletId).collect(Collectors.toSet());
+        for(var item:mapper.dispatchPhysical(dispatchNo)) if(item.planPalletId()!=null && !linked.contains(item.planPalletId())) {
+            requireNoBatch(item.customerId(),item.planPalletId());
+            if(mapper.physical(item.planPalletId(),item.customerId()).stream().anyMatch(p->p.destinationKey()!=null && p.destinationKey().startsWith("CUSTOMER:"))) throw conflict("客户仓排车缺少逐票实物批次关联，请重新核对排车");
+        }
+        for(var batch:rows.stream().map(AppointmentWorkDispatchMapper.Bound::batchKey).distinct().sorted().toList()) {
+            if(batch.startsWith("DISPATCH:")) continue;
+            if(locked) lock(batch);
+            var a=appointments.batchContext(batch).appointment();
+            if(!a.replacementBatchKeys().isEmpty()) throw conflict("关联批次已被替代，请重新核对实物批次后发车");
+            var allocated=rows.stream().filter(row->batch.equals(row.batchKey())).toList();
+            var dispatchIds=allocated.stream().map(AppointmentWorkDispatchMapper.Bound::dispatchId).distinct().toList();
+            if(dispatchIds.size()!=1) throw conflict("排车批次关联不一致，请重新核对实物分配");
+            for(var customer:allocated.stream().map(AppointmentWorkDispatchMapper.Bound::customerId).distinct().toList()) {
+                requireReceiving(batch,customer,allocated.stream().filter(row->customer.equals(row.customerId())).toList());
+                requireCurrentAllocation(a,customer,dispatchIds.get(0),allocated.stream().filter(row->customer.equals(row.customerId()))
+                    .map(row->new Allocation(row.palletId(),row.batchKey(),row.customerId(),row.sourceKey(),row.destinationKey(),row.packages())).toList());
+            }
+        }
+        for(var group:rows.stream().collect(Collectors.groupingBy(AppointmentWorkDispatchMapper.Bound::palletId)).values()) {
+            var first=group.get(0);
+            validatePhysical(first.customerId(),new PhysicalItem(first.itemId(),first.palletId(),"RECEIVED",null),
+                group.stream().map(a->new Allocation(a.palletId(),a.batchKey(),a.customerId(),a.sourceKey(),a.destinationKey(),a.packages())).toList(),true,true);
+        }
+    }
+    private void requireReceiving(String batch,String customer,List<AppointmentWorkDispatchMapper.Bound> rows) {
+        if(receiving.hasPending(batch,customer)) throw conflict("本客户有待仓库确认的变化，保留原安排但禁止发车，请先完成明确回复");
+        var agreement=receiving.currentAgreement(batch,customer);
+        if(agreement==null || !"ACTIVE".equals(agreement.status()) || agreement.details()==null || !"SUCCESS".equals(agreement.details().appointmentStatus())
+            || agreement.details().appointmentAt()==null) throw conflict("本客户尚无有效收货确认，请先完成当前预约后发车");
+        var members=agreement.members().stream().filter(m->batch.equals(m.batchKey()) && customer.equals(m.customerId())).toList();
+        if(members.size()!=1) throw conflict("当前收货确认未唯一覆盖本客户批次，请重新核对");
+        for(var group:rows.stream().collect(Collectors.groupingBy(r->List.of(r.sourceKey(),r.destinationKey()))).values()) {
+            var first=group.get(0);
+            var sources=members.get(0).sources().stream().filter(s->first.sourceKey().equals(s.sourceKey()) && first.destinationKey().equals(s.destinationKey())).toList();
+            if(sources.size()!=1 || mapper.allocated(batch,customer,first.sourceKey(),first.destinationKey(),first.dispatchId())
+                +group.stream().mapToLong(AppointmentWorkDispatchMapper.Bound::packages).sum()>sources.get(0).packageCount())
+                throw conflict("当前收货确认未完整覆盖本次逐票实物，请重新核对");
+        }
+    }
+    private void requireCurrentAllocation(com.baiyue.lastleg.inboundplan.dto.FbaAppointmentResponse appointment,String customer,long dispatch,List<Allocation> allocations) {
+        var grouped=allocations.stream().collect(Collectors.groupingBy(a->List.of(a.sourceKey(),a.destinationKey())));
+        for(var group:grouped.values()) {
+            var ref=group.get(0);
+            var originals=appointment.items().stream().filter(i->customer.equals(i.customerId()) && ref.sourceKey().equals(i.sourceKey()) && ref.destinationKey().equals(i.destinationKey())).toList();
+            if(originals.size()!=1) throw conflict("实物来源不属于当前预约批次的唯一分配，请重新核对");
+            var original=originals.get(0);
+            long count=group.stream().mapToLong(Allocation::packageCount).sum();
+            if(group.stream().anyMatch(a->a.packageCount()<=0) || original.packageCount()==null
+                || mapper.allocated(appointment.batchKey(),customer,ref.sourceKey(),ref.destinationKey(),dispatch)+count>original.packageCount())
+                throw conflict("所选实物超过当前批次逐票分配量，请重新核对");
+        }
+    }
+    private void requireNoBatch(String customer,long pallet) {
+        var physical=mapper.physical(pallet,customer).stream().filter(p->p.destinationKey()!=null && p.destinationKey().startsWith("FBA:")).toList();
+        var canonical=AppointmentWorkPhysicalSources.canonical(physical,sources);
+        var refs=physical.stream().map(p->new AppointmentCoverageService.SourceRef(customer,AppointmentWorkPhysicalSources.ref(canonical,p).sourceKey(),p.destinationKey())).distinct().toList();
+        if(!refs.isEmpty() && appointments.relatedBatchSnapshots(refs).stream().anyMatch(a->a.replacementBatchKeys().isEmpty()))
+            throw conflict("所选实物已有预约批次，必须明确逐批逐票分配后才能排车或发车");
+    }
+    public void removeItem(long dispatchId,long itemId) { mapper.removeItem(dispatchId,itemId); changes.requirementsChanged(); }
+    public void requireTripBinding(String dispatchNo,long tripId) {
+        for(var batch:mapper.bindings(dispatchNo).stream().map(AppointmentWorkDispatchMapper.Bound::batchKey).distinct().sorted().toList()) {
+            if(batch.startsWith("DISPATCH:")) continue;
+            lock(batch);
+            if(mapper.trips(batch).stream().anyMatch(id->id!=tripId)) throw conflict("同一预约批次已关联其他车次，请先在原预约分批后分别安排车辆");
+        }
+    }
+    private List<AppointmentWorkDispatchMapper.Bound> privateAllocation(String customer,long dispatch,PhysicalItem item) {
+        var physical=mapper.physical(item.planPalletId(),customer);
+        if(physical.isEmpty() || physical.stream().noneMatch(p->p.destinationKey()!=null && p.destinationKey().startsWith("CUSTOMER:"))) return List.of();
+        if(physical.stream().anyMatch(p->p.destinationKey()==null || !p.destinationKey().startsWith("CUSTOMER:"))) throw conflict("客户仓实物不能混入FBA批次，请先核对托盘目的地");
+        var canonical=AppointmentWorkPhysicalSources.canonical(physical,sources); var rows=new ArrayList<AppointmentWorkDispatchMapper.Bound>();
+        for(var part:physical) {
+            var count="RECEIVED".equals(item.sourceStage())?part.countedPackages():part.plannedPackages();
+            if(count==null || count<=0) throw conflict("客户仓逐票实物数量尚未核实");
+            rows.add(new AppointmentWorkDispatchMapper.Bound(dispatch,item.itemId(),item.planPalletId(),"DISPATCH:"+dispatch,customer,AppointmentWorkPhysicalSources.ref(canonical,part).sourceKey(),part.destinationKey(),count));
+        }
+        if(item.packages()==null || rows.stream().mapToLong(AppointmentWorkDispatchMapper.Bound::packages).sum()!=item.packages()) throw conflict("客户仓逐票实物分配与所选托盘箱数不一致");
+        return rows;
+    }
+    private void lock(String batch) {
+        if(batch==null || !batch.startsWith("FBA_APPOINTMENT:")) throw bad("预约批次键无效");
+        try { long id=Long.parseLong(batch.substring("FBA_APPOINTMENT:".length())); if(!batch.equals("FBA_APPOINTMENT:"+id) || mapper.lockAppointment(id)==null) throw conflict("预约批次不存在"); }
+        catch(NumberFormatException | IndexOutOfBoundsException error) { throw bad("预约批次键无效"); }
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/work/AppointmentWorkDispatchCandidateController.java b/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/work/AppointmentWorkDispatchCandidateController.java
new file mode 100644
index 000000000..2baf1a182
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/work/AppointmentWorkDispatchCandidateController.java
@@ -0,0 +1,21 @@
+package com.baiyue.lastleg.inboundplan.work;
+
+import com.baiyue.common.core.api.ApiResponse;
+import com.baiyue.common.security.AuthenticatedUser;
+import org.springframework.web.bind.annotation.*;
+import org.springframework.security.access.prepost.PreAuthorize;
+import org.springframework.security.core.annotation.AuthenticationPrincipal;
+import static com.baiyue.lastleg.appointmentwork.AppointmentWorkPolicy.*;
+
+@RestController
+@RequestMapping("/api/platform/v1/last-leg/appointment-planning/batches")
+public class AppointmentWorkDispatchCandidateController {
+    private final AppointmentWorkDispatchCandidates service;
+    public AppointmentWorkDispatchCandidateController(AppointmentWorkDispatchCandidates service) { this.service=service; }
+    @GetMapping("/{batchKey}/dispatch-candidates")
+    @PreAuthorize("hasAuthority('platform:appointment:list') and hasAuthority('platform:overseas-warehouse:last-mile-order:list') and hasAuthority('platform:overseas-warehouse:inbound-order:list')")
+    public ApiResponse<AppointmentWorkDispatchCandidates.Result> candidates(@AuthenticationPrincipal AuthenticatedUser user,@PathVariable String batchKey) {
+        if(user==null || user.userId()==null || !"PLATFORM".equals(user.appCode()) || !Long.valueOf(0).equals(user.tenantId())) throw forbidden("仅平台操作人员可读取批次实物");
+        return ApiResponse.success(service.read(batchKey));
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/work/AppointmentWorkDispatchCandidates.java b/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/work/AppointmentWorkDispatchCandidates.java
new file mode 100644
index 000000000..c0a15bd6d
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/work/AppointmentWorkDispatchCandidates.java
@@ -0,0 +1,48 @@
+package com.baiyue.lastleg.inboundplan.work;
+
+import com.baiyue.lastleg.appointmentplanning.*;
+import com.baiyue.lastleg.appointmentwork.AppointmentWorkDispatchPort.Allocation;
+import com.baiyue.lastleg.inboundplan.service.InboundFbaAppointmentService;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Transactional;
+import java.util.*;
+import static com.baiyue.lastleg.appointmentwork.AppointmentWorkPolicy.*;
+
+@Service
+public class AppointmentWorkDispatchCandidates {
+    public record Candidate(long planPalletId,String palletNo,long planId,String planNo,String customerId,String sourceStage,Integer packageCount,List<Allocation> allocations,List<String> blockReasons) { }
+    public record Result(String batchKey,Integer version,List<Candidate> candidates,List<String> blockReasons) { }
+    private final AppointmentWorkDispatchMapper mapper;
+    private final InboundFbaAppointmentService appointments;
+    private final AppointmentSourceService sources;
+    public AppointmentWorkDispatchCandidates(AppointmentWorkDispatchMapper mapper,InboundFbaAppointmentService appointments,AppointmentSourceService sources) { this.mapper=mapper; this.appointments=appointments; this.sources=sources; }
+    @Transactional(readOnly=true)
+    public Result read(String batch) {
+        var appointment=appointments.batchContext(batch).appointment();
+        // Receiving outcome does not release this batch's cargo or decide another customer's physical eligibility.
+        if(!appointment.replacementBatchKeys().isEmpty()) return new Result(batch,appointment.version(),List.of(),List.of("原批次已替代，不能选择实物"));
+        var candidates=mapper.candidates(appointment.id());
+        if(candidates.size()>500) throw conflict("本批实物超过500托，请先按原预约分批");
+        var output=new ArrayList<Candidate>();
+        for(var candidate:candidates) {
+            var reasons=new ArrayList<String>(); var allocations=new ArrayList<Allocation>();
+            if(candidate.locked()) reasons.add("托盘已被其他排车或草稿占用");
+            var physical=mapper.physical(candidate.planPalletId(),candidate.customerId());
+            var refs=AppointmentWorkPhysicalSources.canonical(physical,sources);
+            Integer packages=0;
+            for(int i=0;i<physical.size();i++) {
+                var part=physical.get(i); var ref=AppointmentWorkPhysicalSources.ref(refs,part); var count="RECEIVED".equals(candidate.sourceStage())?part.countedPackages():part.plannedPackages();
+                if(count==null || count<=0) { packages=null; reasons.add("逐票实物箱数尚未核实"); continue; }
+                if(packages!=null) packages=Math.addExact(packages,count);
+                var item=appointment.items().stream().filter(a->a.customerId().equals(part.customerId()) && a.sourceKey().equals(ref.sourceKey()) && a.destinationKey().equals(part.destinationKey())).findFirst().orElse(null);
+                if(item==null) { reasons.add("托盘含本批之外的货物，请先拆托或选择完整的关联批次"); continue; }
+                long used=mapper.allocated(batch,part.customerId(),ref.sourceKey(),part.destinationKey(),-1);
+                if(item.packageCount()==null || used+count>item.packageCount()) reasons.add("本托货量超过该来源本批剩余可排量，请先核对分批或拆托");
+                allocations.add(new Allocation(candidate.planPalletId(),batch,part.customerId(),ref.sourceKey(),part.destinationKey(),count));
+            }
+            if(physical.isEmpty()) { packages=null; reasons.add("缺少逐票实物分配"); }
+            output.add(new Candidate(candidate.planPalletId(),candidate.palletNo(),candidate.planId(),candidate.planNo(),candidate.customerId(),candidate.sourceStage(),packages,List.copyOf(allocations),reasons.stream().distinct().toList()));
+        }
+        return new Result(batch,appointment.version(),List.copyOf(output),List.of());
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/work/AppointmentWorkDispatchMapper.java b/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/work/AppointmentWorkDispatchMapper.java
new file mode 100644
index 000000000..72ade2a4f
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/work/AppointmentWorkDispatchMapper.java
@@ -0,0 +1,80 @@
+package com.baiyue.lastleg.inboundplan.work;
+
+import com.baiyue.lastleg.inboundplan.entity.InboundFbaAppointment;
+import org.apache.ibatis.annotations.*;
+import java.util.List;
+
+@Mapper
+public interface AppointmentWorkDispatchMapper {
+    record Physical(Long orderId,String customerId,String destinationKey,Integer plannedPackages,Integer countedPackages) { }
+    record Bound(long dispatchId,long itemId,long palletId,String batchKey,String customerId,String sourceKey,String destinationKey,int packages) { }
+    record Candidate(long planPalletId,String palletNo,long planId,String planNo,String customerId,String sourceStage,boolean locked) { }
+    record DispatchPhysical(long itemId,Long planPalletId,String customerId,String sourceStage,Integer packages) { }
+    record TransportRow(long dispatchId,String dispatchNo,String customerId,String dispatchStatus,Integer pickedPackages,Integer shippedPackages,
+                        java.time.LocalDateTime updatedAt,long itemId,long palletId,Integer itemPackages,String sourceStage,
+                        String batchKey,String sourceKey,String destinationKey,int packages,String tripNo,Long tripVersion,String tripStatus,
+                        Long outboundId,String outboundStatus,String taskStatus) { }
+    record ReceivingSource(String batchKey,String customerId,String sourceKey,String destinationKey,Integer packages) { }
+    record ReferenceRow(long dispatchId,String batchKey,String batchNo,String customerId,String sourceKey,String destinationKey,int packages) { }
+    @Select("""
+        <script>
+        SELECT a.dispatch_id,a.batch_key,CASE WHEN a.batch_key=CONCAT('DISPATCH:',d.id) THEN d.dispatch_no ELSE p.appointment_no END batch_no,
+          a.customer_id,a.source_key,a.destination_key,a.package_count packages
+        FROM ll_dispatch_appointment_allocation a JOIN ll_dispatch_order d ON d.id=a.dispatch_id AND d.customer_id=a.customer_id
+        LEFT JOIN ll_inbound_fba_appointment p ON a.batch_key=CONCAT('FBA_APPOINTMENT:',p.id)
+        WHERE a.dispatch_id IN <foreach collection='ids' item='id' open='(' separator=',' close=')'>#{id}</foreach>
+        ORDER BY a.dispatch_id,a.batch_key,a.customer_id,a.source_key,a.destination_key,a.dispatch_item_id LIMIT 20001
+        </script>
+        """)
+    List<ReferenceRow> references(@Param("ids") List<Long> ids);
+    @Select("""
+        <script>
+        SELECT CONCAT('FBA_APPOINTMENT:',i.appointment_id) batch_key,i.customer_id,i.source_key,
+          CONCAT('FBA:',i.fba_warehouse_code) destination_key,i.package_count packages
+        FROM ll_inbound_fba_appointment_item i
+        WHERE i.active=1 AND CONCAT('FBA_APPOINTMENT:',i.appointment_id) IN
+          <foreach collection='batches' item='batch' open='(' separator=',' close=')'>#{batch}</foreach>
+        ORDER BY i.appointment_id,i.customer_id,i.source_key LIMIT 20001
+        </script>
+        """)
+    @Options(flushCache=Options.FlushCachePolicy.TRUE,useCache=false)
+    List<ReceivingSource> receivingSources(@Param("batches") List<String> batches);
+    @Select("""
+        <script>
+        SELECT a.dispatch_id,d.dispatch_no,a.customer_id,d.status dispatch_status,d.picked_package_count picked_packages,
+          d.shipped_package_count shipped_packages,d.updated_at,a.dispatch_item_id item_id,a.plan_pallet_id pallet_id,
+          i.package_count item_packages,i.source_stage,a.batch_key,a.source_key,a.destination_key,a.package_count packages,
+          t.trip_no,t.record_version trip_version,t.status trip_status,o.id outbound_id,o.status outbound_status,p.status task_status
+        FROM ll_dispatch_appointment_allocation a JOIN ll_dispatch_order d ON d.id=a.dispatch_id AND d.customer_id=a.customer_id
+        JOIN ll_dispatch_item i ON i.id=a.dispatch_item_id AND i.dispatch_order_id=d.id AND i.customer_id=d.customer_id
+        LEFT JOIN ll_fleet_trip_dispatch b ON b.dispatch_id=d.id LEFT JOIN ll_fleet_trip t ON t.id=b.trip_id
+        LEFT JOIN ll_outbound_order o ON o.dispatch_order_id=d.id AND o.customer_id=d.customer_id
+        LEFT JOIN ll_dispatch_pda_task p ON p.dispatch_order_id=d.id AND p.customer_id=d.customer_id
+        WHERE d.status&lt;&gt;'CANCELLED' AND (
+          a.dispatch_id IN (SELECT selected.dispatch_id FROM ll_dispatch_appointment_allocation selected WHERE selected.batch_key IN <foreach collection='batches' item='key' open='(' separator=',' close=')'>#{key}</foreach>)
+          <if test='trips != null and !trips.isEmpty()'>OR t.trip_no IN <foreach collection='trips' item='trip' open='(' separator=',' close=')'>#{trip}</foreach></if>
+        ) ORDER BY a.dispatch_id,a.dispatch_item_id,a.batch_key,a.customer_id,a.source_key,a.destination_key LIMIT 1001
+        </script>
+        """)
+    @Options(flushCache=Options.FlushCachePolicy.TRUE,useCache=false)
+    List<TransportRow> transportRows(@Param("batches") List<String> batches,@Param("trips") List<String> trips);
+    @Select("SELECT i.id item_id,i.plan_pallet_id,i.customer_id,i.source_stage,i.package_count packages FROM ll_dispatch_item i JOIN ll_dispatch_order d ON d.id=i.dispatch_order_id WHERE d.dispatch_no=#{number}") List<DispatchPhysical> dispatchPhysical(String number);
+    @Select("SELECT DISTINCT p.id plan_pallet_id,p.pallet_no,p.plan_id,n.plan_no,p.customer_id,CASE WHEN p.warehouse_pallet_id IS NULL THEN 'PLAN' ELSE 'RECEIVED' END source_stage,EXISTS(SELECT 1 FROM ll_dispatch_pallet_lock k WHERE k.plan_pallet_id=p.id AND k.status='ACTIVE') locked FROM ll_inbound_plan_pallet p JOIN ll_inbound_plan n ON n.id=p.plan_id JOIN ll_inbound_plan_pallet_allocation a ON a.pallet_id=p.id JOIN ll_inbound_plan_line l ON l.id=a.line_id JOIN ll_inbound_fba_appointment_item i ON i.order_id=l.order_id AND i.customer_id=l.customer_id WHERE i.appointment_id=#{id} ORDER BY p.id LIMIT 501")
+    List<Candidate> candidates(long id);
+    @Select("SELECT l.order_id,l.customer_id,CASE WHEN l.destination_type='PRIVATE' THEN CONCAT('CUSTOMER:',l.order_id) ELSE CONCAT('FBA:',l.fba_warehouse_code) END destination_key,SUM(a.planned_package_count) planned_packages,SUM(a.counted_package_count) counted_packages FROM ll_inbound_plan_pallet_allocation a JOIN ll_inbound_plan_line l ON l.id=a.line_id AND l.customer_id=a.customer_id WHERE a.pallet_id=#{pallet} AND a.customer_id=#{customer} GROUP BY l.order_id,l.customer_id,l.destination_type,l.fba_warehouse_code")
+    List<Physical> physical(@Param("pallet") long pallet,@Param("customer") String customer);
+    @Select("SELECT a.order_id,a.customer_id,CASE WHEN i.destination_type='PRIVATE' THEN CONCAT('CUSTOMER:',a.order_id) ELSE CONCAT('FBA:',i.fba_warehouse_code) END destination_key,NULL planned_packages,SUM(a.packages) counted_packages FROM ll_dispatch_pda_pick_order a JOIN ll_dispatch_pda_pick p ON p.id=a.pick_id AND p.customer_id=a.customer_id JOIN ll_dispatch_item i ON i.id=p.dispatch_item_id AND i.customer_id=p.customer_id WHERE i.id=#{item} AND a.customer_id=#{customer} GROUP BY a.order_id,a.customer_id,i.destination_type,i.fba_warehouse_code")
+    List<Physical> pickedPhysical(@Param("item") long item,@Param("customer") String customer);
+    @Select("SELECT * FROM ll_inbound_fba_appointment WHERE id=#{id} FOR UPDATE") InboundFbaAppointment lockAppointment(long id);
+    @Select("SELECT COALESCE(SUM(b.package_count),0) FROM ll_dispatch_appointment_allocation b JOIN ll_dispatch_order d ON d.id=b.dispatch_id WHERE b.batch_key=#{batch} AND b.customer_id=#{customer} AND b.source_key=#{source} AND b.destination_key=#{destination} AND b.dispatch_id<>#{dispatch} AND d.status<>'CANCELLED'")
+    long allocated(@Param("batch") String batch,@Param("customer") String customer,@Param("source") String source,@Param("destination") String destination,@Param("dispatch") long dispatch);
+    @Delete("DELETE FROM ll_dispatch_appointment_allocation WHERE dispatch_id=#{dispatch}") int remove(long dispatch);
+    @Insert("INSERT INTO ll_dispatch_appointment_allocation(dispatch_id,dispatch_item_id,plan_pallet_id,batch_key,customer_id,source_key,destination_key,package_count) VALUES(#{dispatchId},#{itemId},#{palletId},#{batchKey},#{customerId},#{sourceKey},#{destinationKey},#{packages})")
+    int insert(Bound row);
+    @Select("SELECT COUNT(*) FROM ll_dispatch_appointment_allocation WHERE dispatch_id=#{id}") int count(long id);
+    @Delete("DELETE FROM ll_dispatch_appointment_allocation WHERE dispatch_id=#{dispatch} AND dispatch_item_id=#{item}") int removeItem(@Param("dispatch") long dispatch,@Param("item") long item);
+    @Select("SELECT DISTINCT t.trip_id FROM ll_dispatch_appointment_allocation a JOIN ll_fleet_trip_dispatch t ON t.dispatch_id=a.dispatch_id JOIN ll_dispatch_order d ON d.id=a.dispatch_id AND d.status<>'CANCELLED' WHERE a.batch_key=#{batch}") List<Long> trips(String batch);
+    @Select("SELECT b.dispatch_id,b.dispatch_item_id item_id,b.plan_pallet_id pallet_id,b.batch_key,b.customer_id,b.source_key,b.destination_key,b.package_count packages FROM ll_dispatch_appointment_allocation b JOIN ll_dispatch_order d ON d.id=b.dispatch_id WHERE d.dispatch_no=#{number}")
+    List<Bound> bindings(String number);
+    @Select("SELECT dispatch_id,dispatch_item_id item_id,plan_pallet_id pallet_id,batch_key,customer_id,source_key,destination_key,package_count packages FROM ll_dispatch_appointment_allocation WHERE dispatch_id=#{id}") List<Bound> byDispatch(long id);
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/work/AppointmentWorkPhysicalSources.java b/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/work/AppointmentWorkPhysicalSources.java
new file mode 100644
index 000000000..7050a31cc
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/work/AppointmentWorkPhysicalSources.java
@@ -0,0 +1,24 @@
+package com.baiyue.lastleg.inboundplan.work;
+
+import com.baiyue.lastleg.appointmentplanning.*;
+import java.util.*;
+import static com.baiyue.lastleg.appointmentwork.AppointmentWorkPolicy.*;
+
+final class AppointmentWorkPhysicalSources {
+    private AppointmentWorkPhysicalSources() { }
+    static Map<AppointmentExternalSourceGateway.OrderRef,AppointmentCoverageService.SourceRef> canonical(List<AppointmentWorkDispatchMapper.Physical> rows,AppointmentSourceService sources) {
+        var identities=rows.stream().map(p->new AppointmentExternalSourceGateway.OrderRef(p.customerId(),p.orderId())).distinct().toList();
+        if(identities.isEmpty()) return Map.of();
+        var refs=sources.canonicalOrders(identities);
+        if(refs.size()!=identities.size()) throw unavailable("逐票来源规范化响应不完整");
+        var result=new LinkedHashMap<AppointmentExternalSourceGateway.OrderRef,AppointmentCoverageService.SourceRef>();
+        for(int i=0;i<identities.size();i++) {
+            if(!identities.get(i).customerId().equals(refs.get(i).customerId())) throw unavailable("逐票来源客户归属不一致");
+            result.put(identities.get(i),refs.get(i));
+        }
+        return result;
+    }
+    static AppointmentCoverageService.SourceRef ref(Map<AppointmentExternalSourceGateway.OrderRef,AppointmentCoverageService.SourceRef> refs,AppointmentWorkDispatchMapper.Physical row) {
+        return refs.get(new AppointmentExternalSourceGateway.OrderRef(row.customerId(),row.orderId()));
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/work/AppointmentWorkReceivingGuard.java b/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/work/AppointmentWorkReceivingGuard.java
new file mode 100644
index 000000000..42582a945
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/work/AppointmentWorkReceivingGuard.java
@@ -0,0 +1,24 @@
+package com.baiyue.lastleg.inboundplan.work;
+
+import com.baiyue.lastleg.appointmentwork.AppointmentWorkFirstlegClient;
+import com.baiyue.lastleg.appointmentwork.AppointmentWorkModels.Flow;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.stereotype.Component;
+import static com.baiyue.lastleg.appointmentwork.AppointmentWorkPolicy.*;
+
+@Component
+public class AppointmentWorkReceivingGuard {
+    private final AppointmentWorkFirstlegClient firstleg;
+    private final String token;
+    private final com.baiyue.lastleg.appointmentwork.AppointmentWorkRouteService routes;
+    public AppointmentWorkReceivingGuard(AppointmentWorkFirstlegClient firstleg,com.baiyue.lastleg.appointmentwork.AppointmentWorkRouteService routes,@Value("${baiyue.security.internal-service-token:}") String token) { this.firstleg=firstleg; this.routes=routes; this.token=token; }
+    public void requireWarehouseFlow(String container) {
+        if(routes.route(container).flow()==Flow.DIRECT) throw conflict("该柜已确认直送路线，不能进入海外仓收货");
+        if(token==null || token.isBlank()) throw unavailable("内部服务身份未配置，无法核对收货路线");
+        final com.baiyue.common.core.api.ApiResponse<com.baiyue.lastleg.appointmentwork.AppointmentWorkFactGateway.ContainerSource> response;
+        try { response=firstleg.container(token,container); }
+        catch(RuntimeException error) { throw unavailable("无法核对柜次原业务路线",error); }
+        if(response==null || !response.successful() || response.data()==null || !container.equals(response.data().containerBookingId())) throw unavailable("柜次原业务路线缺失");
+        if(response.data().establishedFlow()==Flow.DIRECT) throw conflict("该柜已有直送卸货事实，不能进入海外仓收货");
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/work/AppointmentWorkReceivingMapper.java b/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/work/AppointmentWorkReceivingMapper.java
new file mode 100644
index 000000000..c3cf9a918
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/work/AppointmentWorkReceivingMapper.java
@@ -0,0 +1,38 @@
+package com.baiyue.lastleg.inboundplan.work;
+
+import com.baiyue.lastleg.inboundplan.entity.InboundPlan;
+import com.baiyue.lastleg.inboundplan.pda.entity.ReceivingContainerSession;
+import org.apache.ibatis.annotations.*;
+import java.util.List;
+
+@Mapper
+public interface AppointmentWorkReceivingMapper {
+    class ContainerPlan extends InboundPlan {
+        private String sourceContainerBookingId;
+        public String getSourceContainerBookingId() { return sourceContainerBookingId; }
+        public void setSourceContainerBookingId(String value) { sourceContainerBookingId=value; }
+    }
+    @Select("""
+        <script>
+        SELECT ranked.* FROM (
+          SELECT source.*,ROW_NUMBER() OVER(PARTITION BY source_container_booking_id ORDER BY id) work_row FROM (
+            SELECT DISTINCT p.*,o.source_container_booking_id FROM ll_inbound_plan p
+            JOIN ll_inbound_plan_line l ON l.plan_id=p.id JOIN ll_order o ON o.id=l.order_id AND o.customer_id=l.customer_id
+            WHERE o.source_container_booking_id IN
+            <foreach collection='containers' item='container' open='(' separator=',' close=')'>#{container}</foreach>
+          ) source
+        ) ranked WHERE work_row &lt;= 1001 ORDER BY source_container_booking_id,id
+        </script>
+        """)
+    List<ContainerPlan> plans(@Param("containers") List<String> containers);
+    @Select("""
+        <script>
+        SELECT ranked.* FROM (
+          SELECT s.*,ROW_NUMBER() OVER(PARTITION BY source_container_booking_id ORDER BY created_at DESC,id DESC) work_row
+          FROM ll_receiving_container_session s WHERE source_container_booking_id IN
+          <foreach collection='containers' item='container' open='(' separator=',' close=')'>#{container}</foreach>
+        ) ranked WHERE work_row=1
+        </script>
+        """)
+    List<ReceivingContainerSession> sessions(@Param("containers") List<String> containers);
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/work/AppointmentWorkReceivingProvider.java b/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/work/AppointmentWorkReceivingProvider.java
new file mode 100644
index 000000000..f88b37f01
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/work/AppointmentWorkReceivingProvider.java
@@ -0,0 +1,45 @@
+package com.baiyue.lastleg.inboundplan.work;
+
+import com.baiyue.lastleg.appointmentwork.AppointmentWorkFactGateway;
+import com.baiyue.lastleg.security.OverseasPermissions;
+import org.springframework.stereotype.Component;
+import java.util.*;
+import java.util.stream.Collectors;
+import static com.baiyue.lastleg.appointmentwork.AppointmentWorkFactGateway.*;
+import static com.baiyue.lastleg.appointmentwork.AppointmentWorkModels.*;
+import static com.baiyue.lastleg.appointmentwork.AppointmentWorkPolicy.*;
+
+@Component
+public class AppointmentWorkReceivingProvider implements AppointmentWorkFactGateway.BusinessProvider {
+    private final AppointmentWorkReceivingMapper mapper;
+    public AppointmentWorkReceivingProvider(AppointmentWorkReceivingMapper mapper) { this.mapper=mapper; }
+    public boolean supports(Type type,Flow flow) { return type==Type.WAREHOUSE_RECEIPT && flow==Flow.TRANSFER; }
+    public List<Fact> read(List<FactRequest> requests) {
+        if(requests.isEmpty()) return List.of();
+        var ids=requests.stream().map(FactRequest::containerBookingId).distinct().toList();
+        var plans=mapper.plans(ids).stream().collect(Collectors.groupingBy(AppointmentWorkReceivingMapper.ContainerPlan::getSourceContainerBookingId));
+        var sessions=mapper.sessions(ids).stream().collect(Collectors.toMap(s->s.getSourceContainerBookingId(),s->s));
+        return requests.stream().map(r->read(r,plans.getOrDefault(r.containerBookingId(),List.of()),sessions.get(r.containerBookingId()))).toList();
+    }
+    private Fact read(FactRequest request,List<AppointmentWorkReceivingMapper.ContainerPlan> plans,com.baiyue.lastleg.inboundplan.pda.entity.ReceivingContainerSession session) {
+        if(plans.size()>1000) throw unavailable("柜次接仓计划超过完整读取上限");
+        var dates=plans.stream().map(p->p.getPlannedArrivalDate()).filter(Objects::nonNull).distinct().sorted().toList();
+        var target=dates.isEmpty()?null:new Slot(dates.get(0),null,null,null,null);
+        boolean complete=session!=null && session.getCompletedAt()!=null && Set.of("COMPLETED","COMPLETED_WITH_DIFFERENCE").contains(session.getStatus());
+        var local=complete?session.getCompletedAt():null;
+        var actual=local==null?null:new Actual(null,local,null);
+        var execution=complete?ExecutionStatus.COMPLETED:session!=null && session.getReceivingAt()!=null?ExecutionStatus.IN_PROGRESS:ExecutionStatus.PENDING;
+        var blocks=new ArrayList<String>();
+        if(dates.size()>1) blocks.add("同柜入仓计划日期不一致，请在原入仓计划核对");
+        var refs=plans.stream().map(p->new BusinessReference("INBOUND_PLAN",p.getId().toString(),p.getPlanNo(),"入仓计划")).toList();
+        var permission=plans.isEmpty()?OverseasPermissions.INBOUND_ORDER_CREATE:OverseasPermissions.INBOUND_ORDER_EDIT;
+        var single=plans.size()==1?plans.get(0):null;
+        var action=complete?null:new Action(ActionCode.SAVE_PLAN,plans.isEmpty()?"建立接仓计划":"查看并维护接仓计划",request.workItemKey(),new ReceiptTarget(single==null?null:single.getId().toString(),single==null?null:single.getPlanNo(),single==null?null:single.getCustomerId(),request.containerBookingId()));
+        String fingerprint=digest(plans.stream().map(p->p.getId()+":"+p.getVersion()+":"+p.getStatus()).toList()+":"+(session==null?"":session.getId()+":"+session.getVersion()));
+        // Arrival-date mutations are authoritative planned changes; first date is baselined by the work observer.
+        String impact=digest(dates.toString());
+        return new Fact(request.workItemKey(),fingerprint,impact,!plans.isEmpty(),target==null?PlanStatus.UNPLANNED:PlanStatus.TARGET_SET,
+            execution,target,null,actual,null,plans.size()==1?plans.get(0).getPlanNo():null,null,List.of(OverseasPermissions.INBOUND_ORDER_LIST),
+            action==null?List.of():List.of(permission),action,List.copyOf(blocks),target!=null || actual!=null?List.of("SOURCE_TIMEZONE"):List.of(),refs,null,null);
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/work/AppointmentWorkRequirementProvider.java b/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/work/AppointmentWorkRequirementProvider.java
new file mode 100644
index 000000000..1bae1c9f4
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/work/AppointmentWorkRequirementProvider.java
@@ -0,0 +1,136 @@
+package com.baiyue.lastleg.inboundplan.work;
+
+import com.baiyue.lastleg.appointmentplanning.*;
+import com.baiyue.lastleg.appointmentwork.AppointmentWorkFactGateway;
+import com.baiyue.lastleg.inboundplan.dto.FbaAppointmentResponse;
+import com.baiyue.lastleg.inboundplan.service.InboundFbaAppointmentService;
+import org.springframework.stereotype.Component;
+import java.util.*;
+import static com.baiyue.lastleg.appointmentwork.AppointmentWorkFactGateway.*;
+import static com.baiyue.lastleg.appointmentwork.AppointmentWorkModels.*;
+import static com.baiyue.lastleg.appointmentwork.AppointmentWorkPolicy.*;
+
+/** Full manifest from source quantities and original appointment allocations; owns no quantity ledger. */
+@Component
+public class AppointmentWorkRequirementProvider implements AppointmentWorkFactGateway.RequirementProvider {
+    private final AppointmentSourceService sources;
+    private final AppointmentCargoVerificationService cargo;
+    private final InboundFbaAppointmentService appointments;
+    private final AppointmentWorkSourceMapper sourceMapping;
+    public AppointmentWorkRequirementProvider(AppointmentSourceService sources,AppointmentCargoVerificationService cargo,InboundFbaAppointmentService appointments,AppointmentWorkSourceMapper sourceMapping) {
+        this.sources=sources; this.cargo=cargo; this.appointments=appointments; this.sourceMapping=sourceMapping;
+    }
+    /** 按当前实物分配生成客户需求，保留已撤销批次身份以退役旧事项。 */
+    public List<Requirement> requirements(ContainerSource container,Flow effectiveFlow) {
+        var original=container.requirements().stream().map(r->"PRIVATE".equals(r.destinationKind())?new Requirement(r.requirementKey(),r.batchKey(),r.batchNo(),"CUSTOMER",r.originName(),r.destinationName(),r.timezone(),r.references(),r.replacesRequirementKeys(),r.sources()):r).toList();
+        if(effectiveFlow==Flow.DIRECT) return original;
+        if(effectiveFlow!=Flow.TRANSFER) throw conflict("需求清单必须明确有效作业路线");
+        var mapped=sourceMapping.containerSources(container.containerBookingId());
+        if(mapped.size()>1000) throw unavailable("柜次尾程来源超过完整读取上限");
+        var result=new LinkedHashMap<String,Requirement>();
+        var privateDispatches=original.stream().anyMatch(r->"CUSTOMER".equals(r.destinationKind()))?sourceMapping.privateDispatches(container.containerBookingId()):List.<AppointmentWorkSourceMapper.DispatchSource>of();
+        if(privateDispatches.size()>1000) throw unavailable("客户仓排车来源超过完整读取上限");
+        for(var requirement:original) {
+            var inbound=requirement.requirementKey().startsWith("INBOUND:")?requirement.requirementKey().substring(8):null;
+            var sourceOrders=mapped.stream().filter(s->Objects.equals(s.sourceInboundId(),inbound)).toList();
+            if(sourceOrders.isEmpty()) { result.put(requirement.requirementKey(),requirement); continue; }
+            if("CUSTOMER".equals(requirement.destinationKind())) { customer(requirement,sourceOrders,privateDispatches,result);continue; }
+            if(!"FBA".equals(requirement.destinationKind())) { result.put(requirement.requirementKey(),requirement); continue; }
+            var refs=canonical(sourceOrders.stream().map(s->new SourceReference(s.customerId(),"ORDER:"+s.id(),null)).toList());
+            List<AppointmentSourceService.Source> resolved;
+            try { resolved=sources.resolveBatch(refs); }
+            catch(org.springframework.web.server.ResponseStatusException error) {
+                if(!AppointmentWorkSourceAvailability.unresolved(error)) throw error;
+                // Keep the complete physical obligation and its canonical source identities. The fact
+                // provider reports the original prerequisite and exposes no booking action.
+                result.put(requirement.requirementKey(),new Requirement(requirement.requirementKey(),null,null,
+                    requirement.destinationKind(),requirement.originName(),requirement.destinationName(),requirement.timezone(),
+                    requirement.references(),List.of(),refs.stream().map(r->new SourceReference(r.customerId(),r.sourceKey(),r.destinationKey())).toList()));
+                continue;
+            }
+            var complete=resolved.stream().map(s->new AppointmentCoverageService.SourceRef(s.customerId(),s.sourceKey(),s.destinationKey())).toList();
+            var history=appointments.relatedBatchSnapshots(complete);
+            var active=history.stream().filter(AppointmentWorkRequirementProvider::active).toList();
+            // Unknown remaining quantity is still work, never a zero or an absent requirement.
+            boolean remainder=resolved.stream().map(cargo::inspect).anyMatch(c->c.availablePackages()==null || c.availablePackages()>0);
+            var replaced=history.stream().filter(a->!active(a)).map(FbaAppointmentResponse::batchKey).toList();
+            if(remainder) {
+                var restored=new LinkedHashSet<>(replaced);
+                // 回到未分配需求时，同时承接原批次运输事项和按客户拆分的送仓事项。
+                complete.forEach(ref->replaced.forEach(key->restored.add(customerRequirement(key,ref.customerId()))));
+                result.put(requirement.requirementKey(),new Requirement(requirement.requirementKey(),null,null,requirement.destinationKind(),
+                    requirement.originName(),requirement.destinationName(),requirement.timezone(),requirement.references(),List.copyOf(restored),
+                    complete.stream().map(r->new SourceReference(r.customerId(),r.sourceKey(),r.destinationKey())).toList()));
+            }
+            for(var batch:active) {
+                var replacementKeys=new LinkedHashSet<>(replaced); replacementKeys.add(requirement.requirementKey());
+                history.stream().filter(a->a.replacementBatchKeys()!=null && a.replacementBatchKeys().contains(batch.batchKey())).map(FbaAppointmentResponse::batchKey).forEach(replacementKeys::add);
+                var previous=result.get(batch.batchKey());
+                if(previous!=null) replacementKeys.addAll(previous.replacesRequirementKeys());
+                var references=new ArrayList<>(requirement.references());
+                if(previous!=null) references.addAll(previous.references());
+                references.add(new BusinessReference("FBA_APPOINTMENT",batch.batchKey(),batch.appointmentNo(),"送仓预约"));
+                var batchSources=batch.items().stream().map(i->new SourceReference(i.customerId(),i.sourceKey(),i.destinationKey())).distinct().toList();
+                result.put(batch.batchKey(),new Requirement(batch.batchKey(),batch.batchKey(),batch.appointmentNo(),"FBA",requirement.originName(),
+                    batch.fbaWarehouseCode(),batch.timezone(),references.stream().distinct().toList(),List.copyOf(replacementKeys),batchSources));
+            }
+        }
+        var scoped=new ArrayList<Requirement>();
+        for(var requirement:result.values()) {
+            if(requirement.batchKey()==null || !requirement.batchKey().startsWith("FBA_APPOINTMENT:")) { scoped.add(requirement);continue; }
+            var customers=new TreeMap<String,List<SourceReference>>();
+            requirement.sources().forEach(s->customers.computeIfAbsent(s.customerId(),ignored->new ArrayList<>()).add(s));
+            if(customers.isEmpty()) throw unavailable("实物批次缺少客户来源，不能生成送仓事项");
+            customers.forEach((customer,refs)->{
+                var replacements=new LinkedHashSet<>(requirement.replacesRequirementKeys());
+                requirement.replacesRequirementKeys().stream().filter(k->k.startsWith("FBA_APPOINTMENT:")).map(k->customerRequirement(k,customer)).forEach(replacements::add);
+                // 客户事项承接同一实物批次的整体需求；批次身份未变化也须有明确拆分去向。
+                replacements.add(requirement.batchKey());
+                scoped.add(new Requirement(customerRequirement(requirement.batchKey(),customer),requirement.batchKey(),requirement.batchNo(),requirement.destinationKind(),
+                    requirement.originName(),requirement.destinationName(),requirement.timezone(),requirement.references(),List.copyOf(replacements),List.copyOf(refs)));
+            });
+        }
+        return List.copyOf(scoped);
+    }
+    private void customer(Requirement requirement,List<AppointmentWorkSourceMapper.Source> orders,List<AppointmentWorkSourceMapper.DispatchSource> dispatches,Map<String,Requirement> result) {
+        if(orders.stream().anyMatch(s->!"PRIVATE".equals(s.destinationType()))) throw conflict("客户仓需求与原订单目的地不一致");
+        var related=dispatches.stream().filter(d->orders.stream().anyMatch(o->o.id()==d.orderId() && o.customerId().equals(d.customerId()))).toList();
+        var active=related.stream().filter(d->!"CANCELLED".equals(d.status())).toList();
+        var cancelled=related.stream().filter(d->"CANCELLED".equals(d.status())).map(d->"DISPATCH:"+d.dispatchId()).distinct().toList();
+        boolean remaining=false;
+        for(var order:orders) {
+            long allocated=active.stream().filter(d->d.orderId()==order.id() && d.customerId().equals(order.customerId())).mapToLong(AppointmentWorkSourceMapper.DispatchSource::packages).sum();
+            if(order.packageCount()!=null && allocated>order.packageCount()) throw conflict("客户仓排车逐票分配超过原货物数量");
+            if(order.packageCount()==null || allocated<order.packageCount()) remaining=true;
+        }
+        if(remaining) result.put(requirement.requirementKey(),new Requirement(requirement.requirementKey(),null,null,"CUSTOMER",requirement.originName(),requirement.destinationName(),requirement.timezone(),requirement.references(),cancelled,orders.stream().map(o->new SourceReference(o.customerId(),"ORDER:"+o.id(),"CUSTOMER:"+o.id())).toList()));
+        for(var batch:active.stream().map(d->"DISPATCH:"+d.dispatchId()).distinct().toList()) {
+            var all=sourceMapping.privateBatch(batch);
+            if(all.isEmpty() || all.size()>1000 || all.stream().anyMatch(d->"CANCELLED".equals(d.status()))) throw unavailable("客户仓排车批次来源不完整");
+            var previous=result.get(batch); var replacements=new LinkedHashSet<>(cancelled);replacements.add(requirement.requirementKey());
+            var refs=new ArrayList<>(requirement.references());
+            if(previous!=null) { replacements.addAll(previous.replacesRequirementKeys());refs.addAll(previous.references()); }
+            refs.add(new BusinessReference("DISPATCH",batch,all.get(0).dispatchNo(),"客户仓排车"));
+            result.put(batch,new Requirement(batch,batch,all.get(0).dispatchNo(),"CUSTOMER",requirement.originName(),requirement.destinationName(),requirement.timezone(),refs.stream().distinct().toList(),List.copyOf(replacements),all.stream().map(d->new SourceReference(d.customerId(),d.sourceKey(),d.destinationKey())).distinct().toList()));
+        }
+    }
+    private List<AppointmentCoverageService.SourceRef> canonical(List<SourceReference> input) {
+        if(input==null || input.isEmpty() || input.size()>100) throw unavailable("Firstleg需求缺少完整客户货源关系");
+        var orders=input.stream().filter(s->s.sourceKey()!=null && s.sourceKey().startsWith("ORDER:")).map(s->{
+            try { return new AppointmentExternalSourceGateway.OrderRef(s.customerId(),Long.parseLong(s.sourceKey().substring(6))); }
+            catch(RuntimeException error) { throw unavailable("Firstleg原订单关联无效",error); }
+        }).toList();
+        var result=new ArrayList<AppointmentCoverageService.SourceRef>();
+        if(!orders.isEmpty()) result.addAll(sources.canonicalOrders(orders));
+        input.stream().filter(s->s.sourceKey()!=null && s.sourceKey().startsWith("BOOKING:")).map(s->new AppointmentCoverageService.SourceRef(s.customerId(),s.sourceKey(),s.destinationKey())).forEach(result::add);
+        if(result.size()!=input.size()) throw unavailable("来源键必须明确为ORDER或BOOKING");
+        return result.stream().distinct().toList();
+    }
+    /** 已取消且没有当前实物分配的记录只属历史；取消但仍有货物的批次继续产生需求。 */
+    private static boolean active(FbaAppointmentResponse batch) {
+        if(batch.replacementBatchKeys()!=null && !batch.replacementBatchKeys().isEmpty()) return false;
+        // 客户来源取当前活动分配；空取消记录不能制造无货送仓事项，也不能阻断整份清单。
+        // 剩余货量仍由 cargo.inspect 核算，有货的 CANCELLED/FAILED 批次不因预约状态退役。
+        return !("CANCELLED".equals(batch.appointmentStatus()) && batch.items().isEmpty());
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/work/AppointmentWorkSourceAvailability.java b/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/work/AppointmentWorkSourceAvailability.java
new file mode 100644
index 000000000..b6f21c826
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/work/AppointmentWorkSourceAvailability.java
@@ -0,0 +1,15 @@
+package com.baiyue.lastleg.inboundplan.work;
+
+import java.util.Set;
+import org.springframework.web.server.ResponseStatusException;
+
+/** An unbookable physical source remains visible work; transport and integrity errors still fail the scan. */
+final class AppointmentWorkSourceAvailability {
+    private AppointmentWorkSourceAvailability() { }
+    private static final Set<String> PREREQUISITES=Set.of(
+        "当前货源类型不支持FBA预约", "货物尚无已开船或后续实际船节点", "当前货源不是FBA送仓货物",
+        "接仓点不在启用的美国仓目录中", "目的仓不在启用的美国FBA目录中", "目的地已变化，请返回原业务重新核对");
+    static boolean unresolved(ResponseStatusException error) {
+        return error.getStatusCode().value()==400 && error.getReason()!=null && PREREQUISITES.contains(error.getReason());
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/work/AppointmentWorkSourceMapper.java b/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/work/AppointmentWorkSourceMapper.java
new file mode 100644
index 000000000..9a3c03a5f
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/work/AppointmentWorkSourceMapper.java
@@ -0,0 +1,30 @@
+package com.baiyue.lastleg.inboundplan.work;
+
+import org.apache.ibatis.annotations.*;
+import java.util.List;
+
+@Mapper
+public interface AppointmentWorkSourceMapper {
+    record Source(Long id,String customerId,String sourceOrderId,String sourceInboundId,String destinationType,String fbaWarehouseCode,Integer packageCount) { }
+    @Select("SELECT id,customer_id,source_order_id,source_inbound_id,destination_type,fba_warehouse_code,package_count FROM ll_order WHERE source_container_booking_id=#{container} ORDER BY id LIMIT 1001")
+    List<Source> containerSources(String container);
+    record ContainerSource(String containerBookingId,Long id,String customerId,String sourceOrderId,String sourceInboundId,String destinationType,String fbaWarehouseCode,Integer packageCount) {
+        public Source source() { return new Source(id,customerId,sourceOrderId,sourceInboundId,destinationType,fbaWarehouseCode,packageCount); }
+    }
+    @Select("""
+        <script>
+        SELECT container_booking_id,id,customer_id,source_order_id,source_inbound_id,destination_type,fba_warehouse_code,package_count FROM (
+          SELECT source_container_booking_id container_booking_id,id,customer_id,source_order_id,source_inbound_id,destination_type,fba_warehouse_code,package_count,
+            ROW_NUMBER() OVER(PARTITION BY source_container_booking_id ORDER BY id) work_row
+          FROM ll_order WHERE source_container_booking_id IN
+          <foreach collection='containers' item='container' open='(' separator=',' close=')'>#{container}</foreach>
+        ) ranked WHERE work_row &lt;= 1001 ORDER BY container_booking_id,id
+        </script>
+        """)
+    List<ContainerSource> containerSourcesBatch(@Param("containers") List<String> containers);
+    record DispatchSource(long dispatchId,String dispatchNo,String status,long orderId,String customerId,String sourceKey,String destinationKey,long packages) { }
+    @Select("SELECT b.dispatch_id,d.dispatch_no,d.status,o.id order_id,b.customer_id,b.source_key,b.destination_key,SUM(b.package_count) packages FROM ll_dispatch_appointment_allocation b JOIN ll_dispatch_order d ON d.id=b.dispatch_id JOIN ll_order o ON b.destination_key=CONCAT('CUSTOMER:',o.id) AND b.customer_id=o.customer_id WHERE b.batch_key=CONCAT('DISPATCH:',d.id) AND o.source_container_booking_id=#{container} GROUP BY b.dispatch_id,d.dispatch_no,d.status,o.id,b.customer_id,b.source_key,b.destination_key ORDER BY b.dispatch_id,o.id LIMIT 1001")
+    List<DispatchSource> privateDispatches(String container);
+    @Select("SELECT b.dispatch_id,d.dispatch_no,d.status,o.id order_id,b.customer_id,b.source_key,b.destination_key,SUM(b.package_count) packages FROM ll_dispatch_appointment_allocation b JOIN ll_dispatch_order d ON d.id=b.dispatch_id JOIN ll_order o ON b.destination_key=CONCAT('CUSTOMER:',o.id) AND b.customer_id=o.customer_id WHERE b.batch_key=#{batch} AND b.batch_key=CONCAT('DISPATCH:',d.id) GROUP BY b.dispatch_id,d.dispatch_no,d.status,o.id,b.customer_id,b.source_key,b.destination_key ORDER BY o.id LIMIT 1001")
+    List<DispatchSource> privateBatch(String batch);
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/work/FbaAppointmentExecutionAdapter.java b/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/work/FbaAppointmentExecutionAdapter.java
new file mode 100644
index 000000000..2eb4d45f6
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/work/FbaAppointmentExecutionAdapter.java
@@ -0,0 +1,116 @@
+package com.baiyue.lastleg.inboundplan.work;
+
+import com.baiyue.lastleg.fleet.trip.*;
+import com.baiyue.lastleg.inboundplan.receiving.FbaAppointmentExecutionPort;
+import org.springframework.stereotype.Component;
+import org.springframework.transaction.annotation.*;
+import org.springframework.web.server.ResponseStatusException;
+import java.time.Instant;
+import java.util.*;
+import java.util.stream.Collectors;
+import static com.baiyue.lastleg.appointmentwork.AppointmentWorkPolicy.*;
+
+/** Original allocations and signed/returned delivery evidence; never reads work projections. */
+@Component
+public class FbaAppointmentExecutionAdapter implements FbaAppointmentExecutionPort {
+    private final AppointmentWorkDispatchMapper allocations;
+    private final FleetTripMapper trips;
+    private final FleetDispatchGateway dispatches;
+    private record Facts(List<String> batches,List<AppointmentWorkDispatchMapper.ReceivingSource> sources,
+                         List<AppointmentWorkDispatchMapper.TransportRow> rows,
+                         Map<String,FleetCompletionModels.DispatchCompletion> outcomes,
+                         Map<String,FleetDispatchGateway.TerminalEvidence> evidence,Map<String,String> invalid) { }
+    public FbaAppointmentExecutionAdapter(AppointmentWorkDispatchMapper allocations,FleetTripMapper trips,FleetDispatchGateway dispatches) {
+        this.allocations=allocations;this.trips=trips;this.dispatches=dispatches;
+    }
+    @Transactional(readOnly=true)
+    public Scope inspect(List<Member> input) {
+        var members=members(input);return scope(members,read(batches(members)));
+    }
+    @Transactional(propagation=Propagation.MANDATORY)
+    public Scope lockAndInspect(List<Member> input,String expectedVersion) {
+        var members=members(input);if(members.isEmpty()) throw bad("请选择需要重新预约的客户");
+        var before=read(batches(members));var selected=selected(before,members);
+        var tripNos=tripNos(selected);var numbers=dispatchNos(selected);
+        for(var trip:tripNos) if(trips.lockByNo(trip)==null) throw conflict("原车次关系已变化，请重新核对");
+        for(var number:numbers) {
+            dispatches.completion(number,true);
+            dispatches.lockForPlanning(number);
+        }
+        var current=read(before.batches());var scope=scope(members,current);
+        if(!numbers.equals(dispatchNos(selected(current,members))) || !tripNos.equals(tripNos(selected(current,members)))
+            || expectedVersion==null || !expectedVersion.equals(scope.version())) throw conflict("客户执行范围已变化，请重新读取预约候选");
+        for(var member:scope.members()) if(!member.canRebook()) throw conflict(member.reason());
+        return scope;
+    }
+    private Facts read(List<String> batches) {
+        if(batches.isEmpty()) return new Facts(batches,List.of(),List.of(),Map.of(),Map.of(),Map.of());
+        var sources=allocations.receivingSources(batches);var rows=allocations.transportRows(batches,List.of());
+        if(sources.size()>20000 || rows.size()>1000) throw unavailable("客户执行事实超过完整读取上限");
+        var outcomes=new TreeMap<String,FleetCompletionModels.DispatchCompletion>();var evidence=new TreeMap<String,FleetDispatchGateway.TerminalEvidence>();var invalid=new TreeMap<String,String>();
+        for(var number:dispatchNos(rows)) {
+            var completion=dispatches.completion(number,false);
+            if(completion==null || !number.equals(completion.dispatchNo()) || completion.outcomes()==null) throw unavailable("原派送执行事实读取不完整");
+            outcomes.put(number,completion);
+            if(rows.stream().anyMatch(r->number.equals(r.dispatchNo()) && "DEPARTED".equals(r.dispatchStatus()))) {
+                try {
+                    var fact=dispatches.terminalEvidence(number,false);
+                    if(fact==null || !number.equals(fact.dispatchNo()) || fact.deliveries()==null) throw unavailable("原发运签收退回事实缺失");
+                    evidence.put(number,fact);
+                } catch(ResponseStatusException error) {
+                    if(error.getStatusCode().value()!=409) throw error;
+                    invalid.put(number,Objects.toString(error.getReason(),"原发运证据不完整"));
+                }
+            }
+        }
+        return new Facts(batches,List.copyOf(sources),List.copyOf(rows),outcomes,evidence,invalid);
+    }
+    private Scope scope(List<Member> members,Facts facts) {
+        // The selected customer subset is deliberately absent from the version. All facts for the
+        // same batch set participate, including siblings omitted from the candidate selection.
+        return new Scope(digest(facts.toString()),members.stream().map(m->eligibility(m,facts)).toList());
+    }
+    private Eligibility eligibility(Member member,Facts facts) {
+        var expected=facts.sources().stream().filter(s->member.batchKey().equals(s.batchKey()) && member.customerId().equals(s.customerId())).toList();
+        if(expected.isEmpty() || expected.stream().anyMatch(s->s.packages()==null || s.packages()<=0)) return denied(member,false,"客户已移出本批或来源箱数尚未核实");
+        var rows=selected(facts,List.of(member));
+        boolean complete=!rows.isEmpty();
+        var expectedAmounts=new HashMap<List<String>,Long>();
+        for(var source:expected) if(source.sourceKey()==null || source.destinationKey()==null || expectedAmounts.put(List.of(source.sourceKey(),source.destinationKey()),source.packages().longValue())!=null)
+            return denied(member,false,"原客户逐票分配存在重复或缺失");
+        var allocated=rows.stream().collect(Collectors.groupingBy(r->List.of(r.sourceKey(),r.destinationKey()),Collectors.summingLong(AppointmentWorkDispatchMapper.TransportRow::packages)));
+        if(rows.stream().anyMatch(r->r.packages()<=0) || allocated.entrySet().stream().anyMatch(e->!expectedAmounts.containsKey(e.getKey()) || e.getValue()>expectedAmounts.get(e.getKey())))
+            return denied(member,false,"排车逐票数量或来源不属于当前客户批次，请先核对原实物关联");
+        if(!expectedAmounts.equals(allocated)) complete=false;
+        for(var row:rows) {
+            var proof=facts.evidence().get(row.dispatchNo());
+            if(proof==null || !member.customerId().equals(proof.customerId())) { complete=false;continue; }
+            var delivery=proof.deliveries().stream().filter(d->member.customerId().equals(d.customerId()) && row.destinationKey().equals(d.destinationKey())).toList();
+            long dispatched=facts.rows().stream().filter(r->row.dispatchNo().equals(r.dispatchNo()) && row.customerId().equals(r.customerId()) && row.destinationKey().equals(r.destinationKey())).mapToLong(AppointmentWorkDispatchMapper.TransportRow::packages).sum();
+            if(delivery.size()!=1 || delivery.get(0).packages()!=dispatched || delivery.get(0).terminalAt()==null || delivery.get(0).terminalAt().isAfter(Instant.now())) complete=false;
+        }
+        if(complete) return denied(member,true,"本客户货物已实际签收或完成退回入仓，不再重新预约");
+        for(var row:rows) {
+            if(facts.invalid().containsKey(row.dispatchNo())) return denied(member,false,facts.invalid().get(row.dispatchNo()));
+            var outcomes=facts.outcomes().get(row.dispatchNo()).outcomes();
+            if(outcomes.stream().anyMatch(o->o.terminalAt()!=null || o.signedPackages()>0 || o.returnedPackages()>0 || Set.of("DELIVERING","DELIVERED","REJECTED","RETURN_PENDING","RETURNED").contains(Objects.toString(o.status(),""))))
+                return denied(member,false,"本客户已有实际派送执行，请从原运输异常处理");
+            if(!"PENDING_DEPARTURE".equals(row.dispatchStatus()) || positive(row.pickedPackages()) || positive(row.shippedPackages())
+                || row.taskStatus()!=null && !"PDA_PENDING".equals(row.taskStatus()) || row.outboundStatus()!=null && !"WAIT_OUTBOUND".equals(row.outboundStatus())
+                || row.tripNo()!=null && !"PLANNED".equals(row.tripStatus())) return denied(member,false,"本客户运输已开始执行，不能普通重新预约");
+        }
+        return new Eligibility(member,false,true,null);
+    }
+    private static Eligibility denied(Member member,boolean completed,String reason) { return new Eligibility(member,completed,false,reason); }
+    private static boolean positive(Integer value) { return value!=null && value>0; }
+    private static List<AppointmentWorkDispatchMapper.TransportRow> selected(Facts facts,List<Member> members) {
+        var scopes=new HashSet<>(members);return facts.rows().stream().filter(r->scopes.contains(new Member(r.batchKey(),r.customerId()))).toList();
+    }
+    private static List<String> dispatchNos(List<AppointmentWorkDispatchMapper.TransportRow> rows) { return rows.stream().map(AppointmentWorkDispatchMapper.TransportRow::dispatchNo).distinct().sorted().toList(); }
+    private static List<String> tripNos(List<AppointmentWorkDispatchMapper.TransportRow> rows) { return rows.stream().map(AppointmentWorkDispatchMapper.TransportRow::tripNo).filter(Objects::nonNull).distinct().sorted().toList(); }
+    private static List<String> batches(List<Member> members) { return members.stream().map(Member::batchKey).distinct().sorted().toList(); }
+    private static List<Member> members(List<Member> members) {
+        if(members==null || members.size()>200 || new HashSet<>(members).size()!=members.size() || members.stream().anyMatch(m->m==null || m.batchKey()==null || !m.batchKey().matches("FBA_APPOINTMENT:[1-9][0-9]*") || m.customerId()==null || m.customerId().isBlank())) throw bad("客户执行范围须为最多200个不重复真实客户批次");
+        return members.stream().sorted(Comparator.comparing(Member::batchKey).thenComparing(Member::customerId)).toList();
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/work/FbaAppointmentTransportAdapter.java b/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/work/FbaAppointmentTransportAdapter.java
new file mode 100644
index 000000000..10530665b
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/work/FbaAppointmentTransportAdapter.java
@@ -0,0 +1,159 @@
+package com.baiyue.lastleg.inboundplan.work;
+
+import com.baiyue.lastleg.fleet.trip.*;
+import com.baiyue.lastleg.inboundplan.receiving.FbaAppointmentTransportPort;
+import org.springframework.context.annotation.Lazy;
+import org.springframework.stereotype.Component;
+import org.springframework.transaction.annotation.*;
+import org.springframework.transaction.support.*;
+import java.util.*;
+import java.util.stream.Collectors;
+import static com.baiyue.lastleg.appointmentwork.AppointmentWorkPolicy.*;
+
+/** Mutates original dispatch rows and fleet bindings only; owns no cargo quantity ledger. */
+@Component
+public class FbaAppointmentTransportAdapter implements FbaAppointmentTransportPort {
+    private final AppointmentWorkDispatchMapper allocations;
+    private final FleetTripMapper trips;
+    private final FleetDispatchGateway dispatches;
+    private final FleetTripService fleet;
+    private final FleetBookingReservations reservations;
+    private final com.baiyue.lastleg.appointmentwork.AppointmentWorkChanges changes;
+    private final Object lockContextKey=new Object();
+    private record Locked(List<String> batches,List<String> tripNos,List<AppointmentWorkDispatchMapper.TransportRow> rows,Scope scope) { }
+    private record Source(String batch,String customer,String source,String destination) { }
+    public FbaAppointmentTransportAdapter(AppointmentWorkDispatchMapper allocations,FleetTripMapper trips,
+        FleetDispatchGateway dispatches,@Lazy FleetTripService fleet,FleetBookingReservations reservations,
+        com.baiyue.lastleg.appointmentwork.AppointmentWorkChanges changes) {
+        this.allocations=allocations;this.trips=trips;this.dispatches=dispatches;this.fleet=fleet;this.reservations=reservations;this.changes=changes;
+    }
+    @Transactional(readOnly=true)
+    public Scope inspect(List<String> batchKeys) {
+        var batches=keys(batchKeys);var first=read(batches,List.of());
+        return scope(batches,read(batches,tripNos(first)));
+    }
+    @Transactional(propagation=Propagation.MANDATORY)
+    public Scope lockAndInspect(List<String> batchKeys,String expectedVersion) {
+        var batches=keys(batchKeys);var initial=read(batches,List.of());var tripNos=tripNos(initial);
+        for(var trip:tripNos) if(trips.lockByNo(trip)==null) throw conflict("原车次已变化，请重新核对");
+        var all=read(batches,tripNos);
+        var targets=all.stream().filter(r->batches.contains(r.batchKey())).map(AppointmentWorkDispatchMapper.TransportRow::dispatchNo).distinct().sorted().toList();
+        for(var number:targets) dispatches.lockForPlanning(number);
+        var lockedRows=read(batches,tripNos);
+        if(!tripNos(lockedRows).equals(tripNos)) throw conflict("排车车次关联已变化，请重新核对");
+        var scope=scope(batches,lockedRows);
+        if(expectedVersion==null || !expectedVersion.equals(scope.version())) throw conflict("运输范围或版本已变化，请重新读取调整范围");
+        if(!scope.blockReasons().isEmpty()) throw conflict(String.join("；",scope.blockReasons()));
+        if(TransactionSynchronizationManager.hasResource(lockContextKey)) throw conflict("同一事务不能重复打开运输调整范围");
+        TransactionSynchronizationManager.bindResource(lockContextKey,new Locked(batches,tripNos,lockedRows,scope));
+        TransactionSynchronizationManager.registerSynchronization(new TransactionSynchronization() {
+            public void afterCompletion(int status) { TransactionSynchronizationManager.unbindResourceIfPossible(lockContextKey); }
+        });
+        return scope;
+    }
+    @Transactional(propagation=Propagation.MANDATORY)
+    public Result apply(Scope locked,List<Move> moves,String operator,String reason) {
+        var context=(Locked)TransactionSynchronizationManager.getResource(lockContextKey);
+        if(context==null || !context.scope().equals(locked)) throw conflict("运输调整必须使用本事务锁定的权威范围");
+        if(operator==null || operator.isBlank() || reason==null || reason.isBlank()) throw bad("运输调整须提供操作人和原因");
+        var current=read(context.batches(),context.tripNos());
+        if(!scope(context.batches(),current).version().equals(locked.version())) throw conflict("锁定后的排车事实已变化，请重新核对");
+        var intents=new LinkedHashMap<Source,Move>();
+        if(moves==null || moves.size()>1000) throw bad("运输调整来源清单无效");
+        for(var move:moves) {
+            if(move==null || !context.batches().contains(move.batchKey()) || move.originalPackages()<=0 || move.retainedPackages()<0 || move.retainedPackages()>move.originalPackages()
+                || move.customerId()==null || move.sourceKey()==null || move.destinationKey()==null) throw bad("运输调整必须对应原批次及0至当前量的真实逐票分配");
+            if(move.retainedPackages()<move.originalPackages() && (move.laterBatchKey()==null || !move.laterBatchKey().startsWith("FBA_APPOINTMENT:"))) throw bad("移出货物缺少核心生成的后送批次");
+            var source=new Source(move.batchKey(),move.customerId(),move.sourceKey(),move.destinationKey());
+            if(intents.putIfAbsent(source,move)!=null) throw bad("运输调整来源重复");
+        }
+        var targetRows=current.stream().filter(r->intents.containsKey(source(r))).toList();
+        var counts=targetRows.stream().collect(Collectors.groupingBy(this::source,Collectors.summingLong(AppointmentWorkDispatchMapper.TransportRow::packages)));
+        var remove=new LinkedHashMap<Source,Integer>();
+        for(var entry:intents.entrySet()) {
+            long bound=counts.getOrDefault(entry.getKey(),0L);
+            if(bound>entry.getValue().originalPackages()) throw conflict("原排车实物超过核心批次当前量，不能调整");
+            remove.put(entry.getKey(),Math.toIntExact(Math.max(0,bound-entry.getValue().retainedPackages())));
+        }
+        var byItem=current.stream().collect(Collectors.groupingBy(AppointmentWorkDispatchMapper.TransportRow::itemId,TreeMap::new,Collectors.toList()));
+        var selected=selectWholeItems(byItem,remove);
+        var affected=targetRows.stream().filter(r->selected.contains(r.itemId())).map(AppointmentWorkDispatchMapper.TransportRow::dispatchNo).distinct().sorted().toList();
+        // Validate every partial edit before invoking any original command. Transaction rollback is still mandatory.
+        for(var number:affected) {
+            var rows=current.stream().filter(r->number.equals(r.dispatchNo())).toList();
+            boolean whole=rows.stream().allMatch(r->selected.contains(r.itemId()));
+            var physical=allocations.dispatchPhysical(number);
+            if(physical.stream().anyMatch(p->!byItem.containsKey(p.itemId()))) throw conflict("原排车含未纳入逐票批次的实物，请先核对完整关联");
+            for(var item:physical) if(item.packages()==null || byItem.get(item.itemId()).stream().mapToLong(AppointmentWorkDispatchMapper.TransportRow::packages).sum()!=item.packages())
+                throw conflict("逐票批次分配未完整核平原排车实物，不能调整");
+            if(!whole && rows.stream().anyMatch(r->r.outboundId()!=null)) throw conflict("部分移出前须先在原业务处理未执行出库单");
+        }
+        var next=new LinkedHashSet<String>();
+        for(var number:affected) {
+            var rows=current.stream().filter(r->number.equals(r.dispatchNo())).toList();var first=rows.get(0);
+            boolean whole=rows.stream().allMatch(r->selected.contains(r.itemId()));
+            if(first.tripNo()!=null) fleet.unbindDispatch(first.tripNo(),operator,new FleetTripModels.BindingCommand(trips.findByNo(first.tripNo()).getRecordVersion(),number,reason));
+            if(whole) {
+                allocations.remove(first.dispatchId());
+                for(var row:rows) allocations.insert(new AppointmentWorkDispatchMapper.Bound(row.dispatchId(),row.itemId(),row.palletId(),intents.get(source(row)).laterBatchKey(),row.customerId(),row.sourceKey(),row.destinationKey(),row.packages()));
+                next.add("沿原排车重新安排后送车辆");
+            } else {
+                for(var item:rows.stream().filter(r->selected.contains(r.itemId())).map(AppointmentWorkDispatchMapper.TransportRow::itemId).distinct().sorted().toList()) dispatches.removeItem(number,item);
+                if(first.tripNo()!=null) fleet.bindDispatch(first.tripNo(),operator,new FleetTripModels.BindingCommand(trips.findByNo(first.tripNo()).getRecordVersion(),number,reason));
+                next.add("按后送批次重新选择已移出的实物");
+            }
+        }
+        for(var number:context.tripNos()) {
+            var detail=fleet.detail(number);
+            if(detail.dispatches().isEmpty() && !reservations.hasConfirmed(trips.findByNo(number).getId())) {
+                // The original cancellation command also checks external reservations and releases vehicle/driver resources.
+                fleet.cancel(number,operator,new FleetTripModels.Cancel(detail.trip().recordVersion(),reason));
+                next.add("原车无有效货物，已按车辆业务取消");
+            } else next.add("核对原车剩余货物及发车安排");
+        }
+        if(!affected.isEmpty()) changes.requirementsChanged();
+        var follow=new LinkedHashSet<>(context.batches());intents.values().stream().map(Move::laterBatchKey).filter(Objects::nonNull).forEach(follow::add);
+        return new Result(vehicles(read(List.copyOf(follow),context.tripNos())),List.copyOf(next));
+    }
+    private Set<Long> selectWholeItems(Map<Long,List<AppointmentWorkDispatchMapper.TransportRow>> byItem,Map<Source,Integer> wanted) {
+        var candidates=byItem.entrySet().stream().filter(e->e.getValue().stream().allMatch(r->wanted.getOrDefault(source(r),0)>0)).toList();
+        var selected=new LinkedHashSet<Long>();var budget=new int[]{10000};
+        if(!select(candidates,0,new HashMap<>(wanted),selected,budget)) throw conflict("移出数量不能精确匹配完整实物明细，请先在原库存业务按实际货物拆托后重试");
+        return selected;
+    }
+    private boolean select(List<Map.Entry<Long,List<AppointmentWorkDispatchMapper.TransportRow>>> items,int index,Map<Source,Integer> remaining,Set<Long> chosen,int[] budget) {
+        if(remaining.values().stream().allMatch(n->n==0)) return true;
+        if(index>=items.size() || --budget[0]<0) return false;
+        var item=items.get(index);var amounts=item.getValue().stream().collect(Collectors.groupingBy(this::source,Collectors.summingInt(AppointmentWorkDispatchMapper.TransportRow::packages)));
+        if(amounts.entrySet().stream().allMatch(e->e.getValue()<=remaining.getOrDefault(e.getKey(),0))) {
+            amounts.forEach((k,v)->remaining.compute(k,(ignored,n)->n-v));chosen.add(item.getKey());
+            if(select(items,index+1,remaining,chosen,budget)) return true;
+            chosen.remove(item.getKey());amounts.forEach((k,v)->remaining.compute(k,(ignored,n)->n+v));
+        }
+        return select(items,index+1,remaining,chosen,budget);
+    }
+    private Source source(AppointmentWorkDispatchMapper.TransportRow row) { return new Source(row.batchKey(),row.customerId(),row.sourceKey(),row.destinationKey()); }
+    private List<String> keys(List<String> keys) {
+        if(keys==null || keys.isEmpty() || keys.size()>100 || keys.stream().anyMatch(k->k==null || !k.matches("FBA_APPOINTMENT:[1-9][0-9]*"))) throw bad("请选择1至100个真实预约批次");
+        return keys.stream().distinct().sorted().toList();
+    }
+    private List<AppointmentWorkDispatchMapper.TransportRow> read(List<String> batches,List<String> tripNos) {
+        var rows=allocations.transportRows(batches,tripNos);if(rows.size()>1000) throw conflict("运输实物范围超过完整核对上限，请缩小范围");return rows;
+    }
+    private List<String> tripNos(List<AppointmentWorkDispatchMapper.TransportRow> rows) { return rows.stream().map(AppointmentWorkDispatchMapper.TransportRow::tripNo).filter(Objects::nonNull).distinct().sorted().toList(); }
+    private Scope scope(List<String> batches,List<AppointmentWorkDispatchMapper.TransportRow> rows) {
+        var reasons=new LinkedHashSet<String>();
+        for(var row:rows) if(batches.contains(row.batchKey())) {
+            if(!"PENDING_DEPARTURE".equals(row.dispatchStatus()) || row.pickedPackages()!=null && row.pickedPackages()>0 || row.shippedPackages()!=null && row.shippedPackages()>0
+                || row.taskStatus()!=null && !"PDA_PENDING".equals(row.taskStatus()) || row.outboundStatus()!=null && !"WAIT_OUTBOUND".equals(row.outboundStatus())) reasons.add("排车已开始执行，不能普通移出；请进入原运输异常处理");
+            if(row.tripNo()!=null && !"PLANNED".equals(row.tripStatus())) reasons.add("原车次已开始执行，不能普通移出");
+            if(row.itemPackages()==null || row.packages()<=0) reasons.add("原排车实物数量不完整");
+        }
+        return new Scope(digest(batches+":"+rows),vehicles(rows),List.copyOf(reasons));
+    }
+    private List<Vehicle> vehicles(List<AppointmentWorkDispatchMapper.TransportRow> rows) {
+        return rows.stream().collect(Collectors.groupingBy(r->List.of(r.dispatchNo(),r.batchKey()),LinkedHashMap::new,Collectors.toList())).values().stream().map(group->{
+            var r=group.get(0);return new Vehicle(r.tripNo(),r.tripVersion()==null?null:Math.toIntExact(r.tripVersion()),r.dispatchNo(),r.customerId(),r.batchKey(),r.dispatchStatus(),group.stream().mapToInt(AppointmentWorkDispatchMapper.TransportRow::packages).sum());
+        }).toList();
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/work/FbaAppointmentWorkAdapter.java b/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/work/FbaAppointmentWorkAdapter.java
new file mode 100644
index 000000000..e8c543393
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/inboundplan/work/FbaAppointmentWorkAdapter.java
@@ -0,0 +1,25 @@
+package com.baiyue.lastleg.inboundplan.work;
+
+import com.baiyue.lastleg.appointmentwork.AppointmentWorkFollowupInheritance;
+import com.baiyue.lastleg.inboundplan.receiving.FbaAppointmentWorkPort;
+import org.springframework.stereotype.Component;
+import java.time.LocalDate;
+import java.util.List;
+
+@Component
+public class FbaAppointmentWorkAdapter implements FbaAppointmentWorkPort {
+    private final AppointmentWorkFollowupInheritance work;
+    public FbaAppointmentWorkAdapter(AppointmentWorkFollowupInheritance work) { this.work=work; }
+    public Followup resolveFollowup(String ownerId,LocalDate date) {
+        var resolved=work.resolve(ownerId,date);
+        return new Followup(resolved.owner().id(),resolved.owner().name(),resolved.nextFollowupDate());
+    }
+    public void seedFollowup(Member original,Member later,Followup followup,String operatorId) {
+        work.seed(member(original),member(later),new com.baiyue.lastleg.appointmentwork.AppointmentWorkStore.Followup(
+            new com.baiyue.lastleg.appointmentwork.AppointmentWorkModels.Owner(followup.ownerId(),followup.ownerName()),followup.nextFollowupDate()),operatorId);
+    }
+    public void inheritFollowup(List<Member> originals,List<Member> successors,String operatorId) {
+        work.inherit(originals.stream().map(FbaAppointmentWorkAdapter::member).toList(),successors.stream().map(FbaAppointmentWorkAdapter::member).toList(),operatorId);
+    }
+    private static AppointmentWorkFollowupInheritance.Member member(Member member) { return new AppointmentWorkFollowupInheritance.Member(member.batchKey(),member.customerId()); }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/inventory/command/service/InventoryCommandService.java b/lastleg-service/src/main/java/com/baiyue/lastleg/inventory/command/service/InventoryCommandService.java
index d6c4cb571..ba07fe491 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/inventory/command/service/InventoryCommandService.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/inventory/command/service/InventoryCommandService.java
@@ -294,6 +294,40 @@ public class InventoryCommandService {
         }
     }
 
+    /** Internal discard workflow: remove only stock held by the same discard item. */
+    @Transactional
+    public InventoryCommandResponse discardHeld(String customerId, String operatorId, InventoryCommandRequests.Move request) {
+        if (request.packages() <= 0) throw badRequest("废弃数量必须为正数");
+        return execute(customerId, operatorId, "DISCARD", request.idempotencyKey(), request, operation -> {
+            Locked locked = locked(customerId, request.positionId());
+            InventoryPosition position = locked.position();
+            InventoryBalance balance = locked.balance();
+            requireReservation(customerId, request.positionId(), null, request.packages(), "DISCARD");
+            long owned = ledgers.orderHoldCycle(customerId, balance.getInboundOrderId(),
+                required(request.sourceEventId(), "废弃库存预留标识不能为空")).stream()
+                .filter(l -> Objects.equals(l.getPositionId(), position.getId())
+                    && Objects.equals(l.getBusinessOrderNo(), request.businessOrderNo()))
+                .mapToLong(l -> value(l.getDeltaPackages())).sum();
+            requireAtLeast(owned, request.packages(), "discard reservation");
+            long before = value(position.getHoldPackages());
+            requireAtLeast(before, request.packages(), "held");
+            requireAtLeast(value(balance.getHoldPackages()), request.packages(), "balance held");
+            position.setHoldPackages(before - request.packages());
+            position.setStatus(positionPackages(position) == 0 ? "EMPTY" : "OCCUPIED");
+            position.setVersion(value(position.getVersion()) + 1); position.setUpdatedAt(LocalDateTime.now());
+            positions.updateById(position);
+            balance.setHoldPackages(value(balance.getHoldPackages()) - request.packages()); touch(balance);
+            balances.updateById(balance);
+            boolean empty = position.getPalletId() != null && commands.palletPackages(position.getPalletId()) == 0;
+            if (empty) warehouseGateway.scrapPallet(customerId, position.getPalletId());
+            ledger(customerId, operatorId, operation.getId(), balance, position, balance.getSkuCode(), "DISCARD",
+                "HOLD", "DISCARDED", before, -request.packages(), before - request.packages(),
+                request.businessOrderNo(), balance.getInboundOrderNo(), request.outboundOrderNo(), request.sourceEventId(),
+                request.idempotencyKey(), request.remark());
+            return response(operation, balance, position, empty);
+        });
+    }
+
     private InventoryCommandResponse ship(String customerId, String operatorId,
                                            InventoryCommandRequests.Move request, String skuSnapshot) {
         return ship(customerId, operatorId, request, skuSnapshot, null);
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/inventory/mapper/InventoryBalanceMapper.java b/lastleg-service/src/main/java/com/baiyue/lastleg/inventory/mapper/InventoryBalanceMapper.java
index 6f29a1004..8026eecc2 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/inventory/mapper/InventoryBalanceMapper.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/inventory/mapper/InventoryBalanceMapper.java
@@ -14,6 +14,26 @@ import java.util.List;
 
 @Mapper
 public interface InventoryBalanceMapper extends BaseMapper<InventoryBalance> {
+    @Select("""
+        SELECT EXISTS(
+          SELECT 1 FROM ll_inbound_plan_carton c
+          JOIN ll_order o ON o.id=c.order_id AND o.customer_id=c.customer_id
+          JOIN ll_inbound_order i ON i.customer_id=o.customer_id AND i.inbound_code=o.inbound_code
+          WHERE c.customer_id=#{customerId} AND i.id=#{inboundOrderId}
+            AND o.overseas_warehouse_id=#{warehouseId} AND c.carton_mark=#{cartonMark}
+          UNION ALL
+          SELECT 1 FROM ll_warehouse_transfer_carton c
+          JOIN ll_warehouse_transfer_order t ON t.id=c.transfer_order_id AND t.customer_id=c.customer_id
+          WHERE c.customer_id=#{customerId} AND t.inbound_order_id=#{inboundOrderId}
+            AND t.operating_warehouse_id=#{warehouseId} AND c.status='COUNTED'
+            AND (c.carton_mark=#{cartonMark} OR c.customer_carton_mark=#{cartonMark})
+        )
+        """)
+    boolean cartonBelongsToInbound(@Param("customerId") String customerId,
+                                  @Param("warehouseId") String warehouseId,
+                                  @Param("inboundOrderId") Long inboundOrderId,
+                                  @Param("cartonMark") String cartonMark);
+
     @Select("SELECT * FROM ll_inventory_balance WHERE customer_id=#{customerId} " +
         "AND overseas_warehouse_id=#{overseasWarehouseId} " +
         "AND destination_warehouse_code=#{destinationWarehouseCode} " +
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/inventory/mapper/InventoryPositionMapper.java b/lastleg-service/src/main/java/com/baiyue/lastleg/inventory/mapper/InventoryPositionMapper.java
index 5aa78e426..dc1e70a5d 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/inventory/mapper/InventoryPositionMapper.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/inventory/mapper/InventoryPositionMapper.java
@@ -9,6 +9,7 @@ import org.apache.ibatis.annotations.Select;
 import org.apache.ibatis.annotations.Update;
 
 import java.util.List;
+import java.util.Collection;
 
 @Mapper
 public interface InventoryPositionMapper extends BaseMapper<InventoryPosition> {
@@ -17,6 +18,14 @@ public interface InventoryPositionMapper extends BaseMapper<InventoryPosition> {
     List<InventoryPosition> listBalance(@Param("customerId") String customerId,
                                         @Param("balanceId") Long balanceId);
 
+    @Select({"<script>",
+        "SELECT p.* FROM ll_inventory_position p JOIN ll_inventory_balance b ON b.id=p.balance_id",
+        "WHERE b.customer_id=#{customerId} AND p.balance_id IN",
+        "<foreach collection='balanceIds' item='id' open='(' separator=',' close=')'>#{id}</foreach>",
+        "ORDER BY p.balance_id,p.pallet_no,p.batch_no", "</script>"})
+    List<InventoryPosition> listBalances(@Param("customerId") String customerId,
+                                         @Param("balanceIds") Collection<Long> balanceIds);
+
     @Select("SELECT * FROM ll_inventory_position WHERE id=#{positionId} AND customer_id=#{customerId} LIMIT 1")
     InventoryPosition findTenantPosition(@Param("customerId") String customerId,
                                          @Param("positionId") Long positionId);
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/mapper/CustomerOrderProgressMapper.java b/lastleg-service/src/main/java/com/baiyue/lastleg/mapper/CustomerOrderProgressMapper.java
index d602ab804..13ea3d7f8 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/mapper/CustomerOrderProgressMapper.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/mapper/CustomerOrderProgressMapper.java
@@ -8,12 +8,17 @@ import java.util.List;
 @Mapper
 public interface CustomerOrderProgressMapper {
     @Select("""
+        <script>
         WITH scheduled AS (
           SELECT line.order_id,SUM(a.planned_package_count) AS packages
           FROM ll_dispatch_order d
           JOIN ll_dispatch_item i ON i.dispatch_order_id=d.id AND i.customer_id=d.customer_id
           JOIN ll_inbound_plan_pallet_allocation a ON a.pallet_id=i.plan_pallet_id
           JOIN ll_inbound_plan_line line ON line.id=a.line_id AND line.customer_id=d.customer_id
+          <if test="orderIds != null">
+          JOIN ll_order planned_source ON planned_source.id=line.order_id AND planned_source.customer_id=#{customerId}
+            AND planned_source.source_order_id IN <foreach collection="orderIds" item="id" open="(" separator="," close=")">#{id}</foreach>
+          </if>
           WHERE d.customer_id=#{customerId} AND d.status IN ('PENDING_DEPARTURE','PICKING','READY_TO_DEPART')
             AND i.warehouse_pallet_id IS NULL
           GROUP BY line.order_id
@@ -24,14 +29,32 @@ public interface CustomerOrderProgressMapper {
           JOIN ll_inventory_position p ON p.customer_id=d.customer_id AND p.pallet_id=i.warehouse_pallet_id
             AND p.overseas_warehouse_id=i.overseas_warehouse_id
           JOIN ll_inventory_balance b ON b.id=p.balance_id AND b.customer_id=d.customer_id
-          LEFT JOIN (SELECT dispatch_item_id,inventory_position_id,SUM(packages) AS packages
-            FROM ll_dispatch_pda_pick WHERE customer_id=#{customerId}
-            GROUP BY dispatch_item_id,inventory_position_id) pk
+          <if test="orderIds != null">
+          JOIN ll_order stock_source ON stock_source.id=b.inbound_order_id AND stock_source.customer_id=#{customerId}
+            AND stock_source.source_order_id IN <foreach collection="orderIds" item="id" open="(" separator="," close=")">#{id}</foreach>
+          </if>
+          LEFT JOIN (SELECT pick.dispatch_item_id,pick.inventory_position_id,SUM(pick.packages) AS packages
+            FROM ll_dispatch_pda_pick pick
+            <if test="orderIds != null">
+            JOIN ll_inventory_position scoped_position ON scoped_position.id=pick.inventory_position_id
+              AND scoped_position.customer_id=pick.customer_id
+            JOIN ll_inventory_balance scoped_balance ON scoped_balance.id=scoped_position.balance_id
+              AND scoped_balance.customer_id=pick.customer_id
+            JOIN ll_order scoped_order ON scoped_order.id=scoped_balance.inbound_order_id
+              AND scoped_order.customer_id=pick.customer_id
+              AND scoped_order.source_order_id IN <foreach collection="orderIds" item="id" open="(" separator="," close=")">#{id}</foreach>
+            </if>
+            WHERE pick.customer_id=#{customerId}
+            GROUP BY pick.dispatch_item_id,pick.inventory_position_id) pk
             ON pk.dispatch_item_id=i.id AND pk.inventory_position_id=p.id
           WHERE d.customer_id=#{customerId} AND d.status IN ('PENDING_DEPARTURE','PICKING','READY_TO_DEPART')
             AND (i.plan_pallet_id IS NULL OR EXISTS (
               SELECT 1 FROM ll_inbound_plan_pallet_allocation a
               JOIN ll_inbound_plan_line line ON line.id=a.line_id AND line.customer_id=d.customer_id
+          <if test="orderIds != null">
+          JOIN ll_order planned_source ON planned_source.id=line.order_id AND planned_source.customer_id=#{customerId}
+            AND planned_source.source_order_id IN <foreach collection="orderIds" item="id" open="(" separator="," close=")">#{id}</foreach>
+          </if>
               WHERE a.pallet_id=i.plan_pallet_id AND line.order_id=b.inbound_order_id))
           GROUP BY b.inbound_order_id
         ), departed AS (
@@ -41,6 +64,10 @@ public interface CustomerOrderProgressMapper {
           JOIN ll_dispatch_pda_task t ON t.id=p.task_id AND t.customer_id=a.customer_id
           JOIN ll_dispatch_order ds ON ds.id=t.dispatch_order_id AND ds.customer_id=a.customer_id
           JOIN ll_dispatch_item i ON i.id=p.dispatch_item_id AND i.dispatch_order_id=ds.id AND i.customer_id=a.customer_id
+          <if test="orderIds != null">
+          JOIN ll_order departed_source ON departed_source.id=a.order_id AND departed_source.customer_id=#{customerId}
+            AND departed_source.source_order_id IN <foreach collection="orderIds" item="id" open="(" separator="," close=")">#{id}</foreach>
+          </if>
           WHERE a.customer_id=#{customerId} AND ds.status='DEPARTED' AND ds.depart_at IS NOT NULL
             AND EXISTS (
               SELECT 1 FROM ll_delivery_order d
@@ -62,7 +89,11 @@ public interface CustomerOrderProgressMapper {
         FROM ll_order o WHERE o.customer_id=#{customerId} AND o.source_region='FIRSTLEG'
           AND o.source_order_id IS NOT NULL AND o.source_inbound_id IS NOT NULL
           AND o.order_type NOT IN ('RELABEL_APPLICATION','WAREHOUSE_TRANSFER')
+          <if test="orderIds != null">
+            AND o.source_order_id IN <foreach collection="orderIds" item="id" open="(" separator="," close=")">#{id}</foreach>
+          </if>
         ORDER BY o.id
+        </script>
         """)
-    List<CustomerOrderProgress.Source> sources(@Param("customerId") String customerId);
+    List<CustomerOrderProgress.Source> sources(@Param("customerId") String customerId, @Param("orderIds") List<String> orderIds);
 }
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/mapper/LastlegOrderMapper.java b/lastleg-service/src/main/java/com/baiyue/lastleg/mapper/LastlegOrderMapper.java
index 103c4d6c9..519aee690 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/mapper/LastlegOrderMapper.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/mapper/LastlegOrderMapper.java
@@ -56,7 +56,8 @@ public interface LastlegOrderMapper extends BaseMapper<LastlegOrder> {
         "WHERE g.container_booking_id=ll_order.source_container_booking_id " +
         "AND g.node_sequence>=40 AND g.actual_at IS NOT NULL) THEN 1 ELSE 0 END END)={0})";
 
-    @Select("<script>SELECT r.lastleg_order_id,r.relabel_no,r.status,r.notified_package_count AS quantity,r.created_at " +
+    @Select("<script>SELECT r.lastleg_order_id,r.relabel_no,r.status,r.notified_package_count AS quantity, " +
+        "CASE WHEN NOT EXISTS (SELECT 1 FROM ll_relabel_item ri WHERE ri.application_id=r.id AND ri.operation_type&lt;&gt;'CARTON_LABEL') THEN '箱' ELSE '件' END AS quantity_unit,r.created_at " +
         "FROM ll_relabel_application r JOIN ll_order o ON o.id=r.lastleg_order_id AND o.customer_id=r.customer_id " +
         "WHERE r.lastleg_order_id IN <foreach collection='orderIds' item='id' open='(' separator=',' close=')'>#{id}</foreach> " +
         "ORDER BY r.created_at,r.id</script>")
@@ -83,7 +84,7 @@ public interface LastlegOrderMapper extends BaseMapper<LastlegOrder> {
         "ORDER BY r.signed_at DESC,r.id DESC) AS measurementNo " +
         "FROM ll_return_receipt r JOIN ll_return_order o ON o.id=r.return_order_id AND o.customer_id=r.customer_id " +
         "WHERE o.lastleg_order_id IN <foreach collection='orderIds' item='id' open='(' separator=',' close=')'>#{id}</foreach> " +
-        "AND r.unit_type IN ('PALLET','BOX') AND r.length IS NOT NULL AND r.width IS NOT NULL AND r.height IS NOT NULL" +
+        "AND r.unit_type IN ('PALLET','BOX','PARCEL') AND r.length IS NOT NULL AND r.width IS NOT NULL AND r.height IS NOT NULL" +
         ") m WHERE m.measurementNo=1 GROUP BY m.orderId</script>")
     List<ReturnVolumeRow> findReturnVolumes(@Param("orderIds") List<Long> orderIds);
 
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/palletops/controller/PdaPalletOperationController.java b/lastleg-service/src/main/java/com/baiyue/lastleg/palletops/controller/PdaPalletOperationController.java
index 74886139e..f5ce3216c 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/palletops/controller/PdaPalletOperationController.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/palletops/controller/PdaPalletOperationController.java
@@ -20,6 +20,20 @@ import org.springframework.web.bind.annotation.RestController;
 @PreAuthorize("hasAuthority('lastleg:pda:operate') and hasAuthority('ROLE_OVERSEAS_WAREHOUSE_PDA_OPERATOR')")
 public class PdaPalletOperationController {
     @Resource private PdaPalletOperationService service;
+    @Resource private com.baiyue.lastleg.relabel.service.RelabelPalletMeasurementService measurements;
+
+    @PostMapping("/relabel-pallet-measurements")
+    public ApiResponse<java.util.List<com.baiyue.lastleg.relabel.service.RelabelPalletMeasurementService.Measurement>> measurements(
+        @AuthenticationPrincipal AuthenticatedUser user, @Valid @RequestBody PalletOperationRequests.RelabelSources request) {
+        return ApiResponse.success(measurements.list(PdaWarehouseIdentity.require(user), request.relabelNo()));
+    }
+
+    @PostMapping("/relabel-pallet-measure")
+    public ApiResponse<java.util.List<com.baiyue.lastleg.relabel.service.RelabelPalletMeasurementService.Measurement>> measure(
+        @AuthenticationPrincipal AuthenticatedUser user,
+        @Valid @RequestBody com.baiyue.lastleg.relabel.service.RelabelPalletMeasurementService.Measure request) {
+        return ApiResponse.success(measurements.save(PdaWarehouseIdentity.require(user), request));
+    }
 
     @PostMapping("/pallets/resolve")
     public ApiResponse<PalletOperationResponses.PalletContent> resolve(
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/palletops/dto/PalletOperationRequests.java b/lastleg-service/src/main/java/com/baiyue/lastleg/palletops/dto/PalletOperationRequests.java
index 3194e89d6..f53145fdd 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/palletops/dto/PalletOperationRequests.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/palletops/dto/PalletOperationRequests.java
@@ -34,17 +34,24 @@ public final class PalletOperationRequests {
                               @NotEmpty @Size(max = 20) List<@Valid TargetMove> targets,
                               @Size(max = 500) String reason) { }
 
-    /** actualSource为现场确认的原入仓库存行；cartonMarks确认本批目标绑定，不推断历史箱唛位置。 */
+    public record MeasuredCartonBinding(@NotBlank @Size(max=255) String cartonMark,
+                                        @NotBlank @Size(max=255) String sourceCartonMark) {}
+    /** source为空时表示退货箱没有来源托盘，现场仅扫描箱唛后绑定目标托盘；actualSource为现场确认的原入仓库存行。 */
     public record RelabelDisassemble(@NotBlank @Size(max = 128) String idempotencyKey,
                                      @NotBlank @Size(max = 64) String relabelNo,
                                      @Valid PalletExpectation source,
                                      @Valid PalletExpectation target,
                                      @NotEmpty @Size(max = 500) List<@NotBlank @Size(max = 255) String> cartonMarks,
                                      @Size(max = 500) String reason,
-                                     @Valid MoveLine actualSource) {
+                                     @Valid MoveLine actualSource,
+                                     @Size(max=500) List<@Valid MeasuredCartonBinding> measuredCartons) {
+        public RelabelDisassemble(String idempotencyKey, String relabelNo, PalletExpectation source,
+                                  PalletExpectation target, List<String> cartonMarks, String reason, MoveLine actualSource) {
+            this(idempotencyKey, relabelNo, source, target, cartonMarks, reason, actualSource, null);
+        }
         public RelabelDisassemble(String idempotencyKey, String relabelNo, PalletExpectation source,
                                   PalletExpectation target, List<String> cartonMarks, String reason) {
-            this(idempotencyKey, relabelNo, source, target, cartonMarks, reason, null);
+            this(idempotencyKey, relabelNo, source, target, cartonMarks, reason, null, null);
         }
     }
 
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/palletops/dto/PalletOperationResponses.java b/lastleg-service/src/main/java/com/baiyue/lastleg/palletops/dto/PalletOperationResponses.java
index 0eb4cf9ec..bc437ad42 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/palletops/dto/PalletOperationResponses.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/palletops/dto/PalletOperationResponses.java
@@ -25,7 +25,14 @@ public final class PalletOperationResponses {
                                 String palletCode, String status, int palletVersion,
                                 @JsonSerialize(using = ToStringSerializer.class) Long locationId,
                                 String locationCode, String destinationWarehouseCode,
-                                long totalPackages, List<InventoryLine> inventory) { }
+                                long totalPackages, List<InventoryLine> inventory,
+                                java.math.BigDecimal grossWeightKg, java.math.BigDecimal volumeCbm) {
+        public PalletContent(long palletId, String palletCode, String status, int palletVersion, Long locationId,
+                             String locationCode, String destinationWarehouseCode, long totalPackages, List<InventoryLine> inventory) {
+            this(palletId, palletCode, status, palletVersion, locationId, locationCode, destinationWarehouseCode,
+                totalPackages, inventory, null, null);
+        }
+    }
     public record PrintablePallet(@JsonSerialize(using = ToStringSerializer.class) long palletId,
                                   String palletCode, int palletVersion,
                                   String relabelNo, String printableHtml) { }
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/palletops/service/PdaPalletOperationService.java b/lastleg-service/src/main/java/com/baiyue/lastleg/palletops/service/PdaPalletOperationService.java
index 2330c0b53..94419194d 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/palletops/service/PdaPalletOperationService.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/palletops/service/PdaPalletOperationService.java
@@ -68,6 +68,7 @@ public class PdaPalletOperationService {
     @Resource private RelabelApplicationMapper relabelApplications;
     @Resource private RelabelItemMapper relabelItems;
     @Resource private RelabelPalletMutationService relabelPalletMutations;
+    @Resource private com.baiyue.lastleg.relabel.service.RelabelCartonMeasurementService cartonMeasurements;
     @Resource private ReturnInventoryCartonMapper returnCartons;
     @Resource private ReturnInventoryCartonItemMapper returnCartonItems;
     @Resource private ReturnInventoryBalanceMapper returnBalances;
@@ -105,13 +106,16 @@ public class PdaPalletOperationService {
                     || !Objects.equals(carton.getOverseasWarehouseId(), app.getOverseasWarehouseId())
                     || !Objects.equals(carton.getStatus(), "RELABEL_PENDING"))
                     throw conflict("退货换标来源托盘不存在或已被占用");
-                PalletPhysicalGateway.PalletReference pallet = physical.resolve(carton.getPalletCode());
-                if (pallet == null || pallet.warehouseId() != identity.overseasWarehouseId())
+                String palletCode = text(carton.getPalletCode());
+                PalletPhysicalGateway.PalletReference pallet = palletCode.isBlank() || "UNBOUND".equalsIgnoreCase(palletCode)
+                    ? null : physical.resolve(palletCode);
+                if (palletCode.isBlank() || "UNBOUND".equalsIgnoreCase(palletCode)) palletCode = "UNBOUND";
+                if (pallet != null && pallet.warehouseId() != identity.overseasWarehouseId())
                     throw conflict("退货换标来源托盘不属于当前仓库");
                 long quantity = entry.getValue().stream().anyMatch(item -> "RETURN_BULK_SKU_LABEL".equals(item.getOperationType()))
                     ? value(carton.getTotalQuantity()) : 1;
                 result.add(new PalletOperationResponses.RelabelSource(carton.getId(), 0L,
-                    pallet.palletId(), pallet.palletCode(), null, carton.getSourceBatchNo(), quantity, quantity,
+                    pallet == null ? null : pallet.palletId(), palletCode, null, carton.getSourceBatchNo(), quantity, quantity,
                     entry.getValue().stream().map(RelabelItem::getCartonMark).filter(Objects::nonNull).toList()));
             }
             return result;
@@ -225,11 +229,14 @@ public class PdaPalletOperationService {
         if (!Objects.equals(application.getOverseasWarehouseId(), String.valueOf(identity.overseasWarehouseId()))) {
             throw conflict("换标单不属于 Token 冻结的海外仓");
         }
-        Map<String, PalletPhysicalGateway.PalletReference> pallets = resolvePallets(identity.overseasWarehouseId(),
-            request.source(), List.of(request.target()));
-        PalletPhysicalGateway.PalletReference source = pallets.get(code(request.source().palletCode()));
-        PalletPhysicalGateway.PalletReference target = pallets.get(code(request.target().palletCode()));
-        if (source.palletId() == target.palletId()) throw conflict("原托盘和目标托盘不能相同");
+        if (request.target() == null) throw badRequest("目标托盘不能为空");
+        PalletPhysicalGateway.PalletReference target = resolvePallets(identity.overseasWarehouseId(),
+            List.of(request.target())).get(code(request.target().palletCode()));
+        PalletPhysicalGateway.PalletReference source = request.source() == null ? null
+            : resolvePallets(identity.overseasWarehouseId(), List.of(request.source())).get(code(request.source().palletCode()));
+        Map<String, PalletPhysicalGateway.PalletReference> pallets = new LinkedHashMap<>();
+        if (source != null) pallets.put(source.palletCode(), source);
+        pallets.put(target.palletCode(), target);
         List<String> marks = request.cartonMarks().stream().map(String::trim).filter(value -> !value.isEmpty()).toList();
         if (marks.size() != request.cartonMarks().size() || new HashSet<>(marks).size() != marks.size()) {
             throw badRequest("箱唛不能为空且不能重复");
@@ -245,6 +252,13 @@ public class PdaPalletOperationService {
         Map<Long, List<RelabelItem>> itemsByPosition = new LinkedHashMap<>();
         Map<Long, InventoryPosition> anchors = new LinkedHashMap<>();
         boolean returnRelabel = selected.stream().allMatch(item -> item.getReturnCartonId() != null);
+        boolean unboundReturnRelabel = returnRelabel && selected.stream().allMatch(item -> {
+            ReturnInventoryCarton carton = returnCartons.selectById(item.getReturnCartonId());
+            return carton != null && (!org.springframework.util.StringUtils.hasText(carton.getPalletCode())
+                || "UNBOUND".equalsIgnoreCase(carton.getPalletCode()));
+        });
+        if (unboundReturnRelabel && source != null) throw conflict("无来源托盘的退货箱不能提交来源托盘");
+        if (!unboundReturnRelabel && source == null) throw conflict("请先确认来源托盘");
         InventoryPosition actual = returnRelabel || request.actualSource() == null
             ? null : positions.selectById(request.actualSource().positionId());
         if (!returnRelabel && request.actualSource() != null && (actual == null
@@ -255,7 +269,7 @@ public class PdaPalletOperationService {
             throw conflict("实际来源托盘库存已变化，请刷新后确认");
         if (actual != null && application.getOutboundOrderNo() != null && !application.getOutboundOrderNo().isBlank())
             throw conflict("已生成出库单，请先处理出库单，不能重新分配冻结来源");
-        if (actual != null && marks.stream().anyMatch(boundRelabelMarks(application)::contains))
+        if (actual != null && source.palletId() != target.palletId() && marks.stream().anyMatch(boundRelabelMarks(application)::contains))
             throw conflict("本批包含本轮已组托的换标箱，请刷新后选择未组托的箱");
         if ("PROCESSING".equals(application.getStatus())) {
             var workTask = relabelWorkTasks.find(application.getCustomerId(), application.getId());
@@ -269,7 +283,42 @@ public class PdaPalletOperationService {
             }
         }
         if (returnRelabel) {
-            return bindReturnRelabelPallet(identity, application, selected, source, target, request);
+            if (source != null && source.palletId() == target.palletId()) throw conflict("退货换标请使用独立目标托盘");
+            return bindReturnRelabelPallet(identity, application, selected, source, target, request, unboundReturnRelabel);
+        }
+        if (source.palletId() == target.palletId()) {
+            return transaction.execute(status -> {
+                var lockedApp = relabelApplications.lockAnyByRelabelNo(application.getRelabelNo());
+                requireRelabelWork(identity, lockedApp);
+                long total = mapper.palletPackages(String.valueOf(identity.overseasWarehouseId()), source.palletId());
+                long selectedPackages = selected.stream().mapToLong(i -> value(i.getNotifiedPackageCount())).sum();
+                if (total <= 0 || total != selectedPackages) throw conflict("部分贴标必须拆到新托盘；只有整托全部贴标可保留原托盘");
+                Map<Long, List<RelabelItem>> byPosition = selected.stream().collect(Collectors.groupingBy(RelabelItem::getSourceInventoryPositionId));
+                Map<Long, InventoryPosition> retained = new LinkedHashMap<>();
+                for (var entry : byPosition.entrySet()) {
+                    var row = mapper.lockPosition(application.getOverseasWarehouseId(), entry.getKey());
+                    long count = entry.getValue().stream().mapToLong(i -> value(i.getNotifiedPackageCount())).sum();
+                    if (row == null || !application.getCustomerId().equals(row.getCustomerId())
+                        || !Objects.equals(row.getPalletId(), source.palletId()) || value(row.getHoldPackages()) < count)
+                        throw conflict("原托盘换标库存已变化，请刷新后核对");
+                    requirePalletReservation(application.getCustomerId(), entry.getKey(), inventoryCommands.relabelTransfer(application.getCustomerId(), application.getId()));
+                    retained.put(entry.getKey(), positions.selectById(entry.getKey()));
+                }
+                requireRelabelDestination(identity.overseasWarehouseId(), selected, target);
+                Set<String> bound = boundRelabelMarks(application);
+                if (!marks.stream().allMatch(bound::contains)) {
+                    if (marks.stream().anyMatch(bound::contains)) throw conflict("本批包含已绑定箱唛，请刷新后重试");
+                    recordRelabelBinding(identity, new RelabelMutation(application, byPosition, Map.of(), request.measuredCartons()), retained);
+                }
+                var result = new PalletOperationResponses.Operation(IdWorker.getId(), "RELABEL_PALLET_DISASSEMBLE", request.idempotencyKey(),
+                    "COMPLETED", false, LocalDateTime.now(), List.of(content(identity.overseasWarehouseId(), source)));
+                var operation = new PdaPalletOperation(); operation.setId(result.operationId());
+                operation.setOverseasWarehouseId(identity.overseasWarehouseId()); operation.setOperatorKey(identity.operatorKey());
+                operation.setOperationType(result.operationType()); operation.setIdempotencyKey(request.idempotencyKey());
+                operation.setRequestHash(hash(request)); operation.setStatus("COMPLETED"); operation.setResultJson(write(result));
+                operation.setCreatedAt(result.completedAt()); operation.setUpdatedAt(result.completedAt()); mapper.insert(operation);
+                return result;
+            });
         }
         for (RelabelItem item : selected) {
             if (item.getSourceInventoryPositionId() == null || item.getNotifiedPackageCount() == null
@@ -303,7 +352,7 @@ public class PdaPalletOperationService {
         requireRelabelDestination(identity.overseasWarehouseId(), selected, target);
         Plan base = plan(identity.overseasWarehouseId(), pallets, moves, Set.of(target.palletId()), false);
         Plan relabelPlan = new Plan(base.pallets(), base.moves(), base.changes(),
-            new RelabelMutation(application, itemsByPosition, actual == null ? Map.of() : anchors));
+            new RelabelMutation(application, itemsByPosition, actual == null ? Map.of() : anchors, request.measuredCartons()));
         String reason = "换标拆托" + (request.reason() == null || request.reason().isBlank()
             ? "" : "：" + request.reason().trim());
         return execute(identity, "RELABEL_PALLET_DISASSEMBLE", request.idempotencyKey(), request,
@@ -313,25 +362,27 @@ public class PdaPalletOperationService {
     private PalletOperationResponses.Operation bindReturnRelabelPallet(PdaWarehouseIdentity identity,
         RelabelApplication application, List<RelabelItem> selected,
         PalletPhysicalGateway.PalletReference source, PalletPhysicalGateway.PalletReference target,
-        PalletOperationRequests.RelabelDisassemble request) {
+        PalletOperationRequests.RelabelDisassemble request, boolean unboundSource) {
         requireRelabelDestination(identity.overseasWarehouseId(), selected, target);
         Set<String> alreadyBound = boundRelabelMarks(application);
-        if (selected.stream().map(RelabelItem::getCartonMark).anyMatch(alreadyBound::contains))
+        boolean rebind = request.actualSource() == null && selected.stream().allMatch(item -> alreadyBound.contains(item.getCartonMark()));
+        if (!rebind && selected.stream().map(RelabelItem::getCartonMark).anyMatch(alreadyBound::contains))
             throw conflict("退货换标箱已在本轮完成组托，请刷新后重试");
         long quantity = 0;
         List<ReturnInventoryCarton> cartons = new ArrayList<>();
         for (RelabelItem item : selected) {
             ReturnInventoryCarton carton = returnCartons.lockId(item.getReturnCartonId());
             if (carton == null || !Objects.equals(carton.getCustomerId(), application.getCustomerId())
-                || !Objects.equals(carton.getPalletCode(), source.palletCode())
+                || (unboundSource ? (org.springframework.util.StringUtils.hasText(carton.getPalletCode()) && !"UNBOUND".equalsIgnoreCase(carton.getPalletCode()))
+                    : !Objects.equals(carton.getPalletCode(), source.palletCode()))
                 || !Objects.equals(carton.getRelabelApplicationId(), application.getId())
                 || !Objects.equals(carton.getStatus(), "RELABEL_PENDING"))
                 throw conflict("退货换标来源托盘或库存状态已变化，请刷新后重试");
             quantity += value(item.getNotifiedPackageCount());
             cartons.add(carton);
         }
-        if (request.actualSource() == null || request.actualSource().positionId() != cartons.get(0).getId()
-            || request.actualSource().packages() != quantity)
+        if (!rebind && !unboundSource && (request.actualSource() == null || request.actualSource().positionId() != cartons.get(0).getId()
+            || request.actualSource().packages() != quantity))
             throw conflict("退货换标拆出数量必须等于本批已完成贴标数量");
         String key = required(request.idempotencyKey(), "幂等键不能为空");
         String requestHash = hash(request);
@@ -344,7 +395,8 @@ public class PdaPalletOperationService {
                 RelabelItem item = selected.get(index);
                 ReturnInventoryCarton carton = returnCartons.lockId(item.getReturnCartonId());
                 if (carton == null || !Objects.equals(carton.getCustomerId(), application.getCustomerId())
-                    || !Objects.equals(carton.getPalletCode(), source.palletCode())
+                    || (unboundSource ? (org.springframework.util.StringUtils.hasText(carton.getPalletCode()) && !"UNBOUND".equalsIgnoreCase(carton.getPalletCode()))
+                        : !Objects.equals(carton.getPalletCode(), source.palletCode()))
                     || !Objects.equals(carton.getRelabelApplicationId(), application.getId())
                     || !"RELABEL_PENDING".equals(carton.getStatus()))
                     throw conflict("退货换标来源库存已变化，请刷新后重试");
@@ -362,9 +414,10 @@ public class PdaPalletOperationService {
                 }
             }
             recordReturnRelabelBinding(identity, application, selected, target.palletCode());
-            List<PalletOperationResponses.PalletContent> contents = List.of(
-                content(identity.overseasWarehouseId(), physical.resolve(source.palletCode())),
-                content(identity.overseasWarehouseId(), physical.resolve(target.palletCode())));
+            List<PalletOperationResponses.PalletContent> contents = source == null
+                ? List.of(content(identity.overseasWarehouseId(), physical.resolve(target.palletCode())))
+                : List.of(content(identity.overseasWarehouseId(), physical.resolve(source.palletCode())),
+                    content(identity.overseasWarehouseId(), physical.resolve(target.palletCode())));
             PalletOperationResponses.Operation result = new PalletOperationResponses.Operation(operation.getId(),
                 operation.getOperationType(), key, "COMPLETED", false, LocalDateTime.now(), contents);
             operation.setStatus("COMPLETED"); operation.setResultJson(write(result));
@@ -788,9 +841,16 @@ public class PdaPalletOperationService {
         record.setFromStatus(task.getStatus()); record.setToStatus(task.getStatus());
         record.setOperatorKey(identity.operatorKey()); record.setOperatorName(identity.operatorName());
         record.setCreatedAt(LocalDateTime.now());
+        var measured = cartonMeasurements.prepare(app,
+            mutation.itemsByPosition().values().stream().flatMap(List::stream).toList(),
+            mutation.itemsByPosition().keySet().stream().map(positions::selectById).filter(Objects::nonNull).findFirst().orElseThrow().getPalletId(),
+            targets.values().iterator().next().getPalletId(), targets.values().iterator().next().getPalletNo(), mutation.measuredCartons());
         record.setDetailJson(write(Map.of("round", Objects.toString(task.getReviewedAt(), "INITIAL"),
+            "measuredCartons", measured,
             "cartonMarks", mutation.itemsByPosition().values().stream().flatMap(List::stream).map(RelabelItem::getCartonMark).toList(),
-            "targetPallets", targets.values().stream().map(InventoryPosition::getPalletNo).distinct().toList())));
+            "targetPallets", targets.values().stream().map(InventoryPosition::getPalletNo).distinct().toList(),
+            "sourcePallets", mutation.itemsByPosition().keySet().stream().map(positions::selectById)
+                .filter(Objects::nonNull).map(InventoryPosition::getPalletNo).distinct().toList())));
         relabelWorkHistory.insert(record);
     }
 
@@ -836,6 +896,8 @@ public class PdaPalletOperationService {
         Set<String> destinations = new HashSet<>();
         selected.forEach(item -> destinations.add(text(item.getDestinationFbaWarehouseCode())));
         if (destinations.size() != 1 || destinations.contains("")) throw conflict("请按已维护的新目的仓分批组托");
+        returnCartons.palletCartons(String.valueOf(warehouseId), target.palletCode())
+            .forEach(carton -> destinations.add(text(carton.getDestinationWarehouseCode())));
         for (PalletInventoryRow row : mapper.content(String.valueOf(warehouseId), target.palletId())) {
             var bound = relabelItems.selectList(new com.baomidou.mybatisplus.core.conditions.query.QueryWrapper<RelabelItem>()
                 .eq("customer_id", row.getCustomerId()).eq("source_inventory_position_id", row.getPositionId()));
@@ -898,10 +960,22 @@ public class PdaPalletOperationService {
                 value(row.getReceivingPackages()), value(row.getVersion()));
         }).toList();
         long total = rows.stream().mapToLong(PdaPalletOperationService::rowPackages).sum();
+        var boxes = returnCartons.palletCartons(String.valueOf(warehouseId), pallet.palletCode());
+        boxes.forEach(box -> destinations.add(text(box.getDestinationWarehouseCode())));
+        total += boxes.size();
+        // Derive totals from current physical bindings, so retries and rebinds cannot double count.
+        java.math.BigDecimal weight = rows.isEmpty() ? java.math.BigDecimal.ZERO : null;
+        java.math.BigDecimal volume = rows.isEmpty() ? java.math.BigDecimal.ZERO : null;
+        for (var box : boxes) {
+            if (weight != null) weight = box.getWeight() == null || box.getWeight().signum() <= 0 ? null : weight.add(box.getWeight());
+            if (volume != null) volume = box.getLength() == null || box.getWidth() == null || box.getHeight() == null
+                || box.getLength().signum() <= 0 || box.getWidth().signum() <= 0 || box.getHeight().signum() <= 0 ? null
+                : volume.add(box.getLength().multiply(box.getWidth()).multiply(box.getHeight()).movePointLeft(6));
+        }
         String locationCode = locationCode(warehouseId, pallet.locationId());
         return new PalletOperationResponses.PalletContent(pallet.palletId(), pallet.palletCode(), pallet.status(),
             pallet.version(), pallet.locationId(), locationCode, destinations.size() == 1 ? destinations.iterator().next() : null,
-            total, inventory);
+            total, inventory, weight, volume);
     }
 
     private PdaPalletOperation begin(PdaWarehouseIdentity identity, String type, String key, String requestHash) {
@@ -1054,6 +1128,11 @@ public class PdaPalletOperationService {
                         RelabelMutation relabelMutation) { }
     private record RelabelMutation(RelabelApplication application,
                                    Map<Long, List<RelabelItem>> itemsByPosition,
-                                   Map<Long, InventoryPosition> anchors) { }
+                                   Map<Long, InventoryPosition> anchors,
+                                   List<com.baiyue.lastleg.palletops.dto.PalletOperationRequests.MeasuredCartonBinding> measuredCartons) {
+        RelabelMutation(RelabelApplication application, Map<Long,List<RelabelItem>> itemsByPosition, Map<Long,InventoryPosition> anchors) {
+            this(application,itemsByPosition,anchors,null);
+        }
+    }
     private enum InventoryBucket { AVAILABLE, HOLD }
 }
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/relabel/controller/MerchantRelabelApplicationController.java b/lastleg-service/src/main/java/com/baiyue/lastleg/relabel/controller/MerchantRelabelApplicationController.java
index 419d2e3f4..fdc6b2fcc 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/relabel/controller/MerchantRelabelApplicationController.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/relabel/controller/MerchantRelabelApplicationController.java
@@ -74,6 +74,15 @@ public class MerchantRelabelApplicationController {
         if ("ITEM".equalsIgnoreCase(scope)) return ApiResponse.success(service.uploadItemFile(customer(user), relabelNo, itemId == null ? 0L : itemId, operatorLong(user), file));
         return ApiResponse.success(service.uploadTotalFile(customer(user), relabelNo, operatorLong(user), file, kind));
     }
+    /** 按登录客户及申请绑定关系读取贴标资料，禁止跨客户或跨明细下载。 */
+    @GetMapping("/{relabelNo}/files/{fileId}/download")
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_RELABEL_LIST + "')")
+    public ResponseEntity<byte[]> downloadFile(@AuthenticationPrincipal AuthenticatedUser user,
+        @PathVariable String relabelNo, @PathVariable long fileId, @RequestParam String scope,
+        @RequestParam(required = false) Long itemId) {
+        var file = service.downloadFile(customer(user), relabelNo, scope, itemId, fileId);
+        return download(file.content(), file.fileName(), file.contentType());
+    }
     @GetMapping("/{relabelNo}/shipping-label/{fileId}/download")
     @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_RELABEL_LIST + "')")
     public ResponseEntity<byte[]> downloadShippingLabel(@AuthenticationPrincipal AuthenticatedUser user,
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/relabel/controller/RelabelApplicationController.java b/lastleg-service/src/main/java/com/baiyue/lastleg/relabel/controller/RelabelApplicationController.java
index c3cab46c9..9fa946db2 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/relabel/controller/RelabelApplicationController.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/relabel/controller/RelabelApplicationController.java
@@ -134,6 +134,17 @@ public class RelabelApplicationController {
         return ResponseEntity.ok().cacheControl(org.springframework.http.CacheControl.noStore()).header("Content-Disposition", ContentDisposition.inline().filename(file.fileName(), StandardCharsets.UTF_8).build().toString())
             .contentType(org.springframework.http.MediaType.parseMediaType(file.contentType())).contentLength(file.content().length).body(file.content());
     }
+    /** 平台按申请绑定关系读取客户上传的面单。 */
+    @GetMapping("/{relabelNo}/shipping-label/{fileId}/download")
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.RELABEL_ORDER_LIST + "')")
+    public ResponseEntity<byte[]> downloadShippingLabel(@AuthenticationPrincipal AuthenticatedUser user,
+        @PathVariable String relabelNo, @PathVariable long fileId) {
+        requirePlatform(user);
+        var file = service.downloadShippingLabel(service.customerId(relabelNo), relabelNo, fileId);
+        return ResponseEntity.ok().cacheControl(org.springframework.http.CacheControl.noStore())
+            .header("Content-Disposition", ContentDisposition.inline().filename(file.fileName(), StandardCharsets.UTF_8).build().toString())
+            .contentType(org.springframework.http.MediaType.parseMediaType(file.contentType())).contentLength(file.content().length).body(file.content());
+    }
     @GetMapping("/{relabelNo}/completion-photos/{fileId}/download")
     @PreAuthorize("hasAuthority('" + OverseasPermissions.RELABEL_ORDER_LIST + "')")
     public ResponseEntity<byte[]> downloadCompletionPhoto(@AuthenticationPrincipal AuthenticatedUser user,
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/relabel/dto/RelabelResponses.java b/lastleg-service/src/main/java/com/baiyue/lastleg/relabel/dto/RelabelResponses.java
index 9e8d44564..1ba2d252d 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/relabel/dto/RelabelResponses.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/relabel/dto/RelabelResponses.java
@@ -18,7 +18,12 @@ public final class RelabelResponses {
                           String walletErrorMessage, String deliveryMethod, boolean printShippingLabel,
                           String shippingLabelFileId, String shippingLabelFileName, String shippingLabelFileUrl,
                           String fulfillmentStatus, String outboundOrderNo, LocalDateTime customerConfirmedAt,
-                          String reviewChannel, String reviewRemark, LocalDateTime createdAt) {}
+                          String reviewChannel, String reviewRemark, LocalDateTime createdAt,
+                          LocalDateTime reviewedAt, LocalDateTime relabelCompletedAt, LocalDateTime outboundAt,
+                          String productNameZh, String labelRequirement, List<String> operationTypes,
+                          List<String> relatedBusinessOrderNos) {}
+    public record Milestones(LocalDateTime reviewedAt, LocalDateTime relabelCompletedAt,
+                             LocalDateTime outboundAt) {}
     public record Item(Long id, String skuCode, String productImageFileId, String productImageFileName,
                        String productImageUrl, String productNameZh, int totalPackageCount,
                        int notifiedPackageCount, String shipmentNo, String trackingCode,
@@ -38,7 +43,21 @@ public final class RelabelResponses {
                                      String destinationFbaWarehouseName, String skuCode, String productNameZh,
                                      long availablePackages, long version, List<InventoryPosition> positions,
                                      String sourceType, Long returnCartonId, String cartonMark,
-                                     List<SkuItem> skuItems, long relabelledPackages) {}
+                                     List<SkuItem> skuItems, long relabelledPackages, String relabelStatus,
+                                     long relabelledQuantity, long relabelReservedQuantity, Long stockQuantity, String inventoryStatus, String occupiedRelabelNo, List<String> mergedIntoCartonMarks, boolean hasOutbound,
+                                     List<com.baiyue.lastleg.returnreceipt.dto.ReturnInventoryResponses.SkuConversion> skuConversions,
+                                     List<SkuItem> cartonSkuItems, long cartonAvailablePackages) {
+        public InventoryCandidate(Long inventoryBalanceId, Long inboundOrderId, String inboundOrderNo, String inboundCode,
+            String overseasWarehouseId, String overseasWarehouseCode, String overseasWarehouseName,
+            String destinationFbaWarehouseCode, String destinationFbaWarehouseName, String skuCode, String productNameZh,
+            long availablePackages, long version, List<InventoryPosition> positions, String sourceType,
+            Long returnCartonId, String cartonMark, List<SkuItem> skuItems, long relabelledPackages) {
+            this(inventoryBalanceId, inboundOrderId, inboundOrderNo, inboundCode, overseasWarehouseId,
+                overseasWarehouseCode, overseasWarehouseName, destinationFbaWarehouseCode, destinationFbaWarehouseName,
+                skuCode, productNameZh, availablePackages, version, positions, sourceType, returnCartonId, cartonMark,
+                skuItems, relabelledPackages, null, relabelledPackages, 0, null, null, null, List.of(), false, List.of(), List.of(), 0);
+        }
+    }
     public record HistoricalOrder(Long id, String orderNo, String sourceOrderNo, String outboundOrderNo,
                                   String relabelOrderNo, String orderType, String status, Integer packageCount,
                                   LocalDateTime createdAt) {}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/relabel/mapper/RelabelApplicationMapper.java b/lastleg-service/src/main/java/com/baiyue/lastleg/relabel/mapper/RelabelApplicationMapper.java
index 7184b7048..c0cc1f19e 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/relabel/mapper/RelabelApplicationMapper.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/relabel/mapper/RelabelApplicationMapper.java
@@ -1,6 +1,7 @@
 package com.baiyue.lastleg.relabel.mapper;
 
 import com.baomidou.mybatisplus.core.mapper.BaseMapper;
+import com.baiyue.lastleg.relabel.dto.RelabelResponses;
 import com.baiyue.lastleg.relabel.entity.RelabelApplication;
 import org.apache.ibatis.annotations.Mapper;
 import org.apache.ibatis.annotations.Param;
@@ -9,6 +10,34 @@ import org.apache.ibatis.annotations.Update;
 
 @Mapper
 public interface RelabelApplicationMapper extends BaseMapper<RelabelApplication> {
+    // Read existing facts so historical applications receive the same timestamps as new ones.
+    // COMPLETED alone is insufficient: SKU-only work can complete without leaving the warehouse.
+    @Select("""
+        SELECT
+          (SELECT MAX(h.created_at) FROM ll_relabel_status_history h
+           WHERE h.customer_id=a.customer_id AND h.application_id=a.id
+             AND h.from_status='PENDING_REVIEW' AND h.to_status IN ('PENDING_PROCESSING','REJECTED')) AS reviewed_at,
+          CASE WHEN a.status IN ('CUSTOMER_CONFIRM_PENDING','READY_FOR_OUTBOUND','COMPLETED') THEN
+            COALESCE((SELECT MAX(t.submitted_at) FROM ll_relabel_pda_task t
+                      WHERE t.customer_id=a.customer_id AND t.application_id=a.id),
+                     (SELECT MAX(h.created_at) FROM ll_relabel_status_history h
+                      WHERE h.customer_id=a.customer_id AND h.application_id=a.id
+                        AND h.to_status='CUSTOMER_CONFIRM_PENDING'))
+          END AS relabel_completed_at,
+          COALESCE((SELECT MAX(t.completed_at) FROM ll_outbound_pda_task t
+                    JOIN ll_outbound_order o ON o.id=t.outbound_order_id AND o.customer_id=t.customer_id
+                    WHERE o.customer_id=a.customer_id AND o.outbound_no=a.outbound_order_no
+                      AND o.status='OUTBOUNDED' AND t.status='COMPLETED'),
+                   (SELECT MAX(w.outbound_at) FROM ll_warehouse_transfer_order w
+                    WHERE w.customer_id=a.customer_id AND w.relabel_application_id=a.id AND w.relabel_no=a.relabel_no),
+                   (SELECT MAX(h.created_at) FROM ll_relabel_status_history h
+                    WHERE h.customer_id=a.customer_id AND h.application_id=a.id
+                      AND h.from_status='READY_FOR_OUTBOUND' AND h.to_status='COMPLETED')) AS outbound_at
+        FROM ll_relabel_application a WHERE a.customer_id=#{customerId} AND a.id=#{applicationId}
+        """)
+    RelabelResponses.Milestones findMilestones(
+        @Param("customerId") String customerId, @Param("applicationId") Long applicationId);
+
     @Select("SELECT * FROM ll_relabel_application WHERE customer_id=#{customerId} AND relabel_no=#{relabelNo} LIMIT 1")
     RelabelApplication findNo(@Param("customerId") String customerId, @Param("relabelNo") String relabelNo);
 
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/relabel/mapper/RelabelItemMapper.java b/lastleg-service/src/main/java/com/baiyue/lastleg/relabel/mapper/RelabelItemMapper.java
index 871f82830..3ef755bed 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/relabel/mapper/RelabelItemMapper.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/relabel/mapper/RelabelItemMapper.java
@@ -6,6 +6,25 @@ import org.apache.ibatis.annotations.Mapper;
 
 @Mapper
 public interface RelabelItemMapper extends BaseMapper<RelabelItem> {
+    @org.apache.ibatis.annotations.Select("SELECT ri.* FROM ll_relabel_item ri JOIN ll_relabel_application ra ON ra.id=ri.application_id " +
+        "WHERE ri.customer_id=#{customerId} AND ri.return_carton_id=#{cartonId} AND ri.application_id<>#{currentApplicationId} " +
+        "AND ra.status NOT IN ('CANCELLED','REJECTED') AND ra.customer_confirmed_at IS NOT NULL " +
+        "AND EXISTS(SELECT 1 FROM ll_relabel_pda_unit_fact f WHERE f.item_id=ri.id AND f.result='RELABELLED') " +
+        "AND NOT EXISTS(SELECT 1 FROM ll_relabel_item newer JOIN ll_relabel_application na ON na.id=newer.application_id " +
+        "WHERE newer.return_carton_id=ri.return_carton_id AND newer.application_id<>#{currentApplicationId} AND na.status NOT IN ('CANCELLED','REJECTED') " +
+        "AND (COALESCE(newer.source_carton_mark,newer.carton_mark)=COALESCE(ri.source_carton_mark,ri.carton_mark) " +
+        "OR COALESCE(newer.source_carton_mark,newer.carton_mark)=(SELECT c.carton_mark FROM ll_return_inventory_carton c WHERE c.id=#{cartonId})) " +
+        "AND (na.created_at>ra.created_at OR (na.created_at=ra.created_at AND na.id>ra.id))) ORDER BY ri.id")
+    java.util.List<RelabelItem> priorCompletedReturnItems(@org.apache.ibatis.annotations.Param("customerId") String customerId,
+        @org.apache.ibatis.annotations.Param("cartonId") long cartonId,
+        @org.apache.ibatis.annotations.Param("currentApplicationId") long currentApplicationId);
+    @org.apache.ibatis.annotations.Update("UPDATE ll_relabel_item i JOIN ll_relabel_application a ON a.id=i.application_id " +
+        "SET i.return_carton_id=#{targetId},i.carton_mark=#{targetMark} WHERE i.customer_id=#{customerId} " +
+        "AND i.return_carton_id=#{sourceId} AND a.status NOT IN ('CANCELLED','REJECTED') AND a.customer_confirmed_at IS NOT NULL")
+    int moveCompletedReturnCarton(@org.apache.ibatis.annotations.Param("customerId") String customerId,
+        @org.apache.ibatis.annotations.Param("sourceId") long sourceId,
+        @org.apache.ibatis.annotations.Param("targetId") long targetId,
+        @org.apache.ibatis.annotations.Param("targetMark") String targetMark);
     @org.apache.ibatis.annotations.Select("SELECT id FROM ll_inventory_balance WHERE id=#{balanceId} AND customer_id=#{customerId} FOR UPDATE")
     Long lockSourceBalance(@org.apache.ibatis.annotations.Param("customerId") String customerId,
                           @org.apache.ibatis.annotations.Param("balanceId") Long balanceId);
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/relabel/mapper/RelabelPalletMeasurementMapper.java b/lastleg-service/src/main/java/com/baiyue/lastleg/relabel/mapper/RelabelPalletMeasurementMapper.java
new file mode 100644
index 000000000..f2af956b3
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/relabel/mapper/RelabelPalletMeasurementMapper.java
@@ -0,0 +1,43 @@
+package com.baiyue.lastleg.relabel.mapper;
+
+import org.apache.ibatis.annotations.*;
+import java.math.BigDecimal;
+import java.util.List;
+
+@Mapper
+public interface RelabelPalletMeasurementMapper {
+    record Stock(Long id, Long palletId, String palletNo, long packages, long version) {}
+    record Original(Long palletId, String palletNo, int packages, BigDecimal lengthCm,
+                    BigDecimal widthCm, BigDecimal heightCm, BigDecimal grossWeightKg, BigDecimal volumeCbm) {}
+    record CartonSpec(Long palletId, BigDecimal lengthCm, BigDecimal widthCm, BigDecimal heightCm,
+                      BigDecimal grossWeightKg, long cartons) {}
+    record Carton(Long id, String cartonMark, String customerCartonMark, Long palletId, String palletCode,
+                  BigDecimal lengthCm, BigDecimal widthCm, BigDecimal heightCm, BigDecimal grossWeightKg) {}
+    @Select("SELECT c.id,c.carton_mark cartonMark,c.customer_carton_mark customerCartonMark,p.warehouse_pallet_id palletId,p.pallet_no palletCode," +
+        "c.length_cm lengthCm,c.width_cm widthCm,c.height_cm heightCm,c.gross_weight_kg grossWeightKg " +
+        "FROM ll_warehouse_transfer_carton c JOIN ll_warehouse_transfer_pallet p " +
+        "ON p.id=c.transfer_pallet_id AND p.customer_id=c.customer_id AND p.transfer_order_id=c.transfer_order_id " +
+        "WHERE c.customer_id=#{customerId} AND c.transfer_order_id=#{transferId} AND c.status='COUNTED' AND p.status='COMPLETED' ORDER BY c.id")
+    List<Carton> cartons(@Param("customerId") String customerId, @Param("transferId") Long transferId);
+    @Select("SELECT p.warehouse_pallet_id palletId,c.length_cm lengthCm,c.width_cm widthCm,c.height_cm heightCm," +
+        "c.gross_weight_kg grossWeightKg,COUNT(*) cartons FROM ll_warehouse_transfer_carton c " +
+        "JOIN ll_warehouse_transfer_pallet p ON p.id=c.transfer_pallet_id AND p.customer_id=c.customer_id AND p.transfer_order_id=c.transfer_order_id " +
+        "WHERE c.customer_id=#{customerId} AND c.transfer_order_id=#{transferId} AND c.status='COUNTED' AND p.status='COMPLETED' " +
+        "GROUP BY p.warehouse_pallet_id,c.length_cm,c.width_cm,c.height_cm,c.gross_weight_kg " +
+        "ORDER BY p.warehouse_pallet_id,c.length_cm,c.width_cm,c.height_cm,c.gross_weight_kg")
+    List<CartonSpec> cartonSpecs(@Param("customerId") String customerId, @Param("transferId") Long transferId);
+    @Select("SELECT id FROM ll_warehouse_transfer_order WHERE customer_id=#{customerId} AND relabel_no=#{relabelNo}")
+    Long transfer(@Param("customerId") String customerId, @Param("relabelNo") String relabelNo);
+    @Select("SELECT id,pallet_id palletId,pallet_no palletNo," +
+        "COALESCE(available_packages,0)+COALESCE(hold_packages,0)+COALESCE(allocated_packages,0)+COALESCE(picked_packages,0)+COALESCE(receiving_packages,0) packages,version " +
+        "FROM ll_inventory_position WHERE customer_id=#{customerId} AND overseas_warehouse_id=#{warehouseId} ORDER BY id")
+    List<Stock> stock(@Param("customerId") String customerId, @Param("warehouseId") String warehouseId);
+    @Select("SELECT id FROM ll_inventory_position WHERE customer_id=#{customerId} AND overseas_warehouse_id=#{warehouseId} AND pallet_no=#{palletCode} ORDER BY id FOR UPDATE")
+    List<Long> lockStock(@Param("customerId") String customerId, @Param("warehouseId") String warehouseId, @Param("palletCode") String palletCode);
+    @Select("SELECT warehouse_pallet_id palletId,pallet_no palletNo,carton_count packages,length_cm lengthCm,width_cm widthCm,height_cm heightCm,gross_weight_kg grossWeightKg,volume_cbm volumeCbm " +
+        "FROM ll_warehouse_transfer_pallet WHERE customer_id=#{customerId} AND transfer_order_id=#{transferId} AND status='COMPLETED'")
+    List<Original> originals(@Param("customerId") String customerId, @Param("transferId") Long transferId);
+    @Select("SELECT COUNT(*) FROM ll_inventory_ledger WHERE customer_id=#{customerId} AND pallet_id=#{palletId} " +
+        "AND business_type IN ('RELABEL_PALLET_DISASSEMBLE','PALLET_ASSEMBLE','PALLET_DISASSEMBLE','PALLET_SWAP','PALLET_UNBIND')")
+    int movements(@Param("customerId") String customerId, @Param("palletId") Long palletId);
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/relabel/pda/controller/PdaRelabelController.java b/lastleg-service/src/main/java/com/baiyue/lastleg/relabel/pda/controller/PdaRelabelController.java
index 0e4405b67..a15335082 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/relabel/pda/controller/PdaRelabelController.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/relabel/pda/controller/PdaRelabelController.java
@@ -86,6 +86,13 @@ public class PdaRelabelController {
             identity.overseasWarehouseId(), relabelNo, request));
     }
 
+    @PostMapping("/{relabelNo}/return-cartons/pack")
+    public ApiResponse<PdaRelabelResponses.Detail> packReturn(@AuthenticationPrincipal AuthenticatedUser user,
+        @PathVariable String relabelNo, @Valid @RequestBody com.baiyue.lastleg.returnreceipt.dto.ReturnInventoryRequests.BoxMerge request) {
+        Identity identity = identity(user);
+        return ApiResponse.success(service.packReturn(identity.operatorKey(), identity.operatorName(), identity.overseasWarehouseId(), relabelNo, request));
+    }
+
     @PostMapping("/{relabelNo}/return-skus/complete-total")
     public ApiResponse<PdaRelabelResponses.Detail> completeReturnSkuTotal(@AuthenticationPrincipal AuthenticatedUser user,
         @PathVariable String relabelNo, @Valid @RequestBody PdaRelabelRequests.BulkSkuTotal request) {
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/relabel/pda/dto/PdaRelabelRequests.java b/lastleg-service/src/main/java/com/baiyue/lastleg/relabel/pda/dto/PdaRelabelRequests.java
index a44f212f0..b38d7d556 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/relabel/pda/dto/PdaRelabelRequests.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/relabel/pda/dto/PdaRelabelRequests.java
@@ -17,7 +17,13 @@ public final class PdaRelabelRequests {
     public record SkuScan(@NotNull @Positive Long itemId, @Min(0) int skuIndex,
                           @NotBlank @Size(max = 255) String oldSku,
                           @NotNull @Min(0) Integer expectedVersion,
-                          @NotBlank @Size(max = 255) String idempotencyKey) { }
+                          @NotBlank @Size(max = 255) String idempotencyKey,
+                          @Size(max = 128) String cartonMark,
+                          @Size(max = 128) String newSkuCode, @Positive Integer quantity) {
+        public SkuScan(Long itemId, int skuIndex, String oldSku, Integer expectedVersion, String idempotencyKey) {
+            this(itemId, skuIndex, oldSku, expectedVersion, idempotencyKey, null, null, null);
+        }
+    }
 
     public record CartonScan(@NotBlank @Size(max = 255) String cartonMark,
                              @NotNull @Min(0) Integer expectedVersion,
@@ -40,7 +46,13 @@ public final class PdaRelabelRequests {
     public record BulkSku(@NotNull @Positive Long itemId,
                           @Positive int quantity,
                           @NotNull @Min(0) Integer expectedVersion,
-                          @NotBlank @Size(max = 255) String idempotencyKey) { }
+                          @NotBlank @Size(max = 255) String idempotencyKey,
+                          @NotBlank @Size(max = 128) String cartonMark,
+                          @NotBlank @Size(max = 128) String skuCode) {
+        public BulkSku(Long itemId, int quantity, Integer expectedVersion, String idempotencyKey) {
+            this(itemId, quantity, expectedVersion, idempotencyKey, null, null);
+        }
+    }
 
     public record BulkSkuTotal(@NotBlank @Size(max = 255) String skuCode,
                                @Positive int quantity,
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/relabel/pda/dto/PdaRelabelResponses.java b/lastleg-service/src/main/java/com/baiyue/lastleg/relabel/pda/dto/PdaRelabelResponses.java
index 02afc5ff0..133064335 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/relabel/pda/dto/PdaRelabelResponses.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/relabel/pda/dto/PdaRelabelResponses.java
@@ -20,7 +20,20 @@ public final class PdaRelabelResponses {
                          String operatorName, String reviewerName, List<Long> completionPhotoFileIds,
                          String completionRemark, String reviewDecision, String reviewRemark,
                          LocalDateTime claimedAt, LocalDateTime submittedAt, LocalDateTime reviewedAt,
-                         List<Item> items, List<UnitFact> unitFacts, List<History> history) { }
+                         List<Item> items, List<UnitFact> unitFacts, List<History> history, String deliveryMethod,
+                         boolean requiresPalletBinding) {
+        public Detail(String relabelNo, String customerOrderNo, LocalDateTime labelDeadline, String contactName,
+            String contactPhone, String applicationStatus, String operationType, String taskStatus, int expectedPackages,
+            int relabelledPackages, int skippedPackages, int exceptionPackages, int version, String operatorName,
+            String reviewerName, List<Long> completionPhotoFileIds, String completionRemark, String reviewDecision,
+            String reviewRemark, LocalDateTime claimedAt, LocalDateTime submittedAt, LocalDateTime reviewedAt,
+            List<Item> items, List<UnitFact> unitFacts, List<History> history) {
+            this(relabelNo, customerOrderNo, labelDeadline, contactName, contactPhone, applicationStatus, operationType,
+                taskStatus, expectedPackages, relabelledPackages, skippedPackages, exceptionPackages, version,
+                operatorName, reviewerName, completionPhotoFileIds, completionRemark, reviewDecision, reviewRemark,
+                claimedAt, submittedAt, reviewedAt, items, unitFacts, history, null, false);
+        }
+    }
 
     public record Item(Long itemId, String skuCode, String productNameZh, String shipmentNo,
                        String trackingCode, String newSkuCode, String labelRequirement,
@@ -29,7 +42,29 @@ public final class PdaRelabelResponses {
                        List<SkuItem> skuItems,
                        int expectedPackages, int relabelledPackages, int skippedPackages,
                        int exceptionPackages, int cartonProcessedPackages, int skuProcessedPackages,
-                       String destinationFbaWarehouseCode) { }
+                       String destinationFbaWarehouseCode, Long returnCartonId, long returnQuantity,
+                       String sourcePalletCode, String sourcePalletBasis) {
+        public Item(Long itemId, String skuCode, String productNameZh, String shipmentNo, String trackingCode,
+            String newSkuCode, String labelRequirement, String relabelFileId, String relabelFileName, String relabelFileUrl,
+            String cartonMark, String fbaCartonMark, String operationType, List<SkuItem> skuItems, int expectedPackages,
+            int relabelledPackages, int skippedPackages, int exceptionPackages, int cartonProcessedPackages,
+            int skuProcessedPackages, String destinationFbaWarehouseCode, Long returnCartonId, long returnQuantity) {
+            this(itemId, skuCode, productNameZh, shipmentNo, trackingCode, newSkuCode, labelRequirement,
+                relabelFileId, relabelFileName, relabelFileUrl, cartonMark, fbaCartonMark, operationType, skuItems,
+                expectedPackages, relabelledPackages, skippedPackages, exceptionPackages, cartonProcessedPackages,
+                skuProcessedPackages, destinationFbaWarehouseCode, returnCartonId, returnQuantity, null, null);
+        }
+        public Item(Long itemId, String skuCode, String productNameZh, String shipmentNo, String trackingCode,
+            String newSkuCode, String labelRequirement, String relabelFileId, String relabelFileName, String relabelFileUrl,
+            String cartonMark, String fbaCartonMark, String operationType, List<SkuItem> skuItems, int expectedPackages,
+            int relabelledPackages, int skippedPackages, int exceptionPackages, int cartonProcessedPackages,
+            int skuProcessedPackages, String destinationFbaWarehouseCode) {
+            this(itemId, skuCode, productNameZh, shipmentNo, trackingCode, newSkuCode, labelRequirement,
+                relabelFileId, relabelFileName, relabelFileUrl, cartonMark, fbaCartonMark, operationType, skuItems,
+                expectedPackages, relabelledPackages, skippedPackages, exceptionPackages, cartonProcessedPackages,
+                skuProcessedPackages, destinationFbaWarehouseCode, null, 0);
+        }
+    }
     public record SkuItem(String skuCode, String newSkuCode, int quantity, String remark) { }
 
     public record UnitFact(Long factId, Long itemId, String oldLabel, String newLabel,
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/relabel/pda/service/PdaRelabelService.java b/lastleg-service/src/main/java/com/baiyue/lastleg/relabel/pda/service/PdaRelabelService.java
index 6e18f077a..272ac6222 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/relabel/pda/service/PdaRelabelService.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/relabel/pda/service/PdaRelabelService.java
@@ -52,7 +52,35 @@ import java.util.stream.Collectors;
 
 @Service
 public class PdaRelabelService {
+    @Resource private com.baiyue.lastleg.relabel.service.ReturnSkuConversionService skuConversions;
+    @Resource private com.baiyue.lastleg.relabel.service.ReturnRelabelPackingService returnPacking;
+
+    @Transactional
+    public PdaRelabelResponses.Detail packReturn(String operatorKey, String operatorName, long warehouseId,
+        String relabelNo, com.baiyue.lastleg.returnreceipt.dto.ReturnInventoryRequests.BoxMerge request) {
+        UnitCommand command = new UnitCommand(relabelNo, "RETURN_PACK", request);
+        var replay = replay(operatorKey, warehouseId, relabelNo, "RETURN_PACK", request.idempotencyKey(), command);
+        if (replay != null) return replay;
+        var app = requireApplication(relabelNo, warehouseId, true);
+        var task = requireOwnedTask(app, operatorKey, true);
+        var selected = itemList(app).stream().filter(i -> i.getReturnCartonId() != null
+            && Set.of("RETURN_BULK_SKU_LABEL", "SKU_LABEL").contains(operationType(i))).toList();
+        if (selected.isEmpty() || selected.size() != itemList(app).size()) throw conflict("仅退货按件换标任务可使用此合箱操作");
+        var facts = factList(task);
+        for (var item : selected) if (quantity(facts.stream().filter(f -> item.getId().equals(f.getItemId())).toList(), "RELABELLED")
+            != value(item.getNotifiedPackageCount())) throw conflict("请先完成每个来源包裹/箱的换标数量登记，再合箱");
+        var sourceDeductions = returnPacking.deductions(selected);
+        var packed = returnPacking.pack(new com.baiyue.lastleg.pda.security.PdaWarehouseIdentity(operatorKey, operatorName, warehouseId), app, selected, request);
+        updateTask(task, task.getVersion());
+        insertHistory(task, "RETURN_PACK", PROCESSING, PROCESSING, operatorKey, operatorName,
+            Map.of("cartonMark", packed.cartonMark(), "quantity", packed.totalQuantity(), "label", packed.label(),
+                "round", mixedRound(task), "sourceCartonMarks", request.sourceCartonMarks(), "sourceDeductions", sourceDeductions));
+        var result = detail(app, task);
+        saveOperation(task, operatorKey, "RETURN_PACK", request.idempotencyKey(), command, result);
+        return result;
+    }
     @Resource private com.baiyue.lastleg.relabel.service.RelabelBindingGuard bindingGuard;
+    @Resource private com.baiyue.lastleg.relabel.service.RelabelPalletMeasurementService palletMeasurements;
     public static final String AVAILABLE = "AVAILABLE";
     public static final String PROCESSING = "PROCESSING";
     public static final String WAIT_REVIEW = "WAIT_REVIEW";
@@ -66,6 +94,7 @@ public class PdaRelabelService {
     @Resource private PdaRelabelTaskMapper tasks;
     @Resource private PdaRelabelUnitFactMapper unitFacts;
     @Resource private ReturnInventoryCartonMapper returnCartons;
+    @Resource private com.baiyue.lastleg.inventory.mapper.InventoryPositionMapper sourcePositions;
     @Resource private PdaRelabelOperationMapper operations;
     @Resource private PdaRelabelHistoryMapper histories;
     @Resource private RelabelApplicationService applicationService;
@@ -230,11 +259,16 @@ public class PdaRelabelService {
         var task = requireOwnedTask(app, operatorKey, true);
         requireVersion(task, request.expectedVersion());
         var item = requireItem(app, request.itemId());
+        if (item.getReturnCartonId() != null && !Objects.equals(item.getCartonMark(), trim(request.cartonMark())))
+            throw conflict("请扫描当前来源包裹/箱号后再扫描 SKU");
         if (!Set.of("SKU_LABEL", "CARTON_AND_SKU").contains(operationType(item))) throw conflict("该箱没有SKU换标任务");
         if (value(item.getNotifiedPackageCount()) != 1) throw conflict("SKU逐条作业要求每个仓库唛头独立一箱");
         var skus = readSkuItems(item.getSkuRelabelItemsJson());
         if (request.skuIndex() < 0 || request.skuIndex() >= skus.size()) throw conflict("SKU明细不存在");
         var sku = skus.get(request.skuIndex());
+        if (item.getReturnCartonId() != null && (!Objects.equals(sku.newSkuCode(), trim(request.newSkuCode()))
+            || !Objects.equals(sku.quantity(), request.quantity())))
+            throw conflict("新 SKU 和件数必须与已批准的来源箱明细一致");
         if (!Objects.equals(sku.skuCode(), request.oldSku().trim()) || !StringUtils.hasText(sku.newSkuCode()) || sku.quantity() <= 0)
             throw conflict("旧SKU或绑定的新标签、数量不正确");
         if (factList(task).stream().anyMatch(fact -> item.getId().equals(fact.getItemId()))
@@ -275,6 +309,9 @@ public class PdaRelabelService {
         requireVersion(task, request.expectedVersion());
         RelabelItem item = requireItem(application, request.itemId());
         if (!"RETURN_BULK_SKU_LABEL".equals(operationType(item))) throw conflict("当前明细不是退货按件贴标任务");
+        if (!Objects.equals(item.getCartonMark(), trim(request.cartonMark()))
+            || !Objects.toString(item.getSkuCode(), "").equalsIgnoreCase(Objects.toString(trim(request.skuCode()), "")))
+            throw conflict("请扫描当前来源包裹/箱号和对应 SKU，不能登记其他来源");
         int completed = quantity(factList(task).stream().filter(fact -> item.getId().equals(fact.getItemId())).toList(), "RELABELLED");
         int remaining = value(item.getNotifiedPackageCount()) - completed;
         if (request.quantity() > remaining) throw conflict("本次完成数量超过该 SKU 剩余贴标数量");
@@ -309,6 +346,8 @@ public class PdaRelabelService {
             .filter(item -> skuCode.equalsIgnoreCase(Objects.toString(item.getSkuCode(), "").trim()))
             .toList();
         if (skuItems.isEmpty()) throw notFound("当前换标单没有该退货 SKU");
+        if (skuItems.stream().map(RelabelItem::getCartonMark).distinct().count() != 1)
+            throw conflict("同 SKU 来自多个包裹/箱，请逐来源扫码登记，不能自动分配");
         List<PdaRelabelUnitFact> existingFacts = factList(task);
         Map<Long, Integer> completedByItem = new HashMap<>();
         for (RelabelItem item : skuItems) {
@@ -416,6 +455,7 @@ public class PdaRelabelService {
         PdaRelabelTask task = requireOwnedTask(application, operatorKey, true);
         requireVersion(task, request.expectedVersion());
         if (!request.manualCompletion()) bindingGuard.requireBound(application);
+        palletMeasurements.requireMeasured(application);
         List<RelabelItem> detailItems = itemList(application);
         List<PdaRelabelUnitFact> facts = factList(task);
         boolean incomplete = detailItems.stream().anyMatch(item -> processedQuantity(facts, item.getId()) < value(item.getNotifiedPackageCount()));
@@ -463,13 +503,16 @@ public class PdaRelabelService {
                         StringUtils.hasText(order.getWarehouseRemark()) ? order.getWarehouseRemark() + "\n" + note : note));
             }
         }
+        skuConversions.apply(application, detailItems, factList(task), mixedRound(task), histories.selectList(new LambdaQueryWrapper<PdaRelabelHistory>()
+            .eq(PdaRelabelHistory::getTaskId, task.getId()).eq(PdaRelabelHistory::getCustomerId, application.getCustomerId())
+            .eq(PdaRelabelHistory::getAction, "SKU_SCAN")));
         String before = task.getStatus();
         task.setStatus(WAIT_REVIEW); task.setCompletionPhotoFileIds(write(photoIds));
         task.setCompletionRemark(trim(request.remark())); task.setSubmittedAt(LocalDateTime.now());
         updateTask(task, request.expectedVersion());
         insertHistory(task, "COMPLETE", before, WAIT_REVIEW, operatorKey, operatorName,
             Map.of("photoFileIds", photoIds, "remark", Objects.toString(trim(request.remark()), ""),
-                "manualCompletion", request.manualCompletion()));
+                "manualCompletion", request.manualCompletion(), "roundKey", mixedRound(task)));
         applicationService.changeStatus(application.getCustomerId(), relabelNo, operatorKey,
             new RelabelRequests.ChangeStatus(RelabelApplicationService.CUSTOMER_CONFIRM_PENDING, request.remark()));
         applicationService.settlePdaCompletion(application.getCustomerId(), relabelNo, operatorKey);
@@ -512,6 +555,7 @@ public class PdaRelabelService {
         if (!WAIT_REVIEW.equals(task.getStatus())) throw conflict("Relabel task is not awaiting review");
         requireVersion(task, request.expectedVersion());
         // Preserve the previous round before freeing the active-label uniqueness constraint.
+        skuConversions.reverse(application);
         List<PdaRelabelUnitFact> previousFacts = factList(task);
         insertHistory(task, "REWORK_ARCHIVE", WAIT_REVIEW, AVAILABLE, operatorKey, operatorName,
             Map.of("facts", previousFacts, "photoFileIds", Objects.toString(task.getCompletionPhotoFileIds(), "[]"),
@@ -574,6 +618,9 @@ public class PdaRelabelService {
             throw conflict("Relabel item already has all required package facts");
         }
         String normalizedOldLabel = trim(oldLabel);
+        // A merged return carton can carry several independent SKU task items.
+        // Product-label facts are unique by item; old_label's global key is for physical carton-label scans.
+        if (item.getReturnCartonId() != null && "SKU_LABEL".equals(operationType(item))) normalizedOldLabel = null;
         if (normalizedOldLabel != null && unitFacts.findOldLabel(normalizedOldLabel) != null) {
             throw conflict("Old label was already processed by another relabel unit");
         }
@@ -746,7 +793,8 @@ public class PdaRelabelService {
                 quantity(itemFacts, "EXCEPTION"),
                 count(itemFacts, "RELABELLED") + (itemFacts.isEmpty() && mixedStageDone(task, item.getId(), "CARTON") ? 1 : 0),
                 count(itemFacts, "RELABELLED") + (itemFacts.isEmpty() && mixedStageDone(task, item.getId(), "SKU") ? 1 : 0),
-                item.getDestinationFbaWarehouseCode());
+                item.getDestinationFbaWarehouseCode(), item.getReturnCartonId(),
+                returnQuantity(item), sourcePalletCode(item), item.getReturnCartonId() != null ? "RETURN_CARTON" : "INVENTORY_REFERENCE");
         }).toList();
         List<PdaRelabelResponses.UnitFact> factResponses = facts.stream().map(fact ->
             new PdaRelabelResponses.UnitFact(fact.getId(), fact.getItemId(), fact.getOldLabel(), fact.getNewLabel(),
@@ -768,7 +816,15 @@ public class PdaRelabelService {
             task == null ? null : task.getCompletionRemark(), task == null ? null : task.getReviewDecision(),
             task == null ? null : task.getReviewRemark(), task == null ? null : task.getClaimedAt(),
             task == null ? null : task.getSubmittedAt(), task == null ? null : task.getReviewedAt(),
-            itemResponses, factResponses, historyResponses);
+            itemResponses, factResponses, historyResponses, application.getDeliveryMethod(),
+            detailItems.stream().anyMatch(item -> {
+                String operation = operationType(item);
+                if (item.getReturnCartonId() == null)
+                    return Set.of("CARTON_LABEL", "CARTON_AND_SKU", "RETURN_BULK_SKU_LABEL").contains(operation);
+                if ("SKU_LABEL".equals(operation) && application.getDeliveryMethod() == null) return false;
+                return !"EXPRESS".equals(application.getDeliveryMethod()) && !"PICKUP".equals(application.getDeliveryMethod())
+                    && !"AMAZON_PICKUP".equals(application.getDeliveryMethod()) && !"CUSTOMER_PICKUP".equals(application.getDeliveryMethod());
+            }));
     }
 
     private String effectiveTaskStatus(RelabelApplication application, PdaRelabelTask task) {
@@ -841,6 +897,20 @@ public class PdaRelabelService {
                 List.class, PdaRelabelResponses.SkuItem.class));
         } catch (JsonProcessingException exception) { throw new IllegalStateException("Cannot read relabel SKU details", exception); }
     }
+    private String sourcePalletCode(RelabelItem item) {
+        if (item.getReturnCartonId() != null) {
+            var carton = returnCartons == null ? null : returnCartons.selectById(item.getReturnCartonId());
+            return carton != null && Objects.equals(item.getCustomerId(), carton.getCustomerId()) ? carton.getPalletCode() : null;
+        }
+        var position = sourcePositions == null || item.getSourceInventoryPositionId() == null ? null
+            : sourcePositions.findTenantPosition(item.getCustomerId(), item.getSourceInventoryPositionId());
+        return position != null ? position.getPalletNo() : null;
+    }
+
+    private long returnQuantity(RelabelItem item) {
+        var carton = item.getReturnCartonId() == null ? null : returnCartons.selectById(item.getReturnCartonId());
+        return carton == null || carton.getTotalQuantity() == null ? 0L : carton.getTotalQuantity();
+    }
     private static String operationType(RelabelItem item) {
         return StringUtils.hasText(item.getOperationType()) ? item.getOperationType() : "CARTON_LABEL";
     }
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/relabel/repository/RelabelStatusRepository.java b/lastleg-service/src/main/java/com/baiyue/lastleg/relabel/repository/RelabelStatusRepository.java
new file mode 100644
index 000000000..61587d82f
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/relabel/repository/RelabelStatusRepository.java
@@ -0,0 +1,43 @@
+package com.baiyue.lastleg.relabel.repository;
+
+import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
+import com.baiyue.lastleg.entity.LastlegOrder;
+import com.baiyue.lastleg.mapper.LastlegOrderMapper;
+import com.baiyue.lastleg.relabel.entity.RelabelApplication;
+import com.baiyue.lastleg.relabel.mapper.RelabelApplicationMapper;
+import com.baiyue.lastleg.returnreceipt.entity.ReturnOrder;
+import com.baiyue.lastleg.returnreceipt.mapper.ReturnOrderMapper;
+import com.baiyue.lastleg.returnreceipt.mapper.ReturnInventoryCartonMapper;
+import jakarta.annotation.Resource;
+import org.springframework.stereotype.Repository;
+import org.springframework.util.StringUtils;
+import java.util.List;
+
+/** 封装换标状态命令的客户隔离查询与持久化。 */
+@Repository
+public class RelabelStatusRepository {
+    @Resource private RelabelApplicationMapper applications;
+    @Resource private LastlegOrderMapper orders;
+    @Resource private ReturnOrderMapper returnOrders;
+    @Resource private ReturnInventoryCartonMapper returnCartons;
+
+    /** 锁定申请，平台入口从单据解析客户。 */
+    public RelabelApplication lockApplication(String customer, String no) {
+        return StringUtils.hasText(customer) ? applications.lockNo(customer, no) : applications.lockAnyByRelabelNo(no);
+    }
+    /** 读取申请主订单。 */
+    public LastlegOrder findPrimaryOrder(Long id) { return orders.selectById(id); }
+    /** 保存申请状态及资金状态。 */
+    public void saveApplication(RelabelApplication application) { applications.updateById(application); }
+    /** 保存关联订单状态。 */
+    public void saveOrder(LastlegOrder order) { orders.updateById(order); }
+    /** 读取同一客户下关联的退货单。 */
+    public List<ReturnOrder> linkedReturnOrders(String customer, Long id) {
+        return returnOrders.selectList(new LambdaQueryWrapper<ReturnOrder>()
+            .eq(ReturnOrder::getRelabelApplicationId, id).eq(ReturnOrder::getCustomerId, customer));
+    }
+    /** 保存退货单换标状态。 */
+    public void saveReturnOrder(ReturnOrder order) { returnOrders.updateById(order); }
+    /** 核对退货箱实际已换标数量。 */
+    public long relabelledQuantity(Long id) { return returnCartons.totalRelabelledQuantity(id); }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/relabel/service/RelabelApplicationService.java b/lastleg-service/src/main/java/com/baiyue/lastleg/relabel/service/RelabelApplicationService.java
index 4ad45ee05..e0cab9da6 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/relabel/service/RelabelApplicationService.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/relabel/service/RelabelApplicationService.java
@@ -78,9 +78,11 @@ public class RelabelApplicationService implements WalletResultHandler {
     public static final String READY_FOR_OUTBOUND = "READY_FOR_OUTBOUND";
     private static final Set<String> STATUSES = Set.of(PENDING_REVIEW, PENDING_PROCESSING, "PROCESSING", CUSTOMER_CONFIRM_PENDING,
         READY_FOR_OUTBOUND, "COMPLETED", "REJECTED", "CANCELLED");
-    private static final Set<String> DELIVERY_METHODS = Set.of("TRUCK", "EXPRESS", "TRUCK_PICKUP", "EXPRESS_PICKUP", "PICKUP");
+    private static final Set<String> DELIVERY_METHODS = Set.of("TRUCK", "EXPRESS", "AMAZON_PICKUP", "CUSTOMER_PICKUP", "PICKUP");
 
+    @Resource private com.baiyue.lastleg.service.CompactBusinessNumberService compactNumbers;
     @Resource private RelabelApplicationMapper applications;
+    @Resource private com.baiyue.lastleg.relabel.repository.RelabelStatusRepository statusRepository;
     @Resource private RelabelItemMapper items;
     @Resource private RelabelStatusHistoryMapper histories;
     @Resource private LastlegOrderMapper orders;
@@ -93,7 +95,11 @@ public class RelabelApplicationService implements WalletResultHandler {
     @Resource private InventoryPositionMapper inventoryPositions;
     @Resource private ReturnInventoryCartonMapper returnCartons;
     @Resource private ReturnInventoryCartonItemMapper returnCartonItems;
+    @Resource private com.baiyue.lastleg.relabel.service.ReturnSkuConversionService skuConversions;
+    @Resource private RelabelBindingGuard bindingGuard;
+    @Resource private com.baiyue.lastleg.returnreceipt.mapper.ReturnSkuConversionMapper skuConversionRows;
     @Resource private ReturnOrderMapper returnOrders;
+    @Resource private com.baiyue.lastleg.returnreceipt.mapper.ReturnPackingTraceMapper returnPackingTraces;
     @Resource private RelabelDocumentFileGateway documentFiles;
     @Resource private PdaRelabelTaskMapper pdaTasks;
     @Resource private RelabelPhotoFileGateway photoFiles;
@@ -101,6 +107,8 @@ public class RelabelApplicationService implements WalletResultHandler {
     @Resource private OutboundPalletItemMapper outboundItems;
     @Resource private OutboundPdaTaskMapper outboundTasks;
     @Resource private com.baiyue.lastleg.delivery.mapper.DeliveryOrderMapper deliveryOrders;
+    @Resource private com.baiyue.lastleg.fleet.customer.FleetCustomerDirectory customerDirectory;
+    @Resource private com.baiyue.lastleg.fleet.driver.FleetWarehouseDirectory warehouseDirectory;
     @Resource private OverseasFeeSourceService feeSources;
     @Resource private WarehouseTransferOrderMapper warehouseTransfers;
     @Resource private com.baiyue.lastleg.transfer.service.WarehouseTransferRelabelCompletionService transferRelabelCompletion;
@@ -250,10 +258,13 @@ public class RelabelApplicationService implements WalletResultHandler {
             .gt(InventoryBalance::getAvailablePackages, 0)
             .like(StringUtils.hasText(inboundCode), InventoryBalance::getInboundCode, trim(inboundCode))
             .orderByDesc(InventoryBalance::getUpdatedAt));
-        List<RelabelResponses.InventoryCandidate> result = new java.util.ArrayList<>(balances.stream().map(balance -> {
-            List<RelabelResponses.InventoryPosition> positions = inventoryPositions.listBalance(customerId, balance.getId())
+        Map<Long, List<InventoryPosition>> positionsByBalance = balances.isEmpty() ? Map.of()
+            : inventoryPositions.listBalances(customerId, balances.stream().map(InventoryBalance::getId).toList())
                 .stream().filter(position -> value(position.getAvailablePackages()) > 0)
-                .map(position -> new RelabelResponses.InventoryPosition(position.getId(), position.getPalletNo(),
+                .collect(Collectors.groupingBy(InventoryPosition::getBalanceId, LinkedHashMap::new, Collectors.toList()));
+        List<RelabelResponses.InventoryCandidate> result = new java.util.ArrayList<>(balances.stream().map(balance -> {
+            List<RelabelResponses.InventoryPosition> positions = positionsByBalance.getOrDefault(balance.getId(), List.of())
+                .stream().map(position -> new RelabelResponses.InventoryPosition(position.getId(), position.getPalletNo(),
                     position.getBatchNo(), position.getWarehouseLocationCode(), value(position.getAvailablePackages())))
                 .toList();
             long available = positions.stream().mapToLong(RelabelResponses.InventoryPosition::availablePackages).sum();
@@ -264,30 +275,49 @@ public class RelabelApplicationService implements WalletResultHandler {
                 balance.getProductNameZh(), available, value(balance.getVersion()), positions,
                 "INBOUND", null, null, List.of(), 0);
         }).filter(candidate -> candidate.availablePackages() > 0).toList());
-        for (ReturnInventoryCarton carton : returnCartons.findAvailable(customerId, operationWarehouseId.trim())) {
+        for (ReturnInventoryCarton carton : returnCartons.findRelabelCandidates(customerId, operationWarehouseId.trim())) {
             String keyword = trim(inboundCode);
             if (StringUtils.hasText(keyword)
                 && !containsIgnoreCase(carton.getCartonMark(), keyword)
                 && !containsIgnoreCase(carton.getSourceReturnNo(), keyword)) continue;
-            List<RelabelResponses.SkuItem> cartonSkus = returnCartonItems.listCarton(carton.getId()).stream()
+            var cartonLines = returnCartonItems.listCarton(carton.getId());
+            String productNames = cartonLines.stream().filter(item -> value(item.getQuantity()) > 0)
+                .map(item -> trim(item.getProductNameZh())).filter(StringUtils::hasText).distinct()
+                .collect(Collectors.joining("、"));
+            List<RelabelResponses.SkuItem> cartonSkus = cartonLines.stream()
                 .filter(item -> value(item.getQuantity()) > 0)
                 .map(item -> {
-                    long used = returnCartons.relabelledQuantity(carton.getId(), item.getSkuCode());
-                    long remaining = value(item.getQuantity()) - used - value(item.getPackingReservedQuantity());
+                    long remaining = "AVAILABLE".equals(carton.getStatus())
+                        ? remainingRelabelQuantity(carton.getId(), item) : 0;
                     return new RelabelResponses.SkuItem(item.getSkuCode(), null,
                         Math.toIntExact(Math.max(remaining, 0)), null);
-                }).filter(item -> item.quantity() > 0).toList();
-            if (cartonSkus.isEmpty()) continue;
+                }).filter(item -> !"AVAILABLE".equals(carton.getStatus()) || item.quantity() > 0).toList();
+            List<RelabelResponses.SkuItem> physicalSkus = cartonLines.stream()
+                .filter(line -> value(line.getQuantity()) > 0)
+                .map(line -> new RelabelResponses.SkuItem(line.getSkuCode(), null, Math.toIntExact(value(line.getQuantity())), null)).toList();
+            long cartonAvailable = "AVAILABLE".equals(carton.getStatus()) && carton.getRelabelApplicationId() == null
+                && cartonLines.stream().noneMatch(line -> value(line.getPackingReservedQuantity()) > 0)
+                && !physicalSkus.isEmpty() ? 1 : 0;
+            if (cartonSkus.isEmpty() && cartonAvailable == 0 && !java.util.Set.of("MERGED", "OUTBOUNDED").contains(carton.getStatus())) continue;
             String skuCodes = cartonSkus.stream().map(RelabelResponses.SkuItem::skuCode)
                 .collect(Collectors.joining(","));
             long availablePackages = cartonSkus.stream().mapToLong(RelabelResponses.SkuItem::quantity).sum();
-            if (availablePackages <= 0) continue;
-            long relabelledPackages = carton.getTotalQuantity() == null ? 0
-                : Math.max(0, carton.getTotalQuantity() - availablePackages);
+            long relabelledPackages = Math.max(returnCartons.totalRelabelledQuantity(carton.getId()),
+                cartonLines.stream().mapToLong(line -> value(line.getRelabelledQuantity())
+                    + returnCartons.completedSkuQuantity(carton.getId(), line.getSkuCode())).sum());
+            long reserved = returnCartons.relabelReservedQuantity(carton.getId());
+            List<String> mergedCartonMarks = StringUtils.hasText(carton.getSourceReturnNo()) ? List.of()
+                : returnPackingTraces.listCartonHistory(customerId, carton.getCartonMark()).stream()
+                    .filter(history -> carton.getCartonMark().equals(history.sourceCartonMark()))
+                    .map(history -> history.targetCartonMark()).distinct().toList();
             result.add(new RelabelResponses.InventoryCandidate(null, null, carton.getSourceReturnNo(),
                 null, carton.getOverseasWarehouseId(), null, null, carton.getDestinationWarehouseCode(),
-                carton.getDestinationWarehouseName(), skuCodes, "退货入库库存", availablePackages, 0, List.of(),
-                "PARCEL".equals(carton.getSourceUnitType()) ? "RETURN_PARCEL" : "RETURN_CARTON", carton.getId(), carton.getCartonMark(), cartonSkus, relabelledPackages));
+                carton.getDestinationWarehouseName(), skuCodes, productNames, availablePackages, 0, List.of(),
+                "PARCEL".equals(carton.getSourceUnitType()) ? "RETURN_PARCEL" : "RETURN_CARTON", carton.getId(), carton.getCartonMark(), cartonSkus, relabelledPackages,
+                com.baiyue.lastleg.returnreceipt.service.ReturnRelabelProgress.status(value(carton.getTotalQuantity()), relabelledPackages, reserved), relabelledPackages, reserved, java.util.Set.of("MERGED", "OUTBOUNDED").contains(carton.getStatus()) ? 0L : value(carton.getTotalQuantity()), carton.getStatus(), carton.getRelabelNo(),
+                mergedCartonMarks, returnCartons.hasOutbound(carton.getId()),
+                skuConversionRows.listCarton(customerId, carton.getId()).stream()
+                    .map(com.baiyue.lastleg.returnreceipt.dto.ReturnInventoryResponses.SkuConversion::from).toList(), physicalSkus, cartonAvailable));
         }
         return result;
     }
@@ -343,12 +373,12 @@ public class RelabelApplicationService implements WalletResultHandler {
             || request.items().stream().anyMatch(item -> !"SKU_LABEL".equals(operationType(item)));
         String deliveryMethod = trim(request.deliveryMethod());
         if (requiresOutbound && (!StringUtils.hasText(deliveryMethod) || !DELIVERY_METHODS.contains(deliveryMethod))) {
-            throw badRequest("Delivery method must be TRUCK, PICKUP or EXPRESS when carton labels are changed");
+            throw badRequest("箱唛换标请选择平台卡车、快递、亚马逊自提、客户自提或自提");
         }
         if (!requiresOutbound && StringUtils.hasText(deliveryMethod)) {
             throw badRequest("SKU-only relabel does not create an outbound fulfillment");
         }
-        if (Boolean.TRUE.equals(request.printShippingLabel()) && !Set.of("EXPRESS", "EXPRESS_PICKUP").contains(deliveryMethod)) {
+        if (Boolean.TRUE.equals(request.printShippingLabel()) && !Set.of("EXPRESS").contains(deliveryMethod)) {
             throw badRequest("Shipping-label printing is only available for express delivery");
         }
         String requestHash = hash(request);
@@ -370,6 +400,7 @@ public class RelabelApplicationService implements WalletResultHandler {
         Set<String> selectedCartonMarks = new HashSet<>();
         Map<Long, ReturnInventoryCarton> selectedReturnCartons = new LinkedHashMap<>();
         Map<Long, Long> selectedReturnPackages = new LinkedHashMap<>();
+        Map<Long, Map<String, Long>> selectedReturnSkus = new LinkedHashMap<>();
         for (RelabelRequests.Item item : request.items()) {
             validateOperation(item);
             if (item.notifiedPackageCount() > item.totalPackageCount()) {
@@ -388,36 +419,44 @@ public class RelabelApplicationService implements WalletResultHandler {
                 }
                 if (carton == null || !customerId.equals(carton.getCustomerId())
                     || !request.operationWarehouseId().trim().equals(carton.getOverseasWarehouseId())) {
-                    throw conflict("所选退货箱不属于当前客户和操作仓");
+                    throw conflict("当前箱子不存在或不属于当前订单");
                 }
                 if (!"AVAILABLE".equals(carton.getStatus()) || carton.getRelabelApplicationId() != null) {
                     throw conflict("仓库唛头 " + carton.getCartonMark() + " 已不可用于换标");
                 }
                 if (!carton.getCartonMark().equals(item.cartonMark().trim()))
-                    throw conflict("来源退货箱号与选择的库存不一致");
+                    throw conflict("当前箱子不存在或不属于当前订单");
                 com.baiyue.lastleg.returnreceipt.service.ReturnCartonCountGuard.requireConfirmed(carton);
-                if ("PARCEL".equals(carton.getSourceUnitType()) && !"SKU_LABEL".equals(item.operationType()))
-                    throw conflict("散件退货库存只能贴 SKU，请先合箱后申请箱唛或混贴");
                 final long sourceReturnCartonId = carton.getId();
                 Map<String, Long> availableSku = returnCartonItems.lockCarton(sourceReturnCartonId).stream()
                     .collect(Collectors.toMap(line -> line.getSkuCode().toUpperCase(java.util.Locale.ROOT),
-                        line -> Math.max(0, value(line.getQuantity()) - value(line.getPackingReservedQuantity())
-                            - returnCartons.relabelledQuantity(sourceReturnCartonId, line.getSkuCode())), Long::sum));
-                Map<String, Long> requestedSku = new java.util.HashMap<>();
+                        line -> "CARTON_LABEL".equals(operationType(item)) ? value(line.getQuantity())
+                            : remainingRelabelQuantity(sourceReturnCartonId, line), Long::sum));
+                if (availableSku.values().stream().noneMatch(quantity -> quantity > 0))
+                    throw conflict("来源箱 SKU 已全部换标，没有剩余可换标数量");
+                Map<String, Long> requestedSku = selectedReturnSkus.computeIfAbsent(carton.getId(), ignored -> new java.util.HashMap<>());
                 if (item.skuItems() != null) for (var skuItem : item.skuItems()) {
                     long quantity = requestedSku.merge(skuItem.skuCode().toUpperCase(java.util.Locale.ROOT), (long) skuItem.quantity(), Long::sum);
                     if (quantity > availableSku.getOrDefault(skuItem.skuCode().toUpperCase(java.util.Locale.ROOT), 0L))
                         throw conflict("SKU " + skuItem.skuCode() + " 的换标数量超过来源箱可用数量");
+                    var physical = returnCartonItems.lockCarton(sourceReturnCartonId).stream()
+                        .filter(line -> line.getSkuCode().equalsIgnoreCase(skuItem.skuCode())).findFirst().orElse(null);
+                    if (physical != null && quantity < value(physical.getQuantity())
+                        && returnPackingTraces.ownership(customerId, carton.getCartonMark(), physical.getSkuCode()).size() > 1)
+                        throw conflict("跨来源单同 SKU 部分贴标须先现场分拣确认，不能按单号猜测实物来源");
                 }
+                if ("CARTON_AND_SKU".equals(operationType(item)) && (!requestedSku.equals(availableSku)
+                    || returnCartonItems.lockCarton(sourceReturnCartonId).stream()
+                        .anyMatch(line -> remainingRelabelQuantity(sourceReturnCartonId, line) < value(line.getQuantity()))))
+                    throw conflict("包裹/箱混贴必须包含实物全部 SKU 和件数；部分数量请先隔离为独立新箱");
                 if (returnCartonItems.lockCarton(carton.getId()).stream().anyMatch(line -> value(line.getPackingReservedQuantity()) > 0))
                     throw conflict("退货箱SKU已被合箱计划锁定");
                 if (Set.of("CARTON_LABEL", "CARTON_AND_SKU").contains(item.operationType())
                     && (item.totalPackageCount() != 1 || item.notifiedPackageCount() != 1))
                     throw conflict("退货箱唛换标按真实箱计数，每个来源箱只能填写一箱");
-                long previouslyRelabelled = returnCartons.relabelledQuantity(carton.getId(), item.skuCode());
                 long requestedPackages = selectedReturnPackages.merge(carton.getId(),
                     (long) item.notifiedPackageCount(), Math::addExact);
-                if (requestedPackages + previouslyRelabelled > value(carton.getTotalQuantity())) {
+                if (requestedPackages > value(carton.getTotalQuantity())) {
                     throw conflict("退货托盘 " + carton.getCartonMark() + " 可用箱数不足");
                 }
                 sources.add(new SourceInventory(item, null, carton));
@@ -437,6 +476,10 @@ public class RelabelApplicationService implements WalletResultHandler {
                 || !Objects.equals(balance.getInboundOrderId(), item.sourceInboundOrderId())) {
                 throw conflict("Selected inventory does not belong to this customer, operation warehouse and inbound order");
             }
+            if (!inventoryBalances.cartonBelongsToInbound(customerId, request.operationWarehouseId().trim(),
+                item.sourceInboundOrderId(), item.cartonMark().trim())) {
+                throw conflict("当前箱子不存在或不属于当前订单");
+            }
             if (value(position.getAvailablePackages()) < item.notifiedPackageCount()) {
                 throw conflict("Available inventory changed for inbound " + balance.getInboundOrderNo());
             }
@@ -445,7 +488,7 @@ public class RelabelApplicationService implements WalletResultHandler {
         LocalDateTime now = LocalDateTime.now();
         long applicationId = IdWorker.getId();
         String operationWarehouseId = request.operationWarehouseId().trim();
-        String relabelNo = orderNoGenerator.next("RELABEL", operationWarehouseId, applicationId);
+        String relabelNo = compactNumbers.next("TB", customerId);
         BigDecimal chargeAmount = Objects.requireNonNullElse(request.chargeAmount(), BigDecimal.ZERO);
         boolean requiresWallet = chargeAmount.signum() > 0;
         int holdIndex = 0;
@@ -495,7 +538,8 @@ public class RelabelApplicationService implements WalletResultHandler {
             }
         }
         for (String returnNo : selectedReturnCartons.values().stream().map(ReturnInventoryCarton::getSourceReturnNo)
-            .filter(StringUtils::hasText).distinct().sorted().toList()) {
+            .filter(StringUtils::hasText).flatMap(value -> java.util.Arrays.stream(value.split(",")))
+            .map(String::trim).filter(StringUtils::hasText).distinct().sorted().toList()) {
             ReturnOrder returnOrder = returnOrders.lockCustomerNo(customerId, returnNo);
             if (returnOrder != null) {
                 returnOrder.setRelabelApplicationId(applicationId);
@@ -578,6 +622,7 @@ public class RelabelApplicationService implements WalletResultHandler {
                     Objects.requireNonNullElse(value.getPackageCount(), 0), value.getCurrentStatus())).toList(), evidence);
     }
 
+    /** 统一执行换标单审核、作业状态流转和作废。 */
     @Transactional
     public RelabelResponses.Detail changeStatus(String customerId, String relabelNo, String operatorId,
                                                  RelabelRequests.ChangeStatus request) {
@@ -596,12 +641,11 @@ public class RelabelApplicationService implements WalletResultHandler {
         return changeStatus(customerId, order.getRelabelOrderNo(), operatorId, request, true);
     }
 
+    /** 在申请行锁内执行审核及作废，保留实际作业与状态历史。 */
     private RelabelResponses.Detail changeStatus(String customerId, String relabelNo, String operatorId,
                                                   RelabelRequests.ChangeStatus request,
                                                   boolean directTailOrderReview) {
-        RelabelApplication application = StringUtils.hasText(customerId)
-            ? applications.lockNo(customerId, relabelNo)
-            : applications.lockAnyByRelabelNo(relabelNo);
+        RelabelApplication application = statusRepository.lockApplication(customerId, relabelNo);
         if (application == null) throw notFound("Relabel application not found");
         customerId = application.getCustomerId();
         String next = request.status().trim().toUpperCase();
@@ -609,20 +653,25 @@ public class RelabelApplicationService implements WalletResultHandler {
         if ("REJECTED".equals(next) && !StringUtils.hasText(request.remark())) {
             throw badRequest("审核驳回必须填写原因");
         }
-        LastlegOrder primaryOrder = orders.selectById(application.getLastlegOrderId());
+        LastlegOrder primaryOrder = statusRepository.findPrimaryOrder(application.getLastlegOrderId());
         boolean directApplication = primaryOrder != null && "RELABEL_APPLICATION".equals(primaryOrder.getOrderType());
-        if (PENDING_REVIEW.equals(application.getStatus()) && directApplication != directTailOrderReview) {
+        if (!"CANCELLED".equals(next) && PENDING_REVIEW.equals(application.getStatus()) && directApplication != directTailOrderReview) {
             throw conflict(directApplication
                 ? "直接创建的贴标单请在尾程订单审核"
                 : "关联业务产生的换标单请在换标单审核");
         }
         if (next.equals(application.getStatus())) return detail(customerId, relabelNo);
         validateTransition(application.getStatus(), next);
+        // 作废仅释放申请占用，已经发生的换标事实继续保留；驳回仍禁止回退实际作业。
+        if ("REJECTED".equals(next) && itemList(application.getId()).stream()
+            .filter(item -> item.getReturnCartonId() != null)
+            .anyMatch(item -> statusRepository.relabelledQuantity(item.getReturnCartonId()) > 0))
+            throw conflict("该退货任务已有实际商品换标事实，不能驳回并恢复为未换标库存；请按异常完工或退回重做处理");
         if (PENDING_REVIEW.equals(application.getStatus()) && PENDING_PROCESSING.equals(next)
             && itemList(application.getId()).stream().anyMatch(item -> "RETURN_BULK_SKU_LABEL".equals(operationType(item)))) {
             boolean hasCartonFile = StringUtils.hasText(application.getCartonTotalFileId());
             boolean hasSkuFile = StringUtils.hasText(application.getSkuTotalFileId());
-            if (hasCartonFile == hasSkuFile) throw conflict("退货贴标审核前必须且只能上传一个箱唛总文件或 SKU 总文件");
+            if (!hasCartonFile && !hasSkuFile) throw conflict("退货贴标审核前必须上传箱唛总文件或 SKU 总文件，两类资料可分别上传");
         }
         if ("PROCESSING".equals(next)
             && !Set.of("FROZEN", "NOT_REQUIRED").contains(application.getWalletStatus())) {
@@ -632,20 +681,20 @@ public class RelabelApplicationService implements WalletResultHandler {
         LocalDateTime now = LocalDateTime.now();
         application.setStatus(next);
         application.setUpdatedAt(now);
-        applications.updateById(application);
+        statusRepository.saveApplication(application);
         List<LastlegOrder> linkedOrders = tailOrders(application);
         if (linkedOrders.isEmpty()) throw conflict("Linked tail-leg order is missing");
         if (PENDING_PROCESSING.equals(next)) {
             application.setFulfillmentStatus("WAIT_RELABEL");
-            applications.updateById(application);
+            statusRepository.saveApplication(application);
         }
         if (CUSTOMER_CONFIRM_PENDING.equals(next)) {
             application.setFulfillmentStatus("WAIT_CUSTOMER_CONFIRMATION");
-            applications.updateById(application);
+            statusRepository.saveApplication(application);
         } else if ("COMPLETED".equals(next)) {
             boolean preDispatched = "PRE_DISPATCH_CREATED".equals(application.getFulfillmentStatus());
             application.setFulfillmentStatus("OUTBOUNDED");
-            applications.updateById(application);
+            statusRepository.saveApplication(application);
             if (!StringUtils.hasText(application.getOutboundOrderNo())
                 && !preDispatched) {
                 releaseInventory(customerId, operatorId, application);
@@ -656,7 +705,7 @@ public class RelabelApplicationService implements WalletResultHandler {
             if ("FROZEN".equals(application.getWalletStatus())) {
                 walletCommands.publish("RELEASE", Long.parseLong(customerId), "RELABEL_ORDER", relabelNo, null,
                     "换标取消，释放冻结", 2L);
-                application.setWalletStatus("RELEASE_PENDING"); applications.updateById(application);
+                application.setWalletStatus("RELEASE_PENDING"); statusRepository.saveApplication(application);
             }
         }
         for (LastlegOrder order : linkedOrders) {
@@ -672,28 +721,25 @@ public class RelabelApplicationService implements WalletResultHandler {
                 case "CANCELLED" -> "CANCELLED";
                 default -> mainStatus;
             };
-            // Reviewing/processing a return relabel must not move the already
-            // completed inbound order back to assignment or relabel waiting.
-            if ("RETURN_RELABEL".equals(order.getOrderType())) {
-                orderStatus = "INBOUND_COMPLETED";
+            // 退货不回退已完成入库；转运作废只终止换标，不取消原转运主单。
+            if ("RETURN_RELABEL".equals(order.getOrderType())
+                || "WAREHOUSE_TRANSFER".equals(order.getOrderType()) && "CANCELLED".equals(next)) {
+                orderStatus = orderBefore;
             }
             order.setCurrentStatus(orderStatus);
-            order.setSubOrderStatus("RELABEL:" + next);
+            if (!"RETURN_RELABEL".equals(order.getOrderType())) order.setSubOrderStatus("RELABEL:" + next);
             order.setRelabelStatus(businessRelabelStatus(next));
             order.setUpdatedAt(now);
-            orders.updateById(order);
+            statusRepository.saveOrder(order);
             if (!Objects.equals(orderBefore, orderStatus)) {
                 insertOrderHistory(customerId, order.getId(), orderBefore, orderStatus, request.remark(), now);
             }
         }
-        ReturnOrder returnOrder = returnOrders.selectOne(new LambdaQueryWrapper<ReturnOrder>()
-            .eq(ReturnOrder::getRelabelApplicationId, application.getId())
-            .eq(ReturnOrder::getCustomerId, customerId)
-            .last("LIMIT 1"));
-        if (returnOrder != null) {
+        List<ReturnOrder> linkedReturnOrders = statusRepository.linkedReturnOrders(customerId, application.getId());
+        for (ReturnOrder returnOrder : linkedReturnOrders) {
             returnOrder.setRelabelStatus(next);
             returnOrder.setUpdatedAt(now);
-            returnOrders.updateById(returnOrder);
+            statusRepository.saveReturnOrder(returnOrder);
         }
         insertHistory(customerId, application.getId(), before, next, operatorId, request.remark(), now);
         return detail(customerId, relabelNo);
@@ -791,7 +837,7 @@ public class RelabelApplicationService implements WalletResultHandler {
         applications.updateById(application);
         for (LastlegOrder order : tailOrders(application)) {
             order.setRelabelStatus(PENDING_REVIEW);
-            order.setSubOrderStatus("RELABEL:" + PENDING_REVIEW);
+            if (!"RETURN_RELABEL".equals(order.getOrderType())) order.setSubOrderStatus("RELABEL:" + PENDING_REVIEW);
             order.setUpdatedAt(now);
             orders.updateById(order);
         }
@@ -810,7 +856,8 @@ public class RelabelApplicationService implements WalletResultHandler {
         application.setUpdatedAt(LocalDateTime.now()); applications.updateById(application);
         for (LastlegOrder order : tailOrders(application)) {
             if ("RETURN_RELABEL".equals(order.getOrderType()) && !Objects.equals(order.getRelabelOrderNo(), application.getRelabelNo())) continue;
-            order.setRelabelStatus("PROCESSING"); order.setSubOrderStatus("RELABEL:PROCESSING");
+            order.setRelabelStatus("PROCESSING");
+            if (!"RETURN_RELABEL".equals(order.getOrderType())) order.setSubOrderStatus("RELABEL:PROCESSING");
             order.setUpdatedAt(LocalDateTime.now()); orders.updateById(order);
         }
         insertHistory(customerId, application.getId(), before, "PROCESSING", operatorId, remark, LocalDateTime.now());
@@ -894,12 +941,19 @@ public class RelabelApplicationService implements WalletResultHandler {
             throw conflict("Upload the shipping label before confirming relabel completion");
         }
         List<RelabelItem> relabelItems = itemList(application.getId());
+        // Manual warehouse completion does not waive physical binding at customer confirmation.
+        bindingGuard.requireBound(application);
+        skuConversions.confirm(application);
         WarehouseTransferOrder linkedTransfer = warehouseTransfers == null ? null
             : warehouseTransfers.lockByRelabelNo(customerId, relabelNo);
         boolean existingStockTransfer = linkedTransfer != null
             && StringUtils.hasText(linkedTransfer.getAllocationIdempotencyKey());
         boolean requiresOutbound = relabelItems.stream()
             .anyMatch(item -> Set.of("CARTON_LABEL", "CARTON_AND_SKU").contains(operationType(item)));
+        boolean directOutbound = "EXPRESS".equals(application.getDeliveryMethod())
+            || "PICKUP".equals(application.getDeliveryMethod())
+            || "AMAZON_PICKUP".equals(application.getDeliveryMethod())
+            || "CUSTOMER_PICKUP".equals(application.getDeliveryMethod());
         reviewTask.setStatus("COMPLETED"); reviewTask.setReviewDecision("CONFIRMED");
         reviewTask.setReviewerKey(operatorId); reviewTask.setReviewerName("客户确认");
         reviewTask.setReviewRemark(request.remark()); reviewTask.setReviewedAt(LocalDateTime.now());
@@ -911,9 +965,9 @@ public class RelabelApplicationService implements WalletResultHandler {
         application.setCustomerConfirmationKey(key);
         application.setCustomerConfirmedAt(now);
         application.setFulfillmentStatus(requiresOutbound
-            ? ("TRUCK".equals(application.getDeliveryMethod()) ? "WAIT_PRE_DISPATCH" : "WAIT_OUTBOUND_CREATION")
+            ? (directOutbound ? "WAIT_OUTBOUND_CREATION" : "WAIT_PRE_DISPATCH")
             : "NOT_REQUIRED");
-        if (requiresOutbound && !existingStockTransfer && !"TRUCK".equals(application.getDeliveryMethod())) {
+        if (requiresOutbound && !existingStockTransfer && directOutbound) {
             createDirectOutbound(application, operatorId, now);
             application.setFulfillmentStatus("OUTBOUND_CREATED");
         }
@@ -927,9 +981,9 @@ public class RelabelApplicationService implements WalletResultHandler {
             String orderBefore = order.getCurrentStatus();
             // 换标确认时货物已经完成入库，不得退回最初建单的“待分配”。
             // 独立换标先进入待出库；仓储转运会在下方按目的仓进一步收敛为待排车或待确认目的仓。
-            order.setCurrentStatus("RETURN_RELABEL".equals(order.getOrderType()) ? "INBOUND_COMPLETED"
+            order.setCurrentStatus("RETURN_RELABEL".equals(order.getOrderType()) ? orderBefore
                 : requiresOutbound ? "WAIT_OUTBOUND" : "COMPLETED");
-            order.setSubOrderStatus("RELABEL:" + application.getFulfillmentStatus());
+            if (!"RETURN_RELABEL".equals(order.getOrderType())) order.setSubOrderStatus("RELABEL:" + application.getFulfillmentStatus());
             order.setRelabelStatus("COMPLETED");
             order.setUpdatedAt(now);
             orders.updateById(order);
@@ -938,11 +992,10 @@ public class RelabelApplicationService implements WalletResultHandler {
                     request.remark(), now);
             }
         }
-        ReturnOrder returnOrder = returnOrders.selectOne(new LambdaQueryWrapper<ReturnOrder>()
+        List<ReturnOrder> completedReturnOrders = returnOrders.selectList(new LambdaQueryWrapper<ReturnOrder>()
             .eq(ReturnOrder::getRelabelApplicationId, application.getId())
-            .eq(ReturnOrder::getCustomerId, customerId)
-            .last("LIMIT 1"));
-        if (returnOrder != null) {
+            .eq(ReturnOrder::getCustomerId, customerId));
+        for (ReturnOrder returnOrder : completedReturnOrders) {
             returnOrder.setRelabelStatus("COMPLETED");
             returnOrder.setUpdatedAt(now);
             returnOrders.updateById(returnOrder);
@@ -954,13 +1007,14 @@ public class RelabelApplicationService implements WalletResultHandler {
             carton.setRelabelStatus("COMPLETED"); carton.setRelabelCompletedAt(now);
             // 换标已完成后释放“当前申请占用”关系，但保留 COMPLETED 作为历史状态。
             // 否则退货箱虽显示 AVAILABLE，下一次贴标申请仍会被旧 relabel_application_id 拦截。
-            boolean awaitingTruck = requiresOutbound && "TRUCK".equals(application.getDeliveryMethod());
+            boolean awaitingTruck = requiresOutbound && !directOutbound;
             if (!StringUtils.hasText(application.getOutboundOrderNo()) && !awaitingTruck) {
                 carton.setRelabelApplicationId(null); carton.setRelabelNo(null);
             }
             carton.setStatus(StringUtils.hasText(application.getOutboundOrderNo()) ? "OUTBOUND_PENDING"
                 : awaitingTruck ? "RELABEL_PENDING" : "AVAILABLE");
             carton.setUpdatedAt(now); returnCartons.updateById(carton);
+            if (carton.getRelabelApplicationId() == null) returnCartons.clearRelabel(carton.getId());
         }
         insertHistory(customerId, application.getId(), before, application.getStatus(), operatorId,
             request.remark(), now);
@@ -1010,6 +1064,7 @@ public class RelabelApplicationService implements WalletResultHandler {
                 boolean relabelHasDestination = !relabelItems.isEmpty() && relabelItems.stream()
                     .allMatch(item -> StringUtils.hasText(item.getDestinationFbaWarehouseCode()));
                 application.setFulfillmentStatus(existingStockTransfer ? "WAIT_TRANSFER_OUTBOUND"
+                    : StringUtils.hasText(application.getOutboundOrderNo()) ? "OUTBOUND_CREATED"
                     : "READY_FOR_DISPATCH".equals(transferStatus) || relabelHasDestination
                     ? "WAIT_PRE_DISPATCH" : transferStatus);
                 applications.updateById(application);
@@ -1041,15 +1096,33 @@ public class RelabelApplicationService implements WalletResultHandler {
             return;
         }
         List<RelabelItem> relabelItems = itemList(application.getId());
+        Map<Long, ReturnInventoryCarton> confirmedReturnCartons = new LinkedHashMap<>();
         for (RelabelItem source : relabelItems) {
             if (source.getReturnCartonId() == null) continue;
             ReturnInventoryCarton carton = returnCartons.lockId(source.getReturnCartonId());
             if (carton == null || !application.getCustomerId().equals(carton.getCustomerId())
+                || !Objects.equals(application.getOverseasWarehouseId(), carton.getOverseasWarehouseId())
                 || !application.getId().equals(carton.getRelabelApplicationId())
                 || !"RELABEL_PENDING".equals(carton.getStatus())
                 || intValue(source.getNotifiedPackageCount()) != 1)
                 throw conflict("退货整箱换标出库必须覆盖该箱全部 SKU 数量：" + source.getCartonMark());
             com.baiyue.lastleg.returnreceipt.service.ReturnCartonCountGuard.requireConfirmed(carton);
+            confirmedReturnCartons.put(carton.getId(), carton);
+        }
+        boolean returnOnly = relabelItems.stream().allMatch(item -> item.getReturnCartonId() != null);
+        String customerName = null;
+        String warehouseName = null;
+        if (returnOnly) {
+            // Resolve once per new outbound, before any insert; every destination shares these snapshots.
+            var customer = customerDirectory.find(application.getCustomerId());
+            var warehouse = warehouseDirectory.required(Long.parseLong(application.getOverseasWarehouseId()), "OVERSEAS");
+            if (customer == null || !application.getCustomerId().equals(customer.id()) || !StringUtils.hasText(customer.name())
+                || warehouse == null || !application.getOverseasWarehouseId().equals(warehouse.id())
+                || !"OVERSEAS".equals(warehouse.region()) || !StringUtils.hasText(warehouse.name())) {
+                throw conflict("客户或作业仓库名称未完整返回，请核实主档后重试");
+            }
+            customerName = customer.name().trim();
+            warehouseName = warehouse.name().trim();
         }
         OutboundOrder outbound = new OutboundOrder();
         outbound.setId(IdWorker.getId()); outbound.setCustomerId(application.getCustomerId());
@@ -1058,12 +1131,17 @@ public class RelabelApplicationService implements WalletResultHandler {
         outbound.setStatus("WAIT_PICK"); outbound.setPackageCount(relabelItems.stream().mapToInt(item -> item.getReturnCartonId() == null ? intValue(item.getNotifiedPackageCount()) : 1).sum());
         outbound.setPalletCount((int) relabelItems.stream().map(this::outboundSourceKey).distinct().count());
         outbound.setRecipientInfo(application.getDeliveryMethod()); outbound.setIdempotencyKey(key);
+        if (returnOnly) {
+            var measurement = returnMeasurement(relabelItems, confirmedReturnCartons);
+            outbound.setGrossWeightKg(measurement.weightKg()); outbound.setVolumeCbm(measurement.volumeCbm());
+        }
         outbound.setCreatedBy(operatorId); outbound.setCreatedAt(now); outbound.setUpdatedAt(now); outboundOrders.insert(outbound);
         Map<Long, List<RelabelItem>> byPosition = relabelItems.stream().collect(Collectors.groupingBy(
             this::outboundSourceKey, LinkedHashMap::new, Collectors.toList()));
         for (Map.Entry<Long, List<RelabelItem>> entry : byPosition.entrySet()) {
             InventoryPosition position = entry.getKey() > 0 ? inventoryPositions.selectById(entry.getKey()) : null;
-            if (entry.getKey() > 0 && (position == null || !application.getCustomerId().equals(position.getCustomerId()))) {
+            if (entry.getKey() > 0 && (position == null || !application.getCustomerId().equals(position.getCustomerId())
+                || !Objects.equals(application.getOverseasWarehouseId(), position.getOverseasWarehouseId()))) {
                 throw conflict("Relabel source inventory position no longer exists");
             }
             List<RelabelItem> group = entry.getValue();
@@ -1082,12 +1160,16 @@ public class RelabelApplicationService implements WalletResultHandler {
                 .filter(StringUtils::hasText).distinct().collect(Collectors.joining(",")));
             item.setInboundCode(group.stream().map(RelabelItem::getSourceInboundCode).filter(StringUtils::hasText).distinct().collect(Collectors.joining(",")));
             item.setOrderRefs(writeOutboundRefs(application.getRelabelNo(), position == null ? null : entry.getKey(), group));
+            if (position == null) {
+                var measurement = returnMeasurement(group, confirmedReturnCartons);
+                item.setGrossWeightKg(measurement.weightKg()); item.setVolumeCbm(measurement.volumeCbm());
+            }
             item.setCreatedAt(now); outboundItems.insert(item);
         }
         OutboundPdaTask task = new OutboundPdaTask(); task.setId(IdWorker.getId()); task.setCustomerId(application.getCustomerId());
         task.setOutboundOrderId(outbound.getId()); task.setTaskNo("PDA" + now.format(DateTimeFormatter.BASIC_ISO_DATE) + task.getId());
         task.setStatus("PENDING"); task.setPushedAt(now); task.setCreatedAt(now); task.setUpdatedAt(now); outboundTasks.insert(task);
-        if (relabelItems.stream().allMatch(item -> item.getReturnCartonId() != null)) {
+        if (returnOnly) {
             Map<String, List<RelabelItem>> destinations = relabelItems.stream().collect(Collectors.groupingBy(
                 item -> Objects.toString(item.getDestinationFbaWarehouseCode(), ""), LinkedHashMap::new, Collectors.toList()));
             int index = 0;
@@ -1097,12 +1179,15 @@ public class RelabelApplicationService implements WalletResultHandler {
                 delivery.setDeliveryNo(orderNoGenerator.next("DELIVERY", application.getOverseasWarehouseId(), delivery.getId()));
                 delivery.setOutboundOrderId(outbound.getId()); delivery.setOutboundNo(outbound.getOutboundNo());
                 delivery.setOverseasWarehouseId(application.getOverseasWarehouseId());
+                delivery.setCustomerName(customerName); delivery.setOverseasWarehouseName(warehouseName);
                 delivery.setDeliveryGroupKey("RETURN_RELABEL:" + destination.getKey());
                 delivery.setDestinationWarehouseCode(destination.getKey());
                 delivery.setDestinationType(StringUtils.hasText(destination.getKey()) ? "FBA" : null);
                 delivery.setContactName(application.getContactName()); delivery.setContactPhone(application.getContactPhone());
                 delivery.setDeliveryMethod(application.getDeliveryMethod()); delivery.setStatus("WAIT_DELIVERY");
                 delivery.setPackageCount(destination.getValue().size()); delivery.setPalletCount(0);
+                var measurement = returnMeasurement(destination.getValue(), confirmedReturnCartons);
+                delivery.setTotalWeightKg(measurement.weightKg()); delivery.setTotalVolumeCbm(measurement.volumeCbm());
                 delivery.setIdempotencyKey(key + ":DELIVERY:" + index++); delivery.setVersion(0L);
                 delivery.setCreatedBy(operatorId); delivery.setCreatedAt(now); delivery.setUpdatedAt(now);
                 deliveryOrders.insert(delivery);
@@ -1111,6 +1196,24 @@ public class RelabelApplicationService implements WalletResultHandler {
         application.setOutboundOrderNo(outbound.getOutboundNo());
     }
 
+    private record ReturnMeasurement(BigDecimal weightKg, BigDecimal volumeCbm) { }
+
+    private ReturnMeasurement returnMeasurement(List<RelabelItem> sources, Map<Long, ReturnInventoryCarton> cartons) {
+        BigDecimal weight = BigDecimal.ZERO;
+        BigDecimal volume = BigDecimal.ZERO;
+        // The selected physical carton contributes once, regardless of its SKU count or piece quantities.
+        for (Long cartonId : sources.stream().map(RelabelItem::getReturnCartonId).distinct().toList()) {
+            ReturnInventoryCarton carton = cartons.get(cartonId);
+            if (carton == null) return new ReturnMeasurement(null, null);
+            weight = weight == null || !positive(carton.getWeight()) ? null : weight.add(carton.getWeight());
+            volume = volume == null || !positive(carton.getLength()) || !positive(carton.getWidth()) || !positive(carton.getHeight())
+                ? null : volume.add(carton.getLength().multiply(carton.getWidth()).multiply(carton.getHeight()).movePointLeft(6));
+        }
+        return new ReturnMeasurement(weight, volume);
+    }
+
+    private static boolean positive(BigDecimal value) { return value != null && value.signum() > 0; }
+
     private String writeOutboundRefs(String relabelNo, Long positionId, List<RelabelItem> values) {
         try {
             Map<String, Object> refs = new LinkedHashMap<>();
@@ -1163,7 +1266,12 @@ public class RelabelApplicationService implements WalletResultHandler {
 
     private RelabelResponses.Summary summary(RelabelApplication value, List<RelabelItem> detailItems) {
         LastlegOrder order = orders.selectById(value.getLastlegOrderId());
-        String skuCodes = detailItems.stream().map(RelabelItem::getSkuCode).filter(Objects::nonNull).distinct().collect(Collectors.joining(","));
+        RelabelResponses.Milestones milestones = applications.findMilestones(value.getCustomerId(), value.getId());
+        String skuCodes = detailItems.stream().flatMap(item -> {
+            List<RelabelResponses.SkuItem> skuItems = readSkuItems(item.getSkuRelabelItemsJson());
+            return skuItems.isEmpty() ? java.util.Arrays.stream(Objects.requireNonNullElse(item.getSkuCode(), "").split(","))
+                : skuItems.stream().map(RelabelResponses.SkuItem::skuCode);
+        }).filter(StringUtils::hasText).map(String::trim).distinct().collect(Collectors.joining(","));
         return new RelabelResponses.Summary(value.getId(), value.getRelabelNo(), value.getLastlegOrderId(),
             order == null ? null : order.getOrderNo(), value.getCustomerOrderNo(),
             value.getOverseasWarehouseId(),
@@ -1180,7 +1288,30 @@ public class RelabelApplicationService implements WalletResultHandler {
             value.getFulfillmentStatus(), value.getOutboundOrderNo(), value.getCustomerConfirmedAt(),
             order != null && "RELABEL_APPLICATION".equals(order.getOrderType()) ? "TAIL_ORDER" : "RELABEL_ORDER",
             null,
-            value.getCreatedAt());
+            value.getCreatedAt(), milestones == null ? null : milestones.reviewedAt(),
+            milestones == null ? null : milestones.relabelCompletedAt(),
+            milestones == null ? null : milestones.outboundAt(),
+            detailItems.stream().map(RelabelItem::getProductNameZh).filter(StringUtils::hasText)
+                .map(String::trim).distinct().collect(Collectors.joining("、")),
+            detailItems.stream().map(RelabelItem::getLabelRequirement).filter(StringUtils::hasText)
+                .map(String::trim).distinct().collect(Collectors.joining("；")),
+            detailItems.stream().map(RelabelItem::getOperationType).filter(StringUtils::hasText)
+                .map(String::trim).distinct().toList(), relatedBusinessOrderNos(value, order, detailItems));
+    }
+
+    private List<String> relatedBusinessOrderNos(RelabelApplication application, LastlegOrder order,
+                                                List<RelabelItem> detailItems) {
+        if (order != null && Objects.equals(application.getCustomerId(), order.getCustomerId())
+            && !"RELABEL_APPLICATION".equals(order.getOrderType())) {
+            String businessNo = StringUtils.hasText(order.getSourceOrderNo()) ? order.getSourceOrderNo() : order.getOrderNo();
+            if (StringUtils.hasText(businessNo)) return List.of(businessNo.trim());
+        }
+        // Standalone relabel orders keep the actual inventory source on their item snapshots.
+        // Their tail sourceOrderNo is a customer reference, not a business order number.
+        return detailItems.stream().map(item -> StringUtils.hasText(item.getSourceInboundOrderNo())
+                ? item.getSourceInboundOrderNo()
+                : "RETURN_BULK_SKU_LABEL".equals(item.getOperationType()) ? item.getShipmentNo() : null)
+            .filter(StringUtils::hasText).map(String::trim).distinct().toList();
     }
 
     @Override public boolean supports(String businessType) { return "RELABEL_ORDER".equals(businessType); }
@@ -1232,12 +1363,11 @@ public class RelabelApplicationService implements WalletResultHandler {
             .last("LIMIT 1"));
         if (existingReturn != null) {
             existingReturn.setRelabelOrderNo(relabelNo); existingReturn.setRelabelStatus(PENDING_REVIEW);
-            existingReturn.setSubOrderStatus("RETURN_RELABEL:" + PENDING_REVIEW); existingReturn.setPackageCount(packageCount);
             existingReturn.setUpdatedAt(now); orders.updateById(existingReturn); return existingReturn;
         }
         LastlegOrder order = new LastlegOrder();
         order.setId(IdWorker.getId());
-        order.setOrderNo(orderNoGenerator.next("RELABEL", warehouseId, order.getId()));
+        order.setOrderNo(relabelNo);
         order.setCustomerId(customerId); order.setOrderType("RELABEL_APPLICATION");
         order.setInboundCode(null); order.setSourceRegion("CUSTOMER");
         order.setSourceInboundId(relabelNo + ":" + warehouseId);
@@ -1262,7 +1392,7 @@ public class RelabelApplicationService implements WalletResultHandler {
         // A linked warehouse-transfer relabel can cover only part of the
         // transfer. Keep the authoritative whole-order package count so later
         // dispatches can attribute the remaining cartons correctly.
-        if (!"WAREHOUSE_TRANSFER".equals(order.getOrderType())) order.setPackageCount(packageCount);
+        if (!"WAREHOUSE_TRANSFER".equals(order.getOrderType()) && !"RETURN_RELABEL".equals(order.getOrderType())) order.setPackageCount(packageCount);
         order.setUpdatedAt(now); orders.updateById(order);
         return order;
     }
@@ -1279,6 +1409,11 @@ public class RelabelApplicationService implements WalletResultHandler {
 
     private record SourceInventory(RelabelRequests.Item request, InventoryBalance balance,
                                    ReturnInventoryCarton returnCarton) {}
+    private long remainingRelabelQuantity(long cartonId, ReturnInventoryCartonItem line) {
+        return Math.max(0, value(line.getQuantity()) - value(line.getPackingReservedQuantity())
+            - value(line.getRelabelledQuantity())
+            - returnCartons.completedSkuQuantity(cartonId, line.getSkuCode()));
+    }
     private static long value(Long value) { return value == null ? 0L : value; }
     private static int intValue(Integer value) { return value == null ? 0 : value; }
     private static boolean containsIgnoreCase(String value, String fragment) {
@@ -1295,6 +1430,7 @@ public class RelabelApplicationService implements WalletResultHandler {
                     && "RELABEL_PENDING".equals(carton.getStatus())) {
                     carton.setRelabelApplicationId(null); carton.setRelabelNo(null); carton.setRelabelStatus(null);
                     carton.setStatus("AVAILABLE"); carton.setUpdatedAt(LocalDateTime.now()); returnCartons.updateById(carton);
+                    returnCartons.clearRelabel(carton.getId());
                 }
                 continue;
             }
@@ -1352,6 +1488,9 @@ public class RelabelApplicationService implements WalletResultHandler {
             && (item.skuItems() == null || item.skuItems().isEmpty())) {
             throw badRequest("SKU label changes require at least one SKU detail");
         }
+        if (item.returnCartonId() != null && item.skuItems() != null && item.skuItems().stream()
+            .anyMatch(sku -> sku.skuCode().trim().equalsIgnoreCase(sku.newSkuCode().trim())))
+            throw badRequest("退货 SKU 转换的新旧编码必须不同");
     }
     private static String operationType(RelabelRequests.Item item) {
         return StringUtils.hasText(item.operationType()) ? item.operationType().trim().toUpperCase() : "CARTON_LABEL";
@@ -1396,7 +1535,12 @@ public class RelabelApplicationService implements WalletResultHandler {
         value.setToStatus(to); value.setEventId("RELABEL_APPLICATION"); value.setRemark(trim(remark)); value.setCreatedAt(now);
         orderHistories.insert(value);
     }
+    /** 客户确认换标完成后禁止作废，其余状态允许终止申请。 */
     private static void validateTransition(String from, String to) {
+        if ("CANCELLED".equals(to)) {
+            if (Set.of(READY_FOR_OUTBOUND, "COMPLETED").contains(from)) throw conflict("换标完成的单据不能作废");
+            return;
+        }
         boolean allowed = PENDING_REVIEW.equals(from) && Set.of(PENDING_PROCESSING, "REJECTED", "CANCELLED").contains(to)
             || PENDING_PROCESSING.equals(from) && Set.of("PROCESSING", "REJECTED", "CANCELLED").contains(to)
             || "PROCESSING".equals(from) && Set.of(CUSTOMER_CONFIRM_PENDING, "REJECTED", "CANCELLED").contains(to)
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/relabel/service/RelabelBindingGuard.java b/lastleg-service/src/main/java/com/baiyue/lastleg/relabel/service/RelabelBindingGuard.java
index 88cb5602f..0ceef07f3 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/relabel/service/RelabelBindingGuard.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/relabel/service/RelabelBindingGuard.java
@@ -22,19 +22,26 @@ public class RelabelBindingGuard {
     @Resource private PdaRelabelHistoryMapper histories;
     @Resource private InventoryPositionMapper positions;
     @Resource private ReturnInventoryCartonMapper returnCartons;
+    @Resource private com.baiyue.lastleg.returnreceipt.mapper.ReturnSkuConversionMapper conversions;
+    @Resource private com.baiyue.lastleg.returnreceipt.mapper.ReturnInventoryCartonItemMapper returnLines;
     @Resource private ObjectMapper objectMapper;
 
     public void requireBound(RelabelApplication app) {
         List<RelabelItem> cartons = items.selectList(new QueryWrapper<RelabelItem>()
             .eq("application_id", app.getId()).eq("customer_id", app.getCustomerId()))
-            .stream().filter(item -> Set.of("CARTON_LABEL", "CARTON_AND_SKU", "RETURN_BULK_SKU_LABEL")
+            .stream().filter(item -> (item.getReturnCartonId() != null && "SKU_LABEL".equals(item.getOperationType())) || Set.of("CARTON_LABEL", "CARTON_AND_SKU", "RETURN_BULK_SKU_LABEL")
                 .contains(item.getOperationType())).toList();
         if (cartons.isEmpty()) return;
         Map<String, Set<String>> bindings = new HashMap<>();
+        String currentRound = null;
         for (PdaRelabelHistory history : histories.selectList(new QueryWrapper<PdaRelabelHistory>()
             .eq("application_id", app.getId()).eq("customer_id", app.getCustomerId())
             .orderByAsc("created_at", "id"))) {
-            if ("REWORK_ARCHIVE".equals(history.getAction())) bindings.clear();
+            if ("REWORK_ARCHIVE".equals(history.getAction())) { bindings.clear(); currentRound = null; }
+            if ("COMPLETE".equals(history.getAction())) {
+                try { currentRound = objectMapper.readTree(history.getDetailJson()).path("roundKey").asText(null); }
+                catch (Exception failure) { throw conflict("换标完工轮次记录无法读取"); }
+            }
             if (!"PALLET_BIND".equals(history.getAction())) continue;
             try {
                 var data = objectMapper.readTree(history.getDetailJson());
@@ -44,27 +51,90 @@ public class RelabelBindingGuard {
             } catch (Exception e) { throw conflict("组托记录无法读取，请核对后重试"); }
         }
         for (RelabelItem item : cartons) {
-            if (item.getReturnCartonId() != null && !"RETURN_BULK_SKU_LABEL".equals(item.getOperationType())) {
-                var carton = returnCartons.selectById(item.getReturnCartonId());
-                if (carton == null || !app.getCustomerId().equals(carton.getCustomerId())) throw conflict("退货箱来源缺失");
-                if (!"TRUCK".equals(app.getDeliveryMethod())) continue;
-                if (!bindings.getOrDefault(item.getCartonMark(), Set.of()).contains(carton.getPalletCode()))
+            var sourceCarton = item.getReturnCartonId() == null ? null : returnCartons.selectById(item.getReturnCartonId());
+            if (item.getReturnCartonId() != null && (sourceCarton == null
+                || !Objects.equals(app.getCustomerId(), sourceCarton.getCustomerId())
+                || !Objects.equals(app.getOverseasWarehouseId(), sourceCarton.getOverseasWarehouseId())))
+                throw conflict("退货箱来源缺失或仓库不一致");
+            if (item.getReturnCartonId() != null && !Set.of("RETURN_BULK_SKU_LABEL", "SKU_LABEL").contains(item.getOperationType())) {
+                var carton = sourceCarton;
+                if ("CARTON_AND_SKU".equals(item.getOperationType())) {
+                    var expected = new HashMap<String, Long>();
+                    try {
+                        for (var sku : objectMapper.readTree(item.getSkuRelabelItemsJson()))
+                            expected.merge(sku.path("skuCode").asText().toUpperCase(Locale.ROOT), sku.path("quantity").asLong(), Long::sum);
+                    } catch (Exception failure) { throw conflict("混贴 SKU 明细无法读取"); }
+                    projectCurrentContents(app, List.of(item), expected, currentRound);
+                    var actual = new HashMap<String, Long>();
+                    returnLines.lockCarton(item.getReturnCartonId()).forEach(line -> actual.merge(line.getSkuCode().toUpperCase(Locale.ROOT), line.getQuantity(), Long::sum));
+                    if (!expected.equals(actual)) throw conflict("包裹/箱混贴必须包含实物全部 SKU 和件数；部分数量请先隔离为独立新箱");
+                }
+                if ("EXPRESS".equals(app.getDeliveryMethod()) || "PICKUP".equals(app.getDeliveryMethod())
+                    || "AMAZON_PICKUP".equals(app.getDeliveryMethod()) || "CUSTOMER_PICKUP".equals(app.getDeliveryMethod())) continue;
+                if (carton.getPalletCode() == null || !bindings.getOrDefault(item.getCartonMark(), Set.of()).contains(carton.getPalletCode()))
                     throw conflict("退货箱尚未完成排车托盘绑定");
                 continue;
             }
-            if ("RETURN_BULK_SKU_LABEL".equals(item.getOperationType())) {
-                var carton = item.getReturnCartonId() == null ? null : returnCartons.selectById(item.getReturnCartonId());
-                if (carton == null || !bindings.getOrDefault(item.getCartonMark(), Set.of()).contains(carton.getPalletCode())
+            if (Set.of("RETURN_BULK_SKU_LABEL", "SKU_LABEL").contains(item.getOperationType()) && item.getReturnCartonId() != null) {
+                var sameCarton = cartons.stream().filter(i -> Objects.equals(i.getReturnCartonId(), item.getReturnCartonId())).toList();
+                var stock = item.getReturnCartonId() == null ? List.<com.baiyue.lastleg.returnreceipt.entity.ReturnInventoryCartonItem>of() : returnLines.lockCarton(item.getReturnCartonId());
+                var selected = new HashMap<String, Long>();
+                for (var i : sameCarton) {
+                    if ("RETURN_BULK_SKU_LABEL".equals(i.getOperationType())) selected.merge(i.getSkuCode().toUpperCase(Locale.ROOT), (long)i.getNotifiedPackageCount(), Long::sum);
+                    else try {
+                        for (var sku : objectMapper.readTree(i.getSkuRelabelItemsJson())) selected.merge(sku.path("skuCode").asText().toUpperCase(Locale.ROOT), sku.path("quantity").asLong(), Long::sum);
+                    } catch (Exception failure) { throw conflict("换标明细无法读取"); }
+                }
+                var actual = new HashMap<String, Long>();
+                stock.forEach(i -> actual.merge(i.getSkuCode().toUpperCase(Locale.ROOT), i.getQuantity(), Long::sum));
+                projectCurrentContents(app, sameCarton, selected, currentRound);
+                if (!selected.equals(actual)) throw conflict("部分换标货物必须先合箱生成独立新箱，再提交完工");
+                // SKU-only work has no outbound fulfillment, but must still cover the isolated carton.
+                if ("SKU_LABEL".equals(item.getOperationType()) && app.getDeliveryMethod() == null) continue;
+                if ("EXPRESS".equals(app.getDeliveryMethod()) || "PICKUP".equals(app.getDeliveryMethod())
+                    || "AMAZON_PICKUP".equals(app.getDeliveryMethod()) || "CUSTOMER_PICKUP".equals(app.getDeliveryMethod())) continue;
+                var carton = sourceCarton;
+                if (carton.getPalletCode() == null || !bindings.getOrDefault(item.getCartonMark(), Set.of()).contains(carton.getPalletCode())
                     || !"PROCESSING".equals(carton.getRelabelStatus()))
                     throw conflict("退货箱 " + item.getCartonMark() + " 尚未绑定带目的仓的新托盘，不能完成换标");
                 continue;
             }
             var position = item.getSourceInventoryPositionId() == null ? null
                 : positions.findTenantPosition(app.getCustomerId(), item.getSourceInventoryPositionId());
-            if (position == null || !bindings.getOrDefault(item.getCartonMark(), Set.of()).contains(position.getPalletNo())
+            if (position == null || !Objects.equals(app.getOverseasWarehouseId(), position.getOverseasWarehouseId())
+                || position.getPalletNo() == null || !bindings.getOrDefault(item.getCartonMark(), Set.of()).contains(position.getPalletNo())
                 || position.getHoldPackages() == null || position.getHoldPackages() < item.getNotifiedPackageCount())
                 throw conflict("箱唛 " + item.getCartonMark() + " 尚未完成托盘绑定，请先在 PDA 确认组托，不能完成或排车出库");
         }
     }
+
+    private void projectCurrentContents(RelabelApplication app, List<RelabelItem> selectedItems,
+                                        Map<String, Long> expected, String currentRound) {
+        if (!"CUSTOMER_CONFIRM_PENDING".equals(app.getStatus()) && !"READY_FOR_OUTBOUND".equals(app.getStatus())
+            && !"COMPLETED".equals(app.getStatus())) return;
+        if (currentRound == null || currentRound.isBlank()) throw conflict("换标完工轮次缺失，不能核对当前 SKU 库存");
+        // Warehouse completion has already applied SKU conversions. Confirmation and dispatch
+        // compare against that round's persisted changes, never assume that every new SKU exists.
+        Map<String, Long> outgoing = new HashMap<>(), incoming = new HashMap<>();
+        for (var row : conversions.lockApplication(app.getCustomerId(), app.getId())) {
+            if (!Objects.equals(row.getCustomerId(), app.getCustomerId()) || !Objects.equals(row.getApplicationId(), app.getId())
+                || !Objects.equals(row.getRoundKey(), currentRound)
+                || !("APPLIED".equals(row.getStatus()) || "CONFIRMED".equals(row.getStatus()))
+                || selectedItems.stream().noneMatch(item -> Objects.equals(item.getId(), row.getItemId())
+                    && Objects.equals(item.getReturnCartonId(), row.getCartonId()))) continue;
+            String oldSku = row.getOldSkuCode().toUpperCase(Locale.ROOT);
+            String newSku = row.getNewSkuCode().toUpperCase(Locale.ROOT);
+            long quantity = Objects.requireNonNullElse(row.getQuantity(), 0L);
+            if (quantity <= 0) throw conflict("换标转换数量与批准明细不一致");
+            outgoing.merge(oldSku, quantity, Math::addExact);
+            incoming.merge(newSku, quantity, Math::addExact);
+        }
+        for (var source : outgoing.entrySet()) {
+            long remaining = expected.getOrDefault(source.getKey(), 0L) - source.getValue();
+            if (remaining < 0) throw conflict("换标转换数量与批准明细不一致");
+            if (remaining == 0) expected.remove(source.getKey()); else expected.put(source.getKey(), remaining);
+        }
+        incoming.forEach((sku, quantity) -> expected.merge(sku, quantity, Math::addExact));
+    }
     private ResponseStatusException conflict(String message) { return new ResponseStatusException(HttpStatus.CONFLICT, message); }
 }
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/relabel/service/RelabelCartonMeasurementService.java b/lastleg-service/src/main/java/com/baiyue/lastleg/relabel/service/RelabelCartonMeasurementService.java
new file mode 100644
index 000000000..1096bb813
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/relabel/service/RelabelCartonMeasurementService.java
@@ -0,0 +1,94 @@
+package com.baiyue.lastleg.relabel.service;
+
+import com.baomidou.mybatisplus.core.conditions.query.QueryWrapper;
+import com.baiyue.lastleg.relabel.entity.*;
+import com.baiyue.lastleg.relabel.mapper.RelabelPalletMeasurementMapper;
+import com.baiyue.lastleg.relabel.pda.entity.PdaRelabelHistory;
+import com.baiyue.lastleg.relabel.pda.mapper.PdaRelabelHistoryMapper;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import jakarta.annotation.Resource;
+import org.springframework.stereotype.Service;
+import org.springframework.http.HttpStatus;
+import org.springframework.web.server.ResponseStatusException;
+import java.util.*;
+
+/** Replays saved physical box bindings; dimensions always come from measured source boxes. */
+@Service
+public class RelabelCartonMeasurementService {
+    @Resource private RelabelPalletMeasurementMapper mapper;
+    @Resource private PdaRelabelHistoryMapper histories;
+    @Resource private ObjectMapper json;
+    public record Move(String cartonMark, String sourceCartonMark, Long targetPalletId, String targetPalletCode) {}
+
+    public List<RelabelPalletMeasurementMapper.Carton> current(RelabelApplication app) {
+        Long transfer = mapper.transfer(app.getCustomerId(), app.getRelabelNo());
+        if (transfer == null) return List.of();
+        var boxes = new LinkedHashMap<String, RelabelPalletMeasurementMapper.Carton>();
+        for (var box : mapper.cartons(app.getCustomerId(), transfer)) boxes.put(box.cartonMark(), box);
+        if (boxes.isEmpty()) return List.of();
+        for (var history : records(app)) if ("PALLET_BIND".equals(history.getAction())) {
+            try {
+                for (var node : json.readTree(history.getDetailJson()).path("measuredCartons")) {
+                    var move = json.treeToValue(node, Move.class);
+                    var box = boxes.get(move.sourceCartonMark());
+                    if (box == null) throw conflict("换标箱测量来源无法追溯");
+                    boxes.put(box.cartonMark(), new RelabelPalletMeasurementMapper.Carton(box.id(), box.cartonMark(), box.customerCartonMark(),
+                        move.targetPalletId(), move.targetPalletCode(), box.lengthCm(), box.widthCm(), box.heightCm(), box.grossWeightKg()));
+                }
+            } catch (com.fasterxml.jackson.core.JsonProcessingException e) { throw conflict("换标箱绑定记录无法读取"); }
+        }
+        return List.copyOf(boxes.values());
+    }
+
+    public List<Move> prepare(RelabelApplication app, List<RelabelItem> items, Long sourcePallet,
+        Long targetPallet, String targetCode, List<com.baiyue.lastleg.palletops.dto.PalletOperationRequests.MeasuredCartonBinding> requested) {
+        var boxes = current(app);
+        if (boxes.isEmpty()) return List.of();
+        var available = new ArrayList<>(boxes.stream().filter(box -> sourcePallet.equals(box.palletId())).toList());
+        var mappings = new HashMap<String,String>();
+        // A rebind retains the exact physical box selected at its first binding.
+        for (var history : records(app)) if ("PALLET_BIND".equals(history.getAction())) {
+            try { for (var node : json.readTree(history.getDetailJson()).path("measuredCartons"))
+                mappings.put(node.path("cartonMark").asText(), node.path("sourceCartonMark").asText());
+            } catch (com.fasterxml.jackson.core.JsonProcessingException e) { throw conflict("换标箱绑定记录无法读取"); }
+        }
+        var explicit = new HashMap<String,String>();
+        var selectedMarks = items.stream().map(RelabelItem::getCartonMark).toList();
+        available.removeIf(box -> mappings.entrySet().stream().anyMatch(entry -> box.cartonMark().equals(entry.getValue()) && !selectedMarks.contains(entry.getKey())));
+        for (var binding : requested == null ? List.<com.baiyue.lastleg.palletops.dto.PalletOperationRequests.MeasuredCartonBinding>of() : requested) {
+            if (binding == null || binding.cartonMark() == null || binding.sourceCartonMark() == null
+                || items.stream().noneMatch(item -> binding.cartonMark().equals(item.getCartonMark()))
+                || explicit.put(binding.cartonMark(),binding.sourceCartonMark()) != null)
+                throw conflict("实测箱选择无效或重复");
+        }
+        var result = new ArrayList<Move>();
+        for (var item : items) {
+            if (!Integer.valueOf(1).equals(item.getNotifiedPackageCount())) throw conflict("按箱测量的换标明细必须对应一个实测箱");
+            String prior = mappings.get(item.getCartonMark()), chosen = explicit.get(item.getCartonMark());
+            if (prior != null && chosen != null && !prior.equals(chosen)) throw conflict("改绑托盘不能替换已绑定的实测箱");
+            if (chosen == null) chosen = prior;
+            final String key = chosen;
+            var matched = available.stream().filter(box -> key != null ? key.equals(box.cartonMark())
+                : item.getCartonMark().equals(box.cartonMark()) || item.getCartonMark().equals(box.customerCartonMark())).toList();
+            RelabelPalletMeasurementMapper.Carton box = matched.size() == 1 ? matched.get(0) : null;
+            // Identical measurements may be allocated without a further scan; mixed specifications require an explicit choice.
+            if (box == null && chosen == null && !available.isEmpty() && available.stream().allMatch(b -> sameSpec(available.get(0), b))) box = available.get(0);
+            if (box == null) throw conflict("请选择本次换标对应的来源实测箱，箱规不同不能自动分摊体积和重量");
+            if (!positive(box.lengthCm()) || !positive(box.widthCm()) || !positive(box.heightCm()) || !positive(box.grossWeightKg()))
+                throw conflict("来源箱缺少有效实测尺寸或重量，请先完成箱测量");
+            available.remove(box);
+            result.add(new Move(item.getCartonMark(),box.cartonMark(),targetPallet,targetCode));
+        }
+        return result;
+    }
+    private boolean sameSpec(RelabelPalletMeasurementMapper.Carton a, RelabelPalletMeasurementMapper.Carton b) {
+        return equal(a.lengthCm(),b.lengthCm()) && equal(a.widthCm(),b.widthCm()) && equal(a.heightCm(),b.heightCm()) && equal(a.grossWeightKg(),b.grossWeightKg());
+    }
+    private boolean equal(java.math.BigDecimal a, java.math.BigDecimal b) { return a != null && b != null && a.compareTo(b) == 0; }
+    private boolean positive(java.math.BigDecimal value) { return value != null && value.signum() > 0; }
+    private List<PdaRelabelHistory> records(RelabelApplication app) {
+        return histories.selectList(new QueryWrapper<PdaRelabelHistory>().eq("customer_id",app.getCustomerId())
+            .eq("application_id",app.getId()).orderByAsc("created_at","id"));
+    }
+    private static ResponseStatusException conflict(String message) { return new ResponseStatusException(HttpStatus.CONFLICT,message); }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/relabel/service/RelabelPalletMeasurementService.java b/lastleg-service/src/main/java/com/baiyue/lastleg/relabel/service/RelabelPalletMeasurementService.java
new file mode 100644
index 000000000..4646fa63e
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/relabel/service/RelabelPalletMeasurementService.java
@@ -0,0 +1,181 @@
+package com.baiyue.lastleg.relabel.service;
+
+import com.baomidou.mybatisplus.core.conditions.query.QueryWrapper;
+import com.baomidou.mybatisplus.core.toolkit.IdWorker;
+import com.baiyue.lastleg.relabel.entity.RelabelApplication;
+import com.baiyue.lastleg.relabel.mapper.*;
+import com.baiyue.lastleg.relabel.pda.entity.PdaRelabelHistory;
+import com.baiyue.lastleg.relabel.pda.mapper.*;
+import com.baiyue.lastleg.pda.security.PdaWarehouseIdentity;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import jakarta.annotation.Resource;
+import jakarta.validation.constraints.*;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Transactional;
+import org.springframework.http.HttpStatus;
+import org.springframework.web.server.ResponseStatusException;
+import java.math.*;
+import java.time.LocalDateTime;
+import java.util.*;
+
+/** Measurements are audited relabel facts, valid only for the measured inventory composition/version. */
+@Service
+public class RelabelPalletMeasurementService {
+    @Resource private RelabelPalletMeasurementMapper mapper;
+    @Resource private RelabelApplicationMapper applications;
+    @Resource private RelabelItemMapper items;
+    @Resource private PdaRelabelHistoryMapper histories;
+    @Resource private PdaRelabelTaskMapper tasks;
+    @Resource private ObjectMapper json;
+    @Resource private RelabelCartonMeasurementService cartonMeasurements;
+    public record Measure(@NotBlank @Size(max=64) String relabelNo, @NotBlank @Size(max=128) String palletCode,
+        @NotBlank @Size(max=128) String idempotencyKey, @NotBlank @Size(max=32768) String stockVersion,
+        @NotNull @DecimalMin("0.01") @Digits(integer=6,fraction=2) BigDecimal lengthCm,
+        @NotNull @DecimalMin("0.01") @Digits(integer=6,fraction=2) BigDecimal widthCm,
+        @NotNull @DecimalMin("0.01") @Digits(integer=6,fraction=2) BigDecimal heightCm,
+        @NotNull @DecimalMin("0.01") @Digits(integer=9,fraction=3) BigDecimal grossWeightKg) {}
+    public record Measurement(Long palletId, String palletCode, long packages, String stockVersion,
+        BigDecimal lengthCm, BigDecimal widthCm, BigDecimal heightCm, BigDecimal grossWeightKg,
+        BigDecimal volumeCbm, boolean inherited, List<RelabelPalletMeasurementMapper.CartonSpec> sourceCartonSpecs,
+        boolean cartonAggregated, List<RelabelPalletMeasurementMapper.Carton> cartons) {
+        public Measurement(Long palletId, String palletCode, long packages, String stockVersion,
+            BigDecimal lengthCm, BigDecimal widthCm, BigDecimal heightCm, BigDecimal grossWeightKg,
+            BigDecimal volumeCbm, boolean inherited) {
+            this(palletId, palletCode, packages, stockVersion, lengthCm, widthCm, heightCm,
+                grossWeightKg, volumeCbm, inherited, List.of(), false, List.of());
+        }
+    }
+
+    public List<Measurement> list(PdaWarehouseIdentity identity, String relabelNo) {
+        return snapshots(scoped(identity, relabelNo, false));
+    }
+    private RelabelApplication scoped(PdaWarehouseIdentity identity, String no, boolean lock) {
+        var app = lock ? applications.lockAnyByRelabelNo(no) : applications.findAnyByRelabelNo(no);
+        if (app == null || !Objects.equals(app.getOverseasWarehouseId(), String.valueOf(identity.overseasWarehouseId())))
+            throw conflict("换标单不属于当前海外仓");
+        return app;
+    }
+    @Transactional(isolation=org.springframework.transaction.annotation.Isolation.READ_COMMITTED)
+    public List<Measurement> save(PdaWarehouseIdentity identity, Measure request) {
+        var app = scoped(identity, request.relabelNo(), true);
+        if (!Set.of("PROCESSING", "READY_FOR_OUTBOUND").contains(app.getStatus())
+            || app.getOutboundOrderNo() != null && !app.getOutboundOrderNo().isBlank()
+            || app.getFulfillmentStatus() != null && !Set.of("WAIT_RELABEL", "WAIT_PRE_DISPATCH").contains(app.getFulfillmentStatus()))
+            throw conflict("已排车或出库的换标单不能修改测量");
+        var task = tasks.find(app.getCustomerId(), app.getId());
+        if (task == null || "PROCESSING".equals(app.getStatus()) && (!"PROCESSING".equals(task.getStatus()) || !identity.operatorKey().equals(task.getOperatorKey())))
+            throw conflict("请先认领当前换标任务");
+        var records = histories(app);
+        String payload = write(request);
+        for (var history : records) if ("PALLET_MEASURE".equals(history.getAction())) {
+            var data = tree(history);
+            if (request.idempotencyKey().equals(data.path("request").path("idempotencyKey").asText())) {
+                if (!payload.equals(write(json.convertValue(data.path("request"), Measure.class))))
+                    throw conflict("测量幂等键不能用于不同数据");
+                return snapshots(app);
+            }
+        }
+        mapper.lockStock(app.getCustomerId(), app.getOverseasWarehouseId(), request.palletCode());
+        var current = snapshots(app).stream().filter(p -> p.palletCode().equals(request.palletCode())).findFirst()
+            .orElseThrow(() -> conflict("托盘不属于本换标单或已经清空"));
+        if (!current.stockVersion().equals(request.stockVersion())) throw conflict("托盘库存已变化，请刷新后重新测量");
+        if (current.cartonAggregated()) throw conflict("本托盘按实测箱自动汇总体积和重量，无需确认整托实测");
+        var measured = new Measurement(current.palletId(), current.palletCode(), current.packages(), current.stockVersion(),
+            request.lengthCm(), request.widthCm(), request.heightCm(), request.grossWeightKg(),
+            request.lengthCm().multiply(request.widthCm()).multiply(request.heightCm()).movePointLeft(6).setScale(6, RoundingMode.HALF_UP), false);
+        var history = new PdaRelabelHistory(); history.setId(IdWorker.getId()); history.setTaskId(task.getId());
+        history.setApplicationId(app.getId()); history.setCustomerId(app.getCustomerId()); history.setAction("PALLET_MEASURE");
+        history.setOperatorKey(identity.operatorKey()); history.setOperatorName(identity.operatorName());
+        history.setFromStatus(task.getStatus()); history.setToStatus(task.getStatus()); history.setCreatedAt(LocalDateTime.now());
+        history.setDetailJson(write(Map.of("request", request, "measurement", measured))); histories.insert(history);
+        return snapshots(app);
+    }
+    public List<Measurement> snapshots(RelabelApplication app) {
+        Long transferId = mapper.transfer(app.getCustomerId(), app.getRelabelNo());
+        if (transferId == null) return List.of(); // Other relabel sources retain their own physical measurement contract.
+        var stock = mapper.stock(app.getCustomerId(), app.getOverseasWarehouseId());
+        var originals = mapper.originals(app.getCustomerId(), transferId);
+        var cartonSpecs = mapper.cartonSpecs(app.getCustomerId(), transferId);
+        var involved = new HashSet<Long>(); originals.forEach(p -> involved.add(p.palletId()));
+        var positions = items.selectList(new QueryWrapper<com.baiyue.lastleg.relabel.entity.RelabelItem>()
+            .eq("customer_id", app.getCustomerId()).eq("application_id", app.getId()));
+        var positionIds = positions.stream().map(i -> i.getSourceInventoryPositionId()).toList();
+        stock.stream().filter(p -> positionIds.contains(p.id())).forEach(p -> involved.add(p.palletId()));
+        var records = histories(app);
+        var currentBoxes = cartonMeasurements.current(app);
+        var codes = new HashSet<String>();
+        for (var h : records) if ("PALLET_BIND".equals(h.getAction())) {
+            tree(h).path("sourcePallets").forEach(p -> codes.add(p.asText()));
+            tree(h).path("targetPallets").forEach(p -> codes.add(p.asText()));
+        }
+        stock.stream().filter(p -> codes.contains(p.palletNo())).forEach(p -> involved.add(p.palletId()));
+        currentBoxes.forEach(box -> involved.add(box.palletId()));
+        var result = new ArrayList<Measurement>();
+        for (Long pallet : involved.stream().filter(Objects::nonNull).sorted().toList()) {
+            var rows = stock.stream().filter(p -> pallet.equals(p.palletId()) && p.packages() > 0).toList();
+            long count = rows.stream().mapToLong(p -> p.packages()).sum(); if (count == 0) continue;
+            String version = rows.stream().map(p -> p.id()+":"+p.version()+":"+p.packages()).collect(java.util.stream.Collectors.joining(","));
+            if (!currentBoxes.isEmpty()) {
+                var boxes = currentBoxes.stream().filter(box -> pallet.equals(box.palletId())).toList();
+                boolean complete = boxes.size() == count && boxes.stream().allMatch(box -> positive(box.lengthCm())
+                    && positive(box.widthCm()) && positive(box.heightCm()) && positive(box.grossWeightKg()));
+                var specs = new LinkedHashMap<List<BigDecimal>,Long>();
+                if (complete) for (var box : boxes) specs.merge(List.of(box.lengthCm(),box.widthCm(),box.heightCm(),box.grossWeightKg()),1L,Long::sum);
+                var grouped = specs.entrySet().stream().map(entry -> new RelabelPalletMeasurementMapper.CartonSpec(pallet,
+                    entry.getKey().get(0),entry.getKey().get(1),entry.getKey().get(2),entry.getKey().get(3),entry.getValue())).toList();
+                BigDecimal volume = complete ? boxes.stream().map(box -> box.lengthCm().multiply(box.widthCm()).multiply(box.heightCm()).movePointLeft(6))
+                    .reduce(BigDecimal.ZERO,BigDecimal::add).setScale(6,RoundingMode.HALF_UP) : null;
+                BigDecimal weight = complete ? boxes.stream().map(RelabelPalletMeasurementMapper.Carton::grossWeightKg).reduce(BigDecimal.ZERO,BigDecimal::add) : null;
+                result.add(new Measurement(pallet,rows.get(0).palletNo(),count,version,null,null,null,weight,volume,true,grouped,true,boxes));
+                continue;
+            }
+            Measurement value = null;
+            for (var h : records) if ("PALLET_MEASURE".equals(h.getAction())) {
+                var measured = json.convertValue(tree(h).path("measurement"), Measurement.class);
+                if (pallet.equals(measured.palletId()) && version.equals(measured.stockVersion())) value = measured;
+            }
+            if (value == null && mapper.movements(app.getCustomerId(), pallet) == 0) {
+                var original = originals.stream().filter(p -> pallet.equals(p.palletId()) && p.packages() == count).findFirst().orElse(null);
+                if (original != null) value = new Measurement(pallet, rows.get(0).palletNo(), count, version,
+                    positiveOrNull(original.lengthCm()), positiveOrNull(original.widthCm()), positiveOrNull(original.heightCm()),
+                    original.grossWeightKg(), original.volumeCbm(), true,
+                    cartonSpecs.stream().filter(spec -> pallet.equals(spec.palletId())).toList(), false, List.of());
+            }
+            result.add(value == null ? new Measurement(pallet, rows.get(0).palletNo(), count, version, null,null,null,null,null,false) : value);
+        }
+        return result;
+    }
+    public void requireMeasured(RelabelApplication app) {
+        for (var p : snapshots(app)) if (p.grossWeightKg() == null || p.volumeCbm() == null
+            || !(positive(p.lengthCm()) && positive(p.widthCm()) && positive(p.heightCm())) && !completeSourceCartons(p)
+            || p.grossWeightKg().signum() <= 0 || p.volumeCbm().signum() <= 0)
+            throw conflict("托盘 " + p.palletCode() + (p.cartonAggregated()
+                ? " 实测箱数据不完整或与库存箱数不一致，请刷新核对来源箱"
+                : " 拆合托后尚未确认实测尺寸和重量，请在 PDA 补测（含原托盘剩余货物）"));
+    }
+    private boolean completeSourceCartons(Measurement p) {
+        if (!p.inherited() || p.sourceCartonSpecs() == null || p.sourceCartonSpecs().isEmpty()) return false;
+        long count = 0; BigDecimal volume = BigDecimal.ZERO, weight = BigDecimal.ZERO;
+        for (var spec : p.sourceCartonSpecs()) {
+            if (spec.cartons() <= 0 || !positive(spec.lengthCm()) || !positive(spec.widthCm())
+                || !positive(spec.heightCm()) || !positive(spec.grossWeightKg())) return false;
+            count += spec.cartons();
+            var boxes = BigDecimal.valueOf(spec.cartons());
+            volume = volume.add(spec.lengthCm().multiply(spec.widthCm()).multiply(spec.heightCm()).movePointLeft(6).multiply(boxes));
+            weight = weight.add(spec.grossWeightKg().multiply(boxes));
+        }
+        return count == p.packages() && volume.setScale(6, RoundingMode.HALF_UP).compareTo(p.volumeCbm()) == 0
+            && weight.compareTo(p.grossWeightKg()) == 0;
+    }
+    private static boolean positive(BigDecimal value) { return value != null && value.signum() > 0; }
+    private static BigDecimal positiveOrNull(BigDecimal value) { return positive(value) ? value : null; }
+    private List<PdaRelabelHistory> histories(RelabelApplication app) {
+        return histories.selectList(new QueryWrapper<PdaRelabelHistory>().eq("customer_id", app.getCustomerId())
+            .eq("application_id", app.getId()).orderByAsc("created_at","id"));
+    }
+    private com.fasterxml.jackson.databind.JsonNode tree(PdaRelabelHistory h) {
+        try { return json.readTree(h.getDetailJson()); } catch (Exception e) { throw conflict("托盘测量记录无法读取"); }
+    }
+    private String write(Object value) { try { return json.writeValueAsString(value); } catch (Exception e) { throw new IllegalStateException(e); } }
+    private static ResponseStatusException conflict(String message) { return new ResponseStatusException(HttpStatus.CONFLICT,message); }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/relabel/service/ReturnRelabelPackingService.java b/lastleg-service/src/main/java/com/baiyue/lastleg/relabel/service/ReturnRelabelPackingService.java
new file mode 100644
index 000000000..0d3d23925
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/relabel/service/ReturnRelabelPackingService.java
@@ -0,0 +1,136 @@
+package com.baiyue.lastleg.relabel.service;
+
+import com.baiyue.lastleg.pda.security.PdaWarehouseIdentity;
+import com.baiyue.lastleg.relabel.entity.RelabelApplication;
+import com.baiyue.lastleg.relabel.entity.RelabelItem;
+import com.baiyue.lastleg.relabel.mapper.RelabelItemMapper;
+import com.baiyue.lastleg.returnreceipt.dto.ReturnInventoryRequests;
+import com.baiyue.lastleg.returnreceipt.dto.ReturnInventoryResponses;
+import com.baiyue.lastleg.returnreceipt.mapper.ReturnInventoryCartonMapper;
+import com.baiyue.lastleg.returnreceipt.service.ReturnInventoryService;
+import jakarta.annotation.Resource;
+import org.springframework.stereotype.Service;
+import java.util.*;
+
+/** Called inside the owned PDA task transaction; materializes only its completed pieces. */
+@Service
+public class ReturnRelabelPackingService {
+    @Resource private ReturnInventoryService inventory;
+    @Resource private ReturnInventoryCartonMapper cartons;
+    @Resource private RelabelItemMapper items;
+    @Resource private com.baiyue.lastleg.returnreceipt.mapper.ReturnInventoryCartonItemMapper cartonItems;
+    @Resource private com.baiyue.lastleg.returnreceipt.mapper.ReturnRelabelCompletionLedgerMapper completionLedger;
+    @Resource private com.baiyue.lastleg.relabel.pda.mapper.PdaRelabelUnitFactMapper facts;
+    @Resource private com.baiyue.lastleg.relabel.pda.mapper.PdaRelabelHistoryMapper histories;
+    @Resource private com.baiyue.lastleg.relabel.pda.mapper.PdaRelabelTaskMapper tasks;
+    @Resource private com.fasterxml.jackson.databind.ObjectMapper json;
+
+    @org.springframework.transaction.annotation.Transactional
+    public ReturnInventoryResponses.MergeResult pack(PdaWarehouseIdentity identity, RelabelApplication app,
+        List<RelabelItem> selected, ReturnInventoryRequests.BoxMerge request) {
+        if (request.targetCartonMark() != null || selected.isEmpty()) throw conflict("换标合箱必须生成独立新箱");
+        var marks = selected.stream().map(RelabelItem::getCartonMark).distinct().sorted().toList();
+        if (!new HashSet<>(marks).equals(new HashSet<>(request.sourceCartonMarks()))) throw conflict("请扫描本次换标全部来源包裹/箱");
+        if (selected.stream().map(RelabelItem::getDestinationFbaWarehouseCode).distinct().count() != 1)
+            throw conflict("不同目的仓不能合箱");
+        var deductions = deductions(selected);
+        if (request.sourceDeductions() != null && !totals(deductions).equals(totals(request.sourceDeductions())))
+            throw conflict("合箱数量必须等于本次已完成换标的明细数量");
+        var inheritedTransfers = new ArrayList<Map<String, Object>>();
+        for (String mark : marks) {
+            var source = cartons.lockMark(mark);
+            if (source == null || !app.getCustomerId().equals(source.getCustomerId())
+                || !app.getId().equals(source.getRelabelApplicationId()) || !"RELABEL_PENDING".equals(source.getStatus()))
+                throw conflict("来源包裹/箱已变化，请刷新");
+            var prior = items.priorCompletedReturnItems(app.getCustomerId(), source.getId(), app.getId());
+            if (!prior.isEmpty()) {
+                var ids = prior.stream().map(i -> i.getId().toString()).toList();
+                var raw = inheritedQuantities(prior);
+                var physical = new HashMap<String, Long>();
+                cartonItems.lockCarton(source.getId()).forEach(i -> physical.merge(i.getSkuCode().toUpperCase(Locale.ROOT), i.getQuantity(), Math::addExact));
+                var moved = new ArrayList<Map<String, Object>>();
+                for (var entry : totals(deductions).entrySet()) {
+                    if (!mark.equals(entry.getKey().get(0))) continue;
+                    String sku = entry.getKey().get(1).toUpperCase(Locale.ROOT);
+                    long inherited = raw.getOrDefault(sku, 0L) - completionLedger.deductedQuantity(ids, sku);
+                    long stock = physical.getOrDefault(sku, 0L);
+                    if (inherited < 0 || inherited > stock) throw conflict("历史换标实物归属与来源库存不一致，请核对来源");
+                    if (inherited > 0 && inherited < stock && entry.getValue() < stock)
+                        throw conflict("已换标与未换标货物来源不能自动猜测，请整箱隔离后重新换标");
+                    long transfer = Math.min(inherited, entry.getValue());
+                    if (transfer > 0) moved.add(Map.of("skuCode", sku, "quantity", transfer));
+                }
+                if (!moved.isEmpty()) inheritedTransfers.add(Map.of("sourceItemIds", ids, "sourceCartonMark", mark, "items", moved));
+            }
+            source.setStatus("AVAILABLE"); cartons.updateById(source);
+        }
+        var result = inventory.mergeBoxes(identity, new ReturnInventoryRequests.BoxMerge(marks, null,
+            "RELABEL-PACK:" + app.getId() + ":" + request.idempotencyKey(), deductions,
+            request.length(), request.width(), request.height(), request.weight()));
+        for (String mark : marks) {
+            var source = cartons.lockMark(mark);
+            cartons.clearRelabel(source.getId());
+        }
+        var target = cartons.lockMark(result.cartonMark());
+        target.setStatus("RELABEL_PENDING"); target.setRelabelApplicationId(app.getId());
+        target.setRelabelNo(app.getRelabelNo()); target.setRelabelStatus("PROCESSING");
+        target.setDestinationWarehouseCode(selected.get(0).getDestinationFbaWarehouseCode());
+        cartons.updateById(target);
+        for (var item : selected) {
+            item.setReturnCartonId(target.getId()); item.setCartonMark(target.getCartonMark());
+            items.updateById(item);
+        }
+        if (!inheritedTransfers.isEmpty()) {
+            var task = tasks.find(app.getCustomerId(), app.getId());
+            for (var transfer : inheritedTransfers) {
+                var detail = new LinkedHashMap<String, Object>(transfer);
+                detail.put("targetCartonMark", result.cartonMark()); detail.put("targetApplicationId", app.getId().toString());
+                var history = new com.baiyue.lastleg.relabel.pda.entity.PdaRelabelHistory();
+                history.setId(com.baomidou.mybatisplus.core.toolkit.IdWorker.getId()); history.setTaskId(task.getId());
+                history.setApplicationId(app.getId()); history.setCustomerId(app.getCustomerId());
+                history.setAction("RETURN_COMPLETION_TRANSFER"); history.setFromStatus("PROCESSING"); history.setToStatus("PROCESSING");
+                history.setOperatorKey(identity.operatorKey()); history.setOperatorName(identity.operatorName());
+                try { history.setDetailJson(json.writeValueAsString(detail)); }
+                catch (java.io.IOException failure) { throw new IllegalStateException(failure); }
+                history.setCreatedAt(java.time.LocalDateTime.now()); histories.insert(history);
+            }
+        }
+        return result;
+    }
+
+    private Map<String, Long> inheritedQuantities(List<RelabelItem> prior) {
+        var completed = facts.selectList(new com.baomidou.mybatisplus.core.conditions.query.QueryWrapper<com.baiyue.lastleg.relabel.pda.entity.PdaRelabelUnitFact>()
+            .in("item_id", prior.stream().map(RelabelItem::getId).toList()).eq("result", "RELABELLED"));
+        var result = new HashMap<String, Long>();
+        for (var item : prior) {
+            long count = completed.stream().filter(f -> item.getId().equals(f.getItemId())).mapToLong(f -> f.getQuantity() == null ? 1 : f.getQuantity()).sum();
+            if ("RETURN_BULK_SKU_LABEL".equals(item.getOperationType())) result.merge(item.getSkuCode().toUpperCase(Locale.ROOT), count, Math::addExact);
+            else for (var deduction : deductions(List.of(item)))
+                result.merge(deduction.skuCode().toUpperCase(Locale.ROOT), Math.multiplyExact(count, deduction.quantity()), Math::addExact);
+        }
+        return result;
+    }
+
+    public List<ReturnInventoryRequests.SourceDeduction> deductions(List<RelabelItem> selected) {
+        var deductions = new ArrayList<ReturnInventoryRequests.SourceDeduction>();
+        for (var i : selected) {
+            if ("RETURN_BULK_SKU_LABEL".equals(i.getOperationType())) deductions.add(new ReturnInventoryRequests.SourceDeduction(i.getCartonMark(), i.getSkuCode(), i.getNotifiedPackageCount()));
+            else try {
+                for (var sku : json.readTree(i.getSkuRelabelItemsJson())) deductions.add(new ReturnInventoryRequests.SourceDeduction(i.getCartonMark(), sku.path("skuCode").asText(), sku.path("quantity").asLong()));
+            } catch (java.io.IOException failure) { throw conflict("换标 SKU 明细无法读取"); }
+        }
+        return deductions;
+    }
+    private Map<List<String>, Long> totals(List<ReturnInventoryRequests.SourceDeduction> lines) {
+        var result = new LinkedHashMap<List<String>, Long>();
+        for (var line : lines) {
+            if (line.quantity() <= 0) throw conflict("合箱扣减数量必须为正数");
+            result.merge(List.of(line.cartonMark(), line.skuCode()), line.quantity(), Math::addExact);
+        }
+        return result;
+    }
+
+    private RuntimeException conflict(String reason) {
+        return new org.springframework.web.server.ResponseStatusException(org.springframework.http.HttpStatus.CONFLICT, reason);
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/relabel/service/ReturnSkuConversionService.java b/lastleg-service/src/main/java/com/baiyue/lastleg/relabel/service/ReturnSkuConversionService.java
new file mode 100644
index 000000000..b73f5a853
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/relabel/service/ReturnSkuConversionService.java
@@ -0,0 +1,216 @@
+package com.baiyue.lastleg.relabel.service;
+
+import com.baomidou.mybatisplus.core.toolkit.IdWorker;
+import com.baiyue.lastleg.relabel.entity.RelabelApplication;
+import com.baiyue.lastleg.relabel.entity.RelabelItem;
+import com.baiyue.lastleg.relabel.pda.entity.PdaRelabelUnitFact;
+import com.baiyue.lastleg.relabel.pda.entity.PdaRelabelHistory;
+import com.baiyue.lastleg.returnreceipt.entity.*;
+import com.baiyue.lastleg.returnreceipt.mapper.*;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import jakarta.annotation.Resource;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Transactional;
+import org.springframework.http.HttpStatus;
+import org.springframework.web.server.ResponseStatusException;
+import java.time.LocalDateTime;
+import java.util.*;
+
+/** Converts physical contents and SKU balances together; the carton itself never gains or loses pieces. */
+@Service
+public class ReturnSkuConversionService {
+    @Resource private ReturnSkuConversionMapper conversions;
+    @Resource private ReturnInventoryCartonMapper cartons;
+    @Resource private ReturnInventoryCartonItemMapper contents;
+    @Resource private ReturnInventoryBalanceMapper balances;
+    @Resource private ReturnPackingTraceMapper traces;
+    @Resource private ReturnInventoryOperationMapper operations;
+    @Resource private ObjectMapper json;
+
+    @Transactional
+    public void apply(RelabelApplication app, List<RelabelItem> items, List<PdaRelabelUnitFact> facts, String round) {
+        apply(app, items, facts, round, List.of());
+    }
+
+    @Transactional
+    public void apply(RelabelApplication app, List<RelabelItem> items, List<PdaRelabelUnitFact> facts, String round,
+                      List<PdaRelabelHistory> scans) {
+        var existing = new ArrayList<>(conversions.lockApplication(app.getCustomerId(), app.getId()));
+        for (var item : items.stream().sorted(Comparator.comparing(RelabelItem::getReturnCartonId,
+                Comparator.nullsLast(Comparator.naturalOrder())).thenComparing(RelabelItem::getId)).toList()) {
+            if (item.getReturnCartonId() == null || !Set.of("SKU_LABEL", "RETURN_BULK_SKU_LABEL", "CARTON_AND_SKU").contains(item.getOperationType())) continue;
+            long completed = facts.stream().filter(f -> item.getId().equals(f.getItemId()) && "RELABELLED".equals(f.getResult()))
+                .mapToLong(f -> f.getQuantity() == null ? 1 : f.getQuantity()).sum();
+            if (completed == 0 && scans.isEmpty()) continue;
+            var carton = ownedCarton(app, item.getReturnCartonId());
+            try {
+                if ("RETURN_BULK_SKU_LABEL".equals(item.getOperationType())) {
+                    // 按件贴标未声明 SKU 编码变更时只保留作业事实，不生成不存在的新 SKU。
+                    if (completed == 0 || item.getNewSkuCode() == null || item.getNewSkuCode().isBlank()) continue;
+                    convert(app, item, carton, item.getSkuCode(), item.getNewSkuCode(), completed, round, existing);
+                } else {
+                    var approved = json.readTree(item.getSkuRelabelItemsJson());
+                    var doneIndices = new HashSet<Integer>();
+                    if (completed == 0) for (var scan : scans) {
+                        if (!"SKU_SCAN".equals(scan.getAction())) continue;
+                        var detail = json.readTree(scan.getDetailJson());
+                        if (!round.equals(detail.path("round").asText()) || !item.getId().toString().equals(detail.path("itemId").asText())) continue;
+                        int index = detail.path("skuIndex").asInt(-1);
+                        if (index < 0 || index >= approved.size()) throw conflict("SKU 扫描明细索引无效");
+                        var sku = approved.get(index);
+                        if (!sku.path("skuCode").asText().equals(detail.path("oldSku").asText())
+                            || !sku.path("newSkuCode").asText().equals(detail.path("newSku").asText())
+                            || sku.path("quantity").asLong() != detail.path("quantity").asLong()) throw conflict("SKU 扫描记录与批准明细不一致");
+                        doneIndices.add(index);
+                    }
+                    for (int index = 0; index < approved.size(); index++) {
+                        if (completed == 0 && !doneIndices.contains(index)) continue;
+                        var sku = approved.get(index);
+                        convert(app, item, carton, sku.path("skuCode").asText(), sku.path("newSkuCode").asText(),
+                            Math.multiplyExact(completed == 0 ? 1 : completed, sku.path("quantity").asLong()), round, existing);
+                    }
+                }
+            } catch (java.io.IOException failure) { throw conflict("换标 SKU 明细无法读取"); }
+            refreshTypes(carton);
+        }
+    }
+
+    private void convert(RelabelApplication app, RelabelItem item, ReturnInventoryCarton carton,
+            String oldSku, String newSku, long quantity, String round, List<ReturnSkuConversion> existing) {
+        oldSku = code(oldSku); newSku = code(newSku);
+        if (quantity <= 0 || oldSku.equalsIgnoreCase(newSku)) throw conflict("新旧 SKU 必须不同且换标数量必须大于零");
+        for (var row : existing) if (item.getId().equals(row.getItemId()) && round.equals(row.getRoundKey())
+                && oldSku.equalsIgnoreCase(row.getOldSkuCode()) && newSku.equalsIgnoreCase(row.getNewSkuCode())) {
+            if (row.getQuantity() != quantity || "REVERSED".equals(row.getStatus())) throw conflict("本轮换标库存转换已变化");
+            return;
+        }
+        var source = contents.lockSku(carton.getId(), oldSku);
+        if (source == null || n(source.getQuantity()) - n(source.getPackingReservedQuantity()) - n(source.getRelabelledQuantity()) < quantity)
+            throw conflict("旧 SKU 的未换标库存不足：" + oldSku);
+        var target = contents.lockSku(carton.getId(), newSku);
+        boolean removed = source.getQuantity() == quantity, added = target == null;
+        var ownership = ownership(carton, oldSku, source.getQuantity());
+        String product = source.getProductNameZh();
+        source.setQuantity(source.getQuantity() - quantity);
+        if (removed) contents.deleteById(source.getId()); else contents.updateById(source);
+        if (target == null) {
+            target = new ReturnInventoryCartonItem(); target.setId(IdWorker.getId()); target.setCartonId(carton.getId());
+            target.setCustomerId(app.getCustomerId()); target.setSkuCode(newSku); target.setProductNameZh(product);
+            target.setQuantity(quantity); target.setPackingReservedQuantity(0L); target.setRelabelledQuantity(quantity);
+            contents.insert(target);
+        } else {
+            target.setQuantity(Math.addExact(n(target.getQuantity()), quantity));
+            target.setRelabelledQuantity(Math.addExact(n(target.getRelabelledQuantity()), quantity)); contents.updateById(target);
+        }
+        adjustBalances(carton, oldSku, newSku, product, quantity, removed, added);
+        var row = new ReturnSkuConversion(); row.setId(IdWorker.getId()); row.setCustomerId(app.getCustomerId());
+        row.setOverseasWarehouseId(carton.getOverseasWarehouseId()); row.setApplicationId(app.getId()); row.setRelabelNo(app.getRelabelNo());
+        row.setItemId(item.getId()); row.setRoundKey(round); row.setCartonId(carton.getId()); row.setCartonMark(carton.getCartonMark());
+        row.setOldSkuCode(oldSku); row.setNewSkuCode(newSku); row.setProductNameZh(product); row.setQuantity(quantity);
+        row.setStatus("APPLIED"); row.setCompletedAt(LocalDateTime.now());
+        var movedOwners = new ArrayList<ReturnPackingTraceMapper.Ownership>();
+        long remaining = quantity;
+        for (var owner : ownership) {
+            long moved = Math.min(remaining, owner.quantity());
+            if (moved > 0) movedOwners.add(new ReturnPackingTraceMapper.Ownership(owner.returnNo(), moved));
+            remaining -= moved;
+        }
+        if (remaining != 0) throw conflict("SKU 换标来源追溯数量不足");
+        try { row.setOwnershipJson(json.writeValueAsString(movedOwners)); }
+        catch (java.io.IOException failure) { throw new IllegalStateException("Cannot save SKU conversion ownership", failure); }
+        conversions.insert(row); existing.add(row); traceConversion(row, movedOwners, false);
+    }
+
+    @Transactional
+    public void confirm(RelabelApplication app) {
+        for (var row : conversions.lockApplication(app.getCustomerId(), app.getId())) if ("APPLIED".equals(row.getStatus())) {
+            row.setStatus("CONFIRMED"); row.setConfirmedAt(LocalDateTime.now()); conversions.updateById(row);
+        }
+    }
+
+    @Transactional
+    public void reverse(RelabelApplication app) {
+        var rows = new ArrayList<>(conversions.lockApplication(app.getCustomerId(), app.getId())); Collections.reverse(rows);
+        for (var row : rows) {
+            if ("CONFIRMED".equals(row.getStatus())) throw conflict("已确认的 SKU 库存转换不能退回");
+            if (!"APPLIED".equals(row.getStatus())) continue;
+            var carton = ownedCarton(app, row.getCartonId());
+            var source = contents.lockSku(carton.getId(), row.getNewSkuCode());
+            long quantity = row.getQuantity();
+            if (source == null || n(source.getQuantity()) < quantity || n(source.getRelabelledQuantity()) < quantity
+                    || n(source.getPackingReservedQuantity()) > 0) throw conflict("已换标 SKU 库存已变化，不能退回");
+            List<ReturnPackingTraceMapper.Ownership> ownership;
+            try { ownership = json.readValue(row.getOwnershipJson(), new com.fasterxml.jackson.core.type.TypeReference<>() {}); }
+            catch (java.io.IOException failure) { throw conflict("换标来源追溯记录无法读取"); }
+            var target = contents.lockSku(carton.getId(), row.getOldSkuCode());
+            boolean removed = source.getQuantity() == quantity, added = target == null;
+            source.setQuantity(source.getQuantity() - quantity); source.setRelabelledQuantity(source.getRelabelledQuantity() - quantity);
+            if (removed) contents.deleteById(source.getId()); else contents.updateById(source);
+            if (target == null) {
+                target = new ReturnInventoryCartonItem(); target.setId(IdWorker.getId()); target.setCartonId(carton.getId());
+                target.setCustomerId(app.getCustomerId()); target.setSkuCode(row.getOldSkuCode()); target.setProductNameZh(row.getProductNameZh());
+                target.setQuantity(quantity); target.setPackingReservedQuantity(0L); target.setRelabelledQuantity(0L); contents.insert(target);
+            } else { target.setQuantity(Math.addExact(n(target.getQuantity()), quantity)); contents.updateById(target); }
+            adjustBalances(carton, row.getNewSkuCode(), row.getOldSkuCode(), row.getProductNameZh(), quantity, removed, added);
+            traceConversion(row, ownership, true);
+            row.setStatus("REVERSED"); row.setReversedAt(LocalDateTime.now()); conversions.updateById(row); refreshTypes(carton);
+        }
+    }
+
+    private void adjustBalances(ReturnInventoryCarton carton, String oldSku, String newSku, String product,
+            long quantity, boolean removed, boolean added) {
+        boolean box = !"PARCEL".equals(carton.getSourceUnitType());
+        if (balances.deductConversion(carton.getCustomerId(), carton.getOverseasWarehouseId(), oldSku, quantity, box && removed ? 1 : 0) != 1)
+            throw conflict("退货 SKU 余额不足：" + oldSku);
+        if (balances.adjust(IdWorker.getId(), carton.getCustomerId(), carton.getOverseasWarehouseId(), newSku,
+                product, quantity, quantity, box && added ? 1 : 0) <= 0) throw conflict("新 SKU 库存入账失败");
+    }
+
+    private ReturnInventoryCarton ownedCarton(RelabelApplication app, long id) {
+        var carton = cartons.lockId(id);
+        if (carton == null || !app.getCustomerId().equals(carton.getCustomerId())
+                || !app.getOverseasWarehouseId().equals(carton.getOverseasWarehouseId())
+                || !app.getId().equals(carton.getRelabelApplicationId()) || !"RELABEL_PENDING".equals(carton.getStatus()))
+            throw conflict("换标来源箱或包裹已变化");
+        return carton;
+    }
+
+    private void refreshTypes(ReturnInventoryCarton carton) {
+        var lines = contents.lockCarton(carton.getId());
+        if (lines.stream().mapToLong(i -> n(i.getQuantity())).sum() != n(carton.getTotalQuantity())) throw conflict("SKU 转换后箱内件数不守恒");
+        carton.setSkuTypes(lines.size()); carton.setUpdatedAt(LocalDateTime.now()); cartons.updateById(carton);
+    }
+
+    private List<ReturnPackingTraceMapper.Ownership> ownership(ReturnInventoryCarton carton, String sku, long quantity) {
+        var result = new ArrayList<>(traces.ownership(carton.getCustomerId(), carton.getCartonMark(), sku));
+        long traced = result.stream().mapToLong(ReturnPackingTraceMapper.Ownership::quantity).sum();
+        if (traced < quantity) {
+            String[] sources = code(carton.getSourceReturnNo()).split(",");
+            if (sources.length != 1) throw conflict("混箱 SKU 缺少来源追溯，不能转换库存");
+            result.add(new ReturnPackingTraceMapper.Ownership(sources[0], quantity - traced));
+        }
+        return result;
+    }
+
+    private void traceConversion(ReturnSkuConversion row, List<ReturnPackingTraceMapper.Ownership> ownership, boolean reverse) {
+        var op = new ReturnInventoryOperation(); op.setId(IdWorker.getId()); op.setOperatorId("SKU_CONVERSION:" + row.getCustomerId());
+        op.setIdempotencyKey(row.getId() + (reverse ? ":REVERSE" : ":APPLY")); op.setRequestHash(op.getIdempotencyKey());
+        op.setOperationType(reverse ? "SKU_CONVERSION_REVERSE" : "SKU_CONVERSION"); op.setResultCartonId(row.getCartonId());
+        op.setResultJson("{}"); op.setCreatedAt(LocalDateTime.now()); op.setUpdatedAt(op.getCreatedAt()); operations.insert(op);
+        long remaining = row.getQuantity();
+        for (var owner : ownership) {
+            long moved = Math.min(remaining, owner.quantity()); if (moved == 0) continue;
+            traces.insert(IdWorker.getId(), row.getCustomerId(), op.getId(), row.getCartonMark(), "", owner.returnNo(),
+                reverse ? row.getNewSkuCode() : row.getOldSkuCode(), moved, op.getCreatedAt());
+            traces.insert(IdWorker.getId(), row.getCustomerId(), op.getId(), "", row.getCartonMark(), owner.returnNo(),
+                reverse ? row.getOldSkuCode() : row.getNewSkuCode(), moved, op.getCreatedAt());
+            remaining -= moved;
+        }
+        if (remaining != 0) throw conflict("SKU 换标来源追溯数量不足");
+    }
+    private static long n(Long value) { return value == null ? 0 : value; }
+    private static String code(String value) {
+        if (value == null || value.isBlank()) throw conflict("SKU 或来源单号缺失"); return value.trim();
+    }
+    private static ResponseStatusException conflict(String message) { return new ResponseStatusException(HttpStatus.CONFLICT, message); }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/controller/PdaReturnInventoryController.java b/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/controller/PdaReturnInventoryController.java
index 689ad53da..80cde6628 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/controller/PdaReturnInventoryController.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/controller/PdaReturnInventoryController.java
@@ -24,6 +24,11 @@ public class PdaReturnInventoryController {
     @Resource private ReturnInventoryService service;
     @Resource private com.baiyue.lastleg.returnreceipt.service.ReturnCartonCountService counting;
 
+    @PostMapping("/cartons/{cartonMark}/confirm-label")
+    public ApiResponse<ReturnInventoryResponses.Label> confirmLabel(@AuthenticationPrincipal AuthenticatedUser user, @PathVariable String cartonMark) {
+        return ApiResponse.success(service.confirmLabel(PdaWarehouseIdentity.require(user), cartonMark));
+    }
+
     @GetMapping("/counting/tasks")
     public ApiResponse<com.baiyue.common.core.api.PageResult<com.baiyue.lastleg.returnreceipt.dto.ReturnCartonCountDtos.Task>> countingTasks(
         @AuthenticationPrincipal AuthenticatedUser user, @Valid com.baiyue.lastleg.returnreceipt.dto.ReturnCartonCountDtos.Query query) {
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/dto/PdaReturnReceiptRequests.java b/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/dto/PdaReturnReceiptRequests.java
index 2d16026cd..04cef7f7e 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/dto/PdaReturnReceiptRequests.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/dto/PdaReturnReceiptRequests.java
@@ -25,11 +25,18 @@ public final class PdaReturnReceiptRequests {
                           @Size(max = 16) String unitType,
                           @Size(max = 128) String unitCode,
                           BigDecimal length, BigDecimal width, BigDecimal height, BigDecimal weight,
-                          Long totalBoxCount) {
+                          Long totalBoxCount, Boolean originalPackaging) {
         public Confirm(String returnNo, String trackingNo, String startedBy, String palletCode,
                        List<@Valid Item> items, String idempotencyKey) {
             this(returnNo, trackingNo, startedBy, palletCode, items, idempotencyKey,
-                null, null, null, null, null, null, null);
+                null, null, null, null, null, null, null, null);
+        }
+        public Confirm(String returnNo, String trackingNo, String startedBy, String palletCode,
+                       List<@Valid Item> items, String idempotencyKey, String unitType, String unitCode,
+                       BigDecimal length, BigDecimal width, BigDecimal height, BigDecimal weight,
+                       Long totalBoxCount) {
+            this(returnNo, trackingNo, startedBy, palletCode, items, idempotencyKey, unitType, unitCode,
+                length, width, height, weight, totalBoxCount, null);
         }
     }
     public record Item(@NotBlank @Size(max = 128) String skuCode,
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/dto/ReturnCartonCountDtos.java b/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/dto/ReturnCartonCountDtos.java
index ffe6b622e..33475af58 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/dto/ReturnCartonCountDtos.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/dto/ReturnCartonCountDtos.java
@@ -3,14 +3,20 @@ package com.baiyue.lastleg.returnreceipt.dto;
 import jakarta.validation.Valid;
 import jakarta.validation.constraints.*;
 import java.util.List;
+import java.math.BigDecimal;
 
 public final class ReturnCartonCountDtos {
     private ReturnCartonCountDtos() { }
     public record Query(@Min(1) long page, @Min(1) @Max(50) long size, @Size(max=128) String keyword) { }
     public record Sku(String skuCode, String productNameZh, long quantity) { }
-    public record Box(String cartonMark, List<Sku> items) { }
+    public record Box(String cartonMark, List<Sku> items, BigDecimal length, BigDecimal width, BigDecimal height, BigDecimal weight) {
+        public Box(String cartonMark, List<Sku> items) { this(cartonMark, items, null, null, null, null); }
+    }
     public record Task(String receiptNo, String returnNo, String palletCode, String status, List<Sku> expectedItems, List<Box> boxes) { }
     public record CountItem(@NotBlank @Size(max=128) String skuCode, @Min(1) long quantity) { }
-    public record CountBox(@NotBlank @Size(max=128) String cartonMark, @NotEmpty @Size(max=100) List<@NotNull @Valid CountItem> items) { }
+    public record CountBox(@NotBlank @Size(max=128) String cartonMark, @NotEmpty @Size(max=100) List<@NotNull @Valid CountItem> items,
+                           @Positive BigDecimal length, @Positive BigDecimal width, @Positive BigDecimal height, @Positive BigDecimal weight) {
+        public CountBox(String cartonMark, List<@NotNull @Valid CountItem> items) { this(cartonMark, items, null, null, null, null); }
+    }
     public record Confirm(@NotBlank @Size(max=128) String idempotencyKey, @NotEmpty @Size(max=500) List<@NotNull @Valid CountBox> boxes) { }
 }
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/dto/ReturnInventoryRequests.java b/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/dto/ReturnInventoryRequests.java
index e3f4d37d5..8a3158e39 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/dto/ReturnInventoryRequests.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/dto/ReturnInventoryRequests.java
@@ -45,9 +45,13 @@ public final class ReturnInventoryRequests {
                                     @NotEmpty @Size(max = 100) List<@Valid PlanBox> boxes,
                                     @Size(max = 1000) String remark,
                                     @NotBlank @Size(max = 255) String idempotencyKey,
-                                    @Size(max = 500) List<@NotBlank String> sourceCartonMarks) {
+                                    @Size(max = 500) List<@NotBlank String> sourceCartonMarks,
+                                    @Size(max = 1000) List<@Valid SourceDeduction> sourceDeductions) {
+        public PackingPlanCreate(List<String> returnNos, String mode, List<PlanBox> boxes, String remark, String idempotencyKey, List<String> sourceCartonMarks) {
+            this(returnNos, mode, boxes, remark, idempotencyKey, sourceCartonMarks, null);
+        }
         public PackingPlanCreate(List<String> returnNos, String mode, List<PlanBox> boxes, String remark, String idempotencyKey) {
-            this(returnNos, mode, boxes, remark, idempotencyKey, List.of());
+            this(returnNos, mode, boxes, remark, idempotencyKey, List.of(), null);
         }
     }
 
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/dto/ReturnInventoryResponses.java b/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/dto/ReturnInventoryResponses.java
index 9da92ed40..1589e311a 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/dto/ReturnInventoryResponses.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/dto/ReturnInventoryResponses.java
@@ -12,27 +12,42 @@ public final class ReturnInventoryResponses {
     public record CartonSummary(String cartonMark, String overseasWarehouseId, String sourceBatchNo,
                                 String sourceReturnNo, String status, int skuTypes, long totalQuantity,
                                 BigDecimal length, BigDecimal width, BigDecimal height, BigDecimal weight,
-                                LocalDateTime createdAt) { }
+                                LocalDateTime createdAt, String relabelStatus, long relabelledQuantity,
+                                long relabelReservedQuantity) { }
 
     public record InventoryItem(String overseasWarehouseId, String cartonMark, String sourceBatchNo, String status, String skuCode,
                                 String productNameZh, long quantity, int cartonSkuTypes, long cartonTotalQuantity,
-                                LocalDateTime receivedAt) { }
+                                LocalDateTime receivedAt, long relabelledQuantity, long remainingRelabelQuantity) { }
     public record SummaryItem(String overseasWarehouseId, String skuCode, String productNameZh,
-                              long totalQuantity, long availableQuantity, long cartonQuantity, LocalDateTime updatedAt) { }
+                              long totalQuantity, long availableQuantity, long cartonQuantity, LocalDateTime updatedAt,
+                              long relabelLockedQuantity) { }
     public record CartonDetail(String cartonMark, String customerId, String overseasWarehouseId, String sourceBatchNo, String sourceReturnNo, String status,
                                String fbaCartonMark, String destinationWarehouseCode, String destinationWarehouseName, String relabelNo, String relabelStatus,
                                int skuTypes, long totalQuantity, BigDecimal length, BigDecimal width, BigDecimal height,
                                BigDecimal weight, LocalDateTime receivedAt, List<CartonItem> items,
-                               String locationCode, String palletCode, LocalDateTime putawayAt, List<MergeHistory> mergeHistory) { }
+                               String locationCode, String palletCode, LocalDateTime putawayAt, List<MergeHistory> mergeHistory,
+                               long relabelledQuantity, long relabelReservedQuantity, List<SkuConversion> skuConversions) { }
+    public record SkuConversion(String relabelNo, String cartonMark, String oldSkuCode, String newSkuCode,
+                                long quantity, String status, LocalDateTime completedAt) {
+        public static SkuConversion from(com.baiyue.lastleg.returnreceipt.entity.ReturnSkuConversion row) {
+            return new SkuConversion(row.getRelabelNo(), row.getCartonMark(), row.getOldSkuCode(), row.getNewSkuCode(),
+                row.getQuantity(), row.getStatus(), row.getCompletedAt());
+        }
+    }
     public record MergeHistory(String planNo, String sourceCartonMark, String targetCartonMark, String returnNo,
                                String skuCode, long quantity, LocalDateTime createdAt) { }
-    public record CartonItem(String skuCode, String productNameZh, long quantity, long availableQuantity) {
+    public record CartonItem(String skuCode, String productNameZh, long quantity, long availableQuantity,
+                             long relabelledQuantity, long remainingRelabelQuantity) {
+        public CartonItem(String skuCode, String productNameZh, long quantity, long availableQuantity) {
+            this(skuCode, productNameZh, quantity, availableQuantity, 0, availableQuantity);
+        }
         public CartonItem(String skuCode, String productNameZh, long quantity) { this(skuCode, productNameZh, quantity, quantity); }
     }
     public record Label(String cartonMark, String overseasWarehouseId, String customerId, String sourceBatchNo, String sourceReturnNo,
                         long totalQuantity, BigDecimal length, BigDecimal width, BigDecimal height, BigDecimal weight,
                         List<CartonItem> items, LocalDateTime generatedAt, String printableHtml) { }
-    public record MergeResult(String cartonMark, String skuCode, long totalQuantity, Label label, String planNo) {
+    public record MergeResult(String cartonMark, String skuCode, long totalQuantity, Label label, String planNo, String operatorName) {
+        public MergeResult(String cartonMark, String skuCode, long totalQuantity, Label label, String planNo) { this(cartonMark, skuCode, totalQuantity, label, planNo, null); }
         public MergeResult(String cartonMark, String skuCode, long totalQuantity, Label label) { this(cartonMark, skuCode, totalQuantity, label, null); }
     }
     public record PutawayResult(String cartonMark, String locationCode, String palletCode, LocalDateTime putawayAt) { }
@@ -45,19 +60,25 @@ public final class ReturnInventoryResponses {
     public record PackingPlan(String planNo, String customerId, String overseasWarehouseId, List<String> returnNos,
                               String mode, String status, List<PlanBox> boxes, String remark, LocalDateTime pushedAt,
                               List<String> sourceCartonMarks, List<PlanSource> sources,
-                              LocalDateTime createdAt, List<CartonDetail> resultCartons, LocalDateTime completedAt) { }
-    public record PlanSource(String cartonMark, List<PlanItem> items) { }
+                              LocalDateTime createdAt, List<CartonDetail> resultCartons, LocalDateTime completedAt,
+                              List<Label> completionCartons, List<MergeHistory> transfers, String completedBy) { }
+    public record PlanSource(String cartonMark, List<PlanItem> items, String sourceReturnNo,
+                             List<CartonItem> originalItems, String participation) { }
+    public record SourceOwnership(String returnNo, String skuCode, long quantity) { }
+    public record CurrentCarton(CartonDetail carton, List<SourceOwnership> ownership, long orderQuantity,
+                                String labelStatus, boolean canRelabel, String blockReason) { }
     public record PlanBox(int boxNo, List<PlanItem> items, BigDecimal length, BigDecimal width, BigDecimal height, BigDecimal weight) { }
     public record PlanItem(String skuCode, long quantity) { }
     public record PackingPlanCompletion(String planNo, List<Label> labels) { }
     public record PlatformStock(String customerId, String overseasWarehouseId, String skuCode, String productNameZh,
                                 long totalQuantity, long availableQuantity, long cartonQuantity, LocalDateTime updatedAt,
-                                long looseAvailableQuantity) { }
+                                long looseAvailableQuantity, long relabelLockedQuantity) { }
     public record PlatformCarton(String customerId, String overseasWarehouseId, String cartonMark, String sourceReturnNo,
                                  String sourceUnitType, String sourceBatchNo, String status, int skuTypes, long totalQuantity,
                                  String fbaCartonMark, String destinationWarehouseCode, String destinationWarehouseName, String relabelNo, String relabelStatus,
                                  BigDecimal length, BigDecimal width, BigDecimal height, BigDecimal weight,
-                                 LocalDateTime createdAt, String locationCode, String palletCode, LocalDateTime putawayAt) { }
+                                 LocalDateTime createdAt, String locationCode, String palletCode, LocalDateTime putawayAt,
+                                 long relabelledQuantity, long relabelReservedQuantity) { }
     public record PlatformMovement(String customerId, String overseasWarehouseId, String skuCode, String productNameZh,
                                    String movementType, String referenceNo, long totalDelta, long availableDelta,
                                    LocalDateTime occurredAt) { }
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/dto/ReturnOrderRequests.java b/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/dto/ReturnOrderRequests.java
index f577a1e83..def6d9c3e 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/dto/ReturnOrderRequests.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/dto/ReturnOrderRequests.java
@@ -35,6 +35,8 @@ public final class ReturnOrderRequests {
                                 @NotBlank @Size(max = 255) String idempotencyKey,
                                 @Size(max = 1000) String cartonRemark) {}
     public record RelabelItem(@NotBlank @Size(max = 128) String skuCode,
-                              @Positive long quantity) {}
+                              @Positive long quantity, @Size(max = 128) String cartonMark) {
+        public RelabelItem(String skuCode, long quantity) { this(skuCode, quantity, null); }
+    }
     public record Review(@NotBlank String decision, @Size(max = 500) String remark) { }
 }
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/dto/ReturnOrderResponses.java b/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/dto/ReturnOrderResponses.java
index b15224b11..3cbb54494 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/dto/ReturnOrderResponses.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/dto/ReturnOrderResponses.java
@@ -14,7 +14,11 @@ public final class ReturnOrderResponses {
     public record Item(String skuCode, String productNameZh, long expectedQuantity,
                        long receivedQuantity) { }
     public record Detail(Summary order, String remark, List<Item> items, List<Receipt> receipts, List<PalletDetail> pallets, List<Photo> photos,
-                         List<PackingDetail> packingDetails, List<ReceiptCarton> cartons) {
+                         List<PackingDetail> packingDetails, List<ReceiptCarton> cartons,
+                         List<ReturnInventoryResponses.CurrentCarton> currentCartons) {
+        public Detail(Summary order, String remark, List<Item> items, List<Receipt> receipts, List<PalletDetail> pallets, List<Photo> photos, List<PackingDetail> packingDetails, List<ReceiptCarton> cartons) {
+            this(order, remark, items, receipts, pallets, photos, packingDetails, cartons, List.of());
+        }
         public Detail(Summary order, String remark, List<Item> items, List<Receipt> receipts, List<PalletDetail> pallets, List<Photo> photos, List<PackingDetail> packingDetails) {
             this(order, remark, items, receipts, pallets, photos, packingDetails, List.of());
         }
@@ -23,8 +27,14 @@ public final class ReturnOrderResponses {
         }
     }
     public record ReceiptCarton(String receiptNo, String palletCode, String cartonMark, String countStatus,
-                                LocalDateTime countedAt, List<ReceiptItem> items) { }
-    public record PackingDetail(String sourceCartonMark, String targetCartonMark, String returnNo,
+                                LocalDateTime countedAt, List<ReceiptItem> items,
+                                BigDecimal length, BigDecimal width, BigDecimal height, BigDecimal weight) {
+        public ReceiptCarton(String receiptNo, String palletCode, String cartonMark, String countStatus,
+                             LocalDateTime countedAt, List<ReceiptItem> items) {
+            this(receiptNo, palletCode, cartonMark, countStatus, countedAt, items, null, null, null, null);
+        }
+    }
+    public record PackingDetail(String planNo, String sourceCartonMark, String targetCartonMark, String returnNo,
                                 String skuCode, long quantity, LocalDateTime createdAt) { }
     public record Photo(long fileId, String fileName, String contentType, long sizeBytes) { }
     public record PalletDetail(String palletCode, int skuTypes, long totalQuantity, List<PalletItem> items,
@@ -40,18 +50,19 @@ public final class ReturnOrderResponses {
     public record Receipt(String receiptNo, String receiptBatchNo, String palletCode, String trackingNo, String startedBy,
                           long receivedQuantity, String operatorName, LocalDateTime signedAt,
                           String unitType, String unitCode, long boxCount, List<ReceiptItem> items,
-                          String cartonMark, String printableHtml, List<CartonLabel> labels, boolean labelRepairRequired) {
+                          String cartonMark, String printableHtml, List<CartonLabel> labels, boolean labelRepairRequired,
+                          BigDecimal length, BigDecimal width, BigDecimal height, BigDecimal weight) {
         public Receipt(String receiptNo, String receiptBatchNo, String palletCode, String trackingNo, String startedBy,
                        long receivedQuantity, String operatorName, LocalDateTime signedAt,
                        String unitType, String unitCode, long boxCount, List<ReceiptItem> items,
                        String cartonMark, String printableHtml, List<CartonLabel> labels) {
             this(receiptNo, receiptBatchNo, palletCode, trackingNo, startedBy, receivedQuantity, operatorName, signedAt,
-                unitType, unitCode, boxCount, items, cartonMark, printableHtml, labels, false);
+                unitType, unitCode, boxCount, items, cartonMark, printableHtml, labels, false, null, null, null, null);
         }
         public Receipt(String receiptNo, String receiptBatchNo, String palletCode, String trackingNo, String startedBy,
                        long receivedQuantity, String operatorName, LocalDateTime signedAt) {
             this(receiptNo, receiptBatchNo, palletCode, trackingNo, startedBy, receivedQuantity, operatorName, signedAt,
-                "PALLET", palletCode, 0, List.of(), null, null, List.of());
+                "PALLET", palletCode, 0, List.of(), null, null, List.of(), false, null, null, null, null);
         }
     }
     public record CartonLabel(String cartonMark, String printableHtml) { }
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/entity/ReturnInventoryBalance.java b/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/entity/ReturnInventoryBalance.java
index e11a5fb8f..ac6837707 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/entity/ReturnInventoryBalance.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/entity/ReturnInventoryBalance.java
@@ -16,9 +16,12 @@ public class ReturnInventoryBalance {
     private String overseasWarehouseId;
     private String skuCode;
     private String productNameZh;
-    /** 实物总库存；只有实际出库才会减少。 */
+    /** 当前 SKU 的实物总库存；实际出库及 SKU 转换会减少，SKU 转换前后全仓件数守恒。 */
     private Long totalQuantity;
     private Long availableQuantity;
+    /** 因换标整箱锁定的 SKU 件数，仅查询投影，不写入余额表。 */
+    @com.baomidou.mybatisplus.annotation.TableField(exist = false)
+    private Long relabelLockedQuantity;
     private Long cartonQuantity;
     private LocalDateTime createdAt;
     private LocalDateTime updatedAt;
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/entity/ReturnInventoryCarton.java b/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/entity/ReturnInventoryCarton.java
index 89b865f58..d3b03b272 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/entity/ReturnInventoryCarton.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/entity/ReturnInventoryCarton.java
@@ -31,6 +31,8 @@ public class ReturnInventoryCarton {
     private LocalDateTime relabelCompletedAt;
     private String status;
     private String countStatus = "CONFIRMED";
+    /** WAIT_LABEL until the operator scans the affixed warehouse label; null for historical units. */
+    private String labelStatus;
     private LocalDateTime countedAt;
     private String countedBy;
     private Integer skuTypes;
@@ -39,6 +41,7 @@ public class ReturnInventoryCarton {
     private BigDecimal width;
     private BigDecimal height;
     private BigDecimal weight;
+    private Boolean originalPackaging;
     private LocalDateTime createdAt;
     private LocalDateTime updatedAt;
     private LocalDateTime mergedAt;
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/entity/ReturnInventoryCartonItem.java b/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/entity/ReturnInventoryCartonItem.java
index f54303f76..9a1227b3e 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/entity/ReturnInventoryCartonItem.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/entity/ReturnInventoryCartonItem.java
@@ -15,4 +15,6 @@ public class ReturnInventoryCartonItem {
     private String productNameZh;
     private Long quantity;
     private Long packingReservedQuantity;
+    /** 当前 SKU 中已经换过标的实物件数，不再允许二次换标。 */
+    private Long relabelledQuantity;
 }
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/entity/ReturnReceipt.java b/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/entity/ReturnReceipt.java
index 0971daa04..12c1151da 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/entity/ReturnReceipt.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/entity/ReturnReceipt.java
@@ -23,6 +23,10 @@ public class ReturnReceipt {
     private BigDecimal width;
     private BigDecimal height;
     private BigDecimal weight;
+    /** Whether the signed physical unit reused its original box/packaging. */
+    private Boolean originalPackaging;
+    /** PALLET_MEASURED for a measured carrier, UNIT_SUM for child-unit aggregation. */
+    private String measurementSource;
     private String palletCode;
     private String cartonMark;
     private String trackingNo;
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/entity/ReturnSkuConversion.java b/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/entity/ReturnSkuConversion.java
new file mode 100644
index 000000000..f1101e234
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/entity/ReturnSkuConversion.java
@@ -0,0 +1,28 @@
+package com.baiyue.lastleg.returnreceipt.entity;
+
+import com.baomidou.mybatisplus.annotation.*;
+import lombok.Data;
+import java.time.LocalDateTime;
+
+@Data
+@TableName("ll_return_sku_conversion")
+public class ReturnSkuConversion {
+    @TableId(type = IdType.INPUT) private Long id;
+    private String customerId;
+    private String overseasWarehouseId;
+    private Long applicationId;
+    private String relabelNo;
+    private Long itemId;
+    private String roundKey;
+    private Long cartonId;
+    private String cartonMark;
+    private String oldSkuCode;
+    private String newSkuCode;
+    private String productNameZh;
+    private Long quantity;
+    private String status;
+    private String ownershipJson;
+    private LocalDateTime completedAt;
+    private LocalDateTime confirmedAt;
+    private LocalDateTime reversedAt;
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/mapper/ReturnInventoryBalanceMapper.java b/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/mapper/ReturnInventoryBalanceMapper.java
index 7dae31f47..729840091 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/mapper/ReturnInventoryBalanceMapper.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/mapper/ReturnInventoryBalanceMapper.java
@@ -12,17 +12,28 @@ import java.util.List;
 
 @Mapper
 public interface ReturnInventoryBalanceMapper extends BaseMapper<ReturnInventoryBalance> {
+    @Update("UPDATE ll_return_inventory_balance SET total_quantity=total_quantity-#{quantity},available_quantity=available_quantity-#{quantity}," +
+        "carton_quantity=carton_quantity-#{cartons},updated_at=NOW(3) WHERE customer_id=#{customerId} AND overseas_warehouse_id=#{warehouseId} " +
+        "AND sku_code=#{skuCode} AND total_quantity>=#{quantity} AND available_quantity>=#{quantity} AND carton_quantity>=#{cartons}")
+    int deductConversion(@Param("customerId") String customerId, @Param("warehouseId") String warehouseId,
+        @Param("skuCode") String skuCode, @Param("quantity") long quantity, @Param("cartons") long cartons);
     @Update("UPDATE ll_return_inventory_balance SET total_quantity=total_quantity-#{quantity}, " +
         "available_quantity=available_quantity-#{quantity},updated_at=NOW(3) " +
         "WHERE id=#{id} AND customer_id=#{customerId} AND overseas_warehouse_id=#{warehouseId} " +
-        "AND total_quantity>=#{quantity} AND available_quantity>=#{quantity} AND carton_quantity>=1")
+        // PARCEL is a labelled physical unit but is not counted as a box in
+        // carton_quantity. Piece shipment must therefore only guard quantities.
+        "AND total_quantity>=#{quantity} AND available_quantity>=#{quantity}")
     int deductOutboundPieces(@Param("id") long id, @Param("customerId") String customerId,
                              @Param("warehouseId") String warehouseId, @Param("quantity") long quantity);
     String FREE_STOCK_COLUMNS = "b.id,b.customer_id,b.overseas_warehouse_id,b.sku_code,b.product_name_zh,b.total_quantity,b.carton_quantity,b.created_at,b.updated_at," +
         "LEAST(b.available_quantity,COALESCE((SELECT SUM(GREATEST(0,i.quantity-COALESCE(i.packing_reserved_quantity,0))) " +
-        "FROM ll_return_inventory_carton c JOIN ll_return_inventory_carton_item i ON i.carton_id=c.id AND i.customer_id=c.customer_id " +
-        "WHERE c.customer_id=b.customer_id AND c.overseas_warehouse_id=b.overseas_warehouse_id AND i.sku_code=b.sku_code " +
-        "AND c.status='AVAILABLE' AND c.count_status='CONFIRMED'),0)) AS available_quantity";
+        "FROM ll_return_inventory_carton c JOIN ll_return_inventory_carton_item i ON i.carton_id=c.id AND i.customer_id COLLATE utf8mb4_0900_ai_ci=c.customer_id COLLATE utf8mb4_0900_ai_ci " +
+        "WHERE c.customer_id COLLATE utf8mb4_0900_ai_ci=b.customer_id COLLATE utf8mb4_0900_ai_ci AND c.overseas_warehouse_id COLLATE utf8mb4_0900_ai_ci=b.overseas_warehouse_id COLLATE utf8mb4_0900_ai_ci AND i.sku_code COLLATE utf8mb4_0900_ai_ci=b.sku_code COLLATE utf8mb4_0900_ai_ci " +
+        "AND c.status='AVAILABLE' AND c.count_status='CONFIRMED'),0)) AS available_quantity," +
+        "COALESCE((SELECT SUM(i.quantity) FROM ll_return_inventory_carton c " +
+        "JOIN ll_return_inventory_carton_item i ON i.carton_id=c.id AND i.customer_id COLLATE utf8mb4_0900_ai_ci=c.customer_id COLLATE utf8mb4_0900_ai_ci " +
+        "WHERE c.customer_id COLLATE utf8mb4_0900_ai_ci=b.customer_id COLLATE utf8mb4_0900_ai_ci AND c.overseas_warehouse_id COLLATE utf8mb4_0900_ai_ci=b.overseas_warehouse_id COLLATE utf8mb4_0900_ai_ci " +
+        "AND i.sku_code COLLATE utf8mb4_0900_ai_ci=b.sku_code COLLATE utf8mb4_0900_ai_ci AND c.status='RELABEL_PENDING'),0) AS relabel_locked_quantity";
     @Select("SELECT * FROM ll_return_inventory_balance WHERE customer_id=#{customerId} " +
         "AND overseas_warehouse_id=#{warehouseId} AND sku_code=#{skuCode} FOR UPDATE")
     ReturnInventoryBalance lockSku(@Param("customerId") String customerId, @Param("warehouseId") String warehouseId,
@@ -55,6 +66,12 @@ public interface ReturnInventoryBalanceMapper extends BaseMapper<ReturnInventory
     int reserveAvailable(@Param("customerId") String customerId, @Param("warehouseId") String warehouseId,
                          @Param("skuCode") String skuCode, @Param("quantity") long quantity);
 
+    @Update("UPDATE ll_return_inventory_balance SET available_quantity=available_quantity+#{quantity},updated_at=NOW(3) " +
+        "WHERE customer_id=#{customerId} AND overseas_warehouse_id=#{warehouseId} AND sku_code=#{skuCode} " +
+        "AND #{quantity}>0 AND total_quantity-available_quantity>=#{quantity}")
+    int releaseAvailable(@Param("customerId") String customerId, @Param("warehouseId") String warehouseId,
+                         @Param("skuCode") String skuCode, @Param("quantity") long quantity);
+
     @Select("SELECT COALESCE(available_quantity,0) FROM ll_return_inventory_balance WHERE customer_id=#{customerId} AND overseas_warehouse_id=#{warehouseId} AND sku_code=#{skuCode} LIMIT 1")
     long availableQuantity(@Param("customerId") String customerId, @Param("warehouseId") String warehouseId,
                            @Param("skuCode") String skuCode);
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/mapper/ReturnInventoryCartonMapper.java b/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/mapper/ReturnInventoryCartonMapper.java
index 12b4fdf3b..fa1eec670 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/mapper/ReturnInventoryCartonMapper.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/mapper/ReturnInventoryCartonMapper.java
@@ -10,6 +10,16 @@ import java.util.List;
 
 @Mapper
 public interface ReturnInventoryCartonMapper extends BaseMapper<ReturnInventoryCarton> {
+    @Select("SELECT * FROM ll_return_inventory_carton WHERE customer_id=#{customerId} AND overseas_warehouse_id=#{warehouseId} AND FIND_IN_SET(#{returnNo},source_return_no)>0 AND total_quantity>0 ORDER BY created_at DESC,id DESC")
+    List<ReturnInventoryCarton> currentReturnCartons(@Param("customerId") String customerId, @Param("warehouseId") String warehouseId, @Param("returnNo") String returnNo);
+    @Select("SELECT * FROM ll_return_inventory_carton WHERE overseas_warehouse_id=#{warehouseId} " +
+        "AND pallet_code=#{palletCode} AND total_quantity>0 " +
+        "AND status IN ('AVAILABLE','PACKING_RESERVED','RELABEL_PENDING','OUTBOUND_PENDING','DISCARD_PENDING') ORDER BY id")
+    List<ReturnInventoryCarton> palletCartons(@Param("warehouseId") String warehouseId, @Param("palletCode") String palletCode);
+    @Select("SELECT EXISTS(SELECT 1 FROM ll_return_inventory_outbound_movement WHERE carton_id=#{cartonId} AND quantity>0)")
+    boolean hasOutbound(@Param("cartonId") long cartonId);
+    @Update("UPDATE ll_return_inventory_carton SET relabel_application_id=NULL,relabel_no=NULL,relabel_status=NULL WHERE id=#{id}")
+    int clearRelabel(@Param("id") long id);
     @Select("SELECT * FROM ll_return_inventory_carton WHERE source_receipt_id=#{receiptId} ORDER BY id FOR UPDATE")
     List<ReturnInventoryCarton> lockReceipt(@Param("receiptId") long receiptId);
     @Select("SELECT * FROM ll_return_inventory_carton WHERE customer_id=#{customerId} AND overseas_warehouse_id=#{warehouseId} AND status='AVAILABLE' AND count_status='CONFIRMED' ORDER BY carton_mark")
@@ -37,6 +47,9 @@ public interface ReturnInventoryCartonMapper extends BaseMapper<ReturnInventoryC
         "<if test='warehouseId != null and warehouseId != \"\"'>AND overseas_warehouse_id=#{warehouseId} </if>" +
         "ORDER BY created_at DESC,id DESC LIMIT 500</script>")
     List<ReturnInventoryCarton> findAvailable(@Param("customerId") String customerId, @Param("warehouseId") String warehouseId);
+    @Select("SELECT * FROM ll_return_inventory_carton WHERE customer_id=#{customerId} AND overseas_warehouse_id=#{warehouseId} " +
+        "AND count_status='CONFIRMED' AND status IN ('AVAILABLE','RELABEL_PENDING','PACKING_RESERVED','MERGED','OUTBOUNDED','OUTBOUND_PENDING','DISCARD_PENDING') ORDER BY created_at DESC,id DESC LIMIT 500")
+    List<ReturnInventoryCarton> findRelabelCandidates(@Param("customerId") String customerId, @Param("warehouseId") String warehouseId);
     @Select("SELECT * FROM ll_return_inventory_carton WHERE carton_mark=#{cartonMark} LIMIT 1")
     ReturnInventoryCarton findMark(@Param("cartonMark") String cartonMark);
 
@@ -57,12 +70,59 @@ public interface ReturnInventoryCartonMapper extends BaseMapper<ReturnInventoryC
     @Update("UPDATE ll_return_inventory_carton SET status='AVAILABLE',updated_at=NOW(3) WHERE id=#{id} AND customer_id=#{customerId} AND status='DISCARD_PENDING'")
     int releaseDiscard(@Param("id") long id, @Param("customerId") String customerId);
 
-    @Select("SELECT COALESCE(SUM(ri.notified_package_count),0) FROM ll_relabel_item ri " +
+    String CURRENT_RELABEL_ROUND = " AND (ri.application_id=(SELECT c.relabel_application_id FROM ll_return_inventory_carton c WHERE c.id=#{cartonId}) " +
+        "OR ((SELECT c.relabel_application_id FROM ll_return_inventory_carton c WHERE c.id=#{cartonId}) IS NULL " +
+        "AND NOT EXISTS(SELECT 1 FROM ll_relabel_item newer JOIN ll_relabel_application na ON na.id=newer.application_id " +
+        "WHERE newer.return_carton_id=ri.return_carton_id AND na.status NOT IN ('CANCELLED','REJECTED') " +
+        "AND (COALESCE(newer.source_carton_mark,newer.carton_mark) COLLATE utf8mb4_0900_ai_ci=COALESCE(ri.source_carton_mark,ri.carton_mark) COLLATE utf8mb4_0900_ai_ci " +
+        "OR COALESCE(newer.source_carton_mark,newer.carton_mark) COLLATE utf8mb4_0900_ai_ci=(SELECT c.carton_mark FROM ll_return_inventory_carton c WHERE c.id=#{cartonId}) COLLATE utf8mb4_0900_ai_ci) " +
+        "AND (na.created_at>ra.created_at OR (na.created_at=ra.created_at AND na.id>ra.id)))))";
+    String ALL_COMPLETION_DEDUCTION = "COALESCE((SELECT SUM(j.quantity) FROM ll_relabel_pda_history h " +
+        "JOIN JSON_TABLE(CASE WHEN h.action='RETURN_COMPLETION_TRANSFER' AND JSON_VALID(h.detail_json) THEN h.detail_json ELSE '{}' END,'$.items[*]' COLUMNS(sku_code VARCHAR(128) PATH '$.skuCode',quantity BIGINT PATH '$.quantity')) j " +
+        "WHERE h.action='RETURN_COMPLETION_TRANSFER' AND EXISTS(SELECT 1 FROM ll_relabel_item ri " +
         "JOIN ll_relabel_application ra ON ra.id=ri.application_id " +
-        "WHERE ri.return_carton_id=#{cartonId} AND ri.sku_code=#{skuCode} " +
-        "AND ra.status NOT IN ('CANCELLED','REJECTED')")
+        "WHERE ri.return_carton_id=#{cartonId} AND JSON_CONTAINS(CASE WHEN JSON_VALID(h.detail_json) THEN h.detail_json ELSE '{}' END," +
+        "JSON_QUOTE(CAST(ri.id AS CHAR)),'$.sourceItemIds') AND ra.status NOT IN ('CANCELLED','REJECTED') ";
+    String COMPLETION_DEDUCTION = ALL_COMPLETION_DEDUCTION + CURRENT_RELABEL_ROUND + ")";
+
+    // All rounds count here: selecting a later partial application must not erase earlier completed pieces.
+    @Select("SELECT GREATEST(0,COALESCE(SUM(CASE WHEN ri.operation_type='RETURN_BULK_SKU_LABEL' THEN f.quantity " +
+        "ELSE f.quantity * COALESCE((SELECT SUM(j.quantity) FROM JSON_TABLE(CASE WHEN JSON_VALID(ri.sku_relabel_items_json) THEN ri.sku_relabel_items_json ELSE '[]' END,'$[*]' " +
+        "COLUMNS(sku_code VARCHAR(128) PATH '$.skuCode',quantity BIGINT PATH '$.quantity')) j WHERE UPPER(j.sku_code)=UPPER(#{skuCode})),0) END),0) - " +
+        ALL_COMPLETION_DEDUCTION + ") AND UPPER(j.sku_code)=UPPER(#{skuCode})),0)) " +
+        "FROM ll_relabel_item ri JOIN ll_relabel_application ra ON ra.id=ri.application_id " +
+        "JOIN ll_relabel_pda_unit_fact f ON f.item_id=ri.id AND f.result='RELABELLED' " +
+        "WHERE ri.return_carton_id=#{cartonId} AND (ri.operation_type<>'RETURN_BULK_SKU_LABEL' OR UPPER(ri.sku_code)=UPPER(#{skuCode})) " +
+        "AND ra.status NOT IN ('CANCELLED','REJECTED') AND NOT EXISTS(SELECT 1 FROM ll_return_sku_conversion sc " +
+        "WHERE sc.item_id=ri.id AND sc.status IN ('APPLIED','CONFIRMED') AND UPPER(sc.old_sku_code)=UPPER(#{skuCode}))")
+    long completedSkuQuantity(@Param("cartonId") long cartonId, @Param("skuCode") String skuCode);
+    @Select("SELECT COALESCE(SUM(CASE WHEN ri.operation_type='RETURN_BULK_SKU_LABEL' THEN f.quantity " +
+        "ELSE f.quantity * COALESCE((SELECT SUM(j.quantity) FROM JSON_TABLE(CASE WHEN JSON_VALID(ri.sku_relabel_items_json) THEN ri.sku_relabel_items_json ELSE '[]' END, '$[*]' " +
+        "COLUMNS(sku_code VARCHAR(128) PATH '$.skuCode', quantity BIGINT PATH '$.quantity')) j WHERE UPPER(j.sku_code)=UPPER(#{skuCode})),0) END),0) - " +
+        COMPLETION_DEDUCTION + " AND UPPER(j.sku_code)=UPPER(#{skuCode})),0) FROM ll_relabel_item ri " +
+        "JOIN ll_relabel_application ra ON ra.id=ri.application_id " +
+        "JOIN ll_relabel_pda_unit_fact f ON f.item_id=ri.id AND f.result='RELABELLED' " +
+        "WHERE ri.return_carton_id=#{cartonId} AND (ri.operation_type<>'RETURN_BULK_SKU_LABEL' OR UPPER(ri.sku_code)=UPPER(#{skuCode})) " +
+        "AND ra.status NOT IN ('CANCELLED','REJECTED')" + CURRENT_RELABEL_ROUND)
     long relabelledQuantity(@Param("cartonId") long cartonId, @Param("skuCode") String skuCode);
 
+    String RELABEL_ITEM_QUANTITY = "CASE WHEN ri.operation_type='RETURN_BULK_SKU_LABEL' THEN ri.notified_package_count ELSE " +
+        "COALESCE((SELECT SUM(j.quantity) FROM JSON_TABLE(CASE WHEN JSON_VALID(ri.sku_relabel_items_json) THEN ri.sku_relabel_items_json ELSE '[]' END, '$[*]' " +
+        "COLUMNS(quantity BIGINT PATH '$.quantity')) j),0) END";
+    @Select("SELECT COALESCE(SUM(CASE WHEN ri.operation_type='RETURN_BULK_SKU_LABEL' THEN f.quantity ELSE f.quantity * " +
+        "COALESCE((SELECT SUM(j.quantity) FROM JSON_TABLE(CASE WHEN JSON_VALID(ri.sku_relabel_items_json) THEN ri.sku_relabel_items_json ELSE '[]' END,'$[*]' COLUMNS(quantity BIGINT PATH '$.quantity')) j),0) END),0) - " +
+        COMPLETION_DEDUCTION + "),0) " +
+        "FROM ll_relabel_item ri JOIN ll_relabel_application ra ON ra.id=ri.application_id " +
+        "JOIN ll_relabel_pda_unit_fact f ON f.item_id=ri.id AND f.result='RELABELLED' " +
+        "WHERE ri.return_carton_id=#{cartonId} AND ra.status NOT IN ('CANCELLED','REJECTED')" + CURRENT_RELABEL_ROUND)
+    long totalRelabelledQuantity(@Param("cartonId") long cartonId);
+    @Select("SELECT COALESCE(SUM(GREATEST(0,(" + RELABEL_ITEM_QUANTITY + ") - " +
+        "COALESCE((SELECT SUM(CASE WHEN ri.operation_type='RETURN_BULK_SKU_LABEL' THEN f.quantity ELSE f.quantity * (" +
+        RELABEL_ITEM_QUANTITY + ") END) FROM ll_relabel_pda_unit_fact f WHERE f.item_id=ri.id AND f.result='RELABELLED'),0))),0) " +
+        "FROM ll_relabel_item ri JOIN ll_relabel_application ra ON ra.id=ri.application_id " +
+        "WHERE ri.return_carton_id=#{cartonId} AND ra.status NOT IN ('CANCELLED','REJECTED','COMPLETED')")
+    long relabelReservedQuantity(@Param("cartonId") long cartonId);
+
     @Update("UPDATE ll_return_inventory_carton SET total_quantity=#{remaining},sku_types=#{skuTypes},status='AVAILABLE'," +
         "relabel_application_id=NULL,relabel_no=NULL,relabel_status=NULL,updated_at=NOW(3) " +
         "WHERE id=#{id} AND customer_id=#{customerId} AND relabel_application_id=#{applicationId} " +
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/mapper/ReturnInventoryMovementMapper.java b/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/mapper/ReturnInventoryMovementMapper.java
index 16d780a55..57bda1bff 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/mapper/ReturnInventoryMovementMapper.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/mapper/ReturnInventoryMovementMapper.java
@@ -17,7 +17,11 @@ public interface ReturnInventoryMovementMapper extends com.baomidou.mybatisplus.
         "UNION ALL SELECT c.customer_id,c.overseas_warehouse_id,i.sku_code,i.product_name_zh,'MERGE',c.carton_mark,0,-i.quantity,c.created_at " +
         "FROM ll_return_inventory_carton c JOIN ll_return_inventory_carton_item i ON i.carton_id=c.id WHERE c.source_batch_no='MERGED'" +
         " UNION ALL SELECT customer_id,overseas_warehouse_id,sku_code,product_name_zh,'OUTBOUND',outbound_no," +
-        "-quantity,-quantity,occurred_at FROM ll_return_inventory_outbound_movement";
+        "-quantity,-quantity,occurred_at FROM ll_return_inventory_outbound_movement" +
+        " UNION ALL SELECT customer_id,overseas_warehouse_id,old_sku_code,product_name_zh,'SKU_CONVERSION_OUT',relabel_no,-quantity,-quantity,completed_at FROM ll_return_sku_conversion" +
+        " UNION ALL SELECT customer_id,overseas_warehouse_id,new_sku_code,product_name_zh,'SKU_CONVERSION_IN',relabel_no,quantity,quantity,completed_at FROM ll_return_sku_conversion" +
+        " UNION ALL SELECT customer_id,overseas_warehouse_id,old_sku_code,product_name_zh,'SKU_CONVERSION_REVERSE_IN',relabel_no,quantity,quantity,reversed_at FROM ll_return_sku_conversion WHERE status='REVERSED'" +
+        " UNION ALL SELECT customer_id,overseas_warehouse_id,new_sku_code,product_name_zh,'SKU_CONVERSION_REVERSE_OUT',relabel_no,-quantity,-quantity,reversed_at FROM ll_return_sku_conversion WHERE status='REVERSED'";
 
     @Select("<script>SELECT COUNT(*) FROM (" + MOVEMENTS + ") m WHERE 1=1 " +
         "<if test='customerId != null and customerId != \"\"'>AND m.customerId=#{customerId} </if>" +
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/mapper/ReturnInventoryQueryMapper.java b/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/mapper/ReturnInventoryQueryMapper.java
index c665877f5..7930f65c9 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/mapper/ReturnInventoryQueryMapper.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/mapper/ReturnInventoryQueryMapper.java
@@ -21,7 +21,7 @@ public interface ReturnInventoryQueryMapper {
                @Param("status") String status, @Param("returnNo") String returnNo);
 
     @Select("<script>SELECT c.id carton_id,c.overseas_warehouse_id,c.carton_mark,c.source_batch_no,(CASE WHEN c.count_status='PENDING' AND c.status='AVAILABLE' THEN 'PENDING_COUNT' ELSE c.status END) AS status,c.sku_types,c.total_quantity,c.created_at, " +
-        "i.sku_code,i.product_name_zh,i.quantity FROM ll_return_inventory_carton c JOIN ll_return_inventory_carton_item i ON i.carton_id=c.id " +
+        "i.sku_code,i.product_name_zh,i.quantity,i.relabelled_quantity,i.packing_reserved_quantity FROM ll_return_inventory_carton c JOIN ll_return_inventory_carton_item i ON i.carton_id=c.id " +
         "WHERE c.customer_id=#{customerId} " +
         "<if test='status != null and status != \"\"'>AND (CASE WHEN c.count_status='PENDING' AND c.status='AVAILABLE' THEN 'PENDING_COUNT' ELSE c.status END)=#{status} </if>" +
         "<if test='returnNo != null and returnNo != \"\"'>AND (c.source_return_no LIKE CONCAT('%',#{returnNo},'%') OR EXISTS (SELECT 1 FROM ll_return_receipt r JOIN ll_return_order o ON o.id=r.return_order_id WHERE r.id=c.source_receipt_id AND o.return_no LIKE CONCAT('%',#{returnNo},'%'))) </if>" +
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/mapper/ReturnPackingTraceMapper.java b/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/mapper/ReturnPackingTraceMapper.java
index 012efe45b..9989681fb 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/mapper/ReturnPackingTraceMapper.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/mapper/ReturnPackingTraceMapper.java
@@ -10,6 +10,13 @@ import java.util.List;
 /** Immutable movements retain original return ownership when cartons are merged again. */
 @Mapper
 public interface ReturnPackingTraceMapper {
+    // Collapse fragments within one operation; separate physical operations remain separate history.
+    String HISTORY_SELECT = "SELECT JSON_UNQUOTE(JSON_EXTRACT(o.result_json,'$.planNo')) AS plan_no,"
+        + "t.source_carton_mark,t.target_carton_mark,t.return_no,t.sku_code,SUM(t.quantity) AS quantity,"
+        + "MIN(t.created_at) AS created_at FROM ll_return_packing_trace t "
+        + "JOIN ll_return_inventory_operation o ON o.id=t.operation_id ";
+    String HISTORY_GROUP = " GROUP BY t.operation_id,JSON_UNQUOTE(JSON_EXTRACT(o.result_json,'$.planNo')),"
+        + "t.source_carton_mark,t.target_carton_mark,t.return_no,t.sku_code ";
     record Trace(long id, String sourceCartonMark, String targetCartonMark, String returnNo,
                  String skuCode, long quantity, LocalDateTime createdAt) { }
     record Ownership(String returnNo, long quantity) { }
@@ -22,9 +29,24 @@ public interface ReturnPackingTraceMapper {
     @Select("SELECT return_no, SUM(CASE WHEN target_carton_mark=#{mark} THEN quantity ELSE -quantity END) AS quantity FROM ll_return_packing_trace WHERE customer_id=#{customerId} AND sku_code=#{sku} AND (source_carton_mark=#{mark} OR target_carton_mark=#{mark}) GROUP BY return_no HAVING quantity>0 ORDER BY return_no")
     List<Ownership> ownership(@Param("customerId") String customerId, @Param("mark") String mark, @Param("sku") String sku);
 
+    @Select("SELECT COALESCE(SUM(CASE WHEN target_carton_mark=#{mark} THEN quantity ELSE -quantity END),0) FROM ll_return_packing_trace WHERE customer_id=#{customerId} AND sku_code=#{sku} AND (source_carton_mark=#{mark} OR target_carton_mark=#{mark})")
+    long netTrackedQuantity(@Param("customerId") String customerId, @Param("mark") String mark, @Param("sku") String sku);
+
     @Select("SELECT id,source_carton_mark,target_carton_mark,return_no,sku_code,quantity,created_at FROM ll_return_packing_trace WHERE customer_id=#{customerId} AND return_no=#{returnNo} ORDER BY created_at,id")
     List<Trace> listReturn(@Param("customerId") String customerId, @Param("returnNo") String returnNo);
 
-    @Select("SELECT JSON_UNQUOTE(JSON_EXTRACT(o.result_json,'$.planNo')) AS plan_no,t.source_carton_mark,t.target_carton_mark,t.return_no,t.sku_code,t.quantity,t.created_at FROM ll_return_packing_trace t JOIN ll_return_inventory_operation o ON o.id=t.operation_id WHERE t.customer_id=#{customerId} AND o.operation_type='MERGE' AND t.source_carton_mark<>'' AND (t.source_carton_mark=#{mark} OR t.target_carton_mark=#{mark}) ORDER BY t.created_at DESC,t.id DESC")
+    @Select(HISTORY_SELECT + "WHERE t.customer_id=#{customerId} AND t.return_no=#{returnNo} AND t.source_carton_mark<>''"
+        + HISTORY_GROUP + "ORDER BY MIN(t.created_at),MIN(t.id)")
+    List<com.baiyue.lastleg.returnreceipt.dto.ReturnOrderResponses.PackingDetail> returnHistory(@Param("customerId") String customerId, @Param("returnNo") String returnNo);
+
+    @Select(HISTORY_SELECT + "WHERE t.customer_id=#{customerId} AND JSON_UNQUOTE(JSON_EXTRACT(o.result_json,'$.planNo'))=#{planNo} AND t.source_carton_mark<>''"
+        + HISTORY_GROUP + "ORDER BY MIN(t.created_at),MIN(t.id)")
+    List<com.baiyue.lastleg.returnreceipt.dto.ReturnInventoryResponses.MergeHistory> planHistory(@Param("customerId") String customerId, @Param("planNo") String planNo);
+
+    @Select("SELECT JSON_UNQUOTE(JSON_EXTRACT(o.result_json,'$.operatorName')) FROM ll_return_inventory_operation o WHERE JSON_UNQUOTE(JSON_EXTRACT(o.result_json,'$.planNo'))=#{planNo} AND o.operation_type='MERGE' ORDER BY o.id LIMIT 1")
+    String planOperator(@Param("planNo") String planNo);
+
+    @Select(HISTORY_SELECT + "WHERE t.customer_id=#{customerId} AND o.operation_type='MERGE' AND t.source_carton_mark<>'' AND (t.source_carton_mark=#{mark} OR t.target_carton_mark=#{mark})"
+        + HISTORY_GROUP + "ORDER BY MIN(t.created_at) DESC,MIN(t.id) DESC")
     List<com.baiyue.lastleg.returnreceipt.dto.ReturnInventoryResponses.MergeHistory> listCartonHistory(@Param("customerId") String customerId, @Param("mark") String mark);
 }
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/mapper/ReturnRelabelCompletionLedgerMapper.java b/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/mapper/ReturnRelabelCompletionLedgerMapper.java
new file mode 100644
index 000000000..3b171480d
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/mapper/ReturnRelabelCompletionLedgerMapper.java
@@ -0,0 +1,15 @@
+package com.baiyue.lastleg.returnreceipt.mapper;
+
+import org.apache.ibatis.annotations.*;
+import java.util.List;
+
+/** Immutable PDA history records exact completed physical pieces moved out of a historical item group. */
+@Mapper
+public interface ReturnRelabelCompletionLedgerMapper {
+    @Select("<script>SELECT COALESCE(SUM(j.quantity),0) FROM ll_relabel_pda_history h " +
+        "JOIN JSON_TABLE(CASE WHEN h.action='RETURN_COMPLETION_TRANSFER' AND JSON_VALID(h.detail_json) THEN h.detail_json ELSE '{}' END,'$.items[*]' COLUMNS(sku_code VARCHAR(128) PATH '$.skuCode',quantity BIGINT PATH '$.quantity')) j " +
+        "WHERE h.action='RETURN_COMPLETION_TRANSFER' AND UPPER(j.sku_code)=UPPER(#{skuCode}) " +
+        "AND EXISTS(SELECT 1 FROM JSON_TABLE(CASE WHEN h.action='RETURN_COMPLETION_TRANSFER' AND JSON_VALID(h.detail_json) THEN h.detail_json ELSE '{}' END,'$.sourceItemIds[*]' COLUMNS(item_id VARCHAR(32) PATH '$')) x " +
+        "WHERE x.item_id IN <foreach item='id' collection='itemIds' open='(' separator=',' close=')'>#{id}</foreach>)</script>")
+    long deductedQuantity(@Param("itemIds") List<String> itemIds, @Param("skuCode") String skuCode);
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/mapper/ReturnSkuConversionMapper.java b/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/mapper/ReturnSkuConversionMapper.java
new file mode 100644
index 000000000..abf4dc7a2
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/mapper/ReturnSkuConversionMapper.java
@@ -0,0 +1,16 @@
+package com.baiyue.lastleg.returnreceipt.mapper;
+
+import com.baomidou.mybatisplus.core.mapper.BaseMapper;
+import com.baiyue.lastleg.returnreceipt.entity.ReturnSkuConversion;
+import org.apache.ibatis.annotations.*;
+import java.util.List;
+
+@Mapper
+public interface ReturnSkuConversionMapper extends BaseMapper<ReturnSkuConversion> {
+    @Select("SELECT * FROM ll_return_sku_conversion WHERE customer_id=#{customerId} AND application_id=#{applicationId} ORDER BY id FOR UPDATE")
+    List<ReturnSkuConversion> lockApplication(@Param("customerId") String customerId, @Param("applicationId") long applicationId);
+
+    @Select("SELECT sc.* FROM ll_return_sku_conversion sc WHERE sc.customer_id=#{customerId} AND (sc.carton_id=#{cartonId} " +
+        "OR EXISTS(SELECT 1 FROM ll_relabel_item ri WHERE ri.id=sc.item_id AND ri.return_carton_id=#{cartonId})) ORDER BY sc.completed_at DESC,sc.id DESC")
+    List<ReturnSkuConversion> listCarton(@Param("customerId") String customerId, @Param("cartonId") long cartonId);
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/model/ReturnInventoryRow.java b/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/model/ReturnInventoryRow.java
index dd63846d5..ae11c1401 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/model/ReturnInventoryRow.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/model/ReturnInventoryRow.java
@@ -17,4 +17,6 @@ public class ReturnInventoryRow {
     private String skuCode;
     private String productNameZh;
     private Long quantity;
+    private Long relabelledQuantity;
+    private Long packingReservedQuantity;
 }
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/service/ReturnCartonCountService.java b/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/service/ReturnCartonCountService.java
index 2e6d3cd04..78bfc42e0 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/service/ReturnCartonCountService.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/service/ReturnCartonCountService.java
@@ -129,6 +129,7 @@ public class ReturnCartonCountService {
         Set<String> marks = new HashSet<>();
         for (CountBox box : request.boxes()) {
             if (!byMark.containsKey(box.cartonMark()) || !marks.add(box.cartonMark())) throw error(HttpStatus.BAD_REQUEST, "箱号不属于本次签收或重复填写");
+            if (box.length() == null || box.width() == null || box.height() == null || box.weight() == null || box.length().signum() <= 0 || box.width().signum() <= 0 || box.height().signum() <= 0 || box.weight().signum() <= 0) throw error(HttpStatus.BAD_REQUEST, "每个箱子必须填写有效的长、宽、高和重量");
             Set<String> skus = new HashSet<>();
             for (CountItem line : box.items()) {
                 if (!expected.containsKey(line.skuCode()) || !skus.add(line.skuCode()) || line.quantity() <= 0) throw error(HttpStatus.BAD_REQUEST, "SKU 不属于本次签收、数量无效或同箱重复");
@@ -144,7 +145,7 @@ public class ReturnCartonCountService {
                 item.setCustomerId(box.getCustomerId()); item.setSkuCode(line.skuCode()); item.setProductNameZh(names.get(line.skuCode())); item.setQuantity(line.quantity());
                 item.setPackingReservedQuantity(0L); items.insert(item);
             }
-            box.setSkuTypes(input.items().size()); box.setTotalQuantity(input.items().stream().mapToLong(CountItem::quantity).sum());
+            box.setSkuTypes(input.items().size()); box.setTotalQuantity(input.items().stream().mapToLong(CountItem::quantity).sum()); box.setLength(input.length()); box.setWidth(input.width()); box.setHeight(input.height()); box.setWeight(input.weight());
             box.setCountStatus("CONFIRMED"); box.setCountedAt(now); box.setCountedBy(identity.operatorKey()); box.setUpdatedAt(now); cartons.updateById(box);
         }
         for (String sku : expected.keySet()) {
@@ -167,7 +168,8 @@ public class ReturnCartonCountService {
     private Task task(ReturnReceipt receipt, List<ReturnInventoryCarton> boxes) {
         List<Sku> expected = receiptItems.listReceipt(receipt.getId()).stream().map(line -> new Sku(line.getSkuCode(), null, line.getReceivedQuantity())).toList();
         List<Box> contents = boxes.stream().map(box -> new Box(box.getCartonMark(), items.listCarton(box.getId()).stream()
-            .map(line -> new Sku(line.getSkuCode(), line.getProductNameZh(), "PENDING".equals(box.getCountStatus()) ? 0 : line.getQuantity())).toList())).toList();
+            .map(line -> new Sku(line.getSkuCode(), line.getProductNameZh(), "PENDING".equals(box.getCountStatus()) ? 0 : line.getQuantity())).toList(),
+            box.getLength(), box.getWidth(), box.getHeight(), box.getWeight())).toList();
         return new Task(receipt.getReceiptNo(), boxes.isEmpty() ? null : boxes.get(0).getSourceReturnNo(), receipt.getPalletCode(),
             boxes.stream().allMatch(box -> "CONFIRMED".equals(box.getCountStatus())) ? "CONFIRMED" : sessions.findReceipt(receipt.getId()) != null ? "COUNTING" : "PENDING", expected, contents);
     }
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/service/ReturnInventoryService.java b/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/service/ReturnInventoryService.java
index e20cfe196..bbd80fb2b 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/service/ReturnInventoryService.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/service/ReturnInventoryService.java
@@ -56,8 +56,10 @@ public class ReturnInventoryService {
     public static final String MERGED = "MERGED";
 
     @Resource private ReturnInventoryCartonMapper cartons;
+    @Resource private com.baiyue.lastleg.relabel.mapper.RelabelItemMapper relabelItems;
     @Resource private ReturnInventoryCartonItemMapper cartonItems;
     @Resource private ReturnInventoryBalanceMapper balances;
+    @Resource private com.baiyue.lastleg.returnreceipt.mapper.ReturnSkuConversionMapper skuConversions;
     @Resource private ReturnInventoryOperationMapper operations;
     @Resource private ReturnInventoryQueryMapper queries;
     @Resource private ReturnInventoryMovementMapper movements;
@@ -129,13 +131,27 @@ public class ReturnInventoryService {
         if (!List.of("BOX", "SKU").contains(mode)) throw badRequest("合箱方式只能选择 BOX 或 SKU");
         List<String> marks = request.sourceCartonMarks() == null ? List.of() : request.sourceCartonMarks().stream().distinct().sorted().toList();
         if ("BOX".equals(mode) && marks.isEmpty()) throw badRequest("按箱合箱必须选择来源箱唛");
-        if ("SKU".equals(mode) && !marks.isEmpty()) throw badRequest("按 SKU 合箱不能同时选择来源箱");
+        // SKU mode is the partial-packing mode. It may explicitly name one or
+        // more physical packages/boxes; the quantities in `boxes` are then
+        // deducted from those sources and materialized as a new labelled carton.
         Map<String, Long> requested = planQuantities(request.boxes());
+        List<ReturnInventoryRequests.SourceDeduction> exact = request.sourceDeductions();
+        if (exact != null) {
+            if (!"SKU".equals(mode) || exact.isEmpty() || marks.isEmpty()) throw badRequest("部分合箱必须指定来源包裹/箱及数量");
+            var seen = new java.util.HashSet<String>();
+            for (var line : exact) if (!marks.contains(line.cartonMark()) || line.quantity() <= 0
+                || !seen.add(line.cartonMark() + ":" + line.skuCode())) throw badRequest("部分合箱来源重复或不属于所选包裹/箱");
+            Map<String, Long> totals = new LinkedHashMap<>();
+            exact.forEach(line -> totals.merge(line.skuCode(), line.quantity(), Math::addExact));
+            if (!totals.equals(requested)) throw conflict("来源扣除数量必须与目标箱数量一致");
+        }
         List<SourceItem> allocation = new ArrayList<>();
         List<ReturnInventoryCarton> sources = "BOX".equals(mode)
             ? marks.stream().map(cartons::lockMark).toList()
-            : packingSourceCartons(selected).stream().filter(c -> "PARCEL".equals(c.getSourceUnitType()))
-                .sorted(Comparator.comparing(ReturnInventoryCarton::getCartonMark)).map(c -> cartons.lockMark(c.getCartonMark())).toList();
+            : (marks.isEmpty()
+                ? packingSourceCartons(selected).stream()
+                    .sorted(Comparator.comparing(ReturnInventoryCarton::getCartonMark)).map(c -> cartons.lockMark(c.getCartonMark())).toList()
+                : marks.stream().map(cartons::lockMark).toList());
         Map<String, Long> remaining = new LinkedHashMap<>(requested);
         for (ReturnInventoryCarton carton : sources) {
             if (carton == null || !first.getCustomerId().equals(carton.getCustomerId())
@@ -143,18 +159,25 @@ public class ReturnInventoryService {
                 || !AVAILABLE.equals(carton.getStatus())
                 || !sourceMatches(carton, returnNos)) throw conflict("来源箱不属于所选退货单或已被占用");
             ReturnCartonCountGuard.requireConfirmed(carton);
-            if ("BOX".equals(mode) && "PARCEL".equals(carton.getSourceUnitType())) throw badRequest("包裹散 SKU 不能作为整箱选择");
-            for (ReturnInventoryCartonItem item : cartonItems.lockCarton(carton.getId())) {
+            List<ReturnInventoryCartonItem> lockedItems = cartonItems.lockCarton(carton.getId());
+            List<ReturnInventoryResponses.CartonItem> originalItems = lockedItems.stream().map(item ->
+                new ReturnInventoryResponses.CartonItem(item.getSkuCode(), item.getProductNameZh(), value(item.getQuantity()))).toList();
+            for (ReturnInventoryCartonItem item : lockedItems) {
                 long free = Math.max(0, value(item.getQuantity()) - value(item.getPackingReservedQuantity()));
-                long take = "BOX".equals(mode) ? free : Math.min(free, value(remaining.get(item.getSkuCode())));
+                if (value(item.getPackingReservedQuantity()) > 0) throw conflict("来源包裹/箱已有合箱预占");
+                long take = "BOX".equals(mode) ? free : exact == null ? Math.min(free, value(remaining.get(item.getSkuCode())))
+                    : exact.stream().filter(line -> carton.getCartonMark().equals(line.cartonMark()) && item.getSkuCode().equals(line.skuCode())).mapToLong(ReturnInventoryRequests.SourceDeduction::quantity).sum();
+                if (take > free) throw conflict("来源包裹/箱扣除数量超过可用库存");
                 if ("BOX".equals(mode) && value(item.getPackingReservedQuantity()) > 0) throw conflict("来源箱已有合箱预占");
                 if (take <= 0) continue;
                 if ("SKU".equals(mode)) remaining.put(item.getSkuCode(), remaining.get(item.getSkuCode()) - take);
                 item.setPackingReservedQuantity(value(item.getPackingReservedQuantity()) + take);
                 cartonItems.updateById(item);
-                allocation.add(new SourceItem(carton.getCartonMark(), item.getSkuCode(), take));
+                allocation.add(new SourceItem(carton.getCartonMark(), item.getSkuCode(), take, carton.getSourceReturnNo(), originalItems));
+            }
+            if (allocation.stream().anyMatch(line -> line.cartonMark().equals(carton.getCartonMark()))) {
+                carton.setStatus("PACKING_RESERVED"); cartons.updateById(carton);
             }
-            if ("BOX".equals(mode)) { carton.setStatus("PACKING_RESERVED"); cartons.updateById(carton); }
         }
         if (allocation.isEmpty() || ("SKU".equals(mode) && remaining.values().stream().anyMatch(q -> q > 0))) throw conflict("来源库存不足，无法锁定合箱数量");
         Map<String, Long> reserved = sourceQuantities(allocation);
@@ -174,12 +197,34 @@ public class ReturnInventoryService {
         return packingPlan(plan);
     }
 
-    private record SourceItem(String cartonMark, String skuCode, long quantity) { }
+    private record SourceItem(String cartonMark, String skuCode, long quantity, String sourceReturnNo,
+                              List<ReturnInventoryResponses.CartonItem> originalItems) {
+        SourceItem(String cartonMark, String skuCode, long quantity) { this(cartonMark, skuCode, quantity, null, null); }
+    }
 
     @Transactional(readOnly = true)
     public List<ReturnOrderResponses.PackingDetail> packingHistory(String customerId, String returnNo) {
-        return packingTrace.listReturn(customerId, returnNo).stream().filter(t -> StringUtils.hasText(t.sourceCartonMark()))
-            .map(t -> new ReturnOrderResponses.PackingDetail(t.sourceCartonMark(), t.targetCartonMark(), t.returnNo(), t.skuCode(), t.quantity(), t.createdAt())).toList();
+        return packingTrace.returnHistory(customerId, returnNo);
+    }
+
+    @Transactional(readOnly = true)
+    public List<ReturnInventoryResponses.CurrentCarton> currentReturnCartons(String customerId, String warehouseId, String returnNo) {
+        return cartons.currentReturnCartons(customerId, warehouseId, returnNo).stream()
+            .filter(carton -> !List.of(MERGED, "OUTBOUNDED", "DISCARDED").contains(carton.getStatus()))
+            .map(carton -> {
+                var detail = cartonDetail(carton);
+                List<ReturnInventoryResponses.SourceOwnership> origins = new ArrayList<>();
+                for (var item : detail.items()) if (item.quantity() > 0) {
+                    for (var origin : ownership(carton, item.skuCode(), item.quantity()))
+                        origins.add(new ReturnInventoryResponses.SourceOwnership(origin.returnNo(), item.skuCode(), origin.quantity()));
+                }
+                long orderQuantity = origins.stream().filter(origin -> returnNo.equals(origin.returnNo()))
+                    .mapToLong(ReturnInventoryResponses.SourceOwnership::quantity).sum();
+                boolean available = AVAILABLE.equals(carton.getStatus()) && "CONFIRMED".equals(carton.getCountStatus())
+                    && detail.relabelReservedQuantity() == 0 && detail.items().stream().anyMatch(item -> item.remainingRelabelQuantity() > 0);
+                return new ReturnInventoryResponses.CurrentCarton(detail, origins, orderQuantity, carton.getLabelStatus(),
+                    available, available ? null : "箱内待清点、已占用或没有待贴标数量");
+            }).filter(row -> row.orderQuantity() > 0).toList();
     }
 
     @Transactional
@@ -197,7 +242,10 @@ public class ReturnInventoryService {
             item.setPackingReservedQuantity(value(item.getPackingReservedQuantity()) - source.quantity()); cartonItems.updateById(item);
             if ("PACKING_RESERVED".equals(carton.getStatus())) { carton.setStatus(AVAILABLE); cartons.updateById(carton); }
         }
-        for (var entry : sourceQuantities(allocation).entrySet()) balances.adjust(IdWorker.getId(), plan.getCustomerId(), plan.getOverseasWarehouseId(), entry.getKey(), null, 0, entry.getValue(), 0);
+        for (var entry : sourceQuantities(allocation).entrySet()) {
+            if (balances.releaseAvailable(plan.getCustomerId(), plan.getOverseasWarehouseId(), entry.getKey(), entry.getValue()) != 1)
+                throw conflict("计划库存余额预占异常，请重新读取库存");
+        }
         plan.setStatus("CANCELLED"); plan.setUpdatedAt(LocalDateTime.now()); packingPlans.updateById(plan);
         return packingPlan(plan);
     }
@@ -282,6 +330,8 @@ public class ReturnInventoryService {
             return new ReturnInventoryResponses.PackingPlanCompletion(plan.getPlanNo(), read(plan.getResultLabelsJson(), new TypeReference<List<ReturnInventoryResponses.Label>>() { }));
         }
         if (!"READY".equals(plan.getStatus())) throw conflict("合箱计划尚未审核或已取消");
+        if ("SKU".equals(plan.getMode()) && request.boxes().stream().anyMatch(box -> text(box.targetCartonMark()) != null))
+            throw conflict("部分包裹/箱必须合箱生成独立新箱");
         if ("BOX".equals(plan.getMode()) && request.boxes().size() != 1) throw badRequest("箱与箱合并必须扫描一个已有目标箱，不支持拆分来源箱");
         List<SourceItem> allocation = read(plan.getSourceItemsJson(), new TypeReference<>() { });
         if (allocation.isEmpty()) throw conflict("合箱计划缺少来源锁定明细，请重新创建");
@@ -289,7 +339,7 @@ public class ReturnInventoryService {
             ? text(request.boxes().get(0).targetCartonMark()) : null;
         List<SourceItem> sourceAllocation = plannedTarget == null ? allocation : allocation.stream()
             .filter(source -> !plannedTarget.equals(source.cartonMark())).toList();
-        if ("BOX".equals(plan.getMode()) && request.sourceDeductions() != null) {
+        if (request.sourceDeductions() != null) {
             Map<String, Long> seen = new LinkedHashMap<>();
             List<SourceItem> selected = new ArrayList<>();
             for (var deduction : request.sourceDeductions()) {
@@ -299,8 +349,14 @@ public class ReturnInventoryService {
                 selected.add(new SourceItem(deduction.cartonMark(), deduction.skuCode(), deduction.quantity()));
             }
             sourceAllocation = selected;
+            if (!deductionQuantities(sourceAllocation).equals(deductionQuantities(plannedTarget == null ? allocation : allocation.stream()
+                .filter(source -> !plannedTarget.equals(source.cartonMark())).toList())))
+                throw conflict("实际来源箱和 SKU 数量必须与计划锁定明细完全一致");
         }
         final List<SourceItem> selectedAllocation = sourceAllocation;
+        if (plannedTarget != null && allocation.stream().anyMatch(source -> !plannedTarget.equals(source.cartonMark())
+            && selectedAllocation.stream().filter(s -> s.cartonMark().equals(source.cartonMark()) && s.skuCode().equals(source.skuCode())).mapToLong(SourceItem::quantity).sum() != source.quantity()))
+            throw conflict("部分包裹/箱必须合箱生成独立新箱，不能并入已有箱");
         if (!sourceQuantities(sourceAllocation).equals(planQuantities(request.boxes()))) throw conflict("来源箱 SKU 数量合计必须与计划锁定数量完全一致");
         List<String> returnNos = read(plan.getReturnNosJson(), new TypeReference<>() { });
         Map<String, Map<String, Long>> limits = new LinkedHashMap<>();
@@ -327,8 +383,10 @@ public class ReturnInventoryService {
             }
             if ("PACKING_RESERVED".equals(targetSource.getStatus())) { targetSource.setStatus(AVAILABLE); cartons.updateById(targetSource); }
         }
-        for (var entry : sourceQuantities(allocation).entrySet()) balances.adjust(IdWorker.getId(), plan.getCustomerId(),
-            plan.getOverseasWarehouseId(), entry.getKey(), null, 0, entry.getValue(), 0);
+        for (var entry : sourceQuantities(allocation).entrySet()) {
+            if (balances.releaseAvailable(plan.getCustomerId(), plan.getOverseasWarehouseId(), entry.getKey(), entry.getValue()) != 1)
+                throw conflict("计划库存余额预占异常，请重新读取库存");
+        }
         List<ReturnInventoryResponses.Label> labels = new ArrayList<>();
         List<String> generatedMarks = "SKU".equals(plan.getMode()) || plannedTarget == null ? packingMarks(request.boxes()) : Collections.nCopies(request.boxes().size(), null);
         int index = 0;
@@ -344,7 +402,7 @@ public class ReturnInventoryService {
             labels.add(result.label());
             ReturnInventoryOperation completedOperation = operations.lockKey(identity.operatorKey(), request.idempotencyKey() + "-" + (index - 1));
             if (completedOperation != null) {
-                completedOperation.setResultJson(json(new ReturnInventoryResponses.MergeResult(result.cartonMark(), result.skuCode(), result.totalQuantity(), result.label(), plan.getPlanNo())));
+                completedOperation.setResultJson(json(new ReturnInventoryResponses.MergeResult(result.cartonMark(), result.skuCode(), result.totalQuantity(), result.label(), plan.getPlanNo(), identity.operatorName())));
                 operations.updateById(completedOperation);
             }
         }
@@ -368,12 +426,25 @@ public class ReturnInventoryService {
         return new ReturnInventoryResponses.PackingPlan(plan.getPlanNo(), plan.getCustomerId(), plan.getOverseasWarehouseId(),
             read(plan.getReturnNosJson(), new TypeReference<>() { }), plan.getMode(), plan.getStatus(), responseBoxes, plan.getRemark(), plan.getPushedAt(),
             sources.stream().map(SourceItem::cartonMark).distinct().toList(),
-            sources.stream().map(SourceItem::cartonMark).distinct().map(mark -> new ReturnInventoryResponses.PlanSource(mark,
-                sources.stream().filter(source -> source.cartonMark().equals(mark)).map(source -> new ReturnInventoryResponses.PlanItem(source.skuCode(), source.quantity())).toList())).toList(),
+            sources.stream().map(SourceItem::cartonMark).distinct().map(mark -> {
+                var lines = sources.stream().filter(source -> source.cartonMark().equals(mark)).toList();
+                var original = lines.get(0).originalItems();
+                long selected = lines.stream().mapToLong(SourceItem::quantity).sum();
+                String participation = original == null ? "UNKNOWN" : original.stream().mapToLong(ReturnInventoryResponses.CartonItem::quantity).sum() == selected ? "FULL" : "PARTIAL";
+                return new ReturnInventoryResponses.PlanSource(mark, lines.stream().map(source -> new ReturnInventoryResponses.PlanItem(source.skuCode(), source.quantity())).toList(),
+                    lines.get(0).sourceReturnNo(), original == null ? List.of() : original, participation);
+            }).toList(),
             plan.getCreatedAt(), "COMPLETED".equals(plan.getStatus())
                 ? read(plan.getResultLabelsJson(), new TypeReference<List<ReturnInventoryResponses.Label>>() { }).stream()
                     .map(label -> cartons.findCustomerMark(plan.getCustomerId(), label.cartonMark()))
-                    .filter(java.util.Objects::nonNull).map(this::cartonDetail).toList() : List.of(), plan.getCompletedAt());
+                    .filter(java.util.Objects::nonNull).map(this::cartonDetail).toList() : List.of(), plan.getCompletedAt(),
+            "COMPLETED".equals(plan.getStatus()) ? read(plan.getResultLabelsJson(), new TypeReference<List<ReturnInventoryResponses.Label>>() { }) : List.of(),
+            packingTrace.planHistory(plan.getCustomerId(), plan.getPlanNo()), packingTrace.planOperator(plan.getPlanNo()));
+    }
+    private Map<String, Long> deductionQuantities(List<SourceItem> lines) {
+        Map<String, Long> quantities = new LinkedHashMap<>();
+        for (var line : lines) quantities.merge(line.cartonMark() + "\u0000" + line.skuCode(), line.quantity(), Math::addExact);
+        return quantities;
     }
     private String json(Object value) { try { return objectMapper.writeValueAsString(value); } catch (Exception error) { throw new IllegalStateException("合箱计划序列化失败", error); } }
     private <T> T read(String value, TypeReference<T> type) { try { return objectMapper.readValue(value == null ? "[]" : value, type); } catch (Exception error) { throw new IllegalStateException("合箱计划数据损坏", error); } }
@@ -448,6 +519,7 @@ public class ReturnInventoryService {
             if (movements.insert(movement) != 1) throw new IllegalStateException("退货出库流水写入失败");
             if (partial) {
                 content.setQuantity(content.getQuantity() - quantity);
+                content.setRelabelledQuantity(Math.min(value(content.getRelabelledQuantity()), content.getQuantity()));
                 if (cartonItems.updateById(content) != 1) throw conflict("退货箱内数量已变化，请重新核对");
             }
         }
@@ -464,8 +536,8 @@ public class ReturnInventoryService {
         required(lines.get(0).skuCode(), "SKU 不能为空");
         String cartonMark = text(requestedMark);
         long cartonId = IdWorker.getId();
-        // A parcel row tracks loose SKU provenance; it is never a physical carton or printable box label.
-        if ("PARCEL".equals(receipt.getUnitType())) cartonMark = "SP" + hash(List.of(receipt.getId(), lines.get(0).skuCode())).substring(0, 24).toUpperCase(java.util.Locale.ROOT);
+        // One durable barcode identifies a physical parcel, irrespective of SKU count.
+        if ("PARCEL".equals(receipt.getUnitType())) cartonMark = "RP-" + Long.toString(receipt.getId(), 36).toUpperCase(java.util.Locale.ROOT);
         else if (cartonMark == null) cartonMark = numbers.next("RETURN_CARTON", order.getOverseasWarehouseId(), cartonId);
         if (cartons.findMark(cartonMark) != null) throw conflict("箱号已存在: " + cartonMark);
         LocalDateTime now = LocalDateTime.now();
@@ -476,11 +548,14 @@ public class ReturnInventoryService {
         carton.setSourceReturnNo(order.getReturnNo()); carton.setCartonMark(cartonMark);
         carton.setPalletCode(text(receipt.getPalletCode()));
         carton.setSourceUnitType(receipt.getUnitType());
+        // PDA signing includes applying the warehouse identification label.
+        carton.setLabelStatus("PALLET".equals(receipt.getUnitType()) ? null : "CONFIRMED");
         carton.setCountStatus("PALLET".equals(receipt.getUnitType()) ? "PENDING" : "CONFIRMED");
         carton.setSourceUnitCode(normalizedUnitCode);
         // Pallet measurements describe the carrier, never each child carton.
-        if ("BOX".equals(receipt.getUnitType())) {
+        if ("BOX".equals(receipt.getUnitType()) || "PARCEL".equals(receipt.getUnitType())) {
             carton.setLength(receipt.getLength()); carton.setWidth(receipt.getWidth()); carton.setHeight(receipt.getHeight()); carton.setWeight(receipt.getWeight());
+            carton.setOriginalPackaging(receipt.getOriginalPackaging());
         }
         carton.setStatus(AVAILABLE); carton.setSkuTypes(lines.size()); carton.setTotalQuantity(total); carton.setCreatedAt(now); carton.setUpdatedAt(now);
         cartons.insert(carton);
@@ -492,7 +567,7 @@ public class ReturnInventoryService {
             balances.adjust(IdWorker.getId(), order.getCustomerId(), order.getOverseasWarehouseId(), line.skuCode(),
                 text(line.productNameZh()), line.quantity(), line.quantity(), "PARCEL".equals(receipt.getUnitType()) ? 0 : 1);
         }
-        if ("BOX".equals(receipt.getUnitType())) {
+        if ("BOX".equals(receipt.getUnitType()) || "PARCEL".equals(receipt.getUnitType())) {
             var contents = lines.stream().map(line -> new com.baiyue.lastleg.returnreceipt.dto.ReturnCartonCountDtos.Sku(line.skuCode(), line.productNameZh(), line.quantity())).toList();
             var snapshot = new com.baiyue.lastleg.returnreceipt.dto.ReturnCartonCountDtos.Task(receipt.getReceiptNo(), order.getReturnNo(), receipt.getPalletCode(), "CONFIRMED", contents,
                 List.of(new com.baiyue.lastleg.returnreceipt.dto.ReturnCartonCountDtos.Box(cartonMark, contents)));
@@ -527,7 +602,8 @@ public class ReturnInventoryService {
     }
 
     private String shortReturnMark(String returnNo, Long receiptId, String skuCode, long totalBoxes, long sequence) {
-        String prefix = hash(java.util.Arrays.asList(returnNo, receiptId, skuCode)).substring(0, 16).toUpperCase(java.util.Locale.ROOT);
+        String prefix = new java.math.BigInteger(hash(java.util.Arrays.asList(returnNo, receiptId, skuCode)).substring(0, 16), 16)
+            .toString(36).toUpperCase(java.util.Locale.ROOT);
         return "RC" + prefix + "#" + totalBoxes + "-" + sequence;
     }
 
@@ -551,7 +627,8 @@ public class ReturnInventoryService {
                 .map(carton -> new ReturnInventoryResponses.CartonSummary(carton.getCartonMark(), carton.getOverseasWarehouseId(),
                     carton.getSourceBatchNo(), carton.getSourceReturnNo(), displayStatus(carton),
                     carton.getSkuTypes() == null ? 0 : carton.getSkuTypes(), value(carton.getTotalQuantity()),
-                    carton.getLength(), carton.getWidth(), carton.getHeight(), carton.getWeight(), carton.getCreatedAt())).toList();
+                    carton.getLength(), carton.getWidth(), carton.getHeight(), carton.getWeight(), carton.getCreatedAt(),
+                    relabelProgressStatus(carton), completedRelabelQuantity(carton), cartons.relabelReservedQuantity(carton.getId()))).toList();
         return new PageResult<>(records, request.page(), request.size(), total, (total + request.size() - 1) / request.size());
     }
 
@@ -573,7 +650,8 @@ public class ReturnInventoryService {
             (request.page() - 1) * request.size(), request.size()).stream().map(balance -> new ReturnInventoryResponses.PlatformStock(
                 balance.getCustomerId(), balance.getOverseasWarehouseId(), balance.getSkuCode(), balance.getProductNameZh(),
                 value(balance.getTotalQuantity()), value(balance.getAvailableQuantity()), value(balance.getCartonQuantity()), balance.getUpdatedAt(),
-                cartonItems.looseAvailableQuantity(balance.getCustomerId(), balance.getOverseasWarehouseId(), balance.getSkuCode()))).toList();
+                cartonItems.looseAvailableQuantity(balance.getCustomerId(), balance.getOverseasWarehouseId(), balance.getSkuCode()),
+                value(balance.getRelabelLockedQuantity()))).toList();
         return new PageResult<>(records, request.page(), request.size(), total, (total + request.size() - 1) / request.size());
     }
 
@@ -594,8 +672,9 @@ public class ReturnInventoryService {
         List<ReturnInventoryResponses.PlatformCarton> records = total == 0 ? List.of() : cartons.platformPage(customerId, warehouseId, cartonMark,
             returnNo, status, sku, (request.page() - 1) * request.size(), request.size()).stream().map(carton -> new ReturnInventoryResponses.PlatformCarton(
                 carton.getCustomerId(), carton.getOverseasWarehouseId(), carton.getCartonMark(), carton.getSourceReturnNo(), carton.getSourceUnitType(), carton.getSourceBatchNo(),
-                displayStatus(carton), carton.getSkuTypes() == null ? 0 : carton.getSkuTypes(), value(carton.getTotalQuantity()), carton.getFbaCartonMark(), carton.getDestinationWarehouseCode(), carton.getDestinationWarehouseName(), carton.getRelabelNo(), carton.getRelabelStatus(), carton.getLength(),
-                carton.getWidth(), carton.getHeight(), carton.getWeight(), carton.getCreatedAt(), carton.getLocationCode(), carton.getPalletCode(), carton.getPutawayAt())).toList();
+                displayStatus(carton), carton.getSkuTypes() == null ? 0 : carton.getSkuTypes(), value(carton.getTotalQuantity()), carton.getFbaCartonMark(), carton.getDestinationWarehouseCode(), carton.getDestinationWarehouseName(), carton.getRelabelNo(), relabelProgressStatus(carton), carton.getLength(),
+                carton.getWidth(), carton.getHeight(), carton.getWeight(), carton.getCreatedAt(), carton.getLocationCode(), carton.getPalletCode(), carton.getPutawayAt(),
+                completedRelabelQuantity(carton), cartons.relabelReservedQuantity(carton.getId()))).toList();
         return new PageResult<>(records, request.page(), request.size(), total, (total + request.size() - 1) / request.size());
     }
 
@@ -652,20 +731,32 @@ public class ReturnInventoryService {
         return label(carton);
     }
 
+    @Transactional
+    public ReturnInventoryResponses.Label confirmLabel(PdaWarehouseIdentity identity, String cartonMark) {
+        ReturnInventoryCarton carton = cartons.lockMark(required(cartonMark, "请扫描已贴好的包裹/箱标签"));
+        if (carton == null || !String.valueOf(identity.overseasWarehouseId()).equals(carton.getOverseasWarehouseId())) throw notFound("当前仓没有该包裹/箱");
+        if (!AVAILABLE.equals(carton.getStatus())) throw conflict("已占用或已拆空的包裹/箱不能确认贴标");
+        if (!"CONFIRMED".equals(carton.getLabelStatus())) {
+            carton.setLabelStatus("CONFIRMED"); carton.setUpdatedAt(LocalDateTime.now()); cartons.updateById(carton);
+        }
+        return label(carton);
+    }
+
     /** Print only persisted physical cartons; a parcel's SKU rows are not cartons. */
     @Transactional(readOnly = true)
     public List<ReturnOrderResponses.ReceiptCarton> receiptContents(ReturnReceipt receipt) {
-        if ("PARCEL".equals(receipt.getUnitType())) return List.of();
         var snapshot = operations.receiptContents(receipt.getCustomerId(), receipt.getId());
         if (snapshot != null) {
             var task = read(snapshot.getResultJson(), new TypeReference<com.baiyue.lastleg.returnreceipt.dto.ReturnCartonCountDtos.Task>() { });
             if (!receipt.getReceiptNo().equals(task.receiptNo())) throw new IllegalStateException("箱内清点快照与签收单不一致");
             return task.boxes().stream().map(box -> new ReturnOrderResponses.ReceiptCarton(receipt.getReceiptNo(), receipt.getPalletCode(), box.cartonMark(), "CONFIRMED", snapshot.getCreatedAt(),
-                box.items().stream().map(line -> new ReturnOrderResponses.ReceiptItem(line.skuCode(), line.productNameZh(), line.quantity(), 1)).toList())).toList();
+                box.items().stream().map(line -> new ReturnOrderResponses.ReceiptItem(line.skuCode(), line.productNameZh(), line.quantity(), 1)).toList(),
+                box.length(), box.width(), box.height(), box.weight())).toList();
         }
         // Never present provisional averages or subsequently changed inventory as receipt facts.
         return cartons.listReceipt(receipt.getId()).stream().map(box -> new ReturnOrderResponses.ReceiptCarton(receipt.getReceiptNo(), receipt.getPalletCode(), box.getCartonMark(),
-            "PENDING".equals(box.getCountStatus()) ? "PENDING" : "UNRECORDED", box.getCountedAt(), List.of())).toList();
+            "PENDING".equals(box.getCountStatus()) ? "PENDING" : "UNRECORDED", box.getCountedAt(), List.of(),
+            box.getLength(), box.getWidth(), box.getHeight(), box.getWeight())).toList();
     }
 
     @Transactional(readOnly = true)
@@ -673,7 +764,6 @@ public class ReturnInventoryService {
                                                                 List<ReturnOrderLine> lines) {
         List<ReturnInventoryCarton> existing = cartons.listReceipt(receipt.getId()).stream()
             .filter(carton -> !"MERGED".equals(carton.getStatus())).toList();
-        if ("PARCEL".equals(receipt.getUnitType())) return List.of();
         long expected = "BOX".equals(receipt.getUnitType()) ? Math.max(1, value(receipt.getTotalBoxCount()))
             : lines.stream().mapToLong(line -> Math.max(0, line.boxCount())).sum();
         if (expected <= 0 || existing.size() >= expected) {
@@ -831,7 +921,7 @@ public class ReturnInventoryService {
     public ReturnInventoryResponses.CartonDetail scanCarton(PdaWarehouseIdentity identity, String mark) {
         ReturnInventoryCarton carton = cartons.findMark(required(mark, "箱唛不能为空"));
         if (carton == null || !String.valueOf(identity.overseasWarehouseId()).equals(carton.getOverseasWarehouseId())) throw notFound("当前仓没有该退货箱");
-        if (!AVAILABLE.equals(carton.getStatus()) || "PARCEL".equals(carton.getSourceUnitType())) throw conflict("该箱不是可用实物箱");
+        if (!AVAILABLE.equals(carton.getStatus())) throw conflict("该包裹/箱不是可用实物单元");
         ReturnCartonCountGuard.requireConfirmed(carton);
         return cartonDetail(carton);
     }
@@ -851,7 +941,7 @@ public class ReturnInventoryService {
         for (String mark : request.sourceCartonMarks().stream().distinct().sorted().toList()) {
             if (mark.equals(request.targetCartonMark())) throw badRequest("来源箱不能与目标箱相同");
             ReturnInventoryCarton carton = cartons.lockMark(mark);
-            if (carton == null || !AVAILABLE.equals(carton.getStatus()) || "PARCEL".equals(carton.getSourceUnitType())
+            if (carton == null || !AVAILABLE.equals(carton.getStatus())
                 || !String.valueOf(identity.overseasWarehouseId()).equals(carton.getOverseasWarehouseId())) throw conflict("来源箱不存在或不可合并");
             if (customer != null && !customer.equals(carton.getCustomerId())) throw conflict("不同客户的箱不能合并");
             ReturnCartonCountGuard.requireConfirmed(carton);
@@ -868,6 +958,10 @@ public class ReturnInventoryService {
         }
         if(request.sourceDeductions() != null && request.sourceDeductions().stream().anyMatch(d -> !limits.containsKey(d.cartonMark()) || !limits.get(d.cartonMark()).containsKey(d.skuCode()))) throw badRequest("扣除明细不属于已扫描来源箱");
         String targetMark = text(request.targetCartonMark());
+        if (targetMark != null && request.sourceCartonMarks().stream().anyMatch(mark ->
+            cartonItems.lockCarton(cartons.lockMark(mark).getId()).stream().anyMatch(item ->
+                value(limits.get(mark).get(item.getSkuCode())) != value(item.getQuantity()))))
+            throw conflict("部分包裹/箱必须合箱生成独立新箱，不能并入已有箱");
         if(targetMark == null && (request.length()==null || request.width()==null || request.height()==null || request.weight()==null)) throw badRequest("新增目标箱必须填写箱规");
         var planItems=quantities.entrySet().stream().map(e -> new ReturnInventoryRequests.PlanItem(e.getKey(),e.getValue())).toList();
         String newMark=targetMark==null?packingMarks(List.of(new ReturnInventoryRequests.PlanBox(planItems,request.length(),request.width(),request.height(),request.weight()))).get(0):null;
@@ -921,8 +1015,7 @@ public class ReturnInventoryService {
             throw conflict("目标箱已有合箱预占，不能并入");
         if (existingTarget != null) ReturnCartonCountGuard.requireConfirmed(existingTarget);
         if (existingTarget != null) for (var item : cartonItems.lockCarton(existingTarget.getId())) {
-            long tracked = packingTrace.ownership(customerId, targetMark, item.getSkuCode()).stream()
-                .mapToLong(com.baiyue.lastleg.returnreceipt.mapper.ReturnPackingTraceMapper.Ownership::quantity).sum();
+            long tracked = packingTrace.netTrackedQuantity(customerId, targetMark, item.getSkuCode());
             if (tracked < value(item.getQuantity())) {
                 String[] origins = required(existingTarget.getSourceReturnNo(), "目标箱来源退货单缺失").split(",");
                 if (origins.length != 1) throw conflict("历史目标混箱缺少 SKU 来源明细");
@@ -956,31 +1049,49 @@ public class ReturnInventoryService {
         Map<String, Long> requested = new LinkedHashMap<>();
         Map<String, String> productNames = new LinkedHashMap<>();
         for (ReturnInventoryRequests.ValidItem item : request.items()) {
-            String sku = required(item.skuCode(), "SKU 不能为空").toUpperCase(java.util.Locale.ROOT);
+            String sku = required(item.skuCode(), "SKU 不能为空");
             if (requested.put(sku, item.quantity()) != null) throw badRequest("合箱 SKU 不能重复");
         }
         Map<String, Long> remaining = new LinkedHashMap<>(requested);
         Map<String, Integer> emptiedBySku = new LinkedHashMap<>();
+        Map<String, Long> movedRelabelled = new LinkedHashMap<>();
         LinkedHashSet<String> consumedBatchNos = new LinkedHashSet<>();
         LinkedHashSet<String> consumedReturnNos = new LinkedHashSet<>();
         Map<Long, Map<String, Long>> attachedByOrder = new LinkedHashMap<>();
         List<TraceTransfer> transfers = new ArrayList<>();
+        java.util.Set<Long> completedRelabelSources = new java.util.HashSet<>();
         long total = 0;
         for (ReturnInventoryCarton source : sources) {
             // Read committed quantities under the source lock, never a stale MVCC snapshot.
             List<ReturnInventoryCartonItem> sourceItems = cartonItems.lockCarton(source.getId());
+            boolean hasCompletedRelabel = sourceItems.stream().anyMatch(i -> cartons.completedSkuQuantity(source.getId(), i.getSkuCode()) > 0);
+            if (hasCompletedRelabel) completedRelabelSources.add(source.getId());
+            if (hasCompletedRelabel && source.getRelabelApplicationId() == null && sourceItems.stream().anyMatch(i -> {
+                long free = Math.max(0, value(i.getQuantity()) - value(i.getPackingReservedQuantity()));
+                long allowed = limits == null ? free : Math.min(free, value(limits.getOrDefault(source.getCartonMark(), Map.of()).get(i.getSkuCode())));
+                return Math.min(value(remaining.get(i.getSkuCode())), allowed) != value(i.getQuantity());
+            })) throw conflict("已换标与未换标货物不能自动分配来源，请先在换标任务内隔离为独立新箱，或整箱合并");
             long sourceTotal = 0; int sourceTypes = 0;
             for (ReturnInventoryCartonItem item : sourceItems) {
-                String sku = item.getSkuCode().toUpperCase(java.util.Locale.ROOT);
+                String sku = item.getSkuCode();
                 long free = Math.max(0, value(item.getQuantity()) - value(item.getPackingReservedQuantity()));
                 long allowed = limits == null ? free : Math.min(free, value(limits.getOrDefault(source.getCartonMark(), Map.of()).get(sku)));
                 long take = Math.min(value(remaining.get(sku)), allowed);
                 if (take > 0) {
+                    long labelled = value(item.getRelabelledQuantity());
+                    if (labelled > 0 && labelled < value(item.getQuantity()) && take != value(item.getQuantity()))
+                        throw conflict("已换标 SKU 只能按当前完整来源明细移箱，不能猜测部分实物来源");
+                    long movedLabelled = Math.min(labelled, take);
+                    movedRelabelled.merge(sku, movedLabelled, Math::addExact);
+                    item.setRelabelledQuantity(labelled - movedLabelled);
                     if (limits != null) limits.get(source.getCartonMark()).put(sku, allowed - take);
                     consumedBatchNos.add(required(source.getSourceBatchNo(), "来源签收批次缺失，无法合箱"));
                     consumedReturnNos.addAll(java.util.Arrays.asList(required(source.getSourceReturnNo(), "来源退货单缺失，无法合箱").split(",")));
                     long toTrace = take;
-                    for (var origin : ownership(source, sku, value(item.getQuantity()))) {
+                    var origins = ownership(source, sku, value(item.getQuantity()));
+                    if (origins.size() > 1 && take < value(item.getQuantity()))
+                        throw conflict("跨来源单同 SKU 部分移箱须先现场分拣确认，不能自动猜测来源归属");
+                    for (var origin : origins) {
                         long traced = Math.min(toTrace, origin.quantity());
                         if (traced > 0) transfers.add(new TraceTransfer(source.getCartonMark(), origin.returnNo(), sku, traced));
                         toTrace -= traced;
@@ -1016,6 +1127,8 @@ public class ReturnInventoryService {
         }
         target.setSourceBatchNo(String.join(",", consumedBatchNos)); target.setSourceReturnNo(String.join(",", consumedReturnNos)); target.setStatus(AVAILABLE);
         if (existingTarget == null) {
+            target.setCountStatus("CONFIRMED");
+            target.setLabelStatus("WAIT_LABEL");
             target.setSkuTypes(requested.size()); target.setTotalQuantity(total); target.setLength(request.length()); target.setWidth(request.width());
             target.setHeight(request.height()); target.setWeight(request.weight()); target.setCreatedAt(now); target.setUpdatedAt(now); cartons.insert(target);
         }
@@ -1025,18 +1138,33 @@ public class ReturnInventoryService {
             if (targetItem == null) {
                 targetItem = new ReturnInventoryCartonItem(); targetItem.setId(IdWorker.getId()); targetItem.setCartonId(targetId);
                 targetItem.setCustomerId(customerId); targetItem.setSkuCode(entry.getKey()); targetItem.setProductNameZh(productNames.get(entry.getKey()));
-                targetItem.setQuantity(entry.getValue()); targetItem.setPackingReservedQuantity(0L); cartonItems.insert(targetItem);
-            } else { targetItem.setQuantity(Math.addExact(value(targetItem.getQuantity()), entry.getValue())); cartonItems.updateById(targetItem); }
+                targetItem.setQuantity(entry.getValue()); targetItem.setPackingReservedQuantity(0L);
+                targetItem.setRelabelledQuantity(movedRelabelled.getOrDefault(entry.getKey(), 0L)); cartonItems.insert(targetItem);
+            } else { targetItem.setQuantity(Math.addExact(value(targetItem.getQuantity()), entry.getValue()));
+                targetItem.setRelabelledQuantity(Math.addExact(value(targetItem.getRelabelledQuantity()), movedRelabelled.getOrDefault(entry.getKey(), 0L)));
+                cartonItems.updateById(targetItem); }
             long cartonDelta = (addedSku ? 1L : 0L) - emptiedBySku.getOrDefault(entry.getKey(), 0);
             if (balances.adjustCartonQuantity(customerId, target.getOverseasWarehouseId(), entry.getKey(), cartonDelta) != 1)
                 throw new IllegalStateException("退货合箱库存箱数更新失败: " + entry.getKey());
         }
         if (existingTarget != null) {
             target.setTotalQuantity(cartonItems.totalQuantity(targetId)); target.setSkuTypes(cartonItems.skuTypes(targetId));
+            if (request.weight() != null) target.setWeight(request.weight());
+            else {
+                BigDecimal combinedWeight = target.getWeight();
+                for (var source : sources) combinedWeight = combinedWeight == null || source.getWeight() == null
+                    ? null : combinedWeight.add(source.getWeight());
+                target.setWeight(combinedWeight);
+            }
+            if (request.length() != null) target.setLength(request.length());
+            if (request.width() != null) target.setWidth(request.width());
+            if (request.height() != null) target.setHeight(request.height());
             target.setUpdatedAt(now); target.setLocationCode(null); target.setPutawayAt(null); cartons.updateById(target); cartons.clearPutaway(targetId);
         }
         for (TraceTransfer transfer : transfers) packingTrace.insert(IdWorker.getId(), customerId, operation.getId(),
             transfer.source(), target.getCartonMark(), transfer.returnNo(), transfer.sku(), transfer.quantity(), now);
+        for (ReturnInventoryCarton source : sources) if (completedRelabelSources.contains(source.getId()) && MERGED.equals(source.getStatus()) && source.getRelabelApplicationId() == null)
+            relabelItems.moveCompletedReturnCarton(customerId, source.getId(), targetId, target.getCartonMark());
         var result = new ReturnInventoryResponses.MergeResult(target.getCartonMark(), requested.keySet().iterator().next(), value(target.getTotalQuantity()), label(target));
         operation.setResultCartonId(targetId); operation.setResultJson(json(result)); operation.setUpdatedAt(now); operations.updateById(operation);
         return result;
@@ -1063,7 +1191,13 @@ public class ReturnInventoryService {
             if (origins.length != 1) throw conflict("历史混箱缺少逐 SKU 来源明细，不能继续合并");
             result.add(new com.baiyue.lastleg.returnreceipt.mapper.ReturnPackingTraceMapper.Ownership(origins[0], quantity - traced));
         }
-        return result;
+        // Existing trace and the original untracked remainder can belong to the same return.
+        // Coalesce before checking for multiple owners or recording a new movement.
+        Map<String, Long> byReturn = new LinkedHashMap<>();
+        for (var origin : result) byReturn.merge(origin.returnNo(), origin.quantity(), Math::addExact);
+        return byReturn.entrySet().stream()
+            .map(entry -> new com.baiyue.lastleg.returnreceipt.mapper.ReturnPackingTraceMapper.Ownership(entry.getKey(), entry.getValue()))
+            .toList();
     }
 
     private ReturnInventoryResponses.MergeResult replayMerge(ReturnInventoryOperation operation, String requestHash) {
@@ -1093,12 +1227,15 @@ public class ReturnInventoryService {
     private ReturnInventoryResponses.InventoryItem item(ReturnInventoryRow row) {
         return new ReturnInventoryResponses.InventoryItem(row.getOverseasWarehouseId(), row.getCartonMark(), row.getSourceBatchNo(), row.getStatus(),
             row.getSkuCode(), row.getProductNameZh(), value(row.getQuantity()), row.getSkuTypes() == null ? 0 : row.getSkuTypes(),
-            value(row.getTotalQuantity()), row.getCreatedAt());
+            value(row.getTotalQuantity()), row.getCreatedAt(), value(row.getRelabelledQuantity()),
+            AVAILABLE.equals(row.getStatus()) ? Math.max(0, value(row.getQuantity()) - value(row.getPackingReservedQuantity())
+                - value(row.getRelabelledQuantity()) - cartons.completedSkuQuantity(row.getCartonId(), row.getSkuCode())) : 0);
     }
 
     private ReturnInventoryResponses.SummaryItem summary(com.baiyue.lastleg.returnreceipt.entity.ReturnInventoryBalance balance) {
         return new ReturnInventoryResponses.SummaryItem(balance.getOverseasWarehouseId(), balance.getSkuCode(), balance.getProductNameZh(),
-            value(balance.getTotalQuantity()), value(balance.getAvailableQuantity()), value(balance.getCartonQuantity()), balance.getUpdatedAt());
+            value(balance.getTotalQuantity()), value(balance.getAvailableQuantity()), value(balance.getCartonQuantity()), balance.getUpdatedAt(),
+            value(balance.getRelabelLockedQuantity()));
     }
 
     private static String displayStatus(ReturnInventoryCarton carton) {
@@ -1109,9 +1246,22 @@ public class ReturnInventoryService {
         List<ReturnInventoryResponses.CartonItem> items = cartonItems.listCarton(carton.getId()).stream()
             .map(item -> new ReturnInventoryResponses.CartonItem(item.getSkuCode(), item.getProductNameZh(), item.getQuantity(),
                 "AVAILABLE".equals(carton.getStatus()) && "CONFIRMED".equals(carton.getCountStatus())
-                    ? Math.max(0, value(item.getQuantity()) - value(item.getPackingReservedQuantity())) : 0)).toList();
+                    ? Math.max(0, value(item.getQuantity()) - value(item.getPackingReservedQuantity())) : 0,
+                value(item.getRelabelledQuantity()), "AVAILABLE".equals(carton.getStatus())
+                    ? Math.max(0, value(item.getQuantity()) - value(item.getPackingReservedQuantity()) - value(item.getRelabelledQuantity())
+                        - cartons.completedSkuQuantity(carton.getId(), item.getSkuCode())) : 0)).toList();
         return new ReturnInventoryResponses.CartonDetail(carton.getCartonMark(), carton.getCustomerId(), carton.getOverseasWarehouseId(), carton.getSourceBatchNo(), carton.getSourceReturnNo(),
-            displayStatus(carton), carton.getFbaCartonMark(), carton.getDestinationWarehouseCode(), carton.getDestinationWarehouseName(), carton.getRelabelNo(), carton.getRelabelStatus(), carton.getSkuTypes() == null ? 0 : carton.getSkuTypes(), value(carton.getTotalQuantity()), carton.getLength(), carton.getWidth(), carton.getHeight(), carton.getWeight(), carton.getCreatedAt(), items, carton.getLocationCode(), carton.getPalletCode(), carton.getPutawayAt(), packingTrace.listCartonHistory(carton.getCustomerId(), carton.getCartonMark()));
+            displayStatus(carton), carton.getFbaCartonMark(), carton.getDestinationWarehouseCode(), carton.getDestinationWarehouseName(), carton.getRelabelNo(), relabelProgressStatus(carton), carton.getSkuTypes() == null ? 0 : carton.getSkuTypes(), value(carton.getTotalQuantity()), carton.getLength(), carton.getWidth(), carton.getHeight(), carton.getWeight(), carton.getCreatedAt(), items, carton.getLocationCode(), carton.getPalletCode(), carton.getPutawayAt(), packingTrace.listCartonHistory(carton.getCustomerId(), carton.getCartonMark()),
+            completedRelabelQuantity(carton), cartons.relabelReservedQuantity(carton.getId()),
+            skuConversions.listCarton(carton.getCustomerId(), carton.getId()).stream().map(ReturnInventoryResponses.SkuConversion::from).toList());
+    }
+
+    private String relabelProgressStatus(ReturnInventoryCarton carton) {
+        return ReturnRelabelProgress.status(value(carton.getTotalQuantity()), completedRelabelQuantity(carton), cartons.relabelReservedQuantity(carton.getId()));
+    }
+    private long completedRelabelQuantity(ReturnInventoryCarton carton) {
+        return Math.max(cartons.totalRelabelledQuantity(carton.getId()), cartonItems.listCarton(carton.getId()).stream()
+            .mapToLong(line -> value(line.getRelabelledQuantity()) + cartons.completedSkuQuantity(carton.getId(), line.getSkuCode())).sum());
     }
 
     private static String printableHtml(ReturnInventoryCarton carton) {
@@ -1127,7 +1277,7 @@ public class ReturnInventoryService {
             .map(ReturnInventoryRequests.PlanItem::skuCode).distinct().sorted().toList()).toList();
         Map<List<String>, Long> totals = groups.stream().collect(java.util.stream.Collectors.groupingBy(group -> group, LinkedHashMap::new, java.util.stream.Collectors.counting()));
         Map<List<String>, String> prefixes = new HashMap<>(); Map<List<String>, Long> sequences = new HashMap<>();
-        return groups.stream().map(group -> prefixes.computeIfAbsent(group, ignored -> "RC" + java.util.UUID.randomUUID().toString().replace("-", "").substring(0, 16).toUpperCase(java.util.Locale.ROOT))
+        return groups.stream().map(group -> prefixes.computeIfAbsent(group, ignored -> LastlegOrderNoGenerator.compactCartonMark(IdWorker.getId()))
             + "#" + totals.get(group) + "-" + sequences.merge(group, 1L, Long::sum)).toList();
     }
     private String hash(Object request) { try { return java.util.HexFormat.of().formatHex(MessageDigest.getInstance("SHA-256")
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/service/ReturnReceiptService.java b/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/service/ReturnReceiptService.java
index 72dd83856..4539015bd 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/service/ReturnReceiptService.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/service/ReturnReceiptService.java
@@ -62,6 +62,7 @@ public class ReturnReceiptService {
     public static final String PARTIALLY_RECEIVED = "PARTIALLY_RECEIVED";
     public static final String COMPLETED = "COMPLETED";
 
+    @Resource private com.baiyue.lastleg.service.CompactBusinessNumberService compactNumbers;
     @Resource private ReturnOrderMapper orders;
     @Resource private ReturnOrderItemMapper orderItems;
     @Resource private ReturnReceiptMapper receipts;
@@ -99,7 +100,7 @@ public class ReturnReceiptService {
         order.setOverseasWarehouseId(text(request.overseasWarehouseId()));
         order.setWarehouseContactName(text(request.warehouseContactName()));
         order.setWarehouseContactPhone(text(request.warehouseContactPhone()));
-        order.setReturnNo(numbers.next("RETURN", order.getOverseasWarehouseId(), order.getId()));
+        order.setReturnNo(compactNumbers.next("TT", customerId));
         order.setCustomerReferenceNo(text(request.customerReferenceNo())); order.setNeedRelabel(request.needRelabel()); order.setStatus(PENDING_REVIEW);
         order.setExpectedSkuTypes(skuCodes.size()); order.setExpectedQuantity(expected); order.setReceivedQuantity(0L);
         order.setRemark(text(request.remark())); order.setIdempotencyKey(key); order.setRequestHash(requestHash);
@@ -278,7 +279,7 @@ public class ReturnReceiptService {
                 .toList();
             long boxes = value(receipt.getTotalBoxCount());
             if (boxes == 0) boxes = lines.stream().mapToLong(ReturnOrderResponses.ReceiptItem::boxCount).sum();
-            String cartonMark = "PARCEL".equals(receipt.getUnitType()) ? null : text(receipt.getCartonMark());
+            String cartonMark = text(receipt.getCartonMark());
             List<ReturnInventoryService.ReturnOrderLine> labelLines = lines.stream()
                 .map(line -> new ReturnInventoryService.ReturnOrderLine(line.skuCode(), line.productNameZh(), line.quantity(), line.boxCount()))
                 .toList();
@@ -286,7 +287,7 @@ public class ReturnReceiptService {
             String printableHtml = combineLabels(labels);
             return new ReturnOrderResponses.Receipt(receipt.getReceiptNo(), receipt.getReceiptBatchNo(), receipt.getPalletCode(), receipt.getTrackingNo(),
                 receipt.getBoundBy(), value(receipt.getReceivedQuantity()), receipt.getOperatorName(), receipt.getSignedAt(), receipt.getUnitType(), receipt.getUnitCode(), boxes, lines, cartonMark, printableHtml, labels,
-                inventory.receiptRepairRequired(receipt, boxes));
+                inventory.receiptRepairRequired(receipt, boxes), receipt.getLength(), receipt.getWidth(), receipt.getHeight(), receipt.getWeight());
         }).toList();
         Map<String, Map<String, ReturnOrderResponses.PalletItem>> palletItems = new LinkedHashMap<>();
         Map<String, String> palletTypes = new LinkedHashMap<>();
@@ -321,7 +322,8 @@ public class ReturnReceiptService {
             .map(file -> new ReturnOrderResponses.Photo(file.fileId(), file.fileName(), file.contentType(), file.sizeBytes())).toList();
         return new ReturnOrderResponses.Detail(summary(order, relabelSubOrders(List.of(order)).getOrDefault(order.getLastlegOrderId(), List.of())), order.getRemark(), items, receiptViews, palletViews, photos,
             inventory.packingHistory(order.getCustomerId(), order.getReturnNo()),
-            orderReceipts.stream().flatMap(receipt -> inventory.receiptContents(receipt).stream()).toList());
+            orderReceipts.stream().flatMap(receipt -> inventory.receiptContents(receipt).stream()).toList(),
+            inventory.currentReturnCartons(order.getCustomerId(), order.getOverseasWarehouseId(), order.getReturnNo()));
     }
 
