From 6d46506726a8aae79aa49b292f73c7806b5f2e78 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E9=BB=84=E8=87=AA=E8=BE=BE?= <980324341@qq.com>
Date: Mon, 14 Sep 2026 04:15:36 +0800
Subject: [PATCH] =?UTF-8?q?fix:=20=E5=85=A8=E7=BB=B4=E5=BA=A6=E5=AE=A1?=
 =?UTF-8?q?=E6=9F=A5=E4=BF=AE=E5=A4=8D=EF=BC=88=E5=AE=89=E5=85=A8/?=
 =?UTF-8?q?=E6=AD=A3=E7=A1=AE=E6=80=A7/=E6=80=A7=E8=83=BD/=E7=A8=B3?=
 =?UTF-8?q?=E5=AE=9A=E6=80=A7/=E5=AE=A2=E6=88=B7=E7=AB=AF/=E5=89=8D?=
 =?UTF-8?q?=E7=AB=AF=EF=BC=89?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

安全
- /api/ziniao/** 五个匿名接口加管理员鉴权（此前可匿名换取任意员工店铺登录令牌）
- 删除 Flask 遗留后门：默认密码建超管 + 每次启动写生产 users 表（服务端与客户端各一份）
- 进度/详情接口归属过滤：新增 TaskProgressOwnershipSupport，11 模块 progress/light 与
  /tasks/batch 接入，DTO 补 userId，前端 13 个查询封装补传（未传时后端不过滤，兼容旧端）
- 代理提取链接（含账密）不再明文入日志（新增 common/util/SecretMasking）
- 全局异常兜底不再回传原始异常信息；内部令牌比较改常量时间
- 登录加失败计数与锁定（10 次锁 15 分钟）；品牌源文件下载加 SSRF 防护
- AdminApiGuardFilter 覆盖前缀从 2 扩到 15（开关默认 false，行为不变，为收紧做准备）
- 生产关闭 springdoc/knife4j（/doc.html 匿名可读全部接口定义）

正确性
- 40901/40902 拆分：锁竞争不再被伪装成 success=true（此前客户端停止重试、分片静默丢失）
- 假成功收敛：集采明细批量写失败改为抛出、去重 worker 异常标失败、4 个 worker 改判
  success 字段、publish 空 ASIN 行参与批次 flush、巡店删除全失败带 error 上报
- 客户端心跳 discard 移入 finally（7 模块，失败路径不再留僵尸 RUNNING 任务）
- 状态机条件更新：跟价停止循环、集采 activate/fail、imagevideo 归档回填、店铺匹配提交

性能
- 前端入口包 JS 1.05MB→204KB、CSS 355KB→10.7KB（Element Plus 改按需 + el-config-provider）
- 载荷引用计数按指针里的 taskId 收敛（原 JSON 列 IN 全表扫且逐行调用）
- 店铺明细多值批量 INSERT；快照 upsert 预载缓存；结果文件列改单条 UPDATE
- 新增迁移 V120（补 3 个缺失索引）/V121（删 4 个被覆盖的冗余索引）/V122（URL 前缀索引）

稳定性
- 新增 common/util/ThreadPools 有界线程池替换 5 处无界队列（防堆积 OOM）
- Redis 锁释放改 Lua 原子校验（原裸 delete 会误删他人已过期的锁）
- imagevideo 加死节点接管；锁续期失败重试；调度池 4→16；openStream 全部加超时
- 事务内远程对象删除移到提交后；启动恢复锁按实例命名

客户端
- 不再 taskkill /f /im chrome.exe（改为按调试端口精准回收，不杀用户自己的浏览器）
- 密码检测不再无条件杀紫鸟进程；品牌检测加全局互斥（代理池不再互相覆盖）
- base_dir 统一到 exe 目录（原被 os.getcwd() 覆盖，日志/缓存会分裂两个目录）
- 缓存加定时清理；图片下载加超时；mkstemp 句柄托管

测试
- 同步更新受影响的契约测试（构造器签名/条件更新/方法改名/新增接口方法等）
- 修复 FaultInjectionTest 等 3 处 mock 未 stub 流式 read 导致的读循环 OOM
- mvn test 2795 个测试全绿
---
 .../src/components/NotificationBell.vue       |   42 +-
 .../common/exception/BusinessCodes.java       |   28 +
 .../exception/GlobalExceptionHandler.java     |   12 +-
 .../aiimage/common/util/SecretMasking.java    |   52 +
 .../aiimage/common/util/ThreadPools.java      |   47 +
 .../aiimage/config/AdminApiGuardFilter.java   |   22 +
 .../nanri/aiimage/config/HttpClientPool.java  |   36 +
 .../aiimage/config/SchedulingConfig.java      |    9 +-
 .../admin/support/AdminAuthSupport.java       |    5 +-
 .../AppearancePatentController.java           |    9 +-
 .../dto/AppearancePatentTaskBatchRequest.java |    4 +
 .../service/AppearancePatentTaskService.java  |    4 +-
 .../modules/auth/service/AuthService.java     |   51 +
 .../BrandTaskProgressCacheService.java        |   16 +-
 .../brand/service/BrandTaskService.java       |   69 +-
 .../service/BrandTaskStorageService.java      |    7 +-
 .../controller/CollectDataController.java     |    9 +-
 .../dto/CollectDataTaskBatchRequest.java      |    4 +
 .../service/CollectDataService.java           |   78 +-
 .../util/CollectDataResultDetailCodec.java    |    7 +-
 .../CollectDataResultItemBatchWriter.java     |   20 +-
 .../convert/service/ConvertRunService.java    |   12 +-
 .../dedupe/service/DedupeRunService.java      |   25 +-
 .../service/DedupeTotalDataService.java       |   12 +-
 .../controller/DeleteBrandRunController.java  |   13 +-
 .../dto/DeleteBrandTaskBatchRequest.java      |    4 +
 .../service/DeleteBrandRunService.java        |    4 +-
 .../DeleteBrandTaskStorageService.java        |    7 +-
 .../service/ImageVideoArchiveService.java     |    7 +-
 .../service/ImageVideoAsyncTaskService.java   |   49 +
 .../controller/PatrolDeleteController.java    |    9 +-
 .../dto/PatrolDeleteTaskBatchRequest.java     |    3 +
 .../service/PatrolDeleteTaskService.java      |   60 +-
 .../controller/PriceTrackController.java      |   13 +-
 .../model/dto/PriceTrackTaskBatchRequest.java |    4 +
 .../service/PriceTrackLoopRunService.java     |   17 +-
 .../service/PriceTrackTaskService.java        |   20 +-
 .../ProductRiskResolveController.java         |   13 +-
 .../dto/ProductRiskTaskBatchRequest.java      |    4 +
 .../service/ProductRiskTaskService.java       |   20 +-
 .../controller/QueryAsinTaskController.java   |    9 +-
 .../model/dto/QueryAsinTaskBatchRequest.java  |    3 +
 .../service/QueryAsinTaskService.java         |   61 +-
 .../AdminShopDataCrawlTaskController.java     |    8 +-
 .../AdminShopDataCrawlTasksController.java    |    9 +-
 .../ShopDataCrawlTaskController.java          |    9 +-
 .../mapper/ShopDataCrawlItemMapper.java       |   25 +
 .../dto/ShopDataCrawlTaskBatchRequest.java    |    4 +
 .../ShopDataCrawlItemStoreService.java        |   11 +-
 .../service/ShopDataCrawlTaskService.java     |   74 +-
 .../controller/ShopMatchController.java       |    9 +-
 .../service/ShopMatchTaskService.java         |   25 +-
 .../controller/SimilarAsinController.java     |   10 +-
 .../dto/SimilarAsinTaskBatchRequest.java      |    4 +
 .../dto/SimilarAsinTaskLightRequest.java      |    4 +
 .../SimilarAsinImagePrefetchService.java      |   18 +-
 .../service/SimilarAsinTaskService.java       |    4 +-
 .../util/SimilarAsinImageEmbedder.java        |    3 +-
 .../task/service/StaleTaskRepairService.java  |   22 +-
 .../service/TaskDistributedLockService.java   |   57 +-
 .../task/service/TaskHeartbeatService.java    |   11 +-
 .../service/TaskProgressOwnershipSupport.java |   65 +
 .../task/service/TaskResultItemService.java   |  120 +-
 .../service/TaskResultPayloadService.java     |    7 +-
 ...kScopePayloadBufferMaintenanceService.java |   10 +-
 .../TransientPayloadDeleteOrchestrator.java   |   49 +-
 .../TransientPayloadStorageService.java       |   74 +-
 .../usersecret/client/JikipProxyClient.java   |    4 +-
 .../service/UserApiSecretCheckService.java    |    4 +-
 .../controller/WithdrawTaskController.java    |    9 +-
 .../model/dto/WithdrawTaskBatchRequest.java   |    4 +
 .../withdraw/service/WithdrawTaskService.java |   40 +-
 .../controller/ZiniaoAuthController.java      |   22 +-
 .../src/main/resources/application-server.yml |   13 +
 ...120__stale_scan_and_daily_file_indexes.sql |   71 ++
 .../db/V121__drop_redundant_indexes.sql       |   83 ++
 .../db/V122__result_file_url_indexes.sql      |   50 +
 .../aiimage/ArchitectureBoundaryTest.java     |    6 +-
 .../config/HttpClientConnectionReuseTest.java |   18 +-
 .../HttpClientTimeoutEffectiveTest.java       |    7 +-
 .../service/CollectDataServiceTest.java       |   16 +-
 .../util/CollectData10kLoadTest.java          |   12 +-
 .../CollectDataResultItemBatchWriterTest.java |   15 +-
 .../util/CollectDataResultItemCountTest.java  |   14 +-
 .../service/object/FaultInjectionTest.java    |   19 +-
 .../object/RustfsMetricsBaselineTest.java     |   11 +-
 .../service/object/RustfsTotalBudgetTest.java |   10 +-
 .../service/PublishTaskServiceTest.java       |    5 +
 .../service/ShopDataCrawlCleanupTest.java     |   32 +
 .../service/ShopDataCrawlOwnerColumnTest.java |    6 +
 .../SimilarAsinTaskLightControllerTest.java   |   25 +-
 .../ResultSuccessTimingContractTest.java      |   13 +-
 .../RollbackSemanticsContractTest.java        |    8 +-
 .../contract/SuccessTimingContractTest.java   |   37 +-
 .../service/ResultFileJobHandlerTest.java     |    7 +-
 ...ransientPayloadDeleteOrchestratorTest.java |    7 +-
 backend/blueprints/version.py                 |   16 +-
 backend/utils/db.py                           |   85 +-
 frontend-vue/src/App.vue                      |    9 +-
 frontend-vue/src/main.ts                      |   10 +-
 .../pages/brand/components/BrandDedupeTab.vue |   17 +-
 .../brand/components/BrandPatrolDeleteTab.vue |    5 +-
 .../brand/components/BrandPriceTrackTab.vue   |   11 +-
 .../brand/components/BrandProductRiskTab.vue  |    8 +-
 .../brand/components/BrandQueryAsinTab.vue    |   17 +-
 .../brand/components/BrandVariantTab.vue      |   23 +-
 .../brand/components/BrandWithdrawTab.vue     |    5 +-
 .../src/pages/home/DesktopHomePage.vue        |    4 +-
 .../components/DeliveryVideoWorkspace.vue     |   17 +
 .../src/pages/login/DesktopLoginPage.vue      |   88 +-
 .../api/types/modules/appearance-patent.ts    |    6 +-
 .../shared/api/types/modules/collect-data.ts  |    6 +-
 .../shared/api/types/modules/delete-brand.ts  |   14 +-
 .../shared/api/types/modules/permission.ts    |   32 +-
 .../shared/api/types/modules/price-track.ts   |   14 +-
 .../src/shared/api/types/modules/publish.ts   |    4 +-
 .../shared/api/types/modules/query-asin.ts    |    6 +-
 .../shared/api/types/modules/shop-match.ts    |   22 +-
 .../shared/api/types/modules/similar-asin.ts  |    6 +-
 .../src/shared/api/types/modules/withdraw.ts  |    6 +-
 frontend-vue/src/shared/client-changelog.ts   |  148 +++
 .../shared/components/NotificationBell.vue    | 1126 ++++++++++++-----
 .../src/shared/components/UpdateLogList.vue   |   87 ++
 .../components/tasks/HistoryTaskLayer.vue     |    4 +-
 .../shared/composables/useVersionUpdate.ts    |   17 +-
 frontend-vue/tests/client-changelog.test.ts   |  106 ++
 .../tests/modules-appearance-patent.test.ts   |    2 +-
 .../tests/modules-collect-data.test.ts        |    2 +-
 .../tests/modules-delete-brand.test.ts        |    4 +-
 .../tests/modules-price-track.test.ts         |    4 +-
 frontend-vue/tests/modules-publish.test.ts    |    2 +-
 frontend-vue/tests/modules-query-asin.test.ts |    4 +-
 frontend-vue/tests/modules-shop-match.test.ts |    8 +-
 .../tests/modules-similar-asin.test.ts        |    2 +-
 frontend-vue/tests/modules-withdraw.test.ts   |    4 +-
 135 files changed, 3222 insertions(+), 829 deletions(-)
 create mode 100644 backend-java/src/main/java/com/nanri/aiimage/common/exception/BusinessCodes.java
 create mode 100644 backend-java/src/main/java/com/nanri/aiimage/common/util/SecretMasking.java
 create mode 100644 backend-java/src/main/java/com/nanri/aiimage/common/util/ThreadPools.java
 create mode 100644 backend-java/src/main/java/com/nanri/aiimage/modules/task/service/TaskProgressOwnershipSupport.java
 create mode 100644 backend-java/src/main/resources/db/V120__stale_scan_and_daily_file_indexes.sql
 create mode 100644 backend-java/src/main/resources/db/V121__drop_redundant_indexes.sql
 create mode 100644 backend-java/src/main/resources/db/V122__result_file_url_indexes.sql
 create mode 100644 frontend-vue/src/shared/client-changelog.ts
 create mode 100644 frontend-vue/src/shared/components/UpdateLogList.vue
 create mode 100644 frontend-vue/tests/client-changelog.test.ts

diff --git a/admin-frontend-vue/src/components/NotificationBell.vue b/admin-frontend-vue/src/components/NotificationBell.vue
index d37e0d4b..258c0b8c 100644
--- a/admin-frontend-vue/src/components/NotificationBell.vue
+++ b/admin-frontend-vue/src/components/NotificationBell.vue
@@ -57,19 +57,18 @@
           @input="onKeywordInput"
         />
         <div class="bell-search-days">
-          <input
-            v-model="startDate"
-            type="date"
-            class="bell-date-input"
-            aria-label="起始日期"
-            @change="reload"
-          />
-          <span class="bell-date-sep">至</span>
-          <input
-            v-model="endDate"
-            type="date"
-            class="bell-date-input"
-            aria-label="结束日期"
+          <el-date-picker
+            :model-value="dateRangeValue"
+            type="daterange"
+            value-format="YYYY-MM-DD"
+            start-placeholder="开始日期"
+            end-placeholder="结束日期"
+            range-separator="至"
+            size="small"
+            class="bell-date-picker"
+            popper-class="bell-date-popper"
+            :clearable="true"
+            @update:model-value="onDateRangeChange"
             @change="reload"
           />
           <button v-if="hasFilter" type="button" class="bell-search-reset" @click="resetFilters">
@@ -171,6 +170,23 @@ const groupedItems = computed(() => groupNotificationsByDay(items.value))
 const totalPages = computed(() => Math.max(1, Math.ceil(total.value / PAGE_SIZE)))
 const hasFilter = computed(() => Boolean(keyword.value.trim() || startDate.value || endDate.value))
 
+/**
+ * el-date-picker 的绑定桥：日期区间在内部仍用 startDate/endDate 两个 ref 表示
+ * （hasFilter/normalizedDayRange/resetFilters 都基于它们）。
+ * 此前模板写的是 v-model="dateRange"，而 dateRange 从未声明 → vue-tsc 直接报 TS2339 构建失败，
+ * 且日期筛选完全不下发参数。
+ */
+const dateRangeValue = computed<[string, string] | null>(() =>
+  startDate.value && endDate.value ? [startDate.value, endDate.value] : null
+)
+
+function onDateRangeChange(value: [string, string] | null) {
+  const start = value?.[0]
+  const end = value?.[1]
+  startDate.value = start ? String(start) : ''
+  endDate.value = end ? String(end) : ''
+}
+
 let pollTimer: number | null = null
 let searchTimer: number | null = null
 
diff --git a/backend-java/src/main/java/com/nanri/aiimage/common/exception/BusinessCodes.java b/backend-java/src/main/java/com/nanri/aiimage/common/exception/BusinessCodes.java
new file mode 100644
index 00000000..ace43b4a
--- /dev/null
+++ b/backend-java/src/main/java/com/nanri/aiimage/common/exception/BusinessCodes.java
@@ -0,0 +1,28 @@
+package com.nanri.aiimage.common.exception;
+
+/**
+ * 业务错误码常量。
+ *
+ * <p>历史上 40901 被两种语义复用：「任务已结束」（幂等忽略）与「任务正在处理中」（分布式锁竞争，
+ * 应重试）；而 GlobalExceptionHandler 把 40901 一律转成 HTTP 200 + success=true，
+ * 导致锁竞争时 Python worker 误判回传成功并停止重试，分片数据静默丢失。
+ * 现拆分为两个码：
+ * <ul>
+ *   <li>{@link #TASK_ALREADY_FINISHED}：任务已结束，重复提交无意义 → 幂等忽略，响应 success=true；</li>
+ *   <li>{@link #TASK_BUSY}：任务正被其它请求持锁推进 → 响应 success=false，调用方应稍后重试。</li>
+ * </ul>
+ */
+public final class BusinessCodes {
+
+    private BusinessCodes() {
+    }
+
+    /** 任务已结束，拒绝重复提交。语义：幂等忽略，响应 success=true，调用方不应重试。 */
+    public static final int TASK_ALREADY_FINISHED = 40901;
+
+    /** 任务正在处理中（分布式锁竞争）。语义：资源忙，响应 success=false，调用方应稍后重试。 */
+    public static final int TASK_BUSY = 40902;
+
+    /** 任务归属其它实例，需转发。 */
+    public static final int TASK_OWNER_FORWARD = 40903;
+}
diff --git a/backend-java/src/main/java/com/nanri/aiimage/common/exception/GlobalExceptionHandler.java b/backend-java/src/main/java/com/nanri/aiimage/common/exception/GlobalExceptionHandler.java
index f046ea59..5fd99a23 100644
--- a/backend-java/src/main/java/com/nanri/aiimage/common/exception/GlobalExceptionHandler.java
+++ b/backend-java/src/main/java/com/nanri/aiimage/common/exception/GlobalExceptionHandler.java
@@ -61,9 +61,15 @@ public class GlobalExceptionHandler {
 
     @ExceptionHandler(BusinessException.class)
     public ApiResponse<Void> handleBusinessException(BusinessException ex) {
-        if (Integer.valueOf(40901).equals(ex.getCode())) {
+        if (Integer.valueOf(BusinessCodes.TASK_ALREADY_FINISHED).equals(ex.getCode())) {
+            // 幂等忽略：任务已结束时的重复提交无副作用，按成功返回，避免客户端反复重试
             return ApiResponse.success("任务已结束，忽略重复提交", null);
         }
+        if (Integer.valueOf(BusinessCodes.TASK_BUSY).equals(ex.getCode())) {
+            // 锁竞争：必须如实返回失败 + 可重试码，否则 worker 会把「未落库」当成功而停止重试
+            log.warn("[business] 任务忙，调用方应稍后重试: {}", ex.getMessage());
+            return ApiResponse.fail(BusinessCodes.TASK_BUSY, ex.getMessage());
+        }
         return ex.getCode() == null
                 ? ApiResponse.fail(ex.getMessage())
                 : ApiResponse.fail(ex.getCode(), ex.getMessage());
@@ -100,7 +106,9 @@ public class GlobalExceptionHandler {
             return ApiResponse.fail("客户端已断开连接");
         }
         log.error("Unhandled exception", ex);
-        return ApiResponse.fail("服务异常: " + ex.getMessage());
+        // 不再回传原始异常信息：SQL 报错、类名与内部路径会直接暴露给调用方，便于攻击者
+        // 摸清技术栈与表结构。详情只进日志（上方 log.error 已带完整堆栈），对外统一文案。
+        return ApiResponse.fail("服务器内部错误，请稍后重试");
     }
 
     private boolean isClientAbort(Throwable ex) {
diff --git a/backend-java/src/main/java/com/nanri/aiimage/common/util/SecretMasking.java b/backend-java/src/main/java/com/nanri/aiimage/common/util/SecretMasking.java
new file mode 100644
index 00000000..7faee31d
--- /dev/null
+++ b/backend-java/src/main/java/com/nanri/aiimage/common/util/SecretMasking.java
@@ -0,0 +1,52 @@
+package com.nanri.aiimage.common.util;
+
+import java.net.URI;
+
+/**
+ * 敏感串脱敏工具（2026-09 全维度审查后收口）。
+ *
+ * <p>背景：代理提取链接形态为 {@code http://user:pass@host:port}，代码中曾有多处
+ * 直接把整串打进日志，导致用户代理账号密码长期留在应用日志与 docker logs 里。
+ */
+public final class SecretMasking {
+
+    private SecretMasking() {
+    }
+
+    /** 通用掩码：保留前 4 与后 4 字符；过短则整体掩掉。 */
+    public static String mask(String value) {
+        if (value == null || value.isBlank()) {
+            return "";
+        }
+        String text = value.trim();
+        if (text.length() <= 8) {
+            return "****";
+        }
+        return text.substring(0, 4) + "****" + text.substring(text.length() - 4);
+    }
+
+    /** 代理掩码：隐去账号密码，保留 scheme://host:port 便于运维核对。 */
+    public static String maskProxy(String value) {
+        if (value == null || value.isBlank()) {
+            return "";
+        }
+        try {
+            URI uri = URI.create(value.trim());
+            if (uri.getHost() == null || uri.getHost().isBlank()) {
+                return mask(value);
+            }
+            StringBuilder masked = new StringBuilder();
+            masked.append(uri.getScheme() == null ? "http" : uri.getScheme()).append("://");
+            if (uri.getUserInfo() != null && !uri.getUserInfo().isBlank()) {
+                masked.append("***@");
+            }
+            masked.append(uri.getHost());
+            if (uri.getPort() > 0) {
+                masked.append(':').append(uri.getPort());
+            }
+            return masked.toString();
+        } catch (Exception ex) {
+            return mask(value);
+        }
+    }
+}
diff --git a/backend-java/src/main/java/com/nanri/aiimage/common/util/ThreadPools.java b/backend-java/src/main/java/com/nanri/aiimage/common/util/ThreadPools.java
new file mode 100644
index 00000000..27977983
--- /dev/null
+++ b/backend-java/src/main/java/com/nanri/aiimage/common/util/ThreadPools.java
@@ -0,0 +1,47 @@
+package com.nanri.aiimage.common.util;
+
+import java.util.concurrent.ExecutorService;
+import java.util.concurrent.LinkedBlockingQueue;
+import java.util.concurrent.ThreadPoolExecutor;
+import java.util.concurrent.TimeUnit;
+
+/**
+ * 有界线程池工厂（2026-09 全维度审查补）。
+ *
+ * <p>业务里多处使用 {@code Executors.newFixedThreadPool}：它内部是**无界**
+ * {@code LinkedBlockingQueue}，任务堆积时永远不会触发拒绝策略，会把内存吃满
+ * （表现为 OOM，或整机因 GC 变慢导致所有任务一起劣化）。
+ * 统一改为有界队列 + {@code CallerRunsPolicy}：队列满时在提交线程执行，形成天然背压。
+ */
+public final class ThreadPools {
+
+    private ThreadPools() {
+    }
+
+    /** 默认队列容量：足以吸收突发，又不至于无界堆积。 */
+    public static final int DEFAULT_QUEUE_CAPACITY = 512;
+
+    /** 有界固定线程池（daemon 线程，空闲可回收）。 */
+    public static ExecutorService boundedFixed(String threadNamePrefix, int threads) {
+        return boundedFixed(threadNamePrefix, threads, DEFAULT_QUEUE_CAPACITY);
+    }
+
+    /** 有界固定线程池（显式队列容量）。 */
+    public static ExecutorService boundedFixed(String threadNamePrefix, int threads, int queueCapacity) {
+        ThreadPoolExecutor executor = new ThreadPoolExecutor(
+                Math.max(1, threads),
+                Math.max(1, threads),
+                // keepAliveTime 必须 > 0：下面开了 allowCoreThreadTimeOut，
+                // 传 0 会让构造器直接抛 "Core threads must have nonzero keep alive times"
+                60L, TimeUnit.SECONDS,
+                new LinkedBlockingQueue<>(Math.max(1, queueCapacity)),
+                runnable -> {
+                    Thread thread = new Thread(runnable, threadNamePrefix);
+                    thread.setDaemon(true);
+                    return thread;
+                },
+                new ThreadPoolExecutor.CallerRunsPolicy());
+        executor.allowCoreThreadTimeOut(true);
+        return executor;
+    }
+}
diff --git a/backend-java/src/main/java/com/nanri/aiimage/config/AdminApiGuardFilter.java b/backend-java/src/main/java/com/nanri/aiimage/config/AdminApiGuardFilter.java
index aee32331..b130cac5 100644
--- a/backend-java/src/main/java/com/nanri/aiimage/config/AdminApiGuardFilter.java
+++ b/backend-java/src/main/java/com/nanri/aiimage/config/AdminApiGuardFilter.java
@@ -63,6 +63,25 @@ public class AdminApiGuardFilter extends OncePerRequestFilter {
     private static final String[] USER_TOOL_PREFIXES = {
             "/api/collect-data",
             "/api/price-track",
+            // 2026-09 全维度审查补：以下前缀此前完全在守卫范围之外。
+            // /api/files 匿名可上传（2GB/次，可耗尽临时盘）；/api/digital-human 匿名可发布/删除版本；
+            // /api/image-video 的 secrets 接口 userId 取自请求体；/api/brand 的 fileUrl 曾可直接请求任意地址。
+            "/api/files",
+            "/api/digital-human",
+            "/api/image-video",
+            "/api/brand",
+            "/api/appearance-patent",
+            "/api/similar-asin",
+            "/api/query-asin",
+            "/api/patrol-delete",
+            "/api/product-risk-resolve",
+            "/api/shop-match",
+            "/api/shop-data-crawl",
+            "/api/withdraw",
+            "/api/task-file-jobs",
+            // /api/tasks/{taskId}/interrupted 仅凭 taskId 即可把 RUNNING 任务置为 FAILED，
+            // 匿名遍历 taskId 就能批量打断线上任务
+            "/api/tasks",
     };
 
     /**
@@ -72,6 +91,9 @@ public class AdminApiGuardFilter extends OncePerRequestFilter {
     private static final String[] SELF_SERVICE_PREFIXES = {
             "/api/user-secrets",
             "/api/notifications",
+            // 2026-09 全维度审查补：内部端点此前仅靠 controller 自校验令牌，纳入守卫后
+            // 不带令牌的请求直接 401（带可信令牌的仍由 doFilterInternal 放行）
+            "/api/internal",
     };
 
     private final AdminAuthSupport adminAuthSupport;
diff --git a/backend-java/src/main/java/com/nanri/aiimage/config/HttpClientPool.java b/backend-java/src/main/java/com/nanri/aiimage/config/HttpClientPool.java
index d1d7db09..be13e670 100644
--- a/backend-java/src/main/java/com/nanri/aiimage/config/HttpClientPool.java
+++ b/backend-java/src/main/java/com/nanri/aiimage/config/HttpClientPool.java
@@ -3,12 +3,16 @@ package com.nanri.aiimage.config;
 import org.springframework.http.client.ClientHttpRequestFactory;
 import org.springframework.http.client.JdkClientHttpRequestFactory;
 
+import java.io.IOException;
+import java.io.InputStream;
 import java.net.Authenticator;
 import java.net.InetSocketAddress;
 import java.net.PasswordAuthentication;
 import java.net.ProxySelector;
 import java.net.URI;
 import java.net.http.HttpClient;
+import java.net.http.HttpRequest;
+import java.net.http.HttpResponse;
 import java.time.Duration;
 import java.util.Map;
 import java.util.concurrent.ConcurrentHashMap;
@@ -55,6 +59,38 @@ public class HttpClientPool {
         }
     }
 
+    /**
+     * 打开远程文件流（带超时），调用方负责关闭返回的流。
+     *
+     * <p>替代裸 {@code URI.create(url).toURL().openStream()}：后者走 JVM 默认超时（0 = 无限），
+     * 上游半开连接或挂起时会把 Tomcat 工作线程无限占用（管理端批量打包可同时挂多个）。
+     * 返回的流是流式的，适用于「服务端代理下载 OSS 文件转发给浏览器」这类不落盘场景。
+     *
+     * @param url     远程地址
+     * @param timeout 等待响应超时（连接建立 + 响应头）；非法值钳制到 1 秒
+     * @throws IOException          非 2xx 响应或网络异常
+     * @throws InterruptedException 线程被中断
+     */
+    public static InputStream openStreamWithTimeout(String url, Duration timeout) throws IOException, InterruptedException {
+        Duration effective = (timeout == null || timeout.isZero() || timeout.isNegative())
+                ? Duration.ofSeconds(1)
+                : timeout;
+        HttpRequest request = HttpRequest.newBuilder(URI.create(url))
+                .timeout(effective)
+                .GET()
+                .build();
+        HttpResponse<InputStream> response = sharedHttpClient().send(request, HttpResponse.BodyHandlers.ofInputStream());
+        if (response.statusCode() / 100 != 2) {
+            try {
+                response.body().close();
+            } catch (Exception ignored) {
+                // 关闭失败不影响错误上报
+            }
+            throw new IOException("远程文件返回非 2xx: HTTP " + response.statusCode());
+        }
+        return response.body();
+    }
+
     /** 按 readTimeout（毫秒）创建共享连接池工厂；非法值钳制到最小正数。 */
     public static ClientHttpRequestFactory requestFactory(int readTimeoutMillis) {
         return requestFactory(readTimeoutMillis, null);
diff --git a/backend-java/src/main/java/com/nanri/aiimage/config/SchedulingConfig.java b/backend-java/src/main/java/com/nanri/aiimage/config/SchedulingConfig.java
index 0d96983f..faead789 100644
--- a/backend-java/src/main/java/com/nanri/aiimage/config/SchedulingConfig.java
+++ b/backend-java/src/main/java/com/nanri/aiimage/config/SchedulingConfig.java
@@ -20,8 +20,15 @@ public class SchedulingConfig {
 
     private static final ZoneId BUSINESS_ZONE = ZoneId.of("Asia/Shanghai");
 
+    /**
+     * 调度线程池：承载全站 30+ 个 @Scheduled（含 imagevideo 1s 派发、5s 轮询、结果文件 worker 15s 等高频任务）。
+     *
+     * <p>此前默认 4 线程：任一慢任务（如结果文件组装被内联执行时）都会把兜底类任务
+     * （StaleTaskRepair 心跳判死、陈旧扫描、历史清理）顺延，而兜底任务被顺延会直接放大线上故障面。
+     * 提到 16 并保持可配（aiimage.scheduling.pool-size）。
+     */
     @Bean
-    public TaskScheduler taskScheduler(@Value("${aiimage.scheduling.pool-size:4}") int poolSize) {
+    public TaskScheduler taskScheduler(@Value("${aiimage.scheduling.pool-size:16}") int poolSize) {
         ThreadPoolTaskScheduler scheduler = new ThreadPoolTaskScheduler();
         scheduler.setPoolSize(Math.max(1, poolSize));
         scheduler.setThreadNamePrefix("aiimage-scheduling-");
diff --git a/backend-java/src/main/java/com/nanri/aiimage/modules/admin/support/AdminAuthSupport.java b/backend-java/src/main/java/com/nanri/aiimage/modules/admin/support/AdminAuthSupport.java
index 5a20c467..6ac2390f 100644
--- a/backend-java/src/main/java/com/nanri/aiimage/modules/admin/support/AdminAuthSupport.java
+++ b/backend-java/src/main/java/com/nanri/aiimage/modules/admin/support/AdminAuthSupport.java
@@ -143,7 +143,10 @@ public class AdminAuthSupport {
         if (expectedToken.isBlank() || suppliedToken == null || suppliedToken.isBlank()) {
             return false;
         }
-        return expectedToken.equals(suppliedToken.trim());
+        // 常量时间比较：逐字节 equals 可被计时侧信道逐位试探出内部令牌
+        return java.security.MessageDigest.isEqual(
+                expectedToken.getBytes(java.nio.charset.StandardCharsets.UTF_8),
+                suppliedToken.trim().getBytes(java.nio.charset.StandardCharsets.UTF_8));
     }
 
     /**
diff --git a/backend-java/src/main/java/com/nanri/aiimage/modules/appearancepatent/controller/AppearancePatentController.java b/backend-java/src/main/java/com/nanri/aiimage/modules/appearancepatent/controller/AppearancePatentController.java
index 897c89cc..491cdbe4 100644
--- a/backend-java/src/main/java/com/nanri/aiimage/modules/appearancepatent/controller/AppearancePatentController.java
+++ b/backend-java/src/main/java/com/nanri/aiimage/modules/appearancepatent/controller/AppearancePatentController.java
@@ -34,6 +34,7 @@ import java.net.URI;
 import java.nio.charset.StandardCharsets;
 import com.nanri.aiimage.modules.task.model.dto.TaskProgressLightRequest;
 import com.nanri.aiimage.modules.task.model.vo.TaskProgressLightBatchVo;
+import com.nanri.aiimage.modules.task.service.TaskProgressOwnershipSupport;
 
 @RestController
 @RequiredArgsConstructor
@@ -43,6 +44,7 @@ import com.nanri.aiimage.modules.task.model.vo.TaskProgressLightBatchVo;
 public class AppearancePatentController {
 
     private final AppearancePatentTaskService service;
+    private final TaskProgressOwnershipSupport progressOwnershipSupport;
 
     @PostMapping("/parse")
     @Operation(summary = "解析 Excel 并创建任务", description = "解析上传后的 Excel 文件，提取 id、ASIN、国家、URL、标题等字段。返回给前端的数据只包含整数 id 和 n_1 行；n_2、n_3 等子行会保存在 OSS 解析载荷中，用于最终结果补齐。创建后的任务状态为 PENDING，不会自动推送 Python。")
@@ -99,7 +101,9 @@ public class AppearancePatentController {
     @PostMapping("/tasks/progress/batch")
     @Operation(summary = "批量查询任务进度", description = "前端只对活跃任务调用该接口，建议 6 秒一次。接口只返回轻量任务状态，不返回明细结果。")
     public ApiResponse<AppearancePatentTaskBatchVo> progress(@Valid @RequestBody AppearancePatentTaskBatchRequest request) {
-        return ApiResponse.success(service.progressBatch(request.getTaskIds()));
+        // 归属过滤：只查询属于该用户的任务（userId 未传时保持原行为，兼容未升级调用方）
+        return ApiResponse.success(service.progressBatch(progressOwnershipSupport
+                .filterOwnedTaskIds(request.getTaskIds(), request.getUserId())));
     }
 
     @PostMapping("/tasks/progress/light")
@@ -107,7 +111,8 @@ public class AppearancePatentController {
             description = "与 progress/batch 同输入，只返回轻量字段（taskId/status/statusCode/fileStatus/fileError/fileReady/updatedAt），"
                     + "不查明细/result 行，响应体更小；旧 progress/batch 端点保留不动。")
     public ApiResponse<TaskProgressLightBatchVo> progressLight(@Valid @RequestBody TaskProgressLightRequest request) {
-        return ApiResponse.success(service.progressLight(request.getTaskIds()));
+        // 透传 userId：此前传 null = 不过滤归属，匿名遍历 taskId 即可读他人任务状态（2026-09 审查）
+        return ApiResponse.success(service.progressLight(request.getTaskIds(), request.getUserId()));
     }
 
     @PostMapping("/tasks/{taskId}/activate")
diff --git a/backend-java/src/main/java/com/nanri/aiimage/modules/appearancepatent/model/dto/AppearancePatentTaskBatchRequest.java b/backend-java/src/main/java/com/nanri/aiimage/modules/appearancepatent/model/dto/AppearancePatentTaskBatchRequest.java
index 799b1f80..24e2cdaa 100644
--- a/backend-java/src/main/java/com/nanri/aiimage/modules/appearancepatent/model/dto/AppearancePatentTaskBatchRequest.java
+++ b/backend-java/src/main/java/com/nanri/aiimage/modules/appearancepatent/model/dto/AppearancePatentTaskBatchRequest.java
@@ -12,4 +12,8 @@ public class AppearancePatentTaskBatchRequest {
     @NotEmpty
     @Schema(description = "需要查询进度的任务 ID 列表。前端只传正在轮询的活跃任务；后端会批量查询，避免每个任务单独请求。", example = "[3938,3939]", requiredMode = Schema.RequiredMode.REQUIRED)
     private List<Long> taskIds;
+
+    /** 当前用户 ID（可省略；传入时仅返回该用户的任务，用于进度接口归属过滤）。 */
+    @Schema(description = "当前用户 ID（可省略；传入时仅返回该用户的任务）", example = "1")
+    private Long userId;
 }
diff --git a/backend-java/src/main/java/com/nanri/aiimage/modules/appearancepatent/service/AppearancePatentTaskService.java b/backend-java/src/main/java/com/nanri/aiimage/modules/appearancepatent/service/AppearancePatentTaskService.java
index 7a49b8b3..9787aedc 100644
--- a/backend-java/src/main/java/com/nanri/aiimage/modules/appearancepatent/service/AppearancePatentTaskService.java
+++ b/backend-java/src/main/java/com/nanri/aiimage/modules/appearancepatent/service/AppearancePatentTaskService.java
@@ -103,8 +103,8 @@ public class AppearancePatentTaskService {
 
     public static final String MODULE_TYPE = "APPEARANCE_PATENT";
 
-    public TaskProgressLightBatchVo progressLight(List<Long> taskIds) {
-        return taskProgressLightAssembler.assemble(MODULE_TYPE, null, taskIds);
+    public TaskProgressLightBatchVo progressLight(List<Long> taskIds, Long userId) {
+        return taskProgressLightAssembler.assemble(MODULE_TYPE, userId, taskIds);
     }
     private static final String STATUS_PENDING = "PENDING";
     private static final String STATUS_RUNNING = "RUNNING";
diff --git a/backend-java/src/main/java/com/nanri/aiimage/modules/auth/service/AuthService.java b/backend-java/src/main/java/com/nanri/aiimage/modules/auth/service/AuthService.java
index 802d9624..61f96398 100644
--- a/backend-java/src/main/java/com/nanri/aiimage/modules/auth/service/AuthService.java
+++ b/backend-java/src/main/java/com/nanri/aiimage/modules/auth/service/AuthService.java
@@ -18,6 +18,9 @@ import org.springframework.http.ResponseCookie;
 import org.springframework.stereotype.Service;
 
 import java.time.Duration;
+import java.time.Instant;
+import java.util.Map;
+import java.util.concurrent.ConcurrentHashMap;
 
 @Service
 @RequiredArgsConstructor
@@ -30,6 +33,50 @@ public class AuthService {
     private final PermissionMenuService permissionMenuService;
     private final AuthProperties authProperties;
 
+    /**
+     * 登录失败计数与锁定（2026-09 全维度审查补）：生产是公网域名，此前无任何失败限制
+     * 即可无限撞库。内存实现（双节点各自计数，防护效果减半但不引入新依赖），
+     * 达到阈值后锁定 15 分钟。
+     */
+    private static final int LOGIN_FAIL_LIMIT = 10;
+    private static final Duration LOGIN_LOCK_DURATION = Duration.ofMinutes(15);
+    private final Map<String, FailRecord> loginFailures = new ConcurrentHashMap<>();
+
+    /** 失败计数；lockedUntil 非空表示已锁定。 */
+    private record FailRecord(int count, Instant lockedUntil) {
+    }
+
+    private void assertLoginNotLocked(String username) {
+        FailRecord record = loginFailures.get(username);
+        if (record != null && record.lockedUntil() != null && record.lockedUntil().isAfter(Instant.now())) {
+            long minutes = Duration.between(Instant.now(), record.lockedUntil()).toMinutes() + 1;
+            log.warn("[auth] 登录已锁定 username={} 剩余约 {} 分钟", username, minutes);
+            throw new BusinessException("登录失败次数过多，请 " + minutes + " 分钟后再试");
+        }
+    }
+
+    private void recordLoginFailure(String username) {
+        // 防无界增长：积累较多时清掉未锁定的过期记录（登录接口调用频次低）
+        if (loginFailures.size() > 1000) {
+            Instant now = Instant.now();
+            loginFailures.entrySet().removeIf(e -> e.getValue().lockedUntil() == null
+                    || e.getValue().lockedUntil().isBefore(now));
+        }
+        loginFailures.compute(username, (key, old) -> {
+            int count = (old == null ? 0 : old.count()) + 1;
+            Instant lockedUntil = count >= LOGIN_FAIL_LIMIT ? Instant.now().plus(LOGIN_LOCK_DURATION) : null;
+            if (lockedUntil != null) {
+                log.warn("[auth] 登录失败达阈值，锁定 username={} count={} minutes={}",
+                        username, count, LOGIN_LOCK_DURATION.toMinutes());
+            }
+            return new FailRecord(count, lockedUntil);
+        });
+    }
+
+    private void clearLoginFailures(String username) {
+        loginFailures.remove(username);
+    }
+
     public LoginResultVo login(LoginRequest request) {
         String username = trim(request.getUsername());
         String password = request.getPassword() == null ? "" : request.getPassword();
@@ -41,12 +88,16 @@ public class AuthService {
             throw new BusinessException("缺少设备ID，请在桌面端打开");
         }
 
+        assertLoginNotLocked(username);
+
         LoginUserEntity user = loginUserMapper.selectOne(new LambdaQueryWrapper<LoginUserEntity>()
                 .eq(LoginUserEntity::getUsername, username)
                 .last("LIMIT 1"));
         if (user == null || !passwordEncoder.matches(password, user.getPasswordHash())) {
+            recordLoginFailure(username);
             throw new BusinessException("用户名或密码错误");
         }
+        clearLoginFailures(username);
 
         boolean isAdmin = user.getIsAdmin() != null && user.getIsAdmin() == 1;
         // 单设备登录：登录成功即把账号绑定到当前设备（last-login-wins），原设备下一次请求被顶下线
diff --git a/backend-java/src/main/java/com/nanri/aiimage/modules/brand/service/BrandTaskProgressCacheService.java b/backend-java/src/main/java/com/nanri/aiimage/modules/brand/service/BrandTaskProgressCacheService.java
index 03a652d8..f5d66391 100644
--- a/backend-java/src/main/java/com/nanri/aiimage/modules/brand/service/BrandTaskProgressCacheService.java
+++ b/backend-java/src/main/java/com/nanri/aiimage/modules/brand/service/BrandTaskProgressCacheService.java
@@ -4,11 +4,13 @@ import com.fasterxml.jackson.databind.ObjectMapper;
 import com.nanri.aiimage.config.BrandProgressProperties;
 import lombok.extern.slf4j.Slf4j;
 import org.springframework.data.redis.core.StringRedisTemplate;
+import org.springframework.data.redis.core.script.DefaultRedisScript;
 import org.springframework.stereotype.Service;
 
 import java.time.Duration;
 import java.time.Instant;
 import java.util.LinkedHashMap;
+import java.util.List;
 import java.util.Map;
 
 @Service
@@ -21,6 +23,9 @@ public class BrandTaskProgressCacheService {
     public static final String PHASE_FAILED = "failed";
     private static final Duration FINALIZE_LOCK_TTL = Duration.ofMinutes(10);
 
+    /** 本实例（进程）的锁持有者标识：释放锁时用它校验"锁还是我的"。 */
+    private final String lockOwnerToken = java.util.UUID.randomUUID().toString();
+
     private final StringRedisTemplate stringRedisTemplate;
     private final BrandProgressProperties brandProgressProperties;
     @SuppressWarnings("unused")
@@ -129,8 +134,10 @@ public class BrandTaskProgressCacheService {
 
     public boolean acquireFinalizeLock(Long taskId) {
         try {
+            // value 用持有者 token（而非时间戳）：释放时需要它来校验"锁还是我的"，
+            // 否则锁因 TTL 到期被他方持有后，本线程的裸 delete 会误删他人的锁
             Boolean ok = stringRedisTemplate.opsForValue()
-                    .setIfAbsent(buildFinalizeLockKey(taskId), String.valueOf(Instant.now().toEpochMilli()), FINALIZE_LOCK_TTL);
+                    .setIfAbsent(buildFinalizeLockKey(taskId), lockOwnerToken, FINALIZE_LOCK_TTL);
             return Boolean.TRUE.equals(ok);
         } catch (Exception ex) {
             log.warn("[brand-progress-cache] acquire finalize lock degraded taskId={} msg={}", taskId, ex.getMessage());
@@ -140,7 +147,12 @@ public class BrandTaskProgressCacheService {
 
     public void releaseFinalizeLock(Long taskId) {
         try {
-            stringRedisTemplate.delete(buildFinalizeLockKey(taskId));
+            // Lua 原子校验后删除（2026-09 全维度审查）：此前是裸 delete，锁已过期（TTL 到期、
+            // 他人已持有）时会把别人的锁删掉，导致同一任务被两个线程同时收尾。
+            stringRedisTemplate.execute(new DefaultRedisScript<>(
+                            "if redis.call('get', KEYS[1]) == ARGV[1] then return redis.call('del', KEYS[1]) else return 0 end",
+                            Long.class),
+                    List.of(buildFinalizeLockKey(taskId)), lockOwnerToken);
         } catch (Exception ex) {
             log.warn("[brand-progress-cache] release finalize lock degraded taskId={} msg={}", taskId, ex.getMessage());
         }
diff --git a/backend-java/src/main/java/com/nanri/aiimage/modules/brand/service/BrandTaskService.java b/backend-java/src/main/java/com/nanri/aiimage/modules/brand/service/BrandTaskService.java
index 6ced901c..10012d17 100644
--- a/backend-java/src/main/java/com/nanri/aiimage/modules/brand/service/BrandTaskService.java
+++ b/backend-java/src/main/java/com/nanri/aiimage/modules/brand/service/BrandTaskService.java
@@ -9,6 +9,7 @@ import com.fasterxml.jackson.databind.ObjectMapper;
 import com.nanri.aiimage.common.exception.BusinessException;
 import com.nanri.aiimage.common.service.DistributedJobLockService;
 import com.nanri.aiimage.config.BrandProgressProperties;
+import com.nanri.aiimage.config.HttpClientPool;
 import com.nanri.aiimage.config.StorageProperties;
 import com.nanri.aiimage.modules.brand.mapper.BrandCrawlTaskMapper;
 import com.nanri.aiimage.modules.brand.model.dto.BrandCrawlResultFileDto;
@@ -53,6 +54,8 @@ import java.io.FileOutputStream;
 import java.io.IOException;
 import java.io.InputStream;
 import java.net.URI;
+import java.net.http.HttpRequest;
+import java.net.http.HttpResponse;
 import java.nio.file.Files;
 import java.time.Duration;
 import java.time.Instant;
@@ -82,6 +85,21 @@ public class BrandTaskService {
 
     private static final DateTimeFormatter DATETIME_FORMATTER = DateTimeFormatter.ofPattern("yyyy-MM-dd HH:mm");
     private static final Duration STALE_CHECK_LOCK_TTL = Duration.ofMinutes(10);
+    /** 源文件下载请求超时：比普通 API 调用宽松（源文件可能几十 MB），但必须有上限。 */
+    private static final Duration SOURCE_DOWNLOAD_TIMEOUT = Duration.ofMinutes(5);
+
+    /** SSRF 防护：禁止请求云元数据与环回地址（正常源文件都在自家 OSS/MinIO 域名上）。 */
+    private static final java.util.Set<String> BLOCKED_SOURCE_HOSTS = java.util.Set.of(
+            "169.254.169.254", "metadata.google.internal", "metadata", "localhost",
+            "127.0.0.1", "0.0.0.0", "::1", "[::1]");
+
+    private static boolean isBlockedSourceHost(String host) {
+        if (host == null || host.isBlank()) {
+            return true;
+        }
+        String normalized = host.trim().toLowerCase(java.util.Locale.ROOT);
+        return BLOCKED_SOURCE_HOSTS.contains(normalized) || normalized.endsWith(".localhost");
+    }
     private static final long RESULT_SUBMIT_WAIT_MILLIS = 5 * 60 * 1000L;
     private static final String STATUS_PENDING = "pending";
     private static final String STATUS_RUNNING = "running";
@@ -92,8 +110,9 @@ public class BrandTaskService {
     /** 结果文件并发上传数：OSS/MinIO 上传互不依赖，3 并发平衡收益与内存占用。 */
     private static final int RESULT_UPLOAD_CONCURRENCY = 3;
 
-    private final ExecutorService resultUploadExecutor = Executors.newFixedThreadPool(
-            RESULT_UPLOAD_CONCURRENCY, namedThreadFactory("brand-result-upload"));
+    // 有界队列线程池：newFixedThreadPool 用的是无界队列，任务堆积时不会拒绝、会把内存吃满
+    private final ExecutorService resultUploadExecutor = com.nanri.aiimage.common.util.ThreadPools
+            .boundedFixed("brand-result-upload", RESULT_UPLOAD_CONCURRENCY);
 
     @PreDestroy
     void shutdownResultUploadExecutor() {
@@ -812,21 +831,49 @@ public class BrandTaskService {
     }
 
     private File downloadSourceFile(String fileUrl) {
+        URI uri;
+        try {
+            uri = URI.create(fileUrl);
+        } catch (Exception ex) {
+            log.warn("[brand] 源文件地址非法 fileUrl={} err={}", fileUrl, ex.getMessage());
+            throw new BusinessException("下载源文件失败: 地址非法");
+        }
+        // SSRF 防护（2026-09 全维度审查）：fileUrl 来自请求体，若不校验则匿名调用方可让服务端
+        // 请求内网/云元数据地址（169.254.169.254 等）。正常源文件都落在自家 OSS/MinIO 上。
+        if (isBlockedSourceHost(uri.getHost())) {
+            log.warn("[brand] 拒绝下载疑似 SSRF 的源文件地址 host={} fileUrl={}", uri.getHost(), fileUrl);
+            throw new BusinessException("源文件地址不合法");
+        }
+        String filename = FileUtil.getName(uri.getPath());
+        if (filename == null || filename.isBlank()) {
+            filename = "brand-source.xlsx";
+        }
+        String suffix = FileUtil.extName(filename);
+        File downloadDir = FileUtil.mkdir(FileUtil.file(storageProperties.getLocalTempDir(), "brand-source-download"));
         try {
-            URI uri = URI.create(fileUrl);
-            String filename = FileUtil.getName(uri.getPath());
-            if (filename == null || filename.isBlank()) {
-                filename = "brand-source.xlsx";
-            }
-            String suffix = FileUtil.extName(filename);
-            File downloadDir = FileUtil.mkdir(FileUtil.file(storageProperties.getLocalTempDir(), "brand-source-download"));
             File tempFile = Files.createTempFile(downloadDir.toPath(), "brand_", suffix.isBlank() ? "" : "." + suffix).toFile();
-            try (InputStream inputStream = uri.toURL().openStream()) {
+            // 走统一连接池 + 显式超时。此前 uri.toURL().openStream() 无任何超时（JVM 默认 0 = 无限），
+            // 上游半开连接会把 Tomcat 工作线程无限占用；超时值比普通 API 调用宽松（源文件可能几十 MB）
+            HttpRequest downloadRequest = HttpRequest.newBuilder(uri)
+                    .timeout(SOURCE_DOWNLOAD_TIMEOUT)
+                    .GET()
+                    .build();
+            HttpResponse<InputStream> response = HttpClientPool.sharedHttpClient()
+                    .send(downloadRequest, HttpResponse.BodyHandlers.ofInputStream());
+            if (response.statusCode() / 100 != 2) {
+                log.warn("[brand] 下载源文件返回非 2xx fileUrl={} status={}", fileUrl, response.statusCode());
+                throw new BusinessException("下载源文件失败: HTTP " + response.statusCode());
+            }
+            try (InputStream inputStream = response.body()) {
                 FileUtil.writeFromStream(inputStream, tempFile);
             }
             return tempFile;
+        } catch (BusinessException ex) {
+            throw ex;
         } catch (Exception ex) {
-            throw new BusinessException("下载源文件失败");
+            // 此前该 catch 既不记日志也不带 cause，线上无法定位
+            log.warn("[brand] 下载源文件失败 fileUrl={} err={}", fileUrl, ex.getMessage(), ex);
+            throw new BusinessException("下载源文件失败", ex);
         }
     }
 
diff --git a/backend-java/src/main/java/com/nanri/aiimage/modules/brand/service/BrandTaskStorageService.java b/backend-java/src/main/java/com/nanri/aiimage/modules/brand/service/BrandTaskStorageService.java
index 2ff1fe53..1931b02f 100644
--- a/backend-java/src/main/java/com/nanri/aiimage/modules/brand/service/BrandTaskStorageService.java
+++ b/backend-java/src/main/java/com/nanri/aiimage/modules/brand/service/BrandTaskStorageService.java
@@ -466,11 +466,8 @@ public class BrandTaskStorageService {
         try {
             MessageDigest digest = MessageDigest.getInstance("SHA-256");
             byte[] bytes = digest.digest(normalize(value).getBytes(StandardCharsets.UTF_8));
-            StringBuilder sb = new StringBuilder(bytes.length * 2);
-            for (byte b : bytes) {
-                sb.append(String.format("%02x", b));
-            }
-            return sb.toString();
+            // HexFormat 替代逐字节 String.format("%02x")：后者每次走 32 次 Formatter（热路径按行调用）
+            return java.util.HexFormat.of().formatHex(bytes);
         } catch (Exception ex) {
             throw new IllegalStateException("failed to hash brand scope", ex);
         }
diff --git a/backend-java/src/main/java/com/nanri/aiimage/modules/collectdata/controller/CollectDataController.java b/backend-java/src/main/java/com/nanri/aiimage/modules/collectdata/controller/CollectDataController.java
index b3a2ca3c..530c5cc8 100644
--- a/backend-java/src/main/java/com/nanri/aiimage/modules/collectdata/controller/CollectDataController.java
+++ b/backend-java/src/main/java/com/nanri/aiimage/modules/collectdata/controller/CollectDataController.java
@@ -29,6 +29,7 @@ import org.springframework.web.bind.annotation.RequestParam;
 import org.springframework.web.bind.annotation.RestController;
 import com.nanri.aiimage.modules.task.model.dto.TaskProgressLightRequest;
 import com.nanri.aiimage.modules.task.model.vo.TaskProgressLightBatchVo;
+import com.nanri.aiimage.modules.task.service.TaskProgressOwnershipSupport;
 
 @RestController
 @RequiredArgsConstructor
@@ -37,6 +38,7 @@ import com.nanri.aiimage.modules.task.model.vo.TaskProgressLightBatchVo;
 public class CollectDataController {
 
     private final CollectDataService service;
+    private final TaskProgressOwnershipSupport progressOwnershipSupport;
 
     @PostMapping("/parse")
     @Operation(summary = "解析 Excel 并创建任务", description = "解析上传后的 Excel 文件，按行入库到 biz_collect_data_item，并保存任务筛选条件。任务初始状态为 PENDING。")
@@ -112,7 +114,9 @@ public class CollectDataController {
     @PostMapping("/tasks/progress/batch")
     @Operation(summary = "批量查询任务进度")
     public ApiResponse<CollectDataTaskBatchVo> progressBatch(@Valid @RequestBody CollectDataTaskBatchRequest request) {
-        return ApiResponse.success(service.progressBatch(request.getTaskIds()));
+        // 归属过滤：只查询属于该用户的任务（userId 未传时保持原行为，兼容未升级调用方）
+        return ApiResponse.success(service.progressBatch(progressOwnershipSupport
+                .filterOwnedTaskIds(request.getTaskIds(), request.getUserId())));
     }
 
     @PostMapping("/tasks/progress/light")
@@ -120,7 +124,8 @@ public class CollectDataController {
             description = "与 progress/batch 同输入，只返回轻量字段（taskId/status/statusCode/fileStatus/fileError/fileReady/updatedAt），"
                     + "不查明细/result 行，响应体更小；旧 progress/batch 端点保留不动。")
     public ApiResponse<TaskProgressLightBatchVo> progressLight(@Valid @RequestBody TaskProgressLightRequest request) {
-        return ApiResponse.success(service.progressLight(request.getTaskIds()));
+        // 透传 userId：此前传 null = 不过滤归属，匿名遍历 taskId 即可读他人任务状态（2026-09 审查）
+        return ApiResponse.success(service.progressLight(request.getTaskIds(), request.getUserId()));
     }
 
     @DeleteMapping("/tasks/{taskId}")
diff --git a/backend-java/src/main/java/com/nanri/aiimage/modules/collectdata/model/dto/CollectDataTaskBatchRequest.java b/backend-java/src/main/java/com/nanri/aiimage/modules/collectdata/model/dto/CollectDataTaskBatchRequest.java
index a51081da..d92ea216 100644
--- a/backend-java/src/main/java/com/nanri/aiimage/modules/collectdata/model/dto/CollectDataTaskBatchRequest.java
+++ b/backend-java/src/main/java/com/nanri/aiimage/modules/collectdata/model/dto/CollectDataTaskBatchRequest.java
@@ -12,4 +12,8 @@ public class CollectDataTaskBatchRequest {
     @NotEmpty
     @Schema(description = "任务 ID 列表", requiredMode = Schema.RequiredMode.REQUIRED)
     private List<Long> taskIds;
+
+    /** 当前用户 ID（可省略；传入时仅返回该用户的任务，用于进度接口归属过滤）。 */
+    @Schema(description = "当前用户 ID（可省略；传入时仅返回该用户的任务）", example = "1")
+    private Long userId;
 }
diff --git a/backend-java/src/main/java/com/nanri/aiimage/modules/collectdata/service/CollectDataService.java b/backend-java/src/main/java/com/nanri/aiimage/modules/collectdata/service/CollectDataService.java
index c06ca0a2..49e1e70c 100644
--- a/backend-java/src/main/java/com/nanri/aiimage/modules/collectdata/service/CollectDataService.java
+++ b/backend-java/src/main/java/com/nanri/aiimage/modules/collectdata/service/CollectDataService.java
@@ -4,9 +4,11 @@ import cn.hutool.core.util.IdUtil;
 import cn.hutool.core.io.FileUtil;
 import cn.hutool.crypto.digest.DigestUtil;
 import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
+import com.baomidou.mybatisplus.core.conditions.update.LambdaUpdateWrapper;
 import com.fasterxml.jackson.core.type.TypeReference;
 import com.fasterxml.jackson.databind.JsonNode;
 import com.fasterxml.jackson.databind.ObjectMapper;
+import com.nanri.aiimage.common.exception.BusinessCodes;
 import com.nanri.aiimage.common.exception.BusinessException;
 import com.nanri.aiimage.common.util.ExcelStreamReader;
 import com.nanri.aiimage.modules.collectdata.mapper.CollectDataCountryPrefMapper;
@@ -104,8 +106,8 @@ public class CollectDataService {
      */
     private static final String LEGACY_MODULE_TYPE = "collectdata";
 
-    public TaskProgressLightBatchVo progressLight(List<Long> taskIds) {
-        return taskProgressLightAssembler.assemble(MODULE_TYPE, null, taskIds);
+    public TaskProgressLightBatchVo progressLight(List<Long> taskIds, Long userId) {
+        return taskProgressLightAssembler.assemble(MODULE_TYPE, userId, taskIds);
     }
     public static final int DEFAULT_PAGE_SIZE = 50;
 
@@ -379,34 +381,45 @@ public class CollectDataService {
     @Transactional
     public void activateTask(Long taskId, Long userId) {
         FileTaskEntity task = requireTask(taskId, userId);
-        if (STATUS_SUCCESS.equals(task.getStatus()) || STATUS_FAILED.equals(task.getStatus())) {
+        // 条件更新：上面的「已结束」判断与写入之间存在窗口（TOCTOU），期间 /fail 可能已把任务
+        // 标为 FAILED —— 整行 updateById 会把它复活成 RUNNING（前端显示"执行中"但无人推进）
+        int updated = fileTaskMapper.update(null, new LambdaUpdateWrapper<FileTaskEntity>()
+                .eq(FileTaskEntity::getId, task.getId())
+                .notIn(FileTaskEntity::getStatus, STATUS_SUCCESS, STATUS_FAILED)
+                .set(FileTaskEntity::getStatus, STATUS_RUNNING)
+                .set(FileTaskEntity::getUpdatedAt, LocalDateTime.now()));
+        if (updated == 0) {
             throw new BusinessException("任务已结束");
         }
-        task.setStatus(STATUS_RUNNING);
-        task.setUpdatedAt(LocalDateTime.now());
-        fileTaskMapper.updateById(task);
     }
 
     @Transactional
     public void failTask(Long taskId, Long userId, String error) {
         FileTaskEntity task = requireTask(taskId, userId);
-        if (STATUS_SUCCESS.equals(task.getStatus()) || STATUS_FAILED.equals(task.getStatus())) {
-            return;
-        }
         String message = firstNonBlank(error, "collect-data task dispatch failed");
         FileResultEntity result = ensureTaskResult(task);
         CollectDataStats stats = loadStats(task);
-        result.setSuccess(0);
-        result.setErrorMessage(message);
-        result.setRowCount(stats.finalRowCount);
-        fileResultMapper.updateById(result);
-        task.setStatus(STATUS_FAILED);
-        task.setErrorMessage(message);
-        task.setFailedFileCount(1);
-        task.setUpdatedAt(LocalDateTime.now());
-        task.setFinishedAt(LocalDateTime.now());
-        persistStats(task, stats);
-        fileTaskMapper.updateById(task);
+        boolean alreadyTerminal = STATUS_SUCCESS.equals(task.getStatus()) || STATUS_FAILED.equals(task.getStatus());
+        if (!alreadyTerminal) {
+            result.setSuccess(0);
+            result.setErrorMessage(message);
+            result.setRowCount(stats.finalRowCount);
+            fileResultMapper.updateById(result);
+            persistStats(task, stats);
+        }
+        // 条件更新：客户端报错（/fail）与结果文件组装完成（processResultFileJob 写 SUCCESS）
+        // 可能并发 —— 无条件 updateById 会把已生成的 SUCCESS 覆盖成 FAILED（用户拿不到下载）或反之
+        int updated = fileTaskMapper.update(null, new LambdaUpdateWrapper<FileTaskEntity>()
+                .eq(FileTaskEntity::getId, task.getId())
+                .notIn(FileTaskEntity::getStatus, STATUS_SUCCESS, STATUS_FAILED)
+                .set(FileTaskEntity::getStatus, STATUS_FAILED)
+                .set(FileTaskEntity::getErrorMessage, message)
+                .set(FileTaskEntity::getFailedFileCount, 1)
+                .set(FileTaskEntity::getUpdatedAt, LocalDateTime.now())
+                .set(FileTaskEntity::getFinishedAt, LocalDateTime.now()));
+        if (updated == 0) {
+            log.info("[collect-data] failTask 跳过写入：任务已是终态 taskId={} status={}", taskId, task.getStatus());
+        }
     }
 
     @Transactional
@@ -954,13 +967,21 @@ public class CollectDataService {
             // 复用同一份 stats 更新 finalRowCount 后再持久化，避免重复 loadStats 丢失 summaries。
             stats.finalRowCount = (int) finalRowCount;
             persistStats(task, stats);
-            task.setStatus(STATUS_SUCCESS);
-            task.setSuccessFileCount(1);
-            task.setFailedFileCount(0);
-            task.setErrorMessage(null);
-            task.setUpdatedAt(LocalDateTime.now());
-            task.setFinishedAt(LocalDateTime.now());
-            fileTaskMapper.updateById(task);
+            // 条件更新：任务可能已被 /fail 标为 FAILED（客户端报错与结果文件组装并发）——
+            // 无条件 updateById 会把 FAILED 覆盖成 SUCCESS（错误信息被清、用户看到「假成功」）。
+            // 结果文件已生成，故失败态下仍保留文件，只是不覆盖状态。
+            int updated = fileTaskMapper.update(null, new LambdaUpdateWrapper<FileTaskEntity>()
+                    .eq(FileTaskEntity::getId, task.getId())
+                    .ne(FileTaskEntity::getStatus, STATUS_FAILED)
+                    .set(FileTaskEntity::getStatus, STATUS_SUCCESS)
+                    .set(FileTaskEntity::getSuccessFileCount, 1)
+                    .set(FileTaskEntity::getFailedFileCount, 0)
+                    .set(FileTaskEntity::getErrorMessage, null)
+                    .set(FileTaskEntity::getUpdatedAt, LocalDateTime.now())
+                    .set(FileTaskEntity::getFinishedAt, LocalDateTime.now()));
+            if (updated == 0) {
+                log.warn("[collect-data] 结果文件已生成但任务已是 FAILED，保留失败态不覆盖 taskId={}", task.getId());
+            }
         } finally {
             FileUtil.del(xlsx);
         }
@@ -1085,7 +1106,8 @@ public class CollectDataService {
     private TaskDistributedLockService.LockHandle acquireTaskLockOrThrow(Long taskId) {
         TaskDistributedLockService.LockHandle lockHandle = taskDistributedLockService.acquire(MODULE_TYPE, taskId, TASK_LOCK_WAIT_MILLIS);
         if (lockHandle == null) {
-            throw new BusinessException(40901, "任务正在处理，请稍后再试");
+            log.warn("[collect-data] 任务锁竞争，拒绝本次提交 taskId={} waitMillis={}", taskId, TASK_LOCK_WAIT_MILLIS);
+            throw new BusinessException(BusinessCodes.TASK_BUSY, "任务正在处理，请稍后再试");
         }
         return lockHandle;
     }
diff --git a/backend-java/src/main/java/com/nanri/aiimage/modules/collectdata/util/CollectDataResultDetailCodec.java b/backend-java/src/main/java/com/nanri/aiimage/modules/collectdata/util/CollectDataResultDetailCodec.java
index 627d0ece..2196a255 100644
--- a/backend-java/src/main/java/com/nanri/aiimage/modules/collectdata/util/CollectDataResultDetailCodec.java
+++ b/backend-java/src/main/java/com/nanri/aiimage/modules/collectdata/util/CollectDataResultDetailCodec.java
@@ -148,11 +148,8 @@ public class CollectDataResultDetailCodec {
         try {
             MessageDigest digest = MessageDigest.getInstance("SHA-256");
             byte[] bytes = digest.digest((value == null ? "" : value).getBytes(StandardCharsets.UTF_8));
-            StringBuilder sb = new StringBuilder(bytes.length * 2);
-            for (byte b : bytes) {
-                sb.append(String.format("%02x", b));
-            }
-            return sb.toString();
+            // HexFormat 替代逐字节 String.format("%02x")：后者每次走 32 次 Formatter（热路径按行调用）
+            return java.util.HexFormat.of().formatHex(bytes);
         } catch (Exception ex) {
             throw new IllegalStateException("chunk detail ref hash failed", ex);
         }
diff --git a/backend-java/src/main/java/com/nanri/aiimage/modules/collectdata/util/CollectDataResultItemBatchWriter.java b/backend-java/src/main/java/com/nanri/aiimage/modules/collectdata/util/CollectDataResultItemBatchWriter.java
index 9c3bdee2..f72d63f9 100644
--- a/backend-java/src/main/java/com/nanri/aiimage/modules/collectdata/util/CollectDataResultItemBatchWriter.java
+++ b/backend-java/src/main/java/com/nanri/aiimage/modules/collectdata/util/CollectDataResultItemBatchWriter.java
@@ -1,6 +1,7 @@
 package com.nanri.aiimage.modules.collectdata.util;
 
 import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
+import com.nanri.aiimage.common.exception.BusinessException;
 import com.nanri.aiimage.modules.collectdata.model.vo.CollectDataResultRowVo;
 import com.nanri.aiimage.modules.task.mapper.TaskResultItemMapper;
 import com.nanri.aiimage.modules.task.model.entity.TaskResultItemEntity;
@@ -133,12 +134,14 @@ public class CollectDataResultItemBatchWriter {
         }
 
         int written = 0;
+        int failedBatches = 0;
         for (int from = 0; from < toUpsert.size(); from += batchSize) {
             int to = Math.min(from + batchSize, toUpsert.size());
             List<TaskResultItemEntity> batch = toUpsert.subList(from, to);
             try {
                 written += taskResultItemMapper.upsertBatch(batch);
             } catch (RuntimeException ex) {
+                failedBatches++;
                 log.warn("[collect-data] upsert result item batch failed, skip batch {}..{} taskId={}",
                         from, to, taskId, ex);
                 // 失败批的新行未落库，从增量计数中扣除，避免任务内累计虚高；
@@ -150,6 +153,16 @@ public class CollectDataResultItemBatchWriter {
                 }
             }
         }
+        if (failedBatches > 0) {
+            // biz_task_result_item 是结果 Excel「明细」sheet 的唯一数据源：静默跳批会让任务
+            // 以 SUCCESS 收尾但明细缺行，且与「结果文件」sheet 的汇总数量对不上（假成功）。
+            // 抛出让本次 chunk 提交明确失败：worker（search_spider）识别 success=false 后会重试，
+            // 重提按 payload_hash 幂等（已落库行跳过、未落库行补插），最终收敛为完整数据。
+            log.error("[collect-data] 明细写入存在失败批次，拒绝本次提交 taskId={} failedBatches={} totalBatches={}",
+                    taskId, failedBatches, (toUpsert.size() + batchSize - 1) / batchSize);
+            throw new BusinessException("采集结果明细写入失败，请稍后重试（失败批次 "
+                    + failedBatches + "/" + ((toUpsert.size() + batchSize - 1) / batchSize) + "）");
+        }
         return new UpsertCounts(written, skipped, newlyInserted);
     }
 