     private String combineLabels(List<ReturnOrderResponses.CartonLabel> labels) {
@@ -382,13 +384,14 @@ public class ReturnReceiptService {
         if (order == null) throw notFound("退货单不存在");
         if (!COMPLETED.equals(order.getStatus())) throw conflict("退货单尚未完成签收");
         List<ReturnOrderResponses.RelabelCandidate> result = new ArrayList<>();
-        for (ReturnReceipt receipt : receipts.listOrder(order.getId())) {
-            for (ReturnInventoryCarton carton : cartons.listReceipt(receipt.getId())) {
+        for (ReturnInventoryCarton carton : cartons.findAvailable(customerId, order.getOverseasWarehouseId())) {
+                if (!inventory.matchesReturnSource(carton, order.getReturnNo())) continue;
                 if (!ReturnInventoryService.AVAILABLE.equals(carton.getStatus()) || !"CONFIRMED".equals(carton.getCountStatus()) || carton.getRelabelApplicationId() != null) continue;
                 List<ReturnOrderResponses.Item> items = cartonItems.listCarton(carton.getId()).stream()
-                    .map(i -> new ReturnOrderResponses.Item(i.getSkuCode(), i.getProductNameZh(), value(i.getQuantity()), value(i.getQuantity()))).toList();
+                    .map(i -> new ReturnOrderResponses.Item(i.getSkuCode(), i.getProductNameZh(), remainingRelabelQuantity(carton.getId(), i), remainingRelabelQuantity(carton.getId(), i)))
+                    .filter(i -> i.receivedQuantity() > 0).toList();
+                if (items.isEmpty()) continue;
                 result.add(new ReturnOrderResponses.RelabelCandidate(carton.getId(), carton.getCartonMark(), carton.getSourceReturnNo(), carton.getStatus(), value(carton.getTotalQuantity()), items, carton.getRelabelStatus()));
-            }
         }
         return result;
     }
@@ -419,18 +422,18 @@ public class ReturnReceiptService {
         long totalQuantity = 0;
         for (ReturnOrderRequests.RelabelItem requested : request.items()) {
             String sku = norm(requested.skuCode());
-            if (!seen.add(sku)) throw badRequest("同一贴标申请不能重复选择 SKU: " + requested.skuCode());
+            if (!seen.add(sku + ":" + text(requested.cartonMark()))) throw badRequest("同一包裹/箱 SKU 不能重复选择: " + requested.skuCode());
             ReturnOrderItem received = receivedBySku.get(sku);
-            if (received == null || requested.quantity() > value(received.getReceivedQuantity())) {
+            if (text(requested.cartonMark()) == null && (received == null || requested.quantity() > value(received.getReceivedQuantity()))) {
                 throw conflict("SKU " + requested.skuCode() + " 的贴标数量超过当前退货单实收数量");
             }
             totalQuantity = Math.addExact(totalQuantity, requested.quantity());
         }
         long appId = IdWorker.getId(); LocalDateTime now = LocalDateTime.now();
-        String relabelNo = numbers.next("RELABEL", order.getOverseasWarehouseId(), appId);
+        String relabelNo = compactNumbers.next("TT", customerId);
         LastlegOrder tail = order.getLastlegOrderId() == null ? null : lastlegOrders.selectById(order.getLastlegOrderId());
         if (tail == null) {
-            tail = new LastlegOrder(); tail.setId(IdWorker.getId()); tail.setOrderNo(numbers.next("RELABEL", order.getOverseasWarehouseId(), tail.getId()));
+            tail = new LastlegOrder(); tail.setId(IdWorker.getId()); tail.setOrderNo(relabelNo);
             tail.setCustomerId(customerId); tail.setOrderType("RELABEL_APPLICATION"); tail.setSourceRegion("CUSTOMER");
             tail.setSourceInboundId("RETURN_RELABEL:" + relabelNo);
             tail.setSourceEventId("RETURN_RELABEL:" + relabelNo);
@@ -445,9 +448,8 @@ public class ReturnReceiptService {
         // Do not create a second independent tail order or overwrite the inbound status.
         tail.setRelabelOrderNo(relabelNo);
         tail.setRelabelStatus("PENDING_REVIEW");
-        tail.setSubOrderStatus("RETURN_RELABEL:PENDING_REVIEW");
-        tail.setCurrentStatus("RETURN_RELABEL".equals(tail.getOrderType()) ? "INBOUND_COMPLETED" : tail.getCurrentStatus());
         if (!"RETURN_RELABEL".equals(tail.getOrderType())) {
+            tail.setSubOrderStatus("RETURN_RELABEL:PENDING_REVIEW");
             tail.setPackageCount(Math.toIntExact(totalQuantity));
             tail.setProductQuantity(Math.toIntExact(totalQuantity));
         }
@@ -460,27 +462,37 @@ public class ReturnReceiptService {
         app.setFulfillmentStatus("WAIT_APPROVAL"); app.setRemark(text(request.cartonRemark())); app.setStatus("PENDING_REVIEW"); app.setItemCount(request.items().size()); app.setTotalPackageCount(Math.toIntExact(totalQuantity)); app.setNotifiedPackageCount(Math.toIntExact(totalQuantity)); app.setChargeAmount(java.math.BigDecimal.ZERO); app.setChargeCurrency("CNY"); app.setWalletStatus("NOT_REQUIRED"); app.setIdempotencyKey(key); app.setRequestHash(requestHash); app.setCreatedBy(text(operatorId)); app.setCreatedAt(now); app.setUpdatedAt(now); relabelApplications.insert(app);
         List<ReturnInventoryCarton> availableCartons = cartons.findAvailable(customerId, order.getOverseasWarehouseId());
         Map<Long, ReturnInventoryCarton> selectedCartons = new LinkedHashMap<>();
+        Map<List<String>, Long> allocatedBySourceSku = new LinkedHashMap<>();
         for (ReturnOrderRequests.RelabelItem requested : request.items()) {
             ReturnOrderItem source = receivedBySku.get(norm(requested.skuCode()));
             long remaining = requested.quantity();
             for (ReturnInventoryCarton candidate : availableCartons) {
                 if (remaining == 0) break;
-                if (!order.getReturnNo().equals(candidate.getSourceReturnNo())) continue;
+                if (!inventory.matchesReturnSource(candidate, order.getReturnNo())) continue;
+                if (text(requested.cartonMark()) != null && !requested.cartonMark().equals(candidate.getCartonMark())) continue;
                 long skuQuantity = cartonItems.listCarton(candidate.getId()).stream()
                     .filter(line -> norm(requested.skuCode()).equals(norm(line.getSkuCode())))
-                    .mapToLong(line -> value(line.getQuantity())).sum();
-                skuQuantity -= cartons.relabelledQuantity(candidate.getId(), norm(requested.skuCode()));
+                    .mapToLong(line -> remainingRelabelQuantity(candidate.getId(), line)).sum();
                 if (skuQuantity <= 0) continue;
                 ReturnInventoryCarton carton = selectedCartons.computeIfAbsent(candidate.getId(), ignored -> cartons.lockId(candidate.getId()));
                 if (carton == null || !"AVAILABLE".equals(carton.getStatus()) || carton.getRelabelApplicationId() != null)
                     throw conflict("退货箱已被其他换标申请占用，请刷新后重试");
                 if (cartonItems.lockCarton(carton.getId()).stream().anyMatch(line -> value(line.getPackingReservedQuantity()) > 0))
                     throw conflict("退货 SKU 已被合箱计划锁定，请先完成或取消合箱计划");
+                skuQuantity = cartonItems.lockCarton(carton.getId()).stream()
+                    .filter(line -> norm(requested.skuCode()).equals(norm(line.getSkuCode())))
+                    .mapToLong(line -> remainingRelabelQuantity(carton.getId(), line)).sum();
+                var sourceSku = List.of(carton.getCartonMark(), norm(requested.skuCode()));
+                skuQuantity -= allocatedBySourceSku.getOrDefault(sourceSku, 0L);
+                if (skuQuantity <= 0) continue;
                 long allocated = Math.min(remaining, skuQuantity);
+                if (text(carton.getSourceReturnNo()) != null && carton.getSourceReturnNo().contains(","))
+                    throw conflict("跨来源单合箱请按当前实物箱号申请贴标，不能按单据分配混箱中的 SKU");
+                allocatedBySourceSku.merge(sourceSku, allocated, Math::addExact);
                 ReturnCartonCountGuard.requireConfirmed(carton);
                 RelabelItem item = new RelabelItem(); item.setId(IdWorker.getId()); item.setApplicationId(appId); item.setCustomerId(customerId);
-                item.setSkuCode(source.getSkuCode());
-                item.setProductNameZh(text(source.getProductNameZh()) == null ? source.getSkuCode() : text(source.getProductNameZh()));
+                item.setSkuCode(requested.skuCode());
+                item.setProductNameZh(source == null || text(source.getProductNameZh()) == null ? requested.skuCode() : text(source.getProductNameZh()));
                 item.setTotalPackageCount(Math.toIntExact(allocated)); item.setNotifiedPackageCount(Math.toIntExact(allocated));
                 item.setShipmentNo(order.getReturnNo()); item.setLabelRequirement(text(request.cartonRemark()));
                 item.setDestinationWarehouseId(String.valueOf(destination.id())); item.setDestinationFbaWarehouseCode(destination.code());
@@ -601,9 +613,9 @@ public class ReturnReceiptService {
         if ("PARCEL".equals(unitType) && request.totalBoxCount() != null) throw badRequest("包裹签收不填写箱数");
         if (unitCode == null && "PALLET".equals(unitType)) unitCode = text(request.palletCode());
         if (unitCode == null && "BOX".equals(unitType))
-            unitCode = "RC" + hash(List.of(order.getReturnNo(), IdWorker.getId())).substring(0, 16).toUpperCase(java.util.Locale.ROOT) + "#1-1";
+            unitCode = LastlegOrderNoGenerator.compactCartonMark(IdWorker.getId());
         if (unitCode == null && "PARCEL".equals(unitType)) {
-            unitCode = "PK" + hash(List.of(order.getReturnNo(), IdWorker.getId())).substring(0, 16).toUpperCase(java.util.Locale.ROOT);
+            unitCode = "PK-" + Long.toString(IdWorker.getId(), 36).toUpperCase(java.util.Locale.ROOT);
         }
         if (unitCode == null) throw badRequest(("PALLET".equals(unitType) ? "托盘码" : "包裹码") + "不能为空");
         if ("PALLET".equals(unitType)
@@ -612,6 +624,14 @@ public class ReturnReceiptService {
                 || request.height().signum() <= 0 || request.weight().signum() <= 0)) {
             throw badRequest("托盘签收必须填写有效的长、宽、高和重量");
         }
+        if ("BOX".equals(unitType) || "PARCEL".equals(unitType)) {
+            if (request.originalPackaging() == null) throw badRequest("箱子或包裹必须选择是否使用原箱原包装");
+            if (request.length() == null || request.width() == null || request.height() == null || request.weight() == null
+                || request.length().signum() <= 0 || request.width().signum() <= 0
+                || request.height().signum() <= 0 || request.weight().signum() <= 0) {
+                throw badRequest("箱子或包裹必须填写有效的长、宽、高和重量");
+            }
+        }
         LocalDateTime now = LocalDateTime.now();
         long receiptId = IdWorker.getId();
         ReturnReceipt receipt = new ReturnReceipt();
@@ -623,6 +643,8 @@ public class ReturnReceiptService {
         receipt.setTotalBoxCount(totalBoxCount);
         receipt.setPalletCode("PALLET".equals(unitType) ? unitCode : ("BOX".equals(unitType) ? text(request.palletCode()) : null));
         receipt.setLength(request.length()); receipt.setWidth(request.width()); receipt.setHeight(request.height()); receipt.setWeight(request.weight());
+        receipt.setOriginalPackaging(request.originalPackaging());
+        receipt.setMeasurementSource("PALLET".equals(unitType) ? "PALLET_MEASURED" : "UNIT_MEASURED");
         receipt.setReceivedQuantity(receiptQuantity); receipt.setOperatorId(identity.operatorKey());
         receipt.setOperatorName(identity.operatorName()); receipt.setIdempotencyKey(key); receipt.setRequestHash(requestHash);
         receipt.setSignedAt(now); receipt.setCreatedAt(now);
@@ -653,13 +675,12 @@ public class ReturnReceiptService {
         if ("PALLET".equals(unitType)) {
             inventoryCartons = inventory.createReceiptCartons(order, receipt, new ArrayList<>(inventoryLines.values()), boxCountBySku);
         } else if ("PARCEL".equals(unitType)) {
-            inventoryCartons = new ArrayList<>();
-            for (var line : inventoryLines.values())
-                inventoryCartons.add(inventory.createReceiptCarton(order, receipt, null, List.of(line)));
+            // One receipt represents one physical parcel, including all its SKUs.
+            inventoryCartons = List.of(inventory.createReceiptCarton(order, receipt, null, new ArrayList<>(inventoryLines.values())));
         } else {
             inventoryCartons = List.of(inventory.createReceiptCarton(order, receipt, unitCode, new ArrayList<>(inventoryLines.values())));
         }
-        receipt.setCartonMark("PARCEL".equals(unitType) ? null : inventoryCartons.get(0).getCartonMark());
+        receipt.setCartonMark(inventoryCartons.get(0).getCartonMark());
         receipts.updateById(receipt);
         syncTailCargo(order, receipt, allocations, now);
         List<ReturnOrderItem> finalItems = orderItems.listOrder(order.getId());
@@ -751,7 +772,7 @@ public class ReturnReceiptService {
         tail.setPackageCount(actualBoxes); tail.setReceivedPackageCount(actualBoxes);
         tail.setProductQuantity(actualUnits); tail.setPalletCount(palletCodes.size());
         for (ReturnReceipt signed : signedReceipts) {
-            if (signed.getLength() == null || signed.getWidth() == null || signed.getHeight() == null || "PARCEL".equals(signed.getUnitType())) continue;
+            if (signed.getLength() == null || signed.getWidth() == null || signed.getHeight() == null) continue;
             String code = text(signed.getUnitCode()) == null ? signed.getReceiptNo() : signed.getUnitCode();
             measuredUnits.putIfAbsent(signed.getUnitType() + ":" + code, signed);
         }
@@ -802,10 +823,10 @@ public class ReturnReceiptService {
         return confirmed(order, receipt, COMPLETED.equals(order.getStatus()));
     }
     private PdaReturnReceiptResponses.Confirmed confirmed(ReturnOrder order, ReturnReceipt receipt, boolean completed) {
-        String cartonMark = "PARCEL".equals(receipt.getUnitType()) ? null : text(receipt.getCartonMark());
+        String cartonMark = text(receipt.getCartonMark());
         String printableHtml = null;
         List<ReturnOrderResponses.CartonLabel> labels = new java.util.ArrayList<>();
-        if (receipt.getId() != null && !"PARCEL".equals(receipt.getUnitType())) {
+        if (receipt.getId() != null) {
             for (ReturnInventoryCarton carton : cartons.listReceipt(receipt.getId())) {
                 var label = inventory.label(order.getCustomerId(), carton.getCartonMark());
                 if (label != null) labels.add(new ReturnOrderResponses.CartonLabel(carton.getCartonMark(), label.printableHtml()));
@@ -833,6 +854,10 @@ public class ReturnReceiptService {
         item.getProductNameZh(), value(item.getExpectedQuantity()), value(item.getReceivedQuantity())); }
     private PdaReturnReceiptResponses.Item pdaItem(ReturnOrderItem item) { return new PdaReturnReceiptResponses.Item(item.getSkuCode(),
         item.getProductNameZh(), value(item.getExpectedQuantity()), value(item.getReceivedQuantity())); }
+    private long remainingRelabelQuantity(long cartonId, com.baiyue.lastleg.returnreceipt.entity.ReturnInventoryCartonItem line) {
+        return Math.max(0, value(line.getQuantity()) - value(line.getPackingReservedQuantity()) - value(line.getRelabelledQuantity())
+            - cartons.completedSkuQuantity(cartonId, line.getSkuCode()));
+    }
     private static long value(Long value) { return value == null ? 0 : value; }
     private static String text(String value) { return StringUtils.hasText(value) ? value.trim() : null; }
     private static String norm(String value) { return text(value) == null ? null : text(value).toUpperCase(java.util.Locale.ROOT); }
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/service/ReturnRelabelProgress.java b/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/service/ReturnRelabelProgress.java
new file mode 100644
index 000000000..28fb48e07
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/returnreceipt/service/ReturnRelabelProgress.java
@@ -0,0 +1,11 @@
+package com.baiyue.lastleg.returnreceipt.service;
+
+/** Physical piece progress is independent of warehouse identification-label confirmation. */
+public final class ReturnRelabelProgress {
+    private ReturnRelabelProgress() { }
+    public static String status(long total, long completed, long reserved) {
+        if (total > 0 && completed >= total) return "COMPLETED";
+        if (completed > 0) return "PARTIALLY_COMPLETED";
+        return reserved > 0 ? "PROCESSING" : "UNLABELLED";
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/security/OverseasPermissions.java b/lastleg-service/src/main/java/com/baiyue/lastleg/security/OverseasPermissions.java
index 9da6b4fdf..b8ea1c5f4 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/security/OverseasPermissions.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/security/OverseasPermissions.java
@@ -58,6 +58,7 @@ public final class OverseasPermissions {
     public static final String MERCHANT_TRANSFER_CONFIRM = "merchant:overseas-warehouse:transfer:confirm";
     public static final String MERCHANT_DISCARD_LIST = "merchant:overseas-warehouse:discard:list";
     public static final String MERCHANT_DISCARD_CREATE = "merchant:overseas-warehouse:discard:create";
+    public static final String MERCHANT_DISCARD_CONFIRM = "merchant:overseas-warehouse:discard:confirm";
     public static final String MERCHANT_DISCARD_CANCEL = "merchant:overseas-warehouse:discard:cancel";
     public static final String MERCHANT_RETURN_ORDER_LIST = "merchant:overseas-warehouse:return-order:list";
     public static final String MERCHANT_RETURN_ORDER_CREATE = "merchant:overseas-warehouse:return-order:create";
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/client/AnalyticsClientException.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/client/AnalyticsClientException.java
new file mode 100644
index 000000000..7023cf402
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/client/AnalyticsClientException.java
@@ -0,0 +1,14 @@
+package com.baiyue.lastleg.selfoperated.analytics.client;
+
+/** Fixed diagnostic only: never retain provider bodies, token or arbitrary messages. */
+public final class AnalyticsClientException extends RuntimeException {
+    private final String code;
+    private final boolean retryable;
+    public AnalyticsClientException(String code, boolean retryable) {
+        super(code);
+        this.code = code;
+        this.retryable = retryable;
+    }
+    public String code() { return code; }
+    public boolean retryable() { return retryable; }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/client/LingxingAnalyticsClient.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/client/LingxingAnalyticsClient.java
new file mode 100644
index 000000000..f36a4dfcb
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/client/LingxingAnalyticsClient.java
@@ -0,0 +1,37 @@
+package com.baiyue.lastleg.selfoperated.analytics.client;
+
+import com.baiyue.lastleg.selfoperated.analytics.model.SelfopPayloads.Order;
+import com.baiyue.lastleg.selfoperated.analytics.model.SelfopPayloads.Stock;
+import java.time.LocalDateTime;
+import java.util.List;
+import com.baiyue.lastleg.selfoperated.analytics.model.*;
+
+/** One upstream page or detail per call. Durable orchestration belongs to sync. */
+public interface LingxingAnalyticsClient {
+    Page<Warehouse> warehouses(SelfopRequestContext context, int current, int size);
+    Page<Summary> discover(SelfopRequestContext context, LocalDateTime startTime, LocalDateTime endTime, int current, int size);
+    Page<Summary> locate(SelfopRequestContext context, String deliveryNo, int current, int size);
+    Order detail(SelfopRequestContext context, String warehouseCode, String customerCode, String deliveryNo);
+    Page<Stock> inventory(SelfopRequestContext context, String warehouseCode, int current, int size);
+    Page<SelfopPayloads.Owner> customers(SelfopRequestContext context, int current, int size);
+    Page<SelfopPayloads.Product> products(SelfopRequestContext context, int current, int size);
+
+    record Page<T>(List<T> records, Integer current, Integer size, Long total, Integer pages) {
+        public Page { records = List.copyOf(records); }
+    }
+    record Warehouse(String warehouseCode, String warehouseName, Integer warehouseType,
+                     Integer status, String timeZone) { }
+    record Summary(String sourceAccount, String customerCode, String warehouseCode,
+                   String deliveryNo, String sourceNo, Integer sourceStatus,
+                   String sourceCreatedTime, String sourceOutboundTime, List<SelfopPayloads.Item> items) {
+        public Order order() {
+            return new Order(sourceAccount, customerCode, warehouseCode, deliveryNo, sourceNo, sourceStatus,
+                    sourceCreatedTime, sourceOutboundTime, items);
+        }
+    }
+
+    static boolean needsDetail(Order order) {
+        return order.items() == null || order.items().isEmpty() || order.items().stream().anyMatch(item ->
+                item == null || item.skuCode() == null || item.skuCode().isBlank() || item.actualQuantity() == null);
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/client/RestLingxingAnalyticsClient.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/client/RestLingxingAnalyticsClient.java
new file mode 100644
index 000000000..d9ef8cd13
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/client/RestLingxingAnalyticsClient.java
@@ -0,0 +1,289 @@
+package com.baiyue.lastleg.selfoperated.analytics.client;
+import com.baiyue.lastleg.selfoperated.analytics.model.SelfopRequestContext;
+
+import com.baiyue.lastleg.selfoperated.analytics.model.SelfopAnalyticsProperties;
+import com.baiyue.lastleg.selfoperated.analytics.model.SelfopPayloads;
+import com.baiyue.lastleg.selfoperated.analytics.model.SelfopSupport;
+import com.baiyue.lastleg.selfoperated.analytics.request.*;
+import com.baiyue.lastleg.selfoperated.analytics.request.SelfopEgressDtos.Operation;
+import org.springframework.beans.factory.annotation.Autowired;
+import com.fasterxml.jackson.databind.JsonNode;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.fasterxml.jackson.databind.DeserializationFeature;
+import com.fasterxml.jackson.core.JsonProcessingException;
+import org.springframework.http.MediaType;
+import org.springframework.http.client.JdkClientHttpRequestFactory;
+import org.springframework.stereotype.Component;
+import org.springframework.web.client.ResourceAccessException;
+import org.springframework.web.client.RestClient;
+import org.springframework.web.client.RestClientException;
+import org.springframework.web.client.RestClientResponseException;
+import java.math.BigDecimal;
+import java.net.http.HttpClient;
+import java.time.Duration;
+import java.time.LocalDateTime;
+import java.time.format.DateTimeFormatter;
+import java.util.ArrayList;
+import java.util.Map;
+import java.util.List;
+import java.util.Set;
+import java.util.function.Function;
+
+@Component
+public class RestLingxingAnalyticsClient implements LingxingAnalyticsClient {
+    private static final String PREFIX = "/internal/integrations/lingxing/wms";
+    private static final Set<String> PROVIDER_ERROR_CODES = Set.of(
+            "LINGXING_WMS_FLOW_PERMISSION_DENIED",
+            "LINGXING_WMS_AUTHORIZATION_REJECTED", "LINGXING_WMS_SIGNATURE_REJECTED",
+            "LINGXING_WMS_SOURCE_REJECTED", "LINGXING_WMS_INVALID_RESPONSE", "LINGXING_WMS_RATE_LIMITED",
+            "LINGXING_WMS_HTTP_RATE_LIMITED", "LINGXING_WMS_SOURCE_RATE_LIMITED",
+            "LINGXING_WMS_ACCOUNT_PAUSED", "LINGXING_WMS_BUDGET_COMPLETION_UNCONFIRMED");
+    private final RestClient client;
+    private final SelfopAnalyticsProperties properties;
+    private final SelfopEgressService egress;
+    private final ObjectMapper responseMapper = new ObjectMapper()
+            .enable(DeserializationFeature.USE_BIG_DECIMAL_FOR_FLOATS);
+
+    @Autowired public RestLingxingAnalyticsClient(RestClient.Builder builder, SelfopAnalyticsProperties properties, SelfopEgressService egress) {
+        this.egress = egress;
+        this.properties = properties;
+        var factory = new JdkClientHttpRequestFactory(HttpClient.newBuilder()
+                .connectTimeout(Duration.ofSeconds(5)).followRedirects(HttpClient.Redirect.NEVER).build());
+        factory.setReadTimeout(Duration.ofSeconds(30));
+        this.client = builder.requestFactory(factory).baseUrl(properties.getIntegrationBaseUrl()).build();
+    }
+
+    // Allows an entirely in-memory transport in contract tests.
+    RestLingxingAnalyticsClient(RestClient client, SelfopAnalyticsProperties properties, SelfopEgressService egress) {
+        this.egress = egress;
+        this.client = client;
+        this.properties = properties;
+    }
+
+    @Override public Page<Warehouse> warehouses(SelfopRequestContext context, int current, int size) {
+        gate(context); String account = context.sourceAccount(); paging(current, size, 1000);
+        return page(post(context, "/warehouses/query", Map.of("current", current, "size", size)), current, size,
+                n -> new Warehouse(required(n, "whCode", 64), optional(n, "whNameCn"),
+                        integer(n, "warehouseType"), integer(n, "status"), optional(n, "timeZone")));
+    }
+
+    @Override public Page<Summary> discover(SelfopRequestContext context, LocalDateTime start, LocalDateTime end, int current, int size) {
+        gate(context); String account = context.sourceAccount(); paging(current, size, 100);
+        if (start == null || end == null || !start.isBefore(end) || end.isAfter(start.plusMonths(1)))
+            throw failure("INVALID_DISCOVERY_WINDOW");
+        return page(post(context, "/outbound-orders/query", Map.of("startTime", DateTimeFormatter.ISO_LOCAL_DATE_TIME.format(start),
+                "endTime", DateTimeFormatter.ISO_LOCAL_DATE_TIME.format(end),
+                "current", current, "size", size)), current, size, n -> summary(account, n));
+    }
+
+    @Override public Page<Summary> locate(SelfopRequestContext context, String deliveryNo, int current, int size) {
+        gate(context); String account = context.sourceAccount(); paging(current, size, 1000); argument(deliveryNo, 128);
+        return page(post(context, "/outbound-orders/locate", Map.of("deliveryNo", deliveryNo,
+                "current", current, "size", size)), current, size, n -> summary(account, n));
+    }
+
+    @Override public SelfopPayloads.Order detail(SelfopRequestContext context, String warehouse, String customer, String deliveryNo) {
+        gate(context); String account = context.sourceAccount(); argument(warehouse, 64); argument(customer, 64); argument(deliveryNo, 128);
+        JsonNode n = post(context, "/outbound-orders/detail", Map.of("warehouseCode", warehouse,
+                "customerCode", customer, "deliveryNo", deliveryNo));
+        if (!warehouse.equals(required(n, "whCode", 64)) || !customer.equals(required(n, "customerCode", 64))
+                || !deliveryNo.equals(required(n, "deliveryNo", 128))) throw failure("DETAIL_IDENTITY_MISMATCH");
+        if (!n.path("skuVOList").isArray()) throw failure("DETAIL_ITEMS_MISSING");
+        var items = new ArrayList<SelfopPayloads.Item>();
+        for (JsonNode item : n.path("skuVOList")) {
+            items.add(new SelfopPayloads.Item(required(item, "productSku", 128), optional(item, "productName"),
+                    quantity(item, "actualDeliveryQty"), properties.getQuantityUnit()));
+        }
+        return new SelfopPayloads.Order(account, customer, warehouse, deliveryNo, optional(n, "sourceNo"),
+                integer(n, "status"), optional(n, "orderCreateTime"), optional(n, "outboundTime"), List.copyOf(items));
+    }
+
+    @Override public Page<SelfopPayloads.Stock> inventory(SelfopRequestContext context, String warehouse, int current, int size) {
+        gate(context); String account = context.sourceAccount(); argument(warehouse, 64); paging(current, size, 1000);
+        return page(post(context, "/product-inventory/query", Map.of("warehouseCode", warehouse,
+                "current", current, "size", size)), current, size, n -> {
+            if (!warehouse.equals(required(n, "whCode", 64))) throw failure("INVENTORY_WAREHOUSE_MISMATCH");
+            return new SelfopPayloads.Stock(account, required(n, "customerCode", 64), warehouse,
+                    required(n, "productSku", 128), integer(n, "productQuality"), optional(n, "productName"),
+                    quantity(n, "stkQty"), quantity(n, "useStkQty"), quantity(n, "freezeQty"),
+                    quantity(n, "transitQty"), optional(n, "uniqueKey4tenant"));
+        });
+    }
+
+    @Override public Page<SelfopPayloads.Owner> customers(SelfopRequestContext context,int current,int size) {
+        gate(context);paging(current,size,1000);
+        return page(post(context,"/customers/query",Map.of("current",current,"size",size)),current,size,
+            n -> new SelfopPayloads.Owner(required(n,"customerCode",64),optional(n,"customerName"),optional(n,"status")));
+    }
+    @Override public Page<SelfopPayloads.Product> products(SelfopRequestContext context,int current,int size) {
+        gate(context);paging(current,size,100);
+        return page(post(context,"/products/query",Map.of("current",current,"size",size)),current,size,
+            n -> new SelfopPayloads.Product(required(n,"customerCode",64),required(n,"sku",128),optional(n,"productName"),
+                quantity(n,"length"),quantity(n,"width"),quantity(n,"height"),optional(n,"sizeUnit"),
+                quantity(n,"wmsLength"),quantity(n,"wmsWidth"),quantity(n,"wmsHeight"),optional(n,"wmsSizeUnit")));
+    }
+
+    public JsonNode inventoryFlow(SelfopRequestContext context,String warehouse,String customer,String sku,
+        LocalDateTime start,LocalDateTime end) {
+        gate(context);argument(warehouse,64);argument(customer,64);argument(sku,128);
+        return post(context,"/inventory-flow/query",Map.of("warehouseCode",warehouse,"customerCode",customer,"sku",sku,
+            "startTime",DateTimeFormatter.ISO_LOCAL_DATE_TIME.format(start),"endTime",DateTimeFormatter.ISO_LOCAL_DATE_TIME.format(end)));
+    }
+
+    public JsonNode inventoryFlowPage(SelfopRequestContext context,String warehouse,LocalDateTime start,LocalDateTime end,int current,int size) {
+        gate(context);argument(warehouse,64);paging(current,size,1000);
+        return post(context,"/inventory-flow-page/query",Map.of("warehouseCode",warehouse,"startTime",DateTimeFormatter.ISO_LOCAL_DATE_TIME.format(start),
+            "endTime",DateTimeFormatter.ISO_LOCAL_DATE_TIME.format(end),"current",current,"size",size));
+    }
+
+    private Summary summary(String account, JsonNode n) {
+        List<SelfopPayloads.Item> items = null;
+        JsonNode products = n.get("productList");
+        if (products != null && !products.isNull()) {
+            if (!products.isArray()) throw failure("LIST_ITEMS_INVALID");
+            items = new ArrayList<>();
+            for (JsonNode item : products) {
+                if (!item.isObject()) throw failure("LIST_ITEM_INVALID");
+                items.add(new SelfopPayloads.Item(optional(item, "productSku"), optional(item, "productName"),
+                        quantity(item, "qty"), properties.getQuantityUnit()));
+            }
+        }
+        return new Summary(account, required(n, "customerCode", 64), required(n, "whCode", 64),
+                required(n, "deliveryNo", 128), optional(n, "sourceNo"), integer(n, "status"),
+                optional(n, "createTime"), optional(n, "outboundTime"), items);
+    }
+
+    private void gate(SelfopRequestContext context) {
+        if (context == null) throw failure("EGRESS_CONTEXT_MISSING");
+        String account = context.sourceAccount();
+        if ("OFF".equals(properties.getCollectionMode())) throw failure("EXECUTION_DISABLED");
+        if (!properties.getCollectionMode().equals(context.executionPurpose())) throw failure("EGRESS_PURPOSE_MISMATCH");
+        argument(account, 64);
+        if (!account.equals(properties.getSourceAccount())) throw failure("SOURCE_ACCOUNT_MISMATCH");
+        if (properties.getInternalServiceToken() == null || properties.getInternalServiceToken().isBlank())
+            throw failure("INTERNAL_TOKEN_UNCONFIGURED");
+    }
+
+    private JsonNode post(SelfopRequestContext context, String suffix, Object request) {
+        Map<?,?> fields = (Map<?,?>)request;
+        Operation op = switch(suffix) {
+            case "/warehouses/query" -> Operation.WAREHOUSES;
+            case "/outbound-orders/query" -> Operation.OUTBOUND_QUERY;
+            case "/outbound-orders/locate" -> Operation.OUTBOUND_LOCATE;
+            case "/outbound-orders/detail" -> Operation.OUTBOUND_DETAIL;
+            case "/product-inventory/query" -> Operation.PRODUCT_INVENTORY;
+            case "/customers/query" -> Operation.CUSTOMERS;
+            case "/products/query" -> Operation.PRODUCTS;
+            case "/inventory-flow/query", "/inventory-flow-page/query" -> Operation.INVENTORY_FLOW;
+            default -> throw failure("EGRESS_OPERATION_INVALID");
+        };
+        int size = fields.containsKey("size") ? ((Number)fields.get("size")).intValue() : op==Operation.INVENTORY_FLOW?1000:0;
+        String warehouse=(String)fields.get("warehouseCode");
+        String key=op==Operation.OUTBOUND_DETAIL ? SelfopSupport.json(List.of(fields.get("customerCode"),fields.get("deliveryNo"))) : null;
+        var permission = egress.reserve(context,op,size,warehouse,key,SelfopSupport.hash(fields));
+        JsonNode body;
+        try {
+            String response = client.post().uri(PREFIX + suffix).contentType(MediaType.APPLICATION_JSON)
+                    .header("X-Internal-Service-Token", properties.getInternalServiceToken())
+                    .header("X-Lingxing-Egress-Context", SelfopSupport.json(permission))
+                    .body(request).retrieve().body(String.class);
+            body = response == null ? null : responseMapper.readTree(response);
+        } catch (RestClientResponseException e) {
+            int status = e.getStatusCode().value();
+            if(status>=500||status==429)egress.pauseUncertain(permission,op,"INTEGRATION_HTTP_FAILURE");
+            throw new AnalyticsClientException("INTEGRATION_HTTP_FAILURE", status == 429 || status >= 500);
+        } catch (ResourceAccessException e) {
+            egress.pauseUncertain(permission,op,"INTEGRATION_TRANSPORT_FAILURE");
+            throw new AnalyticsClientException("INTEGRATION_TRANSPORT_FAILURE", true);
+        } catch (RestClientException e) {
+            egress.pauseUncertain(permission,op,"INTEGRATION_RESPONSE_INVALID");
+            throw failure("INTEGRATION_RESPONSE_INVALID");
+        } catch (JsonProcessingException e) {
+            egress.pauseUncertain(permission,op,"INTEGRATION_RESPONSE_INVALID");
+            throw failure("INTEGRATION_RESPONSE_INVALID");
+        }
+        if (body == null || !body.isObject()) {
+            egress.pauseUncertain(permission,op,"INTEGRATION_RESPONSE_INVALID");throw failure("INTEGRATION_RESPONSE_INVALID");
+        }
+        if (!"200".equals(body.path("code").asText())) {
+            JsonNode metadata=body.path("data").path("egress");
+            if(metadata.path("accountPaused").isBoolean()&&metadata.path("accountPaused").booleanValue()){
+                if(!metadata.path("attemptId").isTextual()||!permission.attemptId().equals(metadata.path("attemptId").textValue()))
+                    throw failure("INTEGRATION_PAUSE_BINDING_INVALID");
+                JsonNode reportedCode=body.path("data").path("errorCode");
+                egress.pauseUncertain(permission,op,reportedCode.isTextual()?reportedCode.textValue():"INTEGRATION_RESPONSE_INVALID");
+            }
+            if("LINGXING_WMS_BUDGET_AUTHORIZATION_DENIED".equals(body.path("data").path("errorCode").asText())) {
+                JsonNode denial=body.path("data").path("denial");
+                if(!denial.isObject()||!denial.path("errorCode").isTextual()||!denial.path("errorCode").textValue().matches("[A-Z][A-Z0-9_]{0,63}")||!denial.path("sampleDone").isBoolean()||!denial.has("waitUntil"))throw failure("INTEGRATION_RESPONSE_INVALID");
+                LocalDateTime wait=null;
+                if(!denial.path("waitUntil").isNull()) {
+                    if(!denial.path("waitUntil").isTextual())throw failure("INTEGRATION_RESPONSE_INVALID");
+                    try {wait=LocalDateTime.ofInstant(java.time.Instant.parse(denial.path("waitUntil").textValue()),java.time.ZoneOffset.UTC);}catch(Exception invalid){throw failure("INTEGRATION_RESPONSE_INVALID");}
+                }
+                throw new EgressRejectedException(denial.path("errorCode").textValue(),denial.path("sampleDone").booleanValue(),wait);
+            }
+            // Retryability is a normalized Integration field, never infer it from provider text.
+            boolean retryable = body.path("data").path("retryable").isBoolean()
+                    && body.path("data").path("retryable").booleanValue();
+            JsonNode sourceError = body.path("data").path("errorCode");
+            String code = sourceError.isTextual() && PROVIDER_ERROR_CODES.contains(sourceError.textValue())
+                    ? sourceError.textValue() : "INTEGRATION_PROVIDER_FAILURE";
+            if ("LINGXING_WMS_AUTHORIZATION_REJECTED".equals(code) || "LINGXING_WMS_SIGNATURE_REJECTED".equals(code))
+                retryable = false;
+            throw new AnalyticsClientException(code, retryable);
+        }
+        if (!body.path("data").isObject()) throw failure("INTEGRATION_DATA_MISSING");
+        return body.path("data");
+    }
+
+    private <T> Page<T> page(JsonNode n, int current, int size, Function<JsonNode,T> mapper) {
+        int actualCurrent = integer(n, "current"), actualSize = integer(n, "size"), pages = integer(n, "pages");
+        JsonNode totalNode = n.path("total");
+        long total;
+        try {
+            if (totalNode.isIntegralNumber() && totalNode.canConvertToLong()) total = totalNode.longValue();
+            else if (totalNode.isTextual() && totalNode.textValue().matches("[0-9]+")) total = Long.parseLong(totalNode.textValue());
+            else throw failure("PAGE_METADATA_INVALID");
+        } catch (NumberFormatException e) { throw failure("PAGE_METADATA_INVALID"); }
+        if (!n.path("records").isArray() || actualCurrent != current || actualSize != size || total < 0 || pages < 0
+                || pages != (total == 0 ? 0 : ((total - 1) / size) + 1) || (pages > 0 && current > pages)
+                || (total == 0 && current != 1)) throw failure("PAGE_METADATA_INVALID");
+        long expected = total == 0 ? 0 : Math.min(size, total - ((long) current - 1) * size);
+        if (n.path("records").size() != expected) throw failure("PAGE_ROW_COUNT_INVALID");
+        var records = new ArrayList<T>();
+        for (JsonNode row : n.path("records")) {
+            if (!row.isObject()) throw failure("PAGE_ROW_INVALID");
+            records.add(mapper.apply(row));
+        }
+        return new Page<>(records, current, size, total, pages);
+    }
+
+    private static void paging(int current, int size, int max) {
+        if (current < 1 || size < 1 || size > max) throw failure("INVALID_PAGE_REQUEST");
+    }
+    private static void argument(String value, int max) {
+        if (value == null || value.isBlank() || value.length() > max) throw failure("INVALID_BUSINESS_IDENTITY");
+    }
+    private static String required(JsonNode n, String field, int max) {
+        String value = optional(n, field); argument(value, max); return value;
+    }
+    private static String optional(JsonNode n, String field) {
+        JsonNode value = n.get(field);
+        if (value == null || value.isNull()) return null;
+        if (!value.isTextual()) throw failure("SOURCE_FIELD_TYPE_INVALID");
+        return value.textValue();
+    }
+    private static int integer(JsonNode n, String field) {
+        JsonNode value = n.path(field);
+        if (!value.isIntegralNumber() || !value.canConvertToInt()) throw failure("SOURCE_INTEGER_INVALID");
+        return value.intValue();
+    }
+    private static BigDecimal quantity(JsonNode n, String field) {
+        JsonNode value = n.get(field);
+        if (value == null || value.isNull() || value.isTextual() && value.textValue().isEmpty()) return null;
+        if (!value.isNumber()) throw failure("SOURCE_QUANTITY_INVALID");
+        return value.decimalValue();
+    }
+    private static AnalyticsClientException failure(String code) { return new AnalyticsClientException(code, false); }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/controller/PlatformAnalyticsController.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/controller/PlatformAnalyticsController.java
new file mode 100644
index 000000000..bb913cc6c
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/controller/PlatformAnalyticsController.java
@@ -0,0 +1,108 @@
+package com.baiyue.lastleg.selfoperated.analytics.controller;
+
+import com.baiyue.common.core.api.ApiResponse;
+import com.baiyue.common.security.AuthenticatedUser;
+import com.baiyue.lastleg.selfoperated.analytics.query.*;
+import io.swagger.v3.oas.annotations.Operation;
+import io.swagger.v3.oas.annotations.tags.Tag;
+import org.springframework.http.HttpStatus;
+import org.springframework.security.access.prepost.PreAuthorize;
+import org.springframework.security.core.annotation.AuthenticationPrincipal;
+import org.springframework.web.bind.annotation.*;
+import org.springframework.web.server.ResponseStatusException;
+
+@RestController
+@RequestMapping("/api/platform/v1/last-leg/self-operated-analytics")
+@PreAuthorize("hasAuthority('platform:self-operated-analytics:list')")
+@Tag(name="平台自营出库销量与库存只读分析")
+public class PlatformAnalyticsController {
+    public static final String READ_PERMISSION="platform:self-operated-analytics:list";
+    private final AnalyticsQueryService service;
+    private final CollectionQueryService collection;
+    private final DashboardQueryService dashboard;
+    public PlatformAnalyticsController(AnalyticsQueryService service,CollectionQueryService collection,DashboardQueryService dashboard){this.service=service;this.collection=collection;this.dashboard=dashboard;}
+    @GetMapping("/dashboard")
+    @Operation(summary="同仓固定版本的经营总览图表与精确下钻上下文")
+    public ApiResponse<DashboardResponses.Dashboard> dashboard(@AuthenticationPrincipal AuthenticatedUser user,@ModelAttribute AnalyticsQuery query,
+        @RequestParam java.util.Map<String,String> parameters){
+        requirePlatform(user);DashboardRequest.validateParameterNames(parameters.keySet());return ApiResponse.success(dashboard.dashboard(query));
+    }
+    @GetMapping("/sku-sales-summary")
+    @Operation(summary="五周期或历史自定义范围SKU累计清单")
+    public ApiResponse<AnalyticsResponses.Page<AnalyticsResponses.SalesSummary>> salesSummary(
+        @AuthenticationPrincipal AuthenticatedUser user,@ModelAttribute AnalyticsQuery query,
+        @RequestParam(defaultValue="QUANTITY_DESC") SalesSort salesSort){
+        requirePlatform(user);return ApiResponse.success(service.salesSummary(query,salesSort));
+    }
+    @GetMapping("/sku-daily-sales")
+    @Operation(summary="精确货主与SKU的完整日趋势轴")
+    public ApiResponse<AnalyticsResponses.Trend> dailySales(
+        @AuthenticationPrincipal AuthenticatedUser user,@ModelAttribute AnalyticsQuery query){
+        requirePlatform(user);return ApiResponse.success(service.dailySales(query));
+    }
+    @GetMapping("/hot-skus")
+    @Operation(summary="近7或30个完整自然日热销Top100")
+    public ApiResponse<AnalyticsResponses.Page<AnalyticsResponses.Metric>> hotSkus(
+        @AuthenticationPrincipal AuthenticatedUser user,@ModelAttribute AnalyticsQuery query){
+        requirePlatform(user);return ApiResponse.success(service.hotSkus(query));
+    }
+    @GetMapping("/slow-skus")
+    @Operation(summary="固定近30天有库存低出库量Top100")
+    public ApiResponse<AnalyticsResponses.Page<AnalyticsResponses.Metric>> slowSkus(
+        @AuthenticationPrincipal AuthenticatedUser user,@ModelAttribute AnalyticsQuery query){
+        requirePlatform(user);return ApiResponse.success(service.slowSkus(query));
+    }
+    @GetMapping("/inventory-coverage")
+    @Operation(summary="正品库存与所选窗口日均和预计可售天数，支持总览原图区间下钻")
+    public ApiResponse<AnalyticsResponses.Page<AnalyticsResponses.InventoryMetric>> inventoryCoverage(
+        @AuthenticationPrincipal AuthenticatedUser user,@ModelAttribute AnalyticsQuery query,@ModelAttribute AnalyticsInventoryOptions options){
+        requirePlatform(user);return ApiResponse.success(service.inventoryCoverage(query,options));
+    }
+    @GetMapping("/owners")
+    @Operation(summary="固定两版已采集货主编码前缀分页")
+    public ApiResponse<AnalyticsResponses.Page<AnalyticsResponses.OwnerOption>> owners(
+        @AuthenticationPrincipal AuthenticatedUser user,@ModelAttribute AnalyticsQuery query,@ModelAttribute AnalyticsInventoryOptions options){
+        requirePlatform(user);return ApiResponse.success(service.owners(query,options));
+    }
+    @GetMapping("/owner-directory")
+    @Operation(summary="读取固定查询时刻已发布的货主名称目录")
+    public ApiResponse<java.util.List<AnalyticsResponses.OwnerOption>> ownerDirectory(
+        @AuthenticationPrincipal AuthenticatedUser user,@ModelAttribute AnalyticsQuery query){
+        requirePlatform(user);return ApiResponse.success(service.ownerDirectory(query));
+    }
+    @GetMapping("/owner-overview")
+    @Operation(summary="本仓一个货主完整候选的30日经营概览")
+    public ApiResponse<AnalyticsResponses.OwnerOverview> ownerOverview(
+        @AuthenticationPrincipal AuthenticatedUser user,@ModelAttribute AnalyticsQuery query,@ModelAttribute AnalyticsInventoryOptions options){
+        requirePlatform(user);return ApiResponse.success(service.ownerOverview(query,options));
+    }
+    @GetMapping("/sync-overview")
+    @Operation(summary="各仓任务族独立配置、覆盖和采集运行概览")
+    public ApiResponse<CollectionResponses.Overview> syncOverview(
+        @AuthenticationPrincipal AuthenticatedUser user,@ModelAttribute CollectionQuery query){
+        requirePlatform(user);return ApiResponse.success(collection.overview(query));
+    }
+    @GetMapping("/sync-tasks")
+    @Operation(summary="本仓逻辑采集任务与轻量最新尝试分页")
+    public ApiResponse<CollectionResponses.Page<CollectionResponses.Task>> syncTasks(
+        @AuthenticationPrincipal AuthenticatedUser user,@ModelAttribute CollectionQuery query){
+        requirePlatform(user);return ApiResponse.success(collection.tasks(query));
+    }
+    @GetMapping("/sync-tasks/{taskNo}")
+    @Operation(summary="稳定业务任务号的采集详情与进度")
+    public ApiResponse<CollectionResponses.TaskDetail> syncTaskDetail(
+        @AuthenticationPrincipal AuthenticatedUser user,@PathVariable String taskNo,@ModelAttribute CollectionQuery query){
+        requirePlatform(user);return ApiResponse.success(collection.taskDetail(taskNo,query));
+    }
+    @GetMapping("/sync-runs")
+    @Operation(summary="本仓或指定任务号的尝试历史与终态进度")
+    public ApiResponse<CollectionResponses.Page<CollectionResponses.Attempt>> syncRuns(
+        @AuthenticationPrincipal AuthenticatedUser user,@ModelAttribute CollectionQuery query){
+        requirePlatform(user);return ApiResponse.success(collection.runs(query));
+    }
+    private static void requirePlatform(AuthenticatedUser user){
+        if(user==null||user.tenantId()==null)throw new ResponseStatusException(HttpStatus.UNAUTHORIZED);
+        if(!"PLATFORM".equals(user.appCode())||user.tenantId()!=0L||user.impersonated()||!user.permissions().contains(READ_PERMISSION))
+            throw new ResponseStatusException(HttpStatus.FORBIDDEN,"平台自营分析只读权限不足");
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/controller/PlatformInventoryFlowProbeController.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/controller/PlatformInventoryFlowProbeController.java
new file mode 100644
index 000000000..8e061e694
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/controller/PlatformInventoryFlowProbeController.java
@@ -0,0 +1,23 @@
+package com.baiyue.lastleg.selfoperated.analytics.controller;
+import com.baiyue.common.core.api.ApiResponse;
+import com.baiyue.common.security.AuthenticatedUser;
+import com.baiyue.lastleg.selfoperated.analytics.sync.InventoryFlowProbeService;
+import org.springframework.web.bind.annotation.*;
+import org.springframework.security.access.prepost.PreAuthorize;
+import org.springframework.security.core.annotation.AuthenticationPrincipal;
+import org.springframework.web.server.ResponseStatusException;
+import org.springframework.http.HttpStatus;
+@RestController
+@RequestMapping("/api/platform/v1/last-leg/self-operated-analytics/inventory-flow-probe")
+public class PlatformInventoryFlowProbeController {
+    private final InventoryFlowProbeService service;
+    public PlatformInventoryFlowProbeController(InventoryFlowProbeService service){this.service=service;}
+    @PostMapping
+    @PreAuthorize("hasAuthority('platform:self-operated-analytics:sync')")
+    public ApiResponse<InventoryFlowProbeService.Result> probe(@AuthenticationPrincipal AuthenticatedUser user,
+        @RequestBody InventoryFlowProbeService.Request request) {
+        if(user==null||!Long.valueOf(0).equals(user.tenantId())||!"PLATFORM".equals(user.appCode())||user.impersonated()
+            ||!user.permissions().contains("platform:self-operated-analytics:sync"))throw new ResponseStatusException(HttpStatus.FORBIDDEN);
+        return ApiResponse.success(service.probe(request,user.username()));
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/controller/PlatformInventoryTurnoverController.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/controller/PlatformInventoryTurnoverController.java
new file mode 100644
index 000000000..2f9d89ebf
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/controller/PlatformInventoryTurnoverController.java
@@ -0,0 +1,30 @@
+package com.baiyue.lastleg.selfoperated.analytics.controller;
+
+import com.baiyue.common.core.api.ApiResponse;
+import com.baiyue.common.security.AuthenticatedUser;
+import com.baiyue.lastleg.selfoperated.analytics.query.*;
+import io.swagger.v3.oas.annotations.Operation;
+import org.springframework.http.HttpStatus;
+import org.springframework.security.access.prepost.PreAuthorize;
+import org.springframework.security.core.annotation.AuthenticationPrincipal;
+import org.springframework.web.bind.annotation.*;
+import org.springframework.web.server.ResponseStatusException;
+import java.util.Map;
+
+@RestController
+@RequestMapping("/api/platform/v1/last-leg/self-operated-analytics")
+@PreAuthorize("hasAuthority('platform:self-operated-analytics:list')")
+public class PlatformInventoryTurnoverController {
+    private final InventoryTurnoverQueryService service;
+    public PlatformInventoryTurnoverController(InventoryTurnoverQueryService service){this.service=service;}
+    @GetMapping("/inventory-turnover")
+    @Operation(summary="固定版本的7/15/30日SKU与货主库存周转")
+    public ApiResponse<InventoryTurnoverResponses.Response> query(@AuthenticationPrincipal AuthenticatedUser user,
+        @ModelAttribute InventoryTurnoverRequest request,@RequestParam Map<String,String> parameters) {
+        if(user==null||user.tenantId()==null)throw new ResponseStatusException(HttpStatus.UNAUTHORIZED);
+        if(!"PLATFORM".equals(user.appCode())||user.tenantId()!=0L||user.impersonated()||!user.permissions().contains(PlatformAnalyticsController.READ_PERMISSION))
+            throw new ResponseStatusException(HttpStatus.FORBIDDEN,"平台自营分析只读权限不足");
+        InventoryTurnoverRequest.validateParameters(parameters.keySet());
+        return ApiResponse.success(service.query(request));
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/diagnostic/QuantityDiagnosticConfiguration.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/diagnostic/QuantityDiagnosticConfiguration.java
new file mode 100644
index 000000000..0aef34600
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/diagnostic/QuantityDiagnosticConfiguration.java
@@ -0,0 +1,8 @@
+package com.baiyue.lastleg.selfoperated.analytics.diagnostic;
+
+import org.springframework.boot.context.properties.EnableConfigurationProperties;
+import org.springframework.context.annotation.Configuration;
+
+@Configuration(proxyBeanMethods = false)
+@EnableConfigurationProperties(QuantityDiagnosticProperties.class)
+public class QuantityDiagnosticConfiguration { }
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/diagnostic/QuantityDiagnosticContract.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/diagnostic/QuantityDiagnosticContract.java
new file mode 100644
index 000000000..0380816ca
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/diagnostic/QuantityDiagnosticContract.java
@@ -0,0 +1,16 @@
+package com.baiyue.lastleg.selfoperated.analytics.diagnostic;
+import java.math.BigDecimal;
+import java.time.Instant;
+import java.util.List;
+public final class QuantityDiagnosticContract {
+ private QuantityDiagnosticContract() {}
+ public record Arm(String diagnosticSessionId,String sourceAccount,List<String> warehouseCodes,String ownerCode,String excludedRootTaskId) {}
+ public record Status(String sourceAccount,String producerId,boolean attach,boolean drained) {}
+ public record Stop(String diagnosticSessionId,String sourceAccount,String producerId,String reason) {}
+ public record Observation(String status,String outboundTime,Instant observedAt,String attemptId,Boolean skuSetComplete) {}
+ public record Sku(String sku,BigDecimal listQty,BigDecimal forecastQty,BigDecimal actualQty) {}
+ public record Event(String diagnosticSessionId,String sourceAccount,String producerId,String rootTaskId,String collectionSessionId,String operation,String warehouseCode,String ownerCode,String orderNo,String side,Observation observation,List<Sku> skus) {}
+ public record Key(String warehouseCode,String ownerCode,String orderNo,boolean paired) {}
+ public record View(String diagnosticSessionId,String sourceAccount,String rootTaskId,String collectionSessionId,String state,String stopReason,Instant startsAt,Instant expiresAt,Instant bindBefore,List<String> warehouseCodes,String ownerCode,String excludedRootTaskId,int candidates,int pairedOrders,int retainedRows,long retainedBytes,boolean deliveryUncertain,List<Key> selected) {}
+ public record Receipt(String outcome,String comparison,View session) {}
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/diagnostic/QuantityDiagnosticController.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/diagnostic/QuantityDiagnosticController.java
new file mode 100644
index 000000000..a0737bee9
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/diagnostic/QuantityDiagnosticController.java
@@ -0,0 +1,67 @@
+package com.baiyue.lastleg.selfoperated.analytics.diagnostic;
+
+import com.baiyue.common.core.api.ApiResponse;
+import com.baiyue.common.core.api.ResultCode;
+import com.baiyue.lastleg.security.InternalServiceTokenGuard;
+import com.fasterxml.jackson.databind.DeserializationFeature;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import java.io.IOException;
+import org.springframework.dao.DataAccessException;
+import org.springframework.http.HttpStatus;
+import org.springframework.http.ResponseEntity;
+import org.springframework.transaction.TransactionException;
+import org.springframework.web.bind.annotation.*;
+import org.springframework.web.server.ResponseStatusException;
+
+@RestController
+@RequestMapping("/internal/lastleg/self-operated-analytics/quantity-diagnostics")
+public class QuantityDiagnosticController {
+    private final InternalServiceTokenGuard guard;
+    private final QuantityDiagnosticService service;
+    private final ObjectMapper json;
+    public QuantityDiagnosticController(InternalServiceTokenGuard guard, QuantityDiagnosticService service, ObjectMapper json) {
+        this.guard = guard; this.service = service;
+        this.json = json.copy().enable(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES)
+            .enable(DeserializationFeature.FAIL_ON_TRAILING_TOKENS);
+    }
+    @PostMapping(value="/arm",consumes="application/json")
+    public ApiResponse<QuantityDiagnosticContract.View> arm(@RequestHeader(value="X-Internal-Service-Token",required=false) String token,jakarta.servlet.http.HttpServletRequest request){
+        return run(()->service.arm(read(token,request,QuantityDiagnosticContract.Arm.class)));
+    }
+    @PostMapping(value="/status",consumes="application/json")
+    public ApiResponse<QuantityDiagnosticContract.View> status(@RequestHeader(value="X-Internal-Service-Token",required=false) String token,jakarta.servlet.http.HttpServletRequest request){
+        return run(()->service.status(read(token,request,QuantityDiagnosticContract.Status.class)));
+    }
+    @PostMapping(value="/observe",consumes="application/json")
+    public ApiResponse<QuantityDiagnosticContract.Receipt> observe(@RequestHeader(value="X-Internal-Service-Token",required=false) String token,jakarta.servlet.http.HttpServletRequest request){
+        return run(()->service.observe(read(token,request,QuantityDiagnosticContract.Event.class)));
+    }
+    @PostMapping(value="/stop",consumes="application/json")
+    public ApiResponse<QuantityDiagnosticContract.View> stop(@RequestHeader(value="X-Internal-Service-Token",required=false) String token,jakarta.servlet.http.HttpServletRequest request){
+        return run(()->service.stop(read(token,request,QuantityDiagnosticContract.Stop.class)));
+    }
+    private <T>T read(String token,jakarta.servlet.http.HttpServletRequest request,Class<T> type){
+        guard.verify(token);
+        int limit=QuantityDiagnosticPolicy.MAX_REQUEST_BYTES;
+        if(request.getContentLengthLong()>limit)throw QuantityDiagnosticPolicy.invalid("DIAGNOSTIC_REQUEST_TOO_LARGE");
+        try {
+            byte[] body=request.getInputStream().readNBytes(limit+1);
+            if(body.length>limit)throw QuantityDiagnosticPolicy.invalid("DIAGNOSTIC_REQUEST_TOO_LARGE");
+            return json.readValue(body,type);
+        }catch(IOException e){throw QuantityDiagnosticPolicy.invalid("DIAGNOSTIC_JSON_INVALID");}
+    }
+    private <T>ApiResponse<T> run(java.util.function.Supplier<T> action){
+        try{return ApiResponse.success(action.get());}
+        catch(DataAccessException|TransactionException e){throw new ResponseStatusException(HttpStatus.SERVICE_UNAVAILABLE,"DIAGNOSTIC_STORAGE_UNAVAILABLE");}
+    }
+    @ExceptionHandler(ResponseStatusException.class)
+    public ResponseEntity<ApiResponse<Void>> rejected(ResponseStatusException error) {
+        ResultCode code = switch (error.getStatusCode().value()) {
+            case 401 -> ResultCode.UNAUTHORIZED;
+            case 409 -> ResultCode.CONFLICT;
+            case 503 -> ResultCode.SERVICE_UNAVAILABLE;
+            default -> ResultCode.BAD_REQUEST;
+        };
+        return ResponseEntity.status(error.getStatusCode()).body(ApiResponse.failure(code, error.getReason(), null, null));
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/diagnostic/QuantityDiagnosticPolicy.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/diagnostic/QuantityDiagnosticPolicy.java
new file mode 100644
index 000000000..c8ac75384
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/diagnostic/QuantityDiagnosticPolicy.java
@@ -0,0 +1,33 @@
+package com.baiyue.lastleg.selfoperated.analytics.diagnostic;
+import static com.baiyue.lastleg.selfoperated.analytics.diagnostic.QuantityDiagnosticContract.*;
+import java.math.BigDecimal;
+import java.time.Instant;
+import java.util.*;
+import org.springframework.http.HttpStatus;
+import org.springframework.web.server.ResponseStatusException;
+final class QuantityDiagnosticPolicy {
+ static final int MAX_ORDERS=100,MAX_ROWS=2000,MAX_BYTES=2097152,MAX_REQUEST_BYTES=262144;
+ private QuantityDiagnosticPolicy() {}
+ static ResponseStatusException invalid(String code){return new ResponseStatusException(HttpStatus.BAD_REQUEST,code);}
+ static void require(boolean value,String code){if(!value)throw invalid(code);}
+ static void text(String s,int max){require(s!=null&&!s.isBlank()&&s.length()<=max&&s.codePoints().noneMatch(Character::isISOControl),"DIAGNOSTIC_FIELD_INVALID");}
+ static Event normalize(Event e,Instant now){
+  require(e!=null,"DIAGNOSTIC_EVENT_REQUIRED");text(e.diagnosticSessionId(),128);text(e.sourceAccount(),64);text(e.rootTaskId(),128);text(e.collectionSessionId(),128);text(e.warehouseCode(),64);text(e.ownerCode(),128);text(e.orderNo(),128);
+  text(e.producerId(),128);require("LIST".equals(e.side())||"DETAIL".equals(e.side()),"DIAGNOSTIC_SIDE_INVALID");require(("LIST".equals(e.side())?"OUTBOUND_QUERY":"OUTBOUND_DETAIL").equals(e.operation()),"DIAGNOSTIC_OPERATION_INVALID");require(e.observation()!=null&&e.observation().observedAt()!=null&&e.observation().skuSetComplete()!=null,"DIAGNOSTIC_OBSERVATION_REQUIRED");text(e.observation().attemptId(),128);
+  if(e.observation().status()!=null)text(e.observation().status(),32);if(e.observation().outboundTime()!=null)text(e.observation().outboundTime(),64);
+  require(!e.observation().observedAt().isAfter(now),"DIAGNOSTIC_FUTURE_OBSERVATION");require(e.skus()!=null&&(!e.skus().isEmpty()||!e.observation().skuSetComplete())&&e.skus().size()<=200,"DIAGNOSTIC_SKU_LIMIT");
+  var seen=new HashSet<String>();var skus=new ArrayList<Sku>();for(var s:e.skus()){require(s!=null,"DIAGNOSTIC_SKU_REQUIRED");text(s.sku(),128);require(seen.add(s.sku()),"DIAGNOSTIC_DUPLICATE_SKU");
+   for(var n:Arrays.asList(s.listQty(),s.forecastQty(),s.actualQty()))if(n!=null)require(n.signum()>=0&&n.scale()<=6&&n.precision()-n.scale()<=32,"DIAGNOSTIC_QUANTITY_INVALID");
+   require("LIST".equals(e.side())?s.forecastQty()==null&&s.actualQty()==null:s.listQty()==null,"DIAGNOSTIC_SIDE_FIELDS");skus.add(new Sku(s.sku(),decimal(s.listQty()),decimal(s.forecastQty()),decimal(s.actualQty())));
+  }skus.sort(Comparator.comparing(Sku::sku));return new Event(e.diagnosticSessionId(),e.sourceAccount(),e.producerId(),e.rootTaskId(),e.collectionSessionId(),e.operation(),e.warehouseCode(),e.ownerCode(),e.orderNo(),e.side(),e.observation(),List.copyOf(skus));
+ }
+ static BigDecimal decimal(BigDecimal n){return n==null?null:n.stripTrailingZeros();}
+ static boolean different(BigDecimal a,BigDecimal b){return a!=null&&b!=null&&a.compareTo(b)!=0;}
+ static String compare(Event list,Event detail){
+  var l=new TreeMap<String,Sku>();var d=new TreeMap<String,Sku>();list.skus().forEach(s->l.put(s.sku(),s));detail.skus().forEach(s->d.put(s.sku(),s));
+  boolean incomplete=!Boolean.TRUE.equals(list.observation().skuSetComplete())||!Boolean.TRUE.equals(detail.observation().skuSetComplete())||!l.keySet().equals(d.keySet());
+  var keys=new HashSet<String>(l.keySet());keys.addAll(d.keySet());boolean difference=false;
+  for(String key:keys){var a=l.get(key);var b=d.get(key);BigDecimal x=a==null?null:a.listQty(),y=b==null?null:b.forecastQty(),z=b==null?null:b.actualQty();difference|=different(x,y)||different(x,z)||different(y,z);incomplete|=x==null||y==null||z==null;}
+  return incomplete?"INCONCLUSIVE":difference?"QUANTITY_DIFFERENCE":"ALL_EQUAL";
+ }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/diagnostic/QuantityDiagnosticProperties.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/diagnostic/QuantityDiagnosticProperties.java
new file mode 100644
index 000000000..630aa6d39
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/diagnostic/QuantityDiagnosticProperties.java
@@ -0,0 +1,6 @@
+package com.baiyue.lastleg.selfoperated.analytics.diagnostic;
+import java.util.List;
+import org.springframework.boot.context.properties.ConfigurationProperties;
+import org.springframework.boot.context.properties.bind.DefaultValue;
+@ConfigurationProperties("baiyue.selfop.quantity-diagnostics")
+public record QuantityDiagnosticProperties(@DefaultValue("false") boolean enabled, String sourceAccount, List<String> warehouseCodes) {}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/diagnostic/QuantityDiagnosticService.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/diagnostic/QuantityDiagnosticService.java
new file mode 100644
index 000000000..ceeb17c26
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/diagnostic/QuantityDiagnosticService.java
@@ -0,0 +1,251 @@
+package com.baiyue.lastleg.selfoperated.analytics.diagnostic;
+
+import static com.baiyue.lastleg.selfoperated.analytics.diagnostic.QuantityDiagnosticContract.*;
+import static com.baiyue.lastleg.selfoperated.analytics.diagnostic.QuantityDiagnosticPolicy.*;
+import com.baiyue.lastleg.selfoperated.analytics.model.SelfopSyncTask;
+import com.baiyue.lastleg.selfoperated.analytics.model.SelfopCollectionPolicy;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.fasterxml.jackson.databind.module.SimpleModule;
+import com.fasterxml.jackson.databind.ser.std.StdSerializer;
+import com.fasterxml.jackson.databind.deser.std.StdDeserializer;
+import com.fasterxml.jackson.core.JsonGenerator;
+import com.fasterxml.jackson.core.JsonParser;
+import com.fasterxml.jackson.core.JsonToken;
+import java.io.IOException;
+import java.math.BigDecimal;
+import com.zaxxer.hikari.HikariDataSource;
+import jakarta.annotation.PreDestroy;
+import javax.sql.DataSource;
+import java.nio.charset.StandardCharsets;
+import java.security.MessageDigest;
+import java.time.*;
+import java.util.*;
+import java.util.concurrent.Semaphore;
+import java.util.function.Supplier;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.http.HttpStatus;
+import org.springframework.jdbc.core.JdbcTemplate;
+import org.springframework.jdbc.core.BeanPropertyRowMapper;
+import org.springframework.jdbc.datasource.DataSourceTransactionManager;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.PlatformTransactionManager;
+import org.springframework.transaction.support.TransactionTemplate;
+import org.springframework.web.server.ResponseStatusException;
+
+/** Serializes diagnostic state only; never locks or updates collection/business rows. */
+@Service
+public class QuantityDiagnosticService {
+    private final JdbcTemplate jdbc;
+    private final TransactionTemplate tx;
+    private final ObjectMapper json;
+    private final QuantityDiagnosticProperties config;
+    private final Clock clock;
+    private final Semaphore admission = new Semaphore(1);
+    private HikariDataSource pool;
+
+    @Autowired
+    public QuantityDiagnosticService(DataSource source, ObjectMapper json, QuantityDiagnosticProperties config) {
+        this.json=storageMapper(json);
+        this.config=config; this.clock=Clock.systemUTC();
+        // Separate, bounded connection acquisition. Diagnostics cannot exhaust the collection pool.
+        if(config.enabled()) {
+            try {
+                HikariDataSource base=source.unwrap(HikariDataSource.class);
+                pool=new HikariDataSource(); pool.setJdbcUrl(base.getJdbcUrl()); pool.setUsername(base.getUsername());
+                pool.setPassword(base.getPassword()); pool.setDataSourceProperties(base.getDataSourceProperties());
+                pool.setMaximumPoolSize(1); pool.setMinimumIdle(0); pool.setConnectionTimeout(250);
+                pool.setValidationTimeout(250); pool.setInitializationFailTimeout(-1); pool.setPoolName("quantity-diagnostic");
+            } catch(Exception unavailable) { if(pool!=null)pool.close(); pool=null; }
+        }
+        jdbc=pool==null?null:new JdbcTemplate(pool);
+        tx=pool==null?null:new TransactionTemplate(new DataSourceTransactionManager(pool));
+        if(tx!=null) { tx.setTimeout(3); jdbc.setQueryTimeout(2); }
+    }
+    QuantityDiagnosticService(JdbcTemplate jdbc,PlatformTransactionManager manager,ObjectMapper json,
+                              QuantityDiagnosticProperties config,Clock clock) {
+        this.jdbc=jdbc;this.json=storageMapper(json);
+        this.config=config;this.clock=clock;tx=new TransactionTemplate(manager);tx.setTimeout(3);
+    }
+    @PreDestroy public void close(){if(pool!=null)pool.close();}
+    private <T>T guarded(Supplier<T> action){
+        require(config.enabled(),"DIAGNOSTIC_DISABLED");
+        if(tx==null)throw new ResponseStatusException(HttpStatus.SERVICE_UNAVAILABLE,"DIAGNOSTIC_DATASOURCE_UNAVAILABLE");
+        if(!admission.tryAcquire())throw new ResponseStatusException(HttpStatus.SERVICE_UNAVAILABLE,"DIAGNOSTIC_BUSY");
+        try{return tx.execute(s->action.get());}finally{admission.release();}
+    }
+    private void account(String account){text(account,64);require(account.equals(config.sourceAccount()),"DIAGNOSTIC_ACCOUNT_REJECTED");}
+    public View arm(Arm request){
+        require(request!=null,"DIAGNOSTIC_ARM_REQUIRED");text(request.diagnosticSessionId(),128);account(request.sourceAccount());
+        text(request.ownerCode(),128);if(request.excludedRootTaskId()!=null)text(request.excludedRootTaskId(),128);
+        require(request.warehouseCodes()!=null&&!request.warehouseCodes().isEmpty()&&request.warehouseCodes().size()<=8,"DIAGNOSTIC_SCOPE_REJECTED");
+        request.warehouseCodes().forEach(w->text(w,64));
+        require(config.warehouseCodes()!=null&&config.warehouseCodes().containsAll(request.warehouseCodes()),"DIAGNOSTIC_SCOPE_REJECTED");
+        Arm scope=new Arm(request.diagnosticSessionId(),request.sourceAccount(),request.warehouseCodes().stream().sorted().distinct().toList(),request.ownerCode(),request.excludedRootTaskId());
+        return guarded(()->{
+            Session existing=load(scope.diagnosticSessionId());
+            if(existing!=null){require(existing.scope.equals(scope),"DIAGNOSTIC_ARM_CONFLICT");advance(existing);save(existing);return view(existing);}
+            // Read-only arm snapshot: unfinished automatic roots that have actually started.
+            var current=jdbc.queryForList("SELECT id FROM ll_selfop_sync_task WHERE source_account=? AND task_role='ACCOUNT_DISCOVERY' AND task_type='BACKFILL' AND execution_purpose='BUSINESS' AND requested_by='SELFOP_CONTINUOUS_PLANNER' AND (status IN ('RUNNING','RETRY_WAIT') OR (status='READY' AND attempt_count>0)) ORDER BY id LIMIT 2",String.class,scope.sourceAccount());
+            require(current.size()<=1,"DIAGNOSTIC_CURRENT_ROOT_AMBIGUOUS");
+            String excluded=current.isEmpty()?null:current.get(0);
+            require(Objects.equals(excluded,scope.excludedRootTaskId()),"DIAGNOSTIC_CURRENT_ROOT_CHANGED");
+            require(excluded==null||eligible(root(excluded),scope.sourceAccount()),"DIAGNOSTIC_EXCLUDED_ROOT_INVALID");
+            var active=jdbc.queryForList("SELECT diagnostic_session_id FROM ll_selfop_quantity_diagnostic_session WHERE source_account=? AND active_slot=1",String.class,scope.sourceAccount());
+            if(!active.isEmpty()){Session s=load(active.get(0));advance(s);save(s);require(terminal(s),"DIAGNOSTIC_ALREADY_ARMED");}
+            Session s=new Session();s.scope=scope;s.armedAt=clock.instant();s.bindBefore=s.armedAt.plusSeconds(21600);s.expiresAt=s.armedAt.plusSeconds(36000);s.state="ARMED";
+            // Account+active_slot unique constraint is the cross-instance arm arbitration point.
+            jdbc.update("INSERT INTO ll_selfop_quantity_diagnostic_session(diagnostic_session_id,configuration_hash,source_account,starts_at,expires_at,active_slot,state_json) VALUES(?,?,?,?,?,1,?)",scope.diagnosticSessionId(),hash(encode(scope)),scope.sourceAccount(),s.armedAt.toString(),s.expiresAt.toString(),encode(s));
+            return view(s);
+        });
+    }
+    public View status(Status request){
+        require(request!=null,"DIAGNOSTIC_STATUS_REQUIRED");account(request.sourceAccount());text(request.producerId(),128);
+        return guarded(()->{
+            var ids=jdbc.queryForList("SELECT diagnostic_session_id FROM ll_selfop_quantity_diagnostic_session WHERE source_account=? AND state_json IS NOT NULL ORDER BY active_slot DESC, starts_at DESC LIMIT 1",String.class,request.sourceAccount());
+            if(ids.isEmpty())return null;
+            Session s=load(ids.get(0));advance(s);
+            if(!terminal(s)){
+                if(s.producerId==null)s.producerId=request.producerId();
+                else if(!s.producerId.equals(request.producerId())){
+                    require(request.attach(),"DIAGNOSTIC_PRODUCER_FENCED");
+                    // Recovery retains persisted candidates, but cannot claim the lost in-memory tail was complete.
+                    s.deliveryUncertain=true;s.producerId=request.producerId();
+                }
+                if("DRAINING".equals(s.state)&&request.drained())finish(s);
+            }
+            save(s);return view(s);
+        });
+    }
+    public View stop(Stop request){
+        require(request!=null,"DIAGNOSTIC_STOP_REQUIRED");account(request.sourceAccount());text(request.diagnosticSessionId(),128);text(request.producerId(),128);
+        require(Set.of("INCOMPLETE","QUEUE_FULL","OBSERVER_FAILED","SHUTDOWN").contains(request.reason()),"DIAGNOSTIC_STOP_REASON");
+        return guarded(()->{Session s=load(request.diagnosticSessionId());require(s!=null&&s.scope.sourceAccount().equals(request.sourceAccount()),"DIAGNOSTIC_SESSION_UNKNOWN");
+            require(Objects.equals(s.producerId,request.producerId()),"DIAGNOSTIC_PRODUCER_FENCED");
+            if(!terminal(s)){s.deliveryUncertain=true;end(s,"INCOMPLETE");}save(s);return view(s);});
+    }
+    public Receipt observe(Event input){
+        Event e=normalize(input,clock.instant());account(e.sourceAccount());String payload=encode(e);int bytes=size(payload);
+        require(bytes<=MAX_REQUEST_BYTES,"DIAGNOSTIC_REQUEST_TOO_LARGE");
+        return guarded(()->{
+            Session s=load(e.diagnosticSessionId());require(s!=null&&s.scope.sourceAccount().equals(e.sourceAccount()),"DIAGNOSTIC_SESSION_UNKNOWN");
+            String key=hash(encode(List.of(e.sourceAccount(),e.warehouseCode(),e.ownerCode(),e.orderNo())));
+            var completed=jdbc.query("SELECT evidence_json,comparison FROM ll_selfop_quantity_diagnostic_order WHERE diagnostic_session_id=? AND order_key_hash=?",(r,n)->new String[]{r.getString(1),r.getString(2)},e.diagnosticSessionId(),key);
+            if(!completed.isEmpty()){
+                Pair pair=decode(completed.get(0)[0],Pair.class);Event original="LIST".equals(e.side())?pair.list:pair.detail;
+                require(encode(original).equals(payload),"DIAGNOSTIC_OBSERVATION_CONFLICT");
+                return new Receipt("DUPLICATE",completed.get(0)[1],view(s));
+            }
+            var pending=jdbc.query("SELECT evidence_json FROM ll_selfop_quantity_diagnostic_pending WHERE diagnostic_session_id=? AND order_key_hash=?",(r,n)->decode(r.getString(1),Event.class),e.diagnosticSessionId(),key);
+            if("LIST".equals(e.side())&&!pending.isEmpty()){
+                require(encode(pending.get(0)).equals(payload),"DIAGNOSTIC_OBSERVATION_CONFLICT");return new Receipt("DUPLICATE",null,view(s));
+            }
+            // Session lock is the receiver acceptance boundary. Integration enqueue is not acceptance.
+            advance(s);
+            if(terminal(s)){save(s);return new Receipt("STOPPED",null,view(s));}
+            require(Objects.equals(s.producerId,e.producerId()),"DIAGNOSTIC_PRODUCER_FENCED");
+            require(!e.observation().observedAt().isBefore(s.armedAt),"DIAGNOSTIC_OLD_OBSERVATION");
+            require(s.scope.warehouseCodes().contains(e.warehouseCode())&&("*".equals(s.scope.ownerCode())||s.scope.ownerCode().equals(e.ownerCode())),"DIAGNOSTIC_SCOPE_REJECTED");
+            require(("selfop-"+e.rootTaskId()).equals(e.collectionSessionId()),"DIAGNOSTIC_COLLECTION_SESSION_REJECTED");
+            SelfopSyncTask task=root(e.rootTaskId());require(eligible(task,e.sourceAccount()),"DIAGNOSTIC_ROOT_REJECTED");
+            if(s.rootTaskId==null){
+                if(!"LIST".equals(e.side())||e.rootTaskId().equals(s.scope.excludedRootTaskId())||!clock.instant().isBefore(s.bindBefore)||!e.observation().observedAt().isBefore(s.bindBefore))return new Receipt("IGNORED",null,view(s));
+                s.rootTaskId=e.rootTaskId();s.collectionSessionId=e.collectionSessionId();s.boundAt=e.observation().observedAt();
+                s.expiresAt=s.boundAt.plusSeconds(14400).isBefore(s.expiresAt)?s.boundAt.plusSeconds(14400):s.expiresAt;s.state="BOUND";
+                advance(s);
+                if(terminal(s)){save(s);return new Receipt("STOPPED",null,view(s));}
+            }
+            require(s.rootTaskId.equals(e.rootTaskId())&&s.collectionSessionId.equals(e.collectionSessionId()),"DIAGNOSTIC_ROOT_FROZEN");
+            if(ended(task)&&!"DRAINING".equals(s.state)){s.state="DRAINING";s.rootEndedAt=clock.instant();}
+            if("LIST".equals(e.side())&&("DRAINING".equals(s.state)||s.candidates>=MAX_ORDERS)){save(s);return new Receipt("IGNORED",null,view(s));}
+            if("DETAIL".equals(e.side())&&pending.isEmpty()){save(s);return new Receipt("IGNORED",null,view(s));}
+            if(s.rootEndedAt!=null&&e.observation().observedAt().isAfter(s.rootEndedAt)){save(s);return new Receipt("IGNORED",null,view(s));}
+            // Retained bytes/rows are monotonic and count both observations; promotion never refunds quota.
+            int overhead="LIST".equals(e.side())?20:0;
+            if(s.rows+e.skus().size()>MAX_ROWS||s.bytes+bytes+overhead>MAX_BYTES){end(s,"INCOMPLETE");save(s);return new Receipt("STOPPED",null,view(s));}
+            s.rows+=e.skus().size();s.bytes+=bytes+overhead;
+            String comparison=null;
+            if("LIST".equals(e.side())){
+                s.candidates++;
+                jdbc.update("INSERT INTO ll_selfop_quantity_diagnostic_pending(diagnostic_session_id,order_key_hash,warehouse_code,owner_code,order_no,evidence_json) VALUES(?,?,?,?,?,?)",e.diagnosticSessionId(),key,e.warehouseCode(),e.ownerCode(),e.orderNo(),payload);
+                if(!Boolean.TRUE.equals(e.observation().skuSetComplete())||e.skus().stream().anyMatch(v->v.listQty()==null)){comparison="INCONCLUSIVE";end(s,comparison);}
+            }else{
+                Event list=pending.get(0);comparison=compare(list,e);String evidence=encode(new Pair(list,e));s.paired++;
+                require(size(evidence)<=MAX_REQUEST_BYTES,"DIAGNOSTIC_PAIR_TOO_LARGE");
+                jdbc.update("INSERT INTO ll_selfop_quantity_diagnostic_order(diagnostic_session_id,order_key_hash,source_account,warehouse_code,owner_code,order_no,payload_hash,comparison,sku_rows,payload_bytes,evidence_json,received_at) VALUES(?,?,?,?,?,?,?,?,?,?,?,?)",e.diagnosticSessionId(),key,e.sourceAccount(),e.warehouseCode(),e.ownerCode(),e.orderNo(),hash(evidence),comparison,Math.max(list.skus().size(),e.skus().size()),size(evidence),evidence,clock.instant().toString());
+                jdbc.update("DELETE FROM ll_selfop_quantity_diagnostic_pending WHERE diagnostic_session_id=? AND order_key_hash=?",e.diagnosticSessionId(),key);
+                if(!"ALL_EQUAL".equals(comparison))end(s,comparison);
+                else if(s.paired==MAX_ORDERS)end(s,s.deliveryUncertain?"INCOMPLETE":"COMPLETED");
+            }
+            save(s);return new Receipt("ACCEPTED",comparison,view(s));
+        });
+    }
+    private void advance(Session s){
+        if(terminal(s))return;
+        Instant now=clock.instant();
+        if(!now.isBefore(s.expiresAt)){end(s,"INCOMPLETE");return;}
+        if(s.rootTaskId==null){if(!now.isBefore(s.bindBefore))end(s,"BIND_TIMEOUT");return;}
+        if(ended(root(s.rootTaskId))&&!"DRAINING".equals(s.state)){s.state="DRAINING";s.rootEndedAt=now;}
+    }
+    private void finish(Session s){end(s,s.deliveryUncertain||s.candidates!=s.paired?"INCOMPLETE":s.paired<MAX_ORDERS?"ROOT_ENDED_INSUFFICIENT":"COMPLETED");}
+    private static boolean terminal(Session s){return "TERMINAL".equals(s.state);}
+    private static void end(Session s,String reason){s.state="TERMINAL";s.reason=reason;}
+    private static boolean ended(SelfopSyncTask t){return t==null||Set.of("SUCCEEDED","DEAD","FAILED","ABORTED","CANCELLED").contains(t.getStatus());}
+    private static boolean eligible(SelfopSyncTask t,String account){return t!=null&&account.equals(t.getSourceAccount())&&"ACCOUNT_DISCOVERY".equals(t.getTaskRole())&&SelfopCollectionPolicy.continuousBusinessRoot(t);}
+    private SelfopSyncTask root(String id){
+        require(id!=null&&id.matches("[0-9]{1,19}"),"DIAGNOSTIC_ROOT_ID_INVALID");
+        var rows=jdbc.query("SELECT id,source_account,execution_purpose,upstream_task_id,validation_root_task_id,requested_by,scope_hash,request_key,task_role,task_type,discovery_scope_id,query_from_utc,query_until_utc,query_scope_json,status FROM ll_selfop_sync_task WHERE id=?",new BeanPropertyRowMapper<>(SelfopSyncTask.class),id);
+        return rows.isEmpty()?null:rows.get(0);
+    }
+    private Session load(String id){
+        var sessions=jdbc.query("SELECT state_json,root_task_id,collection_session_id,starts_at,expires_at,accepted_orders,accepted_sku_rows,accepted_bytes,stop_reason FROM ll_selfop_quantity_diagnostic_session WHERE diagnostic_session_id=? FOR UPDATE",(r,n)->{
+            String metadata=r.getString(1);require(metadata!=null,"DIAGNOSTIC_HISTORICAL_ID_READ_ONLY");Session s=decode(metadata,Session.class);
+            // Existing columns remain the sole authority for counters, root, deadline and stop reason.
+            s.rootTaskId=r.getString(2);s.collectionSessionId=r.getString(3);s.boundAt=s.rootTaskId==null?null:Instant.parse(r.getString(4));s.expiresAt=Instant.parse(r.getString(5));
+            s.paired=r.getInt(6);s.rows=r.getInt(7);s.bytes=r.getLong(8);s.reason=r.getString(9);
+            s.state=s.reason!=null?"TERMINAL":s.rootTaskId==null?"ARMED":s.rootEndedAt!=null?"DRAINING":"BOUND";return s;
+        },id);return sessions.isEmpty()?null:sessions.get(0);
+    }
+    private void save(Session s){jdbc.update("UPDATE ll_selfop_quantity_diagnostic_session SET state_json=?,active_slot=?,collection_session_id=?,root_task_id=?,starts_at=?,expires_at=?,accepted_orders=?,accepted_sku_rows=?,accepted_bytes=?,stop_reason=? WHERE diagnostic_session_id=?",encode(s),terminal(s)?null:1,s.collectionSessionId,s.rootTaskId,(s.boundAt==null?s.armedAt:s.boundAt).toString(),s.expiresAt.toString(),s.paired,s.rows,s.bytes,s.reason,s.scope.diagnosticSessionId());}
+    private View view(Session s){
+        var selected=jdbc.query("SELECT warehouse_code,owner_code,order_no,0 AS paired FROM ll_selfop_quantity_diagnostic_pending WHERE diagnostic_session_id=? UNION ALL SELECT warehouse_code,owner_code,order_no,1 AS paired FROM ll_selfop_quantity_diagnostic_order WHERE diagnostic_session_id=?",(r,n)->new Key(r.getString(1),r.getString(2),r.getString(3),r.getBoolean(4)),s.scope.diagnosticSessionId(),s.scope.diagnosticSessionId());
+        return new View(s.scope.diagnosticSessionId(),s.scope.sourceAccount(),s.rootTaskId,s.collectionSessionId,s.state,s.reason,s.boundAt==null?s.armedAt:s.boundAt,s.expiresAt,s.bindBefore,s.scope.warehouseCodes(),s.scope.ownerCode(),s.scope.excludedRootTaskId(),s.candidates,s.paired,s.rows,s.bytes,s.deliveryUncertain,selected);
+    }
+    private String encode(Object value){try{return json.writeValueAsString(value);}catch(Exception e){throw invalid("DIAGNOSTIC_ENCODING_FAILED");}}
+    private <T>T decode(String value,Class<T> type){try{return json.readValue(value,type);}catch(Exception e){throw new IllegalStateException("DIAGNOSTIC_STORAGE_INVALID");}}
+    /** Storage-only codec. The controller and Integration wire codec continue using numeric BigDecimal. */
+    private static ObjectMapper storageMapper(ObjectMapper source) {
+        var module=new SimpleModule("quantity-diagnostic-storage-decimals");
+        module.addSerializer(BigDecimal.class,new StdSerializer<BigDecimal>(BigDecimal.class) {
+            @Override public void serialize(BigDecimal value,JsonGenerator generator,
+                    com.fasterxml.jackson.databind.SerializerProvider provider)throws IOException {
+                generator.writeString(value.stripTrailingZeros().toPlainString());
+            }
+        });
+        module.addDeserializer(BigDecimal.class,new StdDeserializer<BigDecimal>(BigDecimal.class) {
+            @Override public BigDecimal deserialize(JsonParser parser,
+                    com.fasterxml.jackson.databind.DeserializationContext context)throws IOException {
+                // New grants never read historical numeric evidence; no numeric fallback/coercion.
+                if(!parser.hasToken(JsonToken.VALUE_STRING))throw new IOException("DIAGNOSTIC_STORAGE_DECIMAL_REQUIRED");
+                String text=parser.getText();
+                if(!text.matches("(?:0|[1-9][0-9]{0,31})(?:\\.[0-9]{1,6})?"))throw new IOException("DIAGNOSTIC_STORAGE_DECIMAL_INVALID");
+                BigDecimal value=new BigDecimal(text);
+                if(!text.equals(value.stripTrailingZeros().toPlainString()))throw new IOException("DIAGNOSTIC_STORAGE_DECIMAL_NOT_CANONICAL");
+                return value;
+            }
+        });
+        return source.copy().disable(com.fasterxml.jackson.databind.SerializationFeature.WRITE_DATES_AS_TIMESTAMPS)
+            .registerModule(module);
+    }
+    private static int size(String s){return s.getBytes(StandardCharsets.UTF_8).length;}
+    private static String hash(String s){try{return HexFormat.of().formatHex(MessageDigest.getInstance("SHA-256").digest(s.getBytes(StandardCharsets.UTF_8)));}catch(Exception e){throw new IllegalStateException(e);}}
+    public record Pair(Event list,Event detail){}
+    public static class Session {
+        public Arm scope;public String producerId;
+        public Instant armedAt,bindBefore,rootEndedAt;
+        public int candidates;public boolean deliveryUncertain;
+        @com.fasterxml.jackson.annotation.JsonIgnore public String state,reason,rootTaskId,collectionSessionId;
+        @com.fasterxml.jackson.annotation.JsonIgnore public Instant boundAt,expiresAt;
+        @com.fasterxml.jackson.annotation.JsonIgnore public int paired,rows;
+        @com.fasterxml.jackson.annotation.JsonIgnore public long bytes;
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/history/InventoryFlowCollector.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/history/InventoryFlowCollector.java
new file mode 100644
index 000000000..81fb96375
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/history/InventoryFlowCollector.java
@@ -0,0 +1,121 @@
+package com.baiyue.lastleg.selfoperated.analytics.history;
+
+import com.baomidou.mybatisplus.core.conditions.query.QueryWrapper;
+import com.baomidou.mybatisplus.core.toolkit.IdWorker;
+import com.baiyue.lastleg.selfoperated.analytics.client.*;
+import com.baiyue.lastleg.selfoperated.analytics.mapper.*;
+import com.baiyue.lastleg.selfoperated.analytics.model.*;
+import com.baiyue.lastleg.selfoperated.analytics.request.*;
+import com.baiyue.lastleg.selfoperated.analytics.sync.SelfopLeaseService;
+import org.springframework.jdbc.core.JdbcTemplate;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.support.TransactionTemplate;
+import java.time.*;
+import java.util.*;
+import static com.baiyue.lastleg.selfoperated.analytics.model.SelfopSupport.*;
+
+/** One page per dispatch. Only the HTTP/page checkpoint holds the shared account lease. */
+@Service
+public class InventoryFlowCollector {
+    private final SelfopAnalyticsProperties config;
+    private final SelfopSyncTaskMapper tasks; private final SelfopSyncRunMapper runs; private final SelfopSyncStageMapper stages;
+    private final SelfopCoordinationMapper locks; private final SelfopLeaseService leases;
+    private final RestLingxingAnalyticsClient client; private final JdbcTemplate jdbc; private final TransactionTemplate tx;
+    private final String session=UUID.randomUUID().toString();
+    public InventoryFlowCollector(SelfopAnalyticsProperties config,SelfopSyncTaskMapper tasks,SelfopSyncRunMapper runs,
+        SelfopSyncStageMapper stages,SelfopCoordinationMapper locks,SelfopLeaseService leases,RestLingxingAnalyticsClient client,
+        JdbcTemplate jdbc,TransactionTemplate tx){this.config=config;this.tasks=tasks;this.runs=runs;this.stages=stages;this.locks=locks;
+        this.leases=leases;this.client=client;this.jdbc=jdbc;this.tx=tx;}
+    public record Checkpoint(String session,int nextPage,LocalDateTime lastTime) {}
+    public void plan(long accountId,InventoryFlowSlice slice,LocalDate round) {
+        String digest=hash(slice),key="continuous:history:"+round+":"+digest;
+        tx.executeWithoutResult(s->{
+            locks.lockDiscovery(accountId);
+            if(tasks.selectCount(new QueryWrapper<SelfopSyncTask>().eq("source_account",config.getSourceAccount()).eq("request_key",key))>0)return;
+            var now=utcNow();var task=new SelfopSyncTask();task.setId(IdWorker.getId());
+            task.setTaskNo("LXHIST-"+UUID.randomUUID().toString().replace("-",""));task.setSourceAccount(config.getSourceAccount());
+            task.setTaskRole("ACCOUNT_DISCOVERY");task.setDiscoveryScopeId(accountId);task.setTaskType(InventoryFlowSlice.TYPE);
+            task.setExecutionPurpose("BUSINESS");task.setBusinessRootTaskId(task.getId());task.setBusinessBudgetJson(SelfopBusinessBudget.freezeContinuous(now));
+            task.setRequestKey(key);task.setRequestHash(digest);task.setScopeHash(digest);task.setQueryScopeJson(json(slice));
+            task.setQueryFromUtc(LocalDateTime.ofInstant(slice.from(),ZoneOffset.UTC));task.setQueryUntilUtc(LocalDateTime.ofInstant(slice.until(),ZoneOffset.UTC));
+            task.setPlannedAtUtc(round.atStartOfDay());task.setRequestedBy(SelfopCollectionPolicy.CONTINUOUS_PLANNER);
+            task.setStatus("READY");task.setApplyState("NOT_APPLICABLE");task.setAttemptCount(0);task.setCreatedAt(now);task.setUpdatedAt(now);tasks.insert(task);
+        });
+    }
+    public boolean priorityWork() {
+        return !locks.dueContinuous(utcNow(),1,config.getSourceAccount()).isEmpty();
+    }
+    public void page() {
+        if(priorityWork())return;
+        var pending=tasks.selectList(new QueryWrapper<SelfopSyncTask>().eq("source_account",config.getSourceAccount())
+            .eq("task_type",InventoryFlowSlice.TYPE).in("status",List.of("READY","RUNNING","RETRY_WAIT"))
+            .and(q->q.isNull("next_retry_at_utc").or().le("next_retry_at_utc",utcNow())).orderByDesc("query_until_utc").orderByAsc("id").last("LIMIT 1"));
+        if(pending.isEmpty())return;
+        var selected=pending.get(0);var lease=leases.acquireDiscovery(selected.getDiscoveryScopeId(),"history-"+session);
+        try {
+            if(priorityWork())return;
+            var run=tx.execute(s->{
+                leases.verify(lease);var task=locks.lockTask(selected.getId());
+                require(Set.of("READY","RUNNING","RETRY_WAIT").contains(task.getStatus()),"HISTORY_TASK_NOT_READY");
+                var prior=runs.selectOne(new QueryWrapper<SelfopSyncRun>().eq("task_id",task.getId()).orderByDesc("attempt_no").last("LIMIT 1"));
+                if(prior!=null&&"FETCHING".equals(prior.getStatus())&&prior.getProgressSnapshotJson()!=null
+                    &&session.equals(read(prior.getProgressSnapshotJson(),Checkpoint.class).session())) {
+                    prior.setFenceToken(lease.fence());runs.updateById(prior);return prior;
+                }
+                if(prior!=null&&"FETCHING".equals(prior.getStatus())) {
+                    prior.setStatus("ABORTED");prior.setErrorCode("HISTORY_RESTART_PAGE_ONE");prior.setFinishedAtUtc(utcNow());runs.updateById(prior);
+                }
+                if(task.getAttemptCount()>=config.getMaxAttempts()){task.setStatus("DEAD");tasks.updateById(task);return null;}
+                var now=utcNow();var next=new SelfopSyncRun();next.setId(IdWorker.getId());next.setTaskId(task.getId());
+                next.setAttemptNo(task.getAttemptCount()+1);next.setSourceAccount(task.getSourceAccount());next.setExecutionPurpose("BUSINESS");
+                next.setRunRole("ACCOUNT_DISCOVERY");next.setScopeHash(task.getScopeHash());next.setScopeSnapshotJson(task.getQueryScopeJson());
+                next.setFenceToken(lease.fence());next.setStatus("FETCHING");next.setLastPhase("FETCHING");next.setCoverageStatus("UNKNOWN");
+                next.setPageCount(0);next.setUniqueObjectCount(0L);next.setFetchStartedAtUtc(now);next.setCreatedAt(now);next.setUpdatedAt(now);
+                next.setProgressSnapshotJson(json(new Checkpoint(session,1,null)));runs.insert(next);
+                task.setStatus("RUNNING");task.setAttemptCount(next.getAttemptNo());task.setUpdatedAt(now);tasks.updateById(task);return next;
+            });
+            if(run==null)return;
+            var task=tasks.selectById(selected.getId());var slice=read(task.getQueryScopeJson(),InventoryFlowSlice.class);
+            var checkpoint=read(run.getProgressSnapshotJson(),Checkpoint.class);
+            try {
+                var page=slice.validate(client.inventoryFlowPage(SelfopRequestContext.forTask(task,run,config),slice.warehouse(),slice.start(),slice.end(),checkpoint.nextPage(),slice.size()),
+                    checkpoint.nextPage(),run.getSourceTotalCount(),checkpoint.lastTime());
+                tx.executeWithoutResult(s->{
+                    leases.verify(lease);var current=locks.lockTask(task.getId());require("RUNNING".equals(current.getStatus()),"HISTORY_TASK_STOPPED");
+                    var now=utcNow();
+                    for(var row:page.rows()) {
+                        var stage=new SelfopSyncStage();stage.setId(IdWorker.getId());stage.setRunId(run.getId());stage.setStageBatchId(run.getId());
+                        stage.setLastFetchRunId(run.getId());stage.setWarehouseCode(slice.warehouse());stage.setObjectType("INVENTORY_FLOW");
+                        stage.setObjectKeyHash(hash(row.path("id").asText()));stage.setContentHash(hash(row));stage.setPayloadJson(json(row));
+                        stage.setFirstPageNo(checkpoint.nextPage());stage.setObservedAtUtc(now);stage.setValidationStatus("VALID");stage.setCreatedAt(now);stage.setUpdatedAt(now);
+                        stages.insert(stage); // Duplicate IDs across pages roll back this entire page.
+                    }
+                    run.setPageCount(checkpoint.nextPage());run.setSourceTotalCount(page.total());run.setUniqueObjectCount(run.getUniqueObjectCount()+page.rows().size());
+                    run.setProgressSnapshotJson(json(new Checkpoint(session,checkpoint.nextPage()+1,page.lastTime())));run.setUpdatedAt(now);run.setHeartbeatAtUtc(now);
+                    if(checkpoint.nextPage()>=page.pages()) {
+                        require(run.getUniqueObjectCount()==page.total(),"HISTORY_PAGE_COUNT_MISMATCH");
+                        run.setStatus("VALIDATED");run.setLastPhase("VALIDATED");run.setFetchFinishedAtUtc(now);
+                        // Coverage becomes usable only after the separate local merge finishes.
+                        current.setStatus("WAITING_SOURCE");
+                    }
+                    runs.updateById(run);current.setProgressUpdatedAtUtc(now);current.setUpdatedAt(now);tasks.updateById(current);
+                });
+            }catch(EgressRejectedException e) {
+                tx.executeWithoutResult(s->{leases.verify(lease);jdbc.update("UPDATE ll_selfop_sync_task SET next_retry_at_utc=?,updated_at=? WHERE id=? AND status='RUNNING'",
+                    e.waitUntilUtc()==null?utcNow().plusSeconds(30):e.waitUntilUtc(),utcNow(),task.getId());});
+            }catch(RuntimeException e) {
+                tx.executeWithoutResult(s->{leases.verify(lease);run.setStatus("FAILED");run.setErrorCode("HISTORY_FETCH_FAILED");
+                    run.setErrorMessage("分页失败，完整片重试；账号不确定结果仍受出口暂停保护");run.setFinishedAtUtc(utcNow());runs.updateById(run);
+                    boolean drift="HISTORY_PAGE_DRIFT_OR_INVALID".equals(e.getMessage())||e instanceof org.springframework.dao.DuplicateKeyException;
+                    long seconds=Duration.between(slice.start(),slice.end()).getSeconds();
+                    if(drift&&seconds>3600) {
+                        var midpoint=slice.start().plusSeconds(seconds/2);
+                        plan(task.getDiscoveryScopeId(),new InventoryFlowSlice(slice.warehouse(),slice.start(),midpoint,1000),task.getPlannedAtUtc().toLocalDate());
+                        plan(task.getDiscoveryScopeId(),new InventoryFlowSlice(slice.warehouse(),midpoint,slice.end(),1000),task.getPlannedAtUtc().toLocalDate());
+                    }
+                    jdbc.update("UPDATE ll_selfop_sync_task SET status=?,next_retry_at_utc=?,updated_at=? WHERE id=? AND status='RUNNING'",
+                        drift&&seconds>3600||task.getAttemptCount()>=config.getMaxAttempts()?"DEAD":"RETRY_WAIT",utcNow().plusSeconds(60),utcNow(),task.getId());});
+            }
+        }finally{leases.release(lease);}
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/history/InventoryFlowFacts.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/history/InventoryFlowFacts.java
new file mode 100644
index 000000000..c224442e1
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/history/InventoryFlowFacts.java
@@ -0,0 +1,91 @@
+package com.baiyue.lastleg.selfoperated.analytics.history;
+
+import com.baomidou.mybatisplus.core.toolkit.IdWorker;
+import com.baiyue.lastleg.selfoperated.analytics.model.SelfopSupport;
+import com.fasterxml.jackson.databind.JsonNode;
+import org.springframework.jdbc.core.JdbcTemplate;
+import org.springframework.jdbc.core.namedparam.NamedParameterJdbcTemplate;
+import org.springframework.stereotype.Repository;
+import org.springframework.transaction.support.TransactionTemplate;
+import java.math.BigDecimal;
+import java.sql.Timestamp;
+import java.time.*;
+import java.util.*;
+
+/** Small local transactions; facts and invalidation commit together, independently of HTTP. */
+@Repository
+public class InventoryFlowFacts {
+    private final JdbcTemplate jdbc;private final TransactionTemplate tx;private final InventoryHistoryVersions versions;
+    public InventoryFlowFacts(JdbcTemplate jdbc,TransactionTemplate tx,InventoryHistoryVersions versions){this.jdbc=jdbc;this.tx=tx;this.versions=versions;}
+    public boolean mergeNext(String account) {
+        var pending=jdbc.queryForList("SELECT r.id,t.id task_id,t.query_scope_json FROM ll_selfop_sync_run r JOIN ll_selfop_sync_task t ON t.id=r.task_id WHERE t.source_account=? AND t.task_type=? AND t.status='WAITING_SOURCE' AND r.status='VALIDATED' ORDER BY r.id LIMIT 1",account,InventoryFlowSlice.TYPE);
+        if(pending.isEmpty())return false;
+        long run=((Number)pending.get(0).get("id")).longValue(),task=((Number)pending.get(0).get("task_id")).longValue();
+        var slice=SelfopSupport.read(string(pending.get(0).get("query_scope_json")),InventoryFlowSlice.class);
+        tx.executeWithoutResult(s->{
+            versions.lockWarehouse(account,slice.warehouse());
+            var state=jdbc.queryForMap("SELECT status,COALESCE(applied_fact_revision,0) checkpoint FROM ll_selfop_sync_run WHERE id=? FOR UPDATE",run);
+            if(!"VALIDATED".equals(state.get("status")))return;
+            long after=((Number)state.get("checkpoint")).longValue();
+            var batch=jdbc.queryForList("SELECT id,payload_json,content_hash,observed_at_utc FROM ll_selfop_sync_stage WHERE run_id=? AND object_type='INVENTORY_FLOW' AND id>? ORDER BY id LIMIT 500",run,after);
+            boolean changed=false;
+            for(var stage:batch)changed|=merge(account,slice,run,stage);
+            if(changed)versions.invalidate(account,slice.warehouse(),run,"FLOW_FACT_REVISED");
+            if(!batch.isEmpty()) {
+                jdbc.update("UPDATE ll_selfop_sync_run SET applied_fact_revision=?,updated_at=? WHERE id=?",batch.get(batch.size()-1).get("id"),now(),run);return;
+            }
+            // A previously observed row disappearing is uncertainty, not an invented reversal.
+            int missing=jdbc.update("UPDATE ll_selfop_inventory_flow SET validation_status='UNKNOWN',validation_reason='SOURCE_FLOW_MISSING',revision_no=revision_no+1 WHERE source_account=? AND warehouse_code=? AND event_at_utc>=? AND event_at_utc<? AND validation_reason IS NULL AND last_run_id<>? AND last_observed_at<(SELECT fetch_started_at_utc FROM ll_selfop_sync_run WHERE id=?) LIMIT 100",
+                account,slice.warehouse(),utc(slice.from()),utc(slice.until()),run,run);
+            if(missing>0){versions.invalidate(account,slice.warehouse(),run,"SOURCE_FLOW_MISSING");return;}
+            jdbc.update("UPDATE ll_selfop_sync_run SET status='FACTS_APPLIED',last_phase='FACTS_APPLIED',coverage_status='COMPLETE',covered_from_utc=?,covered_until_utc=?,finished_at_utc=?,updated_at=? WHERE id=?",
+                utc(slice.from()),utc(slice.until()),now(),now(),run);
+            jdbc.update("UPDATE ll_selfop_sync_task SET status='SUCCEEDED',updated_at=? WHERE id=? AND status='WAITING_SOURCE'",now(),task);
+        });
+        return true;
+    }
+    private boolean merge(String account,InventoryFlowSlice slice,long run,Map<String,Object> stage) {
+        var row=SelfopSupport.read(string(stage.get("payload_json")),JsonNode.class);String id=row.path("id").asText();
+        var old=jdbc.queryForList("SELECT id,customer_code,sku_code,product_quality,content_hash,revision_no,validation_reason,last_observed_at FROM ll_selfop_inventory_flow WHERE source_account=? AND warehouse_code=? AND source_flow_id=?",account,slice.warehouse(),id);
+        var observed=instant(stage.get("observed_at_utc"));
+        if(!old.isEmpty()&&instant(old.get(0).get("last_observed_at")).isAfter(observed))return false;
+        if(!old.isEmpty()) {
+            var prior=old.get(0);
+            if("FLOW_IDENTITY_CONFLICT".equals(prior.get("validation_reason")))return false;
+            if(!Objects.equals(prior.get("customer_code"),row.path("customerCode").asText())
+                ||!Objects.equals(prior.get("sku_code"),row.path("productSku").asText())
+                ||((Number)prior.get("product_quality")).intValue()!=row.path("productQuality").asInt(-1)) {
+                jdbc.update("UPDATE ll_selfop_inventory_flow SET validation_status='UNKNOWN',validation_reason='FLOW_IDENTITY_CONFLICT',revision_no=revision_no+1 WHERE id=?",prior.get("id"));
+                return true;
+            }
+        }
+        if(!old.isEmpty()&&Objects.equals(old.get(0).get("content_hash"),stage.get("content_hash"))&&old.get(0).get("validation_reason")==null){
+            jdbc.update("UPDATE ll_selfop_inventory_flow SET last_run_id=?,last_observed_at=? WHERE id=?",run,utc(observed),old.get(0).get("id"));return false;
+        }
+        var fields=new LinkedHashMap<String,Object>();
+        fields.put("source_account",account);fields.put("warehouse_code",slice.warehouse());fields.put("source_flow_id",id);
+        fields.put("customer_code",row.path("customerCode").asText());fields.put("sku_code",row.path("productSku").asText());fields.put("product_quality",row.path("productQuality").asInt(-1));
+        for(var name:Map.of("cell_no","cellNo","inner_batch_no","innerBatchNo","bill_no","billNo","source_no","sourceNo","bill_type","billType").entrySet())fields.put(name.getKey(),nullable(row,name.getValue()));
+        var at=LocalDateTime.parse(row.path("createTime").asText().replace(' ','T'));
+        fields.put("book_qty",number(row,"bookQty"));fields.put("book_change_qty_raw",nullable(row,"bookChangQty"));fields.put("delta_quantity",number(row,"bookChangQty"));fields.put("close_quantity",number(row,"closeQty"));
+        fields.put("source_create_time",row.path("createTime").asText());fields.put("event_at_utc",at.minusHours(8));fields.put("business_date",at.toLocalDate());fields.put("quantity_unit","PCS");
+        fields.put("content_hash",stage.get("content_hash"));fields.put("stage_id",stage.get("id"));fields.put("last_run_id",run);fields.put("last_observed_at",utc(observed));
+        fields.put("validation_status","VALID");fields.put("validation_reason",null);
+        fields.put("revision_no",old.isEmpty()?1L:((Number)old.get(0).get("revision_no")).longValue()+1);
+        var named=new NamedParameterJdbcTemplate(jdbc);
+        if(old.isEmpty()) {
+            fields.put("id",IdWorker.getId());fields.put("first_run_id",run);
+            named.update("INSERT INTO ll_selfop_inventory_flow ("+String.join(",",fields.keySet())+") VALUES (:"+String.join(",:",fields.keySet())+")",fields);
+        }else{
+            String sets=String.join(",",fields.keySet().stream().map(k->k+"=:"+k).toList());fields.put("id",old.get(0).get("id"));
+            named.update("UPDATE ll_selfop_inventory_flow SET "+sets+" WHERE id=:id",fields);
+        }
+        return true;
+    }
+    static BigDecimal number(JsonNode row,String field){try{var v=new BigDecimal(row.path(field).asText());return v.scale()<=6&&v.precision()-v.scale()<=14?v:null;}catch(RuntimeException e){return null;}}
+    static String nullable(JsonNode row,String field){return row.path(field).isNull()||row.path(field).isMissingNode()?null:row.path(field).asText();}
+    static String string(Object value){return value instanceof byte[] b?new String(b,java.nio.charset.StandardCharsets.UTF_8):String.valueOf(value);}
+    static Instant instant(Object v){return v instanceof Timestamp t?t.toLocalDateTime().toInstant(ZoneOffset.UTC):((LocalDateTime)v).toInstant(ZoneOffset.UTC);}
+    static LocalDateTime now(){return LocalDateTime.now(ZoneOffset.UTC);}
+    private static LocalDateTime utc(Instant instant){return LocalDateTime.ofInstant(instant,ZoneOffset.UTC);}
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/history/InventoryFlowSlice.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/history/InventoryFlowSlice.java
new file mode 100644
index 000000000..5f0e62099
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/history/InventoryFlowSlice.java
@@ -0,0 +1,54 @@
+package com.baiyue.lastleg.selfoperated.analytics.history;
+
+import com.baiyue.lastleg.selfoperated.analytics.model.SelfopSupport;
+import com.fasterxml.jackson.databind.JsonNode;
+import java.time.*;
+import java.time.format.DateTimeFormatter;
+import java.util.*;
+
+/** Fixed inclusive provider bounds; persisted coverage is half open at the next second. */
+public record InventoryFlowSlice(String warehouse, LocalDateTime start, LocalDateTime end, int size) {
+    public static final String TYPE="INVENTORY_FLOW_HISTORY";
+    public InventoryFlowSlice {
+        if(warehouse==null||warehouse.isBlank()||warehouse.length()>64||start==null||end==null
+            ||!start.isBefore(end)||end.isAfter(start.plusDays(1))||start.getNano()!=0||end.getNano()!=0||size!=1000)
+            throw new IllegalArgumentException("HISTORY_SLICE_INVALID");
+    }
+    public Map<String,Object> request(int page) {
+        if(page<1)throw new IllegalArgumentException("HISTORY_PAGE_INVALID");
+        return Map.of("warehouseCode",warehouse,"startTime",DateTimeFormatter.ISO_LOCAL_DATE_TIME.format(start),
+            "endTime",DateTimeFormatter.ISO_LOCAL_DATE_TIME.format(end),"current",page,"size",size);
+    }
+    public String requestHash(int page){return SelfopSupport.hash(request(page));}
+    public Instant from(){return start.toInstant(ZoneOffset.ofHours(8));}
+    public Instant until(){return end.plusSeconds(1).toInstant(ZoneOffset.ofHours(8));}
+    public record Page(long total,long pages,LocalDateTime lastTime,List<JsonNode> rows) {}
+    public Page validate(JsonNode response,int page,Long previousTotal,LocalDateTime previousLast) {
+        if(response==null||!response.path("records").isArray()||response.path("current").asInt()!=page
+            ||response.path("size").asInt()!=size)throw invalid();
+        // Internal Long fields are serialized as decimal strings by LongIdJacksonConfiguration.
+        var totalNode=response.path("total");
+        if(!(totalNode.isIntegralNumber()||totalNode.isTextual())||!totalNode.asText().matches("[0-9]{1,19}"))throw invalid();
+        long total;
+        try{total=Long.parseLong(totalNode.asText());}catch(NumberFormatException e){throw invalid();}
+        long pages=total==0?0:(total-1)/size+1;
+        if(total<0||pages>Integer.MAX_VALUE||response.path("pages").asLong(-1)!=pages
+            ||previousTotal!=null&&total!=previousTotal||page>Math.max(1,pages)
+            ||response.path("records").size()!=Math.min(size,Math.max(0,total-(long)(page-1)*size)))throw invalid();
+        var ids=new HashSet<String>();var rows=new ArrayList<JsonNode>();var last=previousLast;
+        for(var row:response.path("records")) {
+            String id=text(row,"id",64);text(row,"customerCode",64);text(row,"productSku",128);
+            if(!warehouse.equals(text(row,"whCode",64))||!ids.add(id))throw invalid();
+            LocalDateTime at;
+            try{at=LocalDateTime.parse(row.path("createTime").asText().replace(' ','T'));}catch(RuntimeException e){throw invalid();}
+            if(at.isBefore(start)||at.isAfter(end)||last!=null&&at.isBefore(last))throw invalid();
+            last=at;rows.add(row);
+        }
+        return new Page(total,pages,last,List.copyOf(rows));
+    }
+    static String text(JsonNode row,String field,int max) {
+        var value=row.path(field);String text=value.asText();
+        if(!value.isTextual()||text.isBlank()||text.length()>max)throw invalid();return text;
+    }
+    private static IllegalStateException invalid(){return new IllegalStateException("HISTORY_PAGE_DRIFT_OR_INVALID");}
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/history/InventoryHistoryBuilder.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/history/InventoryHistoryBuilder.java
new file mode 100644
index 000000000..1ffa3ad74
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/history/InventoryHistoryBuilder.java
@@ -0,0 +1,186 @@
+package com.baiyue.lastleg.selfoperated.analytics.history;
+
+import com.baomidou.mybatisplus.core.toolkit.IdWorker;
+import com.baiyue.lastleg.selfoperated.analytics.mapper.*;
+import com.baiyue.lastleg.selfoperated.analytics.model.*;
+import com.fasterxml.jackson.databind.JsonNode;
+import org.springframework.jdbc.core.JdbcTemplate;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.support.TransactionTemplate;
+import java.math.BigDecimal;
+import java.sql.Timestamp;
+import java.time.*;
+import java.util.*;
+import static com.baiyue.lastleg.selfoperated.analytics.history.InventoryHistoryCalculator.*;
+import static com.baiyue.lastleg.selfoperated.analytics.model.SelfopSupport.*;
+
+/** Local reconstruction worker. Source requests and account leases are deliberately absent. */
+@Service
+public class InventoryHistoryBuilder {
+    public static final String TYPE="INVENTORY_HISTORY_BUILD";
+    private final JdbcTemplate jdbc;private final TransactionTemplate tx;private final InventoryHistoryVersions versions;
+    private final SelfopSyncTaskMapper tasks;private final SelfopSyncRunMapper runs;private final SelfopSyncStageMapper stages;
+    public InventoryHistoryBuilder(JdbcTemplate jdbc,TransactionTemplate tx,InventoryHistoryVersions versions,
+        SelfopSyncTaskMapper tasks,SelfopSyncRunMapper runs,SelfopSyncStageMapper stages){this.jdbc=jdbc;this.tx=tx;this.versions=versions;this.tasks=tasks;this.runs=runs;this.stages=stages;}
+    public record StockRun(long id,String scopeHash,Instant from,Instant until) {}
+    public StockRun anchor(String account,String warehouse,int offset) {
+        var rows=jdbc.query("SELECT r.id,r.scope_hash,r.fetch_started_at_utc,r.fetch_finished_at_utc FROM ll_selfop_sync_run r JOIN ll_selfop_sync_scope s ON s.id=r.scope_id AND s.scope_hash=r.scope_hash WHERE s.source_account=? AND s.warehouse_code=? AND s.data_family='INVENTORY' AND r.status='PUBLISHED' AND r.execution_purpose='BUSINESS' AND r.coverage_status='COMPLETE' AND r.source_total_count=r.unique_object_count AND r.page_count>0 AND r.fetch_started_at_utc<=r.fetch_finished_at_utc ORDER BY r.published_at_utc DESC,r.id DESC LIMIT 1 OFFSET ?",
+            (rs,n)->new StockRun(rs.getLong(1),rs.getString(2),rs.getTimestamp(3).toLocalDateTime().toInstant(ZoneOffset.UTC),rs.getTimestamp(4).toLocalDateTime().toInstant(ZoneOffset.UTC)),account,warehouse,offset);
+        return rows.isEmpty()?null:rows.get(0);
+    }
+    private record Frozen(InventoryHistoryVersions.Build build,List<InventoryHistoryVersions.Candidate> candidates,
+        long task,StockRun anchor,StockRun reference,LocalDate from,LocalDate until,List<Interval> coverage,List<Long> coverageRuns) {}
+    public void build(String account,String warehouse,int days) {
+        Frozen frozen=tx.execute(s->freeze(account,warehouse,Math.max(30,Math.min(60,days))));
+        if(frozen==null)return;
+        try {
+            long count=0;String owner="",sku="";
+            while(true) {
+                // Keyset paging bounds memory independently of the warehouse's SKU count.
+                var identities=candidates(frozen,owner,sku);
+                if(identities.isEmpty())break;
+                var dailyBatches=new HashMap<LocalDate,List<Daily>>();
+                for(var identity:identities) {
+                    var input=input(frozen,identity);var daily=reconstruct(input);
+                    String crosscheck=crosscheck(input.anchors(),referenceAnchors(frozen,identity),input.flows(),frozen.coverage());
+                    if(crosscheck!=null)daily=daily.stream().map(d->new Daily(d.date(),d.key(),null,"UNKNOWN",crosscheck,d.anchorRun())).toList();
+                    var evidence=flowEvidence(frozen,identity);
+                    String evidenceHash=hash(evidence);
+                    tx.executeWithoutResult(s->{
+                        requireBuilding(frozen);saveInput(frozen,identity,evidence,evidenceHash);
+                    });
+                    for(var d:daily)dailyBatches.computeIfAbsent(d.date(),k->new ArrayList<>()).add(d);
+                    owner=identity.owner();sku=identity.sku();count++;
+                }
+                for(var candidate:frozen.candidates()) {
+                    var rows=dailyBatches.getOrDefault(candidate.date(),List.of());
+                    for(int start=0;start<rows.size();start+=500)versions.append(candidate,rows.subList(start,Math.min(rows.size(),start+500)),hash(List.of(frozen.build().run(),candidate.date())));
+                }
+                heartbeat(frozen);
+            }
+            for(var c:frozen.candidates())versions.ready(c,count);
+            tx.executeWithoutResult(s->{
+                versions.lockWarehouse(account,warehouse);requireBuilding(frozen);
+                versions.publish(frozen.build(),frozen.candidates());
+                jdbc.update("UPDATE ll_selfop_sync_run SET status='FACTS_APPLIED',last_phase='HISTORY_PUBLISHED',published_at_utc=?,finished_at_utc=?,updated_at=? WHERE id=?",utcNow(),utcNow(),utcNow(),frozen.build().run());
+                jdbc.update("UPDATE ll_selfop_sync_task SET status='SUCCEEDED',result_published_run_id=?,updated_at=? WHERE id=?",frozen.build().run(),utcNow(),frozen.task());
+            });
+        }catch(RuntimeException failure) {
+            tx.executeWithoutResult(s->{
+                versions.lockWarehouse(account,warehouse);
+                jdbc.update("UPDATE ll_selfop_inventory_day_version SET status='FAILED' WHERE build_run_id=? AND status IN ('BUILDING','READY')",frozen.build().run());
+                jdbc.update("UPDATE ll_selfop_sync_run SET status='FAILED',error_code='HISTORY_BUILD_FAILED',error_message='输入变化或构建失败，保留候选证据等待下轮重新构建',finished_at_utc=?,updated_at=? WHERE id=? AND status='BUILDING'",utcNow(),utcNow(),frozen.build().run());
+                jdbc.update("UPDATE ll_selfop_sync_task SET status='DEAD',updated_at=? WHERE id=? AND status='RUNNING'",utcNow(),frozen.task());
+            });
+            throw failure;
+        }
+    }
+    private Frozen freeze(String account,String warehouse,int days) {
+        versions.lockWarehouse(account,warehouse);
+        var active=jdbc.queryForList("SELECT t.id,r.id run_id,r.heartbeat_at_utc FROM ll_selfop_sync_task t JOIN ll_selfop_sync_run r ON r.task_id=t.id WHERE t.source_account=? AND JSON_UNQUOTE(JSON_EXTRACT(t.query_scope_json,'$.warehouse'))=? AND t.task_type=? AND t.status='RUNNING' AND r.status='BUILDING' FOR UPDATE",account,warehouse,TYPE);
+        if(!active.isEmpty()) {
+            var row=active.get(0);var beat=row.get("heartbeat_at_utc");
+            if(beat!=null&&InventoryFlowFacts.instant(beat).isAfter(Instant.now().minusSeconds(300)))return null;
+            jdbc.update("UPDATE ll_selfop_inventory_day_version SET status='FAILED' WHERE build_run_id=? AND status IN ('BUILDING','READY')",row.get("run_id"));
+            jdbc.update("UPDATE ll_selfop_sync_run SET status='ABORTED',error_code='HISTORY_BUILD_INTERRUPTED',finished_at_utc=? WHERE id=?",utcNow(),row.get("run_id"));
+            jdbc.update("UPDATE ll_selfop_sync_task SET status='DEAD',updated_at=? WHERE id=?",utcNow(),row.get("id"));
+        }
+        // A quarantined identity cannot silently move to a different customer/SKU/quality.
+        if(jdbc.queryForObject("SELECT COUNT(*) FROM ll_selfop_inventory_flow WHERE source_account=? AND warehouse_code=? AND validation_reason='FLOW_IDENTITY_CONFLICT'",Long.class,account,warehouse)>0)return null;
+        var anchor=anchor(account,warehouse,0);var reference=anchor(account,warehouse,1);
+        if(anchor==null||reference==null)return null;
+        LocalDate until=anchor.from().atOffset(ZoneOffset.ofHours(8)).toLocalDate();
+        Instant retainedFrom=until.minusDays(366).atStartOfDay().toInstant(ZoneOffset.ofHours(8));
+        Instant coverageFrom=reference.from().isBefore(retainedFrom)?reference.from():retainedFrom;
+        var coverageRows=jdbc.queryForList("SELECT r.id,r.covered_from_utc,r.covered_until_utc FROM ll_selfop_sync_run r JOIN ll_selfop_sync_task t ON t.id=r.task_id WHERE t.source_account=? AND t.task_type=? AND r.status='FACTS_APPLIED' AND r.coverage_status='COMPLETE' AND JSON_UNQUOTE(JSON_EXTRACT(t.query_scope_json,'$.warehouse'))=? AND r.covered_until_utc>? ORDER BY r.covered_from_utc",account,InventoryFlowSlice.TYPE,warehouse,utc(coverageFrom));
+        var coverage=union(coverageRows.stream().map(r->new Interval(InventoryFlowFacts.instant(r.get("covered_from_utc")),InventoryFlowFacts.instant(r.get("covered_until_utc")))).toList());
+        var coverageRuns=coverageRows.stream().map(r->((Number)r.get("id")).longValue()).toList();
+        LocalDate from=until;
+        while(from.isAfter(until.minusDays(days))&&covered(coverage,from.minusDays(1).atStartOfDay().toInstant(ZoneOffset.ofHours(8)),anchor.until().plusNanos(1)))from=from.minusDays(1);
+        if(from.equals(until))return null;
+        var heads=versions.heads(account,warehouse,until.minusDays(366),until);
+        // Corrections rebuild every retained date, or remain invalid until its coverage returns.
+        if(!heads.isEmpty()&&heads.keySet().stream().min(LocalDate::compareTo).orElseThrow().isBefore(from)) {
+            LocalDate earliest=heads.keySet().iterator().next();
+            if(!covered(coverage,earliest.atStartOfDay().toInstant(ZoneOffset.ofHours(8)),anchor.until().plusNanos(1)))return null;
+            from=earliest;
+        }
+        if(jdbc.queryForObject("SELECT COUNT(*) FROM ll_selfop_sync_run r JOIN ll_selfop_sync_task t ON t.id=r.task_id WHERE t.source_account=? AND t.task_type=? AND r.status='VALIDATED' AND JSON_UNQUOTE(JSON_EXTRACT(t.query_scope_json,'$.warehouse'))=? AND t.query_until_utc>? AND t.query_from_utc<?",Long.class,account,InventoryFlowSlice.TYPE,warehouse,from.atStartOfDay().minusHours(8),utc(anchor.until()))>0)return null;
+        var sales=jdbc.queryForList("SELECT published_run_id FROM ll_selfop_sync_scope WHERE source_account=? AND warehouse_code=? AND data_family='OUTBOUND'",account,warehouse);
+        Long salesRun=sales.isEmpty()||sales.get(0).get("published_run_id")==null?null:((Number)sales.get(0).get("published_run_id")).longValue();
+        String inputHash=versions.factHash(account,warehouse);
+        String signature=hash(Arrays.asList(RULE,CALCULATION_REVISION,inputHash,anchor,reference,from,until,salesRun,coverage));
+        if(jdbc.queryForObject("SELECT COUNT(*) FROM ll_selfop_sync_task WHERE source_account=? AND task_type=? AND request_hash=? AND status='SUCCEEDED'",Long.class,account,TYPE,signature)>0)return null;
+        // Failed identical inputs get bounded attempts, instead of an infinite hot loop.
+        if(jdbc.queryForObject("SELECT COUNT(*) FROM ll_selfop_sync_task WHERE source_account=? AND task_type=? AND request_hash=?",Long.class,account,TYPE,signature)>=3)return null;
+        long taskId=IdWorker.getId(),runId=IdWorker.getId(),group=IdWorker.getId();var now=utcNow();
+        String evidence=json(Map.of("warehouse",warehouse,"anchor",anchor,"reference",reference,"coverageRuns",coverageRuns,"inputStagesRun",runId,"rule",RULE,"calculationRevision",CALCULATION_REVISION));
+        var task=new SelfopSyncTask();task.setId(taskId);task.setTaskNo("LXRESTORE-"+UUID.randomUUID().toString().replace("-",""));
+        task.setSourceAccount(account);task.setDiscoveryScopeId(jdbc.queryForObject("SELECT id FROM ll_selfop_outbound_discovery_scope WHERE source_account=?",Long.class,account));task.setExecutionPurpose("BUSINESS");
+        task.setTaskRole("ACCOUNT_DISCOVERY");task.setTaskType(TYPE);task.setRequestKey("history-build:"+UUID.randomUUID());task.setRequestHash(signature);
+        task.setScopeHash(anchor.scopeHash());task.setQueryScopeJson(evidence);task.setStatus("RUNNING");task.setApplyState("NOT_APPLICABLE");task.setAttemptCount(1);task.setCreatedAt(now);task.setUpdatedAt(now);tasks.insert(task);
+        var run=new SelfopSyncRun();run.setId(runId);run.setTaskId(taskId);run.setSourceAccount(account);
+        run.setExecutionPurpose("BUSINESS");run.setRunRole("ACCOUNT_DISCOVERY");run.setScopeHash(anchor.scopeHash());run.setScopeSnapshotJson(evidence);run.setFenceToken(0L);run.setAttemptNo(1);
+        run.setBasePublishedRunId(anchor.id());run.setReferenceSalesRunId(salesRun);run.setStatus("BUILDING");run.setLastPhase("BUILDING");run.setCoverageStatus("COMPLETE");run.setPageCount(0);run.setUniqueObjectCount(0L);
+        run.setHeartbeatAtUtc(now);run.setCreatedAt(now);run.setUpdatedAt(now);runs.insert(run);
+        var build=new InventoryHistoryVersions.Build(account,warehouse,anchor.scopeHash(),runId,group,anchor.id(),salesRun,inputHash,evidence,Map.copyOf(heads));
+        var candidates=new ArrayList<InventoryHistoryVersions.Candidate>();for(LocalDate day=from;day.isBefore(until);day=day.plusDays(1))candidates.add(versions.create(build,day));
+        jdbc.update("UPDATE ll_selfop_sync_run SET progress_snapshot_json=? WHERE id=?",json(Map.of("candidates",candidates,"expectedHeads",heads,"inputHash",inputHash)),runId);
+        return new Frozen(build,List.copyOf(candidates),taskId,anchor,reference,from,until,coverage,coverageRuns);
+    }
+    private List<Sku> candidates(Frozen f,String afterOwner,String afterSku) {
+        return jdbc.query("SELECT customer_code,sku_code FROM (SELECT customer_code,sku_code FROM ll_selfop_inventory_snapshot WHERE snapshot_run_id=? UNION SELECT customer_code,sku_code FROM ll_selfop_sku_daily_sales WHERE sales_run_id=? AND business_date>=? AND business_date<? UNION SELECT customer_code,sku_code FROM ll_selfop_inventory_flow WHERE source_account=? AND warehouse_code=? UNION SELECT d.customer_code,d.sku_code FROM ll_selfop_inventory_daily d JOIN ll_selfop_inventory_day_version v ON v.id=d.day_version_id WHERE v.source_account=? AND v.warehouse_code=? AND v.head_slot=1) c WHERE customer_code>? OR (customer_code=? AND sku_code>?) ORDER BY customer_code,sku_code LIMIT 100",
+            (rs,n)->new Sku(rs.getString(1),rs.getString(2)),f.anchor().id(),f.build().sales(),f.from(),f.until(),f.build().account(),f.build().warehouse(),f.build().account(),f.build().warehouse(),afterOwner,afterOwner,afterSku);
+    }
+    private List<Anchor> anchors(StockRun run,Sku sku) {
+        return jdbc.query("SELECT s.product_quality,s.physical_quantity,s.quality_status,s.quality_reason,p.quantity_unit FROM ll_selfop_inventory_snapshot s LEFT JOIN ll_selfop_sku_profile p ON p.profile_run_id=s.snapshot_run_id AND p.customer_code=s.customer_code AND p.sku_code=s.sku_code WHERE s.snapshot_run_id=? AND s.customer_code=? AND s.sku_code=?",
+            (rs,n)->new Anchor(new Key(sku,rs.getInt(1)),("VALID".equals(rs.getString(3))||Set.of("FIELD_MISSING","NEGATIVE_QUANTITY").contains(Objects.toString(rs.getString(4),"")))?rs.getBigDecimal(2):null,
+                rs.getString(5),run.from(),run.until(),run.id()),run.id(),sku.owner(),sku.sku());
+    }
+    private List<Anchor> referenceAnchors(Frozen f,Sku sku){return anchors(f.reference(),sku);}
+    private Input input(Frozen f,Sku sku) {
+        Instant dayStart=f.from().atStartOfDay().toInstant(ZoneOffset.ofHours(8));
+        Instant referenceStart=f.reference().from().truncatedTo(java.time.temporal.ChronoUnit.SECONDS);
+        Instant evidenceFrom=referenceStart.isBefore(dayStart)?referenceStart:dayStart;
+        var flows=jdbc.query("SELECT source_flow_id,product_quality,cell_no,inner_batch_no,bill_type,delta_quantity,book_qty,close_quantity,event_at_utc,validation_reason FROM ll_selfop_inventory_flow WHERE source_account=? AND warehouse_code=? AND customer_code=? AND sku_code=? AND (event_at_utc IS NULL OR (event_at_utc>=? AND event_at_utc<=?)) ORDER BY event_at_utc,source_flow_id",
+            (rs,n)->new Flow(rs.getString(1),new Key(sku,rs.getInt(2)),rs.getString(3),rs.getString(4),rs.getString(5),rs.getString(10)==null?rs.getBigDecimal(6):null,rs.getBigDecimal(7),rs.getBigDecimal(8),rs.getTimestamp(9)==null?null:rs.getTimestamp(9).toLocalDateTime().toInstant(ZoneOffset.UTC)),
+            f.build().account(),f.build().warehouse(),sku.owner(),sku.sku(),utc(evidenceFrom),utc(f.anchor().until()));
+        return new Input(f.from(),f.until(),Set.of(sku),flows,anchors(f.anchor(),sku),f.coverage());
+    }
+    private Object flowEvidence(Frozen f,Sku sku) {
+        return Map.of("sku",sku,"anchor",f.anchor(),"reference",f.reference(),"flowStages",jdbc.queryForList("SELECT source_flow_id,revision_no,stage_id,validation_reason FROM ll_selfop_inventory_flow WHERE source_account=? AND warehouse_code=? AND customer_code=? AND sku_code=? ORDER BY source_flow_id",f.build().account(),f.build().warehouse(),sku.owner(),sku.sku()));
+    }
+    static String crosscheck(List<Anchor> current,List<Anchor> prior,List<Flow> flows,List<Interval> coverage) {
+        if(current.isEmpty()||prior.isEmpty())return "INDEPENDENT_ANCHOR_MISSING";
+        if(!current.stream().map(Anchor::key).collect(java.util.stream.Collectors.toSet()).equals(prior.stream().map(Anchor::key).collect(java.util.stream.Collectors.toSet())))return "INDEPENDENT_ANCHOR_QUALITY_MISSING";
+        for(var a:current) {
+            var p=prior.stream().filter(v->v.key().equals(a.key())).findFirst().orElseThrow();
+            if(p.quantity()==null||a.quantity()==null||!"PCS".equals(p.unit())||!"PCS".equals(a.unit()))return "INDEPENDENT_ANCHOR_INVALID";
+            if(!p.observedUntil().isBefore(a.observedFrom())||!covered(coverage,p.observedFrom(),a.observedUntil().plusNanos(1)))return "INDEPENDENT_ANCHOR_COVERAGE_MISSING";
+            BigDecimal expected=p.quantity();
+            for(var flow:flows)if(flow.key().equals(a.key())) {
+                if(flow.at()==null||flow.delta()==null)return "INDEPENDENT_ANCHOR_FLOW_UNKNOWN";
+                if((!flow.at().isBefore(p.observedFrom().truncatedTo(java.time.temporal.ChronoUnit.SECONDS))&&!flow.at().isAfter(p.observedUntil()))
+                    ||(!flow.at().isBefore(a.observedFrom().truncatedTo(java.time.temporal.ChronoUnit.SECONDS))&&!flow.at().isAfter(a.observedUntil())))return "ANCHOR_TIME_AMBIGUOUS";
+                if(flow.at().isAfter(p.observedUntil())&&flow.at().isBefore(a.observedFrom()))expected=expected.add(flow.delta());
+            }
+            if(expected.compareTo(a.quantity())!=0)return "INDEPENDENT_ANCHOR_MISMATCH";
+        }
+        return null;
+    }
+    private void saveInput(Frozen f,Sku sku,Object evidence,String digest) {
+        var stage=new SelfopSyncStage();stage.setId(IdWorker.getId());stage.setRunId(f.build().run());stage.setStageBatchId(f.build().run());stage.setLastFetchRunId(f.build().run());stage.setWarehouseCode(f.build().warehouse());
+        stage.setObjectType("HISTORY_INPUT");stage.setObjectKeyHash(hash(sku));stage.setContentHash(digest);stage.setPayloadJson(json(evidence));stage.setFirstPageNo(1);stage.setValidationStatus("VALID");stage.setObservedAtUtc(utcNow());stage.setCreatedAt(utcNow());stage.setUpdatedAt(utcNow());stages.insert(stage);
+    }
+    private void requireBuilding(Frozen f){require("BUILDING".equals(jdbc.queryForObject("SELECT status FROM ll_selfop_sync_run WHERE id=? FOR UPDATE",String.class,f.build().run())),"HISTORY_BUILD_LOST");}
+    private void heartbeat(Frozen f){jdbc.update("UPDATE ll_selfop_sync_run SET heartbeat_at_utc=?,updated_at=? WHERE id=? AND status='BUILDING'",utcNow(),utcNow(),f.build().run());}
+    private static List<Interval> union(List<Interval> input) {
+        var result=new ArrayList<Interval>();
+        for(var next:input.stream().sorted(Comparator.comparing(Interval::from)).toList()) {
+            if(result.isEmpty()||result.get(result.size()-1).until().isBefore(next.from()))result.add(next);
+            else {var old=result.remove(result.size()-1);result.add(new Interval(old.from(),old.until().isAfter(next.until())?old.until():next.until()));}
+        }
+        return List.copyOf(result);
+    }
+    private static LocalDateTime utc(Instant instant){return LocalDateTime.ofInstant(instant,ZoneOffset.UTC);}
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/history/InventoryHistoryCalculator.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/history/InventoryHistoryCalculator.java
new file mode 100644
index 000000000..746d164fa
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/history/InventoryHistoryCalculator.java
@@ -0,0 +1,192 @@
+package com.baiyue.lastleg.selfoperated.analytics.history;
+
+import java.math.BigDecimal;
+import java.time.*;
+import java.util.*;
+
+/** Pure reconstruction over frozen, complete source intervals. Never invents absent stock. */
+public final class InventoryHistoryCalculator {
+    public static final String RULE = "FLOW_EOD_V1";
+    public static final int CALCULATION_REVISION = 2;
+    private static final Set<String> VERIFIED_TYPES = Set.of("DO", "PA", "IMO", "IAT", "RI");
+    private static final ZoneOffset BUSINESS = ZoneOffset.ofHours(8);
+    private InventoryHistoryCalculator() { }
+    public record Sku(String owner, String sku) { }
+    public record Key(Sku sku, int quality) { }
+    public record Interval(Instant from, Instant until) {
+        public Interval { if (from == null || until == null || !from.isBefore(until)) throw new IllegalArgumentException("INVALID_COVERAGE"); }
+    }
+    public record Flow(String id, Key key, String cell, String batch, String type,
+                       BigDecimal delta, BigDecimal bookQuantity, BigDecimal closing, Instant at) { }
+    public record Anchor(Key key, BigDecimal quantity, String unit, Instant observedFrom, Instant observedUntil, long runId) { }
+    public record Daily(LocalDate date, Key key, BigDecimal quantity, String status, String reason, long anchorRun) { }
+    public record Input(LocalDate from, LocalDate until, Set<Sku> candidates, List<Flow> flows,
+                        List<Anchor> anchors, List<Interval> coverage) { }
+
+    public static List<Daily> reconstruct(Input input) {
+        Objects.requireNonNull(input);
+        if (input.from()==null || input.until()==null || !input.from().isBefore(input.until())
+            || input.until().isAfter(input.from().plusDays(366))) throw new IllegalArgumentException("INVALID_HISTORY_WINDOW");
+        var byKey = new HashMap<Key,List<Flow>>();
+        var anchors = new HashMap<Key,Anchor>();
+        var reasons = new HashMap<Key,String>();
+        var ids = new HashMap<String,Flow>();
+        var keys = new HashSet<Key>();
+        for (Anchor a : input.anchors()) {
+            requireKey(a.key()); keys.add(a.key());
+            if (anchors.putIfAbsent(a.key(),a)!=null) reasons.put(a.key(),"ANCHOR_DUPLICATE");
+        }
+        for (Flow f : input.flows()) {
+            requireKey(f.key()); keys.add(f.key());
+            if (f.id()==null || f.id().isBlank() || f.id().length()>64) { reasons.put(f.key(),"FLOW_ID_INVALID"); continue; }
+            Flow old=ids.putIfAbsent(f.id(),f);
+            if (old!=null) {
+                if (!old.equals(f)) { reasons.put(old.key(),"FLOW_ID_CONFLICT"); reasons.put(f.key(),"FLOW_ID_CONFLICT"); }
+                continue;
+            }
+            byKey.computeIfAbsent(f.key(),k->new ArrayList<>()).add(f);
+        }
+        var observedSkus=new HashSet<Sku>();for(var key:keys)observedSkus.add(key.sku());
+        for (Sku sku : input.candidates()) if (!observedSkus.contains(sku)) keys.add(new Key(sku,0));
+        var result = new ArrayList<Daily>();
+        var ordered = keys.stream().sorted(Comparator.comparing((Key k)->k.sku().owner()).thenComparing(k->k.sku().sku()).thenComparingInt(Key::quality)).toList();
+        for (Key key : ordered) {
+            Anchor a=anchors.get(key);
+            List<Flow> rows=byKey.getOrDefault(key,List.of());
+            String failure=reasons.get(key);
+            if (failure==null) failure=validateAnchor(a);
+            if (failure==null && key.quality()!=0 && key.quality()!=1) failure="UNKNOWN_QUALITY";
+            if (failure==null) failure=validateRows(rows,a);
+            for (LocalDate day=input.from();day.isBefore(input.until());day=day.plusDays(1)) {
+                Instant boundary=day.plusDays(1).atStartOfDay().toInstant(BUSINESS);
+                String reason=failure;
+                if (reason==null && a.observedFrom().isBefore(boundary)) reason="ANCHOR_BEFORE_DAY_END";
+                if (reason==null && !covered(input.coverage(),boundary,a.observedUntil().plusNanos(1))) reason="FLOW_COVERAGE_GAP";
+                BigDecimal quantity=null;
+                if (reason==null) {
+                    quantity=a.quantity();
+                    for (Flow f:rows) if (!f.at().isBefore(boundary) && f.at().isBefore(a.observedFrom())) quantity=quantity.subtract(f.delta());
+                    if (quantity.signum()<0) { quantity=null; reason="NEGATIVE_RECONSTRUCTED_STOCK"; }
+                }
+                result.add(new Daily(day,key,quantity,reason==null?"VALID":"UNKNOWN",reason,a==null?0:a.runId()));
+            }
+        }
+        return List.copyOf(result);
+    }
+    private static String validateAnchor(Anchor a) {
+        if (a==null) return "ANCHOR_MISSING";
+        if (!"PCS".equals(a.unit())) return "UNIT_UNKNOWN";
+        if (!quantity(a.quantity()) || a.quantity().signum()<0) return "ANCHOR_QUANTITY_INVALID";
+        if (a.runId()<=0 || a.observedFrom()==null || a.observedUntil()==null || a.observedUntil().isBefore(a.observedFrom())) return "ANCHOR_INTERVAL_INVALID";
+        return null;
+    }
+    private static String validateRows(List<Flow> rows, Anchor anchor) {
+        var chains=new HashMap<List<String>,List<Flow>>();
+        for (Flow f:rows) {
+            if (f.at()==null || !quantity(f.delta()) || !quantity(f.bookQuantity()) || !quantity(f.closing())) return "FLOW_QUANTITY_OR_TIME_INVALID";
+            if (f.type()==null || !VERIFIED_TYPES.contains(f.type())) return "FLOW_TYPE_UNVERIFIED";
+            if (f.delta().compareTo(f.bookQuantity())!=0) return "FLOW_QUANTITY_CONFLICT";
+            if (f.closing().signum()<0 || f.closing().subtract(f.delta()).signum()<0) return "NEGATIVE_CHAIN_STOCK";
+            if (f.cell()==null || f.cell().isBlank() || f.batch()==null || f.batch().isBlank()) return "CHAIN_IDENTITY_MISSING";
+            // Source events have second resolution; an event in the anchor's first second is ambiguous.
+            if (!f.at().isBefore(anchor.observedFrom().truncatedTo(java.time.temporal.ChronoUnit.SECONDS))
+                && !f.at().isAfter(anchor.observedUntil())) return "ANCHOR_TIME_AMBIGUOUS";
+            chains.computeIfAbsent(List.of(f.cell(),f.batch()),k->new ArrayList<>()).add(f);
+        }
+        for (var chain:chains.values()) {
+            var seconds=new TreeMap<Instant,List<Flow>>();
+            for(Flow f:chain) seconds.computeIfAbsent(f.at(),k->new ArrayList<>()).add(f);
+            BigDecimal prior=null;
+            for(var group:seconds.values()) {
+                var resolved=resolveChain(group,prior);
+                if(resolved.reason()!=null) return resolved.reason();
+                prior=resolved.ending();
+            }
+        }
+        var deltas=new TreeMap<Instant,BigDecimal>(Comparator.reverseOrder());
+        for(var row:rows)if(row.at().isBefore(anchor.observedFrom()))deltas.merge(row.at(),row.delta(),BigDecimal::add);
+        BigDecimal balance=anchor.quantity();
+        for(var delta:deltas.values()) {
+            balance=balance.subtract(delta);
+            if(balance.signum()<0)return "NEGATIVE_RECONSTRUCTED_STOCK";
+        }
+        return null;
+    }
+    private record ChainResult(BigDecimal ending,String reason) { }
+    private static ChainResult resolveChain(List<Flow> group,BigDecimal prior) {
+        // Every flow is a distinct directed edge: opening balance -> closing balance.
+        // A valid order is an Euler trail, using every edge exactly once.
+        var degree=new TreeMap<BigDecimal,Integer>();
+        for(var f:group) {
+            degree.merge(f.closing().subtract(f.delta()),1,Integer::sum);
+            degree.merge(f.closing(),-1,Integer::sum);
+        }
+        BigDecimal start=null;int starts=0,ends=0;
+        for(var entry:degree.entrySet()) {
+            int difference=entry.getValue();
+            if(difference==1){start=entry.getKey();starts++;}
+            else if(difference==-1)ends++;
+            else if(difference!=0)return new ChainResult(null,"CHAIN_DISCONTINUITY");
+        }
+        if(!((starts==1&&ends==1)||(starts==0&&ends==0)))return new ChainResult(null,"CHAIN_DISCONTINUITY");
+        if(prior!=null) {
+            if(start!=null&&start.compareTo(prior)!=0)return new ChainResult(null,"CHAIN_DISCONTINUITY");
+            start=prior;
+        } else if(start==null)start=group.get(0).closing().subtract(group.get(0).delta());
+        var first=orderedTrail(group,start,false);
+        if(first==null)return new ChainResult(null,"CHAIN_DISCONTINUITY");
+        // Without a prior balance a circuit with multiple edges admits rotated orders.
+        if(prior==null&&starts==0&&group.size()>1)return new ChainResult(null,"CHAIN_ORDER_AMBIGUOUS");
+        // Hierholzer with opposite edge priorities yields the lexicographically first
+        // and last complete trails. Equality proves uniqueness, including parallel edges.
+        // Input indices only define opposing priorities; neither IDs nor response order
+        // are accepted as chronology. Two iterative passes avoid factorial search/recursion.
+        var last=orderedTrail(group,start,true);
+        if(!Arrays.equals(first,last))return new ChainResult(null,"CHAIN_ORDER_AMBIGUOUS");
+        return new ChainResult(group.get(first[first.length-1]).closing(),null);
+    }
+    private static int[] orderedTrail(List<Flow> group,BigDecimal start,boolean reverse) {
+        var outgoing=new TreeMap<BigDecimal,ArrayDeque<Integer>>();
+        for(int i=0;i<group.size();i++) {
+            var f=group.get(i);
+            outgoing.computeIfAbsent(f.closing().subtract(f.delta()),k->new ArrayDeque<>()).addLast(i);
+        }
+        var stack=new ArrayDeque<Integer>();
+        int[] trail=new int[group.size()];int position=trail.length;
+        BigDecimal balance=start;
+        while(true) {
+            var edges=outgoing.get(balance);
+            if(edges!=null&&!edges.isEmpty()) {
+                int edge=reverse?edges.removeLast():edges.removeFirst();
+                stack.push(edge);balance=group.get(edge).closing();
+            } else {
+                if(stack.isEmpty())break;
+                int edge=stack.pop();trail[--position]=edge;
+                var f=group.get(edge);balance=f.closing().subtract(f.delta());
+            }
+        }
+        if(position!=0)return null; // Disconnected edges cannot be silently discarded.
+        balance=start;
+        for(int edge:trail) {
+            var f=group.get(edge);
+            if(balance.add(f.delta()).compareTo(f.closing())!=0)return null;
+            balance=f.closing();
+        }
+        return trail;
+    }
+    public static boolean covered(List<Interval> intervals,Instant from,Instant until) {
+        Instant cursor=from;
+        for(Interval i:intervals.stream().sorted(Comparator.comparing(Interval::from)).toList()) {
+            if(i.until().isBefore(cursor)) continue;
+            if(i.from().isAfter(cursor)) return false;
+            if(i.until().isAfter(cursor)) cursor=i.until();
+            if(!cursor.isBefore(until)) return true;
+        }
+        return false;
+    }
+    private static boolean quantity(BigDecimal value) { return value!=null && value.scale()<=6 && value.precision()-value.scale()<=14; }
+    private static void requireKey(Key k) {
+        if(k==null || k.sku()==null || k.sku().owner()==null || k.sku().owner().isBlank() || k.sku().sku()==null || k.sku().sku().isBlank())
+            throw new IllegalArgumentException("HISTORY_IDENTITY_INVALID");
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/history/InventoryHistoryVersions.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/history/InventoryHistoryVersions.java
new file mode 100644
index 000000000..1ccfd6b3a
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/history/InventoryHistoryVersions.java
@@ -0,0 +1,100 @@
+package com.baiyue.lastleg.selfoperated.analytics.history;
+
+import com.baomidou.mybatisplus.core.toolkit.IdWorker;
+import com.baiyue.lastleg.selfoperated.analytics.model.SelfopSupport;
+import org.springframework.jdbc.core.JdbcTemplate;
+import org.springframework.stereotype.Repository;
+import org.springframework.transaction.support.TransactionTemplate;
+import java.sql.Timestamp;
+import java.time.*;
+import java.util.*;
+import static com.baiyue.lastleg.selfoperated.analytics.history.InventoryHistoryCalculator.*;
+
+/** Historical day heads have their own publication protocol, separate from raw stock runs. */
+@Repository
+public class InventoryHistoryVersions {
+    private final JdbcTemplate jdbc;
+    private final TransactionTemplate tx;
+    public InventoryHistoryVersions(JdbcTemplate jdbc,TransactionTemplate tx) { this.jdbc=jdbc;this.tx=tx; }
+    public record Build(String account,String warehouse,String scopeHash,long run,long group,long anchor,
+                        Long sales,String inputHash,String evidence,Map<LocalDate,Long> expectedHeads) {
+        public Build { expectedHeads=Map.copyOf(expectedHeads); }
+    }
+    public record Candidate(long id,LocalDate date) { }
+    public void lockWarehouse(String account,String warehouse) {
+        var rows=jdbc.queryForList("SELECT id FROM ll_selfop_sync_scope WHERE source_account=? AND warehouse_code=? AND data_family='INVENTORY' FOR UPDATE",account,warehouse);
+        if(rows.size()!=1) throw new IllegalStateException("HISTORY_SCOPE_MISSING");
+    }
+    /** Monotone revisions and no deletion make this fingerprint stable under the warehouse lock. */
+    public String factHash(String account,String warehouse) {
+        return SelfopSupport.hash(jdbc.queryForMap("SELECT COUNT(*) n,COALESCE(SUM(revision_no),0) revisions,COALESCE(MAX(id),0) newest FROM ll_selfop_inventory_flow WHERE source_account=? AND warehouse_code=?",account,warehouse));
+    }
+    public Map<LocalDate,Long> heads(String account,String warehouse,LocalDate from,LocalDate until) {
+        var result=new TreeMap<LocalDate,Long>();
+        jdbc.query("SELECT business_date,id FROM ll_selfop_inventory_day_version WHERE source_account=? AND warehouse_code=? AND head_slot=1 AND business_date>=? AND business_date<? ORDER BY business_date",
+            rs->{result.put(rs.getDate(1).toLocalDate(),rs.getLong(2));},account,warehouse,from,until);
+        return result;
+    }
+    public Candidate create(Build build,LocalDate date) {
+        long id=IdWorker.getId();
+        jdbc.update("INSERT INTO ll_selfop_inventory_day_version (id,source_account,warehouse_code,business_date,scope_hash,rule_version,build_run_id,publication_group_id,sales_run_id,anchor_run_id,input_hash,evidence_json,status,created_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,'BUILDING',?)",
+            id,build.account(),build.warehouse(),date,build.scopeHash(),RULE,build.run(),build.group(),build.sales(),build.anchor(),build.inputHash(),build.evidence(),now());
+        return new Candidate(id,date);
+    }
+    /** Bounded insert transaction; a failed batch never changes visible day heads. */
+    public void append(Candidate candidate,List<Daily> rows,String evidenceHash) {
+        if(rows.size()>500 || rows.stream().anyMatch(r->!candidate.date().equals(r.date()))) throw new IllegalArgumentException("HISTORY_BATCH_INVALID");
+        tx.executeWithoutResult(status->{
+            String state=jdbc.queryForObject("SELECT status FROM ll_selfop_inventory_day_version WHERE id=? FOR UPDATE",String.class,candidate.id());
+            if(!"BUILDING".equals(state)) throw new IllegalStateException("HISTORY_CANDIDATE_IMMUTABLE");
+            jdbc.batchUpdate("INSERT INTO ll_selfop_inventory_daily (day_version_id,customer_code,sku_code,product_quality,physical_quantity,quality_status,quality_reason,anchor_reference,evidence_hash,source) VALUES (?,?,?,?,?,?,?,?,?,'FLOW_RECONSTRUCTED')",
+                rows,500,(p,r)->{p.setLong(1,candidate.id());p.setString(2,r.key().sku().owner());p.setString(3,r.key().sku().sku());p.setInt(4,r.key().quality());
+                    p.setBigDecimal(5,r.quantity());p.setString(6,r.status());p.setString(7,r.reason());
+                    if(r.anchorRun()==0)p.setNull(8,java.sql.Types.BIGINT);else p.setLong(8,r.anchorRun());p.setString(9,evidenceHash);});
+        });
+    }
+    public void ready(Candidate candidate,long expectedSkuCount) {
+        tx.executeWithoutResult(s->{
+            String state=jdbc.queryForObject("SELECT status FROM ll_selfop_inventory_day_version WHERE id=? FOR UPDATE",String.class,candidate.id());
+            if(!"BUILDING".equals(state)) throw new IllegalStateException("HISTORY_CANDIDATE_IMMUTABLE");
+            var totals=jdbc.queryForMap("SELECT COUNT(*) total,COALESCE(SUM(valid),0) valid FROM (SELECT customer_code,sku_code,MIN(CASE WHEN quality_status='VALID' THEN 1 ELSE 0 END) valid FROM ll_selfop_inventory_daily WHERE day_version_id=? GROUP BY customer_code,sku_code) x",candidate.id());
+            long count=((Number)totals.get("total")).longValue(),valid=((Number)totals.get("valid")).longValue();
+            if(count!=expectedSkuCount) throw new IllegalStateException("HISTORY_CANDIDATE_INCOMPLETE");
+            jdbc.update("UPDATE ll_selfop_inventory_day_version SET status='READY',valid_sku_count=?,unknown_sku_count=? WHERE id=?",valid,count-valid,candidate.id());
+        });
+    }
+    /** Must be called in the same warehouse-locked transaction that accepts a source revision. */
+    public void invalidate(String account,String warehouse,long run,String reason) {
+        jdbc.update("UPDATE ll_selfop_inventory_day_version SET invalidated_at=COALESCE(invalidated_at,?),invalidation_reason=COALESCE(invalidation_reason,?),rebuild_run_id=? WHERE source_account=? AND warehouse_code=? AND status IN ('PUBLISHED','SUPERSEDED')",
+            now(),reason,run,account,warehouse);
+    }
+    public void publish(Build build,List<Candidate> candidates) {
+        if(candidates.isEmpty() || candidates.size()>366 || candidates.stream().map(Candidate::date).distinct().count()!=candidates.size()) throw new IllegalArgumentException("HISTORY_GROUP_INVALID");
+        tx.executeWithoutResult(s->{
+            lockWarehouse(build.account(),build.warehouse());
+            var stored=jdbc.queryForList("SELECT id,business_date,status FROM ll_selfop_inventory_day_version WHERE publication_group_id=? AND build_run_id=? AND source_account=? AND warehouse_code=? ORDER BY business_date FOR UPDATE",build.group(),build.run(),build.account(),build.warehouse());
+            var expected=candidates.stream().map(Candidate::id).collect(java.util.stream.Collectors.toSet());
+            if(stored.size()!=candidates.size() || stored.stream().anyMatch(r->!expected.contains(((Number)r.get("id")).longValue()))) throw new IllegalStateException("HISTORY_GROUP_INCOMPLETE");
+            for(var row:stored) {
+                var candidate=candidates.stream().filter(c->c.id()==((Number)row.get("id")).longValue()).findFirst().orElseThrow();
+                if(!candidate.date().toString().equals(row.get("business_date").toString()))throw new IllegalStateException("HISTORY_GROUP_DATE_MISMATCH");
+            }
+            if(stored.stream().allMatch(r->"PUBLISHED".equals(r.get("status")))) return;
+            if(!build.scopeHash().equals(jdbc.queryForObject("SELECT scope_hash FROM ll_selfop_sync_scope WHERE source_account=? AND warehouse_code=? AND data_family='INVENTORY'",String.class,build.account(),build.warehouse())))throw new IllegalStateException("HISTORY_SCOPE_CHANGED");
+            if(!build.inputHash().equals(factHash(build.account(),build.warehouse()))) throw new IllegalStateException("HISTORY_INPUT_CHANGED");
+            if(stored.stream().anyMatch(r->!"READY".equals(r.get("status")))) throw new IllegalStateException("HISTORY_GROUP_NOT_READY");
+            for(var c:candidates) {
+                var heads=jdbc.queryForList("SELECT id FROM ll_selfop_inventory_day_version WHERE source_account=? AND warehouse_code=? AND business_date=? AND head_slot=1",Long.class,build.account(),build.warehouse(),c.date());
+                Long old=heads.isEmpty()?null:heads.get(0);
+                if(!Objects.equals(old,build.expectedHeads().get(c.date()))) throw new IllegalStateException("HISTORY_HEAD_CHANGED");
+            }
+            var at=now();
+            for(var c:candidates) {
+                jdbc.update("UPDATE ll_selfop_inventory_day_version SET status='SUPERSEDED',head_slot=NULL,superseded_at=? WHERE source_account=? AND warehouse_code=? AND business_date=? AND head_slot=1",at,build.account(),build.warehouse(),c.date());
+                int updated=jdbc.update("UPDATE ll_selfop_inventory_day_version SET status='PUBLISHED',head_slot=1,published_at=? WHERE id=? AND status='READY' AND invalidated_at IS NULL AND input_hash=?",at,c.id(),build.inputHash());
+                if(updated!=1) throw new IllegalStateException("HISTORY_CANDIDATE_CHANGED");
+            }
+        });
+    }
+    private static LocalDateTime now() { return LocalDateTime.now(ZoneOffset.UTC); }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/history/InventoryHistoryWorker.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/history/InventoryHistoryWorker.java
new file mode 100644
index 000000000..a7e184c2d
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/history/InventoryHistoryWorker.java
@@ -0,0 +1,56 @@
+package com.baiyue.lastleg.selfoperated.analytics.history;
+
+import com.baiyue.lastleg.selfoperated.analytics.model.*;
+import jakarta.annotation.PostConstruct;
+import jakarta.annotation.PreDestroy;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.jdbc.core.JdbcTemplate;
+import org.springframework.stereotype.Component;
+import java.time.*;
+import java.time.temporal.TemporalAdjusters;
+import java.util.concurrent.*;
+
+/** Two bounded lanes: provider pages never wait behind local reconstruction or the sales scheduler. */
+@Component
+public class InventoryHistoryWorker {
+    private static final Logger LOG=LoggerFactory.getLogger(InventoryHistoryWorker.class);
+    private final SelfopAnalyticsProperties config;private final InventoryFlowCollector collector;
+    private final InventoryFlowFacts facts;private final InventoryHistoryBuilder builder;private final JdbcTemplate jdbc;
+    private final ScheduledExecutorService http=Executors.newSingleThreadScheduledExecutor(r->{var t=new Thread(r,"selfop-history-pages");t.setDaemon(true);return t;});
+    private final ScheduledExecutorService local=Executors.newSingleThreadScheduledExecutor(r->{var t=new Thread(r,"selfop-history-local");t.setDaemon(true);return t;});
+    private Instant nextPlan=Instant.EPOCH;
+    private Instant nextBuild=Instant.EPOCH;
+    public InventoryHistoryWorker(SelfopAnalyticsProperties config,InventoryFlowCollector collector,InventoryFlowFacts facts,InventoryHistoryBuilder builder,JdbcTemplate jdbc){this.config=config;this.collector=collector;this.facts=facts;this.builder=builder;this.jdbc=jdbc;}
+    boolean enabled(){return config.isInventoryHistoryEnabled()&&SelfopCollectionPolicy.continuousBusiness(config)&&"PCS".equals(config.getQuantityUnit())&&"Asia/Shanghai".equals(config.getSourceQueryTimezone());}
+    @PostConstruct public void start(){http.scheduleWithFixedDelay(()->guard(this::page),10,1,TimeUnit.SECONDS);local.scheduleWithFixedDelay(()->guard(this::local),12000,100,TimeUnit.MILLISECONDS);}
+    @PreDestroy public void close(){http.shutdownNow();local.shutdownNow();}
+    private void guard(Runnable action){if(!enabled())return;try{action.run();}catch(RuntimeException e){LOG.warn("Historical inventory worker deferred ({})",e.getClass().getSimpleName());}}
+    void page(){
+        if(Instant.now().isAfter(nextPlan)){plan();nextPlan=Instant.now().plusSeconds(60);}
+        collector.page();
+    }
+    void local(){
+        facts.mergeNext(config.getSourceAccount());
+        if(Instant.now().isBefore(nextBuild))return;
+        nextBuild=Instant.now().plusSeconds(5);
+        for(String warehouse:config.getWarehouses().keySet())if(enabled())builder.build(config.getSourceAccount(),warehouse,config.getInventoryHistoryDays());
+    }
+    void plan(){
+        var now=LocalDateTime.now(ZoneOffset.ofHours(8));if(now.toLocalTime().isBefore(LocalTime.of(0,5)))return;
+        var ids=jdbc.queryForList("SELECT id FROM ll_selfop_outbound_discovery_scope WHERE source_account=?",Long.class,config.getSourceAccount());if(ids.size()!=1)return;
+        LocalDate today=now.toLocalDate();
+        for(String warehouse:config.getWarehouses().keySet()) {
+            var anchor=builder.anchor(config.getSourceAccount(),warehouse,0);if(anchor==null)continue;
+            long published=jdbc.queryForObject("SELECT COUNT(*) FROM ll_selfop_inventory_day_version WHERE source_account=? AND warehouse_code=? AND head_slot=1 AND business_date>=? AND business_date<?",Long.class,config.getSourceAccount(),warehouse,today.minusDays(30),today);
+            int days=published<30?30:Math.max(30,Math.min(60,config.getInventoryHistoryDays()));
+            for(int age=1;age<=days;age++) {
+                LocalDate day=today.minusDays(age);
+                LocalDate round=age<=3?today:age<=30?today.with(TemporalAdjusters.previousOrSame(DayOfWeek.MONDAY)):LocalDate.of(2000,1,1);
+                collector.plan(ids.get(0),new InventoryFlowSlice(warehouse,day.atStartOfDay(),day.plusDays(1).atStartOfDay(),1000),round);
+            }
+            var end=LocalDateTime.ofInstant(anchor.until(),ZoneOffset.ofHours(8)).withNano(0).plusSeconds(1);
+            if(end.toLocalDate().equals(today)&&end.isAfter(today.atStartOfDay()))collector.plan(ids.get(0),new InventoryFlowSlice(warehouse,today.atStartOfDay(),end,1000),today);
+        }
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/inventory/InventorySnapshotAssembler.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/inventory/InventorySnapshotAssembler.java
new file mode 100644
index 000000000..a59997a1e
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/inventory/InventorySnapshotAssembler.java
@@ -0,0 +1,140 @@
+package com.baiyue.lastleg.selfoperated.analytics.inventory;
+
+import com.baiyue.lastleg.selfoperated.analytics.model.*;
+import com.baomidou.mybatisplus.core.toolkit.IdWorker;
+import java.math.BigDecimal;
+import java.time.LocalDateTime;
+import java.util.*;
+import static com.baiyue.lastleg.selfoperated.analytics.model.SelfopSupport.*;
+
+/** Builds one immutable inventory observation, using only fixed published reference versions. */
+public final class InventorySnapshotAssembler {
+    private InventorySnapshotAssembler() { }
+    public record Candidate(List<SelfopInventorySnapshot> snapshots, List<SelfopSkuProfile> profiles) { }
+    private record StockKey(String customer, String sku, Integer quality) { }
+    private record SkuKey(String customer, String sku) { }
+
+    public static Candidate assemble(SelfopSyncScope scope, SelfopSyncRun run,
+            List<SelfopSyncStage> stages, List<SelfopInventorySnapshot> priorStock,
+            List<SelfopSkuProfile> priorProfiles, List<SelfopSkuProfile> salesProfiles, String unit) {
+        require("COMPLETE".equals(run.getCoverageStatus()), "SELFOP_INVENTORY_INCOMPLETE");
+        require(run.getFetchStartedAtUtc() != null && run.getFetchFinishedAtUtc() != null
+            && !run.getFetchFinishedAtUtc().isBefore(run.getFetchStartedAtUtc()), "SELFOP_INVENTORY_INTERVAL_INVALID");
+        require(run.getPageCount() != null && run.getPageCount() > 0
+            && run.getSourceTotalCount() != null && run.getSourceTotalCount() >= 0
+            && Objects.equals(run.getSourceTotalCount(), run.getUniqueObjectCount())
+            && run.getSourceTotalCount() == stages.size(), "SELFOP_INVENTORY_COUNT_MISMATCH");
+        var now = utcNow();
+        Map<StockKey, SelfopInventorySnapshot> stocks = new LinkedHashMap<>();
+        Map<SkuKey, SelfopSkuProfile> profiles = new LinkedHashMap<>();
+        Set<String> hashes = new HashSet<>();
+        Set<Integer> observedPages = new HashSet<>();
+        for (var stage : stages) {
+            require(Objects.equals(stage.getRunId(), run.getId()) && Objects.equals(stage.getStageBatchId(), run.getId())
+                && Objects.equals(stage.getLastFetchRunId(), run.getId()), "SELFOP_INVENTORY_ATTEMPT_MIXED");
+            require("PRODUCT_STOCK".equals(stage.getObjectType()) && "VALID".equals(stage.getValidationStatus())
+                && Objects.equals(stage.getWarehouseCode(), scope.getWarehouseCode()), "SELFOP_INVENTORY_STAGE_INVALID");
+            require(stage.getFirstPageNo() != null && stage.getFirstPageNo() >= 1
+                && stage.getFirstPageNo() <= run.getPageCount() && stage.getObservedAtUtc() != null,
+                "SELFOP_INVENTORY_PAGE_INVALID");
+            require(hashes.add(stage.getObjectKeyHash()), "SELFOP_INVENTORY_DUPLICATE_KEY");
+            observedPages.add(stage.getFirstPageNo());
+            var value = read(stage.getPayloadJson(), SelfopPayloads.Stock.class);
+            verifyIdentity(scope, value.sourceAccount(), value.warehouseCode(), value.customerCode(), value.skuCode());
+            require(value.productQuality() != null && value.productQuality() >= Short.MIN_VALUE
+                && value.productQuality() <= Short.MAX_VALUE, "SELFOP_INVENTORY_QUALITY_INVALID");
+            require(value.productName() == null || value.productName().length() <= 255, "SELFOP_INVENTORY_NAME_INVALID");
+            require(value.sourceUniqueKey() == null || value.sourceUniqueKey().length() <= 512, "SELFOP_INVENTORY_SOURCE_KEY_INVALID");
+            require(Objects.equals(SelfopStockFingerprint.of(value), stage.getContentHash()), "SELFOP_INVENTORY_CONTENT_CHANGED");
+            var key = new StockKey(value.customerCode(), value.skuCode(), value.productQuality());
+            require(!stocks.containsKey(key), "SELFOP_INVENTORY_DUPLICATE_KEY");
+            var row = snapshot(scope, run, key, now);
+            row.setProductName(value.productName()); row.setSourceUniqueKey(value.sourceUniqueKey());
+            row.setPhysicalQuantity(value.physicalQuantity()); row.setAvailableQuantity(value.availableQuantity());
+            row.setFrozenQuantity(value.frozenQuantity()); row.setTransitQuantity(value.transitQuantity());
+            row.setObservedAtUtc(stage.getObservedAtUtc());
+            var quality = quality(value);
+            row.setQualityStatus(quality[0]); row.setQualityReason(quality[1]);
+            if ("QUANTITY_PRECISION".equals(quality[1])) {
+                // The exact offending decimals remain in immutable stage evidence; never let DECIMAL silently round them.
+                row.setPhysicalQuantity(null); row.setAvailableQuantity(null); row.setFrozenQuantity(null); row.setTransitQuantity(null);
+            }
+            stocks.put(key, row);
+            var skuKey = new SkuKey(key.customer(), key.sku());
+            var profile = profiles.computeIfAbsent(skuKey, ignored -> profile(scope, run, skuKey, now));
+            profile.setProductName(profile.getProductName() == null ? value.productName() : profile.getProductName());
+            profile.setQuantityUnit(unit);
+            profile.setFirstSeenAtUtc(earlier(profile.getFirstSeenAtUtc(), stage.getObservedAtUtc()));
+            profile.setEarliestEvidenceAtUtc(profile.getFirstSeenAtUtc());
+            profile.setEvidenceType("INVENTORY_OBSERVATION"); profile.setEvidenceRunId(run.getId());
+            profile.setLastSeenRunId(run.getId());
+        }
+        require(stages.isEmpty() ? run.getPageCount() == 1 : observedPages.size() == run.getPageCount(),
+            "SELFOP_INVENTORY_PAGE_MISSING");
+        for (var old : priorStock) {
+            verifyIdentity(scope, old.getSourceAccount(), old.getWarehouseCode(), old.getCustomerCode(), old.getSkuCode());
+            require(Objects.equals(old.getSnapshotRunId(), run.getBasePublishedRunId()), "SELFOP_INVENTORY_BASE_INVALID");
+            var key = new StockKey(old.getCustomerCode(), old.getSkuCode(), old.getProductQuality());
+            stocks.computeIfAbsent(key, ignored -> missing(scope, run, key, old.getProductName(), now));
+            profiles.computeIfAbsent(new SkuKey(key.customer(), key.sku()), ignored -> profile(scope, run, ignored, now));
+        }
+        for (var old : priorProfiles) {
+            verifyIdentity(scope, old.getSourceAccount(), old.getWarehouseCode(), old.getCustomerCode(), old.getSkuCode());
+            require(Objects.equals(old.getProfileRunId(), run.getBasePublishedRunId()), "SELFOP_INVENTORY_PROFILE_BASE_INVALID");
+            var key = new SkuKey(old.getCustomerCode(), old.getSkuCode());
+            var current = profiles.computeIfAbsent(key, ignored -> profile(scope, run, key, now));
+            if (current.getProductName() == null) current.setProductName(old.getProductName());
+            if ("INVENTORY_OBSERVATION".equals(old.getEvidenceType()) && old.getFirstSeenAtUtc() != null) {
+                boolean observedNow = current.getLastSeenRunId() != null;
+                current.setFirstSeenAtUtc(earlier(current.getFirstSeenAtUtc(), old.getFirstSeenAtUtc()));
+                current.setEarliestEvidenceAtUtc(current.getFirstSeenAtUtc());
+                current.setEvidenceType("INVENTORY_OBSERVATION");
+                current.setEvidenceRunId(old.getEvidenceRunId());
+                if (!observedNow) { current.setLastSeenRunId(old.getLastSeenRunId()); current.setQuantityUnit(old.getQuantityUnit()); }
+            }
+        }
+        for (var sales : salesProfiles) {
+            verifyIdentity(scope, sales.getSourceAccount(), sales.getWarehouseCode(), sales.getCustomerCode(), sales.getSkuCode());
+            require(Objects.equals(sales.getProfileRunId(), run.getReferenceSalesRunId()), "SELFOP_INVENTORY_SALES_REFERENCE_INVALID");
+            var key = new StockKey(sales.getCustomerCode(), sales.getSkuCode(), 0);
+            stocks.computeIfAbsent(key, ignored -> missing(scope, run, key, sales.getProductName(), now));
+            var skuKey = new SkuKey(key.customer(), key.sku());
+            var current = profiles.computeIfAbsent(skuKey, ignored -> profile(scope, run, skuKey, now));
+            if (current.getProductName() == null) current.setProductName(sales.getProductName());
+            // Sales identifies a candidate; it cannot prove that inventory ever observed it.
+        }
+        return new Candidate(List.copyOf(stocks.values()), List.copyOf(profiles.values()));
+    }
+
+    private static String[] quality(SelfopPayloads.Stock stock) {
+        var quantities = new BigDecimal[]{ stock.physicalQuantity(), stock.availableQuantity(), stock.frozenQuantity(), stock.transitQuantity() };
+        boolean missing = false;
+        for (var quantity : quantities) {
+            if (quantity == null) { missing = true; continue; }
+            if (quantity.scale() > 6 && quantity.stripTrailingZeros().scale() > 6
+                || quantity.precision() - quantity.scale() > 14) return new String[]{"INVALID", "QUANTITY_PRECISION"};
+            if (quantity.signum() < 0) return new String[]{"INVALID", "NEGATIVE_QUANTITY"};
+        }
+        return missing ? new String[]{"UNKNOWN", "FIELD_MISSING"} : new String[]{"VALID", null};
+    }
+    private static void verifyIdentity(SelfopSyncScope scope, String account, String warehouse, String customer, String sku) {
+        identity(customer, 64); identity(sku, 128);
+        require(Objects.equals(scope.getSourceAccount(), account) && Objects.equals(scope.getWarehouseCode(), warehouse),
+            "SELFOP_INVENTORY_SCOPE_LEAK");
+    }
+    private static SelfopInventorySnapshot snapshot(SelfopSyncScope scope, SelfopSyncRun run, StockKey key, LocalDateTime now) {
+        var row = new SelfopInventorySnapshot(); row.setId(IdWorker.getId()); row.setCreatedAt(now); row.setUpdatedAt(now);
+        row.setSnapshotRunId(run.getId()); row.setSourceAccount(scope.getSourceAccount()); row.setWarehouseCode(scope.getWarehouseCode());
+        row.setCustomerCode(key.customer()); row.setSkuCode(key.sku()); row.setProductQuality(key.quality()); return row;
+    }
+    private static SelfopInventorySnapshot missing(SelfopSyncScope scope, SelfopSyncRun run, StockKey key, String name, LocalDateTime now) {
+        var row = snapshot(scope, run, key, now); row.setProductName(name); row.setObservedAtUtc(run.getFetchFinishedAtUtc());
+        row.setQualityStatus("UNKNOWN"); row.setQualityReason("SOURCE_ROW_MISSING"); return row;
+    }
+    private static SelfopSkuProfile profile(SelfopSyncScope scope, SelfopSyncRun run, SkuKey key, LocalDateTime now) {
+        var row = new SelfopSkuProfile(); row.setId(IdWorker.getId()); row.setCreatedAt(now); row.setUpdatedAt(now);
+        row.setProfileRunId(run.getId()); row.setSourceAccount(scope.getSourceAccount()); row.setWarehouseCode(scope.getWarehouseCode());
+        row.setCustomerCode(key.customer()); row.setSkuCode(key.sku()); row.setEvidenceType("NONE"); return row;
+    }
+    private static LocalDateTime earlier(LocalDateTime a, LocalDateTime b) { return a == null || b != null && b.isBefore(a) ? b : a; }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/inventory/InventorySnapshotService.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/inventory/InventorySnapshotService.java
new file mode 100644
index 000000000..7b8482e0d
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/inventory/InventorySnapshotService.java
@@ -0,0 +1,179 @@
+package com.baiyue.lastleg.selfoperated.analytics.inventory;
+
+import com.baiyue.lastleg.selfoperated.analytics.mapper.*;
+import com.baiyue.lastleg.selfoperated.analytics.model.*;
+import com.baomidou.mybatisplus.core.conditions.query.QueryWrapper;
+import java.time.LocalDate;
+import java.time.ZoneId;
+import java.time.ZoneOffset;
+import java.util.*;
+import lombok.RequiredArgsConstructor;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Transactional;
+import static com.baiyue.lastleg.selfoperated.analytics.model.SelfopSupport.*;
+
+@Service
+@RequiredArgsConstructor
+public class InventorySnapshotService {
+    static final String DAILY_SAMPLE_RULE = "DAILY_SCHEDULED_FIRST_V1";
+    private static final ZoneId SAMPLE_ZONE = ZoneId.of("Asia/Shanghai");
+    private final SelfopCoordinationMapper coordination;
+    private final SelfopSyncScopeMapper scopes;
+    private final SelfopSyncRunMapper runs;
+    private final SelfopSyncTaskMapper tasks;
+    private final SelfopSyncStageMapper stages;
+    private final SelfopInventorySnapshotMapper snapshots;
+    private final SelfopSkuProfileMapper profiles;
+    private final SelfopAnalyticsProperties properties;
+
+    /** Whole candidate commits atomically. No source HTTP request occurs in this transaction. */
+    @Transactional(rollbackFor = Exception.class)
+    public void build(long scopeId, long runId, String owner, long fence) {
+        var scope = coordination.lockScope(scopeId);
+        var run = coordination.lockRun(runId);
+        validate(scope, run, owner, fence);
+        if ("READY".equals(run.getStatus()) || "PUBLISHED".equals(run.getStatus())) return;
+        require("VALIDATED".equals(run.getStatus()), "SELFOP_INVENTORY_NOT_VALIDATED");
+        require(Objects.equals(scope.getPublishedRunId(), run.getBasePublishedRunId()), "SELFOP_INVENTORY_BASE_CHANGED");
+        var priorStock = List.<SelfopInventorySnapshot>of();
+        var priorProfiles = List.<SelfopSkuProfile>of();
+        if (run.getBasePublishedRunId() != null) {
+            reference(scope, run.getBasePublishedRunId(), "INVENTORY");
+            priorStock = snapshots.selectList(new QueryWrapper<SelfopInventorySnapshot>().eq("snapshot_run_id", run.getBasePublishedRunId()));
+            priorProfiles = profiles.selectList(new QueryWrapper<SelfopSkuProfile>().eq("profile_run_id", run.getBasePublishedRunId()));
+        }
+        var salesProfiles = List.<SelfopSkuProfile>of();
+        if (run.getReferenceSalesRunId() != null) {
+            reference(scope, run.getReferenceSalesRunId(), "OUTBOUND");
+            salesProfiles = profiles.selectList(new QueryWrapper<SelfopSkuProfile>().eq("profile_run_id", run.getReferenceSalesRunId()));
+        }
+        var candidate = InventorySnapshotAssembler.assemble(scope, run,
+            stages.selectList(new QueryWrapper<SelfopSyncStage>().eq("stage_batch_id", runId).eq("object_type", "PRODUCT_STOCK").orderByAsc("id")),
+            priorStock, priorProfiles, salesProfiles, fixedUnit(run));
+        require(snapshots.selectCount(new QueryWrapper<SelfopInventorySnapshot>().eq("snapshot_run_id", runId)) == 0
+            && profiles.selectCount(new QueryWrapper<SelfopSkuProfile>().eq("profile_run_id", runId)) == 0,
+            "SELFOP_INVENTORY_CANDIDATE_EXISTS");
+        run.setBuildStartedAtUtc(utcNow());run.setLastPhase("BUILDING");
+        for (var row : candidate.snapshots()) row.setId(com.baomidou.mybatisplus.core.toolkit.IdWorker.getId());
+        for (var row : candidate.profiles()) row.setId(com.baomidou.mybatisplus.core.toolkit.IdWorker.getId());
+        if(!candidate.snapshots().isEmpty())snapshots.insert(candidate.snapshots(),Math.max(1,Math.min(500,properties.getPersistenceBatchSize())));
+        if(!candidate.profiles().isEmpty())profiles.insert(candidate.profiles(),Math.max(1,Math.min(500,properties.getPersistenceBatchSize())));
+        run.setStatus("READY"); run.setUpdatedAt(utcNow()); runs.updateById(run);
+    }
+
+    /** Inventory publication deliberately has no outbound apply-state/revision barrier. */
+    @Transactional(rollbackFor = Exception.class)
+    public void publish(long scopeId, long runId, String owner, long fence) {
+        var scope = coordination.lockScope(scopeId);
+        var run = coordination.lockRun(runId);
+        validate(scope, run, owner, fence);
+        if ("PUBLISHED".equals(run.getStatus())) {
+            verifyPublishedResult(run);
+            return;
+        }
+        require(fixedUnit(run) != null, "SELFOP_QUANTITY_UNIT_UNCONFIRMED");
+        require("READY".equals(run.getStatus()) && "COMPLETE".equals(run.getCoverageStatus()), "SELFOP_INVENTORY_NOT_READY");
+        require(Objects.equals(scope.getPublishedRunId(), run.getBasePublishedRunId()), "SELFOP_INVENTORY_BASE_CHANGED");
+        var rows = snapshots.selectList(new QueryWrapper<SelfopInventorySnapshot>().eq("snapshot_run_id", runId));
+        var dimensions = profiles.selectList(new QueryWrapper<SelfopSkuProfile>().eq("profile_run_id", runId));
+        require(run.getSourceTotalCount() != null && rows.size() >= run.getSourceTotalCount(), "SELFOP_INVENTORY_CANDIDATE_INCOMPLETE");
+        Set<List<String>> rowSkus = new HashSet<>(), profileSkus = new HashSet<>();
+        for (var row : rows) {
+            require(Objects.equals(scope.getSourceAccount(), row.getSourceAccount())
+                && Objects.equals(scope.getWarehouseCode(), row.getWarehouseCode()), "SELFOP_INVENTORY_SCOPE_LEAK");
+            rowSkus.add(List.of(row.getCustomerCode(), row.getSkuCode()));
+        }
+        for (var profile : dimensions) {
+            require(Objects.equals(scope.getSourceAccount(), profile.getSourceAccount())
+                && Objects.equals(scope.getWarehouseCode(), profile.getWarehouseCode()), "SELFOP_INVENTORY_SCOPE_LEAK");
+            profileSkus.add(List.of(profile.getCustomerCode(), profile.getSkuCode()));
+        }
+        require(profileSkus.containsAll(rowSkus), "SELFOP_INVENTORY_PROFILE_INCOMPLETE");
+        var task = coordination.lockTask(run.getTaskId());
+        SelfopCollectionPolicy.requireBusiness(task);
+        require(task != null && Objects.equals(task.getScopeId(), scopeId) && Objects.equals(task.getScopeHash(), scope.getScopeHash())
+            && Objects.equals(task.getSourceAccount(), scope.getSourceAccount())
+            && Objects.equals(task.getWarehouseCode(), scope.getWarehouseCode())
+            && "NOT_APPLICABLE".equals(task.getApplyState()), "SELFOP_INVENTORY_TASK_INVALID");
+        require(run.getInventoryDailySampleDate() == null && run.getInventorySampleRuleVersion() == null,
+            "SELFOP_INVENTORY_UNPUBLISHED_SAMPLE");
+        LocalDate sampleDate = eligibleSampleDate(task, run);
+        if (sampleDate != null) {
+            var selected = runs.dailyInventorySample(scope.getSourceAccount(), scope.getWarehouseCode(), sampleDate);
+            require(selected == null || ("PUBLISHED".equals(selected.getStatus())
+                && DAILY_SAMPLE_RULE.equals(selected.getInventorySampleRuleVersion())), "SELFOP_INVENTORY_SAMPLE_INVALID");
+            if (selected == null) {
+                run.setInventoryDailySampleDate(sampleDate);
+                run.setInventorySampleRuleVersion(DAILY_SAMPLE_RULE);
+            }
+        }
+        var now = utcNow();
+        if(scope.getPublishedRunId()!=null)runs.update(null,new com.baomidou.mybatisplus.core.conditions.update.UpdateWrapper<SelfopSyncRun>()
+            .eq("id",scope.getPublishedRunId()).isNull("superseded_at_utc").set("superseded_at_utc",now).set("updated_at",now));
+        scope.setPublishedRunId(runId); scope.setUpdatedAt(now); scopes.updateById(scope);
+        run.setProgressSnapshotJson(task.getProgressJson());run.setStatus("PUBLISHED"); run.setPublishedAtUtc(now); run.setFinishedAtUtc(now); run.setUpdatedAt(now); runs.updateById(run);
+        task.setResultPublishedRunId(runId);task.setStatus("SUCCEEDED"); task.setUpdatedAt(now); tasks.updateById(task);
+    }
+
+    /** Recovery verifies the committed result, never elects an old unmarked version retroactively. */
+    private void verifyPublishedResult(SelfopSyncRun run) {
+        var task = coordination.lockTask(run.getTaskId());
+        SelfopCollectionPolicy.requireBusiness(task);
+        require(task != null && Objects.equals(task.getResultPublishedRunId(), run.getId())
+            && run.getPublishedAtUtc() != null, "SELFOP_INVENTORY_PUBLISHED_RESULT_INVALID");
+        if (run.getInventoryDailySampleDate() == null) {
+            require(run.getInventorySampleRuleVersion() == null, "SELFOP_INVENTORY_SAMPLE_INVALID");
+            return;
+        }
+        require(DAILY_SAMPLE_RULE.equals(run.getInventorySampleRuleVersion())
+            && Objects.equals(run.getInventoryDailySampleDate(), eligibleSampleDate(task, run)), "SELFOP_INVENTORY_SAMPLE_INVALID");
+        var selected = runs.dailyInventorySample(run.getSourceAccount(), run.getWarehouseCode(), run.getInventoryDailySampleDate());
+        require(selected != null && Objects.equals(selected.getId(), run.getId()), "SELFOP_INVENTORY_SAMPLE_INVALID");
+    }
+
+    /** The observed interval, not publication/retry time, determines the Beijing observation day. */
+    static LocalDate eligibleSampleDate(SelfopSyncTask task, SelfopSyncRun run) {
+        if (!"BUSINESS".equals(task.getExecutionPurpose()) || !"BUSINESS".equals(run.getExecutionPurpose())
+            || !"SCHEDULED".equals(task.getTaskType()) || !"WAREHOUSE_SYNC".equals(task.getTaskRole())
+            || !"WAREHOUSE_SYNC".equals(run.getRunRole()) || !"COMPLETE".equals(run.getCoverageStatus())
+            || !("READY".equals(run.getStatus()) || "PUBLISHED".equals(run.getStatus()))
+            || task.getPlannedAtUtc() == null || run.getFetchStartedAtUtc() == null || run.getFetchFinishedAtUtc() == null
+            || run.getFetchFinishedAtUtc().isBefore(run.getFetchStartedAtUtc())
+            || run.getPageCount() == null || run.getPageCount() < 1 || run.getSourceTotalCount() == null
+            || run.getSourceTotalCount() < 0 || !Objects.equals(run.getSourceTotalCount(), run.getUniqueObjectCount())) return null;
+        LocalDate planned = task.getPlannedAtUtc().atOffset(ZoneOffset.UTC).atZoneSameInstant(SAMPLE_ZONE).toLocalDate();
+        LocalDate started = run.getFetchStartedAtUtc().atOffset(ZoneOffset.UTC).atZoneSameInstant(SAMPLE_ZONE).toLocalDate();
+        LocalDate finished = run.getFetchFinishedAtUtc().atOffset(ZoneOffset.UTC).atZoneSameInstant(SAMPLE_ZONE).toLocalDate();
+        return planned.equals(started) && planned.equals(finished) ? planned : null;
+    }
+
+    private void reference(SelfopSyncScope scope, long referenceId, String family) {
+        var ref = runs.selectById(referenceId);
+        SelfopCollectionPolicy.requireBusiness(ref);
+        require(ref != null && "PUBLISHED".equals(ref.getStatus()) && "WAREHOUSE_SYNC".equals(ref.getRunRole())
+            && Objects.equals(scope.getSourceAccount(), ref.getSourceAccount())
+            && Objects.equals(scope.getWarehouseCode(), ref.getWarehouseCode()), "SELFOP_INVENTORY_REFERENCE_INVALID");
+        var refScope = scopes.selectById(ref.getScopeId());
+        require(refScope != null && family.equals(refScope.getDataFamily())
+            && Objects.equals(scope.getSourceAccount(), refScope.getSourceAccount())
+            && Objects.equals(scope.getWarehouseCode(), refScope.getWarehouseCode()), "SELFOP_INVENTORY_REFERENCE_SCOPE_INVALID");
+    }
+    private static String fixedUnit(SelfopSyncRun run) {
+        require(run.getScopeSnapshotJson() != null, "SELFOP_INVENTORY_CONFIG_MISSING");
+        Object unit = read(run.getScopeSnapshotJson(), Map.class).get("quantityUnit");
+        require(unit == null || unit instanceof String, "SELFOP_QUANTITY_UNIT_INVALID");
+        if (unit == null || ((String) unit).isBlank()) return null;
+        return identity((String) unit, 32);
+    }
+    private static void validate(SelfopSyncScope scope, SelfopSyncRun run, String owner, long fence) {
+        SelfopCollectionPolicy.requireBusiness(run);
+        require(scope != null && run != null && "INVENTORY".equals(scope.getDataFamily())
+            && "WAREHOUSE_SYNC".equals(run.getRunRole()) && Objects.equals(scope.getId(), run.getScopeId())
+            && Objects.equals(scope.getSourceAccount(), run.getSourceAccount())
+            && Objects.equals(scope.getWarehouseCode(), run.getWarehouseCode())
+            && Objects.equals(scope.getScopeHash(), run.getScopeHash()), "SELFOP_INVENTORY_SCOPE_INVALID");
+        require(owner != null && owner.equals(scope.getLeaseOwner()) && Objects.equals(scope.getFenceToken(), fence)
+            && Objects.equals(run.getFenceToken(), fence) && scope.getLeaseUntilUtc() != null
+            && scope.getLeaseUntilUtc().isAfter(utcNow()), "SELFOP_LEASE_LOST");
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/mapper/SelfopCoordinationMapper.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/mapper/SelfopCoordinationMapper.java
new file mode 100644
index 000000000..ebde56ed4
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/mapper/SelfopCoordinationMapper.java
@@ -0,0 +1,45 @@
+package com.baiyue.lastleg.selfoperated.analytics.mapper;
+
+import com.baiyue.lastleg.selfoperated.analytics.model.*;
+import org.apache.ibatis.annotations.*;
+import java.time.LocalDateTime;
+import java.util.List;
+
+@Mapper
+public interface SelfopCoordinationMapper {
+    @Select("SELECT * FROM ll_selfop_sync_scope WHERE id=#{id} FOR UPDATE")
+    SelfopSyncScope lockScope(long id);
+    @Select("SELECT * FROM ll_selfop_outbound_discovery_scope WHERE id=#{id} FOR UPDATE")
+    SelfopOutboundDiscoveryScope lockDiscovery(long id);
+    @Select("SELECT * FROM ll_selfop_sync_task WHERE id=#{id} FOR UPDATE")
+    SelfopSyncTask lockTask(long id);
+    @Select("SELECT * FROM ll_selfop_sync_run WHERE id=#{id} FOR UPDATE")
+    SelfopSyncRun lockRun(long id);
+    @Select("SELECT * FROM ll_selfop_sync_task WHERE execution_purpose=#{purpose} AND task_type NOT IN ('INVENTORY_FLOW_PROBE','INVENTORY_FLOW_HISTORY','INVENTORY_HISTORY_BUILD') AND status IN ('READY','RETRY_WAIT','RUNNING') AND (execution_purpose='BUSINESS' OR (status='READY' AND validation_root_task_id=id)) AND (next_retry_at_utc IS NULL OR next_retry_at_utc<=#{now}) ORDER BY CASE WHEN task_type IN ('RECHECK','REBUILD') THEN 1 WHEN task_role='WAREHOUSE_SYNC' THEN 0 WHEN task_type='BACKFILL' THEN 3 ELSE 2 END,id LIMIT #{limit}")
+    List<SelfopSyncTask> due(@Param("now") LocalDateTime now, @Param("limit") int limit, @Param("purpose") String purpose);
+    // Started inventory work may resume across midnight; unstarted historical slots remain excluded.
+    // Publication independently requires the planned day and observation day to match for daily samples.
+    @Select("SELECT t.* FROM ll_selfop_sync_task t JOIN ll_selfop_sync_task r ON r.id=t.business_root_task_id AND r.business_root_task_id=r.id AND r.source_account=t.source_account AND r.execution_purpose='BUSINESS' AND r.validation_root_task_id IS NULL AND r.status<>'DEAD' WHERE t.task_type NOT IN ('INVENTORY_FLOW_HISTORY','INVENTORY_HISTORY_BUILD') AND t.source_account=#{account} AND t.execution_purpose='BUSINESS' AND t.validation_root_task_id IS NULL AND (r.request_key LIKE 'manual:%' OR (r.requested_by='SELFOP_CONTINUOUS_PLANNER' AND r.request_key LIKE 'continuous:%')) AND t.status IN ('READY','RETRY_WAIT','RUNNING') AND (t.next_retry_at_utc IS NULL OR t.next_retry_at_utc<=#{now}) AND (r.request_key NOT LIKE 'continuous:inventory:%' OR DATE(DATE_ADD(r.planned_at_utc,INTERVAL 8 HOUR))=DATE(DATE_ADD(#{now},INTERVAL 8 HOUR)) OR (r.attempt_count>0 AND r.planned_at_utc<=#{now})) ORDER BY CASE WHEN r.task_role='ACCOUNT_DISCOVERY' AND r.query_until_utc>=DATE_SUB(DATE(DATE_ADD(#{now},INTERVAL 8 HOUR)),INTERVAL 8 HOUR) THEN 0 WHEN r.request_key LIKE 'continuous:inventory:%' THEN 1 WHEN t.task_role='WAREHOUSE_SYNC' THEN 2 WHEN t.task_type IN ('RECHECK','REBUILD') THEN 3 ELSE 4 END,t.query_until_utc DESC,t.id LIMIT #{limit}")
+    List<SelfopSyncTask> dueContinuous(@Param("now") LocalDateTime now,@Param("limit") int limit,@Param("account") String account);
+    @Select("SELECT COUNT(*) FROM ll_selfop_sync_task WHERE source_account=#{account} AND apply_state IN ('APPLYING','BLOCKED') AND JSON_CONTAINS(affected_warehouse_codes_json,JSON_QUOTE(#{warehouse}))")
+    long barriers(@Param("account") String account, @Param("warehouse") String warehouse);
+    @Update("UPDATE ll_selfop_sync_task SET status='SUCCEEDED',result_published_run_id=#{published},next_retry_at_utc=NULL,updated_at=#{now} WHERE scope_id=#{scope} AND scope_hash=#{hash} AND execution_purpose='BUSINESS' AND apply_state='APPLIED' AND (query_from_utc IS NULL OR (query_from_utc>=#{from} AND query_until_utc<=#{until})) AND status IN ('READY','RUNNING','RETRY_WAIT','DEAD')")
+    int completeCoveredTasks(@Param("scope") long scope,@Param("hash") String hash,@Param("published") long published,@Param("from") LocalDateTime from,@Param("until") LocalDateTime until,@Param("now") LocalDateTime now);
+    @Update("""
+        UPDATE ll_selfop_sync_run r JOIN ll_selfop_sync_task t ON t.id=r.task_id
+        SET r.status='REUSED',r.finished_at_utc=#{now},r.updated_at=#{now},r.progress_snapshot_json=COALESCE(r.progress_snapshot_json,CASE WHEN JSON_EXTRACT(t.progress_json,'$.attemptNo')=r.attempt_no THEN t.progress_json ELSE NULL END)
+        WHERE r.scope_id=#{scope} AND t.scope_id=#{scope}
+          AND r.source_account=#{account} AND t.source_account=#{account}
+          AND r.warehouse_code=#{warehouse} AND t.warehouse_code=#{warehouse}
+          AND r.scope_hash=#{hash} AND t.scope_hash=#{hash}
+          AND t.result_published_run_id=#{published} AND r.id<>#{published}
+          AND r.attempt_no=t.attempt_count AND r.execution_purpose='BUSINESS' AND t.execution_purpose='BUSINESS'
+          AND r.status IN ('FETCHING','FACTS_APPLIED','BUILDING','READY')
+        """)
+    int completeReusedRuns(@Param("scope") long scope,@Param("account") String account,@Param("warehouse") String warehouse,
+        @Param("hash") String hash,@Param("published") long published,@Param("now") LocalDateTime now);
+    @Update("UPDATE ll_selfop_sync_task SET status='SUCCEEDED',result_published_run_id=#{published},next_retry_at_utc=NULL,updated_at=#{now} WHERE scope_id=#{scope} AND scope_hash=#{hash} AND execution_purpose='BUSINESS' AND task_type='SCHEDULED' AND apply_state='NOT_APPLICABLE' AND status='WAITING_SOURCE' AND planned_at_utc<=#{until}")
+    int completeCoveredMarkers(@Param("scope") long scope,@Param("hash") String hash,@Param("published") long published,@Param("until") LocalDateTime until,@Param("now") LocalDateTime now);
+    @Update("<script>UPDATE ll_selfop_sync_run r JOIN ll_selfop_sync_task t ON t.id=r.task_id SET r.heartbeat_at_utc=#{now},r.updated_at=#{now} WHERE r.fence_token=#{fence} AND t.status='RUNNING' AND r.status IN ('FETCHING','VALIDATED','FACTS_APPLIED','BUILDING','READY') <choose><when test='account'>AND t.discovery_scope_id=#{scope}</when><otherwise>AND r.scope_id=#{scope}</otherwise></choose></script>")
+    int heartbeat(@Param("scope") long scope,@Param("account") boolean account,@Param("fence") long fence,@Param("now") LocalDateTime now);
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/mapper/SelfopInventorySnapshotMapper.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/mapper/SelfopInventorySnapshotMapper.java
new file mode 100644
index 000000000..c48016583
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/mapper/SelfopInventorySnapshotMapper.java
@@ -0,0 +1,9 @@
+package com.baiyue.lastleg.selfoperated.analytics.mapper;
+
+import com.baomidou.mybatisplus.core.mapper.BaseMapper;
+import com.baiyue.lastleg.selfoperated.analytics.model.SelfopInventorySnapshot;
+import org.apache.ibatis.annotations.Mapper;
+
+@Mapper
+public interface SelfopInventorySnapshotMapper extends BaseMapper<SelfopInventorySnapshot> {
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/mapper/SelfopMasterDataMapper.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/mapper/SelfopMasterDataMapper.java
new file mode 100644
index 000000000..c316c3e86
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/mapper/SelfopMasterDataMapper.java
@@ -0,0 +1,33 @@
+package com.baiyue.lastleg.selfoperated.analytics.mapper;
+
+import com.baiyue.lastleg.selfoperated.analytics.model.SelfopPayloads;
+import org.apache.ibatis.annotations.*;
+import java.time.LocalDateTime;
+import java.util.List;
+
+@Mapper
+public interface SelfopMasterDataMapper {
+    @Insert("INSERT INTO ll_selfop_owner(id,run_id,source_account,customer_code,customer_name,source_status,observed_at_utc) VALUES(#{id},#{run},#{account},#{row.customerCode},#{row.customerName},#{row.status},#{now})")
+    void insertOwner(@Param("id") long id,@Param("run") long run,@Param("account") String account,@Param("row") SelfopPayloads.Owner row,@Param("now") LocalDateTime now);
+    @Insert("""
+        INSERT INTO ll_selfop_product(id,run_id,source_account,customer_code,sku_code,product_name,
+          declared_length,declared_width,declared_height,declared_size_unit,measured_length,measured_width,measured_height,measured_size_unit,observed_at_utc)
+        VALUES(#{id},#{run},#{account},#{row.customerCode},#{row.sku},#{row.productName},
+          #{row.length},#{row.width},#{row.height},#{row.sizeUnit},#{row.wmsLength},#{row.wmsWidth},#{row.wmsHeight},#{row.wmsSizeUnit},#{now})
+        """)
+    void insertProduct(@Param("id") long id,@Param("run") long run,@Param("account") String account,@Param("row") SelfopPayloads.Product row,@Param("now") LocalDateTime now);
+    @Select("SELECT COUNT(*) FROM ll_selfop_owner WHERE run_id=#{run} AND source_account=#{account}")
+    long ownerCount(@Param("run") long run,@Param("account") String account);
+    @Select("SELECT COUNT(*) FROM ll_selfop_product WHERE run_id=#{run} AND source_account=#{account}")
+    long productCount(@Param("run") long run,@Param("account") String account);
+    @Select("""
+        SELECT r.id FROM ll_selfop_sync_run r JOIN ll_selfop_sync_task t ON t.id=r.task_id
+        WHERE r.source_account=#{account} AND t.source_account=#{account} AND t.task_type='MASTER_DATA'
+          AND t.task_role='ACCOUNT_DISCOVERY' AND r.execution_purpose='BUSINESS' AND t.execution_purpose='BUSINESS'
+          AND r.status='PUBLISHED' AND r.coverage_status='COMPLETE' AND r.published_at_utc<=#{asOf}
+        ORDER BY r.published_at_utc DESC,r.id DESC LIMIT 1
+        """)
+    Long publishedAt(@Param("account") String account,@Param("asOf") LocalDateTime asOf);
+    @Select("SELECT customer_code,customer_name,source_status AS status FROM ll_selfop_owner WHERE source_account=#{account} AND run_id=#{run} ORDER BY customer_code")
+    List<SelfopPayloads.Owner> owners(@Param("account") String account,@Param("run") long run);
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/mapper/SelfopOutboundDiscoveryScopeMapper.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/mapper/SelfopOutboundDiscoveryScopeMapper.java
new file mode 100644
index 000000000..117c462dd
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/mapper/SelfopOutboundDiscoveryScopeMapper.java
@@ -0,0 +1,9 @@
+package com.baiyue.lastleg.selfoperated.analytics.mapper;
+
+import com.baomidou.mybatisplus.core.mapper.BaseMapper;
+import com.baiyue.lastleg.selfoperated.analytics.model.SelfopOutboundDiscoveryScope;
+import org.apache.ibatis.annotations.Mapper;
+
+@Mapper
+public interface SelfopOutboundDiscoveryScopeMapper extends BaseMapper<SelfopOutboundDiscoveryScope> {
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/mapper/SelfopOutboundItemMapper.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/mapper/SelfopOutboundItemMapper.java
new file mode 100644
index 000000000..313161408
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/mapper/SelfopOutboundItemMapper.java
@@ -0,0 +1,9 @@
+package com.baiyue.lastleg.selfoperated.analytics.mapper;
+
+import com.baomidou.mybatisplus.core.mapper.BaseMapper;
+import com.baiyue.lastleg.selfoperated.analytics.model.SelfopOutboundItem;
+import org.apache.ibatis.annotations.Mapper;
+
+@Mapper
+public interface SelfopOutboundItemMapper extends BaseMapper<SelfopOutboundItem> {
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/mapper/SelfopOutboundOrderMapper.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/mapper/SelfopOutboundOrderMapper.java
new file mode 100644
index 000000000..15b8721ca
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/mapper/SelfopOutboundOrderMapper.java
@@ -0,0 +1,9 @@
+package com.baiyue.lastleg.selfoperated.analytics.mapper;
+
+import com.baomidou.mybatisplus.core.mapper.BaseMapper;
+import com.baiyue.lastleg.selfoperated.analytics.model.SelfopOutboundOrder;
+import org.apache.ibatis.annotations.Mapper;
+
+@Mapper
+public interface SelfopOutboundOrderMapper extends BaseMapper<SelfopOutboundOrder> {
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/mapper/SelfopSkuDailySalesMapper.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/mapper/SelfopSkuDailySalesMapper.java
new file mode 100644
index 000000000..82ad4f828
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/mapper/SelfopSkuDailySalesMapper.java
@@ -0,0 +1,9 @@
+package com.baiyue.lastleg.selfoperated.analytics.mapper;
+
+import com.baomidou.mybatisplus.core.mapper.BaseMapper;
+import com.baiyue.lastleg.selfoperated.analytics.model.SelfopSkuDailySales;
+import org.apache.ibatis.annotations.Mapper;
+
+@Mapper
+public interface SelfopSkuDailySalesMapper extends BaseMapper<SelfopSkuDailySales> {
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/mapper/SelfopSkuProfileMapper.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/mapper/SelfopSkuProfileMapper.java
new file mode 100644
index 000000000..ed752bca3
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/mapper/SelfopSkuProfileMapper.java
@@ -0,0 +1,9 @@
+package com.baiyue.lastleg.selfoperated.analytics.mapper;
+
+import com.baomidou.mybatisplus.core.mapper.BaseMapper;
+import com.baiyue.lastleg.selfoperated.analytics.model.SelfopSkuProfile;
+import org.apache.ibatis.annotations.Mapper;
+
+@Mapper
+public interface SelfopSkuProfileMapper extends BaseMapper<SelfopSkuProfile> {
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/mapper/SelfopSyncRunMapper.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/mapper/SelfopSyncRunMapper.java
new file mode 100644
index 000000000..9d93655a4
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/mapper/SelfopSyncRunMapper.java
@@ -0,0 +1,16 @@
+package com.baiyue.lastleg.selfoperated.analytics.mapper;
+
+import com.baomidou.mybatisplus.core.mapper.BaseMapper;
+import com.baiyue.lastleg.selfoperated.analytics.model.SelfopSyncRun;
+import org.apache.ibatis.annotations.Mapper;
+import org.apache.ibatis.annotations.Param;
+import org.apache.ibatis.annotations.Select;
+import java.time.LocalDate;
+
+@Mapper
+public interface SelfopSyncRunMapper extends BaseMapper<SelfopSyncRun> {
+    /** Current read after acquiring the inventory scope lock, including after a competing publisher commits. */
+    @Select("SELECT * FROM ll_selfop_sync_run WHERE source_account=#{account} AND warehouse_code=#{warehouse} AND inventory_daily_sample_date=#{date} FOR UPDATE")
+    SelfopSyncRun dailyInventorySample(@Param("account") String account, @Param("warehouse") String warehouse,
+                                      @Param("date") LocalDate date);
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/mapper/SelfopSyncScopeMapper.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/mapper/SelfopSyncScopeMapper.java
new file mode 100644
index 000000000..a937d1ade
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/mapper/SelfopSyncScopeMapper.java
@@ -0,0 +1,9 @@
+package com.baiyue.lastleg.selfoperated.analytics.mapper;
+
+import com.baomidou.mybatisplus.core.mapper.BaseMapper;
+import com.baiyue.lastleg.selfoperated.analytics.model.SelfopSyncScope;
+import org.apache.ibatis.annotations.Mapper;
+
+@Mapper
+public interface SelfopSyncScopeMapper extends BaseMapper<SelfopSyncScope> {
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/mapper/SelfopSyncStageMapper.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/mapper/SelfopSyncStageMapper.java
new file mode 100644
index 000000000..da118dc82
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/mapper/SelfopSyncStageMapper.java
@@ -0,0 +1,9 @@
+package com.baiyue.lastleg.selfoperated.analytics.mapper;
+
+import com.baomidou.mybatisplus.core.mapper.BaseMapper;
+import com.baiyue.lastleg.selfoperated.analytics.model.SelfopSyncStage;
+import org.apache.ibatis.annotations.Mapper;
+
+@Mapper
+public interface SelfopSyncStageMapper extends BaseMapper<SelfopSyncStage> {
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/mapper/SelfopSyncTaskMapper.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/mapper/SelfopSyncTaskMapper.java
new file mode 100644
index 000000000..8fcdcbe2a
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/mapper/SelfopSyncTaskMapper.java
@@ -0,0 +1,9 @@
+package com.baiyue.lastleg.selfoperated.analytics.mapper;
+
+import com.baomidou.mybatisplus.core.mapper.BaseMapper;
+import com.baiyue.lastleg.selfoperated.analytics.model.SelfopSyncTask;
+import org.apache.ibatis.annotations.Mapper;
+
+@Mapper
+public interface SelfopSyncTaskMapper extends BaseMapper<SelfopSyncTask> {
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/model/SelfopAnalyticsProperties.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/model/SelfopAnalyticsProperties.java
new file mode 100644
index 000000000..e65b62dac
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/model/SelfopAnalyticsProperties.java
@@ -0,0 +1,75 @@
+package com.baiyue.lastleg.selfoperated.analytics.model;
+
+import lombok.Data;
+import org.springframework.boot.context.properties.ConfigurationProperties;
+import org.springframework.stereotype.Component;
+import java.util.LinkedHashMap;
+import java.util.Map;
+import java.time.LocalDate;
+import java.time.LocalDateTime;
+
+@Data
+@Component
+@ConfigurationProperties(prefix = "baiyue.self-operated-analytics")
+public class SelfopAnalyticsProperties {
+    private String collectionMode = "OFF";
+    /** Explicit account-owner continuous BUSINESS planner/egress mode; off by default. */
+    private boolean continuousBusinessCollectionEnabled = false;
+    /** Requires the history tables and both services from the same release. */
+    private boolean inventoryHistoryEnabled = false;
+    private int inventoryHistoryDays = 60;
+    private String environment = "test";
+    private String exclusiveGrantId;
+    private LocalDateTime exclusiveGrantExpiresAtUtc;
+    private boolean exclusiveHandoffVerified = false;
+    private boolean priorEgressClosed = false;
+    private boolean inflightDrained = false;
+    private boolean transferredBudgetVerified = false;
+    private long transferredDailyHttpCount = 0;
+    private LocalDate transferredBudgetDate;
+    private LocalDateTime transferredCooldownUntilUtc;
+    private String transferredPauseReason;
+    /** VALIDATION-only daily ceiling; BUSINESS retains counts without a daily quota. */
+    private int dailyRequestBudget = 0;
+    private int businessMinRequestIntervalMs = 5000;
+    private int maxRateLimitFailures = 5;
+    private int cooldownSeconds = 60;
+    private int egressLeaseSeconds = 120;
+    private boolean retentionEnabled = false;
+    private int salesRetentionDays = 7;
+    private int persistenceBatchSize = 500;
+    private int minimumBuildIntervalSeconds = 1800;
+    /** Read-only UI projection; collectionMode is the sole runtime mode input. */
+    public boolean isExecutionEnabled() {
+        return "VALIDATION".equals(collectionMode)||("BUSINESS".equals(collectionMode)&&SelfopCollectionPolicy.businessEnvironment(this));
+    }
+    private boolean salesPublicationEnabled = false;
+    private String integrationBaseUrl = "http://integration-service";
+    private String internalServiceToken = "";
+    private String sourceAccount = "";
+    private String sourceQueryTimezone;
+    private String quantityUnit;
+    /** Per-dispatch slice size, never a BUSINESS root/session HTTP-count ceiling. */
+    private int requestBudget = 100;
+    private int timeBudgetSeconds = 120;
+    private int minRequestIntervalMs = 1100;
+    private int leaseSeconds = 180;
+    private int maxAttempts = 5;
+    private int pageSize = 100;
+    /** Inventory supports larger pages independently of the outbound list limit. */
+    private int inventoryPageSize = 1000;
+    private int applyBatchSize = 100;
+    private Map<String, Warehouse> warehouses = new LinkedHashMap<>();
+    @Data
+    public static class Warehouse {
+        private String businessTimezone = "Asia/Shanghai";
+        private String sourceTimezone = "Asia/Shanghai";
+        private String outboundCron = "0 0 8,20 * * *";
+        private String inventoryCron = "0 0 8 * * *";
+        private int inventoryStaleAfterSeconds = 93600;
+        private int outboundStaleAfterSeconds = 93600;
+        private int reviewRequestBudget = 100;
+        private int reviewTimeBudgetSeconds = 120;
+        private int reviewTargetDays = 7;
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/model/SelfopCollectionPolicy.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/model/SelfopCollectionPolicy.java
new file mode 100644
index 000000000..4d868aa52
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/model/SelfopCollectionPolicy.java
@@ -0,0 +1,133 @@
+package com.baiyue.lastleg.selfoperated.analytics.model;
+
+import static com.baiyue.lastleg.selfoperated.analytics.model.SelfopSupport.require;
+import static com.baiyue.lastleg.selfoperated.analytics.model.SelfopSupport.read;
+import static com.baiyue.lastleg.selfoperated.analytics.model.SelfopSupport.identity;
+import java.util.Map;
+import java.util.List;
+
+/** Purpose is persisted on every task/run. Unknown purpose is never treated as business. */
+public final class SelfopCollectionPolicy {
+    private SelfopCollectionPolicy() { }
+    public static void requireBusiness(SelfopSyncTask task) {
+        require(task != null && "BUSINESS".equals(task.getExecutionPurpose()) && task.getValidationRootTaskId()==null,
+            "SELFOP_BUSINESS_PURPOSE_REQUIRED");
+    }
+    public static void requireBusiness(SelfopSyncRun run) {
+        require(run != null && "BUSINESS".equals(run.getExecutionPurpose()),"SELFOP_BUSINESS_PURPOSE_REQUIRED");
+    }
+    public static void requireExecution(SelfopAnalyticsProperties config,String purpose) {
+        require("VALIDATION".equals(purpose)||"BUSINESS".equals(purpose),"SELFOP_PURPOSE_INVALID");
+        require(purpose.equals(config.getCollectionMode()),"SELFOP_COLLECTION_MODE_REJECTED");
+        if("BUSINESS".equals(purpose))require(businessEnvironment(config),"SELFOP_BUSINESS_ENVIRONMENT_REJECTED");
+    }
+    public static boolean businessEnvironment(SelfopAnalyticsProperties config) {
+        return "test".equals(config.getEnvironment())||"production".equals(config.getEnvironment());
+    }
+    public static void requireAutomaticPlanning(SelfopAnalyticsProperties config) {
+        requireExecution(config,"BUSINESS");
+        require("production".equals(config.getEnvironment()),"SELFOP_AUTOMATIC_PLANNING_ENVIRONMENT_REJECTED");
+    }
+    public static final String CONTINUOUS_PLANNER="SELFOP_CONTINUOUS_PLANNER";
+    public static boolean continuousBusiness(SelfopAnalyticsProperties config){
+        return config.isContinuousBusinessCollectionEnabled()&&"BUSINESS".equals(config.getCollectionMode())&&businessEnvironment(config);
+    }
+    /** Strict persisted server identity; enabling continuous mode never admits old cron slots. */
+    public static boolean continuousBusinessRoot(SelfopSyncTask task){
+        if(task==null||!"BUSINESS".equals(task.getExecutionPurpose())||task.getUpstreamTaskId()!=null
+            ||task.getValidationRootTaskId()!=null||!CONTINUOUS_PLANNER.equals(task.getRequestedBy())||task.getScopeHash()==null||!task.getScopeHash().matches("[a-f0-9]{64}"))return false;
+        String key=task.getRequestKey();if(key==null)return false;
+        if(com.baiyue.lastleg.selfoperated.analytics.history.InventoryFlowSlice.TYPE.equals(task.getTaskType())) {
+            try {
+                var slice=read(task.getQueryScopeJson(),com.baiyue.lastleg.selfoperated.analytics.history.InventoryFlowSlice.class);
+                return "ACCOUNT_DISCOVERY".equals(task.getTaskRole())&&task.getDiscoveryScopeId()!=null&&task.getScopeId()==null
+                    &&task.getWarehouseCode()==null&&task.getPlannedAtUtc()!=null&&task.getId().equals(task.getBusinessRootTaskId())
+                    &&task.getScopeHash().equals(SelfopSupport.hash(slice))&&task.getRequestHash().equals(task.getScopeHash())
+                    &&key.equals("continuous:history:"+task.getPlannedAtUtc().toLocalDate()+":"+task.getScopeHash())
+                    &&java.time.LocalDateTime.ofInstant(slice.from(),java.time.ZoneOffset.UTC).equals(task.getQueryFromUtc())
+                    &&java.time.LocalDateTime.ofInstant(slice.until(),java.time.ZoneOffset.UTC).equals(task.getQueryUntilUtc());
+            }catch(RuntimeException invalid){return false;}
+        }
+        if("MASTER_DATA".equals(task.getTaskType())) {
+            if(!"ACCOUNT_DISCOVERY".equals(task.getTaskRole())||task.getDiscoveryScopeId()==null||task.getScopeId()!=null
+                ||task.getWarehouseCode()!=null||task.getPlannedAtUtc()==null||task.getQueryFromUtc()!=null||task.getQueryUntilUtc()!=null)return false;
+            try{Map<?,?> q=read(task.getQueryScopeJson(),Map.class);
+                return key.equals("continuous:master:"+task.getPlannedAtUtc().plusHours(8).toLocalDate()+":"+task.getScopeHash().substring(0,12))
+                    &&q!=null&&q.size()==2&&"MASTER_DATA".equals(q.get("dataFamily"))&&task.getSourceAccount().equals(q.get("sourceAccount"))
+                    &&task.getScopeHash().equals(SelfopSupport.hash(new java.util.TreeMap<>(q)));
+            }catch(RuntimeException invalid){return false;}
+        }
+        if("ACCOUNT_DISCOVERY".equals(task.getTaskRole())&&"BACKFILL".equals(task.getTaskType())&&task.getDiscoveryScopeId()!=null
+            &&task.getQueryFromUtc()!=null&&task.getQueryUntilUtc()!=null&&task.getQueryUntilUtc().equals(task.getQueryFromUtc().plusDays(1))){
+            var local=task.getQueryFromUtc().plusHours(8);
+            if(!local.toLocalTime().equals(java.time.LocalTime.MIDNIGHT)||!key.equals("continuous:outbound:"+local.toLocalDate()+":"+task.getScopeHash().substring(0,12)))return false;
+            try{Map<?,?> q=read(task.getQueryScopeJson(),Map.class);
+                return q!=null&&q.get("parentTaskId")==null&&q.get("deliveryNo")==null&&q.get("customerCode")==null
+                    &&local.toString().equals(q.get("startTime"))&&task.getQueryUntilUtc().plusHours(8).toString().equals(q.get("endTime"));
+            }catch(RuntimeException invalid){return false;}
+        }
+        if(!"WAREHOUSE_SYNC".equals(task.getTaskRole())||!"SCHEDULED".equals(task.getTaskType())||task.getScopeId()==null
+            ||task.getDiscoveryScopeId()!=null||task.getWarehouseCode()==null||task.getPlannedAtUtc()==null
+            ||task.getQueryFromUtc()!=null||task.getQueryUntilUtc()!=null
+            ||!key.equals("continuous:inventory:"+task.getWarehouseCode()+":"+task.getPlannedAtUtc()+":"+task.getScopeHash().substring(0,12)))return false;
+        try{Map<?,?> q=read(task.getQueryScopeJson(),Map.class);
+            return q!=null&&"INVENTORY".equals(q.get("dataFamily"))&&"Asia/Shanghai".equals(q.get("businessTimezone"))
+                &&java.util.Objects.equals(task.getSourceAccount(),q.get("sourceAccount"))&&java.util.Objects.equals(task.getWarehouseCode(),q.get("warehouseCode"));
+        }catch(RuntimeException invalid){return false;}
+    }
+    /** TEST may poll only persisted manual roots and their existing routing/refresh descendants. */
+    public static boolean controlledBusinessTask(SelfopSyncTask task,java.util.function.Function<Long,SelfopSyncTask> lookup) {
+        return controlledBusinessTask(task,lookup,false);
+    }
+    public static boolean controlledBusinessTask(SelfopSyncTask task,java.util.function.Function<Long,SelfopSyncTask> lookup,boolean allowContinuous) {
+        if(task==null)return false;
+        String account=task.getSourceAccount();var seen=new java.util.HashSet<Long>();
+        for(int depth=0;task!=null&&depth<64;depth++) {
+            if(!"BUSINESS".equals(task.getExecutionPurpose())||task.getValidationRootTaskId()!=null
+                ||!java.util.Objects.equals(account,task.getSourceAccount()))return false;
+            if(task.getId()!=null&&!seen.add(task.getId()))return false;
+            if(allowContinuous&&continuousBusinessRoot(task))return true;
+            if("SCHEDULED".equals(task.getTaskType())&&(!allowContinuous||task.getUpstreamTaskId()==null))return false;
+            String key=task.getRequestKey();
+            if(key!=null&&key.startsWith("manual:")&&task.getRequestedBy()!=null&&!task.getRequestedBy().isBlank())return true;
+            Long parent=task.getUpstreamTaskId();
+            if(parent!=null) {
+                if(!"WAREHOUSE_SYNC".equals(task.getTaskRole())||!java.util.Objects.equals(key,"route:"+parent+":"+task.getWarehouseCode()))return false;
+            }else {
+                if(!"ACCOUNT_DISCOVERY".equals(task.getTaskRole())||!"RECHECK".equals(task.getTaskType())||key==null)return false;
+                Map<?,?> query=read(task.getQueryScopeJson(),Map.class);
+                if(query==null||!(query.get("parentTaskId") instanceof Number id))return false;
+                parent=id.longValue();
+                if(!key.startsWith("refresh:"+parent+":")&&!key.startsWith("relocate:"+parent+":"))return false;
+            }
+            task=lookup.apply(parent);
+        }
+        return false;
+    }
+    public static String configuredPurpose(SelfopAnalyticsProperties config) {
+        String purpose=config.getCollectionMode();requireExecution(config,purpose);return purpose;
+    }
+    /** The action and warehouse are immutable task inputs, never taken from later configuration. */
+    public static boolean warehouseDiscovery(SelfopSyncTask task) {
+        require(task!=null&&"VALIDATION".equals(task.getExecutionPurpose())&&"VALIDATION".equals(task.getTaskType())
+            &&"ACCOUNT_DISCOVERY".equals(task.getTaskRole()),"SELFOP_VALIDATION_ENTRY_REQUIRED");
+        Map<?,?> query=read(task.getQueryScopeJson(),Map.class);
+        require(query!=null&&("WAREHOUSE_DISCOVERY".equals(query.get("action"))||"VALIDATION".equals(query.get("action"))),
+            "SELFOP_VALIDATION_ENTRY_REQUIRED");
+        if("WAREHOUSE_DISCOVERY".equals(query.get("action"))) {
+            require(!query.containsKey("warehouses")&&!query.containsKey("startTime")&&!query.containsKey("endTime"),
+                "SELFOP_WAREHOUSE_DISCOVERY_PARAMETERS");
+            return true;
+        }
+        return false;
+    }
+    public static String validationWarehouse(SelfopSyncTask task) {
+        require(!warehouseDiscovery(task),"SELFOP_VALIDATION_WAREHOUSE_REQUIRED");
+        Map<?,?> query=read(task.getQueryScopeJson(),Map.class);
+        require(query.get("warehouses") instanceof List<?> warehouses&&warehouses.size()==1
+            &&warehouses.get(0) instanceof String,"SELFOP_VALIDATION_WAREHOUSE_REQUIRED");
+        String warehouse=(String)((List<?>)query.get("warehouses")).get(0);
+        identity(warehouse,64);
+        return warehouse;
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/model/SelfopFailure.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/model/SelfopFailure.java
new file mode 100644
index 000000000..e7f840f41
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/model/SelfopFailure.java
@@ -0,0 +1,100 @@
+package com.baiyue.lastleg.selfoperated.analytics.model;
+
+import com.fasterxml.jackson.databind.JsonNode;
+import java.sql.SQLException;
+import java.util.*;
+import static com.baiyue.lastleg.selfoperated.analytics.model.SelfopSupport.*;
+
+/** Persist only diagnostic metadata, never exception messages, SQL, parameters or provider bodies. */
+public record SelfopFailure(String code, boolean retryable, String exceptionType, String sqlState, Integer vendorCode, String executionPhase) {
+    public static final int OUTBOUND_MAX_RETRIES = 3;
+    private static final Map<String,String> PHASES = Map.ofEntries(
+        Map.entry("DIRECTORY","获取出库目录"),Map.entry("DETAIL","核验出库数据"),Map.entry("ROUTE","分派仓库任务"),
+        Map.entry("MERGE","归并出库事实"),Map.entry("BUILD","计算统计结果"),Map.entry("PUBLISH","发布统计结果"),
+        Map.entry("INVENTORY","获取库存"),Map.entry("CUSTOMERS","获取客户资料"),Map.entry("PRODUCTS","获取商品资料"),
+        Map.entry("FETCHING","获取数据"),Map.entry("BUILDING","计算统计结果"),Map.entry("UNKNOWN","执行采集任务"));
+    private static final Set<String> OUTBOUND_RETRY_CODES = Set.of("SELFOP_EXECUTION_FAILED","SELFOP_DATABASE_TRANSIENT",
+        "SELFOP_DIRECTORY_DUPLICATE","SELFOP_DIRECTORY_COUNT_MISMATCH","SELFOP_DIRECTORY_UNSTABLE","SELFOP_PAGE_TOTAL_CHANGED",
+        "LINGXING_WMS_SOURCE_REJECTED");
+
+    public static SelfopFailure coded(String code, boolean retryable) {
+        return new SelfopFailure(code,retryable,null,null,null,null);
+    }
+    public static SelfopFailure capture(String code, boolean retryable, Throwable error) {
+        String state=null;Integer vendor=null;Throwable deepest=error;
+        var seen=Collections.newSetFromMap(new IdentityHashMap<Throwable,Boolean>());
+        boolean transientDatabase=false,database=false;
+        for(Throwable cause=error;cause!=null&&seen.size()<12&&seen.add(cause);cause=cause.getCause()) {
+            deepest=cause;
+            if(cause instanceof SQLException sql) {
+                database=true;state=sql.getSQLState();vendor=sql.getErrorCode();
+                transientDatabase |= "40001".equals(state)||vendor==1213||vendor==1205;
+            }
+            if(cause instanceof org.springframework.dao.DataAccessException)database=true;
+            if(cause instanceof org.springframework.dao.TransientDataAccessException
+                ||cause instanceof java.sql.SQLTransientException||cause instanceof java.sql.SQLRecoverableException)transientDatabase=true;
+        }
+        if("SELFOP_EXECUTION_FAILED".equals(code)&&database) {
+            code=transientDatabase?"SELFOP_DATABASE_TRANSIENT":"SELFOP_DATABASE_FAILED";
+            retryable=transientDatabase;
+        }
+        return new SelfopFailure(code,retryable,token(deepest.getClass().getSimpleName(),"[A-Za-z][A-Za-z0-9_$]{0,79}"),
+            token(state,"[A-Z0-9]{5}"),vendor,null);
+    }
+    public boolean outboundRetryable() { return retryable&&OUTBOUND_RETRY_CODES.contains(code); }
+    public SelfopFailure atPhase(String phase) {
+        return new SelfopFailure(code,retryable,exceptionType,sqlState,vendorCode,phase!=null&&PHASES.containsKey(phase)?phase:null);
+    }
+
+    public String stored(String phase,long failures,int maxRetries,boolean scheduled) {
+        if(executionPhase!=null)phase=executionPhase;
+        var data=new LinkedHashMap<String,Object>();data.put("v",1);data.put("phase",PHASES.containsKey(phase)?phase:"UNKNOWN");
+        data.put("type",exceptionType);data.put("sqlState",sqlState);data.put("vendorCode",vendorCode);
+        data.put("failures",failures);data.put("maxRetries",maxRetries);data.put("scheduled",scheduled);
+        return json(data);
+    }
+    public static String phase(SelfopSyncTask task,SelfopSyncRun run) {
+        if(task.getProgressJson()!=null)try {
+            var p=read(task.getProgressJson(),JsonNode.class);
+            if(p.path("attemptNo").asInt(-1)==Objects.requireNonNullElse(run.getAttemptNo(),-2)) {
+                String phase=p.path("phase").asText();if(PHASES.containsKey(phase))return phase;
+            }
+        }catch(IllegalArgumentException ignored) { }
+        return PHASES.containsKey(run.getStatus())?run.getStatus():"UNKNOWN";
+    }
+    public static String publicSummary(String code,String stored) {
+        String generic="采集尝试失败，请根据错误码查看受控诊断记录";
+        if(stored==null)return null;
+        if(stored.length()>500)return generic;
+        try {
+            JsonNode p=read(stored,JsonNode.class);
+            if(p.path("v").asInt()!=1||!PHASES.containsKey(p.path("phase").asText())
+                ||!p.path("failures").canConvertToLong()||p.path("failures").asLong()<1
+                ||!p.path("maxRetries").canConvertToInt()||p.path("maxRetries").asInt()<0
+                ||!p.path("scheduled").isBoolean())return generic;
+            String cause=switch(code==null?"":code) {
+                case "SELFOP_DATABASE_TRANSIENT" -> "数据库临时锁冲突或连接故障";
+                case "SELFOP_DATABASE_FAILED" -> "数据库操作失败";
+                case "SELFOP_DIRECTORY_DUPLICATE","SELFOP_DIRECTORY_COUNT_MISMATCH","SELFOP_DIRECTORY_UNSTABLE","SELFOP_PAGE_TOTAL_CHANGED" -> "目录完整性校验未通过";
+                case "LINGXING_WMS_RATE_LIMITED","LINGXING_WMS_HTTP_RATE_LIMITED","LINGXING_WMS_SOURCE_RATE_LIMITED" -> "来源接口限流";
+                case "INTEGRATION_TRANSPORT_FAILURE" -> "接口传输失败，响应结果未确认";
+                case "LINGXING_WMS_AUTHORIZATION_REJECTED" -> "来源接口鉴权失败";
+                case "LINGXING_WMS_SOURCE_REJECTED" -> "来源接口拒绝请求";
+                default -> "执行异常";
+            };
+            StringBuilder result=new StringBuilder(PHASES.get(p.path("phase").asText())).append("失败：").append(cause);
+            String type=token(p.path("type").asText(null),"[A-Za-z][A-Za-z0-9_$]{0,79}");
+            if(type!=null)result.append("；异常类型 ").append(type);
+            String state=token(p.path("sqlState").asText(null),"[A-Z0-9]{5}");
+            if(state!=null)result.append("；SQLState ").append(state);
+            if(p.path("vendorCode").isIntegralNumber())result.append("；数据库错误码 ").append(p.path("vendorCode").intValue());
+            long failures=p.path("failures").longValue();int max=p.path("maxRetries").intValue();
+            result.append("；累计失败 ").append(failures).append(" 次");
+            if(p.path("scheduled").booleanValue())result.append("，已安排第 ").append(failures).append("/").append(max).append(" 次自动重试");
+            else if(failures>max)result.append("，自动重试已用尽（最多 ").append(max).append(" 次），需人工检查");
+            else result.append("，该错误不自动重试，需核对错误码及账号保护状态");
+            return result.toString();
+        }catch(IllegalArgumentException ignored) { return generic; }
+    }
+    private static String token(String value,String pattern) { return value!=null&&value.matches(pattern)?value:null; }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/model/SelfopInventorySnapshot.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/model/SelfopInventorySnapshot.java
new file mode 100644
index 000000000..0255e0a59
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/model/SelfopInventorySnapshot.java
@@ -0,0 +1,33 @@
+package com.baiyue.lastleg.selfoperated.analytics.model;
+
+import com.baomidou.mybatisplus.annotation.IdType;
+import com.baomidou.mybatisplus.annotation.TableId;
+import com.baomidou.mybatisplus.annotation.TableName;
+import lombok.Data;
+import java.math.BigDecimal;
+import java.time.LocalDate;
+import java.time.LocalDateTime;
+
+@Data
+@TableName("ll_selfop_inventory_snapshot")
+public class SelfopInventorySnapshot {
+    @TableId(type = IdType.ASSIGN_ID)
+    private Long id;
+    private LocalDateTime createdAt;
+    private LocalDateTime updatedAt;
+    private Long snapshotRunId;
+    private String sourceAccount;
+    private String customerCode;
+    private String warehouseCode;
+    private String skuCode;
+    private Integer productQuality;
+    private String productName;
+    private BigDecimal physicalQuantity;
+    private BigDecimal availableQuantity;
+    private BigDecimal frozenQuantity;
+    private BigDecimal transitQuantity;
+    private String sourceUniqueKey;
+    private LocalDateTime observedAtUtc;
+    private String qualityStatus;
+    private String qualityReason;
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/model/SelfopOutboundDiscoveryScope.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/model/SelfopOutboundDiscoveryScope.java
new file mode 100644
index 000000000..6eec5b877
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/model/SelfopOutboundDiscoveryScope.java
@@ -0,0 +1,33 @@
+package com.baiyue.lastleg.selfoperated.analytics.model;
+
+import com.baomidou.mybatisplus.annotation.IdType;
+import com.baomidou.mybatisplus.annotation.TableId;
+import com.baomidou.mybatisplus.annotation.TableName;
+import lombok.Data;
+import java.math.BigDecimal;
+import java.time.LocalDate;
+import java.time.LocalDateTime;
+
+@Data
+@TableName("ll_selfop_outbound_discovery_scope")
+public class SelfopOutboundDiscoveryScope {
+    @TableId(type = IdType.ASSIGN_ID)
+    private Long id;
+    private LocalDateTime createdAt;
+    private LocalDateTime updatedAt;
+    private String sourceAccount;
+    private LocalDateTime catalogFromUtc;
+    private LocalDateTime catalogUntilUtc;
+    private Long nextSequence;
+    private Long nextObservationSequence;
+    private Long activeTaskId;
+    private String leaseOwner;
+    private LocalDateTime leaseUntilUtc;
+    private Long fenceToken;
+    private Integer requestBudget;
+    private Integer timeBudgetSeconds;
+    private Integer minRequestIntervalMs;
+    private String apiBudgetJson;
+    private LocalDateTime apiCooldownUntilUtc;
+    private String apiPauseReason;
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/model/SelfopOutboundFingerprint.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/model/SelfopOutboundFingerprint.java
new file mode 100644
index 000000000..cd87a64cb
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/model/SelfopOutboundFingerprint.java
@@ -0,0 +1,30 @@
+package com.baiyue.lastleg.selfoperated.analytics.model;
+
+import java.math.BigDecimal;
+import java.util.Arrays;
+import java.util.List;
+
+/** Outbound quantities are numeric values; MySQL JSON decimal scale is not business content. */
+public final class SelfopOutboundFingerprint {
+    private SelfopOutboundFingerprint() { }
+    private record Item(String skuCode,String productName,String actualQuantity,String quantityUnit) { }
+    private record Order(String sourceAccount,String customerCode,String warehouseCode,String deliveryNo,
+        String sourceNo,Integer sourceStatus,String sourceCreatedTime,String sourceOutboundTime,List<Item> items) { }
+
+    public static String order(SelfopPayloads.Order value) {
+        return SelfopSupport.hash(canonical(value));
+    }
+    public static String fact(SelfopPayloads.Order value,String businessTimezone,String sourceTimezone,String quantityUnit) {
+        return SelfopSupport.hash(Arrays.asList(canonical(value),businessTimezone,sourceTimezone,quantityUnit));
+    }
+    private static Order canonical(SelfopPayloads.Order value) {
+        SelfopSupport.require(value!=null,"SELFOP_OUTBOUND_FINGERPRINT_MISSING");
+        List<Item> items=value.items()==null?null:value.items().stream().map(item->item==null?null:
+            new Item(item.skuCode(),item.productName(),quantity(item.actualQuantity()),item.quantityUnit())).toList();
+        return new Order(value.sourceAccount(),value.customerCode(),value.warehouseCode(),value.deliveryNo(),value.sourceNo(),
+            value.sourceStatus(),value.sourceCreatedTime(),value.sourceOutboundTime(),items);
+    }
+    private static String quantity(BigDecimal value) {
+        return value==null?null:value.stripTrailingZeros().toPlainString();
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/model/SelfopOutboundItem.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/model/SelfopOutboundItem.java
new file mode 100644
index 000000000..75da06354
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/model/SelfopOutboundItem.java
@@ -0,0 +1,23 @@
+package com.baiyue.lastleg.selfoperated.analytics.model;
+
+import com.baomidou.mybatisplus.annotation.IdType;
+import com.baomidou.mybatisplus.annotation.TableId;
+import com.baomidou.mybatisplus.annotation.TableName;
+import lombok.Data;
+import java.math.BigDecimal;
+import java.time.LocalDate;
+import java.time.LocalDateTime;
+
+@Data
+@TableName("ll_selfop_outbound_item")
+public class SelfopOutboundItem {
+    @TableId(type = IdType.ASSIGN_ID)
+    private Long id;
+    private LocalDateTime createdAt;
+    private LocalDateTime updatedAt;
+    private Long orderId;
+    private String skuCode;
+    private String productName;
+    private BigDecimal actualQuantity;
+    private String quantityUnit;
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/model/SelfopOutboundOrder.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/model/SelfopOutboundOrder.java
new file mode 100644
index 000000000..73d6482a6
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/model/SelfopOutboundOrder.java
@@ -0,0 +1,35 @@
+package com.baiyue.lastleg.selfoperated.analytics.model;
+
+import com.baomidou.mybatisplus.annotation.IdType;
+import com.baomidou.mybatisplus.annotation.TableId;
+import com.baomidou.mybatisplus.annotation.TableName;
+import lombok.Data;
+import java.math.BigDecimal;
+import java.time.LocalDate;
+import java.time.LocalDateTime;
+
+@Data
+@TableName("ll_selfop_outbound_order")
+public class SelfopOutboundOrder {
+    @TableId(type = IdType.ASSIGN_ID)
+    private Long id;
+    private LocalDateTime createdAt;
+    private LocalDateTime updatedAt;
+    private String sourceAccount;
+    private String customerCode;
+    private String warehouseCode;
+    private String deliveryNo;
+    private String sourceNo;
+    private Integer sourceStatus;
+    private String sourceCreatedTime;
+    private String sourceOutboundTime;
+    private String sourceTimezone;
+    private LocalDateTime outboundAtUtc;
+    private LocalDate businessDate;
+    private String businessTimezone;
+    private Integer salesEligible;
+    private Long revisionNo;
+    private String contentHash;
+    private Long lastRunId;
+    private Long lastObservationSequence;
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/model/SelfopPayloads.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/model/SelfopPayloads.java
new file mode 100644
index 000000000..0140d0965
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/model/SelfopPayloads.java
@@ -0,0 +1,20 @@
+package com.baiyue.lastleg.selfoperated.analytics.model;
+
+import java.math.BigDecimal;
+import java.util.List;
+
+public final class SelfopPayloads {
+    private SelfopPayloads() { }
+    public record Owner(String customerCode, String customerName, String status) { }
+    public record Product(String customerCode, String sku, String productName,
+        BigDecimal length, BigDecimal width, BigDecimal height, String sizeUnit,
+        BigDecimal wmsLength, BigDecimal wmsWidth, BigDecimal wmsHeight, String wmsSizeUnit) { }
+    public record Order(String sourceAccount, String customerCode, String warehouseCode,
+        String deliveryNo, String sourceNo, Integer sourceStatus, String sourceCreatedTime,
+        String sourceOutboundTime, List<Item> items) { }
+    public record Item(String skuCode, String productName, BigDecimal actualQuantity, String quantityUnit) { }
+    public record Stock(String sourceAccount, String customerCode, String warehouseCode,
+        String skuCode, Integer productQuality, String productName, BigDecimal physicalQuantity,
+        BigDecimal availableQuantity, BigDecimal frozenQuantity, BigDecimal transitQuantity,
+        String sourceUniqueKey) { }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/model/SelfopProgressProjection.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/model/SelfopProgressProjection.java
new file mode 100644
index 000000000..b09f14a31
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/model/SelfopProgressProjection.java
@@ -0,0 +1,122 @@
+package com.baiyue.lastleg.selfoperated.analytics.model;
+
+import java.nio.charset.StandardCharsets;
+import java.math.BigDecimal;
+import java.math.RoundingMode;
+import java.time.LocalDateTime;
+import java.time.ZoneOffset;
+import java.util.*;
+import static com.baiyue.lastleg.selfoperated.analytics.model.SelfopSupport.*;
+
+public final class SelfopProgressProjection {
+    private SelfopProgressProjection() { }
+    private static final Set<String> PHASES = Set.of("WAITING_SOURCE", "DIRECTORY", "DETAIL", "INVENTORY",
+        "VALIDATION", "MERGE", "BUILD", "PUBLISH", "WAITING", "SAMPLE_DONE", "FAILED", "CUSTOMERS", "PRODUCTS");
+    /** Pure projection for callers already holding the scope/task/run locks and fence. */
+    public static void applyCheckpoint(SelfopSyncTask task,SelfopSyncRun run,String phase,String unit,long completed,Long total,int scan) {
+        applyCheckpoint(task,run,phase,unit,completed,total,scan,true);
+    }
+    public static void applyCheckpoint(SelfopSyncTask task,SelfopSyncRun run,String phase,String unit,long completed,Long total,int scan,boolean realWork) {
+        require(PHASES.contains(phase),"SELFOP_PROGRESS_PHASE_INVALID");
+        require(Set.of("PAGE","ORDER","INVENTORY_ROW","BUSINESS_KEY","BATCH","NONE").contains(unit),"SELFOP_PROGRESS_UNIT_INVALID");
+        require(completed>=0 && scan>=0 && (total==null || total>=completed),"SELFOP_PROGRESS_COUNTS_INVALID");
+        Map<String,Object> p=progress(task);
+        if(!Objects.equals(number(p.get("attemptNo")),run.getAttemptNo().longValue())){
+            var prior=p;p=new LinkedHashMap<>();
+            if(prior.get("localWorkReady") instanceof Boolean
+                &&Objects.equals(prior.get("localWorkReadyScopeHash"),task.getScopeHash())
+                &&Objects.equals(prior.get("localWorkReadyUpstreamTaskId"),task.getUpstreamTaskId()==null?null:task.getUpstreamTaskId().toString()))
+                for(String key:List.of("localWorkReady","localWorkReadyScopeHash","localWorkReadyUpstreamTaskId"))p.put(key,prior.get(key));
+        }
+        String priorIdentity=SelfopStageEstimate.identity(p);
+        String countScope=scope(task); Object started=p.get("stageStartedAt");
+        if(!phase.equals(p.get("phase")) || started==null)started=instant(utcNow());
+        p.put("taskNo",task.getTaskNo());
+        p.put("attemptNo",run.getAttemptNo()); p.put("phase",phase); p.put("progressScope",countScope);
+        p.put("stageStartedAt",started); p.put("unit",unit); p.put("completed",completed);
+        p.put("total",total); p.put("totalKnown",total!=null); p.put("scanRound",scan); p.put("countBasis",Set.of("INVENTORY","BUILD").contains(phase)?"ATTEMPT_ONLY":"TASK_CUMULATIVE"); p.put("sliceFrom",instant(task.getQueryFromUtc())); p.put("sliceUntil",instant(task.getQueryUntilUtc())); p.put("stageFinishedAt",null);
+        if(!priorIdentity.equals(SelfopStageEstimate.identity(p)))p.put("stageStartedAt",instant(utcNow()));
+        SelfopStageEstimate.checkpoint(p,utcNow().toInstant(ZoneOffset.UTC),realWork);
+        // A zero denominator is meaningful evidence, but cannot produce a percentage.
+        p.put("phasePercent",total==null||total==0?null:BigDecimal.valueOf(completed).multiply(BigDecimal.valueOf(100))
+            .divide(BigDecimal.valueOf(total),1,RoundingMode.DOWN));
+        List<Map<String,Object>> stages=new ArrayList<>();
+        if(p.get("stages") instanceof List<?> prior)for(Object value:prior) {
+            var entry=map(value);
+            if(PHASES.contains(Objects.toString(entry.get("phase"),""))&&!phase.equals(entry.get("phase")))stages.add(entry);
+        }
+        var current=new LinkedHashMap<String,Object>();
+        for(String key:List.of("phase","unit","completed","total","totalKnown","scanRound","progressScope","countBasis",
+            "attemptNo","sliceFrom","sliceUntil","stageStartedAt","stageFinishedAt","phasePercent"))current.put(key,p.get(key));
+        stages.add(current);p.remove("phases");p.put("stages",stages);
+        task.setProgressJson(bounded(p));task.setProgressUpdatedAtUtc(utcNow());task.setUpdatedAt(utcNow());
+        run.setLastPhase(phase); run.setHeartbeatAtUtc(utcNow()); run.setUpdatedAt(utcNow());
+    }
+
+    /** Pure terminal snapshot; historical attempt evidence is immutable. */
+    public static void freezeRun(SelfopSyncTask task,SelfopSyncRun run) {
+        // A yielded inventory attempt resumes with the same attempt number. Its live
+        // sampling baseline must not survive a budget pause or execution interruption.
+        if(task.getProgressJson()!=null){
+            var live=progress(task);
+            if(Objects.equals(number(live.get("attemptNo")),run.getAttemptNo().longValue())&&live.remove("etaSamples")!=null)
+                task.setProgressJson(bounded(live));
+        }
+        if(run.getProgressSnapshotJson()!=null)return;
+        if(task.getProgressJson()==null) {
+            var fallback=new LinkedHashMap<String,Object>();fallback.put("attemptNo",run.getAttemptNo());
+            fallback.put("phase",run.getLastPhase()!=null&&PHASES.contains(run.getLastPhase())?run.getLastPhase():"WAITING");
+            fallback.put("progressScope",scope(task));fallback.put("countBasis","TASK_CUMULATIVE");fallback.put("scanRound",0);
+            fallback.put("unit","NONE");fallback.put("completed",0);fallback.put("total",null);fallback.put("totalKnown",false);
+            fallback.put("sliceFrom",instant(task.getQueryFromUtc()));fallback.put("sliceUntil",instant(task.getQueryUntilUtc()));
+            fallback.put("stageStartedAt",instant(run.getFetchStartedAtUtc()));fallback.put("stageFinishedAt",null);fallback.put("stages",List.of());
+            fallback.put("taskNo",task.getTaskNo());fallback.put("summaryAsOf",instant(utcNow()));
+            run.setProgressSnapshotJson(bounded(fallback));
+            return;
+        }
+        var p=progress(task);
+        // A later attempt's projection must never be copied into an earlier historical run.
+        require(Objects.equals(number(p.get("attemptNo")),run.getAttemptNo().longValue()),"SELFOP_PROGRESS_ATTEMPT_MISMATCH");
+        p.remove("etaSamples");p.put("summaryAsOf",instant(utcNow()));
+        run.setProgressSnapshotJson(bounded(p));run.setUpdatedAt(utcNow());
+    }
+
+    /** Route commits this proof together with its immutable effective-stage references. */
+    public static void localWorkReady(SelfopSyncTask task,boolean ready) {
+        var p=progress(task);p.put("localWorkReady",ready);
+        p.put("localWorkReadyScopeHash",task.getScopeHash());
+        p.put("localWorkReadyUpstreamTaskId",task.getUpstreamTaskId()==null?null:task.getUpstreamTaskId().toString());
+        task.setProgressJson(bounded(p));
+    }
+
+    private static String bounded(Map<String,Object> p) {
+        // Reserve the terminal timestamp before accepting a live checkpoint. Optional
+        // ETA and derived display fields never displace business/audit checkpoints.
+        int target=p.containsKey("summaryAsOf")?8192:8192-64;
+        String value=json(p);
+        if(bytes(value)>target){p.remove("etaSamples");value=json(p);}
+        if(bytes(value)>target){p.remove("phasePercent");value=json(p);}
+        if(bytes(value)>target&&p.get("stages") instanceof List<?> prior){
+            var stages=new ArrayList<Map<String,Object>>();
+            for(Object entry:prior){var stage=map(entry);stage.remove("phasePercent");stages.add(stage);}
+            p.put("stages",stages);value=json(p);
+            // The current top-level stage clock remains available. Duplicated stage
+            // display clocks can be omitted while retaining every stage count/identity.
+            if(bytes(value)>target){
+                for(var stage:stages){stage.remove("stageStartedAt");stage.remove("stageFinishedAt");}
+                value=json(p);
+            }
+        }
+        // A pre-existing legacy checkpoint may have used the whole 8 KiB with no
+        // optional display fields. Missing optional snapshot time is preferable to
+        // failing its business termination; never invent a replacement timestamp.
+        if(bytes(value)>8192&&p.containsKey("summaryAsOf")){p.remove("summaryAsOf");value=json(p);}
+        require(bytes(value)<=8192,"SELFOP_PROGRESS_TOO_LARGE");return value;
+    }
+    private static int bytes(String value){return value.getBytes(StandardCharsets.UTF_8).length;}
+    private static String scope(SelfopSyncTask task){return "ACCOUNT_DISCOVERY".equals(task.getTaskRole())?"ACCOUNT_SHARED":"WAREHOUSE";}
+    @SuppressWarnings("unchecked") private static Map<String,Object> progress(SelfopSyncTask task){return task.getProgressJson()==null?new LinkedHashMap<>():read(task.getProgressJson(),LinkedHashMap.class);}
+    @SuppressWarnings("unchecked") private static Map<String,Object> map(Object value){return value instanceof Map<?,?>?new LinkedHashMap<>((Map<String,Object>)value):new LinkedHashMap<>();}
+    private static Long number(Object value){return value instanceof Number n?n.longValue():null;}
+    private static String instant(LocalDateTime value){return value==null?null:value.toInstant(ZoneOffset.UTC).toString();}
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/model/SelfopRequestContext.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/model/SelfopRequestContext.java
new file mode 100644
index 000000000..c8fb94183
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/model/SelfopRequestContext.java
@@ -0,0 +1,15 @@
+package com.baiyue.lastleg.selfoperated.analytics.model;
+
+/** Collector-owned identity; no credentials or provider protocol live in this neutral model. */
+public record SelfopRequestContext(String sourceAccount,String executionPurpose,Long rootTaskId,
+    String sessionId,String exclusiveGrantId,Long taskId,Long runId) {
+    public static SelfopRequestContext forTask(SelfopSyncTask task,SelfopSyncRun run,SelfopAnalyticsProperties properties) {
+        Long root="VALIDATION".equals(task.getExecutionPurpose())?task.getValidationRootTaskId():task.getId();
+        if("BUSINESS".equals(task.getExecutionPurpose())&&"test".equals(properties.getEnvironment())) {
+            root=task.getBusinessRootTaskId();
+            SelfopSupport.require(root!=null,"BUSINESS_SESSION_ROOT_REQUIRED");
+        }
+        return new SelfopRequestContext(task.getSourceAccount(),task.getExecutionPurpose(),root,
+            "selfop-"+root,properties.getExclusiveGrantId(),task.getId(),run.getId());
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/model/SelfopRoutingManifest.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/model/SelfopRoutingManifest.java
new file mode 100644
index 000000000..10abe92fe
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/model/SelfopRoutingManifest.java
@@ -0,0 +1,29 @@
+package com.baiyue.lastleg.selfoperated.analytics.model;
+
+import lombok.Data;
+import java.util.LinkedHashMap;
+import java.util.Map;
+
+/** Durable directory cursor and effective immutable stage references. */
+@Data
+public class SelfopRoutingManifest {
+    private int listPayloadVersion;
+    private int scan = 1;
+    private int nextPage = 1;
+    private Integer pages;
+    private Long total;
+    private boolean directoryComplete;
+    private Map<String, Entry> objects = new LinkedHashMap<>();
+    private Map<String, String> firstScan = new LinkedHashMap<>();
+    @Data
+    public static class Entry {
+        private String customerCode;
+        private String deliveryNo;
+        private String warehouseCode;
+        private Long directoryStageId;
+        private Long effectiveStageId;
+        private Long refreshTaskId;
+        private Long newestSeenSequence;
+        private Long appliedStageId;
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/model/SelfopSalesCoverage.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/model/SelfopSalesCoverage.java
new file mode 100644
index 000000000..3a78b484a
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/model/SelfopSalesCoverage.java
@@ -0,0 +1,46 @@
+package com.baiyue.lastleg.selfoperated.analytics.model;
+
+import java.time.LocalDateTime;
+import java.util.*;
+import static com.baiyue.lastleg.selfoperated.analytics.model.SelfopSupport.*;
+
+/** Immutable union captured under the warehouse scope lock in the candidate's first transaction. */
+public final class SelfopSalesCoverage {
+    public static final String KEY="salesCoverageV1";
+    private SelfopSalesCoverage() { }
+    public record Interval(LocalDateTime from,LocalDateTime until) { }
+    public record Evidence(Long runId,Long scopeId,String scopeHash,List<Interval> intervals) { }
+    public static Map<String,Object> settings(String snapshot){
+        Map<String,Object> result=new LinkedHashMap<>();
+        if(snapshot!=null)read(snapshot,Map.class).forEach((k,v)->result.put(String.valueOf(k),v));
+        result.remove(KEY);return result;
+    }
+    public static void freeze(SelfopSyncRun run,List<Interval> intervals){
+        validate(intervals);var snapshot=settings(run.getScopeSnapshotJson());
+        snapshot.put(KEY,new Evidence(run.getId(),run.getScopeId(),run.getScopeHash(),List.copyOf(intervals)));
+        run.setScopeSnapshotJson(json(snapshot));
+    }
+    public static Evidence evidence(SelfopSyncRun run){
+        if(run==null||run.getScopeSnapshotJson()==null)return null;
+        Object value=read(run.getScopeSnapshotJson(),Map.class).get(KEY);if(value==null)return null;
+        var evidence=read(json(value),Evidence.class);
+        require(Objects.equals(run.getId(),evidence.runId())&&Objects.equals(run.getScopeId(),evidence.scopeId())
+            &&Objects.equals(run.getScopeHash(),evidence.scopeHash()),"SELFOP_COVERAGE_VERSION_INVALID");
+        validate(evidence.intervals());return evidence;
+    }
+    public static boolean contains(Evidence evidence,LocalDateTime from,LocalDateTime until){
+        return evidence!=null&&from!=null&&until!=null&&from.isBefore(until)&&evidence.intervals().stream()
+            .anyMatch(i->!i.from().isAfter(from)&&!i.until().isBefore(until));
+    }
+    public static void requireTask(SelfopSyncRun run,SelfopSyncTask task){
+        var proof=evidence(run);require(proof!=null&&!proof.intervals().isEmpty(),"SELFOP_COVERAGE_UNPROVEN");
+        if(task.getQueryFromUtc()!=null||task.getQueryUntilUtc()!=null)
+            require(contains(proof,task.getQueryFromUtc(),task.getQueryUntilUtc()),"SELFOP_TASK_COVERAGE_UNPROVEN");
+    }
+    private static void validate(List<Interval> intervals){
+        require(intervals!=null&&intervals.size()<=500,"SELFOP_COVERAGE_INTERVAL_LIMIT");
+        LocalDateTime last=null;
+        for(var i:intervals){require(i!=null&&i.from()!=null&&i.until()!=null&&i.from().isBefore(i.until())
+            &&(last==null||last.isBefore(i.from())),"SELFOP_COVERAGE_INTERVAL_INVALID");last=i.until();}
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/model/SelfopSkuDailySales.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/model/SelfopSkuDailySales.java
new file mode 100644
index 000000000..a28738009
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/model/SelfopSkuDailySales.java
@@ -0,0 +1,27 @@
+package com.baiyue.lastleg.selfoperated.analytics.model;
+
+import com.baomidou.mybatisplus.annotation.IdType;
+import com.baomidou.mybatisplus.annotation.TableId;
+import com.baomidou.mybatisplus.annotation.TableName;
+import lombok.Data;
+import java.math.BigDecimal;
+import java.time.LocalDate;
+import java.time.LocalDateTime;
+
+@Data
+@TableName("ll_selfop_sku_daily_sales")
+public class SelfopSkuDailySales {
+    @TableId(type = IdType.ASSIGN_ID)
+    private Long id;
+    private LocalDateTime createdAt;
+    private LocalDateTime updatedAt;
+    private Long salesRunId;
+    private String sourceAccount;
+    private String customerCode;
+    private String warehouseCode;
+    private String skuCode;
+    private LocalDate businessDate;
+    private BigDecimal outboundQuantity;
+    private Long outboundOrderCount;
+    private String quantityUnit;
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/model/SelfopSkuProfile.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/model/SelfopSkuProfile.java
new file mode 100644
index 000000000..8cf455a7c
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/model/SelfopSkuProfile.java
@@ -0,0 +1,30 @@
+package com.baiyue.lastleg.selfoperated.analytics.model;
+
+import com.baomidou.mybatisplus.annotation.IdType;
+import com.baomidou.mybatisplus.annotation.TableId;
+import com.baomidou.mybatisplus.annotation.TableName;
+import lombok.Data;
+import java.math.BigDecimal;
+import java.time.LocalDate;
+import java.time.LocalDateTime;
+
+@Data
+@TableName("ll_selfop_sku_profile")
+public class SelfopSkuProfile {
+    @TableId(type = IdType.ASSIGN_ID)
+    private Long id;
+    private LocalDateTime createdAt;
+    private LocalDateTime updatedAt;
+    private Long profileRunId;
+    private String sourceAccount;
+    private String customerCode;
+    private String warehouseCode;
+    private String skuCode;
+    private String productName;
+    private String quantityUnit;
+    private LocalDateTime firstSeenAtUtc;
+    private LocalDateTime earliestEvidenceAtUtc;
+    private String evidenceType;
+    private Long evidenceRunId;
+    private Long lastSeenRunId;
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/model/SelfopStageEstimate.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/model/SelfopStageEstimate.java
new file mode 100644
index 000000000..c2911d5f1
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/model/SelfopStageEstimate.java
@@ -0,0 +1,117 @@
+package com.baiyue.lastleg.selfoperated.analytics.model;
+
+import java.math.BigDecimal;
+import java.math.RoundingMode;
+import java.nio.charset.StandardCharsets;
+import java.time.Instant;
+import java.util.*;
+import static com.baiyue.lastleg.selfoperated.analytics.model.SelfopSupport.*;
+
+/** Bounded committed-checkpoint sampling; reads never manufacture progress. */
+public final class SelfopStageEstimate {
+    private SelfopStageEstimate() { }
+    public static final int WINDOW_SECONDS=180, MIN_SECONDS=60, MIN_ADVANCES=3,
+        BUCKET_SECONDS=10, MAX_POINTS=20, STALE_SECONDS=60, VALID_SECONDS=30, MAX_BYTES=1024;
+    public record Estimate(String status,String progressIdentity,Long completed,Long total,
+        Instant sampleFrom,Instant sampleUntil,Long completedDelta,BigDecimal ratePerSecond,
+        Long remainingSeconds,Instant estimatedAt,Instant validUntil,String unavailableReason) { }
+
+    public static String identity(Map<String,Object> p) {
+        var values=new ArrayList<Object>();
+        for(String key:List.of("taskNo","attemptNo","phase","scanRound","progressScope","unit",
+            "countBasis","sliceFrom","sliceUntil","total"))values.add(p.get(key));
+        return hash(values);
+    }
+
+    /** Reused count increases reset the baseline; unchanged bookkeeping is not new work. */
+    public static void checkpoint(Map<String,Object> p,Instant now,boolean realWork) {
+        try {
+            Long completed=number(p.get("completed")),total=number(p.get("total"));
+            if(total==null||total<=0||completed==null||completed<0||completed>=total||!Boolean.TRUE.equals(p.get("totalKnown"))||"NONE".equals(p.get("unit"))) {
+                p.remove("etaSamples");return;
+            }
+            String id=identity(p);long second=now.getEpochSecond();
+            var old=map(p.get("etaSamples"));var points=points(old.get("p"));
+            if(!id.equals(old.get("i"))||points.isEmpty()
+                ||!realWork&&!completed.equals(points.get(points.size()-1).get(1))
+                ||second<points.get(points.size()-1).get(0)
+                ||completed<points.get(points.size()-1).get(1)
+                ||second-numberOr(old.get("a"),second)>=STALE_SECONDS)points.clear();
+            points.removeIf(point->second-point.get(0)>WINDOW_SECONDS);
+            long advances=points.isEmpty()?0:points.get(points.size()-1).get(2);
+            long lastAdvance=numberOr(old.get("a"),second);
+            if(points.isEmpty()) {points.add(List.of(second,completed,0L));lastAdvance=second;}
+            else {
+                var last=points.get(points.size()-1);
+                if(completed>last.get(1)) {advances++;lastAdvance=second;}
+                var point=List.of(second,completed,advances);
+                if(last.get(0)/BUCKET_SECONDS==second/BUCKET_SECONDS)points.set(points.size()-1,point);
+                else points.add(point);
+            }
+            while(points.size()>MAX_POINTS)points.remove(0);
+            var sample=new LinkedHashMap<String,Object>();sample.put("i",id);sample.put("a",lastAdvance);sample.put("p",points);
+            while(json(sample).getBytes(StandardCharsets.UTF_8).length>MAX_BYTES&&points.size()>1)points.remove(0);
+            if(json(sample).getBytes(StandardCharsets.UTF_8).length<=MAX_BYTES)p.put("etaSamples",sample);
+            else p.remove("etaSamples");
+        } catch(RuntimeException malformedOptionalSample) {p.remove("etaSamples");}
+    }
+
+    public static Estimate estimate(Map<String,Object> p,Instant now,boolean healthy,boolean paused,boolean terminal) {
+        String id=identity(p);Long completed=number(p.get("completed")),total=number(p.get("total"));
+        String reason=terminal?"TERMINAL":paused?"PAUSED":!healthy?"HEALTH_UNCONFIRMED":
+            total==null||!Boolean.TRUE.equals(p.get("totalKnown"))?"TOTAL_UNKNOWN":completed==null||completed<0||total<completed||"NONE".equals(p.get("unit"))?"INVALID_PROGRESS":
+            total.equals(completed)?"COUNT_COMPLETE":null;
+        Instant from=null;Long delta=null;BigDecimal rate=null;Long remaining=null;Instant until=null;
+        try {
+            var sample=map(p.get("etaSamples"));var points=points(sample.get("p"));
+            if(reason==null&&(!id.equals(sample.get("i"))||points.isEmpty()))reason="SAMPLING";
+            if(reason==null) {
+                long second=now.getEpochSecond(),lastAdvance=numberOr(sample.get("a"),0);
+                // Select an anchor that stays inside the window through the read validity
+                // period, instead of expiring each time the oldest 10-second bucket rolls out.
+                points.removeIf(point->second-point.get(0)>WINDOW_SECONDS-VALID_SECONDS);
+                if(points.isEmpty()||second-lastAdvance>=STALE_SECONDS)reason="NO_RECENT_PROGRESS";
+                else {
+                    var first=points.get(0);var last=points.get(points.size()-1);
+                    long elapsed=second-first.get(0),advances=last.get(2)-first.get(2);
+                    if(second<last.get(0)||!completed.equals(last.get(1)))reason="INVALID_PROGRESS";
+                    else if(elapsed<MIN_SECONDS||advances<MIN_ADVANCES)reason="SAMPLING";
+                    else {
+                        delta=last.get(1)-first.get(1);
+                        if(delta<=0)reason="NO_RECENT_PROGRESS";
+                        else {
+                            from=Instant.ofEpochSecond(first.get(0));
+                            rate=BigDecimal.valueOf(delta).divide(BigDecimal.valueOf(elapsed),6,RoundingMode.DOWN);
+                            remaining=BigDecimal.valueOf(total-completed).multiply(BigDecimal.valueOf(elapsed))
+                                .divide(BigDecimal.valueOf(delta),0,RoundingMode.CEILING).longValueExact();
+                            until=Instant.ofEpochSecond(Math.min(second+VALID_SECONDS,Math.min(lastAdvance+STALE_SECONDS,first.get(0)+WINDOW_SECONDS)));
+                            if(!until.isAfter(now))reason="SAMPLE_EXPIRED";
+                        }
+                    }
+                }
+            }
+        } catch(RuntimeException malformedOptionalSample) {reason="INVALID_SAMPLE";}
+        if(reason!=null)return new Estimate(paused&&!terminal?"PAUSED":"UNAVAILABLE",id,completed,total,null,null,null,null,null,now,null,reason);
+        return new Estimate("AVAILABLE",id,completed,total,from,now,delta,rate,remaining,now,until,null);
+    }
+    private static Long number(Object value){
+        if(!(value instanceof Number))return null;
+        try{return new BigDecimal(value.toString()).longValueExact();}catch(RuntimeException invalid){return null;}
+    }
+    private static long numberOr(Object value,long fallback){Long n=number(value);return n==null?fallback:n;}
+    @SuppressWarnings("unchecked") private static Map<String,Object> map(Object value){return value instanceof Map<?,?>?(Map<String,Object>)value:Map.of();}
+    private static List<List<Long>> points(Object value) {
+        var result=new ArrayList<List<Long>>();
+        if(value instanceof List<?> list)for(Object item:list) {
+            if(!(item instanceof List<?> point)||point.size()!=3||result.size()>=MAX_POINTS)throw new IllegalArgumentException("Invalid bounded sample");
+            var parsed=List.of(Objects.requireNonNull(number(point.get(0))),Objects.requireNonNull(number(point.get(1))),Objects.requireNonNull(number(point.get(2))));
+            if(parsed.stream().anyMatch(n->n<0))throw new IllegalArgumentException("Negative sample");
+            if(!result.isEmpty()){
+                var prior=result.get(result.size()-1);
+                if(parsed.get(0)<=prior.get(0)||parsed.get(1)<prior.get(1)||parsed.get(2)<prior.get(2))throw new IllegalArgumentException("Nonmonotonic sample");
+            }
+            result.add(parsed);
+        }
+        return result;
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/model/SelfopStockFingerprint.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/model/SelfopStockFingerprint.java
new file mode 100644
index 000000000..8fea6a868
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/model/SelfopStockFingerprint.java
@@ -0,0 +1,23 @@
+package com.baiyue.lastleg.selfoperated.analytics.model;
+
+import java.math.BigDecimal;
+
+/** JSON storage may change numeric notation without changing inventory content. */
+public final class SelfopStockFingerprint {
+    private SelfopStockFingerprint() { }
+    private record Stock(String sourceAccount, String customerCode, String warehouseCode,
+        String skuCode, Integer productQuality, String productName, String physicalQuantity,
+        String availableQuantity, String frozenQuantity, String transitQuantity, String sourceUniqueKey) { }
+
+    public static String of(SelfopPayloads.Stock value) {
+        SelfopSupport.require(value != null, "SELFOP_STOCK_FINGERPRINT_MISSING");
+        return SelfopSupport.hash(new Stock(value.sourceAccount(), value.customerCode(), value.warehouseCode(),
+            value.skuCode(), value.productQuality(), value.productName(), quantity(value.physicalQuantity()),
+            quantity(value.availableQuantity()), quantity(value.frozenQuantity()), quantity(value.transitQuantity()),
+            value.sourceUniqueKey()));
+    }
+
+    private static String quantity(BigDecimal value) {
+        return value == null ? null : value.stripTrailingZeros().toPlainString();
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/model/SelfopSupport.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/model/SelfopSupport.java
new file mode 100644
index 000000000..f1d70465b
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/model/SelfopSupport.java
@@ -0,0 +1,37 @@
+package com.baiyue.lastleg.selfoperated.analytics.model;
+
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.fasterxml.jackson.databind.SerializationFeature;
+import java.nio.charset.StandardCharsets;
+import java.security.MessageDigest;
+import java.time.LocalDateTime;
+import java.time.ZoneOffset;
+import java.util.HexFormat;
+
+public final class SelfopSupport {
+    private static final ObjectMapper JSON = new ObjectMapper().findAndRegisterModules()
+        .disable(SerializationFeature.WRITE_DATES_AS_TIMESTAMPS)
+        .enable(SerializationFeature.ORDER_MAP_ENTRIES_BY_KEYS);
+    private SelfopSupport() { }
+    public static LocalDateTime utcNow() { return LocalDateTime.now(ZoneOffset.UTC); }
+    public static String json(Object value) {
+        try { return JSON.writeValueAsString(value); }
+        catch (Exception e) { throw new IllegalArgumentException("SELFOP_PAYLOAD_INVALID"); }
+    }
+    public static <T> T read(String value, Class<T> type) {
+        try { return JSON.readValue(value, type); }
+        catch (Exception e) { throw new IllegalArgumentException("SELFOP_PAYLOAD_INVALID"); }
+    }
+    public static String hash(Object value) {
+        try { return HexFormat.of().formatHex(MessageDigest.getInstance("SHA-256")
+            .digest(json(value).getBytes(StandardCharsets.UTF_8))); }
+        catch (Exception e) { throw new IllegalStateException("SELFOP_HASH_FAILED"); }
+    }
+    public static void require(boolean valid, String code) {
+        if (!valid) throw new IllegalStateException(code);
+    }
+    public static String identity(String value, int max) {
+        require(value != null && !value.isBlank() && value.length() <= max, "SELFOP_IDENTITY_INVALID");
+        return value;
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/model/SelfopSyncRun.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/model/SelfopSyncRun.java
new file mode 100644
index 000000000..3cfb91fe6
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/model/SelfopSyncRun.java
@@ -0,0 +1,57 @@
+package com.baiyue.lastleg.selfoperated.analytics.model;
+
+import com.baomidou.mybatisplus.annotation.IdType;
+import com.baomidou.mybatisplus.annotation.TableId;
+import com.baomidou.mybatisplus.annotation.TableName;
+import lombok.Data;
+import java.math.BigDecimal;
+import java.time.LocalDate;
+import java.time.LocalDateTime;
+
+@Data
+@TableName("ll_selfop_sync_run")
+public class SelfopSyncRun {
+    private String executionPurpose;
+    private LocalDateTime buildStartedAtUtc;
+    private Boolean warehouseDailyReady;
+    private LocalDateTime supersededAtUtc;
+    private String progressSnapshotJson;
+    private LocalDateTime heartbeatAtUtc;
+    @TableId(type = IdType.ASSIGN_ID)
+    private Long id;
+    private LocalDateTime createdAt;
+    private LocalDateTime updatedAt;
+    private Long taskId;
+    private Long scopeId;
+    private String sourceAccount;
+    private String warehouseCode;
+    private String runRole;
+    private Long upstreamTaskId;
+    private Integer attemptNo;
+    private String scopeHash;
+    private String scopeSnapshotJson;
+    private String observedDimensionsJson;
+    private Long fenceToken;
+    private Long basePublishedRunId;
+    private Long referenceSalesRunId;
+    private String status;
+    private String lastPhase;
+    private LocalDateTime fetchStartedAtUtc;
+    private LocalDateTime fetchFinishedAtUtc;
+    private LocalDate inventoryDailySampleDate;
+    private String inventorySampleRuleVersion;
+    private LocalDateTime finishedAtUtc;
+    private LocalDateTime publishedAtUtc;
+    private Integer pageCount;
+    private Long sourceTotalCount;
+    private Long uniqueObjectCount;
+    private String coverageStatus;
+    private LocalDateTime coveredFromUtc;
+    private LocalDateTime coveredUntilUtc;
+    private LocalDate completeDayFrom;
+    private LocalDate completeDayUntil;
+    private Long appliedFactRevision;
+    private Long calculatedFactRevision;
+    private String errorCode;
+    private String errorMessage;
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/model/SelfopSyncScope.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/model/SelfopSyncScope.java
new file mode 100644
index 000000000..7bebe65f9
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/model/SelfopSyncScope.java
@@ -0,0 +1,51 @@
+package com.baiyue.lastleg.selfoperated.analytics.model;
+
+import com.baomidou.mybatisplus.annotation.IdType;
+import com.baomidou.mybatisplus.annotation.TableId;
+import com.baomidou.mybatisplus.annotation.TableName;
+import lombok.Data;
+import java.math.BigDecimal;
+import java.time.LocalDate;
+import java.time.LocalDateTime;
+
+@Data
+@TableName("ll_selfop_sync_scope")
+public class SelfopSyncScope {
+    @TableId(type = IdType.ASSIGN_ID)
+    private Long id;
+    private LocalDateTime createdAt;
+    private LocalDateTime updatedAt;
+    private String sourceAccount;
+    private String warehouseCode;
+    private String dataFamily;
+    private String scopeJson;
+    private String scopeHash;
+    private String businessTimezone;
+    private String sourceTimezone;
+    private String scheduleCron;
+    private Integer staleAfterSeconds;
+    private String warehousePolicyRef;
+    private LocalDateTime initialFromUtc;
+    private LocalDateTime initialUntilUtc;
+    private LocalDateTime discoveryFromUtc;
+    private LocalDateTime discoveryUntilUtc;
+    private Long factRevision;
+    private Long publishedFactRevision;
+    private Integer rebuildRequired;
+    private LocalDateTime invalidatedAtUtc;
+    private Long publishedRunId;
+    private String leaseOwner;
+    private LocalDateTime leaseUntilUtc;
+    private Long fenceToken;
+    private Long knownOrderCursorId;
+    private Long knownOrderRoundMaxId;
+    private LocalDateTime knownOrderRoundStartedAtUtc;
+    private LocalDateTime knownOrderRoundFinishedAtUtc;
+    private LocalDateTime historyRoundFromUtc;
+    private LocalDateTime historyRoundUntilUtc;
+    private LocalDateTime historySliceCursorUtc;
+    private LocalDateTime historyRoundFinishedAtUtc;
+    private Integer reviewRequestBudget;
+    private Integer reviewTimeBudgetSeconds;
+    private Integer reviewTargetDays;
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/model/SelfopSyncStage.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/model/SelfopSyncStage.java
new file mode 100644
index 000000000..35ce63485
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/model/SelfopSyncStage.java
@@ -0,0 +1,33 @@
+package com.baiyue.lastleg.selfoperated.analytics.model;
+
+import com.baomidou.mybatisplus.annotation.IdType;
+import com.baomidou.mybatisplus.annotation.TableId;
+import com.baomidou.mybatisplus.annotation.TableName;
+import lombok.Data;
+import java.math.BigDecimal;
+import java.time.LocalDate;
+import java.time.LocalDateTime;
+
+@Data
+@TableName("ll_selfop_sync_stage")
+public class SelfopSyncStage {
+    @TableId(type = IdType.ASSIGN_ID)
+    private Long id;
+    private LocalDateTime createdAt;
+    private LocalDateTime updatedAt;
+    private Long runId;
+    private Long stageBatchId;
+    private Long lastFetchRunId;
+    private Long observationSequence;
+    private String warehouseCode;
+    private String previousWarehouseCode;
+    private String objectType;
+    private String objectKeyHash;
+    private Integer firstPageNo;
+    private LocalDateTime observedAtUtc;
+    private String contentHash;
+    private String payloadJson;
+    private String beforePayloadJson;
+    private String validationStatus;
+    private String validationCode;
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/model/SelfopSyncTask.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/model/SelfopSyncTask.java
new file mode 100644
index 000000000..bf537782c
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/model/SelfopSyncTask.java
@@ -0,0 +1,57 @@
+package com.baiyue.lastleg.selfoperated.analytics.model;
+
+import com.baomidou.mybatisplus.annotation.IdType;
+import com.baomidou.mybatisplus.annotation.TableId;
+import com.baomidou.mybatisplus.annotation.TableName;
+import com.baomidou.mybatisplus.annotation.TableField;
+import com.baomidou.mybatisplus.annotation.FieldStrategy;
+import lombok.Data;
+import java.math.BigDecimal;
+import java.time.LocalDate;
+import java.time.LocalDateTime;
+
+@Data
+@TableName("ll_selfop_sync_task")
+public class SelfopSyncTask {
+    private String taskNo;
+    private String executionPurpose;
+    private Long validationRootTaskId;
+    private String validationBudgetJson;
+    @TableField(updateStrategy = FieldStrategy.NEVER)
+    private Long businessRootTaskId;
+    // Only locked explicit budget SQL may update this counter; collector entities can be stale.
+    @TableField(updateStrategy = FieldStrategy.NEVER)
+    private String businessBudgetJson;
+    private Long resultPublishedRunId;
+    private String progressJson;
+    private LocalDateTime progressUpdatedAtUtc;
+    @TableId(type = IdType.ASSIGN_ID)
+    private Long id;
+    private LocalDateTime createdAt;
+    private LocalDateTime updatedAt;
+    private String sourceAccount;
+    private String taskRole;
+    private Long scopeId;
+    private String warehouseCode;
+    private Long discoveryScopeId;
+    private Long upstreamTaskId;
+    private Long discoverySequence;
+    private Long observationBaseline;
+    private String requestKey;
+    private String requestHash;
+    private String taskType;
+    private LocalDateTime plannedAtUtc;
+    private LocalDateTime queryFromUtc;
+    private LocalDateTime queryUntilUtc;
+    private String queryScopeJson;
+    private String routingManifestJson;
+    private String scopeHash;
+    private String status;
+    private String applyState;
+    private String affectedWarehouseCodesJson;
+    private LocalDateTime applyStartedAtUtc;
+    private LocalDateTime applyCompletedAtUtc;
+    private Integer attemptCount;
+    private LocalDateTime nextRetryAtUtc;
+    private String requestedBy;
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/outbound/OutboundAggregateMapper.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/outbound/OutboundAggregateMapper.java
new file mode 100644
index 000000000..210966b74
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/outbound/OutboundAggregateMapper.java
@@ -0,0 +1,213 @@
+package com.baiyue.lastleg.selfoperated.analytics.outbound;
+
+import com.baiyue.lastleg.selfoperated.analytics.model.*;
+import org.apache.ibatis.annotations.*;
+import java.time.LocalDate;
+import java.time.LocalDateTime;
+import java.util.List;
+
+/** Database aggregation, with bounded result and insert batches. No raw historical rows enter Java. */
+@Mapper
+public interface OutboundAggregateMapper {
+    @Select("""
+        SELECT MIN(from_at) AS covered_from_utc,MAX(until_at) AS covered_until_utc FROM (
+          SELECT from_at,until_at,SUM(CASE WHEN previous_until IS NULL OR from_at>previous_until THEN 1 ELSE 0 END)
+            OVER (ORDER BY from_at,until_at ROWS UNBOUNDED PRECEDING) AS island FROM (
+            SELECT from_at,until_at,MAX(until_at) OVER
+              (ORDER BY from_at,until_at ROWS BETWEEN UNBOUNDED PRECEDING AND 1 PRECEDING) AS previous_until FROM (
+              SELECT query_from_utc AS from_at,query_until_utc AS until_at FROM ll_selfop_sync_task
+              WHERE scope_id=#{scopeId} AND scope_hash=#{scopeHash} AND execution_purpose='BUSINESS'
+                AND validation_root_task_id IS NULL AND task_role='WAREHOUSE_SYNC' AND apply_state='APPLIED'
+                AND apply_completed_at_utc IS NOT NULL AND query_from_utc IS NOT NULL AND query_until_utc>query_from_utc
+                AND JSON_UNQUOTE(JSON_EXTRACT(routing_manifest_json,'$.directoryComplete'))='true'
+            ) accepted
+          ) ordered_intervals
+        ) islands GROUP BY island ORDER BY MIN(from_at) LIMIT 501
+        """)
+    List<SelfopSyncRun> provenCoverageIslands(@Param("scopeId") Long scopeId,@Param("scopeHash") String scopeHash);
+    @Select("""
+        SELECT COUNT(*) FROM ll_selfop_outbound_order o
+        LEFT JOIN ll_selfop_outbound_item i ON i.order_id=o.id
+        LEFT JOIN ll_selfop_sync_stage s ON s.observation_sequence=o.last_observation_sequence
+          AND s.warehouse_code=o.warehouse_code AND s.object_type='OUTBOUND_ORDER'
+          AND s.validation_status='VALID'
+          AND EXISTS (SELECT 1 FROM ll_selfop_sync_run origin WHERE origin.id=s.run_id AND origin.source_account=o.source_account)
+        LEFT JOIN ll_selfop_sync_run r ON r.id=s.run_id AND r.source_account=o.source_account
+        LEFT JOIN ll_selfop_sync_task t ON t.id=r.task_id
+        WHERE o.source_account=#{account} AND o.warehouse_code=#{warehouse} AND o.sales_eligible=1
+        AND (o.outbound_at_utc IS NULL OR o.business_date IS NULL
+          OR o.source_timezone IS NULL OR o.source_timezone != #{sourceTimezone}
+          OR o.business_timezone IS NULL OR o.business_timezone != #{businessTimezone}
+          OR i.id IS NULL OR i.actual_quantity IS NULL OR i.actual_quantity < 0
+          OR i.quantity_unit IS NULL OR i.quantity_unit != #{unit}
+          OR r.id IS NULL OR r.execution_purpose IS NULL OR r.execution_purpose != 'BUSINESS'
+          OR t.execution_purpose IS NULL OR t.execution_purpose != 'BUSINESS' OR t.validation_root_task_id IS NOT NULL)
+        """)
+    long invalidFacts(@Param("account") String account, @Param("warehouse") String warehouse,
+                      @Param("sourceTimezone") String sourceTimezone, @Param("businessTimezone") String businessTimezone,
+                      @Param("unit") String unit);
+
+    @Select("""
+        <script>
+        SELECT o.customer_code,i.sku_code,o.business_date,
+          SUM(i.actual_quantity) outbound_quantity,COUNT(DISTINCT o.id) outbound_order_count,
+          MAX(i.quantity_unit) quantity_unit
+        FROM ll_selfop_outbound_order o JOIN ll_selfop_outbound_item i ON i.order_id=o.id
+        WHERE o.source_account=#{account} AND o.warehouse_code=#{warehouse} AND o.sales_eligible=1
+        <if test='customer != null'>
+          AND (o.customer_code > #{customer} OR (o.customer_code=#{customer} AND i.sku_code > #{sku})
+            OR (o.customer_code=#{customer} AND i.sku_code=#{sku} AND o.business_date > #{date}))
+        </if>
+        GROUP BY o.customer_code,i.sku_code,o.business_date
+        ORDER BY o.customer_code,i.sku_code,o.business_date LIMIT 500
+        </script>
+        """)
+    List<SelfopSkuDailySales> dailyBatch(@Param("account") String account,@Param("warehouse") String warehouse,
+            @Param("customer") String customer,@Param("sku") String sku,@Param("date") LocalDate date);
+
+    @Select("""
+        <script>
+        SELECT customer_code,sku_code,MAX(product_name) product_name,MAX(quantity_unit) quantity_unit,
+          MIN(observed_at_utc) first_seen_at_utc,MIN(outbound_at_utc) earliest_evidence_at_utc,
+          MAX(CASE WHEN outbound_rank=1 THEN observation_run_id END) evidence_run_id,
+          MAX(CASE WHEN seen_rank=1 THEN observation_run_id END) last_seen_run_id
+        FROM (
+          SELECT /*+ JOIN_ORDER(o,i,s,r,t) INDEX(s idx_selfop_stage_fact_observation) */
+            o.customer_code,i.sku_code,i.product_name,i.quantity_unit,o.outbound_at_utc,
+            s.observed_at_utc,s.run_id observation_run_id,
+            ROW_NUMBER() OVER (PARTITION BY o.customer_code,i.sku_code ORDER BY o.outbound_at_utc,o.id) outbound_rank,
+            ROW_NUMBER() OVER (PARTITION BY o.customer_code,i.sku_code ORDER BY s.observed_at_utc DESC,s.id DESC) seen_rank
+          FROM ll_selfop_outbound_order o JOIN ll_selfop_outbound_item i ON i.order_id=o.id
+          JOIN ll_selfop_sync_stage s ON s.observation_sequence=o.last_observation_sequence
+            AND s.warehouse_code=o.warehouse_code AND s.object_type='OUTBOUND_ORDER' AND s.validation_status='VALID'
+          JOIN ll_selfop_sync_run r ON r.id=s.run_id AND r.source_account=o.source_account AND r.execution_purpose='BUSINESS'
+          JOIN ll_selfop_sync_task t ON t.id=r.task_id AND t.execution_purpose='BUSINESS' AND t.validation_root_task_id IS NULL
+          WHERE o.source_account=#{account} AND o.warehouse_code=#{warehouse} AND o.sales_eligible=1
+          <if test='customer != null'>
+            AND (o.customer_code > #{customer} OR (o.customer_code=#{customer} AND i.sku_code > #{sku}))
+          </if>
+        ) accepted
+        GROUP BY customer_code,sku_code ORDER BY customer_code,sku_code LIMIT 500
+        </script>
+        """)
+    List<SelfopSkuProfile> profileBatch(@Param("account") String account,@Param("warehouse") String warehouse,
+                                      @Param("customer") String customer,@Param("sku") String sku);
+
+    @Select("""
+        <script>
+        SELECT * FROM ll_selfop_sku_profile WHERE profile_run_id=#{runId}
+          <if test='customer != null'>AND (customer_code > #{customer} OR (customer_code=#{customer} AND sku_code > #{sku}))</if>
+        ORDER BY customer_code,sku_code LIMIT 500
+        </script>
+        """)
+    List<SelfopSkuProfile> publishedProfileBatch(@Param("runId") Long runId,@Param("customer") String customer,@Param("sku") String sku);
+
+    @Insert("""
+        <script>
+        INSERT INTO ll_selfop_sku_daily_sales
+        (id,created_at,updated_at,sales_run_id,source_account,customer_code,warehouse_code,sku_code,business_date,
+         outbound_quantity,outbound_order_count,quantity_unit) VALUES
+        <foreach collection='rows' item='r' separator=','>
+        (#{r.id},#{r.createdAt},#{r.updatedAt},#{r.salesRunId},#{r.sourceAccount},#{r.customerCode},#{r.warehouseCode},
+         #{r.skuCode},#{r.businessDate},#{r.outboundQuantity},#{r.outboundOrderCount},#{r.quantityUnit})
+        </foreach>
+        </script>
+        """)
+    int insertDaily(@Param("rows") List<SelfopSkuDailySales> rows);
+
+    @Insert("""
+        <script>
+        INSERT INTO ll_selfop_warehouse_daily_sales
+          (sales_run_id,source_account,warehouse_code,business_date,observed_quantity,invalid_row_count,source_row_count,created_at,updated_at)
+        SELECT sales_run_id,source_account,warehouse_code,business_date,
+          SUM(CASE WHEN quantity_unit='PCS' AND outbound_quantity &gt;= 0 THEN outbound_quantity END),
+          SUM(CASE WHEN quantity_unit='PCS' AND outbound_quantity &gt;= 0 THEN 0 ELSE 1 END),COUNT(*),MIN(created_at),MAX(updated_at)
+        FROM ll_selfop_sku_daily_sales WHERE id IN
+          <foreach collection='rows' item='r' open='(' separator=',' close=')'>#{r.id}</foreach>
+        GROUP BY sales_run_id,source_account,warehouse_code,business_date
+        ON DUPLICATE KEY UPDATE
+          observed_quantity=COALESCE(observed_quantity+VALUES(observed_quantity),observed_quantity,VALUES(observed_quantity)),
+          invalid_row_count=invalid_row_count+VALUES(invalid_row_count),
+          source_row_count=source_row_count+VALUES(source_row_count),updated_at=VALUES(updated_at)
+        </script>
+        """)
+    int insertWarehouseDaily(@Param("rows") List<SelfopSkuDailySales> rows);
+
+    @Select("SELECT COALESCE(SUM(source_row_count),0) FROM ll_selfop_warehouse_daily_sales WHERE sales_run_id=#{runId} AND source_account=#{account} AND warehouse_code=#{warehouse}")
+    long warehouseDailySourceRows(@Param("runId") Long runId,@Param("account") String account,@Param("warehouse") String warehouse);
+
+    @Delete("DELETE FROM ll_selfop_warehouse_daily_sales WHERE sales_run_id=#{runId}")
+    int deleteWarehouseDaily(@Param("runId") Long runId);
+
+    @Insert("""
+        <script>
+        INSERT INTO ll_selfop_sku_profile
+        (id,created_at,updated_at,profile_run_id,source_account,customer_code,warehouse_code,sku_code,product_name,
+         quantity_unit,first_seen_at_utc,earliest_evidence_at_utc,evidence_type,evidence_run_id,last_seen_run_id) VALUES
+        <foreach collection='rows' item='r' separator=','>
+        (#{r.id},#{r.createdAt},#{r.updatedAt},#{r.profileRunId},#{r.sourceAccount},#{r.customerCode},#{r.warehouseCode},
+         #{r.skuCode},#{r.productName},#{r.quantityUnit},#{r.firstSeenAtUtc},#{r.earliestEvidenceAtUtc},#{r.evidenceType},
+         #{r.evidenceRunId},#{r.lastSeenRunId})
+        </foreach>
+        </script>
+        """)
+    int insertProfiles(@Param("rows") List<SelfopSkuProfile> rows);
+
+    @Select("""
+        <script>
+        SELECT id,query_from_utc,query_until_utc FROM ll_selfop_sync_task WHERE scope_id=#{scopeId} AND scope_hash=#{scopeHash}
+          AND execution_purpose='BUSINESS' AND validation_root_task_id IS NULL AND task_role='WAREHOUSE_SYNC' AND apply_state='APPLIED'
+          AND query_from_utc IS NOT NULL AND query_until_utc IS NOT NULL
+          AND JSON_UNQUOTE(JSON_EXTRACT(routing_manifest_json,'$.directoryComplete'))='true'
+          <if test='id != null'>AND (query_from_utc > #{from} OR (query_from_utc=#{from} AND id > #{id}))</if>
+        ORDER BY query_from_utc,id LIMIT 500
+        </script>
+        """)
+    List<SelfopSyncTask> coverageBatch(@Param("scopeId") Long scopeId,@Param("scopeHash") String scopeHash,
+                                      @Param("from") LocalDateTime from,@Param("id") Long id);
+
+    @Select("""
+        SELECT MIN(query_from_utc) FROM ll_selfop_sync_task
+        WHERE scope_id=#{scopeId} AND scope_hash=#{scopeHash}
+          AND execution_purpose='BUSINESS' AND validation_root_task_id IS NULL AND task_role='WAREHOUSE_SYNC' AND apply_state='APPLIED'
+          AND query_from_utc IS NOT NULL AND query_until_utc > query_from_utc
+          AND JSON_UNQUOTE(JSON_EXTRACT(routing_manifest_json,'$.directoryComplete'))='true'
+        """)
+    LocalDateTime firstProvenCoverageFrom(@Param("scopeId") Long scopeId,@Param("scopeHash") String scopeHash);
+
+    @Select("""
+        <script>
+        SELECT CAST(#{initial} AS DATETIME) AS covered_from_utc,MAX(until_at) AS covered_until_utc
+        FROM (
+          SELECT from_at,until_at,SUM(CASE WHEN previous_until IS NULL OR from_at > previous_until THEN 1 ELSE 0 END)
+            OVER (ORDER BY from_at,until_at ROWS UNBOUNDED PRECEDING) AS island
+          FROM (
+            SELECT from_at,until_at,MAX(until_at)
+              OVER (ORDER BY from_at,until_at ROWS BETWEEN UNBOUNDED PRECEDING AND 1 PRECEDING) AS previous_until
+            FROM (
+              SELECT query_from_utc AS from_at,query_until_utc AS until_at FROM ll_selfop_sync_task
+              WHERE scope_id=#{scopeId} AND scope_hash=#{scopeHash} AND execution_purpose='BUSINESS' AND validation_root_task_id IS NULL AND task_role='WAREHOUSE_SYNC' AND apply_state='APPLIED'
+                AND query_from_utc IS NOT NULL AND query_until_utc > query_from_utc AND query_until_utc >= #{initial}
+                AND JSON_UNQUOTE(JSON_EXTRACT(routing_manifest_json,'$.directoryComplete'))='true'
+              UNION ALL SELECT CAST(#{initial} AS DATETIME),CAST(#{initial} AS DATETIME)
+              <if test='discoveryFrom != null and discoveryUntil != null'>
+                UNION ALL SELECT CAST(#{discoveryFrom} AS DATETIME),CAST(#{discoveryUntil} AS DATETIME)
+                  WHERE #{discoveryUntil} > #{discoveryFrom} AND #{discoveryUntil} >= #{initial}
+              </if>
+            ) AS intervals
+          ) AS with_previous
+        ) AS islands
+        GROUP BY island HAVING MIN(from_at) &lt;= #{initial} AND MAX(until_at) > #{initial}
+        </script>
+        """)
+    SelfopSyncRun contiguousCoverage(@Param("scopeId") Long scopeId,@Param("scopeHash") String scopeHash,
+            @Param("initial") LocalDateTime initial,@Param("discoveryFrom") LocalDateTime discoveryFrom,
+            @Param("discoveryUntil") LocalDateTime discoveryUntil);
+
+    @Select("""
+        SELECT COUNT(*) FROM ll_selfop_outbound_order WHERE source_account=#{account} AND warehouse_code=#{warehouse}
+          AND sales_eligible=1 AND updated_at >= #{buildStarted}
+        """)
+    long observationsChangedSince(@Param("account") String account,@Param("warehouse") String warehouse,
+                                  @Param("buildStarted") LocalDateTime buildStarted);
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/outbound/OutboundCandidateBuilder.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/outbound/OutboundCandidateBuilder.java
new file mode 100644
index 000000000..d11a7035e
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/outbound/OutboundCandidateBuilder.java
@@ -0,0 +1,29 @@
+package com.baiyue.lastleg.selfoperated.analytics.outbound;
+
+import com.baiyue.lastleg.selfoperated.analytics.model.SelfopSyncTask;
+import lombok.RequiredArgsConstructor;
+import org.springframework.stereotype.Service;
+import java.time.LocalDateTime;
+import java.util.*;
+
+/** Orchestration has no encompassing transaction: checkpoints and heartbeats commit after every batch. */
+@Service
+@RequiredArgsConstructor
+public class OutboundCandidateBuilder {
+    private final OutboundCandidateTransaction transaction;
+    public void build(Long scopeId,Long runId,String owner,long fence) {
+        OutboundCandidateTransaction.Checkpoint checkpoint=transaction.begin(scopeId,runId,owner,fence);
+        while(!"FINISH".equals(checkpoint.phase()) && !"DONE".equals(checkpoint.phase()))checkpoint=transaction.batch(scopeId,runId,owner,fence);
+        if("FINISH".equals(checkpoint.phase()))transaction.finish(scopeId,runId,owner,fence);
+    }
+    public Long reusable(Long scopeId,Long runId,String owner,long fence) {return transaction.reusable(scopeId,runId,owner,fence);}
+    public static Coverage contiguous(LocalDateTime initialFrom,List<Coverage> intervals) {
+        if(initialFrom==null)return new Coverage(null,null);LocalDateTime until=initialFrom;
+        for(Coverage interval:intervals.stream().filter(i->i.from()!=null && i.until()!=null && i.from().isBefore(i.until()))
+                .sorted(Comparator.comparing(Coverage::from)).toList()) {
+            if(interval.from().isAfter(until))break;if(interval.until().isAfter(until))until=interval.until();
+        }
+        return until.equals(initialFrom)?new Coverage(null,null):new Coverage(initialFrom,until);
+    }
+    public record Coverage(LocalDateTime from,LocalDateTime until) { }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/outbound/OutboundCandidateTransaction.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/outbound/OutboundCandidateTransaction.java
new file mode 100644
index 000000000..3c9802f5f
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/outbound/OutboundCandidateTransaction.java
@@ -0,0 +1,173 @@
+package com.baiyue.lastleg.selfoperated.analytics.outbound;
+
+import com.baiyue.lastleg.selfoperated.analytics.mapper.*;
+import com.baiyue.lastleg.selfoperated.analytics.model.*;
+import com.baomidou.mybatisplus.core.conditions.query.QueryWrapper;
+import com.baomidou.mybatisplus.core.toolkit.IdWorker;
+import lombok.RequiredArgsConstructor;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Isolation;
+import org.springframework.transaction.annotation.Transactional;
+import java.time.*;
+import java.util.*;
+
+/** Each public method is one committed bounded transaction, invoked through Spring's proxy by the facade. */
+@Service
+@RequiredArgsConstructor
+public class OutboundCandidateTransaction {
+    private final OutboundLockMapper locks;
+    private final OutboundFactService facts;
+    private final SelfopSyncRunMapper runs;
+    private final SelfopSyncTaskMapper tasks;
+    private final SelfopSyncScopeMapper scopes;
+    private final SelfopSkuDailySalesMapper daily;
+    private final SelfopSkuProfileMapper profiles;
+    private final OutboundAggregateMapper aggregates;
+    private final SelfopAnalyticsProperties config;
+
+    public record Checkpoint(Long runId,String phase,String customer,String sku,LocalDate date,long dailyRows,long profileRows,long committedBatches) { }
+    private record Held(SelfopSyncScope scope,SelfopSyncRun run,SelfopSyncTask task) { }
+
+    @Transactional(isolation=Isolation.REPEATABLE_READ,rollbackFor=Exception.class)
+    public Checkpoint begin(Long scopeId,Long runId,String owner,long fence) {
+        Held held=held(scopeId,runId,owner,fence,false);
+        SelfopSyncRun run=held.run(); SelfopSyncScope scope=held.scope();
+        SelfopSupport.require(!Set.of("PUBLISHED","REUSED","FAILED","DEAD").contains(run.getStatus()),"CANDIDATE_RUN_INVALID");
+        SelfopSupport.require("APPLIED".equals(held.task().getApplyState()) || "REBUILD".equals(held.task().getTaskType()),"TASK_NOT_APPLIED");
+        facts.assertNoBarrier(scope); validateFacts(scope);
+        if("READY".equals(run.getStatus())) {SelfopSupport.require(Boolean.TRUE.equals(run.getWarehouseDailyReady()),"WAREHOUSE_DAILY_NOT_READY");return new Checkpoint(runId,"DONE",null,null,null,0,0,0);}
+        Checkpoint existing=checkpoint(held.task());
+        if(run.getBuildStartedAtUtc()!=null && existing!=null && Objects.equals(existing.runId(),runId)) {
+            SelfopSupport.require("BUILDING".equals(run.getStatus()) && Objects.equals(scope.getFactRevision(),run.getCalculatedFactRevision()),"CANDIDATE_FACT_REVISION_CHANGED");
+            SelfopSupport.require(aggregates.observationsChangedSince(scope.getSourceAccount(),scope.getWarehouseCode(),run.getBuildStartedAtUtc())==0,"CANDIDATE_OBSERVATION_CHANGED");
+            return existing;
+        }
+        SelfopSupport.require(run.getBuildStartedAtUtc()==null,"CANDIDATE_CHECKPOINT_MISSING");
+        // A new attempt has a new run ID; failed attempts are never overwritten or emptied.
+        aggregates.deleteWarehouseDaily(runId);run.setWarehouseDailyReady(false);
+        daily.delete(new QueryWrapper<SelfopSkuDailySales>().eq("sales_run_id",runId));
+        profiles.delete(new QueryWrapper<SelfopSkuProfile>().eq("profile_run_id",runId));
+        OutboundCandidateBuilder.Coverage coverage=coverage(scope);
+        run.setBasePublishedRunId(scope.getPublishedRunId());
+        run.setCoveredFromUtc(coverage.from());run.setCoveredUntilUtc(coverage.until());
+        OutboundPolicy.DayCoverage days=OutboundPolicy.completeDays(coverage.from(),coverage.until(),scope.getBusinessTimezone());
+        run.setCompleteDayFrom(days.from());run.setCompleteDayUntil(days.until());run.setCoverageStatus(coverage.until()==null?"UNKNOWN":"COMPLETE");
+        run.setCalculatedFactRevision(scope.getFactRevision());run.setBuildStartedAtUtc(SelfopSupport.utcNow());run.setStatus("BUILDING");
+        SelfopSalesCoverage.freeze(run,provenIslands(scope));
+        Checkpoint result=new Checkpoint(runId,"DAILY",null,null,null,0,0,0);save(held,result);return result;
+    }
+
+    @Transactional(isolation=Isolation.REPEATABLE_READ,rollbackFor=Exception.class)
+    public Checkpoint batch(Long scopeId,Long runId,String owner,long fence) {
+        Held held=held(scopeId,runId,owner,fence,true); Checkpoint cursor=checkpoint(held.task());
+        SelfopSupport.require(cursor!=null && Objects.equals(runId,cursor.runId()),"CANDIDATE_CHECKPOINT_MISSING");
+        Checkpoint next;
+        if("DAILY".equals(cursor.phase())) {
+            List<SelfopSkuDailySales> rows=aggregates.dailyBatch(held.scope().getSourceAccount(),held.scope().getWarehouseCode(),cursor.customer(),cursor.sku(),cursor.date());
+            SelfopSupport.require(rows.size()<=500,"CANDIDATE_BATCH_LIMIT");
+            if(rows.isEmpty()) next=new Checkpoint(runId,"PROFILE",null,null,null,cursor.dailyRows(),0,cursor.committedBatches());
+            else {
+                for(var row:rows){row.setId(IdWorker.getId());row.setSalesRunId(runId);row.setSourceAccount(held.scope().getSourceAccount());row.setWarehouseCode(held.scope().getWarehouseCode());row.setCreatedAt(SelfopSupport.utcNow());row.setUpdatedAt(row.getCreatedAt());}
+                aggregates.insertDaily(rows);aggregates.insertWarehouseDaily(rows);var last=rows.get(rows.size()-1);
+                SelfopSupport.require(!Objects.equals(cursor.customer(),last.getCustomerCode()) || !Objects.equals(cursor.sku(),last.getSkuCode()) || !Objects.equals(cursor.date(),last.getBusinessDate()),"CANDIDATE_CURSOR_STALLED");
+                next=new Checkpoint(runId,"DAILY",last.getCustomerCode(),last.getSkuCode(),last.getBusinessDate(),cursor.dailyRows()+rows.size(),0,cursor.committedBatches()+1);
+            }
+        } else if("PROFILE".equals(cursor.phase())) {
+            List<SelfopSkuProfile> rows=aggregates.profileBatch(held.scope().getSourceAccount(),held.scope().getWarehouseCode(),cursor.customer(),cursor.sku());
+            SelfopSupport.require(rows.size()<=500,"CANDIDATE_BATCH_LIMIT");
+            if(rows.isEmpty()) next=new Checkpoint(runId,"FINISH",null,null,null,cursor.dailyRows(),cursor.profileRows(),cursor.committedBatches());
+            else {
+                for(var row:rows){row.setId(IdWorker.getId());row.setProfileRunId(runId);row.setSourceAccount(held.scope().getSourceAccount());row.setWarehouseCode(held.scope().getWarehouseCode());row.setEvidenceType("VALID_OUTBOUND");row.setCreatedAt(SelfopSupport.utcNow());row.setUpdatedAt(row.getCreatedAt());}
+                aggregates.insertProfiles(rows);var last=rows.get(rows.size()-1);
+                SelfopSupport.require(!Objects.equals(cursor.customer(),last.getCustomerCode()) || !Objects.equals(cursor.sku(),last.getSkuCode()),"CANDIDATE_CURSOR_STALLED");
+                next=new Checkpoint(runId,"PROFILE",last.getCustomerCode(),last.getSkuCode(),null,cursor.dailyRows(),cursor.profileRows()+rows.size(),cursor.committedBatches()+1);
+            }
+        } else {SelfopSupport.require("FINISH".equals(cursor.phase()),"CANDIDATE_PHASE_INVALID");return cursor;}
+        save(held,next);return next;
+    }
+
+    @Transactional(isolation=Isolation.REPEATABLE_READ,rollbackFor=Exception.class)
+    public void finish(Long scopeId,Long runId,String owner,long fence) {
+        Held held=held(scopeId,runId,owner,fence,true);Checkpoint cursor=checkpoint(held.task());
+        SelfopSupport.require(cursor!=null && Objects.equals(cursor.runId(),runId) && "FINISH".equals(cursor.phase()),"CANDIDATE_NOT_COMPLETE");
+        SelfopSupport.require(daily.selectCount(new QueryWrapper<SelfopSkuDailySales>().eq("sales_run_id",runId))==cursor.dailyRows()
+                && profiles.selectCount(new QueryWrapper<SelfopSkuProfile>().eq("profile_run_id",runId))==cursor.profileRows(),"CANDIDATE_ROWS_INCOMPLETE");
+        SelfopSupport.require(aggregates.warehouseDailySourceRows(runId,held.scope().getSourceAccount(),held.scope().getWarehouseCode())==cursor.dailyRows(),"WAREHOUSE_DAILY_ROWS_INCOMPLETE");
+        facts.assertNoBarrier(held.scope());held.run().setWarehouseDailyReady(true);held.run().setStatus("READY");save(held,new Checkpoint(runId,"DONE",null,null,null,cursor.dailyRows(),cursor.profileRows(),cursor.committedBatches()));
+    }
+
+    @Transactional(isolation=Isolation.REPEATABLE_READ,rollbackFor=Exception.class)
+    public Long reusable(Long scopeId,Long runId,String owner,long fence) {
+        Held held=held(scopeId,runId,owner,fence,false);SelfopSyncScope scope=held.scope();
+        SelfopSupport.require(!Set.of("PUBLISHED","REUSED","FAILED","DEAD").contains(held.run().getStatus()),"CANDIDATE_RUN_INVALID");
+        SelfopSupport.require("APPLIED".equals(held.task().getApplyState()) || "REBUILD".equals(held.task().getTaskType()),"TASK_NOT_APPLIED");
+        facts.assertNoBarrier(scope);validateFacts(scope);
+        if(scope.getPublishedRunId()==null)return null;
+        SelfopSyncRun published=runs.selectById(scope.getPublishedRunId());
+        if(published==null || !Boolean.TRUE.equals(published.getWarehouseDailyReady()) || !"PUBLISHED".equals(published.getStatus()) || !"BUSINESS".equals(published.getExecutionPurpose())
+                || published.getBuildStartedAtUtc()==null || !Objects.equals(scopeId,published.getScopeId()) || !Objects.equals(scope.getScopeHash(),published.getScopeHash())
+                || !Objects.equals(scope.getFactRevision(),published.getCalculatedFactRevision()) || !Objects.equals(scope.getFactRevision(),scope.getPublishedFactRevision())
+                || !Objects.equals(SelfopSalesCoverage.settings(held.run().getScopeSnapshotJson()),SelfopSalesCoverage.settings(published.getScopeSnapshotJson())))return null;
+        var proof=SelfopSalesCoverage.evidence(published);
+        if(proof==null||!Objects.equals(proof.intervals(),provenIslands(scope)))return null;
+        OutboundCandidateBuilder.Coverage next=coverage(scope);
+        if(!Objects.equals(next.from(),published.getCoveredFromUtc()) || !Objects.equals(next.until(),published.getCoveredUntilUtc()))return null;
+        // Content-identical accepted details still change receipt/run evidence; conservatively rebuild them.
+        return aggregates.observationsChangedSince(scope.getSourceAccount(),scope.getWarehouseCode(),published.getBuildStartedAtUtc())==0?published.getId():null;
+    }
+
+    private List<SelfopSalesCoverage.Interval> provenIslands(SelfopSyncScope scope){
+        var rows=aggregates.provenCoverageIslands(scope.getId(),scope.getScopeHash());
+        SelfopSupport.require(rows.size()<=500,"SELFOP_COVERAGE_INTERVAL_LIMIT");
+        return rows.stream().map(r->new SelfopSalesCoverage.Interval(r.getCoveredFromUtc(),r.getCoveredUntilUtc())).toList();
+    }
+    private Held held(Long scopeId,Long runId,String owner,long fence,boolean building) {
+        SelfopSyncScope scope=locks.scope(scopeId);LocalDateTime now=SelfopSupport.utcNow();
+        SelfopSupport.require(scope!=null && "OUTBOUND".equals(scope.getDataFamily()) && Objects.equals(scope.getLeaseOwner(),owner) && Objects.equals(scope.getFenceToken(),fence)
+                && scope.getLeaseUntilUtc()!=null && scope.getLeaseUntilUtc().isAfter(now),"LEASE_FENCE_REJECTED");
+        SelfopSyncRun run=locks.run(runId);SelfopCollectionPolicy.requireBusiness(run);
+        SelfopSyncTask task=locks.task(run.getTaskId());SelfopCollectionPolicy.requireBusiness(task);
+        SelfopSupport.require(Objects.equals(scopeId,run.getScopeId()) && Objects.equals(run.getFenceToken(),fence) && Objects.equals(scope.getScopeHash(),run.getScopeHash())
+                && "WAREHOUSE_SYNC".equals(run.getRunRole()) && Objects.equals(scopeId,task.getScopeId()) && Objects.equals(scope.getSourceAccount(),task.getSourceAccount())
+                && Objects.equals(scope.getWarehouseCode(),task.getWarehouseCode()) && Objects.equals(scope.getScopeHash(),task.getScopeHash()),"CANDIDATE_RUN_INVALID");
+        SelfopSupport.require(run.getStatus()!=null,"CANDIDATE_RUN_INVALID");
+        if(building) {
+            SelfopSupport.require("BUILDING".equals(run.getStatus()) && Objects.equals(scope.getFactRevision(),run.getCalculatedFactRevision()),"CANDIDATE_FACT_REVISION_CHANGED");
+            SelfopSupport.require(run.getBuildStartedAtUtc()!=null && aggregates.observationsChangedSince(scope.getSourceAccount(),scope.getWarehouseCode(),run.getBuildStartedAtUtc())==0,
+                    "CANDIDATE_OBSERVATION_CHANGED");
+        }
+        scope.setLeaseUntilUtc(now.plusSeconds(Math.max(10,config.getLeaseSeconds())));scope.setUpdatedAt(now);scopes.updateById(scope);
+        return new Held(scope,run,task);
+    }
+    private void validateFacts(SelfopSyncScope scope) {
+        Map<?,?> settings=SelfopSupport.read(scope.getScopeJson(),Map.class);String unit=settings.get("quantityUnit") instanceof String s?s:null;
+        SelfopSupport.require(scope.getSourceTimezone()!=null && !scope.getSourceTimezone().isBlank(),"SOURCE_TIMEZONE_UNCONFIRMED");
+        SelfopSupport.require(unit!=null && !unit.isBlank(),"QUANTITY_UNIT_UNCONFIRMED");
+        SelfopSupport.require(aggregates.invalidFacts(scope.getSourceAccount(),scope.getWarehouseCode(),scope.getSourceTimezone(),scope.getBusinessTimezone(),unit)==0,"FACT_TIME_UNIT_OR_EVIDENCE_INVALID");
+    }
+    private OutboundCandidateBuilder.Coverage coverage(SelfopSyncScope scope) {
+        // A manual first slice has no automatic backfill anchor. Only accepted, fully applied
+        // coverage may establish its start; an existing planned anchor must never move past gaps.
+        LocalDateTime initial=scope.getInitialFromUtc();
+        if(initial==null)initial=aggregates.firstProvenCoverageFrom(scope.getId(),scope.getScopeHash());
+        if(initial==null)return new OutboundCandidateBuilder.Coverage(null,null);
+        SelfopSyncRun result=aggregates.contiguousCoverage(scope.getId(),scope.getScopeHash(),initial,scope.getDiscoveryFromUtc(),scope.getDiscoveryUntilUtc());
+        return result==null?new OutboundCandidateBuilder.Coverage(null,null):new OutboundCandidateBuilder.Coverage(result.getCoveredFromUtc(),result.getCoveredUntilUtc());
+    }
+    private Checkpoint checkpoint(SelfopSyncTask task) {
+        if(task.getProgressJson()==null)return null;Map<?,?> progress=SelfopSupport.read(task.getProgressJson(),Map.class);Object value=progress.get("candidateBuild");
+        return value==null?null:SelfopSupport.read(SelfopSupport.json(value),Checkpoint.class);
+    }
+    private void save(Held held,Checkpoint checkpoint) {
+        LocalDateTime now=SelfopSupport.utcNow();
+        SelfopSupport.require(held.scope().getLeaseUntilUtc().isAfter(now),"LEASE_FENCE_REJECTED");
+        held.scope().setLeaseUntilUtc(now.plusSeconds(Math.max(10,config.getLeaseSeconds())));held.scope().setUpdatedAt(now);scopes.updateById(held.scope());
+        Map<String,Object> progress=new LinkedHashMap<>();
+        if(held.task().getProgressJson()!=null)SelfopSupport.read(held.task().getProgressJson(),Map.class).forEach((k,v)->progress.put(String.valueOf(k),v));
+        if(!(progress.get("attemptNo") instanceof Number attempt) || !Objects.equals(attempt.intValue(),held.run().getAttemptNo()))progress.clear();
+        progress.put("attemptNo",held.run().getAttemptNo());progress.put("candidateBuild",checkpoint);progress.remove("processedCount");
+        held.task().setProgressJson(SelfopSupport.json(progress));
+        SelfopProgressProjection.applyCheckpoint(held.task(),held.run(),"BUILD","BATCH",checkpoint.committedBatches(),null,0);
+        tasks.updateById(held.task());runs.updateById(held.run());
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/outbound/OutboundFactService.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/outbound/OutboundFactService.java
new file mode 100644
index 000000000..70f6c8c98
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/outbound/OutboundFactService.java
@@ -0,0 +1,245 @@
+package com.baiyue.lastleg.selfoperated.analytics.outbound;
+
+import com.baiyue.lastleg.selfoperated.analytics.mapper.*;
+import com.baiyue.lastleg.selfoperated.analytics.model.*;
+import com.baomidou.mybatisplus.core.conditions.query.QueryWrapper;
+import com.baomidou.mybatisplus.core.conditions.update.UpdateWrapper;
+import lombok.RequiredArgsConstructor;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Transactional;
+import java.time.*;
+import java.util.*;
+
+/** Short bounded transactions; all source requests must finish before entering this service. */
+@Service
+@RequiredArgsConstructor
+public class OutboundFactService {
+    private final OutboundLockMapper locks;
+    private final SelfopSyncTaskMapper tasks;
+    private final SelfopSyncRunMapper runs;
+    private final SelfopSyncScopeMapper scopes;
+    private final SelfopSyncStageMapper stages;
+    private final SelfopOutboundOrderMapper orders;
+    private final SelfopOutboundItemMapper items;
+
+    public record Lease(String owner, long fence) {}
+
+    @Transactional(rollbackFor = Exception.class)
+    public void merge(Long taskId, Long runId, List<Long> stageIds, Map<String, Lease> leases) {
+        SelfopSupport.require(stageIds != null && stageIds.size() <= 100, "MERGE_BATCH_LIMIT");
+        SelfopSyncTask preview = tasks.selectById(taskId);
+        SelfopSupport.require(preview != null, "TASK_MISSING");
+        SelfopCollectionPolicy.requireBusiness(preview);
+        // Discover the entire old/new lock set before touching facts. Recheck after order locks.
+        SortedSet<String> warehouses = affected(preview);
+        warehouses.add(preview.getWarehouseCode());
+        // Coordinator acquired this full old/new set from the entire stable routing manifest,
+        // not only this bounded segment. Register it before the first fact mutation.
+        warehouses.addAll(leases.keySet());
+        for (Long id : stageIds) {
+            SelfopSyncStage s = stages.selectById(id);
+            SelfopSupport.require(s != null, "STAGE_MISSING");
+            SelfopPayloads.Order p = SelfopSupport.read(s.getPayloadJson(),SelfopPayloads.Order.class);
+            warehouses.add(p.warehouseCode());
+            SelfopOutboundOrder old = findOrder(p);
+            if (old != null) warehouses.add(old.getWarehouseCode());
+        }
+        Map<String,SelfopSyncScope> held = lockScopes(preview.getSourceAccount(),warehouses,leases);
+        SelfopSyncTask task = locks.task(taskId);
+        SelfopSyncRun run = locks.run(runId);
+        validateTaskRun(task,run,held);
+        SelfopRoutingManifest manifest=SelfopSupport.read(task.getRoutingManifestJson(),SelfopRoutingManifest.class);
+        SelfopSupport.require(!"APPLIED".equals(task.getApplyState()), "TASK_ALREADY_APPLIED");
+        task.setAffectedWarehouseCodesJson(SelfopSupport.json(warehouses));
+        task.setApplyState("APPLYING");
+        if (task.getApplyStartedAtUtc() == null) task.setApplyStartedAtUtc(SelfopSupport.utcNow());
+        task.setUpdatedAt(SelfopSupport.utcNow()); tasks.updateById(task);
+        for (Long id : stageIds) {
+            SelfopSyncStage stage=locks.stage(id); applyOne(task,run,stage,held,manifest);
+            manifest.getObjects().get(stage.getObjectKeyHash()).setAppliedStageId(stage.getId());
+        }
+        task.setRoutingManifestJson(SelfopSupport.json(manifest));
+        mergeProgress(task,run,manifest);tasks.updateById(task);
+        run.setAppliedFactRevision(held.get(task.getWarehouseCode()).getFactRevision());
+        run.setUpdatedAt(SelfopSupport.utcNow()); runs.updateById(run);
+    }
+
+    /** The caller supplies the stable complete routing set, including refreshed effective references. */
+    @Transactional(rollbackFor = Exception.class)
+    public void finish(Long taskId, Long runId, List<Long> allEffectiveStageIds, Map<String,Lease> leases) {
+        SelfopSyncTask preview = tasks.selectById(taskId);
+        SelfopSupport.require(preview != null,"TASK_MISSING");
+        SelfopCollectionPolicy.requireBusiness(preview);
+        SortedSet<String> warehouseSet = affected(preview); warehouseSet.add(preview.getWarehouseCode());
+        Map<String,SelfopSyncScope> held = lockScopes(preview.getSourceAccount(),warehouseSet,leases);
+        SelfopSyncTask task = locks.task(taskId); SelfopSyncRun run = locks.run(runId);
+        validateTaskRun(task,run,held);
+        SelfopSupport.require(allEffectiveStageIds != null && new HashSet<>(allEffectiveStageIds).size() == allEffectiveStageIds.size(),"ROUTING_SET_INVALID");
+        SelfopRoutingManifest manifest = SelfopSupport.read(task.getRoutingManifestJson(),SelfopRoutingManifest.class);
+        SelfopSupport.require(manifest.isDirectoryComplete(),"CATALOG_NOT_COMPLETE");
+        Set<Long> required = new HashSet<>();
+        for(SelfopRoutingManifest.Entry entry : manifest.getObjects().values()) {
+            SelfopSupport.require(entry.getEffectiveStageId() != null,"DETAIL_RECHECK_REQUIRED");
+            required.add(entry.getEffectiveStageId());
+        }
+        SelfopSupport.require(required.equals(new HashSet<>(allEffectiveStageIds)),"ROUTING_SET_INCOMPLETE");
+        for (Long id : allEffectiveStageIds) {
+            SelfopSyncStage stage = locks.stage(id);
+            SelfopPayloads.Order p = validateStage(task, stage,manifest);
+            SelfopOutboundOrder order = locks.order(p.sourceAccount(),p.customerCode(),p.deliveryNo());
+            SelfopSupport.require(order != null && Objects.equals(order.getLastObservationSequence(),stage.getObservationSequence())
+                    && Objects.equals(order.getContentHash(),factHash(p,held.get(p.warehouseCode()))),"OBJECT_NOT_APPLIED");
+            manifest.getObjects().get(stage.getObjectKeyHash()).setAppliedStageId(stage.getId());
+        }
+        task.setApplyState("APPLIED"); task.setApplyCompletedAtUtc(SelfopSupport.utcNow());
+        task.setRoutingManifestJson(SelfopSupport.json(manifest));mergeProgress(task,run,manifest);
+        task.setUpdatedAt(SelfopSupport.utcNow()); tasks.updateById(task);
+        run.setStatus("FACTS_APPLIED");
+        run.setAppliedFactRevision(held.get(task.getWarehouseCode()).getFactRevision());
+        run.setUpdatedAt(SelfopSupport.utcNow()); runs.updateById(run);
+    }
+
+    public void assertNoBarrier(SelfopSyncScope scope) {
+        SelfopSupport.require(locks.barriers(scope.getSourceAccount(),scope.getWarehouseCode()).isEmpty(),"HALF_APPLIED_FACTS");
+    }
+
+    private void applyOne(SelfopSyncTask task, SelfopSyncRun run, SelfopSyncStage stage, Map<String,SelfopSyncScope> held,SelfopRoutingManifest manifest) {
+        SelfopPayloads.Order p = validateStage(task,stage,manifest);
+        SelfopSyncScope target = held.get(p.warehouseCode());
+        SelfopSupport.require(target != null,"LOCK_SET_CHANGED");
+        LocalDateTime utc = OutboundPolicy.outboundUtc(p,target);
+        String unit = unit(target);
+        for(SelfopPayloads.Item item : p.items()) SelfopSupport.require(Objects.equals(unit,item.quantityUnit()),"QUANTITY_UNIT_UNCONFIRMED");
+        SelfopOutboundOrder order = locks.order(p.sourceAccount(),p.customerCode(),p.deliveryNo());
+        SelfopSupport.require(order == null || held.containsKey(order.getWarehouseCode()),"LOCK_SET_CHANGED");
+        SelfopSupport.require(order == null || order.getLastObservationSequence() <= stage.getObservationSequence(),"DETAIL_RECHECK_REQUIRED");
+        String hash = factHash(p,target);
+        if(order != null && Objects.equals(order.getContentHash(),hash)) {
+            order.setLastRunId(run.getId()); order.setLastObservationSequence(stage.getObservationSequence());
+            order.setUpdatedAt(SelfopSupport.utcNow()); orders.updateById(order); return;
+        }
+        SelfopSupport.require(order == null || order.getLastObservationSequence() < stage.getObservationSequence(),"OBSERVATION_CONTENT_CONFLICT");
+        String oldWarehouse = order == null ? null : order.getWarehouseCode();
+        if(order != null && stage.getBeforePayloadJson() == null) {
+            Map<String,Object> before = new LinkedHashMap<>(); before.put("order",order);
+            before.put("items",items.selectList(new QueryWrapper<SelfopOutboundItem>().eq("order_id",order.getId()).orderByAsc("sku_code")));
+            stages.update(null,new UpdateWrapper<SelfopSyncStage>().eq("id",stage.getId())
+                    .isNull("before_payload_json").set("before_payload_json",SelfopSupport.json(before)).set("updated_at",SelfopSupport.utcNow()));
+        }
+        boolean fresh = order == null;
+        if(fresh) { order = new SelfopOutboundOrder(); order.setCreatedAt(SelfopSupport.utcNow()); order.setRevisionNo(1L); }
+        else order.setRevisionNo(order.getRevisionNo()+1);
+        order.setSourceAccount(p.sourceAccount()); order.setCustomerCode(p.customerCode()); order.setWarehouseCode(p.warehouseCode());
+        order.setDeliveryNo(p.deliveryNo()); order.setSourceNo(p.sourceNo()); order.setSourceStatus(p.sourceStatus());
+        order.setSourceCreatedTime(p.sourceCreatedTime()); order.setSourceOutboundTime(p.sourceOutboundTime());
+        order.setSourceTimezone(target.getSourceTimezone()); order.setBusinessTimezone(target.getBusinessTimezone());
+        order.setOutboundAtUtc(utc); order.setBusinessDate(utc == null ? null : utc.atZone(ZoneOffset.UTC).withZoneSameInstant(ZoneId.of(target.getBusinessTimezone())).toLocalDate());
+        order.setSalesEligible(Integer.valueOf(100).equals(p.sourceStatus()) ? 1 : 0);
+        order.setContentHash(hash); order.setLastRunId(run.getId()); order.setLastObservationSequence(stage.getObservationSequence());
+        order.setUpdatedAt(SelfopSupport.utcNow());
+        if(fresh) orders.insert(order);
+        else {
+            orders.updateById(order);
+            // Explicit nulls are meaningful for cancellation and corrections; MyBatis default ignores null entity fields.
+            orders.update(null,new UpdateWrapper<SelfopOutboundOrder>().eq("id",order.getId())
+                    .set("outbound_at_utc",order.getOutboundAtUtc()).set("business_date",order.getBusinessDate())
+                    .set("source_no",order.getSourceNo()).set("source_created_time",order.getSourceCreatedTime())
+                    .set("source_outbound_time",order.getSourceOutboundTime()));
+            items.delete(new QueryWrapper<SelfopOutboundItem>().eq("order_id",order.getId()));
+        }
+        for (SelfopPayloads.Item value : p.items()) {
+            SelfopOutboundItem item = new SelfopOutboundItem(); item.setOrderId(order.getId()); item.setSkuCode(value.skuCode());
+            item.setProductName(value.productName()); item.setActualQuantity(value.actualQuantity()); item.setQuantityUnit(value.quantityUnit());
+            item.setCreatedAt(SelfopSupport.utcNow()); item.setUpdatedAt(item.getCreatedAt()); items.insert(item);
+        }
+        Set<String> changed = new HashSet<>(); changed.add(p.warehouseCode()); if(oldWarehouse != null) changed.add(oldWarehouse);
+        for(String warehouse : changed) {
+            SelfopSyncScope scope = held.get(warehouse); scope.setFactRevision(scope.getFactRevision()+1);
+            scope.setRebuildRequired(1); scope.setInvalidatedAtUtc(SelfopSupport.utcNow()); scope.setUpdatedAt(SelfopSupport.utcNow()); scopes.updateById(scope);
+            if(oldWarehouse != null && !oldWarehouse.equals(p.warehouseCode())) rebuild(task,scope,order);
+        }
+    }
+
+    private void rebuild(SelfopSyncTask upstream,SelfopSyncScope scope,SelfopOutboundOrder order) {
+        String key = "rebuild:"+upstream.getId()+":"+order.getId()+":"+order.getRevisionNo()+":"+scope.getWarehouseCode();
+        if(tasks.selectCount(new QueryWrapper<SelfopSyncTask>().eq("source_account",scope.getSourceAccount()).eq("request_key",key)) > 0) return;
+        SelfopSyncTask task = new SelfopSyncTask(); task.setSourceAccount(scope.getSourceAccount());
+        task.setExecutionPurpose("BUSINESS"); task.setTaskNo("SO-"+com.baomidou.mybatisplus.core.toolkit.IdWorker.getId());
+        task.setTaskRole("WAREHOUSE_SYNC"); task.setScopeId(scope.getId()); task.setWarehouseCode(scope.getWarehouseCode());
+        task.setRequestKey(key); task.setRequestHash(SelfopSupport.hash(List.of(key,scope.getScopeHash())));
+        task.setTaskType("REBUILD"); task.setQueryScopeJson(scope.getScopeJson()); task.setScopeHash(scope.getScopeHash());
+        task.setStatus("READY"); task.setApplyState("NOT_APPLICABLE"); task.setAttemptCount(0);
+        task.setCreatedAt(SelfopSupport.utcNow()); task.setUpdatedAt(task.getCreatedAt()); tasks.insert(task);
+    }
+
+    private SelfopPayloads.Order validateStage(SelfopSyncTask task,SelfopSyncStage stage,SelfopRoutingManifest manifest) {
+        SelfopSupport.require(stage != null && "VALID".equals(stage.getValidationStatus())
+                && "OUTBOUND_ORDER".equals(stage.getObjectType()) && stage.getObservationSequence() != null,"DETAIL_NOT_VALID");
+        SelfopSyncRun sourceRun=runs.selectById(stage.getRunId());
+        SelfopCollectionPolicy.requireBusiness(sourceRun);
+        SelfopSyncTask sourceTask=tasks.selectById(sourceRun.getTaskId());
+        SelfopCollectionPolicy.requireBusiness(sourceTask);
+        SelfopSupport.require(Objects.equals(task.getSourceAccount(),sourceRun.getSourceAccount())
+                && Objects.equals(task.getSourceAccount(),sourceTask.getSourceAccount()),"STAGE_IDENTITY_CONFLICT");
+        SelfopPayloads.Order raw = SelfopSupport.read(stage.getPayloadJson(),SelfopPayloads.Order.class);
+        SelfopSupport.require(Objects.equals(stage.getContentHash(),SelfopOutboundFingerprint.order(raw)),"STAGE_CONTENT_CONFLICT");
+        SelfopPayloads.Order p = OutboundPolicy.normalize(raw);
+        SelfopRoutingManifest.Entry reference = manifest.getObjects().get(stage.getObjectKeyHash());
+        SelfopSupport.require(reference != null && Objects.equals(reference.getEffectiveStageId(),stage.getId()),"STAGE_NOT_ROUTED");
+        if(reference.getRefreshTaskId() != null) {
+            SelfopSyncTask refresh = tasks.selectById(reference.getRefreshTaskId());
+            SelfopSupport.require(refresh != null && "SUCCEEDED".equals(refresh.getStatus())
+                    && Objects.equals(stage.getStageBatchId(),reference.getRefreshTaskId()),"DETAIL_RECHECK_REQUIRED");
+        } else SelfopSupport.require(Objects.equals(stage.getStageBatchId(),task.getUpstreamTaskId()),"STAGE_BATCH_CONFLICT");
+        SelfopSupport.require(Objects.equals(task.getSourceAccount(),p.sourceAccount()) && Objects.equals(stage.getWarehouseCode(),p.warehouseCode()),"STAGE_IDENTITY_CONFLICT");
+        SelfopSupport.require(Objects.equals(stage.getObjectKeyHash(),SelfopSupport.hash(List.of(p.sourceAccount(),p.customerCode(),p.deliveryNo()))),"STAGE_KEY_CONFLICT");
+        SelfopSupport.require(stage.getObservationSequence() >= locks.newestObservation(p.sourceAccount(),stage.getObjectKeyHash()),"DETAIL_RECHECK_REQUIRED");
+        return p;
+    }
+    private void mergeProgress(SelfopSyncTask task,SelfopSyncRun run,SelfopRoutingManifest manifest) {
+        Set<Long> required=new HashSet<>(),applied=new HashSet<>();
+        boolean totalKnown=manifest.isDirectoryComplete();
+        for(SelfopRoutingManifest.Entry entry:manifest.getObjects().values()) {
+            if(entry.getEffectiveStageId()==null)totalKnown=false;
+            if(entry.getEffectiveStageId()!=null)required.add(entry.getEffectiveStageId());
+            if(entry.getEffectiveStageId()!=null && Objects.equals(entry.getEffectiveStageId(),entry.getAppliedStageId()))applied.add(entry.getAppliedStageId());
+        }
+        SelfopProgressProjection.applyCheckpoint(task,run,"MERGE","ORDER",applied.size(),totalKnown?(long)required.size():null,0);
+    }
+    private String factHash(SelfopPayloads.Order p,SelfopSyncScope scope) {
+        SelfopSupport.require(scope != null,"LOCK_SET_CHANGED");
+        return SelfopOutboundFingerprint.fact(p,scope.getBusinessTimezone(),scope.getSourceTimezone(),unit(scope));
+    }
+    private String unit(SelfopSyncScope scope) {
+        Map<?,?> json = SelfopSupport.read(scope.getScopeJson(),Map.class); Object value = json.get("quantityUnit");
+        SelfopSupport.require(value instanceof String && !((String)value).isBlank(),"QUANTITY_UNIT_UNCONFIRMED");
+        return (String)value;
+    }
+    private SelfopOutboundOrder findOrder(SelfopPayloads.Order p) {
+        return orders.selectOne(new QueryWrapper<SelfopOutboundOrder>().eq("source_account",p.sourceAccount())
+                .eq("customer_code",p.customerCode()).eq("delivery_no",p.deliveryNo()));
+    }
+    private SortedSet<String> affected(SelfopSyncTask task) {
+        SortedSet<String> values = new TreeSet<>();
+        if(task.getAffectedWarehouseCodesJson() != null) values.addAll(Arrays.asList(SelfopSupport.read(task.getAffectedWarehouseCodesJson(),String[].class)));
+        return values;
+    }
+    private Map<String,SelfopSyncScope> lockScopes(String account,SortedSet<String> warehouses,Map<String,Lease> leases) {
+        Map<String,SelfopSyncScope> held = new LinkedHashMap<>();
+        for(String warehouse : warehouses) {
+            SelfopSyncScope scope = locks.warehouse(account,warehouse); Lease lease = leases.get(warehouse);
+            SelfopSupport.require(scope != null && lease != null && Objects.equals(scope.getLeaseOwner(),lease.owner())
+                    && Objects.equals(scope.getFenceToken(),lease.fence()) && scope.getLeaseUntilUtc() != null
+                    && scope.getLeaseUntilUtc().isAfter(SelfopSupport.utcNow()),"LEASE_FENCE_REJECTED");
+            held.put(warehouse,scope);
+        }
+        return held;
+    }
+    private void validateTaskRun(SelfopSyncTask task,SelfopSyncRun run,Map<String,SelfopSyncScope> held) {
+        SelfopCollectionPolicy.requireBusiness(task); SelfopCollectionPolicy.requireBusiness(run);
+        SelfopSyncScope own = held.get(task.getWarehouseCode());
+        SelfopSupport.require(run != null && Objects.equals(run.getTaskId(),task.getId()) && Objects.equals(run.getScopeId(),task.getScopeId())
+                && Objects.equals(run.getScopeHash(),own.getScopeHash()) && Objects.equals(task.getScopeHash(),own.getScopeHash())
+                && Objects.equals(run.getFenceToken(),own.getFenceToken()) && !"PUBLISHED".equals(run.getStatus()),"RUN_SCOPE_FENCE_CONFLICT");
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/outbound/OutboundLockMapper.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/outbound/OutboundLockMapper.java
new file mode 100644
index 000000000..6df9490fc
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/outbound/OutboundLockMapper.java
@@ -0,0 +1,25 @@
+package com.baiyue.lastleg.selfoperated.analytics.outbound;
+
+import com.baiyue.lastleg.selfoperated.analytics.model.*;
+import org.apache.ibatis.annotations.*;
+import java.util.List;
+
+@Mapper
+public interface OutboundLockMapper {
+    @Select("SELECT * FROM ll_selfop_sync_scope WHERE id=#{id} FOR UPDATE")
+    SelfopSyncScope scope(@Param("id") Long id);
+    @Select("SELECT * FROM ll_selfop_sync_scope WHERE source_account=#{account} AND warehouse_code=#{warehouse} AND data_family='OUTBOUND' FOR UPDATE")
+    SelfopSyncScope warehouse(@Param("account") String account,@Param("warehouse") String warehouse);
+    @Select("SELECT * FROM ll_selfop_sync_task WHERE id=#{id} FOR UPDATE")
+    SelfopSyncTask task(@Param("id") Long id);
+    @Select("SELECT * FROM ll_selfop_sync_run WHERE id=#{id} FOR UPDATE")
+    SelfopSyncRun run(@Param("id") Long id);
+    @Select("SELECT * FROM ll_selfop_sync_stage WHERE id=#{id} FOR UPDATE")
+    SelfopSyncStage stage(@Param("id") Long id);
+    @Select("SELECT * FROM ll_selfop_outbound_order WHERE source_account=#{account} AND customer_code=#{customer} AND delivery_no=#{delivery} FOR UPDATE")
+    SelfopOutboundOrder order(@Param("account") String account,@Param("customer") String customer,@Param("delivery") String delivery);
+    @Select("SELECT COALESCE(MAX(observation_sequence),0) FROM ll_selfop_sync_stage s JOIN ll_selfop_sync_run r ON r.id=s.run_id JOIN ll_selfop_sync_task t ON t.id=r.task_id WHERE r.source_account=#{account} AND r.execution_purpose='BUSINESS' AND t.execution_purpose='BUSINESS' AND s.object_type='OUTBOUND_ORDER' AND s.object_key_hash=#{key} AND s.validation_status='VALID'")
+    Long newestObservation(@Param("account") String account,@Param("key") String key);
+    @Select("SELECT * FROM ll_selfop_sync_task WHERE source_account=#{account} AND apply_state IN ('APPLYING','BLOCKED') AND JSON_CONTAINS(affected_warehouse_codes_json,JSON_QUOTE(#{warehouse}))")
+    List<SelfopSyncTask> barriers(@Param("account") String account,@Param("warehouse") String warehouse);
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/outbound/OutboundPolicy.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/outbound/OutboundPolicy.java
new file mode 100644
index 000000000..a823c3e4c
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/outbound/OutboundPolicy.java
@@ -0,0 +1,87 @@
+package com.baiyue.lastleg.selfoperated.analytics.outbound;
+
+import com.baiyue.lastleg.selfoperated.analytics.model.SelfopSyncScope;
+import com.baiyue.lastleg.selfoperated.analytics.model.SelfopPayloads;
+import com.baiyue.lastleg.selfoperated.analytics.model.SelfopSupport;
+import java.math.BigDecimal;
+import java.time.*;
+import java.time.format.DateTimeFormatter;
+import java.util.*;
+
+/** Source strings are interpreted only after explicit source timezone and unit confirmation. */
+public final class OutboundPolicy {
+    private OutboundPolicy() {}
+    private static final DateTimeFormatter SOURCE = DateTimeFormatter.ofPattern("uuuu-MM-dd HH:mm:ss")
+            .withResolverStyle(java.time.format.ResolverStyle.STRICT);
+
+    public static SelfopPayloads.Order normalize(SelfopPayloads.Order p) {
+        text(p.sourceAccount(), 64); text(p.customerCode(), 64); text(p.warehouseCode(), 64);
+        text(p.deliveryNo(), 128);
+        optional(p.sourceNo(),128); optional(p.sourceCreatedTime(),64); optional(p.sourceOutboundTime(),64);
+        SelfopSupport.require(p.sourceStatus() != null, "SOURCE_STATUS_MISSING");
+        SelfopSupport.require(p.items() != null, "DETAIL_ITEMS_MISSING");
+        SelfopSupport.require(!Integer.valueOf(100).equals(p.sourceStatus()) || !p.items().isEmpty(), "OUTBOUND_ITEMS_EMPTY");
+        String quantityUnit = p.items().isEmpty() ? null : p.items().get(0).quantityUnit();
+        TreeMap<String, SelfopPayloads.Item> result = new TreeMap<>();
+        for (SelfopPayloads.Item item : p.items()) {
+            text(item.skuCode(),128); optional(item.productName(),255);
+            SelfopSupport.require(Objects.equals(quantityUnit, item.quantityUnit()) && item.quantityUnit() != null && !item.quantityUnit().isBlank(), "QUANTITY_UNIT_CONFLICT");
+            BigDecimal value = item.actualQuantity();
+            SelfopSupport.require(value != null && value.signum() >= 0 && value.scale() <= 6
+                    && value.precision() - value.scale() <= 14, "INVALID_ACTUAL_QUANTITY");
+            SelfopPayloads.Item old = result.get(item.skuCode());
+            BigDecimal sum = old == null ? value : old.actualQuantity().add(value);
+            SelfopSupport.require(sum.precision() - sum.scale() <= 14, "QUANTITY_OVERFLOW");
+            result.put(item.skuCode(), new SelfopPayloads.Item(item.skuCode(),
+                    old != null && old.productName() != null ? old.productName() : item.productName(),
+                    sum.stripTrailingZeros(), quantityUnit));
+        }
+        return new SelfopPayloads.Order(p.sourceAccount(),p.customerCode(),p.warehouseCode(),p.deliveryNo(),
+                p.sourceNo(),p.sourceStatus(),p.sourceCreatedTime(),p.sourceOutboundTime(), List.copyOf(result.values()));
+    }
+
+    public static LocalDateTime outboundUtc(SelfopPayloads.Order p, SelfopSyncScope scope) {
+        SelfopSupport.require(scope.getSourceTimezone() != null && !scope.getSourceTimezone().isBlank(),
+                "SOURCE_TIMEZONE_UNCONFIRMED");
+        if (!Integer.valueOf(100).equals(p.sourceStatus())) return null;
+        text(p.sourceOutboundTime(),64);
+        LocalDateTime local = LocalDateTime.parse(p.sourceOutboundTime(),SOURCE);
+        ZoneId zone = ZoneId.of(scope.getSourceTimezone());
+        List<ZoneOffset> offsets = zone.getRules().getValidOffsets(local);
+        SelfopSupport.require(offsets.size() == 1, "SOURCE_TIME_DST_AMBIGUOUS_OR_GAP");
+        return LocalDateTime.ofInstant(local.toInstant(offsets.get(0)),ZoneOffset.UTC);
+    }
+
+    /** Source API includes both endpoint seconds; new facts belong to exactly one internal slice.
+     * Unknown source timezone retains evidence only; caller must keep formal readiness closed.
+     * Known facts and explicit rechecks retain revisions even when corrected outside the old slice.
+     */
+    public static boolean belongsToSlice(SelfopPayloads.Order p, SelfopSyncScope scope,
+                                         LocalDateTime from, LocalDateTime until,
+                                         boolean knownOrder, String taskType) {
+        if(knownOrder || "RECHECK".equals(taskType) || !Integer.valueOf(100).equals(p.sourceStatus())) return true;
+        if(scope.getSourceTimezone() == null || scope.getSourceTimezone().isBlank()) return true;
+        if(from == null || until == null) return true;
+        SelfopSupport.require(from.isBefore(until),"OUTBOUND_SLICE_INVALID");
+        LocalDateTime observed = outboundUtc(p,scope);
+        return !observed.isBefore(from) && observed.isBefore(until);
+    }
+
+    public static DayCoverage completeDays(LocalDateTime from, LocalDateTime until, String timezone) {
+        if (from == null || until == null || !from.isBefore(until)) return new DayCoverage(null,null);
+        ZoneId zone = ZoneId.of(timezone);
+        ZonedDateTime start = from.atZone(ZoneOffset.UTC).withZoneSameInstant(zone);
+        ZonedDateTime end = until.atZone(ZoneOffset.UTC).withZoneSameInstant(zone);
+        LocalDate first = start.toLocalDate();
+        if (!start.toInstant().equals(first.atStartOfDay(zone).toInstant())) first = first.plusDays(1);
+        LocalDate last = end.toLocalDate();
+        return first.isAfter(last) ? new DayCoverage(null,null) : new DayCoverage(first,last);
+    }
+    public record DayCoverage(LocalDate from, LocalDate until) {}
+    private static void optional(String value,int max) {
+        SelfopSupport.require(value == null || value.length() <= max,"IDENTITY_TOO_LONG");
+    }
+    private static void text(String value,int max) {
+        SelfopSupport.require(value != null && !value.isBlank() && value.length() <= max,"IDENTITY_OR_UNIT_MISSING");
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/AnalyticsInventoryOptions.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/AnalyticsInventoryOptions.java
new file mode 100644
index 000000000..bf7955124
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/AnalyticsInventoryOptions.java
@@ -0,0 +1,38 @@
+package com.baiyue.lastleg.selfoperated.analytics.query;
+
+import com.baiyue.common.core.exception.BizException;
+import java.util.Set;
+
+/** Endpoint-specific inventory presentation, separate from immutable version/date identity. */
+public record AnalyticsInventoryOptions(String keyword,String attention,String sortBy,Integer coverageDaysThreshold,
+    String coverageBucket,String bucketRuleVersion,String coverageSelection,String drilldownFrom,
+    Integer salesWindowDays,@org.springframework.format.annotation.DateTimeFormat(iso=org.springframework.format.annotation.DateTimeFormat.ISO.DATE) java.time.LocalDate salesWindowEndDate) {
+    public int salesDays(){return salesWindowDays==null?30:salesWindowDays;}
+    public String attentionValue(){return attention==null?"ALL":attention;}
+    public String sortValue(){return sortBy==null?"AVAILABLE_DESC":sortBy;}
+    public String keywordPattern(){return keyword==null?null:keyword.replace("!","!!").replace("%","!%").replace("_","!_")+"%";}
+    public void validate(String endpoint,AnalyticsQuery q){
+        CoverageDistributionPolicy.validate(this);
+        if("DASHBOARD".equals(drilldownFrom)&&(salesWindowDays!=null||salesWindowEndDate!=null||!"CUSTOM".equals(q.rangePreset())||q.startDate()==null||q.endDate()==null))
+            throw new BizException("总览库存下钻须携带原图起止日期，不能混用库存窗口");
+        if(salesDays()<1||salesDays()>366)throw new BizException("库存销量窗口须为1至366个完整自然日");
+        if(!"INVENTORY".equals(endpoint)&&(salesWindowDays!=null||salesWindowEndDate!=null))throw new BizException("销量窗口仅用于库存明细");
+        if(!"INVENTORY".equals(endpoint)&&(coverageBucket!=null||coverageSelection!=null||drilldownFrom!=null))throw new BizException("分布下钻条件仅用于库存明细");
+        if(coverageDaysThreshold!=null&&coverageDaysThreshold<=0)throw new BizException("可售天数阈值必须为正整数");
+        if(!Set.of("ALL","NO_OUTBOUND_IN_WINDOW","COVERAGE_GT_THRESHOLD","FROZEN_STOCK","DEFECTIVE_STOCK","UNASSESSABLE").contains(attentionValue()))throw new BizException("库存关注条件无效");
+        if(!Set.of("AVAILABLE_ASC","AVAILABLE_DESC","COVERAGE_DAYS_ASC","COVERAGE_DAYS_DESC",
+            "PHYSICAL_ASC","PHYSICAL_DESC","FROZEN_ASC","FROZEN_DESC","DEFECTIVE_ASC","DEFECTIVE_DESC",
+            "TRANSIT_ASC","TRANSIT_DESC","OUTBOUND_ASC","OUTBOUND_DESC","AVERAGE_DAILY_ASC","AVERAGE_DAILY_DESC").contains(sortValue()))throw new BizException("库存排序无效");
+        if("COVERAGE_GT_THRESHOLD".equals(attentionValue())&&coverageDaysThreshold==null)throw new BizException("超过可售天数筛选必须指定阈值");
+        if("OWNERS".equals(endpoint)){
+            if(keyword!=null&&(keyword.isBlank()||keyword.length()>64))throw new BizException("货主编码前缀不能为空或超长");
+            if(q.customerCode()!=null||q.sku()!=null||attention!=null||sortBy!=null||coverageDaysThreshold!=null)throw new BizException("货主选项仅接受编码前缀与分页");
+        }else{
+            if(keyword!=null)throw new BizException("此接口不接受货主前缀");
+            if("OVERVIEW".equals(endpoint)){
+                AnalyticsQuery.text(q.customerCode(),64,"货主");
+                if(q.sku()!=null||q.current()!=null||q.size()!=null||attention!=null||sortBy!=null)throw new BizException("货主概览不接受SKU、关注、排序或分页条件");
+            }
+        }
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/AnalyticsInventorySql.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/AnalyticsInventorySql.java
new file mode 100644
index 000000000..87d711c6c
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/AnalyticsInventorySql.java
@@ -0,0 +1,142 @@
+package com.baiyue.lastleg.selfoperated.analytics.query;
+
+import java.util.Map;
+
+/** Immutable, one-scope SQL. Qualities and days aggregate independently before joining SKU keys. */
+public final class AnalyticsInventorySql {
+    private AnalyticsInventorySql(){}
+    private static String scope(AnalyticsSqlRequest p){return scope(p,"");}
+    private static String scope(AnalyticsSqlRequest p,String prefix){
+        return " "+prefix+"source_account=#{p.account} AND "+prefix+"warehouse_code=#{p.warehouse}"
+            +(p.customer()==null?"":" AND "+prefix+"customer_code=#{p.customer}")+(p.sku()==null?"":" AND "+prefix+"sku_code=#{p.sku}");
+    }
+    private static String keys(AnalyticsSqlRequest p){return "SELECT customer_code,sku_code FROM ll_selfop_sku_profile WHERE profile_run_id=#{p.salesRun} AND"+scope(p)
+        +" UNION SELECT customer_code,sku_code FROM ll_selfop_sku_profile WHERE profile_run_id=#{p.inventoryRun} AND"+scope(p);}
+    private static String valid(String field){return field+" IS NOT NULL AND "+field+">=0 AND (quality_status='VALID' OR quality_reason IN ('FIELD_MISSING','NEGATIVE_QUANTITY'))";}
+    private static String quantity(String field){return "CASE WHEN MIN(CASE WHEN "+valid(field)+" THEN 1 ELSE 0 END)=1 THEN SUM("+field+") END";}
+    static String availableQuantity(String validAvailable){
+        // A published full snapshot can contain only a valid, empty defective row.
+        // Do not confuse that known zero with a missing or invalid normal-quality row.
+        return "CASE WHEN MIN(CASE WHEN product_quality=1 AND quality_status='VALID' AND physical_quantity=0 AND available_quantity=0 AND frozen_quantity=0 THEN 1 ELSE 0 END)=1 THEN 0 "
+            +"ELSE MAX(CASE WHEN product_quality=0 AND "+validAvailable+" THEN available_quantity END) END";
+    }
+    private static String defectiveQuantity(){return "CASE WHEN MIN(CASE WHEN product_quality NOT IN (0,1) THEN 0 WHEN product_quality=1 THEN CASE WHEN "+valid("physical_quantity")+" THEN 1 ELSE 0 END ELSE 1 END)=1 "
+        +"THEN SUM(CASE WHEN product_quality=1 THEN physical_quantity ELSE 0 END) END";}
+    static String cte(AnalyticsSqlRequest p){return cte(p,false);}
+    static String dashboardCte(AnalyticsSqlRequest p){return cte(p,false,true);}
+    private static String cte(AnalyticsSqlRequest p,boolean stockFirst){return cte(p,stockFirst,false);}
+    private static String cte(AnalyticsSqlRequest p,boolean stockFirst,boolean dashboard){
+        String days=("INVENTORY".equals(p.kind())||"DASHBOARD".equals(p.kind())||"HOT_DASHBOARD".equals(p.kind()))?Long.toString(java.time.temporal.ChronoUnit.DAYS.between(p.from(),p.until())):"30";
+        String complete=("INVENTORY".equals(p.kind())||"DASHBOARD".equals(p.kind())||"HOT_DASHBOARD".equals(p.kind()))?"#{p.completeWindow}":"#{p.complete30}";
+        return "WITH candidates AS ("+keys(p)+"), profiles AS (SELECT c.customer_code,c.sku_code,COALESCE(i.product_name,s.product_name) product_name,"
+            +"CASE WHEN i.quantity_unit='PCS' THEN 1 ELSE 0 END stock_unit_valid,"
+            +"CASE WHEN s.sku_code IS NULL OR s.quantity_unit='PCS' THEN 1 ELSE 0 END sales_unit_valid,"
+            +"CASE WHEN (s.sku_code IS NULL OR s.quantity_unit='PCS') AND (i.sku_code IS NULL OR i.quantity_unit='PCS') THEN 1 ELSE 0 END unit_valid,"
+            +"CASE WHEN s.evidence_type='VALID_OUTBOUND' AND s.evidence_run_id IS NOT NULL THEN s.earliest_evidence_at_utc END sales_evidence,"
+            +"CASE WHEN i.evidence_type='INVENTORY_OBSERVATION' AND i.evidence_run_id IS NOT NULL THEN i.earliest_evidence_at_utc END stock_evidence "
+            +"FROM candidates c LEFT JOIN ll_selfop_sku_profile s ON s.profile_run_id=#{p.salesRun} AND s.source_account=#{p.account} AND s.warehouse_code=#{p.warehouse} AND s.customer_code=c.customer_code AND s.sku_code=c.sku_code "
+            +"LEFT JOIN ll_selfop_sku_profile i ON i.profile_run_id=#{p.inventoryRun} AND i.source_account=#{p.account} AND i.warehouse_code=#{p.warehouse} AND i.customer_code=c.customer_code AND i.sku_code=c.sku_code),"
+            +" stock AS (SELECT customer_code,sku_code,"+quantity("physical_quantity")+" physical_quantity,"+quantity("frozen_quantity")+" frozen_quantity,"
+            +quantity("transit_quantity")+" transit_quantity,"+availableQuantity(valid("available_quantity"))+" available_quantity,"
+            +defectiveQuantity()+" defective_physical_quantity,MAX(observed_at_utc) observed_at_utc "
+            +"FROM ll_selfop_inventory_snapshot WHERE "+(dashboard&&!p.stockFresh()?"1=0 /* dashboard unused stock */ AND ":"")
+            +"snapshot_run_id=#{p.inventoryRun} AND"+scope(p)+" GROUP BY customer_code,sku_code),"
+            +(stockFirst?stockPageKeys():"")
+            +salesCte(p,stockFirst,dashboard&&!"HOT_DASHBOARD".equals(p.kind())&&!p.completeWindow())
+            +" values_by_sku AS (SELECT c.customer_code,c.sku_code,c.product_name,c.unit_valid,"
+            +"CASE WHEN c.sales_evidence IS NULL THEN c.stock_evidence WHEN c.stock_evidence IS NULL THEN c.sales_evidence ELSE LEAST(c.sales_evidence,c.stock_evidence) END evidence_at_utc,"
+            +stockValue("physical_quantity")+","+stockValue("available_quantity")+","+stockValue("frozen_quantity")+","+stockValue("transit_quantity")+","+stockValue("defective_physical_quantity")+",st.observed_at_utc,"
+            +("HOT_DASHBOARD".equals(p.kind())?"CASE WHEN c.sales_unit_valid=1 AND COALESCE(s.unit_valid,1)=1 AND #{p.salesKnown}=1 THEN CASE WHEN #{p.completeWindow}=1 THEN COALESCE(s.observed_quantity,0) ELSE s.observed_quantity END END owner_outbound,":
+            "CASE WHEN c.sales_unit_valid=1 AND COALESCE(s.unit_valid,1)=1 AND "+complete+"=1 THEN COALESCE(s.observed_quantity,0) END owner_outbound,")
+            +"CASE WHEN c.sales_unit_valid=1 AND COALESCE(s.unit_valid,1)=1 AND #{p.salesKnown}=1 THEN s.observed_quantity END observed_outbound,s.order_count "
+            +"FROM profiles c "+(stockFirst?"JOIN stock_paged pk ON pk.customer_code=c.customer_code AND pk.sku_code=c.sku_code ":"")
+            +"LEFT JOIN stock st ON st.customer_code=c.customer_code AND st.sku_code=c.sku_code LEFT JOIN sales s ON s.customer_code=c.customer_code AND s.sku_code=c.sku_code),"
+            +" qualified AS (SELECT v.*,CASE WHEN evidence_at_utc<=CONVERT_TZ(CAST(#{p.from} AS DATETIME),'+08:00','+00:00') THEN 1 ELSE 0 END observation_eligible,"
+            // Complete source coverage proves actual window sales independently of SKU observation age.
+            +"CASE WHEN unit_valid=1 THEN owner_outbound END outbound_quantity30d FROM values_by_sku v),"
+            +" calculated AS (SELECT q.*,CASE WHEN available_quantity=0 THEN 0 WHEN available_quantity>0 AND outbound_quantity30d>0 THEN available_quantity*"+days+"/outbound_quantity30d END coverage_days,"
+            +"CASE WHEN physical_quantity=0 THEN 0 WHEN physical_quantity>0 AND outbound_quantity30d IS NOT NULL THEN CASE WHEN outbound_quantity30d=0 THEN 1 ELSE 0 END END no_outbound,"
+            +"CASE WHEN #{o.coverageDaysThreshold} IS NULL THEN NULL WHEN physical_quantity=0 THEN 0 WHEN physical_quantity>0 AND available_quantity=0 THEN 0 "
+            +"WHEN physical_quantity>0 AND available_quantity>0 AND outbound_quantity30d IS NOT NULL THEN CASE WHEN outbound_quantity30d>0 AND available_quantity*"+days+">outbound_quantity30d*#{o.coverageDaysThreshold} THEN 1 ELSE 0 END END above_threshold "
+            +"FROM qualified q), result AS (SELECT c.*,CASE WHEN physical_quantity IS NULL OR available_quantity IS NULL OR outbound_quantity30d IS NULL THEN 1 ELSE 0 END unassessable FROM calculated c) ";
+    }
+    private static String salesCte(AnalyticsSqlRequest p,boolean stockFirst,boolean unused){String d=stockFirst?"d.":"";
+        return " sales AS (SELECT "+(stockFirst?"/*+ JOIN_ORDER(k,d) INDEX(d idx_selfop_daily_sku_cover) */ ":"")
+            +d+"customer_code,"+d+"sku_code,SUM("+d+"outbound_quantity) observed_quantity,SUM("+d+"outbound_order_count) order_count,"
+            +"MIN(CASE WHEN "+d+"quantity_unit='PCS' AND "+d+"outbound_quantity>=0 THEN 1 ELSE 0 END) unit_valid FROM ll_selfop_sku_daily_sales "
+            +(stockFirst?"d JOIN stock_paged k ON k.customer_code=d.customer_code AND k.sku_code=d.sku_code ":"")
+            +"WHERE "+(unused?"1=0 /* dashboard unused sales */ AND ":"")+d+"sales_run_id=#{p.salesRun} AND"+scope(p,d)+" AND "+d+"business_date>=#{p.from} AND "+d+"business_date<#{p.until} GROUP BY "+d+"customer_code,"+d+"sku_code),";
+    }
+    private static String stockAmount(String field){return "CASE WHEN c.stock_unit_valid=1 AND #{p.stockFresh}=1 THEN st."+field+" END";}
+    private static String stockValue(String field){return stockAmount(field)+" "+field;}
+    private static String stockPageKeys(){String amount=stockAmount("available_quantity");
+        return " stock_paged AS (SELECT c.customer_code,c.sku_code FROM profiles c LEFT JOIN stock st ON st.customer_code=c.customer_code AND st.sku_code=c.sku_code "
+            +"ORDER BY "+amount+" IS NULL,"+amount+" DESC,c.sku_code ASC,c.customer_code ASC LIMIT #{p.size} OFFSET #{p.offset}),";}
+    private static boolean stockFirst(AnalyticsInventoryOptions o){return "ALL".equals(o.attentionValue())&&"AVAILABLE_DESC".equals(o.sortValue())
+        &&o.coverageBucket()==null&&o.coverageSelection()==null;}
+    private static String filter(AnalyticsSqlRequest p,AnalyticsInventoryOptions o){
+        String distribution=CoverageDistributionSql.filter(p,o);
+        if(!distribution.isEmpty())return " WHERE "+distribution;
+        return switch(o.attentionValue()){
+        case "NO_OUTBOUND_IN_WINDOW" -> " WHERE no_outbound=1";
+        case "COVERAGE_GT_THRESHOLD" -> " WHERE above_threshold=1";
+        case "FROZEN_STOCK" -> " WHERE frozen_quantity>0";
+        case "DEFECTIVE_STOCK" -> " WHERE defective_physical_quantity>0";
+        case "UNASSESSABLE" -> " WHERE unassessable=1";
+        default -> "";};}
+    private static String order(AnalyticsInventoryOptions o){return order(o,"");}
+    private static String order(AnalyticsInventoryOptions o,String prefix){String field=prefix+switch(o.sortValue()){
+        case "AVAILABLE_ASC","AVAILABLE_DESC" -> "available_quantity";
+        case "PHYSICAL_ASC","PHYSICAL_DESC" -> "physical_quantity";
+        case "FROZEN_ASC","FROZEN_DESC" -> "frozen_quantity";
+        case "DEFECTIVE_ASC","DEFECTIVE_DESC" -> "defective_physical_quantity";
+        case "TRANSIT_ASC","TRANSIT_DESC" -> "transit_quantity";
+        case "COVERAGE_DAYS_ASC","COVERAGE_DAYS_DESC" -> "coverage_days";
+        // Every row has the same window denominator; sort the exact numerator.
+        case "OUTBOUND_ASC","OUTBOUND_DESC","AVERAGE_DAILY_ASC","AVERAGE_DAILY_DESC" -> "outbound_quantity30d";
+        default -> throw new IllegalArgumentException("Unsupported inventory sort");};
+        return field+" IS NULL,"+field+(o.sortValue().endsWith("_ASC")?" ASC":" DESC")+","+prefix+"sku_code ASC,"+prefix+"customer_code ASC";}
+    public static String inventoryPage(Map<String,Object> args){var p=(AnalyticsSqlRequest)args.get("p");var o=(AnalyticsInventoryOptions)args.get("o");
+        // The full candidate set is filtered and sorted first. Historical dates enrich only
+        // those immutable keys selected for this page and never participate in qualification.
+        boolean stockFirst=stockFirst(o);
+        // ALL/available ordering depends only on stock; aggregate sales after selecting these keys.
+        String paged=cte(p,stockFirst)+", paged AS (SELECT * FROM result"
+            +(stockFirst?"":filter(p,o)+" ORDER BY "+order(o)+" LIMIT #{p.size} OFFSET #{p.offset}")+") "
+            +(stockFirst?"":", last_sales AS (SELECT d.customer_code,d.sku_code,MAX(d.business_date) last_outbound FROM ll_selfop_sku_daily_sales d "
+            +"JOIN paged k ON k.customer_code=d.customer_code AND k.sku_code=d.sku_code WHERE d.sales_run_id=#{p.salesRun} "
+            +"AND d.source_account=#{p.account} AND d.warehouse_code=#{p.warehouse} AND d.business_date<=#{p.anchor} "
+            +"AND d.outbound_quantity>0 AND d.quantity_unit='PCS' GROUP BY d.customer_code,d.sku_code) ");
+        String outerOrder=order(o,"k.");
+        return typed(paged+"SELECT k.customer_code,k.sku_code,k.product_name,k.unit_valid,k.evidence_at_utc,k.physical_quantity,k.available_quantity,k.frozen_quantity,k.transit_quantity,k.defective_physical_quantity,k.observed_at_utc,k.owner_outbound,k.observed_outbound,k.order_count,"+(stockFirst?lastOutboundLookup():"l.last_outbound")+" last_outbound,k.observation_eligible,k.outbound_quantity30d,k.coverage_days,k.no_outbound,k.above_threshold,k.unassessable FROM paged k "+(stockFirst?"":"LEFT JOIN last_sales l ON l.customer_code=k.customer_code AND l.sku_code=k.sku_code ")+"ORDER BY "+outerOrder);}
+    private static String lastOutboundLookup(){
+        // Repeat the correlated equality keys in ORDER BY so MySQL can traverse the covering index in reverse.
+        return "(SELECT /*+ INDEX(d idx_selfop_daily_sku_cover) */ d.business_date FROM ll_selfop_sku_daily_sales d "
+            +"WHERE d.sales_run_id=#{p.salesRun} AND d.source_account=#{p.account} AND d.warehouse_code=#{p.warehouse} "
+            +"AND d.customer_code=k.customer_code AND d.sku_code=k.sku_code AND d.business_date<=#{p.anchor} "
+            +"AND d.outbound_quantity>0 AND d.quantity_unit='PCS' ORDER BY d.customer_code DESC,d.sku_code DESC,d.business_date DESC LIMIT 1)";
+    }
+    public static String inventoryCount(Map<String,Object> args){var p=(AnalyticsSqlRequest)args.get("p");var o=(AnalyticsInventoryOptions)args.get("o");
+        if(o.coverageBucket()==null&&o.coverageSelection()==null&&java.util.Set.of("FROZEN_STOCK","DEFECTIVE_STOCK").contains(o.attentionValue()))
+            return typed(stockAttentionCount(p,o));
+        return typed("ALL".equals(o.attentionValue())&&o.coverageBucket()==null&&o.coverageSelection()==null?"SELECT COUNT(*) FROM ("+keys(p)+") k":cte(p)+"SELECT COUNT(*) FROM result"+filter(p,o));}
+    /** These predicates depend only on stock. Counting them must not aggregate sales
+     * or inspect the other profile version, even when those sales are unavailable. */
+    private static String stockAttentionCount(AnalyticsSqlRequest p,AnalyticsInventoryOptions o){
+        String amount="FROZEN_STOCK".equals(o.attentionValue())?quantity("frozen_quantity"):defectiveQuantity();
+        return "SELECT COUNT(*) FROM (SELECT customer_code,sku_code,"+amount+" amount FROM ll_selfop_inventory_snapshot "
+            +"WHERE snapshot_run_id=#{p.inventoryRun} AND"+scope(p)+" GROUP BY customer_code,sku_code) st "
+            +"JOIN ll_selfop_sku_profile i ON i.profile_run_id=#{p.inventoryRun} AND i.source_account=#{p.account} AND i.warehouse_code=#{p.warehouse} "
+            +"AND i.customer_code=st.customer_code AND i.sku_code=st.sku_code WHERE #{p.stockFresh}=1 AND i.quantity_unit='PCS' AND st.amount>0";
+    }
+    public static String ownerTotals(Map<String,Object> args){var p=(AnalyticsSqlRequest)args.get("p");StringBuilder sql=new StringBuilder(cte(p)).append("SELECT COUNT(*) sku_count");
+        for(String field:java.util.List.of("physical_quantity","available_quantity","frozen_quantity","transit_quantity","defective_physical_quantity","owner_outbound"))
+            sql.append(",SUM(").append(field).append(") ").append(field).append("_known,COUNT(*)-COUNT(").append(field).append(") ").append(field).append("_unknown");
+        sql.append(",SUM(CASE WHEN physical_quantity>0 THEN 1 WHEN physical_quantity=0 THEN 0 END) physical_sku_known,SUM(observed_outbound) observed_outbound");
+        for(String risk:java.util.List.of("no_outbound","above_threshold"))sql.append(",SUM(CASE WHEN ").append(risk).append("=1 THEN 1 ELSE 0 END) ").append(risk).append("_count,SUM(CASE WHEN ").append(risk).append("=1 THEN physical_quantity ELSE 0 END) ").append(risk).append("_physical,COUNT(*)-COUNT(").append(risk).append(") ").append(risk).append("_unknown,SUM(CASE WHEN ").append(risk).append(" IS NULL THEN physical_quantity END) ").append(risk).append("_unknown_physical");
+        return typed(sql+" FROM result");}
+    private static String ownersBase(AnalyticsSqlRequest p,AnalyticsInventoryOptions o){return "SELECT DISTINCT customer_code FROM ("+keys(p)+") k"+(o.keyword()==null?"":" WHERE customer_code LIKE #{o.keywordPattern} ESCAPE '!'");}
+    public static String owners(Map<String,Object> args){return typed(ownersBase((AnalyticsSqlRequest)args.get("p"),(AnalyticsInventoryOptions)args.get("o"))+" ORDER BY customer_code ASC LIMIT #{p.size} OFFSET #{p.offset}");}
+    public static String ownerCount(Map<String,Object> args){return typed("SELECT COUNT(*) FROM ("+ownersBase((AnalyticsSqlRequest)args.get("p"),(AnalyticsInventoryOptions)args.get("o"))+") owners");}
+    static String typed(String sql){for(String key:java.util.List.of("from","until","anchor"))sql=sql.replace("#{p."+key+"}","CAST(#{p."+key+"} AS DATE)");return sql.replace("#{o.coverageDaysThreshold}","CAST(#{o.coverageDaysThreshold} AS DECIMAL(20,0))");}
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/AnalyticsQuery.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/AnalyticsQuery.java
new file mode 100644
index 000000000..41c8b84cd
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/AnalyticsQuery.java
@@ -0,0 +1,42 @@
+package com.baiyue.lastleg.selfoperated.analytics.query;
+
+import com.baiyue.common.core.exception.BizException;
+import java.time.Instant;
+import java.time.LocalDate;
+import org.springframework.format.annotation.DateTimeFormat;
+
+/** Canonical constructor only: this record is also Spring's HTTP query binding contract. */
+public record AnalyticsQuery(String sourceAccount, String warehouseCode, String customerCode, String sku,
+    String rangePreset, @DateTimeFormat(iso=DateTimeFormat.ISO.DATE) LocalDate startDate,
+    @DateTimeFormat(iso=DateTimeFormat.ISO.DATE) LocalDate endDate, String bucket, Integer windowDays,
+    Integer current, Integer size, Long salesRunId, Long inventoryRunId, String salesScopeHash,
+    String inventoryScopeHash, @DateTimeFormat(iso=DateTimeFormat.ISO.DATE_TIME) Instant queryAsOf) {
+    public int pageNumber(){return current==null?1:current;}
+    public int pageSize(){return size==null?20:size;}
+    public int rankingDays(){return windowDays==null?30:windowDays;}
+    public boolean pinned(){return salesRunId!=null;}
+    public long offset(){return (long)(pageNumber()-1)*pageSize();}
+    public void validate(boolean chart, boolean exactSku, boolean hot) {
+        text(sourceAccount,64,"来源账号"); text(warehouseCode,64,"仓库");
+        if(customerCode!=null)text(customerCode,64,"货主"); if(sku!=null)text(sku,128,"SKU");
+        if(exactSku){text(customerCode,64,"货主");text(sku,128,"SKU");}
+        if(pageNumber()<1||pageSize()<1||pageSize()>100)throw new BizException("分页范围为current≥1，size为1至100");
+        if((salesRunId==null)!=(inventoryRunId==null))throw new BizException("必须携带完整版本对");
+        if(pinned()){
+            if(salesRunId<0||inventoryRunId<0||queryAsOf==null)throw new BizException("固定版本必须携带queryAsOf");
+            if(salesRunId>0&&!hash(salesScopeHash)||inventoryRunId>0&&!hash(inventoryScopeHash))throw new BizException("固定版本缺少范围摘要");
+        }else if(queryAsOf!=null||salesScopeHash!=null||inventoryScopeHash!=null||pageNumber()!=1)
+            throw new BizException("后续查询必须携带首屏完整上下文");
+        if(chart){
+            if(windowDays!=null)throw new BizException("SKU周期查询不接受windowDays");
+            if(bucket!=null&&!"DAY".equals(bucket))throw new BizException("仅支持DAY日粒度");
+        }else if("CUSTOM".equals(rangePreset)){
+            if(startDate==null||endDate==null||windowDays!=null||bucket!=null)throw new BizException("自定义榜单窗口须提供起止日期，不接受windowDays或bucket");
+        }else{
+            if(rangePreset!=null||startDate!=null||endDate!=null||bucket!=null)throw new BizException("指标不接受图表周期参数");
+            if(hot?(rankingDays()!=7&&rankingDays()!=30):(windowDays!=null))throw new BizException("热销仅支持7/30天；其他指标固定30天");
+        }
+    }
+    private static boolean hash(String v){return v!=null&&v.matches("[0-9a-f]{64}");}
+    static void text(String v,int max,String label){if(v==null||v.isBlank()||v.length()>max)throw new BizException(label+"必填且不能超长");}
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/AnalyticsQueryService.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/AnalyticsQueryService.java
new file mode 100644
index 000000000..4c6f9b1f3
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/AnalyticsQueryService.java
@@ -0,0 +1,291 @@
+package com.baiyue.lastleg.selfoperated.analytics.query;
+
+import com.baiyue.common.core.exception.BizException;
+import com.baiyue.lastleg.selfoperated.analytics.statistics.*;
+import com.fasterxml.jackson.databind.JsonNode;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Isolation;
+import org.springframework.transaction.annotation.Transactional;
+import java.math.BigDecimal;
+import java.time.*;
+import java.util.*;
+import static com.baiyue.lastleg.selfoperated.analytics.query.AnalyticsReadRows.*;
+
+@Service
+@Transactional(readOnly=true,isolation=Isolation.REPEATABLE_READ)
+public class AnalyticsQueryService {
+    private static final ZoneId BUSINESS_ZONE=ZoneId.of("Asia/Shanghai");
+    private final AnalyticsReadMapper mapper;
+    private final ObjectMapper json;
+    private final Clock clock;
+    private final SelfopOwnerDirectory ownerDirectory;
+    @Value("${baiyue.self-operated-analytics.max-query-days:366}") private int maxQueryDays=366;
+    @Value("${baiyue.self-operated-analytics.sales-retention-days:7}") private int retentionDays=7;
+    @Autowired public AnalyticsQueryService(AnalyticsReadMapper mapper,ObjectMapper json,SelfopOwnerDirectory ownerDirectory){this(mapper,json,Clock.systemUTC(),ownerDirectory);}
+    AnalyticsQueryService(AnalyticsReadMapper mapper,ObjectMapper json,Clock clock,SelfopOwnerDirectory ownerDirectory){this.mapper=mapper;this.json=json;this.clock=clock;this.ownerDirectory=ownerDirectory;}
+    record Snapshot(AnalyticsQuery q,Run sales,Run inventory,boolean sourceKnown,boolean trusted,
+        LocalDate fullFrom,LocalDate fullUntil,SalesRangePolicy.Range range,AnalyticsResponses.Context context){}
+
+    public AnalyticsResponses.Page<AnalyticsResponses.SalesSummary> salesSummary(AnalyticsQuery q,SalesSort salesSort){
+        Snapshot s=context(q,true,false,false,null); AnalyticsSqlRequest p=request(s,"SUMMARY");
+        long count=mapper.count(p);
+        var names=ownerNames(s);var records=mapper.salesPage(p,salesSort).stream().map(r->summary(s,r,names.get(r.customerCode()))).toList();
+        return page(s,records,count,Map.of());
+    }
+    public AnalyticsResponses.Trend dailySales(AnalyticsQuery q){
+        Snapshot s=context(q,true,true,false,null);
+        Profile sp=profile(s,s.sales),ip=profile(s,s.inventory);
+        if(sp==null&&ip==null)throw new BizException("所选固定版本中无该货主和SKU记录");
+        String unit=sp!=null?sp.quantityUnit():ip==null?null:ip.quantityUnit();
+        boolean valid="PCS".equals(unit);
+        List<Daily> rows=s.sales==null?List.of():mapper.daily(s.sales.id(),q.sourceAccount(),q.warehouseCode(),q.customerCode(),q.sku(),
+            s.range.startDate(),s.range.endDateExclusive());
+        Map<LocalDate,Daily> daily=new HashMap<>();
+        for(Daily row:rows){
+            if(daily.put(row.businessDate(),row)!=null)throw new BizException("已发布版本存在重复日行");
+            if(!Objects.equals(unit,row.quantityUnit()))valid=false;
+        }
+        Instant evidence=earliest(sp,ip);
+        var coverage=SalesQueryCoverage.intervals(s.sales);
+        List<SalesBucketPolicy.Point> evaluated=new ArrayList<>(); List<AnalyticsResponses.Point> points=new ArrayList<>();
+        for(LocalDate day=s.range.startDate();day.isBefore(s.range.endDateExclusive());day=day.plusDays(1)){
+            Daily row=daily.get(day);
+            var covered=SalesQueryCoverage.at(row!=null||evidence==null?coverage:
+                coverage.stream().filter(i->i.until().toInstant(ZoneOffset.UTC).isAfter(evidence)).toList(),day);
+            var point=SalesBucketPolicy.evaluate(new SalesBucketPolicy.Input(day,s.range.anchorDate(),BUSINESS_ZONE,SalesQueryCoverage.fullFrom(covered),SalesQueryCoverage.fullUntil(covered),
+                covered==null?null:utc(covered.from()),covered==null?null:utc(covered.until()),evidence,row==null?null:row.outboundQuantity(),
+                row==null?null:row.outboundOrderCount(),valid,s.sourceKnown,s.context.rebuildRequired(),"STALE".equals(s.context.salesStatus())));
+            evaluated.add(point);
+            points.add(new AnalyticsResponses.Point(day,point.outboundQuantity(),point.observedQuantity(),point.dataStatus(),
+                point.reasonCodes(),unit,point.provedFrom(),point.provedUntil()));
+        }
+        var totals=SalesBucketPolicy.aggregate(evaluated);
+        var summary=new AnalyticsResponses.SalesSummary(q.sourceAccount(),q.warehouseCode(),q.customerCode(),q.sku(),name(sp,ip),unit,
+            totals.outboundQuantity(),totals.observedQuantity(),totals.dataStatus(),totals.reasonCodes(),
+            totals.completeDays(),totals.partialDays(),totals.unknownDays(),ownerNames(s).get(q.customerCode()));
+        return new AnalyticsResponses.Trend(s.context,summary,List.copyOf(points));
+    }
+    public AnalyticsResponses.Page<AnalyticsResponses.Metric> hotSkus(AnalyticsQuery q){return metrics(q,"HOT",true);}
+    public AnalyticsResponses.Page<AnalyticsResponses.Metric> slowSkus(AnalyticsQuery q){return metrics(q,"SLOW",false);}
+    public AnalyticsResponses.Page<AnalyticsResponses.InventoryMetric> inventoryCoverage(AnalyticsQuery q,AnalyticsInventoryOptions o){
+        o.validate("INVENTORY",q);Snapshot s=context(q,false,false,false,o);var p=request(s,"INVENTORY");
+        CoverageDistributionPolicy.requireDrilldown(q,o,s.context(),inventoryFreshUntil(s),clock.instant());
+        long total=mapper.inventoryCount(p,o);
+        var names=ownerNames(s);
+        return page(s,q.offset()>=total?List.of():mapper.inventoryPage(p,o).stream().map(r->inventoryMetric(s,r,names.get(r.customerCode()))).toList(),total,Map.of());
+    }
+    public AnalyticsResponses.Page<AnalyticsResponses.OwnerOption> owners(AnalyticsQuery q,AnalyticsInventoryOptions o){
+        o.validate("OWNERS",q);Snapshot s=context(q,false,false,false,null);var p=request(s,"OWNERS");long total=mapper.ownerCount(p,o);
+        var names=ownerNames(s);
+        return page(s,q.offset()>=total?List.of():mapper.owners(p,o).stream().map(code->new AnalyticsResponses.OwnerOption(code,names.get(code))).toList(),total,Map.of());
+    }
+    public AnalyticsResponses.OwnerOverview ownerOverview(AnalyticsQuery q,AnalyticsInventoryOptions o){
+        o.validate("OVERVIEW",q);Snapshot s=context(q,false,false,false,null);var raw=mapper.ownerTotals(request(s,"OVERVIEW"),o);
+        Map<String,Object> totals=new HashMap<>();if(raw!=null)raw.forEach((key,value)->totals.put(key.toLowerCase(Locale.ROOT),value));
+        long count=number(totals,"sku_count");if(count==0)return null;
+        var physical=quantity(totals,"physical_quantity");var outbound=quantity(totals,"owner_outbound");
+        if(outbound.overallTotal()==null)outbound=new AnalyticsResponses.QuantityTotal(null,decimal(totals,"observed_outbound"),outbound.unknownSkuCount(),
+            decimal(totals,"observed_outbound")==null?"UNKNOWN":"PARTIAL",List.of("SALES_WINDOW_UNAVAILABLE"));
+        var average=new AnalyticsResponses.QuantityTotal(divide30(outbound.overallTotal()),divide30(outbound.knownSubtotal()),outbound.unknownSkuCount(),outbound.dataStatus(),outbound.reasonCodes());
+        var physicalSkus=new AnalyticsResponses.QuantityTotal(physical.unknownSkuCount()==0?decimal(totals,"physical_sku_known"):null,
+            decimal(totals,"physical_sku_known"),physical.unknownSkuCount(),physical.dataStatus(),physical.reasonCodes());
+        return new AnalyticsResponses.OwnerOverview(s.context,q.customerCode(),ownerNames(s).get(q.customerCode()),count,physicalSkus,physical,quantity(totals,"available_quantity"),
+            quantity(totals,"frozen_quantity"),quantity(totals,"defective_physical_quantity"),quantity(totals,"transit_quantity"),outbound,average,
+            risk(totals,"no_outbound",physical,false),risk(totals,"above_threshold",physical,o.coverageDaysThreshold()==null));
+    }
+    private AnalyticsResponses.InventoryMetric inventoryMetric(Snapshot s,Inventory r,String customerName){
+        boolean observed=Boolean.TRUE.equals(r.observationEligible());String quality=!"VALID".equals(s.context.inventoryStatus())?s.context.inventoryStatus():r.availableQuantity()==null?"UNKNOWN":"VALID";
+        String coverage=!Boolean.TRUE.equals(r.unitValid())?"UNIT_UNKNOWN_OR_CONFLICT":r.ownerOutbound()!=null?"COMPLETE":"COVERAGE_INSUFFICIENT";
+        var calculated=InventoryWindowPolicy.calculate(quality,r.availableQuantity(),r.outboundQuantity30d(),s.trusted,
+            complete(s,s.range.startDate(),s.range.endDateExclusive()),Boolean.TRUE.equals(r.unitValid()),s.range.dayCount());
+        List<String> attention=new ArrayList<>();if(Integer.valueOf(1).equals(r.noOutbound()))attention.add("NO_OUTBOUND_IN_WINDOW");
+        if(Integer.valueOf(1).equals(r.aboveThreshold()))attention.add("COVERAGE_GT_THRESHOLD");
+        if(positive(r.frozenQuantity()))attention.add("FROZEN_STOCK");if(positive(r.defectivePhysicalQuantity()))attention.add("DEFECTIVE_STOCK");
+        if(Boolean.TRUE.equals(r.unassessable()))attention.add("UNASSESSABLE");
+        List<String> reasons=new ArrayList<>(s.context.reasonCodes());if(!observed)reasons.add("OBSERVATION_INSUFFICIENT");
+        if(!Boolean.TRUE.equals(r.unitValid()))reasons.add("UNIT_UNKNOWN_OR_CONFLICT");
+        if(r.lastOutbound()==null)reasons.add("NO_OUTBOUND_IN_COLLECTED_HISTORY");
+        if(!"VALID".equals(calculated.status()))reasons.add(calculated.status());
+        Map<String,String> statuses=new LinkedHashMap<>();String unknown="STALE".equals(s.context.inventoryStatus())?"STALE":"UNKNOWN";
+        statuses.put("physicalQuantity",r.physicalQuantity()==null?unknown:"VALID");statuses.put("availableQuantity",r.availableQuantity()==null?unknown:"VALID");
+        statuses.put("frozenQuantity",r.frozenQuantity()==null?unknown:"VALID");statuses.put("transitQuantity",r.transitQuantity()==null?unknown:"VALID");
+        statuses.put("defectivePhysicalQuantity",r.defectivePhysicalQuantity()==null?unknown:"VALID");
+        statuses.put("windowOutboundQuantity",r.outboundQuantity30d()!=null?"VALID":!Boolean.TRUE.equals(r.unitValid())?"UNIT_UNKNOWN_OR_CONFLICT":
+            !s.trusted?"SALES_UNTRUSTED":!"COMPLETE".equals(coverage)?"COVERAGE_INSUFFICIENT":"UNKNOWN");
+        return new AnalyticsResponses.InventoryMetric(s.q.sourceAccount(),r.customerCode(),s.q.warehouseCode(),r.skuCode(),r.productName(),Boolean.TRUE.equals(r.unitValid())?"PCS":null,
+            r.orderCount(),r.physicalQuantity(),r.availableQuantity(),r.frozenQuantity(),r.transitQuantity(),utc(r.observedAtUtc()),
+            r.outboundQuantity30d()==null?null:r.outboundQuantity30d().divide(BigDecimal.valueOf(s.range.dayCount()),12,java.math.RoundingMode.HALF_UP),calculated.days(),quality,coverage,observed,utc(r.evidenceAtUtc()),calculated.status(),List.copyOf(new LinkedHashSet<>(reasons)),
+            customerName,r.defectivePhysicalQuantity(),r.outboundQuantity30d(),r.observedOutbound(),r.lastOutbound(),historyStart(s),List.copyOf(attention),Map.copyOf(statuses));
+    }
+    private static boolean positive(BigDecimal n){return n!=null&&n.signum()>0;}
+    private static LocalDate historyStart(Snapshot s){return SalesQueryCoverage.intervals(s.sales).stream()
+        .map(i->utc(i.from()).atZone(BUSINESS_ZONE).toLocalDate()).min(LocalDate::compareTo).orElse(null);}
+    private static BigDecimal divide30(BigDecimal n){return n==null?null:n.divide(BigDecimal.valueOf(30),12,java.math.RoundingMode.HALF_UP);}
+    private static BigDecimal decimal(Map<String,Object> row,String key){Object n=row.get(key);return n==null?null:n instanceof BigDecimal d?d:new BigDecimal(n.toString());}
+    private static long number(Map<String,Object> row,String key){BigDecimal n=decimal(row,key);return n==null?0:n.longValueExact();}
+    private static AnalyticsResponses.QuantityTotal quantity(Map<String,Object> row,String field){
+        BigDecimal known=decimal(row,field+"_known");long unknown=number(row,field+"_unknown");
+        return new AnalyticsResponses.QuantityTotal(unknown==0?known:null,known,unknown,unknown==0?"COMPLETE":known==null?"UNKNOWN":"PARTIAL",
+            unknown==0?List.of():List.of("METRIC_DEPENDENCY_UNKNOWN"));
+    }
+    private static AnalyticsResponses.RiskShare risk(Map<String,Object> row,String field,AnalyticsResponses.QuantityTotal physical,boolean unset){
+        long unknown=number(row,field+"_unknown");long known=number(row,field+"_count");BigDecimal knownPhysical=decimal(row,field+"_physical");
+        boolean complete=!unset&&unknown==0&&physical.overallTotal()!=null;
+        BigDecimal ratio=complete&&positive(physical.overallTotal())?knownPhysical.divide(physical.overallTotal(),12,java.math.RoundingMode.HALF_UP):null;
+        List<String> reasons=unset?List.of("THRESHOLD_NOT_SET"):!complete?List.of("RISK_DEPENDENCY_UNKNOWN"):
+            !positive(physical.overallTotal())?List.of("NO_PHYSICAL_INVENTORY"):List.of();
+        return new AnalyticsResponses.RiskShare(complete?known:null,complete?knownPhysical:null,ratio,unset?null:known,unset?null:knownPhysical,
+            unknown,decimal(row,field+"_unknown_physical"),reasons);
+    }
+    private AnalyticsResponses.Page<AnalyticsResponses.Metric> metrics(AnalyticsQuery q,String kind,boolean hot){
+        Snapshot s=context(q,false,false,hot,null); AnalyticsSqlRequest p=request(s,kind);
+        List<AnalyticsReadMapper.RankingStat> statistics=mapper.rankingStats(p);
+        long total=statistics.isEmpty()?0:statistics.get(0).total();
+        var names=ownerNames(s);List<AnalyticsResponses.Metric> rows=q.offset()>=total?List.of():mapper.page(p).stream().map(r->metric(s,r,kind,names.get(r.customerCode()))).toList();
+        Map<String,Long> excluded=new TreeMap<>();
+        for(var e:statistics)if(e.reason()!=null)excluded.put(e.reason(),e.excludedCount());
+        return page(s,rows,total,excluded);
+    }
+    private Map<String,String> ownerNames(Snapshot s){return ownerDirectory.names(s.q.sourceAccount(),s.context.queryAsOf());}
+    public List<AnalyticsResponses.OwnerOption> ownerDirectory(AnalyticsQuery q){
+        Snapshot s=context(q,false,false,false,null);
+        return ownerNames(s).entrySet().stream().map(e->new AnalyticsResponses.OwnerOption(e.getKey(),e.getValue())).toList();
+    }
+    private AnalyticsResponses.SalesSummary summary(Snapshot s,Aggregate r,String customerName){
+        int complete=r.completeDayCount(),partial=r.partialDayCount(),unknown=r.unknownDayCount();
+        String status=complete==s.range.dayCount()?"COMPLETE":r.observedQuantity()!=null?"PARTIAL":"UNKNOWN";
+        List<String> reasons=new ArrayList<>(s.context.reasonCodes());
+        if(!Boolean.TRUE.equals(r.unitValid()))reasons.add("UNIT_UNKNOWN_OR_CONFLICT");
+        if(partial>0)reasons.add("SALES_DAY_INCOMPLETE"); if(unknown>0)reasons.add("SALES_NOT_COVERED_OR_SKU_HISTORY_UNKNOWN");
+        return new AnalyticsResponses.SalesSummary(s.q.sourceAccount(),s.q.warehouseCode(),r.customerCode(),r.skuCode(),r.productName(),
+            r.quantityUnit(),"COMPLETE".equals(status)?r.observedQuantity():null,r.observedQuantity(),status,List.copyOf(reasons),complete,partial,unknown,customerName);
+    }
+    private AnalyticsResponses.Metric metric(Snapshot s,Aggregate r,String kind,String customerName){
+        Instant evidence=utc(r.evidenceAtUtc());
+        boolean observed=evidence!=null&&!evidence.isAfter(s.range.startDate().atStartOfDay(BUSINESS_ZONE).toInstant());
+        boolean stockValid="VALID".equals(r.inventoryQuality());
+        String coverage=!Boolean.TRUE.equals(r.unitValid())?"UNIT_UNKNOWN_OR_CONFLICT":!s.trusted?"SALES_UNTRUSTED":
+            complete(s,s.range.startDate(),s.range.endDateExclusive())?"COMPLETE":"COVERAGE_INSUFFICIENT";
+        var result=InventoryWindowPolicy.calculate(r.inventoryQuality(),stockValid?r.availableQuantity():null,r.windowQuantity(),
+            s.trusted,complete(s,s.range.startDate(),s.range.endDateExclusive())&&observed,Boolean.TRUE.equals(r.unitValid()),s.range.dayCount());
+        List<String> reasons=new ArrayList<>(s.context.reasonCodes());
+        if(!"COMPLETE".equals(coverage))reasons.add(coverage);
+        if(!"VALID".equals(result.status()))reasons.add(result.status());
+        if(r.inventoryReason()!=null)reasons.add(r.inventoryReason());
+        BigDecimal today=r.todayQuantity();
+        if(!"HOT".equals(kind)&&today==null&&s.sourceKnown&&Boolean.TRUE.equals(r.unitValid())&&evidence!=null){
+            Instant start=s.range.anchorDate().atStartOfDay(BUSINESS_ZONE).toInstant();
+            Instant end=s.range.anchorDate().plusDays(1).atStartOfDay(BUSINESS_ZONE).toInstant();
+            Instant lower=evidence.isAfter(start)?evidence:start;
+            if(lower.isBefore(end)&&SalesQueryCoverage.intervals(s.sales).stream()
+                .anyMatch(i->utc(i.from()).isBefore(end)&&utc(i.until()).isAfter(lower)))today=BigDecimal.ZERO;
+        }
+        return new AnalyticsResponses.Metric(s.q.sourceAccount(),r.customerCode(),s.q.warehouseCode(),r.skuCode(),r.productName(),r.quantityUnit(),
+            r.windowQuantity(),r.windowSkuOrderCount(),today,stockValid?r.physicalQuantity():null,stockValid?r.availableQuantity():null,
+            stockValid?r.frozenQuantity():null,stockValid?r.transitQuantity():null,utc(r.inventoryObservedAtUtc()),result.average(),result.days(),
+            r.inventoryQuality(),coverage,observed,evidence,result.status(),List.copyOf(new LinkedHashSet<>(reasons)),customerName,null,r.sales30Quantity(),null,historyStart(s),List.of(),Map.of());
+    }
+    Snapshot context(AnalyticsQuery q,boolean chart,boolean exact,boolean hot,AnalyticsInventoryOptions inventoryOptions){
+        boolean dashboardWindow=inventoryOptions!=null&&"DASHBOARD".equals(inventoryOptions.drilldownFrom());
+        q.validate(chart||dashboardWindow,exact,hot); Instant now=clock.instant();
+        List<Scope> scopes=mapper.scopes(q.sourceAccount(),q.warehouseCode());
+        Scope salesScope=scope(scopes,"OUTBOUND"),stockScope=scope(scopes,"INVENTORY");
+        if(salesScope==null&&stockScope==null)throw new BizException("来源账号或仓库未配置");
+        Run sales=resolve(salesScope,q.pinned()?q.salesRunId():null,q.salesScopeHash());
+        Run inventory=resolve(stockScope,q.pinned()?q.inventoryRunId():null,q.inventoryScopeHash());
+        JsonNode sc=config(sales),ic=config(inventory);
+        String zone=sales!=null?sc.path("businessTimezone").asText():inventory!=null?ic.path("businessTimezone").asText():
+            salesScope!=null?salesScope.businessTimezone():stockScope.businessTimezone();
+        if(!BUSINESS_ZONE.getId().equals(zone)||inventory!=null&&!BUSINESS_ZONE.getId().equals(ic.path("businessTimezone").asText()))
+            throw new BizException("发布版本不符合已确认的北京时间口径");
+        Instant asOf=q.pinned()?q.queryAsOf():now;
+        if(asOf.isAfter(now))throw new BizException("queryAsOf不能晚于服务端时间");
+        if(sales!=null&&(sales.publishedAtUtc()==null||asOf.isBefore(utc(sales.publishedAtUtc())))
+            ||inventory!=null&&(inventory.publishedAtUtc()==null||asOf.isBefore(utc(inventory.publishedAtUtc()))))
+            throw new BizException("queryAsOf不能早于所选版本发布时间");
+        Instant expires=asOf.plusSeconds(1800);
+        if(sales!=null&&sales.supersededAtUtc()!=null){
+            Instant deadline=utc(sales.supersededAtUtc()).plus(Duration.ofDays(Math.max(7,retentionDays)));
+            if(deadline.isBefore(expires))expires=deadline;
+        }
+        if(!now.isBefore(expires))throw new BizException("查询上下文或统计版本已过期，请刷新整页");
+        LocalDate anchor=asOf.atZone(BUSINESS_ZONE).toLocalDate();
+        SalesRangePolicy.Range range;
+        try{
+            range=inventoryOptions!=null&&!dashboardWindow?InventoryWindowPolicy.range(inventoryOptions,anchor):(chart||dashboardWindow||("CUSTOM".equals(q.rangePreset())))?SalesRangePolicy.resolve(q.rangePreset()==null?"TODAY":q.rangePreset(),q.startDate(),q.endDate(),
+                q.bucket()==null?"DAY":q.bucket(),asOf,BUSINESS_ZONE,maxQueryDays):
+                new SalesRangePolicy.Range(anchor,anchor.minusDays(hot?q.rankingDays():30),anchor,hot?q.rankingDays():30,
+                    anchor.minusDays(hot?q.rankingDays():30).atStartOfDay(BUSINESS_ZONE).toInstant(),anchor.atStartOfDay(BUSINESS_ZONE).toInstant());
+        }catch(IllegalArgumentException e){throw new BizException("查询周期或日期范围无效，最多"+maxQueryDays+"个自然日");}
+        boolean rebuild=salesScope!=null&&(Boolean.TRUE.equals(salesScope.rebuildRequired())
+            ||!Objects.equals(salesScope.factRevision(),salesScope.publishedFactRevision())||mapper.applyBarriers(q.sourceAccount(),q.warehouseCode())>0);
+        boolean known=sales!=null&&BUSINESS_ZONE.getId().equals(sc.path("sourceTimezone").asText());
+        LocalDateTime latestCoverage=SalesQueryCoverage.intervals(sales).stream().map(i->i.until()).max(LocalDateTime::compareTo).orElse(null);
+        String salesState=sales==null?"UNKNOWN":!known?"SOURCE_TIMEZONE_UNKNOWN":stale(latestCoverage,threshold(sc))?"STALE":"VALID";
+        if(rebuild)salesState="REBUILD_REQUIRED";
+        String inventoryState=inventory==null?"UNKNOWN":stale(inventory.fetchFinishedAtUtc(),threshold(ic))?"STALE":"VALID";
+        LocalDate fullFrom=sales==null?null:sales.completeDayFrom(),fullUntil=sales==null?null:sales.completeDayUntil();
+        if(sales!=null&&(sales.coveredFromUtc()==null||sales.coveredUntilUtc()==null||!sales.coveredFromUtc().isBefore(sales.coveredUntilUtc()))){
+            fullFrom=null;fullUntil=null;
+        }
+        if(sales!=null&&sales.coveredFromUtc()!=null&&fullFrom!=null){
+            var covered=utc(sales.coveredFromUtc()).atZone(BUSINESS_ZONE); LocalDate first=covered.toLocalDate();
+            if(!covered.toLocalTime().equals(LocalTime.MIDNIGHT))first=first.plusDays(1);
+            if(first.isAfter(fullFrom))fullFrom=first;
+        }
+        if(sales!=null&&sales.coveredUntilUtc()!=null&&fullUntil!=null){
+            LocalDate last=utc(sales.coveredUntilUtc()).atZone(BUSINESS_ZONE).toLocalDate();
+            if(last.isBefore(fullUntil))fullUntil=last; if(anchor.isBefore(fullUntil))fullUntil=anchor;
+        }
+        String review=reviewStatus(salesScope); List<String> reasons=new ArrayList<>();
+        if(!"VALID".equals(salesState))reasons.add("SALES_"+salesState);
+        if(!"VALID".equals(inventoryState))reasons.add("INVENTORY_"+inventoryState);
+        if(!"CURRENT".equals(review))reasons.add("REVISION_REVIEW_"+review);
+        var c=new AnalyticsResponses.Context(sales==null?0L:sales.id(),inventory==null?0L:inventory.id(),sales==null?null:sales.scopeHash(),
+            inventory==null?null:inventory.scopeHash(),asOf,expires,zone,anchor,range.startDate(),range.endDateExclusive(),chart?null:range.dayCount(),
+            fullFrom,fullUntil,sales==null?null:utc(sales.coveredFromUtc()),sales==null?null:utc(sales.coveredUntilUtc()),
+            sales==null?null:utc(sales.publishedAtUtc()),inventory==null?null:utc(inventory.fetchStartedAtUtc()),
+            inventory==null?null:utc(inventory.fetchFinishedAtUtc()),salesState,inventoryState,rebuild,review,List.copyOf(reasons));
+        return new Snapshot(q,sales,inventory,known,"VALID".equals(salesState),fullFrom,fullUntil,range,c);
+    }
+    AnalyticsSqlRequest request(Snapshot s,String kind){
+        int size=s.q.pageSize(); if("HOT".equals(kind)||"SLOW".equals(kind))size=(int)Math.max(0,Math.min(size,100-s.q.offset()));
+        return new AnalyticsSqlRequest(s.q.sourceAccount(),s.q.warehouseCode(),s.q.customerCode(),s.q.sku(),s.context.salesRunId(),
+            s.context.inventoryRunId(),s.range.startDate(),s.range.endDateExclusive(),s.range.anchorDate(),s.range.startDate(),
+            s.fullFrom,s.fullUntil,s.sales==null?null:s.sales.coveredFromUtc(),s.sales==null?null:s.sales.coveredUntilUtc(),s.sourceKnown,s.sourceKnown,
+            s.trusted&&complete(s,s.range.startDate(),s.range.endDateExclusive()),
+            s.trusted&&complete(s,s.range.anchorDate().minusDays(30),s.range.anchorDate()),"VALID".equals(s.context.inventoryStatus()),s.q.offset(),size,kind,SalesQueryCoverage.intervals(s.sales));
+    }
+    Instant inventoryFreshUntil(Snapshot s){
+        return s.inventory()==null||s.inventory().fetchFinishedAtUtc()==null?null:
+            utc(s.inventory().fetchFinishedAtUtc()).plusSeconds(threshold(config(s.inventory())));
+    }
+    Instant queryClockNow(){return clock.instant();}
+    private Run resolve(Scope scope,Long requested,String hash){
+        if(scope==null){if(requested!=null&&requested!=0)throw new BizException("版本任务族未配置");return null;}
+        Long id=requested==null?scope.publishedRunId():requested; if(id==null||id==0)return null;
+        Run run=mapper.publishedRun(id);
+        if(run==null||!Objects.equals(run.scopeId(),scope.id())||!scope.sourceAccount().equals(run.sourceAccount())
+            ||!scope.warehouseCode().equals(run.warehouseCode())||!scope.scopeHash().equals(run.scopeHash())
+            ||requested!=null&&!run.scopeHash().equals(hash)||!"BUSINESS".equals(run.executionPurpose())||!"PUBLISHED".equals(run.status()))
+            throw new BizException("版本不可用或范围不符，请刷新整页");
+        if(!"COMPLETE".equals(run.coverageStatus())&&SalesQueryCoverage.intervals(run).isEmpty())throw new BizException("发布版本缺少完整覆盖证明");
+        return run;
+    }
+    private Profile profile(Snapshot s,Run run){return run==null?null:mapper.profile(run.id(),s.q.sourceAccount(),s.q.warehouseCode(),s.q.customerCode(),s.q.sku());}
+    private static boolean complete(Snapshot s,LocalDate from,LocalDate until){return s.sourceKnown&&!until.isAfter(s.range.anchorDate())
+        &&SalesQueryCoverage.complete(SalesQueryCoverage.intervals(s.sales),from,until);}
+    private JsonNode config(Run r){if(r==null)return json.createObjectNode();try{JsonNode n=json.readTree(r.scopeSnapshotJson());if(n==null||!n.isObject())throw new IllegalArgumentException();return n;}catch(Exception e){throw new BizException("版本配置快照无效");}}
+    private static int threshold(JsonNode c){int n=c.path("staleAfterSeconds").asInt();if(n<=0)throw new BizException("版本过期阈值无效");return n;}
+    private boolean stale(LocalDateTime t,int seconds){return t==null||utc(t).isAfter(clock.instant())||!clock.instant().isBefore(utc(t).plusSeconds(seconds));}
+    private String reviewStatus(Scope s){if(s==null||s.knownOrderRoundFinishedAtUtc()==null||s.historyRoundFinishedAtUtc()==null||s.reviewTargetDays()==null||s.reviewTargetDays()<=0)return "UNKNOWN";int age=Math.multiplyExact(s.reviewTargetDays(),86400);return stale(s.knownOrderRoundFinishedAtUtc(),age)||stale(s.historyRoundFinishedAtUtc(),age)?"LAGGING":"CURRENT";}
+    private static Scope scope(List<Scope> ss,String family){return ss.stream().filter(s->family.equals(s.dataFamily())).findFirst().orElse(null);}
+    private static String name(Profile s,Profile i){return i!=null&&i.productName()!=null?i.productName():s==null?null:s.productName();}
+    private static Instant earliest(Profile s,Profile i){Instant a=evidence(s,"VALID_OUTBOUND"),b=evidence(i,"INVENTORY_OBSERVATION");return a==null?b:b==null||a.isBefore(b)?a:b;}
+    private static Instant evidence(Profile p,String type){return p!=null&&type.equals(p.evidenceType())&&p.evidenceRunId()!=null?utc(p.earliestEvidenceAtUtc()):null;}
+    private static Instant utc(LocalDateTime t){return t==null?null:t.toInstant(ZoneOffset.UTC);}
+    private static <T> AnalyticsResponses.Page<T> page(Snapshot s,List<T> rows,long total,Map<String,Long> exclusions){int size=s.q.pageSize();return new AnalyticsResponses.Page<>(s.context,rows,s.q.pageNumber(),size,total,total/size+(total%size==0?0:1),Map.copyOf(exclusions));}
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/AnalyticsReadMapper.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/AnalyticsReadMapper.java
new file mode 100644
index 000000000..1c5cfb771
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/AnalyticsReadMapper.java
@@ -0,0 +1,51 @@
+package com.baiyue.lastleg.selfoperated.analytics.query;
+
+import java.util.List;
+import org.apache.ibatis.annotations.*;
+
+/** Reads immutable published versions in Lastleg only. */
+@Mapper
+public interface AnalyticsReadMapper {
+    String RUN_COLUMNS="id,task_id,scope_id,source_account,warehouse_code,run_role,scope_hash,scope_snapshot_json,status,"
+        +"coverage_status,covered_from_utc,covered_until_utc,complete_day_from,complete_day_until,"
+        +"fetch_started_at_utc,fetch_finished_at_utc,published_at_utc,calculated_fact_revision,error_code,error_message,superseded_at_utc,execution_purpose,warehouse_daily_ready";
+    @Select("SELECT id,source_account,warehouse_code,data_family,scope_hash,business_timezone,source_timezone,"
+        +"stale_after_seconds,published_run_id,fact_revision,published_fact_revision,rebuild_required,"
+        +"known_order_round_finished_at_utc,history_round_finished_at_utc,review_target_days "
+        +"FROM ll_selfop_sync_scope WHERE source_account=#{account} AND warehouse_code=#{warehouse} ORDER BY data_family")
+    List<AnalyticsReadRows.Scope> scopes(@Param("account") String account,@Param("warehouse") String warehouse);
+    @Select("SELECT "+RUN_COLUMNS+" FROM ll_selfop_sync_run WHERE id=#{id} AND status='PUBLISHED' AND run_role='WAREHOUSE_SYNC' AND execution_purpose='BUSINESS'")
+    AnalyticsReadRows.Run publishedRun(@Param("id") long id);
+    @SelectProvider(type=AnalyticsReadSql.class,method="page")
+    List<AnalyticsReadRows.Aggregate> page(@Param("p") AnalyticsSqlRequest request);
+    @SelectProvider(type=AnalyticsReadSql.class,method="page")
+    List<AnalyticsReadRows.Aggregate> salesPage(@Param("p") AnalyticsSqlRequest request,@Param("salesSort") SalesSort salesSort);
+    @SelectProvider(type=AnalyticsReadSql.class,method="count")
+    long count(@Param("p") AnalyticsSqlRequest request);
+    record RankingStat(Long total,String reason,Long excludedCount){}
+    @SelectProvider(type=AnalyticsReadSql.class,method="rankingStats")
+    List<RankingStat> rankingStats(@Param("p") AnalyticsSqlRequest request);
+    @Select("SELECT customer_code,sku_code,product_name,quantity_unit,first_seen_at_utc,earliest_evidence_at_utc,"
+        +"evidence_type,evidence_run_id,last_seen_run_id FROM ll_selfop_sku_profile WHERE profile_run_id=#{run} "
+        +"AND source_account=#{account} AND warehouse_code=#{warehouse} AND customer_code=#{customer} AND sku_code=#{sku}")
+    AnalyticsReadRows.Profile profile(@Param("run") long run,@Param("account") String account,@Param("warehouse") String warehouse,
+        @Param("customer") String customer,@Param("sku") String sku);
+    @Select("SELECT customer_code,sku_code,business_date,outbound_quantity,outbound_order_count,quantity_unit "
+        +"FROM ll_selfop_sku_daily_sales WHERE sales_run_id=#{run} AND source_account=#{account} AND warehouse_code=#{warehouse} "
+        +"AND customer_code=#{customer} AND sku_code=#{sku} AND business_date>=#{from} AND business_date<#{until} ORDER BY business_date")
+    List<AnalyticsReadRows.Daily> daily(@Param("run") long run,@Param("account") String account,@Param("warehouse") String warehouse,
+        @Param("customer") String customer,@Param("sku") String sku,@Param("from") java.time.LocalDate from,@Param("until") java.time.LocalDate until);
+    @Select("SELECT COUNT(*) FROM ll_selfop_sync_task WHERE source_account=#{account} AND apply_state IN ('APPLYING','BLOCKED') "
+        +"AND JSON_CONTAINS(affected_warehouse_codes_json,JSON_QUOTE(#{warehouse}))")
+    long applyBarriers(@Param("account") String account,@Param("warehouse") String warehouse);
+    @SelectProvider(type=AnalyticsInventorySql.class,method="inventoryPage")
+    List<AnalyticsReadRows.Inventory> inventoryPage(@Param("p") AnalyticsSqlRequest request,@Param("o") AnalyticsInventoryOptions options);
+    @SelectProvider(type=AnalyticsInventorySql.class,method="inventoryCount")
+    long inventoryCount(@Param("p") AnalyticsSqlRequest request,@Param("o") AnalyticsInventoryOptions options);
+    @SelectProvider(type=AnalyticsInventorySql.class,method="owners")
+    List<String> owners(@Param("p") AnalyticsSqlRequest request,@Param("o") AnalyticsInventoryOptions options);
+    @SelectProvider(type=AnalyticsInventorySql.class,method="ownerCount")
+    long ownerCount(@Param("p") AnalyticsSqlRequest request,@Param("o") AnalyticsInventoryOptions options);
+    @SelectProvider(type=AnalyticsInventorySql.class,method="ownerTotals")
+    java.util.Map<String,Object> ownerTotals(@Param("p") AnalyticsSqlRequest request,@Param("o") AnalyticsInventoryOptions options);
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/AnalyticsReadRows.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/AnalyticsReadRows.java
new file mode 100644
index 000000000..dcd94d40f
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/AnalyticsReadRows.java
@@ -0,0 +1,39 @@
+package com.baiyue.lastleg.selfoperated.analytics.query;
+
+import java.math.BigDecimal;
+import java.time.LocalDate;
+import java.time.LocalDateTime;
+
+/** Read projections only; DATETIME columns are UTC, never JVM-local time. */
+public final class AnalyticsReadRows {
+    private AnalyticsReadRows() {}
+    public record Scope(Long id, String sourceAccount, String warehouseCode, String dataFamily,
+                        String scopeHash, String businessTimezone, String sourceTimezone,
+                        Integer staleAfterSeconds, Long publishedRunId, Long factRevision,
+                        Long publishedFactRevision, Boolean rebuildRequired,
+                        LocalDateTime knownOrderRoundFinishedAtUtc, LocalDateTime historyRoundFinishedAtUtc,
+                        Integer reviewTargetDays) {}
+    public record Run(Long id, Long taskId, Long scopeId, String sourceAccount, String warehouseCode, String runRole,
+                      String scopeHash, String scopeSnapshotJson, String status, String coverageStatus,
+                      LocalDateTime coveredFromUtc, LocalDateTime coveredUntilUtc,
+                      LocalDate completeDayFrom, LocalDate completeDayUntil,
+                      LocalDateTime fetchStartedAtUtc, LocalDateTime fetchFinishedAtUtc,
+                      LocalDateTime publishedAtUtc, Long calculatedFactRevision,
+                      String errorCode, String errorMessage, LocalDateTime supersededAtUtc, String executionPurpose, Boolean warehouseDailyReady) {}
+    public record Profile(String customerCode, String skuCode, String productName, String quantityUnit,
+                          LocalDateTime firstSeenAtUtc, LocalDateTime earliestEvidenceAtUtc,
+                          String evidenceType, Long evidenceRunId, Long lastSeenRunId) {}
+    public record Daily(String customerCode, String skuCode, LocalDate businessDate,
+                        BigDecimal outboundQuantity, Long outboundOrderCount, String quantityUnit) {}
+    public record Aggregate(String customerCode, String skuCode, String productName, String quantityUnit,
+        LocalDateTime evidenceAtUtc, Boolean unitValid, BigDecimal observedQuantity, Long skuOrderCount,
+        Integer completeDayCount, Integer partialDayCount, Integer unknownDayCount,
+        BigDecimal windowQuantity, Long windowSkuOrderCount, BigDecimal sales30Quantity, BigDecimal todayQuantity,
+        BigDecimal physicalQuantity, BigDecimal availableQuantity, BigDecimal frozenQuantity, BigDecimal transitQuantity,
+        LocalDateTime inventoryObservedAtUtc, String inventoryQuality, String inventoryReason) {}
+    public record Inventory(String customerCode,String skuCode,String productName,Boolean unitValid,
+        LocalDateTime evidenceAtUtc,BigDecimal physicalQuantity,BigDecimal availableQuantity,BigDecimal frozenQuantity,
+        BigDecimal transitQuantity,BigDecimal defectivePhysicalQuantity,LocalDateTime observedAtUtc,BigDecimal ownerOutbound,
+        BigDecimal observedOutbound,Long orderCount,LocalDate lastOutbound,Boolean observationEligible,
+        BigDecimal outboundQuantity30d,BigDecimal coverageDays,Integer noOutbound,Integer aboveThreshold,Boolean unassessable){}
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/AnalyticsReadSql.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/AnalyticsReadSql.java
new file mode 100644
index 000000000..453b2340c
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/AnalyticsReadSql.java
@@ -0,0 +1,314 @@
+package com.baiyue.lastleg.selfoperated.analytics.query;
+
+/** MySQL 8 CTEs: bounded by one version, warehouse and date range; no order/item/stage reads. */
+public final class AnalyticsReadSql {
+    private AnalyticsReadSql(){}
+    private static final String KEY_FILTER=" source_account=#{p.account} AND warehouse_code=#{p.warehouse}"
+        +" AND (#{p.customer} IS NULL OR customer_code=#{p.customer}) AND (#{p.sku} IS NULL OR sku_code=#{p.sku}) ";
+    private static String candidates(boolean salesOnly){
+        String sql="WITH candidates AS (SELECT customer_code,sku_code FROM ll_selfop_sku_profile WHERE profile_run_id=#{p.salesRun} AND"
+            +KEY_FILTER+" UNION SELECT customer_code,sku_code FROM ll_selfop_sku_profile WHERE profile_run_id=#{p.inventoryRun} AND"+KEY_FILTER+"),"
+            +" dim AS (SELECT c.customer_code,c.sku_code,COALESCE(i.product_name,s.product_name) product_name,"
+            +"COALESCE(s.quantity_unit,i.quantity_unit) quantity_unit,"
+            +"CASE WHEN (s.sku_code IS NOT NULL AND s.quantity_unit IS NULL) OR (i.sku_code IS NOT NULL AND i.quantity_unit IS NULL) THEN 0 "
+            +"WHEN s.quantity_unit IS NOT NULL AND i.quantity_unit IS NOT NULL AND s.quantity_unit<>i.quantity_unit THEN 0 "
+            +"WHEN COALESCE(s.quantity_unit,i.quantity_unit)<>'PCS' OR COALESCE(s.quantity_unit,i.quantity_unit) IS NULL THEN 0 ELSE 1 END profile_unit_valid,"
+            +"CASE WHEN s.evidence_type='VALID_OUTBOUND' AND s.evidence_run_id IS NOT NULL THEN s.earliest_evidence_at_utc END sales_evidence,"
+            +"CASE WHEN i.evidence_type='INVENTORY_OBSERVATION' AND i.evidence_run_id IS NOT NULL THEN i.earliest_evidence_at_utc END stock_evidence "
+            +"FROM candidates c LEFT JOIN ll_selfop_sku_profile s ON s.profile_run_id=#{p.salesRun} AND s.source_account=#{p.account} "
+            +"AND s.warehouse_code=#{p.warehouse} AND s.customer_code=c.customer_code AND s.sku_code=c.sku_code "
+            +"LEFT JOIN ll_selfop_sku_profile i ON i.profile_run_id=#{p.inventoryRun} AND i.source_account=#{p.account} "
+            +"AND i.warehouse_code=#{p.warehouse} AND i.customer_code=c.customer_code AND i.sku_code=c.sku_code),"
+            +" evidence AS (SELECT dim.*,CASE WHEN sales_evidence IS NULL THEN stock_evidence WHEN stock_evidence IS NULL THEN sales_evidence "
+            +"ELSE LEAST(sales_evidence,stock_evidence) END evidence_at_utc FROM dim),";
+        if(salesOnly){
+            int start=sql.indexOf("CASE WHEN (s.sku_code IS NOT NULL"),end=sql.indexOf("profile_unit_valid,",start);
+            sql=sql.substring(0,start)+"CASE WHEN s.sku_code IS NOT NULL THEN CASE WHEN s.quantity_unit='PCS' THEN 1 ELSE 0 END WHEN i.quantity_unit='PCS' THEN 1 ELSE 0 END "+sql.substring(end);
+            sql=sql.replace("COALESCE(s.quantity_unit,i.quantity_unit) quantity_unit","CASE WHEN s.sku_code IS NOT NULL THEN s.quantity_unit ELSE i.quantity_unit END quantity_unit");
+        }
+        return sql;
+    }
+    private static String cte(AnalyticsSqlRequest request){return cte(request,SalesSort.QUANTITY_DESC);}
+    private static String cte(AnalyticsSqlRequest request,SalesSort salesSort){
+        String kind=request.kind();
+        if("SUMMARY".equals(kind)&&!request.coverage().isEmpty())return coveredSummary(request,salesSort);
+        if("HOT".equals(kind))return hotSalesCte();
+        if("SLOW".equals(kind))return rankingCte();
+        String localEvidence="CONVERT_TZ(evidence_at_utc,'+00:00','+08:00')";
+        String observedStart="CONVERT_TZ(GREATEST(evidence_at_utc,#{p.coveredFrom}),'+00:00','+08:00')";
+        String observedEnd="CONVERT_TZ(#{p.coveredUntil},'+00:00','+08:00')";
+        // Candidate identity is already unique; SUMMARY materializes bounds with NO_MERGE
+        // at its consumer, avoiding a redundant DISTINCT temporary table.
+        String sql=candidates("SUMMARY".equals(kind))+" bounds AS (SELECT evidence.*,"
+            +"CASE WHEN evidence_at_utc IS NOT NULL AND #{p.completeFrom} IS NOT NULL AND #{p.completeUntil} IS NOT NULL THEN "
+            +"GREATEST(#{p.from},#{p.completeFrom},TIMESTAMPADD(DAY,CASE WHEN CAST("+localEvidence+" AS TIME)='00:00:00' THEN 0 ELSE 1 END,DATE("+localEvidence+"))) END full_start,"
+            +"LEAST(#{p.until},#{p.completeUntil},#{p.anchor}) full_end,"
+            +"CASE WHEN evidence_at_utc IS NOT NULL AND #{p.coveredFrom} IS NOT NULL AND #{p.coveredUntil} IS NOT NULL AND GREATEST(evidence_at_utc,#{p.coveredFrom})<#{p.coveredUntil} THEN GREATEST(#{p.from},DATE("+observedStart+")) END observed_start,"
+            +"CASE WHEN evidence_at_utc IS NOT NULL AND #{p.coveredFrom} IS NOT NULL AND #{p.coveredUntil} IS NOT NULL AND GREATEST(evidence_at_utc,#{p.coveredFrom})<#{p.coveredUntil} THEN LEAST(#{p.until},TIMESTAMPADD(DAY,CASE WHEN CAST("+observedEnd+" AS TIME)='00:00:00' THEN 0 ELSE 1 END,DATE("+observedEnd+"))) END observed_end "
+            +"FROM evidence),"
+            +" ranged AS (SELECT b.customer_code,b.sku_code,SUM(d.outbound_quantity) observed_sum,COUNT(d.id) actual_days,"
+            +"SUM(d.outbound_order_count) order_sum,MIN(d.quantity_unit) min_unit,MAX(d.quantity_unit) max_unit,"
+            +"SUM(CASE WHEN d.business_date>=#{p.completeFrom} AND d.business_date<#{p.completeUntil} AND d.business_date<#{p.anchor} THEN 1 ELSE 0 END) actual_complete,"
+            +"SUM(CASE WHEN d.business_date>=b.full_start AND d.business_date<b.full_end THEN 1 ELSE 0 END) actual_full_span,"
+            +"SUM(CASE WHEN d.business_date>=b.observed_start AND d.business_date<b.observed_end THEN 1 ELSE 0 END) actual_observed_span "
+            +"FROM bounds b JOIN ll_selfop_sku_daily_sales d ON d.sales_run_id=#{p.salesRun} AND d.source_account=#{p.account} "
+            +"AND d.warehouse_code=#{p.warehouse} AND d.customer_code=b.customer_code AND d.sku_code=b.sku_code "
+            +"AND d.business_date>=#{p.from} AND d.business_date<#{p.until} GROUP BY b.customer_code,b.sku_code),"
+            +" metric_sales AS (SELECT customer_code,sku_code,"
+            +"SUM(CASE WHEN business_date>=#{p.windowFrom} AND business_date<#{p.anchor} THEN outbound_quantity ELSE 0 END) window_quantity,"
+            +"SUM(CASE WHEN business_date>=#{p.windowFrom} AND business_date<#{p.anchor} THEN outbound_order_count ELSE 0 END) window_orders,"
+            +"SUM(CASE WHEN business_date<#{p.anchor} THEN outbound_quantity ELSE 0 END) sales30_quantity,"
+            +"SUM(CASE WHEN business_date=#{p.anchor} THEN outbound_quantity ELSE NULL END) today_quantity,"
+            +"MIN(quantity_unit) min_unit,MAX(quantity_unit) max_unit "
+            +"FROM ll_selfop_sku_daily_sales WHERE sales_run_id=#{p.salesRun} AND"+KEY_FILTER
+            +" AND business_date>=TIMESTAMPADD(DAY,-30,#{p.anchor}) AND business_date<TIMESTAMPADD(DAY,1,#{p.anchor}) "
+            +"GROUP BY customer_code,sku_code),"
+            +" counted AS (SELECT "+("SUMMARY".equals(kind)?"/*+ NO_MERGE(b) */ ":"")+"b.*,r.observed_sum,r.order_sum,"
+            +"CASE WHEN b.profile_unit_valid=1 AND (r.min_unit IS NULL OR (r.min_unit=b.quantity_unit AND r.max_unit=b.quantity_unit)) "
+            +"AND (m.min_unit IS NULL OR (m.min_unit=b.quantity_unit AND m.max_unit=b.quantity_unit)) THEN 1 ELSE 0 END unit_valid,"
+            +"CASE WHEN #{p.formalSales}=1 THEN GREATEST(0,COALESCE(TIMESTAMPDIFF(DAY,b.full_start,b.full_end),0)) "
+            +"-COALESCE(r.actual_full_span,0)+COALESCE(r.actual_complete,0) ELSE 0 END complete_count,"
+            +"CASE WHEN #{p.salesKnown}=1 THEN GREATEST(0,COALESCE(TIMESTAMPDIFF(DAY,b.observed_start,b.observed_end),0)) "
+            +"-COALESCE(r.actual_observed_span,0)+COALESCE(r.actual_days,0) ELSE 0 END observed_count,"
+            +"m.window_quantity,m.window_orders,m.sales30_quantity,m.today_quantity "
+            +"FROM bounds b LEFT JOIN ranged r ON r.customer_code=b.customer_code AND r.sku_code=b.sku_code "
+            +"LEFT JOIN metric_sales m ON m.customer_code=b.customer_code AND m.sku_code=b.sku_code),"
+            +" result AS (SELECT c.customer_code,c.sku_code,c.product_name,c.quantity_unit,c.evidence_at_utc,c.unit_valid,"
+            +"CASE WHEN c.unit_valid=1 AND c.observed_count>0 THEN COALESCE(c.observed_sum,0) END observed_quantity,"
+            +"c.order_sum sku_order_count,CASE WHEN c.unit_valid=1 THEN c.complete_count ELSE 0 END complete_day_count,"
+            +"CASE WHEN c.unit_valid=1 THEN GREATEST(0,c.observed_count-c.complete_count) ELSE 0 END partial_day_count,"
+            +"TIMESTAMPDIFF(DAY,#{p.from},#{p.until})-CASE WHEN c.unit_valid=1 THEN c.observed_count ELSE 0 END unknown_day_count,"
+            +"CASE WHEN c.unit_valid=1 AND #{p.completeWindow}=1 THEN COALESCE(c.window_quantity,0) END window_quantity,"
+            +"CASE WHEN c.unit_valid=1 AND #{p.completeWindow}=1 THEN COALESCE(c.window_orders,0) END window_sku_order_count,"
+            +"CASE WHEN c.unit_valid=1 AND #{p.complete30}=1 THEN COALESCE(c.sales30_quantity,0) END sales30_quantity,"
+            +"CASE WHEN c.unit_valid=1 AND #{p.salesKnown}=1 THEN c.today_quantity END today_quantity,"
+            +"st.physical_quantity,st.available_quantity,st.frozen_quantity,st.transit_quantity,st.observed_at_utc inventory_observed_at_utc,"
+            +"CASE WHEN st.sku_code IS NULL THEN 'UNKNOWN' WHEN st.quality_status='INVALID' THEN 'INVALID' "
+            +"WHEN st.quality_status<>'VALID' OR st.available_quantity IS NULL OR st.physical_quantity IS NULL OR st.frozen_quantity IS NULL OR st.transit_quantity IS NULL THEN 'UNKNOWN' "
+            +"WHEN st.available_quantity<0 OR st.physical_quantity<0 OR st.frozen_quantity<0 OR st.transit_quantity<0 THEN 'INVALID' "
+            +"WHEN #{p.stockFresh}=0 THEN 'STALE' ELSE 'VALID' END inventory_quality,st.quality_reason inventory_reason "
+            +"FROM counted c LEFT JOIN ll_selfop_inventory_snapshot st ON st.snapshot_run_id=#{p.inventoryRun} AND st.source_account=#{p.account} "
+            +"AND st.warehouse_code=#{p.warehouse} AND st.customer_code=c.customer_code AND st.sku_code=c.sku_code AND st.product_quality=0) ";
+        if("SUMMARY".equals(kind)){
+            // Aggregate facts before joining SKU evidence. Repeating boundary expressions
+            // inside every fact's SUM dominated the long-window MySQL execution profile.
+            int rangeStart=sql.indexOf(" ranged AS (");int rangeEnd=sql.indexOf(" metric_sales AS (",rangeStart);
+            // Only the measured maximum chart window uses SKU-ordered coverage; short windows retain date-range access.
+            String rangedHint=request.from()!=null&&request.until()!=null
+                &&java.time.temporal.ChronoUnit.DAYS.between(request.from(),request.until())==366
+                ?"/*+ INDEX(d idx_selfop_daily_sku_cover) */ ":"";
+            // Sorting needs only the observed quantity and its validity. The daily unique
+            // key makes observed_count the union cardinality of actual days and the
+            // continuous observed date interval: it is positive iff either is nonempty.
+            // Strict UTC intersection rejects empty/reversed intervals without computing
+            // every candidate's full/partial day boundaries before the page is selected.
+            String observedIntersection="e.evidence_at_utc IS NOT NULL AND #{p.coveredFrom} IS NOT NULL AND #{p.coveredUntil} IS NOT NULL "
+                +"AND GREATEST(e.evidence_at_utc,#{p.coveredFrom},CONVERT_TZ(CAST(#{p.from} AS DATETIME),'+08:00','+00:00'))"
+                +"<LEAST(#{p.coveredUntil},CONVERT_TZ(CAST(#{p.until} AS DATETIME),'+08:00','+00:00'))";
+            String sortPage=" sort_sales AS (SELECT "+rangedHint+"d.customer_code,d.sku_code,SUM(d.outbound_quantity) observed_sum,"
+                +"COUNT(*) actual_days,MIN(d.quantity_unit) min_unit,MAX(d.quantity_unit) max_unit "
+                +"FROM ll_selfop_sku_daily_sales d WHERE d.sales_run_id=#{p.salesRun} AND"+KEY_FILTER
+                +"AND d.business_date>=#{p.from} AND d.business_date<#{p.until} GROUP BY d.customer_code,d.sku_code),"
+                +" rankable AS (SELECT e.*,CASE WHEN e.profile_unit_valid=1 "
+                +"AND (s.min_unit IS NULL OR (s.min_unit=e.quantity_unit AND s.max_unit=e.quantity_unit)) "
+                +"AND #{p.salesKnown}=1 AND (COALESCE(s.actual_days,0)>0 OR ("+observedIntersection+")) "
+                +"THEN COALESCE(s.observed_sum,0) END sort_observed_quantity "
+                +"FROM evidence e LEFT JOIN sort_sales s ON s.customer_code=e.customer_code AND s.sku_code=e.sku_code),"
+                +" paged_keys AS (SELECT * FROM rankable ORDER BY "+salesSort.sql("sort_observed_quantity")+" LIMIT #{p.size} OFFSET #{p.offset}),";
+            sql=sql.substring(0,rangeStart)+" ranged AS (SELECT d.customer_code,d.sku_code,SUM(d.outbound_quantity) observed_sum,"
+                +"COUNT(*) actual_days,SUM(d.outbound_order_count) order_sum,MIN(d.quantity_unit) min_unit,MAX(d.quantity_unit) max_unit,"
+                +"SUM(CASE WHEN d.business_date>=#{p.completeFrom} AND d.business_date<#{p.completeUntil} AND d.business_date<#{p.anchor} THEN 1 ELSE 0 END) actual_complete "
+                +"FROM paged_keys k JOIN ll_selfop_sku_daily_sales d ON d.customer_code=k.customer_code AND d.sku_code=k.sku_code "
+                +"WHERE d.sales_run_id=#{p.salesRun} AND d.source_account=#{p.account} AND d.warehouse_code=#{p.warehouse}"
+                +" AND d.business_date>=#{p.from} AND d.business_date<#{p.until} GROUP BY d.customer_code,d.sku_code),"+sql.substring(rangeEnd);
+            sql=sql.replace(" bounds AS (",sortPage+" bounds AS (").replace("FROM evidence),","FROM paged_keys evidence),");
+            String scopedCount="SELECT COUNT(*) FROM ll_selfop_sku_daily_sales d2 WHERE d2.sales_run_id=#{p.salesRun} "
+                +"AND d2.source_account=#{p.account} AND d2.warehouse_code=#{p.warehouse} "
+                +"AND d2.customer_code=b.customer_code AND d2.sku_code=b.sku_code ";
+            String fullSpan="CASE WHEN r.actual_days IS NULL THEN 0 "
+                +"WHEN b.full_start<=GREATEST(#{p.from},#{p.completeFrom}) AND b.full_end>=LEAST(#{p.until},#{p.completeUntil},#{p.anchor}) "
+                +"THEN r.actual_complete ELSE ("+scopedCount+"AND d2.business_date>=GREATEST(#{p.from},b.full_start) "
+                +"AND d2.business_date<LEAST(#{p.until},b.full_end)) END";
+            String observedSpan="CASE WHEN r.actual_days IS NULL THEN 0 "
+                +"WHEN b.observed_start<=#{p.from} AND b.observed_end>=#{p.until} THEN r.actual_days ELSE ("+scopedCount
+                +"AND d2.business_date>=GREATEST(#{p.from},b.observed_start) AND d2.business_date<LEAST(#{p.until},b.observed_end)) END";
+            sql=sql.replace("COALESCE(r.actual_full_span,0)","("+fullSpan+")")
+                .replace("COALESCE(r.actual_observed_span,0)","("+observedSpan+")");
+            int start=sql.indexOf(" metric_sales AS (");int end=sql.indexOf(" counted AS (",start);
+            // An empty aggregate joined back through bounds can still be merged into
+            // another candidate cross product by MySQL. Summary has no metric join at all.
+            sql=sql.substring(0,start)+sql.substring(end);
+            sql=sql.replace("AND (m.min_unit IS NULL OR (m.min_unit=b.quantity_unit AND m.max_unit=b.quantity_unit)) ","")
+                .replace("m.window_quantity,m.window_orders,m.sales30_quantity,m.today_quantity",
+                    "CAST(NULL AS DECIMAL(20,6)) window_quantity,CAST(NULL AS SIGNED) window_orders,"
+                    +"CAST(NULL AS DECIMAL(20,6)) sales30_quantity,CAST(NULL AS DECIMAL(20,6)) today_quantity")
+                .replace("LEFT JOIN metric_sales m ON m.customer_code=b.customer_code AND m.sku_code=b.sku_code","");
+            // A sales chart does not require inventory quantities or freshness. Keep only profile evidence.
+            int stockJoin=sql.indexOf("LEFT JOIN ll_selfop_inventory_snapshot st");
+            sql=sql.substring(0,stockJoin)+"LEFT JOIN (SELECT CAST(NULL AS DECIMAL(20,0)) snapshot_run_id,CAST(NULL AS CHAR(64)) source_account,"
+                +"CAST(NULL AS CHAR(64)) warehouse_code,CAST(NULL AS CHAR(64)) customer_code,CAST(NULL AS CHAR(128)) sku_code,"
+                +"CAST(NULL AS DECIMAL(20,6)) physical_quantity,CAST(NULL AS DECIMAL(20,6)) available_quantity,"
+                +"CAST(NULL AS DECIMAL(20,6)) frozen_quantity,CAST(NULL AS DECIMAL(20,6)) transit_quantity,CAST(NULL AS DATETIME) observed_at_utc,"
+                +"CAST(NULL AS CHAR(16)) quality_status,CAST(NULL AS CHAR(64)) quality_reason,CAST(NULL AS DECIMAL(6,0)) product_quality) st ON 1=0) ";
+        }
+        return sql;
+    }
+    private static String coveredSummary(AnalyticsSqlRequest p,SalesSort salesSort){
+        var intervals=new java.util.ArrayList<String>();
+        for(int i=0;i<p.coverage().size();i++)intervals.add("SELECT CAST(#{p.coverage["+i+"].from} AS DATETIME) lo,CAST(#{p.coverage["+i+"].until} AS DATETIME) hi");
+        var dates=new java.util.ArrayList<String>();
+        for(var day=p.from();day.isBefore(p.until());day=day.plusDays(1))dates.add("SELECT CAST('"+day+"' AS DATE) business_date");
+        String start="TIMESTAMPADD(HOUR,-8,CAST(calendar.business_date AS DATETIME))",end="TIMESTAMPADD(DAY,1,"+start+")";
+        String full="EXISTS (SELECT 1 FROM coverage v WHERE v.lo<="+start+" AND v.hi>="+end+")";
+        String observed="EXISTS (SELECT 1 FROM coverage v WHERE GREATEST(v.lo,b.evidence_at_utc,"+start+")<LEAST(v.hi,"+end+"))";
+        String whole="calendar.business_date<#{p.anchor} AND "+full+" AND (d.id IS NOT NULL OR b.evidence_at_utc<="+start+")";
+        return candidates(true)+" coverage AS ("+String.join(" UNION ALL ",intervals)+"),calendar AS ("+String.join(" UNION ALL ",dates)+"),"
+            +" sort_sales AS (SELECT customer_code,sku_code,SUM(outbound_quantity) observed_sum,MIN(quantity_unit) min_unit,MAX(quantity_unit) max_unit,MIN(outbound_quantity) min_qty"
+            +" FROM ll_selfop_sku_daily_sales WHERE sales_run_id=#{p.salesRun} AND"+KEY_FILTER+" AND business_date>=#{p.from} AND business_date<#{p.until} GROUP BY customer_code,sku_code),"
+            +" rankable AS (SELECT e.*,CASE WHEN e.profile_unit_valid=1 AND (s.min_unit IS NULL OR (s.min_unit=e.quantity_unit AND s.max_unit=e.quantity_unit AND s.min_qty>=0)) THEN 1 ELSE 0 END unit_valid,"
+            +"CASE WHEN #{p.salesKnown}=1 AND e.profile_unit_valid=1 AND (s.min_unit IS NULL OR (s.min_unit=e.quantity_unit AND s.max_unit=e.quantity_unit AND s.min_qty>=0))"
+            +" AND (s.observed_sum IS NOT NULL OR EXISTS (SELECT 1 FROM coverage v WHERE GREATEST(v.lo,e.evidence_at_utc,TIMESTAMPADD(HOUR,-8,CAST(#{p.from} AS DATETIME)))<LEAST(v.hi,TIMESTAMPADD(HOUR,-8,CAST(#{p.until} AS DATETIME))))) THEN COALESCE(s.observed_sum,0) END observed_quantity"
+            +" FROM evidence e LEFT JOIN sort_sales s ON s.customer_code=e.customer_code AND s.sku_code=e.sku_code),"
+            +" paged_keys AS (SELECT * FROM rankable ORDER BY "+salesSort.sql("observed_quantity")+" LIMIT #{p.size} OFFSET #{p.offset}),"
+            +" day_counts AS (SELECT b.customer_code,b.sku_code,SUM(d.outbound_order_count) sku_order_count,"
+            +"SUM(CASE WHEN #{p.formalSales}=1 AND "+whole+" THEN 1 ELSE 0 END) complete_count,"
+            +"SUM(CASE WHEN #{p.salesKnown}=1 AND (d.id IS NOT NULL OR "+observed+") THEN 1 ELSE 0 END) observed_count"
+            +" FROM paged_keys b CROSS JOIN calendar LEFT JOIN ll_selfop_sku_daily_sales d ON d.sales_run_id=#{p.salesRun} AND d.source_account=#{p.account} AND d.warehouse_code=#{p.warehouse}"
+            +" AND d.customer_code=b.customer_code AND d.sku_code=b.sku_code AND d.business_date=calendar.business_date GROUP BY b.customer_code,b.sku_code),"
+            +" result AS (SELECT b.customer_code,b.sku_code,b.product_name,b.quantity_unit,b.evidence_at_utc,b.unit_valid,b.observed_quantity,n.sku_order_count,"
+            +"CASE WHEN b.unit_valid=1 THEN n.complete_count ELSE 0 END complete_day_count,"
+            +"CASE WHEN b.unit_valid=1 THEN n.observed_count-n.complete_count ELSE 0 END partial_day_count,"
+            +"TIMESTAMPDIFF(DAY,#{p.from},#{p.until})-CASE WHEN b.unit_valid=1 THEN n.observed_count ELSE 0 END unknown_day_count,"
+            +"NULL window_quantity,NULL window_sku_order_count,NULL sales30_quantity,NULL today_quantity,NULL physical_quantity,NULL available_quantity,NULL frozen_quantity,NULL transit_quantity,"
+            +"NULL inventory_observed_at_utc,'UNKNOWN' inventory_quality,NULL inventory_reason FROM paged_keys b JOIN day_counts n ON n.customer_code=b.customer_code AND n.sku_code=b.sku_code) ";
+    }
+    /** Ranking consumes the 30-day aggregate, not chart day-span counts. Its 7/30-day
+     * window is contained in this scan, so the same unit proof covers both windows. */
+    private static String rankingCte(){
+        String valid="c.profile_unit_valid=1 AND (m.min_unit IS NULL OR (m.min_unit=c.quantity_unit AND m.max_unit=c.quantity_unit))";
+        return candidates(false)+" metric_sales AS (SELECT customer_code,sku_code,"
+            +"SUM(CASE WHEN business_date>=#{p.from} AND business_date<#{p.until} THEN outbound_quantity ELSE 0 END) window_quantity,"
+            +"SUM(CASE WHEN business_date>=#{p.from} AND business_date<#{p.until} THEN outbound_order_count ELSE 0 END) window_orders,"
+            +"SUM(CASE WHEN business_date<#{p.anchor} THEN outbound_quantity ELSE 0 END) sales30_quantity,"
+            +"SUM(CASE WHEN business_date=#{p.anchor} THEN outbound_quantity ELSE NULL END) today_quantity,MIN(quantity_unit) min_unit,MAX(quantity_unit) max_unit "
+            +"FROM ll_selfop_sku_daily_sales WHERE sales_run_id=#{p.salesRun} AND"+KEY_FILTER
+            +" AND business_date>=LEAST(#{p.from},TIMESTAMPADD(DAY,-30,#{p.anchor})) AND business_date<TIMESTAMPADD(DAY,1,#{p.anchor}) GROUP BY customer_code,sku_code),"
+            +" result AS (SELECT c.customer_code,c.sku_code,c.product_name,c.quantity_unit,c.evidence_at_utc,CASE WHEN "+valid+" THEN 1 ELSE 0 END unit_valid,"
+            +"CAST(NULL AS DECIMAL(20,6)) observed_quantity,CAST(NULL AS SIGNED) sku_order_count,0 complete_day_count,0 partial_day_count,0 unknown_day_count,"
+            +"CASE WHEN "+valid+" AND #{p.completeWindow}=1 THEN COALESCE(m.window_quantity,0) END window_quantity,"
+            +"CASE WHEN "+valid+" AND #{p.completeWindow}=1 THEN COALESCE(m.window_orders,0) END window_sku_order_count,"
+            +"CASE WHEN "+valid+" AND #{p.complete30}=1 THEN COALESCE(m.sales30_quantity,0) END sales30_quantity,"
+            +"CASE WHEN "+valid+" AND #{p.salesKnown}=1 THEN m.today_quantity END today_quantity,"
+            +"st.physical_quantity,st.available_quantity,st.frozen_quantity,st.transit_quantity,st.observed_at_utc inventory_observed_at_utc,"
+            +"CASE WHEN st.sku_code IS NULL THEN 'UNKNOWN' WHEN st.quality_status='INVALID' THEN 'INVALID' "
+            +"WHEN st.quality_status<>'VALID' OR st.available_quantity IS NULL OR st.physical_quantity IS NULL OR st.frozen_quantity IS NULL OR st.transit_quantity IS NULL THEN 'UNKNOWN' "
+            +"WHEN st.available_quantity<0 OR st.physical_quantity<0 OR st.frozen_quantity<0 OR st.transit_quantity<0 THEN 'INVALID' "
+            +"WHEN #{p.stockFresh}=0 THEN 'STALE' ELSE 'VALID' END inventory_quality,st.quality_reason inventory_reason "
+            +"FROM evidence c LEFT JOIN metric_sales m ON m.customer_code=c.customer_code AND m.sku_code=c.sku_code "
+            +"LEFT JOIN ll_selfop_inventory_snapshot st ON st.snapshot_run_id=#{p.inventoryRun} AND st.source_account=#{p.account} "
+            +"AND st.warehouse_code=#{p.warehouse} AND st.customer_code=c.customer_code AND st.sku_code=c.sku_code AND st.product_quality=0) ";
+    }
+    private static String filter(String kind){
+        if("HOT".equals(kind))return " WHERE window_quantity>0 ";
+        if("SLOW".equals(kind))return " WHERE window_quantity IS NOT NULL AND inventory_quality='VALID' AND available_quantity>0 "
+            +"AND evidence_at_utc<=CONVERT_TZ(CAST(#{p.from} AS DATETIME),'+08:00','+00:00') ";
+        return "";
+    }
+    private static String order(String kind){
+        if("HOT".equals(kind))return "window_quantity DESC,window_sku_order_count DESC,sku_code ASC,customer_code ASC";
+        if("SLOW".equals(kind))return "window_quantity ASC,available_quantity DESC,sku_code ASC,customer_code ASC";
+        if("SUMMARY".equals(kind))return "observed_quantity IS NULL,observed_quantity DESC,sku_code ASC,customer_code ASC";
+        return "sku_code ASC,customer_code ASC";
+    }
+    public static String page(java.util.Map<String,Object> parameters){
+        var p=(AnalyticsSqlRequest)parameters.get("p");
+        if("HOT".equals(p.kind()))return typed(hotPage(),p);
+        SalesSort salesSort=(SalesSort)parameters.getOrDefault("salesSort",SalesSort.QUANTITY_DESC);
+        return typed(cte(p,salesSort)+"SELECT customer_code,sku_code,product_name,quantity_unit,evidence_at_utc,unit_valid,observed_quantity,sku_order_count,"
+            +"complete_day_count,partial_day_count,unknown_day_count,window_quantity,window_sku_order_count,sales30_quantity,today_quantity,"
+            +"physical_quantity,available_quantity,frozen_quantity,transit_quantity,inventory_observed_at_utc,inventory_quality,inventory_reason "
+            +"FROM result"+filter(p.kind()).stripTrailing()+" ORDER BY "+("SUMMARY".equals(p.kind())?salesSort.sql("observed_quantity"):order(p.kind()))
+            +("SUMMARY".equals(p.kind())?"":" LIMIT #{p.size} OFFSET #{p.offset}"),p);
+    }
+    /** Rank on sales alone. Inventory enrichment and its quality checks touch only the
+     * selected page; inventory missing/invalid units cannot erase a valid sales rank. */
+    private static String hotSalesCte(){
+        String profileValid="(s.sku_code IS NULL OR s.quantity_unit='PCS')";
+        String windowValid=profileValid+" AND COALESCE(m.window_valid,1)=1";
+        String thirtyValid=profileValid+" AND COALESCE(m.thirty_valid,1)=1";
+        String todayValid=profileValid+" AND COALESCE(m.today_valid,1)=1";
+        return "WITH candidates AS (SELECT customer_code,sku_code FROM ll_selfop_sku_profile WHERE profile_run_id=#{p.salesRun} AND"+KEY_FILTER
+            +" UNION SELECT customer_code,sku_code FROM ll_selfop_sku_profile WHERE profile_run_id=#{p.inventoryRun} AND"+KEY_FILTER+"),"
+            +" metric_sales AS (SELECT customer_code,sku_code,"
+            +"SUM(CASE WHEN business_date>=#{p.from} AND business_date<#{p.until} THEN outbound_quantity ELSE 0 END) window_quantity,"
+            +"SUM(CASE WHEN business_date>=#{p.from} AND business_date<#{p.until} THEN outbound_order_count ELSE 0 END) window_orders,"
+            +"SUM(CASE WHEN business_date>=TIMESTAMPADD(DAY,-30,#{p.anchor}) AND business_date<#{p.anchor} THEN outbound_quantity ELSE 0 END) sales30_quantity,"
+            +"SUM(CASE WHEN business_date=#{p.anchor} THEN outbound_quantity END) today_quantity,"
+            +"MIN(CASE WHEN business_date>=#{p.from} AND business_date<#{p.until} THEN CASE WHEN quantity_unit='PCS' AND outbound_quantity>=0 THEN 1 ELSE 0 END ELSE 1 END) window_valid,"
+            +"MIN(CASE WHEN business_date>=TIMESTAMPADD(DAY,-30,#{p.anchor}) AND business_date<#{p.anchor} THEN CASE WHEN quantity_unit='PCS' AND outbound_quantity>=0 THEN 1 ELSE 0 END ELSE 1 END) thirty_valid,"
+            +"MIN(CASE WHEN business_date=#{p.anchor} THEN CASE WHEN quantity_unit='PCS' AND outbound_quantity>=0 THEN 1 ELSE 0 END ELSE 1 END) today_valid "
+            +"FROM ll_selfop_sku_daily_sales WHERE sales_run_id=#{p.salesRun} AND"+KEY_FILTER
+            +"AND business_date>=LEAST(#{p.from},TIMESTAMPADD(DAY,-30,#{p.anchor})) AND business_date<GREATEST(#{p.until},TIMESTAMPADD(DAY,1,#{p.anchor})) GROUP BY customer_code,sku_code),"
+            +" result AS (SELECT c.customer_code,c.sku_code,CASE WHEN "+windowValid+" THEN 1 ELSE 0 END unit_valid,"
+            +"CASE WHEN "+windowValid+" AND #{p.salesKnown}=1 THEN CASE WHEN #{p.completeWindow}=1 THEN COALESCE(m.window_quantity,0) ELSE m.window_quantity END END window_quantity,"
+            +"CASE WHEN "+windowValid+" AND #{p.salesKnown}=1 THEN CASE WHEN #{p.completeWindow}=1 THEN COALESCE(m.window_orders,0) ELSE m.window_orders END END window_sku_order_count,"
+            +"CASE WHEN "+thirtyValid+" AND #{p.complete30}=1 THEN COALESCE(m.sales30_quantity,0) END sales30_quantity,"
+            +"CASE WHEN "+todayValid+" THEN 1 ELSE 0 END today_unit_valid,"
+            +"CASE WHEN "+todayValid+" AND #{p.salesKnown}=1 THEN m.today_quantity END today_quantity "
+            +"FROM candidates c LEFT JOIN ll_selfop_sku_profile s ON s.profile_run_id=#{p.salesRun} AND s.source_account=#{p.account} AND s.warehouse_code=#{p.warehouse} "
+            +"AND s.customer_code=c.customer_code AND s.sku_code=c.sku_code LEFT JOIN metric_sales m ON m.customer_code=c.customer_code AND m.sku_code=c.sku_code) ";
+    }
+    private static String hotPage(){
+        String salesEvidence="CASE WHEN s.evidence_type='VALID_OUTBOUND' AND s.evidence_run_id IS NOT NULL THEN s.earliest_evidence_at_utc END";
+        String stockEvidence="CASE WHEN i.evidence_type='INVENTORY_OBSERVATION' AND i.evidence_run_id IS NOT NULL THEN i.earliest_evidence_at_utc END";
+        String evidence="CASE WHEN ("+salesEvidence+") IS NULL THEN "+stockEvidence+" WHEN ("+stockEvidence+") IS NULL THEN "+salesEvidence
+            +" ELSE LEAST("+salesEvidence+","+stockEvidence+") END";
+        String todayStart="CONVERT_TZ(CAST(#{p.anchor} AS DATETIME),'+08:00','+00:00')";
+        String today="CASE WHEN k.today_unit_valid=1 AND #{p.salesKnown}=1 THEN CASE WHEN k.today_quantity IS NOT NULL THEN k.today_quantity "
+            +"WHEN ("+evidence+") IS NOT NULL AND #{p.coveredUntil} IS NOT NULL AND GREATEST("+todayStart+",("+evidence+"),COALESCE(#{p.coveredFrom},"+todayStart+"))<#{p.coveredUntil} THEN 0 END END";
+        return hotSalesCte()+", paged AS (SELECT * FROM result WHERE window_quantity>0 ORDER BY "+order("HOT")+" LIMIT #{p.size} OFFSET #{p.offset}) "
+            +"SELECT k.customer_code,k.sku_code,COALESCE(i.product_name,s.product_name) product_name,'PCS' quantity_unit,"
+            +evidence+" evidence_at_utc,k.unit_valid,"
+            +"CAST(NULL AS DECIMAL(20,6)) observed_quantity,CAST(NULL AS SIGNED) sku_order_count,0 complete_day_count,0 partial_day_count,0 unknown_day_count,"
+            +"k.window_quantity,k.window_sku_order_count,k.sales30_quantity,"+today+" today_quantity,st.physical_quantity,st.available_quantity,st.frozen_quantity,st.transit_quantity,st.observed_at_utc inventory_observed_at_utc,"
+            +"CASE WHEN st.sku_code IS NULL OR i.quantity_unit IS NULL OR i.quantity_unit<>'PCS' THEN 'UNKNOWN' WHEN st.quality_status='INVALID' THEN 'INVALID' "
+            +"WHEN st.quality_status<>'VALID' OR st.available_quantity IS NULL OR st.physical_quantity IS NULL OR st.frozen_quantity IS NULL OR st.transit_quantity IS NULL THEN 'UNKNOWN' "
+            +"WHEN st.available_quantity<0 OR st.physical_quantity<0 OR st.frozen_quantity<0 OR st.transit_quantity<0 THEN 'INVALID' WHEN #{p.stockFresh}=0 THEN 'STALE' ELSE 'VALID' END inventory_quality,"
+            +"CASE WHEN i.quantity_unit IS NULL OR i.quantity_unit<>'PCS' THEN 'UNIT_UNKNOWN_OR_CONFLICT' ELSE st.quality_reason END inventory_reason "
+            +"FROM paged k LEFT JOIN ll_selfop_sku_profile s ON s.profile_run_id=#{p.salesRun} AND s.source_account=#{p.account} AND s.warehouse_code=#{p.warehouse} AND s.customer_code=k.customer_code AND s.sku_code=k.sku_code "
+            +"LEFT JOIN ll_selfop_sku_profile i ON i.profile_run_id=#{p.inventoryRun} AND i.source_account=#{p.account} AND i.warehouse_code=#{p.warehouse} AND i.customer_code=k.customer_code AND i.sku_code=k.sku_code "
+            +"LEFT JOIN ll_selfop_inventory_snapshot st ON st.snapshot_run_id=#{p.inventoryRun} AND st.source_account=#{p.account} AND st.warehouse_code=#{p.warehouse} AND st.customer_code=k.customer_code AND st.sku_code=k.sku_code AND st.product_quality=0 "
+            +"ORDER BY k.window_quantity DESC,k.window_sku_order_count DESC,k.sku_code ASC,k.customer_code ASC";
+    }
+    public static String count(java.util.Map<String,Object> parameters){
+        var p=(AnalyticsSqlRequest)parameters.get("p");
+        // Candidate totals do not scan daily rows for normal lists.
+        return typed("SELECT COUNT(*) FROM (SELECT customer_code,sku_code FROM ll_selfop_sku_profile "
+            +"WHERE profile_run_id=#{p.salesRun} AND"+KEY_FILTER+" UNION SELECT customer_code,sku_code FROM ll_selfop_sku_profile "
+            +"WHERE profile_run_id=#{p.inventoryRun} AND"+KEY_FILTER+") candidate_keys",p);
+    }
+    public static String rankingStats(java.util.Map<String,Object> parameters){
+        var p=(AnalyticsSqlRequest)parameters.get("p");
+        String reason="HOT".equals(p.kind())?"CASE WHEN unit_valid=0 THEN 'UNIT_UNKNOWN_OR_CONFLICT' WHEN window_quantity IS NULL THEN 'SALES_WINDOW_UNAVAILABLE' ELSE 'ZERO_OUTBOUND' END":
+            "CASE WHEN inventory_quality<>'VALID' THEN CONCAT('INVENTORY_',inventory_quality) WHEN available_quantity<=0 THEN 'NO_AVAILABLE_INVENTORY' "
+            +"WHEN window_quantity IS NULL THEN 'SALES_WINDOW_UNAVAILABLE' ELSE 'OBSERVATION_INSUFFICIENT' END";
+        String eligible=filter(p.kind()).replace(" WHERE ","").strip();
+        return typed(cte(p)+", classified AS (SELECT CASE WHEN "+eligible+" THEN 1 ELSE 0 END eligible,"
+            +reason+" reason FROM result), counts AS (SELECT eligible,CASE WHEN eligible=1 THEN NULL ELSE reason END reason,COUNT(*) amount "
+            +"FROM classified GROUP BY eligible,CASE WHEN eligible=1 THEN NULL ELSE reason END) "
+            +"SELECT LEAST(SUM(CASE WHEN eligible=1 THEN amount ELSE 0 END) OVER (),100) total,reason,"
+            +"CASE WHEN eligible=0 THEN amount ELSE 0 END excluded_count FROM counts",p);
+    }
+    private static String typed(String sql,AnalyticsSqlRequest p){
+        String filters=" source_account=#{p.account} AND warehouse_code=#{p.warehouse} ";
+        if(p.customer()!=null)filters+="AND customer_code=#{p.customer} ";
+        if(p.sku()!=null)filters+="AND sku_code=#{p.sku} ";
+        sql=sql.replace(KEY_FILTER,filters);
+        // Explicit expression types preserve NULL semantics and avoid inference from bare JDBC parameters.
+        for(String key:java.util.List.of("from","until","anchor","windowFrom","completeFrom","completeUntil"))
+            sql=sql.replace("#{p."+key+"}","CAST(#{p."+key+"} AS DATE)");
+        for(String key:java.util.List.of("coveredFrom","coveredUntil"))
+            sql=sql.replace("#{p."+key+"}","CAST(#{p."+key+"} AS DATETIME)");
+        return sql;
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/AnalyticsResponses.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/AnalyticsResponses.java
new file mode 100644
index 000000000..87508f48b
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/AnalyticsResponses.java
@@ -0,0 +1,49 @@
+package com.baiyue.lastleg.selfoperated.analytics.query;
+
+import java.math.BigDecimal;
+import java.time.Instant;
+import java.time.LocalDate;
+import java.util.List;
+import java.util.Map;
+
+public final class AnalyticsResponses {
+    private AnalyticsResponses(){}
+    public record Context(Long salesRunId,Long inventoryRunId,String salesScopeHash,String inventoryScopeHash,
+        Instant queryAsOf,Instant queryExpiresAt,String businessTimezone,LocalDate anchorDate,
+        LocalDate rangeStartDate,LocalDate rangeEndDateExclusive,Integer calculationWindowDays,
+        LocalDate completeDayFrom,LocalDate completeDayUntil,Instant salesCoveredFrom,Instant salesCoveredUntil,
+        Instant salesPublishedAt,Instant inventoryObservedFrom,Instant inventoryObservedUntil,
+        String salesStatus,String inventoryStatus,boolean rebuildRequired,String revisionReviewStatus,List<String> reasonCodes){}
+    public record Page<T>(Context context,List<T> records,int current,int size,long total,long pages,Map<String,Long> excludedReasons){}
+    public record SalesSummary(String sourceAccount,String warehouseCode,String customerCode,String sku,String productName,
+        String quantityUnit,BigDecimal outboundQuantity,BigDecimal observedQuantity,String dataStatus,List<String> reasonCodes,
+        int completeDayCount,int partialDayCount,int unknownDayCount,String customerName){}
+    public record Point(LocalDate businessDate,BigDecimal outboundQuantity,BigDecimal observedQuantity,String dataStatus,
+        List<String> reasonCodes,String quantityUnit,Instant coveredFrom,Instant coveredUntil){}
+    public record Trend(Context context,SalesSummary summary,List<Point> points){}
+    public record Metric(String sourceAccount,String customerCode,String warehouseCode,String sku,String productName,
+        String quantityUnit,BigDecimal outboundQuantity,Long skuOutboundOrderCount,BigDecimal todayObservedQuantity,
+        BigDecimal physicalQuantity,BigDecimal availableQuantity,BigDecimal frozenQuantity,BigDecimal transitQuantity,
+        Instant inventoryObservedAt,BigDecimal averageDailyOutboundQuantity,BigDecimal inventoryCoverageDays,
+        String inventoryQuality,String salesCoverage,boolean observationEligible,Instant earliestReliableEvidenceAt,
+        String status,List<String> reasonCodes,String customerName,BigDecimal defectivePhysicalQuantity,
+        BigDecimal outboundQuantity30d,LocalDate lastObservedOutboundDate,LocalDate observedHistoryStartDate,
+        List<String> attentionReasons,Map<String,String> quantityStatuses){}
+    public record InventoryMetric(String sourceAccount,String customerCode,String warehouseCode,String sku,String productName,
+        String quantityUnit,Long skuOutboundOrderCount,
+        BigDecimal physicalQuantity,BigDecimal availableQuantity,BigDecimal frozenQuantity,BigDecimal transitQuantity,
+        Instant inventoryObservedAt,BigDecimal averageDailyOutboundQuantity,BigDecimal inventoryCoverageDays,
+        String inventoryQuality,String salesCoverage,boolean observationEligible,Instant earliestReliableEvidenceAt,
+        String status,List<String> reasonCodes,String customerName,BigDecimal defectivePhysicalQuantity,
+        BigDecimal windowOutboundQuantity,BigDecimal observedWindowOutboundQuantity,LocalDate lastObservedOutboundDate,LocalDate observedHistoryStartDate,
+        List<String> attentionReasons,Map<String,String> quantityStatuses){}
+    public record OwnerOption(String customerCode,String customerName){}
+    public record QuantityTotal(BigDecimal overallTotal,BigDecimal knownSubtotal,long unknownSkuCount,String dataStatus,List<String> reasonCodes){}
+    public record RiskShare(Long matchedSkuCount,BigDecimal matchedPhysicalQuantity,BigDecimal physicalQuantityRatio,
+        Long knownMatchedSkuCount,BigDecimal knownMatchedPhysicalQuantity,long unassessableSkuCount,
+        BigDecimal unassessableKnownPhysicalQuantity,List<String> reasonCodes){}
+    public record OwnerOverview(Context context,String customerCode,String customerName,Long skuCount,QuantityTotal physicalSkuCount,
+        QuantityTotal physicalQuantity,QuantityTotal availableQuantity,QuantityTotal frozenQuantity,QuantityTotal defectivePhysicalQuantity,
+        QuantityTotal transitQuantity,QuantityTotal outboundQuantity30d,QuantityTotal averageDailyOutboundQuantity,
+        RiskShare noOutbound30d,RiskShare coverageAboveThreshold){}
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/AnalyticsSqlRequest.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/AnalyticsSqlRequest.java
new file mode 100644
index 000000000..bae6b7545
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/AnalyticsSqlRequest.java
@@ -0,0 +1,11 @@
+package com.baiyue.lastleg.selfoperated.analytics.query;
+
+import java.time.LocalDate;
+import java.time.LocalDateTime;
+
+/** Bound parameters only, generated by the validated service context. */
+public record AnalyticsSqlRequest(String account,String warehouse,String customer,String sku,long salesRun,long inventoryRun,
+    LocalDate from,LocalDate until,LocalDate anchor,LocalDate windowFrom,LocalDate completeFrom,LocalDate completeUntil,
+    LocalDateTime coveredFrom,LocalDateTime coveredUntil,boolean salesKnown,boolean formalSales,boolean completeWindow,
+    boolean complete30,boolean stockFresh,long offset,int size,String kind,
+    java.util.List<com.baiyue.lastleg.selfoperated.analytics.model.SelfopSalesCoverage.Interval> coverage) {}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/CollectionQuery.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/CollectionQuery.java
new file mode 100644
index 000000000..fc2e328fe
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/CollectionQuery.java
@@ -0,0 +1,14 @@
+package com.baiyue.lastleg.selfoperated.analytics.query;
+
+import java.time.LocalDate;
+import java.time.Instant;
+import org.springframework.format.annotation.DateTimeFormat;
+
+/** Single canonical constructor supports Spring ModelAttribute binding. */
+public record CollectionQuery(String sourceAccount, String warehouseCode, String dataFamily,
+        String taskType, String status, String taskNo,
+        @DateTimeFormat(iso = DateTimeFormat.ISO.DATE) LocalDate dateFrom,
+        @DateTimeFormat(iso = DateTimeFormat.ISO.DATE) LocalDate dateUntil,
+        Integer current, Integer size,
+        @DateTimeFormat(iso = DateTimeFormat.ISO.DATE_TIME) Instant listUpperCreatedAt,
+        Long listUpperId) {}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/CollectionQueryService.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/CollectionQueryService.java
new file mode 100644
index 000000000..846a243cf
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/CollectionQueryService.java
@@ -0,0 +1,455 @@
+package com.baiyue.lastleg.selfoperated.analytics.query;
+
+import com.baiyue.common.core.exception.BizException;
+import com.baiyue.lastleg.selfoperated.analytics.model.SelfopAnalyticsProperties;
+import com.baiyue.lastleg.selfoperated.analytics.model.SelfopStageEstimate;
+import com.fasterxml.jackson.databind.JsonNode;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import java.nio.charset.StandardCharsets;
+import java.time.*;
+import java.util.*;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.scheduling.support.CronExpression;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Isolation;
+import org.springframework.transaction.annotation.Transactional;
+import static com.baiyue.lastleg.selfoperated.analytics.query.CollectionReadRows.*;
+
+@Service
+@Transactional(readOnly = true, isolation = Isolation.REPEATABLE_READ)
+public class CollectionQueryService {
+    private final CollectionReadMapper mapper;
+    private final SelfopAnalyticsProperties config;
+    private final ObjectMapper json;
+    private final Clock clock;
+    private static final ZoneId BUSINESS_ZONE = ZoneId.of("Asia/Shanghai");
+    private static final Set<String> TERMINAL = Set.of("ROUTED","PUBLISHED","REUSED","YIELDED","FAILED","ABORTED","SAMPLE_DONE");
+    private static final Set<String> ACTIVE = Set.of("RUNNING","READY","QUEUED","WAITING","WAITING_SOURCE","RETRY_WAIT","YIELDED");
+    private static final Set<String> PROGRESS_FIELDS = Set.of("progressScope","countBasis","attemptNo","scanRound","phase",
+            "completed","total","totalKnown","unit","sliceFrom","sliceUntil","stageStartedAt","stageFinishedAt",
+            "validationState","invalidCount","unknownCount","pendingReviewCount","countUnit","summaryAsOf","directoryComplete");
+    private static final Set<String> COUNTS = Set.of("completed","total","invalidCount","unknownCount","pendingReviewCount","attemptNo","scanRound");
+    private static final Set<String> UNITS = Set.of("PAGE","ORDER","INVENTORY_ROW","BUSINESS_KEY","SKU","BATCH","NONE");
+    @Autowired
+    public CollectionQueryService(CollectionReadMapper mapper, SelfopAnalyticsProperties config, ObjectMapper json) {
+        this(mapper, config, json, Clock.systemUTC());
+    }
+    CollectionQueryService(CollectionReadMapper mapper, SelfopAnalyticsProperties config, ObjectMapper json, Clock clock) {
+        this.mapper=mapper; this.config=config; this.json=json; this.clock=clock;
+    }
+    private record Context(Map<Long,Task> tasks,Map<Long,Attempt> latest,Map<Long,Attempt> published) {}
+    private Context context(String account,List<Task> base,List<Long> extraPublished) {
+        Map<Long,Task> tasks=new HashMap<>();for(Task t:base)tasks.put(t.id(),t);
+        Set<Long> related=new HashSet<>();
+        for(Task t:base){if(t.validationRootTaskId()!=null)related.add(t.validationRootTaskId());if(t.upstreamTaskId()!=null)related.add(t.upstreamTaskId());}
+        related.removeAll(tasks.keySet());
+        if(!related.isEmpty())for(Task t:mapper.tasksByIds(account,new ArrayList<>(related)))tasks.put(t.id(),t);
+        Map<Long,Attempt> latest=new HashMap<>();
+        if(!tasks.isEmpty())for(Attempt a:mapper.latestAttempts(account,new ArrayList<>(tasks.keySet())))latest.put(a.taskId(),a);
+        Set<Long> versions=new HashSet<>(extraPublished);versions.remove(null);
+        for(Task t:tasks.values())if(t.resultPublishedRunId()!=null)versions.add(t.resultPublishedRunId());
+        Map<Long,Attempt> published=new HashMap<>();
+        if(!versions.isEmpty())for(Attempt a:mapper.publishedRuns(account,new ArrayList<>(versions)))published.put(a.id(),a);
+        return new Context(tasks,latest,published);
+    }
+
+    public CollectionResponses.Overview overview(CollectionQuery query) {
+        validate(query, false);
+        List<Scope> scopes=mapper.scopes(query.sourceAccount(),query.warehouseCode());
+        Map<String,Scope> persisted=new HashMap<>();
+        for(Scope scope:scopes) persisted.put(scope.warehouseCode()+":"+scope.dataFamily(),scope);
+        var rows=new ArrayList<CollectionResponses.Warehouse>();
+        var protection=protection(query.sourceAccount());
+        Map<String,CollectionResponses.InventoryDailySamples> inventorySamples=inventorySamples(query);
+        List<Long> scopeIds=scopes.stream().filter(s->config.getWarehouses().containsKey(s.warehouseCode())).map(Scope::id).toList();
+        List<Task> currentTasks=scopeIds.isEmpty()?List.of():mapper.currentTasks(query.sourceAccount(),scopeIds);
+        List<Task> successes=scopeIds.isEmpty()?List.of():mapper.lastSuccessfulTasks(query.sourceAccount(),scopeIds);
+        List<String> visibleWarehouses=config.getWarehouses().keySet().stream()
+                .filter(w->query.warehouseCode()==null||w.equals(query.warehouseCode())).sorted().toList();
+        List<Task> validationTasks=visibleWarehouses.isEmpty()?List.of():mapper.latestValidationTasks(query.sourceAccount(),visibleWarehouses);
+        validationTasks=validationTasks.stream().filter(t->validationAccountRoot(t)&&query.sourceAccount().equals(t.sourceAccount())
+                &&visibleWarehouses.contains(t.warehouseCode())).toList();
+        Task active=mapper.sharedActiveAccount(query.sourceAccount());
+        List<Task> all=new ArrayList<>(currentTasks);all.addAll(successes);all.addAll(validationTasks);if(active!=null)all.add(active);
+        Context context=context(query.sourceAccount(),all,scopes.stream().map(Scope::publishedRunId).filter(Objects::nonNull).toList());
+        Set<String> barriers=config.getWarehouses().isEmpty()?Set.of():new HashSet<>(mapper.barrierWarehouses(query.sourceAccount(),new ArrayList<>(config.getWarehouses().keySet())));
+        for(String warehouse:new TreeSet<>(config.getWarehouses().keySet())) {
+            if(query.warehouseCode()!=null&&!warehouse.equals(query.warehouseCode())) continue;
+            for(String family:List.of("OUTBOUND","INVENTORY")) {
+                if(query.dataFamily()!=null&&!family.equals(query.dataFamily()))continue;
+                Scope scope=persisted.get(warehouse+":"+family);
+                List<Task> candidates=new ArrayList<>(currentTasks.stream().filter(t->warehouse.equals(t.warehouseCode())&&family.equals(t.dataFamily())).toList());
+                Task sampled=validationTasks.stream().filter(t->warehouse.equals(t.warehouseCode())).findFirst().orElse(null);
+                if(sampled!=null)candidates.add(sampled);
+                candidates.sort(Comparator.comparingInt((Task t)->"RUNNING".equals(t.status())?0:ACTIVE.contains(t.status())?1:2)
+                        .thenComparing(Task::createdAt,Comparator.nullsLast(Comparator.reverseOrder()))
+                        .thenComparing(Task::id,Comparator.nullsLast(Comparator.reverseOrder())));
+                Task current=candidates.isEmpty()?null:candidates.get(0);
+                List<CollectionResponses.Task> activity=candidates.stream().filter(t->ACTIVE.contains(t.status())).limit(8)
+                        .map(t->taskView(t,scope,protection,context,family)).toList();
+                Task last=successes.stream().filter(t->warehouse.equals(t.warehouseCode())&&family.equals(t.dataFamily())).findFirst().orElse(null);
+                Attempt published=scope==null?null:context.published().get(scope.publishedRunId());
+                if(published!=null&&(!warehouse.equals(published.warehouseCode())||!Objects.equals(scope.id(),published.scopeId())
+                        ||!Objects.equals(scope.scopeHash(),published.scopeHash())))published=null;
+                Task shared=current==null?null:relatedUpstream(current,context);
+                String blocked=executionBlock(warehouse,protection);
+                boolean enabled=blocked==null;
+                boolean publication="BUSINESS".equals(config.getCollectionMode())&&config.isExecutionEnabled()
+                        &&("INVENTORY".equals(family)||config.isSalesPublicationEnabled());
+                String initial="INVENTORY".equals(family)?published!=null&&"COMPLETE".equals(published.coverageStatus())?"COMPLETE":"UNKNOWN"
+                        :scope==null||scope.initialFromUtc()==null||scope.initialUntilUtc()==null?"UNKNOWN"
+                        :published!=null&&"COMPLETE".equals(published.coverageStatus())&&published.coveredFromUtc()!=null&&published.coveredUntilUtc()!=null
+                        &&!published.coveredFromUtc().isAfter(scope.initialFromUtc())&&!published.coveredUntilUtc().isBefore(scope.initialUntilUtc())
+                        &&!Integer.valueOf(1).equals(scope.rebuildRequired())&&!barriers.contains(warehouse)?"COMPLETE":"PARTIAL";
+                Instant observation=published==null?null:utc("INVENTORY".equals(family)?published.fetchFinishedAtUtc():published.coveredUntilUtc());
+                String freshness=published==null?"NOT_COLLECTED":scope.staleAfterSeconds()==null||scope.staleAfterSeconds()<=0?"UNKNOWN"
+                        :observation==null?"UNKNOWN":!clock.instant().isBefore(observation.plusSeconds(scope.staleAfterSeconds()))?"STALE":"FRESH";
+                rows.add(new CollectionResponses.Warehouse(warehouse,warehouse,family,enabled,publication,blocked,
+                        enabled&&("production".equals(config.getEnvironment())||continuousBusiness())?nextSchedule(warehouse,family):null,clock.instant(),scope==null?null:utc(scope.initialFromUtc()),
+                        scope==null?null:utc(scope.initialUntilUtc()),initial,published==null?null:utc(published.coveredFromUtc()),
+                        published==null?null:utc(published.coveredUntilUtc()),last==null?null:last.taskNo(),last==null||context.latest().get(last.id())==null?null:utc(context.latest().get(last.id()).finishedAtUtc()),
+                        published==null?null:utc(published.publishedAtUtc()),"INVENTORY".equals(family)&&published!=null?utc(published.fetchStartedAtUtc()):null,
+                        "INVENTORY".equals(family)&&published!=null?utc(published.fetchFinishedAtUtc()):null,freshness,
+                        "OUTBOUND".equals(family)&&scope!=null&&(Integer.valueOf(1).equals(scope.rebuildRequired())||barriers.contains(warehouse)),reviewStatus(scope),
+                        current==null?null:taskView(current,scope,protection,context,family),shared==null?null:taskView(shared,null,protection,context),protection,
+                        "INVENTORY".equals(family)?inventorySamples.get(warehouse):null,activity));
+            }
+        }
+        return new CollectionResponses.Overview(query.sourceAccount(),config.getEnvironment(),config.getCollectionMode(),clock.instant(),rows,
+                active!=null&&ACTIVE.contains(active.status())&&"BUSINESS".equals(active.executionPurpose())?taskView(active,null,protection,context):null);
+    }
+
+    private Map<String,CollectionResponses.InventoryDailySamples> inventorySamples(CollectionQuery query) {
+        if("OUTBOUND".equals(query.dataFamily()))return Map.of();
+        List<String> warehouses=config.getWarehouses().keySet().stream()
+                .filter(w->query.warehouseCode()==null||w.equals(query.warehouseCode())).sorted().toList();
+        if(warehouses.isEmpty())return Map.of();
+        LocalDate until=LocalDate.now(clock.withZone(BUSINESS_ZONE)),from=until.minusDays(30);
+        Map<String,Set<LocalDate>> dates=new HashMap<>();
+        for(InventorySample sample:mapper.inventoryDailySamples(query.sourceAccount(),warehouses,from,until)) {
+            if(sample.sampleDate()!=null&&!sample.sampleDate().isBefore(from)&&sample.sampleDate().isBefore(until))
+                dates.computeIfAbsent(sample.warehouseCode(),k->new HashSet<>()).add(sample.sampleDate());
+        }
+        Map<String,LocalDate> starts=new HashMap<>();
+        for(InventorySample sample:mapper.inventoryAccumulationStarts(query.sourceAccount(),warehouses))
+            if(sample.sampleDate()!=null)starts.put(sample.warehouseCode(),sample.sampleDate());
+        Map<String,CollectionResponses.InventoryDailySamples> result=new HashMap<>();
+        for(String warehouse:warehouses) {
+            Set<LocalDate> observed=dates.getOrDefault(warehouse,Set.of());
+            List<LocalDate> missing=from.datesUntil(until).filter(d->!observed.contains(d)).toList();
+            result.put(warehouse,new CollectionResponses.InventoryDailySamples(from,until,30,30-missing.size(),missing,starts.get(warehouse)));
+        }
+        return result;
+    }
+
+    public CollectionResponses.Page<CollectionResponses.Task> tasks(CollectionQuery query) {
+        validate(query,true);
+        var f=filter(query); Bound bound=bound(query,false,f);
+        if(bound==null)return empty(query);
+        var scopes=scopeMap(query); var protection=protection(query.sourceAccount());
+        List<Task> tasks=mapper.tasks(f,bound);Context context=context(query.sourceAccount(),tasks,List.of());
+        var rows=tasks.stream().map(t->{requireTaskScope(t,query);return taskView(t,scopes.get(t.dataFamily()),protection,context,query.dataFamily());}).toList();
+        return new CollectionResponses.Page<>(current(query),size(query),mapper.taskCount(f,bound),utc(bound.createdAt()),bound.id(),clock.instant(),rows);
+    }
+    public CollectionResponses.TaskDetail taskDetail(String taskNo,CollectionQuery query) {
+        validate(query,true);
+        if(taskNo==null||taskNo.isBlank()||taskNo.length()>64)throw new BizException("任务号无效");
+        Task task=mapper.task(query.sourceAccount(),query.warehouseCode(),taskNo);
+        if(task==null)throw new BizException("任务不存在或不属于所选仓库");
+        requireTaskScope(task,query);
+        Scope scope=scopeMap(query).get(task.dataFamily());
+        if(scope==null&&!validationAccountRoot(task))throw new BizException("任务范围与所选仓库不一致");
+        Context context=context(query.sourceAccount(),List.of(task),List.of());
+        Task shared=relatedUpstream(task,context);
+        var protection=protection(query.sourceAccount());
+        return new CollectionResponses.TaskDetail(taskView(task,scope,protection,context,query.dataFamily()),shared==null?null:taskView(shared,null,protection,context),protection,clock.instant());
+    }
+    public CollectionResponses.Page<CollectionResponses.Attempt> runs(CollectionQuery query) {
+        validate(query,true);
+        var f=filter(query); Bound bound=bound(query,true,f);
+        if(bound==null)return empty(query);
+        List<Attempt> runs=mapper.runs(f,bound);
+        Map<Long,Task> tasks=new HashMap<>();List<Long> taskIds=runs.stream().map(Attempt::taskId).distinct().toList();
+        if(!taskIds.isEmpty())for(Task t:mapper.tasksByIds(query.sourceAccount(),taskIds))tasks.put(t.id(),t);
+        Map<String,Scope> scopes=scopeMap(query);var protection=protection(query.sourceAccount());
+        Context context=context(query.sourceAccount(),new ArrayList<>(tasks.values()),List.of());
+        var rows=runs.stream().map(r->{Task t=tasks.get(r.taskId());
+                if(t!=null)requireTaskScope(t,query);
+                if("VALIDATION".equals(r.executionPurpose())&&(t==null||!query.warehouseCode().equals(r.warehouseCode())))
+                    throw new BizException("尝试范围与所选仓库不一致");
+                return attemptView(r,t,
+                t!=null&&retryBlock(t,scopes.get(t.dataFamily()),protection,context)==null);}).toList();
+        return new CollectionResponses.Page<>(current(query),size(query),mapper.runCount(f,bound),utc(bound.createdAt()),bound.id(),clock.instant(),rows);
+    }
+    private <T> CollectionResponses.Page<T> empty(CollectionQuery q) {
+        // A zero id freezes an empty first page; later inserts cannot enter it.
+        return new CollectionResponses.Page<>(current(q),size(q),0,clock.instant(),0L,clock.instant(),List.of());
+    }
+    private Map<String,Scope> scopeMap(CollectionQuery q) {
+        Map<String,Scope> scopes=new HashMap<>();
+        for(Scope scope:mapper.scopes(q.sourceAccount(),q.warehouseCode()))scopes.put(scope.dataFamily(),scope);
+        return scopes;
+    }
+    private String reviewStatus(Scope scope) {
+        if(scope==null||scope.reviewTargetDays()==null||scope.reviewTargetDays()<1)return "UNKNOWN";
+        if(scope.knownOrderRoundFinishedAtUtc()==null||scope.historyRoundFinishedAtUtc()==null)return "PENDING";
+        Instant deadline=clock.instant().minusSeconds(scope.reviewTargetDays()*86400L);
+        return utc(scope.knownOrderRoundFinishedAtUtc()).isBefore(deadline)||utc(scope.historyRoundFinishedAtUtc()).isBefore(deadline)?"OVERDUE":"REVIEWED";
+    }
+    private Task relatedUpstream(Task task,Context context) {
+        if(task.upstreamTaskId()==null)return null;
+        Task parent=context.tasks().get(task.upstreamTaskId());
+        return parent!=null&&"ACCOUNT_DISCOVERY".equals(parent.taskRole())&&Objects.equals(task.sourceAccount(),parent.sourceAccount())
+                &&Objects.equals(task.executionPurpose(),parent.executionPurpose())
+                &&(!"VALIDATION".equals(parent.executionPurpose())||validationAccountRoot(parent)&&Objects.equals(task.warehouseCode(),parent.warehouseCode()))?parent:null;
+    }
+    private static boolean validationAccountRoot(Task task) {
+        return task!=null&&"VALIDATION".equals(task.executionPurpose())&&"VALIDATION".equals(task.taskType())
+                &&"ACCOUNT_DISCOVERY".equals(task.taskRole())&&Objects.equals(task.id(),task.validationRootTaskId())
+                &&task.warehouseCode()!=null&&!task.warehouseCode().isBlank()&&"OUTBOUND".equals(task.dataFamily());
+    }
+    private void requireTaskScope(Task task,CollectionQuery query) {
+        if(!query.sourceAccount().equals(task.sourceAccount())||!query.warehouseCode().equals(task.warehouseCode())
+                ||"ACCOUNT_DISCOVERY".equals(task.taskRole())&&!validationAccountRoot(task)
+                ||query.dataFamily()!=null&&!query.dataFamily().equals(task.dataFamily())&&!validationAccountRoot(task))
+            throw new BizException("任务范围与所选仓库不一致");
+    }
+    private CollectionResponses.Task taskView(Task t,Scope scope,CollectionResponses.Protection protection,Context context) {
+        return taskView(t,scope,protection,context,null);
+    }
+    private CollectionResponses.Task taskView(Task t,Scope scope,CollectionResponses.Protection protection,Context context,String family) {
+        Attempt latest=context.latest().get(t.id());
+        String blocked=retryBlock(t,scope,protection,context);
+        Task root=t.validationRootTaskId()==null?null:context.tasks().get(t.validationRootTaskId());
+        Attempt result=context.published().get(t.resultPublishedRunId());
+        String resultState=t.resultPublishedRunId()==null?"NOT_PUBLISHED":result==null||scope==null||!Objects.equals(scope.id(),result.scopeId())
+                ||!Objects.equals(t.warehouseCode(),result.warehouseCode())||!Objects.equals(t.scopeHash(),result.scopeHash())?"RESULT_UNAVAILABLE"
+                :latest!=null&&"REUSED".equals(latest.status())?"REUSED":latest!=null&&"PUBLISHED".equals(latest.status())?"PUBLISHED":"RESULT_AVAILABLE";
+        Task parent=relatedUpstream(t,context);
+        String dependency=dependencyState(t,parent);
+        String waiting=blockingReason(t,dependency,protection);
+        CollectionResponses.Attempt attempt=latest==null?null:attemptView(latest,t,blocked==null);
+        return new CollectionResponses.Task(t.taskNo(),t.taskType(),validationAccountRoot(t)&&family!=null?family:t.dataFamily(),t.warehouseCode(),t.taskRole(),t.executionPurpose(),
+                utc(t.queryFromUtc()),utc(t.queryUntilUtc()),t.status(),t.applyState(),t.attemptCount(),latest==null?null:latest.attemptNo(),
+                resultState,t.resultPublishedRunId(),utc(t.nextRetryAtUtc()),
+                blocked==null?List.of("RETRY"):List.of(),blocked,utc(t.progressUpdatedAtUtc()),progress(t.progressJson()),
+                validation(root==null?t:root),attempt,dependency,waiting,
+                "WAITING_CONFIRMED".equals(dependency)?parent.taskNo():t.taskNo(),stageEstimate(t,latest,attempt,waiting),utc(t.createdAt()),taskElapsed(t));
+    }
+    private Long taskElapsed(Task task) {
+        Instant start=utc(task.createdAt());
+        Instant end=ACTIVE.contains(task.status())?clock.instant():utc(task.updatedAt());
+        return start==null||end==null||end.isBefore(start)?null:Duration.between(start,end).getSeconds();
+    }
+    private String dependencyState(Task task,Task parent) {
+        if(task.upstreamTaskId()==null)return "WAITING_SOURCE".equals(task.status())?"WAITING_UNCONFIRMED":"NONE";
+        if(parent==null)return "WAITING_UNCONFIRMED";
+        if("SUCCEEDED".equals(parent.status()))return "SATISFIED";
+        if(Set.of("DEAD","FAILED","ABORTED","CANCELLED").contains(parent.status()))return "FAILED";
+        return "WAITING_CONFIRMED";
+    }
+    private String blockingReason(Task task,String dependency,CollectionResponses.Protection protection) {
+        if(!ACTIVE.contains(task.status()))return null;
+        String disabled=executionBlock(task.warehouseCode(),protection);
+        if(disabled!=null)return disabled;
+        if("test".equals(config.getEnvironment())&&"BUSINESS".equals(task.executionPurpose())) {
+            String budget=businessBudgetBlock(task);if(budget!=null)return budget;
+        }
+        if("WAITING_UNCONFIRMED".equals(dependency))return "UPSTREAM_UNCONFIRMED";
+        if("WAITING_CONFIRMED".equals(dependency))return "UPSTREAM_NOT_READY";
+        if("FAILED".equals(dependency))return "UPSTREAM_FAILED";
+        if("RETRY_WAIT".equals(task.status()))return "RETRY_SCHEDULED";
+        if("YIELDED".equals(task.status()))return "EXECUTION_YIELDED";
+        if(Set.of("READY","QUEUED","WAITING").contains(task.status()))return "QUEUED";
+        return null;
+    }
+    private SelfopStageEstimate.Estimate stageEstimate(Task task,Attempt run,CollectionResponses.Attempt attempt,String blocked) {
+        boolean terminal=!ACTIVE.contains(task.status())||run!=null&&TERMINAL.contains(run.status());
+        String source=task.progressJson();
+        JsonNode bounded=boundedObject(source);
+        Map<String,Object> raw=bounded==null?new LinkedHashMap<>():json.convertValue(bounded,new com.fasterxml.jackson.core.type.TypeReference<LinkedHashMap<String,Object>>(){});
+        raw.putAll(progress(source));
+        raw.put("taskNo",task.taskNo());
+        boolean healthy="RUNNING".equals(task.status())&&attempt!=null&&"HEALTHY".equals(attempt.executionHealth())
+                &&Objects.equals(task.attemptCount(),attempt.attemptNo())&&Objects.equals(number(bounded,"attemptNo"),attempt.attemptNo()==null?null:attempt.attemptNo().longValue());
+        var estimate=SelfopStageEstimate.estimate(raw,clock.instant(),healthy,blocked!=null,terminal);
+        if("AVAILABLE".equals(estimate.status())&&attempt.heartbeatAt()!=null) {
+            Instant healthUntil=attempt.heartbeatAt().plusSeconds(config.getLeaseSeconds());
+            if(healthUntil.isBefore(estimate.validUntil()))return new SelfopStageEstimate.Estimate(estimate.status(),estimate.progressIdentity(),estimate.completed(),estimate.total(),
+                    estimate.sampleFrom(),estimate.sampleUntil(),estimate.completedDelta(),estimate.ratePerSecond(),estimate.remainingSeconds(),estimate.estimatedAt(),healthUntil,null);
+        }
+        return estimate;
+    }
+    private String retryBlock(Task task,Scope scope,CollectionResponses.Protection protection,Context context) {
+        if(!"BUSINESS".equals(task.executionPurpose()))return "VALIDATION_NOT_RETRYABLE";
+        if(!"WAREHOUSE_SYNC".equals(task.taskRole()))return "ACCOUNT_SHARED_TASK";
+        String disabled=executionBlock(task.warehouseCode(),protection);if(disabled!=null)return disabled;
+        if(!"BUSINESS".equals(config.getCollectionMode()))return "COLLECTION_MODE_NOT_BUSINESS";
+        if("test".equals(config.getEnvironment())&&!continuousBusiness()&&"SCHEDULED".equals(task.taskType()))return "TEST_MANUAL_TASK_REQUIRED";
+        if("test".equals(config.getEnvironment())) {
+            String budgetBlock=businessBudgetBlock(task);if(budgetBlock!=null)return budgetBlock;
+        }
+        if(!Set.of("DEAD","RETRY_WAIT").contains(task.status()))return "TASK_NOT_RETRYABLE";
+        if(scope==null||!Objects.equals(scope.scopeHash(),task.scopeHash()))return "SCOPE_CHANGED";
+        if(scope.leaseOwner()!=null&&scope.leaseUntilUtc()!=null&&clock.instant().isBefore(utc(scope.leaseUntilUtc())))return "SCOPE_LEASE_BUSY";
+        Task parent=relatedUpstream(task,context);
+        if(task.upstreamTaskId()!=null&&(parent==null||!"SUCCEEDED".equals(parent.status())))return "UPSTREAM_NOT_READY";
+        return null;
+    }
+    private String businessBudgetBlock(Task task) {
+        JsonNode budget=boundedObject(task.businessRootBudgetJson());
+        Long maximum=number(budget,"maxHttp"),reserved=number(budget,"http"),confirmed=number(budget,"confirmedHttp");
+        Instant started=budgetInstant(budget,"startedAtUtc"),deadline=budgetInstant(budget,"deadlineAtUtc");
+        boolean continuous=budget!=null&&budget.path("continuous").isBoolean()&&budget.path("continuous").booleanValue();
+        if(continuous&&!continuousBusiness())return "CONTINUOUS_COLLECTION_DISABLED";
+        if(budget==null||maximum==null||maximum<0||maximum>Integer.MAX_VALUE||reserved==null||reserved>Integer.MAX_VALUE
+                ||confirmed==null||confirmed>reserved||started==null
+                ||(budget.hasNonNull("deadlineAtUtc")&&(continuous||deadline==null||!deadline.isAfter(started))))
+            return "BUSINESS_SESSION_BUDGET_MISSING";
+        JsonNode stopped=budget.get("stopReason");
+        if(stopped!=null&&!stopped.isNull())
+            return "BUSINESS_SESSION_STOPPED";
+        return null;
+    }
+    private CollectionResponses.Attempt attemptView(Attempt run,Task task,boolean retryAllowed) {
+        boolean terminal=TERMINAL.contains(run.status());
+        boolean same=task!=null&&Objects.equals(run.attemptNo(),task.attemptCount());
+        Map<String,Object> progress=progress(terminal?run.progressSnapshotJson():same?task.progressJson():null);
+        Instant updated=terminal?progressInstant(progress,"summaryAsOf"):same?utc(task.progressUpdatedAtUtc()):null;
+        Instant started=utc(run.fetchStartedAtUtc()),finished=utc(run.finishedAtUtc()),heartbeat=utc(run.heartbeatAtUtc());
+        String health=terminal?"TERMINATED":heartbeat==null||!clock.instant().isBefore(heartbeat.plusSeconds(config.getLeaseSeconds()))?"UNCONFIRMED":"HEALTHY";
+        Long elapsed=started==null?null:Math.max(0,Duration.between(started,finished==null?clock.instant():finished).getSeconds());
+        return new CollectionResponses.Attempt(run.id(),run.taskNo(),run.attemptNo(),run.status(),run.lastPhase(),run.executionPurpose(),
+                started,finished,progressInstant(progress,"stageStartedAt"),updated,heartbeat,health,elapsed,run.errorCode(),safeMessage(run.errorCode(),run.errorMessage()),
+                retryAllowed&&same&&"BUSINESS".equals(run.executionPurpose())&&Set.of("FAILED","ABORTED","YIELDED").contains(run.status()),
+                run.coverageStatus(),utc(run.coveredFromUtc()),utc(run.coveredUntilUtc()),utc(run.publishedAtUtc()),progress);
+    }
+    private String safeMessage(String code,String error) {
+        if("BUSINESS_SESSION_HTTP_LIMIT".equals(code))return "本次正式采集会话的请求预算已耗尽，根任务及关联子任务已停止，不能恢复原任务";
+        if("BUSINESS_SESSION_DEADLINE".equals(code))return "该任务曾因旧采集截止时间停止，需核对原检查点和账户保护状态后受控恢复";
+        return com.baiyue.lastleg.selfoperated.analytics.model.SelfopFailure.publicSummary(code,error);
+    }
+    private Instant progressInstant(Map<String,Object> progress,String field) {
+        Object value=progress.get(field);
+        try{return value instanceof String text?Instant.parse(text):null;}catch(DateTimeException error){return null;}
+    }
+    private CollectionResponses.Protection protection(String account) {
+        var p=mapper.protection(account);
+        JsonNode budget=p==null?null:boundedObject(p.apiBudgetJson());
+        return new CollectionResponses.Protection(p==null?null:utc(p.apiCooldownUntilUtc()),p==null?null:p.apiPauseReason(),
+                "BUSINESS".equals(config.getCollectionMode())?0:config.getDailyRequestBudget(),number(budget,"reservedHttp"),number(budget,"confirmedHttp"),
+                budget==null||!budget.path("budgetDate").isTextual()?null:budget.path("budgetDate").textValue());
+    }
+    private String executionBlock(String warehouse,CollectionResponses.Protection protection) {
+        if("OFF".equals(config.getCollectionMode()))return "COLLECTION_OFF";
+        if(!Set.of("BUSINESS","VALIDATION").contains(config.getCollectionMode()))return "COLLECTION_MODE_INVALID";
+        if("BUSINESS".equals(config.getCollectionMode())&&!com.baiyue.lastleg.selfoperated.analytics.model.SelfopCollectionPolicy.businessEnvironment(config))return "BUSINESS_ENVIRONMENT_REJECTED";
+        if(!config.isExecutionEnabled())return "EXECUTION_DISABLED";
+        if(warehouse!=null&&!config.getWarehouses().containsKey(warehouse))return "WAREHOUSE_NOT_CONFIGURED";
+        var w=warehouse==null?null:config.getWarehouses().get(warehouse);
+        if(w!=null&&(!"Asia/Shanghai".equals(w.getBusinessTimezone())||!"Asia/Shanghai".equals(w.getSourceTimezone()))||!"PCS".equals(config.getQuantityUnit()))return "TIMEZONE_OR_UNIT_NOT_CONFIRMED";
+        if(protection.accountPauseReason()!=null&&!protection.accountPauseReason().isBlank())return "ACCOUNT_PAUSED";
+        if(protection.accountCooldownUntil()!=null&&clock.instant().isBefore(protection.accountCooldownUntil()))return "ACCOUNT_COOLDOWN";
+        if(!config.isExclusiveHandoffVerified()||!config.isPriorEgressClosed()||!config.isInflightDrained()||!config.isTransferredBudgetVerified()
+                ||("VALIDATION".equals(config.getCollectionMode())&&(config.getExclusiveGrantExpiresAtUtc()==null||!clock.instant().isBefore(utc(config.getExclusiveGrantExpiresAtUtc())))))return "EXCLUSIVE_GRANT_NOT_VALID";
+        if("BUSINESS".equals(config.getCollectionMode()))return null;
+        if(config.getDailyRequestBudget()<=0)return "DAILY_BUDGET_NOT_CONFIGURED";
+        if(protection.reservedHttpRequests()!=null&&clock.instant().atZone(BUSINESS_ZONE).toLocalDate().toString().equals(protection.budgetDate())
+                &&protection.reservedHttpRequests()>=config.getDailyRequestBudget())return "DAILY_BUDGET_EXHAUSTED";
+        return null;
+    }
+    private boolean continuousBusiness() {
+        return com.baiyue.lastleg.selfoperated.analytics.model.SelfopCollectionPolicy.continuousBusiness(config);
+    }
+    private Instant nextSchedule(String warehouse,String family) {
+        if(continuousBusiness()&&"OUTBOUND".equals(family)) {
+            var slot=clock.instant().atZone(BUSINESS_ZONE).toLocalDate().atStartOfDay(BUSINESS_ZONE).plusMinutes(5);
+            return (slot.toInstant().isAfter(clock.instant())?slot:slot.plusDays(1)).toInstant();
+        }
+        var w=config.getWarehouses().get(warehouse);
+        try {var next=CronExpression.parse("OUTBOUND".equals(family)?w.getOutboundCron():w.getInventoryCron()).next(clock.instant().atZone(BUSINESS_ZONE));return next==null?null:next.toInstant();}
+        catch(IllegalArgumentException ex){return null;}
+    }
+    private CollectionReadMapper.Filter filter(CollectionQuery q) {
+        long offset=(long)(current(q)-1)*size(q);if(offset>Integer.MAX_VALUE)throw new BizException("分页范围过大");
+        return new CollectionReadMapper.Filter(q.sourceAccount(),q.warehouseCode(),q.dataFamily(),q.taskType(),q.status(),q.taskNo(),
+                q.dateFrom()==null?null:LocalDateTime.ofInstant(q.dateFrom().atStartOfDay(BUSINESS_ZONE).toInstant(),ZoneOffset.UTC),
+                q.dateUntil()==null?null:LocalDateTime.ofInstant(q.dateUntil().plusDays(1).atStartOfDay(BUSINESS_ZONE).toInstant(),ZoneOffset.UTC),
+                (int)offset,size(q));
+    }
+    private Bound bound(CollectionQuery q,boolean run,CollectionReadMapper.Filter f) {
+        if(q.listUpperId()!=null)return new Bound(LocalDateTime.ofInstant(q.listUpperCreatedAt(),ZoneOffset.UTC),q.listUpperId());
+        return run?mapper.runBound(f):mapper.taskBound(f);
+    }
+    private void validate(CollectionQuery q,boolean warehouseRequired) {
+        if(q==null||q.sourceAccount()==null||q.sourceAccount().isBlank()||!q.sourceAccount().equals(config.getSourceAccount()))throw new BizException("来源账号未配置或无权访问");
+        if(warehouseRequired&&(q.warehouseCode()==null||q.warehouseCode().isBlank()))throw new BizException("必须选择仓库");
+        if(q.warehouseCode()!=null&&!config.getWarehouses().containsKey(q.warehouseCode()))throw new BizException("仓库不在配置范围内");
+        if(q.dataFamily()!=null&&!Set.of("OUTBOUND","INVENTORY").contains(q.dataFamily()))throw new BizException("任务族无效");
+        if(current(q)<1||size(q)<1||size(q)>100)throw new BizException("分页参数无效");
+        if((q.listUpperCreatedAt()==null)!=(q.listUpperId()==null)||q.listUpperId()!=null&&q.listUpperId()<0)throw new BizException("分页快照上界无效");
+        if(current(q)>1&&q.listUpperId()==null)throw new BizException("翻页必须携带首屏快照上界");
+        if(q.dateFrom()!=null&&q.dateUntil()!=null&&q.dateUntil().isBefore(q.dateFrom()))throw new BizException("创建日期范围倒置");
+        if(q.taskNo()!=null&&(q.taskNo().isBlank()||q.taskNo().length()>64))throw new BizException("任务号无效");
+    }
+    private static int current(CollectionQuery q){return q.current()==null?1:q.current();}
+    private static int size(CollectionQuery q){return q.size()==null?20:q.size();}
+    private static Instant utc(LocalDateTime t){return t==null?null:t.toInstant(ZoneOffset.UTC);}
+
+    /** Unknown/invalid quantities stay null; arbitrary raw payload fields never pass through. */
+    Map<String,Object> progress(String source) {
+        JsonNode root=boundedObject(source);if(root==null)return Map.of();
+        Map<String,Object> result=projectProgress(root);
+        if(root.path("stages").isArray()) {
+            List<Map<String,Object>> stages=new ArrayList<>();
+            if(root.path("stages").size()>16)return Map.of();
+            root.path("stages").forEach(stage->{if(stage.isObject())stages.add(projectProgress(stage));});
+            result.put("stages",stages);
+        }
+        return Collections.unmodifiableMap(result);
+    }
+    private Map<String,Object> projectProgress(JsonNode node) {
+        Map<String,Object> result=new LinkedHashMap<>();
+        for(String field:PROGRESS_FIELDS) {
+            JsonNode value=node.get(field);if(value==null)continue;
+            if(COUNTS.contains(field))result.put(field,value.isIntegralNumber()&&value.canConvertToLong()&&value.longValue()>=0?value.longValue():null);
+            else if(Set.of("totalKnown","directoryComplete").contains(field))result.put(field,value.isBoolean()?value.booleanValue():null);
+            else if(value.isTextual()&&value.textValue().length()<=128)result.put(field,value.textValue());
+        }
+        if(result.containsKey("unit")&&!UNITS.contains(result.get("unit")))result.put("unit",null);
+        if(result.containsKey("countUnit")&&!UNITS.contains(result.get("countUnit")))result.put("countUnit",null);
+        if(result.containsKey("countBasis")&&!Set.of("TASK_CUMULATIVE","ATTEMPT_ONLY").contains(result.get("countBasis")))result.put("countBasis",null);
+        if(result.containsKey("progressScope")&&!Set.of("ACCOUNT_SHARED","WAREHOUSE").contains(result.get("progressScope")))result.put("progressScope",null);
+        if(!Boolean.TRUE.equals(result.get("totalKnown")))result.put("total",null);
+        if("NONE".equals(result.get("unit"))) {
+            result.put("completed",null);result.put("total",null);result.put("totalKnown",false);
+        }
+        return result;
+    }
+    private JsonNode boundedObject(String value) {
+        if(value==null||value.getBytes(StandardCharsets.UTF_8).length>8192)return null;
+        try {JsonNode node=json.readTree(value);return node!=null&&node.isObject()?node:null;}catch(Exception ex){return null;}
+    }
+    private CollectionResponses.Validation validation(Task root) {
+        if(!"VALIDATION".equals(root.executionPurpose()))return null;
+        JsonNode budget=boundedObject(root.validationBudgetJson());
+        Map<String,Object> limits=new LinkedHashMap<>(),consumed=new LinkedHashMap<>();
+        for(String key:List.of("maxPages","maxPageSize","maxDistinctDetails","maxDetailHttp","maxInventoryPagesPerWarehouse","maxHttp"))limits.put(key,number(budget,key));
+        for(String key:List.of("pages","detailHttp","http","confirmedHttp"))consumed.put(key,number(budget,key));
+        consumed.put("distinctDetails",budget==null||!budget.path("detailKeys").isArray()?null:(long)budget.path("detailKeys").size());
+        // detailKeys themselves contain upstream identities and are never exposed.
+        return new CollectionResponses.Validation(root.taskNo(),Collections.unmodifiableMap(limits),Collections.unmodifiableMap(consumed),
+                budgetInstant(budget,"deadlineAtUtc"),budget==null?null:fixedReason(budget.path("stopReason")));
+    }
+    private String fixedReason(JsonNode value) {
+        if(value==null||value.isNull()||!value.isTextual())return null;
+        return value.textValue().matches("[A-Z0-9_]{1,64}")?value.textValue():"STOP_REASON_UNAVAILABLE";
+    }
+    private Long number(JsonNode root,String field) {
+        JsonNode value=root==null?null:root.get(field);
+        return value!=null&&value.isIntegralNumber()&&value.canConvertToLong()&&value.longValue()>=0?value.longValue():null;
+    }
+    private Instant budgetInstant(JsonNode root,String field) {
+        try{return root==null||!root.path(field).isTextual()?null:utc(LocalDateTime.parse(root.path(field).textValue()));}catch(DateTimeException ex){return null;}
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/CollectionReadMapper.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/CollectionReadMapper.java
new file mode 100644
index 000000000..6234e6454
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/CollectionReadMapper.java
@@ -0,0 +1,158 @@
+package com.baiyue.lastleg.selfoperated.analytics.query;
+
+import java.time.LocalDateTime;
+import java.time.LocalDate;
+import java.util.List;
+import org.apache.ibatis.annotations.*;
+import static com.baiyue.lastleg.selfoperated.analytics.query.CollectionReadRows.*;
+
+@Mapper
+public interface CollectionReadMapper {
+    String DAILY_SAMPLE_FROM = " FROM ll_selfop_sync_run r JOIN ll_selfop_sync_scope s ON s.id=r.scope_id"
+            + " AND s.source_account=r.source_account AND s.warehouse_code=r.warehouse_code AND s.data_family='INVENTORY'"
+            + " WHERE r.source_account=#{account} AND r.status='PUBLISHED' AND r.execution_purpose='BUSINESS'"
+            + " AND r.run_role='WAREHOUSE_SYNC' AND r.coverage_status='COMPLETE'"
+            + " AND r.inventory_sample_rule_version='DAILY_SCHEDULED_FIRST_V1'"
+            + " AND r.warehouse_code IN <foreach collection='warehouses' item='w' open='(' close=')' separator=','>#{w}</foreach>";
+    @Select("<script>SELECT r.warehouse_code,r.inventory_daily_sample_date AS sample_date" + DAILY_SAMPLE_FROM
+            + " AND r.inventory_daily_sample_date &gt;= #{from} AND r.inventory_daily_sample_date &lt; #{until}"
+            + " ORDER BY r.warehouse_code,r.inventory_daily_sample_date</script>")
+    List<InventorySample> inventoryDailySamples(@Param("account") String account,
+            @Param("warehouses") List<String> warehouses, @Param("from") LocalDate from, @Param("until") LocalDate until);
+    @Select("<script>SELECT r.warehouse_code,MIN(r.inventory_daily_sample_date) AS sample_date" + DAILY_SAMPLE_FROM
+            + " AND r.inventory_daily_sample_date IS NOT NULL GROUP BY r.warehouse_code</script>")
+    List<InventorySample> inventoryAccumulationStarts(@Param("account") String account,
+            @Param("warehouses") List<String> warehouses);
+    record Filter(String account, String warehouse, String family, String type, String status,
+            String taskNo, LocalDateTime from, LocalDateTime until, int offset, int size) {}
+    String SCOPE = "id,warehouse_code,data_family,scope_hash,business_timezone,schedule_cron,stale_after_seconds,"
+            + "initial_from_utc,initial_until_utc,discovery_from_utc,discovery_until_utc,rebuild_required,published_run_id,"
+            + "known_order_round_finished_at_utc,history_round_finished_at_utc,review_target_days,lease_owner,lease_until_utc";
+    // Only a single frozen warehouse on an ordinary validation root establishes membership.
+    // Warehouse-directory roots have no such membership and cannot enter any warehouse view.
+    String VALIDATION_ROOT = "(t.execution_purpose='VALIDATION' AND t.task_type='VALIDATION'"
+            + " AND t.task_role='ACCOUNT_DISCOVERY' AND t.validation_root_task_id=t.id"
+            + " AND t.scope_id IS NULL AND t.warehouse_code IS NULL"
+            + " AND JSON_UNQUOTE(JSON_EXTRACT(t.query_scope_json,'$.action'))='VALIDATION'"
+            + " AND JSON_TYPE(JSON_EXTRACT(t.query_scope_json,'$.warehouses'))='ARRAY'"
+            + " AND JSON_LENGTH(JSON_EXTRACT(t.query_scope_json,'$.warehouses'))=1"
+            + " AND JSON_TYPE(JSON_EXTRACT(t.query_scope_json,'$.warehouses[0]'))='STRING')";
+    String TASK_WAREHOUSE = "CASE WHEN " + VALIDATION_ROOT
+            + " THEN JSON_UNQUOTE(JSON_EXTRACT(t.query_scope_json,'$.warehouses[0]')) ELSE t.warehouse_code END";
+    String TASK_FAMILY = "CASE WHEN t.task_type='MASTER_DATA' THEN 'MASTER_DATA' WHEN t.task_role='ACCOUNT_DISCOVERY' THEN 'OUTBOUND' ELSE s.data_family END";
+    String TASK_MEMBERSHIP = "((t.task_role='WAREHOUSE_SYNC' AND s.id IS NOT NULL) OR " + VALIDATION_ROOT + ")";
+    String BUSINESS_LOCAL_WORK_READY = "CASE WHEN t.task_role='WAREHOUSE_SYNC' AND s.data_family='OUTBOUND'"
+            + " AND (t.task_type='REBUILD' OR t.apply_state='APPLIED' OR ("
+            + "OCTET_LENGTH(t.progress_json) BETWEEN 0 AND 8192 AND JSON_EXTRACT(t.progress_json,'$.localWorkReady')=CAST('true' AS JSON)"
+            + " AND JSON_UNQUOTE(JSON_EXTRACT(t.progress_json,'$.localWorkReadyScopeHash'))=t.scope_hash"
+            + " AND ((t.upstream_task_id IS NULL AND JSON_TYPE(JSON_EXTRACT(t.progress_json,'$.localWorkReadyUpstreamTaskId'))='NULL')"
+            + " OR (t.upstream_task_id IS NOT NULL AND JSON_UNQUOTE(JSON_EXTRACT(t.progress_json,'$.localWorkReadyUpstreamTaskId'))=CAST(t.upstream_task_id AS CHAR)))))"
+            + " THEN TRUE ELSE FALSE END";
+    String TASK = "t.id,t.task_no,t.source_account," + TASK_WAREHOUSE + " AS warehouse_code," + TASK_FAMILY + " AS data_family,t.task_role,t.task_type,"
+            + "t.execution_purpose,t.scope_hash,t.status,t.apply_state,t.attempt_count,t.query_from_utc,t.query_until_utc,"
+            + "t.next_retry_at_utc,t.upstream_task_id,t.validation_root_task_id,t.result_published_run_id,"
+            + "t.progress_json,t.progress_updated_at_utc,t.validation_budget_json,b.business_budget_json AS business_root_budget_json,"
+            + BUSINESS_LOCAL_WORK_READY + " AS business_local_work_ready,t.created_at,t.updated_at";
+    String ATTEMPT = "r.id,r.task_id,t.task_no,r.attempt_no,r.status,r.last_phase,r.execution_purpose,"
+            + "r.fetch_started_at_utc,r.fetch_finished_at_utc,r.build_started_at_utc,r.finished_at_utc,"
+            + "r.published_at_utc,r.heartbeat_at_utc,r.progress_snapshot_json,r.coverage_status,"
+            + "r.covered_from_utc,r.covered_until_utc,r.error_code,r.error_message,r.created_at,"
+            + "CASE WHEN " + VALIDATION_ROOT + " THEN " + TASK_WAREHOUSE + " ELSE r.warehouse_code END AS warehouse_code,r.scope_id,r.scope_hash";
+    String BUSINESS_ROOT_JOIN = " LEFT JOIN ll_selfop_sync_task b ON b.id=t.business_root_task_id"
+            + " AND b.source_account=t.source_account AND t.execution_purpose='BUSINESS'"
+            + " AND b.execution_purpose='BUSINESS' AND b.business_root_task_id=b.id ";
+    String TASK_FROM = " FROM ll_selfop_sync_task t LEFT JOIN ll_selfop_sync_scope s ON s.id=t.scope_id "
+            + "AND s.source_account=t.source_account AND s.warehouse_code=t.warehouse_code " + BUSINESS_ROOT_JOIN;
+    String RUN_FROM = " FROM ll_selfop_sync_run r JOIN ll_selfop_sync_task t ON t.id=r.task_id "
+            + "AND t.source_account=r.source_account AND r.execution_purpose=t.execution_purpose AND r.run_role=t.task_role"
+            + " AND (t.warehouse_code=r.warehouse_code OR (t.warehouse_code IS NULL AND r.warehouse_code IS NULL)) "
+            + "LEFT JOIN ll_selfop_sync_scope s ON s.id=r.scope_id AND s.id=t.scope_id"
+            + " AND s.source_account=t.source_account AND s.warehouse_code=t.warehouse_code ";
+    String FILTER = " WHERE t.source_account=#{f.account} AND (" + TASK_WAREHOUSE + ")=#{f.warehouse} "
+            + "AND " + TASK_MEMBERSHIP + " "
+            + "<if test='f.family != null'>AND ((" + TASK_FAMILY + ")=#{f.family} OR (" + VALIDATION_ROOT
+            + " AND #{f.family} IN ('OUTBOUND','INVENTORY'))) </if>"
+            + "<if test='f.type != null'>AND t.task_type=#{f.type} </if>"
+            + "<if test='f.taskNo != null'>AND t.task_no=#{f.taskNo} </if>";
+    String TASK_FILTER = FILTER + "<if test='f.status != null'>AND t.status=#{f.status} </if>"
+            + "<if test='f.from != null'>AND t.created_at &gt;= #{f.from} </if>"
+            + "<if test='f.until != null'>AND t.created_at &lt; #{f.until} </if>";
+    String RUN_FILTER = FILTER + " AND (s.id IS NOT NULL OR (" + VALIDATION_ROOT + " AND r.scope_id IS NULL)) "
+            + "<if test='f.status != null'>AND r.status=#{f.status} </if>"
+            + "<if test='f.from != null'>AND r.created_at &gt;= #{f.from} </if>"
+            + "<if test='f.until != null'>AND r.created_at &lt; #{f.until} </if>";
+    String TASK_BOUND = " AND (t.created_at &lt; #{b.createdAt} OR (t.created_at=#{b.createdAt} AND t.id &lt;= #{b.id})) ";
+    String RUN_BOUND = " AND (r.created_at &lt; #{b.createdAt} OR (r.created_at=#{b.createdAt} AND r.id &lt;= #{b.id})) ";
+
+    @Select("<script>SELECT " + SCOPE + " FROM ll_selfop_sync_scope WHERE source_account=#{account}"
+            + "<if test='warehouse != null'> AND warehouse_code=#{warehouse}</if> ORDER BY warehouse_code,data_family</script>")
+    List<Scope> scopes(@Param("account") String account, @Param("warehouse") String warehouse);
+    @Select("<script>SELECT t.created_at,t.id" + TASK_FROM + TASK_FILTER + " ORDER BY t.created_at DESC,t.id DESC LIMIT 1</script>")
+    Bound taskBound(@Param("f") Filter filter);
+    @Select("<script>SELECT r.created_at,r.id" + RUN_FROM + RUN_FILTER + " ORDER BY r.created_at DESC,r.id DESC LIMIT 1</script>")
+    Bound runBound(@Param("f") Filter filter);
+    @Select("<script>SELECT COUNT(*)" + TASK_FROM + TASK_FILTER + TASK_BOUND + "</script>")
+    long taskCount(@Param("f") Filter filter, @Param("b") Bound bound);
+    @Select("<script>SELECT " + TASK + TASK_FROM + TASK_FILTER + TASK_BOUND
+            + " ORDER BY t.created_at DESC,t.id DESC LIMIT #{f.size} OFFSET #{f.offset}</script>")
+    List<Task> tasks(@Param("f") Filter filter, @Param("b") Bound bound);
+    @Select("<script>SELECT COUNT(*)" + RUN_FROM + RUN_FILTER + RUN_BOUND + "</script>")
+    long runCount(@Param("f") Filter filter, @Param("b") Bound bound);
+    @Select("<script>SELECT " + ATTEMPT + RUN_FROM + RUN_FILTER + RUN_BOUND
+            + " ORDER BY r.created_at DESC,r.id DESC LIMIT #{f.size} OFFSET #{f.offset}</script>")
+    List<Attempt> runs(@Param("f") Filter filter, @Param("b") Bound bound);
+    @Select("SELECT " + TASK + TASK_FROM + " WHERE t.source_account=#{account} AND (" + TASK_WAREHOUSE
+            + ")=#{warehouse} AND " + TASK_MEMBERSHIP + " AND t.task_no=#{taskNo}")
+    Task task(@Param("account") String account, @Param("warehouse") String warehouse, @Param("taskNo") String taskNo);
+    @Select("SELECT api_cooldown_until_utc,api_pause_reason,api_budget_json FROM ll_selfop_outbound_discovery_scope WHERE source_account=#{account} LIMIT 1")
+    Protection protection(@Param("account") String account);
+
+    @Select("<script>SELECT " + TASK + TASK_FROM
+            + " WHERE t.source_account=#{account} AND t.id IN <foreach collection='ids' item='id' open='(' close=')' separator=','>#{id}</foreach></script>")
+    List<Task> tasksByIds(@Param("account") String account,@Param("ids") List<Long> ids);
+    @Select("<script>SELECT " + ATTEMPT + " FROM ll_selfop_sync_run r JOIN ll_selfop_sync_task t ON t.id=r.task_id"
+            + " AND t.source_account=r.source_account AND t.execution_purpose=r.execution_purpose AND t.task_role=r.run_role"
+            + " JOIN (SELECT id,ROW_NUMBER() OVER(PARTITION BY task_id ORDER BY attempt_no DESC,id DESC) rn FROM ll_selfop_sync_run"
+            + " WHERE source_account=#{account} AND task_id IN <foreach collection='ids' item='id' open='(' close=')' separator=','>#{id}</foreach>) ranked"
+            + " ON ranked.id=r.id AND ranked.rn=1 WHERE r.source_account=#{account}</script>")
+    List<Attempt> latestAttempts(@Param("account") String account,@Param("ids") List<Long> ids);
+    @Select("<script>SELECT " + ATTEMPT + " FROM ll_selfop_sync_run r JOIN ll_selfop_sync_task t ON t.id=r.task_id"
+            + " AND t.source_account=r.source_account AND t.execution_purpose=r.execution_purpose AND t.task_role=r.run_role"
+            + " WHERE r.source_account=#{account} AND r.status='PUBLISHED' AND r.execution_purpose='BUSINESS' AND r.run_role='WAREHOUSE_SYNC'"
+            + " AND r.id IN <foreach collection='ids' item='id' open='(' close=')' separator=','>#{id}</foreach></script>")
+    List<Attempt> publishedRuns(@Param("account") String account,@Param("ids") List<Long> ids);
+    String ACTIVE_STATUS = "('RUNNING','READY','QUEUED','WAITING','WAITING_SOURCE','RETRY_WAIT','YIELDED')";
+    String ACTIVITY_ORDER = "CASE WHEN status='RUNNING' THEN 0 WHEN status IN " + ACTIVE_STATUS + " THEN 1 ELSE 2 END";
+    @Select("<script>SELECT " + TASK + TASK_FROM
+            + " JOIN (SELECT id,ROW_NUMBER() OVER(PARTITION BY scope_id ORDER BY " + ACTIVITY_ORDER + ",created_at DESC,id DESC) rn FROM ll_selfop_sync_task"
+            + " WHERE source_account=#{account} AND task_role='WAREHOUSE_SYNC' AND scope_id IN <foreach collection='ids' item='id' open='(' close=')' separator=','>#{id}</foreach>) ranked"
+            + " ON ranked.id=t.id AND ranked.rn &lt;= 8 WHERE t.source_account=#{account} AND (t.status IN " + ACTIVE_STATUS + " OR ranked.rn=1)"
+            + " ORDER BY t.scope_id,ranked.rn</script>")
+    List<Task> currentTasks(@Param("account") String account,@Param("ids") List<Long> ids);
+    @Select("<script>SELECT " + TASK + TASK_FROM
+            + " JOIN (SELECT t.id,ROW_NUMBER() OVER(PARTITION BY " + TASK_WAREHOUSE
+            + " ORDER BY " + ACTIVITY_ORDER + ",t.created_at DESC,t.id DESC) rn FROM ll_selfop_sync_task t"
+            + " WHERE t.source_account=#{account} AND " + VALIDATION_ROOT + " AND (" + TASK_WAREHOUSE + ") IN"
+            + " <foreach collection='warehouses' item='w' open='(' close=')' separator=','>#{w}</foreach>) ranked"
+            + " ON ranked.id=t.id AND ranked.rn=1 WHERE t.source_account=#{account} AND " + VALIDATION_ROOT + "</script>")
+    List<Task> latestValidationTasks(@Param("account") String account,@Param("warehouses") List<String> warehouses);
+    @Select("<script>SELECT " + TASK + TASK_FROM
+            + " JOIN (SELECT id,ROW_NUMBER() OVER(PARTITION BY scope_id ORDER BY updated_at DESC,id DESC) rn FROM ll_selfop_sync_task"
+            + " WHERE status='SUCCEEDED' AND execution_purpose='BUSINESS' AND result_published_run_id IS NOT NULL AND scope_id IN"
+            + " <foreach collection='ids' item='id' open='(' close=')' separator=','>#{id}</foreach>) ranked"
+            + " ON ranked.id=t.id AND ranked.rn=1 WHERE t.source_account=#{account}</script>")
+    List<Task> lastSuccessfulTasks(@Param("account") String account,@Param("ids") List<Long> ids);
+    // Account activity is independent; only upstream_task_id proves a warehouse dependency.
+    @Select("SELECT " + TASK + " FROM ll_selfop_outbound_discovery_scope d JOIN ll_selfop_sync_task t ON t.id=d.active_task_id"
+            + " AND t.source_account=d.source_account LEFT JOIN ll_selfop_sync_scope s ON s.id=t.scope_id"
+            + BUSINESS_ROOT_JOIN
+            + " WHERE d.source_account=#{account} AND t.task_role='ACCOUNT_DISCOVERY' LIMIT 1")
+    Task sharedActiveAccount(@Param("account") String account);
+    @Select("<script>SELECT DISTINCT s.warehouse_code FROM ll_selfop_sync_scope s WHERE s.source_account=#{account}"
+            + " AND s.data_family='OUTBOUND' AND s.warehouse_code IN"
+            + " <foreach collection='warehouses' item='w' open='(' close=')' separator=','>#{w}</foreach>"
+            + " AND EXISTS (SELECT 1 FROM ll_selfop_sync_task t WHERE t.source_account=s.source_account"
+            + " AND t.execution_purpose='BUSINESS' AND t.apply_state IN ('APPLYING','BLOCKED')"
+            + " AND (t.warehouse_code=s.warehouse_code OR JSON_CONTAINS(t.affected_warehouse_codes_json,JSON_QUOTE(s.warehouse_code))))</script>")
+    List<String> barrierWarehouses(@Param("account") String account,@Param("warehouses") List<String> warehouses);
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/CollectionReadRows.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/CollectionReadRows.java
new file mode 100644
index 000000000..33d78a15a
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/CollectionReadRows.java
@@ -0,0 +1,35 @@
+package com.baiyue.lastleg.selfoperated.analytics.query;
+
+import java.time.LocalDateTime;
+import java.time.LocalDate;
+
+/** Narrow read projections: no raw manifests, stage payloads or business detail tables. */
+public final class CollectionReadRows {
+    private CollectionReadRows() {}
+    public record Bound(LocalDateTime createdAt, Long id) {}
+    public record InventorySample(String warehouseCode, LocalDate sampleDate) {}
+    public record Scope(Long id, String warehouseCode, String dataFamily, String scopeHash,
+            String businessTimezone, String scheduleCron, Integer staleAfterSeconds,
+            LocalDateTime initialFromUtc, LocalDateTime initialUntilUtc,
+            LocalDateTime discoveryFromUtc, LocalDateTime discoveryUntilUtc,
+            Integer rebuildRequired, Long publishedRunId,
+            LocalDateTime knownOrderRoundFinishedAtUtc, LocalDateTime historyRoundFinishedAtUtc, Integer reviewTargetDays,
+            String leaseOwner, LocalDateTime leaseUntilUtc) {}
+    public record Task(Long id, String taskNo, String sourceAccount, String warehouseCode,
+            String dataFamily, String taskRole, String taskType, String executionPurpose,
+            String scopeHash, String status, String applyState, Integer attemptCount,
+            LocalDateTime queryFromUtc, LocalDateTime queryUntilUtc, LocalDateTime nextRetryAtUtc,
+            Long upstreamTaskId, Long validationRootTaskId, Long resultPublishedRunId,
+            String progressJson, LocalDateTime progressUpdatedAtUtc, String validationBudgetJson, String businessRootBudgetJson,
+            Boolean businessLocalWorkReady,
+            LocalDateTime createdAt, LocalDateTime updatedAt) {}
+    public record Attempt(Long id, Long taskId, String taskNo, Integer attemptNo,
+            String status, String lastPhase, String executionPurpose,
+            LocalDateTime fetchStartedAtUtc, LocalDateTime fetchFinishedAtUtc,
+            LocalDateTime buildStartedAtUtc, LocalDateTime finishedAtUtc,
+            LocalDateTime publishedAtUtc, LocalDateTime heartbeatAtUtc,
+            String progressSnapshotJson, String coverageStatus,
+            LocalDateTime coveredFromUtc, LocalDateTime coveredUntilUtc,
+            String errorCode, String errorMessage, LocalDateTime createdAt, String warehouseCode, Long scopeId, String scopeHash) {}
+    public record Protection(LocalDateTime apiCooldownUntilUtc, String apiPauseReason, String apiBudgetJson) {}
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/CollectionResponses.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/CollectionResponses.java
new file mode 100644
index 000000000..7d09b63ee
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/CollectionResponses.java
@@ -0,0 +1,45 @@
+package com.baiyue.lastleg.selfoperated.analytics.query;
+
+import java.time.Instant;
+import java.time.LocalDate;
+import java.time.LocalDateTime;
+import java.util.List;
+import java.util.Map;
+import com.baiyue.lastleg.selfoperated.analytics.model.SelfopStageEstimate;
+
+public final class CollectionResponses {
+    private CollectionResponses() {}
+    public record Page<T>(int current, int size, long total, Instant listUpperCreatedAt,
+            Long listUpperId, Instant observedAt, List<T> records) {}
+    public record Overview(String sourceAccount, String environmentLabel, String collectionMode,
+            Instant observedAt, List<Warehouse> warehouses, Task accountActivity) {}
+    public record Warehouse(String warehouseCode, String warehouseName, String dataFamily,
+            boolean executionEnabled, boolean publicationEnabled, String disabledReason,
+            Instant nextScheduledAt, Instant observedAt, Instant initialFrom, Instant initialUntil,
+            String initialCoverageStatus, Instant salesCoveredFrom, Instant salesCoveredUntil,
+            String lastSuccessfulTaskNo, Instant lastSucceededAt, Instant lastPublishedAt,
+            Instant inventoryObservedFrom, Instant inventoryObservedUntil, String dataFreshness,
+            boolean rebuildRequired, String revisionReviewStatus, Task currentTask,
+            Task sharedUpstream, Protection protection, InventoryDailySamples inventoryDailySamples,
+            List<Task> activeTasks) {}
+    public record InventoryDailySamples(LocalDate windowFrom, LocalDate windowUntil, int expectedDays,
+            int sampleCount, List<LocalDate> missingDates, LocalDate accumulationStartedOn) {}
+    public record Task(String taskNo, String taskType, String dataFamily, String warehouseCode,
+            String taskRole, String executionPurpose, Instant queryFrom, Instant queryUntil,
+            String taskStatus, String applyState, Integer attemptCount, Integer latestAttemptNo,
+            String resultPublicationState, Long resultPublishedRunId, Instant nextRetryAt,
+            List<String> allowedActions, String actionBlockReason, Instant progressUpdatedAt,
+            Map<String,Object> progress, Validation validation, Attempt latestAttempt,
+            String dependencyState, String blockingReason, String progressSourceTaskNo,
+            SelfopStageEstimate.Estimate stageEstimate, Instant createdAt, Long elapsedSeconds) {}
+    public record TaskDetail(Task task, Task sharedUpstream, Protection protection, Instant observedAt) {}
+    public record Attempt(Long runId, String taskNo, Integer attemptNo, String status, String phase,
+            String executionPurpose, Instant startedAt, Instant finishedAt, Instant phaseStartedAt,
+            Instant progressUpdatedAt, Instant heartbeatAt, String executionHealth, Long elapsedSeconds,
+            String errorCode, String failureSummary, boolean retryable, String coverageStatus,
+            Instant coveredFrom, Instant coveredUntil, Instant publishedAt, Map<String,Object> progress) {}
+    public record Protection(Instant accountCooldownUntil, String accountPauseReason,
+            Integer dailyRequestBudget, Long reservedHttpRequests, Long confirmedHttpRequests, String budgetDate) {}
+    public record Validation(String validationSessionNo, Map<String,Object> budgetLimits,
+            Map<String,Object> budgetConsumed, Instant deadlineAt, String stopReason) {}
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/CoverageDistributionPolicy.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/CoverageDistributionPolicy.java
new file mode 100644
index 000000000..954331268
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/CoverageDistributionPolicy.java
@@ -0,0 +1,29 @@
+package com.baiyue.lastleg.selfoperated.analytics.query;
+
+import com.baiyue.common.core.exception.BizException;
+import java.time.Instant;
+import java.util.List;
+
+/** V1's partition and strict read lifetime are a local report contract, never an authorization. */
+public final class CoverageDistributionPolicy {
+    public static final String RULE_VERSION="COVERAGE_DISTRIBUTION_V1";
+    public static final List<String> BUCKETS=List.of("DAYS_0_30","DAYS_30_60","DAYS_60_90","DAYS_GT_90","NO_OUTBOUND_IN_WINDOW","NO_AVAILABLE","UNKNOWN");
+    private CoverageDistributionPolicy(){}
+    public static void validate(AnalyticsInventoryOptions o){
+        if(o.coverageBucket()!=null&&(!BUCKETS.contains(o.coverageBucket())||!RULE_VERSION.equals(o.bucketRuleVersion())))throw new BizException("库存分布桶或规则版本无效");
+        if(o.coverageBucket()==null&&o.bucketRuleVersion()!=null)throw new BizException("分布规则版本必须与分桶条件一起提供");
+        if(o.coverageSelection()!=null&&!"FINITE_POSITIVE".equals(o.coverageSelection()))throw new BizException("库存有限天数筛选无效");
+        if(o.coverageBucket()!=null&&(o.coverageSelection()!=null||!"ALL".equals(o.attentionValue()))||o.coverageSelection()!=null&&!"ALL".equals(o.attentionValue()))throw new BizException("分桶、有限天数与关注条件互斥");
+        if(o.drilldownFrom()!=null&&!"DASHBOARD".equals(o.drilldownFrom()))throw new BizException("库存下钻来源无效");
+    }
+    public static Instant expiresAt(AnalyticsResponses.Context context,Instant freshUntil){
+        if(context.inventoryRunId()==null||context.inventoryRunId()==0||!"VALID".equals(context.inventoryStatus())||freshUntil==null)return null;
+        return freshUntil.isBefore(context.queryExpiresAt())?freshUntil:context.queryExpiresAt();
+    }
+    public static void requireDrilldown(AnalyticsQuery q,AnalyticsInventoryOptions o,AnalyticsResponses.Context context,Instant freshUntil,Instant now){
+        if(!"DASHBOARD".equals(o.drilldownFrom()))return;
+        if(!q.pinned())throw new BizException("经营总览下钻必须携带原完整版本上下文");
+        Instant expires=expiresAt(context,freshUntil);
+        if(expires==null||!now.isBefore(expires))throw new BizException("原图库存已过期，请刷新总览");
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/CoverageDistributionSql.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/CoverageDistributionSql.java
new file mode 100644
index 000000000..22adcd643
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/CoverageDistributionSql.java
@@ -0,0 +1,22 @@
+package com.baiyue.lastleg.selfoperated.analytics.query;
+
+/** Expressions address AnalyticsInventorySql.result. Comparisons use cross products, never display-rounded days. */
+public final class CoverageDistributionSql {
+    private CoverageDistributionSql(){}
+    public static String candidate(){return "(physical_quantity IS NULL OR physical_quantity>0)";}
+    public static String finitePositive(){return "available_quantity>0 AND outbound_quantity30d>0";}
+    public static String bucket(AnalyticsSqlRequest p){long days=java.time.temporal.ChronoUnit.DAYS.between(p.from(),p.until());return "CASE WHEN physical_quantity IS NULL OR available_quantity IS NULL THEN 'UNKNOWN' "
+        +"WHEN physical_quantity=0 THEN NULL WHEN available_quantity=0 THEN 'NO_AVAILABLE' "
+        +"WHEN outbound_quantity30d IS NULL THEN 'UNKNOWN' WHEN outbound_quantity30d=0 THEN 'NO_OUTBOUND_IN_WINDOW' "
+        +"WHEN available_quantity*"+days+"<=outbound_quantity30d*30 THEN 'DAYS_0_30' "
+        +"WHEN available_quantity*"+days+"<=outbound_quantity30d*60 THEN 'DAYS_30_60' "
+        +"WHEN available_quantity*"+days+"<=outbound_quantity30d*90 THEN 'DAYS_60_90' ELSE 'DAYS_GT_90' END";}
+    public static String unknownReason(){return "CASE WHEN physical_quantity IS NULL THEN 'PHYSICAL_INVENTORY_UNKNOWN' WHEN available_quantity IS NULL THEN 'AVAILABLE_INVENTORY_UNKNOWN' "
+        +"WHEN unit_valid=0 THEN 'UNIT_UNKNOWN_OR_CONFLICT' WHEN owner_outbound IS NULL THEN 'SALES_WINDOW_UNAVAILABLE' "
+        +"ELSE 'METRIC_DEPENDENCY_UNKNOWN' END";}
+    public static String filter(AnalyticsSqlRequest p,AnalyticsInventoryOptions o){
+        if(o.coverageBucket()!=null)return "#{p.inventoryRun}>0 AND "+candidate()+" AND ("+bucket(p)+")=#{o.coverageBucket}";
+        if(o.coverageSelection()!=null)return finitePositive();
+        return "";
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/DashboardQueryService.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/DashboardQueryService.java
new file mode 100644
index 000000000..b92513ca9
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/DashboardQueryService.java
@@ -0,0 +1,117 @@
+package com.baiyue.lastleg.selfoperated.analytics.query;
+
+import com.baiyue.lastleg.selfoperated.analytics.statistics.SalesBucketPolicy;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Isolation;
+import org.springframework.transaction.annotation.Transactional;
+import java.math.BigDecimal;
+import java.math.RoundingMode;
+import java.time.*;
+import java.util.*;
+
+@Service
+@Transactional(readOnly=true,isolation=Isolation.REPEATABLE_READ)
+public class DashboardQueryService {
+    private final AnalyticsQueryService contextService;
+    private final DashboardReadMapper mapper;
+    private final SelfopOwnerDirectory ownerDirectory;
+    public DashboardQueryService(AnalyticsQueryService contextService,DashboardReadMapper mapper,SelfopOwnerDirectory ownerDirectory){this.contextService=contextService;this.mapper=mapper;this.ownerDirectory=ownerDirectory;}
+    public DashboardResponses.Dashboard dashboard(AnalyticsQuery input){
+        AnalyticsQuery q=DashboardRequest.normalize(input);
+        var snapshot=contextService.context(q,true,false,false,null);var c=snapshot.context();
+        var names=ownerDirectory.names(q.sourceAccount(),c.queryAsOf());
+        if(snapshot.sales()!=null&&!Boolean.TRUE.equals(snapshot.sales().warehouseDailyReady()))
+            throw new com.baiyue.common.core.exception.BizException("该销量版本尚未生成仓库每日汇总，请重新发布统计后再查询");
+        var base=contextService.request(snapshot,"DASHBOARD");LocalDate windowFrom=c.rangeStartDate(),windowUntil=c.rangeEndDateExclusive();
+        int windowDays=(int)java.time.temporal.ChronoUnit.DAYS.between(windowFrom,windowUntil);
+        var p=new AnalyticsSqlRequest(base.account(),base.warehouse(),null,null,base.salesRun(),base.inventoryRun(),windowFrom,windowUntil,base.anchor(),windowFrom,
+            base.completeFrom(),base.completeUntil(),base.coveredFrom(),base.coveredUntil(),base.salesKnown(),base.formalSales(),base.completeWindow(),base.complete30(),base.stockFresh(),0,10,"DASHBOARD",base.coverage());
+        var o=new AnalyticsInventoryOptions(null,null,null,null,null,null,null,null,null,null);
+        var days=mapper.daily(p,c.rangeStartDate(),c.rangeEndDateExclusive());
+        var report=mapper.report(p,o).stream().map(DashboardQueryService::normalize).toList();
+        Map<String,Object> stats=report.get(0);var ranked=report.stream().filter(row->row.get("rank_code")!=null).map(DashboardQueryService::ranked).toList();
+        var trendPoints=DashboardSalesPolicy.points(c,snapshot.sourceKnown(),c.rangeStartDate(),c.rangeEndDateExclusive(),days,SalesQueryCoverage.intervals(snapshot.sales()));
+        var trendSummary=SalesBucketPolicy.aggregate(trendPoints);
+        Map<String,Object> hotStats=stats;List<DashboardReadMapper.Ranked> hotRanked=ranked;
+        if(!base.completeWindow()){
+            var hotRequest=new AnalyticsSqlRequest(base.account(),base.warehouse(),null,null,base.salesRun(),base.inventoryRun(),c.rangeStartDate(),c.rangeEndDateExclusive(),base.anchor(),windowFrom,
+                base.completeFrom(),base.completeUntil(),base.coveredFrom(),base.coveredUntil(),base.salesKnown(),base.formalSales(),base.completeWindow(),base.complete30(),base.stockFresh(),0,10,"HOT_DASHBOARD",base.coverage());
+            var hotReport=mapper.report(hotRequest,o).stream().map(DashboardQueryService::normalize).toList();
+            hotStats=hotReport.get(0);hotRanked=hotReport.stream().filter(row->row.get("rank_code")!=null).map(DashboardQueryService::ranked).toList();
+        }
+        var salesSummary=new AnalyticsResponses.SalesSummary(q.sourceAccount(),q.warehouseCode(),null,null,null,"PCS",trendSummary.outboundQuantity(),trendSummary.observedQuantity(),
+            trendSummary.dataStatus(),trendSummary.reasonCodes(),trendSummary.completeDays(),trendSummary.partialDays(),trendSummary.unknownDays(),null);
+        var points=trendPoints.stream().map(t->new AnalyticsResponses.Point(t.date(),t.outboundQuantity(),t.observedQuantity(),t.dataStatus(),t.reasonCodes(),"PCS",t.provedFrom(),t.provedUntil())).toList();
+        var interval=new DashboardResponses.Metric(trendSummary.outboundQuantity(),trendSummary.observedQuantity(),"PCS",trendSummary.dataStatus(),null,trendSummary.reasonCodes(),trendSummary.outboundQuantity(),trendSummary.observedQuantity());
+        // Partial sales never become a formal daily average for the selected window.
+        var average=new DashboardResponses.Metric(divide(trendSummary.outboundQuantity(),windowDays),divide(trendSummary.outboundQuantity(),windowDays),"PCS_PER_DAY",trendSummary.dataStatus(),null,trendSummary.reasonCodes(),null,null);
+        boolean inventoryAvailable=base.inventoryRun()>0;
+        var kpis=new DashboardResponses.Kpis(interval,average,stockMetric(stats,"physical_quantity_known","physical_quantity_unknown","PCS",inventoryAvailable,base.stockFresh(),c),
+            stockMetric(stats,"available_quantity_known","available_quantity_unknown","PCS",inventoryAvailable,base.stockFresh(),c),
+            stockMetric(stats,"physical_skus","physical_quantity_unknown","SKU",inventoryAvailable,base.stockFresh(),c),
+            stockMetric(stats,"no_outbound_eligible","no_outbound_unknown","SKU",inventoryAvailable,base.stockFresh(),c));
+        Instant freshUntil=contextService.inventoryFreshUntil(snapshot),drilldownUntil=CoverageDistributionPolicy.expiresAt(c,freshUntil);
+        return new DashboardResponses.Dashboard(new DashboardResponses.Context(c,freshUntil,drilldownUntil),kpis,
+            new DashboardResponses.SalesTrend(salesSummary,points),distribution(stats,inventoryAvailable,c),
+            hotRanking(ranking("HOT",hotStats,hotRanked,base.salesRun()>0,c.rangeStartDate(),c.rangeEndDateExclusive(),c,names),trendSummary.dataStatus()),
+            ranking("LONG",stats,ranked,inventoryAvailable,windowFrom,windowUntil,c,names),
+            ranking("NO_OUTBOUND",stats,ranked,inventoryAvailable,windowFrom,windowUntil,c,names));
+    }
+    private static DashboardResponses.Ranking hotRanking(DashboardResponses.Ranking ranking,String windowStatus){
+        if("COMPLETE".equals(windowStatus))return ranking;
+        var items=ranking.items().stream().map(i->new DashboardResponses.Item(i.customerCode(),i.sku(),i.productName(),i.value(),i.unit(),i.windowOutboundQuantity(),i.skuOutboundOrderCount(),
+            i.physicalQuantity(),i.availableQuantity(),i.frozenQuantity(),i.defectivePhysicalQuantity(),null,null,i.customerName())).toList();
+        var reasons=new LinkedHashSet<>(ranking.reasonCodes());reasons.add("SALES_WINDOW_INCOMPLETE");
+        return new DashboardResponses.Ranking(ranking.windowStartDate(),ranking.windowEndDateExclusive(),ranking.calculationWindowDays(),ranking.eligibleCount(),ranking.unassessableCount(),items,
+            items.isEmpty()&&"UNKNOWN".equals(windowStatus)?"UNKNOWN":"PARTIAL",List.copyOf(reasons));
+    }
+    private static DashboardResponses.Metric stockMetric(Map<String,Object> s,String knownField,String unknownField,String unit,boolean available,boolean fresh,AnalyticsResponses.Context c){
+        if(!available)return new DashboardResponses.Metric(null,null,unit,"UNKNOWN",null,List.of("INVENTORY_UNAVAILABLE"),null,null);
+        long unknown=count(s,unknownField);BigDecimal known=decimal(s,knownField);
+        if(count(s,"total_skus")==0&&fresh)known=BigDecimal.ZERO;
+        if(!fresh&&count(s,"total_skus")==0)known=null;
+        BigDecimal value=fresh&&unknown==0?known:null;
+        String status=value!=null?"COMPLETE":known!=null?"PARTIAL":"UNKNOWN";
+        List<String> reasons=value!=null?List.of():!fresh?List.of("INVENTORY_"+c.inventoryStatus()):List.of("METRIC_DEPENDENCY_UNKNOWN");
+        return new DashboardResponses.Metric(value,known,unit,status,unknown,reasons,null,null);
+    }
+    private static DashboardResponses.Distribution distribution(Map<String,Object> s,boolean available,AnalyticsResponses.Context c){
+        List<DashboardResponses.Bucket> buckets=new ArrayList<>();
+        for(String code:CoverageDistributionPolicy.BUCKETS){String suffix=code.toLowerCase(Locale.ROOT);long n=count(s,"bucket_"+suffix);BigDecimal physical=decimal(s,"physical_"+suffix);
+            if(n==0&&available)physical=BigDecimal.ZERO;
+            buckets.add(new DashboardResponses.Bucket(code,available?n:null,available?physical:null,available?count(s,"unknown_"+suffix):null));
+        }
+        Map<String,Long> reasons=new LinkedHashMap<>();s.forEach((key,value)->{if(key.startsWith("reason_")&&value!=null){long n=new BigDecimal(value.toString()).longValueExact();if(n>0)reasons.put(key.substring(7).toUpperCase(Locale.ROOT),n);}});
+        String status=!available?"UNKNOWN":count(s,"bucket_unknown")>0?"PARTIAL":"COMPLETE";
+        List<String> codes=!available?List.of("INVENTORY_UNAVAILABLE"):count(s,"bucket_unknown")>0?List.of("UNASSESSABLE_SKUS"):List.of();
+        if(available&&!"VALID".equals(c.inventoryStatus())){status="PARTIAL";codes=List.of("INVENTORY_"+c.inventoryStatus());}
+        return new DashboardResponses.Distribution(CoverageDistributionPolicy.RULE_VERSION,available?count(s,"candidate_skus"):null,
+            available?count(s,"excluded_zero_skus"):null,List.copyOf(buckets),status,codes,available?Map.copyOf(reasons):Map.of());
+    }
+    private static DashboardResponses.Ranking ranking(String kind,Map<String,Object> s,List<DashboardReadMapper.Ranked> rows,boolean available,LocalDate from,LocalDate until,AnalyticsResponses.Context c,Map<String,String> names){
+        int windowDays=(int)java.time.temporal.ChronoUnit.DAYS.between(from,until);
+        String prefix=switch(kind){case "HOT"->"hot";case "LONG"->"long";default->"no_outbound";};
+        List<DashboardReadMapper.Ranked> selected=rows.stream().filter(r->kind.equals(r.rankCode())).sorted(Comparator
+            .comparing(DashboardReadMapper.Ranked::mainValue,Comparator.reverseOrder())
+            .thenComparing(r->"HOT".equals(kind)?r.orderCount():0L,Comparator.nullsLast(Comparator.reverseOrder()))
+            .thenComparing(DashboardReadMapper.Ranked::skuCode).thenComparing(DashboardReadMapper.Ranked::customerCode)).toList();
+        var items=available?selected.stream().map(r->new DashboardResponses.Item(r.customerCode(),r.skuCode(),r.productName(),r.mainValue(),"LONG".equals(kind)?"DAY":"PCS",
+            "HOT".equals(kind)?r.ownerOutbound():r.outboundQuantity30d(),r.orderCount(),r.physicalQuantity(),r.availableQuantity(),r.frozenQuantity(),r.defectivePhysicalQuantity(),
+            divide("HOT".equals(kind)?r.ownerOutbound():r.outboundQuantity30d(),windowDays),"HOT".equals(kind)?null:r.coverageDays(),names.get(r.customerCode()))).toList():List.<DashboardResponses.Item>of();
+        long unknown=count(s,prefix+"_unknown");String status=!available?"UNKNOWN":unknown>0?"PARTIAL":"COMPLETE";
+        List<String> reasons=!available?List.of("HOT".equals(kind)?"SALES_UNAVAILABLE":"INVENTORY_UNAVAILABLE"):unknown>0?List.of("UNASSESSABLE_SKUS"):List.of();
+        if(available&&count(s,prefix+"_eligible")==0&&unknown==0)reasons=List.of("NO_ELIGIBLE_SKUS");
+        if(available&&"HOT".equals(kind)&&!Set.of("VALID","STALE").contains(c.salesStatus())){status="UNKNOWN";reasons=List.of("SALES_"+c.salesStatus());}
+        return new DashboardResponses.Ranking(from,until,windowDays,available?count(s,prefix+"_eligible"):null,available?unknown:null,items,status,reasons);
+    }
+    private static Map<String,Object> normalize(Map<String,Object> source){Map<String,Object> result=new HashMap<>();if(source!=null)source.forEach((key,value)->result.put(key.toLowerCase(Locale.ROOT),value));return result;}
+    static DashboardReadMapper.Ranked ranked(Map<String,Object> row){
+        return new DashboardReadMapper.Ranked((String)row.get("rank_code"),(String)row.get("customer_code"),(String)row.get("sku_code"),(String)row.get("product_name"),
+            decimal(row,"main_value"),decimal(row,"owner_outbound"),row.get("order_count")==null?null:decimal(row,"order_count").longValueExact(),
+            decimal(row,"physical_quantity"),decimal(row,"available_quantity"),decimal(row,"frozen_quantity"),decimal(row,"defective_physical_quantity"),
+            decimal(row,"outbound_quantity30d"),decimal(row,"coverage_days"));
+    }
+    private static BigDecimal decimal(Map<String,Object> source,String key){Object value=source.get(key);return value==null?null:value instanceof BigDecimal decimal?decimal:new BigDecimal(value.toString());}
+    private static long count(Map<String,Object> source,String key){BigDecimal value=decimal(source,key);return value==null?0:value.longValueExact();}
+    private static BigDecimal divide(BigDecimal value,int days){return value==null||days==0?null:value.divide(BigDecimal.valueOf(days),12,RoundingMode.HALF_UP);}
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/DashboardReadMapper.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/DashboardReadMapper.java
new file mode 100644
index 000000000..21f40790c
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/DashboardReadMapper.java
@@ -0,0 +1,23 @@
+package com.baiyue.lastleg.selfoperated.analytics.query;
+
+import java.math.BigDecimal;
+import java.time.LocalDate;
+import java.util.List;
+import java.util.Map;
+import org.apache.ibatis.annotations.*;
+
+@Mapper
+public interface DashboardReadMapper {
+    record Day(LocalDate businessDate,BigDecimal observedQuantity,Long invalidRowCount){}
+    record Ranked(String rankCode,String customerCode,String skuCode,String productName,BigDecimal mainValue,
+        BigDecimal ownerOutbound,Long orderCount,BigDecimal physicalQuantity,BigDecimal availableQuantity,
+        BigDecimal frozenQuantity,BigDecimal defectivePhysicalQuantity,BigDecimal outboundQuantity30d,BigDecimal coverageDays){}
+    // Published-version warehouse facts retain valid subtotal and invalid-row evidence.
+    // Coverage and formal-zero proof still come from the pinned run, never row presence.
+    @Select("SELECT business_date,observed_quantity,invalid_row_count "
+        +"FROM ll_selfop_warehouse_daily_sales WHERE sales_run_id=#{p.salesRun} AND source_account=#{p.account} AND warehouse_code=#{p.warehouse} "
+        +"AND ((business_date>=#{chartFrom} AND business_date<#{chartUntil}) OR (business_date>=#{p.from} AND business_date<#{p.until})) ORDER BY business_date")
+    List<Day> daily(@Param("p") AnalyticsSqlRequest request,@Param("chartFrom") LocalDate chartFrom,@Param("chartUntil") LocalDate chartUntil);
+    @SelectProvider(type=DashboardReadSql.class,method="report")
+    List<Map<String,Object>> report(@Param("p") AnalyticsSqlRequest request,@Param("o") AnalyticsInventoryOptions options);
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/DashboardReadSql.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/DashboardReadSql.java
new file mode 100644
index 000000000..716d22a07
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/DashboardReadSql.java
@@ -0,0 +1,48 @@
+package com.baiyue.lastleg.selfoperated.analytics.query;
+
+import java.util.List;
+import java.util.Map;
+
+/** One shared inventory/sales aggregate returns statistics and at most 30 ranked rows. */
+public final class DashboardReadSql {
+    private DashboardReadSql(){}
+    public static String report(Map<String,Object> args){
+        var p=(AnalyticsSqlRequest)args.get("p");
+        if("HOT_DASHBOARD".equals(p.kind()))return AnalyticsInventorySql.typed(AnalyticsInventorySql.dashboardCte(p)
+            +", hot_statistics AS (SELECT COUNT(CASE WHEN owner_outbound>0 THEN 1 END) hot_eligible,COUNT(CASE WHEN owner_outbound IS NULL THEN 1 END) hot_unknown FROM result)"
+            +", hot_rank AS (SELECT * FROM result WHERE owner_outbound>0 ORDER BY owner_outbound DESC,order_count DESC,sku_code ASC,customer_code ASC LIMIT 10)"
+            +", hot_rows AS ("+select("HOT","owner_outbound","hot_rank")+") SELECT s.*,r.* FROM hot_statistics s LEFT JOIN hot_rows r ON 1=1");
+        // Only dashboard outputs are considered here. Without completeWindow all sales-dependent
+        // rankings are empty; observed sales still come from the independent daily query.
+        // Stale stock quantities are already masked to NULL. Keep both profile versions so
+        // candidate identities, observation evidence and unknown reasons remain unchanged.
+        StringBuilder sql=new StringBuilder(AnalyticsInventorySql.dashboardCte(p));
+        // SKU identity is unique already; DISTINCT is a MySQL merge barrier so the four consumers
+        // share one calculation rather than expanding profile/stock/sales joins for each ranking.
+        sql.append(", dashboard_result AS (SELECT DISTINCT * FROM result)");
+        sql.append(", classified AS (SELECT r.*,CASE WHEN ").append(CoverageDistributionSql.candidate()).append(" THEN ")
+            .append(CoverageDistributionSql.bucket(p)).append(" END bucket_code,").append(CoverageDistributionSql.unknownReason()).append(" unknown_reason FROM dashboard_result r), statistics AS (SELECT COUNT(*) total_skus");
+        for(String field:List.of("physical_quantity","available_quantity"))sql.append(",SUM(").append(field).append(") ").append(field).append("_known,COUNT(*)-COUNT(").append(field).append(") ").append(field).append("_unknown");
+        sql.append(",COUNT(CASE WHEN physical_quantity>0 THEN 1 END) physical_skus,COUNT(CASE WHEN physical_quantity=0 THEN 1 END) excluded_zero_skus")
+            .append(",COUNT(CASE WHEN bucket_code IS NOT NULL THEN 1 END) candidate_skus")
+            .append(",COUNT(CASE WHEN owner_outbound>0 THEN 1 END) hot_eligible,COUNT(CASE WHEN owner_outbound IS NULL THEN 1 END) hot_unknown")
+            .append(",COUNT(CASE WHEN ").append(CoverageDistributionSql.finitePositive()).append(" THEN 1 END) long_eligible")
+            .append(",COUNT(CASE WHEN available_quantity IS NULL OR (available_quantity>0 AND outbound_quantity30d IS NULL) THEN 1 END) long_unknown")
+            .append(",COUNT(CASE WHEN no_outbound=1 THEN 1 END) no_outbound_eligible,COUNT(CASE WHEN no_outbound IS NULL THEN 1 END) no_outbound_unknown");
+        for(String code:CoverageDistributionPolicy.BUCKETS){String alias=code.toLowerCase(java.util.Locale.ROOT);
+            sql.append(",COUNT(CASE WHEN bucket_code='").append(code).append("' THEN 1 END) bucket_").append(alias)
+                .append(",SUM(CASE WHEN bucket_code='").append(code).append("' THEN physical_quantity END) physical_").append(alias)
+                .append(",COUNT(CASE WHEN bucket_code='").append(code).append("' AND physical_quantity IS NULL THEN 1 END) unknown_").append(alias);
+        }
+        for(String reason:List.of("PHYSICAL_INVENTORY_UNKNOWN","AVAILABLE_INVENTORY_UNKNOWN","UNIT_UNKNOWN_OR_CONFLICT","SALES_WINDOW_UNAVAILABLE","METRIC_DEPENDENCY_UNKNOWN"))
+            sql.append(",COUNT(CASE WHEN bucket_code='UNKNOWN' AND unknown_reason='").append(reason).append("' THEN 1 END) reason_").append(reason.toLowerCase(java.util.Locale.ROOT));
+        sql.append(" FROM classified)")
+            .append(", hot_rank AS (SELECT * FROM dashboard_result WHERE owner_outbound>0 ORDER BY owner_outbound DESC,order_count DESC,sku_code ASC,customer_code ASC LIMIT 10)")
+            .append(", long_rank AS (SELECT * FROM dashboard_result WHERE ").append(CoverageDistributionSql.finitePositive()).append(" ORDER BY coverage_days DESC,sku_code ASC,customer_code ASC LIMIT 10)")
+            .append(", no_rank AS (SELECT * FROM dashboard_result WHERE no_outbound=1 ORDER BY physical_quantity DESC,sku_code ASC,customer_code ASC LIMIT 10)")
+            .append(", rankings AS (").append(select("HOT","owner_outbound","hot_rank")).append(" UNION ALL ").append(select("LONG","coverage_days","long_rank"))
+            .append(" UNION ALL ").append(select("NO_OUTBOUND","physical_quantity","no_rank")).append(") SELECT s.*,r.* FROM statistics s LEFT JOIN rankings r ON 1=1");
+        return AnalyticsInventorySql.typed(sql.toString());
+    }
+    private static String select(String kind,String value,String table){return "SELECT '"+kind+"' rank_code,customer_code,sku_code,product_name,"+value+" main_value,owner_outbound,order_count,physical_quantity,available_quantity,frozen_quantity,defective_physical_quantity,outbound_quantity30d,coverage_days FROM "+table;}
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/DashboardRequest.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/DashboardRequest.java
new file mode 100644
index 000000000..b5c776eb8
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/DashboardRequest.java
@@ -0,0 +1,17 @@
+package com.baiyue.lastleg.selfoperated.analytics.query;
+
+import com.baiyue.common.core.exception.BizException;
+import java.util.Set;
+
+public final class DashboardRequest {
+    private DashboardRequest(){}
+    public static void validateParameterNames(Set<String> names){
+        if(!Set.of("sourceAccount","warehouseCode","rangePreset","startDate","endDate","bucket","salesRunId","inventoryRunId","salesScopeHash","inventoryScopeHash","queryAsOf").containsAll(names))
+            throw new BizException("经营总览不接受货主、SKU、分页、任意榜单数量或其他筛选条件");
+    }
+    public static AnalyticsQuery normalize(AnalyticsQuery q){
+        if(q.customerCode()!=null||q.sku()!=null||q.current()!=null||q.size()!=null||q.windowDays()!=null)throw new BizException("经营总览仅支持仓库、趋势范围与固定版本上下文");
+        return new AnalyticsQuery(q.sourceAccount(),q.warehouseCode(),null,null,q.rangePreset()==null?"LAST_15_DAYS":q.rangePreset(),q.startDate(),q.endDate(),q.bucket(),null,null,null,
+            q.salesRunId(),q.inventoryRunId(),q.salesScopeHash(),q.inventoryScopeHash(),q.queryAsOf());
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/DashboardResponses.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/DashboardResponses.java
new file mode 100644
index 000000000..52edf148a
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/DashboardResponses.java
@@ -0,0 +1,28 @@
+package com.baiyue.lastleg.selfoperated.analytics.query;
+
+import com.fasterxml.jackson.annotation.JsonUnwrapped;
+import java.math.BigDecimal;
+import java.time.Instant;
+import java.time.LocalDate;
+import java.util.List;
+import java.util.Map;
+
+public final class DashboardResponses {
+    private DashboardResponses(){}
+    public record Context(@JsonUnwrapped AnalyticsResponses.Context versionContext,Instant inventoryFreshUntil,Instant inventoryDrilldownExpiresAt){}
+    public record Metric(BigDecimal value,BigDecimal knownSubtotal,String unit,String dataStatus,Long unknownSkuCount,
+        List<String> reasonCodes,BigDecimal outboundQuantity,BigDecimal observedQuantity){}
+    public record Kpis(Metric intervalOutboundQuantity,Metric averageDailyOutboundQuantity,Metric physicalQuantity,
+        Metric availableQuantity,Metric physicalSkuCount,Metric noOutboundSkuCount){}
+    public record SalesTrend(AnalyticsResponses.SalesSummary summary,List<AnalyticsResponses.Point> points){}
+    public record Bucket(String bucketCode,Long skuCount,BigDecimal knownPhysicalQuantity,Long unknownPhysicalSkuCount){}
+    public record Distribution(String bucketRuleVersion,Long candidateSkuCount,Long excludedZeroPhysicalSkuCount,
+        List<Bucket> buckets,String dataStatus,List<String> reasonCodes,Map<String,Long> unknownReasons){}
+    public record Item(String customerCode,String sku,String productName,BigDecimal value,String unit,BigDecimal windowOutboundQuantity,
+        Long skuOutboundOrderCount,BigDecimal physicalQuantity,BigDecimal availableQuantity,BigDecimal frozenQuantity,
+        BigDecimal defectivePhysicalQuantity,BigDecimal averageDailyOutboundQuantity,BigDecimal inventoryCoverageDays,String customerName){}
+    public record Ranking(LocalDate windowStartDate,LocalDate windowEndDateExclusive,int calculationWindowDays,Long eligibleCount,
+        Long unassessableCount,List<Item> items,String dataStatus,List<String> reasonCodes){}
+    public record Dashboard(Context context,Kpis kpis,SalesTrend salesTrend,Distribution coverageDistribution,
+        Ranking hotSkus,Ranking longCoverageSkus,Ranking noOutboundSkus){}
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/DashboardSalesPolicy.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/DashboardSalesPolicy.java
new file mode 100644
index 000000000..14d8c2330
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/DashboardSalesPolicy.java
@@ -0,0 +1,39 @@
+package com.baiyue.lastleg.selfoperated.analytics.query;
+
+import com.baiyue.lastleg.selfoperated.analytics.statistics.SalesBucketPolicy;
+import java.math.BigDecimal;
+import java.time.*;
+import java.util.*;
+
+/** Warehouse coverage is independent of SKU existence and inventory observation eligibility. */
+public final class DashboardSalesPolicy {
+    private DashboardSalesPolicy(){}
+    public static List<SalesBucketPolicy.Point> points(AnalyticsResponses.Context c,boolean sourceKnown,LocalDate from,LocalDate until,List<DashboardReadMapper.Day> rows,
+        List<com.baiyue.lastleg.selfoperated.analytics.model.SelfopSalesCoverage.Interval> coverage){
+        var intervals=coverage.isEmpty()?SalesQueryCoverage.scalar(c.salesCoveredFrom()==null?null:LocalDateTime.ofInstant(c.salesCoveredFrom(),ZoneOffset.UTC),
+            c.salesCoveredUntil()==null?null:LocalDateTime.ofInstant(c.salesCoveredUntil(),ZoneOffset.UTC)):coverage;
+        Map<LocalDate,DashboardReadMapper.Day> days=new HashMap<>();for(var row:rows)days.put(row.businessDate(),row);
+        List<SalesBucketPolicy.Point> result=new ArrayList<>();ZoneId zone=ZoneId.of("Asia/Shanghai");
+        for(LocalDate day=from;day.isBefore(until);day=day.plusDays(1)){
+            var actual=days.get(day);Instant start=day.atStartOfDay(zone).toInstant(),end=day.plusDays(1).atStartOfDay(zone).toInstant();
+            var interval=SalesQueryCoverage.at(intervals,day);
+            Instant lower=interval==null?null:(interval.from().toInstant(ZoneOffset.UTC).isAfter(start)?interval.from().toInstant(ZoneOffset.UTC):start);
+            Instant upper=interval==null?null:(interval.until().toInstant(ZoneOffset.UTC).isBefore(end)?interval.until().toInstant(ZoneOffset.UTC):end);
+            boolean intersects=lower!=null&&upper!=null&&lower.isBefore(upper);
+            boolean invalid=actual!=null&&actual.invalidRowCount()!=null&&actual.invalidRowCount()>0;
+            // Recency and pending rebuild describe the live scope, not the frozen version's
+            // historical coverage. Inventory assessment retains its separate rebuild guard.
+            boolean trusted="VALID".equals(c.salesStatus())||"STALE".equals(c.salesStatus())||"REBUILD_REQUIRED".equals(c.salesStatus());
+            boolean complete=sourceKnown&&trusted&&!invalid&&day.isBefore(c.anchorDate())&&SalesQueryCoverage.complete(intervals,day,day.plusDays(1));
+            BigDecimal known=sourceKnown&&actual!=null?actual.observedQuantity():null;
+            if(known==null&&sourceKnown&&!invalid&&(complete||intersects))known=BigDecimal.ZERO;
+            String status=complete?"COMPLETE":known!=null?"PARTIAL":"UNKNOWN";List<String> reasons=new ArrayList<>();
+            if(!sourceKnown)reasons.add("SALES_NOT_COVERED");if(!trusted)reasons.add("SALES_"+c.salesStatus());
+            if(c.rebuildRequired()||"REBUILD_REQUIRED".equals(c.salesStatus()))reasons.add("SALES_REBUILD_REQUIRED");
+            if(invalid)reasons.add("SALES_QUANTITY_OR_UNIT_INVALID");if(!complete)reasons.add(day.equals(c.anchorDate())?"TODAY_INCOMPLETE":"SALES_DAY_INCOMPLETE");
+            if(known==null)reasons.add("SALES_NOT_COVERED");
+            result.add(new SalesBucketPolicy.Point(day,complete?known:null,known,null,status,List.copyOf(new LinkedHashSet<>(reasons)),intersects?lower:null,intersects?upper:null));
+        }
+        return List.copyOf(result);
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/InventoryTurnoverContext.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/InventoryTurnoverContext.java
new file mode 100644
index 000000000..e7e175d55
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/InventoryTurnoverContext.java
@@ -0,0 +1,103 @@
+package com.baiyue.lastleg.selfoperated.analytics.query;
+
+import com.baiyue.common.core.exception.BizException;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import java.time.*;
+import java.time.temporal.ChronoUnit;
+import java.util.*;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.stereotype.Component;
+import static com.baiyue.lastleg.selfoperated.analytics.query.InventoryTurnoverResponses.*;
+
+/** Signed evidence fixes exact committed day versions; corrections explicitly revoke their validity. */
+@Component
+public class InventoryTurnoverContext {
+    static final ZoneId ZONE=ZoneId.of("Asia/Shanghai");
+    static final String RULE="FLOW_EOD_V1";
+    // A service restart expires open pages/exports, which must request a fresh consistent snapshot.
+    private static final byte[] TOKEN_KEY=new java.security.SecureRandom().generateSeed(32);
+    private final AnalyticsReadMapper analytics;
+    private final InventoryTurnoverReadMapper mapper;
+    private final ObjectMapper json;
+    private final Clock clock;
+    private final SelfopOwnerDirectory ownerDirectory;
+    @Autowired public InventoryTurnoverContext(AnalyticsReadMapper analytics,InventoryTurnoverReadMapper mapper,ObjectMapper json,SelfopOwnerDirectory ownerDirectory) {
+        this(analytics,mapper,json,Clock.systemUTC(),ownerDirectory);
+    }
+    InventoryTurnoverContext(AnalyticsReadMapper analytics,InventoryTurnoverReadMapper mapper,ObjectMapper json,Clock clock,SelfopOwnerDirectory ownerDirectory) {
+        this.analytics=analytics;this.mapper=mapper;this.json=json;this.clock=clock;
+        this.ownerDirectory=ownerDirectory;
+    }
+    public record Evidence(String account,String warehouse,LocalDate end,int days,Instant asOf,
+        Long salesRun,Long inventoryRun,String salesHash,String inventoryHash,boolean rebuild,
+        String samplesHash,LocalDate accumulationStartedOn,String rule,List<Sample> versions) {}
+    record Frozen(Context response,AnalyticsQueryService.Snapshot snapshot) {}
+    Frozen resolve(InventoryTurnoverRequest q) {
+        Instant now=clock.instant(); q.validate(now.atZone(ZONE).toLocalDate());
+        Evidence supplied=q.snapshotContext()==null?null:decode(q.snapshotContext());
+        Instant asOf=supplied==null?now.truncatedTo(ChronoUnit.MICROS):supplied.asOf();
+        if(asOf==null||asOf.isAfter(now)||!now.isBefore(asOf.plusSeconds(1800))) throw refresh();
+        LocalDate end=q.end(asOf.atZone(ZONE).toLocalDate());
+        if(supplied!=null&&(!Objects.equals(q.sourceAccount(),supplied.account())||!Objects.equals(q.warehouseCode(),supplied.warehouse())
+            ||!end.equals(supplied.end())||q.days()!=supplied.days()||!RULE.equals(supplied.rule())||supplied.versions()==null)) throw refresh();
+        var scopes=analytics.scopes(q.sourceAccount(),q.warehouseCode());
+        var sales=supplied==null?version(scopes,"OUTBOUND",asOf):fixed(supplied.salesRun());
+        var stock=supplied==null?version(scopes,"INVENTORY",asOf):fixed(supplied.inventoryRun());
+        var aq=new AnalyticsQuery(q.sourceAccount(),q.warehouseCode(),null,null,"CUSTOM",end.minusDays(Math.max(30,q.days())-1),end,"DAY",null,1,20,
+            sales==null?0L:sales.id(),stock==null?0L:stock.id(),sales==null?null:sales.scopeHash(),stock==null?null:stock.scopeHash(),asOf);
+        // Staleness is evaluated at queryAsOf, so pagination does not age a fixed snapshot midway.
+        var snapshot=new AnalyticsQueryService(analytics,json,Clock.fixed(asOf,ZoneOffset.UTC),ownerDirectory).context(aq,true,false,false,null);
+        String inventoryHash=scopes.stream().filter(s->"INVENTORY".equals(s.dataFamily())).map(AnalyticsReadRows.Scope::scopeHash).findFirst().orElse(null);
+        var mapping=new TreeMap<LocalDate,Long>();
+        List<InventoryTurnoverReadMapper.DayVersion> selected;
+        if(supplied==null)selected=mapper.samples(q.sourceAccount(),q.warehouseCode(),inventoryHash,utc(asOf),end.minusDays(Math.max(30,q.days())-1),end.plusDays(1));
+        else {
+            if(supplied.versions().size()>366||supplied.versions().stream().anyMatch(v->v==null||v.dayVersionId()==null||v.dayVersionId()<=0))throw refresh();
+            selected=supplied.versions().isEmpty()?List.of():mapper.fixedSamples(q.sourceAccount(),q.warehouseCode(),inventoryHash,supplied.versions().stream().map(Sample::dayVersionId).toList());
+            if(!selected.stream().map(v->new Sample(v.sampleDate(),v.dayVersionId())).toList().equals(supplied.versions()))throw refresh();
+        }
+        for(var sample:selected) {
+            if(sample.sampleDate()==null||sample.dayVersionId()==null||sample.dayVersionId()<=0||sample.sampleDate().isBefore(end.minusDays(Math.max(30,q.days())-1))||sample.sampleDate().isAfter(end)
+                ||mapping.put(sample.sampleDate(),sample.dayVersionId())!=null) throw refresh();
+        }
+        List<Sample> samples=new ArrayList<>();
+        for(LocalDate date=end.minusDays(Math.max(30,q.days())-1);!date.isAfter(end);date=date.plusDays(1)) samples.add(new Sample(date,mapping.get(date)));
+        var began=supplied==null?mapper.accumulationStartedOn(q.sourceAccount(),q.warehouseCode(),inventoryHash,utc(asOf)):supplied.accumulationStartedOn();
+        var c=snapshot.context();
+        var evidence=new Evidence(q.sourceAccount(),q.warehouseCode(),end,q.days(),asOf,c.salesRunId(),c.inventoryRunId(),
+            c.salesScopeHash(),c.inventoryScopeHash(),c.rebuildRequired(),samplesHash(samples),began,RULE,samples.stream().filter(v->v.dayVersionId()!=null).toList());
+        if(supplied!=null&&!supplied.equals(evidence)) throw refresh();
+        return new Frozen(new Context(encode(evidence),q.sourceAccount(),q.warehouseCode(),end,q.days(),asOf,c.queryExpiresAt(),c,
+            c.inventoryObservedFrom(),c.inventoryObservedUntil(),RULE,List.copyOf(samples),samples.stream().filter(s->s.dayVersionId()==null).map(Sample::date).toList(),began),snapshot);
+    }
+    private AnalyticsReadRows.Run fixed(Long id){if(id==null||id==0)return null;var run=analytics.publishedRun(id);if(run==null)throw refresh();return run;}
+    private AnalyticsReadRows.Run version(List<AnalyticsReadRows.Scope> scopes,String family,Instant asOf) {
+        var scope=scopes.stream().filter(s->family.equals(s.dataFamily())).findFirst().orElse(null);
+        return scope==null?null:mapper.versionAt(scope.id(),scope.scopeHash(),utc(asOf));
+    }
+    private Evidence decode(String token) {
+        try {
+            if(token.length()>16000)throw refresh();var parts=token.split("\\.",-1);if(parts.length!=2)throw refresh();
+            byte[] compressed=Base64.getUrlDecoder().decode(parts[0]);
+            if(!java.security.MessageDigest.isEqual(sign(compressed),Base64.getUrlDecoder().decode(parts[1])))throw refresh();
+            try(var gzip=new java.util.zip.GZIPInputStream(new java.io.ByteArrayInputStream(compressed))){
+                byte[] bytes=gzip.readNBytes(65537);if(bytes.length>65536)throw refresh();
+                var value=json.readValue(bytes,Evidence.class);if(value==null)throw refresh();return value;
+            }
+        } catch(Exception e){throw refresh();}
+    }
+    private String encode(Evidence evidence) {
+        try{var output=new java.io.ByteArrayOutputStream();try(var gzip=new java.util.zip.GZIPOutputStream(output)){gzip.write(json.writeValueAsBytes(evidence));}
+            byte[] data=output.toByteArray();var b64=Base64.getUrlEncoder().withoutPadding();return b64.encodeToString(data)+"."+b64.encodeToString(sign(data));
+        }catch(Exception e){throw new IllegalStateException("Cannot encode turnover context",e);}
+    }
+    private static byte[] sign(byte[] bytes)throws java.security.GeneralSecurityException{var mac=javax.crypto.Mac.getInstance("HmacSHA256");mac.init(new javax.crypto.spec.SecretKeySpec(TOKEN_KEY,"HmacSHA256"));return mac.doFinal(bytes);}
+    private String samplesHash(List<Sample> samples) {
+        // Reconstruct the entire ordered calendar at asOf before comparing its digest.
+        // Keep the GET pagination token bounded even for a full year of samples.
+        try{return HexFormat.of().formatHex(java.security.MessageDigest.getInstance("SHA-256").digest(json.writeValueAsBytes(samples)));}
+        catch(Exception e){throw new IllegalStateException("Cannot encode turnover samples",e);}
+    }
+    private static LocalDateTime utc(Instant value){return LocalDateTime.ofInstant(value,ZoneOffset.UTC);}
+    private static BizException refresh(){return new BizException("库存周转上下文无效或已过期，请整体刷新");}
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/InventoryTurnoverExport.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/InventoryTurnoverExport.java
new file mode 100644
index 000000000..73be71e66
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/InventoryTurnoverExport.java
@@ -0,0 +1,133 @@
+package com.baiyue.lastleg.selfoperated.analytics.query;
+
+import com.baiyue.common.core.export.ExportContracts.*;
+import com.baiyue.common.core.exception.BizException;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import org.springframework.stereotype.Service;
+import java.math.BigDecimal;
+import java.math.RoundingMode;
+import java.util.*;
+import static com.baiyue.lastleg.selfoperated.analytics.query.InventoryTurnoverResponses.*;
+
+/** Download-center projection: the browser supplies column keys, never headings or cell values. */
+@Service
+public class InventoryTurnoverExport {
+    public static final String TYPE = "SELFOP_INVENTORY_TURNOVER";
+    private final InventoryTurnoverQueryService queries;
+    private final ObjectMapper json;
+    public InventoryTurnoverExport(InventoryTurnoverQueryService queries, ObjectMapper json) { this.queries=queries; this.json=json; }
+    private static final Map<String,String> LABELS = Map.ofEntries(
+        Map.entry("sku","SKU"), Map.entry("productName","商品名称"), Map.entry("customerCode","所属货主"),
+        Map.entry("physicalQuantity","实物件数"), Map.entry("availableQuantity","正品可售"), Map.entry("transitQuantity","在途"),
+        Map.entry("frozenQuantity","冻结件数"), Map.entry("defectiveQuantity","次品实物"), Map.entry("physicalSkuCount","有实物SKU数"),
+        Map.entry("inventoryVolumeM3","库存立方数"), Map.entry("outboundVolumesM3","出库立方数"), Map.entry("unitVolumeM3","单件体积"),
+        Map.entry("outbound7","7日出库"), Map.entry("outbound15","15日出库"), Map.entry("outbound30","30日出库"),
+        Map.entry("averageDailyOutboundQuantity","日均"), Map.entry("inventoryCoverageDays","预计可售天数"),
+        Map.entry("quantityTurnoverRate","期间周转率"), Map.entry("quantityTurnoverCount","期间件数周转"),
+        Map.entry("averagePhysicalQuantity","期间平均实物"), Map.entry("lastObservedOutboundDate","最近已观测出库日"),
+        Map.entry("noOutboundInWindow","无出库SKU / 实物"), Map.entry("slowCoverage","慢消化SKU / 待判断"),
+        Map.entry("period","统计期间"), Map.entry("periodOutbound","期间出库件数"), Map.entry("historySource","历史库存来源"),
+        Map.entry("historyDays","合格历史库存天数"), Map.entry("historyReason","历史库存说明"));
+    private static final List<String> REQUIRED = List.of("period","periodOutbound","averagePhysicalQuantity","quantityTurnoverRate","historySource","historyDays","historyReason");
+
+    public ExportBatchResponse batch(ExportBatchRequest request, int offset, String signature) {
+        if(request.limit()>100) throw invalid("库存周转每批最多100条");
+        Map<String,Object> parameters=new LinkedHashMap<>(request.parameters()==null?Map.of():request.parameters());
+        Object rawColumns=parameters.remove("columns"), rawTotal=parameters.remove("expectedTotal");
+        if(!(rawColumns instanceof List<?> selected)||selected.isEmpty()||selected.size()>LABELS.size()) throw invalid("导出列无效");
+        Set<String> keys=new LinkedHashSet<>();
+        for(Object key:selected) if(!(key instanceof String s)||!LABELS.containsKey(s)||!keys.add(s)) throw invalid("导出列重复或不支持");
+        keys.addAll(REQUIRED);
+        long expected;
+        try { expected=new BigDecimal(String.valueOf(rawTotal)).longValueExact(); }
+        catch(RuntimeException e) { throw invalid("导出条数无效"); }
+        if(expected<0||expected>200000||offset>expected) throw invalid("导出条数超出范围");
+        if(parameters.containsKey("current")||parameters.containsKey("size")||parameters.containsKey("includeOverview")) throw invalid("导出不接受列表分页参数");
+        InventoryTurnoverRequest.validateParameters(parameters.keySet());
+        parameters.put("current",offset/request.limit()+1);parameters.put("size",request.limit());parameters.put("includeOverview",false);
+        InventoryTurnoverRequest query;
+        try { query=json.convertValue(parameters,InventoryTurnoverRequest.class); }
+        catch(IllegalArgumentException e) { throw invalid("导出筛选无效"); }
+        if(query.snapshotContext()==null||query.snapshotContext().isBlank()||query.endDate()==null||query.baseWindowDays()==null) throw invalid("请先查询后导出");
+        boolean owner="OWNER".equals(query.group());
+        if(owner&&(keys.contains("sku")||keys.contains("productName")||keys.contains("unitVolumeM3")||keys.contains("inventoryCoverageDays"))
+            ||!owner&&(keys.contains("physicalSkuCount")||keys.contains("noOutboundInWindow")||keys.contains("slowCoverage"))) throw invalid("导出列不适用于当前分组");
+        Response result=queries.query(query);
+        if(result.total()!=expected||!query.snapshotContext().equals(result.context().snapshotContext())
+            ||result.rows().size()!=Math.min(request.limit(),expected-offset)) throw invalid("导出数据范围或版本已变化，请整体刷新后重新导出");
+        Set<List<String>> seen=new HashSet<>();
+        for(Row row:result.rows()) if(!seen.add(Arrays.asList(row.customerCode(),row.sku()))) throw invalid("导出数据重复");
+        List<ExportColumn> columns=keys.stream().map(key->new ExportColumn(key,title(key,query),ExportColumnType.STRING,24)).toList();
+        List<Map<String,Object>> rows=result.rows().stream().map(row->{
+            Map<String,Object> values=new LinkedHashMap<>();for(String key:keys)values.put(key,cell(row,key,query));return values;
+        }).toList();
+        String hash;
+        try { hash="sha256:"+HexFormat.of().formatHex(java.security.MessageDigest.getInstance("SHA-256").digest(json.writeValueAsBytes(columns))); }
+        catch(Exception e) { throw new IllegalStateException("Cannot hash turnover export columns",e); }
+        long next=offset+rows.size();
+        return new ExportBatchResponse(1,hash,signature,request.snapshotToken()==null?columns:List.of(),rows,String.valueOf(next),next<expected,request.snapshotToken()==null?expected:null);
+    }
+    private static String title(String key,InventoryTurnoverRequest q) {
+        if(key.equals("outboundVolumesM3"))return q.days()+"日出库立方数";
+        if(key.equals("averageDailyOutboundQuantity"))return q.days()+"日日均";
+        return LABELS.get(key);
+    }
+    static String cell(Row r,String key,InventoryTurnoverRequest q) {
+        return switch(key) {
+            case "sku" -> text(r.sku()); case "productName" -> text(r.productName());
+            case "customerCode" -> r.customerName()==null||r.customerName().isBlank()?text(r.customerCode()):r.customerName();
+            case "physicalQuantity" -> total(r.physicalQuantity()); case "availableQuantity" -> total(r.availableQuantity());
+            case "transitQuantity" -> total(r.transitQuantity()); case "frozenQuantity" -> total(r.frozenQuantity()); case "defectiveQuantity" -> total(r.defectiveQuantity());
+            case "physicalSkuCount" -> number(r.physicalSkuCount(),2);
+            case "inventoryVolumeM3" -> volume(r.inventoryVolumeM3(),false);
+            case "outboundVolumesM3" -> volume(r.outboundVolumesM3().stream().filter(v->v.days()==q.days()).map(VolumeWindow::volume).findFirst().orElse(null),true);
+            case "unitVolumeM3" -> number(r.unitVolumeM3(),9)+(r.unitVolumeM3()==null?"":" m³")+"；"+switch(text(r.dimensionSource())) { case "WAREHOUSE_MEASURED" -> "仓库实测尺寸";case "PRODUCT_DECLARED" -> "商品尺寸估算";default -> "缺少有效尺寸"; };
+            case "outbound7","outbound15","outbound30" -> window(r,Integer.parseInt(key.substring(8)));
+            case "periodOutbound" -> window(r,q.days());
+            case "averageDailyOutboundQuantity" -> number(r.averageDailyOutboundQuantity(),2);
+            case "inventoryCoverageDays" -> number(r.inventoryCoverageDays(),1)+"；"+reason(r.coverageStatus());
+            case "averagePhysicalQuantity" -> number(r.averagePhysicalQuantity(),2);
+            case "quantityTurnoverRate" -> r.quantityTurnoverCount()==null?"—":number(r.quantityTurnoverCount().multiply(BigDecimal.valueOf(100)),2)+"%";
+            case "quantityTurnoverCount" -> r.quantityTurnoverCount()==null?"—":number(r.quantityTurnoverCount(),2)+" 次/"+q.days()+"日";
+            case "period" -> "截至 "+q.endDate()+"，最近 "+q.days()+" 天";
+            case "historySource" -> "库存流水还原（日末实物库存）";
+            case "historyDays" -> r.qualifiedSampleDays()+"/"+r.requiredSampleDays();
+            case "historyReason" -> reasons(r.sampleReasonCodes());
+            case "lastObservedOutboundDate" -> r.lastObservedOutboundDate()==null?"已采集历史内未见出库":r.lastObservedOutboundDate().toString();
+            case "noOutboundInWindow" -> number(r.noOutboundInWindow().matchedSkuCount(),2)+" SKU / "+number(r.noOutboundInWindow().knownPhysicalQuantity(),2)+" 件；待判断 "+r.noOutboundInWindow().unknownSkuCount()+" SKU";
+            case "slowCoverage" -> q.coverageDaysThreshold()==null?"未设查询阈值":number(r.slowCoverage().matchedSkuCount(),2)+" SKU / "+r.slowCoverage().unknownSkuCount()+" SKU";
+            default -> throw invalid("不支持的导出列");
+        };
+    }
+    static String number(BigDecimal value,int decimals) {
+        if(value==null)return "—";
+        BigDecimal threshold=BigDecimal.ONE.movePointLeft(decimals);
+        if(value.signum()>0&&value.compareTo(threshold)<0)return "<"+threshold.setScale(decimals).toPlainString();
+        var f=new java.text.DecimalFormat("#,##0"+(decimals>0?"."+"#".repeat(decimals):""),java.text.DecimalFormatSymbols.getInstance(Locale.ROOT));
+        f.setRoundingMode(RoundingMode.HALF_UP);return f.format(value);
+    }
+    private static String total(Total t) {
+        if(t.value()!=null)return number(t.value(),2);
+        if(t.knownSubtotal()==null&&t.unknownSkuCount()==0)return reasons(t.reasonCodes());
+        return "已知 "+number(t.knownSubtotal(),2)+"；"+t.unknownSkuCount()+" SKU待核验";
+    }
+    private static String window(Row r,int days) {
+        return r.windows().stream().filter(w->w.days()==days).findFirst().map(w->"COMPLETE".equals(w.dataStatus())?number(w.outboundQuantity(),2):"已采集 "+number(w.observedQuantity(),2)+"，覆盖不足").orElse("—");
+    }
+    private static String volume(Volume v,boolean outbound) {
+        if(v==null)return "—；数量或尺寸待确认";
+        List<String> notes=new ArrayList<>();
+        if(v.value()==null)notes.add(v.knownSubtotal()==null?"暂无已知小计":"已知小计 "+number(v.knownSubtotal(),6)+" m³");
+        if(v.missingDimensionSkuCount()>0)notes.add("缺尺寸 "+v.missingDimensionSkuCount()+" SKU / "+number(v.missingDimensionQuantity(),2)+" 件");
+        if(v.unknownQuantitySkuCount()>0)notes.add("数量待确认 "+v.unknownQuantitySkuCount()+" SKU");
+        if(v.declaredDimensionQuantity()!=null&&v.declaredDimensionQuantity().signum()>0)notes.add("其中 "+number(v.declaredDimensionQuantity(),2)+" 件按商品尺寸估算");
+        if(outbound)notes.add("按当前商品尺寸估算");
+        else if(v.value()!=null&&v.value().signum()==0)notes.add("已知体积为0");
+        else if(v.value()!=null&&(v.declaredDimensionQuantity()==null||v.declaredDimensionQuantity().signum()==0))notes.add("按仓库实测尺寸计算");
+        return number(v.value(),6)+(v.value()==null?"":" m³")+"；"+(notes.isEmpty()?"数量或尺寸待确认":String.join("；",notes));
+    }
+    private static String reasons(List<String> reasons){return reasons==null||reasons.isEmpty()?"—":String.join("、",reasons.stream().map(InventoryTurnoverExport::reason).toList());}
+    private static String reason(String reason){return TurnoverExportReasons.LABELS.getOrDefault(reason==null?"":reason,"数据待核验");}
+    private static String text(String value){return value==null||value.isBlank()?"—":value;}
+    private static BizException invalid(String message){return new BizException(message);}
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/InventoryTurnoverPolicy.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/InventoryTurnoverPolicy.java
new file mode 100644
index 000000000..27bc80535
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/InventoryTurnoverPolicy.java
@@ -0,0 +1,105 @@
+package com.baiyue.lastleg.selfoperated.analytics.query;
+
+import java.math.BigDecimal;
+import java.math.RoundingMode;
+import java.time.LocalDate;
+import java.util.*;
+import static com.baiyue.lastleg.selfoperated.analytics.query.InventoryTurnoverResponses.*;
+
+/** Maps separately qualified quantities; a missing value never becomes a formal zero. */
+public final class InventoryTurnoverPolicy {
+    private InventoryTurnoverPolicy() {}
+    static Map<String,Object> normalized(Map<String,Object> source) {
+        Map<String,Object> result=new HashMap<>();
+        if(source!=null)source.forEach((key,value)->result.put(key.toLowerCase(Locale.ROOT),value));
+        return result;
+    }
+    static BigDecimal decimal(Map<String,Object> row,String key) {
+        Object value=row.get(key);return value==null?null:new BigDecimal(value.toString());
+    }
+    static int count(Map<String,Object> row,String key){BigDecimal value=decimal(row,key);return value==null?0:value.intValueExact();}
+    static String text(Map<String,Object> row,String key){Object value=row.get(key);return value==null?null:value.toString();}
+    static BigDecimal divide(BigDecimal a,int n){return a==null?null:a.divide(BigDecimal.valueOf(n),6,RoundingMode.HALF_UP);}
+    private static BigDecimal scale(BigDecimal value){return value==null?null:value.setScale(6,RoundingMode.HALF_UP);}
+    static List<Window> windows(Map<String,Object> row,LocalDate until, java.util.List<Integer> sizes) {
+        List<Window> result=new ArrayList<>();
+        for(int n:sizes) {
+            String key="w"+n+"_";var formal=decimal(row,key+"outbound");var observed=decimal(row,key+"observed");
+            int complete=count(row,key+"complete"),partial=count(row,key+"partial");
+            result.add(new Window(n,until.minusDays(n),until,formal,observed,divide(formal,n),complete,partial,
+                n-complete-partial,formal!=null?"COMPLETE":observed!=null?"PARTIAL":"UNKNOWN",
+                formal!=null?List.of():List.of("SALES_WINDOW_INCOMPLETE")));
+        }
+        return List.copyOf(result);
+    }
+    static Total total(Map<String,Object> row,String field,boolean owner) {
+        var value=decimal(row,field);int unknown=owner?count(row,field+"_unknown"):value==null?1:0;
+        return new Total(value,owner?decimal(row,field+"_known"):value,unknown,unknown==0?List.of():List.of("INVENTORY_UNKNOWN_OR_STALE"));
+    }
+    static Volume volume(Map<String,Object> row,String field) {
+        var reasons=new ArrayList<String>();
+        int missing=count(row,field+"_missing_dimension_skus"),unknown=count(row,field+"_unknown_quantity_skus");
+        var declared=decimal(row,field+"_estimated_quantity");
+        if(missing>0)reasons.add("DIMENSIONS_MISSING_OR_INVALID");
+        if(unknown>0||decimal(row,field+"_volume")==null&&decimal(row,field+"_volume_known")==null)reasons.add("QUANTITY_UNAVAILABLE");
+        if(declared!=null&&declared.signum()>0)reasons.add("DECLARED_DIMENSIONS_ESTIMATE");
+        return new Volume(decimal(row,field+"_volume"),decimal(row,field+"_volume_known"),decimal(row,field+"_missing_dimension_quantity"),
+            missing,unknown,declared,List.copyOf(reasons));
+    }
+    static List<VolumeWindow> volumeWindows(Map<String,Object> row,LocalDate until,List<Integer> sizes) {
+        return sizes.stream().map(n->new VolumeWindow(n,until.minusDays(n),until,volume(row,"w"+n+"_outbound"))).toList();
+    }
+    private static Risk risk(Map<String,Object> row,String name,Total physical,boolean owner,boolean enabled) {
+        if(!enabled)return new Risk(null,null,0,null);
+        int unknown=owner?count(row,name+"_unknown"):row.get(name)==null?1:0;
+        BigDecimal matched=owner?decimal(row,name+"_count"):BigDecimal.valueOf(count(row,name));
+        BigDecimal quantity=owner?decimal(row,name+"_physical"):BigDecimal.ONE.equals(matched)?physical.value():BigDecimal.ZERO;
+        BigDecimal ratio=unknown==0&&physical.value()!=null&&physical.value().signum()>0&&quantity!=null
+            ?quantity.divide(physical.value(),6,RoundingMode.HALF_UP):null;
+        return new Risk(matched,quantity,unknown,ratio);
+    }
+    static Row row(Map<String,Object> raw,InventoryTurnoverRequest q,Context context) {
+        var r=normalized(raw);boolean owner="OWNER".equals(q.group());
+        Total physical=total(r,"physical",owner),available=total(r,"available",owner);
+        var windows=windows(r,context.endDate().plusDays(1),q.windows());var base=windows.stream().filter(w->w.days()==q.days()).findFirst().orElseThrow();
+        var coverage=owner?null:scale(decimal(r,"coverage_days"));var rawAverage=decimal(r,"average_physical");var average=scale(rawAverage);
+        var turnover=scale(decimal(r,"turnover"));int sampleCount=count(r,"sample_count");
+        String coverageStatus=owner?"NOT_APPLICABLE":available.value()==null?"INVENTORY_UNKNOWN_OR_STALE":available.value().signum()==0?"NO_AVAILABLE_STOCK":
+            base.outboundQuantity()==null||count(r,"unassessable")>0?"UNASSESSABLE":base.outboundQuantity().signum()==0?"NO_OUTBOUND_IN_WINDOW":"VALID";
+        // Qualification precedes output rounding: a positive daily mean can round to six-place zero.
+        String sampleStatus=sampleCount<q.days()||rawAverage==null?"INSUFFICIENT":rawAverage.signum()==0?"ZERO_AVERAGE_STOCK":turnover==null?"SALES_WINDOW_UNAVAILABLE":"VALID";
+        if(!"VALID".equals(sampleStatus))turnover=null;
+        List<LocalDate> missing=new ArrayList<>();String dates=text(r,"missing_dates");
+        if(dates!=null&&!dates.isBlank())for(String date:dates.split(","))missing.add(LocalDate.parse(date.substring(0,10)));
+        List<String> attention=new ArrayList<>();
+        if(count(r,owner?"no_outbound_count":"no_outbound")>0)attention.add("NO_OUTBOUND_IN_WINDOW");
+        if(count(r,owner?"slow_count":"slow")>0)attention.add("COVERAGE_GT_THRESHOLD");
+        if(decimal(r,"frozen")!=null&&decimal(r,"frozen").signum()>0)attention.add("FROZEN_STOCK");
+        if(decimal(r,"defective")!=null&&decimal(r,"defective").signum()>0)attention.add("DEFECTIVE_STOCK");
+        if(count(r,"unassessable")>0)attention.add("UNASSESSABLE");
+        var sampleReasons=new LinkedHashSet<String>();
+        if(!"VALID".equals(sampleStatus)) {
+            sampleReasons.add(sampleStatus);String historyReasons=text(r,"history_reasons");
+            if(historyReasons!=null&&!historyReasons.isBlank())sampleReasons.addAll(Arrays.asList(historyReasons.split(",")));
+        }
+        String last=text(r,"last_outbound");
+        return new Row(text(r,"customer_code"),text(r,"customer_name"),owner?null:text(r,"sku_code"),owner?null:text(r,"product_name"),physical,available,
+            total(r,"frozen",owner),total(r,"defective",owner),total(r,"transit",owner),owner?decimal(r,"physical_skus"):physical.value()==null?null:physical.value().signum()>0?BigDecimal.ONE:BigDecimal.ZERO,
+            windows,base.averageDailyOutboundQuantity(),coverage,coverageStatus,average,turnover,sampleStatus,sampleCount,q.days(),List.copyOf(missing),
+            List.copyOf(sampleReasons),last==null?null:LocalDate.parse(last.substring(0,10)),List.copyOf(attention),
+            risk(r,"no_outbound",physical,owner,true),risk(r,"slow",physical,owner,q.coverageDaysThreshold()!=null),count(r,"unassessable"),
+            owner?null:decimal(r,"unit_volume"),owner?null:text(r,"dimension_source"),volume(r,"physical"),volumeWindows(r,context.endDate().plusDays(1),q.windows()));
+    }
+    static Overview overview(Map<String,Object> raw,Context context) {
+        var r=normalized(raw);int noUnknown=count(r,"no_outbound_unknown");var noKnown=decimal(r,"no_outbound_count");
+        if(count(r,"sku_count")==0&&!"VALID".equals(context.analyticsContext().inventoryStatus())) {
+            var unknown=new Total(null,null,0,List.of("INVENTORY_UNKNOWN_OR_STALE"));
+            return new Overview(unknown,unknown,new Total(null,null,0,List.of("SALES_OR_STOCK_UNASSESSABLE")),
+                new Total(null,null,0,List.of("SALES_OR_STOCK_UNASSESSABLE")),volume(Map.of(),"physical"),volumeWindows(r,context.endDate().plusDays(1),volumeSizes(context)));
+        }
+        return new Overview(total(r,"physical",true),total(r,"available",true),
+            new Total(noUnknown==0?noKnown:null,noKnown,noUnknown,noUnknown==0?List.of():List.of("SALES_OR_STOCK_UNASSESSABLE")),
+            new Total(decimal(r,"unassessable"),decimal(r,"unassessable"),0,List.of()),volume(r,"physical"),volumeWindows(r,context.endDate().plusDays(1),volumeSizes(context)));
+    }
+    private static List<Integer> volumeSizes(Context context){return java.util.stream.Stream.of(7,15,30,context.baseWindowDays()).distinct().sorted().toList();}
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/InventoryTurnoverQueryService.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/InventoryTurnoverQueryService.java
new file mode 100644
index 000000000..6277fbe8c
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/InventoryTurnoverQueryService.java
@@ -0,0 +1,51 @@
+package com.baiyue.lastleg.selfoperated.analytics.query;
+
+import java.util.*;
+import com.fasterxml.jackson.core.type.TypeReference;
+import com.fasterxml.jackson.databind.DeserializationFeature;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Isolation;
+import org.springframework.transaction.annotation.Transactional;
+import static com.baiyue.lastleg.selfoperated.analytics.query.InventoryTurnoverResponses.*;
+import static com.baiyue.lastleg.selfoperated.analytics.query.InventoryTurnoverPolicy.*;
+
+@Service
+@Transactional(readOnly=true,isolation=Isolation.REPEATABLE_READ)
+public class InventoryTurnoverQueryService {
+    private final InventoryTurnoverContext contexts;
+    private final InventoryTurnoverReadMapper mapper;
+    private final ObjectMapper json;
+    private final SelfopOwnerDirectory ownerDirectory;
+    public InventoryTurnoverQueryService(InventoryTurnoverContext contexts,InventoryTurnoverReadMapper mapper,ObjectMapper json,SelfopOwnerDirectory ownerDirectory){this.contexts=contexts;this.mapper=mapper;this.json=json;this.ownerDirectory=ownerDirectory;}
+    public Response query(InventoryTurnoverRequest request) {
+        var frozen=contexts.resolve(request);var input=InventoryTurnoverSql.input(request,frozen);var context=frozen.response();
+        var names=ownerDirectory.names(request.sourceAccount(),context.queryAsOf());
+        long total=0;boolean hasTotal=false;Overview summary=null;Charts charts=null;
+        List<Row> rows=new ArrayList<>();List<OwnerPhysical> owners=new ArrayList<>();List<OwnerVolume> volumeOwners=new ArrayList<>();int unknown=0,unknownVolume=0;
+        for(var part:mapper.report(input)) {
+            var envelope=normalized(part);Map<String,Object> value;
+            try {
+                value=json.readerFor(new TypeReference<Map<String,Object>>(){}).with(DeserializationFeature.USE_BIG_DECIMAL_FOR_FLOATS)
+                    .readValue(text(envelope,"payload"));
+            } catch(Exception e){throw new IllegalStateException("Invalid turnover query projection",e);}
+            var customerCode=text(value,"customer_code");
+            if(customerCode!=null)value.put("customer_name",names.get(customerCode));
+            switch(text(envelope,"section")) {
+                case "ROW" -> rows.add(row(value,request,context));
+                case "TOTAL" -> {total=decimal(value,"total").longValueExact();hasTotal=true;}
+                case "OVERVIEW" -> summary=overview(value,context);
+                case "OWNER" -> owners.add(new OwnerPhysical(text(value,"customer_code"),text(value,"customer_name"),decimal(value,"physical")));
+                case "OWNER_META" -> unknown=count(value,"unknown_count");
+                case "OWNER_VOLUME" -> volumeOwners.add(new OwnerVolume(text(value,"customer_code"),text(value,"customer_name"),volume(value,"physical")));
+                case "OWNER_VOLUME_META" -> unknownVolume=count(value,"unknown_count");
+                default -> throw new IllegalStateException("Unknown turnover query section");
+            }
+        }
+        if(!hasTotal||request.overview()&&summary==null)throw new IllegalStateException("Missing turnover query section");
+        if(request.overview()) {
+            charts=new Charts(List.copyOf(owners),unknown,List.copyOf(volumeOwners),unknownVolume,windows(normalized(mapper.chartWindows(InventoryTurnoverSql.chartInput(request,frozen))),context.endDate().plusDays(1),request.windows()));
+        }
+        return new Response(context,summary,charts,List.copyOf(rows),total);
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/InventoryTurnoverReadMapper.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/InventoryTurnoverReadMapper.java
new file mode 100644
index 000000000..e15f7a368
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/InventoryTurnoverReadMapper.java
@@ -0,0 +1,42 @@
+package com.baiyue.lastleg.selfoperated.analytics.query;
+
+import java.time.LocalDate;
+import java.time.LocalDateTime;
+import java.util.List;
+import java.util.Map;
+import org.apache.ibatis.annotations.*;
+
+@Mapper
+public interface InventoryTurnoverReadMapper {
+    record DayVersion(LocalDate sampleDate,Long dayVersionId) {}
+    @Select("SELECT "+AnalyticsReadMapper.RUN_COLUMNS+" FROM ll_selfop_sync_run WHERE scope_id=#{scopeId} "
+        +"AND scope_hash=#{scopeHash} AND status='PUBLISHED' AND run_role='WAREHOUSE_SYNC' AND execution_purpose='BUSINESS' "
+        +"AND published_at_utc<=#{asOf} ORDER BY published_at_utc DESC,id DESC LIMIT 1")
+    AnalyticsReadRows.Run versionAt(@Param("scopeId") Long scopeId,@Param("scopeHash") String scopeHash,@Param("asOf") LocalDateTime asOf);
+
+    String HISTORY_WHERE=" source_account=#{account} AND warehouse_code=#{warehouse} AND scope_hash=#{scopeHash,jdbcType=VARCHAR} "
+        +"AND rule_version='FLOW_EOD_V1' AND status IN ('PUBLISHED','SUPERSEDED') AND invalidated_at IS NULL ";
+    @Select("SELECT business_date sample_date,id day_version_id FROM ll_selfop_inventory_day_version WHERE "+HISTORY_WHERE
+        +"AND head_slot=1 AND published_at<=#{asOf} AND business_date>=#{from} AND business_date<#{until} ORDER BY business_date")
+    List<DayVersion> samples(@Param("account") String account,@Param("warehouse") String warehouse,@Param("scopeHash") String scopeHash,
+        @Param("asOf") LocalDateTime asOf,@Param("from") LocalDate from,@Param("until") LocalDate until);
+    @Select("<script>SELECT business_date sample_date,id day_version_id FROM ll_selfop_inventory_day_version WHERE "+HISTORY_WHERE
+        +"AND id IN <foreach collection='ids' item='id' open='(' separator=',' close=')'>#{id}</foreach> ORDER BY business_date</script>")
+    List<DayVersion> fixedSamples(@Param("account") String account,@Param("warehouse") String warehouse,@Param("scopeHash") String scopeHash,@Param("ids") List<Long> ids);
+    @Select("SELECT MIN(business_date) FROM ll_selfop_inventory_day_version WHERE "+HISTORY_WHERE+" AND head_slot=1 AND published_at<=#{asOf}")
+    LocalDate accumulationStartedOn(@Param("account") String account,@Param("warehouse") String warehouse,@Param("scopeHash") String scopeHash,@Param("asOf") LocalDateTime asOf);
+
+    @SelectProvider(type=InventoryTurnoverSql.class,method="page")
+    List<Map<String,Object>> page(@Param("p") InventoryTurnoverSql.Input input);
+    @SelectProvider(type=InventoryTurnoverSql.class,method="count")
+    long count(@Param("p") InventoryTurnoverSql.Input input);
+    @SelectProvider(type=InventoryTurnoverSql.class,method="overview")
+    Map<String,Object> overview(@Param("p") InventoryTurnoverSql.Input input);
+    @SelectProvider(type=InventoryTurnoverSql.class,method="owners")
+    List<Map<String,Object>> owners(@Param("p") InventoryTurnoverSql.Input input);
+    @SelectProvider(type=InventoryTurnoverSql.class,method="chartWindows")
+    Map<String,Object> chartWindows(@Param("p") InventoryTurnoverSql.Input input);
+
+    @SelectProvider(type=InventoryTurnoverSql.class,method="report")
+    List<Map<String,Object>> report(@Param("p") InventoryTurnoverSql.Input input);
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/InventoryTurnoverRequest.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/InventoryTurnoverRequest.java
new file mode 100644
index 000000000..663037d63
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/InventoryTurnoverRequest.java
@@ -0,0 +1,58 @@
+package com.baiyue.lastleg.selfoperated.analytics.query;
+
+import com.baiyue.common.core.exception.BizException;
+import java.time.LocalDate;
+import java.util.Set;
+import org.springframework.format.annotation.DateTimeFormat;
+
+/** Separate from DETAIL: its dates, windows and filters must never be silently mixed. */
+public record InventoryTurnoverRequest(String sourceAccount, String warehouseCode,
+    @DateTimeFormat(iso=DateTimeFormat.ISO.DATE) LocalDate endDate, Integer baseWindowDays,
+    String groupBy, java.util.List<String> customerCodes, String sku, String focus, Integer coverageDaysThreshold,
+    String turnoverStatus, String sortBy, Integer current, Integer size, Boolean includeOverview,
+    String snapshotContext, Boolean hideZeroInventory) {
+    private static final Set<String> PARAMETERS=Set.of("sourceAccount","warehouseCode","endDate","baseWindowDays",
+        "groupBy","customerCodes","sku","focus","coverageDaysThreshold","turnoverStatus","sortBy","current","size","includeOverview","snapshotContext","hideZeroInventory");
+    public static void validateParameters(Set<String> keys) {
+        if(!PARAMETERS.containsAll(keys)) throw new BizException("库存周转不接受其他视图的查询参数");
+    }
+    public boolean hideZero(){return !Boolean.FALSE.equals(hideZeroInventory);}
+    public int days(){return baseWindowDays==null?30:baseWindowDays;}
+    public java.util.List<Integer> windows(){return java.util.stream.Stream.of(7,15,30,days()).distinct().sorted().toList();}
+    public String group(){return groupBy==null?"SKU":groupBy;}
+    public String attention(){return focus==null?"ALL":focus;}
+    public String sort(){return sortBy==null?"PHYSICAL_DESC":sortBy;}
+    public int page(){return current==null?1:current;}
+    public int pageSize(){return size==null?20:size;}
+    public long offset(){return (long)(page()-1)*pageSize();}
+    public boolean overview(){return snapshotContext==null||!Boolean.FALSE.equals(includeOverview);}
+    public LocalDate end(LocalDate today){return endDate==null?today.minusDays(1):endDate;}
+    public void validate(LocalDate today) {
+        AnalyticsQuery.text(sourceAccount,64,"来源账号"); AnalyticsQuery.text(warehouseCode,64,"仓库");
+        if(customerCodes!=null) {
+            if(customerCodes.size()>100) throw new BizException("最多选择100个货主");
+            for(String code:customerCodes) AnalyticsQuery.text(code,64,"货主");
+        }
+        if(sku!=null) AnalyticsQuery.text(sku,128,"SKU");
+        if(days()<1||days()>366) throw new BizException("统计区间须为1至366个完整自然日");
+        if(!end(today).isBefore(today)) throw new BizException("截止日必须是北京时间已结束的日期");
+        if(!Set.of("SKU","OWNER").contains(group())) throw new BizException("分组仅支持SKU或OWNER");
+        if("OWNER".equals(group())&&sku!=null) throw new BizException("货主汇总不接受SKU筛选");
+        if(!Set.of("ALL","NO_OUTBOUND_IN_WINDOW","COVERAGE_GT","COVERAGE_LE","FROZEN","DEFECTIVE","UNASSESSABLE").contains(attention()))
+            throw new BizException("库存关注条件无效");
+        if(coverageDaysThreshold!=null&&coverageDaysThreshold<=0 || attention().startsWith("COVERAGE_")&&coverageDaysThreshold==null)
+            throw new BizException("可售天数阈值须为正整数");
+        if(turnoverStatus!=null&&!"INSUFFICIENT".equals(turnoverStatus)) throw new BizException("周转状态无效");
+        if(!Set.of("PHYSICAL_ASC","PHYSICAL_DESC","AVAILABLE_ASC","AVAILABLE_DESC",
+            "OUTBOUND_7_ASC","OUTBOUND_7_DESC","OUTBOUND_15_ASC","OUTBOUND_15_DESC","OUTBOUND_30_ASC","OUTBOUND_30_DESC",
+            "AVERAGE_DAILY_ASC","AVERAGE_DAILY_DESC","COVERAGE_ASC","COVERAGE_DESC",
+            "TRANSIT_ASC","TRANSIT_DESC","FROZEN_ASC","FROZEN_DESC","DEFECTIVE_ASC","DEFECTIVE_DESC","AVERAGE_PHYSICAL_ASC","AVERAGE_PHYSICAL_DESC",
+            "INVENTORY_VOLUME_ASC","INVENTORY_VOLUME_DESC","OUTBOUND_VOLUME_ASC","OUTBOUND_VOLUME_DESC","UNIT_VOLUME_ASC","UNIT_VOLUME_DESC",
+            "TURNOVER_ASC","TURNOVER_DESC","NO_OUTBOUND_PHYSICAL_DESC").contains(sort())
+            || "OWNER".equals(group())&&(sort().startsWith("COVERAGE_")||sort().startsWith("UNIT_VOLUME_"))
+            || "SKU".equals(group())&&"NO_OUTBOUND_PHYSICAL_DESC".equals(sort())) throw new BizException("排序不适用于当前分组");
+        if(page()<1||pageSize()<1||pageSize()>100) throw new BizException("分页范围为current≥1，size为1至100");
+        if(snapshotContext==null&&page()!=1) throw new BizException("翻页必须携带首屏上下文");
+        if(snapshotContext!=null&&(snapshotContext.isBlank()||snapshotContext.length()>16384)) throw new BizException("查询上下文无效，请整体刷新");
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/InventoryTurnoverResponses.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/InventoryTurnoverResponses.java
new file mode 100644
index 000000000..d46cca56b
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/InventoryTurnoverResponses.java
@@ -0,0 +1,38 @@
+package com.baiyue.lastleg.selfoperated.analytics.query;
+
+import java.math.BigDecimal;
+import java.time.Instant;
+import java.time.LocalDate;
+import java.util.List;
+
+public final class InventoryTurnoverResponses {
+    private InventoryTurnoverResponses() {}
+    public record Window(int days, LocalDate startDate, LocalDate endDateExclusive, BigDecimal outboundQuantity,
+        BigDecimal observedQuantity, BigDecimal averageDailyOutboundQuantity, int completeDayCount,
+        int partialDayCount, int unknownDayCount, String dataStatus, List<String> reasonCodes) {}
+    public record Total(BigDecimal value, BigDecimal knownSubtotal, int unknownSkuCount, List<String> reasonCodes) {}
+    public record Volume(BigDecimal value,BigDecimal knownSubtotal,BigDecimal missingDimensionQuantity,
+        int missingDimensionSkuCount,int unknownQuantitySkuCount,BigDecimal declaredDimensionQuantity,List<String> reasonCodes) {}
+    public record VolumeWindow(int days,LocalDate startDate,LocalDate endDateExclusive,Volume volume) {}
+    public record Risk(BigDecimal matchedSkuCount, BigDecimal knownPhysicalQuantity, int unknownSkuCount, BigDecimal physicalQuantityRatio) {}
+    public record Row(String customerCode,String customerName,String sku,String productName,
+        Total physicalQuantity,Total availableQuantity,Total frozenQuantity,Total defectiveQuantity,Total transitQuantity,
+        BigDecimal physicalSkuCount,List<Window> windows,BigDecimal averageDailyOutboundQuantity,
+        BigDecimal inventoryCoverageDays,String coverageStatus,BigDecimal averagePhysicalQuantity,
+        BigDecimal quantityTurnoverCount,String turnoverStatus,int qualifiedSampleDays,int requiredSampleDays,
+        List<LocalDate> missingSampleDates,List<String> sampleReasonCodes,LocalDate lastObservedOutboundDate,
+        List<String> attentionReasons,Risk noOutboundInWindow,Risk slowCoverage,int unassessableSkuCount,
+        BigDecimal unitVolumeM3,String dimensionSource,Volume inventoryVolumeM3,List<VolumeWindow> outboundVolumesM3) {}
+    public record Sample(LocalDate date,Long dayVersionId) {}
+    public record Context(String snapshotContext,String sourceAccount,String warehouseCode,LocalDate endDate,
+        int baseWindowDays,Instant queryAsOf,Instant queryExpiresAt,AnalyticsResponses.Context analyticsContext,
+        Instant inventoryObservedFrom,Instant inventoryObservedUntil,String sampleRuleVersion,
+        List<Sample> dailySamples,List<LocalDate> missingSampleDates,LocalDate accumulationStartedOn) {}
+    public record Overview(Total physicalQuantity,Total availableQuantity,Total noOutboundSkuCount,Total unassessableSkuCount,
+        Volume inventoryVolumeM3,List<VolumeWindow> outboundVolumesM3) {}
+    public record OwnerPhysical(String customerCode,String customerName,BigDecimal physicalQuantity) {}
+    public record OwnerVolume(String customerCode,String customerName,Volume inventoryVolumeM3) {}
+    public record Charts(List<OwnerPhysical> ownerPhysicalTop,int unknownOwnerCount,List<OwnerVolume> ownerVolumeTop,
+        int unknownVolumeOwnerCount,List<Window> averageDaily) {}
+    public record Response(Context context,Overview summary,Charts charts,List<Row> rows,long total) {}
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/InventoryTurnoverSql.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/InventoryTurnoverSql.java
new file mode 100644
index 000000000..6cc3040d4
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/InventoryTurnoverSql.java
@@ -0,0 +1,305 @@
+package com.baiyue.lastleg.selfoperated.analytics.query;
+
+import java.time.*;
+import java.util.*;
+
+/** Every value is bound. Only validated enums select SQL fragments; no source order/remote API reads. */
+public final class InventoryTurnoverSql {
+    private InventoryTurnoverSql() {}
+    public record Day(LocalDate date,LocalDateTime startUtc,int coverage,Long historyVersionId) {}
+    public record Input(InventoryTurnoverRequest query,long salesRun,long inventoryRun,boolean stockFresh,
+        boolean salesKnown,List<Day> days,LocalDateTime queryAsOf) {
+        public LocalDate until(){return days.get(days.size()-1).date().plusDays(1);}
+        public LocalDate from(){return days.get(0).date();}
+        public LocalDate fromBase(){return baseFrom();}
+        public LocalDate baseFrom(){return until().minusDays(query.days());}
+        public LocalDate from7(){return until().minusDays(7);}
+        public LocalDate from15(){return until().minusDays(15);}
+        public LocalDate from30(){return until().minusDays(30);}
+        public LocalDateTime baseFromUtc(){return baseFrom().atStartOfDay().minusHours(8);}
+        public LocalDateTime fromUtc(){return from().atStartOfDay().minusHours(8);}
+    }
+    static Input input(InventoryTurnoverRequest q,InventoryTurnoverContext.Frozen frozen) {
+        return input(q,frozen,false);
+    }
+    static Input chartInput(InventoryTurnoverRequest q,InventoryTurnoverContext.Frozen frozen) {
+        // Historical charts read only the frozen published sales version. Pending fact merges
+        // cannot erase its coverage; current stock assessments still use the stricter input.
+        return input(q,frozen,true);
+    }
+    private static Input input(InventoryTurnoverRequest q,InventoryTurnoverContext.Frozen frozen,boolean publishedHistory) {
+        var coverage=SalesQueryCoverage.intervals(frozen.snapshot().sales());
+        boolean trusted=frozen.snapshot().sourceKnown()&&(publishedHistory||!frozen.response().analyticsContext().rebuildRequired());
+        var days=frozen.response().dailySamples().stream().map(s->new Day(s.date(),s.date().atStartOfDay().minusHours(8),
+            !trusted?0:SalesQueryCoverage.complete(coverage,s.date(),s.date().plusDays(1))?1:SalesQueryCoverage.at(coverage,s.date())==null?0:2,s.dayVersionId())).toList();
+        return new Input(q,frozen.response().analyticsContext().salesRunId(),frozen.response().analyticsContext().inventoryRunId(),
+            "VALID".equals(frozen.response().analyticsContext().inventoryStatus()),frozen.snapshot().sourceKnown(),days,LocalDateTime.ofInstant(frozen.response().queryAsOf(),ZoneOffset.UTC));
+    }
+    private static String windowStart(int n){return "#{p.from"+(java.util.Set.of(7,15,30).contains(n)?Integer.toString(n):"Base")+"}";}
+    private static String scope(Input p,String alias) {
+        String base=alias+"source_account=#{p.query.sourceAccount} AND "+alias+"warehouse_code=#{p.query.warehouseCode}";
+        var owners=p.query.customerCodes();
+        if(owners==null||owners.isEmpty())return base;
+        var values=new ArrayList<String>();
+        for(int i=0;i<owners.size();i++)values.add("#{p.query.customerCodes["+i+"],jdbcType=VARCHAR}");
+        return base+" AND "+alias+"customer_code IN ("+String.join(",",values)+")";
+    }
+    private static String valid(String field){return "product_quality IN (0,1) AND "+field+" IS NOT NULL AND "+field+">=0 AND (quality_status='VALID' OR quality_reason IN ('FIELD_MISSING','NEGATIVE_QUANTITY'))";}
+    private static String amount(String field){return "CASE WHEN MIN(CASE WHEN "+valid(field)+" THEN 1 ELSE 0 END)=1 THEN SUM("+field+") END";}
+    private static String calendar(Input p) {
+        var parts=new ArrayList<String>();
+        for(int i=0;i<p.days().size();i++) parts.add("SELECT CAST(#{p.days["+i+"].date} AS DATE) business_date,CAST(#{p.days["+i+"].startUtc} AS DATETIME) start_utc,"
+            +"CAST(#{p.days["+i+"].coverage} AS SIGNED) coverage,CAST(#{p.days["+i+"].historyVersionId,jdbcType=BIGINT} AS SIGNED) sample_run");
+        return String.join(" UNION ALL ",parts);
+    }
+    private static String historyVersions(Input p) {
+        // The frozen context already resolved these versions. Bind them directly instead
+        // of repeatedly expanding the 30-day calendar as a membership subquery.
+        var runs=new ArrayList<String>();
+        for(int i=0;i<p.days().size();i++) if(p.days().get(i).historyVersionId()!=null)
+            runs.add("#{p.days["+i+"].historyVersionId,jdbcType=BIGINT}");
+        return runs.isEmpty()?"NULL":String.join(",",runs);
+    }
+    private static String salesDays(Input p) {
+        return "SELECT customer_code,sku_code,business_date,SUM(outbound_quantity) quantity,MIN(CASE WHEN quantity_unit='PCS' AND outbound_quantity>=0 THEN 1 ELSE 0 END) unit_valid FROM ll_selfop_sku_daily_sales WHERE "
+            +scope(p,"")+" AND sales_run_id=#{p.salesRun} AND business_date>=CAST(#{p.from} AS DATE) AND business_date<CAST(#{p.until} AS DATE) GROUP BY customer_code,sku_code,business_date";
+    }
+    private static String cte(Input p) {
+        String stocks="SELECT snapshot_run_id,customer_code,sku_code,"+amount("physical_quantity")+" physical,"
+            +amount("transit_quantity")+" transit,"+amount("frozen_quantity")+" frozen,"+AnalyticsInventorySql.availableQuantity(valid("available_quantity"))+" available,"
+            +"CASE WHEN MIN(CASE WHEN product_quality NOT IN (0,1) OR product_quality IS NULL THEN 0 WHEN product_quality=1 AND NOT ("+valid("physical_quantity")+") THEN 0 ELSE 1 END)=1 "
+            +"THEN SUM(CASE WHEN product_quality=1 THEN physical_quantity ELSE 0 END) END defective "
+            +"FROM ll_selfop_inventory_snapshot WHERE "+scope(p,"")+" AND snapshot_run_id=#{p.inventoryRun} "
+            +"GROUP BY snapshot_run_id,customer_code,sku_code";
+        String profiles="SELECT * FROM ll_selfop_sku_profile WHERE "+scope(p,"")+" AND profile_run_id IN (#{p.salesRun},#{p.inventoryRun})";
+        String history="SELECT d.day_version_id,d.customer_code,d.sku_code,CASE WHEN MIN(CASE WHEN d.quality_status='VALID' AND d.product_quality IN (0,1) AND d.physical_quantity>=0 THEN 1 ELSE 0 END)=1 THEN SUM(d.physical_quantity) END physical,GROUP_CONCAT(DISTINCT d.quality_reason SEPARATOR ',') reason FROM ll_selfop_inventory_daily d JOIN ll_selfop_inventory_day_version v ON v.id=d.day_version_id WHERE v.source_account=#{p.query.sourceAccount} AND v.warehouse_code=#{p.query.warehouseCode} AND v.rule_version='FLOW_EOD_V1' AND v.invalidated_at IS NULL AND "+scope(p,"d.").replace("d.source_account=#{p.query.sourceAccount} AND d.warehouse_code=#{p.query.warehouseCode}","1=1")+" AND d.day_version_id IN ("+historyVersions(p)+") GROUP BY d.day_version_id,d.customer_code,d.sku_code";
+        StringBuilder sql=new StringBuilder("WITH calendar AS (").append(calendar(p)).append("), history AS (").append(history).append("), fixed_profiles AS (").append(profiles)
+            .append("), stocks AS (").append(stocks).append("), sales_days AS (").append(salesDays(p)).append("), candidates AS (")
+            .append("SELECT customer_code,sku_code FROM fixed_profiles UNION SELECT customer_code,sku_code FROM stocks UNION SELECT customer_code,sku_code FROM sales_days UNION SELECT customer_code,sku_code FROM history), profiles AS (")
+            .append("SELECT c.customer_code,c.sku_code,COALESCE(MAX(CASE WHEN f.profile_run_id=#{p.inventoryRun} THEN f.product_name END),MAX(f.product_name)) product_name,")
+            .append("COALESCE(MAX(CASE WHEN f.profile_run_id=#{p.salesRun} THEN CASE WHEN f.quantity_unit='PCS' THEN 1 ELSE 0 END END),MAX(CASE WHEN f.profile_run_id=#{p.inventoryRun} THEN CASE WHEN f.quantity_unit='PCS' THEN 1 ELSE 0 END END),MIN(CASE WHEN f.profile_run_id IS NULL THEN NULL WHEN f.quantity_unit='PCS' THEN 1 ELSE 0 END),CASE WHEN EXISTS (SELECT 1 FROM history h WHERE h.customer_code=c.customer_code AND h.sku_code=c.sku_code AND h.physical IS NOT NULL) THEN 1 ELSE 0 END) unit_valid,")
+            .append("MIN(CASE WHEN f.evidence_run_id IS NOT NULL AND f.evidence_type IN ('VALID_OUTBOUND','INVENTORY_OBSERVATION') THEN f.earliest_evidence_at_utc END) evidence ")
+            .append("FROM candidates c LEFT JOIN fixed_profiles f ON f.customer_code=c.customer_code AND f.sku_code=c.sku_code GROUP BY c.customer_code,c.sku_code)")
+            .append(InventoryVolumeSql.products()).append(skuWindows(p)).append(", last_sales AS (SELECT customer_code,sku_code,MAX(business_date) last_outbound FROM ll_selfop_sku_daily_sales WHERE ")
+            .append(scope(p,"")).append(" AND sales_run_id=#{p.salesRun} AND business_date<CAST(#{p.until} AS DATE) AND outbound_quantity>0 AND quantity_unit='PCS' GROUP BY customer_code,sku_code)");
+        sql.append(", sku_base AS (SELECT c.customer_code,c.sku_code,c.product_name,c.evidence,c.unit_valid,pv.unit_volume,COALESCE(pv.dimension_source,'MISSING') dimension_source");
+        for(int n:p.query().windows()) for(String suffix:List.of("outbound","observed","complete","partial")) sql.append(",w.w").append(n).append('_').append(suffix);
+        sql.append(",w.sample_count,w.sample_total,w.average_physical,w.sample_mask,ls.last_outbound");
+        for(String field:List.of("physical","available","frozen","defective","transit")) sql.append(",CASE WHEN #{p.stockFresh}=1 AND ip.quantity_unit='PCS' THEN st.").append(field).append(" END ").append(field);
+        sql.append(" FROM profiles c JOIN sku_windows w ON w.customer_code=c.customer_code AND w.sku_code=c.sku_code LEFT JOIN last_sales ls ON ls.customer_code=c.customer_code AND ls.sku_code=c.sku_code LEFT JOIN stocks st ON st.snapshot_run_id=#{p.inventoryRun} AND st.customer_code=c.customer_code AND st.sku_code=c.sku_code ")
+            .append("LEFT JOIN product_volumes pv ON pv.customer_code=c.customer_code AND pv.sku_code=c.sku_code LEFT JOIN fixed_profiles ip ON ip.profile_run_id=#{p.inventoryRun} AND ip.customer_code=c.customer_code AND ip.sku_code=c.sku_code), sku_calculated AS (SELECT b.*,")
+            .append("CASE WHEN available=0 THEN 0 WHEN available>0 AND w").append(p.query.days()).append("_outbound>0 THEN available*#{p.query.days}/w").append(p.query.days()).append("_outbound END coverage_days,")
+            .append("CASE WHEN sample_total>0 THEN w").append(p.query.days()).append("_outbound*#{p.query.days}/sample_total END turnover,")
+            .append("CASE WHEN physical=0 THEN 0 WHEN physical>0 AND w"+p.query.days()+"_outbound IS NOT NULL THEN CASE WHEN w"+p.query.days()+"_outbound=0 THEN 1 ELSE 0 END END no_outbound,")
+            .append("CASE WHEN physical IS NULL OR available IS NULL OR w").append(p.query.days()).append("_outbound IS NULL THEN 1 ELSE 0 END unassessable FROM sku_base b), sku_result AS (")
+            .append("SELECT b.*").append(InventoryVolumeSql.sku(p)).append(",CASE WHEN #{p.query.coverageDaysThreshold,jdbcType=INTEGER} IS NULL THEN NULL WHEN physical=0 OR available=0 THEN 0 WHEN coverage_days IS NOT NULL AND available>0 THEN CASE WHEN coverage_days>#{p.query.coverageDaysThreshold,jdbcType=INTEGER} THEN 1 ELSE 0 END WHEN available>0 AND w")
+            .append(p.query.days()).append("_outbound=0 AND unassessable=0 THEN 0 END slow FROM sku_calculated b) ");
+        return sql.toString();
+    }
+    private static String skuWindows(Input p) {
+        // Published warehouse coverage qualifies absent sales dates independently of
+        // SKU observation age. Actual invalid rows below revoke their zero allowance.
+        var sql=new StringBuilder(", window_coverage AS (SELECT ");
+        boolean first=true;
+        for(int n:p.query().windows()) for(String kind:List.of("complete","known","partial")) {
+            String coverage=switch(kind){case "complete"->"coverage=1";case "known"->"coverage>0";default->"coverage=2";};
+            if(!first)sql.append(',');first=false;
+            sql.append("SUM(CASE WHEN business_date>=CAST(#{p.from").append(java.util.Set.of(7,15,30).contains(n)?Integer.toString(n):"Base").append("} AS DATE) AND ").append(coverage)
+                .append(" THEN 1 ELSE 0 END) w").append(n).append('_').append(kind);
+        }
+        sql.append(" FROM calendar), sku_zero_counts AS (SELECT c.customer_code,c.sku_code");
+        for(int n:p.query().windows()) for(String kind:List.of("complete","known","partial"))
+            sql.append(",CASE WHEN c.unit_valid=1").append("complete".equals(kind)?"":" AND #{p.salesKnown}=1")
+                .append(" THEN COALESCE(b.w").append(n).append('_').append(kind).append(",0) ELSE 0 END w").append(n).append('_').append(kind);
+        sql.append(" FROM profiles c CROSS JOIN window_coverage b), actual_sku_days AS (")
+            .append("SELECT s.customer_code,s.sku_code,s.business_date,CASE WHEN #{p.salesKnown}=1 AND c.unit_valid=1 AND s.unit_valid=1 THEN s.quantity END observed,")
+            .append("CASE WHEN d.coverage=1 AND c.unit_valid=1 AND s.unit_valid=1 THEN 1 ELSE 0 END complete,")
+            .append("CASE WHEN d.coverage=1 AND c.unit_valid=1 THEN 1 ELSE 0 END zero_complete,")
+            .append("CASE WHEN #{p.salesKnown}=1 AND c.unit_valid=1 AND d.coverage>0 THEN 1 ELSE 0 END zero_known,")
+            .append("CASE WHEN #{p.salesKnown}=1 AND c.unit_valid=1 AND d.coverage=2 THEN 1 ELSE 0 END zero_partial ")
+            .append("FROM sales_days s JOIN profiles c ON c.customer_code=s.customer_code AND c.sku_code=s.sku_code JOIN calendar d ON d.business_date=s.business_date), sku_actual_counts AS (SELECT customer_code,sku_code");
+        for(int n:p.query().windows()) {
+            String range="business_date>=CAST("+windowStart(n)+" AS DATE)";
+            sql.append(",SUM(CASE WHEN ").append(range).append(" THEN COALESCE(observed,0) ELSE 0 END) w").append(n).append("_sum")
+                .append(",SUM(CASE WHEN ").append(range).append(" THEN complete-zero_complete ELSE 0 END) w").append(n).append("_complete")
+                .append(",SUM(CASE WHEN ").append(range).append(" THEN (CASE WHEN observed IS NOT NULL THEN 1 ELSE 0 END)-zero_known ELSE 0 END) w").append(n).append("_known")
+                .append(",SUM(CASE WHEN ").append(range).append(" THEN (CASE WHEN observed IS NOT NULL AND complete=0 THEN 1 ELSE 0 END)-zero_partial ELSE 0 END) w").append(n).append("_partial");
+        }
+        // Read only actual qualified samples at the frozen date/run. Missing candidates
+        // remain in sku_zero_counts; absence never creates a zero-valued sample.
+        sql.append(" FROM actual_sku_days GROUP BY customer_code,sku_code), sku_sample_days AS (SELECT st.customer_code,st.sku_code,d.business_date,")
+            .append("st.physical sample_physical FROM calendar d JOIN history st ON st.day_version_id=d.sample_run ")
+            .append("WHERE st.physical IS NOT NULL), sku_sample_counts AS (SELECT customer_code,sku_code,")
+            .append("COUNT(CASE WHEN business_date>=CAST(#{p.baseFrom} AS DATE) THEN sample_physical END) sample_count,")
+            // Keep the qualified sum exact; do not divide again by a rounded daily mean.
+            .append("CASE WHEN COUNT(CASE WHEN business_date>=CAST(#{p.baseFrom} AS DATE) THEN sample_physical END)=#{p.query.days} THEN SUM(CASE WHEN business_date>=CAST(#{p.baseFrom} AS DATE) THEN sample_physical END) END sample_total,")
+            .append("CASE WHEN COUNT(CASE WHEN business_date>=CAST(#{p.baseFrom} AS DATE) THEN sample_physical END)=#{p.query.days} THEN SUM(CASE WHEN business_date>=CAST(#{p.baseFrom} AS DATE) THEN sample_physical END)/#{p.query.days} END average_physical,")
+            .append(sampleMask()).append(" sample_mask FROM sku_sample_days GROUP BY customer_code,sku_code), sku_window_counts AS (SELECT z.customer_code,z.sku_code,COALESCE(s.sample_count,0) sample_count,s.sample_total,s.average_physical,COALESCE(s.sample_mask,'') sample_mask");
+        for(int n:p.query().windows()) sql.append(",CASE WHEN z.w").append(n).append("_known+COALESCE(a.w").append(n).append("_known,0)>0 THEN COALESCE(a.w").append(n).append("_sum,0) END w").append(n).append("_observed")
+            .append(",z.w").append(n).append("_complete+COALESCE(a.w").append(n).append("_complete,0) w").append(n).append("_complete")
+            .append(",z.w").append(n).append("_partial+COALESCE(a.w").append(n).append("_partial,0) w").append(n).append("_partial");
+        return sql.append(" FROM sku_zero_counts z LEFT JOIN sku_actual_counts a ON a.customer_code=z.customer_code AND a.sku_code=z.sku_code ")
+            .append("LEFT JOIN sku_sample_counts s ON s.customer_code=z.customer_code AND s.sku_code=z.sku_code), sku_windows AS (SELECT w.*")
+            .append(formalWindows(p)).append(" FROM sku_window_counts w)").toString();
+    }
+    private static String sampleMask() {
+        // Qualified date membership supports the full selected window without numeric bit overflow.
+        return "GROUP_CONCAT(CASE WHEN sample_physical IS NOT NULL THEN CAST(business_date AS CHAR) END ORDER BY business_date SEPARATOR ',')";
+    }
+    private static String pageMissingDates(Input p) {
+        // Only the selected page expands dates. Numeric qualification and filtering
+        // already used every candidate and every frozen sample before pagination.
+        return ", page_missing AS (SELECT r.*, (SELECT GROUP_CONCAT(CAST(business_date AS CHAR) ORDER BY business_date SEPARATOR ',') FROM calendar d "
+            +"WHERE d.business_date>=CAST(#{p.baseFrom} AS DATE) AND LOCATE(CAST(d.business_date AS CHAR),COALESCE(r.sample_mask,''))=0) missing_dates, (SELECT GROUP_CONCAT(DISTINCT h.reason SEPARATOR ',') FROM history h JOIN calendar d ON d.sample_run=h.day_version_id WHERE h.customer_code=r.customer_code "+("SKU".equals(p.query.group())?"AND h.sku_code=r.sku_code ":"")+"AND d.business_date>=CAST(#{p.baseFrom} AS DATE)) history_reasons FROM page_result r)";
+    }
+    private static String windowAggregates(Input p) {
+        StringBuilder sql=new StringBuilder();
+        for(int n:p.query().windows()) {
+            String range="business_date>=CAST("+windowStart(n)+" AS DATE)";
+            sql.append(",SUM(CASE WHEN ").append(range).append(" THEN observed END) w").append(n).append("_observed")
+                .append(",SUM(CASE WHEN ").append(range).append(" THEN complete ELSE 0 END) w").append(n).append("_complete")
+                .append(",SUM(CASE WHEN ").append(range).append(" AND complete=0 AND observed IS NOT NULL THEN 1 ELSE 0 END) w").append(n).append("_partial");
+        }
+        return sql.toString();
+    }
+    private static String formalWindows(Input p) {
+        // Derive formal values once per SKU/owner, reusing the same complete count and
+        // observed sum. A complete all-null observation sum retains the prior zero;
+        // partial/unknown windows remain null and never shorten the denominator.
+        var sql=new StringBuilder();
+        for(int n:p.query().windows()) sql.append(",CASE WHEN w.w").append(n).append("_complete=").append(n)
+            .append(" THEN COALESCE(w.w").append(n).append("_observed,0) END w").append(n).append("_outbound");
+        return sql.toString();
+    }
+    private static String ownerCte(Input p) {
+        // Sales units apply to actual daily records, not profile units/evidence.
+        // The full candidate count distinguishes covered absent rows (known zero)
+        // from a day where every candidate has only an invalid actual record.
+        return ", owner_candidates AS (SELECT customer_code,COUNT(*) candidate_count FROM candidates GROUP BY customer_code), owner_actual_days AS ("
+            +"SELECT customer_code,business_date,COUNT(*) actual_count,SUM(CASE WHEN unit_valid=1 THEN 1 ELSE 0 END) valid_count,"
+            +"SUM(CASE WHEN unit_valid=1 THEN quantity END) observed FROM sales_days GROUP BY customer_code,business_date), owner_sample_days AS ("
+            +"SELECT s.customer_code,s.business_date,SUM(s.sample_physical) sample_physical "
+            +"FROM sku_sample_days s JOIN owner_candidates c ON c.customer_code=s.customer_code GROUP BY s.customer_code,s.business_date HAVING COUNT(*)=MAX(c.candidate_count)), owner_days AS ("
+            +"SELECT c.customer_code,d.business_date,CASE WHEN #{p.salesKnown}=1 AND d.coverage=1 AND COALESCE(a.actual_count-a.valid_count,0)=0 THEN 1 ELSE 0 END complete,"
+            +"CASE WHEN #{p.salesKnown}=1 THEN CASE WHEN a.valid_count>0 THEN a.observed WHEN d.coverage>0 AND c.candidate_count>COALESCE(a.actual_count,0) THEN 0 END END observed,"
+            +"s.sample_physical FROM owner_candidates c CROSS JOIN calendar d LEFT JOIN owner_actual_days a ON a.customer_code=c.customer_code AND a.business_date=d.business_date "
+            +"LEFT JOIN owner_sample_days s ON s.customer_code=c.customer_code AND s.business_date=d.business_date), owner_window_counts AS (SELECT customer_code"
+            +windowAggregates(p)+",COUNT(CASE WHEN business_date>=CAST(#{p.baseFrom} AS DATE) THEN sample_physical END) sample_count,"
+            +"CASE WHEN COUNT(CASE WHEN business_date>=CAST(#{p.baseFrom} AS DATE) THEN sample_physical END)=#{p.query.days} THEN SUM(CASE WHEN business_date>=CAST(#{p.baseFrom} AS DATE) THEN sample_physical END) END sample_total,"
+            +"CASE WHEN COUNT(CASE WHEN business_date>=CAST(#{p.baseFrom} AS DATE) THEN sample_physical END)=#{p.query.days} THEN SUM(CASE WHEN business_date>=CAST(#{p.baseFrom} AS DATE) THEN sample_physical END)/#{p.query.days} END average_physical,"
+            +sampleMask()+" sample_mask FROM owner_days GROUP BY customer_code), owner_windows AS (SELECT w.*"+formalWindows(p)+" FROM owner_window_counts w), owner_totals AS ("
+            +totals(p,"customer_code",true)+" FROM sku_result GROUP BY customer_code), owner_result AS (SELECT t.*,w.sample_count,w.average_physical,w.sample_mask,"
+            +"CASE WHEN w.sample_total>0 THEN w.w"+p.query.days()+"_outbound*#{p.query.days}/w.sample_total END turnover,"
+            +String.join(",",p.query().windows().stream().flatMap(n->List.of("outbound","observed","complete","partial").stream().map(s->"w.w"+n+"_"+s)).toList())
+            +" FROM owner_totals t JOIN owner_windows w ON w.customer_code=t.customer_code) ";
+    }
+    private static String totals(Input p,String key,boolean withFocus) {
+        var sql=new StringBuilder("SELECT ").append(key==null?"COUNT(*) sku_count":key);
+        for(String field:List.of("physical","available","frozen","defective","transit")) sql.append(",CASE WHEN COUNT(").append(field).append(")=COUNT(*) THEN COALESCE(SUM(").append(field).append("),0) END ").append(field)
+            .append(",CASE WHEN COUNT(*)=0 THEN 0 ELSE SUM(").append(field).append(") END ").append(field).append("_known,COUNT(*)-COUNT(").append(field).append(") ").append(field).append("_unknown");
+        sql.append(",MAX(last_outbound) last_outbound,CASE WHEN COUNT(physical)=COUNT(*) THEN SUM(CASE WHEN physical>0 THEN 1 ELSE 0 END) END physical_skus,COALESCE(SUM(unassessable),0) unassessable");
+        for(String risk:List.of("no_outbound","slow")) sql.append(",COALESCE(SUM(CASE WHEN ").append(risk).append("=1 THEN 1 ELSE 0 END),0) ").append(risk).append("_count,COALESCE(SUM(CASE WHEN ").append(risk).append("=1 THEN physical ELSE 0 END),0) ").append(risk).append("_physical,COUNT(*)-COUNT(").append(risk).append(") ").append(risk).append("_unknown");
+        sql.append(InventoryVolumeSql.totals(p));
+        if(withFocus)sql.append(",MAX(CASE WHEN available>0 AND coverage_days IS NOT NULL AND coverage_days<=#{p.query.coverageDaysThreshold,jdbcType=INTEGER} THEN 1 ELSE 0 END) fast_count,MAX(CASE WHEN frozen>0 THEN 1 ELSE 0 END) frozen_count,MAX(CASE WHEN defective>0 THEN 1 ELSE 0 END) defective_count");
+        return sql.toString();
+    }
+    private static String filter(Input p,boolean owner) {
+        String predicate=switch(p.query.attention()) {
+            case "NO_OUTBOUND_IN_WINDOW" -> owner?"no_outbound_count>0":"no_outbound=1";
+            case "COVERAGE_GT" -> owner?"slow_count>0":"slow=1";
+            case "COVERAGE_LE" -> owner?"fast_count>0":"available>0 AND coverage_days IS NOT NULL AND coverage_days<=#{p.query.coverageDaysThreshold}";
+            case "FROZEN" -> owner?"frozen_count>0":"frozen>0";
+            case "DEFECTIVE" -> owner?"defective_count>0":"defective>0";
+            case "UNASSESSABLE" -> "unassessable>0";
+            default -> "1=1";
+        };
+        if(p.query.hideZero()) predicate+=" AND (physical IS NULL OR physical<>0)";
+        if(p.query.turnoverStatus()!=null) predicate+=" AND sample_count<#{p.query.days}";
+        if(!owner&&p.query.sku()!=null) predicate+=" AND sku_code=#{p.query.sku}";
+        return " WHERE "+predicate;
+    }
+    private static String order(Input p,boolean owner) {
+        String field=switch(p.query.sort()) {
+            case "INVENTORY_VOLUME_ASC","INVENTORY_VOLUME_DESC" -> "physical_volume";
+            case "OUTBOUND_VOLUME_ASC","OUTBOUND_VOLUME_DESC" -> "w"+p.query.days()+"_outbound_volume";
+            case "UNIT_VOLUME_ASC","UNIT_VOLUME_DESC" -> "unit_volume";
+            case "PHYSICAL_ASC","PHYSICAL_DESC" -> "physical";
+            case "AVAILABLE_ASC","AVAILABLE_DESC" -> "available";
+            case "OUTBOUND_7_ASC","OUTBOUND_7_DESC" -> "w7_outbound";
+            case "OUTBOUND_15_ASC","OUTBOUND_15_DESC" -> "w15_outbound";
+            case "OUTBOUND_30_ASC","OUTBOUND_30_DESC" -> "w30_outbound";
+            // The denominator is constant for the whole query; use the unrounded numerator.
+            case "AVERAGE_DAILY_ASC","AVERAGE_DAILY_DESC" -> "w"+p.query.days()+"_outbound";
+            case "COVERAGE_ASC","COVERAGE_DESC" -> "coverage_days";
+            case "TRANSIT_ASC","TRANSIT_DESC" -> "transit";
+            case "FROZEN_ASC","FROZEN_DESC" -> "frozen";
+            case "DEFECTIVE_ASC","DEFECTIVE_DESC" -> "defective";
+            case "AVERAGE_PHYSICAL_ASC","AVERAGE_PHYSICAL_DESC" -> "average_physical";
+            case "TURNOVER_ASC","TURNOVER_DESC" -> "turnover";
+            case "NO_OUTBOUND_PHYSICAL_DESC" -> "no_outbound_physical";
+            default -> throw new IllegalArgumentException("Unsupported turnover sort");
+        };
+        return " ORDER BY "+field+" IS NULL,"+field+(p.query.sort().endsWith("_ASC")?" ASC":" DESC")+(owner?",customer_code":",sku_code,customer_code");
+    }
+    public static String page(Map<String,Object> args) {
+        Input p=(Input)args.get("p");boolean owner="OWNER".equals(p.query.group());
+        return cte(p)+(owner?ownerCte(p):"")+", page_result AS (SELECT * FROM "+(owner?"owner_result":"sku_result")+filter(p,owner)+order(p,owner)+" LIMIT #{p.query.pageSize} OFFSET #{p.query.offset})"+pageMissingDates(p)+" SELECT * FROM page_missing"+order(p,owner);
+    }
+    public static String count(Map<String,Object> args) {
+        Input p=(Input)args.get("p");boolean owner="OWNER".equals(p.query.group());
+        return cte(p)+(owner?ownerCte(p):"")+"SELECT COUNT(*) FROM "+(owner?"owner_result":"sku_result")+filter(p,owner);
+    }
+    public static String overview(Map<String,Object> args) {
+        Input p=(Input)args.get("p");return cte(p)+totals(p,null,false)+" FROM sku_result";
+    }
+    public static String owners(Map<String,Object> args) {
+        Input p=(Input)args.get("p");return cte(p)+ownerCte(p)
+            +", ranked_owners AS (SELECT customer_code,physical FROM owner_result WHERE physical IS NOT NULL ORDER BY physical DESC,customer_code LIMIT 10) "
+            +"SELECT 'OWNER' kind,customer_code,physical,0 unknown_count FROM ranked_owners UNION ALL SELECT 'META' kind,NULL customer_code,NULL physical,COUNT(*) unknown_count FROM owner_result WHERE physical IS NULL ORDER BY kind DESC,physical DESC,customer_code";
+    }
+    public static String chartWindows(Map<String,Object> args) {
+        Input p=(Input)args.get("p");return "WITH calendar AS ("+calendar(p)+"), sales_days AS ("+salesDays(p)+"), warehouse_days AS (SELECT d.business_date,"
+            +"CASE WHEN #{p.salesKnown}=1 AND d.coverage=1 AND MIN(COALESCE(s.unit_valid,1))=1 THEN 1 ELSE 0 END complete,"
+            +"CASE WHEN #{p.salesKnown}=1 THEN CASE WHEN COUNT(s.business_date)=0 AND d.coverage>0 THEN 0 ELSE SUM(CASE WHEN s.unit_valid=1 THEN s.quantity END) END END observed "
+            +"FROM calendar d LEFT JOIN sales_days s ON s.business_date=d.business_date GROUP BY d.business_date,d.coverage), warehouse_window_counts AS (SELECT COUNT(*) day_count"+windowAggregates(p)+" FROM warehouse_days) SELECT w.*"+formalWindows(p)+" FROM warehouse_window_counts w";
+    }
+    private static String jsonFields(List<String> fields) {
+        return "JSON_OBJECT("+String.join(",",fields.stream().map(f->"'"+f+"',"+f).toList())+")";
+    }
+    /** One statement shares the materialized stock/day/window relations across all first-page sections. */
+    public static String report(Map<String,Object> args) {
+        Input p=(Input)args.get("p");boolean owner="OWNER".equals(p.query.group()),overview=p.query.overview();
+        String source=owner?"owner_result":"sku_result";
+        List<String> fields=new ArrayList<>(List.of("customer_code","physical","available","frozen","defective","transit","sample_count","average_physical","missing_dates","history_reasons","last_outbound","turnover","unassessable"));
+        for(int n:p.query().windows())for(String suffix:List.of("outbound","observed","complete","partial"))fields.add("w"+n+"_"+suffix);
+        fields.addAll(InventoryVolumeSql.fields(p));
+        if(owner) {
+            fields.add("physical_skus");
+            for(String field:List.of("physical","available","frozen","defective","transit"))for(String suffix:List.of("known","unknown"))fields.add(field+"_"+suffix);
+            for(String risk:List.of("no_outbound","slow"))for(String suffix:List.of("count","physical","unknown"))fields.add(risk+"_"+suffix);
+        } else fields.addAll(List.of("sku_code","product_name","coverage_days","no_outbound","slow","unit_volume","dimension_source"));
+        // Stock charts share owner totals, independently of list filters and pagination.
+        String sql=cte(p)+(owner?ownerCte(p):overview?", owner_totals AS ("+totals(p,"customer_code",true)+" FROM sku_result GROUP BY customer_code) ":"")
+            +", page_result AS (SELECT r.*,ROW_NUMBER() OVER ("+order(p,owner)+") ordinal FROM "+source+" r"+filter(p,owner)+order(p,owner)+" LIMIT #{p.query.pageSize} OFFSET #{p.query.offset})";
+        sql+=pageMissingDates(p);
+        if(overview)sql+=", summary_result AS ("+totals(p,null,false)+" FROM sku_result), top_owners AS (SELECT customer_code,physical,ROW_NUMBER() OVER (ORDER BY physical DESC,customer_code) ordinal FROM owner_totals WHERE physical IS NOT NULL ORDER BY physical DESC,customer_code LIMIT 10)"
+            +", top_volume_owners AS (SELECT t.*,ROW_NUMBER() OVER (ORDER BY physical_volume DESC,customer_code) ordinal FROM owner_totals t WHERE physical_volume IS NOT NULL ORDER BY physical_volume DESC,customer_code LIMIT 10)";
+        // Statement-local only: share intermediate relations across report branches;
+        // do not change connection/global settings or any result/filter semantics.
+        sql+=" SELECT /*+ SET_VAR(group_concat_max_len=16384) SET_VAR(optimizer_switch='derived_merge=off') SET_VAR(optimizer_search_depth=4) */ 'ROW' section,ordinal,"+jsonFields(fields)+" payload FROM page_missing"
+            +" UNION ALL SELECT 'TOTAL' section,0 ordinal,JSON_OBJECT('total',COUNT(*)) payload FROM "+source+filter(p,owner);
+        if(overview) {
+            List<String> ownerVolumeFields=new ArrayList<>(List.of("customer_code"));
+            InventoryVolumeSql.SUFFIXES.forEach(suffix->ownerVolumeFields.add("physical_"+suffix));
+            List<String> summary=new ArrayList<>(List.of("sku_count","unassessable","no_outbound_count","no_outbound_unknown"));
+            summary.addAll(InventoryVolumeSql.fields(p));
+            for(String field:List.of("physical","available")){summary.add(field);summary.add(field+"_known");summary.add(field+"_unknown");}
+            sql+=" UNION ALL SELECT 'OVERVIEW' section,0 ordinal,"+jsonFields(summary)+" payload FROM summary_result"
+                +" UNION ALL SELECT 'OWNER' section,ordinal,JSON_OBJECT('customer_code',customer_code,'physical',physical) payload FROM top_owners"
+                +" UNION ALL SELECT 'OWNER_META' section,0 ordinal,JSON_OBJECT('unknown_count',COUNT(*)) payload FROM owner_totals WHERE physical IS NULL"
+                +" UNION ALL SELECT 'OWNER_VOLUME' section,ordinal,"+jsonFields(ownerVolumeFields)+" payload FROM top_volume_owners"
+                +" UNION ALL SELECT 'OWNER_VOLUME_META' section,0 ordinal,JSON_OBJECT('unknown_count',COUNT(*)) payload FROM owner_totals WHERE physical_volume IS NULL";
+        }
+        return sql+" ORDER BY section,ordinal";
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/InventoryVolumeSql.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/InventoryVolumeSql.java
new file mode 100644
index 000000000..83d105483
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/InventoryVolumeSql.java
@@ -0,0 +1,64 @@
+package com.baiyue.lastleg.selfoperated.analytics.query;
+
+import java.util.ArrayList;
+import java.util.List;
+
+/** Volumes use a complete dimension triplet from the master-data version visible at queryAsOf. */
+final class InventoryVolumeSql {
+    private InventoryVolumeSql() {}
+    private static String cube(String prefix) {
+        return "CASE WHEN " + prefix + "_length>0 AND " + prefix + "_width>0 AND " + prefix + "_height>0 THEN "
+            + prefix + "_length*" + prefix + "_width*" + prefix + "_height*CASE LOWER(TRIM(" + prefix + "_size_unit))"
+            + " WHEN 'mm' THEN 0.000000001 WHEN 'cm' THEN 0.000001 WHEN 'm' THEN 1"
+            + " WHEN 'in' THEN 0.000016387064 WHEN 'ft' THEN 0.028316846592 END END";
+    }
+    static String products() {
+        return ", volume_master AS (SELECT r.id FROM ll_selfop_sync_run r JOIN ll_selfop_sync_task t ON t.id=r.task_id"
+            + " WHERE r.source_account=#{p.query.sourceAccount} AND t.source_account=#{p.query.sourceAccount}"
+            + " AND t.task_type='MASTER_DATA' AND t.task_role='ACCOUNT_DISCOVERY'"
+            + " AND r.execution_purpose='BUSINESS' AND t.execution_purpose='BUSINESS'"
+            + " AND r.status='PUBLISHED' AND r.coverage_status='COMPLETE' AND r.published_at_utc<=#{p.queryAsOf}"
+            + " ORDER BY r.published_at_utc DESC,r.id DESC LIMIT 1), product_cubes AS ("
+            + "SELECT customer_code,sku_code," + cube("measured") + " measured_cube," + cube("declared") + " declared_cube"
+            + " FROM ll_selfop_product WHERE source_account=#{p.query.sourceAccount} AND run_id=(SELECT id FROM volume_master)),"
+            + " product_volumes AS (SELECT customer_code,sku_code,COALESCE(measured_cube,declared_cube) unit_volume,"
+            + "CASE WHEN measured_cube IS NOT NULL THEN 'WAREHOUSE_MEASURED' WHEN declared_cube IS NOT NULL THEN 'PRODUCT_DECLARED' ELSE 'MISSING' END dimension_source FROM product_cubes)";
+    }
+    static List<String> quantities(InventoryTurnoverSql.Input p) {
+        var fields=new ArrayList<String>();fields.add("physical");
+        p.query().windows().forEach(n->fields.add("w"+n+"_outbound"));return fields;
+    }
+    static final List<String> SUFFIXES=List.of("volume","volume_known","missing_dimension_quantity","missing_dimension_skus","unknown_quantity_skus","estimated_quantity");
+    static List<String> fields(InventoryTurnoverSql.Input p) {
+        return quantities(p).stream().flatMap(q->SUFFIXES.stream().map(s->q+"_"+s)).toList();
+    }
+    static String sku(InventoryTurnoverSql.Input p) {
+        var sql=new StringBuilder();
+        for(var q:quantities(p)) {
+            String volume="CASE WHEN "+q+"=0 THEN 0 WHEN "+q+">0 THEN "+q+"*unit_volume END";
+            sql.append(',').append(volume).append(' ').append(q).append("_volume")
+                .append(',').append(volume).append(' ').append(q).append("_volume_known")
+                .append(",CASE WHEN ").append(q).append(">0 AND unit_volume IS NULL THEN ").append(q).append(" ELSE 0 END ").append(q).append("_missing_dimension_quantity")
+                .append(",CASE WHEN ").append(q).append(">0 AND unit_volume IS NULL THEN 1 ELSE 0 END ").append(q).append("_missing_dimension_skus")
+                .append(",CASE WHEN ").append(q).append(" IS NULL THEN 1 ELSE 0 END ").append(q).append("_unknown_quantity_skus")
+                .append(",CASE WHEN ").append(q).append(">0 AND dimension_source='PRODUCT_DECLARED' THEN ").append(q).append(" ELSE 0 END ").append(q).append("_estimated_quantity");
+        }
+        return sql.toString();
+    }
+    static String totals(InventoryTurnoverSql.Input p) {
+        var sql=new StringBuilder();
+        for(var q:quantities(p)) {
+            String emptyKnown;
+            if(q.equals("physical"))emptyKnown="#{p.stockFresh}=1";
+            else {
+                int n=Integer.parseInt(q.substring(1,q.indexOf('_')));
+                String from="#{p.from"+(java.util.Set.of(7,15,30).contains(n)?Integer.toString(n):"Base")+"}";
+                emptyKnown="#{p.salesKnown}=1 AND (SELECT COUNT(*) FROM calendar WHERE business_date>=CAST("+from+" AS DATE) AND coverage=1)="+n;
+            }
+            sql.append(",CASE WHEN COUNT(*)=0 THEN CASE WHEN ").append(emptyKnown).append(" THEN 0 END WHEN COUNT(").append(q).append("_volume)=COUNT(*) THEN SUM(").append(q).append("_volume) END ").append(q).append("_volume")
+                .append(",CASE WHEN COUNT(*)=0 THEN CASE WHEN ").append(emptyKnown).append(" THEN 0 END ELSE SUM(").append(q).append("_volume) END ").append(q).append("_volume_known");
+            for(var suffix:SUFFIXES.subList(2,SUFFIXES.size()))sql.append(",COALESCE(SUM(").append(q).append('_').append(suffix).append("),0) ").append(q).append('_').append(suffix);
+        }
+        return sql.toString();
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/InventoryWindowPolicy.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/InventoryWindowPolicy.java
new file mode 100644
index 000000000..080783fee
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/InventoryWindowPolicy.java
@@ -0,0 +1,38 @@
+package com.baiyue.lastleg.selfoperated.analytics.query;
+
+import com.baiyue.common.core.exception.BizException;
+import com.baiyue.lastleg.selfoperated.analytics.statistics.SalesRangePolicy;
+import java.math.BigDecimal;
+import java.math.RoundingMode;
+import java.time.LocalDate;
+import java.time.ZoneId;
+
+/** Inventory-only complete natural-day window; dashboard drilldowns resolve their explicit selected dates separately. */
+final class InventoryWindowPolicy {
+    private InventoryWindowPolicy() {}
+    static SalesRangePolicy.Range range(AnalyticsInventoryOptions o,LocalDate anchor) {
+        int days=o.salesDays();
+        if(days<1||days>366)throw new BizException("库存销量窗口须为1至366个完整自然日");
+        LocalDate end=o.salesWindowEndDate()==null?anchor.minusDays(1):o.salesWindowEndDate();
+        if(!end.isBefore(anchor))throw new BizException("库存销量截止日必须早于查询当日");
+        LocalDate until=end.plusDays(1),from=until.minusDays(days);var zone=ZoneId.of("Asia/Shanghai");
+        return new SalesRangePolicy.Range(anchor,from,until,days,from.atStartOfDay(zone).toInstant(),until.atStartOfDay(zone).toInstant());
+    }
+    record Result(BigDecimal average,BigDecimal days,String status) {}
+    static Result calculate(String quality,BigDecimal available,BigDecimal sales,boolean trusted,
+        boolean complete,boolean unit,int days) {
+        if(days<1||days>366)throw new IllegalArgumentException("Inventory window must be 1 to 366 days");
+        if(!"VALID".equals(quality)||available==null)return new Result(null,null,"INVENTORY_"+quality);
+        if(available.signum()<0)return new Result(null,null,"INVENTORY_INVALID");
+        BigDecimal divisor=BigDecimal.valueOf(days);
+        BigDecimal average=unit&&trusted&&complete&&sales!=null&&sales.signum()>=0
+            ?sales.divide(divisor,12,RoundingMode.HALF_UP):null;
+        if(available.signum()==0)return new Result(average,BigDecimal.ZERO.setScale(1),"NO_AVAILABLE_INVENTORY");
+        if(!unit)return new Result(null,null,"UNIT_UNKNOWN_OR_CONFLICT");
+        if(!trusted)return new Result(null,null,"SALES_UNTRUSTED");
+        if(!complete)return new Result(null,null,"COVERAGE_INSUFFICIENT");
+        if(sales==null||sales.signum()<0)return new Result(null,null,"SALES_UNKNOWN");
+        if(sales.signum()==0)return new Result(average,null,"NO_OUTBOUND_IN_WINDOW");
+        return new Result(average,available.multiply(divisor).divide(sales,1,RoundingMode.HALF_UP),"VALID");
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/SalesQueryCoverage.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/SalesQueryCoverage.java
new file mode 100644
index 000000000..763feb99d
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/SalesQueryCoverage.java
@@ -0,0 +1,33 @@
+package com.baiyue.lastleg.selfoperated.analytics.query;
+
+import com.baiyue.lastleg.selfoperated.analytics.model.*;
+import java.time.*;
+import java.util.*;
+
+/** Reads only immutable evidence already stored in the selected published run. */
+public final class SalesQueryCoverage {
+    private SalesQueryCoverage() { }
+    public static List<SelfopSalesCoverage.Interval> intervals(AnalyticsReadRows.Run selected){
+        if(selected==null)return List.of();
+        var run=new SelfopSyncRun();run.setId(selected.id());run.setScopeId(selected.scopeId());run.setScopeHash(selected.scopeHash());run.setScopeSnapshotJson(selected.scopeSnapshotJson());
+        var evidence=SelfopSalesCoverage.evidence(run);
+        if(evidence!=null)return evidence.intervals();
+        // The existing scalar is itself a frozen continuous proof; never extend it from live tasks.
+        return scalar(selected.coveredFromUtc(),selected.coveredUntilUtc());
+    }
+    public static List<SelfopSalesCoverage.Interval> scalar(LocalDateTime from,LocalDateTime until){
+        return from!=null&&until!=null&&from.isBefore(until)?List.of(new SelfopSalesCoverage.Interval(from,until)):List.of();
+    }
+    public static SelfopSalesCoverage.Interval at(List<SelfopSalesCoverage.Interval> intervals,LocalDate date){
+        var start=date.atStartOfDay().minusHours(8);var end=start.plusDays(1);
+        return intervals.stream().filter(i->i.from().isBefore(end)&&i.until().isAfter(start)).findFirst().orElse(null);
+    }
+    public static boolean complete(List<SelfopSalesCoverage.Interval> intervals,LocalDate from,LocalDate until){
+        var start=from.atStartOfDay().minusHours(8);var end=until.atStartOfDay().minusHours(8);
+        return start.isBefore(end)&&intervals.stream().anyMatch(i->!i.from().isAfter(start)&&!i.until().isBefore(end));
+    }
+    public static LocalDate fullFrom(SelfopSalesCoverage.Interval i){
+        if(i==null)return null;var local=i.from().plusHours(8);return local.toLocalTime().equals(LocalTime.MIDNIGHT)?local.toLocalDate():local.toLocalDate().plusDays(1);
+    }
+    public static LocalDate fullUntil(SelfopSalesCoverage.Interval i){return i==null?null:i.until().plusHours(8).toLocalDate();}
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/SalesSort.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/SalesSort.java
new file mode 100644
index 000000000..267b1a636
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/SalesSort.java
@@ -0,0 +1,9 @@
+package com.baiyue.lastleg.selfoperated.analytics.query;
+
+/** Whitelisted global quantity ordering; unknown quantities always follow known values. */
+public enum SalesSort {
+    QUANTITY_ASC, QUANTITY_DESC;
+    public String sql(String column) {
+        return column + " IS NULL," + column + (this == QUANTITY_ASC ? " ASC" : " DESC") + ",sku_code ASC,customer_code ASC";
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/SelfopOwnerDirectory.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/SelfopOwnerDirectory.java
new file mode 100644
index 000000000..b051775a3
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/SelfopOwnerDirectory.java
@@ -0,0 +1,20 @@
+package com.baiyue.lastleg.selfoperated.analytics.query;
+
+import com.baiyue.lastleg.selfoperated.analytics.mapper.SelfopMasterDataMapper;
+import org.springframework.stereotype.Service;
+import java.time.*;
+import java.util.*;
+
+/** Names are read from the last complete master-data batch visible at the query's fixed time. */
+@Service
+public class SelfopOwnerDirectory {
+    private final SelfopMasterDataMapper mapper;
+    public SelfopOwnerDirectory(SelfopMasterDataMapper mapper){this.mapper=mapper;}
+    public Map<String,String> names(String account,Instant asOf) {
+        Long run=mapper.publishedAt(account,LocalDateTime.ofInstant(asOf,ZoneOffset.UTC));
+        if(run==null)return Map.of();
+        var result=new LinkedHashMap<String,String>();
+        for(var owner:mapper.owners(account,run))result.put(owner.customerCode(),owner.customerName()==null||owner.customerName().isBlank()?null:owner.customerName());
+        return Collections.unmodifiableMap(result);
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/TurnoverExportReasons.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/TurnoverExportReasons.java
new file mode 100644
index 000000000..f14d039fe
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/TurnoverExportReasons.java
@@ -0,0 +1,154 @@
+package com.baiyue.lastleg.selfoperated.analytics.query;
+
+import java.util.Map;
+
+/** Business explanations retained in server-generated spreadsheets. */
+final class TurnoverExportReasons {
+    private TurnoverExportReasons() {}
+    static final Map<String,String> LABELS = Map.ofEntries(
+        Map.entry("COMPLETE","完整"),
+        Map.entry("PARTIAL","未完整"),
+        Map.entry("UNKNOWN","未知"),
+        Map.entry("QUEUED","排队中"),
+        Map.entry("RUNNING","执行中"),
+        Map.entry("WAITING","等待中"),
+        Map.entry("WAITING_UPSTREAM","等待上游"),
+        Map.entry("WAITING_SOURCE","等待来源数据"),
+        Map.entry("RETRY_WAIT","待重试"),
+        Map.entry("YIELDED","预算等待"),
+        Map.entry("FAILED","失败"),
+        Map.entry("DEAD","待处理"),
+        Map.entry("SUCCEEDED","执行成功"),
+        Map.entry("ROUTED","账号共享采集完成"),
+        Map.entry("SAMPLE_DONE","测试样本结束"),
+        Map.entry("PUBLISHED","已发布"),
+        Map.entry("REUSED","沿用已有结果"),
+        Map.entry("NOT_PUBLISHED","未发布"),
+        Map.entry("PENDING","待处理"),
+        Map.entry("BLOCKED","修订阻断"),
+        Map.entry("OFF","关闭"),
+        Map.entry("VALIDATION","验证采样"),
+        Map.entry("BUSINESS","正式采集"),
+        Map.entry("FRESH","有效"),
+        Map.entry("STALE","过期"),
+        Map.entry("INVALID","异常"),
+        Map.entry("OBSERVING","观察中"),
+        Map.entry("HEALTHY","正常"),
+        Map.entry("STALE_HEARTBEAT","心跳过期，执行状态待确认"),
+        Map.entry("UNCONFIRMED","执行状态待确认"),
+        Map.entry("TERMINATED","尝试已结束"),
+        Map.entry("ABORTED","已停止"),
+        Map.entry("NOT_STARTED","尚未开始"),
+        Map.entry("FETCHING","采集中"),
+        Map.entry("FETCHED","采集完成"),
+        Map.entry("VALIDATING","校验中"),
+        Map.entry("BUILDING","计算中"),
+        Map.entry("READY","待发布"),
+        Map.entry("INITIALIZING","首采中"),
+        Map.entry("COVERED","覆盖完整"),
+        Map.entry("ACCOUNT_DISCOVERY","账号共享出库目录"),
+        Map.entry("WAREHOUSE_SYNC","本仓采集"),
+        Map.entry("VALID","有效"),
+        Map.entry("CURRENT","已核对"),
+        Map.entry("LAGGING","核对滞后"),
+        Map.entry("MISSING","尚无可用数据"),
+        Map.entry("UNCOVERED","覆盖不足"),
+        Map.entry("INCOMPLETE","未完整"),
+        Map.entry("REBUILD_REQUIRED","销量待重新统计发布"),
+        Map.entry("NO_AVAILABLE_INVENTORY","无可售库存"),
+        Map.entry("UNIT_UNKNOWN_OR_CONFLICT","数量单位未知或不一致"),
+        Map.entry("SALES_UNTRUSTED","销量待核对"),
+        Map.entry("COVERAGE_INSUFFICIENT","覆盖不足"),
+        Map.entry("OBSERVATION_INSUFFICIENT","观察期不足"),
+        Map.entry("SALES_UNKNOWN","销量未知"),
+        Map.entry("NO_OUTBOUND_IN_WINDOW","所选窗口无出库"),
+        Map.entry("NO_OUTBOUND_30_DAYS","近30天无出库"),
+        Map.entry("INVENTORY_INVALID","库存异常"),
+        Map.entry("INVENTORY_STALE","库存快照过期"),
+        Map.entry("INVENTORY_UNKNOWN","库存未知"),
+        Map.entry("UNASSESSABLE_SKUS","存在待评估SKU"),
+        Map.entry("INVENTORY_UNAVAILABLE","库存资料不可用"),
+        Map.entry("SALES_UNAVAILABLE","销量资料不可用"),
+        Map.entry("PHYSICAL_INVENTORY_UNKNOWN","实物库存待核验"),
+        Map.entry("AVAILABLE_INVENTORY_UNKNOWN","可售库存待核验"),
+        Map.entry("SALES_QUANTITY_OR_UNIT_INVALID","出库数量或单位异常"),
+        Map.entry("NO_ELIGIBLE_SKUS","暂无符合条件的SKU"),
+        Map.entry("NO_OUTBOUND_30D","近30天无出库"),
+        Map.entry("COVERAGE_GT_THRESHOLD","可售天数超过本次阈值"),
+        Map.entry("FROZEN_STOCK","存在冻结库存"),
+        Map.entry("DEFECTIVE_STOCK","存在次品实物库存"),
+        Map.entry("UNASSESSABLE","数据不足／待观察"),
+        Map.entry("THRESHOLD_NOT_SET","未设置查询阈值"),
+        Map.entry("NO_PHYSICAL_INVENTORY","无实物库存"),
+        Map.entry("METRIC_DEPENDENCY_UNKNOWN","该指标依赖资料未知"),
+        Map.entry("SALES_WINDOW_UNAVAILABLE","同期完整销量不足"),
+        Map.entry("SALES_WINDOW_INCOMPLETE","所选时段销量尚未采齐"),
+        Map.entry("RISK_DEPENDENCY_UNKNOWN","部分SKU关注判断未知"),
+        Map.entry("NO_OUTBOUND_IN_COLLECTED_HISTORY","已采集历史内未见出库"),
+        Map.entry("SALES_NOT_COVERED","销量未覆盖"),
+        Map.entry("SKU_HISTORY_UNKNOWN","SKU历史未知"),
+        Map.entry("QUANTITY_UNIT_UNKNOWN","数量单位未知"),
+        Map.entry("INVENTORY_NOT_PUBLISHED","库存尚未发布"),
+        Map.entry("SALES_NOT_PUBLISHED","销量尚未发布"),
+        Map.entry("OBSERVATION_INCOMPLETE","观察期不足"),
+        Map.entry("SCOPE_CHANGED","配置范围已变化"),
+        Map.entry("UPSTREAM_NOT_READY","账号共享上游未就绪"),
+        Map.entry("TASK_NOT_RETRYABLE","任务当前不可恢复"),
+        Map.entry("COLLECTION_MODE_NOT_BUSINESS","当前不是正式采集模式"),
+        Map.entry("VALIDATION_NOT_RETRYABLE","验证会话不可恢复"),
+        Map.entry("ACCOUNT_SHARED_TASK","账号共享任务由协调器恢复"),
+        Map.entry("SOURCE_TIMEZONE_UNKNOWN","来源时区未确认"),
+        Map.entry("SALES_DAY_INCOMPLETE","销量日期未完整"),
+        Map.entry("SALES_NOT_COVERED_OR_SKU_HISTORY_UNKNOWN","销量未覆盖或SKU历史未知"),
+        Map.entry("SCOPE_LEASE_BUSY","本仓任务正在执行"),
+        Map.entry("COLLECTION_OFF","采集模式关闭"),
+        Map.entry("COLLECTION_MODE_INVALID","采集模式配置无效"),
+        Map.entry("BUSINESS_ENVIRONMENT_REJECTED","正式采集只允许生产环境"),
+        Map.entry("EXECUTION_DISABLED","采集执行未启用"),
+        Map.entry("WAREHOUSE_NOT_CONFIGURED","仓库未配置"),
+        Map.entry("TIMEZONE_OR_UNIT_NOT_CONFIRMED","时间或件数口径配置不符合确认值"),
+        Map.entry("ACCOUNT_PAUSED","账号采集已暂停"),
+        Map.entry("ACCOUNT_COOLDOWN","账号处于冷却期"),
+        Map.entry("EXCLUSIVE_GRANT_NOT_VALID","账号独占窗口授权无效"),
+        Map.entry("DAILY_BUDGET_NOT_CONFIGURED","账号日额度未配置"),
+        Map.entry("DAILY_BUDGET_EXHAUSTED","账号日额度已用完"),
+        Map.entry("SALES_MISSING","尚无销量发布版本"),
+        Map.entry("INVENTORY_MISSING","尚无库存发布版本"),
+        Map.entry("SALES_BLOCKED","销量修订阻断"),
+        Map.entry("SALES_STALE","销量数据过期"),
+        Map.entry("REVISION_REVIEW_UNKNOWN","修订核对状态未知"),
+        Map.entry("REVISION_REVIEW_LAGGING","修订核对滞后"),
+        Map.entry("SALES_REBUILD_REQUIRED","销量有变动，待重新统计发布"),
+        Map.entry("TODAY_INCOMPLETE","今日尚未结束，不能作为完整自然日"),
+        Map.entry("SALES_SOURCE_TIMEZONE_UNKNOWN","销量来源时区未确认"),
+        Map.entry("INDEPENDENT_ANCHOR_MISSING","缺少独立库存对账记录"),
+        Map.entry("INDEPENDENT_ANCHOR_QUALITY_MISSING","独立库存品质记录不完整"),
+        Map.entry("INDEPENDENT_ANCHOR_INVALID","独立库存记录无效"),
+        Map.entry("INDEPENDENT_ANCHOR_COVERAGE_MISSING","库存对账区间流水未齐"),
+        Map.entry("INDEPENDENT_ANCHOR_MISMATCH","流水与独立库存记录不符"),
+        Map.entry("INDEPENDENT_ANCHOR_FLOW_UNKNOWN","库存对账流水待核验"),
+        Map.entry("ANCHOR_TIME_AMBIGUOUS","采集库存时发生变动，待稳定库存记录核验"),
+        Map.entry("ANCHOR_MISSING","缺少库存锚点"),
+        Map.entry("FLOW_COVERAGE_GAP","库存流水覆盖不完整"),
+        Map.entry("FLOW_TYPE_UNVERIFIED","流水类型尚未核验"),
+        Map.entry("CHAIN_DISCONTINUITY","批次结存不连续"),
+        Map.entry("CHAIN_ORDER_AMBIGUOUS","同秒流水顺序待核验"),
+        Map.entry("FLOW_QUANTITY_OR_TIME_INVALID","流水数量或时间待核验"),
+        Map.entry("FLOW_QUANTITY_CONFLICT","流水变动数量不一致"),
+        Map.entry("NEGATIVE_CHAIN_STOCK","批次结存出现负数"),
+        Map.entry("NEGATIVE_RECONSTRUCTED_STOCK","还原库存出现负数"),
+        Map.entry("UNIT_UNKNOWN","库存数量单位待确认"),
+        Map.entry("ANCHOR_DUPLICATE","库存锚点重复"),
+        Map.entry("ANCHOR_QUANTITY_INVALID","库存锚点数量无效"),
+        Map.entry("ANCHOR_INTERVAL_INVALID","库存观测时间无效"),
+        Map.entry("ANCHOR_BEFORE_DAY_END","库存锚点早于日末"),
+        Map.entry("FLOW_ID_INVALID","流水标识无效"),
+        Map.entry("FLOW_ID_CONFLICT","流水标识存在冲突"),
+        Map.entry("UNKNOWN_QUALITY","库存品质待确认"),
+        Map.entry("CHAIN_IDENTITY_MISSING","流水库位或批次缺失"),
+        Map.entry("INSUFFICIENT","合格日末库存记录不足"),
+        Map.entry("ZERO_AVERAGE_STOCK","期间平均日末库存为0，无法计算周转"),
+        Map.entry("INVENTORY_UNKNOWN_OR_STALE","当前库存未知、异常或已过期"),
+        Map.entry("NOT_APPLICABLE","货主不计算整体可售天数"),
+        Map.entry("SALES_OR_STOCK_UNASSESSABLE","部分商品的销量或库存不足以判断"));
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/diagnostics/QueryDiagnostics.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/diagnostics/QueryDiagnostics.java
new file mode 100644
index 000000000..b94d9c9b4
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/diagnostics/QueryDiagnostics.java
@@ -0,0 +1,59 @@
+package com.baiyue.lastleg.selfoperated.analytics.query.diagnostics;
+
+import com.fasterxml.jackson.core.JsonProcessingException;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import java.util.*;
+
+/** Request-local, parameter-free client timings. No SQL or business identities are retained. */
+final class QueryDiagnostics {
+    static final ThreadLocal<State> CURRENT = new ThreadLocal<>();
+    private static final ObjectMapper JSON = new ObjectMapper();
+    static final String PREFIX = "com.baiyue.lastleg.selfoperated.analytics.query.";
+    private static final Set<String> METHODS = Set.of("AnalyticsReadMapper.scopes", "AnalyticsReadMapper.publishedRun",
+        "AnalyticsReadMapper.applyBarriers", "AnalyticsReadMapper.count", "AnalyticsReadMapper.page",
+        "AnalyticsReadMapper.inventoryCount", "AnalyticsReadMapper.inventoryPage", "DashboardReadMapper.daily", "DashboardReadMapper.report");
+    static String method(String id) {
+        if (!id.startsWith(PREFIX)) return null;
+        String method = id.substring(PREFIX.length());
+        return METHODS.contains(method) ? method : null;
+    }
+    static String phase(String method) {
+        if (method.endsWith(".scopes") || method.endsWith(".publishedRun") || method.endsWith(".applyBarriers")) return "CONTEXT";
+        if (method.endsWith(".daily")) return "DAILY";
+        if (method.endsWith(".report")) return "REPORT";
+        return method.endsWith("Count") || method.endsWith(".count") ? "COUNT" : "PAGE";
+    }
+    static final class Timing {
+        public long calls, failures, nanos;
+        void add(long elapsed, boolean failed) { calls++; nanos += elapsed; if (failed) failures++; }
+    }
+    static final class MethodTiming {
+        public final String phase;
+        public final Timing executor = new Timing(), statement = new Timing();
+        MethodTiming(String method) { phase = QueryDiagnostics.phase(method); }
+    }
+    static final class State {
+        final long started = System.nanoTime();
+        final Map<String, MethodTiming> methods = new TreeMap<>();
+        final Deque<String> frames = new ArrayDeque<>();
+        int statementDepth;
+        MethodTiming timing(String method) { return methods.computeIfAbsent(method, MethodTiming::new); }
+        String json(String endpoint, String requestId, int status, boolean failed) {
+            return json(endpoint, requestId, status, failed, "REQUEST_COMPLETE");
+        }
+        String json(String endpoint, String requestId, int status, boolean failed, String capturePoint) {
+            long total = System.nanoTime() - started;
+            long executor = methods.values().stream().mapToLong(t -> t.executor.nanos).sum();
+            Map<String,Object> report = new LinkedHashMap<>();
+            report.put("event", "SELFOP_QUERY_DIAGNOSTICS"); report.put("endpoint", endpoint);
+            report.put("requestId", requestId != null && requestId.matches("[A-Za-z0-9._:-]{1,128}") ? requestId : null);
+            report.put("httpStatus", status); report.put("escapedException", failed);
+            report.put("capturePoint", capturePoint);
+            report.put("requestNanos", total); report.put("unattributedNanos", Math.max(0, total-executor));
+            report.put("timingMeaning", "CLIENT_EXECUTOR_AND_STATEMENT_INCLUDING_MAPPING_NOT_SERVER_DB_TIME");
+            report.put("poolWaitAttribution", "NOT_MEASURED_PER_REQUEST"); report.put("methods", methods);
+            try { return JSON.writeValueAsString(report); }
+            catch (JsonProcessingException e) { return "{\"event\":\"SELFOP_QUERY_DIAGNOSTICS_SERIALIZATION_FAILED\"}"; }
+        }
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/diagnostics/QueryDiagnosticsConfiguration.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/diagnostics/QueryDiagnosticsConfiguration.java
new file mode 100644
index 000000000..f5dfe1956
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/diagnostics/QueryDiagnosticsConfiguration.java
@@ -0,0 +1,26 @@
+package com.baiyue.lastleg.selfoperated.analytics.query.diagnostics;
+
+import org.slf4j.LoggerFactory;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
+import org.springframework.boot.web.servlet.FilterRegistrationBean;
+import org.springframework.context.annotation.*;
+import org.springframework.core.Ordered;
+
+/** Explicit TEST opt-in; no datasource decoration or changes to business queries. */
+@Configuration(proxyBeanMethods=false)
+@ConditionalOnProperty(name="DEPLOY_ENV", havingValue="test", matchIfMissing=false)
+public class QueryDiagnosticsConfiguration {
+    @Bean
+    @ConditionalOnProperty(name="baiyue.self-operated-analytics.query-diagnostics.enabled", havingValue="true", matchIfMissing=false)
+    public QueryDiagnosticsInterceptor queryDiagnosticsInterceptor() { return new QueryDiagnosticsInterceptor(); }
+
+    @Bean
+    @ConditionalOnProperty(name="baiyue.self-operated-analytics.query-diagnostics.enabled", havingValue="true", matchIfMissing=false)
+    public FilterRegistrationBean<QueryDiagnosticsFilter> queryDiagnosticsFilter() {
+        var log = LoggerFactory.getLogger(QueryDiagnosticsFilter.class);
+        var registration = new FilterRegistrationBean<>(new QueryDiagnosticsFilter(log::info));
+        registration.setOrder(Ordered.HIGHEST_PRECEDENCE+1);
+        registration.setDispatcherTypes(jakarta.servlet.DispatcherType.REQUEST);
+        return registration;
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/diagnostics/QueryDiagnosticsFilter.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/diagnostics/QueryDiagnosticsFilter.java
new file mode 100644
index 000000000..45a4b7739
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/diagnostics/QueryDiagnosticsFilter.java
@@ -0,0 +1,33 @@
+package com.baiyue.lastleg.selfoperated.analytics.query.diagnostics;
+
+import com.baiyue.common.web.CorrelationContext;
+import jakarta.servlet.*;
+import jakarta.servlet.http.*;
+import org.slf4j.MDC;
+import org.springframework.web.filter.OncePerRequestFilter;
+import java.io.IOException;
+import java.util.Map;
+import java.util.function.Consumer;
+
+public final class QueryDiagnosticsFilter extends OncePerRequestFilter {
+    private static final String BASE = "/api/platform/v1/last-leg/self-operated-analytics/";
+    private static final Map<String,String> ENDPOINTS = Map.of(BASE+"dashboard", "DASHBOARD",
+        BASE+"sku-sales-summary", "SUMMARY", BASE+"inventory-coverage", "INVENTORY");
+    private final Consumer<String> sink;
+    QueryDiagnosticsFilter(Consumer<String> sink) { this.sink = sink; }
+    @Override protected boolean shouldNotFilter(HttpServletRequest request) {
+        return !"GET".equals(request.getMethod()) || !ENDPOINTS.containsKey(request.getRequestURI());
+    }
+    @Override protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain)
+        throws ServletException, IOException {
+        var state = new QueryDiagnostics.State(); QueryDiagnostics.CURRENT.set(state);
+        String requestId = MDC.get(CorrelationContext.REQUEST_ID); boolean failed = true;
+        try { chain.doFilter(request, response); failed = false; }
+        finally {
+            QueryDiagnostics.CURRENT.remove();
+            // Diagnostic failures must never replace the original request result or exception.
+            try { sink.accept(state.json(ENDPOINTS.get(request.getRequestURI()), requestId, response.getStatus(), failed)); }
+            catch (RuntimeException ignored) { logger.warn("SELFOP_QUERY_DIAGNOSTICS_OUTPUT_FAILED"); }
+        }
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/diagnostics/QueryDiagnosticsInterceptor.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/diagnostics/QueryDiagnosticsInterceptor.java
new file mode 100644
index 000000000..a4cf5afdb
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/diagnostics/QueryDiagnosticsInterceptor.java
@@ -0,0 +1,42 @@
+package com.baiyue.lastleg.selfoperated.analytics.query.diagnostics;
+
+import org.apache.ibatis.cache.CacheKey;
+import org.apache.ibatis.executor.Executor;
+import org.apache.ibatis.executor.statement.StatementHandler;
+import org.apache.ibatis.mapping.*;
+import org.apache.ibatis.plugin.*;
+import org.apache.ibatis.session.*;
+import java.sql.Statement;
+
+@Intercepts({
+    @Signature(type=Executor.class, method="query", args={MappedStatement.class,Object.class,RowBounds.class,ResultHandler.class}),
+    @Signature(type=Executor.class, method="query", args={MappedStatement.class,Object.class,RowBounds.class,ResultHandler.class,CacheKey.class,BoundSql.class}),
+    @Signature(type=StatementHandler.class, method="query", args={Statement.class,ResultHandler.class})
+})
+public final class QueryDiagnosticsInterceptor implements Interceptor {
+    @Override public Object intercept(Invocation invocation) throws Throwable {
+        var state = QueryDiagnostics.CURRENT.get();
+        if (state == null) return invocation.proceed();
+        boolean executor = invocation.getTarget() instanceof Executor;
+        String method;
+        boolean record;
+        if (executor) {
+            method = QueryDiagnostics.method(((MappedStatement) invocation.getArgs()[0]).getId());
+            record = method != null && state.frames.isEmpty();
+            state.frames.push(method == null ? "" : method);
+        } else {
+            method = state.frames.peek();
+            record = method != null && !method.isEmpty() && state.statementDepth == 0;
+            state.statementDepth++;
+        }
+        long start = System.nanoTime(); boolean failed = true;
+        try { Object result = invocation.proceed(); failed = false; return result; }
+        finally {
+            if (record) {
+                var timing = state.timing(method);
+                (executor ? timing.executor : timing.statement).add(System.nanoTime()-start, failed);
+            }
+            if (executor) state.frames.pop(); else state.statementDepth--;
+        }
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/diagnostics/QueryDiagnosticsResponseAdvice.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/diagnostics/QueryDiagnosticsResponseAdvice.java
new file mode 100644
index 000000000..e02af0926
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/query/diagnostics/QueryDiagnosticsResponseAdvice.java
@@ -0,0 +1,35 @@
+package com.baiyue.lastleg.selfoperated.analytics.query.diagnostics;
+
+import com.baiyue.common.web.CorrelationContext;
+import org.slf4j.MDC;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnExpression;
+import org.springframework.core.MethodParameter;
+import org.springframework.http.MediaType;
+import org.springframework.http.converter.HttpMessageConverter;
+import org.springframework.http.server.*;
+import org.springframework.web.bind.annotation.RestControllerAdvice;
+import org.springframework.web.servlet.mvc.method.annotation.ResponseBodyAdvice;
+import java.util.Map;
+
+/** Opt-in diagnostic snapshot before serialization; never changes the response body. */
+@RestControllerAdvice
+@ConditionalOnExpression("'${DEPLOY_ENV:}' == 'test' && ${baiyue.self-operated-analytics.query-diagnostics.enabled:false}")
+public final class QueryDiagnosticsResponseAdvice implements ResponseBodyAdvice<Object> {
+    public static final String HEADER = "X-Selfop-Query-Diagnostics";
+    private static final String BASE = "/api/platform/v1/last-leg/self-operated-analytics/";
+    private static final Map<String,String> ENDPOINTS = Map.of(BASE+"dashboard", "DASHBOARD",
+        BASE+"sku-sales-summary", "SUMMARY", BASE+"inventory-coverage", "INVENTORY");
+    @Override public boolean supports(MethodParameter returnType, Class<? extends HttpMessageConverter<?>> converterType) {
+        return QueryDiagnostics.CURRENT.get() != null;
+    }
+    @Override public Object beforeBodyWrite(Object body, MethodParameter returnType, MediaType contentType,
+        Class<? extends HttpMessageConverter<?>> converterType, ServerHttpRequest request, ServerHttpResponse response) {
+        var state = QueryDiagnostics.CURRENT.get();
+        String endpoint = ENDPOINTS.get(request.getURI().getPath());
+        if (state != null && endpoint != null && request.getMethod() == org.springframework.http.HttpMethod.GET) {
+            int status = response instanceof ServletServerHttpResponse servlet ? servlet.getServletResponse().getStatus() : 200;
+            response.getHeaders().set(HEADER, state.json(endpoint, MDC.get(CorrelationContext.REQUEST_ID), status, false, "BEFORE_BODY_WRITE"));
+        }
+        return body;
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/request/EgressRejectedException.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/request/EgressRejectedException.java
new file mode 100644
index 000000000..c74863d35
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/request/EgressRejectedException.java
@@ -0,0 +1,8 @@
+package com.baiyue.lastleg.selfoperated.analytics.request;
+import java.time.LocalDateTime;
+/** Fixed reason; committed reservations are never refunded after an ambiguous outcome. */
+public final class EgressRejectedException extends RuntimeException {
+ private final boolean sampleDone; private final LocalDateTime waitUntilUtc;
+ public EgressRejectedException(String code, boolean sampleDone, LocalDateTime waitUntilUtc) {super(code);this.sampleDone=sampleDone;this.waitUntilUtc=waitUntilUtc;}
+ public String code(){return getMessage();} public boolean sampleDone(){return sampleDone;} public LocalDateTime waitUntilUtc(){return waitUntilUtc;}
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/request/SelfopApiBudget.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/request/SelfopApiBudget.java
new file mode 100644
index 000000000..50228a3b3
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/request/SelfopApiBudget.java
@@ -0,0 +1,12 @@
+package com.baiyue.lastleg.selfoperated.analytics.request;
+import java.time.*;
+/** Bounded durable account journal: only one outstanding attempt; old IDs cannot match a new permit. */
+public final class SelfopApiBudget {
+ public int dailyLimit,minIntervalMs; public String configHash;
+ public LocalDate budgetDate; public long reservedHttp,confirmedHttp; public int rateLimitFailures;
+ public LocalDateTime lastRequestAtUtc; public String importedGrantId; public Pending pending;
+ public static final class Pending {
+  public SelfopEgressDtos.EgressContext context; public SelfopEgressDtos.Operation operation; public String requestHash; public String internalRequestHash; public String completionHash;
+  public Long taskId,runId; public LocalDateTime expiresAtUtc; public boolean consumed; public boolean completed; public boolean abandoned;
+ }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/request/SelfopBusinessBudget.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/request/SelfopBusinessBudget.java
new file mode 100644
index 000000000..7802f75a8
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/request/SelfopBusinessBudget.java
@@ -0,0 +1,42 @@
+package com.baiyue.lastleg.selfoperated.analytics.request;
+
+import com.baiyue.lastleg.selfoperated.analytics.model.SelfopSupport;
+import java.time.LocalDateTime;
+
+/** BUSINESS session accounting and explicit stops, shared by the root and descendants. */
+public final class SelfopBusinessBudget {
+    /** Recorded field only; BUSINESS has no HTTP-count ceiling. New sessions write zero. */
+    public int maxHttp;
+    public int http, confirmedHttp;
+    public boolean continuous;
+    /** Existing deadlines remain recorded evidence, never an execution limit. */
+    public LocalDateTime startedAtUtc, deadlineAtUtc;
+    public String stopReason;
+
+    public static String freeze(LocalDateTime now) {
+        if (now == null)
+            throw new IllegalArgumentException("BUSINESS_SESSION_BUDGET_INVALID");
+        var budget = new SelfopBusinessBudget();
+        budget.startedAtUtc = now;
+        return SelfopSupport.json(budget);
+    }
+
+    public static String freezeContinuous(LocalDateTime now) {
+        if(now==null)throw new IllegalArgumentException("BUSINESS_SESSION_BUDGET_INVALID");
+        var budget=new SelfopBusinessBudget();budget.startedAtUtc=now;budget.continuous=true;
+        return SelfopSupport.json(budget);
+    }
+
+    public void validate() {
+        if (http < 0 || confirmedHttp < 0 || confirmedHttp > http
+            || startedAtUtc == null || deadlineAtUtc != null && (continuous || !deadlineAtUtc.isAfter(startedAtUtc))
+            || stopReason != null && !stopReason.matches("[A-Z0-9_]{1,64}"))
+            throw new EgressRejectedException("BUSINESS_SESSION_BUDGET_INVALID", false, null);
+    }
+
+    public String limit(LocalDateTime now) {
+        validate();
+        if (stopReason != null) return stopReason;
+        return null;
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/request/SelfopEgressController.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/request/SelfopEgressController.java
new file mode 100644
index 000000000..0a193dcb7
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/request/SelfopEgressController.java
@@ -0,0 +1,15 @@
+package com.baiyue.lastleg.selfoperated.analytics.request;
+import com.baiyue.common.core.api.ApiResponse;
+import com.baiyue.common.core.api.ResultCode;
+import java.time.ZoneOffset;
+import com.baiyue.lastleg.security.InternalServiceTokenGuard;
+import org.springframework.web.bind.annotation.*;
+@RestController
+@RequestMapping("/internal/lastleg/self-operated-analytics/egress")
+public class SelfopEgressController {
+ private final InternalServiceTokenGuard guard;private final SelfopEgressService service;
+ public SelfopEgressController(InternalServiceTokenGuard guard,SelfopEgressService service){this.guard=guard;this.service=service;}
+ @GetMapping("/runtime") public ApiResponse<SelfopEgressDtos.RuntimeSnapshot> runtime(@RequestHeader(value="X-Internal-Service-Token",required=false) String token){guard.verify(token);return ApiResponse.success(service.runtime());}
+ @PostMapping("/authorize") public ApiResponse<?> authorize(@RequestHeader(value="X-Internal-Service-Token",required=false) String token,@RequestBody SelfopEgressDtos.AuthorizationRequest request){guard.verify(token);try{return ApiResponse.success(service.authorize(request));}catch(EgressRejectedException denied){return ApiResponse.of(ResultCode.BUSINESS_ERROR,"领星请求许可未授予",new SelfopEgressDtos.AuthorizationDenial(denied.code(),denied.sampleDone(),denied.waitUntilUtc()==null?null:denied.waitUntilUtc().toInstant(ZoneOffset.UTC)),null,null);}}
+ @PostMapping("/complete") public ApiResponse<Boolean> complete(@RequestHeader(value="X-Internal-Service-Token",required=false) String token,@RequestBody SelfopEgressDtos.CompletionRequest request){guard.verify(token);service.complete(request);return ApiResponse.success(true);}
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/request/SelfopEgressDtos.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/request/SelfopEgressDtos.java
new file mode 100644
index 000000000..b932dc712
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/request/SelfopEgressDtos.java
@@ -0,0 +1,17 @@
+package com.baiyue.lastleg.selfoperated.analytics.request;
+import java.time.Instant;
+public final class SelfopEgressDtos {
+ private SelfopEgressDtos(){}
+ @com.fasterxml.jackson.annotation.JsonInclude(com.fasterxml.jackson.annotation.JsonInclude.Include.ALWAYS)
+ public record RuntimeSnapshot(int schemaVersion,String service,Instant observedAt,String mode,String environment,
+  boolean continuousEnabled,String sourceAccountFingerprint,boolean grantPresent,String grantFingerprint,
+  long intervalMs,int permitMaxSeconds,boolean executionEnabled,int pendingMaxSeconds,
+  boolean exclusiveHandoffVerified,boolean priorEgressClosed,boolean inflightDrained,boolean transferredBudgetVerified){}
+ public enum Operation {WAREHOUSES,OUTBOUND_QUERY,OUTBOUND_LOCATE,OUTBOUND_DETAIL,PRODUCT_INVENTORY,CUSTOMERS,PRODUCTS,INVENTORY_FLOW}
+ public record EgressContext(String sourceAccount,String executionPurpose,String rootTaskId,String sessionId,String attemptId,String exclusiveGrantId){}
+ @com.fasterxml.jackson.annotation.JsonInclude(com.fasterxml.jackson.annotation.JsonInclude.Include.ALWAYS)
+ public record AuthorizationDenial(String errorCode,boolean sampleDone,Instant waitUntil){}
+ public record AuthorizationRequest(EgressContext context,Operation operation,String requestHash){}
+ public record AttemptPermit(EgressContext context,Operation operation,String requestHash,int allowedAttempts,Instant expiresAt,boolean exclusiveConfirmed,boolean budgetConsumed){}
+ public record CompletionRequest(EgressContext context,Operation operation,String requestHash,int actualHttpAttempts,String errorCode,Integer upstreamStatus,Integer sourceCode,boolean accountPaused,Instant cooldownUntil){}
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/request/SelfopEgressMapper.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/request/SelfopEgressMapper.java
new file mode 100644
index 000000000..fe1d42378
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/request/SelfopEgressMapper.java
@@ -0,0 +1,16 @@
+package com.baiyue.lastleg.selfoperated.analytics.request;
+import com.baiyue.lastleg.selfoperated.analytics.model.*;
+import org.apache.ibatis.annotations.*;
+import java.time.LocalDateTime;
+@Mapper
+public interface SelfopEgressMapper {
+ @Select("SELECT * FROM ll_selfop_outbound_discovery_scope WHERE source_account=#{account} FOR UPDATE") SelfopOutboundDiscoveryScope lockAccount(String account);
+ @Select("SELECT * FROM ll_selfop_sync_task WHERE id=#{id} FOR UPDATE") SelfopSyncTask lockTask(Long id);
+ @Select("SELECT * FROM ll_selfop_sync_run WHERE id=#{id} FOR UPDATE") SelfopSyncRun lockRun(Long id);
+ @Select("SELECT COUNT(*) FROM ll_selfop_sync_scope WHERE id=#{scopeId} AND fence_token=#{fence} AND lease_until_utc>#{now}") int warehouseFence(@Param("scopeId") Long scopeId,@Param("fence") Long fence,@Param("taskId") Long taskId,@Param("now") LocalDateTime now);
+ @Update("UPDATE ll_selfop_outbound_discovery_scope SET api_budget_json=#{apiBudgetJson},api_cooldown_until_utc=#{apiCooldownUntilUtc},api_pause_reason=#{apiPauseReason},updated_at=UTC_TIMESTAMP(3) WHERE id=#{id}") int saveAccount(SelfopOutboundDiscoveryScope row);
+ @Update("UPDATE ll_selfop_sync_task SET validation_budget_json=#{validationBudgetJson},business_budget_json=#{businessBudgetJson},status=#{status},next_retry_at_utc=#{nextRetryAtUtc},updated_at=UTC_TIMESTAMP(3) WHERE id=#{id}") int saveRoot(SelfopSyncTask row);
+ @Update("UPDATE ll_selfop_sync_task SET status='DEAD',next_retry_at_utc=NULL,updated_at=UTC_TIMESTAMP(3) WHERE business_root_task_id=#{root} AND source_account=#{account} AND execution_purpose='BUSINESS' AND status IN ('WAITING_SOURCE','READY','RUNNING','RETRY_WAIT')") int terminateBusinessTasks(@Param("root") Long root,@Param("account") String account);
+ @Update("UPDATE ll_selfop_sync_run SET status='FAILED',error_code=#{reason},finished_at_utc=#{now},progress_snapshot_json=(SELECT JSON_SET(JSON_REMOVE(COALESCE(progress_json,JSON_OBJECT()),'$.etaSamples'),'$.summaryAsOf',CONCAT(DATE_FORMAT(#{now},'%Y-%m-%dT%H:%i:%s.%f'),'Z')) FROM ll_selfop_sync_task WHERE id=task_id AND (progress_json IS NULL OR JSON_EXTRACT(progress_json,'$.attemptNo')=attempt_no)) WHERE source_account=#{account} AND execution_purpose='BUSINESS' AND task_id IN (SELECT id FROM ll_selfop_sync_task WHERE business_root_task_id=#{root} AND source_account=#{account} AND execution_purpose='BUSINESS') AND status IN ('FETCHING','VALIDATED','YIELDED','READY','BUILDING')") int terminateBusinessRuns(@Param("root") Long root,@Param("account") String account,@Param("reason") String reason,@Param("now") LocalDateTime now);
+ @Update("UPDATE ll_selfop_sync_run SET status=#{status},error_code=#{reason},finished_at_utc=#{now},progress_snapshot_json=(SELECT JSON_SET(JSON_REMOVE(COALESCE(progress_json,JSON_OBJECT()),'$.etaSamples'),'$.summaryAsOf',CONCAT(DATE_FORMAT(#{now},'%Y-%m-%dT%H:%i:%s.%f'),'Z')) FROM ll_selfop_sync_task WHERE id=task_id AND (progress_json IS NULL OR JSON_EXTRACT(progress_json,'$.attemptNo')=attempt_no)) WHERE task_id IN (SELECT id FROM ll_selfop_sync_task WHERE validation_root_task_id=#{root}) AND status IN ('FETCHING','VALIDATED','YIELDED')") int terminateValidationRuns(@Param("root") Long root,@Param("status") String status,@Param("reason") String reason,@Param("now") LocalDateTime now);
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/request/SelfopEgressService.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/request/SelfopEgressService.java
new file mode 100644
index 000000000..0916e0227
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/request/SelfopEgressService.java
@@ -0,0 +1,235 @@
+package com.baiyue.lastleg.selfoperated.analytics.request;
+import com.baiyue.lastleg.selfoperated.analytics.model.SelfopRequestContext;
+import com.baiyue.lastleg.selfoperated.analytics.model.*;
+import com.baiyue.lastleg.selfoperated.analytics.request.SelfopEgressDtos.*;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Transactional;
+import java.time.*;
+import java.util.*;
+@Service
+public class SelfopEgressService {
+ private static final int PERMIT_MAX_SECONDS=30,PENDING_MAX_SECONDS=120;
+ private final SelfopEgressMapper mapper; private final SelfopAnalyticsProperties config; private final Clock clock;
+ @Autowired public SelfopEgressService(SelfopEgressMapper mapper,SelfopAnalyticsProperties config){this(mapper,config,Clock.systemUTC());}
+ SelfopEgressService(SelfopEgressMapper mapper,SelfopAnalyticsProperties config,Clock clock){this.mapper=mapper;this.config=config;this.clock=clock;}
+ private LocalDateTime now(){return LocalDateTime.ofInstant(clock.instant(),ZoneOffset.UTC);}
+ /** Reads the same configuration instance used by authorization; no account, permit or provider access. */
+ public RuntimeSnapshot runtime(){
+  return new RuntimeSnapshot(1,"lastleg",clock.instant(),config.getCollectionMode(),config.getEnvironment(),
+   config.isContinuousBusinessCollectionEnabled(),fingerprint("source-account",config.getSourceAccount()),
+   config.getExclusiveGrantId()!=null&&!config.getExclusiveGrantId().isBlank(),fingerprint("grant",config.getExclusiveGrantId()),
+   config.getBusinessMinRequestIntervalMs(),PERMIT_MAX_SECONDS,config.isExecutionEnabled(),pendingMaxSeconds(),
+   config.isExclusiveHandoffVerified(),config.isPriorEgressClosed(),config.isInflightDrained(),config.isTransferredBudgetVerified());
+ }
+ private int pendingMaxSeconds(){return Math.max(1,Math.min(PENDING_MAX_SECONDS,config.getEgressLeaseSeconds()));}
+ private static String fingerprint(String domain,String value){
+  if(value==null||value.isBlank())return null;
+  try{return HexFormat.of().formatHex(java.security.MessageDigest.getInstance("SHA-256")
+   .digest(("selfop-runtime:v1:"+domain+"\n"+value).getBytes(java.nio.charset.StandardCharsets.UTF_8)));}
+  catch(java.security.NoSuchAlgorithmException impossible){throw new IllegalStateException("SHA-256 unavailable",impossible);}
+ }
+ @Transactional(noRollbackFor=EgressRejectedException.class)
+ public EgressContext reserve(SelfopRequestContext context,Operation operation,int pageSize,String warehouseCode,String detailKey,String requestHash){
+  if(context==null||context.rootTaskId()==null||context.taskId()==null||context.runId()==null||!Objects.equals(context.sessionId(),"selfop-"+context.rootTaskId()))throw reject("EGRESS_CONTEXT_INVALID");
+  LocalDateTime now=now();gate(context.sourceAccount(),context.executionPurpose(),context.exclusiveGrantId(),now);
+  if(operation==null||requestHash==null||!requestHash.matches("[a-f0-9]{64}"))throw reject("EGRESS_REQUEST_INVALID");
+  var account=account(context.sourceAccount());var budget=budget(account,now,context.executionPurpose());save(account,budget);var root=root(context.rootTaskId(),context.executionPurpose(),context.sourceAccount());
+  var task=mapper.lockTask(context.taskId());var run=mapper.lockRun(context.runId());
+  SelfopBusinessBudget business=hasBusinessSession(root)?business(root):null;
+  if(business!=null){verifyBusinessTask(task,root);String limit=business.limit(now);if(limit!=null){stopBusiness(root,business,limit,now);throw reject(limit);}}
+  verify(task,run,root,account,now);
+  boolean flowOperation=operation==Operation.INVENTORY_FLOW;
+  boolean history=com.baiyue.lastleg.selfoperated.analytics.history.InventoryFlowSlice.TYPE.equals(task.getTaskType());
+  if(history){
+   if(!flowOperation||!config.isInventoryHistoryEnabled()||!SelfopCollectionPolicy.continuousBusinessRoot(task)
+       ||!SelfopCollectionPolicy.continuousBusiness(config)||pageSize!=1000)throw reject("EGRESS_HISTORY_INVALID");
+   try {
+    var slice=SelfopSupport.read(task.getQueryScopeJson(),com.baiyue.lastleg.selfoperated.analytics.history.InventoryFlowSlice.class);
+    var checkpoint=SelfopSupport.read(run.getProgressSnapshotJson(),com.fasterxml.jackson.databind.JsonNode.class);
+    int page=checkpoint.path("nextPage").asInt();
+    if(!slice.warehouse().equals(warehouseCode)||!config.getWarehouses().containsKey(warehouseCode)
+        ||!slice.requestHash(page).equals(requestHash))throw reject("EGRESS_HISTORY_INVALID");
+   }catch(EgressRejectedException e){throw e;}catch(RuntimeException invalid){throw reject("EGRESS_HISTORY_INVALID");}
+  }else if(flowOperation!="INVENTORY_FLOW_PROBE".equals(task.getTaskType())
+      ||flowOperation&&(!"test".equals(config.getEnvironment())||!"BUSINESS".equals(task.getExecutionPurpose())
+          ||pageSize!=1000||!config.getWarehouses().containsKey(warehouseCode)
+          ||business==null||business.http!=0||!Objects.equals(task.getRequestHash(),requestHash)))throw reject("EGRESS_FLOW_PROBE_INVALID");
+  boolean masterOperation=operation==Operation.CUSTOMERS||operation==Operation.PRODUCTS;
+  if(masterOperation!=("MASTER_DATA".equals(task.getTaskType()))
+      ||masterOperation&&(!"BUSINESS".equals(task.getExecutionPurpose())||pageSize<1||pageSize>(operation==Operation.CUSTOMERS?1000:100)))throw reject("EGRESS_OPERATION_TASK_MISMATCH");
+  checkAccount(account,budget,now);
+  SelfopValidationBudget validation=null;
+  if("VALIDATION".equals(context.executionPurpose())){
+   if(SelfopCollectionPolicy.warehouseDiscovery(root)){
+    if(operation!=Operation.WAREHOUSES)throw reject("VALIDATION_DIRECTORY_OPERATION_ONLY");
+   }else{
+    String selected=SelfopCollectionPolicy.validationWarehouse(root);
+    if((operation==Operation.PRODUCT_INVENTORY||operation==Operation.OUTBOUND_DETAIL)&&!Objects.equals(selected,warehouseCode))throw reject("EGRESS_WAREHOUSE_INVALID");
+   }
+   validation=validation(root);String limit=validation.limit(now,operation,pageSize,warehouseCode,detailKey);
+   if(limit!=null){stop(root,validation,limit,false,now);throw new EgressRejectedException(limit,true,null);}
+   if(operation==Operation.PRODUCT_INVENTORY&&(warehouseCode==null||!config.getWarehouses().containsKey(warehouseCode)))throw reject("EGRESS_WAREHOUSE_INVALID");
+   if(operation==Operation.OUTBOUND_DETAIL&&(detailKey==null||detailKey.isBlank()))throw reject("EGRESS_DETAIL_IDENTITY_INVALID");
+  }
+  int interval="VALIDATION".equals(context.executionPurpose())?Math.max(5000,budget.minIntervalMs):budget.minIntervalMs;
+  if(budget.lastRequestAtUtc!=null&&now.isBefore(budget.lastRequestAtUtc.plusNanos((long)interval*1000000)))throw new EgressRejectedException("ACCOUNT_INTERVAL_WAIT",false,budget.lastRequestAtUtc.plusNanos((long)interval*1000000));
+  if("VALIDATION".equals(context.executionPurpose())&&budget.reservedHttp>=budget.dailyLimit)throw new EgressRejectedException("ACCOUNT_DAILY_BUDGET",false,now.plusHours(8).toLocalDate().plusDays(1).atStartOfDay().minusHours(8));
+  var outbound=new EgressContext(context.sourceAccount(),context.executionPurpose(),String.valueOf(context.rootTaskId()),context.sessionId(),UUID.randomUUID().toString(),context.exclusiveGrantId());
+  var pending=new SelfopApiBudget.Pending();pending.context=outbound;pending.operation=operation;pending.internalRequestHash=requestHash;pending.taskId=context.taskId();pending.runId=context.runId();pending.expiresAtUtc=now.plusSeconds(pendingMaxSeconds());
+  if("VALIDATION".equals(context.executionPurpose())&&pending.expiresAtUtc.isAfter(config.getExclusiveGrantExpiresAtUtc()))pending.expiresAtUtc=config.getExclusiveGrantExpiresAtUtc();
+  if(validation!=null&&pending.expiresAtUtc.isAfter(validation.deadlineAtUtc))pending.expiresAtUtc=validation.deadlineAtUtc;
+  budget.pending=pending;budget.reservedHttp++;budget.lastRequestAtUtc=now;
+  if(validation!=null){validation.consume(operation,warehouseCode,detailKey);root.setValidationBudgetJson(SelfopSupport.json(validation));mapper.saveRoot(root);}
+  if(business!=null){business.http++;saveBusiness(root,business);}
+  save(account,budget);return outbound;
+ }
+ @Transactional(noRollbackFor=EgressRejectedException.class)
+ public AttemptPermit authorize(AuthorizationRequest request){
+  requireRequest(request);var c=request.context();var now=now();gate(c.sourceAccount(),c.executionPurpose(),c.exclusiveGrantId(),now);
+  var account=account(c.sourceAccount());var budget=budget(account,now,c.executionPurpose());var pending=pendingForAuthorization(budget,c,request.operation());
+  var root=root(parseId(c.rootTaskId()),c.executionPurpose(),c.sourceAccount());
+  var task=mapper.lockTask(pending.taskId);var run=mapper.lockRun(pending.runId);
+  if(com.baiyue.lastleg.selfoperated.analytics.history.InventoryFlowSlice.TYPE.equals(task==null?null:task.getTaskType())&&!config.isInventoryHistoryEnabled())throw reject("EGRESS_HISTORY_DISABLED");
+  if(hasBusinessSession(root)){
+   var b=business(root);verifyBusinessTask(task,root);
+   // Explicit root stops remain independent of request accounting and short permit expiry.
+   String limit=b.limit(now);
+   if(limit!=null){stopBusiness(root,b,limit,now);throw reject(limit);}
+  }
+  verify(task,run,root,account,now);
+  if(pending.consumed||pending.completed||!now.isBefore(pending.expiresAtUtc))throw reject("EGRESS_PERMIT_REPLAY_OR_EXPIRED");
+  if(account.getApiPauseReason()!=null||account.getApiCooldownUntilUtc()!=null&&now.isBefore(account.getApiCooldownUntilUtc()))throw reject("ACCOUNT_PAUSED");
+  if("VALIDATION".equals(c.executionPurpose())){var v=validation(root);if(v.stopReason!=null||!now.isBefore(v.deadlineAtUtc)){stop(root,v,v.stopReason==null?"VALIDATION_DEADLINE":v.stopReason,false,now);throw new EgressRejectedException("VALIDATION_STOPPED",true,null);}}
+  if (!request.requestHash().matches("[a-f0-9]{64}"))throw reject("EGRESS_REQUEST_HASH_INVALID");
+  pending.requestHash=request.requestHash();pending.consumed=true;LocalDateTime expiry=now.plusSeconds(PERMIT_MAX_SECONDS);if(expiry.isAfter(pending.expiresAtUtc))expiry=pending.expiresAtUtc;pending.expiresAtUtc=expiry;budget.lastRequestAtUtc=now;save(account,budget);
+  return new AttemptPermit(c,request.operation(),request.requestHash(),1,expiry.toInstant(ZoneOffset.UTC),true,true);
+ }
+ @Transactional(noRollbackFor=EgressRejectedException.class)
+ public void complete(CompletionRequest request){
+  if(request==null||request.context()==null||request.actualHttpAttempts()<0||request.actualHttpAttempts()>1)throw reject("EGRESS_COMPLETION_INVALID");
+  var c=request.context();var now=now();var account=account(c.sourceAccount());var budget=budget(account,now,c.executionPurpose());var pending=pending(budget,c,request.operation(),request.requestHash());
+  String completionHash=SelfopSupport.hash(request);
+  if(pending.completed&&!pending.abandoned){
+   if(!Objects.equals(pending.completionHash,completionHash))throw reject("EGRESS_COMPLETION_CONFLICT");
+   return;
+  }
+  if(!pending.consumed)throw reject("EGRESS_COMPLETION_NOT_AUTHORIZED");
+  pending.completed=true;pending.abandoned=false;pending.completionHash=completionHash;budget.confirmedHttp+=request.actualHttpAttempts();
+  var root=root(parseId(c.rootTaskId()),c.executionPurpose(),c.sourceAccount());
+  SelfopValidationBudget validation="VALIDATION".equals(c.executionPurpose())?validation(root):null;
+  if(validation!=null){validation.confirmedHttp+=request.actualHttpAttempts();root.setValidationBudgetJson(SelfopSupport.json(validation));mapper.saveRoot(root);}
+  // An already authorized response remains accountable after continuous mode is disabled.
+  if(hasBusinessSession(root)){var b=business(root);b.confirmedHttp+=request.actualHttpAttempts();b.validate();saveBusiness(root,b);}
+  boolean auth=Integer.valueOf(401).equals(request.upstreamStatus())||Integer.valueOf(403).equals(request.upstreamStatus())
+   ||"LINGXING_WMS_AUTHORIZATION_REJECTED".equals(request.errorCode())||"LINGXING_WMS_SIGNATURE_REJECTED".equals(request.errorCode());
+  boolean rate=!auth&&(Integer.valueOf(429).equals(request.upstreamStatus())||Integer.valueOf(31001).equals(request.sourceCode())
+   ||Integer.valueOf(429).equals(request.sourceCode())||"LINGXING_WMS_HTTP_RATE_LIMITED".equals(request.errorCode())
+   ||"LINGXING_WMS_SOURCE_RATE_LIMITED".equals(request.errorCode()));
+  if(rate){
+   budget.rateLimitFailures++;var until=now.plusSeconds(Math.max(1,config.getCooldownSeconds())*(1L<<Math.min(10,budget.rateLimitFailures-1)));
+   if(request.cooldownUntil()!=null&&LocalDateTime.ofInstant(request.cooldownUntil(),ZoneOffset.UTC).isAfter(until))until=LocalDateTime.ofInstant(request.cooldownUntil(),ZoneOffset.UTC);
+   if(account.getApiCooldownUntilUtc()==null||account.getApiCooldownUntilUtc().isBefore(until))account.setApiCooldownUntilUtc(until);
+   if(recoverablePause(account.getApiPauseReason()))account.setApiPauseReason(budget.rateLimitFailures>=config.getMaxRateLimitFailures()?"RATE_LIMIT_REQUIRES_REVIEW":"RATE_LIMIT_COOLDOWN");
+  }
+  if(auth)account.setApiPauseReason("AUTHORIZATION_REQUIRES_REVIEW");
+  else if(request.accountPaused()&&!rate&&recoverablePause(account.getApiPauseReason()))account.setApiPauseReason("EGRESS_REQUIRES_REVIEW");
+  if(validation!=null&&(request.errorCode()!=null||rate||request.accountPaused()||request.upstreamStatus()!=null&&request.upstreamStatus()>=400))stop(root,validation,auth?"AUTHORIZATION_REJECTED":rate?"RATE_LIMITED":"VALIDATION_PROVIDER_FAILURE",true,now);
+  save(account,budget);
+ }
+ /** Records the caller's uncertain result without changing the original completion or its consumption. */
+ @Transactional
+ public void pauseUncertain(EgressContext context,Operation operation,String errorCode){
+  if(context==null||operation==null)throw reject("EGRESS_CONTEXT_INVALID");
+  var account=account(context.sourceAccount());
+  if(!Objects.equals(account.getSourceAccount(),context.sourceAccount())||account.getApiBudgetJson()==null)throw reject("EGRESS_PERMIT_BINDING_INVALID");
+  var budget=SelfopSupport.read(account.getApiBudgetJson(),SelfopApiBudget.class);
+  var pending=pendingForAuthorization(budget,context,operation);
+  // A durable completion already confirms the supplier rate limit. Keep its recoverable cooldown.
+  boolean confirmedRate=pending.completed&&!pending.abandoned&&pending.completionHash!=null
+   &&Set.of("LINGXING_WMS_HTTP_RATE_LIMITED","LINGXING_WMS_SOURCE_RATE_LIMITED").contains(errorCode==null?"":errorCode)
+   &&Set.of("RATE_LIMIT_COOLDOWN","RATE_LIMIT_REQUIRES_REVIEW").contains(account.getApiPauseReason()==null?"":account.getApiPauseReason());
+  if(confirmedRate)return;
+  if(recoverablePause(account.getApiPauseReason()))account.setApiPauseReason("EGRESS_REQUIRES_REVIEW");
+  if(mapper.saveAccount(account)!=1)throw reject("EGRESS_ACCOUNT_WRITE_FAILED");
+ }
+ @Transactional(noRollbackFor=EgressRejectedException.class)
+ public void failValidation(Long rootTaskId,String code){var initial=mapper.lockTask(rootTaskId);if(initial==null)throw reject("VALIDATION_ROOT_MISSING");/* caller is no longer holding collection locks */var v=validation(initial);stop(initial,v,safeReason(code),true,now());}
+ @Transactional(noRollbackFor=EgressRejectedException.class)
+ public void finishSample(Long rootTaskId,String reason){var root=mapper.lockTask(rootTaskId);var v=validation(root);if("DEAD".equals(root.getStatus()))return;stop(root,v,safeReason(reason),false,now());}
+ private void gate(String account,String purpose,String grant,LocalDateTime now){
+  if("OFF".equals(config.getCollectionMode())||!Objects.equals(config.getCollectionMode(),purpose)||!("VALIDATION".equals(purpose)||"BUSINESS".equals(purpose)))throw reject("EGRESS_MODE_REJECTED");
+  if("BUSINESS".equals(purpose)&&!("production".equals(config.getEnvironment())||"test".equals(config.getEnvironment())))throw reject("BUSINESS_ENVIRONMENT_REJECTED");
+  if(!Objects.equals(config.getSourceAccount(),account)||account==null||account.isBlank())throw reject("SOURCE_ACCOUNT_MISMATCH");
+  if(grant==null||grant.isBlank()||!Objects.equals(grant,config.getExclusiveGrantId())||("VALIDATION".equals(purpose)&&(config.getExclusiveGrantExpiresAtUtc()==null||!now.isBefore(config.getExclusiveGrantExpiresAtUtc())))||!config.isExclusiveHandoffVerified()||!config.isPriorEgressClosed()||!config.isInflightDrained()||!config.isTransferredBudgetVerified())throw reject("EXCLUSIVE_HANDOFF_UNCONFIRMED");
+  if(("VALIDATION".equals(purpose)&&config.getDailyRequestBudget()<1)||config.getBusinessMinRequestIntervalMs()<1||config.getRequestBudget()<1||config.getTimeBudgetSeconds()<1||config.getMaxRateLimitFailures()<1||config.getCooldownSeconds()<1)throw reject("ACCOUNT_BUDGET_UNCONFIGURED");
+ }
+ private SelfopOutboundDiscoveryScope account(String id){var a=mapper.lockAccount(id);if(a==null)throw reject("EGRESS_ACCOUNT_MISSING");return a;}
+ private SelfopApiBudget budget(SelfopOutboundDiscoveryScope account,LocalDateTime now,String purpose){
+  var b=account.getApiBudgetJson()==null?new SelfopApiBudget():SelfopSupport.read(account.getApiBudgetJson(),SelfopApiBudget.class);
+  if(b.reservedHttp<0||b.confirmedHttp<0||b.confirmedHttp>b.reservedHttp)throw reject("ACCOUNT_BUDGET_INVALID");
+  LocalDate day=now.plusHours(8).toLocalDate();
+  if(!Objects.equals(day,b.budgetDate)){
+   b.budgetDate=day;
+   // BUSINESS records cumulative consumption, including transferred and uncertain attempts.
+   // Only the finite VALIDATION daily quota rolls over; cooling/pending always survive.
+   if(!"BUSINESS".equals(purpose)){b.dailyLimit=config.getDailyRequestBudget();b.reservedHttp=b.pending!=null&&!b.pending.completed?1:0;b.confirmedHttp=0;}
+  }
+  if("BUSINESS".equals(purpose))b.dailyLimit=0;
+  else {if(b.dailyLimit<1)b.dailyLimit=config.getDailyRequestBudget();b.dailyLimit=Math.min(b.dailyLimit,config.getDailyRequestBudget());}
+  b.minIntervalMs=Math.max(b.minIntervalMs,config.getBusinessMinRequestIntervalMs());
+  b.configHash=SelfopSupport.hash(Arrays.asList(b.dailyLimit,b.minIntervalMs,config.getRequestBudget(),config.getTimeBudgetSeconds()));
+  if(!Objects.equals(config.getExclusiveGrantId(),b.importedGrantId)){
+   if(config.getTransferredBudgetDate()==null||!config.getTransferredBudgetDate().equals(day)||config.getTransferredDailyHttpCount()<0)throw reject("HANDOFF_BUDGET_DATE_UNCONFIRMED");
+   b.reservedHttp=Math.max(b.reservedHttp,config.getTransferredDailyHttpCount());b.importedGrantId=config.getExclusiveGrantId();
+   if(config.getTransferredCooldownUntilUtc()!=null&&(account.getApiCooldownUntilUtc()==null||account.getApiCooldownUntilUtc().isBefore(config.getTransferredCooldownUntilUtc())))account.setApiCooldownUntilUtc(config.getTransferredCooldownUntilUtc());
+   if(config.getTransferredPauseReason()!=null&&!config.getTransferredPauseReason().isBlank())account.setApiPauseReason(config.getTransferredPauseReason());
+  }
+  return b;
+ }
+ private void checkAccount(SelfopOutboundDiscoveryScope account,SelfopApiBudget b,LocalDateTime now){
+  if(b.pending!=null&&!b.pending.completed){
+   if(now.isBefore(b.pending.expiresAtUtc))throw new EgressRejectedException("ACCOUNT_REQUEST_INFLIGHT",false,b.pending.expiresAtUtc);
+   /* A lost response may still be in the provider. Conservatively retain charge and cool before another attempt. */
+   b.pending.completed=true;b.pending.abandoned=true;var until=now.plusSeconds(config.getCooldownSeconds());
+   if(account.getApiCooldownUntilUtc()==null||account.getApiCooldownUntilUtc().isBefore(until))account.setApiCooldownUntilUtc(until);
+   if(recoverablePause(account.getApiPauseReason()))account.setApiPauseReason("REQUEST_OUTCOME_UNKNOWN");save(account,b);
+  }
+  if(account.getApiCooldownUntilUtc()!=null&&now.isBefore(account.getApiCooldownUntilUtc()))throw new EgressRejectedException("ACCOUNT_COOLDOWN_WAIT",false,account.getApiCooldownUntilUtc());
+  if("RATE_LIMIT_COOLDOWN".equals(account.getApiPauseReason())||"REQUEST_OUTCOME_UNKNOWN".equals(account.getApiPauseReason()))account.setApiPauseReason(null);
+  if(account.getApiPauseReason()!=null)throw reject("ACCOUNT_REQUIRES_REVIEW");
+ }
+ private SelfopSyncTask root(Long id,String purpose,String account){var t=mapper.lockTask(id);if(t==null||!Objects.equals(t.getSourceAccount(),account)||!Objects.equals(t.getExecutionPurpose(),purpose))throw reject("EGRESS_ROOT_INVALID");if("VALIDATION".equals(purpose)&&!Objects.equals(id,t.getValidationRootTaskId()))throw reject("VALIDATION_ROOT_INVALID");return t;}
+ private void verify(SelfopSyncTask task,SelfopSyncRun run,SelfopSyncTask root,SelfopOutboundDiscoveryScope account,LocalDateTime now){
+  if(hasBusinessSession(root)&&"DEAD".equals(root.getStatus()))throw reject("BUSINESS_SESSION_ROOT_STOPPED");
+  if(task==null||run==null||!Objects.equals(run.getTaskId(),task.getId())||!Objects.equals(run.getSourceAccount(),root.getSourceAccount())||!Objects.equals(task.getSourceAccount(),root.getSourceAccount())||!Objects.equals(task.getExecutionPurpose(),root.getExecutionPurpose())||!Objects.equals(run.getExecutionPurpose(),task.getExecutionPurpose())||!"RUNNING".equals(task.getStatus())||!Set.of("FETCHING","VALIDATED").contains(run.getStatus()))throw reject("EGRESS_TASK_NOT_ACTIVE");
+  if("VALIDATION".equals(root.getExecutionPurpose())&&(!Objects.equals(task.getValidationRootTaskId(),root.getId())||Set.of("DEAD","SAMPLE_DONE").contains(root.getStatus())))throw reject("VALIDATION_ROOT_STOPPED");
+  if("ACCOUNT_DISCOVERY".equals(task.getTaskRole())){if(!Objects.equals(task.getDiscoveryScopeId(),account.getId())||!Objects.equals(account.getFenceToken(),run.getFenceToken())||account.getLeaseUntilUtc()==null||!now.isBefore(account.getLeaseUntilUtc()))throw reject("EGRESS_FENCE_LOST");}
+  else if(!Objects.equals(task.getScopeId(),run.getScopeId())||!Objects.equals(task.getWarehouseCode(),run.getWarehouseCode())||mapper.warehouseFence(task.getScopeId(),run.getFenceToken(),task.getId(),now)!=1)throw reject("EGRESS_FENCE_LOST");
+ }
+ private SelfopValidationBudget validation(SelfopSyncTask root){if(root==null||!"VALIDATION".equals(root.getExecutionPurpose())||!Objects.equals(root.getId(),root.getValidationRootTaskId())||root.getValidationBudgetJson()==null)throw reject("VALIDATION_ROOT_INVALID");var b=SelfopSupport.read(root.getValidationBudgetJson(),SelfopValidationBudget.class);b.validate();return b;}
+ private boolean continuousBusiness(String purpose){return "BUSINESS".equals(purpose)&&config.isContinuousBusinessCollectionEnabled();}
+ private boolean testBusiness(String purpose){return "test".equals(config.getEnvironment())&&"BUSINESS".equals(purpose);}
+ private boolean hasBusinessSession(SelfopSyncTask root){return "BUSINESS".equals(root.getExecutionPurpose())&&(testBusiness(root.getExecutionPurpose())||root.getBusinessBudgetJson()!=null||SelfopCollectionPolicy.continuousBusinessRoot(root));}
+ private SelfopBusinessBudget business(SelfopSyncTask root){
+  if(root==null||!"BUSINESS".equals(root.getExecutionPurpose())||!Objects.equals(root.getId(),root.getBusinessRootTaskId())||root.getBusinessBudgetJson()==null)throw reject("BUSINESS_SESSION_ROOT_INVALID");
+  SelfopBusinessBudget b;try{b=SelfopSupport.read(root.getBusinessBudgetJson(),SelfopBusinessBudget.class);}catch(RuntimeException e){throw reject("BUSINESS_SESSION_BUDGET_INVALID");}
+  if(b==null)throw reject("BUSINESS_SESSION_BUDGET_INVALID");b.validate();
+  if(b.continuous&&!SelfopCollectionPolicy.continuousBusinessRoot(root))throw reject("BUSINESS_SESSION_ROOT_INVALID");return b;
+ }
+ private void verifyBusinessTask(SelfopSyncTask task,SelfopSyncTask root){if(task==null||!Objects.equals(task.getBusinessRootTaskId(),root.getId())||!Objects.equals(task.getSourceAccount(),root.getSourceAccount())||!"BUSINESS".equals(task.getExecutionPurpose())||business(root).continuous&&!continuousBusiness(root.getExecutionPurpose()))throw reject("BUSINESS_SESSION_ROOT_INVALID");}
+ private void stopBusiness(SelfopSyncTask root,SelfopBusinessBudget b,String reason,LocalDateTime now){
+  b.stopReason=reason;root.setStatus("DEAD");root.setNextRetryAtUtc(null);saveBusiness(root,b);
+  mapper.terminateBusinessTasks(root.getId(),root.getSourceAccount());mapper.terminateBusinessRuns(root.getId(),root.getSourceAccount(),reason,now);
+ }
+ private void saveBusiness(SelfopSyncTask root,SelfopBusinessBudget b){root.setBusinessBudgetJson(SelfopSupport.json(b));if(mapper.saveRoot(root)!=1)throw new IllegalStateException("BUSINESS_SESSION_BUDGET_WRITE_FAILED");}
+ private SelfopApiBudget.Pending pendingForAuthorization(SelfopApiBudget budget,EgressContext c,Operation op){var p=budget.pending;if(p==null||!Objects.equals(p.context,c)||p.operation!=op)throw reject("EGRESS_PERMIT_BINDING_INVALID");return p;}
+ private SelfopApiBudget.Pending pending(SelfopApiBudget budget,EgressContext c,Operation op,String hash){var p=budget.pending;if(p==null||!Objects.equals(p.context,c)||p.operation!=op||!Objects.equals(p.requestHash,hash))throw reject("EGRESS_PERMIT_BINDING_INVALID");return p;}
+ private void stop(SelfopSyncTask root,SelfopValidationBudget v,String reason,boolean failed,LocalDateTime now){if("DEAD".equals(root.getStatus())||"SAMPLE_DONE".equals(root.getStatus()))return;v.stopReason=reason;root.setValidationBudgetJson(SelfopSupport.json(v));root.setStatus(failed?"DEAD":"SAMPLE_DONE");root.setNextRetryAtUtc(null);mapper.saveRoot(root);mapper.terminateValidationRuns(root.getId(),failed?"FAILED":"SAMPLE_DONE",reason,now);}
+ private void save(SelfopOutboundDiscoveryScope account,SelfopApiBudget b){account.setApiBudgetJson(SelfopSupport.json(b));if(mapper.saveAccount(account)!=1)throw reject("EGRESS_ACCOUNT_WRITE_FAILED");}
+ private static Long parseId(String id){try{return Long.valueOf(id);}catch(Exception e){throw reject("EGRESS_ROOT_ID_INVALID");}}
+ private static void requireRequest(AuthorizationRequest r){if(r==null||r.context()==null||r.operation()==null||r.requestHash()==null)throw reject("EGRESS_REQUEST_INVALID");}
+ private static String safeReason(String code){return code!=null&&code.matches("[A-Z0-9_]{1,64}")?code:"VALIDATION_FAILED";}
+ private static boolean recoverablePause(String reason){return reason==null||"RATE_LIMIT_COOLDOWN".equals(reason)||"REQUEST_OUTCOME_UNKNOWN".equals(reason);}
+ private static EgressRejectedException reject(String code){return new EgressRejectedException(code,false,null);}
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/request/SelfopValidationBudget.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/request/SelfopValidationBudget.java
new file mode 100644
index 000000000..ad63c290a
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/request/SelfopValidationBudget.java
@@ -0,0 +1,32 @@
+package com.baiyue.lastleg.selfoperated.analytics.request;
+import com.baiyue.lastleg.selfoperated.analytics.model.SelfopSupport;
+import java.time.LocalDateTime;
+import java.util.*;
+/** Frozen, persisted once on the root task. Limits may only be lowered before creation. */
+public final class SelfopValidationBudget {
+ public int maxPages=10,maxPageSize=10,maxDistinctDetails=20,maxDetailHttp=20,maxInventoryPagesPerWarehouse=2,maxHttp=40;
+ public int pages,detailHttp,http,confirmedHttp;
+ public LocalDateTime startedAtUtc,deadlineAtUtc;
+ public String stopReason;
+ public Set<String> detailKeys=new LinkedHashSet<>();
+ public Map<String,Integer> inventoryPages=new LinkedHashMap<>();
+ public static String freeze(LocalDateTime now){return freeze(now,10,20,40,300);}
+ public static String freezeWarehouseDiscovery(LocalDateTime now){return freeze(now,1,1,1,60);}
+ public static String freeze(LocalDateTime now,int pages,int details,int http,int seconds){
+  if(pages<1||details<1||http<1||seconds<1)throw new IllegalArgumentException("VALIDATION_LIMIT_INVALID");
+  var b=new SelfopValidationBudget();b.maxPages=Math.min(10,pages);b.maxDetailHttp=Math.min(20,details);b.maxDistinctDetails=Math.min(20,details);b.maxHttp=Math.min(40,http);b.startedAtUtc=now;b.deadlineAtUtc=now.plusSeconds(Math.min(300,seconds));return SelfopSupport.json(b);
+ }
+ public void validate(){
+  if(maxPages<1||maxPages>10||maxPageSize<1||maxPageSize>10||maxDistinctDetails<1||maxDistinctDetails>20||maxDetailHttp<1||maxDetailHttp>20||maxInventoryPagesPerWarehouse<1||maxInventoryPagesPerWarehouse>2||maxHttp<1||maxHttp>40||startedAtUtc==null||deadlineAtUtc==null||deadlineAtUtc.isAfter(startedAtUtc.plusMinutes(5))||!deadlineAtUtc.isAfter(startedAtUtc)||pages<0||detailHttp<0||http<0||confirmedHttp<0||confirmedHttp>http||detailKeys==null||inventoryPages==null)throw new EgressRejectedException("VALIDATION_BUDGET_INVALID",false,null);
+ }
+ public String limit(LocalDateTime now,SelfopEgressDtos.Operation op,int size,String warehouse,String key){
+  validate();if(stopReason!=null)return stopReason;
+  if(!now.isBefore(deadlineAtUtc))return "VALIDATION_DEADLINE";
+  if(http>=maxHttp)return "VALIDATION_HTTP_LIMIT";
+  if(op!=SelfopEgressDtos.Operation.OUTBOUND_DETAIL){if(size<1||size>maxPageSize)throw new EgressRejectedException("VALIDATION_PAGE_SIZE",false,null);if(pages>=maxPages)return "VALIDATION_PAGE_LIMIT";}
+  if(op==SelfopEgressDtos.Operation.PRODUCT_INVENTORY&&inventoryPages.getOrDefault(warehouse,0)>=maxInventoryPagesPerWarehouse)return "VALIDATION_INVENTORY_LIMIT";
+  if(op==SelfopEgressDtos.Operation.OUTBOUND_DETAIL){if(detailHttp>=maxDetailHttp)return "VALIDATION_DETAIL_HTTP_LIMIT";if(!detailKeys.contains(key)&&detailKeys.size()>=maxDistinctDetails)return "VALIDATION_DETAIL_IDENTITY_LIMIT";}
+  return null;
+ }
+ public void consume(SelfopEgressDtos.Operation op,String warehouse,String key){http++;if(op!=SelfopEgressDtos.Operation.OUTBOUND_DETAIL)pages++;else{detailHttp++;detailKeys.add(key);}if(op==SelfopEgressDtos.Operation.PRODUCT_INVENTORY)inventoryPages.merge(warehouse,1,Integer::sum);}
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/retention/SalesRetentionMapper.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/retention/SalesRetentionMapper.java
new file mode 100644
index 000000000..aee96cb42
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/retention/SalesRetentionMapper.java
@@ -0,0 +1,49 @@
+package com.baiyue.lastleg.selfoperated.analytics.retention;
+
+import com.baiyue.lastleg.selfoperated.analytics.model.*;
+import org.apache.ibatis.annotations.*;
+import java.time.LocalDateTime;
+import java.util.List;
+
+@Mapper
+public interface SalesRetentionMapper {
+    @Select("SELECT * FROM ll_selfop_sync_scope WHERE id=#{id} FOR UPDATE")
+    SelfopSyncScope scope(@Param("id") Long id);
+    @Select("SELECT * FROM ll_selfop_sync_run WHERE id=#{id} FOR UPDATE")
+    SelfopSyncRun run(@Param("id") Long id);
+    @Select("SELECT id FROM ll_selfop_sync_run WHERE scope_id=#{scopeId} AND status='PUBLISHED' AND execution_purpose='BUSINESS' AND id != #{current} ORDER BY published_at_utc DESC,id DESC LIMIT 1")
+    Long previous(@Param("scopeId") Long scopeId,@Param("current") Long current);
+    @Select("""
+        SELECT r.* FROM ll_selfop_sync_run r
+        WHERE r.scope_id=#{scopeId} AND r.status='PUBLISHED' AND r.execution_purpose='BUSINESS' AND r.run_role='WAREHOUSE_SYNC'
+          AND r.superseded_at_utc IS NOT NULL AND r.superseded_at_utc <= #{cutoff}
+          AND r.inventory_daily_sample_date IS NULL AND r.inventory_sample_rule_version IS NULL
+          AND r.id != #{current} AND (#{previous} IS NULL OR r.id != #{previous})
+          AND NOT EXISTS (SELECT 1 FROM ll_selfop_inventory_day_version h WHERE h.sales_run_id=r.id OR h.anchor_run_id=r.id)
+          AND (EXISTS (SELECT 1 FROM ll_selfop_sku_daily_sales d WHERE d.sales_run_id=r.id)
+            OR EXISTS (SELECT 1 FROM ll_selfop_warehouse_daily_sales w WHERE w.sales_run_id=r.id)
+            OR EXISTS (SELECT 1 FROM ll_selfop_sku_profile p WHERE p.profile_run_id=r.id))
+          AND NOT EXISTS (
+            SELECT 1 FROM ll_selfop_sync_run input JOIN ll_selfop_sync_task t ON t.id=input.task_id
+            WHERE t.source_account=r.source_account AND t.warehouse_code=r.warehouse_code
+              AND (t.status NOT IN ('SUCCEEDED','SAMPLE_DONE','CANCELLED') OR t.apply_state IN ('APPLYING','BLOCKED'))
+              AND (input.base_published_run_id=r.id OR input.reference_sales_run_id=r.id))
+        ORDER BY r.superseded_at_utc,r.id LIMIT 500
+        """)
+    List<SelfopSyncRun> eligible(@Param("scopeId") Long scopeId,@Param("current") Long current,
+                               @Param("previous") Long previous,@Param("cutoff") LocalDateTime cutoff);
+    @Select("""
+        SELECT (SELECT COUNT(*) FROM ll_selfop_sync_run input JOIN ll_selfop_sync_task t ON t.id=input.task_id
+        WHERE t.source_account=#{account} AND t.warehouse_code=#{warehouse}
+          AND (t.status NOT IN ('SUCCEEDED','SAMPLE_DONE','CANCELLED') OR t.apply_state IN ('APPLYING','BLOCKED'))
+          AND (input.base_published_run_id=#{id} OR input.reference_sales_run_id=#{id}))
+          + (SELECT COUNT(*) FROM ll_selfop_inventory_day_version h WHERE h.sales_run_id=#{id} OR h.anchor_run_id=#{id})
+        """)
+    long activeReferences(@Param("account") String account,@Param("warehouse") String warehouse,@Param("id") Long id);
+    @Delete("DELETE FROM ll_selfop_sku_daily_sales WHERE sales_run_id=#{id} LIMIT #{batchSize}")
+    int deleteDaily(@Param("id") Long id,@Param("batchSize") int batchSize);
+    @Delete("DELETE FROM ll_selfop_warehouse_daily_sales WHERE sales_run_id=#{id} LIMIT #{batchSize}")
+    int deleteWarehouseDaily(@Param("id") Long id,@Param("batchSize") int batchSize);
+    @Delete("DELETE FROM ll_selfop_sku_profile WHERE profile_run_id=#{id} LIMIT #{batchSize}")
+    int deleteProfiles(@Param("id") Long id,@Param("batchSize") int batchSize);
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/retention/SalesRetentionService.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/retention/SalesRetentionService.java
new file mode 100644
index 000000000..af43e7562
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/retention/SalesRetentionService.java
@@ -0,0 +1,54 @@
+package com.baiyue.lastleg.selfoperated.analytics.retention;
+
+import com.baiyue.lastleg.selfoperated.analytics.model.*;
+import lombok.RequiredArgsConstructor;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Isolation;
+import org.springframework.transaction.annotation.Transactional;
+import java.time.LocalDateTime;
+import java.util.*;
+
+/** No scheduled execution. Enabled, explicitly requested calls can remove only old derived sales copies. */
+@Service
+@RequiredArgsConstructor
+public class SalesRetentionService {
+    private final SalesRetentionMapper mapper;
+    private final SelfopAnalyticsProperties config;
+
+    public record Preview(Long scopeId,Long current,Long previous,List<Long> eligibleRunIds,LocalDateTime cutoff) { }
+    public record Deleted(Long runId,int dailyRows,int profileRows,int warehouseDailyRows) { }
+
+    @Transactional(isolation=Isolation.READ_COMMITTED,rollbackFor=Exception.class)
+    public Preview preview(Long scopeId,LocalDateTime now) {
+        SelfopSyncScope scope=mapper.scope(scopeId); validateScope(scope);
+        Long previous=scope.getPublishedRunId()==null?null:mapper.previous(scopeId,scope.getPublishedRunId());
+        LocalDateTime cutoff=now.minusDays(Math.max(7,config.getSalesRetentionDays()));
+        if(scope.getPublishedRunId()==null) return new Preview(scopeId,null,null,List.of(),cutoff);
+        return new Preview(scopeId,scope.getPublishedRunId(),previous,
+                mapper.eligible(scopeId,scope.getPublishedRunId(),previous,cutoff).stream().map(SelfopSyncRun::getId).toList(),cutoff);
+    }
+
+    /** Every batch rechecks current pointers and active references while holding the shared OUTBOUND scope lock. */
+    @Transactional(isolation=Isolation.READ_COMMITTED,rollbackFor=Exception.class)
+    public Deleted deleteBatch(Long scopeId,Long runId) {
+        SelfopSupport.require(config.isRetentionEnabled(),"SALES_RETENTION_DISABLED");
+        SelfopSyncScope scope=mapper.scope(scopeId); validateScope(scope);
+        SelfopSyncRun run=mapper.run(runId);
+        Long previous=scope.getPublishedRunId()==null?null:mapper.previous(scopeId,scope.getPublishedRunId());
+        SelfopSupport.require(run!=null && Objects.equals(run.getScopeId(),scopeId)
+                && Objects.equals(run.getSourceAccount(),scope.getSourceAccount())
+                && Objects.equals(run.getWarehouseCode(),scope.getWarehouseCode()) && "WAREHOUSE_SYNC".equals(run.getRunRole())
+                && "PUBLISHED".equals(run.getStatus()) && "BUSINESS".equals(run.getExecutionPurpose())
+                && run.getInventoryDailySampleDate()==null && run.getInventorySampleRuleVersion()==null
+                && run.getPublishedAtUtc()!=null && run.getSupersededAtUtc()!=null
+                && !run.getSupersededAtUtc().isAfter(SelfopSupport.utcNow().minusDays(Math.max(7,config.getSalesRetentionDays())))
+                && scope.getPublishedRunId()!=null && !Objects.equals(runId,scope.getPublishedRunId())
+                && !Objects.equals(runId,previous),"SALES_VERSION_PROTECTED");
+        SelfopSupport.require(mapper.activeReferences(scope.getSourceAccount(),scope.getWarehouseCode(),runId)==0,"SALES_INPUT_REFERENCED");
+        int size=Math.max(1,Math.min(500,config.getPersistenceBatchSize()));
+        return new Deleted(runId,mapper.deleteDaily(runId,size),mapper.deleteProfiles(runId,size),mapper.deleteWarehouseDaily(runId,size));
+    }
+    private void validateScope(SelfopSyncScope scope) {
+        SelfopSupport.require(scope!=null && "OUTBOUND".equals(scope.getDataFamily()),"SALES_RETENTION_SCOPE_INVALID");
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/statistics/InventoryCoveragePolicy.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/statistics/InventoryCoveragePolicy.java
new file mode 100644
index 000000000..c6ff45496
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/statistics/InventoryCoveragePolicy.java
@@ -0,0 +1,28 @@
+package com.baiyue.lastleg.selfoperated.analytics.statistics;
+
+import java.math.BigDecimal;
+import java.math.RoundingMode;
+
+/** Quality precedes zero; denominator uses all 30 complete days. */
+public final class InventoryCoveragePolicy {
+    private InventoryCoveragePolicy() {}
+    public record Result(BigDecimal average, BigDecimal days, String status) {}
+    public static Result calculate(String inventoryQuality, BigDecimal available, BigDecimal sales30,
+                                   boolean salesTrusted, boolean complete30, boolean observationEligible,
+                                   boolean unitConfirmed) {
+        if (!"VALID".equals(inventoryQuality) || available == null)
+            return new Result(null, null, "INVENTORY_" + inventoryQuality);
+        if (available.signum() < 0) return new Result(null, null, "INVENTORY_INVALID");
+        BigDecimal average = unitConfirmed && salesTrusted && complete30 && observationEligible && sales30 != null
+            ? sales30.divide(BigDecimal.valueOf(30), 12, RoundingMode.HALF_UP) : null;
+        if (available.signum() == 0) return new Result(average, BigDecimal.ZERO.setScale(1), "NO_AVAILABLE_INVENTORY");
+        if (!unitConfirmed) return new Result(null, null, "UNIT_UNKNOWN_OR_CONFLICT");
+        if (!salesTrusted) return new Result(null, null, "SALES_UNTRUSTED");
+        if (!complete30) return new Result(null, null, "COVERAGE_INSUFFICIENT");
+        if (!observationEligible) return new Result(null, null, "OBSERVATION_INSUFFICIENT");
+        if (sales30 == null) return new Result(null, null, "SALES_UNKNOWN");
+        if (sales30.signum() == 0) return new Result(average, null, "NO_OUTBOUND_30_DAYS");
+        // Algebraically stock / (sales / 30), avoiding intermediate rounding.
+        return new Result(average, available.multiply(BigDecimal.valueOf(30)).divide(sales30, 1, RoundingMode.HALF_UP), "VALID");
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/statistics/SalesBucketPolicy.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/statistics/SalesBucketPolicy.java
new file mode 100644
index 000000000..614f4643c
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/statistics/SalesBucketPolicy.java
@@ -0,0 +1,104 @@
+package com.baiyue.lastleg.selfoperated.analytics.statistics;
+
+import java.math.BigDecimal;
+import java.time.Instant;
+import java.time.LocalDate;
+import java.time.ZoneId;
+import java.util.ArrayList;
+import java.util.LinkedHashSet;
+import java.util.List;
+import java.util.Objects;
+
+/** Daily quantities distinguish complete facts, observed facts and unknown history. */
+public final class SalesBucketPolicy {
+    private SalesBucketPolicy() {}
+    public record Input(LocalDate date, LocalDate anchorDate, ZoneId zone,
+                        LocalDate completeDayFrom, LocalDate completeDayUntilExclusive,
+                        Instant coveredFrom, Instant coveredUntil, Instant evidenceAt,
+                        BigDecimal actualQuantity, Long actualOrderCount, boolean unitConfirmed,
+                        boolean salesKnown, boolean rebuild, boolean stale) {}
+    public record Point(LocalDate date, BigDecimal outboundQuantity, BigDecimal observedQuantity,
+                        Long orderCount, String dataStatus, List<String> reasonCodes,
+                        Instant provedFrom, Instant provedUntil) {}
+    public record Summary(BigDecimal outboundQuantity, BigDecimal observedQuantity, String dataStatus,
+                          List<String> reasonCodes, int completeDays, int partialDays, int unknownDays) {}
+
+    public static Point evaluate(Input input) {
+        Objects.requireNonNull(input.date(), "date");
+        Objects.requireNonNull(input.anchorDate(), "anchorDate");
+        Objects.requireNonNull(input.zone(), "zone");
+        if (input.date().isAfter(input.anchorDate())) throw new IllegalArgumentException("Future bucket");
+        Instant start = input.date().atStartOfDay(input.zone()).toInstant();
+        Instant end = input.date().plusDays(1).atStartOfDay(input.zone()).toInstant();
+        Instant provedFrom = input.coveredFrom() == null ? null : later(start, input.coveredFrom());
+        Instant provedUntil = input.coveredUntil() == null ? null : earlier(end, input.coveredUntil());
+        boolean intersection = provedFrom != null && provedUntil != null && provedFrom.isBefore(provedUntil);
+        if (!intersection) { provedFrom = null; provedUntil = null; }
+        List<String> reasons = new ArrayList<>();
+        if (input.rebuild()) reasons.add("SALES_REBUILD_REQUIRED");
+        if (input.stale()) reasons.add("SALES_STALE");
+        if (!input.unitConfirmed()) {
+            reasons.add("UNIT_UNKNOWN_OR_CONFLICT");
+            return point(input, null, null, null, "UNKNOWN", reasons, provedFrom, provedUntil);
+        }
+        if (!input.salesKnown()) {
+            reasons.add("SALES_NOT_COVERED");
+            return point(input, null, null, null, "UNKNOWN", reasons, provedFrom, provedUntil);
+        }
+        boolean today = input.date().equals(input.anchorDate());
+        boolean complete = !today && input.completeDayFrom() != null && input.completeDayUntilExclusive() != null
+                && !input.date().isBefore(input.completeDayFrom())
+                && input.date().isBefore(input.completeDayUntilExclusive())
+                && input.coveredFrom() != null && !input.coveredFrom().isAfter(start)
+                && input.coveredUntil() != null && !input.coveredUntil().isBefore(end);
+        boolean actual = input.actualQuantity() != null && input.actualQuantity().signum() >= 0;
+        if (input.actualQuantity() != null && !actual) {
+            reasons.add("SALES_QUANTITY_INVALID");
+            return point(input, null, null, null, "UNKNOWN", reasons, provedFrom, provedUntil);
+        }
+        if (complete && (actual || input.evidenceAt() != null && !input.evidenceAt().isAfter(start))) {
+            BigDecimal quantity = actual ? input.actualQuantity() : BigDecimal.ZERO;
+            return point(input, quantity, quantity, actual ? input.actualOrderCount() : 0L,
+                    "COMPLETE", reasons, provedFrom, provedUntil);
+        }
+        if (today) reasons.add("TODAY_INCOMPLETE");
+        else reasons.add("SALES_DAY_INCOMPLETE");
+        if (actual) return point(input, null, input.actualQuantity(), input.actualOrderCount(),
+                "PARTIAL", reasons, provedFrom, provedUntil);
+        if (intersection && input.evidenceAt() != null && later(provedFrom, input.evidenceAt()).isBefore(provedUntil)) {
+            reasons.add("SKU_PARTIAL_OBSERVATION");
+            return point(input, null, BigDecimal.ZERO, 0L, "PARTIAL", reasons, provedFrom, provedUntil);
+        }
+        reasons.add(input.evidenceAt() == null || !input.evidenceAt().isBefore(end)
+                ? "SKU_HISTORY_UNKNOWN" : "SALES_NOT_COVERED");
+        return point(input, null, null, null, "UNKNOWN", reasons, provedFrom, provedUntil);
+    }
+
+    public static Summary aggregate(List<Point> points) {
+        Objects.requireNonNull(points, "points");
+        int complete = 0, partial = 0, unknown = 0;
+        BigDecimal outbound = BigDecimal.ZERO, observed = BigDecimal.ZERO;
+        boolean hasObserved = false;
+        LinkedHashSet<String> reasons = new LinkedHashSet<>();
+        for (Point point : points) {
+            reasons.addAll(point.reasonCodes());
+            switch (point.dataStatus()) {
+                case "COMPLETE" -> { complete++; outbound = outbound.add(point.outboundQuantity()); }
+                case "PARTIAL" -> partial++;
+                case "UNKNOWN" -> unknown++;
+                default -> throw new IllegalArgumentException("Unknown dataStatus");
+            }
+            if (point.observedQuantity() != null) { observed = observed.add(point.observedQuantity()); hasObserved = true; }
+        }
+        boolean allComplete = !points.isEmpty() && complete == points.size();
+        return new Summary(allComplete ? outbound : null, hasObserved ? observed : null,
+                allComplete ? "COMPLETE" : hasObserved ? "PARTIAL" : "UNKNOWN",
+                List.copyOf(reasons), complete, partial, unknown);
+    }
+    private static Point point(Input input, BigDecimal outbound, BigDecimal observed, Long count,
+                               String status, List<String> reasons, Instant from, Instant until) {
+        return new Point(input.date(), outbound, observed, count, status, List.copyOf(reasons), from, until);
+    }
+    private static Instant later(Instant a, Instant b) { return a.isAfter(b) ? a : b; }
+    private static Instant earlier(Instant a, Instant b) { return a.isBefore(b) ? a : b; }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/statistics/SalesRangePolicy.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/statistics/SalesRangePolicy.java
new file mode 100644
index 000000000..6d39f9f78
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/statistics/SalesRangePolicy.java
@@ -0,0 +1,51 @@
+package com.baiyue.lastleg.selfoperated.analytics.statistics;
+
+import java.time.DayOfWeek;
+import java.time.Instant;
+import java.time.LocalDate;
+import java.time.ZoneId;
+import java.time.temporal.ChronoUnit;
+import java.time.temporal.TemporalAdjusters;
+import java.util.Objects;
+
+/** Natural-day query boundaries, resolved once for the fixed query version pair. */
+public final class SalesRangePolicy {
+    private SalesRangePolicy() {}
+    public enum Preset { TODAY, LAST_3_DAYS, THIS_WEEK, LAST_15_DAYS, THIS_MONTH, CUSTOM }
+    public record Range(LocalDate anchorDate, LocalDate startDate, LocalDate endDateExclusive,
+                        int dayCount, Instant startAt, Instant endAtExclusive) {}
+
+    public static Range resolve(String rangePreset, LocalDate startDate, LocalDate endDate,
+                                String bucket, Instant queryAsOf, ZoneId zone, int maxQueryDays) {
+        Objects.requireNonNull(queryAsOf, "queryAsOf");
+        Objects.requireNonNull(zone, "zone");
+        if (maxQueryDays < 1 || maxQueryDays > 366) throw new IllegalArgumentException("maxQueryDays must be 1..366");
+        if (!"DAY".equals(bucket)) throw new IllegalArgumentException("bucket must be DAY");
+        Preset preset;
+        try { preset = Preset.valueOf(rangePreset); }
+        catch (RuntimeException ex) { throw new IllegalArgumentException("Unknown rangePreset", ex); }
+        LocalDate anchor = queryAsOf.atZone(zone).toLocalDate();
+        LocalDate start;
+        LocalDate end = anchor;
+        if (preset == Preset.CUSTOM) {
+            if (startDate == null || endDate == null) throw new IllegalArgumentException("CUSTOM requires both dates");
+            start = startDate;
+            end = endDate;
+        } else {
+            if (startDate != null || endDate != null) throw new IllegalArgumentException("Preset dates conflict with explicit dates");
+            start = switch (preset) {
+                case TODAY -> anchor;
+                case LAST_3_DAYS -> anchor.minusDays(2);
+                case THIS_WEEK -> anchor.with(TemporalAdjusters.previousOrSame(DayOfWeek.MONDAY));
+                case LAST_15_DAYS -> anchor.minusDays(14);
+                case THIS_MONTH -> anchor.withDayOfMonth(1);
+                case CUSTOM -> throw new IllegalStateException("CUSTOM handled above");
+            };
+        }
+        long days = ChronoUnit.DAYS.between(start, end) + 1;
+        if (end.isAfter(anchor) || days < 1 || days > maxQueryDays) throw new IllegalArgumentException("Invalid query date range");
+        LocalDate exclusive = end.plusDays(1);
+        return new Range(anchor, start, exclusive, (int) days, start.atStartOfDay(zone).toInstant(),
+                exclusive.atStartOfDay(zone).toInstant());
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/sync/InventoryFlowProbeService.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/sync/InventoryFlowProbeService.java
new file mode 100644
index 000000000..4da795765
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/sync/InventoryFlowProbeService.java
@@ -0,0 +1,103 @@
+package com.baiyue.lastleg.selfoperated.analytics.sync;
+
+import com.baomidou.mybatisplus.core.conditions.query.QueryWrapper;
+import com.baomidou.mybatisplus.core.toolkit.IdWorker;
+import com.baiyue.lastleg.selfoperated.analytics.client.RestLingxingAnalyticsClient;
+import com.baiyue.lastleg.selfoperated.analytics.mapper.*;
+import com.baiyue.lastleg.selfoperated.analytics.model.*;
+import com.baiyue.lastleg.selfoperated.analytics.request.SelfopBusinessBudget;
+import com.fasterxml.jackson.databind.JsonNode;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.support.TransactionTemplate;
+import java.time.LocalDateTime;
+import java.util.*;
+import static com.baiyue.lastleg.selfoperated.analytics.model.SelfopSupport.*;
+
+/** TEST-only, one audited request. No schedule, retry, publication or historical inventory mutation. */
+@Service
+public class InventoryFlowProbeService {
+    private final SelfopAnalyticsProperties config;
+    private final SelfopSyncTaskMapper tasks;
+    private final SelfopSyncRunMapper runs;
+    private final SelfopOutboundDiscoveryScopeMapper accounts;
+    private final SelfopLeaseService leases;
+    private final RestLingxingAnalyticsClient client;
+    private final TransactionTemplate tx;
+    public InventoryFlowProbeService(SelfopAnalyticsProperties config,SelfopSyncTaskMapper tasks,SelfopSyncRunMapper runs,
+        SelfopOutboundDiscoveryScopeMapper accounts,SelfopLeaseService leases,RestLingxingAnalyticsClient client,TransactionTemplate tx) {
+        this.config=config;this.tasks=tasks;this.runs=runs;this.accounts=accounts;this.leases=leases;this.client=client;this.tx=tx;
+    }
+    public record Request(String requestKey,String warehouseCode,String customerCode,String sku,LocalDateTime startTime,LocalDateTime endTime) {
+        public Map<String,Object> providerRequest(){return Map.of("warehouseCode",warehouseCode,"customerCode",customerCode,"sku",sku,
+            "startTime",java.time.format.DateTimeFormatter.ISO_LOCAL_DATE_TIME.format(startTime),
+            "endTime",java.time.format.DateTimeFormatter.ISO_LOCAL_DATE_TIME.format(endTime));}
+    }
+    public record Result(String taskNo,boolean complete,JsonNode page) {}
+    static void validate(Request q,LocalDateTime now) {
+        require(q!=null,"SELFOP_FLOW_REQUEST_REQUIRED");identity(q.requestKey(),80);identity(q.warehouseCode(),64);
+        identity(q.customerCode(),64);identity(q.sku(),128);
+        require(q.startTime()!=null&&q.endTime()!=null&&q.startTime().isBefore(q.endTime())
+            &&!q.endTime().isAfter(q.startTime().plusDays(31))&&!q.endTime().isAfter(now),"SELFOP_FLOW_WINDOW_INVALID");
+    }
+    public Result probe(Request q,String actor) {
+        validate(q,utcNow().plusHours(8));
+        require("test".equals(config.getEnvironment())&&"BUSINESS".equals(config.getCollectionMode())
+            &&config.isExecutionEnabled()&&config.getWarehouses().containsKey(q.warehouseCode()),"SELFOP_FLOW_PROBE_DISABLED");
+        String key="flow-probe:"+q.requestKey(),digest=hash(q.providerRequest());
+        var account=accounts.selectOne(new QueryWrapper<SelfopOutboundDiscoveryScope>().eq("source_account",config.getSourceAccount()));
+        require(account!=null,"SELFOP_SCOPE_MISSING");
+        var lease=leases.acquireDiscovery(account.getId(),"flow-probe-"+UUID.randomUUID());
+        try {
+            var existing=tasks.selectOne(new QueryWrapper<SelfopSyncTask>().eq("source_account",config.getSourceAccount()).eq("request_key",key));
+            if(existing!=null) {
+                require(digest.equals(existing.getRequestHash()),"SELFOP_IDEMPOTENCY_CONFLICT");
+                require("SAMPLE_DONE".equals(existing.getStatus())&&existing.getRoutingManifestJson()!=null,"SELFOP_FLOW_PREVIOUS_ATTEMPT_REQUIRES_REVIEW");
+                return read(existing.getRoutingManifestJson(),Result.class);
+            }
+            var now=utcNow();var task=new SelfopSyncTask();var run=new SelfopSyncRun();
+            task.setId(IdWorker.getId());task.setTaskNo("LXFLOW-"+UUID.randomUUID().toString().replace("-","").toUpperCase(Locale.ROOT));
+            task.setSourceAccount(config.getSourceAccount());task.setExecutionPurpose("BUSINESS");task.setTaskRole("ACCOUNT_DISCOVERY");
+            task.setDiscoveryScopeId(account.getId());task.setTaskType("INVENTORY_FLOW_PROBE");task.setStatus("RUNNING");
+            task.setApplyState("NOT_APPLICABLE");task.setAttemptCount(1);task.setRequestKey(key);task.setRequestHash(digest);
+            task.setScopeHash(digest);task.setQueryScopeJson(json(q.providerRequest()));task.setBusinessRootTaskId(task.getId());
+            task.setBusinessBudgetJson(SelfopBusinessBudget.freeze(now));task.setRequestedBy(actor);task.setCreatedAt(now);task.setUpdatedAt(now);
+            run.setId(IdWorker.getId());run.setTaskId(task.getId());run.setSourceAccount(config.getSourceAccount());run.setExecutionPurpose("BUSINESS");
+            run.setRunRole("ACCOUNT_DISCOVERY");run.setAttemptNo(1);run.setScopeHash(digest);run.setScopeSnapshotJson(task.getQueryScopeJson());
+            run.setFenceToken(lease.fence());run.setStatus("FETCHING");run.setLastPhase("FETCHING");run.setFetchStartedAtUtc(now);
+            run.setCoverageStatus("UNKNOWN");run.setPageCount(0);run.setUniqueObjectCount(0L);run.setCreatedAt(now);run.setUpdatedAt(now);
+            tx.executeWithoutResult(s->{leases.verify(lease);tasks.insert(task);runs.insert(run);});
+            try {
+                JsonNode page=client.inventoryFlow(SelfopRequestContext.forTask(task,run,config),q.warehouseCode(),q.customerCode(),q.sku(),q.startTime(),q.endTime());
+                boolean complete=validatePage(page);
+                var result=new Result(task.getTaskNo(),complete,page);
+                tx.executeWithoutResult(s->{
+                    leases.verify(lease);var done=utcNow();
+                    task.setStatus("SAMPLE_DONE");task.setRoutingManifestJson(json(result));task.setUpdatedAt(done);
+                    run.setStatus("SAMPLE_DONE");run.setLastPhase("INVENTORY_FLOW_PROBE");run.setPageCount(1);
+                    run.setSourceTotalCount(page.path("total").asLong());run.setUniqueObjectCount((long)page.path("records").size());
+                    run.setCoverageStatus(complete?"COMPLETE":"PARTIAL");run.setFetchFinishedAtUtc(done);run.setFinishedAtUtc(done);run.setUpdatedAt(done);
+                    tasks.updateById(task);runs.updateById(run);
+                });
+                return result;
+            } catch(RuntimeException failure) {
+                String error=failure instanceof com.baiyue.lastleg.selfoperated.analytics.client.AnalyticsClientException c?c.code():
+                    failure instanceof com.baiyue.lastleg.selfoperated.analytics.request.EgressRejectedException e?e.code():"FLOW_PROBE_FAILED";
+                tx.executeWithoutResult(s->{leases.verify(lease);task.setStatus("DEAD");task.setUpdatedAt(utcNow());
+                    run.setStatus("FAILED");run.setErrorCode(error);run.setErrorMessage("库存流水诊断失败；不自动重试");run.setFinishedAtUtc(utcNow());run.setUpdatedAt(utcNow());
+                    tasks.updateById(task);runs.updateById(run);});
+                throw failure;
+            }
+        } finally {leases.release(lease);}
+    }
+    static boolean validatePage(JsonNode page) {
+        require(page!=null&&page.path("records").isArray()&&page.path("current").asInt()==1&&page.path("size").asInt()==1000
+            &&page.path("total").asLong(-1)>=0,"SELFOP_FLOW_PAGE_INVALID");
+        long total=page.path("total").asLong();
+        require(page.path("pages").asLong(-1)==(total==0?0:(total-1)/1000+1)
+            &&page.path("records").size()==Math.min(1000,total),"SELFOP_FLOW_PAGE_INVALID");
+        var ids=new HashSet<String>();
+        for(var row:page.path("records"))require(row.path("id").isTextual()&&!row.path("id").asText().isBlank()
+            &&ids.add(row.path("id").asText()),"SELFOP_FLOW_DUPLICATE_ID");
+        return total<=1000;
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/sync/SelfopBudget.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/sync/SelfopBudget.java
new file mode 100644
index 000000000..fa1ce6748
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/sync/SelfopBudget.java
@@ -0,0 +1,18 @@
+package com.baiyue.lastleg.selfoperated.analytics.sync;
+
+import java.time.Duration;
+import java.time.Instant;
+
+/** Per-dispatch budget: cursors survive this object's lifetime in task manifests. */
+public final class SelfopBudget {
+    private final int limit;
+    private final Instant deadline;
+    private int requests;
+    public SelfopBudget(int limit,int seconds) {
+        if(limit<=0||seconds<=0)throw new IllegalArgumentException("SELFOP_BUDGET_INVALID");
+        this.limit=limit;this.deadline=Instant.now().plusSeconds(seconds);
+    }
+    public boolean hasTime() {return Instant.now().isBefore(deadline);}
+    public boolean take() {if(requests>=limit||!hasTime())return false;requests++;return true;}
+    public int used(){return requests;}
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/sync/SelfopCommandService.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/sync/SelfopCommandService.java
new file mode 100644
index 000000000..f7ebea27c
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/sync/SelfopCommandService.java
@@ -0,0 +1,128 @@
+package com.baiyue.lastleg.selfoperated.analytics.sync;
+
+import com.baomidou.mybatisplus.core.conditions.query.QueryWrapper;
+import com.baiyue.common.core.exception.BizException;
+import com.baiyue.lastleg.selfoperated.analytics.mapper.*;
+import com.baiyue.lastleg.selfoperated.analytics.model.*;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Transactional;
+import java.time.*;
+import java.util.*;
+import static com.baiyue.lastleg.selfoperated.analytics.model.SelfopSupport.*;
+
+@Service
+public class SelfopCommandService {
+    public record Command(String requestKey,String warehouseCode,String action,String taskNo,
+        LocalDateTime sourceFrom,LocalDateTime sourceUntil,String customerCode,String deliveryNo,String reason) { }
+    private final SelfopTaskService taskService;
+    private final SelfopSyncScopeMapper scopes;
+    private final SelfopOutboundDiscoveryScopeMapper accounts;
+    private final SelfopAnalyticsProperties config;
+    private final SelfopSyncTaskMapper tasks;
+    public SelfopCommandService(SelfopTaskService taskService,SelfopSyncScopeMapper scopes,SelfopOutboundDiscoveryScopeMapper accounts,SelfopAnalyticsProperties config,SelfopSyncTaskMapper tasks){
+        this.taskService=taskService;this.scopes=scopes;this.accounts=accounts;this.config=config;this.tasks=tasks;
+    }
+    @Transactional(noRollbackFor=SelfopTaskService.BusinessSessionStoppedException.class)
+    public SelfopSyncTask request(Command c,String operator){
+        try { return requestChecked(c,operator); }
+        catch(IllegalStateException failure){
+            String message=failure.getMessage()==null?null:REJECTIONS.get(failure.getMessage());
+            if(message==null)throw failure;
+            throw new BizException(message);
+        }
+    }
+    private SelfopSyncTask requestChecked(Command c,String operator){
+        if(!config.isExecutionEnabled())throw new BizException("采集功能未启用，当前环境不允许执行采集或重试");
+        if(c==null)throw new BizException("请提供采集命令");
+        input(c.requestKey(),100,"请求标识");
+        if("WAREHOUSE_DISCOVERY".equals(c.action())) {
+            require("VALIDATION".equals(SelfopCollectionPolicy.configuredPurpose(config)),"SELFOP_VALIDATION_ENTRY_REQUIRED");
+            require(c.warehouseCode()==null&&c.taskNo()==null&&c.sourceFrom()==null&&c.sourceUntil()==null
+                &&c.customerCode()==null&&c.deliveryNo()==null&&c.reason()==null,"SELFOP_WAREHOUSE_DISCOVERY_PARAMETERS");
+            var account=taskService.initializeAccount();
+            Map<String,Object> query=Map.of("action","WAREHOUSE_DISCOVERY","sourceAccount",config.getSourceAccount());
+            var task=new SelfopSyncTask();task.setSourceAccount(config.getSourceAccount());task.setRequestedBy(operator);
+            task.setRequestKey("manual:"+c.requestKey());task.setExecutionPurpose("VALIDATION");task.setTaskType("VALIDATION");
+            task.setTaskRole("ACCOUNT_DISCOVERY");task.setDiscoveryScopeId(account.getId());
+            task.setQueryScopeJson(json(query));task.setScopeHash(hash(query));task.setRequestHash(hash(Arrays.asList(c,task.getScopeHash())));
+            return taskService.create(task);
+        }
+        input(c.warehouseCode(),64,"仓库编码");
+        require(config.getWarehouses().containsKey(c.warehouseCode()),"SELFOP_WAREHOUSE_UNCONFIGURED");
+        if(c.action()==null||!Set.of("RETRY","INVENTORY","BACKFILL","RECHECK","REBUILD","VALIDATION").contains(c.action()))
+            throw new BizException("不支持此采集操作");
+        if("RETRY".equals(c.action())){input(c.taskNo(),64,"任务编号");input(c.reason(),500,"重试原因");
+            var original=tasks.selectOne(new QueryWrapper<SelfopSyncTask>().eq("task_no",c.taskNo()).eq("source_account",config.getSourceAccount()));require(original!=null,"SELFOP_TASK_SCOPE_MISMATCH");
+            require("WAREHOUSE_SYNC".equals(original.getTaskRole())&&c.warehouseCode().equals(original.getWarehouseCode()),"SELFOP_TASK_SCOPE_MISMATCH");
+            require(!"WAITING_SOURCE".equals(original.getStatus()),"SELFOP_RETRY_WAITING_SOURCE");
+            require("BUSINESS".equals(original.getExecutionPurpose())&&"BUSINESS".equals(config.getCollectionMode()),"SELFOP_BUSINESS_PURPOSE_REQUIRED");
+            require(!"test".equals(config.getEnvironment())||SelfopCollectionPolicy.controlledBusinessTask(original,tasks::selectById,SelfopCollectionPolicy.continuousBusiness(config)),"SELFOP_TEST_MANUAL_TASK_REQUIRED");
+            return taskService.retry(original.getId(),c.requestKey(),operator,c.reason());}
+        String purpose=SelfopCollectionPolicy.configuredPurpose(config);
+        require(("VALIDATION".equals(purpose))==("VALIDATION".equals(c.action())),"SELFOP_VALIDATION_ENTRY_REQUIRED");
+        if("RECHECK".equals(c.action())){input(c.customerCode(),64,"货主编码");input(c.deliveryNo(),128,"出库单号");}
+        if(Set.of("BACKFILL","VALIDATION").contains(c.action())){
+            require(c.sourceFrom()!=null&&c.sourceUntil()!=null&&c.sourceFrom().isBefore(c.sourceUntil()),"SELFOP_QUERY_WINDOW_INVALID");
+            require(!c.sourceUntil().isAfter(c.sourceFrom().plusDays(1)),"SELFOP_SLICE_MAX_ONE_DAY");
+            if(config.getSourceQueryTimezone()!=null){var source=ZoneId.of(config.getSourceQueryTimezone());
+                require(source.getRules().getValidOffsets(c.sourceFrom()).size()==1&&source.getRules().getValidOffsets(c.sourceUntil()).size()==1,"SELFOP_SOURCE_TIME_AMBIGUOUS");}
+        }
+        taskService.initialize();
+        var scope=scopes.selectOne(new QueryWrapper<SelfopSyncScope>().eq("source_account",config.getSourceAccount()).eq("warehouse_code",c.warehouseCode())
+            .eq("data_family","INVENTORY".equals(c.action())?"INVENTORY":"OUTBOUND"));
+        require(scope!=null,"SELFOP_SCOPE_MISSING");
+        var task=new SelfopSyncTask();task.setSourceAccount(config.getSourceAccount());task.setRequestedBy(operator);task.setRequestKey("manual:"+c.requestKey());
+        task.setExecutionPurpose(purpose);
+        task.setTaskType("INVENTORY".equals(c.action())?"BACKFILL":c.action());task.setScopeHash(scope.getScopeHash());
+        if(Set.of("INVENTORY","REBUILD").contains(c.action())){
+            task.setTaskRole("WAREHOUSE_SYNC");task.setScopeId(scope.getId());task.setWarehouseCode(c.warehouseCode());task.setQueryScopeJson(scope.getScopeJson());
+        }else{
+            var account=accounts.selectOne(new QueryWrapper<SelfopOutboundDiscoveryScope>().eq("source_account",config.getSourceAccount()));
+            require(account!=null,"SELFOP_SCOPE_MISSING");
+            task.setTaskRole("ACCOUNT_DISCOVERY");task.setDiscoveryScopeId(account.getId());
+            if("VALIDATION".equals(c.action())){
+                require(c.sourceFrom()!=null&&c.sourceUntil()!=null&&c.sourceFrom().isBefore(c.sourceUntil())&&!c.sourceUntil().isAfter(c.sourceFrom().plusDays(1)),"SELFOP_QUERY_WINDOW_INVALID");
+                task.setTaskType("VALIDATION");task.setQueryScopeJson(json(Map.of("action","VALIDATION","startTime",c.sourceFrom().toString(),"endTime",c.sourceUntil().toString(),"warehouses",List.of(c.warehouseCode()))));
+            }else if("RECHECK".equals(c.action())){identity(c.customerCode(),64);identity(c.deliveryNo(),128);
+                task.setQueryScopeJson(json(new SelfopDiscoveryService.Query(null,null,c.deliveryNo(),c.customerCode(),null)));
+            }else{
+                require(c.sourceFrom()!=null&&c.sourceUntil()!=null&&c.sourceFrom().isBefore(c.sourceUntil()),"SELFOP_QUERY_WINDOW_INVALID");
+                require(!c.sourceUntil().isAfter(c.sourceFrom().plusDays(1)),"SELFOP_SLICE_MAX_ONE_DAY");
+                task.setQueryScopeJson(json(new SelfopDiscoveryService.Query(c.sourceFrom().toString(),c.sourceUntil().toString(),null,null,null)));
+                if(config.getSourceQueryTimezone()!=null){
+                    ZoneId source=ZoneId.of(config.getSourceQueryTimezone());
+                    require(source.getRules().getValidOffsets(c.sourceFrom()).size()==1&&source.getRules().getValidOffsets(c.sourceUntil()).size()==1,"SELFOP_SOURCE_TIME_AMBIGUOUS");
+                    task.setQueryFromUtc(c.sourceFrom().atZone(source).withZoneSameInstant(ZoneOffset.UTC).toLocalDateTime());
+                    task.setQueryUntilUtc(c.sourceUntil().atZone(source).withZoneSameInstant(ZoneOffset.UTC).toLocalDateTime());
+                }
+            }
+        }
+        task.setRequestHash(hash(Arrays.asList(c,task.getScopeHash())));return taskService.create(task);
+    }
+    private static void input(String value,int max,String label){
+        if(value==null||value.isBlank()||value.length()>max)throw new BizException(label+"不能为空且不能超过"+max+"个字符");
+    }
+    private static final Map<String,String> REJECTIONS=Map.ofEntries(
+        Map.entry("BUSINESS_SESSION_ROOT_REQUIRED","该测试任务没有有效的会话预算，请新建有界任务"),
+        Map.entry("BUSINESS_SESSION_ROOT_INVALID","测试采集会话关联无效，请核对任务记录"),
+        Map.entry("BUSINESS_SESSION_IDENTITY_INVALID","测试采集会话不能重新指定预算或根任务"),
+        Map.entry("BUSINESS_SESSION_BUDGET_INVALID","测试采集会话预算无效，请核对任务记录"),
+        Map.entry("SELFOP_WAREHOUSE_UNCONFIGURED","该仓库尚未配置采集，暂不能提交任务"),
+        Map.entry("SELFOP_TASK_SCOPE_MISMATCH","任务不存在或不属于当前账号和仓库"),
+        Map.entry("SELFOP_TASK_MISSING","任务不存在，请刷新后重试"),
+        Map.entry("SELFOP_RETRY_WAITING_SOURCE","任务正在等待来源数据，暂不能重试"),
+        Map.entry("SELFOP_BUSINESS_PURPOSE_REQUIRED","验证任务不能通过正式采集重试恢复"),
+        Map.entry("SELFOP_VALIDATION_ENTRY_REQUIRED","当前采集模式与所选操作不一致，请使用对应入口"),
+        Map.entry("SELFOP_QUERY_WINDOW_INVALID","采集时间范围不能为空，结束时间必须晚于开始时间"),
+        Map.entry("SELFOP_SLICE_MAX_ONE_DAY","单次采集时间范围不能超过一天"),
+        Map.entry("SELFOP_SOURCE_TIME_AMBIGUOUS","来源时间存在时区歧义，请重新选择时间范围"),
+        Map.entry("SELFOP_SCOPE_MISSING","采集作用域尚未准备就绪，请联系管理员"),
+        Map.entry("SELFOP_WAREHOUSE_DISCOVERY_PARAMETERS","仓库目录发现仅接受请求标识和操作类型，不接受仓库或采集范围"),
+        Map.entry("SELFOP_IDEMPOTENCY_CONFLICT","请求标识已用于其他内容，请刷新后重新提交"),
+        Map.entry("SELFOP_RETRY_LEASE_BUSY","任务正在执行，暂不能重试"),
+        Map.entry("SELFOP_TASK_ALREADY_SUCCEEDED","任务已成功完成，无需重试"),
+        Map.entry("SELFOP_COLLECTION_MODE_REJECTED","当前采集模式不允许此操作"),
+        Map.entry("SELFOP_BUSINESS_ENVIRONMENT_REJECTED","当前环境不允许正式采集"),
+        Map.entry("SELFOP_TEST_MANUAL_TASK_REQUIRED","测试环境仅允许重试当前已启用的受控采集任务"),
+        Map.entry("SELFOP_BUDGET_INVALID","采集预算配置无效，请联系管理员"));
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/sync/SelfopDiscoveryService.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/sync/SelfopDiscoveryService.java
new file mode 100644
index 000000000..5a65e13d3
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/sync/SelfopDiscoveryService.java
@@ -0,0 +1,338 @@
+package com.baiyue.lastleg.selfoperated.analytics.sync;
+
+import com.baomidou.mybatisplus.core.conditions.query.QueryWrapper;
+import com.baomidou.mybatisplus.core.conditions.update.UpdateWrapper;
+import com.baomidou.mybatisplus.core.toolkit.IdWorker;
+import com.baiyue.lastleg.selfoperated.analytics.client.LingxingAnalyticsClient;
+import com.baiyue.lastleg.selfoperated.analytics.client.AnalyticsClientException;
+import com.baiyue.lastleg.selfoperated.analytics.outbound.OutboundPolicy;
+import com.baiyue.lastleg.selfoperated.analytics.mapper.*;
+import com.baiyue.lastleg.selfoperated.analytics.model.*;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.support.TransactionTemplate;
+import java.time.LocalDateTime;
+import java.util.*;
+import static com.baiyue.lastleg.selfoperated.analytics.model.SelfopSupport.*;
+
+@Service
+public class SelfopDiscoveryService {
+    public record Query(String startTime,String endTime,String deliveryNo,String customerCode,Long parentTaskId) { }
+    private final LingxingAnalyticsClient client;
+    private final SelfopSyncTaskMapper tasks;
+    private final SelfopSyncRunMapper runs;
+    private final SelfopSyncStageMapper stages;
+    private final SelfopOutboundOrderMapper orders;
+    private final SelfopSyncScopeMapper scopes;
+    private final SelfopOutboundDiscoveryScopeMapper accounts;
+    private final SelfopTaskService taskService;
+    private final SelfopLeaseService leases;
+    private final SelfopAnalyticsProperties config;
+    private final TransactionTemplate tx;
+    public SelfopDiscoveryService(LingxingAnalyticsClient client,SelfopSyncTaskMapper tasks,SelfopSyncRunMapper runs,
+        SelfopSyncStageMapper stages,SelfopOutboundOrderMapper orders,SelfopSyncScopeMapper scopes,
+        SelfopOutboundDiscoveryScopeMapper accounts,SelfopTaskService taskService,SelfopLeaseService leases,
+        SelfopAnalyticsProperties config,TransactionTemplate tx) {
+        this.client=client;this.tasks=tasks;this.runs=runs;this.stages=stages;this.orders=orders;this.scopes=scopes;
+        this.accounts=accounts;this.taskService=taskService;this.leases=leases;this.config=config;this.tx=tx;
+    }
+    /** Network requests are outside tx; every accepted cursor/stage write checks the account fence again. */
+    public void collect(SelfopSyncTask task,SelfopSyncRun run,SelfopLeaseService.Lease lease) {
+        SelfopCollectionPolicy.requireBusiness(task);SelfopCollectionPolicy.requireBusiness(run);
+        var a=accounts.selectById(task.getDiscoveryScopeId());var budget=new SelfopBudget(a.getRequestBudget(),a.getTimeBudgetSeconds());
+        collect(task,run,lease,budget);
+    }
+    private void collect(SelfopSyncTask task,SelfopSyncRun run,SelfopLeaseService.Lease lease,SelfopBudget budget) {
+        Query query=read(task.getQueryScopeJson(),Query.class);
+        var manifest=task.getRoutingManifestJson()==null?new SelfopRoutingManifest():read(task.getRoutingManifestJson(),SelfopRoutingManifest.class);
+        if(manifest.getListPayloadVersion()==0) {
+            if(!manifest.isDirectoryComplete()) {
+                manifest.setScan(1);manifest.setNextPage(1);manifest.setPages(null);manifest.setTotal(null);
+                manifest.getObjects().clear();manifest.getFirstScan().clear();
+            }
+            manifest.setListPayloadVersion(1);
+        }
+        if(query.deliveryNo()!=null) {if(!collectLocated(task,run,lease,budget,query,manifest))return;}
+        else {
+            while(!manifest.isDirectoryComplete()) {
+                if(!budget.take()){taskService.yield(task.getId(),run.getId(),lease);return;}
+                leases.renew(lease);
+                var page=client.discover(SelfopRequestContext.forTask(task,run,config),LocalDateTime.parse(query.startTime()),LocalDateTime.parse(query.endTime()),manifest.getNextPage(),config.getPageSize());
+                require(page.current()==manifest.getNextPage()&&page.size()==config.getPageSize(),"SELFOP_PAGE_MISMATCH");
+                require(page.total()!=null&&page.pages()!=null,"SELFOP_PAGE_METADATA_MISSING");
+                if(manifest.getTotal()==null){manifest.setTotal(page.total());manifest.setPages(page.pages());}
+                require(Objects.equals(manifest.getTotal(),page.total())&&Objects.equals(manifest.getPages(),page.pages()),"SELFOP_PAGE_TOTAL_CHANGED");
+                tx.executeWithoutResult(s->{var checkpoint=taskService.checkpoint(task,run,lease);
+                    for(var summary:page.records()) {
+                        identity(summary.customerCode(),64);identity(summary.deliveryNo(),128);identity(summary.warehouseCode(),64);
+                        String key=hash(List.of(task.getSourceAccount(),summary.customerCode(),summary.deliveryNo()));String content=hash(summary);
+                        if(manifest.getScan()==1){
+                            require(!manifest.getFirstScan().containsKey(key),"SELFOP_DIRECTORY_DUPLICATE");manifest.getFirstScan().put(key,content);
+                            var payload=new SelfopPayloads.Order(task.getSourceAccount(),summary.customerCode(),summary.warehouseCode(),summary.deliveryNo(),summary.sourceNo(),summary.sourceStatus(),summary.sourceCreatedTime(),summary.sourceOutboundTime(),summary.items());
+                            var stage=stage(task,run,payload,manifest.getNextPage(),null,"PENDING");
+                            var prior=stages.selectOne(new QueryWrapper<SelfopSyncStage>().eq("stage_batch_id",task.getId()).eq("object_type","OUTBOUND_ORDER").eq("object_key_hash",key));
+                            if(prior==null)stages.insert(stage);else if("PENDING".equals(prior.getValidationStatus())){
+                                stage.setId(prior.getId());stage.setRunId(prior.getRunId());stage.setCreatedAt(prior.getCreatedAt());stages.updateById(stage);
+                            }else stage=prior;
+                            var entry=new SelfopRoutingManifest.Entry();entry.setCustomerCode(summary.customerCode());entry.setDeliveryNo(summary.deliveryNo());
+                            entry.setWarehouseCode(summary.warehouseCode());entry.setDirectoryStageId(stage.getId());manifest.getObjects().put(key,entry);
+                        }else{
+                            require(Objects.equals(manifest.getFirstScan().get(key),content),"SELFOP_DIRECTORY_UNSTABLE");
+                            require(!manifest.getObjects().containsKey("seen:"+key),"SELFOP_DIRECTORY_DUPLICATE");
+                            manifest.getObjects().put("seen:"+key,new SelfopRoutingManifest.Entry());
+                        }
+                    }
+                    manifest.setNextPage(manifest.getNextPage()+1);
+                    if(manifest.getPages()==0||manifest.getNextPage()>manifest.getPages()) {
+                        long count=manifest.getScan()==1?manifest.getFirstScan().size():manifest.getObjects().keySet().stream().filter(k->k.startsWith("seen:")).count();
+                        require(count==manifest.getTotal(),"SELFOP_DIRECTORY_COUNT_MISMATCH");
+                        if(manifest.getScan()==1){manifest.setScan(2);manifest.setNextPage(1);}
+                        else{manifest.getObjects().keySet().removeIf(k->k.startsWith("seen:"));manifest.setDirectoryComplete(true);}
+                    }
+                    saveManifest(checkpoint.task(),checkpoint.run(),manifest);
+                });
+            }
+        }
+        route(task,run,manifest,lease,false);
+        var entries=new ArrayList<>(manifest.getObjects().entrySet());
+        for(int index=0;index<entries.size();index++) {
+            if(!budget.hasTime()){taskService.yield(task.getId(),run.getId(),lease);return;}
+            int accepted=acceptListBatch(task,run,lease,manifest,entries,index);
+            if(accepted>0){index+=accepted-1;continue;}
+            var entry=entries.get(index);
+            var ref=entry.getValue();
+            if(ref.getRefreshTaskId()!=null){
+                var refresh=tasks.selectById(ref.getRefreshTaskId());require(refresh!=null,"SELFOP_REFRESH_TASK_MISSING");
+                if(!"SUCCEEDED".equals(refresh.getStatus())){
+                    var refreshRun=taskService.begin(refresh.getId(),lease);refresh=tasks.selectById(refresh.getId());collect(refresh,refreshRun,lease,budget);
+                    refresh=tasks.selectById(refresh.getId());
+                    if(!"SUCCEEDED".equals(refresh.getStatus())){taskService.yield(task.getId(),run.getId(),lease);return;}
+                }
+                var refreshed=read(refresh.getRoutingManifestJson(),SelfopRoutingManifest.class).getObjects().get(entry.getKey());
+                require(refreshed!=null&&refreshed.getEffectiveStageId()!=null,"SELFOP_REFRESH_REFERENCE_MISSING");
+                ref.setEffectiveStageId(refreshed.getEffectiveStageId());ref.setWarehouseCode(refreshed.getWarehouseCode());
+                tx.executeWithoutResult(s->{var checkpoint=taskService.checkpoint(task,run,lease);saveManifest(checkpoint.task(),checkpoint.run(),manifest);});
+            }
+            var latest=stages.selectOne(new QueryWrapper<SelfopSyncStage>().eq("object_type","OUTBOUND_ORDER")
+                .eq("object_key_hash",entry.getKey()).eq("validation_status","VALID").isNotNull("observation_sequence").orderByDesc("observation_sequence").last("LIMIT 1"));
+            var effective=ref.getEffectiveStageId()==null?null:stages.selectById(ref.getEffectiveStageId());
+            boolean newer=latest!=null&&(effective==null?latest.getObservationSequence()>task.getObservationBaseline():latest.getObservationSequence()>effective.getObservationSequence());
+            if(effective!=null&&!newer) continue;
+            leases.renew(lease);
+            SelfopSyncTask fetchTask=task;SelfopSyncRun fetchRun=run;
+            if(newer){
+                var recheck=new SelfopSyncTask();recheck.setSourceAccount(task.getSourceAccount());recheck.setTaskRole("ACCOUNT_DISCOVERY");
+                recheck.setExecutionPurpose(task.getExecutionPurpose());
+                recheck.setDiscoveryScopeId(task.getDiscoveryScopeId());recheck.setTaskType("RECHECK");recheck.setScopeHash(task.getScopeHash());
+                recheck.setRequestKey("refresh:"+task.getId()+":"+entry.getKey().substring(0,24)+":"+latest.getObservationSequence());
+                recheck.setQueryScopeJson(json(new Query(null,null,ref.getDeliveryNo(),ref.getCustomerCode(),task.getId())));recheck.setRequestHash(hash(recheck.getQueryScopeJson()));
+                fetchTask=taskService.create(recheck);ref.setRefreshTaskId(fetchTask.getId());ref.setNewestSeenSequence(latest.getObservationSequence());
+                fetchRun=taskService.begin(fetchTask.getId(),lease);
+                fetchTask.setAttemptCount(fetchRun.getAttemptNo());fetchTask.setStatus("RUNNING");
+            }
+            if(newer){
+                tx.executeWithoutResult(s->{var checkpoint=taskService.checkpoint(task,run,lease);saveManifest(checkpoint.task(),checkpoint.run(),manifest);});
+                collect(fetchTask,fetchRun,lease,budget);
+                var refreshedTask=tasks.selectById(fetchTask.getId());
+                if(!"SUCCEEDED".equals(refreshedTask.getStatus())){taskService.yield(task.getId(),run.getId(),lease);return;}
+                var refreshed=read(refreshedTask.getRoutingManifestJson(),SelfopRoutingManifest.class).getObjects().get(entry.getKey());
+                require(refreshed!=null&&refreshed.getEffectiveStageId()!=null,"SELFOP_REFRESH_REFERENCE_MISSING");
+                ref.setEffectiveStageId(refreshed.getEffectiveStageId());ref.setWarehouseCode(refreshed.getWarehouseCode());
+                tx.executeWithoutResult(s->{var checkpoint=taskService.checkpoint(task,run,lease);saveManifest(checkpoint.task(),checkpoint.run(),manifest);});
+                continue;
+            }
+            var directoryStage=ref.getDirectoryStageId()==null?null:stages.selectById(ref.getDirectoryStageId());
+            SelfopPayloads.Order detail=directoryStage==null?null:read(directoryStage.getPayloadJson(),SelfopPayloads.Order.class);
+            long observation;
+            if(detail==null||LingxingAnalyticsClient.needsDetail(detail)) {
+                if(!budget.take()){taskService.yield(task.getId(),run.getId(),lease);return;}
+                observation=leases.nextObservation(lease);
+                try {detail=client.detail(SelfopRequestContext.forTask(fetchTask,fetchRun,config),ref.getWarehouseCode(),ref.getCustomerCode(),ref.getDeliveryNo());}
+                catch(AnalyticsClientException staleIdentity){
+                    if(!Set.of("DETAIL_IDENTITY_MISMATCH","INTEGRATION_DATA_MISSING","LINGXING_WMS_SOURCE_REJECTED","LINGXING_WMS_INVALID_RESPONSE").contains(staleIdentity.code())||staleIdentity.retryable())throw staleIdentity;
+                    var relocate=new SelfopSyncTask();relocate.setSourceAccount(task.getSourceAccount());relocate.setTaskRole("ACCOUNT_DISCOVERY");relocate.setDiscoveryScopeId(task.getDiscoveryScopeId());
+                    relocate.setExecutionPurpose(task.getExecutionPurpose());
+                    relocate.setTaskType("RECHECK");relocate.setScopeHash(task.getScopeHash());relocate.setRequestKey("relocate:"+task.getId()+":"+entry.getKey().substring(0,24)+":"+observation);
+                    var locateQuery=new Query(null,null,ref.getDeliveryNo(),ref.getCustomerCode(),task.getId());relocate.setQueryScopeJson(json(locateQuery));relocate.setRequestHash(hash(relocate.getQueryScopeJson()));
+                    fetchTask=taskService.create(relocate);fetchRun=taskService.begin(fetchTask.getId(),lease);ref.setRefreshTaskId(fetchTask.getId());
+                    fetchTask.setAttemptCount(fetchRun.getAttemptNo());fetchTask.setStatus("RUNNING");
+                    tx.executeWithoutResult(s->{var checkpoint=taskService.checkpoint(task,run,lease);saveManifest(checkpoint.task(),checkpoint.run(),manifest);});
+                    var located=new SelfopRoutingManifest();located.setListPayloadVersion(1);
+                    if(!collectLocated(fetchTask,fetchRun,lease,budget,locateQuery,located)){tx.executeWithoutResult(s->{var checkpoint=taskService.checkpoint(task,run,lease);saveManifest(checkpoint.task(),checkpoint.run(),manifest);});taskService.yield(task.getId(),run.getId(),lease);return;}
+                    ref.setWarehouseCode(located.getObjects().values().iterator().next().getWarehouseCode());
+                    tx.executeWithoutResult(s->{var checkpoint=taskService.checkpoint(task,run,lease);saveManifest(checkpoint.task(),checkpoint.run(),manifest);});
+                    var locatedRef=located.getObjects().values().iterator().next();
+                    var locatedStage=stages.selectById(locatedRef.getDirectoryStageId());
+                    detail=read(locatedStage.getPayloadJson(),SelfopPayloads.Order.class);
+                    if(LingxingAnalyticsClient.needsDetail(detail)) {
+                        if(!budget.take()){taskService.yield(fetchTask.getId(),fetchRun.getId(),lease);taskService.yield(task.getId(),run.getId(),lease);return;}
+                        detail=client.detail(SelfopRequestContext.forTask(fetchTask,fetchRun,config),ref.getWarehouseCode(),ref.getCustomerCode(),ref.getDeliveryNo());
+                    }
+                    observation=leases.nextObservation(lease);
+                }
+            } else observation=leases.nextObservation(lease);
+            require(Objects.equals(detail.sourceAccount(),task.getSourceAccount())&&Objects.equals(detail.customerCode(),ref.getCustomerCode())
+                &&Objects.equals(detail.deliveryNo(),ref.getDeliveryNo()),"SELFOP_DETAIL_IDENTITY_MISMATCH");
+            require(detail.items()!=null&&detail.sourceStatus()!=null,"SELFOP_DETAIL_STRUCTURE_INVALID");
+            identity(detail.warehouseCode(),64);
+            var finalFetchTask=fetchTask;var finalFetchRun=fetchRun;var acceptedDetail=detail;long acceptedObservation=observation;
+            tx.executeWithoutResult(s->{var checkpoint=taskService.checkpoint(task,run,lease);
+                var fetchCheckpoint=finalFetchTask.getId().equals(task.getId())?checkpoint:taskService.checkpoint(finalFetchTask,finalFetchRun,lease);
+                var currentFetchTask=fetchCheckpoint.task();var currentFetchRun=fetchCheckpoint.run();
+                var existing=stages.selectOne(new QueryWrapper<SelfopSyncStage>().eq("stage_batch_id",finalFetchTask.getId()).eq("object_type","OUTBOUND_ORDER").eq("object_key_hash",entry.getKey()));
+                SelfopSyncStage full;
+                if(existing!=null&&"VALID".equals(existing.getValidationStatus())){
+                    require(existing.getContentHash().equals(SelfopOutboundFingerprint.order(acceptedDetail)),"SELFOP_VALID_STAGE_IMMUTABLE");full=existing;
+                }else{
+                    full=stage(finalFetchTask,finalFetchRun,acceptedDetail,existing==null?1:existing.getFirstPageNo(),acceptedObservation,"VALID");
+                    if(existing!=null){full.setId(existing.getId());full.setRunId(existing.getRunId());full.setCreatedAt(existing.getCreatedAt());stages.updateById(full);}else stages.insert(full);
+                }
+                ref.setEffectiveStageId(full.getId());ref.setWarehouseCode(acceptedDetail.warehouseCode());saveManifest(checkpoint.task(),checkpoint.run(),manifest,existing==null||!"VALID".equals(existing.getValidationStatus()));
+                if(!currentFetchTask.getId().equals(task.getId())){var refreshManifest=new SelfopRoutingManifest();refreshManifest.setDirectoryComplete(true);refreshManifest.setPages(1);refreshManifest.setTotal(1L);
+                    var refreshRef=new SelfopRoutingManifest.Entry();refreshRef.setCustomerCode(ref.getCustomerCode());refreshRef.setDeliveryNo(ref.getDeliveryNo());refreshRef.setWarehouseCode(ref.getWarehouseCode());refreshRef.setEffectiveStageId(full.getId());
+                    refreshManifest.getObjects().put(entry.getKey(),refreshRef);currentFetchTask.setRoutingManifestJson(json(refreshManifest));
+                    SelfopProgressProjection.applyCheckpoint(currentFetchTask,currentFetchRun,"DETAIL","ORDER",1,1L,refreshManifest.getScan(),existing==null||!"VALID".equals(existing.getValidationStatus()));
+                    SelfopProgressProjection.freezeRun(currentFetchTask,currentFetchRun);currentFetchRun.setStatus("ROUTED");currentFetchRun.setFetchFinishedAtUtc(utcNow());currentFetchRun.setFinishedAtUtc(utcNow());currentFetchRun.setUpdatedAt(utcNow());runs.updateById(currentFetchRun);
+                    currentFetchTask.setStatus("SUCCEEDED");currentFetchTask.setUpdatedAt(utcNow());tasks.updateById(currentFetchTask);}
+            });
+        }
+        // Child tasks stay WAITING_SOURCE until all orders are resolved. Rebuilding every
+        // warehouse manifest after each order made this loop quadratic in directory size.
+        // A resumed attempt projects its current references before entering the loop.
+        // A directory warehouse is provisional until every account order (including resumed
+        // revision checks) has resolved. An empty warehouse must not publish a false zero early.
+        route(task,run,manifest,lease,true);
+        tx.executeWithoutResult(s->{var checkpoint=taskService.checkpoint(task,run,lease);var currentTask=checkpoint.task();var currentRun=checkpoint.run();var now=utcNow();
+            SelfopCollectionPolicy.requireBusiness(currentTask);SelfopCollectionPolicy.requireBusiness(currentRun);SelfopProgressProjection.freezeRun(currentTask,currentRun);
+            currentRun.setStatus("ROUTED");currentRun.setCoverageStatus("COMPLETE");currentRun.setPageCount(manifest.getPages()==null?0:manifest.getPages()*2);
+            currentRun.setSourceTotalCount(manifest.getTotal());currentRun.setUniqueObjectCount((long)manifest.getObjects().size());currentRun.setFetchFinishedAtUtc(now);currentRun.setFinishedAtUtc(now);currentRun.setUpdatedAt(now);runs.updateById(currentRun);
+            currentTask.setStatus("SUCCEEDED");currentTask.setUpdatedAt(now);tasks.updateById(currentTask);
+            var account=accounts.selectOne(new QueryWrapper<SelfopOutboundDiscoveryScope>().eq("id",task.getDiscoveryScopeId()).last("FOR UPDATE"));
+            if(task.getQueryFromUtc()!=null&&task.getQueryUntilUtc()!=null&&
+                (account.getCatalogUntilUtc()==null||!task.getQueryFromUtc().isAfter(account.getCatalogUntilUtc()))) {
+                account.setCatalogFromUtc(account.getCatalogFromUtc()==null?task.getQueryFromUtc():account.getCatalogFromUtc());
+                account.setCatalogUntilUtc(account.getCatalogUntilUtc()==null||task.getQueryUntilUtc().isAfter(account.getCatalogUntilUtc())?task.getQueryUntilUtc():account.getCatalogUntilUtc());
+                account.setUpdatedAt(now);accounts.update(null,new UpdateWrapper<SelfopOutboundDiscoveryScope>().eq("id",account.getId())
+                    .set("catalog_from_utc",account.getCatalogFromUtc()).set("catalog_until_utc",account.getCatalogUntilUtc()).set("updated_at",now));}
+        });
+    }
+    /** Complete list rows need one bounded transaction/checkpoint per batch, not per order.
+     * Missing data, resumed references and newer revisions still follow the individual resolution path.
+     * Stages and their manifest references commit together; no network call occurs in this transaction. */
+    private int acceptListBatch(SelfopSyncTask task,SelfopSyncRun run,SelfopLeaseService.Lease lease,
+            SelfopRoutingManifest manifest,List<Map.Entry<String,SelfopRoutingManifest.Entry>> entries,int start) {
+        var candidates=new ArrayList<Map.Entry<String,SelfopRoutingManifest.Entry>>();
+        for(int i=start;i<Math.min(entries.size(),start+100);i++) {
+            var e=entries.get(i);var ref=e.getValue();
+            if(ref.getEffectiveStageId()!=null||ref.getRefreshTaskId()!=null||ref.getDirectoryStageId()==null)break;
+            candidates.add(e);
+        }
+        if(candidates.isEmpty())return 0;
+        var directory=new HashMap<Long,SelfopSyncStage>();
+        stages.selectList(new QueryWrapper<SelfopSyncStage>().in("id",candidates.stream().map(e->e.getValue().getDirectoryStageId()).toList()))
+            .forEach(s->directory.put(s.getId(),s));
+        var revised=new HashSet<String>();
+        stages.selectList(new QueryWrapper<SelfopSyncStage>().select("object_key_hash").eq("object_type","OUTBOUND_ORDER")
+            .in("object_key_hash",candidates.stream().map(Map.Entry::getKey).toList()).eq("validation_status","VALID")
+            .gt("observation_sequence",task.getObservationBaseline())).forEach(s->revised.add(s.getObjectKeyHash()));
+        var payloads=new ArrayList<SelfopPayloads.Order>();
+        for(var e:candidates) {
+            var s=directory.get(e.getValue().getDirectoryStageId());
+            if(s==null||!Objects.equals(s.getStageBatchId(),task.getId())||!"PENDING".equals(s.getValidationStatus())||revised.contains(e.getKey()))break;
+            var p=read(s.getPayloadJson(),SelfopPayloads.Order.class);
+            if(p==null||LingxingAnalyticsClient.needsDetail(p))break;
+            require(Objects.equals(p.sourceAccount(),task.getSourceAccount())&&Objects.equals(p.customerCode(),e.getValue().getCustomerCode())
+                &&Objects.equals(p.deliveryNo(),e.getValue().getDeliveryNo()),"SELFOP_DETAIL_IDENTITY_MISMATCH");
+            require(p.sourceStatus()!=null,"SELFOP_DETAIL_STRUCTURE_INVALID");identity(p.warehouseCode(),64);
+            payloads.add(p);
+        }
+        if(payloads.isEmpty())return 0;
+        leases.renew(lease);
+        tx.executeWithoutResult(s->{
+            var checkpoint=taskService.checkpoint(task,run,lease);
+            long first=leases.nextObservations(lease,payloads.size());
+            for(int i=0;i<payloads.size();i++) {
+                var ref=candidates.get(i).getValue();var old=directory.get(ref.getDirectoryStageId());var p=payloads.get(i);
+                var full=stage(task,run,p,old.getFirstPageNo(),first+i,"VALID");
+                full.setId(old.getId());full.setRunId(old.getRunId());full.setCreatedAt(old.getCreatedAt());
+                require(stages.updateById(full)==1,"SELFOP_STAGE_MISSING");
+                ref.setEffectiveStageId(full.getId());ref.setWarehouseCode(p.warehouseCode());
+            }
+            saveManifest(checkpoint.task(),checkpoint.run(),manifest,true);
+        });
+        return payloads.size();
+    }
+    private boolean collectLocated(SelfopSyncTask task,SelfopSyncRun run,SelfopLeaseService.Lease lease,SelfopBudget budget,Query query,SelfopRoutingManifest manifest) {
+        if(manifest.isDirectoryComplete())return true;
+        // Identity relocation consumes the full paginated result before trusting one match.
+        while(!manifest.isDirectoryComplete()){
+            if(!budget.take()){taskService.yield(task.getId(),run.getId(),lease);return false;}leases.renew(lease);
+            var page=client.locate(SelfopRequestContext.forTask(task,run,config),query.deliveryNo(),manifest.getNextPage(),config.getPageSize());
+            require(page.total()!=null&&page.pages()!=null,"SELFOP_PAGE_METADATA_MISSING");
+            if(manifest.getTotal()==null){manifest.setTotal(page.total());manifest.setPages(page.pages());}
+            require(Objects.equals(manifest.getTotal(),page.total())&&Objects.equals(manifest.getPages(),page.pages()),"SELFOP_PAGE_TOTAL_CHANGED");
+            for(var summary:page.records())if(query.deliveryNo().equals(summary.deliveryNo())&&query.customerCode().equals(summary.customerCode())){
+                String key=hash(List.of(task.getSourceAccount(),summary.customerCode(),summary.deliveryNo()));require(!manifest.getObjects().containsKey(key),"SELFOP_LOCATE_AMBIGUOUS");
+                var e=new SelfopRoutingManifest.Entry();e.setCustomerCode(summary.customerCode());e.setDeliveryNo(summary.deliveryNo());e.setWarehouseCode(summary.warehouseCode());
+                tx.executeWithoutResult(s->{taskService.checkpoint(task,run,lease);
+                    var pending=stage(task,run,summary.order(),manifest.getNextPage(),null,"PENDING");
+                    var prior=stages.selectOne(new QueryWrapper<SelfopSyncStage>().eq("stage_batch_id",task.getId()).eq("object_type","OUTBOUND_ORDER").eq("object_key_hash",key));
+                    if(prior==null)stages.insert(pending);else pending=prior;
+                    e.setDirectoryStageId(pending.getId());});
+                manifest.getObjects().put(key,e);}
+            manifest.setNextPage(manifest.getNextPage()+1);if(page.pages()==0||manifest.getNextPage()>page.pages()){
+                require(manifest.getObjects().size()==1,"SELFOP_LOCATE_UNRESOLVED");manifest.setDirectoryComplete(true);}
+            tx.executeWithoutResult(s->{var checkpoint=taskService.checkpoint(task,run,lease);saveManifest(checkpoint.task(),checkpoint.run(),manifest);});
+        }
+        return true;
+    }
+    private SelfopSyncStage stage(SelfopSyncTask task,SelfopSyncRun run,SelfopPayloads.Order payload,int page,Long observation,String status){
+        var s=new SelfopSyncStage();s.setId(IdWorker.getId());s.setRunId(run.getId());s.setStageBatchId(task.getId());s.setLastFetchRunId(run.getId());
+        s.setObservationSequence(observation);s.setWarehouseCode(payload.warehouseCode());s.setObjectType("OUTBOUND_ORDER");
+        s.setObjectKeyHash(hash(List.of(payload.sourceAccount(),payload.customerCode(),payload.deliveryNo())));s.setFirstPageNo(page);s.setObservedAtUtc(utcNow());
+        s.setContentHash(SelfopOutboundFingerprint.order(payload));s.setPayloadJson(json(payload));s.setValidationStatus(status);s.setCreatedAt(utcNow());s.setUpdatedAt(utcNow());return s;
+    }
+    private void saveManifest(SelfopSyncTask task,SelfopSyncRun active,SelfopRoutingManifest manifest){
+        // Directory pages are freshly fetched. Detail reference reuse cannot establish throughput.
+        saveManifest(task,active,manifest,!manifest.isDirectoryComplete());
+    }
+    private void saveManifest(SelfopSyncTask task,SelfopSyncRun active,SelfopRoutingManifest manifest,boolean realWork){
+        task.setRoutingManifestJson(json(manifest));task.setUpdatedAt(utcNow());
+        SelfopProgressProjection.applyCheckpoint(task,active,manifest.isDirectoryComplete()?"DETAIL":"DIRECTORY",manifest.isDirectoryComplete()?"ORDER":"PAGE",
+            manifest.isDirectoryComplete()?manifest.getObjects().values().stream().filter(e->e.getEffectiveStageId()!=null).count():Math.max(0,manifest.getNextPage()-1),
+            manifest.isDirectoryComplete()?(long)manifest.getObjects().size():manifest.getPages()==null?null:manifest.getPages().longValue(),manifest.getScan(),realWork);
+        runs.updateById(active);tasks.updateById(task);
+    }
+    private void route(SelfopSyncTask parent,SelfopSyncRun parentRun,SelfopRoutingManifest manifest,SelfopLeaseService.Lease lease,boolean detailsResolved){
+        // Refresh commands only replace a parent manifest reference; never create an independent
+        // fact writer that could publish around that parent's half-applied barrier.
+        if(read(parent.getQueryScopeJson(),Query.class).parentTaskId()!=null)return;
+        tx.executeWithoutResult(s->{taskService.checkpoint(parent,parentRun,lease);if(!manifest.isDirectoryComplete())return;
+            boolean accountDetailsReady=detailsResolved&&manifest.getObjects().values().stream().allMatch(e->e.getEffectiveStageId()!=null);
+            for(var scope:scopes.selectList(new QueryWrapper<SelfopSyncScope>().eq("source_account",parent.getSourceAccount()).eq("data_family","OUTBOUND"))){
+                if(!config.getWarehouses().containsKey(scope.getWarehouseCode()))continue;
+                var own=new SelfopRoutingManifest();own.setDirectoryComplete(true);own.setTotal(0L);own.setPages(manifest.getPages());
+                for(var e:manifest.getObjects().entrySet()){
+                    var ref=e.getValue();var previous=orders.selectOne(new QueryWrapper<SelfopOutboundOrder>().eq("source_account",parent.getSourceAccount()).eq("customer_code",ref.getCustomerCode()).eq("delivery_no",ref.getDeliveryNo()));
+                    if(scope.getWarehouseCode().equals(ref.getWarehouseCode())||(previous!=null&&scope.getWarehouseCode().equals(previous.getWarehouseCode()))){
+                        boolean belongs=true;
+                        if(ref.getEffectiveStageId()!=null){var payload=read(stages.selectById(ref.getEffectiveStageId()).getPayloadJson(),SelfopPayloads.Order.class);
+                            belongs=OutboundPolicy.belongsToSlice(payload,scope,parent.getQueryFromUtc(),parent.getQueryUntilUtc(),previous!=null,parent.getTaskType());}
+                        if(belongs)own.getObjects().put(e.getKey(),ref);
+                    }
+                }
+                own.setTotal((long)own.getObjects().size());
+                boolean ready=accountDetailsReady&&scope.getSourceTimezone()!=null
+                    &&(parent.getQueryFromUtc()==null||Objects.equals(scope.getSourceTimezone(),config.getSourceQueryTimezone()));
+                var child=new SelfopSyncTask();child.setSourceAccount(parent.getSourceAccount());child.setTaskRole("WAREHOUSE_SYNC");child.setScopeId(scope.getId());child.setWarehouseCode(scope.getWarehouseCode());
+                child.setExecutionPurpose(parent.getExecutionPurpose());
+                child.setUpstreamTaskId(parent.getId());child.setDiscoverySequence(parent.getDiscoverySequence());child.setObservationBaseline(parent.getObservationBaseline());
+                child.setRequestKey("route:"+parent.getId()+":"+scope.getWarehouseCode());child.setTaskType(parent.getTaskType());child.setQueryFromUtc(parent.getQueryFromUtc());child.setQueryUntilUtc(parent.getQueryUntilUtc());
+                child.setQueryScopeJson(scope.getScopeJson());child.setScopeHash(scope.getScopeHash());child.setRequestHash(hash(List.of(parent.getId(),scope.getScopeHash())));child.setStatus(ready?"READY":"WAITING_SOURCE");child.setApplyState("NOT_STARTED");
+                var saved=taskService.create(child);
+                if(!Set.of("SUCCEEDED","DEAD","SAMPLE_DONE").contains(saved.getStatus())&& !Set.of("APPLYING","APPLIED","BLOCKED").contains(saved.getApplyState())){
+                    saved.setRoutingManifestJson(json(own));saved.setStatus(ready?"READY":"WAITING_SOURCE");
+                    SelfopProgressProjection.localWorkReady(saved,ready);saved.setUpdatedAt(utcNow());tasks.updateById(saved);}
+            }
+        });
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/sync/SelfopExecutionService.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/sync/SelfopExecutionService.java
new file mode 100644
index 000000000..482600e2b
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/sync/SelfopExecutionService.java
@@ -0,0 +1,109 @@
+package com.baiyue.lastleg.selfoperated.analytics.sync;
+
+import com.baomidou.mybatisplus.core.conditions.query.QueryWrapper;
+import com.baiyue.lastleg.selfoperated.analytics.client.AnalyticsClientException;
+import com.baiyue.lastleg.selfoperated.analytics.mapper.*;
+import com.baiyue.lastleg.selfoperated.analytics.model.*;
+import com.baiyue.lastleg.selfoperated.analytics.outbound.*;
+import com.baiyue.lastleg.selfoperated.analytics.inventory.InventorySnapshotService;
+import org.springframework.stereotype.Service;
+import java.util.*;
+import static com.baiyue.lastleg.selfoperated.analytics.model.SelfopSupport.*;
+
+@Service
+public class SelfopExecutionService {
+    private static final org.slf4j.Logger LOG=org.slf4j.LoggerFactory.getLogger(SelfopExecutionService.class);
+    private final SelfopAnalyticsProperties config;
+    private final SelfopTaskService taskService;
+    private final SelfopLeaseService leases;
+    private final SelfopDiscoveryService discovery;
+    private final SelfopInventoryCollector stock;
+    private final SelfopMasterDataCollector masterData;
+    private final InventorySnapshotService snapshots;
+    private final OutboundFactService facts;
+    private final OutboundCandidateBuilder candidates;
+    private final SelfopSalesPublisher publisher;
+    private final SelfopSyncScopeMapper scopes;
+    private final SelfopSyncTaskMapper tasks;
+    private final SelfopSyncStageMapper stages;
+    private final SelfopOutboundOrderMapper orders;
+    private final SelfopReferenceRecovery recovery;
+    private final SelfopValidationRunner validation;
+    private final SelfopSyncRunMapper runs;
+    public SelfopExecutionService(SelfopAnalyticsProperties config,SelfopTaskService taskService,SelfopLeaseService leases,
+        SelfopDiscoveryService discovery,SelfopInventoryCollector stock,InventorySnapshotService snapshots,OutboundFactService facts,
+        OutboundCandidateBuilder candidates,SelfopSalesPublisher publisher,SelfopSyncScopeMapper scopes,SelfopSyncTaskMapper tasks,
+        SelfopSyncStageMapper stages,SelfopOutboundOrderMapper orders,SelfopReferenceRecovery recovery,SelfopValidationRunner validation,SelfopSyncRunMapper runs,SelfopMasterDataCollector masterData){
+        this.config=config;this.taskService=taskService;this.leases=leases;this.discovery=discovery;this.stock=stock;this.snapshots=snapshots;
+        this.facts=facts;this.candidates=candidates;this.publisher=publisher;this.scopes=scopes;this.tasks=tasks;this.stages=stages;this.orders=orders;this.recovery=recovery;this.validation=validation;this.runs=runs;
+        this.masterData=masterData;
+    }
+    public void execute(long taskId){
+        var task=tasks.selectById(taskId);require(task!=null,"SELFOP_TASK_MISSING");SelfopCollectionPolicy.requireExecution(config,task.getExecutionPurpose());
+        if(SelfopCollectionPolicy.continuousBusiness(config))require(SelfopCollectionPolicy.controlledBusinessTask(task,tasks::selectById,true),"SELFOP_TEST_MANUAL_TASK_REQUIRED");
+        if("SUCCEEDED".equals(task.getStatus())||"DEAD".equals(task.getStatus()))return;
+        String owner=UUID.randomUUID().toString();Map<Long,SelfopLeaseService.Lease> held=new LinkedHashMap<>();SelfopLeaseService.Lease primary;
+        if("ACCOUNT_DISCOVERY".equals(task.getTaskRole())){primary=leases.acquireDiscovery(task.getDiscoveryScopeId(),owner);held.put(primary.scopeId(),primary);}
+        else {
+            var ids=new TreeSet<Long>();ids.add(task.getScopeId());
+            if("OUTBOUND".equals(scopes.selectById(task.getScopeId()).getDataFamily())){
+                var warehouses=new TreeSet<String>();warehouses.add(task.getWarehouseCode());
+                if(task.getAffectedWarehouseCodesJson()!=null)warehouses.addAll(read(task.getAffectedWarehouseCodesJson(),List.class));
+                if(task.getRoutingManifestJson()!=null){var manifest=read(task.getRoutingManifestJson(),SelfopRoutingManifest.class);
+                    for(var ref:manifest.getObjects().values())if(ref.getEffectiveStageId()!=null){var stage=stages.selectById(ref.getEffectiveStageId());var p=read(stage.getPayloadJson(),SelfopPayloads.Order.class);
+                        warehouses.add(p.warehouseCode());var old=orders.selectOne(new QueryWrapper<SelfopOutboundOrder>().eq("source_account",p.sourceAccount()).eq("customer_code",p.customerCode()).eq("delivery_no",p.deliveryNo()));
+                        var latest=stages.selectOne(new QueryWrapper<SelfopSyncStage>().eq("object_type","OUTBOUND_ORDER").eq("object_key_hash",stage.getObjectKeyHash()).eq("validation_status","VALID").isNotNull("observation_sequence").orderByDesc("observation_sequence").last("LIMIT 1"));
+                        if(latest!=null)warehouses.add(latest.getWarehouseCode());
+                        if(old!=null)warehouses.add(old.getWarehouseCode());}}
+                for(String w:warehouses){var s=scopes.selectOne(new QueryWrapper<SelfopSyncScope>().eq("source_account",task.getSourceAccount()).eq("warehouse_code",w).eq("data_family","OUTBOUND"));
+                    require(s!=null,"SELFOP_WAREHOUSE_UNCONFIGURED");ids.add(s.getId());}
+            }
+            held.putAll(leases.acquireScopes(ids,owner));primary=held.get(task.getScopeId());
+        }
+        SelfopSyncRun run=null;String executionPhase=null;
+        try{
+            run=taskService.begin(taskId,primary);
+            task=tasks.selectById(taskId);
+            if("VALIDATION".equals(task.getExecutionPurpose())){validation.run(task,run,primary);return;}
+            if(!primary.account()&&"OUTBOUND".equals(scopes.selectById(task.getScopeId()).getDataFamily())){executionPhase="MERGE";recovery.refresh(task,held);}
+            if("MASTER_DATA".equals(task.getTaskType()))masterData.collect(task,run,primary);
+            else if(primary.account())discovery.collect(task,run,primary);
+            else if("INVENTORY".equals(scopes.selectById(task.getScopeId()).getDataFamily())){
+                executionPhase="INVENTORY";
+                if(stock.collect(task,run,primary)){executionPhase="BUILD";snapshots.build(task.getScopeId(),run.getId(),owner,primary.fence());
+                    executionPhase="PUBLISH";snapshots.publish(task.getScopeId(),run.getId(),owner,primary.fence());}
+            }else{
+                Map<String,OutboundFactService.Lease> outbound=new TreeMap<>();for(var lease:held.values())outbound.put(scopes.selectById(lease.scopeId()).getWarehouseCode(),new OutboundFactService.Lease(owner,lease.fence()));
+                if(!"REBUILD".equals(task.getTaskType())){
+                    var manifest=read(task.getRoutingManifestJson(),SelfopRoutingManifest.class);var ids=manifest.getObjects().values().stream().map(SelfopRoutingManifest.Entry::getEffectiveStageId).distinct().toList();
+                    require(ids.stream().noneMatch(Objects::isNull),"SELFOP_DETAILS_INCOMPLETE");
+                    if(!"APPLIED".equals(task.getApplyState())){
+                        int batch=Math.max(1,Math.min(100,config.getApplyBatchSize()));for(int i=0;i<ids.size();i+=batch){for(var lease:held.values())leases.renew(lease);facts.merge(taskId,run.getId(),ids.subList(i,Math.min(ids.size(),i+batch)),outbound);}
+                        facts.finish(taskId,run.getId(),ids,outbound);
+                    }
+                }
+                executionPhase="BUILD";var reused=candidates.reusable(task.getScopeId(),run.getId(),owner,primary.fence());
+                if(reused!=null){executionPhase="PUBLISH";publisher.reuse(task.getScopeId(),run.getId(),reused,owner,primary.fence());return;}
+                candidates.build(task.getScopeId(),run.getId(),owner,primary.fence());
+                if(config.isSalesPublicationEnabled()){executionPhase="PUBLISH";publisher.publish(task.getScopeId(),run.getId(),owner,primary.fence());}
+                else taskService.candidateFinished(taskId,run.getId(),primary);
+            }
+        }catch(RuntimeException e){
+            if(run!=null&&"BUSINESS".equals(task.getExecutionPurpose())&& e instanceof com.baiyue.lastleg.selfoperated.analytics.request.EgressRejectedException q && q.waitUntilUtc()!=null){
+                try{taskService.waitForBudget(taskId,run.getId(),q.waitUntilUtc(),primary);}catch(IllegalStateException lostFence){ }return;
+            }
+            var failure=SelfopFailure.capture(e instanceof AnalyticsClientException c?c.code():safeCode(e.getMessage()),
+                !(e instanceof AnalyticsClientException c)||c.retryable(),e).atPhase(executionPhase);
+            // Stack locations and classified metadata only: throwable messages can contain SQL and credentials.
+            LOG.warn("Selfop execution failed taskNo={} runId={} diagnostic={} locations={}",task.getTaskNo(),run==null?null:run.getId(),
+                failure,Arrays.stream(e.getStackTrace()).limit(8).toList());
+            if(run!=null){
+                try{
+                    if("VALIDATION".equals(task.getExecutionPurpose()))validation.fail(task,run,primary,failure.code());
+                    else taskService.fail(taskId,run.getId(),failure,primary);
+                }catch(IllegalStateException lostFence){LOG.warn("Selfop failure persistence rejected taskNo={} type={}",task.getTaskNo(),lostFence.getClass().getSimpleName());}}
+        }finally{for(var lease:held.values())leases.release(lease);}
+    }
+    private static String safeCode(String message){return message!=null&&message.length()<=64
+        &&message.matches("(SELFOP|BUSINESS|ACCOUNT|VALIDATION|LINGXING|INTEGRATION)_[A-Z0-9_]+")?message:"SELFOP_EXECUTION_FAILED";}
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/sync/SelfopInventoryCollector.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/sync/SelfopInventoryCollector.java
new file mode 100644
index 000000000..7b166a30d
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/sync/SelfopInventoryCollector.java
@@ -0,0 +1,63 @@
+package com.baiyue.lastleg.selfoperated.analytics.sync;
+
+import com.baomidou.mybatisplus.core.toolkit.IdWorker;
+import com.baiyue.lastleg.selfoperated.analytics.client.LingxingAnalyticsClient;
+import com.baiyue.lastleg.selfoperated.analytics.mapper.*;
+import com.baiyue.lastleg.selfoperated.analytics.model.*;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.support.TransactionTemplate;
+import java.util.*;
+import static com.baiyue.lastleg.selfoperated.analytics.model.SelfopSupport.*;
+
+@Service
+public class SelfopInventoryCollector {
+    private final LingxingAnalyticsClient client;
+    private final SelfopSyncStageMapper stages;
+    private final SelfopSyncTaskMapper tasks;
+    private final SelfopSyncRunMapper runs;
+    private final SelfopLeaseService leases;
+    private final SelfopTaskService taskService;
+    private final SelfopAnalyticsProperties config;
+    private final TransactionTemplate tx;
+    public SelfopInventoryCollector(LingxingAnalyticsClient client,SelfopSyncStageMapper stages,SelfopSyncTaskMapper tasks,
+        SelfopSyncRunMapper runs,SelfopLeaseService leases,SelfopTaskService taskService,SelfopAnalyticsProperties config,TransactionTemplate tx){
+        this.client=client;this.stages=stages;this.tasks=tasks;this.runs=runs;this.leases=leases;this.taskService=taskService;this.config=config;this.tx=tx;
+    }
+    public boolean collect(SelfopSyncTask task,SelfopSyncRun run,SelfopLeaseService.Lease lease){
+        SelfopCollectionPolicy.requireBusiness(task);SelfopCollectionPolicy.requireBusiness(run);
+        int pageSize=config.getInventoryPageSize();
+        require(pageSize>=1&&pageSize<=1000,"SELFOP_INVENTORY_PAGE_SIZE_INVALID");
+        var manifest=task.getRoutingManifestJson()==null?new SelfopRoutingManifest():read(task.getRoutingManifestJson(),SelfopRoutingManifest.class);
+        var budget=new SelfopBudget(config.getRequestBudget(),config.getTimeBudgetSeconds());
+        while(!manifest.isDirectoryComplete()){
+            if(!budget.take()){taskService.yield(task.getId(),run.getId(),lease);return false;}
+            leases.renew(lease);var page=client.inventory(SelfopRequestContext.forTask(task,run,config),task.getWarehouseCode(),manifest.getNextPage(),pageSize);
+            require(page.current()==manifest.getNextPage()&&page.size()==pageSize,"SELFOP_PAGE_MISMATCH");
+            require(page.total()!=null&&page.pages()!=null,"SELFOP_PAGE_METADATA_MISSING");
+            if(manifest.getTotal()==null){manifest.setTotal(page.total());manifest.setPages(page.pages());}
+            require(Objects.equals(manifest.getTotal(),page.total())&&Objects.equals(manifest.getPages(),page.pages()),"SELFOP_PAGE_TOTAL_CHANGED");
+            tx.executeWithoutResult(s->{var checkpoint=taskService.checkpoint(task,run,lease);var currentTask=checkpoint.task();var currentRun=checkpoint.run();
+                for(var row:page.records()){
+                    require(task.getSourceAccount().equals(row.sourceAccount())&&task.getWarehouseCode().equals(row.warehouseCode()),"SELFOP_STOCK_SCOPE_LEAK");
+                    identity(row.customerCode(),64);identity(row.skuCode(),128);require(row.productQuality()!=null,"SELFOP_STOCK_IDENTITY_MISSING");
+                    String key=hash(List.of(row.sourceAccount(),row.customerCode(),row.warehouseCode(),row.skuCode(),row.productQuality()));
+                    require(!manifest.getFirstScan().containsKey(key),"SELFOP_STOCK_DUPLICATE");manifest.getFirstScan().put(key,SelfopStockFingerprint.of(row));
+                        var stage=new SelfopSyncStage();stage.setId(IdWorker.getId());stage.setRunId(run.getId());stage.setStageBatchId(run.getId());stage.setLastFetchRunId(run.getId());
+                        stage.setWarehouseCode(row.warehouseCode());stage.setObjectType("PRODUCT_STOCK");stage.setObjectKeyHash(key);stage.setFirstPageNo(manifest.getNextPage());
+                        stage.setObservedAtUtc(utcNow());stage.setContentHash(SelfopStockFingerprint.of(row));stage.setPayloadJson(json(row));stage.setValidationStatus("VALID");stage.setCreatedAt(utcNow());stage.setUpdatedAt(utcNow());stages.insert(stage);
+                }
+                manifest.setNextPage(manifest.getNextPage()+1);
+                if(manifest.getPages()==0||manifest.getNextPage()>manifest.getPages()){
+                    require(manifest.getFirstScan().size()==manifest.getTotal(),"SELFOP_STOCK_COUNT_MISMATCH");
+                    manifest.setDirectoryComplete(true);
+                }
+                currentTask.setRoutingManifestJson(json(manifest));currentTask.setUpdatedAt(utcNow());tasks.updateById(currentTask);
+                SelfopProgressProjection.applyCheckpoint(currentTask,currentRun,"INVENTORY","PAGE",Math.max(0,manifest.getNextPage()-1),manifest.getPages()==null?null:manifest.getPages().longValue(),manifest.getScan());tasks.updateById(currentTask);runs.updateById(currentRun);
+            });
+        }
+        tx.executeWithoutResult(s->{var checkpoint=taskService.checkpoint(task,run,lease);var currentTask=checkpoint.task();var currentRun=checkpoint.run();currentRun.setStatus("VALIDATED");currentRun.setLastPhase("VALIDATED");currentRun.setCoverageStatus("COMPLETE");
+            currentRun.setPageCount(Math.max(1,manifest.getPages()));currentRun.setSourceTotalCount(manifest.getTotal());currentRun.setUniqueObjectCount((long)manifest.getFirstScan().size());
+            currentRun.setFetchFinishedAtUtc(utcNow());currentRun.setUpdatedAt(utcNow());runs.updateById(currentRun);
+        });return true;
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/sync/SelfopLeaseService.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/sync/SelfopLeaseService.java
new file mode 100644
index 000000000..775e612a2
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/sync/SelfopLeaseService.java
@@ -0,0 +1,88 @@
+package com.baiyue.lastleg.selfoperated.analytics.sync;
+
+import com.baiyue.lastleg.selfoperated.analytics.mapper.*;
+import com.baiyue.lastleg.selfoperated.analytics.model.*;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Transactional;
+import java.time.LocalDateTime;
+import java.util.*;
+import static com.baiyue.lastleg.selfoperated.analytics.model.SelfopSupport.*;
+
+@Service
+public class SelfopLeaseService {
+    private final SelfopCoordinationMapper locks;
+    private final SelfopSyncScopeMapper scopes;
+    private final SelfopOutboundDiscoveryScopeMapper discoveries;
+    private final SelfopAnalyticsProperties config;
+    public SelfopLeaseService(SelfopCoordinationMapper locks, SelfopSyncScopeMapper scopes,
+        SelfopOutboundDiscoveryScopeMapper discoveries, SelfopAnalyticsProperties config) {
+        this.locks=locks; this.scopes=scopes; this.discoveries=discoveries; this.config=config;
+    }
+    public record Lease(long scopeId, String owner, long fence, boolean account) { }
+    @Transactional
+    public Lease acquireDiscovery(long id, String owner) {
+        var row=locks.lockDiscovery(id); require(row!=null,"SELFOP_SCOPE_MISSING");
+        var now=utcNow(); require(available(row.getLeaseOwner(),row.getLeaseUntilUtc(),now),"SELFOP_LEASE_BUSY");
+        long fence=row.getFenceToken()+1; row.setLeaseOwner(owner); row.setFenceToken(fence);
+        row.setLeaseUntilUtc(now.plusSeconds(config.getLeaseSeconds())); row.setUpdatedAt(now);
+        discoveries.updateById(row); return new Lease(id,owner,fence,true);
+    }
+    /** Atomic all-or-none acquisition; never hold one warehouse while waiting for another. */
+    @Transactional
+    public Map<Long,Lease> acquireScopes(Collection<Long> ids, String owner) {
+        var rows=ids.stream().distinct().map(scopes::selectById)
+            .sorted(Comparator.comparing(SelfopSyncScope::getSourceAccount)
+                .thenComparing(SelfopSyncScope::getWarehouseCode).thenComparing(SelfopSyncScope::getDataFamily)).toList();
+        Map<Long,Lease> result=new LinkedHashMap<>(); var now=utcNow();
+        for(var candidate:rows){
+            var row=locks.lockScope(candidate.getId());
+            require(available(row.getLeaseOwner(),row.getLeaseUntilUtc(),now),"SELFOP_LEASE_BUSY");
+            long fence=row.getFenceToken()+1; row.setLeaseOwner(owner); row.setFenceToken(fence);
+            row.setLeaseUntilUtc(now.plusSeconds(config.getLeaseSeconds())); row.setUpdatedAt(now);
+            scopes.updateById(row); result.put(row.getId(),new Lease(row.getId(),owner,fence,false));
+        }
+        return result;
+    }
+    @Transactional
+    public void renew(Lease lease) {
+        var now=utcNow();
+        if(lease.account()) {var s=locks.lockDiscovery(lease.scopeId()); check(lease,s.getLeaseOwner(),s.getFenceToken(),s.getLeaseUntilUtc(),now);
+            s.setLeaseUntilUtc(now.plusSeconds(config.getLeaseSeconds())); s.setUpdatedAt(now); discoveries.updateById(s);
+        } else {var s=locks.lockScope(lease.scopeId()); check(lease,s.getLeaseOwner(),s.getFenceToken(),s.getLeaseUntilUtc(),now);
+            s.setLeaseUntilUtc(now.plusSeconds(config.getLeaseSeconds())); s.setUpdatedAt(now); scopes.updateById(s);}
+        locks.heartbeat(lease.scopeId(),lease.account(),lease.fence(),now);
+    }
+    @Transactional
+    public void release(Lease lease) {
+        if(lease.account()) {var s=locks.lockDiscovery(lease.scopeId());
+            if(Objects.equals(s.getLeaseOwner(),lease.owner()) && s.getFenceToken()==lease.fence()) {
+                s.setLeaseOwner(null); s.setLeaseUntilUtc(null); s.setUpdatedAt(utcNow());
+                discoveries.update(null,new com.baomidou.mybatisplus.core.conditions.update.UpdateWrapper<SelfopOutboundDiscoveryScope>()
+                    .eq("id",s.getId()).set("lease_owner",null).set("lease_until_utc",null).set("updated_at",utcNow())); }
+        } else {var s=locks.lockScope(lease.scopeId());
+            if(Objects.equals(s.getLeaseOwner(),lease.owner()) && s.getFenceToken()==lease.fence())
+                scopes.update(null,new com.baomidou.mybatisplus.core.conditions.update.UpdateWrapper<SelfopSyncScope>()
+                    .eq("id",s.getId()).set("lease_owner",null).set("lease_until_utc",null).set("updated_at",utcNow())); }
+    }
+    @Transactional
+    public long nextObservation(Lease lease) {
+        return nextObservations(lease,1);
+    }
+    /** Reserve consecutive observations under the same fence; gaps after a failed batch are harmless. */
+    @Transactional
+    public long nextObservations(Lease lease,int count) {
+        require(count>0&&count<=100,"SELFOP_OBSERVATION_BATCH_INVALID");
+        require(lease.account(),"SELFOP_ACCOUNT_LEASE_REQUIRED"); var s=locks.lockDiscovery(lease.scopeId());
+        check(lease,s.getLeaseOwner(),s.getFenceToken(),s.getLeaseUntilUtc(),utcNow());
+        long seq=s.getNextObservationSequence(); s.setNextObservationSequence(Math.addExact(seq,count)); s.setUpdatedAt(utcNow());
+        discoveries.updateById(s); return seq;
+    }
+    public void verify(Lease lease) {
+        if(lease.account()) {var s=locks.lockDiscovery(lease.scopeId());check(lease,s.getLeaseOwner(),s.getFenceToken(),s.getLeaseUntilUtc(),utcNow());}
+        else {var s=locks.lockScope(lease.scopeId());check(lease,s.getLeaseOwner(),s.getFenceToken(),s.getLeaseUntilUtc(),utcNow());}
+    }
+    static boolean available(String owner, LocalDateTime until, LocalDateTime now) {return owner==null || until==null || !until.isAfter(now);}
+    public static void check(Lease lease,String owner,Long fence,LocalDateTime until,LocalDateTime now) {
+        require(Objects.equals(owner,lease.owner()) && fence!=null && fence==lease.fence() && until!=null && until.isAfter(now),"SELFOP_FENCE_REJECTED");
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/sync/SelfopMasterDataCollector.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/sync/SelfopMasterDataCollector.java
new file mode 100644
index 000000000..3763b4e0d
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/sync/SelfopMasterDataCollector.java
@@ -0,0 +1,85 @@
+package com.baiyue.lastleg.selfoperated.analytics.sync;
+
+import com.baomidou.mybatisplus.core.toolkit.IdWorker;
+import com.baiyue.lastleg.selfoperated.analytics.client.LingxingAnalyticsClient;
+import com.baiyue.lastleg.selfoperated.analytics.mapper.*;
+import com.baiyue.lastleg.selfoperated.analytics.model.*;
+import org.springframework.dao.DuplicateKeyException;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.support.TransactionTemplate;
+import lombok.Data;
+import java.util.Objects;
+import static com.baiyue.lastleg.selfoperated.analytics.model.SelfopSupport.*;
+
+/** Account-wide master data uses the same durable task, lease and provider permit as sales. */
+@Service
+public class SelfopMasterDataCollector {
+    private final LingxingAnalyticsClient client;
+    private final SelfopMasterDataMapper data;
+    private final SelfopSyncTaskMapper tasks;
+    private final SelfopSyncRunMapper runs;
+    private final SelfopTaskService taskService;
+    private final SelfopLeaseService leases;
+    private final SelfopAnalyticsProperties config;
+    private final TransactionTemplate tx;
+    public SelfopMasterDataCollector(LingxingAnalyticsClient client,SelfopMasterDataMapper data,SelfopSyncTaskMapper tasks,
+        SelfopSyncRunMapper runs,SelfopTaskService taskService,SelfopLeaseService leases,SelfopAnalyticsProperties config,TransactionTemplate tx) {
+        this.client=client;this.data=data;this.tasks=tasks;this.runs=runs;this.taskService=taskService;this.leases=leases;this.config=config;this.tx=tx;
+    }
+    @Data public static class Manifest {
+        private int nextPage=1,completedPages=0;
+        private Long total;
+        private Integer pages;
+        private long ownerCount,productCount;
+        private boolean ownersComplete;
+    }
+    public void collect(SelfopSyncTask task,SelfopSyncRun run,SelfopLeaseService.Lease lease) {
+        SelfopCollectionPolicy.requireBusiness(task);SelfopCollectionPolicy.requireBusiness(run);
+        require("MASTER_DATA".equals(task.getTaskType())&&lease.account(),"SELFOP_MASTER_TASK_REQUIRED");
+        var manifest=task.getRoutingManifestJson()==null?new Manifest():read(task.getRoutingManifestJson(),Manifest.class);
+        // Master-data endpoints need slower paging than outbound. Yield every page so waiting never owns the account lease.
+        {
+            leases.renew(lease);boolean owners=!manifest.isOwnersComplete();int size=owners?1000:100;
+            var context=SelfopRequestContext.forTask(task,run,config);
+            LingxingAnalyticsClient.Page<?> page=owners?client.customers(context,manifest.nextPage,size):client.products(context,manifest.nextPage,size);
+            validatePage(manifest,page,size);
+            try {tx.executeWithoutResult(status->{
+                var checkpoint=taskService.checkpoint(task,run,lease);
+                for(var value:page.records()) {
+                    if(owners) {var row=(SelfopPayloads.Owner)value;identity(row.customerCode(),64);data.insertOwner(IdWorker.getId(),run.getId(),task.getSourceAccount(),row,utcNow());manifest.ownerCount++;}
+                    else {var row=(SelfopPayloads.Product)value;identity(row.customerCode(),64);identity(row.sku(),128);data.insertProduct(IdWorker.getId(),run.getId(),task.getSourceAccount(),row,utcNow());manifest.productCount++;}
+                }
+                manifest.completedPages++;manifest.nextPage++;
+                boolean complete=page.pages()==0||manifest.nextPage>page.pages();
+                if(complete) {
+                    require((owners?manifest.ownerCount:manifest.productCount)==page.total(),"SELFOP_MASTER_COUNT_MISMATCH");
+                    require((owners?data.ownerCount(run.getId(),task.getSourceAccount()):data.productCount(run.getId(),task.getSourceAccount()))==page.total(),"SELFOP_MASTER_COUNT_MISMATCH");
+                }
+                var t=checkpoint.task();var r=checkpoint.run();
+                SelfopProgressProjection.applyCheckpoint(t,r,owners?"CUSTOMERS":"PRODUCTS","PAGE",Math.min(manifest.nextPage-1,page.pages()),page.pages().longValue(),1);
+                if(complete&&owners){manifest.ownersComplete=true;manifest.nextPage=1;manifest.total=null;manifest.pages=null;}
+                t.setRoutingManifestJson(json(manifest));t.setUpdatedAt(utcNow());
+                if(complete&&!owners) {
+                    r.setStatus("PUBLISHED");r.setLastPhase("PUBLISHED");r.setCoverageStatus("COMPLETE");r.setPageCount(manifest.completedPages);
+                    r.setSourceTotalCount(manifest.ownerCount+manifest.productCount);r.setUniqueObjectCount(manifest.ownerCount+manifest.productCount);
+                    r.setFetchFinishedAtUtc(utcNow());r.setPublishedAtUtc(utcNow());r.setFinishedAtUtc(utcNow());r.setUpdatedAt(utcNow());
+                    t.setStatus("SUCCEEDED");t.setResultPublishedRunId(r.getId());
+                    SelfopProgressProjection.applyCheckpoint(t,r,"PUBLISH","BATCH",1,1L,1);
+                    SelfopProgressProjection.freezeRun(t,r);
+                    tasks.update(null,new com.baomidou.mybatisplus.core.conditions.update.UpdateWrapper<SelfopSyncTask>().eq("id",t.getId()).set("next_retry_at_utc",null));
+                    t.setNextRetryAtUtc(null);
+                }
+                tasks.updateById(t);runs.updateById(r);
+            });} catch(DuplicateKeyException duplicate){throw new IllegalStateException("SELFOP_MASTER_DUPLICATE");}
+            if(!owners&&(page.pages()==0||manifest.nextPage>page.pages()))return;
+        }
+        taskService.yield(task.getId(),run.getId(),lease);
+    }
+    static void validatePage(Manifest m,LingxingAnalyticsClient.Page<?> p,int size) {
+        require(p.current()!=null&&p.current()==m.nextPage&&p.size()!=null&&p.size()==size,"SELFOP_PAGE_MISMATCH");
+        require(p.total()!=null&&p.total()>=0&&p.pages()!=null&&p.pages()==(p.total()+size-1)/size,"SELFOP_PAGE_METADATA_MISSING");
+        require(p.records().size()==Math.min(size,Math.max(0,p.total()-(long)(m.nextPage-1)*size)),"SELFOP_MASTER_COUNT_MISMATCH");
+        if(m.total==null){m.total=p.total();m.pages=p.pages();}
+        require(Objects.equals(m.total,p.total())&&Objects.equals(m.pages,p.pages()),"SELFOP_PAGE_TOTAL_CHANGED");
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/sync/SelfopProgressService.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/sync/SelfopProgressService.java
new file mode 100644
index 000000000..79d074e3f
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/sync/SelfopProgressService.java
@@ -0,0 +1,85 @@
+package com.baiyue.lastleg.selfoperated.analytics.sync;
+
+import com.baiyue.lastleg.selfoperated.analytics.mapper.*;
+import com.baiyue.lastleg.selfoperated.analytics.model.*;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Transactional;
+import java.nio.charset.StandardCharsets;
+import java.math.BigDecimal;
+import java.math.RoundingMode;
+import java.time.LocalDateTime;
+import java.time.ZoneOffset;
+import java.util.*;
+import static com.baiyue.lastleg.selfoperated.analytics.model.SelfopSupport.*;
+
+/** Small, durable checkpoint projection. Counts describe committed work, never HTTP attempts. */
+@Service
+public class SelfopProgressService {
+    private static final Set<String> PHASES = Set.of("WAITING_SOURCE", "DIRECTORY", "DETAIL", "INVENTORY",
+        "VALIDATION", "MERGE", "BUILD", "PUBLISH", "WAITING", "SAMPLE_DONE", "FAILED");
+    private final SelfopCoordinationMapper locks;
+    private final SelfopSyncTaskMapper tasks;
+    private final SelfopSyncRunMapper runs;
+    private final SelfopLeaseService leases;
+    public SelfopProgressService(SelfopCoordinationMapper locks, SelfopSyncTaskMapper tasks,
+                                SelfopSyncRunMapper runs, SelfopLeaseService leases) {
+        this.locks=locks; this.tasks=tasks; this.runs=runs; this.leases=leases;
+    }
+
+    /** Creation-only waiting evidence; no execution or observation is inferred. */
+    @Transactional
+    public void initializeWaiting(long taskId, String phase) {
+        require(Set.of("WAITING_SOURCE", "WAITING").contains(phase), "SELFOP_PROGRESS_PHASE_INVALID");
+        var task=locks.lockTask(taskId); require(task!=null,"SELFOP_TASK_MISSING");
+        require(task.getAttemptCount()==null || task.getAttemptCount()==0,"SELFOP_PROGRESS_ALREADY_STARTED");
+        if(task.getProgressJson()!=null)return;
+        var p=new LinkedHashMap<String,Object>(); p.put("attemptNo",0); p.put("phase",phase);
+        p.put("progressScope",scope(task)); p.put("stageStartedAt",instant(utcNow()));
+        p.put("unit","NONE"); p.put("completed",0); p.put("total",null);
+        p.put("scanRound",0);p.put("totalKnown",false);p.put("countBasis","TASK_CUMULATIVE");
+        p.put("sliceFrom",instant(task.getQueryFromUtc()));p.put("sliceUntil",instant(task.getQueryUntilUtc()));
+        p.put("stageFinishedAt",null);p.put("stages",new ArrayList<>()); persist(task,p);
+    }
+
+    /** Caller invokes after the corresponding manifest/stage/merge checkpoint in the same transaction. */
+    @Transactional
+    public void checkpoint(long taskId, long runId, SelfopLeaseService.Lease lease, String phase,
+                           String unit, long completed, Long total, int scan) {
+        require(PHASES.contains(phase),"SELFOP_PROGRESS_PHASE_INVALID");
+        require(Set.of("PAGE","ORDER","INVENTORY_ROW","BUSINESS_KEY","BATCH","NONE").contains(unit),"SELFOP_PROGRESS_UNIT_INVALID");
+        require(completed>=0 && scan>=0 && (total==null || total>=completed),"SELFOP_PROGRESS_COUNTS_INVALID");
+        leases.verify(lease);
+        var task=locks.lockTask(taskId); var run=locks.lockRun(runId); check(task,run,lease,true);
+        SelfopProgressProjection.applyCheckpoint(task,run,phase,unit,completed,total,scan);
+        tasks.updateById(task); runs.updateById(run);
+    }
+
+    @Transactional
+    public void heartbeat(long taskId,long runId,SelfopLeaseService.Lease lease) {
+        leases.verify(lease); var task=locks.lockTask(taskId); var run=locks.lockRun(runId);check(task,run,lease,true);
+        run.setHeartbeatAtUtc(utcNow()); run.setUpdatedAt(utcNow());runs.updateById(run);
+    }
+
+    /** Freeze before replacing task progress, including crash takeover under the new valid fence. */
+    @Transactional
+    public void freeze(long taskId,long runId,SelfopLeaseService.Lease lease) {
+        leases.verify(lease);var task=locks.lockTask(taskId);var run=locks.lockRun(runId);check(task,run,lease,false);
+        SelfopProgressProjection.freezeRun(task,run);runs.updateById(run);
+    }
+
+    private void check(SelfopSyncTask task,SelfopSyncRun run,SelfopLeaseService.Lease lease,boolean active) {
+        require(task!=null&&run!=null&&Objects.equals(run.getTaskId(),task.getId()),"SELFOP_PROGRESS_RUN_MISMATCH");
+        require(Objects.equals(lease.scopeId(),lease.account()?task.getDiscoveryScopeId():task.getScopeId()),"SELFOP_PROGRESS_SCOPE_MISMATCH");
+        if(active)require(Objects.equals(run.getFenceToken(),lease.fence())&&Objects.equals(task.getAttemptCount(),run.getAttemptNo())
+            &&run.getFinishedAtUtc()==null,"SELFOP_FENCE_REJECTED");
+    }
+    private void persist(SelfopSyncTask task,Map<String,Object> p) {
+        task.setProgressJson(bounded(p));task.setProgressUpdatedAtUtc(utcNow());task.setUpdatedAt(utcNow());tasks.updateById(task);
+    }
+    private static String bounded(Map<String,Object> p) {String value=json(p);require(value.getBytes(StandardCharsets.UTF_8).length<=8192,"SELFOP_PROGRESS_TOO_LARGE");return value;}
+    private static String scope(SelfopSyncTask task){return "ACCOUNT_DISCOVERY".equals(task.getTaskRole())?"ACCOUNT_SHARED":"WAREHOUSE";}
+    @SuppressWarnings("unchecked") private static Map<String,Object> progress(SelfopSyncTask task){return task.getProgressJson()==null?new LinkedHashMap<>():read(task.getProgressJson(),LinkedHashMap.class);}
+    @SuppressWarnings("unchecked") private static Map<String,Object> map(Object value){return value instanceof Map<?,?>?new LinkedHashMap<>((Map<String,Object>)value):new LinkedHashMap<>();}
+    private static Long number(Object value){return value instanceof Number n?n.longValue():null;}
+    private static String instant(LocalDateTime value){return value==null?null:value.toInstant(ZoneOffset.UTC).toString();}
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/sync/SelfopReferenceRecovery.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/sync/SelfopReferenceRecovery.java
new file mode 100644
index 000000000..3bbab41ec
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/sync/SelfopReferenceRecovery.java
@@ -0,0 +1,55 @@
+package com.baiyue.lastleg.selfoperated.analytics.sync;
+
+import com.baomidou.mybatisplus.core.conditions.query.QueryWrapper;
+import com.baiyue.lastleg.selfoperated.analytics.mapper.*;
+import com.baiyue.lastleg.selfoperated.analytics.model.*;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.support.TransactionTemplate;
+import java.util.*;
+import static com.baiyue.lastleg.selfoperated.analytics.model.SelfopSupport.*;
+
+@Service
+public class SelfopReferenceRecovery {
+    private final SelfopSyncStageMapper stages;
+    private final SelfopSyncTaskMapper tasks;
+    private final SelfopSyncScopeMapper scopes;
+    private final SelfopOutboundDiscoveryScopeMapper accounts;
+    private final SelfopCoordinationMapper locks;
+    private final SelfopLeaseService leases;
+    private final SelfopTaskService taskService;
+    private final SelfopDiscoveryService discovery;
+    private final TransactionTemplate tx;
+    public SelfopReferenceRecovery(SelfopSyncStageMapper stages,SelfopSyncTaskMapper tasks,SelfopSyncScopeMapper scopes,
+        SelfopOutboundDiscoveryScopeMapper accounts,SelfopCoordinationMapper locks,SelfopLeaseService leases,SelfopTaskService taskService,
+        SelfopDiscoveryService discovery,TransactionTemplate tx){this.stages=stages;this.tasks=tasks;this.scopes=scopes;this.accounts=accounts;
+        this.locks=locks;this.leases=leases;this.taskService=taskService;this.discovery=discovery;this.tx=tx;}
+    public void refresh(SelfopSyncTask task,Map<Long,SelfopLeaseService.Lease> held){
+        SelfopCollectionPolicy.requireBusiness(task);
+        if(task.getRoutingManifestJson()==null||"APPLIED".equals(task.getApplyState()))return;
+        var manifest=read(task.getRoutingManifestJson(),SelfopRoutingManifest.class);
+        for(var object:manifest.getObjects().entrySet()){
+            var ref=object.getValue();require(ref.getEffectiveStageId()!=null,"SELFOP_DETAILS_INCOMPLETE");
+            var current=stages.selectById(ref.getEffectiveStageId());var latest=stages.selectOne(new QueryWrapper<SelfopSyncStage>()
+                .eq("object_type","OUTBOUND_ORDER").eq("object_key_hash",object.getKey()).eq("validation_status","VALID").isNotNull("observation_sequence").orderByDesc("observation_sequence").last("LIMIT 1"));
+            if(latest==null||latest.getObservationSequence()<=current.getObservationSequence())continue;
+            for(var lease:held.values())leases.renew(lease);
+            var account=accounts.selectOne(new QueryWrapper<SelfopOutboundDiscoveryScope>().eq("source_account",task.getSourceAccount()));
+            var accountLease=leases.acquireDiscovery(account.getId(),UUID.randomUUID().toString());
+            try{
+                var refresh=new SelfopSyncTask();refresh.setSourceAccount(task.getSourceAccount());refresh.setTaskRole("ACCOUNT_DISCOVERY");refresh.setDiscoveryScopeId(account.getId());refresh.setTaskType("RECHECK");
+                refresh.setExecutionPurpose(task.getExecutionPurpose());
+                refresh.setScopeHash(task.getScopeHash());refresh.setRequestKey("warehouse-refresh:"+task.getId()+":"+object.getKey().substring(0,16)+":"+latest.getObservationSequence());
+                refresh.setQueryScopeJson(json(new SelfopDiscoveryService.Query(null,null,ref.getDeliveryNo(),ref.getCustomerCode(),task.getId())));refresh.setRequestHash(hash(refresh.getQueryScopeJson()));
+                refresh=taskService.create(refresh);
+                if(!"SUCCEEDED".equals(refresh.getStatus())){var run=taskService.begin(refresh.getId(),accountLease);refresh=tasks.selectById(refresh.getId());discovery.collect(refresh,run,accountLease);}
+                refresh=tasks.selectById(refresh.getId());require("SUCCEEDED".equals(refresh.getStatus()),"SELFOP_RECHECK_YIELDED");
+                var recovered=read(refresh.getRoutingManifestJson(),SelfopRoutingManifest.class).getObjects().get(object.getKey());
+                require(recovered!=null&&recovered.getEffectiveStageId()!=null,"SELFOP_RECHECK_INCOMPLETE");
+                require(held.values().stream().anyMatch(l->scopes.selectById(l.scopeId()).getWarehouseCode().equals(recovered.getWarehouseCode())),"LOCK_SET_CHANGED");
+                ref.setEffectiveStageId(recovered.getEffectiveStageId());ref.setWarehouseCode(recovered.getWarehouseCode());ref.setRefreshTaskId(refresh.getId());ref.setNewestSeenSequence(latest.getObservationSequence());
+                tx.executeWithoutResult(s->{for(var lease:held.values())leases.verify(lease);leases.verify(accountLease);var locked=locks.lockTask(task.getId());
+                    locked.setRoutingManifestJson(json(manifest));locked.setUpdatedAt(utcNow());tasks.updateById(locked);task.setRoutingManifestJson(locked.getRoutingManifestJson());});
+            }finally{leases.release(accountLease);}
+        }
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/sync/SelfopSalesPublisher.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/sync/SelfopSalesPublisher.java
new file mode 100644
index 000000000..9f6a656fd
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/sync/SelfopSalesPublisher.java
@@ -0,0 +1,68 @@
+package com.baiyue.lastleg.selfoperated.analytics.sync;
+
+import com.baiyue.lastleg.selfoperated.analytics.mapper.*;
+import com.baiyue.lastleg.selfoperated.analytics.model.*;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Transactional;
+import java.util.Objects;
+import static com.baiyue.lastleg.selfoperated.analytics.model.SelfopSupport.*;
+
+@Service
+public class SelfopSalesPublisher {
+    private final SelfopCoordinationMapper locks;
+    private final SelfopSyncScopeMapper scopes;
+    private final SelfopSyncRunMapper runs;
+    private final SelfopSyncTaskMapper tasks;
+    private final SelfopAnalyticsProperties config;
+    private final com.baiyue.lastleg.selfoperated.analytics.outbound.OutboundAggregateMapper aggregates;
+    public SelfopSalesPublisher(SelfopCoordinationMapper locks,SelfopSyncScopeMapper scopes,SelfopSyncRunMapper runs,SelfopSyncTaskMapper tasks,SelfopAnalyticsProperties config,com.baiyue.lastleg.selfoperated.analytics.outbound.OutboundAggregateMapper aggregates){
+        this.locks=locks;this.scopes=scopes;this.runs=runs;this.tasks=tasks;this.config=config;this.aggregates=aggregates;
+    }
+    @Transactional
+    public void publish(long scopeId,long runId,String owner,long fence){
+        require(config.isSalesPublicationEnabled(),"SELFOP_SALES_PUBLICATION_DISABLED");
+        var scope=locks.lockScope(scopeId);var run=locks.lockRun(runId);var now=utcNow();
+        SelfopCollectionPolicy.requireExecution(config,"BUSINESS");SelfopCollectionPolicy.requireBusiness(run);
+        require(scope!=null&&run!=null&&"OUTBOUND".equals(scope.getDataFamily()),"SELFOP_SALES_SCOPE_INVALID");
+        SelfopLeaseService.check(new SelfopLeaseService.Lease(scopeId,owner,fence,false),scope.getLeaseOwner(),scope.getFenceToken(),scope.getLeaseUntilUtc(),now);
+        require(Boolean.TRUE.equals(run.getWarehouseDailyReady()),"SELFOP_WAREHOUSE_DAILY_NOT_READY");
+        if(Objects.equals(scope.getPublishedRunId(),runId)&&"PUBLISHED".equals(run.getStatus()))return;
+        require(scope.getSourceTimezone()!=null&&!scope.getSourceTimezone().isBlank(),"SOURCE_TIMEZONE_UNCONFIRMED");
+        require(config.getQuantityUnit()!=null&&!config.getQuantityUnit().isBlank(),"QUANTITY_UNIT_UNCONFIRMED");
+        require(Objects.equals(run.getScopeId(),scopeId)&&Objects.equals(run.getScopeHash(),scope.getScopeHash())&&Objects.equals(run.getFenceToken(),fence)
+            &&"WAREHOUSE_SYNC".equals(run.getRunRole())&&"READY".equals(run.getStatus()),"SELFOP_CANDIDATE_NOT_READY");
+        require(locks.barriers(scope.getSourceAccount(),scope.getWarehouseCode())==0,"HALF_APPLIED_FACTS");
+        require(Objects.equals(run.getCalculatedFactRevision(),scope.getFactRevision()),"SELFOP_CANDIDATE_OBSOLETE");
+        require(run.getBuildStartedAtUtc()!=null&&aggregates.observationsChangedSince(scope.getSourceAccount(),scope.getWarehouseCode(),run.getBuildStartedAtUtc())==0,"SELFOP_CANDIDATE_OBSERVATION_CHANGED");
+        var task=locks.lockTask(run.getTaskId());require("APPLIED".equals(task.getApplyState())||"REBUILD".equals(task.getTaskType()),"SELFOP_TASK_NOT_APPLIED");
+        SelfopCollectionPolicy.requireBusiness(task);
+        SelfopSalesCoverage.requireTask(run,task);
+        if(scope.getPublishedRunId()!=null)runs.update(null,new com.baomidou.mybatisplus.core.conditions.update.UpdateWrapper<SelfopSyncRun>()
+            .eq("id",scope.getPublishedRunId()).isNull("superseded_at_utc").set("superseded_at_utc",now).set("updated_at",now));
+        scope.setPublishedRunId(runId);scope.setPublishedFactRevision(run.getCalculatedFactRevision());scope.setRebuildRequired(0);
+        scope.setDiscoveryFromUtc(run.getCoveredFromUtc());scope.setDiscoveryUntilUtc(run.getCoveredUntilUtc());scope.setUpdatedAt(now);scopes.updateById(scope);
+        SelfopProgressProjection.applyCheckpoint(task,run,"PUBLISH","NONE",1,1L,1);SelfopProgressProjection.freezeRun(task,run);
+        run.setStatus("PUBLISHED");run.setPublishedAtUtc(now);run.setFinishedAtUtc(now);run.setUpdatedAt(now);runs.updateById(run);
+        task.setResultPublishedRunId(runId);task.setStatus("SUCCEEDED");task.setUpdatedAt(now);tasks.updateById(task);
+        locks.completeCoveredTasks(scopeId,scope.getScopeHash(),runId,run.getCoveredFromUtc(),run.getCoveredUntilUtc(),now);
+        locks.completeReusedRuns(scopeId,scope.getSourceAccount(),scope.getWarehouseCode(),scope.getScopeHash(),runId,now);
+        locks.completeCoveredMarkers(scopeId,scope.getScopeHash(),runId,run.getCoveredUntilUtc(),now);
+    }
+    @Transactional
+    public void reuse(long scopeId,long runId,long publishedId,String owner,long fence){
+        SelfopCollectionPolicy.requireExecution(config,"BUSINESS");require(config.isSalesPublicationEnabled(),"SELFOP_SALES_PUBLICATION_DISABLED");
+        var scope=locks.lockScope(scopeId);var run=locks.lockRun(runId);var task=locks.lockTask(run.getTaskId());var published=runs.selectById(publishedId);
+        SelfopCollectionPolicy.requireBusiness(task);SelfopCollectionPolicy.requireBusiness(run);SelfopCollectionPolicy.requireBusiness(published);
+        require(published!=null&&Boolean.TRUE.equals(published.getWarehouseDailyReady()),"SELFOP_WAREHOUSE_DAILY_NOT_READY");
+        SelfopLeaseService.check(new SelfopLeaseService.Lease(scopeId,owner,fence,false),scope.getLeaseOwner(),scope.getFenceToken(),scope.getLeaseUntilUtc(),utcNow());
+        require(Objects.equals(run.getScopeId(),scopeId)&&Objects.equals(run.getFenceToken(),fence)&&Objects.equals(run.getScopeHash(),scope.getScopeHash()),"SELFOP_REUSE_SCOPE_INVALID");
+        require(Objects.equals(scope.getPublishedRunId(),publishedId)&&"PUBLISHED".equals(published.getStatus())&&Objects.equals(published.getCalculatedFactRevision(),scope.getFactRevision())
+            &&locks.barriers(scope.getSourceAccount(),scope.getWarehouseCode())==0,"SELFOP_REUSE_OBSOLETE");
+        require("APPLIED".equals(task.getApplyState())||"REBUILD".equals(task.getTaskType()),"SELFOP_TASK_NOT_APPLIED");
+        SelfopSalesCoverage.requireTask(published,task);
+        require(run.getFetchStartedAtUtc()!=null&&aggregates.observationsChangedSince(scope.getSourceAccount(),scope.getWarehouseCode(),run.getFetchStartedAtUtc())==0,"SELFOP_REUSE_OBSERVATION_CHANGED");
+        var now=utcNow();run.setCalculatedFactRevision(published.getCalculatedFactRevision());SelfopProgressProjection.freezeRun(task,run);run.setStatus("REUSED");run.setFinishedAtUtc(now);run.setUpdatedAt(now);runs.updateById(run);
+        task.setResultPublishedRunId(publishedId);task.setStatus("SUCCEEDED");task.setUpdatedAt(now);tasks.update(null,new com.baomidou.mybatisplus.core.conditions.update.UpdateWrapper<SelfopSyncTask>()
+            .eq("id",task.getId()).set("status","SUCCEEDED").set("result_published_run_id",publishedId).set("next_retry_at_utc",null).set("updated_at",now));
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/sync/SelfopSchedulePlanner.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/sync/SelfopSchedulePlanner.java
new file mode 100644
index 000000000..11eab9fca
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/sync/SelfopSchedulePlanner.java
@@ -0,0 +1,227 @@
+package com.baiyue.lastleg.selfoperated.analytics.sync;
+
+import com.baomidou.mybatisplus.core.conditions.query.QueryWrapper;
+import com.baomidou.mybatisplus.core.toolkit.IdWorker;
+import com.baiyue.lastleg.selfoperated.analytics.mapper.*;
+import com.baiyue.lastleg.selfoperated.analytics.model.*;
+import org.springframework.scheduling.annotation.Scheduled;
+import org.springframework.scheduling.support.CronExpression;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.support.TransactionTemplate;
+import java.time.*;
+import java.util.*;
+import static com.baiyue.lastleg.selfoperated.analytics.model.SelfopSupport.*;
+
+/** Persistent cron slots + immediate polling of durable work; never starts a live call by default. */
+@Service
+public class SelfopSchedulePlanner {
+    private final SelfopAnalyticsProperties config;
+    private final SelfopTaskService taskService;
+    private final SelfopExecutionService execution;
+    private final SelfopSyncScopeMapper scopes;
+    private final SelfopOutboundDiscoveryScopeMapper accounts;
+    private final SelfopSyncTaskMapper tasks;
+    private final SelfopOutboundOrderMapper orders;
+    private final SelfopCoordinationMapper locks;
+    private final TransactionTemplate tx;
+    public SelfopSchedulePlanner(SelfopAnalyticsProperties config,SelfopTaskService taskService,SelfopExecutionService execution,
+        SelfopSyncScopeMapper scopes,SelfopOutboundDiscoveryScopeMapper accounts,SelfopSyncTaskMapper tasks,SelfopOutboundOrderMapper orders,SelfopCoordinationMapper locks,TransactionTemplate tx){
+        this.config=config;this.taskService=taskService;this.execution=execution;this.scopes=scopes;this.accounts=accounts;this.tasks=tasks;this.orders=orders;this.locks=locks;this.tx=tx;
+    }
+    @Scheduled(fixedDelayString="${baiyue.self-operated-analytics.poll-delay-ms:1000}")
+    public void tick(){
+        if("OFF".equals(config.getCollectionMode()))return;
+        if("BUSINESS".equals(config.getCollectionMode()))SelfopCollectionPolicy.requireExecution(config,"BUSINESS");
+        if(SelfopCollectionPolicy.continuousBusiness(config)){
+            planContinuous(utcNow());
+            // One dispatch per tick: after a safe yield, re-plan and re-read priority.
+            for(var task:taskService.due(1)){
+                if(!SelfopCollectionPolicy.controlledBusinessTask(task,tasks::selectById,true))continue;
+                try{execution.execute(task.getId());}catch(IllegalStateException leaseBusy){/* Durable lease owner continues. */}
+            }
+            return;
+        }
+        List<SelfopSyncScope> configured;
+        if("VALIDATION".equals(config.getCollectionMode())){taskService.initializeAccount();configured=List.of();}
+        else if("test".equals(config.getEnvironment()))configured=List.of();
+        else configured=taskService.initialize();
+        var now=utcNow();
+        for(var scope:configured){
+            if(!"BUSINESS".equals(config.getCollectionMode()))break;
+            if("INVENTORY".equals(scope.getDataFamily()))plan(scope,now);
+            else if(config.getSourceQueryTimezone()!=null&&Objects.equals(scope.getSourceTimezone(),config.getSourceQueryTimezone())){plan(scope,now);review(scope,now);}
+        }
+        for(var task:taskService.due(10)){
+            if("BUSINESS".equals(config.getCollectionMode())&&"test".equals(config.getEnvironment())
+                &&!SelfopCollectionPolicy.controlledBusinessTask(task,tasks::selectById))continue;
+            try{execution.execute(task.getId());}catch(IllegalStateException leaseBusy){/* Another worker owns the durable lease. */}
+        }
+    }
+    public void planContinuous(LocalDateTime now){
+        require(SelfopCollectionPolicy.continuousBusiness(config),"SELFOP_CONTINUOUS_COLLECTION_DISABLED");
+        require("Asia/Shanghai".equals(config.getSourceQueryTimezone()),"SELFOP_SOURCE_TIMEZONE_REQUIRED");
+        require(!config.getWarehouses().isEmpty(),"SELFOP_WAREHOUSE_UNCONFIGURED");
+        var account=taskService.initializeAccount();
+        tx.executeWithoutResult(s->{
+            locks.lockDiscovery(account.getId());
+            // Read existing scopes only. Pool creation must never move the published coverage anchor.
+            var configured=scopes.selectList(new QueryWrapper<SelfopSyncScope>().eq("source_account",config.getSourceAccount())
+                .eq("data_family","OUTBOUND").in("warehouse_code",config.getWarehouses().keySet()));
+            require(configured.size()==config.getWarehouses().size()&&configured.stream().allMatch(scope->
+                "Asia/Shanghai".equals(scope.getSourceTimezone())&&"Asia/Shanghai".equals(scope.getBusinessTimezone())),"SELFOP_SCOPE_MISSING");
+            var local=now.plusHours(8);var today=local.toLocalDate();
+            var last=today.minusDays(local.toLocalTime().isBefore(LocalTime.of(0,5))?2:1);
+            var first=today.minusMonths(2);
+            String digest=hash(config.getWarehouses());
+            // Idle planning needs only day identity; routing manifests can contain thousands of orders.
+            var roots=tasks.selectList(new QueryWrapper<SelfopSyncTask>()
+                .select("request_key","query_from_utc","query_until_utc","scope_hash","status","query_scope_json")
+                .eq("source_account",config.getSourceAccount())
+                .eq("execution_purpose","BUSINESS").eq("task_role","ACCOUNT_DISCOVERY").eq("task_type","BACKFILL")
+                .eq("discovery_scope_id",account.getId()).isNull("upstream_task_id").isNull("validation_root_task_id")
+                .ge("query_from_utc",first.atStartOfDay().minusHours(8)).le("query_until_utc",last.plusDays(1).atStartOfDay().minusHours(8)));
+            var acceptedHashes=new HashSet<String>();acceptedHashes.add(digest);
+            configured.forEach(scope->acceptedHashes.add(scope.getScopeHash()));
+            for(var date=last;!date.isBefore(first);date=date.minusDays(1)){
+                var from=date.atStartOfDay().minusHours(8);var until=from.plusDays(1);
+                String key="continuous:outbound:"+date+":"+digest.substring(0,12);
+                // Examine every root: an old DEAD attempt must not mask a later successful/manual root.
+                boolean exists=roots.stream().anyMatch(root->key.equals(root.getRequestKey())||
+                    (from.equals(root.getQueryFromUtc())&&until.equals(root.getQueryUntilUtc())&&acceptedHashes.contains(root.getScopeHash())
+                     &&Set.of("READY","RUNNING","RETRY_WAIT","SUCCEEDED").contains(root.getStatus())&&wholeDayQuery(root,from)));
+                if(exists)continue;
+                var task=new SelfopSyncTask();task.setSourceAccount(config.getSourceAccount());task.setExecutionPurpose("BUSINESS");
+                task.setTaskRole("ACCOUNT_DISCOVERY");task.setTaskType("BACKFILL");task.setDiscoveryScopeId(account.getId());
+                task.setRequestedBy(SelfopCollectionPolicy.CONTINUOUS_PLANNER);task.setScopeHash(digest);task.setRequestKey(key);
+                task.setQueryFromUtc(from);task.setQueryUntilUtc(until);
+                task.setQueryScopeJson(json(new SelfopDiscoveryService.Query(from.plusHours(8).toString(),until.plusHours(8).toString(),null,null,null)));
+                task.setRequestHash(hash(Arrays.asList(task.getQueryScopeJson(),digest)));taskService.create(task);
+            }
+            planContinuousInventory(now,today);
+            planMasterData(account,now,today);
+        });
+    }
+    private void planMasterData(SelfopOutboundDiscoveryScope account,LocalDateTime now,LocalDate today) {
+        // One durable daily slot; unfinished work is resumed rather than replaced by a new day's scan.
+        if(tasks.selectCount(new QueryWrapper<SelfopSyncTask>().eq("source_account",config.getSourceAccount())
+            .eq("task_type","MASTER_DATA").in("status","READY","RUNNING","RETRY_WAIT"))>0)return;
+        var definition=new TreeMap<String,Object>();definition.put("dataFamily","MASTER_DATA");definition.put("sourceAccount",config.getSourceAccount());
+        String digest=hash(definition),key="continuous:master:"+today+":"+digest.substring(0,12);
+        if(tasks.selectCount(new QueryWrapper<SelfopSyncTask>().eq("source_account",config.getSourceAccount()).eq("request_key",key))>0)return;
+        var task=new SelfopSyncTask();task.setSourceAccount(config.getSourceAccount());task.setExecutionPurpose("BUSINESS");
+        task.setTaskRole("ACCOUNT_DISCOVERY");task.setTaskType("MASTER_DATA");task.setDiscoveryScopeId(account.getId());
+        task.setRequestedBy(SelfopCollectionPolicy.CONTINUOUS_PLANNER);task.setScopeHash(digest);task.setRequestKey(key);
+        task.setPlannedAtUtc(today.atStartOfDay().minusHours(8));task.setQueryScopeJson(json(definition));
+        task.setRequestHash(hash(Arrays.asList(task.getQueryScopeJson(),digest)));taskService.create(task);
+    }
+    private void planContinuousInventory(LocalDateTime now,LocalDate today){
+        var inventory=scopes.selectList(new QueryWrapper<SelfopSyncScope>().eq("source_account",config.getSourceAccount())
+            .eq("data_family","INVENTORY").in("warehouse_code",config.getWarehouses().keySet()));
+        require(inventory.size()==config.getWarehouses().size(),"SELFOP_SCOPE_MISSING");
+        for(var scope:inventory){
+            require("INVENTORY".equals(scope.getDataFamily())&&"Asia/Shanghai".equals(scope.getBusinessTimezone()),"SELFOP_INVENTORY_SCOPE_INVALID");
+            var midnight=today.atStartOfDay(ZoneId.of("Asia/Shanghai"));
+            var slot=CronExpression.parse(config.getWarehouses().get(scope.getWarehouseCode()).getInventoryCron()).next(midnight.minusNanos(1));
+            if(slot==null||!slot.toLocalDate().equals(today))continue;
+            var planned=slot.withZoneSameInstant(ZoneOffset.UTC).toLocalDateTime();
+            if(planned.isAfter(now))continue;
+            String key="continuous:inventory:"+scope.getWarehouseCode()+":"+planned+":"+scope.getScopeHash().substring(0,12);
+            var existing=tasks.selectList(new QueryWrapper<SelfopSyncTask>().eq("source_account",config.getSourceAccount())
+                .eq("scope_id",scope.getId()).eq("scope_hash",scope.getScopeHash()).eq("execution_purpose","BUSINESS")
+                .eq("task_role","WAREHOUSE_SYNC").eq("task_type","SCHEDULED")
+                .ge("planned_at_utc",midnight.withZoneSameInstant(ZoneOffset.UTC).toLocalDateTime())
+                .lt("planned_at_utc",midnight.plusDays(1).withZoneSameInstant(ZoneOffset.UTC).toLocalDateTime()));
+            if(existing.stream().anyMatch(t->key.equals(t.getRequestKey())||
+                (Objects.equals(t.getScopeId(),scope.getId())&&Objects.equals(t.getScopeHash(),scope.getScopeHash())
+                 &&t.getPlannedAtUtc()!=null&&t.getPlannedAtUtc().plusHours(8).toLocalDate().equals(today)
+                 &&SelfopCollectionPolicy.continuousBusinessRoot(t))))continue;
+            var task=new SelfopSyncTask();task.setSourceAccount(config.getSourceAccount());task.setExecutionPurpose("BUSINESS");
+            task.setTaskRole("WAREHOUSE_SYNC");task.setTaskType("SCHEDULED");task.setScopeId(scope.getId());task.setWarehouseCode(scope.getWarehouseCode());
+            task.setRequestedBy(SelfopCollectionPolicy.CONTINUOUS_PLANNER);task.setScopeHash(scope.getScopeHash());task.setRequestKey(key);
+            task.setPlannedAtUtc(planned);task.setNextRetryAtUtc(planned);task.setQueryScopeJson(scope.getScopeJson());
+            task.setRequestHash(hash(Arrays.asList(scope.getScopeHash(),planned,task.getQueryScopeJson())));taskService.create(task);
+        }
+    }
+    private static boolean wholeDayQuery(SelfopSyncTask root,LocalDateTime from){
+        try{var q=read(root.getQueryScopeJson(),SelfopDiscoveryService.Query.class);
+            return q!=null&&q.deliveryNo()==null&&q.customerCode()==null&&q.parentTaskId()==null
+                &&from.plusHours(8).equals(LocalDateTime.parse(q.startTime()))&&from.plusDays(1).plusHours(8).equals(LocalDateTime.parse(q.endTime()));
+        }catch(RuntimeException invalid){return false;}
+    }
+    public void plan(SelfopSyncScope preview,LocalDateTime now){
+        SelfopCollectionPolicy.requireAutomaticPlanning(config);
+        tx.executeWithoutResult(s->{var scope=locks.lockScope(preview.getId());ZoneId business=ZoneId.of(scope.getBusinessTimezone());
+            if("OUTBOUND".equals(scope.getDataFamily())&&scope.getInitialUntilUtc()==null){
+                scope.setInitialUntilUtc(now);scope.setInitialFromUtc(now.atZone(ZoneOffset.UTC).withZoneSameInstant(business).minusMonths(2).withZoneSameInstant(ZoneOffset.UTC).toLocalDateTime());
+                scope.setUpdatedAt(now);scopes.updateById(scope);}
+            var latest=tasks.selectOne(new QueryWrapper<SelfopSyncTask>().eq("scope_id",scope.getId()).eq("scope_hash",scope.getScopeHash()).eq("task_type","SCHEDULED").isNotNull("planned_at_utc").orderByDesc("planned_at_utc").last("LIMIT 1"));
+            LocalDateTime from=latest==null?scope.getCreatedAt():latest.getPlannedAtUtc();
+            ZonedDateTime slot=CronExpression.parse(scope.getScheduleCron()).next(from.atZone(ZoneOffset.UTC).withZoneSameInstant(business).minusNanos(1));
+            ZonedDateTime last=null;int count=0;
+            while(slot!=null&&!slot.toInstant().isAfter(now.toInstant(ZoneOffset.UTC))&&count++<100){last=slot;slot=CronExpression.parse(scope.getScheduleCron()).next(slot);}
+            if(last==null&&latest==null)last=now.atZone(ZoneOffset.UTC).withZoneSameInstant(business);
+            if(last==null)return;
+            LocalDateTime planned=last.withZoneSameInstant(ZoneOffset.UTC).toLocalDateTime();
+            if(latest!=null&&Objects.equals(latest.getPlannedAtUtc(),planned))return;
+            var request=new SelfopSyncTask();request.setSourceAccount(scope.getSourceAccount());request.setTaskRole("WAREHOUSE_SYNC");request.setScopeId(scope.getId());request.setWarehouseCode(scope.getWarehouseCode());
+            request.setTaskType("SCHEDULED");request.setPlannedAtUtc(planned);request.setScopeHash(scope.getScopeHash());request.setQueryScopeJson(scope.getScopeJson());
+            request.setRequestKey("slot:"+scope.getWarehouseCode()+":"+scope.getDataFamily()+":"+scope.getScopeHash().substring(0,12)+":"+planned);request.setRequestHash(hash(List.of(scope.getScopeHash(),planned)));
+            if("OUTBOUND".equals(scope.getDataFamily())){
+                // This durable slot marker routes through bounded shared account slices, never a month-long request.
+                request.setStatus("WAITING_SOURCE");request.setApplyState("NOT_APPLICABLE");
+                // The fixed historical window is queued atomically with its first slot marker.
+                // Slice identity is independent of later 08:00/20:00 slots and publication progress.
+                if(latest==null){
+                    LocalDateTime start=scope.getInitialFromUtc(),until=scope.getInitialUntilUtc();
+                    while(start.isBefore(until)){LocalDateTime end=start.plusDays(1);if(end.isAfter(until))end=until;
+                        shared(scope,start,end,"initial:"+start+":"+end,"BACKFILL",null,null);start=end;}
+                }
+                // Prior slots retain their durable pending work; the planning cursor can advance
+                // before publication without skipping any interval. Re-read the recent overlap.
+                LocalDateTime start=latest==null?scope.getInitialUntilUtc():latest.getPlannedAtUtc().minusHours(48);
+                if(start.isBefore(scope.getInitialUntilUtc()))start=scope.getInitialUntilUtc();
+                while(start.isBefore(planned)){LocalDateTime end=start.plusDays(1);if(end.isAfter(planned))end=planned;
+                    shared(scope,start,end,"schedule:"+planned+":"+start,"SCHEDULED",null,null);start=end;}
+            }
+            taskService.create(request);
+        });
+    }
+    private SelfopSyncTask shared(SelfopSyncScope scope,LocalDateTime from,LocalDateTime until,String key,String type,String customer,String delivery){
+        var account=accounts.selectOne(new QueryWrapper<SelfopOutboundDiscoveryScope>().eq("source_account",scope.getSourceAccount()));
+        var t=new SelfopSyncTask();t.setSourceAccount(scope.getSourceAccount());t.setTaskRole("ACCOUNT_DISCOVERY");t.setDiscoveryScopeId(account.getId());
+        t.setTaskType(type);t.setScopeHash(hash(config.getWarehouses()));t.setRequestKey(key+":"+t.getScopeHash().substring(0,12));t.setQueryFromUtc(from);t.setQueryUntilUtc(until);
+        ZoneId source=ZoneId.of(config.getSourceQueryTimezone());
+        t.setQueryScopeJson(json(new SelfopDiscoveryService.Query(from==null?null:from.atZone(ZoneOffset.UTC).withZoneSameInstant(source).toLocalDateTime().toString(),
+            until==null?null:until.atZone(ZoneOffset.UTC).withZoneSameInstant(source).toLocalDateTime().toString(),delivery,customer,null)));
+        t.setRequestHash(hash(Arrays.asList(t.getQueryScopeJson(),t.getScopeHash())));return taskService.create(t);
+    }
+    public void review(SelfopSyncScope preview,LocalDateTime now){
+        SelfopCollectionPolicy.requireAutomaticPlanning(config);
+        tx.executeWithoutResult(s->{var scope=locks.lockScope(preview.getId());
+            if(scope.getKnownOrderRoundMaxId()==null){var max=orders.selectOne(new QueryWrapper<SelfopOutboundOrder>().eq("source_account",scope.getSourceAccount()).eq("warehouse_code",scope.getWarehouseCode()).orderByDesc("id").last("LIMIT 1"));
+                scope.setKnownOrderRoundMaxId(max==null?0L:max.getId());scope.setKnownOrderCursorId(0L);scope.setKnownOrderRoundStartedAtUtc(now);}
+            var next=orders.selectOne(new QueryWrapper<SelfopOutboundOrder>().eq("source_account",scope.getSourceAccount()).eq("warehouse_code",scope.getWarehouseCode())
+                .gt("id",scope.getKnownOrderCursorId()).le("id",scope.getKnownOrderRoundMaxId()).orderByAsc("id").last("LIMIT 1"));
+            if(next!=null){String key="review:"+scope.getId()+":"+scope.getKnownOrderRoundStartedAtUtc()+":"+next.getId();
+                var t=shared(scope,null,null,key,"RECHECK",next.getCustomerCode(),next.getDeliveryNo());
+                long pending=tasks.selectCount(new QueryWrapper<SelfopSyncTask>().eq("upstream_task_id",t.getId()).ne("apply_state","APPLIED"));
+                long applied=tasks.selectCount(new QueryWrapper<SelfopSyncTask>().eq("upstream_task_id",t.getId()).eq("apply_state","APPLIED"));
+                if("SUCCEEDED".equals(t.getStatus())&&pending==0&&applied>0)scope.setKnownOrderCursorId(next.getId());
+            }else{scope.setKnownOrderRoundFinishedAtUtc(now);
+                scope.setKnownOrderRoundMaxId(null);scope.setKnownOrderCursorId(null);
+                scopes.update(null,new com.baomidou.mybatisplus.core.conditions.update.UpdateWrapper<SelfopSyncScope>().eq("id",scope.getId())
+                    .set("known_order_round_max_id",null).set("known_order_cursor_id",null).set("known_order_round_finished_at_utc",now));}
+            if(scope.getDiscoveryUntilUtc()!=null){
+                if(scope.getHistoryRoundUntilUtc()==null){scope.setHistoryRoundFromUtc(scope.getInitialFromUtc());scope.setHistoryRoundUntilUtc(scope.getDiscoveryUntilUtc());scope.setHistorySliceCursorUtc(scope.getInitialFromUtc());}
+                if(scope.getHistorySliceCursorUtc().isBefore(scope.getHistoryRoundUntilUtc())){
+                    var end=scope.getHistorySliceCursorUtc().plusDays(1);if(end.isAfter(scope.getHistoryRoundUntilUtc()))end=scope.getHistoryRoundUntilUtc();
+                    var t=shared(scope,scope.getHistorySliceCursorUtc(),end,"history:"+scope.getId()+":"+scope.getHistoryRoundUntilUtc()+":"+scope.getHistorySliceCursorUtc(),"RECHECK",null,null);
+                    var child=tasks.selectOne(new QueryWrapper<SelfopSyncTask>().eq("upstream_task_id",t.getId()).eq("scope_id",scope.getId()));
+                    if(child!=null&&"APPLIED".equals(child.getApplyState()))scope.setHistorySliceCursorUtc(end);
+                }else{scope.setHistoryRoundFinishedAtUtc(now);scope.setHistoryRoundUntilUtc(null);scope.setHistorySliceCursorUtc(null);scopes.update(null,new com.baomidou.mybatisplus.core.conditions.update.UpdateWrapper<SelfopSyncScope>().eq("id",scope.getId())
+                    .set("history_round_until_utc",null).set("history_slice_cursor_utc",null).set("history_round_finished_at_utc",now));}
+            }
+            scope.setUpdatedAt(now);scopes.updateById(scope);
+        });
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/sync/SelfopTaskService.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/sync/SelfopTaskService.java
new file mode 100644
index 000000000..4ff32a8b4
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/sync/SelfopTaskService.java
@@ -0,0 +1,362 @@
+package com.baiyue.lastleg.selfoperated.analytics.sync;
+
+import com.baomidou.mybatisplus.core.conditions.query.QueryWrapper;
+import com.baiyue.lastleg.selfoperated.analytics.request.SelfopBusinessBudget;
+import com.baomidou.mybatisplus.core.conditions.update.UpdateWrapper;
+import com.baomidou.mybatisplus.core.toolkit.IdWorker;
+import com.baiyue.lastleg.selfoperated.analytics.mapper.*;
+import com.baiyue.lastleg.selfoperated.analytics.model.*;
+import org.springframework.dao.DuplicateKeyException;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Transactional;
+import java.time.*;
+import java.util.*;
+import static com.baiyue.lastleg.selfoperated.analytics.model.SelfopSupport.*;
+import static com.baiyue.lastleg.selfoperated.analytics.model.SelfopCollectionPolicy.*;
+
+@Service
+public class SelfopTaskService {
+    private final SelfopSyncScopeMapper scopes;
+    private final SelfopOutboundDiscoveryScopeMapper accounts;
+    private final SelfopSyncTaskMapper tasks;
+    private final SelfopSyncRunMapper runs;
+    private final SelfopCoordinationMapper locks;
+    private final SelfopAnalyticsProperties config;
+    private final SelfopLeaseService leases;
+    public SelfopTaskService(SelfopSyncScopeMapper scopes,SelfopOutboundDiscoveryScopeMapper accounts,
+        SelfopSyncTaskMapper tasks,SelfopSyncRunMapper runs,SelfopCoordinationMapper locks,SelfopAnalyticsProperties config,SelfopLeaseService leases) {
+        this.scopes=scopes;this.accounts=accounts;this.tasks=tasks;this.runs=runs;this.locks=locks;this.config=config;this.leases=leases;
+    }
+    @Transactional
+    public List<SelfopSyncScope> initialize() {
+        identity(config.getSourceAccount(),64); require(!config.getWarehouses().isEmpty(),"SELFOP_WAREHOUSE_UNCONFIGURED");
+        var now=utcNow();
+        initializeAccount();
+        for(var e:config.getWarehouses().entrySet()) for(String family:List.of("OUTBOUND","INVENTORY")) {
+            identity(e.getKey(),64);var p=e.getValue();ZoneId.of(p.getBusinessTimezone());
+            var existing=scopes.selectOne(new QueryWrapper<SelfopSyncScope>().eq("source_account",config.getSourceAccount()).eq("warehouse_code",e.getKey()).eq("data_family",family));
+            Map<String,Object> definition=new TreeMap<>();definition.put("customerMode","ALL_AUTHORIZED");definition.put("sourceAccount",config.getSourceAccount());
+            definition.put("warehouseCode",e.getKey());definition.put("dataFamily",family);definition.put("businessTimezone",p.getBusinessTimezone());
+            definition.put("sourceTimezone",p.getSourceTimezone());definition.put("quantityUnit",config.getQuantityUnit());
+            definition.put("qualities",family.equals("INVENTORY")?"ALL":"ACTUAL_OUTBOUND");
+            definition.put("staleAfterSeconds",family.equals("INVENTORY")?p.getInventoryStaleAfterSeconds():p.getOutboundStaleAfterSeconds());
+            String digest=hash(definition);
+            if(existing!=null){
+                if("VALIDATION".equals(config.getCollectionMode()))continue;
+                if(!existing.getScopeHash().equals(digest)){
+                    existing=locks.lockScope(existing.getId());
+                    var update=new UpdateWrapper<SelfopSyncScope>().eq("id",existing.getId())
+                        .set("scope_json",json(definition)).set("scope_hash",digest).set("business_timezone",p.getBusinessTimezone()).set("source_timezone",p.getSourceTimezone())
+                        .set("schedule_cron",family.equals("OUTBOUND")?p.getOutboundCron():p.getInventoryCron())
+                        .set("stale_after_seconds",family.equals("OUTBOUND")?p.getOutboundStaleAfterSeconds():p.getInventoryStaleAfterSeconds())
+                        .set("fence_token",existing.getFenceToken()+1).set("lease_owner",null).set("lease_until_utc",null).set("updated_at",now);
+                    if("OUTBOUND".equals(family)){
+                        update.set("discovery_from_utc",null).set("discovery_until_utc",null).set("rebuild_required",1).set("invalidated_at_utc",now)
+                            .set("fact_revision",existing.getFactRevision()+1).set("known_order_round_max_id",null).set("known_order_cursor_id",null)
+                            .set("history_round_until_utc",null).set("history_slice_cursor_utc",null);
+                        if(existing.getInitialUntilUtc()!=null)update.set("initial_from_utc",existing.getInitialUntilUtc().atZone(ZoneOffset.UTC)
+                            .withZoneSameInstant(ZoneId.of(p.getBusinessTimezone())).minusMonths(2).withZoneSameInstant(ZoneOffset.UTC).toLocalDateTime());
+                    }
+                    scopes.update(null,update);
+                }
+                continue;
+            }
+            var s=new SelfopSyncScope();s.setId(IdWorker.getId());s.setSourceAccount(config.getSourceAccount());s.setWarehouseCode(e.getKey());s.setDataFamily(family);
+            s.setScopeJson(json(definition));s.setScopeHash(digest);s.setBusinessTimezone(p.getBusinessTimezone());s.setSourceTimezone(p.getSourceTimezone());
+            s.setScheduleCron(family.equals("OUTBOUND")?p.getOutboundCron():p.getInventoryCron());
+            s.setStaleAfterSeconds(family.equals("OUTBOUND")?p.getOutboundStaleAfterSeconds():p.getInventoryStaleAfterSeconds());
+            s.setFactRevision(0L);s.setPublishedFactRevision(0L);s.setRebuildRequired(0);s.setFenceToken(0L);
+            s.setReviewRequestBudget(p.getReviewRequestBudget());s.setReviewTimeBudgetSeconds(p.getReviewTimeBudgetSeconds());s.setReviewTargetDays(p.getReviewTargetDays());
+            require(s.getStaleAfterSeconds()>0&&s.getReviewRequestBudget()>0&&s.getReviewTimeBudgetSeconds()>0,"SELFOP_BUDGET_INVALID");
+            s.setCreatedAt(now);s.setUpdatedAt(now);try{scopes.insert(s);}catch(DuplicateKeyException ignored){ }
+        }
+        return scopes.selectList(new QueryWrapper<SelfopSyncScope>().eq("source_account",config.getSourceAccount()).orderByAsc("warehouse_code","data_family"));
+    }
+    @Transactional
+    public SelfopOutboundDiscoveryScope initializeAccount() {
+        identity(config.getSourceAccount(),64);
+        var now=utcNow();
+        var account=accounts.selectOne(new QueryWrapper<SelfopOutboundDiscoveryScope>().eq("source_account",config.getSourceAccount()));
+        if(account!=null)return account;
+        account=new SelfopOutboundDiscoveryScope();account.setId(IdWorker.getId());account.setSourceAccount(config.getSourceAccount());
+        account.setNextSequence(1L);account.setNextObservationSequence(1L);account.setFenceToken(0L);
+        account.setRequestBudget(config.getRequestBudget());account.setTimeBudgetSeconds(config.getTimeBudgetSeconds());
+        account.setMinRequestIntervalMs(config.getMinRequestIntervalMs());account.setCreatedAt(now);account.setUpdatedAt(now);
+        require(account.getRequestBudget()>0&&account.getTimeBudgetSeconds()>0&&account.getMinRequestIntervalMs()>0,"SELFOP_BUDGET_INVALID");
+        try{accounts.insert(account);}catch(DuplicateKeyException ignored){
+            account=accounts.selectOne(new QueryWrapper<SelfopOutboundDiscoveryScope>().eq("source_account",config.getSourceAccount()));
+            require(account!=null,"SELFOP_SCOPE_MISSING");
+        }
+        return account;
+    }
+    @Transactional(noRollbackFor=BusinessSessionStoppedException.class)
+    public SelfopSyncTask create(SelfopSyncTask task) {
+        identity(task.getRequestKey(),128); var existing=tasks.selectOne(new QueryWrapper<SelfopSyncTask>()
+            .eq("source_account",task.getSourceAccount()).eq("request_key",task.getRequestKey()));
+        if(existing!=null){require(existing.getRequestHash().equals(task.getRequestHash()),"SELFOP_IDEMPOTENCY_CONFLICT");businessGuard(existing);return existing;}
+        if(task.getExecutionPurpose()==null)task.setExecutionPurpose(configuredPurpose(config));
+        requireExecution(config,task.getExecutionPurpose());
+        var now=utcNow();task.setId(IdWorker.getId());task.setAttemptCount(0);task.setCreatedAt(now);task.setUpdatedAt(now);
+        task.setTaskNo("LXCOL-"+now.atZone(ZoneOffset.UTC).withZoneSameInstant(ZoneId.of("Asia/Shanghai")).toLocalDate().toString().replace("-","")+"-"+UUID.randomUUID().toString().replace("-","").substring(0,16).toUpperCase(Locale.ROOT));
+        if("VALIDATION".equals(task.getExecutionPurpose())){
+            require("VALIDATION".equals(task.getTaskType()),"SELFOP_VALIDATION_ENTRY_REQUIRED");
+            if(task.getValidationRootTaskId()==null){task.setValidationRootTaskId(task.getId());
+                boolean directoryOnly=warehouseDiscovery(task);
+                if(!directoryOnly)validationWarehouse(task);
+                task.setValidationBudgetJson(directoryOnly
+                    ?com.baiyue.lastleg.selfoperated.analytics.request.SelfopValidationBudget.freezeWarehouseDiscovery(now)
+                    :com.baiyue.lastleg.selfoperated.analytics.request.SelfopValidationBudget.freeze(now));}
+            task.setApplyState("NOT_APPLICABLE");
+        }
+        if(testBusiness(task)) {
+            require(task.getBusinessRootTaskId()==null&&task.getBusinessBudgetJson()==null,"BUSINESS_SESSION_IDENTITY_INVALID");
+            if(continuousBusiness(config)&&continuousBusinessRoot(task)){
+                if("WAREHOUSE_SYNC".equals(task.getTaskRole())){
+                    var scope=scopes.selectById(task.getScopeId());
+                    require(scope!=null&&"INVENTORY".equals(scope.getDataFamily())&&Objects.equals(scope.getSourceAccount(),task.getSourceAccount())
+                        &&Objects.equals(scope.getWarehouseCode(),task.getWarehouseCode())&&Objects.equals(scope.getScopeHash(),task.getScopeHash())
+                        &&Objects.equals(scope.getScopeJson(),task.getQueryScopeJson()),"SELFOP_INVENTORY_SCOPE_INVALID");
+                }
+                task.setBusinessRootTaskId(task.getId());task.setBusinessBudgetJson(SelfopBusinessBudget.freezeContinuous(now));
+            }else if(task.getRequestKey().startsWith("manual:")&&task.getUpstreamTaskId()==null) {
+                require(controlledBusinessTask(task,tasks::selectById,continuousBusiness(config)),"SELFOP_TEST_MANUAL_TASK_REQUIRED");
+                task.setBusinessRootTaskId(task.getId());
+                task.setBusinessBudgetJson(SelfopBusinessBudget.freeze(now));
+            }else {
+                var parent=businessParent(task);
+                require(parent!=null&&Objects.equals(parent.getSourceAccount(),task.getSourceAccount())&&controlledBusinessTask(parent,tasks::selectById,continuousBusiness(config)),"SELFOP_TEST_MANUAL_TASK_REQUIRED");
+                if("MANUAL_RETRY".equals(task.getTaskType()))require("SUCCEEDED".equals(task.getStatus())&&task.getRequestKey().startsWith("retry:")&&task.getUpstreamTaskId()!=null,"SELFOP_TEST_MANUAL_TASK_REQUIRED");
+                require("MANUAL_RETRY".equals(task.getTaskType())||controlledBusinessTask(task,tasks::selectById,continuousBusiness(config)),"SELFOP_TEST_MANUAL_TASK_REQUIRED");
+                businessGuard(parent);task.setBusinessRootTaskId(parent.getBusinessRootTaskId());
+            }
+        }
+        task.setStatus(task.getStatus()==null?"READY":task.getStatus());
+        task.setApplyState(task.getApplyState()==null?"NOT_APPLICABLE":task.getApplyState());
+        if("ACCOUNT_DISCOVERY".equals(task.getTaskRole())) {
+            var account=locks.lockDiscovery(task.getDiscoveryScopeId());task.setDiscoverySequence(account.getNextSequence());
+            task.setObservationBaseline(account.getNextObservationSequence()-1);account.setNextSequence(account.getNextSequence()+1);account.setUpdatedAt(now);accounts.updateById(account);
+        }
+        try{tasks.insert(task);}catch(DuplicateKeyException ignored){existing=tasks.selectOne(new QueryWrapper<SelfopSyncTask>()
+            .eq("source_account",task.getSourceAccount()).eq("request_key",task.getRequestKey()).last("FOR UPDATE"));
+            require(existing!=null&&existing.getRequestHash().equals(task.getRequestHash()),"SELFOP_IDEMPOTENCY_CONFLICT");businessGuard(existing);return existing;}
+        return task;
+    }
+    @Transactional(noRollbackFor=BusinessSessionStoppedException.class)
+    public SelfopSyncRun begin(long taskId,SelfopLeaseService.Lease lease) {
+        lockBusinessAccount(taskId);leases.verify(lease);
+        if("test".equals(config.getEnvironment())||continuousBusiness(config)){var preview=tasks.selectById(taskId);businessGuard(preview);}
+        var task=locks.lockTask(taskId);require(task!=null&&!"SUCCEEDED".equals(task.getStatus())&&!"DEAD".equals(task.getStatus()),"SELFOP_TASK_NOT_EXECUTABLE");
+        checkTaskLease(task,lease);
+        requireExecution(config,task.getExecutionPurpose());
+        require(!"SAMPLE_DONE".equals(task.getStatus()),"SELFOP_VALIDATION_TERMINATED");
+        if(lease.account()) {var account=locks.lockDiscovery(lease.scopeId());account.setActiveTaskId(taskId);account.setUpdatedAt(utcNow());accounts.updateById(account);}
+        var now=utcNow();var active=runs.selectOne(new QueryWrapper<SelfopSyncRun>().eq("task_id",taskId).eq("status","FETCHING").orderByDesc("id").last("LIMIT 1"));
+        if("MASTER_DATA".equals(task.getTaskType()) || task.getScopeId()!=null && "INVENTORY".equals(scopes.selectById(task.getScopeId()).getDataFamily())) {
+            var yielded=runs.selectOne(new QueryWrapper<SelfopSyncRun>().eq("task_id",taskId).eq("status","YIELDED").orderByDesc("id").last("LIMIT 1"));
+            if(yielded!=null){yielded.setStatus("FETCHING");yielded.setFinishedAtUtc(null);yielded.setProgressSnapshotJson(null);yielded.setFenceToken(lease.fence());yielded.setUpdatedAt(now);
+                runs.update(null,new UpdateWrapper<SelfopSyncRun>().eq("id",yielded.getId()).set("status","FETCHING").set("fence_token",lease.fence()).set("finished_at_utc",null).set("progress_snapshot_json",null).set("updated_at",now));
+                task.setStatus("RUNNING");task.setUpdatedAt(now);tasks.updateById(task);return yielded;}
+        }
+        if(active!=null){require(!Objects.equals(active.getFenceToken(),lease.fence()),"SELFOP_TASK_ALREADY_RUNNING");
+            SelfopProgressProjection.freezeRun(task,active);
+            active.setStatus("ABORTED");active.setLastPhase("FETCHING");active.setFinishedAtUtc(now);active.setErrorCode("LEASE_EXPIRED");active.setErrorMessage("执行租约失效");active.setUpdatedAt(now);runs.updateById(active);}
+        if("MASTER_DATA".equals(task.getTaskType()) || task.getScopeId()!=null&&"INVENTORY".equals(scopes.selectById(task.getScopeId()).getDataFamily())) {
+            // Every genuinely new inventory attempt starts at page one, including a crash that never called fail().
+            task.setRoutingManifestJson(null);
+            tasks.update(null,new UpdateWrapper<SelfopSyncTask>().eq("id",taskId).set("routing_manifest_json",null));
+        }
+        var run=new SelfopSyncRun();run.setId(IdWorker.getId());run.setTaskId(taskId);run.setScopeId(task.getScopeId());
+        run.setExecutionPurpose(task.getExecutionPurpose());run.setHeartbeatAtUtc(now);
+        run.setSourceAccount(task.getSourceAccount());run.setWarehouseCode(task.getWarehouseCode());run.setRunRole(task.getTaskRole());run.setUpstreamTaskId(task.getUpstreamTaskId());
+        run.setAttemptNo(task.getAttemptCount()+1);run.setScopeHash(task.getScopeHash());run.setScopeSnapshotJson(task.getQueryScopeJson());
+        run.setFenceToken(lease.fence());run.setStatus("FETCHING");run.setLastPhase("FETCHING");run.setFetchStartedAtUtc(now);
+        run.setPageCount(0);run.setUniqueObjectCount(0L);run.setCoverageStatus("UNKNOWN");run.setCreatedAt(now);run.setUpdatedAt(now);
+        if(task.getScopeId()!=null){var scope=scopes.selectById(task.getScopeId());run.setBasePublishedRunId(scope.getPublishedRunId());
+            Map<String,Object> snapshot=new TreeMap<>(read(scope.getScopeJson(),Map.class));
+            snapshot.put("initialFromUtc",scope.getInitialFromUtc());snapshot.put("initialUntilUtc",scope.getInitialUntilUtc());
+            snapshot.put("businessTimezone",scope.getBusinessTimezone());snapshot.put("sourceTimezone",scope.getSourceTimezone());
+            snapshot.put("staleAfterSeconds",scope.getStaleAfterSeconds());run.setScopeSnapshotJson(json(snapshot));
+            if("INVENTORY".equals(scope.getDataFamily())){var sales=scopes.selectOne(new QueryWrapper<SelfopSyncScope>().eq("source_account",task.getSourceAccount()).eq("warehouse_code",task.getWarehouseCode()).eq("data_family","OUTBOUND"));
+                if(sales!=null)sales=locks.lockScope(sales.getId());
+                run.setReferenceSalesRunId(sales==null?null:sales.getPublishedRunId());}}
+        runs.insert(run);task.setAttemptCount(run.getAttemptNo());task.setStatus("RUNNING");task.setUpdatedAt(now);
+        String initialPhase="MASTER_DATA".equals(task.getTaskType())?"CUSTOMERS":lease.account()?"DIRECTORY":("INVENTORY".equals(scopes.selectById(task.getScopeId()).getDataFamily())?"INVENTORY":"MERGE");
+        SelfopProgressProjection.applyCheckpoint(task,run,initialPhase,"PAGE",0,null,1);tasks.updateById(task);return run;
+    }
+    @Transactional(noRollbackFor=BusinessSessionStoppedException.class)
+    public void yield(long taskId,long runId,SelfopLeaseService.Lease lease) {
+        lockBusinessAccount(taskId);leases.verify(lease);
+        guardBeforeTaskLock(taskId);
+        var now=utcNow();var task=locks.lockTask(taskId);var run=locks.lockRun(runId);checkRunLease(task,run,lease);requireBusiness(task);requireBusiness(run);SelfopProgressProjection.freezeRun(task,run);run.setStatus("YIELDED");run.setFinishedAtUtc(now);run.setUpdatedAt(now);runs.updateById(run);
+        // Persist the master-data pacing across restarts; ordinary sales/inventory scheduling stays unchanged.
+        task.setStatus("RETRY_WAIT");task.setNextRetryAtUtc(now.plusSeconds("MASTER_DATA".equals(task.getTaskType())?5:1));task.setUpdatedAt(now);tasks.updateById(task);
+    }
+    @Transactional(noRollbackFor=BusinessSessionStoppedException.class)
+    public void fail(long taskId,long runId,SelfopFailure failure,SelfopLeaseService.Lease lease) {
+        lockBusinessAccount(taskId);leases.verify(lease);
+        try{guardBeforeTaskLock(taskId);}catch(BusinessSessionStoppedException stopped){return;}
+        var now=utcNow();var task=locks.lockTask(taskId);var run=locks.lockRun(runId);checkRunLease(task,run,lease);requireBusiness(task);requireBusiness(run);
+        String code=failure.code();boolean retryable=failure.retryable();String phase=SelfopFailure.phase(task,run);
+        SelfopProgressProjection.freezeRun(task,run);run.setLastPhase(run.getStatus());run.setStatus("FAILED");run.setErrorCode(code);
+        run.setFinishedAtUtc(now);run.setUpdatedAt(now);runs.updateById(run);
+        // A yielded execution is not a failed request; finite failures are counted separately.
+        long failures=runs.selectCount(new QueryWrapper<SelfopSyncRun>().eq("task_id",taskId).eq("status","FAILED"));
+        boolean inventory=task.getScopeId()!=null&&"INVENTORY".equals(scopes.selectById(task.getScopeId()).getDataFamily());
+        int maxRetries=Math.max(0,config.getMaxAttempts()-1);
+        if(task.getBusinessRootTaskId()!=null&&continuousBusinessRoot(tasks.selectById(task.getBusinessRootTaskId()))) {
+            boolean outbound=!"MASTER_DATA".equals(task.getTaskType())
+                &&("ACCOUNT_DISCOVERY".equals(task.getTaskRole())||task.getScopeId()!=null&&"OUTBOUND".equals(scopes.selectById(task.getScopeId()).getDataFamily()));
+            // Retry the same durable task, never a new daily root that would reset the failure budget.
+            if(outbound)maxRetries=SelfopFailure.OUTBOUND_MAX_RETRIES;
+            retryable=retryable&&(inventory&&Set.of("SELFOP_STOCK_DUPLICATE","SELFOP_STOCK_COUNT_MISMATCH","SELFOP_PAGE_TOTAL_CHANGED").contains(code)
+                ||"MASTER_DATA".equals(task.getTaskType())&&Set.of("SELFOP_MASTER_DUPLICATE","SELFOP_MASTER_COUNT_MISMATCH","SELFOP_PAGE_TOTAL_CHANGED").contains(code)
+                ||outbound&&failure.outboundRetryable());
+        }
+        task.setStatus(retryable&&failures<=maxRetries?"RETRY_WAIT":"DEAD");
+        run.setErrorMessage(failure.stored(phase,failures,maxRetries,"RETRY_WAIT".equals(task.getStatus())));runs.updateById(run);
+        if("APPLYING".equals(task.getApplyState())) task.setApplyState("BLOCKED");
+        if(inventory) {
+            task.setRoutingManifestJson(null);
+            tasks.update(null,new UpdateWrapper<SelfopSyncTask>().eq("id",taskId).set("routing_manifest_json",null));
+        }
+        if(Set.of("SELFOP_DIRECTORY_DUPLICATE","SELFOP_DIRECTORY_COUNT_MISMATCH","SELFOP_DIRECTORY_UNSTABLE","SELFOP_PAGE_TOTAL_CHANGED").contains(code)) {
+            task.setRoutingManifestJson(null);
+            tasks.update(null,new UpdateWrapper<SelfopSyncTask>().eq("id",taskId).set("routing_manifest_json",null));
+        }
+        task.setNextRetryAtUtc("DEAD".equals(task.getStatus())?null:now.plusSeconds(Math.min(3600,5L<<Math.min(9,(int)failures))));task.setUpdatedAt(now);tasks.updateById(task);
+        if("DEAD".equals(task.getStatus()))tasks.update(null,new UpdateWrapper<SelfopSyncTask>().eq("id",taskId).set("next_retry_at_utc",null));
+    }
+    @Transactional(noRollbackFor=BusinessSessionStoppedException.class)
+    public SelfopSyncTask retry(long id,String requestKey,String operator,String reason) {
+        identity(reason,500);
+        identity(requestKey,128);var preview=tasks.selectById(id);require(preview!=null,"SELFOP_TASK_MISSING");
+        lockBusinessAccount(id);
+        var commandQuery=new QueryWrapper<SelfopSyncTask>().eq("source_account",preview.getSourceAccount()).eq("request_key","retry:"+requestKey);
+        var prior=tasks.selectOne(commandQuery);
+        if(prior!=null){require(prior.getRequestHash().equals(hash(List.of(id,requestKey,reason))),"SELFOP_IDEMPOTENCY_CONFLICT");businessGuard(preview,false);return preview;}
+        // Match executor lock ordering: account/warehouse scope first, task second.
+        String activeOwner;LocalDateTime activeUntil;
+        if("ACCOUNT_DISCOVERY".equals(preview.getTaskRole())){var scope=locks.lockDiscovery(preview.getDiscoveryScopeId());require(scope!=null,"SELFOP_SCOPE_MISSING");activeOwner=scope.getLeaseOwner();activeUntil=scope.getLeaseUntilUtc();}
+        else{var scope=locks.lockScope(preview.getScopeId());require(scope!=null,"SELFOP_SCOPE_MISSING");activeOwner=scope.getLeaseOwner();activeUntil=scope.getLeaseUntilUtc();}
+        prior=tasks.selectOne(new QueryWrapper<SelfopSyncTask>().eq("source_account",preview.getSourceAccount()).eq("request_key","retry:"+requestKey).last("FOR UPDATE"));
+        if(prior!=null){require(prior.getRequestHash().equals(hash(List.of(id,requestKey,reason))),"SELFOP_IDEMPOTENCY_CONFLICT");return tasks.selectById(id);}
+        businessGuard(preview,false,true);
+        require(SelfopLeaseService.available(activeOwner,activeUntil,utcNow()),"SELFOP_RETRY_LEASE_BUSY");
+        var original=locks.lockTask(id);require(original!=null,"SELFOP_TASK_MISSING");
+        requireBusiness(original);requireExecution(config,original.getExecutionPurpose());
+        require(!"SUCCEEDED".equals(original.getStatus()),"SELFOP_TASK_ALREADY_SUCCEEDED");
+        // The audit creation checks the parent again. Persist the authorized resume in this same
+        // transaction before creating it; any audit failure rolls the resume back as well.
+        original.setStatus("READY");original.setNextRetryAtUtc(utcNow());
+        if(!continuousBusinessRoot(original))original.setRequestedBy(operator);
+        original.setUpdatedAt(utcNow());tasks.updateById(original);
+        // Resume original logical task, retaining apply barrier and stage set. Record the manual command separately.
+        var audit=new SelfopSyncTask();audit.setSourceAccount(original.getSourceAccount());audit.setTaskRole(original.getTaskRole());audit.setScopeId(original.getScopeId());
+        audit.setExecutionPurpose(original.getExecutionPurpose());
+        audit.setWarehouseCode(original.getWarehouseCode());audit.setDiscoveryScopeId(original.getDiscoveryScopeId());audit.setUpstreamTaskId(original.getId());
+        audit.setRequestKey("retry:"+requestKey);audit.setRequestHash(hash(List.of(id,requestKey,reason)));audit.setTaskType("MANUAL_RETRY");audit.setScopeHash(original.getScopeHash());
+        audit.setQueryScopeJson(json(Map.of("resumesTaskNo",original.getTaskNo(),"reason",reason)));audit.setStatus("SUCCEEDED");audit.setApplyState("NOT_APPLICABLE");audit.setRequestedBy(operator);
+        create(audit);
+        return original;
+    }
+    public List<SelfopSyncTask> due(int limit){return continuousBusiness(config)?locks.dueContinuous(utcNow(),limit,config.getSourceAccount()):locks.due(utcNow(),limit,config.getCollectionMode());}
+    @Transactional(noRollbackFor=BusinessSessionStoppedException.class)
+    public void candidateFinished(long taskId,long runId,SelfopLeaseService.Lease lease) {
+        lockBusinessAccount(taskId);leases.verify(lease);guardBeforeTaskLock(taskId);var task=locks.lockTask(taskId);var run=locks.lockRun(runId);
+        checkRunLease(task,run,lease);
+        require("READY".equals(run.getStatus()),"SELFOP_CANDIDATE_NOT_READY");
+        run.setFinishedAtUtc(utcNow());run.setUpdatedAt(utcNow());runs.updateById(run);
+        // Candidate readiness is not business success until a published result is linked.
+        task.setStatus("RETRY_WAIT");task.setNextRetryAtUtc(utcNow().plusSeconds(config.getMinimumBuildIntervalSeconds()));task.setUpdatedAt(utcNow());tasks.updateById(task);
+    }
+    @Transactional(noRollbackFor=BusinessSessionStoppedException.class)
+    public void waitForBudget(long taskId,long runId,LocalDateTime until,SelfopLeaseService.Lease lease) {
+        lockBusinessAccount(taskId);leases.verify(lease);if("test".equals(config.getEnvironment())||continuousBusiness(config)){var preview=tasks.selectById(taskId);businessGuard(preview);}var task=locks.lockTask(taskId);var run=locks.lockRun(runId);checkRunLease(task,run,lease);requireBusiness(task);requireBusiness(run);
+        SelfopProgressProjection.freezeRun(task,run);run.setLastPhase(run.getStatus());run.setStatus("YIELDED");run.setFinishedAtUtc(utcNow());run.setUpdatedAt(utcNow());runs.updateById(run);
+        task.setStatus("RETRY_WAIT");task.setNextRetryAtUtc(until);task.setUpdatedAt(utcNow());tasks.updateById(task);
+    }
+    public record CollectionCheckpoint(SelfopSyncTask task,SelfopSyncRun run) { }
+    /** Caller holds the checkpoint transaction through all stage/progress writes. Never trust response-era entities. */
+    @Transactional(propagation=org.springframework.transaction.annotation.Propagation.MANDATORY)
+    public CollectionCheckpoint checkpoint(SelfopSyncTask observedTask,SelfopSyncRun observedRun,SelfopLeaseService.Lease lease) {
+        long taskId=observedTask.getId();lockBusinessAccount(taskId);leases.verify(lease);
+        if("test".equals(config.getEnvironment())||continuousBusiness(config)) {
+            var preview=tasks.selectById(taskId);require(preview!=null,"SELFOP_TASK_MISSING");businessGuard(preview,false);
+        }
+        var task=locks.lockTask(taskId);var run=locks.lockRun(observedRun.getId());checkRunLease(task,run,lease);
+        requireBusiness(task);requireBusiness(run);
+        require("RUNNING".equals(task.getStatus())&&"FETCHING".equals(run.getStatus()),"SELFOP_COLLECTION_TERMINATED");
+        return new CollectionCheckpoint(task,run);
+    }
+    /** Explicit session stops remain binding after removal of artificial BUSINESS deadlines. */
+    public static final class BusinessSessionStoppedException extends com.baiyue.common.core.exception.BizException {
+        private final String reason;
+        BusinessSessionStoppedException(String reason){super("本次采集会话已停止或计数无效，请核对停止原因与原检查点");this.reason=reason;}
+        public String reason(){return reason;}
+    }
+    private boolean testBusiness(SelfopSyncTask task){return task!=null&&("test".equals(config.getEnvironment())||continuousBusiness(config))&&"BUSINESS".equals(task.getExecutionPurpose());}
+    private SelfopSyncTask businessParent(SelfopSyncTask task){
+        Long id=task.getUpstreamTaskId();
+        if(id==null&&task.getQueryScopeJson()!=null){var query=read(task.getQueryScopeJson(),Map.class);if(query.get("parentTaskId") instanceof Number n)id=n.longValue();}
+        return id==null?null:tasks.selectById(id);
+    }
+    private void lockBusinessAccount(long id){
+        if(!"test".equals(config.getEnvironment())&&!continuousBusiness(config))return;
+        var task=tasks.selectById(id);if(!testBusiness(task))return;
+        require(task.getBusinessRootTaskId()!=null,"BUSINESS_SESSION_ROOT_REQUIRED");
+        var account=accounts.selectOne(new QueryWrapper<SelfopOutboundDiscoveryScope>().eq("source_account",task.getSourceAccount()));
+        require(account!=null,"SELFOP_SCOPE_MISSING");locks.lockDiscovery(account.getId());
+    }
+    private void guardBeforeTaskLock(long id){
+        if(!"test".equals(config.getEnvironment())&&!continuousBusiness(config))return;
+        var task=tasks.selectById(id);businessGuard(task);
+    }
+    private void businessGuard(SelfopSyncTask task){businessGuard(task,true);}
+    private void businessGuard(SelfopSyncTask task,boolean terminate){businessGuard(task,terminate,false);}
+    private void businessGuard(SelfopSyncTask task,boolean terminate,boolean inventoryRetry){
+        if(!testBusiness(task))return;
+        require(controlledBusinessTask(task,tasks::selectById,continuousBusiness(config)),"SELFOP_TEST_MANUAL_TASK_REQUIRED");
+        require(task.getBusinessRootTaskId()!=null,"BUSINESS_SESSION_ROOT_REQUIRED");
+        var ancestor=task;
+        while(!ancestor.getRequestKey().startsWith("manual:")&&!continuousBusinessRoot(ancestor))ancestor=businessParent(ancestor);
+        require(Objects.equals(ancestor.getId(),task.getBusinessRootTaskId()),"BUSINESS_SESSION_ROOT_INVALID");
+        // Serialize with egress in account -> root -> task order, before taking any task row lock.
+        var account=accounts.selectOne(new QueryWrapper<SelfopOutboundDiscoveryScope>().eq("source_account",task.getSourceAccount()));
+        require(account!=null,"SELFOP_SCOPE_MISSING");locks.lockDiscovery(account.getId());
+        var root=locks.lockTask(task.getBusinessRootTaskId());
+        require(root!=null&&Objects.equals(root.getId(),root.getBusinessRootTaskId())&&Objects.equals(root.getSourceAccount(),task.getSourceAccount())
+            &&root.getRequestKey()!=null&&(root.getRequestKey().startsWith("manual:")||continuousBusinessRoot(root))&&controlledBusinessTask(root,tasks::selectById,continuousBusiness(config)),"BUSINESS_SESSION_ROOT_INVALID");
+        require(root.getBusinessBudgetJson()!=null,"BUSINESS_SESSION_BUDGET_INVALID");
+        var budget=read(root.getBusinessBudgetJson(),SelfopBusinessBudget.class);budget.validate();
+        require(!budget.continuous||(continuousBusiness(config)&&continuousBusinessRoot(root)),"SELFOP_CONTINUOUS_COLLECTION_DISABLED");
+        String reason=budget.stopReason;
+        if(reason==null&&"DEAD".equals(root.getStatus())&&!(inventoryRetry&&failedInventoryScanRoot(root)))reason="BUSINESS_SESSION_STOPPED";
+        if(reason==null)return;
+        if(!terminate)throw new BusinessSessionStoppedException(reason);
+        var now=utcNow();budget.stopReason=reason;
+        tasks.update(null,new UpdateWrapper<SelfopSyncTask>().eq("id",root.getId()).set("business_budget_json",json(budget)).set("status","DEAD").set("next_retry_at_utc",null).set("updated_at",now));
+        var members=tasks.selectList(new QueryWrapper<SelfopSyncTask>().eq("business_root_task_id",root.getId()).eq("source_account",root.getSourceAccount()).eq("execution_purpose","BUSINESS"));
+        var ids=new ArrayList<Long>();for(var member:members)ids.add(member.getId());if(!ids.contains(root.getId()))ids.add(root.getId());
+        runs.update(null,new UpdateWrapper<SelfopSyncRun>().in("task_id",ids).eq("source_account",root.getSourceAccount()).eq("execution_purpose","BUSINESS").in("status",List.of("FETCHING","VALIDATED","YIELDED","READY","BUILDING"))
+            .set("status","FAILED").set("error_code",reason).set("error_message","测试采集会话已结束").set("finished_at_utc",now).set("updated_at",now));
+        tasks.update(null,new UpdateWrapper<SelfopSyncTask>().in("id",ids).eq("source_account",root.getSourceAccount()).eq("execution_purpose","BUSINESS").in("status",List.of("WAITING_SOURCE","READY","RUNNING","RETRY_WAIT"))
+            .set("status","DEAD").set("next_retry_at_utc",null).set("updated_at",now));
+        throw new BusinessSessionStoppedException(reason);
+    }
+    private boolean failedInventoryScanRoot(SelfopSyncTask root){
+        if(!continuousBusiness(config)||!continuousBusinessRoot(root)||!"WAREHOUSE_SYNC".equals(root.getTaskRole()))return false;
+        var scope=scopes.selectById(root.getScopeId());
+        if(scope==null||!"INVENTORY".equals(scope.getDataFamily()))return false;
+        var latest=runs.selectOne(new QueryWrapper<SelfopSyncRun>().eq("task_id",root.getId())
+            .orderByDesc("attempt_no","id").last("LIMIT 1"));
+        return latest!=null&&"FAILED".equals(latest.getStatus())
+            &&Set.of("SELFOP_STOCK_DUPLICATE","SELFOP_STOCK_COUNT_MISMATCH","SELFOP_PAGE_TOTAL_CHANGED").contains(latest.getErrorCode());
+    }
+    private static void checkTaskLease(SelfopSyncTask task,SelfopLeaseService.Lease lease){
+        require(task!=null&&(lease.account()?"ACCOUNT_DISCOVERY".equals(task.getTaskRole())&&Objects.equals(task.getDiscoveryScopeId(),lease.scopeId())
+            :"WAREHOUSE_SYNC".equals(task.getTaskRole())&&Objects.equals(task.getScopeId(),lease.scopeId())),"SELFOP_TASK_LEASE_SCOPE_MISMATCH");
+    }
+    private static void checkRunLease(SelfopSyncTask task,SelfopSyncRun run,SelfopLeaseService.Lease lease){
+        checkTaskLease(task,lease);require(run!=null&&Objects.equals(run.getTaskId(),task.getId())&&Objects.equals(run.getFenceToken(),lease.fence()),"SELFOP_RUN_LEASE_MISMATCH");
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/sync/SelfopValidationRunner.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/sync/SelfopValidationRunner.java
new file mode 100644
index 000000000..1981528d2
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/sync/SelfopValidationRunner.java
@@ -0,0 +1,226 @@
+package com.baiyue.lastleg.selfoperated.analytics.sync;
+
+import com.baomidou.mybatisplus.core.conditions.query.QueryWrapper;
+import com.baomidou.mybatisplus.core.conditions.update.UpdateWrapper;
+import com.baomidou.mybatisplus.core.toolkit.IdWorker;
+import com.baiyue.lastleg.selfoperated.analytics.client.*;
+import com.baiyue.lastleg.selfoperated.analytics.mapper.*;
+import com.baiyue.lastleg.selfoperated.analytics.model.*;
+import com.baiyue.lastleg.selfoperated.analytics.request.*;
+import lombok.Data;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.support.TransactionTemplate;
+import java.time.LocalDateTime;
+import java.time.Duration;
+import java.util.*;
+import java.util.function.Supplier;
+import static com.baiyue.lastleg.selfoperated.analytics.model.SelfopSupport.*;
+
+/** Bounded sample workflow. Deliberately has no facts, scope, SKU, candidate or publisher dependencies. */
+@Service
+public class SelfopValidationRunner {
+    private final LingxingAnalyticsClient client;
+    private final SelfopSyncStageMapper stages;
+    private final SelfopSyncTaskMapper tasks;
+    private final SelfopSyncRunMapper runs;
+    private final SelfopCoordinationMapper locks;
+    private final SelfopLeaseService leases;
+    private final SelfopEgressService egress;
+    private final SelfopAnalyticsProperties config;
+    private final TransactionTemplate tx;
+    public SelfopValidationRunner(LingxingAnalyticsClient client,SelfopSyncStageMapper stages,
+        SelfopSyncTaskMapper tasks,SelfopSyncRunMapper runs,SelfopCoordinationMapper locks,
+        SelfopLeaseService leases,SelfopEgressService egress,SelfopAnalyticsProperties config,TransactionTemplate tx) {
+        this.client=client;this.stages=stages;this.tasks=tasks;this.runs=runs;this.locks=locks;
+        this.leases=leases;this.egress=egress;this.config=config;this.tx=tx;
+    }
+
+    public void run(SelfopSyncTask task,SelfopSyncRun run,SelfopLeaseService.Lease lease) {
+        require("VALIDATION".equals(config.getCollectionMode())&&"VALIDATION".equals(task.getExecutionPurpose())
+            &&"VALIDATION".equals(run.getExecutionPurpose()),"SELFOP_VALIDATION_PURPOSE_REQUIRED");
+        require(task.getValidationRootTaskId()!=null,"SELFOP_VALIDATION_ROOT_REQUIRED");
+        require(lease.account(),"SELFOP_ACCOUNT_LEASE_REQUIRED");
+        var context=SelfopRequestContext.forTask(task,run,config);
+        try {
+            var state=task.getRoutingManifestJson()==null?new Sample():read(task.getRoutingManifestJson(),Sample.class);
+            Map<?,?> query=read(task.getQueryScopeJson(),Map.class);
+            boolean directoryOnly=SelfopCollectionPolicy.warehouseDiscovery(task);
+            String selectedWarehouse=directoryOnly?null:SelfopCollectionPolicy.validationWarehouse(task);
+            if(!directoryOnly)require(config.getWarehouses().containsKey(selectedWarehouse),"SELFOP_WAREHOUSE_UNCONFIGURED");
+            var from=directoryOnly?null:LocalDateTime.parse(Objects.toString(query.get("startTime"),""));
+            var until=directoryOnly?null:LocalDateTime.parse(Objects.toString(query.get("endTime"),""));
+            if(!directoryOnly)require(until.isAfter(from)&&Duration.between(from,until).compareTo(Duration.ofDays(1))<=0,"SELFOP_VALIDATION_WINDOW_INVALID");
+            if(!state.warehousesRead) {
+                leases.renew(lease); var page=request(task,run,lease,()->client.warehouses(context,1,10)); validatePage(page,1);
+                tx.executeWithoutResult(s->{check(task,run,lease);
+                    Set<String> warehouseCodes=new HashSet<>();
+                    for(var warehouse:page.records()) {
+                        identity(warehouse.warehouseCode(),64);
+                        require(warehouseCodes.add(warehouse.warehouseCode()),"SELFOP_SAMPLE_WAREHOUSE_DUPLICATE");
+                    }
+                    run.setObservedDimensionsJson(json(Map.of("validationWarehouseSamples",page.records(),"truncated",page.pages()>1)));
+                    state.warehousesRead=true;state.pages++;save(task,run,state,"DIRECTORY","PAGE",state.pages,null);
+                });
+            }
+            if(directoryOnly){
+                require(run.getObservedDimensionsJson()!=null,"SELFOP_WAREHOUSE_DIRECTORY_EVIDENCE_MISSING");
+                Map<?,?> dimensions=read(run.getObservedDimensionsJson(),Map.class);
+                finish(task,run,lease,Boolean.TRUE.equals(dimensions.get("truncated"))
+                    ?"VALIDATION_WAREHOUSE_DIRECTORY_TRUNCATED":"VALIDATION_WAREHOUSE_DIRECTORY_COMPLETE",false);return;
+            }
+            while(!state.directoryRead&&state.outboundPage<=2) {
+                int current=state.outboundPage;leases.renew(lease);
+                var page=request(task,run,lease,()->client.discover(context,from,until,current,10));validatePage(page,current);
+                tx.executeWithoutResult(s->{check(task,run,lease);
+                    for(var summary:page.records()) {
+                        require(Objects.equals(task.getSourceAccount(),summary.sourceAccount()),"SELFOP_SAMPLE_ACCOUNT_MISMATCH");
+                        identity(summary.customerCode(),64);identity(summary.warehouseCode(),64);identity(summary.deliveryNo(),128);
+                        if(!selectedWarehouse.equals(summary.warehouseCode()))continue;
+                        String key=hash(List.of(summary.customerCode(),summary.deliveryNo()));
+                        require(state.orders.stream().noneMatch(o->key.equals(hash(List.of(o.customerCode(),o.deliveryNo())))),"SELFOP_SAMPLE_DIRECTORY_DUPLICATE");
+                        state.orders.add(summary);
+                        stage(task,run,"OUTBOUND_ORDER","directory:"+key,summary.warehouseCode(),current,summary,"PENDING",null);
+                    }
+                    state.outboundPage++;state.pages++;state.directoryRead=page.pages()==0||current>=page.pages()||state.outboundPage>2;
+                    save(task,run,state,"DIRECTORY","PAGE",state.pages,null);
+                });
+            }
+            while(state.detailIndex<state.orders.size()) {
+                var summary=state.orders.get(state.detailIndex);leases.renew(lease);
+                require(selectedWarehouse.equals(summary.warehouseCode()),"SELFOP_SAMPLE_WAREHOUSE_MISMATCH");
+                SelfopPayloads.Order selected=summary.order();
+                if(LingxingAnalyticsClient.needsDetail(selected)) {
+                    selected=request(task,run,lease,()->client.detail(context,summary.warehouseCode(),summary.customerCode(),summary.deliveryNo()));
+                }
+                var detail=selected;
+                validateOrder(task,summary,detail);
+                tx.executeWithoutResult(s->{check(task,run,lease);
+                    boolean unknown=detail.items().stream().anyMatch(i->i.actualQuantity()==null);
+                    boolean invalid=detail.items().stream().anyMatch(i->i.actualQuantity()!=null&&i.actualQuantity().signum()<0);
+                    stage(task,run,"OUTBOUND_ORDER",hash(List.of(detail.customerCode(),detail.deliveryNo())),detail.warehouseCode(),1,detail,
+                        invalid?"INVALID":unknown?"PENDING":"VALID",invalid?"NEGATIVE_QUANTITY":unknown?"QUANTITY_UNKNOWN":null);
+                    state.detailIndex++;save(task,run,state,"DETAIL","ORDER",state.detailIndex,(long)state.orders.size());
+                });
+            }
+            // Only the command's frozen warehouse is sampled; other configured warehouses are independent roots.
+            for(String warehouse:List.of(selectedWarehouse)) {
+                int current=state.inventoryNextPage.getOrDefault(warehouse,1);
+                while(current<=2&&!state.inventoryFinished.contains(warehouse)) {
+                    leases.renew(lease);int pageNo=current;
+                    var page=request(task,run,lease,()->client.inventory(context,warehouse,pageNo,10));validatePage(page,current);
+                    tx.executeWithoutResult(s->{check(task,run,lease);
+                        for(var stock:page.records()) {
+                            require(Objects.equals(stock.sourceAccount(),task.getSourceAccount())&&warehouse.equals(stock.warehouseCode()),"SELFOP_SAMPLE_INVENTORY_IDENTITY");
+                            identity(stock.customerCode(),64);identity(stock.skuCode(),128);require(stock.productQuality()!=null,"SELFOP_SAMPLE_INVENTORY_STRUCTURE");
+                            String key=hash(List.of(stock.customerCode(),stock.warehouseCode(),stock.skuCode(),stock.productQuality()));
+                            require(state.inventoryKeys.add(key),"SELFOP_SAMPLE_INVENTORY_DUPLICATE");
+                            boolean unknown=stock.physicalQuantity()==null||stock.availableQuantity()==null||stock.frozenQuantity()==null||stock.transitQuantity()==null;
+                            boolean invalid=Arrays.asList(stock.physicalQuantity(),stock.availableQuantity(),stock.frozenQuantity(),stock.transitQuantity()).stream().filter(Objects::nonNull).anyMatch(q->q.signum()<0);
+                            stage(task,run,"PRODUCT_STOCK",key,warehouse,pageNo,stock,invalid?"INVALID":unknown?"PENDING":"VALID",invalid?"NEGATIVE_QUANTITY":unknown?"QUANTITY_UNKNOWN":null);
+                        }
+                        state.inventoryNextPage.put(warehouse,pageNo+1);state.pages++;state.inventoryRows+=page.records().size();
+                        if(page.pages()==0||pageNo>=page.pages()||pageNo==2)state.inventoryFinished.add(warehouse);
+                        save(task,run,state,"INVENTORY","INVENTORY_ROW",state.inventoryRows,null);
+                    });current++;
+                }
+            }
+            finish(task,run,lease,"VALIDATION_SAMPLE_SUFFICIENT",false);
+        } catch(EgressRejectedException stop) {
+            // No YIELDED or retry scheduling: every validation root is a single finite session.
+            finish(task,run,lease,stop.sampleDone()?stop.code():"VALIDATION_REQUEST_REJECTED",!stop.sampleDone());
+        } catch(AnalyticsClientException failure) {
+            finish(task,run,lease,failure.code(),true);
+        } catch(RuntimeException invalid) {
+            if("SELFOP_FENCE_REJECTED".equals(invalid.getMessage())||"SELFOP_LEASE_BUSY".equals(invalid.getMessage()))throw invalid;
+            finish(task,run,lease,"VALIDATION_STRUCTURE_REJECTED",true);
+        }
+    }
+
+    /** Execution-level failures still terminate the original bounded validation session. */
+    public void fail(SelfopSyncTask task,SelfopSyncRun run,SelfopLeaseService.Lease lease,String code) {
+        finish(task,run,lease,code,true);
+    }
+
+    private void check(SelfopSyncTask task,SelfopSyncRun run,SelfopLeaseService.Lease lease) {
+        leases.verify(lease);var stored=locks.lockTask(task.getId());var active=locks.lockRun(run.getId());
+        require(stored!=null&&active!=null&&Objects.equals(stored.getDiscoveryScopeId(),lease.scopeId())
+            &&Objects.equals(active.getTaskId(),stored.getId())&&Objects.equals(active.getFenceToken(),lease.fence())
+            &&Objects.equals(stored.getAttemptCount(),active.getAttemptNo())&&"VALIDATION".equals(stored.getExecutionPurpose())
+            &&"VALIDATION".equals(active.getExecutionPurpose())&&Objects.equals(stored.getSourceAccount(),task.getSourceAccount())
+            &&Objects.equals(active.getSourceAccount(),stored.getSourceAccount())
+            &&Objects.equals(stored.getValidationRootTaskId(),task.getValidationRootTaskId()),"SELFOP_FENCE_REJECTED");
+    }
+    private void stage(SelfopSyncTask task,SelfopSyncRun run,String type,String key,String warehouse,int page,Object payload,String status,String code) {
+        // VALID outbound stages require an observation sequence in the schema. Samples never
+        // acquire a formal sequence: structure success remains explicit pending sample evidence.
+        if("VALID".equals(status)){status="PENDING";code="SAMPLE_VALIDATED";}
+        String keyHash=hash(key);
+        String contentHash=payload instanceof SelfopPayloads.Stock stock ? SelfopStockFingerprint.of(stock) : hash(payload);
+        var prior=stages.selectOne(new QueryWrapper<SelfopSyncStage>().eq("stage_batch_id",task.getId()).eq("object_type",type).eq("object_key_hash",keyHash));
+        if(prior!=null){require(prior.getContentHash().equals(contentHash),"SELFOP_SAMPLE_STAGE_CHANGED");return;}
+        var row=new SelfopSyncStage();row.setId(IdWorker.getId());row.setStageBatchId(task.getId());row.setRunId(run.getId());row.setLastFetchRunId(run.getId());
+        row.setObjectType(type);row.setObjectKeyHash(keyHash);row.setWarehouseCode(warehouse);row.setFirstPageNo(page);row.setObservedAtUtc(utcNow());
+        row.setContentHash(contentHash);row.setPayloadJson(json(payload));row.setValidationStatus(status);row.setValidationCode(code);
+        row.setCreatedAt(utcNow());row.setUpdatedAt(utcNow());stages.insert(row);
+    }
+    private void save(SelfopSyncTask task,SelfopSyncRun run,Sample state,String phase,String unit,long completed,Long total) {
+        task.setRoutingManifestJson(json(state));SelfopProgressProjection.applyCheckpoint(task,run,phase,unit,completed,total,1);
+        tasks.update(null,new UpdateWrapper<SelfopSyncTask>().eq("id",task.getId()).set("routing_manifest_json",task.getRoutingManifestJson())
+            .set("progress_json",task.getProgressJson()).set("progress_updated_at_utc",task.getProgressUpdatedAtUtc()).set("updated_at",utcNow()));
+        runs.updateById(run);
+    }
+    private void finish(SelfopSyncTask task,SelfopSyncRun run,SelfopLeaseService.Lease lease,String code,boolean failed) {
+        // Quota owns root stop reason and consumed allowance. Never overwrite it from a stale task object.
+        tx.executeWithoutResult(s->{check(task,run,lease);
+            if(failed)egress.failValidation(task.getValidationRootTaskId(),code);else egress.finishSample(task.getValidationRootTaskId(),code);
+            var saved=locks.lockTask(task.getId());var attempt=locks.lockRun(run.getId());
+            boolean dead=failed||"DEAD".equals(saved.getStatus())||"FAILED".equals(attempt.getStatus());
+            SelfopProgressProjection.applyCheckpoint(saved,attempt,dead?"FAILED":"SAMPLE_DONE","NONE",0,null,1);
+            SelfopProgressProjection.freezeRun(saved,attempt);attempt.setStatus(dead?"FAILED":"SAMPLE_DONE");
+            if(attempt.getErrorCode()==null)attempt.setErrorCode(code);
+            attempt.setCoverageStatus("UNKNOWN");attempt.setFetchFinishedAtUtc(utcNow());attempt.setFinishedAtUtc(utcNow());attempt.setUpdatedAt(utcNow());runs.updateById(attempt);
+            tasks.update(null,new UpdateWrapper<SelfopSyncTask>().eq("id",task.getId()).set("status",dead?"DEAD":"SAMPLE_DONE")
+                .set("next_retry_at_utc",null).set("progress_json",saved.getProgressJson()).set("progress_updated_at_utc",saved.getProgressUpdatedAtUtc()).set("updated_at",utcNow()));
+        });
+    }
+    private <T> T request(SelfopSyncTask task,SelfopSyncRun run,SelfopLeaseService.Lease lease,Supplier<T> request) {
+        while(true) {
+            try{return request.get();}
+            catch(EgressRejectedException wait) {
+                if(!Set.of("ACCOUNT_INTERVAL_WAIT","ACCOUNT_REQUEST_INFLIGHT").contains(wait.code())||wait.waitUntilUtc()==null)throw wait;
+                var root=tasks.selectById(task.getValidationRootTaskId());
+                require(root!=null&&root.getValidationBudgetJson()!=null,"SELFOP_VALIDATION_ROOT_REQUIRED");
+                var budget=read(root.getValidationBudgetJson(),SelfopValidationBudget.class);
+                if(!wait.waitUntilUtc().isBefore(budget.deadlineAtUtc))throw new EgressRejectedException("VALIDATION_DEADLINE",true,null);
+                while(utcNow().isBefore(wait.waitUntilUtc())) {
+                    leases.renew(lease);
+                    try{Thread.sleep(Math.min(1000,Math.max(1,Duration.between(utcNow(),wait.waitUntilUtc()).toMillis())));}
+                    catch(InterruptedException interrupted){Thread.currentThread().interrupt();throw new EgressRejectedException("VALIDATION_INTERRUPTED",false,null);}
+                }
+            }
+        }
+    }
+    private static void validatePage(LingxingAnalyticsClient.Page<?> page,int current) {
+        require(page.current()!=null&&page.current()==current&&page.size()!=null&&page.size()==10&&page.total()!=null&&page.total()>=0
+            &&page.pages()!=null&&page.pages()>=0&&page.records().size()<=10,"SELFOP_SAMPLE_PAGE_INVALID");
+    }
+    private static void validateOrder(SelfopSyncTask task,LingxingAnalyticsClient.Summary summary,SelfopPayloads.Order order) {
+        require(Objects.equals(task.getSourceAccount(),order.sourceAccount())&&Objects.equals(summary.warehouseCode(),order.warehouseCode())
+            &&Objects.equals(summary.customerCode(),order.customerCode())&&Objects.equals(summary.deliveryNo(),order.deliveryNo()),"SELFOP_SAMPLE_DETAIL_IDENTITY");
+        require(order.sourceStatus()!=null&&order.items()!=null,"SELFOP_SAMPLE_DETAIL_STRUCTURE");
+        for(var item:order.items())identity(item.skuCode(),128);
+    }
+    @Data
+    public static class Sample {
+        private boolean warehousesRead;
+        private int pages;
+        private int outboundPage=1;
+        private boolean directoryRead;
+        private List<LingxingAnalyticsClient.Summary> orders=new ArrayList<>();
+        private int detailIndex;
+        private Map<String,Integer> inventoryNextPage=new LinkedHashMap<>();
+        private Set<String> inventoryFinished=new LinkedHashSet<>();
+        private Set<String> inventoryKeys=new LinkedHashSet<>();
+        private long inventoryRows;
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/sync/SyncController.java b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/sync/SyncController.java
new file mode 100644
index 000000000..88e784a59
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/sync/SyncController.java
@@ -0,0 +1,25 @@
+package com.baiyue.lastleg.selfoperated.analytics.sync;
+
+import com.baiyue.common.core.api.ApiResponse;
+import com.baiyue.common.security.AuthenticatedUser;
+import io.swagger.v3.oas.annotations.Operation;
+import org.springframework.security.access.prepost.PreAuthorize;
+import org.springframework.security.core.annotation.AuthenticationPrincipal;
+import org.springframework.web.bind.annotation.*;
+import org.springframework.http.HttpStatus;
+import org.springframework.web.server.ResponseStatusException;
+
+@RestController
+public class SyncController {
+    private final SelfopCommandService commands;
+    public SyncController(SelfopCommandService commands){this.commands=commands;}
+    public record Accepted(String taskNo,String warehouseCode,String status) { }
+    @PostMapping("/api/platform/v1/last-leg/self-operated-analytics/sync-tasks")
+    @PreAuthorize("hasAuthority('platform:self-operated-analytics:sync')")
+    @Operation(summary="创建自营分析人工采集或恢复任务",description="平台独立写权限 platform:self-operated-analytics:sync；持久化后异步执行，执行开关默认关闭。BACKFILL使用不超过一天的来源时间切片；未知源时区仅允许暂存。")
+    public ApiResponse<Accepted> request(@AuthenticationPrincipal AuthenticatedUser user,@RequestBody SelfopCommandService.Command command){
+        if(user==null||user.userId()==null||user.tenantId()==null||user.tenantId()!=0||!"PLATFORM".equals(user.appCode())||user.impersonated()||!user.permissions().contains("platform:self-operated-analytics:sync"))
+            throw new ResponseStatusException(HttpStatus.FORBIDDEN,"仅限已授权平台人员");
+        var task=commands.request(command,String.valueOf(user.userId()));return ApiResponse.success(new Accepted(task.getTaskNo(),command.warehouseCode(),"ACCEPTED"));
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/service/CompactBusinessNumberService.java b/lastleg-service/src/main/java/com/baiyue/lastleg/service/CompactBusinessNumberService.java
new file mode 100644
index 000000000..ed45087b1
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/service/CompactBusinessNumberService.java
@@ -0,0 +1,59 @@
+package com.baiyue.lastleg.service;
+
+import net.sourceforge.pinyin4j.PinyinHelper;
+import org.springframework.jdbc.core.JdbcTemplate;
+import org.springframework.stereotype.Component;
+import org.springframework.transaction.annotation.Transactional;
+
+import java.time.Instant;
+import java.time.ZoneId;
+import java.time.format.DateTimeFormatter;
+import java.util.Locale;
+
+/** Allocates suffix-free document numbers across all service instances. */
+@Component
+public class CompactBusinessNumberService {
+    private static final ZoneId ZONE = ZoneId.of("Asia/Shanghai");
+    private static final DateTimeFormatter FORMAT = DateTimeFormatter.ofPattern("yyMMddHHmmss", Locale.ROOT).withZone(ZONE);
+    private final JdbcTemplate jdbc;
+    private final ReturnOrderReferenceResolver customers;
+
+    public CompactBusinessNumberService(JdbcTemplate jdbc, ReturnOrderReferenceResolver customers) {
+        this.jdbc = jdbc;
+        this.customers = customers;
+    }
+
+    @Transactional
+    public String next(String prefix, String customerId) {
+        return allocate(prefix, initials(customers.customerName(customerId)), Instant.now());
+    }
+
+    String allocate(String prefix, String initials, Instant now) {
+        String key = prefix + "-" + initials;
+        long seconds = now.getEpochSecond();
+        // The row lock serializes identical prefixes/initials even across customers and JVMs.
+        jdbc.update("INSERT INTO ll_compact_number_clock(number_key,last_second) VALUES(?,LAST_INSERT_ID(?)) "
+            + "ON DUPLICATE KEY UPDATE last_second=LAST_INSERT_ID(GREATEST(last_second+1,?))", key, seconds, seconds);
+        Long allocated = jdbc.queryForObject("SELECT LAST_INSERT_ID()", Long.class);
+        if (allocated == null || allocated < seconds) throw new IllegalStateException("业务编号生成失败");
+        return key + "-" + FORMAT.format(Instant.ofEpochSecond(allocated));
+    }
+
+    static String initials(String name) {
+        if (name == null || name.isBlank()) return "KH";
+        StringBuilder result = new StringBuilder();
+        boolean latinWord = false;
+        for (char c : name.trim().toCharArray()) {
+            if (result.length() >= 4) break;
+            if (Character.UnicodeScript.of(c) == Character.UnicodeScript.HAN) {
+                String[] pinyin = PinyinHelper.toHanyuPinyinStringArray(c);
+                if (pinyin != null && pinyin.length > 0) result.append(Character.toUpperCase(pinyin[0].charAt(0)));
+                latinWord = false;
+            } else if (c < 128 && Character.isLetterOrDigit(c)) {
+                if (!latinWord) result.append(Character.toUpperCase(c));
+                latinWord = true;
+            } else latinWord = false;
+        }
+        return result.isEmpty() ? "KH" : result.toString();
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/service/CustomerOrderProgressService.java b/lastleg-service/src/main/java/com/baiyue/lastleg/service/CustomerOrderProgressService.java
index 665a10d4d..da82987e1 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/service/CustomerOrderProgressService.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/service/CustomerOrderProgressService.java
@@ -12,8 +12,8 @@ public class CustomerOrderProgressService {
     private final CustomerOrderProgressMapper mapper;
     public CustomerOrderProgressService(CustomerOrderProgressMapper mapper) { this.mapper = mapper; }
     @Transactional(readOnly=true)
-    public CustomerOrderProgress.Response read(long customerId) {
-        return new CustomerOrderProgress.Response(project(mapper.sources(Long.toString(customerId))));
+    public CustomerOrderProgress.Response read(long customerId, List<Long> orderIds) {
+        return new CustomerOrderProgress.Response(project(mapper.sources(Long.toString(customerId), orderIds == null ? null : orderIds.stream().map(String::valueOf).toList())));
     }
     static List<CustomerOrderProgress.Progress> project(List<CustomerOrderProgress.Source> sources) {
         return sources.stream().collect(Collectors.groupingBy(CustomerOrderProgress.Source::orderId))
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/service/LastlegOrderNoGenerator.java b/lastleg-service/src/main/java/com/baiyue/lastleg/service/LastlegOrderNoGenerator.java
index 9c6f8cb0f..f8ebba53f 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/service/LastlegOrderNoGenerator.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/service/LastlegOrderNoGenerator.java
@@ -36,6 +36,7 @@ public class LastlegOrderNoGenerator {
 