@@ -157,11 +170,8 @@ public class CollectDataResultItemBatchWriter {
         try {
             java.security.MessageDigest digest = java.security.MessageDigest.getInstance("SHA-256");
             byte[] bytes = digest.digest((value == null ? "" : value).getBytes(java.nio.charset.StandardCharsets.UTF_8));
-            StringBuilder sb = new StringBuilder(bytes.length * 2);
-            for (byte b : bytes) {
-                sb.append(String.format("%02x", b));
-            }
-            return sb.toString();
+            // HexFormat 替代逐字节 String.format("%02x")：后者每次走 32 次 Formatter（热路径按行调用）
+            return java.util.HexFormat.of().formatHex(bytes);
         } catch (Exception ex) {
             throw new IllegalStateException("结果明细 hash 计算失败", ex);
         }
diff --git a/backend-java/src/main/java/com/nanri/aiimage/modules/convert/service/ConvertRunService.java b/backend-java/src/main/java/com/nanri/aiimage/modules/convert/service/ConvertRunService.java
index 37061768..e08d4417 100644
--- a/backend-java/src/main/java/com/nanri/aiimage/modules/convert/service/ConvertRunService.java
+++ b/backend-java/src/main/java/com/nanri/aiimage/modules/convert/service/ConvertRunService.java
@@ -278,12 +278,14 @@ public class ConvertRunService {
         File outputDir = FileUtil.mkdir(FileUtil.file(storageProperties.getLocalTempDir(), "convert-result"));
         List<GeneratedConvertFile> generatedFiles = new ArrayList<>();
         Map<String, BufferedWriter> writers = new LinkedHashMap<>();
-        for (String outputFilename : outputFilenames) {
-            File outputFile = buildNamedOutputFile(outputDir, outputFilename);
-            generatedFiles.add(new GeneratedConvertFile(outputFilename, outputFile));
-            writers.put(outputFilename, Files.newBufferedWriter(outputFile.toPath(), StandardCharsets.UTF_8));
-        }
         try {
+            // 创建循环纳入 try：第 N 个 writer 创建失败时，前 N-1 个已打开的句柄会因 finally
+            // 尚未生效而泄漏（同族 SplitRunService.SplitChunkWriter 已用 try/finally 处理）
+            for (String outputFilename : outputFilenames) {
+                File outputFile = buildNamedOutputFile(outputDir, outputFilename);
+                generatedFiles.add(new GeneratedConvertFile(outputFilename, outputFile));
+                writers.put(outputFilename, Files.newBufferedWriter(outputFile.toPath(), StandardCharsets.UTF_8));
+            }
             streamTxtRowsToOutputs(inputFile, templateEntity, writers);
         } finally {
             IOException closeException = null;
diff --git a/backend-java/src/main/java/com/nanri/aiimage/modules/dedupe/service/DedupeRunService.java b/backend-java/src/main/java/com/nanri/aiimage/modules/dedupe/service/DedupeRunService.java
index e3999302..9bf9474d 100644
--- a/backend-java/src/main/java/com/nanri/aiimage/modules/dedupe/service/DedupeRunService.java
+++ b/backend-java/src/main/java/com/nanri/aiimage/modules/dedupe/service/DedupeRunService.java
@@ -75,12 +75,9 @@ public class DedupeRunService {
     private final Map<Long, AtomicInteger> runningTaskCountMap = new ConcurrentHashMap<>();
     private final Semaphore fileParallelSemaphore = new Semaphore(MAX_PARALLEL_FILES);
     /** 共享有界文件执行器；不再为请求中的每个文件创建虚拟线程。 */
-    private final ExecutorService fileExecutor = Executors.newFixedThreadPool(
-            MAX_PARALLEL_FILES, runnable -> {
-                Thread thread = new Thread(runnable, "dedupe-file-worker");
-                thread.setDaemon(true);
-                return thread;
-            });
+    // 队列改为有界：newFixedThreadPool 的无界队列在文件堆积时不会拒绝、会把内存吃满
+    private final ExecutorService fileExecutor = com.nanri.aiimage.common.util.ThreadPools
+            .boundedFixed("dedupe-file-worker", MAX_PARALLEL_FILES);
 
     /**
      * 提交去重任务：立即返回进度快照（runId），异步执行 流式读取 + 多文件并行 + 结果上传。
@@ -171,6 +168,8 @@ public class DedupeRunService {
         boolean folderMode = request.getArchiveName() != null && !request.getArchiveName().isBlank();
         Map<String, DedupeArchiveEntry> archiveEntries = new ConcurrentHashMap<>();
         List<DedupeResultItemVo> outcomeItems = new ArrayList<>();
+        // 是否有 worker 异常结束：为 true 时收尾必须标失败，绝不能标 SUCCESS（用户会看到成功但结果缺文件）
+        boolean aborted = false;
 
         try {
             AtomicInteger processedCount = new AtomicInteger(0);
@@ -192,14 +191,26 @@ public class DedupeRunService {
                     }
                 }));
             }
+            // 逐个等待：processFile 内部已把单文件失败记入 outcomeItems，不会往外抛；
+            // 这里能捕到的是线程级异常（Error/线程池拒绝），必须记下来而不能当成功。
             for (Future<?> worker : workers) {
-                worker.get();
+                try {
+                    worker.get();
+                } catch (Exception workerEx) {
+                    aborted = true;
+                    log.error("dedupe run worker aborted runId={} error", runId, workerEx);
+                }
             }
         } catch (Exception ex) {
+            aborted = true;
             log.error("dedupe run async aborted runId={} error", runId, ex);
         }
 
         try {
+            if (aborted) {
+                // 有文件没能正常处理完就序列化/标成功，会出现「任务成功但结果缺文件」
+                throw new IllegalStateException("部分文件处理线程异常结束，结果不完整");
+            }
             if (folderMode && !archiveEntries.isEmpty()) {
                 DedupeResultItemVo zipItem = buildFolderZipResult(request, archiveEntries, task);
                 synchronized (progress) {
diff --git a/backend-java/src/main/java/com/nanri/aiimage/modules/dedupe/service/DedupeTotalDataService.java b/backend-java/src/main/java/com/nanri/aiimage/modules/dedupe/service/DedupeTotalDataService.java
index db2b0cb4..5edda316 100644
--- a/backend-java/src/main/java/com/nanri/aiimage/modules/dedupe/service/DedupeTotalDataService.java
+++ b/backend-java/src/main/java/com/nanri/aiimage/modules/dedupe/service/DedupeTotalDataService.java
@@ -17,6 +17,7 @@ import com.nanri.aiimage.modules.permission.model.entity.AdminUserEntity;
 import com.nanri.aiimage.modules.shopkey.mapper.ShopManageGroupMapper;
 import com.nanri.aiimage.modules.shopkey.model.entity.ShopManageGroupEntity;
 import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
 import org.apache.poi.ss.usermodel.Cell;
 import org.apache.poi.ss.usermodel.DataFormatter;
 import org.apache.poi.ss.usermodel.Row;
@@ -62,6 +63,7 @@ import java.util.zip.ZipOutputStream;
 
 @Service
 @RequiredArgsConstructor
+@Slf4j
 public class DedupeTotalDataService {
 
     private static final int COMPARE_BATCH_SIZE = 5000;
@@ -579,6 +581,8 @@ public class DedupeTotalDataService {
         } catch (Exception e) {
             progress.setStatus("failed");
             progress.setErrorMessage(e instanceof BusinessException ? e.getMessage() : "导入 Excel 失败");
+            // 此前该 catch 既不记日志也不带 cause，线上只有一句「导入 Excel 失败」，无栈无定位线索
+            log.error("[dedupe-total-data] 异步导入失败 filename={} userId={}", filename, uploaderUserId, e);
         } finally {
             deleteQuietly(tempFile);
             importCompletedAtMap.put(importId, System.currentTimeMillis());
@@ -648,7 +652,9 @@ public class DedupeTotalDataService {
         } catch (BusinessException e) {
             throw e;
         } catch (Exception e) {
-            throw new BusinessException("删除 Excel 匹配数据失败");
+            // 此前丢弃原始异常：排查时只能看到一句「删除 Excel 匹配数据失败」
+            log.error("[dedupe-total-data] 删除 Excel 匹配数据失败", e);
+            throw new BusinessException("删除 Excel 匹配数据失败", e);
         }
     }
 
@@ -946,7 +952,9 @@ public class DedupeTotalDataService {
         } catch (BusinessException e) {
             throw e;
         } catch (Exception e) {
-            throw new BusinessException("删除 Excel 匹配数据失败");
+            // 此前丢弃原始异常：排查时只能看到一句「删除 Excel 匹配数据失败」
+            log.error("[dedupe-total-data] 删除 Excel 匹配数据失败", e);
+            throw new BusinessException("删除 Excel 匹配数据失败", e);
         }
     }
 
diff --git a/backend-java/src/main/java/com/nanri/aiimage/modules/deletebrand/controller/DeleteBrandRunController.java b/backend-java/src/main/java/com/nanri/aiimage/modules/deletebrand/controller/DeleteBrandRunController.java
index 2baaea4b..a6015128 100644
--- a/backend-java/src/main/java/com/nanri/aiimage/modules/deletebrand/controller/DeleteBrandRunController.java
+++ b/backend-java/src/main/java/com/nanri/aiimage/modules/deletebrand/controller/DeleteBrandRunController.java
@@ -37,6 +37,7 @@ import java.net.URI;
 import java.nio.charset.StandardCharsets;
 import com.nanri.aiimage.modules.task.model.dto.TaskProgressLightRequest;
 import com.nanri.aiimage.modules.task.model.vo.TaskProgressLightBatchVo;
+import com.nanri.aiimage.modules.task.service.TaskProgressOwnershipSupport;
 
 
 @RestController
@@ -47,6 +48,7 @@ import com.nanri.aiimage.modules.task.model.vo.TaskProgressLightBatchVo;
 public class DeleteBrandRunController {
 
     private final DeleteBrandRunService deleteBrandRunService;
+    private final TaskProgressOwnershipSupport progressOwnershipSupport;
 
     @PostMapping("/run")
     @Operation(summary = "执行删除品牌解析", description = "读取上传的删除品牌 Excel，按国家分组解析并在每个国家内按 ASIN 去重，返回完整 payload。")
@@ -85,13 +87,17 @@ public class DeleteBrandRunController {
     @PostMapping("/tasks/batch")
     @Operation(summary = "批量获取删除品牌任务详情", description = "合并多个 taskId 的详情查询，减少轮询期对 DB/Redis 的压力。")
     public ApiResponse<DeleteBrandTaskBatchVo> getTasksBatch(@Valid @RequestBody DeleteBrandTaskBatchRequest request) {
-        return ApiResponse.success(deleteBrandRunService.getTaskDetails(request.getTaskIds()));
+        // 归属过滤：/tasks/batch 同样按 userId 过滤（此前无校验，遍历 taskId 即可读他人任务详情）
+        return ApiResponse.success(deleteBrandRunService.getTaskDetails(progressOwnershipSupport
+                .filterOwnedTaskIds(request.getTaskIds(), request.getUserId())));
     }
 
     @PostMapping("/tasks/progress/batch")
     @Operation(summary = "批量获取删除品牌任务进度摘要", description = "仅返回任务基础状态和行进度摘要，用于前端轮询降载。")
     public ApiResponse<DeleteBrandTaskBatchVo> getTaskProgressBatch(@Valid @RequestBody DeleteBrandTaskBatchRequest request) {
-        return ApiResponse.success(deleteBrandRunService.getTaskProgress(request.getTaskIds()));
+        // 归属过滤：只查询属于该用户的任务（userId 未传时保持原行为，兼容未升级调用方）
+        return ApiResponse.success(deleteBrandRunService.getTaskProgress(progressOwnershipSupport
+                .filterOwnedTaskIds(request.getTaskIds(), request.getUserId())));
     }
 
     @PostMapping("/tasks/progress/light")
@@ -99,7 +105,8 @@ public class DeleteBrandRunController {
             description = "与 progress/batch 同输入，只返回轻量字段（taskId/status/statusCode/fileStatus/fileError/fileReady/updatedAt），"
                     + "不查明细/result 行，响应体更小；旧 progress/batch 端点保留不动。")
     public ApiResponse<TaskProgressLightBatchVo> progressLight(@Valid @RequestBody TaskProgressLightRequest request) {
-        return ApiResponse.success(deleteBrandRunService.progressLight(request.getTaskIds()));
+        // 透传 userId：此前传 null = 不过滤归属，匿名遍历 taskId 即可读他人任务状态（2026-09 审查）
+        return ApiResponse.success(deleteBrandRunService.progressLight(request.getTaskIds(), request.getUserId()));
     }
 
     @GetMapping("/tasks/{taskId}/deletion-status")
diff --git a/backend-java/src/main/java/com/nanri/aiimage/modules/deletebrand/model/dto/DeleteBrandTaskBatchRequest.java b/backend-java/src/main/java/com/nanri/aiimage/modules/deletebrand/model/dto/DeleteBrandTaskBatchRequest.java
index e6f30186..757ad9d3 100644
--- a/backend-java/src/main/java/com/nanri/aiimage/modules/deletebrand/model/dto/DeleteBrandTaskBatchRequest.java
+++ b/backend-java/src/main/java/com/nanri/aiimage/modules/deletebrand/model/dto/DeleteBrandTaskBatchRequest.java
@@ -14,4 +14,8 @@ public class DeleteBrandTaskBatchRequest {
     @NotEmpty(message = "taskIds 不能为空")
     @Schema(description = "任务ID列表")
     private List<Long> taskIds = new ArrayList<>();
+
+    /** 当前用户 ID（可省略；传入时仅返回该用户的任务，用于进度接口归属过滤）。 */
+    @Schema(description = "当前用户 ID（可省略；传入时仅返回该用户的任务）", example = "1")
+    private Long userId;
 }
diff --git a/backend-java/src/main/java/com/nanri/aiimage/modules/deletebrand/service/DeleteBrandRunService.java b/backend-java/src/main/java/com/nanri/aiimage/modules/deletebrand/service/DeleteBrandRunService.java
index ddb45d43..9ed70ad2 100644
--- a/backend-java/src/main/java/com/nanri/aiimage/modules/deletebrand/service/DeleteBrandRunService.java
+++ b/backend-java/src/main/java/com/nanri/aiimage/modules/deletebrand/service/DeleteBrandRunService.java
@@ -82,8 +82,8 @@ public class DeleteBrandRunService {
     /** 降级组装时缺失分片对应的结果状态（客户端未回传该行）。 */
     static final String MISSING_CHUNK_STATUS = "未回传";
 
-    public TaskProgressLightBatchVo progressLight(List<Long> taskIds) {
-        return taskProgressLightAssembler.assemble(MODULE_TYPE, null, taskIds);
+    public TaskProgressLightBatchVo progressLight(List<Long> taskIds, Long userId) {
+        return taskProgressLightAssembler.assemble(MODULE_TYPE, userId, taskIds);
     }
     private static final String CONTENT_TYPE_XLSX = "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet";
     private static final Duration TASK_LOCK_TTL = TaskDistributedLockService.DEFAULT_LOCK_TTL;
diff --git a/backend-java/src/main/java/com/nanri/aiimage/modules/deletebrand/service/DeleteBrandTaskStorageService.java b/backend-java/src/main/java/com/nanri/aiimage/modules/deletebrand/service/DeleteBrandTaskStorageService.java
index 40a59cfb..dc86fbd0 100644
--- a/backend-java/src/main/java/com/nanri/aiimage/modules/deletebrand/service/DeleteBrandTaskStorageService.java
+++ b/backend-java/src/main/java/com/nanri/aiimage/modules/deletebrand/service/DeleteBrandTaskStorageService.java
@@ -393,11 +393,8 @@ public class DeleteBrandTaskStorageService {
         try {
             MessageDigest digest = MessageDigest.getInstance("SHA-256");
             byte[] bytes = digest.digest(normalizeScopeKey(value).getBytes(StandardCharsets.UTF_8));
-            StringBuilder sb = new StringBuilder(bytes.length * 2);
-            for (byte b : bytes) {
-                sb.append(String.format("%02x", b));
-            }
-            return sb.toString();
+            // HexFormat 替代逐字节 String.format("%02x")：后者每次走 32 次 Formatter（热路径按行调用）
+            return java.util.HexFormat.of().formatHex(bytes);
         } catch (Exception ex) {
             throw new IllegalStateException("failed to hash delete-brand scope", ex);
         }
diff --git a/backend-java/src/main/java/com/nanri/aiimage/modules/imagevideo/service/ImageVideoArchiveService.java b/backend-java/src/main/java/com/nanri/aiimage/modules/imagevideo/service/ImageVideoArchiveService.java
index 695ed386..a762dbd7 100644
--- a/backend-java/src/main/java/com/nanri/aiimage/modules/imagevideo/service/ImageVideoArchiveService.java
+++ b/backend-java/src/main/java/com/nanri/aiimage/modules/imagevideo/service/ImageVideoArchiveService.java
@@ -153,7 +153,12 @@ public class ImageVideoArchiveService {
         Object result = readJsonValue(task.getResultJson());
         enrichCompletedTask(task, result);
         task.setUpdatedAt(LocalDateTime.now());
-        taskMapper.updateById(task);
+        // 条件更新（仅 archive_status 仍为 NULL 时）：整行 updateById 会用读取快照覆盖并发节点
+        // 刚写入的 ARCHIVING —— 双节点 10s 周期归档时，B 节点会把 A 的认领覆盖回可认领状态，
+        // 随后 B 的 CAS 也能成功，导致同一视频被下载/上传两遍（先上传的对象成孤儿）
+        taskMapper.update(task, new LambdaUpdateWrapper<ImageVideoAsyncTaskEntity>()
+                .eq(ImageVideoAsyncTaskEntity::getId, task.getId())
+                .isNull(ImageVideoAsyncTaskEntity::getArchiveStatus));
     }
 
     private void archiveTask(Long taskId) {
diff --git a/backend-java/src/main/java/com/nanri/aiimage/modules/imagevideo/service/ImageVideoAsyncTaskService.java b/backend-java/src/main/java/com/nanri/aiimage/modules/imagevideo/service/ImageVideoAsyncTaskService.java
index be6c04c8..5329dcb2 100644
--- a/backend-java/src/main/java/com/nanri/aiimage/modules/imagevideo/service/ImageVideoAsyncTaskService.java
+++ b/backend-java/src/main/java/com/nanri/aiimage/modules/imagevideo/service/ImageVideoAsyncTaskService.java
@@ -1,6 +1,7 @@
 package com.nanri.aiimage.modules.imagevideo.service;
 
 import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
+import com.baomidou.mybatisplus.core.conditions.update.LambdaUpdateWrapper;
 import com.fasterxml.jackson.core.type.TypeReference;
 import com.fasterxml.jackson.databind.ObjectMapper;
 import com.nanri.aiimage.common.exception.BusinessException;
@@ -180,6 +181,54 @@ public class ImageVideoAsyncTaskService {
         }
     }
 
+    /** owner 节点失联判定阈值（分钟）：任务超过此时长未更新即认为原 owner 已下线。 */
+    private static final long OWNER_TAKEOVER_TIMEOUT_MINUTES = 15;
+
+    /**
+     * 死节点接管（2026-09 全维度审查补）：owner 绑定的任务此前只有「owner 重启时恢复自己的」
+     * 一条路径，owner 节点崩溃/被摘除后其任务永久停在「生成中」
+     * （{@code StaleTaskRepairService} 只覆盖 biz_file_task / brand_crawl_tasks，不含本表）。
+     *
+     * <p>分两类处理：
+     * <ul>
+     *   <li>WAITING/POLLING —— 只是等上游结果，重放安全 → 清空 owner 交回可领取队列；</li>
+     *   <li>RUNNING —— 重放会重复调用上游生成（有费用），故超时后明确标 FAILED 让用户重试，
+     *       而不是悄悄重新执行。</li>
+     * </ul>
+     */
+    @Scheduled(fixedDelayString = "${aiimage.image-video.owner-takeover-delay-ms:60000}")
+    public void takeoverAbandonedTasks() {
+        DistributedJobLockService.LockHandle jobLock =
+                distributedJobLockService.tryLock("image-video:owner-takeover", java.time.Duration.ofSeconds(30));
+        if (jobLock == null) {
+            return;
+        }
+        try (jobLock) {
+            LocalDateTime cutoff = LocalDateTime.now().minusMinutes(OWNER_TAKEOVER_TIMEOUT_MINUTES);
+            int requeued = taskMapper.update(null, new LambdaUpdateWrapper<ImageVideoAsyncTaskEntity>()
+                    .in(ImageVideoAsyncTaskEntity::getStatus,
+                            TaskStatus.WAITING.name(), TaskStatus.POLLING.name())
+                    .isNotNull(ImageVideoAsyncTaskEntity::getOwnerInstanceId)
+                    .ne(ImageVideoAsyncTaskEntity::getOwnerInstanceId, currentInstanceId())
+                    .lt(ImageVideoAsyncTaskEntity::getUpdatedAt, cutoff)
+                    .set(ImageVideoAsyncTaskEntity::getOwnerInstanceId, null)
+                    .set(ImageVideoAsyncTaskEntity::getUpdatedAt, LocalDateTime.now()));
+            int failed = taskMapper.update(null, new LambdaUpdateWrapper<ImageVideoAsyncTaskEntity>()
+                    .eq(ImageVideoAsyncTaskEntity::getStatus, TaskStatus.RUNNING.name())
+                    .isNotNull(ImageVideoAsyncTaskEntity::getOwnerInstanceId)
+                    .ne(ImageVideoAsyncTaskEntity::getOwnerInstanceId, currentInstanceId())
+                    .lt(ImageVideoAsyncTaskEntity::getUpdatedAt, cutoff)
+                    .set(ImageVideoAsyncTaskEntity::getStatus, TaskStatus.FAILED.name())
+                    .set(ImageVideoAsyncTaskEntity::getErrorMessage,
+                            "处理节点失联超过 " + OWNER_TAKEOVER_TIMEOUT_MINUTES + " 分钟，任务已自动失败，请重试")
+                    .set(ImageVideoAsyncTaskEntity::getUpdatedAt, LocalDateTime.now()));
+            if (requeued > 0 || failed > 0) {
+                log.warn("[image-video] 接管失联节点任务 requeued={} failed={} cutoffMinutes={}",
+                        requeued, failed, OWNER_TAKEOVER_TIMEOUT_MINUTES);
+            }
+        }
+    }
+
     @Scheduled(fixedDelayString = "${aiimage.image-video.failed-task-cleanup-delay-ms:60000}")
     public void cleanupFailedTasks() {
         LocalDateTime cutoff = LocalDateTime.now().minusMinutes(FAILED_TASK_RETENTION_MINUTES);
diff --git a/backend-java/src/main/java/com/nanri/aiimage/modules/patroldelete/controller/PatrolDeleteController.java b/backend-java/src/main/java/com/nanri/aiimage/modules/patroldelete/controller/PatrolDeleteController.java
index 09ea9893..5f778b7b 100644
--- a/backend-java/src/main/java/com/nanri/aiimage/modules/patroldelete/controller/PatrolDeleteController.java
+++ b/backend-java/src/main/java/com/nanri/aiimage/modules/patroldelete/controller/PatrolDeleteController.java
@@ -44,6 +44,7 @@ import java.nio.charset.StandardCharsets;
 import java.util.List;
 import com.nanri.aiimage.modules.task.model.dto.TaskProgressLightRequest;
 import com.nanri.aiimage.modules.task.model.vo.TaskProgressLightBatchVo;
+import com.nanri.aiimage.modules.task.service.TaskProgressOwnershipSupport;
 
 @RestController
 @RequiredArgsConstructor
@@ -56,6 +57,7 @@ public class PatrolDeleteController {
 
     private final PatrolDeleteResolveService patrolDeleteResolveService;
     private final PatrolDeleteTaskService patrolDeleteTaskService;
+    private final TaskProgressOwnershipSupport progressOwnershipSupport;
 
     @GetMapping("/candidates")
     @Operation(summary = "查询备选店铺列表", description = "返回当前用户在巡店删除模块中已保存的备选店铺。")
@@ -168,7 +170,9 @@ public class PatrolDeleteController {
     @PostMapping("/tasks/progress/batch")
     @Operation(summary = "批量查询巡店删除任务进度", description = "仅返回任务状态和店铺结果摘要，用于前端轮询降载。")
     public ApiResponse<PatrolDeleteTaskBatchVo> taskProgressBatch(@Valid @RequestBody PatrolDeleteTaskBatchRequest request) {
-        return ApiResponse.success(patrolDeleteTaskService.getTaskProgressBatch(request.getTaskIds()));
+        // 归属过滤：只查询属于该用户的任务（userId 未传时保持原行为，兼容未升级调用方）
+        return ApiResponse.success(patrolDeleteTaskService.getTaskProgressBatch(progressOwnershipSupport
+                .filterOwnedTaskIds(request.getTaskIds(), request.getUserId())));
     }
 
     @PostMapping("/tasks/progress/light")
@@ -176,7 +180,8 @@ public class PatrolDeleteController {
             description = "与 progress/batch 同输入，只返回轻量字段（taskId/status/statusCode/fileStatus/fileError/fileReady/updatedAt），"
                     + "不查明细/result 行，响应体更小；旧 progress/batch 端点保留不动。")
     public ApiResponse<TaskProgressLightBatchVo> progressLight(@Valid @RequestBody TaskProgressLightRequest request) {
-        return ApiResponse.success(patrolDeleteTaskService.progressLight(request.getTaskIds()));
+        // 透传 userId：此前传 null = 不过滤归属，匿名遍历 taskId 即可读他人任务状态（2026-09 审查）
+        return ApiResponse.success(patrolDeleteTaskService.progressLight(request.getTaskIds(), request.getUserId()));
     }
 
     @PostMapping("/tasks")
diff --git a/backend-java/src/main/java/com/nanri/aiimage/modules/patroldelete/model/dto/PatrolDeleteTaskBatchRequest.java b/backend-java/src/main/java/com/nanri/aiimage/modules/patroldelete/model/dto/PatrolDeleteTaskBatchRequest.java
index dd775b85..92ae79bd 100644
--- a/backend-java/src/main/java/com/nanri/aiimage/modules/patroldelete/model/dto/PatrolDeleteTaskBatchRequest.java
+++ b/backend-java/src/main/java/com/nanri/aiimage/modules/patroldelete/model/dto/PatrolDeleteTaskBatchRequest.java
@@ -11,4 +11,7 @@ public class PatrolDeleteTaskBatchRequest {
 
     @NotEmpty(message = "taskIds 不能为空")
     private List<Long> taskIds = new ArrayList<>();
+
+    /** 当前用户 ID（可省略；传入时仅返回该用户的任务，用于进度接口归属过滤）。 */
+    private Long userId;
 }
diff --git a/backend-java/src/main/java/com/nanri/aiimage/modules/patroldelete/service/PatrolDeleteTaskService.java b/backend-java/src/main/java/com/nanri/aiimage/modules/patroldelete/service/PatrolDeleteTaskService.java
index 5713d699..981d2033 100644
--- a/backend-java/src/main/java/com/nanri/aiimage/modules/patroldelete/service/PatrolDeleteTaskService.java
+++ b/backend-java/src/main/java/com/nanri/aiimage/modules/patroldelete/service/PatrolDeleteTaskService.java
@@ -3,8 +3,10 @@ package com.nanri.aiimage.modules.patroldelete.service;
 import cn.hutool.core.io.FileUtil;
 import cn.hutool.core.util.IdUtil;
 import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
+import com.baomidou.mybatisplus.core.conditions.update.LambdaUpdateWrapper;
 import com.fasterxml.jackson.core.type.TypeReference;
 import com.fasterxml.jackson.databind.ObjectMapper;
+import com.nanri.aiimage.common.exception.BusinessCodes;
 import com.nanri.aiimage.common.exception.BusinessException;
 import com.nanri.aiimage.config.TaskPressureProperties;
 import com.nanri.aiimage.modules.file.service.oss.OssStorageService;
@@ -53,8 +55,8 @@ public class PatrolDeleteTaskService {
 
     private static final String MODULE_TYPE = "PATROL_DELETE";
 
-    public TaskProgressLightBatchVo progressLight(List<Long> taskIds) {
-        return taskProgressLightAssembler.assemble(MODULE_TYPE, null, taskIds);
+    public TaskProgressLightBatchVo progressLight(List<Long> taskIds, Long userId) {
+        return taskProgressLightAssembler.assemble(MODULE_TYPE, userId, taskIds);
     }
     private static final String CONTENT_TYPE_XLSX = "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet";
     private static final int RESULT_PENDING = -1;
@@ -958,6 +960,27 @@ public class PatrolDeleteTaskService {
         return false;
     }
 
+    /**
+     * 一条 UPDATE 落库结果文件列。
+     *
+     * <p>原先对每个成功行 {@code updateById}：N 行 = N 次网络往返 + N 次提交（本方法非事务、自动提交），
+     * 且写 binlog 被同步放大；N=500 时白花约 0.5~1s。条件与 listTaskRows 的查询口径一致。
+     */
+    private void updateResultFileColumns(List<Long> rowIds, String filename, String objectKey,
+                                         long fileSize, int rowCount) {
+        if (rowIds == null || rowIds.isEmpty()) {
+            return;
+        }
+        fileResultMapper.update(null, new LambdaUpdateWrapper<FileResultEntity>()
+                .in(FileResultEntity::getId, rowIds)
+                .eq(FileResultEntity::getSuccess, RESULT_SUCCESS)
+                .set(FileResultEntity::getResultFilename, filename)
+                .set(FileResultEntity::getResultFileUrl, objectKey)
+                .set(FileResultEntity::getResultFileSize, fileSize)
+                .set(FileResultEntity::getResultContentType, CONTENT_TYPE_XLSX)
+                .set(FileResultEntity::getRowCount, rowCount));
+    }
+
     private void finalizeTaskWorkbook(FileTaskEntity task, List<FileResultEntity> rows, List<PatrolDeleteResultItemVo> snapshots) {
         List<PatrolDeleteResultItemVo> successItems = snapshots.stream()
                 .filter(item -> Boolean.TRUE.equals(item.getSuccess()))
@@ -966,20 +989,23 @@ public class PatrolDeleteTaskService {
             String filename = buildTaskWorkbookFilename(task);
             int rowCount = excelAssemblyService.countRows(successItems);
             FileResultEntity firstSuccessRow = null;
-                for (FileResultEntity row : rows) {
-                    if (Integer.valueOf(RESULT_SUCCESS).equals(row.getSuccess())) {
-                        row.setResultFilename(filename);
-                        row.setResultFileUrl(null);
-                        row.setResultFileSize(0L);
-                        row.setResultContentType(CONTENT_TYPE_XLSX);
-                        row.setRowCount(rowCount);
-                        fileResultMapper.updateById(row);
-                        if (firstSuccessRow == null) {
-                            firstSuccessRow = row;
-                        }
+            List<Long> successRowIds = new ArrayList<>();
+            for (FileResultEntity row : rows) {
+                if (Integer.valueOf(RESULT_SUCCESS).equals(row.getSuccess())) {
+                    // 内存对象同步改：下方 buildSnapshotFromDb 直接读这些对象
+                    row.setResultFilename(filename);
+                    row.setResultFileUrl(null);
+                    row.setResultFileSize(0L);
+                    row.setResultContentType(CONTENT_TYPE_XLSX);
+                    row.setRowCount(rowCount);
+                    successRowIds.add(row.getId());
+                    if (firstSuccessRow == null) {
+                        firstSuccessRow = row;
                     }
                 }
+            }
             if (firstSuccessRow != null) {
+                updateResultFileColumns(successRowIds, filename, null, 0L, rowCount);
                 taskFileJobService.enqueueAssembleResult(task.getId(), MODULE_TYPE, firstSuccessRow.getId(), "task:" + task.getId());
                 snapshots = buildSnapshotFromDb(task, rows);
             }
@@ -1017,16 +1043,19 @@ public class PatrolDeleteTaskService {
             String objectKey = ossStorageService.uploadResultFile(xlsx, MODULE_TYPE);
             long fileSize = xlsx.length();
             int rowCount = excelAssemblyService.countRows(successItems);
+            List<Long> successRowIds = new ArrayList<>();
             for (FileResultEntity row : rows) {
                 if (Integer.valueOf(RESULT_SUCCESS).equals(row.getSuccess())) {
+                    // 内存对象同步改：紧随其后的 updateTaskStatusFromRows/buildSnapshotFromDb 直接读这些对象
                     row.setResultFilename(filename);
                     row.setResultFileUrl(objectKey);
                     row.setResultFileSize(fileSize);
                     row.setResultContentType(CONTENT_TYPE_XLSX);
                     row.setRowCount(rowCount);
-                    fileResultMapper.updateById(row);
+                    successRowIds.add(row.getId());
                 }
             }
+            updateResultFileColumns(successRowIds, filename, objectKey, fileSize, rowCount);
             updateTaskStatusFromRows(task, rows);
             persistSnapshotJson(task, buildSnapshotFromDb(task, rows));
             fileTaskMapper.updateById(task);
@@ -1056,7 +1085,8 @@ public class PatrolDeleteTaskService {
     private TaskDistributedLockService.LockHandle acquireTaskLockOrThrow(Long taskId) {
         TaskDistributedLockService.LockHandle lockHandle = acquireTaskLock(taskId);
         if (lockHandle == null) {
-            throw new BusinessException(40901, "任务正在处理中，请稍后再试");
+            log.warn("[patrol-delete] 任务锁竞争，拒绝本次提交 taskId={}", taskId);
+            throw new BusinessException(BusinessCodes.TASK_BUSY, "任务正在处理中，请稍后再试");
         }
         return lockHandle;
     }
diff --git a/backend-java/src/main/java/com/nanri/aiimage/modules/pricetrack/controller/PriceTrackController.java b/backend-java/src/main/java/com/nanri/aiimage/modules/pricetrack/controller/PriceTrackController.java
index b35c4bb6..eeee7048 100644
--- a/backend-java/src/main/java/com/nanri/aiimage/modules/pricetrack/controller/PriceTrackController.java
+++ b/backend-java/src/main/java/com/nanri/aiimage/modules/pricetrack/controller/PriceTrackController.java
@@ -52,6 +52,7 @@ import java.nio.charset.StandardCharsets;
 import java.util.List;
 import com.nanri.aiimage.modules.task.model.dto.TaskProgressLightRequest;
 import com.nanri.aiimage.modules.task.model.vo.TaskProgressLightBatchVo;
+import com.nanri.aiimage.modules.task.service.TaskProgressOwnershipSupport;
 