     public String next(String businessType, String warehouse, long uniqueId) {
         String code = businessType == null ? "" : businessType.trim().toUpperCase(Locale.ROOT);
+        if ("RETURN_CARTON".equals(code)) return compactCartonMark(uniqueId);
         String returnPrefix = switch (code) {
             case "RETURN" -> "RT";
             case "RETURN_RECEIPT" -> "RR";
@@ -65,6 +66,12 @@ public class LastlegOrderNoGenerator {
         return "0".repeat(25 - encoded.length()) + encoded;
     }
 
+    /** Preserve every snowflake ID bit; do not truncate or hash physical label identifiers. */
+    public static String compactCartonMark(long id) {
+        if (id <= 0) throw new IllegalArgumentException("Carton id must be positive");
+        return "BX-" + Long.toString(id, 36).toUpperCase(Locale.ROOT);
+    }
+
     private String normalizeType(String value) {
         String code = value == null ? "LMO" : value.trim().toUpperCase(Locale.ROOT);
         return switch (code) {
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/service/ReturnOrderReferenceResolver.java b/lastleg-service/src/main/java/com/baiyue/lastleg/service/ReturnOrderReferenceResolver.java
index 1152f9cd4..5f049ce83 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/service/ReturnOrderReferenceResolver.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/service/ReturnOrderReferenceResolver.java
@@ -1,8 +1,10 @@
 package com.baiyue.lastleg.service;
 
 import com.baiyue.lastleg.entity.LastlegOrder;
-import com.baiyue.lastleg.fleet.customer.FleetCustomerDirectory;
+import com.baiyue.lastleg.service.reference.ReturnCustomerReferenceClient;
 import com.baiyue.lastleg.inboundplan.pda.gateway.WarehouseResourceGateway;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.http.HttpStatus;
 import org.springframework.stereotype.Service;
 import org.springframework.util.StringUtils;
 import org.springframework.web.server.ResponseStatusException;
@@ -16,12 +18,15 @@ import java.util.Map;
 @Service
 public class ReturnOrderReferenceResolver {
     private static final Logger log = LoggerFactory.getLogger(ReturnOrderReferenceResolver.class);
-    private final FleetCustomerDirectory customers;
+    private final ReturnCustomerReferenceClient customers;
     private final WarehouseResourceGateway warehouses;
+    private final String internalToken;
 
-    public ReturnOrderReferenceResolver(FleetCustomerDirectory customers, WarehouseResourceGateway warehouses) {
+    public ReturnOrderReferenceResolver(ReturnCustomerReferenceClient customers, WarehouseResourceGateway warehouses,
+        @Value("${baiyue.security.internal-service-token}") String internalToken) {
         this.customers = customers;
         this.warehouses = warehouses;
+        this.internalToken = internalToken;
     }
 
     public void populate(List<LastlegOrder> orders) {
@@ -33,14 +38,14 @@ public class ReturnOrderReferenceResolver {
     }
 
     private void populate(List<LastlegOrder> orders, boolean required) {
-        Map<String, FleetCustomerDirectory.Customer> customerReferences = new HashMap<>();
+        Map<String, ReturnCustomerReferenceClient.Customer> customerReferences = new HashMap<>();
         Map<String, WarehouseResourceGateway.WarehouseReference> warehouseReferences = new HashMap<>();
         for (LastlegOrder order : orders) {
             if (!"RETURN_RELABEL".equals(order.getOrderType())) continue;
             if (!StringUtils.hasText(order.getCustomerName())) {
                 try {
-                    var customer = customerReferences.computeIfAbsent(order.getCustomerId(), customers::find);
-                    order.setCustomerName(customer.name());
+                    var customer = customerReferences.computeIfAbsent(order.getCustomerId(), this::customerReference);
+                    order.setCustomerName(customer.tenantName());
                 } catch (ResponseStatusException error) {
                     if (required) throw error;
                     log.warn("Return customer reference unavailable for order {}, status {}", order.getId(), error.getStatusCode().value());
@@ -59,4 +64,22 @@ public class ReturnOrderReferenceResolver {
             }
         }
     }
+
+    public String customerName(String id) {
+        return customerReference(id).tenantName();
+    }
+
+    private ReturnCustomerReferenceClient.Customer customerReference(String id) {
+        try {
+            var result = customers.customers(internalToken, 1, 30, null, "ACTIVE", Long.parseLong(id));
+            if (result == null || !result.successful() || result.data() == null)
+                throw new ResponseStatusException(HttpStatus.SERVICE_UNAVAILABLE, "客户目录暂不可用，请稍后重试");
+            return result.data().records().stream()
+                .filter(row -> row.id() != null && row.id() > 0 && row.id().toString().equals(id) && "ACTIVE".equals(row.status()))
+                .findFirst().orElseThrow(() -> new ResponseStatusException(HttpStatus.BAD_REQUEST, "请选择有效客户"));
+        } catch (ResponseStatusException error) { throw error; }
+        catch (RuntimeException error) {
+            throw new ResponseStatusException(HttpStatus.SERVICE_UNAVAILABLE, "客户目录暂不可用，请稍后重试");
+        }
+    }
 }
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/service/reference/ReturnCustomerReferenceClient.java b/lastleg-service/src/main/java/com/baiyue/lastleg/service/reference/ReturnCustomerReferenceClient.java
new file mode 100644
index 000000000..691919b9d
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/service/reference/ReturnCustomerReferenceClient.java
@@ -0,0 +1,19 @@
+package com.baiyue.lastleg.service.reference;
+
+import com.baiyue.common.core.api.ApiResponse;
+import com.baiyue.common.core.api.PageResult;
+import org.springframework.cloud.openfeign.FeignClient;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.RequestHeader;
+import org.springframework.web.bind.annotation.RequestParam;
+
+/** IAM owns customer references used to fill return-order snapshots. */
+@FeignClient(name = "iam-service", contextId = "returnCustomerReferenceClient", url = "${baiyue.clients.iam.url:}")
+public interface ReturnCustomerReferenceClient {
+    @GetMapping("/internal/iam/finance-customers")
+    ApiResponse<PageResult<Customer>> customers(@RequestHeader("X-Internal-Service-Token") String token,
+        @RequestParam("page") long page, @RequestParam("size") long size, @RequestParam("keyword") String keyword,
+        @RequestParam("status") String status, @RequestParam("customerId") Long customerId);
+
+    record Customer(Long id, String tenantCode, String tenantName, String status, String contactName, String contactPhone) { }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/transfer/controller/MerchantWarehouseTransferController.java b/lastleg-service/src/main/java/com/baiyue/lastleg/transfer/controller/MerchantWarehouseTransferController.java
index 56c1bb480..35ba560dd 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/transfer/controller/MerchantWarehouseTransferController.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/transfer/controller/MerchantWarehouseTransferController.java
@@ -27,6 +27,24 @@ import java.util.List;
 @RequestMapping("/api/merchant/v1/last-leg/warehouse-transfers")
 public class MerchantWarehouseTransferController {
     @Resource private WarehouseTransferService service;
+    @Resource private com.baiyue.lastleg.transfer.service.WarehouseTransferForecastService forecastService;
+
+    /** 测量完成前追加预报箱唛，保留原编号和已测量内容。 */
+    @PostMapping("/{transferNo}/increase-forecast-cartons")
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_TRANSFER_CREATE + "')")
+    public ApiResponse<WarehouseTransferResponses.Detail> increaseForecastCartons(
+        @AuthenticationPrincipal AuthenticatedUser user, @PathVariable String transferNo,
+        @Valid @RequestBody WarehouseTransferRequests.IncreaseForecastCartons request) {
+        return ApiResponse.success(forecastService.increase(customer(user), transferNo, operator(user), request));
+    }
+
+    @GetMapping("/inventory-source-cartons")
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_TRANSFER_CREATE + "')")
+    public ApiResponse<List<WarehouseTransferResponses.SourceCarton>> sourceCartons(
+        @AuthenticationPrincipal AuthenticatedUser user, @RequestParam String operatingWarehouseId,
+        @RequestParam String inboundCode) {
+        return ApiResponse.success(service.sourceCartons(customer(user), operatingWarehouseId, inboundCode));
+    }
 
     @PostMapping
     @PreAuthorize("hasAuthority('" + OverseasPermissions.MERCHANT_TRANSFER_CREATE + "')")
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/transfer/controller/PdaWarehouseTransferController.java b/lastleg-service/src/main/java/com/baiyue/lastleg/transfer/controller/PdaWarehouseTransferController.java
index 6bd39c1ce..baa2a1707 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/transfer/controller/PdaWarehouseTransferController.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/transfer/controller/PdaWarehouseTransferController.java
@@ -77,6 +77,28 @@ public class PdaWarehouseTransferController {
             .contentType(MediaType.parseMediaType(file.contentType())).body(file.content());
     }
 
+    @GetMapping("/{transferNo}/carton-label")
+    public ApiResponse<WarehouseTransferResponses.Label> cartonLabel(
+        @AuthenticationPrincipal AuthenticatedUser user, @PathVariable String transferNo) {
+        PdaWarehouseIdentity identity = PdaWarehouseIdentity.require(user);
+        return ApiResponse.success(service.pdaCartonLabel(identity.overseasWarehouseId(), transferNo));
+    }
+
+    @PostMapping("/{transferNo}/cartons/reopen")
+    public ApiResponse<WarehouseTransferResponses.Detail> reopenMeasurement(
+        @AuthenticationPrincipal AuthenticatedUser user, @PathVariable String transferNo) {
+        PdaWarehouseIdentity identity = PdaWarehouseIdentity.require(user);
+        return ApiResponse.success(service.reopenMeasurement(identity.overseasWarehouseId(), transferNo));
+    }
+
+    @PostMapping("/{transferNo}/cartons/count")
+    public ApiResponse<WarehouseTransferResponses.Detail> countCartons(
+        @AuthenticationPrincipal AuthenticatedUser user, @PathVariable String transferNo,
+        @Valid @RequestBody WarehouseTransferRequests.CountCartons request) {
+        PdaWarehouseIdentity identity = PdaWarehouseIdentity.require(user);
+        return ApiResponse.success(service.countCartons(identity.operatorKey(), identity.overseasWarehouseId(), transferNo, request));
+    }
+
     @PostMapping("/{transferNo}/palletize")
     public ApiResponse<WarehouseTransferResponses.Detail> palletize(
         @AuthenticationPrincipal AuthenticatedUser user, @PathVariable String transferNo,
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/transfer/controller/WarehouseTransferController.java b/lastleg-service/src/main/java/com/baiyue/lastleg/transfer/controller/WarehouseTransferController.java
index 8d3c9f135..879e5e7d9 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/transfer/controller/WarehouseTransferController.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/transfer/controller/WarehouseTransferController.java
@@ -20,6 +20,7 @@ import org.springframework.web.server.ResponseStatusException;
 public class WarehouseTransferController {
     public static final String MANAGE_PERMISSION = "lastleg:warehouse-transfer:manage";
     @Resource private WarehouseTransferService service;
+    @Resource private com.baiyue.lastleg.transfer.service.WarehouseTransferForecastService forecasts;
 
     @PostMapping
     public ApiResponse<WarehouseTransferResponses.Detail> create(@AuthenticationPrincipal AuthenticatedUser user,
@@ -41,6 +42,17 @@ public class WarehouseTransferController {
         return ApiResponse.success(service.detail(scope(user, customerId), transferNo));
     }
 
+    /** 平台人员在测量完成前追加整单预报箱，沿用统一锁单及箱唛生成规则。 */
+    @PostMapping("/{transferNo}/increase-forecast-cartons")
+    @PreAuthorize("hasAuthority('" + OverseasPermissions.WAREHOUSE_TRANSFER_APPROVE + "')")
+    public ApiResponse<WarehouseTransferResponses.Detail> increaseForecastCartons(@AuthenticationPrincipal AuthenticatedUser user,
+        @RequestParam String customerId, @PathVariable String transferNo,
+        @Valid @RequestBody WarehouseTransferRequests.IncreaseForecastCartons request) {
+        if (user == null || !"PLATFORM".equals(user.appCode()) || user.tenantId() == null || user.tenantId() != 0L)
+            throw new ResponseStatusException(HttpStatus.FORBIDDEN, "Platform identity is required");
+        return ApiResponse.success(forecasts.increase(scope(user, customerId), transferNo, operator(user), request));
+    }
+
     @GetMapping("/{transferNo}/carton-label")
     @PreAuthorize("hasAuthority('" + OverseasPermissions.LAST_MILE_ORDER_LIST + "')")
     public ApiResponse<WarehouseTransferResponses.Label> cartonLabel(@AuthenticationPrincipal AuthenticatedUser user,
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/transfer/dto/WarehouseTransferRequests.java b/lastleg-service/src/main/java/com/baiyue/lastleg/transfer/dto/WarehouseTransferRequests.java
index 42804efba..21f4fc5b5 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/transfer/dto/WarehouseTransferRequests.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/transfer/dto/WarehouseTransferRequests.java
@@ -29,13 +29,13 @@ public final class WarehouseTransferRequests {
         @Size(max = 32) String privateDestinationPostalCode,
         @Size(max = 128) String privateDestinationContactName,
         @Size(max = 64) String privateDestinationContactPhone,
-        @NotBlank @Size(max = 1000) String deliveryAddress,
+        @Size(max = 1000) String deliveryAddress,
         @Size(max = 128) String pickupContactName,
         @Size(max = 64) String pickupContactPhone,
         @Positive int packageCount,
         @NotNull @DecimalMin(value = "0.0") BigDecimal volumeCbm,
-        @NotBlank @Size(max = 64) String deliveryMethod,
-        @NotNull LocalDateTime estimatedArrivalAt,
+        @Size(max = 64) String deliveryMethod,
+        LocalDateTime estimatedArrivalAt,
         LocalDateTime estimatedShipAt,
         @Size(max = 128) String fbaShipmentNo,
         @Size(max = 255) String trackingNo,
@@ -51,6 +51,14 @@ public final class WarehouseTransferRequests {
         @NotEmpty @Size(max = 500) List<@Valid Item> items,
         @Size(max = 1000) List<@Valid RelabelItem> relabelItems
     ) {
+        @jakarta.validation.constraints.AssertTrue(message="外来货物须填写入仓方式、地址和预计入仓时间；库存转运须选择FBA或私人仓")
+        public boolean isInboundModeValid() {
+            if (inboundCode != null && !inboundCode.isBlank())
+                return "FBA".equals(destinationType) || "PRIVATE".equals(destinationType)
+                    || destinationType == null && fbaWarehouseCode != null && !fbaWarehouseCode.isBlank();
+            return deliveryMethod != null && !deliveryMethod.isBlank() && deliveryAddress != null
+                && !deliveryAddress.isBlank() && estimatedArrivalAt != null;
+        }
         public Create(String inboundCode, List<Long> sourceLastlegOrderIds, String operatingWarehouseId,
                       String fbaWarehouseCode, String deliveryAddress, int packageCount, BigDecimal volumeCbm,
                       String deliveryMethod, LocalDateTime estimatedArrivalAt, String fbaShipmentNo,
@@ -97,20 +105,47 @@ public final class WarehouseTransferRequests {
     public record Outbound(@NotBlank @Size(max = 255) String idempotencyKey,
                            @Size(max = 1000) String remark) {}
 
+    /** 仅增加整单预报箱数，箱内SKU由PDA清点确定，携带原箱数用于并发核对及重试去重。 */
+    public record IncreaseForecastCartons(
+        @Positive @Max(5000) int expectedPackageCount,
+        @Positive @Max(5000) int packageCount
+    ) {}
+
+    public record CountCartons(
+        @NotBlank @Size(max = 255) String idempotencyKey,
+        @NotEmpty @Size(max = 5000) List<@Valid @NotNull CountCarton> boxes,
+        @Size(max = 1000) String discrepancyReason,
+        @NotNull @Positive Integer forecastPackageCount
+    ) {}
+
+    public record CountCarton(
+        @Size(max = 255) String cartonMark,
+        Long transferItemId,
+        @NotNull Long transferPalletId,
+        @NotNull @DecimalMin("0.01") BigDecimal length,
+        @NotNull @DecimalMin("0.01") BigDecimal width,
+        @NotNull @DecimalMin("0.01") BigDecimal height,
+        @NotNull @DecimalMin("0.01") BigDecimal weight,
+        @NotEmpty @Size(max = 200) List<@Valid @NotNull CountSku> items
+    ) {}
+
+    public record CountSku(@NotBlank @Size(max = 255) String skuCode,
+                           @Positive @Max(2147483647) long quantity) {}
+
     public record Palletize(
         @NotBlank @Size(max = 255) String idempotencyKey,
-        @NotEmpty @Size(max = 20) List<@NotNull Long> photoFileIds
-    ) {}
+        @NotEmpty @Size(max = 20) List<@NotNull Long> photoFileIds,
+        @Size(max = 1000) String discrepancyReason
+    ) {
+        /** 无差异的既有调用不需要填写原因。 */
+        public Palletize(String idempotencyKey, List<Long> photoFileIds) {
+            this(idempotencyKey, photoFileIds, null);
+        }
+    }
 
     public record PalletDraft(
         Long palletId,
-        @NotBlank @Size(max = 255) String idempotencyKey,
-        @Positive int cartonCount,
-        @NotNull @DecimalMin("0.01") BigDecimal lengthCm,
-        @NotNull @DecimalMin("0.01") BigDecimal widthCm,
-        @NotNull @DecimalMin("0.01") BigDecimal heightCm,
-        @NotNull @DecimalMin("0.000001") BigDecimal volumeCbm,
-        @NotNull @DecimalMin("0.01") BigDecimal grossWeightKg
+        @NotBlank @Size(max = 255) String idempotencyKey
     ) {}
 
     public record PalletAction(@NotBlank @Size(max = 255) String idempotencyKey) {}
@@ -151,8 +186,17 @@ public final class WarehouseTransferRequests {
         @Size(max = 128) String skuCode,
         @Size(max = 255) String productNameZh,
         @Positive int packageCount,
-        @Size(max = 255) String shippingMark
-    ) {}
+        @Size(max = 255) String shippingMark,
+        @Positive Long quantity,
+        @Size(max = 5000) List<@NotBlank @jakarta.validation.constraints.Pattern(regexp = "BX-[A-Z0-9]{1,40}") String> cartonMarks
+    ) {
+        public Item(String skuCode, String productNameZh, int packageCount, String shippingMark, Long quantity) {
+            this(skuCode, productNameZh, packageCount, shippingMark, quantity, null);
+        }
+        public Item(String skuCode, String productNameZh, int packageCount, String shippingMark) {
+            this(skuCode, productNameZh, packageCount, shippingMark, null);
+        }
+    }
 
     public record RelabelItem(
         @NotBlank @Size(max = 32) String operationType,
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/transfer/dto/WarehouseTransferResponses.java b/lastleg-service/src/main/java/com/baiyue/lastleg/transfer/dto/WarehouseTransferResponses.java
index 7a3ece053..356c8d4ac 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/transfer/dto/WarehouseTransferResponses.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/transfer/dto/WarehouseTransferResponses.java
@@ -6,8 +6,14 @@ import java.util.List;
 
 public final class WarehouseTransferResponses {
     private WarehouseTransferResponses() {}
-    public record Item(Long id, String skuCode, String productNameZh, int packageCount, String shippingMark) {}
-    public record Carton(String cartonMark, String customerCartonMark, int cartonIndex, int totalCartons, String status) {}
+    public record SourceCarton(String cartonMark, String productNameZh, Long quantity,
+                               String destinationWarehouseCode, String destinationWarehouseName, List<SourceCartonSku> items) {}
+    public record SourceCartonSku(String skuCode, Long quantity) {}
+    public record Item(Long id, String skuCode, String productNameZh, int packageCount, String shippingMark, Long quantity) {}
+    public record Carton(String cartonMark, String customerCartonMark, int cartonIndex, int totalCartons, String status,
+                         Long transferItemId, Long transferPalletId, BigDecimal length, BigDecimal width, BigDecimal height,
+                         BigDecimal weight, Long quantity, String discrepancyReason, String countedBy, LocalDateTime countedAt, List<CartonItem> items) {}
+    public record CartonItem(Long transferItemId, String skuCode, long quantity) {}
     public record Label(String transferNo, List<Carton> cartons, String printableHtml) {}
     public record DestinationResult(String customerId, String transferNo) {}
     public record PalletItem(Long transferItemId, String skuCode, int packageCount) {}
@@ -36,7 +42,8 @@ public final class WarehouseTransferResponses {
                           String destinationType, String destinationWarehouseCode, String destinationWarehouseName,
                           int packageCount, String deliveryMethod, boolean needRelabel, String relabelNo,
                           String relabelStatus, String relabelFulfillmentStatus,
-                          String status, LocalDateTime estimatedArrivalAt, LocalDateTime createdAt) {}
+                          String status, LocalDateTime estimatedArrivalAt, LocalDateTime createdAt,
+                          LocalDateTime reviewedAt, LocalDateTime measuredAt, LocalDateTime outboundAt) {}
     public record Detail(Long id, String transferNo, Long inboundOrderId, String inboundCode,
                          Long lastlegOrderId, String lastlegOrderNo, String orderType, String orderStatus,
                          String status,
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/transfer/entity/WarehouseTransferCarton.java b/lastleg-service/src/main/java/com/baiyue/lastleg/transfer/entity/WarehouseTransferCarton.java
index e17cfd9c4..3bbba0377 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/transfer/entity/WarehouseTransferCarton.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/transfer/entity/WarehouseTransferCarton.java
@@ -13,12 +13,24 @@ public class WarehouseTransferCarton {
     @TableId(type = IdType.INPUT) private Long id;
     private Long transferOrderId;
     private Long transferItemId;
+    private Long transferPalletId;
     private String customerId;
     private String cartonMark;
     private String customerCartonMark;
     private Integer cartonIndex;
     private Integer totalCartons;
     private String status;
+    private java.math.BigDecimal lengthCm;
+    private java.math.BigDecimal widthCm;
+    private java.math.BigDecimal heightCm;
+    private java.math.BigDecimal grossWeightKg;
+    private Long countedQuantity;
+    private String skuItemsJson;
+    private String countIdempotencyKey;
+    private String countRequestHash;
+    private String discrepancyReason;
+    private String countedBy;
+    private LocalDateTime countedAt;
     private LocalDateTime createdAt;
     private LocalDateTime updatedAt;
 }
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/transfer/entity/WarehouseTransferItem.java b/lastleg-service/src/main/java/com/baiyue/lastleg/transfer/entity/WarehouseTransferItem.java
index 6ca13d301..09d712433 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/transfer/entity/WarehouseTransferItem.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/transfer/entity/WarehouseTransferItem.java
@@ -15,6 +15,7 @@ public class WarehouseTransferItem {
     private String skuCode;
     private String productNameZh;
     private Integer packageCount;
+    private Long declaredQuantity;
     private String shippingMark;
     private LocalDateTime createdAt;
 }
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/transfer/gateway/TransferWarehouseCatalogClient.java b/lastleg-service/src/main/java/com/baiyue/lastleg/transfer/gateway/TransferWarehouseCatalogClient.java
new file mode 100644
index 000000000..5f7f6a42e
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/transfer/gateway/TransferWarehouseCatalogClient.java
@@ -0,0 +1,17 @@
+package com.baiyue.lastleg.transfer.gateway;
+
+import com.baiyue.common.core.api.ApiResponse;
+import org.springframework.cloud.openfeign.FeignClient;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.RequestHeader;
+import java.util.List;
+
+/** Authoritative warehouse catalog for resolving the frozen transfer destination. */
+@FeignClient(name = "warehouse-service", contextId = "transferWarehouseCatalogClient",
+    url = "${baiyue.clients.domestic-warehouse.url:}")
+public interface TransferWarehouseCatalogClient {
+    @GetMapping("/internal/warehouses/order-catalog")
+    ApiResponse<List<Warehouse>> activeWarehouses(@RequestHeader("X-Internal-Service-Token") String token);
+
+    record Warehouse(Long id, String warehouseCode, String warehouseName, String warehouseType, String countryCode) { }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/transfer/mapper/InboundSnapshotMapper.java b/lastleg-service/src/main/java/com/baiyue/lastleg/transfer/mapper/InboundSnapshotMapper.java
index 59e14637c..01a2cfa45 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/transfer/mapper/InboundSnapshotMapper.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/transfer/mapper/InboundSnapshotMapper.java
@@ -3,6 +3,25 @@ import org.apache.ibatis.annotations.Mapper;
 import org.apache.ibatis.annotations.Param;
 import org.apache.ibatis.annotations.Select;
 @Mapper public interface InboundSnapshotMapper {
+    record SourceCarton(String cartonMark, String skuCode, String productNameZh, Long quantity,
+                        String destinationWarehouseCode, String destinationWarehouseName, String skuItemsJson) {}
+    @Select("""
+        SELECT c.carton_mark cartonMark,c.sku_code skuCode,NULL productNameZh,NULL quantity,
+               c.destination_warehouse_code destinationWarehouseCode,c.destination_warehouse_name destinationWarehouseName,NULL skuItemsJson
+          FROM ll_inbound_plan_carton c JOIN ll_order o ON o.id=c.order_id AND o.customer_id=c.customer_id
+         WHERE c.customer_id=#{customerId} AND o.inbound_code=#{inboundCode} AND o.overseas_warehouse_id=#{warehouseId}
+        UNION ALL
+        SELECT c.carton_mark,i.sku_code,i.product_name_zh,c.counted_quantity,
+               t.destination_warehouse_code,t.destination_warehouse_name,c.sku_items_json
+          FROM ll_warehouse_transfer_carton c
+          JOIN ll_warehouse_transfer_order t ON t.id=c.transfer_order_id AND t.customer_id=c.customer_id
+          JOIN ll_order o ON o.id=t.lastleg_order_id AND o.customer_id=t.customer_id
+          JOIN ll_warehouse_transfer_item i ON i.id=c.transfer_item_id AND i.customer_id=c.customer_id AND i.transfer_order_id=t.id
+         WHERE c.customer_id=#{customerId} AND o.inbound_code=#{inboundCode} AND t.operating_warehouse_id=#{warehouseId} AND c.status='COUNTED'
+         ORDER BY cartonMark
+        """)
+    java.util.List<SourceCarton> sourceCartons(@Param("customerId") String customerId,
+        @Param("warehouseId") String warehouseId, @Param("inboundCode") String inboundCode);
     @Select("SELECT id FROM ll_inbound_order WHERE customer_id=#{customerId} AND (inbound_code=#{code} OR source_inbound_id=#{code}) LIMIT 1")
     Long findId(@Param("customerId") String customerId, @Param("code") String code);
     @Select("SELECT id FROM ll_inbound_order WHERE customer_id=#{customerId} AND source_inbound_id=#{sourceInboundId} LIMIT 1")
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/transfer/mapper/WarehouseTransferCartonMapper.java b/lastleg-service/src/main/java/com/baiyue/lastleg/transfer/mapper/WarehouseTransferCartonMapper.java
index ae584e342..50e0884a5 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/transfer/mapper/WarehouseTransferCartonMapper.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/transfer/mapper/WarehouseTransferCartonMapper.java
@@ -10,6 +10,15 @@ import java.util.List;
 
 @Mapper
 public interface WarehouseTransferCartonMapper extends BaseMapper<WarehouseTransferCarton> {
+    /** 按客户及本单范围保存完成原因，允许清空重测前的差异说明。 */
+    @org.apache.ibatis.annotations.Update("UPDATE ll_warehouse_transfer_carton SET discrepancy_reason=#{reason}, updated_at=CURRENT_TIMESTAMP WHERE customer_id=#{customerId} AND transfer_order_id=#{transferOrderId}")
+    int saveDiscrepancyReason(@Param("customerId") String customerId, @Param("transferOrderId") Long transferOrderId, @Param("reason") String reason);
+
+    @org.apache.ibatis.annotations.Update("UPDATE ll_warehouse_transfer_carton SET counted_at=NULL, counted_by=NULL, count_idempotency_key=NULL, count_request_hash=NULL, updated_at=CURRENT_TIMESTAMP WHERE customer_id=#{customerId} AND transfer_order_id=#{transferOrderId}")
+    int reopenMeasurement(@Param("customerId") String customerId, @Param("transferOrderId") Long transferOrderId);
+
+    @org.apache.ibatis.annotations.Update("UPDATE ll_warehouse_transfer_carton SET transfer_pallet_id=NULL, updated_at=CURRENT_TIMESTAMP WHERE customer_id=#{customerId} AND transfer_order_id=#{transferOrderId} AND transfer_pallet_id=#{palletId}")
+    int unassignPallet(@Param("customerId") String customerId, @Param("transferOrderId") Long transferOrderId, @Param("palletId") Long palletId);
     @Select("SELECT * FROM ll_warehouse_transfer_carton WHERE customer_id=#{customerId} AND transfer_order_id=#{transferOrderId} ORDER BY carton_index")
     List<WarehouseTransferCarton> listOrder(@Param("customerId") String customerId,
                                             @Param("transferOrderId") Long transferOrderId);
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/transfer/mapper/WarehouseTransferPalletMapper.java b/lastleg-service/src/main/java/com/baiyue/lastleg/transfer/mapper/WarehouseTransferPalletMapper.java
index fb9361e0e..4f0454b43 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/transfer/mapper/WarehouseTransferPalletMapper.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/transfer/mapper/WarehouseTransferPalletMapper.java
@@ -10,6 +10,15 @@ import java.util.List;
 
 @Mapper
 public interface WarehouseTransferPalletMapper extends BaseMapper<WarehouseTransferPallet> {
+    record MeasurementTime(Long transferOrderId, java.time.LocalDateTime measuredAt) {}
+
+    @Select("<script>SELECT p.transfer_order_id AS transferOrderId,MAX(p.completed_at) AS measuredAt " +
+        "FROM ll_warehouse_transfer_pallet p JOIN ll_warehouse_transfer_order t " +
+        "ON t.id=p.transfer_order_id AND t.customer_id=p.customer_id " +
+        "WHERE t.id IN <foreach collection='orderIds' item='id' open='(' separator=',' close=')'>#{id}</foreach> " +
+        "AND p.completed_at IS NOT NULL GROUP BY p.transfer_order_id</script>")
+    List<MeasurementTime> measurementTimes(@Param("orderIds") List<Long> orderIds);
+
     @Select("SELECT * FROM ll_warehouse_transfer_pallet WHERE customer_id=#{customerId} AND transfer_order_id=#{transferOrderId} ORDER BY sequence_no")
     List<WarehouseTransferPallet> listOrder(@Param("customerId") String customerId,
                                              @Param("transferOrderId") Long transferOrderId);
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/transfer/repository/TransferForecastRepository.java b/lastleg-service/src/main/java/com/baiyue/lastleg/transfer/repository/TransferForecastRepository.java
new file mode 100644
index 000000000..83e29a1f8
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/transfer/repository/TransferForecastRepository.java
@@ -0,0 +1,69 @@
+package com.baiyue.lastleg.transfer.repository;
+
+import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
+import com.baomidou.mybatisplus.core.conditions.update.LambdaUpdateWrapper;
+import com.baiyue.lastleg.transfer.entity.*;
+import com.baiyue.lastleg.transfer.mapper.*;
+import com.baiyue.lastleg.entity.LastlegOrder;
+import com.baiyue.lastleg.entity.LastlegInboundOrder;
+import com.baiyue.lastleg.entity.LastlegOrderStatusHistory;
+import com.baiyue.lastleg.mapper.*;
+import com.baiyue.lastleg.inboundplan.entity.InboundPlanLine;
+import com.baiyue.lastleg.inboundplan.mapper.InboundPlanLineMapper;
+import jakarta.annotation.Resource;
+import org.springframework.stereotype.Repository;
+import java.time.LocalDateTime;
+import java.util.List;
+
+/** 转运预报补箱的数据访问，统一保留原箱号及客户隔离。 */
+@Repository
+public class TransferForecastRepository {
+    @Resource private WarehouseTransferOrderMapper transfers;
+
+    @Resource private WarehouseTransferCartonMapper cartons;
+    @Resource private LastlegOrderMapper orders;
+    @Resource private LastlegInboundOrderMapper inboundOrders;
+
+    @Resource private LastlegOrderStatusHistoryMapper histories;
+    @Resource private InboundPlanLineMapper planLines;
+
+    /** 与PDA清点及完工锁定同一转运单，避免补箱与完工并发。 */
+    public WarehouseTransferOrder lock(String customerId, String transferNo) {
+        return transfers.lockNo(customerId, transferNo);
+    }
+
+    /** 读取原箱号用于确定新增编号，不删除或重建原箱。 */
+    public List<WarehouseTransferCarton> cartons(String customerId, Long transferId) {
+        return cartons.listOrder(customerId, transferId);
+    }
+
+    /** 追加预报箱并同步各预报口径；清点数据保留，整单清点确认失效。 */
+    public void append(WarehouseTransferOrder transfer,
+                       List<WarehouseTransferCarton> added, LocalDateTime now, String operatorId) {
+        String customerId = transfer.getCustomerId();
+        var order = orders.selectOne(new LambdaQueryWrapper<LastlegOrder>()
+            .eq(LastlegOrder::getCustomerId, customerId).eq(LastlegOrder::getId, transfer.getLastlegOrderId()));
+        if (order == null) throw new IllegalStateException("转运关联尾程订单不存在");
+
+        transfers.updateById(transfer);
+        for (var carton : added) cartons.insert(carton);
+        cartons.update(null, new LambdaUpdateWrapper<WarehouseTransferCarton>()
+            .eq(WarehouseTransferCarton::getCustomerId, customerId).eq(WarehouseTransferCarton::getTransferOrderId, transfer.getId())
+            .set(WarehouseTransferCarton::getTotalCartons, transfer.getPackageCount()).set(WarehouseTransferCarton::getUpdatedAt, now));
+        cartons.reopenMeasurement(customerId, transfer.getId());
+        orders.update(null, new LambdaUpdateWrapper<LastlegOrder>()
+            .eq(LastlegOrder::getCustomerId, customerId).eq(LastlegOrder::getId, transfer.getLastlegOrderId())
+            .set(LastlegOrder::getPackageCount, transfer.getPackageCount()).set(LastlegOrder::getUpdatedAt, now));
+        inboundOrders.update(null, new LambdaUpdateWrapper<LastlegInboundOrder>()
+            .eq(LastlegInboundOrder::getCustomerId, customerId).eq(LastlegInboundOrder::getId, transfer.getInboundOrderId())
+            .set(LastlegInboundOrder::getPackageCount, transfer.getPackageCount()).set(LastlegInboundOrder::getUpdatedAt, now));
+        planLines.update(null, new LambdaUpdateWrapper<InboundPlanLine>()
+            .eq(InboundPlanLine::getCustomerId, customerId).eq(InboundPlanLine::getOrderId, transfer.getLastlegOrderId())
+            .set(InboundPlanLine::getRequiredPackageCount, transfer.getPackageCount()));
+        var history = new LastlegOrderStatusHistory(); history.setCustomerId(customerId); history.setOrderId(transfer.getLastlegOrderId());
+        history.setFromStatus(order.getCurrentStatus()); history.setToStatus(order.getCurrentStatus());
+        history.setEventId(transfer.getTransferNo()); history.setCreatedAt(now);
+        history.setRemark("增加预报箱数，补充箱唛" + added.size() + "个；操作人：" + operatorId);
+        histories.insert(history);
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/transfer/repository/TransferMeasurementRepository.java b/lastleg-service/src/main/java/com/baiyue/lastleg/transfer/repository/TransferMeasurementRepository.java
new file mode 100644
index 000000000..ff8ea0f62
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/transfer/repository/TransferMeasurementRepository.java
@@ -0,0 +1,16 @@
+package com.baiyue.lastleg.transfer.repository;
+
+import com.baiyue.lastleg.transfer.mapper.WarehouseTransferCartonMapper;
+import jakarta.annotation.Resource;
+import org.springframework.stereotype.Repository;
+
+/** 封装转运测量完成时的箱级差异说明持久化。 */
+@Repository
+public class TransferMeasurementRepository {
+    @Resource private WarehouseTransferCartonMapper cartons;
+
+    /** 整单统一保存原因，无差异时显式清空重测前的旧原因。 */
+    public void saveDiscrepancyReason(String customerId, Long transferOrderId, String reason) {
+        cartons.saveDiscrepancyReason(customerId, transferOrderId, reason);
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/transfer/repository/TransferReturnSourceRepository.java b/lastleg-service/src/main/java/com/baiyue/lastleg/transfer/repository/TransferReturnSourceRepository.java
new file mode 100644
index 000000000..7a7be18df
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/transfer/repository/TransferReturnSourceRepository.java
@@ -0,0 +1,38 @@
+package com.baiyue.lastleg.transfer.repository;
+
+import com.baiyue.lastleg.returnreceipt.entity.ReturnInventoryCarton;
+import com.baiyue.lastleg.returnreceipt.entity.ReturnInventoryCartonItem;
+import com.baiyue.lastleg.returnreceipt.entity.ReturnOrder;
+import com.baiyue.lastleg.returnreceipt.mapper.ReturnInventoryCartonItemMapper;
+import com.baiyue.lastleg.returnreceipt.mapper.ReturnInventoryCartonMapper;
+import com.baiyue.lastleg.returnreceipt.mapper.ReturnOrderMapper;
+import jakarta.annotation.Resource;
+import org.springframework.stereotype.Repository;
+
+import java.util.List;
+
+/** 封装仓储转运所需的退货来源查询，保留客户和操作仓隔离。 */
+@Repository
+public class TransferReturnSourceRepository {
+    @Resource private ReturnOrderMapper orders;
+    @Resource private ReturnInventoryCartonMapper cartons;
+    @Resource private ReturnInventoryCartonItemMapper items;
+
+    /** 按当前客户和退货单号查询来源单据。 */
+    public ReturnOrder findOrder(String customerId, String returnNo) {
+        return orders.findNo(customerId, returnNo);
+    }
+
+    /** 查询当前仓内已完成清点且可用的退货箱，不影响其他页面的历史库存查询。 */
+    public List<ReturnInventoryCarton> availableCartons(String customerId, String warehouseId, String returnNo) {
+        return cartons.currentReturnCartons(customerId, warehouseId, returnNo).stream()
+            .filter(carton -> "AVAILABLE".equals(carton.getStatus()) && "CONFIRMED".equals(carton.getCountStatus())
+                && carton.getRelabelApplicationId() == null)
+            .toList();
+    }
+
+    /** 批量读取已通过客户及仓库隔离校验的来源箱明细。 */
+    public List<ReturnInventoryCartonItem> cartonItems(List<Long> cartonIds) {
+        return cartonIds.isEmpty() ? List.of() : items.listCartons(cartonIds);
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/transfer/service/WarehouseTransferForecastService.java b/lastleg-service/src/main/java/com/baiyue/lastleg/transfer/service/WarehouseTransferForecastService.java
new file mode 100644
index 000000000..40996d75f
--- /dev/null
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/transfer/service/WarehouseTransferForecastService.java
@@ -0,0 +1,56 @@
+package com.baiyue.lastleg.transfer.service;
+
+import com.baomidou.mybatisplus.core.toolkit.IdWorker;
+import com.baiyue.lastleg.transfer.dto.WarehouseTransferRequests;
+import com.baiyue.lastleg.transfer.dto.WarehouseTransferResponses;
+import com.baiyue.lastleg.transfer.entity.WarehouseTransferCarton;
+import com.baiyue.lastleg.transfer.repository.TransferForecastRepository;
+import com.baiyue.lastleg.service.LastlegOrderNoGenerator;
+import jakarta.annotation.Resource;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Transactional;
+import org.springframework.http.HttpStatus;
+import org.springframework.web.server.ResponseStatusException;
+import java.time.LocalDateTime;
+import java.util.ArrayList;
+import java.util.Set;
+
+/** 测量完成前补充预报箱，只追加编号，不重建既有箱号。 */
+@Service
+public class WarehouseTransferForecastService {
+    @Resource private TransferForecastRepository repository;
+    @Resource private WarehouseTransferService transfers;
+
+    /** 锁单校验原预报快照，追加箱号并同步预报箱数，重复提交不重复生成。 */
+    @Transactional
+    public WarehouseTransferResponses.Detail increase(String customerId, String transferNo, String operatorId,
+                                                       WarehouseTransferRequests.IncreaseForecastCartons request) {
+        var transfer = repository.lock(customerId, transferNo);
+        if (transfer == null) throw new ResponseStatusException(HttpStatus.NOT_FOUND, "转运单不存在");
+        if (!transferNo.equals(transfer.getInboundCode()) || !Set.of("PENDING_REVIEW", "WAIT_PDA_RECEIVING").contains(transfer.getStatus()))
+            throw new ResponseStatusException(HttpStatus.CONFLICT, "仅测量完成前的外来转运单可增加预报箱数");
+        int addedCount = request.packageCount() - request.expectedPackageCount();
+        int total = request.packageCount();
+        if (addedCount <= 0 || total > 5000 || request.expectedPackageCount() <= 0)
+            throw new ResponseStatusException(HttpStatus.BAD_REQUEST, "只能增加预报箱数，整单最多5000箱");
+        // 相同目标值重试不再生成箱唛；不同原快照必须刷新，防止并发覆盖。
+        if (transfer.getPackageCount() == total) return transfers.detail(customerId, transferNo);
+        if (transfer.getPackageCount() != request.expectedPackageCount())
+            throw new ResponseStatusException(HttpStatus.CONFLICT, "预报箱数已变化，请刷新后重试");
+        var existing = repository.cartons(customerId, transfer.getId());
+        int index = existing.stream().mapToInt(WarehouseTransferCarton::getCartonIndex).max().orElse(0);
+        LocalDateTime now = LocalDateTime.now();
+        var added = new ArrayList<WarehouseTransferCarton>();
+        for (int i = 0; i < addedCount; i++) {
+            var carton = new WarehouseTransferCarton(); carton.setId(IdWorker.getId()); carton.setCustomerId(customerId);
+            carton.setTransferOrderId(transfer.getId());
+            // 预报箱仅代表一个箱唛，不预先绑定SKU，实收箱内明细由PDA记录。
+            carton.setCartonMark(LastlegOrderNoGenerator.compactCartonMark(carton.getId()));
+            carton.setCartonIndex(++index); carton.setTotalCartons((int) total); carton.setStatus("EXPECTED");
+            carton.setCreatedAt(now); carton.setUpdatedAt(now); added.add(carton);
+        }
+        transfer.setPackageCount(total); transfer.setUpdatedAt(now);
+        repository.append(transfer, added, now, operatorId);
+        return transfers.detail(customerId, transferNo);
+    }
+}
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/transfer/service/WarehouseTransferReceiptCoordinator.java b/lastleg-service/src/main/java/com/baiyue/lastleg/transfer/service/WarehouseTransferReceiptCoordinator.java
index e952751bf..619498af3 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/transfer/service/WarehouseTransferReceiptCoordinator.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/transfer/service/WarehouseTransferReceiptCoordinator.java
@@ -2,7 +2,7 @@ package com.baiyue.lastleg.transfer.service;
 
 import com.baomidou.mybatisplus.core.toolkit.IdWorker;
 import com.baiyue.lastleg.client.DomesticWarehouseDirectoryClient;
-import com.baiyue.lastleg.fleet.driver.FleetWarehouseClient;
+import com.baiyue.lastleg.transfer.gateway.TransferWarehouseCatalogClient;
 import com.baiyue.lastleg.inboundplan.pda.gateway.WarehouseResourceGateway;
 import com.baiyue.lastleg.transfer.dto.WarehouseTransferRequests;
 import com.baiyue.lastleg.transfer.dto.WarehouseTransferResponses;
@@ -41,7 +41,7 @@ public class WarehouseTransferReceiptCoordinator {
     @Resource private WarehouseTransferReceiptCommandMapper commands;
     @Resource private WarehouseResourceGateway warehouse;
     @Resource private DomesticWarehouseDirectoryClient directory;
-    @Resource private FleetWarehouseClient catalog;
+    @Resource private TransferWarehouseCatalogClient catalog;
     @Resource private PlatformTransactionManager transactionManager;
     @Resource private ObjectMapper objectMapper;
     @Value("${baiyue.security.internal-service-token:}") private String internalToken;
diff --git a/lastleg-service/src/main/java/com/baiyue/lastleg/transfer/service/WarehouseTransferService.java b/lastleg-service/src/main/java/com/baiyue/lastleg/transfer/service/WarehouseTransferService.java
index 07cbf6a04..6b5984cb3 100644
--- a/lastleg-service/src/main/java/com/baiyue/lastleg/transfer/service/WarehouseTransferService.java
+++ b/lastleg-service/src/main/java/com/baiyue/lastleg/transfer/service/WarehouseTransferService.java
@@ -59,6 +59,10 @@ import com.baiyue.lastleg.transfer.mapper.WarehouseTransferPalletMapper;
 import com.baiyue.lastleg.transfer.mapper.WarehouseTransferPalletItemMapper;
 import com.baiyue.lastleg.transfer.mapper.WarehouseTransferRelabelBindingMapper;
 import com.baiyue.lastleg.transfer.mapper.WarehouseTransferMeasurementPhotoMapper;
+import com.baiyue.lastleg.returnreceipt.entity.ReturnInventoryCarton;
+import com.baiyue.lastleg.returnreceipt.entity.ReturnInventoryCartonItem;
+import com.baiyue.lastleg.returnreceipt.entity.ReturnOrder;
+import com.baiyue.lastleg.transfer.repository.TransferReturnSourceRepository;
 import com.fasterxml.jackson.databind.ObjectMapper;
 import jakarta.annotation.Resource;
 import org.springframework.http.HttpStatus;
@@ -88,6 +92,9 @@ import java.util.stream.Collectors;
 
 @Service
 public class WarehouseTransferService {
+    /** 退货单在转运来源中的展示编码，避免把退货单号误当成普通入仓码查询。 */
+    public static final String RETURN_ORDER_PREFIX = "RETURN_ORDER:";
+    @Resource private com.baiyue.lastleg.service.CompactBusinessNumberService compactNumbers;
     @Resource private com.baiyue.lastleg.fleet.customer.FleetCustomerDirectory customerDirectory;
     @Resource private com.baiyue.lastleg.fleet.business.FleetPoolOrderBridge fleetPool;
     @Resource private com.baiyue.lastleg.fleet.business.FleetPoolOrderQueries fleetPoolQueries;
@@ -113,6 +120,7 @@ public class WarehouseTransferService {
     @Resource private WarehouseTransferOrderMapper transfers;
     @Resource private WarehouseTransferItemMapper transferItems;
     @Resource private WarehouseTransferCartonMapper transferCartons;
+    @Resource private com.baiyue.lastleg.transfer.repository.TransferMeasurementRepository transferMeasurementRepository;
     @Resource private WarehouseTransferSourceOrderMapper sourceOrders;
     @Resource private WarehouseTransferPalletMapper transferPallets;
     @Resource private WarehouseTransferPalletItemMapper transferPalletItems;
@@ -139,24 +147,63 @@ public class WarehouseTransferService {
     @Resource private InventoryCommandService inventory;
     @Resource private InventoryCommandMapper inventoryCommands;
     @Resource private ObjectMapper objectMapper;
+    @Resource private TransferReturnSourceRepository returnSources;
 
+    /** 查询来源单据当前可用的箱唛及箱内 SKU，兼容普通入仓与退货库存。 */
+    public List<WarehouseTransferResponses.SourceCarton> sourceCartons(String customerId, String warehouseId, String inboundCode) {
+        if (!StringUtils.hasText(warehouseId) || !StringUtils.hasText(inboundCode)) throw badRequest("请选择海外仓和库存来源单据");
+        String source = inboundCode.trim();
+        if (isReturnOrderSource(source)) {
+            String returnNo = returnNoFromSource(source);
+            ReturnOrder order = returnSources.findOrder(customerId, returnNo);
+            if (order == null || !warehouseId.trim().equals(order.getOverseasWarehouseId())) {
+                throw notFound("退货单不存在或不属于当前操作仓");
+            }
+            List<ReturnInventoryCarton> cartons = returnSources.availableCartons(customerId, warehouseId.trim(), returnNo);
+            List<Long> cartonIds = cartons.stream().map(ReturnInventoryCarton::getId).filter(Objects::nonNull).toList();
+            Map<Long, List<ReturnInventoryCartonItem>> items = cartonIds.isEmpty() ? Map.of()
+                : returnSources.cartonItems(cartonIds).stream().collect(Collectors.groupingBy(ReturnInventoryCartonItem::getCartonId));
+            return cartons.stream().map(carton -> {
+                List<ReturnInventoryCartonItem> rows = items.getOrDefault(carton.getId(), List.of());
+                List<WarehouseTransferResponses.SourceCartonSku> contents = rows.stream()
+                    .filter(item -> item.getQuantity() != null && item.getQuantity() > 0)
+                    .map(item -> new WarehouseTransferResponses.SourceCartonSku(item.getSkuCode(), item.getQuantity())).toList();
+                return new WarehouseTransferResponses.SourceCarton(carton.getCartonMark(), null, carton.getTotalQuantity(),
+                    carton.getDestinationWarehouseCode(), carton.getDestinationWarehouseName(), contents);
+            }).toList();
+        }
+        return inboundSnapshots.sourceCartons(customerId, warehouseId.trim(), source).stream().map(row -> {
+            var carton = new WarehouseTransferCarton(); carton.setSkuItemsJson(row.skuItemsJson());
+            var contents = cartonContents(carton).stream().map(item -> new WarehouseTransferResponses.SourceCartonSku(item.skuCode(),item.quantity())).toList();
+            if (contents.isEmpty()) contents = List.of(new WarehouseTransferResponses.SourceCartonSku(row.skuCode(),row.quantity()));
+            return new WarehouseTransferResponses.SourceCarton(row.cartonMark(),row.productNameZh(),row.quantity(),
+                row.destinationWarehouseCode(),row.destinationWarehouseName(),contents);
+        }).toList();
+    }
+    private static LocalDateTime arrivalTime(WarehouseTransferRequests.Create request) {
+        return StringUtils.hasText(request.inboundCode()) ? null : request.estimatedArrivalAt();
+    }
+    private static String inboundMethod(WarehouseTransferRequests.Create request) {
+        return StringUtils.hasText(request.inboundCode()) ? "INVENTORY_TRANSFER" : request.deliveryMethod().trim();
+    }
+    private static String inboundAddress(WarehouseTransferRequests.Create request) {
+        return StringUtils.hasText(request.inboundCode()) ? "" : request.deliveryAddress().trim();
+    }
+
+    /** 创建转运草稿并关联来源单据，退货来源沿其关联尾程订单核对客户归属。 */
     @Transactional
     public WarehouseTransferResponses.Detail create(String customerId, String operatorId,
                                                      WarehouseTransferRequests.Create request) {
+        if (!request.isInboundModeValid()) throw badRequest("外来货物须填写入仓信息，库存转运须选择FBA仓或私人仓");
         int itemPackages = request.items().stream().mapToInt(WarehouseTransferRequests.Item::packageCount).sum();
         if (itemPackages != request.packageCount()) {
             throw badRequest("Cargo item package total must equal transfer package count");
         }
-        validateRelabelRequest(request);
+        validatePrintedCartonMarks(request);
+        validateRelabelRequest(customerId, request);
         validateDestination(request.destinationType(), request.destinationWarehouseCode(), request.fbaWarehouseCode(),
             request.privateDestinationAddress(), request.privateDestinationPostalCode(),
             request.privateDestinationContactName(), request.privateDestinationContactPhone());
-        // A split relabel transfer may intentionally defer the whole-order
-        // destination: relabeled cartons go through relabel dispatch while the
-        // remaining cartons are bound later from warehouse-transfer outbound.
-        // All other transfer types must still select FBA or PRIVATE up front.
-        validateTransferDestinationRequired(request.destinationType(), request.fbaWarehouseCode(),
-            request.needRelabel() && request.relabelItems() != null && !request.relabelItems().isEmpty());
         String key = request.idempotencyKey().trim();
         String requestHash = hash(request);
         WarehouseTransferOrder replay = transfers.findKey(customerId, key);
@@ -173,7 +220,7 @@ public class WarehouseTransferService {
         }
         LocalDateTime now = LocalDateTime.now();
         long transferId = IdWorker.getId();
-        String transferNo = orderNoGenerator.next("TRANSFER", request.operatingWarehouseId(), transferId);
+        String transferNo = compactNumbers.next("ZY", customerId);
         String requestedInboundCode = trim(request.inboundCode());
         List<Long> selectedIds = request.sourceLastlegOrderIds() == null
             ? List.of() : request.sourceLastlegOrderIds().stream().distinct().toList();
@@ -187,18 +234,35 @@ public class WarehouseTransferService {
         List<LastlegOrder> selectedOrders;
         if (existingInventoryTransfer) {
             inboundCode = requestedInboundCode;
-            inboundOrderId = inboundSnapshots.findId(customerId, inboundCode);
-            if (inboundOrderId == null) throw notFound("Inbound order was not found for inboundCode " + inboundCode);
+            if (isReturnOrderSource(inboundCode)) {
+                ReturnOrder returnOrder = returnSources.findOrder(customerId, returnNoFromSource(inboundCode));
+                if (returnOrder == null || !request.operatingWarehouseId().trim().equals(returnOrder.getOverseasWarehouseId())
+                    || returnOrder.getLastlegOrderId() == null) {
+                    throw notFound("退货单不存在、操作仓不匹配或未关联尾程订单");
+                }
+                LastlegOrder returnOrderTail = orders.selectById(returnOrder.getLastlegOrderId());
+                if (returnOrderTail == null || !customerId.equals(returnOrderTail.getCustomerId())) {
+                    throw notFound("退货单关联的尾程订单不存在");
+                }
+                inboundOrderId = StringUtils.hasText(returnOrderTail.getSourceInboundId())
+                    ? inboundSnapshots.findBySourceInboundId(customerId, returnOrderTail.getSourceInboundId())
+                    : inboundSnapshots.findId(customerId, returnOrderTail.getInboundCode());
+                if (inboundOrderId == null) throw notFound("退货单关联的入仓快照不存在");
+                selectedOrders = List.of(returnOrderTail);
+            } else {
+                inboundOrderId = inboundSnapshots.findId(customerId, inboundCode);
+                if (inboundOrderId == null) throw notFound("Inbound order was not found for inboundCode " + inboundCode);
+                selectedOrders = selectedIds.isEmpty()
+                    ? orders.selectList(new LambdaQueryWrapper<LastlegOrder>()
+                        .eq(LastlegOrder::getCustomerId, customerId)
+                        .eq(LastlegOrder::getInboundCode, inboundCode))
+                    : orders.selectList(new LambdaQueryWrapper<LastlegOrder>()
+                        .eq(LastlegOrder::getCustomerId, customerId).in(LastlegOrder::getId, selectedIds));
+            }
             // The merchant form may only submit the inventory inbound code. In that
             // case derive all eligible tail orders for the inbound instead of
             // rejecting a valid inventory transfer because source IDs were omitted.
-            selectedOrders = selectedIds.isEmpty()
-                ? orders.selectList(new LambdaQueryWrapper<LastlegOrder>()
-                    .eq(LastlegOrder::getCustomerId, customerId)
-                    .eq(LastlegOrder::getInboundCode, inboundCode))
-                : orders.selectList(new LambdaQueryWrapper<LastlegOrder>()
-                    .eq(LastlegOrder::getCustomerId, customerId).in(LastlegOrder::getId, selectedIds));
-            if (selectedOrders.isEmpty() || (!selectedIds.isEmpty() && selectedOrders.size() != selectedIds.size())) {
+            if (selectedOrders.isEmpty() || (!selectedIds.isEmpty() && !isReturnOrderSource(inboundCode) && selectedOrders.size() != selectedIds.size())) {
                 throw notFound("One or more selected customer orders do not exist in the current tenant");
             }
         } else {
@@ -216,13 +280,13 @@ public class WarehouseTransferService {
         transfer.setOperatingWarehouseId(request.operatingWarehouseId().trim());
         transfer.setFbaWarehouseCode(destinationCode(request));
         applyDestination(transfer, request);
-        transfer.setDeliveryAddress(request.deliveryAddress().trim()); transfer.setPackageCount(request.packageCount());
+        transfer.setDeliveryAddress(inboundAddress(request)); transfer.setPackageCount(request.packageCount());
         transfer.setPickupContactName(trim(request.pickupContactName()));
         transfer.setPickupContactPhone(trim(request.pickupContactPhone()));
-        transfer.setDeliveryMethod(request.deliveryMethod().trim()); transfer.setEstimatedArrivalAt(request.estimatedArrivalAt());
+        transfer.setDeliveryMethod(inboundMethod(request)); transfer.setEstimatedArrivalAt(arrivalTime(request));
         transfer.setEstimatedShipAt(request.estimatedShipAt());
         transfer.setFbaShipmentNo(trim(request.fbaShipmentNo()));
-        transfer.setTrackingNo("CUSTOMER_DELIVERY".equals(request.deliveryMethod().trim()) ? trim(request.trackingNo()) : null);
+        transfer.setTrackingNo("CUSTOMER_DELIVERY".equals(inboundMethod(request)) ? trim(request.trackingNo()) : null);
         transfer.setFbaBoxNos(trim(request.fbaBoxNos())); transfer.setRemark(trim(request.remark()));
         transfer.setNeedRelabel(request.needRelabel()); transfer.setStatus(DRAFT);
         transfer.setLabelDeadline(request.labelDeadline());
@@ -258,7 +322,8 @@ public class WarehouseTransferService {
             for (int itemCarton = 0; itemCarton < source.packageCount(); itemCarton++) {
                 cartonIndex++;
                 insertTransferCarton(customerId, transferId, itemId, transferNo,
-                    cartonIndex, request.packageCount(), itemCarton < customerMarks.size() ? customerMarks.get(itemCarton) : null, now);
+                    cartonIndex, request.packageCount(), itemCarton < customerMarks.size() ? customerMarks.get(itemCarton) : null, now,
+                    source.cartonMarks() == null ? null : source.cartonMarks().get(itemCarton));
             }
             insertOrderDetail(customerId, order.getId(), transferNo, index, source, request, now);
         }
@@ -284,16 +349,16 @@ public class WarehouseTransferService {
         if (!DRAFT.equals(transfer.getStatus())) {
             throw conflict("Only a draft warehouse transfer order can be edited");
         }
+        if (!request.isInboundModeValid()) throw badRequest("外来货物须填写入仓信息，库存转运须选择FBA仓或私人仓");
         int itemPackages = request.items().stream().mapToInt(WarehouseTransferRequests.Item::packageCount).sum();
         if (itemPackages != request.packageCount()) {
             throw badRequest("Cargo item package total must equal transfer package count");
         }
-        validateRelabelRequest(request);
+        validatePrintedCartonMarks(request);
+        validateRelabelRequest(customerId, request);
         validateDestination(request.destinationType(), request.destinationWarehouseCode(), request.fbaWarehouseCode(),
             request.privateDestinationAddress(), request.privateDestinationPostalCode(),
             request.privateDestinationContactName(), request.privateDestinationContactPhone());
-        validateTransferDestinationRequired(request.destinationType(), request.fbaWarehouseCode(),
-            request.needRelabel() && request.relabelItems() != null && !request.relabelItems().isEmpty());
 
         LastlegOrder order = requireTailOrder(customerId, transfer);
         LocalDateTime now = LocalDateTime.now();
@@ -301,15 +366,15 @@ public class WarehouseTransferService {
         transfer.setOperatingWarehouseId(request.operatingWarehouseId().trim());
         transfer.setFbaWarehouseCode(destinationCode(request));
         applyDestination(transfer, request);
-        transfer.setDeliveryAddress(request.deliveryAddress().trim());
+        transfer.setDeliveryAddress(inboundAddress(request));
         transfer.setPackageCount(request.packageCount());
         transfer.setPickupContactName(trim(request.pickupContactName()));
         transfer.setPickupContactPhone(trim(request.pickupContactPhone()));
-        transfer.setDeliveryMethod(request.deliveryMethod().trim());
-        transfer.setEstimatedArrivalAt(request.estimatedArrivalAt());
+        transfer.setDeliveryMethod(inboundMethod(request));
+        transfer.setEstimatedArrivalAt(arrivalTime(request));
         transfer.setEstimatedShipAt(request.estimatedShipAt());
         transfer.setFbaShipmentNo(trim(request.fbaShipmentNo()));
-        transfer.setTrackingNo("CUSTOMER_DELIVERY".equals(request.deliveryMethod().trim())
+        transfer.setTrackingNo("CUSTOMER_DELIVERY".equals(inboundMethod(request))
             ? trim(request.trackingNo()) : null);
         transfer.setFbaBoxNos(trim(request.fbaBoxNos()));
         transfer.setRemark(trim(request.remark()));
@@ -327,7 +392,7 @@ public class WarehouseTransferService {
         order.setFbaWarehouseCode(destinationCode(request));
         order.setPackageCount(request.packageCount());
         order.setVolumeCbm(request.volumeCbm());
-        order.setEstimatedWarehouseAt(request.estimatedArrivalAt());
+        order.setEstimatedWarehouseAt(arrivalTime(request));
         order.setRelabelStatus(request.needRelabel() ? "PENDING_BINDING" : "NOT_REQUIRED");
         order.setSubOrderStatus("WAREHOUSE_TRANSFER:" + DRAFT + ";RELABEL:" + order.getRelabelStatus());
         order.setCustomerRemark(trim(request.remark()));
@@ -348,9 +413,13 @@ public class WarehouseTransferService {
             inboundOrders.updateById(inbound);
         }
 
+        // 草稿可能已打印箱唛，编辑时保留已有序号对应的编号，只追加或移除尾部箱子。
+        Map<Integer, WarehouseTransferCarton> originalCartons = transferCartons.listOrder(customerId, transfer.getId())
+            .stream().collect(Collectors.toMap(WarehouseTransferCarton::getCartonIndex, Function.identity()));
         transferCartons.delete(new LambdaQueryWrapper<WarehouseTransferCarton>()
             .eq(WarehouseTransferCarton::getCustomerId, customerId)
-            .eq(WarehouseTransferCarton::getTransferOrderId, transfer.getId()));
+            .eq(WarehouseTransferCarton::getTransferOrderId, transfer.getId())
+            .gt(WarehouseTransferCarton::getCartonIndex, request.packageCount()));
         transferItems.delete(new LambdaQueryWrapper<WarehouseTransferItem>()
             .eq(WarehouseTransferItem::getCustomerId, customerId)
             .eq(WarehouseTransferItem::getTransferOrderId, transfer.getId()));
@@ -369,8 +438,17 @@ public class WarehouseTransferService {
             List<String> customerMarks = splitMarks(source.shippingMark());
             for (int itemCarton = 0; itemCarton < source.packageCount(); itemCarton++) {
                 cartonIndex++;
-                insertTransferCarton(customerId, transfer.getId(), itemId, transferNo, cartonIndex,
-                    request.packageCount(), itemCarton < customerMarks.size() ? customerMarks.get(itemCarton) : null, now);
+                var existingCarton = originalCartons.get(cartonIndex);
+                String customerMark = itemCarton < customerMarks.size() ? customerMarks.get(itemCarton) : null;
+                if (existingCarton == null) {
+                    insertTransferCarton(customerId, transfer.getId(), itemId, transferNo, cartonIndex,
+                        request.packageCount(), customerMark, now, source.cartonMarks() == null ? null : source.cartonMarks().get(itemCarton));
+                } else {
+                    if (source.cartonMarks() != null && !existingCarton.getCartonMark().equals(source.cartonMarks().get(itemCarton))) throw conflict("已保存箱唛不能替换，请重新读取草稿");
+                    existingCarton.setTransferItemId(itemId); existingCarton.setTotalCartons(request.packageCount());
+                    existingCarton.setCustomerCartonMark(customerMark); existingCarton.setUpdatedAt(now);
+                    transferCartons.updateById(existingCarton);
+                }
             }
             insertOrderDetail(customerId, order.getId(), transferNo, index, source, request, now);
         }
@@ -378,12 +456,26 @@ public class WarehouseTransferService {
     }
 
     @Transactional
+    /** 提交草稿前重新校验来源箱归属，防止草稿保存后库存已发生变化。 */
     public WarehouseTransferResponses.Detail submit(String customerId, String transferNo, String operatorId) {
         WarehouseTransferOrder transfer = transfers.lockNo(customerId, transferNo);
         if (transfer == null) throw notFound("Warehouse transfer order not found");
         if (PENDING_REVIEW.equals(transfer.getStatus())) return detail(customerId, transferNo);
         if (!DRAFT.equals(transfer.getStatus())) throw conflict("Only a draft warehouse transfer order can be submitted");
 
+        if (Boolean.TRUE.equals(transfer.getNeedRelabel())) {
+            Set<String> allowedMarks = !transfer.getTransferNo().equals(transfer.getInboundCode())
+                ? sourceCartons(customerId, transfer.getOperatingWarehouseId(), transfer.getInboundCode())
+                    .stream().map(WarehouseTransferResponses.SourceCarton::cartonMark).collect(Collectors.toSet())
+                : transferCartons.listOrder(customerId, transfer.getId()).stream()
+                    .flatMap(carton -> java.util.stream.Stream.of(carton.getCartonMark(), carton.getCustomerCartonMark()))
+                    .filter(StringUtils::hasText).collect(Collectors.toSet());
+            for (var binding : relabelBindings.listOrder(customerId, transfer.getId())) {
+                if (!allowedMarks.contains(binding.getCustomerCartonMark()))
+                    throw badRequest("当前箱子不存在或不属于当前订单");
+            }
+        }
+
         LastlegOrder order = requireTailOrder(customerId, transfer);
         LocalDateTime now = LocalDateTime.now();
         transfer.setStatus(PENDING_REVIEW);
@@ -436,6 +528,7 @@ public class WarehouseTransferService {
             .orderByDesc(WarehouseTransferOrder::getCreatedAt).orderByDesc(WarehouseTransferOrder::getId);
         Page<WarehouseTransferOrder> result = transfers.selectPage(Page.of(query.page(), query.size()), wrapper);
         Map<String, RelabelApplication> relabelApplicationsByNo = relabelApplications(result.getRecords());
+        Map<Long, LocalDateTime> measurementTimes = measurementTimes(result.getRecords());
         List<WarehouseTransferResponses.Summary> records = result.getRecords().stream().map(value ->
             new WarehouseTransferResponses.Summary(value.getId(), value.getTransferNo(), value.getInboundCode(),
                 value.getLastlegOrderId(), value.getLastlegOrderNo(), value.getOperatingWarehouseId(),
@@ -447,7 +540,8 @@ public class WarehouseTransferService {
                 value.getRelabelNo() == null || relabelApplicationsByNo.get(value.getRelabelNo()) == null
                     ? null : relabelApplicationsByNo.get(value.getRelabelNo()).getFulfillmentStatus(),
                 value.getStatus(),
-                value.getEstimatedArrivalAt(), value.getCreatedAt())).toList();
+                value.getEstimatedArrivalAt(), value.getCreatedAt(), value.getReviewedAt(),
+                measurementTimes.get(value.getId()), value.getOutboundAt())).toList();
         return new PageResult<>(records, result.getCurrent(), result.getSize(), result.getTotal(), result.getPages());
     }
 
@@ -531,7 +625,7 @@ public class WarehouseTransferService {
             new LambdaQueryWrapper<WarehouseTransferItem>().eq(WarehouseTransferItem::getCustomerId, customerId)
                 .eq(WarehouseTransferItem::getTransferOrderId, transfer.getId()).orderByAsc(WarehouseTransferItem::getId))
             .stream().map(value -> new WarehouseTransferResponses.Item(value.getId(), value.getSkuCode(), value.getProductNameZh(),
-                value.getPackageCount(), value.getShippingMark())).toList();
+                value.getPackageCount(), value.getShippingMark(), value.getDeclaredQuantity())).toList();
         Map<Long, WarehouseTransferResponses.Item> itemById = items.stream()
             .collect(Collectors.toMap(WarehouseTransferResponses.Item::id, Function.identity()));
         List<WarehouseTransferResponses.SourceOrder> sources = sourceOrders.selectList(
@@ -541,7 +635,7 @@ public class WarehouseTransferService {
                 value.getSourceLastlegOrderNo(), value.getInboundOrderId(), value.getInboundCode())).toList();
         List<WarehouseTransferResponses.Carton> cartons = transferCartons.listOrder(customerId, transfer.getId())
             .stream().map(value -> new WarehouseTransferResponses.Carton(value.getCartonMark(), value.getCustomerCartonMark(),
-                value.getCartonIndex(), value.getTotalCartons(), value.getStatus())).toList();
+                value.getCartonIndex(), value.getTotalCartons(), value.getStatus(), value.getTransferItemId(), value.getTransferPalletId(), value.getLengthCm(), value.getWidthCm(), value.getHeightCm(), value.getGrossWeightKg(), value.getCountedQuantity(), value.getDiscrepancyReason(), value.getCountedBy(), value.getCountedAt(), cartonContents(value))).toList();
         List<WarehouseTransferPalletItem> palletItemRows = transferPalletItems == null
             ? List.of() : transferPalletItems.listOrder(customerId, transfer.getId());
         Map<Long, List<WarehouseTransferPalletItem>> palletItemsByPallet = palletItemRows.stream()
@@ -613,13 +707,20 @@ public class WarehouseTransferService {
             transfer.getCustomerConfirmedAt(), transfer.getOutboundAt(), transfer.getCreatedAt());
     }
 
+    @Transactional(readOnly = true)
+    public WarehouseTransferResponses.Label pdaCartonLabel(long warehouseId, String transferNo) {
+        var transfer = transfers.findNoByWarehouse(transferNo, String.valueOf(warehouseId));
+        if (transfer == null) throw notFound("当前仓没有该转运单");
+        return cartonLabel(transfer.getCustomerId(), transferNo);
+    }
+
+    /** 保存草稿后即可打印整单固定箱唛，测量及未收状态不改变箱号集合。 */
     @Transactional(readOnly = true)
     public WarehouseTransferResponses.Label cartonLabel(String customerId, String transferNo) {
         WarehouseTransferOrder transfer = transfers.findNo(customerId, transferNo);
         if (transfer == null) throw notFound("Warehouse transfer order not found");
-        if (DRAFT.equals(transfer.getStatus())) throw conflict("Submit the warehouse transfer order before printing carton labels");
         List<WarehouseTransferResponses.Carton> cartons = transferCartons.listOrder(customerId, transfer.getId()).stream()
-            .map(value -> new WarehouseTransferResponses.Carton(value.getCartonMark(), value.getCustomerCartonMark(), value.getCartonIndex(), value.getTotalCartons(), value.getStatus())).toList();
+            .map(value -> new WarehouseTransferResponses.Carton(value.getCartonMark(), value.getCustomerCartonMark(), value.getCartonIndex(), value.getTotalCartons(), value.getStatus(), value.getTransferItemId(), value.getTransferPalletId(), value.getLengthCm(), value.getWidthCm(), value.getHeightCm(), value.getGrossWeightKg(), value.getCountedQuantity(), value.getDiscrepancyReason(), value.getCountedBy(), value.getCountedAt(), cartonContents(value))).toList();
         StringBuilder labels = new StringBuilder();
         for (WarehouseTransferResponses.Carton carton : cartons) {
             labels.append("<section class=label><div class=title>仓储转运箱唛</div><div class=mark>")
@@ -695,9 +796,10 @@ public class WarehouseTransferService {
                                                                WarehouseTransferRequests.PalletDraft request) {
         WarehouseTransferOrder transfer = requirePdaMeasuringTransfer(warehouseId, transferNo);
         String customerId = transfer.getCustomerId();
-        validatePalletMeasurement(request.lengthCm(), request.widthCm(), request.heightCm(), request.volumeCbm());
         String requestHash = hash(request);
         List<WarehouseTransferPallet> existing = transferPallets.listOrder(customerId, transfer.getId());
+        if (transferCartons.listOrder(customerId, transfer.getId()).stream().anyMatch(box -> box.getCountedAt() != null))
+            throw conflict("箱子清点已确认，不能再新增或修改托盘");
         WarehouseTransferPallet pallet;
         if (request.palletId() == null) {
             pallet = existing.stream().filter(value -> request.idempotencyKey().equals(value.getDraftIdempotencyKey()))
@@ -716,9 +818,9 @@ public class WarehouseTransferService {
             if (pallet == null) throw notFound("Warehouse transfer pallet draft not found");
             if (!"DRAFT".equals(pallet.getStatus())) throw conflict("Generated pallet measurements are locked");
         }
-        pallet.setCartonCount(request.cartonCount()); pallet.setLengthCm(request.lengthCm());
-        pallet.setWidthCm(request.widthCm()); pallet.setHeightCm(request.heightCm());
-        pallet.setVolumeCbm(request.volumeCbm()); pallet.setGrossWeightKg(request.grossWeightKg());
+        pallet.setCartonCount(0); pallet.setLengthCm(BigDecimal.ZERO);
+        pallet.setWidthCm(BigDecimal.ZERO); pallet.setHeightCm(BigDecimal.ZERO);
+        pallet.setVolumeCbm(BigDecimal.ZERO); pallet.setGrossWeightKg(BigDecimal.ZERO);
         pallet.setDraftIdempotencyKey(request.idempotencyKey()); pallet.setDraftRequestHash(requestHash);
         pallet.setUpdatedAt(LocalDateTime.now()); transferPallets.insertOrUpdate(pallet);
         fleetPool.receiving(customerId, transferNo, pdaOperatorId());
@@ -730,11 +832,24 @@ public class WarehouseTransferService {
         WarehouseTransferOrder transfer = requirePdaMeasuringTransfer(warehouseId, transferNo);
         WarehouseTransferPallet pallet = transferPallets.lockOne(transfer.getCustomerId(), transfer.getId(), palletId);
         if (pallet == null) return detail(transfer.getCustomerId(), transferNo);
-        if (!"DRAFT".equals(pallet.getStatus())) throw conflict("Generated pallet cannot be removed");
+        if (!Set.of("DRAFT", "GENERATED", "BOUND").contains(pallet.getStatus())) throw conflict("当前托盘不能删除");
+        if (pallet.getWarehouseResourceLockId() != null) {
+            warehouseResources.release(transfer.getCustomerId(), pallet.getWarehouseResourceLockId());
+        }
+        transferCartons.unassignPallet(transfer.getCustomerId(), transfer.getId(), palletId);
+        transferCartons.reopenMeasurement(transfer.getCustomerId(), transfer.getId());
         transferPallets.deleteById(palletId);
         return detail(transfer.getCustomerId(), transferNo);
     }
 
+    @Transactional
+    public WarehouseTransferResponses.Detail reopenMeasurement(long warehouseId, String transferNo) {
+        WarehouseTransferOrder transfer = requirePdaMeasuringTransfer(warehouseId, transferNo);
+        // Preserve dimensions, SKU contents and assignments; invalidate the previous count request.
+        transferCartons.reopenMeasurement(transfer.getCustomerId(), transfer.getId());
+        return detail(transfer.getCustomerId(), transferNo);
+    }
+
     @Transactional
     public WarehouseTransferResponses.Detail generatePallet(long warehouseId, String transferNo, long palletId,
                                                               WarehouseTransferRequests.PalletAction request) {
@@ -788,6 +903,137 @@ public class WarehouseTransferService {
         return detail(transfer.getCustomerId(), transferNo);
     }
 
+    /** 保存逐箱实测及托盘归属，按整托汇总体积并保留三位小数。 */
+    @Transactional
+    public WarehouseTransferResponses.Detail countCartons(String operatorId, long warehouseId, String transferNo,
+                                                           WarehouseTransferRequests.CountCartons request) {
+        WarehouseTransferOrder transfer = transfers.lockForPda(transferNo, String.valueOf(warehouseId));
+        if (transfer == null) throw notFound("当前仓没有该转运单");
+        String customerId = transfer.getCustomerId();
+        List<WarehouseTransferCarton> cartons = transferCartons.listOrder(customerId, transfer.getId());
+        // 客户补箱后旧设备快照不可确认短收，必须刷新取得新增的预报箱唛。
+        if (!java.util.Objects.equals(request.forecastPackageCount(), transfer.getPackageCount()))
+            throw conflict("预报箱数已变化，请刷新后继续清点");
+        // PDA只清点客户预报的固定箱唛；不足时由客户补充预报，禁止现场另造编号。
+        if (request.boxes().stream().anyMatch(box -> !StringUtils.hasText(box.cartonMark())))
+            throw badRequest("请先由客户增加预报箱数，刷新取得箱唛后再清点");
+        String requestHash = hash(request);
+        boolean sameKey = cartons.stream().anyMatch(box -> request.idempotencyKey().equals(box.getCountIdempotencyKey()));
+        if (sameKey) {
+            if (cartons.stream().anyMatch(box -> !request.idempotencyKey().equals(box.getCountIdempotencyKey())
+                || !requestHash.equals(box.getCountRequestHash()))) throw conflict("幂等键已用于其他清点内容");
+            return detail(customerId, transferNo);
+        }
+        if (!WAIT_PDA_RECEIVING.equals(transfer.getStatus())) throw conflict("转运单已结束入库测量");
+        if (cartons.stream().anyMatch(box -> box.getCountedAt() != null)) throw conflict("本单已完成清点，请刷新查看结果");
+        if (cartons.isEmpty()) throw conflict("转运单缺少箱号预报");
+        // 清点阶段只记录实收事实，差异原因在最终完成测量时强制填写。
+        Map<String, WarehouseTransferCarton> byMark = cartons.stream().collect(Collectors.toMap(WarehouseTransferCarton::getCartonMark, Function.identity()));
+        Map<Long, WarehouseTransferItem> byItem = transferItems.selectList(new LambdaQueryWrapper<WarehouseTransferItem>()
+            .eq(WarehouseTransferItem::getCustomerId, customerId).eq(WarehouseTransferItem::getTransferOrderId, transfer.getId()))
+            .stream().collect(Collectors.toMap(WarehouseTransferItem::getId, Function.identity()));
+        List<WarehouseTransferPallet> countedPallets = transferPallets.listOrder(customerId, transfer.getId());
+        if (countedPallets.stream().anyMatch(pallet -> request.boxes().stream().noneMatch(box -> pallet.getId().equals(box.transferPalletId()))))
+            throw badRequest("每个托盘必须至少分配一个实收箱，请核对箱子所属托盘");
+        Map<Long, WarehouseTransferPallet> byPallet = countedPallets.stream().collect(Collectors.toMap(WarehouseTransferPallet::getId, Function.identity()));
+        Set<String> seen = new java.util.HashSet<>();
+        for (var input : request.boxes()) {
+            var targetPallet = byPallet.get(input.transferPalletId());
+            if (targetPallet == null || targetPallet.getWarehousePalletId() == null
+                || !Set.of("GENERATED", "BOUND").contains(targetPallet.getStatus()))
+                throw badRequest("请先创建本单托盘号，再选择箱子所属托盘");
+            var carton = byMark.get(input.cartonMark());
+            if (carton == null || !seen.add(input.cartonMark()))
+                throw badRequest("箱号不属于本单或重复填写");
+            if (input.items() == null || input.items().isEmpty() || input.items().size() > 200)
+                throw badRequest("每箱必须填写 1 至 200 行 SKU");
+            Set<String> skuCodes = new java.util.HashSet<>();
+            for (var line : input.items()) {
+                if (line == null || !StringUtils.hasText(line.skuCode())
+                    || byItem.values().stream().noneMatch(declared -> declared.getSkuCode().equals(line.skuCode()))
+                    || !skuCodes.add(line.skuCode())) throw badRequest("箱内 SKU 必须来自本单预报，同箱不能重复");
+                if (line.quantity() <= 0 || line.quantity() > Integer.MAX_VALUE) throw badRequest("每行 SKU 必须填写有效实点件数");
+            }
+            // 箱内实际SKU以PDA清点为准，允许混箱或调整，仍须属于当前单预报。
+            if (input.length() == null || input.width() == null
+                || input.height() == null || input.weight() == null || input.length().signum() <= 0 || input.width().signum() <= 0
+                || input.height().signum() <= 0 || input.weight().signum() <= 0) throw badRequest("每箱必须填写有效尺寸、重量和实点件数");
+        }
+        LocalDateTime now = LocalDateTime.now();
+        for (var carton : cartons) {
+            if (seen.contains(carton.getCartonMark())) continue;
+            carton.setStatus("NOT_RECEIVED"); carton.setCountedAt(now); carton.setCountedBy(operatorId);
+            carton.setCountIdempotencyKey(request.idempotencyKey()); carton.setCountRequestHash(requestHash);
+            carton.setDiscrepancyReason(trim(request.discrepancyReason())); carton.setUpdatedAt(now); transferCartons.updateById(carton);
+        }
+        for (var input : request.boxes()) {
+            var carton = byMark.get(input.cartonMark());
+            carton.setTransferPalletId(input.transferPalletId());
+            carton.setLengthCm(input.length()); carton.setWidthCm(input.width()); carton.setHeightCm(input.height());
+            carton.setGrossWeightKg(input.weight());
+            carton.setCountedQuantity(input.items().stream().mapToLong(WarehouseTransferRequests.CountSku::quantity).sum());
+            List<WarehouseTransferResponses.CartonItem> contents = input.items().stream().map(line -> {
+                var declared = byItem.values().stream().filter(value -> value.getSkuCode().equals(line.skuCode())).findFirst().orElseThrow();
+                return new WarehouseTransferResponses.CartonItem(declared.getId(), line.skuCode(), line.quantity());
+            }).toList();
+            carton.setTransferItemId(contents.get(0).transferItemId());
+            try { carton.setSkuItemsJson(objectMapper.writeValueAsString(contents)); }
+            catch (com.fasterxml.jackson.core.JsonProcessingException e) { throw new IllegalStateException("Cannot serialize carton contents", e); }
+            carton.setCountedBy(operatorId); carton.setCountedAt(now); carton.setStatus("COUNTED");
+            carton.setCountIdempotencyKey(request.idempotencyKey()); carton.setCountRequestHash(requestHash); carton.setUpdatedAt(now);
+            carton.setDiscrepancyReason(trim(request.discrepancyReason()));
+            transferCartons.updateById(carton);
+        }
+        // 仅汇总实际分配到本托的实收箱，体积在整托汇总后四舍五入保存三位，避免逐箱舍入累积误差。
+        for (var pallet : countedPallets) {
+            var assigned = request.boxes().stream().filter(box -> pallet.getId().equals(box.transferPalletId())).toList();
+            pallet.setCartonCount(assigned.size());
+            pallet.setVolumeCbm(assigned.stream().map(box -> box.length().multiply(box.width()).multiply(box.height())
+                .movePointLeft(6)).reduce(BigDecimal.ZERO, BigDecimal::add).setScale(3, java.math.RoundingMode.HALF_UP));
+            pallet.setGrossWeightKg(assigned.stream().map(WarehouseTransferRequests.CountCarton::weight).reduce(BigDecimal.ZERO, BigDecimal::add));
+            pallet.setUpdatedAt(now); transferPallets.updateById(pallet);
+        }
+        return detail(customerId, transferNo);
+    }
+
+    private List<WarehouseTransferResponses.CartonItem> cartonContents(WarehouseTransferCarton carton) {
+        if (!StringUtils.hasText(carton.getSkuItemsJson())) return List.of();
+        try {
+            return objectMapper.readValue(carton.getSkuItemsJson(),
+                new com.fasterxml.jackson.core.type.TypeReference<List<WarehouseTransferResponses.CartonItem>>() {});
+        } catch (com.fasterxml.jackson.core.JsonProcessingException e) {
+            throw new IllegalStateException("Invalid persisted carton contents", e);
+        }
+    }
+
+    /** 按 SKU 汇总预报及实收件数；混箱逐项累计，兼容原单 SKU 箱记录。 */
+    boolean hasSkuReceiptDifference(List<WarehouseTransferCarton> cartons, List<WarehouseTransferItem> items) {
+        Map<String, Long> expected = new java.util.HashMap<>();
+        Map<String, Long> received = new java.util.HashMap<>();
+        Map<Long, WarehouseTransferItem> byId = items.stream().collect(Collectors.toMap(WarehouseTransferItem::getId, Function.identity()));
+        for (var item : items) expected.merge(item.getSkuCode(), item.getDeclaredQuantity() == null ? 0L : item.getDeclaredQuantity(), Long::sum);
+        for (var carton : cartons) {
+            var contents = cartonContents(carton);
+            if (contents.isEmpty()) {
+                var item = byId.get(carton.getTransferItemId());
+                if (item == null) throw conflict("实收箱缺少有效SKU归属，请重新清点");
+                received.merge(item.getSkuCode(), carton.getCountedQuantity() == null ? 0L : carton.getCountedQuantity(), Long::sum);
+            } else {
+                for (var line : contents) received.merge(line.skuCode(), line.quantity(), Long::sum);
+            }
+        }
+        return expected.entrySet().stream().anyMatch(entry -> !entry.getValue().equals(received.getOrDefault(entry.getKey(), 0L)))
+            || received.entrySet().stream().anyMatch(entry -> !entry.getValue().equals(expected.getOrDefault(entry.getKey(), 0L)));
+    }
+
+    private List<WarehouseTransferCarton> requireCountedCartons(WarehouseTransferOrder transfer) {
+        var cartons = transferCartons.listOrder(transfer.getCustomerId(), transfer.getId());
+        if (cartons.isEmpty() || cartons.stream().anyMatch(box -> box.getCountedAt() == null)
+            || cartons.stream().noneMatch(box -> "COUNTED".equals(box.getStatus())))
+            throw conflict("请先完成全部箱子的尺寸测量和箱内清点");
+        return cartons.stream().filter(box -> "COUNTED".equals(box.getStatus())).toList();
+    }
+
     private WarehouseTransferOrder requirePdaMeasuringTransfer(long warehouseId, String transferNo) {
         WarehouseTransferOrder transfer = transfers.lockForPda(transferNo, String.valueOf(warehouseId));
         if (transfer == null) throw notFound("Warehouse transfer order not found");
@@ -803,6 +1049,7 @@ public class WarehouseTransferService {
         }
     }
 
+    /** 核对清点、照片、托盘及差异说明，在同一事务内完成测量并入库。 */
     @Transactional
     public WarehouseTransferResponses.Detail palletize(String operatorId, long overseasWarehouseId,
                                                         String transferNo,
@@ -824,12 +1071,20 @@ public class WarehouseTransferService {
         if (!WAIT_PDA_RECEIVING.equals(transfer.getStatus())) {
             throw conflict("Warehouse transfer is not awaiting PDA receiving");
         }
+        List<WarehouseTransferCarton> countedCartons = requireCountedCartons(transfer);
         List<WarehouseTransferItem> items = transferItems.selectList(new LambdaQueryWrapper<WarehouseTransferItem>()
             .eq(WarehouseTransferItem::getCustomerId, customerId)
             .eq(WarehouseTransferItem::getTransferOrderId, transfer.getId()).orderByAsc(WarehouseTransferItem::getId));
         if (items.isEmpty() || items.stream().mapToInt(WarehouseTransferItem::getPackageCount).sum() != transfer.getPackageCount()) {
             throw conflict("Warehouse transfer declared cargo is incomplete");
         }
+        // 按每种 SKU 的件数核对实收，箱数变化不触发，不同 SKU 的差异不能抵消。
+        boolean skuDifference = hasSkuReceiptDifference(countedCartons, items);
+        String discrepancyReason = skuDifference ? trim(request.discrepancyReason()) : null;
+        if (skuDifference && !StringUtils.hasText(discrepancyReason))
+            throw badRequest("SKU实收件数与预报不一致时必须填写差异原因");
+        if (discrepancyReason != null && discrepancyReason.length() > 1000)
+            throw badRequest("差异原因不能超过1000字");
         if (request.photoFileIds() == null || request.photoFileIds().isEmpty() || request.photoFileIds().size() > 20) {
             throw conflict("Measurement and palletization require 1 to 20 on-site photos");
         }
@@ -844,10 +1099,14 @@ public class WarehouseTransferService {
         if (persistedPallets.isEmpty() || persistedPallets.stream().anyMatch(value -> !"BOUND".equals(value.getStatus()))) {
             throw conflict("Every pallet must be generated and scan-bound before completing palletization");
         }
+        if (persistedPallets.stream().anyMatch(pallet -> pallet.getCartonCount() == null || pallet.getCartonCount() <= 0)) throw conflict("每个托盘必须至少分配一个实收箱");
         int palletCartons = persistedPallets.stream().mapToInt(WarehouseTransferPallet::getCartonCount).sum();
-        List<DerivedPalletAllocation> derivedAllocations = derivePersistedPalletAllocations(items, persistedPallets);
+        if (palletCartons != countedCartons.size()) throw conflict("打托箱数必须与已清点实收箱数一致");
+        List<DerivedPalletAllocation> derivedAllocations = deriveCountedPalletAllocations(countedCartons, persistedPallets);
         LocalDateTime now = LocalDateTime.now();
         List<WarehouseTransferPalletItem> completedPalletItems = new ArrayList<>();
+        // 与测量完成处于同一事务；短收箱与实收箱保持同一说明，供详情回显。
+        transferMeasurementRepository.saveDiscrepancyReason(customerId, transfer.getId(), discrepancyReason);
         for (int index = 0; index < persistedPallets.size(); index++) {
             WarehouseTransferPallet pallet = persistedPallets.get(index);
             for (DerivedPalletAllocation allocation : derivedAllocations) {
@@ -1328,10 +1587,17 @@ public class WarehouseTransferService {
                 relabel == null ? null : relabel.getStatus(),
                 relabel == null ? null : relabel.getFulfillmentStatus(),
                 value.getStatus(),
-                value.getEstimatedArrivalAt(), value.getCreatedAt());
+                value.getEstimatedArrivalAt(), value.getCreatedAt(), value.getReviewedAt(), null, value.getOutboundAt());
         }).toList();
     }
 
+    private Map<Long, LocalDateTime> measurementTimes(List<WarehouseTransferOrder> transferOrders) {
+        if (transferOrders.isEmpty()) return Map.of();
+        return transferPallets.measurementTimes(transferOrders.stream().map(WarehouseTransferOrder::getId).toList())
+            .stream().collect(Collectors.toMap(WarehouseTransferPalletMapper.MeasurementTime::transferOrderId,
+                WarehouseTransferPalletMapper.MeasurementTime::measuredAt));
+    }
+
     private Map<String, RelabelApplication> relabelApplications(List<WarehouseTransferOrder> transferOrders) {
         Set<String> relabelNos = transferOrders.stream().map(WarehouseTransferOrder::getRelabelNo)
             .filter(StringUtils::hasText).collect(Collectors.toSet());
@@ -1451,29 +1717,20 @@ public class WarehouseTransferService {
         return result;
     }
 
-    static List<DerivedPalletAllocation> derivePersistedPalletAllocations(List<WarehouseTransferItem> items,
-                                                                           List<WarehouseTransferPallet> pallets) {
-        if (items == null || items.isEmpty()) throw conflict("Warehouse transfer declared cargo is incomplete");
+    static List<DerivedPalletAllocation> deriveCountedPalletAllocations(List<WarehouseTransferCarton> cartons,
+                                                                         List<WarehouseTransferPallet> pallets) {
         List<DerivedPalletAllocation> result = new ArrayList<>();
-        int itemIndex = 0;
-        int itemRemaining = items.get(0).getPackageCount();
-        for (int palletIndex = 0; palletIndex < pallets.size(); palletIndex++) {
-            int palletRemaining = pallets.get(palletIndex).getCartonCount();
-            while (palletRemaining > 0) {
-                WarehouseTransferItem item = items.get(itemIndex);
-                if (itemIndex + 1 == items.size()) {
-                    result.add(new DerivedPalletAllocation(palletIndex, item.getId(), palletRemaining));
-                    break;
-                }
-                int allocated = Math.min(palletRemaining, itemRemaining);
-                result.add(new DerivedPalletAllocation(palletIndex, item.getId(), allocated));
-                palletRemaining -= allocated;
-                itemRemaining -= allocated;
-                if (itemRemaining == 0 && itemIndex + 1 < items.size()) {
-                    itemIndex++;
-                    itemRemaining = items.get(itemIndex).getPackageCount();
-                }
-            }
+        Set<Long> palletIds = pallets.stream().map(WarehouseTransferPallet::getId).collect(Collectors.toSet());
+        if (cartons.stream().anyMatch(box -> box.getTransferPalletId() == null || !palletIds.contains(box.getTransferPalletId())))
+            throw conflict("每个实收箱必须分配到本单托盘");
+        for (int index = 0; index < pallets.size(); index++) {
+            var pallet = pallets.get(index);
+            Map<Long, Integer> quantities = new java.util.LinkedHashMap<>();
+            cartons.stream().filter(box -> pallet.getId().equals(box.getTransferPalletId()))
+                .forEach(box -> quantities.merge(box.getTransferItemId(), 1, Integer::sum));
+            if (quantities.values().stream().mapToInt(Integer::intValue).sum() != pallet.getCartonCount())
+                throw conflict("托盘箱数与分配的实收箱不一致");
+            for (var entry : quantities.entrySet()) result.add(new DerivedPalletAllocation(index, entry.getKey(), entry.getValue()));
         }
         return result;
     }
@@ -1508,15 +1765,6 @@ public class WarehouseTransferService {
         }
     }
 
-    private static void validateTransferDestinationRequired(String destinationType, String fbaWarehouseCode,
-                                                            boolean allowDeferredForRelabel) {
-        String type = trim(destinationType);
-        if (type == null && StringUtils.hasText(fbaWarehouseCode)) type = "FBA";
-        if ((type == null || "NONE".equalsIgnoreCase(type)) && !allowDeferredForRelabel) {
-            throw badRequest("仓储转运必须选择 FBA 仓或私人仓");
-        }
-    }
-
     private static void applyDestination(WarehouseTransferOrder transfer, WarehouseTransferRequests.Create request) {
         String type = trim(request.destinationType());
         if (type == null && StringUtils.hasText(request.fbaWarehouseCode())) type = "FBA";
@@ -1602,7 +1850,8 @@ public class WarehouseTransferService {
         }
     }
 
-    private void validateRelabelRequest(WarehouseTransferRequests.Create request) {
+    /** 校验换标资料及箱唛归属，退货来源同样按当前可用箱校验。 */
+    private void validateRelabelRequest(String customerId, WarehouseTransferRequests.Create request) {
         if (!request.needRelabel()) {
             if (request.relabelItems() != null && !request.relabelItems().isEmpty()) {
                 throw badRequest("Relabel items require needRelabel=true");
@@ -1610,6 +1859,14 @@ public class WarehouseTransferService {
             return;
         }
         if (request.relabelItems() == null || request.relabelItems().isEmpty()) return;
+        Set<String> orderCartonMarks = StringUtils.hasText(request.inboundCode())
+            ? sourceCartons(customerId, request.operatingWarehouseId().trim(), request.inboundCode().trim())
+                .stream().map(WarehouseTransferResponses.SourceCarton::cartonMark)
+                .filter(StringUtils::hasText).map(String::trim).collect(Collectors.toSet())
+            : request.items().stream().flatMap(item -> splitMarks(item.shippingMark()).stream()).collect(Collectors.toSet());
+        if (!StringUtils.hasText(request.inboundCode()) && orderCartonMarks.isEmpty()) {
+            orderCartonMarks.addAll(splitMarks(request.fbaBoxNos()));
+        }
         if (request.labelDeadline() == null || !StringUtils.hasText(request.relabelContactName())
             || !StringUtils.hasText(request.relabelContactPhone())) {
             throw badRequest("Relabel deadline and contact are required");
@@ -1644,6 +1901,7 @@ public class WarehouseTransferService {
                 throw badRequest("SKU relabel requires a new SKU");
             }
             for (String mark : row.customerCartonMarks()) {
+                if (!orderCartonMarks.contains(mark.trim())) throw badRequest("当前箱子不存在或不属于当前订单");
                 if (!marks.add(mark.trim().toUpperCase())) throw badRequest("Customer carton marks must be unique");
             }
         }
@@ -1804,18 +2062,17 @@ public class WarehouseTransferService {
             pallet.setWarehouseResourceLockId(source.getWarehouseResourceLockId()); pallet.setAssignmentStatus("ASSIGNED");
             pallet.setLockedAt(source.getCompletedAt()); pallet.setActualVolumeCbm(source.getVolumeCbm());
             pallet.setActualPackageCount(source.getCartonCount()); inboundPlanPallets.insert(pallet);
-            for (WarehouseTransferPalletItem sourceItem : palletItems.stream()
-                .filter(row -> row.getTransferPalletId().equals(source.getId())).toList()) {
-                InboundPlanPalletAllocation allocation = new InboundPlanPalletAllocation(); allocation.setId(IdWorker.getId());
-                allocation.setCustomerId(customerId); allocation.setPlanId(plan.getId()); allocation.setLineId(line.getId());
-                allocation.setPalletId(pallet.getId()); allocation.setAllocatedVolumeCbm(BigDecimal.ZERO);
-                allocation.setPlannedPackageCount(sourceItem.getPackageCount()); allocation.setCountedPackageCount(sourceItem.getPackageCount());
-                // PDA 已完成测量、打托并确认了本托箱数；入仓计划列表的“实际拣货数”
-                // 直接汇总该字段，不能再保留初始化时的 0。
-                allocation.setPickedPackageCount(sourceItem.getPackageCount());
-                allocation.setActualVolumeCbm(source.getVolumeCbm());
-                allocation.setStatus("COMPLETED"); allocation.setVersion(0); inboundPlanAllocations.insert(allocation);
-            }
+            // Plan allocations are unique by inbound line + pallet. SKU breakdown
+            // belongs to transfer pallet items and must not duplicate that allocation.
+            int receivedPackages = palletItems.stream().filter(row -> row.getTransferPalletId().equals(source.getId()))
+                .mapToInt(WarehouseTransferPalletItem::getPackageCount).sum();
+            if (receivedPackages != source.getCartonCount()) throw conflict("托盘明细箱数与实收不一致");
+            InboundPlanPalletAllocation allocation = new InboundPlanPalletAllocation(); allocation.setId(IdWorker.getId());
+            allocation.setCustomerId(customerId); allocation.setPlanId(plan.getId()); allocation.setLineId(line.getId());
+            allocation.setPalletId(pallet.getId()); allocation.setAllocatedVolumeCbm(BigDecimal.ZERO);
+            allocation.setPlannedPackageCount(receivedPackages); allocation.setCountedPackageCount(receivedPackages);
+            allocation.setPickedPackageCount(receivedPackages); allocation.setActualVolumeCbm(source.getVolumeCbm());
+            allocation.setStatus("COMPLETED"); allocation.setVersion(0); inboundPlanAllocations.insert(allocation);
         }
         plan.setAssignedFlag(true); plan.setStatus("COMPLETED"); plan.setPalletCount(pallets.size());
         plan.setTotalVolumeCbm(pallets.stream().map(WarehouseTransferPallet::getVolumeCbm)
@@ -1860,7 +2117,7 @@ public class WarehouseTransferService {
     private LastlegOrder createTailOrder(String customerId, String customerName, Long inboundOrderId, String inboundCode, String transferNo,
                                          WarehouseTransferRequests.Create request, String requestHash, LocalDateTime now) {
         LastlegOrder order = new LastlegOrder();
-        order.setId(IdWorker.getId()); order.setOrderNo(orderNoGenerator.next("TRANSFER", request.operatingWarehouseId(), order.getId())); order.setCustomerId(customerId);
+        order.setId(IdWorker.getId()); order.setOrderNo(transferNo); order.setCustomerId(customerId);
         order.setCustomerName(customerName);
         order.setOrderType(ORDER_TYPE);
         order.setInboundCode(inboundCode); order.setSourceRegion("CUSTOMER");
@@ -1870,7 +2127,7 @@ public class WarehouseTransferService {
         order.setVolumeCbm(request.volumeCbm());
         order.setContainerNo(transferNo);
         order.setPalletCount(0); order.setPickedPackageCount(0); order.setShippedPackageCount(0);
-        order.setEstimatedWarehouseAt(request.estimatedArrivalAt());
+        order.setEstimatedWarehouseAt(arrivalTime(request));
         order.setCurrentStatus(DRAFT);
         order.setRelabelStatus(request.needRelabel() ? "PENDING_BINDING" : "NOT_REQUIRED");
         order.setSubOrderStatus("WAREHOUSE_TRANSFER:" + DRAFT + ";RELABEL:" + order.getRelabelStatus());
@@ -1881,12 +2138,24 @@ public class WarehouseTransferService {
         return order;
     }
 
+    private void validatePrintedCartonMarks(WarehouseTransferRequests.Create request) {
+        Set<String> marks = new java.util.HashSet<>();
+        for (var item : request.items()) {
+            if (item.cartonMarks() == null) continue;
+            if (item.cartonMarks().size() != item.packageCount()) throw badRequest("已生成箱唛数量必须等于预报箱数，请重新打印");
+            for (String mark : item.cartonMarks()) {
+                if (mark == null || !mark.matches("BX-[A-Z0-9]{1,40}") || !marks.add(mark)) throw badRequest("已生成箱唛格式错误或重复，请重新打印");
+            }
+        }
+    }
+
     private long insertTransferItem(String customerId, long transferId, WarehouseTransferRequests.Item source,
                                     LocalDateTime now) {
         WarehouseTransferItem item = new WarehouseTransferItem();
         item.setId(IdWorker.getId()); item.setTransferOrderId(transferId); item.setCustomerId(customerId);
         item.setSkuCode(Objects.toString(trim(source.skuCode()), "UNSPECIFIED"));
         item.setProductNameZh(Objects.toString(trim(source.productNameZh()), "仓储转运货物"));
+        item.setDeclaredQuantity(source.quantity());
         item.setPackageCount(source.packageCount()); item.setShippingMark(trim(source.shippingMark())); item.setCreatedAt(now);
         transferItems.insert(item);
         return item.getId();
@@ -1894,10 +2163,10 @@ public class WarehouseTransferService {
 
     private void insertTransferCarton(String customerId, long transferId, long transferItemId,
                                       String transferNo, int cartonIndex, int totalCartons,
-                                      String customerCartonMark, LocalDateTime now) {
+                                      String customerCartonMark, LocalDateTime now, String printedMark) {
         WarehouseTransferCarton carton = new WarehouseTransferCarton();
         carton.setId(IdWorker.getId()); carton.setTransferOrderId(transferId); carton.setTransferItemId(transferItemId);
-        carton.setCustomerId(customerId); carton.setCartonMark(transferNo + "#" + totalCartons + "-" + cartonIndex);
+        carton.setCustomerId(customerId); carton.setCartonMark(printedMark == null ? LastlegOrderNoGenerator.compactCartonMark(carton.getId()) : printedMark);
         carton.setCustomerCartonMark(trim(customerCartonMark));
         carton.setCartonIndex(cartonIndex); carton.setTotalCartons(totalCartons); carton.setStatus("EXPECTED");
         carton.setCreatedAt(now); carton.setUpdatedAt(now); transferCartons.insert(carton);
@@ -1910,7 +2179,7 @@ public class WarehouseTransferService {
         detail.setOrderId(orderId); detail.setSourceInboundDetailId(transferNo + ":" + index);
         detail.setSkuCode(trim(source.skuCode())); detail.setProductNameZh(trim(source.productNameZh()));
         detail.setPackageCount(source.packageCount()); detail.setDestinationWarehouseCode(destinationCode(request));
-        detail.setFbaTrackingNo("CUSTOMER_DELIVERY".equals(request.deliveryMethod().trim())
+        detail.setFbaTrackingNo("CUSTOMER_DELIVERY".equals(inboundMethod(request))
             ? trim(request.trackingNo()) : null);
         detail.setShipmentNo(trim(request.fbaShipmentNo()));
         detail.setShippingMark(trim(source.shippingMark())); orderDetails.insert(detail);
@@ -1948,6 +2217,10 @@ public class WarehouseTransferService {
         return auth == null ? null : auth.getName();
     }
     private static String trim(String value) { return StringUtils.hasText(value) ? value.trim() : null; }
+    /** 根据独立前缀识别退货来源，避免与普通入仓码混淆。 */
+    private static boolean isReturnOrderSource(String value) { return StringUtils.hasText(value) && value.trim().startsWith(RETURN_ORDER_PREFIX); }
+    /** 从转运来源编码提取真实退货单号。 */
+    private static String returnNoFromSource(String value) { return value.trim().substring(RETURN_ORDER_PREFIX.length()).trim(); }
     private static String firstText(String first, String second) { return StringUtils.hasText(first) ? first.trim() : trim(second); }
     private static long packages(Long value) { return value == null ? 0L : value; }
     private static ResponseStatusException badRequest(String message) { return new ResponseStatusException(HttpStatus.BAD_REQUEST, message); }
diff --git a/lastleg-service/src/main/resources/application.yml b/lastleg-service/src/main/resources/application.yml
index 21524c7a4..e8c1bb6c9 100644
--- a/lastleg-service/src/main/resources/application.yml
+++ b/lastleg-service/src/main/resources/application.yml
@@ -46,6 +46,18 @@ lastleg:
     enabled: ${LASTLEG_SMART_DISPATCH_API_ENABLED:true}
 
 baiyue:
+  self-operated-analytics:
+    collection-mode: ${SELFOP_COLLECTION_MODE:OFF}
+    continuous-business-collection-enabled: ${SELFOP_CONTINUOUS_BUSINESS_COLLECTION_ENABLED:false}
+    environment: ${DEPLOY_ENV:test}
+    daily-request-budget: ${SELFOP_DAILY_REQUEST_BUDGET:0}
+    business-min-request-interval-ms: ${SELFOP_MIN_REQUEST_INTERVAL_MS:5000}
+    sales-publication-enabled: ${SELFOP_SALES_PUBLICATION_ENABLED:false}
+    integration-base-url: http://integration-service:9210
+    internal-service-token: ${INTERNAL_SERVICE_TOKEN:}
+    source-account: ${SELFOP_SOURCE_ACCOUNT:lingxing-primary}
+    source-query-timezone: Asia/Shanghai
+    quantity-unit: PCS
   http:
     clients:
       unload-photo-file:
diff --git a/lastleg-service/src/main/resources/db/appointment-receiving.sql b/lastleg-service/src/main/resources/db/appointment-receiving.sql
new file mode 100644
index 000000000..a05355ee1
--- /dev/null
+++ b/lastleg-service/src/main/resources/db/appointment-receiving.sql
@@ -0,0 +1,49 @@
+-- V13 receiving coverage and pending changes; baseline only, no test data migration.
+CREATE TABLE IF NOT EXISTS ll_fba_receiving_agreement (
+  agreement_key VARCHAR(64) NOT NULL COMMENT '收货预约独立业务键',
+  version INT NOT NULL COMMENT '预约覆盖范围与确认资料版本',
+  status VARCHAR(24) NOT NULL COMMENT '有效、取消或已替代状态',
+  destination_key VARCHAR(128) NOT NULL COMMENT '权威目的仓关联键',
+  confirmation_no VARCHAR(128) NULL COMMENT '当前有效外部约号，失效后清空以释放覆盖',
+  snapshot_json LONGTEXT NOT NULL COMMENT '客户逐来源覆盖、确认时区及仓库依据快照',
+  PRIMARY KEY (agreement_key),
+  UNIQUE KEY uk_fba_receiving_confirmation (destination_key, confirmation_no)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci COMMENT='独立于送货批次的收货预约';
+
+CREATE TABLE IF NOT EXISTS ll_fba_receiving_member (
+  agreement_key VARCHAR(64) NOT NULL COMMENT '所属收货预约业务键',
+  batch_key VARCHAR(128) NOT NULL COMMENT '稳定送货批次键',
+  customer_id VARCHAR(128) NOT NULL COMMENT '货物所属客户标识',
+  active_ref VARCHAR(260) NULL COMMENT '有效批次与客户唯一引用，退出后清空且历史保留',
+  PRIMARY KEY (agreement_key,batch_key,customer_id),
+  UNIQUE KEY uk_fba_receiving_active_member (active_ref),
+  KEY idx_fba_receiving_batch (batch_key,customer_id)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci COMMENT='收货预约当前覆盖关联及退出历史';
+
+CREATE TABLE IF NOT EXISTS ll_fba_receiving_change (
+  change_key VARCHAR(64) NOT NULL COMMENT '客户预约变化业务键',
+  version INT NOT NULL COMMENT '变化续办版本',
+  status VARCHAR(24) NOT NULL COMMENT '待仓库确认、已应用或已撤回状态',
+  batch_key VARCHAR(128) NOT NULL COMMENT '受影响原送货批次键',
+  customer_id VARCHAR(128) NOT NULL COMMENT '本次变化所属客户',
+  snapshot_json LONGTEXT NOT NULL COMMENT '原覆盖快照、逐来源拟保留量、负责人及跟进资料',
+  result_json LONGTEXT NULL COMMENT '确认后的实际批次去向及逐步骤结果',
+  active_ref VARCHAR(260) NULL COMMENT '同批同客户唯一未解决变化引用',
+  PRIMARY KEY (change_key),
+  UNIQUE KEY uk_fba_receiving_pending (active_ref),
+  KEY idx_fba_receiving_pending_batch (batch_key,status)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci COMMENT='保留原安排且阻止误发车的客户变化';
+
+CREATE TABLE IF NOT EXISTS ll_fba_receiving_revision (
+  agreement_key VARCHAR(64) NOT NULL COMMENT '收货预约业务键',
+  version INT NOT NULL COMMENT '不可变覆盖与确认版本',
+  snapshot_json LONGTEXT NOT NULL COMMENT '该版本完整客户覆盖、确认时段及回复依据',
+  PRIMARY KEY (agreement_key,version)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci COMMENT='收货预约覆盖与确认不可变历史';
+
+CREATE TABLE IF NOT EXISTS ll_fba_receiving_plan (
+  batch_key VARCHAR(128) NOT NULL COMMENT '稳定送货批次键',
+  customer_id VARCHAR(128) NOT NULL COMMENT '计划所属客户标识',
+  snapshot_json LONGTEXT NOT NULL COMMENT '本客户未确认计划、目标窗口及业务时区，不含有效预约确认',
+  PRIMARY KEY (batch_key,customer_id)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci COMMENT='按批次及客户保存的未确认收货计划';
diff --git a/lastleg-service/src/main/resources/db/appointment-work.sql b/lastleg-service/src/main/resources/db/appointment-work.sql
new file mode 100644
index 000000000..3db17dc47
--- /dev/null
+++ b/lastleg-service/src/main/resources/db/appointment-work.sql
@@ -0,0 +1,59 @@
+-- DDL proposal only. The coordinator must integrate the approved baseline; do not execute from this task.
+CREATE TABLE IF NOT EXISTS ll_dispatch_appointment_allocation (
+  dispatch_id BIGINT NOT NULL COMMENT '排车单标识',
+  dispatch_item_id BIGINT NOT NULL COMMENT '排车明细标识',
+  plan_pallet_id BIGINT NOT NULL COMMENT '入仓计划托盘标识',
+  batch_key VARCHAR(96) NOT NULL COMMENT '预约稳定批次键',
+  customer_id VARCHAR(64) NOT NULL COMMENT '所属客户标识',
+  source_key VARCHAR(160) NOT NULL COMMENT '货物来源稳定键',
+  destination_key VARCHAR(160) NOT NULL COMMENT '目的地稳定键',
+  package_count INT NOT NULL COMMENT '本票分配实物箱数',
+  PRIMARY KEY(dispatch_item_id,batch_key,source_key,destination_key),
+  KEY idx_dispatch_appointment_batch(batch_key,customer_id),
+  KEY idx_dispatch_appointment_dispatch(dispatch_id)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci COMMENT='排车实物与预约批次逐票分配，原执行域事实';
+CREATE TABLE IF NOT EXISTS ll_appointment_work_commitment (
+  entity_key VARCHAR(160) NOT NULL COMMENT '原业务实体稳定键',
+  state_json LONGTEXT NOT NULL COMMENT '原业务命令产生的只读语义影响基线，不是第二份可编辑计划',
+  impact_version BIGINT NOT NULL DEFAULT 0 COMMENT '承诺影响单调递增版本',
+  PRIMARY KEY (entity_key)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci COMMENT='工作事项承诺影响审计基线';
+CREATE TABLE IF NOT EXISTS ll_appointment_work_guard (
+  id INT NOT NULL COMMENT '工作事项协调锁，固定1',
+  scan_cursor VARCHAR(128) NULL COMMENT '已开船来源同步游标',
+  initialized BOOLEAN NOT NULL DEFAULT FALSE COMMENT '是否完成首次完整来源扫描',
+  scope_version VARCHAR(128) NULL COMMENT '完整同步已确认的权威来源集合版本',
+  scan_scope_version VARCHAR(128) NULL COMMENT '当前扫描来源集合版本，防跨页漂移',
+  completed_at DATETIME(3) NULL COMMENT '最近完整同步UTC时间',
+  requirement_version BIGINT NOT NULL DEFAULT 0 COMMENT '原域命令在同一事务推进的需求版本',
+  synchronized_requirement_version BIGINT NOT NULL DEFAULT 0 COMMENT '完整扫描已消费需求版本',
+  scan_requirement_version BIGINT NOT NULL DEFAULT 0 COMMENT '当前扫描需求版本，防跨页漂移',
+  PRIMARY KEY (id)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci COMMENT='预约工作事项同步与命令串行守卫';
+INSERT INTO ll_appointment_work_guard(id,initialized) SELECT 1,FALSE WHERE NOT EXISTS(SELECT 1 FROM ll_appointment_work_guard WHERE id=1);
+
+CREATE TABLE IF NOT EXISTS ll_appointment_work (
+  work_item_key VARCHAR(96) NOT NULL COMMENT '不可变事项键，业务身份确定性生成',
+  container_booking_id VARCHAR(64) NOT NULL COMMENT '来源柜次内部关联标识，不作展示编号',
+  version INT NOT NULL DEFAULT 0 COMMENT '工作命令乐观锁版本',
+  retired BOOLEAN NOT NULL DEFAULT FALSE COMMENT '已替代或已完成路线需求，不计活动工作',
+  state_json LONGTEXT NOT NULL COMMENT '工作关系责任跟进及影响基线，不保存可编辑业务执行事实',
+  PRIMARY KEY (work_item_key),
+  KEY idx_appointment_work_container (container_booking_id,retired)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci COMMENT='预约工作事项需求与关系';
+
+CREATE TABLE IF NOT EXISTS ll_appointment_work_history (
+  id VARCHAR(36) NOT NULL COMMENT '历史记录标识',
+  work_item_key VARCHAR(96) NOT NULL COMMENT '事项稳定键',
+  operator_id VARCHAR(64) NOT NULL COMMENT '真实操作人员标识',
+  operator_name VARCHAR(128) NULL COMMENT '操作人显示名称',
+  action VARCHAR(48) NOT NULL COMMENT '工作命令或观察动作',
+  summary VARCHAR(2000) NOT NULL COMMENT '处理或责任变更依据',
+  command_key VARCHAR(64) NULL COMMENT '请求幂等键，观察记录为空',
+  request_hash VARCHAR(64) NULL COMMENT '包含操作者的规范请求摘要',
+  response_json LONGTEXT NULL COMMENT '原命令响应快照，重放不随当前状态改变',
+  occurred_at DATETIME(3) NOT NULL COMMENT '历史发生UTC时间',
+  PRIMARY KEY (id),
+  UNIQUE KEY uk_appointment_work_command (work_item_key,command_key),
+  KEY idx_appointment_work_history (work_item_key,occurred_at)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci COMMENT='预约工作事项历史与幂等命令';
diff --git a/lastleg-service/src/main/resources/db/lastleg.sql b/lastleg-service/src/main/resources/db/lastleg.sql
index 566ef2d3a..0767e4e17 100644
--- a/lastleg-service/src/main/resources/db/lastleg.sql
+++ b/lastleg-service/src/main/resources/db/lastleg.sql
@@ -300,7 +300,7 @@ CREATE TABLE IF NOT EXISTS ll_delivery_order (
   package_count INT NOT NULL DEFAULT 0 COMMENT '派送箱数',
   pallet_count INT NOT NULL DEFAULT 0 COMMENT '派送托盘数',
   total_weight_kg DECIMAL(18,4) NULL COMMENT '总重量（千克），任一来源未确认时为空',
-  total_volume_cbm DECIMAL(18,4) NOT NULL DEFAULT 0 COMMENT '总体积（立方米）',
+  total_volume_cbm DECIMAL(18,4) NULL COMMENT '体积（立方米），来源未确认时为空',
   planned_delivery_at DATETIME(3) NULL COMMENT '预计派送时间',
   dispatched_at DATETIME(3) NULL COMMENT '实际派送时间',
   expected_arrival_at DATETIME(3) NULL COMMENT '预计到达时间',
@@ -683,7 +683,7 @@ CREATE TABLE IF NOT EXISTS ll_inbound_plan_carton (
   destination_warehouse_name VARCHAR(255) NULL COMMENT '目的仓名称快照', plan_id BIGINT NULL COMMENT '海外入库计划ID',
   line_id BIGINT NULL COMMENT '入库计划明细ID', plan_pallet_id BIGINT NULL COMMENT '海外计划托盘ID', warehouse_pallet_id BIGINT NULL COMMENT '海外实物托盘ID',
   warehouse_location_id BIGINT NULL COMMENT '海外库位ID', pda_task_id BIGINT NULL COMMENT '首次扫码PDA任务ID',
-  status VARCHAR(32) NOT NULL COMMENT '箱唛状态：UNASSIGNED、ON_PALLET、BULK_RECEIVED、AVAILABLE', version INT NOT NULL DEFAULT 0 COMMENT '乐观锁版本',
+  status VARCHAR(32) NOT NULL COMMENT '箱唛状态：未绑定UNASSIGNED、已绑托ON_PALLET、整票收货BULK_RECEIVED、可用AVAILABLE、待废弃DISCARD_PENDING、已废弃DISCARDED', version INT NOT NULL DEFAULT 0 COMMENT '乐观锁版本',
   bound_at DATETIME(3) NULL COMMENT '绑定托盘时间', received_at DATETIME(3) NULL COMMENT '完成入库时间',
   updated_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3) COMMENT '更新时间',
   PRIMARY KEY(id), UNIQUE KEY uk_ll_inbound_carton_mark(customer_id,carton_mark),
@@ -1649,6 +1649,57 @@ CREATE TABLE IF NOT EXISTS ll_appointment_followup (
   CONSTRAINT chk_appointment_followup_stage CHECK (stage IN ('DRAYAGE_CONTACT','TERMINAL_APPOINTMENT','WAREHOUSE_RECEIVING','FBA_RECEIVING'))
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COMMENT='真实在途货源的预约筹划联系记录，追加留痕';
 
+-- V13 receiving coverage and pending changes; baseline only, no test data migration.
+CREATE TABLE IF NOT EXISTS ll_fba_receiving_agreement (
+  agreement_key VARCHAR(64) NOT NULL COMMENT '收货预约独立业务键',
+  version INT NOT NULL COMMENT '预约覆盖范围与确认资料版本',
+  status VARCHAR(24) NOT NULL COMMENT '有效、取消或已替代状态',
+  destination_key VARCHAR(128) NOT NULL COMMENT '权威目的仓关联键',
+  confirmation_no VARCHAR(128) NULL COMMENT '当前有效外部约号，失效后清空以释放覆盖',
+  snapshot_json LONGTEXT NOT NULL COMMENT '客户逐来源覆盖、确认时区及仓库依据快照',
+  PRIMARY KEY (agreement_key),
+  UNIQUE KEY uk_fba_receiving_confirmation (destination_key, confirmation_no)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci COMMENT='独立于送货批次的收货预约';
+
+CREATE TABLE IF NOT EXISTS ll_fba_receiving_member (
+  agreement_key VARCHAR(64) NOT NULL COMMENT '所属收货预约业务键',
+  batch_key VARCHAR(128) NOT NULL COMMENT '稳定送货批次键',
+  customer_id VARCHAR(128) NOT NULL COMMENT '货物所属客户标识',
+  active_ref VARCHAR(260) NULL COMMENT '有效批次与客户唯一引用，退出后清空且历史保留',
+  PRIMARY KEY (agreement_key,batch_key,customer_id),
+  UNIQUE KEY uk_fba_receiving_active_member (active_ref),
+  KEY idx_fba_receiving_batch (batch_key,customer_id)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci COMMENT='收货预约当前覆盖关联及退出历史';
+
+CREATE TABLE IF NOT EXISTS ll_fba_receiving_change (
+  change_key VARCHAR(64) NOT NULL COMMENT '客户预约变化业务键',
+  version INT NOT NULL COMMENT '变化续办版本',
+  status VARCHAR(24) NOT NULL COMMENT '待仓库确认、已应用或已撤回状态',
+  batch_key VARCHAR(128) NOT NULL COMMENT '受影响原送货批次键',
+  customer_id VARCHAR(128) NOT NULL COMMENT '本次变化所属客户',
+  snapshot_json LONGTEXT NOT NULL COMMENT '原覆盖快照、逐来源拟保留量、负责人及跟进资料',
+  result_json LONGTEXT NULL COMMENT '确认后的实际批次去向及逐步骤结果',
+  active_ref VARCHAR(260) NULL COMMENT '同批同客户唯一未解决变化引用',
+  PRIMARY KEY (change_key),
+  UNIQUE KEY uk_fba_receiving_pending (active_ref),
+  KEY idx_fba_receiving_pending_batch (batch_key,status)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci COMMENT='保留原安排且阻止误发车的客户变化';
+
+CREATE TABLE IF NOT EXISTS ll_fba_receiving_revision (
+  agreement_key VARCHAR(64) NOT NULL COMMENT '收货预约业务键',
+  version INT NOT NULL COMMENT '不可变覆盖与确认版本',
+  snapshot_json LONGTEXT NOT NULL COMMENT '该版本完整客户覆盖、确认时段及回复依据',
+  PRIMARY KEY (agreement_key,version)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci COMMENT='收货预约覆盖与确认不可变历史';
+
+CREATE TABLE IF NOT EXISTS ll_fba_receiving_plan (
+  batch_key VARCHAR(128) NOT NULL COMMENT '稳定送货批次键',
+  customer_id VARCHAR(128) NOT NULL COMMENT '计划所属客户标识',
+  snapshot_json LONGTEXT NOT NULL COMMENT '本客户未确认计划、目标窗口及业务时区，不含有效预约确认',
+  PRIMARY KEY (batch_key,customer_id)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci COMMENT='按批次及客户保存的未确认收货计划';
+
+
 CREATE TABLE IF NOT EXISTS ll_inbound_fba_appointment (
   id BIGINT NOT NULL COMMENT '主键ID',
   appointment_no VARCHAR(64) NOT NULL COMMENT '系统预约业务单号，不是外部约号',
@@ -1667,12 +1718,14 @@ CREATE TABLE IF NOT EXISTS ll_inbound_fba_appointment (
   appointment_remark VARCHAR(1000) NULL COMMENT '备注或取消原因',
   fba_warehouse_code VARCHAR(128) NOT NULL COMMENT 'FBA目的仓编码',
   selected_count INT NOT NULL DEFAULT 0 COMMENT '真实货源票数',
+  replacement_nos_json LONGTEXT NULL COMMENT '分批或合并后的新预约业务号列表，非空时原批次只读',
+  replacement_keys_json LONGTEXT NULL COMMENT '替代批次不可变键列表，只用于内部业务关联',
+  repartition_reason VARCHAR(1000) NULL COMMENT '分批或合并原因，原安排及来源明细保留',
   created_by VARCHAR(128) NOT NULL COMMENT '登录操作人',
   created_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) COMMENT '创建UTC时间',
   updated_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) COMMENT '更新UTC时间',
   PRIMARY KEY (id),
   UNIQUE KEY uk_ll_fba_appointment_no (appointment_no),
-  UNIQUE KEY uk_ll_fba_external_confirmation (fba_warehouse_code,confirmation_no),
   KEY idx_ll_fba_appointment_list (appointment_at,appointment_status,fba_warehouse_code),
   KEY idx_ll_fba_appointment_planned (planned_at,appointment_status)
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci COMMENT='FBA预约安排与正式确认唯一主记录';
@@ -1686,19 +1739,42 @@ CREATE TABLE IF NOT EXISTS ll_inbound_fba_appointment_item (
   order_id BIGINT NULL COMMENT '尚未形成尾程订单时为空',
   inbound_code VARCHAR(128) NULL COMMENT '真实入仓码，不伪造',
   fba_warehouse_code VARCHAR(128) NOT NULL COMMENT '目的FBA仓编码',
-  package_count INT NULL COMMENT '所选整票预报箱数，未知保持空',
-  active TINYINT(1) NOT NULL DEFAULT 1 COMMENT '取消或失败后释放货源占用',
-  active_source_key VARCHAR(160) GENERATED ALWAYS AS (CASE WHEN active=1 THEN source_key ELSE NULL END) STORED COMMENT '有效货源唯一占用键',
-  active_order_id BIGINT GENERATED ALWAYS AS (CASE WHEN active=1 THEN order_id ELSE NULL END) STORED COMMENT '有效订单唯一占用键',
+  package_count INT NULL COMMENT '本批分配箱数，未知保持空；同一原来源总量守恒',
+  cargo_verification_version INT NULL COMMENT '采用的预约货物核实版本，未核实时为空',
+  shipment_references_json LONGTEXT NULL COMMENT '本次采用的货件或追踪号核实快照',
+  active TINYINT(1) NOT NULL DEFAULT 1 COMMENT '当前批次数量分配有效；取消、未约成和完成均保留，仅替代时释放',
   created_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) COMMENT '创建UTC时间',
   PRIMARY KEY (id),
   UNIQUE KEY uk_ll_fba_item_source (appointment_id,source_key),
-  UNIQUE KEY uk_ll_fba_active_source (active_source_key),
-  UNIQUE KEY uk_ll_fba_active_order (active_order_id),
+  KEY idx_ll_fba_active_source (customer_id,source_key,active),
+  KEY idx_ll_fba_active_order (customer_id,order_id,active),
   KEY idx_ll_fba_item_source_lookup (source_key,customer_id),
   KEY idx_ll_fba_item_customer_order (customer_id,order_id)
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci COMMENT='入仓前后共用的预约真实货源';
 
+CREATE TABLE IF NOT EXISTS ll_appointment_cargo_verification (
+  id BIGINT NOT NULL COMMENT '核实记录主键',
+  customer_id VARCHAR(128) NOT NULL COMMENT '原货源所属客户',
+  source_key VARCHAR(160) NOT NULL COMMENT '稳定ORDER或BOOKING原来源键',
+  destination_key VARCHAR(160) NOT NULL COMMENT '核实时的原目的地',
+  source_version VARCHAR(160) NULL COMMENT '核实时的原来源版本',
+  source_packages INT NULL COMMENT '核实时的原来源箱数，未知为空',
+  version INT NOT NULL COMMENT '同一来源的核实版本，从一递增',
+  package_count INT NULL COMMENT '独立核实箱数，不回写原订单',
+  shipment_references_json LONGTEXT NOT NULL COMMENT '本票货件号或追踪号列表，不回写原订单',
+  remark VARCHAR(1000) NULL COMMENT '核实说明',
+  operator_id VARCHAR(128) NOT NULL COMMENT '登录操作人',
+  operator_name VARCHAR(200) NULL COMMENT '操作人名称快照',
+  command_key VARCHAR(64) NOT NULL COMMENT '来源内幂等命令键',
+  request_hash CHAR(64) NOT NULL COMMENT '来源、操作人及请求摘要',
+  created_at DATETIME(3) NOT NULL COMMENT '核实UTC时间',
+  PRIMARY KEY (id),
+  UNIQUE KEY uk_ll_cargo_verification_version (customer_id,source_key,version),
+  UNIQUE KEY uk_ll_cargo_verification_command (customer_id,source_key,command_key),
+  CONSTRAINT chk_ll_cargo_verification_quantity CHECK (package_count IS NULL OR package_count > 0),
+  CONSTRAINT chk_ll_cargo_verification_version CHECK (version > 0)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci COMMENT='预约货物核实资料及不可覆盖的版本历史';
+
 CREATE TABLE IF NOT EXISTS ll_fba_appointment_command (
   command_key VARCHAR(128) NOT NULL COMMENT '持久化幂等键',
   request_hash CHAR(64) NOT NULL COMMENT '操作、操作者和请求摘要',
@@ -2027,7 +2103,7 @@ CREATE TABLE IF NOT EXISTS ll_outbound_order (
   overseas_warehouse_id VARCHAR(128) NULL COMMENT '海外仓ID', status VARCHAR(32) NOT NULL DEFAULT 'WAIT_OUTBOUND' COMMENT '业务状态',
   package_count INT NOT NULL DEFAULT 0 COMMENT '箱数', pallet_count INT NOT NULL DEFAULT 0 COMMENT '托盘数',
   gross_weight_kg DECIMAL(18,3) NULL COMMENT '毛重（千克），来源未确认时为空', volume_weight_kg DECIMAL(18,3) NOT NULL DEFAULT 0 COMMENT '材积重（千克）',
-  volume_cbm DECIMAL(18,4) NOT NULL DEFAULT 0 COMMENT '体积（立方米）',
+  volume_cbm DECIMAL(18,4) NULL COMMENT '体积（立方米），来源未确认时为空',
   idempotency_key VARCHAR(255) NOT NULL COMMENT '业务幂等键', created_by VARCHAR(128) NULL COMMENT '创建人ID',
   created_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) COMMENT '创建时间', updated_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3) COMMENT '更新时间',
   outbound_type VARCHAR(32) NOT NULL DEFAULT 'DISPATCH_DELIVERY' COMMENT '出库类型：派送转出库、一件代发', lx_codes VARCHAR(1000) NULL COMMENT '关联一件代发领星入库单代码汇总',
@@ -2043,7 +2119,7 @@ CREATE TABLE IF NOT EXISTS ll_outbound_pallet_item (
   id BIGINT NOT NULL COMMENT '主键ID', customer_id VARCHAR(128) NOT NULL COMMENT '客户租户ID', outbound_order_id BIGINT NOT NULL COMMENT '出库单ID',
   warehouse_pallet_id BIGINT NULL COMMENT '仓库实物托盘ID', pallet_no VARCHAR(128) NULL COMMENT '托盘号',
   destination_warehouse_id VARCHAR(128) NULL COMMENT '目的仓ID', destination_warehouse_code VARCHAR(128) NULL COMMENT '目的仓编码快照', destination_warehouse_name VARCHAR(255) NULL COMMENT '目的仓名称快照',
-  package_count INT NOT NULL DEFAULT 0 COMMENT '箱数', gross_weight_kg DECIMAL(18,3) NULL COMMENT '毛重（千克），来源未确认时为空', volume_weight_kg DECIMAL(18,3) NOT NULL DEFAULT 0 COMMENT '材积重（千克）', volume_cbm DECIMAL(18,4) NOT NULL DEFAULT 0 COMMENT '体积（立方米）', picked_package_count INT NOT NULL DEFAULT 0 COMMENT '已拣箱数', status VARCHAR(32) NOT NULL DEFAULT 'WAIT_PICK' COMMENT '拣货状态', sku_code VARCHAR(128) NULL COMMENT '一件代发SKU', return_sku_quantity BIGINT NULL COMMENT '退货单SKU本来源计划出库件数快照，NULL为历史整箱出库', order_refs VARCHAR(2000) NULL COMMENT '关联订单信息', inbound_code VARCHAR(128) NULL COMMENT '入仓单号快照',
+  package_count INT NOT NULL DEFAULT 0 COMMENT '箱数', gross_weight_kg DECIMAL(18,3) NULL COMMENT '毛重（千克），来源未确认时为空', volume_weight_kg DECIMAL(18,3) NOT NULL DEFAULT 0 COMMENT '材积重（千克）', volume_cbm DECIMAL(18,4) NULL COMMENT '体积（立方米），来源未确认时为空', picked_package_count INT NOT NULL DEFAULT 0 COMMENT '已拣箱数', status VARCHAR(32) NOT NULL DEFAULT 'WAIT_PICK' COMMENT '拣货状态', sku_code VARCHAR(128) NULL COMMENT '一件代发SKU', return_sku_quantity BIGINT NULL COMMENT '退货单SKU本来源计划出库件数快照，NULL为历史整箱出库', order_refs VARCHAR(2000) NULL COMMENT '关联订单信息', inbound_code VARCHAR(128) NULL COMMENT '入仓单号快照',
   created_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) COMMENT '创建时间', PRIMARY KEY (id),
   UNIQUE KEY uk_ll_outbound_pallet (customer_id,outbound_order_id,warehouse_pallet_id,inbound_code,sku_code),
   KEY idx_ll_outbound_pallet_list (customer_id,outbound_order_id), KEY idx_ll_outbound_pallet_destination (customer_id,destination_warehouse_code)
@@ -2110,7 +2186,7 @@ CREATE TABLE IF NOT EXISTS ll_warehouse_transfer_order (
   private_destination_address VARCHAR(1000) NULL COMMENT '私人仓完整地址', private_destination_postal_code VARCHAR(32) NULL COMMENT '私人仓邮编', private_destination_contact_name VARCHAR(128) NULL COMMENT '私人仓联系人',
   private_destination_contact_phone VARCHAR(64) NULL COMMENT '私人仓联系电话',
   delivery_address VARCHAR(1000) NOT NULL COMMENT '提货地址或中转仓收货地址', pickup_contact_name VARCHAR(128) NULL COMMENT '提货联系人', pickup_contact_phone VARCHAR(64) NULL COMMENT '提货联系电话', package_count INT NOT NULL COMMENT '箱数', delivery_method VARCHAR(64) NOT NULL COMMENT '入仓方式',
-  estimated_arrival_at DATETIME(3) NOT NULL COMMENT '预计入仓时间', fba_shipment_no VARCHAR(128) NULL COMMENT '可选FBA货件编号',
+  estimated_arrival_at DATETIME(3) NULL COMMENT '预计入仓时间，库存转运不填写', fba_shipment_no VARCHAR(128) NULL COMMENT '可选FBA货件编号',
   tracking_no VARCHAR(255) NULL COMMENT '物流跟踪号', fba_box_nos VARCHAR(2000) NULL COMMENT 'FBA箱号集合', remark VARCHAR(1000) NULL COMMENT '备注',
   need_relabel TINYINT NOT NULL DEFAULT 0 COMMENT '是否需要换标', relabel_application_id BIGINT NULL COMMENT '换标申请单ID', relabel_no VARCHAR(64) NULL COMMENT '换标申请单号',
   status VARCHAR(32) NOT NULL DEFAULT 'PENDING_REVIEW' COMMENT '业务状态',
@@ -2131,7 +2207,7 @@ CREATE TABLE IF NOT EXISTS ll_warehouse_transfer_order (
   KEY idx_ll_wh_transfer_list (customer_id,status,created_at), KEY idx_ll_wh_transfer_inbound (customer_id,inbound_code)
 ) ENGINE=InnoDB COMMENT='客户转仓单';
 
-SET @ddl = (SELECT IF(EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_warehouse_transfer_order' AND column_name='fba_warehouse_code' AND is_nullable='NO'), 'ALTER TABLE ll_warehouse_transfer_order MODIFY COLUMN fba_warehouse_code VARCHAR(128) NULL COMMENT ''可选FBA目的仓编码'', MODIFY COLUMN fba_shipment_no VARCHAR(128) NULL COMMENT ''可选FBA货件编号'', MODIFY COLUMN delivery_address VARCHAR(1000) NOT NULL COMMENT ''提货地址或中转仓收货地址'', MODIFY COLUMN delivery_method VARCHAR(64) NOT NULL COMMENT ''入仓方式'', MODIFY COLUMN estimated_arrival_at DATETIME(3) NOT NULL COMMENT ''预计入仓时间''', 'SELECT 1'));
+SET @ddl = (SELECT IF(EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_warehouse_transfer_order' AND column_name='fba_warehouse_code' AND is_nullable='NO'), 'ALTER TABLE ll_warehouse_transfer_order MODIFY COLUMN fba_warehouse_code VARCHAR(128) NULL COMMENT ''可选FBA目的仓编码'', MODIFY COLUMN fba_shipment_no VARCHAR(128) NULL COMMENT ''可选FBA货件编号'', MODIFY COLUMN delivery_address VARCHAR(1000) NOT NULL COMMENT ''提货地址或中转仓收货地址'', MODIFY COLUMN delivery_method VARCHAR(64) NOT NULL COMMENT ''入仓方式'', MODIFY COLUMN estimated_arrival_at DATETIME(3) NULL COMMENT ''预计入仓时间，库存转运不填写''', 'SELECT 1'));
 PREPARE transfer_optional_fba_stmt FROM @ddl; EXECUTE transfer_optional_fba_stmt; DEALLOCATE PREPARE transfer_optional_fba_stmt;
 
 -- 兼容已存在的旧版转仓单表：CREATE TABLE IF NOT EXISTS 不会补充新增字段。
@@ -2184,6 +2260,7 @@ CREATE TABLE IF NOT EXISTS ll_warehouse_transfer_source_order (
 ) ENGINE=InnoDB COMMENT='转仓来源历史订单绑定';
 
 CREATE TABLE IF NOT EXISTS ll_warehouse_transfer_item (
+  declared_quantity BIGINT NULL COMMENT 'SKU申报件数，非预计或实收箱数',
   id BIGINT NOT NULL COMMENT '主键ID', transfer_order_id BIGINT NOT NULL COMMENT '转仓单ID', customer_id VARCHAR(128) NOT NULL COMMENT '客户租户ID',
   sku_code VARCHAR(128) NOT NULL COMMENT 'SKU编码', product_name_zh VARCHAR(255) NOT NULL COMMENT '产品中文名称',
   package_count INT NOT NULL COMMENT '箱数', shipping_mark VARCHAR(255) NULL COMMENT '运输唛头',
@@ -2192,8 +2269,21 @@ CREATE TABLE IF NOT EXISTS ll_warehouse_transfer_item (
 ) ENGINE=InnoDB COMMENT='转仓货物冻结明细';
 
 CREATE TABLE IF NOT EXISTS ll_warehouse_transfer_carton (
+  length_cm DECIMAL(12,2) NULL COMMENT '箱子实测长度厘米',
+  width_cm DECIMAL(12,2) NULL COMMENT '箱子实测宽度厘米',
+  height_cm DECIMAL(12,2) NULL COMMENT '箱子实测高度厘米',
+  gross_weight_kg DECIMAL(12,2) NULL COMMENT '箱子实测重量千克',
+  counted_quantity BIGINT NULL COMMENT '箱内SKU实点件数',
+  count_idempotency_key VARCHAR(255) NULL COMMENT '箱内清点幂等键',
+  count_request_hash VARCHAR(64) NULL COMMENT '箱内清点请求摘要',
+  counted_by VARCHAR(128) NULL COMMENT '箱内清点操作人',
+  counted_at DATETIME(3) NULL COMMENT '箱内清点完成时间',
+  discrepancy_reason VARCHAR(1000) NULL COMMENT '实收与预报箱数差异原因',
+  transfer_pallet_id BIGINT NULL COMMENT '签收箱所属转运托盘事实ID',
+  sku_items_json JSON NULL COMMENT '实收箱内SKU及逐项件数明细',
   id BIGINT NOT NULL COMMENT '预报箱主键', transfer_order_id BIGINT NOT NULL COMMENT '转运单ID',
-  transfer_item_id BIGINT NOT NULL COMMENT '转运申报明细ID', customer_id VARCHAR(128) NOT NULL COMMENT '客户租户ID',
+  transfer_item_id BIGINT NULL COMMENT '实际箱内首项SKU明细ID，预报补箱可为空', customer_id VARCHAR(128) NOT NULL COMMENT '客户租户ID',
+  customer_carton_mark VARCHAR(255) NULL COMMENT '客户原箱唛，用于换标现场绑定',
   carton_mark VARCHAR(255) NOT NULL COMMENT '系统生成的一箱一码箱唛', carton_index INT NOT NULL COMMENT '全单箱序号',
   total_cartons INT NOT NULL COMMENT '首次生成时全单总箱数', status VARCHAR(32) NOT NULL DEFAULT 'EXPECTED' COMMENT '箱状态：EXPECTED待实收',
   created_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) COMMENT '创建时间',
@@ -2344,7 +2434,7 @@ CREATE TABLE IF NOT EXISTS ll_relabel_application (
   label_deadline DATETIME(3) NOT NULL COMMENT '换标截止时间',
   contact_name VARCHAR(128) NOT NULL COMMENT '联系人姓名',
   contact_phone VARCHAR(64) NOT NULL COMMENT '联系人电话',
-  delivery_method VARCHAR(32) NULL COMMENT '派送方式：TRUCK卡车、PICKUP自提、EXPRESS快递；仅涉及箱唛换标时必填',
+  delivery_method VARCHAR(32) NULL COMMENT '派送方式：TRUCK平台卡车、EXPRESS快递、PICKUP自提、AMAZON_PICKUP亚马逊自提、CUSTOMER_PICKUP客户自提；仅平台卡车进入预排车',
   print_shipping_label TINYINT(1) NOT NULL DEFAULT 0 COMMENT '是否需要打印面单',
   shipping_label_file_id VARCHAR(128) NULL COMMENT '客户上传面单文件ID',
   shipping_label_file_name VARCHAR(255) NULL COMMENT '客户上传面单文件名',
@@ -2381,7 +2471,7 @@ CREATE TABLE IF NOT EXISTS ll_relabel_application (
 SET @ddl = (SELECT IF(EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_relabel_application' AND column_name='total_file_id'), 'SELECT 1', 'ALTER TABLE ll_relabel_application ADD COLUMN total_file_id VARCHAR(128) NULL COMMENT ''总换标PDF文件ID'' AFTER remark')); PREPARE stmt FROM @ddl; EXECUTE stmt; DEALLOCATE PREPARE stmt;
 SET @ddl = (SELECT IF(EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_relabel_application' AND column_name='total_file_name'), 'SELECT 1', 'ALTER TABLE ll_relabel_application ADD COLUMN total_file_name VARCHAR(255) NULL COMMENT ''总换标PDF文件名'' AFTER total_file_id')); PREPARE stmt FROM @ddl; EXECUTE stmt; DEALLOCATE PREPARE stmt;
 SET @ddl = (SELECT IF(EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_relabel_application' AND column_name='total_file_url'), 'SELECT 1', 'ALTER TABLE ll_relabel_application ADD COLUMN total_file_url VARCHAR(1000) NULL COMMENT ''总换标PDF预览地址'' AFTER total_file_name')); PREPARE stmt FROM @ddl; EXECUTE stmt; DEALLOCATE PREPARE stmt;
-SET @ddl = (SELECT IF(EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_relabel_application' AND column_name='delivery_method'), 'SELECT 1', 'ALTER TABLE ll_relabel_application ADD COLUMN delivery_method VARCHAR(32) NULL COMMENT ''派送方式：TRUCK卡车、PICKUP自提、EXPRESS快递；仅涉及箱唛换标时必填'' AFTER contact_phone')); PREPARE stmt FROM @ddl; EXECUTE stmt; DEALLOCATE PREPARE stmt;
+SET @ddl = (SELECT IF(EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_relabel_application' AND column_name='delivery_method'), 'SELECT 1', 'ALTER TABLE ll_relabel_application ADD COLUMN delivery_method VARCHAR(32) NULL COMMENT ''派送方式：TRUCK平台卡车、EXPRESS快递、PICKUP自提、AMAZON_PICKUP亚马逊自提、CUSTOMER_PICKUP客户自提；仅平台卡车进入预排车'' AFTER contact_phone')); PREPARE stmt FROM @ddl; EXECUTE stmt; DEALLOCATE PREPARE stmt;
 SET @ddl = (SELECT IF(EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_relabel_application' AND column_name='print_shipping_label'), 'SELECT 1', 'ALTER TABLE ll_relabel_application ADD COLUMN print_shipping_label TINYINT(1) NOT NULL DEFAULT 0 COMMENT ''是否需要打印面单'' AFTER delivery_method')); PREPARE stmt FROM @ddl; EXECUTE stmt; DEALLOCATE PREPARE stmt;
 SET @ddl = (SELECT IF(EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_relabel_application' AND column_name='shipping_label_file_id'), 'SELECT 1', 'ALTER TABLE ll_relabel_application ADD COLUMN shipping_label_file_id VARCHAR(128) NULL COMMENT ''客户上传面单文件ID'' AFTER print_shipping_label')); PREPARE stmt FROM @ddl; EXECUTE stmt; DEALLOCATE PREPARE stmt;
 SET @ddl = (SELECT IF(EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_relabel_application' AND column_name='shipping_label_file_name'), 'SELECT 1', 'ALTER TABLE ll_relabel_application ADD COLUMN shipping_label_file_name VARCHAR(255) NULL COMMENT ''客户上传面单文件名'' AFTER shipping_label_file_id')); PREPARE stmt FROM @ddl; EXECUTE stmt; DEALLOCATE PREPARE stmt;
@@ -2621,22 +2711,29 @@ CREATE TABLE IF NOT EXISTS ll_cargo_discard_application (
 
 CREATE TABLE IF NOT EXISTS ll_cargo_discard_item (
   id BIGINT NOT NULL COMMENT '主键ID', application_id BIGINT NOT NULL COMMENT '申请单ID', customer_id VARCHAR(128) NOT NULL COMMENT '客户租户ID',
-  order_id BIGINT NULL COMMENT '一件代发订单ID', source_type VARCHAR(32) NOT NULL DEFAULT 'DROPSHIP' COMMENT '库存来源：一件代发DROPSHIP、退货箱RETURN_CARTON',
+  order_id BIGINT NULL COMMENT '一件代发订单ID', source_type VARCHAR(32) NOT NULL DEFAULT 'DROPSHIP' COMMENT '库存来源：一件代发DROPSHIP、退货箱RETURN_CARTON、通用库存INVENTORY',
   return_carton_id BIGINT NULL COMMENT '退货库存箱ID', inbound_code VARCHAR(128) NOT NULL COMMENT '入仓单号快照', profile_id BIGINT NULL COMMENT '托盘档案ID',
   sku_inventory_id BIGINT NULL COMMENT 'SKU库存记录ID', sku_code VARCHAR(128) NOT NULL COMMENT 'SKU编码', product_name VARCHAR(255) NULL COMMENT '产品名称',
   available_packages_snapshot INT NOT NULL COMMENT '可用箱数快照', discard_packages INT NOT NULL COMMENT '申请废弃箱数',
+  inventory_position_id BIGINT NULL COMMENT '废弃来源库存仓位ID',
+  carton_marks_json TEXT NULL COMMENT '本次废弃所选真实箱唛快照JSON数组',
+  carton_scan_required TINYINT(1) NOT NULL DEFAULT 0 COMMENT '是否需要逐箱核对本次所选箱子',
   completion_photo_file_ids TEXT NULL COMMENT 'PDA完工照片文件ID JSON数组',
   actual_discard_packages INT NULL COMMENT 'PDA确认实际废弃箱数', pda_status VARCHAR(32) NOT NULL DEFAULT 'PENDING' COMMENT 'PDA处理状态：待处理PENDING、已完成COMPLETED',
   pda_operator_id VARCHAR(128) NULL COMMENT 'PDA操作人', pda_completed_at DATETIME(3) NULL COMMENT 'PDA完成时间',
   created_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) COMMENT '创建时间', PRIMARY KEY(id),
   UNIQUE KEY uk_ll_cargo_discard_item(application_id,profile_id,sku_code),
+  UNIQUE KEY uk_ll_discard_position_sku(application_id,inventory_position_id,sku_code),
   KEY idx_ll_cargo_discard_item_list(customer_id,application_id),
   KEY idx_ll_cargo_discard_item_inbound(customer_id,inbound_code,sku_code)
+,
+  KEY idx_ll_cargo_discard_return_carton(customer_id,return_carton_id)
 ) ENGINE=InnoDB COMMENT='货物废弃SKU明细';
 
 CREATE TABLE IF NOT EXISTS ll_cargo_discard_carton (
   id BIGINT NOT NULL COMMENT '主键ID', application_id BIGINT NOT NULL COMMENT '申请单ID', item_id BIGINT NOT NULL COMMENT '明细ID',
   customer_id VARCHAR(128) NOT NULL COMMENT '客户租户ID', carton_id BIGINT NOT NULL COMMENT '箱唛记录ID', carton_mark VARCHAR(128) NOT NULL COMMENT '箱唛',
+  source_type VARCHAR(32) NOT NULL DEFAULT 'DROPSHIP' COMMENT '箱子来源：一件代发DROPSHIP、入仓箱INBOUND、转运箱TRANSFER',
   created_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) COMMENT '创建时间', PRIMARY KEY(id),
   UNIQUE KEY uk_ll_cargo_discard_carton(application_id,carton_id),
   KEY idx_ll_cargo_discard_carton_application(customer_id,application_id,item_id),
@@ -2962,9 +3059,9 @@ CREATE TABLE IF NOT EXISTS ll_destuff_pallet_cost_allocation (
 -- 客户退货预报、PDA 签收与仓储费起算批次
 CREATE TABLE IF NOT EXISTS ll_return_order (
  -- need_relabel is added below for existing deployments
- id BIGINT NOT NULL COMMENT '退货订单ID', customer_id VARCHAR(128) NOT NULL COMMENT '客户ID和隔离键', return_no VARCHAR(128) NOT NULL COMMENT '退货订单号', overseas_warehouse_id VARCHAR(128) NOT NULL COMMENT '操作海外仓ID', warehouse_contact_name VARCHAR(128) NULL COMMENT '中转仓联系人快照', warehouse_contact_phone VARCHAR(64) NULL COMMENT '中转仓联系电话快照', customer_reference_no VARCHAR(128) NULL COMMENT '客户参考号', lastleg_order_id BIGINT NULL COMMENT '尾程订单ID', lastleg_order_no VARCHAR(32) NULL COMMENT '尾程订单号', status VARCHAR(32) NOT NULL COMMENT 'PENDING_RECEIPT、PARTIALLY_RECEIVED或COMPLETED', expected_sku_types INT NOT NULL COMMENT '预报SKU种类数', expected_quantity BIGINT NOT NULL COMMENT '预报总数量', received_quantity BIGINT NOT NULL DEFAULT 0 COMMENT '累计实收总数量', remark VARCHAR(1000) NULL COMMENT '客户备注', idempotency_key VARCHAR(255) NOT NULL COMMENT '创建幂等键', request_hash CHAR(64) NOT NULL COMMENT '创建请求SHA-256', created_by VARCHAR(128) NULL COMMENT '创建操作人ID', created_at DATETIME(3) NOT NULL COMMENT '创建时间', updated_at DATETIME(3) NOT NULL COMMENT '最后更新时间',
+ id BIGINT NOT NULL COMMENT '退货订单ID', customer_id VARCHAR(128) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL COMMENT '客户ID和隔离键', return_no VARCHAR(128) NOT NULL COMMENT '退货订单号', overseas_warehouse_id VARCHAR(128) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL COMMENT '操作海外仓ID', warehouse_contact_name VARCHAR(128) NULL COMMENT '中转仓联系人快照', warehouse_contact_phone VARCHAR(64) NULL COMMENT '中转仓联系电话快照', customer_reference_no VARCHAR(128) NULL COMMENT '客户参考号', lastleg_order_id BIGINT NULL COMMENT '尾程订单ID', lastleg_order_no VARCHAR(32) NULL COMMENT '尾程订单号', status VARCHAR(32) NOT NULL COMMENT 'PENDING_RECEIPT、PARTIALLY_RECEIVED或COMPLETED', expected_sku_types INT NOT NULL COMMENT '预报SKU种类数', expected_quantity BIGINT NOT NULL COMMENT '预报总数量', received_quantity BIGINT NOT NULL DEFAULT 0 COMMENT '累计实收总数量', remark VARCHAR(1000) NULL COMMENT '客户备注', idempotency_key VARCHAR(255) NOT NULL COMMENT '创建幂等键', request_hash CHAR(64) NOT NULL COMMENT '创建请求SHA-256', created_by VARCHAR(128) NULL COMMENT '创建操作人ID', created_at DATETIME(3) NOT NULL COMMENT '创建时间', updated_at DATETIME(3) NOT NULL COMMENT '最后更新时间',
  PRIMARY KEY(id), UNIQUE KEY uk_ll_return_order_customer_no(customer_id,return_no), UNIQUE KEY uk_ll_return_order_customer_key(customer_id,idempotency_key), KEY idx_ll_return_order_warehouse_status(overseas_warehouse_id,status,created_at), CONSTRAINT chk_ll_return_order_quantity CHECK(expected_sku_types>0 AND expected_quantity>0 AND received_quantity>=0 AND received_quantity<=expected_quantity)
-) ENGINE=InnoDB COMMENT='客户退货订单及SKU实收汇总';
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci COMMENT='客户退货订单及SKU实收汇总';
 SET @ll_return_order_need_relabel = (SELECT IF(EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_return_order' AND column_name='need_relabel'), 'SELECT 1', 'ALTER TABLE ll_return_order ADD COLUMN need_relabel TINYINT(1) NOT NULL DEFAULT 0 COMMENT ''是否需要换标'' AFTER customer_reference_no')); PREPARE stmt FROM @ll_return_order_need_relabel; EXECUTE stmt; DEALLOCATE PREPARE stmt;
 SET @ddl = (SELECT IF(EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_return_order' AND column_name='lastleg_order_id'), 'SELECT 1', 'ALTER TABLE ll_return_order ADD COLUMN lastleg_order_id BIGINT NULL COMMENT ''尾程订单ID'' AFTER customer_reference_no')); PREPARE stmt FROM @ddl; EXECUTE stmt; DEALLOCATE PREPARE stmt;
 SET @ddl = (SELECT IF(EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_return_order' AND column_name='lastleg_order_no'), 'SELECT 1', 'ALTER TABLE ll_return_order ADD COLUMN lastleg_order_no VARCHAR(32) NULL COMMENT ''尾程订单号'' AFTER lastleg_order_id')); PREPARE stmt FROM @ddl; EXECUTE stmt; DEALLOCATE PREPARE stmt;
@@ -2974,13 +3071,14 @@ SET @ddl = (SELECT IF(EXISTS (SELECT 1 FROM information_schema.columns WHERE tab
 SET @ddl = (SELECT IF(EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_return_order' AND column_name='relabel_no'), 'SELECT 1', 'ALTER TABLE ll_return_order ADD COLUMN relabel_no VARCHAR(64) NULL COMMENT ''绑定换标单号'' AFTER relabel_application_id')); PREPARE stmt FROM @ddl; EXECUTE stmt; DEALLOCATE PREPARE stmt;
 SET @ddl = (SELECT IF(EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_return_order' AND column_name='relabel_status'), 'SELECT 1', 'ALTER TABLE ll_return_order ADD COLUMN relabel_status VARCHAR(32) NULL COMMENT ''换标状态'' AFTER relabel_no')); PREPARE stmt FROM @ddl; EXECUTE stmt; DEALLOCATE PREPARE stmt;
 CREATE TABLE IF NOT EXISTS ll_return_order_item (
- id BIGINT NOT NULL COMMENT '退货预报明细ID', return_order_id BIGINT NOT NULL COMMENT '退货订单ID', customer_id VARCHAR(128) NOT NULL COMMENT '客户ID和隔离键', sku_code VARCHAR(128) NOT NULL COMMENT 'SKU编码', product_name_zh VARCHAR(255) NULL COMMENT '中文品名', expected_quantity BIGINT NOT NULL COMMENT 'SKU预报数量', received_quantity BIGINT NOT NULL DEFAULT 0 COMMENT 'SKU累计实收数量', created_at DATETIME(3) NOT NULL COMMENT '创建时间', updated_at DATETIME(3) NOT NULL COMMENT '最后更新时间',
+ id BIGINT NOT NULL COMMENT '退货预报明细ID', return_order_id BIGINT NOT NULL COMMENT '退货订单ID', customer_id VARCHAR(128) NOT NULL COMMENT '客户ID和隔离键', sku_code VARCHAR(128) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL COMMENT 'SKU编码', product_name_zh VARCHAR(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NULL COMMENT '中文品名', expected_quantity BIGINT NOT NULL COMMENT 'SKU预报数量', received_quantity BIGINT NOT NULL DEFAULT 0 COMMENT 'SKU累计实收数量', created_at DATETIME(3) NOT NULL COMMENT '创建时间', updated_at DATETIME(3) NOT NULL COMMENT '最后更新时间',
  PRIMARY KEY(id), UNIQUE KEY uk_ll_return_item_order_sku(return_order_id,sku_code), KEY idx_ll_return_item_sku(sku_code,received_quantity), CONSTRAINT chk_ll_return_item_quantity CHECK(expected_quantity>0 AND received_quantity>=0 AND received_quantity<=expected_quantity)
-) ENGINE=InnoDB COMMENT='客户退货订单的SKU预报与实收明细';
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci COMMENT='客户退货订单的SKU预报与实收明细';
 CREATE TABLE IF NOT EXISTS ll_return_receipt (
- id BIGINT NOT NULL COMMENT 'PDA退货签收单ID', return_order_id BIGINT NOT NULL COMMENT '退货订单ID', customer_id VARCHAR(128) NOT NULL COMMENT '客户ID和隔离键', receipt_no VARCHAR(128) NOT NULL COMMENT '签收单号', receipt_batch_no VARCHAR(128) NOT NULL COMMENT '签收批次号', tracking_no VARCHAR(128) NULL COMMENT '本次签收包裹的可选快递单号', bound_by VARCHAR(16) NOT NULL COMMENT '开始签收方式，RETURN_NO退货单号或SKU候选', status VARCHAR(32) NOT NULL COMMENT '签收状态，当前SIGNED', received_quantity BIGINT NOT NULL COMMENT '本次实收数量', operator_id VARCHAR(128) NOT NULL COMMENT 'PDA操作人ID', operator_name VARCHAR(128) NULL COMMENT 'PDA操作人名称', idempotency_key VARCHAR(255) NOT NULL COMMENT 'PDA确认幂等键', request_hash CHAR(64) NOT NULL COMMENT 'PDA确认请求SHA-256', signed_at DATETIME(3) NOT NULL COMMENT '签收时间', created_at DATETIME(3) NOT NULL COMMENT '创建时间',
+ original_packaging TINYINT(1) NULL COMMENT '是否使用原箱原包装', measurement_source VARCHAR(32) NULL COMMENT '尺寸重量来源',
+ id BIGINT NOT NULL COMMENT 'PDA退货签收单ID', return_order_id BIGINT NOT NULL COMMENT '退货订单ID', customer_id VARCHAR(128) NOT NULL COMMENT '客户ID和隔离键', receipt_no VARCHAR(128) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL COMMENT '签收单号', receipt_batch_no VARCHAR(128) NOT NULL COMMENT '签收批次号', tracking_no VARCHAR(128) NULL COMMENT '本次签收包裹的可选快递单号', bound_by VARCHAR(16) NOT NULL COMMENT '开始签收方式，RETURN_NO退货单号或SKU候选', status VARCHAR(32) NOT NULL COMMENT '签收状态，当前SIGNED', received_quantity BIGINT NOT NULL COMMENT '本次实收数量', operator_id VARCHAR(128) NOT NULL COMMENT 'PDA操作人ID', operator_name VARCHAR(128) NULL COMMENT 'PDA操作人名称', idempotency_key VARCHAR(255) NOT NULL COMMENT 'PDA确认幂等键', request_hash CHAR(64) NOT NULL COMMENT 'PDA确认请求SHA-256', signed_at DATETIME(3) NOT NULL COMMENT '签收时间', created_at DATETIME(3) NOT NULL COMMENT '创建时间',
  PRIMARY KEY(id), UNIQUE KEY uk_ll_return_receipt_no(receipt_no), UNIQUE KEY uk_ll_return_receipt_batch(receipt_batch_no), UNIQUE KEY uk_ll_return_receipt_operator_key(operator_id,idempotency_key), KEY idx_ll_return_receipt_order(return_order_id,signed_at), CONSTRAINT chk_ll_return_receipt_quantity CHECK(received_quantity>0), CONSTRAINT chk_ll_return_receipt_bound CHECK(bound_by IN('RETURN_NO','SKU'))
-) ENGINE=InnoDB COMMENT='PDA退货实收签收事实';
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci COMMENT='PDA退货实收签收事实';
 
 -- 已创建开发库升级为“客户只预报 SKU，快递单号仅属于签收批次”的最终模型。
 SET @ll_return_item_drop_tracking_order_sku = (SELECT IF(COUNT(*) > 0, 'ALTER TABLE ll_return_order_item DROP INDEX uk_ll_return_item_order_tracking_sku', 'SELECT 1') FROM information_schema.statistics WHERE table_schema=DATABASE() AND table_name='ll_return_order_item' AND index_name='uk_ll_return_item_order_tracking_sku');
@@ -3018,10 +3116,14 @@ EXECUTE ll_return_receipt_alter_stmt;
 DEALLOCATE PREPARE ll_return_receipt_alter_stmt;
 SET @ll_return_receipt_add_pallet = (SELECT IF(EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_return_receipt' AND column_name='pallet_code'), 'SELECT 1', 'ALTER TABLE ll_return_receipt ADD COLUMN pallet_code VARCHAR(128) NULL COMMENT ''本次签收绑定的托盘码'' AFTER receipt_batch_no'));
 PREPARE ll_return_receipt_add_pallet_stmt FROM @ll_return_receipt_add_pallet; EXECUTE ll_return_receipt_add_pallet_stmt; DEALLOCATE PREPARE ll_return_receipt_add_pallet_stmt;
+SET @ll_return_receipt_add_measurement_facts = (SELECT IF(COUNT(*)=0, 'ALTER TABLE ll_return_receipt ADD COLUMN original_packaging TINYINT(1) NULL COMMENT ''是否使用原箱原包装'' AFTER weight', 'SELECT 1') FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_return_receipt' AND column_name='original_packaging');
+PREPARE ll_return_receipt_add_measurement_facts_stmt FROM @ll_return_receipt_add_measurement_facts; EXECUTE ll_return_receipt_add_measurement_facts_stmt; DEALLOCATE PREPARE ll_return_receipt_add_measurement_facts_stmt;
+SET @ll_return_receipt_add_measurement_facts = (SELECT IF(COUNT(*)=0, 'ALTER TABLE ll_return_receipt ADD COLUMN measurement_source VARCHAR(32) NULL COMMENT ''尺寸重量来源'' AFTER original_packaging', 'SELECT 1') FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_return_receipt' AND column_name='measurement_source');
+PREPARE ll_return_receipt_add_measurement_facts_stmt FROM @ll_return_receipt_add_measurement_facts; EXECUTE ll_return_receipt_add_measurement_facts_stmt; DEALLOCATE PREPARE ll_return_receipt_add_measurement_facts_stmt;
 CREATE TABLE IF NOT EXISTS ll_return_receipt_item (
- id BIGINT NOT NULL COMMENT '签收SKU明细ID', receipt_id BIGINT NOT NULL COMMENT 'PDA退货签收单ID', return_order_item_id BIGINT NOT NULL COMMENT '退货预报明细ID', customer_id VARCHAR(128) NOT NULL COMMENT '客户ID和隔离键', sku_code VARCHAR(128) NOT NULL COMMENT 'SKU编码', received_quantity BIGINT NOT NULL COMMENT '本次SKU实收数量',
+ id BIGINT NOT NULL COMMENT '签收SKU明细ID', receipt_id BIGINT NOT NULL COMMENT 'PDA退货签收单ID', return_order_item_id BIGINT NOT NULL COMMENT '退货预报明细ID', customer_id VARCHAR(128) NOT NULL COMMENT '客户ID和隔离键', sku_code VARCHAR(128) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL COMMENT 'SKU编码', received_quantity BIGINT NOT NULL COMMENT '本次SKU实收数量',
  PRIMARY KEY(id), KEY idx_ll_return_receipt_item_receipt(receipt_id), KEY idx_ll_return_receipt_item_order_item(return_order_item_id), CONSTRAINT chk_ll_return_receipt_item_quantity CHECK(received_quantity>0)
-) ENGINE=InnoDB COMMENT='PDA退货签收SKU实际数量明细';
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci COMMENT='PDA退货签收SKU实际数量明细';
 CREATE TABLE IF NOT EXISTS ll_return_receipt_batch (
  id BIGINT NOT NULL COMMENT '退货仓储计费批次ID', return_order_id BIGINT NOT NULL COMMENT '退货订单ID', receipt_id BIGINT NOT NULL COMMENT 'PDA退货签收单ID', customer_id VARCHAR(128) NOT NULL COMMENT '客户ID和隔离键', batch_no VARCHAR(128) NOT NULL COMMENT '签收批次号', overseas_warehouse_id VARCHAR(128) NOT NULL COMMENT '操作海外仓ID', storage_billing_status VARCHAR(32) NOT NULL COMMENT '仓储计费状态，初始PENDING_PRICING', storage_started_at DATETIME(3) NOT NULL COMMENT '仓储计费起算时间', created_at DATETIME(3) NOT NULL COMMENT '创建时间',
  PRIMARY KEY(id), UNIQUE KEY uk_ll_return_batch_no(batch_no), UNIQUE KEY uk_ll_return_batch_receipt(receipt_id), KEY idx_ll_return_batch_billing(customer_id,overseas_warehouse_id,storage_billing_status,storage_started_at)
@@ -3031,12 +3133,15 @@ CREATE TABLE IF NOT EXISTS ll_return_receipt_batch (
 SET @ddl = (SELECT IF(EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_return_receipt' AND column_name='carton_mark'), 'SELECT 1', 'ALTER TABLE ll_return_receipt ADD COLUMN carton_mark VARCHAR(128) NULL COMMENT ''签收生成或绑定的退货箱号'' AFTER receipt_batch_no'));
 PREPARE return_receipt_carton_mark_stmt FROM @ddl; EXECUTE return_receipt_carton_mark_stmt; DEALLOCATE PREPARE return_receipt_carton_mark_stmt;
 CREATE TABLE IF NOT EXISTS ll_return_inventory_carton (
+ original_packaging TINYINT(1) NULL COMMENT '是否使用原箱原包装',
  new_carton_mark VARCHAR(255) NULL COMMENT '换标后新箱唛',
- id BIGINT NOT NULL COMMENT '退货库存箱ID', customer_id VARCHAR(128) NOT NULL COMMENT '客户ID和隔离键', overseas_warehouse_id VARCHAR(128) NOT NULL COMMENT '海外仓ID', source_receipt_id BIGINT NULL COMMENT '来源PDA签收单ID', source_batch_no VARCHAR(128) NULL COMMENT '来源签收批次号', carton_mark VARCHAR(128) NOT NULL COMMENT '退货箱号和箱唛编码', status VARCHAR(32) NOT NULL COMMENT 'AVAILABLE可用或MERGED已合箱', sku_types INT NOT NULL COMMENT '箱内SKU种类数', total_quantity BIGINT NOT NULL COMMENT '箱内总件数', length DECIMAL(12,3) NULL COMMENT '箱长CM', width DECIMAL(12,3) NULL COMMENT '箱宽CM', height DECIMAL(12,3) NULL COMMENT '箱高CM', weight DECIMAL(12,3) NULL COMMENT '箱重KG', created_at DATETIME(3) NOT NULL COMMENT '创建时间', updated_at DATETIME(3) NOT NULL COMMENT '最后更新时间', merged_at DATETIME(3) NULL COMMENT '合箱完成时间',
+ id BIGINT NOT NULL COMMENT '退货库存箱ID', customer_id VARCHAR(128) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL COMMENT '客户ID和隔离键', overseas_warehouse_id VARCHAR(128) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL COMMENT '海外仓ID', source_receipt_id BIGINT NULL COMMENT '来源PDA签收单ID', source_batch_no VARCHAR(128) NULL COMMENT '来源签收批次号', carton_mark VARCHAR(128) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL COMMENT '退货箱号和箱唛编码', status VARCHAR(32) NOT NULL COMMENT 'AVAILABLE可用或MERGED已合箱', sku_types INT NOT NULL COMMENT '箱内SKU种类数', total_quantity BIGINT NOT NULL COMMENT '箱内总件数', length DECIMAL(12,3) NULL COMMENT '箱长CM', width DECIMAL(12,3) NULL COMMENT '箱宽CM', height DECIMAL(12,3) NULL COMMENT '箱高CM', weight DECIMAL(12,3) NULL COMMENT '箱重KG', created_at DATETIME(3) NOT NULL COMMENT '创建时间', updated_at DATETIME(3) NOT NULL COMMENT '最后更新时间', merged_at DATETIME(3) NULL COMMENT '合箱完成时间',
  PRIMARY KEY(id), UNIQUE KEY uk_ll_return_inventory_carton_mark(carton_mark), UNIQUE KEY uk_ll_return_inventory_carton_receipt(source_receipt_id), KEY idx_ll_return_inventory_carton_customer(customer_id,overseas_warehouse_id,status,created_at), CONSTRAINT chk_ll_return_inventory_carton_quantity CHECK((status IN('AVAILABLE','RELABEL_PENDING','OUTBOUNDED','DISCARD_PENDING') AND sku_types>0 AND total_quantity>0) OR (status IN('MERGED','DISCARDED') AND sku_types=0 AND total_quantity=0)), CONSTRAINT chk_ll_return_inventory_carton_status CHECK(status IN('AVAILABLE','RELABEL_PENDING','MERGED','OUTBOUNDED','DISCARD_PENDING','DISCARDED'))
-) ENGINE=InnoDB COMMENT='退货实物库存箱及箱唛';
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci COMMENT='退货实物库存箱及箱唛';
 SET @ll_return_carton_add_pallet = (SELECT IF(EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_return_inventory_carton' AND column_name='pallet_code'), 'SELECT 1', 'ALTER TABLE ll_return_inventory_carton ADD COLUMN pallet_code VARCHAR(128) NULL COMMENT ''签收时绑定的托盘码'' AFTER source_batch_no'));
 PREPARE ll_return_carton_add_pallet_stmt FROM @ll_return_carton_add_pallet; EXECUTE ll_return_carton_add_pallet_stmt; DEALLOCATE PREPARE ll_return_carton_add_pallet_stmt;
+SET @ll_return_carton_add_original_packaging = (SELECT IF(COUNT(*)=0, 'ALTER TABLE ll_return_inventory_carton ADD COLUMN original_packaging TINYINT(1) NULL COMMENT ''是否使用原箱原包装'' AFTER weight', 'SELECT 1') FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_return_inventory_carton' AND column_name='original_packaging');
+PREPARE ll_return_carton_add_original_packaging_stmt FROM @ll_return_carton_add_original_packaging; EXECUTE ll_return_carton_add_original_packaging_stmt; DEALLOCATE PREPARE ll_return_carton_add_original_packaging_stmt;
 -- 已合箱的来源箱保留审计记录，但其箱内库存必须归零；动态 SQL 兼容 Spring 的数据库初始化器。
 SET @ddl = (SELECT IF(EXISTS (SELECT 1 FROM information_schema.table_constraints WHERE constraint_schema=DATABASE() AND table_name='ll_return_inventory_carton' AND constraint_name='chk_ll_return_inventory_carton_quantity'), 'ALTER TABLE ll_return_inventory_carton DROP CHECK chk_ll_return_inventory_carton_quantity', 'SELECT 1'));
 PREPARE return_inventory_carton_check_drop_stmt FROM @ddl; EXECUTE return_inventory_carton_check_drop_stmt; DEALLOCATE PREPARE return_inventory_carton_check_drop_stmt;
@@ -3055,20 +3160,20 @@ SET @ddl = (SELECT IF(EXISTS (SELECT 1 FROM information_schema.columns WHERE tab
 SET @ddl = (SELECT IF(EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_return_inventory_carton' AND column_name='relabel_status'), 'SELECT 1', 'ALTER TABLE ll_return_inventory_carton ADD COLUMN relabel_status VARCHAR(32) NULL COMMENT ''换标状态'' AFTER relabel_no')); PREPARE stmt FROM @ddl; EXECUTE stmt; DEALLOCATE PREPARE stmt;
 SET @ddl = (SELECT IF(EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_return_inventory_carton' AND column_name='relabel_completed_at'), 'SELECT 1', 'ALTER TABLE ll_return_inventory_carton ADD COLUMN relabel_completed_at DATETIME(3) NULL COMMENT ''换标完成时间'' AFTER relabel_status')); PREPARE stmt FROM @ddl; EXECUTE stmt; DEALLOCATE PREPARE stmt;
 CREATE TABLE IF NOT EXISTS ll_return_inventory_carton_item (
- id BIGINT NOT NULL COMMENT '退货库存箱SKU明细ID', carton_id BIGINT NOT NULL COMMENT '退货库存箱ID', customer_id VARCHAR(128) NOT NULL COMMENT '客户ID和隔离键', sku_code VARCHAR(128) NOT NULL COMMENT 'SKU编码', product_name_zh VARCHAR(255) NULL COMMENT '中文品名', quantity BIGINT NOT NULL COMMENT '该SKU箱内数量',
- PRIMARY KEY(id), UNIQUE KEY uk_ll_return_inventory_carton_item(carton_id,sku_code), KEY idx_ll_return_inventory_carton_item_customer(customer_id,sku_code), CONSTRAINT chk_ll_return_inventory_carton_item_quantity CHECK(quantity>0)
-) ENGINE=InnoDB COMMENT='退货库存箱内SKU和数量';
+ id BIGINT NOT NULL COMMENT '退货库存箱SKU明细ID', carton_id BIGINT NOT NULL COMMENT '退货库存箱ID', customer_id VARCHAR(128) NOT NULL COMMENT '客户ID和隔离键', sku_code VARCHAR(128) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL COMMENT 'SKU编码', product_name_zh VARCHAR(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NULL COMMENT '中文品名', quantity BIGINT NOT NULL COMMENT '该SKU箱内数量',
+ PRIMARY KEY(id), UNIQUE KEY uk_ll_return_inventory_carton_item(carton_id,sku_code), KEY idx_ll_return_inventory_carton_item_customer(customer_id,sku_code), CONSTRAINT chk_ll_return_inventory_carton_item_quantity CHECK(quantity>=0)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci COMMENT='退货库存箱内SKU和数量';
 -- 退货出库按SKU固化扣减前后快照，与PDA拣货同事务提交；不修改历史箱内容。
 CREATE TABLE IF NOT EXISTS ll_return_inventory_outbound_movement (
  id BIGINT NOT NULL COMMENT '退货出库SKU流水ID',
  outbound_pick_id BIGINT NOT NULL COMMENT '同事务PDA出库拣货记录ID',
- customer_id VARCHAR(128) NOT NULL COMMENT '库存所属客户ID和隔离键',
- overseas_warehouse_id VARCHAR(128) NOT NULL COMMENT '实际出库海外仓ID',
+ customer_id VARCHAR(128) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL COMMENT '库存所属客户ID和隔离键',
+ overseas_warehouse_id VARCHAR(128) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL COMMENT '实际出库海外仓ID',
  carton_id BIGINT NOT NULL COMMENT '真实退货库存箱ID',
  carton_mark VARCHAR(128) NOT NULL COMMENT '冻结的真实退货箱业务码',
- outbound_no VARCHAR(64) NOT NULL COMMENT '本次退货出库业务单号',
- sku_code VARCHAR(128) NOT NULL COMMENT '本次出库SKU编码快照',
- product_name_zh VARCHAR(255) NULL COMMENT '中文品名快照',
+ outbound_no VARCHAR(64) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL COMMENT '本次退货出库业务单号',
+ sku_code VARCHAR(128) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL COMMENT '本次出库SKU编码快照',
+ product_name_zh VARCHAR(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NULL COMMENT '中文品名快照',
  quantity BIGINT NOT NULL COMMENT '本箱该SKU实际出库件数，始终为正',
  total_before BIGINT NOT NULL COMMENT '客户仓SKU出库前实物总数量',
  total_after BIGINT NOT NULL COMMENT '客户仓SKU出库后实物总数量',
@@ -3084,7 +3189,7 @@ CREATE TABLE IF NOT EXISTS ll_return_inventory_outbound_movement (
  CONSTRAINT chk_ll_return_outbound_movement_delta CHECK(quantity>0 AND total_after>=0 AND available_after>=0
    AND total_before-total_after=quantity AND available_before-available_after=quantity
    AND cartons_after>=0 AND cartons_before-cartons_after IN (0,1) AND total_after>=available_after)
-) ENGINE=InnoDB COMMENT='不可变退货出库SKU库存流水';
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci COMMENT='不可变退货出库SKU库存流水';
 
 CREATE TABLE IF NOT EXISTS ll_return_inventory_balance (
  id BIGINT NOT NULL COMMENT '退货库存余额ID', customer_id VARCHAR(128) NOT NULL COMMENT '客户ID和隔离键', overseas_warehouse_id VARCHAR(128) NOT NULL COMMENT '海外仓ID', sku_code VARCHAR(128) NOT NULL COMMENT 'SKU编码', product_name_zh VARCHAR(255) NULL COMMENT '中文品名', total_quantity BIGINT NOT NULL DEFAULT 0 COMMENT '实物总库存，仅实际出库扣减', available_quantity BIGINT NOT NULL COMMENT '未合箱可用上架数量', carton_quantity BIGINT NOT NULL COMMENT '包含该SKU的可用箱数', created_at DATETIME(3) NOT NULL COMMENT '创建时间', updated_at DATETIME(3) NOT NULL COMMENT '最后更新时间',
@@ -3563,3 +3668,622 @@ CREATE TABLE IF NOT EXISTS ll_appointment_impact_history (
   CONSTRAINT fk_appointment_impact_history FOREIGN KEY (container_booking_id) REFERENCES ll_appointment_impact(container_booking_id),
   CONSTRAINT chk_appointment_impact_action CHECK (action IN ('OBSERVED','CLAIM','RECORD','RESOLVE'))
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COMMENT='船期观察及人工处理追加历史';
+
+-- 退货以包裹/箱为最小出库实物单位；部分数量必须先合箱生成新标签箱。
+-- 可重复执行，目标库 baiyue_lastleg。
+USE baiyue_lastleg;
+
+-- 合箱后的新箱与原包裹共用同一箱唛、标签和来源追溯模型。
+-- 流水约束允许部分合箱/拆分只扣件数，不虚减箱数。
+SET @ddl = IF(EXISTS(SELECT 1 FROM information_schema.table_constraints
+  WHERE constraint_schema=DATABASE() AND table_name='ll_return_inventory_outbound_movement'
+    AND constraint_name='chk_ll_return_outbound_movement_delta'),
+  'ALTER TABLE ll_return_inventory_outbound_movement DROP CHECK chk_ll_return_outbound_movement_delta, ADD CONSTRAINT chk_ll_return_outbound_movement_delta CHECK(quantity>0 AND total_after>=0 AND available_after>=0 AND total_before-total_after=quantity AND available_before-available_after=quantity AND cartons_after>=0 AND cartons_before-cartons_after IN (0,1) AND total_after>=available_after)',
+  'ALTER TABLE ll_return_inventory_outbound_movement ADD CONSTRAINT chk_ll_return_outbound_movement_delta CHECK(quantity>0 AND total_after>=0 AND available_after>=0 AND total_before-total_after=quantity AND available_before-available_after=quantity AND cartons_after>=0 AND cartons_before-cartons_after IN (0,1) AND total_after>=available_after)');
+PREPARE stmt FROM @ddl; EXECUTE stmt; DEALLOCATE PREPARE stmt;
+
+-- 同一包裹可分批合箱/出库，重复提交仍由 outbound_pick_id + SKU 幂等约束保护。
+SET @ddl = IF(EXISTS(SELECT 1 FROM information_schema.statistics
+  WHERE table_schema=DATABASE() AND table_name='ll_return_inventory_outbound_movement'
+    AND index_name='uk_ll_return_outbound_carton_sku'),
+  'ALTER TABLE ll_return_inventory_outbound_movement DROP INDEX uk_ll_return_outbound_carton_sku, ADD INDEX idx_ll_return_outbound_carton_sku(customer_id,carton_id,sku_code)',
+  'SELECT 1');
+PREPARE stmt FROM @ddl; EXECUTE stmt; DEALLOCATE PREPARE stmt;
+
+-- 新签收及新合箱必须打印并扫码确认标签；既有实物按原状态继续作业。
+SET @ddl = IF(EXISTS(SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_return_inventory_carton' AND column_name='label_status'), 'SELECT 1', 'ALTER TABLE ll_return_inventory_carton ADD COLUMN label_status VARCHAR(32) NULL COMMENT ''WAIT_LABEL待贴标 CONFIRMED已扫码确认标签''');
+PREPARE stmt FROM @ddl; EXECUTE stmt; DEALLOCATE PREPARE stmt;
+
+-- SKU 换标实物转换：先执行本增量，再部署服务。不会自动改写存量业务事实。
+SET @return_sku_ddl = (SELECT IF(EXISTS(SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_return_inventory_carton_item' AND column_name='relabelled_quantity'), 'SELECT 1', 'ALTER TABLE ll_return_inventory_carton_item ADD COLUMN relabelled_quantity BIGINT NOT NULL DEFAULT 0 COMMENT ''当前SKU已经换标的实物件数，不可二次换标'''));
+PREPARE return_sku_stmt FROM @return_sku_ddl; EXECUTE return_sku_stmt; DEALLOCATE PREPARE return_sku_stmt;
+CREATE TABLE IF NOT EXISTS ll_return_sku_conversion (
+ id BIGINT NOT NULL COMMENT 'SKU库存转换记录ID',
+ customer_id VARCHAR(128) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL COMMENT '客户隔离键',
+ overseas_warehouse_id VARCHAR(128) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL COMMENT '操作海外仓ID',
+ application_id BIGINT NOT NULL COMMENT '换标申请ID',
+ relabel_no VARCHAR(64) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL COMMENT '换标单号',
+ item_id BIGINT NOT NULL COMMENT '换标箱级明细ID',
+ round_key VARCHAR(64) NOT NULL COMMENT '作业轮次，退回重做使用新轮次',
+ carton_id BIGINT NOT NULL COMMENT '实物来源包裹或箱ID',
+ carton_mark VARCHAR(128) NOT NULL COMMENT '完工时仓库识别码',
+ old_sku_code VARCHAR(128) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL COMMENT '换标前SKU',
+ new_sku_code VARCHAR(128) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL COMMENT '换标后SKU',
+ product_name_zh VARCHAR(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NULL COMMENT '中文品名快照',
+ quantity BIGINT NOT NULL COMMENT '实际完成转换件数',
+ status VARCHAR(32) NOT NULL COMMENT 'APPLIED待客户确认/CONFIRMED已确认/REVERSED退回冲回',
+ ownership_json LONGTEXT NOT NULL COMMENT '本次转换件数的来源退货单快照，供精确冲回',
+ completed_at DATETIME(3) NOT NULL COMMENT '实物SKU转换时间',
+ confirmed_at DATETIME(3) NULL COMMENT '客户确认时间',
+ reversed_at DATETIME(3) NULL COMMENT '退回冲回时间',
+ PRIMARY KEY(id),
+ UNIQUE KEY uk_return_sku_conversion_round(item_id,round_key,old_sku_code,new_sku_code),
+ KEY idx_return_sku_conversion_app(customer_id,application_id,status),
+ KEY idx_return_sku_conversion_carton(customer_id,carton_id),
+ CONSTRAINT chk_return_sku_conversion_quantity CHECK(quantity>0)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci COMMENT='退货实物SKU换标库存转换和冲回记录';
+
+
+-- 平台自营领星统计：独立事实与不可变发布版本；仅空库初始化，不自动执行。
+CREATE TABLE ll_selfop_outbound_discovery_scope (
+  id BIGINT NOT NULL COMMENT '应用生成的记录标识',
+  created_at DATETIME(3) NOT NULL COMMENT 'UTC创建时间',
+  updated_at DATETIME(3) NOT NULL COMMENT 'UTC更新时间',
+  source_account VARCHAR(64) NOT NULL COMMENT '受控来源账号别名，不保存密钥',
+  catalog_from_utc DATETIME(3) NULL COMMENT '账号完整目录连续覆盖UTC下界，不等同销量覆盖',
+  catalog_until_utc DATETIME(3) NULL COMMENT '账号完整目录连续覆盖UTC上界，不等同销量覆盖',
+  next_sequence BIGINT NOT NULL DEFAULT 1 COMMENT '新发现任务的单调调度序号；重试沿用，只安排任务，不判断对象内容的新旧',
+  next_observation_sequence BIGINT NOT NULL DEFAULT 1 COMMENT '每次实际出库详情请求前分配的单调采集代次；与 task 调度序号独立，重试请求也分配新代次',
+  active_task_id BIGINT NULL COMMENT '当前共享发现／详情补齐任务',
+  lease_owner VARCHAR(128) NULL COMMENT '账号发现执行者',
+  lease_until_utc DATETIME(3) NULL COMMENT '账号发现租约到期时刻',
+  fence_token BIGINT NOT NULL DEFAULT 0 COMMENT '防止过期发现进程继续写共享暂存或派发任务',
+  request_budget INT NOT NULL COMMENT '一次调度允许的目录、详情请求总预算，必须为正',
+  time_budget_seconds INT NOT NULL COMMENT '一次调度允许占用的执行时长，必须为正',
+  min_request_interval_ms INT NOT NULL COMMENT '同账号请求最小间隔，按已核准配额配置',
+  api_budget_json JSON NULL COMMENT '账号所有采集族共用的预算、统计日、保守预留及确认消耗、尝试许可和独占交接依据',
+  api_cooldown_until_utc DATETIME(3) NULL COMMENT '账号全部真实请求共用冷却UTC截止，重启与跨日不清除',
+  api_pause_reason VARCHAR(64) NULL COMMENT '账号停止或等待的固定原因码，不保存供应商原始错误或凭据',
+  PRIMARY KEY (id),
+  UNIQUE KEY uk_selfop_discovery_account (source_account),
+  CONSTRAINT chk_selfop_outbound_discovery_scope CHECK (request_budget > 0 AND time_budget_seconds > 0 AND min_request_interval_ms > 0 AND fence_token >= 0 AND next_sequence > 0 AND next_observation_sequence > 0)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_bin COMMENT='账号共享出库目录与详情发现协调作用域';
+
+CREATE TABLE ll_selfop_sync_scope (
+  id BIGINT NOT NULL COMMENT '应用生成的记录标识',
+  created_at DATETIME(3) NOT NULL COMMENT 'UTC创建时间',
+  updated_at DATETIME(3) NOT NULL COMMENT 'UTC更新时间',
+  source_account VARCHAR(64) NOT NULL COMMENT '受控来源账号别名，不保存密钥',
+  warehouse_code VARCHAR(64) NOT NULL COMMENT '来源仓库原始编码，按仓独立统计',
+  data_family VARCHAR(16) NOT NULL COMMENT 'OUTBOUND 或 INVENTORY；按账号＋仓库＋任务族互斥',
+  scope_json JSON NOT NULL COMMENT '本仓范围规则，customerMode=ALL_AUTHORIZED，库存为全部品质；当前账号全部授权货主均自营，不将当天出现的货主列表当白名单',
+  scope_hash CHAR(64) NOT NULL COMMENT '仓库、货主范围规则、品质、时区及单位口径的规范化摘要；不包含当天观测到的客户／SKU 集合',
+  business_timezone VARCHAR(64) NOT NULL COMMENT '本仓报表及调度时区，初始建议值为 Asia/Shanghai，各仓独立核准',
+  source_timezone VARCHAR(64) NULL COMMENT '本仓已核准的出库源时间时区',
+  schedule_cron VARCHAR(128) NOT NULL COMMENT '本仓、本任务族的调度表达式，按 business_timezone 执行',
+  stale_after_seconds INT NOT NULL COMMENT '本仓、本任务族数据过期阈值，必须为正；库存初始可采用 26 小时，后续按仓调整',
+  warehouse_policy_ref VARCHAR(128) NULL COMMENT '未来按仓告警／补货策略的稳定引用；一期为空，不建告警规则表',
+  initial_from_utc DATETIME(3) NULL COMMENT '首采固定UTC下界，按本仓业务时区减一个月',
+  initial_until_utc DATETIME(3) NULL COMMENT '首采固定UTC截止，重试不重新取当前时间',
+  discovery_from_utc DATETIME(3) NULL COMMENT '本仓已发布的连续销量覆盖UTC下界',
+  discovery_until_utc DATETIME(3) NULL COMMENT '本仓已发布的连续销量覆盖UTC上界，不含端点',
+  fact_revision BIGINT NOT NULL DEFAULT 0 COMMENT '出库事实归并修订号；内容实际变化才增加',
+  published_fact_revision BIGINT NOT NULL DEFAULT 0 COMMENT '本仓最后已发布销量版所使用的事实修订号',
+  rebuild_required TINYINT NOT NULL DEFAULT 0 COMMENT '事实变化待重建标记；跨仓修订同时置旧、新仓为 1',
+  invalidated_at_utc DATETIME(3) NULL COMMENT '最近一次因事实修订使当前版待重建的时刻',
+  published_run_id BIGINT NULL COMMENT '唯一对外可见版本，指向本任务族已发布执行批次',
+  lease_owner VARCHAR(128) NULL COMMENT '当前执行者令牌，不使用仅进程内锁',
+  lease_until_utc DATETIME(3) NULL COMMENT '租约到期时刻',
+  fence_token BIGINT NOT NULL DEFAULT 0 COMMENT '每次取得租约递增，事实提交和发布均校验',
+  known_order_cursor_id BIGINT NULL COMMENT '本仓已可靠处理的稳定订单内部标识游标',
+  known_order_round_max_id BIGINT NULL COMMENT '本轮已知单复查固定最大内部标识',
+  known_order_round_started_at_utc DATETIME(3) NULL COMMENT '本仓已知单复查轮次开始UTC时间',
+  known_order_round_finished_at_utc DATETIME(3) NULL COMMENT '本仓已知单完整轮转完成UTC时间',
+  history_round_from_utc DATETIME(3) NULL COMMENT '本仓历史核对固定UTC下界',
+  history_round_until_utc DATETIME(3) NULL COMMENT '本仓历史核对固定UTC上界',
+  history_slice_cursor_utc DATETIME(3) NULL COMMENT '本仓下一待核对历史切片UTC位置',
+  history_round_finished_at_utc DATETIME(3) NULL COMMENT '上一轮历史时间片全部完成时刻',
+  review_request_budget INT NOT NULL COMMENT '本仓单次复查最大请求数，必须为正',
+  review_time_budget_seconds INT NOT NULL COMMENT '本仓单次复查最大执行秒数，必须为正',
+  review_target_days INT NOT NULL DEFAULT 7 COMMENT '建议每 7 天轮转一遍，属于待配额验证的目标，不保证首次大量详情在单次调度内完成',
+  PRIMARY KEY (id),
+  UNIQUE KEY uk_selfop_scope (source_account,warehouse_code,data_family),
+  KEY idx_selfop_scope_lease (lease_until_utc),
+  CONSTRAINT chk_selfop_sync_scope CHECK (data_family IN ('OUTBOUND','INVENTORY') AND stale_after_seconds > 0 AND review_request_budget > 0 AND review_time_budget_seconds > 0 AND review_target_days > 0 AND fact_revision >= 0 AND published_fact_revision >= 0 AND fence_token >= 0)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_bin COMMENT='分仓任务族租约及发布指针';
+
+CREATE TABLE ll_selfop_sync_task (
+  id BIGINT NOT NULL COMMENT '应用生成的记录标识',
+  created_at DATETIME(3) NOT NULL COMMENT 'UTC创建时间',
+  updated_at DATETIME(3) NOT NULL COMMENT 'UTC更新时间',
+  task_no VARCHAR(64) NOT NULL COMMENT '稳定采集业务任务号，重试沿用，不展示内部数据库标识',
+  execution_purpose VARCHAR(16) NOT NULL COMMENT 'BUSINESS或VALIDATION；由服务端冻结用途，子任务继承',
+  validation_root_task_id BIGINT NULL COMMENT '验证会话唯一预算根任务，根引用自身，正式任务为空',
+  validation_budget_json JSON NULL COMMENT '验证根冻结硬预算、累计消耗、库存分仓页数、截止时刻及停止原因',
+  business_root_task_id BIGINT NULL COMMENT '测试人工正式采集共享预算根任务；生产任务为空',
+  business_budget_json JSON NULL COMMENT '仅测试正式采集根保存冻结请求上限、截止时间、消耗及停止原因',
+  source_account VARCHAR(64) NOT NULL COMMENT '受控来源账号别名，不保存密钥',
+  task_role VARCHAR(24) NOT NULL COMMENT 'ACCOUNT_DISCOVERY 或 WAREHOUSE_SYNC',
+  scope_id BIGINT NULL COMMENT '分仓任务必须引用分仓作用域；仅账号共享发现为空',
+  warehouse_code VARCHAR(64) NULL COMMENT '来源仓库原始编码，按仓独立统计',
+  discovery_scope_id BIGINT NULL COMMENT '共享发现必填，引用账号发现协调器',
+  upstream_task_id BIGINT NULL COMMENT '出库分仓任务引用已持久化目录的共享发现切片；库存无此上游',
+  discovery_sequence BIGINT NULL COMMENT '共享任务及分仓子任务继承的调度顺序；重试保持不变，不用于事实覆盖判定',
+  observation_baseline BIGINT NULL COMMENT '共享任务建立时已分配的最大详情采集代次，分仓子任务继承；用于识别旧任务恢复期间出现的其他任务新观测',
+  request_key VARCHAR(128) NOT NULL COMMENT '共享发现包含切片／计划槽位；分仓任务包含仓库、任务族及切片或计划槽位；人工附请求幂等键',
+  request_hash CHAR(64) NOT NULL COMMENT '请求类型、查询范围、范围摘要的指纹；同键不同请求拒绝',
+  task_type VARCHAR(24) NOT NULL COMMENT '计划、补采、复核、重建与验证；INVENTORY_FLOW_HISTORY为流水片，INVENTORY_HISTORY_BUILD为本地历史还原',
+  planned_at_utc DATETIME(3) NULL COMMENT '计划时点；人工请求可空',
+  query_from_utc DATETIME(3) NULL COMMENT '出库查询区间UTC下界，库存不填',
+  query_until_utc DATETIME(3) NULL COMMENT '出库查询区间UTC上界，不含端点，库存不填',
+  query_scope_json JSON NOT NULL COMMENT '不变的账号、货主、仓库、品质和查询条件快照；按单补查在此记录单号',
+  routing_manifest_json JSON NULL COMMENT '共享切片目录完整标记、每仓对象键集合／数量和详情就绪状态；各对象记录 effectiveStageId，需新代次复查时记录 refreshTaskId，完成后指向新有效暂存；不改写旧载荷',
+  scope_hash CHAR(64) NOT NULL COMMENT '建任务时的业务范围摘要',
+  status VARCHAR(20) NOT NULL COMMENT 'WAITING_SOURCE、READY、RUNNING、RETRY_WAIT、SUCCEEDED、DEAD、SAMPLE_DONE；样本结束不等于正式成功',
+  apply_state VARCHAR(20) NOT NULL COMMENT '正式出库归并NOT_STARTED、APPLYING、BLOCKED、APPLIED；共享发现、库存、重建及验证为NOT_APPLICABLE',
+  affected_warehouse_codes_json JSON NULL COMMENT '本次归并可能改变的仓集合，包含原仓与新仓；首段事实写入前登记，扩大集合须先取得新增仓租约并锁 scope，不能写完再补',
+  apply_started_at_utc DATETIME(3) NULL COMMENT '首段事实提交UTC时间',
+  apply_completed_at_utc DATETIME(3) NULL COMMENT '全部必需事实归并完成UTC时间，失败不填',
+  attempt_count INT NOT NULL DEFAULT 0 COMMENT '已创建的执行尝试数',
+  next_retry_at_utc DATETIME(3) NULL COMMENT '有限退避后下一次可执行时刻',
+  requested_by VARCHAR(128) NULL COMMENT '人工请求的平台操作人，仅内部审计',
+  result_published_run_id BIGINT NULL COMMENT '正式成功任务实际发布或复用的版本；验证和共享发现为空',
+  progress_json JSON NULL COMMENT '与可靠检查点一起提交的有界阶段、单位、尝试和质量进度，不保存单据集合',
+  progress_updated_at_utc DATETIME(3) NULL COMMENT '最后可靠业务检查点UTC时间，与执行心跳分开',
+  PRIMARY KEY (id),
+  UNIQUE KEY uk_selfop_task_no (task_no),
+  UNIQUE KEY uk_selfop_task_request (source_account,request_key),
+  KEY idx_selfop_task_poll (status,next_retry_at_utc,id),
+  KEY idx_selfop_task_upstream (upstream_task_id,warehouse_code),
+  KEY idx_selfop_task_apply (apply_state,id),
+  KEY idx_selfop_task_scope_list (scope_id,created_at,id),
+  KEY idx_selfop_task_account_list (source_account,task_role,created_at,id),
+  KEY idx_selfop_task_business_root (business_root_task_id,status,id),
+  CONSTRAINT chk_selfop_business_budget CHECK ((business_root_task_id IS NULL AND business_budget_json IS NULL) OR (execution_purpose='BUSINESS' AND business_root_task_id IS NOT NULL AND ((business_root_task_id=id AND business_budget_json IS NOT NULL) OR (business_root_task_id<>id AND business_budget_json IS NULL)))),
+  CONSTRAINT chk_selfop_sync_task CHECK (attempt_count >= 0 AND execution_purpose IN ('BUSINESS','VALIDATION') AND ((execution_purpose = 'BUSINESS' AND validation_root_task_id IS NULL AND validation_budget_json IS NULL) OR (execution_purpose = 'VALIDATION' AND validation_root_task_id IS NOT NULL AND apply_state = 'NOT_APPLICABLE' AND result_published_run_id IS NULL AND status <> 'SUCCEEDED')) AND ((task_role = 'ACCOUNT_DISCOVERY' AND scope_id IS NULL AND warehouse_code IS NULL AND discovery_scope_id IS NOT NULL) OR (task_role = 'WAREHOUSE_SYNC' AND scope_id IS NOT NULL AND warehouse_code IS NOT NULL)))
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_bin COMMENT='一次计划或人工请求';
+
+CREATE TABLE ll_selfop_sync_run (
+  id BIGINT NOT NULL COMMENT '应用生成的记录标识',
+  created_at DATETIME(3) NOT NULL COMMENT 'UTC创建时间',
+  updated_at DATETIME(3) NOT NULL COMMENT 'UTC更新时间',
+  task_id BIGINT NOT NULL COMMENT '本次执行请求',
+  execution_purpose VARCHAR(16) NOT NULL COMMENT '从逻辑任务冻结继承，验证尝试不能作为正式统计版本',
+  scope_id BIGINT NULL COMMENT '仅账号共享发现为空；分仓执行必须有作用域',
+  source_account VARCHAR(64) NOT NULL COMMENT '受控来源账号别名，不保存密钥',
+  warehouse_code VARCHAR(64) NULL COMMENT '来源仓库原始编码，按仓独立统计',
+  run_role VARCHAR(24) NOT NULL COMMENT 'ACCOUNT_DISCOVERY 或 WAREHOUSE_SYNC',
+  upstream_task_id BIGINT NULL COMMENT '分仓出库计算引用的共享切片及其稳定暂存集合',
+  attempt_no INT NOT NULL COMMENT '同一请求从 1 起递增',
+  scope_hash CHAR(64) NOT NULL COMMENT '本版本的业务范围摘要',
+  scope_snapshot_json JSON NOT NULL COMMENT '分仓版只含本仓货主／品质、固定首采 [B,E0)、时区、调度与过期阈值；账号发现保存待路由仓集合，不冒充业务版',
+  observed_dimensions_json JSON NULL COMMENT '本次实际出现的仓库／货主集合及数量摘要，仅作采集证据；例如已观测 70 货主不等于固定授权范围',
+  fence_token BIGINT NOT NULL COMMENT '本尝试持有的栅栏版本',
+  base_published_run_id BIGINT NULL COMMENT '执行开始时的上一可见版本',
+  reference_sales_run_id BIGINT NULL COMMENT '库存构建开始时固定的本仓已发布销量版，用其不可变 SKU 维度生成出库已知商品占位；没有已发布销量版时为空，不读取半归并订单事实',
+  inventory_daily_sample_date DATE NULL COMMENT '北京时间当日首个合格计划库存发布代表日期，非代表为空',
+  inventory_sample_rule_version VARCHAR(32) NULL COMMENT '日库存代表选择规则 DAILY_SCHEDULED_FIRST_V1，与日标记原子保存',
+  status VARCHAR(24) NOT NULL COMMENT 'FETCHING、VALIDATED、ROUTED、FACTS_APPLIED、BUILDING、READY、PUBLISHED、REUSED、YIELDED、FAILED、ABORTED、SAMPLE_DONE；复用和验证不是版本头',
+  last_phase VARCHAR(24) NOT NULL COMMENT '失败／中止前所在阶段，支持判断是否已经归并事实',
+  fetch_started_at_utc DATETIME(3) NULL COMMENT '实际采集开始UTC时间',
+  fetch_finished_at_utc DATETIME(3) NULL COMMENT '实际采集完成UTC时间，未完成为空',
+  build_started_at_utc DATETIME(3) NULL COMMENT '实际开始有界候选构建UTC时间，用于构建耗时及首采合并间隔',
+  warehouse_daily_ready TINYINT NOT NULL DEFAULT 0 COMMENT '仓库日汇总已完整构建并校验，含完整空版本',
+  finished_at_utc DATETIME(3) NULL COMMENT '本次尝试终止UTC时间',
+  published_at_utc DATETIME(3) NULL COMMENT '实际原子切换发布指针UTC时间',
+  superseded_at_utc DATETIME(3) NULL COMMENT '被新发布版替代的首次UTC时间，同事务填写且重试不重置',
+  page_count INT NOT NULL DEFAULT 0 COMMENT '已完整获取页数',
+  source_total_count BIGINT NULL COMMENT '上游可靠返回的总数；未返回则为空',
+  unique_object_count BIGINT NOT NULL DEFAULT 0 COMMENT '规范化去重后对象数',
+  progress_snapshot_json JSON NULL COMMENT '尝试终止时冻结的有界可靠进度摘要，历史尝试不随逻辑任务改写',
+  heartbeat_at_utc DATETIME(3) NULL COMMENT '有效执行者最新UTC心跳，不代表业务检查点推进',
+  coverage_status VARCHAR(16) NOT NULL COMMENT 'UNKNOWN、PARTIAL、COMPLETE；分页完整与数值有效性分别判断',
+  covered_from_utc DATETIME(3) NULL COMMENT '本仓销量版本实际连续覆盖UTC下界',
+  covered_until_utc DATETIME(3) NULL COMMENT '本仓销量版本实际连续覆盖UTC上界，不含端点',
+  complete_day_from DATE NULL COMMENT '本仓完整自然日区间首日，包含',
+  complete_day_until DATE NULL COMMENT '本仓完整自然日区间末日，不含',
+  applied_fact_revision BIGINT NULL COMMENT '本次尝试归并后的事实修订号，库存为空',
+  calculated_fact_revision BIGINT NULL COMMENT '候选销量版本计算所依据的固定事实修订号',
+  error_code VARCHAR(64) NULL COMMENT '内部可诊断错误分类，不保存认证信息',
+  error_message VARCHAR(500) NULL COMMENT '脱敏后的固定错误摘要',
+  PRIMARY KEY (id),
+  UNIQUE KEY uk_selfop_run_attempt (task_id,attempt_no),
+  UNIQUE KEY uk_selfop_inventory_daily (source_account,warehouse_code,inventory_daily_sample_date),
+  KEY idx_selfop_run_scope (scope_id,id),
+  KEY idx_selfop_run_status (status,updated_at),
+  CONSTRAINT chk_selfop_inventory_daily CHECK ((inventory_daily_sample_date IS NULL AND inventory_sample_rule_version IS NULL) OR (inventory_daily_sample_date IS NOT NULL AND inventory_sample_rule_version IS NOT NULL AND inventory_sample_rule_version = 'DAILY_SCHEDULED_FIRST_V1' AND execution_purpose = 'BUSINESS' AND run_role = 'WAREHOUSE_SYNC' AND status = 'PUBLISHED' AND coverage_status = 'COMPLETE')),
+  CONSTRAINT chk_selfop_sync_run CHECK (attempt_no > 0 AND page_count >= 0 AND unique_object_count >= 0 AND execution_purpose IN ('BUSINESS','VALIDATION') AND (execution_purpose <> 'VALIDATION' OR status NOT IN ('PUBLISHED','REUSED')) AND (source_total_count IS NULL OR source_total_count >= 0) AND ((run_role = 'ACCOUNT_DISCOVERY' AND scope_id IS NULL AND warehouse_code IS NULL) OR (run_role = 'WAREHOUSE_SYNC' AND scope_id IS NOT NULL AND warehouse_code IS NOT NULL)))
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_bin COMMENT='执行尝试、覆盖证明和版本头';
+
+CREATE TABLE ll_selfop_sync_stage (
+  id BIGINT NOT NULL COMMENT '应用生成的记录标识',
+  created_at DATETIME(3) NOT NULL COMMENT 'UTC创建时间',
+  updated_at DATETIME(3) NOT NULL COMMENT 'UTC更新时间',
+  run_id BIGINT NOT NULL COMMENT '首次写入该暂存对象的执行尝试',
+  stage_batch_id BIGINT NOT NULL COMMENT '出库取共享发现 task.id，便于断点续取；库存取本次 run.id，严禁跨尝试混页',
+  last_fetch_run_id BIGINT NOT NULL COMMENT '最后一次补齐该对象的执行尝试，保留重试来源',
+  observation_sequence BIGINT NULL COMMENT '该完整出库详情实际请求的采集代次；有效出库对象必填，目录待补对象和库存为空；不能填 task 调度序号',
+  warehouse_code VARCHAR(64) NOT NULL COMMENT '来源仓库原始编码，按仓独立统计',
+  previous_warehouse_code VARCHAR(64) NULL COMMENT '路由时从已有单据识别的原仓库；归并前再校验，跨仓时通知两仓',
+  object_type VARCHAR(16) NOT NULL COMMENT 'OUTBOUND_ORDER 或 PRODUCT_STOCK',
+  object_key_hash CHAR(64) NOT NULL COMMENT '规范化业务键摘要；原业务键保留在载荷中并核对',
+  first_page_no INT NOT NULL COMMENT '首次发现页码',
+  observed_at_utc DATETIME(3) NOT NULL COMMENT '实际接收该对象的时刻',
+  content_hash CHAR(64) NOT NULL COMMENT '完整规范化对象摘要',
+  payload_json JSON NOT NULL COMMENT '目录阶段可先存订单头，详情齐后补完整 SKU；VALID 后不再修改；库存保存产品库存字段',
+  before_payload_json JSON NULL COMMENT '订单归并事务内记录归并前的完整规范化事实；新增单为空',
+  validation_status VARCHAR(16) NOT NULL COMMENT '暂存校验状态：PENDING待核验、VALID有效、INVALID异常',
+  validation_code VARCHAR(64) NULL COMMENT '字段缺失、冲突、未知时区等原因',
+  PRIMARY KEY (id),
+  UNIQUE KEY uk_selfop_stage_object (stage_batch_id,object_type,object_key_hash),
+  KEY idx_selfop_stage_history (object_type,object_key_hash,stage_batch_id),
+  KEY idx_selfop_stage_observation (object_type,object_key_hash,validation_status,observation_sequence),
+  KEY idx_selfop_stage_fact_observation (observation_sequence,warehouse_code,object_type,validation_status,run_id,observed_at_utc),
+  KEY idx_selfop_stage_route (stage_batch_id,warehouse_code,validation_status),
+  CONSTRAINT chk_selfop_sync_stage CHECK (first_page_no > 0 AND (object_type <> 'OUTBOUND_ORDER' OR validation_status <> 'VALID' OR observation_sequence IS NOT NULL))
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_bin COMMENT='待验证事实与修订证据';
+
+CREATE TABLE ll_selfop_outbound_order (
+  id BIGINT NOT NULL COMMENT '应用生成的记录标识',
+  created_at DATETIME(3) NOT NULL COMMENT 'UTC创建时间',
+  updated_at DATETIME(3) NOT NULL COMMENT 'UTC更新时间',
+  source_account VARCHAR(64) NOT NULL COMMENT '受控来源账号别名，不保存密钥',
+  customer_code VARCHAR(64) NOT NULL COMMENT '领星货主原始编码，不等同平台客户标识',
+  warehouse_code VARCHAR(64) NOT NULL COMMENT '来源仓库原始编码，按仓独立统计',
+  delivery_no VARCHAR(128) NOT NULL COMMENT 'OMP 发货单号，采用列表及详情同一身份',
+  source_no VARCHAR(128) NULL COMMENT 'WMS 来源出库单号，缺失不以内部 ID 回退展示',
+  source_status INT NOT NULL COMMENT '原始状态，100 已出库、99 已取消；不改造成内部状态码',
+  source_created_time VARCHAR(64) NULL COMMENT '来源创建时间原始字符串，不使用采集时间替代',
+  source_outbound_time VARCHAR(64) NULL COMMENT '来源实际出库时间原始字符串，不使用采集时间替代',
+  source_timezone VARCHAR(64) NULL COMMENT '解析采用的源时区',
+  outbound_at_utc DATETIME(3) NULL COMMENT '已核准的实际出库时间点；非出库状态可空',
+  business_date DATE NULL COMMENT '已核准业务时区下的出库日',
+  business_timezone VARCHAR(64) NOT NULL COMMENT '该事实当前归属仓所用业务时区，迁仓后重新确定业务日',
+  sales_eligible TINYINT NOT NULL DEFAULT 0 COMMENT '仅已出库、时间与全部数量有效时为 1',
+  revision_no BIGINT NOT NULL DEFAULT 1 COMMENT '该单内容变更次数，不等于拉取次数',
+  content_hash CHAR(64) NOT NULL COMMENT '订单头及完整 SKU 明细规范化摘要',
+  last_run_id BIGINT NOT NULL COMMENT '最后一次确认或修订的执行尝试',
+  last_observation_sequence BIGINT NOT NULL COMMENT '最后接受的完整详情采集代次；仅防旧观测重放，不按 task 调度序号拒绝较晚实际读取的事实，不冒充领星源版本号',
+  PRIMARY KEY (id),
+  UNIQUE KEY uk_selfop_order (source_account,customer_code,delivery_no),
+  KEY idx_selfop_order_daily (source_account,warehouse_code,sales_eligible,business_date,id),
+  KEY idx_selfop_order_run (last_run_id),
+  CONSTRAINT chk_selfop_outbound_order CHECK (revision_no > 0 AND last_observation_sequence > 0 AND sales_eligible IN (0,1) AND (sales_eligible = 0 OR (source_status = 100 AND source_timezone IS NOT NULL AND outbound_at_utc IS NOT NULL AND business_date IS NOT NULL)))
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_bin COMMENT='最后确认的单据事实';
+
+CREATE TABLE ll_selfop_outbound_item (
+  id BIGINT NOT NULL COMMENT '应用生成的记录标识',
+  created_at DATETIME(3) NOT NULL COMMENT 'UTC创建时间',
+  updated_at DATETIME(3) NOT NULL COMMENT 'UTC更新时间',
+  order_id BIGINT NOT NULL COMMENT '对应外部出库事实',
+  sku_code VARCHAR(128) NOT NULL COMMENT '原始 productSku',
+  product_name VARCHAR(255) NULL COMMENT '来源商品名称，仅作展示',
+  actual_quantity DECIMAL(20,6) NOT NULL COMMENT '详情 actualDeliveryQty，必须为非负有效数值',
+  quantity_unit VARCHAR(32) NOT NULL COMMENT '已核准业务单位；未确认单位不发布正式数量统计',
+  PRIMARY KEY (id),
+  UNIQUE KEY uk_selfop_order_sku (order_id,sku_code),
+  KEY idx_selfop_item_sku (sku_code,order_id),
+  CONSTRAINT chk_selfop_outbound_item CHECK (actual_quantity >= 0)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_bin COMMENT='整单替换的实际出库明细';
+
+CREATE TABLE ll_selfop_inventory_snapshot (
+  id BIGINT NOT NULL COMMENT '应用生成的记录标识',
+  created_at DATETIME(3) NOT NULL COMMENT 'UTC创建时间',
+  updated_at DATETIME(3) NOT NULL COMMENT 'UTC更新时间',
+  snapshot_run_id BIGINT NOT NULL COMMENT 'INVENTORY 执行尝试；发布后该批明细不可修改',
+  source_account VARCHAR(64) NOT NULL COMMENT '受控来源账号别名，不保存密钥',
+  customer_code VARCHAR(64) NOT NULL COMMENT '领星货主原始编码，不等同平台客户标识',
+  warehouse_code VARCHAR(64) NOT NULL COMMENT '来源仓库原始编码，按仓独立统计',
+  sku_code VARCHAR(128) NOT NULL COMMENT '原始产品 SKU',
+  product_quality SMALLINT NOT NULL COMMENT '来源品质，当前 0 正品、1 次品；全量均保存，不套用整箱库存',
+  product_name VARCHAR(255) NULL COMMENT '来源名称',
+  physical_quantity DECIMAL(20,6) NULL COMMENT '来源stkQty实物库存，未知为空',
+  available_quantity DECIMAL(20,6) NULL COMMENT '来源useStkQty可用库存，未知为空，不再次扣冻结',
+  frozen_quantity DECIMAL(20,6) NULL COMMENT '来源freezeQty冻结库存，未知为空',
+  transit_quantity DECIMAL(20,6) NULL COMMENT '来源transitQty在途数量，未知为空，不计可售库存',
+  source_unique_key VARCHAR(512) NULL COMMENT '原 uniqueKey4tenant，只作来源证据',
+  observed_at_utc DATETIME(3) NOT NULL COMMENT '所在页实际采集时间；缺行占位取本批采集完成时间',
+  quality_status VARCHAR(16) NOT NULL COMMENT 'VALID、UNKNOWN、INVALID；STALE 按批次年龄实时派生',
+  quality_reason VARCHAR(64) NULL COMMENT 'SOURCE_ROW_MISSING、FIELD_MISSING、NEGATIVE_QUANTITY 等',
+  PRIMARY KEY (id),
+  UNIQUE KEY uk_selfop_stock_snapshot (snapshot_run_id,source_account,customer_code,warehouse_code,sku_code,product_quality),
+  KEY idx_selfop_stock_lookup (source_account,customer_code,warehouse_code,sku_code,product_quality,snapshot_run_id)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_bin COMMENT='产品库存全量批次明细';
+
+CREATE TABLE ll_selfop_sku_daily_sales (
+  id BIGINT NOT NULL COMMENT '应用生成的记录标识',
+  created_at DATETIME(3) NOT NULL COMMENT 'UTC创建时间',
+  updated_at DATETIME(3) NOT NULL COMMENT 'UTC更新时间',
+  sales_run_id BIGINT NOT NULL COMMENT 'OUTBOUND 执行尝试，同时是计算版本',
+  source_account VARCHAR(64) NOT NULL COMMENT '受控来源账号别名，不保存密钥',
+  customer_code VARCHAR(64) NOT NULL COMMENT '领星货主原始编码，不等同平台客户标识',
+  warehouse_code VARCHAR(64) NOT NULL COMMENT '来源仓库原始编码，按仓独立统计',
+  sku_code VARCHAR(128) NOT NULL COMMENT '原始产品 SKU',
+  business_date DATE NOT NULL COMMENT '已核准业务日',
+  outbound_quantity DECIMAL(20,6) NOT NULL COMMENT '有效出库实际件数之和，非负',
+  outbound_order_count BIGINT NOT NULL COMMENT '该维度去重发货单数，非负',
+  quantity_unit VARCHAR(32) NOT NULL COMMENT '同一统计维度内一致的业务单位',
+  PRIMARY KEY (id),
+  UNIQUE KEY uk_selfop_daily_version (sales_run_id,source_account,customer_code,warehouse_code,sku_code,business_date),
+  KEY idx_selfop_daily_window_cover (sales_run_id,source_account,warehouse_code,business_date,customer_code,sku_code,outbound_quantity,outbound_order_count,quantity_unit),
+  KEY idx_selfop_daily_sku_cover (sales_run_id,source_account,warehouse_code,customer_code,sku_code,business_date,outbound_quantity,outbound_order_count,quantity_unit),
+  CONSTRAINT chk_selfop_sku_daily_sales CHECK (outbound_quantity >= 0 AND outbound_order_count >= 0)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_bin COMMENT='完整销量版本的稀疏日事实';
+
+CREATE TABLE ll_selfop_warehouse_daily_sales (
+  sales_run_id BIGINT NOT NULL COMMENT '完整销量计算版本标识',
+  source_account VARCHAR(64) NOT NULL COMMENT '受控来源账号别名，不保存密钥',
+  warehouse_code VARCHAR(64) NOT NULL COMMENT '来源仓库原始编码',
+  business_date DATE NOT NULL COMMENT '已核准业务日',
+  observed_quantity DECIMAL(38,6) NULL COMMENT '该日PCS非负有效出库量之和，无有效行时为空',
+  invalid_row_count BIGINT NOT NULL COMMENT '该日数量为空或负数或单位非PCS的日事实行数',
+  source_row_count BIGINT NOT NULL COMMENT '该日参与仓库汇总的SKU日事实总行数',
+  created_at DATETIME(3) NOT NULL COMMENT 'UTC创建时间',
+  updated_at DATETIME(3) NOT NULL COMMENT 'UTC更新时间',
+  PRIMARY KEY (sales_run_id,source_account,warehouse_code,business_date),
+  CONSTRAINT chk_selfop_warehouse_daily_sales CHECK (source_row_count > 0 AND invalid_row_count >= 0 AND invalid_row_count <= source_row_count AND (observed_quantity IS NULL OR observed_quantity >= 0))
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_bin COMMENT='完整销量版本按仓按日汇总，随SKU日事实批次原子构建';
+
+CREATE TABLE ll_selfop_sku_profile (
+  id BIGINT NOT NULL COMMENT '应用生成的记录标识',
+  created_at DATETIME(3) NOT NULL COMMENT 'UTC创建时间',
+  updated_at DATETIME(3) NOT NULL COMMENT 'UTC更新时间',
+  profile_run_id BIGINT NOT NULL COMMENT '本仓销量或库存候选版本；与对应 daily／snapshot 使用同一 run，发布后该版本全部维度行不可修改',
+  source_account VARCHAR(64) NOT NULL COMMENT '受控来源账号别名，不保存密钥',
+  customer_code VARCHAR(64) NOT NULL COMMENT '领星货主原始编码，不等同平台客户标识',
+  warehouse_code VARCHAR(64) NOT NULL COMMENT '来源仓库原始编码，按仓独立统计',
+  sku_code VARCHAR(128) NOT NULL COMMENT '原始产品 SKU',
+  product_name VARCHAR(255) NULL COMMENT '本版本确认的名称，不实时连接其他版本名称',
+  quantity_unit VARCHAR(32) NULL COMMENT '本版本已核准单位；未知或两版本单位冲突时不计算混合指标',
+  first_seen_at_utc DATETIME(3) NULL COMMENT '本证据族真实观测到本仓商品的最早接收时刻；缺行占位不能生成观察证据',
+  earliest_evidence_at_utc DATETIME(3) NULL COMMENT '库存版取真实库存首次观察时刻；销量版从该版有效事实重新求最早已核准出库时间，可随改期、取消或迁仓撤回／后移',
+  evidence_type VARCHAR(24) NOT NULL COMMENT 'INVENTORY_OBSERVATION、VALID_OUTBOUND、NONE；不得将销量证据复制成库存真实观察证据',
+  evidence_run_id BIGINT NULL COMMENT '本证据族真实依据的采集批次，无证据占位为空',
+  last_seen_run_id BIGINT NULL COMMENT '本证据族最近真实观测批次，无证据占位为空',
+  PRIMARY KEY (id),
+  UNIQUE KEY uk_selfop_profile_version (profile_run_id,source_account,customer_code,warehouse_code,sku_code),
+  KEY idx_selfop_profile_evidence (profile_run_id,earliest_evidence_at_utc,customer_code,sku_code)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_bin COMMENT='随发布版本固定的 SKU 维度与观察依据';
+
+-- PDA cargo discard photo evidence
+CREATE TABLE IF NOT EXISTS ll_cargo_discard_photo (
+  id BIGINT NOT NULL COMMENT '照片记录标识',
+  customer_id VARCHAR(64) NOT NULL COMMENT '所属客户标识',
+  application_id BIGINT NOT NULL COMMENT '废弃申请标识',
+  pallet_no VARCHAR(128) NOT NULL COMMENT '托盘业务码',
+  file_id BIGINT NOT NULL COMMENT '照片文件标识',
+  file_name VARCHAR(255) NOT NULL COMMENT '原始文件名',
+  content_type VARCHAR(128) NOT NULL COMMENT '文件媒体类型',
+  size_bytes BIGINT NOT NULL COMMENT '文件字节数',
+  operator_id VARCHAR(64) NOT NULL COMMENT '上传操作人标识',
+  created_at DATETIME(6) NOT NULL COMMENT '照片创建时间',
+  submitted_at DATETIME(6) NULL COMMENT '照片提交时间',
+  PRIMARY KEY (id),
+  UNIQUE KEY uk_cargo_discard_photo_file (file_id),
+  KEY idx_cargo_discard_photo_application (customer_id, application_id, pallet_no)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci COMMENT='海外PDA货物废弃照片凭证';
+
+CREATE TABLE ll_selfop_owner (
+  id BIGINT NOT NULL COMMENT '主键',
+  run_id BIGINT NOT NULL COMMENT '完整资料采集版本',
+  source_account VARCHAR(64) COLLATE utf8mb4_bin NOT NULL COMMENT '来源账号',
+  customer_code VARCHAR(64) COLLATE utf8mb4_bin NOT NULL COMMENT '领星货主编码',
+  customer_name VARCHAR(255) NULL COMMENT '领星货主名称',
+  source_status VARCHAR(32) NULL COMMENT '来源启停状态',
+  observed_at_utc DATETIME(6) NOT NULL COMMENT '资料观测时间',
+  PRIMARY KEY (id),
+  UNIQUE KEY uk_selfop_owner_version (run_id,source_account,customer_code),
+  KEY idx_selfop_owner_lookup (source_account,customer_code,run_id)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COMMENT='自营领星货主资料版本';
+
+CREATE TABLE ll_selfop_product (
+  id BIGINT NOT NULL COMMENT '主键',
+  run_id BIGINT NOT NULL COMMENT '完整资料采集版本',
+  source_account VARCHAR(64) COLLATE utf8mb4_bin NOT NULL COMMENT '来源账号',
+  customer_code VARCHAR(64) COLLATE utf8mb4_bin NOT NULL COMMENT '领星货主编码',
+  sku_code VARCHAR(128) COLLATE utf8mb4_bin NOT NULL COMMENT '货主商品编码',
+  product_name VARCHAR(255) NULL COMMENT '商品名称',
+  declared_length DECIMAL(24,6) NULL COMMENT '商品资料长度',
+  declared_width DECIMAL(24,6) NULL COMMENT '商品资料宽度',
+  declared_height DECIMAL(24,6) NULL COMMENT '商品资料高度',
+  declared_size_unit VARCHAR(32) NULL COMMENT '商品资料尺寸单位',
+  measured_length DECIMAL(24,6) NULL COMMENT '仓库实测长度',
+  measured_width DECIMAL(24,6) NULL COMMENT '仓库实测宽度',
+  measured_height DECIMAL(24,6) NULL COMMENT '仓库实测高度',
+  measured_size_unit VARCHAR(32) NULL COMMENT '仓库实测尺寸单位',
+  observed_at_utc DATETIME(6) NOT NULL COMMENT '资料观测时间',
+  PRIMARY KEY (id),
+  UNIQUE KEY uk_selfop_product_version (run_id,source_account,customer_code,sku_code),
+  KEY idx_selfop_product_lookup (source_account,customer_code,sku_code,run_id)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COMMENT='自营领星商品资料版本';
+
+-- 仓储转运逐箱测量与清点；仅增加字段，不修改业务数据。
+USE baiyue_lastleg;
+SET @ddl = (SELECT IF(EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_warehouse_transfer_carton' AND column_name='length_cm'), 'SELECT 1', 'ALTER TABLE ll_warehouse_transfer_carton ADD COLUMN length_cm DECIMAL(12,2) NULL COMMENT ''箱子实测长度厘米'''));
+PREPARE transfer_count_stmt FROM @ddl; EXECUTE transfer_count_stmt; DEALLOCATE PREPARE transfer_count_stmt;
+SET @ddl = (SELECT IF(EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_warehouse_transfer_carton' AND column_name='width_cm'), 'SELECT 1', 'ALTER TABLE ll_warehouse_transfer_carton ADD COLUMN width_cm DECIMAL(12,2) NULL COMMENT ''箱子实测宽度厘米'''));
+PREPARE transfer_count_stmt FROM @ddl; EXECUTE transfer_count_stmt; DEALLOCATE PREPARE transfer_count_stmt;
+SET @ddl = (SELECT IF(EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_warehouse_transfer_carton' AND column_name='height_cm'), 'SELECT 1', 'ALTER TABLE ll_warehouse_transfer_carton ADD COLUMN height_cm DECIMAL(12,2) NULL COMMENT ''箱子实测高度厘米'''));
+PREPARE transfer_count_stmt FROM @ddl; EXECUTE transfer_count_stmt; DEALLOCATE PREPARE transfer_count_stmt;
+SET @ddl = (SELECT IF(EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_warehouse_transfer_carton' AND column_name='gross_weight_kg'), 'SELECT 1', 'ALTER TABLE ll_warehouse_transfer_carton ADD COLUMN gross_weight_kg DECIMAL(12,2) NULL COMMENT ''箱子实测重量千克'''));
+PREPARE transfer_count_stmt FROM @ddl; EXECUTE transfer_count_stmt; DEALLOCATE PREPARE transfer_count_stmt;
+SET @ddl = (SELECT IF(EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_warehouse_transfer_carton' AND column_name='counted_quantity'), 'SELECT 1', 'ALTER TABLE ll_warehouse_transfer_carton ADD COLUMN counted_quantity BIGINT NULL COMMENT ''箱内SKU实点件数'''));
+PREPARE transfer_count_stmt FROM @ddl; EXECUTE transfer_count_stmt; DEALLOCATE PREPARE transfer_count_stmt;
+SET @ddl = (SELECT IF(EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_warehouse_transfer_carton' AND column_name='count_idempotency_key'), 'SELECT 1', 'ALTER TABLE ll_warehouse_transfer_carton ADD COLUMN count_idempotency_key VARCHAR(255) NULL COMMENT ''箱内清点幂等键'''));
+PREPARE transfer_count_stmt FROM @ddl; EXECUTE transfer_count_stmt; DEALLOCATE PREPARE transfer_count_stmt;
+SET @ddl = (SELECT IF(EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_warehouse_transfer_carton' AND column_name='count_request_hash'), 'SELECT 1', 'ALTER TABLE ll_warehouse_transfer_carton ADD COLUMN count_request_hash VARCHAR(64) NULL COMMENT ''箱内清点请求摘要'''));
+PREPARE transfer_count_stmt FROM @ddl; EXECUTE transfer_count_stmt; DEALLOCATE PREPARE transfer_count_stmt;
+SET @ddl = (SELECT IF(EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_warehouse_transfer_carton' AND column_name='counted_by'), 'SELECT 1', 'ALTER TABLE ll_warehouse_transfer_carton ADD COLUMN counted_by VARCHAR(128) NULL COMMENT ''箱内清点操作人'''));
+PREPARE transfer_count_stmt FROM @ddl; EXECUTE transfer_count_stmt; DEALLOCATE PREPARE transfer_count_stmt;
+SET @ddl = (SELECT IF(EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_warehouse_transfer_carton' AND column_name='counted_at'), 'SELECT 1', 'ALTER TABLE ll_warehouse_transfer_carton ADD COLUMN counted_at DATETIME(3) NULL COMMENT ''箱内清点完成时间'''));
+PREPARE transfer_count_stmt FROM @ddl; EXECUTE transfer_count_stmt; DEALLOCATE PREPARE transfer_count_stmt;
+
+SET @ddl = (SELECT IF(EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_warehouse_transfer_carton' AND column_name='discrepancy_reason'), 'SELECT 1', 'ALTER TABLE ll_warehouse_transfer_carton ADD COLUMN discrepancy_reason VARCHAR(1000) NULL COMMENT ''实收与预报箱数差异原因'''));
+PREPARE transfer_count_stmt FROM @ddl; EXECUTE transfer_count_stmt; DEALLOCATE PREPARE transfer_count_stmt;
+
+SET @ddl = (SELECT IF(EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_warehouse_transfer_carton' AND column_name='transfer_pallet_id'), 'SELECT 1', 'ALTER TABLE ll_warehouse_transfer_carton ADD COLUMN transfer_pallet_id BIGINT NULL COMMENT ''签收箱所属转运托盘事实ID'''));
+PREPARE transfer_count_stmt FROM @ddl; EXECUTE transfer_count_stmt; DEALLOCATE PREPARE transfer_count_stmt;
+
+-- SKU 申报件数独立于预计箱数；历史未申报件数保持 NULL，实收以 PDA 清点为准。
+SET @ddl = (SELECT IF(EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_warehouse_transfer_item' AND column_name='declared_quantity'), 'SELECT 1', 'ALTER TABLE ll_warehouse_transfer_item ADD COLUMN declared_quantity BIGINT NULL COMMENT ''SKU申报件数，非预计或实收箱数'''));
+PREPARE transfer_quantity_stmt FROM @ddl; EXECUTE transfer_quantity_stmt; DEALLOCATE PREPARE transfer_quantity_stmt;
+
+-- 历史库存基线；执行前必须取得指定环境的建表授权。
+CREATE TABLE IF NOT EXISTS ll_selfop_inventory_flow (
+  id BIGINT NOT NULL COMMENT '应用生成的流水记录标识',
+  source_account VARCHAR(64) NOT NULL COMMENT '受控来源账号',
+  warehouse_code VARCHAR(64) NOT NULL COMMENT '来源仓库编码',
+  customer_code VARCHAR(64) NOT NULL COMMENT '来源货主编码',
+  sku_code VARCHAR(128) NOT NULL COMMENT '来源商品编码',
+  source_flow_id VARCHAR(64) NOT NULL COMMENT '来源流水字符串标识',
+  product_quality INT NOT NULL COMMENT '来源品质，零正品一次品，其他未知',
+  cell_no VARCHAR(128) NULL COMMENT '来源库位编码',
+  inner_batch_no VARCHAR(128) NULL COMMENT '来源内部批次号',
+  bill_no VARCHAR(128) NULL COMMENT '来源业务单号',
+  source_no VARCHAR(128) NULL COMMENT '来源关联单号',
+  bill_type VARCHAR(32) NULL COMMENT '来源业务类型，未验证类型不得参与正式还原',
+  book_qty DECIMAL(20,6) NULL COMMENT '来源记账增减量，未知为空',
+  book_change_qty_raw VARCHAR(64) NULL COMMENT '来源带符号变动量原文',
+  delta_quantity DECIMAL(20,6) NULL COMMENT '解析后的有符号实物变动量',
+  close_quantity DECIMAL(20,6) NULL COMMENT '对应库位批次品质链的结存',
+  source_create_time VARCHAR(64) NULL COMMENT '来源北京时间原文',
+  event_at_utc DATETIME(3) NULL COMMENT '流水发生UTC时刻，无法解析时为空',
+  business_date DATE NULL COMMENT '北京时间业务日期',
+  quantity_unit VARCHAR(16) NULL COMMENT '已确认数量单位，未知为空',
+  content_hash CHAR(64) NOT NULL COMMENT '当前事实内容摘要',
+  revision_no BIGINT NOT NULL COMMENT '同来源流水单调增加的修订号',
+  stage_id BIGINT NOT NULL COMMENT '当前事实对应不可变暂存证据',
+  first_run_id BIGINT NOT NULL COMMENT '首次观察执行尝试',
+  last_run_id BIGINT NOT NULL COMMENT '最近确认执行尝试',
+  last_observed_at DATETIME(3) NOT NULL COMMENT '最近观察UTC时刻',
+  validation_status VARCHAR(16) NOT NULL COMMENT '字段资格，有效或未知',
+  validation_reason VARCHAR(64) NULL COMMENT '数量或身份待核验原因',
+  PRIMARY KEY (id),
+  UNIQUE KEY uk_selfop_flow_source (source_account,warehouse_code,source_flow_id),
+  KEY idx_selfop_flow_sku (source_account,warehouse_code,customer_code,sku_code,event_at_utc),
+  KEY idx_selfop_flow_day (source_account,warehouse_code,business_date),
+  CONSTRAINT chk_selfop_flow_revision CHECK (revision_no > 0)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_bin COMMENT='自营历史库存流水最新事实，旧版本保留于暂存证据';
+
+CREATE TABLE IF NOT EXISTS ll_selfop_inventory_day_version (
+  id BIGINT NOT NULL COMMENT '不可变历史日版本标识',
+  source_account VARCHAR(64) NOT NULL COMMENT '受控来源账号',
+  warehouse_code VARCHAR(64) NOT NULL COMMENT '来源仓库编码',
+  business_date DATE NOT NULL COMMENT '北京时间日末所属日期',
+  scope_hash CHAR(64) NOT NULL COMMENT '业务范围摘要',
+  rule_version VARCHAR(32) NOT NULL COMMENT '日末库存还原规则版本',
+  build_run_id BIGINT NOT NULL COMMENT '历史重建执行尝试',
+  publication_group_id BIGINT NOT NULL COMMENT '必须一起切换的发布组标识',
+  sales_run_id BIGINT NULL COMMENT '构建时固定的销量证据版本',
+  anchor_run_id BIGINT NOT NULL COMMENT '固定的独立库存锚点版本',
+  input_hash CHAR(64) NOT NULL COMMENT '冻结流水修订与覆盖及锚点输入摘要',
+  evidence_json JSON NOT NULL COMMENT '固定输入清单及不可变证据引用',
+  status VARCHAR(16) NOT NULL COMMENT '构建中、就绪、已发布、已替代或失败',
+  head_slot TINYINT NULL COMMENT '当前日头为一，非当前版本为空',
+  valid_sku_count BIGINT NOT NULL DEFAULT 0 COMMENT '合格商品数',
+  unknown_sku_count BIGINT NOT NULL DEFAULT 0 COMMENT '待核验商品数',
+  created_at DATETIME(3) NOT NULL COMMENT '版本创建UTC时刻',
+  published_at DATETIME(3) NULL COMMENT '发布组提交UTC时刻',
+  superseded_at DATETIME(3) NULL COMMENT '被新组替代的UTC时刻',
+  invalidated_at DATETIME(3) NULL COMMENT '已确认输入失效的UTC时刻',
+  invalidation_reason VARCHAR(64) NULL COMMENT '旧版本失效原因',
+  rebuild_run_id BIGINT NULL COMMENT '处理失效版本的重建尝试',
+  PRIMARY KEY (id),
+  UNIQUE KEY uk_selfop_history_head (source_account,warehouse_code,business_date,head_slot),
+  UNIQUE KEY uk_selfop_history_build_day (build_run_id,business_date),
+  KEY idx_selfop_history_group (publication_group_id,status),
+  CONSTRAINT chk_selfop_history_head CHECK (head_slot IS NULL OR (head_slot=1 AND status='PUBLISHED'))
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_bin COMMENT='历史日库存不可变版本及原子发布日头';
+
+CREATE TABLE IF NOT EXISTS ll_selfop_inventory_daily (
+  day_version_id BIGINT NOT NULL COMMENT '所属历史日版本',
+  customer_code VARCHAR(64) NOT NULL COMMENT '来源货主编码',
+  sku_code VARCHAR(128) NOT NULL COMMENT '来源商品编码',
+  product_quality INT NOT NULL COMMENT '来源库存品质',
+  physical_quantity DECIMAL(20,6) NULL COMMENT '日末实物库存，未知为空，已确认零为零',
+  quality_status VARCHAR(16) NOT NULL COMMENT '日末资格，有效或未知',
+  quality_reason VARCHAR(64) NULL COMMENT '缺覆盖或锚点等未知原因',
+  anchor_reference BIGINT NULL COMMENT '独立库存锚点版本',
+  evidence_hash CHAR(64) NOT NULL COMMENT '该日计算证据摘要',
+  source VARCHAR(32) NOT NULL COMMENT '库存来源标记，流水还原',
+  PRIMARY KEY (day_version_id,customer_code,sku_code,product_quality),
+  KEY idx_selfop_daily_identity (customer_code,sku_code,day_version_id),
+  CONSTRAINT chk_selfop_daily_quantity CHECK ((quality_status='VALID' AND physical_quantity IS NOT NULL AND physical_quantity>=0) OR (quality_status='UNKNOWN' AND physical_quantity IS NULL))
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_bin COMMENT='历史日末分货主商品品质实物库存';
+
+-- 仓储转运一箱多SKU清点；仅增加结构，不回填历史业务数据。
+USE baiyue_lastleg;
+SET @ddl = (SELECT IF(EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_warehouse_transfer_carton' AND column_name='sku_items_json'), 'SELECT 1', 'ALTER TABLE ll_warehouse_transfer_carton ADD COLUMN sku_items_json JSON NULL COMMENT ''实收箱内SKU及逐项件数明细'''));
+PREPARE transfer_sku_stmt FROM @ddl; EXECUTE transfer_sku_stmt; DEALLOCATE PREPARE transfer_sku_stmt;
+
+
+-- Appointment work scope, audit and physical batch allocation.
+USE baiyue_lastleg;
+CREATE TABLE IF NOT EXISTS ll_dispatch_appointment_allocation (
+  dispatch_id BIGINT NOT NULL COMMENT '排车单标识',
+  dispatch_item_id BIGINT NOT NULL COMMENT '排车明细标识',
+  plan_pallet_id BIGINT NOT NULL COMMENT '入仓计划托盘标识',
+  batch_key VARCHAR(96) NOT NULL COMMENT '预约稳定批次键',
+  customer_id VARCHAR(64) NOT NULL COMMENT '所属客户标识',
+  source_key VARCHAR(160) NOT NULL COMMENT '货物来源稳定键',
+  destination_key VARCHAR(160) NOT NULL COMMENT '目的地稳定键',
+  package_count INT NOT NULL COMMENT '本票分配实物箱数',
+  PRIMARY KEY(dispatch_item_id,batch_key,source_key,destination_key),
+  KEY idx_dispatch_appointment_batch(batch_key,customer_id),
+  KEY idx_dispatch_appointment_dispatch(dispatch_id)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci COMMENT='排车实物与预约批次逐票分配，原执行域事实';
+CREATE TABLE IF NOT EXISTS ll_appointment_work_commitment (
+  entity_key VARCHAR(160) NOT NULL COMMENT '原业务实体稳定键',
+  state_json LONGTEXT NOT NULL COMMENT '原业务命令产生的只读语义影响基线，不是第二份可编辑计划',
+  impact_version BIGINT NOT NULL DEFAULT 0 COMMENT '承诺影响单调递增版本',
+  PRIMARY KEY (entity_key)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci COMMENT='工作事项承诺影响审计基线';
+CREATE TABLE IF NOT EXISTS ll_appointment_work_guard (
+  id INT NOT NULL COMMENT '工作事项协调锁，固定1',
+  scan_cursor VARCHAR(128) NULL COMMENT '已开船来源同步游标',
+  initialized BOOLEAN NOT NULL DEFAULT FALSE COMMENT '是否完成首次完整来源扫描',
+  scope_version VARCHAR(128) NULL COMMENT '完整同步已确认的权威来源集合版本',
+  scan_scope_version VARCHAR(128) NULL COMMENT '当前扫描来源集合版本，防跨页漂移',
+  completed_at DATETIME(3) NULL COMMENT '最近完整同步UTC时间',
+  requirement_version BIGINT NOT NULL DEFAULT 0 COMMENT '原域命令在同一事务推进的需求版本',
+  synchronized_requirement_version BIGINT NOT NULL DEFAULT 0 COMMENT '完整扫描已消费需求版本',
+  scan_requirement_version BIGINT NOT NULL DEFAULT 0 COMMENT '当前扫描需求版本，防跨页漂移',
+  PRIMARY KEY (id)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci COMMENT='预约工作事项同步与命令串行守卫';
+INSERT INTO ll_appointment_work_guard(id,initialized) SELECT 1,FALSE WHERE NOT EXISTS(SELECT 1 FROM ll_appointment_work_guard WHERE id=1);
+
+CREATE TABLE IF NOT EXISTS ll_appointment_work (
+  work_item_key VARCHAR(96) NOT NULL COMMENT '不可变事项键，业务身份确定性生成',
+  container_booking_id VARCHAR(64) NOT NULL COMMENT '来源柜次内部关联标识，不作展示编号',
+  version INT NOT NULL DEFAULT 0 COMMENT '工作命令乐观锁版本',
+  retired BOOLEAN NOT NULL DEFAULT FALSE COMMENT '已替代或已完成路线需求，不计活动工作',
+  state_json LONGTEXT NOT NULL COMMENT '工作关系责任跟进及影响基线，不保存可编辑业务执行事实',
+  PRIMARY KEY (work_item_key),
+  KEY idx_appointment_work_container (container_booking_id,retired)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci COMMENT='预约工作事项需求与关系';
+
+CREATE TABLE IF NOT EXISTS ll_appointment_work_history (
+  id VARCHAR(36) NOT NULL COMMENT '历史记录标识',
+  work_item_key VARCHAR(96) NOT NULL COMMENT '事项稳定键',
+  operator_id VARCHAR(64) NOT NULL COMMENT '真实操作人员标识',
+  operator_name VARCHAR(128) NULL COMMENT '操作人显示名称',
+  action VARCHAR(48) NOT NULL COMMENT '工作命令或观察动作',
+  summary VARCHAR(2000) NOT NULL COMMENT '处理或责任变更依据',
+  command_key VARCHAR(64) NULL COMMENT '请求幂等键，观察记录为空',
+  request_hash VARCHAR(64) NULL COMMENT '包含操作者的规范请求摘要',
+  response_json LONGTEXT NULL COMMENT '原命令响应快照，重放不随当前状态改变',
+  occurred_at DATETIME(3) NOT NULL COMMENT '历史发生UTC时间',
+  PRIMARY KEY (id),
+  UNIQUE KEY uk_appointment_work_command (work_item_key,command_key),
+  KEY idx_appointment_work_history (work_item_key,occurred_at)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci COMMENT='预约工作事项历史与幂等命令';
+
+-- 新单据短号：相同业务及客户名称缩写共享逻辑秒，避免同秒或多实例重号。
+CREATE TABLE IF NOT EXISTS ll_compact_number_clock (
+  number_key VARCHAR(16) NOT NULL COMMENT '业务前缀和客户名称缩写',
+  last_second BIGINT NOT NULL COMMENT '最后分配的Unix逻辑秒',
+  PRIMARY KEY (number_key)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci COMMENT='海外业务短单号分配时钟';
+-- 库存转运无需再次预约入仓；目标库：lastleg-service 所属数据库。可重复执行。
+SET @ddl = (SELECT IF(EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_warehouse_transfer_order' AND column_name='estimated_arrival_at' AND is_nullable='NO'), 'ALTER TABLE ll_warehouse_transfer_order MODIFY COLUMN estimated_arrival_at DATETIME(3) NULL COMMENT ''预计入仓时间，库存转运不填写''', 'SELECT 1'));
+PREPARE stmt FROM @ddl; EXECUTE stmt; DEALLOCATE PREPARE stmt;
diff --git a/lastleg-service/src/main/resources/db/return-sku-conversion.sql b/lastleg-service/src/main/resources/db/return-sku-conversion.sql
new file mode 100644
index 000000000..0a22307ed
--- /dev/null
+++ b/lastleg-service/src/main/resources/db/return-sku-conversion.sql
@@ -0,0 +1,28 @@
+-- SKU 换标实物转换：先执行本增量，再部署服务。不会自动改写存量业务事实。
+SET @return_sku_ddl = (SELECT IF(EXISTS(SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_return_inventory_carton_item' AND column_name='relabelled_quantity'), 'SELECT 1', 'ALTER TABLE ll_return_inventory_carton_item ADD COLUMN relabelled_quantity BIGINT NOT NULL DEFAULT 0 COMMENT ''当前SKU已经换标的实物件数，不可二次换标'''));
+PREPARE return_sku_stmt FROM @return_sku_ddl; EXECUTE return_sku_stmt; DEALLOCATE PREPARE return_sku_stmt;
+CREATE TABLE IF NOT EXISTS ll_return_sku_conversion (
+ id BIGINT NOT NULL COMMENT 'SKU库存转换记录ID',
+ customer_id VARCHAR(128) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL COMMENT '客户隔离键',
+ overseas_warehouse_id VARCHAR(128) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL COMMENT '操作海外仓ID',
+ application_id BIGINT NOT NULL COMMENT '换标申请ID',
+ relabel_no VARCHAR(64) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL COMMENT '换标单号',
+ item_id BIGINT NOT NULL COMMENT '换标箱级明细ID',
+ round_key VARCHAR(64) NOT NULL COMMENT '作业轮次，退回重做使用新轮次',
+ carton_id BIGINT NOT NULL COMMENT '实物来源包裹或箱ID',
+ carton_mark VARCHAR(128) NOT NULL COMMENT '完工时仓库识别码',
+ old_sku_code VARCHAR(128) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL COMMENT '换标前SKU',
+ new_sku_code VARCHAR(128) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NOT NULL COMMENT '换标后SKU',
+ product_name_zh VARCHAR(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NULL COMMENT '中文品名快照',
+ quantity BIGINT NOT NULL COMMENT '实际完成转换件数',
+ status VARCHAR(32) NOT NULL COMMENT 'APPLIED待客户确认/CONFIRMED已确认/REVERSED退回冲回',
+ ownership_json LONGTEXT NOT NULL COMMENT '本次转换件数的来源退货单快照，供精确冲回',
+ completed_at DATETIME(3) NOT NULL COMMENT '实物SKU转换时间',
+ confirmed_at DATETIME(3) NULL COMMENT '客户确认时间',
+ reversed_at DATETIME(3) NULL COMMENT '退回冲回时间',
+ PRIMARY KEY(id),
+ UNIQUE KEY uk_return_sku_conversion_round(item_id,round_key,old_sku_code,new_sku_code),
+ KEY idx_return_sku_conversion_app(customer_id,application_id,status),
+ KEY idx_return_sku_conversion_carton(customer_id,carton_id),
+ CONSTRAINT chk_return_sku_conversion_quantity CHECK(quantity>0)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci COMMENT='退货实物SKU换标库存转换和冲回记录';
diff --git a/lastleg-service/src/main/resources/db/selfop-inventory-history.sql b/lastleg-service/src/main/resources/db/selfop-inventory-history.sql
new file mode 100644
index 000000000..9b3904491
--- /dev/null
+++ b/lastleg-service/src/main/resources/db/selfop-inventory-history.sql
@@ -0,0 +1,82 @@
+-- 历史库存基线；执行前必须取得指定环境的建表授权。
+CREATE TABLE IF NOT EXISTS ll_selfop_inventory_flow (
+  id BIGINT NOT NULL COMMENT '应用生成的流水记录标识',
+  source_account VARCHAR(64) NOT NULL COMMENT '受控来源账号',
+  warehouse_code VARCHAR(64) NOT NULL COMMENT '来源仓库编码',
+  customer_code VARCHAR(64) NOT NULL COMMENT '来源货主编码',
+  sku_code VARCHAR(128) NOT NULL COMMENT '来源商品编码',
+  source_flow_id VARCHAR(64) NOT NULL COMMENT '来源流水字符串标识',
+  product_quality INT NOT NULL COMMENT '来源品质，零正品一次品，其他未知',
+  cell_no VARCHAR(128) NULL COMMENT '来源库位编码',
+  inner_batch_no VARCHAR(128) NULL COMMENT '来源内部批次号',
+  bill_no VARCHAR(128) NULL COMMENT '来源业务单号',
+  source_no VARCHAR(128) NULL COMMENT '来源关联单号',
+  bill_type VARCHAR(32) NULL COMMENT '来源业务类型，未验证类型不得参与正式还原',
+  book_qty DECIMAL(20,6) NULL COMMENT '来源记账增减量，未知为空',
+  book_change_qty_raw VARCHAR(64) NULL COMMENT '来源带符号变动量原文',
+  delta_quantity DECIMAL(20,6) NULL COMMENT '解析后的有符号实物变动量',
+  close_quantity DECIMAL(20,6) NULL COMMENT '对应库位批次品质链的结存',
+  source_create_time VARCHAR(64) NULL COMMENT '来源北京时间原文',
+  event_at_utc DATETIME(3) NULL COMMENT '流水发生UTC时刻，无法解析时为空',
+  business_date DATE NULL COMMENT '北京时间业务日期',
+  quantity_unit VARCHAR(16) NULL COMMENT '已确认数量单位，未知为空',
+  content_hash CHAR(64) NOT NULL COMMENT '当前事实内容摘要',
+  revision_no BIGINT NOT NULL COMMENT '同来源流水单调增加的修订号',
+  stage_id BIGINT NOT NULL COMMENT '当前事实对应不可变暂存证据',
+  first_run_id BIGINT NOT NULL COMMENT '首次观察执行尝试',
+  last_run_id BIGINT NOT NULL COMMENT '最近确认执行尝试',
+  last_observed_at DATETIME(3) NOT NULL COMMENT '最近观察UTC时刻',
+  validation_status VARCHAR(16) NOT NULL COMMENT '字段资格，有效或未知',
+  validation_reason VARCHAR(64) NULL COMMENT '数量或身份待核验原因',
+  PRIMARY KEY (id),
+  UNIQUE KEY uk_selfop_flow_source (source_account,warehouse_code,source_flow_id),
+  KEY idx_selfop_flow_sku (source_account,warehouse_code,customer_code,sku_code,event_at_utc),
+  KEY idx_selfop_flow_day (source_account,warehouse_code,business_date),
+  CONSTRAINT chk_selfop_flow_revision CHECK (revision_no > 0)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_bin COMMENT='自营历史库存流水最新事实，旧版本保留于暂存证据';
+
+CREATE TABLE IF NOT EXISTS ll_selfop_inventory_day_version (
+  id BIGINT NOT NULL COMMENT '不可变历史日版本标识',
+  source_account VARCHAR(64) NOT NULL COMMENT '受控来源账号',
+  warehouse_code VARCHAR(64) NOT NULL COMMENT '来源仓库编码',
+  business_date DATE NOT NULL COMMENT '北京时间日末所属日期',
+  scope_hash CHAR(64) NOT NULL COMMENT '业务范围摘要',
+  rule_version VARCHAR(32) NOT NULL COMMENT '日末库存还原规则版本',
+  build_run_id BIGINT NOT NULL COMMENT '历史重建执行尝试',
+  publication_group_id BIGINT NOT NULL COMMENT '必须一起切换的发布组标识',
+  sales_run_id BIGINT NULL COMMENT '构建时固定的销量证据版本',
+  anchor_run_id BIGINT NOT NULL COMMENT '固定的独立库存锚点版本',
+  input_hash CHAR(64) NOT NULL COMMENT '冻结流水修订与覆盖及锚点输入摘要',
+  evidence_json JSON NOT NULL COMMENT '固定输入清单及不可变证据引用',
+  status VARCHAR(16) NOT NULL COMMENT '构建中、就绪、已发布、已替代或失败',
+  head_slot TINYINT NULL COMMENT '当前日头为一，非当前版本为空',
+  valid_sku_count BIGINT NOT NULL DEFAULT 0 COMMENT '合格商品数',
+  unknown_sku_count BIGINT NOT NULL DEFAULT 0 COMMENT '待核验商品数',
+  created_at DATETIME(3) NOT NULL COMMENT '版本创建UTC时刻',
+  published_at DATETIME(3) NULL COMMENT '发布组提交UTC时刻',
+  superseded_at DATETIME(3) NULL COMMENT '被新组替代的UTC时刻',
+  invalidated_at DATETIME(3) NULL COMMENT '已确认输入失效的UTC时刻',
+  invalidation_reason VARCHAR(64) NULL COMMENT '旧版本失效原因',
+  rebuild_run_id BIGINT NULL COMMENT '处理失效版本的重建尝试',
+  PRIMARY KEY (id),
+  UNIQUE KEY uk_selfop_history_head (source_account,warehouse_code,business_date,head_slot),
+  UNIQUE KEY uk_selfop_history_build_day (build_run_id,business_date),
+  KEY idx_selfop_history_group (publication_group_id,status),
+  CONSTRAINT chk_selfop_history_head CHECK (head_slot IS NULL OR (head_slot=1 AND status='PUBLISHED'))
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_bin COMMENT='历史日库存不可变版本及原子发布日头';
+
+CREATE TABLE IF NOT EXISTS ll_selfop_inventory_daily (
+  day_version_id BIGINT NOT NULL COMMENT '所属历史日版本',
+  customer_code VARCHAR(64) NOT NULL COMMENT '来源货主编码',
+  sku_code VARCHAR(128) NOT NULL COMMENT '来源商品编码',
+  product_quality INT NOT NULL COMMENT '来源库存品质',
+  physical_quantity DECIMAL(20,6) NULL COMMENT '日末实物库存，未知为空，已确认零为零',
+  quality_status VARCHAR(16) NOT NULL COMMENT '日末资格，有效或未知',
+  quality_reason VARCHAR(64) NULL COMMENT '缺覆盖或锚点等未知原因',
+  anchor_reference BIGINT NULL COMMENT '独立库存锚点版本',
+  evidence_hash CHAR(64) NOT NULL COMMENT '该日计算证据摘要',
+  source VARCHAR(32) NOT NULL COMMENT '库存来源标记，流水还原',
+  PRIMARY KEY (day_version_id,customer_code,sku_code,product_quality),
+  KEY idx_selfop_daily_identity (customer_code,sku_code,day_version_id),
+  CONSTRAINT chk_selfop_daily_quantity CHECK ((quality_status='VALID' AND physical_quantity IS NOT NULL AND physical_quantity>=0) OR (quality_status='UNKNOWN' AND physical_quantity IS NULL))
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_bin COMMENT='历史日末分货主商品品质实物库存';
diff --git a/lastleg-service/src/main/resources/db/selfop-master-data.sql b/lastleg-service/src/main/resources/db/selfop-master-data.sql
new file mode 100644
index 000000000..be7773def
--- /dev/null
+++ b/lastleg-service/src/main/resources/db/selfop-master-data.sql
@@ -0,0 +1,33 @@
+CREATE TABLE ll_selfop_owner (
+  id BIGINT NOT NULL COMMENT '主键',
+  run_id BIGINT NOT NULL COMMENT '完整资料采集版本',
+  source_account VARCHAR(64) COLLATE utf8mb4_bin NOT NULL COMMENT '来源账号',
+  customer_code VARCHAR(64) COLLATE utf8mb4_bin NOT NULL COMMENT '领星货主编码',
+  customer_name VARCHAR(255) NULL COMMENT '领星货主名称',
+  source_status VARCHAR(32) NULL COMMENT '来源启停状态',
+  observed_at_utc DATETIME(6) NOT NULL COMMENT '资料观测时间',
+  PRIMARY KEY (id),
+  UNIQUE KEY uk_selfop_owner_version (run_id,source_account,customer_code),
+  KEY idx_selfop_owner_lookup (source_account,customer_code,run_id)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COMMENT='自营领星货主资料版本';
+
+CREATE TABLE ll_selfop_product (
+  id BIGINT NOT NULL COMMENT '主键',
+  run_id BIGINT NOT NULL COMMENT '完整资料采集版本',
+  source_account VARCHAR(64) COLLATE utf8mb4_bin NOT NULL COMMENT '来源账号',
+  customer_code VARCHAR(64) COLLATE utf8mb4_bin NOT NULL COMMENT '领星货主编码',
+  sku_code VARCHAR(128) COLLATE utf8mb4_bin NOT NULL COMMENT '货主商品编码',
+  product_name VARCHAR(255) NULL COMMENT '商品名称',
+  declared_length DECIMAL(24,6) NULL COMMENT '商品资料长度',
+  declared_width DECIMAL(24,6) NULL COMMENT '商品资料宽度',
+  declared_height DECIMAL(24,6) NULL COMMENT '商品资料高度',
+  declared_size_unit VARCHAR(32) NULL COMMENT '商品资料尺寸单位',
+  measured_length DECIMAL(24,6) NULL COMMENT '仓库实测长度',
+  measured_width DECIMAL(24,6) NULL COMMENT '仓库实测宽度',
+  measured_height DECIMAL(24,6) NULL COMMENT '仓库实测高度',
+  measured_size_unit VARCHAR(32) NULL COMMENT '仓库实测尺寸单位',
+  observed_at_utc DATETIME(6) NOT NULL COMMENT '资料观测时间',
+  PRIMARY KEY (id),
+  UNIQUE KEY uk_selfop_product_version (run_id,source_account,customer_code,sku_code),
+  KEY idx_selfop_product_lookup (source_account,customer_code,sku_code,run_id)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COMMENT='自营领星商品资料版本';
diff --git a/lastleg-service/src/main/resources/db/selfop-quantity-diagnostics.sql b/lastleg-service/src/main/resources/db/selfop-quantity-diagnostics.sql
new file mode 100644
index 000000000..deaac3f6a
--- /dev/null
+++ b/lastleg-service/src/main/resources/db/selfop-quantity-diagnostics.sql
@@ -0,0 +1,53 @@
+-- Independent diagnostic tables in the Lastleg schema. No business fact/queue writes.
+-- Run only after explicit TEST SQL approval. Not executed by service startup.
+CREATE TABLE ll_selfop_quantity_diagnostic_session (
+  diagnostic_session_id VARCHAR(128) NOT NULL COMMENT '固定有界数量诊断会话标识',
+  configuration_hash CHAR(64) NOT NULL COMMENT '冻结授权范围的SHA256摘要',
+  source_account VARCHAR(64) NOT NULL COMMENT '来源账号别名，不保存凭据',
+  collection_session_id VARCHAR(128) NULL COMMENT '被观察的来源采集会话标识',
+  root_task_id VARCHAR(128) NULL COMMENT '被观察的账号采集根任务标识',
+  starts_at VARCHAR(40) NOT NULL COMMENT '诊断开始时刻，ISO8601 UTC字符串',
+  expires_at VARCHAR(40) NOT NULL COMMENT '诊断截止时刻，首个LIST观测后最多4小时且授权后最多10小时，ISO8601 UTC字符串',
+  accepted_orders INT NOT NULL DEFAULT 0 COMMENT '已接收完整配对订单数，跨重启累计',
+  accepted_sku_rows INT NOT NULL DEFAULT 0 COMMENT '两侧已保留SKU行数，跨重启累计',
+  accepted_bytes BIGINT NOT NULL DEFAULT 0 COMMENT '已持久化白名单规范JSON的UTF8字节数',
+  stop_reason VARCHAR(64) NULL COMMENT '诊断终止原因，空值表示尚未终止',
+  active_slot INT NULL COMMENT '当前授权占位，终态释放；旧证据不自动授权',
+  state_json LONGTEXT NULL COMMENT '新授权的持久生命周期；NULL仅表示未参与此协议的历史证据',
+  UNIQUE KEY uq_qdiag_active (source_account, active_slot),
+  CONSTRAINT chk_qdiag_active CHECK (active_slot IS NULL OR active_slot = 1),
+  PRIMARY KEY (diagnostic_session_id),
+  CONSTRAINT chk_selfop_qdiag_limits CHECK (accepted_orders BETWEEN 0 AND 100
+    AND accepted_sku_rows BETWEEN 0 AND 2000 AND accepted_bytes BETWEEN 0 AND 2097152)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_bin COMMENT='独立数量对照诊断会话，重启不重置限额';
+
+CREATE TABLE ll_selfop_quantity_diagnostic_order (
+  diagnostic_session_id VARCHAR(128) NOT NULL COMMENT '所属固定诊断会话标识',
+  order_key_hash CHAR(64) NOT NULL COMMENT '账号、仓库、货主、出库单业务键的SHA256摘要',
+  source_account VARCHAR(64) NOT NULL COMMENT '来源账号别名',
+  warehouse_code VARCHAR(64) NOT NULL COMMENT '来源仓库编码',
+  owner_code VARCHAR(128) NOT NULL COMMENT '来源货主编码',
+  order_no VARCHAR(128) NOT NULL COMMENT '来源出库单号',
+  payload_hash CHAR(64) NOT NULL COMMENT '白名单规范载荷SHA256摘要，用于幂等校验',
+  comparison VARCHAR(40) NOT NULL COMMENT 'SKU集合与三类数量比较结果',
+  sku_rows INT NOT NULL COMMENT '本单两侧较大的SKU行数；两侧累计额度由会话约束',
+  payload_bytes INT NOT NULL COMMENT '本单白名单规范JSON的UTF8字节数',
+  evidence_json JSON NOT NULL COMMENT '类型化列表与详情观测及SKU三量证据，不含原始响应或收件信息',
+  received_at VARCHAR(40) NOT NULL COMMENT '接收时刻，ISO8601 UTC字符串',
+  PRIMARY KEY (diagnostic_session_id, order_key_hash),
+  CONSTRAINT fk_selfop_qdiag_session FOREIGN KEY (diagnostic_session_id)
+    REFERENCES ll_selfop_quantity_diagnostic_session(diagnostic_session_id),
+  CONSTRAINT chk_selfop_qdiag_order_limits CHECK (sku_rows BETWEEN 1 AND 200
+    AND payload_bytes BETWEEN 1 AND 262144)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_bin COMMENT='独立配对订单数量诊断证据，不参与销量发布';
+
+CREATE TABLE ll_selfop_quantity_diagnostic_pending (
+ diagnostic_session_id VARCHAR(128) NOT NULL,
+ order_key_hash CHAR(64) NOT NULL,
+ warehouse_code VARCHAR(64) NOT NULL,
+ owner_code VARCHAR(128) NOT NULL,
+ order_no VARCHAR(128) NOT NULL,
+ evidence_json LONGTEXT NOT NULL,
+ PRIMARY KEY(diagnostic_session_id,order_key_hash),
+ FOREIGN KEY(diagnostic_session_id) REFERENCES ll_selfop_quantity_diagnostic_session(diagnostic_session_id)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_bin COMMENT='首次LIST白名单证据；配对后同事务移至最终证据表';
diff --git a/lastleg-service/src/main/resources/db/selfop-warehouse-daily-sales.sql b/lastleg-service/src/main/resources/db/selfop-warehouse-daily-sales.sql
new file mode 100644
index 000000000..fc0c9f2b4
--- /dev/null
+++ b/lastleg-service/src/main/resources/db/selfop-warehouse-daily-sales.sql
@@ -0,0 +1,21 @@
+CREATE TABLE IF NOT EXISTS ll_selfop_warehouse_daily_sales (
+  sales_run_id BIGINT NOT NULL COMMENT '完整销量计算版本标识',
+  source_account VARCHAR(64) NOT NULL COMMENT '受控来源账号别名，不保存密钥',
+  warehouse_code VARCHAR(64) NOT NULL COMMENT '来源仓库原始编码',
+  business_date DATE NOT NULL COMMENT '已核准业务日',
+  observed_quantity DECIMAL(38,6) NULL COMMENT '该日PCS非负有效出库量之和，无有效行时为空',
+  invalid_row_count BIGINT NOT NULL COMMENT '该日数量为空或负数或单位非PCS的日事实行数',
+  source_row_count BIGINT NOT NULL COMMENT '该日参与仓库汇总的SKU日事实总行数',
+  created_at DATETIME(3) NOT NULL COMMENT 'UTC创建时间',
+  updated_at DATETIME(3) NOT NULL COMMENT 'UTC更新时间',
+  PRIMARY KEY (sales_run_id,source_account,warehouse_code,business_date),
+  CONSTRAINT chk_selfop_warehouse_daily_sales CHECK (source_row_count > 0 AND invalid_row_count >= 0 AND invalid_row_count <= source_row_count AND (observed_quantity IS NULL OR observed_quantity >= 0))
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_bin COMMENT='完整销量版本按仓按日汇总，随SKU日事实批次原子构建';
+
+SET @selfop_warehouse_daily_ready_ddl = IF(
+  EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_selfop_sync_run' AND column_name='warehouse_daily_ready'),
+  'SELECT 1',
+  'ALTER TABLE ll_selfop_sync_run ADD COLUMN warehouse_daily_ready TINYINT NOT NULL DEFAULT 0 COMMENT ''仓库日汇总已完整构建并校验，含完整空版本''');
+PREPARE selfop_warehouse_daily_ready_stmt FROM @selfop_warehouse_daily_ready_ddl;
+EXECUTE selfop_warehouse_daily_ready_stmt;
+DEALLOCATE PREPARE selfop_warehouse_daily_ready_stmt;
diff --git a/lastleg-service/src/main/resources/openapi/appointment-batches-v1.yaml b/lastleg-service/src/main/resources/openapi/appointment-batches-v1.yaml
new file mode 100644
index 000000000..cf958bab9
--- /dev/null
+++ b/lastleg-service/src/main/resources/openapi/appointment-batches-v1.yaml
@@ -0,0 +1,154 @@
+openapi: 3.0.3
+info:
+  title: 预约货物分批与合并
+  version: 1.0.0
+  description: 原子重新分配已有未确认批次。保留原来源、客户、柜及历史；不创建车次、库存或外部确认。
+security:
+  - bearerAuth: []
+paths:
+  /api/platform/v1/last-leg/appointment-planning/batches/{batchKey}:
+    get:
+      operationId: getFbaAppointmentBatchContext
+      summary: 按不可变批次键读取分批资料和操作条件
+      description: >-
+        仅平台，需预约列表及尾程订单列表权限。batchKey为FBA_APPOINTMENT加内部不可变主键，仅供关联，不作为展示编号。
+        返回appointment原快照、sources当前逐来源可用于重新分配的本批数量、allowedActions、blockReasons及currentBatches全部当前去向。
+        currentBatches沿所有替代及客户后送分支读取到当前批次，按稳定键去重，并按原客户、来源、目的地排除无关分支。
+        originalSourceRefs是本批当前及已移出货物的客户/原来源/目的地范围，消费者用它过滤全部当前去向，不能用当前items漏掉已全部移出的客户；它不代表可重新分配的货量。
+        每项为当前批次完整权威快照（合并后可能含其他来源），不是旧批次逐箱归属拆账；消费者按所查看的客户和来源展示对应明细，不把整批合计当成本客户数量。
+        取消和未约成仍保留批次分配及当前去向；缺失关系、循环或超过1000节点明确报错，不返回截断成功或空货量。
+        原批次箱数未知且已独立核实总量时，本批数量由核实总量减其他活动批次分配量计算；不修改旧快照。
+        已替代、已确认或关联排车时不开放分批合并。原来源或核实事实读取失败明确报错，不以空列表冒充无货。
+        allowedActions表示业务资格，前端与FBA预约写权限取交集；实际写入仍在事务内重验。
+      parameters:
+        - {name: batchKey, in: path, required: true, schema: {type: string, pattern: '^FBA_APPOINTMENT:[1-9][0-9]*$'}}
+      responses:
+        '200':
+          description: code=200时data为批次上下文
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  code: {type: string}
+                  data:
+                    type: object
+                    properties:
+                      appointment: {$ref: './fba-appointment-calendar-v1.yaml#/components/schemas/Appointment'}
+                      currentBatches:
+                        type: array
+                        description: 全部当前批次快照，包含未约成、取消后仍需继续安排的批次，不仅返回第一个替代批次
+                        items: {$ref: './fba-appointment-calendar-v1.yaml#/components/schemas/Appointment'}
+                      originalSourceRefs:
+                        type: array
+                        description: 本批当前及历史移出来源，仅供当前去向过滤，不授予重新分配资格
+                        items:
+                          type: object
+                          required: [customerId, sourceKey, destinationKey]
+                          properties:
+                            customerId: {type: string}
+                            sourceKey: {type: string}
+                            destinationKey: {type: string}
+                      sources:
+                        type: array
+                        items:
+                          type: object
+                          properties:
+                            customerId: {type: string}
+                            sourceKey: {type: string}
+                            destinationKey: {type: string}
+                            packageCount: {type: integer, nullable: true, description: 本批分配量或可从独立核实资料确认的本批量}
+                            originalPackages: {type: integer, nullable: true, description: 原订单/登记箱数，独立核实不回写}
+                            sourceVersion: {type: string, nullable: true}
+                            cargoVerificationVersion: {type: integer, nullable: true}
+                            shipmentReferences: {type: array, items: {type: string}}
+                      allowedActions: {type: array, items: {type: string, enum: [VERIFY_CARGO, SPLIT, MERGE]}}
+                      blockReasons: {type: array, items: {type: string}}
+        '400': {description: 批次键格式无效}
+        '403': {description: 非平台或缺少读取权限}
+        '404': {description: 批次或原来源不存在}
+        '409': {description: 原来源变化，需重新核实资料}
+        '503': {description: 原来源权威目录不可用}
+  /api/platform/v1/last-leg/appointment-planning/appointments/repartition:
+    post:
+      operationId: repartitionFbaAppointments
+      summary: 一批分多批或多批合一批
+      description: >-
+        仅平台，需platform:appointment:list、platform:overseas-warehouse:last-mile-order:list及platform:overseas-warehouse:inbound-order:fba-appointment。
+        originals为一条且batches多条表示分批；originals多条且batches一条表示合并，其他组合拒绝。
+        原批次必须同起运仓、同目的仓，尚未正式确认、未被替代且没有有效关联排车。
+        先按稳定批次键有序锁原预约，再锁原BOOKING/订单；版本、来源资格、客户归属及数量均在锁内重新核对。
+        按每个稳定来源分别比较调整前后总量，不能只比较合计箱数或跨客户挪量；逐来源预期版本及核实版本必须与最新资料一致。
+        原批次箱数未知时可采用刚保存的独立核实总量，无需先登记预约确认；仍未知则拒绝。
+        全部旧明细释放、新批次和来源明细建立、替代关系及幂等结果在同一事务内；任一失败全部回滚。
+        原批次仍可详情读取，replacementAppointmentNos和repartitionReason标识替代关系，不能再次编辑或取消；日历和未定时列表只返回当前批次。
+        新批次都是PENDING，仅保存显式计划日期，确认号和确认时段为空；旧柜级提柜、接仓、还空不复制。
+        同键同操作人同请求返回原结果，后续编辑不会改变原重试快照；同键异内容、并发版本或已安排冲突返回409。
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema: {$ref: '#/components/schemas/Repartition'}
+      responses:
+        '200':
+          description: code=200时data为原批次业务号及新批次快照，按请求batches顺序返回
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  code: {type: string}
+                  data:
+                    type: object
+                    properties:
+                      replacedBatchKeys: {type: array, items: {type: string}, description: 被替代的稳定批次键，用于协调原工作需求}
+                      replacedAppointmentNos: {type: array, items: {type: string}}
+                      appointments: {type: array, items: {$ref: './fba-appointment-calendar-v1.yaml#/components/schemas/Appointment'}}
+        '400': {description: 分组不合法、客户/来源替换、数量不守恒或跨起讫点}
+        '403': {description: 非平台或权限不足}
+        '404': {description: 原批次或货源不存在}
+        '409': {description: 原版本变化、来源待核实、已有确认或有效排车、幂等内容冲突}
+        '503': {description: 权威仓库目录或时区暂不可用}
+components:
+  securitySchemes:
+    bearerAuth: {type: http, scheme: bearer, bearerFormat: JWT}
+  schemas:
+    Repartition:
+      type: object
+      required: [originals, batches, reason, idempotencyKey]
+      properties:
+        originals:
+          type: array
+          minItems: 1
+          maxItems: 20
+          items:
+            type: object
+            required: [appointmentNo, version]
+            properties:
+              appointmentNo: {type: string, minLength: 1, maxLength: 64}
+              version: {type: integer, minimum: 0}
+        batches:
+          type: array
+          minItems: 1
+          maxItems: 20
+          items:
+            type: object
+            required: [allocations]
+            properties:
+              plannedDate: {type: string, format: date, nullable: true}
+              remark: {type: string, maxLength: 1000, nullable: true}
+              allocations:
+                type: array
+                minItems: 1
+                maxItems: 100
+                items:
+                  type: object
+                  required: [customerId, sourceKey, packageCount]
+                  properties:
+                    customerId: {type: string, minLength: 1, maxLength: 128}
+                    sourceKey: {type: string, minLength: 1, maxLength: 160}
+                    packageCount: {type: integer, minimum: 1, description: 本批来自该原来源的箱数；不使用零数量占位行}
+                    expectedSourceVersion: {type: string, maxLength: 160, nullable: true, description: 批次上下文sources的sourceVersion；空值也须一致}
+                    expectedVerificationVersion: {type: integer, minimum: 1, nullable: true, description: 批次上下文sources的cargoVerificationVersion，无独立核实时为空}
+        reason: {type: string, minLength: 1, maxLength: 1000}
+        idempotencyKey: {type: string, minLength: 1, maxLength: 64}
diff --git a/lastleg-service/src/main/resources/openapi/appointment-cargo-verification-v1.yaml b/lastleg-service/src/main/resources/openapi/appointment-cargo-verification-v1.yaml
new file mode 100644
index 000000000..c779987f0
--- /dev/null
+++ b/lastleg-service/src/main/resources/openapi/appointment-cargo-verification-v1.yaml
@@ -0,0 +1,114 @@
+openapi: 3.0.3
+info:
+  title: 预约货物核实资料
+  version: 1.0.0
+  description: >-
+    按原ORDER或BOOKING货源保存独立核实资料，不修改订单、登记、库存或预约确认状态。
+    未取得预约确认也可保存箱数和各票货件号。核实记录逐版本追加，取消预约不删除资料。
+security:
+  - bearerAuth: []
+paths:
+  /api/platform/v1/last-leg/appointment-planning/sources/{sourceKey}/cargo-verification:
+    parameters:
+      - {name: sourceKey, in: path, required: true, schema: {type: string, maxLength: 160}, description: 原稳定货源键；外接货来货前后均使用BOOKING键}
+      - {name: customerId, in: query, required: true, schema: {type: string, maxLength: 128}, description: 服务端核对的原客户归属}
+    get:
+      operationId: getAppointmentCargoVerification
+      summary: 读取本票独立核实资料和分配总量
+      description: >-
+        仅平台，需platform:appointment:list与platform:overseas-warehouse:last-mile-order:list。
+        source为权威原来源，verification为空表示尚无独立核实记录。
+        原版本、目的地或原箱数变化后sourceChanged为true，可分配量返回null，重新核实前不得采用旧资料。
+        allocatedPackages合计当前活动预约明细；未知分配单独计数，不当作零。
+        availablePackages为当前有效总量减已分配量，未知、超量或待复核时为空，不虚构可用量。
+        allowedActions表示业务资格；前端仍须与当前用户写权限取交集。
+      parameters:
+        - {name: destinationKey, in: query, schema: {type: string, maxLength: 160}, description: 可传选择时的目的地；与原来源不符则拒绝}
+      responses:
+        '200':
+          description: 业务响应，data为核实上下文
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  code: {type: string}
+                  data: {$ref: '#/components/schemas/CargoContext'}
+        '400': {description: 来源格式或目的地不符}
+        '403': {description: 非平台身份或权限不足}
+        '404': {description: 原来源不存在或客户不匹配}
+        '503': {description: 权威仓库目录不可用}
+    post:
+      operationId: saveAppointmentCargoVerification
+      summary: 独立保存箱数和本票货件或追踪号
+      description: >-
+        仅平台，需两个读取权限及platform:overseas-warehouse:inbound-order:fba-appointment。
+        操作人取登录身份。原货源锁与预约写命令共用，锁后重读来源和版本；expectedVersion首次为0。
+        原来源已知箱数时，核实量不得超过原来源；任何情况下不得低于活动预约已分配量。
+        原来源箱数未知时允许独立核实总量，原来源仍为空。
+        可以暂缺箱数或货件，保存不会自动确认预约；正式确认仍需完整材料。
+        同来源客户内的同幂等键、同操作人、同请求返回原核实版本，即使此后又有新版本。
+        同键异内容、并发版本冲突或原来源变化返回409；记录与业务写入处于同一事务。
+        后续预约写入采用核实版本及货件快照；单独再次核实不会改写已保存预约快照。
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema: {$ref: '#/components/schemas/SaveCargoVerification'}
+      responses:
+        '200':
+          description: 保存或重试原命令的核实资料快照
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  code: {type: string}
+                  data: {$ref: '#/components/schemas/CargoVerification'}
+        '400': {description: 请求字段无效}
+        '403': {description: 非平台身份或缺少独立写权限}
+        '404': {description: 原来源不存在或客户不匹配}
+        '409': {description: 原来源或核实版本变化、幂等冲突、箱数越界或来源不可安排}
+        '503': {description: 权威仓库目录不可用}
+components:
+  securitySchemes:
+    bearerAuth: {type: http, scheme: bearer, bearerFormat: JWT}
+  schemas:
+    SaveCargoVerification:
+      type: object
+      required: [destinationKey, expectedVersion, shipmentReferences, idempotencyKey]
+      properties:
+        destinationKey: {type: string, minLength: 1, maxLength: 160}
+        expectedSourceVersion: {type: string, maxLength: 160, nullable: true, description: 读取上下文中的原来源版本，空值也须一致}
+        expectedVersion: {type: integer, minimum: 0}
+        packageCount: {type: integer, minimum: 1, nullable: true}
+        shipmentReferences: {type: array, maxItems: 100, items: {type: string, minLength: 1, maxLength: 128}, description: 本票货件号或追踪号，允许暂时空列表；保存时去首尾空格并去重}
+        remark: {type: string, maxLength: 1000, nullable: true}
+        idempotencyKey: {type: string, minLength: 1, maxLength: 64}
+    CargoVerification:
+      type: object
+      required: [version, destinationKey, shipmentReferences, verifiedAt]
+      properties:
+        version: {type: integer, minimum: 1}
+        sourceVersion: {type: string, nullable: true}
+        destinationKey: {type: string}
+        sourcePackages: {type: integer, nullable: true}
+        packageCount: {type: integer, nullable: true}
+        shipmentReferences: {type: array, items: {type: string}}
+        remark: {type: string, nullable: true}
+        operatorName: {type: string, nullable: true}
+        verifiedAt: {type: string, format: date-time, description: UTC时间}
+    CargoContext:
+      type: object
+      properties:
+        source: {$ref: './appointment-planning-v1.yaml#/components/schemas/PlanningSource'}
+        verification:
+          allOf: [{$ref: '#/components/schemas/CargoVerification'}]
+          nullable: true
+        allocatedPackages: {type: integer, format: int64}
+        unknownAllocationCount: {type: integer, format: int64}
+        effectivePackages: {type: integer, nullable: true, description: 独立核实箱数；没有核实记录时采用原来源箱数}
+        availablePackages: {type: integer, format: int64, nullable: true}
+        sourceChanged: {type: boolean}
+        allowedActions: {type: array, items: {type: string, enum: [VERIFY_CARGO]}}
+        blockReasons: {type: array, items: {type: string}}
diff --git a/lastleg-service/src/main/resources/openapi/appointment-planning-v1.yaml b/lastleg-service/src/main/resources/openapi/appointment-planning-v1.yaml
index d308929f7..cae7341c6 100644
--- a/lastleg-service/src/main/resources/openapi/appointment-planning-v1.yaml
+++ b/lastleg-service/src/main/resources/openapi/appointment-planning-v1.yaml
@@ -6,6 +6,37 @@ info:
 security:
   - bearerAuth: []
 paths:
+  /api/platform/v1/last-leg/appointment-planning/sources/resolve-order:
+    get:
+      operationId: resolveOrderAppointmentSource
+      summary: 从实际订单读取规范原货源及预约覆盖
+      description: >-
+        仅平台；同时要求platform:appointment:list与platform:overseas-warehouse:last-mile-order:list。
+        入仓列表只知道订单时使用此只读入口；服务端保留外接登记BOOKING键，其他来源返回ORDER键，核对客户、订单关联及目的地。
+        前端后续核实和预约命令必须使用返回的source.sourceKey，不将外接来货改写为ORDER别名。
+      parameters:
+        - {name: orderId, in: query, required: true, schema: {type: integer, format: int64, minimum: 1}}
+        - {name: customerId, in: query, required: true, schema: {type: string, minLength: 1, maxLength: 128}}
+        - {name: destinationKey, in: query, schema: {type: string}}
+      responses:
+        '200':
+          description: 真实原来源和当前活动预约覆盖
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  code: {type: string}
+                  data:
+                    type: object
+                    properties:
+                      source: {$ref: '#/components/schemas/PlanningSource'}
+                      coverage: {$ref: '#/components/schemas/Coverage'}
+        '400': {description: 订单、客户或目的地参数无效}
+        '403': {description: 非平台或缺少任一读取权限}
+        '404': {description: 当前客户下来源不存在}
+        '409': {description: 订单与原来源关联变化}
+        '503': {description: 权威目录不可用}
   /api/platform/v1/last-leg/appointment-planning/external-candidates:
     get:
       operationId: listExternalAppointmentCandidates
@@ -52,7 +83,7 @@ paths:
         仅平台；同时需要platform:appointment:list、platform:overseas-warehouse:last-mile-order:list及platform:overseas-warehouse:inbound-order:fba-appointment。
         与入仓明细入口共用同一FBA预约聚合；系统生成AP单号，不创建入仓计划、库存或车次。
         PENDING允许日期、时段、外部约号及箱数暂缺。SUCCESS必须有权威目的仓时区、真实货件材料、确定箱数及外部约号和确认时段。
-        实际客户、起运仓、目的仓及原BOOKING由服务端核对；活动来源与已形成订单均唯一占用，取消后释放并保留历史。
+        实际客户、起运仓、目的仓及原BOOKING由服务端核对；锁原来源后按剩余未分配箱数建立新安排，分批总量不能超过独立核实或原来源总量。取消仅释放有效预约覆盖，仍需履约的本批分配保留，不重新作为整票余量；历史保留。
         命令与主单、明细同事务；同键同操作人同内容重试返回原快照，不受后来编辑影响。异内容或来源占用冲突拒绝。
       requestBody:
         required: true
@@ -117,7 +148,7 @@ paths:
       description: >-
         只读核对，不保存预约安排、不占货、不确认预约。仅平台，同时要求platform:appointment:list与platform:overseas-warehouse:last-mile-order:list。
         最多100票，批量查询货源、实际开船节点和美国仓目录，支持ORDER与已确认承运BOOKING混合；同一订单重复别名拒绝。
-        必须同美国起运仓及同美国FBA目的仓；暂扣、多目的地、已有有效预约或已取消完成货源拒绝；未知箱数保留待核实，不填0。
+        必须同美国起运仓及同美国FBA目的仓；暂扣、多目的地、已分配完或已取消完成货源拒绝；部分分配后仍可选择剩余量。未知箱数保留待核实，不填0。
         未建入仓计划及尚未来货的已确认BOOKING不伪造计划、库存或入仓码；正式确认前必须核实箱数。
         未接入权威备妥窗口时返回readinessIncomplete及READY_WINDOW_UNVERIFIED，不拿到港/到仓预测代替。
       requestBody:
@@ -156,6 +187,7 @@ paths:
                       destinationWarehouseCode: {type: string}
                       destinationTimezone: {type: string, nullable: true, description: 当前目的仓主档IANA时区；主档为空时为null，读取失败返回错误，不使用历史预约快照}
                       sources: {type: array, items: {$ref: '#/components/schemas/PlanningSource'}}
+                      cargoVerification: {type: array, items: {$ref: './appointment-cargo-verification-v1.yaml#/components/schemas/CargoContext'}, description: 各原来源当前独立核实及剩余分配量，sources本身仍保留原事实}
                       missingFields: {type: array, items: {type: string}}
                       group:
                         type: object
diff --git a/lastleg-service/src/main/resources/openapi/appointment-receiving-v1.yaml b/lastleg-service/src/main/resources/openapi/appointment-receiving-v1.yaml
new file mode 100644
index 000000000..9c692db7b
--- /dev/null
+++ b/lastleg-service/src/main/resources/openapi/appointment-receiving-v1.yaml
@@ -0,0 +1,852 @@
+openapi: 3.0.3
+info:
+  title: V13 收货预约覆盖、客户变化及重新预约
+  version: 1.0.0
+  description: 稳定批次与有效收货预约身份分离；Agreement.version覆盖资料和成员范围。新共约必须新agreementKey，不以约号相等推断成员。同一次移出为Lastleg本地事务：transport锁序车次→排车→出库/PDA→批次，任一步失败全部回滚，不返回批次部分成功。成功Result持久化且同键重放返回原快照；异内容冲突。后续约仓/配车独立续办使用成功batchKey，不重建已成功货物。WAITING保存原安排和数量，只有CONFIRM按原scope/source/verification及batch版本复验后应用；WITHDRAW保留原安排。实际发车另由原Dispatch/Fleet检查pending及有效收货范围。未知量、版本冲突、来源不可用均拒绝，不伪造0项。
+    负责人提交ownerId并由平台人员目录校验；后送及再次分批继承权威负责人和跟进资料。重约使用按客户核对的executionVersion，不让同批无关已完成客户阻断未完成员；已完成成员不得再次预约。WITHDRAW只撤回未生效变化，不改原货物/车辆，运输开始或版本变化不阻断撤回；仍须变化版本与幂等校验。
+paths:
+  /api/platform/v1/last-leg/appointment-receiving/batches/{batchKey}:
+    get:
+      summary: 读取本批真实收货覆盖和待确认变化
+      description: '平台身份 tenantId=0。Required authority: platform:appointment:list'
+      security:
+      - bearerAuth: []
+      responses:
+        '200':
+          description: ApiResponse：成功code="200"；业务错误按统一封装返回，不把HTTP 200当业务成功。
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  code: &id001
+                    type: string
+                  message: *id001
+                  data:
+                    $ref: '#/components/schemas/Context'
+      parameters:
+      - name: batchKey
+        in: path
+        required: true
+        schema: *id001
+  /api/platform/v1/last-leg/appointment-receiving/agreements/{agreementKey}:
+    get:
+      summary: 读取当前范围和取消组重约候选及排除原因
+      description: '平台身份 tenantId=0。Required authority: platform:appointment:list'
+      security:
+      - bearerAuth: []
+      responses:
+        '200':
+          description: ApiResponse：成功code="200"；业务错误按统一封装返回，不把HTTP 200当业务成功。
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  code: *id001
+                  message: *id001
+                  data:
+                    $ref: '#/components/schemas/GroupContext'
+      parameters:
+      - name: agreementKey
+        in: path
+        required: true
+        schema: *id001
+  /api/platform/v1/last-leg/appointment-receiving/changes:
+    post:
+      summary: 保存客户待确认变化，保留原安排并阻发
+      description: '平台身份 tenantId=0。Required authority: platform:overseas-warehouse:inbound-order:fba-appointment AND platform:appointment:delete'
+      security:
+      - bearerAuth: []
+      responses:
+        '200':
+          description: ApiResponse：成功code="200"；业务错误按统一封装返回，不把HTTP 200当业务成功。
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  code: *id001
+                  message: *id001
+                  data:
+                    $ref: '#/components/schemas/Result'
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/Propose'
+  /api/platform/v1/last-leg/appointment-receiving/changes/{changeKey}/resolve:
+    post:
+      summary: 确认并原子移出，或撤回本次变化
+      description: '平台身份 tenantId=0。Required authority: platform:overseas-warehouse:inbound-order:fba-appointment AND platform:appointment:delete'
+      security:
+      - bearerAuth: []
+      responses:
+        '200':
+          description: ApiResponse：成功code="200"；业务错误按统一封装返回，不把HTTP 200当业务成功。
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  code: *id001
+                  message: *id001
+                  data:
+                    $ref: '#/components/schemas/Result'
+      parameters:
+      - name: changeKey
+        in: path
+        required: true
+        schema: *id001
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/Resolve'
+  /api/platform/v1/last-leg/appointment-receiving/bookings:
+    post:
+      summary: 沿用现有批次创建共同或独立收货预约
+      description: '平台身份 tenantId=0。Required authority: platform:overseas-warehouse:inbound-order:fba-appointment'
+      security:
+      - bearerAuth: []
+      responses:
+        '200':
+          description: ApiResponse：成功code="200"；业务错误按统一封装返回，不把HTTP 200当业务成功。
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  code: *id001
+                  message: *id001
+                  data:
+                    $ref: '#/components/schemas/Result'
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/Book'
+  /api/platform/v1/last-leg/appointment-receiving/agreements/{agreementKey}/reschedule:
+    post:
+      summary: 整份当前收货预约改期
+      description: '平台身份 tenantId=0。Required authority: platform:overseas-warehouse:inbound-order:fba-appointment'
+      security:
+      - bearerAuth: []
+      responses:
+        '200':
+          description: ApiResponse：成功code="200"；业务错误按统一封装返回，不把HTTP 200当业务成功。
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  code: *id001
+                  message: *id001
+                  data:
+                    $ref: '#/components/schemas/Result'
+      parameters:
+      - name: agreementKey
+        in: path
+        required: true
+        schema: *id001
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/GroupChange'
+  /api/platform/v1/last-leg/appointment-receiving/agreements/{agreementKey}/cancel:
+    post:
+      summary: 整份当前收货预约取消并保留货量及车辆
+      description: '平台身份 tenantId=0。Required authority: platform:appointment:delete'
+      security:
+      - bearerAuth: []
+      responses:
+        '200':
+          description: ApiResponse：成功code="200"；业务错误按统一封装返回，不把HTTP 200当业务成功。
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  code: *id001
+                  message: *id001
+                  data:
+                    $ref: '#/components/schemas/Result'
+      parameters:
+      - name: agreementKey
+        in: path
+        required: true
+        schema: *id001
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/GroupChange'
+  /api/platform/v1/last-leg/appointment-receiving/plans:
+    post:
+      summary: 只保存本客户未确认的送仓计划，不改变其他客户正式确认
+      description: '平台身份 tenantId=0。Required authority: platform:overseas-warehouse:inbound-order:fba-appointment。已正式确认、待变化确认或已执行客户不可直接改计划；清目标仍保留需求。计划不创建预约确认、不重新占量。'
+      security:
+      - bearerAuth: []
+      responses:
+        '200':
+          description: ApiResponse：成功code="200"；业务错误按统一封装返回，不把HTTP 200当业务成功。
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  code: &id002
+                    type: string
+                  message: *id002
+                  data:
+                    $ref: '#/components/schemas/Result'
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/Plan'
+  /api/platform/v1/last-leg/appointment-receiving/execution-scope:
+    post:
+      summary: 按实际选择的客户批次只读核对执行资格和提交版本
+      description: '平台身份 tenantId=0。Required authority: platform:appointment:list。只读，不保存计划或预约。跨批次取消组只选部分成员时先读取本范围执行版本，前端重新确认选择；写入仍独立校验批次及取消组版本。'
+      security:
+      - bearerAuth: []
+      responses:
+        '200':
+          description: ApiResponse：成功code="200"；业务错误按统一封装返回，不把HTTP 200当业务成功。
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  code: &id003
+                    type: string
+                  message: *id003
+                  data:
+                    $ref: '#/components/schemas/ExecutionScope'
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/ExecutionQuery'
+  /api/platform/v1/last-leg/appointment-receiving/cargo-refresh:
+    post:
+      summary: 明确核对并采用本客户最新货物资料
+      description: '平台身份 tenantId=0。Required authority: platform:overseas-warehouse:inbound-order:fba-appointment。仅未确认且未执行客户可采用，清晰核对本批量、最新核实总量及货件号；来源目的地或客户改变不得采用，不修改原订单。'
+      security:
+      - bearerAuth: []
+      responses:
+        '200':
+          description: ApiResponse：成功code="200"；业务错误按统一封装返回，不把HTTP 200当业务成功。
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  code: &id004
+                    type: string
+                  message: *id004
+                  data:
+                    $ref: '#/components/schemas/Result'
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/RefreshCargo'
+components:
+  securitySchemes:
+    bearerAuth:
+      type: http
+      scheme: bearer
+  schemas:
+    Source:
+      type: object
+      properties:
+        sourceKey: *id001
+        destinationKey: *id001
+        packageCount:
+          type: integer
+          minimum: 1
+        sourceVersion: *id001
+        verificationVersion:
+          type: integer
+          nullable: true
+        inboundCode:
+          type: string
+          nullable: true
+          description: 原来源入仓业务号；未知显示—
+      required:
+      - sourceKey
+      - destinationKey
+      - packageCount
+      - sourceVersion
+      - verificationVersion
+    Member:
+      type: object
+      properties:
+        batchKey: *id001
+        appointmentNo: *id001
+        batchVersion: &id005
+          type: integer
+          minimum: 0
+        customerId: *id001
+        sources:
+          type: array
+          items:
+            $ref: '#/components/schemas/Source'
+        customerName:
+          type: string
+          nullable: true
+          description: 原订单真实客户名称；未知显示—，不用内部标识回退
+      required:
+      - batchKey
+      - appointmentNo
+      - batchVersion
+      - customerId
+      - sources
+    Details:
+      type: object
+      properties:
+        plannedDate: &id006
+          type: string
+          format: date
+          nullable: true
+        plannedAt:
+          type: string
+          format: date-time
+          nullable: true
+        plannedEndAt:
+          type: string
+          format: date-time
+          nullable: true
+        confirmationNo: *id001
+        appointmentAt:
+          type: string
+          format: date-time
+        appointmentEndAt:
+          type: string
+          format: date-time
+          nullable: true
+        appointmentStatus:
+          type: string
+          enum:
+          - SUCCESS
+        appointmentRemark:
+          type: string
+          nullable: true
+        startOffset:
+          type: string
+          nullable: true
+        endOffset:
+          type: string
+          nullable: true
+      required:
+      - confirmationNo
+      - appointmentAt
+      - appointmentStatus
+    Agreement:
+      type: object
+      properties:
+        agreementKey: *id001
+        version: *id005
+        status:
+          type: string
+          enum:
+          - ACTIVE
+          - CANCELLED
+          - SUPERSEDED
+        destinationKey: *id001
+        details:
+          $ref: '#/components/schemas/Details'
+        timezone: *id001
+        members:
+          type: array
+          items:
+            $ref: '#/components/schemas/Member'
+        warehouseEvidence: *id001
+      required:
+      - agreementKey
+      - version
+      - status
+      - destinationKey
+      - details
+      - timezone
+      - members
+      - warehouseEvidence
+    Vehicle:
+      type: object
+      properties:
+        tripNo:
+          type: string
+          nullable: true
+        version:
+          type: integer
+          nullable: true
+        dispatchNo: *id001
+        customerId: *id001
+        batchKey: *id001
+        status: *id001
+        packageCount: *id005
+      required:
+      - tripNo
+      - version
+      - dispatchNo
+      - customerId
+      - batchKey
+      - status
+      - packageCount
+    Transport:
+      type: object
+      properties:
+        version: *id001
+        vehicles:
+          type: array
+          items:
+            $ref: '#/components/schemas/Vehicle'
+        blockReasons:
+          type: array
+          items: *id001
+      required:
+      - version
+      - vehicles
+      - blockReasons
+    Selection:
+      type: object
+      properties:
+        batchKey: *id001
+        batchVersion: *id005
+        customerId: *id001
+      required:
+      - batchKey
+      - batchVersion
+      - customerId
+    Quantity:
+      type: object
+      properties:
+        sourceKey: *id001
+        destinationKey: *id001
+        retainedPackages: *id005
+        expectedSourceVersion: *id001
+        expectedVerificationVersion:
+          type: integer
+          nullable: true
+      required:
+      - sourceKey
+      - destinationKey
+      - retainedPackages
+      - expectedSourceVersion
+      - expectedVerificationVersion
+    ChangeIntent:
+      type: object
+      properties:
+        batchKey: *id001
+        batchVersion: *id005
+        customerId: *id001
+        quantities:
+          type: array
+          items:
+            $ref: '#/components/schemas/Quantity'
+        laterDate: *id006
+        nextFollowupDate: *id006
+        reason: *id001
+        transportVersion: *id001
+        ownerId: *id001
+      required:
+      - batchKey
+      - batchVersion
+      - customerId
+      - quantities
+      - ownerId
+      - reason
+      - transportVersion
+    Pending:
+      type: object
+      properties:
+        changeKey: *id001
+        version: *id005
+        status:
+          type: string
+          enum:
+          - WAITING
+          - APPLIED
+          - WITHDRAWN
+        intent:
+          $ref: '#/components/schemas/ChangeIntent'
+        originalMembers:
+          type: array
+          items:
+            $ref: '#/components/schemas/Member'
+        originalAgreements:
+          type: array
+          items:
+            $ref: '#/components/schemas/Agreement'
+        followup:
+          $ref: '#/components/schemas/Followup'
+      required:
+      - changeKey
+      - version
+      - status
+      - intent
+      - originalMembers
+      - originalAgreements
+      - followup
+    Context:
+      type: object
+      properties:
+        batch:
+          $ref: ./fba-appointment-calendar-v1.yaml#/components/schemas/Appointment
+        agreements:
+          type: array
+          items:
+            $ref: '#/components/schemas/Agreement'
+        pendingChanges:
+          type: array
+          items:
+            $ref: '#/components/schemas/Pending'
+        transport:
+          $ref: '#/components/schemas/Transport'
+        allowedActions:
+          type: array
+          items:
+            type: string
+            enum:
+            - BOOK_RECEIVING
+            - PROPOSE_CUSTOMER_CHANGE
+        blockReasons:
+          type: array
+          items: *id001
+        executionScope:
+          $ref: '#/components/schemas/ExecutionScope'
+        plans:
+          type: array
+          items:
+            $ref: '#/components/schemas/CustomerPlan'
+      required:
+      - batch
+      - agreements
+      - pendingChanges
+      - transport
+      - allowedActions
+      - blockReasons
+      - executionScope
+      - plans
+    Excluded:
+      type: object
+      properties:
+        member:
+          $ref: '#/components/schemas/Member'
+        reason: *id001
+        currentAgreementKey:
+          type: string
+          nullable: true
+      required:
+      - member
+      - reason
+      - currentAgreementKey
+    GroupContext:
+      type: object
+      properties:
+        agreement:
+          $ref: '#/components/schemas/Agreement'
+        eligibleMembers:
+          type: array
+          items:
+            $ref: '#/components/schemas/Member'
+        excludedMembers:
+          type: array
+          items:
+            $ref: '#/components/schemas/Excluded'
+        transport:
+          $ref: '#/components/schemas/Transport'
+        executionScope:
+          $ref: '#/components/schemas/ExecutionScope'
+      required:
+      - agreement
+      - eligibleMembers
+      - excludedMembers
+      - transport
+      - executionScope
+    Propose:
+      type: object
+      properties:
+        idempotencyKey: *id001
+        intent:
+          $ref: '#/components/schemas/ChangeIntent'
+      required:
+      - idempotencyKey
+      - intent
+    Resolve:
+      type: object
+      properties:
+        idempotencyKey: *id001
+        version: *id005
+        decision:
+          type: string
+          enum:
+          - CONFIRM
+          - WITHDRAW
+        warehouseEvidence:
+          type: string
+          nullable: true
+        transportVersion: *id001
+      required:
+      - idempotencyKey
+      - version
+      - decision
+      - transportVersion
+    Booking:
+      type: object
+      properties:
+        members:
+          type: array
+          items:
+            $ref: '#/components/schemas/Selection'
+        details:
+          $ref: '#/components/schemas/Details'
+        warehouseEvidence: *id001
+      required:
+      - members
+      - details
+      - warehouseEvidence
+    Book:
+      type: object
+      properties:
+        idempotencyKey: *id001
+        bookings:
+          type: array
+          items:
+            $ref: '#/components/schemas/Booking'
+        cancelledAgreementKey:
+          type: string
+          nullable: true
+        cancelledAgreementVersion:
+          type: integer
+          nullable: true
+        executionVersion: *id001
+      required:
+      - idempotencyKey
+      - bookings
+      - executionVersion
+    GroupChange:
+      type: object
+      properties:
+        idempotencyKey: *id001
+        version: *id005
+        action:
+          type: string
+          enum:
+          - RESCHEDULE
+          - CANCEL
+        details:
+          $ref: '#/components/schemas/Details'
+          nullable: true
+        warehouseEvidence: *id001
+        transportVersion: *id001
+      required:
+      - idempotencyKey
+      - version
+      - action
+      - warehouseEvidence
+      - transportVersion
+    Step:
+      type: object
+      properties:
+        step: *id001
+        status:
+          type: string
+          enum:
+          - SUCCESS
+        targetKey: *id001
+        message: *id001
+      required:
+      - step
+      - status
+      - targetKey
+      - message
+    Result:
+      type: object
+      properties:
+        changeKey:
+          type: string
+          nullable: true
+        status:
+          type: string
+          enum:
+          - WAITING
+          - APPLIED
+          - WITHDRAWN
+          - UNCHANGED
+        batches:
+          type: array
+          items:
+            $ref: ./fba-appointment-calendar-v1.yaml#/components/schemas/Appointment
+        agreements:
+          type: array
+          items:
+            $ref: '#/components/schemas/Agreement'
+        steps:
+          type: array
+          items:
+            $ref: '#/components/schemas/Step'
+        nextActions:
+          type: array
+          items:
+            type: string
+            description: 主要下一步及原车辆业务返回的实际后续动作，沿Result中的稳定batchKey继续，不重复创建货物
+      required:
+      - changeKey
+      - status
+      - batches
+      - agreements
+      - steps
+      - nextActions
+    Followup:
+      type: object
+      properties:
+        ownerId:
+          type: string
+        ownerName:
+          type: string
+        nextFollowupDate:
+          type: string
+          format: date
+          nullable: true
+      required:
+      - ownerId
+      - ownerName
+      - nextFollowupDate
+    ExecutionMember:
+      type: object
+      properties:
+        batchKey:
+          type: string
+        customerId:
+          type: string
+      required:
+      - batchKey
+      - customerId
+    ExecutionEligibility:
+      type: object
+      properties:
+        member:
+          $ref: '#/components/schemas/ExecutionMember'
+        completed:
+          type: boolean
+        canRebook:
+          type: boolean
+        reason:
+          type: string
+          nullable: true
+      required:
+      - member
+      - completed
+      - canRebook
+      - reason
+    ExecutionScope:
+      type: object
+      description: 原业务按客户、批次及逐票履约事实核对；version绑定涉及批次的完整执行事实，资格仅针对所选客户。
+      properties:
+        version:
+          type: string
+        members:
+          type: array
+          items:
+            $ref: '#/components/schemas/ExecutionEligibility'
+      required:
+      - version
+      - members
+    CustomerPlan:
+      type: object
+      required:
+      - batchKey
+      - customerId
+      - details
+      properties:
+        batchKey:
+          type: string
+        customerId:
+          type: string
+        details:
+          $ref: ./fba-appointment-calendar-v1.yaml#/components/schemas/AppointmentDetails
+        timezone:
+          type: string
+          nullable: true
+      description: 按稳定批次及客户保存的未确认收货计划；仅PENDING/FAILED，目标可空，不包含有效确认或货物分配。
+    Plan:
+      type: object
+      required:
+      - idempotencyKey
+      - member
+      - details
+      - executionVersion
+      properties:
+        idempotencyKey:
+          type: string
+          maxLength: 64
+        member:
+          $ref: '#/components/schemas/Selection'
+        details:
+          $ref: ./fba-appointment-calendar-v1.yaml#/components/schemas/AppointmentDetails
+        executionVersion:
+          type: string
+      description: 仅PENDING/FAILED，confirmationNo、appointmentAt、appointmentEndAt必须为空；FAILED必须有原因。服务端校验客户实际执行资格、批次及来源/核实版本，同键幂等。 非空目标须目的仓有效IANA时区；计划时刻按DST与跨日规则校验。此命令中details.startOffset/endOffset对应计划窗口；仅日期或目标为空不携带offset。
+    ExecutionQuery:
+      type: object
+      required:
+      - members
+      properties:
+        members:
+          type: array
+          minItems: 1
+          maxItems: 200
+          uniqueItems: true
+          items:
+            $ref: '#/components/schemas/ExecutionMember'
+    CargoVersion:
+      type: object
+      required:
+      - sourceKey
+      - destinationKey
+      - expectedSourceVersion
+      properties:
+        sourceKey:
+          type: string
+        destinationKey:
+          type: string
+        expectedSourceVersion:
+          type: string
+        expectedVerificationVersion:
+          type: integer
+          minimum: 1
+          nullable: true
+    RefreshCargo:
+      type: object
+      required:
+      - idempotencyKey
+      - member
+      - sources
+      - executionVersion
+      properties:
+        idempotencyKey:
+          type: string
+          maxLength: 64
+        member:
+          $ref: '#/components/schemas/Selection'
+        sources:
+          type: array
+          minItems: 1
+          maxItems: 100
+          items:
+            $ref: '#/components/schemas/CargoVersion'
+        executionVersion:
+          type: string
+      description: 操作者先读取并核对本客户各原来源最新核实资料，再显式采用。只更新原批次本客户明细的源/核实版本和货件快照，原分配数量、来源身份和其他客户确认保持。已确认、待变化确认、已执行、源/核实版本变化或数量不守恒拒绝；同键幂等，不自动采用。
diff --git a/lastleg-service/src/main/resources/openapi/appointment-work-v1.yaml b/lastleg-service/src/main/resources/openapi/appointment-work-v1.yaml
new file mode 100644
index 000000000..eb279bf0d
--- /dev/null
+++ b/lastleg-service/src/main/resources/openapi/appointment-work-v1.yaml
@@ -0,0 +1,1496 @@
+openapi: "3.0.3"
+info:
+  title: "预约工作事项"
+  version: "1.0.0"
+  description: "工作事项只保存需求、路线、责任、跟进及影响基线。提柜/还空、预约、PDA和Fleet计划与执行事实由原业务提供。独立DDL仍需总控集成。"
+security:
+  -
+    bearerAuth: []
+paths:
+  /api/platform/v1/last-leg/appointment-work/items/resolve:
+    get:
+      operationId: appointmentWorkResolveBatch
+      summary: 按当前权威批次精确进入送仓事项
+      description: "要求platform:appointment:list及原来源读取资格。batchKey使用原业务返回的完整稳定键；customerId来自所选客户货源。精确匹配返回detail，未传客户且存在多个客户时detail为空并返回candidates，必须选择后重新解析；不得选首项或回退已替代旧批次。需求关系未同步返回409，未生成返回404。"
+      parameters:
+        - name: batchKey
+          in: query
+          required: true
+          schema:
+            type: string
+            pattern: '^(FBA_APPOINTMENT|DISPATCH):[1-9][0-9]*$'
+        - name: customerId
+          in: query
+          required: false
+          schema: {type: string, minLength: 1}
+      responses:
+        200:
+          description: data为客户送仓精确解析结果或可见客户候选
+          content:
+            application/json:
+              schema:
+                type: object
+                required: [code, data]
+                properties:
+                  code: {type: string}
+                  message: {type: string, nullable: true}
+                  data:
+                    $ref: '#/components/schemas/BatchWorkResolution'
+        400:
+          description: 批次键无效
+        403:
+          description: 缺少平台或原来源读取资格
+        404:
+          description: 当前批次未生成活动送仓事项
+        409:
+          description: 需求关系尚未同步或存在不唯一的事项关系
+  /api/platform/v1/last-leg/appointment-work/calendar:
+    get:
+      operationId: "appointmentWorkCalendar"
+      summary: "完整日期区间的工作聚合"
+      description: "platform:appointment:list并逐事项核验来源读取资格；最大62个当地日期；五个桶互斥；到港参考不计工作量。完整扫描未就绪、scopeVersion变化或任一权威事实失败均拒绝伪造统计。"
+      parameters:
+        -
+          name: "from"
+          in: "query"
+          required: true
+          schema:
+            type: "string"
+            format: "date"
+        -
+          name: "to"
+          in: "query"
+          required: true
+          schema:
+            type: "string"
+            format: "date"
+        -
+          name: "flow"
+          in: "query"
+          required: false
+          schema:
+            "$ref": "#/components/schemas/Flow"
+        -
+          name: "types"
+          in: "query"
+          required: false
+          schema:
+            type: "array"
+            items:
+              type: "string"
+              enum:
+                - "PICKUP"
+                - "WAREHOUSE_RECEIPT"
+                - "DELIVERY"
+                - "TRANSPORT"
+                - "EMPTY_RETURN"
+      responses:
+        200:
+          description: "code为字符串200时成功；data为业务结果"
+          content:
+            application/json:
+              schema:
+                type: "object"
+                additionalProperties: false
+                required:
+                  - "code"
+                  - "data"
+                properties:
+                  code:
+                    type: "string"
+                  message:
+                    type: "string"
+                    nullable: true
+                  data:
+                    "$ref": "#/components/schemas/CalendarResult"
+        400:
+          description: "参数、时区或判别式payload不合法"
+        403:
+          description: "非平台或缺少关联来源/命令权限"
+        404:
+          description: "事项不存在"
+        409:
+          description: "版本、来源集合、影响版本或并发冲突；必须刷新"
+        503:
+          description: "权威来源/原域适配/目录未就绪；不得显示零值或假成功"
+  /api/platform/v1/last-leg/appointment-work/summary:
+    get:
+      operationId: "appointmentWorkSummary"
+      summary: "全部活动事项全局统计"
+      description: "不接收月份/流程/类型条件。集合可重叠；无日期有跟进日仍是未定日期。未知地点提醒按America/Los_Angeles业务默认时区判断并在missingFields说明。"
+      responses:
+        200:
+          description: "code为字符串200时成功；data为业务结果"
+          content:
+            application/json:
+              schema:
+                type: "object"
+                additionalProperties: false
+                required:
+                  - "code"
+                  - "data"
+                properties:
+                  code:
+                    type: "string"
+                  message:
+                    type: "string"
+                    nullable: true
+                  data:
+                    "$ref": "#/components/schemas/Summary"
+        400:
+          description: "参数、时区或判别式payload不合法"
+        403:
+          description: "非平台或缺少关联来源/命令权限"
+        404:
+          description: "事项不存在"
+        409:
+          description: "版本、来源集合、影响版本或并发冲突；必须刷新"
+        503:
+          description: "权威来源/原域适配/目录未就绪；不得显示零值或假成功"
+  /api/platform/v1/last-leg/appointment-work/items:
+    get:
+      operationId: "appointmentWorkItems"
+      summary: "工作明细"
+      description: "ALL不传date时排除已完成；传date时包含当日已完成。共享车次按稳定车次键仅一项，containers中任一柜均可命中。"
+      parameters:
+        -
+          name: "view"
+          in: "query"
+          required: false
+          schema:
+            type: "string"
+            enum:
+              - "ALL"
+              - "FOLLOW_TODAY"
+              - "OVERDUE"
+              - "UNDATED"
+              - "REVIEW"
+            default: "ALL"
+        -
+          name: "page"
+          in: "query"
+          required: false
+          schema:
+            type: "integer"
+            minimum: 1
+            default: 1
+        -
+          name: "size"
+          in: "query"
+          required: false
+          schema:
+            type: "integer"
+            minimum: 1
+            maximum: 100
+            default: 20
+        -
+          name: "date"
+          in: "query"
+          required: false
+          schema:
+            type: "string"
+            format: "date"
+        -
+          name: "flow"
+          in: "query"
+          required: false
+          schema:
+            "$ref": "#/components/schemas/Flow"
+        -
+          name: "types"
+          in: "query"
+          required: false
+          schema:
+            type: "array"
+            items:
+              "$ref": "#/components/schemas/Type"
+        -
+          name: "containerBookingId"
+          in: "query"
+          required: false
+          schema:
+            type: "string"
+        -
+          name: "bucket"
+          in: "query"
+          required: false
+          schema:
+            type: "string"
+            enum:
+              - "PENDING"
+              - "CONFIRMED"
+              - "NO_BOOKING_REQUIRED"
+              - "REVIEW"
+              - "COMPLETED"
+        -
+          name: "keyword"
+          in: "query"
+          required: false
+          schema:
+            type: "string"
+            maxLength: 128
+      responses:
+        200:
+          description: "code为字符串200时成功；data为业务结果"
+          content:
+            application/json:
+              schema:
+                type: "object"
+                additionalProperties: false
+                required:
+                  - "code"
+                  - "data"
+                properties:
+                  code:
+                    type: "string"
+                  message:
+                    type: "string"
+                    nullable: true
+                  data:
+                    "$ref": "#/components/schemas/Page"
+        400:
+          description: "参数、时区或判别式payload不合法"
+        403:
+          description: "非平台或缺少关联来源/命令权限"
+        404:
+          description: "事项不存在"
+        409:
+          description: "版本、来源集合、影响版本或并发冲突；必须刷新"
+        503:
+          description: "权威来源/原域适配/目录未就绪；不得显示零值或假成功"
+  /api/platform/v1/last-leg/appointment-work/items/{workItemKey}:
+    parameters:
+      -
+        name: "workItemKey"
+        in: "path"
+        required: true
+        schema:
+          type: "string"
+    get:
+      operationId: "appointmentWorkDetail"
+      summary: "事项、业务引用、关联与历史"
+      responses:
+        200:
+          description: "code为字符串200时成功；data为业务结果"
+          content:
+            application/json:
+              schema:
+                type: "object"
+                additionalProperties: false
+                required:
+                  - "code"
+                  - "data"
+                properties:
+                  code:
+                    type: "string"
+                  message:
+                    type: "string"
+                    nullable: true
+                  data:
+                    "$ref": "#/components/schemas/WorkDetail"
+        400:
+          description: "参数、时区或判别式payload不合法"
+        403:
+          description: "非平台或缺少关联来源/命令权限"
+        404:
+          description: "事项不存在"
+        409:
+          description: "版本、来源集合、影响版本或并发冲突；必须刷新"
+        503:
+          description: "权威来源/原域适配/目录未就绪；不得显示零值或假成功"
+  /api/platform/v1/last-leg/appointment-work/items/{workItemKey}/commands:
+    parameters:
+      -
+        name: "workItemKey"
+        in: "path"
+        required: true
+        schema:
+          type: "string"
+    post:
+      operationId: "appointmentWorkCommand"
+      summary: "执行事项自有数据命令"
+      description: "SAVE_FOLLOWUP/RESOLVE_REVIEW要求platform:appointment:followup；其他命令要求platform:appointment:manage-work，同时核验list与来源资格。USER本人接手；外部责任方须运营记录明确反馈。只确认责任，不写实际还空。事务幂等键按事项唯一，同操作者同内容重放原响应；未知字段拒绝；不支持标为完成。"
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              "$ref": "#/components/schemas/CommandRequest"
+      responses:
+        200:
+          description: "code为字符串200时成功；data为业务结果"
+          content:
+            application/json:
+              schema:
+                type: "object"
+                additionalProperties: false
+                required:
+                  - "code"
+                  - "data"
+                properties:
+                  code:
+                    type: "string"
+                  message:
+                    type: "string"
+                    nullable: true
+                  data:
+                    "$ref": "#/components/schemas/CommandResult"
+        400:
+          description: "参数、时区或判别式payload不合法"
+        403:
+          description: "非平台或缺少关联来源/命令权限"
+        404:
+          description: "事项不存在"
+        409:
+          description: "版本、来源集合、影响版本或并发冲突；必须刷新"
+        503:
+          description: "权威来源/原域适配/目录未就绪；不得显示零值或假成功"
+  /internal/lastleg/appointment-work/synchronize:
+    post:
+      operationId: "synchronizeAppointmentWork"
+      summary: "服务端分页同步完整已开船事项"
+      description: "仅X-Internal-Service-Token，不经公网Gateway。由后台编排分页调用；GET不写库。afterContainerBookingId为空开始完整扫描，逐页回传nextCursor直到complete。跨页scopeVersion漂移拒绝；首次完整扫描前查询拒绝零值。未出现在新候选页的旧未还空工作保留。"
+      security:
+        -
+          internalToken: []
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              "$ref": "#/components/schemas/SyncRequest"
+      responses:
+        200:
+          description: "code为字符串200时成功；data为业务结果"
+          content:
+            application/json:
+              schema:
+                type: "object"
+                additionalProperties: false
+                required:
+                  - "code"
+                  - "data"
+                properties:
+                  code:
+                    type: "string"
+                  message:
+                    type: "string"
+                    nullable: true
+                  data:
+                    "$ref": "#/components/schemas/SyncResult"
+        400:
+          description: "参数、时区或判别式payload不合法"
+        403:
+          description: "非平台或缺少关联来源/命令权限"
+        404:
+          description: "事项不存在"
+        409:
+          description: "版本、来源集合、影响版本或并发冲突；必须刷新"
+        503:
+          description: "权威来源/原域适配/目录未就绪；不得显示零值或假成功"
+  /internal/lastleg/appointment-work/containers/{id}/route:
+    get:
+      operationId: readAppointmentWorkContainerRoute
+      summary: 读取本地已确认路线，不锁工作守卫或回调Firstleg
+      security: [{internalToken: []}]
+      parameters:
+        - {name: id, in: path, required: true, schema: {type: string}}
+      responses:
+        '200':
+          description: ApiResponse包装的本地持久路线
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  code: {type: string}
+                  message: {type: string, nullable: true}
+                  data:
+                    type: object
+                    required: [flow]
+                    properties:
+                      flow: {type: string, enum: [TRANSFER, DIRECT, UNKNOWN]}
+        '403': {description: 内部身份无效}
+        '409': {description: 当前有效事项路线冲突}
+  /api/platform/v1/last-leg/appointment-planning/batches/{batchKey}/dispatch-candidates:
+    get:
+      operationId: appointmentWorkBatchDispatchCandidates
+      summary: 按不可变FBA预约批次读取逐票实物排车候选
+      description: 客户仓使用原排车单批次键DISPATCH:<id>，逐票实物由原排车事务生成；按工作项batchNo进入原排车单并关联车次，不调用本FBA候选接口。平台主体且同时具有platform:appointment:list、platform:overseas-warehouse:last-mile-order:list、platform:overseas-warehouse:inbound-order:list。候选不足不补造数量；超过500托拒绝截断。写入沿用dispatches/pre-arrange及drafts/pre-arrange的batchAllocations，跨客户分别生成排车单后绑定同一车次。
+      security: [{bearerAuth: []}]
+      parameters:
+        - {name: batchKey, in: path, required: true, schema: {type: string}}
+      responses:
+        '200':
+          description: ApiResponse包装的完整候选及阻断原因
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  code: {type: string}
+                  message: {type: string, nullable: true}
+                  data: {$ref: '#/components/schemas/BatchDispatchCandidates'}
+        '403': {description: 非平台主体或无来源读取权限}
+        '409': {description: 批次或实物范围不能完整读取}
+        '503': {description: 原来源目录不可用}
+components:
+  securitySchemes:
+    bearerAuth:
+      type: "http"
+      scheme: "bearer"
+      bearerFormat: "JWT"
+    internalToken:
+      type: "apiKey"
+      in: "header"
+      name: "X-Internal-Service-Token"
+  schemas:
+    Flow:
+      type: "string"
+      enum:
+        - "TRANSFER"
+        - "DIRECT"
+        - "UNKNOWN"
+    Type:
+      type: "string"
+      enum:
+        - "ROUTE"
+        - "PICKUP"
+        - "WAREHOUSE_RECEIPT"
+        - "DELIVERY"
+        - "TRANSPORT"
+        - "EMPTY_RETURN"
+    Command:
+      type: "string"
+      enum:
+        - "CONFIRM_ROUTE"
+        - "SAVE_FOLLOWUP"
+        - "RESOLVE_REVIEW"
+        - "SAVE_REQUIREMENT"
+        - "HANDOFF_RETURN"
+        - "ACCEPT_RETURN"
+    ActionCode:
+      type: "string"
+      enum:
+        - "VIEW_DETAIL"
+        - "SAVE_PLAN"
+        - "REQUEST_BOOKING"
+        - "RECORD_CONFIRMATION"
+        - "CHANGE_BOOKING"
+        - "CANCEL_BOOKING"
+        - "VERIFY_CARGO"
+        - "EDIT_BATCH"
+        - "ARRANGE_TRANSPORT"
+        - "RECORD_EXECUTION"
+        - "CONFIRM_ROUTE"
+        - "SAVE_FOLLOWUP"
+        - "RESOLVE_REVIEW"
+        - "SAVE_REQUIREMENT"
+        - "HANDOFF_RETURN"
+        - "ACCEPT_RETURN"
+        - "VIEW_HISTORY"
+    Slot:
+      type: "object"
+      additionalProperties: false
+      required:
+        - "date"
+        - "startTime"
+        - "endDate"
+        - "endTime"
+        - "timezone"
+      properties:
+        date:
+          type: "string"
+          format: "date"
+        startTime:
+          type: "string"
+          pattern: "^\\d{2}:\\d{2}(:\\d{2}(\\.\\d{1,9})?)?$"
+          nullable: true
+        endDate:
+          type: "string"
+          format: "date"
+          nullable: true
+          description: "与endTime同时为空或同时填写；不推断次日"
+        endTime:
+          type: "string"
+          pattern: "^\\d{2}:\\d{2}(:\\d{2}(\\.\\d{1,9})?)?$"
+          nullable: true
+        timezone:
+          type: "string"
+          nullable: true
+          description: "原业务缺失时区可为空并标SOURCE_TIMEZONE；SAVE_REQUIREMENT写入仍须有效IANA时区"
+    Actual:
+      type: "object"
+      additionalProperties: false
+      description: "occurredAt与localOccurredAt至少一个非空；未知时区按原始当地日期展示，不推断UTC"
+      required:
+        - "occurredAt"
+        - "localOccurredAt"
+        - "timezone"
+      properties:
+        occurredAt:
+          type: "string"
+          format: "date-time"
+          nullable: true
+        localOccurredAt:
+          type: "string"
+          description: "无偏移的原始当地日期时间"
+          nullable: true
+        timezone:
+          type: "string"
+          nullable: true
+    Owner:
+      type: "object"
+      additionalProperties: false
+      required:
+        - "id"
+        - "name"
+      properties:
+        id:
+          type: "string"
+        name:
+          type: "string"
+    ContainerReference:
+      type: "object"
+      additionalProperties: false
+      required:
+        - "containerBookingId"
+        - "bookingNo"
+        - "containerNo"
+      properties:
+        containerBookingId:
+          type: "string"
+        bookingNo:
+          type: "string"
+          nullable: true
+        containerNo:
+          type: "string"
+          nullable: true
+    SourceReference:
+      type: "object"
+      additionalProperties: false
+      required:
+        - "customerId"
+        - "sourceKey"
+        - "destinationKey"
+      properties:
+        customerId:
+          type: "string"
+        sourceKey:
+          type: "string"
+          pattern: "^(ORDER|BOOKING):.+$"
+        destinationKey:
+          type: "string"
+          nullable: true
+    BusinessReference:
+      type: "object"
+      additionalProperties: false
+      required:
+        - "kind"
+        - "key"
+        - "businessNo"
+        - "label"
+      properties:
+        kind:
+          type: "string"
+        key:
+          type: "string"
+        businessNo:
+          type: "string"
+          nullable: true
+        label:
+          type: "string"
+    Responsibility:
+      type: "object"
+      additionalProperties: false
+      required:
+        - "kind"
+        - "id"
+        - "name"
+      properties:
+        kind:
+          type: "string"
+          enum:
+            - "USER"
+            - "SUPPLIER"
+            - "EXTERNAL"
+        id:
+          type: "string"
+          nullable: true
+        name:
+          type: "string"
+          minLength: 1
+          maxLength: 200
+    WorkTarget:
+      type: "object"
+      additionalProperties: false
+      required:
+        - "kind"
+        - "command"
+      properties:
+        kind:
+          type: "string"
+          enum:
+            - "WORK_COMMAND"
+        command:
+          "$ref": "#/components/schemas/Command"
+    CargoTarget:
+      type: "object"
+      additionalProperties: false
+      required:
+        - "kind"
+        - "source"
+      properties:
+        kind:
+          type: "string"
+          enum:
+            - "CARGO_VERIFICATION"
+        source:
+          "$ref": "#/components/schemas/SourceReference"
+    AppointmentTarget:
+      type: "object"
+      additionalProperties: false
+      required:
+        - "kind"
+        - "appointmentId"
+        - "batchKey"
+        - "sources"
+      properties:
+        kind:
+          type: "string"
+          enum:
+            - "FBA_APPOINTMENT"
+        appointmentId:
+          type: "string"
+          nullable: true
+        batchKey:
+          type: "string"
+          nullable: true
+        sources:
+          type: "array"
+          items:
+            "$ref": "#/components/schemas/SourceReference"
+    ContainerTarget:
+      type: "object"
+      additionalProperties: false
+      required:
+        - "kind"
+        - "containerBookingId"
+      properties:
+        kind:
+          type: "string"
+          enum:
+            - "FIRSTLEG_CONTAINER"
+        containerBookingId:
+          type: "string"
+    TripTarget:
+      type: "object"
+      description: FLEET_TRIP动作。tripId存在时维护原车次，业务车次号取工作项businessNo。未绑定车次的客户仓批次以DISPATCH:<原排车单不可变ID>放入batchKeys，原排车业务号取工作项batchNo；直接进入该原排车单关联车次，不能解析为FBA预约或再建立排车。FBA批次仍通过实物候选及batchAllocations安排。
+      additionalProperties: false
+      required:
+        - "kind"
+        - "tripId"
+        - "batchKeys"
+      properties:
+        kind:
+          type: "string"
+          enum:
+            - "FLEET_TRIP"
+        tripId:
+          type: "string"
+          nullable: true
+        batchKeys:
+          type: "array"
+          items:
+            type: "string"
+    ReceiptTarget:
+      type: "object"
+      additionalProperties: false
+      required:
+        - "kind"
+        - "inboundPlanId"
+        - "inboundPlanNo"
+        - "customerId"
+        - "containerBookingId"
+      properties:
+        kind:
+          type: "string"
+          enum:
+            - "WAREHOUSE_RECEIPT"
+        inboundPlanId:
+          type: "string"
+          nullable: true
+        inboundPlanNo:
+          type: "string"
+          nullable: true
+        customerId:
+          type: "string"
+          nullable: true
+        containerBookingId:
+          type: "string"
+    ReadTarget:
+      type: "object"
+      description: 原业务只读入口。客户仓派送使用DELIVERY引用（key与businessNo均为派送业务号）；DISPATCH引用的key为DISPATCH:<原排车单ID>，businessNo为原排车单号。仅供导航，不代表已经执行写入动作。
+      additionalProperties: false
+      required:
+        - "kind"
+        - "references"
+      properties:
+        kind:
+          type: "string"
+          enum:
+            - "READ_ONLY"
+        references:
+          type: "array"
+          items:
+            "$ref": "#/components/schemas/BusinessReference"
+    ActionTarget:
+      oneOf:
+        -
+          "$ref": "#/components/schemas/WorkTarget"
+        -
+          "$ref": "#/components/schemas/CargoTarget"
+        -
+          "$ref": "#/components/schemas/AppointmentTarget"
+        -
+          "$ref": "#/components/schemas/ContainerTarget"
+        -
+          "$ref": "#/components/schemas/TripTarget"
+        -
+          "$ref": "#/components/schemas/ReceiptTarget"
+        -
+          "$ref": "#/components/schemas/ReadTarget"
+      discriminator:
+        propertyName: "kind"
+        mapping:
+          WORK_COMMAND: "#/components/schemas/WorkTarget"
+          CARGO_VERIFICATION: "#/components/schemas/CargoTarget"
+          FBA_APPOINTMENT: "#/components/schemas/AppointmentTarget"
+          FIRSTLEG_CONTAINER: "#/components/schemas/ContainerTarget"
+          FLEET_TRIP: "#/components/schemas/TripTarget"
+          WAREHOUSE_RECEIPT: "#/components/schemas/ReceiptTarget"
+          READ_ONLY: "#/components/schemas/ReadTarget"
+    Action:
+      type: "object"
+      additionalProperties: false
+      required:
+        - "code"
+        - "label"
+        - "targetWorkItemKey"
+        - "target"
+      properties:
+        code:
+          "$ref": "#/components/schemas/ActionCode"
+        label:
+          type: "string"
+        targetWorkItemKey:
+          type: "string"
+          nullable: true
+        target:
+          "$ref": "#/components/schemas/ActionTarget"
+    WorkItem:
+      type: "object"
+      additionalProperties: false
+      required:
+        - "workItemKey"
+        - "version"
+        - "type"
+        - "flow"
+        - "title"
+        - "businessNo"
+        - "containers"
+        - "requirementKey"
+        - "batchKey"
+        - "batchNo"
+        - "originName"
+        - "destinationName"
+        - "planStatus"
+        - "executionStatus"
+        - "reviewRequired"
+        - "target"
+        - "confirmed"
+        - "actual"
+        - "calendarDate"
+        - "dateBasis"
+        - "timezone"
+        - "owner"
+        - "followupDate"
+        - "overdueReasons"
+        - "allowedActions"
+        - "nextAction"
+        - "blockReasons"
+        - "missingFields"
+      properties:
+        workItemKey:
+          type: "string"
+        version:
+          type: "integer"
+          minimum: 0
+        type:
+          "$ref": "#/components/schemas/Type"
+        flow:
+          "$ref": "#/components/schemas/Flow"
+        title:
+          type: "string"
+        businessNo:
+          type: "string"
+          nullable: true
+        containers:
+          type: "array"
+          items:
+            "$ref": "#/components/schemas/ContainerReference"
+        requirementKey:
+          type: "string"
+          nullable: true
+        batchKey:
+          type: "string"
+          nullable: true
+        batchNo:
+          type: "string"
+          nullable: true
+        originName:
+          type: "string"
+          nullable: true
+        destinationName:
+          type: "string"
+          nullable: true
+        planStatus:
+          type: "string"
+          enum:
+            - "UNPLANNED"
+            - "TARGET_SET"
+            - "AWAITING_REPLY"
+            - "CONFIRMED"
+            - "NOT_REQUIRED"
+        executionStatus:
+          type: "string"
+          enum:
+            - "PENDING"
+            - "IN_PROGRESS"
+            - "COMPLETED"
+        reviewRequired:
+          type: "boolean"
+        target:
+          "$ref": "#/components/schemas/Slot"
+          nullable: true
+        confirmed:
+          "$ref": "#/components/schemas/Slot"
+          nullable: true
+        actual:
+          "$ref": "#/components/schemas/Actual"
+          nullable: true
+        calendarDate:
+          type: "string"
+          format: "date"
+          nullable: true
+        dateBasis:
+          type: "string"
+          enum:
+            - "ACTUAL"
+            - "CONFIRMED"
+            - "TARGET"
+            - "NONE"
+        timezone:
+          type: "string"
+          nullable: true
+        owner:
+          "$ref": "#/components/schemas/Owner"
+          nullable: true
+        followupDate:
+          type: "string"
+          format: "date"
+          nullable: true
+        overdueReasons:
+          type: "array"
+          items:
+            type: "string"
+        allowedActions:
+          type: "array"
+          items:
+            "$ref": "#/components/schemas/Action"
+        nextAction:
+          "$ref": "#/components/schemas/Action"
+          nullable: true
+          description: "按当前权限和白名单目标引导；已确认送仓预约可指向本批车辆安排或本车复核，不代表授权发车。取消预约沿原批次重新预约，不恢复旧确认。"
+        blockReasons:
+          type: "array"
+          items:
+            type: "string"
+        missingFields:
+          type: "array"
+          description: "未完成事项分别提示负责人、下次跟进日期和作业日期等缺口；跟进日期不能作为作业日历日期。"
+          items:
+            type: "string"
+    Review:
+      type: "object"
+      additionalProperties: false
+      required:
+        - "version"
+        - "reasons"
+      properties:
+        version:
+          type: "integer"
+          minimum: 0
+        reasons:
+          type: "array"
+          items:
+            type: "string"
+    RequirementDetails:
+      type: "object"
+      additionalProperties: false
+      required:
+        - "bookingRequired"
+        - "receivingRequirements"
+        - "reason"
+      properties:
+        bookingRequired:
+          type: "boolean"
+        receivingRequirements:
+          type: "string"
+        reason:
+          type: "string"
+          nullable: true
+    ReturnHandoff:
+      type: "object"
+      additionalProperties: false
+      required:
+        - "version"
+        - "from"
+        - "to"
+        - "status"
+        - "reason"
+      properties:
+        version:
+          type: "integer"
+          minimum: 0
+        from:
+          "$ref": "#/components/schemas/Responsibility"
+        to:
+          "$ref": "#/components/schemas/Responsibility"
+        status:
+          type: "string"
+          enum:
+            - "PENDING_ACCEPTANCE"
+            - "ACCEPTED"
+        reason:
+          type: "string"
+    HistoryEntry:
+      type: "object"
+      additionalProperties: false
+      required:
+        - "occurredAt"
+        - "operatorName"
+        - "action"
+        - "summary"
+      properties:
+        occurredAt:
+          type: "string"
+          format: "date-time"
+        operatorName:
+          type: "string"
+          nullable: true
+        action:
+          type: "string"
+        summary:
+          type: "string"
+    BatchWorkResolution:
+      type: object
+      required: [batchKey, candidates]
+      properties:
+        batchKey: {type: string}
+        customerId: {type: string, nullable: true}
+        detail:
+          nullable: true
+          allOf:
+            - $ref: '#/components/schemas/WorkDetail'
+        candidates:
+          type: array
+          items:
+            type: object
+            required: [customerId, workItemKey]
+            properties:
+              customerId: {type: string}
+              workItemKey: {type: string}
+              batchNo: {type: string, nullable: true}
+    WorkDetail:
+      type: "object"
+      additionalProperties: false
+      required:
+        - "item"
+        - "relatedItems"
+        - "references"
+        - "history"
+        - "review"
+        - "requirement"
+        - "returnHandoff"
+      properties:
+        item:
+          "$ref": "#/components/schemas/WorkItem"
+        relatedItems:
+          type: "array"
+          items:
+            "$ref": "#/components/schemas/WorkItem"
+        references:
+          type: "array"
+          items:
+            "$ref": "#/components/schemas/BusinessReference"
+        history:
+          type: "array"
+          items:
+            "$ref": "#/components/schemas/HistoryEntry"
+        review:
+          "$ref": "#/components/schemas/Review"
+          nullable: true
+        requirement:
+          "$ref": "#/components/schemas/RequirementDetails"
+          nullable: true
+        returnHandoff:
+          "$ref": "#/components/schemas/ReturnHandoff"
+          nullable: true
+    Summary:
+      type: "object"
+      additionalProperties: false
+      required:
+        - "all"
+        - "followToday"
+        - "overdue"
+        - "undated"
+        - "review"
+      properties:
+        all:
+          type: "integer"
+          minimum: 0
+        followToday:
+          type: "integer"
+          minimum: 0
+        overdue:
+          type: "integer"
+          minimum: 0
+        undated:
+          type: "integer"
+          minimum: 0
+        review:
+          type: "integer"
+          minimum: 0
+    BucketCounts:
+      type: "object"
+      additionalProperties: false
+      required:
+        - "pending"
+        - "confirmed"
+        - "noBookingRequired"
+        - "review"
+        - "completed"
+      properties:
+        pending:
+          type: "integer"
+          minimum: 0
+        confirmed:
+          type: "integer"
+          minimum: 0
+        noBookingRequired:
+          type: "integer"
+          minimum: 0
+        review:
+          type: "integer"
+          minimum: 0
+        completed:
+          type: "integer"
+          minimum: 0
+    DayAggregate:
+      type: "object"
+      additionalProperties: false
+      required:
+        - "date"
+        - "total"
+        - "typeCounts"
+        - "counts"
+      properties:
+        date:
+          type: "string"
+          format: "date"
+        total:
+          type: "integer"
+          minimum: 0
+        typeCounts:
+          type: "object"
+          additionalProperties:
+            type: "integer"
+            minimum: 0
+        counts:
+          "$ref": "#/components/schemas/BucketCounts"
+    CalendarResult:
+      type: "object"
+      additionalProperties: false
+      required:
+        - "from"
+        - "to"
+        - "total"
+        - "counts"
+        - "days"
+      properties:
+        from:
+          type: "string"
+          format: "date"
+        to:
+          type: "string"
+          format: "date"
+        total:
+          type: "integer"
+          minimum: 0
+        counts:
+          "$ref": "#/components/schemas/BucketCounts"
+        days:
+          type: "array"
+          items:
+            "$ref": "#/components/schemas/DayAggregate"
+    Page:
+      type: "object"
+      additionalProperties: false
+      required:
+        - "records"
+        - "page"
+        - "size"
+        - "total"
+        - "pages"
+      properties:
+        records:
+          type: "array"
+          items:
+            "$ref": "#/components/schemas/WorkItem"
+        page:
+          type: "integer"
+          minimum: 1
+        size:
+          type: "integer"
+          minimum: 1
+          maximum: 100
+        total:
+          type: "integer"
+          minimum: 0
+        pages:
+          type: "integer"
+          minimum: 0
+    CommandResult:
+      type: "object"
+      additionalProperties: false
+      required:
+        - "item"
+        - "affectedWorkItemKeys"
+      properties:
+        item:
+          "$ref": "#/components/schemas/WorkItem"
+        affectedWorkItemKeys:
+          type: "array"
+          items:
+            type: "string"
+    SyncRequest:
+      type: "object"
+      additionalProperties: false
+      required:
+        - "size"
+      properties:
+        afterContainerBookingId:
+          type: "string"
+          nullable: true
+          maxLength: 128
+        size:
+          type: "integer"
+          minimum: 1
+          maximum: 100
+    SyncResult:
+      type: "object"
+      additionalProperties: false
+      required:
+        - "sources"
+        - "created"
+        - "nextCursor"
+        - "complete"
+      properties:
+        sources:
+          type: "integer"
+          minimum: 0
+        created:
+          type: "integer"
+          minimum: 0
+        nextCursor:
+          type: "string"
+          nullable: true
+        complete:
+          type: "boolean"
+    CONFIRM_ROUTERequest:
+      type: "object"
+      additionalProperties: false
+      required:
+        - "command"
+        - "expectedVersion"
+        - "idempotencyKey"
+        - "payload"
+      properties:
+        command:
+          type: "string"
+          enum:
+            - "CONFIRM_ROUTE"
+        expectedVersion:
+          type: "integer"
+          minimum: 0
+        idempotencyKey:
+          type: "string"
+          minLength: 1
+          maxLength: 64
+        payload:
+          type: "object"
+          additionalProperties: false
+          required:
+            - "flow"
+          properties:
+            flow:
+              type: "string"
+              enum:
+                - "TRANSFER"
+                - "DIRECT"
+            reason:
+              type: "string"
+              nullable: true
+              maxLength: 1000
+    SAVE_FOLLOWUPRequest:
+      type: "object"
+      additionalProperties: false
+      required:
+        - "command"
+        - "expectedVersion"
+        - "idempotencyKey"
+        - "payload"
+      properties:
+        command:
+          type: "string"
+          enum:
+            - "SAVE_FOLLOWUP"
+        expectedVersion:
+          type: "integer"
+          minimum: 0
+        idempotencyKey:
+          type: "string"
+          minLength: 1
+          maxLength: 64
+        payload:
+          type: "object"
+          additionalProperties: false
+          required:
+            - "ownerId"
+            - "followupDate"
+            - "note"
+          properties:
+            ownerId:
+              type: "string"
+              minLength: 1
+              maxLength: 64
+            followupDate:
+              type: "string"
+              format: "date"
+              nullable: true
+            note:
+              type: "string"
+              minLength: 1
+              maxLength: 1000
+    RESOLVE_REVIEWRequest:
+      type: "object"
+      description: "须匹配当前影响版本，并核对本事项及关联安排的最新权威影响；需求关系未同步或出现新影响时拒绝清除。车次货物成员变化仅要求相关客户及车辆核对，未变化客户预约不连带复核；车辆、司机、时间变化影响当前关联预约。复核不恢复取消的确认、不修改原预约和车辆，也不制造新的业务影响。"
+      additionalProperties: false
+      required:
+        - "command"
+        - "expectedVersion"
+        - "idempotencyKey"
+        - "payload"
+      properties:
+        command:
+          type: "string"
+          enum:
+            - "RESOLVE_REVIEW"
+        expectedVersion:
+          type: "integer"
+          minimum: 0
+        idempotencyKey:
+          type: "string"
+          minLength: 1
+          maxLength: 64
+        payload:
+          type: "object"
+          additionalProperties: false
+          required:
+            - "reviewVersion"
+            - "note"
+          properties:
+            reviewVersion:
+              type: "integer"
+              minimum: 0
+            note:
+              type: "string"
+              minLength: 1
+              maxLength: 1000
+    SAVE_REQUIREMENTRequest:
+      type: "object"
+      additionalProperties: false
+      required:
+        - "command"
+        - "expectedVersion"
+        - "idempotencyKey"
+        - "payload"
+      properties:
+        command:
+          type: "string"
+          enum:
+            - "SAVE_REQUIREMENT"
+        expectedVersion:
+          type: "integer"
+          minimum: 0
+        idempotencyKey:
+          type: "string"
+          minLength: 1
+          maxLength: 64
+        payload:
+          type: "object"
+          additionalProperties: false
+          required:
+            - "target"
+            - "bookingRequired"
+            - "receivingRequirements"
+            - "reason"
+          properties:
+            target:
+              "$ref": "#/components/schemas/Slot"
+              nullable: true
+            bookingRequired:
+              type: "boolean"
+            receivingRequirements:
+              type: "string"
+              nullable: true
+              maxLength: 1000
+            reason:
+              type: "string"
+              minLength: 1
+              maxLength: 1000
+    HANDOFF_RETURNRequest:
+      type: "object"
+      additionalProperties: false
+      required:
+        - "command"
+        - "expectedVersion"
+        - "idempotencyKey"
+        - "payload"
+      properties:
+        command:
+          type: "string"
+          enum:
+            - "HANDOFF_RETURN"
+        expectedVersion:
+          type: "integer"
+          minimum: 0
+        idempotencyKey:
+          type: "string"
+          minLength: 1
+          maxLength: 64
+        payload:
+          type: "object"
+          additionalProperties: false
+          required:
+            - "recipient"
+            - "reason"
+          properties:
+            recipient:
+              "$ref": "#/components/schemas/Responsibility"
+            reason:
+              type: "string"
+              minLength: 1
+              maxLength: 1000
+    ACCEPT_RETURNRequest:
+      type: "object"
+      additionalProperties: false
+      required:
+        - "command"
+        - "expectedVersion"
+        - "idempotencyKey"
+        - "payload"
+      properties:
+        command:
+          type: "string"
+          enum:
+            - "ACCEPT_RETURN"
+        expectedVersion:
+          type: "integer"
+          minimum: 0
+        idempotencyKey:
+          type: "string"
+          minLength: 1
+          maxLength: 64
+        payload:
+          type: "object"
+          additionalProperties: false
+          required:
+            - "handoffVersion"
+            - "note"
+          properties:
+            handoffVersion:
+              type: "integer"
+              minimum: 0
+            note:
+              type: "string"
+              nullable: true
+              maxLength: 1000
+    CommandRequest:
+      description: SAVE_REQUIREMENT新增目标须为分钟精度且有IANA时区；原业务Slot允许保留秒、纳秒及未知时区。
+      oneOf:
+        -
+          "$ref": "#/components/schemas/CONFIRM_ROUTERequest"
+        -
+          "$ref": "#/components/schemas/SAVE_FOLLOWUPRequest"
+        -
+          "$ref": "#/components/schemas/RESOLVE_REVIEWRequest"
+        -
+          "$ref": "#/components/schemas/SAVE_REQUIREMENTRequest"
+        -
+          "$ref": "#/components/schemas/HANDOFF_RETURNRequest"
+        -
+          "$ref": "#/components/schemas/ACCEPT_RETURNRequest"
+      discriminator:
+        propertyName: "command"
+        mapping:
+          CONFIRM_ROUTE: "#/components/schemas/CONFIRM_ROUTERequest"
+          SAVE_FOLLOWUP: "#/components/schemas/SAVE_FOLLOWUPRequest"
+          RESOLVE_REVIEW: "#/components/schemas/RESOLVE_REVIEWRequest"
+          SAVE_REQUIREMENT: "#/components/schemas/SAVE_REQUIREMENTRequest"
+          HANDOFF_RETURN: "#/components/schemas/HANDOFF_RETURNRequest"
+          ACCEPT_RETURN: "#/components/schemas/ACCEPT_RETURNRequest"
+    DispatchBatchAllocation:
+      type: object
+      additionalProperties: false
+      required: [planPalletId, batchKey, customerId, sourceKey, destinationKey, packageCount]
+      properties:
+        planPalletId: {type: integer, format: int64}
+        batchKey: {type: string, pattern: '^FBA_APPOINTMENT:[1-9][0-9]*$'}
+        customerId: {type: string}
+        sourceKey: {type: string}
+        destinationKey: {type: string}
+        packageCount: {type: integer, minimum: 1}
+    BatchDispatchCandidates:
+      type: object
+      required: [batchKey, version, candidates, blockReasons]
+      properties:
+        batchKey: {type: string}
+        version: {type: integer}
+        blockReasons: {type: array, items: {type: string}}
+        candidates:
+          type: array
+          items:
+            type: object
+            required: [planPalletId, palletNo, planId, planNo, customerId, sourceStage, packageCount, allocations, blockReasons]
+            properties:
+              planPalletId: {type: integer, format: int64}
+              palletNo: {type: string}
+              planId: {type: integer, format: int64}
+              planNo: {type: string}
+              customerId: {type: string}
+              sourceStage: {type: string, enum: [PLAN, RECEIVED]}
+              packageCount: {type: integer, nullable: true}
+              allocations: {type: array, items: {$ref: '#/components/schemas/DispatchBatchAllocation'}}
+              blockReasons: {type: array, items: {type: string}}
diff --git a/lastleg-service/src/main/resources/openapi/cargo-discard-photos-v1.yaml b/lastleg-service/src/main/resources/openapi/cargo-discard-photos-v1.yaml
new file mode 100644
index 000000000..07d151e04
--- /dev/null
+++ b/lastleg-service/src/main/resources/openapi/cargo-discard-photos-v1.yaml
@@ -0,0 +1,165 @@
+openapi: 3.0.3
+info:
+  title: Cargo discard PDA photo evidence
+  version: 1.0.0
+  description: >-
+    Each approved pallet requires 1–20 JPG/PNG photos before actual disposal confirmation.
+    Uploads persist as drafts and recover through the PDA list endpoint. Confirmation binds
+    selected photos in the same transaction as inventory deduction. Completed quantities and
+    photo sets are immutable; identical replay does not deduct stock or create evidence again.
+    Platform and merchant details expose only submitted photos, including photos of completed
+    pallets while other pallets are still pending. Historic applications are not backfilled.
+    Approval atomically creates one DISCARD_OUTBOUND document and planned SKU/pallet snapshots.
+    Platform/merchant summary and PDA pallet task include nullable outboundNo. PDA completion
+    synchronizes actual quantities and OUTBOUNDED status without a second inventory deduction.
+    Cancellation must use the discard application workflow. PDA resolve optionally accepts
+    discardNo together with palletNo; ambiguous scans require selection of a discard application.
+    Candidates include INVENTORY positions from every document type with available warehouse stock,
+    plus DROPSHIP and RETURN_CARTON sources. Create items identify exactly one of orderId,
+    returnCartonId or inventoryPositionId and carry selected cartonIds for partial whole-carton disposal; quantities must match those IDs.
+    RETURN_CARTON selections consume every SKU in the selected physical carton.
+    Candidates return cartons, cartonSelectionSupported and cartonSelectionBlockReason.
+    Stock without complete carton/pallet ownership remains available for full disposal only.
+    PDA tasks return scanMode PALLET or CARTON and the real cartonMarks for loose stock.
+    Bound pallets require their pallet number; loose stock requires every distinct carton mark scanned,
+    or confirmAllCartons=true. The loose group uses 散箱 as its API path key, never as a scan code.
+    The application may select a subset of available cartons. PDA must finish every selected carton;
+    short actual quantities are rejected. At least one photo remains required.
+    Partial bound-pallet tasks use CARTON scanMode with the real palletNo and selected cartonMarks.
+    PDA completion leaves the application in PDA_COMPLETED (waiting for customer confirmation).
+    Only the authenticated merchant may confirm completion after reviewing submitted PDA photos.
+    Confirmation changes the application to COMPLETED, records customerConfirmedAt, and never deducts
+    inventory again. Identical repeated confirmation preserves the first timestamp and history.
+    Platform users cannot close the application on behalf of the customer.
+security:
+  - bearerAuth: []
+paths:
+  /api/merchant/v1/last-leg/cargo-discards/{discardNo}/confirm-completion:
+    parameters:
+      - $ref: '#/components/parameters/DiscardNo'
+    post:
+      summary: 客户确认废弃完结
+      description: >-
+        Customer scope is taken only from the authenticated merchant token.
+        Requires PDA_COMPLETED; repeated COMPLETED calls return the existing detail.
+        No request customerId, stock adjustment, or new photo upload is accepted.
+        The client shows submitted PDA photos before the customer confirms.
+      x-permissions: [merchant:overseas-warehouse:discard:confirm]
+      responses:
+        '200': { description: ApiResponse with updated Detail; summary contains customerConfirmedAt }
+  /api/pda/v1/last-leg/cargo-discards/{discardNo}/pallets/{palletNo}/photos/files:
+    parameters:
+      - $ref: '#/components/parameters/DiscardNo'
+      - $ref: '#/components/parameters/PalletNo'
+    post:
+      summary: Upload an approved, unfinished pallet photo (PDA bound warehouse only)
+      x-permissions: [lastleg:pda:operate, ROLE_OVERSEAS_WAREHOUSE_PDA_OPERATOR]
+      requestBody:
+        required: true
+        content:
+          multipart/form-data:
+            schema:
+              type: object
+              required: [file]
+              properties:
+                file: { type: string, format: binary, description: Non-empty JPG/PNG up to 10 MiB with image signature validation }
+      responses:
+        '200': { description: ApiResponse with uploaded Photo metadata; business errors use body code }
+    get:
+      summary: Recover all uploaded photos for this application and pallet
+      x-permissions: [lastleg:pda:operate, ROLE_OVERSEAS_WAREHOUSE_PDA_OPERATOR]
+      responses:
+        '200': { description: ApiResponse with a Photo array, including unsubmitted uploads }
+  /api/pda/v1/last-leg/cargo-discards/{discardNo}/pallets/{palletNo}/photos/files/{fileId}/download:
+    parameters:
+      - $ref: '#/components/parameters/DiscardNo'
+      - $ref: '#/components/parameters/PalletNo'
+      - $ref: '#/components/parameters/FileId'
+    get:
+      summary: Download a photo associated with this pallet in the PDA bound warehouse
+      x-permissions: [lastleg:pda:operate, ROLE_OVERSEAS_WAREHOUSE_PDA_OPERATOR]
+      responses:
+        '200': { description: Inline JPG/PNG bytes with Cache-Control no-store }
+  /api/pda/v1/last-leg/cargo-discards/{discardNo}/pallets/{palletNo}/confirm:
+    parameters:
+      - $ref: '#/components/parameters/DiscardNo'
+      - $ref: '#/components/parameters/PalletNo'
+    post:
+      summary: Confirm actual disposal with owned pallet photos
+      x-permissions: [lastleg:pda:operate, ROLE_OVERSEAS_WAREHOUSE_PDA_OPERATOR]
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required: [lines, photoFileIds]
+              properties:
+                lines:
+                  type: array
+                  minItems: 1
+                  items:
+                    type: object
+                    required: [itemId, actualPackages]
+                    properties:
+                      itemId: { type: string, pattern: '^[1-9][0-9]*$' }
+                      actualPackages: { type: integer, minimum: 1, description: Must equal plannedPackages; must finish the application selection }
+                scannedCartonMarks:
+                  type: array
+                  uniqueItems: true
+                  items: { type: string }
+                  description: All task cartonMarks must be scanned unless confirmAllCartons is true.
+                confirmAllCartons:
+                  type: boolean
+                  default: false
+                  description: Explicitly confirm all loose cartons without individual scans; photos remain mandatory.
+                photoFileIds:
+                  type: array
+                  minItems: 1
+                  maxItems: 20
+                  uniqueItems: true
+                  items: { type: string, pattern: '^[1-9][0-9]*$' }
+      responses:
+        '200': { description: ApiResponse containing the completed PalletTask; conflicts use business body code }
+  /api/platform/v1/last-leg/cargo-discards/{discardNo}/photos/files/{fileId}/download:
+    parameters:
+      - $ref: '#/components/parameters/DiscardNo'
+      - $ref: '#/components/parameters/FileId'
+      - name: customerId
+        in: query
+        required: true
+        schema: { type: string, pattern: '^[1-9][0-9]*$' }
+    get:
+      summary: Download a submitted photo after application/customer ownership validation
+      x-permissions: [platform:overseas-warehouse:discard:list]
+      responses:
+        '200': { description: Inline JPG/PNG bytes with Cache-Control no-store }
+  /api/merchant/v1/last-leg/cargo-discards/{discardNo}/photos/files/{fileId}/download:
+    parameters:
+      - $ref: '#/components/parameters/DiscardNo'
+      - $ref: '#/components/parameters/FileId'
+    get:
+      summary: Download a submitted photo belonging to the authenticated customer only
+      x-permissions: [merchant:overseas-warehouse:discard:list]
+      responses:
+        '200': { description: Inline JPG/PNG bytes with Cache-Control no-store; no customer override allowed }
+components:
+  securitySchemes:
+    bearerAuth: { type: http, scheme: bearer, bearerFormat: JWT }
+  parameters:
+    DiscardNo: { name: discardNo, in: path, required: true, schema: { type: string } }
+    PalletNo: { name: palletNo, in: path, required: true, schema: { type: string } }
+    FileId: { name: fileId, in: path, required: true, schema: { type: string, pattern: '^[1-9][0-9]*$' } }
+  schemas:
+    Photo:
+      type: object
+      required: [fileId, palletNo, fileName, contentType, sizeBytes, operatorId, createdAt]
+      properties:
+        fileId: { type: string }
+        palletNo: { type: string }
+        fileName: { type: string }
+        contentType: { type: string, enum: [image/jpeg, image/png] }
+        sizeBytes: { type: integer, format: int64, maximum: 10485760 }
+        operatorId: { type: string }
+        createdAt: { type: string, format: date-time }
+        submittedAt: { type: string, format: date-time, nullable: true }
diff --git a/lastleg-service/src/main/resources/openapi/fba-appointment-calendar-v1.yaml b/lastleg-service/src/main/resources/openapi/fba-appointment-calendar-v1.yaml
index 58283d672..8031a7cbb 100644
--- a/lastleg-service/src/main/resources/openapi/fba-appointment-calendar-v1.yaml
+++ b/lastleg-service/src/main/resources/openapi/fba-appointment-calendar-v1.yaml
@@ -33,8 +33,8 @@ paths:
         required: true
         schema: {type: string}
     delete:
-      summary: 取消未关联有效排车的预约并释放占用
-      description: '平台专用，权限platform:appointment:delete。校验版本后保留主单、确认事实及明细历史，设置CANCELLED并释放货源占用；不删除客户货物或回退库存。已有关联有效排车时拒绝。取消原因必填，独立保存于取消命令历史，不覆盖原业务备注；按系统单号、版本、操作者及原因校验幂等，异内容拒绝。'
+      summary: 取消未关联有效排车的预约覆盖并保留本批货量
+      description: '平台专用，权限platform:appointment:delete。校验版本后设置CANCELLED，清除当前有效计划日期、确认号及时段；旧计划与确认保存在不可变取消命令历史。货物分配保持有效，不能再次从整票创建相同货量；不删除客户货物或回退库存。已有关联有效排车时拒绝。取消原因必填，独立保存于取消命令历史，不覆盖原业务备注；按系统单号、版本、操作者及原因校验幂等，异内容拒绝。'
       requestBody:
         required: true
         content:
@@ -56,7 +56,7 @@ paths:
         '403': {description: 无读取权限}
     put:
       summary: 按版本更新预约
-      description: '权限：platform:overseas-warehouse:inbound-order:fba-appointment。平台限定，版本及持久化幂等校验；已有有效排车时先处理运输安排。未约成必须写原因并保留原确认时间。禁止通过更新设置CANCELLED，取消必须调用DELETE并通过独立取消权限、实际原因和历史规则。恢复时重新核对来源、目的仓和占用；不能直接将SUCCESS退回PENDING。'
+      description: '权限：platform:overseas-warehouse:inbound-order:fba-appointment。平台限定，版本及持久化幂等校验；已有有效排车时先处理运输安排。未约成必须写原因，清除无效确认，但保留本批货物分配。禁止通过更新设置CANCELLED，取消必须调用DELETE并通过独立取消权限、实际原因和历史规则。重新安排时重新核对来源、目的仓和占用，沿原批次数量继续；不能直接将SUCCESS退回PENDING。'
       requestBody:
         required: true
         content:
@@ -229,6 +229,10 @@ components:
       properties:
         id: {type: string, description: 内部标识，不作为展示编号}
         appointmentNo: {type: string, description: 系统生成AP业务单号}
+        batchKey: {type: string, description: FBA_APPOINTMENT加不可变主键，用于工作事项关联，不展示内部键}
+        replacementBatchKeys: {type: array, items: {type: string}, description: 分批/合并后的稳定批次键；旧批次历史保留}
+        replacementAppointmentNos: {type: array, items: {type: string}, description: 替代批次业务号；非空时原批次只读}
+        repartitionReason: {type: string, nullable: true}
         confirmationNo: {type: string, nullable: true, description: 对方正式外部确认号}
         plannedDate: {type: string, format: date, nullable: true}
         plannedAt: {type: string, nullable: true}
@@ -255,8 +259,11 @@ components:
               id: {type: string}
               customerId: {type: string, description: 本票货物客户归属，不在预约主单指定客户}
               sourceKey: {type: string}
+              destinationKey: {type: string, description: 本票目的地FBA加仓码，与原来源归属一同保留}
               sourceVersion: {type: string, nullable: true}
               orderId: {type: string, nullable: true}
               inboundCode: {type: string, nullable: true}
               packageCount: {type: integer, nullable: true}
+              cargoVerificationVersion: {type: integer, nullable: true, description: 本次采用的独立核实版本，后续单独核实不改写此快照}
+              shipmentReferences: {type: array, items: {type: string}, description: 本次采用的独立核实货件或追踪号快照，无核实资料时为空列表}
               fbaWarehouseCode: {type: string}
diff --git a/lastleg-service/src/main/resources/openapi/fleet-trips-v1.yaml b/lastleg-service/src/main/resources/openapi/fleet-trips-v1.yaml
index 9af723579..3d5770768 100644
--- a/lastleg-service/src/main/resources/openapi/fleet-trips-v1.yaml
+++ b/lastleg-service/src/main/resources/openapi/fleet-trips-v1.yaml
@@ -29,12 +29,12 @@ security:
 paths:
   /api/platform/v1/last-leg/fleet/trips/calendar:
     get:
-      summary: 读取美国车次计划日历来源
+      summary: 读取美国车次用车日历来源
       description: >-
-        仅PLATFORM且平台公共主体（tenantId=0），权限 platform:fleet:trip:list。from/to 是明确UTC时间点，按计划发车时间读取半开区间，最多44天；
+        仅PLATFORM且平台公共主体（tenantId=0），权限 platform:fleet:trip:list。from/to 是明确UTC时间点，已发车按实际发车时间、尚未发车按计划发车时间读取半开区间，最多44天；
         该保护性窗口供界面最多42个当地日历日加时区边界使用，不扩大界面范围。
         最多2000条候选，超限明确拒绝并要求缩小日期范围，不分页扫描、不静默截断。
-        一车一条，保留取消及完成状态；记录只表示用车计划，不表示收货预约已确认。
+        一车一条，保留取消及完成状态；保留原计划与实际时间，已执行事实不随计划改期移动，不表示收货预约已确认。
         已知非美国仓排除；未知仓库/国家/地理IANA时区进入unresolvedRecords，不落入美国当地日槽。
         一次车次查询加一次仓库批量资料请求，包含停用仓历史资料，资料服务失败返回错误而非空日历。
       parameters:
@@ -358,6 +358,14 @@ components:
                     properties:
                       trip: {$ref: '#/components/schemas/Trip'}
                       dispatches: {type: array, items: {$ref: '#/components/schemas/DispatchBinding'}}
+                      previousDispatches:
+                        type: array
+                        description: 原绑定历史中已不在当前绑定的批次、客户及来源引用，按最新有效证据去重；历史数量不作为当前装载或可分配数量
+                        items: {$ref: '#/components/schemas/PreviousDispatch'}
+                      appointmentHistoryUnavailableReason:
+                        type: string
+                        nullable: true
+                        description: 原绑定历史缺少引用证据或超过1000条读取上限时的明确原因；仅历史引用不可完整使用，当前车次和绑定仍可读
                       loadingReview: {$ref: '#/components/schemas/ReviewState'}
                       driverQualification:
                         type: object
@@ -681,13 +689,24 @@ components:
         recordVersion: {type: integer, format: int64, nullable: true, description: 本次审核所核对的车次版本}
     DispatchBinding:
       type: object
+      required: [appointmentBatches]
       properties:
+        appointmentBatches: {type: array, items: {$ref: 'overseas-business-v1.yaml#/components/schemas/DispatchBatchReference'}}
         dispatchNo: {type: string}
         customerId: {type: string, description: 排车单自身客户归属，由服务端解析}
         packageCount: {type: integer, description: 关联时待发运箱数，不是实物托位数}
         boundBy: {type: string}
         boundAt: {type: string, format: date-time}
         review: {$ref: '#/components/schemas/ReviewState'}
+    PreviousDispatch:
+      type: object
+      required: [dispatchNo, customerId, recordVersion, recordedAt, appointmentBatches]
+      properties:
+        dispatchNo: {type: string}
+        customerId: {type: string}
+        recordVersion: {type: integer, format: int64, description: 原绑定历史的车次版本}
+        recordedAt: {type: string, format: date-time}
+        appointmentBatches: {type: array, items: {$ref: 'overseas-business-v1.yaml#/components/schemas/DispatchBatchReference'}}
     Envelope:
       type: object
       properties:
diff --git a/lastleg-service/src/main/resources/openapi/lastleg-customer-order-progress-v1.yaml b/lastleg-service/src/main/resources/openapi/lastleg-customer-order-progress-v1.yaml
index d702aa64b..db3121322 100644
--- a/lastleg-service/src/main/resources/openapi/lastleg-customer-order-progress-v1.yaml
+++ b/lastleg-service/src/main/resources/openapi/lastleg-customer-order-progress-v1.yaml
@@ -21,6 +21,13 @@ paths:
               required: [customerId]
               properties:
                 customerId: {type: integer, format: int64, minimum: 1}
+                orderIds:
+                  type: array
+                  nullable: true
+                  minItems: 1
+                  maxItems: 200
+                  items: {type: integer, format: int64, minimum: 1}
+                  description: 省略或null查询当前客户全部进度；传入时仅在SQL内查询这些来源Order订单，空数组拒绝，不允许扩大到全客户。
       responses:
         '200':
           description: ApiResponse，只有code为200表示成功；progress为空表示客户当前无有效排车或派送
diff --git a/lastleg-service/src/main/resources/openapi/lastleg-exports-v1.yaml b/lastleg-service/src/main/resources/openapi/lastleg-exports-v1.yaml
index 47152332a..b5c7226a7 100644
--- a/lastleg-service/src/main/resources/openapi/lastleg-exports-v1.yaml
+++ b/lastleg-service/src/main/resources/openapi/lastleg-exports-v1.yaml
@@ -10,6 +10,9 @@ info:
     每批最多 200 行，总行数上限 200000；车队报价及出车记录保留业务查询的 5000 条限制。
     snapshotToken 绑定任务、申请人、执行版本和筛选条件，不表示数据库历史快照。
     TRIP_OPERATIONS_LIST 的 costVisible 仅由 File 根据申请人的 platform:fleet:trip:list 权限写入，不能信任客户端值。
+    SELFOP_INVENTORY_TURNOVER 每批最多100行；parameters 必须提供库存周转列表的 snapshotContext、expectedTotal 和有序 columns（仅列键）。
+    它沿用 inventory-turnover 的筛选、排序、固定版本及30分钟有效期，拒绝 current/size/includeOverview；版本失效或条数变化整任务失败，不切换到最新数据。
+    columns 由服务端白名单解释并追加统计期间、期间出库、平均日末库存、周转率和历史证据；列头与说明由服务端生成。
     原 Lastleg 业务 /export CSV 公网接口已移除。文件领取、过期、失败重试由 File 下载中心管理。
 paths:
   /internal/exports/v1/{exportType}/batches:
@@ -25,7 +28,7 @@ paths:
           required: true
           schema:
             type: string
-            enum: [LAST_MILE_ORDER_LIST, OVERSEAS_INVENTORY_BALANCE, OVERSEAS_INVENTORY_LEDGER, OVERSEAS_QUOTE_LIST, MONTHLY_EXCHANGE_RATE_LIST, VEHICLE_LIST, FLEET_QUOTE_LIST, TRIP_OPERATIONS_LIST]
+            enum: [LAST_MILE_ORDER_LIST, OVERSEAS_INVENTORY_BALANCE, OVERSEAS_INVENTORY_LEDGER, OVERSEAS_QUOTE_LIST, MONTHLY_EXCHANGE_RATE_LIST, VEHICLE_LIST, FLEET_QUOTE_LIST, TRIP_OPERATIONS_LIST, SELFOP_INVENTORY_TURNOVER]
       requestBody:
         required: true
         content:
diff --git a/lastleg-service/src/main/resources/openapi/overseas-business-v1.yaml b/lastleg-service/src/main/resources/openapi/overseas-business-v1.yaml
index 277f26400..4fca6c337 100644
--- a/lastleg-service/src/main/resources/openapi/overseas-business-v1.yaml
+++ b/lastleg-service/src/main/resources/openapi/overseas-business-v1.yaml
@@ -4,6 +4,116 @@ info:
   description: 派送资料完整契约见同目录 delivery-documents-v1.yaml；派送列表/详情行返回 bolNo、documentSummary（三类状态与x/3），状态仍使用 version 和 allowedActions。
   version: 1.0.0
 paths:
+  /api/merchant/v1/last-leg/warehouse-transfers/{transferNo}/increase-forecast-cartons:
+    post:
+      summary: 测量完成前增加预报箱数并补充箱唛
+      description: 客户身份及transfer:create权限；仅外来货物待审核或待PDA测量可用，按原预报快照追加整单箱数，不绑定SKU，实际箱内SKU由PDA清点确定，原箱唛与件数不变。补箱及PDA完工锁定同一订单；成功后PDA刷新继续清点。
+      parameters:
+        - {name: transferNo, in: path, required: true, schema: {type: string}}
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required: [expectedPackageCount, packageCount]
+              properties:
+                expectedPackageCount: {type: integer, minimum: 1, maximum: 5000, description: 修改前整单预报箱数}
+                packageCount: {type: integer, minimum: 1, maximum: 5000, description: 增加后整单预报箱数}
+      responses:
+        '200': {description: 返回补箱后的转运详情，相同原快照和目标箱数重试不重复生成箱唛}
+  /api/platform/v1/last-leg/warehouse-transfers/{transferNo}/increase-forecast-cartons:
+    post:
+      summary: 平台在测量完成前增加整单预报箱数
+      description: 平台身份及 platform:overseas-warehouse:warehouse-transfer:approve 权限；指定目标客户，沿用客户补箱的状态、并发及幂等规则，不改变SKU预报件数。
+      security: [{ bearerAuth: [] }]
+      parameters:
+        - { name: transferNo, in: path, required: true, schema: { type: string } }
+        - { name: customerId, in: query, required: true, schema: { type: string } }
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required: [expectedPackageCount, packageCount]
+              properties:
+                expectedPackageCount: { type: integer, minimum: 1, maximum: 5000 }
+                packageCount: { type: integer, minimum: 1, maximum: 5000 }
+      responses:
+        '200': { description: 补箱后的转运详情 }
+        '409': { description: 已完成测量或原预报箱数过期 }
+  /api/pda/v1/last-leg/warehouse-transfers/{transferNo}/carton-label:
+    get:
+      summary: PDA读取转运箱标签
+      description: 需要 lastleg:pda:operate 与 OVERSEAS_WAREHOUSE_PDA_OPERATOR；只可读取Token绑定仓的转运单标签，包含客户预报及后续补充预报的箱唛。
+      parameters:
+        - {name: transferNo, in: path, required: true, schema: {type: string}}
+      responses:
+        '200': {description: 统一业务响应，成功data为包含printableHtml的箱标签}
+  /api/pda/v1/last-leg/warehouse-transfers/{transferNo}/pallets/drafts:
+    post:
+      summary: 先创建转运签收托盘草稿
+      description: 仅绑定仓PDA可操作，提交幂等键创建空托盘草稿，再调用generate生成实物托盘号。不接收手工箱数、尺寸、体积和重量，箱子清点时按归属自动汇总。
+      parameters:
+        - {name: transferNo, in: path, required: true, schema: {type: string}}
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required: [idempotencyKey]
+              properties:
+                palletId: {type: integer, format: int64, nullable: true}
+                idempotencyKey: {type: string, maxLength: 255}
+      responses:
+        '200': {description: 统一业务响应，data为含空托盘草稿的转运详情}
+  /api/pda/v1/last-leg/warehouse-transfers/{transferNo}/cartons/count:
+    post:
+      summary: 转运逐箱测量与清点
+      description: 仅限 lastleg:pda:operate 与 OVERSEAS_WAREHOUSE_PDA_OPERATOR，绑定仓由统一Token确定。先创建本单托盘号，每箱选择所属托盘，可包含多个本单预报SKU，逐项记录实点件数；同箱SKU不可重复，尺寸重量和实收箱数按实物箱计算一次，托盘体积重量由分配箱子汇总，全部实收箱子测量清点后才可完成打托入库，打托箱数与已清点实收箱数核平；短收箱保留未收到事实，额外箱须客户先增加预报箱数补生成箱唛；清点允许暂不填写差异原因，最终完成测量时仅SKU实收件数有差异才必填原因。事务锁定转运单；原键原载荷重试不重复写入，同键不同载荷拒绝，已确认事实不可覆盖。
+      parameters:
+        - {name: transferNo, in: path, required: true, schema: {type: string}}
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required: [idempotencyKey, boxes, forecastPackageCount]
+              properties:
+                idempotencyKey: {type: string, maxLength: 255}
+                forecastPackageCount: {type: integer, minimum: 1, description: 设备读取的预报箱数，补箱后旧快照须刷新}
+                discrepancyReason: {type: string, maxLength: 1000, description: 清点阶段可选，最终完成测量时SKU实收件数有差异必填原因}
+                boxes:
+                  type: array
+                  minItems: 1
+                  maxItems: 5000
+                  items:
+                    type: object
+                    required: [cartonMark, transferPalletId, length, width, height, weight, items]
+                    properties:
+                      cartonMark: {type: string, maxLength: 255, description: 必须为当前单预报中已存在的仓库唛头}
+                      transferItemId: {type: integer, format: int64, nullable: true, description: 箱子所属本单申报明细}
+                      transferPalletId: {type: integer, format: int64, description: 本单已生成的转运托盘事实ID，逐箱关联，托盘箱数体积重量由箱子汇总}
+                      length: {type: number, minimum: 0.01, description: 箱长厘米}
+                      width: {type: number, minimum: 0.01, description: 箱宽厘米}
+                      height: {type: number, minimum: 0.01, description: 箱高厘米}
+                      weight: {type: number, minimum: 0.01, description: 箱重千克}
+                      items:
+                        type: array
+                        minItems: 1
+                        maxItems: 200
+                        description: 本箱实际SKU明细，仅限本单预报SKU，同箱不可重复
+                        items:
+                          type: object
+                          required: [skuCode, quantity]
+                          properties:
+                            skuCode: {type: string, maxLength: 255}
+                            quantity: {type: integer, minimum: 1, maximum: 2147483647, description: 本SKU箱内实点件数}
+      responses:
+        '200': {description: 统一业务响应，成功data为转运详情，cartons含逐箱尺寸重量、quantity合计件数、items逐SKU明细（transferItemId/skuCode/quantity）及清点操作人时间}
   /api/platform/v1/last-leg/inventory/balances/{balanceId}:
     get:
       summary: 查询单条库存余额详情
@@ -512,7 +622,7 @@ paths:
         - { name: destinationWarehouseCode, in: query, schema: { type: string } }
         - { name: warehouse, in: query, schema: { type: string } }
         - { name: fbaWarehouseCode, in: query, schema: { type: string } }
-        - { name: appointmentStatus, in: query, schema: { type: string, enum: [UNAPPOINTED, PENDING, SUCCESS, FAILED, CANCELLED] } }
+        - { name: appointmentStatus, in: query, schema: { type: string, enum: [UNAPPOINTED, PENDING, SUCCESS, FAILED, CANCELLED, MULTIPLE] } }
         - { name: dispatchStatus, in: query, schema: { type: string, enum: [UNSCHEDULED, SCHEDULED] } }
         - { name: createdFrom, in: query, schema: { type: string, format: date-time } }
         - { name: createdTo, in: query, schema: { type: string, format: date-time } }
@@ -824,8 +934,8 @@ paths:
       responses: { '200': { description: 出库单分页 } }
   /api/platform/v1/last-leg/outbound-orders/return:
     post:
-      summary: 创建退货出库单，支持多个散件SKU分别填写出库数量
-      description: 权限 platform:overseas-warehouse:outbound:create；散件SKU来源仅允许PARCEL可用库存，不包含箱内库存；实体箱按箱或托盘出库。items逐来源指定SKU及数量，与cartonMarks一一对应，不可同时提交顶层skuCode或quantity，不支持PALLET方式。多个SKU生成同一张出库单和派送单，PDA逐SKU按件数拣货。旧版skuCode与quantity继续支持单SKU来源排序分配。未拣货前占用整个使用来源，拣货后来源余数恢复可用。相同幂等键改数量拒绝。
+      summary: 按包裹或箱标签创建整实物退货出库单
+      description: 权限 platform:overseas-warehouse:outbound:create；以包裹或箱为最小单位，cartonMarks为实际标签码，PARCEL可包含多个SKU，整包裹/箱或整托出库。新签收和新合箱须先扫码确认贴标。部分包裹及部分箱均须通过合箱生成独立新标签箱后才能出库。提交skuCode、quantity或非空items直接拒绝，不修改库存。来源合箱占用或尚未清点时拒绝，PDA按实物标签扣全部内容，同键重放不重复扣减。
       security: [{ bearerAuth: [] }]
       parameters: [{ name: customerId, in: query, required: true, schema: { type: string } }]
       requestBody:
@@ -840,20 +950,6 @@ paths:
                 overseasWarehouseId: { type: string, maxLength: 128 }
                 returnNo: { type: string, maxLength: 128 }
                 cartonMarks: { type: array, minItems: 1, maxItems: 200, uniqueItems: true, items: { type: string, maxLength: 128 } }
-                skuCode: { type: string, maxLength: 128, nullable: true }
-                quantity: { type: integer, format: int64, minimum: 1, nullable: true, description: 单SKU计划件数，不得超过所选来源总数；省略出全部，只允许skuCode已填且非PALLET维度，不接受小数 }
-                items:
-                  type: array
-                  nullable: true
-                  minItems: 1
-                  maxItems: 200
-                  items:
-                    type: object
-                    required: [cartonMark, skuCode, quantity]
-                    properties:
-                      cartonMark: { type: string, maxLength: 128, description: 散件库存来源标识，非实体箱号 }
-                      skuCode: { type: string, maxLength: 128 }
-                      quantity: { type: integer, format: int64, minimum: 1, description: 本来源本次出库件数，不接受小数，不得超过可用数量 }
                 unitType: { type: string, enum: [BOX, PALLET], nullable: true }
                 remark: { type: string, maxLength: 1000, nullable: true }
                 idempotencyKey: { type: string, maxLength: 255 }
@@ -1228,9 +1324,18 @@ paths:
       responses: { '200': { description: 当前客户仓储转运单分页 }, '403': { description: 缺少仓储转运查看权限 } }
     post:
       summary: 客户创建仓储转运单
-      description: 权限 merchant:overseas-warehouse:transfer:create；客户范围只取认证 Token。
+      description: 选择已有库存入仓码时，deliveryMethod、deliveryAddress和estimatedArrivalAt不需要提交；服务端保存库存转运标记并清空预计入仓时间，目的去向仅FBA或PRIVATE。外来货物仍须填写入仓方式、地址和预计入仓时间。 权限 merchant:overseas-warehouse:transfer:create；客户范围只取认证 Token。货物 items[].quantity 为 SKU 申报件数（正整数），items[].packageCount 为预计箱数，整单 packageCount 等于明细预计箱数合计；件数与箱数独立，实际签收箱数和每箱件数以 PDA 清点事实为准，支持短收、超收并记录差异原因。目的去向可暂未确定（destinationType 为 NONE 或不传），允许保存草稿、编辑和提交；入库确认后可在出库时绑定 FBA 仓或私人仓，也可选择入库库存发起贴标申请出库；普通转运出库前必须补齐目的仓。
       security: [{ bearerAuth: [] }]
       responses: { '200': { description: 创建后的仓储转运单 }, '403': { description: 缺少仓储转运创建权限 }, '409': { description: 幂等、库存或状态冲突 } }
+  /api/merchant/v1/last-leg/warehouse-transfers/inventory-source-cartons:
+    get:
+      summary: 客户查询库存来源单据的原始箱明细
+      description: 权限 merchant:overseas-warehouse:transfer:create；客户取认证会话。按仓库及入仓码查询真实原单箱快照，返回箱号、SKU子明细、已记录的件数和原目的仓；不存在逐箱快照时返回空数组，不按箱数伪造箱号，不宣称原单箱当前均可用。
+      security: [{ bearerAuth: [] }]
+      parameters:
+        - { name: operatingWarehouseId, in: query, required: true, schema: { type: string } }
+        - { name: inboundCode, in: query, required: true, schema: { type: string } }
+      responses: { '200': { description: 原单箱明细数组，cartonMark/productNameZh/quantity/destinationWarehouseCode/destinationWarehouseName/items；quantity未记录为null }, '403': { description: 缺少创建权限 } }
   /api/merchant/v1/last-leg/warehouse-transfers/{transferNo}:
     get:
       summary: 客户查询自己的仓储转运单详情
@@ -1386,7 +1491,7 @@ paths:
         - { name: status, in: query, schema: { type: string } }
         - { name: overseasWarehouseId, in: query, schema: { type: string } }
         - { name: destinationWarehouseCode, in: query, schema: { type: string } }
-        - { name: appointmentStatus, in: query, schema: { type: string, enum: [UNAPPOINTED, PENDING, SUCCESS, FAILED, CANCELLED] } }
+        - { name: appointmentStatus, in: query, schema: { type: string, enum: [UNAPPOINTED, PENDING, SUCCESS, FAILED, CANCELLED, MULTIPLE] } }
         - { name: dispatchStatus, in: query, schema: { type: string, enum: [UNSCHEDULED, SCHEDULED] } }
         - { name: createdFrom, in: query, schema: { type: string, format: date-time } }
         - { name: createdTo, in: query, schema: { type: string, format: date-time } }
@@ -1654,7 +1759,7 @@ paths:
         '200': { description: 客户换标申请分页, content: { application/json: { schema: { $ref: '#/components/schemas/RelabelMerchantPageResponse' } } } }
     post:
       summary: 创建客户换标申请
-      description: 权限 merchant:overseas-warehouse:relabel:create；申请创建即冻结对应库存。一张申请只能选择一种换标类型，所有 items.operationType 必须一致；不同类型混合提交返回业务参数错误且不冻结库存。SKU_LABEL 不要求派送方式；CARTON_LABEL/CARTON_AND_SKU 必须指定 TRUCK、PICKUP 或 EXPRESS。
+      description: 权限 merchant:overseas-warehouse:relabel:create；申请创建即冻结对应库存。一张申请只能选择一种换标类型，所有 items.operationType 必须一致；不同类型混合提交返回业务参数错误且不冻结库存。SKU_LABEL 不要求派送方式；CARTON_LABEL/CARTON_AND_SKU 必须指定 TRUCK、EXPRESS、PICKUP、AMAZON_PICKUP 或 CUSTOMER_PICKUP。
       security: [{ bearerAuth: [] }]
       requestBody: { required: true, content: { application/json: { schema: { $ref: '#/components/schemas/RelabelCreate' } } } }
       responses:
@@ -1710,6 +1815,31 @@ paths:
         - { name: itemId, in: query, required: false, schema: { type: integer, format: int64 } }
       requestBody: { required: true, content: { multipart/form-data: { schema: { type: object, required: [file], properties: { file: { type: string, format: binary } } } } } }
       responses: { '200': { description: 更新后的换标详情 }, '403': { description: 缺少换标文件维护权限 }, '409': { description: 状态或归属冲突 } }
+  /api/merchant/v1/last-leg/relabel-applications/{relabelNo}/files/{fileId}/download:
+    get:
+      summary: 客户查看或下载申请已绑定的贴标文件
+      description: 权限 merchant:overseas-warehouse:relabel:list；按登录客户隔离，并校验总文件或明细文件归属。响应禁止缓存。
+      security: [{ bearerAuth: [] }]
+      parameters:
+        - { name: relabelNo, in: path, required: true, schema: { type: string } }
+        - { name: fileId, in: path, required: true, schema: { type: integer, format: int64, minimum: 1 } }
+        - { name: scope, in: query, required: true, schema: { type: string, enum: [TOTAL, CARTON_TOTAL, SKU_TOTAL, ITEM] } }
+        - { name: itemId, in: query, required: false, schema: { type: integer, format: int64 } }
+      responses:
+        '200': { description: 贴标 PDF, content: { application/pdf: { schema: { type: string, format: binary } } } }
+        '403': { description: 缺少客户查询权限 }
+        '404': { description: 申请或文件不存在或不属于当前客户 }
+  /api/platform/v1/last-leg/relabel-applications/{relabelNo}/shipping-label/{fileId}/download:
+    get:
+      summary: 平台查看客户上传的换标面单
+      description: 权限 platform:overseas-warehouse:relabel-order:list；校验平台身份及申请的面单绑定关系。
+      security: [{ bearerAuth: [] }]
+      parameters:
+        - { name: relabelNo, in: path, required: true, schema: { type: string } }
+        - { name: fileId, in: path, required: true, schema: { type: integer, format: int64, minimum: 1 } }
+      responses:
+        '200': { description: 面单文件, content: { application/pdf: { schema: { type: string, format: binary } }, image/jpeg: { schema: { type: string, format: binary } }, image/png: { schema: { type: string, format: binary } } } }
+        '404': { description: 文件未绑定当前申请 }
   /api/merchant/v1/last-leg/relabel-applications/{relabelNo}/shipping-label/{fileId}/download:
     get:
       summary: 下载换标快递面单
@@ -1735,7 +1865,7 @@ paths:
   /api/merchant/v1/last-leg/relabel-applications/{relabelNo}/confirm-completion:
     post:
       summary: 客户确认换标完成
-      description: 权限 merchant:overseas-warehouse:relabel:confirm；仅 CUSTOMER_CONFIRM_PENDING 可确认。TRUCK 进入 WAIT_PRE_DISPATCH，PICKUP/EXPRESS 幂等生成 RELABEL_OUTBOUND 出库单；EXPRESS 且要求打印面单时必须先上传面单。
+      description: 权限 merchant:overseas-warehouse:relabel:confirm；仅 CUSTOMER_CONFIRM_PENDING 可确认，确认前复验实际托盘绑定，仓库手动完工不豁免该门禁。普通库存箱唛换标必须绑定实际托盘；退货整箱 EXPRESS、PICKUP、AMAZON_PICKUP、CUSTOMER_PICKUP 可不组托但仍校验全箱 SKU 数量。只有平台卡车 TRUCK 进入 WAIT_PRE_DISPATCH；EXPRESS 与全部自提方式幂等生成 RELABEL_OUTBOUND 出库单和 PDA 出库任务，不进入预排车候选，直接预排请求也拒绝。已分配仓储转运保持原转运出库链，不生成独立出库。EXPRESS 且要求打印面单时必须先上传面单。
       security: [{ bearerAuth: [] }]
       parameters: [{ name: relabelNo, in: path, required: true, schema: { type: string, maxLength: 64 } }]
       requestBody: { required: true, content: { application/json: { schema: { $ref: '#/components/schemas/RelabelCustomerConfirm' } } } }
@@ -1764,7 +1894,7 @@ paths:
   /api/merchant/v1/last-leg/return-orders/{returnNo}:
     get:
       summary: 客户查询退货订单与签收批次
-      description: 权限 merchant:overseas-warehouse:return-order:list；返回各 SKU 的预报和实收数量，以及每次 PDA 签收产生的批次号和可选快递单号。cartons 数组包含 receiptNo、palletCode、cartonMark、countStatus、countedAt、items（skuCode、productNameZh、quantity、boxCount）。CONFIRMED 为签收或清点时不可变箱内快照；PENDING 的 items 为空，不返回预分配平均数；UNRECORDED 表示历史未留存箱内快照，不能以已变化库存冒充签收数量。包裹散件不生成实物箱明细。
+      description: 权限 merchant:overseas-warehouse:return-order:list；返回各 SKU 的预报和实收数量，以及每次 PDA 签收产生的批次号和可选快递单号。cartons 数组包含 receiptNo、palletCode、cartonMark、countStatus、countedAt、items（skuCode、productNameZh、quantity、boxCount）。CONFIRMED 为签收或清点时不可变箱内快照；PENDING 的 items 为空，不返回预分配平均数；UNRECORDED 表示历史未留存箱内快照，不能以已变化库存冒充签收数量。包裹作为一个独立实物明细，保留同包裹全部SKU及可打印标签。
       security: [{ bearerAuth: [] }]
       parameters: [{ name: returnNo, in: path, required: true, schema: { type: string } }]
       responses: { '200': { description: 当前客户退货订单详情 }, '404': { description: 当前客户下退货订单不存在 } }
@@ -1829,7 +1959,7 @@ paths:
   /api/merchant/v1/last-leg/return-inventory/summary:
     get:
       summary: 客户查询退货库存 SKU 汇总
-      description: 客户范围只取认证 Token。按海外仓和 SKU 汇总 PDA 实收上架数量及可用箱数。
+      description: 客户范围只取认证 Token。按海外仓和 SKU 汇总 PDA 实收上架数量及可用箱数。relabelLockedQuantity 为换标处理中整箱锁定的该 SKU 在库件数，包含同箱未申请换标但无法使用的余量；不包含合箱、待清点或出库占用，不等同于未完成换标任务件数。
       security: [{ bearerAuth: [] }]
       parameters:
         - { name: page, in: query, schema: { type: integer, minimum: 1, default: 1 } }
@@ -1851,11 +1981,11 @@ paths:
         - { name: returnNo, in: query, schema: { type: string } }
         - { name: status, in: query, schema: { type: string } }
       responses:
-        '200': { description: 分页 records 每箱一行，包含 cartonMark、overseasWarehouseId、sourceBatchNo、sourceReturnNo、status、skuTypes、totalQuantity、length、width、height、weight、createdAt；total 为实际箱数 }
+        '200': { description: 分页 records 每箱一行，包含 cartonMark、overseasWarehouseId、sourceBatchNo、sourceReturnNo、status、skuTypes、totalQuantity、length、width、height、weight、createdAt、relabelStatus、relabelledQuantity、relabelReservedQuantity；total 为实际箱数。换标状态取实际当前或最新轮次事实，申请占用为未完成申请件数，两者不从可用库存差值推算 }
   /api/merchant/v1/last-leg/return-inventory/cartons/{cartonMark}:
     get:
       summary: 客户查询退货箱明细
-      description: 仅返回当前客户的箱号、签收批次和箱内 SKU 数量。
+      description: 仅返回当前客户的箱号、签收批次和箱内 SKU 数量；relabelStatus 为 UNLABELLED/PROCESSING/PARTIALLY_COMPLETED/COMPLETED，relabelledQuantity 为当前或最新轮次实际商品换标件数，relabelReservedQuantity 为未完成申请件数。items.availableQuantity 为实物可用库存，历史换标不会永久扣减下一轮可申请量。
       security: [{ bearerAuth: [] }]
       parameters: [{ name: cartonMark, in: path, required: true, schema: { type: string, maxLength: 128 } }]
       responses: { '200': { description: 当前客户退货箱明细 }, '404': { description: 当前客户下退货箱不存在 } }
@@ -1897,6 +2027,15 @@ components:
       description: 保留原转运详情字段；新增持久实收命令投影供平台与当前客户恢复。成功实收返回本地事务完成后的命令状态，不暴露内部资源锁或reservationKey。
       required: [receiptCommands]
       properties:
+        packageCount: { type: integer, description: 下单预计箱数，不随实际签收覆盖 }
+        items:
+          type: array
+          items:
+            type: object
+            properties:
+              quantity: { type: integer, format: int64, nullable: true, description: SKU 申报件数，历史未申报为 null }
+              packageCount: { type: integer, description: 该 SKU 预计箱数 }
+        cartons: { type: array, items: { type: object }, description: 实际签收仅统计状态 COUNTED 的箱子 }
         receiptCommands:
           type: array
           items: { $ref: '#/components/schemas/WarehouseTransferReceiptCommand' }
@@ -1989,6 +2128,10 @@ components:
       required: [deliveryNo, packageCount, signedPackages]
       properties:
         deliveryNo: { type: string }
+        customerName: { type: string, nullable: true, description: 客户名称快照；退货换标直出创建时从权威客户目录获取，查询不按ID猜名 }
+        overseasWarehouseName: { type: string, nullable: true, description: 作业海外仓名称快照；退货换标直出创建时从权威仓库目录获取 }
+        totalWeightKg: { type: number, nullable: true, description: 实物毛重千克；退货换标直出按选中实际箱每箱一次汇总，任一箱缺测则为空，不按SKU件数倍乘 }
+        totalVolumeCbm: { type: number, nullable: true, description: 实物体积立方米；退货换标直出按每箱实测长宽高厘米相乘除以1000000，任一箱缺尺寸则为空 }
         packageCount: { type: integer, minimum: 0 }
         signedPackages:
           type: integer
@@ -2015,7 +2158,7 @@ components:
             order: { $ref: '#/components/schemas/DeliveryOrderRow' }
             skus:
               type: array
-              description: 当前派送目的地的本次排车货物投影；数量按冻结排车与本次PDA实拣归属，不返回整单申报箱数。未实拣或MIXED库存没有单SKU归属时保留数量，SKU及品名为null；没有本次SKU测量事实时重量与体积为null，不按比例分摊整单测量。
+              description: 当前派送目的地的本次排车货物投影；数量按冻结排车与本次PDA实拣归属，不返回整单申报箱数。未实拣或MIXED库存没有单SKU归属时保留数量，SKU及品名为null；没有本次SKU测量事实时重量与体积为null，不按比例分摊整单测量。退货换标直接出库沿签收货物约定，按每实物箱的sku_code排序，仅首SKU行承载1箱及冻结的整箱重量/体积，其余SKU行承载0箱、物理量为空；每行productQuantity仍是对应SKU件数，整箱物理量不是单SKU净重。
               items: { $ref: '#/components/schemas/DeliveryCargoSku' }
     DeliveryCargoSku:
       type: object
@@ -2029,9 +2172,10 @@ components:
         fbaTrackingNo: { type: string, nullable: true }
         skuCode: { type: string, nullable: true }
         productName: { type: string, nullable: true }
-        packageCount: { type: integer, minimum: 0, description: 本次排车/实拣的箱数，不是整单申报箱数 }
-        weightKg: { type: number, nullable: true }
-        volumeCbm: { type: number, nullable: true }
+        packageCount: { type: integer, minimum: 0, description: 本次实物箱贡献数，不是件数或整单申报箱数；退货换标直出同箱仅首SKU行计1，其余为0 }
+        productQuantity: { type: string, nullable: true, pattern: '^[0-9]+$', description: 退货箱中本行SKU件数，long按字符串返回；不用于乘算箱级重量或体积 }
+        weightKg: { type: number, nullable: true, description: 千克；退货换标直出同箱首SKU行承载冻结整箱毛重，其余行或缺测为null }
+        volumeCbm: { type: number, nullable: true, description: 立方米；退货换标直出同箱首SKU行承载冻结整箱体积，其余行或缺测为null }
     ReturnOrderCreate:
       type: object
       required: [overseasWarehouseId, needRelabel, idempotencyKey, items]
@@ -2712,6 +2856,7 @@ components:
               draftContainerId: { type: integer, format: int64 }
               planPalletIds: { type: array, maxItems: 500, items: { type: integer, format: int64 } }
               returnReceiptIds: { type: array, maxItems: 500, items: { type: integer, format: int64 } }
+              batchAllocations: { type: array, maxItems: 1000, items: { $ref: './appointment-work-v1.yaml#/components/schemas/DispatchBatchAllocation' } }
     SmartDispatchDraftGroupResult:
       type: object
       required: [draftContainerId, dispatch]
@@ -2722,6 +2867,11 @@ components:
       type: object
       description: planPalletIds与returnReceiptIds是两类正式来源，合计至少一项且最多500项。退回来源仅接受实际入账生成的实收记录，不得用退回实收ID冒充计划托盘ID；同一实物托盘不可重复选择。
       properties:
+        batchAllocations:
+          type: array
+          maxItems: 1000
+          description: 已有预约批次的FBA实物必须逐票绑定，整托总量或可变预约号不能替代；发车再次校验实物与原预约。
+          items: { $ref: './appointment-work-v1.yaml#/components/schemas/DispatchBatchAllocation' }
         planPalletIds: { type: array, maxItems: 500, uniqueItems: true, items: { type: string } }
         returnReceiptIds: { type: array, maxItems: 500, uniqueItems: true, items: { type: string }, description: 原订单实际退回入账来源ID }
         fbaAppointmentNo: { type: string, nullable: true, maxLength: 64 }
@@ -2737,7 +2887,7 @@ components:
         returnReceiptId: { type: string }
         sourceType: { type: string, enum: [INBOUND_PLAN, RETURN_RECEIPT] }
         draftToken: { type: string, minLength: 1, maxLength: 64 }
-        draftContainerId: { type: string, nullable: true, description: 托盘所在草稿车厢ID }
+        draftContainerId: { type: string, nullable: true, description: 托盘所在草稿车厢ID；省略时复用唯一分组，无分组则新建30托默认组，多组时必须明确选择 }
     SmartDispatchDraftRelease:
       type: object
       required: [draftToken]
@@ -2972,6 +3122,7 @@ components:
       properties: { reason: { type: string, minLength: 1, maxLength: 1000 } }
     DispatchResponse:
       type: object
+      required: [appointmentBatches]
       properties:
         id: { type: string }
         dispatchNo: { type: string }
@@ -2984,6 +3135,10 @@ components:
         overseasWarehouseId: { type: string }
         overseasWarehouseName: { type: string }
         departAt: { type: string, format: date-time, nullable: true }
+        appointmentBatches:
+          type: array
+          description: 当前排车分配中的全部原批次、客户及来源引用；无预约分配时为空，不通过旧预约号推导
+          items: { $ref: '#/components/schemas/DispatchBatchReference' }
         fbaAppointmentNo: { type: string, nullable: true }
         fbaAppointmentStatus: { type: string }
         vehicleAppointmentStatus: { type: string }
@@ -3006,6 +3161,21 @@ components:
           type: array
           description: 仅详情接口返回的BOL打印聚合行；分页接口返回空数组，避免列表查询放大
           items: { $ref: '#/components/schemas/DispatchBolLine' }
+    DispatchBatchSource:
+      type: object
+      required: [sourceKey, destinationKey, packageCount]
+      properties:
+        sourceKey: { type: string }
+        destinationKey: { type: string }
+        packageCount: { type: integer, minimum: 1 }
+    DispatchBatchReference:
+      type: object
+      required: [batchKey, batchNo, customerId, sources]
+      properties:
+        batchKey: { type: string, description: 原分配持久化的稳定批次键 }
+        batchNo: { type: string, nullable: true, description: 原批次业务号；缺失不以内码代替 }
+        customerId: { type: string }
+        sources: { type: array, items: { $ref: '#/components/schemas/DispatchBatchSource' } }
     DispatchWorkflow:
       type: object
       required: [tripNo, dispatchReview, loadingReview]
@@ -3078,9 +3248,12 @@ components:
         labelDeadline: { type: string, format: date-time }
         status: { $ref: '#/components/schemas/RelabelStatus' }
         itemCount: { type: integer }
+        skuCodes: { type: string, description: 汇总全部箱内 skuItems 的旧 SKU 并去重，以逗号分隔；无 SKU 换标子明细时汇总主明细 SKU }
         totalPackageCount: { type: integer }
         notifiedPackageCount: { type: integer }
-        deliveryMethod: { type: string, nullable: true, enum: [TRUCK, PICKUP, EXPRESS] }
+        productNameZh: { type: string, description: 明细非空中文品名按原顺序去重并以顿号连接 }
+        labelRequirement: { type: string, description: 明细非空贴标要求按原顺序去重并以中文分号连接 }
+        deliveryMethod: { type: string, nullable: true, enum: [TRUCK, EXPRESS, PICKUP, AMAZON_PICKUP, CUSTOMER_PICKUP], description: 仅TRUCK进入平台预排车；快递及全部自提直接创建出库任务 }
         printShippingLabel: { type: boolean }
         shippingLabelFileId: { type: string, nullable: true }
         fulfillmentStatus: { type: string, nullable: true, enum: [WAIT_RELABEL, WAIT_PRE_DISPATCH, WAIT_TRANSFER_OUTBOUND, READY_FOR_OUTBOUND, OUTBOUND_CREATED, OUTBOUNDED, COMPLETED] }
@@ -3088,6 +3261,9 @@ components:
         customerConfirmedAt: { type: string, format: date-time, nullable: true }
         reviewChannel: { type: string, enum: [TAIL_ORDER, RELABEL_ORDER], description: TAIL_ORDER 表示客户直接贴标，RELABEL_ORDER 表示其他业务关联换标 }
         reviewRemark: { type: string, nullable: true, description: 当前驳回状态最近一次审核驳回原因 }
+        reviewedAt: { type: string, format: date-time, nullable: true, description: 最近一次申请审核通过或驳回时间 }
+        relabelCompletedAt: { type: string, format: date-time, nullable: true, description: 本轮贴标作业提交完成时间，退回重做后完成前为空 }
+        outboundAt: { type: string, format: date-time, nullable: true, description: 实际出库时间，无需出库的纯 SKU 贴标完成不会产生出库时间 }
         createdAt: { type: string, format: date-time }
     RelabelDetail:
       type: object
@@ -3118,6 +3294,20 @@ components:
     RelabelInventoryCandidate:
       type: object
       properties:
+        cartonAvailablePackages: { type: integer, format: int64, minimum: 0, maximum: 1, description: 仅换箱唛可选择的当前实物箱数；已换 SKU 不影响可选箱数，占用和合箱预留仍不可选 }
+        cartonSkuItems:
+          type: array
+          description: 当前实物箱内全部 SKU 和件数，包含换标后的新 SKU
+          items:
+            type: object
+            properties:
+              skuCode: { type: string }
+              quantity: { type: integer, minimum: 1 }
+        skuConversions: { type: array, items: { $ref: '#/components/schemas/ReturnSkuConversion' }, description: 当前实物关联的旧新SKU转换、实际件数和客户确认状态 }
+        relabelStatus: { type: string, nullable: true, enum: [UNLABELLED, PROCESSING, PARTIALLY_COMPLETED, COMPLETED], description: 退货实物按实际完成件数和未完成申请占用计算 }
+        relabelledPackages: { type: integer, format: int64, description: 退货实际已完成商品换标件数，不从可用库存差值推导 }
+        relabelledQuantity: { type: integer, format: int64, minimum: 0 }
+        relabelReservedQuantity: { type: integer, format: int64, minimum: 0, description: 未完成申请件数，取消或完成后释放 }
         inventoryBalanceId: { type: string }
         inboundOrderId: { type: string }
         inboundOrderNo: { type: string }
@@ -3132,7 +3322,7 @@ components:
         availablePackages: { type: integer, format: int64 }
         version: { type: integer, format: int64 }
         positions: { type: array, items: { $ref: '#/components/schemas/RelabelInventoryPosition' } }
-        sourceType: { type: string, enum: [INBOUND, RETURN_CARTON] }
+        sourceType: { type: string, enum: [INBOUND, RETURN_CARTON, RETURN_PARCEL], description: RETURN_PARCEL与RETURN_CARTON均支持整实体箱唛、SKU或混贴，实物单位计1；SKU按件，编码转换保留原识别码及总件数，部分出库需先隔离为独立新箱 }
         returnCartonId: { type: string, nullable: true, description: 退货合箱库存主键；sourceType=RETURN_CARTON 时提供 }
         cartonMark: { type: string, nullable: true, description: 仓库合箱后打印并贴箱的仓库唛头 }
         skuItems:
@@ -3145,6 +3335,16 @@ components:
               newSkuCode: { type: string, nullable: true }
               quantity: { type: integer, minimum: 1 }
               remark: { type: string, nullable: true }
+    ReturnSkuConversion:
+      type: object
+      properties:
+        relabelNo: { type: string }
+        cartonMark: { type: string, description: 完工时的包裹或箱识别码 }
+        oldSkuCode: { type: string }
+        newSkuCode: { type: string }
+        quantity: { type: integer, format: int64, minimum: 1 }
+        status: { type: string, enum: [APPLIED, CONFIRMED, REVERSED] }
+        completedAt: { type: string, format: date-time }
     RelabelInventoryPosition:
       type: object
       properties:
@@ -3192,7 +3392,7 @@ components:
         chargeAmount: { type: number, nullable: true, minimum: 0.01, description: 本次贴标费用（CNY）；未传时不冻结或结算资金 }
         remark: { type: string, nullable: true, maxLength: 1000 }
         idempotencyKey: { type: string, maxLength: 255 }
-        deliveryMethod: { type: string, nullable: true, enum: [TRUCK, EXPRESS, TRUCK_PICKUP, EXPRESS_PICKUP, PICKUP], description: 只换箱唛或SKU与箱唛同时换时必填；只换SKU时不传 }
+        deliveryMethod: { type: string, nullable: true, enum: [TRUCK, EXPRESS, AMAZON_PICKUP, CUSTOMER_PICKUP, PICKUP], description: 只换箱唛或SKU与箱唛同时换时必填；只换SKU时不传；仅TRUCK进入平台预排车，其余方式直接创建出库任务 }
         printShippingLabel: { type: boolean, default: false, description: 仅快递派送可选，客户确认前必须已上传面单 }
         items: { type: array, minItems: 1, maxItems: 500, items: { $ref: '#/components/schemas/RelabelItem' } }
     RelabelItem:
diff --git a/lastleg-service/src/main/resources/openapi/overseas-pda-operations-v1.yaml b/lastleg-service/src/main/resources/openapi/overseas-pda-operations-v1.yaml
index b0dad9ad6..06561c1e4 100644
--- a/lastleg-service/src/main/resources/openapi/overseas-pda-operations-v1.yaml
+++ b/lastleg-service/src/main/resources/openapi/overseas-pda-operations-v1.yaml
@@ -220,9 +220,44 @@ paths:
   /api/pda/v1/last-leg/pallet-operations/relabel-disassemble:
     post:
       summary: 按换标箱唛拆托并绑定目标托盘
-      description: PDA选择原入仓单库存行并扫描实际来源托盘，输入拆出箱数，核对本批cartonMarks后扫描目标托盘。传actualSource时以其数量和版本为准，同入仓余额及批次内原子调整本单冻结记账位置，再移动冻结库存和换标明细；不新增入库、不改变库存归属、不占用其他单据冻结量。每次一个来源库存行，可分批处理多个托盘。已有出库单时不允许此数量重分配。未传actualSource的箱唛模式仍要求已有来源仓位一致。
+      description: PDA选择原入仓单库存行并扫描实际来源托盘，输入拆出箱数，核对本批cartonMarks后扫描目标托盘。传actualSource时以其数量和版本为准，同入仓余额及批次内原子调整本单冻结记账位置，再移动冻结库存和换标明细；不新增入库、不改变库存归属、不占用其他单据冻结量。每次一个来源库存行，可分批处理多个托盘。已有出库单时不允许此数量重分配。未传actualSource的箱唛模式仍要求已有来源仓位一致。普通库存整托全部换标允许目标与来源为同一托盘，校验整托数量和本单冻结归属后仅记录绑定、不搬移库存；部分换标必须使用新托盘。按箱实测的仓储转运按实测箱追踪移托：来源扣除移出箱体积重量，目标增加同箱数据；同规格自动分配，混合箱规通过measuredCartons选择实际箱，改绑保留首次来源箱身份。其他整托测量来源仍按原规则补测。
       requestBody: { required: true, content: { application/json: { schema: { $ref: '#/components/schemas/RelabelPalletDisassemble' } } } }
       responses: { '200': { description: 箱唛级拆托绑定结果 }, '409': { description: 箱唛、库存或托盘版本冲突 } }
+  /api/pda/v1/last-leg/pallet-operations/relabel-pallet-measurements:
+    post:
+      summary: 查询仓储转运换标涉及托盘的最终测量及库存版本
+      description: 权限 lastleg:pda:operate 及海外PDA角色；仅Token绑定仓。按箱实测的仓储转运返回cartonAggregated=true，按当前实测箱自动汇总，不要求整托长宽高或人工确认；箱数与当前库存必须一致且每箱尺寸重量有效。其他整托测量来源沿用原始测量或补测。测量保存为PALLET_MEASURE作业历史，库存版本变化后失效。
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required: [relabelNo]
+              properties:
+                relabelNo: { type: string, maxLength: 64 }
+      responses: { '200': { description: '托盘业务码、箱数、stockVersion、长宽高cm、毛重kg、体积m³及inherited；按箱测量的原托盘不虚构整托尺寸，长宽高为null，sourceCartonSpecs返回按箱规分组的lengthCm/widthCm/heightCm/grossWeightKg（每箱）/cartons；cartonAggregated表示按箱自动汇总，cartons返回当前托盘实测箱的cartonMark、customerCartonMark及尺寸重量，移托后自动重新汇总。其他来源换标返回空列表' }, '409': { description: 不属于当前仓 } }
+  /api/pda/v1/last-leg/pallet-operations/relabel-pallet-measure:
+    post:
+      summary: 确认仓储转运换标托盘最终实测
+      description: 已认领的操作员可在处理中保存；待出库但未排车亦可补测。保存当前stockVersion及实测长宽高、毛重，服务端计算体积；相同幂等键异载荷拒绝，库存变化要求刷新。按箱实测托盘拒绝手动整托测量，直接使用箱数据。排车前核验所有相关非空托盘，包括原托盘余货。
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required: [relabelNo, palletCode, stockVersion, idempotencyKey, lengthCm, widthCm, heightCm, grossWeightKg]
+              properties:
+                relabelNo: { type: string, maxLength: 64 }
+                palletCode: { type: string, maxLength: 128 }
+                stockVersion: { type: string, description: 查询返回的当前库存版本指纹 }
+                idempotencyKey: { type: string, maxLength: 128 }
+                lengthCm: { type: number, minimum: 0.01, multipleOf: 0.01 }
+                widthCm: { type: number, minimum: 0.01, multipleOf: 0.01 }
+                heightCm: { type: number, minimum: 0.01, multipleOf: 0.01 }
+                grossWeightKg: { type: number, minimum: 0.01, multipleOf: 0.001 }
+      responses: { '200': { description: 已保存并返回全部相关托盘测量 }, '409': { description: 版本、归属、状态、认领人或幂等载荷冲突 } }
   /api/pda/v1/last-leg/pallet-operations/swap:
     post:
       summary: 将整托库存更换到空目标托盘
@@ -272,11 +307,82 @@ paths:
                 itemId: { type: string, pattern: '^[0-9]+$' }
                 skuIndex: { type: integer, minimum: 0 }
                 oldSku: { type: string, maxLength: 255 }
+                cartonMark: { type: string, maxLength: 128, description: 退货SKU作业必填，须扫描当前实体来源包裹或箱 }
+                newSkuCode: { type: string, maxLength: 128, description: 退货SKU作业必填，须与批准的目标标签一致 }
+                quantity: { type: integer, minimum: 1, description: 退货SKU作业必填，须与本明细批准件数一致 }
                 expectedVersion: { type: integer, minimum: 0 }
                 idempotencyKey: { type: string, maxLength: 255 }
       responses:
         '200': { description: 更新后的任务, content: { application/json: { schema: { $ref: '#/components/schemas/RelabelDetailResponse' } } } }
         '409': { description: 已处理、映射不符、认领人或版本冲突 }
+  /api/pda/v1/last-leg/relabel-tasks/{relabelNo}/return-skus/complete:
+    post:
+      summary: 扫描来源包裹或箱及SKU登记退货按件换标实际完成量
+      parameters: [{ name: relabelNo, in: path, required: true, schema: { type: string } }]
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required: [itemId, quantity, expectedVersion, idempotencyKey, cartonMark, skuCode]
+              properties:
+                itemId: { type: string, pattern: '^[0-9]+$' }
+                quantity: { type: integer, minimum: 1 }
+                expectedVersion: { type: integer, minimum: 0 }
+                idempotencyKey: { type: string, maxLength: 255 }
+                cartonMark: { type: string, maxLength: 128 }
+                skuCode: { type: string, maxLength: 128 }
+      responses: { '200': { description: 更新后Detail；同键同请求重放 }, '409': { description: 来源、SKU、剩余件数或版本冲突 } }
+  /api/pda/v1/last-leg/relabel-tasks/{relabelNo}/return-skus/complete-total:
+    post:
+      summary: 单一来源的退货SKU按件完成
+      description: 同SKU涉及多个来源包裹或箱时拒绝自动分配，必须逐来源扫码。
+      parameters: [{ name: relabelNo, in: path, required: true, schema: { type: string } }]
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required: [skuCode, quantity, expectedVersion, idempotencyKey]
+              properties:
+                skuCode: { type: string }
+                quantity: { type: integer, minimum: 1 }
+                expectedVersion: { type: integer, minimum: 0 }
+                idempotencyKey: { type: string }
+      responses: { '200': { description: 更新后Detail }, '409': { description: 多来源或数量冲突 } }
+  /api/pda/v1/last-leg/relabel-tasks/{relabelNo}/return-cartons/pack:
+    post:
+      summary: 将本任务已完成的退货SKU件数隔离合箱为独立新箱
+      description: 必须由认领人在PROCESSING阶段完成所有申请明细后执行；原包裹余量守恒，保留跨退货单追溯。响应Detail的items切换为新箱，history的RETURN_PACK.detail JSON含round、sourceCartonMarks、sourceDeductions、cartonMark、quantity和label.printableHtml。标签为仓库识别标签，与商品换标资料分开。同键重放原结果。
+      parameters: [{ name: relabelNo, in: path, required: true, schema: { type: string } }]
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required: [sourceCartonMarks, idempotencyKey, length, width, height, weight]
+              properties:
+                sourceCartonMarks: { type: array, minItems: 1, maxItems: 100, items: { type: string } }
+                targetCartonMark: { type: string, nullable: true, description: 必须为空，由系统生成独立新箱 }
+                idempotencyKey: { type: string, maxLength: 255 }
+                sourceDeductions:
+                  type: array
+                  description: 可省略由服务端生成；填写时按来源箱和SKU汇总必须与本任务完成明细一致
+                  items:
+                    type: object
+                    required: [cartonMark, skuCode, quantity]
+                    properties:
+                      cartonMark: { type: string }
+                      skuCode: { type: string }
+                      quantity: { type: integer, format: int64, minimum: 1 }
+                length: { type: number, exclusiveMinimum: true, minimum: 0 }
+                width: { type: number, exclusiveMinimum: true, minimum: 0 }
+                height: { type: number, exclusiveMinimum: true, minimum: 0 }
+                weight: { type: number, exclusiveMinimum: true, minimum: 0 }
+      responses: { '200': { description: 更新后Detail含新箱识别标签 }, '409': { description: 未完成申请、来源变动或数量冲突 } }
   /api/pda/v1/last-leg/relabel-tasks/{relabelNo}/units/skip:
     post:
       summary: 登记一件有原因的跳过事实
@@ -309,9 +415,10 @@ paths:
   /api/pda/v1/last-leg/relabel-tasks/{relabelNo}/complete:
     post:
       summary: 提交现场任务到复核池并直接等待客户确认
+      description: 按箱测量的仓储转运换标自动汇总各托盘剩余实测箱的体积重量，无需确认整托实测；箱数据不全或库存箱数不符时拒绝完成。其他整托来源仍校验有效实测尺寸和重量；手动完成也不能跳过校验。缺失或库存版本变化导致实测失效时，保持处理中并提示补测。
       parameters: [{ name: relabelNo, in: path, required: true, schema: { type: string } }]
       requestBody: { required: true, content: { application/json: { schema: { $ref: '#/components/schemas/RelabelComplete' } } } }
-      responses: { '200': { description: WAIT_REVIEW任务, content: { application/json: { schema: { $ref: '#/components/schemas/RelabelDetailResponse' } } } }, '409': { description: 箱数未核平、照片或版本冲突 } }
+      responses: { '200': { description: WAIT_REVIEW任务, content: { application/json: { schema: { $ref: '#/components/schemas/RelabelDetailResponse' } } } }, '409': { description: 托盘实测缺失或失效、箱数未核平、照片或版本冲突 } }
   /api/pda/v1/last-leg/relabel-tasks/{relabelNo}/review:
     post:
       summary: 已停用；客户确认完成复核，退回重贴由平台执行
@@ -480,6 +587,7 @@ components:
       required: [idempotencyKey, photoFileIds]
       properties:
         idempotencyKey: { type: string, minLength: 1, maxLength: 255 }
+        discrepancyReason: { type: string, maxLength: 1000, nullable: true, description: 任一SKU实收件数与预报不同时完成测量必填，原因随完成事务保存 }
         photoFileIds:
           type: array
           minItems: 1
@@ -751,6 +859,8 @@ components:
       type: object
       required: [relabelNo, applicationStatus, operationType, taskStatus, expectedPackages, relabelledPackages, skippedPackages, exceptionPackages, version, completionPhotoFileIds, items, unitFacts, history]
       properties:
+        deliveryMethod: { type: string, nullable: true, enum: [TRUCK, EXPRESS, PICKUP, AMAZON_PICKUP, CUSTOMER_PICKUP], description: 申请真实运输方式，纯SKU留仓为空；只有平台卡车TRUCK进入预排车，快递和所有自提直接创建出库任务 }
+        requiresPalletBinding: { type: boolean, description: 普通库存箱唛或混合换标须实际托盘绑定；退货整箱EXPRESS、PICKUP、AMAZON_PICKUP、CUSTOMER_PICKUP不要求排车组托，TRUCK要求；纯SKU留仓为空派送方式时不要求组托 }
         relabelNo: { type: string }
         customerOrderNo: { type: string, nullable: true }
         labelDeadline: { type: string, format: date-time, nullable: true }
@@ -791,7 +901,7 @@ components:
         relabelFileUrl: { type: string, nullable: true }
         cartonMark: { type: string, nullable: true, description: 我方箱唛 }
         fbaCartonMark: { type: string, nullable: true, description: 新FBA箱唛 }
-        operationType: { type: string, enum: [CARTON_LABEL, SKU_LABEL, CARTON_AND_SKU] }
+        operationType: { type: string, enum: [CARTON_LABEL, SKU_LABEL, CARTON_AND_SKU, RETURN_BULK_SKU_LABEL] }
         skuItems: { type: array, items: { $ref: '#/components/schemas/RelabelSkuItem' } }
         expectedPackages: { type: integer }
         relabelledPackages: { type: integer }
@@ -799,6 +909,8 @@ components:
         exceptionPackages: { type: integer }
         cartonProcessedPackages: { type: integer, description: 本轮箱唛作业已完成箱数，混合单独立计数 }
         skuProcessedPackages: { type: integer, description: 本轮SKU作业已完成箱数，两项均完成才增加整箱已换标数 }
+        returnCartonId: { type: string, nullable: true, description: 真实退货包裹或箱ID }
+        returnQuantity: { type: integer, format: int64, minimum: 0, description: 当前实物包裹或箱全部件数；不是申请量 }
     RelabelSkuItem:
       type: object
       required: [skuCode, newSkuCode, quantity]
@@ -876,7 +988,7 @@ components:
         inventoryPositionId: { type: string, nullable: true, pattern: '^[0-9]+$', description: 普通库存使用真实仓位键；退货箱库存没有该仓位，提交 null，不提交空字符串或退货库存内部ID }
         packages: { type: integer, format: int64, minimum: 1 }
         productQuantity: { type: integer, format: int64, minimum: 1, nullable: true, description: 单SKU退货明细存在returnSkuQuantity时必填且必须等于计划件数；不接受小数。历史无快照明细可省略 }
-        skuCode: { type: string, maxLength: 128, nullable: true, description: PARCEL散件单SKU扫码值；已装箱来源必须扫描箱唛 }
+        skuCode: { type: string, maxLength: 128, nullable: true, description: 仅遗留已创建SKU任务使用；新退货任务必须扫描包裹或箱标签 }
         idempotencyKey: { type: string, minLength: 1, maxLength: 255 }
         cartonMarks:
           type: array
@@ -1018,6 +1130,16 @@ components:
         source: { $ref: '#/components/schemas/PalletExpectation' }
         target: { $ref: '#/components/schemas/PalletExpectation' }
         cartonMarks: { type: array, minItems: 1, maxItems: 500, uniqueItems: true, items: { type: string, maxLength: 255 } }
+        measuredCartons:
+          type: array
+          maxItems: 500
+          description: 混合箱规选择实际移出箱；同规格可省略，改绑自动沿用首次绑定
+          items:
+            type: object
+            required: [cartonMark, sourceCartonMark]
+            properties:
+              cartonMark: { type: string, maxLength: 255, description: 本次换标明细箱唛 }
+              sourceCartonMark: { type: string, maxLength: 255, description: 来源实测箱的系统箱号 }
         actualSource: { $ref: '#/components/schemas/PalletMoveLine' }
         reason: { type: string, maxLength: 500 }
     RelabelSource:
diff --git a/lastleg-service/src/main/resources/openapi/return-packing-v1.yaml b/lastleg-service/src/main/resources/openapi/return-packing-v1.yaml
index b579ee2a8..6cabcdfa1 100644
--- a/lastleg-service/src/main/resources/openapi/return-packing-v1.yaml
+++ b/lastleg-service/src/main/resources/openapi/return-packing-v1.yaml
@@ -2,13 +2,13 @@ openapi: 3.0.3
 info:
   title: 退货合箱计划与箱级上架
   version: 1.0.0
-  description: 散SKU查询客户全部同仓PARCEL可用库存；箱合并精确指定来源箱唛并扫描已有目标箱。托盘仅为可选载体。合箱不新增订单货量。
+  description: 包裹可包含多个SKU并拥有独立标签；整包裹/箱可直接出库，部分数量须精确选择来源包裹/箱合箱成新标签箱。托盘仅为可选载体。合箱不新增订单货量。SKU编码换标完工时原子扣旧SKU、加新SKU，总件数守恒；客户确认前保持RELABEL_PENDING占用，退回重做冲回本轮转换。CartonDetail返回skuConversions（换标单号、完工识别码、旧新SKU、实际数量、APPLIED/CONFIRMED/REVERSED状态和时间），items返回当前quantity、availableQuantity、relabelledQuantity、remainingRelabelQuantity；新SKU已换标件数不可二次换标。
 security: [{ bearerAuth: [] }]
 paths:
   /api/platform/v1/last-leg/return-packing-plans:
     get:
       summary: 合箱计划分页
-      description: return-inventory:list；page/size/status/planNo 查询，planNo 去除首尾空格后按字面包含匹配，统计与分页使用相同条件。每条计划返回 createdAt 和 completedAt（实际合箱完成时间）；已完成计划 resultCartons 返回实际箱唛、SKU数量及当前库位、载体托盘。完成时间不使用箱子的 putawayAt，原箱多次合箱时仍显示本次计划完成时间。
+      description: return-inventory:list；page/size/status/planNo 查询，planNo 去除首尾空格后按字面包含匹配，统计与分页使用相同条件。每条计划返回 createdAt 和 completedAt（实际合箱完成时间）；sources 返回来源箱唛、sourceReturnNo、创建时 originalItems、计划取出 items 和 participation（FULL/PARTIAL/UNKNOWN）。已完成计划 completionCartons 为不可变完成时标签及箱内数量快照，transfers 为来源单/来源箱/SKU/目标箱的本次流向，completedBy 为操作员名称；resultCartons 仅返回当前库存及库位，不替代历史结果。完成时间不使用箱子的 putawayAt，原箱多次合箱时仍显示本次计划完成时间。
       parameters:
         - { name: planNo, in: query, schema: { type: string, maxLength: 128 }, description: 合箱计划号，支持部分编号查询 }
         - { name: customerId, in: query, schema: { type: string, maxLength: 64 }, description: 客户筛选 }
@@ -17,7 +17,7 @@ paths:
       responses: { '200': { description: 业务响应信封 code为200成功，A0400/A0404/A0409校验或状态错误，requestId及traceId保留 }, '403': { description: 权限或角色不符 } }
     post:
       summary: 创建并锁定来源库存
-      description: return-inventory:list + lastleg:inventory:manage；同客户同仓已签收订单，BOX精确锁来源箱全部SKU，SKU只锁散件指定数量。
+      description: return-inventory:list + lastleg:inventory:manage；同客户同仓已签收订单，BOX精确锁来源箱全部SKU，SKU锁定所选包裹/箱的指定数量，来源实物在计划完成或取消前不可出库。
       requestBody: { required: true, content: { application/json: { schema: { $ref: '#/components/schemas/Create' } } } }
       responses: { '200': { description: 业务响应信封 code为200成功，A0400/A0404/A0409校验或状态错误，requestId及traceId保留 }, '403': { description: 权限或角色不符 } }
   /api/platform/v1/last-leg/return-packing-plans/{planNo}/review:
@@ -40,22 +40,28 @@ paths:
   /api/pda/v1/last-leg/return-inventory/packing/plans/{planNo}:
     get:
       summary: 读取精确锁定的来源和数量
-      description: 绑定仓范围；sources含来源箱逐SKU锁定件数，boxes含汇总数量。
+      description: 绑定仓范围；sources含来源单、原箱内容快照、参与方式及逐SKU锁定件数，boxes含汇总数量。业务详情currentCartons显示当前实物箱及ownership逐来源单SKU贡献，整箱库存只计一次；packingDetails带planNo。跨来源单同SKU的部分移箱或部分贴标须先现场分拣确认，不自动猜测实物归属。
       parameters: [{ name: planNo, in: path, required: true, schema: { type: string } }]
       responses: { '200': { description: 业务响应信封 code为200成功，A0400/A0404/A0409校验或状态错误，requestId及traceId保留 }, '403': { description: 权限或角色不符 } }
   /api/pda/v1/last-leg/return-inventory/packing/plans/{planNo}/complete:
     post:
       summary: 多箱分配并完成计划
-      description: SKU目标总量须等于锁定量。BOX先选择新增目标箱或扫描已有目标箱，sourceDeductions逐来源箱及SKU指定实际扣除量（不超过锁定量），未使用预占释放；目标原库存不扣减，新箱须填写箱规并生成系统箱唛。全事务、同载荷重放标签快照。
+      description: SKU目标总量须等于锁定量。SKU仅支持新增目标箱；BOX整箱可扫描已有目标箱，部分扣除仅支持新增目标箱，sourceDeductions逐来源箱及SKU必须与计划锁定量完全一致（作为目标的计划原箱除外）；目标原库存不扣减，新箱须填写箱规并生成系统箱唛。全事务、同载荷重放标签快照。
       parameters: [{ name: planNo, in: path, required: true, schema: { type: string } }]
       requestBody: { required: true, content: { application/json: { schema: { $ref: '#/components/schemas/Complete' } } } }
       responses: { '200': { description: 业务响应信封 code为200成功，A0400/A0404/A0409校验或状态错误，requestId及traceId保留 }, '403': { description: 权限或角色不符 } }
   /api/pda/v1/last-leg/return-inventory/cartons/{cartonMark}:
     get:
       summary: 扫描可用来源或目标箱
-      description: 仅同仓AVAILABLE实物箱，PARCEL不作为箱选择。
+      description: 仅同仓AVAILABLE包裹或箱，返回其全部SKU明细。
       parameters: [{ name: cartonMark, in: path, required: true, schema: { type: string } }]
       responses: { '200': { description: 业务响应信封 code为200成功，A0400/A0404/A0409校验或状态错误，requestId及traceId保留 }, '403': { description: 权限或角色不符 } }
+  /api/pda/v1/last-leg/return-inventory/cartons/{cartonMark}/confirm-label:
+    post:
+      summary: 扫描已贴好的包裹或箱标签
+      description: 绑定仓且AVAILABLE实物，幂等确认仓库识别标签；整包裹或箱无需确认此标签也可创建出库单。此操作不登记商品换标完成量。
+      parameters: [{ name: cartonMark, in: path, required: true, schema: { type: string } }]
+      responses: { '200': { description: 标签快照及业务响应 }, '403': { description: 权限或角色不符 } }
   /api/pda/v1/last-leg/return-inventory/cartons/merge-boxes:
     post:
       summary: 来源箱并入已有目标箱
@@ -112,6 +118,7 @@ components:
         returnNos: { type: array, minItems: 1, maxItems: 100, items: { type: string } }
         mode: { type: string, enum: [SKU, BOX] }
         sourceCartonMarks: { type: array, maxItems: 500, items: { type: string } }
+        sourceDeductions: { type: array, maxItems: 1000, items: { $ref: '#/components/schemas/SourceDeduction' }, description: 部分合箱精确来源及数量，与目标SKU合计一致 }
         boxes: { type: array, minItems: 1, maxItems: 100, items: { $ref: '#/components/schemas/Box' } }
         remark: { type: string, maxLength: 1000 }
         idempotencyKey: { type: string, maxLength: 255 }
diff --git a/lastleg-service/src/main/resources/openapi/self-operated-analytics-egress-v1.yaml b/lastleg-service/src/main/resources/openapi/self-operated-analytics-egress-v1.yaml
new file mode 100644
index 000000000..a624a6122
--- /dev/null
+++ b/lastleg-service/src/main/resources/openapi/self-operated-analytics-egress-v1.yaml
@@ -0,0 +1,171 @@
+openapi: 3.0.3
+info:
+  title: Self-operated Analytics Internal Egress Authority
+  version: 1.0.0
+paths:
+  /internal/lastleg/self-operated-analytics/egress/runtime:
+    get:
+      operationId: getSelfoperatedEgressRuntime
+      summary: 读取脱敏的实际出口配置快照
+      description: >-
+        仅内部服务令牌，不提供公网路由。直接读取 Egress 执行所用的同一配置实例，
+        不读取数据库、不预留或消费许可、不调用供应商。响应不是部署验证结论，
+        不包含 verified、镜像版本、原始账号、grant、Token 或 URL。
+        intervalMs 为当前配置间隔，持久账户间隔可能更严格，须另行只读核验。
+        pendingMaxSeconds 为实际配置经 1 至 120 秒裁剪后的上限；permitMaxSeconds 为单次许可上限，
+        VALIDATION 仍可能受验证截止及 grant 截止进一步缩短。
+      security: [{ internalServiceToken: [] }]
+      responses:
+        '200':
+          description: ApiResponse 成功响应，data 为只读白名单快照
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  code: { type: string }
+                  data: { $ref: '#/components/schemas/RuntimeSnapshot' }
+        '401': { description: 内部令牌无效 }
+        '503': { description: 内部令牌未配置 }
+  /internal/lastleg/self-operated-analytics/egress/authorize:
+    post:
+      operationId: authorizeSelfoperatedEgressAttempt
+      summary: 一次性消费已持久预留的领星请求许可
+      description: >-
+        仅内部服务令牌。客户端已登记的 context 和 operation 必须完全匹配；
+        requestHash 是 Integration 对 OMP 路径和有序业务 JSON 的摘要，首次消费绑定，
+        后续完成必须完全匹配。同 attemptId 再次消费拒绝。allowedAttempts 固定 1，
+        expiresAt 最多 30 秒；VALIDATION 不超过验证根截止及 grant 截止。
+        BUSINESS 不受人为会话或 grant 截止阻断，但保留短许可过期、身份、显式停止及账户保护。
+        OFF 默认拒绝；BUSINESS 仅接受 production 或 test，人工根及合法派生保持原身份，
+        连续计划根另须连续开关与持久化 planner 身份。独占交接证明及接续计数由服务端配置核验。
+      security: [{ internalServiceToken: [] }]
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema: { $ref: '#/components/schemas/AuthorizationRequest' }
+      responses:
+        '200':
+          description: HTTP 200；许可 code=200，正常拒绝 code=B0001，data 为显式预算决策
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  code: { type: string }
+                  data:
+                    oneOf:
+                      - { $ref: '#/components/schemas/AttemptPermit' }
+                      - { $ref: '#/components/schemas/AuthorizationDenial' }
+        '401': { description: 内部令牌无效 }
+        '503': { description: 内部令牌未配置 }
+  /internal/lastleg/self-operated-analytics/egress/complete:
+    post:
+      operationId: completeSelfoperatedEgressAttempt
+      summary: 记录真实尝试次数和账号冷却
+      description: >-
+        回调 context、operation、requestHash 必须匹配已消费许可。actualHttpAttempts 仅 0 或 1；
+        即使 0 也不退回预留，响应丢失同样保留保守消耗。重复已确认完成为幂等成功。
+        429 对账号全部采集族持久冷却；验证根 DEAD、run FAILED、禁止自动续跑。
+        未确认结果的许可到期后保守冷却，不使用换日、换仓、重试或重启清零预算。
+      security: [{ internalServiceToken: [] }]
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema: { $ref: '#/components/schemas/CompletionRequest' }
+      responses:
+        '200':
+          description: ApiResponse code 字符串 200，data 为布尔 true
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  code: { type: string }
+                  data: { type: boolean, enum: [true] }
+        '401': { description: 内部令牌无效 }
+components:
+  securitySchemes:
+    internalServiceToken: { type: apiKey, in: header, name: X-Internal-Service-Token }
+  schemas:
+    RuntimeSnapshot:
+      type: object
+      additionalProperties: false
+      required: [schemaVersion, service, observedAt, mode, environment, continuousEnabled, sourceAccountFingerprint, grantPresent, grantFingerprint, intervalMs, permitMaxSeconds, executionEnabled, pendingMaxSeconds, exclusiveHandoffVerified, priorEgressClosed, inflightDrained, transferredBudgetVerified]
+      properties:
+        schemaVersion: { type: integer, enum: [1] }
+        service: { type: string, enum: [lastleg] }
+        observedAt: { type: string, format: date-time, description: UTC 观测时间 }
+        mode: { type: string, nullable: true, description: 原样返回实际配置，不将未知值转为 BUSINESS }
+        environment: { type: string, nullable: true }
+        continuousEnabled: { type: boolean }
+        sourceAccountFingerprint:
+          type: string
+          nullable: true
+          pattern: '^[a-f0-9]{64}$'
+          description: 'SHA-256 UTF-8 输入为 selfop-runtime:v1:source-account 加一个 LF 再加原始值；不 trim；null 或 blank 返回显式 null。'
+        grantPresent: { type: boolean, description: grant 原值非 null 且非 blank }
+        grantFingerprint:
+          type: string
+          nullable: true
+          pattern: '^[a-f0-9]{64}$'
+          description: 'SHA-256 UTF-8 输入为 selfop-runtime:v1:grant 加一个 LF 再加原始值；不 trim；null 或 blank 返回显式 null。'
+        intervalMs: { type: integer, format: int64, description: 实际配置的 BUSINESS 最小请求间隔毫秒数，未合并持久账户间隔 }
+        permitMaxSeconds: { type: integer, enum: [30] }
+        executionEnabled: { type: boolean }
+        pendingMaxSeconds: { type: integer, minimum: 1, maximum: 120 }
+        exclusiveHandoffVerified: { type: boolean }
+        priorEgressClosed: { type: boolean }
+        inflightDrained: { type: boolean }
+        transferredBudgetVerified: { type: boolean }
+    EgressContext:
+      type: object
+      required: [sourceAccount, executionPurpose, rootTaskId, sessionId, attemptId, exclusiveGrantId]
+      properties:
+        sourceAccount: { type: string, maxLength: 64 }
+        executionPurpose: { type: string, enum: [VALIDATION, BUSINESS] }
+        rootTaskId: { type: string, pattern: '^[0-9]+$' }
+        sessionId: { type: string, maxLength: 128 }
+        attemptId: { type: string, maxLength: 128 }
+        exclusiveGrantId: { type: string, maxLength: 128 }
+    Operation:
+      type: string
+      enum: [WAREHOUSES, OUTBOUND_QUERY, OUTBOUND_LOCATE, OUTBOUND_DETAIL, PRODUCT_INVENTORY, CUSTOMERS, PRODUCTS]
+    AuthorizationRequest:
+      type: object
+      required: [context, operation, requestHash]
+      properties:
+        context: { $ref: '#/components/schemas/EgressContext' }
+        operation: { $ref: '#/components/schemas/Operation' }
+        requestHash: { type: string, pattern: '^[a-f0-9]{64}$' }
+    AuthorizationDenial:
+      type: object
+      required: [errorCode, sampleDone, waitUntil]
+      properties:
+        errorCode: { type: string, pattern: '^[A-Z][A-Z0-9_]{0,63}$' }
+        sampleDone: { type: boolean }
+        waitUntil: { type: string, format: date-time, nullable: true, description: UTC Instant 或显式 null }
+    AttemptPermit:
+      allOf:
+        - { $ref: '#/components/schemas/AuthorizationRequest' }
+        - type: object
+          required: [allowedAttempts, expiresAt, exclusiveConfirmed, budgetConsumed]
+          properties:
+            allowedAttempts: { type: integer, enum: [1] }
+            expiresAt: { type: string, format: date-time }
+            exclusiveConfirmed: { type: boolean, enum: [true] }
+            budgetConsumed: { type: boolean, enum: [true] }
+    CompletionRequest:
+      allOf:
+        - { $ref: '#/components/schemas/AuthorizationRequest' }
+        - type: object
+          required: [actualHttpAttempts, accountPaused]
+          properties:
+            actualHttpAttempts: { type: integer, minimum: 0, maximum: 1 }
+            errorCode: { type: string, nullable: true }
+            upstreamStatus: { type: integer, nullable: true }
+            sourceCode: { type: integer, nullable: true }
+            accountPaused: { type: boolean }
+            cooldownUntil: { type: string, format: date-time, nullable: true }
diff --git a/lastleg-service/src/main/resources/openapi/self-operated-analytics-sync-v1.yaml b/lastleg-service/src/main/resources/openapi/self-operated-analytics-sync-v1.yaml
new file mode 100644
index 000000000..2f5015f74
--- /dev/null
+++ b/lastleg-service/src/main/resources/openapi/self-operated-analytics-sync-v1.yaml
@@ -0,0 +1,82 @@
+openapi: 3.0.3
+info:
+  title: Platform Self-operated Analytics Sync Commands
+  version: 1.0.0
+paths:
+  /api/platform/v1/last-leg/self-operated-analytics/sync-tasks:
+    post:
+      operationId: requestSelfoperatedAnalyticsSyncTask
+      summary: 创建人工采集、复查、重建或恢复任务
+      description: >-
+        仅平台账号且须 platform:self-operated-analytics:sync 权限。命令先持久化，
+        不在 HTTP 请求内运行历史采集。collectionMode 默认 OFF；VALIDATION 仅用于持久预算内的样本暂存，
+        BUSINESS 允许 production 以及受控人工执行的 test，均要求真实出口取得服务端核验的人工独占许可。TEST 不自动计划、历史复查或创建两个月首采；仅执行人工命令及合法派生任务。
+        TEST BUSINESS 人工根创建时冻结服务端 requestBudget/timeBudgetSeconds 为根会话请求总上限和截止时间；子任务及重试共用持久预算，续授权或重启不清零。
+        请求上限或截止后不得继续出网，保留停止原因并终止未完成任务；不将截断结果作为完整版本发布。最后一个合法请求返回的完整数据允许完成纯本地校验和发布。
+        出库来源时间及业务时间统一 Asia/Shanghai；首次正式目标固定为 E0 前两个滚动月。
+        BACKFILL 单片不超过一天。RETRY 使用 taskNo 和非空 reason 恢复原分仓逻辑任务，
+        保留半归并屏障及旧尝试，拒绝验证会话复活、账号共享任务伪装单仓、有效执行租约及上游未齐；
+        requestKey 同键异载荷拒绝。成功受理只表示排队，不表示采集或发布成功。
+        WAREHOUSE_DISCOVERY 仅允许 VALIDATION，只接受 requestKey/action，不要求已知仓码；
+        真实账号根最多一页10条、一次HTTP、60秒，读取后SAMPLE_DONE，不进入出库、详情、库存或正式发布。
+        普通 VALIDATION 冻结命令指定的单仓，每根独立最多300秒/40HTTP，账号预算、冷却与间隔仍共享。
+      security:
+        - bearerAuth: []
+      x-required-authorities:
+        - platform:self-operated-analytics:sync
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/SyncCommand'
+      responses:
+        '200':
+          description: 平台 ApiResponse 包络，成功 code 为字符串 200；返回稳定业务任务号与 ACCEPTED
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  code: { type: string }
+                  message: { type: string }
+                  data:
+                    type: object
+                    properties:
+                      taskNo: { type: string }
+                      warehouseCode: { type: string, nullable: true, description: 目录发现无仓库主体，其他命令为指定仓码 }
+                      status: { type: string, enum: [ACCEPTED] }
+        '401': { description: 未认证 }
+        '403': { description: 非平台身份或无独立写权限 }
+components:
+  securitySchemes:
+    bearerAuth: { type: http, scheme: bearer, bearerFormat: JWT }
+  schemas:
+    SyncCommand:
+      type: object
+      required: [requestKey, action]
+      oneOf:
+        - properties:
+            action: { type: string, enum: [WAREHOUSE_DISCOVERY] }
+          not:
+            anyOf:
+              - required: [warehouseCode]
+              - required: [taskNo]
+              - required: [sourceFrom]
+              - required: [sourceUntil]
+              - required: [customerCode]
+              - required: [deliveryNo]
+              - required: [reason]
+        - required: [warehouseCode]
+          properties:
+            action: { type: string, enum: [INVENTORY, BACKFILL, RECHECK, REBUILD, RETRY, VALIDATION] }
+      properties:
+        requestKey: { type: string, minLength: 1, maxLength: 100 }
+        warehouseCode: { type: string, minLength: 1, maxLength: 64 }
+        action: { type: string, enum: [INVENTORY, BACKFILL, RECHECK, REBUILD, RETRY, VALIDATION, WAREHOUSE_DISCOVERY] }
+        taskNo: { type: string, minLength: 1, maxLength: 64, description: RETRY 必填，原始分仓业务任务号 }
+        reason: { type: string, minLength: 1, maxLength: 500, description: RETRY 必填，随操作人和原任务审计保存 }
+        sourceFrom: { type: string, example: '2026-10-11T00:00:00' }
+        sourceUntil: { type: string, example: '2026-10-12T00:00:00' }
+        customerCode: { type: string, maxLength: 64, description: RECHECK 必填 }
+        deliveryNo: { type: string, maxLength: 128, description: RECHECK 必填 }
diff --git a/lastleg-service/src/main/resources/openapi/self-operated-analytics-v1.yaml b/lastleg-service/src/main/resources/openapi/self-operated-analytics-v1.yaml
new file mode 100644
index 000000000..46a2987fb
--- /dev/null
+++ b/lastleg-service/src/main/resources/openapi/self-operated-analytics-v1.yaml
@@ -0,0 +1,985 @@
+openapi: 3.0.3
+info:
+  title: 平台自营出库销量库存及采集运行只读接口
+  version: 1.0.0
+  description: >-
+    全部GET要求PLATFORM身份、tenantId=0、非代登录及独立platform:self-operated-analytics:list权限。
+    来源及业务时区Asia/Shanghai，单位PCS，账号和仓库由服务端已配置范围校验。
+    经营查询首屏生成context，包含版本对、独立范围摘要、queryAsOf/queryExpiresAt。
+    后续列表、图表、榜单和库存复用完整上下文，版本0保持不可用，不偷偷补入新版本。
+    上下文最多30分钟且不超过旧销量版superseded_at_utc+7天；queryAsOf不得未来或早于所选版本发布时间。
+    过期/范围不符明确要求刷新整页，不能静默切版；各请求在同一REPEATABLE_READ快照内校验和读取。
+    五周期包含今日，CUSTOM两端包含且endDate不晚于anchorDate；只有CUSTOM接受startDate/endDate。
+    默认maxQueryDays366，粒度DAY。正式outboundQuantity与observedQuantity独立，全部未知仍为空。
+    每日COMPLETE仅证明全天覆盖及有效日行或可靠SKU存在；今日/部分日正式量空，观察量可用，未知日期保持空。
+    SKU区间正式量仅全部日完整才输出；observedQuantity为可靠点合计，完整/部分/未知日数独立。
+    热销榜跟随图表所选日期，以已采集有效出库量排序；覆盖不足标记PARTIAL，日均、库存分布及两库存榜使用同一所选区间的完整销量与自然日数；不触发领星请求。
+    运行接口不受经营context限制。动态库存时效、重建和修订待核对独立返回。
+    阶段进度区分ACCOUNT_SHARED/WAREHOUSE及TASK_CUMULATIVE/ATTEMPT_ONLY，不伪造总百分比。
+    total未知为空、计数不能跨PAGE/ORDER/INVENTORY_ROW/BUSINESS_KEY/SKU/BATCH单位求和，NONE为非计数阶段且completed/total为空、totalKnown=false；阶段检查点与心跳分开。
+    任务号稳定，内部诊断ID不作为业务编号回退。SKU订单数不可相加为仓总单数。
+    重试沿既有POST sync-tasks，action=RETRY/requestKey/warehouseCode/taskNo/reason，使用独立sync权限并最终复核资格。
+security: [{bearerAuth: []}]
+paths:
+  /api/platform/v1/last-leg/self-operated-analytics/inventory-flow-probe:
+    post:
+      summary: TEST单SKU库存流水有界诊断
+      description: >-
+        仅TEST、BUSINESS、执行开启及配置仓库；PLATFORM、tenantId=0、非代登录、独立platform:self-operated-analytics:sync权限。
+        每个requestKey最多一次供应商请求、第一页最多1000条、时间范围最多31天且不得未来。
+        复用现有账号lease/fence、1200ms间隔、permit和消费记录。占用时拒绝，由操作者另行发起，不自动重试。
+        同键成功重放读取保存结果；同键异参拒绝；失败或结果未知不得重发。任务类型INVENTORY_FLOW_PROBE，成功SAMPLE_DONE，失败DEAD。
+        complete仅证明本次分页记录已全部返回，不证明历史流水无缺失或库存可还原。只保存诊断结果，不发布销量、库存或日样本。
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required: [requestKey, warehouseCode, customerCode, sku, startTime, endTime]
+              properties:
+                requestKey: {type: string, minLength: 1, maxLength: 80}
+                warehouseCode: {type: string, minLength: 1, maxLength: 64}
+                customerCode: {type: string, minLength: 1, maxLength: 64}
+                sku: {type: string, minLength: 1, maxLength: 128}
+                startTime: {type: string, description: 北京时间本地日期时间}
+                endTime: {type: string, description: 北京时间本地日期时间}
+      responses:
+        '200':
+          description: ApiResponse；成功data包含taskNo、complete与page（records、total、current、size、pages、observedAt、egress）。流水字段定义见Integration库存流水合同。业务失败保留错误码，不返回伪成功。
+        '403':
+          description: 非平台或缺少采集权限
+  /api/platform/v1/last-leg/self-operated-analytics/owner-directory:
+    get:
+      summary: 完整资料批次中的客户名称与编码
+      description: 仅平台且须 platform:self-operated-analytics:list。按账号和 queryAsOf 选择最近完整发布的 MASTER_DATA 资料版本；不调用领星，不限制为当前仓有销量的客户。未同步返回空数组，缺失名称返回 null。
+      parameters:
+        - {$ref: '#/components/parameters/sourceAccount'}
+        - {$ref: '#/components/parameters/warehouseCode'}
+        - {$ref: '#/components/parameters/salesRunId'}
+        - {$ref: '#/components/parameters/inventoryRunId'}
+        - {$ref: '#/components/parameters/salesScopeHash'}
+        - {$ref: '#/components/parameters/inventoryScopeHash'}
+        - {$ref: '#/components/parameters/queryAsOf'}
+      responses:
+        '200':
+          description: 统一 ApiResponse
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  code: {type: string}
+                  message: {type: string}
+                  data: {type: array, items: {$ref: '#/components/schemas/OwnerOption'}}
+        '401': {description: 缺少可信认证身份}
+        '403': {description: 非平台身份或缺少只读权限}
+  /api/platform/v1/last-leg/self-operated-analytics/dashboard:
+    get:
+      summary: 单仓固定版本经营总览
+      description: >-
+        平台独立只读权限platform:self-operated-analytics:list。一次一致快照固定销量和库存版本。
+        默认LAST_15_DAYS统一用于趋势、区间出库、日均、互斥分桶及三个Top10；热销按已采集有效量排序并标记覆盖状态，库存评估要求所选区间完整可信销量和有效库存；商品观察期仅提示。
+        不接受货主、SKU、分页、windowDays、topN或其他额外筛选。仓级趋势不套单SKU观察期。
+        库存严格下钻须携带原版本和drilldownFrom=DASHBOARD；截止时间由服务端根据库存真实观测重算。
+      parameters:
+        - {$ref: '#/components/parameters/sourceAccount'}
+        - {$ref: '#/components/parameters/warehouseCode'}
+        - {$ref: '#/components/parameters/rangePreset'}
+        - {$ref: '#/components/parameters/startDate'}
+        - {$ref: '#/components/parameters/endDate'}
+        - {$ref: '#/components/parameters/bucket'}
+        - {$ref: '#/components/parameters/salesRunId'}
+        - {$ref: '#/components/parameters/inventoryRunId'}
+        - {$ref: '#/components/parameters/salesScopeHash'}
+        - {$ref: '#/components/parameters/inventoryScopeHash'}
+        - {$ref: '#/components/parameters/queryAsOf'}
+      responses:
+        '200':
+          description: 统一ApiResponse；版本或参数错误为业务失败，不降级成空图。
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  code: {type: string}
+                  message: {type: string}
+                  data: {$ref: '#/components/schemas/Dashboard'}
+        '401': {description: 缺少可信认证身份}
+        '403': {description: 非平台身份或缺少独立只读权限}
+  /api/platform/v1/last-leg/self-operated-analytics/sku-sales-summary:
+    get:
+      summary: SKU五周期或历史累计清单
+      description: '候选为两版profile并集，SQL按选定日期聚合后按salesSort指定observedQuantity升降序（默认降序）空值末尾、SKU及货主升序，再分页。未知日不填零。 权限platform:self-operated-analytics:list。'
+      parameters:
+        - {$ref: '#/components/parameters/sourceAccount'}
+        - {$ref: '#/components/parameters/warehouseCode'}
+        - {$ref: '#/components/parameters/customerCode'}
+        - {$ref: '#/components/parameters/sku'}
+        - {$ref: '#/components/parameters/salesRunId'}
+        - {$ref: '#/components/parameters/inventoryRunId'}
+        - {$ref: '#/components/parameters/salesScopeHash'}
+        - {$ref: '#/components/parameters/inventoryScopeHash'}
+        - {$ref: '#/components/parameters/queryAsOf'}
+        - {$ref: '#/components/parameters/rangePreset'}
+        - {$ref: '#/components/parameters/startDate'}
+        - {$ref: '#/components/parameters/endDate'}
+        - {$ref: '#/components/parameters/bucket'}
+        - {$ref: '#/components/parameters/current'}
+        - {$ref: '#/components/parameters/size'}
+        - name: salesSort
+          in: query
+          required: false
+          description: 全量数量排序，默认降序；未知值始终末尾，同值按SKU及货主升序。
+          schema: {type: string, enum: [QUANTITY_ASC, QUANTITY_DESC], default: QUANTITY_DESC}
+      responses:
+        '200':
+          description: '统一ApiResponse，业务失败HTTP200且code非200。'
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  code: {type: string}
+                  message: {type: string}
+                  data: {$ref: '#/components/schemas/SalesPage'}
+        '401': {description: 缺少可信认证身份}
+        '403': {description: 非平台身份或缺少独立只读权限}
+  /api/platform/v1/last-leg/self-operated-analytics/sku-daily-sales:
+    get:
+      summary: 精确单SKU日趋势
+      description: 'customerCode和sku必填，精确原始业务键匹配。最多366日且返回完整升序日期轴，不分页。无候选明确业务错误。 权限platform:self-operated-analytics:list。'
+      parameters:
+        - {$ref: '#/components/parameters/sourceAccount'}
+        - {$ref: '#/components/parameters/warehouseCode'}
+        - {$ref: '#/components/parameters/customerCodeRequired'}
+        - {$ref: '#/components/parameters/skuRequired'}
+        - {$ref: '#/components/parameters/salesRunId'}
+        - {$ref: '#/components/parameters/inventoryRunId'}
+        - {$ref: '#/components/parameters/salesScopeHash'}
+        - {$ref: '#/components/parameters/inventoryScopeHash'}
+        - {$ref: '#/components/parameters/queryAsOf'}
+        - {$ref: '#/components/parameters/rangePreset'}
+        - {$ref: '#/components/parameters/startDate'}
+        - {$ref: '#/components/parameters/endDate'}
+        - {$ref: '#/components/parameters/bucket'}
+      responses:
+        '200':
+          description: '统一ApiResponse，业务失败HTTP200且code非200。'
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  code: {type: string}
+                  message: {type: string}
+                  data: {$ref: '#/components/schemas/Trend'}
+        '401': {description: 缺少可信认证身份}
+        '403': {description: 非平台身份或缺少独立只读权限}
+  /api/platform/v1/last-leg/self-operated-analytics/hot-skus:
+    get:
+      summary: 所选时段已采集热销Top100
+      description: '支持CUSTOM起止日期（含截止日），与总览所选时段一致；未传日期时仍使用windowDays的7/30日窗口。按已采集有效数量排序，覆盖不足由context及coverageStatus提示，不把未知当零。数量大于零，数量降序、SKU单数降序、SKU及货主升序，先Top100再分页；当前缺货仍可入榜。 权限platform:self-operated-analytics:list。'
+      parameters:
+        - {$ref: '#/components/parameters/sourceAccount'}
+        - {$ref: '#/components/parameters/warehouseCode'}
+        - {$ref: '#/components/parameters/customerCode'}
+        - {$ref: '#/components/parameters/sku'}
+        - {$ref: '#/components/parameters/salesRunId'}
+        - {$ref: '#/components/parameters/inventoryRunId'}
+        - {$ref: '#/components/parameters/salesScopeHash'}
+        - {$ref: '#/components/parameters/inventoryScopeHash'}
+        - {$ref: '#/components/parameters/queryAsOf'}
+        - {$ref: '#/components/parameters/windowDays'}
+        - {$ref: '#/components/parameters/rangePreset'}
+        - {$ref: '#/components/parameters/startDate'}
+        - {$ref: '#/components/parameters/endDate'}
+        - {$ref: '#/components/parameters/current'}
+        - {$ref: '#/components/parameters/size'}
+      responses:
+        '200':
+          description: '统一ApiResponse，业务失败HTTP200且code非200。'
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  code: {type: string}
+                  message: {type: string}
+                  data: {$ref: '#/components/schemas/MetricPage'}
+        '401': {description: 缺少可信认证身份}
+        '403': {description: 非平台身份或缺少独立只读权限}
+  /api/platform/v1/last-leg/self-operated-analytics/slow-skus:
+    get:
+      summary: 所选完整时段有库存低出库Top100
+      description: '支持CUSTOM起止日期，1至366天，前端统一为截至昨日的3/7/15/30天或自定义；不接受windowDays。正品有效新鲜可售量大于零、完整窗口且起点前可靠存在。数量升序、可售量降序、SKU及货主升序。 权限platform:self-operated-analytics:list。'
+      parameters:
+        - {$ref: '#/components/parameters/sourceAccount'}
+        - {$ref: '#/components/parameters/warehouseCode'}
+        - {$ref: '#/components/parameters/customerCode'}
+        - {$ref: '#/components/parameters/sku'}
+        - {$ref: '#/components/parameters/salesRunId'}
+        - {$ref: '#/components/parameters/inventoryRunId'}
+        - {$ref: '#/components/parameters/salesScopeHash'}
+        - {$ref: '#/components/parameters/inventoryScopeHash'}
+        - {$ref: '#/components/parameters/queryAsOf'}
+        - {$ref: '#/components/parameters/rangePreset'}
+        - {$ref: '#/components/parameters/startDate'}
+        - {$ref: '#/components/parameters/endDate'}
+        - {$ref: '#/components/parameters/current'}
+        - {$ref: '#/components/parameters/size'}
+      responses:
+        '200':
+          description: '统一ApiResponse，业务失败HTTP200且code非200。'
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  code: {type: string}
+                  message: {type: string}
+                  data: {$ref: '#/components/schemas/MetricPage'}
+        '401': {description: 缺少可信认证身份}
+        '403': {description: 非平台身份或缺少独立只读权限}
+  /api/platform/v1/last-leg/self-operated-analytics/inventory-coverage:
+    get:
+      summary: 正品库存与所选窗口可售天数
+      description: '普通库存明细使用1至366个完整自然日，由最近3/7/15/30天或自定义区间计算；总览严格下钻须携带drilldownFrom=DASHBOARD及原图CUSTOM起止日期，不得同时携带salesWindowDays/salesWindowEndDate。可售仅品质0可用量，不扣冻结或加在途次品。先UNKNOWN/INVALID/STALE，再有效零库存为0，再校验正库存单位及完整可信窗口；观察期仅提示，不阻断统计；零销量天数为空。 权限platform:self-operated-analytics:list。'
+      parameters:
+        - {$ref: '#/components/parameters/rangePreset'}
+        - {$ref: '#/components/parameters/startDate'}
+        - {$ref: '#/components/parameters/endDate'}
+        - {$ref: '#/components/parameters/coverageBucket'}
+        - {$ref: '#/components/parameters/bucketRuleVersion'}
+        - {$ref: '#/components/parameters/coverageSelection'}
+        - {$ref: '#/components/parameters/drilldownFrom'}
+        - {$ref: '#/components/parameters/attention'}
+        - {$ref: '#/components/parameters/sortBy'}
+        - {$ref: '#/components/parameters/coverageDaysThreshold'}
+        - {name: salesWindowDays, in: query, schema: {type: integer, minimum: 1, maximum: 366, default: 30}, description: 仅库存明细使用的完整自然日窗口}
+        - {name: salesWindowEndDate, in: query, schema: {type: string, format: date}, description: 含当日的窗口截止日，默认固定查询基准的北京时间昨日；必须早于查询当日，分页须携带原窗口}
+
+        - {$ref: '#/components/parameters/sourceAccount'}
+        - {$ref: '#/components/parameters/warehouseCode'}
+        - {$ref: '#/components/parameters/customerCode'}
+        - {$ref: '#/components/parameters/sku'}
+        - {$ref: '#/components/parameters/salesRunId'}
+        - {$ref: '#/components/parameters/inventoryRunId'}
+        - {$ref: '#/components/parameters/salesScopeHash'}
+        - {$ref: '#/components/parameters/inventoryScopeHash'}
+        - {$ref: '#/components/parameters/queryAsOf'}
+        - {$ref: '#/components/parameters/current'}
+        - {$ref: '#/components/parameters/size'}
+      responses:
+        '200':
+          description: '统一ApiResponse，业务失败HTTP200且code非200。'
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  code: {type: string}
+                  message: {type: string}
+                  data: {$ref: '#/components/schemas/InventoryMetricPage'}
+        '401': {description: 缺少可信认证身份}
+        '403': {description: 非平台身份或缺少独立只读权限}
+  /api/platform/v1/last-leg/self-operated-analytics/sync-overview:
+    get:
+      summary: 各仓任务族运行概览
+      description: 'warehouseCode可选。轻量读取scope/task/run/账号保护。无发布版和OFF仍返回配置任务；无正式scope时可显示冻结唯一仓码的最近普通VALIDATION根，不计入正式同步成功、覆盖或发布。首采COMPLETE须正式发布覆盖且无rebuild或未闭合归并。共享上游明确账号共享范围。 权限platform:self-operated-analytics:list。'
+      parameters:
+        - {$ref: '#/components/parameters/sourceAccount'}
+        - {$ref: '#/components/parameters/warehouseCodeOptional'}
+        - {$ref: '#/components/parameters/dataFamily'}
+      responses:
+        '200':
+          description: '统一ApiResponse，业务失败HTTP200且code非200。'
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  code: {type: string}
+                  message: {type: string}
+                  data: {$ref: '#/components/schemas/Overview'}
+        '401': {description: 缺少可信认证身份}
+        '403': {description: 非平台身份或缺少独立只读权限}
+  /api/platform/v1/last-leg/self-operated-analytics/sync-tasks:
+    get:
+      summary: 本仓逻辑采集任务
+      description: '任务按创建时间及稳定键倒序。首屏返回listUpperCreatedAt/listUpperId，后页完整重传；新插入不挤移页。普通VALIDATION根按冻结唯一仓码归属本仓，无需正式scope；仓库目录发现根不进入分仓视图。只读有限检查点，不展开stage或大manifest。 权限platform:self-operated-analytics:list。'
+      parameters:
+        - {$ref: '#/components/parameters/sourceAccount'}
+        - {$ref: '#/components/parameters/warehouseCode'}
+        - {$ref: '#/components/parameters/dataFamily'}
+        - {$ref: '#/components/parameters/taskType'}
+        - {$ref: '#/components/parameters/status'}
+        - {$ref: '#/components/parameters/taskNo'}
+        - {$ref: '#/components/parameters/dateFrom'}
+        - {$ref: '#/components/parameters/dateUntil'}
+        - {$ref: '#/components/parameters/current'}
+        - {$ref: '#/components/parameters/size'}
+        - {$ref: '#/components/parameters/listUpperCreatedAt'}
+        - {$ref: '#/components/parameters/listUpperId'}
+      responses:
+        '200':
+          description: '统一ApiResponse，业务失败HTTP200且code非200。'
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  code: {type: string}
+                  message: {type: string}
+                  data: {$ref: '#/components/schemas/TaskPage'}
+        '401': {description: 缺少可信认证身份}
+        '403': {description: 非平台身份或缺少独立只读权限}
+  /api/platform/v1/last-leg/self-operated-analytics/sync-tasks/{taskNo}:
+    get:
+      summary: 本仓业务任务号详情
+      description: '路径taskNo为稳定业务任务号，实际归属与请求账号仓必须一致。不以内部ID回退。详情含最新尝试和关联共享上游；普通VALIDATION根以冻结唯一仓码匹配，可在无正式scope时读取。progress.stages保留实际阶段计数，HTTP次数和终态NONE不作为样本行数。 权限platform:self-operated-analytics:list。'
+      parameters:
+        - {$ref: '#/components/parameters/sourceAccount'}
+        - {$ref: '#/components/parameters/warehouseCode'}
+        - {name: taskNo, in: path, required: true, schema: {type: string, maxLength: 64}}
+      responses:
+        '200':
+          description: '统一ApiResponse，业务失败HTTP200且code非200。'
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  code: {type: string}
+                  message: {type: string}
+                  data: {$ref: '#/components/schemas/TaskDetail'}
+        '401': {description: 缺少可信认证身份}
+        '403': {description: 非平台身份或缺少独立只读权限}
+  /api/platform/v1/last-leg/self-operated-analytics/sync-runs:
+    get:
+      summary: 本仓或任务号的尝试历史
+      description: '纯运行元数据分页，包含冻结唯一仓码匹配本仓的普通VALIDATION根尝试，无需正式scope；目录发现根不进入分仓视图。当前尝试读同一attemptNo的task进度，终态尝试只读run冻结快照；心跳过期UNCONFIRMED，不自动改判成功失败。 权限platform:self-operated-analytics:list。'
+      parameters:
+        - {$ref: '#/components/parameters/sourceAccount'}
+        - {$ref: '#/components/parameters/warehouseCode'}
+        - {$ref: '#/components/parameters/dataFamily'}
+        - {$ref: '#/components/parameters/taskType'}
+        - {$ref: '#/components/parameters/status'}
+        - {$ref: '#/components/parameters/taskNo'}
+        - {$ref: '#/components/parameters/dateFrom'}
+        - {$ref: '#/components/parameters/dateUntil'}
+        - {$ref: '#/components/parameters/current'}
+        - {$ref: '#/components/parameters/size'}
+        - {$ref: '#/components/parameters/listUpperCreatedAt'}
+        - {$ref: '#/components/parameters/listUpperId'}
+      responses:
+        '200':
+          description: '统一ApiResponse，业务失败HTTP200且code非200。'
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  code: {type: string}
+                  message: {type: string}
+                  data: {$ref: '#/components/schemas/AttemptPage'}
+        '401': {description: 缺少可信认证身份}
+        '403': {description: 非平台身份或缺少独立只读权限}
+  /api/platform/v1/last-leg/self-operated-analytics/owners:
+    get:
+      summary: 已采集货主编码分页
+      description: 固定同屏版本，只读权限platform:self-operated-analytics:list。不调用外部API。概览不接受SKU/attention/sortBy/分页/图表范围，候选不存在data为空。
+      parameters:
+        - {$ref: '#/components/parameters/sourceAccount'}
+        - {$ref: '#/components/parameters/warehouseCode'}
+        - {$ref: '#/components/parameters/salesRunId'}
+        - {$ref: '#/components/parameters/inventoryRunId'}
+        - {$ref: '#/components/parameters/salesScopeHash'}
+        - {$ref: '#/components/parameters/inventoryScopeHash'}
+        - {$ref: '#/components/parameters/queryAsOf'}
+        - {$ref: '#/components/parameters/keyword'}
+        - {$ref: '#/components/parameters/current'}
+        - {$ref: '#/components/parameters/size'}
+      responses:
+        '200':
+          description: 统一ApiResponse
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  code: {type: string}
+                  message: {type: string}
+                  data: {$ref: '#/components/schemas/OwnerPage'}
+        '401': {description: 缺少可信认证身份}
+        '403': {description: 非平台身份或缺少独立只读权限}
+  /api/platform/v1/last-leg/self-operated-analytics/owner-overview:
+    get:
+      summary: 单货主完整候选30日经营概览
+      description: 固定同屏版本，只读权限platform:self-operated-analytics:list。不调用外部API。概览不接受SKU/attention/sortBy/分页/图表范围，候选不存在data为空。
+      parameters:
+        - {$ref: '#/components/parameters/sourceAccount'}
+        - {$ref: '#/components/parameters/warehouseCode'}
+        - {$ref: '#/components/parameters/salesRunId'}
+        - {$ref: '#/components/parameters/inventoryRunId'}
+        - {$ref: '#/components/parameters/salesScopeHash'}
+        - {$ref: '#/components/parameters/inventoryScopeHash'}
+        - {$ref: '#/components/parameters/queryAsOf'}
+        - {$ref: '#/components/parameters/customerCodeRequired'}
+        - {$ref: '#/components/parameters/coverageDaysThreshold'}
+      responses:
+        '200':
+          description: 统一ApiResponse
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  code: {type: string}
+                  message: {type: string}
+                  data: {$ref: '#/components/schemas/OwnerOverview'}
+        '401': {description: 缺少可信认证身份}
+        '403': {description: 非平台身份或缺少独立只读权限}
+components:
+  securitySchemes:
+    bearerAuth: {type: http, scheme: bearer, bearerFormat: JWT}
+  parameters:
+    coverageBucket:
+      name: coverageBucket
+      in: query
+      description: 与非ALL attention和coverageSelection互斥，须配套固定规则版本；SQL分页前采用与总览相同互斥谓词。
+      schema: {type: string, enum: [DAYS_0_30, DAYS_30_60, DAYS_60_90, DAYS_GT_90, NO_OUTBOUND_IN_WINDOW, NO_AVAILABLE, UNKNOWN]}
+    bucketRuleVersion: {name: bucketRuleVersion, in: query, description: 不带coverageBucket时禁止单独传入, schema: {type: string, enum: [COVERAGE_DISTRIBUTION_V1]}}
+    coverageSelection: {name: coverageSelection, in: query, description: 正式有限正可售天数候选，在SQL分页前过滤，与非ALL attention及coverageBucket互斥, schema: {type: string, enum: [FINITE_POSITIVE]}}
+    drilldownFrom: {name: drilldownFrom, in: query, description: 必须固定原版本，服务端在真实库存有效期与查询到期较早者阻断并要求刷新总览；不增加权限, schema: {type: string, enum: [DASHBOARD]}}
+    keyword: {name: keyword, in: query, schema: {type: string, minLength: 1, maxLength: 64}, description: 区分大小写的货主编码字面前缀，先过滤去重再分页}
+    attention: {name: attention, in: query, schema: {type: string, default: ALL, enum: [ALL, NO_OUTBOUND_IN_WINDOW, COVERAGE_GT_THRESHOLD, FROZEN_STOCK, DEFECTIVE_STOCK, UNASSESSABLE]}}
+    sortBy: {name: sortBy, in: query, schema: {type: string, default: AVAILABLE_DESC, enum: [AVAILABLE_ASC, AVAILABLE_DESC, COVERAGE_DAYS_ASC, COVERAGE_DAYS_DESC, PHYSICAL_ASC, PHYSICAL_DESC, FROZEN_ASC, FROZEN_DESC, DEFECTIVE_ASC, DEFECTIVE_DESC, TRANSIT_ASC, TRANSIT_DESC, OUTBOUND_ASC, OUTBOUND_DESC, AVERAGE_DAILY_ASC, AVERAGE_DAILY_DESC]}, description: 完整候选先筛选后按正式未舍入值排序分页，未知末尾，同值SKU和货主升序；出库和日均按本次实际窗口，已采集小计不参与正式值排序}
+    coverageDaysThreshold: {name: coverageDaysThreshold, in: query, schema: {type: integer, minimum: 1}, description: COVERAGE_GT_THRESHOLD必填，严格大于且未舍入比较，不设置默认经营政策}
+    sourceAccount: {name: sourceAccount, in: query, required: true, schema: {type: string, minLength: 1, maxLength: 64}}
+    warehouseCode: {name: warehouseCode, in: query, required: true, schema: {type: string, minLength: 1, maxLength: 64}}
+    customerCode: {name: customerCode, in: query, required: false, schema: {type: string, minLength: 1, maxLength: 64}}
+    sku: {name: sku, in: query, required: false, schema: {type: string, minLength: 1, maxLength: 128}}
+    rangePreset: {name: rangePreset, in: query, required: false, schema: {type: string, enum: [TODAY, LAST_3_DAYS, THIS_WEEK, LAST_15_DAYS, THIS_MONTH, CUSTOM], default: TODAY}}
+    startDate: {name: startDate, in: query, required: false, schema: {type: string, format: date}}
+    endDate: {name: endDate, in: query, required: false, schema: {type: string, format: date}}
+    bucket: {name: bucket, in: query, required: false, schema: {type: string, enum: [DAY], default: DAY}}
+    windowDays: {name: windowDays, in: query, required: false, schema: {type: integer, enum: [7, 30], default: 30}}
+    current: {name: current, in: query, required: false, schema: {type: integer, minimum: 1, default: 1}}
+    size: {name: size, in: query, required: false, schema: {type: integer, minimum: 1, maximum: 100, default: 20}}
+    salesRunId: {name: salesRunId, in: query, required: false, schema: {type: string, pattern: '^[0-9]+$'}}
+    inventoryRunId: {name: inventoryRunId, in: query, required: false, schema: {type: string, pattern: '^[0-9]+$'}}
+    salesScopeHash: {name: salesScopeHash, in: query, required: false, schema: {type: string, pattern: '^[0-9a-f]{64}$'}}
+    inventoryScopeHash: {name: inventoryScopeHash, in: query, required: false, schema: {type: string, pattern: '^[0-9a-f]{64}$'}}
+    queryAsOf: {name: queryAsOf, in: query, required: false, schema: {type: string, format: date-time}}
+    dataFamily: {name: dataFamily, in: query, required: false, schema: {type: string, enum: [OUTBOUND, INVENTORY]}}
+    taskType: {name: taskType, in: query, required: false, schema: {type: string}}
+    status: {name: status, in: query, required: false, schema: {type: string}}
+    taskNo: {name: taskNo, in: query, required: false, schema: {type: string, maxLength: 64}}
+    dateFrom: {name: dateFrom, in: query, required: false, schema: {type: string, format: date}}
+    dateUntil: {name: dateUntil, in: query, required: false, schema: {type: string, format: date}}
+    listUpperCreatedAt: {name: listUpperCreatedAt, in: query, required: false, schema: {type: string, format: date-time}}
+    listUpperId: {name: listUpperId, in: query, required: false, schema: {type: string, pattern: '^[0-9]+$'}}
+    warehouseCodeOptional: {name: warehouseCode, in: query, schema: {type: string, minLength: 1, maxLength: 64}}
+    customerCodeRequired: {name: customerCode, in: query, required: true, schema: {type: string, minLength: 1, maxLength: 64}}
+    skuRequired: {name: sku, in: query, required: true, schema: {type: string, minLength: 1, maxLength: 128}}
+  schemas:
+    DashboardContext:
+      allOf:
+        - {$ref: '#/components/schemas/Context'}
+        - type: object
+          properties:
+            inventoryFreshUntil: {type: string, format: date-time, nullable: true}
+            inventoryDrilldownExpiresAt: {type: string, format: date-time, nullable: true}
+    DashboardMetric:
+      type: object
+      properties:
+        value: {type: number, nullable: true}
+        knownSubtotal: {type: number, nullable: true}
+        unit: {type: string, enum: [PCS, PCS_PER_DAY, SKU]}
+        dataStatus: {type: string, enum: [COMPLETE, PARTIAL, UNKNOWN]}
+        unknownSkuCount: {type: string, nullable: true}
+        reasonCodes: {type: array, items: {type: string}}
+        outboundQuantity: {type: number, nullable: true}
+        observedQuantity: {type: number, nullable: true}
+    DashboardKpis:
+      type: object
+      properties:
+        intervalOutboundQuantity: {$ref: '#/components/schemas/DashboardMetric'}
+        averageDailyOutboundQuantity: {$ref: '#/components/schemas/DashboardMetric'}
+        physicalQuantity: {$ref: '#/components/schemas/DashboardMetric'}
+        availableQuantity: {$ref: '#/components/schemas/DashboardMetric'}
+        physicalSkuCount: {$ref: '#/components/schemas/DashboardMetric'}
+        noOutboundSkuCount: {$ref: '#/components/schemas/DashboardMetric'}
+    CoverageDistribution:
+      type: object
+      description: 数值桶按未舍入交叉乘积判断；七桶互斥守恒。库存版未发布时计数为空，不把销量候选伪造成库存总量。
+      properties:
+        bucketRuleVersion: {type: string, enum: [COVERAGE_DISTRIBUTION_V1]}
+        candidateSkuCount: {type: string, nullable: true}
+        excludedZeroPhysicalSkuCount: {type: string, nullable: true}
+        dataStatus: {type: string, enum: [COMPLETE, PARTIAL, UNKNOWN]}
+        reasonCodes: {type: array, items: {type: string}}
+        unknownReasons: {type: object, additionalProperties: {type: string}}
+        buckets:
+          type: array
+          minItems: 7
+          maxItems: 7
+          items:
+            type: object
+            properties:
+              bucketCode: {type: string, enum: [DAYS_0_30, DAYS_30_60, DAYS_60_90, DAYS_GT_90, NO_OUTBOUND_IN_WINDOW, NO_AVAILABLE, UNKNOWN]}
+              skuCount: {type: string, nullable: true}
+              knownPhysicalQuantity: {type: number, nullable: true}
+              unknownPhysicalSkuCount: {type: string, nullable: true}
+    DashboardRankingItem:
+      type: object
+      properties:
+        customerName: {type: string, nullable: true, description: queryAsOf 时可见的完整资料批次中的货主名称}
+        customerCode: {type: string}
+        sku: {type: string}
+        productName: {type: string, nullable: true}
+        value: {type: number}
+        unit: {type: string, enum: [PCS, DAY]}
+        windowOutboundQuantity: {type: number, nullable: true, description: 榜单实际窗口出库量；热销在部分覆盖时为已采集量}
+        skuOutboundOrderCount: {type: string, nullable: true}
+        physicalQuantity: {type: number, nullable: true}
+        availableQuantity: {type: number, nullable: true}
+        frozenQuantity: {type: number, nullable: true}
+        defectivePhysicalQuantity: {type: number, nullable: true}
+        averageDailyOutboundQuantity: {type: number, nullable: true}
+        inventoryCoverageDays: {type: number, nullable: true}
+    DashboardRanking:
+      type: object
+      description: eligibleCount来自完整候选；items最多10项，不用Top100数量冒充全量合格数。
+      properties:
+        windowStartDate: {type: string, format: date}
+        windowEndDateExclusive: {type: string, format: date}
+        calculationWindowDays: {type: integer, minimum: 1, description: 三个榜单均为所选日期区间的自然日数}
+        eligibleCount: {type: string, nullable: true}
+        unassessableCount: {type: string, nullable: true}
+        items: {type: array, maxItems: 10, items: {$ref: '#/components/schemas/DashboardRankingItem'}}
+        dataStatus: {type: string, enum: [COMPLETE, PARTIAL, UNKNOWN]}
+        reasonCodes: {type: array, items: {type: string}}
+    Dashboard:
+      type: object
+      properties:
+        context: {$ref: '#/components/schemas/DashboardContext'}
+        kpis: {$ref: '#/components/schemas/DashboardKpis'}
+        salesTrend:
+          type: object
+          properties:
+            summary: {$ref: '#/components/schemas/SalesSummary'}
+            points: {type: array, maxItems: 366, items: {$ref: '#/components/schemas/Point'}}
+        coverageDistribution: {$ref: '#/components/schemas/CoverageDistribution'}
+        hotSkus: {$ref: '#/components/schemas/DashboardRanking'}
+        longCoverageSkus: {$ref: '#/components/schemas/DashboardRanking'}
+        noOutboundSkus: {$ref: '#/components/schemas/DashboardRanking'}
+    OwnerOption:
+      type: object
+      properties:
+        customerCode: {type: string}
+        customerName: {type: string, nullable: true}
+    OwnerPage:
+      type: object
+      properties:
+        context: {$ref: '#/components/schemas/Context'}
+        records: {type: array, items: {$ref: '#/components/schemas/OwnerOption'}}
+        current: {type: integer}
+        size: {type: integer}
+        total: {type: string}
+        pages: {type: string}
+        excludedReasons: {type: object, additionalProperties: {type: string}}
+    QuantityTotal:
+      type: object
+      properties:
+        overallTotal: {type: number, nullable: true}
+        knownSubtotal: {type: number, nullable: true}
+        unknownSkuCount: {type: string}
+        dataStatus: {type: string, enum: [COMPLETE, PARTIAL, UNKNOWN]}
+        reasonCodes: {type: array, items: {type: string}}
+    RiskShare:
+      type: object
+      description: 分母为同一OwnerOverview的physicalQuantity。未知时正式命中与比例为空。未设置阈值返回THRESHOLD_NOT_SET。
+      properties:
+        matchedSkuCount: {type: string, nullable: true}
+        matchedPhysicalQuantity: {type: number, nullable: true}
+        physicalQuantityRatio: {type: number, minimum: 0, maximum: 1, nullable: true}
+        knownMatchedSkuCount: {type: string, nullable: true}
+        knownMatchedPhysicalQuantity: {type: number, nullable: true}
+        unassessableSkuCount: {type: string}
+        unassessableKnownPhysicalQuantity: {type: number, nullable: true}
+        reasonCodes: {type: array, items: {type: string}}
+    OwnerOverview:
+      type: object
+      nullable: true
+      properties:
+        context: {$ref: '#/components/schemas/Context'}
+        customerCode: {type: string}
+        customerName: {type: string, nullable: true}
+        skuCount: {type: string, nullable: true}
+        physicalSkuCount: {$ref: '#/components/schemas/QuantityTotal'}
+        physicalQuantity: {$ref: '#/components/schemas/QuantityTotal'}
+        availableQuantity: {$ref: '#/components/schemas/QuantityTotal'}
+        frozenQuantity: {$ref: '#/components/schemas/QuantityTotal'}
+        defectivePhysicalQuantity: {$ref: '#/components/schemas/QuantityTotal'}
+        transitQuantity: {$ref: '#/components/schemas/QuantityTotal'}
+        outboundQuantity30d: {$ref: '#/components/schemas/QuantityTotal'}
+        averageDailyOutboundQuantity: {$ref: '#/components/schemas/QuantityTotal'}
+        noOutbound30d: {$ref: '#/components/schemas/RiskShare'}
+        coverageAboveThreshold: {$ref: '#/components/schemas/RiskShare'}
+    Context:
+      type: object
+      properties:
+        salesRunId: {type: string, nullable: true}
+        inventoryRunId: {type: string, nullable: true}
+        salesScopeHash: {type: string, nullable: true}
+        inventoryScopeHash: {type: string, nullable: true}
+        queryAsOf: {type: string, format: date-time, nullable: true}
+        queryExpiresAt: {type: string, format: date-time, nullable: true}
+        businessTimezone: {type: string, nullable: true}
+        anchorDate: {type: string, format: date, nullable: true}
+        rangeStartDate: {type: string, format: date, nullable: true}
+        rangeEndDateExclusive: {type: string, format: date, nullable: true}
+        calculationWindowDays: {type: integer, nullable: true}
+        completeDayFrom: {type: string, format: date, nullable: true}
+        completeDayUntil: {type: string, format: date, nullable: true}
+        salesCoveredFrom: {type: string, format: date-time, nullable: true}
+        salesCoveredUntil: {type: string, format: date-time, nullable: true}
+        salesPublishedAt: {type: string, format: date-time, nullable: true}
+        inventoryObservedFrom: {type: string, format: date-time, nullable: true}
+        inventoryObservedUntil: {type: string, format: date-time, nullable: true}
+        salesStatus: {type: string, nullable: true}
+        inventoryStatus: {type: string, nullable: true}
+        rebuildRequired: {type: boolean, nullable: true}
+        revisionReviewStatus: {type: string, nullable: true}
+        reasonCodes: {type: array, items: {type: string}}
+    SalesSummary:
+      type: object
+      properties:
+        customerName: {type: string, nullable: true, description: queryAsOf 时可见的完整资料批次中的货主名称}
+        sourceAccount: {type: string, nullable: true}
+        warehouseCode: {type: string, nullable: true}
+        customerCode: {type: string, nullable: true}
+        sku: {type: string, nullable: true}
+        productName: {type: string, nullable: true}
+        quantityUnit: {type: string, nullable: true}
+        outboundQuantity: {type: number, nullable: true}
+        observedQuantity: {type: number, nullable: true}
+        dataStatus: {type: string, nullable: true}
+        reasonCodes: {type: array, items: {type: string}}
+        completeDayCount: {type: integer, nullable: true}
+        partialDayCount: {type: integer, nullable: true}
+        unknownDayCount: {type: integer, nullable: true}
+    Point:
+      type: object
+      properties:
+        businessDate: {type: string, format: date, nullable: true}
+        outboundQuantity: {type: number, nullable: true}
+        observedQuantity: {type: number, nullable: true}
+        dataStatus: {type: string, nullable: true}
+        reasonCodes: {type: array, items: {type: string}}
+        quantityUnit: {type: string, nullable: true}
+        coveredFrom: {type: string, format: date-time, nullable: true}
+        coveredUntil: {type: string, format: date-time, nullable: true}
+    Trend:
+      type: object
+      properties:
+        context: {$ref: '#/components/schemas/Context'}
+        summary: {$ref: '#/components/schemas/SalesSummary'}
+        points: {type: array, items: {$ref: '#/components/schemas/Point'}}
+    Metric:
+      type: object
+      properties:
+        customerName: {type: string, nullable: true}
+        defectivePhysicalQuantity: {type: number, nullable: true}
+        outboundQuantity30d: {type: number, nullable: true}
+        lastObservedOutboundDate: {type: string, format: date, nullable: true}
+        observedHistoryStartDate: {type: string, format: date, nullable: true}
+        attentionReasons: {type: array, items: {type: string}}
+        quantityStatuses: {type: object, additionalProperties: {type: string, enum: [VALID, UNKNOWN, STALE]}}
+        sourceAccount: {type: string, nullable: true}
+        customerCode: {type: string, nullable: true}
+        warehouseCode: {type: string, nullable: true}
+        sku: {type: string, nullable: true}
+        productName: {type: string, nullable: true}
+        quantityUnit: {type: string, nullable: true}
+        outboundQuantity: {type: number, nullable: true}
+        skuOutboundOrderCount: {type: string, nullable: true}
+        todayObservedQuantity: {type: number, nullable: true}
+        physicalQuantity: {type: number, nullable: true}
+        availableQuantity: {type: number, nullable: true}
+        frozenQuantity: {type: number, nullable: true}
+        transitQuantity: {type: number, nullable: true}
+        inventoryObservedAt: {type: string, format: date-time, nullable: true}
+        averageDailyOutboundQuantity: {type: number, nullable: true}
+        inventoryCoverageDays: {type: number, nullable: true}
+        inventoryQuality: {type: string, nullable: true}
+        salesCoverage: {type: string, nullable: true}
+        observationEligible: {type: boolean, nullable: true}
+        earliestReliableEvidenceAt: {type: string, format: date-time, nullable: true}
+        status: {type: string, nullable: true}
+        reasonCodes: {type: array, items: {type: string}}
+    InventoryMetric:
+      description: 库存窗口响应。windowOutboundQuantity为所选完整窗口销量：普通明细10或30日，总览严格下钻使用原图CUSTOM区间；未知保持null，零销量状态NO_OUTBOUND_IN_WINDOW不除零。无出库关注、出库排序及分组均使用实际窗口；商品观察期仅提示，不阻断完整窗口销量及可售天数。完整可信窗口中无出库行可记零，覆盖不足或数量异常不可补零。
+      type: object
+      properties:
+        customerName: {type: string, nullable: true}
+        defectivePhysicalQuantity: {type: number, nullable: true}
+        windowOutboundQuantity: {type: number, nullable: true}
+        observedWindowOutboundQuantity: {type: number, nullable: true, description: 同一固定销量版及实际窗口中单位有效的已采集出库小计；不代替完整窗口出库，不用于推算日均或可售天数，未知不补零}
+        lastObservedOutboundDate: {type: string, format: date, nullable: true}
+        observedHistoryStartDate: {type: string, format: date, nullable: true}
+        attentionReasons: {type: array, items: {type: string}}
+        quantityStatuses: {type: object, additionalProperties: {type: string, enum: [VALID, UNKNOWN, STALE, UNIT_UNKNOWN_OR_CONFLICT, SALES_UNTRUSTED, COVERAGE_INSUFFICIENT]}}
+        sourceAccount: {type: string, nullable: true}
+        customerCode: {type: string, nullable: true}
+        warehouseCode: {type: string, nullable: true}
+        sku: {type: string, nullable: true}
+        productName: {type: string, nullable: true}
+        quantityUnit: {type: string, nullable: true}
+        skuOutboundOrderCount: {type: string, nullable: true}
+        physicalQuantity: {type: number, nullable: true}
+        availableQuantity: {type: number, nullable: true}
+        frozenQuantity: {type: number, nullable: true}
+        transitQuantity: {type: number, nullable: true}
+        inventoryObservedAt: {type: string, format: date-time, nullable: true}
+        averageDailyOutboundQuantity: {type: number, nullable: true}
+        inventoryCoverageDays: {type: number, nullable: true}
+        inventoryQuality: {type: string, nullable: true}
+        salesCoverage: {type: string, nullable: true}
+        observationEligible: {type: boolean, nullable: true, description: 是否已有不晚于窗口起点的可靠商品记录；false仅用于观察提示，不阻断完整可信窗口出库、日均和可售天数}
+        earliestReliableEvidenceAt: {type: string, format: date-time, nullable: true}
+        status: {type: string, nullable: true}
+        reasonCodes: {type: array, items: {type: string}}
+    Protection:
+      type: object
+      properties:
+        accountCooldownUntil: {type: string, format: date-time, nullable: true}
+        accountPauseReason: {type: string, nullable: true}
+        dailyRequestBudget: {type: integer, minimum: 0, nullable: true, description: "BUSINESS 为 0，表示不限制累计请求次数；VALIDATION 为每日请求上限。实际请求计数继续累计。"}
+        reservedHttpRequests: {type: string, nullable: true}
+        confirmedHttpRequests: {type: string, nullable: true}
+        budgetDate: {type: string, format: date, nullable: true}
+    Validation:
+      type: object
+      properties:
+        validationSessionNo: {type: string, nullable: true}
+        budgetLimits: {type: object, additionalProperties: {type: string, nullable: true}}
+        budgetConsumed: {type: object, additionalProperties: {type: string, nullable: true}}
+        deadlineAt: {type: string, format: date-time, nullable: true}
+        stopReason: {type: string, nullable: true}
+    Attempt:
+      type: object
+      properties:
+        runId: {type: string, nullable: true}
+        taskNo: {type: string, nullable: true}
+        attemptNo: {type: integer, nullable: true}
+        status: {type: string, nullable: true}
+        phase: {type: string, nullable: true, description: 资料同步使用 CUSTOMERS / PRODUCTS；其他阶段不变}
+        executionPurpose: {type: string, nullable: true}
+        startedAt: {type: string, format: date-time, nullable: true}
+        finishedAt: {type: string, format: date-time, nullable: true}
+        phaseStartedAt: {type: string, format: date-time, nullable: true}
+        progressUpdatedAt: {type: string, format: date-time, nullable: true}
+        heartbeatAt: {type: string, format: date-time, nullable: true}
+        executionHealth: {type: string, nullable: true}
+        elapsedSeconds: {type: string, nullable: true}
+        errorCode: {type: string, nullable: true}
+        failureSummary: {type: string, nullable: true}
+        retryable: {type: boolean, nullable: true}
+        coverageStatus: {type: string, nullable: true}
+        coveredFrom: {type: string, format: date-time, nullable: true}
+        coveredUntil: {type: string, format: date-time, nullable: true}
+        publishedAt: {type: string, format: date-time, nullable: true}
+        progress: {$ref: '#/components/schemas/Progress'}
+    Task:
+      type: object
+      properties:
+        createdAt: {type: string, format: date-time, nullable: true, description: 当前任务创建时间，重试和阶段切换不重置}
+        elapsedSeconds: {type: string, nullable: true, description: 自创建起的累计秒数，含排队和重试；活动任务截止本次读取，终态任务截止任务最后更新时间；不是单次执行耗时}
+        taskNo: {type: string, nullable: true}
+        taskType: {type: string, nullable: true}
+        dataFamily: {type: string, nullable: true, description: OUTBOUND / INVENTORY / MASTER_DATA（账号资料）}
+        warehouseCode: {type: string, nullable: true}
+        taskRole: {type: string, nullable: true}
+        executionPurpose: {type: string, nullable: true}
+        queryFrom: {type: string, format: date-time, nullable: true}
+        queryUntil: {type: string, format: date-time, nullable: true}
+        taskStatus: {type: string, nullable: true}
+        applyState: {type: string, nullable: true}
+        attemptCount: {type: integer, nullable: true}
+        latestAttemptNo: {type: integer, nullable: true}
+        resultPublicationState: {type: string, nullable: true}
+        resultPublishedRunId: {type: string, nullable: true}
+        nextRetryAt: {type: string, format: date-time, nullable: true}
+        allowedActions: {type: array, items: {type: string}}
+        actionBlockReason: {type: string, nullable: true}
+        progressUpdatedAt: {type: string, format: date-time, nullable: true}
+        progress: {$ref: '#/components/schemas/Progress'}
+        validation: {$ref: '#/components/schemas/Validation'}
+        latestAttempt: {$ref: '#/components/schemas/Attempt'}
+        dependencyState:
+          type: string
+          enum: [NONE, WAITING_CONFIRMED, WAITING_UNCONFIRMED, SATISFIED, FAILED]
+          description: 仅直接upstreamTaskId且账号及用途一致证明依赖；时间窗口相交不构成依赖。
+        blockingReason: {type: string, nullable: true, description: 当前执行阻塞原因码，与恢复操作资格actionBlockReason分开}
+        progressSourceTaskNo: {type: string, nullable: true, description: 确认等待时指向直接上游，否则指向本任务；计数仍保留在各自Task.progress，不复制到本仓}
+        stageEstimate: {$ref: '#/components/schemas/StageEstimate'}
+    StageEstimate:
+      type: object
+      description: 本任务当前阶段估算，不能当作全任务ETA；进度与估算整体按progressIdentity和validUntil接收。计数包含复用时测速基线重建，采样仅来自已提交检查点。
+      properties:
+        status: {type: string, enum: [AVAILABLE, UNAVAILABLE, PAUSED]}
+        progressIdentity: {type: string}
+        completed: {type: string, nullable: true}
+        total: {type: string, nullable: true}
+        sampleFrom: {type: string, format: date-time, nullable: true}
+        sampleUntil: {type: string, format: date-time, nullable: true}
+        completedDelta: {type: string, nullable: true}
+        ratePerSecond: {type: number, nullable: true}
+        remainingSeconds: {type: string, nullable: true}
+        estimatedAt: {type: string, format: date-time}
+        validUntil: {type: string, format: date-time, nullable: true}
+        unavailableReason:
+          type: string
+          nullable: true
+          enum: [TERMINAL, PAUSED, HEALTH_UNCONFIRMED, TOTAL_UNKNOWN, INVALID_PROGRESS, STAGE_COMPLETE, SAMPLING, NO_RECENT_PROGRESS, SAMPLE_EXPIRED, INVALID_SAMPLE]
+    TaskDetail:
+      type: object
+      properties:
+        task: {$ref: '#/components/schemas/Task'}
+        sharedUpstream: {$ref: '#/components/schemas/Task'}
+        protection: {$ref: '#/components/schemas/Protection'}
+        observedAt: {type: string, format: date-time, nullable: true}
+    InventoryDailySamples:
+      type: object
+      nullable: true
+      description: 仅库存任务族提供。北京时间近30个完整日的正式日代表积累；缺日不补零或沿用旧批次，不是周转率。
+      required: [windowFrom, windowUntil, expectedDays, sampleCount, missingDates]
+      properties:
+        windowFrom: {type: string, format: date, description: 包含起日}
+        windowUntil: {type: string, format: date, description: 排他上界，即北京时间今日}
+        expectedDays: {type: integer, enum: [30]}
+        sampleCount: {type: integer, minimum: 0, maximum: 30}
+        missingDates: {type: array, items: {type: string, format: date}}
+        accumulationStartedOn: {type: string, format: date, nullable: true, description: 本仓最早正式日代表日期，无样本时为空}
+    Warehouse:
+      type: object
+      properties:
+        warehouseCode: {type: string, nullable: true}
+        warehouseName: {type: string, nullable: true}
+        dataFamily: {type: string, nullable: true, description: OUTBOUND / INVENTORY / MASTER_DATA（账号资料）}
+        executionEnabled: {type: boolean, nullable: true}
+        publicationEnabled: {type: boolean, nullable: true}
+        disabledReason: {type: string, nullable: true}
+        nextScheduledAt: {type: string, format: date-time, nullable: true, description: 自动采集下一计划时刻；显式连续BUSINESS模式下销量为下个北京时间00点05分，库存沿仓库计划；执行被禁用时为空，不代表当前任务预计完成时间}
+        observedAt: {type: string, format: date-time, nullable: true}
+        initialFrom: {type: string, format: date-time, nullable: true}
+        initialUntil: {type: string, format: date-time, nullable: true}
+        initialCoverageStatus: {type: string, nullable: true}
+        salesCoveredFrom: {type: string, format: date-time, nullable: true}
+        salesCoveredUntil: {type: string, format: date-time, nullable: true}
+        lastSuccessfulTaskNo: {type: string, nullable: true}
+        lastSucceededAt: {type: string, format: date-time, nullable: true}
+        lastPublishedAt: {type: string, format: date-time, nullable: true}
+        inventoryObservedFrom: {type: string, format: date-time, nullable: true}
+        inventoryObservedUntil: {type: string, format: date-time, nullable: true}
+        dataFreshness: {type: string, nullable: true}
+        rebuildRequired: {type: boolean, nullable: true}
+        revisionReviewStatus: {type: string, nullable: true}
+        inventoryDailySamples: {$ref: '#/components/schemas/InventoryDailySamples'}
+        currentTask: {$ref: '#/components/schemas/Task'}
+        activeTasks:
+          type: array
+          maxItems: 8
+          description: 本仓本类型活动或等待任务，RUNNING优先，再按创建时间倒序；currentTask取活动首项，无活动时取最近任务。
+          items: {$ref: '#/components/schemas/Task'}
+        sharedUpstream: {$ref: '#/components/schemas/Task'}
+        protection: {$ref: '#/components/schemas/Protection'}
+    Overview:
+      type: object
+      properties:
+        sourceAccount: {type: string, nullable: true}
+        environmentLabel: {type: string, nullable: true}
+        collectionMode: {type: string, nullable: true}
+        observedAt: {type: string, format: date-time, nullable: true}
+        warehouses: {type: array, items: {$ref: '#/components/schemas/Warehouse'}}
+        accountActivity:
+          allOf: [{$ref: '#/components/schemas/Task'}]
+          nullable: true
+          description: 来源账号明确活动指针指向的正式采集任务，独立展示，不代表任一仓库的依赖或数量。
+    Progress:
+      type: object
+      properties:
+        progressScope: {type: string, nullable: true}
+        countBasis: {type: string, nullable: true}
+        attemptNo: {type: string, nullable: true}
+        scanRound: {type: string, nullable: true}
+        phase: {type: string, nullable: true, description: 资料同步使用 CUSTOMERS / PRODUCTS；其他阶段不变}
+        completed: {type: string, nullable: true}
+        total: {type: string, nullable: true}
+        totalKnown: {type: boolean, nullable: true}
+        unit: {type: string, nullable: true}
+        sliceFrom: {type: string, format: date-time, nullable: true}
+        sliceUntil: {type: string, format: date-time, nullable: true}
+        stageStartedAt: {type: string, format: date-time, nullable: true}
+        stageFinishedAt: {type: string, format: date-time, nullable: true}
+        validationState: {type: string, nullable: true}
+        invalidCount: {type: string, nullable: true}
+        unknownCount: {type: string, nullable: true}
+        pendingReviewCount: {type: string, nullable: true}
+        countUnit: {type: string, nullable: true}
+        summaryAsOf: {type: string, format: date-time, nullable: true}
+        directoryComplete: {type: boolean, nullable: true}
+        stages: {type: array, items: {$ref: '#/components/schemas/Progress'}}
+    SalesPage:
+      type: object
+      properties:
+        context: {$ref: '#/components/schemas/Context'}
+        records: {type: array, items: {$ref: '#/components/schemas/SalesSummary'}}
+        current: {type: integer, nullable: true}
+        size: {type: integer, nullable: true}
+        total: {type: string, nullable: true}
+        pages: {type: string, nullable: true}
+        excludedReasons: {type: object, additionalProperties: {type: string, nullable: true}}
+    MetricPage:
+      type: object
+      properties:
+        context: {$ref: '#/components/schemas/Context'}
+        records: {type: array, items: {$ref: '#/components/schemas/Metric'}}
+        current: {type: integer, nullable: true}
+        size: {type: integer, nullable: true}
+        total: {type: string, nullable: true}
+        pages: {type: string, nullable: true}
+        excludedReasons: {type: object, additionalProperties: {type: string, nullable: true}}
+    InventoryMetricPage:
+      type: object
+      properties:
+        context: {$ref: '#/components/schemas/Context'}
+        records: {type: array, items: {$ref: '#/components/schemas/InventoryMetric'}}
+        current: {type: integer, nullable: true}
+        size: {type: integer, nullable: true}
+        total: {type: string, nullable: true}
+        pages: {type: string, nullable: true}
+        excludedReasons: {type: object, additionalProperties: {type: string, nullable: true}}
+    TaskPage:
+      type: object
+      properties:
+        records: {type: array, items: {$ref: '#/components/schemas/Task'}}
+        current: {type: integer, nullable: true}
+        size: {type: integer, nullable: true}
+        total: {type: string, nullable: true}
+        listUpperCreatedAt: {type: string, format: date-time, nullable: true}
+        listUpperId: {type: string, nullable: true}
+        observedAt: {type: string, format: date-time, nullable: true}
+    AttemptPage:
+      type: object
+      properties:
+        records: {type: array, items: {$ref: '#/components/schemas/Attempt'}}
+        current: {type: integer, nullable: true}
+        size: {type: integer, nullable: true}
+        total: {type: string, nullable: true}
+        listUpperCreatedAt: {type: string, format: date-time, nullable: true}
+        listUpperId: {type: string, nullable: true}
+        observedAt: {type: string, format: date-time, nullable: true}
diff --git a/lastleg-service/src/main/resources/openapi/self-operated-inventory-turnover-v1.yaml b/lastleg-service/src/main/resources/openapi/self-operated-inventory-turnover-v1.yaml
new file mode 100644
index 000000000..3910fdeec
--- /dev/null
+++ b/lastleg-service/src/main/resources/openapi/self-operated-inventory-turnover-v1.yaml
@@ -0,0 +1,243 @@
+openapi: 3.0.3
+info:
+  title: 平台自营库存周转只读查询
+  version: 1.0.0
+  description: >-
+    仅PLATFORM、tenantId=0、非代登录及platform:self-operated-analytics:list权限。
+    仓库由服务端受控配置校验；不触发采集，不读取来源订单，不调用领星。
+    所选窗口为截至endDate的1～366个完整北京时间自然日，并提供7/15/30天辅助对比；当前库存独立固定版本。
+    每次请求使用REPEATABLE_READ，一致性读固定销量、当前库存及历史日版本映射。
+    snapshotContext保存签名压缩的准确版本清单与缺失日期，不作为授权凭据；后续页按准确ID校验
+    账号、仓库、范围及失效标记，不用墙钟时刻重新推导日头。服务重启、校正失效、规则变更要求整体刷新。
+    历史分母只使用FLOW_EOD_V1日末全品质实物库存，以完整流水及独立库存锚点还原；不与旧计划样本混算。
+    上下文有效期最多30分钟；客户端不能直接指定runId。SKU/关注分页不改变概览范围。
+    历史销量完整性不依赖当前库存新鲜度；缺日保持未知、不缩短周转分母。sampleReasonCodes包含流水或独立库存对账失败原因。dailySamples.dayVersionId表示历史日版本标识，非原始库存run。
+security: [{bearerAuth: []}]
+paths:
+  /api/platform/v1/last-leg/self-operated-analytics/inventory-turnover:
+    get:
+      operationId: inventoryTurnover
+      summary: 单仓SKU或货主三窗口库存周转
+      description: >-
+        customerCodes按所选货主集合限定列表、概览及图表，省略或空集合表示全部；sku、focus、turnoverStatus及hideZeroInventory只筛列表。
+        按完整候选计算依赖后排序分页，未知末尾，同值按SKU及货主或货主编码稳定排序。
+        OWNER不计算整体可售天数；销售事实完整即可展示货主实际出库，不受单SKU观察期影响。
+        SKU出库及无出库判断同样不受首次观察时间限制：可信完整覆盖的缺销量行可计零；实际异常单位或未覆盖日期保持未知。
+        当前可售天数仍要求有效库存和完整销量窗口；期间件数周转仍要求合格每日库存样本及商品观察证据。
+        首屏必须current=1且返回概览；后续携带snapshotContext，includeOverview=false省略概览。
+        不接受attention、salesWindowDays、版本ID或其他视图参数。
+      parameters:
+        - {name: sourceAccount, in: query, required: true, schema: {type: string, minLength: 1, maxLength: 64}}
+        - {name: warehouseCode, in: query, required: true, schema: {type: string, minLength: 1, maxLength: 64}}
+        - {name: endDate, in: query, description: '含截止日，默认北京时间昨天，不接受今日或未来', schema: {type: string, format: date}}
+        - {name: baseWindowDays, in: query, schema: {type: integer, minimum: 1, maximum: 366, default: 30}}
+        - {name: groupBy, in: query, schema: {type: string, enum: [SKU, OWNER], default: SKU}}
+        - {name: customerCodes, in: query, style: form, explode: true, description: '货主编码多选，重复键传输；同一编码不重复计数，最多100个', schema: {type: array, maxItems: 100, items: {type: string, minLength: 1, maxLength: 64}}}
+        - {name: sku, in: query, description: SKU分组的精确查询，OWNER禁止传入, schema: {type: string, minLength: 1, maxLength: 128}}
+        - {name: hideZeroInventory, in: query, description: 默认隐藏当前全品质实物件数明确为0的SKU或货主汇总行，保留未知；全量筛选后分页，不改变概览及图表, schema: {type: boolean, default: true}}
+        - name: focus
+          in: query
+          schema: {type: string, enum: [ALL, NO_OUTBOUND_IN_WINDOW, COVERAGE_GT, COVERAGE_LE, FROZEN, DEFECTIVE, UNASSESSABLE], default: ALL}
+        - {name: coverageDaysThreshold, in: query, description: 'GT/LE必填，其余可选；无默认业务阈值', schema: {type: integer, minimum: 1}}
+        - {name: turnoverStatus, in: query, schema: {type: string, enum: [INSUFFICIENT]}}
+        - name: sortBy
+          in: query
+          description: 'OWNER禁止COVERAGE_ASC/DESC及UNIT_VOLUME_ASC/DESC，SKU禁止NO_OUTBOUND_PHYSICAL_DESC。全量筛选后按正式未舍入值排序再分页，未知值始终末尾，同值按SKU及货主升序。AVERAGE_DAILY及OUTBOUND_VOLUME使用baseWindowDays指定的窗口；体积按正式值排序，不使用已知小计。'
+          schema: {type: string, default: PHYSICAL_DESC, enum: [PHYSICAL_ASC, PHYSICAL_DESC, AVAILABLE_ASC, AVAILABLE_DESC, OUTBOUND_7_ASC, OUTBOUND_7_DESC, OUTBOUND_15_ASC, OUTBOUND_15_DESC, OUTBOUND_30_ASC, OUTBOUND_30_DESC, AVERAGE_DAILY_ASC, AVERAGE_DAILY_DESC, COVERAGE_ASC, COVERAGE_DESC, TRANSIT_ASC, TRANSIT_DESC, FROZEN_ASC, FROZEN_DESC, DEFECTIVE_ASC, DEFECTIVE_DESC, AVERAGE_PHYSICAL_ASC, AVERAGE_PHYSICAL_DESC, TURNOVER_ASC, TURNOVER_DESC, INVENTORY_VOLUME_ASC, INVENTORY_VOLUME_DESC, OUTBOUND_VOLUME_ASC, OUTBOUND_VOLUME_DESC, UNIT_VOLUME_ASC, UNIT_VOLUME_DESC, NO_OUTBOUND_PHYSICAL_DESC]}
+        - {name: current, in: query, schema: {type: integer, minimum: 1, default: 1}}
+        - {name: size, in: query, schema: {type: integer, minimum: 1, maximum: 100, default: 20}}
+        - {name: includeOverview, in: query, schema: {type: boolean, default: true}}
+        - {name: snapshotContext, in: query, description: 首屏返回的完整不可拆分上下文；翻页必填, schema: {type: string, minLength: 1, maxLength: 16384}}
+      responses:
+        '200':
+          description: 统一ApiResponse；参数或上下文业务错误沿现有异常响应，不伪装成空结果
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  code: {type: string}
+                  message: {type: string}
+                  data: {$ref: '#/components/schemas/Response'}
+        '400': {description: HTTP参数类型或日期格式不合法}
+        '401': {description: 无可信登录身份}
+        '403': {description: 非平台、代登录或缺少独立只读权限}
+components:
+  securitySchemes:
+    bearerAuth: {type: http, scheme: bearer, bearerFormat: JWT}
+  schemas:
+    Quantity:
+      type: number
+      nullable: true
+      description: PCS件数或对应指标值；未知为null，派生值六位小数，不把未知当0
+    Reasons:
+      type: array
+      items: {type: string}
+    Total:
+      type: object
+      required: [value, knownSubtotal, unknownSkuCount, reasonCodes]
+      properties:
+        value: {$ref: '#/components/schemas/Quantity'}
+        knownSubtotal: {$ref: '#/components/schemas/Quantity'}
+        unknownSkuCount: {type: integer, minimum: 0}
+        reasonCodes: {$ref: '#/components/schemas/Reasons'}
+    Risk:
+      type: object
+      description: 命中为已确认小计；只有整个实物及风险判断完整、分母大于0时才提供件数比例。未设慢消化阈值则数量与比例均null。
+      required: [matchedSkuCount, knownPhysicalQuantity, unknownSkuCount, physicalQuantityRatio]
+      properties:
+        matchedSkuCount: {$ref: '#/components/schemas/Quantity'}
+        knownPhysicalQuantity: {$ref: '#/components/schemas/Quantity'}
+        unknownSkuCount: {type: integer, minimum: 0}
+        physicalQuantityRatio: {$ref: '#/components/schemas/Quantity'}
+    Volume:
+      type: object
+      description: >-
+        m³，按SKU先计算再汇总，不对分页行求和。优先完整有效的仓库实测尺寸，否则完整商品申报尺寸；不混搭长宽高。
+        支持mm/cm/m/in/ft，未知单位及非正尺寸无效。商品资料固定为queryAsOf之前最近完整已发布批次，按账号+货主+SKU关联。
+        库存按全品质实物件数，不计在途，不代表库位占用；历史出库按当前商品尺寸估算，不代表历史包裹实测体积。
+        数量已知为0可得0，无需尺寸；数量未知或正数量缺有效尺寸时正式值null，已知小计单独返回。
+      required: [value, knownSubtotal, missingDimensionQuantity, missingDimensionSkuCount, unknownQuantitySkuCount, declaredDimensionQuantity, reasonCodes]
+      properties:
+        value: {type: number, nullable: true, description: 全部数量和所需尺寸可确认时的体积，m³}
+        knownSubtotal: {type: number, nullable: true, description: 可计算部分的体积小计，m³，不冒充总量}
+        missingDimensionQuantity: {$ref: '#/components/schemas/Quantity'}
+        missingDimensionSkuCount: {type: integer, minimum: 0}
+        unknownQuantitySkuCount: {type: integer, minimum: 0}
+        declaredDimensionQuantity: {allOf: [{$ref: '#/components/schemas/Quantity'}], description: 使用商品申报尺寸估算的件数}
+        reasonCodes: {type: array, items: {type: string, enum: [DIMENSIONS_MISSING_OR_INVALID, QUANTITY_UNAVAILABLE, DECLARED_DIMENSIONS_ESTIMATE]}}
+    VolumeWindow:
+      type: object
+      required: [days, startDate, endDateExclusive, volume]
+      properties:
+        days: {type: integer, minimum: 1, maximum: 366}
+        startDate: {type: string, format: date}
+        endDateExclusive: {type: string, format: date}
+        volume: {$ref: '#/components/schemas/Volume'}
+    Window:
+      type: object
+      required: [days, startDate, endDateExclusive, outboundQuantity, observedQuantity, averageDailyOutboundQuantity, completeDayCount, partialDayCount, unknownDayCount, dataStatus, reasonCodes]
+      properties:
+        days: {type: integer, minimum: 1, maximum: 366}
+        startDate: {type: string, format: date}
+        endDateExclusive: {type: string, format: date}
+        outboundQuantity: {$ref: '#/components/schemas/Quantity'}
+        observedQuantity: {$ref: '#/components/schemas/Quantity'}
+        averageDailyOutboundQuantity: {$ref: '#/components/schemas/Quantity'}
+        completeDayCount: {type: integer, minimum: 0}
+        partialDayCount: {type: integer, minimum: 0}
+        unknownDayCount: {type: integer, minimum: 0}
+        dataStatus: {type: string, enum: [COMPLETE, PARTIAL, UNKNOWN]}
+        reasonCodes: {$ref: '#/components/schemas/Reasons'}
+    Context:
+      type: object
+      required: [snapshotContext, sourceAccount, warehouseCode, endDate, baseWindowDays, queryAsOf, queryExpiresAt, analyticsContext, inventoryObservedFrom, inventoryObservedUntil, sampleRuleVersion, dailySamples, missingSampleDates, accumulationStartedOn]
+      properties:
+        snapshotContext: {type: string}
+        sourceAccount: {type: string}
+        warehouseCode: {type: string}
+        endDate: {type: string, format: date}
+        baseWindowDays: {type: integer, minimum: 1, maximum: 366}
+        queryAsOf: {type: string, format: date-time}
+        queryExpiresAt: {type: string, format: date-time}
+        analyticsContext: {$ref: './self-operated-analytics-v1.yaml#/components/schemas/Context'}
+        inventoryObservedFrom: {type: string, format: date-time, nullable: true}
+        inventoryObservedUntil: {type: string, format: date-time, nullable: true}
+        sampleRuleVersion: {type: string, enum: [FLOW_EOD_V1]}
+        dailySamples:
+          type: array
+          minItems: 30
+          maxItems: 366
+          items:
+            type: object
+            required: [date, dayVersionId]
+            properties:
+              date: {type: string, format: date}
+              dayVersionId: {type: string, nullable: true, description: 内部版本证据，不作为用户可见编号}
+        missingSampleDates: {type: array, items: {type: string, format: date}}
+        accumulationStartedOn: {type: string, format: date, nullable: true}
+    Row:
+      type: object
+      required: [customerCode, customerName, sku, productName, physicalQuantity, availableQuantity, frozenQuantity, defectiveQuantity, transitQuantity, physicalSkuCount, windows, averageDailyOutboundQuantity, inventoryCoverageDays, coverageStatus, averagePhysicalQuantity, quantityTurnoverCount, turnoverStatus, qualifiedSampleDays, requiredSampleDays, missingSampleDates, sampleReasonCodes, lastObservedOutboundDate, attentionReasons, noOutboundInWindow, slowCoverage, unassessableSkuCount, unitVolumeM3, dimensionSource, inventoryVolumeM3, outboundVolumesM3]
+      properties:
+        customerCode: {type: string}
+        customerName: {type: string, nullable: true}
+        sku: {type: string, nullable: true}
+        productName: {type: string, nullable: true}
+        physicalQuantity: {$ref: '#/components/schemas/Total'}
+        availableQuantity: {$ref: '#/components/schemas/Total'}
+        frozenQuantity: {$ref: '#/components/schemas/Total'}
+        defectiveQuantity: {$ref: '#/components/schemas/Total'}
+        transitQuantity:
+          allOf: [{$ref: '#/components/schemas/Total'}]
+          description: 当前固定库存版本的全品质在途件数；独立展示，不计入实物、可售或周转分母；缺失、异常或过期保留未知。
+        physicalSkuCount: {$ref: '#/components/schemas/Quantity'}
+        windows: {type: array, minItems: 3, maxItems: 4, items: {$ref: '#/components/schemas/Window'}}
+        averageDailyOutboundQuantity: {$ref: '#/components/schemas/Quantity'}
+        inventoryCoverageDays: {$ref: '#/components/schemas/Quantity'}
+        coverageStatus: {type: string, enum: [VALID, NOT_APPLICABLE, INVENTORY_UNKNOWN_OR_STALE, NO_AVAILABLE_STOCK, UNASSESSABLE, NO_OUTBOUND_IN_WINDOW]}
+        averagePhysicalQuantity: {$ref: '#/components/schemas/Quantity'}
+        quantityTurnoverCount: {$ref: '#/components/schemas/Quantity'}
+        turnoverStatus: {type: string, enum: [VALID, INSUFFICIENT, ZERO_AVERAGE_STOCK, SALES_WINDOW_UNAVAILABLE]}
+        qualifiedSampleDays: {type: integer, minimum: 0, maximum: 30}
+        requiredSampleDays: {type: integer, minimum: 1, maximum: 366}
+        missingSampleDates: {type: array, items: {type: string, format: date}}
+        sampleReasonCodes: {$ref: '#/components/schemas/Reasons'}
+        lastObservedOutboundDate: {type: string, format: date, nullable: true}
+        attentionReasons: {$ref: '#/components/schemas/Reasons'}
+        noOutboundInWindow: {$ref: '#/components/schemas/Risk'}
+        slowCoverage: {$ref: '#/components/schemas/Risk'}
+        unassessableSkuCount: {type: integer, minimum: 0}
+        unitVolumeM3: {type: number, nullable: true, description: SKU单件体积m³，货主汇总不提供}
+        dimensionSource: {type: string, nullable: true, enum: [WAREHOUSE_MEASURED, PRODUCT_DECLARED, MISSING], description: SKU尺寸来源，货主汇总不提供}
+        inventoryVolumeM3: {$ref: '#/components/schemas/Volume'}
+        outboundVolumesM3: {type: array, minItems: 3, maxItems: 4, items: {$ref: '#/components/schemas/VolumeWindow'}}
+    Overview:
+      type: object
+      nullable: true
+      required: [physicalQuantity, availableQuantity, noOutboundSkuCount, unassessableSkuCount, inventoryVolumeM3, outboundVolumesM3]
+      properties:
+        physicalQuantity: {$ref: '#/components/schemas/Total'}
+        availableQuantity: {$ref: '#/components/schemas/Total'}
+        noOutboundSkuCount: {$ref: '#/components/schemas/Total'}
+        unassessableSkuCount: {$ref: '#/components/schemas/Total'}
+        inventoryVolumeM3: {$ref: '#/components/schemas/Volume'}
+        outboundVolumesM3: {type: array, minItems: 3, maxItems: 4, items: {$ref: '#/components/schemas/VolumeWindow'}}
+    Charts:
+      type: object
+      nullable: true
+      required: [ownerPhysicalTop, unknownOwnerCount, ownerVolumeTop, unknownVolumeOwnerCount, averageDaily]
+      properties:
+        ownerPhysicalTop:
+          type: array
+          maxItems: 10
+          items:
+            type: object
+            required: [customerCode, customerName, physicalQuantity]
+            properties:
+              customerCode: {type: string}
+              customerName: {type: string, nullable: true}
+              physicalQuantity: {$ref: '#/components/schemas/Quantity'}
+        unknownOwnerCount: {type: integer, minimum: 0}
+        ownerVolumeTop:
+          type: array
+          maxItems: 10
+          description: 当前库存正式体积降序，同体积按货主编码稳定排序；排除体积未知货主，不受列表筛选及分页影响。
+          items:
+            type: object
+            required: [customerCode, customerName, inventoryVolumeM3]
+            properties:
+              customerCode: {type: string}
+              customerName: {type: string, nullable: true}
+              inventoryVolumeM3: {$ref: '#/components/schemas/Volume'}
+        unknownVolumeOwnerCount: {type: integer, minimum: 0, description: 因缺尺寸或库存数量未知未参与体积排名的货主数}
+        averageDaily: {type: array, minItems: 3, maxItems: 4, items: {$ref: '#/components/schemas/Window'}}
+    Response:
+      type: object
+      required: [context, summary, charts, rows, total]
+      properties:
+        context: {$ref: '#/components/schemas/Context'}
+        summary: {$ref: '#/components/schemas/Overview'}
+        charts: {$ref: '#/components/schemas/Charts'}
+        rows: {type: array, maxItems: 100, items: {$ref: '#/components/schemas/Row'}}
+        total: {type: string, pattern: '^[0-9]+$', description: 服务统一将Long序列化为字符串}
diff --git a/lastleg-service/src/main/resources/openapi/selfop-quantity-diagnostics-internal-v1.yaml b/lastleg-service/src/main/resources/openapi/selfop-quantity-diagnostics-internal-v1.yaml
new file mode 100644
index 000000000..82391d797
--- /dev/null
+++ b/lastleg-service/src/main/resources/openapi/selfop-quantity-diagnostics-internal-v1.yaml
@@ -0,0 +1,534 @@
+openapi: 3.0.3
+info:
+  title: Internal next-root bounded quantity diagnostics
+  version: 2.0.0
+  description: Explicit arm only; no automatic rearm. Bind next normal automatic historical OUTBOUND_QUERY root
+    within 6h. Sampling expires 4h after first LIST observedAt, never later than armedAt+10h. Lastleg session lock
+    is receiver acceptance. Source root creation may predate arm. LOCATE, manual/validation roots, current excluded
+    root and different bound root are rejected/ignored. At most 100 distinct LIST candidates total, 2000 retained
+    SKU rows across both sides, 2MiB canonical evidence plus promotion overhead. Pending-to-final never refunds
+    quota. First unknown or SKU mismatch persists INCONCLUSIVE and stops; any known inequality among list/forecast/actual
+    persists QUANTITY_DIFFERENCE and stops. Original side timestamps/attempts are immutable; exact replay returns
+    stored receipt even after termination, changed same-side evidence is rejected. Root termination drains only
+    accepted candidates via an explicit Integration FIFO boundary without extending expiry. Fewer than 100 complete
+    pairs is ROOT_ENDED_INSUFFICIENT; unpaired/lost tail is INCOMPLETE. Producer restart retains persisted candidates
+    but marks delivery uncertain. Every request/response is stream-bounded to 262144 bytes. Never exposed through
+    Gateway, never creates supplier requests or changes business facts.
+paths:
+  /internal/lastleg/self-operated-analytics/quantity-diagnostics/arm:
+    post:
+      operationId: quantityDiagnosticArm
+      security:
+      - internalServiceToken: []
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/Arm'
+      responses:
+        '200':
+          description: ApiResponse code 200. status data is null if no grant exists.
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: false
+                properties:
+                  code:
+                    type: string
+                  message:
+                    type: string
+                    nullable: true
+                  data:
+                    $ref: '#/components/schemas/View'
+                    nullable: true
+                required:
+                - code
+                - data
+        '400':
+          description: Invalid scope, changed frozen evidence, invalid observation or disabled feature.
+        '401':
+          description: Missing or invalid internal service token.
+        '503':
+          description: Diagnostic admission, dedicated connection or storage unavailable; collection is unaffected.
+  /internal/lastleg/self-operated-analytics/quantity-diagnostics/status:
+    post:
+      operationId: quantityDiagnosticStatus
+      security:
+      - internalServiceToken: []
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/Status'
+      responses:
+        '200':
+          description: ApiResponse code 200. status data is null if no grant exists.
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: false
+                properties:
+                  code:
+                    type: string
+                  message:
+                    type: string
+                    nullable: true
+                  data:
+                    $ref: '#/components/schemas/View'
+                    nullable: true
+                required:
+                - code
+                - data
+        '400':
+          description: Invalid scope, changed frozen evidence, invalid observation or disabled feature.
+        '401':
+          description: Missing or invalid internal service token.
+        '503':
+          description: Diagnostic admission, dedicated connection or storage unavailable; collection is unaffected.
+  /internal/lastleg/self-operated-analytics/quantity-diagnostics/observe:
+    post:
+      operationId: quantityDiagnosticObserve
+      security:
+      - internalServiceToken: []
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/Event'
+      responses:
+        '200':
+          description: ApiResponse code 200. status data is null if no grant exists.
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: false
+                properties:
+                  code:
+                    type: string
+                  message:
+                    type: string
+                    nullable: true
+                  data:
+                    $ref: '#/components/schemas/Receipt'
+                    nullable: true
+                required:
+                - code
+                - data
+        '400':
+          description: Invalid scope, changed frozen evidence, invalid observation or disabled feature.
+        '401':
+          description: Missing or invalid internal service token.
+        '503':
+          description: Diagnostic admission, dedicated connection or storage unavailable; collection is unaffected.
+  /internal/lastleg/self-operated-analytics/quantity-diagnostics/stop:
+    post:
+      operationId: quantityDiagnosticStop
+      security:
+      - internalServiceToken: []
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/Stop'
+      responses:
+        '200':
+          description: ApiResponse code 200. status data is null if no grant exists.
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: false
+                properties:
+                  code:
+                    type: string
+                  message:
+                    type: string
+                    nullable: true
+                  data:
+                    $ref: '#/components/schemas/View'
+                    nullable: true
+                required:
+                - code
+                - data
+        '400':
+          description: Invalid scope, changed frozen evidence, invalid observation or disabled feature.
+        '401':
+          description: Missing or invalid internal service token.
+        '503':
+          description: Diagnostic admission, dedicated connection or storage unavailable; collection is unaffected.
+components:
+  securitySchemes:
+    internalServiceToken:
+      type: apiKey
+      in: header
+      name: X-Internal-Service-Token
+  schemas:
+    Arm:
+      type: object
+      additionalProperties: false
+      properties:
+        diagnosticSessionId:
+          type: string
+          maxLength: 128
+          minLength: 1
+        sourceAccount:
+          type: string
+          maxLength: 64
+          minLength: 1
+        warehouseCodes:
+          type: array
+          minItems: 1
+          maxItems: 8
+          uniqueItems: true
+          items:
+            type: string
+            maxLength: 64
+            minLength: 1
+        ownerCode:
+          type: string
+          maxLength: 128
+          minLength: 1
+          description: Explicit owner code, or * for all allowed owners.
+        excludedRootTaskId:
+          type: string
+          maxLength: 128
+          minLength: 1
+          nullable: true
+          description: Must match the actual started, unfinished automatic root at arm; null only when none exists.
+      required:
+      - diagnosticSessionId
+      - sourceAccount
+      - warehouseCodes
+      - ownerCode
+    Status:
+      type: object
+      additionalProperties: false
+      properties:
+        sourceAccount:
+          type: string
+          maxLength: 64
+          minLength: 1
+        producerId:
+          type: string
+          maxLength: 128
+          minLength: 1
+        attach:
+          type: boolean
+          description: True only on Integration process attachment; replacement marks delivery uncertain and fences
+            prior producer.
+        drained:
+          type: boolean
+          description: Only after observing DRAINING, closing intake and draining previously queued callbacks.
+      required:
+      - sourceAccount
+      - producerId
+      - attach
+      - drained
+    Stop:
+      type: object
+      additionalProperties: false
+      properties:
+        diagnosticSessionId:
+          type: string
+          maxLength: 128
+          minLength: 1
+        sourceAccount:
+          type: string
+          maxLength: 64
+          minLength: 1
+        producerId:
+          type: string
+          maxLength: 128
+          minLength: 1
+        reason:
+          type: string
+          enum:
+          - INCOMPLETE
+          - QUEUE_FULL
+          - OBSERVER_FAILED
+          - SHUTDOWN
+      required:
+      - diagnosticSessionId
+      - sourceAccount
+      - producerId
+      - reason
+    Observation:
+      type: object
+      additionalProperties: false
+      properties:
+        status:
+          type: string
+          maxLength: 32
+          minLength: 1
+          nullable: true
+        outboundTime:
+          type: string
+          maxLength: 64
+          minLength: 1
+          nullable: true
+        observedAt:
+          type: string
+          format: date-time
+        attemptId:
+          type: string
+          maxLength: 128
+          minLength: 1
+        skuSetComplete:
+          type: boolean
+      required:
+      - status
+      - outboundTime
+      - observedAt
+      - attemptId
+      - skuSetComplete
+    Sku:
+      type: object
+      additionalProperties: false
+      properties:
+        sku:
+          type: string
+          maxLength: 128
+          minLength: 1
+        listQty:
+          type: number
+          nullable: true
+          minimum: 0
+          description: Up to 32 integer digits, at most 6 decimal places; unknown stays null.
+        forecastQty:
+          type: number
+          nullable: true
+          minimum: 0
+          description: Up to 32 integer digits, at most 6 decimal places; unknown stays null.
+        actualQty:
+          type: number
+          nullable: true
+          minimum: 0
+          description: Up to 32 integer digits, at most 6 decimal places; unknown stays null.
+      required:
+      - sku
+      - listQty
+      - forecastQty
+      - actualQty
+    Key:
+      type: object
+      additionalProperties: false
+      properties:
+        warehouseCode:
+          type: string
+          maxLength: 64
+          minLength: 1
+        ownerCode:
+          type: string
+          maxLength: 128
+          minLength: 1
+        orderNo:
+          type: string
+          maxLength: 128
+          minLength: 1
+        paired:
+          type: boolean
+      required:
+      - warehouseCode
+      - ownerCode
+      - orderNo
+      - paired
+    Event:
+      type: object
+      additionalProperties: false
+      properties:
+        diagnosticSessionId:
+          type: string
+          maxLength: 128
+          minLength: 1
+        sourceAccount:
+          type: string
+          maxLength: 64
+          minLength: 1
+        producerId:
+          type: string
+          maxLength: 128
+          minLength: 1
+        rootTaskId:
+          type: string
+          maxLength: 128
+          minLength: 1
+        collectionSessionId:
+          type: string
+          maxLength: 128
+          minLength: 1
+        operation:
+          type: string
+          enum:
+          - OUTBOUND_QUERY
+          - OUTBOUND_DETAIL
+        warehouseCode:
+          type: string
+          maxLength: 64
+          minLength: 1
+        ownerCode:
+          type: string
+          maxLength: 128
+          minLength: 1
+        orderNo:
+          type: string
+          maxLength: 128
+          minLength: 1
+        side:
+          type: string
+          enum:
+          - LIST
+          - DETAIL
+        observation:
+          $ref: '#/components/schemas/Observation'
+        skus:
+          type: array
+          maxItems: 200
+          items:
+            $ref: '#/components/schemas/Sku'
+          description: Empty allowed only when skuSetComplete=false; persists inconclusive evidence.
+      required:
+      - diagnosticSessionId
+      - sourceAccount
+      - producerId
+      - rootTaskId
+      - collectionSessionId
+      - operation
+      - warehouseCode
+      - ownerCode
+      - orderNo
+      - side
+      - observation
+      - skus
+    View:
+      type: object
+      additionalProperties: false
+      properties:
+        diagnosticSessionId:
+          type: string
+          maxLength: 128
+          minLength: 1
+        sourceAccount:
+          type: string
+          maxLength: 64
+          minLength: 1
+        rootTaskId:
+          type: string
+          maxLength: 128
+          minLength: 1
+          nullable: true
+        collectionSessionId:
+          type: string
+          maxLength: 128
+          minLength: 1
+          nullable: true
+        state:
+          type: string
+          enum:
+          - ARMED
+          - BOUND
+          - DRAINING
+          - TERMINAL
+        stopReason:
+          type: string
+          nullable: true
+        startsAt:
+          type: string
+          format: date-time
+          nullable: true
+        expiresAt:
+          type: string
+          format: date-time
+          nullable: true
+        bindBefore:
+          type: string
+          format: date-time
+          nullable: true
+        warehouseCodes:
+          type: array
+          maxItems: 8
+          items:
+            type: string
+            maxLength: 64
+            minLength: 1
+        ownerCode:
+          type: string
+          maxLength: 128
+          minLength: 1
+        excludedRootTaskId:
+          type: string
+          maxLength: 128
+          minLength: 1
+          nullable: true
+        candidates:
+          type: integer
+          minimum: 0
+          maximum: 100
+        pairedOrders:
+          type: integer
+          minimum: 0
+          maximum: 100
+        retainedRows:
+          type: integer
+          minimum: 0
+          maximum: 2000
+        retainedBytes:
+          type: integer
+          minimum: 0
+          maximum: 2097152
+        deliveryUncertain:
+          type: boolean
+        selected:
+          type: array
+          maxItems: 100
+          items:
+            $ref: '#/components/schemas/Key'
+      required:
+      - diagnosticSessionId
+      - sourceAccount
+      - rootTaskId
+      - collectionSessionId
+      - state
+      - stopReason
+      - startsAt
+      - expiresAt
+      - bindBefore
+      - warehouseCodes
+      - ownerCode
+      - excludedRootTaskId
+      - candidates
+      - pairedOrders
+      - retainedRows
+      - retainedBytes
+      - deliveryUncertain
+      - selected
+    Receipt:
+      type: object
+      additionalProperties: false
+      properties:
+        outcome:
+          type: string
+          enum:
+          - ACCEPTED
+          - IGNORED
+          - DUPLICATE
+          - STOPPED
+        comparison:
+          type: string
+          nullable: true
+          enum:
+          - ALL_EQUAL
+          - QUANTITY_DIFFERENCE
+          - INCONCLUSIVE
+        session:
+          $ref: '#/components/schemas/View'
+      required:
+      - outcome
+      - comparison
+      - session
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/appointmentplanning/AppointmentBatchPreviewMapperTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/appointmentplanning/AppointmentBatchPreviewMapperTest.java
index 2b5c4c2b1..6809ab544 100644
--- a/lastleg-service/src/test/java/com/baiyue/lastleg/appointmentplanning/AppointmentBatchPreviewMapperTest.java
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/appointmentplanning/AppointmentBatchPreviewMapperTest.java
@@ -17,11 +17,11 @@ class AppointmentBatchPreviewMapperTest {
             s.execute("CREATE TABLE ll_order(id BIGINT, customer_id VARCHAR(32),detained BOOLEAN,fba_warehouse_code VARCHAR(32))");
             s.execute("CREATE TABLE ll_order_detail(order_id BIGINT,customer_id VARCHAR(32),destination_warehouse_code VARCHAR(32))");
             s.execute("CREATE TABLE ll_inbound_fba_appointment(id BIGINT,appointment_status VARCHAR(32))");
-            s.execute("CREATE TABLE ll_inbound_fba_appointment_item(order_id BIGINT,customer_id VARCHAR(32),appointment_id BIGINT)");
+            s.execute("CREATE TABLE ll_inbound_fba_appointment_item(order_id BIGINT,customer_id VARCHAR(32),appointment_id BIGINT,active BOOLEAN)");
             s.execute("INSERT INTO ll_order VALUES(1,'A',FALSE,'ONT8'),(2,'B',TRUE,'ONT8'),(3,'C',FALSE,'ONT8')");
             s.execute("INSERT INTO ll_order_detail VALUES(1,'OTHER','LAX9'),(2,'B','ONT8'),(3,'C','LAX9')");
             s.execute("INSERT INTO ll_inbound_fba_appointment VALUES(10,'CANCELLED'),(11,'SUCCESS')");
-            s.execute("INSERT INTO ll_inbound_fba_appointment_item VALUES(1,'A',10),(1,'OTHER',11),(3,'C',11)");
+            s.execute("INSERT INTO ll_inbound_fba_appointment_item VALUES(1,'A',10,TRUE),(1,'OTHER',11,TRUE),(3,'C',11,TRUE)");
         }
         var config=new Configuration(new Environment("test",new JdbcTransactionFactory(),ds));config.addMapper(AppointmentBatchPreviewMapper.class);
         try(var session=new SqlSessionFactoryBuilder().build(config).openSession()) {
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/appointmentplanning/AppointmentBatchPreviewServiceTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/appointmentplanning/AppointmentBatchPreviewServiceTest.java
index 8f9ff1197..8433d7474 100644
--- a/lastleg-service/src/test/java/com/baiyue/lastleg/appointmentplanning/AppointmentBatchPreviewServiceTest.java
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/appointmentplanning/AppointmentBatchPreviewServiceTest.java
@@ -7,6 +7,21 @@ import static org.junit.jupiter.api.Assertions.*;
 import static org.mockito.Mockito.*;
 
 class AppointmentBatchPreviewServiceTest {
+    private static AppointmentCargoVerificationService verification() {
+        var service=mock(AppointmentCargoVerificationService.class);
+        when(service.inspect(any())).thenAnswer(call->{AppointmentSourceService.Source source=call.getArgument(0);return new AppointmentCargoVerificationService.Context(source,null,0,0,source.packages(),source.packages()==null?null:source.packages().longValue(),false,List.of("VERIFY_CARGO"),List.of());});
+        return service;
+    }
+    @Test void previewUsesVerifiedRemainingQuantityAndDoesNotRejectAnEntirePartiallyAllocatedSource() {
+        var sources=mock(AppointmentSourceService.class);var mapper=mock(AppointmentBatchPreviewMapper.class);var verification=verification();
+        var refs=List.of(new AppointmentCoverageService.SourceRef("A","ORDER:1","FBA:ONT8"));var source=source("ORDER:1","A",1L,"100","FBA:ONT8");
+        when(sources.resolveBatch(refs)).thenReturn(List.of(source));when(mapper.flags(List.of(1L))).thenReturn(List.of(new AppointmentBatchPreviewMapper.Flags(1L,false,false,true)));
+        when(verification.inspect(source)).thenReturn(new AppointmentCargoVerificationService.Context(source,null,6,0,10,4L,false,List.of("VERIFY_CARGO"),List.of()));
+        var service=new AppointmentBatchPreviewService(sources,mapper,verification);
+        assertEquals(4,service.preview(refs).group().packages());
+        when(verification.inspect(source)).thenReturn(new AppointmentCargoVerificationService.Context(source,null,10,0,10,0L,false,List.of("VERIFY_CARGO"),List.of()));
+        assertThrows(ResponseStatusException.class,()->service.preview(refs));
+    }
     private static AppointmentSourceService.Source source(String key,String customer,Long orderId,String origin,String destination) {
         return new AppointmentSourceService.Source(key,customer,orderId,null,null,null,origin,"美国仓",destination,destination.substring(4),10,"1",true,List.of());
     }
@@ -16,7 +31,7 @@ class AppointmentBatchPreviewServiceTest {
         when(sources.resolveBatch(refs)).thenReturn(List.of(source("ORDER:1","A",1L,"100","FBA:ONT8"),source("BOOKING:B-1","B",null,"100","FBA:ONT8")));
         when(mapper.flags(List.of(1L))).thenReturn(List.of(new AppointmentBatchPreviewMapper.Flags(1L,false,false,false)));
         when(sources.destinationTimezone("ONT8")).thenReturn("America/Los_Angeles");
-        var preview=new AppointmentBatchPreviewService(sources,mapper).preview(refs);
+        var preview=new AppointmentBatchPreviewService(sources,mapper,verification()).preview(refs);
         assertEquals("America/Los_Angeles",preview.destinationTimezone());
         assertEquals(2,preview.group().customerCount());assertEquals(20,preview.group().packages());
         assertTrue(preview.group().readinessIncomplete());assertNull(preview.group().readyFrom());
@@ -28,9 +43,9 @@ class AppointmentBatchPreviewServiceTest {
         var sources=mock(AppointmentSourceService.class);var mapper=mock(AppointmentBatchPreviewMapper.class);
         var refs=List.of(new AppointmentCoverageService.SourceRef("A","ORDER:1","FBA:ONT8"));
         when(sources.resolveBatch(refs)).thenReturn(List.of(source("ORDER:1","A",1L,"100","FBA:ONT8")));
-        var service=new AppointmentBatchPreviewService(sources,mapper);
+        var service=new AppointmentBatchPreviewService(sources,mapper,verification());
         for(var flags:List.of(List.<AppointmentBatchPreviewMapper.Flags>of(),List.of(new AppointmentBatchPreviewMapper.Flags(1L,true,false,false)),
-            List.of(new AppointmentBatchPreviewMapper.Flags(1L,false,true,false)),List.of(new AppointmentBatchPreviewMapper.Flags(1L,false,false,true)))) {
+            List.of(new AppointmentBatchPreviewMapper.Flags(1L,false,true,false)))) {
             when(mapper.flags(List.of(1L))).thenReturn(flags);
             assertEquals(400,assertThrows(ResponseStatusException.class,()->service.preview(refs)).getStatusCode().value());
         }
@@ -39,14 +54,14 @@ class AppointmentBatchPreviewServiceTest {
         var sources=mock(AppointmentSourceService.class);var mapper=mock(AppointmentBatchPreviewMapper.class);
         var refs=List.of(new AppointmentCoverageService.SourceRef("A","BOOKING:A","FBA:ONT8"),new AppointmentCoverageService.SourceRef("B","BOOKING:B","FBA:ONT8"));
         when(sources.resolveBatch(refs)).thenReturn(List.of(source("BOOKING:A","A",null,"100","FBA:ONT8"),source("BOOKING:B","B",null,"200","FBA:ONT8")));
-        assertThrows(ResponseStatusException.class,()->new AppointmentBatchPreviewService(sources,mapper).preview(refs));
+        assertThrows(ResponseStatusException.class,()->new AppointmentBatchPreviewService(sources,mapper,verification()).preview(refs));
         verifyNoInteractions(mapper);
     }
     @Test void absentTimezoneStaysUnknownAndLookupFailureIsNotMasked() {
         var sources=mock(AppointmentSourceService.class);var mapper=mock(AppointmentBatchPreviewMapper.class);
         var refs=List.of(new AppointmentCoverageService.SourceRef("A","BOOKING:A","FBA:ONT8"));
         when(sources.resolveBatch(refs)).thenReturn(List.of(source("BOOKING:A","A",null,"100","FBA:ONT8")));
-        var service=new AppointmentBatchPreviewService(sources,mapper);
+        var service=new AppointmentBatchPreviewService(sources,mapper,verification());
         assertNull(service.preview(refs).destinationTimezone());
         when(sources.destinationTimezone("ONT8")).thenThrow(new ResponseStatusException(org.springframework.http.HttpStatus.SERVICE_UNAVAILABLE,"lookup failed"));
         assertEquals(503,assertThrows(ResponseStatusException.class,()->service.preview(refs)).getStatusCode().value());
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/appointmentplanning/AppointmentCargoMapperTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/appointmentplanning/AppointmentCargoMapperTest.java
index 7f7f18b11..5c615046f 100644
--- a/lastleg-service/src/test/java/com/baiyue/lastleg/appointmentplanning/AppointmentCargoMapperTest.java
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/appointmentplanning/AppointmentCargoMapperTest.java
@@ -17,7 +17,7 @@ class AppointmentCargoMapperTest {
             s.execute("CREATE TABLE ll_order(id BIGINT,customer_id VARCHAR,customer_name VARCHAR,inbound_code VARCHAR,source_container_booking_id VARCHAR,container_no VARCHAR,overseas_warehouse_id VARCHAR,overseas_warehouse_code VARCHAR,overseas_warehouse_name VARCHAR,fba_warehouse_code VARCHAR,package_count INT,received_package_count INT,shipped_package_count INT,pallet_count INT,volume_cbm DECIMAL,estimated_arrival_at TIMESTAMP,estimated_warehouse_at TIMESTAMP,version INT,detained BOOLEAN,order_type VARCHAR,destination_type VARCHAR,current_status VARCHAR,created_at TIMESTAMP)");
             s.execute("CREATE TABLE ll_container_shipping_gate(container_booking_id VARCHAR,node_sequence INT,standard_node VARCHAR,aggregate_version BIGINT,observed_at TIMESTAMP,provider_code VARCHAR)");
             s.execute("CREATE TABLE ll_inbound_plan(id BIGINT,source_order_id BIGINT,customer_id VARCHAR)");
-            s.execute("CREATE TABLE ll_inbound_fba_appointment_item(order_id BIGINT,customer_id VARCHAR,appointment_id BIGINT)");
+            s.execute("CREATE TABLE ll_inbound_fba_appointment_item(order_id BIGINT,customer_id VARCHAR,appointment_id BIGINT,active BOOLEAN)");
             s.execute("CREATE TABLE ll_inbound_fba_appointment(id BIGINT,appointment_status VARCHAR)");
             s.execute("CREATE TABLE ll_order_detail(order_id BIGINT,customer_id VARCHAR,destination_warehouse_code VARCHAR)");
             s.execute("INSERT INTO ll_order(id,customer_id,inbound_code,source_container_booking_id,overseas_warehouse_id,fba_warehouse_code,package_count,order_type,destination_type,current_status,created_at) VALUES(1,'A','IN-A','C1','100','ONT8',10,'FIRST_LEG','FBA','WAIT_INBOUND',CURRENT_TIMESTAMP),(2,'B','IN-B','C2','100','ONT8',8,'FIRST_LEG','FBA','WAIT_INBOUND',CURRENT_TIMESTAMP)");
@@ -33,7 +33,7 @@ class AppointmentCargoMapperTest {
             try (var s=session.getConnection().createStatement()) {
                 s.execute("INSERT INTO ll_inbound_plan VALUES(11,1,'A'),(12,1,'A')");
                 s.execute("INSERT INTO ll_inbound_fba_appointment VALUES(20,'SUCCESS')");
-                s.execute("INSERT INTO ll_inbound_fba_appointment_item VALUES(1,'A',20)");
+                s.execute("INSERT INTO ll_inbound_fba_appointment_item VALUES(1,'A',20,TRUE)");
             }
             session.clearCache();
             var after=mapper.page(List.of("100"),List.of("ONT8"),null,null,null,20,0);
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/appointmentplanning/AppointmentCargoVerificationBatchTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/appointmentplanning/AppointmentCargoVerificationBatchTest.java
new file mode 100644
index 000000000..ea89cc6e8
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/appointmentplanning/AppointmentCargoVerificationBatchTest.java
@@ -0,0 +1,32 @@
+package com.baiyue.lastleg.appointmentplanning;
+
+import com.fasterxml.jackson.databind.ObjectMapper;
+import org.junit.jupiter.api.Test;
+import org.springframework.http.HttpStatus;
+import org.springframework.web.server.ResponseStatusException;
+import java.util.*;
+import java.util.stream.IntStream;
+import static org.junit.jupiter.api.Assertions.*;
+import static org.mockito.ArgumentMatchers.*;
+import static org.mockito.Mockito.*;
+
+class AppointmentCargoVerificationBatchTest {
+    @Test void inspectionUsesTwoBoundedBatchesAndRetainsPerSourcePrerequisitesAndAllocations() {
+        var sources=mock(AppointmentSourceService.class);var mapper=mock(AppointmentCargoVerificationMapper.class);
+        var service=new AppointmentCargoVerificationService(sources,mapper,new ObjectMapper());
+        var refs=IntStream.rangeClosed(1,200).mapToObj(i->new AppointmentCoverageService.SourceRef("C","ORDER:"+i,"FBA:ONT8")).toList();
+        when(sources.inspectBatch(anyList())).thenAnswer(call->call.<List<AppointmentCoverageService.SourceRef>>getArgument(0).stream().map(ref->
+            ref.sourceKey().equals("ORDER:2")?new AppointmentSourceService.Resolution(ref,null,new ResponseStatusException(HttpStatus.BAD_REQUEST,"接仓点不在启用的美国仓目录中")):
+            new AppointmentSourceService.Resolution(ref,new AppointmentSourceService.Source(ref.sourceKey(),ref.customerId(),Long.valueOf(ref.sourceKey().substring(6)),"IN",null,"CONTAINER","100","仓",ref.destinationKey(),"ONT8",10,"ORDER:1",true,List.of()),null)).toList());
+        when(mapper.allocatedBatch(anyList())).thenAnswer(call->call.<List<AppointmentCoverageService.SourceRef>>getArgument(0).stream().filter(r->r.sourceKey().equals("ORDER:1"))
+            .map(r->new AppointmentCargoVerificationMapper.SourceAllocation(r.customerId(),r.sourceKey(),4,0)).toList());
+        var result=service.inspectBatch(refs);
+        assertEquals(200,result.size());assertEquals(6L,result.get(0).requireContext().availablePackages());
+        assertEquals("接仓点不在启用的美国仓目录中",assertThrows(ResponseStatusException.class,()->result.get(1).requireContext()).getReason());
+        assertEquals(10L,result.get(199).requireContext().availablePackages());
+        verify(sources,times(2)).inspectBatch(argThat(batch->batch.size()==100));
+        verify(mapper,times(2)).latestBatch(anyList());verify(mapper,times(2)).allocatedBatch(anyList());verifyNoMoreInteractions(mapper,sources);
+        when(sources.inspectBatch(anyList())).thenThrow(new ResponseStatusException(HttpStatus.SERVICE_UNAVAILABLE,"目录不可用"));
+        assertEquals(503,assertThrows(ResponseStatusException.class,()->service.inspectBatch(refs)).getStatusCode().value());
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/appointmentplanning/AppointmentCoverageMapperTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/appointmentplanning/AppointmentCoverageMapperTest.java
index ee46c5649..21d7fd5bc 100644
--- a/lastleg-service/src/test/java/com/baiyue/lastleg/appointmentplanning/AppointmentCoverageMapperTest.java
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/appointmentplanning/AppointmentCoverageMapperTest.java
@@ -24,8 +24,14 @@ class AppointmentCoverageMapperTest {
             s.execute("INSERT INTO ll_warehouse_transfer_order VALUES(30,3,'C','FBA','ACY2','SHIP-C',NULL)");
             s.execute("INSERT INTO ll_inbound_fba_appointment VALUES(1000,'AP-1','SUCCESS',CURRENT_TIMESTAMP,NULL,CURRENT_TIMESTAMP,'EXT-1','America/Los_Angeles'),(2000,'CANCELLED-1','CANCELLED',CURRENT_TIMESTAMP,NULL,CURRENT_TIMESTAMP,'EXT-2','America/Los_Angeles')");
             s.execute("INSERT INTO ll_inbound_fba_appointment_item VALUES(1,1000,1,'A','ORDER:1','ORDER:1',20,'ONT8',TRUE),(2,1000,2,'B','ORDER:2','ORDER:1',8,'ONT8',TRUE),(3,2000,1,'A','ORDER:1','ORDER:1',20,'ONT8',FALSE),(4,1000,NULL,'D','BOOKING:B-1','BOOKING:1',NULL,'ONT8',TRUE)");
+            s.execute("ALTER TABLE ll_inbound_fba_appointment_item ADD cargo_verification_version INT");
+            String baseline;try(var input=getClass().getResourceAsStream("/db/lastleg.sql")){baseline=new String(java.util.Objects.requireNonNull(input).readAllBytes(),java.nio.charset.StandardCharsets.UTF_8);}
+            int start=baseline.indexOf("CREATE TABLE IF NOT EXISTS ll_appointment_cargo_verification (");
+            s.execute(baseline.substring(start,baseline.indexOf(';',start)+1));
+            s.execute("INSERT INTO ll_appointment_cargo_verification(id,customer_id,source_key,destination_key,version,package_count,shipment_references_json,operator_id,command_key,request_hash,created_at) VALUES(1,'A','ORDER:1','FBA:ONT8',1,19,'[]','operator','one',REPEAT('a',64),CURRENT_TIMESTAMP),(2,'A','ORDER:1','FBA:ONT8',2,20,'[\"FBA-A\"]','operator','two',REPEAT('b',64),CURRENT_TIMESTAMP),(3,'B','ORDER:1','FBA:ONT8',1,8,'[]','operator','one',REPEAT('c',64),CURRENT_TIMESTAMP)");
         }
         var config=new Configuration(new Environment("test",new JdbcTransactionFactory(),ds));config.setMapUnderscoreToCamelCase(true);config.addMapper(AppointmentCoverageMapper.class);
+        config.addMapper(AppointmentCargoVerificationMapper.class);
         try(var session=new SqlSessionFactoryBuilder().build(config).openSession(true)) {
             var mapper=session.getMapper(AppointmentCoverageMapper.class);
             var source=mapper.sources(List.of(new AppointmentCoverageMapper.OrderRef("A",1L))).get(0);assertFalse(source.shipmentReferencesMissing());assertEquals(20,source.packages());
@@ -35,6 +41,16 @@ class AppointmentCoverageMapperTest {
             var external=mapper.appointments(List.of(new AppointmentCoverageService.SourceRef("D","BOOKING:B-1","FBA:ONT8"))).get(0);assertNull(external.orderId());assertNull(external.packages());
             var transfer=mapper.sources(List.of(new AppointmentCoverageMapper.OrderRef("C",3L))).get(0);assertEquals("FBA",transfer.destinationType());assertEquals("ACY2",transfer.fbaWarehouseCode());assertFalse(transfer.shipmentReferencesMissing());
             assertTrue(mapper.sources(List.of(new AppointmentCoverageMapper.OrderRef("B",2L))).get(0).shipmentReferencesMissing());
+            var evidence=mapper.verifications(List.of(new AppointmentCoverageService.SourceRef("A","ORDER:1","FBA:ONT8")));
+            assertEquals(1,evidence.size());assertEquals(2,evidence.get(0).getVersion());assertEquals(20,evidence.get(0).getPackageCount());
+            var cargo=session.getMapper(AppointmentCargoVerificationMapper.class);
+            var refs=List.of(new AppointmentCoverageService.SourceRef("A","ORDER:1","FBA:ONT8"),new AppointmentCoverageService.SourceRef("B","ORDER:1","FBA:ONT8"),new AppointmentCoverageService.SourceRef("D","BOOKING:B-1","FBA:ONT8"));
+            var latest=cargo.latestBatch(refs);assertEquals(2,latest.size());
+            assertEquals(2,latest.stream().filter(r->r.getCustomerId().equals("A")).findFirst().orElseThrow().getVersion());
+            assertEquals(1,latest.stream().filter(r->r.getCustomerId().equals("B")).findFirst().orElseThrow().getVersion());
+            var allocations=cargo.allocatedBatch(refs);assertEquals(2,allocations.size());
+            assertEquals(new AppointmentCargoVerificationMapper.SourceAllocation("A","ORDER:1",20,0),allocations.stream().filter(r->r.customerId().equals("A")).findFirst().orElseThrow());
+            assertEquals(new AppointmentCargoVerificationMapper.SourceAllocation("D","BOOKING:B-1",0,1),allocations.stream().filter(r->r.customerId().equals("D")).findFirst().orElseThrow());
         }
     }
-}
\ No newline at end of file
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/appointmentplanning/AppointmentCoverageServiceTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/appointmentplanning/AppointmentCoverageServiceTest.java
index 5d7e0cd6a..fe14d1dd4 100644
--- a/lastleg-service/src/test/java/com/baiyue/lastleg/appointmentplanning/AppointmentCoverageServiceTest.java
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/appointmentplanning/AppointmentCoverageServiceTest.java
@@ -13,7 +13,7 @@ class AppointmentCoverageServiceTest {
         return new AppointmentCoverageMapper.Source(1L,"A","FBA","ONT8",20,2,BEFORE,false);
     }
     private static AppointmentCoverageMapper.Fact fact(long line,int packages,String status) {
-        return new AppointmentCoverageMapper.Fact(1L,"A","AP-1",status,AFTER.plusDays(1),null,AFTER,line,packages,"ONT8","ORDER:1","ORDER:2","EXT-1","America/Los_Angeles");
+        return new AppointmentCoverageMapper.Fact(1L,"A","AP-1",status,AFTER.plusDays(1),null,AFTER,line,packages,"ONT8","ORDER:1","ORDER:2","EXT-1","America/Los_Angeles",null);
     }
     @Test void completeQuantitySharesOneAppointmentWithItsActualConfirmationAndTimezone() {
         var mapper=mock(AppointmentCoverageMapper.class); var gateway=mock(AppointmentExternalSourceGateway.class);
@@ -42,7 +42,7 @@ class AppointmentCoverageServiceTest {
         when(gateway.resolve(anyList())).thenReturn(List.of(new AppointmentExternalSourceGateway.Source("A","B-1","TR-1","CONFIRMED","100","FBA:ONT8",null,20,1L)));
         assertEquals("SOURCE_NOT_MATERIALIZED",service.query(refs).get(0).status()); verify(mapper,never()).sources(anyList());
         when(gateway.resolve(anyList())).thenReturn(List.of(new AppointmentExternalSourceGateway.Source("A","B-1","TR-1","BOUND","100","FBA:ONT8",1L,20,2L)));
-        when(mapper.sources(anyList())).thenReturn(List.of(order())); when(mapper.appointments(anyList())).thenReturn(List.of(new AppointmentCoverageMapper.Fact(1L,"A","AP-1","SUCCESS",AFTER.plusDays(1),null,AFTER,10L,20,"ONT8","BOOKING:B-1","BOOKING:2/ORDER:2","EXT-1","America/Los_Angeles")));
+        when(mapper.sources(anyList())).thenReturn(List.of(order())); when(mapper.appointments(anyList())).thenReturn(List.of(new AppointmentCoverageMapper.Fact(1L,"A","AP-1","SUCCESS",AFTER.plusDays(1),null,AFTER,10L,20,"ONT8","BOOKING:B-1","BOOKING:2/ORDER:2","EXT-1","America/Los_Angeles",null)));
         var result=service.query(refs).get(0); assertEquals("BOOKING:B-1",result.sourceKey()); assertEquals("CONFIRMED",result.status());
         assertThrows(IllegalArgumentException.class, () -> service.query(List.of(refs.get(0),new AppointmentCoverageService.SourceRef("A","ORDER:1","FBA:ONT8"))));
     }
@@ -60,6 +60,22 @@ class AppointmentCoverageServiceTest {
         var result=new AppointmentCoverageService(mapper,mock(AppointmentExternalSourceGateway.class)).query(List.of(new AppointmentCoverageService.SourceRef("A","ORDER:1","FBA:ONT8"))).get(0);
         assertTrue(result.changeReviewRequired()); assertTrue(result.missingFields().containsAll(List.of("SOURCE_CHANGED_REVIEW","FBA_SHIPMENT_REFERENCES")));
         assertEquals(AFTER.plusDays(1),result.appointments().get(0).confirmedAt());
-        verify(mapper,times(1)).sources(anyList()); verify(mapper,times(1)).appointments(anyList()); verifyNoMoreInteractions(mapper);
+        verify(mapper,times(1)).sources(anyList()); verify(mapper,times(1)).appointments(anyList()); verify(mapper,times(1)).verifications(anyList()); verifyNoMoreInteractions(mapper);
+    }
+    @Test void independentVerificationSuppliesQuantityAndReferencesWithoutRewritingOriginalOrderFacts() {
+        var mapper=mock(AppointmentCoverageMapper.class);
+        when(mapper.sources(anyList())).thenReturn(List.of(new AppointmentCoverageMapper.Source(1L,"A","FBA","ONT8",null,2,BEFORE,true)));
+        var evidence=new AppointmentCargoVerification();evidence.setCustomerId("A");evidence.setSourceKey("ORDER:1");evidence.setDestinationKey("FBA:ONT8");
+        evidence.setSourceVersion("ORDER:2");evidence.setPackageCount(20);evidence.setVersion(1);evidence.setShipmentReferencesJson("[\"FBA-A\"]");
+        when(mapper.verifications(anyList())).thenReturn(List.of(evidence));
+        when(mapper.appointments(anyList())).thenReturn(List.of(new AppointmentCoverageMapper.Fact(1L,"A","AP-1","SUCCESS",AFTER.plusDays(1),null,AFTER,10L,20,"ONT8","ORDER:1","ORDER:2","EXT-1","America/Los_Angeles",1)));
+        var service=new AppointmentCoverageService(mapper,mock(AppointmentExternalSourceGateway.class));
+        var refs=List.of(new AppointmentCoverageService.SourceRef("A","ORDER:1","FBA:ONT8"));
+        var result=service.query(refs).get(0);
+        assertEquals("CONFIRMED",result.status());assertFalse(result.changeReviewRequired());assertFalse(result.missingFields().contains("FBA_SHIPMENT_REFERENCES"));
+        evidence.setVersion(2);evidence.setShipmentReferencesJson("[\"FBA-CHANGED\"]");
+        var changed=service.query(refs).get(0);
+        assertTrue(changed.changeReviewRequired());assertTrue(changed.missingFields().contains("SOURCE_CHANGED_REVIEW"));
+        assertEquals(result.appointments(),changed.appointments(),"核实资料变更不能重写原确认时间");
     }
 }
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/appointmentplanning/AppointmentPlanningAuthorizationTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/appointmentplanning/AppointmentPlanningAuthorizationTest.java
index 3f3910460..13e21e691 100644
--- a/lastleg-service/src/test/java/com/baiyue/lastleg/appointmentplanning/AppointmentPlanningAuthorizationTest.java
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/appointmentplanning/AppointmentPlanningAuthorizationTest.java
@@ -1,6 +1,7 @@
 package com.baiyue.lastleg.appointmentplanning;
 
 import com.baiyue.common.security.AuthenticatedUser;
+import com.baiyue.lastleg.inboundplan.controller.AppointmentSourceCreateController;
 import org.junit.jupiter.api.Test;
 import org.springframework.context.annotation.*;
 import org.springframework.security.access.AccessDeniedException;
@@ -16,16 +17,66 @@ import static org.mockito.Mockito.*;
 
 class AppointmentPlanningAuthorizationTest {
     private static final String LIST="platform:appointment:list", CARGO="platform:overseas-warehouse:last-mile-order:list", WRITE="platform:appointment:followup";
+    @Test void orderLookupUsesCanonicalBookingSourceAndEnforcesCustomerAndReadPermissions() {
+        try(var context=new AnnotationConfigApplicationContext(Config.class)) {
+            var controller=context.getBean(AppointmentPlanningController.class);
+            var sources=context.getBean(AppointmentSourceService.class);
+            var coverage=context.getBean(AppointmentCoverageService.class);
+            login(LIST);assertThrows(AccessDeniedException.class,()->controller.resolveOrder(user(0L,"PLATFORM"),1L,"A","FBA:ONT8"));
+            login(CARGO);assertThrows(AccessDeniedException.class,()->controller.resolveOrder(user(0L,"PLATFORM"),1L,"A","FBA:ONT8"));
+            login(LIST,CARGO);
+            assertThrows(ResponseStatusException.class,()->controller.resolveOrder(user(1L,"CLIENT"),1L,"A","FBA:ONT8"));
+            assertThrows(ResponseStatusException.class,()->controller.resolveOrder(user(0L,"PLATFORM"),0L,"A","FBA:ONT8"));
+            verifyNoInteractions(sources);
+            var ref=new AppointmentCoverageService.SourceRef("A","BOOKING:B-1","FBA:ONT8");
+            var source=new AppointmentSourceService.Source("BOOKING:B-1","A",1L,"IN-A","B-1",null,"100","美国仓","FBA:ONT8","ONT8",10,"BOOKING:2/ORDER:1",true,List.of());
+            when(sources.canonicalOrders(List.of(new AppointmentExternalSourceGateway.OrderRef("A",1L)))).thenReturn(List.of(ref));
+            when(sources.resolve("BOOKING:B-1","A","FBA:ONT8")).thenReturn(source);
+            var snapshot=new AppointmentCoverageService.Coverage("A","BOOKING:B-1","FBA:ONT8","PENDING",List.of(),List.of(),source.sourceVersion(),false);
+            when(coverage.query(List.of(ref))).thenReturn(List.of(snapshot));
+            assertEquals(source,controller.resolveOrder(user(0L,"PLATFORM"),1L,"A","FBA:ONT8").data().source());
+            verify(sources,never()).resolve("ORDER:1","A","FBA:ONT8");
+            when(sources.canonicalOrders(List.of(new AppointmentExternalSourceGateway.OrderRef("OTHER",1L)))).thenReturn(List.of(new AppointmentCoverageService.SourceRef("OTHER","ORDER:1",null)));
+            when(sources.resolve("ORDER:1","OTHER","FBA:ONT8")).thenThrow(new ResponseStatusException(org.springframework.http.HttpStatus.NOT_FOUND));
+            assertEquals(404,assertThrows(ResponseStatusException.class,()->controller.resolveOrder(user(0L,"PLATFORM"),1L,"OTHER","FBA:ONT8")).getStatusCode().value());
+            verify(coverage,times(1)).query(anyList());
+        } finally {SecurityContextHolder.clearContext();}
+    }
+    @Test void batchContextRequiresBothListPermissionsAndRejectsCustomerIdentity() {
+        try(var context=new AnnotationConfigApplicationContext(Config.class)) {
+            var controller=context.getBean(com.baiyue.lastleg.inboundplan.controller.FbaAppointmentBatchController.class);
+            login(LIST);assertThrows(AccessDeniedException.class,()->controller.detail(user(0L,"PLATFORM"),"FBA_APPOINTMENT:1"));
+            login(LIST,CARGO);assertThrows(ResponseStatusException.class,()->controller.detail(user(1L,"CLIENT"),"FBA_APPOINTMENT:1"));
+            assertDoesNotThrow(()->controller.detail(user(0L,"PLATFORM"),"FBA_APPOINTMENT:1"));
+        } finally {SecurityContextHolder.clearContext();}
+    }
+    @Test void cargoVerificationRequiresIndependentWritePermissionAndPlatformIdentity() {
+        try(var context=new AnnotationConfigApplicationContext(Config.class)) {
+            var controller=context.getBean(AppointmentCargoVerificationController.class);
+            var request=new AppointmentCargoVerificationService.Save("FBA:ONT8","ORDER:1",0,10,List.of("FBA-A"),null,"verify");
+            login(LIST);assertThrows(AccessDeniedException.class,()->controller.get(user(0L,"PLATFORM"),"ORDER:1","A",null));
+            login(LIST,CARGO);controller.get(user(0L,"PLATFORM"),"ORDER:1","A",null);
+            assertThrows(AccessDeniedException.class,()->controller.save(user(0L,"PLATFORM"),"ORDER:1","A",request));
+            login(LIST,CARGO,WRITE);assertThrows(AccessDeniedException.class,()->controller.save(user(0L,"PLATFORM"),"ORDER:1","A",request));
+            login(LIST,CARGO,com.baiyue.lastleg.security.OverseasPermissions.INBOUND_ORDER_FBA_APPOINTMENT);
+            assertThrows(ResponseStatusException.class,()->controller.save(user(1L,"CLIENT"),"ORDER:1","A",request));
+            controller.save(user(0L,"PLATFORM"),"ORDER:1","A",request);
+            verify(context.getBean(AppointmentCargoVerificationService.class)).save("ORDER:1","A",request,"7","operator");
+        } finally {SecurityContextHolder.clearContext();}
+    }
     @Test void savingSourceAppointmentsNeedsTheExistingFbaWritePermissionAndNeverAcceptsClientIdentity() {
         try(var context=new AnnotationConfigApplicationContext(Config.class)) {
             var controller=context.getBean(AppointmentSourceCreateController.class);
-            var request=new com.baiyue.lastleg.inboundplan.dto.SourceFbaAppointmentRequest(List.of(new AppointmentCoverageService.SourceRef("A","ORDER:1","FBA:ONT8")),
+            var request=new com.baiyue.lastleg.inboundplan.dto.SourceFbaAppointmentRequest(List.of(new com.baiyue.lastleg.inboundplan.dto.SourceFbaAppointmentRequest.SourceRef("A","ORDER:1","FBA:ONT8")),
                 "100","ONT8",new com.baiyue.lastleg.inboundplan.dto.FbaAppointmentDetails(null,null,null,null,null,null,"PENDING",null,null,null),"key");
             login(LIST,CARGO,WRITE);
             assertThrows(AccessDeniedException.class,()->controller.create(user(0L,"PLATFORM"),request));
+            assertThrows(AccessDeniedException.class,()->controller.repartition(user(0L,"PLATFORM"),null));
             login(LIST,CARGO,com.baiyue.lastleg.security.OverseasPermissions.INBOUND_ORDER_FBA_APPOINTMENT);
             assertThrows(ResponseStatusException.class,()->controller.create(user(1L,"CLIENT"),request));
+            assertThrows(ResponseStatusException.class,()->controller.repartition(user(1L,"CLIENT"),null));
             assertDoesNotThrow(()->controller.create(user(0L,"PLATFORM"),request));
+            assertDoesNotThrow(()->controller.repartition(user(0L,"PLATFORM"),null));
             login(LIST);assertDoesNotThrow(()->controller.unscheduled(user(0L,"PLATFORM"),1,20));
         } finally {SecurityContextHolder.clearContext();}
     }
@@ -90,6 +141,9 @@ class AppointmentPlanningAuthorizationTest {
     private static void login(String... permissions) { SecurityContextHolder.getContext().setAuthentication(new UsernamePasswordAuthenticationToken("operator","unused",java.util.Arrays.stream(permissions).map(SimpleGrantedAuthority::new).toList())); }
     @Configuration @EnableMethodSecurity
     static class Config {
+        @Bean com.baiyue.lastleg.inboundplan.controller.FbaAppointmentBatchController batchController() {return new com.baiyue.lastleg.inboundplan.controller.FbaAppointmentBatchController(mock(com.baiyue.lastleg.inboundplan.service.InboundFbaAppointmentService.class));}
+        @Bean AppointmentCargoVerificationService verificationService() {return mock(AppointmentCargoVerificationService.class);}
+        @Bean AppointmentCargoVerificationController verificationController(AppointmentCargoVerificationService service) {return new AppointmentCargoVerificationController(service);}
         @Bean AppointmentSourceCreateController sourceCreateController() { return new AppointmentSourceCreateController(mock(com.baiyue.lastleg.inboundplan.service.InboundFbaAppointmentService.class)); }
         @Bean AppointmentCoverageMapper destinationFacts() { return mock(AppointmentCoverageMapper.class); }
         @Bean AppointmentBatchPreviewService batchPreviews() { return mock(AppointmentBatchPreviewService.class); }
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/appointmentplanning/AppointmentSourceServiceTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/appointmentplanning/AppointmentSourceServiceTest.java
index c860204e2..0543d3efc 100644
--- a/lastleg-service/src/test/java/com/baiyue/lastleg/appointmentplanning/AppointmentSourceServiceTest.java
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/appointmentplanning/AppointmentSourceServiceTest.java
@@ -25,6 +25,14 @@ class AppointmentSourceServiceTest {
         var refs=List.of(new AppointmentCoverageService.SourceRef("A","ORDER:1","FBA:ONT8"),new AppointmentCoverageService.SourceRef("B","ORDER:2","FBA:ONT8"));
         var result=service.resolveBatch(refs);assertEquals(2,result.size());assertEquals(20,result.get(1).packages());
         verify(orders,times(1)).selectBatchIds(anyCollection());verify(shipping,times(1)).selectBatchIds(anyCollection());verify(warehouse,times(1)).catalog("token");verify(gateway,times(1)).resolveOrders(anyList());verifyNoMoreInteractions(gateway);
+        b.setOverseasWarehouseId("unknown");
+        var inspected=service.inspectBatch(refs);assertNotNull(inspected.get(0).requireSource());
+        assertEquals("接仓点不在启用的美国仓目录中",inspected.get(1).error().getReason());
+        assertThrows(ResponseStatusException.class,()->service.resolveBatch(refs));
+        var unauthorized=service.inspectBatch(List.of(new AppointmentCoverageService.SourceRef("OTHER","ORDER:1","FBA:ONT8")));
+        assertEquals(404,assertThrows(ResponseStatusException.class,()->unauthorized.get(0).requireSource()).getStatusCode().value());
+        when(warehouse.catalog("token")).thenThrow(new IllegalStateException("offline"));
+        assertEquals(503,assertThrows(ResponseStatusException.class,()->service.inspectBatch(refs)).getStatusCode().value());
         assertThrows(ResponseStatusException.class,()->service.resolveBatch(List.of(refs.get(0),refs.get(0))));
         assertThrows(ResponseStatusException.class,()->service.resolveBatch(List.of(new AppointmentCoverageService.SourceRef("OTHER","ORDER:1","FBA:ONT8"))));
     }
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkCommandServiceTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkCommandServiceTest.java
new file mode 100644
index 000000000..820fa3a18
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkCommandServiceTest.java
@@ -0,0 +1,76 @@
+package com.baiyue.lastleg.appointmentwork;
+
+import org.junit.jupiter.api.Test;
+import org.springframework.web.server.ResponseStatusException;
+import java.time.*;
+import java.util.*;
+import static org.junit.jupiter.api.Assertions.*;
+import static org.mockito.Mockito.*;
+import static org.mockito.ArgumentMatchers.*;
+import static com.baiyue.lastleg.appointmentwork.WorkTestFixture.*;
+import static com.baiyue.lastleg.appointmentwork.AppointmentWorkModels.*;
+import static com.baiyue.lastleg.appointmentwork.AppointmentWorkFactGateway.*;
+import static com.baiyue.lastleg.appointmentwork.AppointmentWorkPolicy.*;
+
+class AppointmentWorkCommandServiceTest {
+    @Test void sameCommandReplaysItsOriginalSnapshotAfterLaterChangesAndRejectsChangedContent() throws Exception {
+        var f=new WorkTestFixture(); var state=f.state("1",Type.ROUTE,Flow.UNKNOWN,null); f.add(state);
+        var first=f.command(Command.SAVE_FOLLOWUP,0,"first","{\"ownerId\":\"1\",\"followupDate\":null,\"note\":\"已联系\"}");
+        var saved=f.commands.execute(state.getWorkItemKey(),first,ACTOR);
+        f.commands.execute(state.getWorkItemKey(),f.command(Command.SAVE_FOLLOWUP,1,"second","{\"ownerId\":\"1\",\"followupDate\":\"2026-10-16\",\"note\":\"等待回复\"}"),ACTOR);
+        assertEquals(saved,f.commands.execute(state.getWorkItemKey(),first,ACTOR));
+        assertEquals(2,f.history.size()); assertNull(saved.item().followupDate());
+        var changed=f.command(Command.SAVE_FOLLOWUP,0,"first","{\"ownerId\":\"1\",\"followupDate\":null,\"note\":\"不同内容\"}");
+        assertEquals(409,assertThrows(ResponseStatusException.class,()->f.commands.execute(state.getWorkItemKey(),changed,ACTOR)).getStatusCode().value());
+        var other=new Actor("2","运营乙",ACTOR.permissions());
+        assertEquals(409,assertThrows(ResponseStatusException.class,()->f.commands.execute(state.getWorkItemKey(),first,other)).getStatusCode().value());
+        when(f.gateway.facts(anyList())).thenThrow(new IllegalStateException("source temporarily offline"));
+        assertEquals(saved,f.commands.execute(state.getWorkItemKey(),first,ACTOR));
+        var revoked=new Actor("1","运营甲",Set.of(LIST,FOLLOWUP,MANAGE));
+        assertEquals(403,assertThrows(ResponseStatusException.class,()->f.commands.execute(state.getWorkItemKey(),first,revoked)).getStatusCode().value());
+    }
+    @Test void directRouteGeneratesFourTypesOnceAndDoesNotCreateWarehouseReceipt() throws Exception {
+        var f=new WorkTestFixture(); var route=f.state("1",Type.ROUTE,Flow.UNKNOWN,null); f.add(route);
+        var requirement=new Requirement("requirement-1",null,null,"CUSTOMER","洛杉矶港","客户仓","America/Los_Angeles",List.of(),List.of(),List.of());
+        when(f.gateway.container("1")).thenReturn(new ContainerSource("1","柜1",Instant.parse("2026-10-01T00:00:00Z"),null,null,"v1",Flow.UNKNOWN,"America/Los_Angeles",List.of(requirement)));
+        var request=f.command(Command.CONFIRM_ROUTE,0,"route","{\"flow\":\"DIRECT\",\"reason\":\"按客户直送要求\"}");
+        var result=f.commands.execute(route.getWorkItemKey(),request,ACTOR);
+        assertEquals(5,f.rows.size()); assertEquals(5,result.affectedWorkItemKeys().size());
+        assertTrue(f.store.get(route.getWorkItemKey()).isRetired());
+        assertFalse(f.store.all().stream().anyMatch(s->s.getType()==Type.WAREHOUSE_RECEIPT));
+        assertEquals(result,f.commands.execute(route.getWorkItemKey(),request,ACTOR)); assertEquals(5,f.rows.size());
+        assertThrows(ResponseStatusException.class,()->f.commands.execute(route.getWorkItemKey(),f.command(Command.CONFIRM_ROUTE,1,"switch","{\"flow\":\"TRANSFER\"}"),ACTOR));
+    }
+    @Test void externalHandoffRequiresExplicitAcceptanceAndOrdinaryReplyCannotClearIt() throws Exception {
+        var f=new WorkTestFixture(); var state=f.state("1",Type.EMPTY_RETURN,Flow.DIRECT,null); f.add(state);
+        f.commands.execute(state.getWorkItemKey(),f.command(Command.HANDOFF_RETURN,0,"handoff","{\"recipient\":{\"kind\":\"EXTERNAL\",\"id\":null,\"name\":\"新车队\"},\"reason\":\"原承运另有任务\"}"),ACTOR);
+        f.commands.execute(state.getWorkItemKey(),f.command(Command.SAVE_FOLLOWUP,1,"reply","{\"ownerId\":\"1\",\"followupDate\":null,\"note\":\"等待新车队回复\"}"),ACTOR);
+        assertTrue(pendingHandoff(f.store.get(state.getWorkItemKey())));
+        assertThrows(ResponseStatusException.class,()->f.commands.execute(state.getWorkItemKey(),f.command(Command.ACCEPT_RETURN,2,"empty","{\"handoffVersion\":1,\"note\":\"\"}"),ACTOR));
+        var accepted=f.commands.execute(state.getWorkItemKey(),f.command(Command.ACCEPT_RETURN,2,"accept","{\"handoffVersion\":1,\"note\":\"已电话确认接手，联系人张先生\"}"),ACTOR);
+        assertEquals(HandoffStatus.ACCEPTED,f.store.get(state.getWorkItemKey()).getReturnHandoff().status());
+        assertEquals(ExecutionStatus.PENDING,accepted.item().executionStatus()); assertNull(accepted.item().actual());
+        assertEquals("1",f.history.get(f.history.size()-1).getOperatorId());
+    }
+    @Test void firstRequirementDoesNotReviewDownstreamButRealRescheduleDoes() throws Exception {
+        var f=new WorkTestFixture(); var receipt=f.state("1",Type.WAREHOUSE_RECEIPT,Flow.TRANSFER,null); f.add(receipt);
+        var delivery=f.state("1",Type.DELIVERY,Flow.TRANSFER,"r1"); delivery.setPrerequisites(List.of(receipt.getWorkItemKey())); delivery.setTarget(slot("2026-10-17")); f.add(delivery);
+        var payload="{\"target\":{\"date\":\"2026-10-15\",\"startTime\":null,\"endDate\":null,\"endTime\":null,\"timezone\":\"America/Los_Angeles\"},\"bookingRequired\":true,\"receivingRequirements\":\"先接仓\",\"reason\":\"首次目标\"}";
+        f.commands.execute(receipt.getWorkItemKey(),f.command(Command.SAVE_REQUIREMENT,0,"first",payload),ACTOR);
+        assertFalse(f.store.get(delivery.getWorkItemKey()).isReviewRequired());
+        f.commands.execute(receipt.getWorkItemKey(),f.command(Command.SAVE_REQUIREMENT,1,"second",payload.replace("2026-10-15","2026-10-18").replace("首次目标","改期")),ACTOR);
+        assertTrue(f.store.get(delivery.getWorkItemKey()).isReviewRequired()); assertEquals(1,f.store.get(delivery.getWorkItemKey()).getReviewVersion());
+        assertThrows(ResponseStatusException.class,()->f.commands.execute(delivery.getWorkItemKey(),f.command(Command.RESOLVE_REVIEW,1,"old","{\"reviewVersion\":0,\"note\":\"旧影响\"}"),ACTOR));
+        var resolved=f.commands.execute(delivery.getWorkItemKey(),f.command(Command.RESOLVE_REVIEW,1,"review","{\"reviewVersion\":1,\"note\":\"已核对安排\"}"),ACTOR);
+        assertFalse(resolved.item().reviewRequired()); assertFalse(f.store.get(receipt.getWorkItemKey()).isReviewRequired());
+    }
+    @Test void unsupportedPayloadAndReadOnlyActorCannotWrite() throws Exception {
+        var f=new WorkTestFixture(); var state=f.state("1",Type.ROUTE,Flow.UNKNOWN,null); f.add(state);
+        var readonly=new Actor("1","只读",Set.of(LIST,ORDER_READ));
+        var request=f.command(Command.SAVE_FOLLOWUP,0,"one","{\"ownerId\":\"1\",\"followupDate\":null,\"note\":\"回复\"}");
+        assertEquals(403,assertThrows(ResponseStatusException.class,()->f.commands.execute(state.getWorkItemKey(),request,readonly)).getStatusCode().value());
+        var invalid=f.command(Command.SAVE_FOLLOWUP,0,"two","{\"ownerId\":\"1\",\"followupDate\":null,\"note\":\"回复\",\"executionStatus\":\"COMPLETED\"}");
+        assertEquals(400,assertThrows(ResponseStatusException.class,()->f.commands.execute(state.getWorkItemKey(),invalid,ACTOR)).getStatusCode().value());
+        assertEquals(0,f.store.get(state.getWorkItemKey()).getVersion()); assertTrue(f.history.isEmpty());
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkCommitmentServiceTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkCommitmentServiceTest.java
new file mode 100644
index 000000000..2f2838cc0
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkCommitmentServiceTest.java
@@ -0,0 +1,20 @@
+package com.baiyue.lastleg.appointmentwork;
+
+import org.junit.jupiter.api.Test;
+import static org.junit.jupiter.api.Assertions.*;
+import static com.baiyue.lastleg.appointmentwork.AppointmentWorkCommitmentService.*;
+import static com.baiyue.lastleg.appointmentwork.WorkTestFixture.slot;
+
+class AppointmentWorkCommitmentServiceTest {
+    @Test void firstTargetSameDayConfirmationAndFirstAssignmentAreNotImpacts() {
+        var empty=new Commitment(null,null,null,"cargo",false);
+        var planned=new Commitment(slot("2026-10-16"),null,null,"cargo",false);
+        var confirmed=new Commitment(planned.target(),slot("2026-10-16"),"vehicle-1","cargo",false);
+        assertFalse(impacts(empty,planned)); assertFalse(impacts(planned,confirmed));
+        assertFalse(impacts(planned,new Commitment(null,confirmed.confirmed(),null,"cargo",false)));
+        assertTrue(impacts(planned,new Commitment(planned.target(),slot("2026-10-17"),null,"cargo",false)));
+        assertTrue(impacts(confirmed,new Commitment(confirmed.target(),confirmed.confirmed(),"vehicle-2","cargo",false)));
+        assertTrue(impacts(confirmed,new Commitment(confirmed.target(),confirmed.confirmed(),confirmed.assignment(),"changed",false)));
+        assertTrue(impacts(confirmed,new Commitment(null,null,null,"cargo",true)));
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkContractTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkContractTest.java
new file mode 100644
index 000000000..cf2fd5a83
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkContractTest.java
@@ -0,0 +1,36 @@
+package com.baiyue.lastleg.appointmentwork;
+
+import com.fasterxml.jackson.databind.ObjectMapper;
+import org.junit.jupiter.api.Test;
+import org.yaml.snakeyaml.Yaml;
+import java.time.*;
+import java.util.*;
+import static org.junit.jupiter.api.Assertions.*;
+import static com.baiyue.lastleg.appointmentwork.AppointmentWorkModels.*;
+
+class AppointmentWorkContractTest {
+    @Test void actionTargetsSerializeWithDiscriminatorAndSlotsNeverInventSeconds() throws Exception {
+        var json=new ObjectMapper().findAndRegisterModules();
+        var action=new Action(ActionCode.VERIFY_CARGO,"核实资料","work-1",new CargoTarget(new SourceReference("12","ORDER:1","FBA:2")));
+        var tree=json.readTree(json.writeValueAsString(action));
+        assertEquals("CARGO_VERIFICATION",tree.path("target").path("kind").asText());
+        assertEquals("12",tree.path("target").path("source").path("customerId").asText());
+        assertEquals(action,json.treeToValue(tree,Action.class));
+        var slot=new Slot(LocalDate.of(2026,10,15),LocalTime.of(10,30),null,null,"America/Los_Angeles");
+        assertEquals("10:30",json.readTree(json.writeValueAsString(slot)).path("startTime").asText());
+        var precise=new Slot(slot.date(),LocalTime.of(10,30,45,123000000),null,null,null);
+        assertEquals("10:30:45.123",json.readTree(json.writeValueAsString(precise)).path("startTime").asText());
+        assertEquals(precise,json.readValue(json.writeValueAsString(precise),Slot.class));
+        assertDoesNotThrow(()->AppointmentWorkPolicy.validateSourceSlot(precise));
+        assertThrows(org.springframework.web.server.ResponseStatusException.class,()->AppointmentWorkPolicy.validateSlot(precise));
+    }
+    @Test void openApiDefinesFrozenPathsAndDiscriminatedCommands() throws Exception {
+        var options=new org.yaml.snakeyaml.LoaderOptions();options.setAllowDuplicateKeys(false);
+        Map<String,Object> root; try(var input=getClass().getResourceAsStream("/openapi/appointment-work-v1.yaml")) { assertNotNull(input); root=new Yaml(new org.yaml.snakeyaml.constructor.SafeConstructor(options)).load(input); }
+        var paths=(Map<?,?>)root.get("paths"); var prefix="/api/platform/v1/last-leg/appointment-work";
+        for(var path:List.of("/calendar","/summary","/items","/items/resolve","/items/{workItemKey}","/items/{workItemKey}/commands")) assertTrue(paths.containsKey(prefix+path));
+        var schemas=(Map<?,?>)((Map<?,?>)root.get("components")).get("schemas");
+        var command=(Map<?,?>)schemas.get("CommandRequest"); assertEquals(6,((List<?>)command.get("oneOf")).size());
+        var item=(Map<?,?>)((Map<?,?>)schemas.get("WorkItem")).get("properties"); assertTrue(item.containsKey("containers")); assertFalse(item.containsKey("containerBookingId"));
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkDirectTransportProviderTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkDirectTransportProviderTest.java
new file mode 100644
index 000000000..6e9b2bf10
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkDirectTransportProviderTest.java
@@ -0,0 +1,28 @@
+package com.baiyue.lastleg.appointmentwork;
+
+import com.baiyue.common.core.api.ApiResponse;
+import org.junit.jupiter.api.Test;
+import java.time.LocalDateTime;
+import java.util.List;
+import static com.baiyue.lastleg.appointmentwork.AppointmentWorkFactGateway.*;
+import static com.baiyue.lastleg.appointmentwork.AppointmentWorkModels.*;
+import static org.junit.jupiter.api.Assertions.*;
+import static org.mockito.ArgumentMatchers.*;
+import static org.mockito.Mockito.*;
+
+class AppointmentWorkDirectTransportProviderTest {
+    @Test void pickupStartsDirectTransportButOnlyOriginalDestinationUnloadingCompletesIt() {
+        var client=mock(AppointmentWorkFirstlegClient.class);var provider=new AppointmentWorkDirectTransportProvider(client,"internal-test");
+        var request=new FactRequest("W",Type.TRANSPORT,Flow.DIRECT,"1","INBOUND:1",null,null,List.of(),List.of(),List.of());
+        var time=LocalDateTime.parse("2026-10-15T11:00:00");
+        var pickup=fact("W/carrier",ExecutionStatus.COMPLETED,new Actual(null,time,null));
+        when(client.facts(eq("internal-test"),anyList())).thenReturn(ApiResponse.success(List.of(pickup,fact("W/delivery",ExecutionStatus.PENDING,null))));
+        var moving=provider.read(List.of(request)).get(0);assertEquals(ExecutionStatus.IN_PROGRESS,moving.executionStatus());assertNull(moving.actual());assertNull(moving.tripKey());
+        when(client.facts(eq("internal-test"),anyList())).thenReturn(ApiResponse.success(List.of(pickup,fact("W/delivery",ExecutionStatus.COMPLETED,new Actual(null,time.plusHours(2),null)))));
+        var done=provider.read(List.of(request)).get(0);assertEquals(ExecutionStatus.COMPLETED,done.executionStatus());assertEquals(time.plusHours(2),done.actual().localOccurredAt());
+        assertFalse(provider.supports(Type.TRANSPORT,Flow.TRANSFER));
+    }
+    private Fact fact(String key,ExecutionStatus execution,Actual actual) {
+        return new Fact(key,"v1","impact",false,PlanStatus.UNPLANNED,execution,null,null,actual,null,"CNT1",null,List.of(AppointmentWorkPolicy.ORDER_READ),List.of(),null,List.of(),List.of("SOURCE_TIMEZONE"),List.of(),null,null);
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkFactAdapterTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkFactAdapterTest.java
new file mode 100644
index 000000000..5872e4ec5
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkFactAdapterTest.java
@@ -0,0 +1,25 @@
+package com.baiyue.lastleg.appointmentwork;
+
+import org.junit.jupiter.api.Test;
+import org.springframework.web.server.ResponseStatusException;
+import java.util.*;
+import static org.junit.jupiter.api.Assertions.*;
+import static com.baiyue.lastleg.appointmentwork.AppointmentWorkModels.*;
+import static com.baiyue.lastleg.appointmentwork.AppointmentWorkFactGateway.*;
+import static com.baiyue.lastleg.appointmentwork.WorkTestFixture.*;
+
+class AppointmentWorkFactAdapterTest {
+    @Test void incompleteAndDuplicateAuthorityResultsAreFailuresNotEmptySuccess() {
+        var f=new WorkTestFixture(); var state=f.state("1",Type.EMPTY_RETURN,Flow.DIRECT,null);
+        var request=new FactRequest(state.getWorkItemKey(),state.getType(),state.getFlow(),"1",null,null,null,List.of(),state.getContainers(),List.of());
+        assertThrows(ResponseStatusException.class,()->AppointmentWorkFactAdapter.append(new HashMap<>(),List.of(request),List.of()));
+        assertThrows(ResponseStatusException.class,()->AppointmentWorkFactAdapter.append(new HashMap<>(),List.of(request),null));
+        var target=new HashMap<String,Fact>(); AppointmentWorkFactAdapter.append(target,List.of(request),List.of(fact(state,null,null,ExecutionStatus.PENDING,null)));
+        assertThrows(ResponseStatusException.class,()->AppointmentWorkFactAdapter.append(target,List.of(request),List.of(fact(state,null,null,ExecutionStatus.PENDING,null))));
+    }
+    @Test void completedFactRequiresActualEvidence() {
+        var f=new WorkTestFixture(); var state=f.state("1",Type.EMPTY_RETURN,Flow.DIRECT,null);
+        var request=new FactRequest(state.getWorkItemKey(),state.getType(),state.getFlow(),"1",null,null,null,List.of(),state.getContainers(),List.of());
+        assertThrows(ResponseStatusException.class,()->AppointmentWorkFactAdapter.append(new HashMap<>(),List.of(request),List.of(fact(state,null,null,ExecutionStatus.COMPLETED,null))));
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkFollowupInheritanceTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkFollowupInheritanceTest.java
new file mode 100644
index 000000000..5247fa0fa
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkFollowupInheritanceTest.java
@@ -0,0 +1,71 @@
+package com.baiyue.lastleg.appointmentwork;
+
+import org.junit.jupiter.api.Test;
+import java.time.*;
+import java.util.*;
+import static org.junit.jupiter.api.Assertions.*;
+import static org.mockito.Mockito.*;
+import static com.baiyue.lastleg.appointmentwork.AppointmentWorkModels.*;
+import static com.baiyue.lastleg.appointmentwork.AppointmentWorkFactGateway.*;
+import static com.baiyue.lastleg.appointmentwork.AppointmentWorkPolicy.*;
+import static com.baiyue.lastleg.appointmentwork.AppointmentWorkFollowupInheritance.*;
+
+class AppointmentWorkFollowupInheritanceTest {
+    @Test void repartitionSupportsTwentyBatchesWithOneHundredCustomerSources() {
+        var f=new WorkTestFixture();var service=new AppointmentWorkFollowupInheritance(f.store,mock(OwnerDirectory.class));
+        var originals=new ArrayList<Member>();var successors=new ArrayList<Member>();
+        for(int batch=1;batch<=20;batch++) for(int customer=1;customer<=100;customer++) {
+            originals.add(new Member("FBA_APPOINTMENT:"+batch,"C"+customer));
+            successors.add(new Member("FBA_APPOINTMENT:"+(batch+20),"C"+customer));
+        }
+        assertDoesNotThrow(()->service.inherit(originals,successors,"operator"));
+        successors.add(new Member("FBA_APPOINTMENT:41","C1"));
+        assertThrows(org.springframework.web.server.ResponseStatusException.class,()->service.inherit(originals,successors,"operator"));
+    }
+    @Test void missingFollowupDateStaysMissingAndMergeCannotSilentlyDiscardAnUnassignedSource() {
+        var f=new WorkTestFixture();var directory=mock(OwnerDirectory.class);when(directory.activePlatformOwner("17")).thenReturn(new Owner("17","负责人"));
+        var service=new AppointmentWorkFollowupInheritance(f.store,directory);var source=new Member("FBA_APPOINTMENT:1","B");var later=new Member("FBA_APPOINTMENT:2","B");
+        var followup=service.resolve("17",null);service.seed(source,later,followup,"operator");generate(f,later);
+        var state=f.store.get(workKey(later));assertNull(state.getFollowupDate());assertEquals("17",state.getOwner().id());
+        var item=project(state,WorkTestFixture.fact(state,null,null,ExecutionStatus.PENDING,null),WorkTestFixture.ACTOR,WorkTestFixture.CLOCK);
+        assertTrue(item.missingFields().contains("下次跟进日期待安排"));
+        var unassigned=new Member("FBA_APPOINTMENT:3","B");
+        var empty=f.state("1",Type.DELIVERY,Flow.TRANSFER,"empty");empty.setWorkItemKey(workKey(unassigned));f.add(empty);
+        assertThrows(org.springframework.web.server.ResponseStatusException.class,()->service.inherit(List.of(later,unassigned),List.of(new Member("FBA_APPOINTMENT:4","B")),"operator"));
+    }
+    @Test void appliedFollowupSurvivesBeforeDiscoveryAndLaterRepartitionUsesLatestSavedWork() {
+        var f=new WorkTestFixture();var directory=mock(OwnerDirectory.class);
+        when(directory.activePlatformOwner("17")).thenReturn(new Owner("17","真实平台负责人"));
+        var service=new AppointmentWorkFollowupInheritance(f.store,directory);
+        var original=new Member("FBA_APPOINTMENT:1","B");var later=new Member("FBA_APPOINTMENT:2","B");
+        var date=LocalDate.of(2026,10,22);var followup=service.resolve("17",date);
+        service.seed(original,later,followup,"operator");
+        assertTrue(f.store.all().isEmpty()); // An audit seed does not invent a sailed source or physical batch.
+        var forty=new Member("FBA_APPOINTMENT:3","B");var twenty=new Member("FBA_APPOINTMENT:4","B");
+        service.inherit(List.of(later),List.of(forty,twenty),"operator");
+        assertEquals(followup,f.store.inheritedFollowup(workKey(forty)));assertEquals(followup,f.store.inheritedFollowup(workKey(twenty)));
+        generate(f,forty);var state=f.store.get(workKey(forty));
+        assertEquals(new Owner("17","真实平台负责人"),state.getOwner());assertEquals(date,state.getFollowupDate());
+        state.setOwner(new Owner("18","新负责人"));state.setFollowupDate(date.plusDays(1));f.store.save(state);
+        var next=new Member("FBA_APPOINTMENT:5","B");service.inherit(List.of(forty),List.of(next),"operator");generate(f,next);
+        assertEquals(state.getOwner(),f.store.get(workKey(next)).getOwner());assertEquals(date.plusDays(1),f.store.get(workKey(next)).getFollowupDate());
+        verify(directory).activePlatformOwner("17");
+    }
+    @Test void freeTextOwnerCannotBecomeAnAccountAndConflictingMergeDoesNotChooseFirst() {
+        var f=new WorkTestFixture();var directory=mock(OwnerDirectory.class);var service=new AppointmentWorkFollowupInheritance(f.store,directory);
+        assertThrows(org.springframework.web.server.ResponseStatusException.class,()->service.resolve("客服张三",LocalDate.now()));
+        when(directory.activePlatformOwner("1")).thenReturn(new Owner("2","不匹配"));
+        assertThrows(org.springframework.web.server.ResponseStatusException.class,()->service.resolve("1",LocalDate.now()));
+        var first=new Member("FBA_APPOINTMENT:2","B");var second=new Member("FBA_APPOINTMENT:3","B");var merged=new Member("FBA_APPOINTMENT:4","B");
+        service.seed(new Member("FBA_APPOINTMENT:1","B"),first,new AppointmentWorkStore.Followup(new Owner("1","甲"),LocalDate.of(2026,10,20)),"operator");
+        service.seed(new Member("FBA_APPOINTMENT:1","B"),second,new AppointmentWorkStore.Followup(new Owner("2","乙"),LocalDate.of(2026,10,21)),"operator");
+        assertThrows(org.springframework.web.server.ResponseStatusException.class,()->service.inherit(List.of(first,second),List.of(merged),"operator"));
+        assertNull(f.store.inheritedFollowup(workKey(merged)));
+    }
+    private static String workKey(Member m) {return key("BATCH:"+m.batchKey(),Type.DELIVERY,customerRequirement(m.batchKey(),m.customerId()));}
+    private static void generate(WorkTestFixture f,Member member) {
+        var requirement=new Requirement(customerRequirement(member.batchKey(),member.customerId()),member.batchKey(),"AP","FBA","仓","ONT8",null,List.of(),List.of(),List.of(new SourceReference(member.customerId(),"ORDER:2","FBA:ONT8")));
+        var source=new ContainerSource("1","柜",null,LocalDateTime.of(2026,10,1,12,0),null,"v1",Flow.TRANSFER,null,List.of(requirement));
+        f.sync.generate(source,Flow.TRANSFER,List.of(),WorkTestFixture.ACTOR);
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkPersistenceTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkPersistenceTest.java
new file mode 100644
index 000000000..962bf0032
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkPersistenceTest.java
@@ -0,0 +1,169 @@
+package com.baiyue.lastleg.appointmentwork;
+
+import com.baomidou.mybatisplus.core.MybatisConfiguration;
+import com.baomidou.mybatisplus.core.MybatisSqlSessionFactoryBuilder;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import org.apache.ibatis.mapping.Environment;
+import org.apache.ibatis.transaction.jdbc.JdbcTransactionFactory;
+import org.h2.jdbcx.JdbcDataSource;
+import org.junit.jupiter.api.Test;
+import java.nio.charset.StandardCharsets;
+import java.sql.Connection;
+import java.time.*;
+import java.util.*;
+import static com.baiyue.lastleg.inboundplan.receiving.FbaReceivingContracts.*;
+import static org.mockito.Mockito.*;
+import static org.junit.jupiter.api.Assertions.*;
+import static com.baiyue.lastleg.appointmentwork.AppointmentWorkModels.*;
+import static com.baiyue.lastleg.appointmentwork.WorkTestFixture.*;
+
+class AppointmentWorkPersistenceTest {
+    @Test void independentCustomerPlanChangesOnlyItsPersistedSemanticImpact() throws Exception {
+        var config=new MybatisConfiguration();config.setMapUnderscoreToCamelCase(true);
+        config.setEnvironment(new Environment("test",new JdbcTransactionFactory(),database()));config.addMapper(AppointmentWorkMapper.class);
+        try(var session=new MybatisSqlSessionFactoryBuilder().build(config).openSession(true)) {
+            var mapper=session.getMapper(AppointmentWorkMapper.class);var json=new ObjectMapper().findAndRegisterModules();
+            var commitments=new AppointmentWorkCommitmentService(mapper,json);
+            var receiving=mock(com.baiyue.lastleg.inboundplan.receiving.FbaReceivingStore.class);
+            var changes=new com.baiyue.lastleg.inboundplan.work.AppointmentWorkAppointmentChanges(commitments,mock(AppointmentWorkChanges.class),receiving);
+            String key="FBA_APPOINTMENT:1",zone="America/Los_Angeles";
+            var batch=mock(com.baiyue.lastleg.inboundplan.dto.FbaAppointmentResponse.class);
+            when(batch.batchKey()).thenReturn(key);when(batch.appointmentStatus()).thenReturn("SUCCESS");when(batch.plannedDate()).thenReturn(LocalDate.of(2026,10,19));
+            var items=List.of("A","B","D").stream().map(customer->{
+                var item=mock(com.baiyue.lastleg.inboundplan.dto.FbaAppointmentResponse.Item.class);
+                when(item.customerId()).thenReturn(customer);when(item.sourceKey()).thenReturn("ORDER:1");when(item.destinationKey()).thenReturn("FBA:ONT8");when(item.packageCount()).thenReturn(100);return item;
+            }).toList();when(batch.items()).thenReturn(items);
+            var agreement=new Agreement("RA-A",1,"ACTIVE","FBA:ONT8",new com.baiyue.lastleg.inboundplan.dto.FbaAppointmentDetails(null,null,null,"CONF-A",LocalDateTime.of(2026,10,20,10,0),null,"SUCCESS",null,null,null),zone,List.of(new Member(key,"AP-1",1,"A",List.of(),null)),"正式确认");
+            var plan=new java.util.concurrent.atomic.AtomicReference<>(new CustomerPlan(key,"B",customerPlanDetails(LocalDate.of(2026,10,21),"PENDING",null),zone));
+            when(receiving.snapshots(List.of(key))).thenAnswer(call->List.of(new BatchReceiving(key,List.of(agreement),List.of(),List.of(plan.get()))));
+            changes.changed(batch);
+            var beforeA=mapper.commitment(key+"|CUSTOMER:A").getStateJson();var beforeD=mapper.commitment(key+"|CUSTOMER:D").getStateJson();
+            plan.set(new CustomerPlan(key,"B",customerPlanDetails(LocalDate.of(2026,10,22),"FAILED","未约成"),zone));changes.changed(batch);
+            assertEquals(key+"|CUSTOMER:B:1",commitments.impactToken(key+"|CUSTOMER:B"));
+            changes.changed(batch);assertEquals(key+"|CUSTOMER:B:1",commitments.impactToken(key+"|CUSTOMER:B"));
+            plan.set(new CustomerPlan(key,"B",customerPlanDetails(LocalDate.of(2026,10,22),"PENDING","继续联系"),zone));changes.changed(batch);
+            assertEquals(key+"|CUSTOMER:B:1",commitments.impactToken(key+"|CUSTOMER:B")); // Status/notes do not invent a changed promised date.
+            plan.set(new CustomerPlan(key,"B",customerPlanDetails(null,"PENDING",null),zone));changes.changed(batch);changes.changed(batch);
+            assertEquals(key+"|CUSTOMER:B:2",commitments.impactToken(key+"|CUSTOMER:B"));
+            assertNull(json.readValue(mapper.commitment(key+"|CUSTOMER:B").getStateJson(),AppointmentWorkCommitmentService.Commitment.class).target());
+            assertEquals(key+"|CUSTOMER:A:0",commitments.impactToken(key+"|CUSTOMER:A"));assertEquals(beforeA,mapper.commitment(key+"|CUSTOMER:A").getStateJson());
+            assertEquals(key+"|CUSTOMER:D:0",commitments.impactToken(key+"|CUSTOMER:D"));assertEquals(beforeD,mapper.commitment(key+"|CUSTOMER:D").getStateJson());
+        }
+    }
+    private static com.baiyue.lastleg.inboundplan.dto.FbaAppointmentDetails customerPlanDetails(LocalDate date,String status,String remark) {
+        return new com.baiyue.lastleg.inboundplan.dto.FbaAppointmentDetails(date,null,null,null,null,null,status,remark,null,null);
+    }
+    @Test void followupPortPersistsFutureSeedAndRollsBackWithOriginalTransaction() throws Exception {
+        var ds=database();var jdbc=new org.springframework.jdbc.core.JdbcTemplate(ds);
+        jdbc.execute("CREATE TABLE core_probe(id INT PRIMARY KEY,quantity INT)");jdbc.update("INSERT INTO core_probe VALUES(1,160)");
+        var configuration=new MybatisConfiguration();configuration.setMapUnderscoreToCamelCase(true);configuration.addMapper(AppointmentWorkMapper.class);
+        var factory=new com.baomidou.mybatisplus.extension.spring.MybatisSqlSessionFactoryBean();factory.setDataSource(ds);factory.setConfiguration(configuration);
+        var session=new org.mybatis.spring.SqlSessionTemplate(factory.getObject());var json=new ObjectMapper().findAndRegisterModules();
+        var store=new AppointmentWorkStore(session.getMapper(AppointmentWorkMapper.class),json);
+        var directory=org.mockito.Mockito.mock(AppointmentWorkFactGateway.OwnerDirectory.class);
+        org.mockito.Mockito.when(directory.activePlatformOwner("17")).thenReturn(new Owner("17","平台负责人"));
+        var manager=new org.springframework.jdbc.datasource.DataSourceTransactionManager(ds);
+        var proxy=new org.springframework.aop.framework.ProxyFactory(new AppointmentWorkFollowupInheritance(store,directory));proxy.setProxyTargetClass(true);
+        proxy.addAdvice(new org.springframework.transaction.interceptor.TransactionInterceptor(manager,new org.springframework.transaction.annotation.AnnotationTransactionAttributeSource()));
+        var port=new com.baiyue.lastleg.inboundplan.work.FbaAppointmentWorkAdapter((AppointmentWorkFollowupInheritance)proxy.getProxy());
+        var original=new com.baiyue.lastleg.inboundplan.receiving.FbaAppointmentWorkPort.Member("FBA_APPOINTMENT:1","B");
+        var later=new com.baiyue.lastleg.inboundplan.receiving.FbaAppointmentWorkPort.Member("FBA_APPOINTMENT:2","B");
+        var followup=port.resolveFollowup("17",LocalDate.of(2026,10,22));
+        var key=AppointmentWorkPolicy.key("BATCH:"+later.batchKey(),Type.DELIVERY,AppointmentWorkPolicy.customerRequirement(later.batchKey(),later.customerId()));
+        var tx=new org.springframework.transaction.support.TransactionTemplate(manager);
+        assertThrows(IllegalStateException.class,()->tx.executeWithoutResult(status->{jdbc.update("UPDATE core_probe SET quantity=100 WHERE id=1");port.seedFollowup(original,later,followup,"operator");throw new IllegalStateException("后续原域命令失败");}));
+        assertNull(store.inheritedFollowup(key));assertEquals(160,jdbc.queryForObject("SELECT quantity FROM core_probe WHERE id=1",Integer.class));
+        tx.executeWithoutResult(status->port.seedFollowup(original,later,followup,"operator"));
+        var persisted=new AppointmentWorkStore(session.getMapper(AppointmentWorkMapper.class),json).inheritedFollowup(key);
+        assertEquals(new Owner("17","平台负责人"),persisted.owner());assertEquals(followup.nextFollowupDate(),persisted.nextFollowupDate());
+        var requirement=new AppointmentWorkFactGateway.Requirement(AppointmentWorkPolicy.customerRequirement(later.batchKey(),"B"),later.batchKey(),"AP-2","FBA","海外仓","ONT8",null,List.of(),List.of(),List.of(new SourceReference("B","ORDER:2","FBA:ONT8")));
+        var source=new AppointmentWorkFactGateway.ContainerSource("1","CNT",null,LocalDateTime.of(2026,10,1,12,0),null,"v1",Flow.TRANSFER,null,List.of(requirement));
+        var facts=org.mockito.Mockito.mock(AppointmentWorkFactGateway.class);
+        org.mockito.Mockito.when(facts.requirements(source,Flow.TRANSFER)).thenReturn(List.of(requirement));
+        tx.executeWithoutResult(status->new AppointmentWorkSyncService(store,facts).generate(source,Flow.TRANSFER,List.of(),ACTOR));
+        assertEquals(persisted.owner(),store.get(key).getOwner());assertEquals(persisted.nextFollowupDate(),store.get(key).getFollowupDate());
+        var third=new com.baiyue.lastleg.inboundplan.receiving.FbaAppointmentWorkPort.Member("FBA_APPOINTMENT:3","B");
+        tx.executeWithoutResult(status->port.seedFollowup(original,third,new com.baiyue.lastleg.inboundplan.receiving.FbaAppointmentWorkPort.Followup("17","平台负责人",null),"operator"));
+        var thirdKey=AppointmentWorkPolicy.key("BATCH:"+third.batchKey(),Type.DELIVERY,AppointmentWorkPolicy.customerRequirement(third.batchKey(),"B"));
+        assertNull(store.inheritedFollowup(thirdKey).nextFollowupDate());
+        org.mockito.Mockito.verify(directory).activePlatformOwner("17"); // Seeding trusted core output never repeats IAM under cargo locks.
+    }
+    @Test void failedBookingPersistsTargetAndClearsConfirmationWhileCancellationClearsBoth() throws Exception {
+        var config=new MybatisConfiguration();config.setMapUnderscoreToCamelCase(true);
+        config.setEnvironment(new Environment("test",new JdbcTransactionFactory(),database()));config.addMapper(AppointmentWorkMapper.class);
+        try(var session=new MybatisSqlSessionFactoryBuilder().build(config).openSession(true)) {
+            var mapper=session.getMapper(AppointmentWorkMapper.class);var json=new ObjectMapper().findAndRegisterModules();
+            var commitments=new AppointmentWorkCommitmentService(mapper,json);
+            var receiving=org.mockito.Mockito.mock(com.baiyue.lastleg.inboundplan.receiving.FbaReceivingStore.class);
+            var changes=new com.baiyue.lastleg.inboundplan.work.AppointmentWorkAppointmentChanges(commitments,org.mockito.Mockito.mock(AppointmentWorkChanges.class),receiving);
+            var appointment=org.mockito.Mockito.mock(com.baiyue.lastleg.inboundplan.dto.FbaAppointmentResponse.class);
+            var groupRevision=new java.util.concurrent.atomic.AtomicInteger(1);
+            var item=org.mockito.Mockito.mock(com.baiyue.lastleg.inboundplan.dto.FbaAppointmentResponse.Item.class);
+            org.mockito.Mockito.when(item.customerId()).thenReturn("C");org.mockito.Mockito.when(item.sourceKey()).thenReturn("ORDER:1");
+            org.mockito.Mockito.when(appointment.items()).thenReturn(List.of(item));
+            org.mockito.Mockito.when(receiving.snapshots(List.of("FBA_APPOINTMENT:1"))).thenAnswer(call->{
+                var details=new com.baiyue.lastleg.inboundplan.dto.FbaAppointmentDetails(appointment.plannedDate(),null,null,"CONF",appointment.appointmentAt(),null,"SUCCESS",null,null,null);
+                var member=new com.baiyue.lastleg.inboundplan.receiving.FbaReceivingContracts.Member(appointment.batchKey(),"AP-1",0,"C",List.of(),null);
+                var group=new com.baiyue.lastleg.inboundplan.receiving.FbaReceivingContracts.Agreement("RA-1",groupRevision.get(),"ACTIVE","FBA:ONT8",details,appointment.timezone(),List.of(member),"confirmed");
+                return List.of(new com.baiyue.lastleg.inboundplan.receiving.FbaReceivingContracts.BatchReceiving(appointment.batchKey(),"SUCCESS".equals(appointment.appointmentStatus())?List.of(group):List.of(),List.of(),List.of()));
+            });
+            org.mockito.Mockito.when(appointment.batchKey()).thenReturn("FBA_APPOINTMENT:1");
+            org.mockito.Mockito.when(appointment.plannedDate()).thenReturn(LocalDate.of(2026,10,18));
+            org.mockito.Mockito.when(appointment.timezone()).thenReturn("America/Los_Angeles");
+            org.mockito.Mockito.when(appointment.appointmentAt()).thenReturn(LocalDateTime.of(2026,10,18,10,0));
+            org.mockito.Mockito.when(appointment.appointmentStatus()).thenReturn("SUCCESS");changes.changed(appointment);
+            groupRevision.set(8);changes.changed(appointment);
+            assertEquals("FBA_APPOINTMENT:1|CUSTOMER:C:0",commitments.impactToken("FBA_APPOINTMENT:1|CUSTOMER:C"));
+            org.mockito.Mockito.when(appointment.appointmentStatus()).thenReturn("FAILED");changes.changed(appointment);
+            var failed=json.readValue(mapper.commitment("FBA_APPOINTMENT:1|CUSTOMER:C").getStateJson(),AppointmentWorkCommitmentService.Commitment.class);
+            assertEquals(LocalDate.of(2026,10,18),failed.target().date());assertNull(failed.confirmed());assertFalse(failed.cancelled());
+            assertEquals("FBA_APPOINTMENT:1|CUSTOMER:C:1",commitments.impactToken("FBA_APPOINTMENT:1|CUSTOMER:C"));
+            changes.changed(appointment);assertEquals("FBA_APPOINTMENT:1|CUSTOMER:C:1",commitments.impactToken("FBA_APPOINTMENT:1|CUSTOMER:C"));
+            org.mockito.Mockito.when(appointment.appointmentStatus()).thenReturn("CANCELLED");changes.changed(appointment);
+            var cancelled=json.readValue(mapper.commitment("FBA_APPOINTMENT:1|CUSTOMER:C").getStateJson(),AppointmentWorkCommitmentService.Commitment.class);
+            assertNull(cancelled.target());assertNull(cancelled.confirmed());assertTrue(cancelled.cancelled());
+            assertEquals("FBA_APPOINTMENT:1|CUSTOMER:C:2",commitments.impactToken("FBA_APPOINTMENT:1|CUSTOMER:C"));
+        }
+    }
+    @Test void ddlAndMapperEnforceStableIdentityVersionAndGlobalCommandKey() throws Exception {
+        var ds=database();
+        var config=new MybatisConfiguration(); config.setMapUnderscoreToCamelCase(true);
+        config.setEnvironment(new Environment("test",new JdbcTransactionFactory(),ds)); config.addMapper(AppointmentWorkMapper.class);
+        try(var session=new MybatisSqlSessionFactoryBuilder().build(config).openSession(true)) {
+            var mapper=session.getMapper(AppointmentWorkMapper.class); var store=new AppointmentWorkStore(mapper,new ObjectMapper().findAndRegisterModules());
+            assertNotNull(store.lock()); assertThrows(org.springframework.web.server.ResponseStatusException.class,store::requireInitialized);
+            var guard=store.lock(); guard.setInitialized(true); store.checkpoint(guard); assertDoesNotThrow(store::requireInitialized);
+            mapper.invalidateRequirements(); assertThrows(org.springframework.web.server.ResponseStatusException.class,store::requireInitialized);
+            guard=store.lock(); guard.setSynchronizedRequirementVersion(guard.getRequirementVersion()); store.checkpoint(guard); assertDoesNotThrow(store::requireInitialized);
+            var fixture=new WorkTestFixture(); var state=fixture.state("1",Type.EMPTY_RETURN,Flow.DIRECT,null); store.insert(state);
+            assertThrows(RuntimeException.class,()->store.insert(state));
+            var stale=store.get(state.getWorkItemKey()); state.setOwner(new Owner("1","运营甲")); store.save(state);
+            assertEquals(1,store.get(state.getWorkItemKey()).getVersion());
+            assertThrows(org.springframework.web.server.ResponseStatusException.class,()->store.save(stale));
+            store.history(state,ACTOR,"SAVE_FOLLOWUP","等待回复","same-key","hash",Map.of("version",1));
+            assertEquals("运营甲",store.replay(state.getWorkItemKey(),"same-key").getOperatorName());
+            assertThrows(RuntimeException.class,()->store.history(state,new Actor("2","运营乙",ACTOR.permissions()),"SAVE_FOLLOWUP","其他人重复键","same-key","other",Map.of("version",2)));
+            assertEquals(1,store.history(state.getWorkItemKey()).size());
+            mapper.insertCommitment("FBA_APPOINTMENT:1","{}");mapper.updateCommitment("FBA_APPOINTMENT:1","{}",3);
+            var tokens=new AppointmentWorkCommitmentService(mapper,new ObjectMapper()).impactTokens(List.of("FBA_APPOINTMENT:1","FBA_APPOINTMENT:2"));
+            assertEquals(Map.of("FBA_APPOINTMENT:1","FBA_APPOINTMENT:1:3","FBA_APPOINTMENT:2","FBA_APPOINTMENT:2:0"),tokens);
+        }
+    }
+    @Test void transactionRollbackCannotLeaveHalfGeneratedRoute() throws Exception {
+        var ds=database(); var config=new MybatisConfiguration(); config.setMapUnderscoreToCamelCase(true);
+        config.setEnvironment(new Environment("test",new JdbcTransactionFactory(),ds)); config.addMapper(AppointmentWorkMapper.class);
+        var factory=new MybatisSqlSessionFactoryBuilder().build(config);
+        try(var session=factory.openSession(false)) {
+            var store=new AppointmentWorkStore(session.getMapper(AppointmentWorkMapper.class),new ObjectMapper().findAndRegisterModules());
+            var state=new WorkTestFixture().state("1",Type.PICKUP,Flow.TRANSFER,null); store.insert(state);
+            store.history(state,ACTOR,"GENERATED","路线生成",null,null,null); session.rollback();
+        }
+        try(var session=factory.openSession(true)) { assertTrue(session.getMapper(AppointmentWorkMapper.class).all(10).isEmpty()); }
+    }
+    private JdbcDataSource database() throws Exception {
+        var ds=new JdbcDataSource(); ds.setURL("jdbc:h2:mem:work-"+UUID.randomUUID()+";MODE=MySQL;DB_CLOSE_DELAY=-1");
+        String ddl; try(var stream=getClass().getResourceAsStream("/db/appointment-work.sql")) { assertNotNull(stream); ddl=new String(stream.readAllBytes(),StandardCharsets.UTF_8); }
+        try(Connection connection=ds.getConnection(); var statement=connection.createStatement()) { for(var sql:ddl.replaceAll("(?m)^--.*$","").replaceAll(" ENGINE=InnoDB[^;]*;",";").split(";")) if(!sql.isBlank()) statement.execute(sql); }
+        return ds;
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkPolicyTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkPolicyTest.java
new file mode 100644
index 000000000..11bc6de9d
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkPolicyTest.java
@@ -0,0 +1,70 @@
+package com.baiyue.lastleg.appointmentwork;
+
+import org.junit.jupiter.api.Test;
+import org.springframework.web.server.ResponseStatusException;
+import java.time.*;
+import java.util.*;
+import static org.junit.jupiter.api.Assertions.*;
+import static com.baiyue.lastleg.appointmentwork.WorkTestFixture.*;
+import static com.baiyue.lastleg.appointmentwork.AppointmentWorkModels.*;
+import static com.baiyue.lastleg.appointmentwork.AppointmentWorkPolicy.*;
+
+class AppointmentWorkPolicyTest {
+    @Test void originalDeliveryScheduleDoesNotUndoTheRecordedNoBookingRequirement() {
+        var fixture=new WorkTestFixture();var state=fixture.state("1",Type.DELIVERY,Flow.TRANSFER,"DISPATCH:1");state.setDestinationKind("CUSTOMER");state.setBookingRequired(false);
+        var item=project(state,fact(state,null,slot("2026-10-16"),ExecutionStatus.PENDING,null),ACTOR,CLOCK);
+        assertEquals(PlanStatus.NOT_REQUIRED,item.planStatus());assertEquals(LocalDate.of(2026,10,16),item.calendarDate());assertEquals(ExecutionStatus.PENDING,item.executionStatus());
+    }
+    @Test void localActualWithoutTimezoneRemainsCompletedOnItsRecordedDate() {
+        var fixture=new WorkTestFixture(); var state=fixture.state("1",Type.EMPTY_RETURN,Flow.DIRECT,null);
+        var actual=new Actual(null,LocalDateTime.parse("2026-10-12T23:45:00"),null);
+        var item=project(state,fact(state,null,null,ExecutionStatus.COMPLETED,actual),ACTOR,CLOCK);
+        assertEquals(LocalDate.of(2026,10,12),item.calendarDate()); assertEquals(ExecutionStatus.COMPLETED,item.executionStatus());
+        assertNull(item.timezone()); assertTrue(item.missingFields().contains("SOURCE_TIMEZONE"));
+        assertThrows(org.springframework.web.server.ResponseStatusException.class,()->validateActual(new Actual(null,null,null)));
+    }
+    @Test void sourcePlanWithoutTimezoneIsVisibleButNewRequirementRejectsIt() {
+        var source=new Slot(LocalDate.of(2026,10,16),LocalTime.of(10,30),null,null,null);
+        assertDoesNotThrow(()->validateSourceSlot(source)); assertThrows(org.springframework.web.server.ResponseStatusException.class,()->validateSlot(source));
+        var fixture=new WorkTestFixture(); var state=fixture.state("1",Type.PICKUP,Flow.TRANSFER,null);
+        var item=project(state,fact(state,null,source,ExecutionStatus.PENDING,null),ACTOR,CLOCK);
+        assertEquals(source.date(),item.calendarDate()); assertTrue(item.missingFields().contains("SOURCE_TIMEZONE"));
+    }
+    @Test void followupDateNeverBecomesAnAppointmentAndUnknownTimezoneUsesExplicitBusinessClock() {
+        var fixture=new WorkTestFixture(); var state=fixture.state("1",Type.ROUTE,Flow.UNKNOWN,null); state.setTimezone(null); state.setFollowupDate(LocalDate.of(2026,10,14));
+        var item=project(state,null,ACTOR,CLOCK);
+        assertNull(item.calendarDate()); assertEquals(DateBasis.NONE,item.dateBasis()); assertTrue(followToday(item,CLOCK));
+        assertTrue(item.missingFields().stream().anyMatch(s->s.contains("America/Los_Angeles")));
+        assertEquals(ActionCode.CONFIRM_ROUTE,item.nextAction().code());
+    }
+    @Test void actualDateWinsInItsOwnZoneAndBucketsAreExclusive() {
+        var fixture=new WorkTestFixture(); var state=fixture.state("1",Type.DELIVERY,Flow.TRANSFER,"r1"); state.setReviewRequired(true);
+        var actual=new Actual(Instant.parse("2026-10-16T01:00:00Z"),null,"America/Los_Angeles");
+        var fact=fact(state,slot("2026-10-12"),slot("2026-10-13"),ExecutionStatus.COMPLETED,actual);
+        var item=project(state,fact,ACTOR,CLOCK);
+        assertEquals(LocalDate.of(2026,10,15),item.calendarDate()); assertEquals(DateBasis.ACTUAL,item.dateBasis());
+        assertEquals(Bucket.COMPLETED,bucket(item)); assertEquals(new BucketCounts(0,0,0,0,1),counts(List.of(item))); assertTrue(item.overdueReasons().isEmpty());
+        assertEquals(ActionCode.VIEW_HISTORY,item.nextAction().code());
+    }
+    @Test void nonexistentAndAmbiguousLocalTimesAreRejectedButDateOnlyStaysDateOnly() {
+        assertThrows(ResponseStatusException.class,()->validateSlot(new Slot(LocalDate.of(2026,3,8),LocalTime.of(2,30),null,null,"America/Los_Angeles")));
+        assertThrows(ResponseStatusException.class,()->validateSlot(new Slot(LocalDate.of(2026,11,1),LocalTime.of(1,30),null,null,"America/Los_Angeles")));
+        assertDoesNotThrow(()->validateSlot(slot("2026-11-01")));
+        assertThrows(ResponseStatusException.class,()->validateSlot(new Slot(LocalDate.of(2026,10,15),null,null,null,"-08:00")));
+    }
+    @Test void overnightSlotRequiresExplicitEndDateAndValidEndLocalTime() {
+        var day=LocalDate.of(2026,10,15);
+        assertDoesNotThrow(()->validateSlot(new Slot(day,LocalTime.of(23,0),day.plusDays(1),LocalTime.of(1,0),"America/Los_Angeles")));
+        assertThrows(ResponseStatusException.class,()->validateSlot(new Slot(day,LocalTime.of(23,0),null,LocalTime.of(1,0),"America/Los_Angeles")));
+        assertThrows(ResponseStatusException.class,()->validateSlot(new Slot(day,LocalTime.of(23,0),day,LocalTime.of(1,0),"America/Los_Angeles")));
+        assertThrows(ResponseStatusException.class,()->validateSlot(new Slot(day,null,day.plusDays(1),LocalTime.of(1,0),"America/Los_Angeles")));
+        assertThrows(ResponseStatusException.class,()->validateSlot(new Slot(LocalDate.of(2026,3,7),LocalTime.of(23,0),LocalDate.of(2026,3,8),LocalTime.of(2,30),"America/Los_Angeles")));
+    }
+    @Test void pendingAcceptanceSurvivesAnEmptyReminderAndDoesNotGrantExecution() {
+        var fixture=new WorkTestFixture(); var state=fixture.state("1",Type.EMPTY_RETURN,Flow.DIRECT,null);
+        state.setReturnHandoff(new ReturnHandoff(2,new Responsibility(ResponsibilityKind.EXTERNAL,null,"原车队"),new Responsibility(ResponsibilityKind.EXTERNAL,null,"新车队"),HandoffStatus.PENDING_ACCEPTANCE,"原车次结束"));
+        var item=project(state,fact(state,null,null,ExecutionStatus.PENDING,null),ACTOR,CLOCK);
+        assertTrue(followToday(item,CLOCK)); assertEquals(ActionCode.ACCEPT_RETURN,item.nextAction().code());
+        assertEquals(ExecutionStatus.PENDING,item.executionStatus()); assertNull(item.actual());
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkQueryServiceTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkQueryServiceTest.java
new file mode 100644
index 000000000..a0a419b3d
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkQueryServiceTest.java
@@ -0,0 +1,121 @@
+package com.baiyue.lastleg.appointmentwork;
+
+import org.junit.jupiter.api.Test;
+import org.springframework.web.server.ResponseStatusException;
+import java.time.*;
+import java.util.*;
+import static org.junit.jupiter.api.Assertions.*;
+import static org.mockito.Mockito.*;
+import static org.mockito.ArgumentMatchers.*;
+import static com.baiyue.lastleg.appointmentwork.WorkTestFixture.*;
+import static com.baiyue.lastleg.appointmentwork.AppointmentWorkModels.*;
+import static com.baiyue.lastleg.appointmentwork.AppointmentWorkFactGateway.*;
+
+class AppointmentWorkQueryServiceTest {
+    @Test void sameBatchRequiresExplicitCustomerAndNeverChoosesTheFirstCandidate() {
+        var f=new WorkTestFixture();var expected=new HashMap<String,String>();
+        for(var customer:List.of("A","B")) {
+            var state=f.state("1",Type.DELIVERY,Flow.TRANSFER,"batch-"+customer);state.setBatchKey("FBA_APPOINTMENT:1");
+            state.setSources(List.of(new SourceReference(customer,"ORDER:"+customer,"FBA:ONT8")));f.add(state);expected.put(customer,state.getWorkItemKey());
+        }
+        var selection=f.queries.resolveBatch("FBA_APPOINTMENT:1",null,ACTOR);
+        assertNull(selection.detail());assertNull(selection.customerId());assertEquals(List.of("A","B"),selection.candidates().stream().map(BatchWorkCandidate::customerId).toList());
+        var chosen=f.queries.resolveBatch("FBA_APPOINTMENT:1","B",ACTOR);
+        assertEquals("B",chosen.customerId());assertEquals(expected.get("B"),chosen.detail().item().workItemKey());
+        assertEquals(404,assertThrows(ResponseStatusException.class,()->f.queries.resolveBatch("FBA_APPOINTMENT:1","C",ACTOR)).getStatusCode().value());
+    }
+    @Test void exactBatchResolutionSelectsCurrentFortyAndTwentyWithoutReturningOldSixty() {
+        var f=new WorkTestFixture();
+        var old=f.state("1",Type.DELIVERY,Flow.TRANSFER,"old-sixty");old.setBatchKey("FBA_APPOINTMENT:60");old.setRetired(true);f.add(old);
+        var forty=f.state("1",Type.DELIVERY,Flow.TRANSFER,"new-forty");forty.setBatchKey("FBA_APPOINTMENT:40");forty.setSources(List.of(new SourceReference("C","ORDER:1","FBA:ONT8")));f.add(forty);
+        var twenty=f.state("1",Type.DELIVERY,Flow.TRANSFER,"new-twenty");twenty.setBatchKey("FBA_APPOINTMENT:20");twenty.setSources(List.of(new SourceReference("C","ORDER:1","FBA:ONT8")));f.add(twenty);
+        old.setReplacementKeys(List.of(forty.getWorkItemKey(),twenty.getWorkItemKey()));f.store.save(old);
+        assertEquals(forty.getWorkItemKey(),f.queries.resolveBatch("FBA_APPOINTMENT:40",null,ACTOR).detail().item().workItemKey());
+        assertEquals(twenty.getWorkItemKey(),f.queries.resolveBatch("FBA_APPOINTMENT:20",null,ACTOR).detail().item().workItemKey());
+        assertEquals(404,assertThrows(ResponseStatusException.class,()->f.queries.resolveBatch("FBA_APPOINTMENT:60",null,ACTOR)).getStatusCode().value());
+        assertEquals(403,assertThrows(ResponseStatusException.class,()->f.queries.resolveBatch("FBA_APPOINTMENT:40",null,new Actor("no-source","只读",Set.of("platform:appointment:list")))).getStatusCode().value());
+        f.guard.setRequirementVersion(2);f.guard.setSynchronizedRequirementVersion(1);
+        assertEquals(409,assertThrows(ResponseStatusException.class,()->f.queries.resolveBatch("FBA_APPOINTMENT:40",null,ACTOR)).getStatusCode().value());
+    }
+    @Test void followTodayPageOneSizeEightDoesNotReadUnrelatedRuntimeFactsOrPaginateBeforeCompletionChecks() {
+        var f=new WorkTestFixture();
+        for(int index=0;index<1000;index++) f.add(f.state("unrelated-"+index,Type.WAREHOUSE_RECEIPT,Flow.TRANSFER,null));
+        var expected=new HashSet<String>();
+        var prior=f.state("due-1",Type.PICKUP,Flow.TRANSFER,null);f.add(prior);expected.add(prior.getWorkItemKey());
+        for(int index=1;index<=10;index++) {
+            var state=f.state("due-"+index,Type.DELIVERY,Flow.TRANSFER,"inbound");state.setFollowupDate(LocalDate.of(2026,10,14));
+            if(index==1) state.setPrerequisites(List.of(prior.getWorkItemKey()));
+            if(index==10) f.facts.put(state.getWorkItemKey(),fact(state,null,null,ExecutionStatus.COMPLETED,new Actual(Instant.parse("2026-10-14T12:00:00Z"),null,"America/Los_Angeles")));
+            f.add(state);expected.add(state.getWorkItemKey());
+        }
+        var future=f.state("future",Type.DELIVERY,Flow.TRANSFER,"inbound");future.setFollowupDate(LocalDate.of(2027,1,1));f.add(future);
+        // Exact parameters from /items?view=FOLLOW_TODAY&page=1&size=8.
+        var page=f.queries.items(View.FOLLOW_TODAY,1,8,null,null,null,null,null,null,ACTOR);
+        assertEquals(9,page.total());assertEquals(8,page.records().size());assertEquals(2,page.pages());
+        assertTrue(page.records().stream().allMatch(i->i.executionStatus()==ExecutionStatus.PENDING));
+        verify(f.gateway).facts(argThat(states->states.stream().map(AppointmentWorkState::getWorkItemKey).collect(java.util.stream.Collectors.toSet()).equals(expected)));
+    }
+    @Test void followTodayPreservesAuthoritativeDateLineZonesAndUndatedPendingHandoffs() {
+        var f=new WorkTestFixture();
+        var tomorrow=LocalDate.of(2026,10,16);
+        var east=f.state("east",Type.DELIVERY,Flow.TRANSFER,"inbound");east.setFollowupDate(tomorrow);f.add(east);
+        var west=f.state("west",Type.DELIVERY,Flow.TRANSFER,"inbound");west.setFollowupDate(tomorrow);f.add(west);
+        // Stored timezone is Los Angeles; the live source is already on the following local day.
+        f.facts.put(east.getWorkItemKey(),fact(east,new Slot(tomorrow,null,null,null,"Pacific/Kiritimati"),null,ExecutionStatus.PENDING,null));
+        var handoff=f.state("return",Type.EMPTY_RETURN,Flow.TRANSFER,null);
+        var owner=new Responsibility(ResponsibilityKind.USER,"1","运营甲");
+        handoff.setReturnHandoff(new ReturnHandoff(1,owner,owner,HandoffStatus.PENDING_ACCEPTANCE,"交接"));f.add(handoff);
+        var query=new AppointmentWorkQueryService(f.store,f.gateway,Clock.fixed(Instant.parse("2026-10-15T12:00:00Z"),ZoneOffset.UTC));
+        var page=query.items(View.FOLLOW_TODAY,1,8,null,null,null,null,null,null,ACTOR);
+        assertEquals(Set.of(east.getWorkItemKey(),handoff.getWorkItemKey()),page.records().stream().map(WorkItem::workItemKey).collect(java.util.stream.Collectors.toSet()));
+    }
+    @Test void calendarLoadsOnlyRequestedTypesButUsesCurrentAuthorityDatesAndStillChecksScope() {
+        var f=new WorkTestFixture();
+        var receipt=f.state("1",Type.WAREHOUSE_RECEIPT,Flow.TRANSFER,null);receipt.setTarget(slot("2025-01-01"));f.add(receipt);
+        var pickup=f.state("1",Type.PICKUP,Flow.TRANSFER,null);f.add(pickup);
+        receipt.setPrerequisites(List.of(pickup.getWorkItemKey()));f.store.save(receipt);
+        f.facts.put(receipt.getWorkItemKey(),fact(receipt,slot("2026-10-16"),null,ExecutionStatus.PENDING,null));
+        assertEquals(1,f.queries.calendar(LocalDate.of(2026,10,1),LocalDate.of(2026,10,31),Flow.TRANSFER,Set.of(Type.WAREHOUSE_RECEIPT),ACTOR).total());
+        verify(f.gateway).facts(argThat(states->states.size()==1 && states.get(0).getWorkItemKey().equals(receipt.getWorkItemKey())));
+        verify(f.gateway).discover(null,1);
+        var reader=new Actor("2","无原业务权限",Set.of(LIST));
+        assertEquals(0,f.queries.calendar(LocalDate.of(2026,10,1),LocalDate.of(2026,10,31),null,Set.of(Type.WAREHOUSE_RECEIPT),reader).total());
+    }
+    @Test void filteredItemsLoadPrerequisiteClosureWithoutIncludingUnrelatedContainers() {
+        var f=new WorkTestFixture();
+        var pickup=f.state("1",Type.PICKUP,Flow.TRANSFER,null);f.add(pickup);
+        var retired=f.state("1",Type.ROUTE,Flow.UNKNOWN,null);retired.setRetired(true);retired.setReplacementKeys(List.of(pickup.getWorkItemKey()));f.add(retired);
+        var receipt=f.state("1",Type.WAREHOUSE_RECEIPT,Flow.TRANSFER,null);receipt.setPrerequisites(List.of(retired.getWorkItemKey()));receipt.setObservedFingerprint("old");f.add(receipt);
+        f.add(f.state("2",Type.DELIVERY,Flow.TRANSFER,"other"));
+        var items=f.queries.items(View.ALL,1,20,null,null,Set.of(Type.WAREHOUSE_RECEIPT),"1",null,null,ACTOR);
+        assertEquals(1,items.total());assertEquals(pickup.getWorkItemKey(),items.records().get(0).nextAction().targetWorkItemKey());
+        verify(f.gateway).facts(argThat(states->states.stream().map(AppointmentWorkState::getWorkItemKey).collect(java.util.stream.Collectors.toSet()).equals(Set.of(pickup.getWorkItemKey(),receipt.getWorkItemKey()))));
+    }
+    @Test void globalSummaryRetainsUnknownRoutesAndReturnAfterDeliveryAcrossCalendarFilters() {
+        var f=new WorkTestFixture(); var route=f.state("1",Type.ROUTE,Flow.UNKNOWN,null); route.setFollowupDate(LocalDate.of(2026,10,14)); f.add(route);
+        var returns=f.state("2",Type.EMPTY_RETURN,Flow.DIRECT,null); returns.setTarget(slot("2026-09-01")); f.add(returns);
+        var delivered=f.state("2",Type.DELIVERY,Flow.DIRECT,"r1"); f.add(delivered);
+        f.facts.put(delivered.getWorkItemKey(),fact(delivered,null,null,ExecutionStatus.COMPLETED,new Actual(Instant.parse("2026-10-14T20:00:00Z"),null,"America/Los_Angeles")));
+        assertEquals(new Summary(2,1,1,1,0),f.queries.summary(ACTOR));
+        assertEquals(0,f.queries.calendar(LocalDate.of(2026,10,1),LocalDate.of(2026,10,31),Flow.TRANSFER,Set.of(),ACTOR).total());
+        assertEquals(2,f.queries.summary(ACTOR).all());
+        var day=f.queries.items(View.ALL,1,20,LocalDate.of(2026,10,14),null,null,null,Bucket.COMPLETED,null,ACTOR);
+        assertEquals(1,day.total()); assertEquals(delivered.getWorkItemKey(),day.records().get(0).workItemKey());
+        assertEquals(2,f.queries.items(View.ALL,1,20,null,null,null,null,null,null,ACTOR).total());
+    }
+    @Test void canonicalTripIsOneWorkItemAndMatchesEveryAssociatedContainer() {
+        var f=new WorkTestFixture(); var trip=f.state("1",Type.TRANSPORT,Flow.TRANSFER,null); trip.setTripKey("trip-1");
+        trip.setContainers(List.of(new ContainerReference("1","CB-1","A"),new ContainerReference("2","CB-2","B"))); f.add(trip);
+        assertEquals(1,f.queries.summary(ACTOR).all());
+        assertEquals(1,f.queries.items(View.ALL,1,20,null,null,null,"2",null,"B",ACTOR).total());
+        assertEquals(2,f.queries.detail(trip.getWorkItemKey(),ACTOR).item().containers().size());
+    }
+    @Test void incompleteBootstrapScopeDriftAndAuthorityFailureCannotProduceZero() {
+        var f=new WorkTestFixture(); f.guard.setInitialized(false);
+        assertEquals(503,assertThrows(ResponseStatusException.class,()->f.queries.summary(ACTOR)).getStatusCode().value());
+        f.guard.setInitialized(true); when(f.gateway.discover(isNull(),anyInt())).thenReturn(new SourcePage(List.of(),null,true,"new-scope"));
+        assertEquals(409,assertThrows(ResponseStatusException.class,()->f.queries.summary(ACTOR)).getStatusCode().value());
+        when(f.gateway.discover(isNull(),anyInt())).thenThrow(new IllegalStateException("offline"));
+        assertThrows(IllegalStateException.class,()->f.queries.summary(ACTOR));
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkRouteServiceTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkRouteServiceTest.java
new file mode 100644
index 000000000..dcabbe27f
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkRouteServiceTest.java
@@ -0,0 +1,15 @@
+package com.baiyue.lastleg.appointmentwork;
+
+import org.junit.jupiter.api.Test;
+import static org.junit.jupiter.api.Assertions.*;
+import static com.baiyue.lastleg.appointmentwork.AppointmentWorkModels.*;
+
+class AppointmentWorkRouteServiceTest {
+    @Test void onlyCurrentCommittedItemsDefineRouteAndNoGuardOrRemoteReadIsRequired() {
+        var fixture=new WorkTestFixture();var old=fixture.state("1",Type.WAREHOUSE_RECEIPT,Flow.TRANSFER,null);old.setRetired(true);fixture.add(old);
+        var current=fixture.state("1",Type.DELIVERY,Flow.DIRECT,"INBOUND:1");fixture.add(current);
+        assertEquals(Flow.DIRECT,new AppointmentWorkRouteService(fixture.store).route("1").flow());
+        org.mockito.Mockito.verify(fixture.mapper,org.mockito.Mockito.never()).lockGuard();
+        org.mockito.Mockito.verifyNoInteractions(fixture.gateway);
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkSyncServiceTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkSyncServiceTest.java
new file mode 100644
index 000000000..b44348ca7
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkSyncServiceTest.java
@@ -0,0 +1,180 @@
+package com.baiyue.lastleg.appointmentwork;
+
+import org.junit.jupiter.api.Test;
+import org.springframework.web.server.ResponseStatusException;
+import java.time.*;
+import java.util.*;
+import static org.junit.jupiter.api.Assertions.*;
+import static org.mockito.Mockito.*;
+import static org.mockito.ArgumentMatchers.*;
+import static com.baiyue.lastleg.appointmentwork.WorkTestFixture.*;
+import static com.baiyue.lastleg.appointmentwork.AppointmentWorkModels.*;
+import static com.baiyue.lastleg.appointmentwork.AppointmentWorkFactGateway.*;
+
+class AppointmentWorkSyncServiceTest {
+    /** 同一实物批次拆成客户事项时，整体事项须有完整去向，运输仍保持唯一。 */
+    @Test void batchWideDeliveryIsReplacedByItsExplicitCustomerRequirements() {
+        var f=new WorkTestFixture();String batch="FBA_APPOINTMENT:1";
+        var refs=List.of(new SourceReference("A","ORDER:1","FBA:ONT8"),new SourceReference("B","ORDER:2","FBA:ONT8"));
+        // 先保存整体需求的真实历史事项，再按相同批次和来源拆出客户事项。
+        var old=f.state("1",Type.DELIVERY,Flow.TRANSFER,batch);
+        old.setWorkItemKey(AppointmentWorkPolicy.key("BATCH:"+batch,Type.DELIVERY,null));
+        old.setBatchKey(batch);old.setBatchKeys(List.of(batch));old.setSources(refs);f.add(old);
+        var sources=mock(com.baiyue.lastleg.appointmentplanning.AppointmentSourceService.class);
+        var cargo=mock(com.baiyue.lastleg.appointmentplanning.AppointmentCargoVerificationService.class);
+        var appointments=mock(com.baiyue.lastleg.inboundplan.service.InboundFbaAppointmentService.class);
+        var mapping=mock(com.baiyue.lastleg.inboundplan.work.AppointmentWorkSourceMapper.class);
+        var provider=new com.baiyue.lastleg.inboundplan.work.AppointmentWorkRequirementProvider(sources,cargo,appointments,mapping);
+        when(mapping.containerSources("1")).thenReturn(List.of(new com.baiyue.lastleg.inboundplan.work.AppointmentWorkSourceMapper.Source(1L,"A","1","1","FBA","ONT8",1),new com.baiyue.lastleg.inboundplan.work.AppointmentWorkSourceMapper.Source(2L,"B","2","1","FBA","ONT8",1)));
+        when(sources.canonicalOrders(anyList())).thenReturn(refs.stream().map(r->new com.baiyue.lastleg.appointmentplanning.AppointmentCoverageService.SourceRef(r.customerId(),r.sourceKey(),r.destinationKey())).toList());
+        when(sources.resolveBatch(anyList())).thenReturn(refs.stream().map(r->new com.baiyue.lastleg.appointmentplanning.AppointmentSourceService.Source(r.sourceKey(),r.customerId(),Long.valueOf(r.sourceKey().substring(6)),null,null,"CNT",null,null,r.destinationKey(),"ONT8",1,"v1",true,List.of())).toList());
+        var allocation=mock(com.baiyue.lastleg.appointmentplanning.AppointmentCargoVerificationService.Context.class);
+        when(allocation.availablePackages()).thenReturn(0L);when(cargo.inspect(any(com.baiyue.lastleg.appointmentplanning.AppointmentSourceService.Source.class))).thenReturn(allocation);
+        var snapshot=mock(com.baiyue.lastleg.inboundplan.dto.FbaAppointmentResponse.class);
+        when(snapshot.batchKey()).thenReturn(batch);when(snapshot.appointmentNo()).thenReturn("AP-1");when(snapshot.fbaWarehouseCode()).thenReturn("ONT8");
+        var items=refs.stream().map(r->{var item=mock(com.baiyue.lastleg.inboundplan.dto.FbaAppointmentResponse.Item.class);when(item.customerId()).thenReturn(r.customerId());when(item.sourceKey()).thenReturn(r.sourceKey());when(item.destinationKey()).thenReturn(r.destinationKey());return item;}).toList();
+        when(snapshot.items()).thenReturn(items);
+        when(appointments.relatedBatchSnapshots(anyList())).thenReturn(List.of(snapshot));
+        var root=new Requirement("INBOUND:1",null,null,"FBA",null,"ONT8",null,List.of(),List.of(),refs);
+        var source=new ContainerSource("1","CNT",null,LocalDateTime.parse("2026-10-01T10:00:00"),null,"v1",Flow.TRANSFER,null,List.of(root));
+        doAnswer(c->provider.requirements(c.getArgument(0),c.getArgument(1))).when(f.gateway).requirements(any(),eq(Flow.TRANSFER));
+        when(f.gateway.discover(null,10)).thenReturn(new SourcePage(List.of(source),null,true,"scope"));
+        f.guard.setRequirementVersion(1);
+        f.sync.synchronize(new SyncRequest(null,10));
+        var deliveries=f.store.all().stream().filter(s->s.getType()==Type.DELIVERY && !s.isRetired()).toList();
+        assertEquals(2,deliveries.size());
+        var retired=f.store.get(old.getWorkItemKey());assertTrue(retired.isRetired());
+        assertEquals(new HashSet<>(deliveries.stream().map(AppointmentWorkState::getWorkItemKey).toList()),new HashSet<>(retired.getReplacementKeys()));
+        assertEquals(1,f.store.all().stream().filter(s->s.getType()==Type.TRANSPORT && !s.isRetired()).count());
+        assertDoesNotThrow(f.store::requireInitialized);
+        f.sync.synchronize(new SyncRequest(null,10));
+        assertEquals(2,f.store.all().stream().filter(s->s.getType()==Type.DELIVERY && !s.isRetired()).count());
+    }
+
+    @Test void onePhysicalBatchHasIndependentCustomerDeliveriesAndOneVehicleWithAllCustomerEdges() {
+        var f=new WorkTestFixture();String batch="FBA_APPOINTMENT:1";
+        var requirements=List.of("A","B").stream().map(customer->new Requirement(AppointmentWorkPolicy.customerRequirement(batch,customer),batch,"AP-1","FBA","海外仓","ONT8",null,List.of(),List.of(),List.of(new SourceReference(customer,"ORDER:"+customer,"FBA:ONT8")))).toList();
+        var source=new ContainerSource("1","CNT",null,LocalDateTime.parse("2026-10-01T10:00:00"),null,"v1",Flow.TRANSFER,null,requirements);
+        when(f.gateway.discover(null,10)).thenReturn(new SourcePage(List.of(source),null,true,"scope"));
+        f.sync.synchronize(new SyncRequest(null,10));
+        var deliveries=f.store.all().stream().filter(s->s.getType()==Type.DELIVERY && !s.isRetired()).toList();
+        var vehicles=f.store.all().stream().filter(s->s.getType()==Type.TRANSPORT && !s.isRetired()).toList();
+        assertEquals(2,deliveries.size());assertEquals(1,vehicles.size());
+        var vehicle=vehicles.get(0);assertTrue(vehicle.getPrerequisites().containsAll(deliveries.stream().map(AppointmentWorkState::getWorkItemKey).toList()));
+        assertEquals(2,vehicle.getSources().size());assertTrue(deliveries.stream().allMatch(s->batch.equals(s.getBatchKey()) && s.getSources().size()==1 && s.getPrerequisites().contains(vehicle.getWorkItemKey())));
+        var keys=deliveries.stream().map(AppointmentWorkState::getWorkItemKey).sorted().toList();
+        f.sync.synchronize(new SyncRequest(null,10));
+        assertEquals(keys,f.store.all().stream().filter(s->s.getType()==Type.DELIVERY && !s.isRetired()).map(AppointmentWorkState::getWorkItemKey).sorted().toList());
+    }
+    @Test void removingPrivateCargoDetachesOldContainerAndRestoresDemandWithoutRetiringOtherCargo() {
+        var f=new WorkTestFixture();
+        var source1=new SourceReference("C1","ORDER:1","CUSTOMER:1");var source2=new SourceReference("C2","ORDER:2","CUSTOMER:2");
+        var batch=new Requirement("DISPATCH:1","DISPATCH:1","D-1","CUSTOMER",null,"客户仓",null,List.of(),List.of("INBOUND:1","INBOUND:2"),List.of(source1,source2));
+        var first=new ContainerSource("1","CNT1",null,LocalDateTime.parse("2026-10-01T10:00:00"),null,"v1",Flow.TRANSFER,null,List.of(batch));
+        var second=new ContainerSource("2","CNT2",null,LocalDateTime.parse("2026-10-01T10:00:00"),null,"v1",Flow.TRANSFER,null,List.of(batch));
+        when(f.gateway.discover(null,10)).thenReturn(new SourcePage(List.of(first,second),null,true,"scope"));f.sync.synchronize(new SyncRequest(null,10));
+        var root=new Requirement("INBOUND:1",null,null,"CUSTOMER",null,"客户仓",null,List.of(),List.of(),List.of(source1));
+        first=new ContainerSource("1","CNT1",null,LocalDateTime.parse("2026-10-01T10:00:00"),null,"v1",Flow.TRANSFER,null,List.of(root));
+        var remainingBatch=new Requirement("DISPATCH:1","DISPATCH:1","D-1","CUSTOMER",null,"客户仓",null,List.of(),List.of("INBOUND:2"),List.of(source2));
+        second=new ContainerSource("2","CNT2",null,LocalDateTime.parse("2026-10-01T10:00:00"),null,"v1",Flow.TRANSFER,null,List.of(remainingBatch));
+        when(f.gateway.discover(null,10)).thenReturn(new SourcePage(List.of(first,second),null,true,"scope"));f.sync.synchronize(new SyncRequest(null,10));
+        var active=f.store.all().stream().filter(s->s.getType()==Type.DELIVERY && !s.isRetired()).toList();assertEquals(2,active.size());
+        var kept=active.stream().filter(s->"DISPATCH:1".equals(s.getBatchKey())).findFirst().orElseThrow();
+        assertEquals(List.of("2"),kept.getContainers().stream().map(ContainerReference::containerBookingId).toList());assertEquals("2",kept.getContainerBookingId());
+        assertFalse(kept.getPrerequisites().contains(AppointmentWorkPolicy.key("1",Type.WAREHOUSE_RECEIPT,null)));
+        assertFalse(f.store.container("1").stream().anyMatch(s->"DISPATCH:1".equals(s.getBatchKey())));
+        assertEquals(List.of(source2),kept.getSources());
+        var root2=new Requirement("INBOUND:2",null,null,"CUSTOMER",null,"客户仓",null,List.of(),List.of(),List.of(source2));
+        second=new ContainerSource("2","CNT2",null,LocalDateTime.parse("2026-10-01T10:00:00"),null,"v1",Flow.TRANSFER,null,List.of(root2));
+        when(f.gateway.discover(null,10)).thenReturn(new SourcePage(List.of(first,second),null,true,"scope"));f.sync.synchronize(new SyncRequest(null,10));
+        assertEquals(2,f.store.all().stream().filter(s->s.getType()==Type.DELIVERY && !s.isRetired() && s.getBatchKey()==null).count());
+    }
+    @Test void removedPrivateBatchCannotBeReplacedByAnotherCustomersUnrelatedDemand() {
+        var f=new WorkTestFixture();var oldSource=new SourceReference("C1","ORDER:1","CUSTOMER:1");
+        var batch=new Requirement("DISPATCH:1","DISPATCH:1","D-1","CUSTOMER",null,null,null,List.of(),List.of(),List.of(oldSource));
+        var container=new ContainerSource("1","CNT1",null,LocalDateTime.parse("2026-10-01T10:00:00"),null,"v1",Flow.TRANSFER,null,List.of(batch));
+        when(f.gateway.discover(null,10)).thenReturn(new SourcePage(List.of(container),null,true,"scope"));f.sync.synchronize(new SyncRequest(null,10));
+        var unrelated=new Requirement("INBOUND:2",null,null,"CUSTOMER",null,null,null,List.of(),List.of(),List.of(new SourceReference("C2","ORDER:2","CUSTOMER:2")));
+        container=new ContainerSource("1","CNT1",null,LocalDateTime.parse("2026-10-01T10:00:00"),null,"v1",Flow.TRANSFER,null,List.of(unrelated));
+        when(f.gateway.discover(null,10)).thenReturn(new SourcePage(List.of(container),null,true,"scope"));
+        assertThrows(ResponseStatusException.class,()->f.sync.synchronize(new SyncRequest(null,10)));
+    }
+    /** 空取消批次回到原货源时退役客户送仓及运输事项，并使版本门禁恢复可读。 */
+    @Test void cancellationReopensOriginalDemandAndRestoringTheSameAppointmentDoesNotDuplicateWork() {
+        var f=new WorkTestFixture();
+        var refs=List.of(new SourceReference("C","ORDER:1","FBA:ONT8"));
+        var root=new Requirement("INBOUND:1",null,null,"FBA",null,"ONT8",null,List.of(),List.of("FBA_APPOINTMENT:1","FBA_APPOINTMENT:1|CUSTOMER:C"),refs);
+        var batch=new Requirement("FBA_APPOINTMENT:1|CUSTOMER:C","FBA_APPOINTMENT:1","AP-1","FBA",null,"ONT8",null,List.of(),List.of("INBOUND:1"),refs);
+        for(var requirement:List.of(root,batch,root,batch)) {
+            f.guard.setRequirementVersion(f.guard.getRequirementVersion()+1);
+            assertThrows(ResponseStatusException.class,f.store::requireInitialized);
+            var source=new ContainerSource("1","CNT",null,LocalDateTime.parse("2026-10-01T10:00:00"),null,"v1",Flow.TRANSFER,null,List.of(requirement));
+            when(f.gateway.discover(null,10)).thenReturn(new SourcePage(List.of(source),null,true,"scope"));
+            f.sync.synchronize(new SyncRequest(null,10));
+            assertDoesNotThrow(f.store::requireInitialized);
+            var deliveries=f.store.all().stream().filter(s->s.getType()==Type.DELIVERY && !s.isRetired()).toList();
+            assertEquals(1,deliveries.size()); assertEquals(requirement.requirementKey(),deliveries.get(0).getRequirementKey());
+        }
+    }
+    @Test void localRequirementVersionChangingBetweenPagesCannotBePublishedComplete() {
+        var f=new WorkTestFixture();f.guard.setScanCursor("10");f.guard.setScanScopeVersion("scope");f.guard.setScanRequirementVersion(1);f.guard.setRequirementVersion(2);
+        when(f.gateway.discover("10",10)).thenReturn(new SourcePage(List.of(),null,true,"scope"));
+        assertThrows(ResponseStatusException.class,()->f.sync.synchronize(new SyncRequest("10",10)));
+        assertEquals(0,f.guard.getSynchronizedRequirementVersion());
+    }
+    @Test void serverDiscoveryCreatesUnknownRouteWithoutWarehouseBindingAndRetainsOldUnreturnedWork() {
+        var f=new WorkTestFixture(); var returns=f.state("old",Type.EMPTY_RETURN,Flow.DIRECT,null); f.add(returns);
+        var source=new ContainerSource("new","柜new",Instant.parse("2026-10-01T00:00:00Z"),null,null,"v1",Flow.UNKNOWN,null,List.of());
+        when(f.gateway.discover(null,10)).thenReturn(new SourcePage(List.of(source),null,true,"scope"));
+        assertEquals(1,f.sync.synchronize(new SyncRequest(null,10)).created());
+        assertEquals(0,f.sync.synchronize(new SyncRequest(null,10)).created());
+        assertEquals(2,f.rows.size()); assertNotNull(f.store.get(returns.getWorkItemKey()));
+        assertTrue(f.store.all().stream().anyMatch(s->s.getFlow()==Flow.UNKNOWN && s.getType()==Type.ROUTE));
+    }
+    @Test void threeTransferRequirementsGenerateOnlyOnePickupReceiptAndReturn() {
+        var f=new WorkTestFixture();
+        var requirements=List.of("one","two","three").stream().map(id->new Requirement(id,null,null,"FBA","海外仓","ONT8","America/Los_Angeles",List.of(),List.of(),List.of())).toList();
+        var source=new ContainerSource("1","柜1",Instant.parse("2026-10-01T00:00:00Z"),null,null,"v1",Flow.TRANSFER,"America/Los_Angeles",requirements);
+        when(f.gateway.discover(null,10)).thenReturn(new SourcePage(List.of(source),null,true,"scope"));
+        f.sync.synchronize(new SyncRequest(null,10)); f.sync.synchronize(new SyncRequest(null,10));
+        assertEquals(9,f.rows.size());
+        for(var type:List.of(Type.PICKUP,Type.WAREHOUSE_RECEIPT,Type.EMPTY_RETURN)) assertEquals(1,f.store.all().stream().filter(s->s.getType()==type).count());
+    }
+    @Test void firstConfirmationUsesBaselineWhileSubsequentImpactMarksOnlyArrangedRelatedWork() {
+        var f=new WorkTestFixture(); var receipt=f.state("1",Type.WAREHOUSE_RECEIPT,Flow.TRANSFER,null); receipt.setTarget(slot("2026-10-15")); receipt.setObservedFingerprint("old"); receipt.setObservedImpactToken("same-impact"); receipt.setObservedArranged(true); f.add(receipt);
+        var delivery=f.state("1",Type.DELIVERY,Flow.TRANSFER,"r1"); delivery.setTarget(slot("2026-10-16")); delivery.setPrerequisites(List.of(receipt.getWorkItemKey())); f.add(delivery);
+        var unscheduled=f.state("1",Type.DELIVERY,Flow.TRANSFER,"r2"); unscheduled.setPrerequisites(List.of(receipt.getWorkItemKey())); f.add(unscheduled);
+        var first=new Fact(receipt.getWorkItemKey(),"first-confirm","same-impact",true,PlanStatus.CONFIRMED,ExecutionStatus.PENDING,slot("2026-10-15"),slot("2026-10-15"),null,"America/Los_Angeles",null,null,List.of(AppointmentWorkPolicy.ORDER_READ),List.of(),null,List.of(),List.of(),List.of(),null,null);
+        var facts=new HashMap<String,Fact>(); facts.put(receipt.getWorkItemKey(),first); facts.put(delivery.getWorkItemKey(),fact(delivery,null,null,ExecutionStatus.PENDING,null)); facts.put(unscheduled.getWorkItemKey(),fact(unscheduled,null,null,ExecutionStatus.PENDING,null));
+        f.sync.observe(f.store.all(),facts,ACTOR); assertFalse(f.store.get(delivery.getWorkItemKey()).isReviewRequired());
+        facts.put(receipt.getWorkItemKey(),new Fact(receipt.getWorkItemKey(),"rescheduled","new-impact",true,PlanStatus.CONFIRMED,ExecutionStatus.PENDING,slot("2026-10-18"),slot("2026-10-18"),null,"America/Los_Angeles",null,null,List.of(AppointmentWorkPolicy.ORDER_READ),List.of(),null,List.of(),List.of(),List.of(),null,null));
+        f.sync.observe(f.store.all(),facts,ACTOR);
+        assertTrue(f.store.get(delivery.getWorkItemKey()).isReviewRequired()); assertFalse(f.store.get(unscheduled.getWorkItemKey()).isReviewRequired());
+        int version=f.store.get(delivery.getWorkItemKey()).getReviewVersion(); f.sync.observe(f.store.all(),facts,ACTOR); assertEquals(version,f.store.get(delivery.getWorkItemKey()).getReviewVersion());
+    }
+    @Test void changingDiscoveryScopeDuringPaginationIsNotMarkedComplete() {
+        var f=new WorkTestFixture(); f.guard.setInitialized(false); f.guard.setScanCursor("10"); f.guard.setScanScopeVersion("before");
+        when(f.gateway.discover("10",10)).thenReturn(new SourcePage(List.of(),null,true,"after"));
+        assertThrows(ResponseStatusException.class,()->f.sync.synchronize(new SyncRequest("10",10)));
+        assertFalse(f.guard.isInitialized());
+    }
+    @Test void sharedTripAcrossTwoContainersIsPersistedOnceAndKeepsBothContainers() {
+        var f=new WorkTestFixture();
+        var sources=List.of("1","2").stream().map(id->new ContainerSource(id,"柜"+id,Instant.parse("2026-10-01T00:00:00Z"),null,null,"v1",Flow.TRANSFER,"America/Los_Angeles",
+            List.of(new Requirement("R"+id,"B"+id,"AP"+id,"FBA","海外仓","ONT8","America/Los_Angeles",List.of(),List.of(),List.of())))).toList();
+        when(f.gateway.discover(null,10)).thenReturn(new SourcePage(sources,null,true,"scope"));
+        when(f.gateway.facts(anyList())).thenAnswer(call->{
+            var values=new HashMap<String,Fact>();
+            for(var state:call.<List<AppointmentWorkState>>getArgument(0)) if(state.getType()!=Type.ROUTE) {
+                if(state.getType()==Type.TRANSPORT) values.put(state.getWorkItemKey(),new Fact(state.getWorkItemKey(),"trip-v1","trip-impact-v1",true,PlanStatus.CONFIRMED,ExecutionStatus.PENDING,
+                    slot("2026-10-16"),slot("2026-10-16"),null,"America/Los_Angeles","TR-1","trip-1",List.of(AppointmentWorkPolicy.ORDER_READ),List.of(),null,List.of(),List.of(),List.of(),null,null));
+                else values.put(state.getWorkItemKey(),fact(state,null,null,ExecutionStatus.PENDING,null));
+            }
+            return values;
+        });
+        f.sync.synchronize(new SyncRequest(null,10)); f.sync.synchronize(new SyncRequest(null,10));
+        var transports=f.store.all().stream().filter(s->!s.isRetired() && s.getType()==Type.TRANSPORT).toList();
+        assertEquals(1,transports.size()); assertEquals(2,transports.get(0).getContainers().size()); assertEquals(List.of("B1","B2"),transports.get(0).getBatchKeys());
+        assertEquals(9,f.store.all().stream().filter(s->!s.isRetired()).count());
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkSynchronizationJobTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkSynchronizationJobTest.java
new file mode 100644
index 000000000..b573ab02e
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkSynchronizationJobTest.java
@@ -0,0 +1,16 @@
+package com.baiyue.lastleg.appointmentwork;
+
+import org.junit.jupiter.api.Test;
+import org.springframework.http.HttpStatus;
+import org.springframework.web.server.ResponseStatusException;
+import static org.assertj.core.api.Assertions.assertThat;
+
+class AppointmentWorkSynchronizationJobTest {
+    @Test void diagnosticKeepsCauseAndCodeWithoutRemoteMessages() {
+        var cause=new IllegalArgumentException("Authorization: Bearer secret; private remote body");
+        var error=new ResponseStatusException(HttpStatus.SERVICE_UNAVAILABLE,"private response",cause);
+        assertThat(AppointmentWorkSynchronizationJob.failureDiagnostic(error))
+            .contains("ResponseStatusException[503]", "IllegalArgumentException", "AppointmentWorkSynchronizationJobTest:")
+            .doesNotContain("secret", "private", "Authorization", "Bearer");
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkV13WorkflowTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkV13WorkflowTest.java
new file mode 100644
index 000000000..e98241487
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/appointmentwork/AppointmentWorkV13WorkflowTest.java
@@ -0,0 +1,175 @@
+package com.baiyue.lastleg.appointmentwork;
+
+import org.junit.jupiter.api.Test;
+import org.springframework.web.server.ResponseStatusException;
+import java.time.LocalDate;
+import java.util.*;
+import static org.junit.jupiter.api.Assertions.*;
+import static com.baiyue.lastleg.appointmentwork.WorkTestFixture.*;
+import static com.baiyue.lastleg.appointmentwork.AppointmentWorkModels.*;
+import static com.baiyue.lastleg.appointmentwork.AppointmentWorkFactGateway.*;
+import static com.baiyue.lastleg.appointmentwork.AppointmentWorkPolicy.*;
+
+class AppointmentWorkV13WorkflowTest {
+    private record Shared(WorkTestFixture fixture,AppointmentWorkState a,AppointmentWorkState b,
+                          AppointmentWorkState waiting,AppointmentWorkState trip) { }
+
+    private Fact planned(AppointmentWorkState state,String revision) {
+        return new Fact(state.getWorkItemKey(),"fact-"+revision,"impact-"+revision,true,PlanStatus.CONFIRMED,
+            ExecutionStatus.PENDING,slot("2026-10-17"),slot("2026-10-17"),null,"America/Los_Angeles",
+            null,state.getTripKey(),List.of(ORDER_READ),List.of(),null,List.of(),List.of(),List.of(),null,null);
+    }
+    private Shared shared() {
+        var f=new WorkTestFixture();
+        var a=f.state("1",Type.DELIVERY,Flow.TRANSFER,"customer-a");
+        var b=f.state("1",Type.DELIVERY,Flow.TRANSFER,"customer-b");
+        var waiting=f.state("1",Type.DELIVERY,Flow.TRANSFER,"not-arranged");
+        var trip=f.state("1",Type.TRANSPORT,Flow.TRANSFER,"shared-trip");trip.setTripKey("TRIP-1");
+        a.setSources(List.of(new SourceReference("A","ORDER:1","CODE:ONT8")));
+        b.setSources(List.of(new SourceReference("B","ORDER:2","CODE:ONT8")));
+        // Real graph after canonical shared-vehicle reconciliation: appointments and vehicle
+        // are mutually dependent, but sharing a vehicle does not change another appointment.
+        for(var delivery:List.of(a,b,waiting)) delivery.setPrerequisites(List.of(trip.getWorkItemKey()));
+        trip.setPrerequisites(List.of(a.getWorkItemKey(),b.getWorkItemKey(),waiting.getWorkItemKey()));
+        for(var state:List.of(a,b,trip)) { f.add(state);f.facts.put(state.getWorkItemKey(),planned(state,"1")); }
+        f.add(waiting);f.facts.put(waiting.getWorkItemKey(),fact(waiting,null,null,ExecutionStatus.PENDING,null));
+        f.sync.observe(f.store.all(),f.facts,ACTOR);
+        return new Shared(f,a,b,waiting,trip);
+    }
+
+    @Test void oneCustomerChangeReviewsItsVehicleWithoutReviewingOtherCustomersOrUnarrangedWork() {
+        var s=shared();var f=s.fixture();
+        f.facts.put(s.a().getWorkItemKey(),planned(s.a(),"2"));
+        f.sync.observe(f.store.all(),f.facts,ACTOR);
+        assertTrue(f.store.get(s.a().getWorkItemKey()).isReviewRequired());
+        assertTrue(f.store.get(s.trip().getWorkItemKey()).isReviewRequired());
+        assertFalse(f.store.get(s.b().getWorkItemKey()).isReviewRequired());
+        assertFalse(f.store.get(s.waiting().getWorkItemKey()).isReviewRequired());
+        assertEquals(List.of(s.trip().getWorkItemKey()),AppointmentWorkSyncService.impactPrerequisites(s.a(),f.store.all())
+            .stream().map(AppointmentWorkState::getWorkItemKey).toList());
+        var version=f.store.get(s.trip().getWorkItemKey()).getReviewVersion();
+        f.sync.observe(f.store.all(),f.facts,ACTOR);
+        assertEquals(version,f.store.get(s.trip().getWorkItemKey()).getReviewVersion());
+    }
+
+    @Test void realVehicleChangeStillReviewsEveryCurrentlyArrangedMember() {
+        var s=shared();var f=s.fixture();
+        f.facts.put(s.trip().getWorkItemKey(),planned(s.trip(),"2"));
+        f.sync.observe(f.store.all(),f.facts,ACTOR);
+        for(var state:List.of(s.a(),s.b(),s.trip())) assertTrue(f.store.get(state.getWorkItemKey()).isReviewRequired());
+        assertFalse(f.store.get(s.waiting().getWorkItemKey()).isReviewRequired());
+    }
+
+    private Fact vehicleImpact(AppointmentWorkState state,String own,String shared) {
+        return new Fact(state.getWorkItemKey(),"fact-"+own,"impact-"+own,true,PlanStatus.CONFIRMED,
+            ExecutionStatus.PENDING,slot("2026-10-17"),slot("2026-10-17"),null,"America/Los_Angeles",
+            null,state.getTripKey(),List.of(ORDER_READ),List.of(),null,List.of(),List.of(),List.of(),null,shared);
+    }
+    @Test void simultaneousCustomerAndVehicleMembershipChangeDoesNotReviewUnchangedCustomers() throws Exception {
+        var s=shared();var f=s.fixture();
+        f.facts.put(s.trip().getWorkItemKey(),vehicleImpact(s.trip(),"1","plan-1"));
+        f.sync.observe(f.store.all(),f.facts,ACTOR);
+        f.facts.put(s.a().getWorkItemKey(),planned(s.a(),"2"));
+        f.facts.put(s.trip().getWorkItemKey(),vehicleImpact(s.trip(),"2","plan-1"));
+        var unchanged=f.queries.detail(s.b().getWorkItemKey(),ACTOR).item();
+        assertFalse(unchanged.reviewRequired());assertTrue(unchanged.blockReasons().isEmpty());
+        f.sync.observe(f.store.all(),f.facts,ACTOR);
+        assertTrue(f.store.get(s.a().getWorkItemKey()).isReviewRequired());
+        assertTrue(f.store.get(s.trip().getWorkItemKey()).isReviewRequired());
+        assertFalse(f.store.get(s.b().getWorkItemKey()).isReviewRequired());
+        // A later cargo-only change must not invalidate B's review of a different impact.
+        var b=f.store.get(s.b().getWorkItemKey());b.setReviewRequired(true);b.setReviewVersion(1);f.store.save(b);
+        f.facts.put(s.trip().getWorkItemKey(),vehicleImpact(s.trip(),"3","plan-1"));
+        assertTrue(f.queries.detail(b.getWorkItemKey(),ACTOR).item().allowedActions().stream().anyMatch(a->a.code()==ActionCode.RESOLVE_REVIEW));
+        var review=f.command(Command.RESOLVE_REVIEW,b.getVersion(),"review-b","{\"reviewVersion\":1,\"note\":\"本客户时段不变\"}");
+        assertFalse(f.commands.execute(b.getWorkItemKey(),review,ACTOR).item().reviewRequired());
+        f.sync.observe(f.store.all(),f.facts,ACTOR);
+        assertFalse(f.store.get(b.getWorkItemKey()).isReviewRequired());
+        f.facts.put(s.trip().getWorkItemKey(),vehicleImpact(s.trip(),"4","plan-2"));
+        f.sync.observe(f.store.all(),f.facts,ACTOR);
+        assertTrue(f.store.get(b.getWorkItemKey()).isReviewRequired());
+    }
+
+    @Test void retiredTransportAliasKeepsTheSameCustomerImpactBoundary() {
+        var s=shared();var f=s.fixture();
+        var alias=f.state("1",Type.TRANSPORT,Flow.TRANSFER,"old-a-transport");
+        alias.setRetired(true);alias.setRetirementReason("TRIP_LINKED");alias.setReplacementKeys(List.of(s.trip().getWorkItemKey()));f.add(alias);
+        var a=f.store.get(s.a().getWorkItemKey());a.setPrerequisites(List.of(alias.getWorkItemKey()));f.store.save(a);
+        var affected=new LinkedHashSet<String>();AppointmentWorkSyncService.expandDependents(a.getWorkItemKey(),f.store.all(),affected);
+        assertTrue(affected.contains(s.trip().getWorkItemKey()));assertFalse(affected.contains(s.b().getWorkItemKey()));
+        assertEquals(List.of(s.trip().getWorkItemKey()),AppointmentWorkSyncService.impactPrerequisites(a,f.store.all())
+            .stream().map(AppointmentWorkState::getWorkItemKey).toList());
+    }
+
+    @Test void unsynchronizedNewUpstreamImpactCannotBeClearedByAnOldReviewAndReplayCannotClearLaterChanges() throws Exception {
+        var f=new WorkTestFixture();
+        var receipt=f.state("1",Type.WAREHOUSE_RECEIPT,Flow.TRANSFER,null);f.add(receipt);
+        var delivery=f.state("1",Type.DELIVERY,Flow.TRANSFER,"batch-a");delivery.setPrerequisites(List.of(receipt.getWorkItemKey()));f.add(delivery);
+        f.facts.put(receipt.getWorkItemKey(),planned(receipt,"1"));f.facts.put(delivery.getWorkItemKey(),planned(delivery,"1"));
+        f.sync.observe(f.store.all(),f.facts,ACTOR);
+        f.facts.put(receipt.getWorkItemKey(),planned(receipt,"2"));f.sync.observe(f.store.all(),f.facts,ACTOR);
+        var reviewing=f.store.get(delivery.getWorkItemKey());
+        var old=f.command(Command.RESOLVE_REVIEW,reviewing.getVersion(),"old-review","{\"reviewVersion\":1,\"note\":\"核对旧影响\"}");
+        f.facts.put(receipt.getWorkItemKey(),planned(receipt,"3"));
+        assertEquals(409,assertThrows(ResponseStatusException.class,()->f.commands.execute(delivery.getWorkItemKey(),old,ACTOR)).getStatusCode().value());
+        assertTrue(f.store.get(delivery.getWorkItemKey()).isReviewRequired());
+        f.sync.observe(f.store.all(),f.facts,ACTOR);
+        var current=f.store.get(delivery.getWorkItemKey());assertEquals(2,current.getReviewVersion());
+        var staleImpact=f.command(Command.RESOLVE_REVIEW,current.getVersion(),"old-impact","{\"reviewVersion\":1,\"note\":\"旧版本\"}");
+        assertEquals(409,assertThrows(ResponseStatusException.class,()->f.commands.execute(delivery.getWorkItemKey(),staleImpact,ACTOR)).getStatusCode().value());
+        var accepted=f.command(Command.RESOLVE_REVIEW,current.getVersion(),"current-review","{\"reviewVersion\":2,\"note\":\"核对最新安排\"}");
+        var response=f.commands.execute(delivery.getWorkItemKey(),accepted,ACTOR);assertFalse(response.item().reviewRequired());
+        f.sync.observe(f.store.all(),f.facts,ACTOR);assertFalse(f.store.get(delivery.getWorkItemKey()).isReviewRequired());
+        f.facts.put(receipt.getWorkItemKey(),planned(receipt,"4"));f.sync.observe(f.store.all(),f.facts,ACTOR);
+        assertEquals(response,f.commands.execute(delivery.getWorkItemKey(),accepted,ACTOR));
+        assertTrue(f.store.get(delivery.getWorkItemKey()).isReviewRequired());
+        assertEquals(3,f.store.get(delivery.getWorkItemKey()).getReviewVersion());
+    }
+
+    @Test void outstandingRequirementChangesPreventReviewUntilRelationshipsAreSynchronized() throws Exception {
+        var s=shared();var f=s.fixture();
+        var state=f.store.get(s.a().getWorkItemKey());state.setReviewRequired(true);state.setReviewVersion(1);f.store.save(state);
+        f.guard.setRequirementVersion(2);f.guard.setSynchronizedRequirementVersion(1);
+        var command=f.command(Command.RESOLVE_REVIEW,state.getVersion(),"dirty-scope","{\"reviewVersion\":1,\"note\":\"不能略过关系变化\"}");
+        assertEquals(409,assertThrows(ResponseStatusException.class,()->f.commands.execute(state.getWorkItemKey(),command,ACTOR)).getStatusCode().value());
+        assertTrue(f.store.get(state.getWorkItemKey()).isReviewRequired());
+    }
+
+    @Test void reminderDateIsNotWorkDateAndAnUnsetReminderRemainsAnExplicitMissingField() {
+        var f=new WorkTestFixture();var delivery=f.state("1",Type.DELIVERY,Flow.TRANSFER,"later-batch");
+        delivery.setFollowupDate(LocalDate.of(2026,10,16));f.add(delivery);
+        var item=f.queries.items(View.UNDATED,1,8,null,null,null,null,null,null,ACTOR).records().get(0);
+        assertNull(item.calendarDate());assertEquals(LocalDate.of(2026,10,16),item.followupDate());
+        assertEquals(1,f.queries.summary(ACTOR).all());assertEquals(1,f.queries.summary(ACTOR).undated());
+        delivery=f.store.get(delivery.getWorkItemKey());delivery.setFollowupDate(null);f.store.save(delivery);
+        assertTrue(f.queries.detail(delivery.getWorkItemKey(),ACTOR).item().missingFields().contains("下次跟进日期待安排"));
+        assertEquals(1,f.queries.summary(ACTOR).all());
+    }
+
+    private Fact actionable(AppointmentWorkState state,boolean confirmed,Action action,List<String> permissions) {
+        return new Fact(state.getWorkItemKey(),"fact-1","impact-1",true,confirmed?PlanStatus.CONFIRMED:PlanStatus.UNPLANNED,
+            ExecutionStatus.PENDING,null,confirmed?slot("2026-10-17"):null,null,"America/Los_Angeles",null,state.getTripKey(),
+            List.of(ORDER_READ),permissions,action,List.of(),List.of(),List.of(),null,null);
+    }
+    @Test void confirmedAppointmentGuidesExistingVehicleWhileUnconfirmedAppointmentKeepsBookingStep() {
+        var f=new WorkTestFixture();var delivery=f.state("1",Type.DELIVERY,Flow.TRANSFER,"batch-a");
+        var transport=f.state("1",Type.TRANSPORT,Flow.TRANSFER,"batch-a");
+        delivery.setPrerequisites(List.of(transport.getWorkItemKey()));f.add(delivery);f.add(transport);
+        var booking=new Action(ActionCode.CHANGE_BOOKING,"维护预约",delivery.getWorkItemKey(),new AppointmentTarget("1","batch-a",List.of()));
+        var vehicle=new Action(ActionCode.ARRANGE_TRANSPORT,"维护车辆",transport.getWorkItemKey(),new TripTarget(null,List.of("batch-a")));
+        f.facts.put(delivery.getWorkItemKey(),actionable(delivery,true,booking,List.of(MANAGE)));
+        f.facts.put(transport.getWorkItemKey(),actionable(transport,false,vehicle,List.of(MANAGE)));
+        var next=f.queries.detail(delivery.getWorkItemKey(),ACTOR).item().nextAction();
+        assertEquals(ActionCode.ARRANGE_TRANSPORT,next.code());assertEquals("继续安排本批车辆",next.label());
+        assertEquals(transport.getWorkItemKey(),next.targetWorkItemKey());assertEquals(vehicle.target(),next.target());
+        var existing=new Action(ActionCode.ARRANGE_TRANSPORT,"维护车辆",transport.getWorkItemKey(),new TripTarget("TRIP-1",List.of("batch-a")));
+        f.facts.put(transport.getWorkItemKey(),actionable(transport,true,existing,List.of(MANAGE)));
+        assertEquals("核对本车发车安排",f.queries.detail(delivery.getWorkItemKey(),ACTOR).item().nextAction().label());
+        var rebook=new Action(ActionCode.RECORD_CONFIRMATION,"重新约仓",delivery.getWorkItemKey(),booking.target());
+        f.facts.put(delivery.getWorkItemKey(),actionable(delivery,false,rebook,List.of(MANAGE)));
+        assertEquals(rebook,f.queries.detail(delivery.getWorkItemKey(),ACTOR).item().nextAction());
+        f.facts.put(delivery.getWorkItemKey(),actionable(delivery,true,booking,List.of(MANAGE)));
+        var reader=new Actor("read","只读",Set.of(LIST,ORDER_READ));
+        assertEquals(ActionCode.VIEW_DETAIL,f.queries.detail(delivery.getWorkItemKey(),reader).item().nextAction().code());
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/appointmentwork/WorkTestFixture.java b/lastleg-service/src/test/java/com/baiyue/lastleg/appointmentwork/WorkTestFixture.java
new file mode 100644
index 000000000..1c9ec32f0
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/appointmentwork/WorkTestFixture.java
@@ -0,0 +1,55 @@
+package com.baiyue.lastleg.appointmentwork;
+
+import com.fasterxml.jackson.databind.ObjectMapper;
+import java.time.*;
+import java.util.*;
+import static org.mockito.Mockito.*;
+import static org.mockito.ArgumentMatchers.*;
+import static com.baiyue.lastleg.appointmentwork.AppointmentWorkModels.*;
+import static com.baiyue.lastleg.appointmentwork.AppointmentWorkFactGateway.*;
+import static com.baiyue.lastleg.appointmentwork.AppointmentWorkPolicy.*;
+
+final class WorkTestFixture {
+    static final Clock CLOCK=Clock.fixed(Instant.parse("2026-10-15T04:00:00Z"),ZoneOffset.UTC);
+    static final Actor ACTOR=new Actor("1","运营甲",Set.of(LIST,ORDER_READ,FOLLOWUP,MANAGE));
+    final ObjectMapper json=new ObjectMapper().findAndRegisterModules();
+    final AppointmentWorkMapper mapper=mock(AppointmentWorkMapper.class);
+    final AppointmentWorkFactGateway gateway=mock(AppointmentWorkFactGateway.class);
+    final Map<String,AppointmentWorkMapper.Row> rows=new TreeMap<>();
+    final Map<String,Fact> facts=new HashMap<>();
+    final List<AppointmentWorkMapper.History> history=new ArrayList<>();
+    final AppointmentWorkMapper.Guard guard=new AppointmentWorkMapper.Guard();
+    final AppointmentWorkStore store=new AppointmentWorkStore(mapper,json);
+    final AppointmentWorkSyncService sync=new AppointmentWorkSyncService(store,gateway);
+    final AppointmentWorkQueryService queries=new AppointmentWorkQueryService(store,gateway,CLOCK);
+    final AppointmentWorkCommandService commands=new AppointmentWorkCommandService(store,gateway,sync,queries);
+    WorkTestFixture() {
+        guard.setId(1); guard.setInitialized(true); guard.setScopeVersion("scope");
+        when(mapper.guard()).thenReturn(guard); when(mapper.lockGuard()).thenReturn(guard);
+        when(mapper.get(anyString())).thenAnswer(c->rows.get(c.getArgument(0)));
+        when(mapper.all(anyInt())).thenAnswer(c->rows.values().stream().limit(c.getArgument(0,Integer.class)).toList());
+        when(mapper.container(anyString())).thenAnswer(c->rows.values().stream().filter(r->r.getContainerBookingId().equals(c.getArgument(0))).toList());
+        when(mapper.insert(any())).thenAnswer(c->{ var row=c.getArgument(0,AppointmentWorkMapper.Row.class); if(rows.putIfAbsent(row.getWorkItemKey(),row)!=null) throw new org.springframework.dao.DuplicateKeyException("duplicate"); return 1; });
+        when(mapper.update(any())).thenAnswer(c->{ var row=c.getArgument(0,AppointmentWorkMapper.Row.class); var old=rows.get(row.getWorkItemKey()); if(old==null || old.getVersion()!=row.getVersion()-1) return 0; rows.put(row.getWorkItemKey(),row); return 1; });
+        when(mapper.insertHistory(any(AppointmentWorkMapper.History.class))).thenAnswer(c->{history.add(c.getArgument(0)); return 1;});
+        when(mapper.selectHistory(anyString())).thenAnswer(c->history.stream().filter(h->h.getWorkItemKey().equals(c.getArgument(0))).toList());
+        when(mapper.inheritedFollowup(anyString())).thenAnswer(c->history.stream().filter(h->h.getWorkItemKey().equals(c.getArgument(0)) && "FOLLOWUP_INHERITED".equals(h.getAction())).reduce((a,b)->b).orElse(null));
+        when(mapper.command(anyString(),anyString())).thenAnswer(c->history.stream().filter(h->h.getWorkItemKey().equals(c.getArgument(0)) && Objects.equals(h.getCommandKey(),c.getArgument(1))).findFirst().orElse(null));
+        when(gateway.facts(anyList())).thenAnswer(c->{ var result=new LinkedHashMap<String,Fact>(); for(var state:c.<List<AppointmentWorkState>>getArgument(0)) if(state.getType()!=Type.ROUTE) result.put(state.getWorkItemKey(),facts.getOrDefault(state.getWorkItemKey(),fact(state,null,null,ExecutionStatus.PENDING,null))); return result; });
+        when(gateway.discover(isNull(),anyInt())).thenReturn(new SourcePage(List.of(),null,true,"scope"));
+        when(gateway.owner(eq("1"),any())).thenReturn(new Owner("1","运营甲"));
+        when(gateway.requirements(any(),any())).thenAnswer(c->c.getArgument(0,ContainerSource.class).requirements());
+    }
+    AppointmentWorkState state(String container,Type type,Flow flow,String requirement) {
+        var state=new AppointmentWorkState(); state.setWorkItemKey(key(container,type,requirement)); state.setContainerBookingId(container); state.setContainerNo("柜"+container);
+        state.setContainers(List.of(new ContainerReference(container,"CB-"+container,"柜"+container))); state.setType(type); state.setFlow(flow); state.setRequirementKey(requirement); state.setSourceVersion("v1"); state.setTimezone("America/Los_Angeles");
+        return state;
+    }
+    void add(AppointmentWorkState state) { store.insert(state); }
+    CommandRequest command(Command command,int version,String id,String payload) throws Exception { return new CommandRequest(command,version,id,json.readTree(payload)); }
+    static Slot slot(String date) { return new Slot(LocalDate.parse(date),null,null,null,"America/Los_Angeles"); }
+    static Fact fact(AppointmentWorkState state,Slot target,Slot confirmed,ExecutionStatus execution,Actual actual) {
+        return new Fact(state.getWorkItemKey(),"fact-v1","impact-v1",target!=null || confirmed!=null,confirmed!=null?PlanStatus.CONFIRMED:target!=null?PlanStatus.TARGET_SET:PlanStatus.UNPLANNED,
+            execution,target,confirmed,actual,"America/Los_Angeles",null,null,List.of(ORDER_READ),List.of(),null,List.of(),List.of(),List.of(),null,null);
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/contract/AppointmentWorkSchemaContractTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/contract/AppointmentWorkSchemaContractTest.java
new file mode 100644
index 000000000..aa601fe14
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/contract/AppointmentWorkSchemaContractTest.java
@@ -0,0 +1,55 @@
+package com.baiyue.lastleg.contract;
+
+import org.junit.jupiter.api.Test;
+import java.nio.file.*;
+import java.util.List;
+import java.util.regex.Pattern;
+import static org.junit.jupiter.api.Assertions.*;
+
+class AppointmentWorkSchemaContractTest {
+    @Test void receivingCoverageSchemaMatchesBothInitializationEntriesWithoutLegacyHeaderUniqueness() throws Exception {
+        String source=Files.readString(Path.of("src/main/resources/db/appointment-receiving.sql"));
+        for(String path:List.of("src/main/resources/db/lastleg.sql","../deploy/sql/海外区域统一增量-MySQL8.sql")) {
+            String target=Files.readString(Path.of(path));
+            for(String table:List.of("ll_fba_receiving_agreement","ll_fba_receiving_member","ll_fba_receiving_change","ll_fba_receiving_revision","ll_fba_receiving_plan"))
+                assertEquals(definition(source,table),definition(target,table),path+" differs for "+table);
+            assertFalse(target.contains("uk_ll_fba_external_confirmation"),"An aggregate header cannot own independently confirmed customer appointments");
+        }
+        String reset=Files.readString(Path.of("../deploy/sql/reset-test-fba-appointments.sql"));
+        int guardEnd=reset.indexOf("CALL assert_test_appointment_reset_preconditions()");
+        for(String table:List.of("ll_fba_receiving_agreement","ll_fba_receiving_member","ll_fba_receiving_change","ll_fba_receiving_revision","ll_fba_receiving_plan"))
+            assertTrue(reset.substring(0,guardEnd).contains("'"+table+"'"),"Old reset must refuse receiving history: "+table);
+    }
+    @Test void completeWorkAndPhysicalAllocationSchemaMatchesBothInitializationEntries() throws Exception {
+        String source=Files.readString(Path.of("src/main/resources/db/appointment-work.sql"));
+        for(String path:List.of("src/main/resources/db/lastleg.sql","../deploy/sql/海外区域统一增量-MySQL8.sql")) {
+            String target=Files.readString(Path.of(path));
+            for(String table:List.of("ll_dispatch_appointment_allocation","ll_appointment_work_commitment","ll_appointment_work_guard","ll_appointment_work","ll_appointment_work_history"))
+                assertEquals(definition(source,table),definition(target,table),path+" differs for "+table);
+            if (path.startsWith("../deploy/")) {
+                assertTrue(target.contains("INSERT INTO ll_appointment_work_guard (id,initialized) VALUES (1,FALSE);"));
+                assertFalse(target.contains("WHERE NOT EXISTS(SELECT 1 FROM ll_appointment_work_guard"));
+            } else {
+                assertTrue(target.contains("INSERT INTO ll_appointment_work_guard(id,initialized) SELECT 1,FALSE"));
+            }
+        }
+        assertTrue(source.contains("scan_cursor VARCHAR(128)"));
+        assertTrue(source.contains("PRIMARY KEY(dispatch_item_id,batch_key,source_key,destination_key)"));
+    }
+    @Test void overseasInitializationReportsSuccessOnlyAfterEveryTableAndSeed() throws Exception {
+        String sql=Files.readString(Path.of("../deploy/sql/海外区域统一增量-MySQL8.sql"));
+        long count=Pattern.compile("(?m)^CREATE TABLE\\s+").matcher(sql).results().count();
+        String pass="SELECT 'PASS' AS initialization_status, 'OVERSEAS' AS region, "+count+" AS initialized_tables;";
+        assertTrue(sql.stripTrailing().endsWith(pass));
+        assertEquals(1,Pattern.compile("SELECT 'PASS' AS initialization_status").matcher(sql).results().count());
+        String reset=Files.readString(Path.of("../deploy/sql/reset-test-fba-appointments.sql"));
+        assertTrue(reset.indexOf("CALL assert_test_appointment_reset_preconditions()")<reset.indexOf("DROP TABLE ll_inbound_fba_appointment_item"));
+        assertTrue(reset.contains("'ll_fba_appointment_command','ll_appointment_cargo_verification'"));
+    }
+    private String definition(String sql,String table) {
+        var match=Pattern.compile("CREATE TABLE(?: IF NOT EXISTS)? "+Pattern.quote(table)+" \\([\\s\\S]*?\\) ENGINE=InnoDB[^\\r\\n]*;").matcher(sql);
+        assertTrue(match.find(),"Missing "+table);
+        String result=match.group().replace("CREATE TABLE IF NOT EXISTS","CREATE TABLE").replace("\r\n","\n");
+        assertFalse(match.find(),"Duplicate "+table);return result;
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/controller/InternalCustomerOrderProgressControllerTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/controller/InternalCustomerOrderProgressControllerTest.java
index 1a5ac72da..961594d10 100644
--- a/lastleg-service/src/test/java/com/baiyue/lastleg/controller/InternalCustomerOrderProgressControllerTest.java
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/controller/InternalCustomerOrderProgressControllerTest.java
@@ -11,10 +11,36 @@ class InternalCustomerOrderProgressControllerTest {
     @Test void validatesInternalIdentityBeforeReadingCustomerFacts() {
         var service=mock(CustomerOrderProgressService.class);
         var controller=new InternalCustomerOrderProgressController(new InternalServiceTokenGuard("test-token"),service);
-        var request=new CustomerOrderProgress.Request(11L);
+        var request=new CustomerOrderProgress.Request(11L, null);
         assertThatThrownBy(()->controller.read(null,request)).isInstanceOf(org.springframework.web.server.ResponseStatusException.class);
         assertThatThrownBy(()->controller.read("wrong",request)).isInstanceOf(org.springframework.web.server.ResponseStatusException.class);
         verifyNoInteractions(service);
-        controller.read("test-token",request);verify(service).read(11);
+        controller.read("test-token",request);verify(service).read(11, null);
+    }
+
+    @Test void optionalExactScopeRejectsEmptyOversizeNullOrNonPositiveItems() {
+        try(var factory=jakarta.validation.Validation.buildDefaultValidatorFactory()) {
+            var validator=factory.getValidator();
+            for(java.util.List<Long> ids: java.util.List.of(java.util.List.<Long>of(),java.util.List.of(0L),
+                java.util.Arrays.asList(1L,null),java.util.stream.LongStream.rangeClosed(1,201).boxed().toList())) {
+                assertThat(validator.validate(new CustomerOrderProgress.Request(11L,ids))).isNotEmpty();
+            }
+            for(java.util.List<Long> ids: java.util.Arrays.asList(null,java.util.List.of(1L),java.util.stream.LongStream.rangeClosed(1,200).boxed().toList())) {
+                assertThat(validator.validate(new CustomerOrderProgress.Request(11L,ids))).isEmpty();
+            }
+        }
+    }
+
+
+    @Test @SuppressWarnings("unchecked") void documentsBoundedOptionalExactOrderScope() throws Exception {
+        var document=(java.util.Map<String,Object>)new org.yaml.snakeyaml.Yaml().load(
+            new org.springframework.core.io.ClassPathResource("openapi/lastleg-customer-order-progress-v1.yaml").getContentAsString(java.nio.charset.StandardCharsets.UTF_8));
+        var paths=(java.util.Map<String,Object>)document.get("paths");
+        var operation=(java.util.Map<String,Object>)((java.util.Map<String,Object>)paths.get("/internal/lastleg/v1/customer-order-progress")).get("post");
+        var content=(java.util.Map<String,Object>)((java.util.Map<String,Object>)operation.get("requestBody")).get("content");
+        var schema=(java.util.Map<String,Object>)((java.util.Map<String,Object>)content.get("application/json")).get("schema");
+        var ids=(java.util.Map<String,Object>)((java.util.Map<String,Object>)schema.get("properties")).get("orderIds");
+        assertThat(ids).containsEntry("minItems",1).containsEntry("maxItems",200).containsEntry("nullable",true);
+        assertThat((java.util.List<String>)schema.get("required")).doesNotContain("orderIds");
     }
 }
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/delivery/DeliverySchemaContractTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/delivery/DeliverySchemaContractTest.java
index 68df52f74..f96710cda 100644
--- a/lastleg-service/src/test/java/com/baiyue/lastleg/delivery/DeliverySchemaContractTest.java
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/delivery/DeliverySchemaContractTest.java
@@ -30,6 +30,18 @@ class DeliverySchemaContractTest {
         }
     }
     @Test
+    void directOutboundSnapshotsKeepUnknownVolumeNullableAcrossBothBaselines() throws Exception {
+        for (Path path : java.util.List.of(Path.of("src/main/resources/db/lastleg.sql"), Path.of("../deploy/sql/海外区域统一增量-MySQL8.sql"))) {
+            String sql = Files.readString(path, StandardCharsets.UTF_8);
+            for (String table : java.util.List.of("ll_outbound_order", "ll_outbound_pallet_item", "ll_delivery_order")) {
+                var matcher = java.util.regex.Pattern.compile("(?is)CREATE TABLE(?: IF NOT EXISTS)? " + table + " \\(.*?;").matcher(sql);
+                assertTrue(matcher.find(), table);
+                String column = "ll_delivery_order".equals(table) ? "total_volume_cbm" : "volume_cbm";
+                assertTrue(java.util.regex.Pattern.compile("(?i)" + column + " DECIMAL\\(18,4\\) NULL COMMENT").matcher(matcher.group()).find(), table + " keeps unknown volume NULL");
+            }
+        }
+    }
+    @Test
     void baselineDefinesOutboundPalletsAndDeliveryContracts() throws Exception {
         String schema = Files.readString(Path.of("src/main/resources/db/lastleg.sql"), StandardCharsets.UTF_8)
             .toLowerCase();
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/delivery/fleet/FleetPoolDeliveryAdapterTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/delivery/fleet/FleetPoolDeliveryAdapterTest.java
new file mode 100644
index 000000000..18617b272
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/delivery/fleet/FleetPoolDeliveryAdapterTest.java
@@ -0,0 +1,43 @@
+package com.baiyue.lastleg.delivery.fleet;
+
+import com.baiyue.lastleg.delivery.mapper.DeliverySourceEvidenceMapper;
+import com.baiyue.lastleg.delivery.model.SourceDeliveryCompletionPolicy.*;
+import org.junit.jupiter.api.Test;
+import java.time.LocalDateTime;
+import java.util.List;
+import static org.assertj.core.api.Assertions.*;
+import static org.mockito.Mockito.*;
+
+class FleetPoolDeliveryAdapterTest {
+    private final DeliverySourceEvidenceMapper evidence=mock(DeliverySourceEvidenceMapper.class);
+    private final FleetPoolDeliveryAdapter adapter=new FleetPoolDeliveryAdapter(evidence);
+    private final LocalDateTime signed=LocalDateTime.of(2026,10,12,12,0);
+    private void shipment(int total,long signatures,List<Pick> picks,List<Returned> returns){
+        when(evidence.dispatchIds("9",77)).thenReturn(List.of(70L));
+        when(evidence.deliveries("9",70)).thenReturn(List.of(new Delivery(71,70,"CODE:ONT8",total,signatures,signed,signed.minusHours(1))));
+        when(evidence.picks("9",70)).thenReturn(picks);when(evidence.returns("9",70)).thenReturn(returns);
+    }
+    private Pick pick(long id,long source,int quantity){return new Pick(id,70,"CODE:ONT8",source,quantity,id,null,null,null);}
+    @Test void completeActualSourceIsSignedButPartialSignatureIsNot(){
+        shipment(4,2,List.of(pick(1,77,4)),List.of());assertThat(adapter.fullySigned("9","WT-7",77,4)).isFalse();
+        shipment(4,4,List.of(pick(1,77,4)),List.of());assertThat(adapter.fullySigned("9","WT-7",77,4)).isTrue();
+    }
+    @Test void anotherCoShippedSourceReturnDoesNotBlockThisFullySignedSource(){
+        shipment(8,6,List.of(pick(1,77,4),pick(2,78,4)),List.of(new Returned(9,71,78,2,signed.minusMinutes(5))));
+        assertThat(adapter.fullySigned("9","WT-7",77,4)).isTrue();
+    }
+    @Test void thisSourceReturnCannotBeCountedAsWholeSignature(){
+        shipment(4,2,List.of(pick(1,77,4)),List.of(new Returned(9,71,77,2,signed.minusMinutes(5))));
+        assertThat(adapter.fullySigned("9","WT-7",77,4)).isFalse();
+    }
+    @Test void missingOrDuplicatedDispatchEvidenceIsUnproved(){
+        for(var ids:List.of(List.<Long>of(),List.of(70L,70L),List.of(0L))){
+            when(evidence.dispatchIds("9",77)).thenReturn(ids);assertThat(adapter.fullySigned("9","WT-7",77,4)).isFalse();
+        }
+        verify(evidence,never()).deliveries(anyString(),anyLong());
+    }
+    @Test void missingPickOrReturnHistoryIsUnproved(){
+        shipment(4,4,List.of(),List.of());assertThat(adapter.fullySigned("9","WT-7",77,4)).isFalse();
+        shipment(4,4,List.of(pick(1,77,4)),null);assertThat(adapter.fullySigned("9","WT-7",77,4)).isFalse();
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/delivery/service/DeliveryTransferServiceTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/delivery/service/DeliveryTransferServiceTest.java
index 8c05d0096..a632493aa 100644
--- a/lastleg-service/src/test/java/com/baiyue/lastleg/delivery/service/DeliveryTransferServiceTest.java
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/delivery/service/DeliveryTransferServiceTest.java
@@ -67,6 +67,7 @@ import static org.junit.jupiter.api.Assertions.assertNull;
 import static org.junit.jupiter.api.Assertions.assertThrows;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.anyString;
 import static org.mockito.ArgumentMatchers.anyLong;
 import static org.mockito.Mockito.inOrder;
 import static org.mockito.Mockito.mock;
@@ -209,105 +210,52 @@ class DeliveryTransferServiceTest {
 
         var candidates = service.returnOutboundCandidates("TENANT-A", "WH-1");
 
-        assertEquals(List.of("RC-PAL"), candidates.stream().map(DeliveryResponses.ReturnOutboundCandidate::cartonMark).toList());
+        assertEquals(List.of("RC-PAL", "RC-PARCEL"), candidates.stream().map(DeliveryResponses.ReturnOutboundCandidate::cartonMark).toList());
+    }
+
+
+
+
+
+
+
+    @Test
+    void directPartialReturnOutboundRequiresPackingBeforeAnyInventoryLock() {
+        for (var request : List.of(
+            new DeliveryRequests.ReturnOutbound("receiver", "WH-1", "RT-1", List.of("RP-1"), null, "partial-sku", "SKU-A", "BOX", 1L),
+            new DeliveryRequests.ReturnOutbound("receiver", "WH-1", "RT-1", List.of("BOX-1"), null, "partial-box", null, "BOX", null,
+                List.of(new DeliveryRequests.ReturnSkuOutboundItem("BOX-1", "SKU-A", 1L))))) {
+            var error = assertThrows(ResponseStatusException.class, () -> service.createReturnOutbound("TENANT-A", "U-1", request));
+            assertTrue(error.getReason().contains("先合箱"));
+        }
+        verify(returnCartons, never()).lockMark(anyString());
+        verify(outboundOrders, never()).insert(any(OutboundOrder.class));
     }
 
     @Test
-    void singleSkuReturnOutboundReservesParcelAndCreatesDelivery() {
-        ReturnInventoryCarton parcel = returnCarton("RC-PARCEL", null);
-        parcel.setId(901L); parcel.setSourceUnitType("PARCEL"); parcel.setTotalQuantity(3L);
-        ReturnInventoryCartonItem line = new ReturnInventoryCartonItem();
-        line.setSkuCode("SKU-A"); line.setQuantity(3L);
-        when(returnCartons.lockMark("RC-PARCEL")).thenReturn(parcel);
-        when(returnCartonItems.lockCarton(901L)).thenReturn(List.of(line));
-
-        service.createReturnOutbound("TENANT-A", "U-1",
-            new DeliveryRequests.ReturnOutbound("receiver", "WH-1", "RT-1",
-                List.of("RC-PARCEL"), null, "sku-return-1", "SKU-A"));
-
-        ArgumentCaptor<OutboundPalletItem> item = ArgumentCaptor.forClass(OutboundPalletItem.class);
-        ArgumentCaptor<DeliveryOrder> delivery = ArgumentCaptor.forClass(DeliveryOrder.class);
-        verify(outboundPallets).insert(item.capture());
-        verify(deliveryOrders).insert(delivery.capture());
-        assertEquals("SKU-A", item.getValue().getSkuCode());
-        assertEquals("RC-PARCEL", item.getValue().getCartonMarks());
+    void wholeMultiSkuParcelCreatesBarcodePickWithoutSkuQuantity() {
+        var parcel = returnCarton("RP-1", null); parcel.setId(901L); parcel.setSourceUnitType("PARCEL"); parcel.setTotalQuantity(5L);
+        var a = new ReturnInventoryCartonItem(); a.setSkuCode("SKU-A"); a.setQuantity(3L);
+        var b = new ReturnInventoryCartonItem(); b.setSkuCode("SKU-B"); b.setQuantity(2L);
+        when(returnCartons.lockMark("RP-1")).thenReturn(parcel);
+        when(returnCartonItems.lockCarton(901L)).thenReturn(List.of(a,b));
+        service.createReturnOutbound("TENANT-A", "U-1", new DeliveryRequests.ReturnOutbound("receiver","WH-1","RT-1",List.of("RP-1"),null,"whole-package",null,"BOX"));
+        var capture=ArgumentCaptor.forClass(OutboundPalletItem.class); verify(outboundPallets).insert(capture.capture());
+        assertEquals("RP-1", capture.getValue().getCartonMarks());
+        assertNull(capture.getValue().getSkuCode()); assertNull(capture.getValue().getReturnSkuQuantity());
         assertEquals("OUTBOUND_PENDING", parcel.getStatus());
-        assertEquals("WAIT_DELIVERY", delivery.getValue().getStatus());
-        assertEquals(1, delivery.getValue().getPackageCount());
     }
 
     @Test
-    void partialSkuOutboundDistributesSixPiecesAcrossTwoFivePieceSources() {
-        var first = returnCarton("RC-1", null); first.setId(901L); first.setTotalQuantity(5L);
-        var second = returnCarton("RC-2", null); second.setId(902L); second.setTotalQuantity(5L);
-        first.setSourceUnitType("PARCEL"); second.setSourceUnitType("PARCEL");
-        when(returnCartons.lockMark("RC-1")).thenReturn(first); when(returnCartons.lockMark("RC-2")).thenReturn(second);
-        var line = new ReturnInventoryCartonItem(); line.setSkuCode("SKU-A"); line.setQuantity(5L);
-        when(returnCartonItems.lockCarton(901L)).thenReturn(List.of(line));
-        when(returnCartonItems.lockCarton(902L)).thenReturn(List.of(line));
-        service.createReturnOutbound("TENANT-A", "U-1", new DeliveryRequests.ReturnOutbound("receiver", "WH-1", "RT-1",
-            List.of("RC-1", "RC-2"), null, "partial-six", "SKU-A", "BOX", 6L));
-        var capture = ArgumentCaptor.forClass(OutboundPalletItem.class);
-        verify(outboundPallets, org.mockito.Mockito.times(2)).insert(capture.capture());
-        assertEquals(List.of(5L, 1L), capture.getAllValues().stream().map(OutboundPalletItem::getReturnSkuQuantity).toList());
-    }
-
-    @Test
-    void singleSkuReturnOutboundRejectsPackedSingleSkuWithoutReservingInventory() {
-        ReturnInventoryCarton carton = returnCarton("RC-BOX", "PAL-1");
-        carton.setSourceUnitType("BOX"); carton.setTotalQuantity(5L);
-        when(returnCartons.lockMark("RC-BOX")).thenReturn(carton);
-        var error = assertThrows(ResponseStatusException.class, () -> service.createReturnOutbound("TENANT-A", "U-1",
-            new DeliveryRequests.ReturnOutbound("receiver", "WH-1", "RT-1", List.of("RC-BOX"), null, "packed-sku", "SKU-A")));
-        assertTrue(error.getReason().contains("单SKU出库只允许散件库存"));
-        verify(outboundOrders, never()).insert(any(OutboundOrder.class));
-        verify(returnCartons, never()).updateById(any(ReturnInventoryCarton.class));
-        assertEquals("AVAILABLE", carton.getStatus());
-    }
-
-    @Test
-    void multipleLooseSkusCreateOneOutboundWithExactPerSourceQuantities() {
-        var first = returnCarton("SP-A", null); first.setId(901L); first.setSourceUnitType("PARCEL"); first.setTotalQuantity(5L);
-        var second = returnCarton("SP-B", null); second.setId(902L); second.setSourceUnitType("PARCEL"); second.setTotalQuantity(8L);
-        when(returnCartons.lockMark("SP-A")).thenReturn(first); when(returnCartons.lockMark("SP-B")).thenReturn(second);
-        var a = new ReturnInventoryCartonItem(); a.setSkuCode("SKU-A"); a.setQuantity(5L);
-        var b = new ReturnInventoryCartonItem(); b.setSkuCode("SKU-B"); b.setQuantity(8L);
-        when(returnCartonItems.lockCarton(901L)).thenReturn(List.of(a)); when(returnCartonItems.lockCarton(902L)).thenReturn(List.of(b));
-        service.createReturnOutbound("TENANT-A", "U-1", new DeliveryRequests.ReturnOutbound("receiver", "WH-1", "RT-1",
-            List.of("SP-A", "SP-B"), null, "multi-loose", null, "BOX", null,
-            List.of(new DeliveryRequests.ReturnSkuOutboundItem("SP-A", "SKU-A", 2L), new DeliveryRequests.ReturnSkuOutboundItem("SP-B", "SKU-B", 3L))));
-        var capture = ArgumentCaptor.forClass(OutboundPalletItem.class);
-        verify(outboundPallets, org.mockito.Mockito.times(2)).insert(capture.capture());
-        assertEquals(List.of("SKU-A", "SKU-B"), capture.getAllValues().stream().map(OutboundPalletItem::getSkuCode).toList());
-        assertEquals(List.of(2L, 3L), capture.getAllValues().stream().map(OutboundPalletItem::getReturnSkuQuantity).toList());
-        verify(outboundOrders).insert(any(OutboundOrder.class)); verify(deliveryOrders).insert(any(DeliveryOrder.class));
-    }
-
-    @Test
-    void looseItemQuantityCannotExceedItsOwnSource() {
-        var first = returnCarton("SP-A", null); first.setId(901L); first.setSourceUnitType("PARCEL"); first.setTotalQuantity(1L);
-        when(returnCartons.lockMark("SP-A")).thenReturn(first);
-        var a = new ReturnInventoryCartonItem(); a.setSkuCode("SKU-A"); a.setQuantity(1L);
-        when(returnCartonItems.lockCarton(901L)).thenReturn(List.of(a));
-        var error = assertThrows(ResponseStatusException.class, () -> service.createReturnOutbound("TENANT-A", "U-1", new DeliveryRequests.ReturnOutbound("receiver", "WH-1", "RT-1",
-            List.of("SP-A"), null, "over-source", null, "BOX", null, List.of(new DeliveryRequests.ReturnSkuOutboundItem("SP-A", "SKU-A", 2L)))));
-        assertTrue(error.getReason().contains("超过")); verify(outboundOrders, never()).insert(any(OutboundOrder.class));
-    }
-
-    @Test
-    void singleSkuReturnOutboundRejectsMixedCarton() {
-        ReturnInventoryCarton mixed = returnCarton("RC-MIXED", null);
-        mixed.setSourceUnitType("PARCEL");
-        mixed.setId(901L); mixed.setTotalQuantity(5L);
-        ReturnInventoryCartonItem skuA = new ReturnInventoryCartonItem(); skuA.setSkuCode("SKU-A"); skuA.setQuantity(3L);
-        ReturnInventoryCartonItem skuB = new ReturnInventoryCartonItem(); skuB.setSkuCode("SKU-B"); skuB.setQuantity(2L);
-        when(returnCartons.lockMark("RC-MIXED")).thenReturn(mixed);
-        when(returnCartonItems.lockCarton(901L)).thenReturn(List.of(skuA, skuB));
-
-        assertEquals(409, assertThrows(ResponseStatusException.class, () -> service.createReturnOutbound("TENANT-A", "U-1",
-            new DeliveryRequests.ReturnOutbound("receiver", "WH-1", "RT-1",
-                List.of("RC-MIXED"), null, "sku-return-2", "SKU-A"))).getStatusCode().value());
-        verify(outboundOrders, never()).insert(any(OutboundOrder.class));
+    void newlyReceivedParcelCanOutboundBeforeItsLabelIsConfirmed() {
+        var parcel = returnCarton("RP-1", null); parcel.setLabelStatus("WAIT_LABEL");
+        when(returnCartons.lockMark("RP-1")).thenReturn(parcel);
+        var line = new ReturnInventoryCartonItem(); line.setSkuCode("SKU-A"); line.setQuantity(3L);
+        when(returnCartonItems.lockCarton(anyLong())).thenReturn(List.of(line));
+        service.createReturnOutbound("TENANT-A", "U-1",
+            new DeliveryRequests.ReturnOutbound("receiver", "WH-1", "RT-1", List.of("RP-1"), null, "waiting-label"));
+        verify(outboundOrders).insert(any(OutboundOrder.class));
+        assertEquals("OUTBOUND_PENDING", parcel.getStatus());
     }
 
     @Test
@@ -347,6 +295,7 @@ class DeliveryTransferServiceTest {
         outbound.setOverseasWarehouseId("WH-1"); outbound.setOutboundType("RETURN_OUTBOUND");
         OutboundPalletItem item = new OutboundPalletItem(); item.setCartonMarks("RC-1");
         ReturnInventoryCarton carton = returnCarton("RC-1", null); carton.setId(901L);
+        item.setDestinationWarehouseCode("OTHER-SNAPSHOT"); carton.setDestinationWarehouseCode("ORIGINAL-RETURN");
         ReturnInventoryCartonItem line = new ReturnInventoryCartonItem();
         line.setSkuCode("SKU-A"); line.setProductNameZh("测试品"); line.setQuantity(3L);
         when(deliveryOrders.findByNo("TENANT-A", "DL-501")).thenReturn(delivery);
@@ -361,6 +310,44 @@ class DeliveryTransferServiceTest {
         assertEquals("SKU-A", detail.skus().get(0).skuCode());
         assertEquals(3L, detail.skus().get(0).productQuantity());
         assertEquals(1, detail.skus().get(0).packageCount());
+        assertEquals("ORIGINAL-RETURN", detail.skus().get(0).destinationWarehouseCode());
+    }
+
+    @org.junit.jupiter.params.ParameterizedTest
+    @org.junit.jupiter.params.provider.ValueSource(booleans = {true, false})
+    void relabelDeliveryDetailCarriesFrozenPhysicalMeasurementOnFirstSkuOnly(boolean measured) {
+        DeliveryOrder delivery = new DeliveryOrder(); delivery.setId(501L); delivery.setCustomerId("TENANT-A");
+        delivery.setDeliveryNo("DL-501"); delivery.setOutboundOrderId(301L); delivery.setOutboundNo("OUT-301");
+        delivery.setOverseasWarehouseId("WH-1"); delivery.setCustomerName("客户快照"); delivery.setOverseasWarehouseName("仓库快照");
+        delivery.setDeliveryGroupKey("RETURN_RELABEL:ABE4"); delivery.setDestinationWarehouseCode("ABE4");
+        delivery.setStatus("WAIT_DELIVERY");
+        OutboundOrder outbound = outbound(301L, null, null, "OUT-301", "relabel-1"); outbound.setOutboundType("RELABEL_OUTBOUND");
+        OutboundPalletItem item = new OutboundPalletItem(); item.setCartonMarks("RC-1"); item.setDestinationWarehouseCode("ABE4");
+        OutboundPalletItem otherDestination = new OutboundPalletItem();
+        otherDestination.setCartonMarks("RC-OTHER"); otherDestination.setDestinationWarehouseCode("ONT8");
+        if (measured) { item.setGrossWeightKg(BigDecimal.ONE); item.setVolumeCbm(new BigDecimal("0.008")); }
+        ReturnInventoryCarton carton = returnCarton("RC-1", null); carton.setId(901L);
+        carton.setWeight(new BigDecimal("99")); // Reading the current carton must not replace the frozen outbound measurement.
+        carton.setDestinationWarehouseCode(measured ? "CHANGED-AFTER-OUTBOUND" : null);
+        var first = new ReturnInventoryCartonItem(); first.setSkuCode("SKU-A"); first.setQuantity(3L);
+        var second = new ReturnInventoryCartonItem(); second.setSkuCode("SKU-B"); second.setQuantity(2L);
+        when(deliveryOrders.findByNo("TENANT-A", "DL-501")).thenReturn(delivery);
+        when(outboundOrders.selectById(301L)).thenReturn(outbound);
+        when(outboundPallets.findByOutbound("TENANT-A", 301L)).thenReturn(List.of(item, otherDestination));
+        when(returnCartons.findCustomerMark("TENANT-A", "RC-1")).thenReturn(carton);
+        when(returnCartonItems.listCarton(901L)).thenReturn(List.of(first, second));
+
+        var detail = service.deliveryDetail("TENANT-A", "DL-501");
+
+        assertEquals("客户快照", detail.order().customerName()); assertEquals("仓库快照", detail.order().overseasWarehouseName());
+        assertEquals(2, detail.skus().size()); assertEquals(1, detail.skus().stream().mapToInt(row -> row.packageCount()).sum());
+        assertTrue(detail.skus().stream().allMatch(row -> "ABE4".equals(row.destinationWarehouseCode())));
+        verify(returnCartons, never()).findCustomerMark("TENANT-A", "RC-OTHER");
+        assertEquals(5L, detail.skus().stream().mapToLong(row -> row.productQuantity()).sum());
+        assertEquals(measured ? BigDecimal.ONE : null, detail.skus().get(0).weightKg());
+        assertEquals(measured ? new BigDecimal("0.008") : null, detail.skus().get(0).volumeCbm());
+        assertEquals(0, detail.skus().get(1).packageCount());
+        assertNull(detail.skus().get(1).weightKg()); assertNull(detail.skus().get(1).volumeCbm());
     }
 
     @Test
@@ -724,6 +711,16 @@ class DeliveryTransferServiceTest {
         assertEquals(4, detail.pallets().get(0).packageCount());
     }
 
+    @org.junit.jupiter.params.ParameterizedTest
+    @org.junit.jupiter.params.provider.ValueSource(strings = {"DISCARD_OUTBOUND", "ONE_CLICK_DROPSHIP"})
+    void discardDoesNotExposeHistoricInboundCodeAsLxButDropshipKeepsRealLx(String type) {
+        OutboundOrder outbound = outbound(301L, null, null, "OUT-301", "outbound-301");
+        outbound.setOutboundType(type); outbound.setLxCodes("LX-REAL-001");
+        when(outboundOrders.findGlobalByNo("OUT-301")).thenReturn(outbound);
+        var detail = service.outboundDetail("OUT-301");
+        assertEquals("DISCARD_OUTBOUND".equals(type) ? null : "LX-REAL-001", detail.outbound().lxCodes());
+    }
+
     @Test
     void dispatchOutboundStillRequiresItsDeliveryDocument() {
         OutboundOrder outbound = outbound(301L, 101L, "DSP-101", "OUT-301", "dispatch-301");
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/delivery/service/ReturnOutboundClosureTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/delivery/service/ReturnOutboundClosureTest.java
index a227a7df6..d6a5b1436 100644
--- a/lastleg-service/src/test/java/com/baiyue/lastleg/delivery/service/ReturnOutboundClosureTest.java
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/delivery/service/ReturnOutboundClosureTest.java
@@ -71,27 +71,13 @@ class ReturnOutboundClosureTest {
         verify(outbounds, times(1)).insert(any(OutboundOrder.class));
     }
 
-    @Test void singleSkuPackedBoxIsExcludedFromLooseOutbound() {
-        assertThatThrownBy(() -> service.createReturnOutbound("C1", "USER", command("SKU1")))
-            .isInstanceOf(ResponseStatusException.class).hasMessageContaining("散件库存");
-        verify(items, never()).insert(any(OutboundPalletItem.class));
-        assertThat(carton.getStatus()).isEqualTo("AVAILABLE");
-    }
 
-    @Test void singleSkuCannotConsumeMixedSkuCarton() {
-        ReturnInventoryCartonItem other = new ReturnInventoryCartonItem(); other.setSkuCode("SKU2"); other.setQuantity(1L);
-        var first = contents.lockCarton(10L).get(0);
-        when(contents.lockCarton(10L)).thenReturn(List.of(first, other));
-        assertThatThrownBy(() -> service.createReturnOutbound("C1", "USER", command("SKU1")))
-            .isInstanceOf(ResponseStatusException.class).hasMessageContaining("SKU");
-        verify(outbounds, never()).insert(any(OutboundOrder.class));
-    }
 
-    @Test void singleSkuParcelReservesAndKeepsScanSku() {
+
+    @Test void wholeParcelUsesItsPhysicalBarcode() {
         carton.setSourceUnitType("PARCEL");
-        service.createReturnOutbound("C1", "USER", command("SKU1"));
-        verify(items).insert(argThat((OutboundPalletItem i) -> "SKU1".equals(i.getSkuCode())));
-        assertThat(carton.getStatus()).isEqualTo("OUTBOUND_PENDING");
+        service.createReturnOutbound("C1", "USER", command(null));
+        verify(items).insert(argThat((OutboundPalletItem i) -> i.getSkuCode() == null && i.getReturnSkuQuantity() == null && "RC#1-1".equals(i.getCartonMarks())));
     }
 
     @Test void refusesPackingReservedQuantity() {
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/delivery/service/ReturnOutboundPdaPersistenceTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/delivery/service/ReturnOutboundPdaPersistenceTest.java
index dc82ab31a..793fc2459 100644
--- a/lastleg-service/src/test/java/com/baiyue/lastleg/delivery/service/ReturnOutboundPdaPersistenceTest.java
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/delivery/service/ReturnOutboundPdaPersistenceTest.java
@@ -46,7 +46,7 @@ class ReturnOutboundPdaPersistenceTest {
         // Persist production entities through production MyBatis mappers, with real transactions.
         for (Class<?> entity : List.of(OutboundOrder.class, OutboundPalletItem.class, OutboundPdaTask.class,
                 OutboundPdaPick.class, DeliveryOrder.class, ReturnInventoryCarton.class, ReturnInventoryCartonItem.class, ReturnInventoryBalance.class,
-                ReturnInventoryOutboundMovement.class, ReturnOrder.class, ReturnOrderItem.class, ReturnReceipt.class, ReturnReceiptItem.class)) {
+                ReturnInventoryOutboundMovement.class, ReturnSkuConversion.class, ReturnOrder.class, ReturnOrderItem.class, ReturnReceipt.class, ReturnReceiptItem.class)) {
             String columns = Arrays.stream(entity.getDeclaredFields()).filter(field -> !Modifier.isStatic(field.getModifiers()))
                 .map(field -> field.getName().replaceAll("([A-Z])", "_$1").toLowerCase() + " "
                     + (field.getType() == String.class ? "VARCHAR(2000)" : field.getType() == LocalDateTime.class ? "TIMESTAMP"
@@ -123,29 +123,6 @@ class ReturnOutboundPdaPersistenceTest {
         assertEquals(1, after.items().stream().flatMap(item -> item.positions().stream()).mapToLong(row -> row.availablePackages()).sum());
     }
 
-    @Test void multipleLooseSkusPersistPickAndDeductTheirOwnPieceQuantitiesWithReplayProtection() {
-        jdbc.update("UPDATE ll_return_inventory_carton SET source_unit_type='PARCEL' WHERE id IN (1,2)");
-        jdbc.update("UPDATE ll_return_inventory_carton_item SET sku_code='SKU-B' WHERE id=2");
-        jdbc.update("UPDATE ll_return_inventory_balance SET total_quantity=5,available_quantity=5,carton_quantity=1 WHERE id=1");
-        jdbc.update("INSERT INTO ll_return_inventory_balance(id,customer_id,overseas_warehouse_id,sku_code,total_quantity,available_quantity,carton_quantity) VALUES(10,'C1','WH-1','SKU-B',5,5,1)");
-        var task = service.createReturnOutbound("C1", "operator", new DeliveryRequests.ReturnOutbound("recipient", "WH-1", "RT-1",
-            List.of("BOX-A", "BOX-B"), null, "multi-sku", null, "BOX", null,
-            List.of(new DeliveryRequests.ReturnSkuOutboundItem("BOX-A", "SKU-A", 2L), new DeliveryRequests.ReturnSkuOutboundItem("BOX-B", "SKU-B", 3L))));
-        var detail = service.pdaTaskDetail("WH-1", task.taskNo());
-        assertEquals(2, detail.items().size());
-        for (var item : detail.items()) {
-            String sku = item.skuCode(); long quantity = "SKU-A".equals(sku) ? 2 : 3;
-            var request = new DeliveryRequests.PdaPick(item.outboundPalletItemId(), null, 1L, "pick-" + sku, List.of(), sku, quantity);
-            service.pdaPick("WH-1", "operator", task.taskNo(), request);
-            service.pdaPick("WH-1", "operator", task.taskNo(), request);
-        }
-        assertEquals(3L, jdbc.queryForObject("SELECT available_quantity FROM ll_return_inventory_balance WHERE id=1", Long.class));
-        assertEquals(2L, jdbc.queryForObject("SELECT available_quantity FROM ll_return_inventory_balance WHERE id=10", Long.class));
-        assertEquals(5L, jdbc.queryForObject("SELECT SUM(quantity) FROM ll_return_inventory_outbound_movement", Long.class));
-        assertEquals(2, jdbc.queryForObject("SELECT COUNT(*) FROM ll_outbound_pda_pick", Integer.class));
-        assertEquals(1, jdbc.queryForObject("SELECT COUNT(*) FROM ll_outbound_order", Integer.class));
-        assertEquals(1, jdbc.queryForObject("SELECT COUNT(*) FROM ll_delivery_order", Integer.class));
-    }
     @Test void wholeReturnPalletRejectsPartialScansAndChangedContentsThenShipsAtomically() {
         jdbc.update("UPDATE ll_return_inventory_carton SET pallet_code='PAL-1' WHERE id IN (1,2)");
         var task = service.createReturnOutbound("C1", "operator", new DeliveryRequests.ReturnOutbound(
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/discard/CargoDiscardSchemaContractTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/discard/CargoDiscardSchemaContractTest.java
index 9d4a5bd77..126566500 100644
--- a/lastleg-service/src/test/java/com/baiyue/lastleg/discard/CargoDiscardSchemaContractTest.java
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/discard/CargoDiscardSchemaContractTest.java
@@ -3,10 +3,51 @@ package com.baiyue.lastleg.discard;
 import org.junit.jupiter.api.Test;
 
 import java.nio.charset.StandardCharsets;
+import java.sql.DriverManager;
+import java.sql.SQLException;
+import com.baiyue.lastleg.returnreceipt.mapper.ReturnInventoryCartonItemMapper;
+import org.apache.ibatis.annotations.Update;
 
 import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertThrows;
 
 class CargoDiscardSchemaContractTest {
+    @Test
+    void returnCartonDeductionAllowsZeroButRejectsNegativeStock() throws Exception {
+        String baseline;
+        try (var input = getClass().getResourceAsStream("/db/lastleg.sql")) {
+            baseline = new String(input.readAllBytes(), StandardCharsets.UTF_8);
+        }
+        var constraint = java.util.regex.Pattern.compile(
+            "CONSTRAINT chk_ll_return_inventory_carton_item_quantity CHECK\\(([^)]+)\\)")
+            .matcher(baseline);
+        assertTrue(constraint.find());
+        String deduction = ReturnInventoryCartonItemMapper.class.getMethod("deduct", long.class, long.class)
+            .getAnnotation(Update.class).value()[0]
+            .replace("#{quantity}", "?").replace("#{id}", "?");
+        try (var connection = DriverManager.getConnection("jdbc:h2:mem:discard_zero_quantity;MODE=MySQL")) {
+            try (var statement = connection.createStatement()) {
+                statement.execute("CREATE TABLE ll_return_inventory_carton_item (id BIGINT PRIMARY KEY, "
+                    + "quantity BIGINT NOT NULL, CONSTRAINT chk_ll_return_inventory_carton_item_quantity CHECK("
+                    + constraint.group(1) + "))");
+                statement.execute("INSERT INTO ll_return_inventory_carton_item VALUES (1, 3)");
+                try (var update = connection.prepareStatement(deduction)) {
+                    update.setLong(1, 3); update.setLong(2, 1); update.setLong(3, 3);
+                    assertEquals(1, update.executeUpdate());
+                    update.setLong(1, 1); update.setLong(3, 1);
+                    assertEquals(0, update.executeUpdate());
+                }
+                try (var result = statement.executeQuery("SELECT quantity FROM ll_return_inventory_carton_item WHERE id=1")) {
+                    assertTrue(result.next());
+                    assertEquals(0, result.getLong(1));
+                }
+                assertThrows(SQLException.class, () -> statement.executeUpdate(
+                    "UPDATE ll_return_inventory_carton_item SET quantity=-1 WHERE id=1"));
+            }
+        }
+    }
+
     @Test
     void baselineContainsDiscardApplicationReservationAndHistoryTables() throws Exception {
         String sql;
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/discard/controller/MerchantCargoDiscardControllerTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/discard/controller/MerchantCargoDiscardControllerTest.java
index 33b22eb50..d61b43786 100644
--- a/lastleg-service/src/test/java/com/baiyue/lastleg/discard/controller/MerchantCargoDiscardControllerTest.java
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/discard/controller/MerchantCargoDiscardControllerTest.java
@@ -12,8 +12,25 @@ import java.util.Set;
 import static org.junit.jupiter.api.Assertions.assertThrows;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
 
 class MerchantCargoDiscardControllerTest {
+    @Test
+    void completionUsesAuthenticatedCustomerAndIndependentPermission() throws Exception {
+        controller.confirmCompletion(user(100L, "MERCHANT"), "CD001");
+        verify(service).confirmCompletion("100", "CD001", "1");
+        assertThrows(ResponseStatusException.class,
+            () -> controller.confirmCompletion(user(0L, "PLATFORM"), "CD001"));
+        var guard = MerchantCargoDiscardController.class.getMethod("confirmCompletion", AuthenticatedUser.class, String.class)
+            .getAnnotation(org.springframework.security.access.prepost.PreAuthorize.class);
+        org.junit.jupiter.api.Assertions.assertEquals(
+            "hasAuthority('merchant:overseas-warehouse:discard:confirm')", guard.value());
+        org.junit.jupiter.api.Assertions.assertFalse(java.util.Arrays.stream(CargoDiscardController.class.getDeclaredMethods())
+            .filter(method -> method.isAnnotationPresent(org.springframework.web.bind.annotation.PostMapping.class))
+            .flatMap(method -> java.util.Arrays.stream(method.getAnnotation(org.springframework.web.bind.annotation.PostMapping.class).value()))
+            .anyMatch(path -> path.endsWith("/complete") || path.endsWith("/confirm-completion")));
+    }
+
     private final CargoDiscardService service = mock(CargoDiscardService.class);
     private final MerchantCargoDiscardController controller = controller();
     private final CargoDiscardRequests.Query query = new CargoDiscardRequests.Query(
@@ -36,6 +53,17 @@ class MerchantCargoDiscardControllerTest {
             () -> controller.page(user(0L, "PLATFORM"), query));
     }
 
+    @Test void photoDownloadUsesTokenCustomerAndReturnsPrivateImageBytes() {
+        byte[] bytes = {1, 2, 3};
+        when(service.downloadPhoto("100", "DS001", 101L)).thenReturn(
+            new com.baiyue.lastleg.discard.gateway.CargoDiscardPhotoFileGateway.DownloadedFile(bytes, "discard.png", "image/png"));
+        var response = controller.downloadPhoto(user(100L, "MERCHANT"), "DS001", 101L);
+        org.junit.jupiter.api.Assertions.assertArrayEquals(bytes, response.getBody());
+        org.junit.jupiter.api.Assertions.assertEquals("no-store", response.getHeaders().getCacheControl());
+        verify(service).downloadPhoto("100", "DS001", 101L);
+        assertThrows(ResponseStatusException.class, () -> controller.downloadPhoto(user(0L, "PLATFORM"), "DS001", 101L));
+    }
+
     private static AuthenticatedUser user(long tenantId, String appCode) {
         return new AuthenticatedUser(1L, tenantId, tenantId, 9L, "merchant", appCode, "WEB", Set.of());
     }
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/discard/pda/service/PdaCargoDiscardServiceTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/discard/pda/service/PdaCargoDiscardServiceTest.java
index 6bbed447b..6d10762ba 100644
--- a/lastleg-service/src/test/java/com/baiyue/lastleg/discard/pda/service/PdaCargoDiscardServiceTest.java
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/discard/pda/service/PdaCargoDiscardServiceTest.java
@@ -37,10 +37,13 @@ class PdaCargoDiscardServiceTest {
     private CargoDiscardApplication application;
     private CargoDiscardItem item;
     private final PdaWarehouseIdentity identity = new PdaWarehouseIdentity("OP", "operator", 99L);
-    private PdaCargoDiscardDtos.Confirm request(int actual) { return new PdaCargoDiscardDtos.Confirm(List.of(new PdaCargoDiscardDtos.ActualLine(11L, actual))); }
+    private final com.baiyue.lastleg.discard.service.CargoDiscardPhotoService photoService = mock(com.baiyue.lastleg.discard.service.CargoDiscardPhotoService.class);
+    private PdaCargoDiscardDtos.Confirm request(int actual) { return new PdaCargoDiscardDtos.Confirm(List.of(new PdaCargoDiscardDtos.ActualLine(11L, actual)), List.of(101L)); }
 
     @BeforeEach void setup() {
         service = new PdaCargoDiscardService();
+        ReflectionTestUtils.setField(service, "outboundService", org.mockito.Mockito.mock(com.baiyue.lastleg.discard.service.CargoDiscardOutboundService.class));
+        ReflectionTestUtils.setField(service, "photoService", photoService);
         ReflectionTestUtils.setField(service, "applications", applications);
         ReflectionTestUtils.setField(service, "items", items);
         ReflectionTestUtils.setField(service, "cartons", cartons);
@@ -93,8 +96,8 @@ class PdaCargoDiscardServiceTest {
     void finishedQuantityCannotChange(String status) { finished(status); assertThrows(ResponseStatusException.class, () -> service.confirm(identity, "CD-1", "PALLET-1", request(0))); noWrites(); }
     @Test void missingOrForeignLineAndWrongPalletCannotRecover() {
         finished("PDA_COMPLETED");
-        assertThrows(ResponseStatusException.class, () -> service.confirm(identity, "CD-1", "PALLET-1", new PdaCargoDiscardDtos.Confirm(List.of())));
-        assertThrows(ResponseStatusException.class, () -> service.confirm(identity, "CD-1", "PALLET-1", new PdaCargoDiscardDtos.Confirm(List.of(new PdaCargoDiscardDtos.ActualLine(999L, 1)))));
+        assertThrows(ResponseStatusException.class, () -> service.confirm(identity, "CD-1", "PALLET-1", new PdaCargoDiscardDtos.Confirm(List.of(), List.of(101L))));
+        assertThrows(ResponseStatusException.class, () -> service.confirm(identity, "CD-1", "PALLET-1", new PdaCargoDiscardDtos.Confirm(List.of(new PdaCargoDiscardDtos.ActualLine(999L, 1)), List.of(101L))));
         assertThrows(ResponseStatusException.class, () -> service.confirm(identity, "CD-1", "OTHER-PALLET", request(1))); noWrites();
     }
     @Test void foreignWarehouseHasNoApplication() {
@@ -116,7 +119,90 @@ class PdaCargoDiscardServiceTest {
         when(items.listApplication("CUSTOMER", 1L)).thenReturn(List.of(item, pending)); when(profiles.selectById(23L)).thenReturn(other);
         assertThrows(ResponseStatusException.class, () -> service.confirm(identity, "CD-1", "PALLET-1", request(1))); noWrites();
     }
-    @Test void duplicateLineCannotRecover() { finished("COMPLETED"); assertThrows(ResponseStatusException.class, () -> service.confirm(identity, "CD-1", "PALLET-1", new PdaCargoDiscardDtos.Confirm(List.of(new PdaCargoDiscardDtos.ActualLine(11L, 1), new PdaCargoDiscardDtos.ActualLine(11L, 1))))); noWrites(); }
+    @Test void duplicateLineCannotRecover() { finished("COMPLETED"); assertThrows(ResponseStatusException.class, () -> service.confirm(identity, "CD-1", "PALLET-1", new PdaCargoDiscardDtos.Confirm(List.of(new PdaCargoDiscardDtos.ActualLine(11L, 1), new PdaCargoDiscardDtos.ActualLine(11L, 1)), List.of(101L)))); noWrites(); }
     @Test void loadedForeignCustomerItemCannotRecover() { finished("COMPLETED"); item.setCustomerId("OTHER"); assertThrows(ResponseStatusException.class, () -> service.confirm(identity, "CD-1", "PALLET-1", request(1))); noWrites(); }
     @Test void loadedDifferentApplicationItemCannotRecover() { finished("COMPLETED"); item.setApplicationId(2L); assertThrows(ResponseStatusException.class, () -> service.confirm(identity, "CD-1", "PALLET-1", request(1))); noWrites(); }
+
+    @Test
+    void fullDisposalUploadsConfirmsAndReplaysWithoutDoubleDeduction() {
+        int actual = 3;
+        var realPhotos = new com.baiyue.lastleg.discard.service.CargoDiscardPhotoService();
+        var photoMapper = mock(com.baiyue.lastleg.discard.mapper.CargoDiscardPhotoMapper.class);
+        var photoFiles = mock(com.baiyue.lastleg.discard.gateway.CargoDiscardPhotoFileGateway.class);
+        var stored = new java.util.ArrayList<com.baiyue.lastleg.discard.entity.CargoDiscardPhoto>();
+        ReflectionTestUtils.setField(realPhotos, "photos", photoMapper); ReflectionTestUtils.setField(realPhotos, "files", photoFiles);
+        ReflectionTestUtils.setField(service, "photoService", realPhotos);
+        when(photoMapper.listApplication("CUSTOMER", 1L)).thenAnswer(invocation -> stored);
+        when(photoMapper.insert(any(com.baiyue.lastleg.discard.entity.CargoDiscardPhoto.class))).thenAnswer(invocation -> { stored.add(invocation.getArgument(0)); return 1; });
+        when(photoFiles.upload(eq("CUSTOMER"), eq(1L), eq(9L), any())).thenReturn(new com.baiyue.lastleg.discard.gateway.CargoDiscardPhotoFileGateway.UploadedFile(101L, "discard.png", "image/png", 8L));
+        when(applications.readNoByWarehouse("CD-1", "99")).thenReturn(application);
+        item.setDiscardPackages(3);
+        assertThrows(ResponseStatusException.class, () -> service.confirm(identity, "CD-1", "PALLET-1", new PdaCargoDiscardDtos.Confirm(List.of(new PdaCargoDiscardDtos.ActualLine(11L, actual)), List.of())));
+        verifyNoInteractions(adjustments);
+        service.uploadPhoto(identity, "CD-1", "PALLET-1", 9L, new org.springframework.mock.web.MockMultipartFile("file", new byte[]{1}));
+        assertEquals(1, service.photos(identity, "CD-1", "PALLET-1").size());
+        assertTrue(realPhotos.list(application, null, true).isEmpty());
+        service.confirm(identity, "CD-1", "PALLET-1", request(actual));
+        assertEquals(CargoDiscardService.PDA_COMPLETED, application.getStatus());
+        assertEquals(actual, application.getTotalPackages());
+        assertEquals(new BigDecimal("5.00").multiply(BigDecimal.valueOf(actual)), application.getTotalFee());
+        assertEquals(1, realPhotos.list(application, null, true).size());
+        assertNotNull(realPhotos.list(application, null, true).get(0).submittedAt());
+        service.confirm(identity, "CD-1", "PALLET-1", request(actual));
+        verify(adjustments, times(1)).discardPalletItem(eq("CUSTOMER"), same(application), same(item), anyList(), eq(actual), eq("OP"), any());
+        verify(photoMapper, times(1)).updateById(any(com.baiyue.lastleg.discard.entity.CargoDiscardPhoto.class));
+        assertThrows(ResponseStatusException.class, () -> service.uploadPhoto(identity, "CD-1", "PALLET-1", 9L, new org.springframework.mock.web.MockMultipartFile("file", new byte[]{1})));
+    }
+    @ParameterizedTest @ValueSource(ints = {0, 1, 2})
+    void partialAndZeroDisposalDoNotWriteInventoryOrPhotos(int actual) {
+        item.setDiscardPackages(3);
+        assertThrows(ResponseStatusException.class, () -> service.confirm(identity, "CD-1", "PALLET-1", request(actual)));
+        noWrites(); verifyNoInteractions(photoService);
+    }
+    private void looseTask() {
+        var stockService = mock(com.baiyue.lastleg.discard.service.CargoDiscardStockService.class);
+        ReflectionTestUtils.setField(service, "stockService", stockService);
+        item.setSourceType("INVENTORY"); item.setInventoryPositionId(42L); item.setDiscardPackages(2);
+        var position = new com.baiyue.lastleg.inventory.entity.InventoryPosition();
+        position.setId(42L); position.setCustomerId("CUSTOMER"); position.setOverseasWarehouseId("99");
+        when(stockService.position("CUSTOMER", 42L)).thenReturn(position);
+        when(stockService.cartonMarks(item)).thenReturn(List.of("BOX-1", "BOX-2"));
+    }
+    private PdaCargoDiscardDtos.Confirm looseRequest(List<String> marks, boolean bulk) {
+        return new PdaCargoDiscardDtos.Confirm(List.of(new PdaCargoDiscardDtos.ActualLine(11L, 2)), List.of(101L), marks, bulk);
+    }
+    @Test void looseTaskExposesAllRealMarksAndRejectsMissingDuplicateAndUnknownScans() {
+        looseTask(); when(applications.selectList(any())).thenReturn(List.of(application));
+        var task = service.resolve(identity, "BOX-1", "CD-1");
+        assertEquals("CARTON", task.scanMode()); assertEquals(List.of("BOX-1", "BOX-2"), task.cartonMarks());
+        for (var marks : List.of(List.of("BOX-1"), List.of("BOX-1", "BOX-1"), List.of("BOX-1", "OTHER")))
+            assertThrows(ResponseStatusException.class, () -> service.confirm(identity, "CD-1", "散箱", looseRequest(marks, false)));
+        noWrites(); verifyNoInteractions(photoService);
+    }
+    @ParameterizedTest @ValueSource(booleans = {false, true})
+    void looseTaskCompletesAfterAllScansOrExplicitBulkAndReplays(boolean bulk) {
+        looseTask(); var request = looseRequest(bulk ? List.of() : List.of("BOX-2", "BOX-1"), bulk);
+        assertEquals("COMPLETED", service.confirm(identity, "CD-1", "散箱", request).status());
+        assertEquals(CargoDiscardService.PDA_COMPLETED, application.getStatus());
+        service.confirm(identity, "CD-1", "散箱", request);
+        verify(adjustments, times(1)).discardPalletItem(eq("CUSTOMER"), same(application), same(item), anyList(), eq(2), eq("OP"), any());
+        verify(photoService).confirm(same(application), eq("散箱"), eq(List.of(101L)), eq(false));
+    }
+
+    @Test void partialBoundPalletOnlyExposesSelectedBoxesAndRequiresTheirScan() {
+        looseTask(); item.setCartonScanRequired(true);
+        var stockService = (com.baiyue.lastleg.discard.service.CargoDiscardStockService) ReflectionTestUtils.getField(service, "stockService");
+        var position = new com.baiyue.lastleg.inventory.entity.InventoryPosition(); position.setOverseasWarehouseId("99"); position.setPalletNo("P-42");
+        when(stockService.position("CUSTOMER", 42L)).thenReturn(position);
+        when(applications.selectList(any())).thenReturn(List.of(application));
+        var task = service.resolve(identity, "P-42", "CD-1");
+        assertEquals("CARTON", task.scanMode()); assertEquals("P-42", task.palletNo());
+        assertEquals(List.of("BOX-1", "BOX-2"), task.cartonMarks());
+        assertThrows(ResponseStatusException.class, () -> service.confirm(identity, "CD-1", "P-42", looseRequest(List.of("BOX-1"), false)));
+        verifyNoInteractions(adjustments);
+        service.confirm(identity, "CD-1", "P-42", looseRequest(List.of("BOX-1", "BOX-2"), false));
+        service.confirm(identity, "CD-1", "P-42", looseRequest(List.of("BOX-1", "BOX-2"), false));
+        verify(adjustments, times(1)).discardPalletItem(eq("CUSTOMER"), same(application), same(item), anyList(), eq(2), eq("OP"), any());
+    }
+
 }
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/discard/service/CargoDiscardOutboundServiceTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/discard/service/CargoDiscardOutboundServiceTest.java
new file mode 100644
index 000000000..dc5997d36
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/discard/service/CargoDiscardOutboundServiceTest.java
@@ -0,0 +1,107 @@
+package com.baiyue.lastleg.discard.service;
+
+import com.baiyue.lastleg.delivery.entity.*;
+import com.baiyue.lastleg.delivery.mapper.*;
+import com.baiyue.lastleg.discard.entity.*;
+import com.baiyue.lastleg.discard.mapper.*;
+import com.baiyue.lastleg.dropship.entity.DropshipOrderProfile;
+import com.baiyue.lastleg.dropship.mapper.DropshipOrderProfileMapper;
+import com.baiyue.lastleg.returnreceipt.entity.ReturnInventoryCarton;
+import com.baiyue.lastleg.returnreceipt.mapper.ReturnInventoryCartonMapper;
+import com.baiyue.lastleg.service.LastlegOrderNoGenerator;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.springframework.test.util.ReflectionTestUtils;
+import org.springframework.web.server.ResponseStatusException;
+import java.util.*;
+import static org.junit.jupiter.api.Assertions.*;
+import static org.mockito.Mockito.*;
+import static org.mockito.ArgumentMatchers.*;
+
+class CargoDiscardOutboundServiceTest {
+    private final OutboundOrderMapper outbounds = mock(OutboundOrderMapper.class);
+    private final OutboundPalletItemMapper pallets = mock(OutboundPalletItemMapper.class);
+    private final CargoDiscardItemMapper items = mock(CargoDiscardItemMapper.class);
+    private final CargoDiscardCartonMapper cartons = mock(CargoDiscardCartonMapper.class);
+    private final DropshipOrderProfileMapper profiles = mock(DropshipOrderProfileMapper.class);
+    private final ReturnInventoryCartonMapper returnCartons = mock(ReturnInventoryCartonMapper.class);
+    private CargoDiscardOutboundService service;
+    private CargoDiscardApplication application;
+    private CargoDiscardItem first, second;
+    private OutboundOrder document;
+    private final List<OutboundPalletItem> snapshots = new ArrayList<>();
+
+    @BeforeEach void setup() {
+        service = new CargoDiscardOutboundService();
+        ReflectionTestUtils.setField(service, "outbounds", outbounds);
+        ReflectionTestUtils.setField(service, "pallets", pallets);
+        ReflectionTestUtils.setField(service, "items", items);
+        ReflectionTestUtils.setField(service, "cartons", cartons);
+        ReflectionTestUtils.setField(service, "profiles", profiles);
+        ReflectionTestUtils.setField(service, "returnCartons", returnCartons);
+        ReflectionTestUtils.setField(service, "orderNoGenerator", new LastlegOrderNoGenerator());
+        application = new CargoDiscardApplication(); application.setId(1L); application.setCustomerId("C1");
+        application.setDiscardNo("CD-TEST"); application.setOverseasWarehouseId("99");
+        application.setTotalPackages(5); application.setStatus("APPROVED");
+        application.setInboundCodes("RT-123,RK-456");
+        first = line(11L, 21L, 3); second = line(12L, 22L, 2);
+        when(items.listApplication("C1", 1L)).thenReturn(List.of(first, second));
+        when(cartons.listApplication("C1", 1L)).thenReturn(List.of());
+        for (long id : List.of(21L, 22L)) {
+            var profile = new DropshipOrderProfile(); profile.setId(id); profile.setCustomerId("C1"); profile.setPalletNo("P-" + id);
+            when(profiles.selectById(id)).thenReturn(profile);
+        }
+        when(outbounds.findByIdempotency("C1", "CARGO_DISCARD:1")).thenAnswer(i -> document);
+        when(outbounds.lockByIdempotency("C1", "CARGO_DISCARD:1")).thenAnswer(i -> document);
+        when(outbounds.insert(any(OutboundOrder.class))).thenAnswer(i -> { document = i.getArgument(0); return 1; });
+        when(pallets.insert(any(OutboundPalletItem.class))).thenAnswer(i -> { snapshots.add(i.getArgument(0)); return 1; });
+        when(pallets.findByOutbound(eq("C1"), anyLong())).thenAnswer(i -> snapshots);
+    }
+    private CargoDiscardItem line(long id, long profile, int quantity) {
+        var line = new CargoDiscardItem(); line.setId(id); line.setApplicationId(1L); line.setCustomerId("C1");
+        line.setProfileId(profile); line.setDiscardPackages(quantity); line.setSkuCode("SKU-" + id); return line;
+    }
+    @Test void approvalCreatesExactlyOneDocumentAndImmutablePlannedLines() {
+        service.create(application, "OP"); service.create(application, "OP");
+        assertEquals("DISCARD_OUTBOUND", document.getOutboundType()); assertEquals("WAIT_PICK", document.getStatus());
+        assertNull(document.getLxCodes());
+        assertEquals(5, document.getPackageCount()); assertEquals(2, document.getPalletCount());
+        assertTrue(service.outboundNo(application).startsWith("OB-"));
+        assertEquals(List.of(3, 2), snapshots.stream().map(OutboundPalletItem::getPackageCount).toList());
+        verify(outbounds, times(1)).insert(any(OutboundOrder.class)); verify(pallets, times(2)).insert(any(OutboundPalletItem.class));
+    }
+    @Test void partialThenFinalCompletionTracksActualsWithoutChangingPlannedQuantities() {
+        service.create(application, "OP"); first.setPdaStatus("COMPLETED"); first.setActualDiscardPackages(2);
+        service.sync(application); assertEquals("PICKING", document.getStatus());
+        assertEquals(2, snapshots.get(0).getPickedPackageCount()); assertEquals(0, snapshots.get(1).getPickedPackageCount());
+        second.setPdaStatus("COMPLETED"); second.setActualDiscardPackages(0);
+        application.setStatus("PDA_COMPLETED"); application.setTotalPackages(2); service.sync(application);
+        assertEquals("OUTBOUNDED", document.getStatus()); assertEquals(2, document.getPackageCount());
+        assertEquals(3, snapshots.get(0).getPackageCount()); assertEquals("PICKED", snapshots.get(1).getStatus());
+        application.setStatus("COMPLETED"); service.sync(application); assertEquals("OUTBOUNDED", document.getStatus());
+    }
+    @Test void cancellationSynchronizesDocumentAndEveryLine() {
+        service.create(application, "OP"); application.setStatus("CANCELLED"); service.sync(application);
+        assertEquals("CANCELLED", document.getStatus()); assertTrue(snapshots.stream().allMatch(s -> "CANCELLED".equals(s.getStatus())));
+    }
+    @Test void syncClearsHistoricallyMislabelledInboundCodesWithoutChangingSourceSnapshots() {
+        first.setInboundCode("RK-456");
+        service.create(application, "OP"); document.setLxCodes("RT-123,RK-456");
+        service.sync(application);
+        assertNull(document.getLxCodes()); assertEquals("RK-456", snapshots.get(0).getInboundCode());
+        assertEquals("RT-123,RK-456", application.getInboundCodes());
+    }
+    @Test void returnSourceKeepsRealCartonMarkWithoutInventingPalletNumber() {
+        first.setReturnCartonId(31L); first.setSourceType("RETURN_CARTON");
+        var carton = new ReturnInventoryCarton(); carton.setId(31L); carton.setCustomerId("C1");
+        carton.setOverseasWarehouseId("99"); carton.setCartonMark("BOX-31");
+        when(returnCartons.selectById(31L)).thenReturn(carton);
+        service.create(application, "OP"); assertNull(snapshots.get(0).getPalletNo()); assertEquals("BOX-31", snapshots.get(0).getCartonMarks());
+        assertEquals(3L, snapshots.get(0).getReturnSkuQuantity());
+    }
+    @Test void invalidSourcePreventsAnyOutboundInsert() {
+        when(profiles.selectById(22L)).thenReturn(null);
+        assertThrows(ResponseStatusException.class, () -> service.create(application, "OP"));
+        verify(outbounds, never()).insert(any(OutboundOrder.class)); verify(pallets, never()).insert(any(OutboundPalletItem.class));
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/discard/service/CargoDiscardPhotoServiceTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/discard/service/CargoDiscardPhotoServiceTest.java
new file mode 100644
index 000000000..4015008f7
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/discard/service/CargoDiscardPhotoServiceTest.java
@@ -0,0 +1,85 @@
+package com.baiyue.lastleg.discard.service;
+
+import com.baiyue.lastleg.discard.entity.CargoDiscardApplication;
+import com.baiyue.lastleg.discard.entity.CargoDiscardPhoto;
+import com.baiyue.lastleg.discard.gateway.CargoDiscardPhotoFileGateway;
+import com.baiyue.lastleg.discard.mapper.CargoDiscardPhotoMapper;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.ValueSource;
+import org.springframework.mock.web.MockMultipartFile;
+import org.springframework.test.util.ReflectionTestUtils;
+import org.springframework.web.server.ResponseStatusException;
+import java.time.LocalDateTime;
+import java.util.ArrayList;
+import java.util.List;
+import static org.junit.jupiter.api.Assertions.*;
+import static org.mockito.ArgumentMatchers.*;
+import static org.mockito.Mockito.*;
+
+class CargoDiscardPhotoServiceTest {
+    private final CargoDiscardPhotoMapper photos = mock(CargoDiscardPhotoMapper.class);
+    private final CargoDiscardPhotoFileGateway files = mock(CargoDiscardPhotoFileGateway.class);
+    private final CargoDiscardPhotoService service = new CargoDiscardPhotoService();
+    private final CargoDiscardApplication application = new CargoDiscardApplication();
+    private final List<CargoDiscardPhoto> stored = new ArrayList<>();
+
+    @BeforeEach void setup() {
+        application.setId(1L); application.setCustomerId("7");
+        ReflectionTestUtils.setField(service, "photos", photos); ReflectionTestUtils.setField(service, "files", files);
+        when(photos.listApplication("7", 1L)).thenAnswer(invocation -> stored);
+        when(photos.insert(any(CargoDiscardPhoto.class))).thenAnswer(invocation -> { stored.add(invocation.getArgument(0)); return 1; });
+        when(files.upload(eq("7"), eq(1L), eq(9L), any())).thenReturn(new CargoDiscardPhotoFileGateway.UploadedFile(101L, "discard.png", "image/png", 8L));
+    }
+    private CargoDiscardPhoto photo(long fileId, String palletNo) {
+        var photo = new CargoDiscardPhoto(); photo.setFileId(fileId); photo.setPalletNo(palletNo);
+        photo.setCustomerId("7"); photo.setApplicationId(1L); stored.add(photo); return photo;
+    }
+
+    @Test void uploadsRestoreForPdaButOnlySubmittedPhotosAppearInBothDetails() {
+        var uploaded = service.upload(application, "PALLET-A", "operator", 9L, new MockMultipartFile("file", new byte[]{1}));
+        assertEquals(101L, uploaded.fileId()); assertEquals("PALLET-A", uploaded.palletNo());
+        assertEquals(1, service.list(application, "PALLET-A", false).size());
+        assertTrue(service.list(application, null, true).isEmpty());
+        assertThrows(ResponseStatusException.class, () -> service.download(application, null, 101L, true));
+        service.confirm(application, "PALLET-A", List.of(101L), false);
+        assertEquals(1, service.list(application, null, true).size());
+        assertNotNull(service.list(application, null, true).get(0).submittedAt());
+        service.download(application, null, 101L, true); verify(files).download("7", 1L, 101L);
+        service.confirm(application, "PALLET-A", List.of(101L), true);
+        verify(photos, times(1)).updateById(any(CargoDiscardPhoto.class));
+    }
+
+    @Test void noPhotosDuplicatesAndCrossPalletOrApplicationReferencesCannotSubmit() {
+        photo(101L, "PALLET-A"); photo(102L, "PALLET-B");
+        for (var ids : List.of(List.<Long>of(), List.of(101L, 101L), List.of(102L), List.of(999L)))
+            assertThrows(ResponseStatusException.class, () -> service.confirm(application, "PALLET-A", ids, false));
+        assertThrows(ResponseStatusException.class, () -> service.download(application, "PALLET-A", 102L, false));
+        verify(files, never()).validate(anyString(), anyLong(), anyLong());
+        verify(photos, never()).updateById(any(CargoDiscardPhoto.class));
+    }
+
+    @Test void ownershipValidationFailureDoesNotBindAnyPhoto() {
+        photo(101L, "PALLET-A"); photo(102L, "PALLET-A");
+        doThrow(new ResponseStatusException(org.springframework.http.HttpStatus.BAD_REQUEST)).when(files).validate("7", 1L, 102L);
+        assertThrows(ResponseStatusException.class, () -> service.confirm(application, "PALLET-A", List.of(101L, 102L), false));
+        verify(photos, never()).updateById(any(CargoDiscardPhoto.class));
+        assertTrue(stored.stream().allMatch(p -> p.getSubmittedAt() == null));
+    }
+
+    @Test void completedEvidenceCannotChangeAndReplayDoesNotWrite() {
+        photo(101L, "PALLET-A").setSubmittedAt(LocalDateTime.now()); photo(102L, "PALLET-A");
+        service.confirm(application, "PALLET-A", List.of(101L), true);
+        assertThrows(ResponseStatusException.class, () -> service.confirm(application, "PALLET-A", List.of(102L), true));
+        assertThrows(ResponseStatusException.class, () -> service.confirm(application, "PALLET-A", List.of(101L, 102L), true));
+        verifyNoInteractions(files); verify(photos, never()).updateById(any(CargoDiscardPhoto.class));
+    }
+
+    @Test void uploadLimitIsPerPalletAndStopsBeforeFileStorage() {
+        for (long id=1; id<=20; id++) photo(id, "PALLET-A");
+        assertThrows(ResponseStatusException.class, () -> service.upload(application, "PALLET-A", "operator", 9L, new MockMultipartFile("file", new byte[]{1})));
+        verify(files, never()).upload(anyString(), anyLong(), anyLong(), any());
+        assertEquals(101L, service.upload(application, "PALLET-B", "operator", 9L, new MockMultipartFile("file", new byte[]{1})).fileId());
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/discard/service/CargoDiscardServiceTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/discard/service/CargoDiscardServiceTest.java
index 33c6c5eec..6ee27dd9f 100644
--- a/lastleg-service/src/test/java/com/baiyue/lastleg/discard/service/CargoDiscardServiceTest.java
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/discard/service/CargoDiscardServiceTest.java
@@ -47,6 +47,36 @@ import static org.mockito.Mockito.when;
 
 @ExtendWith(MockitoExtension.class)
 class CargoDiscardServiceTest {
+    @Test
+    void customerConfirmationClosesPdaCompletedApplicationOnceWithoutAnotherDeduction() {
+        CargoDiscardApplication application = new CargoDiscardApplication();
+        application.setId(1001L); application.setCustomerId("100"); application.setDiscardNo("CD001");
+        application.setTotalPackages(1); application.setOverseasWarehouseName("测试仓"); application.setStatus(CargoDiscardService.PDA_COMPLETED);
+        storedApplication.set(application);
+        when(applications.lockNo("100", "CD001")).thenReturn(application);
+
+        service.confirmCompletion("100", "CD001", "CUSTOMER");
+        var confirmedAt = application.getCustomerConfirmedAt();
+        org.junit.jupiter.api.Assertions.assertNotNull(confirmedAt);
+        assertEquals(CargoDiscardService.COMPLETED, application.getStatus());
+        assertEquals("客户确认废弃完成", storedHistories.get(0).getRemark());
+        service.confirmCompletion("100", "CD001", "CUSTOMER");
+        assertEquals(confirmedAt, application.getCustomerConfirmedAt());
+        assertEquals(1, storedHistories.size());
+        verify(applications, times(1)).updateById(application);
+        org.mockito.Mockito.verifyNoInteractions(adjustments, inventory, returnCartonItems);
+    }
+
+    @org.junit.jupiter.params.ParameterizedTest
+    @org.junit.jupiter.params.provider.ValueSource(strings = {"PENDING_REVIEW", "APPROVED", "REJECTED", "CANCELLED"})
+    void customerCannotConfirmBeforePdaCompletion(String status) {
+        CargoDiscardApplication application = new CargoDiscardApplication(); application.setStatus(status);
+        when(applications.lockNo("100", "CD001")).thenReturn(application);
+        org.junit.jupiter.api.Assertions.assertThrows(org.springframework.web.server.ResponseStatusException.class,
+            () -> service.confirmCompletion("100", "CD001", "CUSTOMER"));
+        verify(applications, never()).updateById(any(CargoDiscardApplication.class));
+    }
+
     @Mock CargoDiscardApplicationMapper applications;
     @Mock CargoDiscardItemMapper items;
     @Mock CargoDiscardCartonMapper discardCartons;
@@ -57,8 +87,10 @@ class CargoDiscardServiceTest {
     @Mock LastlegOrderStatusHistoryMapper orderHistories;
     @Mock ReturnInventoryCartonMapper returnCartons;
     @Mock ReturnInventoryCartonItemMapper returnCartonItems;
+    @Mock com.baiyue.lastleg.client.DomesticWarehouseDirectoryClient warehouseDirectory;
 
     private CargoDiscardService service;
+    private final CargoDiscardOutboundService outboundService = org.mockito.Mockito.mock(CargoDiscardOutboundService.class);
     private final AtomicReference<CargoDiscardApplication> storedApplication = new AtomicReference<>();
     private final List<CargoDiscardItem> storedItems = new ArrayList<>();
     private final List<CargoDiscardCarton> storedLinks = new ArrayList<>();
@@ -67,6 +99,12 @@ class CargoDiscardServiceTest {
     @BeforeEach
     void setUp() {
         service = new CargoDiscardService();
+        ReflectionTestUtils.setField(service, "warehouseDirectory", warehouseDirectory);
+        lenient().when(warehouseDirectory.receivingWarehouses(any())).thenReturn(com.baiyue.common.core.api.ApiResponse.success(List.of(
+            new com.baiyue.lastleg.client.DomesticWarehouseDirectoryClient.ReceivingWarehouse(99L, "LAX", "洛杉矶仓", "US", "ACTIVE"))));
+        ReflectionTestUtils.setField(service, "outboundService", outboundService);
+        ReflectionTestUtils.setField(service, "stockService", org.mockito.Mockito.mock(CargoDiscardStockService.class));
+        ReflectionTestUtils.setField(service, "photoService", org.mockito.Mockito.mock(CargoDiscardPhotoService.class));
         ReflectionTestUtils.setField(service, "applications", applications);
         ReflectionTestUtils.setField(service, "items", items);
         ReflectionTestUtils.setField(service, "discardCartons", discardCartons);
@@ -93,18 +131,20 @@ class CargoDiscardServiceTest {
     @Test
     void createReservesExactSkuCartonsWithoutDeductingInventory() {
         LastlegOrder order = order();
+        order.setOverseasWarehouseId("99"); order.setOverseasWarehouseName(null);
         DropshipSkuInventory sku = skuInventory();
         when(orders.selectById(101L)).thenReturn(order);
-        when(inventory.countAvailable("100", 101L, "SKU-1")).thenReturn(3L);
+        when(inventory.countAvailable("100", 101L, "SKU-1")).thenReturn(2L);
         when(inventory.lockAvailable("100", 101L, "SKU-1", 2)).thenReturn(List.of(carton(1L), carton(2L)));
         when(inventory.lockSkuInventoryDimension("100", 101L, 201L, "SKU-1")).thenReturn(sku);
-        when(inventory.countAvailableProfile("100", 101L, 201L, "SKU-1")).thenReturn(3L);
+        when(inventory.countAvailableProfile("100", 101L, 201L, "SKU-1")).thenReturn(2L);
         when(inventory.changeCartonStatus(eq("100"), anyLong(), eq("AVAILABLE"), eq("DISCARD_PENDING"))).thenReturn(1);
 
         var detail = service.create("100", "7", new CargoDiscardRequests.Create(
             List.of(new CargoDiscardRequests.Item(101L, null, "SKU-1", 2)), "discard-create-1", "damaged"));
 
         assertEquals(CargoDiscardService.PENDING_REVIEW, detail.summary().status());
+        assertEquals("洛杉矶仓", storedApplication.get().getOverseasWarehouseName());
         assertEquals(2, detail.summary().totalPackages());
         assertEquals(new BigDecimal("10.00"), detail.summary().totalFee());
         assertEquals(2, storedLinks.size());
@@ -112,6 +152,38 @@ class CargoDiscardServiceTest {
         verify(inventory, never()).deductSkuInventory(any(), anyLong(), anyInt());
     }
 
+    @Test void historicalDiscardDetailResolvesMissingWarehouseNameByOperatingWarehouseId() {
+        CargoDiscardApplication application = pendingApplication();
+        application.setOverseasWarehouseId("99"); application.setOverseasWarehouseName(null);
+        storedApplication.set(application);
+        assertEquals("洛杉矶仓", service.detail("100", application.getDiscardNo()).summary().overseasWarehouseName());
+        verify(applications, never()).updateById(any(CargoDiscardApplication.class));
+    }
+
+
+    @Test void selectedBoxesCreatePartialApplicationWithoutReservingUnselectedStock() {
+        when(orders.selectById(101L)).thenReturn(order());
+        when(inventory.lockSelected("100", 101L, "SKU-1", List.of(2L))).thenReturn(List.of(carton(2L)));
+        when(inventory.lockSkuInventoryDimension("100", 101L, 201L, "SKU-1")).thenReturn(skuInventory());
+        when(inventory.countAvailableProfile("100", 101L, 201L, "SKU-1")).thenReturn(3L);
+        when(inventory.availableOrderCartons("100", 101L)).thenReturn(List.of(carton(1L), carton(2L), carton(3L)));
+        when(inventory.changeCartonStatus("100", 2L, "AVAILABLE", "DISCARD_PENDING")).thenReturn(1);
+        var detail = service.create("100", "7", new CargoDiscardRequests.Create(
+            List.of(new CargoDiscardRequests.Item(101L, null, "SKU-1", 1, null, List.of(2L))), "partial-create", "damage"));
+        assertEquals(1, detail.summary().totalPackages()); assertEquals(new BigDecimal("5.00"), detail.summary().totalFee());
+        assertEquals(List.of("C-2"), detail.items().get(0).cartonMarks());
+        assertEquals(1, storedLinks.size()); assertEquals(2L, storedLinks.get(0).getCartonId());
+        org.junit.jupiter.api.Assertions.assertTrue(storedItems.get(0).getCartonScanRequired());
+        verify(inventory, never()).changeCartonStatus(eq("100"), eq(1L), any(), any());
+        verify(inventory, never()).changeCartonStatus(eq("100"), eq(3L), any(), any());
+    }
+    @Test void duplicatePhysicalBoxAcrossSkuLinesIsRejectedBeforeCreation() {
+        when(orders.selectById(101L)).thenReturn(order());
+        org.junit.jupiter.api.Assertions.assertThrows(org.springframework.web.server.ResponseStatusException.class, () -> service.create("100", "7", new CargoDiscardRequests.Create(
+            List.of(new CargoDiscardRequests.Item(101L, null, "SKU-A", 1, null, List.of(2L)),
+                    new CargoDiscardRequests.Item(101L, null, "SKU-B", 1, null, List.of(2L))), "duplicate-box", null)));
+        verify(applications, never()).insert(any(CargoDiscardApplication.class));
+    }
     @Test
     void candidateTotalCountsPhysicalCartonsInsteadOfSkuRows() {
         CargoDiscardCandidateRow skuA = candidate("SKU-A", 20L);
@@ -131,7 +203,7 @@ class CargoDiscardServiceTest {
         ReturnInventoryCarton carton = new ReturnInventoryCarton();
         carton.setId(901L);
         carton.setCustomerId("100");
-        carton.setOverseasWarehouseId("WH-1");
+        carton.setOverseasWarehouseId("99");
         carton.setSourceReturnNo("RT-20260928-001");
         carton.setCartonMark("RC-LAX-001");
         carton.setStatus("AVAILABLE");
@@ -148,6 +220,7 @@ class CargoDiscardServiceTest {
 
         assertEquals(1, result.size());
         assertEquals("RETURN_CARTON", result.get(0).sourceType());
+        assertEquals("洛杉矶仓", result.get(0).overseasWarehouseName());
         assertEquals(901L, result.get(0).returnCartonId());
         assertEquals("RC-LAX-001", result.get(0).cartonMark());
         assertEquals(4, result.get(0).availablePackages());
@@ -166,6 +239,7 @@ class CargoDiscardServiceTest {
         var detail = service.review("100", "FH-1", "9", new CargoDiscardRequests.Review("APPROVE", "ok"));
 
         assertEquals(CargoDiscardService.APPROVED, detail.summary().status());
+        verify(outboundService).create(application, "9");
         verify(adjustments, never()).discard(any(), any(), any(), any(), any(), any());
         verify(inventory, never()).deductSkuInventory(any(), anyLong(), anyInt());
         assertEquals("ok", storedHistories.get(storedHistories.size() - 1).getRemark());
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/discard/service/CargoDiscardStockServiceTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/discard/service/CargoDiscardStockServiceTest.java
new file mode 100644
index 000000000..d2da844a0
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/discard/service/CargoDiscardStockServiceTest.java
@@ -0,0 +1,132 @@
+package com.baiyue.lastleg.discard.service;
+
+import com.baiyue.lastleg.discard.dto.CargoDiscardRequests;
+import com.baiyue.lastleg.discard.entity.*;
+import com.baiyue.lastleg.discard.mapper.*;
+import com.baiyue.lastleg.inventory.command.dto.InventoryCommandRequests;
+import com.baiyue.lastleg.inventory.command.service.InventoryCommandService;
+import com.baiyue.lastleg.inventory.entity.*;
+import com.baiyue.lastleg.inventory.mapper.*;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.mockito.ArgumentCaptor;
+import org.springframework.test.util.ReflectionTestUtils;
+import org.springframework.web.server.ResponseStatusException;
+import java.time.LocalDateTime;
+import java.util.List;
+import static org.junit.jupiter.api.Assertions.*;
+import static org.mockito.Mockito.*;
+import static org.mockito.ArgumentMatchers.*;
+
+class CargoDiscardStockServiceTest {
+    final CargoDiscardInventoryMapper stock = mock(CargoDiscardInventoryMapper.class);
+    final InventoryPositionMapper positions = mock(InventoryPositionMapper.class);
+    final InventoryBalanceMapper balances = mock(InventoryBalanceMapper.class);
+    final CargoDiscardCartonMapper links = mock(CargoDiscardCartonMapper.class);
+    final CargoDiscardItemMapper items = mock(CargoDiscardItemMapper.class);
+    final InventoryCommandService commands = mock(InventoryCommandService.class);
+    final CargoDiscardStockService service = new CargoDiscardStockService();
+    final InventoryPosition position = new InventoryPosition();
+    final InventoryBalance balance = new InventoryBalance();
+    final CargoDiscardApplication application = new CargoDiscardApplication();
+    CargoDiscardRequests.Item request(int count) { return new CargoDiscardRequests.Item(null, null, "SKU", count, 42L); }
+    @BeforeEach void setup() {
+        ReflectionTestUtils.setField(service, "stock", stock);
+        ReflectionTestUtils.setField(service, "positions", positions);
+        ReflectionTestUtils.setField(service, "balances", balances);
+        ReflectionTestUtils.setField(service, "commands", commands);
+        ReflectionTestUtils.setField(service, "items", items);
+        ReflectionTestUtils.setField(service, "links", links);
+        ReflectionTestUtils.setField(service, "objectMapper", new ObjectMapper());
+        position.setId(42L); position.setCustomerId("C1"); position.setBalanceId(51L);
+        position.setOverseasWarehouseId("99"); position.setPalletNo("P-42"); position.setAvailablePackages(100L);
+        balance.setId(51L); balance.setCustomerId("C1"); balance.setOverseasWarehouseId("99");
+        balance.setInboundCode("WT-WH-1"); balance.setInboundOrderNo("WT-WH-1"); balance.setSkuCode("SKU"); balance.setAvailablePackages(100L);
+        application.setId(11L); application.setDiscardNo("CD-1"); application.setCustomerId("C1"); application.setCreatedBy("OP");
+        when(positions.findTenantPosition("C1", 42L)).thenReturn(position);
+        when(stock.lockGenericPosition("C1", 42L)).thenReturn(position);
+        when(balances.selectById(51L)).thenReturn(balance);
+    }
+    @Test void warehouseTransferStockIsEligibleAndKeepsTrueSourcePosition() {
+        when(stock.genericPositions("C1", "WT")).thenReturn(List.of(position));
+        var candidate = service.candidates("C1", "WT").get(0);
+        assertEquals("INVENTORY", candidate.sourceType()); assertNull(candidate.orderId());
+        assertEquals(42L, candidate.inventoryPositionId()); assertEquals("WT-WH-1", candidate.inboundCode());
+        service.reserve("C1", "OP", application, request(100), LocalDateTime.now());
+        var capture = ArgumentCaptor.forClass(CargoDiscardItem.class); verify(items).insert(capture.capture());
+        var line = capture.getValue(); assertEquals(42L, line.getInventoryPositionId()); assertEquals(100, line.getDiscardPackages());
+        var move = ArgumentCaptor.forClass(InventoryCommandRequests.Move.class); verify(commands).hold(eq("C1"), eq("OP"), move.capture());
+        assertEquals(100, move.getValue().packages()); assertEquals("CARGO_DISCARD:11:" + line.getId(), move.getValue().sourceEventId());
+        service.release("C1", application, line); verify(commands).release(eq("C1"), eq("OP"), any());
+        service.discard("C1", "OP", application, line, 100); verify(commands).discardHeld(eq("C1"), eq("OP"), any());
+    }
+    @Test void partialForeignSkuAndDropshipBypassAreRejectedBeforeHolding() {
+        assertThrows(ResponseStatusException.class, () -> service.reserve("C1", "OP", application, request(99), LocalDateTime.now()));
+        assertThrows(ResponseStatusException.class, () -> service.validate("C2", request(100)));
+        assertThrows(ResponseStatusException.class, () -> service.validate("C1", new CargoDiscardRequests.Item(null, null, "OTHER", 100, 42L)));
+        when(stock.isDropshipPosition("C1", 42L)).thenReturn(1L);
+        assertThrows(ResponseStatusException.class, () -> service.validate("C1", request(100)));
+        verifyNoInteractions(commands, items);
+    }
+    @Test void looseStockRequiresCompleteRealMarksAndSnapshotsThem() {
+        position.setPalletNo(null); position.setAvailablePackages(2L); balance.setAvailablePackages(2L);
+        when(stock.looseCartonMarks("C1", 42L)).thenReturn(List.of("BOX-1"));
+        assertThrows(ResponseStatusException.class, () -> service.reserve("C1", "OP", application, request(2), LocalDateTime.now()));
+        verifyNoInteractions(commands, items);
+        when(stock.looseCartonMarks("C1", 42L)).thenReturn(List.of("BOX-1", "BOX-2"));
+        service.reserve("C1", "OP", application, request(2), LocalDateTime.now());
+        var capture = ArgumentCaptor.forClass(CargoDiscardItem.class); verify(items).insert(capture.capture());
+        assertEquals(List.of("BOX-1", "BOX-2"), service.cartonMarks(capture.getValue()));
+    }
+    private com.baiyue.lastleg.discard.model.CargoDiscardStockCartonRow carton(long id, String mark) {
+        var carton = new com.baiyue.lastleg.discard.model.CargoDiscardStockCartonRow();
+        carton.setSourceType("INBOUND"); carton.setId(id); carton.setCartonMark(mark); carton.setSkuCode("SKU"); return carton;
+    }
+    @Test void partialDisposalFreezesExactlySelectedBoxesAndLeavesTheOthersUntouched() {
+        position.setAvailablePackages(3L); balance.setAvailablePackages(3L);
+        when(stock.genericCartons("C1", 42L)).thenReturn(List.of(carton(1L, "BOX-1"), carton(2L, "BOX-2"), carton(3L, "BOX-3")));
+        when(stock.changeGenericCartonStatus("C1", 2L, "AVAILABLE", "DISCARD_PENDING")).thenReturn(1);
+        var request = new CargoDiscardRequests.Item(null, null, "SKU", 1, 42L, List.of(2L));
+        service.reserve("C1", "OP", application, request, LocalDateTime.now());
+        var capture = ArgumentCaptor.forClass(CargoDiscardItem.class); verify(items).insert(capture.capture());
+        var line = capture.getValue(); assertEquals(1, line.getDiscardPackages()); assertTrue(line.getCartonScanRequired());
+        assertEquals(List.of("BOX-2"), service.cartonMarks(line));
+        var boxLink = ArgumentCaptor.forClass(CargoDiscardCarton.class); verify(links).insert(boxLink.capture());
+        assertEquals(2L, boxLink.getValue().getCartonId());
+        verify(stock, never()).changeGenericCartonStatus(eq("C1"), eq(1L), anyString(), anyString());
+        verify(stock, never()).changeGenericCartonStatus(eq("C1"), eq(3L), anyString(), anyString());
+        when(links.listApplication("C1", 11L)).thenReturn(List.of(boxLink.getValue()));
+        when(stock.changeGenericCartonStatus("C1", 2L, "DISCARD_PENDING", "AVAILABLE")).thenReturn(1);
+        service.release("C1", application, line);
+        verify(stock).changeGenericCartonStatus("C1", 2L, "DISCARD_PENDING", "AVAILABLE");
+    }
+    @Test void partialBoxSelectionRejectsForeignRepeatedAndMismatchedQuantity() {
+        position.setAvailablePackages(3L); balance.setAvailablePackages(3L);
+        when(stock.genericCartons("C1", 42L)).thenReturn(List.of(carton(1L, "BOX-1"), carton(2L, "BOX-2"), carton(3L, "BOX-3")));
+        for (var request : List.of(new CargoDiscardRequests.Item(null, null, "SKU", 1, 42L, List.of(9L)),
+                new CargoDiscardRequests.Item(null, null, "SKU", 2, 42L, List.of(1L, 1L)),
+                new CargoDiscardRequests.Item(null, null, "SKU", 2, 42L, List.of(1L)))) {
+            assertThrows(ResponseStatusException.class, () -> service.validate("C1", request));
+        }
+        verifyNoInteractions(commands, items, links);
+    }
+
+    @Test void singlePositionTransferBoxesReleaseBackToTheirOriginalExpectedStatus() {
+        position.setAvailablePackages(2L); balance.setAvailablePackages(2L);
+        var first = carton(1L, "WT-1#2-1"); first.setSourceType("TRANSFER");
+        var second = carton(2L, "WT-1#2-2"); second.setSourceType("TRANSFER");
+        when(stock.genericCartons("C1", 42L)).thenReturn(List.of(first, second));
+        when(stock.changeTransferCartonStatus("C1", 2L, "EXPECTED", "DISCARD_PENDING")).thenReturn(1);
+        service.reserve("C1", "OP", application, new CargoDiscardRequests.Item(null, null, "SKU", 1, 42L, List.of(2L)), LocalDateTime.now());
+        var capture = ArgumentCaptor.forClass(CargoDiscardCarton.class); verify(links).insert(capture.capture());
+        assertEquals("TRANSFER", capture.getValue().getSourceType());
+        when(links.listApplication("C1", 11L)).thenReturn(List.of(capture.getValue()));
+        when(stock.changeTransferCartonStatus("C1", 2L, "DISCARD_PENDING", "EXPECTED")).thenReturn(1);
+        var line = ArgumentCaptor.forClass(CargoDiscardItem.class); verify(items).insert(line.capture());
+        service.release("C1", application, line.getValue());
+        verify(stock).changeTransferCartonStatus("C1", 2L, "DISCARD_PENDING", "EXPECTED");
+        verify(stock, never()).changeGenericCartonStatus(anyString(), anyLong(), anyString(), anyString());
+    }
+
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/dispatch/DispatchCandidateMapperContractTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/dispatch/DispatchCandidateMapperContractTest.java
index e2cbdb8eb..af62cb734 100644
--- a/lastleg-service/src/test/java/com/baiyue/lastleg/dispatch/DispatchCandidateMapperContractTest.java
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/dispatch/DispatchCandidateMapperContractTest.java
@@ -5,6 +5,8 @@ import org.apache.ibatis.annotations.Select;
 import org.junit.jupiter.api.Test;
 
 import java.lang.reflect.Method;
+import java.nio.file.Files;
+import java.nio.file.Path;
 import java.sql.DriverManager;
 import java.util.ArrayList;
 import java.util.List;
@@ -14,6 +16,32 @@ import static org.junit.jupiter.api.Assertions.assertFalse;
 import static org.junit.jupiter.api.Assertions.assertEquals;
 
 class DispatchCandidateMapperContractTest {
+    @Test
+    void ordinaryAndReturnRelabelCandidatesExcludeDirectOutboundDeliveryModes() throws Exception {
+        for (String method : List.of("relabelAvailable", "nativeReturnRelabelAvailable")) {
+            String sql = String.join(" ", DispatchCandidateMapper.class
+                .getMethod(method, String.class, String.class, String.class).getAnnotation(Select.class).value());
+            String eligibility = sql.substring(sql.indexOf("WHERE a.delivery_method"), sql.indexOf("<if test='customerId"));
+            try (var connection = DriverManager.getConnection("jdbc:h2:mem:relabel-mode-" + method + ";MODE=MySQL")) {
+                var statement = connection.createStatement();
+                statement.execute("CREATE TABLE ll_relabel_application(delivery_method VARCHAR,status VARCHAR,fulfillment_status VARCHAR)");
+                statement.execute("INSERT INTO ll_relabel_application VALUES "
+                    + "('TRUCK','READY_FOR_OUTBOUND','WAIT_PRE_DISPATCH'),"
+                    + "('PICKUP','READY_FOR_OUTBOUND','WAIT_PRE_DISPATCH'),"
+                    + "('AMAZON_PICKUP','READY_FOR_OUTBOUND','WAIT_PRE_DISPATCH'),"
+                    + "('CUSTOMER_PICKUP','READY_FOR_OUTBOUND','WAIT_PRE_DISPATCH'),"
+                    + "('UNKNOWN','READY_FOR_OUTBOUND','WAIT_PRE_DISPATCH'),"
+                    + "(NULL,'READY_FOR_OUTBOUND','WAIT_PRE_DISPATCH'),"
+                    + "('EXPRESS','READY_FOR_OUTBOUND','WAIT_PRE_DISPATCH')");
+                // The return query also requires physical return-carton availability.
+                eligibility = eligibility.replace("AND c.status='RELABEL_PENDING' AND c.pallet_code IS NOT NULL", "");
+                try (var rows = statement.executeQuery("SELECT delivery_method FROM ll_relabel_application a " + eligibility)) {
+                    assertTrue(rows.next()); assertEquals("TRUCK", rows.getString(1)); assertFalse(rows.next());
+                }
+            }
+        }
+    }
+
     @Test
     void confirmedAppointmentUsesOriginalCustomerOrderAndDestinationAndNeverInventsLoadingTime() throws Exception {
         try (var connection = DriverManager.getConnection("jdbc:h2:mem:dispatch-confirmed-appointment;MODE=MySQL")) {
@@ -48,6 +76,15 @@ class DispatchCandidateMapperContractTest {
                 }
                 assertEquals(8, count);
             }
+            statement.execute("INSERT INTO ll_inbound_fba_appointment VALUES (99,'2026-10-15 10:00:00',NULL,'SUCCESS','ACY2')");
+            statement.execute("INSERT INTO ll_inbound_fba_appointment_item VALUES (99,1,'9',1,'ACY2')");
+            try(var rows=statement.executeQuery("SELECT "+DispatchCandidateMapper.CONFIRMED_APPOINTMENT_AT+" AS appointment_at FROM ll_inbound_plan_pallet p JOIN ll_inbound_plan ip ON ip.id=p.plan_id WHERE p.id=1")) {
+                assertTrue(rows.next());assertEquals(null,rows.getTimestamp("appointment_at"),"一票多批时不得将最晚确认冒充整个托盘的预约时间");
+            }
+            statement.execute("UPDATE ll_inbound_fba_appointment SET appointment_status='PENDING' WHERE id=99");
+            try(var rows=statement.executeQuery("SELECT "+DispatchCandidateMapper.CONFIRMED_APPOINTMENT_AT+" AS appointment_at FROM ll_inbound_plan_pallet p JOIN ll_inbound_plan ip ON ip.id=p.plan_id WHERE p.id=1")) {
+                assertTrue(rows.next());assertEquals(null,rows.getTimestamp("appointment_at"),"部分批次确认也不能代表整票");
+            }
             for (Method method : List.of(
                 DispatchCandidateMapper.class.getMethod("available", String.class, List.class, String.class, String.class, String.class, String.class),
                 DispatchCandidateMapper.class.getMethod("lockSelected", String.class, List.class))) {
@@ -187,6 +224,17 @@ class DispatchCandidateMapperContractTest {
         }
     }
 
+    @Test
+    void relabelCandidatesReadWeightFromWarehouseTransferPalletSnapshot() throws Exception {
+        String source = Files.readString(Path.of("src/main/java/com/baiyue/lastleg/dispatch/mapper/DispatchCandidateMapper.java"));
+        int start = source.indexOf("List<DispatchPalletCandidate> relabelAvailable");
+        int end = source.indexOf("List<DispatchPalletCandidate> nativeReturnRelabelAvailable");
+        String sql = source.substring(source.lastIndexOf("@Select", start), end);
+        assertTrue(sql.contains("MAX(wtp.gross_weight_kg) AS grossWeightKg"));
+        assertTrue(sql.contains("MAX(wtp.volume_cbm) AS volumeCbm"));
+        assertTrue(sql.contains("wtp.warehouse_pallet_id=pos.pallet_id"));
+    }
+
     @Test
     void candidateGrossWeightUsesPhysicalSourcesAndNeverBillingVolumeWeight() throws Exception {
         for (Method method : List.of(
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/dispatch/DispatchPhysicalWeightTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/dispatch/DispatchPhysicalWeightTest.java
index a25e8bfcd..eb21f2262 100644
--- a/lastleg-service/src/test/java/com/baiyue/lastleg/dispatch/DispatchPhysicalWeightTest.java
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/dispatch/DispatchPhysicalWeightTest.java
@@ -25,6 +25,11 @@ class DispatchPhysicalWeightTest {
             int to = sql.indexOf(" AS grossWeightKg,");
             if (from < 0 || to < 0) continue;
             String projection = sql.substring(from + "AS volumeWeightKg,".length(), to);
+            if (projection.contains("wtp.gross_weight_kg")) {
+                assertThat(jdbc.queryForObject("SELECT " + projection + " FROM (SELECT CAST(NULL AS DECIMAL(12,3)) gross_weight_kg) wtp", BigDecimal.class)).isNull();
+                assertThat(jdbc.queryForObject("SELECT " + projection + " FROM (SELECT 80 gross_weight_kg) wtp", BigDecimal.class)).isEqualByComparingTo("80");
+                continue;
+            }
             String query = "SELECT " + projection + " FROM (SELECT '10' AS customer_id) ip "
                 + "CROSS JOIN (SELECT 1 AS order_id,10 AS volume_cbm) l "
                 + "CROSS JOIN (SELECT 1 AS line_id,5 AS allocated_volume_cbm) a "
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/dispatch/service/DispatchBolPrintServiceTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/dispatch/service/DispatchBolPrintServiceTest.java
index 2bd6c0966..447778249 100644
--- a/lastleg-service/src/test/java/com/baiyue/lastleg/dispatch/service/DispatchBolPrintServiceTest.java
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/dispatch/service/DispatchBolPrintServiceTest.java
@@ -55,7 +55,7 @@ class DispatchBolPrintServiceTest {
                 null, null, null, LocalDateTime.of(2026, 9, 12, 2, 40, 20), "PENDING_DEPARTURE",
                 1, 1, 1, 0, 0, 1, null, LocalDateTime.of(2026, 9, 11, 10, 0), List.of(),
                 List.of(new DispatchResponse.BolLine("TSTU3539519", "DP-260911-0027", "ABE2", "ABE2",
-                        "NYEXX2609110214", null, null, 1)), null);
+                        "NYEXX2609110214", null, null, 1)), null, List.of());
         var address = new DomesticWarehouseDirectoryClient.Address("OPERATING", "US", "California", "Rancho Cucamonga",
                 null, "91730", "10767 7th Street", null);
         var warehouse = new DomesticWarehouseDirectoryClient.Warehouse(Long.parseLong(warehouseId), 0L,
@@ -87,7 +87,7 @@ class DispatchBolPrintServiceTest {
                         new DispatchResponse.BolLine("TSTU3539519", "DP-001", "ABE2", "ABE2 Warehouse",
                                 "NYEXX2609110214", null, null, 1),
                         new DispatchResponse.BolLine("TSTU3539519", "DP-002", "ONT8", "ONT8 Warehouse",
-                                "NYEXX2609110215", null, null, 1)), null);
+                                "NYEXX2609110215", null, null, 1)), null, List.of());
         var warehouse = new DomesticWarehouseDirectoryClient.Warehouse(Long.parseLong(warehouseId), 0L,
                 "US-LAX", "洛杉矶仓", "OVERSEAS", "US", "ACTIVE", null, null);
         when(dispatches.platformDetail(detail.dispatchNo())).thenReturn(detail);
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/dispatch/service/DispatchServiceTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/dispatch/service/DispatchServiceTest.java
index 9e3f0e654..70558a329 100644
--- a/lastleg-service/src/test/java/com/baiyue/lastleg/dispatch/service/DispatchServiceTest.java
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/dispatch/service/DispatchServiceTest.java
@@ -51,6 +51,37 @@ import static org.mockito.Mockito.when;
 
 @ExtendWith(MockitoExtension.class)
 class DispatchServiceTest {
+    @Test void detailReturnsEveryOriginalBatchSourceWithoutLegacyAppointmentNumber() {
+        var dispatch=new DispatchOrder();dispatch.setId(1L);dispatch.setCustomerId("C");dispatch.setDispatchNo("DP-1");
+        when(orders.findGlobalByDispatchNo("DP-1")).thenReturn(dispatch);
+        var allocations=mock(com.baiyue.lastleg.appointmentwork.AppointmentWorkDispatchPort.class);ReflectionTestUtils.setField(service,"appointmentAllocations",allocations);
+        var references=List.of(new com.baiyue.lastleg.appointmentwork.AppointmentWorkDispatchPort.BatchReference("FBA_APPOINTMENT:1","AP-1","C",
+                List.of(new com.baiyue.lastleg.appointmentwork.AppointmentWorkDispatchPort.BatchSource("ORDER:10","FBA:ONT8",40))),
+            new com.baiyue.lastleg.appointmentwork.AppointmentWorkDispatchPort.BatchReference("FBA_APPOINTMENT:2","AP-2","C",
+                List.of(new com.baiyue.lastleg.appointmentwork.AppointmentWorkDispatchPort.BatchSource("ORDER:11","FBA:ONT8",20))));
+        when(allocations.references(List.of(1L))).thenReturn(java.util.Map.of(1L,references));
+        var result=service.platformDetail("DP-1");assertNull(result.fbaAppointmentNo());assertEquals(references,result.appointmentBatches());
+        verify(allocations).references(List.of(1L));
+    }
+    @org.junit.jupiter.params.ParameterizedTest
+    @org.junit.jupiter.params.provider.NullAndEmptySource
+    @org.junit.jupiter.params.provider.ValueSource(strings = {"PICKUP", "EXPRESS", "AMAZON_PICKUP", "CUSTOMER_PICKUP", "UNKNOWN"})
+    void directRelabelCannotResolveDispatchScopeOrBypassCandidateFiltering(String deliveryMethod) {
+        var relabels = mock(com.baiyue.lastleg.relabel.mapper.RelabelApplicationMapper.class);
+        ReflectionTestUtils.setField(service, "relabelApplications", relabels);
+        var application = new com.baiyue.lastleg.relabel.entity.RelabelApplication();
+        application.setCustomerId("100"); application.setStatus("READY_FOR_OUTBOUND");
+        application.setFulfillmentStatus("WAIT_PRE_DISPATCH"); application.setDeliveryMethod(deliveryMethod);
+        when(relabels.findAnyByRelabelNo("RL-1")).thenReturn(application);
+        when(relabels.lockNo("100", "RL-1")).thenReturn(application);
+        assertThrows(ResponseStatusException.class, () -> service.resolveCustomerScopeForRelabel("RL-1"));
+        assertThrows(ResponseStatusException.class, () -> service.preArrange("100", "OP",
+            new DispatchRequests.PreArrange(List.of(1L), null, null, null, null, "RL-1")));
+        verify(orders, never()).insert(any(DispatchOrder.class));
+        verify(candidates, never()).relabelAvailable(any(), any(), any());
+        verify(relabelMeasurements, never()).requireMeasured(any());
+    }
+
     @Mock DispatchOrderMapper orders;
     @Mock DispatchItemMapper items;
     @Mock DispatchBolMapper bolLines;
@@ -65,11 +96,15 @@ class DispatchServiceTest {
     @Mock com.baiyue.lastleg.fleet.trip.FleetDispatchBindingGuard fleetBindings;
     @Mock com.baiyue.lastleg.fleet.trip.FleetDispatchWorkflowQuery fleetWorkflow;
     @Mock ReturnRelabelDispatchStock returnRelabelStock;
+    @Mock com.baiyue.lastleg.relabel.service.RelabelPalletMeasurementService relabelMeasurements;
     private DispatchService service;
 
     @BeforeEach
     void setUp() {
         service = new DispatchService();
+        ReflectionTestUtils.setField(service,"appointmentAllocations",mock(com.baiyue.lastleg.appointmentwork.AppointmentWorkDispatchPort.class));
+        ReflectionTestUtils.setField(service,"workChanges",mock(com.baiyue.lastleg.appointmentwork.AppointmentWorkChanges.class));
+        ReflectionTestUtils.setField(service, "relabelMeasurements", relabelMeasurements);
         ReflectionTestUtils.setField(service, "fleetWorkflow", fleetWorkflow);
         ReflectionTestUtils.setField(service, "fleetBindings", fleetBindings);
         ReflectionTestUtils.setField(service, "returnRelabelStock", returnRelabelStock);
@@ -156,6 +191,11 @@ class DispatchServiceTest {
         verify(locks).insert(lock.capture());
         assertEquals("draft-1", lock.getValue().getDraftToken());
         assertEquals("7", lock.getValue().getOperatorId());
+        ArgumentCaptor<DispatchDraftContainer> group = ArgumentCaptor.forClass(DispatchDraftContainer.class);
+        verify(draftContainers).insert(group.capture());
+        assertNotNull(group.getValue().getId());
+        assertEquals(30, group.getValue().getCapacity());
+        assertEquals(group.getValue().getId(), lock.getValue().getDraftContainerId());
         assertNotNull(lock.getValue().getExpiresAt());
         assertEquals(null, lock.getValue().getDispatchOrderId());
         verify(locks).clearInactiveActiveKey("100", "PLAN:10");
@@ -171,6 +211,59 @@ class DispatchServiceTest {
         verify(locks).insert(any(DispatchPalletLock.class));
     }
 
+    private DispatchDraftContainer existingDraftGroup() {
+        DispatchDraft draft = new DispatchDraft();
+        draft.setId(20L); draft.setDraftToken("draft-1"); draft.setOperatorId("7");
+        when(drafts.lockActive("draft-1", "7")).thenReturn(draft);
+        DispatchDraftContainer group = new DispatchDraftContainer();
+        group.setId(21L); group.setDraftId(20L); group.setDraftToken("draft-1");
+        return group;
+    }
+
+    @Test void omittedGroupReusesTheOnlyGroupAndPersistsItsIdentity() {
+        var group = existingDraftGroup();
+        when(draftContainers.findByToken("draft-1")).thenReturn(List.of(group));
+        when(candidates.lockSelected("100", List.of(10L))).thenReturn(List.of(candidate(10L, null, "ONT8")));
+        service.lockDraftPallet("100", "7", new DispatchRequests.DraftPallet(10L, "draft-1"));
+        var lock = ArgumentCaptor.forClass(DispatchPalletLock.class);
+        verify(locks).insert(lock.capture());
+        assertEquals(21L, lock.getValue().getDraftContainerId());
+        verify(draftContainers, never()).insert(any(DispatchDraftContainer.class));
+    }
+
+    @Test void omittedGroupReplayDoesNotCreateAnotherGroupOrLock() {
+        var group = existingDraftGroup();
+        when(draftContainers.findByToken("draft-1")).thenReturn(List.of(group));
+        when(candidates.lockSelected("100", List.of(10L))).thenReturn(List.of(candidate(10L, null, "ONT8")));
+        var lock = new DispatchPalletLock(); lock.setDraftToken("draft-1"); lock.setOperatorId("7"); lock.setDraftContainerId(21L);
+        when(locks.lockActive("100", "PLAN:10")).thenReturn(lock);
+        service.lockDraftPallet("100", "7", new DispatchRequests.DraftPallet(10L, "draft-1"));
+        verify(draftContainers, never()).insert(any(DispatchDraftContainer.class));
+        verify(locks, never()).insert(any(DispatchPalletLock.class));
+    }
+
+    @Test void multipleGroupsRequireExplicitSelectionWithoutCreatingAnotherGroup() {
+        var group = existingDraftGroup();
+        var second = new DispatchDraftContainer(); second.setId(22L);
+        when(draftContainers.findByToken("draft-1")).thenReturn(List.of(group, second));
+        assertEquals(400, assertThrows(ResponseStatusException.class, () ->
+            service.lockDraftPallet("100", "7", new DispatchRequests.DraftPallet(10L, "draft-1"))).getStatusCode().value());
+        verify(draftContainers, never()).insert(any(DispatchDraftContainer.class));
+        verify(locks, never()).insert(any(DispatchPalletLock.class));
+    }
+
+    @Test void replayCannotSilentlyMoveAPalletToAnotherGroup() {
+        var group = existingDraftGroup();
+        when(draftContainers.selectById(21L)).thenReturn(group);
+        when(candidates.lockSelected("100", List.of(10L))).thenReturn(List.of(candidate(10L, null, "ONT8")));
+        var lock = new DispatchPalletLock(); lock.setDraftToken("draft-1"); lock.setOperatorId("7"); lock.setDraftContainerId(22L);
+        when(locks.lockActive("100", "PLAN:10")).thenReturn(lock);
+        assertEquals(409, assertThrows(ResponseStatusException.class, () ->
+            service.lockDraftPallet("100", "7", new DispatchRequests.DraftPallet(10L, "draft-1", 21L))).getStatusCode().value());
+        assertEquals(22L, lock.getDraftContainerId());
+        verify(locks, never()).insert(any(DispatchPalletLock.class));
+    }
+
     @Test
     void preArrangeAcceptsVolumeOnlyPlanPallet() {
         when(candidates.lockSelected("100", List.of(10L)))
@@ -615,6 +708,40 @@ class DispatchServiceTest {
         verify(orders, never()).insert(any(DispatchOrder.class)); verify(items, never()).insert(any(DispatchItem.class));
     }
 
+    @Test
+    void groupedPreArrangeRejectsUnsupportedStoredCapacityBeforeCreatingDispatches() {
+        var fixture = twoGroupFixture();
+        for (Integer capacity : java.util.Arrays.asList(null, 0, 31, 500)) {
+            fixture.containers().get(0).setCapacity(capacity);
+            var error = assertThrows(ResponseStatusException.class,
+                () -> service.preArrangeDraft("7", fixture.request()));
+            assertEquals(409, error.getStatusCode().value());
+            assertEquals("车辆大小仅支持15托或30托", error.getReason());
+        }
+        verify(orders, never()).insert(any(DispatchOrder.class));
+        verify(items, never()).insert(any(DispatchItem.class));
+    }
+
+    @Test
+    void groupedPreArrangeRejectsThirtyOnePalletsInThirtyPalletVehicle() {
+        twoGroupFixture();
+        var palletIds = java.util.stream.LongStream.rangeClosed(100, 130).boxed().toList();
+        var bound = palletIds.stream().map(id -> {
+            var lock = new DispatchPalletLock();
+            lock.setPlanPalletId(id);
+            return lock;
+        }).toList();
+        when(locks.lockActiveByDraftContainer("draft-multi", 21L)).thenReturn(bound);
+        var request = new DispatchRequests.PreArrangeDraft("draft-multi",
+            List.of(new DispatchRequests.DraftGroup(21L, palletIds, List.of())));
+        var error = assertThrows(ResponseStatusException.class,
+            () -> service.preArrangeDraft("7", request));
+        assertEquals(409, error.getStatusCode().value());
+        assertEquals("装车分组超过车型托位容量", error.getReason());
+        verify(orders, never()).insert(any(DispatchOrder.class));
+        verify(items, never()).insert(any(DispatchItem.class));
+    }
+
     @Test
     void secondGroupFailureRollsBackFirstGroupInsertInTheSameTransaction() {
         var fixture = twoGroupFixture();
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/fleet/business/FleetPoolOrderBridgeTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/fleet/business/FleetPoolOrderBridgeTest.java
index 2729365a6..2bb70c73c 100644
--- a/lastleg-service/src/test/java/com/baiyue/lastleg/fleet/business/FleetPoolOrderBridgeTest.java
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/fleet/business/FleetPoolOrderBridgeTest.java
@@ -1,15 +1,11 @@
 package com.baiyue.lastleg.fleet.business;
 