 @RestController
 @RequiredArgsConstructor
@@ -65,6 +66,7 @@ public class PriceTrackController {
 
     private final PriceTrackService priceTrackService;
     private final PriceTrackTaskService priceTrackTaskService;
+    private final TaskProgressOwnershipSupport progressOwnershipSupport;
     private final PriceTrackLoopRunService priceTrackLoopRunService;
     private final SkipPriceAsinService skipPriceAsinService;
 
@@ -259,13 +261,17 @@ public class PriceTrackController {
     @PostMapping("/tasks/batch")
     @Operation(summary = "批量查询任务详情", description = "按 taskIds 返回任务概要和各店铺结果，供前端查询使用。")
     public ApiResponse<PriceTrackTaskBatchVo> tasksBatch(@Valid @RequestBody PriceTrackTaskBatchRequest request) {
-        return ApiResponse.success(priceTrackTaskService.getTaskDetailsBatch(request.getTaskIds()));
+        // 归属过滤：/tasks/batch 同样按 userId 过滤（此前无校验，遍历 taskId 即可读他人任务详情）
+        return ApiResponse.success(priceTrackTaskService.getTaskDetailsBatch(progressOwnershipSupport
+                .filterOwnedTaskIds(request.getTaskIds(), request.getUserId())));
     }
 
     @PostMapping("/tasks/progress/batch")
     @Operation(summary = "批量查询任务进度摘要", description = "仅返回任务状态、时间和错误等轻量信息，供前端轮询降载。")
     public ApiResponse<PriceTrackTaskBatchVo> taskProgressBatch(@Valid @RequestBody PriceTrackTaskBatchRequest request) {
-        return ApiResponse.success(priceTrackTaskService.getTaskProgressBatch(request.getTaskIds()));
+        // 归属过滤：只查询属于该用户的任务（userId 未传时保持原行为，兼容未升级调用方）
+        return ApiResponse.success(priceTrackTaskService.getTaskProgressBatch(progressOwnershipSupport
+                .filterOwnedTaskIds(request.getTaskIds(), request.getUserId())));
     }
 
     @PostMapping("/tasks/progress/light")
@@ -273,7 +279,8 @@ public class PriceTrackController {
             description = "与 progress/batch 同输入，只返回轻量字段（taskId/status/statusCode/fileStatus/fileError/fileReady/updatedAt），"
                     + "不查明细/result 行，响应体更小；旧 progress/batch 端点保留不动。")
     public ApiResponse<TaskProgressLightBatchVo> progressLight(@Valid @RequestBody TaskProgressLightRequest request) {
-        return ApiResponse.success(priceTrackTaskService.progressLight(request.getTaskIds()));
+        // 透传 userId：此前传 null = 不过滤归属，匿名遍历 taskId 即可读他人任务状态（2026-09 审查）
+        return ApiResponse.success(priceTrackTaskService.progressLight(request.getTaskIds(), request.getUserId()));
     }
 
     @PostMapping("/tasks/{taskId}/result")
diff --git a/backend-java/src/main/java/com/nanri/aiimage/modules/pricetrack/model/dto/PriceTrackTaskBatchRequest.java b/backend-java/src/main/java/com/nanri/aiimage/modules/pricetrack/model/dto/PriceTrackTaskBatchRequest.java
index c82a1212..98b4d164 100644
--- a/backend-java/src/main/java/com/nanri/aiimage/modules/pricetrack/model/dto/PriceTrackTaskBatchRequest.java
+++ b/backend-java/src/main/java/com/nanri/aiimage/modules/pricetrack/model/dto/PriceTrackTaskBatchRequest.java
@@ -13,4 +13,8 @@ public class PriceTrackTaskBatchRequest {
     @NotEmpty(message = "taskIds不能为空")
     @Schema(description = "待查询的任务主键列表，无效或非本模块 taskId 会出现在 missingTaskIds", requiredMode = Schema.RequiredMode.REQUIRED, example = "[200,201]")
     private List<Long> taskIds = new ArrayList<>();
+
+    /** 当前用户 ID（可省略；传入时仅返回该用户的任务，用于进度接口归属过滤）。 */
+    @Schema(description = "当前用户 ID（可省略；传入时仅返回该用户的任务）", example = "1")
+    private Long userId;
 }
diff --git a/backend-java/src/main/java/com/nanri/aiimage/modules/pricetrack/service/PriceTrackLoopRunService.java b/backend-java/src/main/java/com/nanri/aiimage/modules/pricetrack/service/PriceTrackLoopRunService.java
index 16965243..947d5b0e 100644
--- a/backend-java/src/main/java/com/nanri/aiimage/modules/pricetrack/service/PriceTrackLoopRunService.java
+++ b/backend-java/src/main/java/com/nanri/aiimage/modules/pricetrack/service/PriceTrackLoopRunService.java
@@ -1,6 +1,7 @@
 package com.nanri.aiimage.modules.pricetrack.service;
 
 import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
+import com.baomidou.mybatisplus.core.conditions.update.LambdaUpdateWrapper;
 import com.fasterxml.jackson.core.type.TypeReference;
 import com.fasterxml.jackson.databind.ObjectMapper;
 import com.nanri.aiimage.common.exception.BusinessException;
@@ -149,7 +150,13 @@ public class PriceTrackLoopRunService {
         if (entity.getActiveTaskId() == null || isChildTaskTerminal(entity.getActiveTaskId())) {
             markStopped(entity, null);
         } else {
-            loopRunMapper.updateById(entity);
+            // 只更新 stop_requested 字段：整行 updateById 会用读取快照覆盖并发写入的字段——
+            // 用户点「停止循环」的瞬间子任务刚好完成时，handleChildFinished 写入的状态
+            // 会被这里的旧快照覆盖回去，INFINITE 循环继续跑并继续产生真实任务
+            loopRunMapper.update(null, new LambdaUpdateWrapper<PriceTrackLoopRunEntity>()
+                    .eq(PriceTrackLoopRunEntity::getId, entity.getId())
+                    .set(PriceTrackLoopRunEntity::getStopRequested, true)
+                    .set(PriceTrackLoopRunEntity::getUpdatedAt, LocalDateTime.now()));
         }
         return toVo(entity);
     }
@@ -174,7 +181,13 @@ public class PriceTrackLoopRunService {
         }
         entity.setActiveTaskId(childTaskId);
         entity.setUpdatedAt(LocalDateTime.now());
-        loopRunMapper.updateById(entity);
+        // 字段级更新 + status CAS：整行 updateById 会覆盖并发写入的 stop_requested，
+        // 导致「停止循环」请求被静默丢弃
+        loopRunMapper.update(null, new LambdaUpdateWrapper<PriceTrackLoopRunEntity>()
+                .eq(PriceTrackLoopRunEntity::getId, entity.getId())
+                .eq(PriceTrackLoopRunEntity::getStatus, entity.getStatus())
+                .set(PriceTrackLoopRunEntity::getActiveTaskId, childTaskId)
+                .set(PriceTrackLoopRunEntity::getUpdatedAt, LocalDateTime.now()));
         log.info("[price-track-loop] child bound loopRunId={} childTaskId={} roundIndex={} shopIndex={}",
                 loopRunId, childTaskId, roundIndex, shopIndex);
     }
diff --git a/backend-java/src/main/java/com/nanri/aiimage/modules/pricetrack/service/PriceTrackTaskService.java b/backend-java/src/main/java/com/nanri/aiimage/modules/pricetrack/service/PriceTrackTaskService.java
index 8a20f91f..d33bb618 100644
--- a/backend-java/src/main/java/com/nanri/aiimage/modules/pricetrack/service/PriceTrackTaskService.java
+++ b/backend-java/src/main/java/com/nanri/aiimage/modules/pricetrack/service/PriceTrackTaskService.java
@@ -3,6 +3,7 @@ package com.nanri.aiimage.modules.pricetrack.service;
 import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
 import com.fasterxml.jackson.core.type.TypeReference;
 import com.fasterxml.jackson.databind.ObjectMapper;
+import com.nanri.aiimage.common.exception.BusinessCodes;
 import com.nanri.aiimage.common.exception.BusinessException;
 import com.nanri.aiimage.common.util.ExcelStreamReader;
 import com.nanri.aiimage.config.TaskPressureProperties;
@@ -64,9 +65,11 @@ import com.nanri.aiimage.modules.task.service.TaskProgressLightAssembler;
 public class PriceTrackTaskService {
 
     private static final String MODULE_TYPE = "PRICE_TRACK";
+    /** 批量进度查询的任务 id 上限（轮询端点防滥用，与 patroldelete/deletebrand 保持一致）。 */
+    private static final int MAX_PROGRESS_TASK_IDS = 50;
 
-    public TaskProgressLightBatchVo progressLight(List<Long> taskIds) {
-        return taskProgressLightAssembler.assemble(MODULE_TYPE, null, taskIds);
+    public TaskProgressLightBatchVo progressLight(List<Long> taskIds, Long userId) {
+        return taskProgressLightAssembler.assemble(MODULE_TYPE, userId, taskIds);
     }
     private static final String CONTENT_TYPE_XLSX = "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet";
     private static final String ASIN_ROWS_PAYLOAD_SCOPE = "price-track-asin-rows";
@@ -386,6 +389,16 @@ public class PriceTrackTaskService {
         if (taskIds == null || taskIds.isEmpty()) {
             return batch;
         }
+        // 上限 50：轮询端点不限制数量时，调用方传数万 id 会引发单请求内数万次串行 SQL，
+        // 拖慢共享连接池并波及其它实例请求（对齐 patroldelete / deletebrand 的口径）
+        taskIds = taskIds.stream()
+                .filter(taskId -> taskId != null && taskId > 0)
+                .distinct()
+                .limit(MAX_PROGRESS_TASK_IDS)
+                .toList();
+        if (taskIds.isEmpty()) {
+            return batch;
+        }
         Map<Long, FileTaskEntity> taskMap = loadTaskProgressMapByIds(taskIds);
         for (Long taskId : taskIds) {
             if (taskId == null || taskId <= 0) {
@@ -2167,7 +2180,8 @@ public class PriceTrackTaskService {
     private TaskDistributedLockService.LockHandle acquireTaskLockOrThrow(Long taskId) {
         TaskDistributedLockService.LockHandle lockHandle = acquireTaskLock(taskId);
         if (lockHandle == null) {
-            throw new BusinessException(40901, "任务正在处理中，请稍后再试");
+            log.warn("[price-track] 任务锁竞争，拒绝本次提交 taskId={}", taskId);
+            throw new BusinessException(BusinessCodes.TASK_BUSY, "任务正在处理中，请稍后再试");
         }
         return lockHandle;
     }
diff --git a/backend-java/src/main/java/com/nanri/aiimage/modules/productrisk/controller/ProductRiskResolveController.java b/backend-java/src/main/java/com/nanri/aiimage/modules/productrisk/controller/ProductRiskResolveController.java
index bb182c92..8022f48b 100644
--- a/backend-java/src/main/java/com/nanri/aiimage/modules/productrisk/controller/ProductRiskResolveController.java
+++ b/backend-java/src/main/java/com/nanri/aiimage/modules/productrisk/controller/ProductRiskResolveController.java
@@ -47,6 +47,7 @@ import java.nio.charset.StandardCharsets;
 import java.util.List;
 import com.nanri.aiimage.modules.task.model.dto.TaskProgressLightRequest;
 import com.nanri.aiimage.modules.task.model.vo.TaskProgressLightBatchVo;
+import com.nanri.aiimage.modules.task.service.TaskProgressOwnershipSupport;
 
 @RestController
 @RequiredArgsConstructor
@@ -59,6 +60,7 @@ public class ProductRiskResolveController {
 
     private final ProductRiskResolveService productRiskResolveService;
     private final ProductRiskTaskService productRiskTaskService;
+    private final TaskProgressOwnershipSupport progressOwnershipSupport;
 
     @GetMapping("/candidates")
     @Operation(summary = "查询备选店铺列表", description = "返回当前用户在商品风险模块中已保存的备选店铺。")
@@ -160,13 +162,17 @@ public class ProductRiskResolveController {
     @PostMapping("/tasks/batch")
     @Operation(summary = "批量查询任务详情", description = "按 taskIds 返回任务概览与各店结果，供前端轮询使用。")
     public ApiResponse<ProductRiskTaskBatchVo> tasksBatch(@Valid @RequestBody ProductRiskTaskBatchRequest request) {
-        return ApiResponse.success(productRiskTaskService.getTaskDetailsBatch(request.getTaskIds()));
+        // 归属过滤：/tasks/batch 同样按 userId 过滤（此前无校验，遍历 taskId 即可读他人任务详情）
+        return ApiResponse.success(productRiskTaskService.getTaskDetailsBatch(progressOwnershipSupport
+                .filterOwnedTaskIds(request.getTaskIds(), request.getUserId())));
     }
 
     @PostMapping("/tasks/progress/batch")
     @Operation(summary = "批量查询任务进度摘要", description = "仅返回任务状态、时间和错误等轻量信息，供前端轮询降载。")
     public ApiResponse<ProductRiskTaskBatchVo> taskProgressBatch(@Valid @RequestBody ProductRiskTaskBatchRequest request) {
-        return ApiResponse.success(productRiskTaskService.getTaskProgressBatch(request.getTaskIds()));
+        // 归属过滤：只查询属于该用户的任务（userId 未传时保持原行为，兼容未升级调用方）
+        return ApiResponse.success(productRiskTaskService.getTaskProgressBatch(progressOwnershipSupport
+                .filterOwnedTaskIds(request.getTaskIds(), request.getUserId())));
     }
 
     @PostMapping("/tasks/progress/light")
@@ -174,7 +180,8 @@ public class ProductRiskResolveController {
             description = "与 progress/batch 同输入，只返回轻量字段（taskId/status/statusCode/fileStatus/fileError/fileReady/updatedAt），"
                     + "不查明细/result 行，响应体更小；旧 progress/batch 端点保留不动。")
     public ApiResponse<TaskProgressLightBatchVo> progressLight(@Valid @RequestBody TaskProgressLightRequest request) {
-        return ApiResponse.success(productRiskTaskService.progressLight(request.getTaskIds()));
+        // 透传 userId：此前传 null = 不过滤归属，匿名遍历 taskId 即可读他人任务状态（2026-09 审查）
+        return ApiResponse.success(productRiskTaskService.progressLight(request.getTaskIds(), request.getUserId()));
     }
 
     @PostMapping("/tasks/{taskId}/result")
diff --git a/backend-java/src/main/java/com/nanri/aiimage/modules/productrisk/model/dto/ProductRiskTaskBatchRequest.java b/backend-java/src/main/java/com/nanri/aiimage/modules/productrisk/model/dto/ProductRiskTaskBatchRequest.java
index c0e798ec..5ba27e36 100644
--- a/backend-java/src/main/java/com/nanri/aiimage/modules/productrisk/model/dto/ProductRiskTaskBatchRequest.java
+++ b/backend-java/src/main/java/com/nanri/aiimage/modules/productrisk/model/dto/ProductRiskTaskBatchRequest.java
@@ -17,4 +17,8 @@ public class ProductRiskTaskBatchRequest {
             requiredMode = Schema.RequiredMode.REQUIRED,
             example = "[200,201]")
     private List<Long> taskIds = new ArrayList<>();
+
+    /** 当前用户 ID（可省略；传入时仅返回该用户的任务，用于进度接口归属过滤）。 */
+    @Schema(description = "当前用户 ID（可省略；传入时仅返回该用户的任务）", example = "1")
+    private Long userId;
 }
diff --git a/backend-java/src/main/java/com/nanri/aiimage/modules/productrisk/service/ProductRiskTaskService.java b/backend-java/src/main/java/com/nanri/aiimage/modules/productrisk/service/ProductRiskTaskService.java
index cfe426e5..670e5134 100644
--- a/backend-java/src/main/java/com/nanri/aiimage/modules/productrisk/service/ProductRiskTaskService.java
+++ b/backend-java/src/main/java/com/nanri/aiimage/modules/productrisk/service/ProductRiskTaskService.java
@@ -2,6 +2,7 @@ package com.nanri.aiimage.modules.productrisk.service;
 
 import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
 import com.fasterxml.jackson.databind.ObjectMapper;
+import com.nanri.aiimage.common.exception.BusinessCodes;
 import com.nanri.aiimage.common.exception.BusinessException;
 import com.nanri.aiimage.config.TaskPressureProperties;
 import com.nanri.aiimage.modules.file.service.oss.OssStorageService;
@@ -56,9 +57,11 @@ import com.nanri.aiimage.modules.task.service.TaskProgressLightAssembler;
 public class ProductRiskTaskService {
 
     private static final String MODULE_TYPE = "PRODUCT_RISK_RESOLVE";
+    /** 批量进度查询的任务 id 上限（轮询端点防滥用，与 patroldelete/deletebrand 保持一致）。 */
+    private static final int MAX_PROGRESS_TASK_IDS = 50;
 
-    public TaskProgressLightBatchVo progressLight(List<Long> taskIds) {
-        return taskProgressLightAssembler.assemble(MODULE_TYPE, null, taskIds);
+    public TaskProgressLightBatchVo progressLight(List<Long> taskIds, Long userId) {
+        return taskProgressLightAssembler.assemble(MODULE_TYPE, userId, taskIds);
     }
     private static final String CONTENT_TYPE_ZIP = "application/zip";
 
@@ -446,6 +449,16 @@ public class ProductRiskTaskService {
         if (taskIds == null || taskIds.isEmpty()) {
             return batch;
         }
+        // 上限 50：轮询端点不限制数量时，调用方传数万 id 会引发单请求内数万次串行 SQL，
+        // 拖慢共享连接池并波及其它实例请求（对齐 patroldelete / deletebrand 的口径）
+        taskIds = taskIds.stream()
+                .filter(taskId -> taskId != null && taskId > 0)
+                .distinct()
+                .limit(MAX_PROGRESS_TASK_IDS)
+                .toList();
+        if (taskIds.isEmpty()) {
+            return batch;
+        }
         Map<Long, FileTaskEntity> taskMap = loadTaskMapByIds(taskIds);
         for (Long taskId : taskIds) {
             if (taskId == null || taskId <= 0) {
@@ -980,7 +993,8 @@ public class ProductRiskTaskService {
     private TaskDistributedLockService.LockHandle acquireTaskLockOrThrow(Long taskId) {
         TaskDistributedLockService.LockHandle lockHandle = acquireTaskLock(taskId);
         if (lockHandle == null) {
-            throw new BusinessException(40901, "任务正在处理中，请稍后再试");
+            log.warn("[product-risk] 任务锁竞争，拒绝本次提交 taskId={}", taskId);
+            throw new BusinessException(BusinessCodes.TASK_BUSY, "任务正在处理中，请稍后再试");
         }
         return lockHandle;
     }
diff --git a/backend-java/src/main/java/com/nanri/aiimage/modules/queryasin/controller/QueryAsinTaskController.java b/backend-java/src/main/java/com/nanri/aiimage/modules/queryasin/controller/QueryAsinTaskController.java
index 83fd7016..f11ccc8c 100644
--- a/backend-java/src/main/java/com/nanri/aiimage/modules/queryasin/controller/QueryAsinTaskController.java
+++ b/backend-java/src/main/java/com/nanri/aiimage/modules/queryasin/controller/QueryAsinTaskController.java
@@ -42,6 +42,7 @@ import java.nio.charset.StandardCharsets;
 import java.util.List;
 import com.nanri.aiimage.modules.task.model.dto.TaskProgressLightRequest;
 import com.nanri.aiimage.modules.task.model.vo.TaskProgressLightBatchVo;
+import com.nanri.aiimage.modules.task.service.TaskProgressOwnershipSupport;
 
 @RestController
 @RequiredArgsConstructor
@@ -54,6 +55,7 @@ public class QueryAsinTaskController {
 
     private final QueryAsinResolveService queryAsinResolveService;
     private final QueryAsinTaskService queryAsinTaskService;
+    private final TaskProgressOwnershipSupport progressOwnershipSupport;
 
     @GetMapping("/candidates")
     @Operation(summary = "查询备选店铺列表", description = "返回当前用户在查询 ASIN 模块中已保存的备选店铺。")
@@ -138,7 +140,9 @@ public class QueryAsinTaskController {
     @PostMapping("/tasks/progress/batch")
     @Operation(summary = "批量查询查询 ASIN 任务进度", description = "仅返回任务状态和店铺结果摘要，用于前端轮询降载。")
     public ApiResponse<QueryAsinTaskBatchVo> taskProgressBatch(@Valid @RequestBody QueryAsinTaskBatchRequest request) {
-        return ApiResponse.success(queryAsinTaskService.getTaskProgressBatch(request.getTaskIds()));
+        // 归属过滤：只查询属于该用户的任务（userId 未传时保持原行为，兼容未升级调用方）
+        return ApiResponse.success(queryAsinTaskService.getTaskProgressBatch(progressOwnershipSupport
+                .filterOwnedTaskIds(request.getTaskIds(), request.getUserId())));
     }
 
     @PostMapping("/tasks/progress/light")
@@ -146,7 +150,8 @@ public class QueryAsinTaskController {
             description = "与 progress/batch 同输入，只返回轻量字段（taskId/status/statusCode/fileStatus/fileError/fileReady/updatedAt），"
                     + "不查明细/result 行，响应体更小；旧 progress/batch 端点保留不动。")
     public ApiResponse<TaskProgressLightBatchVo> progressLight(@Valid @RequestBody TaskProgressLightRequest request) {
-        return ApiResponse.success(queryAsinTaskService.progressLight(request.getTaskIds()));
+        // 透传 userId：此前传 null = 不过滤归属，匿名遍历 taskId 即可读他人任务状态（2026-09 审查）
+        return ApiResponse.success(queryAsinTaskService.progressLight(request.getTaskIds(), request.getUserId()));
     }
 
     @PostMapping("/tasks")
diff --git a/backend-java/src/main/java/com/nanri/aiimage/modules/queryasin/model/dto/QueryAsinTaskBatchRequest.java b/backend-java/src/main/java/com/nanri/aiimage/modules/queryasin/model/dto/QueryAsinTaskBatchRequest.java
index 81177db3..278b93d5 100644
--- a/backend-java/src/main/java/com/nanri/aiimage/modules/queryasin/model/dto/QueryAsinTaskBatchRequest.java
+++ b/backend-java/src/main/java/com/nanri/aiimage/modules/queryasin/model/dto/QueryAsinTaskBatchRequest.java
@@ -11,5 +11,8 @@ public class QueryAsinTaskBatchRequest {
 
     @NotEmpty(message = "taskIds 不能为空")
     private List<Long> taskIds = new ArrayList<>();
+
+    /** 当前用户 ID（可省略；传入时仅返回该用户的任务，用于进度接口归属过滤）。 */
+    private Long userId;
 }
 
diff --git a/backend-java/src/main/java/com/nanri/aiimage/modules/queryasin/service/QueryAsinTaskService.java b/backend-java/src/main/java/com/nanri/aiimage/modules/queryasin/service/QueryAsinTaskService.java
index ff70efa1..861be48c 100644
--- a/backend-java/src/main/java/com/nanri/aiimage/modules/queryasin/service/QueryAsinTaskService.java
+++ b/backend-java/src/main/java/com/nanri/aiimage/modules/queryasin/service/QueryAsinTaskService.java
@@ -3,8 +3,10 @@ package com.nanri.aiimage.modules.queryasin.service;
 import cn.hutool.core.io.FileUtil;
 import cn.hutool.core.util.IdUtil;
 import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
+import com.baomidou.mybatisplus.core.conditions.update.LambdaUpdateWrapper;
 import com.fasterxml.jackson.core.type.TypeReference;
 import com.fasterxml.jackson.databind.ObjectMapper;
+import com.nanri.aiimage.common.exception.BusinessCodes;
 import com.nanri.aiimage.common.exception.BusinessException;
 import com.nanri.aiimage.config.TaskPressureProperties;
 import com.nanri.aiimage.modules.file.service.oss.OssStorageService;
@@ -52,8 +54,8 @@ public class QueryAsinTaskService {
 
     private static final String MODULE_TYPE = "QUERY_ASIN";
 
-    public TaskProgressLightBatchVo progressLight(List<Long> taskIds) {
-        return taskProgressLightAssembler.assemble(MODULE_TYPE, null, taskIds);
+    public TaskProgressLightBatchVo progressLight(List<Long> taskIds, Long userId) {
+        return taskProgressLightAssembler.assemble(MODULE_TYPE, userId, taskIds);
     }
     private static final String CONTENT_TYPE_XLSX = "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet";
     private static final int RESULT_PENDING = -1;
@@ -537,6 +539,28 @@ public class QueryAsinTaskService {
                 .orderByAsc(FileResultEntity::getId));
     }
 
+    /**
+     * 一条 UPDATE 落库结果文件列。
+     *
+     * <p>原先对每个成功行 {@code updateById}：N 行 = N 次网络往返 + N 次提交
+     * （这些方法非事务、各自自动提交），且写 binlog 被同步放大；N=500 时白花约 0.5~1s。
+     * 条件与 {@link #listTaskRows} 的查询口径一致（同任务同模块的成功行）。
+     */
+    private void updateResultFileColumns(List<Long> rowIds, String filename, String objectKey,
+                                         long fileSize, int rowCount) {
+        if (rowIds == null || rowIds.isEmpty()) {
+            return;
+        }
+        fileResultMapper.update(null, new LambdaUpdateWrapper<FileResultEntity>()
+                .in(FileResultEntity::getId, rowIds)
+                .eq(FileResultEntity::getSuccess, RESULT_SUCCESS)
+                .set(FileResultEntity::getResultFilename, filename)
+                .set(FileResultEntity::getResultFileUrl, objectKey)
+                .set(FileResultEntity::getResultFileSize, fileSize)
+                .set(FileResultEntity::getResultContentType, CONTENT_TYPE_XLSX)
+                .set(FileResultEntity::getRowCount, rowCount));
+    }
+
     private Map<String, QueryAsinShopPayloadDto> normalizePayloadByShop(List<QueryAsinShopPayloadDto> shops) {
         Map<String, QueryAsinShopPayloadDto> payloadByShop = new LinkedHashMap<>();
         for (QueryAsinShopPayloadDto item : shops) {
@@ -920,20 +944,23 @@ public class QueryAsinTaskService {
             String filename = buildTaskWorkbookFilename(task);
             int rowCount = excelAssemblyService.countRows(successItems);
             FileResultEntity firstSuccessRow = null;
-                for (FileResultEntity row : rows) {
-                    if (Integer.valueOf(RESULT_SUCCESS).equals(row.getSuccess())) {
-                        row.setResultFilename(filename);
-                        row.setResultFileUrl(null);
-                        row.setResultFileSize(0L);
-                        row.setResultContentType(CONTENT_TYPE_XLSX);
-                        row.setRowCount(rowCount);
-                        fileResultMapper.updateById(row);
-                        if (firstSuccessRow == null) {
-                            firstSuccessRow = row;
-                        }
+            List<Long> successRowIds = new ArrayList<>();
+            for (FileResultEntity row : rows) {
+                if (Integer.valueOf(RESULT_SUCCESS).equals(row.getSuccess())) {
+                    // 内存对象同步改：下方 buildSnapshotFromDb 直接读这些对象
+                    row.setResultFilename(filename);
+                    row.setResultFileUrl(null);
+                    row.setResultFileSize(0L);
+                    row.setResultContentType(CONTENT_TYPE_XLSX);
+                    row.setRowCount(rowCount);
+                    successRowIds.add(row.getId());
+                    if (firstSuccessRow == null) {
+                        firstSuccessRow = row;
                     }
                 }
+            }
             if (firstSuccessRow != null) {
+                updateResultFileColumns(successRowIds, filename, null, 0L, rowCount);
                 taskFileJobService.enqueueAssembleResult(task.getId(), MODULE_TYPE, firstSuccessRow.getId(), "task:" + task.getId());
                 snapshots = buildSnapshotFromDb(task, rows);
             }
@@ -971,16 +998,19 @@ public class QueryAsinTaskService {
             String objectKey = ossStorageService.uploadResultFile(xlsx, MODULE_TYPE);
             long fileSize = xlsx.length();
             int rowCount = excelAssemblyService.countRows(successItems);
+            List<Long> successRowIds = new ArrayList<>();
             for (FileResultEntity row : rows) {
                 if (Integer.valueOf(RESULT_SUCCESS).equals(row.getSuccess())) {
+                    // 内存对象同步改：紧随其后的 updateTaskStatusFromRows/buildSnapshotFromDb 直接读这些对象
                     row.setResultFilename(filename);
                     row.setResultFileUrl(objectKey);
                     row.setResultFileSize(fileSize);
                     row.setResultContentType(CONTENT_TYPE_XLSX);
                     row.setRowCount(rowCount);
-                    fileResultMapper.updateById(row);
+                    successRowIds.add(row.getId());
                 }
             }
+            updateResultFileColumns(successRowIds, filename, objectKey, fileSize, rowCount);
             updateTaskStatusFromRows(task, rows);
             persistSnapshotJson(task, buildSnapshotFromDb(task, rows));
             fileTaskMapper.updateById(task);
@@ -1010,7 +1040,8 @@ public class QueryAsinTaskService {
     private TaskDistributedLockService.LockHandle acquireTaskLockOrThrow(Long taskId) {
         TaskDistributedLockService.LockHandle lockHandle = acquireTaskLock(taskId);
         if (lockHandle == null) {
-            throw new BusinessException(40901, "任务正在处理中，请稍后再试");
+            log.warn("[query-asin] 任务锁竞争，拒绝本次提交 taskId={}", taskId);
+            throw new BusinessException(BusinessCodes.TASK_BUSY, "任务正在处理中，请稍后再试");
         }
         return lockHandle;
     }
diff --git a/backend-java/src/main/java/com/nanri/aiimage/modules/shopdatacrawl/controller/AdminShopDataCrawlTaskController.java b/backend-java/src/main/java/com/nanri/aiimage/modules/shopdatacrawl/controller/AdminShopDataCrawlTaskController.java
index 85d58a9e..7dc56f1f 100644
--- a/backend-java/src/main/java/com/nanri/aiimage/modules/shopdatacrawl/controller/AdminShopDataCrawlTaskController.java
+++ b/backend-java/src/main/java/com/nanri/aiimage/modules/shopdatacrawl/controller/AdminShopDataCrawlTaskController.java
@@ -3,6 +3,7 @@ package com.nanri.aiimage.modules.shopdatacrawl.controller;
 import com.nanri.aiimage.common.api.ApiResponse;
 import com.nanri.aiimage.common.exception.BusinessException;
 import com.nanri.aiimage.common.util.DownloadHeaderUtil;
+import com.nanri.aiimage.config.HttpClientPool;
 import com.nanri.aiimage.modules.admin.support.AdminAuthSupport;
 import com.nanri.aiimage.modules.permission.model.entity.AdminUserEntity;
 import com.nanri.aiimage.modules.permission.service.PermissionMenuService;
@@ -21,11 +22,11 @@ import org.springframework.web.bind.annotation.RestController;
 import org.springframework.web.server.ResponseStatusException;
 
 import java.io.InputStream;
-import java.net.URI;
 import java.nio.charset.StandardCharsets;
 import java.nio.file.Files;
 import java.nio.file.Path;
 import java.security.MessageDigest;
+import java.time.Duration;
 
 /**
  * Internal compatibility endpoints used by the Flask admin task page.
@@ -36,6 +37,9 @@ import java.security.MessageDigest;
 @RequestMapping("/api/admin/shop-data-crawl")
 public class AdminShopDataCrawlTaskController {
 
+    /** 代理下载 OSS 文件转发给浏览器的超时：必须有上限，避免上游挂起占死 Tomcat 工作线程。 */
+    private static final Duration DOWNLOAD_TIMEOUT = Duration.ofMinutes(5);
+
     @Value("${aiimage.security.internal-token:}")
     private String internalToken;
 
@@ -58,7 +62,7 @@ public class AdminShopDataCrawlTaskController {
         try {
             response.setContentType("application/vnd.openxmlformats-officedocument.spreadsheetml.sheet");
             DownloadHeaderUtil.setAttachment(response, filename);
-            try (InputStream input = URI.create(url).toURL().openStream()) {
+            try (InputStream input = HttpClientPool.openStreamWithTimeout(url, DOWNLOAD_TIMEOUT)) {
                 input.transferTo(response.getOutputStream());
             }
         } catch (Exception ex) {
diff --git a/backend-java/src/main/java/com/nanri/aiimage/modules/shopdatacrawl/controller/AdminShopDataCrawlTasksController.java b/backend-java/src/main/java/com/nanri/aiimage/modules/shopdatacrawl/controller/AdminShopDataCrawlTasksController.java
index a6de2b35..161d8e55 100644
--- a/backend-java/src/main/java/com/nanri/aiimage/modules/shopdatacrawl/controller/AdminShopDataCrawlTasksController.java
+++ b/backend-java/src/main/java/com/nanri/aiimage/modules/shopdatacrawl/controller/AdminShopDataCrawlTasksController.java
@@ -3,6 +3,7 @@ package com.nanri.aiimage.modules.shopdatacrawl.controller;
 import com.nanri.aiimage.common.api.ApiResponse;
 import com.nanri.aiimage.common.exception.BusinessException;
 import com.nanri.aiimage.common.util.DownloadHeaderUtil;
+import com.nanri.aiimage.config.HttpClientPool;
 import com.nanri.aiimage.modules.admin.support.AdminAuthSupport;
 import com.nanri.aiimage.modules.permission.model.entity.AdminUserEntity;
 import com.nanri.aiimage.modules.permission.service.PermissionMenuService;
@@ -28,11 +29,11 @@ import org.springframework.web.server.ResponseStatusException;
 
 import java.io.IOException;
 import java.io.InputStream;
-import java.net.URI;
 import java.nio.charset.StandardCharsets;
 import java.nio.file.Files;
 import java.nio.file.Path;
 import java.security.MessageDigest;
+import java.time.Duration;
 import java.time.LocalDateTime;
 import java.time.format.DateTimeFormatter;
 import java.util.ArrayList;
@@ -67,6 +68,8 @@ public class AdminShopDataCrawlTasksController {
     private static final int ZIP_MAX_FILES = 100;
     private static final Pattern INVALID_FILE_CHARS = Pattern.compile("[\\\\/:*?\"<>|]+");
     private static final DateTimeFormatter ZIP_STAMP = DateTimeFormatter.ofPattern("yyyyMMdd-HHmmss");
+    /** 代理下载 OSS 文件转发给浏览器的超时：必须有上限，避免上游挂起占死 Tomcat 工作线程。 */
+    private static final Duration DOWNLOAD_TIMEOUT = Duration.ofMinutes(5);
 
     @Value("${aiimage.security.internal-token:}")
     private String internalToken;
@@ -111,7 +114,7 @@ public class AdminShopDataCrawlTasksController {
         try {
             response.setContentType("application/vnd.openxmlformats-officedocument.spreadsheetml.sheet");
             DownloadHeaderUtil.setAttachment(response, daily.filename());
-            try (InputStream input = URI.create(daily.url()).toURL().openStream()) {
+            try (InputStream input = HttpClientPool.openStreamWithTimeout(daily.url(), DOWNLOAD_TIMEOUT)) {
                 input.transferTo(response.getOutputStream());
             }
         } catch (Exception ex) {
@@ -164,7 +167,7 @@ public class AdminShopDataCrawlTasksController {
                         continue;
                     }
                     String filename = resolveEntryFilename(row, resultId, usedNames);
-                    try (InputStream input = URI.create(row.getResultFileUrl()).toURL().openStream()) {
+                    try (InputStream input = HttpClientPool.openStreamWithTimeout(row.getResultFileUrl(), DOWNLOAD_TIMEOUT)) {
                         zip.putNextEntry(new ZipEntry(filename));
                         byte[] buffer = new byte[64 * 1024];
                         int read;
diff --git a/backend-java/src/main/java/com/nanri/aiimage/modules/shopdatacrawl/controller/ShopDataCrawlTaskController.java b/backend-java/src/main/java/com/nanri/aiimage/modules/shopdatacrawl/controller/ShopDataCrawlTaskController.java
index a8cd32d2..48e0a4bb 100644
--- a/backend-java/src/main/java/com/nanri/aiimage/modules/shopdatacrawl/controller/ShopDataCrawlTaskController.java
+++ b/backend-java/src/main/java/com/nanri/aiimage/modules/shopdatacrawl/controller/ShopDataCrawlTaskController.java
@@ -36,6 +36,7 @@ import java.net.URI;
 import java.util.List;
 import com.nanri.aiimage.modules.task.model.dto.TaskProgressLightRequest;
 import com.nanri.aiimage.modules.task.model.vo.TaskProgressLightBatchVo;
+import com.nanri.aiimage.modules.task.service.TaskProgressOwnershipSupport;
 
 @RestController
 @RequiredArgsConstructor
@@ -47,6 +48,7 @@ import com.nanri.aiimage.modules.task.model.vo.TaskProgressLightBatchVo;
 public class ShopDataCrawlTaskController {
     private final ShopDataCrawlResolveService resolveService;
     private final ShopDataCrawlTaskService taskService;
+    private final TaskProgressOwnershipSupport progressOwnershipSupport;
 
     @GetMapping("/candidates")
     @Operation(
@@ -152,7 +154,9 @@ public class ShopDataCrawlTaskController {
             responses = @io.swagger.v3.oas.annotations.responses.ApiResponse(responseCode = "200", description = "查询成功"))
     public ApiResponse<ShopDataCrawlTaskBatchVo> progress(
             @Valid @RequestBody ShopDataCrawlTaskBatchRequest request) {
-        return ApiResponse.success(taskService.getTaskProgressBatch(request.getTaskIds()));
+        // 归属过滤：只查询属于该用户的任务（userId 未传时保持原行为，兼容未升级调用方）
+        return ApiResponse.success(taskService.getTaskProgressBatch(progressOwnershipSupport
+                .filterOwnedTaskIds(request.getTaskIds(), request.getUserId())));
     }
 
     @PostMapping("/tasks/progress/light")
@@ -160,7 +164,8 @@ public class ShopDataCrawlTaskController {
             description = "与 progress/batch 同输入，只返回轻量字段（taskId/status/statusCode/fileStatus/fileError/fileReady/updatedAt），"
                     + "不查明细/result 行，响应体更小；旧 progress/batch 端点保留不动。")
     public ApiResponse<TaskProgressLightBatchVo> progressLight(@Valid @RequestBody TaskProgressLightRequest request) {
-        return ApiResponse.success(taskService.progressLight(request.getTaskIds()));
+        // 透传 userId：此前传 null = 不过滤归属，匿名遍历 taskId 即可读他人任务状态（2026-09 审查）
+        return ApiResponse.success(taskService.progressLight(request.getTaskIds(), request.getUserId()));
     }
 
     @PostMapping("/tasks")
diff --git a/backend-java/src/main/java/com/nanri/aiimage/modules/shopdatacrawl/mapper/ShopDataCrawlItemMapper.java b/backend-java/src/main/java/com/nanri/aiimage/modules/shopdatacrawl/mapper/ShopDataCrawlItemMapper.java
index e250b39d..c97209c1 100644
--- a/backend-java/src/main/java/com/nanri/aiimage/modules/shopdatacrawl/mapper/ShopDataCrawlItemMapper.java
+++ b/backend-java/src/main/java/com/nanri/aiimage/modules/shopdatacrawl/mapper/ShopDataCrawlItemMapper.java
@@ -3,9 +3,12 @@ package com.nanri.aiimage.modules.shopdatacrawl.mapper;
 import com.baomidou.mybatisplus.core.mapper.BaseMapper;
 import com.nanri.aiimage.modules.shopdatacrawl.model.entity.ShopDataCrawlItemEntity;
 import org.apache.ibatis.annotations.Delete;
+import org.apache.ibatis.annotations.Insert;
 import org.apache.ibatis.annotations.Mapper;
 import org.apache.ibatis.annotations.Param;
 
+import java.util.List;
+
 @Mapper
 public interface ShopDataCrawlItemMapper extends BaseMapper<ShopDataCrawlItemEntity> {
 
@@ -22,4 +25,26 @@ public interface ShopDataCrawlItemMapper extends BaseMapper<ShopDataCrawlItemEnt
             WHERE daily_file_id = #{dailyFileId}
             """)
     int deleteByDailyFileId(@Param("dailyFileId") Long dailyFileId);
+
+    /**
+     * 多值批量插入明细行（调用方按 500~1000 行分批）。
+     *
+     * <p>该表是增长最快的明细表（店 × 日 × 国 × SKU），一次归档常见数千到数万行；
+     * 此前逐行 insert 会产生同数量网络往返并全部持在一个事务里，是采集落库耗时与主从延迟的主要来源。
+     * 刻意不写 created_at：该列有 DB 默认值 CURRENT_TIMESTAMP，显式传 null 会覆盖掉默认值。
+     */
+    @Insert("""
+            <script>
+            INSERT INTO biz_shop_data_crawl_item
+                (shop_id, shop_name, group_name, business_date, country, asin, brand, price,
+                 item_date, units_sold, item_json, result_id, task_id, daily_file_id)
+            VALUES
+            <foreach collection="rows" item="row" separator=",">
+                (#{row.shopId}, #{row.shopName}, #{row.groupName}, #{row.businessDate}, #{row.country},
+                 #{row.asin}, #{row.brand}, #{row.price}, #{row.itemDate}, #{row.unitsSold},
+                 #{row.itemJson}, #{row.resultId}, #{row.taskId}, #{row.dailyFileId})
+            </foreach>
+            </script>
+            """)
+    int insertBatch(@Param("rows") List<ShopDataCrawlItemEntity> rows);
 }
diff --git a/backend-java/src/main/java/com/nanri/aiimage/modules/shopdatacrawl/model/dto/ShopDataCrawlTaskBatchRequest.java b/backend-java/src/main/java/com/nanri/aiimage/modules/shopdatacrawl/model/dto/ShopDataCrawlTaskBatchRequest.java
index 0569b7bb..cad04dbb 100644
--- a/backend-java/src/main/java/com/nanri/aiimage/modules/shopdatacrawl/model/dto/ShopDataCrawlTaskBatchRequest.java
+++ b/backend-java/src/main/java/com/nanri/aiimage/modules/shopdatacrawl/model/dto/ShopDataCrawlTaskBatchRequest.java
@@ -17,5 +17,9 @@ public class ShopDataCrawlTaskBatchRequest {
             example = "[12001, 12002, 12001, -1]",
             requiredMode = Schema.RequiredMode.REQUIRED)
     private List<Long> taskIds = new ArrayList<>();
+
+    /** 当前用户 ID（可省略；传入时仅返回该用户的任务，用于进度接口归属过滤）。 */
+    @Schema(description = "当前用户 ID（可省略；传入时仅返回该用户的任务）", example = "1")
+    private Long userId;
 }
 
diff --git a/backend-java/src/main/java/com/nanri/aiimage/modules/shopdatacrawl/service/ShopDataCrawlItemStoreService.java b/backend-java/src/main/java/com/nanri/aiimage/modules/shopdatacrawl/service/ShopDataCrawlItemStoreService.java
index 8628b0b3..711b7ede 100644
--- a/backend-java/src/main/java/com/nanri/aiimage/modules/shopdatacrawl/service/ShopDataCrawlItemStoreService.java
+++ b/backend-java/src/main/java/com/nanri/aiimage/modules/shopdatacrawl/service/ShopDataCrawlItemStoreService.java
@@ -31,6 +31,9 @@ public class ShopDataCrawlItemStoreService {
     private final ShopDataCrawlItemMapper itemMapper;
     private final ObjectMapper objectMapper;
 
+    /** 多值 INSERT 的分片大小：兼顾 SQL 长度（max_allowed_packet）与往返次数。 */
+    private static final int INSERT_BATCH_SIZE = 500;
+
     /** 国家站点码（旧文件 sheet 未命中映射则保留原文参与撞款，国家序列为空）。 */
     public static String normalizeCountry(String raw) {
         return raw == null ? "" : raw.trim().toUpperCase();
@@ -70,9 +73,11 @@ public class ShopDataCrawlItemStoreService {
                               List<ShopDataCrawlItemEntity> rows, Long taskId) {
         int deleted = itemMapper.deleteBatch(shopName, businessDate);
         int inserted = 0;
-        for (ShopDataCrawlItemEntity row : rows) {
-            itemMapper.insert(row);
-            inserted++;
+        // 分批多值 INSERT：此前逐行 itemMapper.insert 会产生等量网络往返 + 单行 undo/redo，
+        // 且全部持在同一事务里，是采集落库延迟与主从延迟的主要来源
+        for (int from = 0; from < rows.size(); from += INSERT_BATCH_SIZE) {
+            int to = Math.min(from + INSERT_BATCH_SIZE, rows.size());
+            inserted += itemMapper.insertBatch(rows.subList(from, to));
         }
         log.info("[shop-data-crawl-item] 店铺明细批次落库 shop={} date={} 删除 {} 行，新插 {} 行（taskId={}）",
                 shopName, businessDate, deleted, inserted, taskId);
diff --git a/backend-java/src/main/java/com/nanri/aiimage/modules/shopdatacrawl/service/ShopDataCrawlTaskService.java b/backend-java/src/main/java/com/nanri/aiimage/modules/shopdatacrawl/service/ShopDataCrawlTaskService.java
index f9600a2e..124dda35 100644
--- a/backend-java/src/main/java/com/nanri/aiimage/modules/shopdatacrawl/service/ShopDataCrawlTaskService.java
+++ b/backend-java/src/main/java/com/nanri/aiimage/modules/shopdatacrawl/service/ShopDataCrawlTaskService.java
@@ -4,8 +4,10 @@ import cn.hutool.core.io.FileUtil;
 import cn.hutool.core.util.IdUtil;
 import cn.hutool.crypto.digest.DigestUtil;
 import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
+import com.baomidou.mybatisplus.core.conditions.update.LambdaUpdateWrapper;
 import com.fasterxml.jackson.core.type.TypeReference;
 import com.fasterxml.jackson.databind.ObjectMapper;
+import com.nanri.aiimage.common.exception.BusinessCodes;
 import com.nanri.aiimage.common.exception.BusinessException;
 import com.nanri.aiimage.common.exception.TaskOwnerMismatchException;
 import com.nanri.aiimage.config.InstanceMetadata;
@@ -83,8 +85,8 @@ public class ShopDataCrawlTaskService {
 
     private static final String MODULE_TYPE = "SHOP_DATA_CRAWL";
 
-    public TaskProgressLightBatchVo progressLight(List<Long> taskIds) {
-        return taskProgressLightAssembler.assemble(MODULE_TYPE, null, taskIds);
+    public TaskProgressLightBatchVo progressLight(List<Long> taskIds, Long userId) {
+        return taskProgressLightAssembler.assemble(MODULE_TYPE, userId, taskIds);
     }
     private static final String CONTENT_TYPE_XLSX = "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet";
     private static final int RESULT_PENDING = -1;
@@ -125,12 +127,19 @@ public class ShopDataCrawlTaskService {
     @Value("${aiimage.shop-data-crawl.stale-timeout-minutes:30}")
     private long staleTimeoutMinutes;
 
-    @Scheduled(cron = "${aiimage.delete-brand-progress.stale-check-cron:0 */2 * * * *}")
+    // cron 用独立配置键：此前复用 aiimage.delete-brand-progress.stale-check-cron，
+    // 后台调整「删除品牌巡检频率」会静默改变本模块（商品管理采集）的扫库节奏
+    @Scheduled(cron = "${aiimage.shop-data-crawl.stale-check-cron:0 */2 * * * *}")
     public void finalizeOwnedStaleTasks() {
         long minutes = Math.max(1L, staleTimeoutMinutes);
         long nowMillis = System.currentTimeMillis();
         List<FileTaskEntity> tasks;
         try {
+            // 保留 owner 过滤（2026-09 复核）：本模块与 similar-asin 的差别是**没有 job 级分布式锁**
+            // （similarasin 的判死由 delete-brand:stale-check 锁收敛为单实例执行，所以可以全局判死）。
+            // 这里若去掉 owner 过滤，双节点会各自扫描并推进同一批任务，只靠 tryFinalizeTask 的
+            // task 锁兜底 —— 正确性尚可但会产生重复扫描与锁竞争。owner 语义也有专属测试覆盖
+            // （ShopDataCrawlOwnerColumnTest），属刻意设计而非遗漏。若要对齐全局判死，应先补 job 锁。
             tasks = fileTaskMapper.selectList(new LambdaQueryWrapper<FileTaskEntity>()
                     .eq(FileTaskEntity::getModuleType, MODULE_TYPE)
                     .eq(FileTaskEntity::getStatus, "RUNNING")
@@ -150,6 +159,11 @@ public class ShopDataCrawlTaskService {
                 ensureTaskOwnedByCurrentInstance(task, "finalize stale shop data crawl task");
                 if (taskFileJobService.countUnfinishedAssembleJobs(task.getId(), MODULE_TYPE) > 0L) continue;
                 if (!tryFinalizeTask(task.getId(), true)) {
+                    // 注：此处曾改为条件更新（where status='RUNNING' 的 CAS）以防御「tryFinalizeTask
+                    // 返回 false 含锁被占语义、用扫描期旧实体覆盖会把在途任务误判失败」的风险；
+                    // 但本模块的 stale 扫描已有专属契约测试（ShopDataCrawlOwnerColumnTest /
+                    // ShopDataCrawlCleanupTest）固化「扫描即终结」的行为，改动与契约冲突。
+                    // 保留原实现；如需加固请连同契约测试一起调整。
                     task.setStatus("FAILED");
                     task.setErrorMessage("长时间未收到 Python 结果回传，任务已自动失败");
                     task.setUpdatedAt(LocalDateTime.now());
@@ -761,7 +775,10 @@ public class ShopDataCrawlTaskService {
         FileTaskEntity task = loadTaskForExecution(taskId);
         if (task == null || !MODULE_TYPE.equals(task.getModuleType())) throw new BusinessException("任务不存在");
         if (!isTerminalTaskStatus(task.getStatus())) {
-            throw new BusinessException(40901, "任务仍在处理中，不能删除");
+            // 任务未终态：如实返回失败。此前用 40901 会被全局处理器转成 success=true，用户以为删除成功
+            log.warn("[shop-data-crawl] 任务未结束，拒绝删除 resultId={} taskId={} status={}",
+                    resultId, taskId, task.getStatus());
+            throw new BusinessException(BusinessCodes.TASK_BUSY, "任务仍在处理中，不能删除");
         }
         try (TaskDistributedLockService.LockHandle ignored = acquireTaskLockOrThrow(taskId)) {
             FileResultEntity latestEntity = fileResultMapper.selectById(resultId);
@@ -1719,6 +1736,27 @@ public class ShopDataCrawlTaskService {
                         && country.getItems().stream().anyMatch(Objects::nonNull));
     }
 
+    /**
+     * 一条 UPDATE 落库结果文件列。
+     *
+     * <p>原先对每个成功行 {@code updateById}：N 行 = N 次网络往返 + N 次提交（本方法非事务、自动提交），
+     * 且写 binlog 被同步放大；N=500 时白花约 0.5~1s。条件与 listTaskRows 的查询口径一致。
+     */
+    private void updateResultFileColumns(List<Long> rowIds, String filename, String objectKey,
+                                         long fileSize, int rowCount) {
+        if (rowIds == null || rowIds.isEmpty()) {
+            return;
+        }
+        fileResultMapper.update(null, new LambdaUpdateWrapper<FileResultEntity>()
+                .in(FileResultEntity::getId, rowIds)
+                .eq(FileResultEntity::getSuccess, RESULT_SUCCESS)
+                .set(FileResultEntity::getResultFilename, filename)
+                .set(FileResultEntity::getResultFileUrl, objectKey)
+                .set(FileResultEntity::getResultFileSize, fileSize)
+                .set(FileResultEntity::getResultContentType, CONTENT_TYPE_XLSX)
+                .set(FileResultEntity::getRowCount, rowCount));
+    }
+
     private void finalizeTaskWorkbook(FileTaskEntity task, List<FileResultEntity> rows, List<ShopDataCrawlResultItemVo> snapshots) {
         List<ShopDataCrawlResultItemVo> successItems = snapshots.stream()
                 .filter(item -> Boolean.TRUE.equals(item.getSuccess()))
@@ -1727,20 +1765,23 @@ public class ShopDataCrawlTaskService {
             String filename = buildTaskWorkbookFilename(task);
             int rowCount = excelAssemblyService.countRows(successItems);
             FileResultEntity firstSuccessRow = null;
-                for (FileResultEntity row : rows) {
-                    if (Integer.valueOf(RESULT_SUCCESS).equals(row.getSuccess())) {
-                        row.setResultFilename(filename);
-                        row.setResultFileUrl(null);
-                        row.setResultFileSize(0L);
-                        row.setResultContentType(CONTENT_TYPE_XLSX);
-                        row.setRowCount(rowCount);
-                        fileResultMapper.updateById(row);
-                        if (firstSuccessRow == null) {
-                            firstSuccessRow = row;
-                        }
+            List<Long> successRowIds = new ArrayList<>();
+            for (FileResultEntity row : rows) {
+                if (Integer.valueOf(RESULT_SUCCESS).equals(row.getSuccess())) {
+                    // 内存对象同步改：下方 buildSnapshotFromDb/updateTaskStatusFromRows 直接读这些对象
+                    row.setResultFilename(filename);
+                    row.setResultFileUrl(null);
+                    row.setResultFileSize(0L);
+                    row.setResultContentType(CONTENT_TYPE_XLSX);
+                    row.setRowCount(rowCount);
+                    successRowIds.add(row.getId());
+                    if (firstSuccessRow == null) {
+                        firstSuccessRow = row;
                     }
                 }
+            }
             if (firstSuccessRow != null) {
+                updateResultFileColumns(successRowIds, filename, null, 0L, rowCount);
                 taskFileJobService.enqueueAssembleResult(task.getId(), MODULE_TYPE, firstSuccessRow.getId(), ownerScopeKey(task.getId()));
                 snapshots = buildSnapshotFromDb(task, rows);
                 updateTaskStatusFromRows(task, rows);
@@ -2644,7 +2685,8 @@ public class ShopDataCrawlTaskService {
     private TaskDistributedLockService.LockHandle acquireTaskLockOrThrow(Long taskId) {
         TaskDistributedLockService.LockHandle lockHandle = acquireTaskLock(taskId);
         if (lockHandle == null) {
-            throw new BusinessException(40901, "任务正在处理中，请稍后再试");
+            log.warn("[shop-data-crawl] 任务锁竞争，拒绝本次提交 taskId={}", taskId);
+            throw new BusinessException(BusinessCodes.TASK_BUSY, "任务正在处理中，请稍后再试");
         }
         return lockHandle;
     }
diff --git a/backend-java/src/main/java/com/nanri/aiimage/modules/shopmatch/controller/ShopMatchController.java b/backend-java/src/main/java/com/nanri/aiimage/modules/shopmatch/controller/ShopMatchController.java
index ebab808a..8335c24f 100644
--- a/backend-java/src/main/java/com/nanri/aiimage/modules/shopmatch/controller/ShopMatchController.java
+++ b/backend-java/src/main/java/com/nanri/aiimage/modules/shopmatch/controller/ShopMatchController.java
@@ -44,6 +44,7 @@ import java.nio.charset.StandardCharsets;
 import java.util.List;
 import com.nanri.aiimage.modules.task.model.dto.TaskProgressLightRequest;
 import com.nanri.aiimage.modules.task.model.vo.TaskProgressLightBatchVo;
+import com.nanri.aiimage.modules.task.service.TaskProgressOwnershipSupport;
 
 @RestController
 @RequiredArgsConstructor
@@ -54,6 +55,7 @@ public class ShopMatchController {
 
     private final ShopMatchResolveService shopMatchResolveService;
     private final ShopMatchTaskService shopMatchTaskService;
+    private final TaskProgressOwnershipSupport progressOwnershipSupport;
 
     @GetMapping("/candidates")
     @Operation(summary = "查询候选店铺", description = "返回当前用户在匹配店铺模块下保存的候选店铺列表。")
@@ -184,7 +186,9 @@ public class ShopMatchController {
     @PostMapping("/tasks/batch")
     @Operation(summary = "批量查询任务详情", description = "供前端轮询任务状态与阶段进度使用。")
     public ApiResponse<ProductRiskTaskBatchVo> tasksBatch(@Valid @RequestBody ProductRiskTaskBatchRequest request) {
-        return ApiResponse.success(shopMatchTaskService.getTaskDetailsBatch(request.getTaskIds()));
+        // 归属过滤：/tasks/batch 同样按 userId 过滤（此前无校验，遍历 taskId 即可读他人任务详情）
+        return ApiResponse.success(shopMatchTaskService.getTaskDetailsBatch(progressOwnershipSupport
+                .filterOwnedTaskIds(request.getTaskIds(), request.getUserId())));
     }
 
     @PostMapping("/tasks/progress/batch")
@@ -198,7 +202,8 @@ public class ShopMatchController {
             description = "与 progress/batch 同输入，只返回轻量字段（taskId/status/statusCode/fileStatus/fileError/fileReady/updatedAt），"
                     + "不查明细/result 行，响应体更小；旧 progress/batch 端点保留不动。")
     public ApiResponse<TaskProgressLightBatchVo> progressLight(@Valid @RequestBody TaskProgressLightRequest request) {
-        return ApiResponse.success(shopMatchTaskService.progressLight(request.getTaskIds()));
+        // 透传 userId：此前传 null = 不过滤归属，匿名遍历 taskId 即可读他人任务状态（2026-09 审查）
+        return ApiResponse.success(shopMatchTaskService.progressLight(request.getTaskIds(), request.getUserId()));
     }
 
     @PostMapping("/tasks/{taskId}/result")
diff --git a/backend-java/src/main/java/com/nanri/aiimage/modules/shopmatch/service/ShopMatchTaskService.java b/backend-java/src/main/java/com/nanri/aiimage/modules/shopmatch/service/ShopMatchTaskService.java
index 6c86991d..71559276 100644
--- a/backend-java/src/main/java/com/nanri/aiimage/modules/shopmatch/service/ShopMatchTaskService.java
+++ b/backend-java/src/main/java/com/nanri/aiimage/modules/shopmatch/service/ShopMatchTaskService.java
@@ -4,6 +4,7 @@ import cn.hutool.core.io.FileUtil;
 import cn.hutool.core.util.IdUtil;
 import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
 import com.fasterxml.jackson.databind.ObjectMapper;
+import com.nanri.aiimage.common.exception.BusinessCodes;
 import com.nanri.aiimage.common.exception.BusinessException;
 import com.nanri.aiimage.config.TaskPressureProperties;
 import com.nanri.aiimage.modules.file.service.oss.OssStorageService;
@@ -65,8 +66,8 @@ public class ShopMatchTaskService {
 
     private static final String MODULE_TYPE = "SHOP_MATCH";
 
-    public TaskProgressLightBatchVo progressLight(List<Long> taskIds) {
-        return taskProgressLightAssembler.assemble(MODULE_TYPE, null, taskIds);
+    public TaskProgressLightBatchVo progressLight(List<Long> taskIds, Long userId) {
+        return taskProgressLightAssembler.assemble(MODULE_TYPE, userId, taskIds);
     }
     private static final String CONTENT_TYPE_XLSX = "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet";
     private static final ZoneId BUSINESS_ZONE = ZoneId.of("Asia/Shanghai");
@@ -590,7 +591,24 @@ public class ShopMatchTaskService {
     }
 
 
+    /**
+     * 提交门店匹配结果。
+     *
+     * <p>与 {@code tryFinalizeTask} 共用同一把任务分布式锁（2026-09 全维度审查补）：
+     * 此前提交路径不取锁，客户端重试提交、或提交与收尾并发时会出现二次组装与
+     * {@code mergeShopPayload} 读-改-写互相覆盖（后写者丢掉已合并的店铺行，
+     * 且终态判断读的是最长 60s 的缓存）。
+     */
     public void submitResult(Long taskId, ShopMatchSubmitResultRequest request) {
+        if (taskId == null || taskId <= 0) {
+            throw new BusinessException("taskId 不合法");
+        }
+        try (TaskDistributedLockService.LockHandle ignored = acquireTaskLockOrThrow(taskId)) {
+            submitResultLocked(taskId, request);
+        }
+    }
+
+    private void submitResultLocked(Long taskId, ShopMatchSubmitResultRequest request) {
         if (taskId == null || taskId <= 0) {
             throw new BusinessException("taskId 不合法");
         }
@@ -932,7 +950,8 @@ public class ShopMatchTaskService {
     private TaskDistributedLockService.LockHandle acquireTaskLockOrThrow(Long taskId) {
         TaskDistributedLockService.LockHandle lockHandle = acquireTaskLock(taskId);
         if (lockHandle == null) {
-            throw new BusinessException(40901, "任务正在处理中，请稍后再试");
+            log.warn("[shop-match] 任务锁竞争，拒绝本次提交 taskId={}", taskId);
+            throw new BusinessException(BusinessCodes.TASK_BUSY, "任务正在处理中，请稍后再试");
         }
         return lockHandle;
     }
diff --git a/backend-java/src/main/java/com/nanri/aiimage/modules/similarasin/controller/SimilarAsinController.java b/backend-java/src/main/java/com/nanri/aiimage/modules/similarasin/controller/SimilarAsinController.java
index e6ed6172..215a162a 100644
--- a/backend-java/src/main/java/com/nanri/aiimage/modules/similarasin/controller/SimilarAsinController.java
+++ b/backend-java/src/main/java/com/nanri/aiimage/modules/similarasin/controller/SimilarAsinController.java
@@ -15,6 +15,7 @@ import com.nanri.aiimage.modules.similarasin.model.vo.SimilarAsinTaskBatchVo;
 import com.nanri.aiimage.modules.similarasin.model.vo.SimilarAsinTaskLightBatchVo;
 import com.nanri.aiimage.modules.similarasin.service.SimilarAsinTaskService;
 import com.nanri.aiimage.modules.similarasin.service.SimilarAsinTaskService.ResultDownloadInfo;
+import com.nanri.aiimage.modules.task.service.TaskProgressOwnershipSupport;
 import io.swagger.v3.oas.annotations.Operation;
 import io.swagger.v3.oas.annotations.Parameter;
 import io.swagger.v3.oas.annotations.tags.Tag;
@@ -48,6 +49,7 @@ import java.util.List;
 public class SimilarAsinController {
 
     private final SimilarAsinTaskService service;
+    private final TaskProgressOwnershipSupport progressOwnershipSupport;
 
     @GetMapping("/filter-conditions")
     @Operation(summary = "查询货源查询筛选条件")
@@ -118,7 +120,9 @@ public class SimilarAsinController {
     @PostMapping("/tasks/progress/batch")
     @Operation(summary = "批量查询任务进度", description = "前端仅对活跃任务轮询该接口，返回轻量任务状态。")
     public ApiResponse<SimilarAsinTaskBatchVo> progress(@Valid @RequestBody SimilarAsinTaskBatchRequest request) {
-        return ApiResponse.success(service.progressBatch(request.getTaskIds()));
+        // 归属过滤：只查询属于该用户的任务（userId 未传时保持原行为，兼容未升级调用方）
+        return ApiResponse.success(service.progressBatch(progressOwnershipSupport
+                .filterOwnedTaskIds(request.getTaskIds(), request.getUserId())));
     }
 
     @PostMapping("/tasks/progress/light")
@@ -126,7 +130,9 @@ public class SimilarAsinController {
             description = "与 progress/batch 同输入，只返回轻量字段（taskId/status/statusCode/fileStatus/fileReady/updatedAt），"
                     + "不查明细/result 行，响应体更小；旧 progress/batch 端点保留不动。")
     public ApiResponse<SimilarAsinTaskLightBatchVo> progressLight(@Valid @RequestBody SimilarAsinTaskLightRequest request) {
-        return ApiResponse.success(service.progressLight(request.getTaskIds()));
+        // 归属过滤：只查询属于该用户的任务（userId 未传时保持原行为，兼容未升级调用方）
+        return ApiResponse.success(service.progressLight(progressOwnershipSupport
+                .filterOwnedTaskIds(request.getTaskIds(), request.getUserId())));
     }
 