-import com.baiyue.lastleg.delivery.entity.DeliveryOrder;
-import com.baiyue.lastleg.delivery.mapper.DeliverySourceEvidenceMapper;
-import com.baiyue.lastleg.delivery.model.SourceDeliveryCompletionPolicy;
-import com.baiyue.lastleg.fleet.trip.FleetBookingIncomingGateway;
 import com.baiyue.lastleg.looseboard.entity.LocalLooseboardOrder;
 import com.baiyue.lastleg.looseboard.mapper.*;
 import com.baiyue.lastleg.trucking.entity.UsTruckOrder;
 import com.baiyue.lastleg.trucking.entity.UsTruckOrderStatusHistory;
 import com.baiyue.lastleg.trucking.mapper.*;
-import com.baiyue.lastleg.service.LastlegOrderNoGenerator;
+
 import com.fasterxml.jackson.databind.ObjectMapper;
 import org.junit.jupiter.api.*;
 import org.springframework.transaction.annotation.*;
@@ -26,15 +22,14 @@ class FleetPoolOrderBridgeTest {
     LocalLooseboardHistoryMapper looseHistory=mock(LocalLooseboardHistoryMapper.class);
     UsTruckOrderMapper trucks=mock(UsTruckOrderMapper.class);
     UsTruckOrderStatusHistoryMapper truckHistory=mock(UsTruckOrderStatusHistoryMapper.class);
-    LastlegOrderNoGenerator numbers=mock(LastlegOrderNoGenerator.class);
-    DeliverySourceEvidenceMapper evidence=mock(DeliverySourceEvidenceMapper.class);
+    FleetPoolOrderNumberGenerator numbers=mock(FleetPoolOrderNumberGenerator.class);
+    FleetPoolDeliveryEvidence evidence=mock(FleetPoolDeliveryEvidence.class);
     com.baiyue.lastleg.appointmentplanning.AppointmentSourceLinker appointmentSources=mock(com.baiyue.lastleg.appointmentplanning.AppointmentSourceLinker.class);
     FleetPoolOrderBridge service;
     FleetPoolOrderLink row; LocalLooseboardOrder looseOrder; UsTruckOrder truckOrder;
     @BeforeEach void setup(){
         service=new FleetPoolOrderBridge(links,loose,looseHistory,trucks,truckHistory,numbers,new ObjectMapper().findAndRegisterModules(),evidence,appointmentSources);
-        when(evidence.dispatchIds("9",77)).thenReturn(List.of(70L));
-        when(evidence.returns("9",70)).thenReturn(List.of());
+
         when(numbers.next(anyString(),any(),anyLong())).thenReturn("LOCAL-001");
         when(links.lockBooking(7L)).thenAnswer(a->row);when(links.lockBookingNo("FB-7")).thenAnswer(a->row);
         when(links.lockIncoming("9","WT-7")).thenAnswer(a->row);
@@ -66,16 +61,13 @@ class FleetPoolOrderBridgeTest {
         doThrow(new IllegalStateException("appointment binding conflict")).when(appointmentSources).materialized("9","FB-7",77L);
         assertThatThrownBy(this::incoming).isInstanceOf(IllegalStateException.class).hasMessageContaining("appointment binding conflict");
     }
-    FleetBookingIncomingGateway.Evidence receipt(){return new FleetBookingIncomingGateway.Evidence("WT-7","WT-7","92","FBA:ONT8","READY_FOR_DISPATCH","hash",List.of(
-        new FleetBookingIncomingGateway.Pallet("101","PALLET-1",2,BigDecimal.TEN,BigDecimal.ONE),
-        new FleetBookingIncomingGateway.Pallet("102","PALLET-2",2,BigDecimal.TEN,BigDecimal.ONE)),4);}
+    Receipt receipt(){return new Receipt("WT-7","92","FBA:ONT8","READY_FOR_DISPATCH",List.of(
+        new ReceivedPallet("101",2),new ReceivedPallet("102",2)),4);}
     void dispatch(String type){service.confirm(input(type),"op");incoming();service.receiving("9","WT-7","pda");
         service.acceptedReceipt(7,receipt(),3,"op");service.boundDispatch(7,"9","DISPATCH-7","op");}
-    DeliveryOrder delivery(int signed){var d=new DeliveryOrder();d.setId(71L);d.setDispatchOrderId(70L);d.setDeliveryGroupKey("CODE:ONT8");d.setCustomerId("9");d.setDispatchNo("DISPATCH-7");d.setDeliveryNo("DELIVERY-7");
-        d.setStatus("DELIVERED");d.setPackageCount(4);d.setSignedPackages(signed);d.setSignedAt(LocalDateTime.now());
-        when(evidence.deliveries("9",70)).thenReturn(List.of(new SourceDeliveryCompletionPolicy.Delivery(71,70,"CODE:ONT8",4,(long)signed,d.getSignedAt(),d.getSignedAt().minusHours(1))));
-        when(evidence.picks("9",70)).thenReturn(List.of(new SourceDeliveryCompletionPolicy.Pick(1,70,"CODE:ONT8",77,4,1L,null,null,null)));
-        return d;}
+    SignedDelivery delivery(int signed){
+        when(evidence.fullySigned("9","WT-7",77,4)).thenReturn(signed>=4);
+        return new SignedDelivery("9","DISPATCH-7","DELIVERY-7",true,LocalDateTime.now());}
     @Test void looseboardConfirmationCreatesOnlyCommercialRecordAndReplaysWithoutAnotherOrder(){
         var result=service.confirm(input("LOCAL_LOOSEBOARD"),"op");
         assertThat(result.businessOrderNo()).isEqualTo("LOCAL-001");assertThat(looseOrder.getLastlegOrderId()).isNull();
@@ -130,9 +122,9 @@ class FleetPoolOrderBridgeTest {
     @Test void incomingBlocksCancellationAndWrongReceiptIdentityOrDuplicatePhysicalPallets(){
         service.confirm(input("US_TRUCK"),"op");incoming();
         assertThatThrownBy(()->service.cancelBeforeIncoming(7,"9","op","取消")).hasMessageContaining("已登记来货");
-        var r=receipt();var wrong=new FleetBookingIncomingGateway.Evidence("OTHER",r.inboundCode(),r.warehouseId(),r.destinationKey(),r.status(),r.receiptHash(),r.pallets(),4);
+        var r=receipt();var wrong=new Receipt("OTHER",r.warehouseId(),r.destinationKey(),r.status(),r.pallets(),4);
         assertThatThrownBy(()->service.acceptedReceipt(7,wrong,3,"op")).hasMessageContaining("来源");
-        var duplicate=new FleetBookingIncomingGateway.Evidence(r.incomingNo(),r.inboundCode(),r.warehouseId(),r.destinationKey(),r.status(),r.receiptHash(),List.of(r.pallets().get(0),r.pallets().get(0)),4);
+        var duplicate=new Receipt(r.incomingNo(),r.warehouseId(),r.destinationKey(),r.status(),List.of(r.pallets().get(0),r.pallets().get(0)),4);
         assertThatThrownBy(()->service.acceptedReceipt(7,duplicate,3,"op")).hasMessageContaining("重复");
     }
     @Test void actualDepartureAndFullSignatureDriveLooseboardExactlyOnce(){
@@ -157,22 +149,15 @@ class FleetPoolOrderBridgeTest {
         assertThatThrownBy(()->service.confirm(missing,"op")).hasMessageContaining("独立实托数");
         verifyNoInteractions(trucks,loose,links);
     }
-    @Test void anotherCoShippedSourceReturnDoesNotBlockThisFullySignedCommercialOrder(){
+    @Test void deliveryOwnedProofCompletesOnlyThisCommercialSource(){
         dispatch("US_TRUCK");service.departed("9","DISPATCH-7",Map.of(77L,4),"op",LocalDateTime.now());
-        var d=delivery(6);d.setPackageCount(8);
-        when(evidence.deliveries("9",70)).thenReturn(List.of(new SourceDeliveryCompletionPolicy.Delivery(71,70,"CODE:ONT8",8,6L,d.getSignedAt(),d.getSignedAt().minusHours(1))));
-        when(evidence.picks("9",70)).thenReturn(List.of(new SourceDeliveryCompletionPolicy.Pick(1,70,"CODE:ONT8",77,4,1L,null,null,null),
-            new SourceDeliveryCompletionPolicy.Pick(2,70,"CODE:ONT8",78,4,2L,null,null,null)));
-        when(evidence.returns("9",70)).thenReturn(List.of(new SourceDeliveryCompletionPolicy.Returned(9,71,78,2,d.getSignedAt().minusMinutes(5))));
-        service.signed(d,Map.of(77L,4L,78L,4L),"op",LocalDateTime.now());assertThat(truckOrder.getStatus()).isEqualTo("COMPLETED");
+        service.signed(delivery(4),Map.of(77L,4L,78L,4L),"op",LocalDateTime.now());
+        assertThat(truckOrder.getStatus()).isEqualTo("COMPLETED");verify(evidence).fullySigned("9","WT-7",77,4);
     }
-    @Test void thisSourceReturnOrMissingHistoryCannotBeCountedAsWholeSignature(){
+    @Test void missingDeliveryOwnedProofCannotCompleteCommercialOrder(){
         dispatch("US_TRUCK");service.departed("9","DISPATCH-7",Map.of(77L,4),"op",LocalDateTime.now());
-        var d=delivery(2);
-        when(evidence.returns("9",70)).thenReturn(List.of(new SourceDeliveryCompletionPolicy.Returned(9,71,77,2,d.getSignedAt().minusMinutes(5))));
-        service.signed(d,Map.of(77L,4L),"op",LocalDateTime.now());assertThat(truckOrder.getStatus()).isEqualTo("IN_TRANSIT");
-        d=delivery(4);when(evidence.dispatchIds("9",77)).thenReturn(List.of());
-        service.signed(d,Map.of(77L,4L),"op",LocalDateTime.now());assertThat(truckOrder.getStatus()).isEqualTo("IN_TRANSIT");
+        service.signed(delivery(2),Map.of(77L,4L),"op",LocalDateTime.now());
+        assertThat(truckOrder.getStatus()).isEqualTo("IN_TRANSIT");
     }
     @Test void bindingDoesNotMeanDepartureAndCannotCompleteBeforeActualDeparture(){
         dispatch("US_TRUCK");assertThat(truckOrder.getStatus()).isEqualTo("PENDING_DISPATCH");
@@ -185,6 +170,9 @@ class FleetPoolOrderBridgeTest {
             assertThat(method.getAnnotation(Transactional.class).propagation()).isEqualTo(Propagation.MANDATORY);
         assertThat(Arrays.stream(FleetPoolOrderBridge.class.getDeclaredFields()).map(f->f.getType().getSimpleName()))
             .noneMatch(name->name.contains("FleetTrip")||name.contains("FleetBooking")||name.contains("Fee")||name.contains("Inventory"));
+        assertThat(Arrays.stream(FleetPoolOrderBridge.class.getDeclaredFields()).map(f->f.getType().getPackageName()))
+            .noneMatch(name->name.startsWith("com.baiyue.lastleg.delivery")||name.equals("com.baiyue.lastleg.fleet.trip")
+                ||name.equals("com.baiyue.lastleg.service"));
     }
     @Test void poolOnlyCallbacksCannotSucceedWithoutTheirCommercialLink(){
         assertThatThrownBy(()->service.acceptedReceipt(7,receipt(),1,"op")).hasMessageContaining("缺少唯一商业订单关联");
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/fleet/business/FleetPoolOrderNumberGeneratorTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/fleet/business/FleetPoolOrderNumberGeneratorTest.java
new file mode 100644
index 000000000..76c6a83aa
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/fleet/business/FleetPoolOrderNumberGeneratorTest.java
@@ -0,0 +1,21 @@
+package com.baiyue.lastleg.fleet.business;
+
+import org.junit.jupiter.api.Test;
+import java.time.LocalDate;
+import java.time.format.DateTimeFormatter;
+import static org.assertj.core.api.Assertions.*;
+
+class FleetPoolOrderNumberGeneratorTest {
+    private final FleetPoolOrderNumberGenerator generator=new FleetPoolOrderNumberGenerator();
+    @Test void existingLooseboardAndTruckFormatLocationAndSuffixArePreserved(){
+        String day=LocalDate.now().format(DateTimeFormatter.BASIC_ISO_DATE);
+        assertThat(generator.next("LOOSEBOARD","FBA:ONT8",1234567)).isEqualTo("LB-ONT-"+day+"-234567");
+        assertThat(generator.next("TRUCK","nyc",1000001)).isEqualTo("TR-NYC-"+day+"-000001");
+    }
+    @Test void existingPrivateDestinationAndShortCodeRulesArePreserved(){
+        String day=LocalDate.now().format(DateTimeFormatter.BASIC_ISO_DATE);
+        assertThat(generator.next("TRUCK","private address",9)).isEqualTo("TR-WH-"+day+"-000009");
+        assertThat(generator.next("LOOSEBOARD","ab12",9)).isEqualTo("LB-AB12-"+day+"-000009");
+        assertThat(generator.next("TRUCK",null,-1)).isEqualTo("TR-WH-"+day+"-999999");
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/fleet/exception/FleetTransitEvidenceTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/fleet/exception/FleetTransitEvidenceTest.java
index 589f9155e..b2b496996 100644
--- a/lastleg-service/src/test/java/com/baiyue/lastleg/fleet/exception/FleetTransitEvidenceTest.java
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/fleet/exception/FleetTransitEvidenceTest.java
@@ -17,6 +17,12 @@ import static org.junit.jupiter.api.Assertions.*;
 import static org.mockito.Mockito.*;
 
 class FleetTransitEvidenceTest {
+    @Test void removingOriginalPhysicalItemDelegatesToDispatchAuthority() {
+        var service=mock(com.baiyue.lastleg.dispatch.service.DispatchService.class);
+        org.springframework.test.util.ReflectionTestUtils.setField(adapter,"dispatchService",service);
+        adapter.removeItem("PC-1",41L);
+        verify(service).removeItem("PC-1",41L);verifyNoMoreInteractions(service);
+    }
     @BeforeAll static void initializeDeliveryMetadata() {
         com.baomidou.mybatisplus.core.metadata.TableInfoHelper.initTableInfo(
             new org.apache.ibatis.builder.MapperBuilderAssistant(new com.baomidou.mybatisplus.core.MybatisConfiguration(), "fleet-transit-evidence"),
@@ -72,11 +78,20 @@ class FleetTransitEvidenceTest {
     @Test void unsignedReturnRequiresImmutableReturnOperation() {
         delivery.setStatus("RETURNED"); delivery.setUpdatedAt(LocalDateTime.now());
         assertThrows(org.springframework.web.server.ResponseStatusException.class, () -> adapter.transitEvidence("PC-1", false));
+        assertThrows(org.springframework.web.server.ResponseStatusException.class, () -> adapter.terminalEvidence("PC-1", false));
         var returned = LocalDateTime.of(2026, 10, 3, 10, 0);
         when(operations.returnedAt("CUSTOMER-A", 41L)).thenReturn(returned);
         when(operations.returnReceipts("CUSTOMER-A", 41L)).thenReturn(List.of(new com.baiyue.lastleg.delivery.model.DeliveryReturnReceiptFact(1L, 51L, 61L, 10, returned)));
         assertEquals(returned.atZone(ZoneId.systemDefault()).toInstant(),
             adapter.transitEvidence("PC-1", false).deliveries().get(0).cargo().terminalAt());
+        var terminal=adapter.terminalEvidence("PC-1",false);
+        assertEquals("CUSTOMER-A",terminal.customerId());assertEquals(10,terminal.shippedPackages());
+        var returnedDelivery=terminal.deliveries().get(0);
+        assertEquals("FBA:ONT8",returnedDelivery.destinationKey());assertEquals(10,returnedDelivery.packages());
+        assertEquals(returned.atZone(ZoneId.systemDefault()).toInstant(),returnedDelivery.terminalAt());
+        assertEquals("RETURNED",returnedDelivery.status());assertEquals(0L,returnedDelivery.recordVersion());
+        assertEquals(List.of(new com.baiyue.lastleg.fleet.trip.FleetDispatchGateway.ReturnedReceipt("51","61",10,
+            returned.atZone(ZoneId.systemDefault()).toInstant())),returnedDelivery.receipts());
     }
 
     @Test void crossCustomerAndUnbalancedFactsFailClosed() {
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/fleet/trip/FleetTripAuthorizationTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/fleet/trip/FleetTripAuthorizationTest.java
index a3d714739..2998c50ce 100644
--- a/lastleg-service/src/test/java/com/baiyue/lastleg/fleet/trip/FleetTripAuthorizationTest.java
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/fleet/trip/FleetTripAuthorizationTest.java
@@ -87,6 +87,8 @@ class FleetTripAuthorizationTest {
     }
     @Configuration @EnableMethodSecurity
     static class Config {
+        @Bean com.baiyue.lastleg.fleet.trip.work.AppointmentWorkTripChanges workTripChanges() { return mock(com.baiyue.lastleg.fleet.trip.work.AppointmentWorkTripChanges.class); }
+        @Bean com.baiyue.lastleg.appointmentwork.AppointmentWorkDispatchPort workDispatches() { return mock(com.baiyue.lastleg.appointmentwork.AppointmentWorkDispatchPort.class); }
         @Bean FleetTripCalendarService calendar() { return mock(FleetTripCalendarService.class); }
         @Bean FleetCapacityOfferCommandMapper commands() { return mock(FleetCapacityOfferCommandMapper.class); }
         @Bean FleetDispatchPlanningGateway planning() { return mock(FleetDispatchPlanningGateway.class); }
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/fleet/trip/FleetTripCalendarMapperTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/fleet/trip/FleetTripCalendarMapperTest.java
index 9940bb7f0..19174d845 100644
--- a/lastleg-service/src/test/java/com/baiyue/lastleg/fleet/trip/FleetTripCalendarMapperTest.java
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/fleet/trip/FleetTripCalendarMapperTest.java
@@ -28,6 +28,18 @@ class FleetTripCalendarMapperTest {
         assertThat(rows).extracting(FleetTripEntity::getTripNo).containsExactly("TR-FROM","TR-LAST");
         assertThat(rows).extracting(FleetTripEntity::getStatus).containsExactly("CANCELLED","COMPLETED");
         assertThat(rows.get(0).getPlannedDepartureAt()).isEqualTo(from);
+        // The actual month is authoritative even when the original plan is outside this window.
+        jdbc.update(insert,"TR-ACTUAL-IN","IN_TRANSIT",from.minusDays(3),to);
+        jdbc.update("UPDATE ll_fleet_trip SET departed_at=? WHERE trip_no=?",from.plusHours(2),"TR-ACTUAL-IN");
+        jdbc.update(insert,"TR-ACTUAL-OUT","IN_TRANSIT",from.plusHours(3),to);
+        jdbc.update("UPDATE ll_fleet_trip SET departed_at=? WHERE trip_no=?",to,"TR-ACTUAL-OUT");
+        jdbc.update(insert,"TR-ACTUAL-FROM","IN_TRANSIT",from.minusDays(2),to);
+        jdbc.update("UPDATE ll_fleet_trip SET departed_at=? WHERE trip_no=?",from,"TR-ACTUAL-FROM");
+        assertThat(mapper.calendar(from,to)).extracting(FleetTripEntity::getTripNo)
+            .containsExactly("TR-ACTUAL-FROM","TR-FROM","TR-ACTUAL-IN","TR-LAST");
+        jdbc.update("UPDATE ll_fleet_trip SET planned_departure_at=? WHERE trip_no=?",to.plusDays(20),"TR-ACTUAL-IN");
+        assertThat(mapper.calendar(from,to)).extracting(FleetTripEntity::getTripNo)
+            .containsExactly("TR-ACTUAL-FROM","TR-FROM","TR-ACTUAL-IN","TR-LAST");
         var many=new ArrayList<Object[]>();for(int i=0;i<2002;i++)many.add(new Object[]{"TR-MANY-"+i,"PLANNED",from.plusHours(1),to});
         jdbc.batchUpdate(insert,many);
         assertThat(mapper.calendar(from,to)).hasSize(2001);
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/fleet/trip/FleetTripPersistenceTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/fleet/trip/FleetTripPersistenceTest.java
index 2c5d7d03b..d99381511 100644
--- a/lastleg-service/src/test/java/com/baiyue/lastleg/fleet/trip/FleetTripPersistenceTest.java
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/fleet/trip/FleetTripPersistenceTest.java
@@ -54,6 +54,40 @@ import static org.mockito.ArgumentMatchers.*;
 import static org.mockito.Mockito.*;
 
 class FleetTripPersistenceTest {
+    @Test void originalBatchReferencesSurviveRemovalReentryAndLaterDispatchReassignment() throws Exception {
+        String number=assignedTrip();dispatch(11,"CLIENT-A","92");dispatch(12,"CLIENT-B","92");
+        var allocations=mock(com.baiyue.lastleg.appointmentwork.AppointmentWorkDispatchPort.class);
+        ReflectionTestUtils.setField(service,"appointmentAllocations",allocations);
+        var a=List.of(batchReference("1","CLIENT-A",6),batchReference("2","CLIENT-A",4));
+        var originalB=List.of(batchReference("3","CLIENT-B",10));
+        var current=new java.util.HashMap<Long,List<com.baiyue.lastleg.appointmentwork.AppointmentWorkDispatchPort.BatchReference>>();current.put(11L,a);current.put(12L,originalB);
+        when(allocations.references(anyList())).thenAnswer(call->{List<Long> ids=call.getArgument(0);return ids.stream().collect(java.util.stream.Collectors.toMap(id->id,id->current.getOrDefault(id,List.of())));});
+        service.bindDispatch(number,"1",new FleetTripModels.BindingCommand(1L,"DP-11","加入甲"));
+        var both=service.bindDispatch(number,"1",new FleetTripModels.BindingCommand(2L,"DP-12","加入乙"));
+        assertThat(both.dispatches().get(0).appointmentBatches()).containsExactlyElementsOf(a);assertThat(both.previousDispatches()).isEmpty();
+        service.unbindDispatch(number,"1",new FleetTripModels.BindingCommand(3L,"DP-12","乙后送"));
+        current.put(12L,List.of(batchReference("4","CLIENT-B",4),batchReference("5","CLIENT-B",6)));
+        var reopened=service.detail(number);
+        assertThat(reopened.dispatches()).extracting(FleetTripModels.DispatchBinding::customerId).containsExactly("CLIENT-A");
+        assertThat(reopened.previousDispatches()).hasSize(1);
+        var previous=reopened.previousDispatches().get(0);assertThat(previous.dispatchNo()).isEqualTo("DP-12");assertThat(previous.customerId()).isEqualTo("CLIENT-B");
+        assertThat(previous.recordVersion()).isEqualTo(3);assertThat(previous.recordedAt()).isNotNull();assertThat(previous.appointmentBatches()).isEqualTo(originalB);
+        var rebound=service.bindDispatch(number,"1",new FleetTripModels.BindingCommand(4L,"DP-12","按当前后送批重入"));
+        assertThat(rebound.dispatches().get(1).appointmentBatches()).isEqualTo(current.get(12L));
+        assertThat(rebound.previousDispatches()).hasSize(1);assertThat(rebound.previousDispatches().get(0).appointmentBatches()).isEqualTo(originalB);
+        var audit=service.history(number,1,20).records().stream().filter(h->h.recordVersion()==3).findFirst().orElseThrow();
+        assertThat(audit.snapshot().dispatches().get(1).appointmentBatches()).isEqualTo(originalB);
+        assertThat(rebound.appointmentHistoryUnavailableReason()).isNull();
+        var json=new ObjectMapper().findAndRegisterModules();
+        var incomplete=json.valueToTree(audit.snapshot());((com.fasterxml.jackson.databind.node.ObjectNode)incomplete.path("dispatches").get(1)).remove("appointmentBatches");
+        jdbc.update("UPDATE ll_fleet_trip_history SET snapshot_json=? WHERE trip_id=(SELECT id FROM ll_fleet_trip WHERE trip_no=?) AND record_version=3",json.writeValueAsString(incomplete),number);
+        var readable=service.detail(number);assertThat(readable.dispatches()).hasSize(2);assertThat(readable.dispatches().get(1).appointmentBatches()).isEqualTo(current.get(12L));
+        assertThat(readable.previousDispatches()).isEmpty();assertThat(readable.appointmentHistoryUnavailableReason()).contains("追踪不完整");
+    }
+    private static com.baiyue.lastleg.appointmentwork.AppointmentWorkDispatchPort.BatchReference batchReference(String id,String customer,int packages) {
+        return new com.baiyue.lastleg.appointmentwork.AppointmentWorkDispatchPort.BatchReference("FBA_APPOINTMENT:"+id,"AP-"+id,customer,
+            List.of(new com.baiyue.lastleg.appointmentwork.AppointmentWorkDispatchPort.BatchSource("ORDER:"+customer,"FBA:ONT8",packages)));
+    }
     private JdbcTemplate jdbc;
     private FleetTripService service;
     private FleetTripPreparationService preparation;
@@ -146,7 +180,10 @@ class FleetTripPersistenceTest {
         preparation = transactional(new FleetTripPreparationService(service,session.getMapper(FleetTripMapper.class),session.getMapper(FleetCapacityOfferCommandMapper.class),json),FleetTripPreparationService.class);
         planning=mock(FleetDispatchPlanningGateway.class);
         ReflectionTestUtils.setField(service,"planning",planning);
+        ReflectionTestUtils.setField(service,"workChanges",mock(com.baiyue.lastleg.fleet.trip.work.AppointmentWorkTripChanges.class));
+        ReflectionTestUtils.setField(service,"appointmentAllocations",mock(com.baiyue.lastleg.appointmentwork.AppointmentWorkDispatchPort.class));
         execution = transactional(new FleetTripExecutionService(session.getMapper(FleetTripMapper.class), bindingMapper, resources, dispatchGateway, service, drivers, vehicles, json, reservations), FleetTripExecutionService.class);
+        ReflectionTestUtils.setField(execution,"appointmentAllocations",mock(com.baiyue.lastleg.appointmentwork.AppointmentWorkDispatchPort.class));
         var customerDirectory = mock(com.baiyue.lastleg.fleet.customer.FleetCustomerDirectory.class);
         when(customerDirectory.required(anyLong())).thenAnswer(call -> new com.baiyue.lastleg.fleet.customer.FleetCustomerDirectory.Customer(
             Long.toString(call.getArgument(0,Long.class)), "00001", "外接客户", null, null));
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/fleet/trip/work/AppointmentWorkTransportProviderTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/fleet/trip/work/AppointmentWorkTransportProviderTest.java
new file mode 100644
index 000000000..f38a769d7
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/fleet/trip/work/AppointmentWorkTransportProviderTest.java
@@ -0,0 +1,30 @@
+package com.baiyue.lastleg.fleet.trip.work;
+
+import com.baiyue.lastleg.appointmentwork.AppointmentWorkCommitmentService;
+import com.baiyue.lastleg.fleet.driver.FleetWarehouseClient;
+import org.junit.jupiter.api.Test;
+import java.util.List;
+import java.util.stream.IntStream;
+import static com.baiyue.lastleg.appointmentwork.AppointmentWorkFactGateway.*;
+import static com.baiyue.lastleg.appointmentwork.AppointmentWorkModels.*;
+import static org.junit.jupiter.api.Assertions.*;
+import static org.mockito.Mockito.*;
+
+class AppointmentWorkTransportProviderTest {
+    @Test void linkedVehicleCarriesIndependentCargoAndCommonPlanVersions() {
+        var mapper=mock(AppointmentWorkTripMapper.class);var commitments=mock(AppointmentWorkCommitmentService.class);
+        var trip=new com.baiyue.lastleg.fleet.trip.FleetTripEntity();trip.setId(10L);trip.setTripNo("TR-10");
+        when(mapper.trip(10)).thenReturn(trip);when(commitments.impactToken("TRIP:10")).thenReturn("TRIP:10:2");
+        when(commitments.impactToken("TRIP_PLAN:10")).thenReturn("TRIP_PLAN:10:0");
+        var request=new FactRequest("W",Type.TRANSPORT,Flow.TRANSFER,"C",null,null,"10",List.of(),List.of(),List.of());
+        var fact=new AppointmentWorkTransportProvider(mapper,mock(FleetWarehouseClient.class),commitments,"token").read(List.of(request)).get(0);
+        assertEquals("TRIP:10:2",fact.impactToken());assertEquals("TRIP_PLAN:10:0",fact.dependentImpactToken());
+    }
+    @Test void unassignedTransportWorkDoesNotQueryTripsOrWarehousesPerSource() {
+        var mapper=mock(AppointmentWorkTripMapper.class);var warehouses=mock(FleetWarehouseClient.class);var commitments=mock(AppointmentWorkCommitmentService.class);
+        var requests=IntStream.range(0,200).mapToObj(i->new FactRequest("W"+i,Type.TRANSPORT,Flow.TRANSFER,"C"+i,"INBOUND:"+i,null,null,List.of(),List.of(),List.of())).toList();
+        var facts=new AppointmentWorkTransportProvider(mapper,warehouses,commitments,"token").read(requests);
+        assertEquals(200,facts.size());assertTrue(facts.stream().allMatch(f->!f.planExists() && f.executionStatus()==ExecutionStatus.PENDING));
+        verifyNoInteractions(mapper,warehouses,commitments);
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/fleet/trip/work/AppointmentWorkTripChangesTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/fleet/trip/work/AppointmentWorkTripChangesTest.java
new file mode 100644
index 000000000..17ffd072c
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/fleet/trip/work/AppointmentWorkTripChangesTest.java
@@ -0,0 +1,44 @@
+package com.baiyue.lastleg.fleet.trip.work;
+
+import com.baiyue.lastleg.appointmentwork.*;
+import com.baiyue.lastleg.fleet.trip.FleetTripEntity;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import org.junit.jupiter.api.Test;
+import java.time.LocalDateTime;
+import java.util.*;
+import static org.junit.jupiter.api.Assertions.*;
+import static org.mockito.Mockito.*;
+
+class AppointmentWorkTripChangesTest {
+    @Test void membershipAndRouteChangesReviewVehicleWhileOnlyCommonPlanChangesAffectOtherAppointments() {
+        var rows=new HashMap<String,AppointmentWorkMapper.CommitmentRow>();
+        var persistence=mock(AppointmentWorkMapper.class);
+        when(persistence.lockCommitment(anyString())).thenAnswer(c->rows.get(c.getArgument(0)));
+        when(persistence.commitment(anyString())).thenAnswer(c->rows.get(c.getArgument(0)));
+        when(persistence.insertCommitment(anyString(),anyString())).thenAnswer(c->{
+            var row=new AppointmentWorkMapper.CommitmentRow();row.setEntityKey(c.getArgument(0));row.setStateJson(c.getArgument(1));
+            rows.put(row.getEntityKey(),row);return 1;
+        });
+        when(persistence.updateCommitment(anyString(),anyString(),anyLong())).thenAnswer(c->{
+            var row=rows.get(c.getArgument(0));row.setStateJson(c.getArgument(1));row.setImpactVersion(c.getArgument(2));return 1;
+        });
+        var commitments=new AppointmentWorkCommitmentService(persistence,new ObjectMapper().findAndRegisterModules());
+        var mapper=mock(AppointmentWorkTripMapper.class);
+        var changes=new AppointmentWorkTripChanges(mock(AppointmentWorkChanges.class),commitments,mapper);
+        var trip=new FleetTripEntity();trip.setId(10L);trip.setVehicleId(20L);trip.setDriverId(30L);trip.setStatus("PLANNED");
+        trip.setStopsJson("[A,B,C]");trip.setPlannedDepartureAt(LocalDateTime.parse("2026-10-17T10:00:00"));
+        trip.setExpectedDriverEndAt(LocalDateTime.parse("2026-10-17T20:00:00"));
+        when(mapper.batches(10)).thenReturn(List.of("A","B","C"));changes.changed(trip);
+        assertEquals("TRIP:10:0",commitments.impactToken("TRIP:10"));assertEquals("TRIP_PLAN:10:0",commitments.impactToken("TRIP_PLAN:10"));
+        when(mapper.batches(10)).thenReturn(List.of("C","B","A"));changes.changed(trip);
+        assertEquals("TRIP:10:0",commitments.impactToken("TRIP:10"));
+        when(mapper.batches(10)).thenReturn(List.of("A","C"));trip.setStopsJson("[A,C]");changes.changed(trip);
+        assertEquals("TRIP:10:1",commitments.impactToken("TRIP:10"));assertEquals("TRIP_PLAN:10:0",commitments.impactToken("TRIP_PLAN:10"));
+        changes.changed(trip);assertEquals("TRIP:10:1",commitments.impactToken("TRIP:10"));
+        trip.setVehicleId(21L);changes.changed(trip);assertEquals("TRIP_PLAN:10:1",commitments.impactToken("TRIP_PLAN:10"));
+        trip.setDriverId(31L);changes.changed(trip);assertEquals("TRIP_PLAN:10:2",commitments.impactToken("TRIP_PLAN:10"));
+        trip.setPlannedDepartureAt(trip.getPlannedDepartureAt().plusHours(1));changes.changed(trip);
+        assertEquals("TRIP_PLAN:10:3",commitments.impactToken("TRIP_PLAN:10"));
+        trip.setStatus("CANCELLED");changes.changed(trip);assertEquals("TRIP_PLAN:10:4",commitments.impactToken("TRIP_PLAN:10"));
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/inboundplan/InboundPlanSchemaContractTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/inboundplan/InboundPlanSchemaContractTest.java
index 7489c6b3f..b4ca55031 100644
--- a/lastleg-service/src/test/java/com/baiyue/lastleg/inboundplan/InboundPlanSchemaContractTest.java
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/inboundplan/InboundPlanSchemaContractTest.java
@@ -4,11 +4,34 @@ import org.junit.jupiter.api.Test;
 
 import java.io.IOException;
 import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.List;
+import java.util.regex.Pattern;
 
 import static org.junit.jupiter.api.Assertions.assertFalse;
 import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
 
 class InboundPlanSchemaContractTest {
+    @Test
+    void splitBatchAndVerificationDefinitionsMatchEveryDeploymentEntry() throws IOException {
+        String source=Files.readString(Path.of("src/main/resources/db/lastleg.sql"));
+        for(var file:List.of("../deploy/sql/海外区域统一增量-MySQL8.sql","../deploy/sql/reset-test-fba-appointments.sql")) {
+            String deployment=Files.readString(Path.of(file));
+            for(var name:List.of("ll_inbound_fba_appointment","ll_inbound_fba_appointment_item","ll_appointment_cargo_verification")) {
+                assertEquals(definition(source,name),definition(deployment,name),file+" must preserve allocation and history for "+name);
+            }
+        }
+    }
+
+    private static String definition(String sql,String name) {
+        var matcher=Pattern.compile("CREATE TABLE(?: IF NOT EXISTS)? "+Pattern.quote(name)+" \\([\\s\\S]*?\\) ENGINE=InnoDB[^\\r\\n]*;").matcher(sql);
+        assertTrue(matcher.find(),name+" must exist");
+        String definition=matcher.group().replace("CREATE TABLE IF NOT EXISTS","CREATE TABLE").replace("\r\n","\n");
+        assertFalse(matcher.find(),name+" must have one definition");
+        return definition;
+    }
     @Test
     void planIsUniqueByCustomerAndSourceOrderWhileContainerCanBeShared() throws IOException {
         try (var stream = getClass().getClassLoader().getResourceAsStream("db/lastleg.sql")) {
@@ -33,8 +56,11 @@ class InboundPlanSchemaContractTest {
             assertTrue(appointment.contains("confirmation_no varchar(128) null"));
             assertTrue(appointment.contains("planned_date date null"));
             assertTrue(appointment.contains("appointment_start_utc datetime(3) null"));
-            assertTrue(schema.contains("unique key uk_ll_fba_active_source (active_source_key)"));
-            assertTrue(schema.contains("unique key uk_ll_fba_active_order (active_order_id)"));
+            assertFalse(schema.contains("unique key uk_ll_fba_active_source (active_source_key)"));
+            assertFalse(schema.contains("unique key uk_ll_fba_active_order (active_order_id)"));
+            assertTrue(schema.contains("key idx_ll_fba_active_source (customer_id,source_key,active)"));
+            assertTrue(schema.contains("key idx_ll_fba_active_order (customer_id,order_id,active)"));
+            assertTrue(schema.contains("replacement_keys_json longtext null"));
             assertTrue(schema.contains("create table if not exists ll_fba_appointment_command"));
             String items = schema.substring(schema.indexOf("create table if not exists ll_inbound_fba_appointment_item ("));
             assertTrue(items.substring(0, items.indexOf("engine=innodb")).contains("customer_id varchar(128) not null"));
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/inboundplan/mapper/InboundPlanDispatchStatusPersistenceTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/inboundplan/mapper/InboundPlanDispatchStatusPersistenceTest.java
index c46136ad3..a1952e1e3 100644
--- a/lastleg-service/src/test/java/com/baiyue/lastleg/inboundplan/mapper/InboundPlanDispatchStatusPersistenceTest.java
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/inboundplan/mapper/InboundPlanDispatchStatusPersistenceTest.java
@@ -26,7 +26,7 @@ class InboundPlanDispatchStatusPersistenceTest {
         db.execute("CREATE TABLE ll_inbound_plan_line(id BIGINT,plan_id BIGINT,order_id BIGINT,inbound_code VARCHAR(50),destination_warehouse_id VARCHAR(30),destination_warehouse_code VARCHAR(30),destination_warehouse_name VARCHAR(50),fba_warehouse_code VARCHAR(30),required_package_count INT,volume_cbm DECIMAL(18,3),planned_pallet_count INT)");
         db.execute("CREATE TABLE ll_order(id BIGINT,customer_id VARCHAR(20),lx_code VARCHAR(50),order_type VARCHAR(30),overseas_warehouse_code VARCHAR(30),overseas_warehouse_name VARCHAR(50),customer_name VARCHAR(50))");
         db.execute("CREATE TABLE ll_inbound_fba_appointment_item(id BIGINT,order_id BIGINT,appointment_id BIGINT,customer_id VARCHAR(20),fba_warehouse_code VARCHAR(30),active BOOLEAN)");
-        db.execute("CREATE TABLE ll_inbound_fba_appointment(id BIGINT,created_at TIMESTAMP,appointment_no VARCHAR(50),appointment_status VARCHAR(30),appointment_at TIMESTAMP)");
+        db.execute("CREATE TABLE ll_inbound_fba_appointment(id BIGINT,created_at TIMESTAMP,appointment_no VARCHAR(50),appointment_status VARCHAR(30),appointment_at TIMESTAMP,replacement_nos_json VARCHAR(1000))");
         db.execute("CREATE TABLE ll_inbound_plan_pallet_allocation(line_id BIGINT,picked_package_count INT)");
         db.execute("CREATE TABLE ll_order_detail(order_id BIGINT,customer_id VARCHAR(20),gross_weight_kg DECIMAL(18,3),net_weight_kg DECIMAL(18,3))");
         db.execute("CREATE TABLE ll_inbound_order(id BIGINT,customer_id VARCHAR(20),gross_weight_kg DECIMAL(18,3),net_weight_kg DECIMAL(18,3))");
@@ -83,7 +83,7 @@ class InboundPlanDispatchStatusPersistenceTest {
         db.update("INSERT INTO ll_inbound_plan VALUES(4,'LIP-2','B',90,TRUE,FALSE,FALSE,'RECEIVED',CURRENT_TIMESTAMP,0)");
         db.update("INSERT INTO ll_inbound_plan_line VALUES(5,4,6,'IN-2','91','ABE4','ABE4','ABE4',1,1,1)");
         db.update("INSERT INTO ll_order VALUES(6,'B','LX-2','FIRST_LEG','LA','洛杉矶仓','客户B')");
-        db.update("INSERT INTO ll_inbound_fba_appointment VALUES(7,CURRENT_TIMESTAMP,'APT-SHARED','SUCCESS',CURRENT_TIMESTAMP)");
+        db.update("INSERT INTO ll_inbound_fba_appointment VALUES(7,CURRENT_TIMESTAMP,'APT-SHARED','SUCCESS',CURRENT_TIMESTAMP,NULL)");
         db.update("INSERT INTO ll_inbound_fba_appointment_item VALUES(8,3,7,'A','ABE4',TRUE),(9,6,7,'B','ABE4',TRUE)");
         assertThat(mapper.rows(null, query(null), 0, 20)).hasSize(2)
             .extracting(InboundPlanListResponse::appointmentNo).containsOnly("APT-SHARED");
@@ -95,6 +95,17 @@ class InboundPlanDispatchStatusPersistenceTest {
         }
     }
 
+    @Test void splitSourcesNeverExposeAnArbitraryLatestAppointmentAsTheWholeOrder() {
+        db.update("INSERT INTO ll_inbound_fba_appointment VALUES(7,CURRENT_TIMESTAMP,'AP-FIRST','SUCCESS',CURRENT_TIMESTAMP,NULL),(8,CURRENT_TIMESTAMP,'AP-SECOND','PENDING',NULL,NULL)");
+        db.update("INSERT INTO ll_inbound_fba_appointment_item VALUES(9,3,7,'A','ABE4',TRUE),(10,3,8,'A','ABE4',TRUE)");
+        var row=mapper.rows("A",query(null),0,20).get(0);
+        assertThat(row.appointmentStatus()).isEqualTo("MULTIPLE");assertThat(row.appointmentNo()).isNull();assertThat(row.appointmentAt()).isNull();
+        db.update("UPDATE ll_inbound_fba_appointment_item SET active=FALSE WHERE id=10");
+        db.update("UPDATE ll_inbound_fba_appointment SET appointment_status='CANCELLED' WHERE id=8");
+        var remaining=mapper.rows("A",query(null),0,20).get(0);
+        assertThat(remaining.appointmentNo()).isEqualTo("AP-FIRST");assertThat(remaining.appointmentStatus()).isEqualTo("SUCCESS");
+    }
+
     private void dispatch(long id, String owner, String status, String itemOwner) {
         db.update("INSERT INTO ll_dispatch_order VALUES(?,?,?)", id, owner, status);
         db.update("INSERT INTO ll_dispatch_item VALUES(?,?,?,3)", id, itemOwner, id);
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/inboundplan/pda/service/ReceivingContainerServiceBehaviorTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/inboundplan/pda/service/ReceivingContainerServiceBehaviorTest.java
index f2f13a06e..67cfba200 100644
--- a/lastleg-service/src/test/java/com/baiyue/lastleg/inboundplan/pda/service/ReceivingContainerServiceBehaviorTest.java
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/inboundplan/pda/service/ReceivingContainerServiceBehaviorTest.java
@@ -82,6 +82,7 @@ class ReceivingContainerServiceBehaviorTest {
     @BeforeEach
     void setUp() {
         service = new ReceivingContainerService();
+        ReflectionTestUtils.setField(service,"workRouteGuard",org.mockito.Mockito.mock(com.baiyue.lastleg.inboundplan.work.AppointmentWorkReceivingGuard.class));
         ReflectionTestUtils.setField(service, "plans", plans);
         ReflectionTestUtils.setField(service, "lines", lines);
         ReflectionTestUtils.setField(service, "pallets", pallets);
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/inboundplan/receiving/FbaReceivingAuthorizationTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/inboundplan/receiving/FbaReceivingAuthorizationTest.java
new file mode 100644
index 000000000..3ff7b44c1
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/inboundplan/receiving/FbaReceivingAuthorizationTest.java
@@ -0,0 +1,69 @@
+package com.baiyue.lastleg.inboundplan.receiving;
+
+import com.baiyue.common.security.AuthenticatedUser;
+import org.junit.jupiter.api.Test;
+import org.springframework.context.annotation.*;
+import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
+import org.springframework.security.core.context.SecurityContextHolder;
+import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
+import org.springframework.security.core.authority.SimpleGrantedAuthority;
+import org.springframework.security.access.AccessDeniedException;
+import org.springframework.web.server.ResponseStatusException;
+import java.util.*;
+import static org.junit.jupiter.api.Assertions.*;
+import static org.mockito.Mockito.*;
+import static com.baiyue.lastleg.inboundplan.receiving.FbaReceivingContracts.*;
+
+class FbaReceivingAuthorizationTest {
+    static final String EDIT="platform:overseas-warehouse:inbound-order:fba-appointment", DELETE="platform:appointment:delete", READ="platform:appointment:list";
+    @Configuration @EnableMethodSecurity static class Config {
+        @Bean FbaReceivingService service(){return mock(FbaReceivingService.class);}
+        @Bean FbaReceivingController controller(FbaReceivingService service){return new FbaReceivingController(service);}
+    }
+    @Test void listOnlyCanReadButCannotChangeOrCancel() {
+        try(var context=new AnnotationConfigApplicationContext(Config.class)) {
+            var user=login(0L,"PLATFORM",READ);var controller=context.getBean(FbaReceivingController.class);var service=context.getBean(FbaReceivingService.class);
+            controller.context(user,"FBA_APPOINTMENT:1");verify(service).context("FBA_APPOINTMENT:1");
+            var query=new ExecutionQuery(List.of(new FbaAppointmentExecutionPort.Member("FBA_APPOINTMENT:1","A")));
+            controller.executionScope(user,query);verify(service).executionScope(query);
+            assertThrows(AccessDeniedException.class,()->controller.book(user,null));
+            assertThrows(AccessDeniedException.class,()->controller.plan(user,null));
+            assertThrows(AccessDeniedException.class,()->controller.refreshCargo(user,null));
+            assertThrows(AccessDeniedException.class,()->controller.cancel(user,"RA-1",null));
+            assertThrows(AccessDeniedException.class,()->controller.propose(user,null));
+        } finally {SecurityContextHolder.clearContext();}
+    }
+    @Test void editingCannotCancelThroughRescheduleOrRemovalAndDeleteDoesNotGrantEditing() {
+        try(var context=new AnnotationConfigApplicationContext(Config.class)) {
+            var controller=context.getBean(FbaReceivingController.class);var service=context.getBean(FbaReceivingService.class);
+            var user=login(0L,"PLATFORM",EDIT);
+            assertThrows(AccessDeniedException.class,()->controller.cancel(user,"RA-1",null));
+            assertThrows(AccessDeniedException.class,()->controller.resolve(user,"CH-1",null));
+            assertEquals(400,assertThrows(ResponseStatusException.class,()->controller.reschedule(user,"RA-1",new GroupChange("key",0,"CANCEL",null,"仓库取消","t"))).getStatusCode().value());
+            var deleteUser=login(0L,"PLATFORM",DELETE);
+            assertThrows(AccessDeniedException.class,()->controller.plan(deleteUser,null));
+            assertThrows(AccessDeniedException.class,()->controller.refreshCargo(deleteUser,null));
+            assertThrows(AccessDeniedException.class,()->controller.reschedule(deleteUser,"RA-1",null));
+            assertThrows(AccessDeniedException.class,()->controller.propose(deleteUser,null));verifyNoInteractions(service);
+        } finally {SecurityContextHolder.clearContext();}
+    }
+    @Test void correctAuthoritiesStillRejectClientIdentityAndPermitExplicitScopeCommands() {
+        try(var context=new AnnotationConfigApplicationContext(Config.class)) {
+            var controller=context.getBean(FbaReceivingController.class);var service=context.getBean(FbaReceivingService.class);
+            var client=login(7L,"CLIENT",READ,EDIT,DELETE);
+            assertEquals(403,assertThrows(ResponseStatusException.class,()->controller.context(client,"FBA_APPOINTMENT:1")).getStatusCode().value());
+            assertEquals(403,assertThrows(ResponseStatusException.class,()->controller.plan(client,null)).getStatusCode().value());
+            assertEquals(403,assertThrows(ResponseStatusException.class,()->controller.refreshCargo(client,null)).getStatusCode().value());
+            assertEquals(403,assertThrows(ResponseStatusException.class,()->controller.executionScope(client,null)).getStatusCode().value());
+            var user=login(0L,"PLATFORM",EDIT,DELETE);var request=new Resolve("key",0,"CONFIRM","明确回复","t");
+            controller.resolve(user,"CH-1",request);verify(service).resolve("1","CH-1",request);
+            var editUser=login(0L,"PLATFORM",EDIT);
+            controller.plan(editUser,null);verify(service).plan("1",null);
+            controller.refreshCargo(editUser,null);verify(service).refreshCargo("1",null);
+        } finally {SecurityContextHolder.clearContext();}
+    }
+    static AuthenticatedUser login(long customer,String app,String...permissions) {
+        var user=new AuthenticatedUser(1L,customer,0L,1L,"operator",app,"WEB",Set.of(permissions));
+        SecurityContextHolder.getContext().setAuthentication(new UsernamePasswordAuthenticationToken(user,"",Arrays.stream(permissions).map(SimpleGrantedAuthority::new).toList()));return user;
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/inboundplan/service/AppointmentCargoVerificationPersistenceTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/inboundplan/service/AppointmentCargoVerificationPersistenceTest.java
new file mode 100644
index 000000000..14b236581
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/inboundplan/service/AppointmentCargoVerificationPersistenceTest.java
@@ -0,0 +1,112 @@
+package com.baiyue.lastleg.inboundplan.service;
+
+import com.baiyue.lastleg.appointmentplanning.*;
+import com.baiyue.lastleg.inboundplan.dto.*;
+import org.junit.jupiter.api.Test;
+import org.springframework.context.annotation.AnnotationConfigApplicationContext;
+import org.springframework.jdbc.core.JdbcTemplate;
+import org.springframework.web.server.ResponseStatusException;
+import javax.sql.DataSource;
+import java.time.LocalDateTime;
+import java.util.List;
+import java.util.concurrent.*;
+import static org.junit.jupiter.api.Assertions.*;
+import static org.mockito.ArgumentMatchers.*;
+import static org.mockito.Mockito.*;
+
+class AppointmentCargoVerificationPersistenceTest {
+    private static AppointmentCargoVerificationService.Save save(int version,Integer quantity,String key,String... refs) {
+        return new AppointmentCargoVerificationService.Save("FBA:ONT8","ORDER:1",version,quantity,List.of(refs),"按原票核实",key);
+    }
+    private static SourceFbaAppointmentRequest appointment(String key,FbaAppointmentDetails details) {
+        return new SourceFbaAppointmentRequest(List.of(new SourceFbaAppointmentRequest.SourceRef("A","ORDER:1","FBA:ONT8")),"100","ONT8",details,key);
+    }
+    private static FbaAppointmentDetails pending() {return new FbaAppointmentDetails(null,null,null,null,null,null,"PENDING",null,null,null);}
+    private static FbaAppointmentDetails confirmed() {return new FbaAppointmentDetails(null,null,null,"EXT-1",LocalDateTime.of(2026,10,20,9,0),null,"SUCCESS",null,null,null);}
+    private static void flags(AnnotationConfigApplicationContext context) {
+        when(context.getBean(AppointmentBatchPreviewMapper.class).flags(List.of(1L))).thenReturn(List.of(new AppointmentBatchPreviewMapper.Flags(1L,false,false,false)));
+    }
+    @Test void savesWithoutAppointmentOrConfirmationAndReplaysOriginalVersionAfterLaterEdits() {
+        try(var context=new AnnotationConfigApplicationContext(FbaAppointmentPersistenceTest.Config.class)) {
+            var service=context.getBean(AppointmentCargoVerificationService.class);
+            var db=new JdbcTemplate(context.getBean(DataSource.class));
+            var first=service.save("ORDER:1","A",save(0,10,"first","FBA-A"),"operator","客服");
+            assertEquals(1,first.version());assertEquals(List.of("FBA-A"),first.shipmentReferences());
+            service.save("ORDER:1","A",save(1,9,"second","FBA-A-NEW"),"operator","客服");
+            assertEquals(first,service.save("ORDER:1","A",save(0,10,"first","FBA-A"),"operator","客服"));
+            assertEquals(2,db.queryForObject("SELECT COUNT(*) FROM ll_appointment_cargo_verification",Integer.class));
+            assertEquals(0,db.queryForObject("SELECT COUNT(*) FROM ll_inbound_fba_appointment",Integer.class));
+            assertEquals(0,db.queryForObject("SELECT version FROM ll_order WHERE id=1",Integer.class));
+            assertThrows(ResponseStatusException.class,()->service.save("ORDER:1","A",save(0,10,"first","OTHER"),"operator","客服"));
+            assertThrows(ResponseStatusException.class,()->service.save("ORDER:1","A",save(0,10,"first","FBA-A"),"other-operator","客服"));
+        }
+    }
+    @Test void verificationEnforcesSourceLimitAndExistingAllocationAndSurvivesCancellation() {
+        try(var context=new AnnotationConfigApplicationContext(FbaAppointmentPersistenceTest.Config.class)) {
+            flags(context);
+            var cargo=context.getBean(AppointmentCargoVerificationService.class);
+            var appointments=context.getBean(InboundFbaAppointmentService.class);
+            assertEquals(409,assertThrows(ResponseStatusException.class,()->cargo.save("ORDER:1","A",save(0,11,"overflow"),"operator","客服")).getStatusCode().value());
+            cargo.save("ORDER:1","A",save(0,8,"verified","FBA-A"),"operator","客服");
+            var planned=appointments.createFromSources("operator",appointment("create",pending()));
+            assertEquals(8,planned.items().get(0).packageCount());
+            assertEquals(1,planned.items().get(0).cargoVerificationVersion());
+            assertEquals(List.of("FBA-A"),planned.items().get(0).shipmentReferences());
+            assertThrows(ResponseStatusException.class,()->cargo.save("ORDER:1","A",save(1,7,"under-allocated","FBA-A"),"operator","客服"));
+            var confirmed=appointments.update("operator",planned.appointmentNo(),new UpdateFbaAppointmentRequest(confirmed(),0,"confirm"));
+            assertEquals("SUCCESS",confirmed.appointmentStatus(),"独立核实资料应满足预约货量和货件门禁，无需改写原订单明细");
+            cargo.save("ORDER:1","A",save(1,8,"new-reference","FBA-RECHECKED"),"operator","客服");
+            assertEquals(List.of("FBA-A"),appointments.detail(planned.appointmentNo()).items().get(0).shipmentReferences(),"后续核实不能静默改变原预约快照");
+            appointments.delete("operator",planned.appointmentNo(),new CancelFbaAppointmentRequest(1,"对方取消"));
+            var db=new JdbcTemplate(context.getBean(DataSource.class));
+            assertEquals(2,db.queryForObject("SELECT COUNT(*) FROM ll_appointment_cargo_verification",Integer.class));
+            assertEquals(8,context.getBean(AppointmentCargoVerificationMapper.class).allocated("A","ORDER:1").packages());
+            assertThrows(ResponseStatusException.class,()->cargo.save("ORDER:1","A",save(2,7,"after-cancel","FBA-RECHECKED"),"operator","客服"));
+        }
+    }
+    @Test void incompleteVerificationCanBeSavedButCannotConfirmAndChangedSourceMustBeReverified() {
+        try(var context=new AnnotationConfigApplicationContext(FbaAppointmentPersistenceTest.Config.class)) {
+            flags(context);
+            var cargo=context.getBean(AppointmentCargoVerificationService.class);
+            var appointments=context.getBean(InboundFbaAppointmentService.class);
+            cargo.save("ORDER:1","A",save(0,10,"only-quantity"),"operator","客服");
+            assertThrows(ResponseStatusException.class,()->appointments.createFromSources("operator",appointment("cannot-confirm",confirmed())));
+            var changed=new AppointmentSourceService.Source("ORDER:1","A",1L,"IN-A",null,null,"100","美国仓","FBA:ONT8","ONT8",9,"ORDER:2",true,List.of());
+            when(context.getBean(AppointmentSourceService.class).resolveBatch(anyList())).thenReturn(List.of(changed));
+            assertThrows(ResponseStatusException.class,()->appointments.createFromSources("operator",appointment("changed",pending())));
+            assertThrows(ResponseStatusException.class,()->cargo.save("ORDER:1","A",save(1,9,"stale-source","FBA-A"),"operator","客服"));
+            var request=new AppointmentCargoVerificationService.Save("FBA:ONT8","ORDER:2",1,9,List.of("FBA-A"),null,"fresh-source");
+            cargo.save("ORDER:1","A",request,"operator","客服");
+            assertEquals(9,appointments.createFromSources("operator",appointment("fresh-create",pending())).items().get(0).packageCount());
+        }
+    }
+    @Test void simultaneousCommandsWithTheSameExpectedVersionCannotOverwriteEachOther() throws Exception {
+        try(var context=new AnnotationConfigApplicationContext(FbaAppointmentPersistenceTest.Config.class)) {
+            var service=context.getBean(AppointmentCargoVerificationService.class);
+            var executor=Executors.newFixedThreadPool(2);var start=new CountDownLatch(1);
+            try {
+                var one=executor.submit(()->attempt(service,start,"one"));var two=executor.submit(()->attempt(service,start,"two"));start.countDown();
+                assertEquals(1,(one.get(10,TimeUnit.SECONDS)?1:0)+(two.get(10,TimeUnit.SECONDS)?1:0));
+                assertEquals(1,new JdbcTemplate(context.getBean(DataSource.class)).queryForObject("SELECT COUNT(*) FROM ll_appointment_cargo_verification",Integer.class));
+            } finally {executor.shutdownNow();}
+        }
+    }
+    @Test void declaredQuantityCanStayUnknownUntilIndependentVerificationWithoutChangingSource() {
+        try(var context=new AnnotationConfigApplicationContext(FbaAppointmentPersistenceTest.Config.class)) {
+            flags(context);
+            var source=new AppointmentSourceService.Source("ORDER:1","A",1L,"IN-A",null,null,"100","美国仓","FBA:ONT8","ONT8",null,"ORDER:1",true,List.of());
+            var resolver=context.getBean(AppointmentSourceService.class);
+            when(resolver.resolveBatch(anyList())).thenReturn(List.of(source));when(resolver.resolve("ORDER:1","A",null)).thenReturn(source);
+            var service=context.getBean(AppointmentCargoVerificationService.class);
+            service.save("ORDER:1","A",save(0,12,"fill-quantity","FBA-A"),"operator","客服");
+            var view=service.get("ORDER:1","A",null);
+            assertNull(view.source().packages());assertEquals(12,view.effectivePackages());assertEquals(12L,view.availablePackages());
+            assertEquals(List.of("VERIFY_CARGO"),view.allowedActions());
+            assertEquals(12,context.getBean(InboundFbaAppointmentService.class).createFromSources("operator",appointment("create",confirmed())).items().get(0).packageCount());
+        }
+    }
+    private static boolean attempt(AppointmentCargoVerificationService service,CountDownLatch start,String key) throws Exception {
+        start.await();try {service.save("ORDER:1","A",save(0,10,key,"FBA-A"),"operator","客服");return true;}
+        catch(ResponseStatusException error) {assertEquals(409,error.getStatusCode().value());return false;}
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/inboundplan/service/AppointmentWorkPreArrangementPersistenceTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/inboundplan/service/AppointmentWorkPreArrangementPersistenceTest.java
new file mode 100644
index 000000000..b4b205f47
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/inboundplan/service/AppointmentWorkPreArrangementPersistenceTest.java
@@ -0,0 +1,78 @@
+package com.baiyue.lastleg.inboundplan.service;
+
+import com.baiyue.lastleg.appointmentplanning.*;
+import com.baiyue.lastleg.appointmentwork.*;
+import com.baiyue.lastleg.inboundplan.dto.*;
+import com.baiyue.lastleg.inboundplan.receiving.*;
+import com.baiyue.lastleg.inboundplan.work.*;
+import org.junit.jupiter.api.Test;
+import org.mybatis.spring.SqlSessionTemplate;
+import org.springframework.context.annotation.AnnotationConfigApplicationContext;
+import org.springframework.jdbc.core.JdbcTemplate;
+import org.springframework.transaction.PlatformTransactionManager;
+import org.springframework.transaction.support.TransactionTemplate;
+import org.springframework.web.server.ResponseStatusException;
+import javax.sql.DataSource;
+import java.time.LocalDate;
+import java.util.*;
+import static org.junit.jupiter.api.Assertions.*;
+import static org.mockito.Mockito.*;
+import static com.baiyue.lastleg.inboundplan.receiving.FbaReceivingContracts.*;
+
+class AppointmentWorkPreArrangementPersistenceTest {
+    @Test void siblingPlanChangeCannotGrantOrRemovePhysicalPreArrangementAndNeverAuthorizesDeparture() {
+        try(var context=new AnnotationConfigApplicationContext(FbaAppointmentPersistenceTest.Config.class)) {
+            var sources=context.getBean(AppointmentSourceService.class);
+            var cargo=List.of(source("B",1,60),source("D",2,40));
+            when(sources.resolveBatch(anyList())).thenAnswer(call->{List<AppointmentCoverageService.SourceRef> refs=call.getArgument(0);return refs.stream().map(ref->cargo.stream().filter(s->s.customerId().equals(ref.customerId()) && s.sourceKey().equals(ref.sourceKey()) && s.destinationKey().equals(ref.destinationKey())).findFirst().orElseThrow()).toList();});
+            when(sources.canonicalOrders(anyList())).thenAnswer(call->{List<AppointmentExternalSourceGateway.OrderRef> refs=call.getArgument(0);return refs.stream().map(ref->new AppointmentCoverageService.SourceRef(ref.customerId(),"ORDER:"+ref.orderId(),null)).toList();});
+            var verification=context.getBean(AppointmentCargoVerificationService.class);
+            for(var source:cargo) verification.save(source.sourceKey(),source.customerId(),new AppointmentCargoVerificationService.Save("FBA:ONT8",source.sourceVersion(),0,source.packages(),List.of("SHIP-"+source.customerId()),null,"verify-"+source.customerId()),"operator","客服");
+            var batches=context.getBean(InboundFbaAppointmentService.class);var receiving=context.getBean(FbaReceivingService.class);var store=context.getBean(FbaReceivingStore.class);
+            var batch=batches.createFromSources("operator",new SourceFbaAppointmentRequest(List.of(new SourceFbaAppointmentRequest.SourceRef("B","ORDER:1","FBA:ONT8"),new SourceFbaAppointmentRequest.SourceRef("D","ORDER:2","FBA:ONT8")),"100","ONT8",plan("PENDING"),"create-bd"));
+            batch=receiving.plan("operator",new Plan("failed-b",new Selection(batch.batchKey(),batch.version(),"B"),plan("FAILED"),"transport-v1")).batches().get(0);
+            batch=receiving.plan("operator",new Plan("failed-d",new Selection(batch.batchKey(),batch.version(),"D"),plan("FAILED"),"transport-v1")).batches().get(0);
+            assertEquals("FAILED",batch.appointmentStatus());var originalB=store.plan(batch.batchKey(),"B");
+            var session=context.getBean(SqlSessionTemplate.class);session.getConfiguration().addMapper(AppointmentWorkDispatchMapper.class);
+            var mapper=spy(session.getMapper(AppointmentWorkDispatchMapper.class));
+            doReturn(List.of(new AppointmentWorkDispatchMapper.Candidate(101L,"P-B",11L,"IP-B","B","RECEIVED",false),new AppointmentWorkDispatchMapper.Candidate(102L,"P-D",12L,"IP-D","D","RECEIVED",false))).when(mapper).candidates(batch.id());
+            doReturn(List.of(new AppointmentWorkDispatchMapper.Physical(1L,"B","FBA:ONT8",60,60))).when(mapper).physical(101L,"B");
+            doReturn(List.of(new AppointmentWorkDispatchMapper.Physical(2L,"D","FBA:ONT8",40,40))).when(mapper).physical(102L,"D");
+            var jdbc=new JdbcTemplate(context.getBean(DataSource.class));jdbc.update("INSERT INTO ll_dispatch_order(id,customer_id,status) VALUES(20,'B','PENDING_DEPARTURE')");
+            var candidates=new AppointmentWorkDispatchCandidates(mapper,batches,sources);
+            var binding=new AppointmentWorkDispatchBinding(mapper,batches,sources,mock(AppointmentWorkChanges.class),store);
+            var tx=new TransactionTemplate(context.getBean(PlatformTransactionManager.class));
+            var before=candidates.read(batch.batchKey()).candidates().stream().filter(c->c.customerId().equals("B")).findFirst().orElseThrow();
+            assertTrue(before.blockReasons().isEmpty());assertEquals(60,before.packageCount());
+            assertBindable(tx,binding,mapper,before);
+            batch=receiving.plan("operator",new Plan("pending-d",new Selection(batch.batchKey(),batch.version(),"D"),plan("PENDING"),"transport-v1")).batches().get(0);
+            assertEquals("PENDING",batch.appointmentStatus());assertEquals(originalB,store.plan(batch.batchKey(),"B"));
+            var after=candidates.read(batch.batchKey()).candidates().stream().filter(c->c.customerId().equals("B")).findFirst().orElseThrow();
+            assertEquals(before,after);assertBindable(tx,binding,mapper,after);
+            var bound=new AppointmentWorkDispatchMapper.Bound(20L,201L,101L,batch.batchKey(),"B","ORDER:1","FBA:ONT8",60);
+            doReturn(List.of(bound)).when(mapper).bindings("DP-B");doReturn(List.of()).when(mapper).dispatchPhysical("DP-B");
+            assertTrue(assertThrows(ResponseStatusException.class,()->binding.requireDeparture("DP-B")).getReason().contains("尚无有效收货确认"));
+            // Unchanged real-source guards still reject an unverified pallet and an allocation owned by another customer.
+            doReturn(List.of(new AppointmentWorkDispatchMapper.Physical(1L,"B","FBA:ONT8",60,null))).when(mapper).physical(101L,"B");
+            assertFalse(candidates.read(batch.batchKey()).candidates().get(0).blockReasons().isEmpty());
+            assertThrows(ResponseStatusException.class,()->tx.executeWithoutResult(s->binding.bind("B",20,List.of(new AppointmentWorkDispatchPort.PhysicalItem(201L,101L,"RECEIVED",60)),after.allocations())));
+            assertThrows(ResponseStatusException.class,()->tx.executeWithoutResult(s->binding.bind("D",20,List.of(new AppointmentWorkDispatchPort.PhysicalItem(201L,101L,"RECEIVED",60)),after.allocations())));
+            doReturn(List.of(new AppointmentWorkDispatchMapper.Physical(1L,"B","FBA:ONT8",61,61))).when(mapper).physical(101L,"B");
+            var excessive=candidates.read(batch.batchKey()).candidates().get(0);assertFalse(excessive.blockReasons().isEmpty());
+            assertThrows(ResponseStatusException.class,()->tx.executeWithoutResult(s->binding.bind("B",20,List.of(new AppointmentWorkDispatchPort.PhysicalItem(201L,101L,"RECEIVED",61)),excessive.allocations())));
+            assertTrue(mapper.byDispatch(20).isEmpty());
+        }
+    }
+    private static void assertBindable(TransactionTemplate tx,AppointmentWorkDispatchBinding binding,AppointmentWorkDispatchMapper mapper,AppointmentWorkDispatchCandidates.Candidate candidate) {
+        tx.executeWithoutResult(status->{
+            binding.bind("B",20,List.of(new AppointmentWorkDispatchPort.PhysicalItem(201L,101L,"RECEIVED",60)),candidate.allocations());
+            assertEquals(60,mapper.byDispatch(20).stream().mapToInt(AppointmentWorkDispatchMapper.Bound::packages).sum());
+            status.setRollbackOnly(); // Compare identical physical availability before and after the independent customer's plan command.
+        });
+        assertTrue(mapper.byDispatch(20).isEmpty());
+    }
+    private static FbaAppointmentDetails plan(String status) {return new FbaAppointmentDetails(LocalDate.of(2026,10,25),null,null,null,null,null,status,"仓库暂无确认",null,null);}
+    private static AppointmentSourceService.Source source(String customer,long id,int packages) {
+        return new AppointmentSourceService.Source("ORDER:"+id,customer,id,"IN-"+customer,null,null,"100","美国仓","FBA:ONT8","ONT8",packages,"ORDER:1",true,List.of());
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/inboundplan/service/FbaAppointmentPersistenceTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/inboundplan/service/FbaAppointmentPersistenceTest.java
index df073ba1f..c867ccdb6 100644
--- a/lastleg-service/src/test/java/com/baiyue/lastleg/inboundplan/service/FbaAppointmentPersistenceTest.java
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/inboundplan/service/FbaAppointmentPersistenceTest.java
@@ -7,6 +7,7 @@ import com.baomidou.mybatisplus.core.MybatisSqlSessionFactoryBuilder;
 import com.baiyue.lastleg.appointmentplanning.*;
 import com.baiyue.lastleg.inboundplan.dto.*;
 import com.baiyue.lastleg.inboundplan.mapper.*;
+import com.baiyue.lastleg.inboundplan.receiving.*;
 import com.fasterxml.jackson.databind.ObjectMapper;
 import org.apache.ibatis.mapping.Environment;
 import org.apache.ibatis.session.SqlSessionFactory;
@@ -69,7 +70,7 @@ class FbaAppointmentPersistenceTest {
             new AppointmentSourceService.Source("ORDER:2","B",2L,"IN-B",null,null,"100","美国仓","FBA:ONT8","ONT8",secondPackages,"ORDER:1",true,List.of()));
     }
     private static SourceFbaAppointmentRequest request(String key) {
-        return new SourceFbaAppointmentRequest(List.of(new AppointmentCoverageService.SourceRef("A","ORDER:1","FBA:ONT8"),new AppointmentCoverageService.SourceRef("B","ORDER:2","FBA:ONT8")),
+        return new SourceFbaAppointmentRequest(List.of(new SourceFbaAppointmentRequest.SourceRef("A","ORDER:1","FBA:ONT8"),new SourceFbaAppointmentRequest.SourceRef("B","ORDER:2","FBA:ONT8")),
             "100","ONT8",new FbaAppointmentDetails(null,null,null,null,null,null,"PENDING",null,null,null),key);
     }
     @Test void failureAfterHeaderAndFirstItemRollsBackTheCommandAndEntireAggregate() {
@@ -101,17 +102,31 @@ class FbaAppointmentPersistenceTest {
             } finally {executor.shutdownNow();}
         }
     }
-    @Test void cancellationReleasesGeneratedClaimsWhileReplayKeepsItsOriginalSnapshot() {
+    @Test void cancellationRetainsBatchQuantityWhileReplayKeepsItsOriginalSnapshot() {
         try(var context=new AnnotationConfigApplicationContext(Config.class)) {
             var service=context.getBean(InboundFbaAppointmentService.class);var first=service.createFromSources("operator",request("first"));
             service.delete("operator",first.appointmentNo(),new CancelFbaAppointmentRequest(0,"收货方取消时段"));
-            var second=service.createFromSources("operator",request("second"));assertNotEquals(first.appointmentNo(),second.appointmentNo());
+            assertThrows(ResponseStatusException.class,()->service.createFromSources("operator",request("second")));
             assertEquals("CANCELLED",service.detail(first.appointmentNo()).appointmentStatus());
+            assertNull(service.detail(first.appointmentNo()).plannedDate());
+            assertEquals(1,service.unscheduled(1,20).total());
             assertEquals(first,service.createFromSources("operator",request("first")));
-            var db=new JdbcTemplate(context.getBean(DataSource.class));assertEquals(4,db.queryForObject("SELECT COUNT(*) FROM ll_inbound_fba_appointment_item",Integer.class));
+            var db=new JdbcTemplate(context.getBean(DataSource.class));assertEquals(2,db.queryForObject("SELECT COUNT(*) FROM ll_inbound_fba_appointment_item",Integer.class));
             assertEquals(2,db.queryForObject("SELECT COUNT(*) FROM ll_inbound_fba_appointment_item WHERE active=1",Integer.class));
         }
     }
+    @Test void unsuccessfulBookingRetainsTheSameAllocationAndCannotBeCreatedAgain() {
+        try(var context=new AnnotationConfigApplicationContext(Config.class)) {
+            var service=context.getBean(InboundFbaAppointmentService.class);
+            var original=service.createFromSources("operator",request("failed-original"));
+            var failed=service.update("operator",original.appointmentNo(),new UpdateFbaAppointmentRequest(
+                new FbaAppointmentDetails(null,null,null,null,null,null,"FAILED","仓库无可用时段",null,null),0,"failed-command"));
+            assertEquals(original.items(),failed.items());
+            var db=new JdbcTemplate(context.getBean(DataSource.class));
+            assertEquals(30,db.queryForObject("SELECT SUM(package_count) FROM ll_inbound_fba_appointment_item WHERE active=1",Integer.class));
+            assertThrows(ResponseStatusException.class,()->service.createFromSources("operator",request("failed-duplicate")));
+        }
+    }
     @Test void restoringCancelledAppointmentRechecksClaimsAndPreservesCancellationHistory() {
         try(var context=new AnnotationConfigApplicationContext(Config.class)) {
             var service=context.getBean(InboundFbaAppointmentService.class);
@@ -144,8 +159,7 @@ class FbaAppointmentPersistenceTest {
             var json=new ObjectMapper().findAndRegisterModules().writeValueAsString(page);
             assertFalse(json.contains("internal-operator"));assertFalse(json.contains("responseJson"));assertFalse(json.contains("sourceKey"));
             assertTrue(service.cancellationHistory(original.appointmentNo(),2,1).records().isEmpty());
-            var second=service.createFromSources("internal-operator",request("history-second"));
-            assertEquals(0,service.cancellationHistory(second.appointmentNo(),1,20).total());
+            assertThrows(ResponseStatusException.class,()->service.createFromSources("internal-operator",request("history-second")));
             assertThrows(ResponseStatusException.class,()->service.cancellationHistory("AP-NOT-FOUND",1,20));
             var db=new JdbcTemplate(context.getBean(DataSource.class));
             var mapper=new ObjectMapper().findAndRegisterModules();
@@ -155,13 +169,12 @@ class FbaAppointmentPersistenceTest {
             assertNull(service.cancellationHistory(original.appointmentNo(),1,20).records().get(0).cancelReason());
         }
     }
-    @Test void unknownQuantityOnReviewDoesNotSilentlyKeepThePreviousKnownQuantity() {
+    @Test void changedUnknownSourceQuantityBlocksReviewWithoutErasingTheAllocatedQuantity() {
         try(var context=new AnnotationConfigApplicationContext(Config.class)) {
             var service=context.getBean(InboundFbaAppointmentService.class);var saved=service.createFromSources("operator",request("create"));
             when(context.getBean(AppointmentSourceService.class).resolveBatch(anyList())).thenReturn(cargo(null));
-            var updated=service.update("operator",saved.appointmentNo(),new UpdateFbaAppointmentRequest(request("unused").details(),0,"review"));
-            assertNull(updated.items().get(1).packageCount());
-            assertNull(new JdbcTemplate(context.getBean(DataSource.class)).queryForObject("SELECT package_count FROM ll_inbound_fba_appointment_item WHERE source_key='ORDER:2'",Integer.class));
+            assertThrows(ResponseStatusException.class,()->service.update("operator",saved.appointmentNo(),new UpdateFbaAppointmentRequest(request("unused").details(),0,"review")));
+            assertEquals(20,new JdbcTemplate(context.getBean(DataSource.class)).queryForObject("SELECT package_count FROM ll_inbound_fba_appointment_item WHERE source_key='ORDER:2'",Integer.class));
         }
     }
     @Test void actualIncomingBindsTheOriginalBookingInItsOwnTransactionWithoutChangingPlannedFacts() {
@@ -169,7 +182,7 @@ class FbaAppointmentPersistenceTest {
             var service=context.getBean(InboundFbaAppointmentService.class);var linker=context.getBean(AppointmentSourceLinker.class);
             var before=new AppointmentSourceService.Source("BOOKING:B-1","C",null,null,"B-1",null,"100","美国仓","FBA:ONT8","ONT8",null,"BOOKING:1",true,List.of());
             when(context.getBean(AppointmentSourceService.class).resolveBatch(anyList())).thenReturn(List.of(before));
-            var request=new SourceFbaAppointmentRequest(List.of(new AppointmentCoverageService.SourceRef("C","BOOKING:B-1","FBA:ONT8")),"100","ONT8",request("unused").details(),"before-incoming");
+            var request=new SourceFbaAppointmentRequest(List.of(new SourceFbaAppointmentRequest.SourceRef("C","BOOKING:B-1","FBA:ONT8")),"100","ONT8",request("unused").details(),"before-incoming");
             var saved=service.createFromSources("operator",request);
             assertNull(saved.items().get(0).orderId());
             assertThrows(org.springframework.transaction.IllegalTransactionStateException.class,()->linker.materialized("C","B-1",100L));
@@ -194,13 +207,17 @@ class FbaAppointmentPersistenceTest {
             var ds=new JdbcDataSource();ds.setURL("jdbc:h2:mem:appointment-"+UUID.randomUUID()+";MODE=MySQL;DB_CLOSE_DELAY=-1;LOCK_TIMEOUT=5000");
             String baseline;try(var input=FbaAppointmentPersistenceTest.class.getResourceAsStream("/db/lastleg.sql")){baseline=new String(Objects.requireNonNull(input).readAllBytes(),StandardCharsets.UTF_8);}
             try(var c=ds.getConnection();var statement=c.createStatement()) {
-                for(var table:List.of("ll_inbound_fba_appointment","ll_inbound_fba_appointment_item","ll_fba_appointment_command")) {
+                for(var table:List.of("ll_inbound_fba_appointment","ll_inbound_fba_appointment_item","ll_fba_appointment_command","ll_appointment_cargo_verification")) {
                     int start=baseline.indexOf("CREATE TABLE IF NOT EXISTS "+table+" (");assertTrue(start>=0);
                     String sql=baseline.substring(start,baseline.indexOf(';',start)+1).replace(" STORED","").replaceAll(" ENGINE=InnoDB[^;]*;",";");statement.execute(sql);
                 }
-                statement.execute("CREATE TABLE ll_order(id BIGINT PRIMARY KEY,version INT DEFAULT 0)");statement.execute("INSERT INTO ll_order(id) VALUES(1),(2)");
+                statement.execute("CREATE TABLE ll_order(id BIGINT PRIMARY KEY,version INT DEFAULT 0,customer_id VARCHAR(128),customer_name VARCHAR(128))");statement.execute("INSERT INTO ll_order(id) VALUES(1),(2)");
                 statement.execute("CREATE TABLE ll_dispatch_item(order_id BIGINT,customer_id VARCHAR(128),dispatch_order_id BIGINT)");
                 statement.execute("CREATE TABLE ll_dispatch_order(id BIGINT,customer_id VARCHAR(128),status VARCHAR(32))");
+                String work;try(var input=FbaAppointmentPersistenceTest.class.getResourceAsStream("/db/appointment-work.sql")){work=new String(Objects.requireNonNull(input).readAllBytes(),StandardCharsets.UTF_8);}
+                for(var sql:work.replaceAll("(?m)^--.*$","").replaceAll(" ENGINE=InnoDB[^;]*;",";").split(";")) if(!sql.isBlank()) statement.execute(sql);
+                String receiving;try(var input=FbaAppointmentPersistenceTest.class.getResourceAsStream("/db/appointment-receiving.sql")){receiving=new String(Objects.requireNonNull(input).readAllBytes(),StandardCharsets.UTF_8);}
+                for(var sql:receiving.replaceAll("(?m)^--.*$","").replaceAll(" ENGINE=InnoDB[^;]*;",";").split(";")) if(!sql.isBlank()) statement.execute(sql);
             }return ds;
         }
         @Bean DataSourceTransactionManager transactionManager(DataSource dataSource){return new DataSourceTransactionManager(dataSource);}
@@ -208,6 +225,9 @@ class FbaAppointmentPersistenceTest {
             var config=new MybatisConfiguration();config.setEnvironment(new Environment("test",new SpringManagedTransactionFactory(),dataSource));config.setMapUnderscoreToCamelCase(true);
             config.addMapper(InboundFbaAppointmentMapper.class);config.addMapper(InboundFbaAppointmentItemMapper.class);config.addMapper(InboundFbaAppointmentQueryMapper.class);config.addMapper(FbaAppointmentCommandMapper.class);
             config.addMapper(OrderVersionProbe.class);
+            config.addMapper(FbaReceivingMapper.class);
+            config.addMapper(AppointmentCargoVerificationMapper.class);
+            config.addMapper(com.baiyue.lastleg.appointmentwork.AppointmentWorkMapper.class);
             return new MybatisSqlSessionFactoryBuilder().build(config);
         }
         @Bean SqlSessionTemplate template(SqlSessionFactory factory){return new SqlSessionTemplate(factory);}
@@ -215,13 +235,37 @@ class FbaAppointmentPersistenceTest {
         @Bean InboundFbaAppointmentItemMapper itemMapper(SqlSessionTemplate session){return session.getMapper(InboundFbaAppointmentItemMapper.class);}
         @Bean InboundFbaAppointmentQueryMapper queryMapper(SqlSessionTemplate session){return session.getMapper(InboundFbaAppointmentQueryMapper.class);}
         @Bean FbaAppointmentCommandMapper commands(SqlSessionTemplate session){return session.getMapper(FbaAppointmentCommandMapper.class);}
-        @Bean AppointmentSourceService sources(){var mock=mock(AppointmentSourceService.class);when(mock.resolveBatch(anyList())).thenReturn(cargo(20));when(mock.destinationTimezone("ONT8")).thenReturn("America/Los_Angeles");return mock;}
-        @Bean AppointmentBatchPreviewMapper flags(){var mock=mock(AppointmentBatchPreviewMapper.class);when(mock.flags(anyList())).thenReturn(List.of(new AppointmentBatchPreviewMapper.Flags(1L,false,false,false),new AppointmentBatchPreviewMapper.Flags(2L,false,false,false)));return mock;}
+        @Bean FbaReceivingMapper receivingMapper(SqlSessionTemplate session){return session.getMapper(FbaReceivingMapper.class);}
+        @Bean FbaReceivingStore receivingStore(FbaReceivingMapper mapper,ObjectMapper json){return new FbaReceivingStore(mapper,json);}
+        @Bean FbaAppointmentTransportPort receivingTransport(){
+            var port=mock(FbaAppointmentTransportPort.class);var scope=new FbaAppointmentTransportPort.Scope("transport-v1",List.of(),List.of());
+            when(port.inspect(anyList())).thenReturn(scope);when(port.lockAndInspect(anyList(),anyString())).thenReturn(scope);
+            when(port.apply(any(),anyList(),anyString(),anyString())).thenReturn(new FbaAppointmentTransportPort.Result(List.of(),List.of()));return port;
+        }
+        @Bean FbaAppointmentWorkPort receivingWork(){
+            var port=mock(FbaAppointmentWorkPort.class);
+            when(port.resolveFollowup(anyString(),nullable(java.time.LocalDate.class))).thenAnswer(c->new FbaAppointmentWorkPort.Followup(c.getArgument(0),"测试负责人",c.getArgument(1)));
+            return port;
+        }
+        @Bean FbaAppointmentExecutionPort receivingExecution(){
+            var port=mock(FbaAppointmentExecutionPort.class);
+            org.mockito.stubbing.Answer<FbaAppointmentExecutionPort.Scope> scope=c->{List<FbaAppointmentExecutionPort.Member> members=c.getArgument(0);return new FbaAppointmentExecutionPort.Scope("transport-v1",members.stream().map(m->new FbaAppointmentExecutionPort.Eligibility(m,false,true,null)).toList());};
+            when(port.inspect(anyList())).thenAnswer(scope);when(port.lockAndInspect(anyList(),anyString())).thenAnswer(scope);return port;
+        }
+        @Bean FbaReceivingService receivingService(FbaReceivingStore store,InboundFbaAppointmentService batches,FbaAppointmentTransportPort transport,FbaAppointmentCommandMapper commands,FbaAppointmentWorkPort work,FbaAppointmentExecutionPort execution){return new FbaReceivingService(store,batches,transport,commands,work,execution);}
+        @Bean AppointmentCargoVerificationMapper verifications(SqlSessionTemplate session){return session.getMapper(AppointmentCargoVerificationMapper.class);}
+        @Bean AppointmentCargoVerificationService verificationService(AppointmentSourceService sources,AppointmentCargoVerificationMapper mapper,ObjectMapper json){return new AppointmentCargoVerificationService(sources,mapper,json);}
+        @Bean AppointmentSourceService sources(){var mock=mock(AppointmentSourceService.class);when(mock.resolveBatch(anyList())).thenAnswer(call->{List<AppointmentCoverageService.SourceRef> refs=call.getArgument(0);return refs.stream().map(ref->cargo(20).stream().filter(s->s.sourceKey().equals(ref.sourceKey()) && s.customerId().equals(ref.customerId())).findFirst().orElseThrow()).toList();});when(mock.destinationTimezone("ONT8")).thenReturn("America/Los_Angeles");return mock;}
+        @Bean AppointmentBatchPreviewMapper flags(){var mock=mock(AppointmentBatchPreviewMapper.class);when(mock.flags(anyList())).thenAnswer(call->{List<Long> ids=call.getArgument(0);return ids.stream().map(id->new AppointmentBatchPreviewMapper.Flags(id,false,false,false)).toList();});return mock;}
         @Bean ObjectMapper json(){return new ObjectMapper().findAndRegisterModules();}
         @Bean AppointmentCoverageMapper destinationFacts(){return mock(AppointmentCoverageMapper.class);}
         @Bean com.baiyue.lastleg.mapper.LastlegOrderMapper orders(){var mock=mock(com.baiyue.lastleg.mapper.LastlegOrderMapper.class);var row=new com.baiyue.lastleg.entity.LastlegOrder();row.setId(100L);row.setCustomerId("C");row.setInboundCode("WT-REAL");when(mock.selectById(100L)).thenReturn(row);return mock;}
         @Bean AppointmentExternalSourceGateway bookings(){var mock=mock(AppointmentExternalSourceGateway.class);when(mock.resolve(anyList())).thenReturn(List.of(new AppointmentExternalSourceGateway.Source("C","B-1","TR-1","RECEIVED","100","FBA:ONT8",100L,10,2L)));return mock;}
-        @Bean AppointmentSourceLinker linker(com.baiyue.lastleg.mapper.LastlegOrderMapper orders,InboundFbaAppointmentItemMapper items,AppointmentExternalSourceGateway bookings){return new AppointmentSourceLinker(orders,items,bookings);}
+        @Bean AppointmentSourceLinker linker(com.baiyue.lastleg.mapper.LastlegOrderMapper orders,InboundFbaAppointmentItemMapper items,AppointmentExternalSourceGateway bookings){return new InboundAppointmentSourceLinker(orders,items,bookings);}
         @Bean InboundFbaAppointmentService service(){return new InboundFbaAppointmentService();}
+        @Bean com.baiyue.lastleg.appointmentwork.AppointmentWorkMapper workMapper(SqlSessionTemplate session){return session.getMapper(com.baiyue.lastleg.appointmentwork.AppointmentWorkMapper.class);}
+        @Bean com.baiyue.lastleg.appointmentwork.AppointmentWorkChanges workInvalidation(com.baiyue.lastleg.appointmentwork.AppointmentWorkMapper mapper){return new com.baiyue.lastleg.appointmentwork.AppointmentWorkChanges(mapper);}
+        @Bean com.baiyue.lastleg.appointmentwork.AppointmentWorkCommitmentService workCommitments(com.baiyue.lastleg.appointmentwork.AppointmentWorkMapper mapper,ObjectMapper json){return new com.baiyue.lastleg.appointmentwork.AppointmentWorkCommitmentService(mapper,json);}
+        @Bean com.baiyue.lastleg.inboundplan.work.AppointmentWorkAppointmentChanges appointmentWorkChanges(com.baiyue.lastleg.appointmentwork.AppointmentWorkChanges changes,com.baiyue.lastleg.appointmentwork.AppointmentWorkCommitmentService commitments,FbaReceivingStore receiving){return new com.baiyue.lastleg.inboundplan.work.AppointmentWorkAppointmentChanges(commitments,changes,receiving);}
     }
 }
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/inboundplan/service/FbaAppointmentRepartitionPersistenceTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/inboundplan/service/FbaAppointmentRepartitionPersistenceTest.java
new file mode 100644
index 000000000..7a9ce6b62
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/inboundplan/service/FbaAppointmentRepartitionPersistenceTest.java
@@ -0,0 +1,183 @@
+package com.baiyue.lastleg.inboundplan.service;
+
+import com.baiyue.lastleg.appointmentplanning.*;
+import com.baiyue.lastleg.inboundplan.dto.*;
+import org.junit.jupiter.api.Test;
+import org.springframework.context.annotation.AnnotationConfigApplicationContext;
+import org.springframework.jdbc.core.JdbcTemplate;
+import org.springframework.web.server.ResponseStatusException;
+import javax.sql.DataSource;
+import java.time.LocalDate;
+import java.util.List;
+import java.util.concurrent.*;
+import static org.junit.jupiter.api.Assertions.*;
+import static org.mockito.ArgumentMatchers.*;
+import static org.mockito.Mockito.*;
+
+class FbaAppointmentRepartitionPersistenceTest {
+    @Test void allCurrentDestinationsSurvivePartialRedistributionAndConvergingMergePaths() {
+        try(var context=new AnnotationConfigApplicationContext(FbaAppointmentPersistenceTest.Config.class)) {
+            var service=context.getBean(InboundFbaAppointmentService.class);
+            var original=service.createFromSources("operator",create("lineage-create"));
+            var first=service.repartition("operator",split(original,"lineage-first"));
+            var later=first.appointments().get(1);
+            var second=service.repartition("operator",new RepartitionFbaAppointmentsRequest(
+                List.of(new RepartitionFbaAppointmentsRequest.Original(later.appointmentNo(),later.version())),
+                List.of(batch(cargo("A","ORDER:1",4)),batch(cargo("A","ORDER:1",2))),"后送部分再排","lineage-second"));
+            var current=service.batchContext(original.batchKey()).currentBatches();
+            assertEquals(3,current.size());
+            assertEquals(List.of(2,4,4),current.stream().flatMap(a->a.items().stream()).filter(i->i.sourceKey().equals("ORDER:1")).map(FbaAppointmentResponse.Item::packageCount).sorted().toList());
+            assertEquals(2,service.batchContext(later.batchKey()).currentBatches().size());
+            var merged=service.repartition("operator",new RepartitionFbaAppointmentsRequest(
+                second.appointments().stream().map(a->new RepartitionFbaAppointmentsRequest.Original(a.appointmentNo(),a.version())).toList(),
+                List.of(batch(cargo("A","ORDER:1",6))),"后送重新合并","lineage-merge"));
+            var mergedCurrent=service.batchContext(original.batchKey()).currentBatches();
+            assertEquals(2,mergedCurrent.size());
+            assertEquals(1,mergedCurrent.stream().filter(a->a.batchKey().equals(merged.appointments().get(0).batchKey())).count());
+            assertEquals(List.of(merged.appointments().get(0)),service.batchContext(later.batchKey()).currentBatches());
+            assertThrows(ResponseStatusException.class,()->service.createFromSources("operator",create("lineage-duplicate")));
+        }
+    }
+    @Test void brokenOrCyclicReplacementRelationsAreNotReportedAsEmptyOrCompleted() {
+        try(var context=new AnnotationConfigApplicationContext(FbaAppointmentPersistenceTest.Config.class)) {
+            var service=context.getBean(InboundFbaAppointmentService.class);var db=new JdbcTemplate(context.getBean(DataSource.class));
+            var original=service.createFromSources("operator",create("broken-create"));
+            db.update("UPDATE ll_inbound_fba_appointment SET replacement_nos_json='[\"missing\"]',replacement_keys_json='[\"FBA_APPOINTMENT:999\"]' WHERE id=?",original.id());
+            assertEquals(404,assertThrows(ResponseStatusException.class,()->service.batchContext(original.batchKey())).getStatusCode().value());
+            db.update("UPDATE ll_inbound_fba_appointment SET replacement_keys_json=? WHERE id=?","[\""+original.batchKey()+"\"]",original.id());
+            assertEquals(409,assertThrows(ResponseStatusException.class,()->service.batchContext(original.batchKey())).getStatusCode().value());
+        }
+    }
+    private static SourceFbaAppointmentRequest create(String key) {
+        return new SourceFbaAppointmentRequest(List.of(new SourceFbaAppointmentRequest.SourceRef("A","ORDER:1","FBA:ONT8"),new SourceFbaAppointmentRequest.SourceRef("B","ORDER:2","FBA:ONT8")),
+            "100","ONT8",pending(),key);
+    }
+    private static FbaAppointmentDetails pending(){return new FbaAppointmentDetails(null,null,null,null,null,null,"PENDING",null,null,null);}
+    private static RepartitionFbaAppointmentsRequest.Allocation cargo(String customer,String key,int packages) {return new RepartitionFbaAppointmentsRequest.Allocation(customer,key,packages,"ORDER:1",null);}
+    private static RepartitionFbaAppointmentsRequest.Batch batch(RepartitionFbaAppointmentsRequest.Allocation... rows){return new RepartitionFbaAppointmentsRequest.Batch(null,null,List.of(rows));}
+    private static RepartitionFbaAppointmentsRequest split(FbaAppointmentResponse original,String key) {
+        return new RepartitionFbaAppointmentsRequest(List.of(new RepartitionFbaAppointmentsRequest.Original(original.appointmentNo(),original.version())),
+            List.of(batch(cargo("A","ORDER:1",4),cargo("B","ORDER:2",20)),batch(cargo("A","ORDER:1",6))),"按收货窗口分批",key);
+    }
+    @Test void splitAndMergeConserveEveryOriginalSourceAndReschedulingNeverExpandsBackToWholeOrder() {
+        try(var context=new AnnotationConfigApplicationContext(FbaAppointmentPersistenceTest.Config.class)) {
+            var service=context.getBean(InboundFbaAppointmentService.class);var db=new JdbcTemplate(context.getBean(DataSource.class));
+            var original=service.createFromSources("operator",create("create"));
+            assertEquals("FBA_APPOINTMENT:"+original.id(),original.batchKey());
+            assertTrue(service.batchContext(original.batchKey()).allowedActions().containsAll(List.of("SPLIT","MERGE")));
+            var split=service.repartition("operator",split(original,"split"));
+            assertEquals(split,service.repartition("operator",split(original,"split")));
+            assertEquals(2,split.appointments().size());assertEquals(2,service.unscheduled(1,20).total());
+            var historical=service.detail(original.appointmentNo());
+            assertEquals(split.appointments().stream().map(FbaAppointmentResponse::appointmentNo).toList(),historical.replacementAppointmentNos());
+            assertEquals(split.appointments().stream().map(FbaAppointmentResponse::batchKey).toList(),historical.replacementBatchKeys());
+            assertEquals(List.of(original.batchKey()),split.replacedBatchKeys());
+            assertTrue(service.batchContext(original.batchKey()).allowedActions().isEmpty());
+            assertEquals(3,service.relatedBatchSnapshots(List.of(new AppointmentCoverageService.SourceRef("A","ORDER:1","FBA:ONT8"))).size());
+            assertTrue(service.relatedBatchSnapshots(List.of(new AppointmentCoverageService.SourceRef("B","ORDER:1","FBA:ONT8"))).isEmpty());
+            assertTrue(service.relatedBatchSnapshots(List.of(new AppointmentCoverageService.SourceRef("A","ORDER:1","FBA:LAX9"))).isEmpty());
+            assertEquals(List.of(10,20),historical.items().stream().map(FbaAppointmentResponse.Item::packageCount).toList());
+            assertEquals("按收货窗口分批",historical.repartitionReason());
+            assertThrows(ResponseStatusException.class,()->service.update("operator",historical.appointmentNo(),new UpdateFbaAppointmentRequest(pending(),historical.version(),"old-edit")));
+            assertThrows(ResponseStatusException.class,()->service.delete("operator",historical.appointmentNo(),new CancelFbaAppointmentRequest(historical.version(),"old-cancel")));
+            assertThrows(ResponseStatusException.class,()->service.createFromSources("operator",create("duplicate")));
+            var first=split.appointments().get(0);var second=split.appointments().get(1);
+            var rescheduled=service.update("operator",second.appointmentNo(),new UpdateFbaAppointmentRequest(new FbaAppointmentDetails(LocalDate.of(2026,10,20),null,null,null,null,null,"PENDING",null,null,null),0,"reschedule"));
+            assertEquals(6,rescheduled.items().get(0).packageCount());
+            var merged=service.repartition("operator",new RepartitionFbaAppointmentsRequest(List.of(
+                new RepartitionFbaAppointmentsRequest.Original(first.appointmentNo(),first.version()),
+                new RepartitionFbaAppointmentsRequest.Original(second.appointmentNo(),rescheduled.version())),
+                List.of(batch(cargo("A","ORDER:1",10),cargo("B","ORDER:2",20))),"同仓合约","merge"));
+            assertEquals(1,service.unscheduled(1,20).total());assertEquals(2,merged.appointments().get(0).items().size());
+            assertEquals(10,db.queryForObject("SELECT SUM(package_count) FROM ll_inbound_fba_appointment_item WHERE source_key='ORDER:1' AND active=1",Integer.class));
+            assertEquals(20,db.queryForObject("SELECT SUM(package_count) FROM ll_inbound_fba_appointment_item WHERE source_key='ORDER:2' AND active=1",Integer.class));
+            assertEquals(0,db.queryForObject("SELECT COUNT(*) FROM ll_dispatch_order",Integer.class));
+            assertEquals(0,db.queryForObject("SELECT SUM(version) FROM ll_order",Integer.class));
+        }
+    }
+    @Test void staleSourceOrVerificationIntentCannotConsumeOrReplaceCurrentBatch() {
+        try(var context=new AnnotationConfigApplicationContext(FbaAppointmentPersistenceTest.Config.class)) {
+            var service=context.getBean(InboundFbaAppointmentService.class);
+            var verification=context.getBean(AppointmentCargoVerificationService.class);
+            var original=service.createFromSources("operator",create("create"));
+            var stale=split(original,"stale-verification");
+            verification.save("ORDER:1","A",new AppointmentCargoVerificationService.Save("FBA:ONT8","ORDER:1",0,10,List.of("FBA-A"),null,"verify"),"operator","客服");
+            assertEquals(409,assertThrows(ResponseStatusException.class,()->service.repartition("operator",stale)).getStatusCode().value());
+            var contextAfterVerification=service.batchContext(original.batchKey());
+            assertEquals(1,contextAfterVerification.sources().stream().filter(s->s.sourceKey().equals("ORDER:1")).findFirst().orElseThrow().cargoVerificationVersion());
+            var badSource=new RepartitionFbaAppointmentsRequest(stale.originals(),List.of(
+                batch(new RepartitionFbaAppointmentsRequest.Allocation("A","ORDER:1",4,"ORDER:0",1),cargo("B","ORDER:2",20)),
+                batch(new RepartitionFbaAppointmentsRequest.Allocation("A","ORDER:1",6,"ORDER:1",1))),"来源已变化","stale-source");
+            assertEquals(409,assertThrows(ResponseStatusException.class,()->service.repartition("operator",badSource)).getStatusCode().value());
+            var fresh=new RepartitionFbaAppointmentsRequest(stale.originals(),List.of(
+                batch(new RepartitionFbaAppointmentsRequest.Allocation("A","ORDER:1",4,"ORDER:1",1),cargo("B","ORDER:2",20)),
+                batch(new RepartitionFbaAppointmentsRequest.Allocation("A","ORDER:1",6,"ORDER:1",1))),"刷新后分批","fresh");
+            assertTrue(service.detail(original.appointmentNo()).replacementBatchKeys().isEmpty());
+            assertEquals(2,service.repartition("operator",fresh).appointments().size());
+            assertEquals(400,assertThrows(ResponseStatusException.class,()->service.batchContext("FBA_APPOINTMENT:0" )).getStatusCode().value());
+        }
+    }
+    @Test void matchingGrandTotalCannotMoveQuantityAcrossCustomersOrOriginalSources() {
+        try(var context=new AnnotationConfigApplicationContext(FbaAppointmentPersistenceTest.Config.class)) {
+            var service=context.getBean(InboundFbaAppointmentService.class);var original=service.createFromSources("operator",create("create"));
+            var input=split(original,"bad");
+            var wrong=new RepartitionFbaAppointmentsRequest(input.originals(),List.of(batch(cargo("A","ORDER:1",5)),batch(cargo("B","ORDER:2",25))),"错误分配","wrong-count");
+            assertEquals(400,assertThrows(ResponseStatusException.class,()->service.repartition("operator",wrong)).getStatusCode().value());
+            var customer=new RepartitionFbaAppointmentsRequest(input.originals(),List.of(batch(cargo("B","ORDER:1",10)),batch(cargo("A","ORDER:2",20))),"错误客户","wrong-customer");
+            assertEquals(400,assertThrows(ResponseStatusException.class,()->service.repartition("operator",customer)).getStatusCode().value());
+            assertTrue(service.detail(original.appointmentNo()).replacementAppointmentNos().isEmpty());
+            assertEquals(1,service.unscheduled(1,20).total());
+        }
+    }
+    @Test void anyInsertFailureRollsBackOldClaimsNewBatchesAndIdempotencyRecordTogether() {
+        try(var context=new AnnotationConfigApplicationContext(FbaAppointmentPersistenceTest.Config.class)) {
+            var service=context.getBean(InboundFbaAppointmentService.class);var db=new JdbcTemplate(context.getBean(DataSource.class));
+            var original=service.createFromSources("operator",create("create"));
+            db.execute("ALTER TABLE ll_inbound_fba_appointment_item ADD CONSTRAINT reject_second CHECK(package_count<>6)");
+            assertThrows(RuntimeException.class,()->service.repartition("operator",split(original,"retry")));
+            assertEquals(1,db.queryForObject("SELECT COUNT(*) FROM ll_inbound_fba_appointment",Integer.class));
+            assertEquals(2,db.queryForObject("SELECT COUNT(*) FROM ll_inbound_fba_appointment_item WHERE active=1",Integer.class));
+            assertEquals(0,db.queryForObject("SELECT COUNT(*) FROM ll_fba_appointment_command WHERE operation='REPARTITION'",Integer.class));
+            assertTrue(service.detail(original.appointmentNo()).replacementAppointmentNos().isEmpty());
+            db.execute("ALTER TABLE ll_inbound_fba_appointment_item DROP CONSTRAINT reject_second");
+            assertEquals(2,service.repartition("operator",split(original,"retry")).appointments().size());
+        }
+    }
+    @Test void unknownQuantityCanBeVerifiedThenSplitImmediatelyWithoutConfirmingOrRewritingOriginalOrder() {
+        try(var context=new AnnotationConfigApplicationContext(FbaAppointmentPersistenceTest.Config.class)) {
+            var source=new AppointmentSourceService.Source("ORDER:1","A",1L,"IN-A",null,null,"100","美国仓","FBA:ONT8","ONT8",null,"ORDER:1",true,List.of());
+            when(context.getBean(AppointmentSourceService.class).resolveBatch(anyList())).thenReturn(List.of(source));
+            var service=context.getBean(InboundFbaAppointmentService.class);
+            var original=service.createFromSources("operator",new SourceFbaAppointmentRequest(List.of(new SourceFbaAppointmentRequest.SourceRef("A","ORDER:1","FBA:ONT8")),"100","ONT8",pending(),"create"));
+            var request=new RepartitionFbaAppointmentsRequest(List.of(new RepartitionFbaAppointmentsRequest.Original(original.appointmentNo(),0)),
+                List.of(batch(new RepartitionFbaAppointmentsRequest.Allocation("A","ORDER:1",5,"ORDER:1",1)),batch(new RepartitionFbaAppointmentsRequest.Allocation("A","ORDER:1",7,"ORDER:1",1))),"分两次送仓","split");
+            assertThrows(ResponseStatusException.class,()->service.repartition("operator",request));
+            context.getBean(AppointmentCargoVerificationService.class).save("ORDER:1","A",new AppointmentCargoVerificationService.Save("FBA:ONT8","ORDER:1",0,12,List.of(),null,"verify"),"operator","客服");
+            var editable=service.batchContext(original.batchKey());
+            assertTrue(editable.allowedActions().contains("SPLIT"));assertEquals(12,editable.sources().get(0).packageCount());
+            var result=service.repartition("operator",request);
+            assertEquals(List.of(5,7),result.appointments().stream().map(a->a.items().get(0).packageCount()).toList());
+            assertTrue(result.appointments().stream().allMatch(a->a.appointmentAt()==null && "PENDING".equals(a.appointmentStatus())));
+            assertNull(service.detail(original.appointmentNo()).items().get(0).packageCount());
+        }
+    }
+    @Test void existingTransportAndConcurrentRepartitionCannotDuplicateWork() throws Exception {
+        try(var context=new AnnotationConfigApplicationContext(FbaAppointmentPersistenceTest.Config.class)) {
+            var service=context.getBean(InboundFbaAppointmentService.class);var db=new JdbcTemplate(context.getBean(DataSource.class));
+            var original=service.createFromSources("operator",create("create"));
+            db.update("INSERT INTO ll_dispatch_order VALUES(10,'A','DRAFT')");db.update("INSERT INTO ll_dispatch_item VALUES(1,'A',10)");
+            db.update("INSERT INTO ll_dispatch_appointment_allocation VALUES(10,11,12,?,'A','ORDER:1','FBA:ONT8',1)",original.batchKey());
+            assertThrows(ResponseStatusException.class,()->service.repartition("operator",split(original,"blocked")));
+            db.update("UPDATE ll_dispatch_order SET status='CANCELLED' WHERE id=10");
+            var executor=Executors.newFixedThreadPool(2);var start=new CountDownLatch(1);
+            try {
+                var one=executor.submit(()->attempt(service,start,split(original,"one")));var two=executor.submit(()->attempt(service,start,split(original,"two")));start.countDown();
+                assertEquals(1,(one.get(10,TimeUnit.SECONDS)?1:0)+(two.get(10,TimeUnit.SECONDS)?1:0));
+                assertEquals(2,service.unscheduled(1,20).total());
+            } finally {executor.shutdownNow();}
+        }
+    }
+    private static boolean attempt(InboundFbaAppointmentService service,CountDownLatch start,RepartitionFbaAppointmentsRequest request) throws Exception {
+        start.await();try {service.repartition("operator",request);return true;}catch(ResponseStatusException error){assertEquals(409,error.getStatusCode().value());return false;}
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/inboundplan/service/FbaReceivingPersistenceTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/inboundplan/service/FbaReceivingPersistenceTest.java
new file mode 100644
index 000000000..7111b3aa1
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/inboundplan/service/FbaReceivingPersistenceTest.java
@@ -0,0 +1,818 @@
+package com.baiyue.lastleg.inboundplan.service;
+
+import com.baiyue.lastleg.appointmentplanning.*;
+import com.baiyue.lastleg.inboundplan.dto.*;
+import com.baiyue.lastleg.inboundplan.receiving.*;
+import org.junit.jupiter.api.Test;
+import org.springframework.context.annotation.AnnotationConfigApplicationContext;
+import org.springframework.jdbc.core.JdbcTemplate;
+import org.springframework.jdbc.datasource.DataSourceTransactionManager;
+import org.springframework.transaction.support.TransactionTemplate;
+import org.springframework.web.server.ResponseStatusException;
+import javax.sql.DataSource;
+import java.time.LocalDate;
+import java.time.LocalDateTime;
+import java.util.List;
+import static com.baiyue.lastleg.inboundplan.receiving.FbaReceivingContracts.*;
+import static org.junit.jupiter.api.Assertions.*;
+import static org.mockito.ArgumentMatchers.*;
+import static org.mockito.Mockito.*;
+
+/** Real H2 core transactions; transport, execution and work ports are mocked, not physical/owner-domain acceptance. */
+class FbaReceivingPersistenceTest {
+    private static final String OPERATOR="operator", TRANSPORT="transport-v1", DESTINATION="FBA:ONT8";
+
+    @Test void pendingChangePreservesConfirmedCargoAndOnlyMarksTheAffectedCustomer() {
+        try(var f=new Fixture()) {
+            var original=f.create();var group=f.store.currentAgreement(original.batchKey(),"B");
+            var pending=f.propose(original,100,"pending");
+            assertEquals("WAITING",pending.status());
+            assertEquals(original,f.batches.detail(original.appointmentNo()));
+            assertEquals(group,f.store.currentAgreement(original.batchKey(),"B"));
+            assertTrue(f.store.hasPending(original.batchKey(),"B"));
+            assertFalse(f.store.hasPending(original.batchKey(),"A"));
+            assertEquals(1,f.receiving.context(original.batchKey()).pendingChanges().size());
+            f.assertAllocations(80,160,40);
+            verify(f.transport,never()).apply(any(),anyList(),anyString(),anyString());
+            var withdrawn=f.receiving.resolve(OPERATOR,pending.changeKey(),new Resolve("withdraw",0,"WITHDRAW",null,TRANSPORT));
+            assertEquals("WITHDRAWN",withdrawn.status());
+            assertFalse(f.store.hasPending(original.batchKey(),"B"));
+            assertEquals(original,f.batches.detail(original.appointmentNo()));
+        }
+    }
+
+    @Test void confirmedPartialMoveRetainsOtherCustomersAndLaterSixtyCanSplitIntoFortyAndTwenty() {
+        try(var f=new Fixture()) {
+            var original=f.create();var group=f.store.currentAgreement(original.batchKey(),"B");
+            var proposed=f.propose(original,100,"partial");
+            var result=f.confirm(proposed.changeKey(),"partial-confirm");
+            assertEquals("APPLIED",result.status());
+            var retained=result.batches().get(0);var later=result.batches().get(1);
+            assertEquals(original.batchKey(),retained.batchKey());
+            assertEquals(220,total(retained));assertEquals(60,total(later));
+            assertEquals(80,quantity(retained,"A"));assertEquals(100,quantity(retained,"B"));assertEquals(40,quantity(retained,"D"));
+            assertEquals(original.confirmationNo(),retained.confirmationNo());
+            assertNull(later.confirmationNo());assertEquals("PENDING",later.appointmentStatus());
+            var current=f.store.currentAgreement(original.batchKey(),"B");
+            assertEquals(group.agreementKey(),current.agreementKey());assertEquals(group.version()+1,current.version());
+            assertEquals(100,current.members().stream().filter(m->m.customerId().equals("B")).findFirst().orElseThrow().sources().get(0).packageCount());
+            assertFalse(f.store.hasPending(original.batchKey(),"B"));
+            var split=f.batches.repartition(OPERATOR,new RepartitionFbaAppointmentsRequest(
+                List.of(new RepartitionFbaAppointmentsRequest.Original(later.appointmentNo(),later.version())),
+                List.of(laterBatch(40),laterBatch(20)),"后送六十箱分两次送","split-later"));
+            assertEquals(List.of(20,40),split.appointments().stream().map(FbaReceivingPersistenceTest::total).sorted().toList());
+            var destinations=f.batches.batchContext(original.batchKey()).currentBatches();
+            assertEquals(List.of(20,40,100),destinations.stream().flatMap(b->b.items().stream()).filter(i->i.customerId().equals("B")).map(FbaAppointmentResponse.Item::packageCount).sorted().toList());
+            f.assertAllocations(80,160,40);
+            assertEquals(0,f.db.queryForObject("SELECT SUM(version) FROM ll_order",Integer.class));
+            verify(f.transport).apply(any(),eq(List.of(new FbaAppointmentTransportPort.Move(original.batchKey(),"B","ORDER:2",DESTINATION,160,100,later.batchKey()))),eq(OPERATOR),anyString());
+        }
+    }
+
+    @Test void allOfCustomerCanMoveOutWithoutLeavingZeroQuantityInCurrentBatch() {
+        try(var f=new Fixture()) {
+            var original=f.create();var group=f.store.currentAgreement(original.batchKey(),"B");
+            var result=f.confirm(f.propose(original,0,"all-out").changeKey(),"all-out-confirm");
+            assertEquals(120,total(result.batches().get(0)));assertEquals(160,total(result.batches().get(1)));
+            var reread=f.receiving.context(original.batchKey()).batch();
+            assertEquals(List.of("A","D"),reread.items().stream().map(FbaAppointmentResponse.Item::customerId).sorted().toList());
+            assertTrue(reread.items().stream().allMatch(i->i.packageCount()>0));
+            assertNull(f.store.currentAgreement(original.batchKey(),"B"));
+            var remaining=f.store.agreement(group.agreementKey(),false);
+            assertEquals(List.of("A","D"),remaining.members().stream().map(Member::customerId).sorted().toList());
+            assertEquals(original.confirmationNo(),reread.confirmationNo());
+            var destinations=f.batches.batchContext(original.batchKey());
+            assertTrue(destinations.originalSourceRefs().stream().anyMatch(s->s.customerId().equals("B")&&s.sourceKey().equals("ORDER:2")&&s.destinationKey().equals(DESTINATION)));
+            assertEquals(3,destinations.originalSourceRefs().size());
+            assertEquals(List.of(120,160),destinations.currentBatches().stream().map(FbaReceivingPersistenceTest::total).sorted().toList());
+            assertEquals(result.batches().get(1).batchKey(),destinations.currentBatches().stream().filter(b->quantity(b,"B")==160).findFirst().orElseThrow().batchKey());
+            f.assertAllocations(80,160,40);
+        }
+    }
+
+    @Test void identicalCommandsReplayAndDifferentContentCannotReuseTheirKeys() {
+        try(var f=new Fixture()) {
+            var original=f.create();var proposal=new Propose("same-proposal",intent(original,100));
+            var first=f.receiving.propose(OPERATOR,proposal);
+            assertEquals(first,f.receiving.propose(OPERATOR,proposal));
+            conflict(()->f.receiving.propose(OPERATOR,new Propose("same-proposal",intent(original,90))));
+            var resolve=new Resolve("same-resolve",0,"CONFIRM","仓库同意一百箱先送",TRANSPORT);
+            var applied=f.receiving.resolve(OPERATOR,first.changeKey(),resolve);
+            assertEquals(applied,f.receiving.resolve(OPERATOR,first.changeKey(),resolve));
+            conflict(()->f.receiving.resolve(OPERATOR,first.changeKey(),new Resolve("same-resolve",0,"WITHDRAW",null,TRANSPORT)));
+            assertEquals(2,f.db.queryForObject("SELECT COUNT(*) FROM ll_inbound_fba_appointment",Integer.class));
+            assertEquals(1,f.db.queryForObject("SELECT COUNT(*) FROM ll_fba_receiving_change",Integer.class));
+            verify(f.transport,times(1)).apply(any(),anyList(),anyString(),anyString());
+            f.assertAllocations(80,160,40);
+        }
+    }
+
+    @Test void transportFailureRollsBackAllocationAgreementAndCommandThenSameKeyCanRetry() {
+        try(var f=new Fixture()) {
+            var original=f.create();var group=f.store.currentAgreement(original.batchKey(),"B");
+            var pending=f.propose(original,100,"rollback-propose");
+            when(f.transport.apply(any(),anyList(),anyString(),anyString())).thenThrow(new IllegalStateException("physical adjustment rejected"));
+            assertThrows(IllegalStateException.class,()->f.confirm(pending.changeKey(),"retry-resolve"));
+            assertEquals(original,f.batches.detail(original.appointmentNo()));
+            assertEquals(group,f.store.currentAgreement(original.batchKey(),"B"));
+            assertEquals("WAITING",f.store.change(pending.changeKey(),false).status());
+            assertEquals(1,f.db.queryForObject("SELECT COUNT(*) FROM ll_inbound_fba_appointment",Integer.class));
+            assertEquals(0,f.db.queryForObject("SELECT COUNT(*) FROM ll_fba_appointment_command WHERE command_key='retry-resolve'",Integer.class));
+            f.assertAllocations(80,160,40);
+            doReturn(new FbaAppointmentTransportPort.Result(List.of(),List.of())).when(f.transport).apply(any(),anyList(),anyString(),anyString());
+            assertEquals("APPLIED",f.confirm(pending.changeKey(),"retry-resolve").status());
+            f.assertAllocations(80,160,40);
+        }
+    }
+
+    @Test void groupCancellationKeepsAllCargoAndRebookingCreatesANewEffectiveIdentity() {
+        try(var f=new Fixture()) {
+            var original=f.create();var old=f.store.currentAgreement(original.batchKey(),"A");
+            var cancelled=f.cancel(old);var batch=cancelled.batches().get(0);var group=cancelled.agreements().get(0);
+            assertEquals(original.batchKey(),batch.batchKey());assertEquals(280,total(batch));
+            assertEquals("CANCELLED",batch.appointmentStatus());assertNull(batch.confirmationNo());assertNull(batch.plannedDate());
+            assertEquals(old.details(),group.details());
+            assertEquals(3,f.receiving.groupContext(old.agreementKey()).eligibleMembers().size());
+            var request=new Book("rebook-group",List.of(new Booking(selections(batch,"A","B","D"),confirmed("NEW-GROUP"),"仓库确认新约覆盖三客户")),old.agreementKey(),group.version(),TRANSPORT);
+            var rebooked=f.receiving.book(OPERATOR,request);
+            assertNotEquals(old.agreementKey(),rebooked.agreements().get(0).agreementKey());
+            assertEquals("SUCCESS",rebooked.batches().get(0).appointmentStatus());
+            assertEquals("NEW-GROUP",rebooked.batches().get(0).confirmationNo());
+            assertEquals(rebooked,f.receiving.book(OPERATOR,request));
+            assertEquals("CANCELLED",f.store.agreement(old.agreementKey(),false).status());
+            assertEquals(1,f.db.queryForObject("SELECT COUNT(*) FROM ll_inbound_fba_appointment",Integer.class));
+            f.assertAllocations(80,160,40);
+        }
+    }
+
+    @Test void independentlyRebookedCustomerIsExcludedFromOldGroupAndOthersCanRebookTogether() {
+        try(var f=new Fixture()) {
+            var original=f.create();var old=f.store.currentAgreement(original.batchKey(),"A");
+            var cancellation=f.cancel(old);var cancelled=cancellation.agreements().get(0);var batch=cancellation.batches().get(0);
+            var independent=f.receiving.book(OPERATOR,new Book("rebook-a",List.of(new Booking(selections(batch,"A"),confirmed("A-ONLY"),"A独立确认")),old.agreementKey(),cancelled.version(),TRANSPORT));
+            var group=f.receiving.groupContext(old.agreementKey());
+            assertEquals(List.of("B","D"),group.eligibleMembers().stream().map(Member::customerId).sorted().toList());
+            assertEquals(1,group.excludedMembers().size());assertEquals("A",group.excludedMembers().get(0).member().customerId());
+            assertEquals(independent.agreements().get(0).agreementKey(),group.excludedMembers().get(0).currentAgreementKey());
+            var current=independent.batches().get(0);
+            conflict(()->f.receiving.book(OPERATOR,new Book("try-include-a",List.of(new Booking(selections(current,"A","B","D"),confirmed("INVALID"),"旧范围")),old.agreementKey(),cancelled.version(),TRANSPORT)));
+            var others=f.receiving.book(OPERATOR,new Book("rebook-bd",List.of(new Booking(selections(current,"B","D"),confirmed("BD-ONLY"),"B及D共同确认")),old.agreementKey(),cancelled.version(),TRANSPORT));
+            assertNotEquals(independent.agreements().get(0).agreementKey(),others.agreements().get(0).agreementKey());
+            assertEquals(independent.agreements().get(0).agreementKey(),f.store.currentAgreement(original.batchKey(),"A").agreementKey());
+            f.assertAllocations(80,160,40);
+        }
+    }
+
+    @Test void staleBatchAndPendingVersionsNeverApplyQuantityChanges() {
+        try(var f=new Fixture()) {
+            var original=f.create();var pending=f.propose(original,100,"stale-propose");
+            conflict(()->f.receiving.resolve(OPERATOR,pending.changeKey(),new Resolve("wrong-pending",1,"CONFIRM","同意",TRANSPORT)));
+            f.db.update("UPDATE ll_inbound_fba_appointment SET version=version+1 WHERE id=?",original.id());
+            conflict(()->f.confirm(pending.changeKey(),"stale-batch"));
+            assertEquals("WAITING",f.store.change(pending.changeKey(),false).status());
+            assertEquals(280,total(f.batches.detail(original.appointmentNo())));f.assertAllocations(80,160,40);
+            verify(f.transport,never()).apply(any(),anyList(),anyString(),anyString());
+        }
+    }
+
+    @Test void changedAgreementScopeVersionInvalidatesEarlierWarehouseReply() {
+        try(var f=new Fixture()) {
+            var original=f.create();var group=f.store.currentAgreement(original.batchKey(),"B");
+            var pending=f.propose(original,100,"scope-propose");
+            new TransactionTemplate(f.context.getBean(DataSourceTransactionManager.class)).execute(status->{
+                f.store.update(group,group.members(),confirmed("UPDATED-GROUP"),"新一轮范围确认");return null;
+            });
+            conflict(()->f.confirm(pending.changeKey(),"stale-agreement"));
+            assertEquals("WAITING",f.store.change(pending.changeKey(),false).status());
+            assertEquals(original,f.batches.detail(original.appointmentNo()));f.assertAllocations(80,160,40);
+            verify(f.transport,never()).apply(any(),anyList(),anyString(),anyString());
+        }
+    }
+
+    @Test void changedOriginalSourceCannotBeAppliedUsingAnEarlierVerificationAndReply() {
+        try(var f=new Fixture()) {
+            var original=f.create();var pending=f.propose(original,100,"source-propose");
+            var changed=new AppointmentSourceService.Source("ORDER:2","B",2L,"IN-B",null,null,"100","美国仓",DESTINATION,"ONT8",160,"ORDER:2",true,List.of());
+            when(f.context.getBean(AppointmentSourceService.class).resolveBatch(anyList())).thenReturn(List.of(changed));
+            conflict(()->f.confirm(pending.changeKey(),"stale-source"));
+            assertEquals(original,f.batches.detail(original.appointmentNo()));
+            assertEquals("WAITING",f.store.change(pending.changeKey(),false).status());
+            f.assertAllocations(80,160,40);
+            verify(f.transport,never()).apply(any(),anyList(),anyString(),anyString());
+        }
+    }
+
+    @Test void transportScopeConflictCannotCreatePendingChangeOrConsumeCommandKey() {
+        try(var f=new Fixture()) {
+            var original=f.create();
+            when(f.transport.lockAndInspect(anyList(),eq(TRANSPORT))).thenThrow(new ResponseStatusException(org.springframework.http.HttpStatus.CONFLICT,"原车次范围已更新"));
+            conflict(()->f.propose(original,100,"stale-transport"));
+            assertFalse(f.store.hasPending(original.batchKey(),"B"));
+            assertEquals(0,f.db.queryForObject("SELECT COUNT(*) FROM ll_fba_appointment_command WHERE command_key='stale-transport'",Integer.class));
+            assertEquals(original,f.batches.detail(original.appointmentNo()));
+            f.assertAllocations(80,160,40);
+        }
+    }
+
+    @Test void legacyEditCannotCancelOrExpandAnIndependentCustomerAgreement() {
+        try(var f=new Fixture()) {
+            var original=f.create();var old=f.store.currentAgreement(original.batchKey(),"A");
+            var cancellation=f.cancel(old);var cancelled=cancellation.agreements().get(0);var batch=cancellation.batches().get(0);
+            var independent=f.receiving.book(OPERATOR,new Book("only-a",List.of(new Booking(selections(batch,"A"),confirmed("A-PRIVATE"),"仅A已获仓库确认")),old.agreementKey(),cancelled.version(),TRANSPORT));
+            var current=independent.batches().get(0);var agreement=independent.agreements().get(0);
+            var failed=new FbaAppointmentDetails(null,null,null,null,null,null,"FAILED","其他客户暂时没有约到",null,null);
+            conflict(()->f.batches.update(OPERATOR,current.appointmentNo(),new UpdateFbaAppointmentRequest(failed,current.version(),"legacy-failed")));
+            conflict(()->f.batches.update(OPERATOR,current.appointmentNo(),new UpdateFbaAppointmentRequest(confirmed("A-PRIVATE"),current.version(),"legacy-expand")));
+            assertEquals(agreement,f.store.currentAgreement(current.batchKey(),"A"));
+            assertEquals(List.of("A"),f.store.agreement(agreement.agreementKey(),false).members().stream().map(Member::customerId).toList());
+            assertNull(f.store.currentAgreement(current.batchKey(),"B"));assertNull(f.store.currentAgreement(current.batchKey(),"D"));
+            assertEquals(current,f.batches.detail(current.appointmentNo()));
+            var legacyContext=f.batches.batchContext(current.batchKey());
+            assertFalse(legacyContext.allowedActions().contains("SPLIT"));
+            assertFalse(legacyContext.allowedActions().contains("MERGE"));
+            assertTrue(legacyContext.blockReasons().stream().anyMatch(reason->reason.contains("部分客户已取得确认")));
+            f.assertAllocations(80,160,40);
+        }
+    }
+
+    @Test void fullyMovedSingleCustomerGroupExplainsExclusionWithoutReadingZeroQuantityAsCurrentCargo() {
+        try(var f=new Fixture()) {
+            var original=f.batches.createFromSources(OPERATOR,new SourceFbaAppointmentRequest(
+                List.of(new SourceFbaAppointmentRequest.SourceRef("B","ORDER:2",DESTINATION)),"100","ONT8",confirmed("B-ORIGINAL"),"create-b"));
+            var old=f.store.currentAgreement(original.batchKey(),"B");
+            var moved=f.confirm(f.propose(original,0,"move-all-b").changeKey(),"confirm-all-b");
+            assertEquals(160,total(moved.batches().get(1)));
+            var context=f.receiving.groupContext(old.agreementKey());
+            assertTrue(context.eligibleMembers().isEmpty());assertEquals(1,context.excludedMembers().size());
+            var excluded=context.excludedMembers().get(0);
+            assertEquals("B",excluded.member().customerId());
+            assertTrue(excluded.reason().contains("转入")||excluded.reason().contains("移出"));
+            assertEquals(160,excluded.member().sources().stream().mapToInt(Source::packageCount).sum());
+            assertTrue(excluded.member().sources().stream().allMatch(source->source.packageCount()>0));
+            assertNull(f.store.currentAgreement(original.batchKey(),"B"));
+            assertEquals(List.of(moved.batches().get(1).batchKey()),f.batches.batchContext(original.batchKey()).currentBatches().stream().map(FbaAppointmentResponse::batchKey).toList());
+        }
+    }
+
+    @Test void unchangedLegacyConfirmationWithNewCommandKeyDoesNotChangeBatchAgreementOrHistory() {
+        try(var f=new Fixture()) {
+            var original=f.create();var agreement=f.store.currentAgreement(original.batchKey(),"A");
+            var revisions=f.db.queryForObject("SELECT COUNT(*) FROM ll_fba_receiving_revision WHERE agreement_key=?",Integer.class,agreement.agreementKey());
+            var request=new UpdateFbaAppointmentRequest(confirmed("ORIGINAL-GROUP"),original.version(),"unchanged-confirmation");
+            var saved=f.batches.update(OPERATOR,original.appointmentNo(),request);
+            assertEquals(original,saved);assertEquals(original,f.batches.detail(original.appointmentNo()));
+            assertEquals(agreement,f.store.currentAgreement(original.batchKey(),"A"));
+            assertEquals(revisions,f.db.queryForObject("SELECT COUNT(*) FROM ll_fba_receiving_revision WHERE agreement_key=?",Integer.class,agreement.agreementKey()));
+            assertEquals(saved,f.batches.update(OPERATOR,original.appointmentNo(),request));
+            f.assertAllocations(80,160,40);
+        }
+    }
+
+    @Test void pendingChangeCanBeWithdrawnAfterTransportBecomesImmutableButCannotBeConfirmed() {
+        try(var f=new Fixture()) {
+            var original=f.create();var group=f.store.currentAgreement(original.batchKey(),"B");
+            var pending=f.propose(original,100,"before-picking");
+            when(f.transport.lockAndInspect(anyList(),eq(TRANSPORT))).thenThrow(new ResponseStatusException(org.springframework.http.HttpStatus.CONFLICT,"已开始拣货，禁止调整运输货量"));
+            conflict(()->f.confirm(pending.changeKey(),"confirm-after-picking"));
+            assertEquals("WAITING",f.store.change(pending.changeKey(),false).status());
+            conflict(()->f.receiving.resolve(OPERATOR,pending.changeKey(),new Resolve("withdraw-wrong-version",1,"WITHDRAW",null,TRANSPORT)));
+            var request=new Resolve("withdraw-after-picking",0,"WITHDRAW",null,TRANSPORT);
+            var result=f.receiving.resolve(OPERATOR,pending.changeKey(),request);
+            assertEquals("WITHDRAWN",result.status());
+            assertEquals(1,f.store.change(pending.changeKey(),false).version());
+            assertFalse(f.store.hasPending(original.batchKey(),"B"));
+            assertEquals(original,f.batches.detail(original.appointmentNo()));
+            assertEquals(group,f.store.currentAgreement(original.batchKey(),"B"));
+            assertEquals(result,f.receiving.resolve(OPERATOR,pending.changeKey(),request));
+            conflict(()->f.receiving.resolve(OPERATOR,pending.changeKey(),new Resolve("withdraw-after-picking",0,"CONFIRM","修改请求内容",TRANSPORT)));
+            verify(f.transport,times(2)).lockAndInspect(anyList(),eq(TRANSPORT));
+            verify(f.transport,never()).apply(any(),anyList(),anyString(),anyString());
+            f.assertAllocations(80,160,40);
+        }
+    }
+
+    @Test void completedCustomerIsExcludedAndRemainingCustomersRebookWithoutTransportMutationLocks() {
+        try(var f=new Fixture()) {
+            var original=f.create();var group=f.store.currentAgreement(original.batchKey(),"A");
+            var cancelled=f.cancel(group);var batch=cancelled.batches().get(0);var cancelledGroup=cancelled.agreements().get(0);
+            org.mockito.stubbing.Answer<FbaAppointmentExecutionPort.Scope> scope=call->{
+                List<FbaAppointmentExecutionPort.Member> members=call.getArgument(0);
+                return new FbaAppointmentExecutionPort.Scope("execution-v1",members.stream().map(m->new FbaAppointmentExecutionPort.Eligibility(m,m.customerId().equals("A"),!m.customerId().equals("A"),m.customerId().equals("A")?"本客户货物已经全部签收":null)).toList());
+            };
+            when(f.execution.inspect(anyList())).thenAnswer(scope);
+            when(f.execution.lockAndInspect(anyList(),anyString())).thenAnswer(scope);
+            clearInvocations(f.transport);
+            var candidates=f.receiving.groupContext(group.agreementKey());
+            assertEquals(List.of("B","D"),candidates.eligibleMembers().stream().map(Member::customerId).sorted().toList());
+            assertEquals(1,candidates.excludedMembers().size());
+            assertEquals("A",candidates.excludedMembers().get(0).member().customerId());
+            assertFalse(candidates.excludedMembers().get(0).reason().isBlank());
+            var before=f.db.queryForObject("SELECT COUNT(*) FROM ll_fba_receiving_agreement",Integer.class);
+            conflict(()->f.receiving.book(OPERATOR,new Book("completed-a-rejected",List.of(new Booking(selections(batch,"A"),confirmed("ILLEGAL-A"),"误选已签收客户")),group.agreementKey(),cancelledGroup.version(),"execution-v1")));
+            assertEquals(before,f.db.queryForObject("SELECT COUNT(*) FROM ll_fba_receiving_agreement",Integer.class));
+            assertNull(f.store.currentAgreement(batch.batchKey(),"A"));
+            var rebooked=f.receiving.book(OPERATOR,new Book("remaining-bd",List.of(new Booking(selections(batch,"B","D"),confirmed("REMAINING-BD"),"仓库仅确认未完成客户")),group.agreementKey(),cancelledGroup.version(),candidates.executionScope().version()));
+            assertEquals(List.of("B","D"),rebooked.agreements().get(0).members().stream().map(Member::customerId).sorted().toList());
+            verify(f.execution).lockAndInspect(eq(List.of(new FbaAppointmentExecutionPort.Member(batch.batchKey(),"B"),new FbaAppointmentExecutionPort.Member(batch.batchKey(),"D"))),eq("execution-v1"));
+            verify(f.transport,never()).lockAndInspect(anyList(),anyString());
+            verify(f.transport,never()).apply(any(),anyList(),anyString(),anyString());
+            f.assertAllocations(80,160,40);
+        }
+    }
+
+    @Test void undatedLaterBatchReceivesVerifiedFollowupAndFurtherSplitInheritsExactCustomerMembers() {
+        try(var f=new Fixture()) {
+            var original=f.create();var base=intent(original,100);var followup=new FbaAppointmentWorkPort.Followup("42","王客服",LocalDate.of(2026,10,19));
+            when(f.work.resolveFollowup("42",followup.nextFollowupDate())).thenReturn(followup);
+            var input=new ChangeIntent(base.batchKey(),base.batchVersion(),base.customerId(),base.quantities(),null,"42",followup.nextFollowupDate(),base.reason(),base.transportVersion());
+            var pending=f.receiving.propose(OPERATOR,new Propose("undated-propose",input));
+            assertEquals(followup,f.store.change(pending.changeKey(),false).followup());
+            var applied=f.confirm(pending.changeKey(),"undated-confirm");var later=applied.batches().get(1);
+            assertNull(later.plannedDate());assertNull(later.plannedAt());assertNull(later.confirmationNo());
+            verify(f.work,times(2)).resolveFollowup("42",followup.nextFollowupDate());
+            verify(f.work).seedFollowup(new FbaAppointmentWorkPort.Member(original.batchKey(),"B"),new FbaAppointmentWorkPort.Member(later.batchKey(),"B"),followup,OPERATOR);
+            var split=f.batches.repartition(OPERATOR,new RepartitionFbaAppointmentsRequest(
+                List.of(new RepartitionFbaAppointmentsRequest.Original(later.appointmentNo(),later.version())),List.of(laterBatch(40),laterBatch(20)),"后送再拆分并继承跟进","inherit-split"));
+            verify(f.work).inheritFollowup(eq(List.of(new FbaAppointmentWorkPort.Member(later.batchKey(),"B"))),eq(split.appointments().stream().map(b->new FbaAppointmentWorkPort.Member(b.batchKey(),"B")).toList()),eq(OPERATOR));
+            assertEquals(List.of(20,40),split.appointments().stream().map(FbaReceivingPersistenceTest::total).sorted().toList());
+            f.assertAllocations(80,160,40);
+        }
+    }
+
+    @Test void inactiveResponsiblePersonPreventsProposalWithoutCreatingPendingOrQuantityChanges() {
+        try(var f=new Fixture()) {
+            var original=f.create();
+            when(f.work.resolveFollowup(anyString(),nullable(LocalDate.class))).thenThrow(new ResponseStatusException(org.springframework.http.HttpStatus.CONFLICT,"负责人已停用"));
+            conflict(()->f.propose(original,100,"inactive-propose"));
+            assertFalse(f.store.hasPending(original.batchKey(),"B"));
+            assertEquals(0,f.db.queryForObject("SELECT COUNT(*) FROM ll_fba_appointment_command WHERE command_key='inactive-propose'",Integer.class));
+            assertEquals(original,f.batches.detail(original.appointmentNo()));
+            verify(f.work,never()).seedFollowup(any(),any(),any(),anyString());
+            f.assertAllocations(80,160,40);
+        }
+    }
+
+    @Test void ownerBecomingInactiveBeforeConfirmationPreservesPendingAndOriginalCargo() {
+        try(var f=new Fixture()) {
+            var original=f.create();var agreement=f.store.currentAgreement(original.batchKey(),"B");
+            var pending=f.propose(original,100,"owner-active-propose");
+            when(f.work.resolveFollowup(anyString(),nullable(LocalDate.class))).thenThrow(new ResponseStatusException(org.springframework.http.HttpStatus.CONFLICT,"负责人已停用"));
+            conflict(()->f.confirm(pending.changeKey(),"inactive-confirm"));
+            assertEquals("WAITING",f.store.change(pending.changeKey(),false).status());
+            assertEquals(original,f.batches.detail(original.appointmentNo()));
+            assertEquals(agreement,f.store.currentAgreement(original.batchKey(),"B"));
+            assertEquals(1,f.db.queryForObject("SELECT COUNT(*) FROM ll_inbound_fba_appointment",Integer.class));
+            assertEquals(0,f.db.queryForObject("SELECT COUNT(*) FROM ll_fba_appointment_command WHERE command_key='inactive-confirm'",Integer.class));
+            verify(f.work,never()).seedFollowup(any(),any(),any(),anyString());
+            verify(f.transport,never()).apply(any(),anyList(),anyString(),anyString());
+            f.assertAllocations(80,160,40);
+        }
+    }
+
+    @Test void followupSeedFailureRollsBackCreatedLaterBatchAndKeepsOriginalPendingRetryable() {
+        try(var f=new Fixture()) {
+            var original=f.create();var agreement=f.store.currentAgreement(original.batchKey(),"B");
+            var pending=f.propose(original,100,"seed-propose");
+            doThrow(new IllegalStateException("work followup persistence unavailable")).when(f.work).seedFollowup(any(),any(),any(),anyString());
+            assertThrows(IllegalStateException.class,()->f.confirm(pending.changeKey(),"seed-retry"));
+            assertEquals(original,f.batches.detail(original.appointmentNo()));
+            assertEquals(agreement,f.store.currentAgreement(original.batchKey(),"B"));
+            assertEquals("WAITING",f.store.change(pending.changeKey(),false).status());
+            assertEquals(1,f.db.queryForObject("SELECT COUNT(*) FROM ll_inbound_fba_appointment",Integer.class));
+            assertEquals(0,f.db.queryForObject("SELECT COUNT(*) FROM ll_fba_appointment_command WHERE command_key='seed-retry'",Integer.class));
+            doNothing().when(f.work).seedFollowup(any(),any(),any(),anyString());
+            assertEquals("APPLIED",f.confirm(pending.changeKey(),"seed-retry").status());
+            f.assertAllocations(80,160,40);
+        }
+    }
+
+    @Test void movedCustomerCannotReuseConfirmationStillCoveringOtherCustomersButCanBookIndependently() {
+        try(var f=new Fixture()) {
+            var original=f.create();var moved=f.confirm(f.propose(original,0,"move-b-for-rebook").changeKey(),"move-b-for-rebook-confirm");
+            var retained=moved.batches().get(0);var later=moved.batches().get(1);
+            var remainingAgreement=f.store.currentAgreement(original.batchKey(),"A");
+            var before=f.db.queryForObject("SELECT COUNT(*) FROM ll_fba_receiving_agreement",Integer.class);
+            conflict(()->f.receiving.book(OPERATOR,new Book("reuse-live-number",List.of(new Booking(selections(later,"B"),confirmed(original.confirmationNo()),"B错误沿用原约号")),null,null,TRANSPORT)));
+            assertEquals(before,f.db.queryForObject("SELECT COUNT(*) FROM ll_fba_receiving_agreement",Integer.class));
+            assertEquals(remainingAgreement,f.store.currentAgreement(original.batchKey(),"A"));
+            assertEquals(remainingAgreement,f.store.currentAgreement(original.batchKey(),"D"));
+            assertEquals(retained,f.batches.detail(original.appointmentNo()));
+            assertEquals(later,f.batches.detail(later.appointmentNo()));assertEquals(160,total(later));
+            assertNull(f.store.currentAgreement(later.batchKey(),"B"));
+            var separate=f.receiving.book(OPERATOR,new Book("new-b-number",List.of(new Booking(selections(later,"B"),confirmed("B-NEW-CONFIRMATION"),"B已取得独立约号")),null,null,TRANSPORT));
+            assertEquals("B-NEW-CONFIRMATION",separate.agreements().get(0).details().confirmationNo());
+            assertNotEquals(remainingAgreement.agreementKey(),separate.agreements().get(0).agreementKey());
+            assertEquals(remainingAgreement,f.store.currentAgreement(original.batchKey(),"A"));
+            f.assertAllocations(80,160,40);
+        }
+    }
+
+    @Test void executionAssociationChangingBetweenLockAndBatchLockRejectsBookingAtomically() {
+        try(var f=new Fixture()) {
+            var original=f.create();var old=f.store.currentAgreement(original.batchKey(),"A");
+            var cancelled=f.cancel(old);var batch=cancelled.batches().get(0);var cancelledGroup=cancelled.agreements().get(0);
+            var member=new FbaAppointmentExecutionPort.Member(batch.batchKey(),"B");
+            var eligibility=new FbaAppointmentExecutionPort.Eligibility(member,false,true,null);
+            when(f.execution.lockAndInspect(eq(List.of(member)),eq("execution-v1"))).thenReturn(new FbaAppointmentExecutionPort.Scope("execution-v1",List.of(eligibility)));
+            when(f.execution.inspect(eq(List.of(member)))).thenReturn(new FbaAppointmentExecutionPort.Scope("execution-v2",List.of(eligibility)));
+            var before=f.db.queryForObject("SELECT COUNT(*) FROM ll_fba_receiving_agreement",Integer.class);
+            conflict(()->f.receiving.book(OPERATOR,new Book("raced-execution",List.of(new Booking(selections(batch,"B"),confirmed("RACED-B"),"并发新关联")),old.agreementKey(),cancelledGroup.version(),"execution-v1")));
+            assertEquals(before,f.db.queryForObject("SELECT COUNT(*) FROM ll_fba_receiving_agreement",Integer.class));
+            assertEquals(0,f.db.queryForObject("SELECT COUNT(*) FROM ll_fba_appointment_command WHERE command_key='raced-execution'",Integer.class));
+            assertNull(f.store.currentAgreement(batch.batchKey(),"B"));
+            assertEquals(batch,f.batches.detail(batch.appointmentNo()));
+            f.assertAllocations(80,160,40);
+        }
+    }
+
+    @Test void transportAssociationChangingBeforeBatchLockRejectsProposalWithoutPendingOrCommand() {
+        try(var f=new Fixture()) {
+            var original=f.create();var agreement=f.store.currentAgreement(original.batchKey(),"B");
+            when(f.transport.lockAndInspect(anyList(),eq(TRANSPORT))).thenReturn(new FbaAppointmentTransportPort.Scope(TRANSPORT,List.of(),List.of()));
+            when(f.transport.inspect(anyList())).thenReturn(new FbaAppointmentTransportPort.Scope("transport-v2",List.of(),List.of()));
+            conflict(()->f.propose(original,100,"raced-proposal"));
+            assertFalse(f.store.hasPending(original.batchKey(),"B"));
+            assertEquals(0,f.db.queryForObject("SELECT COUNT(*) FROM ll_fba_receiving_change",Integer.class));
+            assertEquals(0,f.db.queryForObject("SELECT COUNT(*) FROM ll_fba_appointment_command WHERE command_key='raced-proposal'",Integer.class));
+            assertEquals(original,f.batches.detail(original.appointmentNo()));
+            assertEquals(agreement,f.store.currentAgreement(original.batchKey(),"B"));
+            verify(f.transport,never()).apply(any(),anyList(),anyString(),anyString());
+            f.assertAllocations(80,160,40);
+        }
+    }
+
+    @Test void transportAssociationChangingBeforeBatchLockRejectsBothGroupCancellationAndRescheduling() {
+        try(var f=new Fixture()) {
+            var original=f.create();var agreement=f.store.currentAgreement(original.batchKey(),"A");
+            var revisionCount=f.db.queryForObject("SELECT COUNT(*) FROM ll_fba_receiving_revision",Integer.class);
+            when(f.transport.lockAndInspect(anyList(),eq(TRANSPORT))).thenReturn(new FbaAppointmentTransportPort.Scope(TRANSPORT,List.of(),List.of()));
+            when(f.transport.inspect(anyList())).thenReturn(new FbaAppointmentTransportPort.Scope("transport-v2",List.of(),List.of()));
+            for(var action:List.of("CANCEL","RESCHEDULE")) {
+                var key="raced-group-"+action;
+                var request=new GroupChange(key,agreement.version(),action,action.equals("RESCHEDULE")?confirmed("CHANGED-CONFIRMATION"):null,"仓库回复期间新关联排车",TRANSPORT);
+                conflict(()->f.receiving.changeGroup(OPERATOR,agreement.agreementKey(),request));
+                assertEquals(0,f.db.queryForObject("SELECT COUNT(*) FROM ll_fba_appointment_command WHERE command_key=?",Integer.class,key));
+                assertEquals(original,f.batches.detail(original.appointmentNo()));
+                assertEquals(agreement,f.store.agreement(agreement.agreementKey(),false));
+                for(var customer:List.of("A","B","D")) assertEquals(agreement,f.store.currentAgreement(original.batchKey(),customer));
+                assertEquals(revisionCount,f.db.queryForObject("SELECT COUNT(*) FROM ll_fba_receiving_revision",Integer.class));
+                f.assertAllocations(80,160,40);
+            }
+            verify(f.transport,times(2)).lockAndInspect(eq(List.of(original.batchKey())),eq(TRANSPORT));
+            verify(f.transport,never()).apply(any(),anyList(),anyString(),anyString());
+        }
+    }
+
+    @Test void customerPlanChangesOnlyUnconfirmedCustomerWhileAnotherConfirmationAndUnknownDateRemain() {
+        try(var f=new Fixture()) {
+            var original=f.createPending(null);
+            var booked=f.receiving.book(OPERATOR,new Book("confirm-a-before-plan",List.of(new Booking(selections(original,"A"),confirmed("A-ONLY-PLAN"),"A取得确认")),null,null,TRANSPORT));
+            var batch=booked.batches().get(0);var agreement=booked.agreements().get(0);
+            var target=LocalDate.of(2026,11,3);
+            var result=f.plan(batch,"B",planned(target,"PENDING",null),"plan-b");
+            assertEquals("APPLIED",result.status());
+            assertEquals(agreement,f.store.currentAgreement(batch.batchKey(),"A"));
+            assertEquals(target,f.store.plan(batch.batchKey(),"B").details().plannedDate());
+            assertNull(f.store.plan(batch.batchKey(),"D").details().plannedDate());
+            assertNull(f.store.plan(batch.batchKey(),"A"));
+            assertNull(result.batches().get(0).plannedDate());assertNull(result.batches().get(0).confirmationNo());
+            assertEquals(1,f.db.queryForObject("SELECT COUNT(*) FROM ll_fba_receiving_agreement",Integer.class));
+            assertEquals(2,f.receiving.context(batch.batchKey()).plans().size());
+            assertTrue(f.receiving.context(batch.batchKey()).allowedActions().contains("PLAN_RECEIVING"));
+            var current=result.batches().get(0);
+            conflict(()->f.batches.update(OPERATOR,current.appointmentNo(),new UpdateFbaAppointmentRequest(planned(null,"PENDING",null),current.version(),"legacy-plan-overwrite")));
+            conflict(()->f.batches.delete(OPERATOR,current.appointmentNo(),new CancelFbaAppointmentRequest(current.version(),"不能整批取消客户计划")));
+            f.assertAllocations(80,160,40);
+        }
+    }
+
+    @Test void failedCustomerPlanMayHaveNoDateButCannotSmuggleFormalConfirmationFields() {
+        try(var f=new Fixture()) {
+            var original=f.createPending(null);
+            var saved=f.plan(original,"B",planned(null,"FAILED","仓库暂无时段"),"failed-plan");
+            var current=saved.batches().get(0);var plan=f.store.plan(original.batchKey(),"B");
+            assertEquals("FAILED",plan.details().appointmentStatus());assertNull(plan.details().plannedDate());
+            assertTrue(saved.agreements().isEmpty());
+            var invalid=new java.util.ArrayList<FbaAppointmentDetails>();
+            invalid.add(confirmed("NOT-A-PLAN"));invalid.add(planned(null,"FAILED","  "));
+            for(var number:List.of("","  ","EXTERNAL")) invalid.add(new FbaAppointmentDetails(null,null,null,number,null,null,"PENDING",null,null,null));
+            invalid.add(new FbaAppointmentDetails(null,null,null,null,LocalDateTime.of(2026,10,20,10,0),null,"PENDING",null,null,null));
+            int index=0;
+            for(var details:invalid) {
+                var key="bad-plan-"+(index++);
+                assertEquals(400,assertThrows(ResponseStatusException.class,()->f.plan(current,"B",details,key)).getStatusCode().value());
+                assertEquals(0,f.db.queryForObject("SELECT COUNT(*) FROM ll_fba_appointment_command WHERE command_key=?",Integer.class,key));
+            }
+            assertEquals(plan,f.store.plan(original.batchKey(),"B"));assertEquals(current,f.batches.detail(original.appointmentNo()));
+            assertEquals(0,f.db.queryForObject("SELECT COUNT(*) FROM ll_fba_receiving_agreement",Integer.class));
+            f.assertAllocations(80,160,40);
+        }
+    }
+
+    @Test void customerPlanReplayAndSemanticNoopKeepVersionAndStaleWritesAreRejected() {
+        try(var f=new Fixture()) {
+            var original=f.createPending(null);var details=planned(LocalDate.of(2026,11,4),"PENDING","等待回复");
+            var request=new Plan("plan-idempotent",new Selection(original.batchKey(),original.version(),"B"),details,TRANSPORT);
+            var saved=f.receiving.plan(OPERATOR,request);var current=saved.batches().get(0);
+            assertEquals(saved,f.receiving.plan(OPERATOR,request));
+            var noop=f.plan(current,"B",details,"plan-noop");
+            assertEquals("UNCHANGED",noop.status());assertEquals(current,noop.batches().get(0));
+            assertEquals(current,f.batches.detail(original.appointmentNo()));
+            assertEquals(3,f.db.queryForObject("SELECT COUNT(*) FROM ll_fba_receiving_plan",Integer.class));
+            conflict(()->f.plan(original,"B",planned(null,"PENDING",null),"stale-plan"));
+            conflict(()->f.plan(original,"B",planned(null,"PENDING",null),"plan-idempotent"));
+            assertEquals(details,f.store.plan(original.batchKey(),"B").details());
+        }
+    }
+
+    @Test void customerPlanRechecksExecutionScopeAndRejectsCurrentConfirmationOrPendingChange() {
+        try(var f=new Fixture()) {
+            var original=f.createPending(null);var member=new FbaAppointmentExecutionPort.Member(original.batchKey(),"B");
+            var eligibility=new FbaAppointmentExecutionPort.Eligibility(member,false,true,null);
+            when(f.execution.inspect(eq(List.of(member)))).thenReturn(new FbaAppointmentExecutionPort.Scope("execution-v2",List.of(eligibility)));
+            conflict(()->f.plan(original,"B",planned(null,"PENDING",null),"raced-plan"));
+            assertEquals(0,f.db.queryForObject("SELECT COUNT(*) FROM ll_fba_receiving_plan",Integer.class));
+            when(f.execution.inspect(eq(List.of(member)))).thenReturn(new FbaAppointmentExecutionPort.Scope(TRANSPORT,List.of(eligibility)));
+            f.propose(original,100,"pending-before-plan");
+            conflict(()->f.plan(original,"B",planned(null,"PENDING",null),"pending-plan"));
+            assertEquals(original,f.batches.detail(original.appointmentNo()));
+            assertEquals(0,f.db.queryForObject("SELECT COUNT(*) FROM ll_fba_receiving_plan",Integer.class));
+        }
+        try(var f=new Fixture()) {
+            var original=f.create();var agreement=f.store.currentAgreement(original.batchKey(),"B");
+            conflict(()->f.plan(original,"B",planned(null,"PENDING",null),"confirmed-plan"));
+            assertEquals(agreement,f.store.currentAgreement(original.batchKey(),"B"));
+            assertEquals(original,f.batches.detail(original.appointmentNo()));
+        }
+    }
+
+    @Test void bookingFreezesOtherCustomersOriginalTargetAndDeletesOnlyBookedPlan() {
+        try(var f=new Fixture()) {
+            var target=LocalDate.of(2026,10,25);var original=f.createPending(target);
+            var a=f.receiving.book(OPERATOR,new Book("freeze-a",List.of(new Booking(selections(original,"A"),confirmed("FROZEN-A"),"A确认")),null,null,TRANSPORT));
+            assertNull(f.store.plan(original.batchKey(),"A"));
+            assertEquals(target,f.store.plan(original.batchKey(),"B").details().plannedDate());
+            assertEquals(target,f.store.plan(original.batchKey(),"D").details().plannedDate());
+            var updated=f.plan(a.batches().get(0),"B",planned(target.plusDays(1),"PENDING",null),"adjust-b-plan").batches().get(0);
+            var b=f.receiving.book(OPERATOR,new Book("freeze-b",List.of(new Booking(selections(updated,"B"),confirmed("FROZEN-B"),"B确认")),null,null,TRANSPORT));
+            assertNull(f.store.plan(original.batchKey(),"B"));
+            var d=f.store.plan(original.batchKey(),"D");assertEquals(target,d.details().plannedDate());
+            f.receiving.changeGroup(OPERATOR,a.agreements().get(0).agreementKey(),new GroupChange("cancel-a-only",a.agreements().get(0).version(),"CANCEL",null,"仅A取消",TRANSPORT));
+            assertEquals(d,f.store.plan(original.batchKey(),"D"));
+            assertEquals(b.agreements().get(0),f.store.currentAgreement(original.batchKey(),"B"));
+            f.assertAllocations(80,160,40);
+        }
+    }
+
+    @Test void repartitionUsesExplicitNewDatesAndDoesNotTreatHistoricalCustomerPlansAsCurrent() {
+        try(var f=new Fixture()) {
+            var original=f.createPending(LocalDate.of(2026,10,25));
+            var current=f.plan(original,"B",planned(LocalDate.of(2026,10,26),"PENDING",null),"before-split-plan").batches().get(0);
+            assertTrue(f.batches.batchContext(current.batchKey()).allowedActions().contains("SPLIT"));
+            var nextDate=LocalDate.of(2026,11,2);
+            var split=f.batches.repartition(OPERATOR,new RepartitionFbaAppointmentsRequest(List.of(new RepartitionFbaAppointmentsRequest.Original(current.appointmentNo(),current.version())),List.of(
+                new RepartitionFbaAppointmentsRequest.Batch(nextDate,null,List.of(new RepartitionFbaAppointmentsRequest.Allocation("A","ORDER:1",80,"ORDER:1",1),new RepartitionFbaAppointmentsRequest.Allocation("B","ORDER:2",100,"ORDER:1",1),new RepartitionFbaAppointmentsRequest.Allocation("D","ORDER:3",40,"ORDER:1",1))),laterBatch(60)),"拆分使用本次新目标","plan-repartition"));
+            assertEquals(nextDate,split.appointments().get(0).plannedDate());assertNull(split.appointments().get(1).plannedDate());
+            assertEquals(3,f.db.queryForObject("SELECT COUNT(*) FROM ll_fba_receiving_plan WHERE batch_key=?",Integer.class,current.batchKey()));
+            assertTrue(f.store.snapshots(List.of(current.batchKey())).get(0).plans().isEmpty());
+            for(var batch:split.appointments()) assertTrue(f.store.plans(batch.batchKey()).isEmpty());
+            f.assertAllocations(80,160,40);
+        }
+    }
+
+    @Test void partialMoveKeepsRemainingCustomerPlanAndFullMoveClearsOnlyItsOldPlan() {
+        try(var f=new Fixture()) {
+            var original=f.createPending(LocalDate.of(2026,10,25));
+            var current=f.plan(original,"B",planned(LocalDate.of(2026,10,27),"PENDING",null),"move-plan-b").batches().get(0);
+            var b=f.store.plan(current.batchKey(),"B");var a=f.store.plan(current.batchKey(),"A");var d=f.store.plan(current.batchKey(),"D");
+            var partial=f.confirm(f.propose(current,100,"plan-partial").changeKey(),"plan-partial-confirm");
+            assertEquals(b,f.store.plan(current.batchKey(),"B"));
+            assertEquals(LocalDate.of(2026,10,23),partial.batches().get(1).plannedDate());
+            var all=f.confirm(f.propose(partial.batches().get(0),0,"plan-full").changeKey(),"plan-full-confirm");
+            assertNull(f.store.plan(current.batchKey(),"B"));
+            assertEquals(a,f.store.plan(current.batchKey(),"A"));assertEquals(d,f.store.plan(current.batchKey(),"D"));
+            assertEquals(100,total(all.batches().get(1)));f.assertAllocations(80,160,40);
+        }
+    }
+
+    @Test void customerPlanRejectsStaleSourceWithoutChangingFrozenPlansOrQuantity() {
+        try(var f=new Fixture()) {
+            var original=f.createPending(null);
+            var changed=new AppointmentSourceService.Source("ORDER:2","B",2L,"IN-B",null,null,"100","美国仓",DESTINATION,"ONT8",160,"ORDER:2",true,List.of());
+            when(f.context.getBean(AppointmentSourceService.class).resolveBatch(anyList())).thenReturn(List.of(changed));
+            conflict(()->f.plan(original,"B",planned(LocalDate.of(2026,10,25),"PENDING",null),"stale-plan-source"));
+            assertEquals(0,f.db.queryForObject("SELECT COUNT(*) FROM ll_fba_receiving_plan",Integer.class));
+            assertEquals(original,f.batches.detail(original.appointmentNo()));f.assertAllocations(80,160,40);
+        }
+    }
+
+    @Test void emptyDatePlanAllowsMissingTimezoneButNewDateRequiresAuthoritativeIanaZone() {
+        try(var f=new Fixture()) {
+            var original=f.createPending(null);when(f.context.getBean(AppointmentSourceService.class).destinationTimezone("ONT8")).thenReturn(null);
+            assertEquals(400,assertThrows(ResponseStatusException.class,()->f.plan(original,"B",planned(LocalDate.of(2026,10,25),"PENDING",null),"missing-zone-date")).getStatusCode().value());
+            var saved=f.plan(original,"B",planned(null,"FAILED","待补仓库时区及回复"),"missing-zone-undated");
+            assertNull(f.store.plan(original.batchKey(),"B").timezone());
+            assertNull(saved.batches().get(0).plannedAt());
+            when(f.context.getBean(AppointmentSourceService.class).destinationTimezone("ONT8")).thenReturn("America/Los_Angeles");
+            var dated=f.plan(saved.batches().get(0),"B",planned(LocalDate.of(2026,10,25),"PENDING",null),"zone-restored-date");
+            assertNull(f.store.plan(original.batchKey(),"B").details().plannedAt());
+            assertEquals(LocalDate.of(2026,10,25),f.store.plan(original.batchKey(),"B").details().plannedDate());
+            assertEquals("APPLIED",dated.status());
+        }
+    }
+
+    @Test void customerPlanValidatesDstGapAmbiguityOffsetsAndCrossMidnightWithoutInventingTimes() {
+        try(var f=new Fixture()) {
+            var original=f.createPending(null);
+            var gap=LocalDateTime.of(2026,3,8,2,30);var overlap=LocalDateTime.of(2026,11,1,1,30);
+            var invalid=List.of(new FbaAppointmentDetails(gap.toLocalDate(),gap,null,null,null,null,"PENDING",null,null,null),
+                new FbaAppointmentDetails(overlap.toLocalDate(),overlap,null,null,null,null,"PENDING",null,null,null),
+                new FbaAppointmentDetails(overlap.toLocalDate(),null,null,null,null,null,"PENDING",null,"-07:00",null));
+            int index=0;for(var details:invalid) {var key="invalid-plan-time-"+(index++);assertEquals(400,assertThrows(ResponseStatusException.class,()->f.plan(original,"B",details,key)).getStatusCode().value());}
+            var explicit=new FbaAppointmentDetails(overlap.toLocalDate(),overlap,overlap.plusMinutes(15),null,null,null,"PENDING",null,"-07:00","-07:00");
+            var saved=f.plan(original,"B",explicit,"explicit-plan-offset").batches().get(0);
+            assertEquals(explicit,f.store.plan(original.batchKey(),"B").details());
+            var start=LocalDateTime.of(2026,11,3,23,30);var across=new FbaAppointmentDetails(start.toLocalDate(),start,start.plusHours(2),null,null,null,"PENDING",null,null,null);
+            f.plan(saved,"B",across,"cross-midnight-plan");
+            assertEquals(start.plusHours(2),f.store.plan(original.batchKey(),"B").details().plannedEndAt());
+        }
+    }
+
+    @Test void adoptingNewVerificationRestoresOnlyUnconfirmedCustomerWithoutChangingOtherAgreementPlanOrQuantity() {
+        try(var f=new Fixture()) {
+            var original=f.createPending(LocalDate.of(2026,10,25));
+            var a=f.receiving.book(OPERATOR,new Book("a-before-refresh",List.of(new Booking(selections(original,"A"),confirmed("A-BEFORE-REFRESH"),"A确认")),null,null,TRANSPORT));
+            var batch=a.batches().get(0);var plans=f.store.plans(batch.batchKey());
+            var otherItems=batch.items().stream().filter(i->!i.customerId().equals("B")).toList();
+            f.verifyB(1,"verify-b-v2","B-NEW-SHIPMENT");
+            conflict(()->f.plan(batch,"B",planned(LocalDate.of(2026,11,5),"PENDING",null),"before-refresh-plan"));
+            conflict(()->f.receiving.book(OPERATOR,new Book("before-refresh-book",List.of(new Booking(selections(batch,"B"),confirmed("B-BEFORE-REFRESH"),"B确认")),null,null,TRANSPORT)));
+            var result=f.refresh(batch,"B",List.of(new CargoVersion("ORDER:2",DESTINATION,"ORDER:1",2)),"adopt-b-v2");var refreshed=result.batches().get(0);
+            assertEquals("APPLIED",result.status());assertEquals(batch.batchKey(),refreshed.batchKey());
+            assertEquals(batch.version()+1,refreshed.version());
+            assertEquals(otherItems,refreshed.items().stream().filter(i->!i.customerId().equals("B")).toList());
+            var b=refreshed.items().stream().filter(i->i.customerId().equals("B")).findFirst().orElseThrow();
+            assertEquals(2,b.cargoVerificationVersion());assertEquals(List.of("B-NEW-SHIPMENT"),b.shipmentReferences());assertEquals(160,b.packageCount());
+            assertEquals(plans,f.store.plans(batch.batchKey()));assertEquals(a.agreements().get(0),f.store.currentAgreement(batch.batchKey(),"A"));
+            var plannedBatch=f.plan(refreshed,"B",planned(LocalDate.of(2026,11,5),"PENDING",null),"after-refresh-plan").batches().get(0);
+            var booked=f.receiving.book(OPERATOR,new Book("after-refresh-book",List.of(new Booking(selections(plannedBatch,"B"),confirmed("B-AFTER-REFRESH"),"B确认")),null,null,TRANSPORT));
+            assertEquals("APPLIED",booked.status());assertEquals(a.agreements().get(0),f.store.currentAgreement(batch.batchKey(),"A"));
+            assertEquals(plans.stream().filter(p->p.customerId().equals("D")).findFirst().orElseThrow(),f.store.plan(batch.batchKey(),"D"));
+            f.assertAllocations(80,160,40);
+        }
+    }
+
+    @Test void cargoAdoptionUsesExactExpectedVersionsAndPersistentIdempotencyWithoutRepeatedChanges() {
+        try(var f=new Fixture()) {
+            var original=f.createPending(null);f.verifyB(1,"v2-for-replay","B-V2");
+            var versions=List.of(new CargoVersion("ORDER:2",DESTINATION,"ORDER:1",2));
+            var request=new RefreshCargo("adopt-replay",new Selection(original.batchKey(),original.version(),"B"),versions,TRANSPORT);
+            var saved=f.receiving.refreshCargo(OPERATOR,request);var current=saved.batches().get(0);
+            assertEquals(saved,f.receiving.refreshCargo(OPERATOR,request));
+            var noop=f.refresh(current,"B",versions,"adopt-noop");assertEquals("UNCHANGED",noop.status());assertEquals(current,noop.batches().get(0));
+            conflict(()->f.refresh(current,"B",List.of(new CargoVersion("ORDER:2",DESTINATION,"ORDER:1",1)),"stale-adopt-version"));
+            conflict(()->f.refresh(original,"B",versions,"stale-adopt-batch"));
+            conflict(()->f.refresh(original,"B",List.of(new CargoVersion("ORDER:2",DESTINATION,"ORDER:1",1)),"adopt-replay"));
+            for(var key:List.of("stale-adopt-version","stale-adopt-batch")) assertEquals(0,f.db.queryForObject("SELECT COUNT(*) FROM ll_fba_appointment_command WHERE command_key=?",Integer.class,key));
+            assertEquals(current,f.batches.detail(original.appointmentNo()));f.assertAllocations(80,160,40);
+        }
+    }
+
+    @Test void cargoAdoptionRejectsMissingDuplicateForeignSourcesAndDestinationSubstitution() {
+        try(var f=new Fixture()) {
+            var original=f.createPending(null);f.verifyB(1,"v2-for-scope","B-V2");
+            List<List<CargoVersion>> invalid=List.of(List.of(),List.of(new CargoVersion("ORDER:1",DESTINATION,"ORDER:1",2)),
+                List.of(new CargoVersion("ORDER:2","FBA:LAX9","ORDER:1",2)),List.of(new CargoVersion("ORDER:2",DESTINATION,"ORDER:1",2),new CargoVersion("ORDER:2",DESTINATION,"ORDER:1",2)));
+            int index=0;for(var versions:invalid) {
+                var key="invalid-adopt-"+(index++);assertThrows(ResponseStatusException.class,()->f.refresh(original,"B",versions,key));
+                assertEquals(0,f.db.queryForObject("SELECT COUNT(*) FROM ll_fba_appointment_command WHERE command_key=?",Integer.class,key));
+            }
+            assertEquals(original,f.batches.detail(original.appointmentNo()));f.assertAllocations(80,160,40);
+        }
+    }
+
+    @Test void cargoAdoptionCannotReduceAllocationEvenWhenLatestEvidenceClaimsLessQuantity() {
+        try(var f=new Fixture()) {
+            var original=f.createPending(null);var verification=f.context.getBean(AppointmentCargoVerificationService.class);
+            conflict(()->verification.save("ORDER:2","B",new AppointmentCargoVerificationService.Save(DESTINATION,"ORDER:1",1,159,List.of("B-LOW"),null,"bad-lower-total"),OPERATOR,"客服"));
+            f.verifyB(1,"v2-for-count-guard","B-V2");
+            // Corrupt the fixture's latest authoritative count to prove the core independently guards allocation totals.
+            f.db.update("UPDATE ll_appointment_cargo_verification SET package_count=159 WHERE customer_id='B' AND version=2");
+            conflict(()->f.refresh(original,"B",List.of(new CargoVersion("ORDER:2",DESTINATION,"ORDER:1",2)),"adopt-too-small"));
+            assertEquals(original,f.batches.detail(original.appointmentNo()));
+            assertEquals(0,f.db.queryForObject("SELECT COUNT(*) FROM ll_fba_appointment_command WHERE command_key='adopt-too-small'",Integer.class));
+            f.assertAllocations(80,160,40);
+        }
+    }
+
+    @Test void cargoAdoptionAfterSourceChangeRequiresFreshVerificationAndRejectsChangedIdentity() {
+        try(var f=new Fixture()) {
+            var original=f.createPending(null);
+            var changed=new AppointmentSourceService.Source("ORDER:2","B",2L,"IN-B",null,null,"100","美国仓",DESTINATION,"ONT8",160,"ORDER:2",true,List.of());
+            when(f.context.getBean(AppointmentSourceService.class).resolveBatch(anyList())).thenReturn(List.of(changed));
+            conflict(()->f.refresh(original,"B",List.of(new CargoVersion("ORDER:2",DESTINATION,"ORDER:2",1)),"adopt-before-reverify"));
+            f.context.getBean(AppointmentCargoVerificationService.class).save("ORDER:2","B",new AppointmentCargoVerificationService.Save(DESTINATION,"ORDER:2",1,160,List.of("B-SOURCE-V2"),null,"source-v2-verification"),OPERATOR,"客服");
+            var refreshed=f.refresh(original,"B",List.of(new CargoVersion("ORDER:2",DESTINATION,"ORDER:2",2)),"adopt-source-v2").batches().get(0);
+            assertEquals("ORDER:2",refreshed.items().stream().filter(i->i.customerId().equals("B")).findFirst().orElseThrow().sourceVersion());
+            var wrongCustomer=new AppointmentSourceService.Source("ORDER:2","X",2L,"IN-B",null,null,"100","美国仓",DESTINATION,"ONT8",160,"ORDER:2",true,List.of());
+            when(f.context.getBean(AppointmentSourceService.class).resolveBatch(anyList())).thenReturn(List.of(wrongCustomer));
+            conflict(()->f.refresh(refreshed,"B",List.of(new CargoVersion("ORDER:2",DESTINATION,"ORDER:2",null)),"adopt-wrong-customer"));
+            assertEquals(refreshed,f.batches.detail(original.appointmentNo()));f.assertAllocations(80,160,40);
+        }
+    }
+
+    @Test void cargoAdoptionRejectsExecutionRaceCompletedConfirmedAndPendingCustomer() {
+        try(var f=new Fixture()) {
+            var original=f.createPending(null);f.verifyB(1,"v2-execution-adopt","B-V2");
+            var versions=List.of(new CargoVersion("ORDER:2",DESTINATION,"ORDER:1",2));
+            var member=new FbaAppointmentExecutionPort.Member(original.batchKey(),"B");
+            when(f.execution.inspect(eq(List.of(member)))).thenReturn(new FbaAppointmentExecutionPort.Scope("execution-raced",List.of(new FbaAppointmentExecutionPort.Eligibility(member,false,true,null))));
+            conflict(()->f.refresh(original,"B",versions,"raced-cargo-adopt"));
+            when(f.execution.inspect(eq(List.of(member)))).thenReturn(new FbaAppointmentExecutionPort.Scope(TRANSPORT,List.of(new FbaAppointmentExecutionPort.Eligibility(member,true,false,"已完成"))));
+            conflict(()->f.refresh(original,"B",versions,"completed-cargo-adopt"));
+            when(f.execution.inspect(eq(List.of(member)))).thenReturn(new FbaAppointmentExecutionPort.Scope(TRANSPORT,List.of(new FbaAppointmentExecutionPort.Eligibility(member,false,true,null))));
+            f.propose(original,100,"pending-cargo-adopt");
+            conflict(()->f.refresh(original,"B",versions,"pending-cargo-refresh"));
+            assertEquals(original,f.batches.detail(original.appointmentNo()));f.assertAllocations(80,160,40);
+        }
+        try(var f=new Fixture()) {
+            var original=f.create();var group=f.store.currentAgreement(original.batchKey(),"B");f.verifyB(1,"v2-confirmed-adopt","B-V2");
+            conflict(()->f.refresh(original,"B",List.of(new CargoVersion("ORDER:2",DESTINATION,"ORDER:1",2)),"confirmed-cargo-adopt"));
+            assertEquals(group,f.store.currentAgreement(original.batchKey(),"B"));assertEquals(original,f.batches.detail(original.appointmentNo()));
+        }
+    }
+
+    @Test void cargoAdoptionPersistenceFailureRollsBackItemAndCommandAndSameRequestCanRetry() {
+        try(var f=new Fixture()) {
+            var original=f.createPending(null);f.verifyB(1,"v2-adopt-failure","B-V2");
+            var versions=List.of(new CargoVersion("ORDER:2",DESTINATION,"ORDER:1",2));
+            f.db.execute("ALTER TABLE ll_inbound_fba_appointment_item ADD CONSTRAINT reject_adopt_v2 CHECK(cargo_verification_version<>2)");
+            assertThrows(RuntimeException.class,()->f.refresh(original,"B",versions,"adopt-db-retry"));
+            assertEquals(original,f.batches.detail(original.appointmentNo()));
+            assertEquals(0,f.db.queryForObject("SELECT COUNT(*) FROM ll_fba_appointment_command WHERE command_key='adopt-db-retry'",Integer.class));
+            f.db.execute("ALTER TABLE ll_inbound_fba_appointment_item DROP CONSTRAINT reject_adopt_v2");
+            assertEquals("APPLIED",f.refresh(original,"B",versions,"adopt-db-retry").status());f.assertAllocations(80,160,40);
+        }
+    }
+
+    private static void conflict(org.junit.jupiter.api.function.Executable action) {
+        assertEquals(409,assertThrows(ResponseStatusException.class,action).getStatusCode().value());
+    }
+    private static int total(FbaAppointmentResponse batch) {return batch.items().stream().mapToInt(FbaAppointmentResponse.Item::packageCount).sum();}
+    private static int quantity(FbaAppointmentResponse batch,String customer) {return batch.items().stream().filter(i->i.customerId().equals(customer)).mapToInt(FbaAppointmentResponse.Item::packageCount).sum();}
+    private static FbaAppointmentDetails confirmed(String number) {
+        var start=LocalDateTime.of(2026,10,20,10,0);
+        return new FbaAppointmentDetails(start.toLocalDate(),null,null,number,start,start.plusHours(1),"SUCCESS","仓库已确认",null,null);
+    }
+    private static FbaAppointmentDetails planned(LocalDate date,String status,String remark) {return new FbaAppointmentDetails(date,null,null,null,null,null,status,remark,null,null);}
+    private static ChangeIntent intent(FbaAppointmentResponse batch,int retained) {
+        var item=batch.items().stream().filter(i->i.customerId().equals("B")).findFirst().orElseThrow();
+        return new ChangeIntent(batch.batchKey(),batch.version(),"B",List.of(new Quantity(item.sourceKey(),item.destinationKey(),retained,item.sourceVersion(),item.cargoVerificationVersion())),LocalDate.of(2026,10,23),"42",LocalDate.of(2026,10,19),"B客户部分后送",TRANSPORT);
+    }
+    private static List<Selection> selections(FbaAppointmentResponse batch,String... customers) {return java.util.Arrays.stream(customers).map(c->new Selection(batch.batchKey(),batch.version(),c)).toList();}
+    private static RepartitionFbaAppointmentsRequest.Batch laterBatch(int amount) {
+        return new RepartitionFbaAppointmentsRequest.Batch(null,null,List.of(new RepartitionFbaAppointmentsRequest.Allocation("B","ORDER:2",amount,"ORDER:1",1)));
+    }
+
+    private static final class Fixture implements AutoCloseable {
+        final AnnotationConfigApplicationContext context=new AnnotationConfigApplicationContext(FbaAppointmentPersistenceTest.Config.class);
+        final InboundFbaAppointmentService batches=context.getBean(InboundFbaAppointmentService.class);
+        final FbaReceivingService receiving=context.getBean(FbaReceivingService.class);
+        final FbaReceivingStore store=context.getBean(FbaReceivingStore.class);
+        final FbaAppointmentTransportPort transport=context.getBean(FbaAppointmentTransportPort.class);
+        final FbaAppointmentWorkPort work=context.getBean(FbaAppointmentWorkPort.class);
+        final FbaAppointmentExecutionPort execution=context.getBean(FbaAppointmentExecutionPort.class);
+        final JdbcTemplate db=new JdbcTemplate(context.getBean(DataSource.class));
+        Fixture() {
+            db.update("INSERT INTO ll_order(id) VALUES(3)");
+            var sources=List.of(source("A",1,80),source("B",2,160),source("D",3,40));
+            when(context.getBean(AppointmentSourceService.class).resolveBatch(anyList())).thenAnswer(call->{
+                List<AppointmentCoverageService.SourceRef> refs=call.getArgument(0);
+                return refs.stream().map(ref->sources.stream().filter(s->s.customerId().equals(ref.customerId())&&s.sourceKey().equals(ref.sourceKey())&&s.destinationKey().equals(ref.destinationKey())).findFirst().orElseThrow()).toList();
+            });
+            var verification=context.getBean(AppointmentCargoVerificationService.class);
+            for(var source:sources) verification.save(source.sourceKey(),source.customerId(),new AppointmentCargoVerificationService.Save(DESTINATION,source.sourceVersion(),0,source.packages(),List.of("SHIP-"+source.customerId()),null,"verify-"+source.customerId()),OPERATOR,"客服");
+        }
+        FbaAppointmentResponse create() {
+            return batches.createFromSources(OPERATOR,new SourceFbaAppointmentRequest(List.of(
+                new SourceFbaAppointmentRequest.SourceRef("A","ORDER:1",DESTINATION),new SourceFbaAppointmentRequest.SourceRef("B","ORDER:2",DESTINATION),new SourceFbaAppointmentRequest.SourceRef("D","ORDER:3",DESTINATION)),"100","ONT8",confirmed("ORIGINAL-GROUP"),"create"));
+        }
+        FbaAppointmentResponse createPending(LocalDate date) {
+            return batches.createFromSources(OPERATOR,new SourceFbaAppointmentRequest(List.of(
+                new SourceFbaAppointmentRequest.SourceRef("A","ORDER:1",DESTINATION),new SourceFbaAppointmentRequest.SourceRef("B","ORDER:2",DESTINATION),new SourceFbaAppointmentRequest.SourceRef("D","ORDER:3",DESTINATION)),"100","ONT8",planned(date,"PENDING",null),"create-pending"));
+        }
+        Result plan(FbaAppointmentResponse batch,String customer,FbaAppointmentDetails details,String key) {return receiving.plan(OPERATOR,new Plan(key,new Selection(batch.batchKey(),batch.version(),customer),details,TRANSPORT));}
+        Result refresh(FbaAppointmentResponse batch,String customer,List<CargoVersion> versions,String key) {return receiving.refreshCargo(OPERATOR,new RefreshCargo(key,new Selection(batch.batchKey(),batch.version(),customer),versions,TRANSPORT));}
+        void verifyB(int version,String key,String shipment) {context.getBean(AppointmentCargoVerificationService.class).save("ORDER:2","B",new AppointmentCargoVerificationService.Save(DESTINATION,"ORDER:1",version,160,List.of(shipment),null,key),OPERATOR,"客服");}
+        Result propose(FbaAppointmentResponse batch,int retained,String key) {return receiving.propose(OPERATOR,new Propose(key,intent(batch,retained)));}
+        Result confirm(String changeKey,String key) {return receiving.resolve(OPERATOR,changeKey,new Resolve(key,0,"CONFIRM","仓库明确同意本次保留量和移出量",TRANSPORT));}
+        Result cancel(Agreement group) {return receiving.changeGroup(OPERATOR,group.agreementKey(),new GroupChange("cancel-group",group.version(),"CANCEL",null,"仓库取消本份预约",TRANSPORT));}
+        void assertAllocations(int a,int b,int d) {
+            for(var entry:java.util.Map.of("A",a,"B",b,"D",d).entrySet()) assertEquals(entry.getValue(),db.queryForObject("SELECT SUM(package_count) FROM ll_inbound_fba_appointment_item WHERE customer_id=? AND active=1",Integer.class,entry.getKey()));
+        }
+        @Override public void close() {context.close();}
+        private static AppointmentSourceService.Source source(String customer,long id,int packages) {
+            return new AppointmentSourceService.Source("ORDER:"+id,customer,id,"IN-"+customer,null,null,"100","美国仓",DESTINATION,"ONT8",packages,"ORDER:1",true,List.of());
+        }
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/inboundplan/service/InboundFbaAppointmentServiceTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/inboundplan/service/InboundFbaAppointmentServiceTest.java
index 572a140cf..12871cd94 100644
--- a/lastleg-service/src/test/java/com/baiyue/lastleg/inboundplan/service/InboundFbaAppointmentServiceTest.java
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/inboundplan/service/InboundFbaAppointmentServiceTest.java
@@ -33,6 +33,10 @@ class InboundFbaAppointmentServiceTest {
         headers=mock(InboundFbaAppointmentMapper.class);items=mock(InboundFbaAppointmentItemMapper.class);query=mock(InboundFbaAppointmentQueryMapper.class);
         commands=mock(FbaAppointmentCommandMapper.class);sources=mock(AppointmentSourceService.class);flags=mock(AppointmentBatchPreviewMapper.class);
         service=new InboundFbaAppointmentService();
+        ReflectionTestUtils.setField(service,"receiving",mock(com.baiyue.lastleg.inboundplan.receiving.FbaReceivingStore.class));
+        ReflectionTestUtils.setField(service,"receivingWork",mock(com.baiyue.lastleg.inboundplan.receiving.FbaAppointmentWorkPort.class));
+        ReflectionTestUtils.setField(service,"workChanges",mock(com.baiyue.lastleg.inboundplan.work.AppointmentWorkAppointmentChanges.class));
+        ReflectionTestUtils.setField(service,"verification",mock(AppointmentCargoVerificationService.class));
         ReflectionTestUtils.setField(service,"appointmentMapper",headers);ReflectionTestUtils.setField(service,"itemMapper",items);ReflectionTestUtils.setField(service,"queryMapper",query);
         ReflectionTestUtils.setField(service,"commands",commands);ReflectionTestUtils.setField(service,"sources",sources);ReflectionTestUtils.setField(service,"flags",flags);ReflectionTestUtils.setField(service,"json",new ObjectMapper().findAndRegisterModules());
         when(commands.find(anyString())).thenAnswer(c->journal.get(c.getArgument(0)));
@@ -41,6 +45,7 @@ class InboundFbaAppointmentServiceTest {
         when(sources.resolveBatch(anyList())).thenAnswer(c->{List<AppointmentCoverageService.SourceRef> refs=c.getArgument(0);return refs.stream().map(r->cargo.get(r.sourceKey())).toList();});
         when(sources.destinationTimezone(anyString())).thenReturn("America/Los_Angeles");
         when(query.lockOrders(anyList())).thenAnswer(c->c.getArgument(0));
+        when(query.allocation(anyString(),anyString(),nullable(Long.class),nullable(Long.class))).thenReturn(new InboundFbaAppointmentQueryMapper.Allocation(0,0,0));
         when(flags.flags(anyList())).thenAnswer(c->{List<Long> ids=c.getArgument(0);return ids.stream().map(id->new AppointmentBatchPreviewMapper.Flags(id,false,false,false)).toList();});
         when(headers.insert(any(InboundFbaAppointment.class))).thenAnswer(c->{storedHeaders.add(c.getArgument(0));return 1;});
         when(headers.selectOne(any())).thenAnswer(c->storedHeaders.isEmpty()?null:storedHeaders.get(0));
@@ -55,15 +60,36 @@ class InboundFbaAppointmentServiceTest {
     List<AppointmentCoverageService.SourceRef> refs(String... keys) {return Arrays.stream(keys).map(key->new AppointmentCoverageService.SourceRef(cargo.get(key).customerId(),key,cargo.get(key).destinationKey())).toList();}
     FbaAppointmentDetails pending(String remark) {return new FbaAppointmentDetails(LocalDate.of(2026,10,15),null,null,null,null,null,"PENDING",remark,null,null);}
     FbaAppointmentDetails confirmed() {return new FbaAppointmentDetails(LocalDate.of(2026,10,14),null,null,"EXT-ONT8-1",at,at.plusHours(1),"SUCCESS","已核实",null,null);}
-    SourceFbaAppointmentRequest request(String key,FbaAppointmentDetails details,String... sources) {return new SourceFbaAppointmentRequest(refs(sources),"100","ONT8",details,key);}
+    List<SourceFbaAppointmentRequest.SourceRef> requestRefs(String... keys) {return refs(keys).stream().map(r->new SourceFbaAppointmentRequest.SourceRef(r.customerId(),r.sourceKey(),r.destinationKey())).toList();}
+    SourceFbaAppointmentRequest request(String key,FbaAppointmentDetails details,String... sources) {return new SourceFbaAppointmentRequest(requestRefs(sources),"100","ONT8",details,key);}
     FbaAppointmentResponse create(String key) {return service.createFromSources("operator",request(key,pending(null),"ORDER:1","ORDER:2"));}
 
+    @Test void workBatchSnapshotsReadOnlyHeadersAndItemsWithoutRunningRepartitionEligibility() {
+        var original=create("snapshot");
+        when(headers.selectBatchIds(List.of(original.id()))).thenReturn(List.copyOf(storedHeaders));
+        clearInvocations(headers,items,query,sources);
+        assertEquals(List.of(original),service.batchSnapshots(List.of(original.batchKey())));
+        verify(headers).selectBatchIds(List.of(original.id()));verify(items).selectList(any());verifyNoMoreInteractions(headers,items);verifyNoInteractions(query,sources);
+        assertThrows(ResponseStatusException.class,()->service.batchSnapshots(List.of("DISPATCH:1")));
+        assertThrows(ResponseStatusException.class,()->service.batchSnapshots(List.of("FBA_APPOINTMENT:999")));
+    }
+
+    @Test void sourceRequestKeepsWireShapeAndPassesAllSourceFieldsToResolution() throws Exception {
+        var json=new ObjectMapper().findAndRegisterModules();
+        var input=request("source-json",pending(null),"ORDER:1","ORDER:2");
+        assertEquals(json.valueToTree(refs("ORDER:1","ORDER:2")),json.valueToTree(input).get("sources"));
+        var decoded=json.readValue(json.writeValueAsString(input),SourceFbaAppointmentRequest.class);
+        assertEquals(input,decoded);
+        service.createFromSources("operator",decoded);
+        verify(sources,times(2)).resolveBatch(refs("ORDER:1","ORDER:2"));
+    }
+
     @Test void refusesOriginOrDestinationChangedAfterSelection() {
         var intent=request("origin-changed",pending(null),"ORDER:1");
         add("ORDER:1","A",1L,"200","ONT8",10);
         assertEquals(409,assertThrows(ResponseStatusException.class,()->service.createFromSources("operator",intent)).getStatusCode().value());
         add("ORDER:1","A",1L,"100","LAX9",10);
-        var changed=new SourceFbaAppointmentRequest(refs("ORDER:1"),"100","ONT8",pending(null),"destination-changed");
+        var changed=new SourceFbaAppointmentRequest(requestRefs("ORDER:1"),"100","ONT8",pending(null),"destination-changed");
         assertEquals(409,assertThrows(ResponseStatusException.class,()->service.createFromSources("operator",changed)).getStatusCode().value());
         verify(headers,never()).insert(any(InboundFbaAppointment.class));
     }
@@ -117,6 +143,13 @@ class InboundFbaAppointmentServiceTest {
         when(sources.destinationTimezone("ONT8")).thenReturn(null);
         assertThrows(ResponseStatusException.class,()->service.createFromSources("operator",request("no-zone",confirmed(),"ORDER:1")));assertTrue(storedHeaders.isEmpty());
     }
+    @Test void confirmedAppointmentCannotLoseItsConfirmationThroughOrdinaryFailedEdit() {
+        var original=service.createFromSources("operator",request("confirmed-before-failure",confirmed(),"ORDER:1"));
+        var attempt=new UpdateFbaAppointmentRequest(new FbaAppointmentDetails(null,null,null,null,null,null,"FAILED","仓库取消",null,null),original.version(),"bypass-cancel");
+        assertEquals(400,assertThrows(ResponseStatusException.class,()->service.update("operator",original.appointmentNo(),attempt)).getStatusCode().value());
+        assertEquals("SUCCESS",storedHeaders.get(0).getAppointmentStatus());assertEquals(original.confirmationNo(),storedHeaders.get(0).getConfirmationNo());
+        verify(headers,never()).update(any(InboundFbaAppointment.class),any());
+    }
     @Test void confirmationRequiresActualShipmentReferencesAndKnownCargoWithoutFakingMaterialization() {
         when(query.countMissingShipmentReferences(List.of(1L))).thenReturn(1L);
         assertThrows(ResponseStatusException.class,()->service.createFromSources("operator",request("missing-materials",confirmed(),"ORDER:1")));
@@ -137,9 +170,9 @@ class InboundFbaAppointmentServiceTest {
         assertThrows(ResponseStatusException.class,()->service.createFromSources("operator",request("dst-gap",gap,"ORDER:1")));
     }
     @Test void duplicateActiveSourceOrDatabaseClaimRaceCannotCreateAnotherAppointment() {
-        when(query.countActiveSources(anyList(),anyList(),isNull())).thenReturn(1L);
-        assertEquals(409,assertThrows(ResponseStatusException.class,()->create("occupied")).getStatusCode().value());assertTrue(storedHeaders.isEmpty());
-        when(query.countActiveSources(anyList(),anyList(),isNull())).thenReturn(0L);
+        when(query.allocation(anyString(),anyString(),nullable(Long.class),nullable(Long.class))).thenReturn(new InboundFbaAppointmentQueryMapper.Allocation(20,1,0));
+        assertEquals(409,assertThrows(ResponseStatusException.class,()->create("occupied")).getStatusCode().value());assertTrue(storedItems.isEmpty());
+        when(query.allocation(anyString(),anyString(),nullable(Long.class),nullable(Long.class))).thenReturn(new InboundFbaAppointmentQueryMapper.Allocation(0,0,0));
         when(items.insert(any(InboundFbaAppointmentItem.class))).thenThrow(new org.springframework.dao.DuplicateKeyException("claimed"));
         assertEquals(409,assertThrows(ResponseStatusException.class,()->create("raced")).getStatusCode().value());
     }
@@ -167,12 +200,16 @@ class InboundFbaAppointmentServiceTest {
         verify(commands,never()).begin(anyString(),anyString(),anyString(),anyString(),any());
         verify(headers,never()).update(any(InboundFbaAppointment.class),any());
     }
-    @Test void cancellationPreservesConfirmedFactsAndHistoryButCannotRestoreOverAnotherActiveClaim() {
+    @Test void cancellationClearsEffectiveDatesButPreservesAllocationAndImmutableConfirmedHistory() throws Exception {
         var result=service.createFromSources("operator",request("confirmed",confirmed(),"ORDER:1"));
         service.delete("operator",result.appointmentNo(),new CancelFbaAppointmentRequest(0,"收货方取消时段"));
-        assertEquals("CANCELLED",storedHeaders.get(0).getAppointmentStatus());assertEquals(at,storedHeaders.get(0).getAppointmentAt());assertFalse(storedItems.get(0).getActive());
+        assertEquals("CANCELLED",storedHeaders.get(0).getAppointmentStatus());assertNull(storedHeaders.get(0).getAppointmentAt());assertNull(storedHeaders.get(0).getPlannedDate());assertTrue(storedItems.get(0).getActive());
+        var snapshot=journal.get("CANCEL:"+result.appointmentNo()+":0").responseJson();
+        var json=new ObjectMapper().findAndRegisterModules();
+        assertEquals("EXT-ONT8-1",json.readTree(snapshot).path("confirmationNo").asText());
+        assertEquals(json.valueToTree(at),json.readTree(snapshot).get("appointmentAt"));
         assertEquals(result,service.createFromSources("operator",request("confirmed",confirmed(),"ORDER:1")));
-        when(query.countActiveSources(anyList(),anyList(),eq(result.id()))).thenReturn(1L);
+        when(query.allocation(anyString(),anyString(),nullable(Long.class),eq(result.id()))).thenReturn(new InboundFbaAppointmentQueryMapper.Allocation(10,1,0));
         assertThrows(ResponseStatusException.class,()->service.update("operator",result.appointmentNo(),new UpdateFbaAppointmentRequest(confirmed(),1,"restore")));
     }
     @Test void snowflakeLineSelectorsDeserializeWithoutPrecisionLoss() throws Exception {
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/inboundplan/service/InboundPlanPaginationTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/inboundplan/service/InboundPlanPaginationTest.java
index 3ea14af60..31b7d210f 100644
--- a/lastleg-service/src/test/java/com/baiyue/lastleg/inboundplan/service/InboundPlanPaginationTest.java
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/inboundplan/service/InboundPlanPaginationTest.java
@@ -81,7 +81,9 @@ class InboundPlanPaginationTest {
         String sql = String.join("", InboundPlanQueryMapper.class
             .getMethod("rows", String.class, InboundPlanRequests.Query.class, long.class, long.class)
             .getAnnotation(org.apache.ibatis.annotations.Select.class).value()) + InboundPlanQueryMapper.FROM_AND_FILTER;
-        assertThat(sql).contains("ai2.customer_id=p.customer_id", "ORDER BY a2.created_at DESC,ai2.id DESC LIMIT 1");
+        assertThat(sql).contains("ai2.customer_id=p.customer_id", "ai2.fba_warehouse_code=l.fba_warehouse_code",
+            "a2.replacement_nos_json IS NULL", "ORDER BY ai2.active DESC,a2.created_at DESC,ai2.id DESC LIMIT 1");
+        assertThat(sql).contains("COUNT(DISTINCT current_item.appointment_id)", "current_item.active=1", "THEN 'MULTIPLE'");
         assertThat(sql).contains("p.customer_id=#{customerId}", "o.customer_id=p.customer_id");
         assertThat(sql).doesNotContain("a2.customer_id=#{customerId}");
         assertThat(sql).contains("di.customer_id=p.customer_id AND di.order_id=l.order_id",
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/inboundplan/work/AppointmentWorkDeliveryProviderTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/inboundplan/work/AppointmentWorkDeliveryProviderTest.java
new file mode 100644
index 000000000..85c9e8b36
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/inboundplan/work/AppointmentWorkDeliveryProviderTest.java
@@ -0,0 +1,226 @@
+package com.baiyue.lastleg.inboundplan.work;
+
+import com.baiyue.lastleg.appointmentplanning.AppointmentCargoVerificationService;
+import com.baiyue.lastleg.appointmentplanning.AppointmentCoverageService.SourceRef;
+import com.baiyue.lastleg.appointmentplanning.AppointmentSourceService.Resolution;
+import com.baiyue.lastleg.appointmentwork.AppointmentWorkCommitmentService;
+import com.baiyue.lastleg.inboundplan.service.InboundFbaAppointmentService;
+import org.junit.jupiter.api.Test;
+import static com.baiyue.lastleg.inboundplan.receiving.FbaReceivingContracts.*;
+import java.time.LocalDateTime;
+import java.util.List;
+import static com.baiyue.lastleg.appointmentwork.AppointmentWorkFactGateway.*;
+import static com.baiyue.lastleg.appointmentwork.AppointmentWorkModels.*;
+import static org.junit.jupiter.api.Assertions.*;
+import static org.mockito.Mockito.*;
+
+class AppointmentWorkDeliveryProviderTest {
+    @Test void confirmedCustomerIndependentFailedPlanAndUnplannedSiblingRemainSeparate() {
+        String key="FBA_APPOINTMENT:1",zone="America/Los_Angeles";
+        var appointments=mock(InboundFbaAppointmentService.class);var commitments=mock(AppointmentWorkCommitmentService.class);var receiving=receiving();
+        var batch=mock(com.baiyue.lastleg.inboundplan.dto.FbaAppointmentResponse.class);
+        when(batch.id()).thenReturn(1L);when(batch.batchKey()).thenReturn(key);when(batch.appointmentStatus()).thenReturn("SUCCESS");
+        when(batch.plannedDate()).thenReturn(java.time.LocalDate.of(2026,10,19));when(batch.timezone()).thenReturn(zone);
+        var a=item();when(a.customerId()).thenReturn("A");var b=item();when(b.customerId()).thenReturn("B");var d=item();when(d.customerId()).thenReturn("D");
+        when(batch.items()).thenReturn(List.of(a,b,d));when(appointments.batchSnapshots(List.of(key))).thenReturn(List.of(batch));
+        var confirmedAt=LocalDateTime.of(2026,10,20,10,0);
+        var agreement=new Agreement("RA-A",1,"ACTIVE","FBA:ONT8",new com.baiyue.lastleg.inboundplan.dto.FbaAppointmentDetails(null,null,null,"CONF-A",confirmedAt,null,"SUCCESS",null,null,null),zone,
+            List.of(new Member(key,"AP-1",1,"A",List.of(),null)),"正式确认");
+        var failedDate=java.time.LocalDate.of(2026,10,22);
+        var failed=new CustomerPlan(key,"B",planDetails(failedDate,"FAILED"),zone);
+        var staleA=new CustomerPlan(key,"A",planDetails(failedDate,"FAILED"),zone);
+        when(receiving.snapshots(List.of(key))).thenReturn(List.of(new BatchReceiving(key,List.of(agreement),List.of(),List.of(staleA,failed))));
+        when(commitments.impactTokens(anyList())).thenAnswer(call->{List<String> keys=call.getArgument(0);return keys.stream().collect(java.util.stream.Collectors.toMap(k->k,k->k+":0"));});
+        var provider=new AppointmentWorkDeliveryProvider(appointments,mock(AppointmentCargoVerificationService.class),commitments,mock(AppointmentWorkDeliveryMapper.class),mock(AppointmentWorkSourceMapper.class),receiving);
+        var requests=List.of("A","B","D").stream().map(c->new FactRequest("W"+c,Type.DELIVERY,Flow.TRANSFER,"1",key+"|CUSTOMER:"+c,key,null,List.of(key),List.of(),List.of(new SourceReference(c,"ORDER:1","FBA:ONT8")))).toList();
+        var facts=provider.read(requests);var aFact=facts.get(0);var bFact=facts.get(1);var dFact=facts.get(2);
+        assertEquals(confirmedAt.toLocalDate(),aFact.confirmed().date());assertNull(aFact.target());assertEquals(PlanStatus.CONFIRMED,aFact.planStatus());assertTrue(aFact.blockReasons().isEmpty());
+        assertEquals(failedDate,bFact.target().date());assertNull(bFact.confirmed());assertEquals(PlanStatus.TARGET_SET,bFact.planStatus());assertEquals("沿原批次重新预约",bFact.action().label());
+        assertEquals(PlanStatus.UNPLANNED,dFact.planStatus());assertNull(dFact.target());assertNull(dFact.confirmed());assertTrue(dFact.blockReasons().isEmpty());
+        var state=new com.baiyue.lastleg.appointmentwork.AppointmentWorkState();state.setWorkItemKey("WB");state.setType(Type.DELIVERY);state.setFlow(Flow.TRANSFER);
+        var projected=com.baiyue.lastleg.appointmentwork.AppointmentWorkPolicy.project(state,bFact,new Actor("reader","reader",java.util.Set.of()),java.time.Clock.systemUTC());
+        assertEquals(failedDate,projected.calendarDate());assertEquals(DateBasis.TARGET,projected.dateBasis());
+        var cleared=new CustomerPlan(key,"B",planDetails(null,"PENDING"),zone);
+        when(receiving.snapshots(List.of(key))).thenReturn(List.of(new BatchReceiving(key,List.of(agreement),List.of(),List.of(cleared))));
+        var updated=provider.read(requests);
+        assertEquals(aFact.fingerprint(),updated.get(0).fingerprint());assertEquals(dFact.fingerprint(),updated.get(2).fingerprint());
+        assertEquals(PlanStatus.UNPLANNED,updated.get(1).planStatus());assertNull(updated.get(1).target());assertTrue(updated.get(1).blockReasons().isEmpty());
+        // An explicitly cleared customer plan wins even when the original shared header has a date.
+        when(receiving.snapshots(List.of(key))).thenReturn(List.of(new BatchReceiving(key,List.of(),List.of(),List.of(cleared))));
+        assertNull(provider.read(List.of(requests.get(1))).get(0).target());
+        when(receiving.snapshots(List.of(key))).thenReturn(List.of(new BatchReceiving(key,List.of(),List.of(),List.of())));
+        assertEquals(batch.plannedDate(),provider.read(List.of(requests.get(1))).get(0).target().date());
+    }
+    private static com.baiyue.lastleg.inboundplan.dto.FbaAppointmentDetails planDetails(java.time.LocalDate date,String status) {
+        return new com.baiyue.lastleg.inboundplan.dto.FbaAppointmentDetails(date,null,null,null,null,null,status,null,null,null);
+    }
+    @Test void customerExecutionExcludesRebookingAndFullBatchReadLimitAppliesBeforeCustomerFiltering() {
+        String key="FBA_APPOINTMENT:1";var at=LocalDateTime.parse("2026-10-17T12:00:00");
+        var appointments=mock(InboundFbaAppointmentService.class);var commitments=mock(AppointmentWorkCommitmentService.class);var deliveries=mock(AppointmentWorkDeliveryMapper.class);
+        var batch=mock(com.baiyue.lastleg.inboundplan.dto.FbaAppointmentResponse.class);
+        var own=item();var other=item();when(other.customerId()).thenReturn("D");when(other.sourceKey()).thenReturn("ORDER:2");
+        when(batch.id()).thenReturn(1L);when(batch.batchKey()).thenReturn(key);when(batch.items()).thenReturn(List.of(own,other));when(batch.appointmentStatus()).thenReturn("PENDING");
+        when(appointments.batchSnapshots(List.of(key))).thenReturn(List.of(batch));
+        when(commitments.impactTokens(List.of(key+"|CUSTOMER:C"))).thenReturn(java.util.Map.of(key+"|CUSTOMER:C","C:0"));
+        var provider=new AppointmentWorkDeliveryProvider(appointments,mock(AppointmentCargoVerificationService.class),commitments,deliveries,mock(AppointmentWorkSourceMapper.class),receiving());
+        var request=new FactRequest("W",Type.DELIVERY,Flow.TRANSFER,"1",key+"|CUSTOMER:C",key,null,List.of(key),List.of(),refs());
+        var signed=new AppointmentWorkDeliveryMapper.BatchDelivery(key,"C","ORDER:1","FBA:ONT8",100,"DEPARTED","DL-C","DELIVERED",100,100,at);
+        var waiting=new AppointmentWorkDeliveryMapper.BatchDelivery(key,"D","ORDER:2","FBA:ONT8",100,"PENDING_DEPARTURE","DL-D","WAIT_DELIVERY",100,null,null);
+        when(deliveries.batches(List.of(key))).thenReturn(List.of(signed,waiting));
+        var complete=provider.read(List.of(request)).get(0);
+        assertEquals(ExecutionStatus.COMPLETED,complete.executionStatus());assertEquals(at,complete.actual().localOccurredAt());assertNull(complete.action());
+        var inTransit=new AppointmentWorkDeliveryMapper.BatchDelivery(key,"C","ORDER:1","FBA:ONT8",100,"DEPARTED","DL-C","WAIT_DELIVERY",100,null,null);
+        when(deliveries.batches(List.of(key))).thenReturn(List.of(inTransit,waiting));
+        var executing=provider.read(List.of(request)).get(0);
+        assertEquals(ExecutionStatus.IN_PROGRESS,executing.executionStatus());assertNull(executing.action());assertNull(executing.actual());assertFalse(executing.blockReasons().isEmpty());
+        var unexpected=new AppointmentWorkDeliveryMapper.BatchDelivery(key,"C","ORDER:999","FBA:ONT8",5,"DEPARTED","DL-X","DELIVERED",5,5,at);
+        when(deliveries.batches(List.of(key))).thenReturn(List.of(signed,unexpected));
+        assertNotEquals(ExecutionStatus.COMPLETED,provider.read(List.of(request)).get(0).executionStatus());
+        var truncated=new java.util.ArrayList<>(java.util.Collections.nCopies(1000,waiting));truncated.add(signed);
+        when(deliveries.batches(List.of(key))).thenReturn(truncated);
+        assertTrue(assertThrows(org.springframework.web.server.ResponseStatusException.class,()->provider.read(List.of(request))).getReason().contains("完整读取上限"));
+    }
+    @Test void independentDatesAndPendingScopeUseOneBulkReadWithoutHeaderConfirmationOrSiblingVersionImpact() {
+        var appointments=mock(InboundFbaAppointmentService.class);var commitments=mock(AppointmentWorkCommitmentService.class);
+        var deliveries=mock(AppointmentWorkDeliveryMapper.class);var receiving=receiving();
+        var batch=mock(com.baiyue.lastleg.inboundplan.dto.FbaAppointmentResponse.class);
+        when(batch.id()).thenReturn(1L);when(batch.batchKey()).thenReturn("FBA_APPOINTMENT:1");when(batch.appointmentStatus()).thenReturn("PENDING");
+        var a=item();when(a.customerId()).thenReturn("A");var b=item();when(b.customerId()).thenReturn("B");when(b.sourceKey()).thenReturn("ORDER:2");
+        when(batch.items()).thenReturn(List.of(a,b));when(appointments.batchSnapshots(List.of(batch.batchKey()))).thenReturn(List.of(batch));
+        var memberA=new Member(batch.batchKey(),"AP-1",1,"A",List.of(new Source("ORDER:1","FBA:ONT8",100,"v1",1,null)),null);
+        var memberB=new Member(batch.batchKey(),"AP-1",1,"B",List.of(new Source("ORDER:2","FBA:ONT8",100,"v1",1,null)),null);
+        var timeA=LocalDateTime.parse("2026-10-17T10:00:00");var timeB=timeA.plusDays(1);
+        var detailsA=new com.baiyue.lastleg.inboundplan.dto.FbaAppointmentDetails(null,null,null,"CONF-A",timeA,null,"SUCCESS",null,null,null);
+        var detailsB=new com.baiyue.lastleg.inboundplan.dto.FbaAppointmentDetails(null,null,null,"CONF-B",timeB,null,"SUCCESS",null,null,null);
+        var groupA=new Agreement("RA-A",1,"ACTIVE","FBA:ONT8",detailsA,"America/Los_Angeles",List.of(memberA),"确认A");
+        var groupB=new Agreement("RA-B",1,"ACTIVE","FBA:ONT8",detailsB,"America/Los_Angeles",List.of(memberB),"确认B");
+        var pending=new Pending("RC-B",0,"WAITING",new ChangeIntent(batch.batchKey(),1,"B",List.of(),timeB.toLocalDate().plusDays(1),"1",timeA.toLocalDate(),"后送", "scope"),List.of(memberB),List.of(groupB),new com.baiyue.lastleg.inboundplan.receiving.FbaAppointmentWorkPort.Followup("1","负责人",timeA.toLocalDate()));
+        var batchKey=batch.batchKey();
+        when(receiving.snapshots(List.of(batchKey))).thenReturn(List.of(new BatchReceiving(batchKey,List.of(groupA,groupB),List.of(pending),List.of())));
+        var requestA=new FactRequest("WA",Type.DELIVERY,Flow.TRANSFER,"1","A",batch.batchKey(),null,List.of(batch.batchKey()),List.of(),List.of(new SourceReference("A","ORDER:1","FBA:ONT8")));
+        var requestB=new FactRequest("WB",Type.DELIVERY,Flow.TRANSFER,"1","B",batch.batchKey(),null,List.of(batch.batchKey()),List.of(),List.of(new SourceReference("B","ORDER:2","FBA:ONT8")));
+        when(commitments.impactTokens(anyList())).thenAnswer(call->{List<String> keys=call.getArgument(0);return keys.stream().collect(java.util.stream.Collectors.toMap(k->k,k->k+":0"));});
+        var provider=new AppointmentWorkDeliveryProvider(appointments,mock(AppointmentCargoVerificationService.class),commitments,deliveries,mock(AppointmentWorkSourceMapper.class),receiving);
+        var facts=provider.read(List.of(requestA,requestB));
+        assertEquals(timeA.toLocalDate(),facts.get(0).confirmed().date());assertEquals(PlanStatus.CONFIRMED,facts.get(0).planStatus());assertTrue(facts.get(0).blockReasons().isEmpty());
+        assertEquals(timeB.toLocalDate(),facts.get(1).confirmed().date());assertEquals(PlanStatus.AWAITING_REPLY,facts.get(1).planStatus());assertTrue(facts.get(1).arranged());
+        assertEquals(List.of(new SourceReference("B","ORDER:2","FBA:ONT8")),((AppointmentTarget)facts.get(1).action().target()).sources());
+        assertFalse(facts.get(1).blockReasons().isEmpty());verify(receiving).snapshots(List.of(batch.batchKey()));verifyNoMoreInteractions(receiving);
+        // A shared confirmation's revision changes when another member changes; A's fact stays semantic.
+        var shared=new Agreement("RA-SHARED",9,"ACTIVE","FBA:ONT8",detailsA,"America/Los_Angeles",List.of(memberA,memberB),"共同确认");
+        when(receiving.snapshots(List.of(batchKey))).thenReturn(List.of(new BatchReceiving(batchKey,List.of(shared),List.of(),List.of())));
+        var unchanged=provider.read(List.of(requestA)).get(0);
+        assertEquals(facts.get(0).fingerprint(),unchanged.fingerprint());assertEquals(facts.get(0).impactToken(),unchanged.impactToken());
+        when(receiving.snapshots(List.of(batchKey))).thenReturn(List.of(new BatchReceiving(batchKey,List.of(),List.of(),List.of())));
+        when(batch.appointmentStatus()).thenReturn("SUCCESS");when(batch.appointmentAt()).thenReturn(timeA);
+        assertNull(provider.read(List.of(requestA)).get(0).confirmed());
+    }
+    private static List<SourceReference> refs() { return List.of(new SourceReference("C","ORDER:1","FBA:ONT8")); }
+    private static com.baiyue.lastleg.inboundplan.dto.FbaAppointmentResponse.Item item() {
+        var item=mock(com.baiyue.lastleg.inboundplan.dto.FbaAppointmentResponse.Item.class);
+        when(item.customerId()).thenReturn("C");when(item.sourceKey()).thenReturn("ORDER:1");when(item.destinationKey()).thenReturn("FBA:ONT8");when(item.packageCount()).thenReturn(100);
+        return item;
+    }
+    private static com.baiyue.lastleg.inboundplan.receiving.FbaReceivingStore receiving() {
+        var store=mock(com.baiyue.lastleg.inboundplan.receiving.FbaReceivingStore.class);
+        when(store.snapshots(anyList())).thenAnswer(call->{List<String> keys=call.getArgument(0);return keys.stream().map(k->new com.baiyue.lastleg.inboundplan.receiving.FbaReceivingContracts.BatchReceiving(k,List.of(),List.of(),List.of())).toList();});
+        return store;
+    }
+    @Test void cancelledBookingClearsDatesAndGuidesRebookingTheSameAllocatedBatch() {
+        var appointments=mock(InboundFbaAppointmentService.class);var commitments=mock(AppointmentWorkCommitmentService.class);
+        var provider=new AppointmentWorkDeliveryProvider(appointments,mock(AppointmentCargoVerificationService.class),commitments,mock(AppointmentWorkDeliveryMapper.class),mock(AppointmentWorkSourceMapper.class),receiving());
+        var batch=mock(com.baiyue.lastleg.inboundplan.dto.FbaAppointmentResponse.class);
+        var ownItem=item();when(batch.items()).thenReturn(List.of(ownItem));when(batch.id()).thenReturn(1L);when(batch.batchKey()).thenReturn("FBA_APPOINTMENT:1");
+        when(batch.appointmentStatus()).thenReturn("CANCELLED");when(batch.appointmentAt()).thenReturn(LocalDateTime.parse("2026-10-15T11:00:00"));
+        when(appointments.batchSnapshots(List.of("FBA_APPOINTMENT:1"))).thenReturn(List.of(batch));
+        when(commitments.impactTokens(List.of("FBA_APPOINTMENT:1|CUSTOMER:C"))).thenReturn(java.util.Map.of("FBA_APPOINTMENT:1|CUSTOMER:C","cancelled:1"));
+        var request=new FactRequest("W",Type.DELIVERY,Flow.TRANSFER,"1",null,"FBA_APPOINTMENT:1",null,List.of(),List.of(),refs());
+        var fact=provider.read(List.of(request)).get(0);
+        assertTrue(fact.planExists());assertEquals(PlanStatus.UNPLANNED,fact.planStatus());
+        assertNull(fact.target());assertNull(fact.confirmed());assertNull(fact.actual());
+        assertEquals("沿原批次重新预约",fact.action().label());
+        assertEquals(new AppointmentTarget("1","FBA_APPOINTMENT:1",refs()),fact.action().target());
+        assertFalse(fact.blockReasons().isEmpty());
+    }
+    @Test void failedBookingKeepsItsTargetCalendarDateWithoutInventingConfirmation() {
+        var appointments=mock(InboundFbaAppointmentService.class);var commitments=mock(AppointmentWorkCommitmentService.class);
+        var provider=new AppointmentWorkDeliveryProvider(appointments,mock(AppointmentCargoVerificationService.class),commitments,mock(AppointmentWorkDeliveryMapper.class),mock(AppointmentWorkSourceMapper.class),receiving());
+        var batch=mock(com.baiyue.lastleg.inboundplan.dto.FbaAppointmentResponse.class);
+        var ownItem=item();when(batch.items()).thenReturn(List.of(ownItem));when(batch.id()).thenReturn(1L);when(batch.batchKey()).thenReturn("FBA_APPOINTMENT:1");when(batch.appointmentStatus()).thenReturn("FAILED");
+        when(batch.plannedDate()).thenReturn(java.time.LocalDate.of(2026,10,18));when(batch.timezone()).thenReturn("America/Los_Angeles");
+        when(appointments.batchSnapshots(List.of("FBA_APPOINTMENT:1"))).thenReturn(List.of(batch));
+        when(commitments.impactTokens(List.of("FBA_APPOINTMENT:1|CUSTOMER:C"))).thenReturn(java.util.Map.of("FBA_APPOINTMENT:1|CUSTOMER:C","failed:1"));
+        var request=new FactRequest("W",Type.DELIVERY,Flow.TRANSFER,"1",null,"FBA_APPOINTMENT:1",null,List.of(),List.of(),refs());
+        var fact=provider.read(List.of(request)).get(0);
+        assertEquals(PlanStatus.TARGET_SET,fact.planStatus());assertNull(fact.confirmed());assertNull(fact.actual());
+        assertEquals("沿原批次重新预约",fact.action().label());assertFalse(fact.blockReasons().isEmpty());
+        var state=new com.baiyue.lastleg.appointmentwork.AppointmentWorkState();state.setWorkItemKey("W");state.setType(Type.DELIVERY);state.setFlow(Flow.TRANSFER);
+        var projected=com.baiyue.lastleg.appointmentwork.AppointmentWorkPolicy.project(state,fact,new Actor("reader","reader",java.util.Set.of()),java.time.Clock.systemUTC());
+        assertEquals(java.time.LocalDate.of(2026,10,18),projected.calendarDate());assertEquals(DateBasis.TARGET,projected.dateBasis());
+        when(batch.plannedDate()).thenReturn(null);
+        assertEquals(PlanStatus.UNPLANNED,provider.read(List.of(request)).get(0).planStatus());
+    }
+    @Test void establishedFbaBatchesShareSnapshotsDeliveriesAndImpactReads() {
+        var appointments=mock(InboundFbaAppointmentService.class);var cargo=mock(AppointmentCargoVerificationService.class);
+        var commitments=mock(AppointmentWorkCommitmentService.class);var deliveries=mock(AppointmentWorkDeliveryMapper.class);var sources=mock(AppointmentWorkSourceMapper.class);
+        var requests=java.util.stream.IntStream.rangeClosed(1,200).mapToObj(i->new FactRequest("W"+i,Type.DELIVERY,Flow.TRANSFER,"1",null,"FBA_APPOINTMENT:"+i,null,List.of(),List.of(),refs())).toList();
+        var keys=requests.stream().map(FactRequest::batchKey).toList();
+        var snapshots=keys.stream().map(key->{
+            var snapshot=mock(com.baiyue.lastleg.inboundplan.dto.FbaAppointmentResponse.class);
+            var ownItem=item();when(snapshot.items()).thenReturn(List.of(ownItem));when(snapshot.batchKey()).thenReturn(key);when(snapshot.id()).thenReturn(Long.valueOf(key.substring(16)));when(snapshot.appointmentStatus()).thenReturn("PENDING");
+            return snapshot;
+        }).toList();
+        when(appointments.batchSnapshots(keys)).thenReturn(snapshots);
+        var impactKeys=keys.stream().map(k->k+"|CUSTOMER:C").toList();when(commitments.impactTokens(impactKeys)).thenReturn(impactKeys.stream().collect(java.util.stream.Collectors.toMap(k->k,k->k+":0")));
+        var result=new AppointmentWorkDeliveryProvider(appointments,cargo,commitments,deliveries,sources,receiving()).read(requests);
+        assertEquals(200,result.size());assertTrue(result.stream().allMatch(f->f.planExists() && f.executionStatus()==ExecutionStatus.PENDING));
+        verify(appointments).batchSnapshots(keys);verify(deliveries).batches(keys);verify(commitments).impactTokens(impactKeys);
+        verifyNoMoreInteractions(appointments,deliveries,commitments);verifyNoInteractions(cargo,sources);
+        when(appointments.batchSnapshots(keys)).thenReturn(List.of());
+        assertThrows(org.springframework.web.server.ResponseStatusException.class,()->new AppointmentWorkDeliveryProvider(appointments,cargo,commitments,deliveries,sources,receiving()).read(requests));
+    }
+    @Test void handledPrerequisiteCommitsTheCallerTransactionThroughTheRealCargoProxy() {
+        var sourceService=mock(com.baiyue.lastleg.appointmentplanning.AppointmentSourceService.class);
+        when(sourceService.inspectBatch(List.of(new SourceRef("C","ORDER:11",null)))).thenReturn(List.of(new Resolution(new SourceRef("C","ORDER:11",null),null,new org.springframework.web.server.ResponseStatusException(org.springframework.http.HttpStatus.BAD_REQUEST,"当前货源类型不支持FBA预约"))));
+        var cargo=new AppointmentCargoVerificationService(sourceService,mock(com.baiyue.lastleg.appointmentplanning.AppointmentCargoVerificationMapper.class),new com.fasterxml.jackson.databind.ObjectMapper());
+        var ds=new org.h2.jdbcx.JdbcDataSource();ds.setURL("jdbc:h2:mem:work-read-tx-"+java.util.UUID.randomUUID()+";DB_CLOSE_DELAY=-1");
+        var manager=new org.springframework.jdbc.datasource.DataSourceTransactionManager(ds);
+        var proxy=new org.springframework.aop.framework.ProxyFactory(cargo);proxy.setProxyTargetClass(true);
+        proxy.addAdvice(new org.springframework.transaction.interceptor.TransactionInterceptor(manager,new org.springframework.transaction.annotation.AnnotationTransactionAttributeSource()));
+        var provider=new AppointmentWorkDeliveryProvider(mock(InboundFbaAppointmentService.class),(AppointmentCargoVerificationService)proxy.getProxy(),mock(AppointmentWorkCommitmentService.class),mock(AppointmentWorkDeliveryMapper.class),mock(AppointmentWorkSourceMapper.class),receiving());
+        var jdbc=new org.springframework.jdbc.core.JdbcTemplate(ds);jdbc.execute("CREATE TABLE work_probe(id INT PRIMARY KEY)");
+        var request=new FactRequest("W",Type.DELIVERY,Flow.TRANSFER,"1","INBOUND:1",null,null,List.of(),List.of(),List.of(new SourceReference("C","ORDER:11",null)));
+        new org.springframework.transaction.support.TransactionTemplate(manager).executeWithoutResult(tx->{
+            var fact=provider.read(List.of(request)).get(0);assertNull(fact.action());assertEquals(List.of("SOURCE_CONFIGURATION"),fact.missingFields());
+            jdbc.update("INSERT INTO work_probe VALUES (1)");
+        });
+        assertEquals(1,jdbc.queryForObject("SELECT COUNT(*) FROM work_probe",Integer.class));
+    }
+    @Test void knownSourcePrerequisiteIsVisibleAndCannotOfferBookingButOutagesStillFail() {
+        var cargo=mock(AppointmentCargoVerificationService.class);var sources=mock(AppointmentWorkSourceMapper.class);
+        var provider=new AppointmentWorkDeliveryProvider(mock(InboundFbaAppointmentService.class),cargo,mock(AppointmentWorkCommitmentService.class),mock(AppointmentWorkDeliveryMapper.class),sources,receiving());
+        var request=new FactRequest("W",Type.DELIVERY,Flow.TRANSFER,"1","INBOUND:1",null,null,List.of(),List.of(),List.of(new SourceReference("C","ORDER:11",null)));
+        when(cargo.inspectBatch(List.of(new SourceRef("C","ORDER:11",null)))).thenReturn(List.of(new AppointmentCargoVerificationService.Inspection(new SourceRef("C","ORDER:11",null),null,new org.springframework.web.server.ResponseStatusException(org.springframework.http.HttpStatus.BAD_REQUEST,"接仓点不在启用的美国仓目录中"))));
+        var fact=provider.read(List.of(request)).get(0);
+        assertEquals(ExecutionStatus.PENDING,fact.executionStatus());assertNull(fact.action());assertNull(fact.actual());
+        assertEquals(List.of("SOURCE_CONFIGURATION"),fact.missingFields());assertEquals(List.of("接仓点不在启用的美国仓目录中"),fact.blockReasons());
+        doThrow(new org.springframework.web.server.ResponseStatusException(org.springframework.http.HttpStatus.SERVICE_UNAVAILABLE,"服务不可用")).when(cargo).inspectBatch(List.of(new SourceRef("C","ORDER:11",null)));
+        assertThrows(org.springframework.web.server.ResponseStatusException.class,()->provider.read(List.of(request)));
+    }
+    @Test void privateCompletionCoversThisDispatchPerSourceWithoutCompletingTheWholeOrder() {
+        var appointments=mock(InboundFbaAppointmentService.class);var deliveries=mock(AppointmentWorkDeliveryMapper.class);var sources=mock(AppointmentWorkSourceMapper.class);
+        var provider=new AppointmentWorkDeliveryProvider(appointments,mock(AppointmentCargoVerificationService.class),mock(AppointmentWorkCommitmentService.class),deliveries,sources,receiving());
+        when(sources.privateBatch("DISPATCH:20")).thenReturn(List.of(new AppointmentWorkSourceMapper.DispatchSource(20,"D-20","DEPARTED",11,"C","ORDER:11","CUSTOMER:11",4),new AppointmentWorkSourceMapper.DispatchSource(20,"D-20","DEPARTED",12,"C","ORDER:12","CUSTOMER:12",6)));
+        var time=LocalDateTime.parse("2026-10-15T11:00:00");
+        var one=new AppointmentWorkDeliveryMapper.CustomerDelivery(11,"C",4,"L-1","DELIVERED",10,10,time,time.minusDays(1));
+        var two=new AppointmentWorkDeliveryMapper.CustomerDelivery(12,"C",6,"L-1","DELIVERED",10,10,time,time.minusDays(1));
+        var request=new FactRequest("W",Type.DELIVERY,Flow.TRANSFER,"1","DISPATCH:20","DISPATCH:20",null,List.of("DISPATCH:20"),List.of(),List.of());
+        when(deliveries.privateBatch("DISPATCH:20")).thenReturn(List.of(one));
+        assertNotEquals(ExecutionStatus.COMPLETED,provider.read(List.of(request)).get(0).executionStatus());
+        when(deliveries.privateBatch("DISPATCH:20")).thenReturn(List.of(one,two));
+        var fact=provider.read(List.of(request)).get(0);assertEquals(ExecutionStatus.COMPLETED,fact.executionStatus());assertEquals(time,fact.actual().localOccurredAt());assertEquals("D-20",fact.businessNo());
+        when(sources.privateBatch("DISPATCH:20")).thenReturn(List.of());
+        var removed=provider.read(List.of(request)).get(0);assertEquals(ExecutionStatus.PENDING,removed.executionStatus());assertNull(removed.actual());assertFalse(removed.blockReasons().isEmpty());
+        verify(deliveries,never()).customer(org.mockito.ArgumentMatchers.anyString(),org.mockito.ArgumentMatchers.anyString());verifyNoInteractions(appointments);
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/inboundplan/work/AppointmentWorkDispatchBindingTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/inboundplan/work/AppointmentWorkDispatchBindingTest.java
new file mode 100644
index 000000000..ccd2587bf
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/inboundplan/work/AppointmentWorkDispatchBindingTest.java
@@ -0,0 +1,137 @@
+package com.baiyue.lastleg.inboundplan.work;
+
+import com.baiyue.lastleg.appointmentplanning.*;
+import com.baiyue.lastleg.appointmentwork.*;
+import com.baiyue.lastleg.inboundplan.dto.FbaAppointmentResponse;
+import com.baiyue.lastleg.inboundplan.service.InboundFbaAppointmentService;
+import org.junit.jupiter.api.Test;
+import java.util.*;
+import static org.junit.jupiter.api.Assertions.*;
+import static org.mockito.Mockito.*;
+import static org.mockito.ArgumentMatchers.*;
+
+class AppointmentWorkDispatchBindingTest {
+    @Test void referencesCombinePhysicalRowsWithoutLosingBatchCustomerOrSourceIdentity() throws Exception {
+        var mapper=mock(AppointmentWorkDispatchMapper.class);
+        var service=new AppointmentWorkDispatchBinding(mapper,mock(InboundFbaAppointmentService.class),mock(AppointmentSourceService.class),mock(AppointmentWorkChanges.class),mock(com.baiyue.lastleg.inboundplan.receiving.FbaReceivingStore.class));
+        when(mapper.references(List.of(11L,12L))).thenReturn(List.of(
+            new AppointmentWorkDispatchMapper.ReferenceRow(11L,"FBA_APPOINTMENT:1","AP-1","A","ORDER:1","FBA:ONT8",40),
+            new AppointmentWorkDispatchMapper.ReferenceRow(11L,"FBA_APPOINTMENT:1","AP-1","A","ORDER:1","FBA:ONT8",20),
+            new AppointmentWorkDispatchMapper.ReferenceRow(11L,"FBA_APPOINTMENT:2",null,"A","ORDER:2","FBA:ONT8",10),
+            new AppointmentWorkDispatchMapper.ReferenceRow(12L,"DISPATCH:12","DP-12","B","ORDER:3","CUSTOMER:3",30)));
+        var result=service.references(List.of(12L,11L));assertEquals(2,result.get(11L).size());
+        assertEquals(60,result.get(11L).get(0).sources().get(0).packageCount());assertNull(result.get(11L).get(1).batchNo());
+        assertEquals("DP-12",result.get(12L).get(0).batchNo());assertEquals("B",result.get(12L).get(0).customerId());
+        verify(mapper).references(List.of(11L,12L));
+        var transaction=AppointmentWorkDispatchBinding.class.getMethod("references",List.class).getAnnotation(org.springframework.transaction.annotation.Transactional.class);
+        assertEquals(org.springframework.transaction.annotation.Propagation.SUPPORTS,transaction.propagation());assertTrue(transaction.readOnly());
+        when(mapper.references(List.of(11L))).thenReturn(java.util.Collections.nCopies(20001,new AppointmentWorkDispatchMapper.ReferenceRow(11L,"FBA_APPOINTMENT:1","AP-1","A","ORDER:1","FBA:ONT8",1)));
+        assertThrows(org.springframework.web.server.ResponseStatusException.class,()->service.references(List.of(11L)));
+    }
+    @Test void departureRechecksCurrentSourceAllocationAfterBatchQuantityOrMembershipChanges() {
+        var mapper=mock(AppointmentWorkDispatchMapper.class);var appointments=mock(InboundFbaAppointmentService.class);
+        var sources=mock(AppointmentSourceService.class);var changes=mock(AppointmentWorkChanges.class);
+        var receiving=mock(com.baiyue.lastleg.inboundplan.receiving.FbaReceivingStore.class);
+        var service=new AppointmentWorkDispatchBinding(mapper,appointments,sources,changes,receiving);
+        when(receiving.currentAgreement("FBA_APPOINTMENT:1","C")).thenReturn(agreement("C",4));
+        var row=new AppointmentWorkDispatchMapper.Bound(20,30,10,"FBA_APPOINTMENT:1","C","ORDER:1","FBA:ONT8",4);
+        when(mapper.bindings("D-20")).thenReturn(List.of(row));
+        when(mapper.lockAppointment(1)).thenReturn(new com.baiyue.lastleg.inboundplan.entity.InboundFbaAppointment());
+        var batch=mock(FbaAppointmentResponse.class);when(batch.batchKey()).thenReturn("FBA_APPOINTMENT:1");
+        when(batch.appointmentStatus()).thenReturn("SUCCESS");when(batch.appointmentAt()).thenReturn(java.time.LocalDateTime.of(2026,10,18,10,0));
+        when(batch.replacementBatchKeys()).thenReturn(List.of());
+        when(appointments.batchContext("FBA_APPOINTMENT:1")).thenReturn(new com.baiyue.lastleg.inboundplan.dto.FbaAppointmentBatchContext(batch,List.of(),List.of(),List.of(),List.of(batch),List.of()));
+        var item=mock(FbaAppointmentResponse.Item.class);when(item.customerId()).thenReturn("C");when(item.sourceKey()).thenReturn("ORDER:1");when(item.destinationKey()).thenReturn("FBA:ONT8");
+        when(item.packageCount()).thenReturn(3);when(batch.items()).thenReturn(List.of(item));
+        assertThrows(org.springframework.web.server.ResponseStatusException.class,()->service.requireDeparture("D-20"));
+        when(item.packageCount()).thenReturn(4);when(mapper.allocated("FBA_APPOINTMENT:1","C","ORDER:1","FBA:ONT8",20)).thenReturn(1L);
+        assertThrows(org.springframework.web.server.ResponseStatusException.class,()->service.requireDeparture("D-20"));
+        when(mapper.allocated("FBA_APPOINTMENT:1","C","ORDER:1","FBA:ONT8",20)).thenReturn(0L);
+        when(item.customerId()).thenReturn("OTHER");
+        assertThrows(org.springframework.web.server.ResponseStatusException.class,()->service.requireDeparture("D-20"));
+        when(item.customerId()).thenReturn("C");when(item.destinationKey()).thenReturn("FBA:OTHER");
+        assertThrows(org.springframework.web.server.ResponseStatusException.class,()->service.requireDeparture("D-20"));
+        verify(mapper,never()).pickedPhysical(anyLong(),anyString());
+        when(item.destinationKey()).thenReturn("FBA:ONT8");
+        when(mapper.pickedPhysical(30,"C")).thenReturn(List.of(new AppointmentWorkDispatchMapper.Physical(1L,"C","FBA:ONT8",null,4)));
+        when(sources.canonicalOrders(anyList())).thenReturn(List.of(new AppointmentCoverageService.SourceRef("C","ORDER:1",null)));
+        assertDoesNotThrow(()->service.requireDeparture("D-20"));
+        when(item.packageCount()).thenReturn(5);when(mapper.allocated("FBA_APPOINTMENT:1","C","ORDER:1","FBA:ONT8",20)).thenReturn(1L);
+        assertTrue(service.departureBlockReason("D-20").contains("收货确认未完整覆盖")); // Batch has 5, but the current agreement covers only 4 across every dispatch.
+        when(item.packageCount()).thenReturn(4);when(mapper.allocated("FBA_APPOINTMENT:1","C","ORDER:1","FBA:ONT8",20)).thenReturn(0L);
+        when(batch.appointmentStatus()).thenReturn("PENDING");
+        assertDoesNotThrow(()->service.requireDeparture("D-20")); // The current receiving agreement, not the old header, authorizes receipt.
+        when(receiving.hasPending("FBA_APPOINTMENT:1","OTHER")).thenReturn(true);
+        assertDoesNotThrow(()->service.requireDeparture("D-20"));
+        when(receiving.hasPending("FBA_APPOINTMENT:1","C")).thenReturn(true);
+        clearInvocations(mapper);
+        assertTrue(service.departureBlockReason("D-20").contains("待仓库确认"));verify(mapper,never()).lockAppointment(anyLong());
+        assertThrows(org.springframework.web.server.ResponseStatusException.class,()->service.requireDeparture("D-20"));
+        when(receiving.hasPending("FBA_APPOINTMENT:1","C")).thenReturn(false);
+        when(receiving.currentAgreement("FBA_APPOINTMENT:1","C")).thenReturn(agreement("OTHER",4));
+        assertThrows(org.springframework.web.server.ResponseStatusException.class,()->service.requireDeparture("D-20"));
+        when(receiving.currentAgreement("FBA_APPOINTMENT:1","C")).thenReturn(agreement("C",3));
+        assertThrows(org.springframework.web.server.ResponseStatusException.class,()->service.requireDeparture("D-20"));
+        when(receiving.currentAgreement("FBA_APPOINTMENT:1","C")).thenReturn(null);
+        assertThrows(org.springframework.web.server.ResponseStatusException.class,()->service.requireDeparture("D-20"));
+        verifyNoInteractions(changes);
+    }
+    private com.baiyue.lastleg.inboundplan.receiving.FbaReceivingContracts.Agreement agreement(String customer,int packages) {
+        var details=new com.baiyue.lastleg.inboundplan.dto.FbaAppointmentDetails(null,null,null,"CONF-1",java.time.LocalDateTime.of(2026,10,18,10,0),null,"SUCCESS",null,null,null);
+        var source=new com.baiyue.lastleg.inboundplan.receiving.FbaReceivingContracts.Source("ORDER:1","FBA:ONT8",packages,"v1",1,null);
+        var member=new com.baiyue.lastleg.inboundplan.receiving.FbaReceivingContracts.Member("FBA_APPOINTMENT:1","AP-1",1,customer,List.of(source),null);
+        return new com.baiyue.lastleg.inboundplan.receiving.FbaReceivingContracts.Agreement("RA-1",1,"ACTIVE","FBA:ONT8",details,"America/Los_Angeles",List.of(member),"仓库已确认");
+    }
+    @Test void groupedReplayCannotRewriteBatchBindingsAfterTheOriginalDispatchHasMovedOn() {
+        var mapper=mock(AppointmentWorkDispatchMapper.class);var changes=mock(AppointmentWorkChanges.class);
+        var service=new AppointmentWorkDispatchBinding(mapper,mock(InboundFbaAppointmentService.class),mock(AppointmentSourceService.class),changes,mock(com.baiyue.lastleg.inboundplan.receiving.FbaReceivingStore.class));
+        var row=new AppointmentWorkDispatchMapper.Bound(20,30,10,"FBA_APPOINTMENT:1","C","ORDER:1","FBA:ONT8",4);
+        when(mapper.byDispatch(20)).thenReturn(List.of(row));
+        var allocation=new AppointmentWorkDispatchPort.Allocation(10L,"FBA_APPOINTMENT:1","C","ORDER:1","FBA:ONT8",4);
+        assertDoesNotThrow(()->service.requireReplay("C",20,List.of(allocation)));
+        assertThrows(org.springframework.web.server.ResponseStatusException.class,()->service.requireReplay("C",20,List.of(new AppointmentWorkDispatchPort.Allocation(10L,"FBA_APPOINTMENT:2","C","ORDER:1","FBA:ONT8",4))));
+        verify(mapper,never()).remove(anyLong());verify(mapper,never()).insert(any());verifyNoInteractions(changes);
+    }
+    @Test void privateDispatchBindsOriginalPhysicalSourceAndDepartureRequiresActualPickedQuantity() {
+        var mapper=mock(AppointmentWorkDispatchMapper.class);var appointments=mock(InboundFbaAppointmentService.class);var sources=mock(AppointmentSourceService.class);var changes=mock(AppointmentWorkChanges.class);
+        var service=new AppointmentWorkDispatchBinding(mapper,appointments,sources,changes,mock(com.baiyue.lastleg.inboundplan.receiving.FbaReceivingStore.class));
+        when(mapper.physical(10,"C")).thenReturn(List.of(new AppointmentWorkDispatchMapper.Physical(1L,"C","CUSTOMER:1",4,4)));
+        when(sources.canonicalOrders(anyList())).thenReturn(List.of(new AppointmentCoverageService.SourceRef("C","ORDER:1",null)));
+        service.bind("C",20,List.of(new AppointmentWorkDispatchPort.PhysicalItem(30L,10L,"RECEIVED",4)),List.of());
+        var expected=new AppointmentWorkDispatchMapper.Bound(20,30,10,"DISPATCH:20","C","ORDER:1","CUSTOMER:1",4);
+        verify(mapper).insert(expected);verify(changes).requirementsChanged();
+        when(mapper.bindings("D-20")).thenReturn(List.of(expected));
+        when(mapper.pickedPhysical(30,"C")).thenReturn(List.of(new AppointmentWorkDispatchMapper.Physical(1L,"C","CUSTOMER:1",null,3)));
+        assertThrows(org.springframework.web.server.ResponseStatusException.class,()->service.requireDeparture("D-20"));
+        when(mapper.pickedPhysical(30,"C")).thenReturn(List.of(new AppointmentWorkDispatchMapper.Physical(1L,"C","CUSTOMER:1",null,4)));
+        assertDoesNotThrow(()->service.requireDeparture("D-20"));verifyNoInteractions(appointments);
+    }
+    @Test void repeatedPhysicalRowsForSameOrderResolveByIdentityWithoutIndexingDistinctResults() {
+        var sources=mock(AppointmentSourceService.class);
+        var one=new AppointmentWorkDispatchMapper.Physical(1L,"C","FBA:A",4,4);
+        var two=new AppointmentWorkDispatchMapper.Physical(1L,"C","FBA:B",5,5);
+        when(sources.canonicalOrders(List.of(new AppointmentExternalSourceGateway.OrderRef("C",1L))))
+            .thenReturn(List.of(new AppointmentCoverageService.SourceRef("C","BOOKING:X",null)));
+        var refs=AppointmentWorkPhysicalSources.canonical(List.of(one,two),sources);
+        assertEquals("BOOKING:X",AppointmentWorkPhysicalSources.ref(refs,one).sourceKey());
+        assertEquals("BOOKING:X",AppointmentWorkPhysicalSources.ref(refs,two).sourceKey());
+    }
+    @Test void emptyAllocationCannotBypassAnExistingBatchAtArrangeOrDeparture() {
+        var mapper=mock(AppointmentWorkDispatchMapper.class); var appointments=mock(InboundFbaAppointmentService.class);
+        var sources=mock(AppointmentSourceService.class); var changes=mock(AppointmentWorkChanges.class);
+        var service=new AppointmentWorkDispatchBinding(mapper,appointments,sources,changes,mock(com.baiyue.lastleg.inboundplan.receiving.FbaReceivingStore.class));
+        var part=new AppointmentWorkDispatchMapper.Physical(1L,"C","FBA:ONT8",4,4);
+        when(mapper.physical(10,"C")).thenReturn(List.of(part));
+        when(sources.canonicalOrders(anyList())).thenReturn(List.of(new AppointmentCoverageService.SourceRef("C","ORDER:1",null)));
+        var batch=mock(FbaAppointmentResponse.class);when(batch.appointmentStatus()).thenReturn("SUCCESS");when(batch.replacementBatchKeys()).thenReturn(List.of());
+        when(appointments.relatedBatchSnapshots(anyList())).thenReturn(List.of(batch));
+        when(mapper.bindings("D-1")).thenReturn(List.of());
+        when(mapper.dispatchPhysical("D-1")).thenReturn(List.of(new AppointmentWorkDispatchMapper.DispatchPhysical(30,10L,"C","RECEIVED",4)));
+        for(var status:List.of("SUCCESS","CANCELLED","FAILED")) {
+            when(batch.appointmentStatus()).thenReturn(status);
+            assertThrows(org.springframework.web.server.ResponseStatusException.class,()->service.bind("C",20,List.of(new AppointmentWorkDispatchPort.PhysicalItem(30L,10L,"RECEIVED",4)),List.of()));
+            assertThrows(org.springframework.web.server.ResponseStatusException.class,()->service.requireDeparture("D-1"));
+        }
+        verify(mapper,never()).insert(any()); verifyNoInteractions(changes);
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/inboundplan/work/AppointmentWorkDomainMapperTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/inboundplan/work/AppointmentWorkDomainMapperTest.java
new file mode 100644
index 000000000..bc761a7d5
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/inboundplan/work/AppointmentWorkDomainMapperTest.java
@@ -0,0 +1,78 @@
+package com.baiyue.lastleg.inboundplan.work;
+
+import com.baomidou.mybatisplus.core.MybatisConfiguration;
+import com.baomidou.mybatisplus.core.MybatisSqlSessionFactoryBuilder;
+import com.baiyue.lastleg.fleet.trip.work.AppointmentWorkTripMapper;
+import org.apache.ibatis.mapping.Environment;
+import org.apache.ibatis.transaction.jdbc.JdbcTransactionFactory;
+import org.h2.jdbcx.JdbcDataSource;
+import org.junit.jupiter.api.Test;
+import java.nio.charset.StandardCharsets;
+import java.util.*;
+import static org.junit.jupiter.api.Assertions.*;
+
+class AppointmentWorkDomainMapperTest {
+    @Test void originalDomainJoinsExecuteAgainstTheCurrentSchemaWithoutInventedColumns() throws Exception {
+        var ds=new JdbcDataSource();ds.setURL("jdbc:h2:mem:work-domain-"+UUID.randomUUID()+";MODE=MySQL;DB_CLOSE_DELAY=-1");
+        String baseline;try(var stream=getClass().getResourceAsStream("/db/lastleg.sql")){baseline=new String(Objects.requireNonNull(stream).readAllBytes(),StandardCharsets.UTF_8);}
+        try(var connection=ds.getConnection();var sql=connection.createStatement()) {
+            var created=new HashSet<String>();
+            for(var table:List.of("ll_order","ll_inbound_plan","ll_inbound_plan_line","ll_inbound_plan_pallet","ll_inbound_plan_pallet_allocation","ll_inbound_fba_appointment","ll_inbound_fba_appointment_item","ll_dispatch_pallet_lock","ll_dispatch_order","ll_dispatch_item","ll_dispatch_pda_pick","ll_dispatch_pda_pick_order","ll_receiving_container_session","ll_delivery_order","ll_fleet_driver","ll_vehicle","ll_fleet_trip","ll_fleet_trip_dispatch")) {
+                int start=baseline.indexOf("CREATE TABLE IF NOT EXISTS "+table+" (");if(start<0) start=baseline.indexOf("CREATE TABLE "+table+" (");assertTrue(start>=0,table);
+                sql.execute(baseline.substring(start,baseline.indexOf(';',start)+1).replace(" STORED","").replaceAll(" ENGINE=InnoDB[^;]*;",";"));
+                created.add(table);
+            }
+            // The current initialization script defines some fields in guarded ADD COLUMN literals.
+            // Execute those original definitions too; do not invent test-only business columns.
+            var additions=java.util.regex.Pattern.compile("'(ALTER TABLE (\\w+) ADD COLUMN (?:''|[^'])*)'").matcher(baseline);
+            while(additions.find()) if(created.contains(additions.group(2))) {
+                var prefix="ALTER TABLE "+additions.group(2)+" ";
+                for(var addition:additions.group(1).substring(prefix.length()).replace("''","'").split(",\\s*(?=ADD COLUMN)"))
+                    sql.execute(prefix+addition.replace("ADD COLUMN ","ADD COLUMN IF NOT EXISTS "));
+            }
+            String work;try(var stream=getClass().getResourceAsStream("/db/appointment-work.sql")){work=new String(Objects.requireNonNull(stream).readAllBytes(),StandardCharsets.UTF_8);}
+            for(var statement:work.replaceAll("(?m)^--.*$","").replaceAll(" ENGINE=InnoDB[^;]*;",";").split(";")) if(!statement.isBlank()) sql.execute(statement);
+        }
+        var config=new MybatisConfiguration();config.setMapUnderscoreToCamelCase(true);config.setEnvironment(new Environment("test",new JdbcTransactionFactory(),ds));
+        for(var mapper:List.of(AppointmentWorkDispatchMapper.class,AppointmentWorkDeliveryMapper.class,AppointmentWorkSourceMapper.class,AppointmentWorkReceivingMapper.class,AppointmentWorkTripMapper.class)) config.addMapper(mapper);
+        try(var session=new MybatisSqlSessionFactoryBuilder().build(config).openSession(true)) {
+            var dispatch=session.getMapper(AppointmentWorkDispatchMapper.class);
+            assertTrue(dispatch.candidates(1).isEmpty());assertTrue(dispatch.physical(1,"C").isEmpty());assertTrue(dispatch.pickedPhysical(1,"C").isEmpty());
+            assertTrue(dispatch.dispatchPhysical("D").isEmpty());assertTrue(dispatch.bindings("D").isEmpty());assertTrue(dispatch.byDispatch(1).isEmpty());assertTrue(dispatch.trips("FBA_APPOINTMENT:1").isEmpty());
+            assertTrue(dispatch.references(List.of(1L)).isEmpty());
+            assertEquals(0,dispatch.allocated("FBA_APPOINTMENT:1","C","ORDER:1","FBA:ONT8",1));
+            var deliveries=session.getMapper(AppointmentWorkDeliveryMapper.class);assertTrue(deliveries.batch("FBA_APPOINTMENT:1").isEmpty());assertTrue(deliveries.customer("1","1").isEmpty());
+            assertTrue(deliveries.privateBatch("DISPATCH:1").isEmpty());
+            assertTrue(deliveries.batches(List.of("FBA_APPOINTMENT:1","FBA_APPOINTMENT:2")).isEmpty());
+            var sources=session.getMapper(AppointmentWorkSourceMapper.class);assertTrue(sources.containerSources("1").isEmpty());assertTrue(sources.privateDispatches("1").isEmpty());assertTrue(sources.privateBatch("DISPATCH:1").isEmpty());
+            var receiving=session.getMapper(AppointmentWorkReceivingMapper.class);assertTrue(receiving.plans(List.of("1")).isEmpty());assertTrue(receiving.sessions(List.of("1")).isEmpty());
+            try(var sql=session.getConnection().createStatement()) {
+                sql.execute("INSERT INTO ll_order(id,order_no,customer_id,source_region,source_inbound_id,source_event_id,source_loading_plan_id,source_payload_hash,source_container_booking_id) VALUES(101,'O-1','A','TEST','I-1','E-1','P-1','HASH','1'),(102,'O-2','B','TEST','I-2','E-2','P-2','HASH','2')");
+                sql.execute("INSERT INTO ll_inbound_plan(id,plan_no,customer_id,source_order_id,container_no,planned_arrival_date) VALUES(201,'IP-1','A',101,'C-1','2026-10-16'),(202,'IP-2','B',102,'C-2','2026-10-17')");
+                sql.execute("INSERT INTO ll_inbound_plan_line(id,customer_id,plan_id,order_id,inbound_code) VALUES(301,'A',201,101,'IN-1'),(302,'B',202,102,'IN-2'),(303,'WRONG',201,102,'WRONG')");
+                sql.execute("INSERT INTO ll_receiving_container_session(id,source_container_booking_id,container_fact_hash,container_no,overseas_warehouse_id,overseas_warehouse_code,overseas_warehouse_name,operator_key,status,created_at) VALUES(401,'1','HASH','C-1',1,'W','W','A','COMPLETED','2026-10-15 01:00:00'),(402,'1','HASH','C-1',1,'W','W','A','RECEIVING','2026-10-15 02:00:00'),(403,'1','HASH','C-1',1,'W','W','A','SIGNED','2026-10-15 02:00:00'),(404,'2','HASH','C-2',1,'W','W','B','WAIT_SIGN','2026-10-15 01:00:00')");
+            }
+            session.clearCache();
+            var plans=receiving.plans(List.of("1","2"));assertEquals(2,plans.size());
+            assertEquals("1",plans.get(0).getSourceContainerBookingId());assertEquals("IP-1",plans.get(0).getPlanNo());assertEquals(java.time.LocalDate.of(2026,10,16),plans.get(0).getPlannedArrivalDate());
+            assertEquals("2",plans.get(1).getSourceContainerBookingId());
+            var sourceBatch=sources.containerSourcesBatch(List.of("1","2"));assertEquals(2,sourceBatch.size());
+            assertEquals("1",sourceBatch.get(0).containerBookingId());assertEquals(sources.containerSources("1").get(0),sourceBatch.get(0).source());
+            var sessions=receiving.sessions(List.of("1","2"));assertEquals(2,sessions.size());
+            assertEquals(403L,sessions.stream().filter(s->"1".equals(s.getSourceContainerBookingId())).findFirst().orElseThrow().getId());
+            try(var sql=session.getConnection().createStatement()) {
+                sql.execute("INSERT INTO ll_dispatch_order(id,customer_id,dispatch_no,status) VALUES(501,'A','D-1','PENDING_DEPARTURE'),(502,'B','D-2','CANCELLED'),(503,'B','D-3','PENDING_DEPARTURE')");
+                sql.execute("INSERT INTO ll_inbound_fba_appointment(id,appointment_no,origin_warehouse_id,fba_warehouse_code,created_by) VALUES(1,'AP-1','W','ONT8','operator'),(2,'AP-2','W','ONT8','operator')");
+                sql.execute("INSERT INTO ll_dispatch_appointment_allocation(dispatch_id,dispatch_item_id,plan_pallet_id,batch_key,customer_id,source_key,destination_key,package_count) VALUES(501,601,701,'FBA_APPOINTMENT:1','A','ORDER:101','FBA:ONT8',4),(501,602,702,'FBA_APPOINTMENT:1','B','ORDER:102','FBA:ONT8',6),(502,603,703,'FBA_APPOINTMENT:1','B','ORDER:102','FBA:ONT8',2),(503,604,704,'FBA_APPOINTMENT:2','B','ORDER:102','FBA:ONT8',3)");
+            }
+            session.clearCache();
+            var references=dispatch.references(List.of(501L,503L));
+            assertEquals(2,references.size());assertEquals("A",references.get(0).customerId());assertEquals("AP-1",references.get(0).batchNo());assertEquals(4,references.get(0).packages());
+            assertEquals("FBA_APPOINTMENT:2",references.get(1).batchKey());assertEquals("AP-2",references.get(1).batchNo()); // Wrong-customer rows on dispatch 501 must not leak into current references.
+            var batchDeliveries=deliveries.batches(List.of("FBA_APPOINTMENT:1","FBA_APPOINTMENT:2"));assertEquals(3,batchDeliveries.size());
+            assertEquals(deliveries.batch("FBA_APPOINTMENT:1"),batchDeliveries.stream().filter(d->d.batchKey().equals("FBA_APPOINTMENT:1")).map(AppointmentWorkDeliveryMapper.BatchDelivery::delivery).toList());
+            assertEquals(deliveries.batch("FBA_APPOINTMENT:2"),batchDeliveries.stream().filter(d->d.batchKey().equals("FBA_APPOINTMENT:2")).map(AppointmentWorkDeliveryMapper.BatchDelivery::delivery).toList());
+            var trips=session.getMapper(AppointmentWorkTripMapper.class);assertTrue(trips.batchTrips("FBA_APPOINTMENT:1").isEmpty());assertTrue(trips.batches(1).isEmpty());assertNull(trips.trip(1));
+        }
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/inboundplan/work/AppointmentWorkReceivingGuardTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/inboundplan/work/AppointmentWorkReceivingGuardTest.java
new file mode 100644
index 000000000..caf353914
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/inboundplan/work/AppointmentWorkReceivingGuardTest.java
@@ -0,0 +1,17 @@
+package com.baiyue.lastleg.inboundplan.work;
+
+import com.baiyue.lastleg.appointmentwork.*;
+import org.junit.jupiter.api.Test;
+import static org.junit.jupiter.api.Assertions.*;
+import static org.mockito.Mockito.*;
+import static com.baiyue.lastleg.appointmentwork.AppointmentWorkModels.*;
+
+class AppointmentWorkReceivingGuardTest {
+    @Test void confirmedLocalDirectRouteRejectsReceivingBeforeRemoteFactsExist() {
+        var firstleg=mock(AppointmentWorkFirstlegClient.class); var routes=mock(AppointmentWorkRouteService.class);
+        when(routes.route("1")).thenReturn(new AppointmentWorkRouteService.Route(Flow.DIRECT));
+        var guard=new AppointmentWorkReceivingGuard(firstleg,routes,"internal-token");
+        assertThrows(org.springframework.web.server.ResponseStatusException.class,()->guard.requireWarehouseFlow("1"));
+        verifyNoInteractions(firstleg);
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/inboundplan/work/AppointmentWorkReceivingProviderTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/inboundplan/work/AppointmentWorkReceivingProviderTest.java
new file mode 100644
index 000000000..872d4036e
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/inboundplan/work/AppointmentWorkReceivingProviderTest.java
@@ -0,0 +1,37 @@
+package com.baiyue.lastleg.inboundplan.work;
+
+import com.baiyue.lastleg.inboundplan.entity.InboundPlan;
+import com.baiyue.lastleg.inboundplan.pda.entity.ReceivingContainerSession;
+import org.junit.jupiter.api.Test;
+import java.time.*;
+import java.util.List;
+import static org.junit.jupiter.api.Assertions.*;
+import static org.mockito.Mockito.*;
+import static com.baiyue.lastleg.appointmentwork.AppointmentWorkFactGateway.*;
+import static com.baiyue.lastleg.appointmentwork.AppointmentWorkModels.*;
+
+class AppointmentWorkReceivingProviderTest {
+    @Test void receivingIsInProgressWithoutInventingAnActualCompletionAndTargetCarriesRealIdentity() {
+        var mapper=mock(AppointmentWorkReceivingMapper.class); var provider=new AppointmentWorkReceivingProvider(mapper);
+        var plan=new AppointmentWorkReceivingMapper.ContainerPlan(); plan.setSourceContainerBookingId("1");plan.setId(10L);plan.setPlanNo("IP-REAL");plan.setCustomerId("C");plan.setPlannedArrivalDate(LocalDate.of(2026,10,16));
+        var session=new ReceivingContainerSession();session.setId(2L);session.setStatus("RECEIVING");session.setReceivingAt(LocalDateTime.of(2026,10,15,10,0));
+        session.setSourceContainerBookingId("1");
+        when(mapper.plans(List.of("1"))).thenReturn(List.of(plan)); when(mapper.sessions(List.of("1"))).thenReturn(List.of(session));
+        var request=new FactRequest("work",Type.WAREHOUSE_RECEIPT,Flow.TRANSFER,"1",null,null,null,List.of(),List.of(),List.of());
+        var fact=provider.read(List.of(request)).get(0);
+        assertEquals(ExecutionStatus.IN_PROGRESS,fact.executionStatus()); assertNull(fact.actual());
+        assertEquals(new ReceiptTarget("10","IP-REAL","C","1"),fact.action().target());
+        session.setStatus("COMPLETED"); session.setCompletedAt(LocalDateTime.of(2026,10,16,12,0));
+        fact=provider.read(List.of(request)).get(0); assertEquals(ExecutionStatus.COMPLETED,fact.executionStatus()); assertEquals(session.getCompletedAt(),fact.actual().localOccurredAt());
+    }
+    @Test void twoQueriesCoverTwoHundredContainersAndKeepTheirFactsSeparate() {
+        var mapper=mock(AppointmentWorkReceivingMapper.class); var provider=new AppointmentWorkReceivingProvider(mapper);
+        var requests=java.util.stream.IntStream.range(1,201).mapToObj(i->new FactRequest("W"+i,Type.WAREHOUSE_RECEIPT,Flow.TRANSFER,""+i,null,null,null,List.of(),List.of(),List.of())).toList();
+        var plan=new AppointmentWorkReceivingMapper.ContainerPlan();plan.setSourceContainerBookingId("2");plan.setId(20L);plan.setPlanNo("IP-2");plan.setPlannedArrivalDate(LocalDate.of(2026,10,16));
+        when(mapper.plans(org.mockito.ArgumentMatchers.anyList())).thenReturn(List.of(plan));
+        var facts=provider.read(requests);assertEquals(200,facts.size());assertNull(facts.get(0).target());assertEquals(plan.getPlannedArrivalDate(),facts.get(1).target().date());
+        verify(mapper).plans(requests.stream().map(FactRequest::containerBookingId).toList());verify(mapper).sessions(requests.stream().map(FactRequest::containerBookingId).toList());verifyNoMoreInteractions(mapper);
+        when(mapper.plans(org.mockito.ArgumentMatchers.anyList())).thenReturn(java.util.Collections.nCopies(1001,plan));
+        assertThrows(org.springframework.web.server.ResponseStatusException.class,()->provider.read(requests));
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/inboundplan/work/AppointmentWorkRequirementProviderTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/inboundplan/work/AppointmentWorkRequirementProviderTest.java
new file mode 100644
index 000000000..1ff8f4d24
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/inboundplan/work/AppointmentWorkRequirementProviderTest.java
@@ -0,0 +1,126 @@
+package com.baiyue.lastleg.inboundplan.work;
+
+import com.baiyue.lastleg.appointmentplanning.*;
+import com.baiyue.lastleg.inboundplan.service.InboundFbaAppointmentService;
+import org.junit.jupiter.api.Test;
+import java.time.LocalDateTime;
+import java.util.List;
+import static org.junit.jupiter.api.Assertions.*;
+import static org.mockito.Mockito.*;
+import static com.baiyue.lastleg.appointmentwork.AppointmentWorkFactGateway.*;
+import static com.baiyue.lastleg.appointmentwork.AppointmentWorkModels.*;
+
+class AppointmentWorkRequirementProviderTest {
+    /** 取消历史没有活动货物时退役旧事项，仍按权威分配保留新批次和未分配余量。 */
+    @Test void cancelledEmptyHistoryDoesNotBlockCurrentBatchOrRestoreAlreadyAllocatedCargo() {
+        var sources=mock(AppointmentSourceService.class);var cargo=mock(AppointmentCargoVerificationService.class);
+        var appointments=mock(InboundFbaAppointmentService.class);var mapping=mock(AppointmentWorkSourceMapper.class);
+        var provider=new AppointmentWorkRequirementProvider(sources,cargo,appointments,mapping);
+        var requirement=new Requirement("INBOUND:1",null,null,"FBA",null,"ONT8",null,List.of(),List.of(),List.of());
+        var container=new ContainerSource("1","CNT",null,null,LocalDateTime.parse("2026-10-15T11:00:00"),"1",Flow.TRANSFER,null,List.of(requirement));
+        when(mapping.containerSources("1")).thenReturn(List.of(new AppointmentWorkSourceMapper.Source(11L,"C","10","1","FBA","ONT8",60)));
+        when(sources.canonicalOrders(anyList())).thenReturn(List.of(new AppointmentCoverageService.SourceRef("C","ORDER:11",null)));
+        var source=new AppointmentSourceService.Source("ORDER:11","C",11L,"IN-11",null,"CNT",null,null,"FBA:ONT8","ONT8",60,"v1",true,List.of());
+        when(sources.resolveBatch(anyList())).thenReturn(List.of(source));
+        var allocation=mock(AppointmentCargoVerificationService.Context.class);
+        when(cargo.inspect(source)).thenReturn(allocation);when(allocation.availablePackages()).thenReturn(0L);
+        var cancelled=mock(com.baiyue.lastleg.inboundplan.dto.FbaAppointmentResponse.class);
+        when(cancelled.batchKey()).thenReturn("FBA_APPOINTMENT:1");when(cancelled.appointmentStatus()).thenReturn("CANCELLED");
+        when(cancelled.items()).thenReturn(List.of());when(cancelled.replacementBatchKeys()).thenReturn(List.of());
+        var current=mock(com.baiyue.lastleg.inboundplan.dto.FbaAppointmentResponse.class);
+        var item=mock(com.baiyue.lastleg.inboundplan.dto.FbaAppointmentResponse.Item.class);
+        when(item.customerId()).thenReturn("C");when(item.sourceKey()).thenReturn("ORDER:11");when(item.destinationKey()).thenReturn("FBA:ONT8");
+        when(current.batchKey()).thenReturn("FBA_APPOINTMENT:2");when(current.appointmentNo()).thenReturn("AP-2");
+        when(current.fbaWarehouseCode()).thenReturn("ONT8");when(current.items()).thenReturn(List.of(item));when(current.replacementBatchKeys()).thenReturn(List.of());
+        when(appointments.relatedBatchSnapshots(anyList())).thenReturn(List.of(cancelled,current));
+        var actual=provider.requirements(container,Flow.TRANSFER);
+        assertEquals(List.of("FBA_APPOINTMENT:2|CUSTOMER:C"),actual.stream().map(Requirement::requirementKey).toList());
+        assertEquals(List.of(new SourceReference("C","ORDER:11","FBA:ONT8")),actual.get(0).sources());
+        assertTrue(actual.get(0).replacesRequirementKeys().contains("FBA_APPOINTMENT:1|CUSTOMER:C"));
+        when(allocation.availablePackages()).thenReturn(20L);
+        actual=provider.requirements(container,Flow.TRANSFER);
+        assertEquals(List.of("INBOUND:1","FBA_APPOINTMENT:2|CUSTOMER:C"),actual.stream().map(Requirement::requirementKey).toList());
+        assertEquals(List.of("FBA_APPOINTMENT:1","FBA_APPOINTMENT:1|CUSTOMER:C"),actual.get(0).replacesRequirementKeys());
+        when(appointments.relatedBatchSnapshots(anyList())).thenReturn(List.of(cancelled));
+        when(allocation.availablePackages()).thenReturn(60L);
+        actual=provider.requirements(container,Flow.TRANSFER);
+        assertEquals(List.of("INBOUND:1"),actual.stream().map(Requirement::requirementKey).toList());
+        assertEquals(List.of(new SourceReference("C","ORDER:11","FBA:ONT8")),actual.get(0).sources());
+        assertTrue(actual.get(0).replacesRequirementKeys().contains("FBA_APPOINTMENT:1|CUSTOMER:C"));
+        // 非取消的空批次仍属缺失事实，不能静默跳过。
+        when(cancelled.appointmentStatus()).thenReturn("PENDING");
+        assertEquals(503,assertThrows(org.springframework.web.server.ResponseStatusException.class,()->provider.requirements(container,Flow.TRANSFER)).getStatusCode().value());
+    }
+
+    @Test void cancelledAndFailedBookingsRetainTheirAllocatedBatchAndOnlyAuthorityDefinesRemainder() {
+        var sources=mock(AppointmentSourceService.class);var cargo=mock(AppointmentCargoVerificationService.class);
+        var appointments=mock(InboundFbaAppointmentService.class);var mapping=mock(AppointmentWorkSourceMapper.class);
+        var provider=new AppointmentWorkRequirementProvider(sources,cargo,appointments,mapping);
+        var requirement=new Requirement("INBOUND:1",null,null,"FBA",null,"ONT8",null,List.of(),List.of(),List.of());
+        var container=new ContainerSource("1","CNT",null,null,LocalDateTime.parse("2026-10-15T11:00:00"),"1",Flow.TRANSFER,null,List.of(requirement));
+        when(mapping.containerSources("1")).thenReturn(List.of(new AppointmentWorkSourceMapper.Source(11L,"C","10","1","FBA","ONT8",60)));
+        when(sources.canonicalOrders(anyList())).thenReturn(List.of(new AppointmentCoverageService.SourceRef("C","ORDER:11",null)));
+        var source=new AppointmentSourceService.Source("ORDER:11","C",11L,"IN-11",null,"CNT",null,null,"FBA:ONT8","ONT8",60,"v1",true,List.of());
+        when(sources.resolveBatch(anyList())).thenReturn(List.of(source));
+        var allocation=mock(AppointmentCargoVerificationService.Context.class);
+        when(cargo.inspect(source)).thenReturn(allocation);when(allocation.availablePackages()).thenReturn(0L);
+        var batch=mock(com.baiyue.lastleg.inboundplan.dto.FbaAppointmentResponse.class);
+        var item=mock(com.baiyue.lastleg.inboundplan.dto.FbaAppointmentResponse.Item.class);
+        when(item.customerId()).thenReturn("C");when(item.sourceKey()).thenReturn("ORDER:11");when(item.destinationKey()).thenReturn("FBA:ONT8");
+        when(batch.batchKey()).thenReturn("FBA_APPOINTMENT:1");when(batch.appointmentNo()).thenReturn("AP-1");
+        when(batch.fbaWarehouseCode()).thenReturn("ONT8");when(batch.items()).thenReturn(List.of(item));when(batch.replacementBatchKeys()).thenReturn(List.of());
+        when(appointments.relatedBatchSnapshots(anyList())).thenReturn(List.of(batch));
+        for(var status:List.of("CANCELLED","FAILED")) {
+            when(batch.appointmentStatus()).thenReturn(status);
+            var result=provider.requirements(container,Flow.TRANSFER);
+            assertEquals(List.of("FBA_APPOINTMENT:1|CUSTOMER:C"),result.stream().map(Requirement::requirementKey).toList());
+            assertEquals(List.of(new SourceReference("C","ORDER:11","FBA:ONT8")),result.get(0).sources());
+            assertTrue(result.get(0).replacesRequirementKeys().contains("FBA_APPOINTMENT:1"));
+        }
+        when(allocation.availablePackages()).thenReturn(20L);
+        assertEquals(List.of("INBOUND:1","FBA_APPOINTMENT:1|CUSTOMER:C"),provider.requirements(container,Flow.TRANSFER).stream().map(Requirement::requirementKey).toList());
+        when(batch.replacementBatchKeys()).thenReturn(List.of("FBA_APPOINTMENT:2"));
+        assertEquals(List.of("INBOUND:1"),provider.requirements(container,Flow.TRANSFER).stream().map(Requirement::requirementKey).toList());
+    }
+    @Test void unbookableSourceKeepsItsPhysicalRequirementWhileAuthorityFailuresStillAbort() {
+        var sources=mock(AppointmentSourceService.class);var cargo=mock(AppointmentCargoVerificationService.class);
+        var appointments=mock(InboundFbaAppointmentService.class);var mapping=mock(AppointmentWorkSourceMapper.class);
+        var provider=new AppointmentWorkRequirementProvider(sources,cargo,appointments,mapping);
+        var requirement=new Requirement("INBOUND:1",null,null,"FBA",null,"ONT8",null,List.of(),List.of(),List.of());
+        var container=new ContainerSource("1","CNT",null,null,LocalDateTime.parse("2026-10-15T11:00:00"),"1",Flow.TRANSFER,null,List.of(requirement));
+        when(mapping.containerSources("1")).thenReturn(List.of(new AppointmentWorkSourceMapper.Source(11L,"C","10","1","FBA","ONT8",4)));
+        var refs=List.of(new AppointmentCoverageService.SourceRef("C","ORDER:11",null));
+        when(sources.canonicalOrders(anyList())).thenReturn(refs);
+        when(sources.resolveBatch(refs)).thenThrow(new org.springframework.web.server.ResponseStatusException(org.springframework.http.HttpStatus.BAD_REQUEST,"当前货源类型不支持FBA预约"));
+        var actual=provider.requirements(container,Flow.TRANSFER);
+        assertEquals(1,actual.size());assertEquals("INBOUND:1",actual.get(0).requirementKey());
+        assertEquals(List.of(new SourceReference("C","ORDER:11",null)),actual.get(0).sources());
+        verifyNoInteractions(cargo,appointments);
+        doThrow(new org.springframework.web.server.ResponseStatusException(org.springframework.http.HttpStatus.SERVICE_UNAVAILABLE,"仓库目录暂不可用，请稍后重新核对")).when(sources).resolveBatch(refs);
+        assertThrows(org.springframework.web.server.ResponseStatusException.class,()->provider.requirements(container,Flow.TRANSFER));
+    }
+    @Test void privateDispatchKeepsPartialRemainderAndRestoresCancelledQuantity() {
+        var sources=mock(AppointmentSourceService.class);var cargo=mock(AppointmentCargoVerificationService.class);var appointments=mock(InboundFbaAppointmentService.class);var mapping=mock(AppointmentWorkSourceMapper.class);
+        var provider=new AppointmentWorkRequirementProvider(sources,cargo,appointments,mapping);
+        var requirement=new Requirement("INBOUND:1",null,null,"PRIVATE",null,"客户仓",null,List.of(),List.of(),List.of());
+        var container=new ContainerSource("1","CNT",null,null,LocalDateTime.parse("2026-10-15T11:00:00"),"1",Flow.TRANSFER,null,List.of(requirement));
+        when(mapping.containerSources("1")).thenReturn(List.of(new AppointmentWorkSourceMapper.Source(11L,"C","10","1","PRIVATE",null,10)));
+        var batch=new AppointmentWorkSourceMapper.DispatchSource(20,"D-20","PRE_ARRANGED",11,"C","ORDER:11","CUSTOMER:11",4);
+        when(mapping.privateDispatches("1")).thenReturn(List.of(batch));when(mapping.privateBatch("DISPATCH:20")).thenReturn(List.of(batch));
+        var manifest=provider.requirements(container,Flow.TRANSFER);
+        assertEquals(List.of("INBOUND:1","DISPATCH:20"),manifest.stream().map(Requirement::requirementKey).toList());
+        assertEquals("D-20",manifest.get(1).batchNo());assertEquals("CUSTOMER:11",manifest.get(1).sources().get(0).destinationKey());
+        when(mapping.privateDispatches("1")).thenReturn(List.of(new AppointmentWorkSourceMapper.DispatchSource(20,"D-20","CANCELLED",11,"C","ORDER:11","CUSTOMER:11",4)));
+        var restored=provider.requirements(container,Flow.TRANSFER);assertEquals(1,restored.size());assertEquals(List.of("DISPATCH:20"),restored.get(0).replacesRequirementKeys());
+        verifyNoInteractions(sources,cargo,appointments);
+    }
+    @Test void chosenDirectRoutePreservesInboundKeyBeforeAnyActualUnloading() {
+        var sources=mock(AppointmentSourceService.class); var cargo=mock(AppointmentCargoVerificationService.class);
+        var appointments=mock(InboundFbaAppointmentService.class); var mapping=mock(AppointmentWorkSourceMapper.class);
+        var provider=new AppointmentWorkRequirementProvider(sources,cargo,appointments,mapping);
+        var requirement=new Requirement("INBOUND:1",null,null,"FBA",null,"ONT8",null,List.of(),List.of(),List.of());
+        var source=new ContainerSource("1","CNT",null,null,LocalDateTime.parse("2026-10-15T11:00:00"),"1",Flow.UNKNOWN,null,List.of(requirement));
+        assertEquals(List.of(requirement),provider.requirements(source,Flow.DIRECT));
+        verifyNoInteractions(sources,cargo,appointments,mapping);
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/inboundplan/work/FbaAppointmentExecutionAdapterTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/inboundplan/work/FbaAppointmentExecutionAdapterTest.java
new file mode 100644
index 000000000..a2c9c1443
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/inboundplan/work/FbaAppointmentExecutionAdapterTest.java
@@ -0,0 +1,62 @@
+package com.baiyue.lastleg.inboundplan.work;
+
+import com.baiyue.lastleg.fleet.trip.*;
+
+import com.baiyue.lastleg.inboundplan.receiving.FbaAppointmentExecutionPort.*;
+import org.junit.jupiter.api.Test;
+import java.time.*;
+import java.util.*;
+import static org.junit.jupiter.api.Assertions.*;
+import static org.mockito.Mockito.*;
+
+class FbaAppointmentExecutionAdapterTest {
+    final String batch="FBA_APPOINTMENT:1";
+    final Member a=new Member(batch,"A"),b=new Member(batch,"B");
+    final AppointmentWorkDispatchMapper mapper=mock(AppointmentWorkDispatchMapper.class);
+    final FleetTripMapper trips=mock(FleetTripMapper.class);
+    final FleetDispatchGateway dispatches=mock(FleetDispatchGateway.class);
+    final FbaAppointmentExecutionAdapter adapter=new FbaAppointmentExecutionAdapter(mapper,trips,dispatches);
+    final Instant at=Instant.parse("2026-10-01T12:00:00Z");
+    FbaAppointmentExecutionAdapterTest() {
+        when(mapper.receivingSources(List.of(batch))).thenReturn(List.of(new AppointmentWorkDispatchMapper.ReceivingSource(batch,"A","ORDER:1","FBA:ONT8",100),new AppointmentWorkDispatchMapper.ReceivingSource(batch,"B","ORDER:2","FBA:ONT8",100)));
+        when(mapper.transportRows(List.of(batch),List.of())).thenReturn(List.of(row("A","DEPARTED","COMPLETED"),row("B","PENDING_DEPARTURE","PLANNED")));
+        when(dispatches.completion("D-A",false)).thenReturn(new FleetCompletionModels.DispatchCompletion("D-A","100",List.of(new FleetCompletionModels.Outcome("D-A","DL-A","A","ONT8","DELIVERED",100,at,100,0,0)),null));
+        when(dispatches.completion("D-B",false)).thenReturn(new FleetCompletionModels.DispatchCompletion("D-B","100",List.of(),"排车出库尚未完成"));
+        when(dispatches.terminalEvidence("D-A",false)).thenReturn(proof(100,at,1,List.of()));
+        when(trips.lockByNo("T-B")).thenReturn(new FleetTripEntity());
+    }
+    @Test void sameBatchSubsetKeepsTokenAndOnlySelectedCustomerExecutionRowsAreLocked() {
+        var all=adapter.inspect(List.of(a,b));var selected=adapter.inspect(List.of(b));
+        assertEquals(all.version(),selected.version());assertTrue(all.members().get(0).completed());assertFalse(all.members().get(0).canRebook());assertTrue(selected.members().get(0).canRebook());
+        var locked=adapter.lockAndInspect(List.of(b),all.version());assertTrue(locked.members().get(0).canRebook());
+        var order=inOrder(trips,dispatches);order.verify(trips).lockByNo("T-B");order.verify(dispatches).completion("D-B",true);order.verify(dispatches).lockForPlanning("D-B");
+        verify(trips,never()).lockByNo("T-A");verify(dispatches,never()).completion("D-A",true);verify(dispatches,never()).lockForPlanning("D-A");
+    }
+    @Test void statusCannotReplaceRealProofAndPartialActualCoverageCannotCompleteWholeAllocation() {
+        when(dispatches.terminalEvidence("D-A",false)).thenReturn(proof(50,at,1,List.of()));
+        var partial=adapter.inspect(List.of(a)).members().get(0);assertFalse(partial.completed());assertFalse(partial.canRebook());
+        when(dispatches.terminalEvidence("D-A",false)).thenThrow(new org.springframework.web.server.ResponseStatusException(org.springframework.http.HttpStatus.CONFLICT,"缺少真实出库依据"));
+        var absent=adapter.inspect(List.of(a)).members().get(0);assertFalse(absent.completed());assertFalse(absent.canRebook());
+        when(mapper.transportRows(List.of(batch),List.of())).thenReturn(List.of(row("B","PENDING_DEPARTURE","COMPLETED")));
+        var tripOnly=adapter.inspect(List.of(b)).members().get(0);assertFalse(tripOnly.completed());assertFalse(tripOnly.canRebook());
+    }
+    @Test void actualReturnCompletionExcludesMemberAndSiblingExecutionChangeInvalidatesToken() {
+        var prior=adapter.inspect(List.of(b));
+        when(dispatches.terminalEvidence("D-A",false)).thenReturn(proof(100,at.plusSeconds(60),2,List.of(new FleetDispatchGateway.ReturnedReceipt("11","101",100,at.plusSeconds(60)))));
+        var returned=adapter.inspect(List.of(a)).members().get(0);assertTrue(returned.completed());assertFalse(returned.canRebook());
+        assertThrows(org.springframework.web.server.ResponseStatusException.class,()->adapter.lockAndInspect(List.of(b),prior.version()));
+        verify(dispatches,never()).completion("D-A",true);
+    }
+    @Test void noCandidatesDoesNotGrantAnOperationOrReadOtherBusinessData() {
+        clearInvocations(mapper,trips,dispatches);assertTrue(adapter.inspect(List.of()).members().isEmpty());
+        assertThrows(org.springframework.web.server.ResponseStatusException.class,()->adapter.lockAndInspect(List.of(),"empty"));
+        verifyNoInteractions(mapper,trips,dispatches);
+    }
+    private AppointmentWorkDispatchMapper.TransportRow row(String customer,String status,String tripStatus) {
+        long id="A".equals(customer)?1:2;boolean executed="DEPARTED".equals(status);
+        return new AppointmentWorkDispatchMapper.TransportRow(id,"D-"+customer,customer,status,executed?100:0,executed?100:0,LocalDateTime.of(2026,10,1,12,0),id+10,id+100,100,"RECEIVED",batch,"ORDER:"+id,"FBA:ONT8",100,"T-"+customer,1L,tripStatus,id+200,executed?"OUTBOUNDED":"WAIT_OUTBOUND",executed?"COMPLETED":"PDA_PENDING");
+    }
+    private FleetDispatchGateway.TerminalEvidence proof(int packages,Instant terminal,long version,List<FleetDispatchGateway.ReturnedReceipt> returns) {
+        return new FleetDispatchGateway.TerminalEvidence("D-A","A","100",packages,List.of(new FleetDispatchGateway.TerminalDelivery("A","DL-A","FBA:ONT8",packages,terminal,returns.isEmpty()?"DELIVERED":"RETURNED",version,returns)));
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/inboundplan/work/FbaAppointmentTransportAdapterTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/inboundplan/work/FbaAppointmentTransportAdapterTest.java
new file mode 100644
index 000000000..bd108771c
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/inboundplan/work/FbaAppointmentTransportAdapterTest.java
@@ -0,0 +1,103 @@
+package com.baiyue.lastleg.inboundplan.work;
+
+import com.baiyue.lastleg.appointmentwork.AppointmentWorkChanges;
+import com.baiyue.lastleg.fleet.trip.*;
+import com.baiyue.lastleg.inboundplan.receiving.FbaAppointmentTransportPort;
+import com.baomidou.mybatisplus.core.MybatisConfiguration;
+import com.baomidou.mybatisplus.extension.spring.MybatisSqlSessionFactoryBean;
+import org.mybatis.spring.SqlSessionTemplate;
+import org.junit.jupiter.api.*;
+import org.springframework.aop.framework.ProxyFactory;
+import org.springframework.jdbc.core.JdbcTemplate;
+import org.springframework.jdbc.datasource.*;
+import org.springframework.transaction.annotation.AnnotationTransactionAttributeSource;
+import org.springframework.transaction.interceptor.TransactionInterceptor;
+import org.springframework.transaction.support.TransactionTemplate;
+import java.util.*;
+import static org.junit.jupiter.api.Assertions.*;
+import static org.mockito.Mockito.*;
+
+/** Real mapper/transaction checks; original Fleet/Dispatch commands are represented by transactional SQL test doubles. */
+class FbaAppointmentTransportAdapterTest {
+    private JdbcTemplate jdbc;
+    private TransactionTemplate tx;
+    private FbaAppointmentTransportPort adapter;
+    private FleetTripService fleet;
+    private FleetDispatchGateway dispatch;
+    @BeforeEach void setup() throws Exception {
+        var ds=new DriverManagerDataSource("jdbc:h2:mem:transport-"+UUID.randomUUID()+";MODE=MySQL;DB_CLOSE_DELAY=-1","sa","");
+        jdbc=new JdbcTemplate(ds);var manager=new DataSourceTransactionManager(ds);tx=new TransactionTemplate(manager);
+        jdbc.execute("CREATE TABLE ll_fleet_trip(id BIGINT PRIMARY KEY,trip_no VARCHAR(40),record_version BIGINT,status VARCHAR(30))");
+        jdbc.execute("CREATE TABLE ll_dispatch_order(id BIGINT PRIMARY KEY,dispatch_no VARCHAR(40),customer_id VARCHAR(40),status VARCHAR(30),package_count INT,picked_package_count INT,shipped_package_count INT,updated_at TIMESTAMP)");
+        jdbc.execute("CREATE TABLE ll_dispatch_item(id BIGINT PRIMARY KEY,dispatch_order_id BIGINT,customer_id VARCHAR(40),plan_pallet_id BIGINT,source_stage VARCHAR(30),package_count INT)");
+        jdbc.execute("CREATE TABLE ll_dispatch_appointment_allocation(dispatch_id BIGINT,dispatch_item_id BIGINT,plan_pallet_id BIGINT,batch_key VARCHAR(60),customer_id VARCHAR(40),source_key VARCHAR(40),destination_key VARCHAR(40),package_count INT)");
+        jdbc.execute("CREATE TABLE ll_fleet_trip_dispatch(dispatch_id BIGINT PRIMARY KEY,trip_id BIGINT)");
+        jdbc.execute("CREATE TABLE ll_outbound_order(id BIGINT,dispatch_order_id BIGINT,customer_id VARCHAR(40),status VARCHAR(30))");
+        jdbc.execute("CREATE TABLE ll_dispatch_pda_task(id BIGINT,dispatch_order_id BIGINT,customer_id VARCHAR(40),status VARCHAR(30))");
+        jdbc.update("INSERT INTO ll_fleet_trip VALUES(1,'T-1',1,'PLANNED')");
+        seed(1,"A",80,List.of(80));seed(2,"B",160,List.of(100,60));seed(3,"C",40,List.of(40));
+        var configuration=new MybatisConfiguration();configuration.setMapUnderscoreToCamelCase(true);configuration.addMapper(AppointmentWorkDispatchMapper.class);configuration.addMapper(FleetTripMapper.class);
+        var factory=new MybatisSqlSessionFactoryBean();factory.setDataSource(ds);factory.setConfiguration(configuration);
+        var session=new SqlSessionTemplate(factory.getObject());
+        fleet=mock(FleetTripService.class);dispatch=mock(FleetDispatchGateway.class);var gateway=dispatch;
+        when(gateway.lockForPlanning(anyString())).thenAnswer(c->{String number=c.getArgument(0);jdbc.queryForList("SELECT id FROM ll_dispatch_order WHERE dispatch_no=? FOR UPDATE",number);return null;});
+        when(fleet.unbindDispatch(anyString(),anyString(),any())).thenAnswer(c->{var command=c.getArgument(2,FleetTripModels.BindingCommand.class);jdbc.update("DELETE FROM ll_fleet_trip_dispatch WHERE dispatch_id=(SELECT id FROM ll_dispatch_order WHERE dispatch_no=?)",command.dispatchNo());bump();return null;});
+        when(fleet.bindDispatch(anyString(),anyString(),any())).thenAnswer(c->{var command=c.getArgument(2,FleetTripModels.BindingCommand.class);jdbc.update("INSERT INTO ll_fleet_trip_dispatch SELECT id,1 FROM ll_dispatch_order WHERE dispatch_no=?",command.dispatchNo());bump();return null;});
+        when(fleet.detail("T-1")).thenAnswer(c->{
+            var response=mock(FleetTripModels.Response.class);when(response.recordVersion()).thenReturn(jdbc.queryForObject("SELECT record_version FROM ll_fleet_trip WHERE id=1",Long.class));
+            var bindings=jdbc.query("SELECT d.* FROM ll_dispatch_order d JOIN ll_fleet_trip_dispatch b ON b.dispatch_id=d.id ORDER BY d.id",(rs,n)->new FleetTripModels.DispatchBinding(rs.getString("dispatch_no"),rs.getString("customer_id"),rs.getInt("package_count"),"operator",null,null,List.of()));
+            return new FleetTripModels.Detail(response,null,bindings,null,List.of(),null);
+        });
+        when(fleet.cancel(anyString(),anyString(),any())).thenAnswer(c->{jdbc.update("UPDATE ll_fleet_trip SET status='CANCELLED',record_version=record_version+1 WHERE id=1");return null;});
+        doAnswer(c->{
+            long item=c.getArgument(1);String number=c.getArgument(0);
+            jdbc.update("DELETE FROM ll_dispatch_appointment_allocation WHERE dispatch_item_id=?",item);jdbc.update("DELETE FROM ll_dispatch_item WHERE id=?",item);
+            jdbc.update("UPDATE ll_dispatch_order SET package_count=(SELECT SUM(package_count) FROM ll_dispatch_item WHERE dispatch_order_id=ll_dispatch_order.id) WHERE dispatch_no=?",number);return null;
+        }).when(dispatch).removeItem(anyString(),anyLong());
+        var target=new FbaAppointmentTransportAdapter(session.getMapper(AppointmentWorkDispatchMapper.class),session.getMapper(FleetTripMapper.class),gateway,fleet,mock(FleetBookingReservations.class),mock(AppointmentWorkChanges.class));
+        var proxy=new ProxyFactory(target);proxy.setProxyTargetClass(true);proxy.addAdvice(new TransactionInterceptor(manager,new AnnotationTransactionAttributeSource()));adapter=(FbaAppointmentTransportPort)proxy.getProxy();
+    }
+    private void seed(long id,String customer,int total,List<Integer> amounts) {
+        jdbc.update("INSERT INTO ll_dispatch_order VALUES(?,?,?,'PENDING_DEPARTURE',?,0,0,CURRENT_TIMESTAMP)",id,"D-"+id,customer,total);
+        jdbc.update("INSERT INTO ll_fleet_trip_dispatch VALUES(?,1)",id);
+        for(int i=0;i<amounts.size();i++) {
+            long item=id*10+i;
+            jdbc.update("INSERT INTO ll_dispatch_item VALUES(?,?,?,?, 'RECEIVED',?)",item,id,customer,item+100,amounts.get(i));
+            jdbc.update("INSERT INTO ll_dispatch_appointment_allocation VALUES(?,?,?,?,?,?,?,?)",id,item,item+100,"FBA_APPOINTMENT:"+id,customer,"ORDER:"+id,"FBA:ONT8",amounts.get(i));
+        }
+    }
+    private void bump() { jdbc.update("UPDATE ll_fleet_trip SET record_version=record_version+1 WHERE id=1"); }
+    private FbaAppointmentTransportPort.Result move(int retained) {
+        var scope=adapter.inspect(List.of("FBA_APPOINTMENT:2"));
+        return tx.execute(status->{var locked=adapter.lockAndInspect(List.of("FBA_APPOINTMENT:2"),scope.version());return adapter.apply(locked,List.of(new FbaAppointmentTransportPort.Move("FBA_APPOINTMENT:2","B","ORDER:2","FBA:ONT8",160,retained,"FBA_APPOINTMENT:4")),"operator","客户明确调整");});
+    }
+    private int remaining(FbaAppointmentTransportPort.Result result) { return result.vehicles().stream().filter(v->"T-1".equals(v.tripNo())).mapToInt(FbaAppointmentTransportPort.Vehicle::packageCount).sum(); }
+    @Test void wholeCustomerExitLeavesOtherCustomers120AndReusesOriginalPhysicalDispatch() {
+        var other=jdbc.queryForList("SELECT * FROM ll_dispatch_appointment_allocation WHERE customer_id<>'B'");
+        var result=move(0);assertEquals(120,remaining(result));
+        assertEquals(other,jdbc.queryForList("SELECT * FROM ll_dispatch_appointment_allocation WHERE customer_id<>'B'"));
+        assertEquals(160,jdbc.queryForObject("SELECT SUM(package_count) FROM ll_dispatch_appointment_allocation WHERE batch_key='FBA_APPOINTMENT:4'",Integer.class));
+        assertEquals(2,jdbc.queryForObject("SELECT COUNT(*) FROM ll_dispatch_item WHERE dispatch_order_id=2",Integer.class));verify(dispatch,never()).removeItem(anyString(),anyLong());
+    }
+    @Test void wholePhysical60MovesOutLeavingOriginalVehicle220AndLaterScopeHasNoSyntheticVehicle() {
+        var result=move(100);assertEquals(220,remaining(result));verify(dispatch).removeItem("D-2",21L);
+        assertEquals(100,jdbc.queryForObject("SELECT package_count FROM ll_dispatch_order WHERE id=2",Integer.class));
+        var later=adapter.inspect(List.of("FBA_APPOINTMENT:4"));assertTrue(later.vehicles().isEmpty());
+        var next=tx.execute(status->{var locked=adapter.lockAndInspect(List.of("FBA_APPOINTMENT:4"),later.version());return adapter.apply(locked,List.of(new FbaAppointmentTransportPort.Move("FBA_APPOINTMENT:4","B","ORDER:2","FBA:ONT8",60,40,"FBA_APPOINTMENT:5")),"operator","后送60分40和20");});
+        assertTrue(next.vehicles().isEmpty());assertEquals(3,jdbc.queryForObject("SELECT COUNT(*) FROM ll_dispatch_item",Integer.class));
+    }
+    @Test void unmatchedPartialQuantityAndStaleScopeNeverMutateOriginalPhysicalRows() {
+        assertThrows(org.springframework.web.server.ResponseStatusException.class,()->move(110));
+        assertEquals(4,jdbc.queryForObject("SELECT COUNT(*) FROM ll_dispatch_item",Integer.class));verify(dispatch,never()).removeItem(anyString(),anyLong());
+        var old=adapter.inspect(List.of("FBA_APPOINTMENT:2"));bump();
+        assertThrows(org.springframework.web.server.ResponseStatusException.class,()->tx.execute(status->adapter.lockAndInspect(List.of("FBA_APPOINTMENT:2"),old.version())));
+    }
+    @Test void downstreamFailureRollsBackUnbindingPhysicalRemovalAndQuantityTogether() {
+        doThrow(new IllegalStateException("原车绑定失败")).when(fleet).bindDispatch(anyString(),anyString(),any());
+        assertThrows(IllegalStateException.class,()->move(100));
+        assertEquals(4,jdbc.queryForObject("SELECT COUNT(*) FROM ll_dispatch_item",Integer.class));
+        assertEquals(160,jdbc.queryForObject("SELECT package_count FROM ll_dispatch_order WHERE id=2",Integer.class));
+        assertEquals(3,jdbc.queryForObject("SELECT COUNT(*) FROM ll_fleet_trip_dispatch",Integer.class));
+        assertEquals(1L,jdbc.queryForObject("SELECT record_version FROM ll_fleet_trip WHERE id=1",Long.class));
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/inventory/command/InventoryCommandServiceTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/inventory/command/InventoryCommandServiceTest.java
index 163039013..a5076986c 100644
--- a/lastleg-service/src/test/java/com/baiyue/lastleg/inventory/command/InventoryCommandServiceTest.java
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/inventory/command/InventoryCommandServiceTest.java
@@ -594,6 +594,35 @@ class InventoryCommandServiceTest {
             "return-1", List.of("FILE-1"));
     }
 
+
+    @Test void discardOnlyConsumesOwnedHoldAndKeepsAvailableStockConserved() {
+        var balance = balance(200L, 7); balance.setHoldPackages(3L);
+        var position = position(201L, 200L, 7); position.setHoldPackages(3L);
+        when(commands.lockPosition("100", 201L)).thenReturn(position);
+        when(commands.lockBalance("100", 200L)).thenReturn(balance);
+        var hold = new InventoryLedger(); hold.setPositionId(201L); hold.setBusinessOrderNo("CD-1"); hold.setDeltaPackages(3L);
+        when(ledgers.orderHoldCycle("100", 101L, "CARGO_DISCARD:1:2")).thenReturn(List.of(hold));
+        when(commands.palletPackages(300L)).thenReturn(7L);
+        service.discardHeld("100", "OP", new InventoryCommandRequests.Move(201L, 3, "CD-1", "OB-1", "CARGO_DISCARD:1:2", "DISCARD-1", null));
+        assertEquals(7L, position.getAvailablePackages()); assertEquals(7L, balance.getAvailablePackages());
+        assertEquals(0L, position.getHoldPackages()); assertEquals(0L, balance.getHoldPackages());
+        var capture = ArgumentCaptor.forClass(InventoryLedger.class); verify(ledgers).insert(capture.capture());
+        assertEquals("DISCARD", capture.getValue().getBusinessType()); assertEquals(-3L, capture.getValue().getDeltaPackages());
+        assertEquals("OB-1", capture.getValue().getOutboundOrderNo());
+        verify(warehouseGateway, never()).scrapPallet(any(), org.mockito.ArgumentMatchers.anyLong());
+    }
+    @Test void foreignDiscardHoldCannotConsumeAnotherApplicationsStock() {
+        var balance = balance(200L, 0); balance.setHoldPackages(3L);
+        var position = position(201L, 200L, 0); position.setHoldPackages(3L);
+        when(commands.lockPosition("100", 201L)).thenReturn(position);
+        when(commands.lockBalance("100", 200L)).thenReturn(balance);
+        var hold = new InventoryLedger(); hold.setPositionId(201L); hold.setBusinessOrderNo("OTHER-CD"); hold.setDeltaPackages(3L);
+        when(ledgers.orderHoldCycle("100", 101L, "CARGO_DISCARD:1:2")).thenReturn(List.of(hold));
+        assertThrows(ResponseStatusException.class, () -> service.discardHeld("100", "OP", new InventoryCommandRequests.Move(201L, 3, "CD-1", null, "CARGO_DISCARD:1:2", "DISCARD-1", null)));
+        assertEquals(3L, position.getHoldPackages());
+        verify(positions, never()).updateById(any(InventoryPosition.class)); verify(ledgers, never()).insert(any(InventoryLedger.class));
+    }
+
     private InventoryBalance balance(Long id, long available) {
         InventoryBalance value = new InventoryBalance();
         value.setId(id); value.setCustomerId("100"); value.setCustomerName("Customer 100");
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/inventory/mapper/InventoryCartonOwnershipTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/inventory/mapper/InventoryCartonOwnershipTest.java
new file mode 100644
index 000000000..ae7a6470c
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/inventory/mapper/InventoryCartonOwnershipTest.java
@@ -0,0 +1,42 @@
+package com.baiyue.lastleg.inventory.mapper;
+
+import org.apache.ibatis.mapping.Environment;
+import org.apache.ibatis.session.Configuration;
+import org.apache.ibatis.session.SqlSessionFactoryBuilder;
+import org.apache.ibatis.transaction.jdbc.JdbcTransactionFactory;
+import org.junit.jupiter.api.Test;
+import org.springframework.jdbc.core.JdbcTemplate;
+import org.springframework.jdbc.datasource.DriverManagerDataSource;
+
+import java.util.UUID;
+import static org.junit.jupiter.api.Assertions.*;
+
+class InventoryCartonOwnershipTest {
+    @Test void realSqlRequiresMatchingCustomerWarehouseAndInboundForEachCarton() {
+        var ds = new DriverManagerDataSource("jdbc:h2:mem:" + UUID.randomUUID() + ";MODE=MySQL;DB_CLOSE_DELAY=-1", "sa", "");
+        var db = new JdbcTemplate(ds);
+        db.execute("CREATE TABLE ll_inbound_plan_carton(order_id BIGINT,customer_id VARCHAR,carton_mark VARCHAR)");
+        db.execute("CREATE TABLE ll_order(id BIGINT,customer_id VARCHAR,inbound_code VARCHAR,overseas_warehouse_id VARCHAR)");
+        db.execute("CREATE TABLE ll_inbound_order(id BIGINT,customer_id VARCHAR,inbound_code VARCHAR)");
+        db.execute("CREATE TABLE ll_warehouse_transfer_order(id BIGINT,customer_id VARCHAR,inbound_order_id BIGINT,operating_warehouse_id VARCHAR)");
+        db.execute("CREATE TABLE ll_warehouse_transfer_carton(transfer_order_id BIGINT,customer_id VARCHAR,carton_mark VARCHAR,customer_carton_mark VARCHAR,status VARCHAR)");
+        db.update("INSERT INTO ll_inbound_order VALUES(1,'C1','IN1'),(2,'C1','IN2')");
+        db.update("INSERT INTO ll_order VALUES(10,'C1','IN1','WH1'),(20,'C1','IN2','WH1')");
+        db.update("INSERT INTO ll_inbound_plan_carton VALUES(10,'C1','BOX1'),(20,'C1','OTHER-ORDER')");
+        db.update("INSERT INTO ll_warehouse_transfer_order VALUES(30,'C1',1,'WH1'),(40,'C2',1,'WH1')");
+        db.update("INSERT INTO ll_warehouse_transfer_carton VALUES(30,'C1','TRANSFER-BOX','CUSTOMER-BOX','COUNTED'),(30,'C1','UNCHECKED','CUSTOMER-UNCHECKED','NOT_RECEIVED'),(40,'C2','OTHER-CUSTOMER',NULL,'COUNTED')");
+        var config = new Configuration(new Environment("test", new JdbcTransactionFactory(), ds));
+        config.addMapper(InventoryBalanceMapper.class);
+        try (var session = new SqlSessionFactoryBuilder().build(config).openSession()) {
+            var mapper = session.getMapper(InventoryBalanceMapper.class);
+            for (String mark : new String[]{"BOX1", "TRANSFER-BOX", "CUSTOMER-BOX"}) {
+                assertTrue(mapper.cartonBelongsToInbound("C1", "WH1", 1L, mark));
+                assertFalse(mapper.cartonBelongsToInbound("C1", "WH2", 1L, mark));
+                assertFalse(mapper.cartonBelongsToInbound("C2", "WH1", 1L, mark));
+                assertFalse(mapper.cartonBelongsToInbound("C1", "WH1", 2L, mark));
+            }
+            for (String mark : new String[]{"MISSING", "OTHER-ORDER", "OTHER-CUSTOMER", "UNCHECKED"})
+                assertFalse(mapper.cartonBelongsToInbound("C1", "WH1", 1L, mark));
+        }
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/mapper/CustomerOrderProgressMapperTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/mapper/CustomerOrderProgressMapperTest.java
index cd2724947..e831aa9de 100644
--- a/lastleg-service/src/test/java/com/baiyue/lastleg/mapper/CustomerOrderProgressMapperTest.java
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/mapper/CustomerOrderProgressMapperTest.java
@@ -38,21 +38,23 @@ class CustomerOrderProgressMapperTest {
         mapper=new SqlSessionTemplate(factory.getObject()).getMapper(CustomerOrderProgressMapper.class);
     }
     @Test void plannedSharedPalletIncludesEveryOwnSourceAndExcludesCancellation() {
-        var sources=mapper.sources("11");assertThat(sources).hasSize(2);
+        var sources=mapper.sources("11", null);assertThat(sources).hasSize(2);
         assertThat(sources.get(0).scheduledPackages()).isEqualTo(10);
         assertThat(sources.get(1).scheduledPackages()).isEqualTo(20);
+        assertThat(mapper.sources("11",java.util.List.of("101"))).containsExactly(sources.get(0));
         assertThat(sources).allMatch(s->s.deliveringPackages()==0);
         jdbc.update("UPDATE ll_dispatch_order SET status='CANCELLED'");
-        assertThat(mapper.sources("11")).allMatch(s->s.scheduledPackages()==0);
-        assertThat(mapper.sources("22")).hasSize(1).allMatch(s->s.scheduledPackages()==0);
+        assertThat(mapper.sources("11", null)).allMatch(s->s.scheduledPackages()==0);
+        assertThat(mapper.sources("22", null)).hasSize(1).allMatch(s->s.scheduledPackages()==0);
     }
     @Test void receivedPalletUsesInventoryAndActualPicksWithoutCountingBothPlanAndStock() {
         jdbc.update("UPDATE ll_dispatch_item SET warehouse_pallet_id=800");
         jdbc.update("INSERT INTO ll_inventory_balance VALUES(300,'11',1),(301,'11',2)");
         jdbc.update("INSERT INTO ll_inventory_position VALUES(400,'11',800,'W1',300,6),(401,'11',800,'W1',301,20)");
         jdbc.update("INSERT INTO ll_dispatch_pda_pick VALUES(600,'11',100,400,4,700)");
-        var sources=mapper.sources("11");assertThat(sources.get(0).scheduledPackages()).isEqualTo(10);
+        var sources=mapper.sources("11", null);assertThat(sources.get(0).scheduledPackages()).isEqualTo(10);
         assertThat(sources.get(1).scheduledPackages()).isEqualTo(20);
+        assertThat(mapper.sources("11",java.util.List.of("101"))).containsExactly(sources.get(0));
     }
     @Test void deliveryRequiresActualDepartureOutboundAndMatchingDestinationAttribution() {
         jdbc.update("INSERT INTO ll_dispatch_pda_task VALUES(700,'11',10)");
@@ -60,15 +62,26 @@ class CustomerOrderProgressMapperTest {
         jdbc.update("INSERT INTO ll_dispatch_pda_pick_order VALUES(900,600,'11',1,4)");
         jdbc.update("INSERT INTO ll_outbound_order VALUES(10000,'11','WAIT_OUTBOUND')");
         jdbc.update("INSERT INTO ll_delivery_order VALUES(10001,'11',10,10000,'DELIVERING','CODE:FBA1')");
-        assertThat(mapper.sources("11")).allMatch(s->s.deliveringPackages()==0);
+        assertThat(mapper.sources("11", null)).allMatch(s->s.deliveringPackages()==0);
         jdbc.update("UPDATE ll_dispatch_order SET status='DEPARTED',depart_at=CURRENT_TIMESTAMP");
-        assertThat(mapper.sources("11")).allMatch(s->s.deliveringPackages()==0);
+        assertThat(mapper.sources("11", null)).allMatch(s->s.deliveringPackages()==0);
         jdbc.update("UPDATE ll_outbound_order SET status='OUTBOUNDED'");
-        assertThat(mapper.sources("11").get(0).deliveringPackages()).isEqualTo(4);
-        assertThat(mapper.sources("11").get(1).deliveringPackages()).isZero();
+        assertThat(mapper.sources("11", null).get(0).deliveringPackages()).isEqualTo(4);
+        assertThat(mapper.sources("11",java.util.List.of("101"))).containsExactly(mapper.sources("11",null).get(0));
+        assertThat(mapper.sources("11", null).get(1).deliveringPackages()).isZero();
         jdbc.update("UPDATE ll_delivery_order SET delivery_group_key='CODE:FBA2'");
-        assertThat(mapper.sources("11")).allMatch(s->s.deliveringPackages()==0);
+        assertThat(mapper.sources("11", null)).allMatch(s->s.deliveringPackages()==0);
         jdbc.update("UPDATE ll_delivery_order SET delivery_group_key='CODE:FBA1',status='RETURN_PENDING'");
-        assertThat(mapper.sources("11")).allMatch(s->s.deliveringPackages()==0);
+        assertThat(mapper.sources("11", null)).allMatch(s->s.deliveringPackages()==0);
     }
+
+    @Test void exactSourceOrderScopePreservesAllOwnInboundFragmentsAndExcludesForeignOrders() {
+        jdbc.update("INSERT INTO ll_order VALUES(4,'11','101','204','FIRSTLEG','FBA',5)");
+        var own=mapper.sources("11",java.util.List.of("101","103"));
+        assertThat(own).extracting(s->s.orderId()).containsExactly("101","101");
+        assertThat(own).extracting(s->s.scheduledPackages()).containsExactly(10L,0L);
+        assertThat(mapper.sources("22",java.util.List.of("101"))).isEmpty();
+        assertThat(mapper.sources("11",java.util.List.of("999"))).isEmpty();
+    }
+
 }
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/palletops/controller/PdaPalletOperationControllerContractTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/palletops/controller/PdaPalletOperationControllerContractTest.java
index c621ded0d..1aa515570 100644
--- a/lastleg-service/src/test/java/com/baiyue/lastleg/palletops/controller/PdaPalletOperationControllerContractTest.java
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/palletops/controller/PdaPalletOperationControllerContractTest.java
@@ -28,7 +28,7 @@ class PdaPalletOperationControllerContractTest {
             .filter(PostMapping.class::isInstance).map(PostMapping.class::cast)
             .flatMap(annotation -> Arrays.stream(annotation.value())).collect(Collectors.toSet());
         assertEquals(Set.of("/pallets/resolve", "/relabel-pallet-label", "/assemble", "/disassemble",
-            "/relabel-disassemble", "/relabel-sources", "/swap", "/unbind"), paths);
+            "/relabel-disassemble", "/relabel-sources", "/relabel-pallet-measure", "/relabel-pallet-measurements", "/swap", "/unbind"), paths);
     }
 
     @Test void palletContentAnnotationUsesNativeGreaterThanOperator() throws Exception {
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/palletops/service/PdaPalletOperationServiceTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/palletops/service/PdaPalletOperationServiceTest.java
index 4f955fe2d..9fbfc5254 100644
--- a/lastleg-service/src/test/java/com/baiyue/lastleg/palletops/service/PdaPalletOperationServiceTest.java
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/palletops/service/PdaPalletOperationServiceTest.java
@@ -75,6 +75,7 @@ class PdaPalletOperationServiceTest {
 
     @BeforeEach void setUp() {
         service = new PdaPalletOperationService();
+        ReflectionTestUtils.setField(service, "cartonMeasurements", org.mockito.Mockito.mock(com.baiyue.lastleg.relabel.service.RelabelCartonMeasurementService.class));
         ReflectionTestUtils.setField(service, "mapper", mapper);
         ReflectionTestUtils.setField(service, "inventoryCommands", inventoryCommands);
         ReflectionTestUtils.setField(service, "positions", positions);
@@ -92,6 +93,88 @@ class PdaPalletOperationServiceTest {
         service.configureTransactions(new NoOpTransactionManager());
     }
 
+    @Test void returnPalletTotalsFollowCurrentBindingsWithoutCountingRetriesTwice() {
+        var first = new ReturnInventoryCarton(); first.setWeight(new java.math.BigDecimal("5"));
+        first.setLength(new java.math.BigDecimal("30")); first.setWidth(new java.math.BigDecimal("20"));
+        first.setHeight(new java.math.BigDecimal("20")); first.setDestinationWarehouseCode("SCK8");
+        var second = new ReturnInventoryCarton(); second.setWeight(new java.math.BigDecimal("11"));
+        second.setLength(new java.math.BigDecimal("40")); second.setWidth(new java.math.BigDecimal("30"));
+        second.setHeight(new java.math.BigDecimal("30")); second.setDestinationWarehouseCode("SCK8");
+        var pallet = new PalletPhysicalGateway.PalletReference(10L, "TARGET", 88L, null, "OCCUPIED", "SCK8", 2);
+        when(returnCartons.palletCartons("88", "TARGET")).thenReturn(List.of(first), List.of(first, second), List.of(first, second), List.of(first));
+        var before = (com.baiyue.lastleg.palletops.dto.PalletOperationResponses.PalletContent) ReflectionTestUtils.invokeMethod(service, "content", 88L, pallet);
+        assertEquals(0, before.grossWeightKg().compareTo(new java.math.BigDecimal("5")));
+        var added = (com.baiyue.lastleg.palletops.dto.PalletOperationResponses.PalletContent) ReflectionTestUtils.invokeMethod(service, "content", 88L, pallet);
+        assertEquals(2, added.totalPackages());
+        assertEquals(0, added.grossWeightKg().compareTo(new java.math.BigDecimal("16")));
+        assertEquals(0, added.volumeCbm().compareTo(new java.math.BigDecimal("0.048")));
+        assertEquals(added, ReflectionTestUtils.invokeMethod(service, "content", 88L, pallet));
+        assertEquals(before, ReflectionTestUtils.invokeMethod(service, "content", 88L, pallet));
+    }
+
+    @Test void returnRebindingRequiresCurrentRoundBindingAndAddsToExistingPallet() {
+        var workTasks = mock(com.baiyue.lastleg.relabel.pda.mapper.PdaRelabelTaskMapper.class);
+        var workHistory = mock(com.baiyue.lastleg.relabel.pda.mapper.PdaRelabelHistoryMapper.class);
+        ReflectionTestUtils.setField(service, "relabelWorkTasks", workTasks);
+        ReflectionTestUtils.setField(service, "relabelWorkHistory", workHistory);
+        var app = new RelabelApplication(); app.setId(600L); app.setCustomerId("100");
+        var task = new com.baiyue.lastleg.relabel.pda.entity.PdaRelabelTask(); task.setId(700L);
+        when(workTasks.find("100", 600L)).thenReturn(task);
+        var item = new RelabelItem(); item.setReturnCartonId(801L); item.setCartonMark("BOX-1");
+        item.setDestinationFbaWarehouseCode("SCK8"); item.setNotifiedPackageCount(1);
+        var box = new ReturnInventoryCarton(); box.setId(801L); box.setCustomerId("100");
+        box.setPalletCode("SOURCE"); box.setRelabelApplicationId(600L); box.setStatus("RELABEL_PENDING");
+        box.setTotalQuantity(10L); box.setWeight(new java.math.BigDecimal("11"));
+        box.setLength(new java.math.BigDecimal("40")); box.setWidth(new java.math.BigDecimal("30"));
+        box.setHeight(new java.math.BigDecimal("30")); box.setDestinationWarehouseCode("SCK8");
+        var existing = new ReturnInventoryCarton(); existing.setWeight(new java.math.BigDecimal("5"));
+        existing.setLength(new java.math.BigDecimal("30")); existing.setWidth(new java.math.BigDecimal("20"));
+        existing.setHeight(new java.math.BigDecimal("20")); existing.setDestinationWarehouseCode("SCK8");
+        var source = new PalletPhysicalGateway.PalletReference(20L, "SOURCE", 88L, 1020L, "OCCUPIED", "SCK8", 1);
+        var target = new PalletPhysicalGateway.PalletReference(10L, "TARGET", 88L, 1010L, "OCCUPIED", "SCK8", 2);
+        when(returnCartons.lockId(801L)).thenReturn(box);
+        when(returnCartons.palletCartons("88", "TARGET")).thenAnswer(call ->
+            "TARGET".equals(box.getPalletCode()) ? List.of(existing, box) : List.of(existing));
+        var request = new PalletOperationRequests.RelabelDisassemble("rebind-current", "RL-1",
+            new PalletOperationRequests.PalletExpectation("SOURCE", 1),
+            new PalletOperationRequests.PalletExpectation("TARGET", 2), List.of("BOX-1"), "rebind");
+        assertThrows(ResponseStatusException.class, () -> ReflectionTestUtils.invokeMethod(service,
+            "bindReturnRelabelPallet", identity(), app, List.of(item), source, target, request, false));
+        verifyNoInteractions(physical);
+        var binding = new com.baiyue.lastleg.relabel.pda.entity.PdaRelabelHistory();
+        binding.setDetailJson("{\"round\":\"INITIAL\",\"cartonMarks\":[\"BOX-1\"]}");
+        when(workHistory.selectList(any())).thenReturn(List.of(binding));
+        task.setReviewedAt(LocalDateTime.of(2026, 10, 12, 12, 0));
+        assertThrows(ResponseStatusException.class, () -> ReflectionTestUtils.invokeMethod(service,
+            "bindReturnRelabelPallet", identity(), app, List.of(item), source, target, request, false));
+        task.setReviewedAt(null);
+        when(physical.resolveLocation(88L, 1020L)).thenReturn(
+            new PalletPhysicalGateway.LocationReference(1020L, "SOURCE-LOC", "STORAGE", "ACTIVE"));
+        when(physical.resolveLocation(88L, 1010L)).thenReturn(
+            new PalletPhysicalGateway.LocationReference(1010L, "TARGET-LOC", "STORAGE", "ACTIVE"));
+        when(physical.resolve("SOURCE")).thenReturn(source);
+        when(physical.resolve("TARGET")).thenReturn(target);
+        var result = (com.baiyue.lastleg.palletops.dto.PalletOperationResponses.Operation)
+            ReflectionTestUtils.invokeMethod(service, "bindReturnRelabelPallet", identity(), app,
+                List.of(item), source, target, request, false);
+        assertEquals("TARGET", box.getPalletCode());
+        assertEquals(0, result.pallets().get(0).totalPackages());
+        assertEquals(2, result.pallets().get(1).totalPackages());
+        assertEquals(0, result.pallets().get(1).grossWeightKg().compareTo(new java.math.BigDecimal("16")));
+        assertEquals(0, result.pallets().get(1).volumeCbm().compareTo(new java.math.BigDecimal("0.048")));
+        verify(returnCartons).updateById(box);
+        verify(workHistory).insert(any(com.baiyue.lastleg.relabel.pda.entity.PdaRelabelHistory.class));
+    }
+
+    @Test void missingCartonMeasurementDoesNotBecomeZeroWeight() {
+        var box = new ReturnInventoryCarton(); box.setWeight(new java.math.BigDecimal("5"));
+        when(returnCartons.palletCartons("88", "TARGET")).thenReturn(List.of(box));
+        var pallet = new PalletPhysicalGateway.PalletReference(10L, "TARGET", 88L, null, "OCCUPIED", "SCK8", 2);
+        var result = (com.baiyue.lastleg.palletops.dto.PalletOperationResponses.PalletContent) ReflectionTestUtils.invokeMethod(service, "content", 88L, pallet);
+        assertNull(result.volumeCbm());
+        assertEquals(0, result.grossWeightKg().compareTo(new java.math.BigDecimal("5")));
+    }
+
     @Test void partialReturnRelabelKeepsUnlabelledRemainderOnOriginalPallet() {
         RelabelApplication app = new RelabelApplication(); app.setId(600L); app.setCustomerId("100"); app.setRelabelNo("RL-1");
         RelabelItem item = new RelabelItem(); item.setId(701L); item.setSkuCode("SKU-1");
@@ -502,6 +585,35 @@ class PdaPalletOperationServiceTest {
         assertThrows(ResponseStatusException.class, () -> service.createRelabelPallet(identity(), new PalletOperationRequests.NewRelabelPallet("RL-1", "different")));
     }
 
+    @Test void wholeRelabelCanRetainOriginalPalletWithoutMovingStockAndPartialCannot() {
+        var tasks = mock(com.baiyue.lastleg.relabel.pda.mapper.PdaRelabelTaskMapper.class);
+        var histories = mock(com.baiyue.lastleg.relabel.pda.mapper.PdaRelabelHistoryMapper.class);
+        ReflectionTestUtils.setField(service,"relabelWorkTasks",tasks); ReflectionTestUtils.setField(service,"relabelWorkHistory",histories);
+        var app = new RelabelApplication();app.setId(600L);app.setCustomerId("100");app.setRelabelNo("RL-1");
+        app.setOverseasWarehouseId("88");app.setStatus("READY_FOR_OUTBOUND");app.setFulfillmentStatus("WAIT_PRE_DISPATCH");
+        when(relabelApplications.findAnyByRelabelNo("RL-1")).thenReturn(app);
+        when(relabelApplications.lockAnyByRelabelNo("RL-1")).thenReturn(app);
+        var task = new com.baiyue.lastleg.relabel.pda.entity.PdaRelabelTask();task.setId(900L);task.setStatus("COMPLETED");
+        when(tasks.find("100",600L)).thenReturn(task);
+        var item = relabelItem(701L,"CARTON-A",100L);
+        when(relabelItems.selectList(any())).thenReturn(List.of(item));
+        when(relabelApplications.selectById(600L)).thenReturn(app);
+        when(physical.resolve("SOURCE")).thenReturn(pallet(10L,"SOURCE",88L,0));
+        when(physical.resolveLocation(88L,1010L)).thenReturn(new PalletPhysicalGateway.LocationReference(1010L,"LOC-1010","STORAGE","ACTIVE"));
+        var position = position(100L,10L,"SOURCE",1,0);when(positions.selectById(100L)).thenReturn(position);
+        var row = row(100L,10L,0,0);row.setHoldPackages(1L);
+        when(mapper.lockPosition("88",100L)).thenReturn(row);when(mapper.content("88",10L)).thenReturn(List.of(row));
+        when(mapper.palletPackages("88",10L)).thenReturn(1L);
+        var request = new PalletOperationRequests.RelabelDisassemble("retain-1","RL-1",
+            new PalletOperationRequests.PalletExpectation("SOURCE",0),new PalletOperationRequests.PalletExpectation("SOURCE",0),List.of("CARTON-A"),"整托贴标");
+        var result = service.relabelDisassemble(identity(),request);
+        assertEquals("COMPLETED",result.status()); assertEquals(1,result.pallets().size());
+        verify(positions,never()).updateById(any(InventoryPosition.class)); verifyNoInteractions(relabelPalletMutations,ledgers);
+        verify(histories).insert(any(com.baiyue.lastleg.relabel.pda.entity.PdaRelabelHistory.class));
+        when(mapper.palletPackages("88",10L)).thenReturn(2L);
+        assertTrue(assertThrows(ResponseStatusException.class,() -> service.relabelDisassemble(identity(),request)).getReason().contains("部分贴标"));
+    }
+
     private static PdaWarehouseIdentity identity() { return new PdaWarehouseIdentity("7", "picker", 88L); }
     private static PalletPhysicalGateway.PalletReference pallet(long id, String code, long warehouse, int version) {
         return new PalletPhysicalGateway.PalletReference(id, code, warehouse, 1000L + id,
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/relabel/RelabelMilestonesPersistenceTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/relabel/RelabelMilestonesPersistenceTest.java
new file mode 100644
index 000000000..5fbb256a8
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/relabel/RelabelMilestonesPersistenceTest.java
@@ -0,0 +1,97 @@
+package com.baiyue.lastleg.relabel;
+
+import com.baomidou.mybatisplus.core.MybatisConfiguration;
+import com.baomidou.mybatisplus.extension.spring.MybatisSqlSessionFactoryBean;
+import com.baiyue.lastleg.relabel.mapper.RelabelApplicationMapper;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.mybatis.spring.SqlSessionTemplate;
+import org.springframework.jdbc.core.JdbcTemplate;
+import org.springframework.jdbc.datasource.DriverManagerDataSource;
+
+import java.time.LocalDateTime;
+import java.util.UUID;
+
+import static org.junit.jupiter.api.Assertions.*;
+
+class RelabelMilestonesPersistenceTest {
+    JdbcTemplate jdbc;
+    RelabelApplicationMapper mapper;
+    final LocalDateTime review = LocalDateTime.of(2026, 10, 12, 10, 0);
+    final LocalDateTime completion = review.plusHours(1);
+    final LocalDateTime outbound = review.plusHours(2);
+
+    @BeforeEach void setup() throws Exception {
+        var ds = new DriverManagerDataSource("jdbc:h2:mem:" + UUID.randomUUID() + ";MODE=MySQL", "sa", "");
+        // Keep the in-memory database alive across mapper connections.
+        ds.setUrl(ds.getUrl() + ";DB_CLOSE_DELAY=-1");
+        jdbc = new JdbcTemplate(ds);
+        jdbc.execute("CREATE TABLE ll_relabel_application(id BIGINT, customer_id VARCHAR(128), status VARCHAR(32), relabel_no VARCHAR(64), outbound_order_no VARCHAR(64))");
+        jdbc.execute("CREATE TABLE ll_relabel_status_history(customer_id VARCHAR(128), application_id BIGINT, from_status VARCHAR(32), to_status VARCHAR(32), created_at TIMESTAMP)");
+        jdbc.execute("CREATE TABLE ll_relabel_pda_task(customer_id VARCHAR(128), application_id BIGINT, submitted_at TIMESTAMP)");
+        jdbc.execute("CREATE TABLE ll_outbound_order(id BIGINT, customer_id VARCHAR(128), outbound_no VARCHAR(64), status VARCHAR(32))");
+        jdbc.execute("CREATE TABLE ll_outbound_pda_task(customer_id VARCHAR(128), outbound_order_id BIGINT, completed_at TIMESTAMP, status VARCHAR(32))");
+        jdbc.execute("CREATE TABLE ll_warehouse_transfer_order(customer_id VARCHAR(128), relabel_application_id BIGINT, relabel_no VARCHAR(64), outbound_at TIMESTAMP)");
+        var config = new MybatisConfiguration();
+        config.setMapUnderscoreToCamelCase(true);
+        config.addMapper(RelabelApplicationMapper.class);
+        var factory = new MybatisSqlSessionFactoryBean();
+        factory.setDataSource(ds); factory.setConfiguration(config);
+        mapper = new SqlSessionTemplate(factory.getObject()).getMapper(RelabelApplicationMapper.class);
+        jdbc.update("INSERT INTO ll_relabel_application VALUES (1,'C','PENDING_REVIEW','RL-1',NULL)");
+    }
+
+    void history(String from, String to, LocalDateTime at) {
+        jdbc.update("INSERT INTO ll_relabel_status_history VALUES ('C',1,?,?,?)", from, to, at);
+    }
+
+    @Test void historicalCompletedApplicationUsesActualFactsAndCustomerScope() {
+        history("PENDING_REVIEW", "PENDING_PROCESSING", review);
+        history("PROCESSING", "CUSTOMER_CONFIRM_PENDING", completion.plusMinutes(1));
+        history("READY_FOR_OUTBOUND", "COMPLETED", outbound.plusMinutes(1));
+        jdbc.update("INSERT INTO ll_relabel_pda_task VALUES ('C',1,?)", completion);
+        jdbc.update("UPDATE ll_relabel_application SET status='COMPLETED', outbound_order_no='OB-1'");
+        jdbc.update("INSERT INTO ll_outbound_order VALUES (2,'C','OB-1','OUTBOUNDED')");
+        jdbc.update("INSERT INTO ll_outbound_pda_task VALUES ('C',2,?,'COMPLETED')", outbound);
+        jdbc.update("INSERT INTO ll_relabel_status_history VALUES ('OTHER',1,'PENDING_REVIEW','PENDING_PROCESSING',?)", outbound);
+        var result = mapper.findMilestones("C", 1L);
+        assertEquals(review, result.reviewedAt());
+        assertEquals(completion, result.relabelCompletedAt());
+        assertEquals(outbound, result.outboundAt());
+        assertNull(mapper.findMilestones("OTHER", 1L));
+    }
+
+    @Test void pendingAndReworkDoNotInventCompletion() {
+        var pending = mapper.findMilestones("C", 1L);
+        // MyBatis returns null for a projection whose columns are all null; the service handles it.
+        assertNull(pending);
+        history("PENDING_REVIEW", "PENDING_PROCESSING", review);
+        history("PROCESSING", "CUSTOMER_CONFIRM_PENDING", completion);
+        jdbc.update("INSERT INTO ll_relabel_pda_task VALUES ('C',1,?)", completion);
+        jdbc.update("UPDATE ll_relabel_application SET status='PROCESSING'");
+        var rework = mapper.findMilestones("C", 1L);
+        assertEquals(review, rework.reviewedAt());
+        assertNull(rework.relabelCompletedAt()); assertNull(rework.outboundAt());
+    }
+
+    @Test void skuOnlyCompletionIsNotOutboundAndResubmissionUsesLatestReview() {
+        history("PENDING_REVIEW", "REJECTED", review.minusHours(1));
+        history("PENDING_REVIEW", "PENDING_PROCESSING", review);
+        history("PROCESSING", "CUSTOMER_CONFIRM_PENDING", completion);
+        history("CUSTOMER_CONFIRM_PENDING", "COMPLETED", completion.plusMinutes(5));
+        jdbc.update("UPDATE ll_relabel_application SET status='COMPLETED'");
+        var result = mapper.findMilestones("C", 1L);
+        assertEquals(review, result.reviewedAt()); assertEquals(completion, result.relabelCompletedAt());
+        assertNull(result.outboundAt());
+    }
+
+    @Test void truckDepartureAndLinkedTransferUseOutboundFacts() {
+        history("READY_FOR_OUTBOUND", "COMPLETED", outbound);
+        jdbc.update("UPDATE ll_relabel_application SET status='COMPLETED'");
+        assertEquals(outbound, mapper.findMilestones("C", 1L).outboundAt());
+        jdbc.update("DELETE FROM ll_relabel_status_history");
+        jdbc.update("UPDATE ll_relabel_application SET status='READY_FOR_OUTBOUND'");
+        jdbc.update("INSERT INTO ll_warehouse_transfer_order VALUES ('C',1,'RL-1',?)", outbound);
+        assertEquals(outbound, mapper.findMilestones("C", 1L).outboundAt());
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/relabel/controller/MerchantRelabelApplicationControllerTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/relabel/controller/MerchantRelabelApplicationControllerTest.java
index dce3a6aab..ff534bcb6 100644
--- a/lastleg-service/src/test/java/com/baiyue/lastleg/relabel/controller/MerchantRelabelApplicationControllerTest.java
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/relabel/controller/MerchantRelabelApplicationControllerTest.java
@@ -34,6 +34,20 @@ class MerchantRelabelApplicationControllerTest {
             () -> controller.page(user(0L, "PLATFORM"), query));
     }
 
+    /** 下载必须使用登录客户，且响应禁止缓存。 */
+    @Test
+    void documentDownloadUsesAuthenticatedCustomerAndRejectsPlatform() {
+        org.mockito.Mockito.when(service.downloadFile("100", "RL001", "SKU_TOTAL", null, 99L))
+            .thenReturn(new com.baiyue.lastleg.relabel.gateway.RelabelDocumentFileGateway.DownloadedFile(
+                "%PDF-1.7".getBytes(), "SKU标签.pdf", "application/pdf"));
+        var result = controller.downloadFile(user(100L, "MERCHANT"), "RL001", 99L, "SKU_TOTAL", null);
+        verify(service).downloadFile("100", "RL001", "SKU_TOTAL", null, 99L);
+        org.junit.jupiter.api.Assertions.assertEquals("no-store", result.getHeaders().getCacheControl());
+        org.junit.jupiter.api.Assertions.assertEquals("application/pdf", result.getHeaders().getContentType().toString());
+        assertThrows(ResponseStatusException.class,
+            () -> controller.downloadFile(user(0L, "PLATFORM"), "RL001", 99L, "SKU_TOTAL", null));
+    }
+
     private static AuthenticatedUser user(long tenantId, String appCode) {
         return new AuthenticatedUser(1L, tenantId, tenantId, 9L, "merchant", appCode, "WEB", Set.of());
     }
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/relabel/controller/RelabelApplicationControllerTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/relabel/controller/RelabelApplicationControllerTest.java
index 7ecff3482..987cdb4d5 100644
--- a/lastleg-service/src/test/java/com/baiyue/lastleg/relabel/controller/RelabelApplicationControllerTest.java
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/relabel/controller/RelabelApplicationControllerTest.java
@@ -61,6 +61,18 @@ class RelabelApplicationControllerTest {
         org.junit.jupiter.api.Assertions.assertEquals("application/pdf", response.getHeaders().getContentType().toString());
     }
 
+    /** 平台面单下载按申请解析客户，避免任意文件读取。 */
+    @Test
+    void shippingLabelDownloadUsesApplicationCustomer() {
+        org.mockito.Mockito.when(service.customerId("RL-1")).thenReturn("101");
+        org.mockito.Mockito.when(service.downloadShippingLabel("101", "RL-1", 88L))
+            .thenReturn(new com.baiyue.lastleg.relabel.gateway.RelabelDocumentFileGateway.DownloadedFile(
+                "%PDF-1.7".getBytes(), "shipping.pdf", "application/pdf"));
+        var response = controller.downloadShippingLabel(platform(), "RL-1", 88L);
+        verify(service).downloadShippingLabel("101", "RL-1", 88L);
+        org.junit.jupiter.api.Assertions.assertEquals("no-store", response.getHeaders().getCacheControl());
+    }
+
     private RelabelRequests.Create request() {
         return new RelabelRequests.Create("CUSTOMER-1", "WH-1",
             LocalDateTime.of(2026, 8, 20, 10, 0), "Li", "13800000000", null, null, "key-1",
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/relabel/pda/service/PdaRelabelServiceTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/relabel/pda/service/PdaRelabelServiceTest.java
index e325d8e1d..0b27bde80 100644
--- a/lastleg-service/src/test/java/com/baiyue/lastleg/relabel/pda/service/PdaRelabelServiceTest.java
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/relabel/pda/service/PdaRelabelServiceTest.java
@@ -44,6 +44,20 @@ import static org.mockito.Mockito.when;
 
 @ExtendWith(MockitoExtension.class)
 class PdaRelabelServiceTest {
+    @org.junit.jupiter.params.ParameterizedTest
+    @org.junit.jupiter.params.provider.ValueSource(strings = {"PICKUP", "EXPRESS", "TRUCK", "AMAZON_PICKUP", "CUSTOMER_PICKUP"})
+    void bindingRequirementDistinguishesOrdinaryInventoryFromDirectReturnCartons(String deliveryMethod) {
+        application.setDeliveryMethod(deliveryMethod); item.setOperationType("CARTON_LABEL");
+        when(applications.findAnyByRelabelNo("FBR-1")).thenReturn(application);
+        assertTrue(service.detail("7", 900L, "FBR-1").requiresPalletBinding());
+        var cartons = org.mockito.Mockito.mock(com.baiyue.lastleg.returnreceipt.mapper.ReturnInventoryCartonMapper.class);
+        ReflectionTestUtils.setField(service, "returnCartons", cartons);
+        item.setReturnCartonId(40L);
+        assertEquals("TRUCK".equals(deliveryMethod), service.detail("7", 900L, "FBR-1").requiresPalletBinding());
+        application.setDeliveryMethod(null); item.setOperationType("SKU_LABEL");
+        assertEquals(false, service.detail("7", 900L, "FBR-1").requiresPalletBinding());
+    }
+
     @Mock RelabelApplicationMapper applications;
     @Mock RelabelItemMapper items;
     @Mock PdaRelabelTaskMapper tasks;
@@ -52,6 +66,8 @@ class PdaRelabelServiceTest {
     @Mock PdaRelabelHistoryMapper histories;
     @Mock RelabelApplicationService applicationService;
     @Mock RelabelPhotoFileGateway photoFiles;
+    @Mock com.baiyue.lastleg.relabel.service.ReturnSkuConversionService skuConversions;
+    @Mock com.baiyue.lastleg.relabel.service.RelabelPalletMeasurementService palletMeasurements;
     PdaRelabelService service;
     RelabelApplication application;
     RelabelItem item;
@@ -60,6 +76,8 @@ class PdaRelabelServiceTest {
     @BeforeEach
     void setUp() {
         service = new PdaRelabelService();
+        ReflectionTestUtils.setField(service, "skuConversions", skuConversions);
+        ReflectionTestUtils.setField(service, "palletMeasurements", palletMeasurements);
         ReflectionTestUtils.setField(service, "applications", applications);
         ReflectionTestUtils.setField(service, "bindingGuard", org.mockito.Mockito.mock(com.baiyue.lastleg.relabel.service.RelabelBindingGuard.class));
         ReflectionTestUtils.setField(service, "items", items);
@@ -82,6 +100,31 @@ class PdaRelabelServiceTest {
         lenient().when(tasks.updateWithVersion(any(), anyInt())).thenReturn(1);
     }
 
+    @Test
+    void detailDistinguishesInventoryReferenceFromRecordedReturnPallet() {
+        when(applications.findAnyByRelabelNo("FBR-1")).thenReturn(application);
+        var positions = org.mockito.Mockito.mock(com.baiyue.lastleg.inventory.mapper.InventoryPositionMapper.class);
+        ReflectionTestUtils.setField(service, "sourcePositions", positions);
+        item.setSourceInventoryPositionId(30L);
+        var position = new com.baiyue.lastleg.inventory.entity.InventoryPosition();
+        position.setPalletNo("PLT-REFERENCE");
+        when(positions.findTenantPosition("100", 30L)).thenReturn(position);
+        var ordinary = service.detail("7", 900L, "FBR-1").items().get(0);
+        assertEquals("PLT-REFERENCE", ordinary.sourcePalletCode());
+        assertEquals("INVENTORY_REFERENCE", ordinary.sourcePalletBasis());
+        var cartons = org.mockito.Mockito.mock(com.baiyue.lastleg.returnreceipt.mapper.ReturnInventoryCartonMapper.class);
+        ReflectionTestUtils.setField(service, "returnCartons", cartons);
+        item.setReturnCartonId(40L);
+        var carton = new com.baiyue.lastleg.returnreceipt.entity.ReturnInventoryCarton();
+        carton.setCustomerId("100"); carton.setPalletCode("PLT-RETURN"); carton.setTotalQuantity(20L);
+        when(cartons.selectById(40L)).thenReturn(carton);
+        var returned = service.detail("7", 900L, "FBR-1").items().get(0);
+        assertEquals("PLT-RETURN", returned.sourcePalletCode());
+        assertEquals("RETURN_CARTON", returned.sourcePalletBasis());
+        carton.setCustomerId("OTHER");
+        assertEquals(null, service.detail("7", 900L, "FBR-1").items().get(0).sourcePalletCode());
+    }
+
     @Test
     void candidatesUseCustomerNameOnlyFromMatchingCustomerOrder() {
         var orders = org.mockito.Mockito.mock(com.baiyue.lastleg.mapper.LastlegOrderMapper.class);
@@ -250,12 +293,23 @@ class PdaRelabelServiceTest {
     }
 
     @org.junit.jupiter.params.ParameterizedTest
-    @org.junit.jupiter.params.provider.ValueSource(strings = {"SKU_LABEL", "CARTON_AND_SKU"})
+    @org.junit.jupiter.params.provider.ValueSource(strings = {"SKU_LABEL", "CARTON_AND_SKU", "RETURN_SKU_LABEL", "RETURN_CARTON_AND_SKU"})
     void oldSkuOnlyScanPersistsEachRowAndCompletesBoxOnlyWhenRequiredStagesFinish(String type) {
+        boolean returnParcel = type.startsWith("RETURN_");
+        type = type.replace("RETURN_", "");
         application.setStatus("PROCESSING");
         item.setOperationType(type); item.setCartonMark("BOX-1"); item.setFbaCartonMark("FBA-1");
         item.setNotifiedPackageCount(1);
         item.setSkuRelabelItemsJson("[{\"skuCode\":\"OLD-A\",\"newSkuCode\":\"NEW-A\",\"quantity\":3},{\"skuCode\":\"OLD-B\",\"newSkuCode\":\"NEW-B\",\"quantity\":2}]");
+        if (returnParcel) {
+            item.setReturnCartonId(20L);
+            var cartons = org.mockito.Mockito.mock(com.baiyue.lastleg.returnreceipt.mapper.ReturnInventoryCartonMapper.class);
+            ReflectionTestUtils.setField(service, "returnCartons", cartons);
+            var parcel = new com.baiyue.lastleg.returnreceipt.entity.ReturnInventoryCarton();
+            parcel.setId(20L); parcel.setCustomerId("100"); parcel.setSourceUnitType("PARCEL");
+            parcel.setCountStatus("CONFIRMED"); parcel.setTotalQuantity(5L);
+            when(cartons.selectById(20L)).thenReturn(parcel);
+        }
         var task = task("PROCESSING", 0);
         var saved = new ArrayList<com.baiyue.lastleg.relabel.pda.entity.PdaRelabelHistory>();
         when(histories.selectList(any())).thenAnswer(call -> List.copyOf(saved));
@@ -264,12 +318,12 @@ class PdaRelabelServiceTest {
         lenient().when(applications.findAnyByRelabelNo("FBR-1")).thenReturn(application);
         when(tasks.lock("100", 1L)).thenReturn(task);
         when(items.selectOne(any())).thenReturn(item);
-        var first = service.scanSku("7", "picker", 900L, "FBR-1", new PdaRelabelRequests.SkuScan(10L, 0, "OLD-A", 0, "sku-a"));
+        var first = service.scanSku("7", "picker", 900L, "FBR-1", new PdaRelabelRequests.SkuScan(10L, 0, "OLD-A", 0, "sku-a", "BOX-1", "NEW-A", 3));
         assertEquals(0, first.relabelledPackages()); assertEquals(1, first.version());
         assertTrue(saved.stream().anyMatch(entry -> "SKU_SCAN".equals(entry.getAction()) && entry.getDetailJson().contains("NEW-A")));
         assertThrows(ResponseStatusException.class, () -> service.scanSku("7", "picker", 900L, "FBR-1", new PdaRelabelRequests.SkuScan(10L, 0, "OLD-A", 1, "duplicate")));
         assertThrows(ResponseStatusException.class, () -> service.scanSku("7", "picker", 900L, "FBR-1", new PdaRelabelRequests.SkuScan(10L, 1, "WRONG", 1, "wrong")));
-        var second = service.scanSku("7", "picker", 900L, "FBR-1", new PdaRelabelRequests.SkuScan(10L, 1, "OLD-B", 1, "sku-b"));
+        var second = service.scanSku("7", "picker", 900L, "FBR-1", new PdaRelabelRequests.SkuScan(10L, 1, "OLD-B", 1, "sku-b", "BOX-1", "NEW-B", 2));
         assertEquals(1, second.items().get(0).skuProcessedPackages());
         if ("CARTON_AND_SKU".equals(type)) {
             assertEquals(0, second.relabelledPackages());
@@ -308,7 +362,7 @@ class PdaRelabelServiceTest {
     }
 
     @Test
-    void returnSkuTotalCompletesOneSkuOnceAndAllocatesAcrossSourcePalletItems() {
+    void returnSkuTotalRejectsAutomaticAllocationAcrossSourceCartons() {
         application.setStatus("PROCESSING"); application.setNotifiedPackageCount(100);
         item.setOperationType("RETURN_BULK_SKU_LABEL"); item.setSkuCode("sku-fba100");
         item.setNotifiedPackageCount(50); item.setCartonMark("PALLET-A");
@@ -319,15 +373,42 @@ class PdaRelabelServiceTest {
         when(tasks.lock("100", 1L)).thenReturn(task);
         when(items.selectList(any())).thenReturn(List.of(item, second));
 
-        var result = service.completeReturnSkuTotal("7", "picker", 900L, "FBR-1",
-            new PdaRelabelRequests.BulkSkuTotal("sku-fba100", 100, 0, "sku-total-1"));
+        assertThrows(ResponseStatusException.class, () -> service.completeReturnSkuTotal("7", "picker", 900L, "FBR-1",
+            new PdaRelabelRequests.BulkSkuTotal("sku-fba100", 100, 0, "sku-total-1")));
+        assertTrue(persistedFacts.isEmpty());
+    }
 
-        assertEquals(100, result.relabelledPackages());
-        assertEquals(2, persistedFacts.size());
-        assertEquals(List.of(50, 50), persistedFacts.stream().map(PdaRelabelUnitFact::getQuantity).toList());
-        assertEquals(List.of(10L, 11L), persistedFacts.stream().map(PdaRelabelUnitFact::getItemId).toList());
+    @Test void returnSkuScanRequiresPhysicalSourceNewSkuAndApprovedQuantity() {
+        application.setStatus("PROCESSING"); application.setDeliveryMethod("EXPRESS");
+        item.setOperationType("SKU_LABEL"); item.setReturnCartonId(20L); item.setCartonMark("PARCEL-A");
+        item.setNotifiedPackageCount(1);
+        item.setSkuRelabelItemsJson("[{\"skuCode\":\"OLD\",\"newSkuCode\":\"NEW\",\"quantity\":3}]");
+        var cartons = org.mockito.Mockito.mock(com.baiyue.lastleg.returnreceipt.mapper.ReturnInventoryCartonMapper.class);
+        ReflectionTestUtils.setField(service, "returnCartons", cartons);
+        var carton = new com.baiyue.lastleg.returnreceipt.entity.ReturnInventoryCarton();
+        carton.setId(20L); carton.setCountStatus("CONFIRMED"); carton.setTotalQuantity(10L);
+        when(cartons.selectById(20L)).thenReturn(carton);
+        when(applications.lockAnyByRelabelNo("FBR-1")).thenReturn(application);
+        when(tasks.lock("100", 1L)).thenReturn(task("PROCESSING", 0));
+        when(items.selectOne(any())).thenReturn(item);
+        assertThrows(ResponseStatusException.class, () -> service.scanSku("7", "picker", 900L, "FBR-1",
+            new PdaRelabelRequests.SkuScan(10L, 0, "OLD", 0, "wrong-source", "PARCEL-B", "NEW", 3)));
+        assertThrows(ResponseStatusException.class, () -> service.scanSku("7", "picker", 900L, "FBR-1",
+            new PdaRelabelRequests.SkuScan(10L, 0, "OLD", 0, "wrong-quantity", "PARCEL-A", "NEW", 2)));
+        assertTrue(persistedFacts.isEmpty());
+        var result = service.scanSku("7", "picker", 900L, "FBR-1",
+            new PdaRelabelRequests.SkuScan(10L, 0, "OLD", 0, "good", "PARCEL-A", "NEW", 3));
+        assertEquals(1, result.relabelledPackages()); assertEquals("EXPRESS", result.deliveryMethod());
+        assertEquals(false, result.requiresPalletBinding()); assertEquals(10, result.items().get(0).returnQuantity());
+        var second = item(); second.setId(11L); second.setReturnCartonId(20L); second.setCartonMark("PARCEL-A");
+        second.setOperationType("SKU_LABEL"); second.setNotifiedPackageCount(1);
+        second.setSkuRelabelItemsJson(item.getSkuRelabelItemsJson());
+        when(items.selectList(any())).thenReturn(List.of(item, second));
+        when(items.selectOne(any())).thenReturn(second);
+        var again = service.scanSku("7", "picker", 900L, "FBR-1",
+            new PdaRelabelRequests.SkuScan(11L, 0, "OLD", 1, "same-merged-box", "PARCEL-A", "NEW", 3));
+        assertEquals(2, again.relabelledPackages());
         assertTrue(persistedFacts.stream().allMatch(fact -> fact.getOldLabel() == null));
-        assertEquals(1, result.version());
     }
 
     @Test
@@ -387,11 +468,44 @@ class PdaRelabelServiceTest {
             new PdaRelabelRequests.Complete(List.of(501L), 1, "complete-1", "done"));
 
         verify(photoFiles).validate("100", 20L, 501L);
+        verify(palletMeasurements).requireMeasured(application);
+        verify(skuConversions).apply(eq(application), org.mockito.ArgumentMatchers.anyList(), org.mockito.ArgumentMatchers.anyList(), anyString(), org.mockito.ArgumentMatchers.anyList());
         assertEquals(PdaRelabelService.WAIT_REVIEW, result.taskStatus());
         assertEquals("CUSTOMER_CONFIRM_PENDING", result.applicationStatus());
         verify(applicationService).changeStatus(eq("100"), eq("FBR-1"), eq("7"), any());
     }
 
+    @Test
+    void missingOriginalRemainderMeasurementBlocksNormalAndManualCompletionBeforeWrites() {
+        application.setStatus("PROCESSING");
+        PdaRelabelTask task = task("PROCESSING", 1);
+        task.setRelabelledPackages(1);
+        persistedFacts.add(fact("RELABELLED"));
+        when(applications.lockAnyByRelabelNo("FBR-1")).thenReturn(application);
+        when(tasks.lock("100", 1L)).thenReturn(task);
+        var measurements = org.mockito.Mockito.spy(new com.baiyue.lastleg.relabel.service.RelabelPalletMeasurementService());
+        var measuredNew = new com.baiyue.lastleg.relabel.service.RelabelPalletMeasurementService.Measurement(
+            200L, "NEW", 1, "2:1:1", java.math.BigDecimal.TEN, java.math.BigDecimal.TEN,
+            java.math.BigDecimal.TEN, java.math.BigDecimal.ONE, new java.math.BigDecimal("0.001"), false);
+        var unmeasuredRemainder = new com.baiyue.lastleg.relabel.service.RelabelPalletMeasurementService.Measurement(
+            100L, "OLD", 2, "1:3:2", null, null, null, null, null, false);
+        org.mockito.Mockito.doReturn(List.of(measuredNew, unmeasuredRemainder)).when(measurements).snapshots(application);
+        ReflectionTestUtils.setField(service, "palletMeasurements", measurements);
+
+        for (boolean manual : List.of(false, true)) {
+            var error = assertThrows(ResponseStatusException.class, () -> service.complete("7", "picker", 900L, "FBR-1",
+                new PdaRelabelRequests.Complete(List.of(501L), 1, "complete-" + manual, "done", manual)));
+            assertTrue(error.getReason().contains("托盘 OLD"));
+            assertEquals("PROCESSING", task.getStatus());
+            assertEquals("PROCESSING", application.getStatus());
+        }
+        verify(tasks, never()).updateWithVersion(any(), anyInt());
+        verify(unitFacts, never()).insert(any(PdaRelabelUnitFact.class));
+        org.mockito.Mockito.verifyNoInteractions(applicationService, photoFiles, skuConversions);
+        verify(histories, never()).insert(any(com.baiyue.lastleg.relabel.pda.entity.PdaRelabelHistory.class));
+        verify(operations, never()).insert(any(PdaRelabelOperation.class));
+    }
+
     @Test
     void approvalUsesExistingApplicationCompletionAndReworkDoesNot() {
         assertThrows(ResponseStatusException.class, () -> service.review("8", "reviewer", 900L, "FBR-1",
@@ -420,6 +534,7 @@ class PdaRelabelServiceTest {
         assertEquals("picker", task.getOperatorName());
         assertTrue(result.completionPhotoFileIds().isEmpty());
         verify(applicationService).resetForRework("100", "FBR-1", "8", "wrong label");
+        verify(skuConversions).reverse(application);
         verify(applicationService, never()).changeStatus(anyString(), anyString(), anyString(), any());
     }
 
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/relabel/service/RelabelApplicationServiceTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/relabel/service/RelabelApplicationServiceTest.java
index f2260afd3..1e1740d23 100644
--- a/lastleg-service/src/test/java/com/baiyue/lastleg/relabel/service/RelabelApplicationServiceTest.java
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/relabel/service/RelabelApplicationServiceTest.java
@@ -66,8 +66,133 @@ import static org.mockito.Mockito.times;
 
 @ExtendWith(MockitoExtension.class)
 class RelabelApplicationServiceTest {
+    @Test void relatedBusinessNumbersUseAuthoritativeSourcesInsteadOfCustomerReferences() {
+        var application = new RelabelApplication(); application.setCustomerId("C1"); application.setCustomerOrderNo("CUSTOMER-REFERENCE");
+        var order = new LastlegOrder(); order.setCustomerId("C1"); order.setOrderNo("TAIL-INTERNAL-NO");
+        for (var type : List.of("WAREHOUSE_TRANSFER", "RETURN_RELABEL", "FIRST_LEG")) {
+            order.setOrderType(type); order.setSourceOrderNo(type + "-BUSINESS-NO");
+            List<String> numbers = ReflectionTestUtils.invokeMethod(service, "relatedBusinessOrderNos", application, order, List.of());
+            assertEquals(List.of(type + "-BUSINESS-NO"), numbers);
+        }
+        order.setOrderType("RELABEL_APPLICATION"); order.setSourceOrderNo("CUSTOMER-REFERENCE");
+        var first = new RelabelItem(); first.setSourceInboundOrderNo(" RT-SOURCE-1 ");
+        var duplicate = new RelabelItem(); duplicate.setSourceInboundOrderNo("RT-SOURCE-1");
+        var second = new RelabelItem(); second.setSourceInboundOrderNo("IN-SOURCE-2");
+        var bulkReturn = new RelabelItem(); bulkReturn.setOperationType("RETURN_BULK_SKU_LABEL"); bulkReturn.setShipmentNo("RT-SOURCE-3");
+        var shipment = new RelabelItem(); shipment.setOperationType("CARTON_LABEL"); shipment.setShipmentNo("FBA-SHIPMENT");
+        List<String> sources = ReflectionTestUtils.invokeMethod(service, "relatedBusinessOrderNos", application, order,
+            List.of(first, duplicate, second, bulkReturn, shipment));
+        assertEquals(List.of("RT-SOURCE-1", "IN-SOURCE-2", "RT-SOURCE-3"), sources);
+        List<String> missing = ReflectionTestUtils.invokeMethod(service, "relatedBusinessOrderNos", application, order, List.of(shipment));
+        assertEquals(List.of(), missing);
+        order.setOrderType("RETURN_RELABEL"); order.setCustomerId("OTHER"); order.setSourceOrderNo("RT-OTHER-CUSTOMER");
+        List<String> foreign = ReflectionTestUtils.invokeMethod(service, "relatedBusinessOrderNos", application, order, List.of());
+        assertEquals(List.of(), foreign);
+    }
+    @Test void summaryReturnsMilestonesFromCustomerScopedFacts() {
+        var application = new RelabelApplication();
+        application.setId(42L); application.setCustomerId("10001");
+        var reviewed = LocalDateTime.of(2026, 10, 12, 10, 0);
+        var completed = reviewed.plusHours(1);
+        var outbound = reviewed.plusHours(2);
+        when(applications.findMilestones("10001", 42L))
+            .thenReturn(new RelabelResponses.Milestones(reviewed, completed, outbound));
+        var first = new RelabelItem(); first.setProductNameZh(" 商品甲 "); first.setLabelRequirement(" 贴标要求111 ");
+        first.setSkuCode("SKU-FIRST"); first.setOperationType("SKU_LABEL");
+        first.setSkuRelabelItemsJson("[{\"skuCode\":\"SKU-FIRST\",\"newSkuCode\":\"NEW-FIRST\",\"quantity\":10},{\"skuCode\":\"SKU-SECOND\",\"newSkuCode\":\"NEW-SECOND\",\"quantity\":5}]");
+        var second = new RelabelItem(); second.setProductNameZh("商品乙"); second.setLabelRequirement("贴标要求111");
+        second.setOperationType("CARTON_LABEL");
+        var empty = new RelabelItem(); empty.setProductNameZh(" "); empty.setOperationType("SKU_LABEL");
+        RelabelResponses.Summary result = ReflectionTestUtils.invokeMethod(service, "summary", application, List.of(first, second, empty));
+        assertNotNull(result);
+        assertEquals(reviewed, result.reviewedAt());
+        assertEquals(completed, result.relabelCompletedAt());
+        assertEquals(outbound, result.outboundAt());
+        assertEquals("商品甲、商品乙", result.productNameZh());
+        assertEquals("贴标要求111", result.labelRequirement());
+        assertEquals("SKU-FIRST,SKU-SECOND", result.skuCodes());
+        assertEquals(List.of("SKU_LABEL", "CARTON_LABEL"), result.operationTypes());
+        assertEquals(3, result.itemCount());
+    }
+
+    @Test void returnInventoryCandidateUsesRealProductNames() {
+        var cartonMapper = org.mockito.Mockito.mock(com.baiyue.lastleg.returnreceipt.mapper.ReturnInventoryCartonMapper.class);
+        var lineMapper = org.mockito.Mockito.mock(com.baiyue.lastleg.returnreceipt.mapper.ReturnInventoryCartonItemMapper.class);
+        ReflectionTestUtils.setField(service, "returnCartons", cartonMapper);
+        ReflectionTestUtils.setField(service, "returnCartonItems", lineMapper);
+        ReflectionTestUtils.setField(service, "returnPackingTraces", org.mockito.Mockito.mock(com.baiyue.lastleg.returnreceipt.mapper.ReturnPackingTraceMapper.class));
+        var carton = new com.baiyue.lastleg.returnreceipt.entity.ReturnInventoryCarton();
+        carton.setId(20L); carton.setStatus("AVAILABLE"); carton.setSourceUnitType("BOX"); carton.setTotalQuantity(4L);
+        var first = new com.baiyue.lastleg.returnreceipt.entity.ReturnInventoryCartonItem();
+        first.setSkuCode("A"); first.setProductNameZh(" 中文商品甲 "); first.setQuantity(2L);
+        var second = new com.baiyue.lastleg.returnreceipt.entity.ReturnInventoryCartonItem();
+        second.setSkuCode("B"); second.setProductNameZh("中文商品乙"); second.setQuantity(2L);
+        when(cartonMapper.findRelabelCandidates("C", "W")).thenReturn(List.of(carton));
+        when(lineMapper.listCarton(20L)).thenReturn(List.of(first, second));
+        var candidate = service.candidates("C", "W", null).get(0);
+        assertEquals("中文商品甲、中文商品乙", candidate.productNameZh());
+        assertEquals(4L, candidate.stockQuantity());
+        assertEquals("AVAILABLE", candidate.inventoryStatus());
+        assertEquals(List.of(), candidate.mergedIntoCartonMarks());
+        assertEquals(1, candidate.cartonAvailablePackages());
+        carton.setStatus("RELABEL_PENDING");
+        var occupied = service.candidates("C", "W", null).get(0);
+        assertEquals(0, occupied.availablePackages());
+        assertEquals(0, occupied.cartonAvailablePackages());
+        assertEquals(2, occupied.skuItems().size(), "处理中库存保留占用信息，但不可再次选择");
+    }
+    @Test void convertedSkuRemainsAvailableForCartonLabelOnly() {
+        var cartons = org.mockito.Mockito.mock(com.baiyue.lastleg.returnreceipt.mapper.ReturnInventoryCartonMapper.class);
+        var lines = org.mockito.Mockito.mock(com.baiyue.lastleg.returnreceipt.mapper.ReturnInventoryCartonItemMapper.class);
+        ReflectionTestUtils.setField(service, "returnCartons", cartons);
+        ReflectionTestUtils.setField(service, "returnCartonItems", lines);
+        ReflectionTestUtils.setField(service, "returnPackingTraces", org.mockito.Mockito.mock(com.baiyue.lastleg.returnreceipt.mapper.ReturnPackingTraceMapper.class));
+        var carton = new com.baiyue.lastleg.returnreceipt.entity.ReturnInventoryCarton();
+        carton.setId(20L); carton.setStatus("AVAILABLE"); carton.setCartonMark("NEW-BOX"); carton.setTotalQuantity(15L);
+        var first = new com.baiyue.lastleg.returnreceipt.entity.ReturnInventoryCartonItem();
+        first.setSkuCode("NEW-A"); first.setQuantity(10L); first.setRelabelledQuantity(10L);
+        var second = new com.baiyue.lastleg.returnreceipt.entity.ReturnInventoryCartonItem();
+        second.setSkuCode("NEW-B"); second.setQuantity(5L); second.setRelabelledQuantity(5L);
+        when(cartons.findRelabelCandidates("C", "W")).thenReturn(List.of(carton));
+        when(lines.listCarton(20L)).thenReturn(List.of(first, second));
+        var candidate = service.candidates("C", "W", null).get(0);
+        assertEquals(0, candidate.availablePackages());
+        assertTrue(candidate.skuItems().isEmpty());
+        assertEquals("NEW-BOX", candidate.cartonMark());
+        assertEquals(1, candidate.cartonAvailablePackages());
+        assertEquals(List.of(new RelabelResponses.SkuItem("NEW-A", null, 10, null),
+            new RelabelResponses.SkuItem("NEW-B", null, 5, null)), candidate.cartonSkuItems());
+    }
+    @org.junit.jupiter.params.ParameterizedTest
+    @org.junit.jupiter.params.provider.ValueSource(longs = {0, 2, 5, 8})
+    void returnCandidatesOnlyOfferUnlabelledPieces(long completed) {
+        var cartons = org.mockito.Mockito.mock(com.baiyue.lastleg.returnreceipt.mapper.ReturnInventoryCartonMapper.class);
+        var lines = org.mockito.Mockito.mock(com.baiyue.lastleg.returnreceipt.mapper.ReturnInventoryCartonItemMapper.class);
+        ReflectionTestUtils.setField(service, "returnCartons", cartons);
+        ReflectionTestUtils.setField(service, "returnCartonItems", lines);
+        ReflectionTestUtils.setField(service, "returnPackingTraces", org.mockito.Mockito.mock(com.baiyue.lastleg.returnreceipt.mapper.ReturnPackingTraceMapper.class));
+        var carton = new com.baiyue.lastleg.returnreceipt.entity.ReturnInventoryCarton();
+        carton.setId(20L); carton.setStatus("AVAILABLE"); carton.setTotalQuantity(10L);
+        var first = new com.baiyue.lastleg.returnreceipt.entity.ReturnInventoryCartonItem();
+        first.setSkuCode("A"); first.setQuantity(5L);
+        var second = new com.baiyue.lastleg.returnreceipt.entity.ReturnInventoryCartonItem();
+        second.setSkuCode("B"); second.setQuantity(5L); second.setPackingReservedQuantity(1L);
+        when(cartons.findRelabelCandidates("C", "W")).thenReturn(List.of(carton));
+        when(lines.listCarton(20L)).thenReturn(List.of(first, second));
+        when(cartons.completedSkuQuantity(20L, "A")).thenReturn(5L);
+        when(cartons.completedSkuQuantity(20L, "B")).thenReturn(completed);
+        var candidates = service.candidates("C", "W", null);
+        if (completed >= 4) assertTrue(candidates.isEmpty());
+        else {
+            assertEquals(1, candidates.size());
+            assertEquals(4 - completed, candidates.get(0).availablePackages());
+            assertEquals(List.of(new RelabelResponses.SkuItem("B", null, (int) (4 - completed), null)), candidates.get(0).skuItems());
+            assertEquals(10L, candidates.get(0).stockQuantity());
+        }
+    }
     @Mock RelabelApplicationMapper applications;
     @Mock RelabelItemMapper items;
+    @Mock RelabelBindingGuard bindingGuard;
     @Mock RelabelStatusHistoryMapper histories;
     @Mock LastlegOrderMapper orders;
     @Mock LastlegOrderStatusHistoryMapper orderHistories;
@@ -87,9 +212,17 @@ class RelabelApplicationServiceTest {
 
     private RelabelApplicationService service;
 
+    private com.baiyue.lastleg.service.CompactBusinessNumberService compactNumbers;
     @BeforeEach
     void setUp() {
+        compactNumbers = org.mockito.Mockito.mock(com.baiyue.lastleg.service.CompactBusinessNumberService.class);
         service = new RelabelApplicationService();
+        ReflectionTestUtils.setField(service, "compactNumbers", compactNumbers);
+        org.mockito.Mockito.lenient().when(compactNumbers.next(org.mockito.ArgumentMatchers.anyString(), org.mockito.ArgumentMatchers.anyString())).thenAnswer(call -> call.getArgument(0) + "-CS-261016102030");
+        ReflectionTestUtils.setField(service, "bindingGuard", bindingGuard);
+        ReflectionTestUtils.setField(service, "returnPackingTraces", org.mockito.Mockito.mock(com.baiyue.lastleg.returnreceipt.mapper.ReturnPackingTraceMapper.class));
+        ReflectionTestUtils.setField(service, "skuConversions", org.mockito.Mockito.mock(com.baiyue.lastleg.relabel.service.ReturnSkuConversionService.class));
+        ReflectionTestUtils.setField(service, "skuConversionRows", org.mockito.Mockito.mock(com.baiyue.lastleg.returnreceipt.mapper.ReturnSkuConversionMapper.class));
         ReflectionTestUtils.setField(service, "pdaTasks", pdaTasks);
         lenient().when(pdaTasks.lock(any(), any())).thenAnswer(call -> {
             var task = new com.baiyue.lastleg.relabel.pda.entity.PdaRelabelTask();
@@ -97,6 +230,11 @@ class RelabelApplicationServiceTest {
         });
         lenient().when(pdaTasks.updateWithVersion(any(), any())).thenReturn(1);
         ReflectionTestUtils.setField(service, "applications", applications);
+        var statusRepository = new com.baiyue.lastleg.relabel.repository.RelabelStatusRepository();
+        ReflectionTestUtils.setField(statusRepository, "applications", applications);
+        ReflectionTestUtils.setField(statusRepository, "orders", orders);
+        ReflectionTestUtils.setField(statusRepository, "returnOrders", returnOrders);
+        ReflectionTestUtils.setField(service, "statusRepository", statusRepository);
         ReflectionTestUtils.setField(service, "transferRelabelCompletion", transferRelabelCompletion);
         ReflectionTestUtils.setField(service, "items", items);
         ReflectionTestUtils.setField(service, "histories", histories);
@@ -122,11 +260,21 @@ class RelabelApplicationServiceTest {
         balance.setOverseasWarehouseId("WH-1"); balance.setInboundOrderId(301L); balance.setInboundOrderNo("IN-1");
         balance.setInboundCode("CODE-1"); balance.setSkuCode("SKU-A"); balance.setProductNameZh("Chinese name");
         lenient().when(inventoryBalances.selectById(any(Long.class))).thenReturn(balance);
+        lenient().when(inventoryBalances.cartonBelongsToInbound(anyString(), anyString(), anyLong(), anyString())).thenReturn(true);
         ReflectionTestUtils.setField(service, "feeSources", feeSources);
         lenient().when(feeSources.publishApproved(any(), any(), any())).thenReturn(new OverseasFeeSource());
     }
 
 
+    @Test
+    void rejectsCartonOutsideSelectedInboundBeforeCreatingOrHoldingInventory() {
+        when(inventoryBalances.cartonBelongsToInbound(eq("10001"), eq("WH-1"), eq(301L), anyString())).thenReturn(false);
+        var error = assertThrows(ResponseStatusException.class, () -> service.create("10001", "operator-1", request("bad-carton", 1, 1)));
+        assertEquals("当前箱子不存在或不属于当前订单", error.getReason());
+        verify(applications, never()).insert(any(RelabelApplication.class));
+        verify(inventoryCommands, never()).hold(any(), any(), any());
+    }
+
     @Test
     void createBuildsPendingRelabelTailOrderItemsAndBothHistories() {
         RelabelRequests.Create request = request("key-1", 10, 6);
@@ -157,7 +305,7 @@ class RelabelApplicationServiceTest {
         assertEquals("PENDING_REVIEW", tailOrder.getValue().getCurrentStatus());
         assertEquals("RELABEL:PENDING_REVIEW", tailOrder.getValue().getSubOrderStatus());
         assertEquals("CUSTOMER", tailOrder.getValue().getSourceRegion());
-        assertTrue(tailOrder.getValue().getOrderNo().matches("RL-WH-\\d{8}-\\d{6}"));
+        assertTrue(tailOrder.getValue().getOrderNo().matches("TB-CS-[0-9]{12}"));
         assertNull(tailOrder.getValue().getInboundCode());
         assertEquals(application.getValue().getRelabelNo() + ":WH-1", tailOrder.getValue().getSourceInboundId());
         assertEquals(tailOrder.getValue().getRelabelOrderNo(), application.getValue().getRelabelNo());
@@ -452,7 +600,7 @@ class RelabelApplicationServiceTest {
         ReturnOrder returnOrder = new ReturnOrder();
         returnOrder.setId(41L); returnOrder.setCustomerId("10001");
         returnOrder.setRelabelApplicationId(application.getId()); returnOrder.setRelabelStatus("PROCESSING");
-        when(returnOrders.selectOne(any())).thenReturn(returnOrder);
+        when(returnOrders.selectList(any())).thenReturn(List.of(returnOrder));
 
         service.changeStatus("10001", "FBR-REVIEW", "operator-2",
             new RelabelRequests.ChangeStatus(RelabelApplicationService.CUSTOMER_CONFIRM_PENDING, "submitted"));
@@ -554,9 +702,11 @@ class RelabelApplicationServiceTest {
         RelabelApplication application = application(11L, "FBR-1", "10001", "key-1", "hash", RelabelApplicationService.READY_FOR_OUTBOUND);
         application.setLastlegOrderId(21L);
         application.setFulfillmentStatus("PRE_DISPATCH_CREATED");
-        LastlegOrder order = order(21L, "10001", "LMO-RELABEL-1", "PROCESSING");
+        LastlegOrder order = order(21L, "10001", "LMO-RELABEL-1", "INBOUND_COMPLETED");
         order.setOrderType("RETURN_RELABEL");
         order.setRelabelOrderNo("FBR-1");
+        order.setPackageCount(7); order.setProductQuantity(110);
+        order.setSubOrderStatus("RETURN_RELABEL:COMPLETED");
         when(applications.lockNo("10001", "FBR-1")).thenReturn(application);
         stubDetail(application);
         when(orders.selectById(21L)).thenReturn(order);
@@ -568,6 +718,31 @@ class RelabelApplicationServiceTest {
         assertEquals("OUTBOUNDED", application.getFulfillmentStatus());
         assertEquals("INBOUND_COMPLETED", order.getCurrentStatus());
         assertEquals("COMPLETED", order.getRelabelStatus());
+        assertEquals(7, order.getPackageCount());
+        assertEquals(110, order.getProductQuantity());
+        assertEquals("RETURN_RELABEL:COMPLETED", order.getSubOrderStatus());
+    }
+
+    @Test void partialReturnRelabelCreationPreservesParentReceiptQuantitiesAndStatus() {
+        LastlegOrder parent = order(21L, "10001", "RT-ORIGINAL", "INBOUND_COMPLETED");
+        parent.setOrderType("RETURN_RELABEL"); parent.setSourceOrderNo("RT-ORIGINAL");
+        parent.setPackageCount(7); parent.setReceivedPackageCount(7); parent.setProductQuantity(110);
+        parent.setSubOrderStatus("RETURN_RELABEL:COMPLETED");
+        when(orders.selectById(21L)).thenReturn(parent);
+        ReflectionTestUtils.invokeMethod(service, "linkExistingTailOrder", "10001", 21L, "RL-PARTIAL", 1, LocalDateTime.now());
+        assertEquals(7, parent.getPackageCount()); assertEquals(7, parent.getReceivedPackageCount());
+        assertEquals(110, parent.getProductQuantity());
+        assertEquals("RT-ORIGINAL", parent.getSourceOrderNo());
+        assertEquals("INBOUND_COMPLETED", parent.getCurrentStatus());
+        assertEquals("RETURN_RELABEL:COMPLETED", parent.getSubOrderStatus());
+        assertEquals("RL-PARTIAL", parent.getRelabelOrderNo());
+        when(orders.selectOne(any())).thenReturn(parent);
+        var request = org.mockito.Mockito.mock(RelabelRequests.Create.class);
+        when(request.customerOrderNo()).thenReturn("RT-ORIGINAL");
+        ReflectionTestUtils.invokeMethod(service, "insertTailOrder", "10001", request, "hash", "RL-SECOND", "W", 1, LocalDateTime.now());
+        assertEquals(7, parent.getPackageCount()); assertEquals(110, parent.getProductQuantity());
+        assertEquals("RETURN_RELABEL:COMPLETED", parent.getSubOrderStatus());
+        assertEquals("RL-SECOND", parent.getRelabelOrderNo());
     }
 
     @Test
@@ -816,9 +991,11 @@ class RelabelApplicationServiceTest {
         verify(applications, never()).updateById(application);
     }
 
-    @Test
-    void pickupCustomerConfirmationCreatesOneExactCartonOutbound() {
-        RelabelApplication application = confirmationApplication("PICKUP", false);
+    @org.junit.jupiter.params.ParameterizedTest
+    @org.junit.jupiter.params.provider.CsvSource({"PICKUP,false", "EXPRESS,false", "AMAZON_PICKUP,false", "CUSTOMER_PICKUP,false",
+        "PICKUP,true", "EXPRESS,true", "AMAZON_PICKUP,true", "CUSTOMER_PICKUP,true"})
+    void directCustomerConfirmationCreatesOneExactCartonOutboundAndReplays(String deliveryMethod, boolean linkedTransfer) {
+        RelabelApplication application = confirmationApplication(deliveryMethod, false);
         RelabelItem source = item(31L, application.getId(), "SKU-A", 1, 1);
         source.setSourceInventoryPositionId(201L);
         source.setSourceInboundCode("CODE-1");
@@ -826,13 +1003,21 @@ class RelabelApplicationServiceTest {
         source.setDestinationFbaWarehouseCode("ONT8");
         InventoryPosition position = new InventoryPosition();
         position.setId(201L); position.setCustomerId("10001"); position.setPalletId(501L); position.setPalletNo("PALLET-1");
+        position.setOverseasWarehouseId("900");
         when(applications.lockNo("10001", "FBR-1")).thenReturn(application);
         when(applications.findNo("10001", "FBR-1")).thenReturn(application);
         when(items.selectList(any())).thenReturn(List.of(source));
         when(histories.selectList(any())).thenReturn(List.of());
         when(orders.selectById(21L)).thenReturn(order(21L, "10001", "LMO-RELABEL-1", "PENDING_ASSIGNMENT"));
         when(inventoryPositions.selectById(201L)).thenReturn(position);
+        if (linkedTransfer) {
+            var transfer = new WarehouseTransferOrder(); transfer.setId(77L); transfer.setCustomerId("10001");
+            transfer.setStatus("WAIT_RELABEL"); transfer.setLastlegOrderId(88L); transfer.setFbaWarehouseCode("ONT8");
+            when(warehouseTransfers.lockByRelabelNo("10001", "FBR-1")).thenReturn(transfer);
+        }
 
+        service.confirmCompletion("10001", "FBR-1", "customer-1",
+            new RelabelRequests.CustomerConfirm("confirm-pickup", null));
         service.confirmCompletion("10001", "FBR-1", "customer-1",
             new RelabelRequests.CustomerConfirm("confirm-pickup", null));
 
@@ -846,6 +1031,95 @@ class RelabelApplicationServiceTest {
         assertEquals("BOX-1", outboundItem.getValue().getCartonMarks());
         assertEquals("PALLET-1", outboundItem.getValue().getPalletNo());
         verify(outboundTasks, times(1)).insert(any(OutboundPdaTask.class));
+        verify(bindingGuard, times(1)).requireBound(application);
+    }
+
+    @Test
+    void customerConfirmationRejectsUnboundManualCompletionBeforeAnyWrite() {
+        RelabelApplication application = confirmationApplication("PICKUP", false);
+        when(applications.lockNo("10001", "FBR-1")).thenReturn(application);
+        org.mockito.Mockito.doThrow(new ResponseStatusException(org.springframework.http.HttpStatus.CONFLICT,
+            "箱唛 BOX-1 尚未完成托盘绑定")).when(bindingGuard).requireBound(application);
+        assertThrows(ResponseStatusException.class, () -> service.confirmCompletion("10001", "FBR-1", "customer-1",
+            new RelabelRequests.CustomerConfirm("manual-confirm", null)));
+        verify(pdaTasks, never()).updateWithVersion(any(), any());
+        verify(applications, never()).updateById(any(RelabelApplication.class));
+        verify(outboundOrders, never()).insert(any(OutboundOrder.class));
+        verify(outboundItems, never()).insert(any(OutboundPalletItem.class));
+        verify(outboundTasks, never()).insert(any(OutboundPdaTask.class));
+        assertEquals(RelabelApplicationService.CUSTOMER_CONFIRM_PENDING, application.getStatus());
+    }
+
+    @org.junit.jupiter.params.ParameterizedTest
+    @org.junit.jupiter.params.provider.CsvSource({"SKU_LABEL,", "CARTON_AND_SKU,PICKUP", "CARTON_AND_SKU,EXPRESS",
+        "CARTON_AND_SKU,AMAZON_PICKUP", "CARTON_AND_SKU,CUSTOMER_PICKUP"})
+    void convertedReturnContentsPassRealConfirmationGuardAndRemainValidAfterConfirmation(String operation, String deliveryMethod) {
+        var application = confirmationApplication(deliveryMethod, false);
+        var source = item(31L, application.getId(), "OLD-A", 1, 1);
+        source.setOperationType(operation); source.setReturnCartonId(301L); source.setSourceInventoryPositionId(null);
+        source.setCartonMark("BOX-1"); source.setSourceCartonMark("RETURN-BOX-1");
+        source.setDestinationFbaWarehouseCode("ONT8");
+        source.setSkuRelabelItemsJson("[{\"skuCode\":\"OLD-A\",\"newSkuCode\":\"NEW\",\"quantity\":3},{\"skuCode\":\"OLD-B\",\"newSkuCode\":\"NEW\",\"quantity\":2}]");
+        when(items.selectList(any())).thenReturn(List.of(source));
+        when(applications.lockNo("10001", "FBR-1")).thenReturn(application);
+        when(applications.findNo("10001", "FBR-1")).thenReturn(application);
+        when(orders.selectById(21L)).thenReturn(order(21L, "10001", "LMO-RELABEL-1", "WAIT_RELABEL"));
+        var cartons = org.mockito.Mockito.mock(com.baiyue.lastleg.returnreceipt.mapper.ReturnInventoryCartonMapper.class);
+        var contents = org.mockito.Mockito.mock(com.baiyue.lastleg.returnreceipt.mapper.ReturnInventoryCartonItemMapper.class);
+        var conversions = org.mockito.Mockito.mock(com.baiyue.lastleg.returnreceipt.mapper.ReturnSkuConversionMapper.class);
+        var pdaHistories = org.mockito.Mockito.mock(com.baiyue.lastleg.relabel.pda.mapper.PdaRelabelHistoryMapper.class);
+        var completed = new com.baiyue.lastleg.relabel.pda.entity.PdaRelabelHistory();
+        completed.setAction("COMPLETE"); completed.setDetailJson("{\"roundKey\":\"INITIAL\"}");
+        when(pdaHistories.selectList(any())).thenReturn(List.of(completed));
+        var carton = new com.baiyue.lastleg.returnreceipt.entity.ReturnInventoryCarton();
+        carton.setId(301L); carton.setCustomerId("10001"); carton.setOverseasWarehouseId("900");
+        carton.setRelabelApplicationId(application.getId()); carton.setStatus("RELABEL_PENDING");
+        carton.setCountStatus("CONFIRMED"); carton.setSourceUnitType("BOX"); carton.setTotalQuantity(5L);
+        lenient().when(cartons.selectById(301L)).thenReturn(carton);
+        when(cartons.lockId(301L)).thenReturn(carton);
+        var content = new com.baiyue.lastleg.returnreceipt.entity.ReturnInventoryCartonItem();
+        content.setSkuCode("NEW"); content.setQuantity(5L);
+        when(contents.lockCarton(301L)).thenReturn(List.of(content));
+        var rows = new java.util.ArrayList<com.baiyue.lastleg.returnreceipt.entity.ReturnSkuConversion>();
+        for (var oldSku : List.of("OLD-A", "OLD-B")) {
+            var row = new com.baiyue.lastleg.returnreceipt.entity.ReturnSkuConversion();
+            row.setCustomerId("10001"); row.setApplicationId(application.getId()); row.setItemId(source.getId());
+            row.setCartonId(301L); row.setRoundKey("INITIAL"); row.setStatus("APPLIED");
+            row.setOldSkuCode(oldSku); row.setNewSkuCode("NEW"); row.setQuantity("OLD-A".equals(oldSku) ? 3L : 2L);
+            rows.add(row);
+        }
+        when(conversions.lockApplication("10001", application.getId())).thenReturn(rows);
+        var realGuard = new RelabelBindingGuard();
+        ReflectionTestUtils.setField(realGuard, "items", items); ReflectionTestUtils.setField(realGuard, "histories", pdaHistories);
+        ReflectionTestUtils.setField(realGuard, "returnCartons", cartons); ReflectionTestUtils.setField(realGuard, "returnLines", contents);
+        ReflectionTestUtils.setField(realGuard, "conversions", conversions); ReflectionTestUtils.setField(realGuard, "objectMapper", mapper());
+        var realConversions = new ReturnSkuConversionService(); ReflectionTestUtils.setField(realConversions, "conversions", conversions);
+        ReflectionTestUtils.setField(service, "bindingGuard", realGuard); ReflectionTestUtils.setField(service, "skuConversions", realConversions);
+        ReflectionTestUtils.setField(service, "returnCartons", cartons);
+        ReflectionTestUtils.setField(service, "deliveryOrders", org.mockito.Mockito.mock(com.baiyue.lastleg.delivery.mapper.DeliveryOrderMapper.class));
+        if (!"SKU_LABEL".equals(operation)) {
+            var customers = org.mockito.Mockito.mock(com.baiyue.lastleg.fleet.customer.FleetCustomerDirectory.class);
+            var warehouses = org.mockito.Mockito.mock(com.baiyue.lastleg.fleet.driver.FleetWarehouseDirectory.class);
+            ReflectionTestUtils.setField(service, "customerDirectory", customers);
+            ReflectionTestUtils.setField(service, "warehouseDirectory", warehouses);
+            when(customers.find("10001")).thenReturn(new com.baiyue.lastleg.fleet.customer.FleetCustomerDirectory.Customer("10001", "C", "客户", null, null));
+            when(warehouses.required(900L, "OVERSEAS")).thenReturn(new com.baiyue.lastleg.fleet.driver.DriverModels.WarehouseOption("900", "WH", "海外仓", "OVERSEAS"));
+        }
+
+        var command = new RelabelRequests.CustomerConfirm("converted-confirm", null);
+        service.confirmCompletion("10001", "FBR-1", "customer-1", command);
+        service.confirmCompletion("10001", "FBR-1", "customer-1", command);
+        assertTrue(rows.stream().allMatch(row -> "CONFIRMED".equals(row.getStatus())));
+        realGuard.requireBound(application);
+        verify(conversions, times(2)).updateById(any(com.baiyue.lastleg.returnreceipt.entity.ReturnSkuConversion.class));
+        if ("SKU_LABEL".equals(operation)) {
+            assertEquals("COMPLETED", application.getStatus()); assertEquals("NOT_REQUIRED", application.getFulfillmentStatus());
+            verify(outboundOrders, never()).insert(any(OutboundOrder.class));
+        } else {
+            assertEquals("OUTBOUND_CREATED", application.getFulfillmentStatus());
+            verify(outboundOrders, times(1)).insert(any(OutboundOrder.class));
+            assertEquals("OUTBOUND_PENDING", carton.getStatus());
+        }
     }
 
     private RelabelApplication confirmationApplication(String deliveryMethod, boolean printShippingLabel) {
@@ -961,12 +1235,62 @@ class RelabelApplicationServiceTest {
         verify(applications, never()).insert(any(RelabelApplication.class));
     }
 
-    @Test
-    void returnSkuRelabelRejectsQuantityBeyondSelectedSourceBox() {
+    @org.junit.jupiter.params.ParameterizedTest
+    @org.junit.jupiter.params.provider.CsvSource({"CARTON_LABEL,0", "CARTON_LABEL,5", "SKU_LABEL,0", "SKU_LABEL,2", "CARTON_AND_SKU,0"})
+    void intactParcelSupportsAllLabelOperationsWithoutMergingIntoBox(String type, long completed) {
+        var cartons = org.mockito.Mockito.mock(com.baiyue.lastleg.returnreceipt.mapper.ReturnInventoryCartonMapper.class);
+        var lines = org.mockito.Mockito.mock(com.baiyue.lastleg.returnreceipt.mapper.ReturnInventoryCartonItemMapper.class);
+        ReflectionTestUtils.setField(service, "returnCartons", cartons); ReflectionTestUtils.setField(service, "returnCartonItems", lines);
+        var parcel = new com.baiyue.lastleg.returnreceipt.entity.ReturnInventoryCarton();
+        parcel.setId(901L); parcel.setCustomerId("10001"); parcel.setOverseasWarehouseId("WH-1");
+        parcel.setCartonMark("PARCEL-1"); parcel.setSourceUnitType("PARCEL"); parcel.setStatus("AVAILABLE");
+        parcel.setCountStatus("CONFIRMED"); parcel.setTotalQuantity(5L);
+        var line = new com.baiyue.lastleg.returnreceipt.entity.ReturnInventoryCartonItem(); line.setSkuCode("SKU-A"); line.setQuantity(5L);
+        when(cartons.lockId(901L)).thenReturn(parcel); when(lines.lockCarton(901L)).thenReturn(List.of(line));
+        if ("CARTON_LABEL".equals(type)) line.setRelabelledQuantity(completed);
+        else when(cartons.completedSkuQuantity(901L, "SKU-A")).thenReturn(completed);
+        when(cartons.markRelabelPending(anyLong(), anyLong(), anyString(), any())).thenReturn(1);
+        var app = application(11L, "RL-PARCEL", "10001", "parcel-key", null, "PENDING_REVIEW"); app.setLastlegOrderId(21L);
+        when(applications.findNo(eq("10001"), any())).thenReturn(app);
+        when(orders.selectById(21L)).thenReturn(order(21L, "10001", "RL-PARCEL-ORDER", "PENDING_REVIEW"));
+        var detail = new RelabelRequests.Item(null, null, null, "SKU-A", null, null, null,
+            "Return goods", 1, 1, "RT-1", null, "NEW-A", null, null, null, null, null,
+            "PARCEL-1", "FBA-PARCEL", "XLX1", type,
+            "CARTON_LABEL".equals(type) ? List.of() : List.of(new RelabelRequests.SkuItem("SKU-A", "NEW-A", (int) (5 - completed), null)), 901L);
+        service.create("10001", "operator", new RelabelRequests.Create("RT-1", "WH-1", LocalDateTime.now().plusDays(1),
+            "Contact", "19900000000", null, null, "parcel-key", List.of(detail), "SKU_LABEL".equals(type) ? null : "EXPRESS", false));
+        var stored = ArgumentCaptor.forClass(RelabelItem.class); verify(items).insert(stored.capture());
+        assertEquals(type, stored.getValue().getOperationType()); assertEquals(901L, stored.getValue().getReturnCartonId());
+        assertEquals(1, stored.getValue().getNotifiedPackageCount()); assertEquals("PARCEL", parcel.getSourceUnitType());
+        verify(inventoryCommands, never()).hold(anyString(), anyString(), any());
+    }
+
+    @Test void partialParcelMixedLabelsRequireIndependentBoxBeforeApplication() {
+        var cartons = org.mockito.Mockito.mock(com.baiyue.lastleg.returnreceipt.mapper.ReturnInventoryCartonMapper.class);
+        var lines = org.mockito.Mockito.mock(com.baiyue.lastleg.returnreceipt.mapper.ReturnInventoryCartonItemMapper.class);
+        ReflectionTestUtils.setField(service, "returnCartons", cartons); ReflectionTestUtils.setField(service, "returnCartonItems", lines);
+        var parcel = new com.baiyue.lastleg.returnreceipt.entity.ReturnInventoryCarton();
+        parcel.setId(901L); parcel.setCustomerId("10001"); parcel.setOverseasWarehouseId("WH-1");
+        parcel.setCartonMark("PARCEL-1"); parcel.setSourceUnitType("PARCEL"); parcel.setStatus("AVAILABLE"); parcel.setTotalQuantity(5L);
+        var line = new com.baiyue.lastleg.returnreceipt.entity.ReturnInventoryCartonItem(); line.setSkuCode("SKU-A"); line.setQuantity(5L);
+        when(cartons.lockId(901L)).thenReturn(parcel); when(lines.lockCarton(901L)).thenReturn(List.of(line));
+        var detail = new RelabelRequests.Item(null, null, null, "SKU-A", null, null, null,
+            "Return goods", 1, 1, "RT-1", null, "NEW-A", null, null, null, null, null,
+            "PARCEL-1", "FBA", "XLX1", "CARTON_AND_SKU", List.of(new RelabelRequests.SkuItem("SKU-A", "NEW-A", 2, null)), 901L);
+        var error = assertThrows(ResponseStatusException.class, () -> service.create("10001", "operator",
+            new RelabelRequests.Create("RT-1", "WH-1", LocalDateTime.now().plusDays(1), "Contact", "19900000000", null,
+                null, "partial-parcel", List.of(detail), "EXPRESS", false)));
+        assertTrue(error.getReason().contains("独立新箱")); verify(applications, never()).insert(any(RelabelApplication.class));
+    }
+
+    @org.junit.jupiter.params.ParameterizedTest
+    @org.junit.jupiter.params.provider.ValueSource(longs = {3, 5})
+    void returnSkuRelabelRejectsAlreadyLabelledPieces(long completed) {
         var cartonMapper = org.mockito.Mockito.mock(com.baiyue.lastleg.returnreceipt.mapper.ReturnInventoryCartonMapper.class);
         var lineMapper = org.mockito.Mockito.mock(com.baiyue.lastleg.returnreceipt.mapper.ReturnInventoryCartonItemMapper.class);
         ReflectionTestUtils.setField(service, "returnCartons", cartonMapper);
         ReflectionTestUtils.setField(service, "returnCartonItems", lineMapper);
+        ReflectionTestUtils.setField(service, "returnPackingTraces", org.mockito.Mockito.mock(com.baiyue.lastleg.returnreceipt.mapper.ReturnPackingTraceMapper.class));
         var carton = new com.baiyue.lastleg.returnreceipt.entity.ReturnInventoryCarton();
         carton.setId(901L); carton.setCustomerId("10001"); carton.setOverseasWarehouseId("WH-1");
         carton.setCartonMark("RETURN-BOX-1"); carton.setStatus("AVAILABLE"); carton.setSourceUnitType("BOX");
@@ -974,17 +1298,70 @@ class RelabelApplicationServiceTest {
         line.setSkuCode("SKU-A"); line.setQuantity(5L); line.setPackingReservedQuantity(0L);
         when(cartonMapper.lockId(901L)).thenReturn(carton);
         when(lineMapper.lockCarton(901L)).thenReturn(List.of(line));
+        when(cartonMapper.completedSkuQuantity(901L, "SKU-A")).thenReturn(completed);
         var detail = new RelabelRequests.Item(null, null, null, "SKU-A", null, null, null,
             "Return goods", 1, 1, "RT-1", null, "NEW-A", null, null,
             null, null, null, "RETURN-BOX-1", null, null, "SKU_LABEL",
-            List.of(new RelabelRequests.SkuItem("SKU-A", "NEW-A", 6, null)), 901L);
+            List.of(new RelabelRequests.SkuItem("SKU-A", "NEW-A", 3, null)), 901L);
         var request = new RelabelRequests.Create("RT-1", "WH-1", LocalDateTime.now().plusDays(1),
             "Li", "13800000000", null, null, "return-over-quantity", List.of(detail), null, false);
         var error = assertThrows(ResponseStatusException.class, () -> service.create("10001", "operator-1", request));
-        assertTrue(error.getReason().contains("超过来源箱可用数量"));
+        assertTrue(error.getReason().contains(completed == 5 ? "已全部换标" : "超过来源箱可用数量"));
         verify(applications, never()).insert(any(RelabelApplication.class));
     }
 
+    @org.junit.jupiter.params.ParameterizedTest
+    @org.junit.jupiter.params.provider.ValueSource(strings = {"PENDING_REVIEW", "PENDING_PROCESSING", "PROCESSING", "CUSTOMER_CONFIRM_PENDING", "REJECTED"})
+    void unfinishedApplicationsCanBeVoidedAndRetainTransferMainStatus(String status) {
+        var app = application(11L, "RL-VOID", "10001", "void-key", "hash", status);
+        app.setLastlegOrderId(21L); app.setWalletStatus("FROZEN");
+        when(applications.lockNo("10001", "RL-VOID")).thenReturn(app);
+        stubDetail(app);
+        var tail = order(21L, "10001", "WT-1", "INBOUND_COMPLETED"); tail.setOrderType("WAREHOUSE_TRANSFER");
+        when(orders.selectById(21L)).thenReturn(tail);
+        service.changeStatus("10001", "RL-VOID", "operator", new RelabelRequests.ChangeStatus("CANCELLED", "废弃预填换标要求"));
+        assertEquals("CANCELLED", app.getStatus());
+        assertEquals("INBOUND_COMPLETED", tail.getCurrentStatus());
+        assertEquals("CANCELLED", tail.getRelabelStatus());
+        assertEquals("RELEASE_PENDING", app.getWalletStatus());
+        verify(walletCommands).publish(eq("RELEASE"), eq(10001L), eq("RELABEL_ORDER"), eq("RL-VOID"), isNull(), anyString(), eq(2L));
+        verify(histories).insert(any(RelabelStatusHistory.class));
+    }
+
+    @Test void repeatedVoidReturnsExistingRecordWithoutReleasingAgain() {
+        var app = application(11L, "RL-VOID-AGAIN", "10001", "key", "hash", "CANCELLED");
+        app.setLastlegOrderId(21L);
+        when(applications.lockNo("10001", app.getRelabelNo())).thenReturn(app); stubDetail(app);
+        var result = service.changeStatus("10001", app.getRelabelNo(), "operator", new RelabelRequests.ChangeStatus("CANCELLED", "作废"));
+        assertEquals("CANCELLED", result.application().status());
+        verify(applications, never()).updateById(any(RelabelApplication.class));
+        verify(inventoryCommands, never()).release(anyString(), anyString(), any());
+        verify(histories, never()).insert(any(RelabelStatusHistory.class));
+    }
+
+    @Test void directPendingReviewApplicationCanBeVoidedOutsideTailOrderReview() {
+        var app = application(11L, "RL-DIRECT-VOID", "10001", "void-key", "hash", "PENDING_REVIEW");
+        app.setLastlegOrderId(21L);
+        when(applications.lockNo("10001", app.getRelabelNo())).thenReturn(app); stubDetail(app);
+        var tail = order(21L, "10001", "RL-ORDER", "WAIT_RELABEL"); tail.setOrderType("RELABEL_APPLICATION");
+        when(orders.selectById(21L)).thenReturn(tail);
+        service.changeStatus("10001", app.getRelabelNo(), "operator", new RelabelRequests.ChangeStatus("CANCELLED", "作废"));
+        assertEquals("CANCELLED", tail.getCurrentStatus());
+    }
+
+    @org.junit.jupiter.params.ParameterizedTest
+    @org.junit.jupiter.params.provider.ValueSource(strings = {"READY_FOR_OUTBOUND", "COMPLETED"})
+    void completedRelabelCannotBeVoided(String status) {
+        var app = application(11L, "RL-DONE", "10001", "key", "hash", status);
+        app.setLastlegOrderId(21L);
+        when(applications.lockNo("10001", "RL-DONE")).thenReturn(app);
+        when(orders.selectById(21L)).thenReturn(order(21L, "10001", "ORDER", "COMPLETED"));
+        var failure = assertThrows(ResponseStatusException.class, () -> service.changeStatus("10001", "RL-DONE", "operator", new RelabelRequests.ChangeStatus("CANCELLED", "作废")));
+        assertTrue(failure.getReason().contains("不能作废"));
+        verify(applications, never()).updateById(any(RelabelApplication.class));
+        verify(walletCommands, never()).publish(anyString(), anyLong(), anyString(), anyString(), any(), any(), anyLong());
+    }
+
     private void stubDetail(RelabelApplication application) {
         when(applications.findNo(application.getCustomerId(), application.getRelabelNo())).thenReturn(application);
         when(items.selectList(any())).thenReturn(List.of(item(31L, application.getId(), "SKU-A", 10, 6)));
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/relabel/service/RelabelBindingGuardTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/relabel/service/RelabelBindingGuardTest.java
index 806625f7b..d842982b7 100644
--- a/lastleg-service/src/test/java/com/baiyue/lastleg/relabel/service/RelabelBindingGuardTest.java
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/relabel/service/RelabelBindingGuardTest.java
@@ -6,6 +6,7 @@ import com.baiyue.lastleg.relabel.pda.entity.PdaRelabelHistory;
 import com.baiyue.lastleg.relabel.pda.mapper.PdaRelabelHistoryMapper;
 import com.baiyue.lastleg.inventory.entity.InventoryPosition;
 import com.baiyue.lastleg.inventory.mapper.InventoryPositionMapper;
+import com.baiyue.lastleg.returnreceipt.mapper.ReturnInventoryCartonMapper;
 import com.fasterxml.jackson.databind.ObjectMapper;
 import org.junit.jupiter.api.Test;
 import org.springframework.test.util.ReflectionTestUtils;
@@ -16,7 +17,148 @@ import static org.mockito.ArgumentMatchers.*;
 import static org.junit.jupiter.api.Assertions.*;
 
 class RelabelBindingGuardTest {
-    @Test void physicalBindingMustMatchLatestTargetAndCannotSurviveRework() {
+    @org.junit.jupiter.params.ParameterizedTest
+    @org.junit.jupiter.params.provider.ValueSource(strings = {"SKU_LABEL", "CARTON_AND_SKU", "RETURN_BULK_SKU_LABEL"})
+    void convertedContentsRequireCurrentCustomerApplicationItemCartonAndRound(String operation) {
+        var guard = new RelabelBindingGuard();
+        var items = mock(RelabelItemMapper.class); var history = mock(PdaRelabelHistoryMapper.class);
+        var cartons = mock(ReturnInventoryCartonMapper.class);
+        var contents = mock(com.baiyue.lastleg.returnreceipt.mapper.ReturnInventoryCartonItemMapper.class);
+        var conversions = mock(com.baiyue.lastleg.returnreceipt.mapper.ReturnSkuConversionMapper.class);
+        ReflectionTestUtils.setField(guard, "items", items); ReflectionTestUtils.setField(guard, "histories", history);
+        ReflectionTestUtils.setField(guard, "returnCartons", cartons); ReflectionTestUtils.setField(guard, "returnLines", contents);
+        ReflectionTestUtils.setField(guard, "conversions", conversions); ReflectionTestUtils.setField(guard, "objectMapper", new ObjectMapper());
+        var app = new RelabelApplication(); app.setId(1L); app.setCustomerId("2"); app.setOverseasWarehouseId("W");
+        app.setStatus("CUSTOMER_CONFIRM_PENDING"); app.setDeliveryMethod("PICKUP");
+        var item = new RelabelItem(); item.setId(4L); item.setReturnCartonId(3L); item.setOperationType(operation);
+        item.setCartonMark("BOX"); item.setSkuCode("A"); item.setNewSkuCode("B"); item.setNotifiedPackageCount(3);
+        item.setSkuRelabelItemsJson("[{\"skuCode\":\"A\",\"newSkuCode\":\"B\",\"quantity\":3}]");
+        var carton = new com.baiyue.lastleg.returnreceipt.entity.ReturnInventoryCarton();
+        carton.setCustomerId("2"); carton.setOverseasWarehouseId("W");
+        var complete = new PdaRelabelHistory(); complete.setAction("COMPLETE"); complete.setDetailJson("{\"roundKey\":\"ROUND-2\"}");
+        var line = new com.baiyue.lastleg.returnreceipt.entity.ReturnInventoryCartonItem(); line.setSkuCode("B"); line.setQuantity(3L);
+        var row = conversion("A", "B", 3L);
+        when(items.selectList(any())).thenReturn(List.of(item)); when(history.selectList(any())).thenReturn(List.of(complete));
+        when(cartons.selectById(3L)).thenReturn(carton); when(contents.lockCarton(3L)).thenReturn(List.of(line));
+        when(conversions.lockApplication("2", 1L)).thenReturn(List.of(row));
+        assertDoesNotThrow(() -> guard.requireBound(app));
+        row.setStatus("CONFIRMED"); app.setStatus("READY_FOR_OUTBOUND");
+        assertDoesNotThrow(() -> guard.requireBound(app));
+        row.setCustomerId("OTHER"); assertThrows(ResponseStatusException.class, () -> guard.requireBound(app)); row.setCustomerId("2");
+        row.setApplicationId(9L); assertThrows(ResponseStatusException.class, () -> guard.requireBound(app)); row.setApplicationId(1L);
+        row.setItemId(9L); assertThrows(ResponseStatusException.class, () -> guard.requireBound(app)); row.setItemId(4L);
+        row.setCartonId(9L); assertThrows(ResponseStatusException.class, () -> guard.requireBound(app)); row.setCartonId(3L);
+        row.setRoundKey("ROUND-1"); assertThrows(ResponseStatusException.class, () -> guard.requireBound(app)); row.setRoundKey("ROUND-2");
+        row.setStatus("REVERSED"); assertThrows(ResponseStatusException.class, () -> guard.requireBound(app)); row.setStatus("APPLIED");
+        line.setQuantity(2L); assertThrows(ResponseStatusException.class, () -> guard.requireBound(app)); line.setQuantity(3L);
+        carton.setOverseasWarehouseId("OTHER"); assertThrows(ResponseStatusException.class, () -> guard.requireBound(app)); carton.setOverseasWarehouseId("W");
+        carton.setCustomerId("OTHER"); assertThrows(ResponseStatusException.class, () -> guard.requireBound(app)); carton.setCustomerId("2");
+        when(conversions.lockApplication("2", 1L)).thenReturn(List.of());
+        assertThrows(ResponseStatusException.class, () -> guard.requireBound(app));
+        when(conversions.lockApplication("2", 1L)).thenReturn(List.of(row));
+        var archive = new PdaRelabelHistory(); archive.setAction("REWORK_ARCHIVE");
+        when(history.selectList(any())).thenReturn(List.of(complete, archive));
+        assertThrows(ResponseStatusException.class, () -> guard.requireBound(app));
+
+        // A -> B and original B -> C must subtract both original quantities before adding targets.
+        when(history.selectList(any())).thenReturn(List.of(complete));
+        item.setOperationType("CARTON_AND_SKU");
+        item.setSkuRelabelItemsJson("[{\"skuCode\":\"A\",\"newSkuCode\":\"B\",\"quantity\":3},{\"skuCode\":\"B\",\"newSkuCode\":\"C\",\"quantity\":2}]");
+        var second = conversion("B", "C", 2L);
+        var target = new com.baiyue.lastleg.returnreceipt.entity.ReturnInventoryCartonItem(); target.setSkuCode("C"); target.setQuantity(2L);
+        when(contents.lockCarton(3L)).thenReturn(List.of(line, target));
+        when(conversions.lockApplication("2", 1L)).thenReturn(List.of(second, row));
+        assertDoesNotThrow(() -> guard.requireBound(app));
+        when(conversions.lockApplication("2", 1L)).thenReturn(List.of(row, second));
+        assertDoesNotThrow(() -> guard.requireBound(app));
+        second.setQuantity(5L); line.setQuantity(0L); target.setQuantity(5L);
+        assertThrows(ResponseStatusException.class, () -> guard.requireBound(app), "不能把新转入 B 当作本申请原批准 B 数量");
+    }
+
+    private com.baiyue.lastleg.returnreceipt.entity.ReturnSkuConversion conversion(String oldSku, String newSku, long quantity) {
+        var row = new com.baiyue.lastleg.returnreceipt.entity.ReturnSkuConversion();
+        row.setCustomerId("2"); row.setApplicationId(1L); row.setItemId(4L); row.setCartonId(3L);
+        row.setRoundKey("ROUND-2"); row.setStatus("APPLIED"); row.setOldSkuCode(oldSku); row.setNewSkuCode(newSku); row.setQuantity(quantity);
+        return row;
+    }
+
+    @org.junit.jupiter.params.ParameterizedTest
+    @org.junit.jupiter.params.provider.ValueSource(strings = {"EXPRESS", "PICKUP", "AMAZON_PICKUP", "CUSTOMER_PICKUP"})
+    void parcelMixedCompletionRechecksAllContentsWithoutRequiringDirectOutboundPallet(String deliveryMethod) {
+        var guard = new RelabelBindingGuard();
+        var items = mock(RelabelItemMapper.class); var histories = mock(PdaRelabelHistoryMapper.class);
+        var cartons = mock(ReturnInventoryCartonMapper.class);
+        var lines = mock(com.baiyue.lastleg.returnreceipt.mapper.ReturnInventoryCartonItemMapper.class);
+        ReflectionTestUtils.setField(guard, "items", items); ReflectionTestUtils.setField(guard, "histories", histories);
+        ReflectionTestUtils.setField(guard, "returnCartons", cartons); ReflectionTestUtils.setField(guard, "returnLines", lines);
+        ReflectionTestUtils.setField(guard, "objectMapper", new ObjectMapper());
+        var app = new RelabelApplication(); app.setId(1L); app.setCustomerId("2"); app.setDeliveryMethod(deliveryMethod);
+        var item = new RelabelItem(); item.setReturnCartonId(3L); item.setOperationType("CARTON_AND_SKU");
+        item.setCartonMark("PARCEL-1"); item.setSkuRelabelItemsJson("[{\"skuCode\":\"A\",\"quantity\":3}]");
+        var parcel = new com.baiyue.lastleg.returnreceipt.entity.ReturnInventoryCarton(); parcel.setCustomerId("2"); parcel.setSourceUnitType("PARCEL");
+        when(items.selectList(any())).thenReturn(List.of(item)); when(histories.selectList(any())).thenReturn(List.of());
+        when(cartons.selectById(3L)).thenReturn(parcel);
+        var line = new com.baiyue.lastleg.returnreceipt.entity.ReturnInventoryCartonItem(); line.setSkuCode("A"); line.setQuantity(3L);
+        when(lines.lockCarton(3L)).thenReturn(List.of(line));
+        assertDoesNotThrow(() -> guard.requireBound(app));
+        line.setQuantity(4L); assertThrows(ResponseStatusException.class, () -> guard.requireBound(app));
+        line.setQuantity(3L); app.setDeliveryMethod("TRUCK"); assertThrows(ResponseStatusException.class, () -> guard.requireBound(app));
+    }
+    @Test void partialReturnSkuMustBeIsolatedAndLooseFullCartonOnlyRequiresPalletForTruck() {
+        var guard = new RelabelBindingGuard();
+        var items = mock(RelabelItemMapper.class); var histories = mock(PdaRelabelHistoryMapper.class);
+        var lines = mock(com.baiyue.lastleg.returnreceipt.mapper.ReturnInventoryCartonItemMapper.class);
+        var cartons = mock(com.baiyue.lastleg.returnreceipt.mapper.ReturnInventoryCartonMapper.class);
+        ReflectionTestUtils.setField(guard, "items", items); ReflectionTestUtils.setField(guard, "histories", histories);
+        ReflectionTestUtils.setField(guard, "returnLines", lines); ReflectionTestUtils.setField(guard, "returnCartons", cartons);
+        ReflectionTestUtils.setField(guard, "objectMapper", new ObjectMapper());
+        var app = new RelabelApplication(); app.setId(1L); app.setCustomerId("2");
+        var item = new RelabelItem(); item.setReturnCartonId(3L); item.setCartonMark("PARCEL");
+        item.setOperationType("SKU_LABEL"); item.setNotifiedPackageCount(1);
+        item.setSkuRelabelItemsJson("[{\"skuCode\":\"A\",\"newSkuCode\":\"NEW-A\",\"quantity\":3}]");
+        when(items.selectList(any())).thenReturn(List.of(item)); when(histories.selectList(any())).thenReturn(List.of());
+        var stock = new com.baiyue.lastleg.returnreceipt.entity.ReturnInventoryCartonItem(); stock.setSkuCode("A"); stock.setQuantity(10L);
+        var ownedCarton = new com.baiyue.lastleg.returnreceipt.entity.ReturnInventoryCarton(); ownedCarton.setCustomerId("2");
+        when(cartons.selectById(3L)).thenReturn(ownedCarton);
+        when(lines.lockCarton(3L)).thenReturn(List.of(stock));
+        assertThrows(ResponseStatusException.class, () -> guard.requireBound(app));
+        stock.setQuantity(3L);
+        assertDoesNotThrow(() -> guard.requireBound(app));
+        assertNull(ownedCarton.getPalletCode(), "纯 SKU 留仓不要求托盘，但仍校验来源归属");
+        stock.setSkuCode("OTHER");
+        assertThrows(ResponseStatusException.class, () -> guard.requireBound(app));
+        stock.setSkuCode("A");
+        app.setDeliveryMethod("EXPRESS"); assertDoesNotThrow(() -> guard.requireBound(app));
+        app.setDeliveryMethod("PICKUP"); assertDoesNotThrow(() -> guard.requireBound(app));
+        app.setDeliveryMethod("AMAZON_PICKUP"); assertDoesNotThrow(() -> guard.requireBound(app));
+        app.setDeliveryMethod("CUSTOMER_PICKUP"); assertDoesNotThrow(() -> guard.requireBound(app));
+        app.setDeliveryMethod("TRUCK"); assertThrows(ResponseStatusException.class, () -> guard.requireBound(app));
+    }
+    @Test void returnBulkSkuWithoutDeliveryDoesNotBypassPalletBinding() {
+        var guard = new RelabelBindingGuard();
+        var items = mock(RelabelItemMapper.class); var histories = mock(PdaRelabelHistoryMapper.class);
+        var lines = mock(com.baiyue.lastleg.returnreceipt.mapper.ReturnInventoryCartonItemMapper.class);
+        var cartons = mock(ReturnInventoryCartonMapper.class);
+        ReflectionTestUtils.setField(guard, "items", items); ReflectionTestUtils.setField(guard, "histories", histories);
+        ReflectionTestUtils.setField(guard, "returnLines", lines); ReflectionTestUtils.setField(guard, "returnCartons", cartons);
+        ReflectionTestUtils.setField(guard, "objectMapper", new ObjectMapper());
+        var app = new RelabelApplication(); app.setId(1L); app.setCustomerId("2");
+        var item = new RelabelItem(); item.setReturnCartonId(3L); item.setCartonMark("RETURN-BOX");
+        item.setOperationType("RETURN_BULK_SKU_LABEL"); item.setSkuCode("A"); item.setNotifiedPackageCount(3);
+        var stock = new com.baiyue.lastleg.returnreceipt.entity.ReturnInventoryCartonItem();
+        stock.setSkuCode("A"); stock.setQuantity(3L);
+        when(items.selectList(any())).thenReturn(List.of(item)); when(histories.selectList(any())).thenReturn(List.of());
+        when(lines.lockCarton(3L)).thenReturn(List.of(stock));
+
+        var ownedCarton = new com.baiyue.lastleg.returnreceipt.entity.ReturnInventoryCarton(); ownedCarton.setCustomerId("2");
+        when(cartons.selectById(3L)).thenReturn(ownedCarton);
+        var rejected = assertThrows(ResponseStatusException.class, () -> guard.requireBound(app));
+        assertTrue(rejected.getReason().contains("尚未绑定"));
+        verify(cartons).selectById(3L);
+    }
+    @org.junit.jupiter.params.ParameterizedTest
+    @org.junit.jupiter.params.provider.ValueSource(strings = {"TRUCK", "EXPRESS", "PICKUP", "AMAZON_PICKUP", "CUSTOMER_PICKUP"})
+    void physicalBindingMustMatchLatestTargetAndCannotSurviveRework(String deliveryMethod) {
         var guard = new RelabelBindingGuard();
         var items = mock(RelabelItemMapper.class);
         var history = mock(PdaRelabelHistoryMapper.class);
@@ -25,7 +167,7 @@ class RelabelBindingGuardTest {
         ReflectionTestUtils.setField(guard, "histories", history);
         ReflectionTestUtils.setField(guard, "positions", positions);
         ReflectionTestUtils.setField(guard, "objectMapper", new ObjectMapper());
-        var app = new RelabelApplication(); app.setId(1L); app.setCustomerId("2");
+        var app = new RelabelApplication(); app.setId(1L); app.setCustomerId("2"); app.setDeliveryMethod(deliveryMethod);
         var item = new RelabelItem(); item.setCartonMark("A"); item.setOperationType("CARTON_LABEL");
         item.setSourceInventoryPositionId(3L); item.setNotifiedPackageCount(1);
         when(items.selectList(any())).thenReturn(List.of(item));
@@ -39,6 +181,9 @@ class RelabelBindingGuardTest {
         assertThrows(ResponseStatusException.class, () -> guard.requireBound(app));
         position.setPalletNo("NEW");
         assertDoesNotThrow(() -> guard.requireBound(app));
+        position.setOverseasWarehouseId("OTHER");
+        assertThrows(ResponseStatusException.class, () -> guard.requireBound(app));
+        position.setOverseasWarehouseId(null);
         var rework = new PdaRelabelHistory(); rework.setAction("REWORK_ARCHIVE");
         when(history.selectList(any())).thenReturn(List.of(binding, rework));
         assertThrows(ResponseStatusException.class, () -> guard.requireBound(app));
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/relabel/service/RelabelCartonMeasurementServiceTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/relabel/service/RelabelCartonMeasurementServiceTest.java
new file mode 100644
index 000000000..82e6988a2
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/relabel/service/RelabelCartonMeasurementServiceTest.java
@@ -0,0 +1,89 @@
+package com.baiyue.lastleg.relabel.service;
+
+import com.baiyue.lastleg.relabel.entity.*;
+import com.baiyue.lastleg.relabel.mapper.*;
+import com.baiyue.lastleg.relabel.pda.entity.PdaRelabelHistory;
+import com.baiyue.lastleg.relabel.pda.mapper.PdaRelabelHistoryMapper;
+import com.baiyue.lastleg.palletops.dto.PalletOperationRequests.MeasuredCartonBinding;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import org.junit.jupiter.api.*;
+import org.springframework.test.util.ReflectionTestUtils;
+import org.springframework.web.server.ResponseStatusException;
+import java.math.BigDecimal;
+import java.util.*;
+import static org.junit.jupiter.api.Assertions.*;
+import static org.mockito.Mockito.*;
+import static org.mockito.ArgumentMatchers.*;
+
+class RelabelCartonMeasurementServiceTest {
+    final RelabelCartonMeasurementService boxes = new RelabelCartonMeasurementService();
+    final RelabelPalletMeasurementService pallets = new RelabelPalletMeasurementService();
+    final RelabelPalletMeasurementMapper mapper = mock(RelabelPalletMeasurementMapper.class);
+    final PdaRelabelHistoryMapper histories = mock(PdaRelabelHistoryMapper.class);
+    final RelabelItemMapper items = mock(RelabelItemMapper.class);
+    final ObjectMapper json = new ObjectMapper();
+    final RelabelApplication app = new RelabelApplication();
+    final List<PdaRelabelHistory> records = new ArrayList<>();
+    @BeforeEach void setup() {
+        app.setId(1L); app.setCustomerId("7"); app.setRelabelNo("RL-1"); app.setOverseasWarehouseId("92");
+        for (Object service : List.of(boxes,pallets)) {
+            ReflectionTestUtils.setField(service,"mapper",mapper);
+            ReflectionTestUtils.setField(service,"histories",histories);
+            ReflectionTestUtils.setField(service,"json",json);
+        }
+        ReflectionTestUtils.setField(pallets,"items",items);
+        ReflectionTestUtils.setField(pallets,"cartonMeasurements",boxes);
+        when(mapper.transfer("7","RL-1")).thenReturn(10L);
+        when(histories.selectList(any())).thenAnswer(i -> List.copyOf(records));
+        when(mapper.originals("7",10L)).thenReturn(List.of());
+        when(items.selectList(any())).thenReturn(List.of());
+        when(mapper.cartons("7",10L)).thenReturn(List.of(box("BIG",100,60,50,50,"2.5"),box("SMALL1",100,50,40,40,"3.6"),box("SMALL2",100,50,40,40,"3.6")));
+    }
+    RelabelPalletMeasurementMapper.Carton box(String mark,long pallet,int l,int w,int h,String kg) {
+        return new RelabelPalletMeasurementMapper.Carton((long)mark.hashCode(),mark,null,pallet,"P"+pallet,
+            BigDecimal.valueOf(l),BigDecimal.valueOf(w),BigDecimal.valueOf(h),new BigDecimal(kg));
+    }
+    RelabelItem item(String mark) { var i=new RelabelItem(); i.setCartonMark(mark); i.setNotifiedPackageCount(1); return i; }
+    void save(List<RelabelCartonMeasurementService.Move> moves) throws Exception {
+        var h=new PdaRelabelHistory(); h.setAction("PALLET_BIND"); h.setDetailJson(json.writeValueAsString(Map.of("measuredCartons",moves))); records.add(h);
+    }
+    void stock(long source,long target,long third) {
+        when(mapper.stock("7","92")).thenReturn(List.of(new RelabelPalletMeasurementMapper.Stock(1L,100L,"P100",source,1),
+            new RelabelPalletMeasurementMapper.Stock(2L,200L,"P200",target,1),new RelabelPalletMeasurementMapper.Stock(3L,300L,"P300",third,1)));
+    }
+    void totals(long pallet,String cbm,String kg) {
+        var p=pallets.snapshots(app).stream().filter(row -> row.palletId()==pallet).findFirst().orElseThrow();
+        assertTrue(p.cartonAggregated()); assertNull(p.lengthCm());
+        assertEquals(0,new BigDecimal(cbm).compareTo(p.volumeCbm())); assertEquals(0,new BigDecimal(kg).compareTo(p.grossWeightKg()));
+    }
+    @Test void movingMixedBoxSubtractsExactMetricsAndRebindingMovesSameBoxOnce() throws Exception {
+        stock(3,0,0); totals(100,"0.31","9.7");
+        save(boxes.prepare(app,List.of(item("CUSTOMER")),100L,200L,"P200",List.of(new MeasuredCartonBinding("CUSTOMER","SMALL1"))));
+        stock(2,1,0); totals(100,"0.23","6.1"); totals(200,"0.08","3.6");
+        assertDoesNotThrow(() -> pallets.requireMeasured(app));
+        var rebind=boxes.prepare(app,List.of(item("CUSTOMER")),200L,300L,"P300",null);
+        assertEquals("SMALL1",rebind.get(0).sourceCartonMark()); save(rebind); save(rebind);
+        stock(2,0,1); totals(100,"0.23","6.1"); totals(300,"0.08","3.6");
+        assertEquals(3,boxes.current(app).size()); assertDoesNotThrow(() -> pallets.requireMeasured(app));
+    }
+    @Test void equalSpecificationsNeedNoExtraBoxSelection() throws Exception {
+        when(mapper.cartons("7",10L)).thenReturn(List.of(box("A",100,60,50,50,"2.5"),box("B",100,60,50,50,"2.50")));
+        save(boxes.prepare(app,List.of(item("CUSTOMER")),100L,200L,"P200",null));
+        stock(1,1,0); totals(100,"0.15","2.5"); totals(200,"0.15","2.5");
+    }
+    @Test void ambiguousForeignDuplicateAndAlreadyUsedBoxesAreRejected() throws Exception {
+        assertThrows(ResponseStatusException.class,()->boxes.prepare(app,List.of(item("X")),100L,200L,"P200",null));
+        assertThrows(ResponseStatusException.class,()->boxes.prepare(app,List.of(item("X")),100L,200L,"P200",List.of(new MeasuredCartonBinding("X","FOREIGN"))));
+        assertThrows(ResponseStatusException.class,()->boxes.prepare(app,List.of(item("X"),item("Y")),100L,200L,"P200",List.of(new MeasuredCartonBinding("X","BIG"),new MeasuredCartonBinding("Y","BIG"))));
+        save(boxes.prepare(app,List.of(item("X")),100L,200L,"P200",List.of(new MeasuredCartonBinding("X","BIG"))));
+        assertThrows(ResponseStatusException.class,()->boxes.prepare(app,List.of(item("Y")),200L,300L,"P300",List.of(new MeasuredCartonBinding("Y","BIG"))));
+        assertThrows(ResponseStatusException.class,()->boxes.prepare(app,List.of(item("X")),200L,300L,"P300",List.of(new MeasuredCartonBinding("X","SMALL1"))));
+    }
+    @Test void missingBoxMeasurementsOrUntrackedContentsCannotPassCompletion() {
+        when(mapper.cartons("7",10L)).thenReturn(List.of(box("A",100,0,50,50,"2.5")));
+        assertThrows(ResponseStatusException.class,()->boxes.prepare(app,List.of(item("A")),100L,200L,"P200",null));
+        stock(1,0,0); assertThrows(ResponseStatusException.class,()->pallets.requireMeasured(app));
+        when(mapper.cartons("7",10L)).thenReturn(List.of(box("A",100,60,50,50,"2.5")));
+        stock(2,0,0); assertThrows(ResponseStatusException.class,()->pallets.requireMeasured(app));
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/relabel/service/RelabelPalletMeasurementMapperTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/relabel/service/RelabelPalletMeasurementMapperTest.java
new file mode 100644
index 000000000..2fe9e0711
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/relabel/service/RelabelPalletMeasurementMapperTest.java
@@ -0,0 +1,44 @@
+package com.baiyue.lastleg.relabel.service;
+
+import com.baiyue.lastleg.relabel.mapper.RelabelPalletMeasurementMapper;
+import org.apache.ibatis.mapping.Environment;
+import org.apache.ibatis.session.*;
+import org.apache.ibatis.transaction.jdbc.JdbcTransactionFactory;
+import org.junit.jupiter.api.Test;
+import org.springframework.jdbc.core.JdbcTemplate;
+import org.springframework.jdbc.datasource.DriverManagerDataSource;
+import java.util.UUID;
+import static org.assertj.core.api.Assertions.*;
+
+class RelabelPalletMeasurementMapperTest {
+    @Test void realSqlGroupsMeasuredCartonsAndKeepsCustomerTransferAndPalletBoundaries() {
+        var ds = new DriverManagerDataSource("jdbc:h2:mem:" + UUID.randomUUID() + ";MODE=MySQL;DB_CLOSE_DELAY=-1", "sa", "");
+        var db = new JdbcTemplate(ds);
+        db.execute("CREATE TABLE ll_warehouse_transfer_pallet(id BIGINT,customer_id VARCHAR,transfer_order_id BIGINT,warehouse_pallet_id BIGINT,status VARCHAR)");
+        db.execute("CREATE TABLE ll_warehouse_transfer_carton(customer_id VARCHAR,transfer_order_id BIGINT,transfer_pallet_id BIGINT,status VARCHAR,length_cm DECIMAL(12,2),width_cm DECIMAL(12,2),height_cm DECIMAL(12,2),gross_weight_kg DECIMAL(12,3))");
+        db.update("INSERT INTO ll_warehouse_transfer_pallet VALUES(1,'7',10,100,'COMPLETED'),(2,'8',10,200,'COMPLETED'),(3,'7',20,300,'COMPLETED'),(4,'7',10,400,'BOUND')");
+        db.update("INSERT INTO ll_warehouse_transfer_carton VALUES('7',10,1,'COUNTED',60,50,50,2.5),('7',10,1,'COUNTED',60,50,50,2.5),('7',10,1,'COUNTED',50,40,40,3.6),('7',10,1,'NOT_RECEIVED',60,50,50,2.5),('8',10,2,'COUNTED',60,50,50,2.5),('7',20,3,'COUNTED',60,50,50,2.5),('7',10,4,'COUNTED',60,50,50,2.5),('7',10,2,'COUNTED',60,50,50,2.5)");
+        db.execute("ALTER TABLE ll_warehouse_transfer_carton ADD id BIGINT GENERATED BY DEFAULT AS IDENTITY");
+        db.execute("ALTER TABLE ll_warehouse_transfer_carton ADD carton_mark VARCHAR DEFAULT 'BOX'");
+        db.execute("ALTER TABLE ll_warehouse_transfer_carton ADD customer_carton_mark VARCHAR DEFAULT 'CUSTOMER'");
+        db.execute("ALTER TABLE ll_warehouse_transfer_pallet ADD pallet_no VARCHAR DEFAULT 'P100'");
+        var configuration = new Configuration(new Environment("test", new JdbcTransactionFactory(), ds));
+        configuration.addMapper(RelabelPalletMeasurementMapper.class);
+        try (var session = new SqlSessionFactoryBuilder().build(configuration).openSession()) {
+            var rows = session.getMapper(RelabelPalletMeasurementMapper.class).cartonSpecs("7", 10L);
+            assertThat(rows).hasSize(2).allSatisfy(row -> assertThat(row.palletId()).isEqualTo(100L));
+            assertThat(rows.get(0).lengthCm()).isEqualByComparingTo("50");
+            assertThat(rows.get(0).cartons()).isEqualTo(1);
+            assertThat(rows.get(1).lengthCm()).isEqualByComparingTo("60");
+            assertThat(rows.get(1).grossWeightKg()).isEqualByComparingTo("2.5");
+            assertThat(rows.get(1).cartons()).isEqualTo(2);
+            var boxes = session.getMapper(RelabelPalletMeasurementMapper.class).cartons("7", 10L);
+            assertThat(boxes).hasSize(3).allSatisfy(box -> {
+                assertThat(box.palletId()).isEqualTo(100L);
+                assertThat(box.palletCode()).isEqualTo("P100");
+                assertThat(box.cartonMark()).isEqualTo("BOX");
+                assertThat(box.customerCartonMark()).isEqualTo("CUSTOMER");
+            });
+        }
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/relabel/service/RelabelPalletMeasurementServiceTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/relabel/service/RelabelPalletMeasurementServiceTest.java
new file mode 100644
index 000000000..d23417006
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/relabel/service/RelabelPalletMeasurementServiceTest.java
@@ -0,0 +1,126 @@
+package com.baiyue.lastleg.relabel.service;
+
+import com.baiyue.lastleg.relabel.mapper.*;
+import com.baiyue.lastleg.relabel.entity.*;
+import com.baiyue.lastleg.relabel.pda.entity.*;
+import com.baiyue.lastleg.relabel.pda.mapper.*;
+import com.baiyue.lastleg.pda.security.PdaWarehouseIdentity;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import org.junit.jupiter.api.*;
+import org.springframework.test.util.ReflectionTestUtils;
+import org.springframework.web.server.ResponseStatusException;
+import java.math.BigDecimal;
+import java.util.*;
+import static org.junit.jupiter.api.Assertions.*;
+import static org.mockito.Mockito.*;
+import static org.mockito.ArgumentMatchers.*;
+
+class RelabelPalletMeasurementServiceTest {
+    final RelabelPalletMeasurementService service = new RelabelPalletMeasurementService();
+    final RelabelPalletMeasurementMapper mapper = mock(RelabelPalletMeasurementMapper.class);
+    final RelabelApplicationMapper apps = mock(RelabelApplicationMapper.class);
+    final RelabelItemMapper items = mock(RelabelItemMapper.class);
+    final PdaRelabelHistoryMapper histories = mock(PdaRelabelHistoryMapper.class);
+    final PdaRelabelTaskMapper tasks = mock(PdaRelabelTaskMapper.class);
+    final RelabelApplication app = new RelabelApplication();
+    final List<PdaRelabelHistory> records = new ArrayList<>();
+    final ObjectMapper json = new ObjectMapper();
+    @BeforeEach void setup() {
+        ReflectionTestUtils.setField(service,"mapper",mapper); ReflectionTestUtils.setField(service,"applications",apps);
+        ReflectionTestUtils.setField(service,"items",items); ReflectionTestUtils.setField(service,"histories",histories);
+        ReflectionTestUtils.setField(service,"tasks",tasks); ReflectionTestUtils.setField(service,"json",json);
+        ReflectionTestUtils.setField(service,"cartonMeasurements",mock(RelabelCartonMeasurementService.class));
+        app.setId(1L);app.setCustomerId("7");app.setRelabelNo("RL-1");app.setOverseasWarehouseId("92");
+        app.setStatus("READY_FOR_OUTBOUND");app.setFulfillmentStatus("WAIT_PRE_DISPATCH");
+        when(apps.findAnyByRelabelNo("RL-1")).thenReturn(app);when(apps.lockAnyByRelabelNo("RL-1")).thenReturn(app);
+        when(mapper.transfer("7","RL-1")).thenReturn(10L);
+        when(mapper.originals("7",10L)).thenReturn(List.of(new RelabelPalletMeasurementMapper.Original(100L,"OLD",10,
+            new BigDecimal("100"),new BigDecimal("100"),new BigDecimal("100"),new BigDecimal("80"),BigDecimal.ONE)));
+        when(mapper.stock("7","92")).thenReturn(List.of(stock(1,100,"OLD",10,1)));
+        when(items.selectList(any())).thenReturn(List.of());
+        when(histories.selectList(any())).thenAnswer(i -> List.copyOf(records));
+        when(histories.insert(any(PdaRelabelHistory.class))).thenAnswer(i -> { records.add(i.getArgument(0));return 1; });
+        var task = new PdaRelabelTask(); task.setId(2L); task.setStatus("COMPLETED");
+        when(tasks.find("7",1L)).thenReturn(task);
+    }
+    RelabelPalletMeasurementMapper.Stock stock(long id,long pallet,String code,long count,long version) {
+        return new RelabelPalletMeasurementMapper.Stock(id,pallet,code,count,version);
+    }
+    @Test void wholeOriginalPalletInheritsWithoutInventingOrRescalingMeasurements() {
+        var p = service.snapshots(app).get(0);assertTrue(p.inherited()); assertEquals(new BigDecimal("80"),p.grossWeightKg());
+        assertEquals(BigDecimal.ONE,p.volumeCbm());assertDoesNotThrow(() -> service.requireMeasured(app));
+    }
+    @Test void cartonMeasuredSourceShowsRealBoxSpecsWithoutInventingPalletDimensions() {
+        cartonMeasuredSource();
+        var p = service.snapshots(app).get(0);
+        assertTrue(p.inherited()); assertNull(p.lengthCm()); assertNull(p.widthCm()); assertNull(p.heightCm());
+        assertEquals(1, p.sourceCartonSpecs().size());
+        assertEquals(new BigDecimal("60"), p.sourceCartonSpecs().get(0).lengthCm());
+        assertEquals(2, p.sourceCartonSpecs().get(0).cartons());
+        assertEquals(new BigDecimal("5.0"), p.grossWeightKg());
+        assertEquals(new BigDecimal("0.3"), p.volumeCbm());
+        assertDoesNotThrow(() -> service.requireMeasured(app));
+    }
+    @Test void incompleteOrMismatchedSourceCartonsCannotBypassMeasurement() {
+        cartonMeasuredSource();
+        for (var spec : List.of(
+            new RelabelPalletMeasurementMapper.CartonSpec(100L,new BigDecimal("60"),new BigDecimal("50"),new BigDecimal("50"),new BigDecimal("2.5"),1),
+            new RelabelPalletMeasurementMapper.CartonSpec(100L,new BigDecimal("61"),new BigDecimal("50"),new BigDecimal("50"),new BigDecimal("2.5"),2),
+            new RelabelPalletMeasurementMapper.CartonSpec(100L,new BigDecimal("60"),new BigDecimal("50"),new BigDecimal("50"),new BigDecimal("3"),2),
+            new RelabelPalletMeasurementMapper.CartonSpec(100L,BigDecimal.ZERO,new BigDecimal("50"),new BigDecimal("50"),new BigDecimal("2.5"),2))) {
+            when(mapper.cartonSpecs("7",10L)).thenReturn(List.of(spec));
+            assertThrows(ResponseStatusException.class, () -> service.requireMeasured(app));
+        }
+        when(mapper.cartonSpecs("7",10L)).thenReturn(List.of());
+        assertThrows(ResponseStatusException.class, () -> service.requireMeasured(app));
+    }
+    @Test void changedCartonMeasuredPalletMustBeRemeasuredInsteadOfReusingOldBoxSpecs() {
+        cartonMeasuredSource();
+        when(mapper.movements("7",100L)).thenReturn(1);
+        var p = service.snapshots(app).get(0);
+        assertFalse(p.inherited()); assertTrue(p.sourceCartonSpecs().isEmpty());
+        assertNull(p.volumeCbm());
+        assertThrows(ResponseStatusException.class, () -> service.requireMeasured(app));
+    }
+    private void cartonMeasuredSource() {
+        when(mapper.originals("7",10L)).thenReturn(List.of(new RelabelPalletMeasurementMapper.Original(100L,"OLD",2,
+            BigDecimal.ZERO,BigDecimal.ZERO,BigDecimal.ZERO,new BigDecimal("5.0"),new BigDecimal("0.3"))));
+        when(mapper.stock("7","92")).thenReturn(List.of(stock(1,100,"OLD",2,1)));
+        when(mapper.cartonSpecs("7",10L)).thenReturn(List.of(new RelabelPalletMeasurementMapper.CartonSpec(100L,
+            new BigDecimal("60"),new BigDecimal("50"),new BigDecimal("50"),new BigDecimal("2.5"),2)));
+    }
+    @Test void partialSplitRequiresBothNewPalletAndOriginalRemainderMeasurements() throws Exception {
+        split(); var values = service.snapshots(app);assertEquals(2,values.size());
+        assertTrue(values.stream().allMatch(p -> p.volumeCbm()==null && p.grossWeightKg()==null));
+        assertThrows(ResponseStatusException.class,() -> service.requireMeasured(app));
+    }
+    @Test void explicitFinalMeasurementsAreAuditedAndReplayDoesNotDuplicateFacts() throws Exception {
+        split();
+        for (var p : service.snapshots(app)) {
+            var request = new RelabelPalletMeasurementService.Measure("RL-1",p.palletCode(),"measure-"+p.palletId(),p.stockVersion(),
+                new BigDecimal("100"),new BigDecimal("50"),new BigDecimal("50"),new BigDecimal("40"));
+            service.save(identity(),request);service.save(identity(),request);
+        }
+        assertEquals(3,records.size()); // One binding, two measurements.
+        assertDoesNotThrow(() -> service.requireMeasured(app));
+        assertTrue(service.snapshots(app).stream().allMatch(p -> p.volumeCbm().compareTo(new BigDecimal("0.25"))==0));
+        when(mapper.stock("7","92")).thenReturn(List.of(stock(1,100,"OLD",5,3),stock(2,200,"NEW",5,1)));
+        assertThrows(ResponseStatusException.class,() -> service.requireMeasured(app));
+    }
+    @Test void staleAndForeignMeasurementsAndAllocatedOrdersAreRejected() {
+        var request = new RelabelPalletMeasurementService.Measure("RL-1","OLD","key","stale",
+            BigDecimal.ONE,BigDecimal.ONE,BigDecimal.ONE,BigDecimal.ONE);
+        assertThrows(ResponseStatusException.class,() -> service.save(identity(),request));
+        app.setOverseasWarehouseId("93"); assertThrows(ResponseStatusException.class,() -> service.list(identity(),"RL-1"));
+        app.setOverseasWarehouseId("92");app.setFulfillmentStatus("PRE_DISPATCH_CREATED");
+        assertThrows(ResponseStatusException.class,() -> service.save(identity(),request));
+        verify(histories,never()).insert(any(PdaRelabelHistory.class));
+    }
+    private void split() throws Exception {
+        when(mapper.stock("7","92")).thenReturn(List.of(stock(1,100,"OLD",5,2),stock(2,200,"NEW",5,1)));
+        when(mapper.movements("7",100L)).thenReturn(1);
+        var binding = new PdaRelabelHistory();binding.setAction("PALLET_BIND");
+        binding.setDetailJson(json.writeValueAsString(Map.of("sourcePallets",List.of("OLD"),"targetPallets",List.of("NEW")))); records.add(binding);
+    }
+    private PdaWarehouseIdentity identity() { return new PdaWarehouseIdentity("operator","现场人员",92L); }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/relabel/service/RelabelReturnCartonCandidateTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/relabel/service/RelabelReturnCartonCandidateTest.java
index de7433c01..82a15cb76 100644
--- a/lastleg-service/src/test/java/com/baiyue/lastleg/relabel/service/RelabelReturnCartonCandidateTest.java
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/relabel/service/RelabelReturnCartonCandidateTest.java
@@ -20,6 +20,7 @@ class RelabelReturnCartonCandidateTest {
     @Test
     void candidatesIncludeAvailableMergedReturnCartonByWarehouseMark() {
         RelabelApplicationService service = new RelabelApplicationService();
+        ReflectionTestUtils.setField(service, "skuConversionRows", mock(com.baiyue.lastleg.returnreceipt.mapper.ReturnSkuConversionMapper.class));
         InventoryBalanceMapper balances = mock(InventoryBalanceMapper.class);
         InventoryPositionMapper positions = mock(InventoryPositionMapper.class);
         ReturnInventoryCartonMapper cartons = mock(ReturnInventoryCartonMapper.class);
@@ -28,6 +29,7 @@ class RelabelReturnCartonCandidateTest {
         ReflectionTestUtils.setField(service, "inventoryPositions", positions);
         ReflectionTestUtils.setField(service, "returnCartons", cartons);
         ReflectionTestUtils.setField(service, "returnCartonItems", cartonItems);
+        ReflectionTestUtils.setField(service, "returnPackingTraces", mock(com.baiyue.lastleg.returnreceipt.mapper.ReturnPackingTraceMapper.class));
 
         ReturnInventoryCarton carton = new ReturnInventoryCarton();
         carton.setId(9001L); carton.setCustomerId("10001"); carton.setOverseasWarehouseId("WH-1");
@@ -36,9 +38,9 @@ class RelabelReturnCartonCandidateTest {
         ReturnInventoryCartonItem cartonItem = new ReturnInventoryCartonItem();
         cartonItem.setCartonId(9001L); cartonItem.setSkuCode("SKU-RETURN");
         cartonItem.setProductNameZh("退货商品"); cartonItem.setQuantity(12L);
-        when(cartons.findAvailable("10001", "WH-1")).thenReturn(List.of(carton));
+        when(cartons.findRelabelCandidates("10001", "WH-1")).thenReturn(List.of(carton));
         when(cartonItems.listCarton(9001L)).thenReturn(List.of(cartonItem));
-        when(cartons.relabelledQuantity(9001L, "SKU-RETURN")).thenReturn(1L);
+        when(cartons.totalRelabelledQuantity(9001L)).thenReturn(1L);
 
         List<RelabelResponses.InventoryCandidate> result = service.candidates("10001", "WH-1", "RC-WH");
 
@@ -46,8 +48,14 @@ class RelabelReturnCartonCandidateTest {
         assertEquals("RETURN_CARTON", result.get(0).sourceType());
         assertEquals(9001L, result.get(0).returnCartonId());
         assertEquals("RC-WH-0001", result.get(0).cartonMark());
-        assertEquals(11, result.get(0).availablePackages());
+        assertEquals(12, result.get(0).availablePackages());
         assertEquals("SKU-RETURN", result.get(0).skuItems().get(0).skuCode());
-        assertEquals(11, result.get(0).skuItems().get(0).quantity());
+        assertEquals(12, result.get(0).skuItems().get(0).quantity());
+        assertEquals(1, result.get(0).relabelledQuantity());
+        assertEquals("PARTIALLY_COMPLETED", result.get(0).relabelStatus());
+        cartonItem.setPackingReservedQuantity(4L);
+        result = service.candidates("10001", "WH-1", "RC-WH");
+        assertEquals(8, result.get(0).availablePackages());
+        assertEquals(1, result.get(0).relabelledQuantity(), "合箱预占不能冒充实际换标完成量");
     }
 }
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/relabel/service/ReturnRelabelDeliveryTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/relabel/service/ReturnRelabelDeliveryTest.java
index b8705c22b..a19d418ee 100644
--- a/lastleg-service/src/test/java/com/baiyue/lastleg/relabel/service/ReturnRelabelDeliveryTest.java
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/relabel/service/ReturnRelabelDeliveryTest.java
@@ -1,6 +1,11 @@
 package com.baiyue.lastleg.relabel.service;
 
 import com.baiyue.lastleg.delivery.entity.DeliveryOrder;
+import com.baiyue.lastleg.delivery.entity.OutboundOrder;
+import com.baiyue.lastleg.delivery.entity.OutboundPalletItem;
+import com.baiyue.lastleg.fleet.customer.FleetCustomerDirectory;
+import com.baiyue.lastleg.fleet.driver.FleetWarehouseDirectory;
+import com.baiyue.lastleg.fleet.driver.DriverModels;
 import com.baiyue.lastleg.delivery.mapper.*;
 import com.baiyue.lastleg.relabel.entity.*;
 import com.baiyue.lastleg.relabel.mapper.RelabelItemMapper;
@@ -12,11 +17,82 @@ import org.junit.jupiter.api.Test;
 import org.springframework.test.util.ReflectionTestUtils;
 import java.time.LocalDateTime;
 import java.util.List;
+import java.math.BigDecimal;
+import org.mockito.ArgumentCaptor;
+import org.springframework.web.server.ResponseStatusException;
+import static org.junit.jupiter.api.Assertions.*;
 import static org.mockito.Mockito.*;
 import static org.mockito.ArgumentMatchers.*;
 
 class ReturnRelabelDeliveryTest {
-    @Test void directNativeRelabelCreatesTwoPhysicalBoxesAndOneDeliveryPerDestination() {
+    @org.junit.jupiter.params.ParameterizedTest
+    @org.junit.jupiter.params.provider.ValueSource(strings = {"EXPRESS", "PICKUP", "AMAZON_PICKUP", "CUSTOMER_PICKUP"})
+    void directNativeRelabelSnapshotsNamesAndCountsMeasuredBoxesOncePerDestination(String deliveryMethod) {
+        var f = fixture(deliveryMethod);
+        f.create();
+        verify(f.deliveries, times(2)).insert(any(DeliveryOrder.class));
+        var rows = ArgumentCaptor.forClass(DeliveryOrder.class);
+        verify(f.deliveries, times(2)).insert(rows.capture());
+        for (var row : rows.getAllValues()) {
+            assertEquals("测试客户", row.getCustomerName()); assertEquals("洛杉矶测试仓", row.getOverseasWarehouseName());
+            assertEquals("100", row.getOverseasWarehouseId()); assertEquals(deliveryMethod, row.getDeliveryMethod());
+            assertEquals("WAIT_DELIVERY", row.getStatus()); assertEquals(f.application.getOutboundOrderNo(), row.getOutboundNo());
+            int boxes = "A".equals(row.getDestinationWarehouseCode()) ? 2 : 1;
+            assertEquals(boxes, row.getPackageCount());
+            assertEquals(0, BigDecimal.valueOf(boxes).compareTo(row.getTotalWeightKg()));
+            assertEquals(0, new BigDecimal("0.008").multiply(BigDecimal.valueOf(boxes)).compareTo(row.getTotalVolumeCbm()));
+        }
+        var outbound = ArgumentCaptor.forClass(OutboundOrder.class);
+        verify(f.outbounds).insert(outbound.capture());
+        assertEquals(3, outbound.getValue().getPackageCount());
+        assertEquals(0, new BigDecimal("3").compareTo(outbound.getValue().getGrossWeightKg()));
+        assertEquals(0, new BigDecimal("0.024").compareTo(outbound.getValue().getVolumeCbm()));
+        var physical = ArgumentCaptor.forClass(OutboundPalletItem.class);
+        verify(f.outboundItems, times(3)).insert(physical.capture());
+        assertTrue(physical.getAllValues().stream().allMatch(row -> row.getPackageCount() == 1
+            && BigDecimal.ONE.compareTo(row.getGrossWeightKg()) == 0 && new BigDecimal("0.008").compareTo(row.getVolumeCbm()) == 0));
+        verify(f.customers, times(1)).find("C1"); verify(f.warehouses, times(1)).required(100L, "OVERSEAS");
+    }
+
+    @Test
+    void incompleteMeasurementStaysUnknownWithoutBlockingAndDoesNotContaminateOtherDestination() {
+        var f = fixture("AMAZON_PICKUP");
+        f.cartonRows.get(0).setWeight(null); f.cartonRows.get(0).setHeight(null);
+        f.create();
+        var rows = ArgumentCaptor.forClass(DeliveryOrder.class); verify(f.deliveries, times(2)).insert(rows.capture());
+        var a = rows.getAllValues().stream().filter(row -> "A".equals(row.getDestinationWarehouseCode())).findFirst().orElseThrow();
+        var b = rows.getAllValues().stream().filter(row -> "B".equals(row.getDestinationWarehouseCode())).findFirst().orElseThrow();
+        assertNull(a.getTotalWeightKg()); assertNull(a.getTotalVolumeCbm());
+        assertEquals(0, BigDecimal.ONE.compareTo(b.getTotalWeightKg()));
+        assertEquals(0, new BigDecimal("0.008").compareTo(b.getTotalVolumeCbm()));
+        var outbound = ArgumentCaptor.forClass(OutboundOrder.class); verify(f.outbounds).insert(outbound.capture());
+        assertNull(outbound.getValue().getGrossWeightKg()); assertNull(outbound.getValue().getVolumeCbm());
+    }
+
+    @org.junit.jupiter.params.ParameterizedTest
+    @org.junit.jupiter.params.provider.ValueSource(strings = {"customer-name", "customer-id", "warehouse-name", "warehouse-id", "unavailable"})
+    void invalidDirectorySnapshotDoesNotCreateAnyDocument(String failure) {
+        var f = fixture("CUSTOMER_PICKUP");
+        if (failure.startsWith("customer")) when(f.customers.find("C1")).thenReturn(new FleetCustomerDirectory.Customer(
+            "customer-id".equals(failure) ? "OTHER" : "C1", "C", "customer-name".equals(failure) ? " " : "客户", null, null));
+        else if (failure.startsWith("warehouse")) when(f.warehouses.required(100L, "OVERSEAS")).thenReturn(new DriverModels.WarehouseOption(
+            "warehouse-id".equals(failure) ? "200" : "100", "WH", "warehouse-name".equals(failure) ? " " : "仓库", "OVERSEAS"));
+        else when(f.customers.find("C1")).thenThrow(new ResponseStatusException(org.springframework.http.HttpStatus.SERVICE_UNAVAILABLE));
+        assertThrows(ResponseStatusException.class, f::create);
+        verify(f.outbounds, never()).insert(any(OutboundOrder.class));
+        verifyNoInteractions(f.deliveries, f.outboundItems);
+    }
+
+    @Test
+    void existingOutboundReplayDoesNotRefreshNamesOrMeasurements() {
+        var f = fixture("PICKUP"); var existing = new OutboundOrder(); existing.setOutboundNo("OUT-EXISTING");
+        when(f.outbounds.findByIdempotency("C1", "RELABEL:1:OUTBOUND")).thenReturn(existing);
+        f.create();
+        assertEquals("OUT-EXISTING", f.application.getOutboundOrderNo());
+        verifyNoInteractions(f.customers, f.warehouses, f.deliveries, f.outboundItems);
+    }
+
+    private Fixture fixture(String deliveryMethod) {
         var service = new RelabelApplicationService();
         var items = mock(RelabelItemMapper.class);
         var cartons = mock(ReturnInventoryCartonMapper.class);
@@ -24,26 +100,36 @@ class ReturnRelabelDeliveryTest {
         ReflectionTestUtils.setField(service, "items", items);
         ReflectionTestUtils.setField(service, "returnCartons", cartons);
         ReflectionTestUtils.setField(service, "deliveryOrders", deliveries);
-        ReflectionTestUtils.setField(service, "outboundOrders", mock(OutboundOrderMapper.class));
-        ReflectionTestUtils.setField(service, "outboundItems", mock(OutboundPalletItemMapper.class));
+        var outbounds = mock(OutboundOrderMapper.class); var outboundItems = mock(OutboundPalletItemMapper.class);
+        ReflectionTestUtils.setField(service, "outboundOrders", outbounds);
+        ReflectionTestUtils.setField(service, "outboundItems", outboundItems);
+        var customers = mock(FleetCustomerDirectory.class); var warehouses = mock(FleetWarehouseDirectory.class);
+        ReflectionTestUtils.setField(service, "customerDirectory", customers); ReflectionTestUtils.setField(service, "warehouseDirectory", warehouses);
+        when(customers.find("C1")).thenReturn(new FleetCustomerDirectory.Customer("C1", "C", "测试客户", null, null));
+        when(warehouses.required(100L, "OVERSEAS")).thenReturn(new DriverModels.WarehouseOption("100", "WH", "洛杉矶测试仓", "OVERSEAS"));
         ReflectionTestUtils.setField(service, "outboundTasks", mock(OutboundPdaTaskMapper.class));
         ReflectionTestUtils.setField(service, "orderNoGenerator", new LastlegOrderNoGenerator());
         ReflectionTestUtils.setField(service, "objectMapper", new ObjectMapper());
         var application = new RelabelApplication(); application.setId(1L); application.setCustomerId("C1");
-        application.setRelabelNo("REL1"); application.setOverseasWarehouseId("WH1"); application.setDeliveryMethod("EXPRESS");
-        var a = source(10L, "A"); var b = source(11L, "B");
-        when(items.selectList(any())).thenReturn(List.of(a, b));
-        for (var item : List.of(a, b)) {
+        application.setRelabelNo("REL1"); application.setOverseasWarehouseId("100"); application.setDeliveryMethod(deliveryMethod);
+        var sources = List.of(source(10L, "A"), source(11L, "B"), source(12L, "A"));
+        when(items.selectList(any())).thenReturn(sources);
+        var cartonRows = new java.util.ArrayList<ReturnInventoryCarton>();
+        for (var item : sources) {
             var carton = new ReturnInventoryCarton(); carton.setId(item.getReturnCartonId());
             carton.setCustomerId("C1"); carton.setRelabelApplicationId(1L); carton.setStatus("RELABEL_PENDING");
+            carton.setOverseasWarehouseId("100"); carton.setCountStatus("CONFIRMED"); carton.setSourceUnitType("PALLET");
+            carton.setWeight(BigDecimal.ONE); carton.setLength(new BigDecimal("20"));
+            carton.setWidth(new BigDecimal("20")); carton.setHeight(new BigDecimal("20"));
+            carton.setTotalQuantity(5L); carton.setSkuTypes(2); cartonRows.add(carton);
             when(cartons.lockId(carton.getId())).thenReturn(carton);
         }
-        ReflectionTestUtils.invokeMethod(service, "createDirectOutbound", application, "OP1", LocalDateTime.now());
-        verify(deliveries, times(2)).insert(any(DeliveryOrder.class));
-        verify(deliveries).insert(argThat((DeliveryOrder d) -> "A".equals(d.getDestinationWarehouseCode())
-            && d.getPackageCount() == 1 && "WAIT_DELIVERY".equals(d.getStatus())
-            && application.getOutboundOrderNo().equals(d.getOutboundNo())));
-        verify(deliveries).insert(argThat((DeliveryOrder d) -> "B".equals(d.getDestinationWarehouseCode()) && d.getPackageCount() == 1));
+        return new Fixture(service, application, customers, warehouses, deliveries, outbounds, outboundItems, cartonRows);
+    }
+    private record Fixture(RelabelApplicationService service, RelabelApplication application, FleetCustomerDirectory customers,
+                           FleetWarehouseDirectory warehouses, DeliveryOrderMapper deliveries, OutboundOrderMapper outbounds,
+                           OutboundPalletItemMapper outboundItems, List<ReturnInventoryCarton> cartonRows) {
+        void create() { ReflectionTestUtils.invokeMethod(service, "createDirectOutbound", application, "OP1", LocalDateTime.now()); }
     }
     private RelabelItem source(long id, String destination) {
         var item = new RelabelItem(); item.setId(id); item.setReturnCartonId(id);
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/relabel/service/ReturnRelabelPackingServiceTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/relabel/service/ReturnRelabelPackingServiceTest.java
new file mode 100644
index 000000000..abb574200
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/relabel/service/ReturnRelabelPackingServiceTest.java
@@ -0,0 +1,107 @@
+package com.baiyue.lastleg.relabel.service;
+
+import com.baiyue.lastleg.pda.security.PdaWarehouseIdentity;
+import com.baiyue.lastleg.relabel.entity.*;
+import com.baiyue.lastleg.relabel.mapper.RelabelItemMapper;
+import com.baiyue.lastleg.returnreceipt.dto.*;
+import com.baiyue.lastleg.returnreceipt.entity.*;
+import com.baiyue.lastleg.returnreceipt.mapper.*;
+import com.baiyue.lastleg.returnreceipt.service.ReturnInventoryService;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import org.junit.jupiter.api.Test;
+import org.springframework.test.util.ReflectionTestUtils;
+import org.springframework.web.server.ResponseStatusException;
+import java.math.BigDecimal;
+import java.util.List;
+import static org.junit.jupiter.api.Assertions.*;
+import static org.mockito.Mockito.*;
+import static org.mockito.ArgumentMatchers.*;
+
+class ReturnRelabelPackingServiceTest {
+    @org.junit.jupiter.params.ParameterizedTest
+    @org.junit.jupiter.params.provider.ValueSource(booleans = {false, true})
+    void skuPackingMovesCompletionToIndependentCartonAndKeepsOriginalSourceMarks(boolean inheritedCompletion) {
+        var service = new ReturnRelabelPackingService();
+        var cartons = mock(ReturnInventoryCartonMapper.class);
+        var items = mock(RelabelItemMapper.class);
+        var inventory = mock(ReturnInventoryService.class);
+        ReflectionTestUtils.setField(service, "cartons", cartons);
+        ReflectionTestUtils.setField(service, "items", items);
+        ReflectionTestUtils.setField(service, "inventory", inventory);
+        ReflectionTestUtils.setField(service, "json", new ObjectMapper());
+        var app = new RelabelApplication(); app.setId(1L); app.setCustomerId("2"); app.setRelabelNo("RL1");
+        var first = item(10L, 20L, "A"); var second = item(11L, 21L, "B");
+        var a = carton(20L, "A"); var b = carton(21L, "B"); var target = carton(22L, "NEW");
+        var history = mock(com.baiyue.lastleg.relabel.pda.mapper.PdaRelabelHistoryMapper.class);
+        ReflectionTestUtils.setField(service, "histories", history);
+        if (inheritedCompletion) {
+            var prior = item(9L, 20L, "A"); prior.setApplicationId(99L);
+            prior.setSkuRelabelItemsJson("[{\"skuCode\":\"SKU\",\"quantity\":6}]");
+            when(items.priorCompletedReturnItems("2", 20L, 1L)).thenReturn(List.of(prior));
+            var facts = mock(com.baiyue.lastleg.relabel.pda.mapper.PdaRelabelUnitFactMapper.class);
+            var fact = new com.baiyue.lastleg.relabel.pda.entity.PdaRelabelUnitFact(); fact.setItemId(9L); fact.setQuantity(1);
+            when(facts.selectList(any())).thenReturn(List.of(fact));
+            ReflectionTestUtils.setField(service, "facts", facts);
+            var physical = mock(ReturnInventoryCartonItemMapper.class);
+            var line = new ReturnInventoryCartonItem(); line.setSkuCode("SKU"); line.setQuantity(6L);
+            when(physical.lockCarton(20L)).thenReturn(List.of(line));
+            ReflectionTestUtils.setField(service, "cartonItems", physical);
+            ReflectionTestUtils.setField(service, "completionLedger", mock(ReturnRelabelCompletionLedgerMapper.class));
+            var tasks = mock(com.baiyue.lastleg.relabel.pda.mapper.PdaRelabelTaskMapper.class);
+            var task = new com.baiyue.lastleg.relabel.pda.entity.PdaRelabelTask(); task.setId(100L);
+            when(tasks.find("2", 1L)).thenReturn(task); ReflectionTestUtils.setField(service, "tasks", tasks);
+        }
+        when(cartons.lockMark("A")).thenReturn(a); when(cartons.lockMark("B")).thenReturn(b);
+        when(cartons.lockMark("NEW")).thenReturn(target);
+        when(inventory.mergeBoxes(any(), any())).thenAnswer(call -> {
+            var request = (ReturnInventoryRequests.BoxMerge)call.getArgument(1);
+            assertEquals(List.of("A", "B"), request.sourceCartonMarks());
+            assertNull(request.targetCartonMark());
+            assertEquals(List.of(new ReturnInventoryRequests.SourceDeduction("A", "SKU", 3),
+                new ReturnInventoryRequests.SourceDeduction("B", "SKU", 3)), request.sourceDeductions());
+            return new ReturnInventoryResponses.MergeResult("NEW", "SKU", 6, null);
+        });
+        var result = service.pack(new PdaWarehouseIdentity("op", "picker", 42L), app, List.of(first, second),
+            new ReturnInventoryRequests.BoxMerge(List.of("A", "B"), null, "key", null,
+                BigDecimal.TEN, BigDecimal.TEN, BigDecimal.TEN, BigDecimal.ONE));
+        assertEquals("NEW", result.cartonMark());
+        assertEquals(22L, first.getReturnCartonId()); assertEquals(22L, second.getReturnCartonId());
+        assertEquals("A", first.getSourceCartonMark()); assertEquals("B", second.getSourceCartonMark());
+        assertEquals("RELABEL_PENDING", target.getStatus());
+        verify(cartons).clearRelabel(20L); verify(cartons).clearRelabel(21L);
+        verify(items).updateById(first); verify(items).updateById(second);
+        if (inheritedCompletion) {
+            var saved = org.mockito.ArgumentCaptor.forClass(com.baiyue.lastleg.relabel.pda.entity.PdaRelabelHistory.class);
+            verify(history).insert(saved.capture());
+            assertEquals("RETURN_COMPLETION_TRANSFER", saved.getValue().getAction());
+            assertTrue(saved.getValue().getDetailJson().contains("\"sourceItemIds\":[\"9\"]"));
+            assertTrue(saved.getValue().getDetailJson().contains("\"quantity\":3"));
+            assertTrue(saved.getValue().getDetailJson().contains("\"targetCartonMark\":\"NEW\""));
+        } else verifyNoInteractions(history);
+    }
+
+    @Test void wrongSourceAndDifferentDestinationCannotEnterInventoryMutation() {
+        var service = new ReturnRelabelPackingService();
+        var inventory = mock(ReturnInventoryService.class);
+        ReflectionTestUtils.setField(service, "inventory", inventory);
+        var app = new RelabelApplication();
+        var a = item(10L, 20L, "A"); var b = item(11L, 21L, "B"); b.setDestinationFbaWarehouseCode("OTHER");
+        assertThrows(ResponseStatusException.class, () -> service.pack(new PdaWarehouseIdentity("op", "name", 42L), app,
+            List.of(a), new ReturnInventoryRequests.BoxMerge(List.of("OTHER"), null, "wrong")));
+        assertThrows(ResponseStatusException.class, () -> service.pack(new PdaWarehouseIdentity("op", "name", 42L), app,
+            List.of(a, b), new ReturnInventoryRequests.BoxMerge(List.of("A", "B"), null, "dest")));
+        verifyNoInteractions(inventory);
+    }
+    private RelabelItem item(long id, long cartonId, String mark) {
+        var item = new RelabelItem(); item.setId(id); item.setReturnCartonId(cartonId);
+        item.setCartonMark(mark); item.setSourceCartonMark(mark); item.setOperationType("SKU_LABEL");
+        item.setNotifiedPackageCount(1); item.setDestinationFbaWarehouseCode("FBA");
+        item.setSkuRelabelItemsJson("[{\"skuCode\":\"SKU\",\"newSkuCode\":\"NEW-SKU\",\"quantity\":3}]");
+        return item;
+    }
+    private ReturnInventoryCarton carton(long id, String mark) {
+        var carton = new ReturnInventoryCarton(); carton.setId(id); carton.setCartonMark(mark);
+        carton.setCustomerId("2"); carton.setRelabelApplicationId(1L); carton.setStatus("RELABEL_PENDING");
+        return carton;
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/returnreceipt/service/ReturnCartonCountServiceTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/returnreceipt/service/ReturnCartonCountServiceTest.java
index bbbb95cf8..44572c72a 100644
--- a/lastleg-service/src/test/java/com/baiyue/lastleg/returnreceipt/service/ReturnCartonCountServiceTest.java
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/returnreceipt/service/ReturnCartonCountServiceTest.java
@@ -65,8 +65,9 @@ class ReturnCartonCountServiceTest {
         when(cartons.lockReceipt(1L)).thenReturn(List.of(a,b));
         when(receiptItems.listReceipt(1L)).thenReturn(expected);
     }
+    private CountBox measuredBox(String mark, List<CountItem> lines) { return new CountBox(mark, lines, java.math.BigDecimal.ONE, java.math.BigDecimal.ONE, java.math.BigDecimal.ONE, java.math.BigDecimal.ONE); }
     private Confirm unequal(long first, long second) {
-        return new Confirm("retry", List.of(new CountBox(a.getCartonMark(),List.of(new CountItem("SKU1",first))),new CountBox(b.getCartonMark(),List.of(new CountItem("SKU1",second)))));
+        return new Confirm("retry", List.of(measuredBox(a.getCartonMark(),List.of(new CountItem("SKU1",first))),measuredBox(b.getCartonMark(),List.of(new CountItem("SKU1",second)))));
     }
     @Test void unequalBoxesAreConfirmedWithoutChangingSkuUnitBalanceAndRetryIsStable() {
         prepare(List.of(expected("SKU1",10)));
@@ -97,7 +98,7 @@ class ReturnCartonCountServiceTest {
         when(items.lockCarton(3L)).thenReturn(List.of(provisional(3,"SKU2",4)));
         when(balances.adjustCartonQuantity("C1","123","SKU1",1)).thenReturn(1);
         when(balances.adjustCartonQuantity("C1","123","SKU2",1)).thenReturn(1);
-        var request = new Confirm("mixed",List.of(new CountBox(a.getCartonMark(),List.of(new CountItem("SKU1",2),new CountItem("SKU2",1))),new CountBox(b.getCartonMark(),List.of(new CountItem("SKU1",4),new CountItem("SKU2",3)))));
+        var request = new Confirm("mixed",List.of(measuredBox(a.getCartonMark(),List.of(new CountItem("SKU1",2),new CountItem("SKU2",1))),measuredBox(b.getCartonMark(),List.of(new CountItem("SKU1",4),new CountItem("SKU2",3)))));
         service.confirm(identity,"RR-1",request);
         verify(balances).adjustCartonQuantity("C1","123","SKU1",1); verify(balances).adjustCartonQuantity("C1","123","SKU2",1);
         verifyNoMoreInteractions(balances); assertThat(a.getSkuTypes()).isEqualTo(2);
@@ -110,7 +111,7 @@ class ReturnCartonCountServiceTest {
     }
     @Test void duplicateOrForeignBoxesCannotBeSubmitted() {
         prepare(List.of(expected("SKU1",10)));
-        var request = new Confirm("dup",List.of(new CountBox(a.getCartonMark(),List.of(new CountItem("SKU1",5))),new CountBox(a.getCartonMark(),List.of(new CountItem("SKU1",5)))));
+        var request = new Confirm("dup",List.of(measuredBox(a.getCartonMark(),List.of(new CountItem("SKU1",5))),measuredBox(a.getCartonMark(),List.of(new CountItem("SKU1",5)))));
         assertThatThrownBy(() -> service.confirm(identity,"RR-1",request)).isInstanceOf(ResponseStatusException.class).hasMessageContaining("重复");
         verify(items,never()).deleteCarton(anyLong());
     }
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/returnreceipt/service/ReturnInventoryMovementSqlTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/returnreceipt/service/ReturnInventoryMovementSqlTest.java
new file mode 100644
index 000000000..9d044f40b
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/returnreceipt/service/ReturnInventoryMovementSqlTest.java
@@ -0,0 +1,65 @@
+package com.baiyue.lastleg.returnreceipt.service;
+
+import com.baiyue.lastleg.returnreceipt.mapper.ReturnInventoryMovementMapper;
+import org.apache.ibatis.builder.annotation.MapperAnnotationBuilder;
+import org.apache.ibatis.session.Configuration;
+import org.junit.jupiter.api.Test;
+
+import java.util.Map;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.List;
+import java.util.regex.Pattern;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+class ReturnInventoryMovementSqlTest {
+    @Test
+    void unionSourceColumnsHaveExplicitMatchingCollationsInBothBaselinesAndMigration() throws Exception {
+        Map<String, List<String>> fields = Map.of(
+                "ll_return_order", List.of("customer_id", "overseas_warehouse_id"),
+                "ll_return_order_item", List.of("sku_code", "product_name_zh"),
+                "ll_return_receipt", List.of("receipt_no"),
+                "ll_return_receipt_item", List.of("sku_code"),
+                "ll_return_inventory_carton", List.of("customer_id", "overseas_warehouse_id", "carton_mark"),
+                "ll_return_inventory_carton_item", List.of("sku_code", "product_name_zh"),
+                "ll_return_inventory_outbound_movement", List.of("customer_id", "overseas_warehouse_id", "sku_code", "product_name_zh", "outbound_no"),
+                "ll_return_sku_conversion", List.of("customer_id", "overseas_warehouse_id", "old_sku_code", "new_sku_code", "product_name_zh", "relabel_no"));
+        for (Path file : List.of(Path.of("src/main/resources/db/lastleg.sql"),
+                Path.of("../deploy/sql/海外区域统一增量-MySQL8.sql"),
+                Path.of("../deploy/sql/migrations/overseas/baiyue_lastleg/V23__align_return_movement_collation.sql"))) {
+            String sql = Files.readString(file);
+            for (var entry : fields.entrySet()) {
+                var block = Pattern.compile("(?s)(?:CREATE TABLE (?:IF NOT EXISTS )?|ALTER TABLE )" + entry.getKey() + "\\b.*?;").matcher(sql);
+                assertTrue(block.find(), file + ": " + entry.getKey());
+                for (String column : entry.getValue()) {
+                    assertTrue(Pattern.compile("(?i)\\b" + column + "\\s+varchar\\(\\d+\\) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci").matcher(block.group()).find(),
+                            file + ": " + entry.getKey() + "." + column);
+                }
+            }
+        }
+        String standalone = Files.readString(Path.of("src/main/resources/db/return-sku-conversion.sql"));
+        for (String column : fields.get("ll_return_sku_conversion"))
+            assertTrue(Pattern.compile("\\b" + column + "\\s+VARCHAR\\(\\d+\\) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci").matcher(standalone).find());
+    }
+
+    @Test
+    void countAndPageKeepOriginalProjectionAndScopeFilters() {
+        Configuration configuration = new Configuration();
+        new MapperAnnotationBuilder(configuration, ReturnInventoryMovementMapper.class).parse();
+        Map<String, Object> params = Map.of("customerId", "CUSTOMER", "warehouseId", "WAREHOUSE",
+                "skuCode", "SKU", "offset", 0L, "size", 20L);
+        for (String method : new String[]{"platformCount", "platformPage"}) {
+            var boundSql = configuration.getMappedStatement(ReturnInventoryMovementMapper.class.getName() + "." + method)
+                    .getBoundSql(params);
+            String sql = boundSql.getSql();
+            assertEquals(7, sql.split("UNION ALL", -1).length);
+            assertTrue(!sql.contains("CONVERT("));
+            assertTrue(sql.contains("m.customerId=?"));
+            assertTrue(sql.contains("m.overseasWarehouseId=?"));
+            assertTrue(sql.contains("m.skuCode LIKE CONCAT('%',?,'%')"));
+            assertEquals(method.equals("platformPage") ? 5 : 3, boundSql.getParameterMappings().size());
+        }
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/returnreceipt/service/ReturnInventoryServiceTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/returnreceipt/service/ReturnInventoryServiceTest.java
index f5485a34a..811b5fe36 100644
--- a/lastleg-service/src/test/java/com/baiyue/lastleg/returnreceipt/service/ReturnInventoryServiceTest.java
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/returnreceipt/service/ReturnInventoryServiceTest.java
@@ -42,6 +42,34 @@ import org.springframework.web.server.ResponseStatusException;
 
 @ExtendWith(MockitoExtension.class)
 class ReturnInventoryServiceTest {
+    @Test
+    void platformStockIncludesRelabelLockedQuantity() {
+        var balance = new com.baiyue.lastleg.returnreceipt.entity.ReturnInventoryBalance();
+        balance.setCustomerId("10001"); balance.setOverseasWarehouseId("42"); balance.setSkuCode("SKU-A");
+        balance.setTotalQuantity(100L); balance.setAvailableQuantity(50L); balance.setRelabelLockedQuantity(30L);
+        when(balances.platformCount("10001", "42", "SKU-A")).thenReturn(1L);
+        when(balances.platformPage("10001", "42", "SKU-A", 0L, 20L)).thenReturn(List.of(balance));
+
+        var result = service.platformStockPage(new ReturnInventoryRequests.PlatformQuery(1, 20, "10001", "42", "SKU-A", null, null, null));
+
+        assertThat(result.records().get(0).relabelLockedQuantity()).isEqualTo(30L);
+        assertThat(result.records().get(0).availableQuantity()).isEqualTo(50L);
+    }
+    @Test
+    void summarySeparatesRelabelLockedStockFromOtherUnavailableStock() {
+        var balance = new com.baiyue.lastleg.returnreceipt.entity.ReturnInventoryBalance();
+        balance.setOverseasWarehouseId("42"); balance.setSkuCode("SKU-A");
+        balance.setTotalQuantity(100L); balance.setAvailableQuantity(50L);
+        balance.setRelabelLockedQuantity(30L); balance.setCartonQuantity(3L);
+        when(balances.countPage("10001", "42", "SKU-A")).thenReturn(1L);
+        when(balances.page("10001", "42", "SKU-A", 0L, 20L)).thenReturn(List.of(balance));
+
+        var result = service.summaryPage("10001", new ReturnInventoryRequests.SummaryQuery(1, 20, "42", "SKU-A"));
+
+        assertThat(result.records().get(0).relabelLockedQuantity()).isEqualTo(30L);
+        assertThat(result.records().get(0).availableQuantity()).isEqualTo(50L);
+        assertThat(result.records().get(0).totalQuantity()).isEqualTo(100L);
+    }
     @Mock ReturnInventoryCartonMapper cartons;
     @Mock ReturnInventoryCartonItemMapper cartonItems;
     @Mock ReturnInventoryBalanceMapper balances;
@@ -60,6 +88,7 @@ class ReturnInventoryServiceTest {
     @BeforeEach
     void setUp() {
         service = new ReturnInventoryService();
+        ReflectionTestUtils.setField(service, "skuConversions", org.mockito.Mockito.mock(com.baiyue.lastleg.returnreceipt.mapper.ReturnSkuConversionMapper.class));
         ReflectionTestUtils.setField(service, "cartons", cartons);
         ReflectionTestUtils.setField(service, "cartonItems", cartonItems);
         ReflectionTestUtils.setField(service, "balances", balances);
@@ -127,7 +156,7 @@ class ReturnInventoryServiceTest {
     }
 
     @Test
-    void pendingReceiptDetailsDoNotExposeProvisionalAveragesAndParcelsHaveNoBoxes() {
+    void pendingReceiptDetailsDoNotExposeProvisionalAveragesForPhysicalUnits() {
         var receipt = new ReturnReceipt(); receipt.setId(21L); receipt.setCustomerId("C1"); receipt.setReceiptNo("RR-1"); receipt.setUnitType("PALLET");
         var box = new ReturnInventoryCarton(); box.setCartonMark("RC#2-1"); box.setCountStatus("PENDING"); box.setTotalQuantity(5L);
         when(cartons.listReceipt(21L)).thenReturn(List.of(box));
@@ -135,14 +164,15 @@ class ReturnInventoryServiceTest {
         assertThat(detail.get(0).countStatus()).isEqualTo("PENDING");
         assertThat(detail.get(0).items()).isEmpty();
         receipt.setUnitType("PARCEL");
-        assertThat(service.receiptContents(receipt)).isEmpty();
+        assertThat(service.receiptContents(receipt)).hasSize(1);
         verifyNoInteractions(cartonItems);
     }
 
     @Test
     void boxSigningStoresActualContentsAsImmutableReceiptSnapshot() {
         var receipt = new ReturnReceipt(); receipt.setId(21L); receipt.setReceiptNo("RR-BOX"); receipt.setUnitType("BOX"); receipt.setUnitCode("RC-BOX"); receipt.setOperatorId("operator-1");
-        service.createReceiptCarton(completedOrder(), receipt, "RC-BOX", List.of(new ReturnInventoryService.ReceiptLine("A", "商品A", 3), new ReturnInventoryService.ReceiptLine("B", "商品B", 7)));
+        var source = service.createReceiptCarton(completedOrder(), receipt, "RC-BOX", List.of(new ReturnInventoryService.ReceiptLine("A", "商品A", 3), new ReturnInventoryService.ReceiptLine("B", "商品B", 7)));
+        assertThat(source.getLabelStatus()).isEqualTo("CONFIRMED");
         var capture = ArgumentCaptor.forClass(com.baiyue.lastleg.returnreceipt.entity.ReturnInventoryOperation.class);
         verify(operations).insert(capture.capture());
         assertThat(capture.getValue().getOperationType()).isEqualTo("SIGN_CONTENTS");
@@ -150,13 +180,14 @@ class ReturnInventoryServiceTest {
     }
 
     @Test
-    void parcelSigningStoresLooseSkuSourceWithoutGeneratingCartonNumberOrIncreasingBoxCount() {
+    void parcelSigningCreatesOneLabelledPhysicalUnitWithoutIncreasingBoxCount() {
         var receipt = new ReturnReceipt(); receipt.setId(21L); receipt.setUnitType("PARCEL"); receipt.setUnitCode("PK-1");
         var source = service.createReceiptCarton(completedOrder(), receipt, null,
             List.of(new ReturnInventoryService.ReceiptLine("A", "商品A", 3)));
-        assertThat(source.getCartonMark()).startsWith("SP");
+        assertThat(source.getCartonMark()).startsWith("RP-").hasSizeLessThanOrEqualTo(16);
         assertThat(source.getSourceUnitType()).isEqualTo("PARCEL");
-        verifyNoInteractions(numbers, operations);
+        verifyNoInteractions(numbers);
+        assertThat(source.getLabelStatus()).isEqualTo("CONFIRMED");
         verify(balances).adjust(anyLong(), anyString(), anyString(), eq("A"), eq("商品A"), eq(3L), eq(3L), eq(0L));
     }
 
@@ -227,7 +258,7 @@ class ReturnInventoryServiceTest {
     void cartonPageCountsPhysicalCartonsAndKeepsTheAuthenticatedCustomerScope() {
         var query = new ReturnInventoryRequests.Query(2, 1, "42", "SKU", null, "AVAILABLE", "RT-1");
         ReturnInventoryCarton carton = new ReturnInventoryCarton();
-        carton.setCartonMark("RC-SECOND");
+        carton.setId(31L); carton.setCartonMark("RC-SECOND");
         carton.setSkuTypes(2);
         carton.setTotalQuantity(5L);
         when(cartons.merchantCount("10001", query)).thenReturn(2L);
@@ -274,7 +305,7 @@ class ReturnInventoryServiceTest {
 
         assertThat(created).hasSize(2);
         assertThat(created).extracting(ReturnInventoryCarton::getCartonMark)
-            .allMatch(mark -> mark.matches("RC[A-F0-9]{16}#2-[12]"))
+            .allMatch(mark -> mark.matches("RC[0-9A-Z]{1,13}#2-[12]"))
             .doesNotHaveDuplicates();
         assertThat(created.get(0).getCartonMark()).endsWith("#2-1");
         assertThat(created.get(1).getCartonMark()).endsWith("#2-2");
@@ -342,6 +373,47 @@ class ReturnInventoryServiceTest {
         verify(balances, never()).adjustCartonQuantity(anyString(), anyString(), anyString(), anyLong());
     }
 
+    @org.junit.jupiter.params.ParameterizedTest
+    @org.junit.jupiter.params.provider.ValueSource(longs = {3L, 6L})
+    void mergeCoalescesTrackedAndOriginalRemainderOwnedByTheSameReturn(long quantity) {
+        var source = prepareConcurrentSource();
+        source.setTotalQuantity(6L);
+        when(cartonItems.lockCarton(31L)).thenReturn(List.of(item(41L, "SKU-A", 6L)));
+        when(packingTrace.ownership("10001", "RC-SOURCE", "SKU-A")).thenReturn(List.of(
+            new com.baiyue.lastleg.returnreceipt.mapper.ReturnPackingTraceMapper.Ownership("RT-1", 3L)));
+        when(numbers.next(anyString(), anyString(), anyLong())).thenReturn("RC-TARGET");
+        when(balances.adjustCartonQuantity(anyString(), anyString(), anyString(), anyLong())).thenReturn(1);
+
+        service.merge(new PdaWarehouseIdentity("operator-2", "操作员2", 42L), mergeRequest(quantity));
+
+        verify(packingTrace).insert(anyLong(), eq("10001"), anyLong(), eq("RC-SOURCE"),
+            eq("RC-TARGET"), eq("RT-1"), eq("SKU-A"), eq(quantity), any());
+        verify(packingTrace, org.mockito.Mockito.times(1)).insert(anyLong(), anyString(), anyLong(),
+            anyString(), anyString(), anyString(), anyString(), anyLong(), any());
+        assertThat(source.getTotalQuantity()).isEqualTo(6L - quantity);
+    }
+
+    @Test
+    void partialMergeStillRejectsActuallyDifferentReturnOwners() {
+        var source = prepareConcurrentSource();
+        source.setSourceReturnNo("RT-1,RT-2"); source.setTotalQuantity(6L);
+        var otherOrder = completedOrder(); otherOrder.setId(12L); otherOrder.setReturnNo("RT-2");
+        org.mockito.Mockito.reset(orders);
+        when(orders.findByNos("42", List.of("RT-1", "RT-2"))).thenReturn(List.of(completedOrder(), otherOrder));
+        when(cartonItems.lockCarton(31L)).thenReturn(List.of(item(41L, "SKU-A", 6L)));
+        when(packingTrace.ownership("10001", "RC-SOURCE", "SKU-A")).thenReturn(List.of(
+            new com.baiyue.lastleg.returnreceipt.mapper.ReturnPackingTraceMapper.Ownership("RT-1", 3L),
+            new com.baiyue.lastleg.returnreceipt.mapper.ReturnPackingTraceMapper.Ownership("RT-2", 3L)));
+        var error = assertThrows(ResponseStatusException.class, () -> service.merge(
+            new PdaWarehouseIdentity("operator-2", "操作员2", 42L),
+            new ReturnInventoryRequests.Merge(List.of("RT-1", "RT-2"),
+                List.of(new ReturnInventoryRequests.ValidItem("SKU-A", 3L)),
+                BigDecimal.ONE, BigDecimal.ONE, BigDecimal.ONE, BigDecimal.ONE, "mixed-owner-key")));
+        assertThat(error.getReason()).contains("不能自动猜测来源归属");
+        verify(packingTrace, never()).insert(anyLong(), anyString(), anyLong(), anyString(),
+            anyString(), anyString(), anyString(), anyLong(), any());
+    }
+
     @Test
     void partiallyConsumedSourceUsesCurrentLockedSkuQuantityNotEarlierSnapshot() {
         ReturnInventoryCarton locked = prepareConcurrentSource();
@@ -369,6 +441,32 @@ class ReturnInventoryServiceTest {
         verify(balances).adjustCartonQuantity("10001", "42", "SKU-A", 1L);
     }
 
+    @Test void completedLabelQuantityCannotBeGuessedWhenSplittingAStoredCarton() {
+        prepareConcurrentSource();
+        when(cartonItems.lockCarton(31L)).thenReturn(List.of(item(41L, "SKU-A", 2L)));
+        when(cartons.completedSkuQuantity(31L, "SKU-A")).thenReturn(1L);
+        var error = assertThrows(ResponseStatusException.class, () -> service.merge(
+            new PdaWarehouseIdentity("operator-2", "name", 42L), mergeRequest(1)));
+        assertThat(error.getReason()).contains("不能自动分配来源", "独立新箱");
+        verify(cartonItems, never()).updateById(any(ReturnInventoryCartonItem.class));
+        verify(cartons, never()).insert(any(ReturnInventoryCarton.class));
+    }
+
+    @Test void wholeCartonMergeCarriesItsCompletedRelabelFactsToTheTarget() {
+        var source = prepareConcurrentSource();
+        when(cartonItems.lockCarton(31L)).thenReturn(List.of(item(41L, "SKU-A", 2L)));
+        when(cartons.completedSkuQuantity(31L, "SKU-A")).thenReturn(2L);
+        when(numbers.next(anyString(), anyString(), anyLong())).thenReturn("RC-TARGET");
+        when(balances.adjustCartonQuantity(anyString(), anyString(), anyString(), anyLong())).thenReturn(1);
+        var relabel = org.mockito.Mockito.mock(com.baiyue.lastleg.relabel.mapper.RelabelItemMapper.class);
+        ReflectionTestUtils.setField(service, "relabelItems", relabel);
+        service.merge(new PdaWarehouseIdentity("operator-2", "name", 42L), mergeRequest(2));
+        var target = ArgumentCaptor.forClass(ReturnInventoryCarton.class);
+        verify(cartons).insert(target.capture());
+        verify(relabel).moveCompletedReturnCarton("10001", 31L, target.getValue().getId(), "RC-TARGET");
+        assertThat(source.getTotalQuantity()).isZero();
+    }
+
     @Test
     void sameKeyInsertRaceReplaysCommittedResultAndLabelUsingOnlyCurrentReads() {
         var request = mergeRequest(1);
@@ -440,7 +538,7 @@ class ReturnInventoryServiceTest {
         String a = ReflectionTestUtils.invokeMethod(service, "shortReturnMark", "RT-ORDER", 123L, "SAMEPREFIX-A", 2L, 1L);
         String b = ReflectionTestUtils.invokeMethod(service, "shortReturnMark", "RT-ORDER", 123L, "SAMEPREFIX-B", 2L, 1L);
         String second = ReflectionTestUtils.invokeMethod(service, "shortReturnMark", "RT-ORDER", 123L, "SAMEPREFIX-A", 2L, 2L);
-        assertThat(a).isNotEqualTo(b).matches("RC[A-F0-9]{16}#2-1");
+        assertThat(a).isNotEqualTo(b).matches("RC[0-9A-Z]{1,13}#2-1");
         assertThat(second).isEqualTo(a.substring(0, a.lastIndexOf('-') + 1) + "2");
     }
 
@@ -468,28 +566,63 @@ class ReturnInventoryServiceTest {
     }
 
     @Test
-    void planCreationLocksExactSkuAndCancelReleasesOnlyItsReservation() {
+    void planCreationLocksPhysicalSourceAndCancelReleasesReservation() {
         var source = new ReturnInventoryCarton(); source.setId(31L); source.setCartonMark("RC-SOURCE");
         source.setCustomerId("10001"); source.setOverseasWarehouseId("42"); source.setSourceReturnNo("RT-1");
         source.setStatus("AVAILABLE"); source.setSourceUnitType("PARCEL");
-        var line = item(41L, "SKU-A", 5); line.setPackingReservedQuantity(1L);
+        var line = item(41L, "SKU-A", 5); line.setPackingReservedQuantity(0L);
         when(orders.lockNo("RT-1")).thenReturn(completedOrder());
         when(cartons.packingAvailable("10001", "42")).thenReturn(List.of(source));
         when(cartons.lockMark("RC-SOURCE")).thenReturn(source);
         when(cartonItems.lockCarton(31L)).thenReturn(List.of(line));
         when(cartonItems.lockSku(31L, "SKU-A")).thenReturn(line);
         when(balances.reserveAvailable("10001", "42", "SKU-A", 2)).thenReturn(1);
+        when(balances.releaseAvailable("10001", "42", "SKU-A", 2)).thenReturn(1);
         when(numbers.next(anyString(), anyString(), anyLong())).thenReturn("PLAN-1");
         var request = new ReturnInventoryRequests.PackingPlanCreate(List.of("RT-1"), "SKU",
             List.of(new ReturnInventoryRequests.PlanBox(List.of(new ReturnInventoryRequests.PlanItem("SKU-A", 2)), null, null, null, null)), null, "plan-key");
         var created = service.createPackingPlan("platform", request);
-        assertThat(created.status()).isEqualTo("PENDING_REVIEW"); assertThat(line.getPackingReservedQuantity()).isEqualTo(3);
+        assertThat(created.status()).isEqualTo("PENDING_REVIEW"); assertThat(line.getPackingReservedQuantity()).isEqualTo(2);
+        assertThat(created.sources().get(0).sourceReturnNo()).isEqualTo("RT-1");
+        assertThat(created.sources().get(0).participation()).isEqualTo("PARTIAL");
+        assertThat(created.sources().get(0).originalItems().get(0).quantity()).isEqualTo(5);
+        assertThat(source.getStatus()).isEqualTo("PACKING_RESERVED");
         var captor = ArgumentCaptor.forClass(com.baiyue.lastleg.returnreceipt.entity.ReturnPackingPlan.class);
         verify(packingPlans).insert(captor.capture());
         when(packingPlans.lockNo("PLAN-1")).thenReturn(captor.getValue());
         assertThat(service.cancelPackingPlan("PLAN-1").status()).isEqualTo("CANCELLED");
-        assertThat(line.getPackingReservedQuantity()).isEqualTo(1);
-        verify(balances).adjust(anyLong(), org.mockito.ArgumentMatchers.eq("10001"), org.mockito.ArgumentMatchers.eq("42"), org.mockito.ArgumentMatchers.eq("SKU-A"), org.mockito.ArgumentMatchers.isNull(), org.mockito.ArgumentMatchers.eq(0L), org.mockito.ArgumentMatchers.eq(2L), org.mockito.ArgumentMatchers.eq(0L));
+        assertThat(line.getPackingReservedQuantity()).isEqualTo(0);
+        assertThat(source.getStatus()).isEqualTo("AVAILABLE");
+        verify(balances).releaseAvailable("10001", "42", "SKU-A", 2);
+    }
+
+    @Test
+    void completedPlanKeepsResultSnapshotWhenLiveCartonHasBeenConsumed() {
+        var plan = new com.baiyue.lastleg.returnreceipt.entity.ReturnPackingPlan();
+        plan.setPlanNo("PLAN-SNAPSHOT"); plan.setCustomerId("10001"); plan.setOverseasWarehouseId("42");
+        plan.setStatus("COMPLETED"); plan.setMode("SKU"); plan.setReturnNosJson("[\"RT-1\",\"RT-2\"]");
+        plan.setSourceItemsJson("[]"); plan.setBoxesJson("[]");
+        plan.setResultLabelsJson("[{\"cartonMark\":\"RESULT\",\"customerId\":\"10001\",\"overseasWarehouseId\":\"42\",\"totalQuantity\":15,\"items\":[{\"skuCode\":\"SKU-A\",\"quantity\":15}]}]");
+        when(packingPlans.findNo("PLAN-SNAPSHOT")).thenReturn(plan);
+        var result = service.packingPlan(new PdaWarehouseIdentity("worker", "验收员", 42), "PLAN-SNAPSHOT");
+        assertThat(result.resultCartons()).isEmpty();
+        assertThat(result.completionCartons()).hasSize(1);
+        assertThat(result.completionCartons().get(0).totalQuantity()).isEqualTo(15);
+    }
+
+    @Test
+    void boxPlanRejectsPartialSourceDeductionsEvenWhenTargetIsNew() {
+        var plan = new com.baiyue.lastleg.returnreceipt.entity.ReturnPackingPlan();
+        plan.setPlanNo("PLAN-FULL"); plan.setCustomerId("10001"); plan.setOverseasWarehouseId("42");
+        plan.setStatus("READY"); plan.setMode("BOX");
+        plan.setSourceItemsJson("[{\"cartonMark\":\"A\",\"skuCode\":\"SKU-A\",\"quantity\":10}]");
+        when(packingPlans.lockNo("PLAN-FULL")).thenReturn(plan);
+        var request = new ReturnInventoryRequests.PackingPlanComplete(
+            List.of(new ReturnInventoryRequests.PlanBox(List.of(new ReturnInventoryRequests.PlanItem("SKU-A", 5)), BigDecimal.TEN, BigDecimal.TEN, BigDecimal.TEN, BigDecimal.ONE)),
+            "full-key", List.of(new ReturnInventoryRequests.SourceDeduction("A", "SKU-A", 5)));
+        var error = assertThrows(ResponseStatusException.class, () -> service.completePackingPlan(new PdaWarehouseIdentity("worker", "worker", 42), "PLAN-FULL", request));
+        assertThat(error.getReason()).contains("完全一致");
+        verifyNoInteractions(balances, cartonItems);
     }
 
     @Test
@@ -502,6 +635,61 @@ class ReturnInventoryServiceTest {
         verifyNoInteractions(cartonItems, balances);
     }
 
+    @Test
+    void partialPhysicalBoxCannotBeMergedIntoAnExistingTarget() {
+        var source = new ReturnInventoryCarton(); source.setId(31L); source.setCartonMark("RC-SOURCE");
+        source.setCustomerId("10001"); source.setOverseasWarehouseId("42"); source.setSourceReturnNo("RT-1");
+        source.setStatus("AVAILABLE"); source.setSourceUnitType("BOX");
+        when(cartons.lockMark("RC-SOURCE")).thenReturn(source);
+        when(cartonItems.lockCarton(31L)).thenReturn(List.of(item(41L, "SKU-A", 5)));
+        var request = new ReturnInventoryRequests.BoxMerge(List.of("RC-SOURCE"), "RC-TARGET", "partial-existing",
+            List.of(new ReturnInventoryRequests.SourceDeduction("RC-SOURCE", "SKU-A", 1)), null, null, null, null);
+        var error = assertThrows(ResponseStatusException.class, () -> service.mergeBoxes(new PdaWarehouseIdentity("operator-1", "作业员", 42L), request));
+        assertThat(error.getReason()).contains("独立新箱");
+        verify(cartonItems, never()).updateById(any(ReturnInventoryCartonItem.class));
+        verify(cartons, never()).insert(any(ReturnInventoryCarton.class));
+    }
+
+    @Test
+    void confirmingPhysicalLabelIsIdempotentAndBoundToWarehouse() {
+        var source = new ReturnInventoryCarton(); source.setId(31L); source.setCartonMark("RC-SOURCE");
+        source.setCustomerId("10001"); source.setOverseasWarehouseId("42"); source.setSourceReturnNo("RT-1");
+        source.setStatus("AVAILABLE"); source.setLabelStatus("WAIT_LABEL");
+        when(cartons.lockMark("RC-SOURCE")).thenReturn(source);
+        when(cartonItems.listCarton(31L)).thenReturn(List.of(item(41L, "SKU-A", 2)));
+        var identity = new PdaWarehouseIdentity("operator-1", "作业员", 42L);
+        service.confirmLabel(identity, "RC-SOURCE"); service.confirmLabel(identity, "RC-SOURCE");
+        assertThat(source.getLabelStatus()).isEqualTo("CONFIRMED");
+        verify(cartons, org.mockito.Mockito.times(1)).updateById(source);
+        assertThrows(ResponseStatusException.class, () -> service.confirmLabel(new PdaWarehouseIdentity("operator-2", "其他仓", 43L), "RC-SOURCE"));
+    }
+
+    @Test
+    void existingTargetSeedsOriginalOwnershipIncludingPreviouslyRemovedQuantity() {
+        var source = prepareConcurrentSource();
+        source.setCountStatus("CONFIRMED");
+        var target = new ReturnInventoryCarton(); target.setId(32L); target.setCartonMark("TARGET");
+        target.setCustomerId("10001"); target.setOverseasWarehouseId("42"); target.setSourceReturnNo("RT-1");
+        target.setSourceBatchNo("RB-1"); target.setStatus("AVAILABLE"); target.setCountStatus("CONFIRMED");
+        target.setTotalQuantity(15L); target.setSkuTypes(1);
+        var sourceLine = item(41L, "SKU-A", 5); var targetLine = item(42L, "SKU-A", 15);
+        when(cartons.lockMark("TARGET")).thenReturn(target);
+        when(cartonItems.lockCarton(31L)).thenReturn(List.of(sourceLine));
+        when(cartonItems.lockCarton(32L)).thenReturn(List.of(targetLine));
+        when(cartonItems.lockSku(32L, "SKU-A")).thenReturn(targetLine);
+        when(cartonItems.listCarton(32L)).thenReturn(List.of(targetLine));
+        when(cartonItems.totalQuantity(32L)).thenAnswer(ignored -> targetLine.getQuantity());
+        when(cartonItems.skuTypes(32L)).thenReturn(1);
+        when(packingTrace.netTrackedQuantity("10001", "TARGET", "SKU-A")).thenReturn(-5L);
+        when(balances.adjustCartonQuantity(anyString(), anyString(), anyString(), anyLong())).thenReturn(1);
+        ReflectionTestUtils.invokeMethod(service, "mergeScoped", new PdaWarehouseIdentity("worker", "worker", 42L),
+            new ReturnInventoryRequests.Merge(List.of("RT-1"), List.of(new ReturnInventoryRequests.ValidItem("SKU-A", 5)),
+                null, null, null, null, "target-reuse"),
+            java.util.Map.of("RC-SOURCE", new java.util.HashMap<>(java.util.Map.of("SKU-A", 5L))), "TARGET", null);
+        verify(packingTrace).insert(anyLong(), eq("10001"), anyLong(), eq(""), eq("TARGET"), eq("RT-1"), eq("SKU-A"), eq(20L), any());
+        assertThat(target.getTotalQuantity()).isEqualTo(20L);
+    }
+
     private ReturnInventoryCarton prepareConcurrentSource() {
         ReturnReceipt receipt = new ReturnReceipt(); receipt.setId(21L);
         ReturnInventoryCarton snapshot = new ReturnInventoryCarton();
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/returnreceipt/service/ReturnPackingBalancePersistenceTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/returnreceipt/service/ReturnPackingBalancePersistenceTest.java
new file mode 100644
index 000000000..85d44737f
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/returnreceipt/service/ReturnPackingBalancePersistenceTest.java
@@ -0,0 +1,45 @@
+package com.baiyue.lastleg.returnreceipt.service;
+
+import com.baomidou.mybatisplus.core.MybatisConfiguration;
+import com.baomidou.mybatisplus.extension.spring.MybatisSqlSessionFactoryBean;
+import com.baiyue.lastleg.returnreceipt.mapper.ReturnInventoryBalanceMapper;
+import org.junit.jupiter.api.Test;
+import org.mybatis.spring.SqlSessionTemplate;
+import org.springframework.jdbc.core.JdbcTemplate;
+import org.springframework.jdbc.datasource.DriverManagerDataSource;
+import java.util.UUID;
+import static org.junit.jupiter.api.Assertions.*;
+
+class ReturnPackingBalancePersistenceTest {
+    @Test
+    void releasingPlanReservationPreservesBalanceConstraintsAndRejectsExcessOrMissingStock() throws Exception {
+        var ds = new DriverManagerDataSource("jdbc:h2:mem:packing-balance-" + UUID.randomUUID() + ";MODE=MySQL;DB_CLOSE_DELAY=-1", "sa", "");
+        var jdbc = new JdbcTemplate(ds);
+        jdbc.execute("CREATE TABLE ll_return_inventory_balance (id BIGINT PRIMARY KEY, customer_id VARCHAR(128), " +
+            "overseas_warehouse_id VARCHAR(128), sku_code VARCHAR(128), product_name_zh VARCHAR(255), " +
+            "total_quantity BIGINT NOT NULL, available_quantity BIGINT NOT NULL, carton_quantity BIGINT NOT NULL, " +
+            "created_at TIMESTAMP, updated_at TIMESTAMP, " +
+            "CONSTRAINT chk_ll_return_inventory_balance_quantity CHECK(total_quantity>=available_quantity AND available_quantity>=0 AND carton_quantity>=0))");
+        jdbc.update("INSERT INTO ll_return_inventory_balance(id,customer_id,overseas_warehouse_id,sku_code,total_quantity,available_quantity,carton_quantity) VALUES(1,'C','W','SKU',4,4,1)");
+        var config = new MybatisConfiguration();
+        config.addMapper(ReturnInventoryBalanceMapper.class);
+        var factory = new MybatisSqlSessionFactoryBean();
+        factory.setDataSource(ds); factory.setConfiguration(config);
+        var mapper = new SqlSessionTemplate(factory.getObject()).getMapper(ReturnInventoryBalanceMapper.class);
+
+        assertEquals(1, mapper.reserveAvailable("C", "W", "SKU", 4));
+        assertEquals(1, mapper.releaseAvailable("C", "W", "SKU", 4));
+        assertEquals(4L, jdbc.queryForObject("SELECT available_quantity FROM ll_return_inventory_balance", Long.class));
+        assertEquals(4L, jdbc.queryForObject("SELECT total_quantity FROM ll_return_inventory_balance", Long.class));
+        assertEquals(1L, jdbc.queryForObject("SELECT carton_quantity FROM ll_return_inventory_balance", Long.class));
+        assertEquals(0, mapper.releaseAvailable("C", "W", "SKU", 1));
+        assertEquals(0, mapper.releaseAvailable("OTHER", "W", "SKU", 1));
+        assertEquals(0, mapper.releaseAvailable("C", "OTHER", "SKU", 1));
+        assertEquals(0, mapper.releaseAvailable("C", "W", "MISSING", 1));
+        assertEquals(1, mapper.reserveAvailable("C", "W", "SKU", 3));
+        assertEquals(0, mapper.releaseAvailable("C", "W", "SKU", 4));
+        assertEquals(0, mapper.releaseAvailable("C", "W", "SKU", -1));
+        assertEquals(1, mapper.releaseAvailable("C", "W", "SKU", 3));
+        assertEquals(1L, jdbc.queryForObject("SELECT COUNT(*) FROM ll_return_inventory_balance", Long.class));
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/returnreceipt/service/ReturnPackingTracePersistenceTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/returnreceipt/service/ReturnPackingTracePersistenceTest.java
new file mode 100644
index 000000000..1737f8276
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/returnreceipt/service/ReturnPackingTracePersistenceTest.java
@@ -0,0 +1,101 @@
+package com.baiyue.lastleg.returnreceipt.service;
+
+import com.baomidou.mybatisplus.core.MybatisConfiguration;
+import com.baomidou.mybatisplus.extension.spring.MybatisSqlSessionFactoryBean;
+import com.baiyue.lastleg.returnreceipt.mapper.ReturnPackingTraceMapper;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.mybatis.spring.SqlSessionTemplate;
+import org.springframework.jdbc.core.JdbcTemplate;
+import org.springframework.jdbc.datasource.DriverManagerDataSource;
+
+import java.util.UUID;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.tuple;
+
+public class ReturnPackingTracePersistenceTest {
+    private JdbcTemplate jdbc;
+    private ReturnPackingTraceMapper mapper;
+
+    @BeforeEach
+    void setUp() throws Exception {
+        var ds = new DriverManagerDataSource("jdbc:h2:mem:packing-trace-" + UUID.randomUUID()
+            + ";MODE=MySQL;DB_CLOSE_DELAY=-1", "sa", "");
+        jdbc = new JdbcTemplate(ds);
+        jdbc.execute("CREATE ALIAS JSON_EXTRACT FOR '" + getClass().getName() + ".jsonExtract'");
+        jdbc.execute("CREATE ALIAS JSON_UNQUOTE FOR '" + getClass().getName() + ".jsonUnquote'");
+        jdbc.execute("CREATE TABLE ll_return_inventory_operation (id BIGINT PRIMARY KEY, operation_type VARCHAR(40), result_json VARCHAR(1000))");
+        jdbc.execute("CREATE TABLE ll_return_packing_trace (id BIGINT PRIMARY KEY, customer_id VARCHAR(80), operation_id BIGINT, "
+            + "source_carton_mark VARCHAR(80), target_carton_mark VARCHAR(80), return_no VARCHAR(80), sku_code VARCHAR(80), quantity BIGINT, created_at TIMESTAMP)");
+        var config = new MybatisConfiguration();
+        config.setMapUnderscoreToCamelCase(true);
+        config.addMapper(ReturnPackingTraceMapper.class);
+        var factory = new MybatisSqlSessionFactoryBean();
+        factory.setDataSource(ds); factory.setConfiguration(config);
+        mapper = new SqlSessionTemplate(factory.getObject()).getMapper(ReturnPackingTraceMapper.class);
+        operation(1, "PLAN");
+        trace(1, 1, "C", "SOURCE", "TARGET", "RETURN", "SKU", 3);
+        trace(2, 1, "C", "SOURCE", "TARGET", "RETURN", "SKU", 3);
+    }
+
+    @Test
+    void allDetailQueriesSumHistoricalFragmentsWithoutChangingRawTrace() {
+        trace(3, 1, "C", "SOURCE-B", "TARGET", "RETURN-B", "SKU-B", 15);
+        assertThat(mapper.planHistory("C", "PLAN"))
+            .extracting(row -> row.skuCode(), row -> row.quantity())
+            .containsExactly(tuple("SKU", 6L), tuple("SKU-B", 15L));
+        assertThat(mapper.returnHistory("C", "RETURN")).singleElement()
+            .satisfies(row -> assertThat(row.quantity()).isEqualTo(6));
+        assertThat(mapper.listCartonHistory("C", "TARGET"))
+            .extracting(row -> row.skuCode(), row -> row.quantity())
+            .containsExactly(tuple("SKU-B", 15L), tuple("SKU", 6L));
+        assertThat(mapper.listReturn("C", "RETURN")).hasSize(2);
+        assertThat(jdbc.queryForObject("SELECT COUNT(*) FROM ll_return_packing_trace", Long.class)).isEqualTo(3);
+    }
+
+    @Test
+    void groupingKeepsOperationReturnSkuAndCartonBoundariesAndCustomerIsolation() {
+        operation(2, "PLAN"); operation(3, "OTHER-PLAN");
+        trace(3, 2, "C", "SOURCE", "TARGET", "RETURN", "SKU", 2);
+        trace(4, 3, "C", "SOURCE", "TARGET", "RETURN", "SKU", 1);
+        trace(5, 1, "C", "SOURCE", "TARGET", "RETURN-B", "SKU", 4);
+        trace(6, 1, "C", "SOURCE-B", "TARGET", "RETURN", "SKU", 5);
+        trace(7, 1, "C", "SOURCE", "TARGET-B", "RETURN", "SKU", 7);
+        trace(8, 1, "C", "SOURCE", "TARGET", "RETURN", "SKU-B", 8);
+        trace(9, 1, "OTHER-CUSTOMER", "SOURCE", "TARGET", "RETURN", "SKU", 99);
+        trace(10, 1, "C", "", "TARGET", "RETURN", "SKU", 100);
+
+        assertThat(mapper.planHistory("C", "PLAN"))
+            .extracting(row -> row.sourceCartonMark(), row -> row.targetCartonMark(), row -> row.returnNo(), row -> row.skuCode(), row -> row.quantity())
+            .containsExactly(tuple("SOURCE", "TARGET", "RETURN", "SKU", 6L),
+                tuple("SOURCE", "TARGET", "RETURN", "SKU", 2L),
+                tuple("SOURCE", "TARGET", "RETURN-B", "SKU", 4L),
+                tuple("SOURCE-B", "TARGET", "RETURN", "SKU", 5L),
+                tuple("SOURCE", "TARGET-B", "RETURN", "SKU", 7L),
+                tuple("SOURCE", "TARGET", "RETURN", "SKU-B", 8L));
+        assertThat(mapper.returnHistory("C", "RETURN")).extracting(row -> row.quantity())
+            .containsExactly(6L, 2L, 1L, 5L, 7L, 8L);
+        assertThat(mapper.listCartonHistory("C", "TARGET")).extracting(row -> row.quantity())
+            .containsExactly(8L, 5L, 4L, 1L, 2L, 6L);
+        assertThat(mapper.planHistory("MISSING", "PLAN")).isEmpty();
+        assertThat(mapper.returnHistory("MISSING", "RETURN")).isEmpty();
+        assertThat(mapper.listCartonHistory("MISSING", "TARGET")).isEmpty();
+    }
+
+    private void operation(long id, String plan) {
+        jdbc.update("INSERT INTO ll_return_inventory_operation VALUES(?, 'MERGE', ?)", id, "{\"planNo\":\"" + plan + "\"}");
+    }
+
+    private void trace(long id, long operation, String customer, String source, String target, String owner, String sku, long quantity) {
+        jdbc.update("INSERT INTO ll_return_packing_trace VALUES(?,?,?,?,?,?,?,?,TIMESTAMP '2026-10-15 16:13:36.447')",
+            id, customer, operation, source, target, owner, sku, quantity);
+    }
+
+    public static String jsonExtract(String json, String path) throws Exception {
+        return new ObjectMapper().readTree(json).path(path.substring(2)).asText(null);
+    }
+
+    public static String jsonUnquote(String value) { return value; }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/returnreceipt/service/ReturnReceiptServiceTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/returnreceipt/service/ReturnReceiptServiceTest.java
index 4205b5c2c..d67a66ccc 100644
--- a/lastleg-service/src/test/java/com/baiyue/lastleg/returnreceipt/service/ReturnReceiptServiceTest.java
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/returnreceipt/service/ReturnReceiptServiceTest.java
@@ -82,6 +82,25 @@ class ReturnReceiptServiceTest {
         verify(details, times(1)).insert(any(com.baiyue.lastleg.entity.LastlegOrderDetail.class));
         verify(details, times(1)).updateById(any(com.baiyue.lastleg.entity.LastlegOrderDetail.class));
     }
+    @Test void countedParcelsContributeVolumeOncePerPhysicalPackage() {
+        ReturnOrder order = new ReturnOrder(); order.setId(1L); order.setCustomerId("C1"); order.setLastlegOrderId(9L);
+        ReturnOrderItem sku = new ReturnOrderItem(); sku.setSkuCode("SKU1");
+        ReturnReceipt first = measuredReceipt(2L, "PK-A", "50", "40", "40"); first.setReturnOrderId(1L); first.setUnitType("PARCEL");
+        ReturnReceipt second = measuredReceipt(3L, "PK-B", "60", "50", "50"); second.setUnitType("PARCEL");
+        ReturnReceipt earlier = measuredReceipt(4L, "PK-A", "40", "40", "40"); earlier.setUnitType("PARCEL");
+        var counted = new com.baiyue.lastleg.returnreceipt.entity.ReturnReceiptItem(); counted.setSkuCode("SKU1"); counted.setReceivedQuantity(24L);
+        LastlegOrder tail = new LastlegOrder(); tail.setId(9L); tail.setCustomerId("C1");
+        when(orders.selectById(1L)).thenReturn(order); when(orderItems.listOrder(1L)).thenReturn(List.of(sku));
+        when(lastlegOrders.selectById(9L)).thenReturn(tail); when(receipts.listOrder(1L)).thenReturn(List.of(second, first, earlier));
+        when(receiptItems.listReceipt(2L)).thenReturn(List.of(counted));
+
+        service.refreshCountedTailCargo(first);
+
+        assertThat(tail.getVolumeCbm()).isEqualByComparingTo("0.23");
+        assertEquals(0, tail.getPackageCount());
+        assertEquals(0, tail.getPalletCount());
+        verify(lastlegOrders).updateById(tail);
+    }
     @Mock ReturnOrderMapper orders;
     @Mock ReturnOrderItemMapper orderItems;
     @Mock ReturnReceiptMapper receipts;
@@ -102,9 +121,13 @@ class ReturnReceiptServiceTest {
     ReturnReceiptService service;
     PdaWarehouseIdentity identity;
 
+    private com.baiyue.lastleg.service.CompactBusinessNumberService compactNumbers;
     @BeforeEach
     void setUp() {
+        compactNumbers = org.mockito.Mockito.mock(com.baiyue.lastleg.service.CompactBusinessNumberService.class);
         service = new ReturnReceiptService();
+        ReflectionTestUtils.setField(service, "compactNumbers", compactNumbers);
+        org.mockito.Mockito.lenient().when(compactNumbers.next(org.mockito.ArgumentMatchers.anyString(), org.mockito.ArgumentMatchers.anyString())).thenAnswer(call -> call.getArgument(0) + "-CS-261016102030");
         ReflectionTestUtils.setField(service, "orders", orders);
         ReflectionTestUtils.setField(service, "orderItems", orderItems);
         ReflectionTestUtils.setField(service, "receipts", receipts);
@@ -224,13 +247,16 @@ class ReturnReceiptServiceTest {
         when(orderItems.lockOrder(1L)).thenReturn(List.of(item(11L, "SKU-A", 50, 50), item(12L, "SKU-B", 40, 40)));
         when(fbaWarehouseValidator.required("200", "XLX6", null)).thenReturn(
             new FbaWarehouseValidator.VerifiedFbaWarehouse(200L, "XLX6", "FBA XLX6", "US", "CA"));
-        when(numbers.next(eq("RELABEL"), eq("10"), anyLong())).thenReturn("RL-MULTI");
+        when(compactNumbers.next(eq("TT"), eq("customer-1"))).thenReturn("RL-MULTI");
         when(lastlegOrders.selectById(99L)).thenReturn(tail);
         when(cartons.findAvailable("customer-1", "10")).thenReturn(List.of(first, second));
+        when(inventory.matchesReturnSource(any(), eq("RT-MULTI"))).thenCallRealMethod();
         when(cartons.lockId(101L)).thenReturn(first);
         when(cartons.lockId(102L)).thenReturn(second);
         when(cartonItems.listCarton(101L)).thenReturn(List.of(returnCartonItem("SKU-A", 50)));
         when(cartonItems.listCarton(102L)).thenReturn(List.of(returnCartonItem("SKU-B", 40)));
+        when(cartonItems.lockCarton(101L)).thenReturn(List.of(returnCartonItem("SKU-A", 50)));
+        when(cartonItems.lockCarton(102L)).thenReturn(List.of(returnCartonItem("SKU-B", 40)));
 
         var result = service.createRelabel("customer-1", "merchant-1", "RT-MULTI",
             new ReturnOrderRequests.RelabelCreate(List.of(
@@ -263,7 +289,7 @@ class ReturnReceiptServiceTest {
     }
 
     @Test
-    void secondRelabelCannotAllocateAlreadyLabelledQuantity() {
+    void completedReturnCartonCanStartAnotherRelabelRound() {
         ReturnOrder order = order("RT-MULTI", "10", "COMPLETED", 100, 100);
         order.setLastlegOrderId(99L); order.setRelabelNo("RL-PREVIOUS");
         LastlegOrder tail = new LastlegOrder(); tail.setId(99L);
@@ -272,19 +298,20 @@ class ReturnReceiptServiceTest {
         when(orderItems.lockOrder(1L)).thenReturn(List.of(item(11L, "SKU-A", 100, 100)));
         when(fbaWarehouseValidator.required("200", "XLX6", null)).thenReturn(
             new FbaWarehouseValidator.VerifiedFbaWarehouse(200L, "XLX6", "FBA XLX6", "US", "CA"));
-        when(numbers.next(eq("RELABEL"), eq("10"), anyLong())).thenReturn("RL-SECOND");
+        when(compactNumbers.next(eq("TT"), eq("customer-1"))).thenReturn("RL-SECOND");
         when(lastlegOrders.selectById(99L)).thenReturn(tail);
         when(cartons.findAvailable("customer-1", "10")).thenReturn(List.of(carton));
+        when(inventory.matchesReturnSource(any(), eq("RT-MULTI"))).thenCallRealMethod();
         when(cartonItems.listCarton(101L)).thenReturn(List.of(returnCartonItem("SKU-A", 100)));
-        when(cartons.relabelledQuantity(101L, "SKU-A")).thenReturn(100L);
-        var error = assertThrows(ResponseStatusException.class, () -> service.createRelabel(
+        when(cartons.lockId(101L)).thenReturn(carton);
+        when(cartonItems.lockCarton(101L)).thenReturn(List.of(returnCartonItem("SKU-A", 100)));
+        var result = service.createRelabel(
             "customer-1", "merchant-1", "RT-MULTI", new ReturnOrderRequests.RelabelCreate(
                 List.of(new ReturnOrderRequests.RelabelItem("SKU-A", 1)),
-                "SKU_TOTAL", "200", "XLX6", "second-key", "second attempt")));
-        assertEquals(409, error.getStatusCode().value());
-        assertTrue(error.getReason().contains("可用实收数量不足"));
-        verify(relabelItems, never()).insert(any(RelabelItem.class));
-        verify(cartons, never()).updateById(any(ReturnInventoryCarton.class));
+                "SKU_TOTAL", "200", "XLX6", "second-key", "second attempt"));
+        assertEquals("RL-SECOND", result.relabelNo());
+        verify(relabelItems).insert(any(RelabelItem.class));
+        verify(cartons).updateById(carton);
     }
 
     @Test
@@ -326,7 +353,7 @@ class ReturnReceiptServiceTest {
     void createForecastPersistsCompleteTailOrderSourceAndReturnsItsBusinessNumber() {
         AtomicReference<ReturnOrder> saved = new AtomicReference<>();
         when(orders.findKey("customer-1", "create-key")).thenReturn(null);
-        when(numbers.next(eq("RETURN"), eq("10"), anyLong())).thenReturn("RT-1");
+        when(compactNumbers.next(eq("TT"), eq("customer-1"))).thenReturn("RT-1");
         when(orders.insert(any(ReturnOrder.class))).thenAnswer(invocation -> { saved.set(invocation.getArgument(0)); return 1; });
         when(orders.findNo("customer-1", "RT-1")).thenAnswer(invocation -> saved.get());
         when(orderItems.listOrder(anyLong())).thenReturn(List.of());
@@ -444,18 +471,18 @@ class ReturnReceiptServiceTest {
     }
 
     @Test
-    void parcelWithoutTrackingGeneratesParcelCodeAndNeverReturnsBoxLabelsOnReplay() {
+    void parcelWithoutTrackingKeepsPhysicalMarkOnReplay() {
         ReturnOrder order = order("RT-1", "10", ReturnReceiptService.PENDING_RECEIPT, 3, 0);
         ReturnOrderItem line = item(11L, "SKU-A", 3, 0);
         stubNewReceipt(order, List.of(line), "SP-SOURCE");
         var request = new PdaReturnReceiptRequests.Confirm("RT-1", null, "SKU", null,
             List.of(new PdaReturnReceiptRequests.Item("SKU-A", 1)), "parcel-key",
-            "PARCEL", null, null, null, null, null, null);
+            "PARCEL", null, java.math.BigDecimal.ONE, java.math.BigDecimal.ONE, java.math.BigDecimal.ONE, java.math.BigDecimal.ONE, null, true);
         var result = service.confirm(identity, request);
         var capture = ArgumentCaptor.forClass(ReturnReceipt.class);
         verify(receipts).insert(capture.capture());
         assertThat(result.unitCode()).startsWith("PK");
-        assertThat(result.cartonMark()).isNull();
+        assertThat(result.cartonMark()).isEqualTo("SP-SOURCE");
         assertThat(result.printableHtml()).isNull();
         assertThat(result.labels()).isEmpty();
         assertThat(capture.getValue().getTrackingNo()).isNull();
@@ -463,7 +490,7 @@ class ReturnReceiptServiceTest {
         var replay = service.confirm(identity, request);
         assertThat(replay.unitCode()).isEqualTo(result.unitCode());
         assertThat(replay.labels()).isEmpty();
-        verify(inventory, never()).label(anyString(), anyString());
+        verify(inventory, times(2)).label("customer-1", "SP-SOURCE");
         verify(inventory, times(1)).createReceiptCarton(any(), any(), any(), any());
     }
 
@@ -607,6 +634,6 @@ class ReturnReceiptServiceTest {
         // These focused tests exercise receipt/idempotency behavior at the
         // carton level. Pallet receipts have a separate multi-carton contract.
         return new PdaReturnReceiptRequests.Confirm("RT-1", trackingNo, startedBy, palletCode, boxed, key,
-            "BOX", palletCode, null, null, null, null, 1L);
+            "BOX", palletCode, java.math.BigDecimal.ONE, java.math.BigDecimal.ONE, java.math.BigDecimal.ONE, java.math.BigDecimal.ONE, 1L, true);
     }
 }
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/returnreceipt/service/ReturnSkuConversionPersistenceTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/returnreceipt/service/ReturnSkuConversionPersistenceTest.java
new file mode 100644
index 000000000..fce3ab2d7
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/returnreceipt/service/ReturnSkuConversionPersistenceTest.java
@@ -0,0 +1,250 @@
+package com.baiyue.lastleg.returnreceipt.service;
+
+import com.baomidou.mybatisplus.annotation.TableName;
+import com.baomidou.mybatisplus.core.MybatisConfiguration;
+import com.baomidou.mybatisplus.extension.spring.MybatisSqlSessionFactoryBean;
+import com.baiyue.lastleg.relabel.entity.RelabelApplication;
+import com.baiyue.lastleg.relabel.service.ReturnSkuConversionService;
+import com.baiyue.lastleg.relabel.entity.RelabelItem;
+import com.baiyue.lastleg.relabel.pda.entity.PdaRelabelUnitFact;
+import com.baiyue.lastleg.returnreceipt.entity.*;
+import com.baiyue.lastleg.returnreceipt.mapper.*;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.TestInfo;
+import org.junit.jupiter.api.condition.EnabledIfSystemProperty;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.ValueSource;
+import org.mybatis.spring.SqlSessionTemplate;
+import org.springframework.aop.framework.ProxyFactory;
+import org.springframework.jdbc.core.JdbcTemplate;
+import org.springframework.jdbc.datasource.*;
+import org.springframework.test.util.ReflectionTestUtils;
+import org.springframework.transaction.annotation.AnnotationTransactionAttributeSource;
+import org.springframework.transaction.interceptor.TransactionInterceptor;
+import org.springframework.web.server.ResponseStatusException;
+import java.lang.reflect.Modifier;
+import java.time.LocalDateTime;
+import java.util.*;
+import java.util.stream.Collectors;
+import static org.junit.jupiter.api.Assertions.*;
+import static org.mockito.Mockito.*;
+import static org.mockito.ArgumentMatchers.*;
+
+/** Real production SQL, contents, balances, provenance and rollback in one database transaction. */
+class ReturnSkuConversionPersistenceTest {
+    JdbcTemplate jdbc;
+    ReturnSkuConversionService service, target;
+    ReturnInventoryBalanceMapper balances;
+    DataSourceTransactionManager transactions;
+    ReturnSkuMySqlTestDatabase mysql;
+
+    @BeforeEach void setUp(TestInfo info) throws Exception {
+        boolean mysqlMode = Boolean.getBoolean("returnSku.test.mysql");
+        var ds = mysqlMode ? (mysql = ReturnSkuMySqlTestDatabase.open(info.getDisplayName())).dataSource()
+            : new DriverManagerDataSource("jdbc:h2:mem:sku-conversion-" + UUID.randomUUID() + ";MODE=MySQL;DB_CLOSE_DELAY=-1", "sa", "");
+        jdbc = new JdbcTemplate(ds); transactions = new DataSourceTransactionManager(ds);
+        for (var entity : List.of(ReturnInventoryCarton.class, ReturnInventoryCartonItem.class, ReturnInventoryBalance.class,
+                ReturnSkuConversion.class, ReturnInventoryOperation.class, RelabelItem.class)) {
+            var columns = Arrays.stream(entity.getDeclaredFields()).filter(f -> !Modifier.isStatic(f.getModifiers()))
+                .filter(f -> f.getAnnotation(com.baomidou.mybatisplus.annotation.TableField.class) == null
+                    || f.getAnnotation(com.baomidou.mybatisplus.annotation.TableField.class).exist())
+                .map(f -> f.getName().replaceAll("([A-Z])", "_$1").toLowerCase() + " "
+                    + (f.getType() == String.class ? (mysqlMode ? (f.getName().endsWith("Json") ? "TEXT" : "VARCHAR(128)") : "VARCHAR(8000)") : f.getType() == LocalDateTime.class ? "TIMESTAMP"
+                        : f.getType() == java.math.BigDecimal.class ? "DECIMAL(20,6)" : "BIGINT")
+                    + (f.getName().equals("id") ? " PRIMARY KEY" : "")).collect(Collectors.joining(","));
+            jdbc.execute("CREATE TABLE " + entity.getAnnotation(TableName.class).value() + " (" + columns + ")"
+                + (mysqlMode ? " ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE="
+                    + (entity == ReturnInventoryCartonItem.class ? "utf8mb4_0900_ai_ci" : "utf8mb4_unicode_ci") : ""));
+        }
+        jdbc.execute("CREATE UNIQUE INDEX balance_sku ON ll_return_inventory_balance(customer_id,overseas_warehouse_id,sku_code)");
+        jdbc.execute("CREATE UNIQUE INDEX conversion_round ON ll_return_sku_conversion(item_id,round_key,old_sku_code,new_sku_code)");
+        jdbc.execute("CREATE TABLE ll_return_packing_trace(id BIGINT PRIMARY KEY,customer_id VARCHAR(128),operation_id BIGINT,source_carton_mark VARCHAR(128),target_carton_mark VARCHAR(128),return_no VARCHAR(64),sku_code VARCHAR(128),quantity BIGINT,created_at TIMESTAMP)");
+        var config = new MybatisConfiguration(); config.setMapUnderscoreToCamelCase(true);
+        for (var mapper : List.of(ReturnSkuConversionMapper.class, ReturnInventoryCartonMapper.class,
+                ReturnInventoryCartonItemMapper.class, ReturnInventoryBalanceMapper.class, ReturnPackingTraceMapper.class,
+                ReturnInventoryOperationMapper.class)) config.addMapper(mapper);
+        var factory = new MybatisSqlSessionFactoryBean(); factory.setDataSource(ds); factory.setConfiguration(config);
+        var session = new SqlSessionTemplate(factory.getObject());
+        target = new ReturnSkuConversionService();
+        ReflectionTestUtils.setField(target, "conversions", session.getMapper(ReturnSkuConversionMapper.class));
+        ReflectionTestUtils.setField(target, "cartons", session.getMapper(ReturnInventoryCartonMapper.class));
+        ReflectionTestUtils.setField(target, "contents", session.getMapper(ReturnInventoryCartonItemMapper.class));
+        balances = session.getMapper(ReturnInventoryBalanceMapper.class);
+        ReflectionTestUtils.setField(target, "balances", balances);
+        ReflectionTestUtils.setField(target, "traces", session.getMapper(ReturnPackingTraceMapper.class));
+        ReflectionTestUtils.setField(target, "operations", session.getMapper(ReturnInventoryOperationMapper.class));
+        ReflectionTestUtils.setField(target, "json", new ObjectMapper());
+        var proxy = new ProxyFactory(target); proxy.setProxyTargetClass(true);
+        proxy.addAdvice(new TransactionInterceptor(transactions, new AnnotationTransactionAttributeSource()));
+        service = (ReturnSkuConversionService) proxy.getProxy();
+    }
+
+    @AfterEach void cleanIsolatedMySql() throws Exception { if (mysql != null) mysql.close(); }
+
+    @ParameterizedTest @ValueSource(strings={"BOX", "PARCEL"})
+    void partialConversionPreservesPhysicalUnitAndLocksUntilConfirmation(String type) {
+        fixture(type); apply(1, 11, 8, "INITIAL");
+        assertStock("A", 12, 0); assertStock("B", 8, 8);
+        assertEquals(20, count("SELECT total_quantity FROM ll_return_inventory_carton WHERE id=101"));
+        assertEquals(2, count("SELECT sku_types FROM ll_return_inventory_carton WHERE id=101"));
+        assertEquals(12, balance("A", "total_quantity")); assertEquals(8, balance("B", "total_quantity"));
+        assertEquals("BOX".equals(type) ? 1 : 0, balance("B", "carton_quantity"));
+        // H2 verifies the persisted lock source and transaction, not MySQL's COLLATE projection.
+        assertEquals("RELABEL_PENDING", jdbc.queryForObject("SELECT status FROM ll_return_inventory_carton WHERE id=101", String.class));
+        assertEquals(1, count("SELECT relabel_application_id FROM ll_return_inventory_carton WHERE id=101"));
+        assertEquals("APPLIED", jdbc.queryForObject("SELECT status FROM ll_return_sku_conversion", String.class));
+        assertEquals(8, count("SELECT SUM(quantity) FROM ll_return_packing_trace WHERE target_carton_mark='UNIT-1' AND sku_code='B'"));
+        service.confirm(app(1));
+        jdbc.update("UPDATE ll_return_inventory_carton SET status='AVAILABLE',relabel_application_id=NULL WHERE id=101");
+        assertStock("B", 8, 8);
+        assertEquals(8, balance("B", "available_quantity"));
+        assertEquals("AVAILABLE", jdbc.queryForObject("SELECT status FROM ll_return_inventory_carton WHERE id=101", String.class));
+        assertEquals("CONFIRMED", jdbc.queryForObject("SELECT status FROM ll_return_sku_conversion", String.class));
+    }
+
+    @ParameterizedTest @ValueSource(strings={"BOX", "PARCEL"})
+    @EnabledIfSystemProperty(named="returnSku.test.mysql", matches="true")
+    void mysqlPageLocksConvertedSkuUntilConfirmationWithoutChangingPhysicalUnit(String type) {
+        fixture(type);
+        var physical = jdbc.queryForMap("SELECT id,carton_mark,source_return_no,source_unit_type,total_quantity FROM ll_return_inventory_carton WHERE id=101");
+        apply(1,11,8,"INITIAL");
+        assertStock("A",12,0); assertStock("B",8,8);
+        assertEquals(12,balance("A","total_quantity")); assertEquals(8,balance("B","total_quantity"));
+        assertEquals("BOX".equals(type) ? 1 : 0,balance("B","carton_quantity"));
+        assertPageQuantity("B",0,8);
+        service.confirm(app(1));
+        jdbc.update("UPDATE ll_return_inventory_carton SET status='AVAILABLE',relabel_application_id=NULL WHERE id=101");
+        assertPageQuantity("B",8,0);
+        assertEquals(physical,jdbc.queryForMap("SELECT id,carton_mark,source_return_no,source_unit_type,total_quantity FROM ll_return_inventory_carton WHERE id=101"));
+        mysql.record("physicalUnit",type); mysql.record("oldSkuQuantity",12); mysql.record("newSkuQuantity",8);
+        mysql.record("beforeConfirmation",Map.of("available",0,"locked",8));
+        mysql.record("afterConfirmation",Map.of("available",8,"locked",0));
+        mysql.record("physicalUnitUnchanged",true);
+    }
+
+    @ParameterizedTest @ValueSource(strings={"cafe", "CAFÉ"})
+    @EnabledIfSystemProperty(named="returnSku.test.mysql", matches="true")
+    void mysqlPageCollatesCaseAndAccentsWithoutJoiningOtherCustomerWarehouseOrSku(String stockSku) {
+        fixture("BOX"); apply(1,11,8,"INITIAL");
+        jdbc.update("UPDATE ll_return_inventory_balance SET sku_code='Café' WHERE sku_code='B'");
+        jdbc.update("UPDATE ll_return_inventory_carton_item SET sku_code=? WHERE sku_code='B'",stockSku);
+        for (int id=401;id<=403;id++) {
+            String customer=id==401 ? "OTHER" : "C", warehouse=id==402 ? "OTHER" : "W", sku=id==403 ? "CAFETERIA" : "café";
+            jdbc.update("INSERT INTO ll_return_inventory_carton(id,customer_id,overseas_warehouse_id,carton_mark,status,count_status,total_quantity,sku_types) VALUES(?,?,?,?,'RELABEL_PENDING','CONFIRMED',99,1)",id,customer,warehouse,"BOUNDARY-"+id);
+            jdbc.update("INSERT INTO ll_return_inventory_carton_item(id,carton_id,customer_id,sku_code,quantity,relabelled_quantity,packing_reserved_quantity) VALUES(?,?,?,?,99,0,0)",id,id,customer,sku);
+        }
+        assertPageQuantity("CAFE",0,8);
+        jdbc.update("UPDATE ll_return_inventory_carton SET status='AVAILABLE'");
+        assertPageQuantity("café",8,0);
+        mysql.record("stockSku",stockSku); mysql.record("balanceSku","Café");
+        mysql.record("caseAndAccentJoin",true); mysql.record("foreignCustomerWarehouseAndDistinctSkuExcluded",true);
+    }
+
+    void assertPageQuantity(String sku,long available,long locked) {
+        var rows=balances.page("C","W",sku,0,20); assertEquals(1,rows.size());
+        assertEquals(available,rows.get(0).getAvailableQuantity());
+        assertEquals(locked,rows.get(0).getRelabelLockedQuantity());
+        var platform=balances.platformPage("C","W",sku,0,20); assertEquals(1,platform.size());
+        assertEquals(available,platform.get(0).getAvailableQuantity());
+        assertEquals(locked,platform.get(0).getRelabelLockedQuantity());
+    }
+
+    @Test void replayAndLaterPartialRoundDoNotConvertPriorPiecesTwice() {
+        fixture("BOX"); apply(1, 11, 8, "INITIAL"); apply(1, 11, 8, "INITIAL");
+        assertEquals(1, count("SELECT COUNT(*) FROM ll_return_sku_conversion")); assertStock("A", 12, 0);
+        service.confirm(app(1)); jdbc.update("UPDATE ll_return_inventory_carton SET relabel_application_id=2 WHERE id=101");
+        apply(2, 12, 5, "INITIAL");
+        assertStock("A", 7, 0); assertStock("B", 13, 13); assertEquals(20, balance("A", "total_quantity") + balance("B", "total_quantity"));
+        var repeated = item(13, 2, "B", "C", 1);
+        assertThrows(ResponseStatusException.class, () -> service.apply(app(2), List.of(repeated), List.of(fact(13, 1, "RELABELLED")), "INITIAL"));
+        assertStock("B", 13, 13);
+    }
+
+    @Test void fullConversionRemovesOldContentsButKeepsTheCartonAndOriginalReceipt() {
+        fixture("BOX"); apply(1, 11, 20, "INITIAL");
+        assertEquals(0, count("SELECT COUNT(*) FROM ll_return_inventory_carton_item WHERE sku_code='A'"));
+        assertStock("B", 20, 20); assertEquals(0, balance("A", "total_quantity")); assertEquals(0, balance("A", "carton_quantity"));
+        assertEquals(1, count("SELECT COUNT(*) FROM ll_return_inventory_carton WHERE carton_mark='UNIT-1' AND source_return_no='RT-1'"));
+    }
+
+    @Test void conversionIntoExistingSkuKeepsItsUnlabelledPiecesSelectable() {
+        fixture("BOX");
+        jdbc.update("INSERT INTO ll_return_inventory_carton_item(id,carton_id,customer_id,sku_code,quantity,relabelled_quantity,packing_reserved_quantity) VALUES(202,101,'C','B',4,0,0)");
+        jdbc.update("UPDATE ll_return_inventory_carton SET total_quantity=24,sku_types=2 WHERE id=101");
+        balances.adjust(302, "C", "W", "B", "Goods", 4, 4, 1);
+        apply(1, 11, 8, "INITIAL"); assertStock("B", 12, 8); assertEquals(1, balance("B", "carton_quantity"));
+        assertEquals(4, count("SELECT quantity-relabelled_quantity FROM ll_return_inventory_carton_item WHERE sku_code='B'"));
+    }
+
+    @Test void reworkReversesOnlyCurrentRoundAndCanBeAppliedAgain() {
+        fixture("PARCEL"); apply(1, 11, 8, "INITIAL"); service.reverse(app(1)); service.reverse(app(1));
+        assertStock("A", 20, 0); assertEquals(0, balance("B", "total_quantity"));
+        assertEquals(0, count("SELECT COUNT(*) FROM ll_return_inventory_carton_item WHERE sku_code='B'"));
+        apply(1, 11, 8, "REWORK-1"); assertStock("A", 12, 0); assertStock("B", 8, 8);
+        assertEquals(2, count("SELECT COUNT(*) FROM ll_return_sku_conversion"));
+        service.confirm(app(1)); assertThrows(ResponseStatusException.class, () -> service.reverse(app(1)));
+    }
+
+    @Test void onlyActualCompletedFactsProduceInventoryAndBulkCountsPieces() {
+        fixture("PARCEL"); var item = item(11, 1, "A", "B", 20); item.setOperationType("RETURN_BULK_SKU_LABEL");
+        service.apply(app(1), List.of(item), List.of(fact(11, 8, "RELABELLED"), fact(11, 12, "EXCEPTION")), "INITIAL");
+        assertStock("A", 12, 0); assertStock("B", 8, 8);
+    }
+
+    @Test void balanceFailureRollsBackContentsLedgerAndOwnership() {
+        fixture("BOX"); var failing = spy(balances);
+        doReturn(0).when(failing).adjust(anyLong(), anyString(), anyString(), eq("B"), any(), anyLong(), anyLong(), anyLong());
+        ReflectionTestUtils.setField(target, "balances", failing);
+        assertThrows(ResponseStatusException.class, () -> apply(1, 11, 8, "INITIAL"));
+        assertStock("A", 20, 0); assertEquals(20, balance("A", "total_quantity"));
+        assertEquals(0, count("SELECT COUNT(*) FROM ll_return_inventory_carton_item WHERE sku_code='B'"));
+        assertEquals(0, count("SELECT COUNT(*) FROM ll_return_sku_conversion"));
+        assertEquals(0, count("SELECT COUNT(*) FROM ll_return_packing_trace"));
+    }
+
+    @Test void manualCompletionOnlyConvertsSkuLinesActuallyScannedInCurrentRound() {
+        fixture("BOX");
+        var item = item(11,1,"A","B",8);
+        item.setSkuRelabelItemsJson("[{\"skuCode\":\"A\",\"newSkuCode\":\"B\",\"quantity\":8},{\"skuCode\":\"A\",\"newSkuCode\":\"C\",\"quantity\":4}]");
+        var scan = new com.baiyue.lastleg.relabel.pda.entity.PdaRelabelHistory(); scan.setAction("SKU_SCAN");
+        scan.setDetailJson("{\"round\":\"CURRENT\",\"itemId\":\"11\",\"skuIndex\":0,\"oldSku\":\"A\",\"newSku\":\"B\",\"quantity\":8}");
+        var previous = new com.baiyue.lastleg.relabel.pda.entity.PdaRelabelHistory(); previous.setAction("SKU_SCAN");
+        previous.setDetailJson("{\"round\":\"PREVIOUS\",\"itemId\":\"11\",\"skuIndex\":1,\"oldSku\":\"A\",\"newSku\":\"C\",\"quantity\":4}");
+        service.apply(app(1), List.of(item), List.of(fact(11,1,"EXCEPTION")), "CURRENT", List.of(scan,previous));
+        assertStock("A",12,0); assertStock("B",8,8);
+        assertEquals(0,count("SELECT COUNT(*) FROM ll_return_inventory_carton_item WHERE sku_code='C'"));
+    }
+
+    @Test void foreignCustomerOrWarehouseCannotConvertStock() {
+        fixture("BOX"); var foreign = app(1); foreign.setCustomerId("OTHER");
+        assertThrows(ResponseStatusException.class, () -> service.apply(foreign, List.of(item(11,1,"A","B",8)), List.of(fact(11,1,"RELABELLED")), "INITIAL"));
+        foreign.setCustomerId("C"); foreign.setOverseasWarehouseId("OTHER");
+        assertThrows(ResponseStatusException.class, () -> service.apply(foreign, List.of(item(11,1,"A","B",8)), List.of(fact(11,1,"RELABELLED")), "INITIAL"));
+        assertStock("A", 20, 0);
+    }
+
+    void fixture(String type) {
+        jdbc.update("INSERT INTO ll_return_inventory_carton(id,customer_id,overseas_warehouse_id,carton_mark,source_return_no,source_unit_type,status,count_status,total_quantity,sku_types,relabel_application_id) VALUES(101,'C','W','UNIT-1','RT-1',?,'RELABEL_PENDING','CONFIRMED',20,1,1)",type);
+        jdbc.update("INSERT INTO ll_return_inventory_carton_item(id,carton_id,customer_id,sku_code,product_name_zh,quantity,relabelled_quantity,packing_reserved_quantity) VALUES(201,101,'C','A','Goods',20,0,0)");
+        balances.adjust(301,"C","W","A","Goods",20,20,"BOX".equals(type)?1:0);
+    }
+    void apply(long appId, long itemId, int quantity, String round) {
+        service.apply(app(appId), List.of(item(itemId,appId,"A","B",quantity)), List.of(fact(itemId,1,"RELABELLED")), round);
+    }
+    RelabelApplication app(long id) { var app=new RelabelApplication(); app.setId(id); app.setCustomerId("C"); app.setOverseasWarehouseId("W"); app.setRelabelNo("RL-"+id); return app; }
+    RelabelItem item(long id,long appId,String oldSku,String newSku,int quantity) {
+        var item=new RelabelItem(); item.setId(id); item.setApplicationId(appId); item.setReturnCartonId(101L);
+        item.setOperationType("SKU_LABEL"); item.setSkuCode(oldSku); item.setNewSkuCode(newSku);
+        item.setSkuRelabelItemsJson("[{\"skuCode\":\""+oldSku+"\",\"newSkuCode\":\""+newSku+"\",\"quantity\":"+quantity+"}]"); return item;
+    }
+    PdaRelabelUnitFact fact(long itemId,int quantity,String result) { var f=new PdaRelabelUnitFact(); f.setItemId(itemId); f.setQuantity(quantity); f.setResult(result); return f; }
+    long count(String sql) { return jdbc.queryForObject(sql,Long.class); }
+    long balance(String sku,String column) { return jdbc.queryForObject("SELECT "+column+" FROM ll_return_inventory_balance WHERE sku_code=?",Long.class,sku); }
+    void assertStock(String sku,long quantity,long labelled) {
+        assertEquals(quantity,jdbc.queryForObject("SELECT quantity FROM ll_return_inventory_carton_item WHERE sku_code=?",Long.class,sku));
+        assertEquals(labelled,jdbc.queryForObject("SELECT relabelled_quantity FROM ll_return_inventory_carton_item WHERE sku_code=?",Long.class,sku));
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/returnreceipt/service/ReturnSkuMySqlTestDatabase.java b/lastleg-service/src/test/java/com/baiyue/lastleg/returnreceipt/service/ReturnSkuMySqlTestDatabase.java
new file mode 100644
index 000000000..2e59149e6
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/returnreceipt/service/ReturnSkuMySqlTestDatabase.java
@@ -0,0 +1,79 @@
+package com.baiyue.lastleg.returnreceipt.service;
+
+import com.fasterxml.jackson.databind.ObjectMapper;
+import org.springframework.jdbc.datasource.DriverManagerDataSource;
+import java.nio.file.*;
+import java.sql.*;
+import java.util.*;
+import javax.sql.DataSource;
+
+/** Opt-in TEST only. Each invocation owns a fresh, non-configurable schema; never connects to business schemas. */
+final class ReturnSkuMySqlTestDatabase implements AutoCloseable {
+    private final String schema="cc_sku_accept_"+UUID.randomUUID().toString().replace("-","");
+    private final Map<String,Object> evidence=new LinkedHashMap<>();
+    private DriverManagerDataSource administration;
+    private DataSource source;
+    private boolean created;
+
+    static ReturnSkuMySqlTestDatabase open(String name) throws Exception {
+        var database=new ReturnSkuMySqlTestDatabase();
+        database.evidence.put("test",name); database.evidence.put("schema",database.schema);
+        try { database.initialize(); return database; }
+        catch(Exception failure) { database.close(); throw failure; }
+    }
+
+    private void initialize() throws Exception {
+        if(!Boolean.getBoolean("returnSku.test.mysql") || !"test".equals(required("CHONGCHONG_ENV")))
+            throw new IllegalStateException("Explicit TEST MySQL opt-in required");
+        if(!schema.matches("cc_sku_accept_[a-f0-9]{32}")) throw new IllegalStateException("Unsafe isolated schema");
+        String host=required("CHONGCHONG_DB_HOST"),port=required("CHONGCHONG_DB_PORT");
+        if(!host.matches("[A-Za-z0-9.-]+") || !port.matches("[0-9]{1,5}")) throw new IllegalStateException("Invalid TEST connection settings");
+        String prefix="jdbc:mysql://"+host+":"+port+"/";
+        String options="?useSSL=false&allowPublicKeyRetrieval=true&characterEncoding=UTF-8&connectTimeout=10000&socketTimeout=15000";
+        String user=required("CHONGCHONG_DB_USERNAME"),password=required("CHONGCHONG_DB_PASSWORD");
+        administration=new DriverManagerDataSource(prefix+"information_schema"+options,user,password);
+        try(var connection=administration.getConnection();var statement=connection.createStatement()) {
+            if(!"information_schema".equals(connection.getCatalog()) || !"MySQL".equals(connection.getMetaData().getDatabaseProductName())
+                || connection.getMetaData().getDatabaseMajorVersion()!=8) throw new IllegalStateException("Expected TEST MySQL 8 administrative read catalog");
+            statement.execute("CREATE DATABASE `"+schema+"` CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci");
+            created=true;
+        } catch(SQLException failure) { throw new IllegalStateException("TEST isolated schema creation failed; SQLState="+failure.getSQLState()); }
+        source=new DriverManagerDataSource(prefix+schema+options,user,password) {
+            @Override public Connection getConnection() throws SQLException {
+                var connection=super.getConnection();
+                if(!created || !schema.equals(connection.getCatalog())) { connection.close(); throw new SQLException("Isolated schema boundary rejected"); }
+                return connection;
+            }
+        };
+        evidence.put("created",true); evidence.put("databaseProduct","MySQL 8");
+    }
+
+    DataSource dataSource() { return source; }
+    void record(String key,Object value) { evidence.put(key,value); }
+
+    @Override public void close() throws Exception {
+        try {
+            if(created) {
+                if(!schema.matches("cc_sku_accept_[a-f0-9]{32}")) throw new IllegalStateException("Unsafe cleanup schema");
+                try(var connection=administration.getConnection();var statement=connection.createStatement()) {
+                    if(!"information_schema".equals(connection.getCatalog())) throw new IllegalStateException("Unexpected cleanup catalog");
+                    statement.execute("DROP DATABASE `"+schema+"`"); created=false;
+                    try(var result=statement.executeQuery("SELECT COUNT(*) FROM information_schema.schemata WHERE schema_name='"+schema+"'")) {
+                        result.next(); if(result.getInt(1)!=0) throw new IllegalStateException("Isolated schema cleanup not confirmed");
+                    }
+                    evidence.put("cleaned",true);
+                } catch(SQLException failure) { throw new IllegalStateException("TEST isolated schema cleanup failed; SQLState="+failure.getSQLState()); }
+            }
+        } finally {
+            var root=Path.of(System.getProperty("maven.multiModuleProjectDirectory","."));
+            var directory=root.resolve("reports/return-sku-mysql-acceptance"); Files.createDirectories(directory);
+            new ObjectMapper().writerWithDefaultPrettyPrinter().writeValue(directory.resolve(schema+".json").toFile(),evidence);
+        }
+    }
+
+    private static String required(String name) {
+        String value=System.getenv(name);
+        if(value==null || value.isBlank()) throw new IllegalStateException("Missing TEST environment variable "+name);
+        return value;
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/schema/Phase5OverseasUpgradeSqlContractTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/schema/Phase5OverseasUpgradeSqlContractTest.java
index b4082dc01..1c1237bdf 100644
--- a/lastleg-service/src/test/java/com/baiyue/lastleg/schema/Phase5OverseasUpgradeSqlContractTest.java
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/schema/Phase5OverseasUpgradeSqlContractTest.java
@@ -56,6 +56,22 @@ class Phase5OverseasUpgradeSqlContractTest {
         assertThat(overseas).doesNotContain("\nUPDATE ", "\nDELETE ", "ALTER TABLE ll_");
     }
 