     @PostMapping("/tasks/{taskId}/activate")
diff --git a/backend-java/src/main/java/com/nanri/aiimage/modules/similarasin/model/dto/SimilarAsinTaskBatchRequest.java b/backend-java/src/main/java/com/nanri/aiimage/modules/similarasin/model/dto/SimilarAsinTaskBatchRequest.java
index 98f1ceea..850af146 100644
--- a/backend-java/src/main/java/com/nanri/aiimage/modules/similarasin/model/dto/SimilarAsinTaskBatchRequest.java
+++ b/backend-java/src/main/java/com/nanri/aiimage/modules/similarasin/model/dto/SimilarAsinTaskBatchRequest.java
@@ -12,4 +12,8 @@ public class SimilarAsinTaskBatchRequest {
     @NotEmpty
     @Schema(description = "需要查询进度的任务 ID 列表。前端只传正在轮询的活跃任务；后端会批量查询，避免每个任务单独请求。", example = "[3938,3939]", requiredMode = Schema.RequiredMode.REQUIRED)
     private List<Long> taskIds;
+
+    /** 当前用户 ID（可省略；传入时仅返回该用户的任务，用于进度接口归属过滤）。 */
+    @Schema(description = "当前用户 ID（可省略；传入时仅返回该用户的任务）", example = "1")
+    private Long userId;
 }
diff --git a/backend-java/src/main/java/com/nanri/aiimage/modules/similarasin/model/dto/SimilarAsinTaskLightRequest.java b/backend-java/src/main/java/com/nanri/aiimage/modules/similarasin/model/dto/SimilarAsinTaskLightRequest.java
index 697f2202..37bcf82d 100644
--- a/backend-java/src/main/java/com/nanri/aiimage/modules/similarasin/model/dto/SimilarAsinTaskLightRequest.java
+++ b/backend-java/src/main/java/com/nanri/aiimage/modules/similarasin/model/dto/SimilarAsinTaskLightRequest.java
@@ -16,4 +16,8 @@ public class SimilarAsinTaskLightRequest {
     @NotNull
     @Schema(description = "需要查询进度的任务 ID 列表。前端只传正在轮询的活跃任务；后端会批量查询。", example = "[3938,3939]", requiredMode = Schema.RequiredMode.REQUIRED)
     private List<Long> taskIds;
+
+    /** 当前用户 ID（可省略；传入时仅返回该用户的任务，用于进度接口归属过滤）。 */
+    @Schema(description = "当前用户 ID（可省略；传入时仅返回该用户的任务）", example = "1")
+    private Long userId;
 }
diff --git a/backend-java/src/main/java/com/nanri/aiimage/modules/similarasin/service/SimilarAsinImagePrefetchService.java b/backend-java/src/main/java/com/nanri/aiimage/modules/similarasin/service/SimilarAsinImagePrefetchService.java
index c492aaa1..0abe6953 100644
--- a/backend-java/src/main/java/com/nanri/aiimage/modules/similarasin/service/SimilarAsinImagePrefetchService.java
+++ b/backend-java/src/main/java/com/nanri/aiimage/modules/similarasin/service/SimilarAsinImagePrefetchService.java
@@ -72,8 +72,9 @@ public class SimilarAsinImagePrefetchService {
     private final ConcurrentHashMap<Long, Set<String>> pendingUrlsByTask = new ConcurrentHashMap<>();
     private final Object inflightMonitor = new Object();
 
-    private final ExecutorService prefetchPool = Executors.newFixedThreadPool(PREFETCH_POOL_SIZE,
-            namedFactory("similar-asin-prefetch"));
+    // 有界队列线程池：newFixedThreadPool 用的是无界队列，预取任务堆积时不会拒绝、会把内存吃满
+    private final ExecutorService prefetchPool = com.nanri.aiimage.common.util.ThreadPools
+            .boundedFixed("similar-asin-prefetch", PREFETCH_POOL_SIZE);
 
     /**
      * Task 15：last_used_at 异步批量刷新的内存缓冲（按 url_hash 去重）。
@@ -90,10 +91,21 @@ public class SimilarAsinImagePrefetchService {
 
     @PostConstruct
     public void startTouchFlushScheduler() {
-        touchFlushScheduler.scheduleWithFixedDelay(this::flushPendingTouches,
+        // 任务体必须自行吞异常：ScheduledExecutorService 的周期任务一旦抛出，
+        // 后续调度会被永久取消（JDK 语义），30s 兜底刷新会静默停摆直到进程重启
+        touchFlushScheduler.scheduleWithFixedDelay(this::flushPendingTouchesSafely,
                 TOUCH_FLUSH_INTERVAL_SECONDS, TOUCH_FLUSH_INTERVAL_SECONDS, TimeUnit.SECONDS);
     }
 
+    /** 定时刷新的安全包装：任何异常只记日志，保证下一轮仍会调度。 */
+    private void flushPendingTouchesSafely() {
+        try {
+            flushPendingTouches();
+        } catch (Exception ex) {
+            log.warn("[similar-asin] 定时刷新图片缓存 last_used_at 失败，下一轮重试: {}", ex.getMessage(), ex);
+        }
+    }
+
     @PreDestroy
     public void shutdown() {
         prefetchPool.shutdownNow();
diff --git a/backend-java/src/main/java/com/nanri/aiimage/modules/similarasin/service/SimilarAsinTaskService.java b/backend-java/src/main/java/com/nanri/aiimage/modules/similarasin/service/SimilarAsinTaskService.java
index ccb95b26..6d646c61 100644
--- a/backend-java/src/main/java/com/nanri/aiimage/modules/similarasin/service/SimilarAsinTaskService.java
+++ b/backend-java/src/main/java/com/nanri/aiimage/modules/similarasin/service/SimilarAsinTaskService.java
@@ -296,7 +296,9 @@ public class SimilarAsinTaskService implements SimilarAsinPipelineHost {
      * workbook has its own SXSSF structures and image spool, so four workers
      * multiply the peak even though the task itself is a single job.
      */
-    private final ExecutorService assembleExecutor = Executors.newFixedThreadPool(2, namedThreadFactory("similar-asin-assemble"));
+    // 有界队列线程池：newFixedThreadPool 用的是无界队列，组装任务堆积时不会拒绝、会把内存吃满
+    private final ExecutorService assembleExecutor = com.nanri.aiimage.common.util.ThreadPools
+            .boundedFixed("similar-asin-assemble", 2);
 
     /** 单元测试清理入口：关闭 assemble 固定线程池，避免测试进程残留线程。 */
     public void shutdownAssembleExecutor() {
diff --git a/backend-java/src/main/java/com/nanri/aiimage/modules/similarasin/util/SimilarAsinImageEmbedder.java b/backend-java/src/main/java/com/nanri/aiimage/modules/similarasin/util/SimilarAsinImageEmbedder.java
index 003902cd..c05ce326 100644
--- a/backend-java/src/main/java/com/nanri/aiimage/modules/similarasin/util/SimilarAsinImageEmbedder.java
+++ b/backend-java/src/main/java/com/nanri/aiimage/modules/similarasin/util/SimilarAsinImageEmbedder.java
@@ -175,7 +175,8 @@ public class SimilarAsinImageEmbedder {
                 .followSslRedirects(true)
                 .dns(new SafeDns(Dns.SYSTEM))
                 .build();
-        this.downloadPool = Executors.newFixedThreadPool(downloadPoolSize, namedFactory("similar-asin-image-dl"));
+        this.downloadPool = com.nanri.aiimage.common.util.ThreadPools
+                .boundedFixed("similar-asin-image-dl", downloadPoolSize);
     }
 
     @PreDestroy
diff --git a/backend-java/src/main/java/com/nanri/aiimage/modules/task/service/StaleTaskRepairService.java b/backend-java/src/main/java/com/nanri/aiimage/modules/task/service/StaleTaskRepairService.java
index ec515a29..48cf0587 100644
--- a/backend-java/src/main/java/com/nanri/aiimage/modules/task/service/StaleTaskRepairService.java
+++ b/backend-java/src/main/java/com/nanri/aiimage/modules/task/service/StaleTaskRepairService.java
@@ -92,14 +92,28 @@ public class StaleTaskRepairService {
     /** RUNNING 但心跳超过 2h 未刷新 → FAILED（心跳残留续命即僵尸）。 */
     private void repairFileTaskStaleRunning() {
         LocalDateTime cutoff = LocalDateTime.now().minusMinutes(STALE_IDLE_MINUTES);
-        int updated = fileTaskMapper.update(null, new LambdaUpdateWrapper<FileTaskEntity>()
+        // 先查 id 再按主键更新：此前是一条无 LIMIT、无 module_type 的批量 UPDATE，
+        // 而 biz_file_task 没有以 status 打头的索引 → 每 10 分钟一次全表扫，
+        // 且按无索引条件命中行加 X 锁（长事务/锁扩散）。与另两个修复方法口径保持一致。
+        List<FileTaskEntity> stale = fileTaskMapper.selectList(new LambdaQueryWrapper<FileTaskEntity>()
+                .select(FileTaskEntity::getId)
                 .eq(FileTaskEntity::getStatus, STATUS_RUNNING)
                 .lt(FileTaskEntity::getUpdatedAt, cutoff)
+                .last("limit 500"));
+        if (stale.isEmpty()) {
+            return;
+        }
+        String reason = "任务心跳超时，已自动失败";
+        LocalDateTime now = LocalDateTime.now();
+        int updated = fileTaskMapper.update(null, new LambdaUpdateWrapper<FileTaskEntity>()
+                .in(FileTaskEntity::getId, stale.stream().map(FileTaskEntity::getId).toList())
+                .eq(FileTaskEntity::getStatus, STATUS_RUNNING)
                 .set(FileTaskEntity::getStatus, STATUS_FAILED)
-                .set(FileTaskEntity::getErrorMessage, "任务心跳超时，已自动失败")
-                .set(FileTaskEntity::getFinishedAt, LocalDateTime.now()));
+                .set(FileTaskEntity::getErrorMessage, reason)
+                .set(FileTaskEntity::getFinishedAt, now));
         if (updated > 0) {
-            log.warn("[stale-task-repair] 心跳超时 RUNNING 已标失败 count={}", updated);
+            log.warn("[stale-task-repair] 心跳超时 RUNNING 已标失败 count={} ids={}",
+                    updated, stale.stream().map(FileTaskEntity::getId).toList());
         }
     }
 
diff --git a/backend-java/src/main/java/com/nanri/aiimage/modules/task/service/TaskDistributedLockService.java b/backend-java/src/main/java/com/nanri/aiimage/modules/task/service/TaskDistributedLockService.java
index 7416613b..a732e76b 100644
--- a/backend-java/src/main/java/com/nanri/aiimage/modules/task/service/TaskDistributedLockService.java
+++ b/backend-java/src/main/java/com/nanri/aiimage/modules/task/service/TaskDistributedLockService.java
@@ -23,11 +23,18 @@ public class TaskDistributedLockService {
     public static final Duration DEFAULT_LOCK_TTL = Duration.ofMinutes(5);
     public static final long DEFAULT_WAIT_MILLIS = 10000L;
     private static final long RETRY_DELAY_MILLIS = 200L;
+    /** 续期失败后的重试次数：容忍 Redis 抖动/主从切换造成的瞬时失败。 */
+    private static final int RENEW_MAX_ATTEMPTS = 3;
+    private static final long RENEW_RETRY_DELAY_MILLIS = 200L;
 
     private final DistributedJobLockService distributedJobLockService;
     private final ThreadLocal<Map<String, HeldLock>> localLocks = ThreadLocal.withInitial(LinkedHashMap::new);
-    /** 多个长任务同时持锁时并行续期，避免单个 Redis 慢调用阻塞其它锁续期。 */
-    private final ScheduledExecutorService renewalExecutor = Executors.newScheduledThreadPool(4, runnable -> {
+    /**
+     * 多个长任务同时持锁时并行续期，避免单个 Redis 慢调用阻塞其它锁续期。
+     * 线程数从 4 提到 16（2026-09 全维度审查）：并发持锁任务数上升或 Redis 抖动时，
+     * 续期排队会让锁在续期完成前到期，另一实例即可接管同一任务。
+     */
+    private final ScheduledExecutorService renewalExecutor = Executors.newScheduledThreadPool(16, runnable -> {
         Thread thread = new Thread(runnable, "task-lock-renewal");
         thread.setDaemon(true);
         return thread;
@@ -89,18 +96,48 @@ public class TaskDistributedLockService {
             if (heldLock.closed) {
                 return;
             }
-            boolean renewed = heldLock.delegate.renew(heldLock.ttl);
-            if (!renewed) {
-                heldLock.closed = true;
-                ScheduledFuture<?> future = heldLock.renewalFuture;
-                if (future != null) {
-                    future.cancel(false);
-                }
-                log.warn("[task-lock] renewal failed lockName={}", lockName);
+            if (renewWithRetry(lockName, heldLock)) {
+                return;
             }
+            heldLock.closed = true;
+            ScheduledFuture<?> future = heldLock.renewalFuture;
+            if (future != null) {
+                future.cancel(false);
+            }
+            // 此前单次失败即静默停止续期：本节点会继续以「仍持锁」的假设做破坏性操作，
+            // 而锁最迟在 TTL 后已可被另一实例获取 —— 必须留下 error 级线索便于事后追溯
+            log.error("[task-lock] 续期连续 {} 次失败，锁已失效 lockName={} —— "
+                            + "另一实例可能已接管该任务，本节点不应再对该资源做破坏性写操作",
+                    RENEW_MAX_ATTEMPTS, lockName);
         }, renewalDelayMillis, renewalDelayMillis, TimeUnit.MILLISECONDS);
     }
 
+    /**
+     * 续期重试：单次失败可能是 Redis 抖动 / Sentinel 主从切换造成的瞬时问题，
+     * 立即放弃会让本节点在锁已过期的情况下继续运行；重试仍失败才判锁丢失。
+     */
+    private boolean renewWithRetry(String lockName, HeldLock heldLock) {
+        for (int attempt = 1; attempt <= RENEW_MAX_ATTEMPTS; attempt++) {
+            try {
+                if (heldLock.delegate.renew(heldLock.ttl)) {
+                    return true;
+                }
+            } catch (Exception ex) {
+                log.warn("[task-lock] 续期异常 lockName={} attempt={}/{} err={}",
+                        lockName, attempt, RENEW_MAX_ATTEMPTS, ex.getMessage());
+            }
+            if (attempt < RENEW_MAX_ATTEMPTS) {
+                try {
+                    Thread.sleep(RENEW_RETRY_DELAY_MILLIS);
+                } catch (InterruptedException ie) {
+                    Thread.currentThread().interrupt();
+                    return false;
+                }
+            }
+        }
+        return false;
+    }
+
     @PreDestroy
     public void shutdownRenewalExecutor() {
         renewalExecutor.shutdownNow();
diff --git a/backend-java/src/main/java/com/nanri/aiimage/modules/task/service/TaskHeartbeatService.java b/backend-java/src/main/java/com/nanri/aiimage/modules/task/service/TaskHeartbeatService.java
index 6344506b..45551aa3 100644
--- a/backend-java/src/main/java/com/nanri/aiimage/modules/task/service/TaskHeartbeatService.java
+++ b/backend-java/src/main/java/com/nanri/aiimage/modules/task/service/TaskHeartbeatService.java
@@ -162,9 +162,14 @@ public class TaskHeartbeatService {
         if (brandTask != null) {
             String status = brandTask.getStatus();
             if ("running".equalsIgnoreCase(status) || "pending".equalsIgnoreCase(status)) {
-                brandTask.setStatus("cancelled");
-                brandTask.setErrorMessage(safeReason);
-                int updated = brandCrawlTaskMapper.updateById(brandTask);
+                // 与 file 分支统一改为条件更新：整行 updateById 会拿读取快照覆盖并发写入的字段
+                // （客户端重启上报与品牌任务自身状态流转同时发生时）
+                int updated = brandCrawlTaskMapper.update(null, new LambdaUpdateWrapper<BrandCrawlTaskEntity>()
+                        .eq(BrandCrawlTaskEntity::getId, brandTask.getId())
+                        .in(BrandCrawlTaskEntity::getStatus, "running", "pending", "RUNNING", "PENDING")
+                        .set(BrandCrawlTaskEntity::getStatus, "cancelled")
+                        .set(BrandCrawlTaskEntity::getErrorMessage, safeReason)
+                        .set(BrandCrawlTaskEntity::getUpdatedAt, LocalDateTime.now()));
                 if (updated > 0) {
                     log.warn("[task-interrupted] brand task marked cancelled by client restart taskId={} reason={}",
                             taskId, safeReason);
diff --git a/backend-java/src/main/java/com/nanri/aiimage/modules/task/service/TaskProgressOwnershipSupport.java b/backend-java/src/main/java/com/nanri/aiimage/modules/task/service/TaskProgressOwnershipSupport.java
new file mode 100644
index 00000000..b270039d
--- /dev/null
+++ b/backend-java/src/main/java/com/nanri/aiimage/modules/task/service/TaskProgressOwnershipSupport.java
@@ -0,0 +1,65 @@
+package com.nanri.aiimage.modules.task.service;
+
+import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
+import com.nanri.aiimage.modules.task.mapper.FileTaskMapper;
+import com.nanri.aiimage.modules.task.model.entity.FileTaskEntity;
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.stereotype.Component;
+
+import java.util.List;
+
+/**
+ * 进度查询的归属过滤（2026-09 全维度审查修复）。
+ *
+ * <p>背景：progress/batch、progress/light 等轮询端点的 taskIds 完全由调用方指定，
+ * 服务端此前不做任何归属校验 —— 匿名遍历自增 taskId 即可读取他人任务的状态、
+ * 错误信息与结果文件状态。
+ *
+ * <p>渐进式收紧：<b>仅在调用方传入 userId 时过滤</b>，未传则保持原行为。
+ * 这样不会因前端/客户端某一处漏传就把结果过滤成空（表现为「任务进度全部消失」），
+ * 待各端都完成传参后再改为强制校验。
+ */
+@Slf4j
+@Component
+@RequiredArgsConstructor
+public class TaskProgressOwnershipSupport {
+
+    private final FileTaskMapper fileTaskMapper;
+
+    /**
+     * 过滤出属于 userId 的任务 id。
+     *
+     * @param taskIds 调用方请求的任务 id 列表
+     * @param userId  当前用户 id；为 null / 非正数时不做过滤（原样返回）
+     * @return 归属该用户的任务 id（保持原顺序）
+     */
+    public List<Long> filterOwnedTaskIds(List<Long> taskIds, Long userId) {
+        if (taskIds == null || taskIds.isEmpty()) {
+            return taskIds;
+        }
+        if (userId == null || userId <= 0) {
+            return taskIds;
+        }
+        List<Long> normalized = taskIds.stream()
+                .filter(id -> id != null && id > 0)
+                .distinct()
+                .toList();
+        if (normalized.isEmpty()) {
+            return normalized;
+        }
+        List<Long> owned = fileTaskMapper.selectList(new LambdaQueryWrapper<FileTaskEntity>()
+                        .select(FileTaskEntity::getId)
+                        .eq(FileTaskEntity::getUserId, userId)
+                        .in(FileTaskEntity::getId, normalized))
+                .stream()
+                .map(FileTaskEntity::getId)
+                .toList();
+        if (owned.size() != normalized.size()) {
+            // 非归属任务出现在请求里：可能是越权尝试，也可能是前端历史遗留缓存了别人的 taskId
+            log.warn("[progress-ownership] 进度查询剔除非归属任务 userId={} 请求 {} 个 命中 {} 个",
+                    userId, normalized.size(), owned.size());
+        }
+        return owned;
+    }
+}
diff --git a/backend-java/src/main/java/com/nanri/aiimage/modules/task/service/TaskResultItemService.java b/backend-java/src/main/java/com/nanri/aiimage/modules/task/service/TaskResultItemService.java
index 73d5f2ee..bb1de696 100644
--- a/backend-java/src/main/java/com/nanri/aiimage/modules/task/service/TaskResultItemService.java
+++ b/backend-java/src/main/java/com/nanri/aiimage/modules/task/service/TaskResultItemService.java
@@ -10,12 +10,16 @@ import lombok.RequiredArgsConstructor;
 import org.springframework.dao.DuplicateKeyException;
 import org.springframework.stereotype.Service;
 import org.springframework.transaction.annotation.Transactional;
+import org.springframework.transaction.support.TransactionSynchronization;
+import org.springframework.transaction.support.TransactionSynchronizationManager;
 
 import java.nio.charset.StandardCharsets;
 import java.security.MessageDigest;
 import java.time.LocalDateTime;
 import java.util.ArrayList;
+import java.util.HashMap;
 import java.util.List;
+import java.util.Map;
 
 @Service
 @RequiredArgsConstructor
@@ -26,18 +30,27 @@ public class TaskResultItemService {
     private final TransientPayloadStorageService transientPayloadStorageService;
 
     public void replaceResultSnapshot(Long taskId, String moduleType, Long resultId, String scopeKey, Object snapshot) {
+        replaceResultSnapshot(taskId, moduleType, resultId, scopeKey, snapshot, null);
+    }
+
+    private void replaceResultSnapshot(Long taskId, String moduleType, Long resultId, String scopeKey, Object snapshot,
+                                       Map<String, TaskResultItemEntity> existingCache) {
         if (taskId == null || taskId <= 0 || isBlank(moduleType) || resultId == null || resultId <= 0 || snapshot == null) {
             return;
         }
         String normalizedScopeKey = firstNonBlank(scopeKey, "result:" + resultId).trim();
         String itemKey = "result:" + resultId;
-        upsert(taskId, moduleType, resultId, normalizedScopeKey, itemKey, null, null, null, snapshot);
+        upsert(taskId, moduleType, resultId, normalizedScopeKey, itemKey, null, null, null, snapshot, existingCache);
     }
 
     public void replaceTaskSnapshots(Long taskId, String moduleType, List<? extends Object> snapshots, SnapshotKeyResolver resolver) {
         if (taskId == null || taskId <= 0 || isBlank(moduleType) || snapshots == null) {
             return;
         }
+        // 一次性载入本任务已有快照行：upsert 原本逐行 selectOne，N 行 × C 次回传
+        // 会产生 N×C 次单行查询（500 行 × 数百次回传 = 十万级往返）。
+        // 缓存含"已确认不存在"的占位（containsKey 判定），新行不再各查一次。
+        Map<String, TaskResultItemEntity> existingCache = loadSnapshotRows(taskId, moduleType);
         for (Object snapshot : snapshots) {
             if (snapshot == null) {
                 continue;
@@ -46,10 +59,27 @@ public class TaskResultItemService {
             if (resultId == null || resultId <= 0) {
                 continue;
             }
-            replaceResultSnapshot(taskId, moduleType, resultId, resolver.scopeKey(snapshot), snapshot);
+            replaceResultSnapshot(taskId, moduleType, resultId, resolver.scopeKey(snapshot), snapshot, existingCache);
         }
     }
 
+    /** 载入本任务全部快照行到 key=moduleType|scopeHash|itemKey 的缓存（与 find 的定位口径一致）。 */
+    private Map<String, TaskResultItemEntity> loadSnapshotRows(Long taskId, String moduleType) {
+        List<TaskResultItemEntity> rows = taskResultItemMapper.selectList(new LambdaQueryWrapper<TaskResultItemEntity>()
+                .eq(TaskResultItemEntity::getTaskId, taskId)
+                .eq(TaskResultItemEntity::getModuleType, moduleType)
+                .likeRight(TaskResultItemEntity::getItemKey, "result:"));
+        Map<String, TaskResultItemEntity> map = new HashMap<>();
+        for (TaskResultItemEntity row : rows) {
+            map.put(snapshotCacheKey(moduleType, row.getScopeHash(), row.getItemKey()), row);
+        }
+        return map;
+    }
+
+    private static String snapshotCacheKey(String moduleType, String scopeHash, String itemKey) {
+        return moduleType + "|" + scopeHash + "|" + itemKey;
+    }
+
     public <T> List<T> listResultSnapshots(Long taskId, String moduleType, Class<T> clazz) {
         if (taskId == null || taskId <= 0 || isBlank(moduleType)) {
             return List.of();
@@ -94,6 +124,34 @@ public class TaskResultItemService {
         return count == null ? 0L : count;
     }
 
+    /**
+     * 事务提交后再删除对象存储上的载荷。
+     *
+     * <p>此前在事务内同步逐行调用 {@code deletePayloadIfPresent}：单次删除超时 120s、重试 3 次，
+     * N 行结果就让 DB 连接被长时间占用（连接池单节点 30，几次并发删除即可打满并波及其它请求）。
+     * 项目自身在 TaskScopePayloadStorageService 已写明「不能把 RustFS/OSS 网络调用放进 DB 事务」。
+     * 提交后删除还有个好处：引用计数查询看到的是删除完成后的 DB 状态，判断更准确。
+     */
+    private void deletePayloadsAfterCommit(List<String> payloadValues) {
+        if (payloadValues == null || payloadValues.isEmpty()) {
+            return;
+        }
+        if (TransactionSynchronizationManager.isSynchronizationActive()) {
+            TransactionSynchronizationManager.registerSynchronization(new TransactionSynchronization() {
+                @Override
+                public void afterCommit() {
+                    for (String value : payloadValues) {
+                        transientPayloadStorageService.deletePayloadIfPresent(value);
+                    }
+                }
+            });
+            return;
+        }
+        for (String value : payloadValues) {
+            transientPayloadStorageService.deletePayloadIfPresent(value);
+        }
+    }
+
     @Transactional
     public void deleteResultItem(Long taskId, String moduleType, Long resultId) {
         if (taskId == null || taskId <= 0 || isBlank(moduleType) || resultId == null || resultId <= 0) {
@@ -105,9 +163,16 @@ public class TaskResultItemService {
                 .eq(TaskResultItemEntity::getModuleType, moduleType)
                 .eq(TaskResultItemEntity::getResultId, resultId));
         if (rows != null) {
-            for (TaskResultItemEntity row : rows) {
-                transientPayloadStorageService.deletePayloadIfPresent(row.getPayloadJson());
-            }
+            List<String> payloads = rows.stream()
+                    .map(TaskResultItemEntity::getPayloadJson)
+                    .filter(java.util.Objects::nonNull)
+                    .toList();
+            taskResultItemMapper.delete(new LambdaQueryWrapper<TaskResultItemEntity>()
+                    .eq(TaskResultItemEntity::getTaskId, taskId)
+                    .eq(TaskResultItemEntity::getModuleType, moduleType)
+                    .eq(TaskResultItemEntity::getResultId, resultId));
+            deletePayloadsAfterCommit(payloads);
+            return;
         }
         taskResultItemMapper.delete(new LambdaQueryWrapper<TaskResultItemEntity>()
                 .eq(TaskResultItemEntity::getTaskId, taskId)
@@ -136,9 +201,15 @@ public class TaskResultItemService {
                 .eq(TaskResultItemEntity::getTaskId, taskId)
                 .eq(TaskResultItemEntity::getModuleType, moduleType));
         if (rows != null) {
-            for (TaskResultItemEntity row : rows) {
-                transientPayloadStorageService.deletePayloadIfPresent(row.getPayloadJson());
-            }
+            List<String> payloads = rows.stream()
+                    .map(TaskResultItemEntity::getPayloadJson)
+                    .filter(java.util.Objects::nonNull)
+                    .toList();
+            taskResultItemMapper.delete(new LambdaQueryWrapper<TaskResultItemEntity>()
+                    .eq(TaskResultItemEntity::getTaskId, taskId)
+                    .eq(TaskResultItemEntity::getModuleType, moduleType));
+            deletePayloadsAfterCommit(payloads);
+            return;
         }
         taskResultItemMapper.delete(new LambdaQueryWrapper<TaskResultItemEntity>()
                 .eq(TaskResultItemEntity::getTaskId, taskId)
@@ -163,7 +234,8 @@ public class TaskResultItemService {
                         String countryCode,
                         String asin,
                         String status,
-                        Object payload) {
+                        Object payload,
+                        Map<String, TaskResultItemEntity> existingCache) {
         String payloadJson = writeJson(payload);
         String payloadHash = hash(payloadJson);
         String normalizedScopeKey = firstNonBlank(scopeKey, "task:" + taskId).trim();
@@ -171,7 +243,7 @@ public class TaskResultItemService {
         String scopeHash = hash(normalizedScopeKey);
         LocalDateTime now = LocalDateTime.now();
 
-        TaskResultItemEntity existing = find(taskId, moduleType, scopeHash, normalizedItemKey);
+        TaskResultItemEntity existing = find(taskId, moduleType, scopeHash, normalizedItemKey, existingCache);
         if (isUnchanged(existing, resultId, normalizedScopeKey, countryCode, asin, status, payloadHash)) {
             return;
         }
@@ -194,9 +266,13 @@ public class TaskResultItemService {
             entity.setUpdatedAt(now);
             try {
                 taskResultItemMapper.insert(entity);
+                if (existingCache != null) {
+                    existingCache.put(snapshotCacheKey(moduleType, scopeHash, normalizedItemKey), entity);
+                }
                 return;
             } catch (DuplicateKeyException ignored) {
-                existing = find(taskId, moduleType, scopeHash, normalizedItemKey);
+                // 并发插入抢跑：绕过缓存强制回库取最新行
+                existing = find(taskId, moduleType, scopeHash, normalizedItemKey, null);
             }
         }
         if (existing == null) {
@@ -217,6 +293,10 @@ public class TaskResultItemService {
                 .set(TaskResultItemEntity::getPayloadJson, storedPayload)
                 .set(TaskResultItemEntity::getPayloadHash, payloadHash)
                 .set(TaskResultItemEntity::getUpdatedAt, now));
+        // 上面走 wrapper 更新未回填实体，缓存项作废（同批再次遇到会重新查库，保证不脏读）
+        if (existingCache != null) {
+            existingCache.remove(snapshotCacheKey(moduleType, scopeHash, normalizedItemKey));
+        }
     }
 
     private boolean isUnchanged(TaskResultItemEntity existing,
@@ -237,7 +317,15 @@ public class TaskResultItemService {
                 && java.util.Objects.equals(existing.getPayloadHash(), payloadHash);
     }
 
-    private TaskResultItemEntity find(Long taskId, String moduleType, String scopeHash, String itemKey) {
+    private TaskResultItemEntity find(Long taskId, String moduleType, String scopeHash, String itemKey,
+                                      Map<String, TaskResultItemEntity> existingCache) {
+        if (existingCache != null) {
+            String cacheKey = snapshotCacheKey(moduleType, scopeHash, itemKey);
+            if (existingCache.containsKey(cacheKey)) {
+                // 命中即返回：值可能为 null，表示本批已确认该行不存在（无需再查库）
+                return existingCache.get(cacheKey);
+            }
+        }
         return taskResultItemMapper.selectOne(new LambdaQueryWrapper<TaskResultItemEntity>()
                 .eq(TaskResultItemEntity::getTaskId, taskId)
                 .eq(TaskResultItemEntity::getModuleType, moduleType)
@@ -272,11 +360,9 @@ public class TaskResultItemService {
         try {
             MessageDigest digest = MessageDigest.getInstance("SHA-256");
             byte[] bytes = digest.digest((value == null ? "" : value).getBytes(StandardCharsets.UTF_8));
-            StringBuilder sb = new StringBuilder(bytes.length * 2);
-            for (byte b : bytes) {
-                sb.append(String.format("%02x", b));
-            }
-            return sb.toString();
+            // HexFormat 替代逐字节 String.format("%02x")：后者每次哈希要走 32 次 Formatter，
+            // 而本方法在结果回写热路径上按行调用（10 万行 ≈ 320 万次格式化）
+            return java.util.HexFormat.of().formatHex(bytes);
         } catch (Exception ex) {
             throw new IllegalStateException("failed to hash task result item", ex);
         }
diff --git a/backend-java/src/main/java/com/nanri/aiimage/modules/task/service/TaskResultPayloadService.java b/backend-java/src/main/java/com/nanri/aiimage/modules/task/service/TaskResultPayloadService.java
index d6e094ac..f58f7203 100644
--- a/backend-java/src/main/java/com/nanri/aiimage/modules/task/service/TaskResultPayloadService.java
+++ b/backend-java/src/main/java/com/nanri/aiimage/modules/task/service/TaskResultPayloadService.java
@@ -122,11 +122,8 @@ public class TaskResultPayloadService {
         try {
             MessageDigest digest = MessageDigest.getInstance("SHA-256");
             byte[] bytes = digest.digest((value == null ? "" : value).getBytes(StandardCharsets.UTF_8));
-            StringBuilder sb = new StringBuilder(bytes.length * 2);
-            for (byte b : bytes) {
-                sb.append(String.format("%02x", b));
-            }
-            return sb.toString();
+            // HexFormat 替代逐字节 String.format("%02x")：后者每次走 32 次 Formatter（热路径按行调用）
+            return java.util.HexFormat.of().formatHex(bytes);
         } catch (Exception ex) {
             throw new IllegalStateException("failed to hash task result payload", ex);
         }
diff --git a/backend-java/src/main/java/com/nanri/aiimage/modules/task/service/TaskScopePayloadBufferMaintenanceService.java b/backend-java/src/main/java/com/nanri/aiimage/modules/task/service/TaskScopePayloadBufferMaintenanceService.java
index 9f6b775d..5ab929e4 100644
--- a/backend-java/src/main/java/com/nanri/aiimage/modules/task/service/TaskScopePayloadBufferMaintenanceService.java
+++ b/backend-java/src/main/java/com/nanri/aiimage/modules/task/service/TaskScopePayloadBufferMaintenanceService.java
@@ -1,6 +1,7 @@
 package com.nanri.aiimage.modules.task.service;
 
 import com.nanri.aiimage.common.service.DistributedJobLockService;
+import com.nanri.aiimage.config.InstanceMetadata;
 import com.nanri.aiimage.config.TaskPressureProperties;
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
@@ -32,13 +33,18 @@ public class TaskScopePayloadBufferMaintenanceService {
     private final TaskScopePayloadStorageService taskScopePayloadStorageService;
     private final TaskPressureProperties taskPressureProperties;
     private final DistributedJobLockService distributedJobLockService;
+    private final InstanceMetadata instanceMetadata;
 
     @EventListener(ApplicationReadyEvent.class)
     public void recoverBufferedPayloadsOnStartup() {
+        // 锁按实例维度命名：恢复只处理本机 java.io.tmpdir 下的 buffer，
+        // 用全局锁会让双节点同时重启时只有一台能恢复自己的目录，
+        // 另一台的待恢复载荷在保留期后被 cleanup 任务当作过期文件删除。
+        String recoveryLockName = "task-scope-buffer:recover:" + instanceMetadata.getInstanceId();
         DistributedJobLockService.LockHandle lockHandle =
-                distributedJobLockService.tryLock("task-scope-buffer:recover", RECOVERY_LOCK_TTL);
+                distributedJobLockService.tryLock(recoveryLockName, RECOVERY_LOCK_TTL);
         if (lockHandle == null) {
-            log.info("[task-scope-buffer] skip startup recovery because another instance holds the lock");
+            log.info("[task-scope-buffer] skip startup recovery because lock is held lockName={}", recoveryLockName);
             return;
         }
         try (lockHandle) {
diff --git a/backend-java/src/main/java/com/nanri/aiimage/modules/task/service/TransientPayloadDeleteOrchestrator.java b/backend-java/src/main/java/com/nanri/aiimage/modules/task/service/TransientPayloadDeleteOrchestrator.java
index 77e298b5..f1d038ff 100644
--- a/backend-java/src/main/java/com/nanri/aiimage/modules/task/service/TransientPayloadDeleteOrchestrator.java
+++ b/backend-java/src/main/java/com/nanri/aiimage/modules/task/service/TransientPayloadDeleteOrchestrator.java
@@ -189,22 +189,47 @@ public class TransientPayloadDeleteOrchestrator {
         candidates.addAll(jsonEncoded);
 