+    @Test
+    void transferFinalMeasurementColumnsAreCreatedBeforeAnyBusinessWrite() throws Exception {
+        for (String path : List.of("lastleg-service/src/main/resources/db/lastleg.sql",
+            "deploy/sql/海外区域统一增量-MySQL8.sql")) {
+            String sql = repositoryFile(path);
+            String carton = createStatement(sql, "ll_warehouse_transfer_carton");
+            for (String column : List.of("customer_carton_mark", "length_cm", "width_cm", "height_cm",
+                "gross_weight_kg", "counted_quantity", "count_idempotency_key", "count_request_hash",
+                "counted_by", "counted_at", "discrepancy_reason", "transfer_pallet_id", "sku_items_json")) {
+                assertThat(carton).as(path + ":" + column).contains(column);
+            }
+            assertThat(createStatement(sql, "ll_warehouse_transfer_item")).contains("declared_quantity");
+            assertThat(createStatement(sql, "ll_cargo_discard_item")).contains("idx_ll_cargo_discard_return_carton");
+        }
+    }
+
     @Test
     void overseasFixedEntryAndModuleBaselineBothDefineCompletePhase5Tables() throws Exception {
         String baseline = repositoryFile("lastleg-service/src/main/resources/db/lastleg.sql");
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/schema/SchemaChineseCommentContractTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/schema/SchemaChineseCommentContractTest.java
index bc57114ec..817b624e7 100644
--- a/lastleg-service/src/test/java/com/baiyue/lastleg/schema/SchemaChineseCommentContractTest.java
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/schema/SchemaChineseCommentContractTest.java
@@ -26,7 +26,7 @@ class SchemaChineseCommentContractTest {
     private static final Pattern CHINESE = Pattern.compile("[\\u4e00-\\u9fff]");
     private static final Pattern TABLE = Pattern.compile(
         "(?is)CREATE\\s+TABLE\\s+(?:IF\\s+NOT\\s+EXISTS\\s+)?(ll_[a-z0-9_]+)"
-            + "\\s*\\((.*?)\\)\\s*ENGINE\\s*=\\s*InnoDB[^;]*?COMMENT\\s*=\\s*'([^']*)'\\s*;");
+            + "\\s*\\((.*?)\\)\\s*ENGINE\\s*=\\s*InnoDB([^;]*);");
 