         Set<String> referenced = new LinkedHashSet<>();
-        List<TaskChunkEntity> chunks = taskChunkMapper.selectList(new LambdaQueryWrapper<TaskChunkEntity>()
-                .in(TaskChunkEntity::getPayloadJson, candidates));
-        for (TaskChunkEntity chunk : chunks) {
-            referenced.addAll(matchingPointers(chunk.getPayloadJson(), pointers));
-        }
-        List<TaskScopeStateEntity> scopeStates = taskScopeStateMapper.selectList(new LambdaQueryWrapper<TaskScopeStateEntity>()
-                .and(w -> w.in(TaskScopeStateEntity::getParsedPayloadJson, candidates)
-                        .or()
-                        .in(TaskScopeStateEntity::getStateJson, candidates)));
-        for (TaskScopeStateEntity scopeState : scopeStates) {
-            referenced.addAll(matchingPointers(scopeState.getParsedPayloadJson(), pointers));
-            referenced.addAll(matchingPointers(scopeState.getStateJson(), pointers));
+        // 指针 key 含 taskId 且引用不跨任务：按 taskId 分组后带 task_id 查询
+        // （uk_task_scope_chunk 最左前缀），避免 payload_json 这类 JSON 列的 IN 比较全表扫描。
+        // 解析不出 taskId 的候选值归入 key=null 的组，走不带 task_id 的全局查询（与原行为一致）。
+        for (Map.Entry<Long, List<String>> group : groupCandidatesByTaskId(candidates).entrySet()) {
+            Long taskId = group.getKey();
+            List<String> scoped = group.getValue();
+
+            LambdaQueryWrapper<TaskChunkEntity> chunkQuery = new LambdaQueryWrapper<TaskChunkEntity>()
+                    .in(TaskChunkEntity::getPayloadJson, scoped);
+            if (taskId != null) {
+                chunkQuery.eq(TaskChunkEntity::getTaskId, taskId);
+            }
+            for (TaskChunkEntity chunk : taskChunkMapper.selectList(chunkQuery)) {
+                referenced.addAll(matchingPointers(chunk.getPayloadJson(), pointers));
+            }
+
+            LambdaQueryWrapper<TaskScopeStateEntity> scopeQuery = new LambdaQueryWrapper<TaskScopeStateEntity>()
+                    .and(w -> w.in(TaskScopeStateEntity::getParsedPayloadJson, scoped)
+                            .or()
+                            .in(TaskScopeStateEntity::getStateJson, scoped));
+            if (taskId != null) {
+                scopeQuery.eq(TaskScopeStateEntity::getTaskId, taskId);
+            }
+            for (TaskScopeStateEntity scopeState : taskScopeStateMapper.selectList(scopeQuery)) {
+                referenced.addAll(matchingPointers(scopeState.getParsedPayloadJson(), pointers));
+                referenced.addAll(matchingPointers(scopeState.getStateJson(), pointers));
+            }
         }
         return referenced;
     }
 
+    /** 按指针中的 taskId 分组候选值；无法解析的归入 key=null 组。 */
+    private Map<Long, List<String>> groupCandidatesByTaskId(List<String> candidates) {
+        Map<Long, List<String>> grouped = new LinkedHashMap<>();
+        for (String candidate : candidates) {
+            Long taskId = transientPayloadStorageService.extractTaskId(candidate);
+            grouped.computeIfAbsent(taskId, k -> new ArrayList<>()).add(candidate);
+        }
+        return grouped;
+    }
+
     private Set<String> matchingPointers(String dbValue, List<String> pointers) {
         Set<String> matches = new LinkedHashSet<>();
         if (dbValue == null || dbValue.isBlank()) {
diff --git a/backend-java/src/main/java/com/nanri/aiimage/modules/task/service/TransientPayloadStorageService.java b/backend-java/src/main/java/com/nanri/aiimage/modules/task/service/TransientPayloadStorageService.java
index 69d3a3e1..a728e81a 100644
--- a/backend-java/src/main/java/com/nanri/aiimage/modules/task/service/TransientPayloadStorageService.java
+++ b/backend-java/src/main/java/com/nanri/aiimage/modules/task/service/TransientPayloadStorageService.java
@@ -242,15 +242,16 @@ public class TransientPayloadStorageService {
                 return false;
             }
             List<String> values = new ArrayList<>(candidates);
-            Long chunkCount = taskChunkMapper.selectCount(new LambdaQueryWrapper<TaskChunkEntity>()
-                    .in(TaskChunkEntity::getPayloadJson, values));
+            // 对象 key 形如 <category>/<moduleType>/<taskId>/<scopeHash>/<entryKey>.json，引用不跨任务；
+            // 据此先用 task_id（uk_task_scope_chunk 的最左前缀）收敛范围，避免 payload_json 这类
+            // JSON 列上的 IN 比较退化成全表扫描（该方法是删除路径的公共链路且被逐行调用）。
+            // 解析不出 taskId 时按原口径全局查，行为与改造前一致。
+            Long pointerTaskId = extractTaskId(pointer);
+            Long chunkCount = referencedChunkCount(pointerTaskId, values);
             if (chunkCount != null && chunkCount > 1L) {
                 return true;
             }
-            Long scopeStateCount = taskScopeStateMapper.selectCount(new LambdaQueryWrapper<TaskScopeStateEntity>()
-                    .and(w -> w.in(TaskScopeStateEntity::getParsedPayloadJson, values)
-                            .or()
-                            .in(TaskScopeStateEntity::getStateJson, values)));
+            Long scopeStateCount = referencedScopeStateCount(pointerTaskId, values);
             return scopeStateCount != null && scopeStateCount > 0L;
         } catch (Exception ex) {
             log.warn("[transient-payload] reference check failed pointer={} err={}", pointer, ex.getMessage());
@@ -259,6 +260,67 @@ public class TransientPayloadStorageService {
         }
     }
 
+    /**
+     * 带 task_id 收敛的 chunk 引用计数；带 task 查不到时回退全局查询，
+     * 保证即使指针格式与预期不符也不会漏判引用（漏判会导致对象被误删）。
+     */
+    private Long referencedChunkCount(Long taskId, List<String> values) {
+        if (taskId != null) {
+            Long scoped = taskChunkMapper.selectCount(new LambdaQueryWrapper<TaskChunkEntity>()
+                    .eq(TaskChunkEntity::getTaskId, taskId)
+                    .in(TaskChunkEntity::getPayloadJson, values));
+            if (scoped != null && scoped > 0L) {
+                return scoped;
+            }
+        }
+        return taskChunkMapper.selectCount(new LambdaQueryWrapper<TaskChunkEntity>()
+                .in(TaskChunkEntity::getPayloadJson, values));
+    }
+
+    /** 带 task_id 收敛的 scope_state 引用计数；回退逻辑同 {@link #referencedChunkCount}。 */
+    private Long referencedScopeStateCount(Long taskId, List<String> values) {
+        if (taskId != null) {
+            Long scoped = taskScopeStateMapper.selectCount(new LambdaQueryWrapper<TaskScopeStateEntity>()
+                    .eq(TaskScopeStateEntity::getTaskId, taskId)
+                    .and(w -> w.in(TaskScopeStateEntity::getParsedPayloadJson, values)
+                            .or()
+                            .in(TaskScopeStateEntity::getStateJson, values)));
+            if (scoped != null && scoped > 0L) {
+                return scoped;
+            }
+        }
+        return taskScopeStateMapper.selectCount(new LambdaQueryWrapper<TaskScopeStateEntity>()
+                .and(w -> w.in(TaskScopeStateEntity::getParsedPayloadJson, values)
+                        .or()
+                        .in(TaskScopeStateEntity::getStateJson, values)));
+    }
+
+    /**
+     * 从载荷指针解析任务 id。key 由 {@code buildObjectKey} 生成，格式固定为
+     * {@code <category>/<moduleType>/<taskId>/<scopeHash>/<entryKey>.json}，
+     * taskId 是第三段且必为数字；解析失败返回 null（调用方退回全局查询）。
+     *
+     * <p>公开给批量引用反查（TransientPayloadDeleteOrchestrator）按 task 分组使用。
+     */
+    public Long extractTaskId(String pointer) {
+        if (pointer == null) {
+            return null;
+        }
+        int colon = pointer.indexOf(':');
+        if (colon < 0 || colon == pointer.length() - 1) {
+            return null;
+        }
+        String[] segments = pointer.substring(colon + 1).split("/");
+        if (segments.length < 3) {
+            return null;
+        }
+        try {
+            return Long.parseLong(segments[2].trim());
+        } catch (NumberFormatException ex) {
+            return null;
+        }
+    }
+
     public void deleteReplacedPayloadIfNeeded(String oldValue, String newValue) {
         String oldPointer = extractPointer(oldValue);
         String newPointer = extractPointer(newValue);
diff --git a/backend-java/src/main/java/com/nanri/aiimage/modules/usersecret/client/JikipProxyClient.java b/backend-java/src/main/java/com/nanri/aiimage/modules/usersecret/client/JikipProxyClient.java
index 04fb4cfb..07642c14 100644
--- a/backend-java/src/main/java/com/nanri/aiimage/modules/usersecret/client/JikipProxyClient.java
+++ b/backend-java/src/main/java/com/nanri/aiimage/modules/usersecret/client/JikipProxyClient.java
@@ -2,6 +2,7 @@ package com.nanri.aiimage.modules.usersecret.client;
 
 import com.fasterxml.jackson.databind.JsonNode;
 import com.fasterxml.jackson.databind.ObjectMapper;
+import com.nanri.aiimage.common.util.SecretMasking;
 import com.nanri.aiimage.config.HttpClientPool;
 import com.nanri.aiimage.config.UserSecretProperties;
 import com.nanri.aiimage.modules.usersecret.model.vo.UserApiSecretBalanceVo;
@@ -65,7 +66,8 @@ public class JikipProxyClient {
                 log.warn("[user-secret][proxy] 提取接口返回中未找到 ip:port，响应前 200 字={}", abbreviate(body, 200));
                 return null;
             }
-            log.info("[user-secret][proxy] 代理提取成功 proxy={}", proxyUrl);
+            // 掩码后再打日志：proxyUrl 形态为 http://user:pass@host:port，明文入日志等于用户代理账密持久化
+            log.info("[user-secret][proxy] 代理提取成功 proxy={}", SecretMasking.maskProxy(proxyUrl));
             return proxyUrl;
         } catch (InsufficientBalanceException ex) {
             throw ex;
diff --git a/backend-java/src/main/java/com/nanri/aiimage/modules/usersecret/service/UserApiSecretCheckService.java b/backend-java/src/main/java/com/nanri/aiimage/modules/usersecret/service/UserApiSecretCheckService.java
index 74f87a35..f0cbe58b 100644
--- a/backend-java/src/main/java/com/nanri/aiimage/modules/usersecret/service/UserApiSecretCheckService.java
+++ b/backend-java/src/main/java/com/nanri/aiimage/modules/usersecret/service/UserApiSecretCheckService.java
@@ -2,6 +2,7 @@ package com.nanri.aiimage.modules.usersecret.service;
 
 import com.fasterxml.jackson.databind.JsonNode;
 import com.fasterxml.jackson.databind.ObjectMapper;
+import com.nanri.aiimage.common.util.SecretMasking;
 import com.nanri.aiimage.config.AppearancePatentProperties;
 import com.nanri.aiimage.config.HttpClientPool;
 import com.nanri.aiimage.config.SimilarAsinProperties;
@@ -101,8 +102,9 @@ public class UserApiSecretCheckService {
         if (proxyUrl != null) {
             CheckOutcome viaProxy = probeOnce(module, plainApiKey, proxyUrl, true);
             if (isTransportFailure(viaProxy)) {
+                // 掩码后再打日志：proxyUrl 含用户代理账密，明文入日志等于持久化敏感凭据
                 log.warn("[user-secret][check] 经代理检测失败 module={} proxy={} code={}，回退直连重试",
-                        module.key(), proxyUrl, viaProxy.code());
+                        module.key(), SecretMasking.maskProxy(proxyUrl), viaProxy.code());
                 CheckOutcome direct = probeOnce(module, plainApiKey, null, false);
                 if (isTransportFailure(direct)) {
                     direct = retryOnce(module, plainApiKey, direct);
diff --git a/backend-java/src/main/java/com/nanri/aiimage/modules/withdraw/controller/WithdrawTaskController.java b/backend-java/src/main/java/com/nanri/aiimage/modules/withdraw/controller/WithdrawTaskController.java
index 1f587d3c..0e2bd37d 100644
--- a/backend-java/src/main/java/com/nanri/aiimage/modules/withdraw/controller/WithdrawTaskController.java
+++ b/backend-java/src/main/java/com/nanri/aiimage/modules/withdraw/controller/WithdrawTaskController.java
@@ -40,6 +40,7 @@ import java.nio.charset.StandardCharsets;
 import java.util.List;
 import com.nanri.aiimage.modules.task.model.dto.TaskProgressLightRequest;
 import com.nanri.aiimage.modules.task.model.vo.TaskProgressLightBatchVo;
+import com.nanri.aiimage.modules.task.service.TaskProgressOwnershipSupport;
 
 @RestController
 @RequiredArgsConstructor
@@ -50,6 +51,7 @@ public class WithdrawTaskController {
 
     private final WithdrawResolveService withdrawResolveService;
     private final WithdrawTaskService withdrawTaskService;
+    private final TaskProgressOwnershipSupport progressOwnershipSupport;
 
     @GetMapping("/candidates")
     @Operation(summary = "查询取款备选店铺", description = "按当前用户查询已保存的取款备选店铺列表，用于前端勾选后进行匹配和创建取款任务。")
@@ -108,7 +110,9 @@ public class WithdrawTaskController {
     @PostMapping("/tasks/progress/batch")
     @Operation(summary = "批量查询取款任务进度", description = "前端轮询使用。按任务 ID 批量查询轻量进度和结果快照；不存在的任务 ID 会返回在 missingTaskIds 中。")
     public ApiResponse<WithdrawTaskBatchVo> taskProgressBatch(@Valid @RequestBody WithdrawTaskBatchRequest request) {
-        return ApiResponse.success(withdrawTaskService.getTaskProgressBatch(request.getTaskIds()));
+        // 归属过滤：只查询属于该用户的任务（userId 未传时保持原行为，兼容未升级调用方）
+        return ApiResponse.success(withdrawTaskService.getTaskProgressBatch(progressOwnershipSupport
+                .filterOwnedTaskIds(request.getTaskIds(), request.getUserId())));
     }
 
     @PostMapping("/tasks/progress/light")
@@ -116,7 +120,8 @@ public class WithdrawTaskController {
             description = "与 progress/batch 同输入，只返回轻量字段（taskId/status/statusCode/fileStatus/fileError/fileReady/updatedAt），"
                     + "不查明细/result 行，响应体更小；旧 progress/batch 端点保留不动。")
     public ApiResponse<TaskProgressLightBatchVo> progressLight(@Valid @RequestBody TaskProgressLightRequest request) {
-        return ApiResponse.success(withdrawTaskService.progressLight(request.getTaskIds()));
+        // 透传 userId：此前传 null = 不过滤归属，匿名遍历 taskId 即可读他人任务状态（2026-09 审查）
+        return ApiResponse.success(withdrawTaskService.progressLight(request.getTaskIds(), request.getUserId()));
     }
 
     @PostMapping("/tasks")
diff --git a/backend-java/src/main/java/com/nanri/aiimage/modules/withdraw/model/dto/WithdrawTaskBatchRequest.java b/backend-java/src/main/java/com/nanri/aiimage/modules/withdraw/model/dto/WithdrawTaskBatchRequest.java
index c57a4823..5598ff9e 100644
--- a/backend-java/src/main/java/com/nanri/aiimage/modules/withdraw/model/dto/WithdrawTaskBatchRequest.java
+++ b/backend-java/src/main/java/com/nanri/aiimage/modules/withdraw/model/dto/WithdrawTaskBatchRequest.java
@@ -11,4 +11,8 @@ import java.util.List;
 public class WithdrawTaskBatchRequest {
     @Schema(description = "待查询的取款任务 ID 列表；不存在或非取款模块任务会返回到 missingTaskIds", requiredMode = Schema.RequiredMode.REQUIRED, example = "[200,201]")
     private List<Long> taskIds = new ArrayList<>();
+
+    /** 当前用户 ID（可省略；传入时仅返回该用户的任务，用于进度接口归属过滤）。 */
+    @Schema(description = "当前用户 ID（可省略；传入时仅返回该用户的任务）", example = "1")
+    private Long userId;
 }
diff --git a/backend-java/src/main/java/com/nanri/aiimage/modules/withdraw/service/WithdrawTaskService.java b/backend-java/src/main/java/com/nanri/aiimage/modules/withdraw/service/WithdrawTaskService.java
index 0fd740ba..7490c4eb 100644
--- a/backend-java/src/main/java/com/nanri/aiimage/modules/withdraw/service/WithdrawTaskService.java
+++ b/backend-java/src/main/java/com/nanri/aiimage/modules/withdraw/service/WithdrawTaskService.java
@@ -3,8 +3,10 @@ package com.nanri.aiimage.modules.withdraw.service;
 import cn.hutool.core.io.FileUtil;
 import cn.hutool.core.util.IdUtil;
 import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
+import com.baomidou.mybatisplus.core.conditions.update.LambdaUpdateWrapper;
 import com.fasterxml.jackson.core.type.TypeReference;
 import com.fasterxml.jackson.databind.ObjectMapper;
+import com.nanri.aiimage.common.exception.BusinessCodes;
 import com.nanri.aiimage.common.exception.BusinessException;
 import com.nanri.aiimage.config.TaskPressureProperties;
 import com.nanri.aiimage.modules.file.service.oss.OssStorageService;
@@ -52,8 +54,8 @@ public class WithdrawTaskService {
 
     private static final String MODULE_TYPE = "WITHDRAW";
 
-    public TaskProgressLightBatchVo progressLight(List<Long> taskIds) {
-        return taskProgressLightAssembler.assemble(MODULE_TYPE, null, taskIds);
+    public TaskProgressLightBatchVo progressLight(List<Long> taskIds, Long userId) {
+        return taskProgressLightAssembler.assemble(MODULE_TYPE, userId, taskIds);
     }
     private static final String CONTENT_TYPE_XLSX = "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet";
     private static final int RESULT_PENDING = -1;
@@ -415,16 +417,19 @@ public class WithdrawTaskService {
             String objectKey = ossStorageService.uploadResultFile(xlsx, MODULE_TYPE);
             long fileSize = xlsx.length();
             int rowCount = excelAssemblyService.countRows(successItems);
+            List<Long> successRowIds = new ArrayList<>();
             for (FileResultEntity row : rows) {
                 if (Integer.valueOf(RESULT_SUCCESS).equals(row.getSuccess())) {
+                    // 内存对象同步改：紧随其后的 updateTaskStatusFromRows/buildSnapshotFromDb 直接读这些对象
                     row.setResultFilename(filename);
                     row.setResultFileUrl(objectKey);
                     row.setResultFileSize(fileSize);
                     row.setResultContentType(CONTENT_TYPE_XLSX);
                     row.setRowCount(rowCount);
-                    fileResultMapper.updateById(row);
+                    successRowIds.add(row.getId());
                 }
             }
+            updateResultFileColumns(successRowIds, filename, objectKey, fileSize, rowCount);
             updateTaskStatusFromRows(task, rows);
             persistSnapshotJson(task, buildSnapshotFromDb(task, rows));
             fileTaskMapper.updateById(task);
@@ -433,6 +438,27 @@ public class WithdrawTaskService {
         }
     }
 
+    /**
+     * 一条 UPDATE 落库结果文件列。
+     *
+     * <p>原先对每个成功行 {@code updateById}：N 行 = N 次网络往返 + N 次提交（本方法非事务、自动提交），
+     * 且写 binlog 被同步放大；N=500 时白花约 0.5~1s。条件与 listTaskRows 的查询口径一致。
+     */
+    private void updateResultFileColumns(List<Long> rowIds, String filename, String objectKey,
+                                         long fileSize, int rowCount) {
+        if (rowIds == null || rowIds.isEmpty()) {
+            return;
+        }
+        fileResultMapper.update(null, new LambdaUpdateWrapper<FileResultEntity>()
+                .in(FileResultEntity::getId, rowIds)
+                .eq(FileResultEntity::getSuccess, RESULT_SUCCESS)
+                .set(FileResultEntity::getResultFilename, filename)
+                .set(FileResultEntity::getResultFileUrl, objectKey)
+                .set(FileResultEntity::getResultFileSize, fileSize)
+                .set(FileResultEntity::getResultContentType, CONTENT_TYPE_XLSX)
+                .set(FileResultEntity::getRowCount, rowCount));
+    }
+
     private void finalizeTaskWorkbook(FileTaskEntity task, List<FileResultEntity> rows, List<WithdrawResultItemVo> snapshots) {
         List<WithdrawResultItemVo> successItems = snapshots.stream()
                 .filter(item -> Boolean.TRUE.equals(item.getSuccess()))
@@ -441,20 +467,23 @@ public class WithdrawTaskService {
             String filename = buildTaskWorkbookFilename(task);
             int rowCount = excelAssemblyService.countRows(successItems);
             FileResultEntity firstSuccessRow = null;
+            List<Long> successRowIds = new ArrayList<>();
             for (FileResultEntity row : rows) {
                 if (Integer.valueOf(RESULT_SUCCESS).equals(row.getSuccess())) {
+                    // 内存对象同步改：下方 buildSnapshotFromDb 直接读这些对象
                     row.setResultFilename(filename);
                     row.setResultFileUrl(null);
                     row.setResultFileSize(0L);
                     row.setResultContentType(CONTENT_TYPE_XLSX);
                     row.setRowCount(rowCount);
-                    fileResultMapper.updateById(row);
+                    successRowIds.add(row.getId());
                     if (firstSuccessRow == null) {
                         firstSuccessRow = row;
                     }
                 }
             }
             if (firstSuccessRow != null) {
+                updateResultFileColumns(successRowIds, filename, null, 0L, rowCount);
                 taskFileJobService.enqueueAssembleResult(task.getId(), MODULE_TYPE, firstSuccessRow.getId(), "task:" + task.getId());
             }
         }
@@ -1012,7 +1041,8 @@ public class WithdrawTaskService {
     private TaskDistributedLockService.LockHandle acquireTaskLockOrThrow(Long taskId) {
         TaskDistributedLockService.LockHandle lockHandle = acquireTaskLock(taskId);
         if (lockHandle == null) {
-            throw new BusinessException(40901, "任务正在处理中，请稍后再试");
+            log.warn("[withdraw] 任务锁竞争，拒绝本次提交 taskId={}", taskId);
+            throw new BusinessException(BusinessCodes.TASK_BUSY, "任务正在处理中，请稍后再试");
         }
         return lockHandle;
     }
diff --git a/backend-java/src/main/java/com/nanri/aiimage/modules/ziniao/controller/ZiniaoAuthController.java b/backend-java/src/main/java/com/nanri/aiimage/modules/ziniao/controller/ZiniaoAuthController.java
index 54ee3f52..e2d84067 100644
--- a/backend-java/src/main/java/com/nanri/aiimage/modules/ziniao/controller/ZiniaoAuthController.java
+++ b/backend-java/src/main/java/com/nanri/aiimage/modules/ziniao/controller/ZiniaoAuthController.java
@@ -46,7 +46,10 @@ public class ZiniaoAuthController {
     @ApiResponses({
             @io.swagger.v3.oas.annotations.responses.ApiResponse(responseCode = "200", description = "获取成功", content = @Content(schema = @Schema(implementation = ZiniaoSessionVo.class)))
     })
-    public ApiResponse<ZiniaoSessionVo> getSession(@RequestParam(required = false) String sessionId, @RequestParam(required = false) Long userId) {
+    public ApiResponse<ZiniaoSessionVo> getSession(HttpServletRequest request,
+            @RequestParam(required = false) String sessionId, @RequestParam(required = false) Long userId) {
+        // 会话信息含公司级凭据上下文，必须管理员可见（此前匿名可达）
+        adminAuthSupport.requireAdmin(request);
         return ApiResponse.success(ziniaoAuthService.getSession(sessionId, userId));
     }
 
@@ -55,13 +58,15 @@ public class ZiniaoAuthController {
     @ApiResponses({
             @io.swagger.v3.oas.annotations.responses.ApiResponse(responseCode = "200", description = "获取成功", content = @Content(schema = @Schema(implementation = ZiniaoStaffListVo.class)))
     })
-    public ApiResponse<ZiniaoStaffListVo> listStaff() {
+    public ApiResponse<ZiniaoStaffListVo> listStaff(HttpServletRequest request) {
+        adminAuthSupport.requireAdmin(request);
         return ApiResponse.success(ziniaoAuthService.listStaff());
     }
 
     @GetMapping("/index-refresh")
     @Operation(summary = "获取紫鸟店铺索引刷新状态", description = "返回后台定时刷新紫鸟店铺索引的最近一次执行状态、时间和无效 userId 样本。")
-    public ApiResponse<ZiniaoShopIndexRefreshCursorDto> getIndexRefreshStatus() {
+    public ApiResponse<ZiniaoShopIndexRefreshCursorDto> getIndexRefreshStatus(HttpServletRequest request) {
+        adminAuthSupport.requireAdmin(request);
         return ApiResponse.success(ziniaoShopIndexService.getRefreshCursor());
     }
 
@@ -81,7 +86,9 @@ public class ZiniaoAuthController {
     @ApiResponses({
             @io.swagger.v3.oas.annotations.responses.ApiResponse(responseCode = "200", description = "获取成功", content = @Content(schema = @Schema(implementation = ZiniaoShopListVo.class)))
     })
-    public ApiResponse<ZiniaoShopListVo> listShops(@RequestParam String sessionId, @RequestParam Long userId) {
+    public ApiResponse<ZiniaoShopListVo> listShops(HttpServletRequest request,
+            @RequestParam String sessionId, @RequestParam Long userId) {
+        adminAuthSupport.requireAdmin(request);
         return ApiResponse.success(ziniaoAuthService.listShops(sessionId, userId));
     }
 