     @Test
     void allLastlegTablesAndColumnsHaveChineseComments() throws Exception {
@@ -104,7 +104,8 @@ class SchemaChineseCommentContractTest {
         Matcher matcher = TABLE.matcher(sql);
         while (matcher.find()) {
             String table = matcher.group(1);
-            assertTrue(CHINESE.matcher(matcher.group(3)).find(), source + " 表备注必须包含中文: " + table);
+            assertTrue(Pattern.compile("(?is)\\bCOMMENT\\s*=\\s*'[^']*[\\u4e00-\\u9fff][^']*'")
+                .matcher(matcher.group(3)).find(), source + " 表备注必须包含中文: " + table);
             List<String> columns = splitTopLevel(matcher.group(2));
             assertFalse(columns.isEmpty(), source + " 表定义没有字段: " + table);
             List<String> columnNames = new ArrayList<>();
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/schema/SelfoperatedAnalyticsSchemaContractTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/schema/SelfoperatedAnalyticsSchemaContractTest.java
new file mode 100644
index 000000000..7b9e4e314
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/schema/SelfoperatedAnalyticsSchemaContractTest.java
@@ -0,0 +1,167 @@
+package com.baiyue.lastleg.schema;
+
+import org.junit.jupiter.api.Test;
+
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.LinkedHashMap;
+import java.util.Map;
+import java.util.Set;
+import java.util.regex.Pattern;
+
+import static org.junit.jupiter.api.Assertions.*;
+
+class SelfoperatedAnalyticsSchemaContractTest {
+    private static final Pattern TABLE = Pattern.compile(
+        "(?s)CREATE TABLE (?:IF NOT EXISTS )?(ll_selfop_\\w+) \\(.*?\\) ENGINE=InnoDB[^;]+;");
+    private static final Set<String> EXPECTED_TABLES = Set.of(
+        "ll_selfop_outbound_discovery_scope", "ll_selfop_sync_scope", "ll_selfop_sync_task",
+        "ll_selfop_sync_run", "ll_selfop_sync_stage", "ll_selfop_outbound_order",
+        "ll_selfop_outbound_item", "ll_selfop_inventory_snapshot", "ll_selfop_sku_daily_sales",
+        "ll_selfop_warehouse_daily_sales", "ll_selfop_sku_profile", "ll_selfop_owner",
+        "ll_selfop_product", "ll_selfop_inventory_flow", "ll_selfop_inventory_day_version",
+        "ll_selfop_inventory_daily");
+
+    private static Map<String, String> tables(String sql) {
+        var result = new LinkedHashMap<String, String>();
+        var matcher = TABLE.matcher(sql.replace("\r\n", "\n"));
+        while (matcher.find()) {
+            assertNull(result.put(matcher.group(1), matcher.group().replaceFirst("CREATE TABLE IF NOT EXISTS", "CREATE TABLE")),
+                "duplicate table definition");
+        }
+        return result;
+    }
+
+    @Test
+    void sourceAndEmptyDatabaseBaselineContainAllCurrentIndependentTables() throws Exception {
+        var source = tables(Files.readString(Path.of("src/main/resources/db/lastleg.sql")));
+        var deployment = tables(Files.readString(Path.of("../deploy/sql/海外区域统一增量-MySQL8.sql")));
+        assertEquals(EXPECTED_TABLES, source.keySet());
+        assertEquals(source, deployment);
+        for (var entry : source.entrySet()) {
+            var ddl = entry.getValue();
+            boolean master = Set.of("ll_selfop_owner", "ll_selfop_product").contains(entry.getKey());
+            boolean history = Set.of("ll_selfop_inventory_flow", "ll_selfop_inventory_day_version",
+                "ll_selfop_inventory_daily").contains(entry.getKey());
+            if (master) {
+                assertTrue(ddl.contains("source_account VARCHAR(64) COLLATE utf8mb4_bin NOT NULL"));
+                assertTrue(ddl.contains("customer_code VARCHAR(64) COLLATE utf8mb4_bin NOT NULL"));
+                assertTrue(ddl.contains("observed_at_utc DATETIME(6) NOT NULL"));
+            } else {
+                assertTrue(ddl.contains("COLLATE=utf8mb4_bin"), entry.getKey());
+            }
+            if (!master && !history) {
+                assertTrue(ddl.contains("created_at DATETIME(3) NOT NULL"), entry.getKey());
+                assertTrue(ddl.contains("updated_at DATETIME(3) NOT NULL"), entry.getKey());
+            }
+            assertTrue(ddl.contains("PRIMARY KEY ("), entry.getKey());
+            if (entry.getKey().equals("ll_selfop_inventory_daily")) {
+                assertTrue(ddl.contains("PRIMARY KEY (day_version_id,customer_code,sku_code,product_quality)"));
+            } else if (entry.getKey().equals("ll_selfop_warehouse_daily_sales")) {
+                assertTrue(ddl.contains("PRIMARY KEY (sales_run_id,source_account,warehouse_code,business_date)"));
+            } else {
+                assertTrue(ddl.contains("\n  id BIGINT NOT NULL"), entry.getKey());
+            }
+            assertFalse(ddl.contains("AUTO_INCREMENT"));
+            assertFalse(ddl.contains("tenant_id"));
+            assertFalse(ddl.contains("FOREIGN KEY"));
+        }
+    }
+
+    @Test
+    void unknownSourceTimeAndStockCannotBecomeZeroOrEligibleSalesByDefault() throws Exception {
+        var ddl = tables(Files.readString(Path.of("src/main/resources/db/lastleg.sql")));
+        for (var table : new String[]{"ll_selfop_sync_scope", "ll_selfop_outbound_order"}) {
+            assertTrue(ddl.get(table).contains("source_timezone VARCHAR(64) NULL COMMENT"));
+        }
+        var stock = ddl.get("ll_selfop_inventory_snapshot");
+        for (var column : new String[]{"physical_quantity", "available_quantity", "frozen_quantity", "transit_quantity"}) {
+            assertTrue(stock.contains(column + " DECIMAL(20,6) NULL COMMENT"));
+        }
+        assertTrue(ddl.get("ll_selfop_outbound_order").contains("sales_eligible TINYINT NOT NULL DEFAULT 0"));
+        assertTrue(ddl.get("ll_selfop_outbound_order").contains("source_status = 100 AND source_timezone IS NOT NULL"));
+        assertTrue(ddl.get("ll_selfop_outbound_item").contains("CHECK (actual_quantity >= 0)"));
+        // Negative observed stock must be retained as INVALID, never rejected/coerced by a quantity CHECK.
+        assertFalse(stock.contains("CHECK (available_quantity"));
+    }
+
+    @Test
+    void durableRecoveryAndImmutableVersionKeysArePresent() throws Exception {
+        var ddl = tables(Files.readString(Path.of("src/main/resources/db/lastleg.sql")));
+        var task = ddl.get("ll_selfop_sync_task");
+        for (var column : new String[]{"apply_state", "affected_warehouse_codes_json", "observation_baseline",
+            "routing_manifest_json", "request_hash", "apply_completed_at_utc", "task_no", "execution_purpose",
+            "validation_root_task_id", "validation_budget_json", "business_root_task_id", "business_budget_json", "result_published_run_id", "progress_json",
+            "progress_updated_at_utc"}) {
+            assertTrue(task.contains("  " + column + " "), column);
+        }
+        assertTrue(task.contains("UNIQUE KEY uk_selfop_task_no (task_no)"));
+        assertTrue(task.contains("KEY idx_selfop_task_business_root (business_root_task_id,status,id)"));
+        assertTrue(task.contains("CONSTRAINT chk_selfop_business_budget CHECK"));
+        var account = ddl.get("ll_selfop_outbound_discovery_scope");
+        for (var column : new String[]{"api_budget_json", "api_cooldown_until_utc", "api_pause_reason"}) {
+            assertTrue(account.contains("  " + column + " "), column);
+        }
+        var run = ddl.get("ll_selfop_sync_run");
+        for (var column : new String[]{"execution_purpose", "build_started_at_utc", "superseded_at_utc",
+            "progress_snapshot_json", "heartbeat_at_utc", "inventory_daily_sample_date", "inventory_sample_rule_version"}) {
+            assertTrue(run.contains("  " + column + " "), column);
+        }
+        assertTrue(run.contains("uk_selfop_inventory_daily (source_account,warehouse_code,inventory_daily_sample_date)"));
+        assertTrue(run.contains("CONSTRAINT chk_selfop_inventory_daily CHECK"));
+        var daily = ddl.get("ll_selfop_sku_daily_sales");
+        assertTrue(daily.contains("KEY idx_selfop_daily_window_cover (sales_run_id,source_account,warehouse_code,business_date,customer_code,sku_code,outbound_quantity,outbound_order_count,quantity_unit)"));
+        assertTrue(daily.contains("KEY idx_selfop_daily_sku_cover (sales_run_id,source_account,warehouse_code,customer_code,sku_code,business_date,outbound_quantity,outbound_order_count,quantity_unit)"));
+        assertFalse(daily.contains("KEY idx_selfop_daily_window ("));
+        assertTrue(daily.contains("UNIQUE KEY uk_selfop_daily_version (sales_run_id,source_account,customer_code,warehouse_code,sku_code,business_date)"));
+        assertTrue(ddl.get("ll_selfop_outbound_order").contains("idx_selfop_order_daily (source_account,warehouse_code,sales_eligible,business_date,id)"));
+        assertTrue(ddl.get("ll_selfop_sync_stage").contains("stage_batch_id,object_type,object_key_hash"));
+        assertTrue(ddl.get("ll_selfop_sync_stage").contains("observation_sequence IS NOT NULL"));
+        assertTrue(ddl.get("ll_selfop_outbound_order").contains("source_account,customer_code,delivery_no"));
+        assertTrue(ddl.get("ll_selfop_sku_daily_sales").contains("sales_run_id,source_account,customer_code,warehouse_code,sku_code,business_date"));
+        assertTrue(ddl.get("ll_selfop_sku_profile").contains("profile_run_id,source_account,customer_code,warehouse_code,sku_code"));
+        assertTrue(ddl.get("ll_selfop_inventory_snapshot").contains("snapshot_run_id,source_account,customer_code,warehouse_code,sku_code,product_quality"));
+    }
+
+    @Test
+    void factObservationLookupHasEqualityPrefixAndCoversProfileEvidence() throws Exception {
+        var ddl = tables(Files.readString(Path.of("src/main/resources/db/lastleg.sql")));
+        var stage = ddl.get("ll_selfop_sync_stage");
+        assertTrue(stage.contains("KEY idx_selfop_stage_fact_observation (observation_sequence,warehouse_code,object_type,validation_status,run_id,observed_at_utc)"));
+        // Observation lookup and business-key history serve different consumers; both are required.
+        assertTrue(stage.contains("KEY idx_selfop_stage_history (object_type,object_key_hash,stage_batch_id)"));
+        assertTrue(stage.contains("UNIQUE KEY uk_selfop_stage_object (stage_batch_id,object_type,object_key_hash)"));
+    }
+
+    @Test
+    void readSyncAndExportPermissionsAreIndependentWithFourAuthorizedAdminMenus() throws Exception {
+        var seed = Files.readString(Path.of("../iam/src/main/resources/db/selfoperated-analytics-permissions.sql"));
+        var unified = Files.readString(Path.of("../deploy/sql/头程数据库统一增量-MySQL8.sql"));
+        // Compare executable seed statements; explanatory comments and line endings are not SQL facts.
+        String seedSql = seed.replace("\r\n", "\n").replaceAll("(?m)^\\s*--[^\n]*", "");
+        String unifiedSql = unified.replace("\r\n", "\n").replaceAll("(?m)^\\s*--[^\n]*", "");
+        int comparedStatements = 0;
+        for (String statement : seedSql.split(";")) {
+            if (statement.strip().startsWith("INSERT INTO")) {
+                assertTrue(unifiedSql.contains(statement.strip() + ";"), statement);
+                comparedStatements++;
+            }
+        }
+        assertEquals(2, comparedStatements, "permission and role grant INSERT statements must both be checked");
+        assertTrue(seed.contains("platform:self-operated-analytics:list"));
+        assertTrue(seed.contains("platform:self-operated-analytics:sync"));
+        assertTrue(seed.contains("platform:self-operated-analytics:export"));
+        for (var route : new String[]{"/self-operated/overview", "/self-operated/sales", "/self-operated/inventory", "/self-operated/collection"}) {
+            assertTrue(seed.contains(route));
+        }
+        assertTrue(seed.contains("'API',5118100,'platform:self-operated-analytics:list'"));
+        assertTrue(seed.contains("'API',5118130,'platform:self-operated-analytics:sync'"));
+        assertTrue(seed.contains("'API',5118120,'platform:self-operated-analytics:export'"));
+        assertFalse(seed.contains("'MERCHANT'"));
+        assertFalse(seed.contains("INSERT IGNORE"));
+        assertFalse(seed.contains("ON DUPLICATE KEY"));
+        assertTrue(seed.contains("(4000001,5118000,0,"));
+        assertTrue(seed.contains("(4000001,5118001,0,"));
+        assertTrue(seed.contains("(4000001,5118002,0,"));
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/client/RestLingxingAnalyticsClientTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/client/RestLingxingAnalyticsClientTest.java
new file mode 100644
index 000000000..4df074bda
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/client/RestLingxingAnalyticsClientTest.java
@@ -0,0 +1,319 @@
+package com.baiyue.lastleg.selfoperated.analytics.client;
+import com.baiyue.lastleg.selfoperated.analytics.model.SelfopRequestContext;
+
+import com.baiyue.lastleg.selfoperated.analytics.model.SelfopAnalyticsProperties;
+import org.junit.jupiter.api.Test;
+import com.baiyue.lastleg.selfoperated.analytics.request.*;
+import static org.mockito.Mockito.*;
+import org.springframework.http.HttpMethod;
+import org.springframework.http.HttpStatus;
+import org.springframework.http.MediaType;
+import org.springframework.test.web.client.MockRestServiceServer;
+import org.springframework.web.client.RestClient;
+import java.time.LocalDateTime;
+import static org.assertj.core.api.Assertions.*;
+import static org.springframework.test.web.client.match.MockRestRequestMatchers.*;
+import static org.springframework.test.web.client.response.MockRestResponseCreators.*;
+
+class RestLingxingAnalyticsClientTest {
+    private final SelfopAnalyticsProperties properties = new SelfopAnalyticsProperties();
+    private final RestClient.Builder builder = RestClient.builder().baseUrl("http://synthetic-integration");
+    private final MockRestServiceServer server = MockRestServiceServer.bindTo(builder).build();
+    private final SelfopEgressService egress = mock(SelfopEgressService.class);
+    private final RestLingxingAnalyticsClient client = new RestLingxingAnalyticsClient(builder.build(), properties, egress);
+    private static SelfopRequestContext context(String account) { return new SelfopRequestContext(account,"BUSINESS",1L,"selfop-1","grant",1L,2L); }
+    private static final String PREFIX = "http://synthetic-integration/internal/integrations/lingxing/wms";
+
+    private void enable() {
+
+        properties.setCollectionMode("BUSINESS");
+        when(egress.reserve(any(),any(),anyInt(),any(),any(),any())).thenAnswer(i -> {
+            SelfopRequestContext c=i.getArgument(0);
+            return new SelfopEgressDtos.EgressContext(c.sourceAccount(),c.executionPurpose(),"1",c.sessionId(),"synthetic-attempt",c.exclusiveGrantId());
+        });
+        properties.setSourceAccount("synthetic-account");
+        properties.setInternalServiceToken("synthetic-token");
+    }
+    @Test void masterPagesKeepNamesAndSeparateDeclaredAndMeasuredDimensions() {
+        enable();
+        expect("/customers/query", "{\"current\":1,\"size\":1000}", """
+            {"code":"200","data":{"current":1,"size":1000,"pages":1,"total":"1","records":[{"customerCode":"C","customerName":"客户","status":"0"}]}}
+            """);
+        expect("/products/query", "{\"current\":1,\"size\":100}", """
+            {"code":"200","data":{"current":1,"size":100,"pages":1,"total":"1","records":[{"customerCode":"C","sku":"SKU","productName":"商品","length":5,"width":11,"height":5,"sizeUnit":"cm","wmsLength":null,"wmsWidth":null,"wmsHeight":null,"wmsSizeUnit":null}]}}
+            """);
+        assertThat(client.customers(context("synthetic-account"),1,1000).records().get(0).customerName()).isEqualTo("客户");
+        var product=client.products(context("synthetic-account"),1,100).records().get(0);
+        assertThat(product.length()).isEqualByComparingTo("5");assertThat(product.sizeUnit()).isEqualTo("cm");assertThat(product.wmsLength()).isNull();assertThat(product.wmsSizeUnit()).isNull();
+        verify(egress).reserve(any(),eq(SelfopEgressDtos.Operation.CUSTOMERS),eq(1000),isNull(),isNull(),any());
+        verify(egress).reserve(any(),eq(SelfopEgressDtos.Operation.PRODUCTS),eq(100),isNull(),isNull(),any());server.verify();
+    }
+    @Test void disabledByDefaultAndAccountBindingFailBeforeTransport() {
+        assertThatThrownBy(() -> client.warehouses(context("synthetic-account"), 1, 100)).hasMessage("EXECUTION_DISABLED");
+        enable();
+        assertThatThrownBy(() -> client.warehouses(context("other-account"), 1, 100)).hasMessage("SOURCE_ACCOUNT_MISMATCH");
+        properties.setInternalServiceToken("");
+        assertThatThrownBy(() -> client.warehouses(context("synthetic-account"), 1, 100)).hasMessage("INTERNAL_TOKEN_UNCONFIGURED");
+        server.verify();
+    }
+    @Test void oneWarehousePagePreservesTimezoneAsClueAndStringLongMetadata() {
+        enable();
+        expect("/warehouses/query", "{\"current\":1,\"size\":100}", """
+            {"code":"200","data":{"current":1,"size":100,"pages":1,"total":"1","records":[
+            {"whCode":"WH-A","whNameCn":"A","warehouseType":1,"status":0,"timeZone":"America/New_York"}]}}
+            """);
+        var page = client.warehouses(context("synthetic-account"), 1, 100);
+        assertThat(page.total()).isEqualTo(1L);
+        assertThat(page.records().get(0).timeZone()).isEqualTo("America/New_York");
+        assertThat(properties.getSourceQueryTimezone()).isNull();
+        server.verify();
+    }
+    @Test void discoveryUsesNormalizedEmptyMetadataAndDoesNotSendWarehouseFilter() {
+        enable();
+        expect("/outbound-orders/query", """
+            {"startTime":"2026-10-01T00:00:00","endTime":"2026-10-02T00:00:00","current":1,"size":100}
+            """, "{\"code\":\"200\",\"data\":{\"current\":1,\"size\":100,\"pages\":0,\"total\":\"0\",\"records\":[]}}");
+        assertThat(client.discover(context("synthetic-account"), LocalDateTime.of(2026,10,1,0,0),
+                LocalDateTime.of(2026,10,2,0,0), 1, 100).records()).isEmpty();
+        server.verify();
+    }
+    @Test void locateHasNoTimeOrStatusAndReturnsCurrentCancelledIdentity() {
+        enable();
+        expect("/outbound-orders/locate", "{\"deliveryNo\":\"DO-1\",\"current\":1,\"size\":100}", """
+            {"code":"200","data":{"current":1,"size":100,"pages":1,"total":1,"records":[
+            {"deliveryNo":"DO-1","sourceNo":"SRC-1","customerCode":"C","whCode":"WH-B","status":99,"outboundTime":null}]}}
+            """);
+        var summary = client.locate(context("synthetic-account"), "DO-1", 1, 100).records().get(0);
+        assertThat(summary.sourceStatus()).isEqualTo(99);
+        assertThat(summary.warehouseCode()).isEqualTo("WH-B");
+        server.verify();
+    }
+    @Test void listItemsUseQtyAndKeepUnknownSeparateFromZero() {
+        enable();properties.setQuantityUnit("PCS");
+        expect("/outbound-orders/locate", "{\"deliveryNo\":\"DO-1\",\"current\":1,\"size\":100}", """
+            {"code":"200","data":{"current":1,"size":100,"pages":1,"total":1,"records":[
+            {"deliveryNo":"DO-1","customerCode":"C","whCode":"WH-A","status":100,
+            "productList":[{"productSku":"SKU","qty":2.123456,"actualDeliveryQty":99},
+            {"productSku":"ZERO","qty":0},{"productSku":"UNKNOWN"}]}]}}
+            """);
+        var summary=client.locate(context("synthetic-account"),"DO-1",1,100).records().get(0);
+        assertThat(summary.items().get(0).actualQuantity()).isEqualByComparingTo("2.123456");
+        assertThat(summary.items().get(1).actualQuantity()).isEqualByComparingTo("0");
+        assertThat(summary.items().get(2).actualQuantity()).isNull();
+        assertThat(summary.items().get(0).quantityUnit()).isEqualTo("PCS");
+        assertThat(LingxingAnalyticsClient.needsDetail(summary.order())).isTrue();server.verify();
+    }
+    @Test void detailProjectsActualLinesOnlyAndDoesNotInventUnitOrTimestamp() {
+        enable();
+        expect("/outbound-orders/detail", "{\"warehouseCode\":\"WH-A\",\"customerCode\":\"C\",\"deliveryNo\":\"DO-1\"}", """
+            {"code":"200","data":{"deliveryNo":"DO-1","customerCode":"C","whCode":"WH-A","status":100,
+            "orderCreateTime":"2025-01-01 00:00:00","outboundTime":"2026-10-01 00:00:00",
+            "skuVOList":[{"productSku":"sku","actualDeliveryQty":2.125,"deliveryQty":99},
+                         {"productSku":"sku","actualDeliveryQty":3}],
+            "packageList":[{"skuList":[{"actualDeliveryQty":"5.125"}]}]}}
+            """);
+        var order = client.detail(context("synthetic-account"), "WH-A", "C", "DO-1");
+        assertThat(order.items()).hasSize(2);
+        assertThat(order.items().get(0).actualQuantity()).isEqualByComparingTo("2.125");
+        assertThat(order.items().get(0).quantityUnit()).isNull();
+        assertThat(order.sourceCreatedTime()).isEqualTo("2025-01-01 00:00:00");
+        server.verify();
+    }
+    @Test void inventoryPreservesUnknownNegativeAndAllQualitiesWithoutInventedArithmetic() {
+        enable();
+        expect("/product-inventory/query", "{\"warehouseCode\":\"WH-A\",\"current\":1,\"size\":1000}", """
+            {"code":"200","data":{"current":1,"size":1000,"pages":1,"total":1,"records":[
+            {"customerCode":"C","whCode":"WH-A","productSku":"sku","productQuality":1,
+             "stkQty":120,"freezeQty":20,"useStkQty":100.125,"transitQty":-3}]}}
+            """);
+        var row = client.inventory(context("synthetic-account"), "WH-A", 1, 1000).records().get(0);
+        assertThat(row.productQuality()).isEqualTo(1);
+        assertThat(row.availableQuantity()).isEqualByComparingTo("100.125");
+        assertThat(row.transitQuantity()).isEqualByComparingTo("-3");
+        server.verify();
+    }
+    @Test void missingPageMetadataCannotBeInterpretedAsEmptySuccess() {
+        enable();
+        expect("/warehouses/query", "{\"current\":1,\"size\":100}",
+                "{\"code\":\"200\",\"data\":{\"records\":[]}}");
+        assertThatThrownBy(() -> client.warehouses(context("synthetic-account"), 1, 100)).isInstanceOf(AnalyticsClientException.class);
+        server.verify();
+    }
+    @Test void unknownStockIsNotZeroAndDecimalPrecisionIsRetained() {
+        enable();
+        expect("/product-inventory/query", "{\"warehouseCode\":\"WH-A\",\"current\":1,\"size\":100}", """
+            {"code":"200","data":{"current":1,"size":100,"pages":1,"total":1,"records":[
+            {"customerCode":"C","whCode":"WH-A","productSku":"sku","productQuality":0,
+             "stkQty":99999999999999.123456,"freezeQty":"","useStkQty":null,"transitQty":0}]}}
+            """);
+        var stock = client.inventory(context("synthetic-account"), "WH-A", 1, 100).records().get(0);
+        assertThat(stock.physicalQuantity()).isEqualByComparingTo("99999999999999.123456");
+        assertThat(stock.frozenQuantity()).isNull();
+        assertThat(stock.availableQuantity()).isNull();
+        assertThat(stock.transitQuantity()).isEqualByComparingTo("0");
+        server.verify();
+    }
+    @Test void detailIdentityMismatchIsNotTreatedAsCancellationOrZero() {
+        enable();
+        expect("/outbound-orders/detail", "{\"warehouseCode\":\"WH-A\",\"customerCode\":\"C\",\"deliveryNo\":\"DO-1\"}", """
+            {"code":"200","data":{"deliveryNo":"DO-2","customerCode":"C","whCode":"WH-A","status":99,"skuVOList":[]}}
+            """);
+        assertThatThrownBy(() -> client.detail(context("synthetic-account"), "WH-A", "C", "DO-1"))
+                .hasMessage("DETAIL_IDENTITY_MISMATCH");
+        server.verify();
+    }
+    @Test void scopeLeakIsRejected() {
+        enable();
+        expect("/product-inventory/query", "{\"warehouseCode\":\"WH-A\",\"current\":1,\"size\":100}", """
+            {"code":"200","data":{"current":1,"size":100,"pages":1,"total":1,"records":[
+            {"customerCode":"C","whCode":"WH-B","productSku":"sku","productQuality":0}]}}
+            """);
+        assertThatThrownBy(() -> client.inventory(context("synthetic-account"), "WH-A", 1, 100)).hasMessage("INVENTORY_WAREHOUSE_MISMATCH");
+        server.verify();
+    }
+    @Test void errorsKeepRetryabilityWithoutRawProviderText() {
+        enable();
+        expect("/warehouses/query", "{\"current\":1,\"size\":100}", """
+            {"code":"BIZ_503","message":"sensitive source response","data":{"retryable":true}}
+            """);
+        server.expect(requestTo(PREFIX + "/warehouses/query")).andRespond(withStatus(HttpStatus.UNAUTHORIZED)
+                .body("sensitive token response"));
+        assertThatThrownBy(() -> client.warehouses(context("synthetic-account"), 1, 100))
+                .hasMessage("INTEGRATION_PROVIDER_FAILURE")
+                .satisfies(e -> assertThat(((AnalyticsClientException)e).retryable()).isTrue());
+        assertThatThrownBy(() -> client.warehouses(context("synthetic-account"), 1, 100))
+                .hasMessage("INTEGRATION_HTTP_FAILURE")
+                .satisfies(e -> assertThat(((AnalyticsClientException)e).retryable()).isFalse());
+        server.verify();
+    }
+    @Test void knownErrorsPreserveSafeClassificationAndCredentialFailuresNeverRetry() {
+        enable();
+        String[] codes = {"LINGXING_WMS_AUTHORIZATION_REJECTED", "LINGXING_WMS_SIGNATURE_REJECTED",
+                "LINGXING_WMS_SOURCE_REJECTED", "LINGXING_WMS_INVALID_RESPONSE"};
+        boolean[] upstreamRetryable = {true, true, false, true};
+        boolean[] expectedRetryable = {false, false, false, true};
+        for (int i = 0; i < codes.length; i++) {
+            expect("/warehouses/query", "{\"current\":1,\"size\":100}",
+                    "{\"code\":\"BIZ_503\",\"message\":\"secret raw provider message\",\"data\":{\"errorCode\":\""
+                            + codes[i] + "\",\"retryable\":" + upstreamRetryable[i] + "}}");
+        }
+        for (int i = 0; i < codes.length; i++) {
+            String code = codes[i]; boolean retryable = expectedRetryable[i];
+            assertThatThrownBy(() -> client.warehouses(context("synthetic-account"), 1, 100))
+                    .hasMessage(code).hasNoCause()
+                    .satisfies(e -> {
+                        assertThat(((AnalyticsClientException)e).code()).isEqualTo(code);
+                        assertThat(((AnalyticsClientException)e).retryable()).isEqualTo(retryable);
+                    });
+        }
+        server.verify();
+    }
+    @Test void unrecognizedProviderCodeCannotLeakThroughDiagnosticMessage() {
+        enable();
+        expect("/warehouses/query", "{\"current\":1,\"size\":100}", """
+            {"code":"BIZ_400","message":"sensitive source response",
+             "data":{"errorCode":"sensitive arbitrary provider code","retryable":false}}
+            """);
+        assertThatThrownBy(() -> client.warehouses(context("synthetic-account"), 1, 100))
+                .hasMessage("INTEGRATION_PROVIDER_FAILURE").hasNoCause();
+        server.verify();
+    }
+    @Test void durableDenialPreservesSampleStopAndQueueDeadline() {
+        enable();
+        expect("/warehouses/query","{\"current\":1,\"size\":100}","{\"code\":\"B0001\",\"data\":{\"errorCode\":\"LINGXING_WMS_BUDGET_AUTHORIZATION_DENIED\",\"denial\":{\"errorCode\":\"ACCOUNT_INTERVAL_WAIT\",\"sampleDone\":false,\"waitUntil\":\"2026-10-12T00:00:05Z\"}}}");
+        expect("/warehouses/query","{\"current\":1,\"size\":100}","{\"code\":\"B0001\",\"data\":{\"errorCode\":\"LINGXING_WMS_BUDGET_AUTHORIZATION_DENIED\",\"denial\":{\"errorCode\":\"VALIDATION_DEADLINE\",\"sampleDone\":true,\"waitUntil\":null}}}");
+        assertThatThrownBy(()->client.warehouses(context("synthetic-account"),1,100)).isInstanceOf(EgressRejectedException.class).satisfies(e->assertThat(((EgressRejectedException)e).waitUntilUtc()).isEqualTo(LocalDateTime.of(2026,10,12,0,0,5)));
+        assertThatThrownBy(()->client.warehouses(context("synthetic-account"),1,100)).isInstanceOf(EgressRejectedException.class).satisfies(e->assertThat(((EgressRejectedException)e).sampleDone()).isTrue());server.verify();
+    }
+    @Test void allFiveEndpointsSendOnlyTheCurrentControlHeaderOverLoopbackHttp() throws Exception {
+        enable();properties.setEnvironment("production");
+        String control="{\"sourceAccount\":\"synthetic-account\",\"executionPurpose\":\"BUSINESS\",\"rootTaskId\":\"1\",\"sessionId\":\"selfop-1\",\"attemptId\":\"synthetic-attempt\",\"exclusiveGrantId\":\"grant\"}";
+        var received=new java.util.concurrent.ConcurrentHashMap<String,String>();
+        var calls=new java.util.concurrent.atomic.AtomicInteger();
+        var wrongHeaders=new java.util.concurrent.atomic.AtomicInteger();
+        var loopback=com.sun.net.httpserver.HttpServer.create(new java.net.InetSocketAddress("127.0.0.1",0),0);
+        loopback.createContext("/internal/integrations/lingxing/wms",exchange->{
+            calls.incrementAndGet();String path=exchange.getRequestURI().getPath();
+            String actual=exchange.getRequestHeaders().getFirst("X-Lingxing-Egress-Context");
+            if(exchange.getRequestHeaders().containsKey("X-Lingxing-Egress-SelfopRequestContext"))wrongHeaders.incrementAndGet();
+            boolean accepted=control.equals(actual)&&"synthetic-token".equals(exchange.getRequestHeaders().getFirst("X-Internal-Service-Token"))
+                &&"POST".equals(exchange.getRequestMethod());
+            if(actual!=null)received.put(path,actual);
+            exchange.getRequestBody().readAllBytes();
+            String data;
+            if(path.endsWith("/outbound-orders/detail")) {
+                data="{\"deliveryNo\":\"D\",\"customerCode\":\"C\",\"whCode\":\"A\",\"status\":100,\"skuVOList\":[{\"productSku\":\"SKU\",\"actualDeliveryQty\":1}]}";
+            } else {
+                String row=path.endsWith("/warehouses/query")
+                    ?"{\"whCode\":\"A\",\"whNameCn\":\"Synthetic\",\"warehouseType\":0,\"status\":0}"
+                    :path.endsWith("/product-inventory/query")
+                        ?"{\"whCode\":\"A\",\"customerCode\":\"C\",\"productSku\":\"SKU\",\"productQuality\":0,\"stkQty\":1,\"useStkQty\":1,\"freezeQty\":0,\"transitQty\":0}"
+                        :"{\"whCode\":\"A\",\"customerCode\":\"C\",\"deliveryNo\":\"D\",\"status\":100}";
+                data="{\"current\":1,\"size\":1,\"pages\":1,\"total\":\"1\",\"records\":["+row+"]}";
+            }
+            byte[] response=("{\"code\":\"200\",\"data\":"+data+"}").getBytes(java.nio.charset.StandardCharsets.UTF_8);
+            exchange.getResponseHeaders().set("Content-Type","application/json");
+            exchange.sendResponseHeaders(accepted?200:403,response.length);
+            exchange.getResponseBody().write(response);exchange.close();
+        });
+        loopback.start();
+        try {
+            properties.setIntegrationBaseUrl("http://127.0.0.1:"+loopback.getAddress().getPort());
+            var httpClient=new RestLingxingAnalyticsClient(RestClient.builder(),properties,egress);
+            var ctx=context("synthetic-account");
+            assertThat(httpClient.warehouses(ctx,1,1).records()).hasSize(1);
+            assertThat(httpClient.discover(ctx,LocalDateTime.of(2026,10,1,0,0),LocalDateTime.of(2026,10,2,0,0),1,1).records()).hasSize(1);
+            assertThat(httpClient.locate(ctx,"D",1,1).records()).hasSize(1);
+            assertThat(httpClient.detail(ctx,"A","C","D").items()).hasSize(1);
+            assertThat(httpClient.inventory(ctx,"A",1,1).records()).hasSize(1);
+            assertThat(calls.get()).isEqualTo(5);assertThat(wrongHeaders.get()).isZero();
+            assertThat(received).hasSize(5);assertThat(received.values()).containsOnly(control);
+            verify(egress,never()).pauseUncertain(any(),any(),any());
+        } finally {loopback.stop(0);}
+    }
+    @Test void unconfirmedCompletionResponsePersistsPauseForItsReservedAttempt() {
+        enable();
+        expect("/warehouses/query","{\"current\":1,\"size\":1}","""
+            {"code":"B0001","data":{"errorCode":"LINGXING_WMS_BUDGET_COMPLETION_UNCONFIRMED","retryable":false,
+             "egress":{"attemptId":"synthetic-attempt","actualHttpAttempts":1,"accountPaused":true,"cooldownUntil":null}}}
+            """);
+        assertThatThrownBy(()->client.warehouses(context("synthetic-account"),1,1)).hasMessage("LINGXING_WMS_BUDGET_COMPLETION_UNCONFIRMED");
+        verify(egress).pauseUncertain(argThat(c->"synthetic-account".equals(c.sourceAccount())&&"synthetic-attempt".equals(c.attemptId())),
+            eq(SelfopEgressDtos.Operation.WAREHOUSES),eq("LINGXING_WMS_BUDGET_COMPLETION_UNCONFIRMED"));server.verify();
+    }
+    @Test void wrongResponseAttemptCannotPersistPauseForTheCurrentReservation() {
+        enable();
+        expect("/warehouses/query","{\"current\":1,\"size\":1}","""
+            {"code":"B0001","data":{"errorCode":"LINGXING_WMS_BUDGET_COMPLETION_UNCONFIRMED",
+             "egress":{"attemptId":"another-attempt","actualHttpAttempts":1,"accountPaused":true}}}
+            """);
+        assertThatThrownBy(()->client.warehouses(context("synthetic-account"),1,1)).hasMessage("INTEGRATION_PAUSE_BINDING_INVALID");
+        verify(egress,never()).pauseUncertain(any(),any(),any());server.verify();
+    }
+    @Test void transportResponseLossPersistsPauseWithoutAnotherHttpAttempt() {
+        enable();
+        server.expect(requestTo(PREFIX+"/warehouses/query")).andRespond(request->{throw new org.springframework.web.client.ResourceAccessException("synthetic reply lost");});
+        assertThatThrownBy(()->client.warehouses(context("synthetic-account"),1,1)).hasMessage("INTEGRATION_TRANSPORT_FAILURE");
+        verify(egress).pauseUncertain(any(),eq(SelfopEgressDtos.Operation.WAREHOUSES),eq("INTEGRATION_TRANSPORT_FAILURE"));
+        verify(egress,times(1)).reserve(any(),any(),anyInt(),any(),any(),any());server.verify();
+    }
+    @Test void rateAndUnconfirmedAckRemainDifferentSignalsToTheDurableAccount() {
+        enable();
+        String[] codes={"LINGXING_WMS_HTTP_RATE_LIMITED","LINGXING_WMS_BUDGET_COMPLETION_UNCONFIRMED"};
+        for(String code:codes){
+            expect("/warehouses/query","{\"current\":1,\"size\":1}","{\"code\":\"B0001\",\"data\":{\"errorCode\":\""+code+"\",\"retryable\":false,\"egress\":{\"attemptId\":\"synthetic-attempt\",\"actualHttpAttempts\":1,\"accountPaused\":true}}}");
+        }
+        for(String code:codes){
+            assertThatThrownBy(()->client.warehouses(context("synthetic-account"),1,1)).hasMessage(code);
+            verify(egress).pauseUncertain(any(),eq(SelfopEgressDtos.Operation.WAREHOUSES),eq(code));
+        }
+        server.verify();
+    }
+    private void expect(String path, String request, String response) {
+        server.expect(requestTo(PREFIX + path)).andExpect(method(HttpMethod.POST))
+                .andExpect(header("X-Internal-Service-Token", "synthetic-token"))
+                .andExpect(header("X-Lingxing-Egress-Context", "{\"sourceAccount\":\"synthetic-account\",\"executionPurpose\":\"BUSINESS\",\"rootTaskId\":\"1\",\"sessionId\":\"selfop-1\",\"attemptId\":\"synthetic-attempt\",\"exclusiveGrantId\":\"grant\"}"))
+                .andExpect(content().json(request, true))
+                .andRespond(withSuccess(response, MediaType.APPLICATION_JSON));
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/controller/PlatformAnalyticsControllerTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/controller/PlatformAnalyticsControllerTest.java
new file mode 100644
index 000000000..c0529f424
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/controller/PlatformAnalyticsControllerTest.java
@@ -0,0 +1,111 @@
+package com.baiyue.lastleg.selfoperated.analytics.controller;
+
+import com.baiyue.common.security.AuthenticatedUser;
+import com.baiyue.lastleg.selfoperated.analytics.query.*;
+import org.junit.jupiter.api.Test;
+import org.springframework.core.MethodParameter;
+import org.springframework.security.access.prepost.PreAuthorize;
+import org.springframework.test.web.servlet.setup.MockMvcBuilders;
+import org.springframework.web.bind.support.WebDataBinderFactory;
+import org.springframework.web.context.request.NativeWebRequest;
+import org.springframework.web.method.support.*;
+import org.springframework.web.server.ResponseStatusException;
+import org.mockito.ArgumentCaptor;
+import java.time.Instant;
+import java.time.LocalDate;
+import java.util.Set;
+import static org.junit.jupiter.api.Assertions.*;
+import static org.mockito.Mockito.*;
+import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
+import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
+
+class PlatformAnalyticsControllerTest {
+    private static AuthenticatedUser platform(){return new AuthenticatedUser(1L,0L,0L,1L,"demo","PLATFORM","WEB",Set.of(PlatformAnalyticsController.READ_PERMISSION));}
+    @Test void rejectsCustomerEvenWithReadPermission(){
+        var service=mock(AnalyticsQueryService.class);var collection=mock(CollectionQueryService.class);
+        var controller=new PlatformAnalyticsController(service,collection,mock(DashboardQueryService.class));
+        var user=new AuthenticatedUser(1L,2L,2L,1L,"demo","CLIENT","WEB",Set.of(PlatformAnalyticsController.READ_PERMISSION));
+        assertThrows(ResponseStatusException.class,()->controller.inventoryCoverage(user,null,null));
+        assertThrows(ResponseStatusException.class,()->controller.ownerDirectory(user,null));
+        assertThrows(ResponseStatusException.class,()->controller.syncTaskDetail(user,"LXCOL-DEMO",null));
+        verifyNoInteractions(service,collection);
+    }
+    @Test void writePermissionAloneDoesNotAuthorizeAnyRead(){
+        var service=mock(AnalyticsQueryService.class);var collection=mock(CollectionQueryService.class);
+        var controller=new PlatformAnalyticsController(service,collection,mock(DashboardQueryService.class));
+        var user=new AuthenticatedUser(1L,0L,0L,1L,"demo","PLATFORM","WEB",Set.of("platform:self-operated-analytics:sync"));
+        assertThrows(ResponseStatusException.class,()->controller.hotSkus(user,null));
+        assertThrows(ResponseStatusException.class,()->controller.ownerDirectory(user,null));
+        assertThrows(ResponseStatusException.class,()->controller.syncOverview(user,null));
+        assertThrows(ResponseStatusException.class,()->controller.slowSkus(null,null));
+        verifyNoInteractions(service,collection);
+    }
+    @Test void allElevenReadEndpointsShareTheIndependentGuard(){
+        var service=mock(AnalyticsQueryService.class);var collection=mock(CollectionQueryService.class);
+        var c=new PlatformAnalyticsController(service,collection,mock(DashboardQueryService.class));var user=platform();
+        c.salesSummary(user,null,com.baiyue.lastleg.selfoperated.analytics.query.SalesSort.QUANTITY_DESC);c.dailySales(user,null);c.hotSkus(user,null);c.slowSkus(user,null);c.inventoryCoverage(user,null,null);
+        c.ownerDirectory(user,null);c.owners(user,null,null);c.ownerOverview(user,null,null);c.syncOverview(user,null);c.syncTasks(user,null);c.syncTaskDetail(user,"LXCOL-DEMO",null);c.syncRuns(user,null);
+        verify(service).ownerDirectory(null);
+        verify(service).salesSummary(null,com.baiyue.lastleg.selfoperated.analytics.query.SalesSort.QUANTITY_DESC);verify(service).dailySales(null);verify(service).hotSkus(null);
+        verify(service).slowSkus(null);verify(service).inventoryCoverage(null,null);
+        verify(service).owners(null,null);verify(service).ownerOverview(null,null);verify(collection).overview(null);verify(collection).tasks(null);verify(collection).taskDetail("LXCOL-DEMO",null);verify(collection).runs(null);
+        assertEquals("hasAuthority('platform:self-operated-analytics:list')",PlatformAnalyticsController.class.getAnnotation(PreAuthorize.class).value());
+    }
+    private static HandlerMethodArgumentResolver identity(){
+        return new HandlerMethodArgumentResolver(){
+            public boolean supportsParameter(MethodParameter p){return p.getParameterType()==AuthenticatedUser.class;}
+            public Object resolveArgument(MethodParameter p,ModelAndViewContainer c,NativeWebRequest r,WebDataBinderFactory b){return platform();}
+        };
+    }
+    @Test void httpBindsCanonicalChartContextAndCustomInclusiveDates() throws Exception{
+        var service=mock(AnalyticsQueryService.class);var collection=mock(CollectionQueryService.class);
+        var mvc=MockMvcBuilders.standaloneSetup(new PlatformAnalyticsController(service,collection,mock(DashboardQueryService.class))).setCustomArgumentResolvers(identity()).build();
+        mvc.perform(get("/api/platform/v1/last-leg/self-operated-analytics/sku-sales-summary")
+            .param("sourceAccount","demo").param("warehouseCode","W").param("rangePreset","CUSTOM").param("startDate","2026-10-01")
+            .param("endDate","2026-10-12").param("current","2").param("size","20").param("salesRunId","11").param("inventoryRunId","22")
+            .param("salesScopeHash","a".repeat(64)).param("inventoryScopeHash","b".repeat(64))
+            .param("queryAsOf","2026-10-12T04:00:00Z")).andExpect(status().isOk());
+        var cap=ArgumentCaptor.forClass(AnalyticsQuery.class);verify(service).salesSummary(cap.capture(),eq(com.baiyue.lastleg.selfoperated.analytics.query.SalesSort.QUANTITY_DESC));
+        assertEquals(LocalDate.of(2026,10,1),cap.getValue().startDate());assertEquals(Instant.parse("2026-10-12T04:00:00Z"),cap.getValue().queryAsOf());
+        assertEquals(11L,cap.getValue().salesRunId());assertEquals(2,cap.getValue().current());
+    }
+    @Test void salesSortBindsAscendingAndRejectsUnknownValues() throws Exception {
+        var service=mock(AnalyticsQueryService.class);
+        var mvc=MockMvcBuilders.standaloneSetup(new PlatformAnalyticsController(service,mock(CollectionQueryService.class),mock(DashboardQueryService.class))).setCustomArgumentResolvers(identity()).build();
+        mvc.perform(get("/api/platform/v1/last-leg/self-operated-analytics/sku-sales-summary").param("salesSort","QUANTITY_ASC")).andExpect(status().isOk());
+        verify(service).salesSummary(any(),eq(com.baiyue.lastleg.selfoperated.analytics.query.SalesSort.QUANTITY_ASC));
+        clearInvocations(service);
+        mvc.perform(get("/api/platform/v1/last-leg/self-operated-analytics/sku-sales-summary").param("salesSort","invalid")).andExpect(status().isBadRequest());
+        verifyNoInteractions(service);
+    }
+    @Test void collectionUsesBusinessTaskNumberAndIndependentLightweightDto() throws Exception{
+        var service=mock(AnalyticsQueryService.class);var collection=mock(CollectionQueryService.class);
+        var mvc=MockMvcBuilders.standaloneSetup(new PlatformAnalyticsController(service,collection,mock(DashboardQueryService.class))).setCustomArgumentResolvers(identity()).build();
+        mvc.perform(get("/api/platform/v1/last-leg/self-operated-analytics/sync-tasks/LXCOL-DEMO")
+            .param("sourceAccount","demo").param("warehouseCode","W")).andExpect(status().isOk());
+        var cap=ArgumentCaptor.forClass(CollectionQuery.class);verify(collection).taskDetail(eq("LXCOL-DEMO"),cap.capture());
+        assertEquals("W",cap.getValue().warehouseCode());verifyNoInteractions(service);
+    }
+    @Test void inventoryHttpBindsAttentionSortAndThresholdIndependentlyFromVersionIdentity()throws Exception{
+        var service=mock(AnalyticsQueryService.class);var collection=mock(CollectionQueryService.class);
+        var mvc=MockMvcBuilders.standaloneSetup(new PlatformAnalyticsController(service,collection,mock(DashboardQueryService.class))).setCustomArgumentResolvers(identity()).build();
+        mvc.perform(get("/api/platform/v1/last-leg/self-operated-analytics/inventory-coverage").param("sourceAccount","demo").param("warehouseCode","W")
+            .param("customerCode","C").param("attention","COVERAGE_GT_THRESHOLD").param("sortBy","COVERAGE_DAYS_DESC").param("coverageDaysThreshold","90")
+            .param("salesWindowDays","10").param("salesWindowEndDate","2026-10-12")).andExpect(status().isOk());
+        var q=ArgumentCaptor.forClass(AnalyticsQuery.class);var options=ArgumentCaptor.forClass(AnalyticsInventoryOptions.class);
+        verify(service).inventoryCoverage(q.capture(),options.capture());assertEquals("C",q.getValue().customerCode());
+        assertEquals("COVERAGE_GT_THRESHOLD",options.getValue().attention());assertEquals("COVERAGE_DAYS_DESC",options.getValue().sortBy());assertEquals(90,options.getValue().coverageDaysThreshold());
+        assertEquals(10,options.getValue().salesWindowDays());assertEquals(LocalDate.of(2026,10,12),options.getValue().salesWindowEndDate());assertNull(q.getValue().queryAsOf());
+        verifyNoInteractions(collection);
+    }
+    @Test void dashboardUsesIndependentReadGuardAndRejectsArbitraryTopN()throws Exception{
+        var service=mock(AnalyticsQueryService.class);var collection=mock(CollectionQueryService.class);var dashboard=mock(DashboardQueryService.class);
+        var controller=new PlatformAnalyticsController(service,collection,dashboard);
+        var customer=new AuthenticatedUser(1L,2L,2L,1L,"demo","CLIENT","WEB",Set.of(PlatformAnalyticsController.READ_PERMISSION));
+        assertThrows(ResponseStatusException.class,()->controller.dashboard(customer,null,java.util.Map.of()));verifyNoInteractions(dashboard);
+        assertThrows(com.baiyue.common.core.exception.BizException.class,()->controller.dashboard(platform(),null,java.util.Map.of("topN","500")));
+        var mvc=MockMvcBuilders.standaloneSetup(controller).setCustomArgumentResolvers(identity()).build();
+        mvc.perform(get("/api/platform/v1/last-leg/self-operated-analytics/dashboard").param("sourceAccount","demo").param("warehouseCode","W").param("rangePreset","TODAY")).andExpect(status().isOk());
+        var q=ArgumentCaptor.forClass(AnalyticsQuery.class);verify(dashboard).dashboard(q.capture());assertEquals("TODAY",q.getValue().rangePreset());assertNull(q.getValue().size());
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/controller/PlatformInventoryFlowProbeControllerTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/controller/PlatformInventoryFlowProbeControllerTest.java
new file mode 100644
index 000000000..0aab0ce34
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/controller/PlatformInventoryFlowProbeControllerTest.java
@@ -0,0 +1,22 @@
+package com.baiyue.lastleg.selfoperated.analytics.controller;
+import com.baiyue.common.security.AuthenticatedUser;
+import com.baiyue.lastleg.selfoperated.analytics.sync.InventoryFlowProbeService;
+import org.junit.jupiter.api.Test;
+import java.util.Set;
+import org.springframework.web.server.ResponseStatusException;
+import org.springframework.security.access.prepost.PreAuthorize;
+import static org.junit.jupiter.api.Assertions.*;
+import static org.mockito.Mockito.*;
+class PlatformInventoryFlowProbeControllerTest {
+ @Test void probeRequiresRealPlatformSyncPermission() throws Exception {
+  var service=mock(InventoryFlowProbeService.class);var c=new PlatformInventoryFlowProbeController(service);
+  var reader=new AuthenticatedUser(1L,0L,0L,1L,"reader","PLATFORM","WEB",Set.of("platform:self-operated-analytics:list"));
+  var customer=new AuthenticatedUser(1L,1L,1L,1L,"customer","CLIENT","WEB",Set.of("platform:self-operated-analytics:sync"));
+  assertThrows(ResponseStatusException.class,()->c.probe(null,null));assertThrows(ResponseStatusException.class,()->c.probe(reader,null));
+  assertThrows(ResponseStatusException.class,()->c.probe(customer,null));verifyNoInteractions(service);
+  var writer=new AuthenticatedUser(1L,0L,0L,1L,"operator","PLATFORM","WEB",Set.of("platform:self-operated-analytics:sync"));
+  c.probe(writer,null);verify(service).probe(null,"operator");
+  assertEquals("hasAuthority('platform:self-operated-analytics:sync')",PlatformInventoryFlowProbeController.class
+   .getMethod("probe",AuthenticatedUser.class,InventoryFlowProbeService.Request.class).getAnnotation(PreAuthorize.class).value());
+ }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/controller/PlatformInventoryTurnoverControllerTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/controller/PlatformInventoryTurnoverControllerTest.java
new file mode 100644
index 000000000..5f768d94a
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/controller/PlatformInventoryTurnoverControllerTest.java
@@ -0,0 +1,54 @@
+package com.baiyue.lastleg.selfoperated.analytics.controller;
+
+import com.baiyue.common.core.exception.BizException;
+import com.baiyue.common.security.AuthenticatedUser;
+import com.baiyue.lastleg.selfoperated.analytics.query.*;
+import java.time.LocalDate;
+import java.util.*;
+import org.junit.jupiter.api.Test;
+import org.mockito.ArgumentCaptor;
+import org.springframework.core.MethodParameter;
+import org.springframework.security.access.prepost.PreAuthorize;
+import org.springframework.test.web.servlet.setup.MockMvcBuilders;
+import org.springframework.web.bind.support.WebDataBinderFactory;
+import org.springframework.web.context.request.NativeWebRequest;
+import org.springframework.web.method.support.*;
+import org.springframework.web.server.ResponseStatusException;
+import static org.junit.jupiter.api.Assertions.*;
+import static org.mockito.Mockito.*;
+import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
+import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
+
+class PlatformInventoryTurnoverControllerTest {
+    private static AuthenticatedUser platform(){return new AuthenticatedUser(1L,0L,0L,1L,"demo","PLATFORM","WEB",Set.of(PlatformAnalyticsController.READ_PERMISSION));}
+    @Test void enforcesIndependentPlatformReadPermissionAndStrictParameterNames() {
+        var service=mock(InventoryTurnoverQueryService.class);var controller=new PlatformInventoryTurnoverController(service);
+        var customer=new AuthenticatedUser(1L,2L,2L,1L,"demo","CLIENT","WEB",Set.of(PlatformAnalyticsController.READ_PERMISSION));
+        var writer=new AuthenticatedUser(1L,0L,0L,1L,"demo","PLATFORM","WEB",Set.of("platform:self-operated-analytics:sync"));
+        assertThrows(ResponseStatusException.class,()->controller.query(null,null,Map.of()));
+        assertThrows(ResponseStatusException.class,()->controller.query(customer,null,Map.of()));
+        assertThrows(ResponseStatusException.class,()->controller.query(writer,null,Map.of()));
+        assertThrows(BizException.class,()->controller.query(platform(),null,Map.of("attention","ALL")));
+        assertThrows(BizException.class,()->controller.query(platform(),null,Map.of("salesRunId","11")));
+        verifyNoInteractions(service);
+        assertEquals("hasAuthority('platform:self-operated-analytics:list')",PlatformInventoryTurnoverController.class.getAnnotation(PreAuthorize.class).value());
+    }
+    @Test void httpBindsFrozenTurnoverContractWithoutTouchingCollection() throws Exception {
+        var service=mock(InventoryTurnoverQueryService.class);
+        var identity=new HandlerMethodArgumentResolver(){
+            public boolean supportsParameter(MethodParameter p){return p.getParameterType()==AuthenticatedUser.class;}
+            public Object resolveArgument(MethodParameter p,ModelAndViewContainer c,NativeWebRequest r,WebDataBinderFactory b){return platform();}
+        };
+        var mvc=MockMvcBuilders.standaloneSetup(new PlatformInventoryTurnoverController(service)).setCustomArgumentResolvers(identity).build();
+        mvc.perform(get("/api/platform/v1/last-leg/self-operated-analytics/inventory-turnover")
+            .param("sourceAccount","demo").param("warehouseCode","W").param("endDate","2026-10-12")
+            .param("baseWindowDays","15").param("groupBy","OWNER").param("focus","COVERAGE_GT")
+            .param("customerCodes","A","B")
+            .param("coverageDaysThreshold","60").param("current","2").param("size","20")
+            .param("hideZeroInventory","false").param("snapshotContext","fixed-token").param("includeOverview","false")).andExpect(status().isOk());
+        var capture=ArgumentCaptor.forClass(InventoryTurnoverRequest.class);verify(service).query(capture.capture());
+        var q=capture.getValue();assertEquals(LocalDate.of(2026,10,12),q.endDate());assertEquals(15,q.days());
+        assertEquals(List.of("A","B"),q.customerCodes());
+        assertEquals("OWNER",q.group());assertEquals(60,q.coverageDaysThreshold());assertEquals(20,q.offset());assertFalse(q.overview());assertFalse(q.hideZero());assertEquals("fixed-token",q.snapshotContext());
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/diagnostic/QuantityDiagnosticControllerTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/diagnostic/QuantityDiagnosticControllerTest.java
new file mode 100644
index 000000000..373d3e2d5
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/diagnostic/QuantityDiagnosticControllerTest.java
@@ -0,0 +1,34 @@
+package com.baiyue.lastleg.selfoperated.analytics.diagnostic;
+import com.baiyue.lastleg.security.InternalServiceTokenGuard;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import org.junit.jupiter.api.Test;
+import static org.assertj.core.api.Assertions.*;
+import static org.mockito.Mockito.*;
+import org.springframework.mock.web.MockHttpServletRequest;
+class QuantityDiagnosticControllerTest {
+ @Test void everyRouteRequiresInternalTokenBeforeParsing()throws Exception{
+  var service=mock(QuantityDiagnosticService.class);var controller=new QuantityDiagnosticController(new InternalServiceTokenGuard("test-token"),service,new ObjectMapper());
+  var mvc=org.springframework.test.web.servlet.setup.MockMvcBuilders.standaloneSetup(controller).setControllerAdvice(new com.baiyue.common.web.GlobalExceptionHandler()).build();
+  for(String action:new String[]{"arm","status","observe","stop"})mvc.perform(org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post("/internal/lastleg/self-operated-analytics/quantity-diagnostics/"+action).contentType("application/json").content("{}"))
+   .andExpect(org.springframework.test.web.servlet.result.MockMvcResultMatchers.status().isUnauthorized());
+  verifyNoInteractions(service);
+ }
+ @Test void strictWhitelistAndBoundedBody(){
+  var service=mock(QuantityDiagnosticService.class);var c=new QuantityDiagnosticController(new InternalServiceTokenGuard("test-token"),service,new ObjectMapper());
+  for(String body:new String[]{"{\"address\":1}","{} {}"}){var request=new MockHttpServletRequest();request.setContent(body.getBytes(java.nio.charset.StandardCharsets.UTF_8));assertThatThrownBy(()->c.observe("test-token",request)).hasMessageContaining("JSON_INVALID");}
+  var request=new MockHttpServletRequest();request.setContent(new byte[262145]);assertThatThrownBy(()->c.observe("test-token",request)).hasMessageContaining("REQUEST_TOO_LARGE");verifyNoInteractions(service);
+ }
+ @Test void streamIsLimitedEvenWithoutContentLength()throws Exception{
+  var service=mock(QuantityDiagnosticService.class);var c=new QuantityDiagnosticController(new InternalServiceTokenGuard("test-token"),service,new ObjectMapper());
+  var request=mock(jakarta.servlet.http.HttpServletRequest.class);when(request.getContentLengthLong()).thenReturn(-1L);
+  var count=new java.util.concurrent.atomic.AtomicInteger();var stream=new jakarta.servlet.ServletInputStream(){public int read(){count.incrementAndGet();return 32;}public boolean isFinished(){return false;}public boolean isReady(){return true;}public void setReadListener(jakarta.servlet.ReadListener listener){}};
+  when(request.getInputStream()).thenReturn(stream);assertThatThrownBy(()->c.observe("test-token",request)).hasMessageContaining("REQUEST_TOO_LARGE");assertThat(count.get()).isEqualTo(262145);verifyNoInteractions(service);
+ }
+ @Test void normalCallbackNumbersStillDeserializeToExactBigDecimal(){
+  var service=mock(QuantityDiagnosticService.class);var controller=new QuantityDiagnosticController(new InternalServiceTokenGuard("test-token"),service,new ObjectMapper().findAndRegisterModules());
+  var request=new MockHttpServletRequest();request.setContent("{\"side\":\"LIST\",\"skus\":[{\"sku\":\"BIG\",\"listQty\":100000000000000000000.000001},{\"sku\":\"MICRO\",\"listQty\":0.000001}]}".getBytes(java.nio.charset.StandardCharsets.UTF_8));
+  controller.observe("test-token",request);var argument=org.mockito.ArgumentCaptor.forClass(QuantityDiagnosticContract.Event.class);verify(service).observe(argument.capture());
+  assertThat(argument.getValue().skus().get(0).listQty()).isEqualByComparingTo("100000000000000000000.000001");assertThat(argument.getValue().skus().get(1).listQty()).isEqualByComparingTo("0.000001");
+ }
+
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/diagnostic/QuantityDiagnosticServiceTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/diagnostic/QuantityDiagnosticServiceTest.java
new file mode 100644
index 000000000..7952612bf
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/diagnostic/QuantityDiagnosticServiceTest.java
@@ -0,0 +1,193 @@
+package com.baiyue.lastleg.selfoperated.analytics.diagnostic;
+import static com.baiyue.lastleg.selfoperated.analytics.diagnostic.QuantityDiagnosticContract.*;
+import static org.assertj.core.api.Assertions.*;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import java.math.BigDecimal;
+import java.nio.charset.StandardCharsets;
+import java.time.*;
+import java.util.*;
+import java.util.concurrent.*;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.springframework.core.io.ClassPathResource;
+import org.springframework.jdbc.core.JdbcTemplate;
+import org.springframework.jdbc.datasource.*;
+class QuantityDiagnosticServiceTest {
+ final Instant start=Instant.parse("2026-10-14T00:00:00Z");
+ final ObjectMapper json=new ObjectMapper().findAndRegisterModules();
+ JdbcTemplate jdbc;DataSourceTransactionManager manager;QuantityDiagnosticService service;MutableClock clock;
+ final QuantityDiagnosticProperties config=new QuantityDiagnosticProperties(true,"account",List.of("W1","W2"));
+ @BeforeEach void setup()throws Exception{
+  var ds=new DriverManagerDataSource("jdbc:h2:mem:"+UUID.randomUUID()+";MODE=MySQL;DB_CLOSE_DELAY=-1;LOCK_TIMEOUT=2000","sa","");jdbc=new JdbcTemplate(ds);manager=new DataSourceTransactionManager(ds);clock=new MutableClock(start);
+  String ddl;try(var in=new ClassPathResource("db/selfop-quantity-diagnostics.sql").getInputStream()){ddl=new String(in.readAllBytes(),StandardCharsets.UTF_8);}
+  ddl=ddl.replaceAll("(?m)^--.*$","").replaceAll("COMMENT\\s*=?\\s*'[^']*'", "").replace("evidence_json JSON", "evidence_json LONGTEXT").replace("ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_bin","");for(String sql:ddl.split(";"))if(!sql.isBlank())jdbc.execute(sql);
+  jdbc.execute("CREATE TABLE ll_selfop_sync_task(id BIGINT PRIMARY KEY,source_account VARCHAR(64),execution_purpose VARCHAR(32),upstream_task_id BIGINT,validation_root_task_id BIGINT,requested_by VARCHAR(64),scope_hash VARCHAR(64),request_key VARCHAR(128),task_role VARCHAR(32),task_type VARCHAR(32),discovery_scope_id BIGINT,query_from_utc TIMESTAMP,query_until_utc TIMESTAMP,query_scope_json VARCHAR(2000),status VARCHAR(32),attempt_count INT DEFAULT 0)");
+  for(long id=1;id<=3;id++)jdbc.update("INSERT INTO ll_selfop_sync_task VALUES(?,?,?,NULL,NULL,?,?,?,?,?,?,?, ?,?,?,0)",id,"account","BUSINESS","SELFOP_CONTINUOUS_PLANNER","a".repeat(64),"continuous:outbound:2026-10-10:"+"a".repeat(12),"ACCOUNT_DISCOVERY","BACKFILL",1L,LocalDateTime.parse("2026-10-09T16:00:00"),LocalDateTime.parse("2026-10-10T16:00:00"),"{\"startTime\":\"2026-10-10T00:00\",\"endTime\":\"2026-10-11T00:00\"}",id==1?"RUNNING":"READY");
+  service=instance();service.arm(arm("diag"));service.status(new Status("account","producer",true,false));clock.now=start.plusSeconds(10);
+ }
+ QuantityDiagnosticService instance(){return new QuantityDiagnosticService(jdbc,manager,json,config,clock);}
+ Arm arm(String id){return new Arm(id,"account",List.of("W1","W2"),"*","1");}
+ Event event(String root,String order,String side,BigDecimal list,BigDecimal forecast,BigDecimal actual){return new Event("diag","account","producer",root,"selfop-"+root,"LIST".equals(side)?"OUTBOUND_QUERY":"OUTBOUND_DETAIL","W1","owner",order,side,new Observation("100",null,clock.instant(),"attempt",true),List.of(new Sku("SKU",list,forecast,actual)));}
+ Event list(String order){return event("2",order,"LIST",BigDecimal.TEN,null,null);}
+ Event detail(String order){return event("2",order,"DETAIL",null,BigDecimal.TEN,BigDecimal.TEN);}
+ View status(){return service.status(new Status("account","producer",false,false));}
+ @Test void explicitArmIsIdempotentAndBindsOnlyNextEligibleList(){
+  assertThat(service.arm(arm("diag")).startsAt()).isEqualTo(start);
+  assertThat(service.observe(detail("early")).outcome()).isEqualTo("IGNORED");
+  assertThat(service.observe(event("1","old","LIST",BigDecimal.ONE,null,null)).outcome()).isEqualTo("IGNORED");
+  Event locate=list("locate");assertThatThrownBy(()->service.observe(new Event(locate.diagnosticSessionId(),locate.sourceAccount(),locate.producerId(),locate.rootTaskId(),locate.collectionSessionId(),"OUTBOUND_LOCATE",locate.warehouseCode(),locate.ownerCode(),locate.orderNo(),locate.side(),locate.observation(),locate.skus()))).hasMessageContaining("OPERATION");
+  View bound=service.observe(list("a")).session();assertThat(bound.rootTaskId()).isEqualTo("2");assertThat(bound.expiresAt()).isEqualTo(clock.instant().plusSeconds(14400));
+  assertThatThrownBy(()->service.observe(event("3","other","LIST",BigDecimal.ONE,null,null))).hasMessageContaining("ROOT_FROZEN");
+  assertThatThrownBy(()->service.arm(arm("second"))).hasMessageContaining("ALREADY_ARMED");
+ }
+ @Test void durablePendingSurvivesReceiverRestartAndPreservesOriginalAttempt(){
+  Event original=list("a");service.observe(original);service=instance();clock.now=start.plusSeconds(5000);
+  assertThat(service.observe(original).outcome()).isEqualTo("DUPLICATE");
+  var result=service.observe(detail("a"));assertThat(result.comparison()).isEqualTo("ALL_EQUAL");assertThat(result.session().candidates()).isEqualTo(1);
+  String payload=jdbc.queryForObject("SELECT evidence_json FROM ll_selfop_quantity_diagnostic_order",String.class);assertThat(payload).contains("attempt").contains("00:00:10Z");
+ }
+ @Test void anyKnownInequalityStopsIncludingListDifferenceAndTerminalReplay(){
+  Event l=list("a");service.observe(l);Event d=event("2","a","DETAIL",null,BigDecimal.ONE,BigDecimal.ONE);
+  var result=service.observe(d);assertThat(result.comparison()).isEqualTo("QUANTITY_DIFFERENCE");assertThat(result.session().state()).isEqualTo("TERMINAL");
+  assertThat(instance().observe(d).outcome()).isEqualTo("DUPLICATE");assertThat(service.observe(list("b")).outcome()).isEqualTo("STOPPED");
+ }
+ @Test void unknownListStopsAndRetainsEvidence(){
+  var receipt=service.observe(event("2","a","LIST",null,null,null));assertThat(receipt.comparison()).isEqualTo("INCONCLUSIVE");assertThat(receipt.session().stopReason()).isEqualTo("INCONCLUSIVE");
+  assertThat(jdbc.queryForObject("SELECT COUNT(*) FROM ll_selfop_quantity_diagnostic_pending",Integer.class)).isEqualTo(1);
+ }
+ @Test void missingSkuAndUnknownDetailStopAtomically(){
+  service.observe(list("a"));Event d=detail("a");var mismatch=new Event(d.diagnosticSessionId(),d.sourceAccount(),d.producerId(),d.rootTaskId(),d.collectionSessionId(),d.operation(),d.warehouseCode(),d.ownerCode(),d.orderNo(),d.side(),d.observation(),List.of(new Sku("OTHER",null,null,BigDecimal.TEN)));
+  assertThat(service.observe(mismatch).comparison()).isEqualTo("INCONCLUSIVE");assertThat(status().state()).isEqualTo("TERMINAL");assertThat(jdbc.queryForObject("SELECT COUNT(*) FROM ll_selfop_quantity_diagnostic_order",Integer.class)).isEqualTo(1);
+ }
+ @Test void lateCallbackCannotBindEvenWhenObservationWasBeforeDeadline(){
+  Event e=list("a");clock.now=start.plusSeconds(21600);assertThat(service.observe(e).session().stopReason()).isEqualTo("BIND_TIMEOUT");assertThat(status().rootTaskId()).isNull();
+ }
+ @Test void latestPossibleBindStillCannotExtendAbsoluteTenHours(){
+  clock.now=start.plusSeconds(21599);assertThat(service.observe(list("a")).session().expiresAt()).isEqualTo(start.plusSeconds(35999));
+  clock.now=start.plusSeconds(36000);assertThat(service.observe(detail("a")).session().stopReason()).isEqualTo("INCOMPLETE");
+ }
+ @Test void rootEndDrainsOnlyAcceptedCandidatesAndNeverExtendsDeadline(){
+  service.observe(list("a"));Instant expires=status().expiresAt();jdbc.update("UPDATE ll_selfop_sync_task SET status='SUCCEEDED' WHERE id=2");
+  assertThat(status().state()).isEqualTo("DRAINING");assertThat(service.observe(list("new")).outcome()).isEqualTo("IGNORED");
+  assertThat(service.observe(detail("a")).comparison()).isEqualTo("ALL_EQUAL");
+  View done=service.status(new Status("account","producer",false,true));assertThat(done.stopReason()).isEqualTo("ROOT_ENDED_INSUFFICIENT");assertThat(done.expiresAt()).isEqualTo(expires);
+ }
+ @Test void producerRestartMarksLostTailUncertainButRestoresPending(){
+  service.observe(list("a"));View recovered=service.status(new Status("account","new-producer",true,false));assertThat(recovered.deliveryUncertain()).isTrue();assertThat(recovered.selected()).hasSize(1);
+  Event d=detail("a");var resumed=new Event(d.diagnosticSessionId(),d.sourceAccount(),"new-producer",d.rootTaskId(),d.collectionSessionId(),d.operation(),d.warehouseCode(),d.ownerCode(),d.orderNo(),d.side(),d.observation(),d.skus());assertThat(service.observe(resumed).comparison()).isEqualTo("ALL_EQUAL");
+  jdbc.update("UPDATE ll_selfop_sync_task SET status='SUCCEEDED' WHERE id=2");assertThat(service.status(new Status("account","new-producer",false,true)).stopReason()).isEqualTo("INCOMPLETE");
+ }
+ @Test void candidatesAreCumulativeAndNeverReplaced(){
+  for(int i=0;i<100;i++)service.observe(list("o"+i));assertThat(service.observe(list("extra")).outcome()).isEqualTo("IGNORED");
+  for(int i=0;i<100;i++)service.observe(detail("o"+i));View done=status();assertThat(done.candidates()).isEqualTo(100);assertThat(done.pairedOrders()).isEqualTo(100);assertThat(done.retainedRows()).isEqualTo(200);assertThat(done.stopReason()).isEqualTo("COMPLETED");
+ }
+ @Test void changedAttemptCannotOverwriteFirstSide(){
+  Event a=list("a");service.observe(a);clock.now=start.plusSeconds(20);assertThatThrownBy(()->service.observe(list("a"))).hasMessageContaining("OBSERVATION_CONFLICT");assertThat(status().candidates()).isEqualTo(1);
+ }
+ @Test void concurrentReceiversSerializeSameCandidate()throws Exception{
+  var other=instance();Event e=list("a");var executor=Executors.newFixedThreadPool(2);try{var one=executor.submit(()->service.observe(e));var two=executor.submit(()->other.observe(e));assertThat(List.of(one.get().outcome(),two.get().outcome())).containsExactlyInAnyOrder("ACCEPTED","DUPLICATE");}finally{executor.shutdownNow();}assertThat(status().candidates()).isEqualTo(1);
+ }
+ @Test void businessRootPolicyIsAuthoritative(){
+  jdbc.update("UPDATE ll_selfop_sync_task SET requested_by='manual' WHERE id=2");assertThatThrownBy(()->service.observe(list("a"))).hasMessageContaining("ROOT_REJECTED");assertThat(status().rootTaskId()).isNull();
+ }
+ @Test void delayedFirstObservationDoesNotExtendSamplingWindow(){
+  Event first=list("a");clock.now=start.plusSeconds(5000);View bound=service.observe(first).session();assertThat(bound.startsAt()).isEqualTo(first.observation().observedAt());assertThat(bound.expiresAt()).isEqualTo(start.plusSeconds(14410));
+ }
+ @Test void endedOrChangedRootCannotBePresentedAsCurrent(){
+  service.stop(new Stop("diag","account","producer","INCOMPLETE"));jdbc.update("UPDATE ll_selfop_sync_task SET status='SUCCEEDED' WHERE id=1");
+  assertThatThrownBy(()->service.arm(arm("next"))).hasMessageContaining("CURRENT_ROOT_CHANGED");
+  assertThat(service.arm(new Arm("next","account",List.of("W1"),"*",null)).excludedRootTaskId()).isNull();
+ }
+ @Test void ambiguousCurrentRootsRefuseArm(){
+  service.stop(new Stop("diag","account","producer","INCOMPLETE"));jdbc.update("UPDATE ll_selfop_sync_task SET status='RUNNING' WHERE id=2");
+  assertThatThrownBy(()->service.arm(arm("next"))).hasMessageContaining("CURRENT_ROOT_AMBIGUOUS");
+ }
+ @Test void diagnosticDatasourceInitializationFailureDoesNotBreakServiceConstruction(){
+  var unavailable=new QuantityDiagnosticService(new DriverManagerDataSource(),json,config);
+  assertThatThrownBy(()->unavailable.status(new Status("account","p",true,false))).hasMessageContaining("DIAGNOSTIC_DATASOURCE_UNAVAILABLE");unavailable.close();
+ }
+ @Test void fourHourExpiredDelayedFirstListIsNotAccepted(){
+  Event first=list("a");clock.now=start.plusSeconds(15000);var r=service.observe(first);assertThat(r.outcome()).isEqualTo("STOPPED");assertThat(r.session().candidates()).isZero();
+ }
+ @Test void rowAndByteCapsNeverRefundOrAcceptOverLimit()throws Exception{
+  service.observe(list("a"));jdbc.update("UPDATE ll_selfop_quantity_diagnostic_session SET accepted_sku_rows=2000");
+  assertThat(service.observe(detail("a")).session().stopReason()).isEqualTo("INCOMPLETE");assertThat(jdbc.queryForObject("SELECT COUNT(*) FROM ll_selfop_quantity_diagnostic_pending",Integer.class)).isEqualTo(1);
+  jdbc.update("UPDATE ll_selfop_quantity_diagnostic_session SET accepted_sku_rows=1,accepted_bytes=2097152,stop_reason=NULL,active_slot=1");
+  assertThat(service.observe(detail("a")).outcome()).isEqualTo("STOPPED");assertThat(status().retainedBytes()).isEqualTo(2097152);
+ }
+ @Test void concurrentLastCandidateCannotExceedOneHundred()throws Exception{
+  for(int i=0;i<99;i++)service.observe(list("o"+i));var other=instance();var pool=Executors.newFixedThreadPool(2);
+  try{var a=pool.submit(()->service.observe(list("last-a")));var b=pool.submit(()->other.observe(list("last-b")));assertThat(List.of(a.get().outcome(),b.get().outcome())).containsExactlyInAnyOrder("ACCEPTED","IGNORED");}finally{pool.shutdownNow();}assertThat(status().candidates()).isEqualTo(100);
+ }
+ @Test void admissionRejectsBeforeSecondConnectionAcquisition()throws Exception{
+  var tm=org.mockito.Mockito.mock(org.springframework.transaction.PlatformTransactionManager.class);var entered=new CountDownLatch(1);var release=new CountDownLatch(1);
+  org.mockito.Mockito.when(tm.getTransaction(org.mockito.ArgumentMatchers.any())).thenAnswer(call->{entered.countDown();release.await(2,TimeUnit.SECONDS);return new org.springframework.transaction.support.SimpleTransactionStatus();});
+  var bounded=new QuantityDiagnosticService(jdbc,tm,json,config,clock);var pool=Executors.newSingleThreadExecutor();
+  try{var first=pool.submit(()->bounded.status(new Status("account","producer",false,false)));assertThat(entered.await(1,TimeUnit.SECONDS)).isTrue();assertThatThrownBy(()->bounded.status(new Status("account","producer",false,false))).hasMessageContaining("DIAGNOSTIC_BUSY");release.countDown();first.get();org.mockito.Mockito.verify(tm,org.mockito.Mockito.times(1)).getTransaction(org.mockito.ArgumentMatchers.any());}finally{release.countDown();pool.shutdownNow();}
+ }
+ @org.junit.jupiter.params.ParameterizedTest
+ @org.junit.jupiter.params.provider.ValueSource(strings={"10","8"})
+ void forecastTenActualEightStopsRegardlessOfListMeaning(String listQuantity){
+  service.observe(event("2","a","LIST",new BigDecimal(listQuantity),null,null));assertThat(service.observe(event("2","a","DETAIL",null,BigDecimal.TEN,new BigDecimal("8"))).comparison()).isEqualTo("QUANTITY_DIFFERENCE");
+ }
+ @Test void historicalEvidenceRemainsUntouchedAndCannotRearmItsIdentifier(){
+  jdbc.update("INSERT INTO ll_selfop_quantity_diagnostic_session(diagnostic_session_id,configuration_hash,source_account,collection_session_id,root_task_id,starts_at,expires_at,accepted_orders,accepted_sku_rows,accepted_bytes,stop_reason) VALUES('old',?,'account','old-session','1',?,?,24,25,1234,'EXPIRED')","a".repeat(64),start.toString(),start.toString());
+  assertThatThrownBy(()->service.arm(arm("old"))).hasMessageContaining("HISTORICAL_ID_READ_ONLY");assertThat(status().diagnosticSessionId()).isEqualTo("diag");assertThat(jdbc.queryForObject("SELECT accepted_orders FROM ll_selfop_quantity_diagnostic_session WHERE diagnostic_session_id='old'",Integer.class)).isEqualTo(24);
+ }
+ @Test void existingStopReasonAndCountersAreTheOnlyPersistedFacts(){
+  service.observe(list("a"));service.observe(event("2","a","DETAIL",null,BigDecimal.TEN,BigDecimal.ONE));
+  assertThat(jdbc.queryForObject("SELECT stop_reason FROM ll_selfop_quantity_diagnostic_session",String.class)).isEqualTo("QUANTITY_DIFFERENCE");assertThat(jdbc.queryForObject("SELECT accepted_orders FROM ll_selfop_quantity_diagnostic_session",Integer.class)).isEqualTo(1);
+  String metadata=jdbc.queryForObject("SELECT state_json FROM ll_selfop_quantity_diagnostic_session",String.class);assertThat(metadata).doesNotContain("\"reason\"","\"paired\"","\"bytes\"","\"expiresAt\"");assertThat(instance().status(new Status("account","producer",false,false)).stopReason()).isEqualTo("QUANTITY_DIFFERENCE");
+ }
+ @Test void highPrecisionStorageUsesStringsAndSurvivesJsonNormalizationAndTerminalReplay()throws Exception{
+  String large="100000000000000000000.000001",micro="0.000001",maximum="99999999999999999999999999999999.999999";
+  Event base=list("precision");
+  Event l=withSkus(base,List.of(new Sku("BIG",new BigDecimal(large),null,null),new Sku("MICRO",new BigDecimal(micro),null,null),new Sku("MAX",new BigDecimal(maximum),null,null)));
+  Event d=withSkus(detail("precision"),List.of(new Sku("BIG",null,new BigDecimal(large),new BigDecimal(large)),new Sku("MICRO",null,new BigDecimal(micro),new BigDecimal("0.000002")),new Sku("MAX",null,new BigDecimal(maximum),new BigDecimal(maximum))));
+  service.observe(l);
+  var pending=json.readTree(jdbc.queryForObject("SELECT evidence_json FROM ll_selfop_quantity_diagnostic_pending",String.class));
+  for(var sku:pending.path("skus")){assertThat(sku.path("listQty").isTextual()).isTrue();assertThat(sku.path("forecastQty").isNull()).isTrue();assertThat(sku.path("actualQty").isNull()).isTrue();}
+  assertThat(service.observe(d).session().stopReason()).isEqualTo("QUANTITY_DIFFERENCE");
+  String evidence=jdbc.queryForObject("SELECT evidence_json FROM ll_selfop_quantity_diagnostic_order",String.class);
+  String storedHash=jdbc.queryForObject("SELECT payload_hash FROM ll_selfop_quantity_diagnostic_order",String.class);
+  var tree=json.readTree(evidence);
+  for(String side:List.of("list","detail"))for(var sku:tree.path(side).path("skus"))for(String field:List.of("listQty","forecastQty","actualQty"))assertThat(sku.path(field).isNull()||sku.path(field).isTextual()).isTrue();
+  assertThat(tree.path("list").path("skus").get(0).path("listQty").textValue()).isEqualTo(large);
+  // Reproduces the precision hazard of untyped JSON numeric normalization, without a MySQL service.
+  Map<?,?> unsafe=json.readValue("{\"qty\":"+large+"}",Map.class);
+  assertThat(new BigDecimal(unsafe.get("qty").toString())).isNotEqualByComparingTo(large);
+  String reordered=json.copy().enable(com.fasterxml.jackson.databind.SerializationFeature.ORDER_MAP_ENTRIES_BY_KEYS).writeValueAsString(json.readValue(evidence,Map.class));
+  assertThat(reordered).isNotEqualTo(evidence);
+  // Exercise an actual H2 JSON column too, rather than relying only on the portable LONGTEXT fixture.
+  jdbc.execute("CREATE TABLE qdiag_json_roundtrip(evidence JSON)");jdbc.update("INSERT INTO qdiag_json_roundtrip VALUES (? FORMAT JSON)",reordered);
+  String persisted=jdbc.queryForObject("SELECT evidence FROM qdiag_json_roundtrip",String.class);
+  jdbc.update("UPDATE ll_selfop_quantity_diagnostic_order SET evidence_json=?",persisted);
+  assertThat(instance().observe(l).outcome()).isEqualTo("DUPLICATE");assertThat(instance().observe(d).outcome()).isEqualTo("DUPLICATE");
+  assertThat(jdbc.queryForObject("SELECT payload_hash FROM ll_selfop_quantity_diagnostic_order",String.class)).isEqualTo(storedHash);
+  assertThat(storedHash).isEqualTo(java.util.HexFormat.of().formatHex(java.security.MessageDigest.getInstance("SHA-256").digest(evidence.getBytes(StandardCharsets.UTF_8))));
+  assertThat(status().pairedOrders()).isEqualTo(1);
+  // Private storage mapper must not mutate the normal numeric wire serializer.
+  assertThat(json.readTree(json.writeValueAsString(l)).path("skus").get(0).path("listQty").isNumber()).isTrue();
+ }
+ @Test void trailingZerosAndNegativeZeroShareCanonicalStorageAndReplay()throws Exception{
+  Event l=event("2","a","LIST",new BigDecimal("12.340000"),null,null);service.observe(l);
+  assertThat(service.observe(event("2","a","LIST",new BigDecimal("12.34"),null,null)).outcome()).isEqualTo("DUPLICATE");
+  Event d=event("2","a","DETAIL",null,new BigDecimal("12.3400"),new BigDecimal("-0.000000"));service.observe(d);
+  var stored=json.readTree(jdbc.queryForObject("SELECT evidence_json FROM ll_selfop_quantity_diagnostic_order",String.class));
+  assertThat(stored.path("list").path("skus").get(0).path("listQty").textValue()).isEqualTo("12.34");assertThat(stored.path("detail").path("skus").get(0).path("actualQty").textValue()).isEqualTo("0");
+  assertThat(instance().observe(event("2","a","DETAIL",null,new BigDecimal("12.34"),BigDecimal.ZERO)).outcome()).isEqualTo("DUPLICATE");
+ }
+ @org.junit.jupiter.params.ParameterizedTest
+ @org.junit.jupiter.params.provider.ValueSource(strings={"-1","-0.000001"})
+ void negativeQuantitiesAreRejectedBeforeEvidencePersistence(String quantity){
+  assertThatThrownBy(()->service.observe(event("2","a","LIST",new BigDecimal(quantity),null,null))).hasMessageContaining("QUANTITY_INVALID");
+  assertThat(status().candidates()).isZero();assertThat(jdbc.queryForObject("SELECT COUNT(*) FROM ll_selfop_quantity_diagnostic_pending",Integer.class)).isZero();
+ }
+ @Test void newGrantStorageRejectsNumericEvidenceInsteadOfAddingLegacyCoercion(){
+  service.observe(list("a"));String stored=jdbc.queryForObject("SELECT evidence_json FROM ll_selfop_quantity_diagnostic_pending",String.class);
+  jdbc.update("UPDATE ll_selfop_quantity_diagnostic_pending SET evidence_json=?",stored.replace("\"listQty\":\"10\"","\"listQty\":10"));
+  assertThatThrownBy(()->instance().observe(detail("a"))).hasMessageContaining("DIAGNOSTIC_STORAGE_INVALID");
+ }
+ private Event withSkus(Event e,List<Sku> skus){return new Event(e.diagnosticSessionId(),e.sourceAccount(),e.producerId(),e.rootTaskId(),e.collectionSessionId(),e.operation(),e.warehouseCode(),e.ownerCode(),e.orderNo(),e.side(),e.observation(),skus);}
+ static class MutableClock extends Clock {Instant now;MutableClock(Instant now){this.now=now;}public ZoneId getZone(){return ZoneOffset.UTC;}public Clock withZone(ZoneId zone){return this;}public Instant instant(){return now;}}
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/history/InventoryFlowSliceTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/history/InventoryFlowSliceTest.java
new file mode 100644
index 000000000..71f582e11
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/history/InventoryFlowSliceTest.java
@@ -0,0 +1,42 @@
+package com.baiyue.lastleg.selfoperated.analytics.history;
+
+import com.baiyue.lastleg.selfoperated.analytics.model.SelfopSupport;
+import com.fasterxml.jackson.databind.JsonNode;
+import org.junit.jupiter.api.Test;
+import java.time.*;
+import java.util.*;
+import static org.junit.jupiter.api.Assertions.*;
+class InventoryFlowSliceTest {
+    private final InventoryFlowSlice slice=new InventoryFlowSlice("W",LocalDateTime.parse("2026-10-14T00:00:00"),LocalDateTime.parse("2026-10-15T00:00:00"),1000);
+    JsonNode row(String id,String at){return SelfopSupport.read(SelfopSupport.json(Map.of("id",id,"customerCode","C","whCode","W","productSku","SKU","createTime",at)),JsonNode.class);}
+    JsonNode page(int current,int total,List<JsonNode> rows){return SelfopSupport.read(SelfopSupport.json(Map.of("current",current,"size",1000,"total",total,"pages",total==0?0:(total-1)/1000+1,"records",rows)),JsonNode.class);}
+    @Test void emptyRangeAndInclusiveMidnightArePreserved(){
+        assertEquals(0,slice.validate(page(1,0,List.of()),1,null,null).total());
+        assertEquals(1,slice.validate(page(1,1,List.of(row("1","2026-10-15 00:00:00"))),1,null,null).rows().size());
+        assertEquals(Instant.parse("2026-10-14T16:00:01Z"),slice.until());
+    }
+    @Test void totalDriftDuplicatesAndOrderingNeverProveCoverage(){
+        assertThrows(IllegalStateException.class,()->slice.validate(page(1,1,List.of(row("1","2026-10-14 12:00:00"))),1,2L,null));
+        assertThrows(IllegalStateException.class,()->slice.validate(page(1,2,List.of(row("1","2026-10-14 12:00:00"),row("1","2026-10-14 12:00:00"))),1,null,null));
+        assertThrows(IllegalStateException.class,()->slice.validate(page(1,1,List.of(row("1","2026-10-14 12:00:00"))),1,null,LocalDateTime.parse("2026-10-14T13:00:00")));
+        assertThrows(IllegalStateException.class,()->slice.validate(page(1,2,List.of(row("1","2026-10-14 12:00:00"))),1,null,null));
+        assertThrows(IllegalStateException.class,()->slice.validate(page(1,1,List.of(row("1","2026-10-15 00:00:01"))),1,null,null));
+    }
+    @Test void fixedPageHashCannotChangeWarehouseWindowOrPage(){
+        assertEquals(slice.requestHash(1),SelfopSupport.hash(slice.request(1)));
+        assertNotEquals(slice.requestHash(1),slice.requestHash(2));
+        assertThrows(IllegalArgumentException.class,()->new InventoryFlowSlice("W",slice.start(),slice.end().plusDays(1),1000));
+        assertThrows(IllegalArgumentException.class,()->new InventoryFlowSlice("W",slice.start(),slice.end(),100));
+    }
+    @Test void acceptsInternalLongStringButRejectsFractionalOrOverflowTotals(){
+        var response=(com.fasterxml.jackson.databind.node.ObjectNode)page(1,0,List.of());
+        response.put("total","0");
+        assertEquals(0,slice.validate(response,1,null,null).total());
+        for(String invalid:List.of("0.0","-1","9223372036854775808","1e3","")) {
+            response.put("total",invalid);
+            assertThrows(IllegalStateException.class,()->slice.validate(response,1,null,null));
+        }
+        response.put("total",0.5);
+        assertThrows(IllegalStateException.class,()->slice.validate(response,1,null,null));
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/history/InventoryHistoryCalculatorTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/history/InventoryHistoryCalculatorTest.java
new file mode 100644
index 000000000..4316a78e4
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/history/InventoryHistoryCalculatorTest.java
@@ -0,0 +1,175 @@
+package com.baiyue.lastleg.selfoperated.analytics.history;
+
+import org.junit.jupiter.api.Test;
+import java.math.BigDecimal;
+import java.time.*;
+import java.util.*;
+import static org.assertj.core.api.Assertions.assertThat;
+import static com.baiyue.lastleg.selfoperated.analytics.history.InventoryHistoryCalculator.*;
+
+class InventoryHistoryCalculatorTest {
+    private static final Sku SKU=new Sku("OWNER","SKU");
+    private static final Key GOOD=new Key(SKU,0), BAD=new Key(SKU,1);
+    private static final LocalDate DAY=LocalDate.of(2026,10,14);
+    private static Instant at(String local) { return LocalDateTime.parse(local).toInstant(ZoneOffset.ofHours(8)); }
+    private static BigDecimal n(String n) { return new BigDecimal(n); }
+    private static Anchor anchor(Key k,String qty) { return new Anchor(k,n(qty),"PCS",at("2026-10-15T08:00:00"),at("2026-10-15T08:00:01"),100); }
+    private static Flow flow(String id,Key key,String type,String delta,String close,String time) {
+        return new Flow(id,key,"CELL","BATCH",type,n(delta),n(delta),n(close),at(time));
+    }
+    private static Input input(List<Flow> rows,List<Anchor> anchors) {
+        return new Input(DAY,DAY.plusDays(1),Set.of(SKU),rows,anchors,
+            List.of(new Interval(at("2026-10-14T00:00:00"),at("2026-10-15T08:00:02"))));
+    }
+    @Test void reversesTailAndAssignsMidnightToNewDay() {
+        var r=reconstruct(input(List.of(flow("f",GOOD,"DO","-1","144","2026-10-15T00:00:00")),List.of(anchor(GOOD,"144"))));
+        assertThat(r.get(0).quantity()).isEqualByComparingTo("145");
+    }
+    @Test void missingTailIsUnknownEvenWhenYesterdayIsComplete() {
+        var i=input(List.of(),List.of(anchor(GOOD,"144")));
+        var r=reconstruct(new Input(i.from(),i.until(),i.candidates(),i.flows(),i.anchors(),List.of(new Interval(at("2026-10-14T00:00:00"),at("2026-10-15T00:00:00")))));
+        assertThat(r.get(0).reason()).isEqualTo("FLOW_COVERAGE_GAP");assertThat(r.get(0).quantity()).isNull();
+    }
+    @Test void keepsInactiveBatchInSkuAnchor() {
+        var r=reconstruct(input(List.of(flow("f",GOOD,"DO","-1","10","2026-10-15T01:00:00")),List.of(anchor(GOOD,"100"))));
+        assertThat(r.get(0).quantity()).isEqualByComparingTo("101");
+    }
+    @Test void sameIdAtOverlappingBoundaryIsCountedOnce() {
+        var f=flow("f",GOOD,"DO","-1","9","2026-10-15T01:00:00");
+        assertThat(reconstruct(input(List.of(f,f),List.of(anchor(GOOD,"9")))).get(0).quantity()).isEqualByComparingTo("10");
+    }
+    @Test void sameIdDifferentIdentityRevokesBoth() {
+        var f=flow("f",GOOD,"DO","-1","9","2026-10-15T01:00:00");
+        var g=flow("f",BAD,"IMO","1","1","2026-10-15T01:00:00");
+        assertThat(reconstruct(input(List.of(f,g),List.of(anchor(GOOD,"9"),anchor(BAD,"1"))))).allMatch(d->"FLOW_ID_CONFLICT".equals(d.reason()));
+    }
+    @Test void qualityConversionPreservesTotalWithoutDroppingEitherSide() {
+        var r=reconstruct(input(List.of(flow("a",GOOD,"IMO","-3","7","2026-10-15T01:00:00"),flow("b",BAD,"IMO","3","3","2026-10-15T01:00:00")),List.of(anchor(GOOD,"7"),anchor(BAD,"3"))));
+        assertThat(r.stream().map(Daily::quantity).reduce(BigDecimal.ZERO,BigDecimal::add)).isEqualByComparingTo("10");
+        assertThat(r.get(0).quantity()).isEqualByComparingTo("10");assertThat(r.get(1).quantity()).isZero();
+    }
+    @Test void absentAnchorNeverBecomesZero() {
+        assertThat(reconstruct(input(List.of(),List.of())).get(0).reason()).isEqualTo("ANCHOR_MISSING");
+    }
+    @Test void explicitZeroWithCompleteCoverageIsValid() {
+        var d=reconstruct(input(List.of(),List.of(anchor(GOOD,"0")))).get(0);
+        assertThat(d.status()).isEqualTo("VALID");assertThat(d.quantity()).isZero();
+    }
+    @Test void unverifiedTypeIsNotIgnored() {
+        assertThat(reconstruct(input(List.of(flow("f",GOOD,"BO","1","1","2026-10-15T01:00:00")),List.of(anchor(GOOD,"1")))).get(0).reason()).isEqualTo("FLOW_TYPE_UNVERIFIED");
+    }
+    @Test void eventInAnchorObservationIsAmbiguous() {
+        assertThat(reconstruct(input(List.of(flow("f",GOOD,"DO","-1","9","2026-10-15T08:00:00")),List.of(anchor(GOOD,"9")))).get(0).reason()).isEqualTo("ANCHOR_TIME_AMBIGUOUS");
+    }
+    @Test void sameSecondOrderUsesBalancesNotIdOrResponseOrder() {
+        var rows=List.of(flow("1",GOOD,"DO","-1","37","2026-10-15T01:00:00"),flow("9",GOOD,"DO","-1","38","2026-10-15T01:00:00"));
+        assertThat(reconstruct(input(rows,List.of(anchor(GOOD,"37")))).get(0).quantity()).isEqualByComparingTo("39");
+    }
+    @Test void brokenChainDoesNotPublish() {
+        var rows=List.of(flow("1",GOOD,"DO","-1","38","2026-10-15T01:00:00"),flow("2",GOOD,"DO","-1","35","2026-10-15T02:00:00"));
+        assertThat(reconstruct(input(rows,List.of(anchor(GOOD,"35")))).get(0).reason()).isEqualTo("CHAIN_DISCONTINUITY");
+    }
+    @Test void restoresHundredSameSecondDecrementsAcrossSixtyDaysRegardlessOfSourceOrder() {
+        var group=new ArrayList<Flow>();
+        for(int i=0;i<100;i++)group.add(flow("F"+(100-i),GOOD,"DO","-1",String.valueOf(726-i),"2026-10-15T01:00:00"));
+        for(int seed=0;seed<10;seed++) {
+            Collections.shuffle(group,new Random(seed));
+            for(boolean hasPrior:List.of(false,true)) {
+                var rows=new ArrayList<>(group);
+                if(hasPrior)rows.add(flow("prior",GOOD,"DO","-1","727","2026-10-14T23:59:59"));
+                var i=input(rows,List.of(anchor(GOOD,"627")));
+                var result=reconstruct(new Input(DAY.minusDays(59),i.until(),i.candidates(),i.flows(),i.anchors(),
+                    List.of(new Interval(DAY.minusDays(59).atStartOfDay().toInstant(ZoneOffset.ofHours(8)),at("2026-10-15T08:00:02")))));
+                assertThat(result).hasSize(60).allMatch(d->"VALID".equals(d.status()));
+                assertThat(result.get(59).quantity()).isEqualByComparingTo("727");
+                assertThat(result.get(0).quantity()).isEqualByComparingTo(hasPrior?"728":"727");
+            }
+        }
+    }
+    @Test void forcedCycleBeforeExitIsUniqueDespiteMultipleOutgoingEdgesAndDecimalScales() {
+        // Taking the exit first is a dead end, not a second complete order.
+        var rows=List.of(flow("exit",GOOD,"DO","-1.00","0.0","2026-10-15T01:00:00"),
+            flow("up",GOOD,"PA","1","2.000","2026-10-15T01:00:00"),
+            flow("down",GOOD,"DO","-1","1.000000","2026-10-15T01:00:00"));
+        assertThat(reconstruct(input(rows,List.of(anchor(GOOD,"10")))).get(0).status()).isEqualTo("VALID");
+    }
+    @Test void twoCyclesWithSameFinalBalanceRemainAmbiguous() {
+        var rows=List.of(flow("prior",GOOD,"PA","0","2","2026-10-15T00:59:59"),
+            flow("a",GOOD,"PA","1","3","2026-10-15T01:00:00"),flow("b",GOOD,"DO","-1","2","2026-10-15T01:00:00"),
+            flow("c",GOOD,"PA","2","4","2026-10-15T01:00:00"),flow("d",GOOD,"DO","-2","2","2026-10-15T01:00:00"));
+        assertThat(reconstruct(input(rows,List.of(anchor(GOOD,"10")))).get(0).reason()).isEqualTo("CHAIN_ORDER_AMBIGUOUS");
+    }
+    @Test void distinctIdsWithDuplicateEdgesAreNotDeduplicatedIntoAUniqueOrder() {
+        var rows=List.of(flow("a",GOOD,"PA","1","2","2026-10-15T01:00:00"),
+            flow("b",GOOD,"PA","1","2","2026-10-15T01:00:00"),flow("return",GOOD,"DO","-1","1","2026-10-15T01:00:00"));
+        assertThat(reconstruct(input(rows,List.of(anchor(GOOD,"10")))).get(0).reason()).isEqualTo("CHAIN_ORDER_AMBIGUOUS");
+    }
+    @Test void disconnectedCycleCannotBeIgnoredEvenWhenDegreesMatch() {
+        var rows=List.of(flow("path",GOOD,"DO","-1","1","2026-10-15T01:00:00"),
+            flow("loop",GOOD,"PA","0","3","2026-10-15T01:00:00"));
+        assertThat(reconstruct(input(rows,List.of(anchor(GOOD,"10")))).get(0).reason()).isEqualTo("CHAIN_DISCONTINUITY");
+    }
+    @Test void longChainWithMissingEdgeOrWrongPriorRemainsUnknown() {
+        var rows=new ArrayList<Flow>();
+        for(int i=0;i<100;i++)rows.add(flow("F"+i,GOOD,"DO","-1",String.valueOf(726-i),"2026-10-15T01:00:00"));
+        rows.add(flow("prior",GOOD,"PA","0","728","2026-10-15T00:59:59"));
+        assertThat(reconstruct(input(rows,List.of(anchor(GOOD,"627")))).get(0).reason()).isEqualTo("CHAIN_DISCONTINUITY");
+        rows.remove(rows.size()-1);rows.remove(50);
+        assertThat(reconstruct(input(rows,List.of(anchor(GOOD,"627")))).get(0).reason()).isEqualTo("CHAIN_DISCONTINUITY");
+    }
+    @Test void largeUniqueChainUsesIterativeTraversal() {
+        var rows=new ArrayList<Flow>();
+        for(int i=0;i<20_000;i++)rows.add(flow("F"+i,GOOD,"DO","-1",String.valueOf(20_000-i),"2026-10-15T01:00:00"));
+        assertThat(reconstruct(input(rows,List.of(anchor(GOOD,"1")))).get(0).quantity()).isEqualByComparingTo("20001");
+    }
+    @Test void graphSolverMatchesExhaustiveOrdersForAllSmallMultigraphs() {
+        // Independent permutation oracle: all multisets of up to five directed edges
+        // on three balances, including loops/parallel edges, with every possible prior.
+        for(int size=1;size<=5;size++)checkGraphs(new ArrayList<>(),0,size);
+    }
+    private void checkGraphs(List<Integer> edges,int minimum,int remaining) {
+        if(remaining>0) {
+            for(int edge=minimum;edge<9;edge++) {
+                edges.add(edge);checkGraphs(edges,edge,remaining-1);edges.remove(edges.size()-1);
+            }
+            return;
+        }
+        var group=new ArrayList<Flow>();
+        for(int i=0;i<edges.size();i++) {
+            int edge=edges.get(i),opening=edge/3,closing=edge%3;
+            group.add(flow("F"+i,GOOD,"PA",String.valueOf(closing-opening),String.valueOf(closing),"2026-10-15T01:00:00"));
+        }
+        for(int prior=-1;prior<3;prior++) {
+            var rows=new ArrayList<>(group);
+            if(prior>=0)rows.add(flow("prior",GOOD,"PA","0",String.valueOf(prior),"2026-10-15T00:59:59"));
+            int paths=countOrders(group,new boolean[group.size()],prior<0?null:BigDecimal.valueOf(prior),0);
+            String reason=paths==0?"CHAIN_DISCONTINUITY":paths==1?null:"CHAIN_ORDER_AMBIGUOUS";
+            var actual=reconstruct(input(rows,List.of(anchor(GOOD,"100")))).get(0);
+            assertThat(actual.reason()).as("edges=%s prior=%s",edges,prior).isEqualTo(reason);
+        }
+    }
+    private int countOrders(List<Flow> group,boolean[] used,BigDecimal balance,int depth) {
+        if(depth==group.size())return 1;
+        int count=0;
+        for(int i=0;i<group.size();i++)if(!used[i]) {
+            var f=group.get(i);
+            if(balance!=null&&balance.add(f.delta()).compareTo(f.closing())!=0)continue;
+            used[i]=true;count+=countOrders(group,used,f.closing(),depth+1);used[i]=false;
+            if(count>1)return 2;
+        }
+        return count;
+    }
+    @Test void laterAnchorRevisionChangesEarlierDay() {
+        var a=reconstruct(input(List.of(flow("f",GOOD,"DO","-1","100","2026-10-15T01:00:00")),List.of(anchor(GOOD,"100"))));
+        var b=reconstruct(input(List.of(flow("f",GOOD,"DO","-2","100","2026-10-15T01:00:00")),List.of(anchor(GOOD,"100"))));
+        assertThat(a.get(0).quantity()).isEqualByComparingTo("101");assertThat(b.get(0).quantity()).isEqualByComparingTo("102");
+    }
+    @Test void negativeSkuBalanceCannotHideBehindPositiveBatchClosing() {
+        assertThat(reconstruct(input(List.of(flow("f",GOOD,"PA","5","5","2026-10-15T01:00:00")),List.of(anchor(GOOD,"3")))).get(0).reason()).isEqualTo("NEGATIVE_RECONSTRUCTED_STOCK");
+    }
+    @Test void mergingCoverageDoesNotBridgeGaps() {
+        var t=Instant.EPOCH;
+        assertThat(covered(List.of(new Interval(t,t.plusSeconds(2)),new Interval(t.plusSeconds(1),t.plusSeconds(4))),t,t.plusSeconds(4))).isTrue();
+        assertThat(covered(List.of(new Interval(t,t.plusSeconds(1)),new Interval(t.plusSeconds(2),t.plusSeconds(4))),t,t.plusSeconds(4))).isFalse();
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/history/InventoryHistoryPipelineTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/history/InventoryHistoryPipelineTest.java
new file mode 100644
index 000000000..48d78a109
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/history/InventoryHistoryPipelineTest.java
@@ -0,0 +1,164 @@
+package com.baiyue.lastleg.selfoperated.analytics.history;
+
+import com.baomidou.mybatisplus.core.MybatisConfiguration;
+import com.baomidou.mybatisplus.extension.spring.MybatisSqlSessionFactoryBean;
+import com.baiyue.lastleg.selfoperated.analytics.client.RestLingxingAnalyticsClient;
+import com.baiyue.lastleg.selfoperated.analytics.mapper.*;
+import com.baiyue.lastleg.selfoperated.analytics.model.*;
+import com.baiyue.lastleg.selfoperated.analytics.sync.SelfopLeaseService;
+import com.fasterxml.jackson.databind.JsonNode;
+import org.apache.ibatis.datasource.unpooled.UnpooledDataSource;
+import org.mybatis.spring.SqlSessionTemplate;
+import org.springframework.jdbc.core.JdbcTemplate;
+import org.springframework.jdbc.datasource.DataSourceTransactionManager;
+import org.springframework.transaction.support.TransactionTemplate;
+import org.junit.jupiter.api.*;
+import java.nio.file.*;
+import java.time.*;
+import java.math.BigDecimal;
+import java.util.*;
+import static com.baiyue.lastleg.selfoperated.analytics.model.SelfopSupport.*;
+import static org.junit.jupiter.api.Assertions.*;
+import static org.mockito.Mockito.*;
+
+/** Actual mapper + SQL + transaction pipeline, isolated H2; provider is a bounded fixture. */
+public class InventoryHistoryPipelineTest {
+    JdbcTemplate jdbc;TransactionTemplate tx;SelfopAnalyticsProperties config;SqlSessionTemplate session;
+    SelfopSyncTaskMapper tasks;SelfopSyncRunMapper runs;SelfopSyncStageMapper stages;SelfopCoordinationMapper locks;
+    SelfopLeaseService leases;RestLingxingAnalyticsClient client;InventoryHistoryVersions versions;InventoryFlowFacts facts;
+    InventoryHistoryBuilder builder;InventoryFlowCollector collector;
+    static final LocalDate DAY=LocalDate.of(2026,10,14);
+    @BeforeEach void setup()throws Exception {
+        var ds=new UnpooledDataSource("org.h2.Driver","jdbc:h2:mem:history_pipeline_"+UUID.randomUUID()+";MODE=MySQL;DATABASE_TO_LOWER=TRUE;DB_CLOSE_DELAY=-1","sa","");
+        jdbc=new JdbcTemplate(ds);tx=new TransactionTemplate(new DataSourceTransactionManager(ds));
+        String ddl=Files.readString(Path.of("src/main/resources/db/lastleg.sql"));
+        for(String table:List.of("ll_selfop_outbound_discovery_scope","ll_selfop_sync_scope","ll_selfop_sync_task","ll_selfop_sync_run","ll_selfop_sync_stage","ll_selfop_inventory_snapshot","ll_selfop_sku_daily_sales","ll_selfop_sku_profile","ll_selfop_inventory_flow","ll_selfop_inventory_day_version","ll_selfop_inventory_daily")) {
+            var m=java.util.regex.Pattern.compile("CREATE TABLE (?:IF NOT EXISTS )?"+table+" \\([\\s\\S]*?\\) ENGINE[^;]+;").matcher(ddl);assertTrue(m.find(),table);
+            jdbc.execute(m.group().replaceAll("\\) ENGINE[^;]+;",");").replace(" JSON "," VARCHAR(1000000) "));
+        }
+        jdbc.execute("CREATE ALIAS JSON_EXTRACT FOR '"+getClass().getName()+".extract'");jdbc.execute("CREATE ALIAS JSON_UNQUOTE FOR '"+getClass().getName()+".unquote'");
+        var c=new MybatisConfiguration();c.setMapUnderscoreToCamelCase(true);
+        for(var mapper:List.of(SelfopSyncTaskMapper.class,SelfopSyncRunMapper.class,SelfopSyncStageMapper.class,SelfopCoordinationMapper.class,SelfopSyncScopeMapper.class,SelfopOutboundDiscoveryScopeMapper.class))c.addMapper(mapper);
+        var factory=new MybatisSqlSessionFactoryBean();factory.setConfiguration(c);factory.setDataSource(ds);session=new SqlSessionTemplate(Objects.requireNonNull(factory.getObject()));
+        tasks=session.getMapper(SelfopSyncTaskMapper.class);runs=session.getMapper(SelfopSyncRunMapper.class);stages=session.getMapper(SelfopSyncStageMapper.class);
+        var real=session.getMapper(SelfopCoordinationMapper.class);locks=mock(SelfopCoordinationMapper.class,org.mockito.AdditionalAnswers.delegatesTo(real));
+        doReturn(List.of()).when(locks).dueContinuous(any(),anyInt(),anyString());
+        config=new SelfopAnalyticsProperties();config.setSourceAccount("demo");config.setCollectionMode("BUSINESS");config.setContinuousBusinessCollectionEnabled(true);config.setInventoryHistoryEnabled(true);config.setSourceQueryTimezone("Asia/Shanghai");config.setQuantityUnit("PCS");config.getWarehouses().put("W",new SelfopAnalyticsProperties.Warehouse());
+        leases=new SelfopLeaseService(locks,session.getMapper(SelfopSyncScopeMapper.class),session.getMapper(SelfopOutboundDiscoveryScopeMapper.class),config);
+        client=mock(RestLingxingAnalyticsClient.class);versions=new InventoryHistoryVersions(jdbc,tx);facts=new InventoryFlowFacts(jdbc,tx,versions);
+        collector=newCollector();builder=new InventoryHistoryBuilder(jdbc,tx,versions,tasks,runs,stages);
+        jdbc.update("INSERT INTO ll_selfop_outbound_discovery_scope (id,created_at,updated_at,source_account,fence_token,request_budget,time_budget_seconds,min_request_interval_ms) VALUES(1,?,?,?,0,100,120,1200)",utcNow(),utcNow(),"demo");
+        jdbc.update("INSERT INTO ll_selfop_sync_scope (id,created_at,updated_at,source_account,warehouse_code,data_family,scope_json,scope_hash,business_timezone,source_timezone,schedule_cron,stale_after_seconds,fence_token,fact_revision,published_fact_revision,rebuild_required,review_request_budget,review_time_budget_seconds) VALUES(2,?,?,'demo','W','INVENTORY','{}',?,'Asia/Shanghai','Asia/Shanghai','0 0 8 * * *',93600,0,0,0,0,100,120)",utcNow(),utcNow(),"b".repeat(64));
+    }
+    @AfterEach void close(){jdbc.execute("SHUTDOWN");}
+    public static String extract(String value,String path){return json(read(value,JsonNode.class).path(path.substring(2)));}
+    public static String unquote(String value){return read(value,JsonNode.class).asText();}
+    InventoryFlowCollector newCollector(){return new InventoryFlowCollector(config,tasks,runs,stages,locks,leases,client,jdbc,tx);}
+    InventoryFlowSlice slice(){return new InventoryFlowSlice("W",DAY.atStartOfDay(),DAY.plusDays(1).atStartOfDay(),1000);}
+    JsonNode flow(String id,String delta,String close){return read("{\"id\":\""+id+"\",\"customerCode\":\"C\",\"whCode\":\"W\",\"productSku\":\"SKU\",\"productQuality\":0,\"cellNo\":\"CELL\",\"innerBatchNo\":\"BATCH\",\"billType\":\"DO\",\"bookQty\":"+delta+",\"bookChangQty\":\""+delta+"\",\"closeQty\":"+close+",\"createTime\":\"2026-10-14 12:00:00\"}",JsonNode.class);}
+    JsonNode page(int current,long total,List<JsonNode> rows){return read(json(Map.of("current",current,"size",1000,"total",total,"pages",total==0?0:(total-1)/1000+1,"records",rows)),JsonNode.class);}
+    void respond(JsonNode page){when(client.inventoryFlowPage(any(),eq("W"),any(),any(),anyInt(),eq(1000))).thenReturn(page);}
+    void collect(InventoryFlowSlice slice,LocalDate round,JsonNode page){collector.plan(1,slice,round);respond(page);collector.page();while(facts.mergeNext("demo")){} }
+    @Test void collectionReplaysDoNotDoubleCountAndRevisionInvalidatesAtomically() {
+        collect(slice(),DAY,page(1,1,List.of(flow("F","-1","9"))));
+        assertEquals(1,jdbc.queryForObject("SELECT COUNT(*) FROM ll_selfop_inventory_flow",Integer.class));
+        assertEquals("FACTS_APPLIED",jdbc.queryForObject("SELECT status FROM ll_selfop_sync_run",String.class));
+        collect(slice(),DAY.plusDays(1),page(1,1,List.of(flow("F","-1","9"))));
+        assertEquals(1,jdbc.queryForObject("SELECT revision_no FROM ll_selfop_inventory_flow",Integer.class));
+        var build=new InventoryHistoryVersions.Build("demo","W","b".repeat(64),50,51,52,null,versions.factHash("demo","W"),"{}",Map.of());
+        var candidate=versions.create(build,DAY);versions.ready(candidate,0);versions.publish(build,List.of(candidate));
+        collect(slice(),DAY.plusDays(2),page(1,1,List.of(flow("F","-2","8"))));
+        assertEquals(2,jdbc.queryForObject("SELECT revision_no FROM ll_selfop_inventory_flow",Integer.class));
+        assertNotNull(jdbc.queryForObject("SELECT invalidated_at FROM ll_selfop_inventory_day_version",Object.class));
+        assertEquals(3,jdbc.queryForObject("SELECT COUNT(*) FROM ll_selfop_sync_stage",Integer.class));
+    }
+    @Test void changedIdentityIsQuarantinedAndNeverMoved() {
+        collect(slice(),DAY,page(1,1,List.of(flow("F","-1","9"))));
+        var changed=(com.fasterxml.jackson.databind.node.ObjectNode)flow("F","-1","9");changed.put("customerCode","OTHER");
+        collect(slice(),DAY.plusDays(1),page(1,1,List.of(changed)));
+        assertEquals("C",jdbc.queryForObject("SELECT customer_code FROM ll_selfop_inventory_flow",String.class));
+        assertEquals("FLOW_IDENTITY_CONFLICT",jdbc.queryForObject("SELECT validation_reason FROM ll_selfop_inventory_flow",String.class));
+    }
+    @Test void missingPreviouslySeenFlowRemainsUnknownInsteadOfBeingDeleted() {
+        collect(slice(),DAY,page(1,1,List.of(flow("F","-1","9"))));
+        collect(slice(),DAY.plusDays(1),page(1,0,List.of()));
+        assertEquals(1,jdbc.queryForObject("SELECT COUNT(*) FROM ll_selfop_inventory_flow",Integer.class));
+        assertEquals("SOURCE_FLOW_MISSING",jdbc.queryForObject("SELECT validation_reason FROM ll_selfop_inventory_flow",String.class));
+    }
+    @Test void restartedCollectorStartsNewAttemptAndDoesNotMixPages() {
+        collector.plan(1,slice(),DAY);var rows=new ArrayList<JsonNode>();for(int i=0;i<1000;i++)rows.add(flow("F"+i,"-1","9"));
+        respond(page(1,1001,rows));collector.page();assertEquals(1000,jdbc.queryForObject("SELECT COUNT(*) FROM ll_selfop_sync_stage",Integer.class));
+        collector=newCollector();respond(page(1,1,List.of(flow("NEW","-1","9"))));collector.page();
+        assertEquals(2,jdbc.queryForObject("SELECT COUNT(*) FROM ll_selfop_sync_run",Integer.class));
+        assertEquals("ABORTED",jdbc.queryForObject("SELECT status FROM ll_selfop_sync_run WHERE attempt_no=1",String.class));
+        while(facts.mergeNext("demo")){}assertEquals("NEW",jdbc.queryForObject("SELECT source_flow_id FROM ll_selfop_inventory_flow",String.class));
+    }
+    @Test void malformedPageSplitsFixedWindowWithoutGrantingCoverage() {
+        collector.plan(1,slice(),DAY);respond(page(1,2,List.of(flow("F","-1","9"))));collector.page();
+        assertEquals(1,jdbc.queryForObject("SELECT COUNT(*) FROM ll_selfop_sync_task WHERE status='DEAD'",Integer.class));
+        assertEquals(2,jdbc.queryForObject("SELECT COUNT(*) FROM ll_selfop_sync_task WHERE status='READY'",Integer.class));
+        assertEquals(0,jdbc.queryForObject("SELECT COUNT(*) FROM ll_selfop_sync_run WHERE coverage_status='COMPLETE'",Integer.class));
+        assertFalse(facts.mergeNext("demo"));
+    }
+    @Test void independentAnchorMismatchPublishesUnknownAndNeverInventsQuantity() {
+        stock(100,DAY,20);stock(101,DAY.plusDays(1),9);
+        collect(slice(),DAY,page(1,1,List.of(flow("F","-1","9"))));
+        collect(new InventoryFlowSlice("W",DAY.plusDays(1).atStartOfDay(),DAY.plusDays(1).atTime(8,0,2),1000),DAY,page(1,0,List.of()));
+        builder.build("demo","W",30);
+        assertEquals("INDEPENDENT_ANCHOR_MISMATCH",jdbc.queryForObject("SELECT quality_reason FROM ll_selfop_inventory_daily",String.class));
+        assertNull(jdbc.queryForObject("SELECT physical_quantity FROM ll_selfop_inventory_daily",BigDecimal.class));
+    }
+    @Test void localReconstructionPublishesDayAndKeepsRawSnapshotsUnchanged() {
+        stock(100,DAY,10);stock(101,DAY.plusDays(1),9);
+        collect(slice(),DAY,page(1,1,List.of(flow("F","-1","9"))));
+        var tail=new InventoryFlowSlice("W",DAY.plusDays(1).atStartOfDay(),DAY.plusDays(1).atTime(8,0,2),1000);
+        collect(tail,DAY,page(1,0,List.of()));builder.build("demo","W",30);
+        assertEquals(1,jdbc.queryForObject("SELECT COUNT(*) FROM ll_selfop_inventory_day_version WHERE head_slot=1",Integer.class));
+        assertEquals(0,new BigDecimal("9").compareTo(jdbc.queryForObject("SELECT physical_quantity FROM ll_selfop_inventory_daily",BigDecimal.class)));
+        assertEquals(2,jdbc.queryForObject("SELECT COUNT(*) FROM ll_selfop_inventory_snapshot",Integer.class));
+        builder.build("demo","W",30);assertEquals(1,jdbc.queryForObject("SELECT COUNT(*) FROM ll_selfop_inventory_day_version",Integer.class));
+    }
+    @Test void calculationRevisionRebuildsLegacyUnknownFromSavedFlowsExactlyOnce() {
+        stock(100,DAY,727);stock(101,DAY.plusDays(1),627);
+        var rows=new ArrayList<JsonNode>();
+        for(int i=0;i<100;i++)rows.add(flow("F"+i,"-1",String.valueOf(726-i)));
+        Collections.shuffle(rows,new Random(42));
+        collect(slice(),DAY,page(1,100,rows));
+        collect(new InventoryFlowSlice("W",DAY.plusDays(1).atStartOfDay(),DAY.plusDays(1).atTime(8,0,2),1000),DAY,page(1,0,List.of()));
+        builder.build("demo","W",30);
+        // Seed the pre-fix published state, including its exact former dedup signature.
+        var coverage=List.of(new InventoryHistoryCalculator.Interval(
+            DAY.atStartOfDay().toInstant(ZoneOffset.ofHours(8)),DAY.plusDays(1).atTime(8,0,2).toInstant(ZoneOffset.ofHours(8))));
+        String legacyHash=hash(Arrays.asList(versions.factHash("demo","W"),builder.anchor("demo","W",0),
+            builder.anchor("demo","W",1),DAY,DAY.plusDays(1),null,coverage));
+        var legacyTask=jdbc.queryForMap("SELECT id,request_hash FROM ll_selfop_sync_task WHERE task_type='INVENTORY_HISTORY_BUILD'");
+        assertNotEquals(legacyHash,legacyTask.get("request_hash"));
+        jdbc.update("UPDATE ll_selfop_sync_task SET request_hash=? WHERE id=?",legacyHash,legacyTask.get("id"));
+        jdbc.update("UPDATE ll_selfop_inventory_daily SET physical_quantity=NULL,quality_status='UNKNOWN',quality_reason='CHAIN_ORDER_AMBIGUOUS'");
+        jdbc.update("UPDATE ll_selfop_inventory_day_version SET evidence_json=?",json(Map.of("rule","FLOW_EOD_V1")));
+        var flowHash=versions.factHash("demo","W");
+        clearInvocations(client);
+        builder.build("demo","W",30);
+        assertEquals(2,jdbc.queryForObject("SELECT COUNT(*) FROM ll_selfop_sync_task WHERE task_type='INVENTORY_HISTORY_BUILD' AND status='SUCCEEDED'",Integer.class));
+        assertEquals(1,jdbc.queryForObject("SELECT COUNT(*) FROM ll_selfop_inventory_day_version WHERE head_slot=1",Integer.class));
+        var current=jdbc.queryForMap("SELECT d.physical_quantity,d.quality_status,v.rule_version,v.evidence_json FROM ll_selfop_inventory_daily d JOIN ll_selfop_inventory_day_version v ON v.id=d.day_version_id WHERE v.head_slot=1");
+        assertEquals(0,new BigDecimal("627").compareTo((BigDecimal)current.get("physical_quantity")));
+        assertEquals("VALID",current.get("quality_status"));
+        assertEquals("FLOW_EOD_V1",current.get("rule_version"));
+        var evidence=read(current.get("evidence_json").toString(),JsonNode.class);
+        assertEquals(InventoryHistoryCalculator.CALCULATION_REVISION,evidence.path("calculationRevision").asInt());
+        var runEvidence=read(jdbc.queryForObject("SELECT scope_snapshot_json FROM ll_selfop_sync_run WHERE status='FACTS_APPLIED' AND last_phase='HISTORY_PUBLISHED' ORDER BY id DESC LIMIT 1",String.class),JsonNode.class);
+        assertEquals(InventoryHistoryCalculator.CALCULATION_REVISION,runEvidence.path("calculationRevision").asInt());
+        builder.build("demo","W",30);
+        assertEquals(2,jdbc.queryForObject("SELECT COUNT(*) FROM ll_selfop_inventory_day_version",Integer.class));
+        assertEquals(flowHash,versions.factHash("demo","W"));
+        assertEquals(100,jdbc.queryForObject("SELECT COUNT(*) FROM ll_selfop_inventory_flow",Integer.class));
+        assertEquals(2,jdbc.queryForObject("SELECT COUNT(*) FROM ll_selfop_inventory_snapshot",Integer.class));
+        verifyNoInteractions(client);
+    }
+    void stock(long id,LocalDate day,int quantity) {
+        var now=day.atTime(0,0);var r=new SelfopSyncRun();r.setId(id);r.setTaskId(id);r.setAttemptNo(1);r.setSourceAccount("demo");r.setWarehouseCode("W");r.setScopeId(2L);r.setRunRole("WAREHOUSE_SYNC");r.setExecutionPurpose("BUSINESS");r.setScopeHash("b".repeat(64));r.setScopeSnapshotJson("{}");r.setFenceToken(0L);r.setStatus("PUBLISHED");r.setLastPhase("PUBLISHED");r.setCoverageStatus("COMPLETE");r.setSourceTotalCount(1L);r.setUniqueObjectCount(1L);r.setPageCount(1);r.setCreatedAt(now);r.setUpdatedAt(now);r.setFetchStartedAtUtc(now);r.setFetchFinishedAtUtc(now.plusSeconds(1));r.setPublishedAtUtc(now.plusSeconds(2));runs.insert(r);
+        jdbc.update("INSERT INTO ll_selfop_inventory_snapshot(id,created_at,updated_at,snapshot_run_id,source_account,customer_code,warehouse_code,sku_code,product_quality,physical_quantity,observed_at_utc,quality_status) VALUES(?,?,?,?,'demo','C','W','SKU',0,?,?,'VALID')",id,now,now,id,quantity,now.plusSeconds(1));
+        jdbc.update("INSERT INTO ll_selfop_sku_profile(id,created_at,updated_at,profile_run_id,source_account,customer_code,warehouse_code,sku_code,quantity_unit,evidence_type,first_seen_at_utc,last_seen_run_id) VALUES(?,?,?,?,'demo','C','W','SKU','PCS','INVENTORY_OBSERVATION',?,?)",id,now,now,id,now,id);
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/history/InventoryHistoryVersionsTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/history/InventoryHistoryVersionsTest.java
new file mode 100644
index 000000000..fbf3a77a2
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/history/InventoryHistoryVersionsTest.java
@@ -0,0 +1,87 @@
+package com.baiyue.lastleg.selfoperated.analytics.history;
+
+import org.junit.jupiter.api.*;
+import org.springframework.jdbc.core.JdbcTemplate;
+import org.springframework.jdbc.datasource.DriverManagerDataSource;
+import org.springframework.jdbc.datasource.DataSourceTransactionManager;
+import org.springframework.transaction.support.TransactionTemplate;
+import org.springframework.core.io.ClassPathResource;
+import java.nio.charset.StandardCharsets;
+import java.math.BigDecimal;
+import java.time.LocalDate;
+import java.util.*;
+import static org.assertj.core.api.Assertions.*;
+import static com.baiyue.lastleg.selfoperated.analytics.history.InventoryHistoryCalculator.*;
+import static com.baiyue.lastleg.selfoperated.analytics.history.InventoryHistoryVersions.*;
+
+class InventoryHistoryVersionsTest {
+    JdbcTemplate jdbc;TransactionTemplate tx;InventoryHistoryVersions versions;
+    final LocalDate day=LocalDate.of(2026,10,1);
+    @BeforeEach void setup() throws Exception {
+        var ds=new DriverManagerDataSource("jdbc:h2:mem:"+UUID.randomUUID()+";MODE=MySQL;DATABASE_TO_LOWER=TRUE;DB_CLOSE_DELAY=-1","sa","");
+        jdbc=new JdbcTemplate(ds);tx=new TransactionTemplate(new DataSourceTransactionManager(ds));versions=new InventoryHistoryVersions(jdbc,tx);
+        jdbc.execute("CREATE TABLE ll_selfop_sync_scope(id BIGINT,source_account VARCHAR(64),warehouse_code VARCHAR(64),data_family VARCHAR(32),scope_hash VARCHAR(64))");
+        jdbc.update("INSERT INTO ll_selfop_sync_scope VALUES(1,'a','w','INVENTORY','scope')");
+        String ddl=new ClassPathResource("db/selfop-inventory-history.sql").getContentAsString(StandardCharsets.UTF_8)
+            .replaceAll("(?m)^--.*$","").replaceAll("ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_bin","");
+        for(String statement:ddl.split(";")) if(!statement.isBlank())jdbc.execute(statement);
+    }
+    Build build(long id,Map<LocalDate,Long> heads) {return new Build("a","w","scope",id,id,10,20L,versions.factHash("a","w"),"{}",heads);}
+    Candidate candidate(Build b,LocalDate date,String quantity) {
+        Candidate c=versions.create(b,date);
+        versions.append(c,List.of(new Daily(date,new Key(new Sku("o","s"),0),new BigDecimal(quantity),"VALID",null,10)),"evidence");
+        versions.ready(c,1);return c;
+    }
+    @Test void unpublishedRowsAreInvisibleAndGroupSwitchesAllDates() {
+        var b=build(1,Map.of());var first=candidate(b,day,"100");var second=candidate(b,day.plusDays(1),"100");
+        assertThat(versions.heads("a","w",day,day.plusDays(2))).isEmpty();
+        versions.publish(b,List.of(first,second));
+        var old=versions.heads("a","w",day,day.plusDays(2));
+        var next=build(2,old);var n1=candidate(next,day,"110");var n2=candidate(next,day.plusDays(1),"110");
+        assertThat(versions.heads("a","w",day,day.plusDays(2))).isEqualTo(old);
+        versions.publish(next,List.of(n1,n2));
+        assertThat(versions.heads("a","w",day,day.plusDays(2))).isEqualTo(Map.of(day,n1.id(),day.plusDays(1),n2.id()));
+        assertThat(jdbc.queryForObject("SELECT COUNT(*) FROM ll_selfop_inventory_daily",Integer.class)).isEqualTo(4);
+    }
+    @Test void failureAfterFirstHeadChangeRollsBackWholeGroup() {
+        var b=build(1,Map.of());var c1=candidate(b,day,"100");var c2=candidate(b,day.plusDays(1),"100");versions.publish(b,List.of(c1,c2));
+        var old=versions.heads("a","w",day,day.plusDays(2));var next=build(2,old);
+        var n1=candidate(next,day,"110");var n2=candidate(next,day.plusDays(1),"110");
+        jdbc.update("UPDATE ll_selfop_inventory_day_version SET invalidated_at=CURRENT_TIMESTAMP WHERE id=?",n2.id());
+        assertThatThrownBy(()->versions.publish(next,List.of(n1,n2))).hasMessage("HISTORY_CANDIDATE_CHANGED");
+        assertThat(versions.heads("a","w",day,day.plusDays(2))).isEqualTo(old);
+        assertThat(jdbc.queryForObject("SELECT status FROM ll_selfop_inventory_day_version WHERE id=?",String.class,n1.id())).isEqualTo("READY");
+    }
+    @Test void partialGroupAndIncompleteSkuSetsCannotPublish() {
+        var b=build(1,Map.of());var c1=candidate(b,day,"100");candidate(b,day.plusDays(1),"100");
+        assertThatThrownBy(()->versions.publish(b,List.of(c1))).hasMessage("HISTORY_GROUP_INCOMPLETE");
+        var c=versions.create(build(2,Map.of()),day.plusDays(2));
+        assertThatThrownBy(()->versions.ready(c,1)).hasMessage("HISTORY_CANDIDATE_INCOMPLETE");
+    }
+    @Test void unknownRowsAreRetainedAndPublishedVersionsCannotBeAppended() {
+        var b=build(1,Map.of());var c=versions.create(b,day);
+        versions.append(c,List.of(new Daily(day,new Key(new Sku("o","s"),0),null,"UNKNOWN","ANCHOR_MISSING",0)),"hash");versions.ready(c,1);versions.publish(b,List.of(c));
+        assertThat(jdbc.queryForObject("SELECT unknown_sku_count FROM ll_selfop_inventory_day_version WHERE id=?",Long.class,c.id())).isEqualTo(1);
+        assertThatThrownBy(()->versions.append(c,List.of(),"hash")).hasMessage("HISTORY_CANDIDATE_IMMUTABLE");
+    }
+    @Test void publicationIsIdempotentAfterCommit() {
+        var b=build(1,Map.of());var c=candidate(b,day,"100");versions.publish(b,List.of(c));versions.publish(b,List.of(c));
+        assertThat(versions.heads("a","w",day,day.plusDays(1))).hasSize(1);
+    }
+    @Test void aNewHeadRejectsStaleBuild() {
+        var stale=build(1,Map.of());var c=candidate(stale,day,"100");
+        var winner=build(2,Map.of());var c2=candidate(winner,day,"110");versions.publish(winner,List.of(c2));
+        assertThatThrownBy(()->versions.publish(stale,List.of(c))).hasMessage("HISTORY_HEAD_CHANGED");
+    }
+    @Test void changedWarehouseScopeRejectsFrozenCandidate() {
+        var b=build(1,Map.of());var c=candidate(b,day,"100");
+        jdbc.update("UPDATE ll_selfop_sync_scope SET scope_hash='new-scope'");
+        assertThatThrownBy(()->versions.publish(b,List.of(c))).hasMessage("HISTORY_SCOPE_CHANGED");
+        assertThat(versions.heads("a","w",day,day.plusDays(1))).isEmpty();
+    }
+    @Test void knownInvaliditySurvivesFailedRebuild() {
+        var b=build(1,Map.of());var c=candidate(b,day,"100");versions.publish(b,List.of(c));
+        tx.executeWithoutResult(s->{versions.lockWarehouse("a","w");versions.invalidate("a","w",2,"FLOW_REVISION");});
+        assertThat(jdbc.queryForObject("SELECT invalidation_reason FROM ll_selfop_inventory_day_version WHERE id=?",String.class,c.id())).isEqualTo("FLOW_REVISION");
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/inventory/InventoryPublicationMySqlAcceptanceTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/inventory/InventoryPublicationMySqlAcceptanceTest.java
new file mode 100644
index 000000000..6c16d4a37
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/inventory/InventoryPublicationMySqlAcceptanceTest.java
@@ -0,0 +1,237 @@
+package com.baiyue.lastleg.selfoperated.analytics.inventory;
+
+import com.baomidou.mybatisplus.core.MybatisConfiguration;
+import com.baomidou.mybatisplus.core.toolkit.IdWorker;
+import com.baomidou.mybatisplus.extension.spring.MybatisSqlSessionFactoryBean;
+import com.baiyue.lastleg.selfoperated.analytics.mapper.*;
+import com.baiyue.lastleg.selfoperated.analytics.model.*;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import org.apache.ibatis.executor.Executor;
+import org.apache.ibatis.logging.nologging.NoLoggingImpl;
+import org.apache.ibatis.mapping.MappedStatement;
+import org.apache.ibatis.plugin.*;
+import org.junit.jupiter.api.*;
+import org.junit.jupiter.api.condition.EnabledIfEnvironmentVariable;
+import org.mybatis.spring.SqlSessionTemplate;
+import org.springframework.aop.framework.ProxyFactory;
+import org.springframework.jdbc.core.JdbcTemplate;
+import org.springframework.jdbc.datasource.DataSourceTransactionManager;
+import org.springframework.jdbc.datasource.DriverManagerDataSource;
+import org.springframework.transaction.annotation.AnnotationTransactionAttributeSource;
+import org.springframework.transaction.interceptor.TransactionInterceptor;
+import org.springframework.transaction.support.TransactionSynchronizationManager;
+import org.springframework.transaction.support.TransactionTemplate;
+
+import java.math.BigDecimal;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.time.*;
+import java.util.*;
+import static com.baiyue.lastleg.selfoperated.analytics.model.SelfopSupport.*;
+import static org.junit.jupiter.api.Assertions.*;
+
+/** Opt-in TEST-only real MySQL transactions. No collector, HTTP client, scheduler or mocked SQL. */
+@EnabledIfEnvironmentVariable(named="SELFOP_TEST_MYSQL_PUBLICATION",matches="true")
+@Timeout(90)
+class InventoryPublicationMySqlAcceptanceTest {
+    private static final String ACCOUNT="SELFOP-TEST-TXN-20261012";
+    private static final ZoneId ZONE=ZoneId.of("Asia/Shanghai");
+    private static final String FAULT="SYNTH_PUBLICATION_FAULT_AFTER_RUN_WRITE";
+    private final String token=UUID.randomUUID().toString().replace("-","");
+    private final String warehouse="SELFOP-TXN-"+token.substring(0,12).toUpperCase(Locale.ROOT);
+    private final String owner="SYNTH-TXN-PUBLISH-"+token;
+    private final Map<String,Object> evidence=new LinkedHashMap<>();
+    private JdbcTemplate jdbc;
+    private TransactionTemplate transactions;
+    private SelfopSyncScopeMapper scopes;
+    private SelfopSyncTaskMapper tasks;
+    private SelfopSyncRunMapper runs;
+    private SelfopInventorySnapshotMapper stocks;
+    private SelfopSkuProfileMapper profiles;
+    private SelfopSyncScope scope;
+    private InventorySnapshotService service;
+    private LocalDate day;
+    private WriteFault fault;
+    private SelfopAnalyticsProperties properties;
+
+    @BeforeEach void initialize(TestInfo info) throws Exception {
+        assertEquals("test",requiredEnv("CHONGCHONG_ENV").toLowerCase(Locale.ROOT),"Only TEST is authorized");
+        String host=requiredEnv("CHONGCHONG_DB_HOST"),port=requiredEnv("CHONGCHONG_DB_PORT");
+        assertTrue(host.matches("[A-Za-z0-9.-]+")&&port.matches("[0-9]{1,5}"),"Invalid TEST connection fields");
+        var source=new DriverManagerDataSource("jdbc:mysql://"+host+":"+port+"/baiyue_lastleg"
+            +"?useSSL=false&allowPublicKeyRetrieval=true&connectionTimeZone=UTC&forceConnectionTimeZoneToSession=true"
+            +"&characterEncoding=UTF-8&connectTimeout=10000&socketTimeout=15000",
+            requiredEnv("CHONGCHONG_DB_USERNAME"),requiredEnv("CHONGCHONG_DB_PASSWORD"));
+        source.setDriverClassName("com.mysql.cj.jdbc.Driver");
+        try(var connection=source.getConnection()) {
+            assertEquals("MySQL",connection.getMetaData().getDatabaseProductName());
+            assertEquals(8,connection.getMetaData().getDatabaseMajorVersion());
+            assertEquals("baiyue_lastleg",connection.getCatalog());
+        } catch(java.sql.SQLException unavailable) {
+            throw new IllegalStateException("TEST MySQL connection unavailable; root must inspect connection settings");
+        }
+        jdbc=new JdbcTemplate(source);jdbc.setQueryTimeout(15);
+        var manager=new DataSourceTransactionManager(source);transactions=new TransactionTemplate(manager);
+        var configuration=new MybatisConfiguration();configuration.setMapUnderscoreToCamelCase(true);
+        configuration.setLogImpl(NoLoggingImpl.class);fault=new WriteFault();configuration.addInterceptor(fault);
+        for(var mapper:List.of(SelfopCoordinationMapper.class,SelfopSyncScopeMapper.class,SelfopSyncTaskMapper.class,
+            SelfopSyncRunMapper.class,SelfopSyncStageMapper.class,SelfopInventorySnapshotMapper.class,SelfopSkuProfileMapper.class))
+            configuration.addMapper(mapper);
+        var factory=new MybatisSqlSessionFactoryBean();factory.setDataSource(source);factory.setConfiguration(configuration);
+        var session=new SqlSessionTemplate(Objects.requireNonNull(factory.getObject()));
+        scopes=session.getMapper(SelfopSyncScopeMapper.class);tasks=session.getMapper(SelfopSyncTaskMapper.class);
+        runs=session.getMapper(SelfopSyncRunMapper.class);stocks=session.getMapper(SelfopInventorySnapshotMapper.class);
+        profiles=session.getMapper(SelfopSkuProfileMapper.class);properties=new SelfopAnalyticsProperties();
+        assertEquals("OFF",properties.getCollectionMode());assertFalse(properties.isExecutionEnabled());
+        var target=new InventorySnapshotService(session.getMapper(SelfopCoordinationMapper.class),scopes,runs,tasks,
+            session.getMapper(SelfopSyncStageMapper.class),stocks,profiles,properties);
+        var proxy=new ProxyFactory(target);proxy.setProxyTargetClass(true);
+        proxy.addAdvice(new TransactionInterceptor(manager,new AnnotationTransactionAttributeSource()));
+        service=(InventorySnapshotService)proxy.getProxy();day=LocalDate.now(ZONE);
+        evidence.put("case",info.getDisplayName());evidence.put("token",token);evidence.put("environment","TEST");
+        evidence.put("sourceAccount",ACCOUNT);evidence.put("warehouseCode",warehouse);
+        evidence.put("realMySqlTransactions",true);evidence.put("collectionMode","OFF");
+        evidence.put("sourceHttpCalls",0);evidence.put("assertionsCompleted",false);
+        scope=new SelfopSyncScope();scope.setId(IdWorker.getId());scope.setSourceAccount(ACCOUNT);
+        scope.setWarehouseCode(warehouse);scope.setDataFamily("INVENTORY");
+        scope.setScopeJson(json(Map.of("fixtureOrigin","OFFLINE_SYNTHETIC_TRANSACTION_ACCEPTANCE",
+            "quantityUnit","PCS","businessTimezone","Asia/Shanghai","sourceTimezone","Asia/Shanghai")));
+        scope.setScopeHash(hash(scope.getScopeJson()));scope.setBusinessTimezone("Asia/Shanghai");scope.setSourceTimezone("Asia/Shanghai");
+        scope.setScheduleCron("0 0 8 * * *");scope.setStaleAfterSeconds(93600);
+        scope.setFactRevision(0L);scope.setPublishedFactRevision(0L);scope.setRebuildRequired(0);
+        scope.setFenceToken(1L);scope.setLeaseOwner(owner);scope.setLeaseUntilUtc(utcNow().plusMinutes(30));
+        scope.setReviewRequestBudget(1);scope.setReviewTimeBudgetSeconds(1);scope.setReviewTargetDays(7);
+        scope.setCreatedAt(utcNow());scope.setUpdatedAt(utcNow());
+        transactions.executeWithoutResult(s->scopes.insert(scope));evidence.put("scopeId",scope.getId().toString());
+    }
+
+    @Test void pointerRunTaskSupersededAndDailyElectionRollBackAfterRealSqlFault() {
+        var old=candidate(day.minusDays(2),day.minusDays(1),false);publish(old);
+        var next=candidate(day,day,false);var before=snapshot(old,next);
+        fault.armed=true;
+        RuntimeException failure=assertThrows(RuntimeException.class,()->publish(next));
+        boolean expected=false;for(Throwable cause=failure;cause!=null;cause=cause.getCause())
+            if(FAULT.equals(cause.getMessage()))expected=true;
+        assertTrue(expected,"Expected injected failure after actual run SQL");
+        assertTrue(fault.pointerWritten&&fault.realTransaction,"Actual pointer update and transaction must have occurred");
+        var after=snapshot(old,next);assertEquals(before,after,"Rollback must restore every publication field");
+        assertEquals("READY",runs.selectById(next.getId()).getStatus());assertNull(runs.selectById(next.getId()).getInventoryDailySampleDate());
+        assertEquals(0L,sampleCount(day));
+        evidence.put("before",before);evidence.put("afterRollback",after);
+        evidence.put("faultAfterRealScopeAndRunWrites",true);evidence.put("assertionsCompleted",true);
+    }
+
+    @Test void successfulPublicationAndPublishedRecoveryKeepExactCommittedResult() {
+        var run=candidate(day,day,false);publish(run);var before=snapshot(run);
+        assertPublished(run,true);publish(run);assertEquals(before,snapshot(run));
+        assertEquals(1L,sampleCount(day));
+        evidence.put("afterFirstCommit",before);evidence.put("afterRecovery",snapshot(run));
+        evidence.put("assertionsCompleted",true);
+    }
+
+    @Test void laterSameDayPublicationPreservesFirstRepresentativeAndItsRows() {
+        var first=candidate(day,day,false);publish(first);
+        var second=candidate(day,day,false);publish(second);
+        assertPublished(second,false);assertEquals(first.getId(),dailyRun(day));assertEquals(1L,sampleCount(day));
+        assertEquals(1L,rowCount("ll_selfop_inventory_snapshot","snapshot_run_id",first.getId()));
+        assertEquals(1L,rowCount("ll_selfop_sku_profile","profile_run_id",first.getId()));
+        assertNotNull(runs.selectById(first.getId()).getSupersededAtUtc());
+        evidence.put("afterSecondCommit",snapshot(first,second));evidence.put("assertionsCompleted",true);
+    }
+
+    @Test void crossMidnightPublicationHasNoDailyMarkerAndCannotBackfill() {
+        var first=candidate(day,day,false);publish(first);
+        var crossed=candidate(day.minusDays(1),day,true);publish(crossed);
+        assertPublished(crossed,false);assertEquals(first.getId(),dailyRun(day));
+        assertEquals(0L,sampleCount(day.minusDays(1)));assertEquals(1L,sampleCount(day));
+        evidence.put("afterCrossMidnightCommit",snapshot(first,crossed));evidence.put("assertionsCompleted",true);
+    }
+
+    private SelfopSyncRun candidate(LocalDate planned,LocalDate observed,boolean crossed) {
+        LocalDateTime start=crossed?utcDate(observed).minusMinutes(1):utcDate(observed).plusHours(1);
+        LocalDateTime finish=crossed?utcDate(observed).plusMinutes(1):start.plusMinutes(1);
+        var task=new SelfopSyncTask();task.setId(IdWorker.getId());task.setTaskNo("SYNTH-TXN-"+UUID.randomUUID().toString().toUpperCase(Locale.ROOT));
+        task.setExecutionPurpose("BUSINESS");task.setSourceAccount(ACCOUNT);task.setWarehouseCode(warehouse);
+        task.setTaskRole("WAREHOUSE_SYNC");task.setScopeId(scope.getId());task.setTaskType("SCHEDULED");
+        task.setPlannedAtUtc(utcDate(planned).plusHours(1));task.setRequestKey("SYNTH-TXN-"+UUID.randomUUID());
+        task.setRequestHash(scope.getScopeHash());task.setScopeHash(scope.getScopeHash());task.setQueryScopeJson(scope.getScopeJson());
+        task.setStatus("RUNNING");task.setApplyState("NOT_APPLICABLE");task.setAttemptCount(1);
+        task.setCreatedAt(utcNow());task.setUpdatedAt(utcNow());
+        var run=new SelfopSyncRun();run.setId(IdWorker.getId());run.setTaskId(task.getId());run.setScopeId(scope.getId());
+        run.setExecutionPurpose("BUSINESS");run.setSourceAccount(ACCOUNT);run.setWarehouseCode(warehouse);run.setRunRole("WAREHOUSE_SYNC");
+        run.setAttemptNo(1);run.setScopeHash(scope.getScopeHash());run.setScopeSnapshotJson(scope.getScopeJson());run.setFenceToken(1L);
+        run.setBasePublishedRunId(scopes.selectById(scope.getId()).getPublishedRunId());run.setStatus("READY");run.setLastPhase("BUILD");
+        run.setFetchStartedAtUtc(start);run.setFetchFinishedAtUtc(finish);run.setPageCount(1);run.setSourceTotalCount(1L);
+        run.setUniqueObjectCount(1L);run.setCoverageStatus("COMPLETE");run.setCreatedAt(utcNow());run.setUpdatedAt(utcNow());
+        var stock=new SelfopInventorySnapshot();stock.setId(IdWorker.getId());stock.setSnapshotRunId(run.getId());
+        stock.setSourceAccount(ACCOUNT);stock.setWarehouseCode(warehouse);stock.setCustomerCode("SYNTH-TXN-OWNER");
+        stock.setSkuCode("SYNTH-TXN-SKU");stock.setProductName("合成事务验收商品，非领星数据");stock.setProductQuality(0);
+        stock.setPhysicalQuantity(BigDecimal.TEN);stock.setAvailableQuantity(BigDecimal.TEN);stock.setFrozenQuantity(BigDecimal.ZERO);
+        stock.setTransitQuantity(BigDecimal.ZERO);stock.setObservedAtUtc(finish);stock.setQualityStatus("VALID");
+        stock.setCreatedAt(utcNow());stock.setUpdatedAt(utcNow());
+        var profile=new SelfopSkuProfile();profile.setId(IdWorker.getId());profile.setProfileRunId(run.getId());
+        profile.setSourceAccount(ACCOUNT);profile.setWarehouseCode(warehouse);profile.setCustomerCode(stock.getCustomerCode());
+        profile.setSkuCode(stock.getSkuCode());profile.setProductName(stock.getProductName());profile.setQuantityUnit("PCS");
+        profile.setFirstSeenAtUtc(start);profile.setEarliestEvidenceAtUtc(start);profile.setEvidenceType("INVENTORY_OBSERVATION");
+        profile.setEvidenceRunId(run.getId());profile.setLastSeenRunId(run.getId());profile.setCreatedAt(utcNow());profile.setUpdatedAt(utcNow());
+        transactions.executeWithoutResult(s->{tasks.insert(task);runs.insert(run);stocks.insert(stock);profiles.insert(profile);});
+        return run;
+    }
+    private void publish(SelfopSyncRun run){service.publish(scope.getId(),run.getId(),owner,1L);}
+    private void assertPublished(SelfopSyncRun candidate,boolean daily){
+        var saved=runs.selectById(candidate.getId());var task=tasks.selectById(saved.getTaskId());
+        assertEquals(candidate.getId(),scopes.selectById(scope.getId()).getPublishedRunId());
+        assertEquals("PUBLISHED",saved.getStatus());assertNotNull(saved.getPublishedAtUtc());
+        assertEquals("SUCCEEDED",task.getStatus());assertEquals(saved.getId(),task.getResultPublishedRunId());
+        assertEquals(daily?day:null,saved.getInventoryDailySampleDate());
+        assertEquals(daily?"DAILY_SCHEDULED_FIRST_V1":null,saved.getInventorySampleRuleVersion());
+        assertEquals("OFF",properties.getCollectionMode());assertFalse(properties.isExecutionEnabled());
+    }
+    /** JdbcTemplate uses independent connections after service transaction completes. */
+    private Map<String,Object> snapshot(SelfopSyncRun... selected){
+        assertFalse(TransactionSynchronizationManager.isActualTransactionActive());
+        var result=new LinkedHashMap<String,Object>();
+        result.put("scope",jdbc.queryForMap("SELECT CAST(published_run_id AS CHAR) published_run_id FROM ll_selfop_sync_scope WHERE id=?",scope.getId()));
+        for(var run:selected){
+            result.put("run-"+run.getId(),jdbc.queryForMap("SELECT status,published_at_utc,superseded_at_utc,inventory_daily_sample_date,inventory_sample_rule_version FROM ll_selfop_sync_run WHERE id=?",run.getId()));
+            result.put("task-"+run.getTaskId(),jdbc.queryForMap("SELECT status,CAST(result_published_run_id AS CHAR) result_published_run_id FROM ll_selfop_sync_task WHERE id=?",run.getTaskId()));
+        }return result;
+    }
+    private long sampleCount(LocalDate date){return jdbc.queryForObject("SELECT COUNT(*) FROM ll_selfop_sync_run WHERE source_account=? AND warehouse_code=? AND inventory_daily_sample_date=?",Long.class,ACCOUNT,warehouse,date);}
+    private Long dailyRun(LocalDate date){return jdbc.queryForObject("SELECT id FROM ll_selfop_sync_run WHERE source_account=? AND warehouse_code=? AND inventory_daily_sample_date=?",Long.class,ACCOUNT,warehouse,date);}
+    private long rowCount(String table,String column,long id){return jdbc.queryForObject("SELECT COUNT(*) FROM "+table+" WHERE "+column+"=?",Long.class,id);}
+    private static LocalDateTime utcDate(LocalDate date){return date.atStartOfDay(ZONE).withZoneSameInstant(ZoneOffset.UTC).toLocalDateTime();}
+    private static String requiredEnv(String name){String value=System.getenv(name);if(value==null||value.isBlank())throw new IllegalStateException("Missing TEST variable "+name);return value;}
+
+    @AfterEach void preserveEvidenceAndDisableRemainingDrafts() throws Exception {
+        if(jdbc!=null&&scope!=null){
+            // Retain every row. Prevent later scheduler runs from consuming unsuccessful synthetic drafts.
+            transactions.executeWithoutResult(s->{
+                jdbc.update("UPDATE ll_selfop_sync_task SET status='DEAD',next_retry_at_utc=NULL WHERE source_account=? AND scope_id=? AND status<>'SUCCEEDED'",ACCOUNT,scope.getId());
+                jdbc.update("UPDATE ll_selfop_sync_scope SET lease_owner=NULL,lease_until_utc=NULL WHERE id=? AND source_account=? AND lease_owner=?",scope.getId(),ACCOUNT,owner);
+            });
+            evidence.put("retainedRunHeads",jdbc.queryForList("SELECT CAST(id AS CHAR) id,status,inventory_daily_sample_date FROM ll_selfop_sync_run WHERE scope_id=? ORDER BY id",scope.getId()));
+        }
+        if(!evidence.isEmpty()){
+            evidence.put("at",Instant.now().toString());evidence.put("noRowsDeleted",true);
+            var directory=Path.of("target");Files.createDirectories(directory);
+            new ObjectMapper().findAndRegisterModules().writerWithDefaultPrettyPrinter().writeValue(
+                directory.resolve("selfop-mysql-publication-"+token+".json").toFile(),evidence);
+        }
+    }
+
+    @Intercepts(@Signature(type=Executor.class,method="update",args={MappedStatement.class,Object.class}))
+    public static class WriteFault implements Interceptor {
+        boolean armed,pointerWritten,realTransaction;
+        @Override public Object intercept(Invocation invocation) throws Throwable {
+            Object result=invocation.proceed(); // Every mapped SQL really executes before the fault hook.
+            if(armed){String id=((MappedStatement)invocation.getArgs()[0]).getId();
+                if(id.equals(SelfopSyncScopeMapper.class.getName()+".updateById"))pointerWritten=true;
+                if(id.equals(SelfopSyncRunMapper.class.getName()+".updateById")){
+                    armed=false;realTransaction=TransactionSynchronizationManager.isActualTransactionActive();
+                    throw new IllegalStateException(FAULT);
+                }
+            }return result;
+        }
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/inventory/InventorySnapshotAssemblerTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/inventory/InventorySnapshotAssemblerTest.java
new file mode 100644
index 000000000..1f784401b
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/inventory/InventorySnapshotAssemblerTest.java
@@ -0,0 +1,122 @@
+package com.baiyue.lastleg.selfoperated.analytics.inventory;
+
+import com.baiyue.lastleg.selfoperated.analytics.model.*;
+import java.math.BigDecimal;
+import java.time.LocalDateTime;
+import java.util.*;
+import org.junit.jupiter.api.Test;
+import static org.junit.jupiter.api.Assertions.*;
+import static com.baiyue.lastleg.selfoperated.analytics.model.SelfopSupport.*;
+
+class InventorySnapshotAssemblerTest {
+    private final LocalDateTime time = LocalDateTime.of(2026, 10, 12, 0, 0);
+    private SelfopSyncScope scope() {
+        var scope = new SelfopSyncScope(); scope.setSourceAccount("demo"); scope.setWarehouseCode("A"); return scope;
+    }
+    private SelfopSyncRun run(long count) {
+        var run = new SelfopSyncRun(); run.setExecutionPurpose("BUSINESS"); run.setId(10L); run.setSourceTotalCount(count); run.setUniqueObjectCount(count);
+        run.setPageCount(1); run.setCoverageStatus("COMPLETE"); run.setFetchStartedAtUtc(time); run.setFetchFinishedAtUtc(time.plusMinutes(1));
+        run.setBasePublishedRunId(9L); run.setReferenceSalesRunId(8L); return run;
+    }
+    private SelfopPayloads.Stock stock(String customer, String sku, Integer quality, BigDecimal available) {
+        return new SelfopPayloads.Stock("demo", customer, "A", sku, quality, "Name", new BigDecimal("120"),
+            available, new BigDecimal("20"), new BigDecimal("30"), null);
+    }
+    private SelfopSyncStage stage(SelfopPayloads.Stock stock) {
+        var stage = new SelfopSyncStage(); stage.setRunId(10L); stage.setStageBatchId(10L); stage.setLastFetchRunId(10L);
+        stage.setWarehouseCode(stock.warehouseCode()); stage.setObjectType("PRODUCT_STOCK"); stage.setValidationStatus("VALID");
+        stage.setFirstPageNo(1); stage.setObservedAtUtc(time); stage.setPayloadJson(json(stock)); stage.setContentHash(SelfopStockFingerprint.of(stock));
+        stage.setObjectKeyHash(hash(List.of(stock.sourceAccount(), stock.customerCode(), stock.warehouseCode(), stock.skuCode(), stock.productQuality())));
+        return stage;
+    }
+    private InventorySnapshotAssembler.Candidate build(SelfopSyncRun run, List<SelfopSyncStage> stages,
+            List<SelfopInventorySnapshot> previous, List<SelfopSkuProfile> profiles, List<SelfopSkuProfile> sales) {
+        return InventorySnapshotAssembler.assemble(scope(), run, stages, previous, profiles, sales, "PCS");
+    }
+    @Test void quantitiesRemainIndependentAndAllQualitiesKeepTheirIdentity() {
+        var rows = List.of(stage(stock("c", "sku", 0, new BigDecimal("100"))),
+            stage(stock("c", "sku", 1, new BigDecimal("8"))), stage(stock("c", "sku2", 0, BigDecimal.ZERO)));
+        var candidate = build(run(3), rows, List.of(), List.of(), List.of());
+        assertEquals(3, candidate.snapshots().size()); assertEquals(2, candidate.profiles().size());
+        var regular = candidate.snapshots().get(0);
+        assertEquals(new BigDecimal("100"), regular.getAvailableQuantity());
+        assertEquals(new BigDecimal("30"), regular.getTransitQuantity());
+        assertEquals("VALID", regular.getQualityStatus());
+        assertEquals(BigDecimal.ZERO, candidate.snapshots().get(2).getAvailableQuantity());
+    }
+    @Test void persistedNumericNotationDoesNotChangeContentButChangedQuantityStillFails() {
+        var original=stock("c","sku",0,new BigDecimal("1E+2"));
+        var staged=stage(original);
+        var persisted=stock("c","sku",0,new BigDecimal("100.0"));
+        assertNotEquals(hash(original),hash(persisted));
+        staged.setPayloadJson(json(persisted));
+        assertEquals(0,new BigDecimal("100").compareTo(build(run(1),List.of(staged),List.of(),List.of(),List.of()).snapshots().get(0).getAvailableQuantity()));
+        staged.setPayloadJson(json(stock("c","sku",0,new BigDecimal("101.0"))));
+        assertEquals("SELFOP_INVENTORY_CONTENT_CHANGED",assertThrows(IllegalStateException.class,
+            ()->build(run(1),List.of(staged),List.of(),List.of(),List.of())).getMessage());
+    }
+    @Test void missingAndNegativeQuantitiesNeverTurnIntoZero() {
+        var candidate = build(run(2), List.of(stage(stock("c", "unknown", 0, null)),
+            stage(stock("c", "negative", 0, BigDecimal.ONE.negate()))), List.of(), List.of(), List.of());
+        assertEquals("UNKNOWN", candidate.snapshots().get(0).getQualityStatus());
+        assertNull(candidate.snapshots().get(0).getAvailableQuantity());
+        assertEquals("INVALID", candidate.snapshots().get(1).getQualityStatus());
+        assertEquals(BigDecimal.ONE.negate(), candidate.snapshots().get(1).getAvailableQuantity());
+    }
+    @Test void unrepresentableDecimalsArePreservedInStageAndCannotBeRoundedInSnapshot() {
+        var source = stage(stock("c", "precise", 0, new BigDecimal("0.1234567")));
+        var candidate = build(run(1), List.of(source), List.of(), List.of(), List.of());
+        assertEquals("QUANTITY_PRECISION", candidate.snapshots().get(0).getQualityReason());
+        assertNull(candidate.snapshots().get(0).getAvailableQuantity());
+        assertEquals(new BigDecimal("0.1234567"), read(source.getPayloadJson(), SelfopPayloads.Stock.class).availableQuantity());
+    }
+    @Test void total5741Unique5740RejectsEvenIfRowCountMatchesSourceTotal() {
+        var run = run(5741); run.setUniqueObjectCount(5740L); run.setPageCount(6);
+        var rows = new ArrayList<SelfopSyncStage>();
+        for (int i = 0; i < 5741; i++) rows.add(stage(stock("c", "sku" + (i % 5740), 0, BigDecimal.ONE)));
+        assertThrows(IllegalStateException.class, () -> build(run, rows, List.of(), List.of(), List.of()));
+    }
+    @Test void duplicateBusinessIdentityRejectedEvenIfDistinctStageHashesClaimComplete() {
+        var first = stage(stock("c", "sku", 0, BigDecimal.ONE));
+        var second = stage(stock("c", "sku", 0, BigDecimal.TEN)); second.setObjectKeyHash("different");
+        assertThrows(IllegalStateException.class, () -> build(run(2), List.of(first, second), List.of(), List.of(), List.of()));
+    }
+    @Test void newAttemptCannotBorrowOldAttemptPages() {
+        var stage = stage(stock("c", "sku", 0, BigDecimal.ONE)); stage.setStageBatchId(9L);
+        assertThrows(IllegalStateException.class, () -> build(run(1), List.of(stage), List.of(), List.of(), List.of()));
+    }
+    @Test void warehouseLeakOrTamperedContentRejected() {
+        var stock = stock("c", "sku", 0, BigDecimal.ONE);
+        var wrong = new SelfopPayloads.Stock(stock.sourceAccount(), stock.customerCode(), "B", stock.skuCode(), 0,
+            null, BigDecimal.ONE, BigDecimal.ONE, BigDecimal.ZERO, BigDecimal.ZERO, null);
+        assertThrows(IllegalStateException.class, () -> build(run(1), List.of(stage(wrong)), List.of(), List.of(), List.of()));
+        var tampered = stage(stock); tampered.setContentHash("bad");
+        assertThrows(IllegalStateException.class, () -> build(run(1), List.of(tampered), List.of(), List.of(), List.of()));
+    }
+    @Test void fixedReferencesGenerateUnknownAndSalesCannotCreateInventoryEvidence() {
+        var previous = new SelfopInventorySnapshot(); previous.setSnapshotRunId(9L); previous.setSourceAccount("demo");
+        previous.setWarehouseCode("A"); previous.setCustomerCode("c"); previous.setSkuCode("old"); previous.setProductQuality(1);
+        previous.setAvailableQuantity(BigDecimal.TEN);
+        var old = profile(9L, "old"); old.setEvidenceType("INVENTORY_OBSERVATION"); old.setFirstSeenAtUtc(time.minusDays(3));
+        old.setEarliestEvidenceAtUtc(time.minusDays(3)); old.setEvidenceRunId(1L); old.setLastSeenRunId(9L);
+        var sales = profile(8L, "salesOnly"); sales.setEvidenceType("VALID_OUTBOUND"); sales.setEarliestEvidenceAtUtc(time.minusDays(100));
+        var candidate = build(run(0), List.of(), List.of(previous), List.of(old), List.of(sales));
+        assertEquals(2, candidate.snapshots().size());
+        assertTrue(candidate.snapshots().stream().allMatch(s -> "UNKNOWN".equals(s.getQualityStatus()) && s.getAvailableQuantity() == null));
+        var inherited = candidate.profiles().stream().filter(p -> "old".equals(p.getSkuCode())).findFirst().orElseThrow();
+        assertEquals(time.minusDays(3), inherited.getFirstSeenAtUtc()); assertEquals(9L, inherited.getLastSeenRunId());
+        var placeholder = candidate.profiles().stream().filter(p -> "salesOnly".equals(p.getSkuCode())).findFirst().orElseThrow();
+        assertEquals("NONE", placeholder.getEvidenceType()); assertNull(placeholder.getEarliestEvidenceAtUtc());
+        assertNull(placeholder.getEvidenceRunId()); assertNull(placeholder.getQuantityUnit());
+        assertEquals(BigDecimal.TEN, previous.getAvailableQuantity()); assertEquals(9L, old.getProfileRunId());
+    }
+    @Test void inventoryFirstSeenIsInheritedOnlyFromInventoryNotSales() {
+        var old = profile(9L, "sku"); old.setEvidenceType("NONE"); old.setFirstSeenAtUtc(time.minusDays(90));
+        var candidate = build(run(1), List.of(stage(stock("c", "sku", 0, BigDecimal.ONE))), List.of(), List.of(old), List.of());
+        assertEquals(time, candidate.profiles().get(0).getFirstSeenAtUtc());
+    }
+    private SelfopSkuProfile profile(long runId, String sku) {
+        var profile = new SelfopSkuProfile(); profile.setProfileRunId(runId); profile.setSourceAccount("demo");
+        profile.setWarehouseCode("A"); profile.setCustomerCode("c"); profile.setSkuCode(sku); return profile;
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/inventory/InventorySnapshotServiceTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/inventory/InventorySnapshotServiceTest.java
new file mode 100644
index 000000000..120b2e566
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/inventory/InventorySnapshotServiceTest.java
@@ -0,0 +1,256 @@
+package com.baiyue.lastleg.selfoperated.analytics.inventory;
+
+import com.baiyue.lastleg.selfoperated.analytics.mapper.*;
+import com.baiyue.lastleg.selfoperated.analytics.model.*;
+import java.time.LocalDateTime;
+import java.time.LocalDate;
+import java.util.List;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import static org.junit.jupiter.api.Assertions.*;
+import static org.mockito.ArgumentMatchers.*;
+import static org.mockito.Mockito.*;
+
+class InventorySnapshotServiceTest {
+    private final SelfopCoordinationMapper coordination = mock(SelfopCoordinationMapper.class);
+    private final SelfopSyncScopeMapper scopes = mock(SelfopSyncScopeMapper.class);
+    private final SelfopSyncRunMapper runs = mock(SelfopSyncRunMapper.class);
+    private final SelfopSyncTaskMapper tasks = mock(SelfopSyncTaskMapper.class);
+    private final SelfopSyncStageMapper stages = mock(SelfopSyncStageMapper.class);
+    private final SelfopInventorySnapshotMapper snapshots = mock(SelfopInventorySnapshotMapper.class);
+    private final SelfopSkuProfileMapper profiles = mock(SelfopSkuProfileMapper.class);
+    private final SelfopAnalyticsProperties properties = new SelfopAnalyticsProperties();
+    private final InventorySnapshotService service = new InventorySnapshotService(coordination, scopes, runs, tasks, stages, snapshots, profiles, properties);
+    private SelfopSyncScope scope;
+    private SelfopSyncRun run;
+    private SelfopSyncTask task;
+    @BeforeEach void prepare() {
+        scope = new SelfopSyncScope(); scope.setId(1L); scope.setSourceAccount("demo"); scope.setWarehouseCode("A");
+        scope.setDataFamily("INVENTORY"); scope.setScopeHash("hash"); scope.setLeaseOwner("owner");
+        scope.setLeaseUntilUtc(LocalDateTime.now(java.time.ZoneOffset.UTC).plusHours(1)); scope.setFenceToken(4L);
+        scope.setRebuildRequired(1); scope.setFactRevision(9L);
+        run = new SelfopSyncRun(); run.setId(10L); run.setTaskId(20L); run.setScopeId(1L);
+        run.setSourceAccount("demo"); run.setWarehouseCode("A"); run.setRunRole("WAREHOUSE_SYNC");
+        run.setExecutionPurpose("BUSINESS"); run.setScopeHash("hash"); run.setFenceToken(4L); run.setStatus("READY"); run.setCoverageStatus("COMPLETE");
+        run.setScopeSnapshotJson("{\"quantityUnit\":\"PCS\"}");
+        run.setSourceTotalCount(0L); run.setUniqueObjectCount(0L); run.setPageCount(1);
+        run.setFetchStartedAtUtc(LocalDateTime.of(2026, 10, 12, 0, 0)); run.setFetchFinishedAtUtc(run.getFetchStartedAtUtc().plusMinutes(1));
+        task = new SelfopSyncTask(); task.setExecutionPurpose("BUSINESS"); task.setId(20L); task.setScopeId(1L); task.setScopeHash("hash");
+        task.setSourceAccount("demo"); task.setWarehouseCode("A"); task.setApplyState("NOT_APPLICABLE");
+        when(coordination.lockScope(1L)).thenReturn(scope); when(coordination.lockRun(10L)).thenReturn(run);
+        when(coordination.lockTask(20L)).thenReturn(task);
+        when(stages.selectList(any())).thenReturn(List.of()); when(snapshots.selectList(any())).thenReturn(List.of());
+        when(profiles.selectList(any())).thenReturn(List.of());
+        properties.setQuantityUnit("PCS");
+    }
+    @Test void inventoryPublicationDoesNotConsultSalesBarrierOrModifyOutboundRevision() {
+        when(coordination.barriers("demo", "A")).thenReturn(1L);
+        service.publish(1L, 10L, "owner", 4L);
+        assertEquals(10L, scope.getPublishedRunId()); assertEquals("PUBLISHED", run.getStatus());
+        assertEquals(1, scope.getRebuildRequired()); assertEquals(9L, scope.getFactRevision());
+        verify(coordination, never()).barriers(anyString(), anyString());
+        verify(tasks).updateById(argThat((SelfopSyncTask t) -> "SUCCEEDED".equals(t.getStatus()) && Long.valueOf(10L).equals(t.getResultPublishedRunId())));
+        assertEquals(10L, task.getResultPublishedRunId());
+    }
+    @Test void oldFenceOrExpiredLeaseCannotMovePointer() {
+        assertThrows(IllegalStateException.class, () -> service.publish(1L, 10L, "owner", 3L));
+        scope.setLeaseUntilUtc(LocalDateTime.now(java.time.ZoneOffset.UTC).minusSeconds(1));
+        assertThrows(IllegalStateException.class, () -> service.publish(1L, 10L, "owner", 4L));
+        verify(scopes, never()).updateById(any(SelfopSyncScope.class));
+    }
+    @Test void newerInventoryPublicationCannotBeOverwrittenByOldCandidate() {
+        scope.setPublishedRunId(11L);
+        assertThrows(IllegalStateException.class, () -> service.publish(1L, 10L, "owner", 4L));
+        verify(scopes, never()).updateById(any(SelfopSyncScope.class));
+    }
+    @Test void unknownUnitFailsClosedAndUnreadyCandidateCannotPublish() {
+        run.setScopeSnapshotJson("{\"quantityUnit\":null}");
+        assertThrows(IllegalStateException.class, () -> service.publish(1L, 10L, "owner", 4L));
+        run.setScopeSnapshotJson("{\"quantityUnit\":\"PCS\"}"); run.setStatus("FETCHING");
+        assertThrows(IllegalStateException.class, () -> service.publish(1L, 10L, "owner", 4L));
+        verify(scopes, never()).updateById(any(SelfopSyncScope.class));
+    }
+    @Test void readyAndPublishedRetryNeverChangesImmutableCandidateRows() {
+        service.build(1L, 10L, "owner", 4L);
+        verify(snapshots, never()).insert(any(SelfopInventorySnapshot.class));
+        verify(snapshots, never()).insert(anyCollection(), anyInt());
+        verify(profiles, never()).insert(any(SelfopSkuProfile.class));
+        verify(profiles, never()).insert(anyCollection(), anyInt());
+        service.publish(1L, 10L, "owner", 4L); service.publish(1L, 10L, "owner", 4L);
+        verify(scopes, times(1)).updateById(any(SelfopSyncScope.class));
+    }
+    @Test void malformedCompleteClaimFailsBeforeAnyCandidateIsWritten() {
+        run.setStatus("VALIDATED"); run.setSourceTotalCount(5741L); run.setUniqueObjectCount(5740L);
+        assertThrows(IllegalStateException.class, () -> service.build(1L, 10L, "owner", 4L));
+        verify(snapshots, never()).insert(any(SelfopInventorySnapshot.class));
+        verify(snapshots, never()).insert(anyCollection(), anyInt());
+        verify(runs, never()).updateById(any(SelfopSyncRun.class));
+    }
+    @Test void emptyCompleteRunCanBuildAndPublishWithoutInventingSkuEvidence() {
+        run.setStatus("VALIDATED");
+        service.build(1L, 10L, "owner", 4L);
+        assertEquals("READY", run.getStatus()); verify(runs).updateById(run);
+        verify(snapshots, never()).insert(any(SelfopInventorySnapshot.class));
+        verify(snapshots, never()).insert(anyCollection(), anyInt());
+        service.publish(1L, 10L, "owner", 4L);
+        assertEquals("PUBLISHED", run.getStatus());
+    }
+    @Test void missingProfileRefusesPointerSwitch() {
+        var row = new SelfopInventorySnapshot(); row.setSnapshotRunId(10L); row.setSourceAccount("demo");
+        row.setWarehouseCode("A"); row.setCustomerCode("c"); row.setSkuCode("sku");
+        when(snapshots.selectList(any())).thenReturn(List.of(row));
+        assertThrows(IllegalStateException.class, () -> service.publish(1L, 10L, "owner", 4L));
+        verify(scopes, never()).updateById(any(SelfopSyncScope.class));
+    }
+    @Test void validationPurposeCannotBuildOrPublishEvenWhenCompleteAndFenceValid() {
+        run.setExecutionPurpose("VALIDATION");run.setStatus("VALIDATED");
+        assertEquals("SELFOP_BUSINESS_PURPOSE_REQUIRED", assertThrows(IllegalStateException.class, () -> service.build(1L,10L,"owner",4L)).getMessage());
+        run.setStatus("READY");
+        assertEquals("SELFOP_BUSINESS_PURPOSE_REQUIRED", assertThrows(IllegalStateException.class, () -> service.publish(1L,10L,"owner",4L)).getMessage());
+        verify(snapshots, never()).insert(anyCollection(),anyInt());verify(profiles, never()).insert(anyCollection(),anyInt());verify(scopes,never()).updateById(any(SelfopSyncScope.class));assertNull(task.getResultPublishedRunId());
+    }
+    @Test void validationTaskCannotPublishBusinessRunOrAcquireResultLink() {
+        task.setExecutionPurpose("VALIDATION");task.setValidationRootTaskId(20L);
+        assertEquals("SELFOP_BUSINESS_PURPOSE_REQUIRED", assertThrows(IllegalStateException.class, () -> service.publish(1L,10L,"owner",4L)).getMessage());
+        verify(scopes,never()).updateById(any(SelfopSyncScope.class));assertNull(task.getResultPublishedRunId());
+    }
+    @Test void candidateBulkInsertHasIdsAndCapsConfiguredBatchSizeAt500() {
+        run.setStatus("VALIDATED");run.setSourceTotalCount(1L);run.setUniqueObjectCount(1L);properties.setPersistenceBatchSize(1000);
+        var payload=new SelfopPayloads.Stock("demo","c","A","sku",0,"Name",java.math.BigDecimal.TEN,java.math.BigDecimal.ONE,java.math.BigDecimal.ZERO,java.math.BigDecimal.ZERO,null);
+        var stage=new SelfopSyncStage();stage.setId(100L);stage.setRunId(10L);stage.setStageBatchId(10L);stage.setLastFetchRunId(10L);stage.setObjectType("PRODUCT_STOCK");stage.setWarehouseCode("A");stage.setValidationStatus("VALID");stage.setFirstPageNo(1);stage.setObservedAtUtc(run.getFetchStartedAtUtc());stage.setPayloadJson(SelfopSupport.json(payload));stage.setContentHash(SelfopStockFingerprint.of(payload));stage.setObjectKeyHash(SelfopSupport.hash(List.of("demo","c","A","sku",0)));
+        when(stages.selectList(any())).thenReturn(List.of(stage));service.build(1L,10L,"owner",4L);
+        verify(snapshots).insert(argThat((java.util.Collection<SelfopInventorySnapshot> rows) -> rows.size()==1 && rows.iterator().next().getId()!=null && Long.valueOf(10L).equals(rows.iterator().next().getSnapshotRunId())),eq(500));
+        verify(profiles).insert(argThat((java.util.Collection<SelfopSkuProfile> rows) -> rows.size()==1 && rows.iterator().next().getId()!=null),eq(500));
+        verify(snapshots,never()).insert(any(SelfopInventorySnapshot.class));verify(profiles,never()).insert(any(SelfopSkuProfile.class));assertEquals("READY",run.getStatus());
+    }
+    @Test void publishedReferenceMustAlsoBeBusinessPurpose() {
+        run.setStatus("VALIDATED");run.setBasePublishedRunId(9L);scope.setPublishedRunId(9L);
+        var ref=new SelfopSyncRun();ref.setId(9L);ref.setExecutionPurpose("VALIDATION");ref.setStatus("PUBLISHED");ref.setRunRole("WAREHOUSE_SYNC");ref.setSourceAccount("demo");ref.setWarehouseCode("A");when(runs.selectById(9L)).thenReturn(ref);
+        assertEquals("SELFOP_BUSINESS_PURPOSE_REQUIRED",assertThrows(IllegalStateException.class,()->service.build(1L,10L,"owner",4L)).getMessage());
+        verify(snapshots,never()).insert(anyCollection(),anyInt());
+    }
+    @Test void liveUnitConfigCannotOverrideFixedRunConfiguration() {
+        properties.setQuantityUnit(null);
+        service.publish(1L, 10L, "owner", 4L);
+        assertEquals("PUBLISHED", run.getStatus());
+        prepare(); properties.setQuantityUnit("PCS"); run.setScopeSnapshotJson("{\"quantityUnit\":null}");
+        assertThrows(IllegalStateException.class, () -> service.publish(1L, 10L, "owner", 4L));
+    }
+
+    private void scheduledObservation() {
+        task.setTaskRole("WAREHOUSE_SYNC"); task.setTaskType("SCHEDULED");
+        task.setPlannedAtUtc(run.getFetchStartedAtUtc());
+    }
+
+    @Test void firstScheduledSuccessSelectsBeijingDayInPublicationTransaction() {
+        scheduledObservation();
+        // Beijing midnight is the previous UTC date; host timezone is irrelevant.
+        task.setPlannedAtUtc(LocalDateTime.of(2026, 10, 11, 16, 0));
+        run.setFetchStartedAtUtc(task.getPlannedAtUtc().plusMinutes(1));
+        run.setFetchFinishedAtUtc(run.getFetchStartedAtUtc().plusMinutes(1));
+        service.publish(1L, 10L, "owner", 4L);
+        assertEquals(LocalDate.of(2026, 10, 12), run.getInventoryDailySampleDate());
+        assertEquals("DAILY_SCHEDULED_FIRST_V1", run.getInventorySampleRuleVersion());
+        var order = inOrder(coordination, runs, scopes, tasks);
+        order.verify(coordination).lockScope(1L);
+        order.verify(runs).dailyInventorySample("demo", "A", LocalDate.of(2026, 10, 12));
+        order.verify(scopes).updateById(scope);
+        order.verify(runs).updateById(run);
+        order.verify(tasks).updateById(task);
+    }
+
+    @Test void laterSameDaySuccessPublishesLatestWithoutReplacingSelectedRepresentative() {
+        scheduledObservation();
+        var selected = new SelfopSyncRun(); selected.setId(9L);
+        selected.setStatus("PUBLISHED"); selected.setInventorySampleRuleVersion("DAILY_SCHEDULED_FIRST_V1");
+        selected.setInventoryDailySampleDate(LocalDate.of(2026, 10, 12));
+        when(runs.dailyInventorySample("demo", "A", LocalDate.of(2026, 10, 12))).thenReturn(selected);
+        service.publish(1L, 10L, "owner", 4L);
+        assertEquals(10L, scope.getPublishedRunId());
+        assertNull(run.getInventoryDailySampleDate()); assertNull(run.getInventorySampleRuleVersion());
+        assertEquals(LocalDate.of(2026, 10, 12), selected.getInventoryDailySampleDate());
+    }
+
+    @Test void failedAttemptDoesNotOccupyDayAndSuccessfulRetryMaySelectIt() {
+        scheduledObservation(); run.setStatus("FAILED");
+        assertThrows(IllegalStateException.class, () -> service.publish(1L, 10L, "owner", 4L));
+        assertNull(run.getInventoryDailySampleDate());
+        verify(runs, never()).dailyInventorySample(anyString(), anyString(), any());
+        // A new attempt uses a new run; the failed attempt remains immutable.
+        var failed = run;
+        run = new SelfopSyncRun(); org.springframework.beans.BeanUtils.copyProperties(failed, run);
+        run.setId(11L); run.setStatus("READY"); run.setAttemptNo(2);
+        when(coordination.lockRun(11L)).thenReturn(run);
+        service.publish(1L, 11L, "owner", 4L);
+        assertEquals("FAILED", failed.getStatus()); assertNull(failed.getInventoryDailySampleDate());
+        assertEquals(LocalDate.of(2026, 10, 12), run.getInventoryDailySampleDate());
+    }
+
+    @Test void crossMidnightAndOldSlotCatchupRemainCurrentInventoryButNeverDailySamples() {
+        scheduledObservation();
+        run.setFetchStartedAtUtc(LocalDateTime.of(2026, 10, 12, 15, 59));
+        run.setFetchFinishedAtUtc(LocalDateTime.of(2026, 10, 12, 16, 1));
+        service.publish(1L, 10L, "owner", 4L);
+        assertEquals("PUBLISHED", run.getStatus()); assertNull(run.getInventoryDailySampleDate());
+        prepare(); scheduledObservation();
+        task.setPlannedAtUtc(task.getPlannedAtUtc().minusDays(1));
+        service.publish(1L, 10L, "owner", 4L);
+        assertEquals("PUBLISHED", run.getStatus()); assertNull(run.getInventoryDailySampleDate());
+        verify(runs, never()).dailyInventorySample(anyString(), anyString(), any());
+    }
+
+    @Test void manualAndIncompleteEvidenceCannotAcquireDailyMarker() {
+        scheduledObservation(); task.setTaskType("MANUAL");
+        service.publish(1L, 10L, "owner", 4L);
+        assertNull(run.getInventoryDailySampleDate());
+        prepare(); scheduledObservation(); run.setFetchFinishedAtUtc(null);
+        assertNull(InventorySnapshotService.eligibleSampleDate(task, run));
+        run.setFetchFinishedAtUtc(run.getFetchStartedAtUtc()); run.setUniqueObjectCount(1L);
+        assertNull(InventorySnapshotService.eligibleSampleDate(task, run));
+        run.setUniqueObjectCount(0L); run.setExecutionPurpose("VALIDATION");
+        assertNull(InventorySnapshotService.eligibleSampleDate(task, run));
+    }
+
+    @Test void publishedRecoveryRetainsMarkerAndNeverRepublishesEvenWhenSuperseded() {
+        scheduledObservation(); service.publish(1L, 10L, "owner", 4L);
+        when(runs.dailyInventorySample("demo", "A", LocalDate.of(2026, 10, 12))).thenReturn(run);
+        scope.setPublishedRunId(11L); // Another successful run has become current.
+        service.publish(1L, 10L, "owner", 4L);
+        assertEquals(11L, scope.getPublishedRunId());
+        assertEquals(LocalDate.of(2026, 10, 12), run.getInventoryDailySampleDate());
+        verify(scopes, times(1)).updateById(scope); verify(runs, times(1)).updateById(run);
+    }
+
+    @Test void unmarkedPublishedRecoveryCannotRetroactivelyElectOldRun() {
+        scheduledObservation();
+        var previous = new SelfopSyncRun(); previous.setId(9L);
+        previous.setStatus("PUBLISHED"); previous.setInventorySampleRuleVersion("DAILY_SCHEDULED_FIRST_V1");
+        when(runs.dailyInventorySample(anyString(), anyString(), any())).thenReturn(previous);
+        service.publish(1L, 10L, "owner", 4L);
+        clearInvocations(runs);
+        when(runs.dailyInventorySample(anyString(), anyString(), any())).thenReturn(null);
+        service.publish(1L, 10L, "owner", 4L);
+        assertNull(run.getInventoryDailySampleDate());
+        verify(runs, never()).dailyInventorySample(anyString(), anyString(), any());
+        verify(runs, never()).updateById(any(SelfopSyncRun.class));
+    }
+
+    @Test void sameQuantityNextDayStillRecordsNewObservationAndRejectsPremarkedCandidate() {
+        scheduledObservation();
+        task.setPlannedAtUtc(task.getPlannedAtUtc().plusDays(1));
+        run.setFetchStartedAtUtc(run.getFetchStartedAtUtc().plusDays(1));
+        run.setFetchFinishedAtUtc(run.getFetchFinishedAtUtc().plusDays(1));
+        service.publish(1L, 10L, "owner", 4L);
+        assertEquals(LocalDate.of(2026, 10, 13), run.getInventoryDailySampleDate());
+        prepare(); scheduledObservation(); run.setInventoryDailySampleDate(LocalDate.of(2026, 10, 12));
+        assertEquals("SELFOP_INVENTORY_UNPUBLISHED_SAMPLE", assertThrows(IllegalStateException.class,
+            () -> service.publish(1L, 10L, "owner", 4L)).getMessage());
+    }
+
+    @Test void recoveryRejectsPartiallyPersistedSampleEvidence() {
+        service.publish(1L, 10L, "owner", 4L);
+        run.setInventorySampleRuleVersion("DAILY_SCHEDULED_FIRST_V1");
+        assertEquals("SELFOP_INVENTORY_SAMPLE_INVALID", assertThrows(IllegalStateException.class,
+            () -> service.publish(1L, 10L, "owner", 4L)).getMessage());
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/mapper/SelfopMasterDataMapperTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/mapper/SelfopMasterDataMapperTest.java
new file mode 100644
index 000000000..09b4b8583
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/mapper/SelfopMasterDataMapperTest.java
@@ -0,0 +1,60 @@
+package com.baiyue.lastleg.selfoperated.analytics.mapper;
+
+import com.baiyue.lastleg.selfoperated.analytics.model.SelfopPayloads;
+import org.apache.ibatis.mapping.Environment;
+import org.apache.ibatis.session.*;
+import org.apache.ibatis.transaction.jdbc.JdbcTransactionFactory;
+import org.h2.jdbcx.JdbcDataSource;
+import org.junit.jupiter.api.*;
+import java.sql.*;
+import java.math.BigDecimal;
+import java.time.LocalDateTime;
+import java.nio.charset.StandardCharsets;
+import java.util.UUID;
+import static org.junit.jupiter.api.Assertions.*;
+
+/** Real SQL, source DDL and transaction rollback against an offline synthetic database. */
+class SelfopMasterDataMapperTest {
+    JdbcDataSource data;SqlSessionFactory factory;SqlSession session;SelfopMasterDataMapper mapper;
+    final LocalDateTime now=LocalDateTime.of(2026,10,14,8,0);
+    @BeforeEach void setup() throws Exception {
+        data=new JdbcDataSource();data.setURL("jdbc:h2:mem:"+UUID.randomUUID()+";MODE=MySQL;DATABASE_TO_LOWER=TRUE;DB_CLOSE_DELAY=-1");
+        try(var stream=getClass().getResourceAsStream("/db/selfop-master-data.sql")) {
+            String ddl=new String(stream.readAllBytes(),StandardCharsets.UTF_8).replace(" COLLATE utf8mb4_bin","").replaceAll(" ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COMMENT='[^']*'","");
+            for(String statement:ddl.split(";"))if(!statement.isBlank())sql(statement);
+        }
+        sql("CREATE TABLE ll_selfop_sync_task(id BIGINT PRIMARY KEY,source_account VARCHAR(64),task_type VARCHAR(32),task_role VARCHAR(32),execution_purpose VARCHAR(32))");
+        sql("CREATE TABLE ll_selfop_sync_run(id BIGINT PRIMARY KEY,task_id BIGINT,source_account VARCHAR(64),execution_purpose VARCHAR(32),status VARCHAR(32),coverage_status VARCHAR(32),published_at_utc TIMESTAMP)");
+        var config=new Configuration(new Environment("offline",new JdbcTransactionFactory(),data));
+        config.setMapUnderscoreToCamelCase(true);config.setLocalCacheScope(LocalCacheScope.STATEMENT);config.addMapper(SelfopMasterDataMapper.class);
+        factory=new SqlSessionFactoryBuilder().build(config);session=factory.openSession(true);mapper=session.getMapper(SelfopMasterDataMapper.class);
+    }
+    @AfterEach void close(){session.close();}
+    void sql(String query)throws Exception{try(var c=data.getConnection();var s=c.createStatement()){s.execute(query);}}
+    SelfopPayloads.Product product(String owner){return new SelfopPayloads.Product(owner,"SKU","商品",new BigDecimal("5"),new BigDecimal("11"),new BigDecimal("5"),"cm",null,null,null,null);}
+    @Test void namesAndProductsAreIsolatedByAccountOwnerAndBatch()throws Exception{
+        mapper.insertOwner(1,10,"A",new SelfopPayloads.Owner("C","客户","0"),now);
+        mapper.insertOwner(2,10,"B",new SelfopPayloads.Owner("C","另一账号","1"),now);
+        mapper.insertProduct(3,10,"A",product("C"),now);mapper.insertProduct(4,10,"A",product("D"),now);
+        assertEquals("客户",mapper.owners("A",10).get(0).customerName());assertEquals("0",mapper.owners("A",10).get(0).status());
+        assertEquals(1,mapper.ownerCount(10,"A"));assertEquals(2,mapper.productCount(10,"A"));assertEquals(0,mapper.productCount(11,"A"));
+        assertThrows(RuntimeException.class,()->mapper.insertProduct(5,10,"A",product("C"),now));
+        try(var c=data.getConnection();var s=c.createStatement();var rs=s.executeQuery("SELECT declared_length,declared_size_unit,measured_length,measured_size_unit FROM ll_selfop_product WHERE id=3")){
+            assertTrue(rs.next());assertEquals(0,new BigDecimal("5").compareTo(rs.getBigDecimal(1)));assertEquals("cm",rs.getString(2));assertNull(rs.getBigDecimal(3));assertNull(rs.getString(4));
+        }
+    }
+    @Test void onlyCompleteBusinessMasterBatchesPublishedBeforeAsOfAreVisible()throws Exception{
+        sql("INSERT INTO ll_selfop_sync_task VALUES(1,'A','MASTER_DATA','ACCOUNT_DISCOVERY','BUSINESS'),(2,'A','BACKFILL','ACCOUNT_DISCOVERY','BUSINESS'),(3,'B','MASTER_DATA','ACCOUNT_DISCOVERY','BUSINESS')");
+        sql("INSERT INTO ll_selfop_sync_run VALUES(10,1,'A','BUSINESS','PUBLISHED','COMPLETE','2026-10-14 07:00:00'),(11,1,'A','BUSINESS','PUBLISHED','COMPLETE','2026-10-14 09:00:00'),(12,1,'A','BUSINESS','FETCHING','COMPLETE','2026-10-14 07:59:00'),(13,1,'A','BUSINESS','PUBLISHED','PARTIAL','2026-10-14 07:59:00'),(14,2,'A','BUSINESS','PUBLISHED','COMPLETE','2026-10-14 07:59:00'),(15,3,'B','BUSINESS','PUBLISHED','COMPLETE','2026-10-14 07:59:00')");
+        assertEquals(10L,mapper.publishedAt("A",now));assertEquals(11L,mapper.publishedAt("A",now.plusHours(2)));assertNull(mapper.publishedAt("A",now.minusHours(2)));assertEquals(15L,mapper.publishedAt("B",now));
+    }
+    @Test void failedPageTransactionRollsBackEveryRow(){
+        try(var transaction=factory.openSession(false)){
+            var writer=transaction.getMapper(SelfopMasterDataMapper.class);
+            writer.insertOwner(1,10,"A",new SelfopPayloads.Owner("C","客户","0"),now);
+            assertThrows(RuntimeException.class,()->writer.insertOwner(2,10,"A",new SelfopPayloads.Owner("C","重复","0"),now));
+            transaction.rollback();
+        }
+        assertEquals(0,mapper.ownerCount(10,"A"));
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/model/SelfopAnalyticsPropertiesBindingTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/model/SelfopAnalyticsPropertiesBindingTest.java
new file mode 100644
index 000000000..e9766ab97
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/model/SelfopAnalyticsPropertiesBindingTest.java
@@ -0,0 +1,38 @@
+package com.baiyue.lastleg.selfoperated.analytics.model;
+
+import org.junit.jupiter.api.Test;
+import org.springframework.boot.context.properties.bind.Bindable;
+import org.springframework.boot.context.properties.bind.BindException;
+import org.springframework.boot.context.properties.bind.Binder;
+import org.springframework.boot.env.YamlPropertySourceLoader;
+import org.springframework.core.env.MapPropertySource;
+import org.springframework.core.env.StandardEnvironment;
+import org.springframework.core.io.ClassPathResource;
+import java.util.Map;
+import static org.junit.jupiter.api.Assertions.*;
+
+class SelfopAnalyticsPropertiesBindingTest {
+    StandardEnvironment environment() throws Exception {
+        var env=new StandardEnvironment();
+        for(var source:new YamlPropertySourceLoader().load("application",new ClassPathResource("application.yml")))env.getPropertySources().addLast(source);
+        env.getPropertySources().addFirst(new MapPropertySource("runtime",Map.of(
+            "baiyue.self-operated-analytics.collection-mode","BUSINESS",
+            "baiyue.self-operated-analytics.environment","test",
+            "baiyue.self-operated-analytics.inventory-history-enabled",true)));
+        return env;
+    }
+    @Test void refreshingRunningBusinessBeanBindsHistoryFlagWithoutDerivedExecutionInput() throws Exception {
+        var config=new SelfopAnalyticsProperties();config.setCollectionMode("BUSINESS");
+        var env=environment();
+        assertNull(env.getProperty("baiyue.self-operated-analytics.execution-enabled"));
+        Binder.get(env).bind("baiyue.self-operated-analytics",Bindable.ofInstance(config));
+        assertTrue(config.isInventoryHistoryEnabled());assertTrue(config.isExecutionEnabled());
+        Binder.get(env).bind("baiyue.self-operated-analytics",Bindable.ofInstance(config));
+        assertTrue(config.isInventoryHistoryEnabled());assertTrue(config.isExecutionEnabled());
+    }
+    @Test void obsoleteFalseInputReproducesTheRefreshFailure() throws Exception {
+        var config=new SelfopAnalyticsProperties();config.setCollectionMode("BUSINESS");
+        var env=environment();env.getPropertySources().addFirst(new MapPropertySource("obsolete",Map.of("baiyue.self-operated-analytics.execution-enabled",false)));
+        assertThrows(BindException.class,()->Binder.get(env).bind("baiyue.self-operated-analytics",Bindable.ofInstance(config)));
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/model/SelfopFailureTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/model/SelfopFailureTest.java
new file mode 100644
index 000000000..bee2a7599
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/model/SelfopFailureTest.java
@@ -0,0 +1,51 @@
+package com.baiyue.lastleg.selfoperated.analytics.model;
+
+import java.sql.SQLException;
+import java.util.Map;
+import org.junit.jupiter.api.Test;
+import org.springframework.dao.CannotAcquireLockException;
+import static org.assertj.core.api.Assertions.*;
+import static com.baiyue.lastleg.selfoperated.analytics.model.SelfopSupport.*;
+
+class SelfopFailureTest {
+    @Test void wrappedDatabaseFailureRetainsDiagnosticsWithoutRawSqlOrCredentials() {
+        var failure=SelfopFailure.capture("SELFOP_EXECUTION_FAILED",true,
+            new CannotAcquireLockException("SQL customer=private token=secret",new SQLException("password=secret","40001",1213)));
+        assertThat(failure.code()).isEqualTo("SELFOP_DATABASE_TRANSIENT");assertThat(failure.outboundRetryable()).isTrue();
+        String stored=failure.stored("MERGE",1,3,true);
+        assertThat(stored).hasSizeLessThan(500).doesNotContain("private","secret","password","customer");
+        assertThat(SelfopFailure.publicSummary(failure.code(),stored)).contains("归并出库事实失败","SQLException","SQLState 40001","1213","第 1/3 次自动重试");
+    }
+    @Test void permanentDatabaseErrorsAndProviderProtectionDoNotRetry() {
+        var failure=SelfopFailure.capture("SELFOP_EXECUTION_FAILED",true,new RuntimeException("sql",new SQLException("bad syntax","42000",1064)));
+        assertThat(failure.code()).isEqualTo("SELFOP_DATABASE_FAILED");assertThat(failure.outboundRetryable()).isFalse();
+        var provider=SelfopFailure.capture("INTEGRATION_TRANSPORT_FAILURE",true,new RuntimeException("private response"));
+        assertThat(provider.outboundRetryable()).isFalse();
+        assertThat(SelfopFailure.publicSummary(provider.code(),provider.stored("DIRECTORY",1,3,false)))
+            .contains("响应结果未确认","不自动重试").doesNotContain("private");
+        assertThat(SelfopFailure.coded("LINGXING_WMS_SOURCE_REJECTED",true).outboundRetryable()).isTrue();
+        assertThat(SelfopFailure.coded("LINGXING_WMS_SOURCE_REJECTED",false).outboundRetryable()).isFalse();
+    }
+    @Test void diagnosticPhaseUsesOnlyCurrentAttemptCheckpoint() {
+        var task=new SelfopSyncTask();var run=new SelfopSyncRun();run.setAttemptNo(25);run.setStatus("FETCHING");
+        task.setProgressJson(json(Map.of("attemptNo",25,"phase","DETAIL")));
+        assertThat(SelfopFailure.phase(task,run)).isEqualTo("DETAIL");
+        task.setProgressJson(json(Map.of("attemptNo",24,"phase","PUBLISH")));
+        assertThat(SelfopFailure.phase(task,run)).isEqualTo("FETCHING");
+        task.setProgressJson("private invalid json");assertThat(SelfopFailure.phase(task,run)).isEqualTo("FETCHING");
+        var failure=SelfopFailure.coded("SELFOP_EXECUTION_FAILED",true).atPhase("PUBLISH");
+        assertThat(SelfopFailure.publicSummary(failure.code(),failure.stored("BUILD",1,3,true))).startsWith("发布统计结果失败");
+    }
+    @Test void readSideRejectsUnstructuredMessagesAndIgnoresExtraPayloadFields() {
+        assertThat(SelfopFailure.publicSummary("FAIL","token=secret")).doesNotContain("secret");
+        String stored=json(Map.of("v",1,"phase","PUBLISH","type","password=secret","sqlState","credential",
+            "failures",4,"maxRetries",3,"scheduled",false,"payload","secret"));
+        assertThat(SelfopFailure.publicSummary("FAIL",stored)).contains("发布统计结果失败","最多 3 次").doesNotContain("secret","credential","password");
+        assertThat(SelfopFailure.publicSummary("FAIL","x".repeat(501))).doesNotContain("xxx");
+    }
+    @Test void boundedCauseTraversalHandlesCyclesAndRetainsUnexpectedExceptionType() {
+        var a=new RuntimeException("secret");var b=new IllegalStateException("private");a.initCause(b);b.initCause(a);
+        var failure=SelfopFailure.capture("SELFOP_EXECUTION_FAILED",true,a);
+        assertThat(failure.exceptionType()).isEqualTo("IllegalStateException");assertThat(failure.outboundRetryable()).isTrue();
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/model/SelfopOutboundFingerprintTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/model/SelfopOutboundFingerprintTest.java
new file mode 100644
index 000000000..45364b688
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/model/SelfopOutboundFingerprintTest.java
@@ -0,0 +1,49 @@
+package com.baiyue.lastleg.selfoperated.analytics.model;
+
+import java.math.BigDecimal;
+import java.util.List;
+import org.junit.jupiter.api.Test;
+import static org.junit.jupiter.api.Assertions.*;
+
+class SelfopOutboundFingerprintTest {
+    private SelfopPayloads.Order order(BigDecimal quantity) {
+        return new SelfopPayloads.Order("source","owner","A","order",null,100,null,"2026-10-12 08:00:00",
+            List.of(new SelfopPayloads.Item("sku",null,quantity,"PCS")));
+    }
+    @Test void scaleNegativeScaleAndScientificNotationDoNotChangeOrderOrFactFingerprint() {
+        var baseline=order(new BigDecimal("1000"));
+        for(String representation:List.of("1000.000000","1E+3","1.0E+3","10E+2")) {
+            var equivalent=order(new BigDecimal(representation));
+            assertEquals(SelfopOutboundFingerprint.order(baseline),SelfopOutboundFingerprint.order(equivalent));
+            assertEquals(SelfopOutboundFingerprint.fact(baseline,"Asia/Shanghai","Asia/Shanghai","PCS"),
+                SelfopOutboundFingerprint.fact(equivalent,"Asia/Shanghai","Asia/Shanghai","PCS"));
+        }
+        assertEquals(SelfopOutboundFingerprint.order(order(new BigDecimal("1.2300"))),SelfopOutboundFingerprint.order(order(new BigDecimal("1.23"))));
+    }
+    @Test void reorderedJsonAndDecimalRepresentationRoundTripKeepSameFingerprint() {
+        var baseline=order(new BigDecimal("1000.000"));
+        String persisted="{\"items\":[{\"quantityUnit\":\"PCS\",\"actualQuantity\":1.0e3,\"productName\":null,\"skuCode\":\"sku\"}],"
+            +"\"sourceOutboundTime\":\"2026-10-12 08:00:00\",\"sourceCreatedTime\":null,\"sourceStatus\":100,\"sourceNo\":null,"
+            +"\"deliveryNo\":\"order\",\"warehouseCode\":\"A\",\"customerCode\":\"owner\",\"sourceAccount\":\"source\"}";
+        var loaded=SelfopSupport.read(persisted,SelfopPayloads.Order.class);
+        assertEquals(SelfopOutboundFingerprint.order(baseline),SelfopOutboundFingerprint.order(loaded));
+        assertNotEquals(SelfopSupport.hash(baseline),SelfopSupport.hash(loaded)); // generic hash remains unchanged
+    }
+    @Test void realQuantityChangesAndUnknownAreNotCollapsed() {
+        assertNotEquals(SelfopOutboundFingerprint.order(order(BigDecimal.ONE)),SelfopOutboundFingerprint.order(order(new BigDecimal("1.000001"))));
+        assertNotEquals(SelfopOutboundFingerprint.order(order(null)),SelfopOutboundFingerprint.order(order(BigDecimal.ZERO)));
+        assertEquals(SelfopOutboundFingerprint.order(order(new BigDecimal("0.000"))),SelfopOutboundFingerprint.order(order(BigDecimal.ZERO)));
+    }
+    @Test void identitiesTextNullAndRawItemOrderStaySensitive() {
+        var original=order(BigDecimal.ONE);
+        var changed=new SelfopPayloads.Order("source","other-owner","A","order",null,100,null,"2026-10-12 08:00:00",original.items());
+        assertNotEquals(SelfopOutboundFingerprint.order(original),SelfopOutboundFingerprint.order(changed));
+        var emptySourceNo=new SelfopPayloads.Order("source","owner","A","order","",100,null,"2026-10-12 08:00:00",original.items());
+        assertNotEquals(SelfopOutboundFingerprint.order(original),SelfopOutboundFingerprint.order(emptySourceNo));
+        var a=new SelfopPayloads.Item("a",null,BigDecimal.ONE,"PCS");var b=new SelfopPayloads.Item("b",null,BigDecimal.ONE,"PCS");
+        var ab=new SelfopPayloads.Order("source","owner","A","order",null,100,null,null,List.of(a,b));
+        var ba=new SelfopPayloads.Order("source","owner","A","order",null,100,null,null,List.of(b,a));
+        assertNotEquals(SelfopOutboundFingerprint.order(ab),SelfopOutboundFingerprint.order(ba));
+        assertNotEquals(SelfopOutboundFingerprint.fact(original,"Asia/Shanghai","UTC","PCS"),SelfopOutboundFingerprint.fact(original,"Asia/Shanghai","Asia/Shanghai","PCS"));
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/model/SelfopStageEstimateTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/model/SelfopStageEstimateTest.java
new file mode 100644
index 000000000..f568f0ef5
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/model/SelfopStageEstimateTest.java
@@ -0,0 +1,110 @@
+package com.baiyue.lastleg.selfoperated.analytics.model;
+
+import java.math.BigDecimal;
+import java.nio.charset.StandardCharsets;
+import java.time.Instant;
+import java.util.*;
+import org.junit.jupiter.api.Test;
+import static org.junit.jupiter.api.Assertions.*;
+import static com.baiyue.lastleg.selfoperated.analytics.model.SelfopSupport.*;
+
+class SelfopStageEstimateTest {
+    private final Instant start=Instant.parse("2026-10-13T00:00:00Z");
+    private Map<String,Object> progress(){
+        var p=new LinkedHashMap<String,Object>();p.put("taskNo","LXCOL-ETA");p.put("attemptNo",1);
+        p.put("phase","DETAIL");p.put("scanRound",1);p.put("progressScope","ACCOUNT_SHARED");
+        p.put("unit","ORDER");p.put("countBasis","TASK_CUMULATIVE");p.put("total",1000L);p.put("totalKnown",true);
+        p.put("sliceFrom","2026-10-12T00:00:00Z");p.put("sliceUntil","2026-10-13T00:00:00Z");return p;
+    }
+    private void commit(Map<String,Object> p,long seconds,long completed,boolean real){
+        p.put("completed",completed);SelfopStageEstimate.checkpoint(p,start.plusSeconds(seconds),real);
+    }
+    private Map<String,Object> ready(){var p=progress();for(int i=0;i<=3;i++)commit(p,i*20,1+i*20,true);return p;}
+    private SelfopStageEstimate.Estimate estimate(Map<String,Object> p,long second){return SelfopStageEstimate.estimate(p,start.plusSeconds(second),true,false,false);}
+    @Test void sufficientRealAdvancesEstimateCurrentStageAndIncludeIdleTime(){
+        var p=ready();var e=estimate(p,60);assertEquals("AVAILABLE",e.status());assertEquals(60L,e.completedDelta());
+        assertEquals(0,new BigDecimal("1").compareTo(e.ratePerSecond()));assertEquals(939L,e.remainingSeconds());
+        assertEquals(start,e.sampleFrom());assertEquals(start.plusSeconds(60),e.sampleUntil());assertEquals(start.plusSeconds(90),e.validUntil());
+        var idle=estimate(p,90);assertEquals("AVAILABLE",idle.status());assertEquals(new BigDecimal("0.666666"),idle.ratePerSecond());
+        assertEquals(1409L,idle.remainingSeconds());assertEquals("NO_RECENT_PROGRESS",estimate(p,120).unavailableReason());
+    }
+    @Test void shortOrInsufficientAdvanceWindowsNeverEstimate(){
+        var p=progress();commit(p,0,1,true);commit(p,20,2,true);commit(p,40,3,true);
+        assertEquals("SAMPLING",estimate(p,59).unavailableReason());assertEquals("SAMPLING",estimate(p,60).unavailableReason());
+        commit(p,60,4,true);assertEquals("AVAILABLE",estimate(p,60).status());
+    }
+    @Test void unchangedBookkeepingDoesNotRestartSamplingOrInventAnAdvance(){
+        var p=ready();commit(p,65,61,false);
+        var e=estimate(p,65);
+        assertEquals("AVAILABLE",e.status());assertEquals(start,e.sampleFrom());
+        assertEquals(60L,e.completedDelta());assertEquals(new BigDecimal("0.923076"),e.ratePerSecond());
+        commit(p,119,61,false);
+        assertEquals("NO_RECENT_PROGRESS",estimate(p,120).unavailableReason());
+    }
+    @Test void rollingWindowKeepsAValidityMarginAcrossTenSecondPollingBoundaries(){
+        var p=progress();p.put("total",100000L);
+        for(int second=0;second<=600;second++){
+            commit(p,second,second,true);
+            if(second>=80&&second%10==0){
+                var e=estimate(p,second);
+                assertEquals("AVAILABLE",e.status(),"second="+second);
+                assertEquals(start.plusSeconds(second+30),e.validUntil());
+                assertFalse(e.sampleFrom().isBefore(e.validUntil().minusSeconds(SelfopStageEstimate.WINDOW_SECONDS)));
+            }
+        }
+    }
+    @Test void reuseBeforeInsideAndAfterWindowRestartsBaselineInsteadOfInflatingRate(){
+        var p=progress();commit(p,0,500,false);commit(p,20,501,true);commit(p,40,502,true);commit(p,60,503,true);
+        assertEquals(3L,estimate(p,60).completedDelta());
+        commit(p,70,900,false);assertEquals("SAMPLING",estimate(p,70).unavailableReason());
+        commit(p,90,901,true);commit(p,110,902,true);commit(p,130,903,true);assertEquals(3L,estimate(p,130).completedDelta());
+        commit(p,400,950,false);assertEquals("SAMPLING",estimate(p,400).unavailableReason());
+    }
+    @Test void eachIdentityDimensionInvalidatesEarlierEstimateAndCheckpointRebuildsIt(){
+        for(String key:List.of("taskNo","attemptNo","phase","scanRound","progressScope","unit","countBasis","sliceFrom","sliceUntil","total")){
+            var p=ready();String old=SelfopStageEstimate.identity(p);
+            Object value=p.get(key);p.put(key,value instanceof Number?((Number)value).longValue()+1:"changed");
+            assertNotEquals(old,SelfopStageEstimate.identity(p));assertEquals("SAMPLING",estimate(p,61).unavailableReason());
+            commit(p,61,62,true);assertEquals("SAMPLING",estimate(p,61).unavailableReason());
+        }
+    }
+    @Test void pausedUnhealthyTerminalUnknownAndCompleteNeverReturnActiveNumbers(){
+        var p=ready();
+        var paused=SelfopStageEstimate.estimate(p,start.plusSeconds(60),true,true,false);assertEquals("PAUSED",paused.status());assertNull(paused.ratePerSecond());
+        var terminal=SelfopStageEstimate.estimate(p,start.plusSeconds(60),true,true,true);assertEquals("UNAVAILABLE",terminal.status());assertEquals("TERMINAL",terminal.unavailableReason());
+        assertEquals("HEALTH_UNCONFIRMED",SelfopStageEstimate.estimate(p,start.plusSeconds(60),false,false,false).unavailableReason());
+        p.put("totalKnown",false);assertEquals("TOTAL_UNKNOWN",estimate(p,60).unavailableReason());
+        p.put("totalKnown",true);p.put("completed",1000L);assertEquals("COUNT_COMPLETE",estimate(p,60).unavailableReason());
+        commit(p,61,1000,true);assertFalse(p.containsKey("etaSamples"));
+    }
+    @Test void zeroAndFullCountsNeverInferStageCompletionOrPublication(){
+        for(long total:List.of(0L,1000L)){
+            var p=progress();p.put("total",total);p.put("completed",total);p.put("stageFinishedAt",null);
+            var result=estimate(p,60);
+            assertEquals("UNAVAILABLE",result.status());assertEquals("COUNT_COMPLETE",result.unavailableReason());
+            assertNull(result.remainingSeconds());assertNull(result.ratePerSecond());assertNull(result.validUntil());
+            assertNull(p.get("stageFinishedAt"));assertFalse(p.containsKey("publishedAt"));
+            assertEquals("DETAIL",p.get("phase"));
+        }
+    }
+    @Test void bucketBoundaryHighFrequencyAndLongHistoryStayBounded(){
+        var p=progress();p.put("total",100000L);
+        for(int second=0;second<=1000;second++)commit(p,second,second,true);
+        var sample=(Map<?,?>)p.get("etaSamples");var points=(List<?>)sample.get("p");assertTrue(points.size()<=20);
+        assertTrue(json(sample).getBytes(StandardCharsets.UTF_8).length<=1024);assertEquals("AVAILABLE",estimate(p,1000).status());
+        long first=((Number)((List<?>)points.get(0)).get(0)).longValue();assertTrue(start.plusSeconds(1000).getEpochSecond()-first<=180);
+        var boundary=progress();commit(boundary,9,1,true);commit(boundary,10,2,true);
+        assertEquals(2,((List<?>)((Map<?,?>)boundary.get("etaSamples")).get("p")).size());
+    }
+    @Test void sixtySecondGapAndCounterRegressionRestartSampling(){
+        var p=ready();commit(p,120,62,true);assertEquals("SAMPLING",estimate(p,120).unavailableReason());
+        commit(p,140,1,true);assertEquals("SAMPLING",estimate(p,140).unavailableReason());
+    }
+    @Test void corruptFractionalOutOfOrderOrOversizedSamplesFailClosed(){
+        var p=ready();p.put("completed",new BigDecimal("61.5"));assertEquals("INVALID_PROGRESS",estimate(p,60).unavailableReason());
+        p=ready();var sample=new LinkedHashMap<>((Map<String,Object>)p.get("etaSamples"));
+        sample.put("p",List.of(List.of(start.getEpochSecond()+40,1L,0L),List.of(start.getEpochSecond()+20,2L,1L)));p.put("etaSamples",sample);
+        assertEquals("INVALID_SAMPLE",estimate(p,60).unavailableReason());
+        p=ready();var future=estimate(p,50);assertEquals("INVALID_PROGRESS",future.unavailableReason());
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/model/SelfopStockFingerprintTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/model/SelfopStockFingerprintTest.java
new file mode 100644
index 000000000..ec34e04b6
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/model/SelfopStockFingerprintTest.java
@@ -0,0 +1,23 @@
+package com.baiyue.lastleg.selfoperated.analytics.model;
+
+import java.math.BigDecimal;
+import org.junit.jupiter.api.Test;
+import static org.junit.jupiter.api.Assertions.*;
+
+class SelfopStockFingerprintTest {
+    private SelfopPayloads.Stock stock(String owner,String sku,BigDecimal quantity) {
+        return new SelfopPayloads.Stock("demo",owner,"warehouse",sku,0,"Name",quantity,quantity,quantity,quantity,"source-key");
+    }
+    @Test void equivalentNumbersAndJsonRoundTripHaveStableFingerprint() {
+        var original=stock("owner","sku",new BigDecimal("1E+2"));
+        var stored=SelfopSupport.read(SelfopSupport.json(stock("owner","sku",new BigDecimal("100.00"))),SelfopPayloads.Stock.class);
+        assertNotEquals(SelfopSupport.hash(original),SelfopSupport.hash(stored));
+        assertEquals(SelfopStockFingerprint.of(original),SelfopStockFingerprint.of(stored));
+        assertEquals(SelfopStockFingerprint.of(stock("owner","sku",new BigDecimal("0.000"))),SelfopStockFingerprint.of(stock("owner","sku",BigDecimal.ZERO)));
+    }
+    @Test void unknownZeroRealQuantityAndIdentityRemainDistinct() {
+        var base=stock("owner","sku",BigDecimal.ZERO);
+        for(var different:new SelfopPayloads.Stock[]{stock("owner","sku",null),stock("owner","sku",new BigDecimal("0.001")),stock("other","sku",BigDecimal.ZERO),stock("owner","other",BigDecimal.ZERO)})
+            assertNotEquals(SelfopStockFingerprint.of(base),SelfopStockFingerprint.of(different));
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/outbound/OutboundAggregateMapperTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/outbound/OutboundAggregateMapperTest.java
new file mode 100644
index 000000000..ce24d8b96
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/outbound/OutboundAggregateMapperTest.java
@@ -0,0 +1,183 @@
+package com.baiyue.lastleg.selfoperated.analytics.outbound;
+
+import com.baiyue.lastleg.selfoperated.analytics.model.*;
+import org.apache.ibatis.mapping.Environment;
+import org.apache.ibatis.session.*;
+import org.apache.ibatis.transaction.jdbc.JdbcTransactionFactory;
+import org.h2.jdbcx.JdbcDataSource;
+import org.junit.jupiter.api.*;
+import java.sql.*;
+import java.time.*;
+import java.util.*;
+import static org.junit.jupiter.api.Assertions.*;
+
+/** Actual mapper SQL against an offline synthetic database, not a mocked aggregate. */
+public class OutboundAggregateMapperTest {
+    JdbcDataSource data; SqlSessionFactory factory; SqlSession session; OutboundAggregateMapper mapper;
+    @BeforeEach void setup() throws Exception {
+        data=new JdbcDataSource(); data.setURL("jdbc:h2:mem:"+UUID.randomUUID()+";MODE=MySQL;DATABASE_TO_LOWER=TRUE;DB_CLOSE_DELAY=-1");
+        sql("CREATE TABLE ll_selfop_outbound_order (id BIGINT PRIMARY KEY,source_account VARCHAR(64),customer_code VARCHAR(64),warehouse_code VARCHAR(64),sales_eligible INT,outbound_at_utc TIMESTAMP,business_date DATE,source_timezone VARCHAR(64),business_timezone VARCHAR(64),last_observation_sequence BIGINT)");
+        sql("CREATE TABLE ll_selfop_outbound_item (id BIGINT PRIMARY KEY,order_id BIGINT,sku_code VARCHAR(128),product_name VARCHAR(255),quantity_unit VARCHAR(32),actual_quantity DECIMAL(20,6))");
+        sql("CREATE TABLE ll_selfop_sync_stage (id BIGINT PRIMARY KEY,run_id BIGINT,warehouse_code VARCHAR(64),object_type VARCHAR(32),validation_status VARCHAR(24),observation_sequence BIGINT,observed_at_utc TIMESTAMP)");
+        sql("CREATE INDEX idx_selfop_stage_fact_observation ON ll_selfop_sync_stage(observation_sequence,warehouse_code,object_type,validation_status,run_id,observed_at_utc)");
+        sql("CREATE TABLE ll_selfop_sync_run (id BIGINT PRIMARY KEY,source_account VARCHAR(64),task_id BIGINT,execution_purpose VARCHAR(24))");
+        sql("CREATE TABLE ll_selfop_sync_task (id BIGINT PRIMARY KEY,execution_purpose VARCHAR(24),validation_root_task_id BIGINT,task_role VARCHAR(32) DEFAULT 'WAREHOUSE_SYNC',scope_id BIGINT,scope_hash VARCHAR(64),apply_state VARCHAR(24),query_from_utc TIMESTAMP,query_until_utc TIMESTAMP,routing_manifest_json VARCHAR)");
+        sql("CREATE ALIAS JSON_EXTRACT FOR 'com.baiyue.lastleg.selfoperated.analytics.outbound.OutboundAggregateMapperTest.jsonExtract'");
+        sql("CREATE ALIAS JSON_UNQUOTE FOR 'com.baiyue.lastleg.selfoperated.analytics.outbound.OutboundAggregateMapperTest.jsonUnquote'");
+        sql("CREATE TABLE ll_selfop_sku_daily_sales (id BIGINT PRIMARY KEY,created_at TIMESTAMP,updated_at TIMESTAMP,sales_run_id BIGINT,source_account VARCHAR(64),customer_code VARCHAR(64),warehouse_code VARCHAR(64),sku_code VARCHAR(128),business_date DATE,outbound_quantity DECIMAL(20,6),outbound_order_count BIGINT,quantity_unit VARCHAR(32))");
+        sql("CREATE TABLE ll_selfop_sku_profile (id BIGINT PRIMARY KEY,created_at TIMESTAMP,updated_at TIMESTAMP,profile_run_id BIGINT,source_account VARCHAR(64),customer_code VARCHAR(64),warehouse_code VARCHAR(64),sku_code VARCHAR(128),product_name VARCHAR(255),quantity_unit VARCHAR(32),first_seen_at_utc TIMESTAMP,earliest_evidence_at_utc TIMESTAMP,evidence_type VARCHAR(24),evidence_run_id BIGINT,last_seen_run_id BIGINT)");
+        sql("CREATE TABLE ll_selfop_warehouse_daily_sales (sales_run_id BIGINT,source_account VARCHAR(64),warehouse_code VARCHAR(64),business_date DATE,observed_quantity DECIMAL(38,6),invalid_row_count BIGINT NOT NULL,source_row_count BIGINT NOT NULL,created_at TIMESTAMP,updated_at TIMESTAMP,PRIMARY KEY(sales_run_id,source_account,warehouse_code,business_date))");
+        Configuration config=new Configuration(new Environment("offline",new JdbcTransactionFactory(),data));
+        config.setMapUnderscoreToCamelCase(true); config.setLocalCacheScope(LocalCacheScope.STATEMENT); config.addMapper(OutboundAggregateMapper.class);
+        factory=new SqlSessionFactoryBuilder().build(config);session=factory.openSession(true); mapper=session.getMapper(OutboundAggregateMapper.class);
+    }
+    @AfterEach void close() { if(session!=null) session.close(); }
+    void sql(String query) throws Exception {try(Connection c=data.getConnection();Statement s=c.createStatement()){s.execute(query);}}
+    void order(long id,String account,String customer,String warehouse,String sku,int eligible,String time,int quantity) throws Exception {
+        sql("INSERT INTO ll_selfop_sync_task (id,execution_purpose,validation_root_task_id) VALUES ("+id+",'BUSINESS',NULL)");
+        sql("INSERT INTO ll_selfop_sync_run VALUES ("+id+",'"+account+"',"+id+",'BUSINESS')");
+        sql("INSERT INTO ll_selfop_sync_stage VALUES ("+id+","+id+",'"+warehouse+"','OUTBOUND_ORDER','VALID',"+id+",'2026-10-12 01:00:00')");
+        sql("INSERT INTO ll_selfop_outbound_order VALUES ("+id+",'"+account+"','"+customer+"','"+warehouse+"',"+eligible+",'"+time+"','2026-10-01','Asia/Shanghai','Asia/Shanghai',"+id+")");
+        sql("INSERT INTO ll_selfop_outbound_item VALUES ("+id+","+id+",'"+sku+"','item','PCS',"+quantity+")");
+    }
+    @Test void warehouseDailyAddsMultipleBatchesAndPreservesUnknownsAndFractionalQuantities() throws Exception {
+        var invalid=List.of(dailyRow(101,null,"PCS"),dailyRow(102,"-1","PCS"),dailyRow(103,"7","BOX"),dailyRow(104,"9",null));
+        mapper.insertDaily(invalid);mapper.insertWarehouseDaily(invalid);
+        assertWarehouse(null,4,4);
+        var first=List.of(dailyRow(105,"0.4","PCS"));mapper.insertDaily(first);mapper.insertWarehouseDaily(first);
+        var second=List.of(dailyRow(106,"0.4","PCS"));mapper.insertDaily(second);mapper.insertWarehouseDaily(second);
+        assertWarehouse("0.8",4,6);
+        assertEquals(6,mapper.warehouseDailySourceRows(900L,"demo","A"));assertEquals(0,mapper.warehouseDailySourceRows(900L,"demo","B"));
+        var moreInvalid=List.of(dailyRow(107,null,"PCS"));mapper.insertDaily(moreInvalid);mapper.insertWarehouseDaily(moreInvalid);
+        assertWarehouse("0.8",5,7);
+    }
+    @Test void nullOnlyBatchesRemainUnknownUntilValidZeroAppears() throws Exception {
+        for(long id:List.of(301L,302L)){var rows=List.of(dailyRow(id,null,"PCS"));mapper.insertDaily(rows);mapper.insertWarehouseDaily(rows);}
+        assertWarehouse(null,2,2);
+        var zero=List.of(dailyRow(303,"0","PCS"));mapper.insertDaily(zero);mapper.insertWarehouseDaily(zero);
+        assertWarehouse("0",2,3);
+        var invalid=List.of(dailyRow(304,"-1","PCS"));mapper.insertDaily(invalid);mapper.insertWarehouseDaily(invalid);
+        assertWarehouse("0",3,4);
+    }
+    @Test void failedBatchRollsBackBothTablesAndRetryCountsRowsOnce() throws Exception {
+        session.close();session=factory.openSession(false);mapper=session.getMapper(OutboundAggregateMapper.class);
+        var rows=List.of(dailyRow(201,"2.125","PCS"),dailyRow(202,null,"PCS"));
+        mapper.insertDaily(rows);mapper.insertWarehouseDaily(rows);session.rollback();
+        assertEquals(0,mapper.warehouseDailySourceRows(900L,"demo","A"));
+        mapper.insertDaily(rows);mapper.insertWarehouseDaily(rows);session.commit();
+        assertWarehouse("2.125",1,2);
+        assertThrows(RuntimeException.class,()->mapper.insertDaily(rows));session.rollback();
+        assertWarehouse("2.125",1,2);
+    }
+    private SelfopSkuDailySales dailyRow(long id,String quantity,String unit) {
+        var row=new SelfopSkuDailySales();row.setId(id);row.setSalesRunId(900L);row.setSourceAccount("demo");row.setWarehouseCode("A");
+        row.setCustomerCode("customer");row.setSkuCode("SKU-"+id);row.setBusinessDate(LocalDate.of(2026,10,1));
+        row.setOutboundQuantity(quantity==null?null:new java.math.BigDecimal(quantity));row.setQuantityUnit(unit);row.setOutboundOrderCount(1L);
+        row.setCreatedAt(LocalDateTime.of(2026,10,13,0,0));row.setUpdatedAt(row.getCreatedAt());return row;
+    }
+    private void assertWarehouse(String quantity,long invalid,long source) throws Exception {
+        try(var c=data.getConnection();var statement=c.createStatement();var result=statement.executeQuery("SELECT observed_quantity,invalid_row_count,source_row_count FROM ll_selfop_warehouse_daily_sales WHERE sales_run_id=900 AND source_account='demo' AND warehouse_code='A'")) {
+            assertTrue(result.next());if(quantity==null)assertNull(result.getBigDecimal(1));else assertEquals(0,new java.math.BigDecimal(quantity).compareTo(result.getBigDecimal(1)));
+            assertEquals(invalid,result.getLong(2));assertEquals(source,result.getLong(3));assertFalse(result.next());
+        }
+    }
+    @Test void aggregatesDistinctOwnersAndRetractsCancelledMigratedAndCorrectedEvidence() throws Exception {
+        order(1,"demo","C1","A","SKU",1,"2026-10-01 00:00:00",2);
+        order(2,"demo","C1","A","SKU",1,"2026-10-02 00:00:00",3);
+        order(3,"demo","C2","A","SKU",1,"2026-10-01 00:00:00",7);
+        order(4,"demo","C1","A","OLD",0,"2026-09-01 00:00:00",99);
+        order(5,"demo","C1","B","MOVED",1,"2026-09-01 00:00:00",99);
+        assertEquals(0,mapper.invalidFacts("demo","A","Asia/Shanghai","Asia/Shanghai","PCS"));
+        var daily=mapper.dailyBatch("demo","A",null,null,null); assertEquals(2,daily.size());
+        assertEquals(0,new java.math.BigDecimal("5").compareTo(daily.get(0).getOutboundQuantity())); assertEquals(2L,daily.get(0).getOutboundOrderCount());
+        var profiles=mapper.profileBatch("demo","A",null,null); assertEquals(2,profiles.size());
+        assertEquals(LocalDateTime.of(2026,10,1,0,0),profiles.get(0).getEarliestEvidenceAtUtc()); assertEquals(1L,profiles.get(0).getEvidenceRunId());
+        sql("UPDATE ll_selfop_outbound_order SET sales_eligible=0 WHERE id=1");
+        var corrected=mapper.profileBatch("demo","A",null,null); assertEquals(LocalDateTime.of(2026,10,2,0,0),corrected.get(0).getEarliestEvidenceAtUtc()); assertEquals(2L,corrected.get(0).getEvidenceRunId());
+        assertEquals(1,mapper.profileBatch("demo","A","C1","SKU").size());
+    }
+    @Test void validationEvidenceAndAccountSequenceCollisionAreFailClosed() throws Exception {
+        order(1,"demo","C1","A","SKU",1,"2026-10-01 00:00:00",2);
+        order(2,"other","C1","A","SKU",1,"2026-10-01 00:00:00",9);
+        sql("UPDATE ll_selfop_sync_stage SET observation_sequence=1 WHERE id=2");
+        assertEquals(0,mapper.invalidFacts("demo","A","Asia/Shanghai","Asia/Shanghai","PCS"));
+        sql("UPDATE ll_selfop_sync_run SET execution_purpose='VALIDATION' WHERE id=1");
+        assertEquals(1,mapper.invalidFacts("demo","A","Asia/Shanghai","Asia/Shanghai","PCS"));
+        assertTrue(mapper.profileBatch("demo","A",null,null).isEmpty());
+    }
+    @Test void indexedObservationJoinRequiresMatchingWarehouseTypeValidityAndAccount() throws Exception {
+        order(1,"demo","C1","A","SKU",1,"2026-10-01 00:00:00",2);
+        order(2,"other","C1","A","SKU",1,"2026-10-01 00:00:00",9);
+        sql("DELETE FROM ll_selfop_sync_stage WHERE id=1");
+        sql("UPDATE ll_selfop_sync_stage SET observation_sequence=1 WHERE id=2");
+        sql("INSERT INTO ll_selfop_sync_stage VALUES (3,1,'OTHER','OUTBOUND_ORDER','VALID',1,'2026-10-12 01:00:00'),"
+            +"(4,1,'A','PRODUCT_STOCK','VALID',1,'2026-10-12 01:00:00'),"
+            +"(5,1,'A','OUTBOUND_ORDER','INVALID',1,'2026-10-12 01:00:00')");
+        assertEquals(1,mapper.invalidFacts("demo","A","Asia/Shanghai","Asia/Shanghai","PCS"));
+        assertTrue(mapper.profileBatch("demo","A",null,null).isEmpty());
+        sql("INSERT INTO ll_selfop_sync_stage VALUES (6,1,'A','OUTBOUND_ORDER','VALID',1,'2026-10-12 02:00:00')");
+        assertEquals(0,mapper.invalidFacts("demo","A","Asia/Shanghai","Asia/Shanghai","PCS"));
+        var profiles=mapper.profileBatch("demo","A",null,null);assertEquals(1,profiles.size());
+        assertEquals(1L,profiles.get(0).getEvidenceRunId());assertEquals(1L,profiles.get(0).getLastSeenRunId());
+        assertEquals(LocalDateTime.of(2026,10,12,2,0),profiles.get(0).getFirstSeenAtUtc());
+    }
+    @Test void orderDrivenProfileBatchPreservesCursorAndIndependentEvidenceRanks() throws Exception {
+        order(1,"demo","C1","A","SKU-B",1,"2026-10-02 00:00:00",2);
+        order(2,"demo","C1","A","SKU-B",1,"2026-10-01 00:00:00",3);
+        order(3,"demo","C1","A","SKU-A",1,"2026-09-01 00:00:00",7);
+        order(4,"demo","C2","A","SKU-A",1,"2026-10-03 00:00:00",5);
+        order(5,"demo","C2","A","ROOTED",1,"2026-09-01 00:00:00",9);
+        order(6,"demo","C2","A","VALIDATION",1,"2026-09-01 00:00:00",9);
+        sql("UPDATE ll_selfop_sync_stage SET observed_at_utc='2026-10-13 01:00:00' WHERE id=1");
+        sql("UPDATE ll_selfop_sync_task SET validation_root_task_id=99 WHERE id=5");
+        sql("UPDATE ll_selfop_sync_task SET execution_purpose='VALIDATION' WHERE id=6");
+        var rows=mapper.profileBatch("demo","A","C1","SKU-A");
+        assertEquals(2,rows.size());
+        assertEquals("C1",rows.get(0).getCustomerCode());assertEquals("SKU-B",rows.get(0).getSkuCode());
+        assertEquals(2L,rows.get(0).getEvidenceRunId());assertEquals(1L,rows.get(0).getLastSeenRunId());
+        assertEquals(LocalDateTime.of(2026,10,12,1,0),rows.get(0).getFirstSeenAtUtc());
+        assertEquals(LocalDateTime.of(2026,10,1,0,0),rows.get(0).getEarliestEvidenceAtUtc());
+        assertEquals("C2",rows.get(1).getCustomerCode());assertEquals("SKU-A",rows.get(1).getSkuCode());
+        assertEquals(1,mapper.profileBatch("demo","A","C1","SKU-B").size());
+        // H2 verifies result semantics but ignores MySQL hints; root separately verifies EXPLAIN and SHOW WARNINGS.
+        var statement=session.getConfiguration().getMappedStatement(OutboundAggregateMapper.class.getName()+".profileBatch");
+        String bound=statement.getBoundSql(Map.of("account","demo","warehouse","A","customer","C1","sku","SKU-A")).getSql();
+        assertTrue(bound.contains("JOIN_ORDER(o,i,s,r,t) INDEX(s idx_selfop_stage_fact_observation)"));
+        assertTrue(bound.indexOf("JOIN_ORDER(")<bound.indexOf("FROM ll_selfop_outbound_order o"));
+    }
+    @Test void databaseResultPagesAndMultiRowInsertsAreBounded() throws Exception {
+        // Insert synthetic local orders without any provider I/O.
+        try(Connection c=data.getConnection();PreparedStatement statement=c.prepareStatement("INSERT INTO ll_selfop_outbound_order VALUES (?,'demo','C1','A',1,'2026-10-01 00:00:00','2026-10-01','Asia/Shanghai','Asia/Shanghai',?)");
+                PreparedStatement item=c.prepareStatement("INSERT INTO ll_selfop_outbound_item VALUES (?, ?, ?, 'item','PCS',1)")) {
+            for(long id=1;id<=501;id++) {statement.setLong(1,id); statement.setLong(2,id);statement.addBatch();item.setLong(1,id); item.setLong(2,id);item.setString(3,String.format("SKU%04d",id));item.addBatch();}
+            statement.executeBatch(); item.executeBatch();
+        }
+        var first=mapper.dailyBatch("demo","A",null,null,null); assertEquals(500,first.size());
+        var last=first.get(499); var second=mapper.dailyBatch("demo","A",last.getCustomerCode(),last.getSkuCode(),last.getBusinessDate());assertEquals(1,second.size());
+        long id=1; for(var row:first) {row.setId(id++);row.setSalesRunId(900L);row.setSourceAccount("demo");row.setWarehouseCode("A");row.setCreatedAt(LocalDateTime.now());row.setUpdatedAt(row.getCreatedAt());}
+        assertEquals(500,mapper.insertDaily(first));
+        try(Connection c=data.getConnection();ResultSet result=c.createStatement().executeQuery("SELECT COUNT(*) FROM ll_selfop_sku_daily_sales")){assertTrue(result.next());assertEquals(500,result.getLong(1));}
+    }
+    public static String jsonExtract(String value,String path) throws Exception {
+        if(value==null)return null;
+        return new com.fasterxml.jackson.databind.ObjectMapper().readTree(value).path("directoryComplete").asText();
+    }
+    public static String jsonUnquote(String value) {return value;}
+    @Test void firstManualCoverageRequiresMatchingScopeAppliedCompleteBusinessEvidence() throws Exception {
+        sql("INSERT INTO ll_selfop_sync_task (id,execution_purpose,scope_id,scope_hash,apply_state,query_from_utc,query_until_utc,routing_manifest_json) VALUES (1,'VALIDATION',1,'h','APPLIED','2026-10-01 00:00:00','2026-10-01 00:05:00','{\"directoryComplete\":true}'),(2,'BUSINESS',1,'h','NOT_STARTED','2026-10-02 00:00:00','2026-10-02 00:05:00','{\"directoryComplete\":true}'),(3,'BUSINESS',1,'h','APPLIED','2026-10-03 00:00:00','2026-10-03 00:05:00','{\"directoryComplete\":false}'),(4,'BUSINESS',2,'h','APPLIED','2026-10-04 00:00:00','2026-10-04 00:05:00','{\"directoryComplete\":true}'),(5,'BUSINESS',1,'old','APPLIED','2026-10-05 00:00:00','2026-10-05 00:05:00','{\"directoryComplete\":true}')");
+        sql("INSERT INTO ll_selfop_sync_task (id,execution_purpose,scope_id,scope_hash,apply_state,query_from_utc,query_until_utc,routing_manifest_json,task_role,validation_root_task_id) VALUES (7,'BUSINESS',1,'h','APPLIED','2026-10-01 00:00:00','2026-10-01 00:05:00','{\"directoryComplete\":true}','ACCOUNT_DISCOVERY',NULL),(8,'BUSINESS',1,'h','APPLIED','2026-10-01 00:00:00','2026-10-01 00:05:00','{\"directoryComplete\":true}','WAREHOUSE_SYNC',99)");
+        assertNull(mapper.firstProvenCoverageFrom(1L,"h"));
+        sql("INSERT INTO ll_selfop_sync_task (id,execution_purpose,scope_id,scope_hash,apply_state,query_from_utc,query_until_utc,routing_manifest_json) VALUES (6,'BUSINESS',1,'h','APPLIED','2026-10-10 01:00:00','2026-10-10 01:05:00','{\"directoryComplete\":true}')");
+        var start=mapper.firstProvenCoverageFrom(1L,"h");assertEquals(LocalDateTime.of(2026,10,10,1,0),start);
+        assertEquals(start.plusMinutes(5),mapper.contiguousCoverage(1L,"h",start,null,null).getCoveredUntilUtc());
+    }
+
+    @Test void databaseCoverageJoinsOverlapsAndStopsAtFirstUnprovedGap() throws Exception {
+        sql("INSERT INTO ll_selfop_sync_task (id,execution_purpose,scope_id,scope_hash,apply_state,query_from_utc,query_until_utc,routing_manifest_json) VALUES (1,'BUSINESS',1,'h','APPLIED','2026-10-01 00:00:00','2026-10-03 00:00:00','{\"directoryComplete\":true}'),(2,'BUSINESS',1,'h','APPLIED','2026-10-02 00:00:00','2026-10-04 00:00:00','{\"directoryComplete\":true}'),(3,'BUSINESS',1,'h','APPLIED','2026-10-05 00:00:00','2026-10-06 00:00:00','{\"directoryComplete\":true}'),(4,'VALIDATION',1,'h','APPLIED','2026-10-04 00:00:00','2026-10-05 00:00:00','{\"directoryComplete\":true}')");
+        var coverage=mapper.contiguousCoverage(1L,"h",LocalDateTime.of(2026,10,1,0,0),null,null);
+        assertEquals(LocalDateTime.of(2026,10,1,0,0),coverage.getCoveredFromUtc());
+        assertEquals(LocalDateTime.of(2026,10,4,0,0),coverage.getCoveredUntilUtc());
+        sql("UPDATE ll_selfop_sync_task SET execution_purpose='BUSINESS' WHERE id=4");
+        assertEquals(LocalDateTime.of(2026,10,6,0,0),mapper.contiguousCoverage(1L,"h",LocalDateTime.of(2026,10,1,0,0),null,null).getCoveredUntilUtc());
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/outbound/OutboundCandidateBuildMySqlAcceptanceTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/outbound/OutboundCandidateBuildMySqlAcceptanceTest.java
new file mode 100644
index 000000000..6fd4d095d
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/outbound/OutboundCandidateBuildMySqlAcceptanceTest.java
@@ -0,0 +1,225 @@
+package com.baiyue.lastleg.selfoperated.analytics.outbound;
+
+import com.baomidou.mybatisplus.core.MybatisConfiguration;
+import com.baomidou.mybatisplus.core.toolkit.IdWorker;
+import com.baomidou.mybatisplus.extension.spring.MybatisSqlSessionFactoryBean;
+import com.baiyue.lastleg.selfoperated.analytics.mapper.*;
+import com.baiyue.lastleg.selfoperated.analytics.model.*;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import org.aopalliance.intercept.MethodInterceptor;
+import org.apache.ibatis.executor.Executor;
+import org.apache.ibatis.logging.nologging.NoLoggingImpl;
+import org.apache.ibatis.mapping.MappedStatement;
+import org.apache.ibatis.plugin.*;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.condition.EnabledIfEnvironmentVariable;
+import org.mybatis.spring.SqlSessionTemplate;
+import org.springframework.aop.framework.ProxyFactory;
+import org.springframework.jdbc.core.JdbcTemplate;
+import org.springframework.jdbc.datasource.*;
+import org.springframework.transaction.annotation.AnnotationTransactionAttributeSource;
+import org.springframework.transaction.interceptor.TransactionInterceptor;
+import org.springframework.transaction.support.*;
+import java.math.BigDecimal;
+import java.nio.file.*;
+import java.time.*;
+import java.util.*;
+import static com.baiyue.lastleg.selfoperated.analytics.model.SelfopSupport.*;
+import static org.junit.jupiter.api.Assertions.*;
+
+/** Explicitly enabled TEST database harness. No Boot context, collector, HTTP client or publication service. */
+@EnabledIfEnvironmentVariable(named="SELFOP_TEST_MYSQL_CANDIDATE_BUILD",matches="true")
+class OutboundCandidateBuildMySqlAcceptanceTest {
+    private final Map<String,Object> report=new LinkedHashMap<>();
+    private final List<Map<String,Object>> commits=new ArrayList<>();
+    private final ObjectMapper jsonMapper=new ObjectMapper().findAndRegisterModules();
+    private final String token=UUID.randomUUID().toString().replace("-","");
+    private final String account="SELFOP-BUILD-"+token,warehouse="SYNTH-BUILD",owner="build-harness-"+token;
+    private JdbcTemplate jdbc;
+    private TransactionTemplate transactions;
+    private long scopeId,taskId,runId,originTask,originRun;
+    private Path output,progressFile;
+    private final TransactionEvidence transactionEvidence=new TransactionEvidence();
+
+    @Test void realCandidateBuildOnIndependentSyntheticFacts() throws Exception {
+        assertEquals("test",required("CHONGCHONG_ENV").toLowerCase(Locale.ROOT));
+        String label=required("SELFOP_BUILD_LABEL");assertTrue(label.matches("r[1-9][0-9]*"));
+        output=Path.of("target","selfop-candidate-build-"+label+".json");
+        progressFile=Path.of(output+".progress.json");
+        Path reservation=Path.of(output+".reserved"),started=Path.of(output+".started.json");
+        assertFalse(Files.exists(output));assertFalse(Files.exists(started));assertFalse(Files.exists(progressFile));
+        Files.writeString(reservation,"Reserved TEST candidate build acceptance\n",StandardOpenOption.CREATE_NEW);
+        int skus=bounded("SELFOP_BUILD_SKUS",10000,10000,100000);
+        int days=bounded("SELFOP_BUILD_DAYS",1,1,30);
+        assertTrue((long)skus*days<=1000000,"At most one million synthetic orders");
+        report.put("label",label);report.put("environment","TEST");report.put("synthetic",true);
+        report.put("skuCount",skus);report.put("days",days);report.put("sourceHttpCalls",0);
+        report.put("harnessConfiguredExternalRequestBudget",0);report.put("collectorAssembled",false);report.put("externalClientAssembled",false);
+        report.put("publishCalled",false);report.put("harnessConfiguredCollectionMode","OFF");
+        report.put("environmentCollectionModeAndAccountBudgetEvidence","ROOT_HTTP_BEFORE_AND_AFTER_REQUIRED");
+        report.put("sourceHttpCallsEvidence","NO_EXTERNAL_CLIENT_ASSEMBLED_IN_HARNESS");
+        report.put("transactions",commits);report.put("success",false);
+        report.put("syntheticAccount",account);
+        report.put("mappedStatementTimingMeaning","CLIENT_MYBATIS_EXECUTOR_CALL_INCLUDING_JDBC_AND_MAPPING_NOT_DATABASE_SERVER_TIME; BUILD_ONLY_EXCLUDES_SEED_AND_VERIFICATION");
+        try {
+            String host=required("CHONGCHONG_DB_HOST"),port=required("CHONGCHONG_DB_PORT");
+            assertTrue(host.matches("[A-Za-z0-9.-]+")&&port.matches("[0-9]{1,5}"));
+            var ds=new DriverManagerDataSource("jdbc:mysql://"+host+":"+port+"/baiyue_lastleg?useSSL=false&allowPublicKeyRetrieval=true&connectionTimeZone=UTC&forceConnectionTimeZoneToSession=true&characterEncoding=UTF-8&rewriteBatchedStatements=true&connectTimeout=10000&socketTimeout=120000",
+                required("CHONGCHONG_DB_USERNAME"),required("CHONGCHONG_DB_PASSWORD"));
+            ds.setDriverClassName("com.mysql.cj.jdbc.Driver");
+            try(var c=ds.getConnection()){assertEquals("MySQL",c.getMetaData().getDatabaseProductName());assertEquals(8,c.getMetaData().getDatabaseMajorVersion());}
+            jdbc=new JdbcTemplate(ds);var manager=new DataSourceTransactionManager(ds);transactions=new TransactionTemplate(manager);
+            var config=new MybatisConfiguration();config.setMapUnderscoreToCamelCase(true);config.setLogImpl(NoLoggingImpl.class);config.addInterceptor(transactionEvidence);
+            for(var type:List.of(OutboundLockMapper.class,OutboundAggregateMapper.class,SelfopSyncScopeMapper.class,SelfopSyncTaskMapper.class,
+                SelfopSyncRunMapper.class,SelfopSyncStageMapper.class,SelfopOutboundOrderMapper.class,SelfopOutboundItemMapper.class,
+                SelfopSkuDailySalesMapper.class,SelfopSkuProfileMapper.class))config.addMapper(type);
+            var factory=new MybatisSqlSessionFactoryBean();factory.setDataSource(ds);factory.setConfiguration(config);
+            var session=new SqlSessionTemplate(Objects.requireNonNull(factory.getObject()));
+            var locks=session.getMapper(OutboundLockMapper.class);var tasks=session.getMapper(SelfopSyncTaskMapper.class);
+            var runs=session.getMapper(SelfopSyncRunMapper.class);var scopes=session.getMapper(SelfopSyncScopeMapper.class);
+            var facts=new OutboundFactService(locks,tasks,runs,scopes,session.getMapper(SelfopSyncStageMapper.class),
+                session.getMapper(SelfopOutboundOrderMapper.class),session.getMapper(SelfopOutboundItemMapper.class));
+            var properties=new SelfopAnalyticsProperties();assertEquals("OFF",properties.getCollectionMode());assertFalse(properties.isExecutionEnabled());
+            // Lease remains bounded; no sleeps or artificial delays are used to manufacture build duration.
+            properties.setLeaseSeconds(600);
+            var target=new OutboundCandidateTransaction(locks,facts,runs,tasks,scopes,session.getMapper(SelfopSkuDailySalesMapper.class),
+                session.getMapper(SelfopSkuProfileMapper.class),session.getMapper(OutboundAggregateMapper.class),properties);
+            var proxy=new ProxyFactory(target);proxy.setProxyTargetClass(true);
+            proxy.addAdvice((MethodInterceptor)invocation->{
+                Instant start=Instant.now();long nanos=System.nanoTime();Object result=invocation.proceed();
+                assertFalse(TransactionSynchronizationManager.isActualTransactionActive(),"Facade must observe committed method transaction");
+                Map<String,Object> entry=new LinkedHashMap<>();entry.put("method",invocation.getMethod().getName());
+                entry.put("startedAt",start.toString());entry.put("committedAt",Instant.now().toString());entry.put("elapsedMs",(System.nanoTime()-nanos)/1000000);
+                if(result instanceof OutboundCandidateTransaction.Checkpoint cp){entry.put("phase",cp.phase());entry.put("dailyRows",cp.dailyRows());entry.put("profileRows",cp.profileRows());entry.put("committedBatches",cp.committedBatches());}
+                commits.add(entry);report.put("lastCommittedMethod",invocation.getMethod().getName());
+                report.put("phase",result instanceof OutboundCandidateTransaction.Checkpoint cp?cp.phase():"DONE");
+                writeProgress();return result;
+            });
+            proxy.addAdvice(new TransactionInterceptor(manager,new AnnotationTransactionAttributeSource()));
+            report.put("seedStart",Instant.now().toString());seed(skus,days);report.put("seedFinish",Instant.now().toString());
+            Object pointerBefore=jdbc.queryForMap("SELECT published_run_id,published_fact_revision FROM ll_selfop_sync_scope WHERE id=?",scopeId);
+            report.put("seedCompletedAt",Instant.now().toString());
+            Files.writeString(started,jsonMapper.writeValueAsString(Map.of("label",label,"seedComplete",true,"at",Instant.now().toString())),StandardOpenOption.CREATE_NEW);
+            Instant start=Instant.now();report.put("buildStartedAt",start.toString());
+            report.put("phase","BUILD_START");writeProgress();
+            transactionEvidence.active=true;
+            try {new OutboundCandidateBuilder((OutboundCandidateTransaction)proxy.getProxy()).build(scopeId,runId,owner,1L);}
+            finally {transactionEvidence.active=false;captureStatementMetrics();}
+            report.put("buildFinishedAt",Instant.now().toString());report.put("buildElapsedMs",Duration.between(start,Instant.now()).toMillis());
+            var saved=runs.selectById(runId);assertEquals("READY",saved.getStatus());assertNull(saved.getPublishedAtUtc());assertEquals("COMPLETE",saved.getCoverageStatus());
+            assertNotNull(saved.getCompleteDayFrom());assertNotNull(saved.getCompleteDayUntil());
+            assertEquals(days,java.time.temporal.ChronoUnit.DAYS.between(saved.getCompleteDayFrom(),saved.getCompleteDayUntil()));
+            var progress=read(tasks.selectById(taskId).getProgressJson(),Map.class);
+            var cp=read(json(progress.get("candidateBuild")),OutboundCandidateTransaction.Checkpoint.class);
+            assertEquals("DONE",cp.phase());assertEquals((long)skus*days,cp.dailyRows());assertEquals(skus,cp.profileRows());
+            assertEquals(cp.dailyRows(),count("ll_selfop_sku_daily_sales","sales_run_id",runId));
+            assertEquals(Boolean.TRUE,saved.getWarehouseDailyReady());
+            assertEquals(days,count("ll_selfop_warehouse_daily_sales","sales_run_id",runId));
+            assertEquals(cp.dailyRows(),jdbc.queryForObject("SELECT COALESCE(SUM(source_row_count),0) FROM ll_selfop_warehouse_daily_sales WHERE sales_run_id=?",Long.class,runId));
+            assertEquals(0L,jdbc.queryForObject("SELECT COALESCE(SUM(invalid_row_count),0) FROM ll_selfop_warehouse_daily_sales WHERE sales_run_id=?",Long.class,runId));
+            assertEquals(cp.profileRows(),count("ll_selfop_sku_profile","profile_run_id",runId));
+            assertEquals((skus*(long)days+499)/500+(skus+499)/500,cp.committedBatches());
+            assertEquals(pointerBefore,jdbc.queryForMap("SELECT published_run_id,published_fact_revision FROM ll_selfop_sync_scope WHERE id=?",scopeId));
+            assertEquals(0L,jdbc.queryForObject("SELECT COUNT(*) FROM ll_selfop_outbound_discovery_scope WHERE source_account=?",Long.class,account));
+            assertTrue(transactionEvidence.inserts>0);assertFalse(transactionEvidence.nonTransactional);
+            assertEquals((skus*(long)days+499)/500,transactionEvidence.warehouseDailyInserts,"Each committed daily batch must write one warehouse summary");
+            BigDecimal quantity=jdbc.queryForObject("SELECT SUM(outbound_quantity) FROM ll_selfop_sku_daily_sales WHERE sales_run_id=?",BigDecimal.class,runId);
+            assertEquals(0,BigDecimal.valueOf((long)skus*days).compareTo(quantity));
+            assertEquals(0,quantity.compareTo(jdbc.queryForObject("SELECT SUM(observed_quantity) FROM ll_selfop_warehouse_daily_sales WHERE sales_run_id=?",BigDecimal.class,runId)));
+            report.put("dailyRows",cp.dailyRows());report.put("profileRows",cp.profileRows());report.put("committedBatches",cp.committedBatches());
+            report.put("aggregateInsertStatements",transactionEvidence.inserts);report.put("allAggregateWritesTransactional",true);
+            report.put("publishedPointerUnchanged",true);report.put("publishedPointerInitiallyNull",true);report.put("candidateStatus",saved.getStatus());report.put("success",true);
+        } catch(Throwable failure) {
+            report.put("failureType",failure.getClass().getSimpleName()); // Never serialize SQL exceptions or credentials.
+            for(Throwable cause=failure;cause!=null;cause=cause.getCause()) {
+                if(cause instanceof java.sql.SQLException sqlFailure) {
+                    String state=sqlFailure.getSQLState();
+                    if(state!=null&&state.matches("[A-Z0-9]{5}"))report.put("sqlState",state);
+                    report.put("sqlVendorCode",sqlFailure.getErrorCode());break;
+                }
+            }
+            throw new AssertionError("Candidate build harness failed: "+failure.getClass().getSimpleName());
+        } finally {
+            captureStatementMetrics();
+            if(jdbc!=null&&taskId!=0) {
+                try { transactions.executeWithoutResult(s->{
+                    jdbc.update("UPDATE ll_selfop_sync_task SET status='DEAD',next_retry_at_utc=NULL WHERE id=? AND source_account=?",taskId,account);
+                    jdbc.update("UPDATE ll_selfop_sync_scope SET lease_owner=NULL,lease_until_utc=NULL WHERE id=? AND source_account=? AND lease_owner=?",scopeId,account,owner);
+                });report.put("draftDisabled",true); } catch(Exception ignored){report.put("draftDisabled",false);report.put("success",false);}
+            }
+            report.put("harnessState",Boolean.TRUE.equals(report.get("success"))?"FINISHED":"FAILED");writeProgress();
+            Files.writeString(output,jsonMapper.writerWithDefaultPrettyPrinter().writeValueAsString(report),StandardOpenOption.CREATE_NEW);
+            assertEquals(true,report.get("success"),"Inspect sanitized candidate build report");
+        }
+    }
+
+    private void seed(int skus,int days) {
+        scopeId=IdWorker.getId();taskId=IdWorker.getId();runId=IdWorker.getId();originTask=IdWorker.getId();originRun=IdWorker.getId();
+        report.put("scopeId",Long.toString(scopeId));report.put("taskId",Long.toString(taskId));report.put("runId",Long.toString(runId));
+        LocalDate until=LocalDate.now(ZoneId.of("Asia/Shanghai")),from=until.minusDays(days);
+        LocalDateTime now=utcNow().minusSeconds(1);String scopeJson=json(Map.of("quantityUnit","PCS","businessTimezone","Asia/Shanghai","sourceTimezone","Asia/Shanghai","fixtureOrigin","SYNTHETIC_BUILD_ACCEPTANCE"));String hash=hash(scopeJson);
+        transactions.executeWithoutResult(s->{
+            insert("ll_selfop_sync_scope",fields("id",scopeId,"created_at",now,"updated_at",now,"source_account",account,"warehouse_code",warehouse,"data_family","OUTBOUND","scope_json",scopeJson,"scope_hash",hash,"business_timezone","Asia/Shanghai","source_timezone","Asia/Shanghai","schedule_cron","0 0 0 1 1 *","stale_after_seconds",93600,"review_request_budget",1,"review_time_budget_seconds",1,"review_target_days",7,"fact_revision",1,"published_fact_revision",0,"fence_token",1,"lease_owner",owner,"lease_until_utc",utcNow().plusHours(1)));
+            for(long id:List.of(originTask,taskId))insert("ll_selfop_sync_task",fields("id",id,"created_at",now,"updated_at",now,"task_no","SYNTH-BUILD-"+id,"execution_purpose","BUSINESS","source_account",account,"warehouse_code",warehouse,"task_role","WAREHOUSE_SYNC","scope_id",scopeId,"request_key","build-"+id,"request_hash",hash,"task_type","REBUILD","query_scope_json",scopeJson,"scope_hash",hash,"status",id==taskId?"RUNNING":"SUCCEEDED","apply_state","APPLIED","apply_completed_at_utc",now,"attempt_count",1,"query_from_utc",utc(from),"query_until_utc",utc(until),"routing_manifest_json","{\"directoryComplete\":true}"));
+            for(long id:List.of(originRun,runId))insert("ll_selfop_sync_run",fields("id",id,"created_at",now,"updated_at",now,"task_id",id==runId?taskId:originTask,"execution_purpose","BUSINESS","scope_id",scopeId,"source_account",account,"warehouse_code",warehouse,"run_role","WAREHOUSE_SYNC","attempt_no",1,"scope_hash",hash,"scope_snapshot_json",scopeJson,"fence_token",1,"status","FACTS_APPLIED","last_phase","BUILD","coverage_status","UNKNOWN"));
+        });
+        for(int offset=0;offset<skus*days;offset+=500) {
+            List<Map<String,Object>> orders=new ArrayList<>(),items=new ArrayList<>(),stages=new ArrayList<>();
+            for(int n=offset;n<Math.min(offset+500,skus*days);n++) {
+                String sku=String.format(Locale.ROOT,"SKU-%06d",n%skus),customer=String.format(Locale.ROOT,"OWNER-%03d",n%skus%100),delivery="ORDER-"+n;
+                LocalDate date=from.plusDays(n/skus);long order=IdWorker.getId(),stage=IdWorker.getId();
+                var payload=new SelfopPayloads.Order(account,customer,warehouse,delivery,null,100,null,date+" 12:00:00",List.of(new SelfopPayloads.Item(sku,"Synthetic candidate build",BigDecimal.ONE,"PCS")));
+                String content=json(payload),digest=hash(content);
+                orders.add(fields("id",order,"created_at",now,"updated_at",now,"source_account",account,"customer_code",customer,"warehouse_code",warehouse,"delivery_no",delivery,"source_status",100,"source_outbound_time",payload.sourceOutboundTime(),"source_timezone","Asia/Shanghai","outbound_at_utc",utc(date).plusHours(12),"business_date",date,"business_timezone","Asia/Shanghai","sales_eligible",1,"revision_no",1,"content_hash",digest,"last_run_id",originRun,"last_observation_sequence",stage));
+                items.add(fields("id",IdWorker.getId(),"created_at",now,"updated_at",now,"order_id",order,"sku_code",sku,"product_name","Synthetic candidate build","actual_quantity",BigDecimal.ONE,"quantity_unit","PCS"));
+                stages.add(fields("id",stage,"created_at",now,"updated_at",now,"run_id",originRun,"stage_batch_id",originTask,"last_fetch_run_id",originRun,"observation_sequence",stage,"warehouse_code",warehouse,"object_type","OUTBOUND_ORDER","object_key_hash",hash(account+"|"+customer+"|"+delivery),"first_page_no",1,"observed_at_utc",now,"content_hash",digest,"payload_json",content,"validation_status","VALID"));
+            }
+            transactions.executeWithoutResult(s->{batch("ll_selfop_sync_stage",stages);batch("ll_selfop_outbound_order",orders);batch("ll_selfop_outbound_item",items);});
+        }
+        // Seeding can take time; acquire a fresh fixture-only lease immediately before the real build.
+        jdbc.update("UPDATE ll_selfop_sync_scope SET lease_until_utc=? WHERE id=? AND source_account=? AND lease_owner=?",utcNow().plusMinutes(10),scopeId,account,owner);
+    }
+    private void insert(String table,Map<String,Object> row){jdbc.update(insertSql(table,row),row.values().toArray());}
+    private void batch(String table,List<Map<String,Object>> rows){jdbc.batchUpdate(insertSql(table,rows.get(0)),rows.stream().map(r->r.values().toArray()).toList());}
+    private static String insertSql(String table,Map<String,Object> row){return "INSERT INTO "+table+" ("+String.join(",",row.keySet())+") VALUES ("+String.join(",",Collections.nCopies(row.size(),"?"))+")";}
+    private static Map<String,Object> fields(Object... pairs){var result=new LinkedHashMap<String,Object>();for(int i=0;i<pairs.length;i+=2)result.put((String)pairs[i],pairs[i+1]);return result;}
+    private long count(String table,String field,long id){return jdbc.queryForObject("SELECT COUNT(*) FROM "+table+" WHERE "+field+"=?",Long.class,id);}
+    private static LocalDateTime utc(LocalDate date){return date.atStartOfDay(ZoneId.of("Asia/Shanghai")).withZoneSameInstant(ZoneOffset.UTC).toLocalDateTime();}
+    private static String required(String name){String v=System.getenv(name);if(v==null||v.isBlank())throw new IllegalStateException("Missing TEST harness variable: "+name);return v;}
+    private static int bounded(String key,int fallback,int min,int max){String value=System.getenv(key);int n=value==null?fallback:Integer.parseInt(value);assertTrue(n>=min&&n<=max,key+" outside bounded range");return n;}
+    private void captureStatementMetrics(){
+        report.put("buildMappedStatementCalls",transactionEvidence.calls);
+        report.put("warehouseDailyInsertStatements",transactionEvidence.warehouseDailyInserts);
+        report.put("buildMappedStatements",transactionEvidence.snapshot());
+    }
+    private void writeProgress()throws java.io.IOException {
+        captureStatementMetrics();report.put("progressUpdatedAt",Instant.now().toString());
+        Path temporary=Path.of(progressFile+".tmp");
+        Files.writeString(temporary,jsonMapper.writerWithDefaultPrettyPrinter().writeValueAsString(report),StandardOpenOption.CREATE_NEW);
+        try {Files.move(temporary,progressFile,StandardCopyOption.ATOMIC_MOVE,StandardCopyOption.REPLACE_EXISTING);}
+        catch(AtomicMoveNotSupportedException unsupported){Files.move(temporary,progressFile,StandardCopyOption.REPLACE_EXISTING);}
+    }
+    @Intercepts({@Signature(type=Executor.class,method="update",args={MappedStatement.class,Object.class}),
+        @Signature(type=Executor.class,method="query",args={MappedStatement.class,Object.class,org.apache.ibatis.session.RowBounds.class,org.apache.ibatis.session.ResultHandler.class})})
+    public static class TransactionEvidence implements Interceptor {
+        long inserts,warehouseDailyInserts,calls;boolean nonTransactional,active;
+        private final Map<String,long[]> metrics=new LinkedHashMap<>();
+        Map<String,Object> snapshot(){
+            Map<String,Object> result=new LinkedHashMap<>();metrics.forEach((id,m)->result.put(id,Map.of("calls",m[0],"failedCalls",m[1],"totalClientElapsedMs",m[2]/1000000.0,"maxClientElapsedMs",m[3]/1000000.0)));
+            return result;
+        }
+        @Override public Object intercept(Invocation invocation)throws Throwable {
+            if(!active)return invocation.proceed();
+            String id=((MappedStatement)invocation.getArgs()[0]).getId();
+            boolean warehouseDaily=id.equals(OutboundAggregateMapper.class.getName()+".insertWarehouseDaily");
+            if(warehouseDaily||id.equals(OutboundAggregateMapper.class.getName()+".insertDaily")||id.equals(OutboundAggregateMapper.class.getName()+".insertProfiles")) {
+                inserts++;if(warehouseDaily)warehouseDailyInserts++;
+                nonTransactional|=!TransactionSynchronizationManager.isActualTransactionActive();
+            }
+            long start=System.nanoTime();boolean succeeded=false;calls++;
+            try {Object value=invocation.proceed();succeeded=true;return value;}
+            finally {long elapsed=System.nanoTime()-start;long[] metric=metrics.computeIfAbsent(id,key->new long[4]);
+                metric[0]++;if(!succeeded)metric[1]++;metric[2]+=elapsed;metric[3]=Math.max(metric[3],elapsed);}
+        }
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/outbound/OutboundCandidateBuilderTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/outbound/OutboundCandidateBuilderTest.java
new file mode 100644
index 000000000..b1003ff90
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/outbound/OutboundCandidateBuilderTest.java
@@ -0,0 +1,195 @@
+package com.baiyue.lastleg.selfoperated.analytics.outbound;
+
+import com.baiyue.lastleg.selfoperated.analytics.mapper.*;
+import com.baiyue.lastleg.selfoperated.analytics.model.*;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import java.time.*;
+import java.util.*;
+import static org.mockito.Mockito.*;
+import static org.junit.jupiter.api.Assertions.*;
+
+class OutboundCandidateBuilderTest {
+    @Test void disconnectedCompleteDayIsFrozenWithoutFillingGapOrChangingAnchor(){
+        var first=island(7);var latest=island(12);scope.setInitialFromUtc(first.getCoveredFromUtc());
+        task.setQueryFromUtc(latest.getCoveredFromUtc());task.setQueryUntilUtc(latest.getCoveredUntilUtc());
+        when(aggregates.contiguousCoverage(1L,"scope",scope.getInitialFromUtc(),null,null)).thenReturn(first);
+        when(aggregates.provenCoverageIslands(1L,"scope")).thenReturn(List.of(first,latest));
+        builder.build(1L,10L,"worker",2);
+        var proof=SelfopSalesCoverage.evidence(run);
+        assertTrue(SelfopSalesCoverage.contains(proof,latest.getCoveredFromUtc(),latest.getCoveredUntilUtc()));
+        assertFalse(SelfopSalesCoverage.contains(proof,first.getCoveredFromUtc(),latest.getCoveredUntilUtc()));
+        assertEquals(first.getCoveredUntilUtc(),run.getCoveredUntilUtc());assertEquals(first.getCoveredFromUtc(),scope.getInitialFromUtc());
+        var frozen=run.getScopeSnapshotJson();when(aggregates.provenCoverageIslands(1L,"scope")).thenReturn(List.of(first,latest,island(14)));
+        assertEquals(frozen,run.getScopeSnapshotJson());
+        assertFalse(SelfopSalesCoverage.contains(SelfopSalesCoverage.evidence(run),island(14).getCoveredFromUtc(),island(14).getCoveredUntilUtc()));
+    }
+    @Test void disconnectedZeroSalesDayForcesNewCandidateEvenWithUnchangedRevisionAndContinuousWatermark(){
+        var first=island(7);var latest=island(12);scope.setInitialFromUtc(first.getCoveredFromUtc());
+        scope.setPublishedRunId(9L);scope.setPublishedFactRevision(5L);
+        var published=new SelfopSyncRun();published.setId(9L);published.setScopeId(1L);published.setScopeHash("scope");
+        published.setStatus("PUBLISHED");published.setExecutionPurpose("BUSINESS");published.setCalculatedFactRevision(5L);
+        published.setWarehouseDailyReady(true);published.setBuildStartedAtUtc(SelfopSupport.utcNow().minusHours(1));
+        published.setCoveredFromUtc(first.getCoveredFromUtc());published.setCoveredUntilUtc(first.getCoveredUntilUtc());published.setScopeSnapshotJson(scope.getScopeJson());
+        SelfopSalesCoverage.freeze(published,List.of(new SelfopSalesCoverage.Interval(first.getCoveredFromUtc(),first.getCoveredUntilUtc())));
+        when(runs.selectById(9L)).thenReturn(published);
+        when(aggregates.contiguousCoverage(1L,"scope",scope.getInitialFromUtc(),null,null)).thenReturn(first);
+        when(aggregates.provenCoverageIslands(1L,"scope")).thenReturn(List.of(first,latest));
+        assertNull(builder.reusable(1L,10L,"worker",2));
+        assertEquals(1,SelfopSalesCoverage.evidence(published).intervals().size());
+    }
+    private SelfopSyncRun island(int day){
+        var r=new SelfopSyncRun();r.setCoveredFromUtc(LocalDateTime.of(2026,10,day,0,0).minusHours(8));r.setCoveredUntilUtc(r.getCoveredFromUtc().plusDays(1));return r;
+    }
+    @Test void fillingMiddleDaysMergesFrozenProofAndResumedBuildDoesNotReadLaterProof(){
+        var merged=island(7);merged.setCoveredUntilUtc(island(12).getCoveredUntilUtc());scope.setInitialFromUtc(merged.getCoveredFromUtc());
+        when(aggregates.contiguousCoverage(1L,"scope",scope.getInitialFromUtc(),null,null)).thenReturn(merged);
+        when(aggregates.provenCoverageIslands(1L,"scope")).thenReturn(List.of(merged));
+        var checkpoint=transaction.begin(1L,10L,"worker",2);var frozen=run.getScopeSnapshotJson();
+        when(aggregates.provenCoverageIslands(1L,"scope")).thenReturn(List.of(merged,island(14)));
+        assertEquals(checkpoint,transaction.begin(1L,10L,"worker",2));assertEquals(frozen,run.getScopeSnapshotJson());
+        assertTrue(SelfopSalesCoverage.contains(SelfopSalesCoverage.evidence(run),merged.getCoveredFromUtc(),merged.getCoveredUntilUtc()));
+        verify(aggregates,times(1)).provenCoverageIslands(1L,"scope");
+    }
+    final OutboundLockMapper locks=mock(OutboundLockMapper.class);
+    final OutboundFactService facts=mock(OutboundFactService.class);
+    final SelfopSyncRunMapper runs=mock(SelfopSyncRunMapper.class);
+    final SelfopSyncTaskMapper tasks=mock(SelfopSyncTaskMapper.class);
+    final SelfopSkuDailySalesMapper daily=mock(SelfopSkuDailySalesMapper.class);
+    final SelfopSkuProfileMapper profiles=mock(SelfopSkuProfileMapper.class);
+    final OutboundAggregateMapper aggregates=mock(OutboundAggregateMapper.class);
+    final SelfopSyncScopeMapper scopes=mock(SelfopSyncScopeMapper.class);
+    final OutboundCandidateTransaction transaction=new OutboundCandidateTransaction(locks,facts,runs,tasks,scopes,daily,profiles,aggregates,new SelfopAnalyticsProperties());
+    final OutboundCandidateBuilder builder=new OutboundCandidateBuilder(transaction);
+    SelfopSyncScope scope; SelfopSyncRun run; SelfopSyncTask task;
+    @BeforeEach void setup() {
+        scope=new SelfopSyncScope(); scope.setId(1L); scope.setSourceAccount("demo"); scope.setWarehouseCode("A"); scope.setDataFamily("OUTBOUND");
+        scope.setScopeHash("scope"); scope.setLeaseOwner("worker"); scope.setFenceToken(2L); scope.setLeaseUntilUtc(SelfopSupport.utcNow().plusHours(1));
+        scope.setFactRevision(5L); scope.setSourceTimezone("Asia/Shanghai"); scope.setBusinessTimezone("Asia/Shanghai"); scope.setScopeJson("{\"quantityUnit\":\"PCS\"}");
+        scope.setInitialFromUtc(LocalDateTime.of(2026,9,12,0,0));
+        run=new SelfopSyncRun(); run.setId(10L); run.setScopeId(1L); run.setTaskId(20L); run.setScopeHash("scope");
+        run.setExecutionPurpose("BUSINESS"); run.setScopeSnapshotJson(scope.getScopeJson());
+        run.setAttemptNo(1);
+        run.setFenceToken(2L); run.setRunRole("WAREHOUSE_SYNC"); run.setStatus("FACTS_APPLIED");
+        task=new SelfopSyncTask(); task.setId(20L); task.setExecutionPurpose("BUSINESS"); task.setApplyState("APPLIED");
+        task.setScopeId(1L);task.setSourceAccount("demo");task.setWarehouseCode("A");task.setScopeHash("scope");
+        task.setQueryFromUtc(scope.getInitialFromUtc()); task.setQueryUntilUtc(LocalDateTime.of(2026,10,12,0,0));
+        SelfopRoutingManifest manifest=new SelfopRoutingManifest(); manifest.setDirectoryComplete(true); task.setRoutingManifestJson(SelfopSupport.json(manifest));
+        when(locks.scope(1L)).thenReturn(scope); when(locks.run(10L)).thenReturn(run); when(locks.task(20L)).thenReturn(task);
+        SelfopSyncRun coverage=new SelfopSyncRun();coverage.setCoveredFromUtc(task.getQueryFromUtc());coverage.setCoveredUntilUtc(task.getQueryUntilUtc());
+        when(aggregates.contiguousCoverage(1L,"scope",scope.getInitialFromUtc(),null,null)).thenReturn(coverage);
+        when(aggregates.provenCoverageIslands(1L,"scope")).thenReturn(List.of(coverage));
+    }
+    @Test void manualFirstSliceUsesOnlyProvenIntervalWithoutInventingFullDays() {
+        scope.setInitialFromUtc(null);
+        var start=LocalDateTime.of(2026,10,9,17,0); var end=start.plusMinutes(5);
+        when(aggregates.firstProvenCoverageFrom(1L,"scope")).thenReturn(start);
+        var coverage=new SelfopSyncRun();coverage.setCoveredFromUtc(start);coverage.setCoveredUntilUtc(end);
+        when(aggregates.contiguousCoverage(1L,"scope",start,null,null)).thenReturn(coverage);
+        builder.build(1L,10L,"worker",2);
+        assertEquals(start,run.getCoveredFromUtc());assertEquals(end,run.getCoveredUntilUtc());
+        assertEquals("COMPLETE",run.getCoverageStatus());assertNull(scope.getInitialFromUtc());
+        assertTrue(run.getCompleteDayFrom()==null || !run.getCompleteDayFrom().isBefore(run.getCompleteDayUntil()));
+    }
+    @Test void missingProvenSliceCannotInventCoverage() {
+        scope.setInitialFromUtc(null);builder.build(1L,10L,"worker",2);
+        assertEquals("UNKNOWN",run.getCoverageStatus());assertNull(run.getCoveredFromUtc());assertNull(run.getCoveredUntilUtc());
+        verify(aggregates,never()).contiguousCoverage(any(),any(),any(),any(),any());
+    }
+    @Test void existingPlannedAnchorCannotMoveForwardPastMissingHistory() {
+        when(aggregates.contiguousCoverage(1L,"scope",scope.getInitialFromUtc(),null,null)).thenReturn(null);
+        builder.build(1L,10L,"worker",2);
+        assertEquals("UNKNOWN",run.getCoverageStatus());assertNull(run.getCoveredUntilUtc());
+        verify(aggregates,never()).firstProvenCoverageFrom(any(),any());
+    }
+
+    @Test void fullRebuildWithNoCurrentFactsRetractsAllRemovedEvidence() {
+        builder.build(1L,10L,"worker",2);
+        verify(profiles).delete(any()); verify(aggregates,never()).insertProfiles(any());
+        verify(aggregates,never()).insertDaily(any()); verify(facts,atLeastOnce()).assertNoBarrier(scope);
+        assertEquals(5L,run.getCalculatedFactRevision()); assertEquals("READY",run.getStatus());assertEquals(Boolean.TRUE,run.getWarehouseDailyReady());
+        verify(aggregates).warehouseDailySourceRows(10L,"demo","A");
+        assertNotNull(run.getBuildStartedAtUtc()); assertEquals(LocalDate.of(2026,9,13),run.getCompleteDayFrom());
+        assertEquals(LocalDate.of(2026,10,12),run.getCompleteDayUntil()); assertNull(scope.getPublishedRunId());
+    }
+    @Test void pagesAreKeysetBoundedAndWrittenInBulk() {
+        List<SelfopSkuDailySales> rows=new ArrayList<>();
+        for(int n=0;n<500;n++) { SelfopSkuDailySales row=new SelfopSkuDailySales(); row.setCustomerCode("c"); row.setSkuCode(String.format("%03d",n)); row.setBusinessDate(LocalDate.of(2026,10,1)); rows.add(row); }
+        SelfopSkuDailySales tail=new SelfopSkuDailySales(); tail.setCustomerCode("c"); tail.setSkuCode("500"); tail.setBusinessDate(LocalDate.of(2026,10,1));
+        when(aggregates.dailyBatch("demo","A",null,null,null)).thenReturn(rows);
+        when(aggregates.dailyBatch("demo","A","c","499",tail.getBusinessDate())).thenReturn(List.of(tail));
+        when(aggregates.dailyBatch("demo","A","c","500",tail.getBusinessDate())).thenReturn(List.of());
+        when(daily.selectCount(any())).thenReturn(501L);when(aggregates.warehouseDailySourceRows(10L,"demo","A")).thenReturn(501L);
+        builder.build(1L,10L,"worker",2);
+        verify(aggregates).insertDaily(rows); verify(aggregates).insertDaily(List.of(tail));
+        verify(aggregates).insertWarehouseDaily(rows);verify(aggregates).insertWarehouseDaily(List.of(tail));
+        verify(daily,never()).insert(any(SelfopSkuDailySales.class));
+        assertTrue(rows.stream().allMatch(r->r.getSalesRunId().equals(10L) && r.getId()!=null));
+    }
+    @Test void unchangedFactsButAdvancedCoverageCannotReuseZeroSales() {
+        scope.setPublishedRunId(9L); scope.setPublishedFactRevision(5L);
+        SelfopSyncRun published=new SelfopSyncRun(); published.setId(9L); published.setScopeId(1L); published.setScopeHash("scope");
+        published.setWarehouseDailyReady(true);published.setStatus("PUBLISHED"); published.setExecutionPurpose("BUSINESS"); published.setCalculatedFactRevision(5L);
+        published.setBuildStartedAtUtc(SelfopSupport.utcNow().minusHours(1));
+        published.setScopeSnapshotJson(scope.getScopeJson()); published.setCoveredFromUtc(scope.getInitialFromUtc());
+        SelfopSalesCoverage.freeze(published,List.of(new SelfopSalesCoverage.Interval(task.getQueryFromUtc(),task.getQueryUntilUtc())));
+        published.setCoveredUntilUtc(task.getQueryUntilUtc().minusDays(1)); when(runs.selectById(9L)).thenReturn(published);
+        assertNull(builder.reusable(1L,10L,"worker",2));
+        published.setCoveredUntilUtc(task.getQueryUntilUtc()); assertEquals(9L,builder.reusable(1L,10L,"worker",2));
+        verifyNoInteractions(daily,profiles);
+    }
+    @Test void validationBuildAndInvalidEvidenceFailBeforeDeletingCandidate() {
+        run.setExecutionPurpose("VALIDATION"); assertThrows(IllegalStateException.class,()->builder.build(1L,10L,"worker",2));
+        run.setExecutionPurpose("BUSINESS"); when(aggregates.invalidFacts(anyString(),anyString(),anyString(),anyString(),anyString())).thenReturn(1L);
+        assertThrows(IllegalStateException.class,()->builder.build(1L,10L,"worker",2)); verifyNoInteractions(daily,profiles);
+    }
+    @Test void partialBatchCommitsCheckpointAndRevisionChangePreventsReady() {
+        transaction.begin(1L,10L,"worker",2);
+        SelfopSkuDailySales row=new SelfopSkuDailySales();row.setCustomerCode("c");row.setSkuCode("s");row.setBusinessDate(LocalDate.of(2026,10,1));
+        when(aggregates.dailyBatch("demo","A",null,null,null)).thenReturn(List.of(row));
+        var checkpoint=transaction.batch(1L,10L,"worker",2);
+        assertEquals(1,checkpoint.dailyRows());assertEquals("BUILDING",run.getStatus());assertNotNull(task.getProgressUpdatedAtUtc());assertNotNull(run.getHeartbeatAtUtc());
+        assertTrue(task.getProgressJson().contains("candidateBuild"));assertNull(scope.getPublishedRunId());
+        Map<?,?> progress=SelfopSupport.read(task.getProgressJson(),Map.class);
+        assertEquals("BUILD",progress.get("phase"));assertEquals("BATCH",progress.get("unit"));assertEquals(1L,((Number)progress.get("completed")).longValue());
+        assertEquals("ATTEMPT_ONLY",progress.get("countBasis"));assertFalse(progress.containsKey("processedCount"));
+        assertDoesNotThrow(()->Instant.parse((String)progress.get("stageStartedAt")));assertTrue(progress.get("stages") instanceof List<?>);
+        scope.setFactRevision(6L);assertThrows(IllegalStateException.class,()->transaction.batch(1L,10L,"worker",2));
+        assertEquals("BUILDING",run.getStatus());verify(aggregates,times(1)).insertDaily(any());
+    }
+    @Test void crashResumesSameRunCursorWithoutDeletingCommittedRows() {
+        var started=transaction.begin(1L,10L,"worker",2);clearInvocations(daily,profiles);
+        assertEquals(started,transaction.begin(1L,10L,"worker",2));verifyNoInteractions(daily,profiles);
+        scope.setLeaseUntilUtc(SelfopSupport.utcNow().minusSeconds(1));
+        assertThrows(IllegalStateException.class,()->transaction.batch(1L,10L,"worker",2));
+    }
+    @Test void observationChangeWithoutRevisionStillAbortsCandidate() {
+        transaction.begin(1L,10L,"worker",2);
+        when(aggregates.observationsChangedSince(eq("demo"),eq("A"),any())).thenReturn(1L);
+        assertThrows(IllegalStateException.class,()->transaction.batch(1L,10L,"worker",2));
+        verify(aggregates,never()).insertDaily(any());assertEquals("BUILDING",run.getStatus());
+    }
+    @Test void facadeHasNoLongTransactionAndWorkerMethodsDeclareOwnTransactions() throws Exception {
+        assertNull(OutboundCandidateBuilder.class.getMethod("build",Long.class,Long.class,String.class,long.class).getAnnotation(org.springframework.transaction.annotation.Transactional.class));
+        for(String name:List.of("begin","batch","finish"))assertNotNull(OutboundCandidateTransaction.class.getMethod(name,Long.class,Long.class,String.class,long.class).getAnnotation(org.springframework.transaction.annotation.Transactional.class));
+    }
+    @Test void missingWarehouseSummaryPreventsReadyAndOldReadyCannotBypassBuild() {
+        transaction.begin(1L,10L,"worker",2);
+        var row=new SelfopSkuDailySales();row.setCustomerCode("c");row.setSkuCode("sku");row.setBusinessDate(LocalDate.of(2026,10,1));
+        when(aggregates.dailyBatch("demo","A",null,null,null)).thenReturn(List.of(row));transaction.batch(1L,10L,"worker",2);
+        transaction.batch(1L,10L,"worker",2);transaction.batch(1L,10L,"worker",2);
+        when(daily.selectCount(any())).thenReturn(1L);
+        assertEquals("WAREHOUSE_DAILY_ROWS_INCOMPLETE",assertThrows(IllegalStateException.class,()->transaction.finish(1L,10L,"worker",2)).getMessage());
+        assertEquals("BUILDING",run.getStatus());assertEquals(Boolean.FALSE,run.getWarehouseDailyReady());
+        run.setStatus("READY");assertEquals("WAREHOUSE_DAILY_NOT_READY",assertThrows(IllegalStateException.class,()->transaction.begin(1L,10L,"worker",2)).getMessage());
+    }
+    @Test void warehouseBatchFailureCannotAdvanceCheckpointAndRetryUsesSameCursor() {
+        transaction.begin(1L,10L,"worker",2);String before=task.getProgressJson();
+        var row=new SelfopSkuDailySales();row.setCustomerCode("c");row.setSkuCode("sku");row.setBusinessDate(LocalDate.of(2026,10,1));
+        when(aggregates.dailyBatch("demo","A",null,null,null)).thenReturn(List.of(row));
+        when(aggregates.insertWarehouseDaily(any())).thenThrow(new IllegalStateException("SYNTHETIC_WRITE_FAILURE")).thenReturn(1);
+        assertThrows(IllegalStateException.class,()->transaction.batch(1L,10L,"worker",2));assertEquals(before,task.getProgressJson());
+        var resumed=transaction.batch(1L,10L,"worker",2);assertEquals(1,resumed.dailyRows());assertEquals(1,resumed.committedBatches());
+    }
+
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/outbound/OutboundFactServiceTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/outbound/OutboundFactServiceTest.java
new file mode 100644
index 000000000..9ede6a31e
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/outbound/OutboundFactServiceTest.java
@@ -0,0 +1,156 @@
+package com.baiyue.lastleg.selfoperated.analytics.outbound;
+
+import com.baiyue.lastleg.selfoperated.analytics.mapper.*;
+import com.baiyue.lastleg.selfoperated.analytics.model.*;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.mockito.ArgumentCaptor;
+import java.math.BigDecimal;
+import java.time.*;
+import java.util.*;
+import static org.mockito.Mockito.*;
+import static org.junit.jupiter.api.Assertions.*;
+
+class OutboundFactServiceTest {
+    final OutboundLockMapper locks=mock(OutboundLockMapper.class);
+    final SelfopSyncTaskMapper tasks=mock(SelfopSyncTaskMapper.class);
+    final SelfopSyncRunMapper runs=mock(SelfopSyncRunMapper.class);
+    final SelfopSyncScopeMapper scopes=mock(SelfopSyncScopeMapper.class);
+    final SelfopSyncStageMapper stages=mock(SelfopSyncStageMapper.class);
+    final SelfopOutboundOrderMapper orders=mock(SelfopOutboundOrderMapper.class);
+    final SelfopOutboundItemMapper items=mock(SelfopOutboundItemMapper.class);
+    final OutboundFactService service=new OutboundFactService(locks,tasks,runs,scopes,stages,orders,items);
+    SelfopSyncTask task; SelfopSyncRun run; SelfopSyncStage stage; SelfopSyncScope a,b; SelfopOutboundOrder old;
+    Map<String,OutboundFactService.Lease> leases;
+    SelfopPayloads.Order payload;
+    @BeforeEach void setup() {
+        a=scope(1L,"A"); b=scope(2L,"B"); leases=Map.of("A",new OutboundFactService.Lease("worker",7),"B",new OutboundFactService.Lease("worker",7));
+        task=new SelfopSyncTask(); task.setId(10L); task.setSourceAccount("demo"); task.setScopeId(2L);
+        task.setExecutionPurpose("BUSINESS");
+        task.setTaskRole("WAREHOUSE_SYNC");
+        task.setWarehouseCode("B"); task.setScopeHash("scope"); task.setUpstreamTaskId(9L); task.setApplyState("NOT_STARTED");
+        run=new SelfopSyncRun(); run.setId(20L); run.setTaskId(10L); run.setScopeId(2L); run.setScopeHash("scope"); run.setFenceToken(7L);
+        run.setExecutionPurpose("BUSINESS");
+        run.setAttemptNo(1);
+        payload=new SelfopPayloads.Order("demo","owner","B","delivery",null,100,null,"2026-10-11 12:00:00",List.of(new SelfopPayloads.Item("sku",null,new BigDecimal("3"),"piece")));
+        stage=new SelfopSyncStage(); stage.setId(30L); stage.setStageBatchId(9L); stage.setObjectType("OUTBOUND_ORDER"); stage.setValidationStatus("VALID");
+        stage.setRunId(8L);
+        SelfopSyncRun sourceRun=new SelfopSyncRun(); sourceRun.setId(8L); sourceRun.setTaskId(9L); sourceRun.setExecutionPurpose("BUSINESS");
+        SelfopSyncTask sourceTask=new SelfopSyncTask(); sourceTask.setId(9L); sourceTask.setExecutionPurpose("BUSINESS");
+        sourceRun.setSourceAccount("demo"); sourceTask.setSourceAccount("demo");
+        when(runs.selectById(8L)).thenReturn(sourceRun); when(tasks.selectById(9L)).thenReturn(sourceTask);
+        stage.setObjectKeyHash(SelfopSupport.hash(List.of("demo","owner","delivery"))); stage.setWarehouseCode("B"); stage.setObservationSequence(2L);
+        stage.setPayloadJson(SelfopSupport.json(payload)); stage.setObservedAtUtc(SelfopSupport.utcNow());
+        stage.setContentHash(SelfopOutboundFingerprint.order(payload));
+        SelfopRoutingManifest manifest=new SelfopRoutingManifest(); manifest.setDirectoryComplete(true);
+        SelfopRoutingManifest.Entry entry=new SelfopRoutingManifest.Entry(); entry.setEffectiveStageId(30L); manifest.getObjects().put(stage.getObjectKeyHash(),entry);
+        task.setRoutingManifestJson(SelfopSupport.json(manifest));
+        old=new SelfopOutboundOrder(); old.setId(40L); old.setWarehouseCode("A"); old.setSourceAccount("demo"); old.setCustomerCode("owner");
+        old.setDeliveryNo("delivery"); old.setRevisionNo(1L); old.setLastObservationSequence(1L); old.setContentHash("old");
+        old.setBusinessDate(LocalDate.of(2026,10,10)); old.setOutboundAtUtc(LocalDateTime.of(2026,10,10,12,0)); old.setSalesEligible(1);
+        when(tasks.selectById(10L)).thenReturn(task); when(locks.task(10L)).thenReturn(task); when(locks.run(20L)).thenReturn(run);
+        when(stages.selectById(30L)).thenReturn(stage); when(locks.stage(30L)).thenReturn(stage);
+        when(orders.selectOne(any())).thenReturn(old); when(locks.order("demo","owner","delivery")).thenReturn(old);
+        when(locks.warehouse("demo","A")).thenReturn(a); when(locks.warehouse("demo","B")).thenReturn(b);
+        when(locks.newestObservation("demo",stage.getObjectKeyHash())).thenReturn(2L);
+        when(items.selectList(any())).thenReturn(List.of()); when(tasks.selectCount(any())).thenReturn(0L);
+    }
+    private SelfopSyncScope scope(Long id,String warehouse) {
+        SelfopSyncScope s=new SelfopSyncScope(); s.setId(id); s.setWarehouseCode(warehouse); s.setSourceAccount("demo"); s.setDataFamily("OUTBOUND");
+        s.setScopeHash("scope"); s.setSourceTimezone("UTC"); s.setBusinessTimezone("UTC"); s.setScopeJson("{\"quantityUnit\":\"piece\"}");
+        s.setLeaseOwner("worker"); s.setFenceToken(7L); s.setLeaseUntilUtc(SelfopSupport.utcNow().plusHours(1)); s.setFactRevision(0L); return s;
+    }
+    private SelfopPayloads.Order withQuantity(String quantity) {
+        return new SelfopPayloads.Order(payload.sourceAccount(),payload.customerCode(),payload.warehouseCode(),payload.deliveryNo(),payload.sourceNo(),
+            payload.sourceStatus(),payload.sourceCreatedTime(),payload.sourceOutboundTime(),List.of(new SelfopPayloads.Item("sku",null,new BigDecimal(quantity),"piece")));
+    }
+    @Test void persistedScientificQuantityKeepsStageIntegrityAndCanMerge() {
+        var observed=withQuantity("3000.000000");stage.setContentHash(SelfopOutboundFingerprint.order(observed));
+        stage.setPayloadJson(SelfopSupport.json(withQuantity("3E+3")));
+        service.merge(10L,20L,List.of(30L),leases);
+        var captured=ArgumentCaptor.forClass(SelfopOutboundItem.class);verify(items).insert(captured.capture());
+        assertEquals(0,new BigDecimal("3000").compareTo(captured.getValue().getActualQuantity()));
+        assertEquals("APPLYING",task.getApplyState());
+    }
+    @Test void equivalentQuantityReobservationDoesNotIncrementFactRevisionOrRewriteItems() {
+        var observed=withQuantity("3000.000000");stage.setContentHash(SelfopOutboundFingerprint.order(observed));stage.setPayloadJson(SelfopSupport.json(withQuantity("3.0E+3")));
+        old.setWarehouseCode("B");old.setContentHash(SelfopOutboundFingerprint.fact(OutboundPolicy.normalize(withQuantity("3000")),"UTC","UTC","piece"));
+        old.setBusinessDate(LocalDate.of(2026,10,11));old.setOutboundAtUtc(LocalDateTime.of(2026,10,11,12,0));
+        service.merge(10L,20L,List.of(30L),leases);
+        assertEquals(1L,old.getRevisionNo());assertEquals(0L,a.getFactRevision());assertEquals(0L,b.getFactRevision());
+        verify(items,never()).delete(any());verify(items,never()).insert(any(SelfopOutboundItem.class));
+        assertEquals(2L,old.getLastObservationSequence());
+    }
+    @Test void realQuantityTamperingStillRejectsBeforeWritingOrderOrItems() {
+        stage.setContentHash(SelfopOutboundFingerprint.order(withQuantity("3000")));stage.setPayloadJson(SelfopSupport.json(withQuantity("3001")));
+        assertEquals("STAGE_CONTENT_CONFLICT",assertThrows(IllegalStateException.class,()->service.merge(10L,20L,List.of(30L),leases)).getMessage());
+        verify(orders,never()).updateById(any(SelfopOutboundOrder.class));verify(items,never()).insert(any(SelfopOutboundItem.class));
+    }
+    @Test void crossWarehouseRevisionInvalidatesBothAndLeavesBarrierUntilFinish() {
+        service.merge(10L,20L,List.of(30L),leases);
+        assertEquals("B",old.getWarehouseCode()); assertEquals(1L,a.getFactRevision()); assertEquals(1L,b.getFactRevision());
+        assertEquals(1,a.getRebuildRequired()); assertEquals(1,b.getRebuildRequired()); assertEquals("APPLYING",task.getApplyState());
+        verify(tasks,times(2)).insert(any(SelfopSyncTask.class));
+        assertTrue(task.getAffectedWarehouseCodesJson().contains("A")); assertTrue(task.getAffectedWarehouseCodesJson().contains("B"));
+        verify(stages).update(isNull(),any());
+    }
+    @Test void expiredOldWorkerCannotWriteFactOrBarrier() {
+        a.setLeaseUntilUtc(SelfopSupport.utcNow().minusSeconds(1));
+        assertThrows(IllegalStateException.class,()->service.merge(10L,20L,List.of(30L),leases));
+        verify(orders,never()).updateById(any(SelfopOutboundOrder.class)); verify(tasks,never()).updateById(any(SelfopSyncTask.class));
+    }
+    @Test void newerPersistedDetailForcesRecheckInsteadOfCompletingOldSlice() {
+        when(locks.newestObservation("demo",stage.getObjectKeyHash())).thenReturn(3L);
+        assertThrows(IllegalStateException.class,()->service.merge(10L,20L,List.of(30L),leases));
+        verify(orders,never()).updateById(any(SelfopOutboundOrder.class));
+    }
+    @Test void cancellationRemovesOldDateAndEligibility() {
+        SelfopPayloads.Order cancelled=new SelfopPayloads.Order("demo","owner","B","delivery",null,99,null,null,payload.items());
+        stage.setPayloadJson(SelfopSupport.json(cancelled)); stage.setContentHash(SelfopOutboundFingerprint.order(cancelled));
+        service.merge(10L,20L,List.of(30L),leases);
+        assertNull(old.getOutboundAtUtc()); assertNull(old.getBusinessDate()); assertEquals(0,old.getSalesEligible());
+        verify(items).delete(any());
+    }
+    @Test void deadTaskRetainsCrossTaskPublicationBarrier() {
+        task.setApplyState("BLOCKED"); task.setStatus("DEAD");
+        when(locks.barriers("demo","B")).thenReturn(List.of(task));
+        assertThrows(IllegalStateException.class,()->service.assertNoBarrier(b));
+    }
+    @Test void incompleteRoutingSetCannotClearBarrier() {
+        assertThrows(IllegalStateException.class,()->service.finish(10L,20L,List.of(),leases));
+        verify(tasks,never()).updateById(any(SelfopSyncTask.class));
+    }
+    @Test void validationCannotMergeOrCompleteFormalTask() {
+        task.setExecutionPurpose("VALIDATION");
+        assertThrows(IllegalStateException.class,()->service.merge(10L,20L,List.of(30L),leases));
+        assertThrows(IllegalStateException.class,()->service.finish(10L,20L,List.of(30L),leases));
+        verifyNoInteractions(scopes); verify(orders,never()).updateById(any(SelfopOutboundOrder.class));
+    }
+    @Test void businessCannotReuseValidationDetailStage() {
+        SelfopSyncRun validation=new SelfopSyncRun(); validation.setExecutionPurpose("VALIDATION");
+        when(runs.selectById(8L)).thenReturn(validation);
+        assertThrows(IllegalStateException.class,()->service.merge(10L,20L,List.of(30L),leases));
+        verify(orders,never()).updateById(any(SelfopOutboundOrder.class)); verify(items,never()).delete(any());
+    }
+    @Test void mergeCheckpointCountsPersistedEffectiveReferencesOnceAcrossReplay() {
+        service.merge(10L,20L,List.of(30L),leases);
+        SelfopRoutingManifest saved=SelfopSupport.read(task.getRoutingManifestJson(),SelfopRoutingManifest.class);
+        assertEquals(30L,saved.getObjects().get(stage.getObjectKeyHash()).getAppliedStageId());
+        Map<?,?> progress=SelfopSupport.read(task.getProgressJson(),Map.class);
+        assertEquals("MERGE",progress.get("phase"));assertEquals("ORDER",progress.get("unit"));
+        assertEquals(1L,((Number)progress.get("completed")).longValue());assertEquals(1L,((Number)progress.get("total")).longValue());
+        service.merge(10L,20L,List.of(30L),leases);
+        assertEquals(1L,((Number)SelfopSupport.read(task.getProgressJson(),Map.class).get("completed")).longValue());
+        assertEquals(1L,a.getFactRevision());assertEquals(1L,b.getFactRevision());
+    }
+    @Test void priorAppliedReferencesCarryForwardButOutdatedReferencesAreNotCompleted() {
+        SelfopRoutingManifest manifest=SelfopSupport.read(task.getRoutingManifestJson(),SelfopRoutingManifest.class);
+        SelfopRoutingManifest.Entry prior=new SelfopRoutingManifest.Entry();prior.setEffectiveStageId(31L);prior.setAppliedStageId(31L);
+        manifest.getObjects().put("other-key",prior);task.setRoutingManifestJson(SelfopSupport.json(manifest));
+        service.merge(10L,20L,List.of(30L),leases);
+        assertEquals(2L,((Number)SelfopSupport.read(task.getProgressJson(),Map.class).get("completed")).longValue());
+        manifest=SelfopSupport.read(task.getRoutingManifestJson(),SelfopRoutingManifest.class);manifest.getObjects().get("other-key").setEffectiveStageId(32L);task.setRoutingManifestJson(SelfopSupport.json(manifest));
+        service.merge(10L,20L,List.of(30L),leases);
+        assertEquals(1L,((Number)SelfopSupport.read(task.getProgressJson(),Map.class).get("completed")).longValue());
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/outbound/OutboundPolicyTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/outbound/OutboundPolicyTest.java
new file mode 100644
index 000000000..a7a0f039f
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/outbound/OutboundPolicyTest.java
@@ -0,0 +1,80 @@
+package com.baiyue.lastleg.selfoperated.analytics.outbound;
+
+import com.baiyue.lastleg.selfoperated.analytics.model.*;
+import org.junit.jupiter.api.Test;
+import java.math.BigDecimal;
+import java.time.*;
+import java.util.List;
+import static org.junit.jupiter.api.Assertions.*;
+
+class OutboundPolicyTest {
+    private SelfopPayloads.Order order(String time,Integer status,List<SelfopPayloads.Item> items) {
+        return new SelfopPayloads.Order("demo","owner","warehouse","delivery",null,status,"2020-01-01 00:00:00",time,items);
+    }
+    @Test void actualSkuLinesAreCombinedWithoutForecastOrPackageQuantities() {
+        SelfopPayloads.Order p=order("2026-10-11 09:00:00",100,List.of(
+                new SelfopPayloads.Item("sku","name",new BigDecimal("2"),"piece"),
+                new SelfopPayloads.Item("sku","name",new BigDecimal("3"),"piece")));
+        assertEquals(new BigDecimal("5"),OutboundPolicy.normalize(p).items().get(0).actualQuantity());
+        assertEquals(1,OutboundPolicy.normalize(p).items().size());
+    }
+    @Test void missingQuantityAndMixedUnitCannotBecomeZero() {
+        assertThrows(IllegalStateException.class,()->OutboundPolicy.normalize(order(null,100,List.of(new SelfopPayloads.Item("sku",null,null,"piece")))));
+        assertThrows(IllegalStateException.class,()->OutboundPolicy.normalize(order(null,100,List.of(
+                new SelfopPayloads.Item("sku",null,BigDecimal.ONE,"piece"),new SelfopPayloads.Item("sku",null,BigDecimal.ONE,"box")))));
+    }
+    @Test void unknownSourceTimezoneNeverUsesWarehouseOrSystemDefault() {
+        SelfopSyncScope scope=new SelfopSyncScope(); scope.setBusinessTimezone("Asia/Shanghai");
+        assertThrows(IllegalStateException.class,()->OutboundPolicy.outboundUtc(order("2026-10-11 09:00:00",100,List.of()),scope));
+    }
+    @Test void dstOverlapAndGapAreExplicitlyRejected() {
+        SelfopSyncScope scope=new SelfopSyncScope(); scope.setSourceTimezone("America/New_York");
+        assertThrows(IllegalStateException.class,()->OutboundPolicy.outboundUtc(order("2026-11-01 01:30:00",100,List.of()),scope));
+        assertThrows(IllegalStateException.class,()->OutboundPolicy.outboundUtc(order("2026-03-08 02:30:00",100,List.of()),scope));
+    }
+    @Test void cancellationWithQuantityAndNoOutboundDateHasNoSalesTime() {
+        SelfopSyncScope scope=new SelfopSyncScope(); scope.setSourceTimezone("UTC");
+        assertNull(OutboundPolicy.outboundUtc(order(null,99,List.of(new SelfopPayloads.Item("sku",null,BigDecimal.ONE,"piece"))),scope));
+    }
+    @Test void rollingMonthDoesNotInventFirstPartialDayCoverage() {
+        var days=OutboundPolicy.completeDays(LocalDateTime.of(2026,9,12,0,0),LocalDateTime.of(2026,10,12,0,0),"Asia/Shanghai");
+        assertEquals(LocalDate.of(2026,9,13),days.from()); assertEquals(LocalDate.of(2026,10,12),days.until());
+        assertTrue(LocalDate.of(2026,10,11).isBefore(days.until()));
+    }
+    @Test void disconnectedBackfillDoesNotJumpOverCoverageGap() {
+        LocalDateTime start=LocalDateTime.of(2026,9,12,0,0);
+        var result=OutboundCandidateBuilder.contiguous(start,List.of(
+                new OutboundCandidateBuilder.Coverage(start,start.plusDays(1)),
+                new OutboundCandidateBuilder.Coverage(start.plusDays(2),start.plusDays(3))));
+        assertEquals(start.plusDays(1),result.until());
+    }
+    @Test void newDiscoverySliceUsesHalfOpenUtcBoundaries() {
+        SelfopSyncScope scope=new SelfopSyncScope(); scope.setSourceTimezone("UTC");
+        LocalDateTime from=LocalDateTime.of(2026,10,11,12,0), until=from.plusHours(1);
+        assertFalse(OutboundPolicy.belongsToSlice(order("2026-10-11 11:59:59",100,List.of()),scope,from,until,false,"SCHEDULED"));
+        assertTrue(OutboundPolicy.belongsToSlice(order("2026-10-11 12:00:00",100,List.of()),scope,from,until,false,"SCHEDULED"));
+        assertTrue(OutboundPolicy.belongsToSlice(order("2026-10-11 12:59:59",100,List.of()),scope,from,until,false,"SCHEDULED"));
+        assertFalse(OutboundPolicy.belongsToSlice(order("2026-10-11 13:00:00",100,List.of()),scope,from,until,false,"SCHEDULED"));
+    }
+    @Test void endpointReturnedByAdjacentSourceSlicesBelongsOnlyToTheSecondInternalSlice() {
+        SelfopSyncScope scope=new SelfopSyncScope(); scope.setSourceTimezone("UTC");
+        LocalDateTime from=LocalDateTime.of(2026,10,11,12,0), middle=from.plusHours(1), until=middle.plusHours(1);
+        var p=order("2026-10-11 13:00:00",100,List.of());
+        assertFalse(OutboundPolicy.belongsToSlice(p,scope,from,middle,false,"SCHEDULED"));
+        assertTrue(OutboundPolicy.belongsToSlice(p,scope,middle,until,false,"SCHEDULED"));
+    }
+    @Test void correctedKnownDateAndCancellationRemainApplicableOutsideTheSlice() {
+        SelfopSyncScope scope=new SelfopSyncScope(); scope.setSourceTimezone("UTC");
+        LocalDateTime from=LocalDateTime.of(2026,10,11,12,0), until=from.plusHours(1);
+        var corrected=order("2026-10-01 00:00:00",100,List.of());
+        assertTrue(OutboundPolicy.belongsToSlice(corrected,scope,from,until,true,"SCHEDULED"));
+        assertTrue(OutboundPolicy.belongsToSlice(corrected,scope,from,until,false,"RECHECK"));
+        assertTrue(OutboundPolicy.belongsToSlice(order(null,99,List.of()),scope,from,until,false,"SCHEDULED"));
+    }
+    @Test void unconfirmedTimezoneRetainsEvidenceWithoutAssumingUtc() {
+        SelfopSyncScope scope=new SelfopSyncScope(); scope.setBusinessTimezone("Asia/Shanghai");
+        LocalDateTime from=LocalDateTime.of(2026,10,11,12,0), until=from.plusHours(1);
+        assertTrue(OutboundPolicy.belongsToSlice(order("2026-10-01 00:00:00",100,List.of()),scope,from,until,false,"SCHEDULED"));
+        assertNull(scope.getSourceTimezone());
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/query/AnalyticsQueryServiceTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/query/AnalyticsQueryServiceTest.java
new file mode 100644
index 000000000..052ad51f4
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/query/AnalyticsQueryServiceTest.java
@@ -0,0 +1,425 @@
+package com.baiyue.lastleg.selfoperated.analytics.query;
+
+import com.baiyue.common.core.exception.BizException;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.mockito.ArgumentCaptor;
+import org.springframework.transaction.annotation.Isolation;
+import org.springframework.transaction.annotation.Transactional;
+import java.math.BigDecimal;
+import java.time.*;
+import java.util.*;
+import static com.baiyue.lastleg.selfoperated.analytics.query.AnalyticsReadRows.*;
+import static org.junit.jupiter.api.Assertions.*;
+import static org.mockito.Mockito.*;
+
+/** Offline contracts: SQL supplies bounded pages, never an in-memory warehouse history. */
+class AnalyticsQueryServiceTest {
+    @Test void namesUseFrozenLocalDirectoryWithoutChangingSkuIdentityOrQuantities(){
+        var directory=mock(SelfopOwnerDirectory.class);when(directory.names("demo",NOW)).thenReturn(Map.of("C","货主名称"));
+        var named=new AnalyticsQueryService(mapper,new ObjectMapper(),Clock.fixed(NOW,ZoneOffset.UTC),directory);
+        var before=service.inventoryCoverage(metrics(null),options()).records().get(0);
+        var after=named.inventoryCoverage(metrics(null),options()).records().get(0);
+        assertEquals("货主名称",after.customerName());assertEquals(before.customerCode(),after.customerCode());assertEquals(before.sku(),after.sku());
+        assertEquals(before.physicalQuantity(),after.physicalQuantity());assertEquals(before.windowOutboundQuantity(),after.windowOutboundQuantity());
+        assertEquals("货主名称",named.ownerDirectory(metrics(null)).get(0).customerName());
+    }
+    @Test void frozenHistoryStartExistsBeforeContinuousAnchorAndIncludesEarlierDisconnectedDays(){
+        when(mapper.publishedRun(11)).thenReturn(frozenRun(null,null,
+            new com.baiyue.lastleg.selfoperated.analytics.model.SelfopSalesCoverage.Interval(time(D.minusDays(1)),time(D))));
+        assertEquals(D.minusDays(1),service.inventoryCoverage(metrics(null),options()).records().get(0).observedHistoryStartDate());
+        assertEquals(D.minusDays(1),service.slowSkus(metrics(null)).records().get(0).observedHistoryStartDate());
+        when(mapper.publishedRun(11)).thenReturn(frozenRun(time(D.minusDays(5)),time(D.minusDays(4)),
+            new com.baiyue.lastleg.selfoperated.analytics.model.SelfopSalesCoverage.Interval(time(D.minusDays(10)),time(D.minusDays(9))),
+            new com.baiyue.lastleg.selfoperated.analytics.model.SelfopSalesCoverage.Interval(time(D.minusDays(5)),time(D.minusDays(4)))));
+        assertEquals(D.minusDays(10),service.inventoryCoverage(metrics(null),options()).records().get(0).observedHistoryStartDate());
+        assertEquals(D.minusDays(10),service.slowSkus(metrics(null)).records().get(0).observedHistoryStartDate());
+    }
+    @Test void slowTodayZeroUsesFrozenIslandAndMatchesTrendWithoutAuthorizingThirtyDays(){
+        var json=new ObjectMapper().findAndRegisterModules();
+        var row=json.convertValue(aggregate(true,"300","VALID",time(D.minusDays(40))),Map.class);row.put("todayQuantity",null);
+        when(mapper.page(any())).thenReturn(List.of(json.convertValue(row,Aggregate.class)));
+        when(mapper.publishedRun(11)).thenReturn(frozenRun(time(D.minusDays(5)),time(D.minusDays(4)),
+            new com.baiyue.lastleg.selfoperated.analytics.model.SelfopSalesCoverage.Interval(time(D.minusDays(5)),time(D.minusDays(4))),
+            new com.baiyue.lastleg.selfoperated.analytics.model.SelfopSalesCoverage.Interval(time(D),utc(NOW.minusSeconds(3600)))));
+        var trend=service.dailySales(chart("TODAY",null,null,"C","SKU")).points().get(0);
+        assertEquals("PARTIAL",trend.dataStatus());assertEquals(BigDecimal.ZERO,trend.observedQuantity());
+        assertEquals(trend.observedQuantity(),service.slowSkus(metrics(null)).records().get(0).todayObservedQuantity());
+        var cap=ArgumentCaptor.forClass(AnalyticsSqlRequest.class);verify(mapper).page(cap.capture());
+        assertFalse(cap.getValue().complete30());assertFalse(cap.getValue().completeWindow());
+        row.put("evidenceAtUtc",utc(NOW));when(mapper.page(any())).thenReturn(List.of(json.convertValue(row,Aggregate.class)));
+        assertNull(service.slowSkus(metrics(null)).records().get(0).todayObservedQuantity());
+    }
+    @Test void slowUncoveredTodayRemainsUnknownAndHistoricalGapIsNotFilled(){
+        var json=new ObjectMapper().findAndRegisterModules();
+        var row=json.convertValue(aggregate(true,"300","VALID",time(D.minusDays(40))),Map.class);row.put("todayQuantity",null);
+        when(mapper.page(any())).thenReturn(List.of(json.convertValue(row,Aggregate.class)));
+        when(mapper.publishedRun(11)).thenReturn(frozenRun(time(D.minusDays(5)),time(D.minusDays(4)),
+            new com.baiyue.lastleg.selfoperated.analytics.model.SelfopSalesCoverage.Interval(time(D.minusDays(5)),time(D.minusDays(4))),
+            new com.baiyue.lastleg.selfoperated.analytics.model.SelfopSalesCoverage.Interval(time(D.minusDays(1)),time(D))));
+        var trend=service.dailySales(chart("TODAY",null,null,"C","SKU")).points().get(0);
+        assertEquals("UNKNOWN",trend.dataStatus());assertNull(trend.observedQuantity());
+        assertNull(service.slowSkus(metrics(null)).records().get(0).todayObservedQuantity());
+        var gap=service.dailySales(chart("CUSTOM",D.minusDays(3),D.minusDays(2),"C","SKU"));
+        assertTrue(gap.points().stream().allMatch(p->"UNKNOWN".equals(p.dataStatus())&&p.observedQuantity()==null));
+        var cap=ArgumentCaptor.forClass(AnalyticsSqlRequest.class);verify(mapper).page(cap.capture());assertFalse(cap.getValue().complete30());
+    }
+    private static Run frozenRun(LocalDateTime from,LocalDateTime until,
+        com.baiyue.lastleg.selfoperated.analytics.model.SelfopSalesCoverage.Interval... intervals){
+        Run original=run(11,1,SH,NOW.minusSeconds(3600),null,"PUBLISHED","BUSINESS","Asia/Shanghai");
+        var frozen=new com.baiyue.lastleg.selfoperated.analytics.model.SelfopSyncRun();
+        frozen.setId(11L);frozen.setScopeId(1L);frozen.setScopeHash(SH);frozen.setScopeSnapshotJson(original.scopeSnapshotJson());
+        com.baiyue.lastleg.selfoperated.analytics.model.SelfopSalesCoverage.freeze(frozen,List.of(intervals));
+        var json=new ObjectMapper().findAndRegisterModules();var fields=json.convertValue(original,Map.class);
+        fields.put("scopeSnapshotJson",frozen.getScopeSnapshotJson());fields.put("coveredFromUtc",from);fields.put("coveredUntilUtc",until);
+        return json.convertValue(fields,Run.class);
+    }
+    @Test void selectedRunFrozenIslandsDriveDailyAndWindowEligibility(){
+        Run original=run(11,1,SH,NOW.minusSeconds(3600),null,"PUBLISHED","BUSINESS","Asia/Shanghai");
+        var frozen=new com.baiyue.lastleg.selfoperated.analytics.model.SelfopSyncRun();frozen.setId(11L);frozen.setScopeId(1L);frozen.setScopeHash(SH);frozen.setScopeSnapshotJson(original.scopeSnapshotJson());
+        com.baiyue.lastleg.selfoperated.analytics.model.SelfopSalesCoverage.freeze(frozen,List.of(
+            new com.baiyue.lastleg.selfoperated.analytics.model.SelfopSalesCoverage.Interval(time(D.minusDays(5)),time(D.minusDays(4))),
+            new com.baiyue.lastleg.selfoperated.analytics.model.SelfopSalesCoverage.Interval(time(D),time(D.plusDays(1)))));
+        var json=new ObjectMapper().findAndRegisterModules();var fields=json.convertValue(original,Map.class);fields.put("scopeSnapshotJson",frozen.getScopeSnapshotJson());
+        fields.put("coveredFromUtc",time(D.minusDays(5)));fields.put("coveredUntilUtc",time(D.minusDays(4)));
+        when(mapper.publishedRun(11)).thenReturn(json.convertValue(fields,Run.class));service=at(NOW.plusSeconds(86400));
+        var response=service.dailySales(chart("CUSTOM",D.minusDays(5),D,"C","SKU"));
+        assertEquals(List.of("COMPLETE","UNKNOWN","UNKNOWN","UNKNOWN","UNKNOWN","COMPLETE"),response.points().stream().map(AnalyticsResponses.Point::dataStatus).toList());
+        assertNull(response.summary().outboundQuantity());assertEquals(BigDecimal.ZERO,response.points().get(5).outboundQuantity());
+        var snapshot=service.context(chart("CUSTOM",D,D,null,null),true,false,false,null);
+        assertTrue(service.request(snapshot,"SUMMARY").completeWindow());assertFalse(service.request(snapshot,"SUMMARY").complete30());
+    }
+    private static final String SH="a".repeat(64), IH="b".repeat(64);
+    private static final LocalDate D=LocalDate.of(2026,10,12);
+    private static final Instant NOW=Instant.parse("2026-10-12T04:00:00Z");
+    private AnalyticsReadMapper mapper;
+    private AnalyticsQueryService service;
+    @BeforeEach void setUp(){
+        mapper=mock(AnalyticsReadMapper.class); service=at(NOW);
+        when(mapper.scopes("demo","W")).thenReturn(List.of(scope(1,"OUTBOUND",SH,11L),scope(2,"INVENTORY",IH,22L)));
+        when(mapper.publishedRun(11)).thenReturn(run(11,1,SH,NOW.minusSeconds(3600),null,"PUBLISHED","BUSINESS","Asia/Shanghai"));
+        when(mapper.publishedRun(22)).thenReturn(run(22,2,IH,NOW.minusSeconds(3600),null,"PUBLISHED","BUSINESS","Asia/Shanghai"));
+        when(mapper.count(any())).thenReturn(1L);
+        when(mapper.page(any())).thenReturn(List.of(aggregate(true,"300","VALID",time(D.minusDays(40)))));
+        when(mapper.salesPage(any(),any())).thenAnswer(invocation -> mapper.page(invocation.getArgument(0)));
+        when(mapper.inventoryCount(any(),any())).thenReturn(1L);
+        doAnswer(inv->List.of(inventory(true,"300",inv.getArgument(0,AnalyticsSqlRequest.class).stockFresh(),time(D.minusDays(40)),inv.getArgument(0,AnalyticsSqlRequest.class).completeWindow()?"150":null))).when(mapper).inventoryPage(any(),any());
+        when(mapper.rankingStats(any())).thenReturn(List.of(new AnalyticsReadMapper.RankingStat(1L,null,0L)));
+        when(mapper.profile(11,"demo","W","C","SKU")).thenReturn(profile("PCS","VALID_OUTBOUND",time(D.minusDays(40))));
+        when(mapper.profile(22,"demo","W","C","SKU")).thenReturn(profile("PCS","INVENTORY_OBSERVATION",time(D.minusDays(35))));
+        when(mapper.daily(anyLong(),anyString(),anyString(),anyString(),anyString(),any(),any())).thenReturn(List.of());
+    }
+    @Test void customHotRangeMatchesSelectedDatesIncludingTodayAndLongHistory(){
+        var q=new AnalyticsQuery("demo","W",null,null,"CUSTOM",D.minusDays(44),D,null,null,1,20,null,null,null,null,null);
+        var result=service.hotSkus(q);
+        var cap=ArgumentCaptor.forClass(AnalyticsSqlRequest.class);verify(mapper).page(cap.capture());
+        assertEquals(D.minusDays(44),cap.getValue().from());assertEquals(D.plusDays(1),cap.getValue().until());
+        assertFalse(cap.getValue().completeWindow());assertEquals(D.minusDays(44),result.context().rangeStartDate());
+        assertThrows(com.baiyue.common.core.exception.BizException.class,()->new AnalyticsQuery("demo","W",null,null,"CUSTOM",D.minusDays(2),D,null,7,1,20,null,null,null,null,null).validate(false,false,true));
+    }
+    @Test void customSlowRangeUsesSelectedDaysAndPreservesIncompleteLongWindow(){
+        for(int days:List.of(3,45)){
+            clearInvocations(mapper);
+            var q=new AnalyticsQuery("demo","W",null,null,"CUSTOM",D.minusDays(days),D.minusDays(1),null,null,1,20,null,null,null,null,null);
+            var result=service.slowSkus(q);
+            var cap=ArgumentCaptor.forClass(AnalyticsSqlRequest.class);verify(mapper).page(cap.capture());
+            assertEquals(D.minusDays(days),cap.getValue().from());assertEquals(D,cap.getValue().until());
+            assertEquals(days,result.context().calculationWindowDays());
+            if(days==3)assertEquals(0,n("50").compareTo(result.records().get(0).averageDailyOutboundQuantity()));
+            else assertNull(result.records().get(0).averageDailyOutboundQuantity());
+        }
+    }
+    @Test void summaryUsesCountAndBoundPageWithoutLoadingProfilesOrHistory(){
+        when(mapper.count(any())).thenReturn(240L);
+        var response=service.salesSummary(chart("LAST_3_DAYS",null,null,null,null),com.baiyue.lastleg.selfoperated.analytics.query.SalesSort.QUANTITY_DESC);
+        var cap=ArgumentCaptor.forClass(AnalyticsSqlRequest.class);
+        verify(mapper).count(cap.capture()); verify(mapper).page(cap.capture());
+        assertEquals(cap.getAllValues().get(0),cap.getAllValues().get(1));
+        var p=cap.getValue(); assertEquals("SUMMARY",p.kind()); assertEquals(11,p.salesRun()); assertEquals(22,p.inventoryRun());
+        assertEquals(D.minusDays(2),p.from()); assertEquals(D.plusDays(1),p.until());
+        assertEquals("demo",p.account()); assertEquals("W",p.warehouse()); assertNull(p.customer());
+        assertEquals(20,p.size()); assertEquals(0,p.offset()); assertEquals(240,response.total()); assertEquals(12,response.pages());
+        verify(mapper,never()).profile(anyLong(),anyString(),anyString(),anyString(),anyString());
+        verify(mapper,never()).daily(anyLong(),anyString(),anyString(),anyString(),anyString(),any(),any());
+    }
+    @Test void twoZeroAndTodayThreeKeepFormalNullObservedFiveAndAscendingWholeAxis(){
+        when(mapper.daily(11,"demo","W","C","SKU",D.minusDays(2),D.plusDays(1))).thenReturn(List.of(
+            new Daily("C","SKU",D,n("3"),1L,"PCS"),new Daily("C","SKU",D.minusDays(2),n("2"),1L,"PCS")));
+        var response=service.dailySales(chart("LAST_3_DAYS",null,null,"C","SKU"));
+        assertEquals(List.of(D.minusDays(2),D.minusDays(1),D),response.points().stream().map(AnalyticsResponses.Point::businessDate).toList());
+        assertEquals(List.of("COMPLETE","COMPLETE","PARTIAL"),response.points().stream().map(AnalyticsResponses.Point::dataStatus).toList());
+        assertEquals(n("2"),response.points().get(0).outboundQuantity()); assertEquals(BigDecimal.ZERO,response.points().get(1).outboundQuantity());
+        assertNull(response.points().get(2).outboundQuantity()); assertEquals(n("3"),response.points().get(2).observedQuantity());
+        assertNull(response.summary().outboundQuantity()); assertEquals(n("5"),response.summary().observedQuantity());
+        assertEquals("PARTIAL",response.summary().dataStatus()); assertEquals(2,response.summary().completeDayCount());
+        assertEquals(1,response.summary().partialDayCount()); assertEquals("PCS",response.summary().quantityUnit());
+        verify(mapper).daily(11,"demo","W","C","SKU",D.minusDays(2),D.plusDays(1));
+        verify(mapper,never()).page(any()); verify(mapper,never()).count(any());
+        var summary=service.salesSummary(chart("LAST_3_DAYS",null,null,"C","SKU"),com.baiyue.lastleg.selfoperated.analytics.query.SalesSort.QUANTITY_DESC).records().get(0);
+        assertEquals(response.summary().observedQuantity(),summary.observedQuantity());
+        assertEquals(response.summary().outboundQuantity(),summary.outboundQuantity()); assertEquals(response.summary().dataStatus(),summary.dataStatus());
+    }
+    @Test void dailyLimitIsInclusive366AndRejects367BeforeReadingBusinessRows(){
+        assertEquals(366,service.dailySales(chart("CUSTOM",D.minusDays(365),D,"C","SKU")).points().size());
+        verify(mapper).daily(11,"demo","W","C","SKU",D.minusDays(365),D.plusDays(1)); clearInvocations(mapper);
+        assertThrows(BizException.class,()->service.dailySales(chart("CUSTOM",D.minusDays(366),D,"C","SKU")));
+        verify(mapper,never()).profile(anyLong(),anyString(),anyString(),anyString(),anyString());
+        verify(mapper,never()).daily(anyLong(),anyString(),anyString(),anyString(),anyString(),any(),any());
+    }
+    @Test void dailyRequiresExactOwnerSkuAndRejectsMissingCandidate(){
+        assertThrows(BizException.class,()->service.dailySales(chart("TODAY",null,null,null,"SKU")));
+        assertThrows(BizException.class,()->service.dailySales(chart("TODAY",null,null,"C",null)));
+        when(mapper.profile(11,"demo","W","C","SKU")).thenReturn(null); when(mapper.profile(22,"demo","W","C","SKU")).thenReturn(null);
+        assertThrows(BizException.class,()->service.dailySales(chart("TODAY",null,null,"C","SKU")));
+        verify(mapper,never()).daily(anyLong(),anyString(),anyString(),anyString(),anyString(),any(),any());
+    }
+    @Test void historyBeforeInventoryEvidenceStaysUnknownAndNoneCannotReviveIt(){
+        when(mapper.profile(11,"demo","W","C","SKU")).thenReturn(null);
+        when(mapper.profile(22,"demo","W","C","SKU")).thenReturn(profile("PCS","INVENTORY_OBSERVATION",time(D.minusDays(1)).plusHours(16)));
+        var response=service.dailySales(chart("CUSTOM",D.minusDays(3),D.minusDays(2),"C","SKU"));
+        assertNull(response.summary().outboundQuantity()); assertNull(response.summary().observedQuantity());
+        assertTrue(response.points().stream().allMatch(p->"UNKNOWN".equals(p.dataStatus())&&p.reasonCodes().contains("SKU_HISTORY_UNKNOWN")));
+        when(mapper.profile(22,"demo","W","C","SKU")).thenReturn(profile("PCS","NONE",time(D.minusDays(100))));
+        assertNull(service.dailySales(chart("TODAY",null,null,"C","SKU")).summary().observedQuantity());
+    }
+    @Test void foreignUnitsConflictsAndUnknownSourceCannotProduceSales(){
+        for(String unit:List.of("BOX")){
+            when(mapper.profile(11,"demo","W","C","SKU")).thenReturn(profile(unit,"VALID_OUTBOUND",time(D.minusDays(40))));
+            when(mapper.profile(22,"demo","W","C","SKU")).thenReturn(profile("BOX","INVENTORY_OBSERVATION",time(D.minusDays(40))));
+            var r=service.dailySales(chart("TODAY",null,null,"C","SKU"));
+            assertNull(r.summary().observedQuantity()); assertTrue(r.summary().reasonCodes().contains("UNIT_UNKNOWN_OR_CONFLICT"));
+        }
+        when(mapper.profile(11,"demo","W","C","SKU")).thenReturn(profile("PCS","VALID_OUTBOUND",time(D.minusDays(40))));
+        when(mapper.profile(22,"demo","W","C","SKU")).thenReturn(profile(null,"INVENTORY_OBSERVATION",time(D.minusDays(40))));
+        when(mapper.daily(anyLong(),anyString(),anyString(),anyString(),anyString(),any(),any())).thenReturn(List.of(new Daily("C","SKU",D.minusDays(1),n("4"),1L,"PCS")));
+        var independent=service.dailySales(chart("CUSTOM",D.minusDays(1),D.minusDays(1),"C","SKU"));
+        assertEquals(0,n("4").compareTo(independent.summary().outboundQuantity()));
+        when(mapper.profile(22,"demo","W","C","SKU")).thenReturn(profile("PCS","INVENTORY_OBSERVATION",time(D.minusDays(40))));
+        when(mapper.daily(anyLong(),anyString(),anyString(),anyString(),anyString(),any(),any())).thenReturn(List.of());
+        when(mapper.publishedRun(11)).thenReturn(run(11,1,SH,NOW.minusSeconds(3600),null,"PUBLISHED","BUSINESS",null));
+        var r=service.dailySales(chart("TODAY",null,null,"C","SKU"));
+        assertEquals("SOURCE_TIMEZONE_UNKNOWN",r.context().salesStatus()); assertNull(r.summary().observedQuantity());
+    }
+    @Test void contextExpiresAtThirtyMinutesAndOldSalesDeadlineClipsIt(){
+        assertEquals(NOW.plusSeconds(1800),service.inventoryCoverage(metrics(null),options()).context().queryExpiresAt());
+        assertThrows(BizException.class,()->at(NOW.plusSeconds(1800)).inventoryCoverage(pinned(null,11,22,SH,IH,NOW,1),options()));
+        Instant deadline=NOW.plusSeconds(600);
+        when(mapper.publishedRun(11)).thenReturn(run(11,1,SH,NOW.minusSeconds(3600),deadline.minus(Duration.ofDays(7)),"PUBLISHED","BUSINESS","Asia/Shanghai"));
+        assertEquals(deadline,service.inventoryCoverage(metrics(null),options()).context().queryExpiresAt());
+        assertThrows(BizException.class,()->at(deadline).inventoryCoverage(pinned(null,11,22,SH,IH,NOW,1),options()));
+    }
+    @Test void salesRetentionCannotBeConfiguredBelowSevenDays(){
+        org.springframework.test.util.ReflectionTestUtils.setField(service,"retentionDays",1);
+        when(mapper.publishedRun(11)).thenReturn(run(11,1,SH,NOW.minusSeconds(3600),NOW.minus(Duration.ofDays(2)),"PUBLISHED","BUSINESS","Asia/Shanghai"));
+        assertEquals(NOW.plusSeconds(1800),service.inventoryCoverage(metrics(null),options()).context().queryExpiresAt());
+    }
+    @Test void missingOrReversedContinuousCoverageNeverAuthorizesFormalThirtyDayZeros(){
+        Run r=run(11,1,SH,NOW.minusSeconds(3600),null,"PUBLISHED","BUSINESS","Asia/Shanghai");
+        for(LocalDateTime from:Arrays.asList(null,r.coveredUntilUtc().plusDays(1))){
+            when(mapper.publishedRun(11)).thenReturn(new Run(r.id(),r.taskId(),r.scopeId(),r.sourceAccount(),r.warehouseCode(),r.runRole(),r.scopeHash(),r.scopeSnapshotJson(),r.status(),r.coverageStatus(),from,r.coveredUntilUtc(),r.completeDayFrom(),r.completeDayUntil(),r.fetchStartedAtUtc(),r.fetchFinishedAtUtc(),r.publishedAtUtc(),r.calculatedFactRevision(),r.errorCode(),r.errorMessage(),r.supersededAtUtc(),r.executionPurpose(),r.warehouseDailyReady()));
+            var response=service.inventoryCoverage(metrics(null),options());assertNull(response.context().completeDayFrom());assertNull(response.records().get(0).windowOutboundQuantity());
+        }
+        var cap=ArgumentCaptor.forClass(AnalyticsSqlRequest.class);verify(mapper,times(2)).inventoryPage(cap.capture(),any());
+        assertTrue(cap.getAllValues().stream().noneMatch(AnalyticsSqlRequest::complete30));
+    }
+    @Test void pinnedDateSurvivesMidnightAndNewPublishedPointers(){
+        Instant before=Instant.parse("2026-10-12T15:55:00Z"),after=before.plusSeconds(600);
+        var first=at(before).salesSummary(chart("TODAY",null,null,null,null),com.baiyue.lastleg.selfoperated.analytics.query.SalesSort.QUANTITY_DESC);
+        when(mapper.scopes("demo","W")).thenReturn(List.of(scope(1,"OUTBOUND",SH,33L),scope(2,"INVENTORY",IH,44L)));
+        var second=at(after).salesSummary(pinned("TODAY",11,22,SH,IH,first.context().queryAsOf(),2),com.baiyue.lastleg.selfoperated.analytics.query.SalesSort.QUANTITY_DESC);
+        assertEquals(D,second.context().anchorDate()); assertEquals(D,second.context().rangeStartDate());
+        assertEquals(D.plusDays(1),second.context().rangeEndDateExclusive()); assertEquals(11L,second.context().salesRunId());
+        verify(mapper,never()).publishedRun(33); verify(mapper,never()).publishedRun(44);
+        var cap=ArgumentCaptor.forClass(AnalyticsSqlRequest.class); verify(mapper,times(2)).page(cap.capture()); assertEquals(20,cap.getValue().offset());
+    }
+    @Test void missingVersionZeroStaysMissingAfterNewPointerAppears(){
+        when(mapper.scopes("demo","W")).thenReturn(List.of(scope(1,"OUTBOUND",SH,0L),scope(2,"INVENTORY",IH,0L)));
+        var first=service.salesSummary(chart("TODAY",null,null,null,null),com.baiyue.lastleg.selfoperated.analytics.query.SalesSort.QUANTITY_DESC); assertEquals(0L,first.context().salesRunId());
+        when(mapper.scopes("demo","W")).thenReturn(List.of(scope(1,"OUTBOUND",SH,11L),scope(2,"INVENTORY",IH,22L)));
+        var second=service.salesSummary(pinned("TODAY",0,0,null,null,NOW,2),com.baiyue.lastleg.selfoperated.analytics.query.SalesSort.QUANTITY_DESC);
+        assertEquals(0L,second.context().inventoryRunId()); assertEquals(0L,second.context().salesRunId()); verify(mapper,never()).publishedRun(anyLong());
+        var cap=ArgumentCaptor.forClass(AnalyticsSqlRequest.class); verify(mapper,times(2)).page(cap.capture());
+        assertEquals(0,cap.getValue().salesRun()); assertEquals(0,cap.getValue().inventoryRun()); assertFalse(cap.getValue().salesKnown());
+    }
+    @Test void hashScopePurposeAndPublicationMustMatch(){
+        assertThrows(BizException.class,()->service.inventoryCoverage(pinned(null,11,22,IH,IH,NOW,1),options()));
+        when(mapper.scopes("demo","W")).thenReturn(List.of(scope(9,"OUTBOUND",SH,11L),scope(2,"INVENTORY",IH,22L)));
+        assertThrows(BizException.class,()->service.inventoryCoverage(metrics(null),options()));
+        when(mapper.scopes("demo","W")).thenReturn(List.of(scope(1,"OUTBOUND",SH,11L),scope(2,"INVENTORY",IH,22L)));
+        when(mapper.publishedRun(11)).thenReturn(run(11,1,SH,NOW.minusSeconds(3600),null,"READY","BUSINESS","Asia/Shanghai"));
+        assertThrows(BizException.class,()->service.inventoryCoverage(metrics(null),options()));
+        when(mapper.publishedRun(11)).thenReturn(run(11,1,SH,NOW.minusSeconds(3600),null,"PUBLISHED","VALIDATION","Asia/Shanghai"));
+        assertThrows(BizException.class,()->service.inventoryCoverage(metrics(null),options())); verify(mapper,never()).page(any());
+    }
+    @Test void warehouseMismatchAndMissingWarehouseAreRejected(){
+        assertThrows(BizException.class,()->service.inventoryCoverage(new AnalyticsQuery("demo",null,null,null,null,null,null,null,null,1,20,null,null,null,null,null),options()));
+        var foreign=scope(1,"OUTBOUND",SH,11L);
+        when(mapper.scopes("demo","W")).thenReturn(List.of(new Scope(foreign.id(),"demo","OTHER",foreign.dataFamily(),SH,"Asia/Shanghai","Asia/Shanghai",
+            93600,11L,1L,1L,false,foreign.knownOrderRoundFinishedAtUtc(),foreign.historyRoundFinishedAtUtc(),7),scope(2,"INVENTORY",IH,22L)));
+        assertThrows(BizException.class,()->service.inventoryCoverage(metrics(null),options())); verify(mapper,never()).page(any());
+    }
+    @Test void clockBaselineMustNotBeFutureOrBeforePublicationAndPagesNeedContext(){
+        assertThrows(BizException.class,()->service.inventoryCoverage(pinned(null,11,22,SH,IH,NOW.plusSeconds(1),1),options()));
+        assertThrows(BizException.class,()->service.inventoryCoverage(pinned(null,11,22,SH,IH,NOW.minusSeconds(7200),1),options()));
+        assertThrows(BizException.class,()->service.inventoryCoverage(pinned(null,11,22,SH,IH,null,2),options()));
+        assertThrows(BizException.class,()->service.inventoryCoverage(new AnalyticsQuery("demo","W",null,null,null,null,null,null,null,2,20,null,null,null,null,null),options()));
+    }
+    @Test void zeroWinsOverUnknownUnitButDynamicStaleZeroDoesNot(){
+        doAnswer(inv->List.of(inventory(false,"0",inv.getArgument(0,AnalyticsSqlRequest.class).stockFresh(),null,null))).when(mapper).inventoryPage(any(),any());
+        var row=service.inventoryCoverage(metrics(null),options()).records().get(0);
+        assertEquals(n("0.0"),row.inventoryCoverageDays());assertEquals("UNIT_UNKNOWN_OR_CONFLICT",row.salesCoverage());assertFalse(row.observationEligible());
+        when(mapper.publishedRun(22)).thenReturn(run(22,2,IH,NOW.minusSeconds(93500),null,"PUBLISHED","BUSINESS","Asia/Shanghai"));
+        var later=at(NOW.plusSeconds(200)).inventoryCoverage(pinned(null,11,22,SH,IH,NOW,1),options());
+        assertEquals("STALE",later.context().inventoryStatus());assertNull(later.records().get(0).inventoryCoverageDays());assertNull(later.records().get(0).availableQuantity());
+    }
+    @Test void fixedMetricWindowsNeverFollowChartPeriods(){
+        var response=service.inventoryCoverage(metrics(null),options()); var row=response.records().get(0);
+        assertEquals(n("60.0"),row.inventoryCoverageDays()); assertEquals(0,n("5").compareTo(row.averageDailyOutboundQuantity()));
+        assertEquals(n("300"),row.availableQuantity()); assertEquals(n("20"),row.frozenQuantity()); assertEquals(n("30"),row.transitQuantity());
+        assertEquals(D.minusDays(40),row.observedHistoryStartDate());
+        assertEquals(30,response.context().calculationWindowDays()); assertEquals(D.minusDays(30),response.context().rangeStartDate());
+        var hot=service.hotSkus(metrics(7)); assertEquals(7,hot.context().calculationWindowDays()); assertEquals(D.minusDays(7),hot.context().rangeStartDate());
+        assertThrows(BizException.class,()->service.hotSkus(metrics(15)));
+        assertThrows(BizException.class,()->service.inventoryCoverage(metrics(30),options()));
+        assertThrows(BizException.class,()->service.slowSkus(chart("TODAY",null,null,null,null)));
+        assertThrows(BizException.class,()->service.hotSkus(chart("LAST_3_DAYS",null,null,null,null)));
+    }
+    @Test void inventoryTenDayContextAndSqlWindowAreIndependentOfThirtyDayEligibility(){
+        var o=new AnalyticsInventoryOptions(null,null,null,null,null,null,null,null,10,D.minusDays(1));
+        var response=service.inventoryCoverage(metrics(null),o);
+        assertEquals(10,response.context().calculationWindowDays());assertEquals(D.minusDays(10),response.context().rangeStartDate());
+        assertEquals(D,response.context().rangeEndDateExclusive());assertEquals(NOW,response.context().queryAsOf());
+        assertEquals(n("20.0"),response.records().get(0).inventoryCoverageDays());
+        assertEquals(0,n("15").compareTo(response.records().get(0).averageDailyOutboundQuantity()));
+        assertEquals(n("150"),response.records().get(0).windowOutboundQuantity());
+        var captor=ArgumentCaptor.forClass(AnalyticsSqlRequest.class);verify(mapper).inventoryPage(captor.capture(),eq(o));
+        assertEquals(D.minusDays(10),captor.getValue().from());assertEquals(D,captor.getValue().until());assertTrue(captor.getValue().completeWindow());
+        assertThrows(BizException.class,()->service.inventoryCoverage(metrics(null),new AnalyticsInventoryOptions(null,null,null,null,null,null,null,null,10,D)));
+    }
+    @Test void unknownInventoryDoesNotReturnZeroCoverage(){
+        doReturn(List.of(inventory(true,null,true,time(D.minusDays(40)),"150"))).when(mapper).inventoryPage(any(),any());
+        var row=service.inventoryCoverage(metrics(null),options()).records().get(0);
+        assertNull(row.inventoryCoverageDays());assertNull(row.availableQuantity());assertEquals("UNKNOWN",row.inventoryQuality());
+    }
+    @Test void unknownSalesStayUnknownAndConfirmedZeroNeedsNoObservationAge(){
+        doReturn(List.of(inventory(true,"300",true,null,null))).when(mapper).inventoryPage(any(),any());
+        var unknown=service.inventoryCoverage(metrics(null),options()).records().get(0);
+        assertNull(unknown.earliestReliableEvidenceAt());assertFalse(unknown.observationEligible());assertEquals("SALES_UNKNOWN",unknown.status());
+        doReturn(List.of(inventory(true,"300",true,null,"0"))).when(mapper).inventoryPage(any(),any());
+        var zero=service.inventoryCoverage(metrics(null),options()).records().get(0);
+        assertEquals("NO_OUTBOUND_IN_WINDOW",zero.status());assertNull(zero.inventoryCoverageDays());assertEquals(0,zero.averageDailyOutboundQuantity().signum());
+    }
+    @Test void rebuildBarrierKeepsVersionButDisablesTrustedMetrics(){
+        when(mapper.applyBarriers("demo","W")).thenReturn(1L); var result=service.inventoryCoverage(metrics(null),options());
+        assertTrue(result.context().rebuildRequired()); assertEquals("REBUILD_REQUIRED",result.context().salesStatus());
+        assertEquals(11L,result.context().salesRunId()); assertNull(result.records().get(0).inventoryCoverageDays());
+        var cap=ArgumentCaptor.forClass(AnalyticsSqlRequest.class); verify(mapper).inventoryPage(cap.capture(),any());
+        assertFalse(cap.getValue().completeWindow()); assertFalse(cap.getValue().complete30());
+    }
+    @Test void topOneHundredClipsFinalSqlPageAndSkipsBeyondIt(){
+        when(mapper.rankingStats(any())).thenReturn(List.of(new AnalyticsReadMapper.RankingStat(100L,null,0L)));
+        service.hotSkus(new AnalyticsQuery("demo","W",null,null,null,null,null,null,30,2,75,11L,22L,SH,IH,NOW));
+        var cap=ArgumentCaptor.forClass(AnalyticsSqlRequest.class); verify(mapper).page(cap.capture());
+        assertEquals(75,cap.getValue().offset()); assertEquals(25,cap.getValue().size());
+        assertTrue(service.hotSkus(new AnalyticsQuery("demo","W",null,null,null,null,null,null,30,3,50,11L,22L,SH,IH,NOW)).records().isEmpty());
+        verify(mapper,times(1)).page(any());
+        verify(mapper,never()).count(any());
+    }
+    @Test void rankingTotalAndExclusionsUseOneStatisticsQuery(){
+        when(mapper.rankingStats(any())).thenReturn(List.of(new AnalyticsReadMapper.RankingStat(1L,null,0L),
+            new AnalyticsReadMapper.RankingStat(1L,"ZERO_OUTBOUND",7L)));
+        var result=service.hotSkus(metrics(30));assertEquals(1L,result.total());
+        assertEquals(Map.of("ZERO_OUTBOUND",7L),result.excludedReasons());
+        verify(mapper).rankingStats(any());verify(mapper).page(any());verify(mapper,never()).count(any());
+    }
+    @Test void readRunsWithinConsistentSnapshot(){
+        var t=AnalyticsQueryService.class.getAnnotation(Transactional.class); assertTrue(t.readOnly()); assertEquals(Isolation.REPEATABLE_READ,t.isolation());
+    }
+    @Test void overviewPreservesUnknownDenominatorAndDoesNotReadCurrentPage(){
+        Map<String,Object> totals=new HashMap<>();totals.put("sku_count",3L);
+        for(String f:List.of("physical_quantity","available_quantity","frozen_quantity","transit_quantity","defective_physical_quantity","owner_outbound")){
+            totals.put(f+"_known",n("100"));totals.put(f+"_unknown",0L);
+        }
+        totals.put("physical_quantity_unknown",1L);totals.put("physical_sku_known",n("2"));
+        totals.put("no_outbound_count",1L);totals.put("no_outbound_physical",n("40"));totals.put("no_outbound_unknown",1L);
+        totals.put("no_outbound_unknown_physical",n("20"));totals.put("above_threshold_count",0L);totals.put("above_threshold_physical",n("0"));totals.put("above_threshold_unknown",3L);
+        when(mapper.ownerTotals(any(),any())).thenReturn(totals);
+        var q=new AnalyticsQuery("demo","W","C",null,null,null,null,null,null,null,null,null,null,null,null,null);
+        var response=service.ownerOverview(q,options());
+        assertEquals(3L,response.skuCount());assertNull(response.physicalQuantity().overallTotal());assertEquals(n("100"),response.physicalQuantity().knownSubtotal());
+        assertNull(response.noOutbound30d().matchedSkuCount());assertNull(response.noOutbound30d().physicalQuantityRatio());assertEquals(1L,response.noOutbound30d().knownMatchedSkuCount());
+        assertEquals(n("100"),response.outboundQuantity30d().overallTotal());assertEquals(List.of("THRESHOLD_NOT_SET"),response.coverageAboveThreshold().reasonCodes());
+        verify(mapper,never()).page(any());verify(mapper,never()).inventoryPage(any(),any());
+    }
+    @Test void endpointSpecificOptionsRejectNarrowingOverviewAndUnboundedAttention(){
+        var q=new AnalyticsQuery("demo","W","C",null,null,null,null,null,null,null,null,null,null,null,null,null);
+        assertThrows(BizException.class,()->service.ownerOverview(q,new AnalyticsInventoryOptions(null,"ALL",null,null,null,null,null,null,null,null)));
+        assertThrows(BizException.class,()->service.ownerOverview(metrics(null),options()));
+        assertThrows(BizException.class,()->service.inventoryCoverage(metrics(null),new AnalyticsInventoryOptions(null,"COVERAGE_GT_THRESHOLD",null,null,null,null,null,null,null,null)));
+        assertThrows(BizException.class,()->service.inventoryCoverage(metrics(null),new AnalyticsInventoryOptions(null,null,"physical;delete",1,null,null,null,null,null,null)));
+        assertThrows(BizException.class,()->service.inventoryCoverage(metrics(null),new AnalyticsInventoryOptions(null,null,null,0,null,null,null,null,null,null)));
+        verifyNoInteractions(mapper);
+    }
+    @Test void dashboardInventoryUsesExactSelectedDatesInsteadOfDefaultThirtyDays(){
+        var o=new AnalyticsInventoryOptions(null,null,null,null,null,null,"FINITE_POSITIVE","DASHBOARD",null,null);
+        for(int days:List.of(1,7,15,45)){
+            clearInvocations(mapper);
+            var q=new AnalyticsQuery("demo","W",null,null,"CUSTOM",D.minusDays(days),D.minusDays(1),null,null,1,20,11L,22L,SH,IH,NOW);
+            var response=service.inventoryCoverage(q,o);
+            var cap=ArgumentCaptor.forClass(AnalyticsSqlRequest.class);verify(mapper).inventoryPage(cap.capture(),eq(o));
+            assertEquals(D.minusDays(days),cap.getValue().from());assertEquals(D,cap.getValue().until());
+            assertEquals(D.minusDays(days),response.context().rangeStartDate());assertEquals(D,response.context().rangeEndDateExclusive());
+            assertEquals(days,response.context().calculationWindowDays());
+            assertThrows(BizException.class,()->service.inventoryCoverage(q,new AnalyticsInventoryOptions(null,null,null,null,null,null,null,"DASHBOARD",30,null)));
+        }
+        assertThrows(BizException.class,()->service.inventoryCoverage(metrics(null),o));
+    }
+    @Test void dashboardDrilldownRejectsStockExpiryWithinOtherwiseValidContextBeforeReadingRows(){
+        var o=new AnalyticsInventoryOptions(null,null,null,null,"UNKNOWN","COVERAGE_DISTRIBUTION_V1",null,"DASHBOARD",null,null);
+        assertThrows(BizException.class,()->service.inventoryCoverage(metrics(null),o));
+        when(mapper.publishedRun(22)).thenReturn(run(22,2,IH,NOW.minusSeconds(93600),null,"PUBLISHED","BUSINESS","Asia/Shanghai"));
+        var q=new AnalyticsQuery("demo","W",null,null,"CUSTOM",D.minusDays(7),D.minusDays(1),null,null,1,20,11L,22L,SH,IH,NOW.minusSeconds(60));
+        assertEquals("原图库存已过期，请刷新总览",assertThrows(BizException.class,()->service.inventoryCoverage(q,o)).getMessage());
+        verify(mapper,never()).inventoryCount(any(),any());verify(mapper,never()).inventoryPage(any(),any());
+        // Normal inventory diagnostics still return the same fixed but stale version.
+        assertEquals("STALE",service.inventoryCoverage(pinned(null,11,22,SH,IH,NOW.minusSeconds(60),1),options()).context().inventoryStatus());
+    }
+    @Test void completeInventorySalesCalculateWithoutObservationAgeAndRetainTheWarning(){
+        var base=inventory(true,"300",true,time(D.minusDays(10)),"92");
+        var partial=new Inventory(base.customerCode(),base.skuCode(),base.productName(),true,base.evidenceAtUtc(),base.physicalQuantity(),base.availableQuantity(),
+            base.frozenQuantity(),base.transitQuantity(),base.defectivePhysicalQuantity(),base.observedAtUtc(),n("92"),n("92"),base.orderCount(),base.lastOutbound(),false,n("92"),n("97.8"),0,0,false);
+        doReturn(List.of(partial)).when(mapper).inventoryPage(any(),any());
+        var row=service.inventoryCoverage(metrics(null),options()).records().get(0);
+        assertEquals(n("92"),row.observedWindowOutboundQuantity());assertEquals(n("92"),row.windowOutboundQuantity());
+        assertEquals(n("3.066666666667"),row.averageDailyOutboundQuantity());assertEquals(n("97.8"),row.inventoryCoverageDays());
+        assertEquals("VALID",row.status());assertEquals("VALID",row.quantityStatuses().get("windowOutboundQuantity"));
+        assertFalse(row.observationEligible());assertTrue(row.reasonCodes().contains("OBSERVATION_INSUFFICIENT"));assertFalse(row.attentionReasons().contains("UNASSESSABLE"));
+        var json=new ObjectMapper().findAndRegisterModules().valueToTree(row);
+        assertEquals(92,json.get("observedWindowOutboundQuantity").intValue());
+        // Unknown evidence must stay unknown; it is never converted into a collected zero.
+        doReturn(List.of(inventory(true,"300",true,null,null))).when(mapper).inventoryPage(any(),any());
+        assertNull(service.inventoryCoverage(metrics(null),options()).records().get(0).observedWindowOutboundQuantity());
+    }
+    private static AnalyticsInventoryOptions options(){return new AnalyticsInventoryOptions(null,null,null,null,null,null,null,null,null,null);}
+    private static Inventory inventory(boolean unit,String available,boolean fresh,LocalDateTime evidence,String sales){
+        BigDecimal stock=fresh&&available!=null?n(available):null,out=sales==null?null:n(sales);
+        return new Inventory("C","SKU","Product",unit,evidence,fresh?n("120"):null,stock,fresh?n("20"):null,fresh?n("30"):null,
+            fresh?n("0"):null,utc(NOW.minusSeconds(3600)),out,out,10L,D.minusDays(1),evidence!=null,out,null,0,0,out==null||stock==null);
+    }
+    private AnalyticsQueryService at(Instant now){return new AnalyticsQueryService(mapper,new ObjectMapper(),Clock.fixed(now,ZoneOffset.UTC),org.mockito.Mockito.mock(SelfopOwnerDirectory.class));}
+    private static AnalyticsQuery chart(String range,LocalDate from,LocalDate until,String owner,String sku){return new AnalyticsQuery("demo","W",owner,sku,range,from,until,"DAY",null,1,20,null,null,null,null,null);}
+    private static AnalyticsQuery metrics(Integer days){return new AnalyticsQuery("demo","W",null,null,null,null,null,null,days,1,20,null,null,null,null,null);}
+    private static AnalyticsQuery pinned(String range,long sales,long inventory,String sh,String ih,Instant asOf,int page){return new AnalyticsQuery("demo","W",null,null,range,null,null,range==null?null:"DAY",null,page,20,sales,inventory,sh,ih,asOf);}
+    private static BigDecimal n(String v){return new BigDecimal(v);}
+    private static LocalDateTime utc(Instant t){return LocalDateTime.ofInstant(t,ZoneOffset.UTC);}
+    private static LocalDateTime time(LocalDate date){return utc(date.atStartOfDay(ZoneId.of("Asia/Shanghai")).toInstant());}
+    private static Scope scope(long id,String family,String hash,Long run){return new Scope(id,"demo","W",family,hash,"Asia/Shanghai","Asia/Shanghai",93600,run,1L,1L,false,utc(NOW.minusSeconds(86400)),utc(NOW.minusSeconds(86400)),7);}
+    private static Run run(long id,long scope,String hash,Instant observed,Instant superseded,String status,String purpose,String source){
+        String config="{\"businessTimezone\":\"Asia/Shanghai\",\"staleAfterSeconds\":93600,\"sourceTimezone\":"+(source==null?"null":"\""+source+"\"")+"}";
+        return new Run(id,id+100,scope,"demo","W","WAREHOUSE_SYNC",hash,config,status,"COMPLETE",time(D.minusDays(40)),utc(observed),D.minusDays(30),D,
+            utc(observed.minusSeconds(60)),utc(observed),utc(NOW.minusSeconds(3600)),1L,null,null,superseded==null?null:utc(superseded),purpose,true);
+    }
+    private static Profile profile(String unit,String type,LocalDateTime evidence){return new Profile("C","SKU","Product",unit,evidence,evidence,type,1L,1L);}
+    private static Aggregate aggregate(boolean unit,String available,String quality,LocalDateTime evidence){return new Aggregate("C","SKU","Product","PCS",evidence,unit,n("5"),2L,2,1,0,n("150"),10L,n("150"),n("3"),n("120"),n(available),n("20"),n("30"),utc(NOW.minusSeconds(3600)),quality,null);}
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/query/AnalyticsReadMapperTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/query/AnalyticsReadMapperTest.java
new file mode 100644
index 000000000..7cc649ad1
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/query/AnalyticsReadMapperTest.java
@@ -0,0 +1,173 @@
+package com.baiyue.lastleg.selfoperated.analytics.query;
+
+import org.apache.ibatis.annotations.Mapper;
+import org.apache.ibatis.mapping.BoundSql;
+import org.apache.ibatis.mapping.SqlCommandType;
+import org.apache.ibatis.session.Configuration;
+import org.junit.jupiter.api.Test;
+import java.time.*;
+import java.util.*;
+import static org.junit.jupiter.api.Assertions.*;
+
+/** MyBatis parses providers and binds parameters; no database or SQL execution. */
+class AnalyticsReadMapperTest {
+    private static final String NS=AnalyticsReadMapper.class.getName()+".";
+    private static Configuration config(){var c=new Configuration(); c.setMapUnderscoreToCamelCase(true); c.addMapper(AnalyticsReadMapper.class); return c;}
+    private static AnalyticsSqlRequest request(String kind){
+        LocalDate d=LocalDate.of(2026,10,12);
+        return new AnalyticsSqlRequest("demo","W","OWNER","Exact-SKU",11,22,d.minusDays(2),d.plusDays(1),d,d.minusDays(7),
+            d.minusDays(30),d,LocalDateTime.of(2026,9,11,16,0),LocalDateTime.of(2026,10,12,3,0),true,true,true,true,true,20,20,kind,java.util.List.of());
+    }
+    private static BoundSql bound(Configuration c,String method,Map<String,Object> parameters){return c.getMappedStatement(NS+method).getBoundSql(parameters);}
+    private static void immutableOnly(String sql){
+        assertFalse(sql.contains("ll_selfop_outbound_order")); assertFalse(sql.contains("ll_selfop_outbound_item")); assertFalse(sql.contains("ll_selfop_sync_stage"));
+        assertFalse(sql.contains("${")); assertFalse(sql.contains("Exact-SKU")); assertFalse(sql.contains("OWNER"));
+    }
+    @Test void quantityOrderingIsAppliedBeforePaginationAndKeepsUnknownLast(){
+        for(var sort:SalesSort.values()){
+            var sql=bound(config(),"salesPage",Map.of("p",request("SUMMARY"),"salesSort",sort)).getSql();
+            String direction=sort==SalesSort.QUANTITY_ASC?"ASC":"DESC";
+            assertTrue(sql.contains("sort_observed_quantity IS NULL,sort_observed_quantity "+direction));
+            assertTrue(sql.contains("ORDER BY observed_quantity IS NULL,observed_quantity "+direction));
+            assertTrue(sql.indexOf("sort_observed_quantity "+direction)<sql.indexOf("LIMIT"));
+        }
+    }
+    @Test void allMapperStatementsAreSelectAndProvidersBindTheNamedRecord(){
+        var c=config(); assertNotNull(AnalyticsReadMapper.class.getAnnotation(Mapper.class));
+        for(String method:List.of("scopes","publishedRun","page","count","rankingStats","profile","daily","applyBarriers")){
+            var statement=c.getMappedStatement(NS+method); assertEquals(SqlCommandType.SELECT,statement.getSqlCommandType());
+            Map<String,Object> params=new HashMap<>(); params.put("p",request("HOT")); params.put("id",11L); params.put("run",11L);
+            params.put("account","demo"); params.put("warehouse","W"); params.put("customer","OWNER"); params.put("sku","Exact-SKU");
+            params.put("from",LocalDate.of(2026,10,10)); params.put("until",LocalDate.of(2026,10,13));
+            immutableOnly(statement.getBoundSql(params).getSql());
+        }
+        var b=bound(c,"page",Map.of("p",request("HOT")));
+        var names=b.getParameterMappings().stream().map(org.apache.ibatis.mapping.ParameterMapping::getProperty).toList();
+        for(String property:List.of("p.account","p.warehouse","p.customer","p.sku","p.salesRun","p.inventoryRun","p.anchor","p.from","p.until","p.size","p.offset"))assertTrue(names.contains(property),property);
+        var summaryNames=bound(c,"page",Map.of("p",request("SUMMARY"))).getParameterMappings().stream()
+            .map(org.apache.ibatis.mapping.ParameterMapping::getProperty).toList();
+        for(String property:List.of("p.from","p.until"))assertTrue(summaryNames.contains(property),property);
+        assertFalse(b.getSql().contains("#{"));
+        assertEquals(AnalyticsReadRows.Aggregate.class,c.getMappedStatement(NS+"page").getResultMaps().get(0).getType());
+    }
+    @Test void exactDailySqlFiltersEveryIdentityVersionAndHalfOpenDateBeforeAscendingAxis(){
+        var c=config(); var b=bound(c,"daily",Map.of("run",11L,"account","demo","warehouse","W","customer","OWNER","sku","Exact-SKU",
+            "from",LocalDate.of(2026,10,10),"until",LocalDate.of(2026,10,13)));
+        String sql=b.getSql();
+        for(String fragment:List.of("sales_run_id=?","source_account=?","warehouse_code=?","customer_code=?","sku_code=?","business_date>=?","business_date<?"))assertTrue(sql.contains(fragment),fragment);
+        assertTrue(sql.endsWith("ORDER BY business_date")); assertFalse(sql.contains("LIMIT")); assertFalse(sql.contains("DATE(business_date)"));
+        assertEquals(AnalyticsReadRows.Daily.class,c.getMappedStatement(NS+"daily").getResultMaps().get(0).getType());
+        immutableOnly(sql);
+    }
+    @Test void summaryCandidateUnionCountDoesNotReadDailyAndPageOnlyScansSelectedWindow(){
+        var c=config(); var parameters=Map.<String,Object>of("p",request("SUMMARY"));
+        String count=bound(c,"count",parameters).getSql();
+        assertTrue(count.contains(" UNION SELECT customer_code,sku_code")); assertFalse(count.contains("UNION ALL"));
+        assertFalse(count.contains("ll_selfop_sku_daily_sales")); assertFalse(count.contains("ll_selfop_inventory_snapshot"));
+        String page=bound(c,"page",parameters).getSql();
+        assertTrue(page.contains("d.sales_run_id=?")); assertTrue(page.contains("d.business_date>=CAST(? AS DATE) AND d.business_date<CAST(? AS DATE)"));
+        assertTrue(page.contains("GROUP BY d.customer_code,d.sku_code")); assertFalse(page.contains("business_date>=DATE_SUB"));
+        assertFalse(page.contains("ll_selfop_inventory_snapshot"));
+        assertFalse(page.contains("metric_sales"));assertFalse(page.contains("FROM bounds WHERE 1=0"));
+        assertTrue(page.contains("bounds AS (SELECT evidence.*,"));
+        assertTrue(page.contains("counted AS (SELECT /*+ NO_MERGE(b) */ b.*,"));
+        assertTrue(page.endsWith("ORDER BY observed_quantity IS NULL,observed_quantity DESC,sku_code ASC,customer_code ASC"));
+        assertTrue(page.contains("paged_keys AS (SELECT * FROM rankable ORDER BY sort_observed_quantity IS NULL,sort_observed_quantity DESC,sku_code ASC,customer_code ASC LIMIT ? OFFSET ?)"));
+        assertTrue(page.indexOf("GROUP BY d.customer_code,d.sku_code")<page.indexOf("LIMIT"));
+        assertTrue(page.indexOf("LIMIT")<page.indexOf("bounds AS"));
+        assertEquals(page.indexOf("LIMIT"),page.lastIndexOf("LIMIT"));
+        assertTrue(page.contains("FROM paged_keys evidence)"));
+        assertTrue(page.contains("FROM paged_keys k JOIN ll_selfop_sku_daily_sales d ON d.customer_code=k.customer_code AND d.sku_code=k.sku_code"));
+        String sorting=page.substring(page.indexOf("sort_sales AS"),page.indexOf("bounds AS"));
+        assertFalse(sorting.contains("outbound_order_count"));assertFalse(sorting.contains("actual_complete"));
+        assertTrue(sorting.contains("AND ?=1 AND (COALESCE(s.actual_days,0)>0 OR"));
+        assertFalse(page.contains("FROM bounds b JOIN ll_selfop_sku_daily_sales"));
+        assertTrue(page.contains("d2.customer_code=b.customer_code AND d2.sku_code=b.sku_code"));
+        assertTrue(page.contains("d2.sales_run_id=? AND d2.source_account=? AND d2.warehouse_code=?"));
+        immutableOnly(page);
+    }
+    @Test void metricsPreFilterQualityAndStableSortAggregatesBeforePagination(){
+        var c=config();
+        for(String kind:List.of("HOT","SLOW","INVENTORY")){
+            var p=Map.<String,Object>of("p",request(kind)); String sql=bound(c,"page",p).getSql();
+            assertTrue(sql.contains("st.snapshot_run_id=?")); assertTrue(sql.contains("st.source_account=?")); assertTrue(sql.contains("st.warehouse_code=?"));
+            assertTrue(sql.contains("AND st.product_quality=0"));
+            if("HOT".equals(kind))assertTrue(sql.contains("business_date>=LEAST(CAST(? AS DATE),TIMESTAMPADD(DAY,-30,CAST(? AS DATE))) AND business_date<GREATEST(CAST(? AS DATE),TIMESTAMPADD(DAY,1,CAST(? AS DATE)))"));
+            else if("SLOW".equals(kind))assertTrue(sql.contains("business_date>=LEAST(CAST(? AS DATE),TIMESTAMPADD(DAY,-30,CAST(? AS DATE))) AND business_date<TIMESTAMPADD(DAY,1,CAST(? AS DATE))"));
+            else assertTrue(sql.contains("business_date>=TIMESTAMPADD(DAY,-30,CAST(? AS DATE)) AND business_date<TIMESTAMPADD(DAY,1,CAST(? AS DATE))"));
+            assertTrue(sql.contains("GROUP BY customer_code,sku_code"));
+            assertTrue(sql.indexOf("GROUP BY customer_code,sku_code")<sql.indexOf("LEFT JOIN ll_selfop_inventory_snapshot"));
+            if("HOT".equals(kind))assertTrue(sql.indexOf("LIMIT ? OFFSET ?")<sql.indexOf("LEFT JOIN ll_selfop_inventory_snapshot"));
+            else assertTrue(sql.endsWith("LIMIT ? OFFSET ?")); immutableOnly(sql);
+        }
+        String hot=bound(c,"page",Map.of("p",request("HOT"))).getSql();
+        assertTrue(hot.contains("FROM result WHERE window_quantity>0 ORDER BY window_quantity DESC,window_sku_order_count DESC,sku_code ASC,customer_code ASC LIMIT"));
+        String slow=bound(c,"page",Map.of("p",request("SLOW"))).getSql();
+        assertTrue(slow.contains("inventory_quality='VALID' AND available_quantity>0"));
+        assertTrue(slow.contains("evidence_at_utc<=CONVERT_TZ"));
+        assertTrue(slow.contains("ORDER BY window_quantity ASC,available_quantity DESC,sku_code ASC,customer_code ASC LIMIT"));
+        for(String kind:List.of("HOT","SLOW")){
+            String stats=bound(c,"rankingStats",Map.of("p",request(kind))).getSql();
+            assertTrue(stats.contains("LEAST(SUM(CASE WHEN eligible=1 THEN amount ELSE 0 END) OVER (),100) total"));
+            assertTrue(stats.contains("excluded_count"));assertFalse(stats.contains(" LIMIT "));
+            assertFalse(stats.contains("ranged AS"));assertFalse(stats.contains("TIMESTAMPDIFF"));
+            if("HOT".equals(kind))assertFalse(stats.contains("ll_selfop_inventory_snapshot"));
+        }
+    }
+    @Test void stockFirstHistoryLookupRetainsCorrelatedScopeAndReverseIndexOrder(){
+        var c=config();var p=request("INVENTORY");var o=new AnalyticsInventoryOptions(null,"ALL","AVAILABLE_DESC",null,null,null,null,null,null,null);
+        String sql=bound(c,"inventoryPage",Map.of("p",p,"o",o)).getSql();
+        assertFalse(sql.contains("last_sales AS"));assertFalse(sql.contains("JOIN last_sales"));
+        assertTrue(sql.contains("d.customer_code=k.customer_code AND d.sku_code=k.sku_code"));
+        assertTrue(sql.contains("d.sales_run_id=? AND d.source_account=? AND d.warehouse_code=?"));
+        assertTrue(sql.contains("d.outbound_quantity>0 AND d.quantity_unit='PCS' ORDER BY d.customer_code DESC,d.sku_code DESC,d.business_date DESC LIMIT 1"));
+        assertTrue(sql.indexOf("stock_paged AS")<sql.indexOf("ORDER BY d.customer_code DESC"));
+        immutableOnly(sql);
+    }
+    @Test void inventoryHistoryOnlyEnrichesQualifiedPageAndNeverCountsOrOwnerTotals(){
+        var c=config();var p=request("INVENTORY");var o=new AnalyticsInventoryOptions(null,"COVERAGE_GT_THRESHOLD","PHYSICAL_DESC",90,null,null,null,null,null,null);
+        String page=bound(c,"inventoryPage",Map.of("p",p,"o",o)).getSql();
+        assertTrue(page.contains("paged AS (SELECT * FROM result WHERE above_threshold=1 ORDER BY"));
+        assertTrue(page.indexOf("LIMIT ? OFFSET ?")<page.indexOf("last_sales AS"));
+        assertTrue(page.contains("JOIN paged k ON k.customer_code=d.customer_code AND k.sku_code=d.sku_code"));
+        assertTrue(page.contains("d.sales_run_id=? AND d.source_account=? AND d.warehouse_code=?"));
+        assertFalse(bound(c,"inventoryCount",Map.of("p",p,"o",o)).getSql().contains("last_sales"));
+        assertFalse(bound(c,"ownerTotals",Map.of("p",p,"o",o)).getSql().contains("last_sales"));
+        immutableOnly(page);
+    }
+    @Test void distributionCountCannotUseUnfilteredKeysAndStockOnlyCountSkipsSales(){
+        var c=config();var p=request("INVENTORY");
+        for(var o:List.of(new AnalyticsInventoryOptions(null,null,null,null,"DAYS_0_30","COVERAGE_DISTRIBUTION_V1",null,null,null,null),
+            new AnalyticsInventoryOptions(null,null,null,null,null,null,"FINITE_POSITIVE",null,null,null))){
+            String count=bound(c,"inventoryCount",Map.of("p",p,"o",o)).getSql();
+            assertTrue(count.contains("FROM result WHERE"));assertTrue(count.contains("ll_selfop_sku_daily_sales"));
+        }
+        for(String attention:List.of("FROZEN_STOCK","DEFECTIVE_STOCK")){
+            String count=bound(c,"inventoryCount",Map.of("p",p,"o",new AnalyticsInventoryOptions(null,attention,null,null,null,null,null,null,null,null))).getSql();
+            assertFalse(count.contains("ll_selfop_sku_daily_sales"));assertTrue(count.contains("i.quantity_unit='PCS'"));
+            assertTrue(count.contains("snapshot_run_id=?"));assertTrue(count.contains("st.amount>0"));
+        }
+    }
+    @Test void observationAndUnitsRequireImmutableProofAndPcsNotFirstSeenOrStockPlaceholders(){
+        String sql=bound(config(),"page",Map.of("p",request("INVENTORY"))).getSql();
+        assertTrue(sql.contains("s.evidence_type='VALID_OUTBOUND' AND s.evidence_run_id IS NOT NULL"));
+        assertTrue(sql.contains("i.evidence_type='INVENTORY_OBSERVATION' AND i.evidence_run_id IS NOT NULL"));
+        assertFalse(sql.contains("first_seen_at_utc")); assertTrue(sql.contains("COALESCE(s.quantity_unit,i.quantity_unit)<>'PCS'"));
+        assertTrue(sql.contains("s.quantity_unit<>i.quantity_unit"));
+        // Comparing timestamps before DATE projection prevents 16:00 evidence from
+        // turning an 08:00 covered-until on the same day into an observed zero.
+        assertTrue(sql.contains("AND GREATEST(evidence_at_utc,CAST(? AS DATETIME))<CAST(? AS DATETIME) THEN GREATEST(CAST(? AS DATE),DATE("));
+        assertTrue(sql.contains("evidence_at_utc IS NOT NULL AND CAST(? AS DATETIME) IS NOT NULL AND CAST(? AS DATETIME) IS NOT NULL"));
+        assertTrue(sql.contains("CASE WHEN c.unit_valid=1 AND c.observed_count>0 THEN COALESCE(c.observed_sum,0) END observed_quantity"));
+        assertTrue(sql.contains("WHEN ?=0 THEN 'STALE'"));
+        assertTrue(sql.contains("st.available_quantity<0")); assertTrue(sql.contains("st.available_quantity IS NULL"));
+    }
+    @Test void publishedRunRejectsValidationAndAccountDiscoveryAndBarrierSurvivesDeadTask(){
+        var c=config(); String run=bound(c,"publishedRun",Map.of("id",11L)).getSql();
+        assertTrue(run.startsWith("SELECT id,task_id,scope_id,")); assertTrue(run.contains("status='PUBLISHED'"));
+        assertTrue(run.contains("run_role='WAREHOUSE_SYNC'")); assertTrue(run.contains("execution_purpose='BUSINESS'"));
+        assertEquals(AnalyticsReadRows.Run.class,c.getMappedStatement(NS+"publishedRun").getResultMaps().get(0).getType());
+        String barrier=bound(c,"applyBarriers",Map.of("account","demo","warehouse","W")).getSql();
+        assertTrue(barrier.contains("'APPLYING','BLOCKED'")); assertTrue(barrier.contains("JSON_CONTAINS")); assertFalse(barrier.contains("status="));
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/query/AnalyticsSqlSemanticTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/query/AnalyticsSqlSemanticTest.java
new file mode 100644
index 000000000..f158c6540
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/query/AnalyticsSqlSemanticTest.java
@@ -0,0 +1,604 @@
+package com.baiyue.lastleg.selfoperated.analytics.query;
+
+import org.apache.ibatis.datasource.unpooled.UnpooledDataSource;
+import org.apache.ibatis.mapping.Environment;
+import org.apache.ibatis.session.*;
+import org.apache.ibatis.transaction.jdbc.JdbcTransactionFactory;
+import org.junit.jupiter.api.*;
+import java.math.BigDecimal;
+import java.sql.*;
+import java.time.*;
+import java.util.*;
+import static org.junit.jupiter.api.Assertions.*;
+
+/** Executes the production provider SQL on synthetic, process-local H2 tables only.
+ * H2's CONVERT_TZ is supplied with explicit offsets. Its repeatedly referenced CTE prepared
+ * plan loses parameter values, so page SQL uses typed, escaped fixture literals from the
+ * original BoundSql mappings. Candidate counts and separate binding contracts remain prepared.
+ * No external database, credentials or HTTP; MySQL plans/performance remain separate gates. */
+public class AnalyticsSqlSemanticTest {
+    @Test void frozenDisconnectedDaysPreserveZeroDayAndUnknownGapInSummarySql() throws Exception {
+        profile(11,"C","SKU","VALID_OUTBOUND",utc(D.minusDays(40),0),"PCS");
+        daily(11,"W","C","SKU",D,"12");
+        var coverage=List.of(new com.baiyue.lastleg.selfoperated.analytics.model.SelfopSalesCoverage.Interval(utc(D.minusDays(5),0),utc(D.minusDays(4),0)),
+            new com.baiyue.lastleg.selfoperated.analytics.model.SelfopSalesCoverage.Interval(utc(D,0),utc(D.plusDays(1),0)));
+        var p=new AnalyticsSqlRequest("demo","W",null,null,11,22,D.minusDays(5),D.plusDays(1),D.plusDays(1),D.minusDays(30),D.minusDays(5),D.minusDays(4),
+            utc(D.minusDays(5),0),utc(D.minusDays(4),0),true,true,false,false,false,0,20,"SUMMARY",coverage);
+        var result=page(p).get(0);assertEquals(2,result.completeDayCount());assertEquals(0,result.partialDayCount());assertEquals(4,result.unknownDayCount());
+        assertEquals(0,new BigDecimal("12").compareTo(result.observedQuantity()));
+    }
+    private Connection schema;
+    private SqlSession session;
+    private AnalyticsReadMapper mapper;
+    private Configuration configuration;
+    private int statementSequence;
+    private long nextId=1;
+    private static final LocalDate D=LocalDate.of(2026,10,12);
+    @BeforeEach void setup() throws Exception {
+        String url="jdbc:h2:mem:selfop_query_"+UUID.randomUUID().toString().replace("-","")+";MODE=MySQL";
+        var ds=new UnpooledDataSource("org.h2.Driver",url,"sa","");
+        schema=ds.getConnection();
+        try(var statement=schema.createStatement()) {
+            statement.execute("CREATE ALIAS CONVERT_TZ FOR 'com.baiyue.lastleg.selfoperated.analytics.query.AnalyticsSqlSemanticTest.convertZone'");
+            statement.execute("CREATE TABLE ll_selfop_sku_profile(profile_run_id BIGINT,source_account VARCHAR(64),warehouse_code VARCHAR(64),customer_code VARCHAR(64),sku_code VARCHAR(128),product_name VARCHAR(255),quantity_unit VARCHAR(32),evidence_type VARCHAR(24),evidence_run_id BIGINT,earliest_evidence_at_utc TIMESTAMP)");
+            statement.execute("CREATE TABLE ll_selfop_sku_daily_sales(id BIGINT,sales_run_id BIGINT,source_account VARCHAR(64),warehouse_code VARCHAR(64),customer_code VARCHAR(64),sku_code VARCHAR(128),business_date DATE,outbound_quantity DECIMAL(20,6),outbound_order_count BIGINT,quantity_unit VARCHAR(32))");
+            statement.execute("CREATE TABLE ll_selfop_inventory_snapshot(snapshot_run_id BIGINT,source_account VARCHAR(64),warehouse_code VARCHAR(64),customer_code VARCHAR(64),sku_code VARCHAR(128),product_quality INTEGER,physical_quantity DECIMAL(20,6),available_quantity DECIMAL(20,6),frozen_quantity DECIMAL(20,6),transit_quantity DECIMAL(20,6),observed_at_utc TIMESTAMP,quality_status VARCHAR(16),quality_reason VARCHAR(64))");
+        }
+        configuration=new Configuration(new Environment("synthetic",new JdbcTransactionFactory(),ds));
+        configuration.setMapUnderscoreToCamelCase(true);configuration.addMapper(AnalyticsReadMapper.class);
+        session=new SqlSessionFactoryBuilder().build(configuration).openSession();mapper=session.getMapper(AnalyticsReadMapper.class);
+    }
+    @AfterEach void close() throws Exception {if(session!=null)session.close();if(schema!=null)schema.close();}
+    public static LocalDateTime convertZone(LocalDateTime value,String from,String to) {
+        return value==null?null:value.atOffset(ZoneOffset.of(from)).withOffsetSameInstant(ZoneOffset.of(to)).toLocalDateTime();
+    }
+    @Test void skuOrderedCoverHintIsLimitedToExactly366DaySummary() {
+        for(int days:List.of(1,7,30,365,366,367)) {
+            var p=request("SUMMARY",D.minusDays(days),D,null,null,utc(D,8),0,20);
+            String sql=AnalyticsReadSql.page(Map.of("p",p));
+            String hint="/*+ INDEX(d idx_selfop_daily_sku_cover) */";
+            assertEquals(days==366,sql.contains(hint),"window="+days);
+            if(days==366) {
+                assertTrue(sql.contains("sort_sales AS (SELECT "+hint+" d.customer_code"));
+                assertEquals(sql.indexOf(hint),sql.lastIndexOf(hint));
+            }
+            assertFalse(AnalyticsReadSql.count(Map.of("p",p)).contains("INDEX("));
+        }
+        for(String kind:List.of("HOT","SLOW","INVENTORY")) {
+            var p=request(kind,D.minusDays(366),D,null,null,utc(D,8),0,20);
+            assertFalse(AnalyticsReadSql.page(Map.of("p",p)).contains("INDEX("),kind);
+        }
+    }
+    @Test void hinted366DaySummaryPreservesSparseZeroUnknownAndDateBoundaries() throws Exception {
+        LocalDate from=D.minusDays(365),until=D.plusDays(1);
+        profile(11,"C","SOLD","VALID_OUTBOUND",utc(from,0),"PCS");
+        profile(22,"C","ZERO","INVENTORY_OBSERVATION",utc(from,0),"PCS");
+        profile(22,"C","UNKNOWN","NONE",null,"PCS");
+        daily(11,"W","C","SOLD",from,"2");daily(11,"W","C","SOLD",D,"3");
+        daily(11,"W","C","SOLD",from.minusDays(1),"999");daily(11,"W","C","SOLD",until,"999");
+        daily(33,"W","C","SOLD",from,"999");daily(11,"OTHER","C","SOLD",from,"999");
+        var p=new AnalyticsSqlRequest("demo","W",null,null,11,22,from,until,D,D.minusDays(30),from,D,
+            utc(from,0),utc(D,8),true,true,false,true,true,0,20,"SUMMARY",java.util.List.of());
+        assertEquals(3,mapper.count(p));var rows=page(p);assertEquals(3,rows.size());
+        var sold=rows.get(0);assertEquals("SOLD",sold.skuCode());assertDecimal("5",sold.observedQuantity());
+        assertEquals(2L,sold.skuOrderCount());assertEquals(365,sold.completeDayCount());
+        assertEquals(1,sold.partialDayCount());assertEquals(0,sold.unknownDayCount());
+        var zero=rows.get(1);assertEquals("ZERO",zero.skuCode());assertDecimal("0",zero.observedQuantity());
+        assertEquals(365,zero.completeDayCount());assertEquals(1,zero.partialDayCount());
+        var unknown=rows.get(2);assertEquals("UNKNOWN",unknown.skuCode());assertNull(unknown.observedQuantity());
+        assertEquals(0,unknown.completeDayCount());assertEquals(0,unknown.partialDayCount());assertEquals(366,unknown.unknownDayCount());
+    }
+    @Test void sqlReturnsTwoCompleteDaysAndTodayPartialObservedFive() throws Exception {
+        profile(11,"C","SKU","VALID_OUTBOUND",utc(D.minusDays(40),0),"PCS");
+        profile(22,"C","SKU","INVENTORY_OBSERVATION",utc(D.minusDays(35),0),"PCS");
+        daily(11,"W","C","SKU",D.minusDays(2),"2");daily(11,"W","C","SKU",D,"3");
+        var p=request("SUMMARY",D.minusDays(2),D.plusDays(1),null,null,utc(D,8),0,20);
+        assertEquals(1,mapper.count(p));var row=page(p).get(0);
+        assertEquals(0,new BigDecimal("5").compareTo(row.observedQuantity()));
+        assertEquals(2,row.completeDayCount());assertEquals(1,row.partialDayCount());assertEquals(0,row.unknownDayCount());
+    }
+    @Test void summaryPageFirstPreservesTiesNullUnitsZeroAndExactScope() throws Exception {
+        for(String owner:List.of("A","B")){
+            profile(11,owner,"TIE","VALID_OUTBOUND",utc(D.minusDays(40),0),"PCS");
+            daily(11,"W",owner,"TIE",D.minusDays(1),"5");
+        }
+        profile(22,"C","ZERO","INVENTORY_OBSERVATION",utc(D.minusDays(40),0),"PCS");
+        profile(22,"C","UNKNOWN","NONE",null,"PCS");
+        profile(11,"C","MIXED","VALID_OUTBOUND",utc(D.minusDays(40),0),"PCS");
+        daily(11,"W","C","MIXED",D.minusDays(1),"900");daily(11,"W","C","MIXED",D,"900");
+        profile(11,"C","NULL-UNIT","VALID_OUTBOUND",utc(D.minusDays(40),0),null);
+        daily(11,"W","C","NULL-UNIT",D,"800");
+        profile(22,"C","OUTSIDE","INVENTORY_OBSERVATION",utc(D.minusDays(40),0),"PCS");
+        profile(99,"C","OTHER-VERSION","VALID_OUTBOUND",utc(D.minusDays(40),0),"PCS");
+        daily(11,"W","C","NO-PROFILE",D,"9999");
+        daily(99,"W","A","TIE",D,"9999");daily(11,"OTHER","A","TIE",D,"9999");
+        daily(11,"W","A","TIE",D.plusDays(1),"9999");
+        try(var s=schema.createStatement()){
+            s.executeUpdate("UPDATE ll_selfop_sku_daily_sales SET quantity_unit='BOX' WHERE sku_code='MIXED' AND business_date=DATE '2026-10-12'");
+            s.executeUpdate("UPDATE ll_selfop_sku_profile SET warehouse_code='OTHER' WHERE sku_code='OUTSIDE'");
+        }
+        var p=request("SUMMARY",D.minusDays(1),D.plusDays(1),null,null,utc(D,8),0,2);
+        assertEquals(6,mapper.count(p));
+        assertEquals(List.of("A/TIE","B/TIE"),page(p).stream().map(r->r.customerCode()+"/"+r.skuCode()).toList());
+        var second=page(request("SUMMARY",D.minusDays(1),D.plusDays(1),null,null,utc(D,8),2,2));
+        assertEquals(List.of("ZERO","MIXED"),second.stream().map(AnalyticsReadRows.Aggregate::skuCode).toList());
+        assertDecimal("0",second.get(0).observedQuantity());assertNull(second.get(1).observedQuantity());
+        assertFalse(second.get(1).unitValid());assertEquals(2,second.get(1).unknownDayCount());
+        var last=page(request("SUMMARY",D.minusDays(1),D.plusDays(1),null,null,utc(D,8),4,2));
+        assertEquals(List.of("NULL-UNIT","UNKNOWN"),last.stream().map(AnalyticsReadRows.Aggregate::skuCode).toList());
+        assertTrue(last.stream().allMatch(r->r.observedQuantity()==null));
+        assertTrue(page(request("SUMMARY",D.minusDays(1),D.plusDays(1),null,null,utc(D,8),6,2)).isEmpty());
+        var scoped=page(request("SUMMARY",D.minusDays(1),D.plusDays(1),"B","TIE",utc(D,8),0,2));
+        assertEquals(1,scoped.size());assertDecimal("5",scoped.get(0).observedQuantity());
+    }
+    @Test void summaryPageFirstCountsIntersectionAndActualDaysOutsideEvidenceOnlyOnSelectedPage() throws Exception {
+        profile(11,"C","LATE","VALID_OUTBOUND",utc(D.minusDays(1),12),"PCS");
+        daily(11,"W","C","LATE",D.minusDays(2),"2");daily(11,"W","C","LATE",D,"3");
+        profile(22,"C","NO-PROOF","NONE",null,"PCS");daily(11,"W","C","NO-PROOF",D,"9");
+        profile(22,"C","ZERO","INVENTORY_OBSERVATION",utc(D.minusDays(1),12),"PCS");
+        var rows=page(request("SUMMARY",D.minusDays(2),D.plusDays(1),null,null,utc(D,8),1,1));
+        assertEquals(1,rows.size());var late=rows.get(0);assertEquals("LATE",late.skuCode());
+        assertDecimal("5",late.observedQuantity());assertEquals(2L,late.skuOrderCount());
+        assertEquals(1,late.completeDayCount());assertEquals(2,late.partialDayCount());assertEquals(0,late.unknownDayCount());
+        var noProof=page(request("SUMMARY",D.minusDays(2),D.plusDays(1),null,null,utc(D,8),0,1)).get(0);
+        assertEquals("NO-PROOF",noProof.skuCode());assertDecimal("9",noProof.observedQuantity());
+        assertEquals(0,noProof.completeDayCount());assertEquals(1,noProof.partialDayCount());assertEquals(2,noProof.unknownDayCount());
+        var zero=page(request("SUMMARY",D.minusDays(2),D.plusDays(1),null,null,utc(D,8),2,1)).get(0);
+        assertEquals("ZERO",zero.skuCode());assertDecimal("0",zero.observedQuantity());
+        assertEquals(0,zero.completeDayCount());assertEquals(2,zero.partialDayCount());assertEquals(1,zero.unknownDayCount());
+    }
+    @Test void summaryPageFirstNeverSortsUnknownSalesOrDisjointCoverageAsKnownZero() throws Exception {
+        profile(22,"C","A-UNKNOWN","NONE",null,"PCS");
+        profile(22,"C","Z-EVIDENCE","INVENTORY_OBSERVATION",utc(D,0),"PCS");
+        for(LocalDateTime[] span:List.of(
+            new LocalDateTime[]{utc(D,0),utc(D,0)},
+            new LocalDateTime[]{utc(D,8),utc(D,0)},
+            new LocalDateTime[]{utc(D.minusDays(2),0),utc(D,0)},
+            new LocalDateTime[]{utc(D.plusDays(1),0),utc(D.plusDays(2),0)},
+            new LocalDateTime[]{null,utc(D,8)})){
+            var p=new AnalyticsSqlRequest("demo","W",null,null,11,22,D,D.plusDays(1),D,D.minusDays(30),null,null,
+                span[0],span[1],true,false,false,false,true,0,1,"SUMMARY",java.util.List.of());
+            var first=page(p).get(0);assertEquals("A-UNKNOWN",first.skuCode());assertNull(first.observedQuantity());
+            var last=new AnalyticsSqlRequest("demo","W",null,null,11,22,D,D.plusDays(1),D,D.minusDays(30),null,null,
+                span[0],span[1],true,false,false,false,true,1,1,"SUMMARY",java.util.List.of());
+            assertNull(page(last).get(0).observedQuantity());
+        }
+        daily(11,"W","C","Z-EVIDENCE",D,"99");
+        var unavailable=new AnalyticsSqlRequest("demo","W",null,null,11,22,D,D.plusDays(1),D,D.minusDays(30),null,null,
+            utc(D,0),utc(D,8),false,false,false,false,true,0,1,"SUMMARY",java.util.List.of());
+        var first=page(unavailable).get(0);assertEquals("A-UNKNOWN",first.skuCode());assertNull(first.observedQuantity());
+    }
+    @Test void evidenceAfterCoveredTimeOnSameDayDoesNotBecomeObservedZero() throws Exception {
+        profile(22,"C","LATE","INVENTORY_OBSERVATION",utc(D,16),"PCS");
+        profile(22,"C","NO-EVIDENCE","NONE",null,"PCS");
+        var rows=page(request("SUMMARY",D,D.plusDays(1),null,null,utc(D,8),0,20));
+        var unknown=rows.stream().filter(r->"NO-EVIDENCE".equals(r.skuCode())).findFirst().orElseThrow();
+        assertNull(unknown.observedQuantity());assertEquals(1,unknown.unknownDayCount());
+        var row=rows.stream().filter(r->"LATE".equals(r.skuCode())).findFirst().orElseThrow();
+        assertNull(row.observedQuantity());assertEquals(0,row.completeDayCount());assertEquals(0,row.partialDayCount());assertEquals(1,row.unknownDayCount());
+        // A real confirmed row outside the continuous watermark is still observed, never complete today.
+        daily(11,"W","C","LATE",D,"3");session.clearCache();
+        row=page(request("SUMMARY",D,D.plusDays(1),null,null,utc(D,8),0,20)).get(0);
+        assertEquals(0,new BigDecimal("3").compareTo(row.observedQuantity()));assertEquals(1,row.partialDayCount());
+    }
+    @Test void intervalSortingIncludesZeroCandidatesBeforePagingAndNeverMergesOwners() throws Exception {
+        for(String owner:List.of("A","B","C"))profile(22,owner,"SAME","INVENTORY_OBSERVATION",utc(D.minusDays(40),0),"PCS");
+        daily(11,"W","A","SAME",D.minusDays(1),"2");daily(11,"W","B","SAME",D.minusDays(1),"5");
+        var first=request("SUMMARY",D.minusDays(1),D,null,null,utc(D,8),0,1);
+        assertEquals(3,mapper.count(first));assertEquals("B",page(first).get(0).customerCode());
+        assertEquals("A",page(request("SUMMARY",D.minusDays(1),D,null,null,utc(D,8),1,1)).get(0).customerCode());
+        var zero=page(request("SUMMARY",D.minusDays(1),D,null,null,utc(D,8),2,1)).get(0);
+        assertEquals("C",zero.customerCode());assertEquals(0,zero.observedQuantity().signum());assertEquals(1,zero.completeDayCount());
+    }
+    @Test void exactFiltersExcludeOtherWarehouseVersionDatesAndQualityNeverMultipliesSales() throws Exception {
+        profile(11,"C","SKU","VALID_OUTBOUND",utc(D.minusDays(40),0),"PCS");
+        profile(22,"C","SKU","INVENTORY_OBSERVATION",utc(D.minusDays(40),0),"PCS");
+        daily(11,"W","C","SKU",D.minusDays(1),"150");daily(11,"OTHER","C","SKU",D.minusDays(1),"999");
+        daily(33,"W","C","SKU",D.minusDays(1),"999");daily(11,"W","C","SKU",D.minusDays(31),"999");
+        stock("C","SKU",0,"300");stock("C","SKU",1,"999");
+        var row=page(request("INVENTORY",D.minusDays(30),D,"C","SKU",utc(D,8),0,20)).get(0);
+        assertEquals(0,new BigDecimal("150").compareTo(row.sales30Quantity()));
+        assertEquals(0,new BigDecimal("300").compareTo(row.availableQuantity()));assertEquals(1L,row.windowSkuOrderCount());
+        assertEquals(0,mapper.count(request("SUMMARY",D.minusDays(1),D,"OTHER","SKU",utc(D,8),0,20)));
+    }
+    @Test void inventoryUnitConflictPreservesPureSalesButBlocksMixedMetricEligibility() throws Exception {
+        profile(11,"C","SKU","VALID_OUTBOUND",utc(D.minusDays(40),0),"PCS");
+        profile(22,"C","SKU","INVENTORY_OBSERVATION",utc(D.minusDays(40),0),"BOX");daily(11,"W","C","SKU",D.minusDays(1),"5");
+        profile(11,"C","UNKNOWN-UNIT","VALID_OUTBOUND",utc(D.minusDays(40),0),"PCS");
+        profile(22,"C","UNKNOWN-UNIT","INVENTORY_OBSERVATION",utc(D.minusDays(40),0),null);
+        daily(11,"W","C","UNKNOWN-UNIT",D.minusDays(1),"5");
+        var rows=page(request("SUMMARY",D.minusDays(1),D,null,null,utc(D,8),0,20));
+        assertTrue(rows.stream().allMatch(r->r.unitValid()&&r.observedQuantity().compareTo(new BigDecimal("5"))==0));
+        var row=rows.get(0);
+        assertTrue(row.unitValid());assertEquals(0,row.unknownDayCount());
+        var hot=page(request("HOT",D.minusDays(30),D,null,null,utc(D,8),0,20));
+        assertEquals(2,hot.size());assertTrue(hot.stream().allMatch(r->r.windowQuantity().compareTo(new BigDecimal("5"))==0));
+        assertTrue(hot.stream().allMatch(r->"UNKNOWN".equals(r.inventoryQuality())));
+    }
+    @Test void inventoryQualitiesAggregateBeforeSalesAndKeepOnlyGoodAvailable() throws Exception {
+        profile(22,"C","SKU","INVENTORY_OBSERVATION",utc(D.minusDays(40),0),"PCS");
+        daily(11,"W","C","SKU",D.minusDays(1),"150");
+        stockExact("SKU",0,"300","250","20","30","VALID",null);
+        stockExact("SKU",1,"60","50","5","10","VALID",null);
+        var row=inventory(null,null,null,0,20).get(0);
+        assertDecimal("360",row.physicalQuantity());assertDecimal("250",row.availableQuantity());assertDecimal("60",row.defectivePhysicalQuantity());
+        assertDecimal("25",row.frozenQuantity());assertDecimal("40",row.transitQuantity());assertDecimal("150",row.outboundQuantity30d());
+        assertEquals(D.minusDays(1),row.lastOutbound());assertEquals(1L,row.orderCount());
+    }
+    @Test void hotCompleteWindowIgnoresTodayUnitButTodayValueRemainsUnknown() throws Exception {
+        profile(11,"C","SKU","VALID_OUTBOUND",utc(D.minusDays(40),0),"PCS");
+        daily(11,"W","C","SKU",D.minusDays(1),"12");daily(11,"W","C","SKU",D,"500");
+        try(var sql=schema.createStatement()){sql.executeUpdate("UPDATE ll_selfop_sku_daily_sales SET quantity_unit='BOX' WHERE business_date=DATE '2026-10-12'");}
+        var rows=page(request("HOT",D.minusDays(30),D,null,null,utc(D,8),0,20));
+        assertEquals(1,rows.size());assertDecimal("12",rows.get(0).windowQuantity());
+        assertDecimal("12",rows.get(0).sales30Quantity());assertNull(rows.get(0).todayQuantity());
+        var stats=rankingStats(request("HOT",D.minusDays(30),D,null,null,utc(D,8),0,20));
+        assertEquals(1L,stats.get(0).total());
+    }
+    @Test void stockOnlyCountMatchesPageForFrozenAndDefectiveWithoutSalesDependency() throws Exception {
+        profile(22,"C","VALID","INVENTORY_OBSERVATION",utc(D.minusDays(40),0),"PCS");
+        profile(22,"C","BAD-UNIT","INVENTORY_OBSERVATION",utc(D.minusDays(40),0),"BOX");
+        profile(22,"C","MISSING","INVENTORY_OBSERVATION",utc(D.minusDays(40),0),"PCS");
+        stockExact("VALID",0,"5","1","4","0","VALID",null);stockExact("VALID",1,"8","0","8","0","VALID",null);
+        stockExact("BAD-UNIT",1,"8","0","8","0","VALID",null);
+        stockExact("MISSING",1,null,"0",null,"0","UNKNOWN","FIELD_MISSING");
+        var p=request("INVENTORY",D.minusDays(30),D,"C",null,utc(D,8),0,20);
+        for(String attention:List.of("FROZEN_STOCK","DEFECTIVE_STOCK")){
+            var o=new AnalyticsInventoryOptions(null,attention,null,null,null,null,null,null,null,null);
+            assertEquals(1L,((Number)literalQuery("inventoryCount",p,o).get(0)).longValue());
+            assertEquals(List.of("VALID"),inventory(attention,null,null,0,20).stream().map(Inventory->Inventory.skuCode()).toList());
+        }
+    }
+    @Test void quantityUnknownIsDependencySpecificAndUnknownQualityIsNotDefective() throws Exception {
+        profile(22,"C","SKU","INVENTORY_OBSERVATION",utc(D.minusDays(40),0),"PCS");
+        stockExact("SKU",0,"20","10",null,"2","UNKNOWN","FIELD_MISSING");
+        stockExact("SKU",7,"3","0","0","0","VALID",null);
+        var row=inventory(null,null,null,0,20).get(0);
+        assertDecimal("23",row.physicalQuantity());assertDecimal("10",row.availableQuantity());assertNull(row.frozenQuantity());
+        assertNull(row.defectivePhysicalQuantity());assertEquals(1,row.noOutbound());assertNull(row.coverageDays());
+        assertEquals(1,inventory("NO_OUTBOUND_IN_WINDOW",null,null,0,20).size());
+    }
+    @Test void frozenDefectiveOnlyStockMatchesNoOutboundEvenWhenGoodAvailableIsZero() throws Exception {
+        profile(22,"C","SKU","INVENTORY_OBSERVATION",utc(D.minusDays(40),0),"PCS");
+        stockExact("SKU",0,"0","0","0","0","VALID",null);stockExact("SKU",1,"40","0","40","0","VALID",null);
+        var row=inventory("NO_OUTBOUND_IN_WINDOW",null,null,0,20).get(0);
+        assertDecimal("0",row.coverageDays());assertEquals(1,row.noOutbound());assertEquals(1,inventory("FROZEN_STOCK",null,null,0,20).size());
+        assertEquals(1,inventory("DEFECTIVE_STOCK",null,null,0,20).size());assertTrue(inventory("COVERAGE_GT_THRESHOLD",1,null,0,20).isEmpty());
+    }
+    @Test void thresholdUsesExactCrossProductBeforePagingAndOwnerTotalsUseAllCandidates() throws Exception {
+        for(int i=0;i<105;i++){
+            String sku=String.format("SKU-%03d",i);profile(22,"C",sku,"INVENTORY_OBSERVATION",utc(D.minusDays(40),0),"PCS");
+            stockExact(sku,0,"301","301","0","0","VALID",null);daily(11,"W","C",sku,D.minusDays(1),"30");
+        }
+        profile(22,"C","BOUNDARY","INVENTORY_OBSERVATION",utc(D.minusDays(40),0),"PCS");
+        stockExact("BOUNDARY",0,"300.000001","300.000001","0","0","VALID",null);daily(11,"W","C","BOUNDARY",D.minusDays(1),"30");
+        var rows=inventory("COVERAGE_GT_THRESHOLD",300,"PHYSICAL_DESC",100,20);assertEquals(6,rows.size());
+        assertEquals("BOUNDARY",rows.get(5).skuCode());assertDecimal("300.000001",rows.get(5).coverageDays());
+        var p=request("INVENTORY",D.minusDays(30),D,"C",null,utc(D,8),100,20);
+        var options=new AnalyticsInventoryOptions(null,"COVERAGE_GT_THRESHOLD","PHYSICAL_DESC",300,null,null,null,null,null,null);
+        assertEquals(106L,((Number)literalQuery("inventoryCount",p,options).get(0)).longValue());
+        Map<String,Object> totals=totals(p,options);assertEquals(106L,((Number)totals.get("sku_count")).longValue());
+        assertEquals(106L,((Number)totals.get("above_threshold_count")).longValue());assertDecimal("31905.000001",(BigDecimal)totals.get("physical_quantity_known"));
+    }
+    @Test void completeWindowSalesAndCoverageDoNotRequireSkuObservationAge() throws Exception {
+        profile(22,"C","NEW","INVENTORY_OBSERVATION",utc(D.minusDays(1),0),"PCS");stockExact("NEW",0,"20","20","0","0","VALID",null);
+        daily(11,"W","C","NEW",D.minusDays(1),"5");
+        var row=inventory(null,30,null,0,20).get(0);assertDecimal("5",row.ownerOutbound());assertDecimal("5",row.outboundQuantity30d());assertEquals(0,row.noOutbound());
+        assertFalse(row.observationEligible());assertDecimal("120",row.coverageDays());assertFalse(row.unassessable());
+        Map<String,Object> totals=totals(request("INVENTORY",D.minusDays(30),D,"C",null,utc(D,8),0,1),new AnalyticsInventoryOptions(null,null,null,30,null,null,null,null,null,null));
+        assertDecimal("5",(BigDecimal)totals.get("owner_outbound_known"));assertEquals(0L,((Number)totals.get("owner_outbound_unknown")).longValue());
+        assertEquals(0L,((Number)totals.get("no_outbound_unknown")).longValue());
+    }
+    @Test void ownersAreCaseSensitiveDistinctAndPrefixWildcardsAreLiteral() throws Exception {
+        for(String owner:List.of("A%","A_test","ABC","abc")){
+            profile(11,owner,"SKU","VALID_OUTBOUND",utc(D.minusDays(40),0),"PCS");profile(22,owner,"SKU","INVENTORY_OBSERVATION",utc(D.minusDays(40),0),"PCS");
+        }
+        var p=request("OWNERS",D.minusDays(30),D,null,null,utc(D,8),0,20);
+        assertEquals(List.of("A%"),literalQuery("owners",p,new AnalyticsInventoryOptions("A%",null,null,null,null,null,null,null,null,null)));
+        assertEquals(List.of("A_test"),literalQuery("owners",p,new AnalyticsInventoryOptions("A_",null,null,null,null,null,null,null,null,null)));
+        assertEquals(List.of("abc"),literalQuery("owners",p,new AnalyticsInventoryOptions("a",null,null,null,null,null,null,null,null,null)));
+        assertEquals(4L,((Number)literalQuery("ownerCount",p,new AnalyticsInventoryOptions(null,null,null,null,null,null,null,null,null,null)).get(0)).longValue());
+    }
+    @Test void inventoryUnitConflictCannotEraseCompleteOwnerSales() throws Exception {
+        profile(11,"C","SKU","VALID_OUTBOUND",utc(D.minusDays(40),0),"PCS");
+        profile(22,"C","SKU","INVENTORY_OBSERVATION",utc(D.minusDays(40),0),"BOX");
+        daily(11,"W","C","SKU",D.minusDays(1),"12");stockExact("SKU",0,"30","30","0","0","VALID",null);
+        var row=inventory(null,30,null,0,20).get(0);assertDecimal("12",row.ownerOutbound());assertNull(row.outboundQuantity30d());assertNull(row.physicalQuantity());
+        var totals=totals(request("INVENTORY",D.minusDays(30),D,"C",null,utc(D,8),0,20),new AnalyticsInventoryOptions(null,null,null,30,null,null,null,null,null,null));
+        assertDecimal("12",(BigDecimal)totals.get("owner_outbound_known"));assertEquals(0L,((Number)totals.get("owner_outbound_unknown")).longValue());
+    }
+    @Test void yearlySparseSummaryPreservesOwnerIdentityAndCompletePartialUnknownSpanCounts() throws Exception {
+        for(String owner:List.of("A","B")){
+            profile(11,owner,"SAME","VALID_OUTBOUND",utc(D.minusDays(400),0),"PCS");
+            profile(22,owner,"SAME","INVENTORY_OBSERVATION",utc(D.minusDays(400),0),"PCS");
+        }
+        profile(22,"A","NONE","NONE",null,"PCS");
+        profile(22,"A","LATE","INVENTORY_OBSERVATION",utc(D.plusDays(1),0),"PCS");
+        daily(11,"W","A","SAME",D.minusDays(364),"1");
+        daily(11,"W","A","SAME",D.minusDays(1),"2");daily(11,"W","A","SAME",D,"5");
+        daily(11,"W","B","SAME",D.minusDays(2),"9");
+        var p=new AnalyticsSqlRequest("demo","W",null,null,11,22,D.minusDays(365),D.plusDays(1),D,D.minusDays(30),
+            D.minusDays(365),D,utc(D.minusDays(365),0),utc(D,8),true,true,false,true,true,0,20,"SUMMARY",java.util.List.of());
+        assertEquals(4,mapper.count(p));var rows=page(p);assertEquals(4,rows.size());
+        for(var row:rows)if("SAME".equals(row.skuCode())){
+            assertDecimal("A".equals(row.customerCode())?"8":"9",row.observedQuantity());
+            assertEquals(365,row.completeDayCount());assertEquals(1,row.partialDayCount());assertEquals(0,row.unknownDayCount());
+        }else{
+            assertNull(row.observedQuantity());assertEquals(0,row.completeDayCount());
+            assertEquals(0,row.partialDayCount());assertEquals(366,row.unknownDayCount());
+        }
+    }
+    @Test void slowCustomRangeCountsOnlySelectedDatesIncludingHistoryBeyondThirtyDays() throws Exception {
+        profile(11,"C","CUSTOM","VALID_OUTBOUND",utc(D.minusDays(60),0),"PCS");
+        profile(22,"C","CUSTOM","INVENTORY_OBSERVATION",utc(D.minusDays(60),0),"PCS");
+        stock("C","CUSTOM",0,"100");
+        daily(11,"W","C","CUSTOM",D.minusDays(40),"30");
+        daily(11,"W","C","CUSTOM",D.minusDays(10),"20");
+        daily(11,"W","C","CUSTOM",D.minusDays(1),"10");
+        var shortRows=page(request("SLOW",D.minusDays(3),D,null,null,utc(D,0),0,20));
+        var longRows=page(request("SLOW",D.minusDays(45),D,null,null,utc(D,0),0,20));
+        assertEquals(1,shortRows.size());assertEquals(1,longRows.size());
+        assertEquals(0,new BigDecimal("10").compareTo(shortRows.get(0).windowQuantity()));
+        assertEquals(0,new BigDecimal("60").compareTo(longRows.get(0).windowQuantity()));
+    }
+    @Test void rankingStatisticsPreserveFullEligibilityTopCapExclusionsAndSharedSkuOwners() throws Exception {
+        for(int i=0;i<110;i++){
+            String sku=String.format("SKU-%03d",i);profile(11,"C",sku,"VALID_OUTBOUND",utc(D.minusDays(40),0),"PCS");
+            profile(22,"C",sku,"INVENTORY_OBSERVATION",utc(D.minusDays(40),0),"PCS");
+            daily(11,"W","C",sku,D.minusDays(1),"1");stock("C",sku,0,"10");
+        }
+        profile(11,"B","SKU-000","VALID_OUTBOUND",utc(D.minusDays(40),0),"PCS");
+        profile(22,"B","SKU-000","INVENTORY_OBSERVATION",utc(D.minusDays(40),0),"PCS");
+        daily(11,"W","B","SKU-000",D.minusDays(1),"2");stock("B","SKU-000",0,"10");
+        profile(22,"C","ZERO","INVENTORY_OBSERVATION",utc(D.minusDays(40),0),"PCS");stock("C","ZERO",0,"0");
+        profile(22,"C","NEW","INVENTORY_OBSERVATION",utc(D.minusDays(1),0),"PCS");stock("C","NEW",0,"10");
+        profile(22,"C","UNIT","INVENTORY_OBSERVATION",utc(D.minusDays(40),0),null);stock("C","UNIT",0,"10");
+        // Stock's missing unit must not create a sales-unit exclusion: the complete
+        // sales window still proves no outbound for UNIT. A broken sales profile is different.
+        profile(11,"C","SALES-UNIT","VALID_OUTBOUND",utc(D.minusDays(40),0),null);
+        daily(11,"W","C","SALES-UNIT",D.minusDays(1),"1000");
+        var hot=request("HOT",D.minusDays(30),D,null,null,utc(D,8),0,20);
+        var hotStats=rankingStats(hot);assertTrue(hotStats.stream().allMatch(s->s.total()==100L));
+        assertEquals(3L,hotStats.stream().filter(s->"ZERO_OUTBOUND".equals(s.reason())).findFirst().orElseThrow().excludedCount());
+        assertEquals(1L,hotStats.stream().filter(s->"UNIT_UNKNOWN_OR_CONFLICT".equals(s.reason())).findFirst().orElseThrow().excludedCount());
+        assertEquals("B",page(hot).get(0).customerCode());
+        var slowStats=rankingStats(request("SLOW",D.minusDays(30),D,null,null,utc(D,8),0,20));
+        assertTrue(slowStats.stream().allMatch(s->s.total()==100L));
+        for(String reason:List.of("NO_AVAILABLE_INVENTORY","OBSERVATION_INSUFFICIENT","SALES_WINDOW_UNAVAILABLE"))
+            assertEquals(1L,slowStats.stream().filter(s->reason.equals(s.reason())).findFirst().orElseThrow().excludedCount());
+    }
+    @Test void inventoryPageKeepsHistoricLastDateForOnlySelectedQualifiedKeys() throws Exception {
+        for(String sku:List.of("OLD-1","OLD-2","RECENT")){
+            profile(22,"C",sku,"INVENTORY_OBSERVATION",utc(D.minusDays(90),0),"PCS");stock("C",sku,0,"10");
+        }
+        daily(11,"W","C","OLD-1",D.minusDays(35),"4");daily(11,"W","C","OLD-2",D.minusDays(60),"8");
+        daily(11,"W","C","RECENT",D.minusDays(1),"2");
+        var first=inventory(null,30,"PHYSICAL_DESC",0,1);assertEquals("OLD-1",first.get(0).skuCode());
+        assertEquals(D.minusDays(35),first.get(0).lastOutbound());
+        var second=inventory(null,30,"PHYSICAL_DESC",1,1);assertEquals("OLD-2",second.get(0).skuCode());
+        assertEquals(D.minusDays(60),second.get(0).lastOutbound());
+    }
+    @Test void stockFirstAllKeepsNullOrderingPageBoundariesThresholdsAndExactScope() throws Exception {
+        for(String owner:List.of("B","C")){
+            profile(22,owner,"A","INVENTORY_OBSERVATION",utc(D.minusDays(90),0),"PCS");
+            stock(owner,"A",0,"100");daily(11,"W",owner,"A",D.minusDays(1),owner.equals("C")?"5":"10");
+        }
+        profile(22,"C","B","INVENTORY_OBSERVATION",utc(D.minusDays(90),0),"PCS");stock("C","B",0,"100");
+        daily(11,"W","C","B",D.minusDays(40),"9");
+        profile(22,"C","NO-SALES","NONE",null,"PCS");stock("C","NO-SALES",0,"80");
+        profile(22,"C","UNIT","INVENTORY_OBSERVATION",utc(D.minusDays(90),0),null);stock("C","UNIT",0,"999");
+        profile(22,"C","UNKNOWN","INVENTORY_OBSERVATION",utc(D.minusDays(90),0),"PCS");
+        stockExact("UNKNOWN",0,"100",null,"0","0","UNKNOWN","FIELD_MISSING");
+        daily(99,"W","C","A",D.minusDays(1),"9000");daily(11,"OTHER","C","A",D.minusDays(1),"8000");
+        profile(22,"C","OTHER-WAREHOUSE","INVENTORY_OBSERVATION",utc(D.minusDays(90),0),"PCS");
+        try(var statement=schema.createStatement()){statement.execute("UPDATE ll_selfop_sku_profile SET warehouse_code='OTHER' WHERE sku_code='OTHER-WAREHOUSE'");}
+        var options=new AnalyticsInventoryOptions(null,null,null,90,null,null,null,null,null,null);
+        var p=request("INVENTORY",D.minusDays(30),D,null,null,utc(D,8),0,2);
+        assertEquals(6L,((Number)literalQuery("inventoryCount",p,options).get(0)).longValue());
+        var first=inventoryRows(p,options);assertEquals(List.of("B/A","C/A"),first.stream().map(r->r.customerCode()+"/"+r.skuCode()).toList());
+        assertDecimal("5",first.get(1).outboundQuantity30d());assertDecimal("600",first.get(1).coverageDays());assertEquals(1,first.get(1).aboveThreshold());
+        var second=inventoryRows(request("INVENTORY",D.minusDays(30),D,null,null,utc(D,8),2,2),options);
+        assertEquals(List.of("B","NO-SALES"),second.stream().map(AnalyticsReadRows.Inventory::skuCode).toList());
+        assertEquals(D.minusDays(40),second.get(0).lastOutbound());assertDecimal("0",second.get(0).outboundQuantity30d());
+        assertDecimal("0",second.get(1).outboundQuantity30d());assertFalse(second.get(1).unassessable());assertFalse(second.get(1).observationEligible());
+        var third=inventoryRows(request("INVENTORY",D.minusDays(30),D,null,null,utc(D,8),4,2),options);
+        assertEquals(List.of("UNIT","UNKNOWN"),third.stream().map(AnalyticsReadRows.Inventory::skuCode).toList());
+        assertTrue(third.stream().allMatch(r->r.availableQuantity()==null));assertNull(third.get(0).physicalQuantity());assertDecimal("100",third.get(1).physicalQuantity());
+        assertTrue(inventoryRows(request("INVENTORY",D.minusDays(30),D,null,null,utc(D,8),6,2),options).isEmpty());
+        assertEquals(List.of("C"),inventoryRows(request("INVENTORY",D.minusDays(30),D,"C","A",utc(D,8),0,20),options).stream().map(AnalyticsReadRows.Inventory::customerCode).toList());
+        assertEquals(2,inventoryRows(request("INVENTORY",D.minusDays(30),D,null,"A",utc(D,8),0,20),options).size());
+        var bucket=new AnalyticsInventoryOptions(null,null,null,null,"DAYS_GT_90","COVERAGE_DISTRIBUTION_V1",null,null,null,null);
+        assertFalse(AnalyticsInventorySql.inventoryPage(Map.of("p",p,"o",bucket)).contains("stock_paged"));
+        assertEquals(List.of("B/A","C/A"),inventoryRows(p,bucket).stream().map(r->r.customerCode()+"/"+r.skuCode()).toList());
+        for(String sort:List.of("PHYSICAL_DESC","COVERAGE_DAYS_DESC","OUTBOUND_ASC"))
+            assertFalse(AnalyticsInventorySql.inventoryPage(Map.of("p",p,"o",new AnalyticsInventoryOptions(null,"ALL",sort,null,null,null,null,null,null,null))).contains("stock_paged"));
+    }
+    @org.junit.jupiter.params.ParameterizedTest
+    @org.junit.jupiter.params.provider.ValueSource(strings={"AVAILABLE","PHYSICAL","FROZEN","DEFECTIVE","TRANSIT","OUTBOUND","AVERAGE_DAILY","COVERAGE_DAYS"})
+    void allInventoryNumericSortsKeepUnknownLastAndSortBeforePagination(String metric) throws Exception {
+        for(String sku:List.of("LOW","LOW-TIE","HIGH","UNKNOWN")) {
+            String unit=sku.equals("UNKNOWN")?"BOX":"PCS";
+            profile(11,"C",sku,"VALID_OUTBOUND",utc(D.minusDays(40),0),unit);
+            profile(22,"C",sku,"INVENTORY_OBSERVATION",utc(D.minusDays(40),0),unit);
+            boolean high=sku.equals("HIGH");
+            stockExact(sku,0,high?"1000":"100",high?"1000":"100",high?"9":"1",high?"90":"10","VALID",null);
+            stockExact(sku,1,high?"90":"10","0","0","0","VALID",null);
+            daily(11,"W","C",sku,D.minusDays(1),high?"5":"1");
+        }
+        for(String direction:List.of("ASC","DESC")) {
+            var expected=direction.equals("ASC")?List.of("LOW","LOW-TIE","HIGH","UNKNOWN"):List.of("HIGH","LOW","LOW-TIE","UNKNOWN");
+            assertEquals(expected,inventory(null,null,metric+"_"+direction,0,20).stream().map(AnalyticsReadRows.Inventory::skuCode).toList());
+            assertEquals(expected.get(1),inventory(null,null,metric+"_"+direction,1,1).get(0).skuCode());
+        }
+    }
+    @Test void stockFirstLastOutboundSkipsInvalidLatestRowsAndKeepsAllScopeBoundaries() throws Exception {
+        for(String sku:List.of("HISTORY","NONE","ANCHOR")){
+            profile(22,"C",sku,"INVENTORY_OBSERVATION",utc(D.minusDays(90),0),"PCS");stock("C",sku,0,"10");
+        }
+        profile(22,"B","HISTORY","INVENTORY_OBSERVATION",utc(D.minusDays(90),0),"PCS");stock("B","HISTORY",0,"10");
+        historyRow(11,"demo","W","C","HISTORY",D.minusDays(40),"4","PCS");
+        historyRow(11,"demo","W","C","HISTORY",D.minusDays(2),"100","BOX");
+        historyRow(11,"demo","W","C","HISTORY",D.minusDays(1),"0","PCS");
+        historyRow(11,"demo","W","C","HISTORY",D.plusDays(1),"100","PCS");
+        historyRow(99,"demo","W","C","HISTORY",D,"100","PCS");
+        historyRow(11,"other-account","W","C","HISTORY",D,"100","PCS");
+        historyRow(11,"demo","OTHER","C","HISTORY",D,"100","PCS");
+        historyRow(11,"demo","W","B","HISTORY",D.minusDays(3),"9","PCS");
+        historyRow(11,"demo","W","C","OTHER-SKU",D,"100","PCS");
+        historyRow(11,"demo","W","C","NONE",D.minusDays(3),null,"PCS");
+        historyRow(11,"demo","W","C","NONE",D.minusDays(2),"8",null);
+        historyRow(11,"demo","W","C","NONE",D.minusDays(1),"-1","PCS");
+        historyRow(11,"demo","W","C","NONE",D,"0","PCS");
+        historyRow(11,"demo","W","C","ANCHOR",D,"1","PCS");
+        var p=request("INVENTORY",D.minusDays(30),D,null,null,utc(D,8),0,20);
+        var options=new AnalyticsInventoryOptions(null,"ALL","AVAILABLE_DESC",null,null,null,null,null,null,null);
+        var rows=inventoryRows(p,options);assertEquals(4,rows.size());
+        for(var row:rows){
+            LocalDate expected=row.skuCode().equals("ANCHOR")?D:row.skuCode().equals("NONE")?null:row.customerCode().equals("B")?D.minusDays(3):D.minusDays(40);
+            assertEquals(expected,row.lastOutbound(),row.customerCode()+"/"+row.skuCode());
+        }
+        // The pre-existing grouped path remains an independent semantic baseline.
+        var legacy=inventoryRows(p,new AnalyticsInventoryOptions(null,"ALL","PHYSICAL_DESC",null,null,null,null,null,null,null));
+        assertEquals(legacy,rows);
+        var selected=inventoryRows(request("INVENTORY",D.minusDays(30),D,"C","HISTORY",utc(D,8),0,20),options);
+        assertEquals(1,selected.size());assertEquals(D.minusDays(40),selected.get(0).lastOutbound());
+    }
+    private void historyRow(long version,String account,String warehouse,String owner,String sku,LocalDate day,String quantity,String unit)throws Exception {
+        try(var statement=schema.prepareStatement("INSERT INTO ll_selfop_sku_daily_sales VALUES(?,?,?,?,?,?,?,?,?,?)")){
+            statement.setLong(1,nextId++);statement.setLong(2,version);statement.setString(3,account);statement.setString(4,warehouse);
+            statement.setString(5,owner);statement.setString(6,sku);statement.setObject(7,day);
+            statement.setBigDecimal(8,quantity==null?null:new BigDecimal(quantity));statement.setLong(9,1L);statement.setString(10,unit);statement.executeUpdate();
+        }
+    }
+    @Test void stockFirstDoesNotTurnUnavailableSalesOrExpiredInventoryIntoKnownValues() throws Exception {
+        profile(22,"C","SKU","INVENTORY_OBSERVATION",utc(D.minusDays(60),0),"PCS");stock("C","SKU",0,"10");daily(11,"W","C","SKU",D.minusDays(1),"3");
+        var options=new AnalyticsInventoryOptions(null,null,null,90,null,null,null,null,null,null);
+        var stale=new AnalyticsSqlRequest("demo","W",null,null,11,22,D.minusDays(30),D,D,D.minusDays(30),D.minusDays(30),D,
+            utc(D.minusDays(30),0),utc(D,8),true,true,true,true,false,0,20,"INVENTORY",java.util.List.of());
+        var row=inventoryRows(stale,options).get(0);assertNull(row.physicalQuantity());assertNull(row.availableQuantity());assertDecimal("3",row.ownerOutbound());assertNull(row.coverageDays());
+        var noSales=new AnalyticsSqlRequest("demo","W",null,null,0,22,D.minusDays(30),D,D,D.minusDays(30),null,null,null,null,false,false,false,false,true,0,20,"INVENTORY",java.util.List.of());
+        row=inventoryRows(noSales,options).get(0);assertDecimal("10",row.availableQuantity());assertNull(row.ownerOutbound());assertNull(row.observedOutbound());assertNull(row.outboundQuantity30d());assertNull(row.lastOutbound());
+        var empty=new AnalyticsSqlRequest("demo","OTHER",null,null,0,0,D.minusDays(30),D,D,D.minusDays(30),null,null,null,null,false,false,false,false,false,0,20,"INVENTORY",java.util.List.of());
+        assertTrue(inventoryRows(empty,options).isEmpty());assertEquals(0L,((Number)literalQuery("inventoryCount",empty,options).get(0)).longValue());
+    }
+    @Test void tenDayInventoryUsesItsOwnCompleteCoverageAndUnroundedThresholdWithoutLeakingScope()throws Exception {
+        for(String sku:List.of("TEN","ZERO","YOUNG")) {
+            profile(22,"C",sku,"INVENTORY_OBSERVATION",utc(D.minusDays("YOUNG".equals(sku)?5:20),0),"PCS");
+            stock("C",sku,0,"TEN".equals(sku)?"6.008":"4");
+        }
+        daily(11,"W","C","TEN",D.minusDays(10),"1");daily(11,"W","C","TEN",D.minusDays(1),"1");
+        daily(11,"W","C","TEN",D.minusDays(11),"900");daily(11,"W","C","TEN",D,"800");
+        daily(99,"W","C","TEN",D.minusDays(1),"700");daily(11,"OTHER","C","TEN",D.minusDays(1),"600");
+        daily(11,"W","OTHER","TEN",D.minusDays(1),"500");
+        var p=new AnalyticsSqlRequest("demo","W","C",null,11,22,D.minusDays(10),D,D,D.minusDays(30),D.minusDays(10),D,
+            utc(D.minusDays(10),0),utc(D,8),true,true,true,false,true,0,20,"INVENTORY",java.util.List.of());
+        var o=new AnalyticsInventoryOptions(null,null,"COVERAGE_DAYS_DESC",30,null,null,null,null,10,D.minusDays(1));
+        var rows=inventoryRows(p,o);var ten=rows.stream().filter(r->r.skuCode().equals("TEN")).findFirst().orElseThrow();
+        assertDecimal("2",ten.outboundQuantity30d());assertDecimal("30.04",ten.coverageDays());assertEquals(1,ten.aboveThreshold());
+        var stockFirst=new AnalyticsInventoryOptions(null,null,"AVAILABLE_DESC",30,null,null,null,null,10,D.minusDays(1));
+        var first=inventoryRows(p,stockFirst).get(0);assertEquals("TEN",first.skuCode());assertDecimal("2",first.outboundQuantity30d());assertDecimal("30.04",first.coverageDays());
+        var second=inventoryRows(request("INVENTORY",D.minusDays(10),D,"C",null,utc(D,8),1,1),o);
+        assertEquals(1,second.size());assertNotEquals("TEN",second.get(0).skuCode());
+        assertTrue(inventoryRows(request("INVENTORY",D.minusDays(10),D,"C",null,utc(D,8),3,1),o).isEmpty());
+        var zero=rows.stream().filter(r->r.skuCode().equals("ZERO")).findFirst().orElseThrow();assertDecimal("0",zero.outboundQuantity30d());assertNull(zero.coverageDays());
+        var young=rows.stream().filter(r->r.skuCode().equals("YOUNG")).findFirst().orElseThrow();
+        assertDecimal("0",young.outboundQuantity30d());assertFalse(young.observationEligible());assertEquals(1,young.noOutbound());assertNull(young.coverageDays());
+        var filtered=new AnalyticsInventoryOptions(null,"COVERAGE_GT_THRESHOLD","COVERAGE_DAYS_DESC",30,null,null,null,null,10,D.minusDays(1));
+        assertEquals(1L,((Number)literalQuery("inventoryCount",p,filtered).get(0)).longValue());
+        assertEquals(List.of("TEN"),inventoryRows(p,filtered).stream().map(AnalyticsReadRows.Inventory::skuCode).toList());
+        var partial=new AnalyticsSqlRequest("demo","W","C",null,11,22,D.minusDays(10),D,D,D.minusDays(30),D.minusDays(9),D,
+            utc(D.minusDays(9),0),utc(D,8),true,true,false,false,true,0,20,"INVENTORY",java.util.List.of());
+        assertTrue(inventoryRows(partial,o).stream().allMatch(r->r.outboundQuantity30d()==null&&r.coverageDays()==null));
+    }
+    @SuppressWarnings("unchecked") private List<AnalyticsReadRows.Inventory> inventoryRows(AnalyticsSqlRequest p,AnalyticsInventoryOptions o){
+        return (List<AnalyticsReadRows.Inventory>)(List<?>)literalQuery("inventoryPage",p,o);
+    }
+    @SuppressWarnings("unchecked") private List<AnalyticsReadMapper.RankingStat> rankingStats(AnalyticsSqlRequest p){
+        return (List<AnalyticsReadMapper.RankingStat>)(List<?>)literalQuery("rankingStats",p,new AnalyticsInventoryOptions(null,null,null,null,null,null,null,null,null,null));
+    }
+    private static void assertDecimal(String expected,BigDecimal actual){assertNotNull(actual);assertEquals(0,new BigDecimal(expected).compareTo(actual));}
+    @SuppressWarnings("unchecked")
+    private List<AnalyticsReadRows.Inventory> inventory(String attention,Integer threshold,String sort,long offset,int size){
+        return (List<AnalyticsReadRows.Inventory>)(List<?>)literalQuery("inventoryPage",request("INVENTORY",D.minusDays(30),D,"C",null,utc(D,8),offset,size),new AnalyticsInventoryOptions(null,attention,sort,threshold,null,null,null,null,null,null));
+    }
+    @SuppressWarnings("unchecked")
+    private Map<String,Object> totals(AnalyticsSqlRequest p,AnalyticsInventoryOptions o){
+        Map<String,Object> result=new HashMap<>();((Map<String,Object>)literalQuery("ownerTotals",p,o).get(0)).forEach((k,v)->result.put(k.toLowerCase(Locale.ROOT),v));return result;
+    }
+    private List<?> literalQuery(String method,AnalyticsSqlRequest p,AnalyticsInventoryOptions o){
+        String namespace=AnalyticsReadMapper.class.getName()+"."+method;var original=configuration.getMappedStatement(namespace);
+        Map<String,Object> args=Map.of("p",p,"o",o);String literal=render(original.getBoundSql(args),args);String id=namespace+".fixture."+(++statementSequence);
+        configuration.addMappedStatement(new org.apache.ibatis.mapping.MappedStatement.Builder(configuration,id,new org.apache.ibatis.builder.StaticSqlSource(configuration,literal),
+            org.apache.ibatis.mapping.SqlCommandType.SELECT).resultMaps(original.getResultMaps()).build());return session.selectList(id);
+    }
+    private void stockExact(String sku,int quality,String physical,String available,String frozen,String transit,String status,String reason)throws Exception{
+        try(var p=schema.prepareStatement("INSERT INTO ll_selfop_inventory_snapshot VALUES(?,?,?,?,?,?,?,?,?,?,?,?,?)")){
+            p.setLong(1,22);p.setString(2,"demo");p.setString(3,"W");p.setString(4,"C");p.setString(5,sku);p.setInt(6,quality);
+            String[] quantities={physical,available,frozen,transit};for(int i=0;i<4;i++)p.setBigDecimal(7+i,quantities[i]==null?null:new BigDecimal(quantities[i]));
+            p.setObject(11,utc(D,8));p.setString(12,status);p.setString(13,reason);p.executeUpdate();
+        }
+    }
+    private List<AnalyticsReadRows.Aggregate> page(AnalyticsSqlRequest request) {
+        String namespace=AnalyticsReadMapper.class.getName()+".page";
+        var original=configuration.getMappedStatement(namespace);
+        Map<String,Object> parameters=Map.of("p",request);
+        var bound=original.getBoundSql(parameters);
+        String literal=render(bound,parameters);
+        String id=namespace+".syntheticLiteral."+(++statementSequence);
+        var source=new org.apache.ibatis.builder.StaticSqlSource(configuration,literal);
+        configuration.addMappedStatement(new org.apache.ibatis.mapping.MappedStatement.Builder(configuration,id,source,
+                org.apache.ibatis.mapping.SqlCommandType.SELECT).resultMaps(original.getResultMaps()).build());
+        return session.selectList(id);
+    }
+    private static String render(org.apache.ibatis.mapping.BoundSql bound,Map<String,Object> parameters) {
+        var meta=org.apache.ibatis.reflection.SystemMetaObject.forObject(parameters);
+        String sql=bound.getSql();StringBuilder result=new StringBuilder();int index=0;boolean quoted=false;
+        for(int i=0;i<sql.length();i++) {
+            char c=sql.charAt(i);
+            if(c=='\'') {
+                result.append(c);
+                if(quoted&&i+1<sql.length()&&sql.charAt(i+1)=='\''){result.append(sql.charAt(++i));continue;}
+                quoted=!quoted;continue;
+            }
+            if(c!='?'||quoted){result.append(c);continue;}
+            var mapping=bound.getParameterMappings().get(index++);
+            Object value=bound.hasAdditionalParameter(mapping.getProperty())?bound.getAdditionalParameter(mapping.getProperty()):meta.getValue(mapping.getProperty());
+            result.append(literal(value));
+        }
+        assertFalse(quoted);assertEquals(bound.getParameterMappings().size(),index,"Every bound value must be consumed exactly once");
+        return result.toString();
+    }
+    private static String literal(Object value) {
+        if(value==null)return "NULL";
+        if(value instanceof Boolean b)return b?"1":"0";
+        if(value instanceof Number n)return n instanceof BigDecimal decimal?decimal.toPlainString():n.toString();
+        if(value instanceof LocalDate d)return "DATE '"+d+"'";
+        if(value instanceof LocalDateTime t)return "TIMESTAMP '"+t.toString().replace('T',' ')+"'";
+        if(value instanceof String s)return "'"+s.replace("'","''")+"'";
+        throw new IllegalArgumentException("Unsupported synthetic parameter type: "+value.getClass());
+    }
+    private AnalyticsSqlRequest request(String kind,LocalDate from,LocalDate until,String owner,String sku,LocalDateTime coveredUntil,long offset,int size) {
+        return new AnalyticsSqlRequest("demo","W",owner,sku,11,22,from,until,D,D.minusDays(30),D.minusDays(30),D,
+            utc(D.minusDays(30),0),coveredUntil,true,true,true,true,true,offset,size,kind,java.util.List.of());
+    }
+    private static LocalDateTime utc(LocalDate d,int hour){return d.atTime(hour,0).atZone(ZoneId.of("Asia/Shanghai")).withZoneSameInstant(ZoneOffset.UTC).toLocalDateTime();}
+    private void profile(long run,String owner,String sku,String evidence,LocalDateTime at,String unit)throws Exception {
+        try(var p=schema.prepareStatement("INSERT INTO ll_selfop_sku_profile VALUES(?,?,?,?,?,?,?,?,?,?)")){
+            p.setLong(1,run);p.setString(2,"demo");p.setString(3,"W");p.setString(4,owner);p.setString(5,sku);p.setString(6,"合成商品");
+            p.setString(7,unit);p.setString(8,evidence);p.setLong(9,1);p.setObject(10,at);p.executeUpdate();
+        }
+    }
+    private void daily(long run,String warehouse,String owner,String sku,LocalDate date,String quantity)throws Exception {
+        try(var p=schema.prepareStatement("INSERT INTO ll_selfop_sku_daily_sales VALUES(?,?,?,?,?,?,?,?,?,?)")){
+            p.setLong(1,nextId++);p.setLong(2,run);p.setString(3,"demo");p.setString(4,warehouse);p.setString(5,owner);p.setString(6,sku);
+            p.setObject(7,date);p.setBigDecimal(8,new BigDecimal(quantity));p.setLong(9,1);p.setString(10,"PCS");p.executeUpdate();
+        }
+    }
+    private void stock(String owner,String sku,int quality,String available)throws Exception {
+        try(var p=schema.prepareStatement("INSERT INTO ll_selfop_inventory_snapshot VALUES(?,?,?,?,?,?,?,?,?,?,?,?,?)")){
+            p.setLong(1,22);p.setString(2,"demo");p.setString(3,"W");p.setString(4,owner);p.setString(5,sku);p.setInt(6,quality);
+            p.setBigDecimal(7,new BigDecimal("120"));p.setBigDecimal(8,new BigDecimal(available));p.setBigDecimal(9,new BigDecimal("20"));
+            p.setBigDecimal(10,new BigDecimal("30"));p.setObject(11,utc(D,8));p.setString(12,"VALID");p.setString(13,null);p.executeUpdate();
+        }
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/query/CollectionDailySamplesSqlTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/query/CollectionDailySamplesSqlTest.java
new file mode 100644
index 000000000..c71a6f07d
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/query/CollectionDailySamplesSqlTest.java
@@ -0,0 +1,51 @@
+package com.baiyue.lastleg.selfoperated.analytics.query;
+
+import org.apache.ibatis.datasource.unpooled.UnpooledDataSource;
+import org.apache.ibatis.mapping.Environment;
+import org.apache.ibatis.session.*;
+import org.apache.ibatis.transaction.jdbc.JdbcTransactionFactory;
+import org.junit.jupiter.api.Test;
+import java.time.LocalDate;
+import java.util.List;
+import java.util.UUID;
+import static org.junit.jupiter.api.Assertions.*;
+
+/** Executes narrow operations-page reads against process-local synthetic metadata only. */
+class CollectionDailySamplesSqlTest {
+    @Test void onlyPublishedBusinessInventoryRepresentativesCountWithinTheRequestedWarehouseAndDates() throws Exception {
+        var ds=new UnpooledDataSource("org.h2.Driver","jdbc:h2:mem:daily_samples_"+UUID.randomUUID()+";MODE=MySQL","sa","");
+        try(var connection=ds.getConnection();var sql=connection.createStatement()) {
+            sql.execute("CREATE TABLE ll_selfop_sync_scope(id BIGINT,source_account VARCHAR(64),warehouse_code VARCHAR(64),data_family VARCHAR(24))");
+            sql.execute("CREATE TABLE ll_selfop_sync_run(scope_id BIGINT,source_account VARCHAR(64),warehouse_code VARCHAR(64),status VARCHAR(24),execution_purpose VARCHAR(24),run_role VARCHAR(24),coverage_status VARCHAR(24),inventory_sample_rule_version VARCHAR(32),inventory_daily_sample_date DATE)");
+            sql.execute("INSERT INTO ll_selfop_sync_scope VALUES (1,'primary','A','INVENTORY'),(2,'primary','B','INVENTORY'),(3,'other','A','INVENTORY'),(4,'primary','A','OUTBOUND')");
+            String insert="INSERT INTO ll_selfop_sync_run VALUES (?,?,?,?,?,?,?,?,?)";
+            try(var row=connection.prepareStatement(insert)) {
+                Object[][] fixtures={
+                    {1,"primary","A","PUBLISHED","BUSINESS","WAREHOUSE_SYNC","COMPLETE","DAILY_SCHEDULED_FIRST_V1","2026-09-01"},
+                    {1,"primary","A","PUBLISHED","BUSINESS","WAREHOUSE_SYNC","COMPLETE","DAILY_SCHEDULED_FIRST_V1","2026-10-10"},
+                    {1,"primary","A","PUBLISHED","BUSINESS","WAREHOUSE_SYNC","COMPLETE","DAILY_SCHEDULED_FIRST_V1","2026-10-11"},
+                    {1,"primary","A","PUBLISHED","BUSINESS","WAREHOUSE_SYNC","COMPLETE","DAILY_SCHEDULED_FIRST_V1","2026-10-12"},
+                    {2,"primary","B","PUBLISHED","BUSINESS","WAREHOUSE_SYNC","COMPLETE","DAILY_SCHEDULED_FIRST_V1","2026-10-09"},
+                    {3,"other","A","PUBLISHED","BUSINESS","WAREHOUSE_SYNC","COMPLETE","DAILY_SCHEDULED_FIRST_V1","2026-10-08"},
+                    {4,"primary","A","PUBLISHED","BUSINESS","WAREHOUSE_SYNC","COMPLETE","DAILY_SCHEDULED_FIRST_V1","2026-10-07"},
+                    {1,"primary","A","FAILED","BUSINESS","WAREHOUSE_SYNC","COMPLETE","DAILY_SCHEDULED_FIRST_V1","2026-10-06"},
+                    {1,"primary","A","PUBLISHED","VALIDATION","WAREHOUSE_SYNC","COMPLETE","DAILY_SCHEDULED_FIRST_V1","2026-10-05"},
+                    {1,"primary","A","PUBLISHED","BUSINESS","WAREHOUSE_SYNC","PARTIAL","DAILY_SCHEDULED_FIRST_V1","2026-10-04"},
+                    {1,"primary","A","PUBLISHED","BUSINESS","WAREHOUSE_SYNC","COMPLETE",null,null}
+                };
+                for(Object[] values:fixtures){for(int i=0;i<values.length;i++)row.setObject(i+1,values[i]);row.executeUpdate();}
+            }
+            var configuration=new Configuration(new Environment("synthetic",new JdbcTransactionFactory(),ds));
+            configuration.setMapUnderscoreToCamelCase(true);configuration.addMapper(CollectionReadMapper.class);
+            try(var session=new SqlSessionFactoryBuilder().build(configuration).openSession()) {
+                var mapper=session.getMapper(CollectionReadMapper.class);
+                var samples=mapper.inventoryDailySamples("primary",List.of("A"),LocalDate.of(2026,9,12),LocalDate.of(2026,10,12));
+                assertEquals(List.of(new CollectionReadRows.InventorySample("A",LocalDate.of(2026,10,10)),
+                        new CollectionReadRows.InventorySample("A",LocalDate.of(2026,10,11))),samples);
+                assertEquals(List.of(new CollectionReadRows.InventorySample("A",LocalDate.of(2026,9,1))),
+                        mapper.inventoryAccumulationStarts("primary",List.of("A")));
+                assertTrue(mapper.inventoryDailySamples("primary",List.of("MISSING"),LocalDate.of(2026,9,12),LocalDate.of(2026,10,12)).isEmpty());
+            }
+        }
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/query/CollectionQueryServiceTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/query/CollectionQueryServiceTest.java
new file mode 100644
index 000000000..6c6db76f3
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/query/CollectionQueryServiceTest.java
@@ -0,0 +1,565 @@
+package com.baiyue.lastleg.selfoperated.analytics.query;
+
+import com.baiyue.common.core.exception.BizException;
+import com.baiyue.lastleg.selfoperated.analytics.model.SelfopAnalyticsProperties;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import java.time.*;
+import java.util.*;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.mockito.ArgumentCaptor;
+import static org.junit.jupiter.api.Assertions.*;
+import static org.mockito.Mockito.*;
+import static com.baiyue.lastleg.selfoperated.analytics.query.CollectionReadRows.*;
+
+class CollectionQueryServiceTest {
+    final CollectionReadMapper mapper=mock(CollectionReadMapper.class);
+    final SelfopAnalyticsProperties config=new SelfopAnalyticsProperties();
+    final LocalDateTime now=LocalDateTime.of(2026,10,12,4,0);
+    CollectionQueryService service;
+    @BeforeEach void setup() {
+        config.setSourceAccount("primary");config.getWarehouses().put("A",new SelfopAnalyticsProperties.Warehouse());
+        service=new CollectionQueryService(mapper,config,new ObjectMapper(),Clock.fixed(now.toInstant(ZoneOffset.UTC),ZoneOffset.UTC));
+        when(mapper.scopes("primary","A")).thenReturn(List.of(scope()));
+    }
+    CollectionQuery q(Integer page,LocalDateTime upper,Long id) {
+        return new CollectionQuery("primary","A",null,null,null,null,null,null,page,null,upper==null?null:upper.toInstant(ZoneOffset.UTC),id);
+    }
+    private Task activity(long id,String status,Long upstream,boolean account,LocalDateTime created,String progress) {
+        return new Task(id,"LXCOL-"+id,"primary",account?null:"A","OUTBOUND",account?"ACCOUNT_DISCOVERY":"WAREHOUSE_SYNC","BACKFILL","BUSINESS",
+                "hash",status,"NOT_STARTED",1,now.minusDays(1),now,null,upstream,null,null,progress,now,null,null,false,created,created);
+    }
+    @Test void taskElapsedIncludesWaitingAndRetriesAndStopsAtTerminalTaskUpdate() {
+        for(String status:List.of("RUNNING","RETRY_WAIT","WAITING_SOURCE","SUCCEEDED")) {
+            var task=activity(7,status,null,false,now.minusMinutes(10),null);
+            when(mapper.task("primary","A",task.taskNo())).thenReturn(task);
+            var result=service.taskDetail(task.taskNo(),q(null,null,null)).task();
+            assertEquals(now.minusMinutes(10).toInstant(ZoneOffset.UTC),result.createdAt());
+            assertEquals("SUCCEEDED".equals(status)?0L:600L,result.elapsedSeconds());
+        }
+    }
+    @Test void currentActivityWinsOverNewerHistoryAndIsBoundedToEight() {
+        var candidates=new ArrayList<Task>();
+        candidates.add(activity(99,"SUCCEEDED",null,false,now,null));
+        for(int i=0;i<10;i++)candidates.add(activity(10+i,"WAITING_SOURCE",null,false,now.minusMinutes(i+1),null));
+        candidates.add(activity(1,"RUNNING",null,false,now.minusDays(1),null));
+        when(mapper.currentTasks(eq("primary"),anyList())).thenReturn(candidates);
+        var row=service.overview(q(null,null,null)).warehouses().get(0);
+        assertEquals("LXCOL-1",row.currentTask().taskNo());assertEquals(8,row.activeTasks().size());
+        assertEquals("LXCOL-1",row.activeTasks().get(0).taskNo());
+        assertTrue(row.activeTasks().stream().noneMatch(t->"SUCCEEDED".equals(t.taskStatus())));
+    }
+    @Test void overlappingAccountActivityDoesNotProveWarehouseDependency() {
+        var child=activity(7,"WAITING_SOURCE",null,false,now,null);
+        var account=activity(8,"RUNNING",null,true,now,null);
+        when(mapper.currentTasks(eq("primary"),anyList())).thenReturn(List.of(child));
+        when(mapper.sharedActiveAccount("primary")).thenReturn(account);
+        when(mapper.task("primary","A",child.taskNo())).thenReturn(child);
+        var result=service.overview(q(null,null,null));var row=result.warehouses().get(0);
+        assertEquals(account.taskNo(),result.accountActivity().taskNo());assertNull(row.sharedUpstream());
+        assertEquals("WAITING_UNCONFIRMED",row.currentTask().dependencyState());
+        var detail=service.taskDetail(child.taskNo(),q(null,null,null));
+        assertNull(detail.sharedUpstream());assertEquals(row.currentTask().dependencyState(),detail.task().dependencyState());
+    }
+    @Test void directDependenciesAreConsistentInOverviewAndDetailIncludingFailureAndCompletion() {
+        enableBusiness("production");
+        var child=activity(7,"WAITING_SOURCE",8L,false,now,null);
+        when(mapper.currentTasks(eq("primary"),anyList())).thenReturn(List.of(child));
+        when(mapper.task("primary","A",child.taskNo())).thenReturn(child);
+        for(var pair:Map.of("RUNNING","WAITING_CONFIRMED","SUCCEEDED","SATISFIED","DEAD","FAILED").entrySet()) {
+            var parent=activity(8,pair.getKey(),null,true,now.minusHours(1),null);
+            when(mapper.tasksByIds(eq("primary"),anyList())).thenReturn(List.of(parent));
+            var row=service.overview(q(null,null,null)).warehouses().get(0);
+            var detail=service.taskDetail(child.taskNo(),q(null,null,null));
+            assertEquals(parent.taskNo(),row.sharedUpstream().taskNo());
+            assertEquals(parent.taskNo(),detail.sharedUpstream().taskNo());
+            assertEquals(pair.getValue(),row.currentTask().dependencyState());
+            assertEquals(pair.getValue(),detail.task().dependencyState());
+            if("RUNNING".equals(pair.getKey())) {
+                assertEquals(parent.taskNo(),detail.task().progressSourceTaskNo());
+                assertEquals("UPSTREAM_NOT_READY",detail.task().blockingReason());
+                assertEquals("TASK_NOT_RETRYABLE",detail.task().actionBlockReason());
+            }
+        }
+        when(mapper.tasksByIds(eq("primary"),anyList())).thenReturn(List.of());
+        assertEquals("WAITING_UNCONFIRMED",service.taskDetail(child.taskNo(),q(null,null,null)).task().dependencyState());
+    }
+    @Test void stageEstimateUsesCommittedSamplesWithoutExposingThemAndRejectsAttemptMismatch() throws Exception {
+        enableBusiness("production");
+        var p=new LinkedHashMap<String,Object>();
+        p.put("taskNo","LXCOL-7");p.put("attemptNo",1);p.put("phase","DETAIL");p.put("scanRound",1);
+        p.put("progressScope","WAREHOUSE");p.put("unit","ORDER");p.put("countBasis","TASK_CUMULATIVE");p.put("total",100);p.put("totalKnown",true);
+        Instant at=now.toInstant(ZoneOffset.UTC);
+        for(int i=0;i<4;i++) {
+            p.put("completed",10+i*10);
+            com.baiyue.lastleg.selfoperated.analytics.model.SelfopStageEstimate.checkpoint(p,at.minusSeconds(70-i*20),true);
+        }
+        var t=activity(7,"RUNNING",null,false,now.minusMinutes(2),new ObjectMapper().writeValueAsString(p));
+        when(mapper.task("primary","A",t.taskNo())).thenReturn(t);
+        when(mapper.latestAttempts(eq("primary"),anyList())).thenReturn(List.of(run(1,"FETCHING",null)));
+        var result=service.taskDetail(t.taskNo(),q(null,null,null)).task();
+        assertEquals("AVAILABLE",result.stageEstimate().status());
+        assertEquals(result.progress().get("completed"),result.stageEstimate().completed());
+        assertEquals(result.progress().get("total"),result.stageEstimate().total());
+        assertFalse(result.progress().containsKey("etaSamples"));
+        when(mapper.latestAttempts(eq("primary"),anyList())).thenReturn(List.of(run(2,"FETCHING",null)));
+        result=service.taskDetail(t.taskNo(),q(null,null,null)).task();
+        assertEquals("UNAVAILABLE",result.stageEstimate().status());assertNull(result.stageEstimate().remainingSeconds());
+    }
+    @Test void businessOverviewAndRetryIgnoreCumulativeRequestCapsButKeepCounters() {
+        enableBusiness("test");
+        when(mapper.protection("primary")).thenReturn(new Protection(null,null,
+                "{\"budgetDate\":\"2026-10-12\",\"dailyLimit\":100,\"reservedHttp\":12001,\"confirmedHttp\":12000}"));
+        for(int configured:List.of(100,0)) {
+            config.setDailyRequestBudget(configured);
+            for(var row:service.overview(q(null,null,null)).warehouses()) {
+                assertTrue(row.executionEnabled());assertNull(row.disabledReason());
+                assertEquals(0,row.protection().dailyRequestBudget());
+                assertEquals(12001L,row.protection().reservedHttpRequests());
+                assertEquals(12000L,row.protection().confirmedHttpRequests());
+            }
+        }
+        for(int maximum:List.of(5,0)) {
+            when(mapper.task("primary","A","LXCOL-TASK")).thenReturn(manualBusinessTask(
+                    businessBudget(now.plusHours(1).toString(),null,6000).replace("\"maxHttp\":5","\"maxHttp\":"+maximum)));
+            assertEquals(List.of("RETRY"),service.taskDetail("LXCOL-TASK",q(null,null,null)).task().allowedActions());
+        }
+        config.setCollectionMode("VALIDATION");config.setDailyRequestBudget(100);
+        for(var row:service.overview(q(null,null,null)).warehouses()) {
+            assertFalse(row.executionEnabled());assertEquals("DAILY_BUDGET_EXHAUSTED",row.disabledReason());
+        }
+    }
+    @Test void controlledTestBusinessProjectsEnabledInventoryPublicationWithoutAutomaticSchedule() {
+        config.setCollectionMode("BUSINESS");config.setEnvironment("test");config.setQuantityUnit("PCS");
+        config.setExclusiveHandoffVerified(true);config.setPriorEgressClosed(true);config.setInflightDrained(true);config.setTransferredBudgetVerified(true);
+        config.setExclusiveGrantExpiresAtUtc(now.plusHours(1));config.setDailyRequestBudget(100);
+        var rows=service.overview(q(null,null,null)).warehouses();
+        assertFalse(rows.isEmpty());for(var row:rows){assertTrue(row.executionEnabled());assertNull(row.disabledReason());assertNull(row.nextScheduledAt());
+            assertEquals("INVENTORY".equals(row.dataFamily()),row.publicationEnabled());}
+        config.setExclusiveGrantExpiresAtUtc(now.minusSeconds(1));
+        for(var row:service.overview(q(null,null,null)).warehouses()){assertTrue(row.executionEnabled());assertNull(row.disabledReason());}
+        config.setEnvironment("development");
+        for(var row:service.overview(q(null,null,null)).warehouses()){assertFalse(row.executionEnabled());assertEquals("BUSINESS_ENVIRONMENT_REJECTED",row.disabledReason());}
+    }
+    @Test void continuousTestBusinessShowsDailyPlanDespiteExpiredGrantButKeepsSafetyGates() {
+        enableBusiness("test");config.setContinuousBusinessCollectionEnabled(true);
+        config.setExclusiveGrantExpiresAtUtc(now.minusDays(1));
+        var rows=service.overview(q(null,null,null)).warehouses();
+        var outbound=rows.stream().filter(r->"OUTBOUND".equals(r.dataFamily())).findFirst().orElseThrow();
+        assertTrue(outbound.executionEnabled());
+        assertEquals(Instant.parse("2026-10-12T16:05:00Z"),outbound.nextScheduledAt());
+        var atSlot=new CollectionQueryService(mapper,config,new ObjectMapper(),Clock.fixed(Instant.parse("2026-10-12T16:05:00Z"),ZoneOffset.UTC));
+        assertEquals(Instant.parse("2026-10-13T16:05:00Z"),atSlot.overview(q(null,null,null)).warehouses().stream()
+                .filter(r->"OUTBOUND".equals(r.dataFamily())).findFirst().orElseThrow().nextScheduledAt());
+        config.setPriorEgressClosed(false);
+        for(var row:service.overview(q(null,null,null)).warehouses()) {
+            assertFalse(row.executionEnabled());assertNull(row.nextScheduledAt());
+            assertEquals("EXCLUSIVE_GRANT_NOT_VALID",row.disabledReason());
+        }
+        config.setPriorEgressClosed(true);config.setContinuousBusinessCollectionEnabled(false);
+        assertTrue(service.overview(q(null,null,null)).warehouses().get(0).executionEnabled());
+    }
+    @Test void plannerIdentityStillNeedsSwitchButManualRecordedDeadlineDoesNotExpire() {
+        enableBusiness("test");config.setContinuousBusinessCollectionEnabled(true);
+        String continuous="{\"continuous\":true,\"startedAtUtc\":\""+now.minusDays(2)+"\",\"maxHttp\":0,\"http\":10,\"confirmedHttp\":10,\"deadlineAtUtc\":null,\"stopReason\":null}";
+        when(mapper.task("primary","A","LXCOL-TASK")).thenReturn(manualBusinessTask(continuous));
+        assertEquals(List.of("RETRY"),service.taskDetail("LXCOL-TASK",q(null,null,null)).task().allowedActions());
+        when(mapper.task("primary","A","LXCOL-TASK")).thenReturn(manualBusinessTask(continuous.replace("\"deadlineAtUtc\":null","\"deadlineAtUtc\":\""+now.plusDays(1)+"\"")));
+        assertEquals("BUSINESS_SESSION_BUDGET_MISSING",service.taskDetail("LXCOL-TASK",q(null,null,null)).task().actionBlockReason());
+        when(mapper.task("primary","A","LXCOL-TASK")).thenReturn(manualBusinessTask(businessBudget(now.minusMinutes(1).toString(),null,10)));
+        assertNull(service.taskDetail("LXCOL-TASK",q(null,null,null)).task().actionBlockReason());
+        when(mapper.task("primary","A","LXCOL-TASK")).thenReturn(manualBusinessTask(continuous.replace("\"continuous\":true","\"continuous\":false")));
+        assertEquals(List.of("RETRY"),service.taskDetail("LXCOL-TASK",q(null,null,null)).task().allowedActions());
+        config.setContinuousBusinessCollectionEnabled(false);
+        when(mapper.task("primary","A","LXCOL-TASK")).thenReturn(manualBusinessTask(continuous));
+        assertEquals("CONTINUOUS_COLLECTION_DISABLED",service.taskDetail("LXCOL-TASK",q(null,null,null)).task().actionBlockReason());
+    }
+    Scope scope() {
+        return new Scope(1L,"A","OUTBOUND","hash","Asia/Shanghai","0 0 8,20 * * *",93600,
+                now.minusMonths(2),now,null,null,0,null,null,null,7,null,null);
+    }
+    Task task(String purpose,String progress,int attempts) {
+        return new Task(7L,"LXCOL-TASK","primary","A","OUTBOUND","WAREHOUSE_SYNC","SCHEDULED",purpose,
+                "hash","DEAD","BLOCKED",attempts,now.minusDays(1),now,null,null,null,null,progress,now,null,null,false,now,now);
+    }
+    private void enableBusiness(String environment) {
+        config.setCollectionMode("BUSINESS");config.setEnvironment(environment);config.setQuantityUnit("PCS");
+        config.setExclusiveHandoffVerified(true);config.setPriorEgressClosed(true);config.setInflightDrained(true);config.setTransferredBudgetVerified(true);
+        config.setExclusiveGrantExpiresAtUtc(now.plusHours(1));config.setDailyRequestBudget(100);
+    }
+    private Task manualBusinessTask(String budget) { return manualBusinessTask(budget,false); }
+    private Task manualBusinessTask(String budget,boolean ready) {
+        return new Task(7L,"LXCOL-TASK","primary","A","OUTBOUND","WAREHOUSE_SYNC","BACKFILL","BUSINESS",
+                "hash","DEAD","BLOCKED",1,now.minusDays(1),now,null,null,null,null,null,now,null,budget,ready,now,now);
+    }
+    private String businessBudget(String deadline,String stopReason,int http) {
+        return "{\"startedAtUtc\":\""+now.minusHours(1)+"\",\"maxHttp\":5,\"http\":"+http+",\"confirmedHttp\":"+http+",\"deadlineAtUtc\":\""+deadline+"\",\"stopReason\":"
+                +(stopReason==null?"null":"\""+stopReason+"\"")+"}";
+    }
+    @Test void stoppedOrMissingTestBusinessRootBudgetCannotAdvertiseTaskOrAttemptRetry() {
+        enableBusiness("test");
+        for(String budget:Arrays.asList(null,"{}",businessBudget(now.plusHours(1).toString(),"BUSINESS_SESSION_HTTP_LIMIT",5))) {
+            when(mapper.task("primary","A","LXCOL-TASK")).thenReturn(manualBusinessTask(budget));
+            when(mapper.latestAttempts(eq("primary"),anyList())).thenReturn(List.of(run(1,"FAILED",null)));
+            var detail=service.taskDetail("LXCOL-TASK",q(null,null,null)).task();
+            assertTrue(detail.allowedActions().isEmpty());assertFalse(detail.latestAttempt().retryable());
+            assertEquals(budget==null||budget.equals("{}")?"BUSINESS_SESSION_BUDGET_MISSING":"BUSINESS_SESSION_STOPPED",detail.actionBlockReason());
+        }
+    }
+    @Test void malformedBudgetBoundsAndAnyNonNullStopReasonCannotAdvertiseRetry() {
+        enableBusiness("test");
+        String valid=businessBudget(now.plusHours(1).toString(),null,5);
+        for(String budget:List.of(
+                valid.replace("\"startedAtUtc\"","\"missingStarted\""),
+                valid.replace(now.minusHours(1).toString(),"invalid"),
+                valid.replace(now.minusHours(1).toString(),now.plusHours(1).toString()),
+                valid.replace(now.minusHours(1).toString(),now.plusHours(2).toString()),
+                valid.replace("\"maxHttp\":5","\"maxHttp\":2147483648"),
+                valid.replace("\"http\":5","\"http\":2147483648"),
+                valid.replace("\"confirmedHttp\":5","\"confirmedHttp\":6"))) {
+            when(mapper.task("primary","A","LXCOL-TASK")).thenReturn(manualBusinessTask(budget,true));
+            var task=service.taskDetail("LXCOL-TASK",q(null,null,null)).task();
+            assertTrue(task.allowedActions().isEmpty());assertEquals("BUSINESS_SESSION_BUDGET_MISSING",task.actionBlockReason());
+        }
+        for(String stop:List.of("\"\"","\" \"","false","0","{}")) {
+            when(mapper.task("primary","A","LXCOL-TASK")).thenReturn(manualBusinessTask(valid.replace("\"stopReason\":null","\"stopReason\":"+stop),true));
+            var task=service.taskDetail("LXCOL-TASK",q(null,null,null)).task();
+            assertTrue(task.allowedActions().isEmpty());assertEquals("BUSINESS_SESSION_STOPPED",task.actionBlockReason());
+        }
+    }
+    @Test void validTestBusinessBudgetAtExactHttpCapStillAllowsLocalRetryAndProductionNeedsNoTestBudget() {
+        enableBusiness("test");
+        when(mapper.task("primary","A","LXCOL-TASK")).thenReturn(manualBusinessTask(businessBudget(now.plusHours(1).toString(),null,5)));
+        when(mapper.latestAttempts(eq("primary"),anyList())).thenReturn(List.of(run(1,"FAILED",null)));
+        var detail=service.taskDetail("LXCOL-TASK",q(null,null,null)).task();
+        assertEquals(List.of("RETRY"),detail.allowedActions());assertTrue(detail.latestAttempt().retryable());
+        enableBusiness("production");when(mapper.task("primary","A","LXCOL-TASK")).thenReturn(manualBusinessTask(null));
+        assertEquals(List.of("RETRY"),service.taskDetail("LXCOL-TASK",q(null,null,null)).task().allowedActions());
+    }
+    @Test void recordedDeadlineDoesNotBlockRemoteOrLocalWorkButPersistedStopStillDoes() {
+        enableBusiness("test");
+        when(mapper.latestAttempts(eq("primary"),anyList())).thenReturn(List.of(run(1,"FAILED",null)));
+        for(boolean ready:List.of(false,true)) {
+            when(mapper.task("primary","A","LXCOL-TASK")).thenReturn(manualBusinessTask(businessBudget(now.toString(),null,5),ready));
+            var task=service.taskDetail("LXCOL-TASK",q(null,null,null)).task();
+            assertTrue(task.latestAttempt().retryable());
+            assertNull(task.actionBlockReason());
+        }
+        when(mapper.task("primary","A","LXCOL-TASK")).thenReturn(manualBusinessTask(businessBudget(now.toString(),"BUSINESS_SESSION_DEADLINE",5),true));
+        assertEquals("BUSINESS_SESSION_STOPPED",service.taskDetail("LXCOL-TASK",q(null,null,null)).task().actionBlockReason());
+    }
+    @Test void businessBudgetTerminationCodesHaveSafeChineseAttemptMessagesEvenWithoutRawErrorText() {
+        var upper=new Bound(now,100L);when(mapper.runBound(any())).thenReturn(upper);
+        for(String code:List.of("BUSINESS_SESSION_HTTP_LIMIT","BUSINESS_SESSION_DEADLINE")) {
+            var attempt=new Attempt(90L,7L,"LXCOL-TASK",1,"FAILED","DETAILS","BUSINESS",now.minusMinutes(2),null,null,
+                    now,null,now,null,"PARTIAL",null,null,code,null,now.minusMinutes(2),"A",1L,"hash");
+            when(mapper.runs(any(),eq(upper))).thenReturn(List.of(attempt));
+            String message=service.runs(q(null,null,null)).records().get(0).failureSummary();
+            assertTrue(message.contains(code.endsWith("HTTP_LIMIT")?"请求预算已耗尽":"旧采集截止时间"));
+            assertTrue(message.contains(code.endsWith("HTTP_LIMIT")?"不能恢复原任务":"受控恢复"));
+        }
+    }
+    Attempt run(int attempt,String status,String snapshot) {
+        return new Attempt(90L,7L,"LXCOL-TASK",attempt,status,"DETAILS","BUSINESS",now.minusHours(1),null,null,
+                "FAILED".equals(status)?now:null,null,now.minusSeconds(10),snapshot,"PARTIAL",now.minusDays(1),now,
+                "FAILED".equals(status)?"SOURCE_ERROR":null,null,now.minusHours(1),"A",1L,"hash");
+    }
+    @Test void noPublishedDataStillReturnsConfiguredWarehousesAndStoppedMode() {
+        when(mapper.scopes("primary",null)).thenReturn(List.of());
+        var query=new CollectionQuery("primary",null,null,null,null,null,null,null,null,null,null,null);
+        var result=service.overview(query);
+        assertEquals(2,result.warehouses().size());
+        var row=result.warehouses().get(0);
+        assertEquals("A",row.warehouseName());assertEquals("COLLECTION_OFF",row.disabledReason());
+        assertNull(row.lastPublishedAt());assertEquals("NOT_COLLECTED",row.dataFreshness());
+        assertNull(row.sharedUpstream());assertFalse(row.executionEnabled());
+    }
+    @Test void paginationRequiresBothFrozenUpperBoundFields() {
+        assertThrows(BizException.class,()->service.tasks(q(2,null,null)));
+        assertThrows(BizException.class,()->service.tasks(q(1,now,null)));
+        verify(mapper,never()).tasks(any(),any());
+    }
+    @Test void dailyInventoryCountsCompletedBeijingDaysAndPreservesGapsPerWarehouse() {
+        config.getWarehouses().put("B",new SelfopAnalyticsProperties.Warehouse());
+        service=new CollectionQueryService(mapper,config,new ObjectMapper(),Clock.fixed(Instant.parse("2026-10-11T16:01:00Z"),ZoneOffset.UTC));
+        LocalDate until=LocalDate.of(2026,10,12),from=until.minusDays(30);
+        when(mapper.inventoryDailySamples("primary",List.of("A","B"),from,until)).thenReturn(List.of(
+                new InventorySample("A",until.minusDays(1)),new InventorySample("A",until.minusDays(2)),
+                new InventorySample("B",until.minusDays(3))));
+        when(mapper.inventoryAccumulationStarts("primary",List.of("A","B"))).thenReturn(List.of(
+                new InventorySample("A",until.minusDays(40)),new InventorySample("B",until.minusDays(3))));
+        var rows=service.overview(new CollectionQuery("primary",null,null,null,null,null,null,null,null,null,null,null)).warehouses();
+        var a=rows.stream().filter(w->w.warehouseCode().equals("A")&&w.dataFamily().equals("INVENTORY")).findFirst().orElseThrow().inventoryDailySamples();
+        var b=rows.stream().filter(w->w.warehouseCode().equals("B")&&w.dataFamily().equals("INVENTORY")).findFirst().orElseThrow().inventoryDailySamples();
+        assertEquals(from,a.windowFrom());assertEquals(until,a.windowUntil());assertEquals(30,a.expectedDays());
+        assertEquals(2,a.sampleCount());assertEquals(28,a.missingDates().size());assertFalse(a.missingDates().contains(until.minusDays(1)));
+        assertEquals(until.minusDays(40),a.accumulationStartedOn());assertEquals(1,b.sampleCount());
+        assertTrue(rows.stream().filter(w->w.dataFamily().equals("OUTBOUND")).allMatch(w->w.inventoryDailySamples()==null));
+        verify(mapper,times(1)).inventoryDailySamples("primary",List.of("A","B"),from,until);
+    }
+    @Test void noInventorySamplesShowsThirtyGapsWithoutInventingHistory() {
+        var row=service.overview(q(null,null,null)).warehouses().stream()
+                .filter(w->w.dataFamily().equals("INVENTORY")).findFirst().orElseThrow().inventoryDailySamples();
+        assertEquals(0,row.sampleCount());assertEquals(30,row.missingDates().size());assertNull(row.accumulationStartedOn());
+    }
+    @Test void accountAndWarehouseAreValidatedBeforePersistenceRead() {
+        assertThrows(BizException.class,()->service.tasks(new CollectionQuery("other","A",null,null,null,null,null,null,null,null,null,null)));
+        assertThrows(BizException.class,()->service.tasks(new CollectionQuery("primary",null,null,null,null,null,null,null,null,null,null,null)));
+        verifyNoInteractions(mapper);
+    }
+    @Test void frozenBoundAndBeijingDateFiltersGoToSql() {
+        Bound upper=new Bound(now,99L);
+        when(mapper.tasks(any(),eq(upper))).thenReturn(List.of());
+        var query=new CollectionQuery("primary","A","OUTBOUND",null,null,null,LocalDate.of(2026,10,12),LocalDate.of(2026,10,12),2,20,now.toInstant(ZoneOffset.UTC),99L);
+        var result=service.tasks(query);
+        ArgumentCaptor<CollectionReadMapper.Filter> f=ArgumentCaptor.forClass(CollectionReadMapper.Filter.class);
+        verify(mapper).tasks(f.capture(),eq(upper));
+        assertEquals(LocalDateTime.of(2026,10,11,16,0),f.getValue().from());
+        assertEquals(LocalDateTime.of(2026,10,12,16,0),f.getValue().until());
+        assertEquals(20,f.getValue().offset());assertEquals(99L,result.listUpperId());
+        verify(mapper,never()).taskBound(any());
+    }
+    @Test void runHistoryReadsFrozenTerminalProgressRatherThanTaskCurrentAttempt() {
+        Bound upper=new Bound(now,100L);when(mapper.runBound(any())).thenReturn(upper);
+        when(mapper.runs(any(),eq(upper))).thenReturn(List.of(run(1,"FAILED","{\"completed\":2,\"totalKnown\":false,\"unit\":\"ORDER\"}")));
+        when(mapper.tasksByIds(eq("primary"),anyList())).thenReturn(List.of(task("BUSINESS","{\"completed\":99}",2)));
+        var result=service.runs(q(null,null,null));
+        assertEquals(2L,result.records().get(0).progress().get("completed"));
+        assertEquals("LXCOL-TASK",result.records().get(0).taskNo());assertEquals(90L,result.records().get(0).runId());
+        assertEquals("TERMINATED",result.records().get(0).executionHealth());
+    }
+    @Test void activeRunFromDifferentAttemptDoesNotReadNewAttemptProgress() {
+        Bound upper=new Bound(now,100L);when(mapper.runBound(any())).thenReturn(upper);
+        when(mapper.runs(any(),eq(upper))).thenReturn(List.of(run(1,"FETCHING",null)));
+        when(mapper.tasksByIds(eq("primary"),anyList())).thenReturn(List.of(task("BUSINESS","{\"completed\":99}",2)));
+        assertTrue(service.runs(q(null,null,null)).records().get(0).progress().isEmpty());
+    }
+    @Test void progressWhitelistPreservesUnknownCountsAndNeverCreatesTotalPercentage() {
+        var result=service.progress("{\"completed\":3,\"total\":17,\"totalKnown\":false,\"unknownCount\":null,\"unit\":\"ORDER\",\"secret\":\"hidden\",\"percent\":90}");
+        assertEquals(3L,result.get("completed"));assertNull(result.get("total"));assertNull(result.get("unknownCount"));
+        assertFalse(result.containsKey("secret"));assertFalse(result.containsKey("percent"));
+        assertTrue(service.progress("{\"x\":\""+"x".repeat(8192)+"\"}").isEmpty());
+        assertTrue(service.progress("not json").isEmpty());
+    }
+    @Test void unknownUnitsAndNegativeCountsAreNotTrusted() {
+        var result=service.progress("{\"completed\":-1,\"unit\":\"HTTP\",\"total\":3,\"totalKnown\":true}");
+        assertNull(result.get("completed"));assertNull(result.get("unit"));assertEquals(3L,result.get("total"));
+    }
+    @Test void batchCheckpointsKeepReliableCountsWhileNonCountingStagesNeverPretendZeroProgress() {
+        var batch=service.progress("{\"unit\":\"BATCH\",\"completed\":3,\"total\":5,\"totalKnown\":true}");
+        assertEquals("BATCH",batch.get("unit"));assertEquals(3L,batch.get("completed"));assertEquals(5L,batch.get("total"));
+        var waiting=service.progress("{\"unit\":\"NONE\",\"completed\":0,\"total\":0,\"totalKnown\":true}");
+        assertEquals("NONE",waiting.get("unit"));assertNull(waiting.get("completed"));assertNull(waiting.get("total"));
+        assertEquals(false,waiting.get("totalKnown"));
+    }
+    @Test void validationTaskCanNeverAdvertiseBusinessRetry() {
+        when(mapper.task("primary","A","LXCOL-TASK")).thenReturn(task("VALIDATION",null,0));
+        var result=service.taskDetail("LXCOL-TASK",q(null,null,null));
+        assertTrue(result.task().allowedActions().isEmpty());assertEquals("VALIDATION_NOT_RETRYABLE",result.task().actionBlockReason());
+    }
+    @Test void emptyPageReturnsFrozenEmptyUpperBound() {
+        when(mapper.taskBound(any())).thenReturn(null);
+        var result=service.tasks(q(null,null,null));
+        assertEquals(0L,result.listUpperId());assertEquals(now.toInstant(ZoneOffset.UTC),result.listUpperCreatedAt());assertEquals(0,result.total());
+        verify(mapper,never()).tasks(any(),any());
+    }
+    @Test void missingTaskDoesNotLeakOtherWarehouseTask() {
+        assertThrows(BizException.class,()->service.taskDetail("LXCOL-OTHER",q(null,null,null)));
+    }
+    @Test void repeatedRowsUseOneBatchLookupAndNeverFetchPerTask() {
+        Bound upper=new Bound(now,100L);when(mapper.runBound(any())).thenReturn(upper);
+        when(mapper.runs(any(),eq(upper))).thenReturn(List.of(run(1,"FAILED",null),run(2,"FETCHING",null)));
+        when(mapper.tasksByIds(eq("primary"),anyList())).thenReturn(List.of(task("BUSINESS",null,2)));
+        service.runs(q(null,null,null));
+        verify(mapper,times(1)).tasksByIds("primary",List.of(7L));
+    }
+    @Test void errorPayloadIsNeverExposedToOperationsPage() {
+        Bound upper=new Bound(now,100L);when(mapper.runBound(any())).thenReturn(upper);
+        var r=new Attempt(90L,7L,"LXCOL-TASK",1,"FAILED","DETAILS","BUSINESS",now.minusHours(1),null,null,
+                now,null,now,null,"PARTIAL",null,null,"SOURCE_ERROR","secret=credential; customer private data",now,"A",1L,"hash");
+        when(mapper.runs(any(),eq(upper))).thenReturn(List.of(r));
+        var result=service.runs(q(null,null,null)).records().get(0);
+        assertEquals("SOURCE_ERROR",result.errorCode());assertFalse(result.failureSummary().contains("credential"));
+    }
+    @Test void runHistoryReturnsFailurePhaseCauseAndAutomaticRetryDecision() {
+        Bound upper=new Bound(now,100L);when(mapper.runBound(any())).thenReturn(upper);
+        var failure=com.baiyue.lastleg.selfoperated.analytics.model.SelfopFailure.capture("SELFOP_EXECUTION_FAILED",true,
+            new RuntimeException("private SQL",new java.sql.SQLException("secret","40001",1213)));
+        var r=new Attempt(90L,7L,"LXCOL-TASK",25,"FAILED","FETCHING","BUSINESS",now.minusHours(1),null,null,
+            now,null,now,null,"PARTIAL",null,null,failure.code(),failure.stored("DETAIL",1,3,true),now,"A",1L,"hash");
+        when(mapper.runs(any(),eq(upper))).thenReturn(List.of(r));
+        var result=service.runs(q(null,null,null)).records().get(0);
+        assertEquals("SELFOP_DATABASE_TRANSIENT",result.errorCode());
+        assertTrue(result.failureSummary().contains("核验出库数据失败"));assertTrue(result.failureSummary().contains("第 1/3 次自动重试"));
+        assertTrue(result.failureSummary().contains("SQLState 40001"));assertFalse(result.failureSummary().contains("private"));
+    }
+    @Test void inventoryFreshnessUsesCompletedObservationAndBarrierBlocksInitialCoverage() {
+        Scope s=new Scope(1L,"A","OUTBOUND","hash","Asia/Shanghai","0 0 8,20 * * *",93600,
+                now.minusMonths(2),now,now.minusMonths(2),now,0,90L,now.minusDays(8),now,7,null,null);
+        when(mapper.scopes("primary","A")).thenReturn(List.of(s));
+        when(mapper.publishedRuns(eq("primary"),anyList())).thenReturn(List.of(new Attempt(90L,7L,"LXCOL-TASK",1,"PUBLISHED","PUBLISH","BUSINESS",
+                now.minusDays(5),now.minusMinutes(5),null,now.minusMinutes(5),now.minusMinutes(5),null,null,"COMPLETE",
+                now.minusMonths(2),now,null,null,now.minusDays(5),"A",1L,"hash")));
+        when(mapper.barrierWarehouses(eq("primary"),anyList())).thenReturn(List.of("A"));
+        var row=service.overview(q(null,null,null)).warehouses().get(0);
+        assertEquals("PARTIAL",row.initialCoverageStatus());assertEquals("FRESH",row.dataFreshness());
+        assertTrue(row.rebuildRequired());assertEquals("OVERDUE",row.revisionReviewStatus());
+    }
+    @Test void validationBudgetReadsActualFlatPersistedFieldsAndMasksDetails() {
+        Task t=new Task(7L,"LXCOL-TASK","primary","A","OUTBOUND","WAREHOUSE_SYNC","VALIDATION","VALIDATION",
+                "hash","SAMPLE_DONE","NOT_APPLICABLE",1,null,null,null,null,null,null,null,null,
+                "{\"maxPages\":10,\"pages\":3,\"http\":5,\"confirmedHttp\":4,\"detailKeys\":[\"secret-order\"],\"deadlineAtUtc\":\"2026-10-12T04:05:00\"}",null,false,now,now);
+        when(mapper.task("primary","A","LXCOL-TASK")).thenReturn(t);
+        var result=service.taskDetail("LXCOL-TASK",q(null,null,null)).task().validation();
+        assertEquals(10L,result.budgetLimits().get("maxPages"));assertEquals(3L,result.budgetConsumed().get("pages"));
+        assertEquals(5L,result.budgetConsumed().get("http"));assertEquals(1L,result.budgetConsumed().get("distinctDetails"));
+        assertNull(result.budgetConsumed().get("detailHttp"));assertFalse(result.budgetConsumed().containsKey("detailKeys"));
+        assertEquals(Instant.parse("2026-10-12T04:05:00Z"),result.deadlineAt());
+    }
+    @Test void allMapperSqlParsesOfflineAndRunQueryOnlyReadsLightweightTables() {
+        var configuration=new org.apache.ibatis.session.Configuration();
+        configuration.addMapper(CollectionReadMapper.class);
+        var f=new CollectionReadMapper.Filter("primary","A","OUTBOUND","SCHEDULED","FAILED","LXCOL-TASK",now.minusDays(1),now,20,20);
+        var parameters=new HashMap<String,Object>();parameters.put("f",f);parameters.put("b",new Bound(now,99L));
+        parameters.put("account","primary");parameters.put("warehouse","A");parameters.put("taskNo","LXCOL-TASK");
+        parameters.put("ids",List.of(1L,7L));parameters.put("warehouses",List.of("A"));
+        parameters.put("from",LocalDate.of(2026,9,12));parameters.put("until",LocalDate.of(2026,10,12));
+        for(String method:List.of("taskBound","runBound","taskCount","tasks","runCount","runs","tasksByIds","latestAttempts",
+                "publishedRuns","currentTasks","latestValidationTasks","lastSuccessfulTasks","sharedActiveAccount","barrierWarehouses",
+                "inventoryDailySamples","inventoryAccumulationStarts")) {
+            String sql=configuration.getMappedStatement(CollectionReadMapper.class.getName()+"."+method).getBoundSql(parameters).getSql();
+            assertFalse(sql.contains("routing_manifest_json"));assertFalse(sql.contains("JSON_TABLE"));assertFalse(sql.contains("ll_selfop_sku_daily_sales"));assertFalse(sql.contains("ll_selfop_inventory_snapshot"));
+            assertFalse(sql.contains("ll_selfop_sync_stage"));
+        }
+        String runSql=configuration.getMappedStatement(CollectionReadMapper.class.getName()+".runs").getBoundSql(parameters).getSql();
+        assertFalse(runSql.contains("routing_manifest_json"));
+        for(String method:List.of("tasks","tasksByIds","currentTasks","latestValidationTasks","lastSuccessfulTasks","sharedActiveAccount")) {
+            String sql=configuration.getMappedStatement(CollectionReadMapper.class.getName()+"."+method).getBoundSql(parameters).getSql();
+            assertTrue(sql.contains("b.source_account=t.source_account"));
+            assertTrue(sql.contains("b.execution_purpose='BUSINESS' AND b.business_root_task_id=b.id"));
+            assertTrue(sql.contains("AS business_local_work_ready"));
+            assertTrue(sql.contains("OCTET_LENGTH(t.progress_json) BETWEEN 0 AND 8192"));
+            assertTrue(sql.contains("'$.localWorkReady')=CAST('true' AS JSON)"));
+            assertTrue(sql.contains("'$.localWorkReadyScopeHash'))=t.scope_hash"));
+            assertTrue(sql.contains("'$.localWorkReadyUpstreamTaskId'))=CAST(t.upstream_task_id AS CHAR)"));
+        }
+        String currentSql=configuration.getMappedStatement(CollectionReadMapper.class.getName()+".currentTasks").getBoundSql(parameters).getSql();
+        assertTrue(currentSql.contains("ranked.rn <= 8"));
+        assertTrue(currentSql.contains("CASE WHEN status='RUNNING' THEN 0"));
+        assertTrue(currentSql.contains("source_account=? AND task_role='WAREHOUSE_SYNC'"));
+        assertTrue(runSql.contains("r.created_at <"));assertTrue(runSql.contains("r.id <="));assertTrue(runSql.contains("LIMIT ? OFFSET ?"));
+        String samplesSql=configuration.getMappedStatement(CollectionReadMapper.class.getName()+".inventoryDailySamples").getBoundSql(parameters).getSql();
+        assertTrue(samplesSql.contains("r.inventory_daily_sample_date >= ?"));
+        assertTrue(samplesSql.contains("r.inventory_daily_sample_date < ?"));
+        assertTrue(samplesSql.contains("r.status='PUBLISHED'"));assertTrue(samplesSql.contains("r.execution_purpose='BUSINESS'"));
+        assertTrue(samplesSql.contains("s.data_family='INVENTORY'"));
+    }
+    @Test void checkpointTimeIsNotInventedFromAttemptFailureTimeAndOffCannotAdvertiseRetry() {
+        Bound upper=new Bound(now,100L);when(mapper.runBound(any())).thenReturn(upper);
+        when(mapper.runs(any(),eq(upper))).thenReturn(List.of(run(1,"FAILED",
+                "{\"stageStartedAt\":\"2026-10-12T02:00:00Z\",\"summaryAsOf\":\"2026-10-12T02:30:00Z\"}")));
+        when(mapper.tasksByIds(eq("primary"),anyList())).thenReturn(List.of(task("BUSINESS",null,1)));
+        var row=service.runs(q(null,null,null)).records().get(0);
+        assertEquals(Instant.parse("2026-10-12T02:00:00Z"),row.phaseStartedAt());
+        assertEquals(Instant.parse("2026-10-12T02:30:00Z"),row.progressUpdatedAt());assertFalse(row.retryable());
+    }
+    @Test void inventoryFullSnapshotDoesNotWaitForSalesInitialCoverageOrApplyBarrier() {
+        Scope inventory=new Scope(2L,"A","INVENTORY","hash","Asia/Shanghai","0 0 8 * * *",93600,
+                null,null,null,null,0,90L,null,null,7,null,null);
+        when(mapper.scopes("primary","A")).thenReturn(List.of(scope(),inventory));
+        when(mapper.publishedRuns(eq("primary"),anyList())).thenReturn(List.of(new Attempt(90L,7L,"LXCOL-STOCK",1,
+                "PUBLISHED","PUBLISH","BUSINESS",now.minusHours(1),now.minusMinutes(1),null,now,now,null,null,
+                "COMPLETE",null,null,null,null,now.minusHours(1),"A",2L,"hash")));
+        when(mapper.barrierWarehouses(eq("primary"),anyList())).thenReturn(List.of("A"));
+        var row=service.overview(q(null,null,null)).warehouses().stream().filter(w->"INVENTORY".equals(w.dataFamily())).findFirst().orElseThrow();
+        assertEquals("COMPLETE",row.initialCoverageStatus());assertFalse(row.rebuildRequired());assertEquals("FRESH",row.dataFreshness());
+    }
+    @Test void anOldScopeHashCannotProveCurrentInitialWindowComplete() {
+        Scope scope=new Scope(1L,"A","OUTBOUND","NEW-HASH","Asia/Shanghai","0 0 8,20 * * *",93600,
+                now.minusMonths(2),now,now.minusMonths(2),now,0,90L,null,null,7,null,null);
+        when(mapper.scopes("primary","A")).thenReturn(List.of(scope));
+        when(mapper.publishedRuns(eq("primary"),anyList())).thenReturn(List.of(new Attempt(90L,7L,"LXCOL-TASK",1,
+                "PUBLISHED","PUBLISH","BUSINESS",now.minusHours(1),now,null,now,now,null,null,"COMPLETE",
+                now.minusMonths(2),now,null,null,now.minusHours(1),"A",1L,"OLD-HASH")));
+        assertEquals("PARTIAL",service.overview(q(null,null,null)).warehouses().get(0).initialCoverageStatus());
+    }
+    private String sampleProgress() {
+        return "{\"phase\":\"SAMPLE_DONE\",\"unit\":\"NONE\",\"completed\":0,\"stages\":["
+                +"{\"phase\":\"DETAIL\",\"unit\":\"ORDER\",\"completed\":20,\"totalKnown\":true,\"total\":20},"
+                +"{\"phase\":\"INVENTORY\",\"unit\":\"INVENTORY_ROW\",\"completed\":20,\"totalKnown\":false}]}";
+    }
+    private Task validationRoot(String warehouse,Long rootId) {
+        return new Task(7L,"LXCOL-SAMPLE","primary",warehouse,"OUTBOUND","ACCOUNT_DISCOVERY","VALIDATION","VALIDATION",
+                "sample-hash","SAMPLE_DONE","NOT_APPLICABLE",1,null,null,null,null,rootId,null,sampleProgress(),now,
+                "{\"http\":23,\"detailHttp\":20,\"deadlineAtUtc\":\"2026-10-12T04:05:00\"}",null,false,now,now);
+    }
+    private Attempt sampleAttempt() {
+        return new Attempt(90L,7L,"LXCOL-SAMPLE",1,"SAMPLE_DONE","SAMPLE_DONE","VALIDATION",now.minusMinutes(2),now,null,
+                now,null,now,sampleProgress(),"UNKNOWN",null,null,null,null,now.minusMinutes(2),"A",null,"sample-hash");
+    }
+    @Test void completedAccountValidationRootIsReadableWithoutFormalScopeAndPreservesActualStageCounts() {
+        when(mapper.scopes("primary","A")).thenReturn(List.of());
+        when(mapper.task("primary","A","LXCOL-SAMPLE")).thenReturn(validationRoot("A",7L));
+        when(mapper.latestAttempts(eq("primary"),anyList())).thenReturn(List.of(sampleAttempt()));
+        var result=service.taskDetail("LXCOL-SAMPLE",q(null,null,null));
+        assertEquals("A",result.task().warehouseCode());assertEquals("SAMPLE_DONE",result.task().taskStatus());
+        assertEquals("NOT_PUBLISHED",result.task().resultPublicationState());assertTrue(result.task().allowedActions().isEmpty());
+        assertEquals("VALIDATION_NOT_RETRYABLE",result.task().actionBlockReason());assertNull(result.sharedUpstream());
+        assertNull(result.task().progress().get("completed")); // terminal NONE is not a sample count
+        var stages=(List<?>)result.task().progress().get("stages");
+        assertEquals(20L,((Map<?,?>)stages.get(0)).get("completed"));assertEquals("ORDER",((Map<?,?>)stages.get(0)).get("unit"));
+        assertEquals(20L,((Map<?,?>)stages.get(1)).get("completed"));assertEquals("INVENTORY_ROW",((Map<?,?>)stages.get(1)).get("unit"));
+        assertNull(result.task().latestAttempt().publishedAt());assertEquals("UNKNOWN",result.task().latestAttempt().coverageStatus());
+    }
+    @Test void sameSingleWarehouseValidationAppearsInInventoryFamilyWithoutInventingFormalScope() {
+        when(mapper.scopes("primary","A")).thenReturn(List.of());
+        when(mapper.task("primary","A","LXCOL-SAMPLE")).thenReturn(validationRoot("A",7L));
+        var query=new CollectionQuery("primary","A","INVENTORY",null,null,null,null,null,null,null,null,null);
+        assertEquals("INVENTORY",service.taskDetail("LXCOL-SAMPLE",query).task().dataFamily());
+        verify(mapper,never()).publishedRuns(anyString(),anyList());
+    }
+    @Test void validationListAndAttemptHistoryRemainVisibleWithoutScope() {
+        when(mapper.scopes("primary","A")).thenReturn(List.of());var upper=new Bound(now,100L);
+        when(mapper.taskBound(any())).thenReturn(upper);when(mapper.tasks(any(),eq(upper))).thenReturn(List.of(validationRoot("A",7L)));
+        when(mapper.taskCount(any(),eq(upper))).thenReturn(1L);
+        assertEquals(1,service.tasks(q(null,null,null)).records().size());
+        when(mapper.runBound(any())).thenReturn(upper);when(mapper.runs(any(),eq(upper))).thenReturn(List.of(sampleAttempt()));
+        when(mapper.tasksByIds(eq("primary"),anyList())).thenReturn(List.of(validationRoot("A",7L)));when(mapper.runCount(any(),eq(upper))).thenReturn(1L);
+        var attempts=service.runs(q(null,null,null));assertEquals(1,attempts.records().size());assertFalse(attempts.records().get(0).retryable());
+        assertEquals("SAMPLE_DONE",attempts.records().get(0).status());assertNull(attempts.records().get(0).publishedAt());
+    }
+    @Test void latestSingleWarehouseSampleIsVisibleInOverviewButNeverBecomesPublishedCoverage() {
+        config.getWarehouses().put("B",new SelfopAnalyticsProperties.Warehouse());
+        when(mapper.scopes("primary",null)).thenReturn(List.of());
+        when(mapper.latestValidationTasks("primary",List.of("A","B"))).thenReturn(List.of(validationRoot("A",7L)));
+        when(mapper.latestAttempts(eq("primary"),anyList())).thenReturn(List.of(sampleAttempt()));
+        var overview=service.overview(new CollectionQuery("primary",null,null,null,null,null,null,null,null,null,null,null));
+        for(var row:overview.warehouses()) {
+            if("A".equals(row.warehouseCode())){assertEquals("LXCOL-SAMPLE",row.currentTask().taskNo());assertEquals(row.dataFamily(),row.currentTask().dataFamily());}
+            else assertNull(row.currentTask());
+            assertNull(row.lastSuccessfulTaskNo());assertNull(row.lastPublishedAt());assertEquals("UNKNOWN",row.initialCoverageStatus());
+            assertEquals("NOT_COLLECTED",row.dataFreshness());assertFalse(row.publicationEnabled());
+        }
+    }
+    @Test void accountRootWithoutFrozenWarehouseProjectionOrWithWrongRootRelationCannotLeakIntoWarehouseDetail() {
+        when(mapper.task("primary","A","LXCOL-SAMPLE")).thenReturn(validationRoot(null,7L));
+        assertThrows(BizException.class,()->service.taskDetail("LXCOL-SAMPLE",q(null,null,null)));
+        when(mapper.task("primary","A","LXCOL-SAMPLE")).thenReturn(validationRoot("B",7L));
+        assertThrows(BizException.class,()->service.taskDetail("LXCOL-SAMPLE",q(null,null,null)));
+        when(mapper.task("primary","A","LXCOL-SAMPLE")).thenReturn(validationRoot("A",8L));
+        assertThrows(BizException.class,()->service.taskDetail("LXCOL-SAMPLE",q(null,null,null)));
+    }
+    @Test void validationMapperReadsFrozenSingleWarehouseAndKeepsAccountTaskRunRelations() {
+        var configuration=new org.apache.ibatis.session.Configuration();configuration.addMapper(CollectionReadMapper.class);
+        var f=new CollectionReadMapper.Filter("primary","A","INVENTORY",null,null,null,null,null,0,20);
+        var p=new HashMap<String,Object>();p.put("f",f);p.put("b",new Bound(now,100L));p.put("account","primary");p.put("warehouse","A");p.put("taskNo","LXCOL-SAMPLE");
+        for(String method:List.of("task","taskBound","taskCount","tasks","runBound","runCount","runs")) {
+            String sql=configuration.getMappedStatement(CollectionReadMapper.class.getName()+"."+method).getBoundSql(p).getSql();
+            assertTrue(sql.contains("JSON_LENGTH(JSON_EXTRACT(t.query_scope_json,'$.warehouses'))=1"));
+            assertTrue(sql.contains("t.validation_root_task_id=t.id"));assertTrue(sql.contains("t.source_account="));
+            assertTrue(sql.contains("'$.action'))='VALIDATION'"));assertFalse(sql.contains("WAREHOUSE_DISCOVERY"));
+            assertFalse(sql.contains("ll_selfop_sync_stage"));
+            if(method.startsWith("run")||method.equals("runs")){assertTrue(sql.contains("t.source_account=r.source_account"));assertTrue(sql.contains("r.execution_purpose=t.execution_purpose"));}
+        }
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/query/DashboardPolicyTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/query/DashboardPolicyTest.java
new file mode 100644
index 000000000..cf7c5bb0e
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/query/DashboardPolicyTest.java
@@ -0,0 +1,100 @@
+package com.baiyue.lastleg.selfoperated.analytics.query;
+
+import com.baiyue.common.core.exception.BizException;
+import com.baiyue.lastleg.selfoperated.analytics.statistics.SalesBucketPolicy;
+import org.junit.jupiter.api.Test;
+import java.math.BigDecimal;
+import java.time.*;
+import java.util.*;
+import static org.junit.jupiter.api.Assertions.*;
+
+class DashboardPolicyTest {
+    @Test void frozenIslandsProveLatestEmptyDayWithoutFillingInterveningDates(){
+        var first=DAY.minusDays(6).atStartOfDay().minusHours(8);var last=DAY.minusDays(1).atStartOfDay().minusHours(8);
+        var coverage=List.of(new com.baiyue.lastleg.selfoperated.analytics.model.SelfopSalesCoverage.Interval(first,first.plusDays(1)),
+            new com.baiyue.lastleg.selfoperated.analytics.model.SelfopSalesCoverage.Interval(last,last.plusDays(1)));
+        var c=context(first.toInstant(ZoneOffset.UTC),first.plusDays(1).toInstant(ZoneOffset.UTC),true);
+        var points=DashboardSalesPolicy.points(c,true,DAY.minusDays(6),DAY,List.of(),coverage);
+        assertEquals(List.of("COMPLETE","UNKNOWN","UNKNOWN","UNKNOWN","UNKNOWN","COMPLETE"),points.stream().map(p->p.dataStatus()).toList());
+        assertEquals(BigDecimal.ZERO,points.get(5).outboundQuantity());assertNull(SalesBucketPolicy.aggregate(points).outboundQuantity());
+    }
+    static final LocalDate DAY=LocalDate.of(2026,10,13);
+    static final Instant NOW=Instant.parse("2026-10-13T04:00:00Z");
+    static AnalyticsResponses.Context context(Instant coveredFrom,Instant coveredUntil,boolean inventory){return context(coveredFrom,coveredUntil,inventory,DAY.minusDays(14),DAY.plusDays(1));}
+    static AnalyticsResponses.Context context(Instant coveredFrom,Instant coveredUntil,boolean inventory,LocalDate from,LocalDate until){return new AnalyticsResponses.Context(11L,inventory?22L:0L,"a".repeat(64),inventory?"b".repeat(64):null,NOW,NOW.plusSeconds(1800),"Asia/Shanghai",DAY,from,until,null,DAY.minusDays(30),DAY,coveredFrom,coveredUntil,NOW.minusSeconds(60),inventory?NOW.minusSeconds(60):null,inventory?NOW.minusSeconds(30):null,"VALID",inventory?"VALID":"UNKNOWN",false,"CURRENT",List.of());}
+    @Test void warehouseObservedTotalPreservesOutsideWatermarkAndUnknownGap(){
+        var c=context(null,null,true);var rows=List.of(new DashboardReadMapper.Day(DAY.minusDays(3),new BigDecimal("2"),0L),new DashboardReadMapper.Day(DAY.minusDays(1),new BigDecimal("5"),0L),new DashboardReadMapper.Day(DAY,BigDecimal.ONE,0L));
+        var points=DashboardSalesPolicy.points(c,true,DAY.minusDays(3),DAY.plusDays(1),rows,java.util.List.of());var summary=SalesBucketPolicy.aggregate(points);
+        assertEquals(new BigDecimal("8"),summary.observedQuantity());assertNull(summary.outboundQuantity());assertNull(points.get(1).observedQuantity());assertEquals("PARTIAL",points.get(3).dataStatus());
+    }
+    @Test void completeWarehouseZeroAndPartialWarehouseZeroNeedNoSkuObservation(){
+        var c=context(DAY.minusDays(30).atStartOfDay().toInstant(ZoneOffset.ofHours(8)),NOW,true);
+        var points=DashboardSalesPolicy.points(c,true,DAY.minusDays(1),DAY.plusDays(1),List.of(),java.util.List.of());
+        assertEquals("COMPLETE",points.get(0).dataStatus());assertEquals(BigDecimal.ZERO,points.get(0).outboundQuantity());
+        assertEquals("PARTIAL",points.get(1).dataStatus());assertEquals(BigDecimal.ZERO,points.get(1).observedQuantity());assertNull(points.get(1).outboundQuantity());
+        var unknown=SalesBucketPolicy.aggregate(DashboardSalesPolicy.points(context(null,null,false),false,DAY.minusDays(1),DAY.plusDays(1),List.of(),java.util.List.of()));assertNull(unknown.observedQuantity());
+    }
+    @Test void staleCollectionDoesNotDowngradePublishedHistoricalDayOrInventOtherFourteenDays(){
+        LocalDate published=DAY.minusDays(3);var c=publishedDayContext("STALE",false);
+        for(BigDecimal amount:List.of(BigDecimal.ZERO,new BigDecimal("2251"))) {
+            var rows=amount.signum()==0?List.<DashboardReadMapper.Day>of():List.of(new DashboardReadMapper.Day(published,amount,0L));
+            var points=DashboardSalesPolicy.points(c,true,DAY.minusDays(14),DAY.plusDays(1),rows,java.util.List.of());
+            var point=points.stream().filter(p->p.date().equals(published)).findFirst().orElseThrow();
+            assertEquals("COMPLETE",point.dataStatus());assertEquals(amount,point.outboundQuantity());
+            assertFalse(point.reasonCodes().contains("SALES_DAY_INCOMPLETE"));assertFalse(point.reasonCodes().contains("SALES_STALE"));
+            var summary=SalesBucketPolicy.aggregate(points);
+            assertEquals(1,summary.completeDays());assertEquals(14,summary.unknownDays());assertEquals(0,summary.partialDays());
+            assertEquals("PARTIAL",summary.dataStatus());assertNull(summary.outboundQuantity());assertEquals(amount,summary.observedQuantity());
+            var single=SalesBucketPolicy.aggregate(DashboardSalesPolicy.points(c,true,published,published.plusDays(1),rows,java.util.List.of()));
+            assertEquals("COMPLETE",single.dataStatus());assertEquals(amount,single.outboundQuantity());
+            assertEquals("STALE",c.salesStatus());assertTrue(c.reasonCodes().contains("SALES_STALE"));
+        }
+    }
+    @Test void historicalCoverageStillRequiresKnownSourceAndValidQuantity(){
+        LocalDate day=DAY.minusDays(3);var rows=List.of(new DashboardReadMapper.Day(day,new BigDecimal("2251"),0L));
+        assertEquals("UNKNOWN",DashboardSalesPolicy.points(publishedDayContext("STALE",false),false,day,day.plusDays(1),rows,java.util.List.of()).get(0).dataStatus());
+        var invalid=DashboardSalesPolicy.points(publishedDayContext("STALE",false),true,day,day.plusDays(1),List.of(new DashboardReadMapper.Day(day,new BigDecimal("2"),1L)),java.util.List.of()).get(0);
+        assertEquals("PARTIAL",invalid.dataStatus());assertNull(invalid.outboundQuantity());assertTrue(invalid.reasonCodes().contains("SALES_QUANTITY_OR_UNIT_INVALID"));
+    }
+    @Test void pendingRebuildPreservesFrozenHistoricalCoverageWithoutFillingGapsOrToday(){
+        LocalDate day=DAY.minusDays(3);var c=publishedDayContext("REBUILD_REQUIRED",true);
+        for(BigDecimal amount:List.of(BigDecimal.ZERO,new BigDecimal("2251"))){
+            var rows=amount.signum()==0?List.<DashboardReadMapper.Day>of():List.of(new DashboardReadMapper.Day(day,amount,0L));
+            var points=DashboardSalesPolicy.points(c,true,day,DAY.plusDays(1),rows,List.of());
+            assertEquals("COMPLETE",points.get(0).dataStatus());assertEquals(amount,points.get(0).outboundQuantity());
+            assertTrue(points.get(0).reasonCodes().contains("SALES_REBUILD_REQUIRED"));
+            assertFalse(points.get(0).reasonCodes().contains("SALES_DAY_INCOMPLETE"));
+            assertEquals(List.of("COMPLETE","UNKNOWN","UNKNOWN","UNKNOWN"),points.stream().map(p->p.dataStatus()).toList());
+            assertTrue(points.get(3).reasonCodes().contains("TODAY_INCOMPLETE"));
+            assertNull(SalesBucketPolicy.aggregate(points).outboundQuantity());
+        }
+        var invalid=DashboardSalesPolicy.points(c,true,day,day.plusDays(1),List.of(new DashboardReadMapper.Day(day,BigDecimal.ONE,1L)),List.of()).get(0);
+        assertEquals("PARTIAL",invalid.dataStatus());assertNull(invalid.outboundQuantity());
+        assertEquals("UNKNOWN",DashboardSalesPolicy.points(c,false,day,day.plusDays(1),List.of(),List.of()).get(0).dataStatus());
+    }
+    private static AnalyticsResponses.Context publishedDayContext(String status,boolean rebuild){
+        LocalDate day=DAY.minusDays(3);var zone=ZoneId.of("Asia/Shanghai");
+        return new AnalyticsResponses.Context(11L,22L,"a".repeat(64),"b".repeat(64),NOW,NOW.plusSeconds(1800),"Asia/Shanghai",DAY,
+            DAY.minusDays(14),DAY.plusDays(1),null,day,day.plusDays(1),day.atStartOfDay(zone).toInstant(),day.plusDays(1).atStartOfDay(zone).toInstant(),
+            NOW.minusSeconds(60),NOW.minusSeconds(60),NOW.minusSeconds(30),status,"VALID",rebuild,"CURRENT",List.of("SALES_"+status));
+    }
+    @Test void strictInventoryDrilldownExpiresBeforeContextWhileOrdinaryInventoryRemainsAllowed(){
+        var c=context(NOW.minusSeconds(86400),NOW,true);var q=query(true);var strict=new AnalyticsInventoryOptions(null,null,null,null,"UNKNOWN",CoverageDistributionPolicy.RULE_VERSION,null,"DASHBOARD",null,null);
+        Instant fresh=NOW.plusSeconds(60);assertEquals(fresh,CoverageDistributionPolicy.expiresAt(c,fresh));
+        assertDoesNotThrow(()->CoverageDistributionPolicy.requireDrilldown(q,strict,c,fresh,fresh.minusSeconds(1)));
+        assertEquals("原图库存已过期，请刷新总览",assertThrows(BizException.class,()->CoverageDistributionPolicy.requireDrilldown(q,strict,c,fresh,fresh)).getMessage());
+        assertThrows(BizException.class,()->CoverageDistributionPolicy.requireDrilldown(query(false),strict,c,fresh,NOW));
+        assertDoesNotThrow(()->CoverageDistributionPolicy.requireDrilldown(q,new AnalyticsInventoryOptions(null,null,null,null,null,null,null,null,null,null),c,fresh,fresh.plusSeconds(1)));
+        assertNull(CoverageDistributionPolicy.expiresAt(context(null,null,false),fresh));
+    }
+    @Test void bucketSelectionAndAttentionCannotSilentlyBroadenToWarehouse(){
+        for(var o:List.of(new AnalyticsInventoryOptions(null,null,null,null,"INVALID",CoverageDistributionPolicy.RULE_VERSION,null,null,null,null),
+            new AnalyticsInventoryOptions(null,null,null,null,null,CoverageDistributionPolicy.RULE_VERSION,null,null,null,null),
+            new AnalyticsInventoryOptions(null,"FROZEN_STOCK",null,null,"UNKNOWN",CoverageDistributionPolicy.RULE_VERSION,null,null,null,null),
+            new AnalyticsInventoryOptions(null,"NO_OUTBOUND_IN_WINDOW",null,null,null,null,"FINITE_POSITIVE",null,null,null),
+            new AnalyticsInventoryOptions(null,null,null,null,"UNKNOWN",CoverageDistributionPolicy.RULE_VERSION,"FINITE_POSITIVE",null,null,null)))assertThrows(BizException.class,()->o.validate("INVENTORY",query(true)));
+        assertThrows(BizException.class,()->DashboardRequest.validateParameterNames(Set.of("sourceAccount","warehouseCode","topN")));
+        assertEquals("LAST_15_DAYS",DashboardRequest.normalize(query(false)).rangePreset());
+    }
+    private static AnalyticsQuery query(boolean pinned){return new AnalyticsQuery("demo","W",null,null,null,null,null,null,null,null,null,pinned?11L:null,pinned?22L:null,pinned?"a".repeat(64):null,pinned?"b".repeat(64):null,pinned?NOW:null);}
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/query/DashboardQueryServiceTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/query/DashboardQueryServiceTest.java
new file mode 100644
index 000000000..1a4e1f466
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/query/DashboardQueryServiceTest.java
@@ -0,0 +1,69 @@
+package com.baiyue.lastleg.selfoperated.analytics.query;
+
+import com.baiyue.lastleg.selfoperated.analytics.statistics.SalesRangePolicy;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.fasterxml.jackson.datatype.jsr310.JavaTimeModule;
+import org.junit.jupiter.api.Test;
+import org.springframework.transaction.annotation.Transactional;
+import java.math.BigDecimal;
+import java.time.*;
+import java.util.*;
+import static org.junit.jupiter.api.Assertions.*;
+import static org.mockito.Mockito.*;
+
+class DashboardQueryServiceTest {
+    @Test void selectedWindowKeepsHotAvailableButDoesNotInventAverageWhenIncomplete()throws Exception{
+        var contexts=mock(AnalyticsQueryService.class);var mapper=mock(DashboardReadMapper.class);var service=new DashboardQueryService(contexts,mapper,org.mockito.Mockito.mock(SelfopOwnerDirectory.class));
+        LocalDate day=DashboardPolicyTest.DAY;Instant now=DashboardPolicyTest.NOW;
+        var q=new AnalyticsQuery("demo","W",null,null,"TODAY",null,null,null,null,null,null,null,null,null,null,null);
+        var context=DashboardPolicyTest.context(day.minusDays(30).atStartOfDay().toInstant(ZoneOffset.ofHours(8)),now,false);
+        var range=SalesRangePolicy.resolve("LAST_15_DAYS",null,null,"DAY",now,ZoneId.of("Asia/Shanghai"),366);
+        var snapshot=new AnalyticsQueryService.Snapshot(q,salesRun(true),null,true,true,day.minusDays(30),day,range,context);
+        when(contexts.context(any(),eq(true),eq(false),eq(false),isNull())).thenReturn(snapshot);
+        var p=new AnalyticsSqlRequest("demo","W",null,null,11,0,day.minusDays(14),day.plusDays(1),day,day.minusDays(30),day.minusDays(30),day,day.minusDays(30).atStartOfDay().minusHours(8),day.atStartOfDay(),true,true,false,true,false,0,20,"DASHBOARD",java.util.List.of());
+        when(contexts.request(snapshot,"DASHBOARD")).thenReturn(p);
+        when(mapper.daily(any(),any(),any())).thenReturn(List.of(new DashboardReadMapper.Day(day.minusDays(1),new BigDecimal("30"),0L)));
+        var reportRow=new HashMap<String,Object>(Map.of("total_skus",200L,"hot_eligible",200L,"hot_unknown",0L));
+        reportRow.putAll(Map.of("rank_code","HOT","customer_code","A","sku_code","X","product_name","Product","main_value",new BigDecimal("30"),"owner_outbound",new BigDecimal("30"),"order_count",1L));
+        when(mapper.report(any(),any())).thenReturn(List.of(reportRow));
+        var result=service.dashboard(q);
+        assertNull(result.kpis().averageDailyOutboundQuantity().value());
+        assertEquals(15,result.hotSkus().calculationWindowDays());assertEquals("PARTIAL",result.hotSkus().dataStatus());assertNull(result.hotSkus().items().get(0).averageDailyOutboundQuantity());
+        assertEquals(200L,result.hotSkus().eligibleCount());assertEquals(1,result.hotSkus().items().size());assertEquals("A",result.hotSkus().items().get(0).customerCode());
+        assertNull(result.coverageDistribution().candidateSkuCount());assertTrue(result.coverageDistribution().buckets().stream().allMatch(b->b.skuCount()==null));
+        assertNull(result.context().inventoryDrilldownExpiresAt());assertEquals(day.minusDays(14),result.context().versionContext().rangeStartDate());
+        assertEquals(15,result.longCoverageSkus().calculationWindowDays());assertEquals(15,result.noOutboundSkus().calculationWindowDays());
+        verify(mapper).daily(any(),any(),any());verify(mapper,times(2)).report(any(),any());verifyNoMoreInteractions(mapper);
+        var json=new ObjectMapper().registerModule(new JavaTimeModule()).valueToTree(result);assertTrue(json.path("context").has("salesRunId"));assertFalse(json.path("context").has("versionContext"));
+        assertTrue(DashboardQueryService.class.getAnnotation(Transactional.class).readOnly());
+    }
+    @Test void unreadyPublishedVersionIsRejectedWhileReadyEmptyWarehouseProvesZeroAndAbsentSalesStayUnknown(){
+        var contexts=mock(AnalyticsQueryService.class);var mapper=mock(DashboardReadMapper.class);var service=new DashboardQueryService(contexts,mapper,org.mockito.Mockito.mock(SelfopOwnerDirectory.class));
+        LocalDate day=DashboardPolicyTest.DAY;Instant now=DashboardPolicyTest.NOW;
+        var q=new AnalyticsQuery("demo","W",null,null,"TODAY",null,null,null,null,null,null,null,null,null,null,null);
+        var context=DashboardPolicyTest.context(day.minusDays(30).atStartOfDay().toInstant(ZoneOffset.ofHours(8)),now,false,day.minusDays(15),day);
+        var range=SalesRangePolicy.resolve("CUSTOM",day.minusDays(15),day.minusDays(1),"DAY",now,ZoneId.of("Asia/Shanghai"),366);
+        for(Boolean ready:Arrays.asList(false,null)){
+            when(contexts.context(any(),eq(true),eq(false),eq(false),isNull())).thenReturn(new AnalyticsQueryService.Snapshot(q,salesRun(ready),null,true,true,day.minusDays(30),day,range,context));
+            var error=assertThrows(com.baiyue.common.core.exception.BizException.class,()->service.dashboard(q));
+            assertEquals("该销量版本尚未生成仓库每日汇总，请重新发布统计后再查询",error.getMessage());
+        }
+        verifyNoInteractions(mapper);
+        when(mapper.daily(any(),any(),any())).thenReturn(List.of());
+        when(mapper.report(any(),any())).thenReturn(List.of(Map.of("total_skus",0L,"hot_eligible",0L,"hot_unknown",0L)));
+        for(boolean salesPresent:List.of(true,false)){
+            var snapshot=new AnalyticsQueryService.Snapshot(q,salesPresent?salesRun(true):null,null,salesPresent,salesPresent,day.minusDays(30),day,range,context);
+            when(contexts.context(any(),eq(true),eq(false),eq(false),isNull())).thenReturn(snapshot);
+            when(contexts.request(snapshot,"DASHBOARD")).thenReturn(new AnalyticsSqlRequest("demo","W",null,null,salesPresent?11:0,0,day.minusDays(15),day,day,day.minusDays(30),day.minusDays(30),day,
+                day.minusDays(30).atStartOfDay().minusHours(8),day.atStartOfDay(),salesPresent,salesPresent,salesPresent,salesPresent,false,0,20,"DASHBOARD",java.util.List.of()));
+            var result=service.dashboard(q);
+            if(salesPresent){assertEquals(0,result.kpis().averageDailyOutboundQuantity().value().signum());assertEquals("COMPLETE",result.kpis().averageDailyOutboundQuantity().dataStatus());}
+            else {assertNull(result.kpis().averageDailyOutboundQuantity().value());assertEquals("UNKNOWN",result.kpis().averageDailyOutboundQuantity().dataStatus());}
+        }
+    }
+    private static AnalyticsReadRows.Run salesRun(Boolean ready){
+        LocalDate day=DashboardPolicyTest.DAY;LocalDateTime now=LocalDateTime.ofInstant(DashboardPolicyTest.NOW,ZoneOffset.UTC);
+        return new AnalyticsReadRows.Run(11L,101L,1L,"demo","W","WAREHOUSE_SYNC","a".repeat(64),"{}","PUBLISHED","COMPLETE",
+            day.minusDays(30).atStartOfDay().minusHours(8),now,day.minusDays(30),day,now.minusMinutes(2),now.minusMinutes(1),now,1L,null,null,null,"BUSINESS",ready);
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/query/DashboardSqlSemanticTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/query/DashboardSqlSemanticTest.java
new file mode 100644
index 000000000..588b2fcbb
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/query/DashboardSqlSemanticTest.java
@@ -0,0 +1,349 @@
+package com.baiyue.lastleg.selfoperated.analytics.query;
+
+import org.apache.ibatis.datasource.unpooled.UnpooledDataSource;
+import org.apache.ibatis.mapping.*;
+import org.apache.ibatis.session.*;
+import org.apache.ibatis.transaction.jdbc.JdbcTransactionFactory;
+import org.junit.jupiter.api.*;
+import java.math.BigDecimal;
+import java.sql.*;
+import java.time.*;
+import java.util.*;
+import static org.junit.jupiter.api.Assertions.*;
+
+/** Production SQL on process-local synthetic H2, never a real environment or outbound HTTP. */
+class DashboardSqlSemanticTest {
+    private Connection connection;private SqlSession session;private Configuration config;private int sequence;
+    private static final LocalDate D=LocalDate.of(2026,10,13);
+    @BeforeEach void setup()throws Exception{
+        var ds=new UnpooledDataSource("org.h2.Driver","jdbc:h2:mem:dashboard_"+UUID.randomUUID().toString().replace("-","")+";MODE=MySQL","sa","");connection=ds.getConnection();
+        try(var s=connection.createStatement()){
+            s.execute("CREATE ALIAS CONVERT_TZ FOR 'com.baiyue.lastleg.selfoperated.analytics.query.AnalyticsSqlSemanticTest.convertZone'");
+            s.execute("CREATE TABLE ll_selfop_sku_profile(profile_run_id BIGINT,source_account VARCHAR(64),warehouse_code VARCHAR(64),customer_code VARCHAR(64),sku_code VARCHAR(128),product_name VARCHAR(255),quantity_unit VARCHAR(32),evidence_type VARCHAR(24),evidence_run_id BIGINT,earliest_evidence_at_utc TIMESTAMP)");
+            s.execute("CREATE TABLE ll_selfop_sku_daily_sales(id BIGINT,sales_run_id BIGINT,source_account VARCHAR(64),warehouse_code VARCHAR(64),customer_code VARCHAR(64),sku_code VARCHAR(128),business_date DATE,outbound_quantity DECIMAL(20,6),outbound_order_count BIGINT,quantity_unit VARCHAR(32))");
+            s.execute("CREATE TABLE ll_selfop_warehouse_daily_sales(sales_run_id BIGINT,source_account VARCHAR(64),warehouse_code VARCHAR(64),business_date DATE,observed_quantity DECIMAL(38,6),invalid_row_count BIGINT,source_row_count BIGINT,PRIMARY KEY(sales_run_id,source_account,warehouse_code,business_date))");
+            s.execute("CREATE TABLE ll_selfop_inventory_snapshot(snapshot_run_id BIGINT,source_account VARCHAR(64),warehouse_code VARCHAR(64),customer_code VARCHAR(64),sku_code VARCHAR(128),product_quality INTEGER,physical_quantity DECIMAL(20,6),available_quantity DECIMAL(20,6),frozen_quantity DECIMAL(20,6),transit_quantity DECIMAL(20,6),observed_at_utc TIMESTAMP,quality_status VARCHAR(16),quality_reason VARCHAR(64))");
+        }
+        config=new Configuration(new Environment("synthetic",new JdbcTransactionFactory(),ds));config.setMapUnderscoreToCamelCase(true);config.addMapper(DashboardReadMapper.class);config.addMapper(AnalyticsReadMapper.class);
+        session=new SqlSessionFactoryBuilder().build(config).openSession();
+    }
+    @AfterEach void close()throws Exception{if(session!=null)session.close();if(connection!=null)connection.close();}
+    @Test void dailyBoundSqlUsesOnlyPinnedWarehouseSummaryWithChartAndFixedWindowBindings(){
+        var statement=config.getMappedStatement(DashboardReadMapper.class.getName()+".daily");
+        for(int days:List.of(1,30,366)){
+            var bound=statement.getBoundSql(Map.of("p",request(),"chartFrom",D.minusDays(days-1),"chartUntil",D.plusDays(1)));
+            assertTrue(bound.getSql().startsWith("SELECT business_date,observed_quantity,invalid_row_count FROM ll_selfop_warehouse_daily_sales"));
+            assertFalse(bound.getSql().contains("ll_selfop_sku_daily_sales"));assertFalse(bound.getSql().contains("GROUP BY"));
+            assertEquals(List.of("p.salesRun","p.account","p.warehouse","chartFrom","chartUntil","p.from","p.until"),
+                bound.getParameterMappings().stream().map(ParameterMapping::getProperty).toList());
+            assertTrue(bound.getSql().endsWith("ORDER BY business_date"));
+        }
+    }
+    @Test void selectedDatesChangeDistributionLongestAndZeroOutboundTogetherWithExactDrilldowns()throws Exception{
+        fixture("RECENT","90","90","30");fixture("OLDER","60","60",null);
+        daily("C","OLDER",D.minusDays(20),"10","PCS");
+        // 7 complete recent days: RECENT=21 days to sell, OLDER has zero outbound.
+        // 30 complete days: RECENT=90, OLDER=180. Historical 7 days: only OLDER sold.
+        for(var period:List.of(new LocalDate[]{D.minusDays(7),D},new LocalDate[]{D.minusDays(30),D},new LocalDate[]{D.minusDays(21),D.minusDays(14)})){
+            int days=(int)java.time.temporal.ChronoUnit.DAYS.between(period[0],period[1]);
+            boolean historical=period[1].isBefore(D);
+            var p=windowRequest(period[0],period[1],true,"DASHBOARD");
+            var rows=query(DashboardReadMapper.class,"report",Map.of("p",p,"o",options()));
+            var ranks=rows.stream().map(row->{Map<String,Object> normalized=new HashMap<>();((Map<?,?>)row).forEach((k,v)->normalized.put(k.toString().toLowerCase(Locale.ROOT),v));return DashboardQueryService.ranked(normalized);}).toList();
+            var longest=ranks.stream().filter(r->"LONG".equals(r.rankCode())).max(Comparator.comparing(DashboardReadMapper.Ranked::mainValue)).orElseThrow();
+            assertEquals(days==30||historical?"OLDER":"RECENT",longest.skuCode());
+            assertEquals(0,new BigDecimal(days==30?"180":historical?"42":"21").compareTo(longest.mainValue()));
+            var zero=ranks.stream().filter(r->"NO_OUTBOUND".equals(r.rankCode())).map(DashboardReadMapper.Ranked::skuCode).toList();
+            assertEquals(days==30?List.of():List.of(historical?"RECENT":"OLDER"),zero);
+            for(String bucket:CoverageDistributionPolicy.BUCKETS){
+                var o=new AnalyticsInventoryOptions(null,null,null,null,bucket,CoverageDistributionPolicy.RULE_VERSION,null,null,null,null);
+                var identities=query(DashboardReadMapper.class,"report",Map.of("p",p,"o",options()),false,true).stream().map(Map.class::cast)
+                    .filter(r->bucket.equals(r.get("BUCKET_CODE"))).map(r->r.get("SKU_CODE")).collect(java.util.stream.Collectors.toSet());
+                var detail=query(AnalyticsReadMapper.class,"inventoryPage",Map.of("p",windowRequest(period[0],period[1],true,"INVENTORY"),"o",o))
+                    .stream().map(AnalyticsReadRows.Inventory.class::cast).map(AnalyticsReadRows.Inventory::skuCode).collect(java.util.stream.Collectors.toSet());
+                assertEquals(identities,detail,bucket+" "+period[0]);
+                if("DAYS_0_30".equals(bucket))assertEquals(days==7&&!historical?Set.of("RECENT"):Set.of(),identities);
+            }
+        }
+        // Incomplete selection must not turn missing days into zero outbound.
+        var incomplete=query(DashboardReadMapper.class,"report",Map.of("p",windowRequest(D.minusDays(7),D.plusDays(1),false,"DASHBOARD"),"o",options()));
+        assertTrue(incomplete.stream().map(Map.class::cast).allMatch(r->r.get("RANK_CODE")==null));
+        assertEquals(2L,((Number)((Map<?,?>)incomplete.get(0)).get("BUCKET_UNKNOWN")).longValue());
+    }
+    private AnalyticsSqlRequest windowRequest(LocalDate from,LocalDate until,boolean complete,String kind){var p=request();
+        return new AnalyticsSqlRequest(p.account(),p.warehouse(),null,null,p.salesRun(),p.inventoryRun(),from,until,D,from,p.completeFrom(),p.completeUntil(),p.coveredFrom(),p.coveredUntil(),true,true,complete,true,true,0,20,kind,List.of());
+    }
+    @Test void selectedRangeHotUsesObservedSalesIncludingTodayAndMatchesTop100DespiteIncompleteCoverage()throws Exception{
+        fixture("RECENT","50","50","3");fixture("OLD","50","50",null);
+        daily("C","RECENT",D,"7","PCS");daily("C","OLD",D.minusDays(20),"100","PCS");
+        var b=request(false,true);
+        var p=new AnalyticsSqlRequest(b.account(),b.warehouse(),null,null,b.salesRun(),b.inventoryRun(),D.minusDays(2),D.plusDays(1),D,D.minusDays(2),
+            b.completeFrom(),b.completeUntil(),b.coveredFrom(),b.coveredUntil(),true,true,false,false,true,0,10,"HOT_DASHBOARD",java.util.List.of());
+        var rows=query(DashboardReadMapper.class,"report",Map.of("p",p,"o",options()));
+        assertEquals(1,rows.size());assertEquals("RECENT",((Map<?,?>)rows.get(0)).get("SKU_CODE"));
+        assertEquals(0,new BigDecimal("10").compareTo((BigDecimal)((Map<?,?>)rows.get(0)).get("MAIN_VALUE")));
+        var top=new AnalyticsSqlRequest(p.account(),p.warehouse(),null,null,p.salesRun(),p.inventoryRun(),p.from(),p.until(),D,p.from(),
+            p.completeFrom(),p.completeUntil(),p.coveredFrom(),p.coveredUntil(),true,true,false,false,true,0,100,"HOT",java.util.List.of());
+        var topRows=query(AnalyticsReadMapper.class,"page",Map.of("p",top));
+        assertEquals(1,topRows.size());var item=(AnalyticsReadRows.Aggregate)topRows.get(0);
+        assertEquals("RECENT",item.skuCode());assertEquals(0,new BigDecimal("10").compareTo(item.windowQuantity()));assertNull(item.sales30Quantity());
+    }
+    @Test void emptyValidDefectiveOnlySkuDoesNotBlockAvailableTotalButUnknownsStillDo()throws Exception{
+        fixture("NORMAL","120","100",null);fixture("DEFECTIVE-ONLY","0","0",null);
+        try(var s=connection.createStatement()){
+            s.executeUpdate("UPDATE ll_selfop_inventory_snapshot SET product_quality=1 WHERE sku_code='DEFECTIVE-ONLY'");
+        }
+        var stats=report().get(0);
+        assertEquals(0,count(stats,"available_quantity_unknown"));
+        assertEquals(0,new BigDecimal("100").compareTo((BigDecimal)stats.get("available_quantity_known")));
+        var detail=query(AnalyticsReadMapper.class,"inventoryPage",Map.of("p",windowRequest(D.minusDays(30),D,true,"INVENTORY"),"o",options()))
+            .stream().map(AnalyticsReadRows.Inventory.class::cast).filter(r->"DEFECTIVE-ONLY".equals(r.skuCode())).findFirst().orElseThrow();
+        assertEquals(0,BigDecimal.ZERO.compareTo(detail.availableQuantity()));
+        // None of these prove a known empty defective-only SKU.
+        for(String change:List.of("physical_quantity=1","physical_quantity=NULL","quality_status='UNKNOWN',quality_reason='SOURCE_ROW_MISSING'","product_quality=2","product_quality=0,available_quantity=NULL")){
+            try(var s=connection.createStatement()){
+                s.executeUpdate("UPDATE ll_selfop_inventory_snapshot SET product_quality=1,physical_quantity=0,available_quantity=0,quality_status='VALID',quality_reason=NULL WHERE sku_code='DEFECTIVE-ONLY'");
+                s.executeUpdate("UPDATE ll_selfop_inventory_snapshot SET "+change+" WHERE sku_code='DEFECTIVE-ONLY'");
+            }
+            assertEquals(1,count(report().get(0),"available_quantity_unknown"),change);
+        }
+    }
+    @Test void combinedReportKeepsStatisticsWhenAllThreeRankingsAreEmpty()throws Exception{
+        var empty=report();assertEquals(1,empty.size());assertEquals(0,count(empty.get(0),"total_skus"));
+        assertNull(empty.get(0).get("rank_code"));assertNull(empty.get(0).get("physical_quantity_known"));
+        fixture("UNKNOWN",null,null,null);
+        var unknown=report();assertEquals(1,unknown.size());assertNull(unknown.get(0).get("rank_code"));
+        assertEquals(1,count(unknown.get(0),"candidate_skus"));assertEquals(1,count(unknown.get(0),"physical_quantity_unknown"));
+        assertNull(unknown.get(0).get("physical_quantity_known"));assertEquals(1,count(unknown.get(0),"bucket_unknown"));
+    }
+    @Test void unavailableAggregateBranchesPreserveEveryReportValueAndIndependentObservedDailySales()throws Exception{
+        fixture("SOLD","90","60","30");fixture("UNSOLD","10","10",null);
+        fixture("NOAVAILABLE","5","0",null);fixture("ZERO","0","0",null);fixture("UNKNOWN",null,null,null);
+        profile(11,"A","SAME","PCS");profile(11,"B","SAME","BOX");
+        daily("A","SAME",D.minusDays(1),"7","PCS");daily("B","SAME",D.minusDays(1),"3","BOX");
+        profile(22,"C","STOCKONLY","PCS");stock("STOCKONLY","4","4");
+        daily("C","SOLD",D.minusDays(2),"-1","PCS");
+        warehouseDaily(11,"demo","W",D.minusDays(1),"37",1,3);
+        warehouseDaily(11,"demo","W",D.minusDays(2),null,1,1);
+        for(boolean complete:List.of(false,true))for(boolean fresh:List.of(false,true)){
+            var p=request(complete,fresh);var args=Map.<String,Object>of("p",p,"o",options());
+            String sql=DashboardReadSql.report(args);
+            assertEquals(!complete,sql.contains("1=0 /* dashboard unused sales */ AND "));
+            assertEquals(!fresh,sql.contains("1=0 /* dashboard unused stock */ AND "));
+            String ordinary=AnalyticsInventorySql.cte(p);
+            assertFalse(ordinary.contains("dashboard unused"));
+            assertEquals(ordinary,AnalyticsInventorySql.dashboardCte(p)
+                .replace("1=0 /* dashboard unused sales */ AND ","").replace("1=0 /* dashboard unused stock */ AND ",""));
+            assertTrue(sql.contains("profile_run_id=#{p.salesRun}"));assertTrue(sql.contains("profile_run_id=#{p.inventoryRun}"));
+            var actual=query(DashboardReadMapper.class,"report",args);
+            var original=query(DashboardReadMapper.class,"report",args,true);
+            assertEquals(new HashSet<>(original),new HashSet<>(actual),"complete="+complete+", fresh="+fresh);
+            assertEquals(original.size(),actual.size());
+            var days=query(DashboardReadMapper.class,"daily",Map.of("p",p,"chartFrom",D.minusDays(2),"chartUntil",D));
+            var yesterday=days.stream().map(DashboardReadMapper.Day.class::cast).filter(day->day.businessDate().equals(D.minusDays(1))).findFirst().orElseThrow();
+            assertEquals(0,new BigDecimal("37").compareTo(yesterday.observedQuantity()));assertEquals(1L,yesterday.invalidRowCount());
+        }
+    }
+    @Test void combinedReportReturnsAtMostThirtyRowsWithoutMultiplyingStatistics()throws Exception{
+        for(int i=0;i<15;i++){fixture("SOLD-"+i,"30.04","30.04","30");fixture("UNSOLD-"+i,"5","5",null);}
+        var rows=report();assertEquals(30,rows.size());
+        for(var row:rows){assertEquals(30,count(row,"total_skus"));assertEquals(15,count(row,"hot_eligible"));
+            assertEquals(15,count(row,"long_eligible"));assertEquals(15,count(row,"no_outbound_eligible"));
+            assertEquals(0,new BigDecimal("525.60").compareTo((BigDecimal)row.get("physical_quantity_known")));}
+        for(String kind:List.of("HOT","LONG","NO_OUTBOUND"))assertEquals(10,rows.stream().filter(row->kind.equals(row.get("rank_code"))).count());
+        assertTrue(rows.stream().filter(row->"LONG".equals(row.get("rank_code"))).allMatch(row->new BigDecimal(row.get("main_value").toString()).compareTo(new BigDecimal("30.04"))==0));
+    }
+    @Test void sevenExclusiveBucketsConserveCandidatesAndEveryInventoryDrilldownMatches()throws Exception{
+        Map<String,Set<String>> expected=new LinkedHashMap<>();
+        for(String bucket:CoverageDistributionPolicy.BUCKETS)expected.put(bucket,new HashSet<>());
+        // Quantities make coverage exactly available days. +/- 0.000001 must not be display-rounded across boundaries.
+        String[][] finite={
+            {"THIRTY-BELOW","29.999999","DAYS_0_30"},{"THIRTY","30","DAYS_0_30"},{"ONE","1","DAYS_0_30"},
+            {"THIRTY-ABOVE","30.000001","DAYS_30_60"},{"SIXTY-BELOW","59.999999","DAYS_30_60"},{"SIXTY","60","DAYS_30_60"},
+            {"SIXTY-ABOVE","60.000001","DAYS_60_90"},{"NINETY-BELOW","89.999999","DAYS_60_90"},{"NINETY","90","DAYS_60_90"},
+            {"NINETY-ABOVE","90.000001","DAYS_GT_90"},{"LONG-A","100","DAYS_GT_90"},{"LONG-B","100","DAYS_GT_90"}};
+        for(var row:finite){fixture(row[0],row[1],row[1],"30");expected.get(row[2]).add("C/"+row[0]);}
+        for(int i=0;i<3;i++){
+            fixture("NOOUT-"+i,"100","100",null);expected.get("NO_OUTBOUND_IN_WINDOW").add("C/NOOUT-"+i);
+            fixture("FROZEN-"+i,"50","0",null);expected.get("NO_AVAILABLE").add("C/FROZEN-"+i);
+            fixture("UNKNOWN-"+i,null,null,null);expected.get("UNKNOWN").add("C/UNKNOWN-"+i);
+        }
+        fixture("ZERO","0","0",null);
+        // Same SKU, different owner and bucket: identities must never collapse to SKU alone.
+        profile(11,"B","THIRTY","PCS");profile(22,"B","THIRTY","PCS");stock("B","THIRTY","75","75");daily("B","THIRTY",D.minusDays(1),"30","PCS");
+        expected.get("DAYS_60_90").add("B/THIRTY");
+        var stats=stats();assertEquals(1,count(stats,"excluded_zero_skus"));
+        var classified=query(DashboardReadMapper.class,"report",Map.of("p",request(),"o",options()),false,true);
+        Map<String,Set<String>> dashboardIdentities=new HashMap<>();
+        for(Object value:classified){Map<?,?> row=(Map<?,?>)value;Map<String,Object> normalized=new HashMap<>();row.forEach((k,v)->normalized.put(k.toString().toLowerCase(Locale.ROOT),v));
+            String bucket=(String)normalized.get("bucket_code");String key=normalized.get("customer_code")+"/"+normalized.get("sku_code");
+            assertTrue(dashboardIdentities.computeIfAbsent(bucket,ignored->new HashSet<>()).add(key),"duplicate dashboard identity "+key);
+        }
+        assertEquals(expected,dashboardIdentities);
+        long sum=0;Set<String> union=new HashSet<>();
+        for(String bucket:CoverageDistributionPolicy.BUCKETS){
+            long n=count(stats,"bucket_"+bucket.toLowerCase(Locale.ROOT));assertTrue(n>0,bucket+" must be populated");sum+=n;
+            assertEquals(expected.get(bucket).size(),n,bucket);
+            var o=new AnalyticsInventoryOptions(null,null,null,null,bucket,CoverageDistributionPolicy.RULE_VERSION,null,null,null,null);
+            assertEquals(n,((Number)query(AnalyticsReadMapper.class,"inventoryCount",Map.of("p",request(),"o",o)).get(0)).longValue(),bucket);
+            var all=query(AnalyticsReadMapper.class,"inventoryPage",Map.of("p",request(),"o",o)).stream().map(AnalyticsReadRows.Inventory.class::cast).map(row->row.customerCode()+"/"+row.skuCode()).toList();
+            assertEquals(dashboardIdentities.get(bucket),new HashSet<>(all),bucket+" drilldown identities");assertEquals(n,all.size());
+            List<String> paged=new ArrayList<>();Set<String> seen=new HashSet<>();
+            for(long offset=0;offset<=n+1;offset+=2){
+                var page=query(AnalyticsReadMapper.class,"inventoryPage",Map.of("p",pageRequest(offset,2),"o",o)).stream().map(AnalyticsReadRows.Inventory.class::cast).map(row->row.customerCode()+"/"+row.skuCode()).toList();
+                int start=(int)Math.min(offset,n),end=(int)Math.min(offset+2,n);assertEquals(all.subList(start,end),page,bucket+" offset="+offset);
+                for(String key:page)assertTrue(seen.add(key),bucket+" repeated identity "+key);paged.addAll(page);
+            }
+            assertEquals(all,paged,bucket+" pages omit or reorder identities");assertEquals(dashboardIdentities.get(bucket),seen);
+            for(String key:seen)assertTrue(union.add(key),"identity belongs to multiple buckets: "+key);
+        }
+        assertEquals(count(stats,"candidate_skus"),sum);assertEquals(sum,union.size());assertFalse(union.contains("C/ZERO"));
+        var finiteSelection=new AnalyticsInventoryOptions(null,null,"COVERAGE_DAYS_DESC",null,null,null,"FINITE_POSITIVE",null,null,null);
+        assertEquals(13,count(stats,"long_eligible"));
+        assertEquals(count(stats,"long_eligible"),((Number)query(AnalyticsReadMapper.class,"inventoryCount",Map.of("p",request(),"o",finiteSelection)).get(0)).longValue());
+        assertEquals(6,count(stats,"no_outbound_eligible"));
+        assertTrue(ranks().stream().anyMatch(row->row.rankCode().equals("NO_OUTBOUND")&&row.skuCode().equals("FROZEN-0")));
+    }
+    @Test void newSkuWindowMetricsMatchDashboardAndDrilldownWithoutObservationAge()throws Exception{
+        fixture("NEW-SOLD","30","30","15");fixture("NEW-UNSOLD","40","40",null);
+        try(var statement=connection.createStatement()) {
+            statement.execute("UPDATE ll_selfop_sku_profile SET earliest_evidence_at_utc=NULL,evidence_type='NONE'");
+        }
+        var p=windowRequest(D.minusDays(15),D,true,"DASHBOARD");
+        var report=query(DashboardReadMapper.class,"report",Map.of("p",p,"o",options()));
+        Map<String,Object> values=new HashMap<>();((Map<?,?>)report.get(0)).forEach((k,v)->values.put(k.toString().toLowerCase(Locale.ROOT),v));
+        assertEquals(1,count(values,"long_eligible"));assertEquals(1,count(values,"no_outbound_eligible"));assertEquals(0,count(values,"bucket_unknown"));
+        var rows=query(AnalyticsReadMapper.class,"inventoryPage",Map.of("p",p,"o",options())).stream().map(AnalyticsReadRows.Inventory.class::cast).toList();
+        assertEquals(2,rows.size());assertTrue(rows.stream().noneMatch(AnalyticsReadRows.Inventory::observationEligible));
+        var sold=rows.stream().filter(row->row.skuCode().equals("NEW-SOLD")).findFirst().orElseThrow();
+        assertEquals(0,new BigDecimal("15").compareTo(sold.outboundQuantity30d()));assertEquals(0,new BigDecimal("30").compareTo(sold.coverageDays()));
+        var zero=rows.stream().filter(row->row.skuCode().equals("NEW-UNSOLD")).findFirst().orElseThrow();
+        assertEquals(0,zero.outboundQuantity30d().signum());assertNull(zero.coverageDays());assertEquals(1,zero.noOutbound());
+    }
+    @Test void exactNinetyBoundaryAndUnknownInventoryRemainDistinct()throws Exception{
+        fixture("NINETY","90","90","30");fixture("NINETY04","90.04","90.04","30");fixture("INFINITE","999","999",null);
+        var s=stats();assertEquals(1,count(s,"bucket_days_60_90"));assertEquals(1,count(s,"bucket_days_gt_90"));assertEquals(1,count(s,"bucket_no_outbound_in_window"));
+        assertEquals(2,count(s,"long_eligible"));assertTrue(ranks().stream().filter(r->r.rankCode().equals("LONG")).noneMatch(r->r.skuCode().equals("INFINITE")));
+    }
+    @Test void twoHundredHotCandidatesCountBeyondTopHundredAndKeepTopTenIdentical()throws Exception{
+        for(int i=0;i<200;i++){
+            String sku=String.format("SKU-%03d",i);profile(11,"C",sku,"PCS");if(i%3!=0)profile(22,"C",sku,i%3==1?"BOX":null);
+            daily("C",sku,D.minusDays(1),Integer.toString(i+1),"PCS");
+        }
+        daily("C","SKU-199",D,"999","BOX");
+        assertEquals(200,count(stats(),"hot_eligible"));var top=ranks().stream().filter(r->r.rankCode().equals("HOT")).sorted(Comparator.comparing(DashboardReadMapper.Ranked::mainValue).reversed()).toList();assertEquals(10,top.size());
+        var p=request();var hot=new AnalyticsSqlRequest(p.account(),p.warehouse(),null,null,p.salesRun(),p.inventoryRun(),p.from(),p.until(),p.anchor(),p.windowFrom(),p.completeFrom(),p.completeUntil(),p.coveredFrom(),p.coveredUntil(),true,true,true,true,true,0,10,"HOT",java.util.List.of());
+        List<?> page=query(AnalyticsReadMapper.class,"page",Map.of("p",hot));assertEquals(10,page.size());
+        for(int i=0;i<10;i++){var item=(AnalyticsReadRows.Aggregate)page.get(i);assertEquals(top.get(i).skuCode(),item.skuCode());assertEquals(0,top.get(i).mainValue().compareTo(item.windowQuantity()));}
+    }
+    @Test void warehouseDailyIncludesBothOwnersWithoutSkuObservationAndNoQualityMultiplication()throws Exception{
+        profile(11,"A","SAME","PCS");profile(11,"B","SAME","PCS");daily("A","SAME",D.minusDays(1),"2","PCS");daily("B","SAME",D.minusDays(1),"5","PCS");
+        warehouseDaily(11,"demo","W",D.minusDays(1),"7",0,2);
+        var rows=query(DashboardReadMapper.class,"daily",Map.of("p",request(),"chartFrom",D.minusDays(2),"chartUntil",D.plusDays(1)));
+        assertEquals(1,rows.size());var row=(DashboardReadMapper.Day)rows.get(0);assertEquals(0,new BigDecimal("7").compareTo(row.observedQuantity()));assertEquals(0L,row.invalidRowCount());
+    }
+    @Test void warehouseSummaryPinsAccountWarehouseVersionAndUnionOfBothHalfOpenWindows()throws Exception{
+        warehouseDaily(11,"demo","W",D.minusDays(31),"1",0,1);
+        warehouseDaily(11,"demo","W",D.minusDays(30),"2",0,1);
+        warehouseDaily(11,"demo","W",D.minusDays(1),"3",0,1);
+        warehouseDaily(11,"demo","W",D,"4",0,1);
+        warehouseDaily(11,"demo","W",D.plusDays(1),"999",0,1);
+        warehouseDaily(11,"other","W",D.minusDays(1),"999",0,1);
+        warehouseDaily(11,"demo","OTHER",D.minusDays(1),"999",0,1);
+        warehouseDaily(99,"demo","W",D.minusDays(1),"999",0,1);
+        var rows=query(DashboardReadMapper.class,"daily",Map.of("p",request(),"chartFrom",D,"chartUntil",D.plusDays(1)))
+            .stream().map(DashboardReadMapper.Day.class::cast).toList();
+        assertEquals(List.of(D.minusDays(30),D.minusDays(1),D),rows.stream().map(DashboardReadMapper.Day::businessDate).toList());
+        assertEquals(List.of("2","3","4"),rows.stream().map(row->row.observedQuantity().stripTrailingZeros().toPlainString()).toList());
+        daily("C","SKU-ONLY",D.minusDays(2),"123","PCS");
+        assertEquals(rows,query(DashboardReadMapper.class,"daily",Map.of("p",request(),"chartFrom",D,"chartUntil",D.plusDays(1))),"Missing summary rows must never fall back to SKU facts");
+    }
+    @Test void warehouseSummaryPreservesBadRowEvidenceAndCannotProveCompleteDays()throws Exception{
+        daily("A","VALID",D.minusDays(3),"7","PCS");daily("B","BOX",D.minusDays(3),"3","BOX");daily("C","NEGATIVE",D.minusDays(3),"-1","PCS");
+        daily("A","NO-QUANTITY",D.minusDays(2),null,"PCS");daily("B","NO-UNIT",D.minusDays(2),"5",null);
+        daily("A","TODAY",D,"4","PCS");
+        warehouseDaily(11,"demo","W",D.minusDays(3),"7",2,3);
+        warehouseDaily(11,"demo","W",D.minusDays(2),null,2,2);
+        warehouseDaily(11,"demo","W",D,"4",0,1);
+        var rows=query(DashboardReadMapper.class,"daily",Map.of("p",request(),"chartFrom",D.minusDays(3),"chartUntil",D.plusDays(1)))
+            .stream().map(DashboardReadMapper.Day.class::cast).toList();
+        assertEquals(originalDailyOracle(D.minusDays(3),D.plusDays(1)),rows,"Published summaries must retain the former SKU aggregation's valid subtotal and invalid count");
+        var covered=DashboardPolicyTest.context(D.minusDays(30).atStartOfDay().toInstant(ZoneOffset.ofHours(8)),DashboardPolicyTest.NOW,true);
+        var points=DashboardSalesPolicy.points(covered,true,D.minusDays(3),D.plusDays(1),rows,java.util.List.of());
+        assertEquals("PARTIAL",points.get(0).dataStatus());assertEquals(0,new BigDecimal("7").compareTo(points.get(0).observedQuantity()));assertNull(points.get(0).outboundQuantity());
+        assertTrue(points.get(0).reasonCodes().contains("SALES_QUANTITY_OR_UNIT_INVALID"));
+        assertEquals("UNKNOWN",points.get(1).dataStatus());assertNull(points.get(1).observedQuantity());
+        assertEquals("COMPLETE",points.get(2).dataStatus());assertEquals(BigDecimal.ZERO,points.get(2).outboundQuantity());
+        assertEquals("PARTIAL",points.get(3).dataStatus());assertEquals(0,new BigDecimal("4").compareTo(points.get(3).observedQuantity()));assertNull(points.get(3).outboundQuantity());
+        var unproved=DashboardSalesPolicy.points(DashboardPolicyTest.context(null,null,true),true,D.minusDays(3),D.plusDays(1),rows,java.util.List.of());
+        assertTrue(unproved.stream().allMatch(point->point.outboundQuantity()==null));
+        assertNull(unproved.get(2).observedQuantity());assertEquals("UNKNOWN",unproved.get(2).dataStatus());
+    }
+    @Test void warehouseSummaryReadsFractionalContributionsWithoutRounding(){
+        assertDoesNotThrow(()->{
+            daily("A","BATCH-1",D.minusDays(1),"0.4","PCS");daily("B","BATCH-2",D.minusDays(1),"0.4","PCS");
+            warehouseDaily(11,"demo","W",D.minusDays(1),"0.8",0,2);
+            var rows=query(DashboardReadMapper.class,"daily",Map.of("p",request(),"chartFrom",D.minusDays(1),"chartUntil",D));
+            assertEquals(originalDailyOracle(D.minusDays(1),D),rows);
+            assertEquals(0,new BigDecimal("0.8").compareTo(((DashboardReadMapper.Day)rows.get(0)).observedQuantity()));
+        });
+    }
+    /** Independent pre-summary query, retained only as a fixture oracle, never a runtime fallback. */
+    private List<DashboardReadMapper.Day> originalDailyOracle(LocalDate from,LocalDate until)throws Exception{
+        var rows=new ArrayList<DashboardReadMapper.Day>();
+        try(var p=connection.prepareStatement("SELECT business_date,SUM(CASE WHEN quantity_unit='PCS' AND outbound_quantity>=0 THEN outbound_quantity END) observed_quantity,COUNT(CASE WHEN quantity_unit IS NULL OR quantity_unit<>'PCS' OR outbound_quantity IS NULL OR outbound_quantity<0 THEN 1 END) invalid_row_count FROM ll_selfop_sku_daily_sales WHERE sales_run_id=11 AND source_account='demo' AND warehouse_code='W' AND business_date>=? AND business_date<? GROUP BY business_date ORDER BY business_date")){
+            p.setObject(1,from);p.setObject(2,until);try(var r=p.executeQuery()){while(r.next())rows.add(new DashboardReadMapper.Day(r.getObject(1,LocalDate.class),r.getBigDecimal(2),r.getLong(3)));}
+        }return rows;
+    }
+    private void warehouseDaily(long run,String account,String warehouse,LocalDate day,String observed,long invalid,long sourceRows)throws Exception{
+        try(var p=connection.prepareStatement("INSERT INTO ll_selfop_warehouse_daily_sales VALUES(?,?,?,?,?,?,?)")){
+            p.setLong(1,run);p.setString(2,account);p.setString(3,warehouse);p.setObject(4,day);p.setBigDecimal(5,observed==null?null:new BigDecimal(observed));p.setLong(6,invalid);p.setLong(7,sourceRows);p.executeUpdate();
+        }
+    }
+    private void fixture(String sku,String physical,String available,String sold)throws Exception{profile(11,"C",sku,"PCS");profile(22,"C",sku,"PCS");stock(sku,physical,available);if(sold!=null)daily("C",sku,D.minusDays(1),sold,"PCS");}
+    private void profile(long run,String owner,String sku,String unit)throws Exception{try(var p=connection.prepareStatement("INSERT INTO ll_selfop_sku_profile VALUES(?,?,?,?,?,?,?,?,?,?)")){
+        p.setLong(1,run);p.setString(2,"demo");p.setString(3,"W");p.setString(4,owner);p.setString(5,sku);p.setString(6,sku);p.setString(7,unit);p.setString(8,run==11?"VALID_OUTBOUND":"INVENTORY_OBSERVATION");p.setLong(9,run);p.setObject(10,D.minusDays(40).atStartOfDay().minusHours(8));p.executeUpdate();}}
+    private void daily(String owner,String sku,LocalDate day,String value,String unit)throws Exception{try(var p=connection.prepareStatement("INSERT INTO ll_selfop_sku_daily_sales VALUES(?,?,?,?,?,?,?,?,?,?)")){
+        p.setLong(1,++sequence);p.setLong(2,11);p.setString(3,"demo");p.setString(4,"W");p.setString(5,owner);p.setString(6,sku);p.setObject(7,day);p.setBigDecimal(8,value==null?null:new BigDecimal(value));p.setLong(9,1);p.setString(10,unit);p.executeUpdate();}}
+    private void stock(String sku,String physical,String available)throws Exception{stock("C",sku,physical,available);}
+    private void stock(String owner,String sku,String physical,String available)throws Exception{try(var p=connection.prepareStatement("INSERT INTO ll_selfop_inventory_snapshot VALUES(?,?,?,?,?,?,?,?,?,?,?,?,?)")){
+        p.setLong(1,22);p.setString(2,"demo");p.setString(3,"W");p.setString(4,owner);p.setString(5,sku);p.setInt(6,0);p.setBigDecimal(7,physical==null?null:new BigDecimal(physical));p.setBigDecimal(8,available==null?null:new BigDecimal(available));p.setBigDecimal(9,BigDecimal.ZERO);p.setBigDecimal(10,BigDecimal.ZERO);p.setObject(11,D.atStartOfDay());p.setString(12,physical==null?"UNKNOWN":"VALID");p.setString(13,physical==null?"FIELD_MISSING":null);p.executeUpdate();}}
+    private AnalyticsSqlRequest request(){return new AnalyticsSqlRequest("demo","W",null,null,11,22,D.minusDays(30),D,D,D.minusDays(30),D.minusDays(30),D,D.minusDays(30).atStartOfDay().minusHours(8),D.atStartOfDay(),true,true,true,true,true,0,20,"DASHBOARD",java.util.List.of());}
+    private AnalyticsSqlRequest pageRequest(long offset,int size){var p=request();return new AnalyticsSqlRequest(p.account(),p.warehouse(),p.customer(),p.sku(),p.salesRun(),p.inventoryRun(),p.from(),p.until(),p.anchor(),p.windowFrom(),p.completeFrom(),p.completeUntil(),p.coveredFrom(),p.coveredUntil(),p.salesKnown(),p.formalSales(),p.completeWindow(),p.complete30(),p.stockFresh(),offset,size,"INVENTORY",java.util.List.of());}
+    private AnalyticsSqlRequest request(boolean complete,boolean fresh){var p=request();return new AnalyticsSqlRequest(p.account(),p.warehouse(),null,null,p.salesRun(),p.inventoryRun(),p.from(),p.until(),p.anchor(),p.windowFrom(),p.completeFrom(),p.completeUntil(),p.coveredFrom(),p.coveredUntil(),p.salesKnown(),p.formalSales(),complete,complete,fresh,p.offset(),p.size(),p.kind(),java.util.List.of());}
+    private static AnalyticsInventoryOptions options(){return new AnalyticsInventoryOptions(null,null,null,null,null,null,null,null,null,null);}
+    @SuppressWarnings("unchecked") private List<Map<String,Object>> report(){
+        return ((List<Map<String,Object>>)(List<?>)query(DashboardReadMapper.class,"report",Map.of("p",request(),"o",options()))).stream().map(row->{
+            Map<String,Object> normalized=new HashMap<>();row.forEach((key,value)->normalized.put(key.toLowerCase(Locale.ROOT),value));return normalized;
+        }).toList();
+    }
+    private Map<String,Object> stats(){return report().get(0);}
+    private List<DashboardReadMapper.Ranked> ranks(){return report().stream().filter(row->row.get("rank_code")!=null).map(DashboardQueryService::ranked).toList();}
+    private static long count(Map<String,Object> stats,String key){return ((Number)stats.get(key)).longValue();}
+    private List<?> query(Class<?> mapper,String method,Map<String,Object> args){
+        return query(mapper,method,args,false);
+    }
+    private List<?> query(Class<?> mapper,String method,Map<String,Object> args,boolean originalAggregates){return query(mapper,method,args,originalAggregates,false);}
+    private List<?> query(Class<?> mapper,String method,Map<String,Object> args,boolean originalAggregates,boolean classifiedIdentities){
+        var original=config.getMappedStatement(mapper.getName()+"."+method);var bound=original.getBoundSql(args);var meta=org.apache.ibatis.reflection.SystemMetaObject.forObject(args);
+        StringBuilder sql=new StringBuilder();int index=0;boolean quoted=false;
+        for(int i=0;i<bound.getSql().length();i++){char ch=bound.getSql().charAt(i);if(ch=='\'')quoted=!quoted;
+            if(ch!='?'||quoted){sql.append(ch);continue;}String key=bound.getParameterMappings().get(index++).getProperty();Object v=meta.getValue(key);
+            if(v==null)sql.append("NULL");else if(v instanceof Boolean b)sql.append(b?1:0);else if(v instanceof Number)sql.append(v);else sql.append("'").append(v.toString().replace("'","''")).append("'");
+        }
+        String rendered=sql.toString();
+        // This fixture literalizes bound booleans. H2 then folds the false stock CASE to
+        // an untyped NULL before SUM resolves its type; MySQL retains the DECIMAL type.
+        // Preserve only that NULL's fixture-column type, equally for old and new SQL.
+        for(String field:List.of("physical_quantity","available_quantity","frozen_quantity","transit_quantity","defective_physical_quantity"))
+            rendered=rendered.replace("CASE WHEN c.stock_unit_valid=1 AND 0=1 THEN st."+field+" END","CAST(NULL AS DECIMAL(20,6))");
+        if(originalAggregates)rendered=rendered.replace("1=0 /* dashboard unused sales */ AND ","").replace("1=0 /* dashboard unused stock */ AND ","");
+        if(classifiedIdentities){
+            // Expose identities from the actual dashboard classification CTE; never reimplement its bucket formula in the test.
+            String finalSelect="SELECT s.*,r.* FROM statistics s LEFT JOIN rankings r ON 1=1";
+            assertTrue(rendered.endsWith(finalSelect));rendered=rendered.substring(0,rendered.length()-finalSelect.length())
+                +"SELECT customer_code,sku_code,bucket_code FROM classified WHERE bucket_code IS NOT NULL";
+        }
+        String id="dashboard.literal."+(++sequence);config.addMappedStatement(new MappedStatement.Builder(config,id,new org.apache.ibatis.builder.StaticSqlSource(config,rendered),SqlCommandType.SELECT).resultMaps(original.getResultMaps()).build());return session.selectList(id);
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/query/InventoryTurnoverContextTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/query/InventoryTurnoverContextTest.java
new file mode 100644
index 000000000..931aca795
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/query/InventoryTurnoverContextTest.java
@@ -0,0 +1,166 @@
+package com.baiyue.lastleg.selfoperated.analytics.query;
+
+import com.baiyue.common.core.exception.BizException;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import java.time.*;
+import java.util.*;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import static com.baiyue.lastleg.selfoperated.analytics.query.AnalyticsReadRows.*;
+import static org.junit.jupiter.api.Assertions.*;
+import static org.mockito.Mockito.*;
+
+class InventoryTurnoverContextTest {
+    private static final Instant NOW=Instant.parse("2026-10-13T04:00:00Z");
+    private static final LocalDate END=LocalDate.of(2026,10,12);
+    private static final String SH="a".repeat(64),IH="b".repeat(64);
+    private final ObjectMapper json=new ObjectMapper().findAndRegisterModules();
+    private AnalyticsReadMapper analytics;
+    private InventoryTurnoverReadMapper mapper;
+    private InventoryTurnoverContext contexts;
+    @BeforeEach void setup() {
+        analytics=mock(AnalyticsReadMapper.class);mapper=mock(InventoryTurnoverReadMapper.class);
+        contexts=at(NOW);
+        when(analytics.scopes("demo","W")).thenReturn(List.of(scope(1,"OUTBOUND",SH,11L),scope(2,"INVENTORY",IH,22L)));
+        for(var run:List.of(run(11,1,SH),run(22,2,IH))) {
+            when(analytics.publishedRun(run.id())).thenReturn(run);
+            when(mapper.versionAt(eq(run.scopeId()),eq(run.scopeHash()),any())).thenReturn(run);
+        }
+        when(mapper.samples(eq("demo"),eq("W"),eq(IH),any(),any(),any())).thenReturn(List.of(new InventoryTurnoverReadMapper.DayVersion(END,100L)));
+        when(mapper.fixedSamples(eq("demo"),eq("W"),eq(IH),any())).thenReturn(List.of(new InventoryTurnoverReadMapper.DayVersion(END,100L)));
+        when(mapper.accumulationStartedOn(eq("demo"),eq("W"),eq(IH),any())).thenReturn(END);
+    }
+    @Test void sameContextFreezesAllThirtyDatesAndMissingSamples() {
+        var first=contexts.resolve(request(null)).response();
+        assertEquals(30,first.dailySamples().size());assertEquals(29,first.missingSampleDates().size());
+        assertEquals(END.minusDays(29),first.analyticsContext().rangeStartDate());
+        assertEquals(END.plusDays(1),first.analyticsContext().rangeEndDateExclusive());
+        assertEquals(first,at(NOW.plusSeconds(60)).resolve(request(first.snapshotContext())).response());
+        var page2=new InventoryTurnoverRequest("demo","W",END,30,"SKU",null,null,"ALL",null,null,"PHYSICAL_DESC",2,20,false,first.snapshotContext(),false);
+        var second=at(NOW.plusSeconds(90)).resolve(page2);
+        assertEquals(first,second.response());
+        assertEquals(InventoryTurnoverSql.input(request(first.snapshotContext()),contexts.resolve(request(first.snapshotContext()))).days(),
+            InventoryTurnoverSql.input(page2,second).days());
+        verify(mapper,times(1)).samples("demo","W",IH,utc(NOW),END.minusDays(29),END.plusDays(1));
+        // Even a late commit bearing an older wall-clock timestamp cannot change the exact mapping.
+        when(mapper.samples(eq("demo"),eq("W"),eq(IH),any(),any(),any())).thenReturn(List.of(new InventoryTurnoverReadMapper.DayVersion(END,101L)));
+        assertEquals(first,contexts.resolve(request(first.snapshotContext())).response());
+        // Explicit invalidation revokes the old evidence rather than silently switching its version.
+        when(mapper.fixedSamples(eq("demo"),eq("W"),eq(IH),any())).thenReturn(List.of());
+        assertThrows(BizException.class,()->contexts.resolve(request(first.snapshotContext())));
+    }
+    @Test void fullYearContextRemainsSmallAndReconstructsEveryMissingDate() {
+        var q=new InventoryTurnoverRequest("demo","W",END,366,"SKU",null,null,"ALL",null,null,"PHYSICAL_DESC",1,20,true,null,false);
+        var first=contexts.resolve(q).response();
+        assertEquals(366,first.dailySamples().size());assertEquals(365,first.missingSampleDates().size());
+        assertTrue(first.snapshotContext().length()<2048);
+        var next=new InventoryTurnoverRequest("demo","W",END,366,"SKU",null,null,"ALL",null,null,"PHYSICAL_DESC",2,20,false,first.snapshotContext(),false);
+        assertEquals(first,at(NOW.plusSeconds(60)).resolve(next).response());
+        when(mapper.fixedSamples(eq("demo"),eq("W"),eq(IH),any())).thenReturn(List.of());
+        assertThrows(BizException.class,()->contexts.resolve(next));
+    }
+    @Test void rejectsTamperedVersionsMappingWarehouseAndExpiry() throws Exception {
+        String token=contexts.resolve(request(null)).response().snapshotContext();
+        String tampered=(token.charAt(0)=='A'?"B":"A")+token.substring(1);
+        assertThrows(BizException.class,()->contexts.resolve(request(tampered)));
+        var another=new InventoryTurnoverRequest("demo","OTHER",END,30,"SKU",null,null,"ALL",null,null,null,1,20,true,token,false);
+        assertThrows(BizException.class,()->contexts.resolve(another));
+        assertThrows(BizException.class,()->at(NOW.plusSeconds(1800)).resolve(request(token)));
+        assertThrows(BizException.class,()->at(NOW.minusSeconds(1)).resolve(request(token)));
+        assertThrows(BizException.class,()->contexts.resolve(request("not-a-token")));
+    }
+    @Test void absentVersionsStayAbsentAndUnconfiguredWarehouseIsRejected() {
+        when(mapper.versionAt(anyLong(),anyString(),any())).thenReturn(null);
+        var c=contexts.resolve(request(null)).response();
+        assertEquals(0L,c.analyticsContext().salesRunId());assertEquals(0L,c.analyticsContext().inventoryRunId());
+        assertEquals("UNKNOWN",c.analyticsContext().inventoryStatus());
+        var absent=InventoryTurnoverSql.chartInput(request(null),contexts.resolve(request(null)));
+        assertFalse(absent.salesKnown());assertTrue(absent.days().stream().allMatch(d->d.coverage()==0));
+        assertEquals(c,contexts.resolve(request(c.snapshotContext())).response());
+        when(analytics.scopes("demo","W")).thenReturn(List.of());
+        assertThrows(BizException.class,()->contexts.resolve(request(null)));
+    }
+    @Test void rejectsDuplicateRepresentativesAndScopeDrift() {
+        when(mapper.samples(eq("demo"),eq("W"),eq(IH),any(),any(),any())).thenReturn(List.of(
+            new InventoryTurnoverReadMapper.DayVersion(END,100L),new InventoryTurnoverReadMapper.DayVersion(END,101L)));
+        assertThrows(BizException.class,()->contexts.resolve(request(null)));
+        when(analytics.publishedRun(11L)).thenReturn(run(11,2,IH));
+        assertThrows(BizException.class,()->contexts.resolve(request(null)));
+    }
+    @Test void localHistoryCoverageSurvivesAgeButRebuildDoesNotAuthorizeFormalSales() {
+        var old=at(NOW.plusSeconds(200000)).resolve(request(null));
+        assertEquals("STALE",old.response().analyticsContext().inventoryStatus());
+        assertTrue(InventoryTurnoverSql.input(request(null),old).days().stream().allMatch(d->d.coverage()==1));
+        when(analytics.applyBarriers("demo","W")).thenReturn(1L);
+        var rebuilding=contexts.resolve(request(null));
+        assertTrue(InventoryTurnoverSql.input(request(null),rebuilding).days().stream().allMatch(d->d.coverage()==0));
+        assertTrue(rebuilding.response().analyticsContext().rebuildRequired());
+        assertTrue(InventoryTurnoverSql.chartInput(request(null),rebuilding).days().stream().allMatch(d->d.coverage()==1));
+    }
+    @Test void publishedChartRetainsEighteenCoveredDaysWhileCurrentAssessmentsWaitForRebuild() {
+        var published=run(11,1,SH);
+        var eighteen=new Run(published.id(),published.taskId(),published.scopeId(),published.sourceAccount(),published.warehouseCode(),published.runRole(),
+            published.scopeHash(),published.scopeSnapshotJson(),published.status(),published.coverageStatus(),
+            END.minusDays(17).atStartOfDay().minusHours(8),published.coveredUntilUtc(),END.minusDays(17),published.completeDayUntil(),
+            published.fetchStartedAtUtc(),published.fetchFinishedAtUtc(),published.publishedAtUtc(),published.calculatedFactRevision(),null,null,null,"BUSINESS",true);
+        when(analytics.publishedRun(11L)).thenReturn(eighteen);
+        when(mapper.versionAt(eq(1L),eq(SH),any())).thenReturn(eighteen);
+        when(analytics.applyBarriers("demo","W")).thenReturn(1L);
+        when(mapper.report(any())).thenReturn(List.of(Map.of("section","TOTAL","payload","{\"total\":0}"),
+            Map.of("section","OVERVIEW","payload","{\"sku_count\":0}")));
+        var result=new InventoryTurnoverQueryService(contexts,mapper,json,org.mockito.Mockito.mock(SelfopOwnerDirectory.class)).query(request(null));
+        assertTrue(result.context().analyticsContext().rebuildRequired());
+        verify(mapper).report(argThat(p->p.days().stream().allMatch(d->d.coverage()==0)));
+        verify(mapper).chartWindows(argThat(p->p.salesRun()==11L&&p.inventoryRun()==22L&&p.salesKnown()
+            &&p.days().stream().filter(d->d.coverage()==1).count()==18
+            &&p.days().subList(0,12).stream().allMatch(d->d.coverage()==0)
+            &&p.days().subList(15,30).stream().allMatch(d->d.coverage()==1)));
+    }
+    @Test void volumeChartUsesDirectoryNamesAndKeepsEstimateEvidence() {
+        var directory=mock(SelfopOwnerDirectory.class);
+        when(directory.names(any(),any())).thenReturn(Map.of("C","货主甲"));
+        when(mapper.report(any())).thenReturn(List.of(
+            Map.of("section","TOTAL","payload","{\"total\":0}"),
+            Map.of("section","OVERVIEW","payload","{\"sku_count\":0}"),
+            Map.of("section","OWNER_VOLUME","payload","{\"customer_code\":\"C\",\"physical_volume\":12.345678,\"physical_estimated_quantity\":9}"),
+            Map.of("section","OWNER_VOLUME_META","payload","{\"unknown_count\":2}")));
+        var charts=new InventoryTurnoverQueryService(contexts,mapper,json,directory).query(request(null)).charts();
+        assertEquals(2,charts.unknownVolumeOwnerCount());assertEquals(1,charts.ownerVolumeTop().size());
+        var owner=charts.ownerVolumeTop().get(0);assertEquals("货主甲",owner.customerName());
+        assertEquals(new java.math.BigDecimal("12.345678"),owner.inventoryVolumeM3().value());
+        assertTrue(owner.inventoryVolumeM3().reasonCodes().contains("DECLARED_DIMENSIONS_ESTIMATE"));
+    }
+    @Test void firstPageSharesAggregationAndPaginationDoesNotRepeatOverviewQueries() {
+        var service=new InventoryTurnoverQueryService(contexts,mapper,json,org.mockito.Mockito.mock(SelfopOwnerDirectory.class));
+        when(mapper.report(any())).thenReturn(List.of(Map.of("section","TOTAL","payload","{\"total\":0}"),
+            Map.of("section","OVERVIEW","payload","{\"sku_count\":0,\"physical\":0,\"available\":0,\"no_outbound_count\":0,\"unassessable\":0}")));
+        var first=service.query(request(null));assertEquals(0,first.total());assertNotNull(first.summary());assertNotNull(first.charts());
+        verify(mapper).report(any());verify(mapper).chartWindows(any());
+        verify(mapper,never()).page(any());verify(mapper,never()).count(any());verify(mapper,never()).overview(any());verify(mapper,never()).owners(any());
+        clearInvocations(mapper);
+        when(mapper.report(any())).thenReturn(List.of(Map.of("section","TOTAL","payload","{\"total\":0}")));
+        var q=new InventoryTurnoverRequest("demo","W",END,30,"SKU",null,null,"ALL",null,null,null,2,20,false,first.context().snapshotContext(),false);
+        var next=service.query(q);assertNull(next.summary());assertNull(next.charts());verify(mapper).report(any());verify(mapper,never()).chartWindows(any());
+    }
+    @Test void fullYearContextKeepsExactVersionsAndBoundedSignedToken() {
+        var versions=java.util.stream.IntStream.range(0,366).mapToObj(i->new InventoryTurnoverReadMapper.DayVersion(END.minusDays(365-i),2110000000000000000L+i*100000003L)).toList();
+        when(mapper.samples(eq("demo"),eq("W"),eq(IH),any(),any(),any())).thenReturn(versions);
+        when(mapper.fixedSamples(eq("demo"),eq("W"),eq(IH),any())).thenReturn(versions);
+        var first=new InventoryTurnoverRequest("demo","W",END,366,"SKU",null,null,"ALL",null,null,null,1,20,true,null,false);
+        var frozen=contexts.resolve(first).response();
+        assertEquals(366,frozen.dailySamples().size());
+        assertTrue(frozen.snapshotContext().length()<7500);
+        var next=new InventoryTurnoverRequest("demo","W",END,366,"SKU",null,null,"ALL",null,null,null,2,20,false,frozen.snapshotContext(),false);
+        assertEquals(frozen,contexts.resolve(next).response());
+    }
+    private InventoryTurnoverContext at(Instant instant){return new InventoryTurnoverContext(analytics,mapper,json,Clock.fixed(instant,ZoneOffset.UTC),mock(SelfopOwnerDirectory.class));}
+    static InventoryTurnoverRequest request(String token){return new InventoryTurnoverRequest("demo","W",END,30,"SKU",null,null,"ALL",null,null,null,1,20,true,token,false);}
+    private static LocalDateTime utc(Instant instant){return LocalDateTime.ofInstant(instant,ZoneOffset.UTC);}
+    private static Scope scope(long id,String family,String hash,long run){return new Scope(id,"demo","W",family,hash,"Asia/Shanghai","Asia/Shanghai",93600,run,1L,1L,false,null,null,7);}
+    private static Run run(long id,long scope,String hash){
+        return new Run(id,id+100,scope,"demo","W","WAREHOUSE_SYNC",hash,
+            "{\"businessTimezone\":\"Asia/Shanghai\",\"sourceTimezone\":\"Asia/Shanghai\",\"staleAfterSeconds\":93600}","PUBLISHED","COMPLETE",
+            END.minusDays(29).atStartOfDay().minusHours(8),END.plusDays(1).atStartOfDay().minusHours(8),END.minusDays(29),END.plusDays(1),
+            utc(NOW.minusSeconds(3660)),utc(NOW.minusSeconds(3600)),utc(NOW.minusSeconds(3500)),1L,null,null,null,"BUSINESS",true);
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/query/InventoryTurnoverExportTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/query/InventoryTurnoverExportTest.java
new file mode 100644
index 000000000..a3171e35d
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/query/InventoryTurnoverExportTest.java
@@ -0,0 +1,84 @@
+package com.baiyue.lastleg.selfoperated.analytics.query;
+
+import com.baiyue.common.core.export.ExportContracts.*;
+import com.baiyue.lastleg.export.LastlegExportProviderService;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import org.junit.jupiter.api.Test;
+import org.springframework.test.util.ReflectionTestUtils;
+import org.springframework.web.server.ResponseStatusException;
+import java.util.*;
+import java.math.BigDecimal;
+import static com.baiyue.lastleg.selfoperated.analytics.query.InventoryTurnoverResponses.*;
+import static org.junit.jupiter.api.Assertions.*;
+import static org.mockito.Mockito.*;
+
+class InventoryTurnoverExportTest {
+    final ObjectMapper json=new ObjectMapper().findAndRegisterModules();
+    final InventoryTurnoverQueryService queries=mock(InventoryTurnoverQueryService.class);
+    final InventoryTurnoverExport export=new InventoryTurnoverExport(queries,json);
+    Map<String,Object> parameters() {
+        Map<String,Object> p=new LinkedHashMap<>();
+        p.put("sourceAccount","demo");p.put("warehouseCode","W");p.put("endDate","2026-10-14");p.put("baseWindowDays",30);
+        p.put("groupBy","SKU");p.put("customerCodes",List.of("A","B"));p.put("sortBy","TURNOVER_DESC");p.put("hideZeroInventory",true);
+        p.put("snapshotContext","fixed");p.put("expectedTotal",205);p.put("columns",List.of("quantityTurnoverRate","sku","inventoryVolumeM3"));return p;
+    }
+    ExportBatchRequest request(Map<String,Object> p,String cursor,String token) {return new ExportBatchRequest("task","0","PLATFORM","user",1,p,cursor,token,100);}
+    Row row(int i) {
+        Map<String,Object> r=new LinkedHashMap<>();r.put("sku",i==0?"=SUM(1,2)":"S"+i);r.put("customerCode","A");r.put("customerName","货主甲");
+        r.put("quantityTurnoverCount",i==1?null:i==2?0:new BigDecimal("1.25"));r.put("averagePhysicalQuantity",new BigDecimal("80"));
+        r.put("windows",List.of(Map.of("days",30,"outboundQuantity",100,"dataStatus","COMPLETE")));
+        r.put("qualifiedSampleDays",30);r.put("requiredSampleDays",30);r.put("sampleReasonCodes",List.of());
+        r.put("inventoryVolumeM3",Map.of("knownSubtotal",1,"missingDimensionSkuCount",2,"missingDimensionQuantity",3,"declaredDimensionQuantity",4));
+        return json.convertValue(r,Row.class);
+    }
+    Response response(InventoryTurnoverRequest q,long total,String token) {
+        Context c=mock(Context.class);when(c.snapshotContext()).thenReturn(token);
+        List<Row> rows=java.util.stream.IntStream.range((int)q.offset(),(int)Math.min(total,q.offset()+q.pageSize())).mapToObj(this::row).toList();
+        return new Response(c,null,null,rows,total);
+    }
+    LastlegExportProviderService provider() {
+        var p=new LastlegExportProviderService();ReflectionTestUtils.setField(p,"json",json);ReflectionTestUtils.setField(p,"turnover",export);
+        ReflectionTestUtils.setField(p,"signingKey","test-export-signing-key-with-32-bytes");return p;
+    }
+    @Test void batchesAllRowsWithVisibleColumnOrderPercentageNotesAndFrozenFilters() {
+        when(queries.query(any())).thenAnswer(c->response(c.getArgument(0),205,"fixed"));
+        var p=provider();var first=p.batch(InventoryTurnoverExport.TYPE,request(parameters(),null,null));
+        assertEquals(List.of("quantityTurnoverRate","sku","inventoryVolumeM3"),first.columns().subList(0,3).stream().map(ExportColumn::key).toList());
+        assertEquals("125%",first.rows().get(0).get("quantityTurnoverRate"));assertEquals("—",first.rows().get(1).get("quantityTurnoverRate"));assertEquals("0%",first.rows().get(2).get("quantityTurnoverRate"));
+        assertTrue(first.rows().get(0).get("inventoryVolumeM3").toString().contains("缺尺寸 2 SKU / 3 件"));
+        assertEquals("库存流水还原（日末实物库存）",first.rows().get(0).get("historySource"));
+        var second=p.batch(InventoryTurnoverExport.TYPE,request(parameters(),first.nextCursor(),first.snapshotToken()));
+        var third=p.batch(InventoryTurnoverExport.TYPE,request(parameters(),second.nextCursor(),second.snapshotToken()));
+        assertEquals(205,first.rows().size()+second.rows().size()+third.rows().size());assertFalse(third.hasMore());assertTrue(second.columns().isEmpty());assertEquals(first.schemaHash(),third.schemaHash());
+        verify(queries).query(argThat(q->q.page()==2&&q.pageSize()==100&&!q.overview()&&q.hideZero()&&q.customerCodes().equals(List.of("A","B"))&&q.sort().equals("TURNOVER_DESC")&&q.snapshotContext().equals("fixed")));
+        var changed=parameters();changed.put("columns",List.of("sku"));
+        assertThrows(ResponseStatusException.class,()->p.batch(InventoryTurnoverExport.TYPE,request(changed,"100",first.snapshotToken())));
+        assertThrows(ResponseStatusException.class,()->p.batch(InventoryTurnoverExport.TYPE,new ExportBatchRequest("task","0","PLATFORM","other",1,parameters(),"100",first.snapshotToken(),100)));
+        assertThrows(ResponseStatusException.class,()->p.batch(InventoryTurnoverExport.TYPE,new ExportBatchRequest("task","2","CLIENT","user",1,parameters(),null,null,100)));
+    }
+    @Test void rejectsStaleOrChangedDataWithoutReturningPartialFileAndSupportsEmptyResults() {
+        doAnswer(c->response(c.getArgument(0),204,"fixed")).when(queries).query(any());
+        assertThrows(com.baiyue.common.core.exception.BizException.class,()->export.batch(request(parameters(),null,null),0,"signed"));
+        doAnswer(c->response(c.getArgument(0),205,"other")).when(queries).query(any());
+        assertThrows(com.baiyue.common.core.exception.BizException.class,()->export.batch(request(parameters(),null,null),0,"signed"));
+        var empty=parameters();empty.put("expectedTotal",0);doAnswer(c->response(c.getArgument(0),0,"fixed")).when(queries).query(any());
+        var result=export.batch(request(empty,null,null),0,"signed");assertFalse(result.hasMore());assertEquals(0L,result.totalRows());assertFalse(result.columns().isEmpty());
+        doThrow(new com.baiyue.common.core.exception.BizException("库存周转上下文无效或已过期，请整体刷新")).when(queries).query(any());
+        assertThrows(com.baiyue.common.core.exception.BizException.class,()->export.batch(request(parameters(),null,null),0,"signed"));
+    }
+    @Test void validatesColumnsPaginationAndSnapshotBeforeQuerying() {
+        for(var columns:List.of(List.of("internalId"),List.of("sku","sku"))) {
+            var p=parameters();p.put("columns",columns);assertThrows(com.baiyue.common.core.exception.BizException.class,()->export.batch(request(p,null,null),0,"s"));
+        }
+        var owner=parameters();owner.put("groupBy","OWNER");assertThrows(com.baiyue.common.core.exception.BizException.class,()->export.batch(request(owner,null,null),0,"s"));
+        var noContext=parameters();noContext.remove("snapshotContext");assertThrows(com.baiyue.common.core.exception.BizException.class,()->export.batch(request(noContext,null,null),0,"s"));
+        var paged=parameters();paged.put("current",1);assertThrows(com.baiyue.common.core.exception.BizException.class,()->export.batch(request(paged,null,null),0,"s"));
+        verifyNoInteractions(queries);
+        assertEquals("<0.01",InventoryTurnoverExport.number(new BigDecimal("0.00001"),2));
+    }
+    @Test void ownerExportUsesTheServerAggregateWithoutAveragingSkuPercentages() {
+        var p=parameters();p.put("groupBy","OWNER");p.put("columns",List.of("customerCode","quantityTurnoverRate"));p.put("expectedTotal",1);
+        when(queries.query(any())).thenAnswer(c->response(c.getArgument(0),1,"fixed"));
+        var result=export.batch(request(p,null,null),0,"signed");assertEquals("货主甲",result.rows().get(0).get("customerCode"));assertEquals("125%",result.rows().get(0).get("quantityTurnoverRate"));
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/query/InventoryTurnoverPolicyTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/query/InventoryTurnoverPolicyTest.java
new file mode 100644
index 000000000..ece0ea4c9
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/query/InventoryTurnoverPolicyTest.java
@@ -0,0 +1,38 @@
+package com.baiyue.lastleg.selfoperated.analytics.query;
+
+import java.math.BigDecimal;
+import java.util.*;
+import org.junit.jupiter.api.Test;
+import static org.junit.jupiter.api.Assertions.*;
+import static com.baiyue.lastleg.selfoperated.analytics.query.InventoryTurnoverResponses.*;
+
+class InventoryTurnoverPolicyTest {
+    static Context context() {
+        return new Context(null,"demo","W",InventoryTurnoverSqlTest.END,30,null,null,null,null,null,null,List.of(),List.of(),null);
+    }
+    private Row mapped(String average,String turnover,int samples) {
+        var raw=new HashMap<String,Object>();raw.put("average_physical",average);raw.put("turnover",turnover);raw.put("sample_count",samples);
+        raw.put("w30_outbound",BigDecimal.ONE);raw.put("w30_complete",30);
+        return InventoryTurnoverPolicy.row(raw,InventoryTurnoverSqlTest.request("SKU","ALL","TURNOVER_DESC",null,null,1,20),context());
+    }
+    @Test void tinyPositiveAverageQualifiesBeforeSixPlaceOutputRounding() {
+        var row=mapped("0.0000000333","30000000",30);
+        assertEquals("VALID",row.turnoverStatus());assertTrue(row.sampleReasonCodes().isEmpty());
+        assertEquals(new BigDecimal("0.000000"),row.averagePhysicalQuantity());
+        assertEquals(new BigDecimal("30000000.000000"),row.quantityTurnoverCount());
+    }
+    @Test void zeroUnknownAndIncompleteSamplesCannotLeakATurnoverValue() {
+        for(var input:List.of(new String[]{"0","ZERO_AVERAGE_STOCK"},new String[]{null,"INSUFFICIENT"})) {
+            var row=mapped(input[0],"30000000",30);assertNull(row.quantityTurnoverCount());
+            assertEquals(input[1],row.turnoverStatus());assertEquals(List.of(input[1]),row.sampleReasonCodes());
+        }
+        var row=mapped("1","30000000",29);assertNull(row.quantityTurnoverCount());
+        assertEquals("INSUFFICIENT",row.turnoverStatus());assertEquals(List.of("INSUFFICIENT"),row.sampleReasonCodes());
+    }
+    @Test void positiveAverageSeparatesMissingSalesFromKnownZeroSales() {
+        var missing=mapped("0.0000000333",null,30);assertNull(missing.quantityTurnoverCount());
+        assertEquals("SALES_WINDOW_UNAVAILABLE",missing.turnoverStatus());assertEquals(List.of("SALES_WINDOW_UNAVAILABLE"),missing.sampleReasonCodes());
+        var zero=mapped("0.0000000333","0",30);assertEquals("VALID",zero.turnoverStatus());
+        assertEquals(new BigDecimal("0.000000"),zero.quantityTurnoverCount());
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/query/InventoryTurnoverQueryServiceTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/query/InventoryTurnoverQueryServiceTest.java
new file mode 100644
index 000000000..7e0307d85
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/query/InventoryTurnoverQueryServiceTest.java
@@ -0,0 +1,21 @@
+package com.baiyue.lastleg.selfoperated.analytics.query;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import org.junit.jupiter.api.Test;
+import java.util.*;
+import java.time.Instant;
+import static org.mockito.Mockito.*;
+import static org.junit.jupiter.api.Assertions.*;
+class InventoryTurnoverQueryServiceTest {
+    @Test void totalsWithoutCustomerIdentityRemainReadableBeforeFirstDirectoryPublication(){
+        var contexts=mock(InventoryTurnoverContext.class);var mapper=mock(InventoryTurnoverReadMapper.class);var directory=mock(SelfopOwnerDirectory.class);
+        var request=mock(InventoryTurnoverRequest.class);when(request.sourceAccount()).thenReturn("A");
+        var context=mock(InventoryTurnoverResponses.Context.class);var analytics=mock(AnalyticsResponses.Context.class);
+        var snapshot=mock(AnalyticsQueryService.Snapshot.class);var asOf=Instant.parse("2026-10-14T08:00:00Z");
+        when(context.queryAsOf()).thenReturn(asOf);when(context.analyticsContext()).thenReturn(analytics);when(context.dailySamples()).thenReturn(List.of());
+        when(contexts.resolve(request)).thenReturn(new InventoryTurnoverContext.Frozen(context,snapshot));
+        when(mapper.report(any())).thenReturn(List.of(Map.of("section","TOTAL","payload","{\"total\":0}")));
+        var service=new InventoryTurnoverQueryService(contexts,mapper,new ObjectMapper(),directory);
+        when(directory.names("A",asOf)).thenReturn(Map.of());assertEquals(0,service.query(request).total());
+        when(directory.names("A",asOf)).thenReturn(Map.of("C","货主名称"));assertEquals(0,service.query(request).total());
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/query/InventoryTurnoverRequestTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/query/InventoryTurnoverRequestTest.java
new file mode 100644
index 000000000..1ada14f91
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/query/InventoryTurnoverRequestTest.java
@@ -0,0 +1,40 @@
+package com.baiyue.lastleg.selfoperated.analytics.query;
+
+import com.baiyue.common.core.exception.BizException;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import java.time.LocalDate;
+import java.util.*;
+import org.junit.jupiter.api.Test;
+import static org.junit.jupiter.api.Assertions.*;
+
+class InventoryTurnoverRequestTest {
+    private final ObjectMapper json=new ObjectMapper().findAndRegisterModules();
+    private static final LocalDate TODAY=LocalDate.of(2026,10,13);
+    private InventoryTurnoverRequest request(Map<String,Object> override) {
+        Map<String,Object> values=new HashMap<>();values.put("sourceAccount","demo");values.put("warehouseCode","W");values.putAll(override);
+        return json.convertValue(values,InventoryTurnoverRequest.class);
+    }
+    @Test void defaultsToYesterdayThirtyDaysAndFirstPageOverview() {
+        var q=request(Map.of("includeOverview",false));q.validate(TODAY);
+        assertEquals(TODAY.minusDays(1),q.end(TODAY));assertEquals(30,q.days());assertEquals("SKU",q.group());assertEquals(20,q.pageSize());assertTrue(q.overview());assertTrue(q.hideZero());
+        assertFalse(request(Map.of("hideZeroInventory",false)).hideZero());
+        assertTrue(request(Map.of("hideZeroInventory",true)).hideZero());
+    }
+    @Test void validatesMultipleOwnersAndRejectsTheRemovedSingleOwnerParameter() {
+        request(Map.of("customerCodes",List.of("A","B"))).validate(TODAY);
+        request(Map.of("customerCodes",List.of())).validate(TODAY);
+        assertThrows(BizException.class,()->request(Map.of("customerCodes",List.of(""))).validate(TODAY));
+        assertThrows(BizException.class,()->request(Map.of("customerCodes",Collections.nCopies(101,"A"))).validate(TODAY));
+        assertThrows(BizException.class,()->InventoryTurnoverRequest.validateParameters(Set.of("customerCode")));
+    }
+    @Test void rejectsIncompleteDatesFiltersSortsAndUnpinnedPagination() {
+        for(var invalid:List.of(Map.<String,Object>of("endDate","2026-10-13"),Map.<String,Object>of("baseWindowDays",367),
+            Map.<String,Object>of("groupBy","OWNER","sku","S"),Map.<String,Object>of("groupBy","OWNER","sortBy","COVERAGE_DESC"),
+            Map.<String,Object>of("sortBy","NO_OUTBOUND_PHYSICAL_DESC"),Map.<String,Object>of("current",2),
+            Map.<String,Object>of("size",101),Map.<String,Object>of("coverageDaysThreshold",0),Map.<String,Object>of("focus","COVERAGE_GT"),
+            Map.<String,Object>of("snapshotContext"," "),Map.<String,Object>of("turnoverStatus","VALID"))) {
+            assertThrows(BizException.class,()->request(invalid).validate(TODAY),invalid.toString());
+        }
+        request(Map.of("groupBy","OWNER","sortBy","NO_OUTBOUND_PHYSICAL_DESC","current",2,"snapshotContext","evidence")).validate(TODAY);
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/query/InventoryTurnoverSqlTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/query/InventoryTurnoverSqlTest.java
new file mode 100644
index 000000000..e5e0040bb
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/query/InventoryTurnoverSqlTest.java
@@ -0,0 +1,784 @@
+package com.baiyue.lastleg.selfoperated.analytics.query;
+
+import java.math.BigDecimal;
+import java.sql.*;
+import java.time.*;
+import java.util.*;
+import org.apache.ibatis.session.Configuration;
+import org.apache.ibatis.reflection.SystemMetaObject;
+import org.junit.jupiter.api.*;
+import static org.junit.jupiter.api.Assertions.*;
+
+/** Synthetic local SQL semantics only. Does not assert MySQL performance or deployed availability. */
+class InventoryTurnoverSqlTest {
+    private Connection db;
+    private final Configuration config=new Configuration();
+    static final LocalDate END=LocalDate.of(2026,10,12);
+    @BeforeEach void setup() throws Exception {
+        db=DriverManager.getConnection("jdbc:h2:mem:turnover_"+UUID.randomUUID()+";MODE=MySQL","sa","");
+        config.addMapper(InventoryTurnoverReadMapper.class);
+        execute("CREATE TABLE ll_selfop_sync_task(id BIGINT,source_account VARCHAR,task_type VARCHAR,task_role VARCHAR,execution_purpose VARCHAR)");
+        execute("CREATE TABLE ll_selfop_sync_run(id BIGINT,task_id BIGINT,source_account VARCHAR,execution_purpose VARCHAR,status VARCHAR,coverage_status VARCHAR,published_at_utc TIMESTAMP)");
+        execute("CREATE TABLE ll_selfop_product(run_id BIGINT,source_account VARCHAR,customer_code VARCHAR,sku_code VARCHAR,declared_length DECIMAL(24,6),declared_width DECIMAL(24,6),declared_height DECIMAL(24,6),declared_size_unit VARCHAR,measured_length DECIMAL(24,6),measured_width DECIMAL(24,6),measured_height DECIMAL(24,6),measured_size_unit VARCHAR)");
+        execute("CREATE ALIAS CONVERT_TZ FOR 'com.baiyue.lastleg.selfoperated.analytics.query.AnalyticsSqlSemanticTest.convertZone'");
+        execute("CREATE TABLE ll_selfop_sku_profile(profile_run_id BIGINT,source_account VARCHAR,warehouse_code VARCHAR,customer_code VARCHAR,sku_code VARCHAR,product_name VARCHAR,quantity_unit VARCHAR,evidence_type VARCHAR,evidence_run_id BIGINT,earliest_evidence_at_utc TIMESTAMP)");
+        execute("CREATE TABLE ll_selfop_sku_daily_sales(sales_run_id BIGINT,source_account VARCHAR,warehouse_code VARCHAR,customer_code VARCHAR,sku_code VARCHAR,business_date DATE,outbound_quantity DECIMAL(20,6),quantity_unit VARCHAR)");
+        execute("CREATE TABLE ll_selfop_inventory_snapshot(snapshot_run_id BIGINT,source_account VARCHAR,warehouse_code VARCHAR,customer_code VARCHAR,sku_code VARCHAR,product_quality INT,physical_quantity DECIMAL(20,6),available_quantity DECIMAL(20,6),frozen_quantity DECIMAL(20,6),transit_quantity DECIMAL(20,6),quality_status VARCHAR,quality_reason VARCHAR)");
+        execute("CREATE TABLE ll_selfop_inventory_day_version(id BIGINT PRIMARY KEY,source_account VARCHAR,warehouse_code VARCHAR,rule_version VARCHAR,invalidated_at TIMESTAMP)");
+        execute("CREATE TABLE ll_selfop_inventory_daily(day_version_id BIGINT,customer_code VARCHAR,sku_code VARCHAR,product_quality INT,physical_quantity DECIMAL(20,6),quality_status VARCHAR,quality_reason VARCHAR)");
+    }
+    @AfterEach void close() throws Exception {db.close();}
+    private void master() throws Exception {
+        execute("INSERT INTO ll_selfop_sync_task VALUES(900,'demo','MASTER_DATA','ACCOUNT_DISCOVERY','BUSINESS')");
+        execute("INSERT INTO ll_selfop_sync_run VALUES(901,900,'demo','BUSINESS','PUBLISHED','COMPLETE',TIMESTAMP '2026-10-12 00:00:00')");
+    }
+    private void product(String owner,String sku,String declared,String measured) throws Exception {
+        execute("INSERT INTO ll_selfop_product VALUES(901,'demo','"+owner+"','"+sku+"',"+declared+","+measured+")");
+    }
+    @Test void hidesOnlyKnownZeroPhysicalRowsBeforeCountAndPagingWithoutChangingOverview() throws Exception {
+        seed("A","POSITIVE",0);seed("A","ZERO",0);seed("B","ZERO",0);seed("C","UNKNOWN",0);
+        execute("UPDATE ll_selfop_inventory_snapshot SET physical_quantity=0 WHERE snapshot_run_id=22 AND sku_code='ZERO'");
+        execute("UPDATE ll_selfop_inventory_snapshot SET available_quantity=0 WHERE snapshot_run_id=22 AND customer_code='A'");
+        execute("UPDATE ll_selfop_inventory_snapshot SET physical_quantity=NULL,quality_status='UNKNOWN' WHERE snapshot_run_id=22 AND customer_code='C'");
+        for(String group:List.of("SKU","OWNER")) {
+            var all=new InventoryTurnoverRequest("demo","W",END,30,group,null,null,"ALL",null,null,"PHYSICAL_ASC",1,20,true,"fixed",false);
+            var hidden=new InventoryTurnoverRequest("demo","W",END,30,group,null,null,"ALL",null,null,"PHYSICAL_ASC",1,20,true,"fixed",null);
+            var visible=reportRows(input(hidden,30,0,true));
+            assertEquals(List.of("A","C"),visible.stream().map(r->r.get("customer_code")).toList());
+            assertEquals(group.equals("SKU")?4:3,reportRows(input(all,30,0,true)).size());
+            var report=query("report",input(hidden,30,0,true));
+            assertEquals(2,payload(report.stream().filter(r->"TOTAL".equals(r.get("section"))).findFirst().orElseThrow()).path("total").asInt());
+            assertEquals(query("overview",input(all,30,0,true)),query("overview",input(hidden,30,0,true)));
+            for(int page=1;page<=2;page++) {
+                var paged=new InventoryTurnoverRequest("demo","W",END,30,group,null,null,"ALL",null,null,"PHYSICAL_ASC",page,1,false,"fixed",true);
+                assertEquals(visible.get(page-1).get("customer_code"),reportRows(input(paged,30,0,true)).get(0).get("customer_code"));
+            }
+            if(group.equals("SKU"))assertEquals(4,query("page",input(hidden,30,0,false)).size(),"Stale stock stays unknown, not zero");
+        }
+        var exact=new InventoryTurnoverRequest("demo","W",END,30,"SKU",null,"ZERO","ALL",null,null,"PHYSICAL_DESC",1,20,true,"fixed",true);
+        assertTrue(reportRows(input(exact,30,0,true)).isEmpty());
+    }
+    @Test void filtersMultipleOwnersBeforeAggregationAndPaginationWithoutMergingSameSku() throws Exception {
+        seed("A","SAME",30);seed("B","SAME",30);seed("C","SAME",30);
+        for(String group:List.of("SKU","OWNER")) {
+            var selected=new InventoryTurnoverRequest("demo","W",END,30,group,List.of("B","A","A"),null,"ALL",null,null,"PHYSICAL_DESC",1,20,true,"fixed",false);
+            var p=input(selected,30,30,true);
+            var rows=reportRows(p);
+            assertEquals(List.of("A","B"),rows.stream().map(r->r.get("customer_code")).toList());
+            var all=input(new InventoryTurnoverRequest("demo","W",END,30,group,null,null,"ALL",null,null,"PHYSICAL_DESC",1,20,true,"fixed",false),30,30,true);
+            assertEquals(3,reportRows(all).size());
+            for(int page=1;page<=2;page++) {
+                var q=new InventoryTurnoverRequest("demo","W",END,30,group,List.of("A","B"),null,"ALL",null,null,"PHYSICAL_DESC",page,1,false,"fixed",false);
+                assertEquals(rows.get(page-1).get("customer_code"),reportRows(input(q,30,30,true)).get(0).get("customer_code"));
+            }
+            var overview=query("overview",p);
+            assertFalse(overview.isEmpty());
+            assertNotEquals(query("overview",all),overview);
+            var unknown=new InventoryTurnoverRequest("demo","W",END,30,group,List.of("' OR 1=1 --"),null,"ALL",null,null,"PHYSICAL_DESC",1,20,true,"fixed",false);
+            assertTrue(reportRows(input(unknown,30,30,true)).isEmpty());
+        }
+    }
+    @Test void ownerVolumeChartRanksFullTotalsExcludesUnknownsAndIgnoresListFilters() throws Exception {
+        master();
+        for(int i=0;i<12;i++) {
+            String owner=String.format("C%02d",i);seed(owner,"SAME",0);
+            product(owner,"SAME",(i<2?"1":Integer.toString(i))+",1,1,'m'","NULL,NULL,NULL,NULL");
+        }
+        seed("MISSING","SAME",0);seed("UNKNOWN","SAME",0);
+        product("UNKNOWN","SAME","100,1,1,'m'","NULL,NULL,NULL,NULL");
+        execute("UPDATE ll_selfop_inventory_snapshot SET quality_status='INVALID' WHERE customer_code='UNKNOWN'");
+        for(int days:List.of(7,30)) {
+            var q=new InventoryTurnoverRequest("demo","W",END,days,"SKU",null,"not-present","FROZEN",null,null,"PHYSICAL_DESC",2,1,true,"fixed",false);
+            var report=query("report",input(q,30,0,true));
+            var ranking=new ArrayList<com.fasterxml.jackson.databind.JsonNode>();
+            for(var part:report)if("OWNER_VOLUME".equals(part.get("section")))ranking.add(payload(part));
+            assertEquals(10,ranking.size());
+            assertEquals("C11",ranking.get(0).path("customer_code").asText());
+            assertEquals("C02",ranking.get(9).path("customer_code").asText());
+            decimal("6710",ranking.get(0).path("physical_volume").decimalValue());
+            decimal("610",ranking.get(0).path("physical_estimated_quantity").decimalValue());
+            assertEquals(2,payload(report.stream().filter(r->"OWNER_VOLUME_META".equals(r.get("section"))).findFirst().orElseThrow()).path("unknown_count").asInt());
+            assertTrue(report.stream().noneMatch(r->"ROW".equals(r.get("section"))));
+        }
+        execute("UPDATE ll_selfop_product SET declared_length=1");
+        var tied=query("report",input(request("OWNER","ALL","PHYSICAL_DESC",null,null,1,1),30,0,true));
+        var ranking=new ArrayList<com.fasterxml.jackson.databind.JsonNode>();
+        for(var part:tied)if("OWNER_VOLUME".equals(part.get("section")))ranking.add(payload(part));
+        assertEquals("C00",ranking.get(0).path("customer_code").asText());
+        assertEquals("C09",ranking.get(9).path("customer_code").asText());
+        execute("UPDATE ll_selfop_inventory_snapshot SET quality_status='INVALID'");
+        var unknown=query("report",input(request("SKU","ALL","PHYSICAL_DESC",null,null,1,1),30,0,true));
+        assertTrue(unknown.stream().noneMatch(r->"OWNER_VOLUME".equals(r.get("section"))));
+    }
+    @Test void volumeSortsUseSelectedWindowFormalValuesBeforePagingWithStableTiesAndUnknownLast() throws Exception {
+        master();
+        for(String owner:List.of("A","B","C","D"))seed(owner,"SAME",0);
+        for(String owner:List.of("A","B","D"))product(owner,"SAME",("B".equals(owner)?"2":"1")+",1,1,'m'","NULL,NULL,NULL,NULL");
+        execute("UPDATE ll_selfop_sku_daily_sales SET outbound_quantity=CASE WHEN customer_code='A' THEN CASE WHEN business_date>=DATE '"+END.minusDays(2)+"' THEN 100 ELSE 0 END WHEN customer_code='B' THEN CASE WHEN business_date>=DATE '"+END.minusDays(2)+"' THEN 1 ELSE 100 END ELSE 10 END");
+        for(String group:List.of("SKU","OWNER"))for(String metric:List.of("INVENTORY_VOLUME","OUTBOUND_VOLUME","UNIT_VOLUME")) {
+            if(group.equals("OWNER")&&metric.equals("UNIT_VOLUME"))continue;
+            for(int days:List.of(3,30))for(String direction:List.of("ASC","DESC")) {
+                var expected=metric.equals("OUTBOUND_VOLUME")&&days==3
+                    ? direction.equals("ASC")?List.of("B","D","A","C"):List.of("A","D","B","C")
+                    : direction.equals("ASC")?List.of("A","D","B","C"):List.of("B","A","D","C");
+                var actual=new ArrayList<Object>();
+                for(int page=1;page<=2;page++) {
+                    var q=new InventoryTurnoverRequest("demo","W",END,days,group,null,null,"ALL",null,null,metric+"_"+direction,page,2,true,"fixed",false);
+                    q.validate(END.plusDays(1));
+                    actual.addAll(reportRows(input(q,30,0,true)).stream().map(r->r.get("customer_code")).toList());
+                }
+                assertEquals(expected,actual,group+" "+metric+" "+days+" "+direction);
+            }
+        }
+        var incomplete=reportRows(input(request("SKU","ALL","OUTBOUND_VOLUME_DESC",null,null,1,20),7,0,true));
+        assertEquals(List.of("A","B","C","D"),incomplete.stream().map(r->r.get("customer_code")).toList());
+        assertTrue(incomplete.stream().allMatch(r->r.get("w30_outbound_volume")==null));
+        for(String direction:List.of("ASC","DESC"))assertThrows(RuntimeException.class,()->request("OWNER","ALL","UNIT_VOLUME_"+direction,null,null,1,20).validate(END.plusDays(1)));
+    }
+    @Test void emptyUncoveredOutboundVolumeIsUnknownAndCompleteEmptyVolumesAreZero() throws Exception {
+        var q=request("SKU","ALL","PHYSICAL_DESC",null,null,1,20);
+        var unknown=query("overview",input(q,0,0,true)).get(0);
+        decimal("0",unknown.get("physical_volume"));assertNull(unknown.get("w30_outbound_volume"));
+        var complete=query("overview",input(q,30,0,true)).get(0);
+        decimal("0",complete.get("physical_volume"));decimal("0",complete.get("w30_outbound_volume"));
+    }
+    @Test void volumesUseWholeMeasuredTripletAndConvertInchesWithoutMergingOwnersOrPages() throws Exception {
+        master();seed("A","SAME",0);seed("B","SAME",0);
+        product("A","SAME","1,1,1,'in'","100,100,100,'cm'");
+        product("B","SAME","1,1,1,'in'","100,NULL,100,'cm'");
+        var q=request("SKU","ALL","PHYSICAL_DESC",null,null,1,1);
+        var a=reportRows(input(q,30,0,true)).get(0);
+        decimal("1",a.get("unit_volume"));decimal("610",a.get("physical_volume"));decimal("300",a.get("w30_outbound_volume"));
+        assertEquals("WAREHOUSE_MEASURED",a.get("dimension_source"));
+        var b=reportRows(input(request("SKU","ALL","PHYSICAL_DESC",null,null,2,1),30,0,true)).get(0);
+        decimal("0.000016387064",b.get("unit_volume"));decimal("0.00999610904",b.get("physical_volume"));
+        assertEquals("PRODUCT_DECLARED",b.get("dimension_source"));decimal("610",b.get("physical_estimated_quantity"));
+        var summary=query("overview",input(q,30,0,true)).get(0);decimal("610.00999610904",summary.get("physical_volume"));
+        var owners=reportRows(input(request("OWNER","ALL","PHYSICAL_DESC",null,null,1,20),30,0,true));
+        assertEquals(2,owners.size());decimal("300",owners.get(0).get("w30_outbound_volume"));
+        decimal("0.0049161192",owners.get(1).get("w30_outbound_volume"));
+    }
+    @Test void missingDimensionsAndUnknownQuantityRemainSeparateAndZeroNeedsNoDimensions() throws Exception {
+        master();seed("A","KNOWN",0);seed("A","MISSING",0);
+        product("A","KNOWN","10,10,10,'cm'","0,0,0,'cm'");
+        product("A","MISSING","10,10,10,'unsupported'","10,-1,10,'cm'");
+        var q=request("OWNER","ALL","PHYSICAL_DESC",null,null,1,20);
+        var row=reportRows(input(q,30,0,true)).get(0);
+        assertNull(row.get("physical_volume"));decimal("0.61",row.get("physical_volume_known"));
+        decimal("610",row.get("physical_missing_dimension_quantity"));decimal("1",row.get("physical_missing_dimension_skus"));
+        assertNull(row.get("w30_outbound_volume"));decimal("0.3",row.get("w30_outbound_volume_known"));
+        execute("UPDATE ll_selfop_inventory_snapshot SET physical_quantity=NULL");
+        row=reportRows(input(q,7,0,true)).get(0);
+        assertNull(row.get("physical_volume"));decimal("2",row.get("physical_unknown_quantity_skus"));
+        assertNull(row.get("w30_outbound_volume"));decimal("2",row.get("w30_outbound_unknown_quantity_skus"));
+        execute("UPDATE ll_selfop_inventory_snapshot SET physical_quantity=CASE WHEN sku_code='MISSING' THEN 0 WHEN product_quality=0 THEN 600 ELSE 10 END");
+        execute("UPDATE ll_selfop_sku_daily_sales SET outbound_quantity=0 WHERE sku_code='MISSING'");
+        row=reportRows(input(q,30,0,true)).get(0);
+        decimal("0.61",row.get("physical_volume"));decimal("0.3",row.get("w30_outbound_volume"));
+        decimal("0",row.get("physical_missing_dimension_skus"));
+    }
+    @Test void volumeMasterVersionIsFrozenAndFailedFutureOrOtherAccountRowsCannotLeak() throws Exception {
+        master();seed("A","SKU",0);product("A","SKU","10,10,10,'cm'","NULL,NULL,NULL,NULL");
+        execute("INSERT INTO ll_selfop_sync_run VALUES(902,900,'demo','BUSINESS','PUBLISHED','COMPLETE',TIMESTAMP '2026-10-14 00:00:00'),(903,900,'demo','BUSINESS','FAILED','COMPLETE',TIMESTAMP '2026-10-12 10:00:00')");
+        execute("INSERT INTO ll_selfop_product VALUES(902,'demo','A','SKU',100,100,100,'cm',NULL,NULL,NULL,NULL),(903,'demo','A','SKU',200,200,200,'cm',NULL,NULL,NULL,NULL),(901,'other','A','SKU',300,300,300,'cm',NULL,NULL,NULL,NULL)");
+        var p=input(request("SKU","ALL","PHYSICAL_DESC",null,null,1,20),30,0,true);
+        decimal("0.001",reportRows(p).get(0).get("unit_volume"));
+        var later=new InventoryTurnoverSql.Input(p.query(),11,22,true,true,p.days(),LocalDateTime.of(2026,10,15,0,0));
+        decimal("1",reportRows(later).get(0).get("unit_volume"));
+    }
+    static InventoryTurnoverRequest request(String group,String focus,String sort,String sku,Integer threshold,int page,int size) {
+        return new InventoryTurnoverRequest("demo","W",END,30,group,null,sku,focus,threshold,null,sort,page,size,true,null,false);
+    }
+    static InventoryTurnoverSql.Input input(InventoryTurnoverRequest q,int covered,int samples,boolean fresh) {
+        List<InventoryTurnoverSql.Day> days=new ArrayList<>();
+        for(int i=0;i<30;i++){LocalDate date=END.minusDays(29-i);days.add(new InventoryTurnoverSql.Day(date,date.atStartOfDay().minusHours(8),i>=30-covered?1:0,i<samples?100L+i:null));}
+        return new InventoryTurnoverSql.Input(q,11,22,fresh,true,List.copyOf(days),LocalDateTime.of(2026,10,13,0,0));
+    }
+    @Test void selectedCustomWindowsUseEveryDayIncludingBeyondThirtyAndKeepSampleGaps() throws Exception {
+        seed("A","SKU",1);master();product("A","SKU","10,10,10,'cm'","NULL,NULL,NULL,NULL");
+        execute("UPDATE ll_selfop_sku_profile SET earliest_evidence_at_utc=TIMESTAMP '2025-01-01 00:00:00'");
+        for(int n:List.of(3,45,366)) {
+            var q=new InventoryTurnoverRequest("demo","W",END,n,"SKU",null,null,"ALL",null,null,null,1,20,true,null,false);
+            var dates=new ArrayList<InventoryTurnoverSql.Day>();
+            int horizon=Math.max(30,n);
+            for(int i=0;i<horizon;i++) {
+                var date=END.minusDays(horizon-1-i);
+                dates.add(new InventoryTurnoverSql.Day(date,date.atStartOfDay().minusHours(8),1,date.equals(END)?null:100L));
+            }
+            var input=new InventoryTurnoverSql.Input(q,11,22,true,true,dates,LocalDateTime.of(2026,10,13,0,0));
+            var row=query("page",input).get(0);
+            decimal(Integer.toString(Math.min(30,n)*10),row.get("w"+n+"_outbound"));
+            decimal(new BigDecimal("0.01").multiply(BigDecimal.valueOf(Math.min(30,n))).toPlainString(),row.get("w"+n+"_outbound_volume"));
+            decimal(Integer.toString(n-1),row.get("sample_count"));
+            assertEquals(END.toString(),row.get("missing_dates"));
+            assertNull(row.get("turnover"));
+            var chart=query("chartWindows",input).get(0);
+            decimal(Integer.toString(Math.min(30,n)*10),chart.get("w"+n+"_outbound"));
+        }
+    }
+    @Test void emptyDefectiveOnlyAvailableIsZeroButMissingNormalAndStaleStockRemainUnknown() throws Exception {
+        profile(22,"A","EMPTY");stock(22,"A","EMPTY",1,0,0);
+        var q=request("SKU","ALL","PHYSICAL_DESC",null,null,1,20);
+        decimal("0",query("page",input(q,30,0,true)).get(0).get("available"));
+        assertNull(query("page",input(q,30,0,false)).get(0).get("available"));
+        stock(22,"A","EMPTY",0,0,0);
+        execute("UPDATE ll_selfop_inventory_snapshot SET available_quantity=NULL,quality_status='UNKNOWN',quality_reason='FIELD_MISSING' WHERE product_quality=0");
+        assertNull(query("page",input(q,30,0,true)).get(0).get("available"));
+    }
+    @Test void transitUsesBothQualitiesAndPropagatesUnknownWithoutChangingStockMetrics() throws Exception {
+        seed("A","KNOWN",0);seed("A","UNKNOWN",0);
+        execute("UPDATE ll_selfop_inventory_snapshot SET transit_quantity=CASE WHEN product_quality=0 THEN 5 ELSE 2 END WHERE snapshot_run_id=22");
+        execute("UPDATE ll_selfop_inventory_snapshot SET transit_quantity=NULL,quality_status='UNKNOWN',quality_reason='FIELD_MISSING' WHERE snapshot_run_id=22 AND sku_code='UNKNOWN' AND product_quality=0");
+        var q=request("SKU","ALL","TRANSIT_DESC",null,null,1,20);
+        var rows=reportRows(input(q,30,0,true));
+        assertEquals("KNOWN",rows.get(0).get("sku_code"));
+        var known=InventoryTurnoverPolicy.row(rows.get(0),q,InventoryTurnoverPolicyTest.context());
+        decimal("7",known.transitQuantity().value());decimal("610",known.physicalQuantity().value());
+        decimal("600",known.availableQuantity().value());decimal("60",known.inventoryCoverageDays());
+        assertNull(rows.get(1).get("transit"));decimal("0",rows.get(1).get("unassessable"));
+        var ownerQuery=request("OWNER","ALL","TRANSIT_DESC",null,null,1,20);
+        var owner=InventoryTurnoverPolicy.row(reportRows(input(ownerQuery,30,0,true)).get(0),ownerQuery,InventoryTurnoverPolicyTest.context());
+        assertNull(owner.transitQuantity().value());decimal("7",owner.transitQuantity().knownSubtotal());
+        assertEquals(1,owner.transitQuantity().unknownSkuCount());decimal("1220",owner.physicalQuantity().value());
+        assertTrue(query("page",input(q,30,0,false)).stream().allMatch(r->r.get("transit")==null));
+    }
+    @Test void threeWindowsAndDailyQualitiesAreNotMultiplied() throws Exception {
+        seed("A","SKU",30);
+        var p=input(request("SKU","ALL","PHYSICAL_DESC",null,null,1,20),30,30,true);
+        var row=query("page",p).get(0);
+        decimal("70",row.get("w7_outbound"));decimal("150",row.get("w15_outbound"));decimal("300",row.get("w30_outbound"));
+        decimal("600",row.get("available"));decimal("60",row.get("coverage_days"));
+        decimal("500",row.get("average_physical"));decimal("0.6",row.get("turnover"));
+        assertEquals(30,((Number)row.get("sample_count")).intValue());
+        decimal("1",query("count",p).get(0).values().iterator().next());
+    }
+    @Test void gapsKeepSevenDaysAndInvalidateThirtyWithoutShrinking() throws Exception {
+        seed("A","SKU",2);
+        var row=query("page",input(request("SKU","ALL","PHYSICAL_DESC",null,null,1,20),7,2,true)).get(0);
+        decimal("70",row.get("w7_outbound"));assertNull(row.get("w15_outbound"));assertNull(row.get("w30_outbound"));
+        decimal("300",row.get("w30_observed"));assertNull(row.get("coverage_days"));assertNull(row.get("turnover"));
+        assertEquals(2,((Number)row.get("sample_count")).intValue());
+    }
+    @Test void historicalTurnoverSurvivesStaleCurrentAndMissingCurrentIsNotZero() throws Exception {
+        seed("A","SKU",30);
+        var row=query("page",input(request("SKU","ALL","PHYSICAL_DESC",null,null,1,20),30,30,false)).get(0);
+        assertNull(row.get("physical"));assertNull(row.get("coverage_days"));decimal("0.6",row.get("turnover"));
+        execute("DELETE FROM ll_selfop_inventory_snapshot WHERE snapshot_run_id=22");
+        row=query("page",input(request("SKU","ALL","PHYSICAL_DESC",null,null,1,20),30,30,true)).get(0);
+        assertNull(row.get("physical"));decimal("300",row.get("w30_outbound"));
+    }
+    @Test void ownerAggregationAndUnknownPropagationUseFullCandidates() throws Exception {
+        seed("A","SKU",30);seed("B","SKU",30);
+        execute("UPDATE ll_selfop_inventory_snapshot SET physical_quantity=NULL,quality_status='UNKNOWN',quality_reason='FIELD_MISSING' WHERE customer_code='A' AND snapshot_run_id=22");
+        var rows=query("page",input(request("OWNER","ALL","PHYSICAL_DESC",null,null,1,20),30,30,true));
+        assertEquals(2,rows.size());assertEquals("B",rows.get(0).get("customer_code"));
+        assertNull(rows.get(1).get("physical"));decimal("300",rows.get(1).get("w30_outbound"));
+        decimal("0.6",rows.get(1).get("turnover"));
+    }
+    @Test void zeroAvailableNeverMatchesFastAndOverviewIgnoresSkuFocus() throws Exception {
+        seed("A","SKU",0);
+        execute("UPDATE ll_selfop_inventory_snapshot SET available_quantity=0 WHERE snapshot_run_id=22");
+        var q=request("SKU","COVERAGE_LE","PHYSICAL_DESC","does-not-exist",60,1,20);
+        var p=input(q,7,0,true);
+        assertTrue(query("page",p).isEmpty());
+        decimal("1",query("overview",p).get(0).get("sku_count"));
+        var row=query("page",input(request("SKU","ALL","PHYSICAL_DESC",null,null,1,20),7,0,true)).get(0);
+        decimal("0",row.get("coverage_days"));decimal("1",row.get("unassessable"));
+    }
+    @Test void invalidHistoricalUnitOnlyInvalidatesItsSampleAndNeverActualOwnerSales() throws Exception {
+        seed("A","SKU",30);
+        execute("UPDATE ll_selfop_inventory_daily SET physical_quantity=NULL,quality_status='UNKNOWN',quality_reason='UNIT_UNKNOWN' WHERE day_version_id=100");
+        var p=input(request("SKU","ALL","PHYSICAL_DESC",null,null,1,20),30,30,true);
+        var row=query("page",p).get(0);
+        decimal("300",row.get("w30_outbound"));decimal("60",row.get("coverage_days"));
+        decimal("29",row.get("sample_count"));assertNull(row.get("turnover"));
+        execute("UPDATE ll_selfop_sku_profile SET quantity_unit='UNKNOWN' WHERE profile_run_id=11");
+        assertNull(query("page",p).get(0).get("w30_outbound"));
+        var owner=query("page",input(request("OWNER","ALL","PHYSICAL_DESC",null,null,1,20),30,30,true)).get(0);
+        decimal("300",owner.get("w30_outbound"));
+    }
+    @Test void zeroSalesAndZeroAverageHaveDifferentTurnoverResults() throws Exception {
+        seed("A","SKU",30);
+        execute("DELETE FROM ll_selfop_sku_daily_sales WHERE warehouse_code='W'");
+        var p=input(request("SKU","ALL","PHYSICAL_DESC",null,null,1,20),30,30,true);
+        var row=query("page",p).get(0);
+        decimal("0",row.get("turnover"));decimal("1",row.get("no_outbound"));assertNull(row.get("coverage_days"));
+        execute("UPDATE ll_selfop_inventory_daily SET physical_quantity=0 WHERE day_version_id>=100");
+        row=query("page",p).get(0);decimal("0",row.get("average_physical"));assertNull(row.get("turnover"));
+    }
+    @Test void emptyWarehouseChartDistinguishesCoveredZeroFromMissingEvidence() throws Exception {
+        var q=request("SKU","ALL","PHYSICAL_DESC",null,null,1,20);
+        var covered=query("chartWindows",input(q,30,0,true)).get(0);
+        decimal("0",covered.get("w30_outbound"));decimal("30",covered.get("w30_complete"));
+        var absent=query("chartWindows",input(q,0,0,false)).get(0);
+        assertNull(absent.get("w30_outbound"));assertNull(absent.get("w30_observed"));
+        decimal("0",query("overview",input(q,30,0,true)).get(0).get("no_outbound_count"));
+    }
+    @Test void eighteenPublishedDaysGiveSevenAndFifteenDayMeansWithoutInventingThirtyDays() throws Exception {
+        seed("A","SKU",0);
+        execute("DELETE FROM ll_selfop_sku_daily_sales WHERE business_date<DATE '"+END.minusDays(17)+"'");
+        // Unpublished/newer versions must not contribute to the selected report.
+        execute("INSERT INTO ll_selfop_sku_daily_sales VALUES (99,'demo','W','A','SKU',DATE '"+END+"',9999,'PCS')");
+        var q=request("SKU","ALL","PHYSICAL_DESC",null,null,1,20);
+        var chart=query("chartWindows",input(q,18,0,true)).get(0);
+        var windows=InventoryTurnoverPolicy.windows(chart,END.plusDays(1),List.of(7,15,30));
+        for(int i=0;i<2;i++) {
+            var window=windows.get(i);
+            assertEquals("COMPLETE",window.dataStatus());assertEquals(window.days(),window.completeDayCount());
+            decimal("10",window.averageDailyOutboundQuantity());
+        }
+        var thirty=windows.get(2);
+        assertEquals(18,thirty.completeDayCount());assertEquals(12,thirty.unknownDayCount());assertNull(thirty.averageDailyOutboundQuantity());
+        assertEquals("PARTIAL",thirty.dataStatus());
+    }
+    @Test void warehouseChartUsesSalesUnitsAndCoverageIndependentlyOfStockProfiles() throws Exception {
+        seed("A","SKU",30);
+        execute("UPDATE ll_selfop_sku_profile SET quantity_unit='UNKNOWN'");
+        execute("UPDATE ll_selfop_inventory_snapshot SET physical_quantity=NULL");
+        var p=input(request("SKU","ALL","PHYSICAL_DESC",null,null,1,20),30,0,false);
+        var row=query("chartWindows",p).get(0);decimal("300",row.get("w30_outbound"));
+        execute("UPDATE ll_selfop_sku_daily_sales SET quantity_unit='UNKNOWN' WHERE business_date=DATE '"+END+"'");
+        row=query("chartWindows",p).get(0);assertNull(row.get("w30_outbound"));
+        decimal("290",row.get("w30_observed"));decimal("29",row.get("w30_complete"));decimal("6",row.get("w7_complete"));
+    }
+    @Test void fullScopeFilterPrecedesPaginationAndKeepsSoldOutHistoricalCandidates() throws Exception {
+        seed("A","LOW",30);seed("A","HIGH",30);seed("B","SOLD",30);
+        execute("UPDATE ll_selfop_inventory_snapshot SET available_quantity=3000,physical_quantity=3000 WHERE sku_code='HIGH' AND snapshot_run_id=22 AND product_quality=0");
+        execute("UPDATE ll_selfop_inventory_snapshot SET available_quantity=0,physical_quantity=0 WHERE sku_code='SOLD' AND snapshot_run_id=22");
+        var p=input(request("SKU","COVERAGE_GT","COVERAGE_DESC",null,100,1,1),30,30,true);
+        var selected=query("page",p);assertEquals(1,selected.size());assertEquals("HIGH",selected.get(0).get("sku_code"));
+        decimal("1",query("count",p).get(0).values().iterator().next());
+        decimal("3",query("overview",p).get(0).get("sku_count"));
+        var owners=query("page",input(request("OWNER","ALL","PHYSICAL_DESC",null,null,1,20),30,30,true));
+        var sold=owners.stream().filter(r->"B".equals(r.get("customer_code"))).findFirst().orElseThrow();
+        decimal("0",sold.get("physical"));decimal("300",sold.get("w30_outbound"));decimal("0.6",sold.get("turnover"));
+    }
+    @Test void independentBaseWindowsUseMatchingHistoricalAverages() throws Exception {
+        seed("A","SKU",30);
+        for(int days:List.of(7,15)) {
+            var q=new InventoryTurnoverRequest("demo","W",END,days,"SKU",null,null,"ALL",null,null,null,1,20,true,null,false);
+            var row=query("page",input(q,30,30,true)).get(0);
+            decimal("70",row.get("w7_outbound"));decimal("150",row.get("w15_outbound"));decimal("300",row.get("w30_outbound"));
+            decimal("60",row.get("coverage_days"));decimal(days==7?"0.14":"0.3",row.get("turnover"));decimal(String.valueOf(days),row.get("sample_count"));
+        }
+    }
+    @Test void sharedReportMatchesStandaloneValuesAndKeepsPageOrder() throws Exception {
+        seed("A","SKU",30);seed("B","SKU",30);
+        execute("UPDATE ll_selfop_inventory_snapshot SET physical_quantity=900 WHERE customer_code='B' AND snapshot_run_id=22 AND product_quality=0");
+        var p=input(request("SKU","ALL","PHYSICAL_DESC",null,null,1,1),30,30,true);
+        var report=query("report",p);var json=new com.fasterxml.jackson.databind.ObjectMapper();
+        var page=report.stream().filter(r->"ROW".equals(r.get("section"))).toList();assertEquals(1,page.size());
+        Object raw=page.get(0).get("payload");var row=raw instanceof byte[] bytes?json.readTree(bytes):json.readTree(raw.toString());
+        assertEquals("B",row.path("customer_code").asText());decimal("300",row.path("w30_outbound").decimalValue());decimal("0.6",row.path("turnover").decimalValue());
+        var total=report.stream().filter(r->"TOTAL".equals(r.get("section"))).findFirst().orElseThrow().get("payload");
+        var count=total instanceof byte[] bytes?json.readTree(bytes):json.readTree(total.toString());assertEquals(2,count.path("total").asInt());
+        assertEquals(2,report.stream().filter(r->"OWNER".equals(r.get("section"))).count());
+        assertEquals(1,report.stream().filter(r->"OVERVIEW".equals(r.get("section"))).count());
+    }
+    @Test void frozenSamplesExcludeUnselectedVersionsWithoutDroppingMissingDays() throws Exception {
+        seed("A","SKU",30);
+        profile(999,"A","UNSELECTED");stock(999,"A","UNSELECTED",0,999,999);
+        var q=request("SKU","ALL","PHYSICAL_DESC",null,null,1,20);
+        var rows=reportRows(input(q,30,2,true));
+        assertEquals(1,rows.size());decimal("2",rows.get(0).get("sample_count"));
+        assertNull(rows.get(0).get("turnover"));
+        assertEquals(28,rows.get(0).get("missing_dates").toString().split(",").length);
+        rows=reportRows(input(q,30,0,true));
+        assertEquals(1,rows.size());decimal("0",rows.get(0).get("sample_count"));
+        assertEquals(30,rows.get(0).get("missing_dates").toString().split(",").length);
+        decimal("300",rows.get(0).get("w30_outbound"));
+    }
+    @Test void repeatedSampleRunAndHighestDateBitKeepAllThreeWindowsExact() throws Exception {
+        seed("A","SKU",30);
+        for(boolean onlyLast:List.of(true,false)) for(int n:List.of(7,15,30)) for(String group:List.of("SKU","OWNER")) {
+            var dates=new ArrayList<InventoryTurnoverSql.Day>();var missing=new ArrayList<String>();
+            for(int i=0;i<30;i++) {
+                var date=END.minusDays(29-i);boolean present=onlyLast?i==29:i!=29;
+                // Reusing a version on multiple frozen dates must retain each date.
+                dates.add(new InventoryTurnoverSql.Day(date,date.atStartOfDay().minusHours(8),1,present?100L:null));
+                if(i>=30-n&&!present)missing.add(date.toString());
+            }
+            var q=new InventoryTurnoverRequest("demo","W",END,n,group,null,null,"ALL",null,null,null,1,20,true,null,false);
+            var p=new InventoryTurnoverSql.Input(q,11,22,true,true,List.copyOf(dates),LocalDateTime.of(2026,10,13,0,0));
+            var row=query("page",p).get(0);
+            assertNotNull(row.get("sample_mask"));
+            decimal(String.valueOf(onlyLast?1:n-1),row.get("sample_count"));
+            assertEquals(String.join(",",missing),row.get("missing_dates"));
+            assertNull(row.get("average_physical"));assertNull(row.get("turnover"));
+            assertEquals(row.get("missing_dates"),reportRows(p).get(0).get("missing_dates"));
+        }
+    }
+    @Test void sparseSamplesKeepExactDateComplementAndFullOwnerDenominator() throws Exception {
+        seed("A","ONE",30);seed("A","TWO",30);
+        // Both edge bits and a middle bit, with different missing members per day.
+        execute("DELETE FROM ll_selfop_inventory_daily WHERE ((sku_code='ONE' AND day_version_id IN (100,114)) OR (sku_code='TWO' AND day_version_id=129))");
+        for(int n:List.of(7,15,30)) {
+            var q=new InventoryTurnoverRequest("demo","W",END,n,"OWNER",null,null,"ALL",null,null,null,1,20,true,null,false);
+            var p=input(q,30,30,true);
+            var row=reportRows(p).get(0);
+            var expected=new ArrayList<LocalDate>();
+            for(int index:List.of(0,14,29)) if(index>=30-n) expected.add(END.minusDays(29-index));
+            decimal(String.valueOf(n-expected.size()),row.get("sample_count"));
+            assertEquals(String.join(",",expected.stream().map(LocalDate::toString).toList()),row.get("missing_dates"));
+            assertNull(row.get("average_physical"));assertNull(row.get("turnover"));
+            assertEquals(row.get("missing_dates"),query("page",p).get(0).get("missing_dates"));
+        }
+        var pageTwo=new InventoryTurnoverRequest("demo","W",END,30,"SKU",null,null,"ALL",null,null,null,2,1,false,null,false);
+        var second=reportRows(input(pageTwo,30,30,true)).get(0);
+        assertEquals("TWO",second.get("sku_code"));decimal("29",second.get("sample_count"));assertEquals(END.toString(),second.get("missing_dates"));
+        // A stock/profile-only candidate without samples invalidates all owner days.
+        profile(22,"A","NO-SAMPLES");stock(22,"A","NO-SAMPLES",0,0,0);
+        var owner=reportRows(input(request("OWNER","ALL","PHYSICAL_DESC",null,null,1,20),30,30,true)).get(0);
+        decimal("0",owner.get("sample_count"));assertEquals(30,owner.get("missing_dates").toString().split(",").length);
+    }
+    @Test void reportBindsExactLargeSampleVersionsAndKeepsWindowDenominators() throws Exception {
+        seed("A","SKU",30);
+        long first=9_007_199_254_740_993L;
+        for(int i=0;i<30;i++) {
+            execute("UPDATE ll_selfop_sku_profile SET profile_run_id="+(first+i)+" WHERE profile_run_id="+(100+i));
+            execute("UPDATE ll_selfop_inventory_day_version SET id="+(first+i)+" WHERE id="+(100+i));
+            execute("UPDATE ll_selfop_inventory_daily SET day_version_id="+(first+i)+",physical_quantity=CASE WHEN product_quality=0 THEN "+((i+1)*10)+" ELSE 0 END WHERE day_version_id="+(100+i));
+        }
+        List<InventoryTurnoverSql.Day> days=new ArrayList<>();
+        for(int i=0;i<30;i++){var date=END.minusDays(29-i);days.add(new InventoryTurnoverSql.Day(date,date.atStartOfDay().minusHours(8),1,first+i));}
+        for(int n:List.of(7,15,30)) {
+            var q=new InventoryTurnoverRequest("demo","W",END,n,"SKU",null,null,"ALL",null,null,null,1,20,true,null,false);
+            var p=new InventoryTurnoverSql.Input(q,11,22,true,true,List.copyOf(days),LocalDateTime.of(2026,10,13,0,0));
+            var row=reportRows(p).get(0);
+            decimal(String.valueOf(n),row.get("sample_count"));
+            decimal(n==7?"270":n==15?"230":"155",row.get("average_physical"));
+            decimal("70",row.get("w7_outbound"));decimal("150",row.get("w15_outbound"));decimal("300",row.get("w30_outbound"));
+            assertNotNull(row.get("turnover"));
+        }
+        var missing=days.get(14);days.set(14,new InventoryTurnoverSql.Day(missing.date(),missing.startUtc(),1,null));
+        var row=reportRows(new InventoryTurnoverSql.Input(request("SKU","ALL","PHYSICAL_DESC",null,null,1,20),11,22,true,true,List.copyOf(days),LocalDateTime.of(2026,10,13,0,0))).get(0);
+        decimal("29",row.get("sample_count"));assertNull(row.get("turnover"));
+        assertEquals(missing.date().toString(),row.get("missing_dates"));
+    }
+    @Test void reportPaginationKeepsTotalAndCanOmitOverview() throws Exception {
+        seed("A","SKU",30);seed("B","SKU",30);
+        var first=reportRows(input(request("SKU","ALL","PHYSICAL_DESC",null,null,1,1),30,30,true));
+        var secondQuery=new InventoryTurnoverRequest("demo","W",END,30,"SKU",null,null,"ALL",null,null,"PHYSICAL_DESC",2,1,false,"frozen",false);
+        var second=query("report",input(secondQuery,30,30,true));
+        var row=second.stream().filter(r->"ROW".equals(r.get("section"))).findFirst().orElseThrow();
+        assertNotEquals(first.get(0).get("customer_code"),payload(row).path("customer_code").asText());
+        assertEquals(2,second.size());
+        var beyond=new InventoryTurnoverRequest("demo","W",END,30,"SKU",null,null,"ALL",null,null,"PHYSICAL_DESC",3,1,false,"frozen",false);
+        var report=query("report",input(beyond,30,30,true));assertEquals(1,report.size());
+        assertEquals("TOTAL",report.get(0).get("section"));assertEquals(2,payload(report.get(0)).path("total").asInt());
+    }
+    @Test void projectedFormalWindowsKeepPartialObservationsAndUnknownDistinctFromZero() throws Exception {
+        seed("A","SKU",30);
+        for(String group:List.of("SKU","OWNER")) {
+            var p=input(request(group,"ALL","PHYSICAL_DESC",null,null,1,20),0,30,true);
+            var row=reportRows(p).get(0);
+            assertNull(row.get("w30_outbound"));decimal("300",row.get("w30_observed"));decimal("30",row.get("w30_partial"));
+        }
+        execute("DELETE FROM ll_selfop_sku_daily_sales WHERE warehouse_code='W'");
+        for(String group:List.of("SKU","OWNER")) {
+            var p=input(request(group,"ALL","PHYSICAL_DESC",null,null,1,20),0,30,true);
+            var unknown=reportRows(p).get(0);assertNull(unknown.get("w30_outbound"));assertNull(unknown.get("w30_observed"));
+            var partialDays=p.days().stream().map(d->new InventoryTurnoverSql.Day(d.date(),d.startUtc(),2,d.historyVersionId())).toList();
+            var partial=reportRows(new InventoryTurnoverSql.Input(p.query(),11,22,true,true,partialDays,LocalDateTime.of(2026,10,13,0,0))).get(0);
+            assertNull(partial.get("w30_outbound"));decimal("0",partial.get("w30_observed"));decimal("30",partial.get("w30_partial"));
+            var complete=reportRows(input(p.query(),30,30,true)).get(0);
+            decimal("0",complete.get("w30_outbound"));decimal("30",complete.get("w30_complete"));
+        }
+    }
+    @Test void coveredZeroDoesNotDependOnObservationBeforeWindowMidnight() throws Exception {
+        seed("A","SKU",0);execute("DELETE FROM ll_selfop_sku_daily_sales WHERE warehouse_code='W'");
+        for(int n:List.of(7,15,30)) for(int millis:List.of(-1,0,1)) {
+            LocalDate start=END.minusDays(n-1);var utc=start.atStartOfDay().minusHours(8).plusNanos(millis*1_000_000L);
+            execute("UPDATE ll_selfop_sku_profile SET earliest_evidence_at_utc=TIMESTAMP '"+utc.toString().replace('T',' ')+"'");
+            var p=input(request("SKU","ALL","PHYSICAL_DESC",null,null,1,20),30,0,true);
+            var row=reportRows(p).get(0);decimal(String.valueOf(n),row.get("w"+n+"_complete"));
+            decimal("0",row.get("w"+n+"_outbound"));
+            execute("INSERT INTO ll_selfop_sku_daily_sales VALUES(11,'demo','W','A','SKU',DATE '"+start+"',0,'PCS')");
+            row=reportRows(p).get(0);decimal(String.valueOf(n),row.get("w"+n+"_complete"));decimal("0",row.get("w"+n+"_outbound"));
+            execute("DELETE FROM ll_selfop_sku_daily_sales WHERE warehouse_code='W'");
+        }
+    }
+    @Test void sparseCorrectionRevokesInvalidActualZeroAndHandlesEvidenceAfterLastBoundary() throws Exception {
+        seed("A","SKU",0);execute("DELETE FROM ll_selfop_sku_daily_sales WHERE warehouse_code='W'");
+        var p=input(request("SKU","ALL","PHYSICAL_DESC",null,null,1,20),1,0,true);
+        var afterLast=END.atStartOfDay().minusHours(8).plusNanos(1_000_000);
+        execute("UPDATE ll_selfop_sku_profile SET earliest_evidence_at_utc=TIMESTAMP '"+afterLast.toString().replace('T',' ')+"'");
+        var row=reportRows(p).get(0);decimal("1",row.get("w7_complete"));decimal("0",row.get("w7_observed"));decimal("0",row.get("w7_partial"));
+        execute("INSERT INTO ll_selfop_sku_daily_sales VALUES(11,'demo','W','A','SKU',DATE '"+END+"',1.234567,'PCS')");
+        row=reportRows(p).get(0);decimal("1",row.get("w7_complete"));decimal("1.234567",row.get("w7_observed"));
+        execute("UPDATE ll_selfop_sku_profile SET earliest_evidence_at_utc=TIMESTAMP '2026-01-01 00:00:00'");
+        execute("UPDATE ll_selfop_sku_daily_sales SET quantity_unit='UNKNOWN' WHERE warehouse_code='W'");
+        row=reportRows(p).get(0);decimal("0",row.get("w7_complete"));assertNull(row.get("w7_observed"));decimal("0",row.get("w7_partial"));
+    }
+    @Test void noObservationAgeDoesNotHideWindowSalesCoverageOrNoOutboundSummary() throws Exception {
+        seed("A","SOLD",0);seed("A","UNSOLD",0);
+        execute("UPDATE ll_selfop_sku_profile SET evidence_run_id=NULL,evidence_type=NULL,earliest_evidence_at_utc=NULL");
+        execute("DELETE FROM ll_selfop_sku_daily_sales WHERE sku_code='UNSOLD'");
+        var q=request("SKU","ALL","PHYSICAL_DESC",null,30,1,20);
+        var p=input(q,30,0,true);
+        var rows=reportRows(p);
+        var sold=rows.stream().filter(r->"SOLD".equals(r.get("sku_code"))).findFirst().orElseThrow();
+        decimal("300",sold.get("w30_outbound"));decimal("60",sold.get("coverage_days"));decimal("0",sold.get("unassessable"));
+        assertNull(sold.get("turnover"));decimal("0",sold.get("sample_count"));
+        var unsold=rows.stream().filter(r->"UNSOLD".equals(r.get("sku_code"))).findFirst().orElseThrow();
+        decimal("0",unsold.get("w30_outbound"));decimal("1",unsold.get("no_outbound"));decimal("0",unsold.get("unassessable"));
+        assertNull(unsold.get("coverage_days"));
+        var summary=query("overview",p).get(0);
+        decimal("1",summary.get("no_outbound_count"));decimal("0",summary.get("no_outbound_unknown"));
+        var filtered=reportRows(input(request("SKU","NO_OUTBOUND_IN_WINDOW","PHYSICAL_DESC",null,null,1,20),30,0,true));
+        assertEquals(List.of("UNSOLD"),filtered.stream().map(r->r.get("sku_code")).toList());
+        summary=query("overview",input(q,7,0,true)).get(0);
+        decimal("2",summary.get("no_outbound_unknown"));
+        // Page projection preserves null stock types in H2 when freshness is a bound false.
+        var stale=query("page",input(q,30,0,false));
+        assertTrue(stale.stream().allMatch(r->r.get("no_outbound")==null));
+    }
+    @Test void oneUnknownAvailableQuantityKeepsSubtotalWithoutHidingIndependentNoOutboundCount() throws Exception {
+        seed("A","KNOWN",0);seed("A","UNKNOWN",0);
+        execute("DELETE FROM ll_selfop_sku_daily_sales WHERE warehouse_code='W'");
+        execute("UPDATE ll_selfop_inventory_snapshot SET available_quantity=NULL,quality_status='UNKNOWN',quality_reason='FIELD_MISSING' WHERE snapshot_run_id=22 AND sku_code='UNKNOWN' AND product_quality=0");
+        var summary=query("overview",input(request("SKU","ALL","PHYSICAL_DESC",null,null,1,20),30,0,true)).get(0);
+        decimal("1220",summary.get("physical"));assertNull(summary.get("available"));
+        decimal("600",summary.get("available_known"));decimal("1",summary.get("available_unknown"));
+        decimal("2",summary.get("no_outbound_count"));decimal("0",summary.get("no_outbound_unknown"));
+    }
+    @Test void presentInvalidSamplesNeverQualifyAndOwnerZeroNeedsEverySku() throws Exception {
+        seed("A","ONE",30);seed("A","TWO",30);
+        String key=" WHERE day_version_id=100 AND sku_code='TWO' AND product_quality=0";
+        for(String mutation:List.of("physical_quantity=NULL","physical_quantity=-1","product_quality=9","quality_status='UNKNOWN',quality_reason='UNCONFIRMED'")) {
+            if("profile".equals(mutation))execute("UPDATE ll_selfop_inventory_daily SET physical_quantity=NULL,quality_status='UNKNOWN',quality_reason='UNIT_UNKNOWN' WHERE day_version_id=100 AND sku_code='TWO'");
+            else execute("UPDATE ll_selfop_inventory_daily SET "+mutation+key);
+            var owner=reportRows(input(request("OWNER","ALL","PHYSICAL_DESC",null,null,1,20),30,30,true)).get(0);
+            decimal("29",owner.get("sample_count"));assertNull(owner.get("turnover"));assertEquals(END.minusDays(29).toString(),owner.get("missing_dates"));
+            execute("DELETE FROM ll_selfop_inventory_daily WHERE day_version_id=100 AND sku_code='TWO'");stock(100,"A","TWO",0,450,450);stock(100,"A","TWO",1,50,0);
+            execute("UPDATE ll_selfop_sku_profile SET quantity_unit='PCS' WHERE profile_run_id=100 AND sku_code='TWO'");
+        }
+        execute("UPDATE ll_selfop_inventory_daily SET physical_quantity=0 WHERE day_version_id>=100");
+        var owner=reportRows(input(request("OWNER","ALL","PHYSICAL_DESC",null,null,1,20),30,30,true)).get(0);
+        decimal("30",owner.get("sample_count"));decimal("0",owner.get("average_physical"));assertNull(owner.get("turnover"));
+    }
+    @Test void ownerInvalidActualAndAbsentMemberKeepCoveredZeroDifferentFromUnknown() throws Exception {
+        seed("A","ONE",0);seed("A","TWO",0);execute("DELETE FROM ll_selfop_sku_daily_sales WHERE warehouse_code='W'");
+        execute("INSERT INTO ll_selfop_sku_daily_sales VALUES(11,'demo','W','A','ONE',DATE '"+END+"',10,'UNKNOWN')");
+        var q=request("OWNER","ALL","PHYSICAL_DESC",null,null,1,20);
+        var row=reportRows(input(q,30,0,true)).get(0);decimal("6",row.get("w7_complete"));decimal("0",row.get("w7_observed"));decimal("1",row.get("w7_partial"));
+        row=reportRows(input(q,0,0,true)).get(0);assertNull(row.get("w7_observed"));decimal("0",row.get("w7_partial"));
+        execute("INSERT INTO ll_selfop_sku_daily_sales VALUES(11,'demo','W','A','TWO',DATE '"+END+"',10,'UNKNOWN')");
+        row=reportRows(input(q,1,0,true)).get(0);assertNull(row.get("w7_observed"));decimal("0",row.get("w7_complete"));decimal("0",row.get("w7_partial"));
+    }
+    @Test void decimalWindowsRemainExactBeyondJavascriptIntegerRangeWithoutDuplicatingCandidates() throws Exception {
+        for(String sku:List.of("ONE","TWO","THREE","FOUR"))seed("A",sku,30);
+        String amount="99999999999999.123456";var quantity=new BigDecimal(amount);
+        execute("UPDATE ll_selfop_sku_daily_sales SET outbound_quantity="+amount+" WHERE warehouse_code='W'");
+        execute("UPDATE ll_selfop_inventory_snapshot SET physical_quantity=CASE WHEN product_quality=0 THEN "+amount+" ELSE 0 END");
+        execute("UPDATE ll_selfop_inventory_daily SET physical_quantity=CASE WHEN product_quality=0 THEN "+amount+" ELSE 0 END");
+        var report=query("report",input(request("OWNER","ALL","PHYSICAL_DESC",null,null,1,20),30,30,true));
+        var row=payload(report.stream().filter(r->"ROW".equals(r.get("section"))).findFirst().orElseThrow());
+        decimal(quantity.multiply(BigDecimal.valueOf(120)).toPlainString(),row.path("w30_outbound").decimalValue());
+        decimal(quantity.multiply(BigDecimal.valueOf(4)).toPlainString(),row.path("average_physical").decimalValue());
+        decimal("30",row.path("turnover").decimalValue());assertEquals(30,row.path("sample_count").asInt());
+        var skuReport=query("report",input(request("SKU","ALL","PHYSICAL_DESC",null,null,1,20),30,30,true));
+        assertEquals(4,skuReport.stream().filter(r->"ROW".equals(r.get("section"))).count());
+        for(var raw:skuReport)if("ROW".equals(raw.get("section")))decimal(quantity.multiply(BigDecimal.valueOf(30)).toPlainString(),payload(raw).path("w30_outbound").decimalValue());
+    }
+    @Test void threeSourceCandidateUnionKeepsFullOwnerDenominator() throws Exception {
+        profile(100,"A","HISTORY");profile(11,"A","HISTORY");profile(22,"A","HISTORY");
+        stock(22,"A","STOCK",0,0,0);
+        execute("INSERT INTO ll_selfop_sku_daily_sales VALUES(11,'demo','W','A','SALES',DATE '"+END+"',1.123456,'PCS')");
+        var skuRows=reportRows(input(request("SKU","ALL","PHYSICAL_DESC",null,null,1,20),30,30,true));
+        assertEquals(Set.of("HISTORY","STOCK","SALES"),new HashSet<>(skuRows.stream().map(r->r.get("sku_code")).toList()));
+        assertEquals(3,skuRows.size());
+        var report=query("report",input(request("OWNER","ALL","PHYSICAL_DESC",null,null,1,20),30,30,true));
+        var row=payload(report.stream().filter(r->"ROW".equals(r.get("section"))).findFirst().orElseThrow());
+        decimal("1.123456",row.path("w30_outbound").decimalValue());
+        assertEquals(0,row.path("sample_count").asInt());assertTrue(row.path("average_physical").isNull());
+        assertEquals(30,row.path("missing_dates").asText().split(",").length);
+    }
+    @Test void ownerStockChartSurvivesMissingWindowsAndEmptySkuFilter() throws Exception {
+        seed("A","SKU",0);seed("B","SKU",0);seed("C","SOLD",0);
+        execute("UPDATE ll_selfop_inventory_snapshot SET physical_quantity=NULL,quality_status='UNKNOWN',quality_reason='FIELD_MISSING' WHERE customer_code='B' AND snapshot_run_id=22");
+        execute("UPDATE ll_selfop_inventory_snapshot SET physical_quantity=0,available_quantity=0 WHERE customer_code='C' AND snapshot_run_id=22");
+        var baseline=query("report",input(request("SKU","ALL","PHYSICAL_DESC",null,null,1,20),7,0,true));
+        var baselineSummary=payload(baseline.stream().filter(r->"OVERVIEW".equals(r.get("section"))).findFirst().orElseThrow());
+        for(String group:List.of("SKU","OWNER")) {
+            var full=input(request(group,"ALL","PHYSICAL_DESC",null,null,1,20),7,0,true);
+            var standalone=query("page",full);var reportRows=reportRows(full);
+            assertEquals(standalone.size(),reportRows.size());
+            for(int i=0;i<standalone.size();i++) for(var field:reportRows.get(i).entrySet()) {
+                Object expected=standalone.get(i).get(field.getKey()),actual=field.getValue();
+                if(expected instanceof Number)decimal(expected.toString(),actual);
+                else if(expected instanceof java.sql.Date)assertEquals(expected.toString(),actual);
+                else assertEquals(expected,actual,field.getKey());
+            }
+            var q=request(group,"ALL","PHYSICAL_DESC","SKU".equals(group)?"not-present":null,null,1,20);
+            var report=query("report",input(q,7,0,true));
+            var chart=report.stream().filter(r->"OWNER".equals(r.get("section"))).toList();
+            assertEquals(2,chart.size());
+            var known=payload(chart.get(0));assertEquals("A",known.path("customer_code").asText());decimal("610",known.path("physical").decimalValue());
+            var unknown=report.stream().filter(r->"OWNER_META".equals(r.get("section"))).findFirst().orElseThrow();
+            assertEquals(1,payload(unknown).path("unknown_count").asInt());
+            var summary=report.stream().filter(r->"OVERVIEW".equals(r.get("section"))).findFirst().orElseThrow();
+            assertEquals(3,payload(summary).path("sku_count").asInt());assertEquals(baselineSummary,payload(summary));
+            var total=report.stream().filter(r->"TOTAL".equals(r.get("section"))).findFirst().orElseThrow();
+            assertEquals("SKU".equals(group)?0:3,payload(total).path("total").asInt());
+            assertEquals("SKU".equals(group)?0:3,report.stream().filter(r->"ROW".equals(r.get("section"))).count());
+        }
+    }
+    @Test void tinyQualifiedDailySumUsesOneDivisionForSkuAndOwnerThroughProductionCtes() throws Exception {
+        seed("A","ONE",30);seed("A","TWO",30);
+        execute("UPDATE ll_selfop_inventory_daily SET physical_quantity=CASE WHEN day_version_id=100 AND product_quality=0 THEN CASE WHEN sku_code='ONE' THEN 0.000001 ELSE 0.000002 END ELSE 0 END WHERE day_version_id>=100");
+        execute("UPDATE ll_selfop_sku_daily_sales SET outbound_quantity=CASE WHEN business_date=DATE '"+END+"' THEN CASE WHEN sku_code='ONE' THEN 1 ELSE 2 END ELSE 0 END WHERE warehouse_code='W'");
+        for(String group:List.of("SKU","OWNER")) {
+            var q=request(group,"ALL","TURNOVER_DESC",null,null,1,20);var p=input(q,30,30,true);
+            for(var row:reportRows(p)) {
+                assertTrue(new BigDecimal(row.get("average_physical").toString()).signum()>0);
+                decimal("30000000",row.get("turnover"));decimal("30",row.get("sample_count"));
+                var mapped=InventoryTurnoverPolicy.row(row,q,InventoryTurnoverPolicyTest.context());
+                assertEquals("VALID",mapped.turnoverStatus());assertTrue(mapped.sampleReasonCodes().isEmpty());
+                assertEquals(new BigDecimal("0.000000"),mapped.averagePhysicalQuantity());
+                assertEquals(new BigDecimal("30000000.000000"),mapped.quantityTurnoverCount());
+            }
+            for(var row:query("page",p))decimal("30000000",row.get("turnover"));
+        }
+        execute("UPDATE ll_selfop_inventory_daily SET physical_quantity=0 WHERE day_version_id>=100");
+        for(String group:List.of("SKU","OWNER")) {
+            var q=request(group,"ALL","TURNOVER_DESC",null,null,1,20);
+            for(var row:reportRows(input(q,30,30,true))) {
+                decimal("0",row.get("average_physical"));assertNull(row.get("turnover"));
+                var mapped=InventoryTurnoverPolicy.row(row,q,InventoryTurnoverPolicyTest.context());
+                assertEquals("ZERO_AVERAGE_STOCK",mapped.turnoverStatus());assertNull(mapped.quantityTurnoverCount());
+                assertEquals(List.of("ZERO_AVERAGE_STOCK"),mapped.sampleReasonCodes());
+            }
+            for(var row:reportRows(input(q,30,29,true))) {
+                assertNull(row.get("average_physical"));assertNull(row.get("turnover"));
+                var mapped=InventoryTurnoverPolicy.row(row,q,InventoryTurnoverPolicyTest.context());
+                assertEquals("INSUFFICIENT",mapped.turnoverStatus());assertNull(mapped.quantityTurnoverCount());
+            }
+        }
+    }
+    @Test void unroundedThresholdAndStableTiesSurviveActualReportPagination() throws Exception {
+        seed("OA","HIGH",30);seed("OA","A",30);seed("OZ","A",30);seed("OA","LOW",30);
+        execute("UPDATE ll_selfop_inventory_snapshot SET available_quantity=CASE sku_code WHEN 'HIGH' THEN 200.000001 WHEN 'LOW' THEN 199.999999 ELSE 200 END WHERE snapshot_run_id=22 AND product_quality=0");
+        var gt=request("SKU","COVERAGE_GT","COVERAGE_DESC",null,20,1,20);
+        var greater=reportRows(input(gt,30,30,true));assertEquals(List.of("HIGH"),greater.stream().map(r->r.get("sku_code")).toList());
+        assertEquals(new BigDecimal("20.000000"),InventoryTurnoverPolicy.row(greater.get(0),gt,InventoryTurnoverPolicyTest.context()).inventoryCoverageDays());
+        var le=request("SKU","COVERAGE_LE","COVERAGE_DESC",null,20,1,20);
+        assertEquals(List.of("A/OA","A/OZ","LOW/OA"),reportRows(input(le,30,30,true)).stream().map(r->r.get("sku_code")+"/"+r.get("customer_code")).toList());
+        var expected=List.of("HIGH/OA","A/OA","A/OZ","LOW/OA");
+        for(int page=1;page<=4;page++) {
+            var q=request("SKU","ALL","COVERAGE_DESC",null,20,page,1);var result=reportRows(input(q,30,30,true));
+            assertEquals(1,result.size());assertEquals(expected.get(page-1),result.get(0).get("sku_code")+"/"+result.get(0).get("customer_code"));
+        }
+    }
+    @Test void turnoverOrderingUsesUnroundedRatioBeforeStableSkuAndOwnerPages() throws Exception {
+        seed("Z","HIGH",30);seed("A","TIE",30);seed("B","TIE",30);seed("L","LOW",30);
+        execute("UPDATE ll_selfop_inventory_daily SET physical_quantity=CASE WHEN product_quality=0 THEN 10 ELSE 0 END WHERE day_version_id>=100");
+        execute("UPDATE ll_selfop_sku_daily_sales SET outbound_quantity=CASE WHEN business_date=DATE '"+END+"' THEN CASE sku_code WHEN 'HIGH' THEN 10.000001 WHEN 'LOW' THEN 9.999999 ELSE 10 END ELSE 0 END WHERE warehouse_code='W'");
+        for(String group:List.of("SKU","OWNER")) for(int page=1;page<=4;page++) {
+            var q=request(group,"ALL","TURNOVER_DESC",null,null,page,1);
+            var result=reportRows(input(q,30,30,true));assertEquals(1,result.size());
+            assertEquals(List.of("Z","A","B","L").get(page-1),result.get(0).get("customer_code"));
+            var mapped=InventoryTurnoverPolicy.row(result.get(0),q,InventoryTurnoverPolicyTest.context());
+            assertEquals("VALID",mapped.turnoverStatus());assertEquals(new BigDecimal("1.000000"),mapped.quantityTurnoverCount());
+        }
+    }
+    private static com.fasterxml.jackson.databind.JsonNode payload(Map<String,Object> row) throws Exception {
+        var json=new com.fasterxml.jackson.databind.ObjectMapper().enable(com.fasterxml.jackson.databind.DeserializationFeature.USE_BIG_DECIMAL_FOR_FLOATS);Object raw=row.get("payload");
+        return raw instanceof byte[] bytes?json.readTree(bytes):json.readTree(raw.toString());
+    }
+    @org.junit.jupiter.params.ParameterizedTest
+    @org.junit.jupiter.params.provider.ValueSource(strings={"PHYSICAL","AVAILABLE","TRANSIT","FROZEN","DEFECTIVE","AVERAGE_PHYSICAL","TURNOVER","COVERAGE","OUTBOUND_7","OUTBOUND_15","OUTBOUND_30","AVERAGE_DAILY"})
+    void numericSortsUseFormalValuesInBothDirectionsAndKeepUnknownLast(String metric) throws Exception {
+        seed("L","SKU",30);seed("H","SKU",30);seed("U","SKU",30);
+        execute("UPDATE ll_selfop_inventory_snapshot SET physical_quantity=CASE customer_code WHEN 'L' THEN 100 WHEN 'H' THEN 1000 ELSE NULL END,available_quantity=CASE customer_code WHEN 'L' THEN 100 WHEN 'H' THEN 1000 ELSE NULL END,transit_quantity=CASE customer_code WHEN 'L' THEN 2 WHEN 'H' THEN 8 ELSE NULL END,frozen_quantity=CASE customer_code WHEN 'L' THEN 1 WHEN 'H' THEN 9 ELSE NULL END");
+        execute("UPDATE ll_selfop_inventory_daily SET physical_quantity=CASE customer_code WHEN 'L' THEN 100 WHEN 'H' THEN 1000 ELSE NULL END");
+        execute("UPDATE ll_selfop_sku_daily_sales SET outbound_quantity=CASE customer_code WHEN 'L' THEN 1 WHEN 'H' THEN 5 ELSE 9999 END,quantity_unit=CASE customer_code WHEN 'U' THEN 'UNKNOWN' ELSE 'PCS' END");
+        for(String group:List.of("SKU","OWNER")) {
+            if(group.equals("OWNER")&&metric.equals("COVERAGE")) continue;
+            for(String direction:List.of("ASC","DESC")) {
+                var q=request(group,"ALL",metric+"_"+direction,null,null,1,20);
+                assertDoesNotThrow(()->q.validate(END.plusDays(1)));
+                var p=input(q,30,30,true);
+                // Turnover divides sales by average stock, so its ordering reverses here.
+                boolean lowFirst=direction.equals("ASC")!=metric.equals("TURNOVER");
+                var expected=lowFirst?List.of("L","H","U"):List.of("H","L","U");
+                assertEquals(expected,reportRows(p).stream().map(r->r.get("customer_code")).toList(),group+" "+q.sort());
+                assertEquals(expected,query("page",p).stream().map(r->r.get("customer_code")).toList());
+            }
+        }
+    }
+    @Test void averageDailySortUsesSelectedWindowBeforePaginationAndDoesNotSortObservedSubtotals() throws Exception {
+        seed("A","RECENT",0);seed("B","OLDER",0);seed("C","UNKNOWN",0);
+        execute("UPDATE ll_selfop_sku_daily_sales SET outbound_quantity=CASE WHEN sku_code='RECENT' THEN CASE WHEN business_date>=DATE '"+END.minusDays(6)+"' THEN 10 ELSE 0 END ELSE CASE WHEN business_date<DATE '"+END.minusDays(6)+"' THEN 20 ELSE 0 END END");
+        execute("UPDATE ll_selfop_sku_daily_sales SET quantity_unit='UNKNOWN',outbound_quantity=9999 WHERE sku_code='UNKNOWN'");
+        for(int days:List.of(7,15,30)) {
+            for(int page=1;page<=3;page++) {
+                var q=new InventoryTurnoverRequest("demo","W",END,days,"SKU",null,null,"ALL",null,null,"AVERAGE_DAILY_DESC",page,1,true,"fixed-context",false);
+                var expected=days==7?List.of("RECENT","OLDER","UNKNOWN"):List.of("OLDER","RECENT","UNKNOWN");
+                assertEquals(expected.get(page-1),reportRows(input(q,30,0,true)).get(0).get("sku_code"));
+            }
+        }
+        var q=request("SKU","ALL","OUTBOUND_30_ASC",null,null,1,20);
+        var rows=reportRows(input(q,15,0,true));
+        assertTrue(rows.stream().allMatch(r->r.get("w30_outbound")==null));
+        assertEquals(List.of("OLDER","RECENT","UNKNOWN"),rows.stream().map(r->r.get("sku_code")).toList());
+    }
+    @Test void rejectsUnsupportedSortNamesAndGroupingInsteadOfInterpolatingSql() {
+        for(String sort:List.of("physical ASC","PHYSICAL_ASC;DROP TABLE x","AVERAGE_DAILY","UNKNOWN_DESC"))
+            assertThrows(RuntimeException.class,()->request("SKU","ALL",sort,null,null,1,20).validate(END.plusDays(1)));
+        assertThrows(RuntimeException.class,()->request("OWNER","ALL","COVERAGE_ASC",null,null,1,20).validate(END.plusDays(1)));
+        assertThrows(RuntimeException.class,()->request("SKU","ALL","NO_OUTBOUND_PHYSICAL_DESC",null,null,1,20).validate(END.plusDays(1)));
+    }
+    private List<Map<String,Object>> reportRows(InventoryTurnoverSql.Input p) throws Exception {
+        var result=new ArrayList<Map<String,Object>>();var json=new com.fasterxml.jackson.databind.ObjectMapper().enable(com.fasterxml.jackson.databind.DeserializationFeature.USE_BIG_DECIMAL_FOR_FLOATS);
+        for(var row:query("report",p)) if("ROW".equals(row.get("section")))
+            result.add(json.convertValue(payload(row),new com.fasterxml.jackson.core.type.TypeReference<Map<String,Object>>(){}));
+        return result;
+    }
+    private void seed(String owner,String sku,int samples) throws Exception {
+        profile(11,owner,sku);profile(22,owner,sku);stock(22,owner,sku,0,600,600);stock(22,owner,sku,1,10,0);
+        for(int i=0;i<30;i++) {
+            execute("INSERT INTO ll_selfop_sku_daily_sales VALUES(11,'demo','W','"+owner+"','"+sku+"',DATE '"+END.minusDays(i)+"',10,'PCS')");
+            if(i<samples){profile(100+i,owner,sku);stock(100+i,owner,sku,0,450,450);stock(100+i,owner,sku,1,50,0);}
+        }
+        execute("INSERT INTO ll_selfop_sku_daily_sales VALUES(11,'demo','OTHER','"+owner+"','"+sku+"',DATE '"+END+"',999,'PCS')");
+    }
+    private void profile(long run,String owner,String sku) throws Exception {
+        execute("INSERT INTO ll_selfop_sku_profile VALUES("+run+",'demo','W','"+owner+"','"+sku+"','Fixture','PCS','INVENTORY_OBSERVATION',1,TIMESTAMP '2026-01-01 00:00:00')");
+    }
+    private void stock(long run,String owner,String sku,int quality,int physical,int available) throws Exception {
+        if(run>=100) {
+            execute("MERGE INTO ll_selfop_inventory_day_version KEY(id) VALUES("+run+",'demo','W','FLOW_EOD_V1',NULL)");
+            execute("INSERT INTO ll_selfop_inventory_daily VALUES("+run+",'"+owner+"','"+sku+"',"+quality+","+physical+",'VALID',NULL)");return;
+        }
+        execute("INSERT INTO ll_selfop_inventory_snapshot VALUES("+run+",'demo','W','"+owner+"','"+sku+"',"+quality+","+physical+","+available+",0,0,'VALID',NULL)");
+    }
+    private void execute(String sql) throws Exception {try(var s=db.createStatement()){s.execute(sql);}}
+    private List<Map<String,Object>> query(String method,InventoryTurnoverSql.Input p) throws Exception {
+        var args=Map.of("p",p);var bound=config.getMappedStatement(InventoryTurnoverReadMapper.class.getName()+"."+method).getBoundSql(args);
+        var meta=SystemMetaObject.forObject(args);String sql=bound.getSql();
+        for(var parameter:bound.getParameterMappings()) {
+            Object value=meta.getValue(parameter.getProperty());String literal=value==null?"NULL":value instanceof Boolean b?b?"1":"0":value instanceof Number?value.toString():"'"+value.toString().replace("'","''")+"'";
+            sql=sql.replaceFirst("\\?",java.util.regex.Matcher.quoteReplacement(literal));
+        }
+        // MySQL SIGNED is a signed 64-bit integer; H2's alias is only 32-bit.
+        sql=sql.replace(" AS SIGNED)"," AS BIGINT)");
+        // MySQL's unbounded CHAR cast preserves the date; H2 defaults to CHAR(1).
+        sql=sql.replace("CAST(business_date AS CHAR)","CAST(business_date AS VARCHAR(10))").replace("CAST(d.business_date AS CHAR)","CAST(d.business_date AS VARCHAR(10))");
+        // H2 inlines repeatedly referenced CTEs exponentially. Materialize each unchanged
+        // production relation in this local fixture; MySQL execution plans remain unverified.
+        List<String> relations=new ArrayList<>();int cursor=5;
+        while(true) {
+            int as=sql.indexOf(" AS (",cursor);String name=sql.substring(cursor,as).trim();int start=as+5,end=start,depth=1;boolean quoted=false;
+            while(depth>0){char ch=sql.charAt(end++);if(ch=='\''){if(quoted&&end<sql.length()&&sql.charAt(end)=='\''){end++;continue;}quoted=!quoted;}else if(!quoted){if(ch=='(')depth++;if(ch==')')depth--;}}
+            execute("CREATE LOCAL TEMPORARY TABLE "+name+" AS "+sql.substring(start,end-1));relations.add(name);
+            cursor=end;while(cursor<sql.length()&&Character.isWhitespace(sql.charAt(cursor)))cursor++;
+            if(sql.charAt(cursor)!=',')break;cursor++;while(Character.isWhitespace(sql.charAt(cursor)))cursor++;
+        }
+        try(var s=db.createStatement();var rs=s.executeQuery(sql.substring(cursor))) {
+            List<Map<String,Object>> rows=new ArrayList<>();
+            while(rs.next()){Map<String,Object> row=new HashMap<>();for(int i=1;i<=rs.getMetaData().getColumnCount();i++)row.put(rs.getMetaData().getColumnLabel(i).toLowerCase(Locale.ROOT),rs.getObject(i));rows.add(row);}return rows;
+        } finally {Collections.reverse(relations);for(String name:relations)execute("DROP TABLE "+name);}
+    }
+    private static void decimal(String expected,Object actual){assertNotNull(actual);assertEquals(0,new BigDecimal(expected).compareTo(new BigDecimal(actual.toString())));}
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/query/InventoryWindowPolicyTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/query/InventoryWindowPolicyTest.java
new file mode 100644
index 000000000..9324c04dc
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/query/InventoryWindowPolicyTest.java
@@ -0,0 +1,54 @@
+package com.baiyue.lastleg.selfoperated.analytics.query;
+
+import com.baiyue.common.core.exception.BizException;
+import org.junit.jupiter.api.Test;
+import java.math.BigDecimal;
+import java.time.LocalDate;
+import static org.junit.jupiter.api.Assertions.*;
+
+class InventoryWindowPolicyTest {
+    private static final LocalDate DAY=LocalDate.of(2026,10,13);
+    private static AnalyticsInventoryOptions options(Integer days,LocalDate end) {
+        return new AnalyticsInventoryOptions(null,null,null,null,null,null,null,null,days,end);
+    }
+    @Test void explicitCompleteWindowStaysFixedAcrossMidnightWithoutChangingQueryClock() {
+        var o=options(10,DAY.minusDays(1));
+        for(LocalDate anchor:new LocalDate[]{DAY,DAY.plusDays(1)}) {
+            var range=InventoryWindowPolicy.range(o,anchor);
+            assertEquals(LocalDate.of(2026,10,3),range.startDate());assertEquals(DAY,range.endDateExclusive());
+            assertEquals(10,range.dayCount());assertEquals(anchor,range.anchorDate());
+        }
+        assertEquals(DAY.minusDays(30),InventoryWindowPolicy.range(options(null,null),DAY).startDate());
+        assertThrows(BizException.class,()->InventoryWindowPolicy.range(options(10,DAY),DAY));
+        assertThrows(BizException.class,()->InventoryWindowPolicy.range(options(10,DAY.plusDays(1)),DAY));
+        assertThrows(BizException.class,()->InventoryWindowPolicy.range(options(367,null),DAY));
+    }
+    @Test void selectedWindowPredicatesWorkForTenDayAndHistoricalWindows() {
+        for(var o:new AnalyticsInventoryOptions[]{
+            new AnalyticsInventoryOptions(null,"NO_OUTBOUND_IN_WINDOW",null,null,null,null,null,null,10,null),
+            new AnalyticsInventoryOptions(null,null,"OUTBOUND_ASC",null,null,null,null,null,10,null),
+            new AnalyticsInventoryOptions(null,null,null,null,"UNKNOWN",CoverageDistributionPolicy.RULE_VERSION,null,null,10,null),
+            new AnalyticsInventoryOptions(null,null,null,null,null,null,"FINITE_POSITIVE",null,10,null)})
+            assertEquals(10,InventoryWindowPolicy.range(o,DAY).dayCount());
+        assertThrows(BizException.class,()->options(10,null).validate("OVERVIEW",null));
+    }
+    @Test void tenDayFormulaKeepsMissingAndZeroSalesDistinctAndAvoidsIntermediateRounding() {
+        var valid=InventoryWindowPolicy.calculate("VALID",new BigDecimal("120"),new BigDecimal("30"),true,true,true,10);
+        assertEquals(0,new BigDecimal("3").compareTo(valid.average()));assertEquals(new BigDecimal("40.0"),valid.days());
+        var partial=InventoryWindowPolicy.calculate("VALID",BigDecimal.TEN,BigDecimal.ONE,true,false,true,10);
+        assertNull(partial.average());assertNull(partial.days());assertEquals("COVERAGE_INSUFFICIENT",partial.status());
+        var zero=InventoryWindowPolicy.calculate("VALID",BigDecimal.TEN,BigDecimal.ZERO,true,true,true,10);
+        assertEquals(0,zero.average().signum());assertNull(zero.days());assertEquals("NO_OUTBOUND_IN_WINDOW",zero.status());
+        assertNull(InventoryWindowPolicy.calculate("VALID",BigDecimal.TEN,null,true,true,true,10).days());
+        assertNull(InventoryWindowPolicy.calculate("VALID",BigDecimal.TEN,BigDecimal.TEN,false,true,true,10).days());
+        assertNull(InventoryWindowPolicy.calculate("VALID",BigDecimal.TEN,BigDecimal.TEN,true,true,false,10).days());
+        assertNull(InventoryWindowPolicy.calculate("STALE",BigDecimal.ZERO,BigDecimal.TEN,true,true,true,10).days());
+        assertEquals(new BigDecimal("0.0"),InventoryWindowPolicy.calculate("VALID",BigDecimal.ZERO,null,false,false,false,10).days());
+        assertEquals(new BigDecimal("3.3"),InventoryWindowPolicy.calculate("VALID",BigDecimal.ONE,new BigDecimal("3"),true,true,true,10).days());
+    }
+    @Test void inventoryResponseHasOneNeutralWindowQuantityWithoutThirtyDayAliases() {
+        var names=java.util.Arrays.stream(AnalyticsResponses.InventoryMetric.class.getRecordComponents()).map(java.lang.reflect.RecordComponent::getName).toList();
+        assertTrue(names.contains("windowOutboundQuantity"));assertFalse(names.contains("outboundQuantity30d"));
+        assertFalse(names.contains("outboundQuantity"));assertFalse(names.contains("todayObservedQuantity"));
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/query/SelfopOwnerDirectoryTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/query/SelfopOwnerDirectoryTest.java
new file mode 100644
index 000000000..e3a5dc4f4
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/query/SelfopOwnerDirectoryTest.java
@@ -0,0 +1,17 @@
+package com.baiyue.lastleg.selfoperated.analytics.query;
+import com.baiyue.lastleg.selfoperated.analytics.mapper.SelfopMasterDataMapper;
+import com.baiyue.lastleg.selfoperated.analytics.model.SelfopPayloads;
+import org.junit.jupiter.api.Test;
+import java.time.*;
+import java.util.*;
+import static org.junit.jupiter.api.Assertions.*;
+import static org.mockito.Mockito.*;
+class SelfopOwnerDirectoryTest {
+    @Test void onlyPublishedBatchAtFrozenTimeSuppliesNames(){
+        var mapper=mock(SelfopMasterDataMapper.class);var time=Instant.parse("2026-10-14T08:00:00Z");
+        when(mapper.publishedAt("A",LocalDateTime.ofInstant(time,ZoneOffset.UTC))).thenReturn(11L);
+        when(mapper.owners("A",11L)).thenReturn(List.of(new SelfopPayloads.Owner("C","客户","0"),new SelfopPayloads.Owner("D","",null)));
+        var names=new SelfopOwnerDirectory(mapper).names("A",time);assertEquals("客户",names.get("C"));assertTrue(names.containsKey("D"));assertNull(names.get("D"));
+        assertEquals(Map.of(),new SelfopOwnerDirectory(mapper).names("B",time));verify(mapper,never()).owners("B",11L);
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/query/diagnostics/QueryDiagnosticsTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/query/diagnostics/QueryDiagnosticsTest.java
new file mode 100644
index 000000000..8abdfe2c6
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/query/diagnostics/QueryDiagnosticsTest.java
@@ -0,0 +1,155 @@
+package com.baiyue.lastleg.selfoperated.analytics.query.diagnostics;
+
+import com.fasterxml.jackson.databind.ObjectMapper;
+import jakarta.servlet.ServletException;
+import org.apache.ibatis.cache.CacheKey;
+import org.apache.ibatis.executor.Executor;
+import org.apache.ibatis.executor.statement.StatementHandler;
+import org.apache.ibatis.mapping.*;
+import org.apache.ibatis.session.*;
+import org.junit.jupiter.api.*;
+import org.slf4j.MDC;
+import org.springframework.boot.test.context.runner.ApplicationContextRunner;
+import org.springframework.boot.web.servlet.FilterRegistrationBean;
+import org.springframework.mock.web.*;
+import java.sql.Statement;
+import java.util.*;
+import java.util.concurrent.*;
+import static org.junit.jupiter.api.Assertions.*;
+import static org.mockito.Mockito.*;
+import static org.mockito.ArgumentMatchers.*;
+
+class QueryDiagnosticsTest {
+    private static final String BASE="/api/platform/v1/last-leg/self-operated-analytics/";
+    private static final String ID=QueryDiagnostics.PREFIX+"DashboardReadMapper.report";
+    @AfterEach void cleanup() { QueryDiagnostics.CURRENT.remove(); MDC.clear(); }
+
+    @Test void onlyExplicitTestAndEnabledCreatesBeans() {
+        var runner=new ApplicationContextRunner().withUserConfiguration(QueryDiagnosticsConfiguration.class,QueryDiagnosticsResponseAdvice.class);
+        runner.run(c->{assertEquals(0,c.getBeansOfType(QueryDiagnosticsInterceptor.class).size());assertEquals(0,c.getBeansOfType(QueryDiagnosticsResponseAdvice.class).size());});
+        runner.withPropertyValues("DEPLOY_ENV=test").run(c->assertEquals(0,c.getBeansOfType(FilterRegistrationBean.class).size()));
+        runner.withPropertyValues("DEPLOY_ENV=production","baiyue.self-operated-analytics.query-diagnostics.enabled=true")
+            .run(c->{assertEquals(0,c.getBeansOfType(QueryDiagnosticsInterceptor.class).size());assertEquals(0,c.getBeansOfType(QueryDiagnosticsResponseAdvice.class).size());});
+        runner.withPropertyValues("baiyue.self-operated-analytics.query-diagnostics.enabled=true")
+            .run(c->assertEquals(0,c.getBeansOfType(QueryDiagnosticsInterceptor.class).size()));
+        runner.withPropertyValues("DEPLOY_ENV=test","baiyue.self-operated-analytics.query-diagnostics.enabled=true")
+            .run(c->{assertEquals(1,c.getBeansOfType(QueryDiagnosticsInterceptor.class).size());assertEquals(1,c.getBeansOfType(FilterRegistrationBean.class).size());assertEquals(1,c.getBeansOfType(QueryDiagnosticsResponseAdvice.class).size());});
+    }
+
+    @Test void responseHeaderRequiresActiveStateAndPreservesBodyAndCapturePoint() throws Exception {
+        var advice=new QueryDiagnosticsResponseAdvice();
+        Object body=Map.of("sku","PRIVATE_SKU","token","PRIVATE_TOKEN");
+        var servletRequest=new MockHttpServletRequest("GET",BASE+"dashboard");
+        servletRequest.setQueryString("sourceAccount=PRIVATE_ACCOUNT");
+        var request=new org.springframework.http.server.ServletServerHttpRequest(servletRequest);
+        var response=new org.springframework.http.server.ServletServerHttpResponse(new MockHttpServletResponse());
+        assertFalse(advice.supports(null,null));
+        assertSame(body,advice.beforeBodyWrite(body,null,null,null,request,response));
+        assertNull(response.getHeaders().getFirst(QueryDiagnosticsResponseAdvice.HEADER));
+        var state=new QueryDiagnostics.State();QueryDiagnostics.CURRENT.set(state);MDC.put("requestId","synthetic-header-1");
+        state.timing("DashboardReadMapper.report").executor.add(123,false);
+        assertTrue(advice.supports(null,null));
+        assertSame(body,advice.beforeBodyWrite(body,null,null,null,request,response));
+        String header=response.getHeaders().getFirst(QueryDiagnosticsResponseAdvice.HEADER);
+        assertNotNull(header);assertFalse(header.contains("PRIVATE"));assertFalse(header.contains("\n"));
+        var json=new ObjectMapper().readTree(header);
+        assertEquals("BEFORE_BODY_WRITE",json.path("capturePoint").asText());
+        assertEquals("DASHBOARD",json.path("endpoint").asText());
+        assertEquals("synthetic-header-1",json.path("requestId").asText());
+        assertEquals(1,json.path("methods").path("DashboardReadMapper.report").path("executor").path("calls").asInt());
+        assertEquals("REQUEST_COMPLETE",new ObjectMapper().readTree(state.json("DASHBOARD","synthetic",200,false)).path("capturePoint").asText());
+        for(String path:List.of("other","dashboard/extra")){
+            var skipped=new org.springframework.http.server.ServletServerHttpResponse(new MockHttpServletResponse());
+            assertSame(body,advice.beforeBodyWrite(body,null,null,null,new org.springframework.http.server.ServletServerHttpRequest(new MockHttpServletRequest("GET",BASE+path)),skipped));
+            assertNull(skipped.getHeaders().getFirst(QueryDiagnosticsResponseAdvice.HEADER));
+        }
+        var post=new org.springframework.http.server.ServletServerHttpResponse(new MockHttpServletResponse());
+        advice.beforeBodyWrite(body,null,null,null,new org.springframework.http.server.ServletServerHttpRequest(new MockHttpServletRequest("POST",BASE+"dashboard")),post);
+        assertNull(post.getHeaders().getFirst(QueryDiagnosticsResponseAdvice.HEADER));
+    }
+
+    @Test void pathsAndMethodsAreExactAndExceptionsCleanRequestState() throws Exception {
+        List<String> lines=new ArrayList<>();var filter=new QueryDiagnosticsFilter(lines::add);
+        for(String path:List.of("dashboard/extra","sku-daily-series","collection-status"))
+            filter.doFilter(new MockHttpServletRequest("GET",BASE+path),new MockHttpServletResponse(),(a,b)->assertNull(QueryDiagnostics.CURRENT.get()));
+        filter.doFilter(new MockHttpServletRequest("POST",BASE+"dashboard"),new MockHttpServletResponse(),(a,b)->assertNull(QueryDiagnostics.CURRENT.get()));
+        assertTrue(lines.isEmpty());
+        var failure=new ServletException("PRIVATE_TOKEN");
+        var caught=assertThrows(ServletException.class,()->filter.doFilter(new MockHttpServletRequest("GET",BASE+"dashboard"),
+            new MockHttpServletResponse(),(a,b)->{assertNotNull(QueryDiagnostics.CURRENT.get());throw failure;}));
+        assertSame(failure,caught);assertNull(QueryDiagnostics.CURRENT.get());
+        assertTrue(new ObjectMapper().readTree(lines.get(0)).get("escapedException").asBoolean());
+        assertFalse(lines.get(0).contains("PRIVATE_TOKEN"));
+        var badSink=new QueryDiagnosticsFilter(s->{throw new IllegalStateException("PRIVATE");});
+        assertSame(failure,assertThrows(ServletException.class,()->badSink.doFilter(new MockHttpServletRequest("GET",BASE+"dashboard"),
+            new MockHttpServletResponse(),(a,b)->{throw failure;})));
+        assertNull(QueryDiagnostics.CURRENT.get());
+    }
+
+    private static MappedStatement statement(String id) {
+        var config=new Configuration();
+        return new MappedStatement.Builder(config,id,p->new BoundSql(config,"SELECT PRIVATE_SQL",List.of(),p),SqlCommandType.SELECT).build();
+    }
+
+    @Test void cacheHitCountsExecutorButNoStatementAndDoesNotExposeParameters() throws Exception {
+        var plugin=new QueryDiagnosticsInterceptor();var executor=(Executor)plugin.plugin(mock(Executor.class));
+        List<String> lines=new ArrayList<>();var filter=new QueryDiagnosticsFilter(lines::add);
+        MDC.put("requestId","synthetic-request-1");
+        var request=new MockHttpServletRequest("GET",BASE+"sku-sales-summary");request.setQueryString("sourceAccount=PRIVATE_ACCOUNT");
+        request.addHeader("Authorization","PRIVATE_TOKEN");
+        filter.doFilter(request,new MockHttpServletResponse(),(a,b)->{
+            try { executor.query(statement(ID),Map.of("sku","PRIVATE_SKU"),RowBounds.DEFAULT,null); }
+            catch(java.sql.SQLException e){throw new ServletException(e);}
+        });
+        var json=new ObjectMapper().readTree(lines.get(0));var timing=json.path("methods").path("DashboardReadMapper.report");
+        assertEquals(1,timing.path("executor").path("calls").asInt());assertEquals(0,timing.path("statement").path("calls").asInt());
+        assertEquals("synthetic-request-1",json.path("requestId").asText());assertEquals("SUMMARY",json.path("endpoint").asText());
+        assertFalse(lines.get(0).contains("PRIVATE"));assertFalse(lines.get(0).contains("\n"));assertNull(QueryDiagnostics.CURRENT.get());
+    }
+
+    @Test void nestedExecutorAndStatementAreNotDoubleCountedAndFailureIsPreserved() throws Exception {
+        var plugin=new QueryDiagnosticsInterceptor();var delegate=mock(Executor.class);
+        var executor=(Executor)plugin.plugin(delegate);var ms=statement(ID);var bound=ms.getBoundSql(null);
+        var statementDelegate=mock(StatementHandler.class);var handler=(StatementHandler)plugin.plugin(statementDelegate);
+        var state=new QueryDiagnostics.State();QueryDiagnostics.CURRENT.set(state);
+        when(delegate.query(eq(ms),any(),eq(RowBounds.DEFAULT),isNull())).thenAnswer(i->
+            executor.query(ms,i.getArgument(1),RowBounds.DEFAULT,null,new CacheKey(),bound));
+        when(delegate.query(eq(ms),any(),eq(RowBounds.DEFAULT),isNull(),any(CacheKey.class),eq(bound)))
+            .thenAnswer(i->handler.query(mock(Statement.class),null));
+        var innerDelegate=mock(StatementHandler.class);var innerHandler=(StatementHandler)plugin.plugin(innerDelegate);
+        when(innerDelegate.query(any(),isNull())).thenReturn(List.of());
+        when(statementDelegate.query(any(),isNull())).thenAnswer(i->innerHandler.query(i.getArgument(0),null));
+        executor.query(ms,Map.of("secret","PRIVATE"),RowBounds.DEFAULT,null);
+        var timing=state.methods.get("DashboardReadMapper.report");
+        assertEquals(1,timing.executor.calls);assertEquals(1,timing.statement.calls);assertTrue(state.frames.isEmpty());
+        var failure=new java.sql.SQLException("PRIVATE_SQL_FAILURE");
+        when(statementDelegate.query(any(),isNull())).thenThrow(failure);
+        assertSame(failure,assertThrows(java.sql.SQLException.class,()->executor.query(ms,Map.of(),RowBounds.DEFAULT,null)));
+        assertEquals(2,timing.executor.calls);assertEquals(2,timing.statement.calls);
+        assertEquals(1,timing.executor.failures);assertEquals(1,timing.statement.failures);
+        assertTrue(state.frames.isEmpty());assertEquals(0,state.statementDepth);
+        executor.query(statement("other.Mapper.privateMethod"),Map.of(),RowBounds.DEFAULT,null);
+        assertEquals(1,state.methods.size());
+    }
+
+    @Test void concurrentRequestsHaveIndependentStateAndCleanup() throws Exception {
+        var ready=new CyclicBarrier(2);var pool=Executors.newFixedThreadPool(2);
+        try {
+            List<Future<String>> futures=new ArrayList<>();
+            for(int index=0;index<2;index++){final int n=index;futures.add(pool.submit(()->{
+                List<String> lines=new ArrayList<>();MDC.put("requestId","request-"+n);
+                try {
+                    new QueryDiagnosticsFilter(lines::add).doFilter(new MockHttpServletRequest("GET",BASE+"inventory-coverage"),new MockHttpServletResponse(),(a,b)->{
+                        var state=QueryDiagnostics.CURRENT.get();state.timing("AnalyticsReadMapper.inventoryPage").executor.add(n+1,false);
+                        try{ready.await(5,TimeUnit.SECONDS);}catch(Exception e){throw new ServletException(e);}
+                        assertSame(state,QueryDiagnostics.CURRENT.get());
+                    });
+                    assertNull(QueryDiagnostics.CURRENT.get());return lines.get(0);
+                } finally {MDC.clear();}
+            }));}
+            for(int i=0;i<2;i++){var json=new ObjectMapper().readTree(futures.get(i).get(10,TimeUnit.SECONDS));
+                assertEquals("request-"+i,json.path("requestId").asText());
+                assertEquals(i+1,json.path("methods").path("AnalyticsReadMapper.inventoryPage").path("executor").path("nanos").asLong());}
+        } finally {pool.shutdownNow();}
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/request/SelfopBusinessBudgetPersistenceTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/request/SelfopBusinessBudgetPersistenceTest.java
new file mode 100644
index 000000000..80fed9111
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/request/SelfopBusinessBudgetPersistenceTest.java
@@ -0,0 +1,56 @@
+package com.baiyue.lastleg.selfoperated.analytics.request;
+
+import com.baomidou.mybatisplus.core.MybatisConfiguration;
+import com.baomidou.mybatisplus.core.conditions.update.UpdateWrapper;
+import com.baomidou.mybatisplus.extension.spring.MybatisSqlSessionFactoryBean;
+import com.baiyue.lastleg.selfoperated.analytics.mapper.SelfopSyncTaskMapper;
+import com.baiyue.lastleg.selfoperated.analytics.model.SelfopSupport;
+import com.baiyue.lastleg.selfoperated.analytics.model.SelfopSyncTask;
+import org.apache.ibatis.datasource.unpooled.UnpooledDataSource;
+import org.junit.jupiter.api.Test;
+import java.time.LocalDateTime;
+import java.util.Map;
+import java.util.Objects;
+import java.util.UUID;
+import static org.junit.jupiter.api.Assertions.*;
+
+/** Actual MyBatis Plus insert/update execution, on process-local H2 only. */
+class SelfopBusinessBudgetPersistenceTest {
+    @Test void staleCollectorUpdateCannotResetFrozenRootIdentityConsumptionOrStopReason() throws Exception {
+        var source=new UnpooledDataSource("org.h2.Driver","jdbc:h2:mem:business_budget_"+UUID.randomUUID()+";MODE=MySQL","sa","");
+        var configuration=new MybatisConfiguration();configuration.setMapUnderscoreToCamelCase(true);
+        configuration.addMapper(SelfopSyncTaskMapper.class);
+        var factory=new MybatisSqlSessionFactoryBean();factory.setDataSource(source);factory.setConfiguration(configuration);
+        try(var session=Objects.requireNonNull(factory.getObject()).openSession(true)){
+            var connection=session.getConnection();
+            try(var statement=connection.createStatement()){
+                statement.execute("CREATE TABLE ll_selfop_sync_task(id BIGINT PRIMARY KEY,status VARCHAR(32),progress_json VARCHAR(2000),business_root_task_id BIGINT,business_budget_json VARCHAR(4000))");
+            }
+            var tasks=session.getMapper(SelfopSyncTaskMapper.class);
+            var stale=new SelfopSyncTask();stale.setId(1L);stale.setStatus("RUNNING");stale.setBusinessRootTaskId(1L);
+            stale.setBusinessBudgetJson(SelfopBusinessBudget.freeze(LocalDateTime.of(2026,10,13,0,0)));
+            assertEquals(1,tasks.insert(stale)); // NEVER updates must still allow initial freezing.
+            var charged=SelfopSupport.read(stale.getBusinessBudgetJson(),SelfopBusinessBudget.class);
+            charged.http=2;charged.confirmedHttp=1;
+            String persisted=SelfopSupport.json(charged);
+            assertEquals(1,tasks.update(null,new UpdateWrapper<SelfopSyncTask>().eq("id",1L).set("business_budget_json",persisted)));
+
+            stale.setBusinessRootTaskId(999L);stale.setProgressJson("{\"phase\":\"DETAIL\"}");
+            var sql=configuration.getMappedStatement(SelfopSyncTaskMapper.class.getName()+".updateById")
+                .getBoundSql(Map.of("et",stale)).getSql();
+            assertFalse(sql.contains("business_root_task_id"));assertFalse(sql.contains("business_budget_json"));
+            assertEquals(1,tasks.updateById(stale));
+            assertStored(connection,persisted,stale.getProgressJson());
+
+            charged.stopReason="BUSINESS_SESSION_HTTP_LIMIT";persisted=SelfopSupport.json(charged);
+            assertEquals(1,tasks.update(null,new UpdateWrapper<SelfopSyncTask>().eq("id",1L).set("business_budget_json",persisted)));
+            stale.setProgressJson("{\"phase\":\"LOCAL_RESULT\"}");assertEquals(1,tasks.updateById(stale));
+            assertStored(connection,persisted,stale.getProgressJson());
+        }
+    }
+    private static void assertStored(java.sql.Connection connection,String budget,String progress) throws Exception {
+        try(var statement=connection.createStatement();var result=statement.executeQuery("SELECT business_root_task_id,business_budget_json,progress_json FROM ll_selfop_sync_task WHERE id=1")){
+            assertTrue(result.next());assertEquals(1L,result.getLong(1));assertEquals(budget,result.getString(2));assertEquals(progress,result.getString(3));assertFalse(result.next());
+        }
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/request/SelfopBusinessBudgetTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/request/SelfopBusinessBudgetTest.java
new file mode 100644
index 000000000..a8be7c63b
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/request/SelfopBusinessBudgetTest.java
@@ -0,0 +1,45 @@
+package com.baiyue.lastleg.selfoperated.analytics.request;
+
+import com.baiyue.lastleg.selfoperated.analytics.model.SelfopSupport;
+import java.time.LocalDateTime;
+import org.junit.jupiter.api.Test;
+import static org.junit.jupiter.api.Assertions.*;
+
+class SelfopBusinessBudgetTest {
+    @Test void continuousSessionHasNoDeadlineButKeepsStopAndAccountingGuards(){
+        var start=LocalDateTime.of(2026,10,13,0,0);
+        var budget=SelfopSupport.read(SelfopBusinessBudget.freezeContinuous(start),SelfopBusinessBudget.class);
+        assertTrue(budget.continuous);assertNull(budget.deadlineAtUtc);
+        budget.http=100000;budget.confirmedHttp=99999;
+        assertNull(budget.limit(start.plusYears(1)));
+        budget.stopReason="EGRESS_RESULT_UNKNOWN";assertEquals(budget.stopReason,budget.limit(start));
+        budget.deadlineAtUtc=start.plusDays(1);assertThrows(EgressRejectedException.class,budget::validate);
+    }
+    private final LocalDateTime start=LocalDateTime.of(2026,10,13,0,0);
+
+    @Test void recordedFiniteDeadlineSurvivesReloadWithoutStoppingExistingBusiness() {
+        var budget=SelfopSupport.read(SelfopBusinessBudget.freeze(start),SelfopBusinessBudget.class);
+        budget.deadlineAtUtc=start.plusSeconds(60);
+        budget.http=2;budget.confirmedHttp=1;
+        var restored=SelfopSupport.read(SelfopSupport.json(budget),SelfopBusinessBudget.class);
+        assertEquals(start.plusSeconds(60),restored.deadlineAtUtc);
+        assertEquals(2,restored.http);assertEquals(1,restored.confirmedHttp);
+        assertEquals(0,restored.maxHttp);assertNull(restored.limit(start.plusSeconds(1)));
+        assertNull(restored.limit(start.plusSeconds(60)));assertNull(restored.limit(start.plusYears(1)));
+        assertFalse(restored.continuous);
+        restored.stopReason="BUSINESS_SESSION_HTTP_LIMIT";
+        assertEquals(restored.stopReason,restored.limit(start.plusDays(1)));
+    }
+
+    @Test void newBusinessHasNoDeadlineAndRetainsStrictAccounting() {
+        assertThrows(IllegalArgumentException.class,()->SelfopBusinessBudget.freeze(null));
+        assertThrows(EgressRejectedException.class,()->new SelfopBusinessBudget().validate());
+        var budget=SelfopSupport.read(SelfopBusinessBudget.freeze(start),SelfopBusinessBudget.class);
+        assertNull(budget.deadlineAtUtc);assertFalse(budget.continuous);
+        budget.confirmedHttp=1;
+        assertThrows(EgressRejectedException.class,budget::validate);
+        budget.confirmedHttp=12001;budget.http=12001;budget.maxHttp=5000;
+        assertDoesNotThrow(budget::validate);assertNull(budget.limit(start.plusSeconds(1)));
+        budget.http=-1;assertThrows(EgressRejectedException.class,budget::validate);
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/request/SelfopEgressControllerTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/request/SelfopEgressControllerTest.java
new file mode 100644
index 000000000..c2ed86316
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/request/SelfopEgressControllerTest.java
@@ -0,0 +1,94 @@
+package com.baiyue.lastleg.selfoperated.analytics.request;
+import com.baiyue.lastleg.security.InternalServiceTokenGuard;
+import org.junit.jupiter.api.Test;
+import static org.mockito.Mockito.*;
+import static org.assertj.core.api.Assertions.*;
+class SelfopEgressControllerTest {
+ @Test void runtimeRequiresInternalTokenBeforeReadingConfiguration(){
+  var service=mock(SelfopEgressService.class);var c=new SelfopEgressController(new InternalServiceTokenGuard("synthetic"),service);
+  for(String token:new String[]{null,"","wrong"})assertThatThrownBy(()->c.runtime(token))
+   .isInstanceOf(org.springframework.web.server.ResponseStatusException.class)
+   .satisfies(e->assertThat(((org.springframework.web.server.ResponseStatusException)e).getStatusCode().value()).isEqualTo(401));
+  verifyNoInteractions(service);
+  var missing=new SelfopEgressController(new InternalServiceTokenGuard(""),service);
+  assertThatThrownBy(()->missing.runtime("synthetic")).isInstanceOf(org.springframework.web.server.ResponseStatusException.class)
+   .satisfies(e->assertThat(((org.springframework.web.server.ResponseStatusException)e).getStatusCode().value()).isEqualTo(503));
+  verifyNoInteractions(service);c.runtime("synthetic");verify(service).runtime();
+ }
+ @Test void runtimeUsesExecutionConfigurationAndSerializesOnlyWhitelistedFields() throws Exception {
+  var storage=mock(SelfopEgressMapper.class);var config=new com.baiyue.lastleg.selfoperated.analytics.model.SelfopAnalyticsProperties();
+  config.setCollectionMode("BUSINESS");config.setEnvironment("test");config.setContinuousBusinessCollectionEnabled(true);
+  config.setSourceAccount("synthetic-private-account");config.setExclusiveGrantId("synthetic-private-grant");
+  config.setInternalServiceToken("synthetic-private-token");config.setIntegrationBaseUrl("http://synthetic-private-host");
+  config.setBusinessMinRequestIntervalMs(1200);config.setEgressLeaseSeconds(999);
+  config.setExclusiveHandoffVerified(true);config.setPriorEgressClosed(true);config.setInflightDrained(true);config.setTransferredBudgetVerified(true);
+  var now=java.time.Instant.parse("2026-10-13T00:00:00Z");
+  var service=new SelfopEgressService(storage,config,java.time.Clock.fixed(now,java.time.ZoneOffset.UTC));
+  var controller=new SelfopEgressController(new InternalServiceTokenGuard("synthetic"),service);
+  var response=controller.runtime("synthetic");var runtime=response.data();
+  assertThat(runtime.schemaVersion()).isEqualTo(1);assertThat(runtime.service()).isEqualTo("lastleg");assertThat(runtime.observedAt()).isEqualTo(now);
+  assertThat(runtime.mode()).isEqualTo("BUSINESS");assertThat(runtime.environment()).isEqualTo("test");assertThat(runtime.continuousEnabled()).isTrue();
+  assertThat(runtime.intervalMs()).isEqualTo(1200);assertThat(runtime.permitMaxSeconds()).isEqualTo(30);assertThat(runtime.pendingMaxSeconds()).isEqualTo(120);
+  assertThat(runtime.executionEnabled()).isTrue();assertThat(runtime.grantPresent()).isTrue();
+  assertThat(runtime.exclusiveHandoffVerified()&&runtime.priorEgressClosed()&&runtime.inflightDrained()&&runtime.transferredBudgetVerified()).isTrue();
+  var mapper=new com.fasterxml.jackson.databind.ObjectMapper().findAndRegisterModules().disable(com.fasterxml.jackson.databind.SerializationFeature.WRITE_DATES_AS_TIMESTAMPS);
+  String serialized=mapper.writeValueAsString(response);var data=mapper.readTree(serialized).path("data");
+  var names=new java.util.HashSet<String>();data.fieldNames().forEachRemaining(names::add);
+  assertThat(names).containsExactlyInAnyOrder("schemaVersion","service","observedAt","mode","environment","continuousEnabled",
+   "sourceAccountFingerprint","grantPresent","grantFingerprint","intervalMs","permitMaxSeconds","executionEnabled","pendingMaxSeconds",
+   "exclusiveHandoffVerified","priorEgressClosed","inflightDrained","transferredBudgetVerified");
+  assertThat(serialized).doesNotContain("synthetic-private-account","synthetic-private-grant","synthetic-private-token","synthetic-private-host");
+  config.setCollectionMode("VALIDATION");config.setContinuousBusinessCollectionEnabled(false);config.setBusinessMinRequestIntervalMs(5000);config.setEgressLeaseSeconds(0);
+  var changed=controller.runtime("synthetic").data();assertThat(changed.mode()).isEqualTo("VALIDATION");assertThat(changed.continuousEnabled()).isFalse();
+  assertThat(changed.intervalMs()).isEqualTo(5000);assertThat(changed.pendingMaxSeconds()).isEqualTo(1);
+  assertThat(runtime.mode()).isEqualTo("BUSINESS");verifyNoInteractions(storage);
+ }
+ @Test void runtimeFingerprintsUseRawUtf8WithSeparateDomainsAndExplicitNulls() throws Exception {
+  var storage=mock(SelfopEgressMapper.class);var config=new com.baiyue.lastleg.selfoperated.analytics.model.SelfopAnalyticsProperties();
+  var service=new SelfopEgressService(storage,config);
+  String value=" fixture-账户 ";config.setSourceAccount(value);config.setExclusiveGrantId(value);
+  var digest=java.security.MessageDigest.getInstance("SHA-256");var hex=java.util.HexFormat.of();
+  var runtime=service.runtime();
+  assertThat(runtime.sourceAccountFingerprint()).isEqualTo(hex.formatHex(digest.digest(("selfop-runtime:v1:source-account\n"+value).getBytes(java.nio.charset.StandardCharsets.UTF_8))));
+  assertThat(runtime.grantFingerprint()).isEqualTo(hex.formatHex(digest.digest(("selfop-runtime:v1:grant\n"+value).getBytes(java.nio.charset.StandardCharsets.UTF_8))));
+  assertThat(runtime.sourceAccountFingerprint()).isNotEqualTo(runtime.grantFingerprint());
+  config.setExclusiveGrantId(value.trim());assertThat(service.runtime().grantFingerprint()).isNotEqualTo(runtime.grantFingerprint());
+  var mapper=new com.fasterxml.jackson.databind.ObjectMapper().findAndRegisterModules();
+  for(String empty:new String[]{null,""," \t"}){
+   config.setSourceAccount(empty);config.setExclusiveGrantId(empty);var absent=service.runtime();
+   assertThat(absent.grantPresent()).isFalse();assertThat(absent.grantFingerprint()).isNull();assertThat(absent.sourceAccountFingerprint()).isNull();
+   var node=mapper.valueToTree(absent);assertThat(node.has("grantFingerprint")).isTrue();assertThat(node.path("grantFingerprint").isNull()).isTrue();
+  }
+  verifyNoInteractions(storage);
+ }
+ @Test void invalidInternalTokenCannotReachAuthority(){
+  var service=mock(SelfopEgressService.class);var c=new SelfopEgressController(new InternalServiceTokenGuard("synthetic"),service);
+  assertThatThrownBy(()->c.authorize("other",null)).isInstanceOf(org.springframework.web.server.ResponseStatusException.class).satisfies(e->assertThat(((org.springframework.web.server.ResponseStatusException)e).getStatusCode().value()).isEqualTo(401));
+  assertThatThrownBy(()->c.complete(null,null)).isInstanceOf(org.springframework.web.server.ResponseStatusException.class).satisfies(e->assertThat(((org.springframework.web.server.ResponseStatusException)e).getStatusCode().value()).isEqualTo(401));
+  verifyNoInteractions(service);
+ }
+ @Test void bothCallbacksUseGuardThenAuthority(){var s=mock(SelfopEgressService.class);var c=new SelfopEgressController(new InternalServiceTokenGuard("synthetic"),s);var context=new SelfopEgressDtos.EgressContext("synthetic","VALIDATION","1","selfop-1","attempt","grant");var r=new SelfopEgressDtos.AuthorizationRequest(context,SelfopEgressDtos.Operation.WAREHOUSES,"1".repeat(64));c.authorize("synthetic",r);verify(s).authorize(r);var complete=new SelfopEgressDtos.CompletionRequest(context,SelfopEgressDtos.Operation.WAREHOUSES,"1".repeat(64),1,null,200,200,false,null);assertThat(c.complete("synthetic",complete).data()).isTrue();verify(s).complete(complete);}
+ @Test void denialUsesExactB0001DataEnvelopeWithInstantOrExplicitNull() throws Exception {
+  var s=mock(SelfopEgressService.class);var c=new SelfopEgressController(new InternalServiceTokenGuard("synthetic"),s);
+  doThrow(new EgressRejectedException("ACCOUNT_INTERVAL_WAIT",false,java.time.LocalDateTime.of(2026,10,12,0,0,5))).when(s).authorize(null);
+  var mapper=new com.fasterxml.jackson.databind.ObjectMapper().findAndRegisterModules().disable(com.fasterxml.jackson.databind.SerializationFeature.WRITE_DATES_AS_TIMESTAMPS);
+  var json=mapper.readTree(mapper.writeValueAsString(c.authorize("synthetic",null)));
+  assertThat(json.path("code").asText()).isEqualTo("B0001");assertThat(json.path("data").path("errorCode").asText()).isEqualTo("ACCOUNT_INTERVAL_WAIT");assertThat(json.path("data").path("waitUntil").asText()).isEqualTo("2026-10-12T00:00:05Z");assertThat(json.path("data").path("sampleDone").booleanValue()).isFalse();
+  doThrow(new EgressRejectedException("VALIDATION_HTTP_LIMIT",true,null)).when(s).authorize(null);json=mapper.readTree(mapper.writeValueAsString(c.authorize("synthetic",null)));assertThat(json.path("data").has("waitUntil")).isTrue();assertThat(json.path("data").path("waitUntil").isNull()).isTrue();assertThat(json.path("data").path("sampleDone").booleanValue()).isTrue();
+ }
+ @Test void authorityDtosRoundTripWithIsoInstantAndExplicitNullableOutcome() throws Exception {
+  var mapper=new com.fasterxml.jackson.databind.ObjectMapper().findAndRegisterModules().disable(com.fasterxml.jackson.databind.SerializationFeature.WRITE_DATES_AS_TIMESTAMPS);
+  var context=new SelfopEgressDtos.EgressContext("synthetic","VALIDATION","1","selfop-1","attempt","grant");var operation=SelfopEgressDtos.Operation.WAREHOUSES;String hash="1".repeat(64);var expiry=java.time.Instant.parse("2026-10-12T00:00:30Z");
+  var permit=new SelfopEgressDtos.AttemptPermit(context,operation,hash,1,expiry,true,true);String permitJson=mapper.writeValueAsString(permit);assertThat(mapper.readTree(permitJson).path("expiresAt").asText()).isEqualTo("2026-10-12T00:00:30Z");assertThat(mapper.readValue(permitJson,SelfopEgressDtos.AttemptPermit.class)).isEqualTo(permit);
+  var request=new SelfopEgressDtos.AuthorizationRequest(context,operation,hash);assertThat(mapper.readValue(mapper.writeValueAsString(request),SelfopEgressDtos.AuthorizationRequest.class)).isEqualTo(request);
+  var complete=new SelfopEgressDtos.CompletionRequest(context,operation,hash,1,"LINGXING_WMS_SOURCE_RATE_LIMITED",200,31001,true,expiry);assertThat(mapper.readValue(mapper.writeValueAsString(complete),SelfopEgressDtos.CompletionRequest.class)).isEqualTo(complete);
+  var nullable=new SelfopEgressDtos.CompletionRequest(context,operation,hash,1,null,null,null,false,null);var node=mapper.readTree(mapper.writeValueAsString(nullable));assertThat(node.path("sourceCode").isNull()).isTrue();assertThat(node.path("upstreamStatus").isNull()).isTrue();assertThat(mapper.readValue(node.toString(),SelfopEgressDtos.CompletionRequest.class)).isEqualTo(nullable);
+  var denial=new SelfopEgressDtos.AuthorizationDenial("ACCOUNT_DAILY_BUDGET",false,expiry);assertThat(mapper.readValue(mapper.writeValueAsString(denial),SelfopEgressDtos.AuthorizationDenial.class)).isEqualTo(denial);
+  var s=mock(SelfopEgressService.class);var c=new SelfopEgressController(new InternalServiceTokenGuard("synthetic"),s);when(s.authorize(request)).thenReturn(permit);var envelope=mapper.readTree(mapper.writeValueAsString(c.authorize("synthetic",request)));assertThat(envelope.path("data")).isEqualTo(mapper.readTree(permitJson));assertThat(envelope.path("data").path("budgetConsumed").booleanValue()).isTrue();
+ }
+ @Test void conflictingCompletionPropagatesRejectionInsteadOfSuccessfulAcknowledgment(){
+  var s=mock(SelfopEgressService.class);var c=new SelfopEgressController(new InternalServiceTokenGuard("synthetic"),s);var context=new SelfopEgressDtos.EgressContext("synthetic","VALIDATION","1","selfop-1","attempt","grant");var completion=new SelfopEgressDtos.CompletionRequest(context,SelfopEgressDtos.Operation.WAREHOUSES,"1".repeat(64),1,null,200,200,false,null);
+  doThrow(new EgressRejectedException("EGRESS_COMPLETION_CONFLICT",false,null)).when(s).complete(completion);assertThatThrownBy(()->c.complete("synthetic",completion)).isInstanceOf(EgressRejectedException.class).hasMessage("EGRESS_COMPLETION_CONFLICT");verify(s).complete(completion);
+ }
+ @Test void durableQueriesUseCurrentReadsAndActualColumnNames()throws Exception{for(String name:new String[]{"lockAccount","lockTask","lockRun"}){var m=java.util.Arrays.stream(SelfopEgressMapper.class.getMethods()).filter(x->x.getName().equals(name)).findFirst().orElseThrow();assertThat(String.join(" ",m.getAnnotation(org.apache.ibatis.annotations.Select.class).value())).contains("FOR UPDATE");}assertThat(SelfopEgressMapper.class.isAnnotationPresent(org.apache.ibatis.annotations.Mapper.class)).isTrue();}
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/request/SelfopEgressServiceTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/request/SelfopEgressServiceTest.java
new file mode 100644
index 000000000..947d374b6
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/request/SelfopEgressServiceTest.java
@@ -0,0 +1,512 @@
+package com.baiyue.lastleg.selfoperated.analytics.request;
+import com.baiyue.lastleg.selfoperated.analytics.model.SelfopRequestContext;
+import com.baiyue.lastleg.selfoperated.analytics.model.*;
+import com.baiyue.lastleg.selfoperated.analytics.request.SelfopEgressDtos.*;
+import org.junit.jupiter.api.Test;
+import java.time.*;
+import java.util.*;
+import static org.assertj.core.api.Assertions.*;
+import static org.mockito.Mockito.*;
+class SelfopEgressServiceTest {
+ private final SelfopEgressMapper mapper=mock(SelfopEgressMapper.class);
+ private final SelfopAnalyticsProperties cfg=new SelfopAnalyticsProperties();
+ private final MutableClock clock=new MutableClock();
+ private final SelfopOutboundDiscoveryScope account=new SelfopOutboundDiscoveryScope();
+ private final SelfopSyncTask task=new SelfopSyncTask();private final SelfopSyncRun run=new SelfopSyncRun();
+ private final SelfopEgressService service=new SelfopEgressService(mapper,cfg,clock);
+ private static final String INTERNAL="1".repeat(64),PROVIDER="2".repeat(64);
+ SelfopEgressServiceTest(){
+  cfg.setSourceAccount("synthetic");cfg.setCollectionMode("VALIDATION");cfg.setExclusiveGrantId("grant");cfg.setExclusiveGrantExpiresAtUtc(now().plusDays(2));cfg.setExclusiveHandoffVerified(true);cfg.setPriorEgressClosed(true);cfg.setInflightDrained(true);cfg.setTransferredBudgetVerified(true);cfg.setTransferredBudgetDate(now().plusHours(8).toLocalDate());cfg.setDailyRequestBudget(100);cfg.getWarehouses().put("A",new SelfopAnalyticsProperties.Warehouse());cfg.getWarehouses().put("B",new SelfopAnalyticsProperties.Warehouse());
+  account.setId(10L);account.setSourceAccount("synthetic");account.setActiveTaskId(1L);account.setFenceToken(7L);account.setLeaseUntilUtc(now().plusDays(2));
+  task.setId(1L);task.setDiscoveryScopeId(10L);task.setSourceAccount("synthetic");task.setStatus("RUNNING");task.setTaskRole("ACCOUNT_DISCOVERY");task.setExecutionPurpose("VALIDATION");task.setValidationRootTaskId(1L);task.setValidationBudgetJson(SelfopValidationBudget.freeze(now()));
+  task.setTaskType("VALIDATION");task.setQueryScopeJson("{\"action\":\"VALIDATION\",\"warehouses\":[\"A\"]}");
+  run.setId(2L);run.setTaskId(1L);run.setSourceAccount("synthetic");run.setStatus("FETCHING");run.setExecutionPurpose("VALIDATION");run.setFenceToken(7L);
+  when(mapper.lockAccount("synthetic")).thenReturn(account);when(mapper.lockTask(1L)).thenReturn(task);when(mapper.lockRun(2L)).thenReturn(run);when(mapper.saveAccount(any())).thenReturn(1);when(mapper.saveRoot(any())).thenReturn(1);
+ }
+ private LocalDateTime now(){return LocalDateTime.ofInstant(clock.instant(),ZoneOffset.UTC);}
+ private SelfopRequestContext context(){return new SelfopRequestContext("synthetic",cfg.getCollectionMode(),1L,"selfop-1","grant",1L,2L);}
+ private EgressContext reserve(Operation op,int size,String wh,String key){return service.reserve(context(),op,size,wh,key,INTERNAL);}
+ private void success(EgressContext c,Operation op){service.authorize(new AuthorizationRequest(c,op,PROVIDER));service.complete(new CompletionRequest(c,op,PROVIDER,1,null,200,200,false,null));clock.advance(5);}
+ private SelfopApiBudget budget(){return SelfopSupport.read(account.getApiBudgetJson(),SelfopApiBudget.class);}
+ private SelfopValidationBudget rootBudget(){return SelfopSupport.read(task.getValidationBudgetJson(),SelfopValidationBudget.class);}
+ @Test void historyPagesRequireExactFrozenSliceCheckpointAndEnabledWorker(){
+  continuousBusinessRoot();cfg.setInventoryHistoryEnabled(true);
+  var slice=new com.baiyue.lastleg.selfoperated.analytics.history.InventoryFlowSlice("A",now().minusDays(1).withNano(0),now().withNano(0),1000);
+  task.setTaskType(com.baiyue.lastleg.selfoperated.analytics.history.InventoryFlowSlice.TYPE);
+  task.setScopeHash(SelfopSupport.hash(slice));task.setRequestHash(task.getScopeHash());task.setQueryScopeJson(SelfopSupport.json(slice));
+  task.setPlannedAtUtc(now().toLocalDate().atStartOfDay());task.setQueryFromUtc(LocalDateTime.ofInstant(slice.from(),ZoneOffset.UTC));task.setQueryUntilUtc(LocalDateTime.ofInstant(slice.until(),ZoneOffset.UTC));
+  task.setRequestKey("continuous:history:"+task.getPlannedAtUtc().toLocalDate()+":"+task.getScopeHash());
+  run.setProgressSnapshotJson("{\"nextPage\":1}");
+  assertThat(SelfopCollectionPolicy.continuousBusinessRoot(task)).isTrue();
+  assertThatThrownBy(()->service.reserve(context(),Operation.INVENTORY_FLOW,1000,"B",null,slice.requestHash(1))).hasMessage("EGRESS_HISTORY_INVALID");
+  assertThatThrownBy(()->service.reserve(context(),Operation.INVENTORY_FLOW,1000,"A",null,slice.requestHash(2))).hasMessage("EGRESS_HISTORY_INVALID");
+  cfg.setInventoryHistoryEnabled(false);
+  assertThatThrownBy(()->service.reserve(context(),Operation.INVENTORY_FLOW,1000,"A",null,slice.requestHash(1))).hasMessage("EGRESS_HISTORY_INVALID");
+  cfg.setInventoryHistoryEnabled(true);
+  var first=service.reserve(context(),Operation.INVENTORY_FLOW,1000,"A",null,slice.requestHash(1));success(first,Operation.INVENTORY_FLOW);
+  run.setProgressSnapshotJson("{\"nextPage\":2}");
+  var second=service.reserve(context(),Operation.INVENTORY_FLOW,1000,"A",null,slice.requestHash(2));success(second,Operation.INVENTORY_FLOW);
+  assertThat(businessBudget().http).isEqualTo(2);assertThat(budget().confirmedHttp).isEqualTo(2);
+ }
+ @Test void masterDataOperationsUseBoundBusinessTaskAndExistingSingleFlightGate(){
+  continuousBusinessRoot();task.setTaskType("MASTER_DATA");task.setQueryFromUtc(null);task.setQueryUntilUtc(null);
+  task.setPlannedAtUtc(now().plusHours(8).toLocalDate().atStartOfDay().minusHours(8));
+  var definition=new TreeMap<String,Object>();definition.put("dataFamily","MASTER_DATA");definition.put("sourceAccount","synthetic");
+  task.setQueryScopeJson(SelfopSupport.json(definition));task.setScopeHash(SelfopSupport.hash(definition));
+  task.setRequestKey("continuous:master:"+task.getPlannedAtUtc().plusHours(8).toLocalDate()+":"+task.getScopeHash().substring(0,12));
+  assertThat(SelfopCollectionPolicy.continuousBusinessRoot(task)).isTrue();
+  assertThatThrownBy(()->reserve(Operation.OUTBOUND_QUERY,100,null,null)).hasMessage("EGRESS_OPERATION_TASK_MISMATCH");
+  assertThatThrownBy(()->reserve(Operation.CUSTOMERS,1001,null,null)).hasMessage("EGRESS_OPERATION_TASK_MISMATCH");
+  assertThatThrownBy(()->reserve(Operation.PRODUCTS,101,null,null)).hasMessage("EGRESS_OPERATION_TASK_MISMATCH");
+  var c=reserve(Operation.CUSTOMERS,1000,null,null);
+  assertThatThrownBy(()->reserve(Operation.PRODUCTS,100,null,null)).isInstanceOf(EgressRejectedException.class);
+  success(c,Operation.CUSTOMERS);success(reserve(Operation.PRODUCTS,100,null,null),Operation.PRODUCTS);
+  assertThat(budget().confirmedHttp).isEqualTo(2);
+ }
+ @Test void flowProbeIsTestOnlyBoundToFrozenHashAndExactlyOneAttempt(){
+  testBusiness(5,300);task.setTaskType("INVENTORY_FLOW_PROBE");task.setRequestHash(INTERNAL);
+  assertThatThrownBy(()->reserve(Operation.OUTBOUND_QUERY,100,null,null)).hasMessage("EGRESS_FLOW_PROBE_INVALID");
+  assertThatThrownBy(()->reserve(Operation.INVENTORY_FLOW,1000,"OTHER",null)).hasMessage("EGRESS_FLOW_PROBE_INVALID");
+  assertThatThrownBy(()->service.reserve(context(),Operation.INVENTORY_FLOW,1000,"A",null,PROVIDER)).hasMessage("EGRESS_FLOW_PROBE_INVALID");
+  var c=reserve(Operation.INVENTORY_FLOW,1000,"A",null);success(c,Operation.INVENTORY_FLOW);
+  assertThatThrownBy(()->reserve(Operation.INVENTORY_FLOW,1000,"A",null)).hasMessage("EGRESS_FLOW_PROBE_INVALID");
+  assertThat(businessBudget().http).isEqualTo(1);assertThat(budget().confirmedHttp).isEqualTo(1);
+ }
+ @Test void flowPermissionFailureDoesNotPauseExistingSalesAccount(){
+  testBusiness(5,300);task.setTaskType("INVENTORY_FLOW_PROBE");task.setRequestHash(INTERNAL);
+  var c=reserve(Operation.INVENTORY_FLOW,1000,"A",null);service.authorize(new AuthorizationRequest(c,Operation.INVENTORY_FLOW,PROVIDER));
+  service.complete(new CompletionRequest(c,Operation.INVENTORY_FLOW,PROVIDER,1,"LINGXING_WMS_FLOW_PERMISSION_DENIED",200,11008,false,null));
+  assertThat(account.getApiPauseReason()).isNull();assertThat(budget().confirmedHttp).isEqualTo(1);
+ }
+ @Test void ordinaryTasksCannotUseMasterDataOperations(){
+  business();assertThatThrownBy(()->reserve(Operation.CUSTOMERS,10,null,null)).hasMessage("EGRESS_OPERATION_TASK_MISMATCH");
+  assertThatThrownBy(()->reserve(Operation.PRODUCTS,10,null,null)).hasMessage("EGRESS_OPERATION_TASK_MISMATCH");
+ }
+ @Test void offUnknownModeUnknownEnvironmentBusinessAndUnverifiedHandoffFailBeforeAnyLock(){
+  cfg.setCollectionMode("OFF");assertThatThrownBy(()->reserve(Operation.WAREHOUSES,1,null,null)).hasMessage("EGRESS_MODE_REJECTED");
+  cfg.setCollectionMode("BUSINESS");cfg.setEnvironment("unknown");assertThatThrownBy(()->reserve(Operation.WAREHOUSES,1,null,null)).hasMessage("BUSINESS_ENVIRONMENT_REJECTED");
+  cfg.setCollectionMode("VALIDATION");cfg.setPriorEgressClosed(false);assertThatThrownBy(()->reserve(Operation.WAREHOUSES,1,null,null)).hasMessage("EXCLUSIVE_HANDOFF_UNCONFIRMED");verifyNoInteractions(mapper);
+ }
+ @Test void businessStillChargesPersistentAccountAndRequiresMatchingGrantIdentity(){
+  testBusiness(5,300);
+  var c=reserve(Operation.WAREHOUSES,1,null,null);success(c,Operation.WAREHOUSES);
+  assertThat(budget().reservedHttp).isEqualTo(1);assertThat(budget().confirmedHttp).isEqualTo(1);
+  assertThat(businessBudget().http).isEqualTo(1);assertThat(businessBudget().confirmedHttp).isEqualTo(1);
+  cfg.setExclusiveGrantExpiresAtUtc(now());
+  success(reserve(Operation.WAREHOUSES,1,null,null),Operation.WAREHOUSES);
+  cfg.setExclusiveGrantId("different");assertThatThrownBy(()->reserve(Operation.WAREHOUSES,1,null,null)).hasMessage("EXCLUSIVE_HANDOFF_UNCONFIRMED");
+  assertThat(budget().reservedHttp).isEqualTo(2);
+ }
+ @Test void frozenPageSizeCannotBeExpanded(){assertThatThrownBy(()->reserve(Operation.WAREHOUSES,11,null,null)).hasMessage("VALIDATION_PAGE_SIZE");assertThat(budget().reservedHttp).isZero();}
+ @Test void businessGrantExpiryDoesNotClipShortPendingOrPermitRegardlessOfPlannerSwitch(){
+  testBusiness(5,300);success(reserve(Operation.WAREHOUSES,1,null,null),Operation.WAREHOUSES);
+  cfg.setContinuousBusinessCollectionEnabled(true);cfg.setExclusiveGrantExpiresAtUtc(now().minusSeconds(1));cfg.setEgressLeaseSeconds(120);
+  var c=reserve(Operation.WAREHOUSES,1,null,null);
+  assertThat(budget().pending.expiresAtUtc).isEqualTo(now().plusSeconds(120));
+  var restarted=new SelfopEgressService(mapper,cfg,clock);
+  assertThat(restarted.authorize(new AuthorizationRequest(c,Operation.WAREHOUSES,PROVIDER)).expiresAt()).isEqualTo(clock.instant().plusSeconds(30));
+  restarted.complete(new CompletionRequest(c,Operation.WAREHOUSES,PROVIDER,1,null,200,200,false,null));
+  assertThat(budget().reservedHttp).isEqualTo(2);assertThat(budget().confirmedHttp).isEqualTo(2);
+  cfg.setContinuousBusinessCollectionEnabled(false);
+  clock.advance(5);success(reserve(Operation.WAREHOUSES,1,null,null),Operation.WAREHOUSES);
+  assertThat(budget().reservedHttp).isEqualTo(3);assertThat(businessBudget().continuous).isFalse();
+ }
+ @Test void continuousFlagNeverBypassesValidationWindowGrantIdentityOrHandoff(){
+  cfg.setContinuousBusinessCollectionEnabled(true);cfg.setExclusiveGrantExpiresAtUtc(null);
+  assertThatThrownBy(()->reserve(Operation.WAREHOUSES,1,null,null)).hasMessage("EXCLUSIVE_HANDOFF_UNCONFIRMED");
+  testBusiness(5,300);
+  for(String grant:Arrays.asList(null,"","other")){cfg.setExclusiveGrantId(grant);assertThatThrownBy(()->reserve(Operation.WAREHOUSES,1,null,null)).hasMessage("EXCLUSIVE_HANDOFF_UNCONFIRMED");}
+  cfg.setExclusiveGrantId("grant");cfg.setPriorEgressClosed(false);
+  assertThatThrownBy(()->reserve(Operation.WAREHOUSES,1,null,null)).hasMessage("EXCLUSIVE_HANDOFF_UNCONFIRMED");verifyNoInteractions(mapper);
+ }
+ @Test void oldManualDeadlineDoesNotClipPermitOrRelaxFence(){
+  testBusiness(5,10);cfg.setContinuousBusinessCollectionEnabled(true);cfg.setExclusiveGrantExpiresAtUtc(null);
+  account.setFenceToken(8L);
+  assertThatThrownBy(()->reserve(Operation.WAREHOUSES,1,null,null)).hasMessage("EGRESS_FENCE_LOST");
+  account.setFenceToken(7L);var c=reserve(Operation.WAREHOUSES,1,null,null);
+  assertThat(budget().pending.expiresAtUtc).isAfter(businessBudget().deadlineAtUtc);
+  clock.advance(10);
+  assertThat(service.authorize(new AuthorizationRequest(c,Operation.WAREHOUSES,PROVIDER)).expiresAt()).isEqualTo(clock.instant().plusSeconds(30));
+  assertThat(budget().pending.consumed).isTrue();assertThat(businessBudget().continuous).isFalse();
+ }
+ @Test void continuousBusinessAcrossMidnightRetainsUnknownPendingAndReviewAcrossRestart(){
+  business();cfg.setContinuousBusinessCollectionEnabled(true);cfg.setExclusiveGrantExpiresAtUtc(null);
+  var c=reserve(Operation.WAREHOUSES,1,null,null);service.authorize(new AuthorizationRequest(c,Operation.WAREHOUSES,PROVIDER));
+  service.pauseUncertain(c,Operation.WAREHOUSES,"INTEGRATION_TRANSPORT_FAILURE");clock.advance(86400);
+  var restarted=new SelfopEgressService(mapper,cfg,clock);
+  assertThatThrownBy(()->restarted.reserve(context(),Operation.WAREHOUSES,1,null,null,INTERNAL)).hasMessage("ACCOUNT_COOLDOWN_WAIT");
+  assertThat(budget().reservedHttp).isEqualTo(1);assertThat(budget().confirmedHttp).isZero();assertThat(budget().pending.abandoned).isTrue();
+  assertThat(account.getApiPauseReason()).isEqualTo("EGRESS_REQUIRES_REVIEW");clock.advance(cfg.getCooldownSeconds()+1);
+  assertThatThrownBy(()->restarted.reserve(context(),Operation.WAREHOUSES,1,null,null,INTERNAL)).hasMessage("ACCOUNT_REQUIRES_REVIEW");
+ }
+ @Test void allFamiliesAndFailuresConsumeOneRootAndAccountAcrossServiceRestart(){
+  var c=reserve(Operation.WAREHOUSES,2,null,null);success(c,Operation.WAREHOUSES);
+  c=reserve(Operation.PRODUCT_INVENTORY,2,"A",null);success(c,Operation.PRODUCT_INVENTORY);
+  c=reserve(Operation.OUTBOUND_LOCATE,2,null,null);success(c,Operation.OUTBOUND_LOCATE);
+  var restarted=new SelfopEgressService(mapper,cfg,clock);c=restarted.reserve(context(),Operation.OUTBOUND_DETAIL,0,"A","C/DO",INTERNAL);
+  restarted.authorize(new AuthorizationRequest(c,Operation.OUTBOUND_DETAIL,PROVIDER));
+  restarted.complete(new CompletionRequest(c,Operation.OUTBOUND_DETAIL,PROVIDER,1,"LINGXING_WMS_INVALID_RESPONSE",502,null,false,null));
+  assertThat(budget().reservedHttp).isEqualTo(4);assertThat(budget().confirmedHttp).isEqualTo(4);assertThat(rootBudget().pages).isEqualTo(3);assertThat(rootBudget().detailHttp).isEqualTo(1);assertThat(rootBudget().detailKeys).containsExactly("C/DO");assertThat(task.getStatus()).isEqualTo("DEAD");assertThat(task.getNextRetryAtUtc()).isNull();
+  assertThatThrownBy(()->reserve(Operation.OUTBOUND_QUERY,2,null,null)).hasMessage("EGRESS_TASK_NOT_ACTIVE");
+ }
+ @Test void accountSingleFlightHasNoNewCounterWhilePendingAndReplayCannotConsumeTwice(){
+  var c=reserve(Operation.WAREHOUSES,2,null,null);assertThatThrownBy(()->reserve(Operation.OUTBOUND_QUERY,2,null,null)).hasMessage("ACCOUNT_REQUEST_INFLIGHT");assertThat(budget().reservedHttp).isEqualTo(1);
+  service.authorize(new AuthorizationRequest(c,Operation.WAREHOUSES,PROVIDER));assertThatThrownBy(()->service.authorize(new AuthorizationRequest(c,Operation.WAREHOUSES,PROVIDER))).hasMessage("EGRESS_PERMIT_REPLAY_OR_EXPIRED");
+  assertThatThrownBy(()->service.complete(new CompletionRequest(c,Operation.WAREHOUSES,INTERNAL,1,null,200,200,false,null))).hasMessage("EGRESS_PERMIT_BINDING_INVALID");
+  service.complete(new CompletionRequest(c,Operation.WAREHOUSES,PROVIDER,1,null,200,200,false,null));service.complete(new CompletionRequest(c,Operation.WAREHOUSES,PROVIDER,1,null,200,200,false,null));assertThat(budget().confirmedHttp).isEqualTo(1);
+ }
+ @Test void preparedOperationCannotBeSubstitutedAndProviderHashIsBoundOnce(){
+  var c=reserve(Operation.WAREHOUSES,2,null,null);assertThatThrownBy(()->service.authorize(new AuthorizationRequest(c,Operation.PRODUCT_INVENTORY,PROVIDER))).hasMessage("EGRESS_PERMIT_BINDING_INVALID");
+  var permit=service.authorize(new AuthorizationRequest(c,Operation.WAREHOUSES,PROVIDER));assertThat(permit.allowedAttempts()).isEqualTo(1);assertThat(permit.expiresAt()).isEqualTo(clock.instant().plusSeconds(30));assertThat(budget().pending.internalRequestHash).isEqualTo(INTERNAL);assertThat(budget().pending.requestHash).isEqualTo(PROVIDER);
+ }
+ @Test void pageLimitEndsSameRootAndDoesNotResetAcrossRestart(){
+  for(int i=0;i<10;i++){var c=reserve(Operation.OUTBOUND_QUERY,1,null,null);success(c,Operation.OUTBOUND_QUERY);}
+  assertThatThrownBy(()->new SelfopEgressService(mapper,cfg,clock).reserve(context(),Operation.OUTBOUND_QUERY,1,null,null,INTERNAL)).hasMessage("VALIDATION_PAGE_LIMIT").satisfies(e->assertThat(((EgressRejectedException)e).sampleDone()).isTrue());
+  assertThat(task.getStatus()).isEqualTo("SAMPLE_DONE");assertThat(rootBudget().http).isEqualTo(10);verify(mapper).terminateValidationRuns(eq(1L),eq("SAMPLE_DONE"),eq("VALIDATION_PAGE_LIMIT"),any());
+ }
+ @Test void inventoryTwoPageLimitCannotSampleAnotherConfiguredWarehouse(){
+  success(reserve(Operation.PRODUCT_INVENTORY,1,"A",null),Operation.PRODUCT_INVENTORY);
+  assertThatThrownBy(()->reserve(Operation.PRODUCT_INVENTORY,1,"B",null)).hasMessage("EGRESS_WAREHOUSE_INVALID");
+  assertThatThrownBy(()->reserve(Operation.OUTBOUND_DETAIL,0,"B","C/DO")).hasMessage("EGRESS_WAREHOUSE_INVALID");
+  success(reserve(Operation.PRODUCT_INVENTORY,1,"A",null),Operation.PRODUCT_INVENTORY);
+  assertThatThrownBy(()->reserve(Operation.PRODUCT_INVENTORY,1,"A",null)).hasMessage("VALIDATION_INVENTORY_LIMIT");assertThat(rootBudget().inventoryPages).containsEntry("A",2).doesNotContainKey("B");assertThat(rootBudget().http).isEqualTo(2);
+ }
+ @Test void repeatedDetailUsesHttpLimitEvenForSameIdentity(){for(int i=0;i<20;i++)success(reserve(Operation.OUTBOUND_DETAIL,0,"A","C/DO"),Operation.OUTBOUND_DETAIL);assertThatThrownBy(()->reserve(Operation.OUTBOUND_DETAIL,0,"A","C/DO")).hasMessage("VALIDATION_DETAIL_HTTP_LIMIT");assertThat(rootBudget().detailKeys).hasSize(1);assertThat(rootBudget().detailHttp).isEqualTo(20);}
+ @Test void fiveMinuteDeadlineTerminalAndFrozenLimitsCannotIncrease(){clock.advance(300);assertThatThrownBy(()->reserve(Operation.WAREHOUSES,1,null,null)).hasMessage("VALIDATION_DEADLINE");assertThat(task.getStatus()).isEqualTo("SAMPLE_DONE");var b=rootBudget();b.maxHttp=41;assertThatThrownBy(b::validate).hasMessage("VALIDATION_BUDGET_INVALID");}
+ @Test void lostResponseRetainsChargeAndConservativelyCoolsAcrossRestart(){reserve(Operation.WAREHOUSES,1,null,null);clock.advance(121);assertThatThrownBy(()->new SelfopEgressService(mapper,cfg,clock).reserve(context(),Operation.OUTBOUND_QUERY,1,null,null,INTERNAL)).hasMessage("ACCOUNT_COOLDOWN_WAIT");assertThat(budget().reservedHttp).isEqualTo(1);assertThat(budget().confirmedHttp).isZero();assertThat(account.getApiPauseReason()).isEqualTo("REQUEST_OUTCOME_UNKNOWN");assertThat(account.getApiCooldownUntilUtc()).isAfter(now());}
+ @Test void rateLimitStopsRootAndAllFamiliesRetainCooldown(){var c=reserve(Operation.PRODUCT_INVENTORY,1,"A",null);service.authorize(new AuthorizationRequest(c,Operation.PRODUCT_INVENTORY,PROVIDER));service.complete(new CompletionRequest(c,Operation.PRODUCT_INVENTORY,PROVIDER,1,"LINGXING_WMS_RATE_LIMITED",429,null,true,clock.instant().plusSeconds(300)));assertThat(task.getStatus()).isEqualTo("DEAD");assertThat(rootBudget().stopReason).isEqualTo("RATE_LIMITED");assertThat(account.getApiCooldownUntilUtc()).isEqualTo(now().plusSeconds(300));assertThat(budget().reservedHttp).isEqualTo(1);verify(mapper).terminateValidationRuns(eq(1L),eq("FAILED"),eq("RATE_LIMITED"),any());}
+ @Test void inheritedDailyBudgetIsNotResetByNewGrantOrDate(){cfg.setTransferredDailyHttpCount(99);success(reserve(Operation.WAREHOUSES,1,null,null),Operation.WAREHOUSES);assertThat(budget().reservedHttp).isEqualTo(100);assertThatThrownBy(()->reserve(Operation.OUTBOUND_QUERY,1,null,null)).hasMessage("ACCOUNT_DAILY_BUDGET");cfg.setExclusiveGrantId("grant2");cfg.setTransferredDailyHttpCount(3);assertThatThrownBy(()->service.reserve(new SelfopRequestContext("synthetic","VALIDATION",1L,"selfop-1","grant2",1L,2L),Operation.OUTBOUND_QUERY,1,null,null,INTERNAL)).hasMessage("ACCOUNT_DAILY_BUDGET");assertThat(budget().reservedHttp).isEqualTo(100);}
+ @Test void actualStartIntervalUsesAuthorizationTimeAndReturnsQueueDeadline(){var c=reserve(Operation.WAREHOUSES,1,null,null);clock.advance(4);service.authorize(new AuthorizationRequest(c,Operation.WAREHOUSES,PROVIDER));service.complete(new CompletionRequest(c,Operation.WAREHOUSES,PROVIDER,1,null,200,200,false,null));clock.advance(1);assertThatThrownBy(()->reserve(Operation.OUTBOUND_QUERY,1,null,null)).hasMessage("ACCOUNT_INTERVAL_WAIT").satisfies(e->assertThat(((EgressRejectedException)e).waitUntilUtc()).isEqualTo(now().plusSeconds(4)));}
+ @Test void obsoleteExecutionFenceCannotReserveOrConsume(){run.setFenceToken(6L);assertThatThrownBy(()->reserve(Operation.WAREHOUSES,1,null,null)).hasMessage("EGRESS_FENCE_LOST");run.setFenceToken(7L);var c=reserve(Operation.WAREHOUSES,1,null,null);account.setFenceToken(8L);assertThatThrownBy(()->service.authorize(new AuthorizationRequest(c,Operation.WAREHOUSES,PROVIDER))).hasMessage("EGRESS_FENCE_LOST");assertThat(budget().reservedHttp).isEqualTo(1);}
+ @Test void totalHttpCapCountsEveryOperationAndPreparedReservation(){var b=rootBudget();b.http=40;task.setValidationBudgetJson(SelfopSupport.json(b));assertThatThrownBy(()->reserve(Operation.OUTBOUND_DETAIL,0,"A","C/DO")).hasMessage("VALIDATION_HTTP_LIMIT");assertThat(task.getStatus()).isEqualTo("SAMPLE_DONE");}
+ @Test void warehouseChildRequestsUseOriginalAccountRootBudgetAndRejectScopeMismatch(){
+  var child=new SelfopSyncTask();child.setId(3L);child.setValidationRootTaskId(1L);child.setTaskRole("WAREHOUSE_SYNC");child.setExecutionPurpose("VALIDATION");child.setSourceAccount("synthetic");child.setStatus("RUNNING");child.setScopeId(100L);child.setWarehouseCode("A");
+  var attempt=new SelfopSyncRun();attempt.setId(4L);attempt.setTaskId(3L);attempt.setSourceAccount("synthetic");attempt.setExecutionPurpose("VALIDATION");attempt.setStatus("FETCHING");attempt.setFenceToken(7L);attempt.setScopeId(100L);attempt.setWarehouseCode("A");
+  when(mapper.lockTask(3L)).thenReturn(child);when(mapper.lockRun(4L)).thenReturn(attempt);when(mapper.warehouseFence(eq(100L),eq(7L),eq(3L),any())).thenReturn(1);
+  var childContext=new SelfopRequestContext("synthetic","VALIDATION",1L,"selfop-1","grant",3L,4L);
+  var c=service.reserve(childContext,Operation.PRODUCT_INVENTORY,1,"A",null,INTERNAL);success(c,Operation.PRODUCT_INVENTORY);assertThat(budget().reservedHttp).isEqualTo(1);
+  attempt.setWarehouseCode("B");assertThatThrownBy(()->service.reserve(childContext,Operation.PRODUCT_INVENTORY,1,"A",null,INTERNAL)).hasMessage("EGRESS_FENCE_LOST");
+ }
+ @Test void directoryRootOnlyAllowsWarehouseOperationAndOneHttpWithinSixtySeconds(){
+  task.setQueryScopeJson("{\"action\":\"WAREHOUSE_DISCOVERY\"}");task.setValidationBudgetJson(SelfopValidationBudget.freezeWarehouseDiscovery(now()));
+  assertThatThrownBy(()->reserve(Operation.OUTBOUND_QUERY,10,null,null)).hasMessage("VALIDATION_DIRECTORY_OPERATION_ONLY");
+  assertThatThrownBy(()->reserve(Operation.PRODUCT_INVENTORY,10,"A",null)).hasMessage("VALIDATION_DIRECTORY_OPERATION_ONLY");
+  assertThat(budget().reservedHttp).isZero();
+  assertThat(rootBudget().deadlineAtUtc).isEqualTo(rootBudget().startedAtUtc.plusSeconds(60));
+  success(reserve(Operation.WAREHOUSES,10,null,null),Operation.WAREHOUSES);
+  assertThatThrownBy(()->reserve(Operation.WAREHOUSES,10,null,null)).hasMessage("VALIDATION_HTTP_LIMIT");
+  assertThat(budget().reservedHttp).isEqualTo(1);assertThat(budget().confirmedHttp).isEqualTo(1);assertThat(rootBudget().pages).isEqualTo(1);
+ }
+ @Test void separateWarehouseRootsKeepTheirOwnFiveMinuteBudgetsAndSameAccountConsumption(){
+  success(reserve(Operation.PRODUCT_INVENTORY,10,"A",null),Operation.PRODUCT_INVENTORY);service.finishSample(1L,"VALIDATION_SAMPLE_SUFFICIENT");
+  var bRoot=new SelfopSyncTask();bRoot.setId(3L);bRoot.setValidationRootTaskId(3L);bRoot.setTaskRole("ACCOUNT_DISCOVERY");bRoot.setTaskType("VALIDATION");bRoot.setExecutionPurpose("VALIDATION");bRoot.setSourceAccount("synthetic");bRoot.setDiscoveryScopeId(10L);bRoot.setStatus("RUNNING");bRoot.setQueryScopeJson("{\"action\":\"VALIDATION\",\"warehouses\":[\"B\"]}");bRoot.setValidationBudgetJson(SelfopValidationBudget.freeze(now()));
+  var bRun=new SelfopSyncRun();bRun.setId(4L);bRun.setTaskId(3L);bRun.setSourceAccount("synthetic");bRun.setExecutionPurpose("VALIDATION");bRun.setStatus("FETCHING");bRun.setFenceToken(7L);
+  when(mapper.lockTask(3L)).thenReturn(bRoot);when(mapper.lockRun(4L)).thenReturn(bRun);
+  var c=service.reserve(new SelfopRequestContext("synthetic","VALIDATION",3L,"selfop-3","grant",3L,4L),Operation.PRODUCT_INVENTORY,10,"B",null,INTERNAL);success(c,Operation.PRODUCT_INVENTORY);
+  assertThat(budget().reservedHttp).isEqualTo(2);assertThat(budget().confirmedHttp).isEqualTo(2);
+  var second=SelfopSupport.read(bRoot.getValidationBudgetJson(),SelfopValidationBudget.class);
+  assertThat(rootBudget().http).isEqualTo(1);assertThat(second.http).isEqualTo(1);assertThat(second.maxHttp).isEqualTo(40);
+  assertThat(second.deadlineAtUtc).isEqualTo(second.startedAtUtc.plusSeconds(300));
+ }
+ @Test void unknownGrantTransferCooldownIsPreservedAndExpiredGrantCannotIssue(){cfg.setTransferredCooldownUntilUtc(now().plusSeconds(100));assertThatThrownBy(()->reserve(Operation.WAREHOUSES,1,null,null)).hasMessage("ACCOUNT_COOLDOWN_WAIT");cfg.setExclusiveGrantExpiresAtUtc(now().minusSeconds(1));assertThatThrownBy(()->reserve(Operation.WAREHOUSES,1,null,null)).hasMessage("EXCLUSIVE_HANDOFF_UNCONFIRMED");}
+ @Test void persistedDailyCapCannotBeRaisedMiddayToBypassBudget(){cfg.setDailyRequestBudget(1);success(reserve(Operation.WAREHOUSES,1,null,null),Operation.WAREHOUSES);cfg.setDailyRequestBudget(100);assertThatThrownBy(()->reserve(Operation.OUTBOUND_QUERY,1,null,null)).hasMessage("ACCOUNT_DAILY_BUDGET");assertThat(budget().dailyLimit).isEqualTo(1);}
+ @Test void oldAttemptCannotConsumeAfterNextPreparedRequest(){var c=reserve(Operation.WAREHOUSES,1,null,null);success(c,Operation.WAREHOUSES);reserve(Operation.OUTBOUND_QUERY,1,null,null);assertThatThrownBy(()->service.authorize(new AuthorizationRequest(c,Operation.WAREHOUSES,PROVIDER))).hasMessage("EGRESS_PERMIT_BINDING_INVALID");}
+ @Test void authorizationsLockAccountBeforeRootAndTask(){var c=reserve(Operation.WAREHOUSES,1,null,null);clearInvocations(mapper);service.authorize(new AuthorizationRequest(c,Operation.WAREHOUSES,PROVIDER));var order=inOrder(mapper);order.verify(mapper).lockAccount("synthetic");order.verify(mapper,times(2)).lockTask(1L);order.verify(mapper).lockRun(2L);}
+ @Test void completedPayloadIsIdempotentAcrossRestartAndBusinessDayWithoutChangingJournal(){
+  var c=reserve(Operation.WAREHOUSES,1,null,null);service.authorize(new AuthorizationRequest(c,Operation.WAREHOUSES,PROVIDER));
+  var completion=new CompletionRequest(c,Operation.WAREHOUSES,PROVIDER,1,null,200,200,false,null);service.complete(completion);
+  String journal=account.getApiBudgetJson(),rootJournal=task.getValidationBudgetJson();String rootStatus=task.getStatus();
+  clearInvocations(mapper);var restarted=new SelfopEgressService(mapper,cfg,clock);restarted.complete(completion);clock.advance(86400);restarted.complete(completion);
+  assertThat(account.getApiBudgetJson()).isEqualTo(journal);assertThat(task.getValidationBudgetJson()).isEqualTo(rootJournal);assertThat(task.getStatus()).isEqualTo(rootStatus);
+  assertThat(budget().pending.completionHash).isEqualTo(SelfopSupport.hash(completion));verify(mapper,never()).saveAccount(any());verify(mapper,never()).saveRoot(any());
+ }
+ @Test void everyChangedCompletionOutcomeConflictsWithoutOverwritingDurableResult(){
+  var c=reserve(Operation.WAREHOUSES,1,null,null);service.authorize(new AuthorizationRequest(c,Operation.WAREHOUSES,PROVIDER));
+  var completed=new CompletionRequest(c,Operation.WAREHOUSES,PROVIDER,1,"LINGXING_WMS_HTTP_RATE_LIMITED",429,31001,true,clock.instant().plusSeconds(300));service.complete(completed);
+  var changed=List.of(
+   new CompletionRequest(c,Operation.WAREHOUSES,PROVIDER,0,completed.errorCode(),429,31001,true,completed.cooldownUntil()),
+   new CompletionRequest(c,Operation.WAREHOUSES,PROVIDER,1,"OTHER_ERROR",429,31001,true,completed.cooldownUntil()),
+   new CompletionRequest(c,Operation.WAREHOUSES,PROVIDER,1,completed.errorCode(),200,31001,true,completed.cooldownUntil()),
+   new CompletionRequest(c,Operation.WAREHOUSES,PROVIDER,1,completed.errorCode(),429,429,true,completed.cooldownUntil()),
+   new CompletionRequest(c,Operation.WAREHOUSES,PROVIDER,1,completed.errorCode(),429,31001,false,completed.cooldownUntil()),
+   new CompletionRequest(c,Operation.WAREHOUSES,PROVIDER,1,completed.errorCode(),429,31001,true,completed.cooldownUntil().plusSeconds(1)));
+  String journal=account.getApiBudgetJson(),rootJournal=task.getValidationBudgetJson();var cooldown=account.getApiCooldownUntilUtc();String pause=account.getApiPauseReason();
+  clearInvocations(mapper);
+  for(var candidate:changed){assertThatThrownBy(()->service.complete(candidate)).isInstanceOf(EgressRejectedException.class).hasMessage("EGRESS_COMPLETION_CONFLICT");assertThat(account.getApiBudgetJson()).isEqualTo(journal);assertThat(task.getValidationBudgetJson()).isEqualTo(rootJournal);assertThat(task.getStatus()).isEqualTo("DEAD");assertThat(account.getApiCooldownUntilUtc()).isEqualTo(cooldown);assertThat(account.getApiPauseReason()).isEqualTo(pause);}
+  assertThat(budget().pending.completionHash).isEqualTo(SelfopSupport.hash(completed));assertThat(budget().confirmedHttp).isEqualTo(1);verify(mapper,never()).saveAccount(any());verify(mapper,never()).saveRoot(any());
+ }
+ @Test void provider31001And429AreRateLimitsEvenWithHttp200AndNoPauseFlag(){
+  for(int sourceCode:new int[]{31001,429}){
+   var fixture=new SelfopEgressServiceTest();var c=fixture.reserve(Operation.WAREHOUSES,1,null,null);fixture.service.authorize(new AuthorizationRequest(c,Operation.WAREHOUSES,PROVIDER));
+   fixture.service.complete(new CompletionRequest(c,Operation.WAREHOUSES,PROVIDER,1,null,200,sourceCode,false,null));
+   assertThat(fixture.task.getStatus()).isEqualTo("DEAD");assertThat(fixture.rootBudget().stopReason).isEqualTo("RATE_LIMITED");assertThat(fixture.budget().rateLimitFailures).isEqualTo(1);assertThat(fixture.account.getApiPauseReason()).isEqualTo("RATE_LIMIT_COOLDOWN");
+  }
+ }
+ private void business(){cfg.setCollectionMode("BUSINESS");cfg.setEnvironment("production");task.setExecutionPurpose("BUSINESS");run.setExecutionPurpose("BUSINESS");}
+ private void testBusiness(int http,int seconds){business();cfg.setEnvironment("test");task.setBusinessRootTaskId(1L);
+  var recorded=new SelfopBusinessBudget();recorded.startedAtUtc=now();recorded.deadlineAtUtc=now().plusSeconds(seconds);
+  task.setBusinessBudgetJson(SelfopSupport.json(recorded));}
+ private SelfopBusinessBudget businessBudget(){return SelfopSupport.read(task.getBusinessBudgetJson(),SelfopBusinessBudget.class);}
+ private void continuousBusinessRoot(){
+  business();cfg.setEnvironment("test");cfg.setContinuousBusinessCollectionEnabled(true);
+  cfg.setExclusiveGrantExpiresAtUtc(now().minusSeconds(1));cfg.setBusinessMinRequestIntervalMs(1200);
+  task.setValidationRootTaskId(null);task.setValidationBudgetJson(null);task.setUpstreamTaskId(null);
+  task.setTaskType("BACKFILL");task.setRequestedBy(SelfopCollectionPolicy.CONTINUOUS_PLANNER);task.setScopeHash("a".repeat(64));
+  var from=LocalDate.of(2026,10,11).atStartOfDay();task.setQueryFromUtc(from.minusHours(8));task.setQueryUntilUtc(from.plusDays(1).minusHours(8));
+  task.setQueryScopeJson(SelfopSupport.json(Map.of("startTime",from.toString(),"endTime",from.plusDays(1).toString())));
+  task.setRequestKey("continuous:outbound:2026-10-11:"+task.getScopeHash().substring(0,12));
+  task.setBusinessRootTaskId(task.getId());task.setBusinessBudgetJson(SelfopBusinessBudget.freezeContinuous(now()));
+  assertThat(SelfopCollectionPolicy.continuousBusinessRoot(task)).isTrue();
+ }
+ @Test void continuousRootWithNoDeadlineReservesAuthorizesAcrossDayWithoutResettingAccumulated8820(){
+  continuousBusinessRoot();cfg.setEgressLeaseSeconds(999);cfg.setDailyRequestBudget(1);
+  var inherited=new SelfopApiBudget();inherited.budgetDate=now().plusHours(8).toLocalDate();inherited.importedGrantId="grant";
+  inherited.reservedHttp=8820;inherited.confirmedHttp=8820;inherited.minIntervalMs=1200;account.setApiBudgetJson(SelfopSupport.json(inherited));
+  var b=businessBudget();b.http=8820;b.confirmedHttp=8820;task.setBusinessBudgetJson(SelfopSupport.json(b));var started=b.startedAtUtc;
+  var c=reserve(Operation.OUTBOUND_QUERY,100,null,null);
+  assertThat(budget().pending.expiresAtUtc).isEqualTo(now().plusSeconds(120));
+  var restarted=new SelfopEgressService(mapper,cfg,clock);
+  var permit=restarted.authorize(new AuthorizationRequest(c,Operation.OUTBOUND_QUERY,PROVIDER));
+  assertThat(permit.expiresAt()).isEqualTo(clock.instant().plusSeconds(30));assertThat(permit.allowedAttempts()).isEqualTo(1);
+  var completion=new CompletionRequest(c,Operation.OUTBOUND_QUERY,PROVIDER,1,null,200,200,false,null);
+  restarted.complete(completion);restarted.complete(completion);
+  clock.advance(86400);account.setLeaseUntilUtc(now().plusMinutes(5));
+  var next=new SelfopEgressService(mapper,cfg,clock).reserve(context(),Operation.OUTBOUND_DETAIL,0,"A","C/DO",INTERNAL);success(next,Operation.OUTBOUND_DETAIL);
+  assertThat(budget().reservedHttp).isEqualTo(8822);assertThat(budget().confirmedHttp).isEqualTo(8822);assertThat(budget().dailyLimit).isZero();
+  assertThat(businessBudget().http).isEqualTo(8822);assertThat(businessBudget().confirmedHttp).isEqualTo(8822);
+  assertThat(businessBudget().continuous).isTrue();assertThat(businessBudget().deadlineAtUtc).isNull();assertThat(businessBudget().startedAtUtc).isEqualTo(started);
+  verify(mapper,never()).terminateBusinessTasks(any(),any());
+ }
+ @Test void continuousRootSwitchOffRejectsNewReserveAndPreparedAuthorizeButAccountsLateCompletion(){
+  continuousBusinessRoot();cfg.setExclusiveGrantExpiresAtUtc(now().plusDays(2));
+  cfg.setContinuousBusinessCollectionEnabled(false);
+  assertThatThrownBy(()->reserve(Operation.WAREHOUSES,1,null,null)).hasMessage("BUSINESS_SESSION_ROOT_INVALID");
+  assertThat(budget().reservedHttp).isZero();
+  cfg.setContinuousBusinessCollectionEnabled(true);var c=reserve(Operation.WAREHOUSES,1,null,null);
+  cfg.setContinuousBusinessCollectionEnabled(false);
+  assertThatThrownBy(()->service.authorize(new AuthorizationRequest(c,Operation.WAREHOUSES,PROVIDER))).hasMessage("BUSINESS_SESSION_ROOT_INVALID");
+  assertThat(budget().pending.consumed).isFalse();
+  cfg.setContinuousBusinessCollectionEnabled(true);service.authorize(new AuthorizationRequest(c,Operation.WAREHOUSES,PROVIDER));
+  cfg.setContinuousBusinessCollectionEnabled(false);cfg.setCollectionMode("OFF");clock.advance(86400);
+  var completion=new CompletionRequest(c,Operation.WAREHOUSES,PROVIDER,1,null,200,200,false,null);
+  var restarted=new SelfopEgressService(mapper,cfg,clock);restarted.complete(completion);restarted.complete(completion);
+  assertThat(budget().reservedHttp).isEqualTo(1);assertThat(budget().confirmedHttp).isEqualTo(1);
+  assertThat(businessBudget().http).isEqualTo(1);assertThat(businessBudget().confirmedHttp).isEqualTo(1);
+ }
+ @Test void continuousRootInProductionAlsoRequiresSwitchAndValidPersistedPlannerIdentity(){
+  continuousBusinessRoot();cfg.setEnvironment("production");cfg.setExclusiveGrantExpiresAtUtc(now().plusDays(2));
+  cfg.setContinuousBusinessCollectionEnabled(false);
+  assertThatThrownBy(()->reserve(Operation.WAREHOUSES,1,null,null)).hasMessage("BUSINESS_SESSION_ROOT_INVALID");
+  cfg.setContinuousBusinessCollectionEnabled(true);task.setRequestedBy("manual-operator");
+  assertThatThrownBy(()->reserve(Operation.WAREHOUSES,1,null,null)).hasMessage("BUSINESS_SESSION_ROOT_INVALID");
+  task.setRequestedBy(SelfopCollectionPolicy.CONTINUOUS_PLANNER);success(reserve(Operation.WAREHOUSES,1,null,null),Operation.WAREHOUSES);
+  assertThat(businessBudget().confirmedHttp).isEqualTo(1);
+  task.setStatus("DEAD");assertThatThrownBy(()->reserve(Operation.WAREHOUSES,1,null,null)).hasMessage("BUSINESS_SESSION_ROOT_STOPPED");
+ }
+ @Test void continuousRootAuthorizeStillChecksFenceStopAndPendingExpiry(){
+  continuousBusinessRoot();var c=reserve(Operation.WAREHOUSES,1,null,null);
+  account.setFenceToken(8L);
+  assertThatThrownBy(()->service.authorize(new AuthorizationRequest(c,Operation.WAREHOUSES,PROVIDER))).hasMessage("EGRESS_FENCE_LOST");
+  account.setFenceToken(7L);clock.advance(121);
+  assertThatThrownBy(()->service.authorize(new AuthorizationRequest(c,Operation.WAREHOUSES,PROVIDER))).hasMessage("EGRESS_PERMIT_REPLAY_OR_EXPIRED");
+  assertThat(budget().pending.consumed).isFalse();assertThat(businessBudget().confirmedHttp).isZero();
+  var b=businessBudget();b.stopReason="BUSINESS_MANUAL_STOP";task.setBusinessBudgetJson(SelfopSupport.json(b));
+  assertThatThrownBy(()->service.authorize(new AuthorizationRequest(c,Operation.WAREHOUSES,PROVIDER))).hasMessage("BUSINESS_MANUAL_STOP");
+  assertThat(task.getStatus()).isEqualTo("DEAD");
+ }
+ @Test void continuousRootStillPreservesIntervalSingleFlightAndUnknownOutcomeAfterRestart(){
+  continuousBusinessRoot();var c=reserve(Operation.WAREHOUSES,1,null,null);
+  assertThatThrownBy(()->reserve(Operation.OUTBOUND_QUERY,1,null,null)).hasMessage("ACCOUNT_REQUEST_INFLIGHT");
+  assertThat(budget().reservedHttp).isEqualTo(1);
+  service.authorize(new AuthorizationRequest(c,Operation.WAREHOUSES,PROVIDER));
+  service.complete(new CompletionRequest(c,Operation.WAREHOUSES,PROVIDER,1,null,200,200,false,null));
+  assertThatThrownBy(()->reserve(Operation.OUTBOUND_QUERY,1,null,null)).hasMessage("ACCOUNT_INTERVAL_WAIT");
+  clock.advance(1);assertThatThrownBy(()->reserve(Operation.OUTBOUND_QUERY,1,null,null)).hasMessage("ACCOUNT_INTERVAL_WAIT");
+  clock.advance(1);var pending=reserve(Operation.OUTBOUND_QUERY,1,null,null);
+  service.authorize(new AuthorizationRequest(pending,Operation.OUTBOUND_QUERY,PROVIDER));clock.advance(86400);
+  account.setLeaseUntilUtc(now().plusMinutes(5));var restarted=new SelfopEgressService(mapper,cfg,clock);
+  assertThatThrownBy(()->restarted.reserve(context(),Operation.WAREHOUSES,1,null,null,INTERNAL)).hasMessage("ACCOUNT_COOLDOWN_WAIT");
+  assertThat(budget().reservedHttp).isEqualTo(2);assertThat(budget().confirmedHttp).isEqualTo(1);assertThat(budget().pending.abandoned).isTrue();
+  assertThat(account.getApiPauseReason()).isEqualTo("REQUEST_OUTCOME_UNKNOWN");
+ }
+ @Test void continuousRootActual429AndAuthorizationFailureKeepAccountProtections(){
+  continuousBusinessRoot();var c=reserve(Operation.WAREHOUSES,1,null,null);service.authorize(new AuthorizationRequest(c,Operation.WAREHOUSES,PROVIDER));
+  service.complete(new CompletionRequest(c,Operation.WAREHOUSES,PROVIDER,1,"LINGXING_WMS_HTTP_RATE_LIMITED",429,null,true,null));
+  assertThatThrownBy(()->reserve(Operation.WAREHOUSES,1,null,null)).hasMessage("ACCOUNT_COOLDOWN_WAIT");
+  clock.advance(cfg.getCooldownSeconds()+1);var next=reserve(Operation.OUTBOUND_DETAIL,0,"A","C/DO");service.authorize(new AuthorizationRequest(next,Operation.OUTBOUND_DETAIL,PROVIDER));
+  service.complete(new CompletionRequest(next,Operation.OUTBOUND_DETAIL,PROVIDER,1,"LINGXING_WMS_AUTHORIZATION_REJECTED",401,null,true,null));
+  clock.advance(86400);account.setLeaseUntilUtc(now().plusMinutes(5));
+  assertThatThrownBy(()->new SelfopEgressService(mapper,cfg,clock).reserve(context(),Operation.WAREHOUSES,1,null,null,INTERNAL)).hasMessage("ACCOUNT_REQUIRES_REVIEW");
+  assertThat(account.getApiPauseReason()).isEqualTo("AUTHORIZATION_REQUIRES_REVIEW");assertThat(budget().rateLimitFailures).isEqualTo(1);
+  assertThat(budget().reservedHttp).isEqualTo(2);assertThat(budget().confirmedHttp).isEqualTo(2);
+ }
+ @Test void businessSurpassesPriorDailyAndRootHttpCapsAcrossRestartWithoutRenewingDeadline(){
+  testBusiness(5000,300);cfg.setDailyRequestBudget(12000);cfg.setTransferredDailyHttpCount(12000);
+  var rootBudget=businessBudget();rootBudget.maxHttp=5000;rootBudget.http=5000;rootBudget.confirmedHttp=5000;task.setBusinessBudgetJson(SelfopSupport.json(rootBudget));
+  var start=rootBudget.startedAtUtc;var deadline=rootBudget.deadlineAtUtc;
+  var c=reserve(Operation.WAREHOUSES,1,null,null);service.authorize(new AuthorizationRequest(c,Operation.WAREHOUSES,PROVIDER));
+  var completion=new CompletionRequest(c,Operation.WAREHOUSES,PROVIDER,1,null,200,200,false,null);
+  service.complete(completion);new SelfopEgressService(mapper,cfg,clock).complete(completion);
+  assertThat(businessBudget().http).isEqualTo(5001);assertThat(businessBudget().confirmedHttp).isEqualTo(5001);
+  assertThat(budget().dailyLimit).isZero();assertThat(budget().reservedHttp).isEqualTo(12001);assertThat(budget().confirmedHttp).isEqualTo(1);
+  clock.advance(10);cfg.setRequestBudget(1000);cfg.setTimeBudgetSeconds(3600);
+  var next=new SelfopEgressService(mapper,cfg,clock).reserve(context(),Operation.OUTBOUND_QUERY,1,null,null,INTERNAL);success(next,Operation.OUTBOUND_QUERY);
+  assertThat(businessBudget().http).isEqualTo(5002);assertThat(businessBudget().startedAtUtc).isEqualTo(start);assertThat(businessBudget().deadlineAtUtc).isEqualTo(deadline);
+  verify(mapper,never()).terminateBusinessTasks(any(),any());verify(mapper,never()).terminateValidationRuns(any(),any(),any(),any());
+ }
+ @Test void businessWithoutDailyQuotaStillUsesIntervalAndActual429Review(){
+  testBusiness(1,1);clock.advance(2);cfg.setExclusiveGrantExpiresAtUtc(now().minusSeconds(1));cfg.setDailyRequestBudget(0);cfg.setBusinessMinRequestIntervalMs(1200);
+  var c=reserve(Operation.WAREHOUSES,1,null,null);service.authorize(new AuthorizationRequest(c,Operation.WAREHOUSES,PROVIDER));
+  service.complete(new CompletionRequest(c,Operation.WAREHOUSES,PROVIDER,1,null,200,200,false,null));
+  assertThatThrownBy(()->reserve(Operation.OUTBOUND_QUERY,1,null,null)).hasMessage("ACCOUNT_INTERVAL_WAIT");
+  clock.advance(2);var next=reserve(Operation.OUTBOUND_QUERY,1,null,null);service.authorize(new AuthorizationRequest(next,Operation.OUTBOUND_QUERY,PROVIDER));
+  service.complete(new CompletionRequest(next,Operation.OUTBOUND_QUERY,PROVIDER,1,"LINGXING_WMS_HTTP_RATE_LIMITED",429,null,true,null));
+  assertThat(budget().reservedHttp).isEqualTo(2);assertThat(budget().confirmedHttp).isEqualTo(2);assertThat(budget().rateLimitFailures).isEqualTo(1);
+  assertThat(account.getApiPauseReason()).isEqualTo("RATE_LIMIT_COOLDOWN");
+  clock.advance(cfg.getCooldownSeconds()+1);var afterCooldown=reserve(Operation.WAREHOUSES,1,null,null);
+  service.authorize(new AuthorizationRequest(afterCooldown,Operation.WAREHOUSES,PROVIDER));
+  service.complete(new CompletionRequest(afterCooldown,Operation.WAREHOUSES,PROVIDER,1,"LINGXING_WMS_AUTHORIZATION_REJECTED",401,null,true,null));
+  clock.advance(2);assertThatThrownBy(()->reserve(Operation.WAREHOUSES,1,null,null)).hasMessage("ACCOUNT_REQUIRES_REVIEW");
+  assertThat(account.getApiPauseReason()).isEqualTo("AUTHORIZATION_REQUIRES_REVIEW");
+ }
+ @Test void oldManualDeadlineRemovalKeepsSingleFlightAndUnknownOutcomeProtection(){
+  testBusiness(5,1);clock.advance(2);cfg.setExclusiveGrantExpiresAtUtc(null);
+  var c=reserve(Operation.WAREHOUSES,1,null,null);
+  assertThatThrownBy(()->reserve(Operation.WAREHOUSES,1,null,null)).hasMessage("ACCOUNT_REQUEST_INFLIGHT");
+  service.authorize(new AuthorizationRequest(c,Operation.WAREHOUSES,PROVIDER));clock.advance(31);
+  var restarted=new SelfopEgressService(mapper,cfg,clock);
+  assertThatThrownBy(()->restarted.reserve(context(),Operation.WAREHOUSES,1,null,null,INTERNAL)).hasMessage("ACCOUNT_COOLDOWN_WAIT");
+  assertThat(account.getApiPauseReason()).isEqualTo("REQUEST_OUTCOME_UNKNOWN");assertThat(budget().pending.abandoned).isTrue();
+  assertThat(businessBudget().http).isEqualTo(1);assertThat(businessBudget().confirmedHttp).isZero();
+ }
+ @Test void existingManualBusinessContinuesPastBothRecordedDeadlineAndGrantWithoutReset(){
+  testBusiness(5,10);cfg.setExclusiveGrantExpiresAtUtc(now().plusSeconds(10));cfg.setContinuousBusinessCollectionEnabled(false);
+  task.setRequestKey("manual:2026-10-06");task.setRequestedBy("operator");task.setRoutingManifestJson("{\"nextPage\":37,\"scan\":2}");
+  var original=businessBudget();original.http=8820;original.confirmedHttp=8819;task.setBusinessBudgetJson(SelfopSupport.json(original));
+  var c=reserve(Operation.WAREHOUSES,1,null,null);assertThat(budget().pending.expiresAtUtc).isAfter(original.deadlineAtUtc);
+  clock.advance(9);var permit=service.authorize(new AuthorizationRequest(c,Operation.WAREHOUSES,PROVIDER));
+  assertThat(permit.expiresAt()).isEqualTo(clock.instant().plusSeconds(30));
+  clock.advance(2);service.complete(new CompletionRequest(c,Operation.WAREHOUSES,PROVIDER,1,null,200,200,false,null));
+  clock.advance(5);var restarted=new SelfopEgressService(mapper,cfg,clock);success(restarted.reserve(context(),Operation.WAREHOUSES,1,null,null,INTERNAL),Operation.WAREHOUSES);
+  assertThat(businessBudget().http).isEqualTo(8822);assertThat(businessBudget().confirmedHttp).isEqualTo(8821);
+  assertThat(businessBudget().startedAtUtc).isEqualTo(original.startedAtUtc);assertThat(businessBudget().deadlineAtUtc).isEqualTo(original.deadlineAtUtc);
+  assertThat(businessBudget().continuous).isFalse();assertThat(businessBudget().stopReason).isNull();
+  assertThat(task.getId()).isEqualTo(1L);assertThat(task.getBusinessRootTaskId()).isEqualTo(1L);assertThat(task.getRequestKey()).isEqualTo("manual:2026-10-06");
+  assertThat(task.getRequestedBy()).isEqualTo("operator");assertThat(task.getRoutingManifestJson()).isEqualTo("{\"nextPage\":37,\"scan\":2}");
+  verify(mapper,never()).terminateBusinessTasks(any(),any());
+ }
+ @Test void businessShortPendingExpiryStillRejectsAfterSessionDeadlineRemoved(){
+  testBusiness(5,10);cfg.setEgressLeaseSeconds(20);var c=reserve(Operation.WAREHOUSES,1,null,null);clock.advance(20);
+  assertThatThrownBy(()->service.authorize(new AuthorizationRequest(c,Operation.WAREHOUSES,PROVIDER)))
+   .hasMessage("EGRESS_PERMIT_REPLAY_OR_EXPIRED").satisfies(e->assertThat(((EgressRejectedException)e).sampleDone()).isFalse());
+  assertThat(budget().pending.consumed).isFalse();assertThat(businessBudget().http).isEqualTo(1);assertThat(businessBudget().confirmedHttp).isZero();
+  assertThat(task.getStatus()).isEqualTo("RUNNING");
+ }
+ @Test void testBusinessMissingBudgetOrWrongRootFailsClosedWithoutBackfill(){
+  testBusiness(5,300);task.setBusinessBudgetJson(null);
+  assertThatThrownBy(()->reserve(Operation.WAREHOUSES,1,null,null)).hasMessage("BUSINESS_SESSION_ROOT_INVALID");
+  assertThat(task.getBusinessBudgetJson()).isNull();assertThat(budget().reservedHttp).isZero();
+  task.setBusinessBudgetJson(SelfopBusinessBudget.freeze(now()));task.setBusinessRootTaskId(999L);
+  assertThatThrownBy(()->reserve(Operation.WAREHOUSES,1,null,null)).hasMessage("BUSINESS_SESSION_ROOT_INVALID");
+  assertThat(businessBudget().http).isZero();
+ }
+ @Test void testBusinessChildSharesFrozenRootAcrossYieldAndRejectsDifferentRoot(){
+  testBusiness(2,300);
+  var child=new SelfopSyncTask();child.setId(3L);child.setBusinessRootTaskId(1L);child.setTaskRole("WAREHOUSE_SYNC");child.setExecutionPurpose("BUSINESS");child.setSourceAccount("synthetic");child.setStatus("RUNNING");child.setScopeId(100L);child.setWarehouseCode("A");
+  var attempt=new SelfopSyncRun();attempt.setId(4L);attempt.setTaskId(3L);attempt.setSourceAccount("synthetic");attempt.setExecutionPurpose("BUSINESS");attempt.setStatus("FETCHING");attempt.setFenceToken(7L);attempt.setScopeId(100L);attempt.setWarehouseCode("A");
+  when(mapper.lockTask(3L)).thenReturn(child);when(mapper.lockRun(4L)).thenReturn(attempt);when(mapper.warehouseFence(eq(100L),eq(7L),eq(3L),any())).thenReturn(1);
+  success(reserve(Operation.WAREHOUSES,1,null,null),Operation.WAREHOUSES);
+  var context=new SelfopRequestContext("synthetic","BUSINESS",1L,"selfop-1","grant",3L,4L);
+  var c=new SelfopEgressService(mapper,cfg,clock).reserve(context,Operation.PRODUCT_INVENTORY,1,"A",null,INTERNAL);success(c,Operation.PRODUCT_INVENTORY);
+  assertThat(businessBudget().http).isEqualTo(2);assertThat(businessBudget().confirmedHttp).isEqualTo(2);assertThat(child.getBusinessBudgetJson()).isNull();
+  child.setBusinessRootTaskId(999L);assertThatThrownBy(()->service.reserve(context,Operation.PRODUCT_INVENTORY,1,"A",null,INTERNAL)).hasMessage("BUSINESS_SESSION_ROOT_INVALID");
+  child.setBusinessRootTaskId(1L);success(service.reserve(context,Operation.PRODUCT_INVENTORY,1,"A",null,INTERNAL),Operation.PRODUCT_INVENTORY);
+  assertThat(businessBudget().http).isEqualTo(3);verify(mapper,never()).terminateBusinessTasks(any(),any());
+ }
+ @Test void productionBusinessDoesNotRequireTestBudget(){
+  business();success(reserve(Operation.WAREHOUSES,1,null,null),Operation.WAREHOUSES);
+  assertThat(task.getBusinessBudgetJson()).isNull();assertThat(budget().confirmedHttp).isEqualTo(1);
+  verify(mapper,never()).terminateBusinessTasks(any(),any());
+ }
+ @Test void testBusinessPreparedAttemptHonorsPersistedStopAndDoesNotReportValidationComplete(){
+  testBusiness(5,300);var c=reserve(Operation.WAREHOUSES,1,null,null);
+  var b=businessBudget();b.stopReason="BUSINESS_SESSION_HTTP_LIMIT";task.setBusinessBudgetJson(SelfopSupport.json(b));task.setStatus("DEAD");
+  assertThatThrownBy(()->service.authorize(new AuthorizationRequest(c,Operation.WAREHOUSES,PROVIDER)))
+   .hasMessage("BUSINESS_SESSION_HTTP_LIMIT").satisfies(e->assertThat(((EgressRejectedException)e).sampleDone()).isFalse());
+  assertThat(budget().pending.consumed).isFalse();assertThat(businessBudget().confirmedHttp).isZero();
+ }
+ @Test void businessTerminationSqlIsRootScopedAndPreservesTerminalPublicationStates(){
+  var configuration=new org.apache.ibatis.session.Configuration();configuration.addMapper(SelfopEgressMapper.class);
+  var args=new HashMap<String,Object>();args.put("root",1L);args.put("account","synthetic");args.put("reason","BUSINESS_SESSION_HTTP_LIMIT");args.put("now",now());
+  String prefix=SelfopEgressMapper.class.getName()+".";
+  String tasks=configuration.getMappedStatement(prefix+"terminateBusinessTasks").getBoundSql(args).getSql();
+  String runs=configuration.getMappedStatement(prefix+"terminateBusinessRuns").getBoundSql(args).getSql();
+  assertThat(tasks).contains("business_root_task_id=? AND source_account=? AND execution_purpose='BUSINESS'", "next_retry_at_utc=NULL", "status IN ('WAITING_SOURCE','READY','RUNNING','RETRY_WAIT')");
+  assertThat(runs).contains("business_root_task_id=? AND source_account=? AND execution_purpose='BUSINESS'", "error_code=?", "status IN ('FETCHING','VALIDATED','YIELDED','READY','BUILDING')");
+  assertThat(tasks).doesNotContain("SUCCEEDED");assertThat(runs).doesNotContain("PUBLISHED","REUSED");
+  assertThat(runs).contains("JSON_SET(JSON_REMOVE", "'$.etaSamples'", "'$.summaryAsOf'", "DATE_FORMAT(?,", "JSON_EXTRACT(progress_json,'$.attemptNo')=attempt_no");
+  args.put("status","FAILED");
+  String validation=configuration.getMappedStatement(prefix+"terminateValidationRuns").getBoundSql(args).getSql();
+  assertThat(validation).contains("'$.etaSamples'", "'$.summaryAsOf'", "DATE_FORMAT(?,", "validation_root_task_id=?");
+ }
+ @Test void committedCompletionWithLostReplyStaysPausedAcrossIntegrationRestart(){
+  business();var c=reserve(Operation.WAREHOUSES,1,null,null);service.authorize(new AuthorizationRequest(c,Operation.WAREHOUSES,PROVIDER));
+  service.complete(new CompletionRequest(c,Operation.WAREHOUSES,PROVIDER,1,null,200,200,false,null));
+  String journal=account.getApiBudgetJson();var until=now().plusSeconds(600);account.setApiCooldownUntilUtc(until);
+  service.pauseUncertain(c,Operation.WAREHOUSES,"LINGXING_WMS_BUDGET_COMPLETION_UNCONFIRMED");
+  assertThat(account.getApiPauseReason()).isEqualTo("EGRESS_REQUIRES_REVIEW");assertThat(account.getApiBudgetJson()).isEqualTo(journal);
+  assertThat(account.getApiCooldownUntilUtc()).isEqualTo(until);assertThat(budget().confirmedHttp).isEqualTo(1);
+  clock.advance(601);var restarted=new SelfopEgressService(mapper,cfg,clock);
+  assertThatThrownBy(()->restarted.reserve(context(),Operation.WAREHOUSES,1,null,null,INTERNAL)).hasMessage("ACCOUNT_REQUIRES_REVIEW");
+  assertThat(budget().reservedHttp).isEqualTo(1);assertThat(account.getApiPauseReason()).isEqualTo("EGRESS_REQUIRES_REVIEW");
+ }
+ @Test void uncertainUncompletedAttemptCannotDowngradeManualPauseWhenItsLeaseExpires(){
+  business();var c=reserve(Operation.WAREHOUSES,1,null,null);service.authorize(new AuthorizationRequest(c,Operation.WAREHOUSES,PROVIDER));
+  service.pauseUncertain(c,Operation.WAREHOUSES,"INTEGRATION_TRANSPORT_FAILURE");clock.advance(121);
+  var restarted=new SelfopEgressService(mapper,cfg,clock);
+  assertThatThrownBy(()->restarted.reserve(context(),Operation.WAREHOUSES,1,null,null,INTERNAL)).hasMessage("ACCOUNT_COOLDOWN_WAIT");
+  assertThat(account.getApiPauseReason()).isEqualTo("EGRESS_REQUIRES_REVIEW");clock.advance(61);
+  assertThatThrownBy(()->restarted.reserve(context(),Operation.WAREHOUSES,1,null,null,INTERNAL)).hasMessage("ACCOUNT_REQUIRES_REVIEW");
+  assertThat(budget().reservedHttp).isEqualTo(1);assertThat(budget().confirmedHttp).isZero();
+ }
+ @Test void uncertainPauseRequiresExactReservedContextAttemptAndOperation(){
+  var c=reserve(Operation.WAREHOUSES,1,null,null);String journal=account.getApiBudgetJson();clearInvocations(mapper);
+  var wrong=new EgressContext(c.sourceAccount(),c.executionPurpose(),c.rootTaskId(),c.sessionId(),"different-attempt",c.exclusiveGrantId());
+  assertThatThrownBy(()->service.pauseUncertain(wrong,Operation.WAREHOUSES,"INTEGRATION_TRANSPORT_FAILURE")).hasMessage("EGRESS_PERMIT_BINDING_INVALID");
+  assertThatThrownBy(()->service.pauseUncertain(c,Operation.OUTBOUND_DETAIL,"INTEGRATION_TRANSPORT_FAILURE")).hasMessage("EGRESS_PERMIT_BINDING_INVALID");
+  assertThat(account.getApiPauseReason()).isNull();assertThat(account.getApiBudgetJson()).isEqualTo(journal);verify(mapper,never()).saveAccount(any());
+ }
+ @Test void confirmedRatePauseIsNotUpgradedAndStrongerReviewIsPreserved(){
+  business();var c=reserve(Operation.WAREHOUSES,1,null,null);service.authorize(new AuthorizationRequest(c,Operation.WAREHOUSES,PROVIDER));
+  service.complete(new CompletionRequest(c,Operation.WAREHOUSES,PROVIDER,1,"LINGXING_WMS_HTTP_RATE_LIMITED",429,null,true,clock.instant().plusSeconds(300)));
+  String journal=account.getApiBudgetJson();var until=account.getApiCooldownUntilUtc();clearInvocations(mapper);
+  service.pauseUncertain(c,Operation.WAREHOUSES,"LINGXING_WMS_HTTP_RATE_LIMITED");
+  assertThat(account.getApiPauseReason()).isEqualTo("RATE_LIMIT_COOLDOWN");assertThat(account.getApiBudgetJson()).isEqualTo(journal);assertThat(account.getApiCooldownUntilUtc()).isEqualTo(until);verify(mapper,never()).saveAccount(any());
+  account.setApiPauseReason("AUTHORIZATION_REQUIRES_REVIEW");service.pauseUncertain(c,Operation.WAREHOUSES,"INTEGRATION_TRANSPORT_FAILURE");
+  assertThat(account.getApiPauseReason()).isEqualTo("AUTHORIZATION_REQUIRES_REVIEW");assertThat(account.getApiBudgetJson()).isEqualTo(journal);assertThat(account.getApiCooldownUntilUtc()).isEqualTo(until);
+ }
+ @Test void rateCompletionCommittedButAckLostRequiresReviewDespitePersistedCooldown(){
+  business();var c=reserve(Operation.WAREHOUSES,1,null,null);service.authorize(new AuthorizationRequest(c,Operation.WAREHOUSES,PROVIDER));
+  service.complete(new CompletionRequest(c,Operation.WAREHOUSES,PROVIDER,1,"LINGXING_WMS_HTTP_RATE_LIMITED",429,null,true,clock.instant().plusSeconds(300)));
+  String journal=account.getApiBudgetJson();var until=account.getApiCooldownUntilUtc();
+  service.pauseUncertain(c,Operation.WAREHOUSES,"LINGXING_WMS_BUDGET_COMPLETION_UNCONFIRMED");
+  assertThat(account.getApiPauseReason()).isEqualTo("EGRESS_REQUIRES_REVIEW");assertThat(account.getApiBudgetJson()).isEqualTo(journal);assertThat(account.getApiCooldownUntilUtc()).isEqualTo(until);
+  clock.advance(301);assertThatThrownBy(()->new SelfopEgressService(mapper,cfg,clock).reserve(context(),Operation.WAREHOUSES,1,null,null,INTERNAL)).hasMessage("ACCOUNT_REQUIRES_REVIEW");
+  assertThat(budget().reservedHttp).isEqualTo(1);assertThat(budget().confirmedHttp).isEqualTo(1);assertThat(budget().rateLimitFailures).isEqualTo(1);
+ }
+ @Test void nonRatePauseRequiresReviewAfterCooldownAndRestartWithoutIncreasingRateFailures(){
+  business();var c=reserve(Operation.WAREHOUSES,1,null,null);service.authorize(new AuthorizationRequest(c,Operation.WAREHOUSES,PROVIDER));
+  service.complete(new CompletionRequest(c,Operation.WAREHOUSES,PROVIDER,1,"LINGXING_WMS_INVALID_RESPONSE",502,null,true,clock.instant().plusSeconds(60)));
+  assertThat(budget().rateLimitFailures).isZero();assertThat(account.getApiPauseReason()).isEqualTo("EGRESS_REQUIRES_REVIEW");clock.advance(61);
+  assertThatThrownBy(()->new SelfopEgressService(mapper,cfg,clock).reserve(context(),Operation.WAREHOUSES,1,null,null,INTERNAL)).hasMessage("ACCOUNT_REQUIRES_REVIEW");assertThat(budget().reservedHttp).isEqualTo(1);assertThat(account.getApiPauseReason()).isEqualTo("EGRESS_REQUIRES_REVIEW");
+ }
+ @Test void httpAuthorizationFailuresRequireReviewAfterRestart(){
+  for(int status:new int[]{401,403}){var fixture=new SelfopEgressServiceTest();fixture.business();var c=fixture.reserve(Operation.WAREHOUSES,1,null,null);fixture.service.authorize(new AuthorizationRequest(c,Operation.WAREHOUSES,PROVIDER));fixture.service.complete(new CompletionRequest(c,Operation.WAREHOUSES,PROVIDER,1,null,status,null,false,null));assertThat(fixture.budget().rateLimitFailures).isZero();assertThat(fixture.account.getApiPauseReason()).isEqualTo("AUTHORIZATION_REQUIRES_REVIEW");fixture.clock.advance(61);assertThatThrownBy(()->new SelfopEgressService(fixture.mapper,fixture.cfg,fixture.clock).reserve(fixture.context(),Operation.WAREHOUSES,1,null,null,INTERNAL)).hasMessage("ACCOUNT_REQUIRES_REVIEW");}
+ }
+ @Test void businessTrueRateLimitRetainsBoundedBackoffAndMayIssueFreshPermitAfterCooldown(){
+  business();var c=reserve(Operation.WAREHOUSES,1,null,null);service.authorize(new AuthorizationRequest(c,Operation.WAREHOUSES,PROVIDER));service.complete(new CompletionRequest(c,Operation.WAREHOUSES,PROVIDER,1,"LINGXING_WMS_HTTP_RATE_LIMITED",429,null,true,null));
+  assertThat(account.getApiCooldownUntilUtc()).isEqualTo(now().plusSeconds(60));assertThatThrownBy(()->reserve(Operation.WAREHOUSES,1,null,null)).hasMessage("ACCOUNT_COOLDOWN_WAIT");clock.advance(60);
+  var restarted=new SelfopEgressService(mapper,cfg,clock);var next=restarted.reserve(context(),Operation.WAREHOUSES,1,null,null,INTERNAL);assertThat(next.attemptId()).isNotEqualTo(c.attemptId());assertThat(restarted.authorize(new AuthorizationRequest(next,Operation.WAREHOUSES,PROVIDER)).allowedAttempts()).isEqualTo(1);restarted.complete(new CompletionRequest(next,Operation.WAREHOUSES,PROVIDER,1,"LINGXING_WMS_SOURCE_RATE_LIMITED",200,31001,false,null));assertThat(budget().rateLimitFailures).isEqualTo(2);assertThat(account.getApiCooldownUntilUtc()).isEqualTo(now().plusSeconds(120));assertThat(budget().reservedHttp).isEqualTo(2);
+ }
+ private static final class MutableClock extends Clock {private Instant instant=Instant.parse("2026-10-12T00:00:00Z");void advance(long seconds){instant=instant.plusSeconds(seconds);}public ZoneId getZone(){return ZoneOffset.UTC;}public Clock withZone(ZoneId zone){return this;}public Instant instant(){return instant;}}
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/retention/SalesRetentionServiceTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/retention/SalesRetentionServiceTest.java
new file mode 100644
index 000000000..e17352194
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/retention/SalesRetentionServiceTest.java
@@ -0,0 +1,77 @@
+package com.baiyue.lastleg.selfoperated.analytics.retention;
+
+import com.baiyue.lastleg.selfoperated.analytics.model.*;
+import org.junit.jupiter.api.*;
+import org.mockito.InOrder;
+import java.util.*;
+import static org.junit.jupiter.api.Assertions.*;
+import static org.mockito.Mockito.*;
+
+class SalesRetentionServiceTest {
+    final SalesRetentionMapper mapper=mock(SalesRetentionMapper.class);
+    final SelfopAnalyticsProperties config=new SelfopAnalyticsProperties();
+    final SalesRetentionService service=new SalesRetentionService(mapper,config);
+    SelfopSyncScope scope; SelfopSyncRun old;
+    @BeforeEach void setup() {
+        scope=new SelfopSyncScope(); scope.setId(1L);scope.setSourceAccount("demo");scope.setWarehouseCode("A");scope.setDataFamily("OUTBOUND");scope.setPublishedRunId(30L);
+        old=new SelfopSyncRun();old.setId(10L);old.setScopeId(1L);old.setSourceAccount("demo");old.setWarehouseCode("A");old.setRunRole("WAREHOUSE_SYNC");
+        old.setStatus("PUBLISHED");old.setExecutionPurpose("BUSINESS");old.setPublishedAtUtc(SelfopSupport.utcNow().minusDays(9));old.setSupersededAtUtc(SelfopSupport.utcNow().minusDays(8));
+        when(mapper.scope(1L)).thenReturn(scope);when(mapper.run(10L)).thenReturn(old);when(mapper.previous(1L,30L)).thenReturn(20L);
+    }
+    @Test void deletionIsOffByDefault() {
+        assertThrows(IllegalStateException.class,()->service.deleteBatch(1L,10L));verifyNoInteractions(mapper);
+    }
+    @Test void shortRetentionAndOversizedBatchCannotWeakenGuards() {
+        config.setRetentionEnabled(true);config.setSalesRetentionDays(1);config.setPersistenceBatchSize(1000);
+        old.setSupersededAtUtc(SelfopSupport.utcNow().minusDays(6));assertThrows(IllegalStateException.class,()->service.deleteBatch(1L,10L));
+        clearInvocations(mapper);
+        old.setSupersededAtUtc(SelfopSupport.utcNow().minusDays(8));when(mapper.deleteDaily(10L,500)).thenReturn(500);when(mapper.deleteProfiles(10L,500)).thenReturn(8);
+        when(mapper.deleteWarehouseDaily(10L,500)).thenReturn(30);
+        assertEquals(new SalesRetentionService.Deleted(10L,500,8,30),service.deleteBatch(1L,10L));
+        InOrder order=inOrder(mapper);order.verify(mapper).scope(1L);order.verify(mapper).run(10L);
+        order.verify(mapper).previous(1L,30L);order.verify(mapper).activeReferences("demo","A",10L);
+        order.verify(mapper).deleteDaily(10L,500);order.verify(mapper).deleteProfiles(10L,500);
+        order.verify(mapper).deleteWarehouseDaily(10L,500);
+        // Actual deletion follows scope acquisition, current-pointer/reference checks and fixed bounded predicates.
+        verify(mapper).deleteDaily(10L,500);verify(mapper).deleteProfiles(10L,500);
+    }
+    @Test void currentPreviousActiveInputAndUnpublishedCandidatesAreProtected() {
+        config.setRetentionEnabled(true);
+        scope.setPublishedRunId(10L);assertThrows(IllegalStateException.class,()->service.deleteBatch(1L,10L));
+        scope.setPublishedRunId(30L);when(mapper.previous(1L,30L)).thenReturn(10L);assertThrows(IllegalStateException.class,()->service.deleteBatch(1L,10L));
+        when(mapper.previous(1L,30L)).thenReturn(20L);when(mapper.activeReferences("demo","A",10L)).thenReturn(1L);assertThrows(IllegalStateException.class,()->service.deleteBatch(1L,10L));
+        when(mapper.activeReferences("demo","A",10L)).thenReturn(0L);old.setStatus("FAILED");assertThrows(IllegalStateException.class,()->service.deleteBatch(1L,10L));
+        verify(mapper,never()).deleteDaily(anyLong(),anyInt());verify(mapper,never()).deleteProfiles(anyLong(),anyInt());
+        verify(mapper,never()).deleteWarehouseDaily(anyLong(),anyInt());
+    }
+    @Test void pointerAndReferencesRecheckedForEveryBatch() {
+        config.setRetentionEnabled(true);service.deleteBatch(1L,10L);
+        when(mapper.activeReferences("demo","A",10L)).thenReturn(1L);
+        assertThrows(IllegalStateException.class,()->service.deleteBatch(1L,10L));
+        verify(mapper,times(2)).scope(1L);verify(mapper,times(2)).activeReferences("demo","A",10L);
+        verify(mapper,times(1)).deleteDaily(10L,500);
+        verify(mapper,times(1)).deleteWarehouseDaily(10L,500);
+    }
+    @Test void inventoryScopeAndDailyRepresentativeCannotBeCleanedAsSalesCopies() {
+        config.setRetentionEnabled(true);
+        scope.setDataFamily("INVENTORY");
+        assertThrows(IllegalStateException.class,()->service.deleteBatch(1L,10L));
+        scope.setDataFamily("OUTBOUND");
+        old.setInventoryDailySampleDate(java.time.LocalDate.of(2026,10,1));
+        old.setInventorySampleRuleVersion("DAILY_SCHEDULED_FIRST_V1");
+        assertThrows(IllegalStateException.class,()->service.deleteBatch(1L,10L));
+        verify(mapper,never()).deleteDaily(anyLong(),anyInt());
+        verify(mapper,never()).deleteProfiles(anyLong(),anyInt());
+        verify(mapper,never()).deleteWarehouseDaily(anyLong(),anyInt());
+    }
+    @Test void warehouseDailyRemainderStaysEligibleAndHasItsOwnBoundedDeletionCount() {
+        var configuration=new org.apache.ibatis.session.Configuration();configuration.addMapper(SalesRetentionMapper.class);
+        var parameters=Map.<String,Object>of("scopeId",1L,"current",30L,"previous",20L,"cutoff",SelfopSupport.utcNow(),"id",10L,"batchSize",500);
+        String eligible=configuration.getMappedStatement(SalesRetentionMapper.class.getName()+".eligible").getBoundSql(parameters).getSql();
+        assertTrue(eligible.contains("OR EXISTS (SELECT 1 FROM ll_selfop_warehouse_daily_sales w WHERE w.sales_run_id=r.id)"));
+        String deletion=configuration.getMappedStatement(SalesRetentionMapper.class.getName()+".deleteWarehouseDaily").getBoundSql(parameters).getSql();
+        assertEquals("DELETE FROM ll_selfop_warehouse_daily_sales WHERE sales_run_id=? LIMIT ?",deletion);
+        config.setRetentionEnabled(true);when(mapper.deleteWarehouseDaily(10L,500)).thenReturn(7);
+        assertEquals(new SalesRetentionService.Deleted(10L,0,0,7),service.deleteBatch(1L,10L));
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/statistics/SalesBucketPolicyTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/statistics/SalesBucketPolicyTest.java
new file mode 100644
index 000000000..51a8b6a9f
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/statistics/SalesBucketPolicyTest.java
@@ -0,0 +1,94 @@
+package com.baiyue.lastleg.selfoperated.analytics.statistics;
+
+import org.junit.jupiter.api.Test;
+import java.math.BigDecimal;
+import java.time.Instant;
+import java.time.LocalDate;
+import java.time.ZoneId;
+import java.util.List;
+import static org.junit.jupiter.api.Assertions.*;
+
+class SalesBucketPolicyTest {
+    private static final ZoneId ZONE = ZoneId.of("Asia/Shanghai");
+    private static final LocalDate DATE = LocalDate.of(2026, 10, 10);
+    private static final LocalDate ANCHOR = DATE.plusDays(2);
+    private static final Instant START = DATE.atStartOfDay(ZONE).toInstant();
+    private static final Instant END = DATE.plusDays(1).atStartOfDay(ZONE).toInstant();
+    @Test void actualCompleteDayNeedsNoThirtyDayObservation() {
+        var point = evaluate(DATE, START, END, null, new BigDecimal("2"), true, false, false);
+        assertEquals("COMPLETE", point.dataStatus());
+        assertEquals(new BigDecimal("2"), point.outboundQuantity());
+        assertEquals(START, point.provedFrom());
+        assertEquals(END, point.provedUntil());
+    }
+    @Test void emptyCompleteDayRequiresExistenceAtMidnightForReliableZero() {
+        var zero = evaluate(DATE, START, END, START, null, true, false, false);
+        assertEquals("COMPLETE", zero.dataStatus());
+        assertEquals(BigDecimal.ZERO, zero.outboundQuantity());
+        var partial = evaluate(DATE, START, END, START.plusSeconds(16 * 3600), null, true, false, false);
+        assertEquals("PARTIAL", partial.dataStatus());
+        assertNull(partial.outboundQuantity());
+        assertEquals(BigDecimal.ZERO, partial.observedQuantity());
+    }
+    @Test void firstCollectionMissingMidnightIsPartialEvenWithEarlierExistence() {
+        var point = evaluate(DATE, START.plusSeconds(3600), END, START.minusSeconds(1), null, true, false, false);
+        assertEquals("PARTIAL", point.dataStatus());
+        assertEquals(BigDecimal.ZERO, point.observedQuantity());
+        assertNull(point.outboundQuantity());
+        assertEquals(START.plusSeconds(3600), point.provedFrom());
+    }
+    @Test void laterEvidenceDoesNotCreateZeroBeyondCoveredWatermark() {
+        var point = evaluate(DATE, START, START.plusSeconds(8 * 3600), START.plusSeconds(16 * 3600), null, true, false, false);
+        assertEquals("UNKNOWN", point.dataStatus());
+        assertNull(point.observedQuantity());
+        var exactBoundary = evaluate(DATE, START, START.plusSeconds(8 * 3600), START.plusSeconds(8 * 3600), null, true, false, false);
+        assertEquals("UNKNOWN", exactBoundary.dataStatus());
+    }
+    @Test void actualRowOutsideContinuousCoverageStillShowsObservedFact() {
+        var point = evaluate(DATE, END, END.plusSeconds(3600), null, new BigDecimal("4"), true, true, true);
+        assertEquals("PARTIAL", point.dataStatus());
+        assertEquals(new BigDecimal("4"), point.observedQuantity());
+        assertNull(point.outboundQuantity());
+        assertNull(point.provedFrom());
+        assertTrue(point.reasonCodes().containsAll(List.of("SALES_REBUILD_REQUIRED", "SALES_STALE")));
+    }
+    @Test void missingEvidenceMissingCoverageAndUnknownUnitRemainUnknown() {
+        assertEquals("UNKNOWN", evaluate(DATE, START, END, null, null, true, false, false).dataStatus());
+        assertEquals("UNKNOWN", evaluate(DATE, null, null, START, null, true, false, false).dataStatus());
+        var unit = evaluate(DATE, START, END, START, BigDecimal.TEN, false, false, false);
+        assertNull(unit.observedQuantity());
+        assertTrue(unit.reasonCodes().contains("UNIT_UNKNOWN_OR_CONFLICT"));
+        var unavailableVersion = SalesBucketPolicy.evaluate(new SalesBucketPolicy.Input(DATE, ANCHOR, ZONE,
+                DATE, ANCHOR, START, END, START, BigDecimal.TEN, 1L, true, false, false, false));
+        assertEquals("UNKNOWN", unavailableVersion.dataStatus());
+        assertNull(unavailableVersion.observedQuantity());
+    }
+    @Test void todayNeverCompleteAndThreeDayAggregatePreservesCollectedFive() {
+        var first = evaluate(DATE, START, END, START, new BigDecimal("2"), true, false, false);
+        var second = evaluate(DATE.plusDays(1), START, END.plusSeconds(86400), START, null, true, false, false);
+        var today = evaluate(ANCHOR, START, END.plusSeconds(2 * 86400), START, new BigDecimal("3"), true, false, false);
+        assertEquals("PARTIAL", today.dataStatus());
+        assertTrue(today.reasonCodes().contains("TODAY_INCOMPLETE"));
+        var summary = SalesBucketPolicy.aggregate(List.of(first, second, today));
+        assertNull(summary.outboundQuantity());
+        assertEquals(new BigDecimal("5"), summary.observedQuantity());
+        assertEquals(2, summary.completeDays());
+        assertEquals(1, summary.partialDays());
+        assertEquals("PARTIAL", summary.dataStatus());
+    }
+    @Test void fullyUnknownAndEmptyRangesDoNotSumToZeroWhileCompleteZerosDo() {
+        var unknown = evaluate(DATE, null, null, null, null, true, false, false);
+        var summary = SalesBucketPolicy.aggregate(List.of(unknown));
+        assertEquals("UNKNOWN", summary.dataStatus());
+        assertNull(summary.observedQuantity());
+        assertNull(SalesBucketPolicy.aggregate(List.of()).observedQuantity());
+        var zero = evaluate(DATE, START, END, START, null, true, false, false);
+        assertEquals(BigDecimal.ZERO, SalesBucketPolicy.aggregate(List.of(zero)).outboundQuantity());
+    }
+    private SalesBucketPolicy.Point evaluate(LocalDate date, Instant from, Instant until, Instant evidence,
+                                            BigDecimal quantity, boolean unit, boolean rebuild, boolean stale) {
+        return SalesBucketPolicy.evaluate(new SalesBucketPolicy.Input(date, ANCHOR, ZONE, DATE,
+                ANCHOR.plusDays(1), from, until, evidence, quantity, quantity == null ? null : 1L,
+                unit, true, rebuild, stale));
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/statistics/SalesRangePolicyTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/statistics/SalesRangePolicyTest.java
new file mode 100644
index 000000000..86f5c2b29
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/statistics/SalesRangePolicyTest.java
@@ -0,0 +1,57 @@
+package com.baiyue.lastleg.selfoperated.analytics.statistics;
+
+import org.junit.jupiter.api.Test;
+import java.time.Instant;
+import java.time.LocalDate;
+import java.time.ZoneId;
+import static org.junit.jupiter.api.Assertions.*;
+
+class SalesRangePolicyTest {
+    private static final ZoneId ZONE = ZoneId.of("Asia/Shanghai");
+    private static final Instant AS_OF = Instant.parse("2026-10-12T02:00:00Z");
+    @Test void fiveNaturalPresetsKeepDailyPoints() {
+        String[] presets = {"TODAY", "LAST_3_DAYS", "THIS_WEEK", "LAST_15_DAYS", "THIS_MONTH"};
+        String[] starts = {"2026-10-12", "2026-10-10", "2026-10-12", "2026-09-28", "2026-10-01"};
+        int[] counts = {1, 3, 1, 15, 12};
+        for (int i = 0; i < presets.length; i++) {
+            var range = SalesRangePolicy.resolve(presets[i], null, null, "DAY", AS_OF, ZONE, 366);
+            assertEquals(LocalDate.parse(starts[i]), range.startDate());
+            assertEquals(counts[i], range.dayCount());
+            assertEquals(LocalDate.of(2026, 10, 13), range.endDateExclusive());
+            assertEquals(Instant.parse("2026-10-12T16:00:00Z"), range.endAtExclusive());
+        }
+    }
+    @Test void weekMayCrossYearAndAnchorUsesExplicitZone() {
+        var range = SalesRangePolicy.resolve("THIS_WEEK", null, null, "DAY",
+                Instant.parse("2025-12-31T17:00:00Z"), ZONE, 366);
+        assertEquals(LocalDate.of(2026, 1, 1), range.anchorDate());
+        assertEquals(LocalDate.of(2025, 12, 29), range.startDate());
+        assertEquals(4, range.dayCount());
+    }
+    @Test void customIncludesLeapDayAndHasHardMaximum() {
+        var asOf = Instant.parse("2024-12-31T04:00:00Z");
+        var range = SalesRangePolicy.resolve("CUSTOM", LocalDate.of(2024, 1, 1),
+                LocalDate.of(2024, 12, 31), "DAY", asOf, ZONE, 366);
+        assertEquals(366, range.dayCount());
+        assertThrows(IllegalArgumentException.class, () -> SalesRangePolicy.resolve("CUSTOM",
+                LocalDate.of(2023, 12, 31), LocalDate.of(2024, 12, 31), "DAY", asOf, ZONE, 366));
+    }
+    @Test void explicitTestZoneUsesCalendarDaysAcrossDaylightSavingChange() {
+        var range = SalesRangePolicy.resolve("TODAY", null, null, "DAY",
+                Instant.parse("2026-03-08T12:00:00Z"), ZoneId.of("America/New_York"), 366);
+        assertEquals(1, range.dayCount());
+        assertEquals(23 * 3600L, java.time.Duration.between(range.startAt(), range.endAtExclusive()).getSeconds());
+    }
+    @Test void conflictsUnknownEnumsFutureReversedAndMissingDatesAreRejected() {
+        assertThrows(IllegalArgumentException.class, () -> resolve("WEEK", null, null, "DAY"));
+        assertThrows(IllegalArgumentException.class, () -> resolve("TODAY", null, null, "WEEK"));
+        assertThrows(IllegalArgumentException.class, () -> resolve("TODAY", LocalDate.of(2026, 10, 1), null, "DAY"));
+        assertThrows(IllegalArgumentException.class, () -> resolve("CUSTOM", null, null, "DAY"));
+        assertThrows(IllegalArgumentException.class, () -> resolve("CUSTOM", LocalDate.of(2026, 10, 12), LocalDate.of(2026, 10, 13), "DAY"));
+        assertThrows(IllegalArgumentException.class, () -> resolve("CUSTOM", LocalDate.of(2026, 10, 12), LocalDate.of(2026, 10, 11), "DAY"));
+        assertThrows(IllegalArgumentException.class, () -> SalesRangePolicy.resolve("LAST_3_DAYS", null, null, "DAY", AS_OF, ZONE, 2));
+    }
+    private SalesRangePolicy.Range resolve(String preset, LocalDate start, LocalDate end, String bucket) {
+        return SalesRangePolicy.resolve(preset, start, end, bucket, AS_OF, ZONE, 366);
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/sync/InventoryFlowProbeServiceTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/sync/InventoryFlowProbeServiceTest.java
new file mode 100644
index 000000000..8b79f2b90
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/sync/InventoryFlowProbeServiceTest.java
@@ -0,0 +1,55 @@
+package com.baiyue.lastleg.selfoperated.analytics.sync;
+import org.junit.jupiter.api.Test;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import java.time.LocalDateTime;
+import static org.junit.jupiter.api.Assertions.*;
+import static org.mockito.Mockito.*;
+import static org.mockito.ArgumentMatchers.*;
+import com.baiyue.lastleg.selfoperated.analytics.model.*;
+import com.baiyue.lastleg.selfoperated.analytics.mapper.*;
+import com.baiyue.lastleg.selfoperated.analytics.client.RestLingxingAnalyticsClient;
+import org.springframework.transaction.support.TransactionTemplate;
+class InventoryFlowProbeServiceTest {
+ @Test void successfulProbeIsAuditedReplayedAndNeverPublished() throws Exception {
+  var cfg=new SelfopAnalyticsProperties();cfg.setEnvironment("test");cfg.setCollectionMode("BUSINESS");cfg.setSourceAccount("demo");
+  cfg.getWarehouses().put("W",new SelfopAnalyticsProperties.Warehouse());
+  var tasks=mock(SelfopSyncTaskMapper.class);var runs=mock(SelfopSyncRunMapper.class);var accounts=mock(SelfopOutboundDiscoveryScopeMapper.class);
+  var leases=mock(SelfopLeaseService.class);var client=mock(RestLingxingAnalyticsClient.class);var tx=mock(TransactionTemplate.class);
+  doAnswer(i->{((java.util.function.Consumer<org.springframework.transaction.TransactionStatus>)i.getArgument(0)).accept(null);return null;}).when(tx).executeWithoutResult(any());
+  var a=new SelfopOutboundDiscoveryScope();a.setId(1L);when(accounts.selectOne(any())).thenReturn(a);
+  var lease=new SelfopLeaseService.Lease(1L,"probe",2L,true);when(leases.acquireDiscovery(eq(1L),anyString())).thenReturn(lease);
+  var saved=new java.util.concurrent.atomic.AtomicReference<SelfopSyncTask>();
+  when(tasks.selectOne(any())).thenAnswer(i->saved.get());when(tasks.insert(any(SelfopSyncTask.class))).thenAnswer(i->{saved.set(i.getArgument(0));return 1;});
+  var page=new ObjectMapper().readTree("{\"current\":1,\"size\":1000,\"pages\":1,\"total\":1,\"records\":[{\"id\":\"1\"}]}");
+  when(client.inventoryFlow(any(),anyString(),anyString(),anyString(),any(),any())).thenReturn(page);
+  var s=new InventoryFlowProbeService(cfg,tasks,runs,accounts,leases,client,tx);
+  var end=LocalDateTime.of(2026,1,1,0,0);var q=new InventoryFlowProbeService.Request("one","W","C","S",end.minusDays(30),end);
+  var first=s.probe(q,"operator");assertTrue(first.complete());assertEquals(first,s.probe(q,"operator"));
+  assertEquals("SAMPLE_DONE",saved.get().getStatus());assertNull(saved.get().getResultPublishedRunId());
+  var capture=org.mockito.ArgumentCaptor.forClass(SelfopSyncRun.class);verify(runs).insert(capture.capture());
+  assertEquals("SAMPLE_DONE",capture.getValue().getStatus());assertNull(capture.getValue().getPublishedAtUtc());assertNull(capture.getValue().getInventoryDailySampleDate());
+  verify(client,times(1)).inventoryFlow(any(),anyString(),anyString(),anyString(),any(),any());verify(leases,times(2)).release(lease);
+  assertThrows(IllegalStateException.class,()->s.probe(new InventoryFlowProbeService.Request("one","W","C","OTHER",q.startTime(),q.endTime()),"operator"));
+  verify(client,times(1)).inventoryFlow(any(),anyString(),anyString(),anyString(),any(),any());
+  saved.set(null);when(client.inventoryFlow(any(),anyString(),anyString(),anyString(),any(),any())).thenThrow(new IllegalStateException("PROVIDER_FAILURE"));
+  assertThrows(IllegalStateException.class,()->s.probe(q,"operator"));assertEquals("DEAD",saved.get().getStatus());
+  assertThrows(IllegalStateException.class,()->s.probe(q,"operator"));
+  verify(client,times(2)).inventoryFlow(any(),anyString(),anyString(),anyString(),any(),any());
+ }
+ @Test void refusesFutureAndOversizedWindow() {
+  var now=LocalDateTime.of(2026,10,15,12,0);
+  InventoryFlowProbeService.validate(new InventoryFlowProbeService.Request("one","W","C","S",now.minusDays(30),now),now);
+  assertThrows(IllegalStateException.class,()->InventoryFlowProbeService.validate(new InventoryFlowProbeService.Request("one","W","C","S",now.minusDays(32),now),now));
+  assertThrows(IllegalStateException.class,()->InventoryFlowProbeService.validate(new InventoryFlowProbeService.Request("one","W","C","S",now,now.plusSeconds(1)),now));
+ }
+ @Test void refusesPartialPageAndDuplicateEvidence() throws Exception {
+  var mapper=new ObjectMapper();
+  assertTrue(InventoryFlowProbeService.validatePage(mapper.readTree("{\"current\":1,\"size\":1000,\"pages\":1,\"total\":1,\"records\":[{\"id\":\"1\"}]}")));
+  assertThrows(IllegalStateException.class,()->InventoryFlowProbeService.validatePage(mapper.readTree("{\"current\":1,\"size\":1000,\"pages\":1,\"total\":2,\"records\":[{\"id\":\"1\"}]}")));
+  assertThrows(IllegalStateException.class,()->InventoryFlowProbeService.validatePage(mapper.readTree("{\"current\":1,\"size\":1000,\"pages\":1,\"total\":2,\"records\":[{\"id\":\"1\"},{\"id\":\"1\"}]}")));
+  var root=mapper.createObjectNode().put("current",1).put("size",1000).put("pages",2).put("total",1001);
+  var rows=root.putArray("records");for(int i=0;i<1000;i++)rows.addObject().put("id",String.valueOf(i));
+  assertFalse(InventoryFlowProbeService.validatePage(root));
+ }
+}
+
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/sync/SelfopCommandServiceTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/sync/SelfopCommandServiceTest.java
new file mode 100644
index 000000000..e45cfa108
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/sync/SelfopCommandServiceTest.java
@@ -0,0 +1,194 @@
+package com.baiyue.lastleg.selfoperated.analytics.sync;
+
+import com.baiyue.lastleg.selfoperated.analytics.mapper.*;
+import com.baiyue.lastleg.selfoperated.analytics.model.*;
+import org.junit.jupiter.api.Test;
+import org.mockito.ArgumentCaptor;
+import java.time.LocalDateTime;
+import java.util.List;
+import java.util.Map;
+import static com.baiyue.lastleg.selfoperated.analytics.model.SelfopSupport.read;
+import static org.assertj.core.api.Assertions.*;
+import static org.mockito.Mockito.*;
+
+class SelfopCommandServiceTest {
+    private final SelfopTaskService taskService = mock(SelfopTaskService.class);
+    private final SelfopSyncScopeMapper scopes = mock(SelfopSyncScopeMapper.class);
+    private final SelfopOutboundDiscoveryScopeMapper accounts = mock(SelfopOutboundDiscoveryScopeMapper.class);
+    private final SelfopSyncTaskMapper tasks = mock(SelfopSyncTaskMapper.class);
+    private final SelfopAnalyticsProperties config = new SelfopAnalyticsProperties();
+    private final SelfopCommandService service = new SelfopCommandService(taskService, scopes, accounts, config, tasks);
+
+    private void configure() {
+        config.setCollectionMode("BUSINESS"); config.setEnvironment("production"); config.setSourceAccount("synthetic-account");
+        config.getWarehouses().put("WH-A", new SelfopAnalyticsProperties.Warehouse());
+    }
+
+    @Test void stoppedBusinessSessionKeepsItsCommittedTerminationAcrossCommandBoundary() throws Exception {
+        configure();var original=original("synthetic-account","WH-A");when(tasks.selectOne(any())).thenReturn(original);
+        var stopped=new SelfopTaskService.BusinessSessionStoppedException("BUSINESS_SESSION_DEADLINE");
+        when(taskService.retry(anyLong(),anyString(),anyString(),anyString())).thenThrow(stopped);
+        assertThatThrownBy(()->service.request(retry(),"42")).isSameAs(stopped);
+        var transaction=SelfopCommandService.class.getMethod("request",SelfopCommandService.Command.class,String.class)
+            .getAnnotation(org.springframework.transaction.annotation.Transactional.class);
+        assertThat(transaction.noRollbackFor()).contains(SelfopTaskService.BusinessSessionStoppedException.class);
+    }
+
+    @Test void retryCannotResumeTaskBelongingToAnotherWarehouse() {
+        configure();
+        var original = original("synthetic-account", "WH-B");
+        when(tasks.selectOne(any())).thenAnswer(call -> { com.baomidou.mybatisplus.core.conditions.query.QueryWrapper<SelfopSyncTask> q=call.getArgument(0); q.getSqlSegment(); return q.getParamNameValuePairs().containsValue(original.getSourceAccount())?original:null; });
+        assertThatThrownBy(() -> service.request(retry(), "42")).hasMessage("任务不存在或不属于当前账号和仓库");
+        verify(taskService, never()).retry(anyLong(), anyString(), anyString(), anyString());
+        verify(taskService, never()).create(any(SelfopSyncTask.class));
+        assertThat(original.getStatus()).isEqualTo("DEAD");
+    }
+
+    @Test void retryCannotResumeTaskBelongingToAnotherSourceAccount() {
+        configure();
+        var original = original("different-source-account", "WH-A");
+        when(tasks.selectOne(any())).thenAnswer(call -> { com.baomidou.mybatisplus.core.conditions.query.QueryWrapper<SelfopSyncTask> q=call.getArgument(0); q.getSqlSegment(); return q.getParamNameValuePairs().containsValue(original.getSourceAccount())?original:null; });
+        assertThatThrownBy(() -> service.request(retry(), "42")).hasMessage("任务不存在或不属于当前账号和仓库");
+        verify(taskService, never()).retry(anyLong(), anyString(), anyString(), anyString());
+        verify(taskService, never()).create(any(SelfopSyncTask.class));
+        assertThat(original.getStatus()).isEqualTo("DEAD");
+    }
+
+    @Test void unknownSourceTimezoneAllowsRawBackfillTaskWithoutClaimingUtcCoverage() {
+        configure();
+        var scope = new SelfopSyncScope(); scope.setId(10L); scope.setScopeHash("synthetic-scope-hash");
+        var account = new SelfopOutboundDiscoveryScope(); account.setId(20L);
+        when(scopes.selectOne(any())).thenReturn(scope);
+        when(accounts.selectOne(any())).thenReturn(account);
+        when(taskService.create(any(SelfopSyncTask.class))).thenAnswer(call -> call.getArgument(0));
+        var from = LocalDateTime.of(2026, 10, 11, 8, 0);
+        var until = from.plusHours(12);
+        var command = new SelfopCommandService.Command("raw-slice", "WH-A", "BACKFILL", null, from, until, null, null, "offline sample");
+        var task = service.request(command, "42");
+        assertThat(config.getSourceQueryTimezone()).isNull();
+        assertThat(config.isExecutionEnabled()).isTrue();
+        assertThat(task.getQueryFromUtc()).isNull();
+        assertThat(task.getQueryUntilUtc()).isNull();
+        assertThat(task.getTaskRole()).isEqualTo("ACCOUNT_DISCOVERY");
+        assertThat(task.getDiscoveryScopeId()).isEqualTo(20L);
+        var query = read(task.getQueryScopeJson(), SelfopDiscoveryService.Query.class);
+        assertThat(query.startTime()).isEqualTo(from.toString());
+        assertThat(query.endTime()).isEqualTo(until.toString());
+        var captured = ArgumentCaptor.forClass(SelfopSyncTask.class);
+        verify(taskService).create(captured.capture());
+        assertThat(captured.getValue()).isSameAs(task);
+        verifyNoInteractions(tasks);
+    }
+
+    private SelfopSyncTask original(String sourceAccount, String warehouse) {
+        var task = new SelfopSyncTask(); task.setExecutionPurpose("BUSINESS"); task.setTaskNo("LXCOL-20261012-00000001"); task.setId(100L); task.setSourceAccount(sourceAccount);
+        task.setWarehouseCode(warehouse); task.setTaskRole("WAREHOUSE_SYNC"); task.setStatus("DEAD");
+        return task;
+    }
+    @Test void offModeAndUnknownEnvironmentDoNotAcceptNewCollectionTask() {
+        configure();config.setCollectionMode("OFF");
+        assertThat(config.isExecutionEnabled()).isFalse();
+        var c=new SelfopCommandService.Command("disabled","WH-A","INVENTORY",null,null,null,null,null,"offline test");
+        assertThatThrownBy(()->service.request(c,"42")).hasMessage("采集功能未启用，当前环境不允许执行采集或重试");
+        assertThatThrownBy(()->service.request(retry(),"42")).hasMessage("采集功能未启用，当前环境不允许执行采集或重试");
+        config.setCollectionMode("BUSINESS");config.setEnvironment("development");
+        assertThat(config.isExecutionEnabled()).isFalse();
+        assertThatThrownBy(()->service.request(c,"42")).hasMessage("采集功能未启用，当前环境不允许执行采集或重试");
+        verifyNoInteractions(taskService,scopes,accounts,tasks);
+    }
+    @Test void testBusinessManualInventoryUsesWholeScopeAndBackfillKeepsOneDayBound() {
+        configure();config.setEnvironment("test");config.setSourceQueryTimezone("Asia/Shanghai");
+        var scope=new SelfopSyncScope();scope.setId(10L);scope.setScopeHash("scope");scope.setScopeJson("{\"qualities\":\"ALL\"}");
+        var account=new SelfopOutboundDiscoveryScope();account.setId(20L);
+        when(scopes.selectOne(any())).thenReturn(scope);when(accounts.selectOne(any())).thenReturn(account);
+        when(taskService.create(any(SelfopSyncTask.class))).thenAnswer(call->call.getArgument(0));
+        var inventory=service.request(new SelfopCommandService.Command("full-inventory","WH-A","INVENTORY",null,null,null,null,null,null),"42");
+        assertThat(config.isExecutionEnabled()).isTrue();assertThat(config.getEnvironment()).isEqualTo("test");
+        assertThat(inventory.getExecutionPurpose()).isEqualTo("BUSINESS");assertThat(inventory.getValidationRootTaskId()).isNull();
+        assertThat(inventory.getTaskRole()).isEqualTo("WAREHOUSE_SYNC");assertThat(inventory.getScopeId()).isEqualTo(10L);
+        assertThat(inventory.getQueryScopeJson()).isEqualTo(scope.getScopeJson());assertThat(inventory.getRequestKey()).isEqualTo("manual:full-inventory");
+        var from=LocalDateTime.of(2026,10,12,0,0);
+        var outbound=service.request(new SelfopCommandService.Command("one-day","WH-A","BACKFILL",null,from,from.plusDays(1),null,null,null),"42");
+        assertThat(outbound.getExecutionPurpose()).isEqualTo("BUSINESS");assertThat(outbound.getTaskRole()).isEqualTo("ACCOUNT_DISCOVERY");
+        assertThat(outbound.getQueryUntilUtc()).isEqualTo(outbound.getQueryFromUtc().plusDays(1));
+        clearInvocations(taskService);
+        assertThatThrownBy(()->service.request(new SelfopCommandService.Command("too-long","WH-A","BACKFILL",null,from,from.plusDays(1).plusSeconds(1),null,null,null),"42"))
+            .hasMessage("单次采集时间范围不能超过一天");
+        verify(taskService,never()).create(any(SelfopSyncTask.class));
+    }
+    @Test void testCannotUseRetryToReviveAutomaticScheduledWork() {
+        configure();config.setEnvironment("test");config.setContinuousBusinessCollectionEnabled(true);var original=original("synthetic-account","WH-A");
+        original.setTaskType("SCHEDULED");original.setRequestKey("slot:old");when(tasks.selectOne(any())).thenReturn(original);
+        assertThatThrownBy(()->service.request(retry(),"42")).hasMessage("测试环境仅允许重试当前已启用的受控采集任务");
+        verify(taskService,never()).retry(anyLong(),anyString(),anyString(),anyString());
+    }
+    @Test void enabledContinuousInventoryCanResumeItsOriginalScheduledIdentity() {
+        configure();config.setEnvironment("test");config.setContinuousBusinessCollectionEnabled(true);
+        var original=continuousInventory();when(tasks.selectOne(any())).thenReturn(original);
+        when(taskService.retry(anyLong(),anyString(),anyString(),anyString())).thenReturn(original);
+        assertThat(service.request(retry(),"42")).isSameAs(original);
+        verify(taskService).retry(eq(original.getId()),eq(retry().requestKey()),eq("42"),eq(retry().reason()));
+        verify(taskService,never()).create(any(SelfopSyncTask.class));
+        assertThat(original.getTaskType()).isEqualTo("SCHEDULED");
+        assertThat(original.getRequestedBy()).isEqualTo(SelfopCollectionPolicy.CONTINUOUS_PLANNER);
+        assertThat(original.getPlannedAtUtc()).isEqualTo(LocalDateTime.of(2026,10,14,0,0));
+    }
+    @Test void continuousRetryStillRejectsDisabledModeAndForgedPlannerIdentity() {
+        configure();config.setEnvironment("test");var original=continuousInventory();
+        when(tasks.selectOne(any())).thenReturn(original);
+        assertThatThrownBy(()->service.request(retry(),"42")).hasMessage("测试环境仅允许重试当前已启用的受控采集任务");
+        config.setContinuousBusinessCollectionEnabled(true);original.setRequestedBy("42");
+        assertThatThrownBy(()->service.request(retry(),"42")).hasMessage("测试环境仅允许重试当前已启用的受控采集任务");
+        verify(taskService,never()).retry(anyLong(),anyString(),anyString(),anyString());
+    }
+    private SelfopSyncTask continuousInventory() {
+        var task=original("synthetic-account","WH-A");task.setScopeId(10L);task.setScopeHash("a".repeat(64));
+        task.setTaskType("SCHEDULED");task.setPlannedAtUtc(LocalDateTime.of(2026,10,14,0,0));
+        task.setRequestedBy(SelfopCollectionPolicy.CONTINUOUS_PLANNER);task.setBusinessRootTaskId(task.getId());
+        task.setRequestKey("continuous:inventory:WH-A:"+task.getPlannedAtUtc()+":"+task.getScopeHash().substring(0,12));
+        task.setQueryScopeJson(com.baiyue.lastleg.selfoperated.analytics.model.SelfopSupport.json(Map.of(
+            "sourceAccount","synthetic-account","warehouseCode","WH-A","dataFamily","INVENTORY","businessTimezone","Asia/Shanghai")));
+        return task;
+    }
+    @Test void validationModeRejectsFormalInventoryEntry() {
+        configure();config.setCollectionMode("VALIDATION");
+        var c=new SelfopCommandService.Command("wrong-purpose","WH-A","INVENTORY",null,null,null,null,null,"offline test");
+        assertThatThrownBy(()->service.request(c,"42")).hasMessage("当前采集模式与所选操作不一致，请使用对应入口");
+        verify(taskService,never()).create(any(SelfopSyncTask.class));
+    }
+    @Test void warehouseDiscoveryCreatesAccountRootWithoutAnyWarehouseOrTimeWindow() {
+        config.setCollectionMode("VALIDATION");config.setSourceAccount("synthetic-account");
+        var account=new SelfopOutboundDiscoveryScope();account.setId(20L);
+        when(taskService.initializeAccount()).thenReturn(account);
+        when(taskService.create(any(SelfopSyncTask.class))).thenAnswer(call->call.getArgument(0));
+        var task=service.request(new SelfopCommandService.Command("directory",null,"WAREHOUSE_DISCOVERY",null,null,null,null,null,null),"42");
+        assertThat(task.getTaskRole()).isEqualTo("ACCOUNT_DISCOVERY");assertThat(task.getTaskType()).isEqualTo("VALIDATION");
+        assertThat(task.getExecutionPurpose()).isEqualTo("VALIDATION");assertThat(task.getDiscoveryScopeId()).isEqualTo(20L);
+        assertThat(task.getWarehouseCode()).isNull();assertThat(task.getScopeId()).isNull();assertThat(task.getRequestedBy()).isEqualTo("42");
+        assertThat(read(task.getQueryScopeJson(),Map.class)).containsEntry("action","WAREHOUSE_DISCOVERY").doesNotContainKeys("warehouses","startTime","endTime");
+        assertThat(task.getScopeHash()).matches("[a-f0-9]{64}");
+        verify(taskService,never()).initialize();verifyNoInteractions(scopes,accounts,tasks);
+    }
+    @Test void directoryDiscoveryRejectsBusinessModeAndAnySuppliedWarehouseBeforeInitializing() {
+        configure();
+        var c=new SelfopCommandService.Command("directory",null,"WAREHOUSE_DISCOVERY",null,null,null,null,null,null);
+        assertThatThrownBy(()->service.request(c,"42")).hasMessage("当前采集模式与所选操作不一致，请使用对应入口");
+        config.setCollectionMode("VALIDATION");
+        assertThatThrownBy(()->service.request(new SelfopCommandService.Command("directory","WH-A","WAREHOUSE_DISCOVERY",null,null,null,null,null,null),"42"))
+            .hasMessage("仓库目录发现仅接受请求标识和操作类型，不接受仓库或采集范围");
+        verifyNoInteractions(taskService,scopes,accounts,tasks);
+    }
+    @Test void ordinaryValidationFreezesOnlySelectedWarehouseDespiteOtherConfiguredWarehouse() {
+        configure();config.setCollectionMode("VALIDATION");config.getWarehouses().put("WH-B",new SelfopAnalyticsProperties.Warehouse());
+        var scope=new SelfopSyncScope();scope.setId(10L);scope.setScopeHash("scope");
+        var account=new SelfopOutboundDiscoveryScope();account.setId(20L);
+        when(scopes.selectOne(any())).thenReturn(scope);when(accounts.selectOne(any())).thenReturn(account);
+        when(taskService.create(any(SelfopSyncTask.class))).thenAnswer(call->call.getArgument(0));
+        var from=LocalDateTime.of(2026,10,12,8,0);
+        var task=service.request(new SelfopCommandService.Command("sample-a","WH-A","VALIDATION",null,from,from.plusMinutes(5),null,null,null),"42");
+        assertThat(read(task.getQueryScopeJson(),Map.class)).containsEntry("action","VALIDATION").containsEntry("warehouses",List.of("WH-A"));
+    }
+    private SelfopCommandService.Command retry() {
+        return new SelfopCommandService.Command("retry-key", "WH-A", "RETRY", "LXCOL-20261012-00000001", null, null, null, null, "offline retry");
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/sync/SelfopContinuousDueSqlTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/sync/SelfopContinuousDueSqlTest.java
new file mode 100644
index 000000000..58e41ae3c
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/sync/SelfopContinuousDueSqlTest.java
@@ -0,0 +1,82 @@
+package com.baiyue.lastleg.selfoperated.analytics.sync;
+
+import com.baiyue.lastleg.selfoperated.analytics.mapper.SelfopCoordinationMapper;
+import org.apache.ibatis.mapping.MappedStatement;
+import org.apache.ibatis.scripting.defaults.DefaultParameterHandler;
+import org.apache.ibatis.session.Configuration;
+import org.junit.jupiter.api.*;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.ValueSource;
+import java.sql.*;
+import java.time.LocalDateTime;
+import java.util.*;
+import static org.junit.jupiter.api.Assertions.*;
+
+/** Executes the production scheduling predicates offline; only date arithmetic syntax is adapted to H2. */
+class SelfopContinuousDueSqlTest {
+    private Connection db;
+    private MappedStatement statement;
+    private static final LocalDateTime MIDNIGHT = LocalDateTime.of(2026,10,14,16,0);
+
+    @BeforeEach void setup() throws Exception {
+        db=DriverManager.getConnection("jdbc:h2:mem:"+UUID.randomUUID()+";MODE=MySQL;DATABASE_TO_LOWER=TRUE","sa","");
+        execute("CREATE TABLE ll_selfop_sync_task(id BIGINT PRIMARY KEY,business_root_task_id BIGINT,source_account VARCHAR,execution_purpose VARCHAR,validation_root_task_id BIGINT,status VARCHAR,request_key VARCHAR,requested_by VARCHAR,task_role VARCHAR,task_type VARCHAR,next_retry_at_utc TIMESTAMP,planned_at_utc TIMESTAMP,query_until_utc TIMESTAMP,attempt_count INT)");
+        var config=new Configuration();config.addMapper(SelfopCoordinationMapper.class);
+        statement=config.getMappedStatement(SelfopCoordinationMapper.class.getName()+".dueContinuous");
+    }
+    @AfterEach void close() throws Exception {db.close();}
+    private void execute(String sql,Object...args) throws Exception {
+        try(var p=db.prepareStatement(sql)){for(int n=0;n<args.length;n++)p.setObject(n+1,args[n]);p.executeUpdate();}
+    }
+    private void inventory(long id,String status,int attempts,LocalDateTime planned,LocalDateTime retry) throws Exception {
+        execute("INSERT INTO ll_selfop_sync_task VALUES (?,?,'SYNTH-ACCOUNT','BUSINESS',NULL,?,?,'SELFOP_CONTINUOUS_PLANNER','WAREHOUSE_SYNC','SCHEDULED',?,?,NULL,?)",
+            id,id,status,"continuous:inventory:SYNTH-WH:"+planned,retry,planned,attempts);
+    }
+    private List<Long> due(LocalDateTime now) throws Exception {
+        var params=Map.of("now",now,"limit",20,"account","SYNTH-ACCOUNT");
+        var bound=statement.getBoundSql(params);
+        String sql=bound.getSql()
+            .replace("DATE_ADD(r.planned_at_utc,INTERVAL 8 HOUR)","DATEADD(HOUR,8,r.planned_at_utc)")
+            .replace("DATE_ADD(?,INTERVAL 8 HOUR)","DATEADD(HOUR,8,CAST(? AS TIMESTAMP))")
+            .replace("DATE_SUB(DATE(DATEADD(HOUR,8,CAST(? AS TIMESTAMP))),INTERVAL 8 HOUR)","DATEADD(HOUR,-8,DATE(DATEADD(HOUR,8,CAST(? AS TIMESTAMP))))");
+        try(var p=db.prepareStatement(sql)){
+            new DefaultParameterHandler(statement,params,bound).setParameters(p);
+            try(var rows=p.executeQuery()){var result=new ArrayList<Long>();while(rows.next())result.add(rows.getLong("id"));return result;}
+        }
+    }
+    @Test void masterCatalogIsDispatchableAfterInventoryAndHistoricalSales() throws Exception {
+        inventory(2,"READY",0,MIDNIGHT,null);
+        execute("INSERT INTO ll_selfop_sync_task VALUES(1,1,'SYNTH-ACCOUNT','BUSINESS',NULL,'READY','continuous:master:day','SELFOP_CONTINUOUS_PLANNER','ACCOUNT_DISCOVERY','MASTER_DATA',NULL,?,NULL,0)",MIDNIGHT.minusDays(1));
+        execute("INSERT INTO ll_selfop_sync_task VALUES(3,3,'SYNTH-ACCOUNT','BUSINESS',NULL,'READY','continuous:outbound:day','SELFOP_CONTINUOUS_PLANNER','ACCOUNT_DISCOVERY','BACKFILL',NULL,NULL,?,0)",MIDNIGHT.minusDays(10));
+        assertEquals(List.of(2L,3L,1L),due(MIDNIGHT));
+    }
+    @Test void retryAfterBeijingMidnightWaitsUntilBackoffThenRemainsDispatchable() throws Exception {
+        // Failure at 23:59:55 + the first 10-second backoff lands on the next Beijing day.
+        inventory(1,"RETRY_WAIT",1,MIDNIGHT.minusHours(16),MIDNIGHT.plusSeconds(5));
+        assertEquals(List.of(),due(MIDNIGHT.minusSeconds(5)));
+        assertEquals(List.of(),due(MIDNIGHT));
+        assertEquals(List.of(1L),due(MIDNIGHT.plusSeconds(5)));
+        assertEquals(List.of(1L),due(MIDNIGHT.plusDays(1)));
+    }
+    @ParameterizedTest @ValueSource(strings={"READY","RETRY_WAIT","RUNNING"})
+    void startedInventoryCanResumeAfterRestartAcrossMidnight(String status) throws Exception {
+        inventory(1,status,1,MIDNIGHT.minusHours(16),MIDNIGHT.minusSeconds(1));
+        assertEquals(List.of(1L),due(MIDNIGHT));
+    }
+    @Test void oldUnstartedSlotsAndTerminalOrUnauthorizedWorkRemainExcluded() throws Exception {
+        var yesterday=MIDNIGHT.minusHours(16);var today=MIDNIGHT.plusHours(8);
+        inventory(1,"READY",0,yesterday,null);
+        inventory(2,"DEAD",3,yesterday,null);
+        inventory(3,"SUCCEEDED",1,yesterday,null);
+        inventory(4,"READY",0,today,today);
+        inventory(5,"RETRY_WAIT",1,yesterday,null);
+        execute("UPDATE ll_selfop_sync_task SET source_account='OTHER-ACCOUNT' WHERE id=5");
+        inventory(6,"RETRY_WAIT",1,yesterday,null);
+        execute("UPDATE ll_selfop_sync_task SET execution_purpose='VALIDATION',validation_root_task_id=id WHERE id=6");
+        inventory(7,"RETRY_WAIT",1,yesterday,null);
+        execute("UPDATE ll_selfop_sync_task SET requested_by='untrusted' WHERE id=7");
+        inventory(8,"RETRY_WAIT",1,today.plusDays(1),null);
+        assertEquals(List.of(),due(MIDNIGHT));
+        assertEquals(List.of(4L),due(today));
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/sync/SelfopDiscoveryServiceTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/sync/SelfopDiscoveryServiceTest.java
new file mode 100644
index 000000000..6d3737077
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/sync/SelfopDiscoveryServiceTest.java
@@ -0,0 +1,435 @@
+package com.baiyue.lastleg.selfoperated.analytics.sync;
+
+import com.baiyue.lastleg.selfoperated.analytics.client.LingxingAnalyticsClient;
+import com.baiyue.lastleg.selfoperated.analytics.client.AnalyticsClientException;
+import com.baiyue.lastleg.selfoperated.analytics.mapper.*;
+import com.baiyue.lastleg.selfoperated.analytics.model.*;
+import com.baomidou.mybatisplus.core.conditions.query.QueryWrapper;
+import java.math.BigDecimal;
+import java.time.LocalDateTime;
+import java.util.*;
+import java.util.function.Consumer;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.springframework.transaction.TransactionStatus;
+import org.springframework.transaction.support.TransactionTemplate;
+import static com.baiyue.lastleg.selfoperated.analytics.model.SelfopSupport.*;
+import static org.junit.jupiter.api.Assertions.*;
+import static org.mockito.ArgumentMatchers.*;
+import static org.mockito.Mockito.*;
+
+class SelfopDiscoveryServiceTest {
+    private final LingxingAnalyticsClient client = mock(LingxingAnalyticsClient.class);
+    private final SelfopSyncTaskMapper tasks = mock(SelfopSyncTaskMapper.class);
+    private final SelfopSyncRunMapper runs = mock(SelfopSyncRunMapper.class);
+    private final SelfopSyncStageMapper stages = mock(SelfopSyncStageMapper.class);
+    private final SelfopOutboundOrderMapper orders = mock(SelfopOutboundOrderMapper.class);
+    private final SelfopSyncScopeMapper scopes = mock(SelfopSyncScopeMapper.class);
+    private final SelfopOutboundDiscoveryScopeMapper accounts = mock(SelfopOutboundDiscoveryScopeMapper.class);
+    private final SelfopTaskService taskService = mock(SelfopTaskService.class);
+    private final SelfopLeaseService leases = mock(SelfopLeaseService.class);
+    private final SelfopAnalyticsProperties config = new SelfopAnalyticsProperties();
+    private final TransactionTemplate tx = mock(TransactionTemplate.class);
+    private final SelfopLeaseService.Lease lease = new SelfopLeaseService.Lease(30L, "account-worker", 4L, true);
+    private final Map<Long, SelfopSyncStage> stored = new LinkedHashMap<>();
+    private final Map<String, SelfopSyncTask> children = new LinkedHashMap<>();
+    private final LocalDateTime from = LocalDateTime.of(2026, 10, 11, 0, 0);
+    private final LocalDateTime until = from.plusDays(1);
+    private SelfopDiscoveryService service;
+    private SelfopSyncTask task;
+    private SelfopSyncRun run;
+    private SelfopSyncScope scope;
+    private SelfopOutboundDiscoveryScope account;
+
+    @BeforeEach void prepare() {
+        when(taskService.checkpoint(any(SelfopSyncTask.class),any(SelfopSyncRun.class),any())).thenAnswer(inv ->
+            new SelfopTaskService.CollectionCheckpoint(inv.getArgument(0),inv.getArgument(1)));
+
+        doAnswer(inv -> { Consumer<TransactionStatus> cb = inv.getArgument(0); cb.accept(mock(TransactionStatus.class)); return null; })
+            .when(tx).executeWithoutResult(any());
+        account = new SelfopOutboundDiscoveryScope(); account.setId(30L); account.setRequestBudget(10); account.setTimeBudgetSeconds(60);
+        when(accounts.selectById(30L)).thenReturn(account);when(accounts.selectOne(any())).thenReturn(account);
+        task = new SelfopSyncTask(); task.setExecutionPurpose("BUSINESS"); task.setTaskNo("LXCOL-20261012-00000001"); task.setId(1L); task.setSourceAccount("demo"); task.setDiscoveryScopeId(30L);
+        task.setDiscoverySequence(17L); task.setObservationBaseline(90L); task.setTaskType("SCHEDULED"); task.setScopeHash("account-hash");
+        task.setQueryFromUtc(from); task.setQueryUntilUtc(until); task.setStatus("RUNNING");
+        task.setQueryScopeJson(json(new SelfopDiscoveryService.Query(from.toString(), until.toString(), null, null, null)));
+        run = new SelfopSyncRun(); run.setExecutionPurpose("BUSINESS"); run.setAttemptNo(1); run.setTaskId(task.getId()); run.setSourceAccount("demo"); run.setFenceToken(lease.fence()); run.setId(20L); run.setStatus("FETCHING");
+        scope = new SelfopSyncScope(); scope.setId(10L); scope.setSourceAccount("demo"); scope.setWarehouseCode("A");
+        scope.setDataFamily("OUTBOUND"); scope.setScopeHash("warehouse-hash"); scope.setScopeJson("{}"); scope.setSourceTimezone("UTC");
+        config.setCollectionMode("BUSINESS"); config.setEnvironment("production"); config.setPageSize(2); config.setSourceQueryTimezone("UTC"); config.setQuantityUnit("PCS");
+        config.getWarehouses().put("A", new SelfopAnalyticsProperties.Warehouse());
+        when(scopes.selectList(any())).thenReturn(List.of(scope));
+        when(leases.nextObservation(lease)).thenReturn(101L, 102L, 103L);
+        when(taskService.create(any(SelfopSyncTask.class))).thenAnswer(inv -> {
+            SelfopSyncTask child = inv.getArgument(0);
+            child.setId(100L + children.size());
+            return children.computeIfAbsent(child.getRequestKey(), ignored -> child);
+        });
+        doAnswer(inv -> { SelfopSyncStage stage = inv.getArgument(0); stored.put(stage.getId(), stage); return 1; })
+            .when(stages).insert(any(SelfopSyncStage.class));
+        doAnswer(inv -> { SelfopSyncStage stage = inv.getArgument(0); stored.put(stage.getId(), stage); return 1; })
+            .when(stages).updateById(any(SelfopSyncStage.class));
+        when(stages.selectById(anyLong())).thenAnswer(inv -> stored.get((Long) inv.getArgument(0)));
+        when(stages.selectOne(any())).thenAnswer(inv -> {
+            QueryWrapper<SelfopSyncStage> query = inv.getArgument(0); String sql = query.getSqlSegment();
+            if (sql.contains("observation_sequence")) return null;
+            var values = query.getParamNameValuePairs().values();
+            return stored.values().stream().filter(s -> values.contains(s.getStageBatchId()) && values.contains(s.getObjectKeyHash())).findFirst().orElse(null);
+        });
+        when(client.detail(any(SelfopRequestContext.class), eq("A"), eq("customer"), anyString())).thenAnswer(inv -> detail(inv.getArgument(3), "2026-10-11 12:00:00"));
+        service = new SelfopDiscoveryService(client, tasks, runs, stages, orders, scopes, accounts, taskService, leases, config, tx);
+    }
+    @Test void lateDirectoryResponseCannotPersistManifestOrStagesAfterSessionStops() {
+        when(client.discover(any(SelfopRequestContext.class),eq(from),eq(until),eq(1),eq(2)))
+            .thenReturn(page(1,2,1,1,summary("late","2026-10-11 12:00:00")));
+        when(taskService.checkpoint(task,run,lease)).thenThrow(new SelfopTaskService.BusinessSessionStoppedException("BUSINESS_SESSION_DEADLINE"));
+        assertThrows(SelfopTaskService.BusinessSessionStoppedException.class,()->service.collect(task,run,lease));
+        assertTrue(stored.isEmpty());verify(tasks,never()).updateById(any(SelfopSyncTask.class));verify(runs,never()).updateById(any(SelfopSyncRun.class));
+    }
+    @Test void lateDetailCannotPromotePendingStageOrRouteWarehouseReady() {
+        when(client.discover(any(SelfopRequestContext.class),eq(from),eq(until),eq(1),eq(2)))
+            .thenReturn(page(1,2,1,1,summary("late","2026-10-11 12:00:00")));
+        boolean[] stopped={false};
+        when(client.detail(any(SelfopRequestContext.class),eq("A"),eq("customer"),eq("late"))).thenAnswer(inv->{stopped[0]=true;return detail("late","2026-10-11 12:00:00");});
+        when(taskService.checkpoint(task,run,lease)).thenAnswer(inv->{
+            if(stopped[0])throw new SelfopTaskService.BusinessSessionStoppedException("BUSINESS_SESSION_DEADLINE");
+            return new SelfopTaskService.CollectionCheckpoint(task,run);
+        });
+        assertThrows(SelfopTaskService.BusinessSessionStoppedException.class,()->service.collect(task,run,lease));
+        assertTrue(stored.values().stream().allMatch(row->"PENDING".equals(row.getValidationStatus())));
+        assertTrue(children.values().stream().allMatch(row->"WAITING_SOURCE".equals(row.getStatus())));
+        assertEquals("FETCHING",run.getStatus());assertEquals("RUNNING",task.getStatus());
+    }
+
+    private LingxingAnalyticsClient.Summary summary(String no, String time) {
+        return new LingxingAnalyticsClient.Summary("demo", "customer", "A", no, null, 100, null, time, null);
+    }
+    private SelfopPayloads.Order detail(String no, String time) {
+        return new SelfopPayloads.Order("demo", "customer", "A", no, null, 100, null, time,
+            List.of(new SelfopPayloads.Item("sku", null, BigDecimal.ONE, "PCS")));
+    }
+    private LingxingAnalyticsClient.Page<LingxingAnalyticsClient.Summary> page(int current, int size, long total, int pages,
+            LingxingAnalyticsClient.Summary... rows) { return new LingxingAnalyticsClient.Page<>(List.of(rows), current, size, total, pages); }
+    private void directoryTwoOrders() {
+        when(client.discover(any(SelfopRequestContext.class), eq(from), eq(until), eq(1), eq(2))).thenReturn(page(1, 2, 2, 1,
+            summary("one", "2026-10-11 12:00:00"), summary("two", "2026-10-11 12:00:00")));
+    }
+
+    @Test void removedWarehouseScopeDoesNotReceiveRoutedTask() {
+        var removed = new SelfopSyncScope(); removed.setId(11L); removed.setSourceAccount("demo");
+        removed.setWarehouseCode("REMOVED"); removed.setDataFamily("OUTBOUND");
+        removed.setScopeHash("old-hash"); removed.setScopeJson("{}"); removed.setSourceTimezone("UTC");
+        when(scopes.selectList(any())).thenReturn(List.of(scope, removed));
+        directoryTwoOrders(); service.collect(task, run, lease);
+        assertEquals(1, children.size());
+        assertTrue(children.values().stream().allMatch(child -> "A".equals(child.getWarehouseCode())));
+        assertEquals("ROUTED", run.getStatus());
+    }
+
+    @Test void paginatedLocateYieldsDurableCursorThenResumesWithoutFiniteFailure() {
+        config.setPageSize(1); account.setRequestBudget(1);
+        task.setQueryScopeJson(json(new SelfopDiscoveryService.Query(null, null, "target", "customer", null)));
+        when(client.locate(any(SelfopRequestContext.class), eq("target"), eq(1), eq(1))).thenReturn(page(1, 1, 2, 2, summary("target", "2026-10-11 12:00:00")));
+        when(client.locate(any(SelfopRequestContext.class), eq("target"), eq(2), eq(1))).thenReturn(page(2, 1, 2, 2, summary("other", "2026-10-11 12:00:00")));
+        service.collect(task, run, lease);
+        var saved = read(task.getRoutingManifestJson(), SelfopRoutingManifest.class);
+        assertEquals(2, saved.getNextPage()); assertEquals(1, saved.getObjects().size()); assertFalse(saved.isDirectoryComplete());
+        verify(taskService).yield(1L, 20L, lease); verify(client, never()).detail(any(SelfopRequestContext.class), anyString(), anyString(), anyString());
+        account.setRequestBudget(10); service.collect(task, run, lease);
+        verify(client, times(1)).locate(any(SelfopRequestContext.class), eq("target"), eq(1), eq(1)); verify(client, times(1)).locate(any(SelfopRequestContext.class), eq("target"), eq(2), eq(1));
+        assertEquals("ROUTED", run.getStatus());
+        verify(taskService, never()).fail(anyLong(), anyLong(), any(SelfopFailure.class), any());
+    }
+    @Test void stableDirectoryScansYieldAndResumeBeforeDetailsWithoutRepeatingFirstScan() {
+        directoryTwoOrders(); account.setRequestBudget(1);
+        service.collect(task, run, lease);
+        var cursor = read(task.getRoutingManifestJson(), SelfopRoutingManifest.class);
+        assertEquals(2, cursor.getScan()); assertEquals(1, cursor.getNextPage()); assertEquals(2, cursor.getFirstScan().size());
+        assertEquals(2, stored.size()); assertTrue(children.isEmpty());
+        account.setRequestBudget(10); service.collect(task, run, lease);
+        verify(client, times(2)).discover(any(SelfopRequestContext.class), eq(from), eq(until), eq(1), eq(2));
+        verify(client, times(2)).detail(any(SelfopRequestContext.class), eq("A"), eq("customer"), anyString());
+        assertEquals(2, stored.size()); assertTrue(stored.values().stream().allMatch(s -> "VALID".equals(s.getValidationStatus())));
+        assertEquals("ROUTED", run.getStatus()); assertEquals(2L, run.getUniqueObjectCount());
+    }
+    @Test void emptyWarehouseWaitsForAllAccountDetailsAcrossBudgetYieldAndReceivesRelocatedOrder() {
+        var destination=new SelfopSyncScope();destination.setId(11L);destination.setSourceAccount("demo");destination.setWarehouseCode("B");
+        destination.setDataFamily("OUTBOUND");destination.setScopeHash("warehouse-b-hash");destination.setScopeJson("{}");destination.setSourceTimezone("UTC");
+        config.getWarehouses().put("B",new SelfopAnalyticsProperties.Warehouse());when(scopes.selectList(any())).thenReturn(List.of(scope,destination));
+        directoryTwoOrders();account.setRequestBudget(3); // Two stable directory scans and only the first detail.
+        var previous=new SelfopOutboundOrder();previous.setWarehouseCode("A");
+        when(orders.selectOne(any())).thenAnswer(inv->{QueryWrapper<SelfopOutboundOrder> query=inv.getArgument(0);query.getSqlSegment();
+            return query.getParamNameValuePairs().values().contains("two")?previous:null;});
+        when(client.detail(any(SelfopRequestContext.class),eq("A"),eq("customer"),eq("two"))).thenReturn(new SelfopPayloads.Order("demo","customer","B","two",null,
+            100,null,"2026-10-11 12:00:00",List.of(new SelfopPayloads.Item("sku",null,BigDecimal.ONE,"PCS"))));
+        List<String> readiness=new ArrayList<>();doAnswer(inv->{SelfopSyncTask child=inv.getArgument(0);if("WAREHOUSE_SYNC".equals(child.getTaskRole()))readiness.add(child.getWarehouseCode()+":"+child.getStatus());return 1;}).when(tasks).updateById(any(SelfopSyncTask.class));
+
+        service.collect(task,run,lease);
+        var warehouseA=children.get("route:1:A");var warehouseB=children.get("route:1:B");
+        assertEquals("WAITING_SOURCE",warehouseA.getStatus());assertEquals("WAITING_SOURCE",warehouseB.getStatus());
+        assertEquals(false,read(warehouseA.getProgressJson(),Map.class).get("localWorkReady"));
+        assertEquals(false,read(warehouseB.getProgressJson(),Map.class).get("localWorkReady"));
+        assertTrue(read(warehouseB.getRoutingManifestJson(),SelfopRoutingManifest.class).getObjects().isEmpty());
+        var partial=read(task.getRoutingManifestJson(),SelfopRoutingManifest.class);
+        assertTrue(partial.isDirectoryComplete());assertEquals(1,partial.getObjects().values().stream().filter(e->e.getEffectiveStageId()!=null).count());
+        assertTrue(readiness.stream().noneMatch(value->value.endsWith(":READY")));verify(taskService).yield(1L,20L,lease);
+        verify(client,never()).detail(any(SelfopRequestContext.class),eq("A"),eq("customer"),eq("two"));
+
+        account.setRequestBudget(10);service.collect(task,run,lease);
+        assertEquals("READY",warehouseA.getStatus());assertEquals("READY",warehouseB.getStatus());
+        for(var child:List.of(warehouseA,warehouseB)){
+            var proof=read(child.getProgressJson(),Map.class);assertEquals(true,proof.get("localWorkReady"));
+            assertEquals(child.getScopeHash(),proof.get("localWorkReadyScopeHash"));
+            assertEquals(task.getId().toString(),proof.get("localWorkReadyUpstreamTaskId"));
+        }
+        var destinationManifest=read(warehouseB.getRoutingManifestJson(),SelfopRoutingManifest.class);
+        String movedKey=hash(List.of("demo","customer","two"));assertEquals(Set.of(movedKey),destinationManifest.getObjects().keySet());
+        var moved=destinationManifest.getObjects().get(movedKey);assertNotNull(moved.getEffectiveStageId());assertEquals("B",moved.getWarehouseCode());
+        assertEquals("B",read(stored.get(moved.getEffectiveStageId()).getPayloadJson(),SelfopPayloads.Order.class).warehouseCode());
+        assertTrue(read(warehouseA.getRoutingManifestJson(),SelfopRoutingManifest.class).getObjects().containsKey(movedKey),"Original warehouse must retain the known-order correction reference");
+        assertEquals("ROUTED",run.getStatus());verify(client,times(2)).discover(any(SelfopRequestContext.class),eq(from),eq(until),eq(1),eq(2));
+        verify(client,times(1)).detail(any(SelfopRequestContext.class),eq("A"),eq("customer"),eq("one"));
+        verify(client,times(1)).detail(any(SelfopRequestContext.class),eq("A"),eq("customer"),eq("two"));
+    }
+    @Test void eachActualDetailGetsIndependentObservationNotTaskSequence() {
+        directoryTwoOrders(); service.collect(task, run, lease);
+        assertEquals(Set.of(101L, 102L), new HashSet<>(stored.values().stream().map(SelfopSyncStage::getObservationSequence).toList()));
+        assertTrue(stored.values().stream().allMatch(s -> s.getStageBatchId().equals(1L) && !s.getObservationSequence().equals(task.getDiscoverySequence())));
+        verify(leases, times(2)).nextObservation(lease);
+        assertEquals(17L, children.values().iterator().next().getDiscoverySequence());
+        var contexts=org.mockito.ArgumentCaptor.forClass(SelfopRequestContext.class);
+        verify(client,times(2)).detail(contexts.capture(),eq("A"),eq("customer"),anyString());
+        assertTrue(contexts.getAllValues().stream().allMatch(c->"demo".equals(c.sourceAccount())&&"BUSINESS".equals(c.executionPurpose())
+            &&Objects.equals(c.taskId(),1L)&&Objects.equals(c.runId(),20L)));
+    }
+    @Test void unknownWarehouseSourceTimezoneKeepsChildWaitingAndNoSalesCoverage() {
+        directoryTwoOrders(); scope.setSourceTimezone(null); service.collect(task, run, lease);
+        var child = children.values().iterator().next(); assertEquals("WAITING_SOURCE", child.getStatus());
+        assertEquals(2L, read(child.getRoutingManifestJson(), SelfopRoutingManifest.class).getTotal());
+        assertNull(scope.getDiscoveryFromUtc()); assertNull(scope.getDiscoveryUntilUtc());
+        assertNull(scope.getPublishedRunId()); verify(taskService, never()).begin(anyLong(), any());
+    }
+    @Test void knownExclusiveEndpointRemainsAccountEvidenceButLeavesWarehouseSlice() {
+        when(client.discover(any(SelfopRequestContext.class), eq(from), eq(until), eq(1), eq(2))).thenReturn(page(1, 2, 1, 1, summary("end", "2026-10-12 00:00:00")));
+        when(client.detail(any(SelfopRequestContext.class), eq("A"), eq("customer"), eq("end"))).thenReturn(detail("end", "2026-10-12 00:00:00"));
+        service.collect(task, run, lease);
+        assertEquals(1L, run.getSourceTotalCount()); assertEquals(1L, run.getUniqueObjectCount());
+        var child = children.values().iterator().next(); var routed = read(child.getRoutingManifestJson(), SelfopRoutingManifest.class);
+        assertEquals(0L, routed.getTotal()); assertTrue(routed.getObjects().isEmpty()); assertEquals("READY", child.getStatus());
+        assertEquals(1, stored.size()); assertEquals("VALID", stored.values().iterator().next().getValidationStatus());
+    }
+
+    @Test void relocationBudgetYieldPersistsRefreshAndCurrentWarehouseThenResumesWithoutLocatingAgain() {
+        String key = completedParent("moved"); account.setRequestBudget(2);
+        when(tasks.selectById(anyLong())).thenAnswer(inv -> {
+            Long id = inv.getArgument(0);
+            return id.equals(task.getId()) ? task : children.values().stream().filter(t -> id.equals(t.getId())).findFirst().orElse(null);
+        });
+        Map<Long, SelfopSyncRun> refreshRuns = new HashMap<>();
+        when(taskService.begin(anyLong(), eq(lease))).thenAnswer(inv -> {
+            Long id = inv.getArgument(0);
+            return refreshRuns.computeIfAbsent(id, ignored -> {
+                var attempt = new SelfopSyncRun(); attempt.setExecutionPurpose("BUSINESS"); attempt.setSourceAccount("demo"); attempt.setId(1000L + id); attempt.setTaskId(id);
+                attempt.setAttemptNo(1); attempt.setFenceToken(lease.fence()); attempt.setStatus("FETCHING"); return attempt;
+            });
+        });
+        doAnswer(inv -> {
+            Long id = inv.getArgument(0); SelfopSyncTask yielded = id.equals(task.getId()) ? task
+                : children.values().stream().filter(t -> id.equals(t.getId())).findFirst().orElseThrow();
+            yielded.setStatus("RETRY_WAIT"); return null;
+        }).when(taskService).yield(anyLong(), anyLong(), eq(lease));
+        when(client.detail(any(SelfopRequestContext.class), eq("A"), eq("customer"), eq("moved")))
+            .thenThrow(new AnalyticsClientException("LINGXING_WMS_SOURCE_REJECTED", false));
+        var moved = new LingxingAnalyticsClient.Summary("demo", "customer", "B", "moved", null, 100, null, "2026-10-11 12:00:00", null);
+        when(client.locate(any(SelfopRequestContext.class), eq("moved"), eq(1), eq(2))).thenReturn(page(1, 2, 1, 1, moved));
+        when(client.detail(any(SelfopRequestContext.class), eq("B"), eq("customer"), eq("moved"))).thenReturn(new SelfopPayloads.Order("demo", "customer", "B", "moved", null,
+            100, null, "2026-10-11 12:00:00", List.of(new SelfopPayloads.Item("sku", null, BigDecimal.ONE, "PCS"))));
+
+        service.collect(task, run, lease);
+        var parentRef = read(task.getRoutingManifestJson(), SelfopRoutingManifest.class).getObjects().get(key);
+        assertEquals("B", parentRef.getWarehouseCode()); assertNotNull(parentRef.getRefreshTaskId()); assertNull(parentRef.getEffectiveStageId());
+        var refresh = children.values().stream().filter(t -> parentRef.getRefreshTaskId().equals(t.getId())).findFirst().orElseThrow();
+        assertEquals("RECHECK", refresh.getTaskType()); assertEquals("RETRY_WAIT", refresh.getStatus());
+        assertTrue(read(refresh.getRoutingManifestJson(), SelfopRoutingManifest.class).isDirectoryComplete());
+        verify(client, never()).detail(any(SelfopRequestContext.class), eq("B"), eq("customer"), eq("moved"));
+
+        account.setRequestBudget(10); service.collect(task, run, lease);
+        var finalRef = read(task.getRoutingManifestJson(), SelfopRoutingManifest.class).getObjects().get(key);
+        assertEquals(parentRef.getRefreshTaskId(), finalRef.getRefreshTaskId()); assertNotNull(finalRef.getEffectiveStageId());
+        assertEquals("B", finalRef.getWarehouseCode()); assertEquals("SUCCEEDED", refresh.getStatus()); assertEquals("ROUTED", run.getStatus());
+        var evidence = stored.get(finalRef.getEffectiveStageId()); assertEquals(102L, evidence.getObservationSequence());
+        assertEquals(refresh.getId(), evidence.getStageBatchId());
+        verify(client, times(1)).locate(any(SelfopRequestContext.class), eq("moved"), eq(1), eq(2));
+        verify(client, times(1)).detail(any(SelfopRequestContext.class), eq("A"), eq("customer"), eq("moved"));
+        verify(client, times(1)).detail(any(SelfopRequestContext.class), eq("B"), eq("customer"), eq("moved"));
+    }
+
+    @Test void authenticationAndSignatureFailuresNeverFallbackToOrderRelocation() {
+        completedParent("protected");
+        for (String code : List.of("LINGXING_WMS_AUTHORIZATION_REJECTED", "LINGXING_WMS_SIGNATURE_REJECTED")) {
+            doThrow(new AnalyticsClientException(code, false)).when(client).detail(any(SelfopRequestContext.class), eq("A"), eq("customer"), eq("protected"));
+            assertEquals(code, assertThrows(AnalyticsClientException.class, () -> service.collect(task, run, lease)).code());
+        }
+        verify(client, never()).locate(any(SelfopRequestContext.class), anyString(), anyInt(), anyInt());
+        assertTrue(children.values().stream().noneMatch(t -> "RECHECK".equals(t.getTaskType())));
+    }
+
+    private String completedParent(String deliveryNo) {
+        var manifest = new SelfopRoutingManifest(); manifest.setDirectoryComplete(true); manifest.setPages(1); manifest.setTotal(1L);
+        var entry = new SelfopRoutingManifest.Entry(); entry.setCustomerCode("customer"); entry.setDeliveryNo(deliveryNo); entry.setWarehouseCode("A");
+        String key = hash(List.of("demo", "customer", deliveryNo)); manifest.getObjects().put(key, entry);
+        task.setRoutingManifestJson(json(manifest)); return key;
+    }
+    @Test void persistedScaleRewriteAndEquivalentFreshDetailKeepImmutableStageFingerprint() {
+        String key=completedParent("decimal");
+        var original=new SelfopPayloads.Order("demo","customer","A","decimal",null,100,null,"2026-10-11 12:00:00",
+            List.of(new SelfopPayloads.Item("sku",null,new BigDecimal("1000.000000"),"PCS")));
+        var loaded=new SelfopPayloads.Order("demo","customer","A","decimal",null,100,null,"2026-10-11 12:00:00",
+            List.of(new SelfopPayloads.Item("sku",null,new BigDecimal("1E+3"),"PCS")));
+        var stage=new SelfopSyncStage();stage.setId(500L);stage.setStageBatchId(1L);stage.setRunId(20L);stage.setObjectKeyHash(key);
+        stage.setWarehouseCode("A");stage.setObservationSequence(101L);stage.setValidationStatus("VALID");stage.setFirstPageNo(1);
+        stage.setContentHash(SelfopOutboundFingerprint.order(original));stage.setPayloadJson(json(loaded));stored.put(500L,stage);
+        when(client.detail(any(SelfopRequestContext.class),eq("A"),eq("customer"),eq("decimal")))
+            .thenReturn(new SelfopPayloads.Order("demo","customer","A","decimal",null,100,null,"2026-10-11 12:00:00",
+                List.of(new SelfopPayloads.Item("sku",null,new BigDecimal("1000.0"),"PCS"))));
+        service.collect(task,run,lease);
+        assertEquals("ROUTED",run.getStatus());assertEquals(500L,read(task.getRoutingManifestJson(),SelfopRoutingManifest.class).getObjects().get(key).getEffectiveStageId());
+        assertEquals(SelfopOutboundFingerprint.order(loaded),stored.get(500L).getContentHash());
+    }
+    private LingxingAnalyticsClient.Summary listed(String no, List<SelfopPayloads.Item> items) {
+        var s=summary(no,"2026-10-11 12:00:00");
+        return new LingxingAnalyticsClient.Summary(s.sourceAccount(),s.customerCode(),s.warehouseCode(),s.deliveryNo(),
+            s.sourceNo(),s.sourceStatus(),s.sourceCreatedTime(),s.sourceOutboundTime(),items);
+    }
+    @Test void completeListAndRealZeroNeedNoDetailsEvenWhenRequestBudgetIsExhausted() {
+        account.setRequestBudget(2);
+        when(client.discover(any(),eq(from),eq(until),eq(1),eq(2))).thenReturn(page(1,2,2,1,
+            listed("one",List.of(new SelfopPayloads.Item("sku",null,new BigDecimal("2.123456"),"PCS"))),
+            listed("zero",List.of(new SelfopPayloads.Item("sku",null,BigDecimal.ZERO,"PCS")))));
+        service.collect(task,run,lease);
+        verify(client,never()).detail(any(),anyString(),anyString(),anyString());
+        assertEquals("ROUTED",run.getStatus());assertEquals(2,stored.size());
+        // Two orders, one warehouse: initial WAITING_SOURCE and final READY projections only.
+        verify(orders,times(4)).selectOne(any());
+        assertTrue(children.values().stream().allMatch(child->"READY".equals(child.getStatus())));
+        assertTrue(stored.values().stream().allMatch(s->"VALID".equals(s.getValidationStatus())));
+        var quantities=stored.values().stream().map(s->read(s.getPayloadJson(),SelfopPayloads.Order.class).items().get(0).actualQuantity()).toList();
+        assertTrue(quantities.stream().anyMatch(q->q.compareTo(new BigDecimal("2.123456"))==0));
+        assertTrue(quantities.stream().anyMatch(q->q.signum()==0));
+    }
+    @Test void completeListYieldsAtTimeLimitAndResumesWithoutRequests() {
+        when(client.discover(any(),eq(from),eq(until),eq(1),eq(2))).thenReturn(page(1,2,2,1,
+            listed("one",List.of(new SelfopPayloads.Item("sku",null,BigDecimal.ONE,"PCS"))),
+            listed("two",List.of(new SelfopPayloads.Item("sku",null,BigDecimal.TEN,"PCS")))));
+        try(var budgets=mockConstruction(SelfopBudget.class,(budget,context)->{
+            when(budget.take()).thenReturn(true);
+            when(budget.hasTime()).thenReturn(true,false);
+        })) {
+            service.collect(task,run,lease);
+            verify(budgets.constructed().get(0),times(2)).take();
+        }
+        verify(taskService).yield(task.getId(),run.getId(),lease);
+        assertEquals(1,stored.values().stream().filter(s->"VALID".equals(s.getValidationStatus())).count());
+        assertTrue(children.values().stream().allMatch(s->"WAITING_SOURCE".equals(s.getStatus())));
+        service.collect(task,run,lease);
+        verify(client,times(2)).discover(any(),eq(from),eq(until),eq(1),eq(2));
+        verify(client,never()).detail(any(),anyString(),anyString(),anyString());
+        assertEquals(2,stored.values().stream().filter(s->"VALID".equals(s.getValidationStatus())).count());
+        assertEquals("ROUTED",run.getStatus());
+    }
+    @Test void onlyIncompleteOrderFallsBackAndRetryDoesNotRefetchCompletedOrders() {
+        when(client.discover(any(),eq(from),eq(until),eq(1),eq(2))).thenReturn(page(1,2,2,1,
+            listed("complete",List.of(new SelfopPayloads.Item("sku",null,BigDecimal.TEN,"PCS"))),
+            listed("missing",List.of(new SelfopPayloads.Item("sku",null,null,"PCS")))));
+        when(client.detail(any(),eq("A"),eq("customer"),eq("missing")))
+            .thenThrow(new AnalyticsClientException("INTEGRATION_PROVIDER_FAILURE",true))
+            .thenReturn(detail("missing","2026-10-11 12:00:00"));
+        assertThrows(AnalyticsClientException.class,()->service.collect(task,run,lease));
+        assertEquals(1,stored.values().stream().filter(s->"VALID".equals(s.getValidationStatus())).count());
+        service.collect(task,run,lease);
+        verify(client,never()).detail(any(),eq("A"),eq("customer"),eq("complete"));
+        verify(client,times(2)).detail(any(),eq("A"),eq("customer"),eq("missing"));
+        verify(client,times(2)).discover(any(),eq(from),eq(until),eq(1),eq(2));
+        assertEquals("ROUTED",run.getStatus());
+    }
+    @Test void missingSkuOrEmptyItemsFallsBackPerOrder() {
+        when(client.discover(any(),eq(from),eq(until),eq(1),eq(2))).thenReturn(page(1,2,2,1,
+            listed("blank",List.of(new SelfopPayloads.Item(" ",null,BigDecimal.ONE,"PCS"))),listed("empty",List.of())));
+        service.collect(task,run,lease);
+        verify(client).detail(any(),eq("A"),eq("customer"),eq("blank"));
+        verify(client).detail(any(),eq("A"),eq("customer"),eq("empty"));
+        assertEquals("ROUTED",run.getStatus());
+    }
+    @Test void genuinelyEmptyDirectoryDoesNotFetchDetails() {
+        when(client.discover(any(),eq(from),eq(until),eq(1),eq(2))).thenReturn(page(1,2,0,0));
+        service.collect(task,run,lease);
+        verify(client,never()).detail(any(),anyString(),anyString(),anyString());
+        assertEquals("ROUTED",run.getStatus());assertTrue(stored.isEmpty());
+    }
+    @Test void partialOldDirectoryRestartsScansWithListItems() {
+        var old=new SelfopRoutingManifest();old.setScan(2);old.setNextPage(1);old.setPages(1);old.setTotal(1L);
+        old.getFirstScan().put(hash(List.of("demo","customer","one")),"old-summary-without-items");
+        task.setRoutingManifestJson(json(old));
+        when(client.discover(any(),eq(from),eq(until),eq(1),eq(2))).thenReturn(page(1,2,1,1,
+            listed("one",List.of(new SelfopPayloads.Item("sku",null,BigDecimal.ONE,"PCS")))));
+        service.collect(task,run,lease);
+        verify(client,times(2)).discover(any(),eq(from),eq(until),eq(1),eq(2));
+        verify(client,never()).detail(any(),anyString(),anyString(),anyString());
+        assertEquals("ROUTED",run.getStatus());
+        assertEquals(1,read(task.getRoutingManifestJson(),SelfopRoutingManifest.class).getListPayloadVersion());
+    }
+    private void prepareCompleteBatch(int count) {
+        var manifest=new SelfopRoutingManifest();manifest.setListPayloadVersion(1);manifest.setDirectoryComplete(true);manifest.setPages(1);manifest.setTotal((long)count);
+        for(int i=0;i<count;i++) {
+            var payload=detail("batch-"+i,"2026-10-11 12:00:00");String key=hash(List.of("demo","customer",payload.deliveryNo()));
+            var stage=new SelfopSyncStage();stage.setId(1000L+i);stage.setRunId(run.getId());stage.setStageBatchId(task.getId());stage.setObjectKeyHash(key);
+            stage.setValidationStatus("PENDING");stage.setFirstPageNo(1);stage.setPayloadJson(json(payload));stage.setCreatedAt(from);stored.put(stage.getId(),stage);
+            var ref=new SelfopRoutingManifest.Entry();ref.setCustomerCode("customer");ref.setWarehouseCode("A");ref.setDeliveryNo(payload.deliveryNo());ref.setDirectoryStageId(stage.getId());manifest.getObjects().put(key,ref);
+        }
+        task.setRoutingManifestJson(json(manifest));
+        when(stages.selectList(any())).thenAnswer(inv->{
+            QueryWrapper<SelfopSyncStage> q=inv.getArgument(0);String sql=q.getSqlSegment();var values=q.getParamNameValuePairs().values();
+            if(sql.contains("observation_sequence"))return List.of();
+            return stored.values().stream().filter(s->values.contains(s.getId())).toList();
+        });
+        long[] next={101};when(leases.nextObservations(eq(lease),anyInt())).thenAnswer(inv->{long first=next[0];next[0]+=inv.<Integer>getArgument(1);return first;});
+    }
+    @Test void completeListsCommitBoundedBatchesInsteadOfPerOrderManifests() {
+        prepareCompleteBatch(205);service.collect(task,run,lease);
+        verifyNoInteractions(client);verify(leases,times(2)).nextObservations(lease,100);verify(leases).nextObservations(lease,5);
+        verify(tasks,times(4)).updateById(argThat((SelfopSyncTask t)->task.getId().equals(t.getId())));
+        assertEquals(205,stored.values().stream().filter(s->"VALID".equals(s.getValidationStatus())).count());
+        assertEquals(205,stored.values().stream().map(SelfopSyncStage::getObservationSequence).distinct().count());
+        assertEquals(101L,stored.values().stream().mapToLong(SelfopSyncStage::getObservationSequence).min().orElseThrow());
+        assertEquals(305L,stored.values().stream().mapToLong(SelfopSyncStage::getObservationSequence).max().orElseThrow());
+        assertEquals("ROUTED",run.getStatus());assertTrue(children.values().stream().allMatch(c->"READY".equals(c.getStatus())));
+    }
+    @Test void batchYieldResumesOnlyUncommittedRowsWithoutSupplierRequests() {
+        prepareCompleteBatch(205);
+        try(var budgets=mockConstruction(SelfopBudget.class,(b,c)->when(b.hasTime()).thenReturn(true,false))){service.collect(task,run,lease);}
+        assertEquals(100,stored.values().stream().filter(s->"VALID".equals(s.getValidationStatus())).count());
+        assertTrue(children.values().stream().allMatch(c->"WAITING_SOURCE".equals(c.getStatus())));
+        service.collect(task,run,lease);verifyNoInteractions(client);
+        verify(stages,times(205)).updateById(any(SelfopSyncStage.class));assertEquals("ROUTED",run.getStatus());
+    }
+    @Test void stoppedBatchCannotPromoteRowsOrAllocateObservations() {
+        prepareCompleteBatch(100);int[] checkpoints={0};
+        when(taskService.checkpoint(task,run,lease)).thenAnswer(inv->{if(++checkpoints[0]>1)throw new SelfopTaskService.BusinessSessionStoppedException("STOPPED");return new SelfopTaskService.CollectionCheckpoint(task,run);});
+        assertThrows(SelfopTaskService.BusinessSessionStoppedException.class,()->service.collect(task,run,lease));
+        verify(leases,never()).nextObservations(any(),anyInt());verify(stages,never()).updateById(any(SelfopSyncStage.class));
+        assertTrue(stored.values().stream().allMatch(s->"PENDING".equals(s.getValidationStatus())));verifyNoInteractions(client);
+    }
+    @Test void incompleteRowInBatchStillUsesDetailAndPreservesCompleteRows() {
+        prepareCompleteBatch(3);var missing=stored.get(1001L);var p=read(missing.getPayloadJson(),SelfopPayloads.Order.class);
+        missing.setPayloadJson(json(new SelfopPayloads.Order(p.sourceAccount(),p.customerCode(),p.warehouseCode(),p.deliveryNo(),p.sourceNo(),p.sourceStatus(),p.sourceCreatedTime(),p.sourceOutboundTime(),null)));
+        service.collect(task,run,lease);verify(client).detail(any(),eq("A"),eq("customer"),eq("batch-1"));
+        verify(client,never()).detail(any(),eq("A"),eq("customer"),eq("batch-0"));verify(client,never()).detail(any(),eq("A"),eq("customer"),eq("batch-2"));
+        assertTrue(stored.values().stream().allMatch(s->"VALID".equals(s.getValidationStatus())));
+    }
+    @Test void validationPurposeCannotReachAccountRoutingOrFormalCoverage() {
+        task.setExecutionPurpose("VALIDATION");run.setExecutionPurpose("VALIDATION");
+        assertEquals("SELFOP_BUSINESS_PURPOSE_REQUIRED",assertThrows(IllegalStateException.class,()->service.collect(task,run,lease)).getMessage());
+        assertNull(account.getCatalogUntilUtc());assertNull(scope.getDiscoveryUntilUtc());assertTrue(children.isEmpty());
+        verifyNoInteractions(client);
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/sync/SelfopExecutionServiceTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/sync/SelfopExecutionServiceTest.java
new file mode 100644
index 000000000..bba0711d8
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/sync/SelfopExecutionServiceTest.java
@@ -0,0 +1,80 @@
+package com.baiyue.lastleg.selfoperated.analytics.sync;
+
+import com.baiyue.lastleg.selfoperated.analytics.mapper.*;
+import com.baiyue.lastleg.selfoperated.analytics.model.*;
+import com.baiyue.lastleg.selfoperated.analytics.outbound.*;
+import com.baiyue.lastleg.selfoperated.analytics.inventory.InventorySnapshotService;
+import com.baiyue.lastleg.selfoperated.analytics.request.EgressRejectedException;
+import org.junit.jupiter.api.Test;
+import java.time.LocalDateTime;
+import static org.mockito.Mockito.*;
+
+class SelfopExecutionServiceTest {
+    @Test void unexpectedBusinessFailureReachesDurableRetryHandlerWithSafeCauseMetadata() {
+        var config=new SelfopAnalyticsProperties();config.setCollectionMode("BUSINESS");config.setEnvironment("production");
+        var taskService=mock(SelfopTaskService.class);var leases=mock(SelfopLeaseService.class);var tasks=mock(SelfopSyncTaskMapper.class);
+        var discovery=mock(SelfopDiscoveryService.class);
+        var task=new SelfopSyncTask();task.setId(1L);task.setTaskRole("ACCOUNT_DISCOVERY");task.setDiscoveryScopeId(3L);
+        task.setExecutionPurpose("BUSINESS");task.setStatus("READY");task.setTaskNo("LXCOL-TEST");
+        var run=new SelfopSyncRun();run.setId(2L);var lease=new SelfopLeaseService.Lease(3L,"owner",8L,true);
+        when(tasks.selectById(1L)).thenReturn(task);when(leases.acquireDiscovery(eq(3L),anyString())).thenReturn(lease);
+        when(taskService.begin(1L,lease)).thenReturn(run);
+        doThrow(new org.springframework.dao.CannotAcquireLockException("secret SQL",new java.sql.SQLException("private","40001",1213)))
+            .when(discovery).collect(task,run,lease);
+        var service=new SelfopExecutionService(config,taskService,leases,discovery,mock(SelfopInventoryCollector.class),mock(InventorySnapshotService.class),
+            mock(OutboundFactService.class),mock(OutboundCandidateBuilder.class),mock(SelfopSalesPublisher.class),mock(SelfopSyncScopeMapper.class),tasks,
+            mock(SelfopSyncStageMapper.class),mock(SelfopOutboundOrderMapper.class),mock(SelfopReferenceRecovery.class),mock(SelfopValidationRunner.class),
+            mock(SelfopSyncRunMapper.class),mock(SelfopMasterDataCollector.class));
+        service.execute(1L);
+        verify(taskService).fail(eq(1L),eq(2L),argThat(f->"SELFOP_DATABASE_TRANSIENT".equals(f.code())&&f.outboundRetryable()&&"40001".equals(f.sqlState())),eq(lease));
+        verify(leases).release(lease);
+    }
+    @Test void completedDayBuildsAndPublishesImmediatelyWithoutBuildIntervalWait() {
+        var config=new SelfopAnalyticsProperties();config.setCollectionMode("BUSINESS");config.setEnvironment("production");config.setSalesPublicationEnabled(true);
+        var taskService=mock(SelfopTaskService.class);var leases=mock(SelfopLeaseService.class);var tasks=mock(SelfopSyncTaskMapper.class);var scopes=mock(SelfopSyncScopeMapper.class);
+        var task=new SelfopSyncTask();task.setId(1L);task.setExecutionPurpose("BUSINESS");task.setStatus("READY");task.setTaskRole("WAREHOUSE_SYNC");task.setTaskType("BACKFILL");task.setScopeId(3L);task.setWarehouseCode("A");task.setApplyState("APPLIED");task.setAttemptCount(1);task.setRoutingManifestJson("{\"objects\":{}}");
+        var scope=new SelfopSyncScope();scope.setId(3L);scope.setWarehouseCode("A");scope.setDataFamily("OUTBOUND");var run=new SelfopSyncRun();run.setId(2L);
+        var lease=new SelfopLeaseService.Lease(3L,"worker",8L,false);
+        when(tasks.selectById(1L)).thenReturn(task);when(scopes.selectById(3L)).thenReturn(scope);when(scopes.selectOne(any())).thenReturn(scope);
+        when(leases.acquireScopes(any(),anyString())).thenReturn(java.util.Map.of(3L,lease));when(taskService.begin(1L,lease)).thenReturn(run);
+        var candidates=mock(OutboundCandidateBuilder.class);var publisher=mock(SelfopSalesPublisher.class);var runs=mock(SelfopSyncRunMapper.class);
+        when(candidates.reusable(anyLong(),anyLong(),anyString(),anyLong())).thenReturn(null);
+        var service=new SelfopExecutionService(config,taskService,leases,mock(SelfopDiscoveryService.class),mock(SelfopInventoryCollector.class),mock(InventorySnapshotService.class),mock(OutboundFactService.class),candidates,publisher,scopes,tasks,mock(SelfopSyncStageMapper.class),mock(SelfopOutboundOrderMapper.class),mock(SelfopReferenceRecovery.class),mock(SelfopValidationRunner.class),runs,org.mockito.Mockito.mock(SelfopMasterDataCollector.class));
+        service.execute(1L);
+        var order=inOrder(candidates,publisher);order.verify(candidates).build(eq(3L),eq(2L),anyString(),eq(8L));order.verify(publisher).publish(eq(3L),eq(2L),anyString(),eq(8L));
+        verify(taskService,never()).waitForBudget(anyLong(),anyLong(),any(),any());verifyNoInteractions(runs);
+        doThrow(new IllegalStateException("private publication payload")).when(publisher).publish(eq(3L),eq(2L),anyString(),eq(8L));
+        service.execute(1L);
+        verify(taskService).fail(eq(1L),eq(2L),argThat(f->"PUBLISH".equals(f.executionPhase())&&"SELFOP_EXECUTION_FAILED".equals(f.code())),eq(lease));
+    }
+    @Test void unexpectedValidationFailureTerminatesSessionInsteadOfSchedulingRetry() {
+        executeValidationFailure(new IllegalStateException("VALIDATION_STRUCTURE_REJECTED"),"VALIDATION_STRUCTURE_REJECTED");
+    }
+    @Test void escapingValidationWaitCannotUseBusinessYieldPath() {
+        executeValidationFailure(new EgressRejectedException("ACCOUNT_INTERVAL_WAIT",false,LocalDateTime.now().plusMinutes(1)),
+            "ACCOUNT_INTERVAL_WAIT");
+    }
+    private void executeValidationFailure(RuntimeException failure,String code) {
+        var config=new SelfopAnalyticsProperties();config.setCollectionMode("VALIDATION");
+        var taskService=mock(SelfopTaskService.class);var leases=mock(SelfopLeaseService.class);
+        var validation=mock(SelfopValidationRunner.class);var tasks=mock(SelfopSyncTaskMapper.class);
+        var discovery=mock(SelfopDiscoveryService.class);var stock=mock(SelfopInventoryCollector.class);
+        var snapshots=mock(InventorySnapshotService.class);var facts=mock(OutboundFactService.class);
+        var candidates=mock(OutboundCandidateBuilder.class);var publisher=mock(SelfopSalesPublisher.class);
+        var recovery=mock(SelfopReferenceRecovery.class);
+        var task=new SelfopSyncTask();task.setId(1L);task.setTaskRole("ACCOUNT_DISCOVERY");
+        task.setDiscoveryScopeId(3L);task.setExecutionPurpose("VALIDATION");task.setStatus("READY");task.setValidationRootTaskId(1L);
+        var run=new SelfopSyncRun();run.setId(2L);run.setTaskId(1L);run.setExecutionPurpose("VALIDATION");
+        var lease=new SelfopLeaseService.Lease(3L,"owner",8L,true);
+        when(tasks.selectById(1L)).thenReturn(task);when(leases.acquireDiscovery(eq(3L),anyString())).thenReturn(lease);
+        when(taskService.begin(1L,lease)).thenReturn(run);doThrow(failure).when(validation).run(task,run,lease);
+        var service=new SelfopExecutionService(config,taskService,leases,discovery,stock,snapshots,facts,candidates,publisher,
+            mock(SelfopSyncScopeMapper.class),tasks,mock(SelfopSyncStageMapper.class),mock(SelfopOutboundOrderMapper.class),
+            recovery,validation,mock(SelfopSyncRunMapper.class),org.mockito.Mockito.mock(SelfopMasterDataCollector.class));
+        service.execute(1L);
+        verify(validation).fail(task,run,lease,code);verify(leases).release(lease);
+        verify(taskService,never()).fail(anyLong(),anyLong(),any(SelfopFailure.class),any());
+        verify(taskService,never()).waitForBudget(anyLong(),anyLong(),any(),any());
+        verifyNoInteractions(discovery,stock,snapshots,facts,candidates,publisher,recovery);
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/sync/SelfopInventoryCollectorTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/sync/SelfopInventoryCollectorTest.java
new file mode 100644
index 000000000..eabe2f65c
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/sync/SelfopInventoryCollectorTest.java
@@ -0,0 +1,223 @@
+package com.baiyue.lastleg.selfoperated.analytics.sync;
+
+import com.baiyue.lastleg.selfoperated.analytics.client.LingxingAnalyticsClient;
+import com.baiyue.lastleg.selfoperated.analytics.mapper.*;
+import com.baiyue.lastleg.selfoperated.analytics.model.*;
+import java.math.BigDecimal;
+import java.util.*;
+import java.util.function.Consumer;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.mockito.ArgumentCaptor;
+import org.springframework.transaction.TransactionStatus;
+import org.springframework.transaction.support.TransactionTemplate;
+import static com.baiyue.lastleg.selfoperated.analytics.model.SelfopSupport.*;
+import static org.junit.jupiter.api.Assertions.*;
+import static org.mockito.ArgumentMatchers.*;
+import static org.mockito.Mockito.*;
+
+/** Fully offline source pages; the transaction callback fake verifies orchestration, not DB rollback. */
+class SelfopInventoryCollectorTest {
+    private final LingxingAnalyticsClient client = mock(LingxingAnalyticsClient.class);
+    private final SelfopSyncStageMapper stages = mock(SelfopSyncStageMapper.class);
+    private final SelfopSyncTaskMapper tasks = mock(SelfopSyncTaskMapper.class);
+    private final SelfopSyncRunMapper runs = mock(SelfopSyncRunMapper.class);
+    private final SelfopLeaseService leases = mock(SelfopLeaseService.class);
+    private final SelfopTaskService taskService = mock(SelfopTaskService.class);
+    private final SelfopAnalyticsProperties config = new SelfopAnalyticsProperties();
+    private final TransactionTemplate tx = mock(TransactionTemplate.class);
+    private final SelfopLeaseService.Lease lease = new SelfopLeaseService.Lease(1L, "owner", 4L, false);
+    private SelfopInventoryCollector collector;
+    private SelfopSyncTask task;
+    private SelfopSyncRun run;
+
+    @BeforeEach void prepare() {
+        when(taskService.checkpoint(any(SelfopSyncTask.class),any(SelfopSyncRun.class),any())).thenAnswer(inv ->
+            new SelfopTaskService.CollectionCheckpoint(inv.getArgument(0),inv.getArgument(1)));
+
+        doAnswer(invocation -> {
+            Consumer<TransactionStatus> callback = invocation.getArgument(0);
+            callback.accept(mock(TransactionStatus.class)); return null;
+        }).when(tx).executeWithoutResult(any());
+        config.setCollectionMode("BUSINESS"); config.setEnvironment("production"); config.setInventoryPageSize(2); config.setRequestBudget(10); config.setTimeBudgetSeconds(60);
+        collector = new SelfopInventoryCollector(client, stages, tasks, runs, leases, taskService, config, tx);
+        task = new SelfopSyncTask(); task.setExecutionPurpose("BUSINESS"); task.setTaskNo("LXCOL-20261012-00000001"); task.setId(20L); task.setSourceAccount("demo"); task.setWarehouseCode("A");
+        run = new SelfopSyncRun(); run.setExecutionPurpose("BUSINESS"); run.setAttemptNo(1); run.setTaskId(task.getId()); run.setSourceAccount("demo"); run.setFenceToken(lease.fence()); run.setId(10L); run.setTaskId(20L); run.setStatus("FETCHING");
+        run.setScopeSnapshotJson("{\"quantityUnit\":\"PCS\"}"); run.setFetchStartedAtUtc(utcNow());
+    }
+    @Test void defaultInventoryPageSizeCollects1001RowsInTwoRequestsWithoutChangingOutboundSize() {
+        var defaults=new SelfopAnalyticsProperties();
+        assertEquals(100,defaults.getPageSize());assertEquals(1000,defaults.getInventoryPageSize());
+        config.setInventoryPageSize(defaults.getInventoryPageSize());
+        var first=new ArrayList<SelfopPayloads.Stock>();
+        for(int i=0;i<1000;i++)first.add(stock("sku-"+i,BigDecimal.ONE));
+        when(client.inventory(any(SelfopRequestContext.class),eq("A"),eq(1),eq(1000)))
+            .thenReturn(new LingxingAnalyticsClient.Page<>(first,1,1000,1001L,2));
+        when(client.inventory(any(SelfopRequestContext.class),eq("A"),eq(2),eq(1000)))
+            .thenReturn(new LingxingAnalyticsClient.Page<>(List.of(stock("last",BigDecimal.ZERO)),2,1000,1001L,2));
+        assertTrue(collector.collect(task,run,lease));
+        assertEquals(100,config.getPageSize());assertEquals(1001L,run.getUniqueObjectCount());
+        assertEquals("COMPLETE",run.getCoverageStatus());assertEquals(2,run.getPageCount());
+        verify(client,times(2)).inventory(any(SelfopRequestContext.class),eq("A"),anyInt(),eq(1000));
+        verify(stages,times(1001)).insert(any(SelfopSyncStage.class));
+    }
+    @Test void invalidInventoryPageSizeRejectsBeforeAnyRequestOrStageWrite() {
+        for(int size:new int[]{0,-1,1001}){
+            config.setInventoryPageSize(size);
+            assertEquals("SELFOP_INVENTORY_PAGE_SIZE_INVALID",assertThrows(IllegalStateException.class,
+                ()->collector.collect(task,run,lease)).getMessage());
+        }
+        verifyNoInteractions(client,stages,leases);
+    }
+    @Test void lateInventoryResponseCannotWriteStagesOrReviveStoppedAttempt() {
+        when(client.inventory(any(SelfopRequestContext.class),eq("A"),eq(1),eq(2))).thenReturn(page(1,1,1,stock("late",BigDecimal.ONE)));
+        when(taskService.checkpoint(task,run,lease)).thenThrow(new SelfopTaskService.BusinessSessionStoppedException("BUSINESS_SESSION_DEADLINE"));
+        assertThrows(SelfopTaskService.BusinessSessionStoppedException.class,()->collector.collect(task,run,lease));
+        verify(stages,never()).insert(any(SelfopSyncStage.class));verify(tasks,never()).updateById(any(SelfopSyncTask.class));
+        verify(runs,never()).updateById(any(SelfopSyncRun.class));
+    }
+    @Test void terminationBetweenLastPageAndFinalValidationCannotSetValidated() {
+        when(client.inventory(any(SelfopRequestContext.class),eq("A"),eq(1),eq(2))).thenReturn(page(1,1,1,stock("last",BigDecimal.ONE)));
+        when(taskService.checkpoint(task,run,lease)).thenReturn(new SelfopTaskService.CollectionCheckpoint(task,run))
+            .thenThrow(new SelfopTaskService.BusinessSessionStoppedException("BUSINESS_SESSION_DEADLINE"));
+        assertThrows(SelfopTaskService.BusinessSessionStoppedException.class,()->collector.collect(task,run,lease));
+        assertEquals("FETCHING",run.getStatus());assertNull(run.getFetchFinishedAtUtc());
+        verify(runs,times(1)).updateById(any(SelfopSyncRun.class));
+    }
+
+    private SelfopPayloads.Stock stock(String sku, BigDecimal available) {
+        return new SelfopPayloads.Stock("demo", "customer", "A", sku, 0, "Name",
+            BigDecimal.TEN, available, BigDecimal.ZERO, BigDecimal.ZERO, null);
+    }
+    private LingxingAnalyticsClient.Page<SelfopPayloads.Stock> page(int current, long total, int pages, SelfopPayloads.Stock... rows) {
+        return new LingxingAnalyticsClient.Page<>(List.of(rows), current, 2, total, pages);
+    }
+    private void stableThreeRows() {
+        when(client.inventory(any(SelfopRequestContext.class), eq("A"), eq(1), eq(2))).thenReturn(page(1, 3, 2, stock("a", BigDecimal.ONE), stock("b", BigDecimal.ZERO)));
+        when(client.inventory(any(SelfopRequestContext.class), eq("A"), eq(2), eq(2))).thenReturn(page(2, 3, 2, stock("c", null)));
+    }
+
+    @Test void oneCompleteObservationValidatesAttemptAndPersistsEachPageOnce() {
+        stableThreeRows();
+        assertTrue(collector.collect(task, run, lease));
+        assertEquals("VALIDATED", run.getStatus()); assertEquals("COMPLETE", run.getCoverageStatus());
+        assertEquals(3L, run.getSourceTotalCount()); assertEquals(3L, run.getUniqueObjectCount()); assertEquals(2, run.getPageCount());
+        verify(client).inventory(any(SelfopRequestContext.class), eq("A"), eq(1), eq(2)); verify(client).inventory(any(SelfopRequestContext.class), eq("A"), eq(2), eq(2));
+        var capture = ArgumentCaptor.forClass(SelfopSyncStage.class);
+        verify(stages, times(3)).insert(capture.capture());
+        assertTrue(capture.getAllValues().stream().allMatch(s -> s.getRunId() == 10L && s.getStageBatchId() == 10L && s.getLastFetchRunId() == 10L));
+        assertNotNull(run.getFetchFinishedAtUtc());
+        var contexts=ArgumentCaptor.forClass(SelfopRequestContext.class);
+        verify(client,times(2)).inventory(contexts.capture(),eq("A"),anyInt(),eq(2));
+        assertTrue(contexts.getAllValues().stream().allMatch(c->"demo".equals(c.sourceAccount())&&"BUSINESS".equals(c.executionPurpose())
+            &&Objects.equals(c.taskId(),20L)&&Objects.equals(c.runId(),10L)&&Objects.equals(c.rootTaskId(),20L)));
+    }
+    @Test void duplicateKeyRejectsReportedTotalEvenIfNumberOfReturnedRowsMatches() {
+        // Scaled version of the observed 5741 rows / 5740 unique dimensions incident.
+        when(client.inventory(any(SelfopRequestContext.class), eq("A"), eq(1), eq(2))).thenReturn(page(1, 3, 2, stock("a", BigDecimal.ONE), stock("b", BigDecimal.ZERO)));
+        when(client.inventory(any(SelfopRequestContext.class), eq("A"), eq(2), eq(2))).thenReturn(page(2, 3, 2, stock("a", BigDecimal.ONE)));
+        var error = assertThrows(IllegalStateException.class, () -> collector.collect(task, run, lease));
+        assertEquals("SELFOP_STOCK_DUPLICATE", error.getMessage());
+        assertIncompleteAttemptWithPersistedProgress();
+    }
+    @Test void sourcePageFailureCannotMarkAttemptComplete() {
+        when(client.inventory(any(SelfopRequestContext.class), eq("A"), eq(1), eq(2))).thenReturn(page(1, 3, 2, stock("a", BigDecimal.ONE), stock("b", BigDecimal.ZERO)));
+        when(client.inventory(any(SelfopRequestContext.class), eq("A"), eq(2), eq(2))).thenThrow(new IllegalStateException("SOURCE_TIMEOUT"));
+        assertThrows(IllegalStateException.class, () -> collector.collect(task, run, lease));
+        assertFalse(read(task.getRoutingManifestJson(), SelfopRoutingManifest.class).isDirectoryComplete());
+        assertIncompleteAttemptWithPersistedProgress();
+    }
+    @Test void freshAttemptAfterDuplicateReReadsAllPagesAndKeepsFailedRowsOutOfItsBatch() {
+        when(client.inventory(any(SelfopRequestContext.class),eq("A"),eq(1),eq(2)))
+            .thenReturn(page(1,3,2,stock("a",BigDecimal.ONE),stock("b",BigDecimal.ZERO)));
+        when(client.inventory(any(SelfopRequestContext.class),eq("A"),eq(2),eq(2)))
+            .thenReturn(page(2,3,2,stock("a",BigDecimal.ONE)),page(2,3,2,stock("c",BigDecimal.TEN)));
+        assertThrows(IllegalStateException.class,()->collector.collect(task,run,lease));
+        assertNull(run.getFetchFinishedAtUtc());
+        // SelfopTaskService.fail/begin clear the failed cursor and allocate a fresh run.
+        task.setRoutingManifestJson(null);
+        var next=new SelfopSyncRun();next.setId(11L);next.setTaskId(task.getId());next.setAttemptNo(2);
+        next.setExecutionPurpose("BUSINESS");next.setSourceAccount("demo");next.setStatus("FETCHING");
+        next.setFetchStartedAtUtc(utcNow());next.setScopeSnapshotJson(run.getScopeSnapshotJson());
+        assertTrue(collector.collect(task,next,lease));
+        verify(client,times(2)).inventory(any(SelfopRequestContext.class),eq("A"),eq(1),eq(2));
+        var captured=ArgumentCaptor.forClass(SelfopSyncStage.class);verify(stages,times(5)).insert(captured.capture());
+        assertEquals(3,captured.getAllValues().stream().filter(s->Objects.equals(s.getStageBatchId(),11L)).count());
+        assertEquals(3L,next.getSourceTotalCount());assertEquals(3L,next.getUniqueObjectCount());
+        assertEquals("COMPLETE",next.getCoverageStatus());assertNull(run.getCoverageStatus());
+    }
+    @Test void leakedWarehouseIsRejectedWithoutCompletingRun() {
+        var leaked = new SelfopPayloads.Stock("demo", "customer", "B", "sku", 0, null,
+            BigDecimal.ONE, BigDecimal.ONE, BigDecimal.ZERO, BigDecimal.ZERO, null);
+        when(client.inventory(any(SelfopRequestContext.class), eq("A"), eq(1), eq(2))).thenReturn(page(1, 1, 1, leaked));
+        assertEquals("SELFOP_STOCK_SCOPE_LEAK", assertThrows(IllegalStateException.class,
+            () -> collector.collect(task, run, lease)).getMessage());
+        verify(stages, never()).insert(any(SelfopSyncStage.class)); verify(runs, never()).updateById(any(SelfopSyncRun.class));
+    }
+    @Test void unknownAndExplicitZeroRemainDifferentInDurablePayloads() {
+        when(client.inventory(any(SelfopRequestContext.class), eq("A"), eq(1), eq(2))).thenReturn(page(1, 2, 1, stock("zero", BigDecimal.ZERO), stock("unknown", null)));
+        assertTrue(collector.collect(task, run, lease));
+        var capture = ArgumentCaptor.forClass(SelfopSyncStage.class); verify(stages, times(2)).insert(capture.capture());
+        var first = read(capture.getAllValues().get(0).getPayloadJson(), SelfopPayloads.Stock.class);
+        var second = read(capture.getAllValues().get(1).getPayloadJson(), SelfopPayloads.Stock.class);
+        assertEquals(BigDecimal.ZERO, first.availableQuantity()); assertNull(second.availableQuantity());
+    }
+    @Test void budgetYieldPersistsNextPageAndResumeUsesOriginalAttempt() {
+        stableThreeRows(); config.setRequestBudget(1);
+        assertFalse(collector.collect(task, run, lease));
+        var cursor = read(task.getRoutingManifestJson(), SelfopRoutingManifest.class);
+        assertEquals(1, cursor.getScan()); assertEquals(2, cursor.getNextPage()); assertEquals(2, cursor.getFirstScan().size());
+        verify(taskService).yield(20L, 10L, lease);
+        // Simulate restart by constructing a fresh collector and reading only the persisted task cursor.
+        var restarted = new SelfopInventoryCollector(client, stages, tasks, runs, leases, taskService, config, tx);
+        config.setRequestBudget(10);
+        assertTrue(restarted.collect(task, run, lease));
+        var capture = ArgumentCaptor.forClass(SelfopSyncStage.class); verify(stages, times(3)).insert(capture.capture());
+        assertTrue(capture.getAllValues().stream().allMatch(s -> Objects.equals(s.getStageBatchId(), 10L)));
+        verify(client).inventory(any(SelfopRequestContext.class), eq("A"), eq(1), eq(2)); verify(client).inventory(any(SelfopRequestContext.class), eq("A"), eq(2), eq(2));
+        assertEquals("COMPLETE", run.getCoverageStatus());
+    }
+    @Test void missingRowCannotCompleteObservation() {
+        when(client.inventory(any(SelfopRequestContext.class), eq("A"), eq(1), eq(2))).thenReturn(page(1, 3, 2, stock("a", BigDecimal.ONE), stock("b", BigDecimal.ZERO)));
+        when(client.inventory(any(SelfopRequestContext.class), eq("A"), eq(2), eq(2))).thenReturn(page(2, 3, 2));
+        assertEquals("SELFOP_STOCK_COUNT_MISMATCH", assertThrows(IllegalStateException.class,
+            () -> collector.collect(task, run, lease)).getMessage());
+        assertIncompleteAttemptWithPersistedProgress();
+    }
+    @Test void completeObservationDoesNotReReadChangingSource() {
+        var started = run.getFetchStartedAtUtc();
+        when(client.inventory(any(SelfopRequestContext.class), eq("A"), eq(1), eq(2))).thenReturn(page(1, 1, 1, stock("a", BigDecimal.ONE)),
+            page(1, 1, 1, stock("a", BigDecimal.TEN)));
+        assertTrue(collector.collect(task, run, lease));
+        verify(client).inventory(any(SelfopRequestContext.class), eq("A"), eq(1), eq(2));
+        var captured = ArgumentCaptor.forClass(SelfopSyncStage.class); verify(stages).insert(captured.capture());
+        assertEquals(BigDecimal.ONE, read(captured.getValue().getPayloadJson(), SelfopPayloads.Stock.class).availableQuantity());
+        assertEquals(started, run.getFetchStartedAtUtc());
+        assertFalse(run.getFetchFinishedAtUtc().isBefore(started));
+        assertTrue(read(task.getRoutingManifestJson(), SelfopRoutingManifest.class).isDirectoryComplete());
+    }
+    @Test void scientificQuantityPersistsCanonicalFingerprint() {
+        when(client.inventory(any(SelfopRequestContext.class),eq("A"),eq(1),eq(2))).thenReturn(
+            page(1,1,1,stock("a",new BigDecimal("1E+2"))));
+        assertTrue(collector.collect(task,run,lease));
+        assertEquals("COMPLETE",run.getCoverageStatus());
+        var captured=ArgumentCaptor.forClass(SelfopSyncStage.class);verify(stages).insert(captured.capture());
+        assertEquals(SelfopStockFingerprint.of(stock("a",new BigDecimal("100.000"))),captured.getValue().getContentHash());
+    }
+    @Test void validationPurposeCannotReachFormalCollector() {
+        task.setExecutionPurpose("VALIDATION");run.setExecutionPurpose("VALIDATION");
+        assertEquals("SELFOP_BUSINESS_PURPOSE_REQUIRED",assertThrows(IllegalStateException.class,()->collector.collect(task,run,lease)).getMessage());
+        verifyNoInteractions(client,stages,tasks,runs);
+    }
+    private void assertIncompleteAttemptWithPersistedProgress() {
+        assertEquals("FETCHING",run.getStatus());
+        assertNull(run.getFetchFinishedAtUtc());
+        assertNull(run.getCoverageStatus());
+        assertNull(run.getSourceTotalCount());
+        assertNull(run.getUniqueObjectCount());
+        assertNotNull(run.getHeartbeatAtUtc());
+        verify(runs,times(1)).updateById(argThat((SelfopSyncRun saved)->
+            "FETCHING".equals(saved.getStatus()) && saved.getFetchFinishedAtUtc()==null
+                && saved.getCoverageStatus()==null && saved.getHeartbeatAtUtc()!=null));
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/sync/SelfopInventoryRecoveryTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/sync/SelfopInventoryRecoveryTest.java
new file mode 100644
index 000000000..35cc86996
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/sync/SelfopInventoryRecoveryTest.java
@@ -0,0 +1,151 @@
+package com.baiyue.lastleg.selfoperated.analytics.sync;
+
+import com.baiyue.lastleg.selfoperated.analytics.client.LingxingAnalyticsClient;
+import com.baiyue.lastleg.selfoperated.analytics.mapper.*;
+import com.baiyue.lastleg.selfoperated.analytics.model.*;
+import java.math.BigDecimal;
+import java.time.LocalDateTime;
+import java.util.List;
+import java.util.Objects;
+import java.util.function.Consumer;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.mockito.ArgumentCaptor;
+import org.springframework.transaction.TransactionStatus;
+import org.springframework.transaction.support.TransactionTemplate;
+import static com.baiyue.lastleg.selfoperated.analytics.model.SelfopSupport.*;
+import static org.junit.jupiter.api.Assertions.*;
+import static org.mockito.ArgumentMatchers.*;
+import static org.mockito.Mockito.*;
+
+class SelfopInventoryRecoveryTest {
+    private final SelfopSyncScopeMapper scopes = mock(SelfopSyncScopeMapper.class);
+    private final SelfopOutboundDiscoveryScopeMapper accounts = mock(SelfopOutboundDiscoveryScopeMapper.class);
+    private final SelfopSyncTaskMapper tasks = mock(SelfopSyncTaskMapper.class);
+    private final SelfopSyncRunMapper runs = mock(SelfopSyncRunMapper.class);
+    private final SelfopCoordinationMapper locks = mock(SelfopCoordinationMapper.class);
+    private final SelfopLeaseService leases = mock(SelfopLeaseService.class);
+    private final SelfopAnalyticsProperties config = new SelfopAnalyticsProperties();
+    private final SelfopLeaseService.Lease lease = new SelfopLeaseService.Lease(10L, "worker", 7L, false);
+    private final SelfopTaskService service = new SelfopTaskService(scopes, accounts, tasks, runs, locks, config, leases);
+    private SelfopSyncTask task;
+    private SelfopSyncRun original;
+    private SelfopSyncScope inventory;
+
+    @BeforeEach void prepare() {
+        task = new SelfopSyncTask(); task.setExecutionPurpose("BUSINESS"); task.setTaskNo("LXCOL-20261012-00000001"); task.setId(1L); task.setScopeId(10L); task.setSourceAccount("demo");
+        task.setWarehouseCode("A"); task.setTaskRole("WAREHOUSE_SYNC"); task.setStatus("RUNNING");
+        task.setApplyState("NOT_APPLICABLE"); task.setAttemptCount(1); task.setScopeHash("inventory-hash"); task.setQueryScopeJson("{}");
+        var manifest = new SelfopRoutingManifest(); manifest.setNextPage(2); manifest.setTotal(3L); manifest.setPages(2);
+        manifest.getFirstScan().put("old-key", "old-value"); task.setRoutingManifestJson(json(manifest));
+        original = new SelfopSyncRun(); original.setExecutionPurpose("BUSINESS"); original.setId(20L); original.setTaskId(1L); original.setScopeId(10L);
+        original.setSourceAccount("demo"); original.setWarehouseCode("A"); original.setAttemptNo(1);
+        original.setFenceToken(6L); original.setStatus("FETCHING"); original.setBasePublishedRunId(11L);
+        original.setReferenceSalesRunId(12L); original.setScopeSnapshotJson("{\"quantityUnit\":\"PCS\"}");
+        original.setFetchStartedAtUtc(LocalDateTime.of(2026, 10, 12, 0, 0));
+        inventory = new SelfopSyncScope(); inventory.setId(10L); inventory.setDataFamily("INVENTORY");
+        inventory.setSourceAccount("demo"); inventory.setWarehouseCode("A"); inventory.setScopeHash("inventory-hash");
+        inventory.setScopeJson("{\"quantityUnit\":\"PCS\"}"); inventory.setPublishedRunId(90L);
+        inventory.setBusinessTimezone("UTC"); inventory.setStaleAfterSeconds(93600);
+        var sales = new SelfopSyncScope(); sales.setId(30L); sales.setDataFamily("OUTBOUND"); sales.setPublishedRunId(80L);
+        when(locks.lockTask(1L)).thenReturn(task); when(locks.lockRun(20L)).thenReturn(original);
+        when(locks.lockScope(30L)).thenReturn(sales); when(scopes.selectById(10L)).thenReturn(inventory); when(scopes.selectOne(any())).thenReturn(sales);
+        config.setCollectionMode("BUSINESS"); config.setEnvironment("production"); config.setRequestBudget(10); config.setTimeBudgetSeconds(60); config.setInventoryPageSize(2);
+    }
+
+    @Test void budgetYieldResumesSameAttemptWithFixedReferencesAndOriginalObservationStart() {
+        String cursor = task.getRoutingManifestJson(); String snapshot = original.getScopeSnapshotJson();
+        var started = original.getFetchStartedAtUtc();
+        original.setFenceToken(lease.fence());
+        service.yield(1L, 20L, lease);
+        assertEquals("YIELDED", original.getStatus()); assertEquals("RETRY_WAIT", task.getStatus());
+        assertNotNull(original.getFinishedAtUtc());
+        when(runs.selectOne(any())).thenReturn(null, original);
+        var resumed = service.begin(1L, lease);
+        assertSame(original, resumed); assertEquals(20L, resumed.getId()); assertEquals(1, resumed.getAttemptNo());
+        assertEquals(11L, resumed.getBasePublishedRunId()); assertEquals(12L, resumed.getReferenceSalesRunId());
+        assertEquals(snapshot, resumed.getScopeSnapshotJson()); assertEquals(started, resumed.getFetchStartedAtUtc());
+        assertEquals(cursor, task.getRoutingManifestJson()); assertEquals(1, task.getAttemptCount());
+        assertEquals(7L, resumed.getFenceToken()); assertEquals("FETCHING", resumed.getStatus()); assertNull(resumed.getFinishedAtUtc());
+        verify(runs, never()).insert(any(SelfopSyncRun.class));
+    }
+    @Test void resumedInventoryReplacesYieldSnapshotWithFinalProgressWithoutChangingHistoricalAttempt(){
+        original.setFenceToken(lease.fence());
+        SelfopProgressProjection.applyCheckpoint(task,original,"INVENTORY","PAGE",1,4L,1);
+        service.yield(1L,20L,lease);
+        var yielded=read(original.getProgressSnapshotJson(),java.util.Map.class);
+        assertEquals(1,yielded.get("completed"));assertNotNull(yielded.get("summaryAsOf"));
+        var history=new SelfopSyncRun();history.setId(19L);history.setAttemptNo(0);
+        String historical="{\"attemptNo\":0,\"completed\":9,\"summaryAsOf\":\"2026-10-12T00:00:00Z\"}";
+        history.setProgressSnapshotJson(historical);
+        when(runs.selectOne(any())).thenReturn(null,original);
+        var resumed=service.begin(1L,lease);assertSame(original,resumed);assertNull(resumed.getProgressSnapshotJson());
+        var update=ArgumentCaptor.forClass(com.baomidou.mybatisplus.core.conditions.Wrapper.class);
+        verify(runs).update(isNull(),update.capture());
+        assertTrue(((com.baomidou.mybatisplus.core.conditions.update.UpdateWrapper<?>)update.getValue()).getSqlSet().contains("progress_snapshot_json"));
+        SelfopProgressProjection.applyCheckpoint(task,resumed,"INVENTORY","PAGE",4,4L,1);
+        java.time.Instant before=java.time.Instant.now();SelfopProgressProjection.freezeRun(task,resumed);
+        java.time.Instant after=java.time.Instant.now();var finished=read(resumed.getProgressSnapshotJson(),java.util.Map.class);
+        assertEquals(4,finished.get("completed"));var asOf=java.time.Instant.parse((String)finished.get("summaryAsOf"));
+        assertFalse(asOf.isBefore(before));assertFalse(asOf.isAfter(after));assertNotEquals(yielded,finished);
+        SelfopProgressProjection.freezeRun(task,history);assertEquals(historical,history.getProgressSnapshotJson());
+    }
+
+    @Test void genuineFailureClearsCursorAndNewAttemptStartsAtPageOneWithItsOwnStageBatch() {
+        original.setFenceToken(lease.fence());
+        when(runs.selectCount(any())).thenReturn(1L);
+        service.fail(1L, 20L,SelfopFailure.coded("SELFOP_STOCK_DUPLICATE", true), lease);
+        assertEquals("FAILED", original.getStatus()); assertNull(task.getRoutingManifestJson());
+        assertEquals("RETRY_WAIT", task.getStatus());
+        // Verifies the final updateById cannot overwrite the explicit SQL-null cursor reset.
+        verify(tasks).updateById(argThat((SelfopSyncTask t) -> t.getRoutingManifestJson() == null));
+        when(runs.selectOne(any())).thenReturn(null);
+        var fresh = service.begin(1L, lease);
+        assertNotEquals(original.getId(), fresh.getId()); assertEquals(2, fresh.getAttemptNo());
+        assertEquals(90L, fresh.getBasePublishedRunId()); assertEquals(80L, fresh.getReferenceSalesRunId());
+        var client = mock(LingxingAnalyticsClient.class); var stages = mock(SelfopSyncStageMapper.class);
+        var stock = new SelfopPayloads.Stock("demo", "customer", "A", "sku", 0, null,
+            BigDecimal.ONE, BigDecimal.ONE, BigDecimal.ZERO, BigDecimal.ZERO, null);
+        when(client.inventory(any(SelfopRequestContext.class), eq("A"), eq(1), eq(2))).thenReturn(new LingxingAnalyticsClient.Page<>(List.of(stock), 1, 2, 1L, 1));
+        var tx = mock(TransactionTemplate.class);
+        doAnswer(invocation -> {
+            Consumer<TransactionStatus> callback = invocation.getArgument(0); callback.accept(mock(TransactionStatus.class)); return null;
+        }).when(tx).executeWithoutResult(any());
+        when(locks.lockRun(fresh.getId())).thenReturn(fresh);
+        var collector = new SelfopInventoryCollector(client, stages, tasks, runs, leases, service, config, tx);
+        assertTrue(collector.collect(task, fresh, lease));
+        var saved = ArgumentCaptor.forClass(SelfopSyncStage.class); verify(stages).insert(saved.capture());
+        assertEquals(fresh.getId(), saved.getValue().getStageBatchId()); assertEquals(fresh.getId(), saved.getValue().getRunId());
+        assertEquals(1, saved.getValue().getFirstPageNo()); verify(client).inventory(any(SelfopRequestContext.class), eq("A"), eq(1), eq(2));
+    }
+
+    @Test void exhaustedFailuresRetainOldPublishedPointerAndCannotCreateAnotherAttempt() {
+        original.setFenceToken(lease.fence());
+        when(runs.selectCount(any())).thenReturn((long) config.getMaxAttempts());
+        service.fail(1L, 20L,SelfopFailure.coded("SOURCE_TIMEOUT", true), lease);
+        assertEquals("DEAD", task.getStatus()); assertEquals("FAILED", original.getStatus());
+        assertEquals(90L, inventory.getPublishedRunId()); assertEquals(11L, original.getBasePublishedRunId());
+        assertThrows(IllegalStateException.class, () -> service.begin(1L, lease));
+        verify(runs, never()).insert(any(SelfopSyncRun.class)); verify(scopes, never()).updateById(any(SelfopSyncScope.class));
+    }
+
+    @Test void expiredFetchingAttemptStartsFreshWithoutReusingCursorEvenIfFailNeverRan() {
+        // Process dies after accepted page one but before failure bookkeeping can clear its task cursor.
+        String oldSnapshot = original.getScopeSnapshotJson(); var oldStarted = original.getFetchStartedAtUtc();
+        when(runs.selectOne(any())).thenReturn(original, null);
+        var replacement = service.begin(1L, lease);
+        assertNotEquals(original.getId(), replacement.getId()); assertEquals(2, replacement.getAttemptNo());
+        assertNull(task.getRoutingManifestJson()); assertEquals("ABORTED", original.getStatus());
+        assertEquals("LEASE_EXPIRED", original.getErrorCode()); assertNotNull(original.getFinishedAtUtc());
+        assertEquals(oldSnapshot, original.getScopeSnapshotJson()); assertEquals(oldStarted, original.getFetchStartedAtUtc());
+        assertEquals(11L, original.getBasePublishedRunId()); assertEquals(12L, original.getReferenceSalesRunId());
+        assertEquals(90L, replacement.getBasePublishedRunId()); assertEquals(80L, replacement.getReferenceSalesRunId());
+        // Clearing NULL needs explicit SQL because default updateById omits null-valued properties.
+        var update = ArgumentCaptor.forClass(com.baomidou.mybatisplus.core.conditions.Wrapper.class);
+        verify(tasks).update(isNull(), update.capture());
+        var wrapper = (com.baomidou.mybatisplus.core.conditions.update.UpdateWrapper<?>) update.getValue();
+        assertTrue(wrapper.getSqlSet().contains("routing_manifest_json"));
+        assertTrue(wrapper.getParamNameValuePairs().values().stream().anyMatch(Objects::isNull));
+        verify(runs).insert(replacement);
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/sync/SelfopMasterDataCollectorTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/sync/SelfopMasterDataCollectorTest.java
new file mode 100644
index 000000000..e42d7e31a
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/sync/SelfopMasterDataCollectorTest.java
@@ -0,0 +1,86 @@
+package com.baiyue.lastleg.selfoperated.analytics.sync;
+
+import com.baiyue.lastleg.selfoperated.analytics.client.LingxingAnalyticsClient;
+import com.baiyue.lastleg.selfoperated.analytics.mapper.*;
+import com.baiyue.lastleg.selfoperated.analytics.model.*;
+import org.junit.jupiter.api.*;
+import org.springframework.transaction.TransactionStatus;
+import org.springframework.transaction.support.TransactionTemplate;
+import org.springframework.dao.DuplicateKeyException;
+import java.util.*;
+import java.util.function.Consumer;
+import static org.junit.jupiter.api.Assertions.*;
+import static org.mockito.Mockito.*;
+import static org.mockito.ArgumentMatchers.*;
+
+class SelfopMasterDataCollectorTest {
+    final LingxingAnalyticsClient client=mock(LingxingAnalyticsClient.class);
+    final SelfopMasterDataMapper data=mock(SelfopMasterDataMapper.class);
+    final SelfopSyncTaskMapper tasks=mock(SelfopSyncTaskMapper.class);
+    final SelfopSyncRunMapper runs=mock(SelfopSyncRunMapper.class);
+    final SelfopTaskService service=mock(SelfopTaskService.class);
+    final SelfopLeaseService leases=mock(SelfopLeaseService.class);
+    final SelfopAnalyticsProperties config=new SelfopAnalyticsProperties();
+    final TransactionTemplate tx=mock(TransactionTemplate.class);
+    final SelfopSyncTask task=new SelfopSyncTask();final SelfopSyncRun run=new SelfopSyncRun();
+    final SelfopLeaseService.Lease lease=new SelfopLeaseService.Lease(1L,"owner",2L,true);
+    SelfopMasterDataCollector collector;
+    @BeforeEach void setup(){
+        config.setEnvironment("production");task.setId(10L);task.setTaskType("MASTER_DATA");task.setExecutionPurpose("BUSINESS");task.setSourceAccount("A");task.setTaskNo("LXCOL-DEMO");
+        run.setId(20L);run.setTaskId(10L);run.setExecutionPurpose("BUSINESS");run.setStatus("FETCHING");run.setAttemptNo(1);
+        when(service.checkpoint(task,run,lease)).thenReturn(new SelfopTaskService.CollectionCheckpoint(task,run));
+        doAnswer(i->{Consumer<TransactionStatus> c=i.getArgument(0);c.accept(mock(TransactionStatus.class));return null;}).when(tx).executeWithoutResult(any());
+        when(client.customers(any(),eq(1),eq(1000))).thenReturn(new LingxingAnalyticsClient.Page<>(List.of(new SelfopPayloads.Owner("C","客户","0")),1,1000,1L,1));
+        when(data.ownerCount(20L,"A")).thenReturn(1L);
+        collector=new SelfopMasterDataCollector(client,data,tasks,runs,service,leases,config,tx);
+    }
+    SelfopPayloads.Product product(String code,String sku){return new SelfopPayloads.Product(code,sku,"商品",null,null,null,"cm",null,null,null,null);}
+    @Test void publishesBothDirectoriesOnlyAfterBothCountsMatch(){
+        when(client.products(any(),eq(1),eq(100))).thenReturn(new LingxingAnalyticsClient.Page<>(List.of(product("C","SKU"),product("D","SKU")),1,100,2L,1));
+        when(data.productCount(20L,"A")).thenReturn(2L);
+        collector.collect(task,run,lease);
+        verify(client,never()).products(any(),anyInt(),anyInt());
+        collector.collect(task,run,lease);
+        assertEquals("PUBLISHED",run.getStatus());assertEquals("SUCCEEDED",task.getStatus());assertEquals(3L,run.getUniqueObjectCount());
+        verify(data,times(2)).insertProduct(anyLong(),eq(20L),eq("A"),any(),any());verify(service,times(1)).yield(anyLong(),anyLong(),any());
+    }
+    @Test void countMismatchCannotPublish(){
+        when(client.products(any(),eq(1),eq(100))).thenReturn(new LingxingAnalyticsClient.Page<>(List.of(product("C","SKU")),1,100,1L,1));
+        collector.collect(task,run,lease);
+        assertEquals("SELFOP_MASTER_COUNT_MISMATCH",assertThrows(IllegalStateException.class,()->collector.collect(task,run,lease)).getMessage());
+        assertNotEquals("PUBLISHED",run.getStatus());
+    }
+    @Test void duplicateFailsInsteadOfDeduplicatingPartialCatalog(){
+        doThrow(new DuplicateKeyException("duplicate")).when(data).insertOwner(anyLong(),anyLong(),anyString(),any(),any());
+        assertEquals("SELFOP_MASTER_DUPLICATE",assertThrows(IllegalStateException.class,()->collector.collect(task,run,lease)).getMessage());
+        verify(client,never()).products(any(),anyInt(),anyInt());
+    }
+    @Test void lostFenceCannotPersistLateResponse(){
+        when(service.checkpoint(task,run,lease)).thenThrow(new IllegalStateException("FENCE_LOST"));
+        assertThrows(IllegalStateException.class,()->collector.collect(task,run,lease));verifyNoInteractions(data);
+    }
+    @Test void yieldsAndResumesSameBatchWithoutRepeatingCustomerPage(){
+        for(int page=1;page<=6;page++){
+            var rows=new ArrayList<SelfopPayloads.Product>();for(int n=0;n<100;n++)rows.add(product("C","SKU-"+page+"-"+n));
+            when(client.products(any(),eq(page),eq(100))).thenReturn(new LingxingAnalyticsClient.Page<>(rows,page,100,600L,6));
+        }
+        when(data.productCount(20L,"A")).thenReturn(600L);
+        collector.collect(task,run,lease);verify(service).yield(10L,20L,lease);assertNotEquals("PUBLISHED",run.getStatus());
+        verify(client,never()).products(any(),anyInt(),anyInt());
+        for(int page=1;page<=6;page++){
+            collector.collect(task,run,lease);
+            verify(client,times(page)).products(any(),anyInt(),anyInt());
+            if(page<6)assertNotEquals("PUBLISHED",run.getStatus());
+        }
+        assertEquals("PUBLISHED",run.getStatus());verify(client,times(1)).customers(any(),eq(1),eq(1000));
+        verify(service,times(6)).yield(10L,20L,lease);
+        verify(data,times(600)).insertProduct(anyLong(),eq(20L),eq("A"),any(),any());
+    }
+    @Test void changedTotalRejectsBeforePersistence(){
+        var manifest=new SelfopMasterDataCollector.Manifest();
+        var rows=Collections.nCopies(100,product("C","SKU"));
+        SelfopMasterDataCollector.validatePage(manifest,new LingxingAnalyticsClient.Page<>(rows,1,100,201L,3),100);
+        manifest.setNextPage(2);
+        assertEquals("SELFOP_PAGE_TOTAL_CHANGED",assertThrows(IllegalStateException.class,()->SelfopMasterDataCollector.validatePage(manifest,new LingxingAnalyticsClient.Page<>(rows,2,100,202L,3),100)).getMessage());
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/sync/SelfopObservationReservationTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/sync/SelfopObservationReservationTest.java
new file mode 100644
index 000000000..090860e78
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/sync/SelfopObservationReservationTest.java
@@ -0,0 +1,22 @@
+package com.baiyue.lastleg.selfoperated.analytics.sync;
+
+import com.baiyue.lastleg.selfoperated.analytics.mapper.*;
+import com.baiyue.lastleg.selfoperated.analytics.model.*;
+import org.junit.jupiter.api.Test;
+import static com.baiyue.lastleg.selfoperated.analytics.model.SelfopSupport.utcNow;
+import static org.junit.jupiter.api.Assertions.*;
+import static org.mockito.Mockito.*;
+
+class SelfopObservationReservationTest {
+    @Test void consecutiveBatchReservationsRetainFenceAndSingleObservationSemantics() {
+        var locks=mock(SelfopCoordinationMapper.class);var accounts=mock(SelfopOutboundDiscoveryScopeMapper.class);
+        var row=new SelfopOutboundDiscoveryScope();row.setId(1L);row.setLeaseOwner("worker");row.setFenceToken(2L);
+        row.setLeaseUntilUtc(utcNow().plusMinutes(1));row.setNextObservationSequence(101L);when(locks.lockDiscovery(1L)).thenReturn(row);
+        var service=new SelfopLeaseService(locks,mock(SelfopSyncScopeMapper.class),accounts,new SelfopAnalyticsProperties());
+        var lease=new SelfopLeaseService.Lease(1L,"worker",2L,true);
+        assertEquals(101L,service.nextObservations(lease,100));assertEquals(201L,service.nextObservation(lease));assertEquals(202L,row.getNextObservationSequence());
+        assertThrows(IllegalStateException.class,()->service.nextObservations(lease,0));assertThrows(IllegalStateException.class,()->service.nextObservations(lease,101));
+        assertThrows(IllegalStateException.class,()->service.nextObservations(new SelfopLeaseService.Lease(1L,"old-worker",1L,true),10));
+        assertEquals(202L,row.getNextObservationSequence());verify(accounts,times(2)).updateById(row);
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/sync/SelfopProgressServiceTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/sync/SelfopProgressServiceTest.java
new file mode 100644
index 000000000..2f4bbadd8
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/sync/SelfopProgressServiceTest.java
@@ -0,0 +1,118 @@
+package com.baiyue.lastleg.selfoperated.analytics.sync;
+
+import com.baiyue.lastleg.selfoperated.analytics.mapper.*;
+import com.baiyue.lastleg.selfoperated.analytics.model.*;
+import org.junit.jupiter.api.Test;
+import java.nio.charset.StandardCharsets;
+import java.util.Map;
+import java.util.List;
+import java.time.Instant;
+import java.time.LocalDateTime;
+import static com.baiyue.lastleg.selfoperated.analytics.model.SelfopSupport.*;
+import static org.junit.jupiter.api.Assertions.*;
+import static org.mockito.Mockito.*;
+import static org.mockito.ArgumentMatchers.*;
+
+class SelfopProgressServiceTest {
+    private SelfopSyncTask task(){var t=new SelfopSyncTask();t.setId(1L);t.setAttemptCount(1);t.setTaskRole("ACCOUNT_DISCOVERY");t.setDiscoveryScopeId(3L);return t;}
+    private SelfopSyncRun run(){var r=new SelfopSyncRun();r.setId(2L);r.setTaskId(1L);r.setAttemptNo(1);r.setFenceToken(8L);return r;}
+    @Test void repeatedCheckpointUsesCommittedCountAndReliablePhaseDenominatorOnly() {
+        var t=task();var r=run();
+        SelfopProgressProjection.applyCheckpoint(t,r,"DIRECTORY","PAGE",3,8L,1);
+        SelfopProgressProjection.applyCheckpoint(t,r,"DIRECTORY","PAGE",3,8L,1);
+        var p=read(t.getProgressJson(),Map.class);
+        assertEquals(3,p.get("completed"));assertEquals("ACCOUNT_SHARED",p.get("progressScope"));assertEquals("TASK_CUMULATIVE",p.get("countBasis"));
+        assertEquals(37.5,((Number)p.get("phasePercent")).doubleValue());assertFalse(p.containsKey("totalPercent"));
+        assertNotNull(r.getHeartbeatAtUtc());assertTrue(t.getProgressJson().getBytes(StandardCharsets.UTF_8).length<=8192);
+        SelfopProgressProjection.applyCheckpoint(t,r,"DIRECTORY","PAGE",2,null,2);
+        p=read(t.getProgressJson(),Map.class);assertNull(p.get("phasePercent"));assertEquals(false,p.get("totalKnown"));assertEquals(2,p.get("scanRound"));
+    }
+    @Test void inventoryRowsAndEmptyResultDoNotBecomeSkuCountOrWholeJobSuccess() {
+        var t=task();t.setTaskRole("WAREHOUSE_SYNC");var r=run();
+        SelfopProgressProjection.applyCheckpoint(t,r,"INVENTORY","INVENTORY_ROW",0,0L,1);
+        var p=read(t.getProgressJson(),Map.class);assertNull(p.get("phasePercent"));assertEquals("ATTEMPT_ONLY",p.get("countBasis"));
+        assertEquals("WAREHOUSE",p.get("progressScope"));assertNull(t.getStatus());
+        assertThrows(IllegalStateException.class,()->SelfopProgressProjection.applyCheckpoint(t,r,"INVENTORY","SKU",1,1L,1));
+    }
+    @Test void frozenAttemptDoesNotFollowLaterAttemptProgress() {
+        var t=task();var r=run();SelfopProgressProjection.applyCheckpoint(t,r,"DETAIL","ORDER",4,10L,1);
+        SelfopProgressProjection.freezeRun(t,r);String frozen=r.getProgressSnapshotJson();
+        var next=run();next.setId(4L);next.setAttemptNo(2);
+        SelfopProgressProjection.applyCheckpoint(t,next,"DETAIL","ORDER",7,10L,1);
+        SelfopProgressProjection.freezeRun(t,r);assertEquals(frozen,r.getProgressSnapshotJson());
+        var unfrozen=run();assertThrows(IllegalStateException.class,()->SelfopProgressProjection.freezeRun(t,unfrozen));
+    }
+    @Test void terminalPhaseKeepsReliableStageHistoryAndUtcStringsForReadContract() {
+        var t=task();t.setQueryFromUtc(LocalDateTime.of(2026,10,11,16,0));t.setQueryUntilUtc(t.getQueryFromUtc().plusDays(1));var r=run();
+        SelfopProgressProjection.applyCheckpoint(t,r,"DETAIL","ORDER",4,4L,1);
+        SelfopProgressProjection.applyCheckpoint(t,r,"SAMPLE_DONE","NONE",0,null,1);
+        var p=read(t.getProgressJson(),Map.class);assertFalse(p.containsKey("phases"));
+        var stages=(List<?>)p.get("stages");assertEquals(2,stages.size());var detail=(Map<?,?>)stages.get(0);
+        assertEquals("DETAIL",detail.get("phase"));assertEquals(4,detail.get("completed"));assertEquals(true,detail.get("totalKnown"));
+        assertEquals(Instant.parse("2026-10-11T16:00:00Z"),Instant.parse((String)detail.get("sliceFrom")));
+        assertDoesNotThrow(()->Instant.parse((String)detail.get("stageStartedAt")));
+        assertDoesNotThrow(()->Instant.parse((String)p.get("stageStartedAt")));
+    }
+    @Test void staleFenceCannotChangeCheckpointOrHeartbeat() {
+        var locks=mock(SelfopCoordinationMapper.class);var tasks=mock(SelfopSyncTaskMapper.class);var runs=mock(SelfopSyncRunMapper.class);var leases=mock(SelfopLeaseService.class);
+        var lease=new SelfopLeaseService.Lease(3,"old",7,true);when(locks.lockTask(1)).thenReturn(task());when(locks.lockRun(2)).thenReturn(run());
+        var service=new SelfopProgressService(locks,tasks,runs,leases);
+        assertThrows(IllegalStateException.class,()->service.checkpoint(1,2,lease,"DETAIL","ORDER",1,3L,1));
+        assertThrows(IllegalStateException.class,()->service.heartbeat(1,2,lease));
+        verify(tasks,never()).updateById(any(SelfopSyncTask.class));verify(runs,never()).updateById(any(SelfopSyncRun.class));
+        var order=inOrder(leases,locks);order.verify(leases).verify(lease);order.verify(locks).lockTask(1);order.verify(locks).lockRun(2);
+    }
+    @Test void terminalSnapshotHasActualFreezeTimeAndResumeCannotKeepPausedEtaBaseline(){
+        var t=task();var r=run();SelfopProgressProjection.applyCheckpoint(t,r,"DETAIL","ORDER",4,10L,1);
+        assertTrue(read(t.getProgressJson(),Map.class).containsKey("etaSamples"));
+        Instant before=Instant.now();SelfopProgressProjection.freezeRun(t,r);Instant after=Instant.now();
+        var snapshot=read(r.getProgressSnapshotJson(),Map.class);Instant asOf=Instant.parse((String)snapshot.get("summaryAsOf"));
+        assertFalse(asOf.isBefore(before));assertFalse(asOf.isAfter(after));assertFalse(snapshot.containsKey("etaSamples"));
+        assertFalse(read(t.getProgressJson(),Map.class).containsKey("etaSamples"));
+        SelfopProgressProjection.applyCheckpoint(t,r,"DETAIL","ORDER",5,10L,1);
+        var points=(List<?>)((Map<?,?>)read(t.getProgressJson(),Map.class).get("etaSamples")).get("p");assertEquals(1,points.size());
+        var fallback=run();SelfopProgressProjection.freezeRun(task(),fallback);
+        assertNotNull(read(fallback.getProgressSnapshotJson(),Map.class).get("summaryAsOf"));
+    }
+    @Test void etaIsFirstToBeDroppedAtEightKiBWhileCandidateAndAuditEvidenceRemain(){
+        var t=task();var r=run();SelfopProgressProjection.applyCheckpoint(t,r,"DETAIL","ORDER",1,100L,1);
+        var p=new java.util.LinkedHashMap<String,Object>(read(t.getProgressJson(),Map.class));p.remove("etaSamples");
+        p.put("candidateBuild",Map.of("committedBatches",7));
+        p.put("audit", "x".repeat(Math.max(0,8192-json(p).getBytes(StandardCharsets.UTF_8).length-80)));
+        t.setProgressJson(json(p));SelfopProgressProjection.applyCheckpoint(t,r,"DETAIL","ORDER",2,100L,1);
+        var result=read(t.getProgressJson(),Map.class);assertFalse(result.containsKey("etaSamples"));
+        assertEquals(Map.of("committedBatches",7),result.get("candidateBuild"));assertEquals(p.get("audit"),result.get("audit"));
+        assertTrue(t.getProgressJson().getBytes(StandardCharsets.UTF_8).length<=8192);
+    }
+    @Test void localWorkProofIsBoundToTheCommittedScopeAndUpstream(){
+        var t=task();t.setScopeHash("scope-1");t.setUpstreamTaskId(99L);
+        SelfopProgressProjection.localWorkReady(t,true);var p=read(t.getProgressJson(),Map.class);
+        assertEquals(true,p.get("localWorkReady"));assertEquals("scope-1",p.get("localWorkReadyScopeHash"));assertEquals("99",p.get("localWorkReadyUpstreamTaskId"));
+        SelfopProgressProjection.applyCheckpoint(t,run(),"MERGE","ORDER",0,4L,0);
+        assertEquals(true,read(t.getProgressJson(),Map.class).get("localWorkReady"));
+        var next=run();next.setAttemptNo(2);SelfopProgressProjection.applyCheckpoint(t,next,"MERGE","ORDER",1,4L,0);
+        assertEquals(true,read(t.getProgressJson(),Map.class).get("localWorkReady"));
+        t.setScopeHash("scope-2");next.setAttemptNo(3);SelfopProgressProjection.applyCheckpoint(t,next,"MERGE","ORDER",1,4L,0);
+        assertFalse(read(t.getProgressJson(),Map.class).containsKey("localWorkReady"));
+        SelfopProgressProjection.localWorkReady(t,false);assertEquals(false,read(t.getProgressJson(),Map.class).get("localWorkReady"));
+    }
+    @Test void exactLegacyEightKiBCheckpointFreezesWithoutLosingBusinessOrAuditCounts(){
+        var t=task();var r=run();SelfopProgressProjection.applyCheckpoint(t,r,"DETAIL","ORDER",4,10L,1);
+        var p=new java.util.LinkedHashMap<String,Object>(read(t.getProgressJson(),Map.class));p.remove("etaSamples");
+        p.put("candidateBuild",Map.of("committedBatches",7));p.put("audit","");
+        p.put("audit","x".repeat(8192-json(p).getBytes(StandardCharsets.UTF_8).length));t.setProgressJson(json(p));
+        assertEquals(8192,t.getProgressJson().getBytes(StandardCharsets.UTF_8).length);
+        assertDoesNotThrow(()->SelfopProgressProjection.freezeRun(t,r));var frozen=read(r.getProgressSnapshotJson(),Map.class);
+        assertNotNull(frozen.get("summaryAsOf"));assertEquals(4,frozen.get("completed"));assertEquals(10,frozen.get("total"));
+        assertEquals(p.get("candidateBuild"),frozen.get("candidateBuild"));assertEquals(p.get("audit"),frozen.get("audit"));
+        assertTrue(r.getProgressSnapshotJson().getBytes(StandardCharsets.UTF_8).length<=8192);
+        var stage=(Map<?,?>)((List<?>)frozen.get("stages")).get(0);assertEquals(4,stage.get("completed"));assertEquals(10,stage.get("total"));
+    }
+    @Test void minimalFullSizeLegacyCheckpointNeverFailsBusinessEndForOptionalTimestamp(){
+        var t=task();var r=run();var p=new java.util.LinkedHashMap<String,Object>();
+        p.put("attemptNo",1);p.put("completed",4);p.put("total",10);p.put("audit","");
+        p.put("audit","x".repeat(8192-json(p).getBytes(StandardCharsets.UTF_8).length));t.setProgressJson(json(p));
+        assertDoesNotThrow(()->SelfopProgressProjection.freezeRun(t,r));var frozen=read(r.getProgressSnapshotJson(),Map.class);
+        assertEquals(p,frozen);assertEquals(8192,r.getProgressSnapshotJson().getBytes(StandardCharsets.UTF_8).length);
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/sync/SelfopReferenceRecoveryTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/sync/SelfopReferenceRecoveryTest.java
new file mode 100644
index 000000000..d946652fd
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/sync/SelfopReferenceRecoveryTest.java
@@ -0,0 +1,118 @@
+package com.baiyue.lastleg.selfoperated.analytics.sync;
+
+import com.baiyue.lastleg.selfoperated.analytics.mapper.*;
+import com.baiyue.lastleg.selfoperated.analytics.model.*;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.springframework.transaction.TransactionStatus;
+import org.springframework.transaction.support.TransactionTemplate;
+import java.util.*;
+import java.util.function.Consumer;
+import static com.baiyue.lastleg.selfoperated.analytics.model.SelfopSupport.*;
+import static org.junit.jupiter.api.Assertions.*;
+import static org.mockito.ArgumentMatchers.*;
+import static org.mockito.Mockito.*;
+
+class SelfopReferenceRecoveryTest {
+    private final SelfopSyncStageMapper stages = mock(SelfopSyncStageMapper.class);
+    private final SelfopSyncTaskMapper tasks = mock(SelfopSyncTaskMapper.class);
+    private final SelfopSyncScopeMapper scopes = mock(SelfopSyncScopeMapper.class);
+    private final SelfopOutboundDiscoveryScopeMapper accounts = mock(SelfopOutboundDiscoveryScopeMapper.class);
+    private final SelfopCoordinationMapper locks = mock(SelfopCoordinationMapper.class);
+    private final SelfopLeaseService leases = mock(SelfopLeaseService.class);
+    private final SelfopTaskService taskService = mock(SelfopTaskService.class);
+    private final SelfopDiscoveryService discovery = mock(SelfopDiscoveryService.class);
+    private final TransactionTemplate tx = mock(TransactionTemplate.class);
+    private final SelfopReferenceRecovery recovery = new SelfopReferenceRecovery(
+        stages, tasks, scopes, accounts, locks, leases, taskService, discovery, tx);
+    private final String key = "b".repeat(64);
+    private final Map<Long, SelfopLeaseService.Lease> held = new LinkedHashMap<>();
+    private final SelfopLeaseService.Lease accountLease = new SelfopLeaseService.Lease(50, "account-worker", 2, true);
+    private final SelfopSyncTask original = new SelfopSyncTask();
+    private final SelfopSyncTask refresh = new SelfopSyncTask();
+    private final SelfopSyncStage latest = new SelfopSyncStage();
+    private String returnedWarehouse = "B";
+
+    @BeforeEach
+    void prepare() {
+        original.setId(1L); original.setSourceAccount("demo"); original.setWarehouseCode("A");
+        original.setExecutionPurpose("BUSINESS");
+        original.setScopeHash("fixed-scope"); original.setApplyState("BLOCKED");
+        original.setAffectedWarehouseCodesJson(json(List.of("A", "B")));
+        var manifest = new SelfopRoutingManifest();
+        var ref = new SelfopRoutingManifest.Entry();
+        ref.setEffectiveStageId(20L); ref.setCustomerCode("customer"); ref.setDeliveryNo("delivery"); ref.setWarehouseCode("A");
+        manifest.getObjects().put(key, ref); original.setRoutingManifestJson(json(manifest));
+        var current = new SelfopSyncStage(); current.setId(20L); current.setObservationSequence(1L);
+        latest.setId(21L); latest.setObservationSequence(2L); latest.setWarehouseCode("B");
+        when(stages.selectById(20L)).thenReturn(current); when(stages.selectOne(any())).thenReturn(latest);
+        var account = new SelfopOutboundDiscoveryScope(); account.setId(50L);
+        when(accounts.selectOne(any())).thenReturn(account);
+        when(leases.acquireDiscovery(eq(50L), anyString())).thenReturn(accountLease);
+        for (long id : new long[]{10, 11}) {
+            held.put(id, new SelfopLeaseService.Lease(id, "warehouse-worker", 3, false));
+            var scope = new SelfopSyncScope(); scope.setWarehouseCode(id == 10 ? "A" : "B");
+            when(scopes.selectById(id)).thenReturn(scope);
+        }
+        refresh.setId(40L); refresh.setStatus("READY"); refresh.setExecutionPurpose("BUSINESS");
+        when(taskService.create(any(SelfopSyncTask.class))).thenReturn(refresh);
+        when(tasks.selectById(40L)).thenReturn(refresh);
+        var run = new SelfopSyncRun(); run.setId(80L); run.setExecutionPurpose("BUSINESS");
+        when(taskService.begin(40L, accountLease)).thenReturn(run);
+        when(locks.lockTask(1L)).thenReturn(original);
+        doAnswer(invocation -> {
+            Consumer<TransactionStatus> callback = invocation.getArgument(0);
+            callback.accept(mock(TransactionStatus.class)); return null;
+        }).when(tx).executeWithoutResult(any());
+        doAnswer(invocation -> {
+            var newManifest = new SelfopRoutingManifest(); var result = new SelfopRoutingManifest.Entry();
+            result.setEffectiveStageId(22L); result.setWarehouseCode(returnedWarehouse);
+            newManifest.getObjects().put(key, result);
+            refresh.setRoutingManifestJson(json(newManifest)); refresh.setStatus("SUCCEEDED"); return null;
+        }).when(discovery).collect(refresh, run, accountLease);
+    }
+
+    @Test
+    void newerObservationRequiresActualRecheckAndKeepsOriginalHalfApplyBarrier() {
+        recovery.refresh(original, held);
+        var reference = read(original.getRoutingManifestJson(), SelfopRoutingManifest.class).getObjects().get(key);
+        assertEquals(22L, reference.getEffectiveStageId()); assertEquals("B", reference.getWarehouseCode());
+        assertEquals(40L, reference.getRefreshTaskId()); assertEquals(2L, reference.getNewestSeenSequence());
+        assertEquals("BLOCKED", original.getApplyState());
+        assertEquals(json(List.of("A", "B")), original.getAffectedWarehouseCodesJson());
+        verify(taskService).create(argThat(t -> "ACCOUNT_DISCOVERY".equals(t.getTaskRole())
+            && "RECHECK".equals(t.getTaskType())
+            && Objects.equals(1L, read(t.getQueryScopeJson(), SelfopDiscoveryService.Query.class).parentTaskId())));
+        verify(discovery).collect(eq(refresh), any(SelfopSyncRun.class), eq(accountLease));
+        verify(tasks).updateById(original); verify(leases).release(accountLease);
+    }
+
+    @Test
+    void unchangedObservationDoesNotRequestAnotherSourceRead() {
+        latest.setObservationSequence(1L);
+        var before = original.getRoutingManifestJson(); recovery.refresh(original, held);
+        assertEquals(before, original.getRoutingManifestJson());
+        verifyNoInteractions(taskService, discovery, accounts, locks, leases);
+    }
+
+    @Test
+    void budgetYieldCannotReplaceEffectiveReferenceOrClearBarrier() {
+        doAnswer(invocation -> { refresh.setStatus("RETRY_WAIT"); return null; })
+            .when(discovery).collect(eq(refresh), any(SelfopSyncRun.class), eq(accountLease));
+        var before = original.getRoutingManifestJson();
+        var error = assertThrows(IllegalStateException.class, () -> recovery.refresh(original, held));
+        assertEquals("SELFOP_RECHECK_YIELDED", error.getMessage());
+        assertEquals(before, original.getRoutingManifestJson()); assertEquals("BLOCKED", original.getApplyState());
+        verify(tasks, never()).updateById(any(SelfopSyncTask.class)); verify(leases).release(accountLease);
+    }
+
+    @Test
+    void recheckMovingToAnUnleasedWarehouseMustReacquireBeforeAnyParentWrite() {
+        returnedWarehouse = "C";
+        var before = original.getRoutingManifestJson();
+        var error = assertThrows(IllegalStateException.class, () -> recovery.refresh(original, held));
+        assertEquals("LOCK_SET_CHANGED", error.getMessage());
+        assertEquals(before, original.getRoutingManifestJson()); assertEquals("BLOCKED", original.getApplyState());
+        verify(tasks, never()).updateById(any(SelfopSyncTask.class)); verify(leases).release(accountLease);
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/sync/SelfopReusedRunScopeSqlTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/sync/SelfopReusedRunScopeSqlTest.java
new file mode 100644
index 000000000..e4c6f3946
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/sync/SelfopReusedRunScopeSqlTest.java
@@ -0,0 +1,102 @@
+package com.baiyue.lastleg.selfoperated.analytics.sync;
+
+import com.baiyue.lastleg.selfoperated.analytics.mapper.SelfopCoordinationMapper;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import org.apache.ibatis.mapping.BoundSql;
+import org.apache.ibatis.mapping.MappedStatement;
+import org.apache.ibatis.scripting.defaults.DefaultParameterHandler;
+import org.apache.ibatis.session.Configuration;
+import org.junit.jupiter.api.*;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.ValueSource;
+import java.sql.*;
+import java.time.LocalDateTime;
+import java.util.*;
+import static org.junit.jupiter.api.Assertions.*;
+
+/** Executes production JOIN/predicates/assignments offline. Only MySQL UPDATE JOIN syntax is
+ * adapted to H2 MERGE; this does not prove MySQL optimizer choices or lock isolation. */
+public class SelfopReusedRunScopeSqlTest {
+    Connection db; MappedStatement statement; BoundSql bound;
+    final Map<String,Object> params=Map.of("scope",7L,"account","SYNTH-ACCOUNT","warehouse","SYNTH-A",
+        "hash","scope-hash","published",900L,"now",LocalDateTime.of(2026,10,14,0,0));
+
+    @BeforeEach void setup() throws Exception {
+        db=DriverManager.getConnection("jdbc:h2:mem:"+UUID.randomUUID()+";MODE=MySQL;DATABASE_TO_LOWER=TRUE","sa","");
+        execute("CREATE TABLE ll_selfop_sync_task(id BIGINT PRIMARY KEY,scope_id BIGINT,source_account VARCHAR,warehouse_code VARCHAR,scope_hash VARCHAR,result_published_run_id BIGINT,attempt_count INT,execution_purpose VARCHAR,progress_json VARCHAR)");
+        execute("CREATE TABLE ll_selfop_sync_run(id BIGINT PRIMARY KEY,task_id BIGINT,scope_id BIGINT,source_account VARCHAR,warehouse_code VARCHAR,scope_hash VARCHAR,attempt_no INT,execution_purpose VARCHAR,status VARCHAR,finished_at_utc TIMESTAMP,updated_at TIMESTAMP,progress_snapshot_json VARCHAR)");
+        execute("CREATE ALIAS JSON_EXTRACT FOR '"+getClass().getName()+".jsonExtract'");
+        var config=new Configuration();config.addMapper(SelfopCoordinationMapper.class);
+        statement=config.getMappedStatement(SelfopCoordinationMapper.class.getName()+".completeReusedRuns");
+        bound=statement.getBoundSql(params);
+    }
+    @AfterEach void close() throws Exception {db.close();}
+    public static String jsonExtract(String body,String path) throws Exception {
+        if(body==null)return null;assertEquals("$.attemptNo",path);
+        var value=new ObjectMapper().readTree(body).get("attemptNo");return value==null?null:value.asText();
+    }
+    void execute(String sql,Object...args) throws Exception {
+        try(var p=db.prepareStatement(sql)){for(int n=0;n<args.length;n++)p.setObject(n+1,args[n]);p.executeUpdate();}
+    }
+    void pair(long id,String status) throws Exception {
+        execute("INSERT INTO ll_selfop_sync_task VALUES (?,7,'SYNTH-ACCOUNT','SYNTH-A','scope-hash',900,2,'BUSINESS',?)",id+1000,"{\"attemptNo\":2,\"checkpoint\":\"kept\"}");
+        execute("INSERT INTO ll_selfop_sync_run VALUES (?,?,7,'SYNTH-ACCOUNT','SYNTH-A','scope-hash',2,'BUSINESS',?,NULL,NULL,NULL)",id,id+1000,status);
+    }
+    Map<String,Object> row(long id) throws Exception {
+        try(var p=db.prepareStatement("SELECT * FROM ll_selfop_sync_run WHERE id=?")){p.setLong(1,id);try(var r=p.executeQuery()){assertTrue(r.next());var out=new TreeMap<String,Object>();for(int n=1;n<=r.getMetaData().getColumnCount();n++)out.put(r.getMetaData().getColumnLabel(n),r.getObject(n));return out;}}
+    }
+    int update() throws Exception {
+        String sql=bound.getSql().replaceAll("\\s+"," ").trim();
+        int set=sql.indexOf(" SET "),where=sql.indexOf(" WHERE ");assertTrue(sql.startsWith("UPDATE ")&&set>0&&where>set);
+        String from=sql.substring(7,set),predicate=sql.substring(where+7);
+        // Assignment order preserves MyBatis parameter order. No test-owned selection predicate.
+        var projection=new ArrayList<String>();var assignments=new ArrayList<String>();
+        for(String assignment:sql.substring(set+5,where).split(",(?=r\\.)")){
+            int equal=assignment.indexOf('=');String column=assignment.substring(0,equal).replace("r.","");
+            String expression=assignment.substring(equal+1);
+            // H2 cannot infer a bare parameter's type in a derived table; production columns are timestamps.
+            if(expression.equals("?")){assertTrue(column.equals("finished_at_utc")||column.equals("updated_at"));expression="CAST(? AS TIMESTAMP)";}
+            projection.add(expression+" AS "+column);assignments.add("destination."+column+"=source."+column);
+        }
+        String adapted="MERGE INTO ll_selfop_sync_run destination USING (SELECT r.id,"+String.join(",",projection)+" FROM "+from+" WHERE "+predicate+") source ON destination.id=source.id WHEN MATCHED THEN UPDATE SET "+String.join(",",assignments);
+        try(var p=db.prepareStatement(adapted)){new DefaultParameterHandler(statement,params,bound).setParameters(p);return p.executeUpdate();}
+    }
+    @Test void nonemptyMatchingAttemptsCompleteAllFourEligibleStatusesAndKeepProgress() throws Exception {
+        String[] statuses={"FETCHING","FACTS_APPLIED","BUILDING","READY"};
+        for(int n=0;n<statuses.length;n++)pair(11+n,statuses[n]);
+        execute("UPDATE ll_selfop_sync_run SET progress_snapshot_json=? WHERE id=11","{\"frozen\":true}");
+        pair(900,"READY");var publishedBefore=row(900);
+        assertEquals(4,update());assertEquals(publishedBefore,row(900),"publishing run must not become REUSED");
+        for(int n=0;n<4;n++){var r=row(11+n);assertEquals("REUSED",r.get("status"));assertEquals(Timestamp.valueOf((LocalDateTime)params.get("now")),r.get("finished_at_utc"));assertEquals(r.get("finished_at_utc"),r.get("updated_at"));assertEquals(n==0?"{\"frozen\":true}":"{\"attemptNo\":2,\"checkpoint\":\"kept\"}",r.get("progress_snapshot_json"));}
+        assertEquals(0,update(),"already completed attempts are untouched");
+    }
+    @ParameterizedTest @ValueSource(strings={"scope_id","source_account","warehouse_code","scope_hash"})
+    void eitherSideOutsidePublishedScopeIsUntouchedWhileValidSiblingCompletes(String column) throws Exception {
+        pair(11,"READY");pair(12,"READY");pair(13,"READY");pair(14,"READY");
+        Object wrong=column.equals("scope_id")?8L:"different";
+        execute("UPDATE ll_selfop_sync_run SET "+column+"=? WHERE id=12",wrong);
+        execute("UPDATE ll_selfop_sync_task SET "+column+"=? WHERE id=1013",wrong);
+        execute("UPDATE ll_selfop_sync_run SET "+column+"=? WHERE id=14",wrong);
+        execute("UPDATE ll_selfop_sync_task SET "+column+"=? WHERE id=1014",wrong);
+        var before=Map.of(12L,row(12),13L,row(13),14L,row(14));
+        assertEquals(1,update());assertEquals("REUSED",row(11).get("status"));
+        for(var item:before.entrySet())assertEquals(item.getValue(),row(item.getKey()),"foreign association must not be changed: "+column);
+    }
+    @ParameterizedTest @ValueSource(strings={"old-attempt","wrong-result","run-validation","task-validation","PUBLISHED","FAILED","DEAD","REUSED","null-scope"})
+    void existingPurposeAttemptPointerAndStatusGatesRemain(String fault) throws Exception {
+        pair(11,"READY");pair(12,"READY");
+        switch(fault){
+            case "old-attempt" -> execute("UPDATE ll_selfop_sync_run SET attempt_no=1 WHERE id=12");
+            case "wrong-result" -> execute("UPDATE ll_selfop_sync_task SET result_published_run_id=901 WHERE id=1012");
+            case "run-validation" -> execute("UPDATE ll_selfop_sync_run SET execution_purpose='VALIDATION' WHERE id=12");
+            case "task-validation" -> execute("UPDATE ll_selfop_sync_task SET execution_purpose='VALIDATION' WHERE id=1012");
+            case "null-scope" -> execute("UPDATE ll_selfop_sync_task SET scope_id=NULL WHERE id=1012");
+            default -> execute("UPDATE ll_selfop_sync_run SET status=? WHERE id=12",fault);
+        }
+        var before=row(12);assertEquals(1,update());assertEquals("REUSED",row(11).get("status"));assertEquals(before,row(12));
+    }
+    @Test void mismatchedProgressAttemptIsNotCopiedIntoCompletedRun() throws Exception {
+        pair(11,"READY");execute("UPDATE ll_selfop_sync_task SET progress_json=? WHERE id=1011","{\"attemptNo\":1}");
+        assertEquals(1,update());assertEquals("REUSED",row(11).get("status"));assertNull(row(11).get("progress_snapshot_json"));
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/sync/SelfopSalesPublisherTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/sync/SelfopSalesPublisherTest.java
new file mode 100644
index 000000000..35b370ead
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/sync/SelfopSalesPublisherTest.java
@@ -0,0 +1,133 @@
+package com.baiyue.lastleg.selfoperated.analytics.sync;
+
+import com.baiyue.lastleg.selfoperated.analytics.mapper.SelfopSyncScopeMapper;
+import com.baiyue.lastleg.selfoperated.analytics.mapper.SelfopSyncRunMapper;
+import com.baiyue.lastleg.selfoperated.analytics.mapper.SelfopSyncTaskMapper;
+import com.baiyue.lastleg.selfoperated.analytics.mapper.SelfopCoordinationMapper;
+import com.baiyue.lastleg.selfoperated.analytics.model.*;
+import com.baiyue.lastleg.selfoperated.analytics.outbound.OutboundAggregateMapper;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.springframework.transaction.annotation.Transactional;
+import java.time.LocalDateTime;
+import static org.junit.jupiter.api.Assertions.*;
+import static org.mockito.Mockito.*;
+
+/** Gate assertions are offline; actual transaction rollback/concurrency needs database acceptance. */
+class SelfopSalesPublisherTest {
+    final SelfopCoordinationMapper locks=mock(SelfopCoordinationMapper.class);
+    final SelfopSyncScopeMapper scopes=mock(SelfopSyncScopeMapper.class);
+    final SelfopSyncRunMapper runs=mock(SelfopSyncRunMapper.class);
+    final SelfopSyncTaskMapper tasks=mock(SelfopSyncTaskMapper.class);
+    final SelfopAnalyticsProperties config=new SelfopAnalyticsProperties();
+    final OutboundAggregateMapper aggregates=mock(OutboundAggregateMapper.class);
+    final SelfopSalesPublisher publisher=new SelfopSalesPublisher(locks,scopes,runs,tasks,config,aggregates);
+    SelfopSyncScope scope; SelfopSyncRun run; SelfopSyncTask task;
+
+    @BeforeEach void setup() {
+        scope=new SelfopSyncScope(); scope.setId(1L); scope.setSourceAccount("synthetic-account"); scope.setWarehouseCode("synthetic-warehouse");
+        scope.setDataFamily("OUTBOUND"); scope.setScopeHash("confirmed-synthetic-scope"); scope.setSourceTimezone("UTC");
+        scope.setLeaseOwner("worker"); scope.setFenceToken(3L); scope.setLeaseUntilUtc(SelfopSupport.utcNow().plusHours(1));
+        scope.setFactRevision(7L); scope.setPublishedFactRevision(6L); scope.setPublishedRunId(9L); scope.setRebuildRequired(1);
+        run=new SelfopSyncRun(); run.setExecutionPurpose("BUSINESS"); run.setAttemptNo(1); run.setSourceAccount("synthetic-account"); run.setScopeSnapshotJson("{\"quantityUnit\":\"PCS\",\"sourceTimezone\":\"UTC\"}"); run.setId(10L); run.setScopeId(1L); run.setTaskId(20L); run.setScopeHash(scope.getScopeHash());
+        run.setFenceToken(3L); run.setRunRole("WAREHOUSE_SYNC"); run.setStatus("READY"); run.setCalculatedFactRevision(7L);run.setWarehouseDailyReady(true);
+        run.setBuildStartedAtUtc(SelfopSupport.utcNow().minusSeconds(1));run.setFetchStartedAtUtc(SelfopSupport.utcNow().minusSeconds(2));
+        run.setCoverageStatus("COMPLETE"); run.setCoveredFromUtc(LocalDateTime.of(2026,9,12,8,0)); run.setCoveredUntilUtc(LocalDateTime.of(2026,10,12,8,0));
+        SelfopSalesCoverage.freeze(run,java.util.List.of(new SelfopSalesCoverage.Interval(run.getCoveredFromUtc(),run.getCoveredUntilUtc())));
+        task=new SelfopSyncTask(); task.setExecutionPurpose("BUSINESS"); task.setTaskNo("LXCOL-20261012-00000020"); task.setId(20L); task.setApplyState("APPLIED"); task.setStatus("RUNNING"); task.setTaskType("SCHEDULED");
+        when(locks.lockScope(1L)).thenReturn(scope); when(locks.lockRun(10L)).thenReturn(run); when(locks.lockTask(20L)).thenReturn(task);
+    }
+    private void enableSyntheticPublication() { config.setCollectionMode("BUSINESS"); config.setEnvironment("production"); config.setSalesPublicationEnabled(true); config.setQuantityUnit("PCS"); }
+    @Test void disconnectedTargetPublishesOnlyWithFrozenProofAndKeepsGapUnknown(){
+        enableSyntheticPublication();var first=LocalDateTime.of(2026,10,6,16,0);var latest=LocalDateTime.of(2026,10,11,16,0);
+        run.setCoveredFromUtc(first);run.setCoveredUntilUtc(first.plusDays(1));
+        task.setQueryFromUtc(latest);task.setQueryUntilUtc(latest.plusDays(1));
+        SelfopSalesCoverage.freeze(run,java.util.List.of(new SelfopSalesCoverage.Interval(first,first.plusDays(1))));
+        assertEquals("SELFOP_TASK_COVERAGE_UNPROVEN",assertThrows(IllegalStateException.class,()->publisher.publish(1,10,"worker",3)).getMessage());
+        noWrites();
+        SelfopSalesCoverage.freeze(run,java.util.List.of(new SelfopSalesCoverage.Interval(first,first.plusDays(1)),new SelfopSalesCoverage.Interval(latest,latest.plusDays(1))));
+        publisher.publish(1,10,"worker",3);assertEquals("SUCCEEDED",task.getStatus());
+        assertEquals(first.plusDays(1),scope.getDiscoveryUntilUtc());
+        assertFalse(SelfopSalesCoverage.contains(SelfopSalesCoverage.evidence(run),first,latest.plusDays(1)));
+    }
+    @Test void latestDayCanPublishBeforeOldPlannedAnchorIsFilled(){
+        enableSyntheticPublication();var latest=LocalDateTime.of(2026,10,11,16,0);
+        scope.setInitialFromUtc(latest.minusMonths(2));run.setCoveredFromUtc(null);run.setCoveredUntilUtc(null);run.setCoverageStatus("UNKNOWN");
+        task.setQueryFromUtc(latest);task.setQueryUntilUtc(latest.plusDays(1));
+        SelfopSalesCoverage.freeze(run,java.util.List.of(new SelfopSalesCoverage.Interval(latest,latest.plusDays(1))));
+        publisher.publish(1,10,"worker",3);assertEquals("SUCCEEDED",task.getStatus());
+        assertEquals(latest.minusMonths(2),scope.getInitialFromUtc());assertNull(run.getCoveredUntilUtc());
+    }
+    @Test void reuseCannotCompleteLatestDayUsingOnlyOldIsland(){
+        enableSyntheticPublication();var first=LocalDateTime.of(2026,10,6,16,0);var latest=LocalDateTime.of(2026,10,11,16,0);
+        var published=new SelfopSyncRun();published.setId(9L);published.setScopeId(1L);published.setScopeHash(scope.getScopeHash());
+        published.setExecutionPurpose("BUSINESS");published.setStatus("PUBLISHED");published.setWarehouseDailyReady(true);published.setCalculatedFactRevision(7L);
+        published.setScopeSnapshotJson("{}");SelfopSalesCoverage.freeze(published,java.util.List.of(new SelfopSalesCoverage.Interval(first,first.plusDays(1))));
+        when(runs.selectById(9L)).thenReturn(published);task.setQueryFromUtc(latest);task.setQueryUntilUtc(latest.plusDays(1));
+        assertEquals("SELFOP_TASK_COVERAGE_UNPROVEN",assertThrows(IllegalStateException.class,()->publisher.reuse(1,10,9,"worker",3)).getMessage());
+        assertEquals("RUNNING",task.getStatus());verify(tasks,never()).update(any(),any());
+    }
+    private void noWrites() { verifyNoInteractions(scopes,runs,tasks); assertEquals(9L,scope.getPublishedRunId()); }
+
+    @Test void salesPublicationIsDisabledByDefaultBeforeAnyDatabaseRead() {
+        assertFalse(config.isSalesPublicationEnabled());
+        IllegalStateException error=assertThrows(IllegalStateException.class,()->publisher.publish(1,10,"worker",3));
+        assertEquals("SELFOP_SALES_PUBLICATION_DISABLED",error.getMessage()); verifyNoInteractions(locks); noWrites();
+    }
+    @Test void expiredLeaseCannotSwitchPointer() {
+        enableSyntheticPublication(); scope.setLeaseUntilUtc(SelfopSupport.utcNow().minusSeconds(1));
+        assertThrows(IllegalStateException.class,()->publisher.publish(1,10,"worker",3)); noWrites();
+    }
+    @Test void missingWarehouseDailyBuildCannotPublishOrPassIdempotentReturn() {
+        enableSyntheticPublication();run.setWarehouseDailyReady(false);
+        assertEquals("SELFOP_WAREHOUSE_DAILY_NOT_READY",assertThrows(IllegalStateException.class,()->publisher.publish(1,10,"worker",3)).getMessage());
+        noWrites();scope.setPublishedRunId(10L);run.setStatus("PUBLISHED");
+        assertEquals("SELFOP_WAREHOUSE_DAILY_NOT_READY",assertThrows(IllegalStateException.class,()->publisher.publish(1,10,"worker",3)).getMessage());
+        verifyNoInteractions(scopes,runs,tasks);
+    }
+    @Test void deadHalfAppliedTaskStillBlocksUnrelatedReadyCandidate() {
+        enableSyntheticPublication(); task.setApplyState("BLOCKED"); task.setStatus("DEAD");
+        when(locks.barriers(scope.getSourceAccount(),scope.getWarehouseCode())).thenReturn(1L);
+        IllegalStateException error=assertThrows(IllegalStateException.class,()->publisher.publish(1,10,"worker",3));
+        assertEquals("HALF_APPLIED_FACTS",error.getMessage()); noWrites();
+        verify(locks,never()).lockTask(20L);
+    }
+    @Test void revisionMismatchRejectsOtherwiseCompleteCandidate() {
+        enableSyntheticPublication(); scope.setFactRevision(8L);
+        IllegalStateException error=assertThrows(IllegalStateException.class,()->publisher.publish(1,10,"worker",3));
+        assertEquals("SELFOP_CANDIDATE_OBSOLETE",error.getMessage()); noWrites();
+    }
+    @Test void newObservationRejectsCandidateEvenWithoutFactRevisionChange() {
+        enableSyntheticPublication();
+        when(aggregates.observationsChangedSince(scope.getSourceAccount(),scope.getWarehouseCode(),run.getBuildStartedAtUtc())).thenReturn(1L);
+        var error=assertThrows(IllegalStateException.class,()->publisher.publish(1,10,"worker",3));
+        assertEquals("SELFOP_CANDIDATE_OBSERVATION_CHANGED",error.getMessage());noWrites();
+        verify(locks,never()).lockTask(20L);
+    }
+    @Test void unconfirmedSourceTimezoneOrUnitCannotPublish() {
+        enableSyntheticPublication(); scope.setSourceTimezone(null);
+        assertThrows(IllegalStateException.class,()->publisher.publish(1,10,"worker",3)); noWrites();
+        scope.setSourceTimezone("UTC"); config.setQuantityUnit(null);
+        assertThrows(IllegalStateException.class,()->publisher.publish(1,10,"worker",3)); noWrites();
+    }
+    @Test void completeCandidatePublishesScopeRunAndTaskInsideOneTransactionBoundary() throws Exception {
+        enableSyntheticPublication();
+        publisher.publish(1,10,"worker",3);
+        assertEquals(10L,scope.getPublishedRunId()); assertEquals(7L,scope.getPublishedFactRevision()); assertEquals(0,scope.getRebuildRequired());
+        assertEquals(run.getCoveredFromUtc(),scope.getDiscoveryFromUtc()); assertEquals(run.getCoveredUntilUtc(),scope.getDiscoveryUntilUtc());
+        assertEquals("PUBLISHED",run.getStatus()); assertNotNull(run.getPublishedAtUtc()); assertEquals("SUCCEEDED",task.getStatus());
+        var ordered=inOrder(locks,scopes,runs,tasks);
+        ordered.verify(locks).lockScope(1L); ordered.verify(locks).lockRun(10L);
+        ordered.verify(locks).barriers(scope.getSourceAccount(),scope.getWarehouseCode()); ordered.verify(locks).lockTask(20L);
+        ordered.verify(runs).update(isNull(),any());
+        ordered.verify(scopes).updateById(any(SelfopSyncScope.class));
+        ordered.verify(runs).updateById(any(SelfopSyncRun.class)); ordered.verify(tasks).updateById(any(SelfopSyncTask.class));
+        ordered.verify(locks).completeCoveredTasks(eq(1L),eq(scope.getScopeHash()),eq(10L),eq(run.getCoveredFromUtc()),eq(run.getCoveredUntilUtc()),any());
+        ordered.verify(locks).completeReusedRuns(eq(1L),eq(scope.getSourceAccount()),eq(scope.getWarehouseCode()),eq(scope.getScopeHash()),eq(10L),any());
+        ordered.verify(locks).completeCoveredMarkers(eq(1L),eq(scope.getScopeHash()),eq(10L),eq(run.getCoveredUntilUtc()),any());
+        assertNotNull(SelfopSalesPublisher.class.getMethod("publish",long.class,long.class,String.class,long.class).getAnnotation(Transactional.class));
+        assertEquals(10L,task.getResultPublishedRunId());assertNotNull(run.getProgressSnapshotJson());
+        // Publisher constructor has no inventory repositories or inventory publication prerequisite.
+        verifyNoMoreInteractions(scopes,runs,tasks);
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/sync/SelfopSchedulePlannerTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/sync/SelfopSchedulePlannerTest.java
new file mode 100644
index 000000000..8830c0629
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/sync/SelfopSchedulePlannerTest.java
@@ -0,0 +1,400 @@
+package com.baiyue.lastleg.selfoperated.analytics.sync;
+
+import com.baiyue.lastleg.selfoperated.analytics.mapper.*;
+import com.baiyue.lastleg.selfoperated.analytics.model.*;
+import org.junit.jupiter.api.Test;
+import org.mockito.ArgumentCaptor;
+import org.springframework.transaction.TransactionStatus;
+import org.springframework.transaction.support.TransactionTemplate;
+import java.time.LocalDateTime;
+import java.util.List;
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.Map;
+import java.util.function.Consumer;
+import static org.assertj.core.api.Assertions.*;
+import static org.mockito.Mockito.*;
+
+class SelfopSchedulePlannerTest {
+    @Test void dailyPlanningNeverResetsRetryBudgetByReplacingWaitingOrExhaustedRoot(){
+        var state=continuousState();var now=LocalDateTime.of(2026,10,13,4,0);
+        planner.planContinuous(now);
+        var root=state.stream().filter(t->t.getRequestKey().startsWith("continuous:outbound:2026-10-12:")).findFirst().orElseThrow();
+        String key=root.getRequestKey();int count=state.size();
+        for(String status:List.of("RETRY_WAIT","DEAD")) {
+            root.setStatus(status);root.setAttemptCount(103);
+            planner.planContinuous(now.plusMinutes(1));
+            assertThat(state).hasSize(count);assertThat(state.stream().filter(t->key.equals(t.getRequestKey()))).containsExactly(root);
+            assertThat(root.getStatus()).isEqualTo(status);assertThat(root.getAttemptCount()).isEqualTo(103);
+        }
+    }
+    @Test void masterCatalogIsOneAccountBatchAndAnUnfinishedBatchSpansDays(){
+        var state=continuousState();
+        planner.planContinuous(LocalDateTime.of(2026,10,13,4,0));
+        var master=state.stream().filter(t->"MASTER_DATA".equals(t.getTaskType())).findFirst().orElseThrow();
+        assertThat(SelfopCollectionPolicy.continuousBusinessRoot(master)).isTrue();assertThat(master.getWarehouseCode()).isNull();
+        planner.planContinuous(LocalDateTime.of(2026,10,14,4,0));
+        assertThat(state.stream().filter(t->"MASTER_DATA".equals(t.getTaskType()))).hasSize(1);
+        master.setStatus("SUCCEEDED");planner.planContinuous(LocalDateTime.of(2026,10,14,4,1));
+        planner.planContinuous(LocalDateTime.of(2026,10,14,4,2));
+        assertThat(state.stream().filter(t->"MASTER_DATA".equals(t.getTaskType()))).hasSize(2);
+    }
+    @Test void continuousInventoryWaitsForTodaysSlotAndNeverBackfillsPreviousDays(){
+        var state=continuousState();
+        var manual7=dayRoot("RUNNING",7,"manual:7");var manual6=dayRoot("READY",6,"manual:6");
+        state.add(manual7);state.add(manual6);
+        planner.planContinuous(LocalDateTime.of(2026,10,12,23,59));
+        assertThat(state).noneMatch(t->"WAREHOUSE_SYNC".equals(t.getTaskRole()));
+        planner.planContinuous(LocalDateTime.of(2026,10,13,0,0));
+        var inventory=state.stream().filter(t->"WAREHOUSE_SYNC".equals(t.getTaskRole())).toList();
+        assertThat(inventory).hasSize(1);assertThat(inventory.get(0).getPlannedAtUtc()).isEqualTo(LocalDateTime.of(2026,10,13,0,0));
+        assertThat(inventory.get(0).getNextRetryAtUtc()).isEqualTo(inventory.get(0).getPlannedAtUtc());
+        assertThat(SelfopCollectionPolicy.continuousBusinessRoot(inventory.get(0))).isTrue();
+        planner.planContinuous(LocalDateTime.of(2026,10,13,12,0));
+        planner.planContinuous(LocalDateTime.of(2026,10,13,16,0));
+        assertThat(state.stream().filter(t->"WAREHOUSE_SYNC".equals(t.getTaskRole()))).hasSize(1);
+        planner.planContinuous(LocalDateTime.of(2026,10,14,0,0));
+        assertThat(state.stream().filter(t->"WAREHOUSE_SYNC".equals(t.getTaskRole()))).hasSize(2);
+        assertThat(manual7.getStatus()).isEqualTo("RUNNING");assertThat(manual6.getStatus()).isEqualTo("READY");
+        verify(scopes,never()).updateById(any(SelfopSyncScope.class));verify(tasks,never()).updateById(any(SelfopSyncTask.class));
+    }
+    @Test void continuousInventoryRegistersOneOverdueSlotPerConfiguredWarehouse(){
+        var state=continuousState();config.getWarehouses().put("WH-B",new SelfopAnalyticsProperties.Warehouse());
+        var outboundA=scope(10L,"WH-A","OUTBOUND");outboundA.setBusinessTimezone("Asia/Shanghai");outboundA.setSourceTimezone("Asia/Shanghai");
+        var outboundB=scope(20L,"WH-B","OUTBOUND");outboundB.setBusinessTimezone("Asia/Shanghai");outboundB.setSourceTimezone("Asia/Shanghai");
+        doAnswer(call->{
+            com.baomidou.mybatisplus.core.conditions.query.QueryWrapper<?> query=call.getArgument(0);query.getSqlSegment();
+            return query.getParamNameValuePairs().containsValue("INVENTORY")?List.of(inventoryScope(11L,"WH-A"),inventoryScope(21L,"WH-B")):List.of(outboundA,outboundB);}).when(scopes).selectList(any());
+        planner.planContinuous(LocalDateTime.of(2026,10,13,12,0));planner.planContinuous(LocalDateTime.of(2026,10,13,12,1));
+        var inventory=state.stream().filter(t->"WAREHOUSE_SYNC".equals(t.getTaskRole())).toList();
+        assertThat(inventory).hasSize(2);assertThat(inventory).extracting(SelfopSyncTask::getWarehouseCode).containsExactlyInAnyOrder("WH-A","WH-B");
+        assertThat(inventory).allMatch(t->t.getPlannedAtUtc().equals(LocalDateTime.of(2026,10,13,0,0))&&SelfopCollectionPolicy.continuousBusinessRoot(t));
+    }
+    @Test void continuousPoolPersistsCompleteDaysNewestFirstAndNeverChangesCoverageAnchor(){
+        var state=continuousState();
+        planner.planContinuous(LocalDateTime.of(2026,10,13,4,0));
+        assertThat(state).hasSize(63);
+        assertThat(state.get(0).getQueryFromUtc()).isEqualTo(LocalDateTime.of(2026,10,11,16,0));
+        assertThat(state.get(60).getQueryFromUtc()).isEqualTo(LocalDateTime.of(2026,8,12,16,0));
+        assertThat(state).allMatch(SelfopCollectionPolicy::continuousBusinessRoot);
+        verify(scopes,never()).updateById(any(SelfopSyncScope.class));verify(taskService,never()).initialize();
+        planner.planContinuous(LocalDateTime.of(2026,10,13,4,1));assertThat(state).hasSize(63);
+        planner.planContinuous(LocalDateTime.of(2026,10,13,16,4));assertThat(state).hasSize(63);
+        planner.planContinuous(LocalDateTime.of(2026,10,13,16,5));assertThat(state).hasSize(64);
+        assertThat(state.get(63).getQueryFromUtc()).isEqualTo(LocalDateTime.of(2026,10,12,16,0));
+        assertThat(state).anyMatch(t->LocalDateTime.of(2026,8,12,16,0).equals(t.getQueryFromUtc()));
+    }
+    @Test void deadOldManualRootDoesNotMaskSuccessfulOrActiveDayAndContinuousFailureIsNotRecreated(){
+        var state=continuousState();
+        state.add(dayRoot("DEAD",12,"manual:old"));state.add(dayRoot("SUCCEEDED",12,"manual:success"));
+        state.add(dayRoot("RUNNING",11,"manual:running"));
+        state.add(dayRoot("DEAD",10,"manual:failed-only"));
+        planner.planContinuous(LocalDateTime.of(2026,10,13,4,0));
+        assertThat(state.stream().filter(SelfopCollectionPolicy::continuousBusinessRoot)).hasSize(61);
+        assertThat(state.stream().filter(SelfopCollectionPolicy::continuousBusinessRoot)).noneMatch(t->LocalDateTime.of(2026,10,11,16,0).equals(t.getQueryFromUtc()));
+        var root=state.stream().filter(SelfopCollectionPolicy::continuousBusinessRoot).findFirst().orElseThrow();root.setStatus("DEAD");
+        int count=state.size();planner.planContinuous(LocalDateTime.of(2026,10,13,4,1));assertThat(state).hasSize(count);
+    }
+    @Test void continuousTickReReadsOneTaskAfterEverySafeDispatch(){
+        continuousState();var subject=spy(planner);doNothing().when(subject).planContinuous(any());
+        var old=dayRoot("RETRY_WAIT",10,"manual:old");old.setId(10L);old.setRequestedBy("operator");
+        var fresh=dayRoot("READY",12,"manual:new");fresh.setId(12L);fresh.setRequestedBy("operator");
+        when(taskService.due(1)).thenReturn(List.of(old),List.of(fresh));
+        subject.tick();subject.tick();
+        var order=inOrder(taskService,execution);order.verify(taskService).due(1);order.verify(execution).execute(10L);
+        order.verify(taskService).due(1);order.verify(execution).execute(12L);verify(taskService,never()).due(10);
+    }
+    private List<SelfopSyncTask> continuousState(){
+        directTransactions();config.setEnvironment("test");config.setContinuousBusinessCollectionEnabled(true);
+        config.setSourceAccount("synthetic");config.setSourceQueryTimezone("Asia/Shanghai");
+        config.getWarehouses().put("WH-A",new SelfopAnalyticsProperties.Warehouse());
+        var scope=scope(10L,"WH-A","OUTBOUND");scope.setBusinessTimezone("Asia/Shanghai");scope.setSourceTimezone("Asia/Shanghai");
+        scope.setScopeHash("a".repeat(64));scope.setInitialFromUtc(LocalDateTime.of(2026,10,7,16,0));
+        var stock=inventoryScope(11L,"WH-A");
+        when(scopes.selectList(any())).thenAnswer(call->{
+            com.baomidou.mybatisplus.core.conditions.query.QueryWrapper<?> query=call.getArgument(0);query.getSqlSegment();
+            return query.getParamNameValuePairs().containsValue("INVENTORY")?List.of(stock):List.of(scope);});
+        var account=new SelfopOutboundDiscoveryScope();account.setId(30L);when(taskService.initializeAccount()).thenReturn(account);
+        var state=new ArrayList<SelfopSyncTask>();when(tasks.selectList(any())).thenAnswer(call->{
+            com.baomidou.mybatisplus.core.conditions.query.QueryWrapper<?> query=call.getArgument(0);query.getSqlSegment();
+            if(!query.getParamNameValuePairs().containsValue("BACKFILL"))return new ArrayList<>(state);
+            // Model the actual database projection so deduplication tests cannot rely on unselected fields.
+            assertThat(query.getSqlSelect()).isEqualTo("request_key,query_from_utc,query_until_utc,scope_hash,status,query_scope_json");
+            return state.stream().map(source->{
+                var row=new SelfopSyncTask();row.setRequestKey(source.getRequestKey());
+                row.setQueryFromUtc(source.getQueryFromUtc());row.setQueryUntilUtc(source.getQueryUntilUtc());
+                row.setScopeHash(source.getScopeHash());row.setStatus(source.getStatus());row.setQueryScopeJson(source.getQueryScopeJson());
+                return row;
+            }).toList();
+        });
+        when(tasks.selectCount(any())).thenAnswer(call->{
+            com.baomidou.mybatisplus.core.conditions.query.QueryWrapper<?> query=call.getArgument(0);query.getSqlSegment();
+            var values=query.getParamNameValuePairs().values();
+            return state.stream().filter(t->"MASTER_DATA".equals(t.getTaskType())).filter(t->values.contains("MASTER_DATA")?List.of("READY","RUNNING","RETRY_WAIT").contains(t.getStatus()):values.contains(t.getRequestKey())).count();
+        });
+        when(taskService.create(any())).thenAnswer(call->{SelfopSyncTask task=call.getArgument(0);task.setStatus("READY");state.add(task);return task;});return state;
+    }
+    private SelfopSyncTask dayRoot(String status,int day,String key){
+        var root=controlled(100L+day,"ACCOUNT_DISCOVERY","BACKFILL",key);root.setDiscoveryScopeId(30L);root.setScopeHash("a".repeat(64));root.setStatus(status);
+        var from=LocalDateTime.of(2026,10,day,0,0);root.setQueryFromUtc(from.minusHours(8));root.setQueryUntilUtc(from.plusDays(1).minusHours(8));
+        root.setQueryScopeJson(com.baiyue.lastleg.selfoperated.analytics.model.SelfopSupport.json(new SelfopDiscoveryService.Query(from.toString(),from.plusDays(1).toString(),null,null,null)));return root;
+    }
+    private SelfopSyncScope inventoryScope(long id,String warehouse){
+        var scope=scope(id,warehouse,"INVENTORY");scope.setSourceAccount("synthetic");scope.setScopeHash("b".repeat(64));
+        scope.setBusinessTimezone("Asia/Shanghai");scope.setSourceTimezone("Asia/Shanghai");
+        scope.setScopeJson(com.baiyue.lastleg.selfoperated.analytics.model.SelfopSupport.json(Map.of("sourceAccount","synthetic","warehouseCode",warehouse,"dataFamily","INVENTORY","businessTimezone","Asia/Shanghai")));return scope;
+    }
+    private final SelfopAnalyticsProperties config = new SelfopAnalyticsProperties();
+    private final SelfopTaskService taskService = mock(SelfopTaskService.class);
+    private final SelfopExecutionService execution = mock(SelfopExecutionService.class);
+    private final SelfopSyncScopeMapper scopes = mock(SelfopSyncScopeMapper.class);
+    private final SelfopOutboundDiscoveryScopeMapper accounts = mock(SelfopOutboundDiscoveryScopeMapper.class);
+    private final SelfopSyncTaskMapper tasks = mock(SelfopSyncTaskMapper.class);
+    private final SelfopOutboundOrderMapper orders = mock(SelfopOutboundOrderMapper.class);
+    private final SelfopCoordinationMapper locks = mock(SelfopCoordinationMapper.class);
+    private final TransactionTemplate tx = mock(TransactionTemplate.class);
+    private final SelfopSchedulePlanner planner = new SelfopSchedulePlanner(config, taskService, execution,
+            scopes, accounts, tasks, orders, locks, tx);
+
+    @Test void disabledTickDoesNotInitializePlanPersistOrExecuteAnything() {
+        planner.tick();
+        verifyNoInteractions(taskService, execution, scopes, accounts, tasks, orders, locks, tx);
+    }
+    @Test void testBusinessPollsManualRootAndRelatedChildrenWithoutAutomaticPlanningOrInitialization() {
+        config.setCollectionMode("BUSINESS");config.setEnvironment("test");
+        var root=controlled(101L,"ACCOUNT_DISCOVERY","BACKFILL","manual:one-day");root.setRequestedBy("42");
+        var child=controlled(102L,"WAREHOUSE_SYNC","BACKFILL","route:101:WH-A");child.setWarehouseCode("WH-A");child.setUpstreamTaskId(101L);
+        var refresh=controlled(103L,"ACCOUNT_DISCOVERY","RECHECK","refresh:101:object:4");refresh.setQueryScopeJson("{\"parentTaskId\":101}");
+        var scheduled=controlled(104L,"WAREHOUSE_SYNC","SCHEDULED","slot:old");
+        var orphan=controlled(105L,"WAREHOUSE_SYNC","BACKFILL","route:999:WH-A");orphan.setWarehouseCode("WH-A");orphan.setUpstreamTaskId(999L);
+        var other=controlled(106L,"WAREHOUSE_SYNC","BACKFILL","route:101:WH-A");other.setSourceAccount("other");other.setWarehouseCode("WH-A");other.setUpstreamTaskId(101L);
+        when(tasks.selectById(101L)).thenReturn(root);when(taskService.due(10)).thenReturn(List.of(root,child,refresh,scheduled,orphan,other));
+        planner.tick();verify(execution).execute(101L);verify(execution).execute(102L);verify(execution).execute(103L);
+        verify(execution,never()).execute(104L);verify(execution,never()).execute(105L);verify(execution,never()).execute(106L);
+        verify(taskService,never()).initialize();verify(taskService,never()).initializeAccount();verify(taskService,never()).create(any(SelfopSyncTask.class));
+        verifyNoInteractions(scopes,accounts,orders,locks,tx);
+    }
+    @Test void testRejectsDirectPlanAndReviewBeforeAnyStateOrTwoMonthWindowWrite() {
+        config.setCollectionMode("BUSINESS");config.setEnvironment("test");var preview=scope(10L,"WH-A","OUTBOUND");
+        assertThatThrownBy(()->planner.plan(preview,LocalDateTime.of(2026,10,12,4,0))).hasMessage("SELFOP_AUTOMATIC_PLANNING_ENVIRONMENT_REJECTED");
+        assertThatThrownBy(()->planner.review(preview,LocalDateTime.of(2026,10,12,4,0))).hasMessage("SELFOP_AUTOMATIC_PLANNING_ENVIRONMENT_REJECTED");
+        assertThat(preview.getInitialUntilUtc()).isNull();verifyNoInteractions(taskService,execution,scopes,accounts,tasks,orders,locks,tx);
+    }
+    private SelfopSyncTask controlled(long id,String role,String type,String key) {
+        var task=new SelfopSyncTask();task.setId(id);task.setSourceAccount("synthetic");task.setExecutionPurpose("BUSINESS");
+        task.setTaskRole(role);task.setTaskType(type);task.setRequestKey(key);return task;
+    }
+    @Test void validationWithoutConfiguredWarehouseOnlyInitializesAccountAndExecutesDurableCommand() {
+        config.setCollectionMode("VALIDATION");
+        var due=new SelfopSyncTask();due.setId(101L);due.setTaskType("VALIDATION");due.setExecutionPurpose("VALIDATION");
+        when(taskService.due(10)).thenReturn(List.of(due));
+        planner.tick();
+        verify(taskService).initializeAccount();verify(taskService,never()).initialize();verify(taskService,never()).create(any(SelfopSyncTask.class));
+        verify(execution).execute(101L);verifyNoInteractions(scopes,accounts,tasks,orders,locks,tx);
+    }
+
+    @Test void unknownSourceTimezoneStillPlansBothInventoriesAndExecutesDurableDueWork() {
+         config.setCollectionMode("BUSINESS"); config.setEnvironment("production");
+        assertThat(config.getSourceQueryTimezone()).isNull();
+        var a = scope(10L, "WH-A", "INVENTORY");
+        var b = scope(11L, "WH-B", "INVENTORY");
+        var outbound = scope(12L, "WH-A", "OUTBOUND");
+        outbound.setSourceTimezone(null);
+        var dueA = new SelfopSyncTask(); dueA.setId(101L);
+        var dueB = new SelfopSyncTask(); dueB.setId(102L);
+        when(taskService.initialize()).thenReturn(List.of(a, b, outbound));
+        when(taskService.due(10)).thenReturn(List.of(dueA, dueB));
+        var subject = spy(planner);
+        doNothing().when(subject).plan(any(SelfopSyncScope.class), any(LocalDateTime.class));
+        doNothing().when(subject).review(any(SelfopSyncScope.class), any(LocalDateTime.class));
+        // A busy warehouse must not suppress the other warehouse's independent durable work.
+        doThrow(new IllegalStateException("SELFOP_LEASE_BUSY")).when(execution).execute(101L);
+        subject.tick();
+        verify(subject).plan(eq(a), any(LocalDateTime.class));
+        verify(subject).plan(eq(b), any(LocalDateTime.class));
+        verify(subject, never()).plan(eq(outbound), any(LocalDateTime.class));
+        verify(subject, never()).review(any(SelfopSyncScope.class), any(LocalDateTime.class));
+        verify(execution).execute(101L);
+        verify(execution).execute(102L);
+        verifyNoInteractions(accounts, orders);
+    }
+
+    @Test void firstInventoryCreatedAfterDailySlotSchedulesCurrentObservationInsteadOfYesterday() {
+        directTransactions();
+        var scope = scope(10L, "WH-A", "INVENTORY");
+        var now = LocalDateTime.of(2026, 10, 12, 14, 30);
+        scope.setCreatedAt(now.minusHours(1));
+        when(locks.lockScope(10L)).thenReturn(scope);
+        planner.plan(scope, now);
+        var captured = ArgumentCaptor.forClass(SelfopSyncTask.class);
+        verify(taskService).create(captured.capture());
+        var task = captured.getValue();
+        assertThat(task.getTaskType()).isEqualTo("SCHEDULED");
+        assertThat(task.getPlannedAtUtc()).isEqualTo(now);
+        assertThat(task.getWarehouseCode()).isEqualTo("WH-A");
+        assertThat(task.getScopeId()).isEqualTo(10L);
+        assertThat(task.getQueryFromUtc()).isNull();
+        assertThat(task.getQueryUntilUtc()).isNull();
+        assertThat(scope.getInitialFromUtc()).isNull();
+        assertThat(scope.getInitialUntilUtc()).isNull();
+        verifyNoInteractions(execution, accounts, orders);
+    }
+
+    @Test void missedInventorySlotsPersistLatestDuePlanWithoutPretendingToObserveHistoricalStock() {
+        directTransactions();
+        var scope = scope(10L, "WH-A", "INVENTORY");
+        scope.setCreatedAt(LocalDateTime.of(2026, 10, 1, 0, 0));
+        var previous = new SelfopSyncTask();
+        previous.setPlannedAtUtc(LocalDateTime.of(2026, 10, 10, 8, 0));
+        when(locks.lockScope(10L)).thenReturn(scope);
+        when(tasks.selectOne(any())).thenReturn(previous);
+        planner.plan(scope, LocalDateTime.of(2026, 10, 12, 14, 30));
+        var captured = ArgumentCaptor.forClass(SelfopSyncTask.class);
+        verify(taskService).create(captured.capture());
+        var task = captured.getValue();
+        assertThat(task.getPlannedAtUtc()).isEqualTo(LocalDateTime.of(2026, 10, 12, 8, 0));
+        assertThat(task.getRequestKey()).contains("WH-A", "INVENTORY", "2026-10-12T08:00");
+        assertThat(task.getQueryFromUtc()).isNull();
+        assertThat(task.getQueryUntilUtc()).isNull();
+        assertThat(task.getRoutingManifestJson()).isNull();
+        // Planning creates no execution run or source observation; actual fetch records those later.
+        verifyNoInteractions(execution, accounts, orders);
+        verify(scopes, never()).updateById(any(SelfopSyncScope.class));
+    }
+
+    @Test void completedKnownOrderAndHistoryRoundsRemainClearedThroughFinalScopeWrite() {
+        directTransactions();
+        var scope = scope(10L, "WH-A", "OUTBOUND");
+        var now = LocalDateTime.of(2026, 10, 12, 14, 30);
+        scope.setKnownOrderCursorId(99L);
+        scope.setKnownOrderRoundMaxId(99L);
+        scope.setKnownOrderRoundStartedAtUtc(now.minusDays(1));
+        scope.setInitialFromUtc(now.minusMonths(2));
+        scope.setDiscoveryUntilUtc(now.minusHours(1));
+        scope.setHistoryRoundFromUtc(scope.getInitialFromUtc());
+        scope.setHistoryRoundUntilUtc(scope.getDiscoveryUntilUtc());
+        scope.setHistorySliceCursorUtc(scope.getDiscoveryUntilUtc());
+        when(locks.lockScope(10L)).thenReturn(scope);
+        // No further known order inside this fixed round; the history cursor is already at its end.
+        when(orders.selectOne(any())).thenReturn(null);
+        planner.review(scope, now);
+        var captured = ArgumentCaptor.forClass(SelfopSyncScope.class);
+        verify(scopes).updateById(captured.capture());
+        var persisted = captured.getValue();
+        assertThat(persisted.getKnownOrderCursorId()).isNull();
+        assertThat(persisted.getKnownOrderRoundMaxId()).isNull();
+        assertThat(persisted.getKnownOrderRoundFinishedAtUtc()).isEqualTo(now);
+        assertThat(persisted.getHistoryRoundUntilUtc()).isNull();
+        assertThat(persisted.getHistorySliceCursorUtc()).isNull();
+        assertThat(persisted.getHistoryRoundFinishedAtUtc()).isEqualTo(now);
+        verify(scopes, times(2)).update(isNull(), any());
+        verifyNoInteractions(taskService, execution, accounts, tasks);
+    }
+
+    @Test void unpublishedInitialBackfillIsNotRepeatedAcrossEightAndTwentySlots() {
+        var initial=LocalDateTime.of(2026,10,12,0,0); // Beijing 08:00
+        var scope=outboundScope(initial);var state=persistPlans(scope);
+        planner.plan(scope,initial);
+        var history=state.created.stream().filter(t->"BACKFILL".equals(t.getTaskType())).toList();
+        assertThat(history).isNotEmpty();
+        assertThat(history.get(0).getQueryFromUtc()).isEqualTo(LocalDateTime.of(2026,8,12,0,0));
+        assertThat(history.get(history.size()-1).getQueryUntilUtc()).isEqualTo(initial);
+        assertThat(history).allSatisfy(t->assertThat(t.getRequestKey()).startsWith("initial:"));
+        int firstCount=state.created.size();
+        var evening=initial.plusHours(12);
+        planner.plan(scope,evening);
+        var second=state.created.subList(firstCount,state.created.size());
+        assertThat(second).noneSatisfy(t->assertThat(t.getTaskType()).isEqualTo("BACKFILL"));
+        var increments=second.stream().filter(t->"ACCOUNT_DISCOVERY".equals(t.getTaskRole())).toList();
+        assertThat(increments).hasSize(1);
+        assertThat(increments.get(0).getTaskType()).isEqualTo("SCHEDULED");
+        assertThat(increments.get(0).getQueryFromUtc()).isEqualTo(initial);
+        assertThat(increments.get(0).getQueryUntilUtc()).isEqualTo(evening);
+        assertThat(scope.getDiscoveryUntilUtc()).isNull(); // No source execution or publication occurred.
+        assertThat(scope.getInitialUntilUtc()).isEqualTo(initial);
+        int afterEvening=state.created.size();
+        planner.plan(scope,evening.plusMinutes(1));
+        assertThat(state.created).hasSize(afterEvening);
+        assertThat(state.created.stream().map(SelfopSyncTask::getRequestKey).toList()).doesNotHaveDuplicates();
+    }
+
+    @Test void persistedRollingMonthWindowKeepsItsBoundaryWhenFirstPlanningIsDelayed() {
+        var initial=LocalDateTime.of(2026,3,31,0,0);
+        var scope=outboundScope(initial);scope.setInitialUntilUtc(initial);
+        scope.setInitialFromUtc(LocalDateTime.of(2026,1,31,0,0));
+        var state=persistPlans(scope);
+        planner.plan(scope,initial.plusHours(12));
+        var history=state.created.stream().filter(t->"BACKFILL".equals(t.getTaskType())).toList();
+        assertThat(history).hasSize(59); // Calendar months, not a fixed sixty-day subtraction.
+        assertThat(history.get(0).getQueryFromUtc()).isEqualTo(scope.getInitialFromUtc());
+        assertThat(history.get(58).getQueryUntilUtc()).isEqualTo(initial);
+        assertThat(history).allSatisfy(t->assertThat(t.getQueryUntilUtc()).isBeforeOrEqualTo(initial));
+        var incremental=state.created.stream().filter(t->"ACCOUNT_DISCOVERY".equals(t.getTaskRole())&&"SCHEDULED".equals(t.getTaskType())).toList();
+        assertThat(incremental).hasSize(1);
+        assertThat(incremental.get(0).getQueryFromUtc()).isEqualTo(initial);
+        assertThat(incremental.get(0).getQueryUntilUtc()).isEqualTo(initial.plusHours(12));
+        assertThat(scope.getInitialUntilUtc()).isEqualTo(initial);
+    }
+
+    @Test void missedLaterSlotsQueueEveryIncrementalIntervalWithoutMovingInitialWindow() {
+        var initial=LocalDateTime.of(2026,10,12,0,0);var scope=outboundScope(initial);
+        var state=persistPlans(scope);planner.plan(scope,initial);
+        int before=state.created.size();
+        planner.plan(scope,initial.plusDays(4).plusHours(12));
+        var incremental=state.created.subList(before,state.created.size()).stream()
+            .filter(t->"ACCOUNT_DISCOVERY".equals(t.getTaskRole())).toList();
+        assertThat(incremental).hasSize(5);
+        var cursor=initial;
+        for(var slice:incremental){
+            assertThat(slice.getTaskType()).isEqualTo("SCHEDULED");
+            assertThat(slice.getQueryFromUtc()).isEqualTo(cursor);
+            assertThat(slice.getQueryUntilUtc()).isAfter(cursor).isBeforeOrEqualTo(cursor.plusDays(1));
+            cursor=slice.getQueryUntilUtc();
+        }
+        assertThat(cursor).isEqualTo(initial.plusDays(4).plusHours(12));
+        assertThat(scope.getInitialFromUtc()).isEqualTo(LocalDateTime.of(2026,8,12,0,0));
+        assertThat(scope.getInitialUntilUtc()).isEqualTo(initial);
+    }
+
+    private SelfopSyncScope outboundScope(LocalDateTime created) {
+        var scope=scope(10L,"WH-A","OUTBOUND");scope.setCreatedAt(created);
+        scope.setBusinessTimezone("Asia/Shanghai");scope.setSourceTimezone("Asia/Shanghai");
+        scope.setScheduleCron("0 0 8,20 * * *");return scope;
+    }
+    private static class PlannedState {
+        final List<SelfopSyncTask> created=new ArrayList<>();
+        final Map<String,SelfopSyncTask> byKey=new HashMap<>();
+        SelfopSyncTask latest;
+    }
+    private PlannedState persistPlans(SelfopSyncScope scope) {
+        directTransactions();config.setSourceQueryTimezone("Asia/Shanghai");
+        config.getWarehouses().put("WH-A",new SelfopAnalyticsProperties.Warehouse());
+        var account=new SelfopOutboundDiscoveryScope();account.setId(30L);
+        when(accounts.selectOne(any())).thenReturn(account);when(locks.lockScope(scope.getId())).thenReturn(scope);
+        var state=new PlannedState();when(tasks.selectOne(any())).thenAnswer(call->state.latest);
+        when(taskService.create(any(SelfopSyncTask.class))).thenAnswer(call->{
+            SelfopSyncTask task=call.getArgument(0);var prior=state.byKey.get(task.getRequestKey());
+            if(prior!=null){assertThat(task.getRequestHash()).isEqualTo(prior.getRequestHash());return prior;}
+            state.byKey.put(task.getRequestKey(),task);state.created.add(task);
+            if("WAREHOUSE_SYNC".equals(task.getTaskRole()))state.latest=task;
+            return task;
+        });return state;
+    }
+
+    private SelfopSyncScope scope(long id, String warehouse, String family) {
+        var scope = new SelfopSyncScope();
+        scope.setId(id); scope.setSourceAccount("synthetic-account"); scope.setWarehouseCode(warehouse);
+        scope.setDataFamily(family); scope.setBusinessTimezone("UTC"); scope.setScheduleCron("0 0 8 * * *");
+        scope.setScopeHash("synthetic-scope-hash");
+        scope.setScopeJson("{\"customerMode\":\"ALL_AUTHORIZED\",\"qualities\":\"ALL\"}");
+        return scope;
+    }
+    private void directTransactions() {
+        config.setCollectionMode("BUSINESS"); config.setEnvironment("production");
+        doAnswer(call -> {
+            Consumer<TransactionStatus> action = call.getArgument(0);
+            action.accept(mock(TransactionStatus.class));
+            return null;
+        }).when(tx).executeWithoutResult(any());
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/sync/SelfopTaskServiceTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/sync/SelfopTaskServiceTest.java
new file mode 100644
index 000000000..d23368d36
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/sync/SelfopTaskServiceTest.java
@@ -0,0 +1,718 @@
+package com.baiyue.lastleg.selfoperated.analytics.sync;
+
+import com.baiyue.lastleg.selfoperated.analytics.mapper.*;
+import com.baiyue.lastleg.selfoperated.analytics.model.*;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.BeforeEach;
+import org.springframework.dao.DuplicateKeyException;
+import com.baomidou.mybatisplus.core.conditions.query.QueryWrapper;
+import java.time.LocalDateTime;
+import java.util.List;
+import java.util.Map;
+import static com.baiyue.lastleg.selfoperated.analytics.model.SelfopSupport.*;
+import static org.assertj.core.api.Assertions.*;
+import static org.mockito.Mockito.*;
+
+class SelfopTaskServiceTest {
+    @Test void automaticInventoryRootRequiresFrozenInventoryScopeAndDoesNotAdmitOldScheduledTasks(){
+        config.setEnvironment("test");config.setContinuousBusinessCollectionEnabled(true);
+        var scope=scope("INVENTORY");scope.setSourceAccount("synthetic-account");scope.setWarehouseCode("WH-A");scope.setScopeHash("b".repeat(64));
+        scope.setScopeJson(json(Map.of("sourceAccount","synthetic-account","warehouseCode","WH-A","dataFamily","INVENTORY","businessTimezone","Asia/Shanghai")));
+        when(scopes.selectById(10L)).thenReturn(scope);
+        var task=task("READY");task.setTaskType("SCHEDULED");task.setRequestedBy(SelfopCollectionPolicy.CONTINUOUS_PLANNER);
+        task.setScopeHash(scope.getScopeHash());task.setQueryScopeJson(scope.getScopeJson());task.setPlannedAtUtc(LocalDateTime.of(2026,10,14,0,0));
+        task.setRequestKey("continuous:inventory:WH-A:2026-10-14T00:00:"+"b".repeat(12));
+        service.create(task);assertThat(task.getBusinessRootTaskId()).isEqualTo(task.getId());
+        assertThat(SelfopCollectionPolicy.controlledBusinessTask(task,tasks::selectById,true)).isTrue();
+        assertThat(SelfopCollectionPolicy.controlledBusinessTask(task,tasks::selectById,false)).isFalse();
+        task.setRequestKey("slot:old");assertThat(SelfopCollectionPolicy.controlledBusinessTask(task,tasks::selectById,true)).isFalse();
+        task.setRequestKey("continuous:inventory:WH-A:2026-10-14T00:00:"+"b".repeat(12));
+        task.setQueryScopeJson(json(Map.of("dataFamily","OUTBOUND")));assertThat(SelfopCollectionPolicy.continuousBusinessRoot(task)).isFalse();
+    }
+    @Test void continuousRootCreationFreezesUnboundedSessionAndUsesAccountQueue(){
+        config.setEnvironment("test");config.setContinuousBusinessCollectionEnabled(true);config.setSourceAccount("synthetic-account");
+        var account=new SelfopOutboundDiscoveryScope();account.setId(20L);account.setNextSequence(1L);account.setNextObservationSequence(1L);
+        when(locks.lockDiscovery(20L)).thenReturn(account);
+        var task=new SelfopSyncTask();task.setSourceAccount("synthetic-account");task.setExecutionPurpose("BUSINESS");
+        task.setTaskRole("ACCOUNT_DISCOVERY");task.setTaskType("BACKFILL");task.setDiscoveryScopeId(20L);
+        task.setRequestedBy(SelfopCollectionPolicy.CONTINUOUS_PLANNER);task.setScopeHash("a".repeat(64));
+        task.setRequestKey("continuous:outbound:2026-10-12:"+"a".repeat(12));task.setRequestHash("digest");
+        task.setQueryFromUtc(LocalDateTime.of(2026,10,11,16,0));task.setQueryUntilUtc(LocalDateTime.of(2026,10,12,16,0));
+        task.setQueryScopeJson(json(new SelfopDiscoveryService.Query("2026-10-12T00:00","2026-10-13T00:00",null,null,null)));
+        service.create(task);assertThat(task.getBusinessRootTaskId()).isEqualTo(task.getId());
+        var budget=read(task.getBusinessBudgetJson(),com.baiyue.lastleg.selfoperated.analytics.request.SelfopBusinessBudget.class);
+        assertThat(budget.continuous).isTrue();assertThat(budget.deadlineAtUtc).isNull();assertThat(budget.limit(utcNow().plusYears(1))).isNull();
+        service.due(1);verify(locks).dueContinuous(any(),eq(1),eq("synthetic-account"));verify(locks,never()).due(any(),anyInt(),anyString());
+        task.setScopeHash("invalid-hash");assertThat(SelfopCollectionPolicy.continuousBusinessRoot(task)).isFalse();
+    }
+    private final SelfopSyncScopeMapper scopes = mock(SelfopSyncScopeMapper.class);
+    private final SelfopOutboundDiscoveryScopeMapper accounts = mock(SelfopOutboundDiscoveryScopeMapper.class);
+    private final SelfopSyncTaskMapper tasks = mock(SelfopSyncTaskMapper.class);
+    private final SelfopSyncRunMapper runs = mock(SelfopSyncRunMapper.class);
+    private final SelfopCoordinationMapper locks = mock(SelfopCoordinationMapper.class);
+    private final SelfopLeaseService leases = mock(SelfopLeaseService.class);
+    private final SelfopAnalyticsProperties config = new SelfopAnalyticsProperties();
+    private final SelfopTaskService service = new SelfopTaskService(scopes, accounts, tasks, runs, locks, config, leases);
+    private final SelfopLeaseService.Lease lease = new SelfopLeaseService.Lease(10L, "synthetic-worker", 7L, false);
+
+    @BeforeEach void configureBusiness() {config.setCollectionMode("BUSINESS");config.setEnvironment("production");}
+
+    @Test void accountInitializationNeedsNoWarehouseAndNeverTouchesWarehouseScopes() {
+        config.setCollectionMode("VALIDATION");config.setSourceAccount("synthetic-account");
+        var account=service.initializeAccount();
+        assertThat(account.getSourceAccount()).isEqualTo("synthetic-account");assertThat(account.getNextSequence()).isEqualTo(1L);
+        assertThat(account.getApiBudgetJson()).isNull();assertThat(account.getApiCooldownUntilUtc()).isNull();
+        verify(accounts).insert(account);verifyNoInteractions(scopes,tasks,runs,locks,leases);
+    }
+    @Test void existingAccountInitializationPreservesConsumedBudgetPauseAndCooldown() {
+        config.setCollectionMode("VALIDATION");config.setSourceAccount("synthetic-account");
+        var account=new SelfopOutboundDiscoveryScope();account.setId(20L);account.setSourceAccount("synthetic-account");
+        account.setApiBudgetJson("{\"reservedHttp\":7}");account.setApiPauseReason("EGRESS_REQUIRES_REVIEW");
+        account.setApiCooldownUntilUtc(utcNow().plusMinutes(10));
+        when(accounts.selectOne(any())).thenReturn(account);
+        assertThat(service.initializeAccount()).isSameAs(account);
+        assertThat(account.getApiBudgetJson()).isEqualTo("{\"reservedHttp\":7}");assertThat(account.getApiPauseReason()).isEqualTo("EGRESS_REQUIRES_REVIEW");
+        verify(accounts,never()).insert(any(SelfopOutboundDiscoveryScope.class));verify(accounts,never()).updateById(any(SelfopOutboundDiscoveryScope.class));
+        verifyNoInteractions(scopes,tasks,runs,locks,leases);
+    }
+    @Test void newDirectoryRootFreezesOnePageOneHttpSixtySecondsWithoutFakeWarehouse() {
+        config.setCollectionMode("VALIDATION");config.setSourceAccount("synthetic-account");
+        var account=new SelfopOutboundDiscoveryScope();account.setId(20L);account.setNextSequence(1L);account.setNextObservationSequence(1L);
+        when(locks.lockDiscovery(20L)).thenReturn(account);
+        var task=new SelfopSyncTask();task.setSourceAccount("synthetic-account");task.setExecutionPurpose("VALIDATION");
+        task.setTaskType("VALIDATION");task.setTaskRole("ACCOUNT_DISCOVERY");task.setDiscoveryScopeId(20L);
+        task.setRequestKey("directory");task.setRequestHash("directory-hash");task.setScopeHash("scope-hash");
+        task.setQueryScopeJson("{\"action\":\"WAREHOUSE_DISCOVERY\",\"sourceAccount\":\"synthetic-account\"}");
+        service.create(task);
+        assertThat(task.getValidationRootTaskId()).isEqualTo(task.getId());assertThat(task.getWarehouseCode()).isNull();assertThat(task.getScopeId()).isNull();
+        var budget=read(task.getValidationBudgetJson(),com.baiyue.lastleg.selfoperated.analytics.request.SelfopValidationBudget.class);
+        assertThat(budget.maxPages).isEqualTo(1);assertThat(budget.maxHttp).isEqualTo(1);assertThat(budget.maxPageSize).isEqualTo(10);
+        assertThat(budget.deadlineAtUtc).isEqualTo(budget.startedAtUtc.plusSeconds(60));assertThat(task.getApplyState()).isEqualTo("NOT_APPLICABLE");
+        verify(tasks).insert(task);verifyNoInteractions(scopes,runs,leases);
+    }
+    @Test void singleWarehouseRootKeepsFullFiveMinuteFortyHttpLimit() {
+        config.setCollectionMode("VALIDATION");config.setSourceAccount("synthetic-account");
+        var account=new SelfopOutboundDiscoveryScope();account.setId(20L);account.setNextSequence(1L);account.setNextObservationSequence(1L);
+        when(locks.lockDiscovery(20L)).thenReturn(account);
+        var task=new SelfopSyncTask();task.setSourceAccount("synthetic-account");task.setExecutionPurpose("VALIDATION");task.setTaskType("VALIDATION");
+        task.setTaskRole("ACCOUNT_DISCOVERY");task.setDiscoveryScopeId(20L);task.setRequestKey("sample");task.setRequestHash("sample-hash");
+        task.setQueryScopeJson("{\"action\":\"VALIDATION\",\"warehouses\":[\"WH-A\"]}");
+        service.create(task);
+        var budget=read(task.getValidationBudgetJson(),com.baiyue.lastleg.selfoperated.analytics.request.SelfopValidationBudget.class);
+        assertThat(budget.maxHttp).isEqualTo(40);assertThat(budget.deadlineAtUtc).isEqualTo(budget.startedAtUtc.plusSeconds(300));
+    }
+
+    @Test void beginFixesTopLevelTimezoneStalenessAndInitialWindowInVersionSnapshot() {
+        var task = task("READY");
+        var scope = scope("OUTBOUND");
+        scope.setInitialFromUtc(LocalDateTime.of(2026, 9, 12, 0, 0));
+        scope.setInitialUntilUtc(LocalDateTime.of(2026, 10, 12, 0, 0));
+        when(locks.lockTask(1L)).thenReturn(task);
+        when(scopes.selectById(10L)).thenReturn(scope);
+
+        var run = service.begin(1L, lease);
+        Map<?, ?> snapshot = read(run.getScopeSnapshotJson(), Map.class);
+        assertThat(snapshot.get("businessTimezone")).isEqualTo("America/New_York");
+        assertThat(snapshot.get("sourceTimezone")).isEqualTo("UTC");
+        assertThat(snapshot.get("staleAfterSeconds")).isEqualTo(43200);
+        assertThat(snapshot.get("initialFromUtc")).isEqualTo("2026-09-12T00:00:00");
+        assertThat(snapshot.get("initialUntilUtc")).isEqualTo("2026-10-12T00:00:00");
+        assertThat(snapshot.get("customerMode")).isEqualTo("ALL_AUTHORIZED");
+        assertThat(run.getBasePublishedRunId()).isEqualTo(90L);
+        assertThat(run.getFenceToken()).isEqualTo(7L);
+        assertThat(run.getAttemptNo()).isEqualTo(1);
+        var order = inOrder(leases, locks, runs, tasks);
+        order.verify(leases).verify(lease);
+        order.verify(locks).lockTask(1L);
+        order.verify(runs).selectOne(any());
+        order.verify(runs).insert(run);
+        order.verify(tasks).updateById(task);
+    }
+
+    @Test void unknownSourceTimezoneAndUnestablishedInitialWindowStayExplicitlyUnknown() {
+        var scope = scope("OUTBOUND");
+        scope.setSourceTimezone(null);
+        when(locks.lockTask(1L)).thenReturn(task("READY"));
+        when(scopes.selectById(10L)).thenReturn(scope);
+        Map<?, ?> snapshot = read(service.begin(1L, lease).getScopeSnapshotJson(), Map.class);
+        assertThat(snapshot.containsKey("sourceTimezone")).isTrue();
+        assertThat(snapshot.containsKey("initialFromUtc")).isTrue();
+        assertThat(snapshot.containsKey("initialUntilUtc")).isTrue();
+        assertThat(snapshot.get("sourceTimezone")).isNull();
+        assertThat(snapshot.get("initialFromUtc")).isNull();
+        assertThat(snapshot.get("initialUntilUtc")).isNull();
+    }
+
+    @Test void staleFenceRejectsBeginBeforeAnyTaskLockOrAttemptMutation() {
+        doThrow(new IllegalStateException("SELFOP_FENCE_REJECTED")).when(leases).verify(lease);
+        assertThatThrownBy(() -> service.begin(1L, lease)).hasMessage("SELFOP_FENCE_REJECTED");
+        verifyNoInteractions(locks, tasks, runs, scopes, accounts);
+    }
+
+    @Test void validLeaseForAnotherWarehouseScopeCannotBeginThisTask() {
+        when(locks.lockTask(1L)).thenReturn(task("READY"));
+        var wrongScope = new SelfopLeaseService.Lease(11L, "synthetic-worker", 7L, false);
+        assertThatThrownBy(() -> service.begin(1L, wrongScope)).hasMessage("SELFOP_TASK_LEASE_SCOPE_MISMATCH");
+        verify(leases).verify(wrongScope);
+        verifyNoInteractions(tasks, runs, scopes, accounts);
+    }
+
+    @Test void sameManualRetryCommandDoesNotResetRunningOrFailedOriginalTask() {
+        for (String status : List.of("RUNNING", "FAILED")) {
+            reset(locks, tasks, accounts, runs, scopes);
+            var original = task(status);
+            original.setApplyState("BLOCKED");
+            original.setAttemptCount(8);
+            original.setRequestedBy("previous-operator");
+            var retryAudit = task("SUCCEEDED");
+            retryAudit.setRequestKey("retry:command-1");
+            retryAudit.setRequestHash(hash(List.of(1L, "command-1", "offline retry")));
+            when(tasks.selectById(1L)).thenReturn(original);
+            when(tasks.selectOne(any())).thenReturn(retryAudit);
+
+            assertThat(service.retry(1L, "command-1", "new-operator", "offline retry")).isSameAs(original);
+            assertThat(original.getStatus()).isEqualTo(status);
+            assertThat(original.getApplyState()).isEqualTo("BLOCKED");
+            assertThat(original.getAttemptCount()).isEqualTo(8);
+            assertThat(original.getRequestedBy()).isEqualTo("previous-operator");
+            assertThat(original.getNextRetryAtUtc()).isNull();
+            verify(tasks, never()).updateById(any(SelfopSyncTask.class));
+            verify(tasks, never()).insert(any(SelfopSyncTask.class));
+            verifyNoInteractions(locks, accounts, runs, scopes);
+        }
+    }
+
+    @Test void duplicateRetryKeyForAnotherTaskIsRefusedWithoutChangingOriginal() {
+        var original = task("RUNNING");
+        var prior = task("SUCCEEDED");
+        prior.setRequestHash(hash(List.of(2L, "command-1", "offline retry")));
+        when(tasks.selectById(1L)).thenReturn(original);
+        when(tasks.selectOne(any())).thenReturn(prior);
+        assertThatThrownBy(() -> service.retry(1L, "command-1", "operator", "offline retry"))
+                .hasMessage("SELFOP_IDEMPOTENCY_CONFLICT");
+        assertThat(original.getStatus()).isEqualTo("RUNNING");
+        verify(tasks, never()).updateById(any(SelfopSyncTask.class));
+        verify(tasks, never()).insert(any(SelfopSyncTask.class));
+        verifyNoInteractions(locks, accounts, runs, scopes);
+    }
+
+    @Test void firstRetryLocksWarehouseScopeBeforeTaskAndPreservesDurableApplyBarrier() {
+        var original = task("DEAD");
+        original.setApplyState("BLOCKED");
+        original.setAttemptCount(5);
+        var unlockedScope = scope("OUTBOUND");
+        when(tasks.selectById(1L)).thenReturn(original);
+        when(locks.lockScope(10L)).thenReturn(unlockedScope);
+        when(locks.lockTask(1L)).thenReturn(original);
+        assertThat(service.retry(1L, "first-command", "new-operator", "offline retry")).isSameAs(original);
+        var order = inOrder(locks);
+        order.verify(locks).lockScope(10L);
+        order.verify(locks).lockTask(1L);
+        assertThat(original.getStatus()).isEqualTo("READY");
+        assertThat(original.getApplyState()).isEqualTo("BLOCKED");
+        assertThat(original.getAttemptCount()).isEqualTo(5);
+        var audit = org.mockito.ArgumentCaptor.forClass(SelfopSyncTask.class);
+        verify(tasks).insert(audit.capture());
+        assertThat(audit.getValue().getRequestKey()).isEqualTo("retry:first-command");
+        assertThat(audit.getValue().getStatus()).isEqualTo("SUCCEEDED");
+        assertThat(audit.getValue().getUpstreamTaskId()).isEqualTo(1L);
+        assertThat(original.getTaskNo()).isEqualTo("LXCOL-20261012-00000001");
+        assertThat(read(audit.getValue().getQueryScopeJson(),Map.class)).containsEntry("reason","offline retry")
+            .containsEntry("resumesTaskNo",original.getTaskNo());
+        verify(tasks).updateById(original);
+    }
+
+    @Test void firstRetryCannotResetTaskWhileScopeHasLiveExecutionLease() {
+        var original = task("RUNNING");
+        original.setApplyState("APPLYING");
+        var liveScope = scope("OUTBOUND");
+        liveScope.setLeaseOwner("active-worker");
+        liveScope.setLeaseUntilUtc(utcNow().plusDays(1));
+        when(tasks.selectById(1L)).thenReturn(original);
+        when(locks.lockScope(10L)).thenReturn(liveScope);
+        assertThatThrownBy(() -> service.retry(1L, "first-command", "new-operator", "offline retry"))
+                .hasMessage("SELFOP_RETRY_LEASE_BUSY");
+        assertThat(original.getStatus()).isEqualTo("RUNNING");
+        assertThat(original.getApplyState()).isEqualTo("APPLYING");
+        assertThat(original.getNextRetryAtUtc()).isNull();
+        verify(locks, never()).lockTask(anyLong());
+        verify(tasks, never()).updateById(any(SelfopSyncTask.class));
+        verify(tasks, never()).insert(any(SelfopSyncTask.class));
+        verifyNoInteractions(accounts, runs, scopes);
+    }
+
+    @Test void concurrentRetryAuditAppearingAfterScopeLockUsesCurrentReadAndDoesNotResetTask() {
+        var original = task("RUNNING");
+        original.setApplyState("APPLYING");
+        var audit = task("SUCCEEDED");
+        audit.setRequestHash(hash(List.of(1L, "raced-command", "offline retry")));
+        when(tasks.selectById(1L)).thenReturn(original);
+        when(locks.lockScope(10L)).thenReturn(scope("OUTBOUND"));
+        int[] reads = {0};
+        when(tasks.selectOne(any())).thenAnswer(call -> {
+            QueryWrapper<SelfopSyncTask> query = call.getArgument(0);
+            if (++reads[0] == 1) {
+                assertThat(query.getSqlSegment()).doesNotContain("FOR UPDATE");
+                return null;
+            }
+            assertThat(query.getSqlSegment()).endsWith("FOR UPDATE");
+            return audit;
+        });
+        assertThat(service.retry(1L, "raced-command", "new-operator", "offline retry")).isSameAs(original);
+        assertThat(reads[0]).isEqualTo(2);
+        assertThat(original.getStatus()).isEqualTo("RUNNING");
+        assertThat(original.getApplyState()).isEqualTo("APPLYING");
+        assertThat(original.getNextRetryAtUtc()).isNull();
+        verify(locks).lockScope(10L);
+        verify(locks, never()).lockTask(anyLong());
+        verify(tasks, never()).updateById(any(SelfopSyncTask.class));
+        verify(tasks, never()).insert(any(SelfopSyncTask.class));
+    }
+
+    @Test void duplicateInsertUsesCurrentReadAndReturnsExistingTaskWithoutResettingIt() {
+        var existing = task("RUNNING");
+        existing.setApplyState("APPLYING");
+        existing.setAttemptCount(8);
+        var incoming = task("READY");
+        int[] reads = {0};
+        when(tasks.selectOne(any())).thenAnswer(call -> {
+            QueryWrapper<SelfopSyncTask> query = call.getArgument(0);
+            if (++reads[0] == 1) return null;
+            assertThat(query.getSqlSegment()).endsWith("FOR UPDATE");
+            return existing;
+        });
+        when(tasks.insert(any(SelfopSyncTask.class))).thenThrow(new DuplicateKeyException("synthetic duplicate"));
+        assertThat(service.create(incoming)).isSameAs(existing);
+        assertThat(reads[0]).isEqualTo(2);
+        assertThat(existing.getStatus()).isEqualTo("RUNNING");
+        assertThat(existing.getApplyState()).isEqualTo("APPLYING");
+        assertThat(existing.getAttemptCount()).isEqualTo(8);
+        verify(tasks, never()).updateById(any(SelfopSyncTask.class));
+        verifyNoInteractions(locks, accounts, runs, scopes);
+    }
+
+    @Test void createRefusesSameRequestKeyWithDifferentPayloadWithoutAllocatingOrWriting() {
+        var existing = task("RUNNING");
+        existing.setRequestHash("existing-hash");
+        var incoming = task("READY");
+        incoming.setRequestHash("different-hash");
+        when(tasks.selectOne(any())).thenReturn(existing);
+        assertThatThrownBy(() -> service.create(incoming)).hasMessage("SELFOP_IDEMPOTENCY_CONFLICT");
+        assertThat(incoming.getAttemptCount()).isEqualTo(0);
+        verify(tasks, never()).insert(any(SelfopSyncTask.class));
+        verify(tasks, never()).updateById(any(SelfopSyncTask.class));
+        verifyNoInteractions(locks, accounts, runs, scopes);
+    }
+
+    @Test void lostLeaseFailCannotTouchCurrentRunOrTask() {
+        doThrow(new IllegalStateException("SELFOP_FENCE_REJECTED")).when(leases).verify(lease);
+        assertThatThrownBy(() -> service.fail(1L, 20L,SelfopFailure.coded("SOURCE_TEMPORARY", true), lease))
+                .hasMessage("SELFOP_FENCE_REJECTED");
+        verifyNoInteractions(locks, tasks, runs, scopes, accounts);
+    }
+
+    @Test void oldRunFenceCannotMutateWithOtherwiseValidCurrentScopeLease() {
+        var task = task("RUNNING");
+        var oldRun = run("FETCHING");
+        oldRun.setFenceToken(6L);
+        when(locks.lockTask(1L)).thenReturn(task);
+        when(locks.lockRun(20L)).thenReturn(oldRun);
+        assertThatThrownBy(() -> service.fail(1L, 20L,SelfopFailure.coded("SOURCE_TEMPORARY", true), lease))
+                .hasMessage("SELFOP_RUN_LEASE_MISMATCH");
+        verify(leases).verify(lease);
+        assertThat(task.getStatus()).isEqualTo("RUNNING");
+        assertThat(oldRun.getStatus()).isEqualTo("FETCHING");
+        assertThat(oldRun.getErrorCode()).isNull();
+        verifyNoInteractions(tasks, runs, scopes, accounts);
+    }
+
+    @Test void masterDataYieldPersistsFiveSecondsWithoutChangingOrdinaryScheduling() {
+        var task=task("RUNNING");task.setTaskType("MASTER_DATA");
+        var run=run("FETCHING");when(locks.lockTask(1L)).thenReturn(task);when(locks.lockRun(20L)).thenReturn(run);
+        service.yield(1L,20L,lease);
+        assertThat(task.getNextRetryAtUtc()).isEqualTo(task.getUpdatedAt().plusSeconds(5));
+        assertThat(run.getStatus()).isEqualTo("YIELDED");
+        task.setTaskType("BACKFILL");task.setStatus("RUNNING");run.setStatus("FETCHING");
+        service.yield(1L,20L,lease);
+        assertThat(task.getNextRetryAtUtc()).isEqualTo(task.getUpdatedAt().plusSeconds(1));
+    }
+    @Test void budgetYieldDoesNotBecomeFailedAttemptOrClearApplyBarrier() {
+        var task = task("RUNNING");
+        task.setAttemptCount(99);
+        task.setApplyState("APPLYING");
+        var run = run("FETCHING");
+        when(locks.lockTask(1L)).thenReturn(task);
+        when(locks.lockRun(20L)).thenReturn(run);
+        service.yield(1L, 20L, lease);
+        assertThat(run.getStatus()).isEqualTo("YIELDED");
+        assertThat(run.getErrorCode()).isNull();
+        assertThat(task.getStatus()).isEqualTo("RETRY_WAIT");
+        assertThat(task.getAttemptCount()).isEqualTo(99);
+        assertThat(task.getApplyState()).isEqualTo("APPLYING");
+        assertThat(task.getNextRetryAtUtc()).isNotNull();
+        verify(runs, never()).selectCount(any());
+        verify(runs).updateById(run);
+        verify(tasks).updateById(task);
+    }
+
+    @Test void finiteFailureBudgetCountsFailuresInsteadOfManyYieldedAttempts() {
+        config.setMaxAttempts(3);
+        var task = task("RUNNING");
+        task.setAttemptCount(99);
+        task.setApplyState("APPLYING");
+        var run = run("FETCHING");
+        when(locks.lockTask(1L)).thenReturn(task);
+        when(locks.lockRun(20L)).thenReturn(run);
+        when(scopes.selectById(10L)).thenReturn(scope("OUTBOUND"));
+        when(runs.selectCount(any())).thenAnswer(call -> {
+            com.baomidou.mybatisplus.core.conditions.query.QueryWrapper<SelfopSyncRun> query = call.getArgument(0);
+            query.getSqlSegment();
+            assertThat(query.getParamNameValuePairs()).containsValue("FAILED").doesNotContainValue("YIELDED");
+            return 2L;
+        });
+        service.fail(1L, 20L,SelfopFailure.coded("SOURCE_TEMPORARY", true), lease);
+        assertThat(task.getStatus()).isEqualTo("RETRY_WAIT");
+        assertThat(task.getApplyState()).isEqualTo("BLOCKED");
+        assertThat(run.getStatus()).isEqualTo("FAILED");
+        assertThat(run.getLastPhase()).isEqualTo("FETCHING");
+        assertThat(run.getErrorCode()).isEqualTo("SOURCE_TEMPORARY");
+        verify(runs).selectCount(any());
+    }
+
+    @Test void exhaustedFiniteFailuresBecomeDeadAndKeepBlockedApplyState() {
+        config.setMaxAttempts(3);
+        var task = task("RUNNING");
+        task.setApplyState("APPLYING");
+        when(locks.lockTask(1L)).thenReturn(task);
+        when(locks.lockRun(20L)).thenReturn(run("BUILDING"));
+        when(scopes.selectById(10L)).thenReturn(scope("OUTBOUND"));
+        when(runs.selectCount(any())).thenReturn(3L);
+        service.fail(1L, 20L,SelfopFailure.coded("SOURCE_TEMPORARY", true), lease);
+        assertThat(task.getStatus()).isEqualTo("DEAD");
+        assertThat(task.getApplyState()).isEqualTo("BLOCKED");
+    }
+
+    @Test void validationChildCannotEnterBusinessFailureOrManualRetryQueue() {
+        var child=task("RUNNING");child.setExecutionPurpose("VALIDATION");child.setValidationRootTaskId(9L);
+        var attempt=run("FETCHING");attempt.setExecutionPurpose("VALIDATION");
+        when(locks.lockTask(1L)).thenReturn(child);when(locks.lockRun(20L)).thenReturn(attempt);
+        when(tasks.selectById(1L)).thenReturn(child);when(locks.lockScope(10L)).thenReturn(scope("OUTBOUND"));
+        assertThatThrownBy(()->service.fail(1L,20L,SelfopFailure.coded("VALIDATION_STRUCTURE_REJECTED",true),lease))
+            .hasMessage("SELFOP_BUSINESS_PURPOSE_REQUIRED");
+        assertThatThrownBy(()->service.retry(1L,"validation-retry","operator","offline retry"))
+            .hasMessage("SELFOP_BUSINESS_PURPOSE_REQUIRED");
+        assertThat(child.getStatus()).isEqualTo("RUNNING");assertThat(child.getNextRetryAtUtc()).isNull();
+        assertThat(attempt.getStatus()).isEqualTo("FETCHING");
+        verify(tasks,never()).updateById(any(SelfopSyncTask.class));verify(tasks,never()).insert(any(SelfopSyncTask.class));
+        verify(runs,never()).updateById(any(SelfopSyncRun.class));verify(runs,never()).selectCount(any());
+    }
+
+    @Test void testManualRootFreezesBudgetAndContextWithoutAffectingProductionIdentity() {
+        config.setEnvironment("test");config.setRequestBudget(7);config.setTimeBudgetSeconds(91);
+        var root=task("READY");root.setRequestKey("manual:frozen");root.setRequestedBy("operator");
+        service.create(root);
+        var budget=read(root.getBusinessBudgetJson(),com.baiyue.lastleg.selfoperated.analytics.request.SelfopBusinessBudget.class);
+        assertThat(root.getBusinessRootTaskId()).isEqualTo(root.getId());assertThat(budget.maxHttp).isZero();
+        assertThat(budget.deadlineAtUtc).isNull();assertThat(budget.continuous).isFalse();
+        var child=task("READY");child.setId(42L);child.setBusinessRootTaskId(root.getId());
+        assertThat(SelfopRequestContext.forTask(child,run("FETCHING"),config).rootTaskId()).isEqualTo(root.getId());
+        config.setEnvironment("production");
+        assertThat(SelfopRequestContext.forTask(child,run("FETCHING"),config).rootTaskId()).isEqualTo(42L);
+    }
+    @Test void routedChildInheritsFrozenRootAndDoesNotGetAnIndependentBudget() {
+        var root=boundedRoot(0,utcNow().plusMinutes(3));
+        var child=task("READY");child.setUpstreamTaskId(1L);child.setRequestKey("route:1:WH-A");
+        child.setId(null);service.create(child);
+        assertThat(child.getBusinessRootTaskId()).isEqualTo(1L);assertThat(child.getBusinessBudgetJson()).isNull();
+        assertThat(read(root.getBusinessBudgetJson(),com.baiyue.lastleg.selfoperated.analytics.request.SelfopBusinessBudget.class).http).isZero();
+    }
+    @Test void legacyTestTaskCannotAcquireAnImplicitUnlimitedBudget() {
+        config.setEnvironment("test");var root=task("READY");root.setRequestKey("manual:legacy");root.setRequestedBy("operator");
+        when(tasks.selectById(1L)).thenReturn(root);
+        assertThatThrownBy(()->service.begin(1L,lease)).hasMessage("BUSINESS_SESSION_ROOT_REQUIRED");
+        assertThatThrownBy(()->SelfopRequestContext.forTask(root,run("FETCHING"),config)).hasMessage("BUSINESS_SESSION_ROOT_REQUIRED");
+        verify(runs,never()).insert(any(SelfopSyncRun.class));assertThat(root.getBusinessBudgetJson()).isNull();
+    }
+    @Test void exactLastHttpResponseMayContinuePureLocalMergeWithoutAnotherReservation() {
+        var root=boundedRoot(7,utcNow().plusMinutes(3));when(scopes.selectById(10L)).thenReturn(scope("OUTBOUND"));
+        var manifest=new SelfopRoutingManifest();manifest.setDirectoryComplete(true);root.setRoutingManifestJson(json(manifest));
+        var next=service.begin(1L,lease);
+        assertThat(next.getStatus()).isEqualTo("FETCHING");
+        assertThat(read(root.getBusinessBudgetJson(),com.baiyue.lastleg.selfoperated.analytics.request.SelfopBusinessBudget.class).http).isEqualTo(7);
+        verify(runs).insert(next);
+    }
+    @Test void existingManualDiscoveryPastDeadlineBeginsFromPersistedCheckpointAndIdentity() {
+        var root=boundedRoot(2,utcNow().minusSeconds(1));
+        root.setTaskRole("ACCOUNT_DISCOVERY");root.setScopeId(null);root.setWarehouseCode(null);root.setDiscoveryScopeId(99L);
+        root.setRequestKey("manual:2026-10-06");root.setTaskType("BACKFILL");root.setAttemptCount(3);
+        root.setQueryFromUtc(LocalDateTime.of(2026,10,5,16,0));root.setQueryUntilUtc(LocalDateTime.of(2026,10,6,16,0));
+        var manifest=new SelfopRoutingManifest();manifest.setNextPage(37);manifest.setScan(2);manifest.setPages(100);manifest.setTotal(1000L);
+        root.setRoutingManifestJson(json(manifest));String checkpoint=root.getRoutingManifestJson(),budget=root.getBusinessBudgetJson();
+        var account=new SelfopOutboundDiscoveryScope();account.setId(99L);when(locks.lockDiscovery(99L)).thenReturn(account);
+        var next=service.begin(1L,new SelfopLeaseService.Lease(99L,"owner",7L,true));
+        assertThat(next.getAttemptNo()).isEqualTo(4);assertThat(next.getTaskId()).isEqualTo(1L);assertThat(next.getStatus()).isEqualTo("FETCHING");
+        assertThat(root.getRoutingManifestJson()).isEqualTo(checkpoint);assertThat(root.getBusinessBudgetJson()).isEqualTo(budget);
+        assertThat(root.getBusinessRootTaskId()).isEqualTo(1L);assertThat(root.getRequestKey()).isEqualTo("manual:2026-10-06");
+        assertThat(root.getRequestedBy()).isEqualTo("operator");assertThat(root.getQueryFromUtc()).isEqualTo(LocalDateTime.of(2026,10,5,16,0));
+        verify(runs).insert(next);verify(tasks,never()).insert(any(SelfopSyncTask.class));
+    }
+    @Test void pastRecordedDeadlineYieldAndBudgetWaitKeepSchedulingSameRoot() {
+        var root=boundedRoot(2,utcNow().minusSeconds(1));root.setStatus("RUNNING");
+        var active=run("FETCHING");when(locks.lockRun(20L)).thenReturn(active);String budget=root.getBusinessBudgetJson();
+        service.yield(1L,20L,lease);assertThat(root.getStatus()).isEqualTo("RETRY_WAIT");assertThat(active.getStatus()).isEqualTo("YIELDED");
+        root.setStatus("RUNNING");active.setStatus("FETCHING");var until=utcNow().plusMinutes(5);
+        service.waitForBudget(1L,20L,until,lease);
+        assertThat(root.getNextRetryAtUtc()).isEqualTo(until);assertThat(root.getBusinessBudgetJson()).isEqualTo(budget);
+        verify(tasks,never()).update(any(),any());
+    }
+    private SelfopSyncTask continuousOutboundRoot(){
+        var root=boundedRoot(0,utcNow().plusMinutes(3));config.setContinuousBusinessCollectionEnabled(true);
+        root.setTaskRole("ACCOUNT_DISCOVERY");root.setTaskType("BACKFILL");root.setScopeId(null);root.setWarehouseCode(null);root.setDiscoveryScopeId(99L);
+        root.setRequestedBy(SelfopCollectionPolicy.CONTINUOUS_PLANNER);root.setScopeHash("a".repeat(64));
+        root.setRequestKey("continuous:outbound:2026-10-12:"+"a".repeat(12));root.setStatus("RUNNING");
+        root.setQueryFromUtc(LocalDateTime.of(2026,10,11,16,0));root.setQueryUntilUtc(LocalDateTime.of(2026,10,12,16,0));
+        root.setQueryScopeJson(json(new SelfopDiscoveryService.Query("2026-10-12T00:00","2026-10-13T00:00",null,null,null)));
+        root.setBusinessBudgetJson(com.baiyue.lastleg.selfoperated.analytics.request.SelfopBusinessBudget.freezeContinuous(utcNow()));
+        var account=new SelfopOutboundDiscoveryScope();account.setId(99L);when(locks.lockDiscovery(99L)).thenReturn(account);
+        return root;
+    }
+    @Test void continuousOutboundRetriesThreeTimesThenStopsWithoutResettingCheckpointOrIdentity(){
+        var root=continuousOutboundRoot();root.setAttemptCount(99);
+        root.setRoutingManifestJson("{\"directoryComplete\":true,\"nextPage\":26,\"scan\":2}");
+        String checkpoint=root.getRoutingManifestJson(),key=root.getRequestKey(),budget=root.getBusinessBudgetJson();
+        var accountLease=new SelfopLeaseService.Lease(99L,"owner",7L,true);
+        for(int failures=1;failures<=4;failures++) {
+            root.setStatus("RUNNING");var failed=run("FETCHING");failed.setAttemptNo(root.getAttemptCount());when(locks.lockRun(20L)).thenReturn(failed);
+            when(runs.selectCount(any())).thenReturn((long)failures);
+            var before=utcNow();service.fail(1L,20L,SelfopFailure.coded("SELFOP_EXECUTION_FAILED",true),accountLease);
+            assertThat(root.getStatus()).isEqualTo(failures<=3?"RETRY_WAIT":"DEAD");
+            assertThat(root.getRoutingManifestJson()).isEqualTo(checkpoint);assertThat(root.getRequestKey()).isEqualTo(key);
+            assertThat(root.getBusinessBudgetJson()).isEqualTo(budget);
+            String summary=SelfopFailure.publicSummary(failed.getErrorCode(),failed.getErrorMessage());
+            if(failures<=3) {
+                assertThat(root.getNextRetryAtUtc()).isBetween(before.plusSeconds(5L<<failures),utcNow().plusSeconds(5L<<failures));
+                assertThat(summary).contains("第 "+failures+"/3 次自动重试");
+                var next=service.begin(1L,accountLease);
+                assertThat(next.getTaskId()).isEqualTo(1L);assertThat(root.getRoutingManifestJson()).isEqualTo(checkpoint);
+            } else {assertThat(root.getNextRetryAtUtc()).isNull();assertThat(summary).contains("自动重试已用尽（最多 3 次）");}
+        }
+        verify(tasks,never()).insert(any(SelfopSyncTask.class));
+    }
+    @Test void continuousOutboundWarehouseFailureAlsoRetriesLocalProcessing(){
+        var root=continuousOutboundRoot();root.setStatus("SUCCEEDED");
+        var child=task("RUNNING");child.setId(2L);child.setBusinessRootTaskId(1L);child.setUpstreamTaskId(1L);child.setApplyState("APPLYING");
+        child.setRequestKey("route:1:WH-A");child.setTaskType("BACKFILL");
+        when(tasks.selectById(2L)).thenReturn(child);when(locks.lockTask(2L)).thenReturn(child);
+        when(scopes.selectById(10L)).thenReturn(scope("OUTBOUND"));
+        var failed=run("BUILDING");failed.setTaskId(2L);when(locks.lockRun(20L)).thenReturn(failed);when(runs.selectCount(any())).thenReturn(1L);
+        service.fail(2L,20L,SelfopFailure.capture("SELFOP_EXECUTION_FAILED",true,
+            new org.springframework.dao.CannotAcquireLockException("private SQL",new java.sql.SQLException("private params","40001",1213))),lease);
+        assertThat(child.getStatus()).isEqualTo("RETRY_WAIT");assertThat(child.getApplyState()).isEqualTo("BLOCKED");
+        assertThat(root.getStatus()).isEqualTo("SUCCEEDED");assertThat(failed.getErrorCode()).isEqualTo("SELFOP_DATABASE_TRANSIENT");
+        assertThat(SelfopFailure.publicSummary(failed.getErrorCode(),failed.getErrorMessage())).contains("SQLState 40001","第 1/3").doesNotContain("private");
+    }
+    @Test void continuousOutboundProtectionAndContractFailuresNeverRetry(){
+        for(String code:List.of("LINGXING_WMS_RATE_LIMITED","LINGXING_WMS_AUTHORIZATION_REJECTED","INTEGRATION_TRANSPORT_FAILURE",
+                "SELFOP_SCOPE_MISMATCH","SELFOP_IDENTITY_INVALID","SELFOP_DATABASE_FAILED")) {
+            var root=continuousOutboundRoot();when(locks.lockRun(20L)).thenReturn(run("FETCHING"));when(runs.selectCount(any())).thenReturn(1L);
+            service.fail(1L,20L,SelfopFailure.coded(code,true),new SelfopLeaseService.Lease(99L,"owner",7L,true));
+            assertThat(root.getStatus()).as(code).isEqualTo("DEAD");assertThat(root.getNextRetryAtUtc()).isNull();
+        }
+        var root=continuousOutboundRoot();when(locks.lockRun(20L)).thenReturn(run("FETCHING"));
+        service.fail(1L,20L,SelfopFailure.coded("SELFOP_EXECUTION_FAILED",false),new SelfopLeaseService.Lease(99L,"owner",7L,true));
+        assertThat(root.getStatus()).isEqualTo("DEAD");
+    }
+    @Test void continuousFailureStopsInsteadOfBecomingAnotherScheduledRetry(){
+        var root=continuousOutboundRoot();
+        var run=run("FETCHING");when(locks.lockRun(20L)).thenReturn(run);
+        service.fail(1L,20L,SelfopFailure.coded("LINGXING_WMS_RATE_LIMITED",true),new SelfopLeaseService.Lease(99L,"owner",7L,true));
+        assertThat(root.getStatus()).isEqualTo("DEAD");assertThat(root.getNextRetryAtUtc()).isNull();
+        assertThat(run.getStatus()).isEqualTo("FAILED");assertThat(run.getErrorCode()).isEqualTo("LINGXING_WMS_RATE_LIMITED");
+    }
+    @Test void continuousInventoryScanFailureRetriesFromPageOneWithinFailureBudget(){
+        for(String code:List.of("SELFOP_STOCK_DUPLICATE","SELFOP_STOCK_COUNT_MISMATCH","SELFOP_PAGE_TOTAL_CHANGED")) {
+            var root=continuousInventoryRoot();root.setRoutingManifestJson("{\"nextPage\":6}");root.setAttemptCount(99);
+            var failed=run("FETCHING");when(locks.lockRun(20L)).thenReturn(failed);
+            when(runs.selectCount(any())).thenReturn(1L);config.setMaxAttempts(3);
+            var before=utcNow();service.fail(1L,20L,SelfopFailure.coded(code,true),lease);
+            assertThat(root.getStatus()).isEqualTo("RETRY_WAIT");
+            assertThat(root.getNextRetryAtUtc()).isBetween(before.plusSeconds(10),utcNow().plusSeconds(10));
+            assertThat(root.getRoutingManifestJson()).isNull();
+            assertThat(failed.getStatus()).isEqualTo("FAILED");assertThat(failed.getErrorCode()).isEqualTo(code);
+            assertThat(root.getTaskType()).isEqualTo("SCHEDULED");
+            assertThat(root.getPlannedAtUtc()).isEqualTo(LocalDateTime.of(2026,10,14,0,0));
+            var fresh=service.begin(1L,lease);
+            assertThat(fresh.getId()).isNotEqualTo(failed.getId());
+            assertThat(fresh.getCoverageStatus()).isEqualTo("UNKNOWN");
+            assertThat(fresh.getInventoryDailySampleDate()).isNull();
+            assertThat(root.getRoutingManifestJson()).isNull();
+        }
+    }
+    @Test void continuousInventoryScanFailureStopsAtConfiguredLimitAndClearsPersistedRetryTime(){
+        var root=continuousInventoryRoot();root.setNextRetryAtUtc(utcNow().minusMinutes(1));
+        when(locks.lockRun(20L)).thenReturn(run("FETCHING"));when(runs.selectCount(any())).thenReturn(3L);config.setMaxAttempts(3);
+        service.fail(1L,20L,SelfopFailure.coded("SELFOP_STOCK_DUPLICATE",true),lease);
+        assertThat(root.getStatus()).isEqualTo("DEAD");assertThat(root.getNextRetryAtUtc()).isNull();
+        verify(tasks,atLeastOnce()).update(isNull(),argThat((com.baomidou.mybatisplus.core.conditions.update.UpdateWrapper<SelfopSyncTask> update)->
+            update.getSqlSet().contains("next_retry_at_utc")));
+    }
+    @Test void continuousInventoryProtectionAndIdentityErrorsNeverAutomaticallyRetry(){
+        for(String code:List.of("LINGXING_WMS_RATE_LIMITED","LINGXING_WMS_AUTHORIZATION_REJECTED",
+                "INTEGRATION_TRANSPORT_FAILURE","SELFOP_STOCK_SCOPE_LEAK","SELFOP_STOCK_IDENTITY_MISSING","SELFOP_EXECUTION_FAILED")) {
+            var root=continuousInventoryRoot();when(locks.lockRun(20L)).thenReturn(run("FETCHING"));when(runs.selectCount(any())).thenReturn(1L);
+            service.fail(1L,20L,SelfopFailure.coded(code,true),lease);
+            assertThat(root.getStatus()).as(code).isEqualTo("DEAD");assertThat(root.getNextRetryAtUtc()).isNull();
+        }
+        var root=continuousInventoryRoot();when(locks.lockRun(20L)).thenReturn(run("FETCHING"));
+        service.fail(1L,20L,SelfopFailure.coded("SELFOP_STOCK_DUPLICATE",false),lease);
+        assertThat(root.getStatus()).isEqualTo("DEAD");
+    }
+    @Test void commandRetriesDeadContinuousInventoryThroughRealTaskServiceAndRecordsAudit(){
+        var root=continuousInventoryRoot();root.setStatus("DEAD");root.setAttemptCount(2);
+        var failed=run("FAILED");failed.setErrorCode("SELFOP_STOCK_DUPLICATE");
+        when(runs.selectOne(any())).thenReturn(failed);
+        when(tasks.selectOne(any())).thenAnswer(inv->{var q=(QueryWrapper<?>)inv.getArgument(0);
+            return q.getSqlSegment().contains("task_no")?root:null;});
+        config.setSourceAccount("synthetic-account");config.getWarehouses().put("WH-A",new SelfopAnalyticsProperties.Warehouse());
+        String budget=root.getBusinessBudgetJson();var planned=root.getPlannedAtUtc();
+        var commands=new SelfopCommandService(service,scopes,accounts,config,tasks);
+        var command=new SelfopCommandService.Command("recover-stock","WH-A","RETRY",root.getTaskNo(),null,null,null,null,"retry completed unstable inventory scan");
+        assertThat(commands.request(command,"operator")).isSameAs(root);
+        assertThat(root.getStatus()).isEqualTo("READY");assertThat(root.getAttemptCount()).isEqualTo(2);
+        assertThat(root.getBusinessBudgetJson()).isEqualTo(budget);assertThat(root.getPlannedAtUtc()).isEqualTo(planned);
+        assertThat(root.getRequestedBy()).isEqualTo(SelfopCollectionPolicy.CONTINUOUS_PLANNER);
+        var order=inOrder(tasks);order.verify(tasks).updateById(root);
+        order.verify(tasks).insert(argThat((SelfopSyncTask audit)->"MANUAL_RETRY".equals(audit.getTaskType())
+            &&"SUCCEEDED".equals(audit.getStatus())&&Long.valueOf(1).equals(audit.getUpstreamTaskId())
+            &&Long.valueOf(1).equals(audit.getBusinessRootTaskId())));
+    }
+    @Test void explicitInventoryRetryCannotClearPersistedStopOrRetryUnknownFailure(){
+        for(String error:List.of("LINGXING_WMS_RATE_LIMITED","INTEGRATION_TRANSPORT_FAILURE","SELFOP_EXECUTION_FAILED")){
+            var root=continuousInventoryRoot();root.setStatus("DEAD");String budget=root.getBusinessBudgetJson();
+            var failed=run("FAILED");failed.setErrorCode(error);when(runs.selectOne(any())).thenReturn(failed);
+            assertThatThrownBy(()->service.retry(1L,"retry-protected","operator","offline retry"))
+                .isInstanceOf(SelfopTaskService.BusinessSessionStoppedException.class);
+            assertThat(root.getStatus()).isEqualTo("DEAD");assertThat(root.getBusinessBudgetJson()).isEqualTo(budget);
+        }
+        var root=continuousInventoryRoot();root.setStatus("DEAD");
+        var budget=read(root.getBusinessBudgetJson(),com.baiyue.lastleg.selfoperated.analytics.request.SelfopBusinessBudget.class);
+        budget.stopReason="BUSINESS_SESSION_STOPPED";root.setBusinessBudgetJson(json(budget));String frozen=root.getBusinessBudgetJson();
+        var failed=run("FAILED");failed.setErrorCode("SELFOP_STOCK_DUPLICATE");when(runs.selectOne(any())).thenReturn(failed);
+        assertThatThrownBy(()->service.retry(1L,"retry-stopped","operator","offline retry"))
+            .isInstanceOf(SelfopTaskService.BusinessSessionStoppedException.class);
+        assertThat(root.getBusinessBudgetJson()).isEqualTo(frozen);
+        verify(tasks,never()).updateById(any(SelfopSyncTask.class));verify(tasks,never()).insert(any(SelfopSyncTask.class));
+        verify(tasks,never()).update(any(),any());
+    }
+    private SelfopSyncTask continuousInventoryRoot(){
+        var root=boundedRoot(0,utcNow().plusMinutes(3));config.setContinuousBusinessCollectionEnabled(true);
+        root.setTaskType("SCHEDULED");root.setStatus("RUNNING");root.setApplyState("NOT_APPLICABLE");
+        root.setRequestedBy(SelfopCollectionPolicy.CONTINUOUS_PLANNER);root.setScopeHash("b".repeat(64));
+        root.setPlannedAtUtc(LocalDateTime.of(2026,10,14,0,0));
+        root.setRequestKey("continuous:inventory:WH-A:2026-10-14T00:00:"+"b".repeat(12));
+        root.setQueryScopeJson(json(Map.of("dataFamily","INVENTORY","businessTimezone","Asia/Shanghai","sourceAccount","synthetic-account","warehouseCode","WH-A")));
+        root.setBusinessBudgetJson(com.baiyue.lastleg.selfoperated.analytics.request.SelfopBusinessBudget.freezeContinuous(utcNow()));
+        when(scopes.selectById(10L)).thenReturn(scope("INVENTORY"));
+        return root;
+    }
+    @Test void egressStopReasonSurvivesExecutorFailureHandling() {
+        var root=boundedRoot(7,utcNow().plusMinutes(3));
+        var budget=read(root.getBusinessBudgetJson(),com.baiyue.lastleg.selfoperated.analytics.request.SelfopBusinessBudget.class);
+        budget.stopReason="BUSINESS_SESSION_HTTP_LIMIT";root.setBusinessBudgetJson(json(budget));root.setStatus("DEAD");
+        service.fail(1L,20L,SelfopFailure.coded("SELFOP_EXECUTION_FAILED",true),lease);
+        verify(runs,never()).updateById(any(SelfopSyncRun.class));verify(tasks,never()).updateById(any(SelfopSyncTask.class));
+        assertThat(read(root.getBusinessBudgetJson(),com.baiyue.lastleg.selfoperated.analytics.request.SelfopBusinessBudget.class).stopReason).isEqualTo("BUSINESS_SESSION_HTTP_LIMIT");
+    }
+    @Test void manualRetryAuditRetainsOriginalRootAndCannotFreezeAnotherAllowance() {
+        var root=boundedRoot(3,utcNow().minusSeconds(1));root.setStatus("RETRY_WAIT");String frozen=root.getBusinessBudgetJson();
+        config.setRequestBudget(100);config.setTimeBudgetSeconds(900);
+        assertThat(service.retry(1L,"retry-bounded","operator","retry failed attempt")).isSameAs(root);
+        var saved=org.mockito.ArgumentCaptor.forClass(SelfopSyncTask.class);verify(tasks).insert(saved.capture());
+        assertThat(saved.getValue().getTaskType()).isEqualTo("MANUAL_RETRY");assertThat(saved.getValue().getStatus()).isEqualTo("SUCCEEDED");
+        assertThat(saved.getValue().getBusinessRootTaskId()).isEqualTo(1L);assertThat(saved.getValue().getBusinessBudgetJson()).isNull();
+        assertThat(root.getBusinessBudgetJson()).isEqualTo(frozen);assertThat(root.getStatus()).isEqualTo("READY");
+    }
+    @Test void completeLocalRebuildCanFinishAfterCollectionDeadline() {
+        var root=boundedRoot(7,utcNow().minusSeconds(1));root.setTaskType("REBUILD");
+        when(scopes.selectById(10L)).thenReturn(scope("OUTBOUND"));
+        assertThat(service.begin(1L,lease).getStatus()).isEqualTo("FETCHING");
+        assertThat(read(root.getBusinessBudgetJson(),com.baiyue.lastleg.selfoperated.analytics.request.SelfopBusinessBudget.class).http).isEqualTo(7);
+    }
+    @Test void guardLocksAccountBeforeWarehouseAndRoot() {
+        boundedRoot(0,utcNow().plusMinutes(3));when(scopes.selectById(10L)).thenReturn(scope("OUTBOUND"));
+        service.begin(1L,lease);var order=inOrder(locks,leases);
+        order.verify(locks).lockDiscovery(99L);order.verify(leases).verify(lease);order.verify(locks).lockDiscovery(99L);
+        // This task is its own session root: guard locks the root, then begin locks the executable task.
+        order.verify(locks,times(2)).lockTask(1L);
+    }
+
+    @Test void incompleteManifestNeverBypassesExplicitFailureStop() {
+        var root=boundedRoot(1,utcNow().minusSeconds(1));when(scopes.selectById(10L)).thenReturn(scope("OUTBOUND"));
+        var budget=read(root.getBusinessBudgetJson(),com.baiyue.lastleg.selfoperated.analytics.request.SelfopBusinessBudget.class);
+        budget.stopReason="AUTHORIZATION_REJECTED";root.setBusinessBudgetJson(json(budget));
+        for(String manifest:List.of("{\"directoryComplete\":true}","{\"directoryComplete\":true,\"objects\":[]}",
+            "{\"directoryComplete\":true,\"objects\":{\"one\":{\"effectiveStageId\":\" \"}}}")) {
+            root.setRoutingManifestJson(manifest);
+            assertThatThrownBy(()->service.begin(1L,lease)).isInstanceOf(SelfopTaskService.BusinessSessionStoppedException.class);
+        }
+        verify(runs,never()).insert(any(SelfopSyncRun.class));
+    }
+
+    @Test void checkpointRejectsLateResponseUsingLockedPersistedStateWithoutOverwritingReason() {
+        var persisted=boundedRoot(7,utcNow().plusMinutes(1));persisted.setStatus("DEAD");
+        var budget=read(persisted.getBusinessBudgetJson(),com.baiyue.lastleg.selfoperated.analytics.request.SelfopBusinessBudget.class);
+        budget.stopReason="BUSINESS_SESSION_DEADLINE";persisted.setBusinessBudgetJson(json(budget));
+        var failed=run("FAILED");failed.setErrorCode(budget.stopReason);when(locks.lockRun(20L)).thenReturn(failed);
+        var responseTask=task("RUNNING");var responseRun=run("FETCHING");
+        assertThatThrownBy(()->service.checkpoint(responseTask,responseRun,lease)).isInstanceOf(SelfopTaskService.BusinessSessionStoppedException.class);
+        verify(tasks,never()).update(any(),any());verify(runs,never()).update(any(),any());
+        assertThat(persisted.getStatus()).isEqualTo("DEAD");assertThat(failed.getStatus()).isEqualTo("FAILED");assertThat(failed.getErrorCode()).isEqualTo("BUSINESS_SESSION_DEADLINE");
+    }
+    @Test void checkpointReturnsLockedFreshEntitiesAndAllowsLastPermittedResponsePastDeadline() {
+        var persisted=boundedRoot(7,utcNow().minusSeconds(1));persisted.setStatus("RUNNING");
+        var active=run("FETCHING");when(locks.lockRun(20L)).thenReturn(active);
+        var result=service.checkpoint(task("RUNNING"),run("FETCHING"),lease);
+        assertThat(result.task()).isSameAs(persisted);assertThat(result.run()).isSameAs(active);
+        assertThat(read(persisted.getBusinessBudgetJson(),com.baiyue.lastleg.selfoperated.analytics.request.SelfopBusinessBudget.class).http).isEqualTo(7);
+        verify(tasks,never()).update(any(),any());verify(runs,never()).update(any(),any());
+    }
+    @Test void completeLocalBuildMayWaitPastCollectionDeadlineWithoutReopeningHttp() {
+        var root=boundedRoot(7,utcNow().minusSeconds(1));root.setTaskType("REBUILD");root.setStatus("RUNNING");
+        when(scopes.selectById(10L)).thenReturn(scope("OUTBOUND"));when(locks.lockRun(20L)).thenReturn(run("BUILDING"));
+        service.waitForBudget(1L,20L,utcNow().plusMinutes(30),lease);
+        assertThat(root.getStatus()).isEqualTo("RETRY_WAIT");
+        assertThat(read(root.getBusinessBudgetJson(),com.baiyue.lastleg.selfoperated.analytics.request.SelfopBusinessBudget.class).http).isEqualTo(7);
+    }
+
+    private SelfopSyncTask boundedRoot(int used,LocalDateTime deadline) {
+        config.setEnvironment("test");var root=task("READY");root.setRequestKey("manual:bounded");root.setRequestedBy("operator");root.setBusinessRootTaskId(1L);
+        var budget=new com.baiyue.lastleg.selfoperated.analytics.request.SelfopBusinessBudget();
+        budget.startedAtUtc=deadline.minusMinutes(5);budget.deadlineAtUtc=deadline;budget.maxHttp=7;budget.http=used;budget.confirmedHttp=used;
+        root.setBusinessBudgetJson(json(budget));when(tasks.selectById(1L)).thenReturn(root);when(locks.lockTask(1L)).thenReturn(root);
+        var account=new SelfopOutboundDiscoveryScope();account.setId(99L);when(accounts.selectOne(any())).thenReturn(account);
+        when(tasks.selectList(any())).thenReturn(List.of(root));when(locks.lockScope(10L)).thenReturn(scope("OUTBOUND"));return root;
+    }
+
+    private SelfopSyncTask task(String status) {
+        var task = new SelfopSyncTask(); task.setExecutionPurpose("BUSINESS"); task.setTaskNo("LXCOL-20261012-00000001");
+        task.setId(1L); task.setScopeId(10L); task.setSourceAccount("synthetic-account");
+        task.setWarehouseCode("WH-A"); task.setTaskRole("WAREHOUSE_SYNC");
+        task.setRequestKey("slot-1"); task.setRequestHash("request-hash"); task.setScopeHash("scope-hash");
+        task.setQueryScopeJson("{\"warehouseCode\":\"WH-A\"}");
+        task.setStatus(status); task.setApplyState("NOT_STARTED"); task.setAttemptCount(0);
+        return task;
+    }
+    private SelfopSyncScope scope(String family) {
+        var scope = new SelfopSyncScope();
+        scope.setId(10L); scope.setSourceAccount("synthetic-account"); scope.setWarehouseCode("WH-A");
+        scope.setDataFamily(family); scope.setScopeJson("{\"customerMode\":\"ALL_AUTHORIZED\"}");
+        scope.setBusinessTimezone("America/New_York"); scope.setSourceTimezone("UTC");
+        scope.setStaleAfterSeconds(43200); scope.setPublishedRunId(90L);
+        return scope;
+    }
+    private SelfopSyncRun run(String status) {
+        var run = new SelfopSyncRun(); run.setExecutionPurpose("BUSINESS"); run.setAttemptNo(1); run.setSourceAccount("synthetic-account");
+        run.setId(20L); run.setTaskId(1L); run.setScopeId(10L); run.setFenceToken(7L); run.setStatus(status);
+        return run;
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/sync/SelfopValidationRunnerTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/sync/SelfopValidationRunnerTest.java
new file mode 100644
index 000000000..ab291976f
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/sync/SelfopValidationRunnerTest.java
@@ -0,0 +1,201 @@
+package com.baiyue.lastleg.selfoperated.analytics.sync;
+
+import com.baomidou.mybatisplus.core.conditions.update.UpdateWrapper;
+import com.baiyue.lastleg.selfoperated.analytics.client.*;
+import com.baiyue.lastleg.selfoperated.analytics.mapper.*;
+import com.baiyue.lastleg.selfoperated.analytics.model.*;
+import com.baiyue.lastleg.selfoperated.analytics.request.*;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.mockito.ArgumentCaptor;
+import org.springframework.transaction.TransactionStatus;
+import org.springframework.transaction.support.TransactionTemplate;
+import java.math.BigDecimal;
+import java.util.*;
+import java.util.function.Consumer;
+import static com.baiyue.lastleg.selfoperated.analytics.model.SelfopSupport.*;
+import static org.junit.jupiter.api.Assertions.*;
+import static org.mockito.Mockito.*;
+import static org.mockito.ArgumentMatchers.*;
+
+/** Offline callbacks model durable checkpoints, without pretending to test MySQL transaction rollback. */
+class SelfopValidationRunnerTest {
+    private final LingxingAnalyticsClient client=mock(LingxingAnalyticsClient.class);
+    private final SelfopSyncStageMapper stages=mock(SelfopSyncStageMapper.class);
+    private final SelfopSyncTaskMapper tasks=mock(SelfopSyncTaskMapper.class);
+    private final SelfopSyncRunMapper runs=mock(SelfopSyncRunMapper.class);
+    private final SelfopCoordinationMapper locks=mock(SelfopCoordinationMapper.class);
+    private final SelfopLeaseService leases=mock(SelfopLeaseService.class);
+    private final SelfopEgressService egress=mock(SelfopEgressService.class);
+    private final SelfopAnalyticsProperties config=new SelfopAnalyticsProperties();
+    private final TransactionTemplate tx=mock(TransactionTemplate.class);
+    private final SelfopLeaseService.Lease lease=new SelfopLeaseService.Lease(3,"owner",8,true);
+    private SelfopSyncTask task;
+    private SelfopSyncRun run;
+    private SelfopValidationRunner runner;
+    @BeforeEach void setup() {
+        config.setCollectionMode("VALIDATION");config.setSourceAccount("demo");config.setExclusiveGrantId("test-grant");
+        config.getWarehouses().put("A",new SelfopAnalyticsProperties.Warehouse());config.getWarehouses().put("B",new SelfopAnalyticsProperties.Warehouse());
+        task=new SelfopSyncTask();task.setId(1L);task.setValidationRootTaskId(1L);task.setTaskRole("ACCOUNT_DISCOVERY");task.setExecutionPurpose("VALIDATION");
+        task.setSourceAccount("demo");task.setDiscoveryScopeId(3L);task.setAttemptCount(1);task.setStatus("RUNNING");task.setTaskType("VALIDATION");
+        task.setQueryScopeJson("{\"action\":\"VALIDATION\",\"warehouses\":[\"A\"],\"startTime\":\"2026-10-12T08:00:00\",\"endTime\":\"2026-10-12T08:10:00\"}");
+        task.setValidationBudgetJson(SelfopValidationBudget.freeze(utcNow()));
+        run=new SelfopSyncRun();run.setId(2L);run.setTaskId(1L);run.setSourceAccount("demo");run.setExecutionPurpose("VALIDATION");run.setAttemptNo(1);run.setFenceToken(8L);run.setStatus("FETCHING");
+        when(locks.lockTask(1)).thenReturn(task);when(locks.lockRun(2)).thenReturn(run);when(tasks.selectById(1L)).thenReturn(task);
+        doAnswer(i->{Consumer<TransactionStatus> callback=i.getArgument(0);callback.accept(mock(TransactionStatus.class));return null;}).when(tx).executeWithoutResult(any());
+        when(client.warehouses(any(SelfopRequestContext.class),eq(1),eq(10))).thenReturn(page(1,0,0,List.of()));
+        when(client.discover(any(SelfopRequestContext.class),any(),any(),eq(1),eq(10))).thenReturn(page(1,0,0,List.of()));
+        when(client.inventory(any(SelfopRequestContext.class),anyString(),eq(1),eq(10))).thenReturn(page(1,0,0,List.of()));
+        runner=new SelfopValidationRunner(client,stages,tasks,runs,locks,leases,egress,config,tx);
+    }
+    private <T> LingxingAnalyticsClient.Page<T> page(int current,long total,int pages,List<T> records){return new LingxingAnalyticsClient.Page<>(records,current,10,total,pages);}
+    private SelfopPayloads.Stock stock(String warehouse,String sku,BigDecimal qty){return new SelfopPayloads.Stock("demo","customer",warehouse,sku,0,"Name",qty,qty,BigDecimal.ZERO,BigDecimal.ZERO,null);}
+    private LingxingAnalyticsClient.Summary summary(String number){return new LingxingAnalyticsClient.Summary("demo","customer","A",number,"source",100,null,"2026-10-12 08:02:00", null);}
+
+    @Test void selectedWarehouseSampleOnlyStagesItsOwnRowsAndDoesNotClaimCompleteCoverage() {
+        when(client.inventory(any(SelfopRequestContext.class),eq("A"),eq(1),eq(10))).thenReturn(page(1,30,3,List.of(stock("A","one",BigDecimal.ZERO))));
+        when(client.inventory(any(SelfopRequestContext.class),eq("A"),eq(2),eq(10))).thenReturn(page(2,30,3,List.of(stock("A","two",null))));
+        when(client.inventory(any(SelfopRequestContext.class),eq("B"),eq(1),eq(10))).thenReturn(page(1,30,3,List.of(stock("B","one",BigDecimal.ONE))));
+        when(client.inventory(any(SelfopRequestContext.class),eq("B"),eq(2),eq(10))).thenReturn(page(2,30,3,List.of(stock("B","two",BigDecimal.ONE))));
+        runner.run(task,run,lease);
+        assertEquals("SAMPLE_DONE",run.getStatus());assertEquals("UNKNOWN",run.getCoverageStatus());assertNull(run.getPublishedAtUtc());assertNull(run.getCoveredUntilUtc());
+        verify(client,never()).inventory(any(SelfopRequestContext.class),anyString(),eq(3),anyInt());
+        var capture=ArgumentCaptor.forClass(SelfopSyncStage.class);verify(stages,times(2)).insert(capture.capture());
+        assertTrue(capture.getAllValues().stream().allMatch(s->s.getObjectType().equals("PRODUCT_STOCK")&&s.getObservationSequence()==null));
+        assertTrue(capture.getAllValues().stream().allMatch(s->"A".equals(s.getWarehouseCode())));
+        verify(client,never()).inventory(any(SelfopRequestContext.class),eq("B"),anyInt(),anyInt());
+        assertTrue(capture.getAllValues().stream().anyMatch(s->"PENDING".equals(s.getValidationStatus())));
+        verify(egress).finishSample(1L,"VALIDATION_SAMPLE_SUFFICIENT");
+        verify(tasks,never()).updateById(any(SelfopSyncTask.class)); // quota root JSON cannot be overwritten by an earlier task snapshot
+    }
+    @Test void emptyCompletePagesStillEndSampleAndNeverBecomeFormalVersion() {
+        runner.run(task,run,lease);assertEquals("SAMPLE_DONE",run.getStatus());assertEquals("UNKNOWN",run.getCoverageStatus());
+        assertNull(run.getPublishedAtUtc());assertNull(run.getAppliedFactRevision());verify(stages,never()).insert(any(SelfopSyncStage.class));
+        assertNotNull(run.getProgressSnapshotJson());
+    }
+    @Test void requestBudgetStopIsSampleDoneNotYieldAndNoSubsequentRequests() {
+        when(client.discover(any(SelfopRequestContext.class),any(),any(),eq(1),eq(10))).thenThrow(new EgressRejectedException("VALIDATION_PAGE_LIMIT",true,null));
+        runner.run(task,run,lease);assertEquals("SAMPLE_DONE",run.getStatus());verify(egress).finishSample(1L,"VALIDATION_PAGE_LIMIT");
+        verify(client,never()).inventory(any(SelfopRequestContext.class),anyString(),anyInt(),anyInt());
+    }
+    @Test void rateLimitFailsEntireRootAndDoesNotResumeOtherWarehouse() {
+        when(client.inventory(any(SelfopRequestContext.class),eq("A"),eq(1),eq(10))).thenThrow(new AnalyticsClientException("LINGXING_WMS_RATE_LIMITED",true));
+        runner.run(task,run,lease);assertEquals("FAILED",run.getStatus());verify(egress).failValidation(1L,"LINGXING_WMS_RATE_LIMITED");
+        verify(client,never()).inventory(any(SelfopRequestContext.class),eq("B"),anyInt(),anyInt());
+    }
+    @Test void uniqueDetailsRetainSkuQuantitiesAndIdentityValidation() throws Exception {
+        when(client.discover(any(SelfopRequestContext.class),any(),any(),eq(1),eq(10))).thenReturn(page(1,1,1,List.of(summary("order"))));
+        var detail=new SelfopPayloads.Order("demo","customer","A","order","source",100,null,"2026-10-12 08:02:00",List.of(new SelfopPayloads.Item("sku",null,BigDecimal.ONE,"PCS")));
+        when(client.detail(any(SelfopRequestContext.class),eq("A"),eq("customer"),eq("order"))).thenReturn(detail);
+        runner.run(task,run,lease);
+        var capture=ArgumentCaptor.forClass(SelfopSyncStage.class);verify(stages,times(2)).insert(capture.capture());
+        var row=capture.getAllValues().stream().filter(s->"OUTBOUND_ORDER".equals(s.getObjectType())&&"SAMPLE_VALIDATED".equals(s.getValidationCode())).findFirst().orElseThrow();
+        assertEquals(BigDecimal.ONE,read(row.getPayloadJson(),SelfopPayloads.Order.class).items().get(0).actualQuantity());
+        assertNull(row.getObservationSequence());assertEquals("SAMPLE_DONE",run.getStatus());
+        assertEquals("PENDING",row.getValidationStatus());
+        assertTrue(capture.getAllValues().stream().allMatch(s->s.getObjectType().length()<=16&&
+            (!"OUTBOUND_ORDER".equals(s.getObjectType())||!"VALID".equals(s.getValidationStatus())||s.getObservationSequence()!=null)));
+        try(var schema=getClass().getResourceAsStream("/db/lastleg.sql")) {
+            assertNotNull(schema);
+            String sql=new String(schema.readAllBytes(),java.nio.charset.StandardCharsets.UTF_8);
+            assertTrue(sql.contains("object_type VARCHAR(16)"));
+            assertTrue(sql.contains("object_type <> 'OUTBOUND_ORDER' OR validation_status <> 'VALID' OR observation_sequence IS NOT NULL"));
+        }
+    }
+    @Test void restartUsesPersistedSampleCursorWithoutRepeatingCompletedPagesOrDetails() {
+        var saved=new SelfopValidationRunner.Sample();saved.setWarehousesRead(true);saved.setDirectoryRead(true);saved.setDetailIndex(1);
+        saved.getOrders().add(summary("order"));saved.getInventoryFinished().add("A");saved.getInventoryNextPage().put("A",3);
+        task.setRoutingManifestJson(json(saved));runner.run(task,run,lease);
+        verify(client,never()).warehouses(any(SelfopRequestContext.class),anyInt(),anyInt());
+        verify(client,never()).detail(any(SelfopRequestContext.class),anyString(),anyString(),anyString());
+        verify(client,never()).inventory(any(SelfopRequestContext.class),eq("A"),anyInt(),anyInt());
+        verify(client,never()).inventory(any(SelfopRequestContext.class),eq("B"),anyInt(),anyInt());
+        assertEquals("SAMPLE_DONE",run.getStatus());
+    }
+    @Test void wrongPurposeCannotCallAnyClient() {
+        task.setExecutionPurpose("BUSINESS");assertThrows(IllegalStateException.class,()->runner.run(task,run,lease));verifyNoInteractions(client,egress);
+    }
+    @Test void malformedPersistedSampleTerminatesRootBeforeAnyProviderRequest() {
+        task.setRoutingManifestJson("{invalid");
+        runner.run(task,run,lease);
+        assertEquals("FAILED",run.getStatus());assertEquals("UNKNOWN",run.getCoverageStatus());
+        assertNull(run.getPublishedAtUtc());assertNull(run.getAppliedFactRevision());
+        verify(egress).failValidation(1L,"VALIDATION_STRUCTURE_REJECTED");
+        verifyNoInteractions(client,stages);
+        verify(tasks).update(isNull(),argThat((UpdateWrapper<SelfopSyncTask> write)->
+            write.getSqlSet().contains("next_retry_at_utc")
+                && write.getParamNameValuePairs().containsValue("DEAD")
+                && write.getParamNameValuePairs().containsValue(null)));
+    }
+    @Test void executionFailureOnChildTerminatesItsOriginalRootAndClearsChildRetry() {
+        task.setValidationRootTaskId(9L);
+        runner.fail(task,run,lease,"VALIDATION_STRUCTURE_REJECTED");
+        assertEquals("FAILED",run.getStatus());assertNull(run.getPublishedAtUtc());
+        verify(egress).failValidation(9L,"VALIDATION_STRUCTURE_REJECTED");
+        verify(tasks).update(isNull(),argThat((UpdateWrapper<SelfopSyncTask> write)->
+            write.getSqlSet().contains("next_retry_at_utc")
+                && write.getParamNameValuePairs().containsValue("DEAD")
+                && write.getParamNameValuePairs().containsValue(null)));
+        verifyNoInteractions(client,stages);
+    }
+    @Test void oldExecutorCannotMarkNewAttemptFailed() {
+        doThrow(new IllegalStateException("SELFOP_FENCE_REJECTED")).when(leases).renew(lease);
+        assertThrows(IllegalStateException.class,()->runner.run(task,run,lease));verifyNoInteractions(egress);verifyNoInteractions(client);
+    }
+    @Test void warehouseEvidenceUsesRunDimensionsAndOnlyDeclaredStageTypesAreWritten() {
+        var warehouse=new LingxingAnalyticsClient.Warehouse("A","Warehouse",0,0,"America/New_York");
+        when(client.warehouses(any(SelfopRequestContext.class),eq(1),eq(10))).thenReturn(page(1,11,2,List.of(warehouse)));
+        runner.run(task,run,lease);
+        var dimensions=read(run.getObservedDimensionsJson(),Map.class);
+        assertEquals(true,dimensions.get("truncated"));assertTrue(dimensions.containsKey("validationWarehouseSamples"));
+        verify(stages,never()).insert(any(SelfopSyncStage.class));assertEquals("SAMPLE_DONE",run.getStatus());
+    }
+    @Test void overlongSkuCannotBeAcceptedAsStructurallyValidStock() {
+        when(client.inventory(any(SelfopRequestContext.class),eq("A"),eq(1),eq(10))).thenReturn(page(1,1,1,List.of(stock("A","x".repeat(129),BigDecimal.ONE))));
+        runner.run(task,run,lease);assertEquals("FAILED",run.getStatus());
+        verify(egress).failValidation(1L,"VALIDATION_STRUCTURE_REJECTED");verify(stages,never()).insert(any(SelfopSyncStage.class));
+    }
+    private void directoryOnly() {
+        config.getWarehouses().clear();task.setQueryScopeJson("{\"action\":\"WAREHOUSE_DISCOVERY\",\"sourceAccount\":\"demo\"}");
+        task.setValidationBudgetJson(SelfopValidationBudget.freezeWarehouseDiscovery(utcNow()));
+    }
+    @Test void warehouseDiscoveryReadsOnePageWithoutTimeWindowOrConfiguredWarehouseAndImmediatelyStops() {
+        directoryOnly();
+        var a=new LingxingAnalyticsClient.Warehouse("REAL-A","A",0,0,"America/New_York");
+        var b=new LingxingAnalyticsClient.Warehouse("REAL-B","B",0,0,"America/Los_Angeles");
+        when(client.warehouses(any(SelfopRequestContext.class),eq(1),eq(10))).thenReturn(page(1,2,1,List.of(a,b)));
+        runner.run(task,run,lease);
+        assertEquals("SAMPLE_DONE",run.getStatus());assertEquals("UNKNOWN",run.getCoverageStatus());assertNull(run.getPublishedAtUtc());
+        assertTrue(run.getObservedDimensionsJson().contains("REAL-A"));assertTrue(run.getObservedDimensionsJson().contains("REAL-B"));
+        verify(client,times(1)).warehouses(any(SelfopRequestContext.class),eq(1),eq(10));
+        verify(client,never()).discover(any(SelfopRequestContext.class),any(),any(),anyInt(),anyInt());
+        verify(client,never()).detail(any(SelfopRequestContext.class),anyString(),anyString(),anyString());
+        verify(client,never()).inventory(any(SelfopRequestContext.class),anyString(),anyInt(),anyInt());verifyNoInteractions(stages);
+        verify(egress).finishSample(1L,"VALIDATION_WAREHOUSE_DIRECTORY_COMPLETE");
+    }
+    @Test void truncatedDirectoryIsExplicitAndCannotRequestSecondPage() {
+        directoryOnly();when(client.warehouses(any(SelfopRequestContext.class),eq(1),eq(10)))
+            .thenReturn(page(1,11,2,List.of(new LingxingAnalyticsClient.Warehouse("A",null,0,0,null))));
+        runner.run(task,run,lease);verify(egress).finishSample(1L,"VALIDATION_WAREHOUSE_DIRECTORY_TRUNCATED");
+        verify(client,never()).warehouses(any(SelfopRequestContext.class),eq(2),anyInt());
+    }
+    @Test void directoryRateLimitTerminatesRootWithoutAnyBusinessRequest() {
+        directoryOnly();when(client.warehouses(any(SelfopRequestContext.class),eq(1),eq(10)))
+            .thenThrow(new AnalyticsClientException("LINGXING_WMS_RATE_LIMITED",true));
+        runner.run(task,run,lease);assertEquals("FAILED",run.getStatus());verify(egress).failValidation(1L,"LINGXING_WMS_RATE_LIMITED");
+        verify(client,never()).discover(any(SelfopRequestContext.class),any(),any(),anyInt(),anyInt());verifyNoInteractions(stages);
+    }
+    @Test void mixedAccountDirectoryOnlyFetchesDetailsOfFrozenWarehouse() {
+        var other=new LingxingAnalyticsClient.Summary("demo","customer","B","other","source",100,null,"2026-10-12 08:02:00", null);
+        when(client.discover(any(SelfopRequestContext.class),any(),any(),eq(1),eq(10))).thenReturn(page(1,2,1,List.of(other,summary("selected"))));
+        when(client.detail(any(SelfopRequestContext.class),eq("A"),eq("customer"),eq("selected")))
+            .thenReturn(new SelfopPayloads.Order("demo","customer","A","selected","source",100,null,"2026-10-12 08:02:00",List.of()));
+        runner.run(task,run,lease);assertEquals("SAMPLE_DONE",run.getStatus());
+        verify(client,never()).detail(any(SelfopRequestContext.class),eq("B"),anyString(),anyString());
+        verify(client,never()).inventory(any(SelfopRequestContext.class),eq("B"),anyInt(),anyInt());
+    }
+    @Test void missingOrMultipleFrozenWarehousesFailBeforeAnyProviderRequest() {
+        task.setQueryScopeJson("{\"action\":\"VALIDATION\",\"warehouses\":[\"A\",\"B\"]}");
+        runner.run(task,run,lease);assertEquals("FAILED",run.getStatus());verifyNoInteractions(client,stages);
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/sync/SyncControllerTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/sync/SyncControllerTest.java
new file mode 100644
index 000000000..5e23901c0
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/selfoperated/analytics/sync/SyncControllerTest.java
@@ -0,0 +1,182 @@
+package com.baiyue.lastleg.selfoperated.analytics.sync;
+
+import com.baiyue.common.security.AuthenticatedUser;
+import com.baiyue.lastleg.selfoperated.analytics.mapper.SelfopOutboundDiscoveryScopeMapper;
+import com.baiyue.lastleg.selfoperated.analytics.mapper.SelfopSyncScopeMapper;
+import com.baiyue.lastleg.selfoperated.analytics.mapper.SelfopSyncTaskMapper;
+import com.baiyue.lastleg.selfoperated.analytics.model.SelfopAnalyticsProperties;
+import com.baiyue.lastleg.selfoperated.analytics.model.SelfopSyncScope;
+import com.baiyue.lastleg.selfoperated.analytics.model.SelfopSyncTask;
+import org.junit.jupiter.api.Test;
+import org.mockito.ArgumentCaptor;
+import org.springframework.http.HttpStatus;
+import org.springframework.security.access.prepost.PreAuthorize;
+import org.springframework.web.server.ResponseStatusException;
+import java.util.Set;
+import com.baiyue.common.web.GlobalExceptionHandler;
+import com.baiyue.lastleg.selfoperated.analytics.model.SelfopSupport;
+import org.springframework.test.web.servlet.MockMvc;
+import org.springframework.test.web.servlet.setup.MockMvcBuilders;
+import org.springframework.web.method.support.HandlerMethodArgumentResolver;
+import org.springframework.core.MethodParameter;
+import org.springframework.web.method.support.ModelAndViewContainer;
+import org.springframework.web.context.request.NativeWebRequest;
+import org.springframework.web.bind.support.WebDataBinderFactory;
+import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post;
+import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.*;
+import static org.assertj.core.api.Assertions.*;
+import static org.mockito.Mockito.*;
+
+class SyncControllerTest {
+    private static final String SYNC = "platform:self-operated-analytics:sync";
+    private final SelfopCommandService.Command command = new SelfopCommandService.Command(
+            "synthetic-command", "WH-A", "INVENTORY", null, null, null, null, null, "offline test");
+
+    @Test void anonymousAndCustomerCannotCreatePlatformTasksEvenWithSyncPermission() {
+        var commands = mock(SelfopCommandService.class);
+        var controller = new SyncController(commands);
+        assertForbidden(() -> controller.request(null, command));
+        assertForbidden(() -> controller.request(user(100L, Set.of(SYNC)), command));
+        verifyNoInteractions(commands);
+    }
+
+    @Test void platformReadPermissionDoesNotAuthorizeManualSync() {
+        var commands = mock(SelfopCommandService.class);
+        var controller = new SyncController(commands);
+        assertForbidden(() -> controller.request(user(0L, Set.of("platform:self-operated-analytics:list")), command));
+        assertForbidden(() -> controller.request(user(0L, Set.of()), command));
+        verifyNoInteractions(commands);
+    }
+
+    @Test void platformScopeFromClientAppAndImpersonatedUserAreDenied() {
+        var commands = mock(SelfopCommandService.class);
+        var controller = new SyncController(commands);
+        var client = new AuthenticatedUser(42L, 0L, 0L, 1L, "synthetic-user", "CLIENT", "WEB", Set.of(SYNC));
+        var impersonated = new AuthenticatedUser(42L, 0L, 0L, 1L, "synthetic-user", "PLATFORM", "WEB", Set.of(SYNC),
+                true, 77L, 2L, false);
+        assertForbidden(() -> controller.request(client, command));
+        assertForbidden(() -> controller.request(impersonated, command));
+        verifyNoInteractions(commands);
+    }
+
+    @Test void authorizedPlatformCommandReturnsAcceptedWithoutPerformingCollection() {
+        var config = new SelfopAnalyticsProperties();
+        assertThat(config.getCollectionMode()).isEqualTo("OFF");
+        assertThat(config.isExecutionEnabled()).isFalse();
+        config.setCollectionMode("BUSINESS"); config.setEnvironment("production"); config.setSourceAccount("synthetic-account");
+        config.getWarehouses().put("WH-A", new SelfopAnalyticsProperties.Warehouse());
+        var tasks = mock(SelfopTaskService.class);
+        var scopes = mock(SelfopSyncScopeMapper.class);
+        var accounts = mock(SelfopOutboundDiscoveryScopeMapper.class);
+        var scope = new SelfopSyncScope();
+        scope.setId(10L); scope.setScopeHash("synthetic-scope-hash");
+        scope.setScopeJson("{\"customerMode\":\"ALL_AUTHORIZED\",\"qualities\":\"ALL\"}");
+        when(scopes.selectOne(any())).thenReturn(scope);
+        when(tasks.create(any(SelfopSyncTask.class))).thenAnswer(call -> {
+            SelfopSyncTask task = call.getArgument(0); task.setId(101L); task.setTaskNo("LXCOL-20261012-00000101"); return task;
+        });
+        var taskRows = mock(SelfopSyncTaskMapper.class);
+        var commands = new SelfopCommandService(tasks, scopes, accounts, config, taskRows);
+        var response = new SyncController(commands).request(user(0L, Set.of(SYNC)), command);
+        assertThat(response.successful()).isTrue();
+        assertThat(response.data().taskNo()).isEqualTo("LXCOL-20261012-00000101");
+        assertThat(response.data().status()).isEqualTo("ACCEPTED");
+        assertThat(response.data().warehouseCode()).isEqualTo("WH-A");
+        assertThat(config.isExecutionEnabled()).isTrue();
+        assertThat(config.isSalesPublicationEnabled()).isFalse();
+        var captured = ArgumentCaptor.forClass(SelfopSyncTask.class);
+        verify(tasks).create(captured.capture());
+        assertThat(captured.getValue().getRequestedBy()).isEqualTo("42");
+        assertThat(captured.getValue().getRequestKey()).isEqualTo("manual:synthetic-command");
+        assertThat(captured.getValue().getTaskRole()).isEqualTo("WAREHOUSE_SYNC");
+        assertThat(captured.getValue().getWarehouseCode()).isEqualTo("WH-A");
+        verify(tasks).initialize();
+        verifyNoInteractions(accounts, taskRows);
+    }
+
+    @Test void endpointDeclaresIndependentSyncAuthority() throws Exception {
+        var method = SyncController.class.getMethod("request", AuthenticatedUser.class, SelfopCommandService.Command.class);
+        assertThat(method.getAnnotation(PreAuthorize.class).value()).isEqualTo("hasAuthority('" + SYNC + "')");
+    }
+
+    @Test void offAndRetryAreChineseBusinessRejectionsBeforeAnyInitialization() throws Exception {
+        var config=new SelfopAnalyticsProperties();
+        var tasks=mock(SelfopTaskService.class);var scopes=mock(SelfopSyncScopeMapper.class);
+        var accounts=mock(SelfopOutboundDiscoveryScopeMapper.class);var rows=mock(SelfopSyncTaskMapper.class);
+        var mvc=mvc(new SelfopCommandService(tasks,scopes,accounts,config,rows));
+        rejected(mvc,command,"采集功能未启用，当前环境不允许执行采集或重试");
+        rejected(mvc,new SelfopCommandService.Command("retry","WH-A","RETRY","LXCOL-1",null,null,null,null,"原因"),
+            "采集功能未启用，当前环境不允许执行采集或重试");
+        verifyNoInteractions(tasks,scopes,accounts,rows);
+    }
+
+    @Test void unconfiguredWarehouseAndInvalidPublicInputsRejectBeforeInitialization() throws Exception {
+        var config=new SelfopAnalyticsProperties();config.setCollectionMode("BUSINESS");config.setEnvironment("production");
+        var tasks=mock(SelfopTaskService.class);var scopes=mock(SelfopSyncScopeMapper.class);
+        var accounts=mock(SelfopOutboundDiscoveryScopeMapper.class);var rows=mock(SelfopSyncTaskMapper.class);
+        var mvc=mvc(new SelfopCommandService(tasks,scopes,accounts,config,rows));
+        rejected(mvc,command,"该仓库尚未配置采集，暂不能提交任务");
+        config.getWarehouses().put("WH-A",new SelfopAnalyticsProperties.Warehouse());
+        rejected(mvc,new SelfopCommandService.Command("invalid","WH-A",null,null,null,null,null,null,null),"不支持此采集操作");
+        rejected(mvc,new SelfopCommandService.Command("invalid","WH-A","BACKFILL",null,null,null,null,null,null),
+            "采集时间范围不能为空，结束时间必须晚于开始时间");
+        rejected(mvc,new SelfopCommandService.Command("invalid","WH-A","RETRY","LXCOL-1",null,null,null,null," "),
+            "重试原因不能为空且不能超过500个字符");
+        verifyNoInteractions(tasks,scopes,accounts,rows);
+    }
+
+    @Test void controlledTaskConflictIsBusinessRejectionButUnknownFailureRemainsSystemError() throws Exception {
+        var config=new SelfopAnalyticsProperties();config.setCollectionMode("BUSINESS");config.setEnvironment("production");
+        config.setSourceAccount("synthetic-account");config.getWarehouses().put("WH-A",new SelfopAnalyticsProperties.Warehouse());
+        var tasks=mock(SelfopTaskService.class);var scopes=mock(SelfopSyncScopeMapper.class);
+        var accounts=mock(SelfopOutboundDiscoveryScopeMapper.class);var rows=mock(SelfopSyncTaskMapper.class);
+        var scope=new SelfopSyncScope();scope.setId(10L);scope.setScopeHash("hash");when(scopes.selectOne(any())).thenReturn(scope);
+        var mvc=mvc(new SelfopCommandService(tasks,scopes,accounts,config,rows));
+        doThrow(new IllegalStateException("SELFOP_IDEMPOTENCY_CONFLICT")).when(tasks).create(any());
+        rejected(mvc,command,"请求标识已用于其他内容，请刷新后重新提交");
+        doThrow(new IllegalStateException("unknown runtime failure")).when(tasks).create(any());
+        mvc.perform(post("/api/platform/v1/last-leg/self-operated-analytics/sync-tasks")
+            .contentType("application/json").content(SelfopSupport.json(command)))
+            // The platform handler transports all result codes in HTTP 200; unknown failures retain S0500.
+            .andExpect(status().isOk()).andExpect(jsonPath("$.code").value("S0500"));
+    }
+
+    @Test void runningRetryIsControlledAndDoesNotInitializeScopes() throws Exception {
+        var config=new SelfopAnalyticsProperties();config.setCollectionMode("BUSINESS");config.setEnvironment("production");
+        config.setSourceAccount("synthetic-account");config.getWarehouses().put("WH-A",new SelfopAnalyticsProperties.Warehouse());
+        var tasks=mock(SelfopTaskService.class);var scopes=mock(SelfopSyncScopeMapper.class);
+        var accounts=mock(SelfopOutboundDiscoveryScopeMapper.class);var rows=mock(SelfopSyncTaskMapper.class);
+        var original=new SelfopSyncTask();original.setId(1L);original.setTaskRole("WAREHOUSE_SYNC");
+        original.setWarehouseCode("WH-A");original.setExecutionPurpose("BUSINESS");original.setStatus("FETCHING");
+        when(rows.selectOne(any())).thenReturn(original);
+        doThrow(new IllegalStateException("SELFOP_RETRY_LEASE_BUSY")).when(tasks).retry(1L,"retry","42","原因");
+        rejected(mvc(new SelfopCommandService(tasks,scopes,accounts,config,rows)),
+            new SelfopCommandService.Command("retry","WH-A","RETRY","LXCOL-1",null,null,null,null,"原因"),
+            "任务正在执行，暂不能重试");
+        verify(tasks,never()).initialize();verify(tasks,never()).create(any());verifyNoInteractions(scopes,accounts);
+    }
+
+    private void rejected(MockMvc mvc,SelfopCommandService.Command request,String message) throws Exception {
+        mvc.perform(post("/api/platform/v1/last-leg/self-operated-analytics/sync-tasks")
+            .contentType("application/json").content(SelfopSupport.json(request)))
+            .andExpect(status().isOk()).andExpect(jsonPath("$.code").value("B0001"))
+            .andExpect(jsonPath("$.message").value(message));
+    }
+    private MockMvc mvc(SelfopCommandService commands){
+        return MockMvcBuilders.standaloneSetup(new SyncController(commands)).setControllerAdvice(new GlobalExceptionHandler())
+            .setCustomArgumentResolvers(new HandlerMethodArgumentResolver(){
+                public boolean supportsParameter(MethodParameter parameter){return parameter.getParameterType()==AuthenticatedUser.class;}
+                public Object resolveArgument(MethodParameter parameter,ModelAndViewContainer container,NativeWebRequest request,WebDataBinderFactory factory){
+                    return user(0L,Set.of(SYNC));
+                }
+            }).build();
+    }
+
+    private AuthenticatedUser user(Long customerScope, Set<String> permissions) {
+        return new AuthenticatedUser(42L, customerScope, 0L, 1L, "synthetic-user", "PLATFORM", "WEB", permissions);
+    }
+    private void assertForbidden(org.assertj.core.api.ThrowableAssert.ThrowingCallable request) {
+        assertThatThrownBy(request).isInstanceOf(ResponseStatusException.class)
+                .satisfies(e -> assertThat(((ResponseStatusException)e).getStatusCode()).isEqualTo(HttpStatus.FORBIDDEN));
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/service/CompactBusinessNumberServiceTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/service/CompactBusinessNumberServiceTest.java
new file mode 100644
index 000000000..07ff1c047
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/service/CompactBusinessNumberServiceTest.java
@@ -0,0 +1,41 @@
+package com.baiyue.lastleg.service;
+
+import org.junit.jupiter.api.Test;
+import org.springframework.jdbc.core.JdbcTemplate;
+import java.time.Instant;
+import static org.junit.jupiter.api.Assertions.*;
+import static org.mockito.Mockito.*;
+
+class CompactBusinessNumberServiceTest {
+    @Test void usesCustomerInitialsAndShanghaiSecondsWithoutSequenceSuffix() {
+        JdbcTemplate jdbc = mock(JdbcTemplate.class);
+        var customers = mock(ReturnOrderReferenceResolver.class);
+        when(customers.customerName("42")).thenReturn("柏悦物流");
+        when(jdbc.queryForObject("SELECT LAST_INSERT_ID()", Long.class))
+            .thenAnswer(call -> Instant.now().getEpochSecond());
+        String number = new CompactBusinessNumberService(jdbc, customers).next("TB", "42");
+        assertTrue(number.matches("TB-BYWL-[0-9]{12}"), number);
+        assertEquals("AB", CompactBusinessNumberService.initials("Alpha Beta"));
+    }
+
+    @Test void usesDatabaseLogicalSecondAcrossInstancesAndClockRollback() {
+        JdbcTemplate jdbc = mock(JdbcTemplate.class);
+        var first = new CompactBusinessNumberService(jdbc, null);
+        var second = new CompactBusinessNumberService(jdbc, null);
+        Instant now = Instant.parse("2026-10-16T02:30:00Z");
+        when(jdbc.queryForObject("SELECT LAST_INSERT_ID()", Long.class))
+            .thenReturn(now.getEpochSecond(), now.getEpochSecond() + 1, now.getEpochSecond() + 2);
+        assertEquals("ZY-ABC-261016103000", first.allocate("ZY", "ABC", now));
+        assertEquals("ZY-ABC-261016103001", second.allocate("ZY", "ABC", now));
+        assertEquals("ZY-ABC-261016103002", first.allocate("ZY", "ABC", now.minusSeconds(60)));
+    }
+
+    @Test void physicalLabelKeepsEveryIdBitAndIsCompact() {
+        long id = 2087379674555461633L;
+        String mark = LastlegOrderNoGenerator.compactCartonMark(id);
+        assertTrue(mark.length() <= 16);
+        assertEquals(id, Long.parseLong(mark.substring(3), 36));
+        assertNotEquals(mark, LastlegOrderNoGenerator.compactCartonMark(id + 1_000_000));
+        assertEquals(mark, new LastlegOrderNoGenerator().next("RETURN_CARTON", "92", id));
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/service/CustomerOrderProgressServiceTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/service/CustomerOrderProgressServiceTest.java
index 9ad75becb..2b6cffd69 100644
--- a/lastleg-service/src/test/java/com/baiyue/lastleg/service/CustomerOrderProgressServiceTest.java
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/service/CustomerOrderProgressServiceTest.java
@@ -15,4 +15,13 @@ class CustomerOrderProgressServiceTest {
         assertThat(result.get(1).stage()).isEqualTo("delivering");assertThat(result.get(1).partial()).isFalse();
         assertThat(result.get(2).partial()).isTrue();assertThat(result.get(3).partial()).isTrue();
     }
+
+    @Test void boundedSourceIdsReachTheMapperBeforeProjection() {
+        var mapper=org.mockito.Mockito.mock(com.baiyue.lastleg.mapper.CustomerOrderProgressMapper.class);
+        org.mockito.Mockito.when(mapper.sources("11",List.of("101"))).thenReturn(List.of(new Source("101",2,2,0)));
+        assertThat(new CustomerOrderProgressService(mapper).read(11,List.of(101L)).progress()).singleElement()
+            .isEqualTo(new com.baiyue.lastleg.dto.CustomerOrderProgress.Progress(101,"scheduled",false));
+        org.mockito.Mockito.verify(mapper).sources("11",List.of("101"));org.mockito.Mockito.verifyNoMoreInteractions(mapper);
+    }
+
 }
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/service/LastlegOrderReturnVolumeTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/service/LastlegOrderReturnVolumeTest.java
new file mode 100644
index 000000000..ed78ca1cb
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/service/LastlegOrderReturnVolumeTest.java
@@ -0,0 +1,37 @@
+package com.baiyue.lastleg.service;
+
+import com.baomidou.mybatisplus.core.MybatisConfiguration;
+import com.baiyue.lastleg.mapper.LastlegOrderMapper;
+import org.apache.ibatis.datasource.unpooled.UnpooledDataSource;
+import org.apache.ibatis.mapping.Environment;
+import org.apache.ibatis.session.SqlSessionFactoryBuilder;
+import org.apache.ibatis.transaction.jdbc.JdbcTransactionFactory;
+import org.junit.jupiter.api.Test;
+import java.util.List;
+import static org.assertj.core.api.Assertions.assertThat;
+
+class LastlegOrderReturnVolumeTest {
+    @Test void historicalParcelsAreIncludedWithLatestCarrierMeasurementsAndCustomerIsolation() throws Exception {
+        var config = new MybatisConfiguration();
+        config.setEnvironment(new Environment("test", new JdbcTransactionFactory(),
+            new UnpooledDataSource("org.h2.Driver", "jdbc:h2:mem:return-volume;MODE=MySQL", "sa", "")));
+        config.addMapper(LastlegOrderMapper.class);
+        try (var session = new SqlSessionFactoryBuilder().build(config).openSession()) {
+            var sql = session.getConnection().createStatement();
+            sql.execute("CREATE TABLE ll_return_order (id BIGINT, customer_id VARCHAR, lastleg_order_id BIGINT)");
+            sql.execute("CREATE TABLE ll_return_receipt (id BIGINT, return_order_id BIGINT, customer_id VARCHAR, unit_type VARCHAR, unit_code VARCHAR, receipt_no VARCHAR, signed_at TIMESTAMP, length DECIMAL(12,3), width DECIMAL(12,3), height DECIMAL(12,3))");
+            sql.execute("INSERT INTO ll_return_order VALUES (1,'A',9),(2,'B',10)");
+            sql.execute("INSERT INTO ll_return_receipt VALUES " +
+                "(1,1,'A','PARCEL','PK-A','RR-1','2026-10-13 10:00:00',40,40,40)," +
+                "(2,1,'A','PARCEL','PK-A','RR-2','2026-10-13 11:00:00',50,40,40)," +
+                "(3,1,'A','PARCEL','PK-B','RR-3','2026-10-13 11:00:00',60,50,50)," +
+                "(4,1,'B','PARCEL','PK-C','RR-4','2026-10-13 11:00:00',100,100,100)," +
+                "(5,2,'B','PARCEL','PK-D','RR-5','2026-10-13 11:00:00',100,100,100)," +
+                "(6,1,'A','PARCEL','PK-E','RR-6','2026-10-13 11:00:00',NULL,50,50)");
+            var rows = session.getMapper(LastlegOrderMapper.class).findReturnVolumes(List.of(9L));
+            assertThat(rows).hasSize(1);
+            assertThat(rows.get(0).orderId()).isEqualTo(9L);
+            assertThat(rows.get(0).volumeCbm()).isEqualByComparingTo("0.23");
+        }
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/service/ReturnOrderReferenceResolverTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/service/ReturnOrderReferenceResolverTest.java
index c56af968d..fbabbeccd 100644
--- a/lastleg-service/src/test/java/com/baiyue/lastleg/service/ReturnOrderReferenceResolverTest.java
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/service/ReturnOrderReferenceResolverTest.java
@@ -1,7 +1,9 @@
 package com.baiyue.lastleg.service;
 
 import com.baiyue.lastleg.entity.LastlegOrder;
-import com.baiyue.lastleg.fleet.customer.FleetCustomerDirectory;
+import com.baiyue.lastleg.service.reference.ReturnCustomerReferenceClient;
+import com.baiyue.common.core.api.ApiResponse;
+import com.baiyue.common.core.api.PageResult;
 import com.baiyue.lastleg.inboundplan.pda.gateway.WarehouseResourceGateway;
 import org.junit.jupiter.api.Test;
 import java.util.List;
@@ -11,11 +13,11 @@ import static org.mockito.Mockito.*;
 class ReturnOrderReferenceResolverTest {
     @Test
     void directoryFailureBlocksNewSnapshotButDoesNotHideHistoricalOrders() {
-        var customers = mock(FleetCustomerDirectory.class);
+        var customers = mock(ReturnCustomerReferenceClient.class);
         var warehouses = mock(WarehouseResourceGateway.class);
-        when(customers.find("1")).thenThrow(new org.springframework.web.server.ResponseStatusException(org.springframework.http.HttpStatus.SERVICE_UNAVAILABLE));
+        when(customers.customers("test-token", 1, 30, null, "ACTIVE", 1L)).thenThrow(new org.springframework.web.server.ResponseStatusException(org.springframework.http.HttpStatus.SERVICE_UNAVAILABLE));
         when(warehouses.requireActiveSharedWarehouse(10L)).thenReturn(new WarehouseResourceGateway.WarehouseReference(10L, "USLAX01", "洛杉矶仓", "ACTIVE"));
-        var resolver = new ReturnOrderReferenceResolver(customers, warehouses);
+        var resolver = new ReturnOrderReferenceResolver(customers, warehouses, "test-token");
         org.junit.jupiter.api.Assertions.assertThrows(org.springframework.web.server.ResponseStatusException.class, () -> resolver.populate(List.of(order())));
         var historical = order();
         resolver.populateForRead(List.of(historical));
@@ -24,24 +26,55 @@ class ReturnOrderReferenceResolverTest {
 
     @Test
     void resolvesMissingReturnReferencesOncePerCustomerAndWarehouseAndPreservesSnapshots() {
-        var customers = mock(FleetCustomerDirectory.class);
+        var customers = mock(ReturnCustomerReferenceClient.class);
         var warehouses = mock(WarehouseResourceGateway.class);
-        when(customers.find("1")).thenReturn(new FleetCustomerDirectory.Customer("1", "C1", "测试货主", null, null));
+        when(customers.customers("test-token", 1, 30, null, "ACTIVE", 1L)).thenReturn(ApiResponse.success(new PageResult<>(
+            List.of(new ReturnCustomerReferenceClient.Customer(1L, "C1", "测试货主", "ACTIVE", null, null)), 1, 30, 1, 1)));
         when(warehouses.requireActiveSharedWarehouse(10L)).thenReturn(new WarehouseResourceGateway.WarehouseReference(10L, "USLAX01", "洛杉矶仓", "ACTIVE"));
         LastlegOrder first = order(), second = order(), frozen = order();
         frozen.setCustomerName("原货主快照"); frozen.setOverseasWarehouseCode("OLD"); frozen.setOverseasWarehouseName("原仓库快照");
 
-        new ReturnOrderReferenceResolver(customers, warehouses).populate(List.of(first, second, frozen));
+        new ReturnOrderReferenceResolver(customers, warehouses, "test-token").populate(List.of(first, second, frozen));
 
         assertEquals("测试货主", first.getCustomerName());
         assertEquals("USLAX01", second.getOverseasWarehouseCode());
         assertEquals("洛杉矶仓", second.getOverseasWarehouseName());
         assertEquals("原货主快照", frozen.getCustomerName());
         assertEquals("原仓库快照", frozen.getOverseasWarehouseName());
-        verify(customers, times(1)).find("1");
+        verify(customers, times(1)).customers("test-token", 1, 30, null, "ACTIVE", 1L);
         verify(warehouses, times(1)).requireActiveSharedWarehouse(10L);
     }
 
+    @Test
+    void foreignOrInactiveCustomerCannotSupplyReturnSnapshot() {
+        var customers = mock(ReturnCustomerReferenceClient.class);
+        var warehouses = mock(WarehouseResourceGateway.class);
+        when(customers.customers("test-token", 1, 30, null, "ACTIVE", 1L)).thenReturn(ApiResponse.success(new PageResult<>(List.of(
+            new ReturnCustomerReferenceClient.Customer(2L, "C2", "其他客户", "ACTIVE", null, null),
+            new ReturnCustomerReferenceClient.Customer(1L, "C1", "停用客户", "DISABLED", null, null)), 1, 30, 2, 1)));
+        var resolver = new ReturnOrderReferenceResolver(customers, warehouses, "test-token");
+        var error = org.junit.jupiter.api.Assertions.assertThrows(org.springframework.web.server.ResponseStatusException.class,
+            () -> resolver.populate(List.of(order())));
+        assertEquals(400, error.getStatusCode().value());
+        verifyNoInteractions(warehouses);
+    }
+
+    @Test
+    void unexpectedClientFailureDoesNotHideHistoricalReturnAndKeepsMissingNameUnknown() {
+        var customers = mock(ReturnCustomerReferenceClient.class);
+        var warehouses = mock(WarehouseResourceGateway.class);
+        when(customers.customers("test-token", 1, 30, null, "ACTIVE", 1L)).thenThrow(new IllegalStateException("transport failure"));
+        when(warehouses.requireActiveSharedWarehouse(10L)).thenReturn(new WarehouseResourceGateway.WarehouseReference(10L, "USLAX01", "洛杉矶仓", "ACTIVE"));
+        var resolver = new ReturnOrderReferenceResolver(customers, warehouses, "test-token");
+        var historical = order();
+        resolver.populateForRead(List.of(historical));
+        org.junit.jupiter.api.Assertions.assertNull(historical.getCustomerName());
+        assertEquals("洛杉矶仓", historical.getOverseasWarehouseName());
+        var error = org.junit.jupiter.api.Assertions.assertThrows(org.springframework.web.server.ResponseStatusException.class,
+            () -> resolver.populate(List.of(order())));
+        assertEquals(503, error.getStatusCode().value());
+    }
+
     private LastlegOrder order() {
         var order = new LastlegOrder(); order.setOrderType("RETURN_RELABEL");
         order.setCustomerId("1"); order.setOverseasWarehouseId("10"); return order;
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/transfer/controller/MerchantWarehouseTransferControllerTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/transfer/controller/MerchantWarehouseTransferControllerTest.java
index ef731e388..bebe9059a 100644
--- a/lastleg-service/src/test/java/com/baiyue/lastleg/transfer/controller/MerchantWarehouseTransferControllerTest.java
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/transfer/controller/MerchantWarehouseTransferControllerTest.java
@@ -15,6 +15,7 @@ import static org.mockito.Mockito.verify;
 
 class MerchantWarehouseTransferControllerTest {
     private final WarehouseTransferService service = mock(WarehouseTransferService.class);
+    private final com.baiyue.lastleg.transfer.service.WarehouseTransferForecastService forecastService = mock(com.baiyue.lastleg.transfer.service.WarehouseTransferForecastService.class);
     private final MerchantWarehouseTransferController controller = controller();
     private final WarehouseTransferRequests.Query query = new WarehouseTransferRequests.Query(
         1, 20, null, null, null, null, null, null, null, null);
@@ -50,6 +51,15 @@ class MerchantWarehouseTransferControllerTest {
         verify(service).cartonLabel("100", "TR001");
     }
 
+    /** 补预报只使用登录客户身份，平台身份不可越权操作。 */
+    @Test
+    void forecastIncreaseUsesAuthenticatedCustomerAndRejectsPlatform() {
+        var request = new WarehouseTransferRequests.IncreaseForecastCartons(2,3);
+        controller.increaseForecastCartons(user(100L,"MERCHANT"),"TR001",request);
+        verify(forecastService).increase("100","TR001","1",request);
+        assertThrows(ResponseStatusException.class,()->controller.increaseForecastCartons(user(0L,"PLATFORM"),"TR001",request));
+    }
+
     @Test
     void merchantEndpointRejectsPlatformIdentity() {
         assertThrows(ResponseStatusException.class,
@@ -63,6 +73,7 @@ class MerchantWarehouseTransferControllerTest {
     private MerchantWarehouseTransferController controller() {
         MerchantWarehouseTransferController controller = new MerchantWarehouseTransferController();
         ReflectionTestUtils.setField(controller, "service", service);
+        ReflectionTestUtils.setField(controller, "forecastService", forecastService);
         return controller;
     }
 }
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/transfer/controller/WarehouseTransferForecastControllerTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/transfer/controller/WarehouseTransferForecastControllerTest.java
new file mode 100644
index 000000000..13d3f6bf5
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/transfer/controller/WarehouseTransferForecastControllerTest.java
@@ -0,0 +1,28 @@
+package com.baiyue.lastleg.transfer.controller;
+
+import com.baiyue.common.security.AuthenticatedUser;
+import com.baiyue.lastleg.transfer.dto.WarehouseTransferRequests;
+import com.baiyue.lastleg.transfer.service.WarehouseTransferForecastService;
+import org.junit.jupiter.api.Test;
+import org.springframework.test.util.ReflectionTestUtils;
+import org.springframework.web.server.ResponseStatusException;
+import java.util.Set;
+import static org.junit.jupiter.api.Assertions.*;
+import static org.mockito.Mockito.*;
+
+class WarehouseTransferForecastControllerTest {
+    /** 平台补箱明确使用选中客户和操作者，拒绝客户身份调用平台入口。 */
+    @Test void platformIncreaseRequiresPlatformAndExplicitCustomer() {
+        var service = mock(WarehouseTransferForecastService.class);
+        var controller = new WarehouseTransferController();
+        ReflectionTestUtils.setField(controller, "forecasts", service);
+        var platform = new AuthenticatedUser(7L, 0L, 0L, 8L, "operator", "PLATFORM", "WEB", Set.of());
+        var customer = new AuthenticatedUser(8L, 101L, 101L, 9L, "customer", "MERCHANT", "WEB", Set.of());
+        var request = new WarehouseTransferRequests.IncreaseForecastCartons(4, 6);
+        controller.increaseForecastCartons(platform, "101", "WT-1", request);
+        verify(service).increase("101", "WT-1", "7", request);
+        assertThrows(ResponseStatusException.class, () -> controller.increaseForecastCartons(customer, "101", "WT-1", request));
+        assertThrows(ResponseStatusException.class, () -> controller.increaseForecastCartons(platform, "", "WT-1", request));
+        verifyNoMoreInteractions(service);
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/transfer/dto/WarehouseTransferCargoValidationTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/transfer/dto/WarehouseTransferCargoValidationTest.java
index 3f680f3cb..1e6d7df3c 100644
--- a/lastleg-service/src/test/java/com/baiyue/lastleg/transfer/dto/WarehouseTransferCargoValidationTest.java
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/transfer/dto/WarehouseTransferCargoValidationTest.java
@@ -18,6 +18,16 @@ class WarehouseTransferCargoValidationTest {
         }
     }
 
+    @Test
+    void skuUnitsAndExpectedCartonsAreIndependent() {
+        try (var factory = Validation.buildDefaultValidatorFactory()) {
+            var validator = factory.getValidator();
+            assertTrue(validator.validate(new WarehouseTransferRequests.Item("SKU-A", "货物", 3, null, 120L)).isEmpty());
+            assertTrue(!validator.validate(new WarehouseTransferRequests.Item("SKU-A", "货物", 3, null, 0L)).isEmpty());
+            assertTrue(!validator.validate(new WarehouseTransferRequests.Item("SKU-A", "货物", 0, null, 120L)).isEmpty());
+        }
+    }
+
     @Test
     void cartonRelabelAllowsOriginalSkuToBeOmitted() {
         try (var factory = Validation.buildDefaultValidatorFactory()) {
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/transfer/service/TransferInventorySourceTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/transfer/service/TransferInventorySourceTest.java
new file mode 100644
index 000000000..8bc35b8ca
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/transfer/service/TransferInventorySourceTest.java
@@ -0,0 +1,48 @@
+package com.baiyue.lastleg.transfer.service;
+
+import com.baiyue.lastleg.transfer.dto.WarehouseTransferRequests;
+import com.baiyue.lastleg.transfer.mapper.InboundSnapshotMapper;
+import org.apache.ibatis.mapping.Environment;
+import org.apache.ibatis.session.*;
+import org.apache.ibatis.transaction.jdbc.JdbcTransactionFactory;
+import org.junit.jupiter.api.Test;
+import org.springframework.jdbc.core.JdbcTemplate;
+import org.springframework.jdbc.datasource.DriverManagerDataSource;
+import java.util.*;
+import java.math.BigDecimal;
+import java.time.LocalDateTime;
+import static org.junit.jupiter.api.Assertions.*;
+
+class TransferInventorySourceTest {
+    WarehouseTransferRequests.Create request(String inbound, String destination, String method, LocalDateTime arrival) {
+        return new WarehouseTransferRequests.Create(inbound,List.of(),"WH",destination,"ADDRESS",1,BigDecimal.ZERO,
+            method,arrival,null,null,null,null,false,"KEY",List.of(new WarehouseTransferRequests.Item("SKU","Product",1,null)));
+    }
+    @Test void inventoryDoesNotRequireRepeatedArrivalButExternalCargoStillDoes() {
+        assertTrue(request("IN","ONT8",null,null).isInboundModeValid());
+        assertFalse(request("IN",null,null,null).isInboundModeValid());
+        assertFalse(request(null,null,null,null).isInboundModeValid());
+        assertTrue(request(null,null,"CUSTOMER_DELIVERY",LocalDateTime.now()).isInboundModeValid());
+    }
+    @Test void originalBoxesIncludeBothSourcesButNeverAnotherCustomerWarehouseOrInbound() {
+        var ds = new DriverManagerDataSource("jdbc:h2:mem:"+UUID.randomUUID()+";MODE=MySQL;DB_CLOSE_DELAY=-1","sa","");
+        var db=new JdbcTemplate(ds);
+        db.execute("CREATE TABLE ll_order(id BIGINT,customer_id VARCHAR,inbound_code VARCHAR,overseas_warehouse_id VARCHAR)");
+        db.execute("CREATE TABLE ll_inbound_plan_carton(customer_id VARCHAR,order_id BIGINT,carton_mark VARCHAR,sku_code VARCHAR,destination_warehouse_code VARCHAR,destination_warehouse_name VARCHAR)");
+        db.execute("CREATE TABLE ll_warehouse_transfer_order(id BIGINT,customer_id VARCHAR,lastleg_order_id BIGINT,operating_warehouse_id VARCHAR,destination_warehouse_code VARCHAR,destination_warehouse_name VARCHAR)");
+        db.execute("CREATE TABLE ll_warehouse_transfer_item(id BIGINT,customer_id VARCHAR,transfer_order_id BIGINT,sku_code VARCHAR,product_name_zh VARCHAR)");
+        db.execute("CREATE TABLE ll_warehouse_transfer_carton(customer_id VARCHAR,transfer_order_id BIGINT,transfer_item_id BIGINT,carton_mark VARCHAR,counted_quantity BIGINT,sku_items_json VARCHAR,status VARCHAR)");
+        db.update("INSERT INTO ll_order VALUES(1,'A','IN','WH'),(2,'B','IN','WH'),(3,'A','IN','OTHER'),(4,'A','OTHER','WH')");
+        db.update("INSERT INTO ll_inbound_plan_carton VALUES('A',1,'FIRST','S','ONT8','Amazon'),('B',2,'FOREIGN','S','ONT8','Amazon'),('A',3,'WRONG-WH','S','ONT8','Amazon'),('A',4,'WRONG-IN','S','ONT8','Amazon'),('B',1,'FORGED','S','ONT8','Amazon')");
+        db.update("INSERT INTO ll_warehouse_transfer_order VALUES(10,'A',1,'WH','ONT8','Amazon')");
+        db.update("INSERT INTO ll_warehouse_transfer_item VALUES(11,'A',10,'SKU','Product')");
+        db.update("INSERT INTO ll_warehouse_transfer_carton VALUES('A',10,11,'MEASURED',20,NULL,'COUNTED'),('A',10,11,'EXPECTED',NULL,NULL,'EXPECTED'),('B',10,11,'FOREIGN2',20,NULL,'COUNTED')");
+        var config=new Configuration(new Environment("test",new JdbcTransactionFactory(),ds)); config.addMapper(InboundSnapshotMapper.class);
+        try(var session=new SqlSessionFactoryBuilder().build(config).openSession()) {
+            var result=session.getMapper(InboundSnapshotMapper.class).sourceCartons("A","WH","IN");
+            assertEquals(List.of("FIRST","MEASURED"),result.stream().map(InboundSnapshotMapper.SourceCarton::cartonMark).toList());
+            assertEquals("ONT8",result.get(0).destinationWarehouseCode());
+            assertNull(result.get(0).quantity()); assertEquals(20L,result.get(1).quantity());
+        }
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/transfer/service/TransferReturnSourceTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/transfer/service/TransferReturnSourceTest.java
new file mode 100644
index 000000000..f7532f5ff
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/transfer/service/TransferReturnSourceTest.java
@@ -0,0 +1,60 @@
+package com.baiyue.lastleg.transfer.service;
+
+import com.baiyue.lastleg.returnreceipt.entity.ReturnInventoryCarton;
+import com.baiyue.lastleg.returnreceipt.entity.ReturnInventoryCartonItem;
+import com.baiyue.lastleg.returnreceipt.entity.ReturnOrder;
+import com.baiyue.lastleg.returnreceipt.mapper.ReturnInventoryCartonItemMapper;
+import com.baiyue.lastleg.returnreceipt.mapper.ReturnInventoryCartonMapper;
+import com.baiyue.lastleg.returnreceipt.mapper.ReturnOrderMapper;
+import com.baiyue.lastleg.transfer.repository.TransferReturnSourceRepository;
+import org.junit.jupiter.api.Test;
+import org.springframework.test.util.ReflectionTestUtils;
+import org.springframework.web.server.ResponseStatusException;
+
+import java.util.List;
+
+import static org.junit.jupiter.api.Assertions.*;
+import static org.mockito.Mockito.*;
+
+class TransferReturnSourceTest {
+    /** 来源查询应排除占用和未清点箱，并保留整箱内的全部 SKU。 */
+    @Test
+    void returnsOnlyAvailableConfirmedCartonsWithContents() {
+        var orders = mock(ReturnOrderMapper.class);
+        var cartons = mock(ReturnInventoryCartonMapper.class);
+        var items = mock(ReturnInventoryCartonItemMapper.class);
+        var repository = new TransferReturnSourceRepository();
+        ReflectionTestUtils.setField(repository, "orders", orders);
+        ReflectionTestUtils.setField(repository, "cartons", cartons);
+        ReflectionTestUtils.setField(repository, "items", items);
+        var service = new WarehouseTransferService();
+        ReflectionTestUtils.setField(service, "returnSources", repository);
+        var order = new ReturnOrder();
+        order.setOverseasWarehouseId("WH-1");
+        when(orders.findNo("C-1", "RET-1")).thenReturn(order);
+        var available = carton(1L, "AVAILABLE", "CONFIRMED");
+        when(cartons.currentReturnCartons("C-1", "WH-1", "RET-1")).thenReturn(List.of(
+            available, carton(2L, "OUTBOUND_PENDING", "CONFIRMED"), carton(3L, "AVAILABLE", "PENDING")));
+        var sku = new ReturnInventoryCartonItem();
+        sku.setCartonId(1L); sku.setSkuCode("SKU-1"); sku.setQuantity(3L);
+        when(items.listCartons(List.of(1L))).thenReturn(List.of(sku));
+
+        var result = service.sourceCartons("C-1", "WH-1", "RETURN_ORDER:RET-1");
+
+        assertEquals(1, result.size());
+        assertEquals("BOX-1", result.get(0).cartonMark());
+        assertEquals("SKU-1", result.get(0).items().get(0).skuCode());
+        assertEquals(3L, result.get(0).items().get(0).quantity());
+        assertThrows(ResponseStatusException.class,
+            () -> service.sourceCartons("C-1", "OTHER-WH", "RETURN_ORDER:RET-1"));
+        verify(cartons, never()).currentReturnCartons("C-1", "OTHER-WH", "RET-1");
+    }
+
+    /** 构造不同库存状态的退货箱以验证来源筛选边界。 */
+    private static ReturnInventoryCarton carton(long id, String status, String countStatus) {
+        var carton = new ReturnInventoryCarton();
+        carton.setId(id); carton.setCartonMark("BOX-" + id); carton.setTotalQuantity(3L);
+        carton.setStatus(status); carton.setCountStatus(countStatus);
+        return carton;
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/transfer/service/WarehouseTransferCartonCountTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/transfer/service/WarehouseTransferCartonCountTest.java
new file mode 100644
index 000000000..4bf3aaddb
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/transfer/service/WarehouseTransferCartonCountTest.java
@@ -0,0 +1,220 @@
+package com.baiyue.lastleg.transfer.service;
+
+import com.baiyue.lastleg.transfer.dto.WarehouseTransferRequests;
+import com.baiyue.lastleg.transfer.entity.*;
+import com.baiyue.lastleg.transfer.mapper.*;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.springframework.test.util.ReflectionTestUtils;
+import org.springframework.web.server.ResponseStatusException;
+import java.math.BigDecimal;
+import java.util.List;
+import static org.junit.jupiter.api.Assertions.*;
+import static org.mockito.Mockito.*;
+import static org.mockito.ArgumentMatchers.*;
+
+class WarehouseTransferCartonCountTest {
+    WarehouseTransferService service;
+    WarehouseTransferOrderMapper orders = mock(WarehouseTransferOrderMapper.class);
+    WarehouseTransferCartonMapper cartons = mock(WarehouseTransferCartonMapper.class);
+    WarehouseTransferItemMapper items = mock(WarehouseTransferItemMapper.class);
+    WarehouseTransferPalletMapper palletMapper = mock(WarehouseTransferPalletMapper.class);
+    WarehouseTransferPallet pallet;
+    WarehouseTransferOrder order;
+    WarehouseTransferCarton a, b;
+    @BeforeEach void setup() {
+        service = spy(new WarehouseTransferService());
+        ReflectionTestUtils.setField(service, "transfers", orders);
+        ReflectionTestUtils.setField(service, "transferCartons", cartons);
+        ReflectionTestUtils.setField(service, "transferItems", items);
+        ReflectionTestUtils.setField(service, "transferPallets", palletMapper);
+        pallet = new WarehouseTransferPallet(); pallet.setId(200L); pallet.setStatus("GENERATED"); pallet.setWarehousePalletId(900L);
+        when(palletMapper.listOrder("C1", 1L)).thenReturn(List.of(pallet));
+        ReflectionTestUtils.setField(service, "objectMapper", new ObjectMapper());
+        doReturn(null).when(service).detail(anyString(), anyString());
+        order = new WarehouseTransferOrder(); order.setId(1L); order.setCustomerId("C1"); order.setTransferNo("WT1"); order.setStatus("WAIT_PDA_RECEIVING"); order.setPackageCount(2);
+        a = box("BOX1", 10L); b = box("BOX2", 11L);
+        when(orders.lockForPda("WT1", "77")).thenReturn(order);
+        when(cartons.listOrder("C1", 1L)).thenReturn(List.of(a,b));
+        var ia = new WarehouseTransferItem(); ia.setId(10L); ia.setSkuCode("A"); ia.setPackageCount(1); ia.setDeclaredQuantity(4L);
+        var ib = new WarehouseTransferItem(); ib.setId(11L); ib.setSkuCode("B"); ib.setPackageCount(1); ib.setDeclaredQuantity(0L);
+        when(items.selectList(any())).thenReturn(List.of(ia,ib));
+    }
+    WarehouseTransferCarton box(String mark, long item) { var box = new WarehouseTransferCarton(); box.setCartonMark(mark); box.setCartonIndex((int)item); box.setTransferItemId(item); return box; }
+    WarehouseTransferRequests.CountCarton input(String mark, String sku, long quantity) { return new WarehouseTransferRequests.CountCarton(mark, null, 200L, new BigDecimal("20"),new BigDecimal("30"),new BigDecimal("40"),new BigDecimal("2.5"),List.of(new WarehouseTransferRequests.CountSku(sku,quantity))); }
+    WarehouseTransferRequests.CountCartons request(String key, WarehouseTransferRequests.CountCarton... rows) { return new WarehouseTransferRequests.CountCartons(key,List.of(rows),null,2); }
+    @Test void multiSkuBoxesPersistDimensionsPiecesAndReplayWithoutWriting() {
+        var request = request("K1",input("BOX1","A",12),input("BOX2","B",7));
+        service.countCartons("OP1",77L,"WT1",request);
+        assertEquals(12L,a.getCountedQuantity()); assertEquals(7L,b.getCountedQuantity()); assertNotNull(a.getCountedAt()); assertEquals("OP1",a.getCountedBy()); assertEquals(new BigDecimal("2.5"),b.getGrossWeightKg());
+        assertEquals(200L,a.getTransferPalletId()); assertEquals(2,pallet.getCartonCount());
+        assertEquals(new BigDecimal("0.048"),pallet.getVolumeCbm()); assertEquals(new BigDecimal("5.0"),pallet.getGrossWeightKg());
+        clearInvocations(cartons); order.setStatus("WAIT_CUSTOMER_CONFIRMATION");
+        service.countCartons("OP1",77L,"WT1",request);
+        verify(cartons,never()).updateById(any(WarehouseTransferCarton.class));
+        assertThrows(ResponseStatusException.class,()->service.countCartons("OP1",77L,"WT1",request("K1",input("BOX1","A",13),input("BOX2","B",7))));
+    }
+    /** 补充预报箱可无SKU归属，箱内装货按PDA实点记录。 */
+    @Test void acceptsUnassignedForecastAndDifferentOriginalSku() {
+        a.setTransferItemId(null);
+        service.countCartons("OP1",77L,"WT1",request("UNBOUND",input("BOX1","B",3),input("BOX2","A",4)));
+        assertNotNull(a.getTransferItemId());
+        assertTrue(a.getSkuItemsJson().contains("B"));
+        assertTrue(b.getSkuItemsJson().contains("A"));
+    }
+
+    /** 整托汇总后再保留三位，不能把每箱先舍入后累加。 */
+    @Test void volumeRoundsOnceAfterSummingBoxes() {
+        var first = new WarehouseTransferRequests.CountCarton("BOX1", null, 200L,
+            new BigDecimal("10"), new BigDecimal("10"), new BigDecimal("6"), new BigDecimal("2.5"),
+            List.of(new WarehouseTransferRequests.CountSku("A", 3)));
+        var second = new WarehouseTransferRequests.CountCarton("BOX2", null, 200L,
+            new BigDecimal("10"), new BigDecimal("10"), new BigDecimal("6"), new BigDecimal("2.5"),
+            List.of(new WarehouseTransferRequests.CountSku("B", 4)));
+        service.countCartons("OP1", 77L, "WT1", request("ROUND", first, second));
+        assertEquals(new BigDecimal("0.001"), pallet.getVolumeCbm());
+        assertEquals(new BigDecimal("6"), a.getHeightCm());
+        assertEquals(new BigDecimal("5.0"), pallet.getGrossWeightKg());
+    }
+
+    @Test void remeasurementInvalidatesCountAndRejectsCompletedOrForeignTransfers() {
+        service.reopenMeasurement(77L, "WT1");
+        verify(cartons).reopenMeasurement("C1", 1L);
+        assertThrows(ResponseStatusException.class, () -> service.reopenMeasurement(88L, "WT1"));
+        order.setStatus("WAIT_CUSTOMER_CONFIRMATION");
+        assertThrows(ResponseStatusException.class, () -> service.reopenMeasurement(77L, "WT1"));
+        verify(cartons, times(1)).reopenMeasurement("C1", 1L);
+    }
+
+    @Test void deletingBoundPalletUnassignsBoxesAndReleasesResource() {
+        var resources = mock(com.baiyue.lastleg.inboundplan.pda.gateway.WarehouseResourceGateway.class);
+        ReflectionTestUtils.setField(service, "warehouseResources", resources);
+        pallet.setStatus("BOUND"); pallet.setWarehouseResourceLockId(901L);
+        when(palletMapper.lockOne("C1", 1L, 200L)).thenReturn(pallet);
+        service.deletePalletDraft(77L, "WT1", 200L);
+        verify(resources).release("C1", 901L);
+        verify(cartons).unassignPallet("C1", 1L, 200L);
+        verify(cartons).reopenMeasurement("C1", 1L);
+        verify(palletMapper).deleteById(200L);
+    }
+
+    @Test void missingDuplicateForeignSkuAndInvalidQuantityRejectBeforeWrites() {
+        var invalid = List.of(request("K",input("BOX1","A",1),input("BOX1","A",2)),request("K",input("OTHER","A",1),input("BOX2","B",2)),request("K",input("BOX1","FOREIGN",1),input("BOX2","B",2)),request("K",input("BOX1","A",0),input("BOX2","B",2)));
+        for(var request:invalid) assertThrows(ResponseStatusException.class,()->service.countCartons("OP1",77L,"WT1",request));
+        verify(cartons,never()).updateById(any(WarehouseTransferCarton.class));
+    }
+    @Test void mixedBoxPersistsEverySkuWithoutDuplicatingPhysicalBoxTotals() throws Exception {
+        var mixed = new WarehouseTransferRequests.CountCarton("BOX1", null, 200L,
+            new BigDecimal("20"),new BigDecimal("30"),new BigDecimal("40"),new BigDecimal("2.5"),
+            List.of(new WarehouseTransferRequests.CountSku("A",3),new WarehouseTransferRequests.CountSku("B",7)));
+        var request = new WarehouseTransferRequests.CountCartons("MIX",List.of(mixed),"两种SKU装一箱",2);
+        service.countCartons("OP1",77L,"WT1",request);
+        assertEquals(10L,a.getCountedQuantity());
+        var contents = new ObjectMapper().readTree(a.getSkuItemsJson());
+        assertEquals(2,contents.size()); assertEquals("A",contents.get(0).get("skuCode").asText());
+        assertEquals(7,contents.get(1).get("quantity").asInt());
+        assertEquals(11L,contents.get(1).get("transferItemId").asLong());
+        assertEquals(1,pallet.getCartonCount()); assertEquals(new BigDecimal("0.024"),pallet.getVolumeCbm());
+        assertEquals(new BigDecimal("2.5"),pallet.getGrossWeightKg());
+        var allocation = WarehouseTransferService.deriveCountedPalletAllocations(List.of(a),List.of(pallet));
+        assertEquals(1,allocation.size()); assertEquals(1,allocation.get(0).packageCount());
+        clearInvocations(cartons);
+        service.countCartons("OP1",77L,"WT1",request);
+        verify(cartons,never()).updateById(any(WarehouseTransferCarton.class));
+        var response = (java.util.List<?>)ReflectionTestUtils.invokeMethod(service,"cartonContents",a);
+        assertEquals(2,response.size());
+        var changed = new WarehouseTransferRequests.CountCarton("BOX1",null,200L,mixed.length(),mixed.width(),mixed.height(),mixed.weight(),
+            List.of(new WarehouseTransferRequests.CountSku("A",4),new WarehouseTransferRequests.CountSku("B",6)));
+        assertThrows(ResponseStatusException.class,()->service.countCartons("OP1",77L,"WT1",
+            new WarehouseTransferRequests.CountCartons("MIX",List.of(changed),"两种SKU装一箱",2)));
+    }
+    @Test void duplicateUnknownEmptyAndInvalidSkuLinesRejectBeforeAnyWrites() {
+        var invalidLines = List.of(List.<WarehouseTransferRequests.CountSku>of(),
+            List.of(new WarehouseTransferRequests.CountSku("A",1),new WarehouseTransferRequests.CountSku("A",2)),
+            List.of(new WarehouseTransferRequests.CountSku("FOREIGN",1)),
+            List.of(new WarehouseTransferRequests.CountSku("A",0)),
+            List.of(new WarehouseTransferRequests.CountSku("A",2147483648L)));
+        for(var lines:invalidLines) {
+            var mixed = new WarehouseTransferRequests.CountCarton("BOX1",null,200L,BigDecimal.ONE,BigDecimal.ONE,BigDecimal.ONE,BigDecimal.ONE,lines);
+            assertThrows(ResponseStatusException.class,()->service.countCartons("OP1",77L,"WT1",request("BAD",mixed,input("BOX2","B",2))));
+        }
+        verify(cartons,never()).updateById(any(WarehouseTransferCarton.class));
+    }
+    @Test void shortReceiptNeedsReasonAndPreservesMissingBoxFact() {
+        var request = new WarehouseTransferRequests.CountCartons("SHORT",List.of(input("BOX1","A",3)),"少到一箱",2);
+        service.countCartons("OP1",77L,"WT1",request);
+        assertEquals("COUNTED",a.getStatus()); assertEquals("NOT_RECEIVED",b.getStatus());
+        assertEquals("少到一箱",b.getDiscrepancyReason()); assertNull(b.getCountedQuantity());
+    }
+    /** 短收可先清点，最终完成必须另行提供非空原因。 */
+    @Test void shortReceiptCanCountWithoutReasonButCannotComplete() {
+        service.countCartons("OP1",77L,"WT1",request("SHORT-NO-REASON",input("BOX1","A",3)));
+        assertEquals("COUNTED", a.getStatus()); assertEquals("NOT_RECEIVED", b.getStatus());
+        order.setOperatingWarehouseId("77");
+        clearInvocations(cartons);
+        for (String reason : new String[] {"", "   "}) {
+            var error = assertThrows(ResponseStatusException.class, () -> service.palletize("OP1",77L,"WT1",
+                new WarehouseTransferRequests.Palletize("DONE",List.of(9001L),reason)));
+            assertTrue(error.getReason().contains("必须填写差异原因"));
+        }
+        verify(cartons,never()).updateById(any(WarehouseTransferCarton.class));
+        assertEquals("WAIT_PDA_RECEIVING", order.getStatus());
+    }
+    /** 相同总件数下各SKU一短一超仍有差异，改变箱数但SKU核平则无差异。 */
+    @Test void skuReceiptDifferenceDoesNotNetDifferentSkusOrUseBoxCount() {
+        var ia = new WarehouseTransferItem(); ia.setId(10L); ia.setSkuCode("A"); ia.setDeclaredQuantity(3L);
+        var ib = new WarehouseTransferItem(); ib.setId(11L); ib.setSkuCode("B"); ib.setDeclaredQuantity(7L);
+        a.setSkuItemsJson("[{\"transferItemId\":10,\"skuCode\":\"A\",\"quantity\":2},{\"transferItemId\":11,\"skuCode\":\"B\",\"quantity\":8}]");
+        assertTrue(service.hasSkuReceiptDifference(List.of(a),List.of(ia,ib)));
+        a.setSkuItemsJson("[{\"transferItemId\":10,\"skuCode\":\"A\",\"quantity\":3},{\"transferItemId\":11,\"skuCode\":\"B\",\"quantity\":7}]");
+        assertFalse(service.hasSkuReceiptDifference(List.of(a),List.of(ia,ib)));
+        ia.setDeclaredQuantity(4L);
+        assertTrue(service.hasSkuReceiptDifference(List.of(a),List.of(ia,ib)));
+    }
+    /** 新箱必须先补客户预报，PDA不能绕过预报生成另一套箱号。 */
+    @Test void extraReceiptRequiresForecastCartonFirst() {
+        var extra = new WarehouseTransferRequests.CountCarton(null,11L,200L,new BigDecimal("10"),new BigDecimal("20"),new BigDecimal("30"),BigDecimal.ONE,List.of(new WarehouseTransferRequests.CountSku("B",4)));
+        assertThrows(ResponseStatusException.class, () -> service.countCartons("OP1",77L,"WT1",new WarehouseTransferRequests.CountCartons("EXTRA",List.of(input("BOX1","A",1),input("BOX2","B",2),extra),null,2)));
+        verify(cartons,never()).insert(any(WarehouseTransferCarton.class));
+    }
+    /** 旧预报版本不能把客户刚新增的箱唛标为未收到。 */
+    @Test void staleForecastCannotCount() {
+        order.setPackageCount(3);
+        var error = assertThrows(ResponseStatusException.class, () -> service.countCartons("OP1",77L,"WT1",request("STALE",input("BOX1","A",1))));
+        assertTrue(error.getReason().contains("预报箱数已变化"));
+        verify(cartons,never()).updateById(any(WarehouseTransferCarton.class));
+    }
+    @Test void cartonsRequireGeneratedPalletOwnedByThisOrder() {
+        when(palletMapper.listOrder("C1",1L)).thenReturn(List.of());
+        assertThrows(ResponseStatusException.class,()->service.countCartons("OP1",77L,"WT1",request("K",input("BOX1","A",1),input("BOX2","B",2))));
+        verify(cartons,never()).updateById(any(WarehouseTransferCarton.class));
+        when(palletMapper.listOrder("C1",1L)).thenReturn(List.of(pallet)); pallet.setStatus("DRAFT");
+        assertThrows(ResponseStatusException.class,()->service.countCartons("OP1",77L,"WT1",request("K",input("BOX1","A",1),input("BOX2","B",2))));
+    }
+    @Test void multiSkuPalletCreatesOneInboundLineAllocationWithSummedBoxes() {
+        var plans = mock(com.baiyue.lastleg.inboundplan.mapper.InboundPlanMapper.class);
+        var lines = mock(com.baiyue.lastleg.inboundplan.mapper.InboundPlanLineMapper.class);
+        var pallets = mock(com.baiyue.lastleg.inboundplan.mapper.InboundPlanPalletMapper.class);
+        var allocations = mock(com.baiyue.lastleg.inboundplan.mapper.InboundPlanPalletAllocationMapper.class);
+        ReflectionTestUtils.setField(service,"inboundPlans",plans); ReflectionTestUtils.setField(service,"inboundPlanLines",lines);
+        ReflectionTestUtils.setField(service,"inboundPlanPallets",pallets); ReflectionTestUtils.setField(service,"inboundPlanAllocations",allocations);
+        order.setLastlegOrderId(9L); order.setInboundCode("WT1");
+        var plan = new com.baiyue.lastleg.inboundplan.entity.InboundPlan(); plan.setId(100L);
+        var line = new com.baiyue.lastleg.inboundplan.entity.InboundPlanLine(); line.setId(101L);
+        when(plans.findBySourceOrder("C1",9L)).thenReturn(plan); when(lines.selectOne(any())).thenReturn(line);
+        var pallet = new WarehouseTransferPallet(); pallet.setId(200L); pallet.setCartonCount(3); pallet.setVolumeCbm(BigDecimal.ONE); pallet.setSequenceNo(1);
+        var first = new WarehouseTransferPalletItem(); first.setTransferPalletId(200L); first.setTransferItemId(10L); first.setPackageCount(1);
+        var second = new WarehouseTransferPalletItem(); second.setTransferPalletId(200L); second.setTransferItemId(11L); second.setPackageCount(2);
+        ReflectionTestUtils.invokeMethod(service,"completeTransferInboundPlan","C1",order,List.of(pallet),List.of(first,second),java.time.LocalDateTime.now());
+        var result=org.mockito.ArgumentCaptor.forClass(com.baiyue.lastleg.inboundplan.entity.InboundPlanPalletAllocation.class);
+        verify(allocations,times(1)).insert(result.capture()); assertEquals(3,result.getValue().getPickedPackageCount()); assertEquals(3,result.getValue().getCountedPackageCount());
+    }
+    @Test void otherWarehouseCannotReadOrWriteAndCompletedCountsCannotBeOverwritten() {
+        assertThrows(ResponseStatusException.class,()->service.countCartons("OP1",88L,"WT1",request("K",input("BOX1","A",1))));
+        service.countCartons("OP1",77L,"WT1",request("K",input("BOX1","A",1),input("BOX2","B",2)));
+        clearInvocations(cartons);
+        assertThrows(ResponseStatusException.class,()->service.countCartons("OP2",77L,"WT1",request("NEW",input("BOX1","A",9),input("BOX2","B",2))));
+        verify(cartons,never()).updateById(any(WarehouseTransferCarton.class));
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/transfer/service/WarehouseTransferForecastServiceTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/transfer/service/WarehouseTransferForecastServiceTest.java
new file mode 100644
index 000000000..6e0e260fd
--- /dev/null
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/transfer/service/WarehouseTransferForecastServiceTest.java
@@ -0,0 +1,56 @@
+package com.baiyue.lastleg.transfer.service;
+
+import com.baiyue.lastleg.transfer.dto.WarehouseTransferRequests;
+import com.baiyue.lastleg.transfer.entity.*;
+import com.baiyue.lastleg.transfer.repository.TransferForecastRepository;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.springframework.test.util.ReflectionTestUtils;
+import org.springframework.web.server.ResponseStatusException;
+import java.util.List;
+import static org.junit.jupiter.api.Assertions.*;
+import static org.mockito.Mockito.*;
+import static org.mockito.ArgumentMatchers.*;
+
+class WarehouseTransferForecastServiceTest {
+    final TransferForecastRepository repository = mock(TransferForecastRepository.class);
+    final WarehouseTransferService transfers = mock(WarehouseTransferService.class);
+    final WarehouseTransferForecastService service = new WarehouseTransferForecastService();
+    WarehouseTransferOrder order;
+    WarehouseTransferItem item;
+    WarehouseTransferCarton carton;
+
+    /** 创建已有箱唛及清点数据，补箱不得重建原记录。 */
+    @BeforeEach void setup() {
+        ReflectionTestUtils.setField(service,"repository",repository); ReflectionTestUtils.setField(service,"transfers",transfers);
+        order = new WarehouseTransferOrder(); order.setId(1L); order.setCustomerId("C"); order.setTransferNo("WT1"); order.setInboundCode("WT1"); order.setStatus("WAIT_PDA_RECEIVING"); order.setPackageCount(2);
+        item = new WarehouseTransferItem(); item.setId(2L); item.setPackageCount(2); item.setDeclaredQuantity(10L);
+        carton = new WarehouseTransferCarton(); carton.setCartonIndex(2); carton.setCartonMark("ORIGINAL"); carton.setStatus("COUNTED");
+        when(repository.lock("C","WT1")).thenReturn(order);
+    }
+
+    /** 补箱追加编号，预报件数与原箱号保持不变，相同快照重放不重复增加。 */
+    @Test void appendPreservesMarksAndQuantityAndReplays() {
+        when(repository.cartons("C",1L)).thenReturn(List.of(carton));
+        var request = new WarehouseTransferRequests.IncreaseForecastCartons(2,4);
+        service.increase("C","WT1","OP",request);
+        var added = org.mockito.ArgumentCaptor.forClass(List.class);
+        verify(repository).append(eq(order),added.capture(),any(),eq("OP"));
+        var rows = (List<WarehouseTransferCarton>) added.getValue();
+        assertEquals(2,rows.size()); assertEquals(3,rows.get(0).getCartonIndex()); assertEquals(4,rows.get(1).getCartonIndex());
+        assertNotEquals(rows.get(0).getCartonMark(),rows.get(1).getCartonMark()); assertEquals("ORIGINAL",carton.getCartonMark());
+        assertNull(rows.get(0).getTransferItemId()); assertEquals(2,item.getPackageCount()); assertEquals(10L,item.getDeclaredQuantity()); assertEquals(4,order.getPackageCount());
+        clearInvocations(repository); service.increase("C","WT1","OP",request);
+        verify(repository,never()).append(any(),anyList(),any(),anyString());
+    }
+
+    /** 不允许完工后、跨单SKU、旧快照或减少箱数。 */
+    @Test void rejectsCompletedForeignStaleAndDecreasing() {
+        order.setStatus("WAIT_CUSTOMER_CONFIRMATION");
+        assertThrows(ResponseStatusException.class,()->service.increase("C","WT1","OP",new WarehouseTransferRequests.IncreaseForecastCartons(2,3)));
+        order.setStatus("WAIT_PDA_RECEIVING");
+        for(var request:List.of(new WarehouseTransferRequests.IncreaseForecastCartons(1,3),new WarehouseTransferRequests.IncreaseForecastCartons(2,1)))
+            assertThrows(ResponseStatusException.class,()->service.increase("C","WT1","OP",request));
+        verify(repository,never()).append(any(),anyList(),any(),anyString());
+    }
+}
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/transfer/service/WarehouseTransferPalletAllocationTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/transfer/service/WarehouseTransferPalletAllocationTest.java
index 1177c8a77..63ed154dc 100644
--- a/lastleg-service/src/test/java/com/baiyue/lastleg/transfer/service/WarehouseTransferPalletAllocationTest.java
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/transfer/service/WarehouseTransferPalletAllocationTest.java
@@ -48,19 +48,17 @@ class WarehouseTransferPalletAllocationTest {
     }
 
     @Test
-    void persistedOverReceiptUsesTheSameStableAllocationRule() {
-        WarehouseTransferPallet first = persistedPallet(4);
-        WarehouseTransferPallet second = persistedPallet(3);
-
-        var allocations = WarehouseTransferService.derivePersistedPalletAllocations(
-            List.of(item(11L, 3), item(12L, 2)), List.of(first, second));
-
-        assertEquals(7, allocations.stream().mapToInt(value -> value.packageCount()).sum());
-        assertEquals(3, allocations.stream().filter(value -> value.transferItemId() == 11L)
-            .mapToInt(value -> value.packageCount()).sum());
-        assertEquals(4, allocations.stream().filter(value -> value.transferItemId() == 12L)
-            .mapToInt(value -> value.packageCount()).sum());
-        assertEquals(List.of(0, 0, 1), allocations.stream().map(value -> value.palletIndex()).toList());
+    void countedBoxesDetermineSkuPlacementRatherThanDeclarationOrder() {
+        WarehouseTransferPallet first = persistedPallet(2); first.setId(100L);
+        WarehouseTransferPallet second = persistedPallet(1); second.setId(200L);
+        var a = new com.baiyue.lastleg.transfer.entity.WarehouseTransferCarton(); a.setTransferItemId(12L); a.setTransferPalletId(100L);
+        var b = new com.baiyue.lastleg.transfer.entity.WarehouseTransferCarton(); b.setTransferItemId(12L); b.setTransferPalletId(100L);
+        var c = new com.baiyue.lastleg.transfer.entity.WarehouseTransferCarton(); c.setTransferItemId(11L); c.setTransferPalletId(200L);
+        var allocations = WarehouseTransferService.deriveCountedPalletAllocations(List.of(a,b,c),List.of(first,second));
+        assertEquals(List.of(new WarehouseTransferService.DerivedPalletAllocation(0,12L,2),new WarehouseTransferService.DerivedPalletAllocation(1,11L,1)),allocations);
+        c.setTransferPalletId(999L);
+        org.junit.jupiter.api.Assertions.assertThrows(org.springframework.web.server.ResponseStatusException.class,
+            () -> WarehouseTransferService.deriveCountedPalletAllocations(List.of(a,b,c),List.of(first,second)));
     }
 
     @Test
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/transfer/service/WarehouseTransferReceiptCoordinatorTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/transfer/service/WarehouseTransferReceiptCoordinatorTest.java
index b8876ad70..839759ec8 100644
--- a/lastleg-service/src/test/java/com/baiyue/lastleg/transfer/service/WarehouseTransferReceiptCoordinatorTest.java
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/transfer/service/WarehouseTransferReceiptCoordinatorTest.java
@@ -5,7 +5,7 @@ import com.baomidou.mybatisplus.core.MybatisConfiguration;
 import com.baomidou.mybatisplus.extension.spring.MybatisSqlSessionFactoryBean;
 import com.baiyue.common.core.api.ApiResponse;
 import com.baiyue.lastleg.client.DomesticWarehouseDirectoryClient;
-import com.baiyue.lastleg.fleet.driver.FleetWarehouseClient;
+import com.baiyue.lastleg.transfer.gateway.TransferWarehouseCatalogClient;
 import com.baiyue.lastleg.inboundplan.pda.gateway.WarehouseResourceGateway;
 import com.baiyue.lastleg.transfer.dto.WarehouseTransferRequests;
 import com.baiyue.lastleg.transfer.entity.*;
@@ -35,7 +35,7 @@ import static org.mockito.Mockito.*;
 
 class WarehouseTransferReceiptCoordinatorTest {
     JdbcTemplate jdbc; SqlSessionTemplate session; WarehouseTransferReceiptCoordinator coordinator;
-    WarehouseResourceGateway warehouse; DomesticWarehouseDirectoryClient directory; FleetWarehouseClient catalog;
+    WarehouseResourceGateway warehouse; DomesticWarehouseDirectoryClient directory; TransferWarehouseCatalogClient catalog;
     ObjectMapper json = new ObjectMapper().findAndRegisterModules();
     AtomicInteger occupancies = new AtomicInteger(), reserveCalls = new AtomicInteger(), stockCalls = new AtomicInteger();
     AtomicBoolean loseReserveResponse = new AtomicBoolean(), failLocal = new AtomicBoolean();
@@ -73,7 +73,7 @@ class WarehouseTransferReceiptCoordinatorTest {
         ReflectionTestUtils.setField(coordinator, "commands", session.getMapper(WarehouseTransferReceiptCommandMapper.class));
         ReflectionTestUtils.setField(coordinator, "transactionManager", new DataSourceTransactionManager(ds));
         ReflectionTestUtils.setField(coordinator, "objectMapper", json);
-        warehouse = mock(WarehouseResourceGateway.class); directory = mock(DomesticWarehouseDirectoryClient.class); catalog = mock(FleetWarehouseClient.class);
+        warehouse = mock(WarehouseResourceGateway.class); directory = mock(DomesticWarehouseDirectoryClient.class); catalog = mock(TransferWarehouseCatalogClient.class);
         ReflectionTestUtils.setField(coordinator, "warehouse", warehouse); ReflectionTestUtils.setField(coordinator, "directory", directory);
         ReflectionTestUtils.setField(coordinator, "catalog", catalog); ReflectionTestUtils.setField(coordinator, "internalToken", "test-token");
         when(warehouse.requireActiveSharedWarehouse(9L)).thenReturn(new WarehouseResourceGateway.WarehouseReference(9, "NY", "NY warehouse", "ACTIVE"));
@@ -81,7 +81,7 @@ class WarehouseTransferReceiptCoordinatorTest {
         when(warehouse.resolveLocation(eq(9L), anyLong())).thenAnswer(call -> new WarehouseResourceGateway.WarehouseLocationReference(
             call.getArgument(1), "LOC-" + call.getArgument(1), "STORAGE", new BigDecimal("1000"), "ACTIVE"));
         when(catalog.activeWarehouses("test-token")).thenReturn(ApiResponse.success(List.of(
-            new FleetWarehouseClient.Warehouse(30L, "ABE4", "ABE4 warehouse", "FBA", "US"))));
+            new TransferWarehouseCatalogClient.Warehouse(30L, "ABE4", "ABE4 warehouse", "FBA", "US"))));
         when(directory.activeWarehouse(30L, "test-token")).thenReturn(ApiResponse.success(new DomesticWarehouseDirectoryClient.Detail(
             new DomesticWarehouseDirectoryClient.Warehouse(30L, 0L, "ABE4", "ABE4 warehouse", "FBA", "US", "ACTIVE", null, null), List.of())));
         when(warehouse.reserve(anyString(), anyLong(), anyLong(), anyLong(), anyString(), anyString(), anyString())).thenAnswer(call -> {
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/transfer/service/WarehouseTransferRelabelPersistenceTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/transfer/service/WarehouseTransferRelabelPersistenceTest.java
index 7754cfa93..b7a262373 100644
--- a/lastleg-service/src/test/java/com/baiyue/lastleg/transfer/service/WarehouseTransferRelabelPersistenceTest.java
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/transfer/service/WarehouseTransferRelabelPersistenceTest.java
@@ -216,6 +216,8 @@ class WarehouseTransferRelabelPersistenceTest {
         when(tasks.lock("7",11L)).thenReturn(task);when(tasks.updateWithVersion(any(),any())).thenReturn(1);
         ReflectionTestUtils.setField(service,"pdaTasks",tasks);
         ReflectionTestUtils.setField(service,"returnOrders",mock(com.baiyue.lastleg.returnreceipt.mapper.ReturnOrderMapper.class));
+        ReflectionTestUtils.setField(service,"skuConversions",mock(com.baiyue.lastleg.relabel.service.ReturnSkuConversionService.class));
+        ReflectionTestUtils.setField(service,"bindingGuard",mock(com.baiyue.lastleg.relabel.service.RelabelBindingGuard.class));
         ReflectionTestUtils.setField(service,"histories",mock(com.baiyue.lastleg.relabel.mapper.RelabelStatusHistoryMapper.class));
         ReflectionTestUtils.setField(service,"orderHistories",mock(com.baiyue.lastleg.mapper.LastlegOrderStatusHistoryMapper.class));
         var orders=mock(com.baiyue.lastleg.mapper.LastlegOrderMapper.class);var order=new com.baiyue.lastleg.entity.LastlegOrder();
diff --git a/lastleg-service/src/test/java/com/baiyue/lastleg/transfer/service/WarehouseTransferServiceTest.java b/lastleg-service/src/test/java/com/baiyue/lastleg/transfer/service/WarehouseTransferServiceTest.java
index daa5b3abb..8ea7bbb47 100644
--- a/lastleg-service/src/test/java/com/baiyue/lastleg/transfer/service/WarehouseTransferServiceTest.java
+++ b/lastleg-service/src/test/java/com/baiyue/lastleg/transfer/service/WarehouseTransferServiceTest.java
@@ -47,6 +47,9 @@ import com.fasterxml.jackson.databind.ObjectMapper;
 import com.baomidou.mybatisplus.extension.plugins.pagination.Page;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.NullSource;
+import org.junit.jupiter.params.provider.ValueSource;
 import org.junit.jupiter.api.extension.ExtendWith;
 import org.mockito.ArgumentCaptor;
 import org.mockito.Mock;
@@ -123,6 +126,12 @@ class WarehouseTransferServiceTest {
         WarehouseTransferOrder transfer = transfer(WarehouseTransferService.WAIT_RELABEL);
         transfer.setNeedRelabel(true);
         transfer.setRelabelNo("RL-20260923-000001");
+        var reviewedAt = LocalDateTime.of(2026, 10, 9, 15, 36, 14);
+        var measuredAt = reviewedAt.plusNanos(300_000_000);
+        var outboundAt = reviewedAt.plusSeconds(2);
+        transfer.setReviewedAt(reviewedAt); transfer.setOutboundAt(outboundAt);
+        when(transferPallets.measurementTimes(List.of(transfer.getId()))).thenReturn(List.of(
+            new WarehouseTransferPalletMapper.MeasurementTime(transfer.getId(), measuredAt)));
         Page<WarehouseTransferOrder> resultPage = new Page<>(1, 20, 1);
         resultPage.setRecords(List.of(transfer));
         RelabelApplication relabel = new RelabelApplication();
@@ -138,6 +147,9 @@ class WarehouseTransferServiceTest {
         assertEquals("RL-20260923-000001", result.records().get(0).relabelNo());
         assertEquals("COMPLETED", result.records().get(0).relabelStatus());
         assertEquals("READY_FOR_DISPATCH", result.records().get(0).relabelFulfillmentStatus());
+        assertEquals(reviewedAt, result.records().get(0).reviewedAt());
+        assertEquals(measuredAt, result.records().get(0).measuredAt());
+        assertEquals(outboundAt, result.records().get(0).outboundAt());
     }
 
     @Test
@@ -154,6 +166,9 @@ class WarehouseTransferServiceTest {
         assertEquals(1, result.records().size());
         assertNull(result.records().get(0).relabelStatus());
         assertNull(result.records().get(0).relabelFulfillmentStatus());
+        assertNull(result.records().get(0).reviewedAt());
+        assertNull(result.records().get(0).measuredAt());
+        assertNull(result.records().get(0).outboundAt());
         verify(relabelApplications, never()).selectList(any());
     }
 
@@ -188,9 +203,16 @@ class WarehouseTransferServiceTest {
     @Mock WarehouseTransferReceiptCoordinator receiptCoordinator;
     @Mock com.baiyue.lastleg.fleet.customer.FleetCustomerDirectory customerDirectory;
 
+    private com.baiyue.lastleg.service.CompactBusinessNumberService compactNumbers;
     @BeforeEach
     void setUp() {
+        compactNumbers = org.mockito.Mockito.mock(com.baiyue.lastleg.service.CompactBusinessNumberService.class);
         service = new WarehouseTransferService();
+        var measurementRepository = new com.baiyue.lastleg.transfer.repository.TransferMeasurementRepository();
+        ReflectionTestUtils.setField(measurementRepository, "cartons", transferCartons);
+        ReflectionTestUtils.setField(service, "transferMeasurementRepository", measurementRepository);
+        ReflectionTestUtils.setField(service, "compactNumbers", compactNumbers);
+        org.mockito.Mockito.lenient().when(compactNumbers.next(org.mockito.ArgumentMatchers.anyString(), org.mockito.ArgumentMatchers.anyString())).thenAnswer(call -> call.getArgument(0) + "-CS-261016102030");
         ReflectionTestUtils.setField(service, "customerDirectory", customerDirectory);
         lenient().when(customerDirectory.find("TENANT-A")).thenReturn(
             new com.baiyue.lastleg.fleet.customer.FleetCustomerDirectory.Customer("TENANT-A", "C-A", "Customer A", null, null));
@@ -307,6 +329,10 @@ class WarehouseTransferServiceTest {
         WarehouseTransferOrder transfer = transfer(WarehouseTransferService.WAIT_PDA_RECEIVING);
         transfer.setOperatingWarehouseId("77");
         WarehouseTransferPallet pallet = measuredPallet("GENERATED");
+        var counted = java.util.stream.IntStream.rangeClosed(1, 5).mapToObj(index -> {
+            var box = new WarehouseTransferCarton(); box.setTransferItemId(51L); box.setStatus("COUNTED"); box.setCountedAt(LocalDateTime.now()); return box;
+        }).toList();
+        when(transferCartons.listOrder("TENANT-A", transfer.getId())).thenReturn(counted);
         when(transfers.lockForPda("WTR-1", "77")).thenReturn(transfer);
         when(transferItems.selectList(any())).thenReturn(List.of(transferItem(51L, "SKU-1", 5)));
         WarehouseTransferMeasurementPhoto photo = new WarehouseTransferMeasurementPhoto();
@@ -321,13 +347,16 @@ class WarehouseTransferServiceTest {
         verify(warehouseResources, never()).ensurePalletBatch(any());
     }
 
-    @Test
-    void palletizeCompletesAfterEveryPalletIsBoundAndDoesNotGenerateAgain() {
+    /** 有无短收均可完成，差异原因应随完成事务保存并支持幂等重放。 */
+    @org.junit.jupiter.params.ParameterizedTest
+    @org.junit.jupiter.params.provider.ValueSource(booleans = {false, true})
+    void palletizeCompletesAfterEveryPalletIsBoundAndDoesNotGenerateAgain(boolean discrepancy) {
         WarehouseTransferOrder transfer = transfer(WarehouseTransferService.WAIT_PDA_RECEIVING);
         transfer.setOperatingWarehouseId("77");
         transfer.setInboundCode("WTR-1");
         WarehouseTransferPallet pallet = measuredPallet("BOUND");
         WarehouseTransferItem item = transferItem(51L, "SKU-1", 5);
+        transfer.setPackageCount(6); item.setPackageCount(6); item.setDeclaredQuantity(discrepancy ? 6L : 5L);
         LastlegOrder tail = tailOrder();
         LastlegInboundOrder inbound = new LastlegInboundOrder();
         inbound.setId(transfer.getInboundOrderId()); inbound.setCustomerId("TENANT-A");
@@ -351,8 +380,22 @@ class WarehouseTransferServiceTest {
             new InventoryCommandResponse(1L, "STOCK_IN", 801L, 901L, 5, 0, 0, 0, false, false));
         when(sourceOrders.selectList(any())).thenReturn(List.of());
 
-        var result = service.palletize("OP-1", 77L, "WTR-1",
-            new WarehouseTransferRequests.Palletize("DONE-1", List.of(9001L)));
+        var counted = java.util.stream.IntStream.rangeClosed(1, 5).mapToObj(index -> {
+            var box = new WarehouseTransferCarton(); box.setTransferPalletId(pallet.getId()); box.setTransferItemId(item.getId()); box.setCartonIndex(index); box.setTotalCartons(5); box.setCountedQuantity(1L); box.setCartonMark("BOX-" + index); box.setStatus("COUNTED"); box.setCountedAt(LocalDateTime.now()); return box;
+        }).toList();
+        when(transferCartons.listOrder("TENANT-A", transfer.getId())).thenReturn(counted);
+        var request = new WarehouseTransferRequests.Palletize("DONE-1", List.of(9001L), discrepancy ? " 客户少发一箱 " : null);
+        when(transferCartons.saveDiscrepancyReason(eq("TENANT-A"), eq(transfer.getId()), any())).thenAnswer(call -> {
+            counted.forEach(box -> box.setDiscrepancyReason(call.getArgument(2)));
+            return counted.size();
+        });
+        var result = service.palletize("OP-1", 77L, "WTR-1", request);
+        assertTrue(counted.stream().allMatch(box -> java.util.Objects.equals(discrepancy ? "客户少发一箱" : null, box.getDiscrepancyReason())));
+        assertTrue(result.cartons().stream().allMatch(box -> java.util.Objects.equals(discrepancy ? "客户少发一箱" : null, box.discrepancyReason())));
+        clearInvocations(transferCartons);
+        service.palletize("OP-1", 77L, "WTR-1", request);
+        verify(transferCartons, never()).updateById(any(WarehouseTransferCarton.class));
+        verify(transferCartons, never()).saveDiscrepancyReason(anyString(), anyLong(), any());
 
         assertEquals(WarehouseTransferService.WAIT_CUSTOMER_CONFIRMATION, result.status());
         assertEquals("COMPLETED", pallet.getStatus());
@@ -393,7 +436,7 @@ class WarehouseTransferServiceTest {
         assertEquals("Customer A", tailOrder.getValue().getCustomerName());
         assertEquals(WarehouseTransferService.DRAFT, tailOrder.getValue().getCurrentStatus());
         assertEquals("WAREHOUSE_TRANSFER:DRAFT;RELABEL:PENDING_BINDING", tailOrder.getValue().getSubOrderStatus());
-        assertTrue(tailOrder.getValue().getOrderNo().matches("WT-[0-9A-Z]{25}"));
+        assertTrue(tailOrder.getValue().getOrderNo().matches("ZY-CS-[0-9]{12}"));
         assertNull(tailOrder.getValue().getTransferWarehouseId());
         verify(sourceOrders).insert(any(WarehouseTransferSourceOrder.class));
         verify(relabelApplications, never()).insert(any(RelabelApplication.class));
@@ -439,21 +482,73 @@ class WarehouseTransferServiceTest {
     }
 
     @Test
-    void transferRejectsRequestWithoutDestination() {
-        WarehouseTransferRequests.Create request = new WarehouseTransferRequests.Create(
-            "IN-1", List.of(11L), "WH-1", null, "123 Pickup Road", 5,
-            new BigDecimal("0.2500"), "WAREHOUSE_PICKUP", LocalDateTime.of(2026, 9, 12, 10, 0),
-            null, null, null, "FBA destination will be supplied later", false, "key-no-fba",
-            List.of(new WarehouseTransferRequests.Item("SKU-1", "Product", 5, "MARK-1")));
-
-        ResponseStatusException exception = assertThrows(ResponseStatusException.class,
-            () -> service.create("TENANT-A", "USER-1", request));
-
-        assertEquals(400, exception.getStatusCode().value());
-        assertEquals("仓储转运必须选择 FBA 仓或私人仓", exception.getReason());
+    void transferRelabelRejectsUnknownAndForeignOrderCartonsBeforePersistence() {
+        var request = new WarehouseTransferRequests.Create(
+            "IN-1", List.of(11L), "WH-1", null, "FBA", null, "ONT8", null,
+            null, null, null, null, null, null, null, 1,
+            BigDecimal.ZERO, null, null, null, null, null, null, null, true,
+            LocalDateTime.of(2026, 10, 16, 10, 0), "Contact", "123", null, "TRUCK",
+            "carton-ownership", List.of(new WarehouseTransferRequests.Item("SKU-1", "Product", 1, null)),
+            List.of(new WarehouseTransferRequests.RelabelItem("CARTON_LABEL", List.of("FOREIGN-BOX"), "SKU-1", null, 1, "FBA-1", "ONT8", null)));
+        for (var cartons : List.of(List.<InboundSnapshotMapper.SourceCarton>of(),
+            List.of(new InboundSnapshotMapper.SourceCarton("CURRENT-BOX", "SKU-1", null, null, null, null, null)))) {
+            when(inboundSnapshots.sourceCartons("TENANT-A", "WH-1", "IN-1")).thenReturn(cartons);
+            var error = assertThrows(ResponseStatusException.class, () -> service.create("TENANT-A", "USER-1", request));
+            assertEquals("当前箱子不存在或不属于当前订单", error.getReason());
+        }
+        when(inboundSnapshots.sourceCartons("TENANT-A", "WH-1", "IN-1"))
+            .thenReturn(List.of(new InboundSnapshotMapper.SourceCarton("FOREIGN-BOX", "SKU-1", null, null, null, null, null)));
+        org.junit.jupiter.api.Assertions.assertDoesNotThrow(() ->
+            ReflectionTestUtils.invokeMethod(service, "validateRelabelRequest", "TENANT-A", request));
         verifyNoInteractions(transfers);
     }
 
+    @Test
+    void submittingOldDraftRechecksRelabelCartonOwnership() {
+        var transfer = transfer(WarehouseTransferService.DRAFT);
+        transfer.setOperatingWarehouseId("WH-1");
+        transfer.setInboundCode("IN-1");
+        transfer.setNeedRelabel(true);
+        when(transfers.lockNo("TENANT-A", "WTR-1")).thenReturn(transfer);
+        var binding = new com.baiyue.lastleg.transfer.entity.WarehouseTransferRelabelBinding();
+        binding.setCustomerCartonMark("FOREIGN-BOX");
+        when(relabelBindings.listOrder("TENANT-A", transfer.getId())).thenReturn(List.of(binding));
+        var error = assertThrows(ResponseStatusException.class, () -> service.submit("TENANT-A", "WTR-1", "USER-1"));
+        assertEquals("当前箱子不存在或不属于当前订单", error.getReason());
+        verify(transfers, never()).updateById(any(WarehouseTransferOrder.class));
+    }
+
+    @ParameterizedTest
+    @NullSource
+    @ValueSource(strings = {"NONE"})
+    void inventoryTransferRequiresKnownDestination(String destinationType) {
+        WarehouseTransferRequests.Create request = new WarehouseTransferRequests.Create(
+            "IN-1", List.of(11L), "WH-1", null, destinationType, null, null, null,
+            null, null, null, null, "123 Pickup Road", null, null, 5,
+            new BigDecimal("0.2500"), "WAREHOUSE_PICKUP", LocalDateTime.of(2026, 9, 12, 10, 0),
+            null, null, null, null, "Destination will be supplied before outbound", false,
+            null, null, null, null, null, "key-no-fba",
+            List.of(new WarehouseTransferRequests.Item("SKU-1", "Product", 5, "MARK-1")), null);
+
+        var error = assertThrows(ResponseStatusException.class, () -> service.create("TENANT-A","USER-1",request));
+        assertEquals(400,error.getStatusCode().value());
+        verifyNoInteractions(transfers,orders);
+    }
+
+    @Test
+    void inventoryDraftCannotClearDestination() {
+        var transfer = transfer(WarehouseTransferService.DRAFT);
+        when(transfers.lockNo("TENANT-A","WTR-1")).thenReturn(transfer);
+        WarehouseTransferRequests.Create request = new WarehouseTransferRequests.Create(
+            "IN-1", List.of(11L), "WH-1", null, "NONE", null, null, null,
+            null, null, null, null, "123 Pickup Road", null, null, 5,
+            new BigDecimal("0.2500"), "WAREHOUSE_PICKUP", LocalDateTime.of(2026, 9, 12, 10, 0),
+            null, null, null, null, null, false, null, null, null, null, null, "edit-no-fba",
+            List.of(new WarehouseTransferRequests.Item("SKU-1", "Product", 5, "MARK-1")), null);
+        assertThrows(ResponseStatusException.class, () -> service.updateDraft("TENANT-A","WTR-1","USER-1",request));
+        verify(transfers, never()).updateById(any(WarehouseTransferOrder.class));
+    }
+
     @Test
     void transferCanEnterTheTransitWarehouseWithFbaDestinationAndNoRelabel() {
         WarehouseTransferRequests.Create request = new WarehouseTransferRequests.Create(
@@ -476,7 +571,8 @@ class WarehouseTransferServiceTest {
         assertEquals("ONT8", transfer.getValue().getFbaWarehouseCode());
         assertNull(transfer.getValue().getFbaShipmentNo());
         assertEquals("ONT8", tailOrder.getValue().getFbaWarehouseCode());
-        assertEquals("WAREHOUSE_PICKUP", transfer.getValue().getDeliveryMethod());
+        assertEquals("INVENTORY_TRANSFER", transfer.getValue().getDeliveryMethod());
+        assertNull(transfer.getValue().getEstimatedArrivalAt());
     }
 
     @Test
@@ -523,7 +619,7 @@ class WarehouseTransferServiceTest {
             new BigDecimal("0.2500"), "WAREHOUSE_PICKUP", LocalDateTime.of(2026, 9, 12, 10, 0),
             null, null, "TRACK-MUST-NOT-BE-SAVED", null, "Incoming transit cargo", true,
             null, null, null, null, null, "key-incoming",
-            List.of(new WarehouseTransferRequests.Item("SKU-1", "Product A", 2, null),
+            List.of(new WarehouseTransferRequests.Item("SKU-1", "Product A", 2, null, null, List.of("BX-PRINTED1", "BX-PRINTED2")),
                 new WarehouseTransferRequests.Item("SKU-2", "Product B", 3, null)), null);
         when(transfers.findNo(eq("TENANT-A"), anyString())).thenAnswer(invocation -> transfer(WarehouseTransferService.DRAFT));
         when(transferItems.selectList(any())).thenReturn(List.of());
@@ -551,8 +647,10 @@ class WarehouseTransferServiceTest {
         assertEquals("PENDING_BINDING", tailOrder.getValue().getRelabelStatus());
         assertEquals(List.of(1, 2, 3, 4, 5), cartons.getAllValues().stream()
             .map(WarehouseTransferCarton::getCartonIndex).toList());
+        assertEquals(List.of("BX-PRINTED1", "BX-PRINTED2"), cartons.getAllValues().subList(0, 2).stream()
+            .map(WarehouseTransferCarton::getCartonMark).toList());
         assertTrue(cartons.getAllValues().stream().allMatch(value -> value.getCartonMark()
-            .matches("WT-[0-9A-Z]{25}#5-[1-5]")));
+            .matches("BX-[0-9A-Z]+")));
         when(transfers.findKey("TENANT-A", request.idempotencyKey())).thenReturn(transfer.getValue());
         clearInvocations(customerDirectory, orders, inboundOrders);
         service.create("TENANT-A", "USER-1", request);
@@ -671,6 +769,30 @@ class WarehouseTransferServiceTest {
         verify(orderDetails).insert(any(LastlegOrderDetail.class));
     }
 
+    /** 已打印草稿再次保存时保留箱唛，并保存SKU预报件数。 */
+    @Test
+    void draftUpdatePreservesPrintedCartonMarksAndDeclaredQuantity() throws Exception {
+        var transfer = persistedTransfer(); transfer.setStatus(WarehouseTransferService.DRAFT);
+        var tailOrder = historicalOrder(); tailOrder.setId(31L); tailOrder.setCustomerId("TENANT-A"); tailOrder.setCurrentStatus(WarehouseTransferService.DRAFT);
+        when(transfers.lockNo("TENANT-A", "WTR-1")).thenReturn(transfer);
+        when(transfers.findNo("TENANT-A", "WTR-1")).thenReturn(transfer);
+        when(orders.selectById(31L)).thenReturn(tailOrder);
+        var box = new WarehouseTransferCarton(); box.setId(88L); box.setCartonIndex(1); box.setCartonMark("BX-KEEP"); box.setTotalCartons(5); box.setStatus("EXPECTED");
+        when(transferCartons.listOrder("TENANT-A", transfer.getId())).thenReturn(List.of(box));
+        var jsonMapper = new ObjectMapper().findAndRegisterModules();
+        com.fasterxml.jackson.databind.node.ObjectNode requestJson = jsonMapper.valueToTree(request(false));
+        ((com.fasterxml.jackson.databind.node.ObjectNode) requestJson.get("items").get(0)).put("quantity", 120L);
+        requestJson.remove("inboundModeValid");
+        var withQuantity = jsonMapper.treeToValue(requestJson, WarehouseTransferRequests.Create.class);
+        var result = service.updateDraft("TENANT-A", "WTR-1", "USER-1", withQuantity);
+        var savedItem = ArgumentCaptor.forClass(WarehouseTransferItem.class);
+        verify(transferItems).insert(savedItem.capture());
+        assertEquals(120L, savedItem.getValue().getDeclaredQuantity());
+        assertEquals("BX-KEEP", box.getCartonMark());
+        verify(transferCartons).updateById(box);
+        verify(transferCartons, times(4)).insert(any(WarehouseTransferCarton.class));
+    }
+
     @Test
     void merchantCannotUpdateSubmittedTransfer() {
         WarehouseTransferOrder transfer = persistedTransfer();
@@ -694,17 +816,43 @@ class WarehouseTransferServiceTest {
         verify(transfers, never()).updateById(any(WarehouseTransferOrder.class));
     }
 
+    /** 未建单时生成的箱唛必须完整且不重复。 */
     @Test
-    void draftCannotPrintCartonLabelsBeforeSubmission() {
-        WarehouseTransferOrder transfer = persistedTransfer();
-        transfer.setStatus(WarehouseTransferService.DRAFT);
+    void duplicateOrMismatchedPreprintedMarksRejectBeforeCreatingOrder() throws Exception {
+        var mapper = new ObjectMapper().findAndRegisterModules();
+        for (var marks : List.of(List.of("BX-ONE"), List.of("BX-ONE", "BX-ONE", "BX-3", "BX-4", "BX-5"))) {
+            com.fasterxml.jackson.databind.node.ObjectNode json = mapper.valueToTree(request(false));
+            json.remove("inboundModeValid");
+            ((com.fasterxml.jackson.databind.node.ObjectNode) json.get("items").get(0)).set("cartonMarks", mapper.valueToTree(marks));
+            var input = mapper.treeToValue(json, WarehouseTransferRequests.Create.class);
+            assertThrows(ResponseStatusException.class, () -> service.create("TENANT-A", "USER-1", input));
+        }
+        verify(transfers, never()).insert(any(WarehouseTransferOrder.class));
+    }
+
+    @Test
+    void draftCanPrintPersistedCartonLabels() {
+        WarehouseTransferOrder transfer = persistedTransfer(); transfer.setStatus(WarehouseTransferService.DRAFT);
         when(transfers.findNo("TENANT-A", "WTR-1")).thenReturn(transfer);
+        var carton = new WarehouseTransferCarton(); carton.setCartonMark("BX-PRESERVED"); carton.setCartonIndex(1); carton.setTotalCartons(1); carton.setStatus("EXPECTED");
+        when(transferCartons.listOrder("TENANT-A", transfer.getId())).thenReturn(List.of(carton));
+        var result = service.cartonLabel("TENANT-A", "WTR-1");
+        assertTrue(result.printableHtml().contains("BX-PRESERVED"));
+    }
 
-        ResponseStatusException error = assertThrows(ResponseStatusException.class,
-            () -> service.cartonLabel("TENANT-A", "WTR-1"));
-
-        assertEquals(409, error.getStatusCode().value());
-        verify(transferCartons, never()).listOrder(anyString(), anyLong());
+    /** 提交预报后即可打印全部预报箱唛，不依赖测量或照片完成。 */
+    @Test
+    void submittedForecastLabelsArePrintableBeforeCounting() {
+        var transfer = transfer(WarehouseTransferService.PENDING_REVIEW);
+        when(transfers.findNo("TENANT-A", "WTR-1")).thenReturn(transfer);
+        var box = new WarehouseTransferCarton(); box.setCartonMark("FORECAST-BOX"); box.setCartonIndex(1); box.setTotalCartons(2); box.setStatus("EXPECTED");
+        var missing = new WarehouseTransferCarton(); missing.setCartonMark("FORECAST-BOX-2"); missing.setCartonIndex(2); missing.setTotalCartons(2); missing.setStatus("NOT_RECEIVED");
+        when(transferCartons.listOrder("TENANT-A", transfer.getId())).thenReturn(List.of(box, missing));
+        var label = service.cartonLabel("TENANT-A", "WTR-1");
+        assertEquals(2, label.cartons().size());
+        assertTrue(label.printableHtml().contains("FORECAST-BOX"));
+        assertNull(box.getCountedAt());
+        verify(inventory, never()).stockIn(anyString(), anyString(), any());
     }
 
     @Test
diff --git a/lastleg-service/src/test/resources/architecture/lastleg-slice-dependencies.json b/lastleg-service/src/test/resources/architecture/lastleg-slice-dependencies.json
index 295791f22..7a2395d42 100644
--- a/lastleg-service/src/test/resources/architecture/lastleg-slice-dependencies.json
+++ b/lastleg-service/src/test/resources/architecture/lastleg-slice-dependencies.json
@@ -23,7 +23,6 @@
     "inventory->inbound-pda",
     "inventory->shared-technical",
     "overseas-master-data->shared-technical",
-    "procurement-trucking-looseboard->overseas-master-data",
     "procurement-trucking-looseboard->shared-technical",
     "procurement-trucking-looseboard->tailleg-handoff",
     "relabel-transfer-discard->dispatch-delivery",
@@ -47,7 +46,9 @@
     "com.baiyue.lastleg.masterdata.vehicle.application.model.VehicleModels": "src/main/java/com/baiyue/lastleg/masterdata/vehicle/application/model/VehicleModels.java",
     "com.baiyue.lastleg.masterdata.vehicle.application.port.out.VehicleRepository": "src/main/java/com/baiyue/lastleg/masterdata/vehicle/application/port/out/VehicleRepository.java"
   },
-  "forbiddenSlices": ["security-projection"],
+  "forbiddenSlices": [
+    "security-projection"
+  ],
   "forbiddenTypePrefixes": [
     "com.baiyue.lastleg.security.controller.LastlegSecurity",
     "com.baiyue.lastleg.security.dto.LastlegSecurity",
@@ -55,147 +56,237 @@
     "com.baiyue.lastleg.security.service.SecurityProjectionMonotonicity"
   ],
   "reviewedClassDependencies": [
-  {
-    "source": "com.baiyue.lastleg.financefee.fleet.VehicleCareFinanceAdapter",
-    "target": "com.baiyue.lastleg.fleet.maintenance.VehicleCareFinanceGateway",
-    "reason": "费用适配器仅实现Fleet公司成本换算与Outbox端口，Fleet不读取费用模块或Outbox持久化实现；同事务发布且不新增package循环。"
-  },
-  {
-    "source": "com.baiyue.lastleg.transfer.fleet.FleetIncomingAdapter",
-    "target": "com.baiyue.lastleg.fleet.trip.FleetBookingIncomingGateway",
-    "reason": "转运适配器实现外接来货端口，仅传登记与实测证据；车队不读取转运Mapper或库存表。"
-  },
-  {
-    "source": "com.baiyue.lastleg.transfer.fleet.FleetIncomingAdapter",
-    "target": "com.baiyue.lastleg.fleet.trip.FleetDispatchGateway",
-    "reason": "仅复用端口定义的稳定卸货目的地匹配键，禁止放宽整个转运切片对车队实现的引用。"
-  },
-  {
-    "source": "com.baiyue.lastleg.controller.LastlegOrderController",
-    "target": "com.baiyue.lastleg.relabel.dto.RelabelRequests",
-    "reason": "尾程订单直接换标审核入口委托既有换标服务和DTO，业务状态仍由换标服务维护。"
-  },
-  {
-    "source": "com.baiyue.lastleg.controller.LastlegOrderController",
-    "target": "com.baiyue.lastleg.relabel.dto.RelabelResponses",
-    "reason": "尾程订单直接换标审核入口委托既有换标服务和DTO，业务状态仍由换标服务维护。"
-  },
-  {
-    "source": "com.baiyue.lastleg.controller.LastlegOrderController",
-    "target": "com.baiyue.lastleg.relabel.service.RelabelApplicationService",
-    "reason": "尾程订单直接换标审核入口委托既有换标服务和DTO，业务状态仍由换标服务维护。"
-  },
-  {
-    "source": "com.baiyue.lastleg.discard.pda.controller.PdaCargoDiscardController",
-    "target": "com.baiyue.lastleg.pda.security.PdaWarehouseIdentity",
-    "reason": "PDA废弃入口复用统一Token身份与绑定仓解析，不另建本地安全投影。"
-  },
-  {
-    "source": "com.baiyue.lastleg.discard.pda.service.PdaCargoDiscardService",
-    "target": "com.baiyue.lastleg.pda.security.PdaWarehouseIdentity",
-    "reason": "PDA废弃作业使用同一已验证身份范围。"
-  },
-  {
-    "source": "com.baiyue.lastleg.transfer.controller.PdaWarehouseTransferController",
-    "target": "com.baiyue.lastleg.pda.security.PdaWarehouseIdentity",
-    "reason": "转运PDA入口复用同一绑定仓身份解析。"
-  },
-  {
-    "source": "com.baiyue.lastleg.transfer.service.WarehouseTransferService",
-    "target": "com.baiyue.lastleg.inboundplan.entity.InboundPlan",
-    "reason": "仓储转运实收打托同步本服务入仓计划、分配和收货事实，资源仍经Warehouse网关；仅冻结这些既有引用，不开放其他转运类直接读取入仓实现。"
-  },
-  {
-    "source": "com.baiyue.lastleg.transfer.service.WarehouseTransferService",
-    "target": "com.baiyue.lastleg.inboundplan.entity.InboundPlanLine",
-    "reason": "仓储转运实收打托同步本服务入仓计划、分配和收货事实，资源仍经Warehouse网关；仅冻结这些既有引用，不开放其他转运类直接读取入仓实现。"
-  },
-  {
-    "source": "com.baiyue.lastleg.transfer.service.WarehouseTransferService",
-    "target": "com.baiyue.lastleg.inboundplan.entity.InboundPlanPallet",
-    "reason": "仓储转运实收打托同步本服务入仓计划、分配和收货事实，资源仍经Warehouse网关；仅冻结这些既有引用，不开放其他转运类直接读取入仓实现。"
-  },
-  {
-    "source": "com.baiyue.lastleg.transfer.service.WarehouseTransferService",
-    "target": "com.baiyue.lastleg.inboundplan.entity.InboundPlanPalletAllocation",
-    "reason": "仓储转运实收打托同步本服务入仓计划、分配和收货事实，资源仍经Warehouse网关；仅冻结这些既有引用，不开放其他转运类直接读取入仓实现。"
-  },
-  {
-    "source": "com.baiyue.lastleg.transfer.service.WarehouseTransferService",
-    "target": "com.baiyue.lastleg.inboundplan.mapper.InboundPlanMapper",
-    "reason": "仓储转运实收打托同步本服务入仓计划、分配和收货事实，资源仍经Warehouse网关；仅冻结这些既有引用，不开放其他转运类直接读取入仓实现。"
-  },
-  {
-    "source": "com.baiyue.lastleg.transfer.service.WarehouseTransferService",
-    "target": "com.baiyue.lastleg.inboundplan.mapper.InboundPlanLineMapper",
-    "reason": "仓储转运实收打托同步本服务入仓计划、分配和收货事实，资源仍经Warehouse网关；仅冻结这些既有引用，不开放其他转运类直接读取入仓实现。"
-  },
-  {
-    "source": "com.baiyue.lastleg.transfer.service.WarehouseTransferService",
-    "target": "com.baiyue.lastleg.inboundplan.mapper.InboundPlanPalletMapper",
-    "reason": "仓储转运实收打托同步本服务入仓计划、分配和收货事实，资源仍经Warehouse网关；仅冻结这些既有引用，不开放其他转运类直接读取入仓实现。"
-  },
-  {
-    "source": "com.baiyue.lastleg.transfer.service.WarehouseTransferService",
-    "target": "com.baiyue.lastleg.inboundplan.mapper.InboundPlanPalletAllocationMapper",
-    "reason": "仓储转运实收打托同步本服务入仓计划、分配和收货事实，资源仍经Warehouse网关；仅冻结这些既有引用，不开放其他转运类直接读取入仓实现。"
-  },
-  {
-    "source": "com.baiyue.lastleg.transfer.service.WarehouseTransferService",
-    "target": "com.baiyue.lastleg.inboundplan.pda.entity.InboundStockReceipt",
-    "reason": "仓储转运实收打托同步本服务入仓计划、分配和收货事实，资源仍经Warehouse网关；仅冻结这些既有引用，不开放其他转运类直接读取入仓实现。"
-  },
-  {
-    "source": "com.baiyue.lastleg.transfer.service.WarehouseTransferService",
-    "target": "com.baiyue.lastleg.inboundplan.pda.mapper.InboundStockReceiptMapper",
-    "reason": "仓储转运实收打托同步本服务入仓计划、分配和收货事实，资源仍经Warehouse网关；仅冻结这些既有引用，不开放其他转运类直接读取入仓实现。"
-  },
-  {
-    "source": "com.baiyue.lastleg.transfer.service.WarehouseTransferService",
-    "target": "com.baiyue.lastleg.inboundplan.pda.gateway.WarehouseResourceGateway",
-    "reason": "仓储转运实收打托同步本服务入仓计划、分配和收货事实，资源仍经Warehouse网关；仅冻结这些既有引用，不开放其他转运类直接读取入仓实现。"
-  },
-  {
-    "source": "com.baiyue.lastleg.financefee.service.OverseasFeeCurrencyConverter",
-    "target": "com.baiyue.lastleg.masterdata.exchange.entity.MonthlyExchangeRate",
-    "reason": "海外费用按业务月份读取当前正式月度汇率，缺失或未生效拒绝；仅此换算器可使用这两项现有实现引用。"
-  },
-  {
-    "source": "com.baiyue.lastleg.financefee.service.OverseasFeeCurrencyConverter",
-    "target": "com.baiyue.lastleg.masterdata.exchange.mapper.MonthlyExchangeRateMapper",
-    "reason": "海外费用按业务月份读取当前正式月度汇率，缺失或未生效拒绝；仅此换算器可使用这两项现有实现引用。"
-  },
-  {
-    "source": "com.baiyue.lastleg.returnreceipt.controller.PdaReturnReceiptController",
-    "target": "com.baiyue.lastleg.relabel.pda.gateway.RelabelPhotoFileGateway",
-    "reason": "退货签收照片复用当前业务文件网关。"
-  },
-  {
-    "source": "com.baiyue.lastleg.returnreceipt.service.ReturnReceiptService",
-    "target": "com.baiyue.lastleg.relabel.entity.RelabelApplication",
-    "reason": "退货实收后按本客户可用退货箱创建换标申请及明细，照片复用原网关；保留同服务事务内稳定关联。"
-  },
-  {
-    "source": "com.baiyue.lastleg.returnreceipt.service.ReturnReceiptService",
-    "target": "com.baiyue.lastleg.relabel.entity.RelabelItem",
-    "reason": "退货实收后按本客户可用退货箱创建换标申请及明细，照片复用原网关；保留同服务事务内稳定关联。"
-  },
-  {
-    "source": "com.baiyue.lastleg.returnreceipt.service.ReturnReceiptService",
-    "target": "com.baiyue.lastleg.relabel.mapper.RelabelApplicationMapper",
-    "reason": "退货实收后按本客户可用退货箱创建换标申请及明细，照片复用原网关；保留同服务事务内稳定关联。"
-  },
-  {
-    "source": "com.baiyue.lastleg.returnreceipt.service.ReturnReceiptService",
-    "target": "com.baiyue.lastleg.relabel.mapper.RelabelItemMapper",
-    "reason": "退货实收后按本客户可用退货箱创建换标申请及明细，照片复用原网关；保留同服务事务内稳定关联。"
-  },
-  {
-    "source": "com.baiyue.lastleg.returnreceipt.service.ReturnReceiptService",
-    "target": "com.baiyue.lastleg.relabel.pda.gateway.RelabelPhotoFileGateway",
-    "reason": "退货实收后按本客户可用退货箱创建换标申请及明细，照片复用原网关；保留同服务事务内稳定关联。"
-  }
-],
+    {
+      "source": "com.baiyue.lastleg.relabel.service.ReturnRelabelPackingService",
+      "target": "com.baiyue.lastleg.pda.security.PdaWarehouseIdentity",
+      "reason": "退货换标合箱沿用PDA冻结仓身份作为操作人与仓库约束，不引用入仓业务服务或持久化。"
+    },
+    {
+      "source": "com.baiyue.lastleg.transfer.service.WarehouseTransferReceiptCoordinator",
+      "target": "com.baiyue.lastleg.inboundplan.pda.gateway.WarehouseResourceGateway",
+      "reason": "转仓实收复用仓储资源HTTP网关，校验及预留目标托盘库位；资源权威仍在Warehouse，不读取入仓持久化。"
+    },
+    {
+      "source": "com.baiyue.lastleg.export.LastlegExportProviderService",
+      "target": "com.baiyue.lastleg.fleet.quote.FleetQuoteModels",
+      "reason": "平台车队报价导出仅组合公开分页查询和投影，沿用列表筛选，不访问车队实体或Mapper。"
+    },
+    {
+      "source": "com.baiyue.lastleg.export.LastlegExportProviderService",
+      "target": "com.baiyue.lastleg.fleet.quote.FleetQuoteService",
+      "reason": "平台车队报价导出仅组合公开分页查询和投影，沿用列表筛选，不访问车队实体或Mapper。"
+    },
+    {
+      "source": "com.baiyue.lastleg.export.LastlegExportProviderService",
+      "target": "com.baiyue.lastleg.fleet.reporting.TripOperationsModels",
+      "reason": "平台出车记录导出仅组合公开报表查询及返回投影，成本可见性仍由导出上下文传递，不访问车队持久化。"
+    },
+    {
+      "source": "com.baiyue.lastleg.export.LastlegExportProviderService",
+      "target": "com.baiyue.lastleg.fleet.reporting.TripOperationsService",
+      "reason": "平台出车记录导出仅组合公开报表查询及返回投影，成本可见性仍由导出上下文传递，不访问车队持久化。"
+    },
+    {
+      "source": "com.baiyue.lastleg.export.LastlegExportProviderService",
+      "target": "com.baiyue.lastleg.inventory.query.dto.InventoryQueryRequests",
+      "reason": "平台库存导出复用库存公开查询与筛选DTO，客户范围及业务投影与列表一致，不读取库存Mapper。"
+    },
+    {
+      "source": "com.baiyue.lastleg.export.LastlegExportProviderService",
+      "target": "com.baiyue.lastleg.inventory.query.service.InventoryQueryService",
+      "reason": "平台库存导出复用库存公开查询与筛选DTO，客户范围及业务投影与列表一致，不读取库存Mapper。"
+    },
+    {
+      "source": "com.baiyue.lastleg.export.LastlegExportProviderService",
+      "target": "com.baiyue.lastleg.masterdata.exchange.dto.MonthlyExchangeRateDtos",
+      "reason": "平台月度汇率导出复用既有分页查询和DTO，不直接访问主数据持久化。"
+    },
+    {
+      "source": "com.baiyue.lastleg.export.LastlegExportProviderService",
+      "target": "com.baiyue.lastleg.masterdata.exchange.service.MonthlyExchangeRateService",
+      "reason": "平台月度汇率导出复用既有分页查询和DTO，不直接访问主数据持久化。"
+    },
+    {
+      "source": "com.baiyue.lastleg.export.LastlegExportProviderService",
+      "target": "com.baiyue.lastleg.masterdata.quote.dto.OverseasQuoteRequests",
+      "reason": "平台海外报价导出复用既有分页查询和筛选DTO，不直接访问主数据持久化。"
+    },
+    {
+      "source": "com.baiyue.lastleg.export.LastlegExportProviderService",
+      "target": "com.baiyue.lastleg.masterdata.quote.service.OverseasQuoteService",
+      "reason": "平台海外报价导出复用既有分页查询和筛选DTO，不直接访问主数据持久化。"
+    },
+    {
+      "source": "com.baiyue.lastleg.export.LastlegExportProviderService",
+      "target": "com.baiyue.lastleg.masterdata.vehicle.application.model.VehicleModels",
+      "reason": "平台车辆导出仅使用车辆应用层公开分页查询及模型，禁止访问车辆持久化适配器。"
+    },
+    {
+      "source": "com.baiyue.lastleg.export.LastlegExportProviderService",
+      "target": "com.baiyue.lastleg.masterdata.vehicle.application.VehicleApplicationService",
+      "reason": "平台车辆导出仅使用车辆应用层公开分页查询及模型，禁止访问车辆持久化适配器。"
+    },
+    {
+      "source": "com.baiyue.lastleg.selfoperated.analytics.request.SelfopEgressController",
+      "target": "com.baiyue.lastleg.security.InternalServiceTokenGuard",
+      "reason": "内部出口许可端点复用现行服务令牌校验，不复制认证实现；只允许该控制器依赖该基础校验器，不开放客户业务或共享技术切片的其他引用。"
+    },
+    {
+      "source": "com.baiyue.lastleg.export.LastlegExportProviderService",
+      "target": "com.baiyue.lastleg.selfoperated.analytics.query.InventoryTurnoverExport",
+      "reason": "统一导出装配器只调用自营周转的公开导出投影，复用固定版本查询；不开放自营Mapper或客户WMS库存访问，不产生反向依赖。"
+    },
+    {
+      "source": "com.baiyue.lastleg.financefee.fleet.VehicleCareFinanceAdapter",
+      "target": "com.baiyue.lastleg.fleet.maintenance.VehicleCareFinanceGateway",
+      "reason": "费用适配器仅实现Fleet公司成本换算与Outbox端口，Fleet不读取费用模块或Outbox持久化实现；同事务发布且不新增package循环。"
+    },
+    {
+      "source": "com.baiyue.lastleg.transfer.fleet.FleetIncomingAdapter",
+      "target": "com.baiyue.lastleg.fleet.trip.FleetBookingIncomingGateway",
+      "reason": "转运适配器实现外接来货端口，仅传登记与实测证据；车队不读取转运Mapper或库存表。"
+    },
+    {
+      "source": "com.baiyue.lastleg.transfer.fleet.FleetIncomingAdapter",
+      "target": "com.baiyue.lastleg.fleet.trip.FleetDispatchGateway",
+      "reason": "仅复用端口定义的稳定卸货目的地匹配键，禁止放宽整个转运切片对车队实现的引用。"
+    },
+    {
+      "source": "com.baiyue.lastleg.controller.LastlegOrderController",
+      "target": "com.baiyue.lastleg.relabel.dto.RelabelRequests",
+      "reason": "尾程订单直接换标审核入口委托既有换标服务和DTO，业务状态仍由换标服务维护。"
+    },
+    {
+      "source": "com.baiyue.lastleg.controller.LastlegOrderController",
+      "target": "com.baiyue.lastleg.relabel.dto.RelabelResponses",
+      "reason": "尾程订单直接换标审核入口委托既有换标服务和DTO，业务状态仍由换标服务维护。"
+    },
+    {
+      "source": "com.baiyue.lastleg.controller.LastlegOrderController",
+      "target": "com.baiyue.lastleg.relabel.service.RelabelApplicationService",
+      "reason": "尾程订单直接换标审核入口委托既有换标服务和DTO，业务状态仍由换标服务维护。"
+    },
+    {
+      "source": "com.baiyue.lastleg.discard.pda.controller.PdaCargoDiscardController",
+      "target": "com.baiyue.lastleg.pda.security.PdaWarehouseIdentity",
+      "reason": "PDA废弃入口复用统一Token身份与绑定仓解析，不另建本地安全投影。"
+    },
+    {
+      "source": "com.baiyue.lastleg.discard.pda.service.PdaCargoDiscardService",
+      "target": "com.baiyue.lastleg.pda.security.PdaWarehouseIdentity",
+      "reason": "PDA废弃作业使用同一已验证身份范围。"
+    },
+    {
+      "source": "com.baiyue.lastleg.transfer.controller.PdaWarehouseTransferController",
+      "target": "com.baiyue.lastleg.pda.security.PdaWarehouseIdentity",
+      "reason": "转运PDA入口复用同一绑定仓身份解析。"
+    },
+    {
+      "source": "com.baiyue.lastleg.transfer.service.WarehouseTransferService",
+      "target": "com.baiyue.lastleg.inboundplan.entity.InboundPlan",
+      "reason": "仓储转运实收打托同步本服务入仓计划、分配和收货事实，资源仍经Warehouse网关；仅冻结这些既有引用，不开放其他转运类直接读取入仓实现。"
+    },
+    {
+      "source": "com.baiyue.lastleg.transfer.service.WarehouseTransferService",
+      "target": "com.baiyue.lastleg.inboundplan.entity.InboundPlanLine",
+      "reason": "仓储转运实收打托同步本服务入仓计划、分配和收货事实，资源仍经Warehouse网关；仅冻结这些既有引用，不开放其他转运类直接读取入仓实现。"
+    },
+    {
+      "source": "com.baiyue.lastleg.transfer.service.WarehouseTransferService",
+      "target": "com.baiyue.lastleg.inboundplan.entity.InboundPlanPallet",
+      "reason": "仓储转运实收打托同步本服务入仓计划、分配和收货事实，资源仍经Warehouse网关；仅冻结这些既有引用，不开放其他转运类直接读取入仓实现。"
+    },
+    {
+      "source": "com.baiyue.lastleg.transfer.service.WarehouseTransferService",
+      "target": "com.baiyue.lastleg.inboundplan.entity.InboundPlanPalletAllocation",
+      "reason": "仓储转运实收打托同步本服务入仓计划、分配和收货事实，资源仍经Warehouse网关；仅冻结这些既有引用，不开放其他转运类直接读取入仓实现。"
+    },
+    {
+      "source": "com.baiyue.lastleg.transfer.service.WarehouseTransferService",
+      "target": "com.baiyue.lastleg.inboundplan.mapper.InboundPlanMapper",
+      "reason": "仓储转运实收打托同步本服务入仓计划、分配和收货事实，资源仍经Warehouse网关；仅冻结这些既有引用，不开放其他转运类直接读取入仓实现。"
+    },
+    {
+      "source": "com.baiyue.lastleg.transfer.service.WarehouseTransferService",
+      "target": "com.baiyue.lastleg.inboundplan.mapper.InboundPlanLineMapper",
+      "reason": "仓储转运实收打托同步本服务入仓计划、分配和收货事实，资源仍经Warehouse网关；仅冻结这些既有引用，不开放其他转运类直接读取入仓实现。"
+    },
+    {
+      "source": "com.baiyue.lastleg.transfer.service.WarehouseTransferService",
+      "target": "com.baiyue.lastleg.inboundplan.mapper.InboundPlanPalletMapper",
+      "reason": "仓储转运实收打托同步本服务入仓计划、分配和收货事实，资源仍经Warehouse网关；仅冻结这些既有引用，不开放其他转运类直接读取入仓实现。"
+    },
+    {
+      "source": "com.baiyue.lastleg.transfer.service.WarehouseTransferService",
+      "target": "com.baiyue.lastleg.inboundplan.mapper.InboundPlanPalletAllocationMapper",
+      "reason": "仓储转运实收打托同步本服务入仓计划、分配和收货事实，资源仍经Warehouse网关；仅冻结这些既有引用，不开放其他转运类直接读取入仓实现。"
+    },
+    {
+      "source": "com.baiyue.lastleg.transfer.service.WarehouseTransferService",
+      "target": "com.baiyue.lastleg.inboundplan.pda.entity.InboundStockReceipt",
+      "reason": "仓储转运实收打托同步本服务入仓计划、分配和收货事实，资源仍经Warehouse网关；仅冻结这些既有引用，不开放其他转运类直接读取入仓实现。"
+    },
+    {
+      "source": "com.baiyue.lastleg.transfer.service.WarehouseTransferService",
+      "target": "com.baiyue.lastleg.inboundplan.pda.mapper.InboundStockReceiptMapper",
+      "reason": "仓储转运实收打托同步本服务入仓计划、分配和收货事实，资源仍经Warehouse网关；仅冻结这些既有引用，不开放其他转运类直接读取入仓实现。"
+    },
+    {
+      "source": "com.baiyue.lastleg.transfer.service.WarehouseTransferService",
+      "target": "com.baiyue.lastleg.inboundplan.pda.gateway.WarehouseResourceGateway",
+      "reason": "仓储转运实收打托同步本服务入仓计划、分配和收货事实，资源仍经Warehouse网关；仅冻结这些既有引用，不开放其他转运类直接读取入仓实现。"
+    },
+    {
+      "source": "com.baiyue.lastleg.financefee.service.OverseasFeeCurrencyConverter",
+      "target": "com.baiyue.lastleg.masterdata.exchange.entity.MonthlyExchangeRate",
+      "reason": "海外费用按业务月份读取当前正式月度汇率，缺失或未生效拒绝；仅此换算器可使用这两项现有实现引用。"
+    },
+    {
+      "source": "com.baiyue.lastleg.financefee.service.OverseasFeeCurrencyConverter",
+      "target": "com.baiyue.lastleg.masterdata.exchange.mapper.MonthlyExchangeRateMapper",
+      "reason": "海外费用按业务月份读取当前正式月度汇率，缺失或未生效拒绝；仅此换算器可使用这两项现有实现引用。"
+    },
+    {
+      "source": "com.baiyue.lastleg.returnreceipt.controller.PdaReturnReceiptController",
+      "target": "com.baiyue.lastleg.relabel.pda.gateway.RelabelPhotoFileGateway",
+      "reason": "退货签收照片复用当前业务文件网关。"
+    },
+    {
+      "source": "com.baiyue.lastleg.returnreceipt.service.ReturnReceiptService",
+      "target": "com.baiyue.lastleg.relabel.entity.RelabelApplication",
+      "reason": "退货实收后按本客户可用退货箱创建换标申请及明细，照片复用原网关；保留同服务事务内稳定关联。"
+    },
+    {
+      "source": "com.baiyue.lastleg.returnreceipt.service.ReturnReceiptService",
+      "target": "com.baiyue.lastleg.relabel.entity.RelabelItem",
+      "reason": "退货实收后按本客户可用退货箱创建换标申请及明细，照片复用原网关；保留同服务事务内稳定关联。"
+    },
+    {
+      "source": "com.baiyue.lastleg.returnreceipt.service.ReturnReceiptService",
+      "target": "com.baiyue.lastleg.relabel.mapper.RelabelApplicationMapper",
+      "reason": "退货实收后按本客户可用退货箱创建换标申请及明细，照片复用原网关；保留同服务事务内稳定关联。"
+    },
+    {
+      "source": "com.baiyue.lastleg.returnreceipt.service.ReturnReceiptService",
+      "target": "com.baiyue.lastleg.relabel.mapper.RelabelItemMapper",
+      "reason": "退货实收后按本客户可用退货箱创建换标申请及明细，照片复用原网关；保留同服务事务内稳定关联。"
+    },
+    {
+      "source": "com.baiyue.lastleg.returnreceipt.service.ReturnReceiptService",
+      "target": "com.baiyue.lastleg.relabel.pda.gateway.RelabelPhotoFileGateway",
+      "reason": "退货实收后按本客户可用退货箱创建换标申请及明细，照片复用原网关；保留同服务事务内稳定关联。"
+    },
+    {
+      "source": "com.baiyue.lastleg.relabel.service.RelabelPalletMeasurementService",
+      "target": "com.baiyue.lastleg.pda.security.PdaWarehouseIdentity",
+      "reason": "换标托盘测量沿用PDA冻结仓身份限制原业务操作仓，不导入入仓服务或Mapper。"
+    },
+    {
+      "source": "com.baiyue.lastleg.selfoperated.analytics.diagnostic.QuantityDiagnosticController",
+      "target": "com.baiyue.lastleg.security.InternalServiceTokenGuard",
+      "reason": "内部只读数量诊断复用服务间身份守卫，不依赖客户库存与出库业务。"
+    }
+  ],
   "applicationDependencyRule": {
     "packagePrefix": "com.baiyue.lastleg.masterdata.vehicle.application",
     "allowedInternalPrefix": "com.baiyue.lastleg.masterdata.vehicle.application",
@@ -209,12 +300,21 @@
   },
   "sliceSpecificRules": {
     "fleet": {
-      "allowedOutgoing": ["overseas-master-data", "shared-technical"],
-      "allowedIncoming": ["dispatch-delivery"]
+      "allowedOutgoing": [
+        "overseas-master-data",
+        "shared-technical"
+      ],
+      "allowedIncoming": [
+        "dispatch-delivery"
+      ]
     },
     "overseas-master-data": {
-      "allowedOutgoing": ["shared-technical"],
-      "allowedIncoming": ["procurement-trucking-looseboard", "fleet"]
+      "allowedOutgoing": [
+        "shared-technical"
+      ],
+      "allowedIncoming": [
+        "fleet"
+      ]
     }
   }
 }
diff --git a/order/AGENTS.md b/order/AGENTS.md
index 23ad5d926..490fde935 100644
--- a/order/AGENTS.md
+++ b/order/AGENTS.md
@@ -1,5 +1,10 @@
 # Order Service 模块指引
 
+## 数据库访问与中文注释约束
+
+- 强制遵守根 `../AGENTS.md` 的“数据库访问与中文代码注释”全部规则：正常业务访问统一为 `Controller → Service → Repository → Mapper`，不得省略 Repository 或跨层直调；生产 SQL 由 Mapper 执行，Repository 不得直接使用 JdbcTemplate 或原生 JDBC。非 HTTP 入口从 Service 进入；无数据库模块不引入数据库访问。
+- 每个手写方法及构造器须有简短中文说明；核心业务规则、复杂 SQL、事务、锁、幂等、并发及失败处理须补充适量中文注释，重点说明原因和边界。新增、修改方法立即执行，触及的存量代码同步整改。
+
 ## 职责与边界
 
 - Mapper 只由 `BaiyueOrderApplication.java` 对 `com.baiyue.order` 根包按 `@Mapper` 过滤扫描；新增或移动 Mapper 后从后端根运行 `node scripts/mapper-scan-contract.mjs`，不得增加子域扫描配置。
diff --git a/order/src/main/java/com/baiyue/order/client/FirstlegUnifiedOrderClient.java b/order/src/main/java/com/baiyue/order/client/FirstlegUnifiedOrderClient.java
index 3600b71d7..091c70060 100644
--- a/order/src/main/java/com/baiyue/order/client/FirstlegUnifiedOrderClient.java
+++ b/order/src/main/java/com/baiyue/order/client/FirstlegUnifiedOrderClient.java
@@ -20,7 +20,7 @@ public interface FirstlegUnifiedOrderClient {
     ApiResponse<WorkbenchFilters> workbenchFilters(@RequestHeader("X-Internal-Service-Token") String token,
                                                   @RequestBody WorkbenchFilterRequest request);
 
-    record WorkbenchFilterRequest(long tenantId, String mainStatus) {}
+    record WorkbenchFilterRequest(long tenantId, String mainStatus, List<Long> orderIds) {}
     record WorkbenchFilters(List<Long> matchingStatusOrderIds, List<Long> feeOrderIds,
                             List<Long> customsOrderIds, List<com.baiyue.order.dto.MerchantOrderProgress> progress) {}
 
diff --git a/order/src/main/java/com/baiyue/order/client/LastlegOrderProgressClient.java b/order/src/main/java/com/baiyue/order/client/LastlegOrderProgressClient.java
index 2cd64e579..8eb2dac9c 100644
--- a/order/src/main/java/com/baiyue/order/client/LastlegOrderProgressClient.java
+++ b/order/src/main/java/com/baiyue/order/client/LastlegOrderProgressClient.java
@@ -11,6 +11,6 @@ import java.util.List;
 public interface LastlegOrderProgressClient {
     @PostMapping
     ApiResponse<Response> read(@RequestHeader("X-Internal-Service-Token") String token, @RequestBody Request request);
-    record Request(long customerId) {}
+    record Request(long customerId, List<Long> orderIds) {}
     record Response(List<MerchantOrderProgress> progress) {}
 }
diff --git a/order/src/main/java/com/baiyue/order/controller/MerchantUnifiedOrderController.java b/order/src/main/java/com/baiyue/order/controller/MerchantUnifiedOrderController.java
index d977e7523..6b1fde0a0 100644
--- a/order/src/main/java/com/baiyue/order/controller/MerchantUnifiedOrderController.java
+++ b/order/src/main/java/com/baiyue/order/controller/MerchantUnifiedOrderController.java
@@ -51,10 +51,13 @@ public class MerchantUnifiedOrderController {
     @GetMapping("/{orderId}")
     @PreAuthorize("hasAuthority('merchant:order:view')")
     @Operation(summary = "我的统一订单详情", description = "仅返回当前客户订单，不包含平台内部备注。")
-    public ApiResponse<UnifiedOrderResponse.Detail> detail(
+    public ApiResponse<UnifiedOrderResponse.MerchantDetail> detail(
         @AuthenticationPrincipal AuthenticatedUser user,
         @PathVariable long orderId) {
-        return ApiResponse.success(service.detail(OrderScopeGuard.merchant(user), orderId, false));
+        long customerId=OrderScopeGuard.merchant(user);
+        var detail=service.detail(customerId,orderId,false);
+        return ApiResponse.success(new UnifiedOrderResponse.MerchantDetail(detail.summary(),detail.order(),detail.timeline(),
+            detail.transportFragments(),workbench.detailProgress(customerId,orderId)));
     }
 
     @GetMapping("/{orderId}/fulfillment-tree")
diff --git a/order/src/main/java/com/baiyue/order/dto/UnifiedOrderResponse.java b/order/src/main/java/com/baiyue/order/dto/UnifiedOrderResponse.java
index b1d7a3110..27dd462a4 100644
--- a/order/src/main/java/com/baiyue/order/dto/UnifiedOrderResponse.java
+++ b/order/src/main/java/com/baiyue/order/dto/UnifiedOrderResponse.java
@@ -50,6 +50,9 @@ public final class UnifiedOrderResponse {
     public record Detail(Row summary, OrderDetailResponse order,
                          List<TimelineEvent> timeline,
                          List<TransportFragment> transportFragments) {}
+    public record MerchantDetail(Row summary, OrderDetailResponse order,
+                                 List<TimelineEvent> timeline, List<TransportFragment> transportFragments,
+                                 MerchantOrderProgress progress) {}
     public record TransportFragment(String inboundCode, String cabinetNo, String containerNo,
                                     List<TransportNode> nodes) {}
     public record TransportNode(String standardNode, Integer nodeSequence, String providerCode,
diff --git a/order/src/main/java/com/baiyue/order/repository/MerchantOrderWorkbenchRepository.java b/order/src/main/java/com/baiyue/order/repository/MerchantOrderWorkbenchRepository.java
index aa5a1741e..77ab9a941 100644
--- a/order/src/main/java/com/baiyue/order/repository/MerchantOrderWorkbenchRepository.java
+++ b/order/src/main/java/com/baiyue/order/repository/MerchantOrderWorkbenchRepository.java
@@ -51,6 +51,17 @@ public class MerchantOrderWorkbenchRepository {
         return mapper.selectList(new QueryWrapper<OrderEntity>().select("id","root_order_id","status")
             .eq("tenant_id",customerId).ne("status","CANCELLED"));
     }
+    /** Exact owned order and, only when it is a root, its own customer's active fragments. */
+    public List<OrderEntity> detailProgressScope(long customerId,long orderId) {
+        var selected=mapper.selectOne(new QueryWrapper<OrderEntity>().select("id","root_order_id","status")
+            .eq("tenant_id",customerId).eq("id",orderId));
+        if(selected==null) return List.of();
+        if(selected.getRootOrderId()!=null && selected.getRootOrderId()!=orderId) return List.of(selected);
+        var scope=new java.util.ArrayList<OrderEntity>();scope.add(selected);
+        scope.addAll(mapper.selectList(new QueryWrapper<OrderEntity>().select("id","root_order_id","status")
+            .eq("tenant_id",customerId).eq("root_order_id",orderId).ne("id",orderId).ne("status","CANCELLED").orderByAsc("id")));
+        return List.copyOf(scope);
+    }
 
     private long progressCount(QueryWrapper<OrderEntity> base,java.util.Map<String,List<Long>> progressIds,String stage) {
         return mapper.selectCount(ids(base.clone(),progressIds.get(stage)));
diff --git a/order/src/main/java/com/baiyue/order/service/MerchantOrderWorkbenchService.java b/order/src/main/java/com/baiyue/order/service/MerchantOrderWorkbenchService.java
index aaf351f97..b415f1011 100644
--- a/order/src/main/java/com/baiyue/order/service/MerchantOrderWorkbenchService.java
+++ b/order/src/main/java/com/baiyue/order/service/MerchantOrderWorkbenchService.java
@@ -42,12 +42,12 @@ public class MerchantOrderWorkbenchService {
         List<MerchantOrderProgress> tailProgress;
         try {
             var response=firstleg.workbenchFilters(internalToken,
-                new FirstlegUnifiedOrderClient.WorkbenchFilterRequest(customerId,status));
+                new FirstlegUnifiedOrderClient.WorkbenchFilterRequest(customerId,status,null));
             if(response==null||!response.successful()||response.data()==null) throw new IllegalStateException();
             filters=response.data();
             if(filters.feeOrderIds()==null||filters.customsOrderIds()==null||filters.progress()==null
                 ||status!=null&&filters.matchingStatusOrderIds()==null) throw new IllegalStateException();
-            var tail=lastleg.read(internalToken,new LastlegOrderProgressClient.Request(customerId));
+            var tail=lastleg.read(internalToken,new LastlegOrderProgressClient.Request(customerId,null));
             if(tail==null||!tail.successful()||tail.data()==null||tail.data().progress()==null) throw new IllegalStateException();
             tailProgress=tail.data().progress();
             validateFacts(filters.progress(),1,3);
@@ -66,6 +66,34 @@ public class MerchantOrderWorkbenchService {
             source.records().stream().map(o->progress.getOrDefault(o.getId(),new MerchantOrderProgress(o.getId(),"none",false))).toList());
     }
 
+    @Transactional(readOnly=true)
+    public MerchantOrderProgress detailProgress(long customerId,long orderId) {
+        var scope=repository.detailProgressScope(customerId,orderId);
+        var selected=scope.stream().filter(o->o.getId()==orderId).findFirst()
+            .orElseThrow(()->new BizException(ResultCode.NOT_FOUND,"订单不存在"));
+        if(selected.getStatus()==OrderStatus.CANCELLED) return new MerchantOrderProgress(orderId,"none",false);
+        if(Set.of(OrderStatus.DRAFT,OrderStatus.SUBMITTED,OrderStatus.COMPLETED).contains(selected.getStatus()))
+            return project(scope,List.of(),List.of()).get(orderId);
+        var firstFacts=new ArrayList<MerchantOrderProgress>();var tailFacts=new ArrayList<MerchantOrderProgress>();
+        var ids=scope.stream().map(OrderEntity::getId).toList();
+        try {
+            for(int start=0;start<ids.size();start+=200) {
+                var batch=ids.subList(start,Math.min(start+200,ids.size()));
+                var first=firstleg.workbenchFilters(internalToken,new FirstlegUnifiedOrderClient.WorkbenchFilterRequest(customerId,null,batch));
+                if(first==null || !first.successful() || first.data()==null || first.data().progress()==null) throw new IllegalStateException();
+                var tail=lastleg.read(internalToken,new LastlegOrderProgressClient.Request(customerId,batch));
+                if(tail==null || !tail.successful() || tail.data()==null || tail.data().progress()==null) throw new IllegalStateException();
+                validateFacts(first.data().progress(),1,3);validateFacts(tail.data().progress(),4,5);
+                if(Stream.concat(first.data().progress().stream(),tail.data().progress().stream()).anyMatch(p->!batch.contains(p.orderId())))
+                    throw new IllegalStateException("Progress response exceeds owned order scope");
+                firstFacts.addAll(first.data().progress());tailFacts.addAll(tail.data().progress());
+            }
+        } catch(RuntimeException failure) {
+            throw new BizException(ResultCode.SERVICE_UNAVAILABLE,"订单进度查询暂时不可用，请重试");
+        }
+        return project(scope,firstFacts,tailFacts).get(orderId);
+    }
+
     private static void validateFacts(List<MerchantOrderProgress> facts, int min, int max) {
         var seen=new java.util.HashSet<Long>();
         for(var fact:facts) if(fact==null||fact.rank()<min||fact.rank()>max||!seen.add(fact.orderId()))
diff --git a/order/src/main/resources/openapi/order-v1.yaml b/order/src/main/resources/openapi/order-v1.yaml
index fc23b0e56..c7ed83a02 100644
--- a/order/src/main/resources/openapi/order-v1.yaml
+++ b/order/src/main/resources/openapi/order-v1.yaml
@@ -58,13 +58,7 @@ paths:
                       progress:
                         type: array
                         description: 与当前页订单一一对应的客户履约进度；分类互斥，待办可重叠。分片未齐时partial为true，完成只认Order可信回写。
-                        items:
-                          type: object
-                          required: [orderId, stage, partial]
-                          properties:
-                            orderId: {type: string, pattern: '^[1-9][0-9]*$'}
-                            stage: {type: string, enum: [none, loaded, declared, cleared, scheduled, delivering, delivered]}
-                            partial: {type: boolean}
+                        items: {$ref: '#/components/schemas/MerchantOrderProgress'}
 
   /internal/order/v1/fulfillment-completions:
     post:
@@ -538,7 +532,7 @@ paths:
   /api/merchant/v1/orders/{orderId}:
     get:
       summary: 客户统一订单详情
-      description: 仅返回登录客户所属订单及客户可见时间线，不返回平台内部备注。
+      description: 仅返回登录客户所属订单及客户可见时间线，不返回平台内部备注。progress使用与工作台相同的权威投影，按认证客户和精确订单读取；根单只汇总本客户有效子单，子单只投影自身。依赖不可用时失败，不回退delivery快照。
       parameters:
         - $ref: '#/components/parameters/UnifiedOrderId'
       responses:
@@ -546,7 +540,7 @@ paths:
           description: 成功或业务失败，按响应体 code 判断
           content:
             application/json:
-              schema: {$ref: '#/components/schemas/UnifiedOrderDetailEnvelope'}
+              schema: {$ref: '#/components/schemas/MerchantOrderDetailEnvelope'}
         '403': {description: 需要 merchant:order:view 权限}
   /api/merchant/v1/orders/first-leg:
     get:
@@ -1138,6 +1132,26 @@ components:
         size: {type: integer, format: int64, minimum: 1}
         total: {type: integer, format: int64, minimum: 0}
         pages: {type: integer, format: int64, minimum: 0}
+    MerchantOrderProgress:
+      type: object
+      required: [orderId, stage, partial]
+      properties:
+        orderId: {type: string, pattern: '^[1-9][0-9]*$'}
+        stage: {type: string, enum: [none, loaded, declared, cleared, scheduled, delivering, delivered]}
+        partial: {type: boolean}
+    MerchantOrderDetailEnvelope:
+      type: object
+      properties:
+        code: {type: string, example: '200'}
+        message: {type: string}
+        data: {$ref: '#/components/schemas/MerchantOrderDetail'}
+    MerchantOrderDetail:
+      allOf:
+        - {$ref: '#/components/schemas/UnifiedOrderDetail'}
+        - type: object
+          required: [progress]
+          properties:
+            progress: {$ref: '#/components/schemas/MerchantOrderProgress'}
     UnifiedOrderDetailEnvelope:
       type: object
       properties:
diff --git a/order/src/test/java/com/baiyue/order/controller/MerchantOrderWorkbenchControllerTest.java b/order/src/test/java/com/baiyue/order/controller/MerchantOrderWorkbenchControllerTest.java
index fc2cd3196..f88f90312 100644
--- a/order/src/test/java/com/baiyue/order/controller/MerchantOrderWorkbenchControllerTest.java
+++ b/order/src/test/java/com/baiyue/order/controller/MerchantOrderWorkbenchControllerTest.java
@@ -67,4 +67,28 @@ class MerchantOrderWorkbenchControllerTest {
         assertThat(captured.getValue().page()).isEqualTo(21);
         assertThat(captured.getValue().createdTo()).isEqualTo(java.time.LocalDateTime.of(2026,10,3,23,59,59,999000000));
     }
+
+    @Test void detailProvidesAuthoritativeProgressOnlyForAuthenticatedCustomerAndRequestedOrder() throws Exception {
+        var query=mock(com.baiyue.order.service.UnifiedOrderQueryService.class);
+        var progress=mock(MerchantOrderWorkbenchService.class);
+        var controller=new MerchantUnifiedOrderController();
+        ReflectionTestUtils.setField(controller,"service",query);ReflectionTestUtils.setField(controller,"workbench",progress);
+        var base=new com.baiyue.order.dto.UnifiedOrderResponse.Detail(null,null,java.util.List.of(),java.util.List.of());
+        var fact=new com.baiyue.order.dto.MerchantOrderProgress(21,"scheduled",true);
+        when(query.detail(11,21,false)).thenReturn(base);when(progress.detailProgress(11,21)).thenReturn(fact);
+        var user=new AuthenticatedUser(1L,11L,null,1L,"customer","MERCHANT","WEB",Set.of("merchant:order:view"));
+        var mvc=MockMvcBuilders.standaloneSetup(controller).setCustomArgumentResolvers(new HandlerMethodArgumentResolver() {
+            public boolean supportsParameter(MethodParameter p) { return p.getParameterType()==AuthenticatedUser.class; }
+            public Object resolveArgument(MethodParameter p,ModelAndViewContainer c,NativeWebRequest r,WebDataBinderFactory f) { return user; }
+        }).build();
+        mvc.perform(get("/api/merchant/v1/orders/21").param("customerId","999").param("tenantId","999"))
+            .andExpect(status().isOk()).andExpect(org.springframework.test.web.servlet.result.MockMvcResultMatchers.jsonPath("$.data.progress.orderId").value(21))
+            .andExpect(org.springframework.test.web.servlet.result.MockMvcResultMatchers.jsonPath("$.data.progress.stage").value("scheduled"))
+            .andExpect(org.springframework.test.web.servlet.result.MockMvcResultMatchers.jsonPath("$.data.progress.partial").value(true));
+        verify(query).detail(11,21,false);verify(progress).detailProgress(11,21);
+        clearInvocations(query,progress);
+        assertThatThrownBy(()->controller.detail(null,21)).isInstanceOf(BizException.class);verifyNoInteractions(query,progress);
+        assertThat(MerchantUnifiedOrderController.class.getMethod("detail",AuthenticatedUser.class,long.class).getAnnotation(PreAuthorize.class).value()).isEqualTo("hasAuthority('merchant:order:view')");
+    }
+
 }
diff --git a/order/src/test/java/com/baiyue/order/controller/UnifiedOrderApiContractTest.java b/order/src/test/java/com/baiyue/order/controller/UnifiedOrderApiContractTest.java
index 826b0c335..7cdb81731 100644
--- a/order/src/test/java/com/baiyue/order/controller/UnifiedOrderApiContractTest.java
+++ b/order/src/test/java/com/baiyue/order/controller/UnifiedOrderApiContractTest.java
@@ -85,7 +85,7 @@ class UnifiedOrderApiContractTest {
         assertThat(responseSchema(paths, "/api/platform/v1/orders", "get"))
             .containsEntry("$ref", "#/components/schemas/UnifiedOrderPageEnvelope");
         assertThat(responseSchema(paths, "/api/merchant/v1/orders/{orderId}", "get"))
-            .containsEntry("$ref", "#/components/schemas/UnifiedOrderDetailEnvelope");
+            .containsEntry("$ref", "#/components/schemas/MerchantOrderDetailEnvelope");
     }
 
     @Test
@@ -143,4 +143,20 @@ class UnifiedOrderApiContractTest {
             .containsOnlyKeys("standardNode","nodeSequence","providerCode","estimatedAt","actualAt","locationCode","locationName");
     }
 
+
+    @Test void merchantDetailRequiresTheSameProgressShapeAsWorkbenchWithoutChangingPlatformDetail() throws Exception {
+        var document=stringMap(new Yaml().load(new ClassPathResource("openapi/order-v1.yaml").getContentAsString(StandardCharsets.UTF_8)));
+        var schemas=stringMap(stringMap(document.get("components")).get("schemas"));
+        var parts=(List<?>)stringMap(schemas.get("MerchantOrderDetail")).get("allOf");
+        assertThat(stringMap(parts.get(0))).containsEntry("$ref","#/components/schemas/UnifiedOrderDetail");
+        assertThat(stringList(stringMap(parts.get(1)).get("required"))).contains("progress");
+        var progress=stringMap(schemas.get("MerchantOrderProgress"));
+        assertThat(stringList(progress.get("required"))).containsExactly("orderId","stage","partial");
+        assertThat(stringList(stringMap(stringMap(progress.get("properties")).get("stage")).get("enum")))
+            .containsExactlyElementsOf(com.baiyue.order.dto.MerchantOrderProgress.STAGES);
+        assertThat(stringMap(stringMap(schemas.get("UnifiedOrderDetail")).get("properties"))).doesNotContainKey("progress");
+        assertThat(java.util.Arrays.stream(com.baiyue.order.dto.UnifiedOrderResponse.MerchantDetail.class.getRecordComponents()).map(java.lang.reflect.RecordComponent::getName))
+            .containsExactly("summary","order","timeline","transportFragments","progress");
+    }
+
 }
diff --git a/order/src/test/java/com/baiyue/order/repository/MerchantOrderWorkbenchRepositoryTest.java b/order/src/test/java/com/baiyue/order/repository/MerchantOrderWorkbenchRepositoryTest.java
index 96d7a9af4..0929211a1 100644
--- a/order/src/test/java/com/baiyue/order/repository/MerchantOrderWorkbenchRepositoryTest.java
+++ b/order/src/test/java/com/baiyue/order/repository/MerchantOrderWorkbenchRepositoryTest.java
@@ -125,4 +125,17 @@ class MerchantOrderWorkbenchRepositoryTest {
         assertThat(filtered.queues().fee()).isEqualTo(1);
         assertThat(repository.progressScope(11)).hasSize(212);
     }
+
+    @Test void detailScopesOnlyExactOwnedOrderAndActiveOwnedChildren() {
+        jdbc.update("UPDATE ord_order SET root_order_id=210 WHERE id BETWEEN 210 AND 214");
+        jdbc.update("UPDATE ord_order SET status='CANCELLED' WHERE id=212");
+        assertThat(repository.detailProgressScope(11,210)).extracting(OrderEntity::getId).containsExactly(210L,211L);
+        assertThat(repository.detailProgressScope(11,211)).extracting(OrderEntity::getId).containsExactly(211L);
+        assertThat(repository.detailProgressScope(22,210)).isEmpty();
+        assertThat(repository.detailProgressScope(11,213)).isEmpty();
+        assertThat(repository.detailProgressScope(11,999)).isEmpty();
+        jdbc.update("UPDATE ord_order SET root_order_id=NULL WHERE id=210");
+        assertThat(repository.detailProgressScope(11,210)).extracting(OrderEntity::getId).containsExactly(210L,211L);
+    }
+
 }
diff --git a/order/src/test/java/com/baiyue/order/service/MerchantOrderWorkbenchServiceTest.java b/order/src/test/java/com/baiyue/order/service/MerchantOrderWorkbenchServiceTest.java
index 01b67d22c..4ffde22dc 100644
--- a/order/src/test/java/com/baiyue/order/service/MerchantOrderWorkbenchServiceTest.java
+++ b/order/src/test/java/com/baiyue/order/service/MerchantOrderWorkbenchServiceTest.java
@@ -45,7 +45,7 @@ class MerchantOrderWorkbenchServiceTest {
         assertThat(result.page().total()).isEqualTo(210);
         assertThat(result.page().page()).isEqualTo(22);
         assertThat(result.queues().fee()).isEqualTo(2);
-        verify(firstleg).workbenchFilters("test-service-token",new FirstlegUnifiedOrderClient.WorkbenchFilterRequest(11,"LOADED"));
+        verify(firstleg).workbenchFilters("test-service-token",new FirstlegUnifiedOrderClient.WorkbenchFilterRequest(11,"LOADED",null));
         verify(unified).merchantWorkbenchRows(11,List.of());
     }
     @Test void unavailableOrIncompleteFulfillmentFiltersCannotProduceMisleadingEmptyQueues() {
@@ -92,4 +92,63 @@ class MerchantOrderWorkbenchServiceTest {
         assertThat(projected.get(2L).partial()).isFalse();assertThat(projected.get(3L).stage()).isEqualTo("delivered");
         assertThat(projected.get(4L).stage()).isEqualTo("none");assertThat(projected).doesNotContainKey(999L);
     }
+
+    @Test void freshDetailUsesExactOwnedScopeAndTheSameProjectionAsList() {
+        var scope=List.of(order(1L,1L,com.baiyue.order.entity.OrderStatus.APPROVED),order(2L,1L,com.baiyue.order.entity.OrderStatus.APPROVED));
+        var first=List.of(new com.baiyue.order.dto.MerchantOrderProgress(1L,"cleared",false));
+        var tail=List.of(new com.baiyue.order.dto.MerchantOrderProgress(2L,"scheduled",false));
+        when(repository.detailProgressScope(11,1)).thenReturn(scope);
+        when(firstleg.workbenchFilters(anyString(),any())).thenReturn(ApiResponse.success(new FirstlegUnifiedOrderClient.WorkbenchFilters(null,List.of(),List.of(),first)));
+        when(lastleg.read(anyString(),any())).thenReturn(ApiResponse.success(new com.baiyue.order.client.LastlegOrderProgressClient.Response(tail)));
+        assertThat(service.detailProgress(11,1)).isEqualTo(MerchantOrderWorkbenchService.project(scope,first,tail).get(1L))
+            .isEqualTo(new com.baiyue.order.dto.MerchantOrderProgress(1L,"scheduled",true));
+        verify(firstleg).workbenchFilters("test-service-token",new FirstlegUnifiedOrderClient.WorkbenchFilterRequest(11,null,List.of(1L,2L)));
+        verify(lastleg).read("test-service-token",new com.baiyue.order.client.LastlegOrderProgressClient.Request(11,List.of(1L,2L)));
+        verify(repository).detailProgressScope(11,1);verifyNoMoreInteractions(repository);verifyNoInteractions(unified);
+    }
+    @Test void childDetailDoesNotReadItsRootSiblingsOrAllCustomerPages() {
+        when(repository.detailProgressScope(11,2)).thenReturn(List.of(order(2L,1L,com.baiyue.order.entity.OrderStatus.APPROVED)));
+        when(firstleg.workbenchFilters(anyString(),any())).thenReturn(ApiResponse.success(new FirstlegUnifiedOrderClient.WorkbenchFilters(null,List.of(),List.of(),List.of())));
+        when(lastleg.read(anyString(),any())).thenReturn(ApiResponse.success(new com.baiyue.order.client.LastlegOrderProgressClient.Response(List.of(new com.baiyue.order.dto.MerchantOrderProgress(2L,"scheduled",false)))));
+        assertThat(service.detailProgress(11,2)).isEqualTo(new com.baiyue.order.dto.MerchantOrderProgress(2L,"scheduled",false));
+        verify(firstleg).workbenchFilters(anyString(),eq(new FirstlegUnifiedOrderClient.WorkbenchFilterRequest(11,null,List.of(2L))));
+        verify(repository).detailProgressScope(11,2);verifyNoMoreInteractions(repository);verifyNoInteractions(unified);
+    }
+    @Test void missingOwnedOrderFailsBeforeAnyRemoteQuery() {
+        when(repository.detailProgressScope(11,99)).thenReturn(List.of());
+        assertThatThrownBy(()->service.detailProgress(11,99)).isInstanceOf(BizException.class).hasMessageContaining("订单不存在");
+        verifyNoInteractions(firstleg,lastleg,unified);
+    }
+    @Test void detailRejectsOutOfScopeDuplicateInvalidAndMissingFactsInsteadOfFallingBack() {
+        when(repository.detailProgressScope(11,1)).thenReturn(List.of(order(1L,null,com.baiyue.order.entity.OrderStatus.APPROVED)));
+        for(var facts:List.of(List.of(new com.baiyue.order.dto.MerchantOrderProgress(999L,"loaded",false)),
+            List.of(new com.baiyue.order.dto.MerchantOrderProgress(1L,"unknown",false)),
+            List.of(new com.baiyue.order.dto.MerchantOrderProgress(1L,"loaded",false),new com.baiyue.order.dto.MerchantOrderProgress(1L,"loaded",false)))) {
+            when(firstleg.workbenchFilters(anyString(),any())).thenReturn(ApiResponse.success(new FirstlegUnifiedOrderClient.WorkbenchFilters(null,List.of(),List.of(),facts)));
+            assertThatThrownBy(()->service.detailProgress(11,1)).isInstanceOf(BizException.class).hasMessageContaining("暂时不可用");
+        }
+        when(firstleg.workbenchFilters(anyString(),any())).thenReturn(null);
+        assertThatThrownBy(()->service.detailProgress(11,1)).isInstanceOf(BizException.class);
+        when(firstleg.workbenchFilters(anyString(),any())).thenReturn(ApiResponse.success(new FirstlegUnifiedOrderClient.WorkbenchFilters(null,List.of(),List.of(),List.of())));
+        when(lastleg.read(anyString(),any())).thenThrow(new IllegalStateException("unavailable"));
+        assertThatThrownBy(()->service.detailProgress(11,1)).isInstanceOf(BizException.class);
+    }
+    @Test void largeRootScopesUseBoundedBatchesWithoutLosingAnyChild() {
+        var scope=java.util.stream.LongStream.rangeClosed(1,201).mapToObj(id->order(id,1L,com.baiyue.order.entity.OrderStatus.APPROVED)).toList();
+        when(repository.detailProgressScope(11,1)).thenReturn(scope);
+        when(firstleg.workbenchFilters(anyString(),any())).thenReturn(ApiResponse.success(new FirstlegUnifiedOrderClient.WorkbenchFilters(null,List.of(),List.of(),List.of())));
+        service.detailProgress(11,1);
+        var requests=org.mockito.ArgumentCaptor.forClass(FirstlegUnifiedOrderClient.WorkbenchFilterRequest.class);
+        verify(firstleg,times(2)).workbenchFilters(anyString(),requests.capture());
+        assertThat(requests.getAllValues()).extracting(r->r.orderIds().size()).containsExactly(200,1);
+        assertThat(requests.getAllValues().stream().flatMap(r->r.orderIds().stream())).containsExactlyElementsOf(scope.stream().map(com.baiyue.order.entity.OrderEntity::getId).toList());
+    }
+    @Test void authoritativeDraftSubmittedCompletedAndCancelledDoNotNeedRemoteProgress() {
+        for(var status:List.of(com.baiyue.order.entity.OrderStatus.DRAFT,com.baiyue.order.entity.OrderStatus.SUBMITTED,com.baiyue.order.entity.OrderStatus.COMPLETED,com.baiyue.order.entity.OrderStatus.CANCELLED)) {
+            when(repository.detailProgressScope(11,1)).thenReturn(List.of(order(1L,null,status)));
+            assertThat(service.detailProgress(11,1).stage()).isEqualTo(status==com.baiyue.order.entity.OrderStatus.COMPLETED?"delivered":"none");
+        }
+        verifyNoInteractions(firstleg,lastleg,unified);
+    }
+
 }
diff --git a/platform-bom/AGENTS.md b/platform-bom/AGENTS.md
index 459558e7a..4b20ebd94 100644
--- a/platform-bom/AGENTS.md
+++ b/platform-bom/AGENTS.md
@@ -1,5 +1,10 @@
 # Platform BOM 模块指引
 
+## 数据库访问与中文注释约束
+
+- 强制遵守根 `../AGENTS.md` 的“数据库访问与中文代码注释”全部规则：正常业务访问统一为 `Controller → Service → Repository → Mapper`，不得省略 Repository 或跨层直调；生产 SQL 由 Mapper 执行，Repository 不得直接使用 JdbcTemplate 或原生 JDBC。非 HTTP 入口从 Service 进入；无数据库模块不引入数据库访问。
+- 每个手写方法及构造器须有简短中文说明；核心业务规则、复杂 SQL、事务、锁、幂等、并发及失败处理须补充适量中文注释，重点说明原因和边界。新增、修改方法立即执行，触及的存量代码同步整改。
+
 ## 职责边界
 
 - 本模块只通过 `pom.xml` 的 `dependencyManagement` 发布 `baiyue-platform-bom`，统一管理本仓公共制品版本。
diff --git a/print/AGENTS.md b/print/AGENTS.md
index 3e9af5ab7..912e3852f 100644
--- a/print/AGENTS.md
+++ b/print/AGENTS.md
@@ -1,5 +1,10 @@
 # Print Service 模块指引
 
+## 数据库访问与中文注释约束
+
+- 强制遵守根 `../AGENTS.md` 的“数据库访问与中文代码注释”全部规则：正常业务访问统一为 `Controller → Service → Repository → Mapper`，不得省略 Repository 或跨层直调；生产 SQL 由 Mapper 执行，Repository 不得直接使用 JdbcTemplate 或原生 JDBC。非 HTTP 入口从 Service 进入；无数据库模块不引入数据库访问。
+- 每个手写方法及构造器须有简短中文说明；核心业务规则、复杂 SQL、事务、锁、幂等、并发及失败处理须补充适量中文注释，重点说明原因和边界。新增、修改方法立即执行，触及的存量代码同步整改。
+
 ## 职责边界
 
 - 本模块是无数据库的无状态 PDF 渲染服务；调用方传入完整 `labels[]` 或 `documents[]`，模块在内存中生成一次性多页 PDF 并同步返回。
diff --git a/scripts/AGENTS.md b/scripts/AGENTS.md
index afb1f0ca0..56201850c 100644
--- a/scripts/AGENTS.md
+++ b/scripts/AGENTS.md
@@ -10,7 +10,7 @@
 
 | 类别 | 正式入口 | 管理边界 |
 |---|---|---|
-| 生产单票发布验收 | `prod-release-acceptance.mjs`、`prod-release-delivery-stage.mjs`、内部 `prod-release-order-stage.mjs` | 同一票义乌到洛杉矶、前置同时核对东莞；订单创建/提交/审核与尾程签收/国内回传分阶段续跑，检查点独立；不调用测试造数模块，不创建账号/主档或删除数据；配置和边界见 README |
+| 测试/灰度单票验收 | `prod-release-acceptance.mjs`、`prod-release-delivery-stage.mjs`、内部 `prod-release-order-stage.mjs` | 显式 test/gray、统一 Gateway/accessToken；同一票义乌到洛杉矶、前置同时核对东莞；full-flow 串行覆盖买单FBA正常链至签收回传及车次资源释放，保留分阶段入口与独立检查点；不调用测试造数模块，不创建账号/主档或删除数据；配置和边界见 README |
 | Admin 全量 HTTP 验证 | `admin-test-env-acceptance.mjs` | 通过显式环境文件运行统一 TEST Gateway/会话，拒绝旧海外网关参数；默认模块覆盖平台全链路，定向验证使用 `--modules`，模块注册和依赖以总入口及 `admin-test-env-modules/README.md` 为准 |
 | Client 全量 HTTP 验证 | `client-test-env-acceptance.mjs` | 通过显式环境文件运行统一 TEST Gateway/会话，拒绝旧海外网关参数；覆盖客户工作台完整链路，`client-phase2-test-env-acceptance.mjs` 只是入库测量与计费专项，不替代全量入口 |
 | Client 快速下单定向验证 | `client-quick-order-test-env-acceptance.mjs` | 使用既有测试客户通过批量草稿接口验证 FBA、海外仓、私人地址、逐行失败和幂等重放；只创建草稿，不提交或审核，不替代 Client 全量入口 |
diff --git a/scripts/README.md b/scripts/README.md
index 5b084247c..a78fb315a 100644
--- a/scripts/README.md
+++ b/scripts/README.md
@@ -1,5 +1,13 @@
 # 后端脚本管理与全量 HTTP 验收索引
 
+`appointment-work-test-env.mjs`：预约事项与稳定批次 TEST 定向 HTTP 验收，默认 `--plan` 零网络；显式 `--execute --environment=TEST --run-id=<新批次> --mode=read|workflow --fixture=<本轮清单>` 才执行。运行者用 `node --env-file=<明确TEST配置>` 注入平台、客户及只读平台凭据，变量名和清单合同见 `--plan`。清单必须引用本轮正式业务生产者报告及 SHA256，不借用历史业务样本。read 只登录、查询、退出自身会话；workflow 还写一项跟进并验证原键重放、陈旧版本、异载荷和权限拒绝，可按清单登记客户仓无需预约要求，不代替排车/PDA/签收原域事实。报告写入独占的新 `reports/appointment-work-<run-id>/`；失败保留报告和业务记录，不自动重发未知结果、删除、重置或执行 SQL。离线合同为 `appointment-work-test-env.test.mjs`；只读或离线通过不代表完整运输履约、真实页面通过。
+
+`../lastleg-service/scripts/selfoperated-test-env-acceptance.mjs`：自营统计 TEST Gateway 验收，默认仅输出计划；显式 `--execute --environment TEST --source-account <账号键> --warehouse <仓库编码> --other-warehouse <第二仓> --report <报告路径>` 才登录并查询。凭据由运行者通过脚本之前的 `node --env-file=<明确TEST文件>` 注入，需平台、只读平台、无权限平台及客户身份。`--probe-off-command` 仅在确认 OFF 后提交预期被拒绝的命令并核对无新增任务；不采集、发布、造数或写 SQL。`--synthetic-fixture <审核后的说明文件>` 验证合成样本，不能证明真实来源覆盖。报告脱敏记录各项结果及请求标识；失败保留报告，重跑使用新报告路径并重新登录，结束退出自身会话，不清理业务样本。离线合同为同目录 `selfoperated-test-env-acceptance.test.mjs`。
+
+`db/cargo-discard-consolidated-incremental-20261014.sql`：废弃业务结构增量汇总，MySQL 8.0.16+，仅对 `baiyue_lastleg` 已有业务库执行。覆盖废弃基础表、PDA完工字段、照片关联、退货箱废弃状态、通用库存来源和部分选箱；表/列/索引按存在性判断，约束原子替换，可重复执行。不回填历史订单、不补造出库单、不修改库存数量，无业务 DML；File及仓储资源库无需本次SQL。实例和凭据由执行者指定，完整执行、遇错停止、不使用 `--force`；DDL隐式提交，修正错误后可重跑，末尾 `SHOW CREATE TABLE` 结果由执行者保存核对，不自动清理或连接环境。
+
+`db/return-consolidated-incremental-20261012.sql`：10月10日/12日退货、签收、清点、换标与按件出库增量汇总，显式 `USE baiyue_lastleg`，MySQL 8.0.16+ 已有业务库可重复执行。本轮补齐签收原包装、尺寸重量来源及库存箱原包装三个字段；逐列判断存在性，不回填签收/清点事实，不改库存数量。连接实例及凭据由执行者明确指定，整份执行、遇错停止；保留执行错误，修复后可重跑，末尾输出字段、索引与约束供核对。托盘重量、体积汇总是应用逻辑，不新增资源库字段；不自动执行到测试或生产环境。
+
 `procurement-sample-test-env.mjs` 是采购样品正常全链路 TEST 专项入口，默认或 `--plan` 零网络。真实执行使用 `node --env-file="<授权目录>/test-acceptance.env" scripts/procurement-sample-test-env.mjs --execute --environment TEST --run-id <唯一短批次> --warehouse-id <已核对有效海外收货仓>`。只允许当前 TEST 工作区及指定配置；由正式 API 创建独立客户并完成资质，人工充值10元，上传凭证/面单，调用内部 `procurement-sample-fulfillment.mjs` 完成两箱正常履约。充值、文件和采购请求前落盘，结果未知停写；报告独占 `reports/procurement-sample-<批次>/report.json`，不覆盖旧报告，不自动重跑，不执行 SQL/部署/删除。结束退出自身平台与客户会话，保留样本。通过只表示该正常路径，不替代异常、退款、权限、真实页面和请求量验收。离线入口合同为 `procurement-sample-test-env.test.mjs`；内部模块安全合同见模块索引。
 
 
@@ -79,7 +87,7 @@ F40 专项可用 `--signature-mode ROOT_FIRST|CHILD_FIRST|ROOT_SIGNED_REMAINDER_
 
 `fleet-cross-customer-test-env.mjs` 是最小两客户共享车次的串行 TEST 专项入口，默认 `--plan` 零网络。显式运行参数为 `--execute --environment TEST --run-id <新批次> --warehouse-id <实际海外收货仓ID> --destination-warehouse-id <FBA目的仓ID>`，凭据仅从显式 `node --env-file="<TEST配置>" --env-file="<Jenkins配置>"` 与 `FBA_CORE_JENKINS_AGENT` 提供。通过普通转运来货、PDA实收和客户确认创建两个新客户各一托一箱，分别预排并关联同车；一单未拣齐时验证全车拒绝及完整库存快照不变，再统一发车、原键重放、逐客户签收，最后正式结案并分别释放车辆/司机，核对结案前后库存零变化。完整库存由只读取证器获取，不写业务SQL，不部署或改共享配置。报告位于 `reports/fleet-cross-<新批次>/`，每次请求发送前记录意图；失败保留原现场，不自动重跑或续跑，已存在批次拒绝覆盖。finally停用本轮PDA并退出独立会话；业务样本保留。前置拒绝不代表事务中途回滚，后者另验。对应入口保护合同为 `fleet-cross-customer-test-env.test.mjs`；内部生成与验收函数见模块README。
 
-头程订单提交使用首次原始详情的 `expectedVersion` 与原 `Idempotency-Key`。生产单票的 `SUBMIT_INTENT` 必须先持久化 `submitCommand` 再发送，显式续跑不得使用当前版本替换原命令，缺少原命令的提交意图及后续检查点停止并等待人工核对。源 Excel 造数同样在提交前保存订单条目的 `submitCommand`；中断或失败条目保留原检查点且不自动重跑，不重建订单或换版本继续。
+头程订单提交使用首次原始详情的 `expectedVersion` 与原 `Idempotency-Key`。单票验收的 `SUBMIT_INTENT` 必须先持久化 `submitCommand` 再发送，显式续跑不得使用当前版本替换原命令，缺少原命令的提交意图及后续检查点停止并等待人工核对。源 Excel 造数同样在提交前保存订单条目的 `submitCommand`；中断或失败条目保留原检查点且不自动重跑，不重建订单或换版本继续。
 
 ## 验收证据校验
 
@@ -153,34 +161,37 @@ node --env-file="<外部生产数据库.env>" scripts/prod-database-schema-accep
 
 ## 验收环境变量文件
 
-### 生产单票发布验收（独立入口）
+### 测试/灰度单票验收（独立入口）
 
 称重计算内部模块 `prod-release-measurement-plan.mjs` 统一采用每箱含纸箱、不含托盘 7.5 kg、40×30×30 cm（0.036 m³）。`order-stage` 在载荷绑定及报价前自动按箱数统一申报箱规、货重及总体积；不推算商品净重，已填商品净重若超过含箱货重则阻断。改口径后的已有检查点载荷不一致会停止，不能以换批次方式盲目重跑。
 
-只读计算命令：`node --env-file="<外部生产配置.env>" scripts/prod-release-acceptance.mjs measurement-plan 2`（箱数只允许 1 或 2；执行前仍需生产 HTTP 授权）。外部配置新增 `CHONGCHONG_ACCEPTANCE_PALLET_CODES`，逗号分隔明确允许复用的现有托盘编码；检查所有编码唯一存在于义乌仓，稳定选择列表第一个，读取其实际 `capacityCbm` 和 `weightKg`，不写死容量或皮重。托数按总体积/选中托盘容量向上取整，每托分配整数箱，称重毛重=该托箱数×7.5+皮重；容量不足以容纳完整箱或参数异常时阻断。不创建托盘/库位、不上传称重图片、不确认称重，只向终端输出 `MEASUREMENT_PLAN_ONLY` 计算结果。服务端库位槽数还依赖其默认托容量配置，与此处实际称重托数不是同一字段；后续由服务端分配并回查既有普通位或 A0，不在脚本伪造库位数。
+只读计算命令：`node --env-file="<明确目标环境配置.env>" scripts/prod-release-acceptance.mjs measurement-plan 2`（箱数只允许 1 或 2；执行前仍需目标环境 HTTP 授权）。外部配置新增 `CHONGCHONG_ACCEPTANCE_PALLET_CODES`，逗号分隔明确允许复用的现有托盘编码；检查所有编码唯一存在于义乌仓，稳定选择列表第一个，读取其实际 `capacityCbm` 和 `weightKg`，不写死容量或皮重。托数按总体积/选中托盘容量向上取整，每托分配整数箱，称重毛重=该托箱数×7.5+皮重；容量不足以容纳完整箱或参数异常时阻断。不创建托盘/库位、不上传称重图片、不确认称重，只向终端输出 `MEASUREMENT_PLAN_ONLY` 计算结果。服务端库位槽数还依赖其默认托容量配置，与此处实际称重托数不是同一字段；后续由服务端分配并回查既有普通位或 A0，不在脚本伪造库位数。
 
 离线验证：`node --test scripts/prod-release-measurement-plan.test.mjs`，覆盖小数容量边界、皮重、箱数/重量守恒、错误仓库和托盘白名单；不证明真实称重写入已实现。
 
 `prod-release-acceptance.mjs` 目标固定为同一票从义乌 `CN-YIWU-01` 到洛杉矶 `US-LAX-01`，并在前置检查中同时核对东莞 `CN-DONGGUAN-01`；客户身份由外部配置精确限定，不调用开发/测试全量造数模块。订单阶段负责单票创建、提交和审核；`prod-release-delivery-stage.mjs` 负责既有本批次的派送中、签收文件、派送完成和国内签收事件回查，两个阶段分别使用独立检查点。签收脚本不会借用历史单据或删除数据。
 
 - `node scripts/prod-release-acceptance.mjs plan`：不加载凭据，不访问 HTTP，列出主链阶段与不覆盖范围。
-- `node --env-file="$env:USERPROFILE\.codex\env\chongchong-global\prod-acceptance.env" scripts/prod-release-acceptance.mjs preflight`：获得当次生产 HTTP 授权后运行；登录既有四个账号并查询客户、义乌/东莞/洛杉矶仓、PDA 绑定及义乌资源。不创建业务数据、主档或账号，不删除数据；登录本身会创建会话及审计记录。
-- 必填 `CHONGCHONG_ENV=prod`；`CHONGCHONG_ADMIN_API_BASE_URL`、`CHONGCHONG_ADMIN_OVERSEAS_API_BASE_URL`、`CHONGCHONG_MERCHANT_API_BASE_URL` 分别为同一 HTTPS 前端代理的 `/api`、`/overseas-api`、`/api`。
-- 客户锁定配置：`CHONGCHONG_ACCEPTANCE_CUSTOMER_ID`、`CHONGCHONG_ACCEPTANCE_CUSTOMER_CODE`、`CHONGCHONG_ACCEPTANCE_CUSTOMER_NAME`。四组账号分别使用 `CHONGCHONG_ADMIN_*`、`CHONGCHONG_MERCHANT_*`、`CHONGCHONG_CN_PDA_*`、`CHONGCHONG_OVERSEAS_LAX_PDA_*` 的 `USERNAME` / `PASSWORD`；另需 `CHONGCHONG_OVERSEAS_LAX_PDA_WAREHOUSE_CODE=US-LAX-01`。不修改环境文件，不读取其他环境作为回退。
+- `node --env-file="$env:USERPROFILE\.codex\chongchong-global-test-acceptance.env" scripts/prod-release-acceptance.mjs preflight`：获得当次目标环境 HTTP 授权后运行；登录既有四个账号并查询客户、义乌/东莞/洛杉矶仓、PDA 绑定及义乌资源。不创建业务数据、主档或账号，不删除数据；登录本身会创建会话及审计记录。
+- 必填 `CHONGCHONG_ENV=test` 或 `gray`；`CHONGCHONG_ADMIN_API_BASE_URL` 与 `CHONGCHONG_MERCHANT_API_BASE_URL` 必须完全指向同一 HTTPS `/api` 统一入口。拒绝 `prod/dev` 及旧 `CHONGCHONG_ADMIN_OVERSEAS_API_BASE_URL`、`CHONGCHONG_MERCHANT_OVERSEAS_API_BASE_URL` 配置（即使值与统一入口相同也必须移除）。所有业务及文件上传只使用登录返回的 `accessToken`，不读取海外 Token。灰度由运行者显式选择外部灰度配置，不自动读取、修改或回退环境文件。
+- 客户必须为 `ACTIVE` 且箱规初始化为 `READY`；`PROFILE_REQUIRED` 等状态阻断，不自动完善资料或审核客户。客户锁定配置：`CHONGCHONG_ACCEPTANCE_CUSTOMER_ID`、`CHONGCHONG_ACCEPTANCE_CUSTOMER_CODE`、`CHONGCHONG_ACCEPTANCE_CUSTOMER_NAME`。四组账号分别使用 `CHONGCHONG_ADMIN_*`、`CHONGCHONG_MERCHANT_*`、`CHONGCHONG_CN_PDA_*`、`CHONGCHONG_OVERSEAS_LAX_PDA_*` 的 `USERNAME` / `PASSWORD`；另需 `CHONGCHONG_OVERSEAS_LAX_PDA_WAREHOUSE_CODE=US-LAX-01`。不修改环境文件，不读取其他环境作为回退。
 - 报告位于 `reports/prod-release-preflight-<时间戳>.json`，不包含账号、Token、真实客户名称或原始响应。网络异常不自动重试；修正问题后可重新执行只读检查，产生新报告，不清理旧报告或业务数据。
-- 单票入口 `order-stage <外部订单输入.json> <本批次检查点.json> --confirm-production-order [--resume]`：须另获当次生产写入授权。自动执行基本前置检查，额外校验指定客户可选的唯一渠道/包税维度与 1～2 箱实际重量、体积报价，然后创建一票、提交、审核；不创建图片、地址、托盘或库位。仅支持 AUTO 入仓码、普通海运 FBA 自送散货、单 SKU 非木制非危险品；目的 FBA 仓显式指定，洛杉矶是后续接柜仓，不是第二票。输入与检查点放仓库外，同一批次始终使用同一检查点文件，禁止并发另开路径或换批次重试。
-- 尾程签收入口 `delivery-stage <尾程事实输入.json> <独立签收检查点.json> --confirm-production-delivery`：须另获当次生产写入授权。脚本只接受本批次已核对的排车、出库、派送和尾程订单身份；按状态版本推进 `DELIVERING`，上传验收用签收文件并保存资料，回查 `DELIVERED`、国内入仓 `DELIVERED` 和头程订单 `COMPLETED`。上传或状态写入结果不确定时停止；托盘明细或尾程子状态未同步会记录为阻断项。
-- `prod-release-order-stage.mjs` 是上述入口使用的内部订单阶段与检查点实现，不可直接执行。先落盘并同步意图，再调用 HTTP；检查点绑定环境、客户、操作者、批次和载荷摘要，不保存密码/Token/完整申报。创建与提交仅在显式续跑时复用原幂等键；审核无幂等键，响应丢失后只回查，若仍不能确认已审核则停止并要求人工核对，不自动再次审核。崩溃残留 `.lock` 时先确认无运行进程、检查业务状态，再人工解除锁；不得删除业务检查点。
+- 单票入口 `order-stage <外部订单输入.json> <本批次检查点.json> --confirm-single-order [--resume]`：须另获当次目标环境写入授权。自动执行基本前置检查，额外校验指定客户可选的唯一渠道/包税维度与 1～2 箱实际重量、体积报价，然后创建一票、提交、审核；不创建图片、地址、托盘或库位。仅支持 AUTO 入仓码、普通海运 FBA 自送散货、单 SKU 非木制非危险品；目的 FBA 仓显式指定，洛杉矶是后续接柜仓，不是第二票。输入与检查点放仓库外，同一批次始终使用同一检查点文件，禁止并发另开路径或换批次重试。
+- 尾程签收入口 `delivery-stage <尾程事实输入.json> <独立签收检查点.json> --confirm-single-delivery`：须另获当次目标环境写入授权。脚本只接受本批次已核对的排车、出库、派送和尾程订单身份；按状态版本推进 `DELIVERING`，上传验收用签收文件并保存资料，回查 `DELIVERED`、国内入仓 `DELIVERED` 和头程订单 `COMPLETED`。上传或状态写入结果不确定时停止；托盘明细或尾程子状态未同步会记录为阻断项。
+- `prod-release-order-stage.mjs` 是上述入口使用的内部订单阶段与检查点实现，不可直接执行。先落盘并同步意图，再调用 HTTP；检查点绑定环境模式及统一 API 地址、客户、操作者、批次和载荷摘要，不保存密码/Token/完整申报。旧双网关检查点不兼容，遇到绑定不符应先人工核对原票状态，禁止删除检查点后重新造票。创建与提交仅在显式续跑时复用原幂等键；审核无幂等键，响应丢失后只回查，若仍不能确认已审核则停止并要求人工核对，不自动再次审核。崩溃残留 `.lock` 时先确认无运行进程、检查业务状态，再人工解除锁；不得删除业务检查点。
 - 订单输入字段：`batch`（8～48 位字母数字/连字符）、`origin: {id, code: "CN-YIWU-01"}`、`destination: {id, code, type: "FBA"}`、`payload`（`order` 服务 `OrderRequests.SaveRequest` 完整请求）。客户、环境和操作者由外部 env 强制绑定；`payload.customerName` 必须匹配配置，`customerRemark` 必须为 `RELEASE-ACCEPTANCE:<batch>`。显式填 `fulfillmentType=STANDARD`、`transportMode=SEA`、`pickupMethod=SELF_EXPRESS`、`containerMode=LCL`，`cargoes` 一行 1～2 箱；已上传的产品图片 ID 和商品申报字段由本次验收资料提供，箱规/含箱总重/总体积由上述固定口径统一计算，不生成资质或物流签收证明。箱数×每箱数量必须等于总件数，箱规×箱数必须等于总体积。
-- 待实现：供应商及海外资源门禁、测量至签收写入、后续阶段归属核验、跨区等待和检查点、所有阶段真实 HTTP 验证。全链 `execute` / `resume` 命令仍拒绝；订单续跑仅使用上述 `order-stage ... --resume`。不得改用测试全量脚本来代替。
-- 离线验证：`node --test scripts/prod-release-acceptance.test.mjs`。一票主链不覆盖多客户混柜、退货异常、真实付款、外部下单、邮件发送或页面交互。
+- 完整正常链：`full-flow <外部订单输入.json> <独立全流程检查点.json> --confirm-single-full-flow [--resume]`。仅支持 `BUY_DECLARATION` 买单报关、单 SKU、1～2 箱、义乌起运及洛杉矶接柜的 FBA 正常链。先用现有客户下单审核，再测量/费用确认、订舱/分柜、国内 PDA 装柜、买单报关、人工船节点、目的港提柜预约、海外 PDA 收货/还空柜、排车/派送、车次调度/拣货/发车、签收回传及车次结案释放资源。任何HTTP或归属/数量门禁失败都停止，保留同票检查点，不新建订单代替失败。
+- 全流程内部模块：`prod-release-full-flow.mjs` 负责单票阶段编排和独立子检查点；`prod-release-http.mjs` 负责统一 Gateway、写前请求摘要落盘、失败诊断、合成文件上传及独立登录会话退出；`prod-release-domestic-stage.mjs` 负责国内正常链；`prod-release-overseas-stage.mjs` 负责海外正常链和签收后车次结案。这些文件没有独立CLI，不运行全量fixture，不创建账号、客户、车辆、司机、供应商等主档。正常业务会创建本票货柜、订舱、作业托盘、排车、车次、派送及费用记录。
+- 完整输入还需 `domestic: {palletId, assigneeId, bookingAgent:{id,name}, carrier:{id,name,carrierCode}, terminalFleet:{id,name}, estimatedSailingAt, estimatedArrivalAt}` 和 `resources:{vehicleId,driverId,carrierName}`，均引用既有启用且有资格的资源。订单级及货物行都必须明确提供 `shipmentId/referenceId`；不能只填货物行。报告/输入/检查点使用仓库外私有路径；公开交付仅保留脱敏结果、业务号及诊断编号。
+- 全流程报告只有全部正常链及签收回传、资源释放核对成功才输出 `SINGLE_ORDER_HTTP_COMPLETED` 与 `fullFlowVerified:true`，其范围仅为 `ONE_ORDER_NORMAL_HTTP_PATH`。测量、资质、装柜、卸柜和签收文件均明确为合成验收材料，不代表真实物流证据；不覆盖退税报关、多客户/拆单/异常、故障注入、真实支付、第三方下单、邮件、浏览器及设备验收。阶段检查点已完成命令复用原结果，未知写入意图必须人工核对，不能自动重发。
+- 离线验证：`node --test scripts/prod-release-acceptance.test.mjs scripts/prod-release-order-stage.test.mjs scripts/prod-release-delivery-stage.test.mjs scripts/prod-release-measurement-plan.test.mjs scripts/prod-release-http.test.mjs scripts/prod-release-domestic-stage.test.mjs scripts/prod-release-overseas-stage.test.mjs scripts/script-documentation-contract.test.mjs`。一票主链不覆盖多客户混柜、退货异常、真实付款、外部下单、邮件发送或页面交互。最终输出单独报告 `sessionCleanup`，会话退出不受业务请求次数上限影响。
 
-订单阶段与恢复验证：`node --test scripts/prod-release-order-stage.test.mjs`，包括断网响应丢失、原幂等键复用、未知审核结果停机、账号/客户/环境/载荷漂移、并发锁、损坏检查点与入口 HTTP mock。生产运行示例（只到已审核，执行前确认授权，不代表全链完成）：
+订单阶段与恢复验证：`node --test scripts/prod-release-order-stage.test.mjs`，包括断网响应丢失、原幂等键复用、未知审核结果停机、账号/客户/环境/载荷漂移、并发锁、损坏检查点与入口 HTTP mock。单票运行示例（只到已审核，执行前确认授权，不代表全链完成）：
 
 ```powershell
-node --env-file="<外部生产配置.env>" scripts/prod-release-acceptance.mjs order-stage "<外部订单输入.json>" "<本批次检查点.json>" --confirm-production-order
+node --env-file="<明确目标环境配置.env>" scripts/prod-release-acceptance.mjs order-stage "<外部订单输入.json>" "<本批次检查点.json>" --confirm-single-order
 # 中断后保持相同输入、账号和检查点；不要删除检查点或换批次。
-node --env-file="<外部生产配置.env>" scripts/prod-release-acceptance.mjs order-stage "<外部订单输入.json>" "<本批次检查点.json>" --confirm-production-order --resume
+node --env-file="<明确目标环境配置.env>" scripts/prod-release-acceptance.mjs order-stage "<外部订单输入.json>" "<本批次检查点.json>" --confirm-single-order --resume
 ```
 
 统一 TEST 验收账号、密码和 Gateway 由仓库外配置文件显式提供，例如 `$env:USERPROFILE\.codex\chongchong-global-test-acceptance.env`，不写入仓库。文件提供以下变量：
@@ -497,3 +508,20 @@ Admin 全量中的 `phase4-cross-region-events` 使用内部 `test-event-fault-e
 
 
 `f32-pda-hold-race.mjs` 是显式 TEST 暂扣/PDA拣货并发验收入口，离线合同 `f32-pda-hold-race.test.mjs`。命令为 `node --env-file="<TEST配置>" --env-file="<Jenkins配置>" --env-file="<本轮自有PDA配置>" scripts/f32-pda-hold-race.mjs --plan <冻结计划> --report <全新报告> --confirm-test-runtime yes`；只消费已实际入仓、4箱可用、无占用、调度审核通过且同仓PDA canPick=true的本轮独立样本，不创建订单或车次。凭据只读明确TEST/Jenkins/自有PDA配置，不写报告；计划冻结客户、来源订单、仓、余额、位置、排车明细、车次、PDA成员和不可变Lastleg镜像ID。通过Jenkins在指定TEST Lastleg所用MySQL建立仅针对原订单的12秒行锁租约（SELECT FOR UPDATE、固定等待、ROLLBACK，无业务DML），用performance_schema实际锁等待证明两条正式HTTP命令同时竞争，再按暂扣先到/拣货先到两种顺序验证。会真实暂扣、解除本轮暂扣和拣货1箱，逐位置、库存流水、拣货及来源归属、原键重放分别核对；两个阶段顺序执行，不并发造数。结束恢复自有PDA停用状态并退出认证会话，测试单据、部分拣货和资源保留。命令结果未知或断言失败时保存原报告及逐步checkpoint，不自动重发命令、重建样本、删数据或回填SQL；租约自动释放后先核对原单和原命令，未证实的暂扣恢复必须单独按原事实处理。离线通过不代表实际MySQL/PDA或四端页面通过。
+
+- `db/return-package-packing-boundary-incremental-20261010.sql`：退货包裹/箱出库及标签字段增量，显式选定 baiyue_lastleg 库后写结构；无凭据、无业务造数，可重复执行，失败停止并检查数据库错误。
+
+废弃明细字段专项修复：db/cargo-discard-item-columns-repair-20261014.sql。仅对 MySQL 8.0.16+ 的 baiyue_lastleg 已有 ll_cargo_discard_item 表补齐 10 个新增字段，逐列判断，可重复执行，独立于退货约束。实例和凭据由执行者指定；不写业务数据，不修改库存，不自动访问环境。完整执行、遇错停止，DDL隐式提交，修正错误后可重跑；末尾只读查询应返回10行，由执行者保存结果，无自动清理。
+
+废弃退货箱归零约束修复：db/cargo-discard-return-quantity-repair-20261014.sql。仅 baiyue_lastleg，MySQL 8.0.16+，将箱内SKU数量约束改为非负以支持整箱废弃。实例及凭据由执行者指定；可重复执行，原子替换约束，无业务DML，不连接环境自动执行。整份执行、遇错停止，DDL隐式提交，修正后可重跑；末尾输出表结构供保存核对，不清理业务数据。正式增量为 deploy/sql/migrations/overseas/baiyue_lastleg/V26__allow_zero_return_carton_item_quantity.sql，已纳入废弃汇总脚本。
+
+客户废弃照片确认增量：db/cargo-discard-customer-confirmation-incremental-20261014.sql。MySQL 8.0.16+，目标明确为 baiyue_lastleg 和 baiyue_iam；连接实例与凭据由执行者指定。补齐客户确认时间和独立确认权限，默认客户管理员获得授权，自定义角色需手动分配；授权与受影响管理员的安全版本在同一事务提交，重跑安全版本仍单调递增。完整执行、遇错停止、修正后可重跑；不确认或回填历史单据，不修改库存，不自动访问环境或清理。执行结果由操作者保存，权限更新后需重新登录客户账号。对应正式迁移为 Lastleg V27 和 IAM V6；未执行时页面权限与服务字段尚不可用。
+
+`db/warehouse-transfer-carton-counting-incremental.sql`：仓储转运逐箱测量与清点增量，显式 USE baiyue_lastleg；逐列检查并新增箱子尺寸、重量、实点件数、清点操作人、时间、幂等字段、箱所属转运托盘ID及独立SKU申报件数 declared_quantity，可重复执行，无业务DML、不回填历史事实。适用于明确授权的本地或开发MySQL8，凭据由操作者外部提供；失败保留原错误，修复后重跑，不清理单据。已同步尾程基线和海外统一增量。
+
+`local-warehouse-transfer-carton-acceptance.mjs`：仅本机统一Gateway的仓储转运逐箱验收；命令前显式 `node --env-file=<本地配置文件>`，必须提供 ADMIN_TEST_GATEWAY、ADMIN_TEST_USERNAME/PASSWORD、LOCAL_TRANSFER_PDA_PASSWORD，可选 OVERSEAS_TEST_CUSTOMER_ID、TRANSFER_CARTON_OUTPUT、TRANSFER_KEEP_PDA。复用既有有效客户和海外仓，以业务HTTP创建4笔带批次标识的新单，覆盖单箱、多SKU分箱多托、短收及超收、SKU申报件数与预计箱数独立持久化且PDA实收不覆盖原申报、先生成多托盘再逐箱选择托盘、箱级测量清点及托盘体积重量自动汇总、错误SKU/零件数/缺少差异原因拒绝、幂等重放、箱标签、打托绑定、测试照片和入库完成回查。测试照片为合成PNG，不证明真机拍照或物理打印。创建本轮PDA账号，默认finally停用；仅显式 TRANSFER_KEEP_PDA=true 时保留供本轮页面验收后人工停用。不改主档、不写业务数据库、不删除单据；报告不保存凭据或Token，失败保留已创建单号，排查后用新批次重跑，不自动清库或续跑既有单。
+
+
+`db/warehouse-transfer-consolidated-incremental-20261015.sql`：仓储转运近期本地增量汇总，固定 `USE baiyue_lastleg`，适用已有 Lastleg 基线的本地/开发 MySQL 8。依次合入 `warehouse-transfer-outbound-incremental.sql` 和 `warehouse-transfer-carton-counting-incremental.sql`，前者已覆盖旧 `dev-warehouse-transfer-pallet-lifecycle-incremental.sql`，无须重复跑旧生命周期补丁。包含审核、打托/照片、换标、目的地/出库/派送结构、实收箱数，以及逐箱尺寸、重量、实点件数、清点幂等、差异原因、箱所属托盘和独立 SKU 申报件数。只执行 DDL/元数据查询，无业务 DML；不回填单据或修改库存。实例和凭据由操作者在数据库客户端外部提供，无内置连接信息或报告文件。需支持 DELIMITER 和 CREATE ROUTINE/ALTER/INDEX 权限，整文件串行执行，遇错停止，不使用 --force；可按缺失结构检查重复执行，不修复任意同名异构旧表。末尾 `missing_carton_and_quantity_columns=0`、`inbound_pallet_unique_index=READY`、`migration_result=WAREHOUSE_TRANSFER_RECENT_SCHEMA_READY` 表示本轮列/索引核对通过；同客户重复托盘号会报告 INDEX_BLOCKED，不擅自更改旧托盘号。仅整理文件不表示目标库已经执行；连接必须由操作者明确选中，不重放 `deploy/sql/海外区域统一增量-MySQL8.sql` 空库基线。
+
+`db/warehouse-transfer-carton-multi-sku-incremental.sql`：固定指向 `baiyue_lastleg`，按列存在性检查新增 `ll_warehouse_transfer_carton.sku_items_json`（JSON），保存同一实收箱的多个预报 SKU 及逐项件数。可重复执行，不更改或回填既有单据；需在启用新版转运清点后端前执行。
diff --git a/scripts/admin-test-env-modules/README.md b/scripts/admin-test-env-modules/README.md
index d47384b3e..a5ceb318e 100644
--- a/scripts/admin-test-env-modules/README.md
+++ b/scripts/admin-test-env-modules/README.md
@@ -276,7 +276,7 @@ export async function run(context) {
 | 海外 PDA 柜号收货与库内操作 HTTP 生命周期 | `phase4-overseas-pda.mjs`（按柜完成签收和实收，成功后仅以内存上下文交接操作员会话和已完成库存事实）、`phase4-overseas-pda-operations.mjs`（紧随收货执行盘点、公共位核对、托盘拆装换绑和换标复核；只复用本轮入仓计划已有空托盘及公共位，不新增托盘或库位；finally 停用双操作员并清空临时 Token；任何真实 fixture 缺失均 fail-closed） | `phase4-overseas-pda-contract.test.mjs`、`phase4-overseas-pda-operations-contract.test.mjs`、`pda-picker-fixture-contract.test.mjs`（长场景名保留完整运行标识，避免造数账号跨轮重复） |
 | 海外 PDA 退货入库、计费批次与退货合箱 | `phase4-overseas-return-receipt.mjs`（自包含创建本轮客户退货预报和绑定仓临时 PDA 操作员；覆盖退货单号/SKU 查询、正常空结果、分批签收、核平、超收、幂等、退货箱/SKU 库存、每次成功签收唯一仓储计费批次及合箱；finally 停用操作员） | `phase4-overseas-return-receipt-contract.test.mjs`；`ReturnReceiptServiceTest` 精确核对计费批次客户、仓库、签收单、起算时间和 `PENDING_PRICING` 初态 |
 | 尾程单公网控制与人工计划 | `phase4-tail-order-controls.mjs`（PDA 收货前对本轮柜执行整柜接柜仓变更/恢复与幂等冲突、单/批 FBA 目的仓变更、单/批合托标记并取消、CSV 导出、订单费用回查、单票暂扣/解除、八个人工节点和逐票人工计划） | `phase4-tail-order-controls-contract.test.mjs`；只复用现有公共接柜仓/FBA 主档，不新增仓库、托盘或库位；为目标柜全部入仓码创建 `MANUAL` 计划后交给 PDA 继续消费，不借历史订单 |
-| 海外入仓扩展、客户服务与排车 | `phase4-overseas-inbound-operations.mjs`、`phase4-overseas-client-services.mjs`、`phase4-overseas-dispatch.mjs` | 对应同名 `*-contract.test.mjs`；只消费本轮前置资源，缺失时 fail-closed |
+| 海外入仓扩展、客户服务与排车 | `phase4-overseas-inbound-operations.mjs`、`phase4-overseas-client-services.mjs`、`phase4-overseas-dispatch.mjs` | 对应同名 `*-contract.test.mjs`；只消费本轮前置资源，缺失时 fail-closed。入仓扩展模块选择本轮未完成 PDA 收货的第二个 FBA 柜，按真实来源版本独立核实箱数，验证核实变化不覆盖原订单；通过 DELETE 取消及原版本重放核对唯一取消历史和释放数量，再建立有效批次并执行拆分、合并、数量守恒、陈旧版本拒绝、同键重放与异载荷拒绝，保留稳定批次及替代链。该模块同时对已收货首柜执行库存冻结、释放与正反盘点，不能视为只读或仅预约写入。最小运行由 Admin 总入口选择 `--modules phase4-overseas-inbound-operations --wait-split-count 1 --wait-split-package-count 4`，使用明确 TEST 环境文件、既有 Admin/PDA 配置及依赖展开；还需预约列表/编辑/取消、入仓预约和尾程订单读取权限。任何请求失败或来源、数量证明失败即停止后续步骤，保留本轮有效、取消和替代批次，不自动删除或重跑；结果写入总入口报告的 `phase4OverseasInboundAdmin`，取消行为须有对应本轮授权 |
 | 海外仓业务跨区事件与安全门禁 | `phase4-cross-region-events.mjs`（统一平台会话、匿名拒绝、canonical 权限 403、国内装柜完成到 Lastleg 建单、海外柜完成到 Firstleg 回写、轮询与诊断证据；重复 GET 仅验证读取稳定，缺真实投递重放证据仍阻断；缺本轮 marker 前置时阻断） | `phase4-cross-region-events-contract.test.mjs` |
 | 国内离仓至海外 PDA 可见人工验收节点 | `phase3-customs.mjs`（国内报关资料与整柜照片）、`phase3-outbound-dispatch.mjs`（柜级离仓）、`phase3-container-documents.mjs`（离仓后目的港清关、DO；PU 使用柜级数字码）、`phase3-carrier-schedule-queries.mjs`、`phase4-carrier-pickup-ready.mjs`、`phase4-overseas-pda.mjs`（同柜候选） | `phase3-phase4-departure-pickup-chain-contract.test.mjs` |
 | 国内出仓聚合、门禁、待装柜与仓库权限 | `phase3-outbound-aggregate.mjs`、`phase3-dispatch-gate.mjs`、`phase3-waiting-for-loading.mjs`、`phase3-warehouse-rbac.mjs` | 由容器回归、生产者链和出仓相关合同覆盖；只消费本轮主链资源 |
@@ -287,6 +287,8 @@ export async function run(context) {
 | 海外排车、出库、派送、异常与回访 HTTP 生命周期 | `phase5-overseas-fulfillment.mjs`（复用本轮海外仓已收货托盘和预排单，正式创建临时 PDA 操作员并在 `finally` 停用；覆盖排车编辑、按 FBA 目的仓转出库/拆分派送单、PDA 全量拣货/发车、逐单签收资料保存自动完成、头程入仓与订单跨区回推、客户回访、人工异常及派送退回） | `phase5-overseas-fulfillment-contract.test.mjs` |
 | 初始化基线（仅离线） | — | `initialization-baseline-contract.test.mjs` |
 
+`phase4-overseas-inbound-operations.mjs` 的内部 `prepareAppointmentFixture` 可由已核对的本轮最小正式 API 流程复用：必须传入真实转换所得的入仓计划和同仓明细，至少两箱才执行拆分合并；两箱验证 `2 → 1 + 1 → 2`，不补造货量。完整 Admin 模块仍按上表四箱参数及统一依赖运行，不能为缩减造数而伪造生产者矩阵或跳过前置事实。
+
 表中的 `*-fixture.mjs` 是被业务模块复用的测试数据前置，不是新增的独立全量入口。执行 HTTP 时仍从 `../admin-test-env-acceptance.mjs` 进入；`*contract.test.mjs` 只做离线脚本结构和数据归属回归。
 
 海外仓业务 HTTP 验收使用 Auth 统一会话，仅通过 `--gateway` 访问 TEST Gateway；拒绝旧 `--overseas-gateway`、`ADMIN_OVERSEAS_GATEWAY` 和非 test 环境参数。平台、客户与 PDA 各用自己的账号访问令牌，权限、客户隔离及仓绑定仍须验证。海外仓、海外业务和海外主数据模块只对带本轮 marker 的资源执行已确认的新增、编辑、状态与导出，并在结束前按契约停用；PDA 收货模块使用本轮临时 OVERSEAS_WAREHOUSE_PDA_OPERATOR 访问令牌，只调用 `/api/pda/v1/last-leg/receiving-containers/**` 柜号收货入口，不接受 `customerId`、`planNo` 或分配 ID。收货成功后由相邻的 `phase4-overseas-pda-operations` 消费仅存在于进程内存、不会进入 JSON 报告的 Token 与库存事实，执行盘点、公共位核对、托盘操作和换标；库内操作只复用收货计划产生的已有空托盘及当前仓 `VIRTUAL + ACTIVE` 公共位，不调用托盘或库位新增接口。新模块无论成功失败都在 finally 停用两个 picker 并清空临时凭据。两模块均不调用出库、退货出库、派送或内部接口；任何真实柜、箱唛、托盘、库存或换标前置缺失都必须形成 deployment blocker，不能按空场景通过；船节点禁止手工创建任务。
diff --git a/scripts/admin-test-env-modules/initialization-baseline-contract.test.mjs b/scripts/admin-test-env-modules/initialization-baseline-contract.test.mjs
index 7719f31ea..d03ec8a05 100644
--- a/scripts/admin-test-env-modules/initialization-baseline-contract.test.mjs
+++ b/scripts/admin-test-env-modules/initialization-baseline-contract.test.mjs
@@ -8,8 +8,16 @@ const domesticSchemas = ['baiyue_auth', 'baiyue_iam', 'baiyue_order', 'baiyue_wa
   'baiyue_firstleg', 'baiyue_file', 'baiyue_audit', 'baiyue_finance']
 const overseasSchemas = ['baiyue_lastleg', 'baiyue_lastlag_warehouse']
 
+test('种子解析覆盖多行多值、函数括号及带逗号和引号的文本', () => {
+  const sql = "INSERT INTO sample (id,label,stamp,note) VALUES\r\n  (1,'甲,乙',CURRENT_TIMESTAMP(3),NULL),\r\n  (2,'客户''名称',CURRENT_TIMESTAMP(3),'已确认');\r\n"
+  assert.deepEqual(seedRows(sql, 'sample'), [
+    { id: '1', label: '甲,乙', stamp: 'CURRENT_TIMESTAMP(3)', note: null },
+    { id: '2', label: "客户'名称", stamp: 'CURRENT_TIMESTAMP(3)', note: '已确认' },
+  ])
+})
+
 test('两个入口分别只操作八个主业务库与两个仓储业务库，包括限定名引用', () => {
-  for (const [sql, allowed, other, count] of [[cn, domesticSchemas, overseasSchemas, 226], [overseas, overseasSchemas, domesticSchemas, 159]]) {
+  for (const [sql, allowed, other, count] of [[cn, domesticSchemas, overseasSchemas, 227], [overseas, overseasSchemas, domesticSchemas, 214]]) {
     assert.deepEqual([...sql.matchAll(/^CREATE DATABASE IF NOT EXISTS (\w+)/gm)].map(m => m[1]), allowed)
     assert.deepEqual([...new Set([...sql.matchAll(/^USE (\w+);/gm)].map(m => m[1]))], allowed)
     const body = sql.replace(/^--.*$/gm, '')
@@ -39,7 +47,10 @@ test('纯初始化禁止迁移、数据回填、清理、重复建表和提前
     assert.doesNotMatch(body.replace(/^CREATE TRIGGER [\s\S]*?\$\$/gm, ''), /^\s*(?:UPDATE|DELETE FROM|REPLACE INTO)\b/gmi)
     assert.doesNotMatch(body, /CREATE TABLE IF NOT EXISTS/i)
     assert.equal((body.match(/AS initialization_status/g) ?? []).length, 1)
-    assert.match(body.trim(), /SELECT 'PASS' AS initialization_status, '(CN|OVERSEAS)' AS region, (226|159) AS initialized_tables;$/)
+    const end = body.trim().match(/SELECT 'PASS' AS initialization_status, '(CN|OVERSEAS)' AS region, (\d+) AS initialized_tables;$/)
+    assert.ok(end, 'only the final statement may announce successful initialization')
+    assert.equal(Number(end[2]), tableDefinitions(sql).size)
+    assert.equal(end[1], sql === cn ? 'CN' : 'OVERSEAS')
   }
 })
 
@@ -100,10 +111,11 @@ test('公司车辆费用隔离于客户账务并约束实际付款金额', () =>
 test('退货出库不可变流水限制重复扣减并保存数量守恒快照', () => {
   const journal = table(overseas, 'baiyue_lastleg', 'll_return_inventory_outbound_movement')
   assert.match(journal, /UNIQUE KEY uk_ll_return_outbound_pick_sku\(outbound_pick_id,sku_code\)/i)
-  assert.match(journal, /UNIQUE KEY uk_ll_return_outbound_carton_sku\(customer_id,carton_id,sku_code\)/i)
+  assert.match(journal, /KEY idx_ll_return_outbound_carton_sku\(customer_id,carton_id,sku_code\)/i)
+  assert.doesNotMatch(journal, /UNIQUE KEY uk_ll_return_outbound_carton_sku/i)
   assert.match(journal, /CHECK\(quantity>0 AND total_after>=0 AND available_after>=0/i)
   assert.match(journal, /total_before-total_after=quantity AND available_before-available_after=quantity/i)
-  assert.match(journal, /cartons_before-cartons_after=1 AND total_after>=available_after/i)
+  assert.match(journal, /cartons_before-cartons_after IN \(0,1\) AND total_after>=available_after/i)
 })
 
 test('平台管理员由外部bcrypt引导，强制首登改密且不创建客户', () => {
@@ -121,13 +133,14 @@ test('平台管理员由外部bcrypt引导，强制首登改密且不创建客
 })
 
 test('必要系统种子完整保留，但不写入示例资源与业务事实', () => {
-  for (const [name, count] of Object.entries({ iam_role: 8, iam_permission: 419, iam_role_permission: 600,
+  for (const [name, count] of Object.entries({ iam_role: 8, iam_permission: 433, iam_role_permission: 614,
     iam_data_scope: 7, wh_warehouse: 318, wh_warehouse_address: 318, wh_service_capability: 4,
     fl_fee_item: 112, fl_price_channel_catalog: 15, fl_price_origin_alias: 7, fl_price_warehouse_mapping: 4,
     file_export_task_guard: 1, fin_subject: 1 })) assert.equal(seedRows(cn, name).length, count, name)
   for (const name of ['wh_pallet', 'wh_location', 'wh_partner', 'wh_partner_type', 'wh_express_company',
     'ord_order', 'fl_inbound_order', 'fin_fee_source']) assert.equal(seedRows(cn, name).length, 0, name)
-  assert.deepEqual([...new Set([...overseas.matchAll(/^INSERT INTO (\w+)/gm)].map(m => m[1]))], [])
+  assert.deepEqual([...new Set([...overseas.matchAll(/^INSERT INTO (\w+)/gm)].map(m => m[1]))], ['ll_appointment_work_guard'])
+  assert.deepEqual(seedRows(overseas, 'll_appointment_work_guard'), [{ id: '1', initialized: 'FALSE' }])
   assert.ok(seedRows(cn, 'wh_warehouse').every(r => r.tenant_id === '0'))
   assert.ok(seedRows(cn, 'wh_service_capability').every(r => r.service_type === 'RECEIVING' || r.capability_code === 'RECEIVING' || Object.values(r).includes('RECEIVING')))
 })
@@ -135,6 +148,10 @@ test('必要系统种子完整保留，但不写入示例资源与业务事实',
 test('国内IAM权限与角色授权没有丢失或悬挂，客户模板仍完整', () => {
   const roles = seedRows(cn, 'iam_role'), permissions = seedRows(cn, 'iam_permission')
   const roleIds = new Set(roles.map(r => r.id)), permissionIds = new Set(permissions.map(r => r.id))
+  assert.equal(permissionIds.size, permissions.length, 'duplicate permission ID')
+  const grants = seedRows(cn, 'iam_role_permission')
+  assert.equal(new Set(grants.map(r => `${r.role_id}:${r.permission_id}:${r.tenant_id}`)).size, grants.length,
+    'duplicate role permission grant')
   assert.equal(new Set(permissions.map(r => r.permission_code)).size, permissions.length)
   for (const row of seedRows(cn, 'iam_role_permission')) {
     assert.ok(roleIds.has(row.role_id), 'missing role ' + row.role_id)
diff --git a/scripts/admin-test-env-modules/phase4-overseas-inbound-operations-contract.test.mjs b/scripts/admin-test-env-modules/phase4-overseas-inbound-operations-contract.test.mjs
index 1d11cd6e0..c84d709e3 100644
--- a/scripts/admin-test-env-modules/phase4-overseas-inbound-operations-contract.test.mjs
+++ b/scripts/admin-test-env-modules/phase4-overseas-inbound-operations-contract.test.mjs
@@ -3,6 +3,7 @@ import fs from 'node:fs'
 import path from 'node:path'
 import test from 'node:test'
 import { fileURLToPath } from 'node:url'
+import { prepareAppointmentFixture } from './phase4-overseas-inbound-operations.mjs'
 
 const here = path.dirname(fileURLToPath(import.meta.url))
 const source = fs.readFileSync(path.join(here, 'phase4-overseas-inbound-operations.mjs'), 'utf8')
@@ -16,7 +17,142 @@ test('module covers the frozen Admin inbound-plan write surface', () => {
   assert.match(source, /'Idempotency-Key'/)
   assert.match(source, /重复转换返回同一入仓计划/)
   assert.match(source, /FBA预约同单号异载荷返回A0409/)
-  assert.match(source, /appointmentStatus: 'CANCELLED'/)
+  assert.match(source, /request\(context, 'DELETE'/)
+  assert.match(source, /cancelReason/)
+  assert.match(source, /cargo-verification/)
+  assert.match(source, /appointments\/repartition/)
+  assert.doesNotMatch(source, /appointmentStatus: 'CANCELLED'/)
+})
+
+// An independent HTTP authority model: records original facts separately from
+// verification and active allocations, and rejects stale commands before mutation.
+function authority({ failSave = false, mutateOrder = false, unknown = 0, drift = false, packages = 4 } = {}) {
+  const state = { calls: [], appointments: [], verification: null, order: { order: {
+    id: 'order1', customerId: 'customer1', packageCount: packages, receivedPackageCount: 0, version: 7,
+    sourceInboundId: 'inbound1' }, cargo: [{ packageCount: packages }] }, history: new Map() }
+  const commands = new Map()
+  const clone = value => structuredClone(value)
+  const response = (data, code = '200') => ({ http: code === '200' ? 200 : code === 'A0409' ? 409 : code === 'A0400' ? 400 : 503,
+    body: { code, data: clone(data) } })
+  const sourceFacts = { sourceKey: 'ORDER:order1', customerId: 'customer1', destinationKey: 'FBA:TEST1',
+    originWarehouseId: 'warehouse1', canFollowup: true, sourceVersion: 'source-v1', packages }
+  const fresh = allocations => {
+    const id = String(state.appointments.length + 1)
+    const value = { id, batchKey: `FBA_APPOINTMENT:${id}`, appointmentNo: `APPT-${id}`, version: 0,
+      appointmentStatus: 'PENDING', replacementBatchKeys: [], items: allocations.map(a => ({
+        customerId: a.customerId, sourceKey: a.sourceKey, destinationKey: sourceFacts.destinationKey,
+        packageCount: a.packageCount, sourceVersion: sourceFacts.sourceVersion,
+        cargoVerificationVersion: state.verification.version })) }
+    state.appointments.push(value)
+    return value
+  }
+  const context = { marker: 'offline-new-four-box',
+    assert(_module, name, _response, condition, evidence) { assert.ok(condition, `${name}: ${evidence}`) },
+    addStep() {},
+    async request(method, path, body) {
+      state.calls.push({ method, path, body: clone(body) })
+      const pathname = decodeURIComponent(path.split('?')[0])
+      const commandKey = body?.idempotencyKey && `${pathname}/${body.idempotencyKey}`
+      const fingerprint = JSON.stringify(body)
+      if (commandKey && commands.has(commandKey)) {
+        const old = commands.get(commandKey)
+        return old.fingerprint === fingerprint ? clone(old.response) : response(null, 'A0409')
+      }
+      const commit = data => {
+        const result = response(data)
+        if (commandKey) commands.set(commandKey, { fingerprint, response: clone(result) })
+        return result
+      }
+      if (pathname.endsWith('/orders/order1')) return response(state.order)
+      if (pathname.endsWith('/cargo-verification')) {
+        if (method === 'GET') {
+          const allocated = state.appointments.filter(a => a.appointmentStatus === 'PENDING' && !a.replacementBatchKeys.length)
+            .flatMap(a => a.items).reduce((n, i) => n + i.packageCount, 0)
+          return response({ source: sourceFacts, verification: state.verification, allocatedPackages: String(allocated),
+            availablePackages: String((state.verification?.packageCount ?? packages) - allocated), unknownAllocationCount: String(unknown), sourceChanged: drift })
+        }
+        if (body.expectedSourceVersion !== sourceFacts.sourceVersion || body.expectedVersion !== (state.verification?.version ?? 0)) return response(null, 'A0409')
+        if (failSave) return response(null, 'S0503')
+        state.verification = { version: body.expectedVersion + 1, sourceVersion: sourceFacts.sourceVersion, packageCount: body.packageCount }
+        if (mutateOrder) state.order.order.packageCount = body.packageCount
+        return commit(state.verification)
+      }
+      if (pathname.endsWith('/fba-appointments/batch')) {
+        const created = fresh([{ customerId: 'customer1', sourceKey: sourceFacts.sourceKey, packageCount: state.verification.packageCount }])
+        Object.assign(created, body.details)
+        return commit(created)
+      }
+      if (pathname.includes('/batches/')) return response({ appointment: state.appointments.find(a => a.batchKey === pathname.split('/').at(-1)) })
+      if (pathname.endsWith('/appointments/repartition')) {
+        const originals = body.originals.map(o => state.appointments.find(a => a.appointmentNo === o.appointmentNo))
+        if (originals.some((a, i) => !a || a.version !== body.originals[i].version || a.replacementBatchKeys.length)) return response(null, 'A0409')
+        const total = items => items.reduce((n, i) => n + i.packageCount, 0)
+        if (total(originals.flatMap(a => a.items)) !== total(body.batches.flatMap(b => b.allocations))) return response(null, 'A0400')
+        const appointments = body.batches.map(b => fresh(b.allocations))
+        for (const a of originals) { a.version++; a.replacementBatchKeys = appointments.map(a => a.batchKey) }
+        return commit({ appointments, replacedBatchKeys: originals.map(a => a.batchKey) })
+      }
+      const match = /\/fba-appointments\/(APPT-\d+)(\/cancellations)?$/.exec(pathname)
+      assert.ok(match, `Unexpected request ${method} ${path}`)
+      const appointment = state.appointments.find(a => a.appointmentNo === match[1])
+      if (match[2]) return response({ total: String((state.history.get(match[1]) || []).length), records: state.history.get(match[1]) || [] })
+      if (method === 'GET') return response(appointment)
+      if (method === 'PUT') {
+        if (body.version !== appointment.version) return response(null, 'A0409')
+        appointment.version++; Object.assign(appointment, body.details)
+        return commit(appointment)
+      }
+      assert.equal(method, 'DELETE')
+      const old = state.history.get(match[1])
+      if (old) return old[0].version === body.version + 1 && old[0].cancelReason === body.cancelReason ? response(null) : response(null, 'A0409')
+      if (body.version !== appointment.version) return response(null, 'A0409')
+      appointment.version++; appointment.appointmentStatus = 'CANCELLED'
+      state.history.set(match[1], [{ version: appointment.version, cancelReason: body.cancelReason, snapshot: clone(appointment) }])
+      return response(null)
+    } }
+  return { context, state }
+}
+
+const fixture = { customerId: 'customer1', plan: { planNo: 'PLAN-1', overseasWarehouseId: 'warehouse1' },
+  fbaLines: [{ id: 'line1', orderId: 'order1', fbaWarehouseCode: 'TEST1', destinationWarehouseId: 'destination1' }] }
+
+test('four real boxes retain original order facts through verification, cancel, split and merge', async () => {
+  const { context, state } = authority()
+  const result = await prepareAppointmentFixture(context, fixture)
+  assert.equal(result.terminalStatus, 'PENDING')
+  assert.equal(state.order.order.packageCount, 4)
+  assert.equal(state.order.order.version, 7)
+  assert.deepEqual(state.verification, { version: 2, sourceVersion: 'source-v1', packageCount: 4 })
+  assert.equal(state.appointments.length, 5)
+  assert.equal(state.history.size, 1)
+  assert.equal(state.history.get(result.cancelledAppointmentNo).length, 1)
+  assert.equal(result.replacedBatchKeys.length, 3)
+  assert.equal(result.splitBatchKeys.length, 2)
+  const active = state.appointments.filter(a => a.appointmentStatus === 'PENDING' && !a.replacementBatchKeys.length)
+  assert.equal(active.length, 1)
+  assert.equal(active[0].batchKey, result.batchKey)
+  assert.equal(active[0].items.reduce((n, i) => n + i.packageCount, 0), 4)
+})
+
+for (const [name, mode, expected] of [
+  ['unknown write outcome', { failSave: true }, /stop, retain/],
+  ['original order changed by verification', { mutateOrder: true }, /不覆盖原订单/],
+  ['unknown source allocations', { unknown: 1 }, /核实数量和版本/],
+  ['source drift', { drift: true }, /核实数量和版本/],
+]) test(`${name} stops before creating any appointment`, async () => {
+  const { context, state } = authority(mode)
+  await assert.rejects(() => prepareAppointmentFixture(context, fixture), expected)
+  assert.equal(state.appointments.length, 0)
+  assert.equal(state.calls.some(c => c.path.endsWith('/fba-appointments/batch')), false)
+})
+
+test('minimal two-box sample splits into one box each and merges without inflating source quantity', async () => {
+  const { context, state } = authority({ packages: 2 })
+  const result = await prepareAppointmentFixture(context, fixture)
+  const split = state.appointments.filter(a => result.splitBatchKeys.includes(a.batchKey))
+  assert.deepEqual(split.map(a => a.items.reduce((n, i) => n + i.packageCount, 0)), [1, 1])
+  assert.equal(state.appointments.find(a => a.batchKey === result.batchKey).items[0].packageCount, 2)
+  assert.equal(state.order.order.packageCount, 2)
 })
 
 test('module covers reversible inventory commands with idempotency and ledger proof', () => {
diff --git a/scripts/admin-test-env-modules/phase4-overseas-inbound-operations.mjs b/scripts/admin-test-env-modules/phase4-overseas-inbound-operations.mjs
index 76fb84043..88540b3c0 100644
--- a/scripts/admin-test-env-modules/phase4-overseas-inbound-operations.mjs
+++ b/scripts/admin-test-env-modules/phase4-overseas-inbound-operations.mjs
@@ -2,11 +2,16 @@ const MODULE = 'phase4-overseas-inbound-operations'
 const OPTIONS = { scenario: 'phase4-inbound-admin-and-inventory-commands', deploymentBlocker: true }
 const PLAN_BASE = '/api/platform/v1/last-leg/inbound-plans'
 const INVENTORY_BASE = '/api/platform/v1/last-leg/inventory'
+const APPOINTMENT_BASE = '/api/platform/v1/last-leg/appointment-planning'
 
 function id(value) { return value == null ? '' : String(value) }
+function count(value) {
+  const parsed = value == null || value === '' ? NaN : Number(value)
+  return Number.isSafeInteger(parsed) && parsed >= 0 ? parsed : NaN
+}
 function ok(response) { return response?.http === 200 && String(response?.body?.code) === '200' }
 function rows(data) { return Array.isArray(data?.records) ? data.records : Array.isArray(data) ? data : [] }
-function conflict(response) { return response?.http === 200 && ['A0409', '409'].includes(String(response?.body?.code)) }
+function conflict(response) { return [200, 409].includes(response?.http) && String(response?.body?.code) === 'A0409' && response.body?.data == null }
 function trace(response) { return `HTTP=${response?.http ?? 'missing'}, code=${response?.body?.code ?? 'missing'}, requestId=${response?.requestId || 'missing'}, traceId=${response?.traceId || 'missing'}` }
 function query(path, values) {
   const params = new URLSearchParams()
@@ -18,7 +23,154 @@ function key(context, operation) { return `${context.marker}:P4-INBOUND:${operat
 async function request(context, method, name, path, body, headers = {}) {
   const response = await context.request(method, path, body, undefined, headers)
   context.addStep(MODULE, name, response, ok(response), trace(response), OPTIONS)
-  return ok(response) ? response.body?.data : null
+  if (!ok(response)) throw Error(`${name}: ${trace(response)}; stop, retain original request and sample`)
+  return response.body?.data
+}
+
+function requireProof(context, name, condition, evidence) {
+  context.assert(MODULE, name, null, condition, evidence, OPTIONS)
+  if (!condition) throw Error(`${name}: ${evidence}`)
+}
+
+/** Current-run original-domain producer: verifies actual sources, proves cancellation, retains a fresh active batch. */
+export async function prepareAppointmentFixture(context, { customerId, plan, fbaLines }) {
+  const sample = fbaLines[0]
+  requireProof(context, '本轮预约只选择同接仓点同目的仓真实来源', Boolean(customerId && plan?.planNo && plan?.overseasWarehouseId && sample?.fbaWarehouseCode)
+    && fbaLines.length > 0 && fbaLines.length <= 100 && fbaLines.every(l => l.orderId && l.id && l.fbaWarehouseCode === sample.fbaWarehouseCode
+      && id(l.destinationWarehouseId) === id(sample.destinationWarehouseId)), `planNo=${plan?.planNo || 'missing'}`)
+  const suffix = String(context.marker).replace(/[^A-Za-z0-9]/g, '').slice(-18).toUpperCase()
+  const verified = []
+  for (const orderId of [...new Set(fbaLines.map(l => id(l.orderId)))]) {
+    const sourceKey = `ORDER:${orderId}`, destinationKey = `FBA:${sample.fbaWarehouseCode}`
+    const sourcePath = `${APPOINTMENT_BASE}/sources/${encodeURIComponent(sourceKey)}/cargo-verification`
+    const orderPath = query(`/api/platform/v1/last-leg/orders/${encodeURIComponent(orderId)}`, { customerId })
+    const orderBefore = await request(context, 'GET', '核实前读取原订单货量', orderPath)
+    const orderFacts = value => ({ id: id(value?.order?.id), customerId: id(value?.order?.customerId), packageCount: value?.order?.packageCount,
+      receivedPackageCount: value?.order?.receivedPackageCount, sourceInboundId: value?.order?.sourceInboundId, version: value?.order?.version, cargo: value?.cargo })
+    requireProof(context, '核实前原订单身份和箱数真实可读', id(orderBefore?.order?.id) === orderId && id(orderBefore.order.customerId) === customerId
+      && Number.isSafeInteger(orderBefore.order.packageCount) && orderBefore.order.packageCount > 0, sourceKey)
+    const before = await request(context, 'GET', '读取本轮逐票核实上下文', query(sourcePath, { customerId, destinationKey }))
+    requireProof(context, '核实数量和版本必须来自当前货源', before?.source?.sourceKey === sourceKey && id(before.source.customerId) === customerId
+      && before.source.destinationKey === destinationKey && id(before.source.originWarehouseId) === id(plan.overseasWarehouseId)
+      && before.source.canFollowup === true && typeof before.source.sourceVersion === 'string' && before.source.sourceVersion.length > 0
+      && Number.isSafeInteger(before.source.packages) && before.source.packages > 0 && count(before.allocatedPackages) === 0 && count(before.unknownAllocationCount) === 0
+      && before.sourceChanged === false,
+      `sourceKey=${sourceKey}, allocated=${before?.allocatedPackages ?? 'missing'}`)
+    const body = { destinationKey, expectedSourceVersion: before.source.sourceVersion, expectedVersion: before.verification?.version ?? 0,
+      packageCount: before.source.packages > 1 ? before.source.packages - 1 : before.source.packages, shipmentReferences: before.verification?.shipmentReferences ?? [],
+      remark: `${context.marker} PENDING预约仅核实真实箱数`, idempotencyKey: `verify-${suffix}-${verified.length}` }
+    const stale = await context.request('POST', query(sourcePath, { customerId }), { ...body,
+      expectedSourceVersion: `stale-${before.source.sourceVersion}`.slice(0, 160), idempotencyKey: `${body.idempotencyKey}-stale` })
+    context.addStep(MODULE, '陈旧货源版本拒绝保存核实资料', stale, conflict(stale), trace(stale), OPTIONS)
+    requireProof(context, '陈旧货源拒绝必须明确返回冲突', conflict(stale), trace(stale))
+    const unchanged = await request(context, 'GET', '拒绝后回查核实记录未变', query(sourcePath, { customerId, destinationKey }))
+    requireProof(context, '陈旧货源写入未生成核实记录', JSON.stringify(unchanged.verification) === JSON.stringify(before.verification)
+      && unchanged.allocatedPackages === before.allocatedPackages, sourceKey)
+    let saved = await request(context, 'POST', '保存独立预约核实箱数和当前来源版本', query(sourcePath, { customerId }), body)
+    const replay = await request(context, 'POST', '逐票核实原键原载荷重放', query(sourcePath, { customerId }), body)
+    requireProof(context, '核实重放版本和事实零重复', JSON.stringify(saved) === JSON.stringify(replay)
+      && saved.version === body.expectedVersion + 1 && saved.sourceVersion === body.expectedSourceVersion && saved.packageCount === body.packageCount, sourceKey)
+    const orderAfter = await request(context, 'GET', '核实箱数减少后原订单仍保持原事实', orderPath)
+    requireProof(context, '预约核实不覆盖原订单箱数版本及货物明细', JSON.stringify(orderFacts(orderAfter)) === JSON.stringify(orderFacts(orderBefore)), sourceKey)
+    if (body.packageCount !== before.source.packages) saved = await request(context, 'POST', '将预约核实恢复为本轮完整货量', query(sourcePath, { customerId }), {
+      ...body, expectedVersion: saved.version, packageCount: before.source.packages, idempotencyKey: `${body.idempotencyKey}-full` })
+    const current = await request(context, 'GET', '回查当前核实及可分配箱数', query(sourcePath, { customerId, destinationKey }))
+    requireProof(context, '核实来源未漂移且箱数完整可分配', current.sourceChanged === false && current.verification?.version === saved.version
+      && count(current.availablePackages) === before.source.packages && count(current.allocatedPackages) === 0, sourceKey)
+    verified.push({ customerId, sourceKey, destinationKey, packageCount: before.source.packages, sourceVersion: saved.sourceVersion, cargoVerificationVersion: saved.version })
+  }
+  const createBody = { originWarehouseId: id(plan.overseasWarehouseId), fbaWarehouseCode: sample.fbaWarehouseCode,
+    lineIds: fbaLines.map(l => id(l.id)), idempotencyKey: `fba-${suffix}`,
+    details: { plannedDate: new Date(Date.now() + 86400000).toISOString().slice(0, 10), appointmentStatus: 'PENDING', appointmentRemark: context.marker } }
+  const appointment = await request(context, 'POST', '批量创建FBA预约', `${PLAN_BASE}/fba-appointments/batch`, createBody)
+  const appointmentNo = appointment?.appointmentNo
+  requireProof(context, '原预约必须返回不可变批次及业务号', Boolean(appointmentNo && appointment.id && appointment.batchKey === `FBA_APPOINTMENT:${appointment.id}`), 'stable batch identity')
+  const replay = await request(context, 'POST', 'FBA预约同单号同载荷重放', `${PLAN_BASE}/fba-appointments/batch`, createBody)
+  requireProof(context, 'FBA创建重放保留不可变批次和全部逐票分配', JSON.stringify(replay) === JSON.stringify(appointment), appointmentNo)
+  const changed = await context.request('POST', `${PLAN_BASE}/fba-appointments/batch`, { ...createBody, details: { ...createBody.details, appointmentRemark: `${context.marker}-different` } })
+  context.addStep(MODULE, 'FBA预约同单号异载荷返回A0409', changed, conflict(changed), trace(changed), OPTIONS)
+  requireProof(context, 'FBA异载荷必须明确拒绝', conflict(changed), trace(changed))
+  const detailPath = `${PLAN_BASE}/fba-appointments/${encodeURIComponent(appointmentNo)}`
+  const detail = await request(context, 'GET', '查询FBA预约详情', detailPath)
+  const exactItems = value => (value?.items || []).map(i => JSON.stringify({ customerId: id(i.customerId), sourceKey: i.sourceKey,
+    destinationKey: i.destinationKey, packageCount: i.packageCount, sourceVersion: i.sourceVersion, cargoVerificationVersion: i.cargoVerificationVersion })).sort()
+  requireProof(context, 'FBA预约逐票归属数量及核实版本冻结', detail.batchKey === appointment.batchKey && detail.appointmentStatus === 'PENDING'
+    && JSON.stringify(exactItems(detail)) === JSON.stringify(verified.map(v => JSON.stringify(v)).sort()), appointmentNo)
+  const batch = await request(context, 'GET', '按不可变批次查询原预约上下文', `${APPOINTMENT_BASE}/batches/${encodeURIComponent(detail.batchKey)}`)
+  requireProof(context, '稳定批次上下文返回同一原预约', batch?.appointment?.batchKey === detail.batchKey && batch.appointment.appointmentNo === appointmentNo
+    && JSON.stringify(exactItems(batch.appointment)) === JSON.stringify(exactItems(detail)), detail.batchKey)
+  const cancelBody = { version: detail.version, cancelReason: `${context.marker}-cancelled` }
+  await request(context, 'DELETE', '按正式取消操作取消本轮预约', detailPath, cancelBody)
+  await request(context, 'DELETE', '原取消版本和原因重放', detailPath, cancelBody)
+  const cancelled = await request(context, 'GET', '回查已取消预约的原批次与历史事实', detailPath)
+  requireProof(context, '取消保留原批次且仅推进一次版本', cancelled.appointmentStatus === 'CANCELLED' && cancelled.batchKey === detail.batchKey
+    && cancelled.version === detail.version + 1 && JSON.stringify(exactItems(cancelled)) === JSON.stringify(exactItems(detail)), appointmentNo)
+  const history = await request(context, 'GET', '核对唯一取消历史和保留的原计划', `${detailPath}/cancellations?page=1&size=20`)
+  requireProof(context, '取消重放不重复历史且保留原计划日期', count(history?.total) === 1 && history.records?.length === 1
+    && history.records[0].cancelReason === cancelBody.cancelReason && history.records[0].version === cancelled.version
+    && history.records[0].snapshot?.appointmentStatus === 'CANCELLED'
+    && history.records[0].snapshot?.plannedDate === detail.plannedDate, appointmentNo)
+  for (const v of verified) {
+    const restored = await request(context, 'GET', '取消后逐票可分配量恢复', query(`${APPOINTMENT_BASE}/sources/${encodeURIComponent(v.sourceKey)}/cargo-verification`, { customerId, destinationKey: v.destinationKey }))
+    requireProof(context, '取消未删除核实事实且恢复剩余需求', count(restored.allocatedPackages) === 0 && count(restored.availablePackages) === v.packageCount
+      && restored.verification?.version === v.cargoVerificationVersion && restored.sourceChanged === false, v.sourceKey)
+  }
+  const active = await request(context, 'POST', '为本轮后续验收重新建立有效批次', `${PLAN_BASE}/fba-appointments/batch`, { ...createBody, idempotencyKey: `${createBody.idempotencyKey}-active` })
+  requireProof(context, '重新安排生成新批次且逐票数量不变', active.batchKey === `FBA_APPOINTMENT:${active.id}` && active.batchKey !== cancelled.batchKey
+    && active.appointmentNo !== appointmentNo && active.appointmentStatus === 'PENDING' && JSON.stringify(exactItems(active)) === JSON.stringify(exactItems(detail)), active?.appointmentNo || 'missing')
+  const activeContext = await request(context, 'GET', '回查保留的有效批次', `${APPOINTMENT_BASE}/batches/${encodeURIComponent(active.batchKey)}`)
+  requireProof(context, '保留批次上下文完整可供后续HTTP核对', activeContext?.appointment?.batchKey === active.batchKey
+    && activeContext.appointment.appointmentStatus === 'PENDING', active.batchKey)
+  const repartitioned = await verifyRepartition(context, active, verified, suffix, createBody.details.plannedDate)
+  return { appointmentNo: repartitioned.active.appointmentNo, batchKey: repartitioned.active.batchKey, terminalStatus: repartitioned.active.appointmentStatus,
+    cancelledAppointmentNo: appointmentNo, cancelledBatchKey: cancelled.batchKey, cancelledVersion: cancelled.version,
+    replacedBatchKeys: repartitioned.replacedBatchKeys, splitBatchKeys: repartitioned.splitBatchKeys,
+    verifiedSources: verified, plannedDate: createBody.details.plannedDate, timezone: repartitioned.active.timezone }
+}
+
+async function verifyRepartition(context, initial, verified, suffix, plannedDate) {
+  const total = verified.reduce((n,v)=>n+v.packageCount,0)
+  requireProof(context, '分批合并使用本轮至少两箱真实来源', total >= 2, `packages=${total}; use at least two actual packages`)
+  const detailPath = no => `${PLAN_BASE}/fba-appointments/${encodeURIComponent(no)}`
+  const active = await request(context,'PUT','推进原预约版本以验证陈旧版本拒绝',detailPath(initial.appointmentNo),{
+    version:initial.version,idempotencyKey:`version-${suffix}`,details:{plannedDate,appointmentStatus:'PENDING',appointmentRemark:`${context.marker}-version-proof`} })
+  const allocation = (v,count=v.packageCount) => ({customerId:v.customerId,sourceKey:v.sourceKey,packageCount:count,
+    expectedSourceVersion:v.sourceVersion,expectedVerificationVersion:v.cargoVerificationVersion})
+  let left=Math.floor(total/2);const first=[],second=[]
+  for(const v of verified){const count=Math.min(v.packageCount,left);if(count)first.push(allocation(v,count));if(count<v.packageCount)second.push(allocation(v,v.packageCount-count));left-=count}
+  const body={originals:[{appointmentNo:active.appointmentNo,version:active.version}],batches:[first,second].map(allocations=>({plannedDate,remark:context.marker,allocations})),reason:`${context.marker}-split`,idempotencyKey:`split-${suffix}`}
+  const endpoint=`${APPOINTMENT_BASE}/appointments/repartition`
+  for(const [name,negative,expected]of [
+    ['旧预约版本分批拒绝',{...body,originals:[{appointmentNo:active.appointmentNo,version:initial.version}],idempotencyKey:`split-stale-${suffix}`},'A0409'],
+    ['分批逐票总量不守恒拒绝',{...body,batches:[{...body.batches[0],allocations:body.batches[0].allocations.map((a,i)=>i? a:{...a,packageCount:a.packageCount+1})},body.batches[1]],idempotencyKey:`split-count-${suffix}`},'A0400']]){
+    const denied=await context.request('POST',endpoint,negative)
+    const rejected=[200,expected==='A0409'?409:400].includes(denied?.http)&&denied?.body?.code===expected&&denied.body.data==null
+    context.addStep(MODULE,name,denied,rejected,trace(denied),OPTIONS);requireProof(context,name,rejected,trace(denied))
+    const unchanged=await request(context,'GET','拒绝分批后原批次保持不变',detailPath(active.appointmentNo))
+    requireProof(context,'拒绝未改写原批次版本分配或替代链',JSON.stringify(unchanged)===JSON.stringify(active),active.appointmentNo)
+  }
+  const sumSources = batches => {
+    const result=new Map()
+    for(const b of batches)for(const i of b.items){const k=`${i.customerId}/${i.sourceKey}/${i.destinationKey}`;result.set(k,(result.get(k)||0)+i.packageCount)}
+    return JSON.stringify([...result].sort((a,b)=>a[0].localeCompare(b[0])))
+  }
+  const split=await request(context,'POST','原批次按真实货量分成两批',endpoint,body)
+  const splitReplay=await request(context,'POST','分批原键原载荷重放',endpoint,body)
+  requireProof(context,'分批重放只返回原两批且逐票总量守恒',JSON.stringify(split)===JSON.stringify(splitReplay)&&split.appointments?.length===2
+    &&new Set(split.appointments.map(a=>a.batchKey)).size===2&&split.appointments.every(a=>a.batchKey===`FBA_APPOINTMENT:${a.id}`&&a.batchKey!==active.batchKey)
+    &&sumSources(split.appointments)===sumSources([active]),active.batchKey)
+  const old=await request(context,'GET','旧批次保存明确分批替代链',detailPath(active.appointmentNo))
+  requireProof(context,'旧批次不可变键保留并指向真实新批次',old.batchKey===active.batchKey&&JSON.stringify([...old.replacementBatchKeys].sort())===JSON.stringify(split.appointments.map(a=>a.batchKey).sort()),active.batchKey)
+  const changed=await context.request('POST',endpoint,{...body,reason:`${body.reason}-different`})
+  requireProof(context,'分批原键异载荷拒绝',conflict(changed),trace(changed))
+  const mergeBody={originals:split.appointments.map(a=>({appointmentNo:a.appointmentNo,version:a.version})),batches:[{plannedDate,remark:context.marker,allocations:verified.map(v=>allocation(v))}],reason:`${context.marker}-merge`,idempotencyKey:`merge-${suffix}`}
+  const merged=await request(context,'POST','两批按原来源数量合并',endpoint,mergeBody)
+  const mergeReplay=await request(context,'POST','合并原键原载荷重放',endpoint,mergeBody)
+  requireProof(context,'合并新键唯一且逐票总量不变',JSON.stringify(merged)===JSON.stringify(mergeReplay)&&merged.appointments?.length===1
+    &&merged.appointments[0].batchKey===`FBA_APPOINTMENT:${merged.appointments[0].id}`&&!split.appointments.some(a=>a.batchKey===merged.appointments[0].batchKey)
+    &&sumSources(merged.appointments)===sumSources([active]),active.appointmentNo)
+  for(const child of split.appointments){const replaced=await request(context,'GET','分批历史指向合并后的稳定批次',detailPath(child.appointmentNo));requireProof(context,'合并保留旧批次及唯一替代指向',replaced.batchKey===child.batchKey&&JSON.stringify(replaced.replacementBatchKeys)===JSON.stringify([merged.appointments[0].batchKey]),child.appointmentNo)}
+  return {active:merged.appointments[0],replacedBatchKeys:[active.batchKey,...split.appointments.map(a=>a.batchKey)],splitBatchKeys:split.appointments.map(a=>a.batchKey)}
 }
 
 async function inboundAdminLifecycle(context) {
@@ -68,8 +220,10 @@ async function inboundAdminLifecycle(context) {
     Boolean(plan?.planNo) && replay?.planNo === plan.planNo,
     `first=${plan?.planNo || 'missing'}, replay=${replay?.planNo || 'missing'}`, OPTIONS)
   const planNo = plan?.planNo
-  const fbaLines = (plan?.lines || []).filter((line) => line?.fbaWarehouseCode
+  const eligibleLines = (plan?.lines || []).filter((line) => line?.fbaWarehouseCode
     && line?.destinationWarehouseId)
+  const fbaLines = eligibleLines.filter(line => line.fbaWarehouseCode === eligibleLines[0]?.fbaWarehouseCode
+    && id(line.destinationWarehouseId) === id(eligibleLines[0]?.destinationWarehouseId))
   context.assert(MODULE, 'FBA入仓计划包含可预约明细', null,
     Boolean(planNo) && fbaLines.length > 0,
     `planNo=${planNo || 'missing'}, fbaLines=${fbaLines.length}`, OPTIONS)
@@ -88,44 +242,10 @@ async function inboundAdminLifecycle(context) {
       && id(supplement?.destinationWarehouseId) === id(sample.destinationWarehouseId),
     `palletId=${id(supplement?.id) || 'missing'}, status=${supplement?.assignmentStatus || 'missing'}`, OPTIONS)
 
-  const suffix = String(context.marker).replace(/[^A-Za-z0-9]/g, '').slice(-18).toUpperCase()
-  const now = Date.now()
-  const appointmentBody = {
-    originWarehouseId: id(plan.overseasWarehouseId), fbaWarehouseCode: sample.fbaWarehouseCode,
-    lineIds: fbaLines.map((line) => id(line.id)), idempotencyKey: `fba-${suffix}`,
-    details: { plannedDate: new Date(now + 24 * 60 * 60_000).toISOString().slice(0, 10),
-      appointmentStatus: 'PENDING', appointmentRemark: context.marker },
-  }
-  const appointment = await request(context, 'POST', '批量创建FBA预约', `${PLAN_BASE}/fba-appointments/batch`, appointmentBody)
-  const appointmentNo = appointment.appointmentNo
-  const expectedSources = new Set(fbaLines.map(line => id(line.orderId))).size
-  const appointmentReplay = await request(context, 'POST', 'FBA预约同单号同载荷重放', `${PLAN_BASE}/fba-appointments/batch`, appointmentBody)
-  context.assert(MODULE, 'FBA预约重放返回同一聚合且明细一致', null,
-    id(appointmentReplay?.id) === id(appointment?.id)
-      && appointmentReplay?.items?.length === expectedSources,
-    `appointmentId=${id(appointment?.id) || 'missing'}, items=${appointmentReplay?.items?.length ?? 'missing'}`, OPTIONS)
-  const appointmentConflict = await context.request('POST', `${PLAN_BASE}/fba-appointments/batch`, {
-    ...appointmentBody, details: { ...appointmentBody.details, appointmentRemark: `${context.marker}-different` },
-  })
-  context.addStep(MODULE, 'FBA预约同单号异载荷返回A0409', appointmentConflict,
-    conflict(appointmentConflict), trace(appointmentConflict), OPTIONS)
-  const detail = await request(context, 'GET', '查询FBA预约详情',
-    `${PLAN_BASE}/fba-appointments/${encodeURIComponent(appointmentNo)}`)
-  context.assert(MODULE, 'FBA预约详情冻结仓码和所选明细', null,
-    detail?.appointmentNo === appointmentNo && detail?.fbaWarehouseCode === sample.fbaWarehouseCode
-      && detail?.items?.length === expectedSources,
-    `appointmentNo=${detail?.appointmentNo || 'missing'}, warehouse=${detail?.fbaWarehouseCode || 'missing'}`, OPTIONS)
-  const cancelled = await request(context, 'PUT', '取消本轮FBA预约收口',
-    `${PLAN_BASE}/fba-appointments/${encodeURIComponent(appointmentNo)}`, {
-      idempotencyKey: `fba-cancel-${suffix}`, version: detail.version,
-      details: { appointmentStatus: 'CANCELLED', appointmentRemark: `${context.marker}-cancelled` },
-    })
-  context.assert(MODULE, 'FBA预约最终为CANCELLED', null,
-    cancelled?.appointmentStatus === 'CANCELLED', `status=${cancelled?.appointmentStatus || 'missing'}`, OPTIONS)
+  const appointmentProof = await prepareAppointmentFixture(context, { customerId, plan, fbaLines })
   context.createdResources.phase4OverseasInboundAdmin = {
     marker: context.marker, customerId, orderId: id(order.id), planNo,
-    supplementedPalletId: id(supplement?.id) || null, appointmentNo,
-    terminalStatus: cancelled?.appointmentStatus || null,
+    supplementedPalletId: id(supplement?.id) || null, ...appointmentProof,
   }
 }
 
diff --git a/scripts/agents-index-contract.ps1 b/scripts/agents-index-contract.ps1
index a7d7cf26a..eb901dbe1 100644
--- a/scripts/agents-index-contract.ps1
+++ b/scripts/agents-index-contract.ps1
@@ -201,7 +201,8 @@ Assert-Contains $docsIndex '[测试环境独立任务协作登记](独立任务
 Assert-Contains $docsIndex '[开发环境独立任务协作登记](开发环境独立任务协作登记.md)' '文档开发登记入口'
 # BEGIN CURRENT TEST REGISTRY CONTRACT
 function Assert-TestTaskRegistry([string]$registry) {
-    $current = ($registry -split '(?m)^## 2026-10-04 全流程唯一持续目标与车辆交接（当前）')[0]
+    # Count this authorized group only; newer independently authorized groups must not be mixed into it.
+    $current = [regex]::Match($registry, '(?ms)^## 2026-10-04 用户确认的三个独立执行对话（当前派工）\r?\n.*?(?=^## |\z)').Value
     Assert-Contains $current '## 2026-10-04 用户确认的三个独立执行对话（当前派工）' '当前全流程协作入口'
     Assert-Contains $current '用户明确选择“按这 3 个独立对话创建”' '测试任务精确数量授权'
     Assert-Contains $current '所属唯一总控仍为 `退税报关` / `01a0d0da-130f-7d43-97b5-9c76abc1b5f1`' '测试所属总控'
@@ -520,7 +521,9 @@ Assert-Contains $firstlegAgents '按卸柜完成时间加 72 小时' 'Firstleg 
 Assert-Contains $terminalDrayageOpenApi '/api/platform/v1/terminal-drayages/{containerBookingId}/fleet:' '码头拖车车队命令 OpenAPI'
 Assert-Contains $terminalDrayageOpenApi '/api/platform/v1/terminal-drayages/{containerBookingId}/empty-return:' '码头拖车还柜命令 OpenAPI'
 Assert-Contains $terminalDrayageService 'EMPTY_RETURN_WARNING_HOURS = 72' '码头拖车 72 小时预警实现'
-Assert-Contains $terminalDrayageService 'context.base().unloadingCompletedAt().plusHours(EMPTY_RETURN_WARNING_HOURS)' '码头拖车权威截止时间实现'
+Assert-Contains $terminalDrayageService 'value.setEstimatedEmptyReturnAt(returnDeadline(context))' '码头拖车权威截止时间实现'
+Assert-Contains $terminalDrayageService 'context.directCompletion().instant().plus(Duration.ofHours(EMPTY_RETURN_WARNING_HOURS))' '直送目的仓按绝对时长计算还空预警'
+Assert-Contains $terminalDrayageService 'completedUnloading(context).plusHours(EMPTY_RETURN_WARNING_HOURS)' '原海外仓卸柜截止时间实现'
 Assert-Contains $adminTerminalDrayages 'allowedActions' 'Admin 码头拖车服务端动作消费'
 Assert-Contains $lastlegOrderCommandService '必须提交完整8行人工时间快照' '尾程人工节点完整快照实现'
 Assert-Contains $lastlegOrderCommandService '尾程订单已进入出库流程，不能新增暂扣' '尾程暂扣出库门禁实现'
diff --git a/scripts/agents-index-registry-contract.test.mjs b/scripts/agents-index-registry-contract.test.mjs
index 3e009b82f..4bc9b35a5 100644
--- a/scripts/agents-index-registry-contract.test.mjs
+++ b/scripts/agents-index-registry-contract.test.mjs
@@ -5,6 +5,8 @@ import test from 'node:test'
 
 const source = readFileSync(new URL('./agents-index-contract.ps1', import.meta.url), 'utf8').replaceAll('\r\n', '\n')
 const registry = readFileSync(new URL('../../docs/独立任务协作登记.md', import.meta.url), 'utf8')
+const currentGroup = registry.match(/^## 2026-10-04 用户确认的三个独立执行对话（当前派工）\r?\n[\s\S]*?(?=^## |$(?![\s\S]))/m)?.[0]
+assert.ok(currentGroup, 'mutations must target their own authorized group')
 const contract = source.split('# BEGIN CURRENT TEST REGISTRY CONTRACT\n')[1]?.split('# END CURRENT TEST REGISTRY CONTRACT')[0]
 assert.ok(contract, 'test exercises the production PowerShell registry validator')
 function failures(text) {
@@ -17,7 +19,10 @@ function Assert-NotContains([string]$text,[string]$needle,[string]$scope){if($te
 ${contract}
 Assert-TestTaskRegistry ([Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('${encoded}')))
 ConvertTo-Json -InputObject @($script:failures) -Compress`
-  return JSON.parse(execFileSync('pwsh', ['-NoProfile', '-NonInteractive', '-Command', command], { encoding: 'utf8' }))
+  // Large registries exceed Windows command-line limits; the generated harness is passed over stdin.
+  return JSON.parse(execFileSync('pwsh', ['-NoProfile', '-NonInteractive', '-Command',
+    '$registryHarness = [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String([Console]::In.ReadToEnd())); & ([ScriptBlock]::Create($registryHarness))'],
+  { encoding: 'utf8', input: Buffer.from(command).toString('base64') }))
 }
 test('actual explicitly authorized TEST registry passes the production validator', () => {
   assert.deepEqual(failures(registry), [])
@@ -32,4 +37,5 @@ for (const [name, mutate] of [
   ['obsolete empty status', s => s + '\n当前无登记任务'],
   ['foreign project identity', s => s + '\n6f874ec3-d3b2-49bd-8625-327f4d685f98'],
   ['retired controller', s => s + '\n01a0194a-259c-7171-8967-074731a27618'],
-]) test(`production validator rejects ${name}`, () => assert.ok(failures(mutate(registry)).length > 0))
+]) test(`production validator rejects ${name}`, () =>
+  assert.ok(failures(registry.replace(currentGroup, mutate(currentGroup))).length > 0))
diff --git a/scripts/appointment-work-test-env.mjs b/scripts/appointment-work-test-env.mjs
new file mode 100644
index 000000000..d5085d3ea
--- /dev/null
+++ b/scripts/appointment-work-test-env.mjs
@@ -0,0 +1,261 @@
+import assert from 'node:assert/strict'
+import { mkdir, open, readFile } from 'node:fs/promises'
+import { resolve, dirname, relative, isAbsolute } from 'node:path'
+import { fileURLToPath, pathToFileURL } from 'node:url'
+import { createHash } from 'node:crypto'
+import { AcceptanceRun } from './admin-test-env-acceptance.mjs'
+import { guardFleetWrites, redactFleetWrite } from './fleet-test-env-acceptance.mjs'
+
+const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..')
+const API = '/api/platform/v1/last-leg', WORK = `${API}/appointment-work`
+const id = value => String(value ?? ''), enc = encodeURIComponent
+const digest = value => createHash('sha256').update(typeof value === 'string' || Buffer.isBuffer(value) ? value : JSON.stringify(value)).digest('hex')
+const requireFact = (condition, message) => { if (!condition) throw new Error(message) }
+const ok = r => r?.http === 200 && id(r.body?.code) === '200'
+const refused = (r, status) => (r?.http === status || r?.http === 200) && id(r?.body?.code) === `A0${status}` && r.body?.data == null
+const sort = rows => rows.map(row => JSON.stringify(row)).sort()
+const source = row => ({ customerId: id(row.customerId), sourceKey: row.sourceKey, destinationKey: row.destinationKey, packageCount: Number(row.packageCount) })
+const count = value => {
+  if (typeof value !== 'number' && !(typeof value === 'string' && /^(0|[1-9]\d*)$/.test(value))) return NaN
+  const n = Number(value)
+  return Number.isSafeInteger(n) && n >= 0 ? n : NaN
+}
+
+export function plan() {
+  return { environment: 'TEST', execute: false, entry: 'scripts/appointment-work-test-env.mjs',
+    modes: { read: 'Only login/logout and GET: selected current-run work, exact FBA allocations/private dispatch pallets, shared trips, explicit retired replacements and actual dates.',
+      workflow: 'Also writes SAVE_FOLLOWUP on one pending fixture item; verifies reader denial, exact replay, stale version and changed-payload rejection. Optional CUSTOMER SAVE_REQUIREMENT records no booking, without execution.' },
+    command: 'node --env-file=<private>/test-acceptance.env scripts/appointment-work-test-env.mjs --execute --environment=TEST --run-id=<new> --mode=read|workflow --fixture=reports/<producer>/appointment-work-fixture.json',
+    prerequisites: ['Latest IAM/Firstleg/Lastleg and permission/DDL baseline deployed by coordinator',
+      'Current-run formal HTTP producer report, its SHA256 and an explicit fixture; no historical discovery or fabricated inventory',
+      'CHONGCHONG_ENV=test and CHONGCHONG_ADMIN_API_BASE_URL ending /api; CHONGCHONG_ADMIN_USERNAME/PASSWORD',
+      'CHONGCHONG_MERCHANT_USERNAME/PASSWORD for customer denial; workflow also APPOINTMENT_WORK_READER_USERNAME/PASSWORD (platform list + source reads, without followup/manage-work)',
+      'Owner is an active platform IAM user; scheduled synchronization complete before execution'],
+    fixture: { schemaVersion: 1, environment: 'TEST', runId: '<new>', producerRunId: '<current producer>', producedAt: '<ISO instant>', producerReport: 'reports/<producer>/report.json', producerSha256: '<sha256>',
+      cases: [{ name: 'customer', containerBookingId: '<id>', type: 'DELIVERY', flow: 'TRANSFER', requirementKey: 'DISPATCH:<id>', batchKey: 'DISPATCH:<id>', batchNo: '<dispatch business number>',
+        expected: { executionStatus: 'PENDING', planStatus: 'UNPLANNED', dateBasis: 'NONE', calendarDate: null }, containerIds: ['<id>'] }],
+      batches: [{ case: 'customer', kind: 'CUSTOMER', dispatchNo: '<business number>', packageCount: 1, pallets: [{ planPalletId: '<id>', packageCount: 1 }] }],
+      sharedTrips: [], retired: [], workflow: { case: 'customer', ownerId: '<active platform user authUserId (Auth subject ID)>', followupDate: '<YYYY-MM-DD>', noBooking: true } },
+    fixtureNotes: ['FBA batch entries instead use kind=FBA, appointmentNo, sources:[{customerId,sourceKey,destinationKey,packageCount}], minimumReadyCandidates (0 allowed).',
+      'sharedTrips:[{case,tripNo,tripId,containerIds,dispatches:[{dispatchNo,customerId,packageCount}]}]. The case must select TRANSPORT.',
+      'retired:[{workItemKey,containerBookingId,replacementCases:[name]}] checks absence from active container work and exact named replacements in old detail.',
+      'For COMPLETED cases provide expected.actual and calendarDate/dateBasis=ACTUAL; completed rows are loaded with their date filter.',
+      'workflow requires one pending item exposing SAVE_FOLLOWUP; noBooking additionally requires editable CUSTOMER DELIVERY and no original appointment plan.'],
+    minimumProducer: { entry:'scripts/admin-test-env-acceptance.mjs', arguments:'--environment test --modules phase4-carrier-pickup-ready --wait-split-count 1 --wait-split-package-count 4 --output reports/<new-producer>/producer.json',
+      notes:'Uses its existing ADMIN_TEST_* and ADMIN_PDA_* configuration. Dependency closure creates a new customer/order, measurement/loading/customs/outbound and formal ship-node evidence. Select only the current report createdResources.phase3CarrierScheduleQuery.containerBookingId. First acceptance can target its UNKNOWN ROUTE work with workflow.noBooking=false; this does not prove stable batches.',
+      batchPrerequisites:'Then use current formal route, cargo-verification/FBA appointment or PRIVATE receiving/pre-arrange APIs to prepare new stable batches; shared trip and completion stages need actual original dispatch/fleet/PDA execution before a new read report.',
+      batchProducer:'Select phase4-overseas-inbound-operations with the same four-box arguments to exercise independent cargo verification, dedicated DELETE cancellation, split/merge conservation, immutable batch identity and replacement history. It also runs prerequisite PDA and reversible inventory writes; offline checks do not establish HTTP readiness. Retain samples and obtain the corresponding environment/cancellation authorization before execution.' },
+    remaining: ['This package does not create sailed containers, appointments, dispatches, stock or fleet trips, cancel original businesses, pick/depart/sign, or run internal synchronization.',
+      'Prepare/advance those samples with existing formal producers; run a new read report after each state transition. This is not end-to-end execution proof.',
+      'PRIVATE per-order pick quantity conservation and DIRECT receiving-write rejection require the original PDA/dispatch producer; this reader checks public batch identity/pallet quantities and completed facts only.',
+      '1920x1080 manual page evidence remains separate.'],
+    boundary: 'Default plan is zero network/file writes. Execute claims a new report directory, journals before every write, stops on unknown outcome, retains samples, and logs out only its sessions. No SQL, deployment, deletes or automatic resume.' }
+}
+
+export function options(args, execArgs, env) {
+  if (!args.length || args.length === 1 && args[0] === '--plan') return { execute: false }
+  const values = new Map()
+  for (const arg of args) {
+    const match = /^--(execute|environment|run-id|mode|fixture)(?:=(.*))?$/.exec(arg)
+    requireFact(match && !values.has(match[1]), 'Unknown or duplicate argument')
+    values.set(match[1], match[1] === 'execute' && match[2] === undefined ? true : match[2])
+  }
+  requireFact(values.size === 5 && values.get('execute') === true && values.get('environment') === 'TEST'
+    && /^[A-Za-z0-9][A-Za-z0-9_-]{0,47}$/.test(values.get('run-id') || '') && ['read', 'workflow'].includes(values.get('mode')) && values.get('fixture'), 'Explicit TEST, new run-id, mode and fixture required')
+  requireFact(execArgs.length === 1 && execArgs[0].startsWith('--env-file=')
+    && resolve(execArgs[0].slice(11)).replaceAll('\\', '/').endsWith('/.codex/env/chongchong-global/test-acceptance.env'), 'Explicit authorized TEST env-file required')
+  requireFact(env.CHONGCHONG_ENV === 'test', 'TEST profile required')
+  const base = new URL(env.CHONGCHONG_ADMIN_API_BASE_URL)
+  requireFact(['http:', 'https:'].includes(base.protocol) && base.pathname.replace(/\/$/, '') === '/api' && !base.username && !base.password && !base.search && !base.hash, 'Unified TEST API base required')
+  const credentialKeys = ['CHONGCHONG_ADMIN_USERNAME', 'CHONGCHONG_ADMIN_PASSWORD', 'CHONGCHONG_MERCHANT_USERNAME', 'CHONGCHONG_MERCHANT_PASSWORD']
+  if (values.get('mode') === 'workflow') credentialKeys.push('APPOINTMENT_WORK_READER_USERNAME', 'APPOINTMENT_WORK_READER_PASSWORD')
+  requireFact(credentialKeys.every(key => typeof env[key] === 'string' && env[key]), 'Required actor credentials missing')
+  return { execute: true, runId: values.get('run-id'), mode: values.get('mode'), fixture: values.get('fixture'), gateway: base.origin, credentialKeys }
+}
+
+export function validateFixture(f, config, now = Date.now()) {
+  requireFact(f?.schemaVersion === 1 && f.environment === 'TEST' && f.runId === config.runId && /^[A-Za-z0-9_-]{1,80}$/.test(f.producerRunId || '')
+    && /^[a-f0-9]{64}$/.test(f.producerSha256 || '') && typeof f.producerReport === 'string', 'Current-run HTTP producer provenance required')
+  const age = now - Date.parse(f.producedAt)
+  requireFact(Number.isFinite(age) && age >= 0 && age < 24 * 3600000, 'Fixture must have been prepared in the current 24-hour window')
+  requireFact(Array.isArray(f.cases) && f.cases.length > 0 && f.cases.length <= 30, 'One to thirty explicit work cases required')
+  const names = new Set()
+  for (const c of f.cases) {
+    requireFact(/^[A-Za-z0-9_-]{1,40}$/.test(c.name || '') && !names.has(c.name), 'Unique case names required'); names.add(c.name)
+    requireFact(typeof c.containerBookingId === 'string' && c.containerBookingId.length > 0 && ['ROUTE','PICKUP','WAREHOUSE_RECEIPT','DELIVERY','TRANSPORT','EMPTY_RETURN'].includes(c.type)
+      && ['UNKNOWN','TRANSFER','DIRECT'].includes(c.flow) && Array.isArray(c.containerIds) && c.containerIds.includes(c.containerBookingId), 'Exact case scope required')
+    requireFact(['PENDING','IN_PROGRESS','COMPLETED'].includes(c.expected?.executionStatus) && ['UNPLANNED','TARGET_SET','AWAITING_REPLY','CONFIRMED','NOT_REQUIRED'].includes(c.expected?.planStatus)
+      && ['NONE','TARGET','CONFIRMED','ACTUAL'].includes(c.expected?.dateBasis) && Object.hasOwn(c.expected, 'calendarDate'), 'Explicit status and calendar expectation required')
+    if (c.expected.executionStatus === 'COMPLETED') requireFact(c.expected.actual && c.expected.dateBasis === 'ACTUAL' && /^\d{4}-\d{2}-\d{2}$/.test(c.expected.calendarDate || ''), 'Completion requires independent actual evidence and date')
+  }
+  for (const key of ['batches', 'sharedTrips', 'retired']) requireFact(Array.isArray(f[key]) && f[key].length <= 30, `${key} must be an explicit bounded list`)
+  for (const b of f.batches) {
+    const c = f.cases.find(c => c.name === b.case)
+    requireFact(c?.type === 'DELIVERY' && c.batchKey && ['FBA','CUSTOMER'].includes(b.kind), 'Batch requires its delivery case')
+    if (b.kind === 'FBA') requireFact(/^FBA_APPOINTMENT:[1-9]\d*$/.test(c.batchKey) && b.appointmentNo && Array.isArray(b.sources) && b.sources.length > 0 && b.sources.every(s => s.customerId && s.sourceKey && s.destinationKey && Number.isSafeInteger(s.packageCount) && s.packageCount > 0) && Number.isSafeInteger(b.minimumReadyCandidates) && b.minimumReadyCandidates >= 0, 'Exact FBA source expectations required')
+    else requireFact(/^DISPATCH:[1-9]\d*$/.test(c.batchKey) && b.dispatchNo && Number.isSafeInteger(b.packageCount) && b.packageCount > 0 && Array.isArray(b.pallets) && b.pallets.length > 0 && b.pallets.every(p => typeof p.planPalletId === 'string' && Number.isSafeInteger(p.packageCount) && p.packageCount > 0), 'Exact private dispatch physical expectations required')
+  }
+  for (const t of f.sharedTrips) requireFact(f.cases.some(c => c.name === t.case && c.type === 'TRANSPORT') && t.tripNo && typeof t.tripId === 'string' && Array.isArray(t.containerIds) && t.containerIds.length > 0 && Array.isArray(t.dispatches) && t.dispatches.length > 0, 'Exact trip source expectations required')
+  for (const r of f.retired) requireFact(r.workItemKey && r.containerBookingId && r.replacementCases?.length > 0 && r.replacementCases.every(n => names.has(n)), 'Explicit retired replacements required')
+  if (config.mode === 'workflow') requireFact(names.has(f.workflow?.case) && typeof f.workflow.ownerId === 'string' && /^\d{4}-\d{2}-\d{2}$/.test(f.workflow.followupDate || '') && typeof f.workflow.noBooking === 'boolean', 'Workflow target, owner and follow-up required')
+  return f
+}
+
+export function validatePage(page, number, size = 100) {
+  const total = count(page?.total)
+  requireFact(page && Number.isSafeInteger(total) && count(page.page) === number && count(page.size) === size && count(page.pages) === Math.ceil(total / size)
+    && Array.isArray(page.records) && page.records.length === Math.min(size, Math.max(0, total - (number - 1) * size)), 'Incomplete work page')
+  return page.records
+}
+export function assertItem(item, c) {
+  requireFact(item?.workItemKey && item.type === c.type && item.flow === c.flow, `Case ${c.name}: wrong work identity`)
+  for (const key of ['requirementKey','batchKey','batchNo']) if (Object.hasOwn(c, key)) assert.equal(item[key], c[key], `Case ${c.name}: ${key}`)
+  assert.deepEqual(item.containers.map(r => id(r.containerBookingId)).sort(), [...c.containerIds].sort(), `Case ${c.name}: current container scope`)
+  for (const [key, value] of Object.entries(c.expected)) { requireFact(['executionStatus','planStatus','dateBasis','calendarDate','actual','reviewRequired','timezone'].includes(key), 'Unsupported expectation field'); assert.deepEqual(['calendarDate','actual','timezone'].includes(key) ? item[key] ?? null : item[key], value, `Case ${c.name}: ${key}`) }
+  if (item.executionStatus !== 'COMPLETED') assert.equal(item.actual ?? null, null, 'Unfinished work must not invent completion')
+  if (c.flow === 'DIRECT') requireFact(item.type !== 'WAREHOUSE_RECEIPT', 'DIRECT cannot create warehouse receipt work')
+  return item
+}
+
+/** Runs only on explicit current-run identities. Caller provides authenticated, journaled transport. */
+export async function verify(context, fixture, config) {
+  const checks = [], resolved = new Map()
+  const check = (name, condition) => { requireFact(condition, name); checks.push(name) }
+  async function data(method, path, body, actor = 'admin') {
+    const r = await context.request(actor, method, path, body)
+    requireFact(ok(r), `HTTP_FAILURE ${method} ${path.split('?')[0]} http=${r?.http} code=${id(r?.body?.code)} requestId=${id(r?.requestId)} traceId=${id(r?.traceId)}`)
+    return r.body.data
+  }
+  async function rows(container, date) {
+    const result = []; let total = null
+    for (let page = 1; page <= 100; page++) {
+      const query = new URLSearchParams({ view: 'ALL', page: id(page), size: '100', containerBookingId: container, ...(date ? { date } : {}) })
+      const response = await data('GET', `${WORK}/items?${query}`), next = validatePage(response, page)
+      requireFact(total == null || total === count(response.total), 'Work scope changed during pagination'); total = count(response.total)
+      result.push(...next); if (page >= count(response.pages)) { requireFact(result.length === total && new Set(result.map(i => i.workItemKey)).size === total, 'Duplicate or missing work rows'); return result }
+    }
+    throw Error('Work pagination limit exceeded')
+  }
+  const anonymous = await context.request('anonymous', 'GET', `${WORK}/summary`)
+  check('anonymous cannot read work', [401,403].includes(anonymous?.http) && anonymous.body?.data == null)
+  check('customer cannot read platform work', refused(await context.request('merchant', 'GET', `${WORK}/summary`), 403))
+  const summary = await data('GET', `${WORK}/summary`)
+  check('summary contains complete initialized counters', ['all','followToday','overdue','undated','review'].every(k=>Number.isSafeInteger(count(summary[k]))))
+  for (const c of fixture.cases) {
+    const current = await rows(c.containerBookingId, c.expected.executionStatus === 'COMPLETED' ? c.expected.calendarDate : null)
+    if (c.flow === 'DIRECT') check(`${c.name}: no active warehouse receiving branch`, !current.some(i => i.type === 'WAREHOUSE_RECEIPT'))
+    const matches = current.filter(i => i.type === c.type && i.flow === c.flow && ['requirementKey','batchKey','batchNo'].every(k => !Object.hasOwn(c,k) || i[k] === c[k]))
+    check(`${c.name}: exactly one current item`, matches.length === 1); assertItem(matches[0], c)
+    const detail = await data('GET', `${WORK}/items/${enc(matches[0].workItemKey)}`); assertItem(detail.item, c)
+    const second = await data('GET', `${WORK}/items/${enc(matches[0].workItemKey)}`)
+    assert.deepEqual(second, detail, 'Repeated GET must not write history or versions')
+    resolved.set(c.name, detail); checks.push(`${c.name}: detail/get-no-write/status/date verified`)
+    if (c.expected.calendarDate) {
+      const day = c.expected.calendarDate, calendar = await data('GET', `${WORK}/calendar?from=${enc(day)}&to=${enc(day)}`)
+      check(`${c.name}: calendar uses authoritative date`, calendar.days.some(d => d.date === day && d.total > 0 && d.typeCounts[c.type] > 0))
+    }
+  }
+  for (const b of fixture.batches) {
+    const item = resolved.get(b.case).item
+    if (b.kind === 'FBA') {
+      const batch = await data('GET', `${API}/appointment-planning/batches/${enc(item.batchKey)}`)
+      check(`${b.case}: immutable FBA batch and business number`, batch.appointment.batchKey === item.batchKey && batch.appointment.appointmentNo === b.appointmentNo && item.batchNo === b.appointmentNo)
+      assert.deepEqual(sort(batch.appointment.items.map(source)), sort(b.sources.map(source)), 'FBA per-source quantities must match producer evidence')
+      const candidates = await data('GET', `${API}/appointment-planning/batches/${enc(item.batchKey)}/dispatch-candidates`)
+      check(`${b.case}: complete FBA candidates`, candidates.batchKey === item.batchKey && candidates.version === batch.appointment.version && Array.isArray(candidates.candidates) && Array.isArray(candidates.blockReasons))
+      const ready = candidates.candidates.filter(c => c.blockReasons.length === 0)
+      check(`${b.case}: required real physical candidates`, ready.length >= b.minimumReadyCandidates)
+      for (const candidate of ready) check(`${b.case}: candidate per-source quantity conservation`, candidate.allocations.length > 0 && candidate.allocations.every(a => a.batchKey === item.batchKey && id(a.customerId) === id(candidate.customerId) && id(a.planPalletId) === id(candidate.planPalletId)) && candidate.allocations.reduce((n,a) => n+a.packageCount,0) === candidate.packageCount)
+    } else {
+      const dispatch = await data('GET', `${API}/dispatches/${enc(b.dispatchNo)}`)
+      check(`${b.case}: original private dispatch identity`, item.batchKey === `DISPATCH:${dispatch.id}` && item.batchNo === dispatch.dispatchNo && dispatch.dispatchNo === b.dispatchNo)
+      check(`${b.case}: physical total`, dispatch.packageCount === b.packageCount && dispatch.items.reduce((n,p) => n+p.packageCount,0) === b.packageCount)
+      assert.deepEqual(sort(dispatch.items.map(p => ({planPalletId:id(p.planPalletId),packageCount:p.packageCount}))), sort(b.pallets), 'Private original pallet allocation drift')
+    }
+  }
+  for (const t of fixture.sharedTrips) {
+    const detail = resolved.get(t.case), trip = await data('GET', `${API}/fleet/trips/${enc(t.tripNo)}`)
+    check(`${t.case}: canonical trip identity`, detail.item.businessNo === t.tripNo && detail.references.some(r => r.kind === 'FLEET_TRIP' && r.key === t.tripId && r.businessNo === t.tripNo) && trip.trip.tripNo === t.tripNo)
+    assert.deepEqual(detail.item.containers.map(c => c.containerBookingId).sort(), [...t.containerIds].sort(), 'Shared trip container membership drift')
+    assert.deepEqual(sort(trip.dispatches.map(d => ({dispatchNo:d.dispatchNo,customerId:id(d.customerId),packageCount:d.packageCount}))), sort(t.dispatches), 'Shared trip original dispatch membership drift')
+    for (const container of t.containerIds) check(`${t.case}: shared transport counted once per container`, (await rows(container, detail.item.calendarDate || undefined)).filter(i => i.type === 'TRANSPORT' && i.workItemKey === detail.item.workItemKey).length === 1)
+  }
+  for (const r of fixture.retired) {
+    check('retired item excluded from active scope', !(await rows(r.containerBookingId)).some(i => i.workItemKey === r.workItemKey))
+    const old = await data('GET', `${WORK}/items/${enc(r.workItemKey)}`)
+    check('retired item retains history and read-only actions', old.history.some(h => h.action === 'REPLACED') && old.item.allowedActions.every(a => ['VIEW_HISTORY','VIEW_DETAIL'].includes(a.code)))
+    for (const name of r.replacementCases) check('original requirement restored or explicitly replaced', old.relatedItems.some(i => i.workItemKey === resolved.get(name).item.workItemKey))
+  }
+  if (config.mode === 'workflow') {
+    const w = fixture.workflow, before = resolved.get(w.case), key = before.item.workItemKey, path = `${WORK}/items/${enc(key)}`
+    check('workflow sample is unfinished and exposes followup', before.item.executionStatus !== 'COMPLETED' && before.item.allowedActions.some(a => a.code === 'SAVE_FOLLOWUP'))
+    await data('GET', path, undefined, 'reader')
+    const command = { command:'SAVE_FOLLOWUP', expectedVersion:before.item.version, idempotencyKey:`AW-${config.runId}-FOLLOWUP`, payload:{ownerId:w.ownerId,followupDate:w.followupDate,note:`预约工作HTTP验收 ${config.runId}`} }
+    check('list-only platform cannot write followup', refused(await context.request('reader','POST',`${path}/commands`,command),403))
+    assert.deepEqual(await data('GET',path),before,'Denied write changed original work')
+    const result = await data('POST',`${path}/commands`,command), saved = await data('GET',path)
+    check('followup resolves the active platform Auth subject owner', result.item.owner?.id === w.ownerId && typeof result.item.owner.name === 'string' && result.item.owner.name.length > 0 && result.item.followupDate === w.followupDate)
+    assert.deepEqual(result.item.actual,before.item.actual,'Followup invented execution'); assert.equal(result.item.executionStatus,before.item.executionStatus)
+    check('one command creates one history entry',saved.history.length===before.history.length+1)
+    assert.deepEqual(await data('POST',`${path}/commands`,command),result,'Idempotent replay changed response')
+    assert.deepEqual(await data('GET',path),saved,'Idempotent replay wrote history or version')
+    check('changed payload under same key rejected',refused(await context.request('admin','POST',`${path}/commands`,{...command,payload:{...command.payload,note:'变更内容应拒绝'}}),409))
+    check('stale version rejected',refused(await context.request('admin','POST',`${path}/commands`,{...command,idempotencyKey:`AW-${config.runId}-STALE`}),409))
+    assert.deepEqual(await data('GET',path),saved,'Rejected stale/tampered write changed work')
+    if(w.noBooking) {
+      check('explicit customer requirement is editable',before.item.type==='DELIVERY' && saved.requirement && saved.item.allowedActions.some(a=>a.code==='SAVE_REQUIREMENT'))
+      const updated=await data('POST',`${path}/commands`,{command:'SAVE_REQUIREMENT',expectedVersion:saved.item.version,idempotencyKey:`AW-${config.runId}-NOBOOK`,payload:{target:null,bookingRequired:false,receivingRequirements:'本轮测试客户仓按到货接收，无需外部预约',reason:`明确收货要求 ${config.runId}`}})
+      check('no booking does not mean executed',updated.item.planStatus==='NOT_REQUIRED' && updated.item.executionStatus===before.item.executionStatus && updated.item.actual==null)
+    }
+  }
+  return { checks, resolved: Object.fromEntries([...resolved].map(([name,d])=>[name,{workItemKey:d.item.workItemKey,version:d.item.version,batchKey:d.item.batchKey,batchNo:d.item.batchNo,executionStatus:d.item.executionStatus}])) }
+}
+
+function inReports(path) {
+  const absolute=resolve(ROOT,path), rel=relative(resolve(ROOT,'reports'),absolute)
+  requireFact(rel && !rel.startsWith('..') && !isAbsolute(rel), 'Fixture and producer evidence must stay inside this TEST workspace reports directory')
+  return absolute
+}
+export async function execute(args=process.argv.slice(2),execArgs=process.execArgv,env=process.env) {
+  const config=options(args,execArgs,env);if(!config.execute)return plan()
+  requireFact(ROOT.replaceAll('\\','/').endsWith('/chongchong-global/baiyue-firstleg'),'Registered TEST workspace required')
+  const fixtureBytes=await readFile(inReports(config.fixture));requireFact(fixtureBytes.length<=1024*1024,'Fixture too large')
+  const fixture=validateFixture(JSON.parse(fixtureBytes),config)
+  const producer=await readFile(inReports(fixture.producerReport));requireFact(digest(producer)===fixture.producerSha256,'Producer evidence digest mismatch')
+  const directory=resolve(ROOT,'reports',`appointment-work-${config.runId}`)
+  await mkdir(dirname(directory),{recursive:true});await mkdir(directory)
+  let sequence=0
+  const report={runId:config.runId,producerRunId:fixture.producerRunId,fixtureSha256:digest(fixtureBytes),mode:config.mode,status:'RUNNING',startedAt:new Date().toISOString(),deploymentBlocker:false,checks:[],sessionsClosed:[],remaining:plan().remaining}
+  const secrets=config.credentialKeys.map(k=>env[k]),sessions=new Map()
+  async function save(name,value) {const file=await open(resolve(directory,name),'wx',0o600);try{await file.writeFile(JSON.stringify(redactFleetWrite(value,secrets),null,2)+'\n');await file.sync()}finally{await file.close()}}
+  async function checkpoint(entry) {
+    // Public query responses can include unrelated records; persist only own request and diagnostic metadata.
+    const {responseBody,raw,...evidence}=entry
+    if(evidence.path?.startsWith('/api/auth/')) evidence.body={sessionOperation:true}
+    await save(`${String(++sequence).padStart(5,'0')}-${entry.status||'event'}.json`,{...evidence,responseCode:responseBody?.code})
+  }
+  await save('claim.json',report)
+  const transport=new AcceptanceRun({environment:'test',gateway:config.gateway,username:env.CHONGCHONG_ADMIN_USERNAME,password:env.CHONGCHONG_ADMIN_PASSWORD,quiet:true,modules:[]})
+  const cleanupRequest=transport.request.bind(transport)
+  guardFleetWrites(transport,checkpoint)
+  const request=async(actor,method,path,body)=> {
+    requireFact(method==='GET' || method==='POST' && (['/api/auth/login','/api/auth/logout'].includes(path) || /^\/api\/platform\/v1\/last-leg\/appointment-work\/items\/[^/]+\/commands$/.test(path)),'Unexpected write boundary')
+    const response=await transport.request(method,path,body,sessions.get(actor)?.accessToken||'')
+    if(method==='GET')await checkpoint({status:'READ',actor,method,path,http:response.http,code:response.body?.code,requestId:response.requestId,traceId:response.traceId})
+    return response
+  }
+  try {
+    const actors=[['admin','CHONGCHONG_ADMIN'],['merchant','CHONGCHONG_MERCHANT'],...(config.mode==='workflow'?[['reader','APPOINTMENT_WORK_READER']]:[])]
+    for(const[name,prefix]of actors){const r=await request(name,'POST','/api/auth/login',{loginId:env[`${prefix}_USERNAME`],password:env[`${prefix}_PASSWORD`]});requireFact(ok(r)&&r.body.data?.accessToken&&r.body.data?.refreshToken,'Incomplete login');sessions.set(name,r.body.data);secrets.push(r.body.data.accessToken,r.body.data.refreshToken)}
+    Object.assign(report,await verify({request},fixture,config));report.status='VERIFIED'
+  }catch(error){report.status=String(error.message).includes('Unknown write outcome')?'UNKNOWN_STOP':'FAILED';report.deploymentBlocker=true;report.failure=redactFleetWrite(String(error.message),secrets)}
+  finally {
+    for(const[name,session]of sessions){
+      try {await checkpoint({status:'LOGOUT_SENDING',actor:name,path:'/api/auth/logout'});const r=await cleanupRequest('POST','/api/auth/logout',{refreshToken:session.refreshToken},session.accessToken);await checkpoint({status:'LOGOUT_RESULT',actor:name,http:r.http,code:r.body?.code,requestId:r.requestId,traceId:r.traceId});requireFact(ok(r),'Logout failed');report.sessionsClosed.push(name)}
+      catch{report.deploymentBlocker=true;report.logoutFailure=true;if(report.status==='VERIFIED')report.status='FAILED'}
+    }
+    report.completedAt=new Date().toISOString();await save('report.json',report)
+  }
+  return {success:report.status==='VERIFIED',status:report.status,checks:report.checks.length,report:resolve(directory,'report.json')}
+}
+if(process.argv[1]&&import.meta.url===pathToFileURL(resolve(process.argv[1])).href){execute().then(result=>{console.log(JSON.stringify(result,null,2));if(result.success===false)process.exitCode=1}).catch(()=>{console.error('Appointment work acceptance not started: verify explicit TEST configuration, current-run fixture and unused report directory.');process.exitCode=1})}
diff --git a/scripts/appointment-work-test-env.test.mjs b/scripts/appointment-work-test-env.test.mjs
new file mode 100644
index 000000000..28079f048
--- /dev/null
+++ b/scripts/appointment-work-test-env.test.mjs
@@ -0,0 +1,159 @@
+import assert from 'node:assert/strict'
+import test from 'node:test'
+import { spawnSync } from 'node:child_process'
+import { readFile } from 'node:fs/promises'
+import { options, plan, validateFixture, validatePage, assertItem, verify, execute } from './appointment-work-test-env.mjs'
+import { guardFleetWrites } from './fleet-test-env-acceptance.mjs'
+
+const WORK='/api/platform/v1/last-leg/appointment-work', API='/api/platform/v1/last-leg'
+const now=Date.parse('2026-10-15T08:00:00Z')
+function sample() {
+  return {schemaVersion:1,environment:'TEST',runId:'aw-test',producerRunId:'producer-test',producedAt:'2026-10-15T07:00:00Z',producerReport:'reports/producer/report.json',producerSha256:'a'.repeat(64),
+    cases:[{name:'private',containerBookingId:'1',containerIds:['1'],type:'DELIVERY',flow:'TRANSFER',requirementKey:'DISPATCH:20',batchKey:'DISPATCH:20',batchNo:'D-20',expected:{executionStatus:'PENDING',planStatus:'UNPLANNED',dateBasis:'NONE',calendarDate:null}}],
+    batches:[{case:'private',kind:'CUSTOMER',dispatchNo:'D-20',packageCount:4,pallets:[{planPalletId:'10',packageCount:4}]}],sharedTrips:[],retired:[],workflow:{case:'private',ownerId:'90',followupDate:'2026-10-16',noBooking:true}}
+}
+function workItem(c=sample().cases[0]) {
+  return {workItemKey:'WORK-1',version:1,type:c.type,flow:c.flow,requirementKey:c.requirementKey,batchKey:c.batchKey,batchNo:c.batchNo,businessNo:'D-20',
+    containers:c.containerIds.map(id=>({containerBookingId:id,containerNo:`CNT-${id}`,bookingNo:null})),...c.expected,actual:c.expected.actual||null,
+    allowedActions:[{code:'SAVE_FOLLOWUP'},{code:'SAVE_REQUIREMENT'}],blockReasons:[],reviewRequired:false,owner:null,followupDate:null}
+}
+function response(data,http=200,code='200') {return {http,body:{code,data},requestId:'REQ',traceId:'TRACE'}}
+function harness(fixture=sample()) {
+  const requests=[], detail={item:workItem(fixture.cases[0]),history:[],references:[],relatedItems:[],requirement:{bookingRequired:true},review:null,returnHandoff:null},replays=new Map()
+  const clone=v=>structuredClone(v)
+  async function request(actor,method,path,body) {
+    requests.push({actor,method,path,body:clone(body)})
+    if(actor==='anonymous')return response(null,401,'A0401')
+    if(actor==='merchant'||actor==='reader'&&method==='POST')return response(null,403,'A0403')
+    if(path===`${WORK}/summary`)return response({all:'1',followToday:'0',overdue:'0',undated:'1',review:'0'})
+    if(path.startsWith(`${WORK}/items?`))return response({records:[clone(detail.item)],page:'1',size:'100',total:'1',pages:'1'})
+    if(path===`${WORK}/items/WORK-1`&&method==='GET')return response(clone(detail))
+    if(path===`${API}/dispatches/D-20`)return response({id:'20',dispatchNo:'D-20',packageCount:4,items:[{planPalletId:'10',packageCount:4}]})
+    if(path===`${WORK}/items/WORK-1/commands`) {
+      if(replays.has(body.idempotencyKey)){const old=replays.get(body.idempotencyKey);return JSON.stringify(old.body)===JSON.stringify(body)?response(clone(old.result)):response(null,409,'A0409')}
+      if(body.expectedVersion!==detail.item.version)return response(null,409,'A0409')
+      if(body.command==='SAVE_FOLLOWUP'){detail.item.owner={id:body.payload.ownerId,name:'验收操作员'};detail.item.followupDate=body.payload.followupDate}
+      else if(body.command==='SAVE_REQUIREMENT'){detail.item.planStatus='NOT_REQUIRED';detail.requirement.bookingRequired=false}
+      else throw Error('Unexpected command')
+      detail.item.version++;detail.history.push({action:body.command,summary:'fixture'})
+      const result={item:clone(detail.item),affectedWorkItemKeys:[]};replays.set(body.idempotencyKey,{body:clone(body),result:clone(result)});return response(result)
+    }
+    throw Error(`Unexpected request ${method} ${path}`)
+  }
+  return {request,requests,detail}
+}
+
+test('default and explicit plan perform no network and no fixture/file reads',async()=>{
+  const original=globalThis.fetch;globalThis.fetch=()=>{throw Error('NETWORK_FORBIDDEN')}
+  try {assert.equal((await execute([],[],{})).execute,false);assert.deepEqual(await execute(['--plan'],[],{}),plan())}finally{globalThis.fetch=original}
+  const child=spawnSync(process.execPath,['scripts/appointment-work-test-env.mjs','--plan'],{encoding:'utf8'})
+  assert.equal(child.status,0,child.stderr);assert.equal(JSON.parse(child.stdout).execute,false)
+})
+test('execution rejects ambiguous environments, duplicate args and wrong private profile',()=>{
+  const args=['--execute','--environment=TEST','--run-id=aw-test','--mode=workflow','--fixture=reports/new/fixture.json']
+  const env={CHONGCHONG_ENV:'test',CHONGCHONG_ADMIN_API_BASE_URL:'https://example.invalid/api',CHONGCHONG_ADMIN_USERNAME:'admin',CHONGCHONG_ADMIN_PASSWORD:'secret',CHONGCHONG_MERCHANT_USERNAME:'customer',CHONGCHONG_MERCHANT_PASSWORD:'secret',APPOINTMENT_WORK_READER_USERNAME:'reader',APPOINTMENT_WORK_READER_PASSWORD:'secret'}
+  const flags=['--env-file=C:/Users/test/.codex/env/chongchong-global/test-acceptance.env']
+  assert.equal(options(args,flags,env).mode,'workflow')
+  assert.throws(()=>options([...args,'--mode=read'],flags,env))
+  assert.throws(()=>options(args,flags,{...env,CHONGCHONG_ENV:'prod'}))
+  assert.throws(()=>options(args,['--env-file=other.env'],env))
+  assert.throws(()=>options(args,flags,{...env,CHONGCHONG_ADMIN_API_BASE_URL:'https://example.invalid/overseas-api'}))
+  assert.throws(()=>options(args,flags,{...env,APPOINTMENT_WORK_READER_PASSWORD:''}))
+})
+test('fixture requires current producer evidence and explicit nonempty expectations',()=>{
+  assert.equal(validateFixture(sample(),{runId:'aw-test',mode:'workflow'},now).cases.length,1)
+  for(const patch of [{cases:[]},{runId:'old'},{producedAt:'2026-10-13T00:00:00Z'},{producerSha256:''},{batches:[{case:'private',kind:'CUSTOMER',dispatchNo:'D-20',packageCount:4,pallets:[]}]}])assert.throws(()=>validateFixture({...sample(),...patch},{runId:'aw-test',mode:'workflow'},now))
+  const incomplete=sample();incomplete.cases[0].expected.executionStatus='COMPLETED';assert.throws(()=>validateFixture(incomplete,{runId:'aw-test',mode:'read'},now))
+})
+test('pagination and actual evidence cannot silently truncate or invent completion',()=>{
+  assert.throws(()=>validatePage({records:[],page:1,size:100,total:1,pages:1},1))
+  const c=sample().cases[0], item=workItem(c);assertItem(item,c)
+  assert.throws(()=>assertItem({...item,actual:{localOccurredAt:'2026-10-15T11:00:00',occurredAt:null,timezone:null}},c))
+  assert.throws(()=>assertItem({...item,containers:[{containerBookingId:'foreign'}]},c))
+})
+
+test('Long wire counters preserve exact pagination and reject missing or unsafe counts',()=>{
+  const page={records:[{workItemKey:'WORK-1'}],page:'1',size:'100',total:'1',pages:'1'}
+  assert.equal(validatePage(page,1).length,1)
+  for(const total of [null,undefined,'',true,'1.5','01','9007199254740993',-1])assert.throws(()=>validatePage({...page,total},1))
+  assert.throws(()=>validatePage({...page,page:null},1))
+  assert.throws(()=>validatePage({...page,pages:'2'},1))
+})
+
+test('omitted nullable wire fields remain unknown and never imply completion',()=>{
+  const c=sample().cases[0], item=workItem(c)
+  delete item.actual; delete item.calendarDate
+  assert.equal(assertItem(item,c),item)
+  assert.throws(()=>assertItem({...item,actual:{localOccurredAt:'2026-10-15T10:00:00'}},c))
+  assert.throws(()=>assertItem({...item,executionStatus:undefined},c))
+})
+test('workflow runs denial/replay/stale/no-booking checks without original-business writes',async()=>{
+  const h=harness(),result=await verify(h,sample(),{mode:'workflow',runId:'aw-test'})
+  assert.ok(result.checks.includes('no booking does not mean executed'))
+  assert.ok(result.checks.includes('stale version rejected'))
+  assert.equal(h.detail.item.executionStatus,'PENDING');assert.equal(h.detail.item.actual,null)
+  assert.equal(h.detail.history.length,2)
+  assert.ok(h.requests.filter(r=>r.method!=='GET').every(r=>r.method==='POST'&&r.path===`${WORK}/items/WORK-1/commands`))
+  assert.ok(!h.requests.some(r=>r.path.includes('/DISPATCH%3A20/dispatch-candidates')))
+})
+test('read mode is GET-only and rejects private dispatch identity or quantity drift',async()=>{
+  const h=harness();await verify(h,sample(),{mode:'read',runId:'aw-test'});assert.ok(h.requests.every(r=>r.method==='GET'))
+  for(const wrong of [{id:'21',dispatchNo:'D-20',packageCount:4,items:[{planPalletId:'10',packageCount:4}]},{id:'20',dispatchNo:'D-20',packageCount:4,items:[{planPalletId:'10',packageCount:3}]}]){
+    const h=harness();await assert.rejects(()=>verify({request:async(...args)=>args[2]===`${API}/dispatches/D-20`?response(wrong):h.request(...args)},sample(),{mode:'read',runId:'aw-test'}))
+  }
+})
+test('denied writes must leave history and versions unchanged',async()=>{
+  const h=harness();await assert.rejects(()=>verify({request:async(...args)=>{const r=await h.request(...args);if(args[0]==='reader'&&args[1]==='POST')h.detail.item.version++;return r}},sample(),{mode:'workflow',runId:'aw-test'}),/Denied write/)
+})
+test('FBA batch source allocation and candidate quantity are independently checked',async()=>{
+  const f=sample(),c=f.cases[0];Object.assign(c,{name:'fba',batchKey:'FBA_APPOINTMENT:20',requirementKey:'FBA_APPOINTMENT:20',batchNo:'AP-20'})
+  const expected={customerId:'C1',sourceKey:'ORDER:1',destinationKey:'FBA:ONT8',packageCount:4}
+  f.batches=[{case:'fba',kind:'FBA',appointmentNo:'AP-20',sources:[expected],minimumReadyCandidates:1}]
+  const h=harness(f)
+  let count=4
+  const request=async(...args)=>{
+    if(args[2]===`${API}/appointment-planning/batches/FBA_APPOINTMENT%3A20`)return response({appointment:{batchKey:c.batchKey,appointmentNo:'AP-20',version:1,items:[expected]}})
+    if(args[2].endsWith('/dispatch-candidates'))return response({batchKey:c.batchKey,version:1,blockReasons:[],candidates:[{planPalletId:'10',customerId:'C1',packageCount:4,blockReasons:[],allocations:[{...expected,packageCount:count,batchKey:c.batchKey,planPalletId:'10'}]}]})
+    return h.request(...args)
+  }
+  await verify({request},f,{mode:'read',runId:'aw-test'});count=3;await assert.rejects(()=>verify({request},f,{mode:'read',runId:'aw-test'}),/quantity conservation/)
+})
+test('shared trip checks original dispatch identities, quantities and current containers',async()=>{
+  const f=sample(),c=f.cases[0];Object.assign(c,{name:'trip',type:'TRANSPORT',containerIds:['1','2'],batchKey:null,batchNo:null,requirementKey:null});f.batches=[]
+  f.sharedTrips=[{case:'trip',tripNo:'TR-1',tripId:'100',containerIds:['1','2'],dispatches:[{dispatchNo:'D-20',customerId:'C1',packageCount:4}]}]
+  const h=harness(f);h.detail.item.businessNo='TR-1';h.detail.references=[{kind:'FLEET_TRIP',key:'100',businessNo:'TR-1'}]
+  const request=async(...args)=>args[2]===`${API}/fleet/trips/TR-1`?response({trip:{tripNo:'TR-1'},dispatches:f.sharedTrips[0].dispatches}):h.request(...args)
+  await verify({request},f,{mode:'read',runId:'aw-test'})
+  h.detail.references[0].key='999';await assert.rejects(()=>verify({request},f,{mode:'read',runId:'aw-test'}),/canonical trip identity/)
+})
+test('completed local facts keep their explicit date and do not disappear behind the pending filter',async()=>{
+  const f=sample();f.batches=[];Object.assign(f.cases[0].expected,{executionStatus:'COMPLETED',dateBasis:'ACTUAL',calendarDate:'2026-10-15',actual:{occurredAt:null,localOccurredAt:'2026-10-15T23:30:00',timezone:null}})
+  const h=harness(f),request=async(...args)=>args[2].startsWith(`${WORK}/calendar?`)?response({days:[{date:'2026-10-15',total:1,typeCounts:{DELIVERY:1}}]}):h.request(...args)
+  await verify({request},f,{mode:'read',runId:'aw-test'})
+  assert.ok(h.requests.some(r=>r.path.includes('/items?')&&r.path.includes('date=2026-10-15')))
+  assert.equal(h.requests.filter(r=>r.method==='POST').length,0)
+})
+test('retired cancellation requires visible original history and exact replacement identities',async()=>{
+  const f=sample();f.retired=[{workItemKey:'OLD',containerBookingId:'1',replacementCases:['private']}]
+  const h=harness();let replacements=[structuredClone(h.detail.item)]
+  const request=async(...args)=>args[2]===`${WORK}/items/OLD`?response({history:[{action:'REPLACED'}],item:{allowedActions:[{code:'VIEW_HISTORY'}]},relatedItems:replacements}):h.request(...args)
+  await verify({request},f,{mode:'read',runId:'aw-test'});replacements=[]
+  await assert.rejects(()=>verify({request},f,{mode:'read',runId:'aw-test'}),/original requirement restored/)
+})
+test('existing write guard persists before send and halts after unknown result',async()=>{
+  const events=[],context={options:{},request:async()=>{events.push('SENT');return {http:503,body:null}}}
+  guardFleetWrites(context,async entry=>events.push(entry.status))
+  await assert.rejects(()=>context.request('POST',`${WORK}/items/WORK-1/commands`,{}),/Unknown write outcome/)
+  await assert.rejects(()=>context.request('POST',`${WORK}/items/WORK-1/commands`,{}))
+  assert.deepEqual(events,['SENDING','SENT','UNKNOWN_RESULT'])
+  let sends=0;const diskFailure={options:{},request:async()=>{sends++}}
+  guardFleetWrites(diskFailure,async()=>{throw Error('DISK_FAILED')})
+  await assert.rejects(()=>diskFailure.request('POST','/api/auth/login',{}),/DISK_FAILED/);assert.equal(sends,0)
+})
+test('entry keeps report exclusive and reuses formal transport without SQL/internal sync/deploy',async()=>{
+  const code=await readFile(new URL('./appointment-work-test-env.mjs',import.meta.url),'utf8')
+  assert.match(code,/new AcceptanceRun/);assert.match(code,/guardFleetWrites\(transport,checkpoint\)/)
+  assert.match(code,/await mkdir\(directory\)/);assert.match(code,/'wx',0o600/);assert.match(code,/await file\.sync\(\)/)
+  assert.match(code,/digest\(producer\)===fixture\.producerSha256/)
+  assert.doesNotMatch(code,/mysql|JENKINS_|\/internal\/|fetch\(/)
+})
diff --git a/scripts/db/cargo-discard-consolidated-incremental-20261014.sql b/scripts/db/cargo-discard-consolidated-incremental-20261014.sql
new file mode 100644
index 000000000..4e304ec65
--- /dev/null
+++ b/scripts/db/cargo-discard-consolidated-incremental-20261014.sql
@@ -0,0 +1,190 @@
+-- 货物废弃增量汇总（2026-10-14），MySQL 8.0.16+，可重复执行。
+-- 目标仅 baiyue_lastleg，连接实例和凭据由执行者指定。
+-- 前提：已有尾程入仓箱、退货库存及出库基线；不是空库初始化脚本。
+-- 覆盖基础废弃表、PDA完工、退货箱废弃、照片、通用库存及部分选箱。
+-- 不回填历史单据、不补造出库单、不修改库存数量、不执行业务DML。
+-- File复用已有文件表，无需修改 baiyue_file 或仓储资源库。
+-- 完整执行，遇错停止，不使用 --force；DDL隐式提交，失败修正后可重跑。
+-- 已有同名表/列/索引沿用，不修复任意未知旧结构，末尾输出结构供核对。
+USE `baiyue_lastleg`;
+SET NAMES utf8mb4;
+SELECT DATABASE() AS target_database, @@hostname AS mysql_host, @@port AS mysql_port, VERSION() AS mysql_version;
+
+-- 一、废弃业务表，存在则保留。
+CREATE TABLE IF NOT EXISTS ll_cargo_discard_application (
+  id BIGINT NOT NULL COMMENT '主键ID', customer_id VARCHAR(128) NOT NULL COMMENT '客户租户ID',
+  customer_confirmed_at DATETIME(3) NULL COMMENT '客户确认完成时间',
+  discard_no VARCHAR(64) NOT NULL COMMENT '废弃申请单号', overseas_warehouse_id VARCHAR(128) NOT NULL COMMENT '海外仓ID',
+  overseas_warehouse_name VARCHAR(255) NULL COMMENT '海外仓名称快照', inbound_codes VARCHAR(2000) NOT NULL COMMENT '入仓单号集合',
+  total_packages INT NOT NULL COMMENT '总箱数', fee_per_package DECIMAL(18,2) NOT NULL COMMENT '每箱处理费用',
+  total_fee DECIMAL(18,2) NOT NULL COMMENT '费用合计', currency CHAR(3) NOT NULL DEFAULT 'USD' COMMENT '币种',
+  status VARCHAR(32) NOT NULL DEFAULT 'PENDING_REVIEW' COMMENT '业务状态', remark VARCHAR(1000) NULL COMMENT '备注',
+  idempotency_key VARCHAR(255) NOT NULL COMMENT '业务幂等键', request_hash CHAR(64) NOT NULL COMMENT '请求内容哈希',
+  created_by VARCHAR(128) NULL COMMENT '创建人ID', reviewed_by VARCHAR(128) NULL COMMENT '审核人ID', review_remark VARCHAR(1000) NULL COMMENT '审核备注',
+  review_idempotency_key VARCHAR(255) NULL COMMENT '审核幂等键', review_request_hash CHAR(64) NULL COMMENT '审核请求内容哈希',
+  reviewed_at DATETIME(3) NULL COMMENT '审核时间', created_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) COMMENT '创建时间',
+  updated_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) ON UPDATE CURRENT_TIMESTAMP(3) COMMENT '更新时间',
+  PRIMARY KEY(id), UNIQUE KEY uk_ll_cargo_discard_no(customer_id,discard_no),
+  UNIQUE KEY uk_ll_cargo_discard_key(customer_id,idempotency_key),
+  KEY idx_ll_cargo_discard_list(customer_id,status,created_at),
+  KEY idx_ll_cargo_discard_warehouse(customer_id,overseas_warehouse_id,created_at)
+) ENGINE=InnoDB COMMENT='货物废弃申请单';
+
+CREATE TABLE IF NOT EXISTS ll_cargo_discard_item (
+  id BIGINT NOT NULL COMMENT '主键ID', application_id BIGINT NOT NULL COMMENT '申请单ID', customer_id VARCHAR(128) NOT NULL COMMENT '客户租户ID',
+  order_id BIGINT NULL COMMENT '一件代发订单ID', source_type VARCHAR(32) NOT NULL DEFAULT 'DROPSHIP' COMMENT '库存来源：一件代发DROPSHIP、退货箱RETURN_CARTON、通用库存INVENTORY',
+  return_carton_id BIGINT NULL COMMENT '退货库存箱ID', inbound_code VARCHAR(128) NOT NULL COMMENT '入仓单号快照', profile_id BIGINT NULL COMMENT '托盘档案ID',
+  sku_inventory_id BIGINT NULL COMMENT 'SKU库存记录ID', sku_code VARCHAR(128) NOT NULL COMMENT 'SKU编码', product_name VARCHAR(255) NULL COMMENT '产品名称',
+  available_packages_snapshot INT NOT NULL COMMENT '可用箱数快照', discard_packages INT NOT NULL COMMENT '申请废弃箱数',
+  inventory_position_id BIGINT NULL COMMENT '废弃来源库存仓位ID',
+  carton_marks_json TEXT NULL COMMENT '本次废弃所选真实箱唛快照JSON数组',
+  carton_scan_required TINYINT(1) NOT NULL DEFAULT 0 COMMENT '是否需要逐箱核对本次所选箱子',
+  completion_photo_file_ids TEXT NULL COMMENT 'PDA完工照片文件ID JSON数组',
+  actual_discard_packages INT NULL COMMENT 'PDA确认实际废弃箱数', pda_status VARCHAR(32) NOT NULL DEFAULT 'PENDING' COMMENT 'PDA处理状态：待处理PENDING、已完成COMPLETED',
+  pda_operator_id VARCHAR(128) NULL COMMENT 'PDA操作人', pda_completed_at DATETIME(3) NULL COMMENT 'PDA完成时间',
+  created_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) COMMENT '创建时间', PRIMARY KEY(id),
+  UNIQUE KEY uk_ll_cargo_discard_item(application_id,profile_id,sku_code),
+  UNIQUE KEY uk_ll_discard_position_sku(application_id,inventory_position_id,sku_code),
+  KEY idx_ll_cargo_discard_item_list(customer_id,application_id),
+  KEY idx_ll_cargo_discard_item_inbound(customer_id,inbound_code,sku_code)
+) ENGINE=InnoDB COMMENT='货物废弃SKU明细';
+
+CREATE TABLE IF NOT EXISTS ll_cargo_discard_carton (
+  id BIGINT NOT NULL COMMENT '主键ID', application_id BIGINT NOT NULL COMMENT '申请单ID', item_id BIGINT NOT NULL COMMENT '明细ID',
+  customer_id VARCHAR(128) NOT NULL COMMENT '客户租户ID', carton_id BIGINT NOT NULL COMMENT '箱唛记录ID', carton_mark VARCHAR(128) NOT NULL COMMENT '箱唛',
+  source_type VARCHAR(32) NOT NULL DEFAULT 'DROPSHIP' COMMENT '箱子来源：一件代发DROPSHIP、入仓箱INBOUND、转运箱TRANSFER',
+  created_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) COMMENT '创建时间', PRIMARY KEY(id),
+  UNIQUE KEY uk_ll_cargo_discard_carton(application_id,carton_id),
+  KEY idx_ll_cargo_discard_carton_application(customer_id,application_id,item_id),
+  KEY idx_ll_cargo_discard_carton_identity(customer_id,carton_id)
+) ENGINE=InnoDB COMMENT='货物废弃锁定箱明细';
+
+CREATE TABLE IF NOT EXISTS ll_cargo_discard_status_history (
+  id BIGINT NOT NULL COMMENT '主键ID', application_id BIGINT NOT NULL COMMENT '申请单ID', customer_id VARCHAR(128) NOT NULL COMMENT '客户租户ID',
+  from_status VARCHAR(32) NULL COMMENT '变更前状态', to_status VARCHAR(32) NOT NULL COMMENT '变更后状态', operator_id VARCHAR(128) NULL COMMENT '操作人ID',
+  remark VARCHAR(1000) NULL COMMENT '备注', created_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) COMMENT '创建时间', PRIMARY KEY(id),
+  KEY idx_ll_cargo_discard_history(customer_id,application_id,created_at)
+) ENGINE=InnoDB COMMENT='货物废弃审批历史';
+
+CREATE TABLE IF NOT EXISTS ll_cargo_discard_photo (
+  id BIGINT NOT NULL,
+  customer_id VARCHAR(64) NOT NULL,
+  application_id BIGINT NOT NULL,
+  pallet_no VARCHAR(128) NOT NULL,
+  file_id BIGINT NOT NULL,
+  file_name VARCHAR(255) NOT NULL,
+  content_type VARCHAR(128) NOT NULL,
+  size_bytes BIGINT NOT NULL,
+  operator_id VARCHAR(64) NOT NULL,
+  created_at DATETIME(6) NOT NULL,
+  submitted_at DATETIME(6) NULL,
+  PRIMARY KEY (id),
+  UNIQUE KEY uk_cargo_discard_photo_file (file_id),
+  KEY idx_cargo_discard_photo_application (customer_id, application_id, pallet_no)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+-- 二、补齐已有表的PDA字段及完工照片快照。
+SET @ddl = IF(NOT EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_cargo_discard_application' AND column_name='customer_confirmed_at'),
+  'ALTER TABLE ll_cargo_discard_application ADD COLUMN customer_confirmed_at DATETIME(3) NULL COMMENT ''客户确认完成时间''', 'SELECT 1');
+PREPARE stmt FROM @ddl; EXECUTE stmt; DEALLOCATE PREPARE stmt;
+
+SET @ddl = IF(NOT EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_cargo_discard_item' AND column_name='actual_discard_packages'),
+  'ALTER TABLE ll_cargo_discard_item ADD COLUMN actual_discard_packages INT NULL COMMENT ''PDA确认实际废弃箱数''', 'SELECT 1');
+PREPARE stmt FROM @ddl; EXECUTE stmt; DEALLOCATE PREPARE stmt;
+
+SET @ddl = IF(NOT EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_cargo_discard_item' AND column_name='pda_status'),
+  'ALTER TABLE ll_cargo_discard_item ADD COLUMN pda_status VARCHAR(32) NOT NULL DEFAULT ''PENDING'' COMMENT ''PDA处理状态：待处理PENDING、已完成COMPLETED''', 'SELECT 1');
+PREPARE stmt FROM @ddl; EXECUTE stmt; DEALLOCATE PREPARE stmt;
+
+SET @ddl = IF(NOT EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_cargo_discard_item' AND column_name='pda_operator_id'),
+  'ALTER TABLE ll_cargo_discard_item ADD COLUMN pda_operator_id VARCHAR(128) NULL COMMENT ''PDA操作人''', 'SELECT 1');
+PREPARE stmt FROM @ddl; EXECUTE stmt; DEALLOCATE PREPARE stmt;
+
+SET @ddl = IF(NOT EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_cargo_discard_item' AND column_name='pda_completed_at'),
+  'ALTER TABLE ll_cargo_discard_item ADD COLUMN pda_completed_at DATETIME(3) NULL COMMENT ''PDA完成时间''', 'SELECT 1');
+PREPARE stmt FROM @ddl; EXECUTE stmt; DEALLOCATE PREPARE stmt;
+
+SET @ddl = IF(NOT EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_cargo_discard_item' AND column_name='completion_photo_file_ids'),
+  'ALTER TABLE ll_cargo_discard_item ADD COLUMN completion_photo_file_ids TEXT NULL COMMENT ''PDA完工照片文件ID JSON数组''', 'SELECT 1');
+PREPARE stmt FROM @ddl; EXECUTE stmt; DEALLOCATE PREPARE stmt;
+
+-- 三、退货箱来源和废弃状态约束（V4）。
+ALTER TABLE ll_cargo_discard_item
+  MODIFY COLUMN order_id BIGINT NULL COMMENT '一件代发订单ID',
+  MODIFY COLUMN profile_id BIGINT NULL COMMENT '托盘档案ID',
+  MODIFY COLUMN sku_inventory_id BIGINT NULL COMMENT 'SKU库存记录ID';
+
+SET @ddl = IF(EXISTS (SELECT 1 FROM information_schema.table_constraints WHERE constraint_schema=DATABASE() AND table_name='ll_return_inventory_carton' AND constraint_name='chk_ll_return_inventory_carton_quantity'),
+  'ALTER TABLE ll_return_inventory_carton DROP CHECK chk_ll_return_inventory_carton_quantity, ADD CONSTRAINT chk_ll_return_inventory_carton_quantity CHECK((status IN(''AVAILABLE'',''PACKING_RESERVED'',''RELABEL_PENDING'',''OUTBOUND_PENDING'',''OUTBOUNDED'',''DISCARD_PENDING'') AND sku_types>0 AND total_quantity>0) OR (status IN(''MERGED'',''DISCARDED'') AND sku_types=0 AND total_quantity=0))',
+  'ALTER TABLE ll_return_inventory_carton ADD CONSTRAINT chk_ll_return_inventory_carton_quantity CHECK((status IN(''AVAILABLE'',''PACKING_RESERVED'',''RELABEL_PENDING'',''OUTBOUND_PENDING'',''OUTBOUNDED'',''DISCARD_PENDING'') AND sku_types>0 AND total_quantity>0) OR (status IN(''MERGED'',''DISCARDED'') AND sku_types=0 AND total_quantity=0))');
+PREPARE stmt FROM @ddl; EXECUTE stmt; DEALLOCATE PREPARE stmt;
+
+SET @ddl = IF(EXISTS (SELECT 1 FROM information_schema.table_constraints WHERE constraint_schema=DATABASE() AND table_name='ll_return_inventory_carton' AND constraint_name='chk_ll_return_inventory_carton_status'),
+  'ALTER TABLE ll_return_inventory_carton DROP CHECK chk_ll_return_inventory_carton_status, ADD CONSTRAINT chk_ll_return_inventory_carton_status CHECK(status IN(''AVAILABLE'',''PACKING_RESERVED'',''RELABEL_PENDING'',''OUTBOUND_PENDING'',''MERGED'',''OUTBOUNDED'',''DISCARD_PENDING'',''DISCARDED''))',
+  'ALTER TABLE ll_return_inventory_carton ADD CONSTRAINT chk_ll_return_inventory_carton_status CHECK(status IN(''AVAILABLE'',''PACKING_RESERVED'',''RELABEL_PENDING'',''OUTBOUND_PENDING'',''MERGED'',''OUTBOUNDED'',''DISCARD_PENDING'',''DISCARDED''))');
+PREPARE stmt FROM @ddl; EXECUTE stmt; DEALLOCATE PREPARE stmt;
+
+SET @ddl = IF(NOT EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_cargo_discard_item' AND column_name='source_type'),
+  'ALTER TABLE ll_cargo_discard_item ADD COLUMN source_type VARCHAR(32) NOT NULL DEFAULT ''DROPSHIP'' COMMENT ''库存来源：一件代发DROPSHIP、退货箱RETURN_CARTON'' AFTER order_id', 'SELECT 1');
+PREPARE stmt FROM @ddl; EXECUTE stmt; DEALLOCATE PREPARE stmt;
+
+SET @ddl = IF(NOT EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_cargo_discard_item' AND column_name='return_carton_id'),
+  'ALTER TABLE ll_cargo_discard_item ADD COLUMN return_carton_id BIGINT NULL COMMENT ''退货库存箱ID'' AFTER source_type', 'SELECT 1');
+PREPARE stmt FROM @ddl; EXECUTE stmt; DEALLOCATE PREPARE stmt;
+
+SET @ddl = IF(NOT EXISTS (SELECT 1 FROM information_schema.statistics WHERE table_schema=DATABASE() AND table_name='ll_cargo_discard_item' AND index_name='idx_ll_cargo_discard_return_carton'),
+  'ALTER TABLE ll_cargo_discard_item ADD KEY idx_ll_cargo_discard_return_carton(customer_id,return_carton_id)', 'SELECT 1');
+PREPARE stmt FROM @ddl; EXECUTE stmt; DEALLOCATE PREPARE stmt;
+
+
+-- 四、通用库存、部分选箱、箱来源（V25）。
+-- 货物废弃支持所有入库来源及散箱全量作业；不回填或修改历史单据。
+SET @ddl = IF(NOT EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_cargo_discard_item' AND column_name='inventory_position_id'),
+  'ALTER TABLE ll_cargo_discard_item ADD COLUMN inventory_position_id BIGINT NULL COMMENT ''废弃来源库存仓位ID''', 'SELECT 1');
+PREPARE stmt FROM @ddl; EXECUTE stmt; DEALLOCATE PREPARE stmt;
+
+SET @ddl = IF(NOT EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_cargo_discard_item' AND column_name='carton_marks_json'),
+  'ALTER TABLE ll_cargo_discard_item ADD COLUMN carton_marks_json TEXT NULL COMMENT ''本次废弃所选真实箱唛快照JSON数组''', 'SELECT 1');
+PREPARE stmt FROM @ddl; EXECUTE stmt; DEALLOCATE PREPARE stmt;
+
+SET @ddl = IF(NOT EXISTS (SELECT 1 FROM information_schema.statistics WHERE table_schema=DATABASE() AND table_name='ll_cargo_discard_item' AND index_name='uk_ll_discard_position_sku'),
+  'ALTER TABLE ll_cargo_discard_item ADD UNIQUE KEY uk_ll_discard_position_sku(application_id,inventory_position_id,sku_code)', 'SELECT 1');
+PREPARE stmt FROM @ddl; EXECUTE stmt; DEALLOCATE PREPARE stmt;
+
+ALTER TABLE ll_cargo_discard_item MODIFY COLUMN source_type VARCHAR(32) NOT NULL DEFAULT 'DROPSHIP' COMMENT '库存来源：一件代发DROPSHIP、退货箱RETURN_CARTON、通用库存INVENTORY';
+
+SET @ddl = IF(NOT EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_cargo_discard_item' AND column_name='carton_scan_required'),
+  'ALTER TABLE ll_cargo_discard_item ADD COLUMN carton_scan_required TINYINT(1) NOT NULL DEFAULT 0 COMMENT ''是否需要逐箱核对本次所选箱子''', 'SELECT 1');
+PREPARE stmt FROM @ddl; EXECUTE stmt; DEALLOCATE PREPARE stmt;
+ALTER TABLE ll_cargo_discard_item MODIFY COLUMN carton_marks_json TEXT NULL COMMENT '本次废弃所选真实箱唛快照JSON数组';
+ALTER TABLE ll_inbound_plan_carton MODIFY COLUMN status VARCHAR(32) NOT NULL COMMENT '箱唛状态：未绑定UNASSIGNED、已绑托ON_PALLET、整票收货BULK_RECEIVED、可用AVAILABLE、待废弃DISCARD_PENDING、已废弃DISCARDED';
+
+SET @ddl = IF(NOT EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_cargo_discard_carton' AND column_name='source_type'),
+  'ALTER TABLE ll_cargo_discard_carton ADD COLUMN source_type VARCHAR(32) NOT NULL DEFAULT ''DROPSHIP'' COMMENT ''箱子来源：一件代发DROPSHIP、入仓箱INBOUND、转运箱TRANSFER''', 'SELECT 1');
+PREPARE stmt FROM @ddl; EXECUTE stmt; DEALLOCATE PREPARE stmt;
+
+
+-- 五、退货箱SKU归零约束（V26）。
+-- 整箱废弃后保留SKU明细，剩余数量允许归零，仍禁止负库存。
+-- 原子替换约束，可重复执行；不修改业务记录。
+SET @ddl = IF(EXISTS (
+  SELECT 1 FROM information_schema.table_constraints
+  WHERE constraint_schema=DATABASE() AND table_name='ll_return_inventory_carton_item'
+    AND constraint_name='chk_ll_return_inventory_carton_item_quantity'
+),
+  'ALTER TABLE ll_return_inventory_carton_item DROP CHECK chk_ll_return_inventory_carton_item_quantity, ADD CONSTRAINT chk_ll_return_inventory_carton_item_quantity CHECK(quantity>=0)',
+  'ALTER TABLE ll_return_inventory_carton_item ADD CONSTRAINT chk_ll_return_inventory_carton_item_quantity CHECK(quantity>=0)'
+);
+PREPARE stmt FROM @ddl;
+EXECUTE stmt;
+DEALLOCATE PREPARE stmt;
+
+-- 六、只读核对。
+SHOW CREATE TABLE `ll_cargo_discard_application`;
+SHOW CREATE TABLE `ll_cargo_discard_item`;
+SHOW CREATE TABLE `ll_cargo_discard_carton`;
+SHOW CREATE TABLE `ll_cargo_discard_status_history`;
+SHOW CREATE TABLE `ll_cargo_discard_photo`;
+SHOW CREATE TABLE `ll_return_inventory_carton`;
+SHOW CREATE TABLE `ll_inbound_plan_carton`;
+SHOW CREATE TABLE ll_return_inventory_carton_item;
diff --git a/scripts/db/cargo-discard-customer-confirmation-incremental-20261014.sql b/scripts/db/cargo-discard-customer-confirmation-incremental-20261014.sql
new file mode 100644
index 000000000..935f51f40
--- /dev/null
+++ b/scripts/db/cargo-discard-customer-confirmation-incremental-20261014.sql
@@ -0,0 +1,30 @@
+-- 客户照片确认功能增量，MySQL 8.0.16+，可重复执行。
+-- 完整执行，遇错停止；须连接同时承载这两个业务库的指定实例。
+-- 仅新增确认时间和权限，不确认/回填任何历史业务单据。
+USE `baiyue_lastleg`;
+-- 客户确认废弃完结时间，可重复执行；仅结构变更。
+SET @ddl = IF(NOT EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_cargo_discard_application' AND column_name='customer_confirmed_at'), 'ALTER TABLE ll_cargo_discard_application ADD COLUMN customer_confirmed_at DATETIME(3) NULL COMMENT ''客户确认废弃完结时间''', 'SELECT 1');
+PREPARE stmt FROM @ddl; EXECUTE stmt; DEALLOCATE PREPARE stmt;
+
+USE `baiyue_iam`;
+-- 仅 baiyue_iam，新增客户废弃确认按钮权限并授权默认客户管理员。
+-- 自定义客户角色由管理员按需分配；不自动扩大其权限。
+-- 可重复执行；授权和持久化安全版本在同一事务提交。
+START TRANSACTION;
+INSERT INTO iam_permission(id,tenant_id,app_code,permission_type,parent_id,permission_code,permission_name,route_path,http_method,sort_no,status,built_in,deleted)
+VALUES (5306183,0,'MERCHANT','BUTTON',5306180,'merchant:overseas-warehouse:discard:confirm','确认废弃完成',NULL,'POST',30,'ACTIVE',1,0)
+ON DUPLICATE KEY UPDATE permission_name=VALUES(permission_name),status='ACTIVE',deleted=0;
+INSERT IGNORE INTO iam_role_permission(tenant_id,role_id,permission_id,created_at)
+SELECT 0,r.id,p.id,NOW(3) FROM iam_role r JOIN iam_permission p
+  ON p.tenant_id=0 AND p.app_code='MERCHANT' AND p.permission_code='merchant:overseas-warehouse:discard:confirm'
+WHERE r.tenant_id=0 AND r.app_code='MERCHANT' AND r.role_code='MERCHANT_OWNER' AND r.status='ACTIVE' AND r.deleted=0;
+INSERT INTO iam_security_subject_version(auth_user_id,permission_version)
+SELECT DISTINCT u.auth_user_id,1 FROM iam_user u
+JOIN iam_membership m ON m.user_id=u.id
+JOIN iam_membership_role mr ON mr.membership_id=m.id AND mr.tenant_id=m.tenant_id
+JOIN iam_role r ON r.id=mr.role_id
+WHERE u.auth_user_id IS NOT NULL AND u.status='ACTIVE' AND u.deleted=0
+  AND m.status='ACTIVE' AND m.deleted=0 AND r.tenant_id=0 AND r.app_code='MERCHANT'
+  AND r.role_code='MERCHANT_OWNER' AND r.status='ACTIVE' AND r.deleted=0
+ON DUPLICATE KEY UPDATE permission_version=permission_version+1;
+COMMIT;
diff --git a/scripts/db/cargo-discard-item-columns-repair-20261014.sql b/scripts/db/cargo-discard-item-columns-repair-20261014.sql
new file mode 100644
index 000000000..635111a60
--- /dev/null
+++ b/scripts/db/cargo-discard-item-columns-repair-20261014.sql
@@ -0,0 +1,53 @@
+-- 废弃明细新增字段专项补齐，MySQL 8.0.16+，可重复执行。
+-- 仅 baiyue_lastleg；前提是 ll_cargo_discard_item 已存在。
+-- 独立于退货库存约束，无需先执行其他汇总章节。
+-- 不修改业务记录或库存数量；完整执行，遇错停止，DDL隐式提交。
+USE `baiyue_lastleg`;
+SET NAMES utf8mb4;
+SELECT DATABASE() AS target_database, @@hostname AS mysql_host, @@port AS mysql_port;
+
+SET @ddl = IF(NOT EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_cargo_discard_item' AND column_name='actual_discard_packages'),
+  'ALTER TABLE ll_cargo_discard_item ADD COLUMN actual_discard_packages INT NULL COMMENT ''PDA确认实际废弃箱数''', 'SELECT 1');
+PREPARE stmt FROM @ddl; EXECUTE stmt; DEALLOCATE PREPARE stmt;
+
+SET @ddl = IF(NOT EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_cargo_discard_item' AND column_name='pda_status'),
+  'ALTER TABLE ll_cargo_discard_item ADD COLUMN pda_status VARCHAR(32) NOT NULL DEFAULT ''PENDING'' COMMENT ''PDA处理状态：待处理PENDING、已完成COMPLETED''', 'SELECT 1');
+PREPARE stmt FROM @ddl; EXECUTE stmt; DEALLOCATE PREPARE stmt;
+
+SET @ddl = IF(NOT EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_cargo_discard_item' AND column_name='pda_operator_id'),
+  'ALTER TABLE ll_cargo_discard_item ADD COLUMN pda_operator_id VARCHAR(128) NULL COMMENT ''PDA操作人''', 'SELECT 1');
+PREPARE stmt FROM @ddl; EXECUTE stmt; DEALLOCATE PREPARE stmt;
+
+SET @ddl = IF(NOT EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_cargo_discard_item' AND column_name='pda_completed_at'),
+  'ALTER TABLE ll_cargo_discard_item ADD COLUMN pda_completed_at DATETIME(3) NULL COMMENT ''PDA完成时间''', 'SELECT 1');
+PREPARE stmt FROM @ddl; EXECUTE stmt; DEALLOCATE PREPARE stmt;
+
+SET @ddl = IF(NOT EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_cargo_discard_item' AND column_name='completion_photo_file_ids'),
+  'ALTER TABLE ll_cargo_discard_item ADD COLUMN completion_photo_file_ids TEXT NULL COMMENT ''PDA完工照片文件ID JSON数组''', 'SELECT 1');
+PREPARE stmt FROM @ddl; EXECUTE stmt; DEALLOCATE PREPARE stmt;
+
+SET @ddl = IF(NOT EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_cargo_discard_item' AND column_name='source_type'),
+  'ALTER TABLE ll_cargo_discard_item ADD COLUMN source_type VARCHAR(32) NOT NULL DEFAULT ''DROPSHIP'' COMMENT ''库存来源：一件代发DROPSHIP、退货箱RETURN_CARTON'' AFTER order_id', 'SELECT 1');
+PREPARE stmt FROM @ddl; EXECUTE stmt; DEALLOCATE PREPARE stmt;
+
+SET @ddl = IF(NOT EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_cargo_discard_item' AND column_name='return_carton_id'),
+  'ALTER TABLE ll_cargo_discard_item ADD COLUMN return_carton_id BIGINT NULL COMMENT ''退货库存箱ID'' AFTER source_type', 'SELECT 1');
+PREPARE stmt FROM @ddl; EXECUTE stmt; DEALLOCATE PREPARE stmt;
+
+SET @ddl = IF(NOT EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_cargo_discard_item' AND column_name='inventory_position_id'),
+  'ALTER TABLE ll_cargo_discard_item ADD COLUMN inventory_position_id BIGINT NULL COMMENT ''废弃来源库存仓位ID''', 'SELECT 1');
+PREPARE stmt FROM @ddl; EXECUTE stmt; DEALLOCATE PREPARE stmt;
+
+SET @ddl = IF(NOT EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_cargo_discard_item' AND column_name='carton_marks_json'),
+  'ALTER TABLE ll_cargo_discard_item ADD COLUMN carton_marks_json TEXT NULL COMMENT ''本次废弃所选真实箱唛快照JSON数组''', 'SELECT 1');
+PREPARE stmt FROM @ddl; EXECUTE stmt; DEALLOCATE PREPARE stmt;
+
+SET @ddl = IF(NOT EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_cargo_discard_item' AND column_name='carton_scan_required'),
+  'ALTER TABLE ll_cargo_discard_item ADD COLUMN carton_scan_required TINYINT(1) NOT NULL DEFAULT 0 COMMENT ''是否需要逐箱核对本次所选箱子''', 'SELECT 1');
+PREPARE stmt FROM @ddl; EXECUTE stmt; DEALLOCATE PREPARE stmt;
+-- 核对新增字段；应返回10行。
+SELECT column_name, column_type, is_nullable, column_default
+FROM information_schema.columns
+WHERE table_schema=DATABASE() AND table_name='ll_cargo_discard_item'
+AND column_name IN ('actual_discard_packages','pda_status','pda_operator_id','pda_completed_at','completion_photo_file_ids','source_type','return_carton_id','inventory_position_id','carton_marks_json','carton_scan_required')
+ORDER BY ordinal_position;
diff --git a/scripts/db/cargo-discard-return-quantity-repair-20261014.sql b/scripts/db/cargo-discard-return-quantity-repair-20261014.sql
new file mode 100644
index 000000000..04f71cebe
--- /dev/null
+++ b/scripts/db/cargo-discard-return-quantity-repair-20261014.sql
@@ -0,0 +1,20 @@
+-- MySQL 8.0.16+；对Lastleg连接的实例完整执行，遇错停止。DDL隐式提交。
+USE `baiyue_lastleg`;
+SET NAMES utf8mb4;
+SELECT DATABASE() AS target_database, @@hostname AS mysql_host, @@port AS mysql_port;
+
+-- 整箱废弃后保留SKU明细，剩余数量允许归零，仍禁止负库存。
+-- 原子替换约束，可重复执行；不修改业务记录。
+SET @ddl = IF(EXISTS (
+  SELECT 1 FROM information_schema.table_constraints
+  WHERE constraint_schema=DATABASE() AND table_name='ll_return_inventory_carton_item'
+    AND constraint_name='chk_ll_return_inventory_carton_item_quantity'
+),
+  'ALTER TABLE ll_return_inventory_carton_item DROP CHECK chk_ll_return_inventory_carton_item_quantity, ADD CONSTRAINT chk_ll_return_inventory_carton_item_quantity CHECK(quantity>=0)',
+  'ALTER TABLE ll_return_inventory_carton_item ADD CONSTRAINT chk_ll_return_inventory_carton_item_quantity CHECK(quantity>=0)'
+);
+PREPARE stmt FROM @ddl;
+EXECUTE stmt;
+DEALLOCATE PREPARE stmt;
+
+SHOW CREATE TABLE ll_return_inventory_carton_item;
diff --git a/scripts/db/incremental.sql b/scripts/db/incremental.sql
index 3215f965f..7a50e38a8 100644
--- a/scripts/db/incremental.sql
+++ b/scripts/db/incremental.sql
@@ -1388,9 +1388,13 @@ CREATE TABLE IF NOT EXISTS ll_cargo_discard_item (
   id BIGINT NOT NULL COMMENT '主键ID', application_id BIGINT NOT NULL COMMENT '申请单ID', customer_id VARCHAR(128) NOT NULL COMMENT '客户租户ID',
   order_id BIGINT NOT NULL COMMENT '订单ID', inbound_code VARCHAR(128) NOT NULL COMMENT '入仓单号快照', profile_id BIGINT NOT NULL COMMENT '托盘档案ID',
   sku_inventory_id BIGINT NOT NULL COMMENT 'SKU库存记录ID', sku_code VARCHAR(128) NOT NULL COMMENT 'SKU编码', product_name VARCHAR(255) NULL COMMENT '产品名称',
+  inventory_position_id BIGINT NULL COMMENT '废弃来源库存仓位ID',
+  carton_marks_json TEXT NULL COMMENT '本次废弃所选真实箱唛快照JSON数组',
+  carton_scan_required TINYINT(1) NOT NULL DEFAULT 0 COMMENT '是否需要逐箱核对本次所选箱子',
   available_packages_snapshot INT NOT NULL COMMENT '可用箱数快照', discard_packages INT NOT NULL COMMENT '废弃箱数',
   created_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) COMMENT '创建时间', PRIMARY KEY(id),
   UNIQUE KEY uk_ll_cargo_discard_item(application_id,profile_id,sku_code),
+  UNIQUE KEY uk_ll_discard_position_sku(application_id,inventory_position_id,sku_code),
   KEY idx_ll_cargo_discard_item_list(customer_id,application_id),
   KEY idx_ll_cargo_discard_item_inbound(customer_id,inbound_code,sku_code)
 ) ENGINE=InnoDB COMMENT='货物废弃SKU明细';
@@ -1398,6 +1402,7 @@ CREATE TABLE IF NOT EXISTS ll_cargo_discard_item (
 CREATE TABLE IF NOT EXISTS ll_cargo_discard_carton (
   id BIGINT NOT NULL COMMENT '主键ID', application_id BIGINT NOT NULL COMMENT '申请单ID', item_id BIGINT NOT NULL COMMENT '明细ID',
   customer_id VARCHAR(128) NOT NULL COMMENT '客户租户ID', carton_id BIGINT NOT NULL COMMENT '箱唛记录ID', carton_mark VARCHAR(128) NOT NULL COMMENT '箱唛',
+  source_type VARCHAR(32) NOT NULL DEFAULT 'DROPSHIP' COMMENT '箱子来源：一件代发DROPSHIP、入仓箱INBOUND、转运箱TRANSFER',
   created_at DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3) COMMENT '创建时间', PRIMARY KEY(id),
   UNIQUE KEY uk_ll_cargo_discard_carton(application_id,carton_id),
   KEY idx_ll_cargo_discard_carton_application(customer_id,application_id,item_id),
@@ -4134,7 +4139,7 @@ SET @ddl = (SELECT IF(EXISTS (SELECT 1 FROM information_schema.columns WHERE tab
 PREPARE return_inventory_carton_dimension_stmt FROM @ddl; EXECUTE return_inventory_carton_dimension_stmt; DEALLOCATE PREPARE return_inventory_carton_dimension_stmt;
 CREATE TABLE IF NOT EXISTS ll_return_inventory_carton_item (
  id BIGINT NOT NULL COMMENT '退货库存箱SKU明细ID', carton_id BIGINT NOT NULL COMMENT '退货库存箱ID', customer_id VARCHAR(128) NOT NULL COMMENT '客户ID和隔离键', sku_code VARCHAR(128) NOT NULL COMMENT 'SKU编码', product_name_zh VARCHAR(255) NULL COMMENT '中文品名', quantity BIGINT NOT NULL COMMENT '该SKU箱内数量',
- PRIMARY KEY(id), UNIQUE KEY uk_ll_return_inventory_carton_item(carton_id,sku_code), KEY idx_ll_return_inventory_carton_item_customer(customer_id,sku_code), CONSTRAINT chk_ll_return_inventory_carton_item_quantity CHECK(quantity>0)
+ PRIMARY KEY(id), UNIQUE KEY uk_ll_return_inventory_carton_item(carton_id,sku_code), KEY idx_ll_return_inventory_carton_item_customer(customer_id,sku_code), CONSTRAINT chk_ll_return_inventory_carton_item_quantity CHECK(quantity>=0)
 ) ENGINE=InnoDB COMMENT='退货库存箱内SKU和数量';
 CREATE TABLE IF NOT EXISTS ll_return_inventory_balance (
  id BIGINT NOT NULL COMMENT '退货库存余额ID', customer_id VARCHAR(128) NOT NULL COMMENT '客户ID和隔离键', overseas_warehouse_id VARCHAR(128) NOT NULL COMMENT '海外仓ID', sku_code VARCHAR(128) NOT NULL COMMENT 'SKU编码', product_name_zh VARCHAR(255) NULL COMMENT '中文品名', total_quantity BIGINT NOT NULL DEFAULT 0 COMMENT '实物总库存，仅实际出库扣减', available_quantity BIGINT NOT NULL COMMENT '未合箱可用上架数量', carton_quantity BIGINT NOT NULL COMMENT '包含该SKU的可用箱数', created_at DATETIME(3) NOT NULL COMMENT '创建时间', updated_at DATETIME(3) NOT NULL COMMENT '最后更新时间',
@@ -5054,3 +5059,53 @@ SET @return_sku_index_ddl = IF(EXISTS(SELECT 1 FROM information_schema.statistic
 PREPARE return_sku_index_stmt FROM @return_sku_index_ddl;
 EXECUTE return_sku_index_stmt;
 DEALLOCATE PREPARE return_sku_index_stmt;
+
+-- 退货以包裹/箱为最小出库实物单位；部分数量必须先合箱生成新标签箱。
+-- 可重复执行，目标库 baiyue_lastleg。
+USE baiyue_lastleg;
+
+-- 合箱后的新箱与原包裹共用同一箱唛、标签和来源追溯模型。
+-- 流水约束允许部分合箱/拆分只扣件数，不虚减箱数。
+SET @ddl = IF(EXISTS(SELECT 1 FROM information_schema.table_constraints
+  WHERE constraint_schema=DATABASE() AND table_name='ll_return_inventory_outbound_movement'
+    AND constraint_name='chk_ll_return_outbound_movement_delta'),
+  'ALTER TABLE ll_return_inventory_outbound_movement DROP CHECK chk_ll_return_outbound_movement_delta, ADD CONSTRAINT chk_ll_return_outbound_movement_delta CHECK(quantity>0 AND total_after>=0 AND available_after>=0 AND total_before-total_after=quantity AND available_before-available_after=quantity AND cartons_after>=0 AND cartons_before-cartons_after IN (0,1) AND total_after>=available_after)',
+  'ALTER TABLE ll_return_inventory_outbound_movement ADD CONSTRAINT chk_ll_return_outbound_movement_delta CHECK(quantity>0 AND total_after>=0 AND available_after>=0 AND total_before-total_after=quantity AND available_before-available_after=quantity AND cartons_after>=0 AND cartons_before-cartons_after IN (0,1) AND total_after>=available_after)');
+PREPARE stmt FROM @ddl; EXECUTE stmt; DEALLOCATE PREPARE stmt;
+
+-- 同一包裹可分批合箱/出库，重复提交仍由 outbound_pick_id + SKU 幂等约束保护。
+SET @ddl = IF(EXISTS(SELECT 1 FROM information_schema.statistics
+  WHERE table_schema=DATABASE() AND table_name='ll_return_inventory_outbound_movement'
+    AND index_name='uk_ll_return_outbound_carton_sku'),
+  'ALTER TABLE ll_return_inventory_outbound_movement DROP INDEX uk_ll_return_outbound_carton_sku, ADD INDEX idx_ll_return_outbound_carton_sku(customer_id,carton_id,sku_code)',
+  'SELECT 1');
+PREPARE stmt FROM @ddl; EXECUTE stmt; DEALLOCATE PREPARE stmt;
+
+-- 新签收及新合箱必须打印并扫码确认标签；既有实物按原状态继续作业。
+SET @ddl = IF(EXISTS(SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_return_inventory_carton' AND column_name='label_status'), 'SELECT 1', 'ALTER TABLE ll_return_inventory_carton ADD COLUMN label_status VARCHAR(32) NULL COMMENT ''WAIT_LABEL待贴标 CONFIRMED已扫码确认标签''');
+PREPARE stmt FROM @ddl; EXECUTE stmt; DEALLOCATE PREPARE stmt;
+
+-- 货物废弃支持所有入库来源及散箱全量作业；不回填或修改历史单据。
+SET @ddl = IF(NOT EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_cargo_discard_item' AND column_name='inventory_position_id'),
+  'ALTER TABLE ll_cargo_discard_item ADD COLUMN inventory_position_id BIGINT NULL COMMENT ''废弃来源库存仓位ID''', 'SELECT 1');
+PREPARE stmt FROM @ddl; EXECUTE stmt; DEALLOCATE PREPARE stmt;
+
+SET @ddl = IF(NOT EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_cargo_discard_item' AND column_name='carton_marks_json'),
+  'ALTER TABLE ll_cargo_discard_item ADD COLUMN carton_marks_json TEXT NULL COMMENT ''本次废弃所选真实箱唛快照JSON数组''', 'SELECT 1');
+PREPARE stmt FROM @ddl; EXECUTE stmt; DEALLOCATE PREPARE stmt;
+
+SET @ddl = IF(NOT EXISTS (SELECT 1 FROM information_schema.statistics WHERE table_schema=DATABASE() AND table_name='ll_cargo_discard_item' AND index_name='uk_ll_discard_position_sku'),
+  'ALTER TABLE ll_cargo_discard_item ADD UNIQUE KEY uk_ll_discard_position_sku(application_id,inventory_position_id,sku_code)', 'SELECT 1');
+PREPARE stmt FROM @ddl; EXECUTE stmt; DEALLOCATE PREPARE stmt;
+
+ALTER TABLE ll_cargo_discard_item MODIFY COLUMN source_type VARCHAR(32) NOT NULL DEFAULT 'DROPSHIP' COMMENT '库存来源：一件代发DROPSHIP、退货箱RETURN_CARTON、通用库存INVENTORY';
+
+SET @ddl = IF(NOT EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_cargo_discard_item' AND column_name='carton_scan_required'),
+  'ALTER TABLE ll_cargo_discard_item ADD COLUMN carton_scan_required TINYINT(1) NOT NULL DEFAULT 0 COMMENT ''是否需要逐箱核对本次所选箱子''', 'SELECT 1');
+PREPARE stmt FROM @ddl; EXECUTE stmt; DEALLOCATE PREPARE stmt;
+ALTER TABLE ll_cargo_discard_item MODIFY COLUMN carton_marks_json TEXT NULL COMMENT '本次废弃所选真实箱唛快照JSON数组';
+ALTER TABLE ll_inbound_plan_carton MODIFY COLUMN status VARCHAR(32) NOT NULL COMMENT '箱唛状态：未绑定UNASSIGNED、已绑托ON_PALLET、整票收货BULK_RECEIVED、可用AVAILABLE、待废弃DISCARD_PENDING、已废弃DISCARDED';
+
+SET @ddl = IF(NOT EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_cargo_discard_carton' AND column_name='source_type'),
+  'ALTER TABLE ll_cargo_discard_carton ADD COLUMN source_type VARCHAR(32) NOT NULL DEFAULT ''DROPSHIP'' COMMENT ''箱子来源：一件代发DROPSHIP、入仓箱INBOUND、转运箱TRANSFER''', 'SELECT 1');
+PREPARE stmt FROM @ddl; EXECUTE stmt; DEALLOCATE PREPARE stmt;
diff --git a/scripts/db/return-consolidated-incremental-20261012.sql b/scripts/db/return-consolidated-incremental-20261012.sql
new file mode 100644
index 000000000..7fde07b3d
--- /dev/null
+++ b/scripts/db/return-consolidated-incremental-20261012.sql
@@ -0,0 +1,123 @@
+-- 退货近期增量汇总（2026-10-12），MySQL 8.0.16+，可重复执行。
+-- 连接到需要升级的 MySQL 实例后，整份执行；目标仅 baiyue_lastleg。
+-- USE 指定数据库，不指定服务器；本脚本不创建数据库，不写测试单据，不修改库存/清点事实。
+-- 前提：已有尾程和退货合箱/出库基线表（不是新库初始化脚本）。
+-- 汇总10月10日/12日直接退货增量，并补齐清点、事实数量及多次换标申请结构。
+-- 排车车队/IAM权限为独立业务基线，不纳入本退货脚本。
+-- PARCEL三类型换标、RETURN_PACK/RETURN_COMPLETION_TRANSFER历史以及清点续作均复用现有结构。
+-- DDL隐式提交；执行客户端遇错须停止，不使用 --force。可重复执行不等于整个脚本事务回滚。
+USE `baiyue_lastleg`;
+SELECT DATABASE() AS target_database, @@hostname AS mysql_host, @@port AS mysql_port, VERSION() AS mysql_version;
+
+-- 一、件数出库快照、部分扣件守恒、同箱分批出库索引。
+-- 退货单 SKU 按件数出库快照。目标库：baiyue_lastleg。可重复执行。
+USE baiyue_lastleg;
+SET @return_sku_quantity_ddl = IF(
+  EXISTS(SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE()
+    AND table_name='ll_outbound_pallet_item' AND column_name='return_sku_quantity'),
+  'SELECT 1',
+  'ALTER TABLE ll_outbound_pallet_item ADD COLUMN return_sku_quantity BIGINT NULL COMMENT ''退货单SKU本来源计划出库件数快照，NULL为历史整箱出库'' AFTER sku_code'
+);
+PREPARE return_sku_quantity_stmt FROM @return_sku_quantity_ddl;
+EXECUTE return_sku_quantity_stmt;
+DEALLOCATE PREPARE return_sku_quantity_stmt;
+
+-- 部分出库仅扣件数；整箱扣一箱，保留守恒和非负约束。
+SET @return_sku_check_ddl = IF(EXISTS(SELECT 1 FROM information_schema.table_constraints WHERE constraint_schema=DATABASE() AND table_name='ll_return_inventory_outbound_movement' AND constraint_name='chk_ll_return_outbound_movement_delta'), 'ALTER TABLE ll_return_inventory_outbound_movement DROP CHECK chk_ll_return_outbound_movement_delta, ADD CONSTRAINT chk_ll_return_outbound_movement_delta CHECK(quantity>0 AND total_after>=0 AND available_after>=0 AND total_before-total_after=quantity AND available_before-available_after=quantity AND cartons_after>=0 AND cartons_before-cartons_after IN (0,1) AND total_after>=available_after)', 'ALTER TABLE ll_return_inventory_outbound_movement ADD CONSTRAINT chk_ll_return_outbound_movement_delta CHECK(quantity>0 AND total_after>=0 AND available_after>=0 AND total_before-total_after=quantity AND available_before-available_after=quantity AND cartons_after>=0 AND cartons_before-cartons_after IN (0,1) AND total_after>=available_after)');
+PREPARE return_sku_check_stmt FROM @return_sku_check_ddl;
+EXECUTE return_sku_check_stmt;
+DEALLOCATE PREPARE return_sku_check_stmt;
+
+-- 二、标签状态（旧记录保留NULL，应用按既有兼容规则处理）。
+SET @ddl = IF(EXISTS(SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_return_inventory_carton' AND column_name='label_status'), 'SELECT 1', 'ALTER TABLE ll_return_inventory_carton ADD COLUMN label_status VARCHAR(32) NULL COMMENT ''WAIT_LABEL待贴标 CONFIRMED已扫码确认标签''');
+PREPARE stmt FROM @ddl; EXECUTE stmt; DEALLOCATE PREPARE stmt;
+
+-- 三、清点结构；不将历史已签收箱自动回退为待清点。
+-- 退货托盘签收箱内清点；MySQL 8；仅在目标尾程库执行，可重复运行。
+USE baiyue_lastleg;
+SET @rc_count_ddl = IF(EXISTS(SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_return_inventory_carton' AND column_name='count_status'),'SELECT 1','ALTER TABLE ll_return_inventory_carton ADD COLUMN count_status VARCHAR(16) NOT NULL DEFAULT ''CONFIRMED'' COMMENT ''箱内清点状态 PENDING待清点 CONFIRMED已确认''');
+PREPARE rc_count_stmt FROM @rc_count_ddl; EXECUTE rc_count_stmt; DEALLOCATE PREPARE rc_count_stmt;
+SET @rc_count_ddl = IF(EXISTS(SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_return_inventory_carton' AND column_name='counted_at'),'SELECT 1','ALTER TABLE ll_return_inventory_carton ADD COLUMN counted_at DATETIME(3) NULL COMMENT ''箱内清点确认时间''');
+PREPARE rc_count_stmt FROM @rc_count_ddl; EXECUTE rc_count_stmt; DEALLOCATE PREPARE rc_count_stmt;
+SET @rc_count_ddl = IF(EXISTS(SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_return_inventory_carton' AND column_name='counted_by'),'SELECT 1','ALTER TABLE ll_return_inventory_carton ADD COLUMN counted_by VARCHAR(128) NULL COMMENT ''箱内清点确认操作人''');
+PREPARE rc_count_stmt FROM @rc_count_ddl; EXECUTE rc_count_stmt; DEALLOCATE PREPARE rc_count_stmt;
+SET @rc_count_ddl = IF(EXISTS(SELECT 1 FROM information_schema.statistics WHERE table_schema=DATABASE() AND table_name='ll_return_inventory_carton' AND index_name='idx_ll_return_count'),'SELECT 1','CREATE INDEX idx_ll_return_count ON ll_return_inventory_carton(overseas_warehouse_id,count_status,status,source_receipt_id)');
+PREPARE rc_count_stmt FROM @rc_count_ddl; EXECUTE rc_count_stmt; DEALLOCATE PREPARE rc_count_stmt;
+
+-- MySQL 8，本地尾程库，可重复执行；不修改现有清点数量或自动释放未完成任务。
+USE baiyue_lastleg;
+-- 退货箱内清点作业会话：每位操作员只能认领一个批次，每个批次只能被一人认领。
+CREATE TABLE IF NOT EXISTS ll_return_carton_count_session (
+  operator_id VARCHAR(128) NOT NULL COMMENT '平台PDA操作员标识',
+  warehouse_id VARCHAR(128) NOT NULL COMMENT '认领时绑定海外仓标识',
+  receipt_id BIGINT NULL COMMENT '正在清点的签收批次，完成后释放为NULL',
+  started_at DATETIME(3) NULL COMMENT '本次开始清点时间',
+  created_at DATETIME(3) NOT NULL COMMENT '会话创建时间',
+  updated_at DATETIME(3) NOT NULL COMMENT '会话更新时间',
+  PRIMARY KEY(operator_id),
+  UNIQUE KEY uk_ll_return_count_session_receipt(receipt_id)
+) ENGINE=InnoDB COMMENT='退货箱内清点单人单任务持久会话';
+
+-- 四、换标事实数量与一单多申请；保留幂等唯一键。
+SET @ddl = (
+  SELECT IF(
+    EXISTS (
+      SELECT 1
+      FROM information_schema.columns
+      WHERE table_schema = DATABASE()
+        AND table_name = 'll_relabel_pda_unit_fact'
+        AND column_name = 'quantity'
+    ),
+    'SELECT 1',
+    'ALTER TABLE ll_relabel_pda_unit_fact ADD COLUMN quantity INT NOT NULL DEFAULT 1 COMMENT ''本次事实处理件数，箱级作业固定为1'' AFTER reason'
+  )
+);
+PREPARE ll_return_bulk_relabel_quantity_stmt FROM @ddl;
+EXECUTE ll_return_bulk_relabel_quantity_stmt;
+DEALLOCATE PREPARE ll_return_bulk_relabel_quantity_stmt;
+
+
+SET @relabel_has_unique = (SELECT COUNT(*) FROM information_schema.statistics
+  WHERE table_schema = DATABASE() AND table_name = 'll_relabel_application'
+    AND index_name = 'uk_ll_relabel_application_order');
+SET @relabel_has_index = (SELECT COUNT(*) FROM information_schema.statistics
+  WHERE table_schema = DATABASE() AND table_name = 'll_relabel_application'
+    AND index_name = 'idx_ll_relabel_application_order');
+SET @relabel_index_sql = CASE
+  WHEN @relabel_has_unique > 0 AND @relabel_has_index = 0 THEN
+    'ALTER TABLE ll_relabel_application DROP INDEX uk_ll_relabel_application_order, ADD INDEX idx_ll_relabel_application_order (lastleg_order_id)'
+  WHEN @relabel_has_unique > 0 THEN
+    'ALTER TABLE ll_relabel_application DROP INDEX uk_ll_relabel_application_order'
+  WHEN @relabel_has_index = 0 THEN
+    'ALTER TABLE ll_relabel_application ADD INDEX idx_ll_relabel_application_order (lastleg_order_id)'
+  ELSE 'SELECT 1' END;
+PREPARE relabel_index_migration FROM @relabel_index_sql;
+EXECUTE relabel_index_migration;
+DEALLOCATE PREPARE relabel_index_migration;
+
+-- 同箱分批索引：同时已有旧/新索引或旧索引已删除时也可执行。
+SET @return_index_ddl = IF(EXISTS(SELECT 1 FROM information_schema.statistics WHERE table_schema=DATABASE() AND table_name='ll_return_inventory_outbound_movement' AND index_name='uk_ll_return_outbound_carton_sku'), 'ALTER TABLE ll_return_inventory_outbound_movement DROP INDEX uk_ll_return_outbound_carton_sku', 'SELECT 1');
+PREPARE return_index_stmt FROM @return_index_ddl; EXECUTE return_index_stmt; DEALLOCATE PREPARE return_index_stmt;
+SET @return_index_ddl = IF(EXISTS(SELECT 1 FROM information_schema.statistics WHERE table_schema=DATABASE() AND table_name='ll_return_inventory_outbound_movement' AND index_name='idx_ll_return_outbound_carton_sku'), 'SELECT 1', 'ALTER TABLE ll_return_inventory_outbound_movement ADD INDEX idx_ll_return_outbound_carton_sku(customer_id,carton_id,sku_code)');
+PREPARE return_index_stmt FROM @return_index_ddl; EXECUTE return_index_stmt; DEALLOCATE PREPARE return_index_stmt;
+
+-- 五、原包装及尺寸重量来源。逐列检查，支持部分执行后重跑。
+-- 托盘重量/体积由当前绑定箱的实测尺寸重量汇总，无需新增托盘字段。
+SET @return_measurement_ddl = IF(EXISTS(SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_return_receipt' AND column_name='original_packaging'), 'SELECT 1', 'ALTER TABLE ll_return_receipt ADD COLUMN original_packaging TINYINT(1) NULL COMMENT ''是否使用原箱原包装'' AFTER weight');
+PREPARE return_measurement_stmt FROM @return_measurement_ddl; EXECUTE return_measurement_stmt; DEALLOCATE PREPARE return_measurement_stmt;
+SET @return_measurement_ddl = IF(EXISTS(SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_return_receipt' AND column_name='measurement_source'), 'SELECT 1', 'ALTER TABLE ll_return_receipt ADD COLUMN measurement_source VARCHAR(32) NULL COMMENT ''尺寸重量来源 PALLET_MEASURED托盘实测 UNIT_SUM子箱汇总'' AFTER original_packaging');
+PREPARE return_measurement_stmt FROM @return_measurement_ddl; EXECUTE return_measurement_stmt; DEALLOCATE PREPARE return_measurement_stmt;
+SET @return_measurement_ddl = IF(EXISTS(SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_return_inventory_carton' AND column_name='original_packaging'), 'SELECT 1', 'ALTER TABLE ll_return_inventory_carton ADD COLUMN original_packaging TINYINT(1) NULL COMMENT ''是否使用原箱原包装'' AFTER weight');
+PREPARE return_measurement_stmt FROM @return_measurement_ddl; EXECUTE return_measurement_stmt; DEALLOCATE PREPARE return_measurement_stmt;
+
+-- 校验输出：核对新增字段、索引和守恒约束。
+SELECT table_name,column_name,column_type,is_nullable,column_default FROM information_schema.columns
+WHERE table_schema=DATABASE() AND (
+(table_name='ll_outbound_pallet_item' AND column_name='return_sku_quantity') OR
+(table_name='ll_return_inventory_carton' AND column_name IN('label_status','count_status','counted_at','counted_by','original_packaging')) OR
+(table_name='ll_return_receipt' AND column_name IN('original_packaging','measurement_source')) OR
+(table_name='ll_relabel_pda_unit_fact' AND column_name='quantity')) ORDER BY table_name,column_name;
+SELECT table_name,index_name,non_unique,GROUP_CONCAT(column_name ORDER BY seq_in_index) AS indexed_columns
+FROM information_schema.statistics WHERE table_schema=DATABASE() AND index_name IN
+('idx_ll_return_outbound_carton_sku','uk_ll_return_outbound_pick_sku','idx_ll_relabel_application_order','uk_ll_return_count_session_receipt','idx_ll_return_count') GROUP BY table_name,index_name,non_unique;
+SELECT constraint_name,check_clause FROM information_schema.check_constraints WHERE constraint_schema=DATABASE() AND constraint_name='chk_ll_return_outbound_movement_delta';
diff --git a/scripts/db/return-package-packing-boundary-incremental-20261010.sql b/scripts/db/return-package-packing-boundary-incremental-20261010.sql
new file mode 100644
index 000000000..90b99d1d0
--- /dev/null
+++ b/scripts/db/return-package-packing-boundary-incremental-20261010.sql
@@ -0,0 +1,24 @@
+-- 退货以包裹/箱为最小出库实物单位；部分数量必须先合箱生成新标签箱。
+-- 可重复执行，目标库 baiyue_lastleg。
+USE baiyue_lastleg;
+
+-- 合箱后的新箱与原包裹共用同一箱唛、标签和来源追溯模型。
+-- 流水约束允许部分合箱/拆分只扣件数，不虚减箱数。
+SET @ddl = IF(EXISTS(SELECT 1 FROM information_schema.table_constraints
+  WHERE constraint_schema=DATABASE() AND table_name='ll_return_inventory_outbound_movement'
+    AND constraint_name='chk_ll_return_outbound_movement_delta'),
+  'ALTER TABLE ll_return_inventory_outbound_movement DROP CHECK chk_ll_return_outbound_movement_delta, ADD CONSTRAINT chk_ll_return_outbound_movement_delta CHECK(quantity>0 AND total_after>=0 AND available_after>=0 AND total_before-total_after=quantity AND available_before-available_after=quantity AND cartons_after>=0 AND cartons_before-cartons_after IN (0,1) AND total_after>=available_after)',
+  'ALTER TABLE ll_return_inventory_outbound_movement ADD CONSTRAINT chk_ll_return_outbound_movement_delta CHECK(quantity>0 AND total_after>=0 AND available_after>=0 AND total_before-total_after=quantity AND available_before-available_after=quantity AND cartons_after>=0 AND cartons_before-cartons_after IN (0,1) AND total_after>=available_after)');
+PREPARE stmt FROM @ddl; EXECUTE stmt; DEALLOCATE PREPARE stmt;
+
+-- 同一包裹可分批合箱/出库，重复提交仍由 outbound_pick_id + SKU 幂等约束保护。
+SET @ddl = IF(EXISTS(SELECT 1 FROM information_schema.statistics
+  WHERE table_schema=DATABASE() AND table_name='ll_return_inventory_outbound_movement'
+    AND index_name='uk_ll_return_outbound_carton_sku'),
+  'ALTER TABLE ll_return_inventory_outbound_movement DROP INDEX uk_ll_return_outbound_carton_sku, ADD INDEX idx_ll_return_outbound_carton_sku(customer_id,carton_id,sku_code)',
+  'SELECT 1');
+PREPARE stmt FROM @ddl; EXECUTE stmt; DEALLOCATE PREPARE stmt;
+
+-- 新签收及新合箱必须打印并扫码确认标签；既有实物按原状态继续作业。
+SET @ddl = IF(EXISTS(SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_return_inventory_carton' AND column_name='label_status'), 'SELECT 1', 'ALTER TABLE ll_return_inventory_carton ADD COLUMN label_status VARCHAR(32) NULL COMMENT ''WAIT_LABEL待贴标 CONFIRMED已扫码确认标签''');
+PREPARE stmt FROM @ddl; EXECUTE stmt; DEALLOCATE PREPARE stmt;
diff --git a/scripts/db/warehouse-transfer-carton-counting-incremental.sql b/scripts/db/warehouse-transfer-carton-counting-incremental.sql
new file mode 100644
index 000000000..ee1954fd4
--- /dev/null
+++ b/scripts/db/warehouse-transfer-carton-counting-incremental.sql
@@ -0,0 +1,30 @@
+-- 仓储转运逐箱测量与清点；仅增加字段，不修改业务数据。
+USE baiyue_lastleg;
+SET @ddl = (SELECT IF(EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_warehouse_transfer_carton' AND column_name='length_cm'), 'SELECT 1', 'ALTER TABLE ll_warehouse_transfer_carton ADD COLUMN length_cm DECIMAL(12,2) NULL COMMENT ''箱子实测长度厘米'''));
+PREPARE transfer_count_stmt FROM @ddl; EXECUTE transfer_count_stmt; DEALLOCATE PREPARE transfer_count_stmt;
+SET @ddl = (SELECT IF(EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_warehouse_transfer_carton' AND column_name='width_cm'), 'SELECT 1', 'ALTER TABLE ll_warehouse_transfer_carton ADD COLUMN width_cm DECIMAL(12,2) NULL COMMENT ''箱子实测宽度厘米'''));
+PREPARE transfer_count_stmt FROM @ddl; EXECUTE transfer_count_stmt; DEALLOCATE PREPARE transfer_count_stmt;
+SET @ddl = (SELECT IF(EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_warehouse_transfer_carton' AND column_name='height_cm'), 'SELECT 1', 'ALTER TABLE ll_warehouse_transfer_carton ADD COLUMN height_cm DECIMAL(12,2) NULL COMMENT ''箱子实测高度厘米'''));
+PREPARE transfer_count_stmt FROM @ddl; EXECUTE transfer_count_stmt; DEALLOCATE PREPARE transfer_count_stmt;
+SET @ddl = (SELECT IF(EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_warehouse_transfer_carton' AND column_name='gross_weight_kg'), 'SELECT 1', 'ALTER TABLE ll_warehouse_transfer_carton ADD COLUMN gross_weight_kg DECIMAL(12,2) NULL COMMENT ''箱子实测重量千克'''));
+PREPARE transfer_count_stmt FROM @ddl; EXECUTE transfer_count_stmt; DEALLOCATE PREPARE transfer_count_stmt;
+SET @ddl = (SELECT IF(EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_warehouse_transfer_carton' AND column_name='counted_quantity'), 'SELECT 1', 'ALTER TABLE ll_warehouse_transfer_carton ADD COLUMN counted_quantity BIGINT NULL COMMENT ''箱内SKU实点件数'''));
+PREPARE transfer_count_stmt FROM @ddl; EXECUTE transfer_count_stmt; DEALLOCATE PREPARE transfer_count_stmt;
+SET @ddl = (SELECT IF(EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_warehouse_transfer_carton' AND column_name='count_idempotency_key'), 'SELECT 1', 'ALTER TABLE ll_warehouse_transfer_carton ADD COLUMN count_idempotency_key VARCHAR(255) NULL COMMENT ''箱内清点幂等键'''));
+PREPARE transfer_count_stmt FROM @ddl; EXECUTE transfer_count_stmt; DEALLOCATE PREPARE transfer_count_stmt;
+SET @ddl = (SELECT IF(EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_warehouse_transfer_carton' AND column_name='count_request_hash'), 'SELECT 1', 'ALTER TABLE ll_warehouse_transfer_carton ADD COLUMN count_request_hash VARCHAR(64) NULL COMMENT ''箱内清点请求摘要'''));
+PREPARE transfer_count_stmt FROM @ddl; EXECUTE transfer_count_stmt; DEALLOCATE PREPARE transfer_count_stmt;
+SET @ddl = (SELECT IF(EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_warehouse_transfer_carton' AND column_name='counted_by'), 'SELECT 1', 'ALTER TABLE ll_warehouse_transfer_carton ADD COLUMN counted_by VARCHAR(128) NULL COMMENT ''箱内清点操作人'''));
+PREPARE transfer_count_stmt FROM @ddl; EXECUTE transfer_count_stmt; DEALLOCATE PREPARE transfer_count_stmt;
+SET @ddl = (SELECT IF(EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_warehouse_transfer_carton' AND column_name='counted_at'), 'SELECT 1', 'ALTER TABLE ll_warehouse_transfer_carton ADD COLUMN counted_at DATETIME(3) NULL COMMENT ''箱内清点完成时间'''));
+PREPARE transfer_count_stmt FROM @ddl; EXECUTE transfer_count_stmt; DEALLOCATE PREPARE transfer_count_stmt;
+
+SET @ddl = (SELECT IF(EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_warehouse_transfer_carton' AND column_name='discrepancy_reason'), 'SELECT 1', 'ALTER TABLE ll_warehouse_transfer_carton ADD COLUMN discrepancy_reason VARCHAR(1000) NULL COMMENT ''实收与预报箱数差异原因'''));
+PREPARE transfer_count_stmt FROM @ddl; EXECUTE transfer_count_stmt; DEALLOCATE PREPARE transfer_count_stmt;
+
+SET @ddl = (SELECT IF(EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_warehouse_transfer_carton' AND column_name='transfer_pallet_id'), 'SELECT 1', 'ALTER TABLE ll_warehouse_transfer_carton ADD COLUMN transfer_pallet_id BIGINT NULL COMMENT ''签收箱所属转运托盘事实ID'''));
+PREPARE transfer_count_stmt FROM @ddl; EXECUTE transfer_count_stmt; DEALLOCATE PREPARE transfer_count_stmt;
+
+-- SKU 申报件数独立于预计箱数；历史未申报件数保持 NULL，实收以 PDA 清点为准。
+SET @ddl = (SELECT IF(EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_warehouse_transfer_item' AND column_name='declared_quantity'), 'SELECT 1', 'ALTER TABLE ll_warehouse_transfer_item ADD COLUMN declared_quantity BIGINT NULL COMMENT ''SKU申报件数，非预计或实收箱数'''));
+PREPARE transfer_quantity_stmt FROM @ddl; EXECUTE transfer_quantity_stmt; DEALLOCATE PREPARE transfer_quantity_stmt;
diff --git a/scripts/db/warehouse-transfer-carton-multi-sku-incremental.sql b/scripts/db/warehouse-transfer-carton-multi-sku-incremental.sql
new file mode 100644
index 000000000..6a3be22a6
--- /dev/null
+++ b/scripts/db/warehouse-transfer-carton-multi-sku-incremental.sql
@@ -0,0 +1,4 @@
+-- 仓储转运一箱多SKU清点；仅增加结构，不回填历史业务数据。
+USE baiyue_lastleg;
+SET @ddl = (SELECT IF(EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema=DATABASE() AND table_name='ll_warehouse_transfer_carton' AND column_name='sku_items_json'), 'SELECT 1', 'ALTER TABLE ll_warehouse_transfer_carton ADD COLUMN sku_items_json JSON NULL COMMENT ''实收箱内SKU及逐项件数明细'''));
+PREPARE transfer_sku_stmt FROM @ddl; EXECUTE transfer_sku_stmt; DEALLOCATE PREPARE transfer_sku_stmt;
diff --git a/scripts/db/warehouse-transfer-forecast-unbound-cartons-20261016.sql b/scripts/db/warehouse-transfer-forecast-unbound-cartons-20261016.sql
new file mode 100644
index 000000000..ca8ddfc79
--- /dev/null
+++ b/scripts/db/warehouse-transfer-forecast-unbound-cartons-20261016.sql
@@ -0,0 +1,3 @@
+-- 对应数据库：baiyue_lastleg；可重复执行，不修改原箱号、SKU预报件数和实测数据。
+USE baiyue_lastleg;
+ALTER TABLE ll_warehouse_transfer_carton MODIFY COLUMN transfer_item_id BIGINT NULL COMMENT '实际箱内首项SKU明细ID，预报补箱可为空';
diff --git a/scripts/local-warehouse-transfer-carton-acceptance.mjs b/scripts/local-warehouse-transfer-carton-acceptance.mjs
new file mode 100644
index 000000000..6f653c897
--- /dev/null
+++ b/scripts/local-warehouse-transfer-carton-acceptance.mjs
@@ -0,0 +1,118 @@
+import { mkdir, writeFile } from 'node:fs/promises'
+import { resolve } from 'node:path'
+import { randomInt, randomUUID } from 'node:crypto'
+
+const gateway = String(process.env.ADMIN_TEST_GATEWAY || '').replace(/\/$/, '')
+if (!gateway || !['localhost', '127.0.0.1'].includes(new URL(gateway).hostname)) throw new Error('Explicit localhost Gateway required')
+if (!process.env.ADMIN_TEST_USERNAME || !process.env.ADMIN_TEST_PASSWORD) throw new Error('Explicit local platform credentials required')
+const marker = `WT-BOX-${new Date().toISOString().replace(/\D/g, '').slice(0,14)}-${randomInt(1000,9999)}`
+const output = resolve(process.env.TRANSFER_CARTON_OUTPUT || `reports/${marker}.json`)
+const report = { marker, gateway, environment: 'LOCAL', photoEvidence: 'SYNTHETIC_TEST_PNG', passed: false, orders: [], checks: [] }
+let admin, pda, userId
+const ok = value => value.http === 200 && String(value.body?.code) === '200'
+async function call(token, method, path, body, expectedFailure = false) {
+  const isForm = body instanceof FormData
+  const response = await fetch(`${gateway}${path}`, { method, signal: AbortSignal.timeout(45000), headers: { ...(token ? { Authorization: `Bearer ${token}` } : {}), ...(!isForm && body !== undefined ? { 'Content-Type': 'application/json' } : {}) }, body: body === undefined ? undefined : isForm ? body : JSON.stringify(body) })
+  let value; try { value = await response.json() } catch { value = null }
+  const result = { http: response.status, body: value, requestId: response.headers.get('x-request-id') || value?.requestId, traceId: response.headers.get('x-trace-id') || value?.traceId }
+  // Never persist auth bodies, credentials, customer profiles or tokens.
+  report.checks.push({ method, path, expectedFailure, http: result.http, code: value?.code, requestId: result.requestId, traceId: result.traceId, passed: expectedFailure ? !ok(result) && ['A0400','A0422','A0409','A0404','A0403','400','409','404','403'].includes(String(value?.code)) : ok(result), message: ok(result) ? undefined : value?.message })
+  if (expectedFailure ? report.checks.at(-1).passed !== true : !ok(result)) throw new Error(`${method} ${path}: ${response.status}/${value?.code} ${value?.message}; requestId=${result.requestId}; traceId=${result.traceId}`)
+  return expectedFailure ? result : value.data
+}
+function assert(value, name) { report.checks.push({ name, passed: Boolean(value) }); if (!value) throw new Error(name) }
+async function save() { await mkdir(resolve(output, '..'), { recursive: true }); await writeFile(output, JSON.stringify(report,null,2)) }
+try {
+  admin = (await call('', 'POST', '/api/auth/login', { loginId: process.env.ADMIN_TEST_USERNAME, password: process.env.ADMIN_TEST_PASSWORD })).accessToken
+  const tenants = await call(admin,'GET','/api/platform/v1/iam/tenants?page=1&size=200')
+  const customer = tenants.records.find(row => row.status === 'ACTIVE' && (!process.env.OVERSEAS_TEST_CUSTOMER_ID || row.id === process.env.OVERSEAS_TEST_CUSTOMER_ID))
+  assert(customer?.id, 'Existing active local customer')
+  const customerId = customer.id
+  const warehouses = (await call(admin,'GET','/api/platform/v1/warehouse-admin?page=1&size=100&warehouseType=OVERSEAS&status=ACTIVE')).records
+  const warehouse = warehouses.find(row => row.warehouseCode === 'US-LAX-01') || warehouses[0]
+  assert(warehouse?.id, 'Existing overseas warehouse')
+  report.customerId = customerId; report.warehouseId = warehouse.id
+  const roles = await call(admin,'GET','/api/platform/v1/iam/roles')
+  const role = roles.find(row => row.roleCode === 'OVERSEAS_WAREHOUSE_PDA_OPERATOR' && row.status === 'ACTIVE')
+  assert(role?.id, 'Existing PDA role')
+  const username = `pda_box_${marker.replace(/\D/g,'').slice(-18)}`
+  const password = process.env.LOCAL_TRANSFER_PDA_PASSWORD
+  if (!password) throw new Error('Explicit fixture PDA password required')
+  const user = await call(admin,'POST','/api/platform/v1/iam/users', { username, password, displayName: marker, phone: `18${randomInt(100000000,999999999)}`, email: `${username}@example.com`, tenantId: '0', roleIds: [role.id], overseasWarehouseId: warehouse.id, status:'ACTIVE' })
+  userId = user.membershipId
+  pda = (await call('', 'POST', '/api/auth/login', { loginId: username, password })).accessToken
+  assert(pda, 'Dedicated warehouse-bound PDA session')
+  await writeFile(resolve('.env.transfer-carton-session'), `PDA_USERNAME=${username}\nPDA_PASSWORD=${password}\n`, { mode: 0o600 })
+  for (const scenario of [
+    { name:'single-box', counts:[1], actual:1 },
+    { name:'multi-box-multi-sku', counts:[2,1], actual:3, pallets:[1,2] },
+    { name:'short-receipt', counts:[3], actual:2, reason:'验收短收一箱' },
+    { name:'over-receipt', counts:[2], actual:3, reason:'验收超收一箱' }
+  ]) {
+    const key = `${marker}-${scenario.name}`
+    const items = scenario.counts.map((packageCount,index) => ({ skuCode:`${key}-SKU${index+1}`,productNameZh:`验收货物${index+1}`,quantity:120+index*30,packageCount,shippingMark:`${key}-CUSTOMER${index+1}` }))
+    let detail = await call(admin,'POST',`/api/platform/v1/last-leg/warehouse-transfers?customerId=${customerId}`, { operatingWarehouseId:warehouse.id,destinationType:'PRIVATE',privateDestinationAddress:'100 Test Warehouse Road',privateDestinationPostalCode:'90001',privateDestinationContactName:'测试收件人',privateDestinationContactPhone:'0000000000',deliveryAddress:'100 Test Warehouse Road',pickupContactName:'测试操作员',pickupContactPhone:'0000000000',packageCount:scenario.counts.reduce((a,b)=>a+b,0),volumeCbm:0.1,deliveryMethod:'TRUCK',estimatedArrivalAt:new Date().toISOString().slice(0,19),estimatedShipAt:new Date(Date.now()+86400000).toISOString().slice(0,19),remark:key,needRelabel:false,idempotencyKey:key,items })
+    assert(detail.items.every((item,index) => Number(item.quantity) === items[index].quantity && item.packageCount === items[index].packageCount), 'SKU declared units and expected cartons persist independently')
+    const no = detail.transferNo
+    const fact = { scenario: scenario.name, transferNo:no, plannedBoxes:detail.packageCount, actualBoxes:scenario.actual, status:detail.status, palletNos:[] }; report.orders.push(fact); await save()
+    detail = await call(admin,'POST',`/api/platform/v1/last-leg/warehouse-transfers/${no}/review?customerId=${customerId}`,{decision:'APPROVE',remark:key})
+    assert(detail.status === 'WAIT_PDA_RECEIVING', 'Review enters PDA receiving')
+    const path = `/api/pda/v1/last-leg/warehouse-transfers/${encodeURIComponent(no)}`
+    await call(pda,'POST',`${path}/palletize`,{idempotencyKey:`${key}-premature`,photoFileIds:['1']},true)
+    detail = await call(pda,'GET',path)
+    const palletAssignments = [];
+    for (const [index, cartonCount] of (scenario.pallets || [scenario.actual]).entries()) {
+      detail = await call(pda,'POST',`${path}/pallets/drafts`,{idempotencyKey:`${key}-pallet${index}`})
+      let pallet = detail.pallets.find(row=>row.status==='DRAFT')
+      assert(pallet?.id,'Saved pallet draft')
+      detail=await call(pda,'POST',`${path}/pallets/${pallet.id}/generate`,{idempotencyKey:`${key}-generate${index}`})
+      pallet=detail.pallets.find(row=>row.id===pallet.id)
+      detail=await call(pda,'POST',`${path}/pallets/${pallet.id}/bind`,{idempotencyKey:`${key}-bind${index}`,palletCode:pallet.palletNo})
+      fact.palletNos.push(pallet.palletNo); palletAssignments.push({ id: pallet.id, count: cartonCount })
+    }
+    let allocationIndex = 0;
+    const palletIds = palletAssignments.flatMap(pallet => Array(pallet.count).fill(pallet.id));
+    let boxes = detail.cartons.slice(0,scenario.actual).map((box,index)=>({ cartonMark:box.cartonMark,transferItemId:box.transferItemId,transferPalletId:palletIds[allocationIndex++],length:30+index,width:20+index,height:15+index,weight:2+index,skuCode:detail.items.find(row=>row.id===box.transferItemId).skuCode,quantity:5+index }))
+    if(scenario.actual>boxes.length) boxes.push({cartonMark:null,transferItemId:detail.items[0].id,transferPalletId:palletIds[allocationIndex++],length:44,width:33,height:22,weight:4.5,skuCode:detail.items[0].skuCode,quantity:13})
+    const count = {idempotencyKey:`${key}-count`,boxes,discrepancyReason:scenario.reason || null}
+    await call(pda,'POST',`${path}/cartons/count`,{...count,idempotencyKey:`${key}-bad-sku`,boxes:boxes.map((row,index)=>index?row:{...row,skuCode:'WRONG-SKU'})},true)
+    if (scenario.reason) await call(pda,'POST',`${path}/cartons/count`,{...count,idempotencyKey:`${key}-missing-reason`,discrepancyReason:null},true)
+    await call(pda,'POST',`${path}/cartons/count`,{...count,idempotencyKey:`${key}-zero`,boxes:boxes.map((row,index)=>index?row:{...row,quantity:0})},true)
+    detail = await call(pda,'POST',`${path}/cartons/count`,count)
+    assert(detail.packageCount === scenario.counts.reduce((a,b)=>a+b,0), 'Actual receipt preserves declared expected carton count')
+    assert(detail.items.every((item,index) => Number(item.quantity) === items[index].quantity), 'PDA actual units do not overwrite SKU declared units')
+    const counted = detail.cartons.filter(row=>row.status==='COUNTED')
+    for (const pallet of detail.pallets) {
+      const assigned = counted.filter(box => String(box.transferPalletId) === String(pallet.id));
+      assert(assigned.length === pallet.cartonCount, 'Pallet count derived from assigned boxes');
+      assert(Math.abs(assigned.reduce((sum,box)=>sum+Number(box.length)*Number(box.width)*Number(box.height)/1000000,0)-Number(pallet.volumeCbm)) < 0.000001, 'Pallet volume derived from boxes');
+      assert(Math.abs(assigned.reduce((sum,box)=>sum+Number(box.weight),0)-Number(pallet.grossWeightKg)) < 0.001, 'Pallet weight derived from boxes');
+    }
+    assert(counted.length===scenario.actual && counted.every(row=>row.countedAt && Number(row.quantity)>0 && Number(row.length)>0), `${scenario.name} persisted box measurements and quantities`)
+    fact.boxes = counted.map(row=>({cartonMark:row.cartonMark,length:row.length,width:row.width,height:row.height,weight:row.weight,quantity:row.quantity}))
+    assert(detail.cartons.filter(row=>row.status==='NOT_RECEIVED').length===Math.max(0,detail.packageCount-scenario.actual),'Missing box facts retained')
+    const replay = await call(pda,'POST',`${path}/cartons/count`,count)
+    assert(JSON.stringify(replay.cartons)===JSON.stringify(detail.cartons),'Count replay preserves original box facts')
+    await call(pda,'POST',`${path}/cartons/count`,{...count,boxes:boxes.map((row,index)=>index?row:{...row,quantity:row.quantity+1})},true)
+    const label = await call(pda,'GET',`${path}/carton-label`)
+    assert(counted.every(row=>label.printableHtml.includes(row.cartonMark)), 'Printable labels include every received carton')
+    const form = new FormData();form.append('file',new Blob([Buffer.from('iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNk+A8AAQUBAScY42YAAAAASUVORK5CYII=','base64')],{type:'image/png'}),`${key}.png`)
+    const photo=await call(pda,'POST',`${path}/measurement-photos/files`,form)
+    const complete={idempotencyKey:`${key}-complete`,photoFileIds:[photo.fileId]}
+    detail=await call(pda,'POST',`${path}/palletize`,complete)
+    assert(detail.status==='WAIT_CUSTOMER_CONFIRMATION' && detail.orderStatus==='INBOUND_COMPLETED','Completed receiving waits for customer confirmation')
+    assert(detail.pallets.reduce((sum,row)=>sum+Number(row.cartonCount),0)===scenario.actual,'Pallet box total equals counted receipts')
+    await call(pda,'POST',`${path}/palletize`,complete)
+    const readback=await call(admin,'GET',`/api/platform/v1/last-leg/warehouse-transfers/${no}?customerId=${customerId}`)
+    assert(JSON.stringify(readback.cartons)===JSON.stringify(detail.cartons),'Platform readback matches persisted PDA box facts')
+    assert(readback.pallets.every(row=>row.status==='COMPLETED'),'Completed pallets persisted')
+    fact.status=readback.status;fact.orderStatus=readback.orderStatus;fact.passed=true
+    await save()
+  }
+  report.passed = report.orders.length===4 && report.orders.every(row=>row.passed) && report.checks.every(row=>row.passed)
+} catch(error) { report.error=error.message; process.exitCode=1 }
+finally {
+  if(userId && process.env.TRANSFER_KEEP_PDA !== 'true') { try {await call(admin,'PUT',`/api/platform/v1/iam/users/${userId}/status`,{status:'DISABLED'});report.fixturePdaDisabled=true} catch(error) {report.cleanupError=error.message;report.passed=false;process.exitCode=1} }
+  if(userId) report.fixturePdaMembershipId=userId
+  await save();console.log(JSON.stringify({passed:report.passed,output,orders:report.orders.map(row=>({scenario:row.scenario,transferNo:row.transferNo,status:row.status,passed:row.passed})),checks:report.checks.length,error:report.error}))
+}
diff --git a/scripts/prod-release-acceptance.mjs b/scripts/prod-release-acceptance.mjs
index 77b12c81c..05ca45f06 100644
--- a/scripts/prod-release-acceptance.mjs
+++ b/scripts/prod-release-acceptance.mjs
@@ -3,7 +3,7 @@ import { dirname, resolve } from 'node:path'
 import { pathToFileURL } from 'node:url'
 import { normalizeOrderInput, measurementPlan } from './prod-release-measurement-plan.mjs'
 
-// Production is deliberately not routed through the multi-customer test runner.
+// Single-order acceptance never invokes the multi-customer fixture runner.
 export const STAGES = Object.freeze([
   'CUSTOMER_ORDER', 'ORDER_REVIEW', 'YIWU_MEASUREMENT', 'CUSTOMER_FEE_CONFIRMATION',
   'CONTAINER_ALLOCATION', 'DOMESTIC_PDA_LOADING', 'CUSTOMS_AND_BOOKING',
@@ -20,9 +20,8 @@ export const DOMESTIC_WAREHOUSE_CODES = Object.freeze(['CN-YIWU-01', 'CN-DONGGUA
 export function plan() {
   return {
     scope: { orders: 1, origins: [...DOMESTIC_WAREHOUSE_CODES], origin: 'CN-YIWU-01', receiving: 'US-LAX-01', sameOrder: true },
-    status: 'FULL_FLOW_NOT_IMPLEMENTED', fullFlowVerified: false,
-    stages: STAGES.map(name => ({ name, status: ['CUSTOMER_ORDER', 'ORDER_REVIEW'].includes(name)
-      ? 'IMPLEMENTED_NOT_HTTP_VERIFIED' : 'NOT_IMPLEMENTED' })),
+    status: 'FULL_FLOW_IMPLEMENTED_NOT_HTTP_VERIFIED', fullFlowVerified: false,
+    stages: STAGES.map(name => ({ name, status: 'IMPLEMENTED_NOT_HTTP_VERIFIED' })),
     excluded: ['其他客户', '混柜及拆单', '退货及异常分支', '真实付款', '第三方下单或发送邮件', '浏览器和设备交互'],
     policy: { createMasterData: false, createAccounts: false, deleteData: false },
   }
@@ -43,20 +42,22 @@ function baseUrl(value, path) {
 }
 
 export function config(env) {
-  if (env.CHONGCHONG_ENV !== 'prod') throw new Error('必须显式配置 CHONGCHONG_ENV=prod')
+  if (!['test', 'gray'].includes(env.CHONGCHONG_ENV)) throw new Error('必须显式配置 CHONGCHONG_ENV=test 或 gray')
+  for (const key of ['CHONGCHONG_ADMIN_OVERSEAS_API_BASE_URL', 'CHONGCHONG_MERCHANT_OVERSEAS_API_BASE_URL']) {
+    if (env[key] != null) throw new Error(`移除旧海外网关配置：${key}；所有业务使用统一 Gateway`)
+  }
   const get = key => requireValue(env, `CHONGCHONG_${key}`)
-  const cn = baseUrl(get('ADMIN_API_BASE_URL'), '/api')
-  const overseas = baseUrl(get('ADMIN_OVERSEAS_API_BASE_URL'), '/overseas-api')
+  const apiBase = baseUrl(get('ADMIN_API_BASE_URL'), '/api')
   const merchant = baseUrl(get('MERCHANT_API_BASE_URL'), '/api')
-  if (new URL(cn).origin !== new URL(overseas).origin || cn !== merchant) {
-    throw new Error('当前专属入口要求国内、海外及客户 API 使用同一 Admin 前端代理')
+  if (apiBase !== merchant) {
+    throw new Error('单票入口要求平台及客户 API 使用同一 HTTPS /api 统一入口')
   }
   const customer = { id: get('ACCEPTANCE_CUSTOMER_ID'), code: get('ACCEPTANCE_CUSTOMER_CODE'), name: get('ACCEPTANCE_CUSTOMER_NAME') }
   if (!/^[1-9]\d*$/.test(customer.id)) throw new Error('客户 ID 必须为非零十进制字符串')
   const credentials = Object.fromEntries(['ADMIN', 'MERCHANT', 'CN_PDA', 'OVERSEAS_LAX_PDA'].map(role =>
     [role, { loginId: get(`${role}_USERNAME`), password: get(`${role}_PASSWORD`) }]))
   if (get('OVERSEAS_LAX_PDA_WAREHOUSE_CODE') !== 'US-LAX-01') throw new Error('海外 PDA 必须绑定洛杉矶仓')
-  return { cn, overseas, customer, credentials }
+  return { environment: env.CHONGCHONG_ENV, apiBase, customer, credentials }
 }
 
 function id(value) {
@@ -88,11 +89,11 @@ export function client(settings, fetcher = fetch, policy = allowedRequest) {
   return {
     get requests() { return requests },
     async request(region, method, path, token, body, idempotencyKey) {
-      if (!policy(method, path, region, body, idempotencyKey)) throw new Error('请求不在生产前置检查白名单内')
-      if (++requests > 100) throw new Error('超过单次前置检查请求上限')
+      if (!policy(method, path, region, body, idempotencyKey)) throw new Error('请求不在单票请求白名单内')
+      if (++requests > 100) throw new Error('超过单阶段请求上限')
       let response
       try {
-        response = await fetcher((region === 'cn' ? settings.cn : settings.overseas) + path, {
+        response = await fetcher(settings.apiBase + path, {
           method, redirect: 'error', signal: AbortSignal.timeout(20_000),
           headers: { 'Content-Type': 'application/json', ...(token ? { Authorization: `Bearer ${token}` } : {}),
             ...(idempotencyKey ? { 'Idempotency-Key': idempotencyKey } : {}) },
@@ -129,7 +130,7 @@ export async function preflight(settings, http, receiveContext = () => {}) {
   const logins = {}
   for (const [role, credentials] of Object.entries(settings.credentials)) {
     logins[role] = await http.request('cn', 'POST', '/auth/login', undefined, credentials)
-    if (!logins[role]?.accessToken) throw new Error(`${role} 登录缺少国内 Token`)
+    if (!logins[role]?.accessToken) throw new Error(`${role} 登录缺少统一 accessToken`)
   }
   const admin = logins.ADMIN.accessToken
   assertCustomer(await http.request('cn', 'GET', `/platform/v1/iam/tenants/${settings.customer.id}`, admin), settings.customer)
@@ -152,8 +153,8 @@ export async function preflight(settings, http, receiveContext = () => {}) {
     !cnWarehouses.some(w => w.warehouseCode === code && id(w.id) === warehouses[code]))) {
     throw new Error('国内 PDA 不可访问义乌或东莞仓')
   }
-  const overseasToken = logins.OVERSEAS_LAX_PDA.overseasAccessToken
-  if (!overseasToken) throw new Error('洛杉矶 PDA 登录缺少海外 Token')
+  const overseasToken = logins.OVERSEAS_LAX_PDA.accessToken
+  if (!overseasToken) throw new Error('洛杉矶 PDA 登录缺少统一 accessToken')
   const binding = await http.request('overseas', 'GET', '/pda/v1/last-leg/receiving-containers/warehouse-profile', overseasToken)
   if (binding?.warehouseCode !== 'US-LAX-01' || id(binding.warehouseId) !== warehouses['US-LAX-01']) throw new Error('洛杉矶 PDA 仓库绑定不符')
   const counts = {}
@@ -169,14 +170,14 @@ export async function preflight(settings, http, receiveContext = () => {}) {
   return { ...plan(), status: 'BASIC_PREFLIGHT_PASSED', requests: http.requests,
     checks: ['客户身份及箱规状态', '四个账号登录', '义乌、东莞及洛杉矶仓', 'PDA 仓库范围', '国内既有托盘及可用库位'],
     resourceCounts: counts,
-    pending: ['单票执行入口的精确线路及小票报价检查', '供应商与海外资源门禁', '测量至签收的写入执行器和检查点', '所有业务阶段真实 HTTP 验证'],
+    pending: ['单票执行入口的精确线路及小票报价检查', '供应商与海外资源门禁', '全流程输入指定的资源资格', '本轮全部业务阶段真实 HTTP 验证'],
   }
 }
 
 export async function executeOrder(settings, input, journalPath, resume, fetcher = fetch) {
   const { validateOrderInput, withOrderJournal, runOrderStage } = await import('./prod-release-order-stage.mjs')
   // These facts come from the selected external environment, not from user-editable order JSON.
-  const bound = { ...normalizeOrderInput(input), customer: settings.customer, environment: settings.cn,
+  const bound = { ...normalizeOrderInput(input), customer: settings.customer, environment: { mode: settings.environment, apiBase: settings.apiBase },
     operator: { merchant: settings.credentials.MERCHANT.loginId, admin: settings.credentials.ADMIN.loginId } }
   validateOrderInput(bound)
   return withOrderJournal(journalPath, bound, async (state, save) => {
@@ -229,9 +230,19 @@ export async function executeOrder(settings, input, journalPath, resume, fetcher
 
 export async function main(argv = process.argv.slice(2), env = process.env) {
   const [mode = 'plan', ...rest] = argv
+  if (mode === 'full-flow') {
+    if ((rest.length !== 3 && rest.length !== 4) || rest[2] !== '--confirm-single-full-flow'
+        || rest.length === 4 && rest[3] !== '--resume') throw Error('full-flow 需要输入文件、检查点、--confirm-single-full-flow，可选 --resume')
+    const inputPath = resolve(rest[0]), journalPath = resolve(rest[1])
+    if (inputPath === journalPath) throw Error('输入和检查点不能使用同一文件')
+    const { executeFullFlow } = await import('./prod-release-full-flow.mjs')
+    const result = await executeFullFlow(config(env), JSON.parse(await readFile(inputPath, 'utf8')), journalPath, rest[3] === '--resume')
+    console.log(JSON.stringify(result, null, 2))
+    return
+  }
   if (mode === 'delivery-stage') {
-    if (rest.length !== 3 || rest[2] !== '--confirm-production-delivery') {
-      throw new Error('delivery-stage 需要输入文件、独立签收检查点、--confirm-production-delivery')
+    if (rest.length !== 3 || rest[2] !== '--confirm-single-delivery') {
+      throw new Error('delivery-stage 需要输入文件、独立签收检查点、--confirm-single-delivery')
     }
     const inputPath = resolve(rest[0]), journalPath = resolve(rest[1])
     if (inputPath === journalPath) throw new Error('输入和检查点不能使用同一文件')
@@ -252,8 +263,8 @@ export async function main(argv = process.argv.slice(2), env = process.env) {
     return
   }
   if (mode === 'order-stage') {
-    if ((rest.length !== 3 && rest.length !== 4) || rest[2] !== '--confirm-production-order'
-        || rest.length === 4 && rest[3] !== '--resume') throw new Error('order-stage 需要输入文件、检查点、--confirm-production-order，可选 --resume')
+    if ((rest.length !== 3 && rest.length !== 4) || rest[2] !== '--confirm-single-order'
+        || rest.length === 4 && rest[3] !== '--resume') throw new Error('order-stage 需要输入文件、检查点、--confirm-single-order，可选 --resume')
     const inputPath = resolve(rest[0]), journalPath = resolve(rest[1])
     if (inputPath === journalPath) throw new Error('输入和检查点不能使用同一文件')
     const input = JSON.parse(await readFile(inputPath, 'utf8'))
@@ -261,7 +272,7 @@ export async function main(argv = process.argv.slice(2), env = process.env) {
     console.log(JSON.stringify(result))
     return
   }
-  if (!['plan', 'preflight'].includes(mode) || rest.length) throw new Error('用法：prod-release-acceptance.mjs [plan|preflight]；全链路执行尚未开放')
+  if (!['plan', 'preflight'].includes(mode) || rest.length) throw new Error('用法：prod-release-acceptance.mjs [plan|preflight]；完整链使用 full-flow <输入> <检查点> --confirm-single-full-flow')
   if (mode === 'plan') { console.log(JSON.stringify(plan(), null, 2)); return }
   const settings = config(env)
   const reportPath = resolve('reports', `prod-release-preflight-${Date.now()}.json`)
@@ -276,5 +287,5 @@ export async function main(argv = process.argv.slice(2), env = process.env) {
 }
 
 if (process.argv[1] && import.meta.url === pathToFileURL(resolve(process.argv[1])).href) {
-  main().catch(error => { console.error(`生产验收入口失败：${error instanceof SyntaxError ? '输入或检查点 JSON 无效' : error.message}`); process.exitCode = 1 })
+  main().catch(error => { console.error(`单票验收入口失败：${error instanceof SyntaxError ? '输入或检查点 JSON 无效' : error.message}`); process.exitCode = 1 })
 }
diff --git a/scripts/prod-release-acceptance.test.mjs b/scripts/prod-release-acceptance.test.mjs
index 2eadb69bb..5556e30bc 100644
--- a/scripts/prod-release-acceptance.test.mjs
+++ b/scripts/prod-release-acceptance.test.mjs
@@ -3,9 +3,8 @@ import assert from 'node:assert/strict'
 import { plan, config, assertCustomer, allowedRequest, client, listAll, preflight, main, DOMESTIC_WAREHOUSE_CODES } from './prod-release-acceptance.mjs'
 
 function environment() {
-  const env = { CHONGCHONG_ENV: 'prod',
+  const env = { CHONGCHONG_ENV: 'gray',
     CHONGCHONG_ADMIN_API_BASE_URL: 'https://acceptance.invalid/api',
-    CHONGCHONG_ADMIN_OVERSEAS_API_BASE_URL: 'https://acceptance.invalid/overseas-api',
     CHONGCHONG_MERCHANT_API_BASE_URL: 'https://acceptance.invalid/api',
     CHONGCHONG_ACCEPTANCE_CUSTOMER_ID: '9007199254740993',
     CHONGCHONG_ACCEPTANCE_CUSTOMER_CODE: 'fixture', CHONGCHONG_ACCEPTANCE_CUSTOMER_NAME: 'fixture',
@@ -25,8 +24,8 @@ test('single order scope does not claim implemented or full coverage', () => {
   assert.deepEqual(result.scope.origins, [...DOMESTIC_WAREHOUSE_CODES])
   assert.equal(result.scope.receiving, 'US-LAX-01')
   assert.equal(result.fullFlowVerified, false)
-  assert.equal(result.stages.filter(s => s.status === 'IMPLEMENTED_NOT_HTTP_VERIFIED').length, 2)
-  assert.equal(result.stages.filter(s => s.status === 'NOT_IMPLEMENTED').length, 12)
+  assert.equal(result.stages.filter(s => s.status === 'IMPLEMENTED_NOT_HTTP_VERIFIED').length, 14)
+  assert.equal(result.stages.filter(s => s.status === 'NOT_IMPLEMENTED').length, 0)
 })
 test('configuration has no development/test fallback', () => {
   assert.throws(() => config({ ADMIN_TEST_GATEWAY: 'https://acceptance.invalid' }))
@@ -85,7 +84,7 @@ function fakeHttp(bindingId = '3') {
   return { requests: 0, async request(region, method, path) {
     this.requests++
     assert.equal(allowedRequest(method, path, region), true)
-    if (method === 'POST') return { accessToken: 'fixture-token', overseasAccessToken: 'fixture-overseas-token' }
+    if (method === 'POST') return { accessToken: 'fixture-token' }
     if (path.includes('/iam/')) return profile
     if (path.includes('/warehouse-profile')) return { warehouseId: bindingId, warehouseCode: 'US-LAX-01' }
     if (path.endsWith('/pda-loading/warehouses')) return [{ id: '2', warehouseCode: 'CN-YIWU-01' }, { id: '4', warehouseCode: 'CN-DONGGUAN-01' }]
@@ -110,6 +109,39 @@ test('PDA warehouse mismatch blocks preflight', async () => {
 })
 test('execute, resume and unrecognized arguments fail closed', async () => {
   for (const args of [['execute'], ['resume'], ['preflight', '--execute'], ['plan', '--count', '2']]) {
-    await assert.rejects(main(args, {}), /尚未开放/)
+    await assert.rejects(main(args, {}), /完整链使用/)
   }
 })
+
+
+test('explicit gray/test mode shares one API base and rejects retired environment keys', () => {
+  for (const mode of ['gray', 'test']) {
+    const settings = config({ ...environment(), CHONGCHONG_ENV: mode })
+    assert.equal(settings.environment, mode)
+    assert.equal(settings.apiBase, 'https://acceptance.invalid/api')
+    assert.equal(settings.overseas, undefined)
+  }
+  for (const mode of ['prod', 'dev', '', undefined]) {
+    assert.throws(() => config({ ...environment(), CHONGCHONG_ENV: mode }), /显式配置/)
+  }
+  for (const key of ['CHONGCHONG_ADMIN_OVERSEAS_API_BASE_URL', 'CHONGCHONG_MERCHANT_OVERSEAS_API_BASE_URL']) {
+    assert.throws(() => config({ ...environment(), [key]: 'https://acceptance.invalid/api' }), /旧海外网关/)
+  }
+})
+
+test('overseas PDA calls the unified gateway using its ordinary access token', async () => {
+  const calls = []
+  const http = client(config(environment()), async (url, options) => {
+    calls.push({ url, token: options.headers.Authorization })
+    return { ok: true, status: 200, json: async () => ({ code: '200', data: {} }) }
+  })
+  await http.request('overseas', 'GET', '/pda/v1/last-leg/receiving-containers/warehouse-profile', 'ordinary-access')
+  assert.deepEqual(calls, [{ url: 'https://acceptance.invalid/api/pda/v1/last-leg/receiving-containers/warehouse-profile', token: 'Bearer ordinary-access' }])
+})
+
+test('unapproved customer blocks preflight before any business stage', async () => {
+  const http = fakeHttp(), original = http.request.bind(http)
+  http.request = async (...args) => args[2].includes('/iam/')
+    ? { ...profile, status: 'PROFILE_REQUIRED' } : original(...args)
+  await assert.rejects(preflight(config(environment()), http), /审核状态/)
+})
diff --git a/scripts/prod-release-delivery-stage.mjs b/scripts/prod-release-delivery-stage.mjs
index 2789cf621..86f77e548 100644
--- a/scripts/prod-release-delivery-stage.mjs
+++ b/scripts/prod-release-delivery-stage.mjs
@@ -5,7 +5,8 @@ import { fingerprint } from './prod-release-order-stage.mjs'
 const check = (ok, message) => { if (!ok) throw new Error(message) }
 const longId = value => typeof value === 'string' && /^[1-9]\d*$/.test(value)
 const segment = value => typeof value === 'string' && /^[A-Za-z0-9_-]{1,80}$/.test(value)
-const number = value => Number.isSafeInteger(Number(value)) ? Number(value) : NaN
+const number = value => (typeof value === 'number' || typeof value === 'string' && /^\d+$/.test(value))
+  && Number.isSafeInteger(Number(value)) && Number(value) >= 0 ? Number(value) : NaN
 
 export function validateDeliveryInput(input) {
   check(/^[A-Za-z0-9][A-Za-z0-9_-]{7,47}$/.test(input.batch || ''), '无效验收批次')
@@ -79,6 +80,7 @@ export async function runDeliveryStage({ input, customerId, state, save, request
   let delivery = await readDelivery()
   if (delivery.order.status === 'WAIT_DELIVERY') {
     check(!state.startIntent, '配送中操作结果不确定，禁止重发；请核对服务端状态')
+    check(Number.isSafeInteger(number(delivery.order.version)), '派送状态版本缺失或无效')
     await save({ startIntent: true })
     await request('overseas', 'PUT', scoped(`${deliveryPath}/status`), {
       status: 'DELIVERING', expectedVersion: number(delivery.order.version), remark: `RELEASE-ACCEPTANCE:${input.batch}`,
@@ -142,12 +144,12 @@ export async function runDeliveryStage({ input, customerId, state, save, request
 
 export async function executeDelivery(settings, input, journalPath, fetcher = fetch) {
   validateDeliveryInput(input)
-  const binding = fingerprint({ input, cn: settings.cn, overseas: settings.overseas,
+  const binding = fingerprint({ input, environment: settings.environment, apiBase: settings.apiBase,
     customer: settings.customer, admin: settings.credentials.ADMIN.loginId })
   return withDeliveryJournal(journalPath, binding, async (state, save) => {
     const { client } = await import('./prod-release-acceptance.mjs')
     const login = await client(settings, fetcher).request('cn', 'POST', '/auth/login', null, settings.credentials.ADMIN)
-    check(login?.accessToken && login?.overseasAccessToken, '缺少国内或海外令牌')
+    check(login?.accessToken, '缺少统一 accessToken')
     const root = '/platform/v1/last-leg'
     const delivery = `${root}/delivery-orders/${input.deliveryNo}`
     const scoped = path => `${path}?customerId=${settings.customer.id}`
@@ -161,13 +163,13 @@ export async function executeDelivery(settings, input, journalPath, fetcher = fe
       : region === 'overseas' && (method === 'GET' && reads.has(path) || method === 'PUT' && writes.has(path)))
     return runDeliveryStage({ input, customerId: settings.customer.id, state, save,
       request: (region, method, path, body) => http.request(region, method, path,
-        region === 'cn' ? login.accessToken : login.overseasAccessToken, body),
+        login.accessToken, body),
       upload: async (path, name, text) => {
         check(path === scoped(`${delivery}/documents/RECEIPT/files`), '上传路径不符')
         const form = new FormData(); form.append('file', new Blob([text], { type: 'text/plain' }), name)
         let response
-        try { response = await fetcher(settings.overseas + path, { method: 'POST', redirect: 'error',
-          signal: AbortSignal.timeout(20_000), headers: { Authorization: `Bearer ${login.overseasAccessToken}` }, body: form }) }
+        try { response = await fetcher(settings.apiBase + path, { method: 'POST', redirect: 'error',
+          signal: AbortSignal.timeout(20_000), headers: { Authorization: `Bearer ${login.accessToken}` }, body: form }) }
         catch { throw new Error('签收上传连接失败或超时；未自动重试') }
         const data = await response.json()
         const safe = value => /^[\w-]{1,100}$/.test(String(value)) ? value : 'unavailable'
diff --git a/scripts/prod-release-delivery-stage.test.mjs b/scripts/prod-release-delivery-stage.test.mjs
index cbd933ea8..0880f44f8 100644
--- a/scripts/prod-release-delivery-stage.test.mjs
+++ b/scripts/prod-release-delivery-stage.test.mjs
@@ -3,7 +3,7 @@ import assert from 'node:assert/strict'
 import { mkdtemp, rm } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
-import { runDeliveryStage, validateDeliveryInput, verifyOutbound, withDeliveryJournal } from './prod-release-delivery-stage.mjs'
+import { executeDelivery, runDeliveryStage, validateDeliveryInput, verifyOutbound, withDeliveryJournal } from './prod-release-delivery-stage.mjs'
 
 const input = { batch: 'acceptance-1234', orderId: '101', orderNo: 'FL-101', tailOrderId: '201',
   warehouseId: '301', inboundCode: 'IN-101', dispatchNo: 'DS-101', outboundNo: 'OB-101', deliveryNo: 'DL-101', packageCount: 1 }
@@ -112,3 +112,49 @@ test('journal rejects changed binding and concurrent processes', async () => {
     await assert.rejects(withDeliveryJournal(path, 'changed', async () => {}), /不符/)
   } finally { await rm(dir, { recursive: true, force: true }) }
 })
+
+
+test('missing or malformed delivery version blocks status write and upload', async () => {
+  for (const version of [undefined, null, '', ' ', false, -1, '9007199254740993']) {
+    const h = harness(), original = h.options.request
+    h.options.request = async (...args) => {
+      const result = await original(...args)
+      if (result?.order?.deliveryNo) result.order.version = version
+      return result
+    }
+    await assert.rejects(runDeliveryStage(h.options), /版本缺失或无效/)
+    assert.equal(h.writes.length, 0)
+    assert.equal(h.uploads(), 0)
+  }
+})
+
+test('delivery executor uses one gateway/accessToken for status, multipart receipt and domestic reconciliation', async t => {
+  const dir = await mkdtemp(join(tmpdir(), 'single-delivery-test-'))
+  t.after(() => rm(dir, { recursive: true, force: true }))
+  const h = harness(), calls = []
+  const settings = { environment: 'gray', apiBase: 'https://fixture.invalid/api', customer: { id: '501' },
+    credentials: { ADMIN: { loginId: 'admin-fixture', password: 'secret-fixture' } } }
+  const fetcher = async (url, options) => {
+    assert.ok(url.startsWith(settings.apiBase + '/'))
+    const path = url.slice(settings.apiBase.length)
+    calls.push(path)
+    let data
+    if (path === '/auth/login') data = { accessToken: 'single-access' }
+    else {
+      assert.equal(options.headers.Authorization, 'Bearer single-access')
+      if (options.body instanceof FormData) {
+        assert.equal(path, '/platform/v1/last-leg/delivery-orders/DL-101/documents/RECEIPT/files?customerId=501')
+        assert.match(await options.body.get('file').text(), /NOT A REAL PROOF/)
+        data = { fileId: '701' }
+      } else {
+        data = await h.options.request(path.startsWith('/platform/v1/last-leg/') ? 'overseas' : 'cn',
+          options.method, path, options.body ? JSON.parse(options.body) : undefined)
+      }
+    }
+    return { ok: true, status: 200, json: async () => ({ code: '200', data }) }
+  }
+  const result = await executeDelivery(settings, input, join(dir, 'journal.json'), fetcher)
+  assert.equal(result.status, 'DELIVERY_STAGE_PASSED')
+  assert.equal(result.fullFlowVerified, false)
+  assert.equal(calls.filter(path => path === '/auth/login').length, 1)
+})
diff --git a/scripts/prod-release-domestic-stage.mjs b/scripts/prod-release-domestic-stage.mjs
new file mode 100644
index 000000000..40f36fc91
--- /dev/null
+++ b/scripts/prod-release-domestic-stage.mjs
@@ -0,0 +1,231 @@
+import { fingerprint } from './prod-release-order-stage.mjs'
+import { oceanBookingDraft } from './admin-test-env-modules/ocean-booking-fixture.mjs'
+import { iso6346ContainerNumber } from './admin-test-env-modules/iso6346-container-number.mjs'
+import { channelGroup } from './admin-test-env-modules/smart-loading-channel-group.mjs'
+
+const assert = (value, message) => { if (!value) throw Error(message) }
+const id = value => value == null ? '' : String(value)
+const PNG = Buffer.from('iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVQIHWP4z8DwHwAFAAH/iZk9HQAAAABJRU5ErkJggg==', 'base64')
+const NODES = ['DEPARTED_WAREHOUSE', 'AT_ORIGIN_PORT', 'LOADED_ON_VESSEL', 'DEPARTED_ORIGIN_PORT', 'IN_TRANSIT', 'ARRIVED_DESTINATION_PORT', 'DISCHARGED_FROM_VESSEL', 'PICKUP_READY']
+const localTime = () => new Date(Date.now() + 8 * 3600000).toISOString().slice(0, 19)
+function fileForm(name, content = PNG, type = 'image/png', fields = {}) {
+  const form = new FormData()
+  for (const [key, value] of Object.entries(fields)) form.append(key, String(value))
+  form.append('file', new Blob([content], { type }), name)
+  return form
+}
+export function domesticSuccess(response) {
+  if (response?.http !== 200 || String(response?.body?.code) !== '200') {
+    const error = Error(`国内履约请求失败 HTTP=${response?.http} code=${response?.body?.code}`)
+    error.evidence = { http: response?.http, code: response?.body?.code, message: response?.body?.message,
+      requestId: response?.requestId, traceId: response?.traceId }
+    throw error
+  }
+  return response.body.data
+}
+
+// Persist intent before invoking transport. Never retry a partially observed write.
+export function domesticCommands(checkpoint, binding) {
+  const { state, save } = checkpoint
+  assert(!state.binding || state.binding === binding, '国内检查点绑定发生变化')
+  return async (name, command, execute) => {
+    const previous = state.commands?.[name]
+    if (previous?.status === 'DONE') return previous.result
+    assert(!previous, `国内写入 ${name} 结果未知，必须人工核对原请求，禁止自动重放`)
+    const intent = { status: 'INTENT', command, fingerprint: fingerprint(command) }
+    const persist = async value => {
+      const patch = { binding, commands: { ...state.commands, [name]: value } }
+      await save(patch); Object.assign(state, patch)
+    }
+    await persist(intent)
+    const result = await execute()
+    await persist({ ...intent, status: 'DONE', result })
+    return result
+  }
+}
+
+export async function runDomesticStage({ input, order, context, checkpoint }) {
+  const config = input.domestic
+  const cargo = input.payload.cargoes[0]
+  assert(order?.status === 'ORDER_APPROVED' && order.orderId && order.inboundCode, '必须使用本票已审核订单')
+  assert(cargo.packageCount >= 1 && cargo.packageCount <= 2 && input.payload.cargoes.length === 1, '国内阶段仅支持本票一个 SKU、1～2 箱')
+  assert(input.payload.taxMode === 'BUY_DECLARATION', '当前专票须为买单报关，不自动改写报关方式')
+  assert(config?.palletId && config.assigneeId && config.bookingAgent?.id && config.carrier?.id
+    && config.carrier.carrierCode && config.estimatedSailingAt && config.estimatedArrivalAt
+    && config.terminalFleet?.id && config.terminalFleet.name, '缺少已有国内资源、目的港车队或明确船期')
+  assert(context.token && context.pdaToken && context.merchantToken, '缺少已登录平台、国内 PDA 或客户会话')
+  const binding = fingerprint({ input, orderId: order.orderId })
+  const command = domesticCommands(checkpoint, binding)
+  const tenantId = input.customer.id, warehouseId = input.origin.id
+  const q = `tenantId=${encodeURIComponent(tenantId)}`
+  const key = name => `release-${fingerprint({ binding, name }).slice(0, 48)}`
+  const get = async (path, token = context.token) => domesticSuccess(await context.request('GET', path, undefined, token))
+  const write = (name, method, path, body, token = context.token) => command(name, { method, path, body, idempotencyKey: key(name) },
+    async () => domesticSuccess(await context.request(method, path, body, token, { 'Idempotency-Key': key(name) })))
+  const upload = (name, path, form, token = context.token) => command(name, { method: 'POST', path, idempotencyKey: key(name), testEvidence: name },
+    async () => domesticSuccess(await context.requestMultipart('POST', path, form, token, { 'Idempotency-Key': key(name) })))
+  const poll = async (read, condition, description) => {
+    for (let i = 0; i < (context.pollAttempts || 45); i++) {
+      const data = await read()
+      if (condition(data)) return data
+      await (context.sleep || (ms => new Promise(resolve => setTimeout(resolve, ms))))(1000)
+    }
+    throw Error(`国内异步事实未就绪：${description}`)
+  }
+  const unified = await poll(() => get(`/api/platform/v1/orders/${order.orderId}?${q}`), data => data.summary?.inboundId, '订单入库投影')
+  const inboundId = id(unified.summary.inboundId)
+  const inboundPath = `/api/platform/inbounds/${inboundId}?${q}`
+  const base = `/api/platform/v1/first-leg/inbounds/${inboundId}`
+  const measurementPath = `${base}/measurement?${q}`
+  const inbound = await get(inboundPath)
+  assert(id(inbound.summary?.tenantId) === tenantId && inbound.summary.inboundCode === order.inboundCode
+    && id(inbound.summary?.orderId) === order.orderId, '入库单客户、订单或入仓码不属于本票')
+  await write('accept', 'POST', `/api/platform/v1/orders/first-leg/${order.orderId}/accept?${q}`)
+  await write('start', 'POST', `/api/platform/v1/orders/first-leg/${order.orderId}/start?${q}`)
+  await command('carton-labels', { method: 'POST', path: `/api/platform/inbounds/${inboundId}/carton-label-pdf?${q}` }, async () => {
+    const result = await context.requestBinary('POST', `/api/platform/inbounds/${inboundId}/carton-label-pdf?${q}`)
+    assert(result.http === 200 && String(result.contentType).includes('pdf') && Buffer.from(result.bytes || []).subarray(0, 4).toString() === '%PDF', '本票箱唛未成功生成')
+    return { generated: true }
+  })
+  const scanForm = new FormData()
+  scanForm.append('data', new Blob([JSON.stringify({ boxCode: `${order.inboundCode}#${cargo.packageCount}-1`,
+    length: cargo.lengthCm, width: cargo.widthCm, height: cargo.heightCm,
+    machineNo: 'TEST-RELEASE-SIMULATED', measuredAt: localTime() })], { type: 'application/json' }))
+  scanForm.append('image', new Blob([PNG], { type: 'image/png' }), 'TEST-simulated-carton.png')
+  const scan = await upload('carton-scan', `${base}/measurement/carton-scans?${q}`, scanForm)
+  assert(scan?.itemId && scan.measurementId, '测量扫描未生成本票明细')
+  await write('carton-count', 'PUT', `${base}/measurement/items/${scan.itemId}/confirmed-package-count?${q}`,
+    { measurementVersion: Number(scan.measurementVersion), confirmedPackageCount: cargo.packageCount })
+  const measured = await get(measurementPath)
+  assert(measured.items?.length === 1 && id(measured.items[0].id) === id(scan.itemId), '本票测量明细数量不符')
+  const item = measured.items[0]
+  await write('measurement-draft', 'PUT', `${base}/measurement/draft?${q}`, {
+    measurementId: measured.measurementId, version: Number(measured.version), actualGoodsName: cargo.goodsName || cargo.skuNo,
+    items: [{ inboundDetailId: item.inboundDetailId, itemNo: item.itemNo, boxSpecification: item.boxSpecification,
+      packageCount: cargo.packageCount, lengthCm: cargo.lengthCm, widthCm: cargo.widthCm, heightCm: cargo.heightCm,
+      intelligentImageFileId: item.intelligentImageFileId, overLimitWarning: item.overLimitWarning ?? null,
+      outerLengthCm: cargo.lengthCm, outerWidthCm: cargo.widthCm, outerHeightCm: cargo.heightCm,
+      coefficientMode: 'ADD', remark: `${input.batch} TEST模拟测量，非实测证据` }] })
+  const weightFile = await upload('weight-file', `/api/platform/v1/files/measurements/${tenantId}/${inboundId}`, fileForm('TEST-weight.png'))
+  const weight = await write('weight-create', 'POST', `${base}/weight-results?${q}`, { fileId: weightFile.fileId, palletId: config.palletId,
+    ocrProvider: 'ADMIN_ACCEPTANCE', ocrRawText: null, ocrWeightValue: null, ocrWeightUnit: null, confidence: null })
+  assert(weight.palletTareWeightKg != null && Number(weight.palletTareWeightKg) >= 0, '缺少已有托盘皮重快照')
+  await write('weight-confirm', 'POST', `${base}/weight-results/${weight.id}/confirm?${q}`, {
+    version: Number(weight.version), adjustedWeightValue: Number(cargo.grossWeightKg) + Number(weight.palletTareWeightKg),
+    adjustedWeightUnit: 'KG', adjustmentReason: `${input.batch} TEST模拟称重，申报货重加托盘皮重` })
+  const ready = await get(measurementPath)
+  await write('measurement-submit', 'POST', `${base}/measurement/submit?${q}`, { measurementId: ready.measurementId, version: Number(ready.version) })
+  const pending = await get(inboundPath)
+  await write('measurement-approve', 'POST', `/api/platform/v1/inbounds/${inboundId}/measurements/approve?${q}`,
+    { measurementId: ready.measurementId, expectedVersion: Number(pending.summary.version), reason: `${input.batch} TEST专票流程` })
+  const approved = await poll(() => get(measurementPath), value => value.processStatus === 'WAIT_SPLIT'
+    || checkpoint.state.commands?.['plan-assign']?.status === 'DONE', '测量审核待分柜')
+  assert(approved.measurementStatus === 'APPROVED' && approved.measureReviewStatus === 'APPROVED'
+    && Number(approved.actualPackageCount) === cargo.packageCount
+    && Math.abs(Number(approved.actualNetWeightKg) - cargo.grossWeightKg) <= 0.001, '测量审核、箱数或净重不符')
+  const latestFee = await context.request('GET', `/api/platform/v1/inbounds/${inboundId}/fees/latest?${q}`, undefined, context.token)
+  if (latestFee.http === 200 && String(latestFee.body?.code) === 'A0404') {
+    await write('fee-calculate', 'POST', `/api/platform/v1/inbounds/${inboundId}/fees/calculate?${q}`)
+  } else domesticSuccess(latestFee)
+  await write('fee-confirm', 'POST', `/api/platform/v1/inbounds/${inboundId}/fees/confirm?${q}`)
+  const sent = await write('fee-send', 'POST', `/api/platform/v1/inbounds/${inboundId}/fees/send?${q}`)
+  assert(sent.feeStatus === 'SENT', '头程费用未发送客户')
+  const billing = `/api/merchant/v1/first-leg/orders/${order.orderId}/inbound-billing`
+  const customerFee = await write('customer-fee-confirm', 'POST', `${billing}/confirm`, { expectedFeeVersion: Number(sent.feeVersion) }, context.merchantToken)
+  assert(customerFee.customerConfirmationStatus === 'CONFIRMED', '客户费用未确认')
+  const containers = '/api/platform/v1/containers', smart = '/api/platform/v1/first-leg/smart-loading', pda = '/api/platform/v1/first-leg/pda-loading'
+  const simulation = await write('container-create', 'POST', containers, { channelGroupCode: channelGroup(input.payload.channelCode), warehouseId,
+    containerType: '40HQ', capacityCbm: 68, maxWeightKg: 19500 })
+  const containerId = id(simulation.id)
+  const booking = await write('booking-create', 'POST', '/api/platform/v1/ocean-bookings', { expectedVersion: 0,
+    data: oceanBookingDraft({ marker: input.batch }, input.batch, { customerId: tenantId, customerName: input.customer.name,
+      channelCode: input.payload.channelCode, warehouseId }, { shippingCompanyId: config.carrier.id, shippingCompanyName: config.carrier.name,
+      carrierCode: config.carrier.carrierCode, bookingAgentId: config.bookingAgent.id, bookingAgentName: config.bookingAgent.name,
+      estimatedSailingAt: config.estimatedSailingAt, estimatedArrivalAt: config.estimatedArrivalAt }) })
+  const oceanBookingId = id(booking.oceanBooking.id)
+  const document = await upload('booking-document', `/api/platform/v1/ocean-bookings/${oceanBookingId}/documents/upload`,
+    fileForm('TEST-booking-confirmation.txt', `${input.batch} TEST模拟订舱确认文件，非真实单证`, 'text/plain',
+      { expectedVersion: booking.oceanBooking.version, documentType: 'BOOKING_CONFIRMATION' }))
+  const released = await write('booking-release', 'POST', `/api/platform/v1/ocean-bookings/${oceanBookingId}/release`,
+    { expectedVersion: Number(document.bookingVersion), reason: `${input.batch} TEST` })
+  assert(released.oceanBooking?.status === 'RELEASED', '订舱未放舱')
+  const requirement = released.containerRequirements?.find(value => value.containerType === '40HQ')
+  assert(requirement?.id, '订舱缺少40HQ需求')
+  const containerNo = iso6346ContainerNumber(input.batch)
+  await write('booking-link', 'POST', `${containers}/${containerId}/ocean-booking-link`, { oceanBookingId,
+    requirementId: id(requirement.id), containerNo, expectedVersion: Number(simulation.version) })
+  const candidates = await get(`${smart}/candidates?bookingId=${containerId}&warehouseId=${warehouseId}`)
+  const candidate = candidates.find(value => id(value.orderId) === order.orderId && id(value.accountId) === tenantId)
+  // After assignment a resumed run uses the captured candidate, never another order.
+  const assignedBefore = checkpoint.state.commands?.['plan-assign']
+  assert(candidate || assignedBefore?.status === 'DONE', '本票不在可分柜候选中')
+  const plan = await get(`${smart}/plans/by-booking/${containerId}`), planId = id(plan.id)
+  const assigned = await write('plan-assign', 'POST', `${smart}/plans/${planId}/assignments`, {
+    inboundId, inboundDetailId: id(candidate?.inboundDetailId), packageCount: cargo.packageCount,
+    expectedVersion: Number(plan.version), operationId: key('plan-assign') })
+  assert(assigned.items?.length === 1 && Number(assigned.items[0].packageCount) === cargo.packageCount, '装柜计划混入其他货物或数量不符')
+  const confirmable = await get(`/api/platform/v1/first-leg/loading-plans/${planId}?warehouseId=${warehouseId}`)
+  const confirmed = await write('plan-confirm', 'POST', `/api/platform/v1/first-leg/loading-plans/${planId}/confirm`,
+    { expectedVersion: Number(confirmable.summary.version), assigneeId: config.assigneeId })
+  const taskId = id(confirmed.readiness?.pdaTaskId)
+  assert(taskId && confirmed.confirmationStatus === 'CONFIRMED', '国内 PDA 任务未生成')
+  const claimed = await write('pda-claim', 'POST', `${pda}/tasks/${taskId}/claim`,
+    { expectedAssignmentVersion: 0, operationId: key('pda-claim') }, context.pdaToken)
+  assert(claimed.items?.length === 1, '国内 PDA 任务货物不唯一')
+  const snapshot = await get(`${pda}/tasks/${taskId}/inventory-snapshot?warehouseId=${warehouseId}`, context.pdaToken)
+  const picked = await write('pda-pick', 'POST', `${pda}/tasks/${taskId}/batch`, { warehouseId, loadingPlanId: planId,
+    containerBookingId: containerId, expectedVersion: Number(snapshot.taskVersion), inventorySnapshotToken: snapshot.snapshotToken,
+    items: [{ itemId: id(claimed.items[0].id), action: 'PICK', pickedPackageCount: cargo.packageCount, version: Number(claimed.items[0].version) }] }, context.pdaToken)
+  for (const evidenceType of ['PHOTO_STEP_1', 'PHOTO_STEP_2', 'PHOTO_STEP_3', 'PHOTO_STEP_4', 'SEAL']) {
+    const params = new URLSearchParams({ warehouseId, expectedVersion: '0', evidenceType, remark: `${input.batch} TEST模拟凭证` })
+    if (evidenceType === 'SEAL') params.set('sealNo', `TEST-${input.batch}`.slice(0, 64))
+    await upload(`loading-${evidenceType}`, `${pda}/tasks/${taskId}/evidence?${params}`, fileForm(`TEST-${evidenceType}.png`), context.pdaToken)
+  }
+  await write('pda-complete', 'POST', `${pda}/tasks/${taskId}/complete`, { expectedTaskVersion: Number(picked.version),
+    operationId: key('pda-complete'), remark: `${input.batch} TEST装柜` }, context.pdaToken)
+  await poll(() => get(`${pda}/tasks/${taskId}?warehouseId=${warehouseId}`, context.pdaToken),
+    value => value.taskStatus === 'COMPLETED' && value.workflowStatus === 'COMPLETED', '国内装柜完成')
+  const customsPath = `/api/platform/v1/customs/loading-plans/${planId}`
+  let customs = await get(customsPath)
+  assert(customs.inbounds?.length === 1 && id(customs.inbounds[0].inboundId) === inboundId
+    && customs.inbounds.every(value => value.taxMode === 'BUY_DECLARATION'), '报关聚合不是本票买单货物')
+  if (customs.status === 'READY_TO_START') customs = await write('customs-start', 'POST', `${customsPath}/start`,
+    { expectedVersion: Number(customs.version), confirm: true, remark: `${input.batch} TEST` })
+  if (customs.status === 'DECLARING') customs = await write('customs-complete', 'POST', `${customsPath}/complete-all-buy`,
+    { expectedVersion: Number(customs.version), confirm: true, remark: `${input.batch} TEST` })
+  assert(customs.status === 'COMPLETED', '国内报关未完成')
+  const outboundPath = `/api/platform/v1/first-leg/outbound-dispatches/${containerId}`
+  const outbound = await poll(() => get(outboundPath), value => value.aggregate?.dispatchStatus === 'WAITING_FOR_LOADING', '报关自动国内离仓')
+  assert(outbound.aggregate.inbounds?.length === 1 && id(outbound.aggregate.inbounds[0].inboundId) === inboundId, '离仓货物归属不符')
+  const queries = await poll(() => get(`/api/platform/v1/carrier-schedule-queries?containerBookingId=${containerId}&page=1&size=20`),
+    value => value.records?.some(row => row.query?.triggerSource === 'OUTBOUND_CONFIRM'), '离仓船节点任务')
+  const owned = queries.records.filter(row => id(row.query?.containerBookingId) === containerId && row.query.triggerSource === 'OUTBOUND_CONFIRM')
+  assert(owned.length === 1, '本柜船节点任务不唯一')
+  const carrierQueryId = id(owned[0].query.id), carrierPath = `/api/platform/v1/carrier-schedule-queries/${carrierQueryId}`
+  let carrierDetail = await get(carrierPath)
+  let start = NODES.indexOf(carrierDetail.query?.query?.latestActualNode)
+  assert(start >= 0, '缺少自动离仓起点')
+  for (let index = start + 1; index < NODES.length; index++) {
+    const latest = carrierDetail.query.query
+    // Current observed wall clock; actual timestamps advance from the authoritative last node.
+    const actualAt = new Date(Date.parse(`${latest.latestActualAt}Z`) + 1000).toISOString().slice(0, 19)
+    carrierDetail = await write(`carrier-${NODES[index]}`, 'POST', `${carrierPath}/manual-nodes`, {
+      expectedVersion: Number(latest.version), standardNode: NODES[index], observedAt: localTime(), actualAt, estimatedAt: null,
+      locationCode: 'USLAX', locationName: 'Los Angeles', reason: `${input.batch} TEST模拟船节点 ${NODES[index]}` })
+  }
+  assert(carrierDetail.query?.query?.latestActualNode === 'PICKUP_READY', '船节点未到可提柜')
+  const terminalPath = `/api/platform/v1/terminal-drayages/${containerId}`
+  const initialTerminal = await get(terminalPath)
+  assert(id(initialTerminal.containerBookingId) === containerId && initialTerminal.containerNo === containerNo, '目的港拖车货柜不符')
+  assert(!initialTerminal.fleetSupplierId || checkpoint.state.commands?.['terminal-fleet']?.status === 'DONE', '禁止更换既有车队触发邮件')
+  const selected = await write('terminal-fleet', 'POST', `${terminalPath}/fleet`, { expectedVersion: Number(initialTerminal.version),
+    fleetSupplierId: config.terminalFleet.id, fleetSupplierName: config.terminalFleet.name, reason: `${input.batch} TEST` })
+  const appointmentAt = new Date(Date.parse(`${carrierDetail.query.query.latestActualAt}Z`) + 3600000).toISOString().slice(0, 19)
+  const scheduled = await write('terminal-appointment', 'POST', `${terminalPath}/pickup-appointment`, {
+    expectedVersion: Number(selected.version), pickupAppointmentAt: appointmentAt, reason: `${input.batch} TEST` })
+  assert(scheduled.pickupAppointmentAt === appointmentAt, '目的港提柜预约未持久化')
+  return { status: 'DOMESTIC_PICKUP_SCHEDULED', orderId: order.orderId, orderNo: order.orderNo, tenantId, warehouseId,
+    inboundId, inboundCode: order.inboundCode, containerId, containerBookingId: containerId, containerNo,
+    oceanBookingId, planId, loadingPlanId: planId, taskId, carrierQueryId, packageCount: cargo.packageCount,
+    terminalDrayageVersion: Number(scheduled.version), pickupAppointmentAt: appointmentAt }
+}
diff --git a/scripts/prod-release-domestic-stage.test.mjs b/scripts/prod-release-domestic-stage.test.mjs
new file mode 100644
index 000000000..39b9a8ed0
--- /dev/null
+++ b/scripts/prod-release-domestic-stage.test.mjs
@@ -0,0 +1,122 @@
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import { domesticCommands, domesticSuccess, runDomesticStage } from './prod-release-domestic-stage.mjs'
+
+const journal = () => {
+  const state = {}, saves = []
+  return { state, saves, async save(patch) { saves.push(structuredClone(patch)); Object.assign(state, patch) } }
+}
+test('uncertain writes retain original intent and cannot replay', async () => {
+  const checkpoint = journal(), run = domesticCommands(checkpoint, 'bound')
+  let count = 0
+  const execute = async () => { count++; assert.equal(checkpoint.state.commands.create.status, 'INTENT'); throw Error('network') }
+  await assert.rejects(run('create', { path: '/create' }, execute), /network/)
+  await assert.rejects(run('create', { path: '/create' }, execute), /结果未知/)
+  assert.equal(count, 1)
+})
+test('completed writes reuse exact saved result and reject another binding', async () => {
+  const checkpoint = journal(), run = domesticCommands(checkpoint, 'bound')
+  const first = await run('create', { path: '/create' }, async () => ({ id: '17' }))
+  assert.deepEqual(await run('create', { path: '/create' }, () => { throw Error('must not run') }), first)
+  assert.throws(() => domesticCommands(checkpoint, 'other'), /绑定/)
+})
+test('business rejection retains diagnostic evidence and cannot count as success', () => {
+  assert.throws(() => domesticSuccess({ http: 200, body: { code: 'A0409', message: 'version' }, requestId: 'r', traceId: 't' }),
+    error => error.evidence.code === 'A0409' && error.evidence.requestId === 'r' && error.evidence.traceId === 't')
+  assert.throws(() => domesticSuccess({ http: 503, body: { code: '200' } }))
+})
+
+function fixture() {
+  const input = { batch: 'release-test-001', customer: { id: '1', name: 'TEST' }, origin: { id: '2' },
+    payload: { taxMode: 'BUY_DECLARATION', channelCode: 'MATSON_CLX', cargoes: [{ skuNo: 'TEST-SKU', packageCount: 2,
+      lengthCm: 30, widthCm: 20, heightCm: 10, grossWeightKg: 8 }] },
+    domestic: { palletId: '3', assigneeId: '4', bookingAgent: { id: '5', name: 'AGENT' },
+      carrier: { id: '6', name: 'CARRIER', carrierCode: 'MATSON' }, terminalFleet: { id: '7', name: 'FLEET' },
+      estimatedSailingAt: '2026-10-12T08:00:00', estimatedArrivalAt: '2026-10-20T08:00:00' } }
+  const order = { status: 'ORDER_APPROVED', orderId: '10', orderNo: 'TEST-ORDER', inboundCode: 'TEST-INBOUND' }
+  const checkpoint = journal(), calls = []
+  const context = { token: 'platform-test', merchantToken: 'merchant-test', pdaToken: 'pda-test', pollAttempts: 1, sleep: async () => {} }
+  let containerNo, carrierNode = 'DEPARTED_WAREHOUSE', carrierVersion = 0, latestActualAt = '2026-10-12T10:00:00'
+  let measured = false
+  const carrier = () => ({ query: { query: { latestActualNode: carrierNode, version: carrierVersion, latestActualAt } } })
+  context.request = async (method, path, body, token, headers) => {
+    calls.push({ method, path, body, token, headers })
+    let data
+    if (path === '/api/platform/v1/orders/10?tenantId=1') data = { summary: { inboundId: '20' } }
+    else if (path === '/api/platform/inbounds/20?tenantId=1') data = { summary: { tenantId: '1', orderId: '10', inboundCode: 'TEST-INBOUND', version: 1 } }
+    else if (path.includes('/measurement?')) data = { measurementId: '30', version: 2, items: [{ id: '31', inboundDetailId: '32', itemNo: 1 }],
+      processStatus: measured ? 'WAIT_SPLIT' : 'MEASURING', measurementStatus: 'APPROVED', measureReviewStatus: 'APPROVED', actualPackageCount: 2, actualNetWeightKg: 8 }
+    else if (path.includes('/measurements/approve')) { measured = true; data = {} }
+    else if (path.includes('/weight-results?')) data = { id: '40', version: 0, palletTareWeightKg: 2 }
+    else if (path.includes('/fees/send')) data = { feeStatus: 'SENT', feeVersion: 1 }
+    else if (path.includes('/inbound-billing/confirm')) data = { customerConfirmationStatus: 'CONFIRMED' }
+    else if (path === '/api/platform/v1/containers') data = { id: '50', version: 0 }
+    else if (path === '/api/platform/v1/ocean-bookings') data = { oceanBooking: { id: '60', version: 0 } }
+    else if (path.includes('/ocean-bookings/60/release')) data = { oceanBooking: { status: 'RELEASED' }, containerRequirements: [{ id: '61', containerType: '40HQ' }] }
+    else if (path.includes('/ocean-booking-link')) { containerNo = body.containerNo; data = {} }
+    else if (path.includes('/smart-loading/candidates')) data = [{ orderId: '10', accountId: '1', inboundDetailId: '32' }]
+    else if (path.includes('/plans/by-booking/')) data = { id: '70', version: 0 }
+    else if (path.includes('/plans/70/assignments')) data = { items: [{ id: '71', packageCount: 2 }] }
+    else if (path.includes('/loading-plans/70/confirm')) data = { confirmationStatus: 'CONFIRMED', readiness: { pdaTaskId: '80' } }
+    else if (path.includes('/first-leg/loading-plans/70?')) data = { summary: { version: 1 } }
+    else if (path.includes('/tasks/80/claim')) data = { items: [{ id: '81', version: 0 }] }
+    else if (path.includes('/tasks/80/inventory-snapshot')) data = { taskVersion: 1, snapshotToken: 'snapshot' }
+    else if (path.includes('/tasks/80/batch')) data = { version: 2 }
+    else if (path.includes('/tasks/80?')) data = { taskStatus: 'COMPLETED', workflowStatus: 'COMPLETED' }
+    else if (path === '/api/platform/v1/customs/loading-plans/70') data = { inbounds: [{ inboundId: '20', taxMode: 'BUY_DECLARATION' }], status: 'READY_TO_START', version: 0 }
+    else if (path.endsWith('/customs/loading-plans/70/start')) data = { status: 'DECLARING', version: 1 }
+    else if (path.endsWith('/complete-all-buy')) data = { status: 'COMPLETED', version: 2 }
+    else if (path.includes('/outbound-dispatches/50')) data = { aggregate: { dispatchStatus: 'WAITING_FOR_LOADING', inbounds: [{ inboundId: '20' }] } }
+    else if (path.includes('/carrier-schedule-queries?')) data = { records: [{ query: { id: '90', containerBookingId: '50', triggerSource: 'OUTBOUND_CONFIRM' } }] }
+    else if (path.endsWith('/carrier-schedule-queries/90')) data = carrier()
+    else if (path.endsWith('/manual-nodes')) { carrierNode = body.standardNode; carrierVersion++; latestActualAt = body.actualAt; data = carrier() }
+    else if (path.endsWith('/terminal-drayages/50')) data = { containerBookingId: '50', containerNo, version: 0 }
+    else if (path.endsWith('/terminal-drayages/50/fleet')) data = { version: 1 }
+    else if (path.endsWith('/pickup-appointment')) data = { version: 2, pickupAppointmentAt: body.pickupAppointmentAt }
+    else if (/\/(accept|start)\?/.test(path) || /confirmed-package-count|measurement\/draft|weight-results\/40\/confirm|measurement\/submit|fees\/latest|fees\/confirm|tasks\/80\/complete/.test(path)) data = {}
+    else throw Error(`unhandled ${method} ${path}`)
+    return { http: 200, body: { code: '200', data } }
+  }
+  context.requestMultipart = async (method, path, form, token, headers) => {
+    assert.ok(form instanceof FormData)
+    calls.push({ method, path, token, headers, multipart: true })
+    let data
+    if (path.includes('/carton-scans')) data = { itemId: '31', measurementId: '30', measurementVersion: 0 }
+    else if (path.includes('/files/measurements/')) data = { fileId: '41' }
+    else if (path.includes('/documents/upload')) data = { bookingVersion: 1 }
+    else if (path.includes('/tasks/80/evidence')) data = { taskId: '80' }
+    else throw Error(`unhandled upload ${path}`)
+    return { http: 200, body: { code: '200', data } }
+  }
+  context.requestBinary = async () => ({ http: 200, contentType: 'application/pdf', bytes: Buffer.from('%PDF-test') })
+  return { input, order, context, checkpoint, calls }
+}
+
+test('single-ticket positive HTTP orchestration conserves two cartons and stops at pickup appointment', async () => {
+  const value = fixture(), result = await runDomesticStage(value)
+  assert.equal(result.status, 'DOMESTIC_PICKUP_SCHEDULED')
+  assert.equal(result.inboundId, '20')
+  assert.equal(result.packageCount, 2)
+  const batch = value.calls.find(call => call.path.endsWith('/tasks/80/batch'))
+  assert.equal(batch.body.items[0].pickedPackageCount, 2)
+  assert.equal(batch.token, value.context.pdaToken)
+  const weight = value.calls.find(call => call.path.includes('/weight-results/40/confirm'))
+  assert.equal(weight.body.adjustedWeightValue, 10)
+  assert.equal(value.calls.filter(call => call.path.endsWith('/manual-nodes')).length, 7)
+  assert.equal(value.calls.filter(call => call.path.includes('/evidence?')).length, 5)
+  assert.ok(value.calls.every(call => !/pickup-email|\/suppliers|\/users|\/customers/.test(call.path)))
+  assert.ok(Object.values(value.checkpoint.state.commands).every(command => command.status === 'DONE'))
+})
+test('tax mode and customer identity fail closed before unrelated business writes', async () => {
+  const value = fixture()
+  value.input.payload.taxMode = 'SELF_DECLARATION'
+  await assert.rejects(runDomesticStage(value), /买单报关/)
+  assert.equal(value.calls.length, 0)
+})
+test('a timeout at first business write preserves intent and stops all later actions', async () => {
+  const value = fixture(), request = value.context.request
+  value.context.request = async (...args) => args[0] === 'POST' ? Promise.reject(Error('timeout')) : request(...args)
+  await assert.rejects(runDomesticStage(value), /timeout/)
+  assert.equal(value.checkpoint.state.commands.accept.status, 'INTENT')
+  assert.equal(Object.keys(value.checkpoint.state.commands).length, 1)
+})
diff --git a/scripts/prod-release-full-flow.mjs b/scripts/prod-release-full-flow.mjs
new file mode 100644
index 000000000..e8e0cdaa5
--- /dev/null
+++ b/scripts/prod-release-full-flow.mjs
@@ -0,0 +1,93 @@
+import { resolve } from 'node:path'
+import { fingerprint, validateOrderInput } from './prod-release-order-stage.mjs'
+import { normalizeOrderInput } from './prod-release-measurement-plan.mjs'
+import { executeOrder } from './prod-release-acceptance.mjs'
+import { executeDelivery } from './prod-release-delivery-stage.mjs'
+import { createFlowContext, withFlowJournal, requireSuccess } from './prod-release-http.mjs'
+import { runDomesticStage } from './prod-release-domestic-stage.mjs'
+import { runOverseasStage, finishSingleOrderTrip } from './prod-release-overseas-stage.mjs'
+
+export async function executeFullFlow(settings, rawInput, journalPath, resume = false, fetcher = fetch) {
+  const input = { ...normalizeOrderInput(rawInput), customer: settings.customer,
+    environment: { mode: settings.environment, apiBase: settings.apiBase },
+    operator: { merchant: settings.credentials.MERCHANT.loginId, admin: settings.credentials.ADMIN.loginId } }
+  validateOrderInput(input)
+  const binding = fingerprint({ input, credentials: Object.fromEntries(Object.entries(settings.credentials).map(([key,value])=>[key,value.loginId])) })
+  return withFlowJournal(journalPath, binding, async (state, save) => {
+    if (state.status !== 'NEW' && !resume) throw Error('已有全流程检查点，须保持原输入并显式 --resume')
+    const ctx = createFlowContext({ settings, state, save, fetcher })
+    ctx.marker = input.batch
+    const checkpoint = name => {
+      const local = state.stages[name] || {}
+      return { state: local, save: async patch => {
+        const next = { ...local, ...patch }
+        await save({ stages: { ...state.stages, [name]: next } }); Object.assign(local, next)
+      } }
+    }
+    const bridgeFetch = async (url, options) => {
+      if (!url.startsWith(settings.apiBase + '/')) throw Error('全流程请求偏离统一Gateway')
+      const path = '/api' + url.slice(settings.apiBase.length)
+      const token = options.headers?.Authorization?.replace(/^Bearer /, '')
+      const body = options.body instanceof FormData ? options.body : options.body ? JSON.parse(options.body) : undefined
+      const result = await ctx.requestWithBody(options.method, path, body, token ?? null,
+        options.headers?.['Idempotency-Key'] ? { 'Idempotency-Key': options.headers['Idempotency-Key'] } : {})
+      if (path === '/api/auth/login' && result.body?.code === '200') ctx.registerSession(result.body.data)
+      return { ok: result.http >= 200 && result.http < 300, status: result.http, json: async () => result.body }
+    }
+    try {
+      await save({ status: 'RUNNING' })
+      ctx.token = (await ctx.login('ADMIN')).accessToken
+      ctx.merchantToken = (await ctx.login('MERCHANT')).accessToken
+      ctx.pdaToken = (await ctx.login('CN_PDA')).accessToken
+      ctx.overseasPdaToken = (await ctx.login('OVERSEAS_LAX_PDA')).accessToken
+      const binding = requireSuccess(await ctx.request('GET', '/api/pda/v1/last-leg/receiving-containers/warehouse-profile', undefined, ctx.overseasPdaToken))
+      if (binding.warehouseCode !== 'US-LAX-01') throw Error('海外PDA不是洛杉矶接柜仓')
+      const orderCp = checkpoint('order')
+      let order = orderCp.state.result
+      if (!order) {
+        order = await executeOrder(settings, input, resolve(`${journalPath}.order.json`), resume, bridgeFetch)
+        await orderCp.save({ result: order })
+      }
+      console.log('单票阶段：ORDER_APPROVED')
+      const domesticCp = checkpoint('domestic')
+      let domestic = domesticCp.state.result
+      if (!domestic) {
+        domestic = await runDomesticStage({ input, order, context: ctx, checkpoint: domesticCp })
+        await domesticCp.save({ result: domestic })
+      }
+      console.log(`单票阶段：${domestic.status}`)
+      const overseasCp = checkpoint('overseas')
+      let overseas = overseasCp.state.result
+      if (!overseas) {
+        overseas = await runOverseasStage({ input: { ...input, customerId: settings.customer.id,
+          packageCount: input.payload.cargoes[0].packageCount, warehouseId: binding.warehouseId },
+          domestic: { ...domestic, sourceInboundId: domestic.inboundId, orderId: order.orderId, orderNo: order.orderNo, inboundCode: order.inboundCode },
+          context: ctx, checkpoint: overseasCp })
+        await overseasCp.save({ result: overseas })
+      }
+      console.log(`单票阶段：${overseas.status}`)
+      const delivery = await executeDelivery(settings, { batch: input.batch, ...overseas,
+        orderId: order.orderId, orderNo: order.orderNo, inboundCode: order.inboundCode,
+        packageCount: input.payload.cargoes[0].packageCount, warehouseId: binding.warehouseId },
+        resolve(`${journalPath}.delivery.json`), bridgeFetch)
+      if (delivery.blockers.length) throw Error(`签收/回传未闭环：${delivery.blockers.join(',')}`)
+      const tripClosure = await finishSingleOrderTrip({ input: { ...input, customerId: settings.customer.id }, overseas, context: ctx, checkpoint: checkpoint('tripClosure') })
+      const result = { status: 'SINGLE_ORDER_HTTP_COMPLETED', fullFlowVerified: true,
+        scope: 'ONE_ORDER_NORMAL_HTTP_PATH', orderNo: order.orderNo, inboundCode: order.inboundCode,
+        containerNo: domestic.containerNo, dispatchNo: overseas.dispatchNo, deliveryNo: overseas.deliveryNo,
+        domesticOrderStatus: delivery.domesticOrderStatus, domesticInboundStatus: delivery.domesticInboundStatus,
+        tripClosureStatus: tripClosure.status,
+        syntheticEvidence: true, excluded: ['真实货物及设备', '浏览器视觉', '故障注入', '多客户/拆单/异常分支', '真实付款/第三方下单/邮件'],
+        completedAt: new Date().toISOString() }
+      await save({ status: 'COMPLETED', result })
+      return result
+    } catch (error) {
+      await save({ status: 'BLOCKED', failure: error.message })
+      throw error
+    } finally {
+      const cleanup = await ctx.close()
+      if (state.result) state.result.sessionCleanup = cleanup.length ? 'FAILED' : 'COMPLETED'
+      await save({ cleanup })
+    }
+  })
+}
diff --git a/scripts/prod-release-http.mjs b/scripts/prod-release-http.mjs
new file mode 100644
index 000000000..d0d0c7af2
--- /dev/null
+++ b/scripts/prod-release-http.mjs
@@ -0,0 +1,123 @@
+import { createHash } from 'node:crypto'
+import { mkdir, open, readFile, rename, unlink } from 'node:fs/promises'
+import { dirname } from 'node:path'
+
+const hash = value => createHash('sha256').update(value).digest('hex')
+const safe = value => typeof value === 'string' && /^[\w-]{1,100}$/.test(value) ? value : 'unavailable'
+export const success = response => response?.http === 200 && response.body?.code === '200'
+export function requireSuccess(response) {
+  if (!success(response)) throw new Error(`HTTP=${response?.http}; code=${safe(response?.body?.code)}; requestId=${safe(response?.requestId)}; traceId=${safe(response?.traceId)}`)
+  return response.body.data
+}
+
+export async function withFlowJournal(path, binding, action) {
+  await mkdir(dirname(path), { recursive: true })
+  const lock = await open(`${path}.lock`, 'wx', 0o600)
+  try {
+    let state
+    try { state = JSON.parse(await readFile(path, 'utf8')) }
+    catch (error) {
+      if (error.code !== 'ENOENT') throw new Error('全流程检查点损坏；禁止新建替代批次')
+      state = { version: 1, binding, stages: {}, requests: [], status: 'NEW' }
+    }
+    if (state.version !== 1 || state.binding !== binding) throw new Error('全流程检查点绑定变化')
+    const save = async patch => {
+      const next = { ...state, ...patch }
+      const file = await open(`${path}.next`, 'wx', 0o600)
+      try { await file.writeFile(JSON.stringify(next, null, 2)); await file.sync() } finally { await file.close() }
+      await rename(`${path}.next`, path)
+      Object.assign(state, next)
+    }
+    await save({})
+    return await action(state, save)
+  } finally { await lock.close(); await unlink(`${path}.lock`) }
+}
+
+async function bodyDigest(body) {
+  if (!(body instanceof FormData)) return hash(JSON.stringify(body ?? null))
+  const parts = []
+  for (const [key, value] of body) parts.push([key, typeof value === 'string' ? value
+    : { name: value.name, type: value.type, sha256: hash(Buffer.from(await value.arrayBuffer())) }])
+  return hash(JSON.stringify(parts))
+}
+
+// Only public business HTTP. No fixture runner, SQL, deployment or automatic network retry.
+export function createFlowContext({ settings, state, save, fetcher = fetch }) {
+  const sessions = []
+  const context = {
+    marker: '', options: {}, context: {}, createdResources: {}, steps: [],
+    registerSession(session) { sessions.push(session) },
+    async request(method, path, body, token = context.token, extraHeaders = {}) {
+      return send(method, path, body, token, extraHeaders, false)
+    },
+    async requestWithBody(method, path, body, token = context.token, extraHeaders = {}) {
+      return send(method, path, body, token, extraHeaders, false)
+    },
+    async requestMultipart(method, path, file, token = context.token, extraHeaders = {}) {
+      const form = file instanceof FormData ? file : new FormData()
+      if (!(file instanceof FormData)) {
+        if (!file || file.content === undefined) throw new Error('缺少上传内容')
+        form.append('file', new Blob([file.content], { type: file.type || 'application/octet-stream' }), file.name || 'acceptance.bin')
+      }
+      return send(method, path, form, token, extraHeaders, false)
+    },
+    async requestBinary(method, path, token = context.token) { return send(method, path, undefined, token, {}, true) },
+    apiSuccess(module, name, response) {
+      const data = requireSuccess(response)
+      context.steps.push({ module, name, passed: true })
+      return data
+    },
+    assert(module, name, response, condition) {
+      context.steps.push({ module, name, passed: Boolean(condition) })
+      if (!condition) throw new Error(`${module}: ${name}`)
+    },
+    async login(role) {
+      const data = requireSuccess(await send('POST', '/api/auth/login', settings.credentials[role], null, {}, false))
+      if (!data?.accessToken || !data.refreshToken) throw new Error(`${role}: 登录令牌不完整`)
+      sessions.push(data)
+      return data
+    },
+    async close() {
+      const failures = []
+      for (const session of sessions) {
+        try { requireSuccess(await send('POST', '/api/auth/logout', { refreshToken: session.refreshToken }, session.accessToken, {}, false)) }
+        catch { failures.push('SESSION_LOGOUT_FAILED') }
+      }
+      return failures
+    },
+  }
+  async function send(method, path, body, token, extraHeaders, binary) {
+    if (!['GET', 'POST', 'PUT'].includes(method) || !/^\/api\/(auth\/(login|logout)$|platform\/|merchant\/|pda\/)/.test(path)
+        || path.includes('..') || path.includes('#')) throw new Error('全流程请求路径或方法不允许')
+    const auth = path === '/api/auth/login' || path === '/api/auth/logout'
+    if (path !== '/api/auth/logout' && state.requests.length >= 2500) throw new Error('全流程请求超过安全上限')
+    const entry = { sequence: state.requests.length + 1, method, path, startedAt: new Date().toISOString(),
+      status: 'INTENT', ...(auth ? {} : { bodyHash: await bodyDigest(body) }) }
+    await save({ requests: [...state.requests, entry] })
+    let result
+    try {
+      const response = await fetcher(settings.apiBase.replace(/\/api$/, '') + path, {
+        method, redirect: 'error', signal: AbortSignal.timeout(45000),
+        headers: { ...(body !== undefined && !(body instanceof FormData) ? { 'Content-Type': 'application/json' } : {}),
+          ...extraHeaders, ...(token ? { Authorization: `Bearer ${token}` } : {}) },
+        ...(body !== undefined ? { body: body instanceof FormData ? body : JSON.stringify(body) } : {}),
+      })
+      if (binary && response.ok && !response.headers.get('content-type')?.includes('json')) {
+        const bytes = new Uint8Array(await response.arrayBuffer())
+        result = { http: response.status, bytes, buffer: Buffer.from(bytes), contentType: response.headers.get('content-type'), headers: Object.fromEntries(response.headers) }
+      } else {
+        const envelope = await response.json()
+        result = { http: response.status, body: envelope, requestId: envelope?.requestId || response.headers.get('x-request-id'),
+          traceId: envelope?.traceId || response.headers.get('x-trace-id') }
+      }
+    } catch {
+      await save({ requests: state.requests.map(row => row.sequence === entry.sequence ? { ...row, status: 'UNKNOWN' } : row) })
+      throw new Error(`HTTP结果不确定：${method} ${path}；禁止自动重试`)
+    }
+    await save({ requests: state.requests.map(row => row.sequence === entry.sequence ? { ...row,
+      status: success(result) || result.bytes ? 'DONE' : 'REJECTED', http: result.http,
+      code: safe(result.body?.code), requestId: safe(result.requestId), traceId: safe(result.traceId) } : row) })
+    return result
+  }
+  return context
+}
diff --git a/scripts/prod-release-http.test.mjs b/scripts/prod-release-http.test.mjs
new file mode 100644
index 000000000..5ba67e6c3
--- /dev/null
+++ b/scripts/prod-release-http.test.mjs
@@ -0,0 +1,50 @@
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import { createFlowContext, requireSuccess } from './prod-release-http.mjs'
+const settings = { apiBase: 'https://fixture.invalid/api', credentials: { ADMIN: { loginId: 'fixture', password: 'private' } } }
+function harness(fetcher, saveError = false) {
+  const state = { requests: [] }, saves = []
+  const save = async patch => { if (saveError) throw Error('disk failed'); Object.assign(state,patch); saves.push(structuredClone(state)) }
+  return { state, saves, ctx: createFlowContext({ settings, state, save, fetcher }) }
+}
+test('persists intent before writes and never saves credentials or tokens', async () => {
+  let h
+  h = harness(async (_url, options) => {
+    assert.equal(h.state.requests.at(-1).status, 'INTENT')
+    return new Response(JSON.stringify({ code: '200', data: { accessToken: 'access-secret', refreshToken: 'refresh-secret' } }))
+  })
+  await h.ctx.login('ADMIN')
+  await h.ctx.close()
+  assert.doesNotMatch(JSON.stringify(h.state), /private|access-secret|refresh-secret/)
+  assert.ok(h.state.requests.every(row=>row.status==='DONE'))
+})
+test('disk failure prevents HTTP and unknown network result is never retried', async () => {
+  let calls=0
+  const broken=harness(async()=>{calls++;throw Error('network')},true)
+  await assert.rejects(broken.ctx.request('POST','/api/platform/v1/example',{}),/disk/)
+  assert.equal(calls,0)
+  const h=harness(async()=>{calls++;throw Error('network')})
+  await assert.rejects(h.ctx.request('POST','/api/platform/v1/example',{}),/结果不确定/)
+  assert.equal(calls,1)
+  assert.equal(h.state.requests[0].status,'UNKNOWN')
+})
+test('business errors retain diagnostic IDs and binary responses preserve bytes',async()=>{
+  const h=harness(async()=>new Response(JSON.stringify({code:'A0403',requestId:'req-1',traceId:'trace-1',message:'private'})))
+  const response=await h.ctx.request('GET','/api/platform/v1/example')
+  assert.throws(()=>requireSuccess(response),/A0403.*req-1.*trace-1/)
+  assert.doesNotMatch(JSON.stringify(h.state),/private/)
+  const binary=harness(async()=>new Response('%PDF-fixture',{headers:{'content-type':'application/pdf'}}))
+  const pdf=await binary.ctx.requestBinary('POST','/api/platform/inbounds/1/carton-label-pdf')
+  assert.equal(Buffer.from(pdf.bytes).toString(),'%PDF-fixture')
+  assert.equal(pdf.contentType,'application/pdf')
+})
+
+test('request limit blocks business calls but permits session logout', async () => {
+  const h = harness(async () => new Response(JSON.stringify({ code: '200', data: {} })))
+  h.ctx.registerSession({ accessToken: 'secret', refreshToken: 'refresh' })
+  h.state.requests = Array.from({ length: 2500 }, (_, index) => ({ sequence: index + 1, status: 'DONE' }))
+  await assert.rejects(h.ctx.request('GET', '/api/platform/v1/example'), /安全上限/)
+  assert.deepEqual(await h.ctx.close(), [])
+  assert.equal(h.state.requests.at(-1).path, '/api/auth/logout')
+  assert.equal(h.state.requests.at(-1).status, 'DONE')
+})
diff --git a/scripts/prod-release-measurement-plan.mjs b/scripts/prod-release-measurement-plan.mjs
index c9ad7584c..8c2ef15ef 100644
--- a/scripts/prod-release-measurement-plan.mjs
+++ b/scripts/prod-release-measurement-plan.mjs
@@ -2,13 +2,13 @@
 export const CARTON_PROFILE = Object.freeze({ lengthCm: 40, widthCm: 30, heightCm: 30, weightKg: 7.5 })
 
 export function cartonTotals(packageCount) {
-  if (!Number.isInteger(packageCount) || packageCount < 1 || packageCount > 2) throw new Error('生产冒烟仅允许 1～2 箱')
+  if (!Number.isInteger(packageCount) || packageCount < 1 || packageCount > 2) throw new Error('单票冒烟仅允许 1～2 箱')
   return { packageCount, lengthCm: 40, widthCm: 30, heightCm: 30,
     grossWeightKg: packageCount * 7.5, volumeCbm: packageCount * 36 / 1000 }
 }
 
 export function normalizeOrderInput(input) {
-  if (!Array.isArray(input?.payload?.cargoes) || input.payload.cargoes.length !== 1) throw new Error('生产冒烟仅支持一个 SKU')
+  if (!Array.isArray(input?.payload?.cargoes) || input.payload.cargoes.length !== 1) throw new Error('单票冒烟仅支持一个 SKU')
   const cargo = input.payload.cargoes[0]
   const totals = cartonTotals(cargo.packageCount)
   if (cargo.netWeightKg != null && (!Number.isFinite(Number(cargo.netWeightKg))
diff --git a/scripts/prod-release-order-stage.mjs b/scripts/prod-release-order-stage.mjs
index 5d54f8ea8..86260e464 100644
--- a/scripts/prod-release-order-stage.mjs
+++ b/scripts/prod-release-order-stage.mjs
@@ -36,6 +36,8 @@ export function validateOrderInput(input) {
   assert(payload.inboundCode == null && payload.senderAddressId == null && payload.privateDestinationAddressId == null, '不允许手工入仓码或地址副作用')
   assert(Array.isArray(payload.cargoes) && payload.cargoes.length === 1, '专属冒烟固定一个 SKU')
   const cargo = payload.cargoes[0]
+  assert(payload.shipmentId && payload.referenceId && cargo.shipmentId && cargo.referenceId,
+    'FBA 订单及货物行均必须提供 Shipment ID 和 Reference ID')
   assert(Number.isInteger(cargo.packageCount) && cargo.packageCount >= 1 && cargo.packageCount <= 2, '冒烟仅允许 1～2 箱')
   assert(cargo.woodenProduct === false && cargo.dangerousGoods === false && !cargo.packingGroupNo, '仅支持非木制非危险单 SKU 货物')
   assert(longId(cargo.productImageFileId), '需要客户已上传产品图片，不生成虚假证明文件')
@@ -58,7 +60,8 @@ function binding(input) {
 // The caller must retain this file between invocations. Never generate a new batch to retry a failed one.
 export async function withOrderJournal(path, input, action) {
   validateOrderInput(input)
-  assert(typeof input.environment === 'string' && input.environment.startsWith('https://'), '缺少环境绑定')
+  assert(['test', 'gray'].includes(input.environment?.mode)
+    && typeof input.environment.apiBase === 'string' && input.environment.apiBase.startsWith('https://'), '缺少环境绑定')
   await mkdir(dirname(path), { recursive: true })
   const lock = await open(`${path}.lock`, 'wx', 0o600)
   const temp = `${path}.next`
diff --git a/scripts/prod-release-order-stage.test.mjs b/scripts/prod-release-order-stage.test.mjs
index afa9b0ced..f9cbcad51 100644
--- a/scripts/prod-release-order-stage.test.mjs
+++ b/scripts/prod-release-order-stage.test.mjs
@@ -7,15 +7,17 @@ import { fingerprint, validateOrderInput, withOrderJournal, runOrderStage, valid
 import { executeOrder } from './prod-release-acceptance.mjs'
 
 function fixture() {
-  return { batch: 'release-fixture-001', environment: 'https://fixture.invalid/api',
+  return { batch: 'release-fixture-001', environment: { mode: 'gray', apiBase: 'https://fixture.invalid/api' },
     operator: { merchant: 'fixture-client', admin: 'fixture-admin' },
     customer: { id: '1', name: 'fixture', code: 'fixture' }, origin: { id: '2', code: 'CN-YIWU-01' },
     destination: { id: '3', code: 'FIXTURE', type: 'FBA' },
     payload: { customerName: 'fixture', receivingWarehouseId: '2', destinationWarehouseId: '3',
+      shipmentId: 'SHIP-fixture', referenceId: 'REF-fixture',
       amazonWarehouseCode: 'FIXTURE', transportMode: 'SEA', destinationType: 'FBA', fulfillmentType: 'STANDARD',
       containerMode: 'LCL', pickupMethod: 'SELF_EXPRESS', channelCode: 'FIXTURE', pricingTaxMode: 'TAX_INCLUDED',
       customerRemark: 'RELEASE-ACCEPTANCE:release-fixture-001',
       cargoes: [{ skuNo: 'fixture-sku', packageCount: 2, unitsPerPackage: 1, totalQuantity: 2,
+        shipmentId: 'SHIP-fixture', referenceId: 'REF-fixture',
         lengthCm: 40, widthCm: 30, heightCm: 30, grossWeightKg: 15, volumeCbm: 0.072,
         productImageFileId: '4', woodenProduct: false, dangerousGoods: false }] } }
 }
@@ -143,7 +145,7 @@ test('uncertain approval that still reads submitted must not be resent', async t
 test('change in environment, account, payload or batch is blocked before HTTP', async t => {
   const path = await sandbox(t), input = fixture(), api = server(input)
   await run(path, input, api)
-  for (const change of [i => i.environment = 'https://other.invalid/api', i => i.operator.merchant = 'other',
+  for (const change of [i => i.environment.apiBase = 'https://other.invalid/api', i => i.environment.mode = 'test', i => i.operator.merchant = 'other',
     i => i.payload.channelCode = 'OTHER', i => { i.batch = 'release-fixture-002'; i.payload.customerRemark = `RELEASE-ACCEPTANCE:${i.batch}` }]) {
     const other = fixture(); change(other)
     const count = api.calls.length
@@ -184,14 +186,15 @@ test('corrupt journal is preserved and fails closed', async t => {
 for (const quoteMismatch of [false, true]) {
   test(`entry integration: customer/profile/route checks and HTTP headers (quote mismatch=${quoteMismatch})`, async t => {
     const path = await sandbox(t), input = fixture(), api = server(input)
-    const settings = { cn: 'https://fixture.invalid/api', overseas: 'https://fixture.invalid/overseas-api', customer: input.customer,
+    const settings = { environment: 'gray', apiBase: 'https://fixture.invalid/api', customer: input.customer,
       credentials: Object.fromEntries(['ADMIN', 'MERCHANT', 'CN_PDA', 'OVERSEAS_LAX_PDA'].map(role => [role, { loginId: role, password: 'secret' }])) }
     const fetcher = async (url, options) => {
-      const endpoint = new URL(url).pathname.replace(/^\/(overseas-api|api)/, '') + new URL(url).search
+      assert.ok(url.startsWith('https://fixture.invalid/api/'))
+      const endpoint = new URL(url).pathname.replace(/^\/api/, '') + new URL(url).search
       let data
       if (endpoint === '/auth/login') {
         const role = JSON.parse(options.body).loginId
-        data = { accessToken: role, overseasAccessToken: `${role}-overseas` }
+        data = { accessToken: role }
       } else if (endpoint.includes('/iam/')) {
         data = { id: '1', tenantCode: 'fixture', tenantName: 'fixture', status: 'ACTIVE', dimensionInitializationStatus: 'READY' }
       } else if (endpoint.includes('/warehouse-admin?')) {
@@ -203,7 +206,7 @@ for (const quoteMismatch of [false, true]) {
         assert.equal(options.headers.Authorization, 'Bearer CN_PDA')
         data = [{ id: '2', warehouseCode: 'CN-YIWU-01' }, { id: '4', warehouseCode: 'CN-DONGGUAN-01' }]
       } else if (endpoint.endsWith('/warehouse-profile')) {
-        assert.equal(options.headers.Authorization, 'Bearer OVERSEAS_LAX_PDA-overseas')
+        assert.equal(options.headers.Authorization, 'Bearer OVERSEAS_LAX_PDA')
         data = { warehouseId: '6', warehouseCode: 'US-LAX-01' }
       } else if (/\/platform\/v1\/(pallets|locations)\?/.test(endpoint)) {
         data = { total: '1', records: [{ warehouseId: '2', status: 'AVAILABLE' }] }
diff --git a/scripts/prod-release-overseas-stage.mjs b/scripts/prod-release-overseas-stage.mjs
new file mode 100644
index 000000000..e936369ef
--- /dev/null
+++ b/scripts/prod-release-overseas-stage.mjs
@@ -0,0 +1,283 @@
+import { fingerprint } from './prod-release-order-stage.mjs'
+import { controlledPalletMeasurements } from './admin-test-env-modules/fleet-trip-fulfillment.mjs'
+
+const BASE = '/api/platform/v1/last-leg'
+const PDA = '/api/pda/v1/last-leg'
+const check = (ok, message) => { if (!ok) throw new Error(message) }
+const id = value => value == null ? '' : String(value)
+const query = (path, values) => `${path}?${new URLSearchParams(values)}`
+const PNG = Buffer.from('iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8/x8AAwMCAO+aH1kAAAAASUVORK5CYII=', 'base64')
+
+/** Each successful command is persisted; an interrupted command must be investigated, never resent. */
+export function overseasCommands(context, checkpoint) {
+  const { state, save } = checkpoint
+  const unwrap = response => {
+    check(response?.http === 200 && String(response?.body?.code) === '200',
+      `海外 HTTP=${response?.http}; code=${response?.body?.code}; requestId=${response?.body?.requestId}; traceId=${response?.body?.traceId}`)
+    return response.body.data
+  }
+  async function command(name, method, path, body, token = context.token, headers = {}, file = null) {
+    const binding = fingerprint({ method, path, body: body ?? null, headers, file })
+    const previous = state.commands?.[name]
+    check(!previous || previous.binding === binding, `海外命令 ${name} 与检查点不符`)
+    if (previous?.status === 'DONE') return previous.result
+    check(!previous, `海外命令 ${name} 结果未知；停止重发并保留检查点`)
+    const persist = async value => { const commands = { ...state.commands, [name]: value }; await save({ commands }); state.commands = commands }
+    await persist({ binding, status: 'INTENT' })
+    let response
+    if (file) {
+      const form = new FormData()
+      form.append('file', new Blob([PNG], { type: 'image/png' }), file)
+      response = await context.requestWithBody(method, path, form, token)
+    } else response = await context.request(method, path, body, token, headers)
+    const result = unwrap(response)
+    await persist({ binding, status: 'DONE', result })
+    return result
+  }
+  return { command, read: async (path, token = context.token) => unwrap(await context.request('GET', path, undefined, token)),
+    readCurrentReceivingSession: async token => {
+      const response = await context.request('GET', `${PDA}/receiving-containers/current`, undefined, token)
+      // Only the initial current-session probe treats the service's absent-session business code as empty.
+      // Subsequent mandatory session reads and every other resource remain strict.
+      if (response?.http === 200 && String(response?.body?.code) === 'A0404') return null
+      return unwrap(response)
+    },
+    lookup: async (path, body) => unwrap(await context.request('POST', path, body)) }
+}
+
+export function validateOverseasInput(input, domestic) {
+  check(/^[A-Za-z0-9][A-Za-z0-9_-]{7,47}$/.test(input.batch || ''), '无效验收批次')
+  check([1, 2].includes(input.packageCount), '海外仅支持1～2箱单票')
+  for (const key of ['customerId', 'warehouseId']) check(/^[1-9]\d*$/.test(input[key] || ''), `缺少 ${key}`)
+  for (const key of ['vehicleId', 'driverId']) check(/^[1-9]\d*$/.test(input.resources?.[key] || ''), `缺少既有 ${key}`)
+  check(Boolean(input.resources.carrierName), '缺少既有车队名称')
+  for (const key of ['containerBookingId', 'sourceInboundId', 'orderId']) check(/^[1-9]\d*$/.test(domestic[key] || ''), `缺少 ${key}`)
+  for (const key of ['containerNo', 'inboundCode', 'orderNo']) check(Boolean(domestic[key]), `缺少 ${key}`)
+  if (domestic.cartonMarks != null) check(Array.isArray(domestic.cartonMarks)
+    && domestic.cartonMarks.length === input.packageCount && new Set(domestic.cartonMarks).size === input.packageCount,
+  '本票冻结箱码数量不符')
+}
+
+/** Normal single-ticket path only. No fixture runners, account creation, or master-data mutation. */
+export async function runOverseasStage({ input, domestic, context, checkpoint }) {
+  validateOverseasInput(input, domestic)
+  check(context.overseasPdaToken && context.merchantToken, '缺少既有海外 PDA 或本客户会话')
+  const { state, save } = checkpoint
+  check(!Object.values(state.commands || {}).some(row => row.status !== 'DONE'), '海外命令结果未知；停止重发并保留检查点')
+  const { read, lookup, command, readCurrentReceivingSession } = overseasCommands(context, checkpoint)
+  const pdaToken = context.overseasPdaToken
+  const remark = `RELEASE-ACCEPTANCE:${input.batch}`
+  const key = name => `${input.batch}-${name}`
+  if (!state.schedule) {
+    const schedule = { plannedDepartureAt: new Date(Date.now() + 3600000).toISOString(),
+      expectedDriverEndAt: new Date(Date.now() + 48 * 3600000).toISOString(),
+      arrival: new Date(Date.now() + 86400000).toISOString().slice(0, 19) }
+    await save({ schedule }); state.schedule = schedule
+  }
+  const schedule = state.schedule
+  const vehicle = await read(`${BASE}/master-data/vehicles/${input.resources.vehicleId}`)
+  const driver = await read(query(`${BASE}/fleet/drivers/${input.resources.driverId}`, { expectedEnd: schedule.expectedDriverEndAt }))
+  check(id(vehicle.id) === input.resources.vehicleId && vehicle.region === 'OVERSEAS' && vehicle.status === 'IN_SERVICE', '既有海外车辆不可用')
+  check(id(driver.id) === input.resources.driverId && driver.qualification?.canDispatch === true, '既有司机证照/审核不满足本次出车')
+  let sources
+  for (let attempt = 0; attempt < 60; attempt++) {
+    const page = await read(query(`${BASE}/orders`, { containerNo: domestic.containerNo, page: '1', size: '200' }))
+    sources = (page.records || []).filter(row => id(row.sourceContainerBookingId) === domestic.containerBookingId)
+    if (sources.length) break
+    if (attempt < 59) await (context.wait || (ms => new Promise(resolve => setTimeout(resolve, ms))))(1000)
+  }
+  check(sources?.length === 1 && id(sources[0].customerId) === input.customerId
+    && id(sources[0].sourceInboundId) === domestic.sourceInboundId && sources[0].inboundCode === domestic.inboundCode
+    && id(sources[0].overseasWarehouseId) === input.warehouseId, '柜内尾程来源不属于本次唯一客户/单票/接柜仓')
+  const tailOrderId = id(sources[0].id)
+  const arrivalRows = await lookup(`${BASE}/orders/container-arrival-times/query`, { sourceContainerBookingIds: [domestic.containerBookingId] })
+  const arrival = arrivalRows.find(row => id(row.sourceContainerBookingId) === domestic.containerBookingId)
+  check(arrival && Number.isSafeInteger(Number(arrival.version)), '柜级到仓版本缺失')
+  if (!arrival.estimatedWarehouseArrivalAt) await command('arrival', 'PUT', `${BASE}/orders/container-summaries/${domestic.containerBookingId}/expected-arrival`,
+    { estimatedWarehouseArrivalAt: schedule.arrival, expectedVersion: Number(arrival.version), remark }, undefined, { 'Idempotency-Key': key('arrival') })
+  let plans = state.commands?.convert?.result
+  if (!plans) {
+    const preview = await read(query(`${BASE}/inbound-plans/container-preview`, { sourceContainerBookingId: domestic.containerBookingId }))
+    check(preview.ready === true && Number(preview.totalOrderCount) === 1 && Number(preview.pendingOrderCount) === 1, '本票计划不可转换或存在未登记计划')
+    plans = await command('convert', 'POST', `${BASE}/inbound-plans/convert-container`, {
+      sourceContainerBookingId: domestic.containerBookingId, snapshotVersion: Number(preview.snapshotVersion), snapshotHash: preview.snapshotHash,
+    }, undefined, { 'Idempotency-Key': key('convert') })
+  }
+  check(plans?.length === 1 && plans[0].lines?.length > 0 && plans[0].lines.every(line => line.inboundCode === domestic.inboundCode)
+    && plans[0].pallets?.length === 1, '本票入仓计划/实体托盘不唯一')
+  const pallet = plans[0].pallets[0]
+  check(pallet.palletNo && pallet.warehousePalletId, '计划未生成实体托盘')
+  const receiving = `${PDA}/receiving-containers`
+  if (!state.commands?.receiveComplete) {
+    const current = await readCurrentReceivingSession(pdaToken)
+    check(!current || current.containerNo === domestic.containerNo && current.inbounds?.length === 1
+      && current.inbounds[0].inboundCode === domestic.inboundCode, '海外 PDA 正在操作其他柜')
+    const detailPath = query(`${receiving}/${encodeURIComponent(domestic.containerNo)}`, { sourceContainerBookingId: domestic.containerBookingId })
+    const detail = await read(detailPath, pdaToken)
+    check(id(detail.overseasWarehouseId) === input.warehouseId && detail.inbounds?.length === 1
+      && detail.inbounds[0].inboundCode === domestic.inboundCode && Number(detail.totalPackages) === input.packageCount, '收货柜身份或箱数不符')
+    const destinationType = detail.inbounds[0].destinationType
+    check(['OVERSEAS', 'FBA'].includes(destinationType), '单票不支持此收货类型')
+    if (destinationType === 'OVERSEAS') check(domestic.cartonMarks?.length === input.packageCount,
+      'OVERSEAS逐箱收货必须提供本票正式冻结箱码')
+    await command('prepare', 'POST', query(`${receiving}/${encodeURIComponent(domestic.containerNo)}/prepare`, { sourceContainerBookingId: domestic.containerBookingId }), { idempotencyKey: key('prepare') }, pdaToken)
+    const photos = []
+    for (const role of ['LICENSE_PLATE', 'CONTAINER_SEAL', 'DOOR_OPEN']) {
+      const uploaded = await command(`photo-${role}`, 'POST', `${receiving}/current/unload-photos/files`, undefined, pdaToken, {}, `${input.batch}-SYNTHETIC-${role}.png`)
+      check(/^[1-9]\d*$/.test(id(uploaded.fileId)), '验收图片未返回文件ID')
+      photos.push({ role, fileId: id(uploaded.fileId) })
+    }
+    await command('sign', 'POST', `${receiving}/current/sign`, { photos, idempotencyKey: key('sign') }, pdaToken)
+    const resolved = await command('resolve-pallet', 'POST', `${receiving}/current/pallets/resolve`, { palletCode: pallet.palletNo, inboundCode: domestic.inboundCode }, pdaToken)
+    check(resolved.compatible === true, '计划托盘不兼容')
+    // FBA receives cumulative physical counts on its source pallet; carton resolution is not a receiving prerequisite.
+    for (const [index, cartonMark] of (destinationType === 'OVERSEAS' ? domestic.cartonMarks : []).entries()) {
+      const carton = await command(`resolve-carton-${index}`, 'POST', `${receiving}/current/cartons/resolve`, { cartonMark }, pdaToken)
+      check(carton.inboundCode === domestic.inboundCode, '箱码未归属本票')
+      await command(`receive-${index}`, 'POST', `${receiving}/current/receipts/carton`, { cartonMark, palletCode: pallet.palletNo, idempotencyKey: key(`receive-${index}`) }, pdaToken)
+    }
+    if (destinationType === 'FBA') await command('receive-bulk', 'POST', `${receiving}/current/receipts/bulk`, {
+      inboundCode: domestic.inboundCode, palletCode: pallet.palletNo, packageCount: input.packageCount, idempotencyKey: key('receive-bulk'),
+    }, pdaToken)
+    const received = await read(`${receiving}/current`, pdaToken)
+    check(Number(received.pendingPackages) === 0 && Number(received.totalPackages) === input.packageCount, '本票收货数量未核平')
+    await command('receiveComplete', 'POST', `${receiving}/current/complete`, { idempotencyKey: key('receive-complete') }, pdaToken)
+  }
+  if (!state.commands?.emptyReturn) {
+    const drayagePath = `/api/platform/v1/terminal-drayages/${domestic.containerBookingId}`
+    let drayage
+    for (let attempt = 0; attempt < 60; attempt++) {
+      drayage = await read(drayagePath)
+      if (drayage.status === 'UNLOADED' && drayage.unloadingCompletedAt) break
+      if (attempt < 59) await (context.wait || (ms => new Promise(resolve => setTimeout(resolve, ms))))(1000)
+    }
+    check(id(drayage.containerBookingId) === domestic.containerBookingId && drayage.status === 'UNLOADED'
+      && drayage.allowedActions?.includes('RECORD_EMPTY_RETURN'), '海外卸柜事实尚未回传国内码头拖车')
+    const unloaded = Date.parse(`${drayage.unloadingCompletedAt}Z`)
+    check(Number.isFinite(unloaded), '卸柜时间无效')
+    const returned = await command('emptyReturn', 'POST', `${drayagePath}/empty-return`, {
+      expectedVersion: Number(drayage.version), actualAt: new Date(unloaded + 3600000).toISOString().slice(0, 19), remark,
+    }, undefined, { 'Idempotency-Key': key('empty-return') })
+    check(returned.status === 'EMPTY_RETURNED', '实际还柜未完成')
+  }
+  let dispatch = state.commands?.dispatch?.result
+  if (!dispatch) {
+    const candidates = await read(`${BASE}/dispatches/candidates?sourceStage=RECEIVED`)
+    const matches = candidates.filter(row => row.sourceStage === 'RECEIVED' && row.inboundCode === domestic.inboundCode
+      && id(row.customerId) === input.customerId && id(row.overseasWarehouseId) === input.warehouseId)
+    check(matches.length === 1 && Number(matches[0].packageCount) === input.packageCount, '本票排车候选不唯一或数量不符')
+    dispatch = await command('dispatch', 'POST', `${BASE}/dispatches/pre-arrange`, { planPalletIds: matches.map(row => id(row.planPalletId)) })
+  }
+  const dispatchNo = dispatch.dispatchNo
+  check(Boolean(dispatchNo), '排车单号缺失')
+  const transport = { vehiclePlate: vehicle.plateNumber, driverName: driver.details?.name,
+    driverPhone: driver.details?.phone, carrierName: input.resources.carrierName, estimatedArrivalAt: schedule.arrival }
+  await command('dispatch-vehicle', 'PUT', `${BASE}/dispatches/${dispatchNo}`, transport)
+  const transfer = await command('transfer', 'POST', query('/api/merchant/v1/last-leg/delivery-orders', { dispatchNo }), {
+    idempotencyKey: key('transfer'), plannedDeliveryAt: schedule.arrival, deliveryMethod: 'TRUCK_PALLET',
+    waybillNo: key('WAYBILL'), carrierName: transport.carrierName, pickupMethod: 'WAREHOUSE_PICKUP', loadingType: 'PALLET',
+    vehicleType: 'TRUCK', vehicleSize: '15托', driverName: transport.driverName, driverPhone: transport.driverPhone,
+    vehiclePlate: transport.vehiclePlate, appointmentAccount: 'SELF', sellerName: null, remark,
+    fees: [{ feeType: 'DELIVERY_FEE', feeName: '派送费', direction: 'RECEIVABLE', currency: 'USD', amount: 10, remark }],
+  }, context.merchantToken)
+  check(transfer.deliveries?.length === 1 && transfer.outboundNo, '本票未形成唯一出库/派送单')
+  let trip = await command('trip', 'POST', `${BASE}/fleet/trips`, { warehouseId: input.warehouseId,
+    plannedDepartureAt: schedule.plannedDepartureAt, expectedDriverEndAt: schedule.expectedDriverEndAt,
+    stops: [{ name: '验收起运仓' }, { name: '待匹配本票目的地' }], remark, idempotencyKey: key('trip') })
+  const tripNo = trip.trip.tripNo, tripPath = `${BASE}/fleet/trips/${tripNo}`
+  trip = await command('trip-assign', 'POST', `${tripPath}/assignment`, { recordVersion: trip.trip.recordVersion,
+    vehicleId: input.resources.vehicleId, driverId: input.resources.driverId, reason: remark })
+  trip = await command('trip-bind', 'POST', `${tripPath}/dispatches/bind`, { recordVersion: trip.trip.recordVersion, dispatchNo, reason: remark })
+  let stops = state.stops
+  if (!stops) {
+    const loading = await read(`${tripPath}/loading`)
+    check(loading.cargo?.length > 0 && loading.cargo.every(row => row.destinationKey), '本票装载缺少真实目的地')
+    stops = [{ name: '验收起运仓' }, ...new Map(loading.cargo.map(row => [row.destinationKey, { name: row.destinationLabel, destinationKey: row.destinationKey }])).values()]
+    await save({ stops }); state.stops = stops
+  }
+  trip = await command('trip-plan', 'PUT', `${tripPath}/plan`, { recordVersion: trip.trip.recordVersion,
+    plannedDepartureAt: schedule.plannedDepartureAt, expectedDriverEndAt: schedule.expectedDriverEndAt, stops, reason: remark })
+  trip = await command('trip-review', 'POST', `${tripPath}/dispatches/${dispatchNo}/review`, { recordVersion: trip.trip.recordVersion, decision: 'APPROVED' })
+  const pdaDispatch = `${PDA}/dispatches/${dispatchNo}`
+  if (!state.commands?.pickComplete) {
+    const picking = await read(pdaDispatch, pdaToken)
+    const exactDispatch = await read(`${BASE}/dispatches/${dispatchNo}`)
+    check(exactDispatch.items?.length > 0 && exactDispatch.items.every(row => row.inboundCode === domestic.inboundCode)
+      && picking.items?.length === exactDispatch.items.length
+      && picking.items.every(row => exactDispatch.items.some(item => id(item.id) === id(row.dispatchItemId))), 'PDA拣货包含其他票')
+    for (const item of picking.items) {
+      let remaining = Number(item.scheduledPackages) - Number(item.pickedPackages)
+      for (const position of item.positions || []) {
+        if (remaining <= 0) break
+        const packages = Math.min(remaining, Number(position.availablePackages))
+        if (!(packages > 0)) continue
+        await command(`pick-${item.dispatchItemId}-${position.id}`, 'POST', `${pdaDispatch}/items/${item.dispatchItemId}/pick`, {
+          positionId: id(position.id), packages, productQuantity: packages, idempotencyKey: key(`pick-${position.id}`), remark,
+        }, pdaToken)
+        remaining -= packages
+      }
+      check(remaining === 0, '本票库存不足以完成拣货')
+    }
+    await command('pickComplete', 'POST', `${pdaDispatch}/complete`, { idempotencyKey: key('pick-complete') }, pdaToken)
+  }
+  let loadingResult = state.commands?.loading?.result
+  if (!loadingResult) {
+    const loading = await read(`${tripPath}/loading`)
+    check(!loading.blockReason, '整车装载未就绪')
+    loadingResult = await command('loading', 'POST', `${tripPath}/loading`, { recordVersion: loading.recordVersion,
+      manifestHash: loading.manifestHash, pallets: controlledPalletMeasurements(loading.cargo, stops), reason: `${remark} 合成验收测量` })
+  }
+  const reviewed = await command('loading-review', 'POST', `${tripPath}/loading-review`, { recordVersion: loadingResult.recordVersion, decision: 'APPROVED' })
+  if (!state.commands?.depart) {
+    const ready = await read(pdaDispatch, pdaToken)
+    check(ready.status === 'COMPLETED' && ready.canDepart === true, 'PDA发车门禁未通过')
+  }
+  await command('depart', 'POST', `${pdaDispatch}/depart`, { recordVersion: reviewed.trip.recordVersion, idempotencyKey: key('depart'), remark }, pdaToken)
+  const outbound = await read(`${BASE}/outbound-orders/${transfer.outboundNo}`)
+  check(outbound.outbound?.status === 'OUTBOUNDED' && outbound.pallets?.length > 0
+    && outbound.pallets.every(row => row.inboundCode === domestic.inboundCode), '本票未真实完成出库')
+  const result = { ...domestic, batch: input.batch, packageCount: input.packageCount, warehouseId: input.warehouseId,
+    tailOrderId, dispatchNo, outboundNo: transfer.outboundNo, deliveryNo: transfer.deliveries[0].deliveryNo,
+    tripNo, status: 'OVERSEAS_OUTBOUNDED', fullFlowVerified: false, photos: 'SYNTHETIC_ACCEPTANCE_ONLY' }
+  await save({ result }); return result
+}
+
+/** Close only this ticket's trip after delivery; release its two resource claims without creating probe trips. */
+export async function finishSingleOrderTrip({ input, overseas, context, checkpoint }) {
+  check(overseas?.tripNo && overseas?.dispatchNo && overseas?.deliveryNo, '缺少本票车次与派送身份')
+  check(!Object.values(checkpoint.state.commands || {}).some(row => row.status !== 'DONE'), '车次结案命令结果未知；停止重发')
+  const { read, command } = overseasCommands(context, checkpoint)
+  const path = `${BASE}/fleet/trips/${encodeURIComponent(overseas.tripNo)}`
+  const delivery = await read(query(`${BASE}/delivery-orders/${encodeURIComponent(overseas.deliveryNo)}`, { customerId: input.customerId }))
+  check(delivery.order?.status === 'DELIVERED' && id(delivery.order.customerId) === input.customerId
+    && delivery.order.dispatchNo === overseas.dispatchNo, '本票尚未完成签收，不能结案车次')
+  const detail = await read(path)
+  check(detail.trip?.tripNo === overseas.tripNo && id(detail.trip.vehicleId) === input.resources.vehicleId
+    && id(detail.trip.driverId) === input.resources.driverId && detail.dispatches?.length === 1
+    && detail.dispatches[0].dispatchNo === overseas.dispatchNo, '车次含其他票或资源身份不符')
+  let completed = checkpoint.state.commands?.tripComplete?.result
+  if (!completed) {
+    const completion = await read(`${path}/completion`)
+    check(completion.canComplete === true && completion.outcomes?.length > 0, '车次结案条件未通过')
+    completed = await command('tripComplete', 'POST', `${path}/complete`, { recordVersion: completion.recordVersion,
+      idempotencyKey: `${input.batch}-trip-complete`, reason: '单票验收实际签收完成' })
+  }
+  check(completed.trip?.status === 'COMPLETED' && completed.trip.completedAt, '车次货物未结案')
+  const endLocation = detail.trip.stops?.at(-1)?.name
+  check(Boolean(endLocation), '本车次缺少结束地点')
+  const vehicle = await command('releaseVehicle', 'POST', `${path}/resources/release`, {
+    recordVersion: completed.trip.recordVersion, resourceKind: 'VEHICLE', actualEndAt: completed.trip.completedAt,
+    endLocation, vehicleStatus: 'IN_SERVICE', idempotencyKey: `${input.batch}-vehicle-release`,
+    reason: '单票受控验收车辆在签收末站结束，无返程安排',
+  })
+  const driver = await command('releaseDriver', 'POST', `${path}/resources/release`, {
+    recordVersion: vehicle.trip.recordVersion, resourceKind: 'DRIVER', actualEndAt: completed.trip.completedAt,
+    endLocation, vehicleStatus: null, idempotencyKey: `${input.batch}-driver-release`,
+    reason: '单票受控验收司机在签收末站结束，无返程安排',
+  })
+  check(driver.trip?.vehicleRelease && driver.trip?.driverRelease, '本车次车辆或司机未释放')
+  const final = await read(path)
+  check(final.trip?.status === 'COMPLETED' && final.trip.vehicleRelease && final.trip.driverRelease, '车次结案回查未通过')
+  const result = { tripNo: overseas.tripNo, status: 'CARGO_COMPLETED_AND_RESOURCES_RELEASED' }
+  await checkpoint.save({ result }); return result
+}
diff --git a/scripts/prod-release-overseas-stage.test.mjs b/scripts/prod-release-overseas-stage.test.mjs
new file mode 100644
index 000000000..80cbf4dd6
--- /dev/null
+++ b/scripts/prod-release-overseas-stage.test.mjs
@@ -0,0 +1,158 @@
+import test from 'node:test'
+import assert from 'node:assert/strict'
+import { overseasCommands, runOverseasStage, validateOverseasInput, finishSingleOrderTrip } from './prod-release-overseas-stage.mjs'
+
+const input = { batch: 'release-test-001', customerId: '1', warehouseId: '2', packageCount: 1,
+  resources: { vehicleId: '3', driverId: '4', carrierName: '验收既有车队' } }
+const domestic = { containerBookingId: '5', sourceInboundId: '6', orderId: '7', containerNo: 'TEST0000001',
+  inboundCode: 'IN-TEST', orderNo: 'ORDER-TEST', cartonMarks: ['CARTON-TEST'] }
+const ok = data => ({ http: 200, body: { code: '200', data } })
+const journal = () => { const state = {}; return { state, save: async patch => Object.assign(state, patch) } }
+
+test('reject multi-ticket quantities and duplicate frozen cartons before HTTP', () => {
+  assert.throws(() => validateOverseasInput({ ...input, packageCount: 3 }, domestic), /1～2/)
+  assert.throws(() => validateOverseasInput({ ...input, packageCount: 2 }, { ...domestic, cartonMarks: ['a', 'a'] }), /箱码/)
+})
+
+test('command records intent before HTTP; uncertain result blocks resend', async () => {
+  const checkpoint = journal(); let calls = 0
+  const { command } = overseasCommands({ request: async () => {
+    calls++; assert.equal(checkpoint.state.commands.create.status, 'INTENT'); throw new Error('timeout')
+  } }, checkpoint)
+  await assert.rejects(command('create', 'POST', '/example', { x: 1 }), /timeout/)
+  await assert.rejects(command('create', 'POST', '/example', { x: 1 }), /结果未知/)
+  assert.equal(calls, 1)
+})
+
+test('completed command restores result without HTTP and rejects changed request', async () => {
+  const checkpoint = journal(); let calls = 0
+  const { command } = overseasCommands({ request: async () => { calls++; return ok({ id: '99' }) } }, checkpoint)
+  await command('create', 'POST', '/example', { x: 1 })
+  assert.deepEqual(await command('create', 'POST', '/example', { x: 1 }), { id: '99' })
+  await assert.rejects(command('create', 'POST', '/example', { x: 2 }), /不符/)
+  assert.equal(calls, 1)
+})
+
+test('unknown prior command blocks even read/other writes on continuation', async () => {
+  const checkpoint = journal(); checkpoint.state.commands = { lost: { status: 'INTENT' } }
+  await assert.rejects(runOverseasStage({ input, domestic, checkpoint,
+    context: { overseasPdaToken: 'pda', merchantToken: 'merchant', request: () => assert.fail('must not call HTTP') } }), /结果未知/)
+})
+
+test('only initial current receiving probe accepts HTTP 200 A0404 as no session', async () => {
+  const calls = []
+  const helpers = overseasCommands({ request: async (method, path, body, token) => {
+    calls.push({ method, path, token }); return { http: 200, body: { code: 'A0404' } }
+  } }, journal())
+  assert.equal(await helpers.readCurrentReceivingSession('pda'), null)
+  assert.deepEqual(calls[0], { method: 'GET', path: '/api/pda/v1/last-leg/receiving-containers/current', token: 'pda' })
+  await assert.rejects(helpers.read('/api/pda/v1/last-leg/receiving-containers/current', 'pda'), /A0404/)
+  await assert.rejects(helpers.read('/api/platform/v1/last-leg/orders/1'), /A0404/)
+})
+
+test('current receiving probe preserves auth, transport and other business errors', async () => {
+  for (const [http, code] of [[200, 'A0403'], [200, 'A0500'], [401, 'A0404'], [404, 'A0404'], [503, 'A0404']]) {
+    const helpers = overseasCommands({ request: async () => ({ http, body: { code, requestId: 'request-test' } }) }, journal())
+    await assert.rejects(helpers.readCurrentReceivingSession('pda'), /request-test/)
+  }
+})
+
+function fixture({ foreignSource = false, destinationType = 'OVERSEAS' } = {}) {
+  const checkpoint = journal(), calls = []
+  const session = { containerNo: domestic.containerNo, overseasWarehouseId: '2', totalPackages: 1, pendingPackages: 0,
+    inbounds: [{ inboundCode: domestic.inboundCode, destinationType }] }
+  const trip = { trip: { tripNo: 'TRIP-TEST', recordVersion: 1, stops: [] } }
+  const cargo = [{ warehousePalletId: '9', palletNo: 'PLT-TEST', destinationKey: 'DEST', destinationLabel: 'Destination' }]
+  const context = { token: 'admin', overseasPdaToken: 'pda', merchantToken: 'merchant', wait: async () => {},
+    requestWithBody: async (method, path, form, token) => {
+      calls.push({ method, path, token }); assert.equal(token, 'pda'); assert.ok(form instanceof FormData); return ok({ fileId: '10' })
+    }, request: async (method, path, body, token) => {
+      calls.push({ method, path, body, token })
+      if (path.includes('/master-data/vehicles/')) return ok({ id: '3', region: 'OVERSEAS', status: 'IN_SERVICE', plateNumber: 'TEST' })
+      if (path.includes('/fleet/drivers/')) return ok({ id: '4', qualification: { canDispatch: true }, details: { name: 'Driver', phone: '10000000000' } })
+      if (path.includes('/orders?containerNo=')) return ok({ records: [{ sourceContainerBookingId: '5', customerId: foreignSource ? '99' : '1', sourceInboundId: '6',
+        inboundCode: domestic.inboundCode, overseasWarehouseId: '2', id: '8' }] })
+      if (path.endsWith('/container-arrival-times/query')) return ok([{ sourceContainerBookingId: '5', version: 0 }])
+      if (path.includes('/container-preview?')) return ok({ ready: true, totalOrderCount: 1, pendingOrderCount: 1, snapshotVersion: 1, snapshotHash: 'hash' })
+      if (path.endsWith('/convert-container')) return ok([{ lines: [{ inboundCode: domestic.inboundCode }], pallets: [{ palletNo: 'PLT-TEST', warehousePalletId: '9' }] }])
+      if (path.endsWith('/current') && method === 'GET') return calls.filter(c => c.path.endsWith('/current')).length === 1
+        ? { http: 200, body: { code: 'A0404' } } : ok(session)
+      if (path.includes('/receiving-containers/TEST0000001?')) return ok(session)
+      if (path.endsWith('/pallets/resolve')) return ok({ compatible: true })
+      if (path.endsWith('/cartons/resolve')) return ok({ inboundCode: domestic.inboundCode })
+      if (path.endsWith('/terminal-drayages/5')) return ok({ containerBookingId: '5', status: 'UNLOADED',
+        version: 1, unloadingCompletedAt: '2026-10-12T12:00:00', allowedActions: ['RECORD_EMPTY_RETURN'] })
+      if (path.endsWith('/empty-return')) return ok({ status: 'EMPTY_RETURNED' })
+      if (path.endsWith('/candidates?sourceStage=RECEIVED')) return ok([{ sourceStage: 'RECEIVED', inboundCode: domestic.inboundCode,
+        customerId: '1', overseasWarehouseId: '2', packageCount: 1, planPalletId: '11' }])
+      if (path.endsWith('/pre-arrange')) return ok({ dispatchNo: 'DISPATCH-TEST' })
+      if (path.includes('/merchant/v1/last-leg/delivery-orders?')) return ok({ outboundNo: 'OUT-TEST', deliveries: [{ deliveryNo: 'DELIVERY-TEST' }] })
+      if (path.endsWith('/loading') && method === 'GET') return ok({ cargo, recordVersion: 1, manifestHash: 'manifest' })
+      if (path.endsWith('/loading') && method === 'POST') return ok({ recordVersion: 2 })
+      if (path.includes('/fleet/trips')) return ok(trip)
+      if (path === '/api/pda/v1/last-leg/dispatches/DISPATCH-TEST') return ok({ status: 'COMPLETED', canDepart: true,
+        items: [{ dispatchItemId: '12', scheduledPackages: 1, pickedPackages: 0, positions: [{ id: '13', availablePackages: 1 }] }] })
+      if (path === '/api/platform/v1/last-leg/dispatches/DISPATCH-TEST' && method === 'GET') return ok({ items: [{ id: '12', inboundCode: domestic.inboundCode }] })
+      if (path.includes('/outbound-orders/')) return ok({ outbound: { status: 'OUTBOUNDED' }, pallets: [{ inboundCode: domestic.inboundCode }] })
+      if (method === 'GET') assert.fail(`unexpected GET ${path}`)
+      return ok({})
+    } }
+  return { input, domestic, context, checkpoint, calls }
+}
+
+test('normal single-ticket HTTP chain reaches outbound with existing master resources and PDA identity', async () => {
+  const f = fixture(), result = await runOverseasStage(f)
+  assert.equal(result.status, 'OVERSEAS_OUTBOUNDED')
+  assert.equal(result.fullFlowVerified, false)
+  assert.equal(result.deliveryNo, 'DELIVERY-TEST')
+  assert.ok(f.calls.some(row => row.path.endsWith('/receipts/carton') && row.token === 'pda'))
+  assert.ok(f.calls.some(row => row.path.endsWith('/depart') && row.token === 'pda'))
+  assert.equal(f.calls.filter(row => row.path.endsWith('/terminal-drayages/5')).length, 1)
+  assert.equal(f.calls.filter(row => row.path.endsWith('/empty-return')).length, 1)
+  assert.equal(f.calls.filter(row => row.method !== 'GET' && /\/master-data\/|\/fleet\/drivers|\/iam\//.test(row.path)).length, 0)
+  assert.ok(Object.values(f.checkpoint.state.commands).every(row => row.status === 'DONE'))
+})
+
+test('foreign customer source stops before plan conversion or receiving', async () => {
+  const f = fixture({ foreignSource: true })
+  await assert.rejects(runOverseasStage(f), /来源不属于/)
+  assert.equal(f.calls.filter(row => row.method !== 'GET').length, 0)
+})
+
+test('FBA receives cumulative package count without fabricated or resolved carton marks', async () => {
+  const f = fixture({ destinationType: 'FBA' })
+  f.domestic = { ...f.domestic }; delete f.domestic.cartonMarks
+  const result = await runOverseasStage(f)
+  assert.equal(result.status, 'OVERSEAS_OUTBOUNDED')
+  const received = f.calls.filter(row => row.path.endsWith('/receipts/bulk'))
+  assert.equal(received.length, 1)
+  assert.equal(received[0].body.packageCount, 1)
+  assert.equal(f.calls.filter(row => /\/cartons\/resolve|\/receipts\/carton/.test(row.path)).length, 0)
+})
+
+test('OVERSEAS missing frozen carton marks fails before opening receiving session', async () => {
+  const f = fixture(); f.domestic = { ...f.domestic }; delete f.domestic.cartonMarks
+  await assert.rejects(runOverseasStage(f), /正式冻结箱码/)
+  assert.equal(f.calls.filter(row => /\/prepare\?|\/current\/sign|\/receipts\//.test(row.path)).length, 0)
+})
+
+test('signed single ticket closes its trip and releases only its existing resources', async () => {
+  const checkpoint = journal(), writes = []
+  const overseas = { tripNo: 'TRIP-TEST', dispatchNo: 'DISPATCH-TEST', deliveryNo: 'DELIVERY-TEST' }
+  let trip = { tripNo: overseas.tripNo, vehicleId: '3', driverId: '4', recordVersion: 1,
+    stops: [{ name: 'Origin' }, { name: 'Destination' }] }
+  const context = { request: async (method, path, body) => {
+    if (path.includes('/delivery-orders/')) return ok({ order: { customerId: '1', status: 'DELIVERED', dispatchNo: overseas.dispatchNo } })
+    if (path.endsWith('/completion')) return ok({ canComplete: true, recordVersion: 1, outcomes: [{}] })
+    if (method === 'POST') {
+      writes.push({ path, body }); trip = { ...trip, recordVersion: trip.recordVersion + 1 }
+      if (path.endsWith('/complete')) trip = { ...trip, status: 'COMPLETED', completedAt: '2026-10-12T12:00:00Z' }
+      else if (body.resourceKind === 'VEHICLE') trip.vehicleRelease = { ended: true }
+      else trip.driverRelease = { ended: true }
+    }
+    return ok({ trip, dispatches: [{ dispatchNo: overseas.dispatchNo }] })
+  } }
+  assert.equal((await finishSingleOrderTrip({ input, overseas, context, checkpoint })).status, 'CARGO_COMPLETED_AND_RESOURCES_RELEASED')
+  assert.equal(writes.length, 3)
+  assert.deepEqual(writes.map(row => row.body.recordVersion), [1, 2, 3])
+})
diff --git a/scripts/sql-baseline-contract-helpers.mjs b/scripts/sql-baseline-contract-helpers.mjs
index 92be7086a..df553e04b 100644
--- a/scripts/sql-baseline-contract-helpers.mjs
+++ b/scripts/sql-baseline-contract-helpers.mjs
@@ -49,12 +49,15 @@ function splitValues(value) {
 }
 
 export function seedRows(sql, name) {
-  const pattern = new RegExp(`^INSERT INTO ${name} \\(([^\\n]+?)\\) VALUES \\(([^\\n]+)\\);$`, 'gm')
-  return [...sql.matchAll(pattern)].map(match => {
+  const pattern = new RegExp(`^INSERT INTO ${name} \\(([^\\n]+?)\\) VALUES\\s*([\\s\\S]*?);$`, 'gm')
+  return [...sql.replaceAll('\r\n', '\n').matchAll(pattern)].flatMap(match => {
     const keys = match[1].split(',').map(key => key.trim())
-    const values = splitValues(match[2])
-    if (keys.length !== values.length) throw new Error(`Invalid seed columns: ${name}`)
-    return Object.fromEntries(keys.map((key, i) => [key, values[i]]))
+    return splitValues(match[2]).map(row => {
+      if (!row.startsWith('(') || !row.endsWith(')')) throw new Error(`Invalid seed row: ${name}`)
+      const values = splitValues(row.slice(1, -1))
+      if (keys.length !== values.length) throw new Error(`Invalid seed columns: ${name}`)
+      return Object.fromEntries(keys.map((key, i) => [key, values[i]]))
+    })
   })
 }
 
diff --git a/scripts/synchronous-dependency-baseline.mjs b/scripts/synchronous-dependency-baseline.mjs
index dbfbb24ec..1dda4fdbf 100644
--- a/scripts/synchronous-dependency-baseline.mjs
+++ b/scripts/synchronous-dependency-baseline.mjs
@@ -15,6 +15,30 @@ const http = (path, source, target, contexts, access, idempotency, note) => ({
 })
 
 export const SYNCHRONOUS_CLIENTS = Object.freeze([
+  feign('lastleg-service/src/main/java/com/baiyue/lastleg/appointmentplanning/AppointmentForecastClient.java',
+    'lastleg-service', 'firstleg-service', ['REQUEST'], 'READ', 'SAFE_READ',
+    '预约影响刷新按柜次批量读取头程不可变船期事实；POST仅查询，刷新写入仅在Lastleg本域，不写Firstleg'),
+  feign('lastleg-service/src/main/java/com/baiyue/lastleg/appointmentplanning/AppointmentWarehouseClient.java',
+    'lastleg-service', 'warehouse-service', ['REQUEST'], 'READ', 'SAFE_READ',
+    '预约货源、整柜及外接候选读取权威启用仓库目录与主档，不创建仓库或预留资源'),
+  feign('lastleg-service/src/main/java/com/baiyue/lastleg/service/reference/ReturnCustomerReferenceClient.java',
+    'lastleg-service', 'iam-service', ['REQUEST'], 'READ', 'SAFE_READ',
+    '退货订单补全客户快照时按客户ID读取IAM有效客户；历史读取失败保留未知，不调用车队业务或客户资格写操作'),
+  feign('lastleg-service/src/main/java/com/baiyue/lastleg/transfer/gateway/TransferWarehouseCatalogClient.java',
+    'lastleg-service', 'warehouse-service', ['REQUEST'], 'READ', 'SAFE_READ',
+    '转仓实收按冻结FBA编码读取权威目录，拒绝缺失或歧义；资源预留仍由独立WarehouseResourceGateway处理'),
+  feign('order/src/main/java/com/baiyue/order/client/LastlegOrderProgressClient.java',
+    'order-service', 'lastleg-service', ['REQUEST'], 'READ', 'SAFE_READ',
+    '客户订单工作台按服务端客户ID批量读取尾程进度；POST无业务写入，失败不伪造待办或回退成功'),
+  http('lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/client/RestLingxingAnalyticsClient.java',
+    'lastleg-service', 'integration-service', ['BACKGROUND'], 'READ', 'NONE',
+    '持久任务后台逐页/逐单读取领星适配接口；每次调用先预留账号额度并冻结attempt上下文，真实尝试耗费预算，未知结果持久暂停，禁止传输层自动重试；人工命令仅入队，报表查询不调用此客户端'),
+  http('integration-service/src/main/java/com/baiyue/integration/provider/lingxing/LingxingHttpBudgetAuthority.java',
+    'integration-service', 'lastleg-service', ['BACKGROUND'], 'READ_WRITE', 'MIXED',
+    '后台采集出口向Lastleg申请一次性许可并确认真实尝试；authorize消费持久预算，不可重复获得许可，complete按attempt/operation/hash及结果摘要幂等，冲突拒绝；不递归执行采集，不自动重试或跟随重定向'),
+  http('integration-service/src/main/java/com/baiyue/integration/provider/lingxing/LingxingWmsClient.java',
+    'integration-service', 'external-lingxing-wms', ['EXTERNAL'], 'READ', 'NONE',
+    '受控WMS OMP查询不写供应商业务，但每次HTTP消耗账号额度；一许可仅允许一次尝试，OFF/无独占窗口拒绝，429或结果不确定停止新请求，无自动重试，不等同可无成本重放的SAFE_READ'),
   feign('lastleg-service/src/main/java/com/baiyue/lastleg/fleet/reporting/TripFinanceClient.java',
     'lastleg-service', 'finance-service', ['REQUEST'], 'READ', 'SAFE_READ',
     '车次财务按不可变发车客户及派送来源批量只读查询，POST无业务写入；内部服务令牌保护，实收另按公网权限裁剪，不逐行查询或推算未分配收款'),
diff --git a/scripts/synchronous-dependency-contract.test.mjs b/scripts/synchronous-dependency-contract.test.mjs
index 94cdf6b22..6675777cd 100644
--- a/scripts/synchronous-dependency-contract.test.mjs
+++ b/scripts/synchronous-dependency-contract.test.mjs
@@ -33,6 +33,7 @@ const expectedOnlineEdges = [
   'iam-service->warehouse-service',
   'lastleg-service->file-service',
   'lastleg-service->finance-service',
+  'lastleg-service->firstleg-service',
   'lastleg-service->iam-service',
   'lastleg-service->print-service',
   'lastleg-service->warehouse-overseas-service',
@@ -41,12 +42,15 @@ const expectedOnlineEdges = [
   'order-service->finance-service',
   'order-service->firstleg-service',
   'order-service->iam-service',
+  'order-service->lastleg-service',
   'order-service->warehouse-service',
   'warehouse-overseas-service->print-service',
   'warehouse-overseas-service->warehouse-service'
 ]
 
 const expectedBackgroundEdges = [
+  'integration-service->lastleg-service',
+  'lastleg-service->integration-service',
   'file-service->finance-service',
   'file-service->firstleg-service',
   'file-service->iam-service',
@@ -103,7 +107,7 @@ test('all Feign clients have reviewed context, access and idempotency metadata',
   const reviewed = SYNCHRONOUS_CLIENTS.filter(client => client.transport === 'FEIGN')
     .map(({ path, source, target }) => ({ path, source, target }))
     .sort((left, right) => left.path.localeCompare(right.path))
-  assert.equal(reviewed.length, 72)
+  assert.equal(reviewed.length, 77)
   assert.deepEqual(await discoverFeignEdges(), reviewed)
 })
 
@@ -119,7 +123,7 @@ test('all raw HTTP transports have reviewed context, access and idempotency meta
   }
   const reviewed = SYNCHRONOUS_CLIENTS.filter(client => client.transport === 'HTTP')
     .map(client => client.path).sort()
-  assert.equal(reviewed.length, 25)
+  assert.equal(reviewed.length, 28)
   assert.deepEqual(discovered.sort(), reviewed)
 })
 
@@ -194,14 +198,14 @@ test('REQUEST, BACKGROUND and full graphs remain separate executable baselines',
   ])
   assert.deepEqual(stronglyConnectedComponents(graphEdges('REQUEST')), [
     ['auth-service', 'iam-service'],
-    ['finance-service', 'firstleg-service', 'order-service']
+    ['finance-service', 'firstleg-service', 'lastleg-service', 'order-service']
   ])
   assert.deepEqual(stronglyConnectedComponents(graphEdges('BACKGROUND')), [[
-    'finance-service', 'firstleg-service', 'lastleg-service', 'order-service'
+    'finance-service', 'firstleg-service', 'integration-service', 'lastleg-service', 'order-service'
   ]])
   assert.deepEqual(stronglyConnectedComponents(graphEdges('ALL')), [[
     'auth-service', 'file-service', 'finance-service',
-    'firstleg-service', 'iam-service', 'lastleg-service', 'order-service'
+    'firstleg-service', 'iam-service', 'integration-service', 'lastleg-service', 'order-service'
   ]])
 })
 
@@ -222,7 +226,7 @@ test('unified authority checks remain infrastructure edges and direct events rem
   assert.ok(!SYNCHRONOUS_CLIENTS.some(client => ['event-bridge-service','gateway-overseas'].includes(client.source) || ['event-bridge-service','gateway-overseas'].includes(client.target)))
 })
 
-test('Order, Firstleg and Finance form the reviewed REQUEST SCC', () => {
+test('Order, Firstleg, Finance and Lastleg form the reviewed REQUEST SCC', () => {
   const requestClients = SYNCHRONOUS_CLIENTS.filter(client => client.contexts.includes('REQUEST'))
   const orderToFirstleg = requestClients.filter(client =>
     client.source === 'order-service' && client.target === 'firstleg-service')
@@ -260,17 +264,17 @@ test('known user entries expose every longest simple REQUEST path over the two-h
       'iam-service->auth-service',
       'iam-service->warehouse-service'
     ] },
-    'order-service': { hops: 5, paths: [
-      'order-service->finance-service->firstleg-service->file-service->iam-service->auth-service',
-      'order-service->finance-service->firstleg-service->file-service->iam-service->warehouse-service'
+    'order-service': { hops: 6, paths: [
+      'order-service->lastleg-service->finance-service->firstleg-service->file-service->iam-service->auth-service',
+      'order-service->lastleg-service->finance-service->firstleg-service->file-service->iam-service->warehouse-service'
     ] },
-    'firstleg-service': { hops: 5, paths: [
-      'firstleg-service->order-service->finance-service->file-service->iam-service->auth-service',
-      'firstleg-service->order-service->finance-service->file-service->iam-service->warehouse-service'
+    'firstleg-service': { hops: 6, paths: [
+      'firstleg-service->order-service->lastleg-service->finance-service->file-service->iam-service->auth-service',
+      'firstleg-service->order-service->lastleg-service->finance-service->file-service->iam-service->warehouse-service'
     ] },
-    'finance-service': { hops: 5, paths: [
-      'finance-service->firstleg-service->order-service->file-service->iam-service->auth-service',
-      'finance-service->firstleg-service->order-service->file-service->iam-service->warehouse-service'
+    'finance-service': { hops: 6, paths: [
+      'finance-service->firstleg-service->order-service->lastleg-service->file-service->iam-service->auth-service',
+      'finance-service->firstleg-service->order-service->lastleg-service->file-service->iam-service->warehouse-service'
     ] },
     'file-service': { hops: 2, paths: [
       'file-service->iam-service->auth-service',
@@ -278,7 +282,9 @@ test('known user entries expose every longest simple REQUEST path over the two-h
     ] },
     'lastleg-service': { hops: 6, paths: [
       'lastleg-service->finance-service->firstleg-service->order-service->file-service->iam-service->auth-service',
-      'lastleg-service->finance-service->firstleg-service->order-service->file-service->iam-service->warehouse-service'
+      'lastleg-service->finance-service->firstleg-service->order-service->file-service->iam-service->warehouse-service',
+      'lastleg-service->firstleg-service->order-service->finance-service->file-service->iam-service->auth-service',
+      'lastleg-service->firstleg-service->order-service->finance-service->file-service->iam-service->warehouse-service'
     ] },
     'warehouse-service': { hops: 0, paths: ['warehouse-service'] },
     'warehouse-overseas-service': { hops: 1, paths: [
@@ -292,6 +298,44 @@ test('known user entries expose every longest simple REQUEST path over the two-h
   }
 })
 
+test('self-operated collection and quota callbacks stay outside the REQUEST graph', async () => {
+  const find = suffix => SYNCHRONOUS_CLIENTS.find(client => client.path.endsWith(suffix))
+  const collection = find('/selfoperated/analytics/client/RestLingxingAnalyticsClient.java')
+  const authority = find('/provider/lingxing/LingxingHttpBudgetAuthority.java')
+  const supplier = find('/provider/lingxing/LingxingWmsClient.java')
+  assert.deepEqual([collection.contexts, collection.access, collection.idempotency], [['BACKGROUND'], 'READ', 'NONE'])
+  assert.deepEqual([authority.contexts, authority.access, authority.idempotency], [['BACKGROUND'], 'READ_WRITE', 'MIXED'])
+  assert.deepEqual([supplier.contexts, supplier.access, supplier.idempotency], [['EXTERNAL'], 'READ', 'NONE'])
+  assert.equal(graphEdges('REQUEST').includes('lastleg-service->integration-service'), false)
+  assert.equal(graphEdges('REQUEST').includes('integration-service->lastleg-service'), false)
+  // The background service graph is bidirectional; the permit callback must not re-enter collection.
+  const egress = await readFile(path.join(root,
+    'lastleg-service/src/main/java/com/baiyue/lastleg/selfoperated/analytics/request/SelfopEgressService.java'), 'utf8')
+  assert.doesNotMatch(egress, /RestLingxingAnalyticsClient|LingxingAnalyticsClient|SelfopExecutionService/)
+  const callback = await readFile(path.join(root, authority.path), 'utf8')
+  assert.match(callback, /followRedirects\(HttpClient\.Redirect\.NEVER\)/)
+  assert.match(callback, /timeout\(Duration\.ofSeconds\(5\)\)/)
+  assert.doesNotMatch(callback, /RetryTemplate|Retryer|@Retryable|\.retry\(/)
+})
+
+test('new domain reference clients are exact readonly internal dependencies', async () => {
+  const reviewed = [
+    ['lastleg-service/src/main/java/com/baiyue/lastleg/appointmentplanning/AppointmentForecastClient.java', 'firstleg-service', '/internal/firstleg/appointment-forecasts/batch'],
+    ['lastleg-service/src/main/java/com/baiyue/lastleg/appointmentplanning/AppointmentWarehouseClient.java', 'warehouse-service', '/internal/warehouses/order-catalog'],
+    ['lastleg-service/src/main/java/com/baiyue/lastleg/service/reference/ReturnCustomerReferenceClient.java', 'iam-service', '/internal/iam/finance-customers'],
+    ['lastleg-service/src/main/java/com/baiyue/lastleg/transfer/gateway/TransferWarehouseCatalogClient.java', 'warehouse-service', '/internal/warehouses/order-catalog'],
+    ['order/src/main/java/com/baiyue/order/client/LastlegOrderProgressClient.java', 'lastleg-service', '/internal/lastleg/v1/customer-order-progress']
+  ]
+  for (const [file, target, endpoint] of reviewed) {
+    const client = SYNCHRONOUS_CLIENTS.find(row => row.path === file)
+    assert.deepEqual([client.target, client.contexts, client.access, client.idempotency], [target, ['REQUEST'], 'READ', 'SAFE_READ'])
+    const source = await readFile(path.join(root, file), 'utf8')
+    assert.ok(source.includes(endpoint))
+    assert.ok(source.includes('X-Internal-Service-Token'))
+    assert.doesNotMatch(source, /@(?:PutMapping|DeleteMapping|PatchMapping)/)
+  }
+})
+
 test('delivery fee coverage is a single readonly Finance hop and cannot write financial state', async () => {
   const client = await readFile(path.join(root, 'lastleg-service/src/main/java/com/baiyue/lastleg/client/FinanceFeeCoverageClient.java'), 'utf8')
   const service = await readFile(path.join(root, 'finance/src/main/java/com/baiyue/finance/service/DeliveryFeeCoverageQueryService.java'), 'utf8')
diff --git a/warehouse-overseas-service/AGENTS.md b/warehouse-overseas-service/AGENTS.md
index 5b5ae5124..a85755f74 100644
--- a/warehouse-overseas-service/AGENTS.md
+++ b/warehouse-overseas-service/AGENTS.md
@@ -1,5 +1,10 @@
 # Overseas Warehouse Service 模块指引
 
+## 数据库访问与中文注释约束
+
+- 强制遵守根 `../AGENTS.md` 的“数据库访问与中文代码注释”全部规则：正常业务访问统一为 `Controller → Service → Repository → Mapper`，不得省略 Repository 或跨层直调；生产 SQL 由 Mapper 执行，Repository 不得直接使用 JdbcTemplate 或原生 JDBC。非 HTTP 入口从 Service 进入；无数据库模块不引入数据库访问。
+- 每个手写方法及构造器须有简短中文说明；核心业务规则、复杂 SQL、事务、锁、幂等、并发及失败处理须补充适量中文注释，重点说明原因和边界。新增、修改方法立即执行，触及的存量代码同步整改。
+
 ## 职责与边界
 
 - Mapper 只由 `BaiyueWarehouseOverseasApplication.java` 对 `com.baiyue.warehouse` 根包按 `@Mapper` 过滤扫描；新增或移动 Mapper 后从后端根运行 `node scripts/mapper-scan-contract.mjs`，不得增加子域扫描配置。
diff --git a/warehouse-overseas-service/src/main/java/com/baiyue/warehouse/service/WarehouseResourceService.java b/warehouse-overseas-service/src/main/java/com/baiyue/warehouse/service/WarehouseResourceService.java
index 024636e81..f79428c25 100644
--- a/warehouse-overseas-service/src/main/java/com/baiyue/warehouse/service/WarehouseResourceService.java
+++ b/warehouse-overseas-service/src/main/java/com/baiyue/warehouse/service/WarehouseResourceService.java
@@ -18,8 +18,6 @@ import org.springframework.transaction.annotation.Transactional;
 import jakarta.annotation.Resource;
 
 import java.util.Set;
-import java.time.LocalDate;
-import java.time.format.DateTimeFormatter;
 import org.springframework.util.StringUtils;
 
 @Service
@@ -448,11 +446,7 @@ public class WarehouseResourceService {
     }
 
     private static String generatedPalletCode(String warehouseCode, long palletId) {
-        String compactWarehouseCode = warehouseCode.replaceAll("[^A-Za-z0-9]", "").toUpperCase(java.util.Locale.ROOT);
-        if (compactWarehouseCode.length() > 9) compactWarehouseCode = compactWarehouseCode.substring(0, 9);
-        return "PLT-" + compactWarehouseCode + "-"
-            + LocalDate.now().format(DateTimeFormatter.ofPattern("yyMMdd")) + "-"
-            + Long.toUnsignedString(palletId, 36).toUpperCase(java.util.Locale.ROOT);
+        return "TP-" + Long.toUnsignedString(palletId, 36).toUpperCase(java.util.Locale.ROOT);
     }
 
     private static String defaultLocationCode(String warehouseCode) {
diff --git a/warehouse-overseas-service/src/test/java/com/baiyue/warehouse/service/WarehouseResourceServiceTest.java b/warehouse-overseas-service/src/test/java/com/baiyue/warehouse/service/WarehouseResourceServiceTest.java
index fa6f46a7b..64a7fe197 100644
--- a/warehouse-overseas-service/src/test/java/com/baiyue/warehouse/service/WarehouseResourceServiceTest.java
+++ b/warehouse-overseas-service/src/test/java/com/baiyue/warehouse/service/WarehouseResourceServiceTest.java
@@ -262,7 +262,7 @@ class WarehouseResourceServiceTest {
 
         ArgumentCaptor<WarehousePalletEntity> captor = ArgumentCaptor.forClass(WarehousePalletEntity.class);
         verify(repository).insertPallet(captor.capture());
-        assertThat(captor.getValue().getPalletCode()).matches("PLT-USLAX01-[0-9]{6}-[0-9A-Z]+");
+        assertThat(captor.getValue().getPalletCode()).matches("TP-[0-9A-Z]+");
         assertThat(captor.getValue().getPalletCode()).hasSizeLessThanOrEqualTo(34);
         assertThat(captor.getValue().getLocationId()).isEqualTo(30003L);
         assertThat(captor.getValue().getId()).isNotNull();
diff --git a/warehouse/AGENTS.md b/warehouse/AGENTS.md
index 09585a20f..51f8a6b40 100644
--- a/warehouse/AGENTS.md
+++ b/warehouse/AGENTS.md
@@ -1,5 +1,10 @@
 # Warehouse Service 模块指引
 
+## 数据库访问与中文注释约束
+
+- 强制遵守根 `../AGENTS.md` 的“数据库访问与中文代码注释”全部规则：正常业务访问统一为 `Controller → Service → Repository → Mapper`，不得省略 Repository 或跨层直调；生产 SQL 由 Mapper 执行，Repository 不得直接使用 JdbcTemplate 或原生 JDBC。非 HTTP 入口从 Service 进入；无数据库模块不引入数据库访问。
+- 每个手写方法及构造器须有简短中文说明；核心业务规则、复杂 SQL、事务、锁、幂等、并发及失败处理须补充适量中文注释，重点说明原因和边界。新增、修改方法立即执行，触及的存量代码同步整改。
+
 ## 职责与边界
 
 - Mapper 只由 `BaiyueWarehouseApplication.java` 对 `com.baiyue.warehouse` 根包按 `@Mapper` 过滤扫描；新增或移动 Mapper 后从后端根运行 `node scripts/mapper-scan-contract.mjs`，不得增加子域扫描配置。