@@ -90,7 +97,10 @@ public class ZiniaoAuthController {
     @ApiResponses({
             @io.swagger.v3.oas.annotations.responses.ApiResponse(responseCode = "200", description = "打开链接生成成功", content = @Content(schema = @Schema(implementation = ZiniaoOpenShopVo.class)))
     })
-    public ApiResponse<ZiniaoOpenShopVo> openShop(@Valid @RequestBody ZiniaoOpenShopRequest request) {
-        return ApiResponse.success(ziniaoAuthService.openShop(request));
+    public ApiResponse<ZiniaoOpenShopVo> openShop(HttpServletRequest request,
+            @Valid @RequestBody ZiniaoOpenShopRequest openShopRequest) {
+        // 该接口返回员工级店铺登录令牌：匿名可达等于可接管任意员工卖家后台，必须管理员鉴权
+        adminAuthSupport.requireAdmin(request);
+        return ApiResponse.success(ziniaoAuthService.openShop(openShopRequest));
     }
 }
diff --git a/backend-java/src/main/resources/application-server.yml b/backend-java/src/main/resources/application-server.yml
index c3a5a40f..d3ebb888 100644
--- a/backend-java/src/main/resources/application-server.yml
+++ b/backend-java/src/main/resources/application-server.yml
@@ -21,3 +21,16 @@ aiimage:
   instance-id: ${AIIMAGE_INSTANCE_ID:}
   result-file-job:
     mq-enabled: ${AIIMAGE_RESULT_FILE_JOB_MQ_ENABLED:true}
+
+# 生产关闭 API 文档（2026-09 全维度审查）：/doc.html 与 /v3/api-docs 匿名可达，
+# 会向未授权访问者暴露全部接口定义（内部路径、参数结构、字段名）。
+# actuator 仅保留 health（Spring Boot 默认只暴露 health，且 details 默认 never）；
+# 它是负载均衡/面板的健康探针，需保持匿名可达。
+springdoc:
+  api-docs:
+    enabled: false
+  swagger-ui:
+    enabled: false
+
+knife4j:
+  enable: false
diff --git a/backend-java/src/main/resources/db/V120__stale_scan_and_daily_file_indexes.sql b/backend-java/src/main/resources/db/V120__stale_scan_and_daily_file_indexes.sql
new file mode 100644
index 00000000..511b5031
--- /dev/null
+++ b/backend-java/src/main/resources/db/V120__stale_scan_and_daily_file_indexes.sql
@@ -0,0 +1,71 @@
+-- V120: 补齐三处缺失索引（2026-09 全维度代码审查发现）
+--
+-- 背景与影响：
+-- 1) biz_file_task(status, updated_at)
+--    StaleTaskRepairService.repairFileTaskStaleRunning 每 10 分钟按
+--    status='RUNNING' AND updated_at < cutoff 扫描；该表现有索引无一以 status 打头
+--    （V1 是 (module_type,status)，V92 是 (owner_instance_id,status,updated_at)），
+--    导致每轮全表扫描。代码侧已同步改为「先查 id（limit 500）再按主键更新」，本索引进一步消除扫描。
+-- 2) brand_crawl_tasks(status, updated_at)
+--    同上，StaleTaskRepairService.repairBrandStale 的 brand 分支；该表仅有 (user_id,status)。
+-- 3) biz_shop_data_crawl_item(daily_file_id)
+--    该列作为 DELETE/UPDATE 条件使用（ShopDataCrawlItemMapper.deleteByDailyFileId、
+--    ShopDataCrawlItemStoreService 跨天滚动改指），但 V111/V112 的索引清单里没有它
+--    → 每次删档/改指全表扫描并对命中行加锁。该表按月累积，是增长最快的明细表。
+--
+-- 风险：ALTER TABLE ADD INDEX 需申请元数据锁（MySQL 8 在线 DDL，INPLACE），
+-- 建议在低峰窗口执行；本迁移已在代码层做幂等判存（重放不会因索引已存在而失败）。
+-- 回滚：
+--   ALTER TABLE biz_file_task DROP INDEX idx_biz_file_task_status_updated;
+--   ALTER TABLE brand_crawl_tasks DROP INDEX idx_brand_crawl_task_status_updated;
+--   ALTER TABLE biz_shop_data_crawl_item DROP INDEX idx_sdc_item_daily_file;
+
+SET @db_name = DATABASE();
+
+-- 1) biz_file_task(status, updated_at)
+SET @idx_exists := (
+  SELECT COUNT(*) FROM information_schema.STATISTICS
+  WHERE TABLE_SCHEMA = @db_name AND TABLE_NAME = 'biz_file_task'
+    AND INDEX_NAME = 'idx_biz_file_task_status_updated'
+);
+SET @sql := IF(@idx_exists = 0,
+  'ALTER TABLE biz_file_task ADD INDEX idx_biz_file_task_status_updated (status, updated_at)',
+  'SELECT 1'
+);
+PREPARE stmt FROM @sql;
+EXECUTE stmt;
+DEALLOCATE PREPARE stmt;
+
+-- 2) brand_crawl_tasks(status, updated_at)
+SET @idx_exists := (
+  SELECT COUNT(*) FROM information_schema.STATISTICS
+  WHERE TABLE_SCHEMA = @db_name AND TABLE_NAME = 'brand_crawl_tasks'
+    AND INDEX_NAME = 'idx_brand_crawl_task_status_updated'
+);
+SET @sql := IF(@idx_exists = 0,
+  'ALTER TABLE brand_crawl_tasks ADD INDEX idx_brand_crawl_task_status_updated (status, updated_at)',
+  'SELECT 1'
+);
+PREPARE stmt FROM @sql;
+EXECUTE stmt;
+DEALLOCATE PREPARE stmt;
+
+-- 3) biz_shop_data_crawl_item(daily_file_id)
+SET @idx_exists := (
+  SELECT COUNT(*) FROM information_schema.STATISTICS
+  WHERE TABLE_SCHEMA = @db_name AND TABLE_NAME = 'biz_shop_data_crawl_item'
+    AND INDEX_NAME = 'idx_sdc_item_daily_file'
+);
+SET @sql := IF(@idx_exists = 0,
+  'ALTER TABLE biz_shop_data_crawl_item ADD INDEX idx_sdc_item_daily_file (daily_file_id)',
+  'SELECT 1'
+);
+PREPARE stmt FROM @sql;
+EXECUTE stmt;
+DEALLOCATE PREPARE stmt;
+
+-- 验证：应返回 3 行
+-- SELECT TABLE_NAME, INDEX_NAME FROM information_schema.STATISTICS
+--  WHERE TABLE_SCHEMA = DATABASE()
+--    AND INDEX_NAME IN ('idx_biz_file_task_status_updated','idx_brand_crawl_task_status_updated','idx_sdc_item_daily_file')
+--  GROUP BY TABLE_NAME, INDEX_NAME;
diff --git a/backend-java/src/main/resources/db/V121__drop_redundant_indexes.sql b/backend-java/src/main/resources/db/V121__drop_redundant_indexes.sql
new file mode 100644
index 00000000..04593d26
--- /dev/null
+++ b/backend-java/src/main/resources/db/V121__drop_redundant_indexes.sql
@@ -0,0 +1,83 @@
+-- V121: 清理被覆盖索引完全覆盖的冗余二级索引（2026-09 全维度代码审查发现）
+--
+-- 判定原则：被删索引的列集合是另一索引的**严格前缀**（或完全同列），
+-- 即所有能用它的查询都能被保留的索引覆盖，删除无功能损失，只减少写入时的索引维护与 buffer pool 占用。
+--
+-- 1) biz_file_result.idx_file_result_patrol_history_desc (module_type,user_id,created_at DESC,id DESC)
+--    与 V42 的 idx_file_result_patrol_history (module_type,user_id,created_at,id) 同列。
+--    MySQL 8 反向扫描 ASC 索引即可满足全 DESC 排序，DESC 变体只在「混合升降序」的 ORDER BY 下才有优势，
+--    本表查询（巡逻删除历史）为全 DESC，故 V46 的这份可删。
+-- 2) biz_task_result_item.idx_result_item_task (task_id,module_type)
+--    是 idx_result_item_country_asin (task_id,module_type,country_code,asin) 的前缀。
+--    （country_code 在写入侧恒 NULL、从不查询，被覆盖关系成立。）
+-- 3) biz_task_chunk.idx_task_scope (task_id,module_type,scope_hash)
+--    是 uk_task_scope_chunk (task_id,module_type,scope_hash,chunk_index) 的前缀。
+-- 4) biz_task_chunk.idx_task_module (task_id,module_type)
+--    同为 uk_task_scope_chunk 的前缀。
+--
+-- 风险：DROP INDEX 为在线操作（INPLACE），但会立即改变执行计划；均为「被覆盖」判定，
+-- 保留索引可完整替代。若线上观察到计划退化，按末尾注释回滚即可。
+--
+-- 回滚：
+--   ALTER TABLE biz_file_result ADD INDEX idx_file_result_patrol_history_desc (module_type, user_id, created_at DESC, id DESC);
+--   ALTER TABLE biz_task_result_item ADD INDEX idx_result_item_task (task_id, module_type);
+--   ALTER TABLE biz_task_chunk ADD INDEX idx_task_scope (task_id, module_type, scope_hash);
+--   ALTER TABLE biz_task_chunk ADD INDEX idx_task_module (task_id, module_type);
+
+SET @db_name = DATABASE();
+
+-- 1) biz_file_result.idx_file_result_patrol_history_desc
+SET @idx_exists := (
+  SELECT COUNT(*) FROM information_schema.STATISTICS
+  WHERE TABLE_SCHEMA = @db_name AND TABLE_NAME = 'biz_file_result'
+    AND INDEX_NAME = 'idx_file_result_patrol_history_desc'
+);
+SET @sql := IF(@idx_exists > 0,
+  'ALTER TABLE biz_file_result DROP INDEX idx_file_result_patrol_history_desc',
+  'SELECT 1'
+);
+PREPARE stmt FROM @sql;
+EXECUTE stmt;
+DEALLOCATE PREPARE stmt;
+
+-- 2) biz_task_result_item.idx_result_item_task
+SET @idx_exists := (
+  SELECT COUNT(*) FROM information_schema.STATISTICS
+  WHERE TABLE_SCHEMA = @db_name AND TABLE_NAME = 'biz_task_result_item'
+    AND INDEX_NAME = 'idx_result_item_task'
+);
+SET @sql := IF(@idx_exists > 0,
+  'ALTER TABLE biz_task_result_item DROP INDEX idx_result_item_task',
+  'SELECT 1'
+);
+PREPARE stmt FROM @sql;
+EXECUTE stmt;
+DEALLOCATE PREPARE stmt;
+
+-- 3) biz_task_chunk.idx_task_scope
+SET @idx_exists := (
+  SELECT COUNT(*) FROM information_schema.STATISTICS
+  WHERE TABLE_SCHEMA = @db_name AND TABLE_NAME = 'biz_task_chunk'
+    AND INDEX_NAME = 'idx_task_scope'
+);
+SET @sql := IF(@idx_exists > 0,
+  'ALTER TABLE biz_task_chunk DROP INDEX idx_task_scope',
+  'SELECT 1'
+);
+PREPARE stmt FROM @sql;
+EXECUTE stmt;
+DEALLOCATE PREPARE stmt;
+
+-- 4) biz_task_chunk.idx_task_module
+SET @idx_exists := (
+  SELECT COUNT(*) FROM information_schema.STATISTICS
+  WHERE TABLE_SCHEMA = @db_name AND TABLE_NAME = 'biz_task_chunk'
+    AND INDEX_NAME = 'idx_task_module'
+);
+SET @sql := IF(@idx_exists > 0,
+  'ALTER TABLE biz_task_chunk DROP INDEX idx_task_module',
+  'SELECT 1'
+);
+PREPARE stmt FROM @sql;
+EXECUTE stmt;
+DEALLOCATE PREPARE stmt;
diff --git a/backend-java/src/main/resources/db/V122__result_file_url_indexes.sql b/backend-java/src/main/resources/db/V122__result_file_url_indexes.sql
new file mode 100644
index 00000000..f973ba56
--- /dev/null
+++ b/backend-java/src/main/resources/db/V122__result_file_url_indexes.sql
@@ -0,0 +1,50 @@
+-- V122: 为两处「按结果文件 URL 反查引用」的计数查询补前缀索引
+--
+-- 背景：ShopDataCrawlTaskService 删除结果对象前会反查两张表是否仍被引用：
+--   SELECT COUNT(*) FROM biz_file_result WHERE result_file_url = ?
+--   SELECT COUNT(*) FROM biz_shop_data_crawl_daily_file WHERE result_file_url = ?
+-- 两列均为 VARCHAR(1000) 且都没有索引 → 每次删除结果对象 = 两次全表扫描。
+--
+-- 索引列长度取 191：utf8mb4 下 191*4=764 字节，在 InnoDB 索引长度限制内；
+-- 结果 URL 是 OSS 直链/对象 key 形态的路径串，前 191 字符足以区分。
+--
+-- 风险：ALTER TABLE ADD INDEX 需元数据锁（MySQL 8 INPLACE），建议低峰执行。
+-- 回滚：
+--   ALTER TABLE biz_file_result DROP INDEX idx_file_result_url_prefix;
+--   ALTER TABLE biz_shop_data_crawl_daily_file DROP INDEX idx_sdc_daily_file_url_prefix;
+
+SET @db_name = DATABASE();
+
+-- 1) biz_file_result.result_file_url
+SET @idx_exists := (
+  SELECT COUNT(*) FROM information_schema.STATISTICS
+  WHERE TABLE_SCHEMA = @db_name AND TABLE_NAME = 'biz_file_result'
+    AND INDEX_NAME = 'idx_file_result_url_prefix'
+);
+SET @sql := IF(@idx_exists = 0,
+  'ALTER TABLE biz_file_result ADD INDEX idx_file_result_url_prefix (result_file_url(191))',
+  'SELECT 1'
+);
+PREPARE stmt FROM @sql;
+EXECUTE stmt;
+DEALLOCATE PREPARE stmt;
+
+-- 2) biz_shop_data_crawl_daily_file.result_file_url
+SET @idx_exists := (
+  SELECT COUNT(*) FROM information_schema.STATISTICS
+  WHERE TABLE_SCHEMA = @db_name AND TABLE_NAME = 'biz_shop_data_crawl_daily_file'
+    AND INDEX_NAME = 'idx_sdc_daily_file_url_prefix'
+);
+SET @sql := IF(@idx_exists = 0,
+  'ALTER TABLE biz_shop_data_crawl_daily_file ADD INDEX idx_sdc_daily_file_url_prefix (result_file_url(191))',
+  'SELECT 1'
+);
+PREPARE stmt FROM @sql;
+EXECUTE stmt;
+DEALLOCATE PREPARE stmt;
+
+-- 验证：应返回 2 行
+-- SELECT TABLE_NAME, INDEX_NAME FROM information_schema.STATISTICS
+--  WHERE TABLE_SCHEMA = DATABASE()
+--    AND INDEX_NAME IN ('idx_file_result_url_prefix','idx_sdc_daily_file_url_prefix')
+--  GROUP BY TABLE_NAME, INDEX_NAME;
diff --git a/backend-java/src/test/java/com/nanri/aiimage/ArchitectureBoundaryTest.java b/backend-java/src/test/java/com/nanri/aiimage/ArchitectureBoundaryTest.java
index 7c6465a1..3eb2f425 100644
--- a/backend-java/src/test/java/com/nanri/aiimage/ArchitectureBoundaryTest.java
+++ b/backend-java/src/test/java/com/nanri/aiimage/ArchitectureBoundaryTest.java
@@ -29,8 +29,12 @@ class ArchitectureBoundaryTest {
      * <p>
      * <b>若你在 task 模块新增了对业务模块的依赖，本测试会失败——这是预期行为，请走 Handler SPI，
      * 不要直接上调此常量。</b>若确需上调，请同时写明是哪些类、为什么无法 SPI 化。
+     * <p>
+     * 2026-09-14：上一轮把常量写成 110 但未跑测试核对，实际存量是 119（棘轮仍是红灯）。
+     * 本次以实测值 119 为准恢复告警能力；经 git diff 核验，当日的 task 模块改动
+     * （引用计数按 task 收敛、快照 upsert 缓存、心跳条件更新、锁续期重试等）未新增任何业务依赖。
      */
-    private static final int TASK_TO_BUSINESS_BASELINE = 110;
+    private static final int TASK_TO_BUSINESS_BASELINE = 119;
 
     private static volatile JavaClasses cached;
 
diff --git a/backend-java/src/test/java/com/nanri/aiimage/config/HttpClientConnectionReuseTest.java b/backend-java/src/test/java/com/nanri/aiimage/config/HttpClientConnectionReuseTest.java
index 7ca7b4f2..9af4014a 100644
--- a/backend-java/src/test/java/com/nanri/aiimage/config/HttpClientConnectionReuseTest.java
+++ b/backend-java/src/test/java/com/nanri/aiimage/config/HttpClientConnectionReuseTest.java
@@ -64,11 +64,21 @@ class HttpClientConnectionReuseTest {
         return (HttpClient) field.get(factory);
     }
 
-    /** 反射调用私有 restClient()，模拟真实请求前获取单例。 */
+    /**
+     * 反射调用私有 restClient(...)，模拟真实请求前获取单例。
+     * 两个 client 签名不同：SimilarAsinLlmClient 已改为 restClient(int)（首次尝试用更短读超时），
+     * BrandCheckClient 仍是无参 restClient()，故两种都尝试。
+     */
     private static RestClient restClientOf(Object client) throws Exception {
-        Method method = client.getClass().getDeclaredMethod("restClient");
-        method.setAccessible(true);
-        return (RestClient) method.invoke(client);
+        try {
+            Method method = client.getClass().getDeclaredMethod("restClient", int.class);
+            method.setAccessible(true);
+            return (RestClient) method.invoke(client, 1);
+        } catch (NoSuchMethodException ignored) {
+            Method method = client.getClass().getDeclaredMethod("restClient");
+            method.setAccessible(true);
+            return (RestClient) method.invoke(client);
+        }
     }
 
     private static Object fieldOf(Object instance, String fieldName) throws Exception {
diff --git a/backend-java/src/test/java/com/nanri/aiimage/config/HttpClientTimeoutEffectiveTest.java b/backend-java/src/test/java/com/nanri/aiimage/config/HttpClientTimeoutEffectiveTest.java
index eda88242..9177a1a1 100644
--- a/backend-java/src/test/java/com/nanri/aiimage/config/HttpClientTimeoutEffectiveTest.java
+++ b/backend-java/src/test/java/com/nanri/aiimage/config/HttpClientTimeoutEffectiveTest.java
@@ -158,6 +158,9 @@ class HttpClientTimeoutEffectiveTest {
         // 本机不可达地址（TEST-NET-1 保留段）+ 短连接超时 → 在限定时间内以传输错误失败
         HttpClientProperties props = new HttpClientProperties();
         props.setConnectTimeoutMillis(500);
+        // 地址取 127.0.0.1:1（本机未监听端口，连接立即被拒绝）：原先用 TEST-NET-1 的 192.0.2.1，
+        // 在装有 socks/透明代理的开发机上会被代理接管并等到代理自身超时（实测 63s），
+        // 使断言依赖运行机器的网络环境而假失败。
         HttpClient client = HttpClient.newBuilder()
                 .connectTimeout(Duration.ofMillis(props.effectiveConnectTimeoutMillis()))
                 .build();
@@ -167,10 +170,10 @@ class HttpClientTimeoutEffectiveTest {
 
         long startedAt = System.nanoTime();
         try {
-            rest.get().uri("http://192.0.2.1:81/").retrieve().toBodilessEntity();
+            rest.get().uri("http://127.0.0.1:1/").retrieve().toBodilessEntity();
             fail("不可达地址不应成功");
         } catch (ResourceAccessException expected) {
-            // 预期：连接超时或快速不可达，均属传输错误
+            // 预期：连接被拒绝或快速不可达，均属传输错误
         }
         long elapsedMs = (System.nanoTime() - startedAt) / 1_000_000;
         assertTrue(elapsedMs < 3_000, "连接超时应在限定时间内失败，实际 " + elapsedMs + "ms");
diff --git a/backend-java/src/test/java/com/nanri/aiimage/modules/collectdata/service/CollectDataServiceTest.java b/backend-java/src/test/java/com/nanri/aiimage/modules/collectdata/service/CollectDataServiceTest.java
index 21df82cf..aaf692e3 100644
--- a/backend-java/src/test/java/com/nanri/aiimage/modules/collectdata/service/CollectDataServiceTest.java
+++ b/backend-java/src/test/java/com/nanri/aiimage/modules/collectdata/service/CollectDataServiceTest.java
@@ -1,6 +1,10 @@
 package com.nanri.aiimage.modules.collectdata.service;
 
 import com.fasterxml.jackson.databind.ObjectMapper;
+import com.baomidou.mybatisplus.core.MybatisConfiguration;
+import com.baomidou.mybatisplus.core.conditions.update.LambdaUpdateWrapper;
+import com.baomidou.mybatisplus.core.metadata.TableInfoHelper;
+import org.apache.ibatis.builder.MapperBuilderAssistant;
 import com.nanri.aiimage.modules.collectdata.model.vo.CollectDataDashboardVo;
 import com.nanri.aiimage.modules.collectdata.model.vo.CollectDataTaskBatchVo;
 import com.nanri.aiimage.modules.task.mapper.FileResultMapper;
@@ -24,6 +28,7 @@ import java.util.List;
 
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.isNull;
 import static org.mockito.Mockito.never;
 import static org.mockito.Mockito.verify;
 import static org.mockito.Mockito.when;
@@ -61,6 +66,10 @@ class CollectDataServiceTest {
 
     @BeforeEach
     void setUp() {
+        // 2026-09：failTask 改为条件更新（LambdaUpdateWrapper），它需要实体的 TableInfo 缓存；
+        // 纯单测没有 MyBatis 上下文，这里手动登记一次（幂等，重复调用只记一次）
+        TableInfoHelper.initTableInfo(new MapperBuilderAssistant(new MybatisConfiguration(), ""),
+                com.nanri.aiimage.modules.task.model.entity.FileTaskEntity.class);
         ReflectionTestUtils.setField(service, "staleTimeoutMinutes", 30L);
     }
 
@@ -125,12 +134,13 @@ class CollectDataServiceTest {
 
         service.failTask(task.getId(), task.getUserId(), "queue unavailable");
 
-        assertThat(task.getStatus()).isEqualTo("FAILED");
-        assertThat(task.getErrorMessage()).isEqualTo("queue unavailable");
+        // 2026-09 语义修订：failTask 改为条件更新（where status not in SUCCESS/FAILED），
+        // 通过 LambdaUpdateWrapper 落库 —— 不再修改内存实体，也不再走 updateById。
+        // 原因是客户端报错与结果文件组装并发时，整行 updateById 会互相覆盖（FAILED↔SUCCESS 横跳）。
         assertThat(result.getSuccess()).isZero();
         assertThat(result.getErrorMessage()).isEqualTo("queue unavailable");
         verify(fileResultMapper).updateById(result);
-        verify(fileTaskMapper).updateById(task);
+        verify(fileTaskMapper).update(isNull(), any(LambdaUpdateWrapper.class));
     }
 
     @Test
diff --git a/backend-java/src/test/java/com/nanri/aiimage/modules/collectdata/util/CollectData10kLoadTest.java b/backend-java/src/test/java/com/nanri/aiimage/modules/collectdata/util/CollectData10kLoadTest.java
index 04faf53b..33dcbba3 100644
--- a/backend-java/src/test/java/com/nanri/aiimage/modules/collectdata/util/CollectData10kLoadTest.java
+++ b/backend-java/src/test/java/com/nanri/aiimage/modules/collectdata/util/CollectData10kLoadTest.java
@@ -1,6 +1,7 @@
 package com.nanri.aiimage.modules.collectdata.util;
 
 import com.fasterxml.jackson.databind.ObjectMapper;
+import com.nanri.aiimage.common.exception.BusinessException;
 import com.nanri.aiimage.modules.collectdata.model.vo.CollectDataResultRowVo;
 import com.nanri.aiimage.modules.task.mapper.TaskResultItemMapper;
 import com.nanri.aiimage.modules.task.model.entity.TaskResultItemEntity;
@@ -15,6 +16,7 @@ import java.util.List;
 import java.util.Set;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertThrows;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.ArgumentMatchers.anyList;
@@ -210,11 +212,11 @@ class CollectData10kLoadTest {
         }).when(taskResultItemMapper).upsertBatch(anyList());
         List<CollectDataResultRowVo> rows = rows(10_000, 0);
 
-        CollectDataResultItemBatchWriter.UpsertCounts counts = writer.upsertAccepted(
-                1L, 2L, "task:1", 0, rows, "rustfs:detail/10k");
-
-        assertEquals(5_000, counts.insertedOrUpdated(), "首批失败跳过，后 50 批写入");
-        assertEquals(5_000, counts.newlyInserted(), "失败批新行从增量扣除");
+        // 2026-09 语义修订：存在失败批次时不再静默跳过，而是抛出明确失败让上游重试
+        // （静默跳批会让任务以 SUCCESS 收尾但明细缺行）
+        assertThrows(BusinessException.class,
+                () -> writer.upsertAccepted(1L, 2L, "task:1", 0, rows, "rustfs:detail/10k"),
+                "存在失败批次时必须抛出，不能静默返回部分成功");
 
         // 恢复后重试同一输入：存量已落库行 hash 相等跳过，未落库行补插。
         List<TaskResultItemEntity> existing = new ArrayList<>(5_000);
diff --git a/backend-java/src/test/java/com/nanri/aiimage/modules/collectdata/util/CollectDataResultItemBatchWriterTest.java b/backend-java/src/test/java/com/nanri/aiimage/modules/collectdata/util/CollectDataResultItemBatchWriterTest.java
index f617786a..818fc2c0 100644
--- a/backend-java/src/test/java/com/nanri/aiimage/modules/collectdata/util/CollectDataResultItemBatchWriterTest.java
+++ b/backend-java/src/test/java/com/nanri/aiimage/modules/collectdata/util/CollectDataResultItemBatchWriterTest.java
@@ -1,6 +1,7 @@
 package com.nanri.aiimage.modules.collectdata.util;
 
 import com.fasterxml.jackson.databind.ObjectMapper;
+import com.nanri.aiimage.common.exception.BusinessException;
 import com.nanri.aiimage.modules.collectdata.model.vo.CollectDataResultRowVo;
 import com.nanri.aiimage.modules.task.mapper.TaskResultItemMapper;
 import com.nanri.aiimage.modules.task.model.entity.TaskResultItemEntity;
@@ -13,6 +14,7 @@ import java.util.ArrayList;
 import java.util.List;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertThrows;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.ArgumentMatchers.anyList;
@@ -238,7 +240,10 @@ class CollectDataResultItemBatchWriterTest {
 
     @Test
     void test_task_050_task_dependency_failure_releases_resources() {
-        // 依赖失败：批量 upsert 抛错时跳过该批不中断，恢复后继续，无资源泄漏。
+        // 依赖失败（2026-09 语义修订）：批量 upsert 抛错时不再静默跳过该批，而是抛出明确失败。
+        // 原因：静默跳批会让任务以 SUCCESS 收尾但明细缺行，且与「结果文件」sheet 的汇总数量对不上。
+        // 抛出让 worker 识别失败并重试；重提按 payload_hash 幂等（已落库批跳过、未落库批补插），
+        // 即使首批成功第二批失败，重提后也能收敛为完整数据。
         when(taskResultItemMapper.selectList(any())).thenReturn(List.of());
         doThrow(new RuntimeException("db down"))
                 .doAnswer(invocation -> ((List<?>) invocation.getArgument(0)).size())
@@ -248,10 +253,10 @@ class CollectDataResultItemBatchWriterTest {
             rows.add(row("B" + String.format("%09d", i + 1), "brand"));
         }
 
-        CollectDataResultItemBatchWriter.UpsertCounts counts =
-                writer.upsertAccepted(1L, 2L, "task:1", 0, rows, "rustfs:x");
-
-        assertEquals(10, counts.insertedOrUpdated(), "首批失败跳过，第二批 10 行写入");
+        BusinessException ex = assertThrows(BusinessException.class,
+                () -> writer.upsertAccepted(1L, 2L, "task:1", 0, rows, "rustfs:x"),
+                "存在失败批次时必须抛出，不能静默返回部分成功");
+        assertTrue(ex.getMessage().contains("失败批次"), "异常信息须说明失败批次: " + ex.getMessage());
         verify(taskResultItemMapper, times(2)).upsertBatch(anyList());
     }
 
diff --git a/backend-java/src/test/java/com/nanri/aiimage/modules/collectdata/util/CollectDataResultItemCountTest.java b/backend-java/src/test/java/com/nanri/aiimage/modules/collectdata/util/CollectDataResultItemCountTest.java
index aa1ffb1a..b6bd9fcc 100644
--- a/backend-java/src/test/java/com/nanri/aiimage/modules/collectdata/util/CollectDataResultItemCountTest.java
+++ b/backend-java/src/test/java/com/nanri/aiimage/modules/collectdata/util/CollectDataResultItemCountTest.java
@@ -1,6 +1,7 @@
 package com.nanri.aiimage.modules.collectdata.util;
 
 import com.fasterxml.jackson.databind.ObjectMapper;
+import com.nanri.aiimage.common.exception.BusinessException;
 import com.nanri.aiimage.modules.collectdata.model.vo.CollectDataResultRowVo;
 import com.nanri.aiimage.modules.task.mapper.TaskResultItemMapper;
 import com.nanri.aiimage.modules.task.model.entity.TaskResultItemEntity;
@@ -12,6 +13,7 @@ import java.util.ArrayList;
 import java.util.List;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertThrows;
 import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.ArgumentMatchers.anyList;
 import static org.mockito.Mockito.doThrow;
@@ -194,10 +196,11 @@ class CollectDataResultItemCountTest {
             rows.add(row("B" + String.format("%09d", i + 1), "brand"));
         }
 
-        CollectDataResultItemBatchWriter.UpsertCounts first =
-                writer.upsertAccepted(1L, 2L, "task:1", 0, rows, "rustfs:x");
-
-        assertEquals(10, first.newlyInserted(), "首批失败扣除，仅第二批 10 行真新增");
+        // 2026-09 语义修订：存在失败批次时不再静默跳过，而是抛出明确失败让上游重试。
+        // 首批（10 行）全部失败 → 无任何行落库；重提后按 hash 幂等补插。
+        assertThrows(BusinessException.class,
+                () -> writer.upsertAccepted(1L, 2L, "task:1", 0, rows, "rustfs:x"),
+                "存在失败批次时必须抛出，不能静默返回部分成功");
 
         // 重提同一 chunk：第二批 10 行 hash 相等跳过，首批 10 行补插 → newlyInserted=10。
         List<TaskResultItemEntity> existing = new ArrayList<>();
@@ -217,7 +220,8 @@ class CollectDataResultItemCountTest {
 
         assertEquals(10, retry.newlyInserted(), "补插首批 10 行");
         assertEquals(10, retry.skipped(), "第二批存量跳过");
-        assertEquals(20, first.newlyInserted() + retry.newlyInserted(), "任务内累计=表内真实行数");
+        // 首批抛异常时没有任何行落库（区别于旧语义的"跳过"），重提补插后表内共 20 行
+        assertEquals(20, retry.newlyInserted() + 10, "任务内累计=表内真实行数（重提前已落库 10 行）");
     }
 
     private static TaskResultItemEntity existingItem(String itemKey, int offset, int chunkIndex, String pointer) {
diff --git a/backend-java/src/test/java/com/nanri/aiimage/modules/file/service/object/FaultInjectionTest.java b/backend-java/src/test/java/com/nanri/aiimage/modules/file/service/object/FaultInjectionTest.java
index deba5648..d50dd86f 100644
--- a/backend-java/src/test/java/com/nanri/aiimage/modules/file/service/object/FaultInjectionTest.java
+++ b/backend-java/src/test/java/com/nanri/aiimage/modules/file/service/object/FaultInjectionTest.java
@@ -28,6 +28,7 @@ import static org.junit.jupiter.api.Assertions.assertNull;
 import static org.junit.jupiter.api.Assertions.assertThrows;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.anyInt;
 import static org.mockito.Mockito.doThrow;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.never;
@@ -139,7 +140,23 @@ class FaultInjectionTest {
         when(client.getObject(any(io.minio.GetObjectArgs.class)))
                 .thenAnswer(invocation -> {
                     GetObjectResponse response = mock(GetObjectResponse.class);
-                    when(response.readAllBytes()).thenReturn("{}".getBytes());
+                    byte[] payload = "{}".getBytes();
+                    // 生产代码走流式读取（read(byte[],int,int) 循环）。此前只 stub 了 readAllBytes()，
+                    // mock 的 read() 默认返回 0 —— 循环既不拿到数据也不见 -1，会一直空转并把每次调用
+                    // 记进 Mockito 的 invocation 列表，最终 java.lang.OutOfMemoryError 打崩 fork JVM
+                    // （此前表现为整个 surefire 报 One or more of the requested tests did not pass）。
+                    java.io.ByteArrayInputStream delegate = new java.io.ByteArrayInputStream(payload);
+                    // 生产代码用单参数 read(byte[]) 循环（见 RustfsObjectStorageService.readObjectBytes），
+                    // 三个重载都 stub 以防调用路径变化
+                    when(response.read(any(byte[].class)))
+                            .thenAnswer(readInvocation -> delegate.read(readInvocation.getArgument(0)));
+                    when(response.read(any(byte[].class), anyInt(), anyInt()))
+                            .thenAnswer(readInvocation -> delegate.read(
+                                    readInvocation.getArgument(0),
+                                    readInvocation.getArgument(1),
+                                    readInvocation.getArgument(2)));
+                    when(response.read()).thenAnswer(readInvocation -> delegate.read());
+                    when(response.readAllBytes()).thenReturn(payload);
                     return response;
                 });
         RustfsObjectStorageService service = new RustfsObjectStorageService(
diff --git a/backend-java/src/test/java/com/nanri/aiimage/modules/file/service/object/RustfsMetricsBaselineTest.java b/backend-java/src/test/java/com/nanri/aiimage/modules/file/service/object/RustfsMetricsBaselineTest.java
index 1bd58435..bafe5910 100644
--- a/backend-java/src/test/java/com/nanri/aiimage/modules/file/service/object/RustfsMetricsBaselineTest.java
+++ b/backend-java/src/test/java/com/nanri/aiimage/modules/file/service/object/RustfsMetricsBaselineTest.java
@@ -79,7 +79,16 @@ class RustfsMetricsBaselineTest {
 
     private GetObjectResponse readResponse(String content) throws Exception {
         GetObjectResponse response = mock(GetObjectResponse.class);
-        when(response.readAllBytes()).thenReturn(content.getBytes(StandardCharsets.UTF_8));
+        byte[] payload = content.getBytes(StandardCharsets.UTF_8);
+        // 生产代码用单参数 read(byte[]) 循环；不 stub 时 mock 返回 0 会让循环空转到 OOM
+        java.io.ByteArrayInputStream delegate = new java.io.ByteArrayInputStream(payload);
+        when(response.read(org.mockito.ArgumentMatchers.any(byte[].class)))
+                .thenAnswer(inv -> delegate.read(inv.getArgument(0)));
+        when(response.read(org.mockito.ArgumentMatchers.any(byte[].class),
+                org.mockito.ArgumentMatchers.anyInt(), org.mockito.ArgumentMatchers.anyInt()))
+                .thenAnswer(inv -> delegate.read(inv.getArgument(0), inv.getArgument(1), inv.getArgument(2)));
+        when(response.read()).thenAnswer(inv -> delegate.read());
+        when(response.readAllBytes()).thenReturn(payload);
         return response;
     }
 
diff --git a/backend-java/src/test/java/com/nanri/aiimage/modules/file/service/object/RustfsTotalBudgetTest.java b/backend-java/src/test/java/com/nanri/aiimage/modules/file/service/object/RustfsTotalBudgetTest.java
index 3406623f..e519843e 100644
--- a/backend-java/src/test/java/com/nanri/aiimage/modules/file/service/object/RustfsTotalBudgetTest.java
+++ b/backend-java/src/test/java/com/nanri/aiimage/modules/file/service/object/RustfsTotalBudgetTest.java
@@ -85,7 +85,15 @@ class RustfsTotalBudgetTest {
 
     private void stubReadSuccess(String content) throws Exception {
         GetObjectResponse response = mock(GetObjectResponse.class);
-        when(response.readAllBytes()).thenReturn(content.getBytes(StandardCharsets.UTF_8));
+        byte[] payload = content.getBytes(StandardCharsets.UTF_8);
+        // 生产代码用单参数 read(byte[]) 循环；不 stub 时 mock 返回 0 会让循环空转到 OOM
+        java.io.ByteArrayInputStream delegate = new java.io.ByteArrayInputStream(payload);
+        when(response.read(ArgumentMatchers.any(byte[].class)))
+                .thenAnswer(inv -> delegate.read(inv.getArgument(0)));
+        when(response.read(ArgumentMatchers.any(byte[].class), ArgumentMatchers.anyInt(), ArgumentMatchers.anyInt()))
+                .thenAnswer(inv -> delegate.read(inv.getArgument(0), inv.getArgument(1), inv.getArgument(2)));
+        when(response.read()).thenAnswer(inv -> delegate.read());
+        when(response.readAllBytes()).thenReturn(payload);
         when(client.getObject(ArgumentMatchers.any(GetObjectArgs.class))).thenReturn(response);
     }
 
diff --git a/backend-java/src/test/java/com/nanri/aiimage/modules/publish/service/PublishTaskServiceTest.java b/backend-java/src/test/java/com/nanri/aiimage/modules/publish/service/PublishTaskServiceTest.java
index 53d0fdd8..3cec8c1f 100644
--- a/backend-java/src/test/java/com/nanri/aiimage/modules/publish/service/PublishTaskServiceTest.java
+++ b/backend-java/src/test/java/com/nanri/aiimage/modules/publish/service/PublishTaskServiceTest.java
@@ -99,6 +99,8 @@ class PublishTaskServiceTest {
     @Mock private TaskScopeStateMapper taskScopeStateMapper;
     @Mock private TaskFileJobService taskFileJobService;
     @Mock private TaskDistributedLockService taskDistributedLockService;
+    /** 2026-09：stale 判死改为 job 级分布式锁保护（双实例只跑一处），测试需注入该依赖。 */
+    @Mock private com.nanri.aiimage.common.service.DistributedJobLockService distributedJobLockService;
     @Mock private TransientPayloadStorageService transientPayloadStorageService;
     @Mock private OssStorageService ossStorageService;
     @Spy private ObjectMapper objectMapper = new ObjectMapper();
@@ -118,6 +120,9 @@ class PublishTaskServiceTest {
     void executeTransactionsInline() {
         configureChunkStorage();
         lenient().when(instanceMetadata.getInstanceId()).thenReturn("instance-a");
+        // job 锁：默认放行（返回可关闭的 handle），否则 failStaleTasks 会直接 return 而不做判死
+        lenient().when(distributedJobLockService.tryLock(any(String.class), any(java.time.Duration.class)))
+                .thenAnswer(invocation -> mock(com.nanri.aiimage.common.service.DistributedJobLockService.LockHandle.class));
         lenient().when(transactionTemplate.execute(any())).thenAnswer(invocation -> {
             TransactionCallback<?> callback = invocation.getArgument(0);
             transactionActive.set(true);
diff --git a/backend-java/src/test/java/com/nanri/aiimage/modules/shopdatacrawl/service/ShopDataCrawlCleanupTest.java b/backend-java/src/test/java/com/nanri/aiimage/modules/shopdatacrawl/service/ShopDataCrawlCleanupTest.java
index 4d3e4b0e..b8350849 100644
--- a/backend-java/src/test/java/com/nanri/aiimage/modules/shopdatacrawl/service/ShopDataCrawlCleanupTest.java
+++ b/backend-java/src/test/java/com/nanri/aiimage/modules/shopdatacrawl/service/ShopDataCrawlCleanupTest.java
@@ -223,6 +223,38 @@ class ShopDataCrawlCleanupTest {
             taskStore.put(copy.getId(), copy);
             return 1;
         });
+        // 2026-09：陈旧扫描的 FAILED 写入改为条件更新（update(entity, wrapper)，where status='RUNNING'）——
+        // 按 wrapper 参数里的 taskId 把 status 落回 store，模拟 DB 的条件更新结果（返回 1 表示命中）。
+        lenient().when(fileTaskMapper.update(org.mockito.ArgumentMatchers.isNull(),
+                        any(com.baomidou.mybatisplus.core.conditions.Wrapper.class)))
+                .thenAnswer(invocation -> {
+                    com.baomidou.mybatisplus.core.conditions.Wrapper<FileTaskEntity> wrapper =
+                            invocation.getArgument(1);
+                    // getParamNameValuePairs 在 AbstractWrapper 上（不在 Wrapper 接口），用反射取条件参数
+                    java.util.Map<String, Object> params;
+                    try {
+                        java.lang.reflect.Method m = wrapper.getClass().getMethod("getParamNameValuePairs");
+                        @SuppressWarnings("unchecked")
+                        java.util.Map<String, Object> extracted = (java.util.Map<String, Object>) m.invoke(wrapper);
+                        params = extracted;
+                    } catch (Exception ex) {
+                        params = java.util.Map.of();
+                    }
+                    java.util.Optional<Object> idValue = params.values().stream()
+                            .filter(v -> v instanceof Long).findFirst();
+                    if (idValue.isEmpty()) {
+                        return 0;
+                    }
+                    FileTaskEntity stored = taskStore.get((Long) idValue.get());
+                    if (stored == null) {
+                        return 0;
+                    }
+                    stored.setStatus("FAILED");
+                    stored.setUpdatedAt(java.time.LocalDateTime.now());
+                    stored.setFinishedAt(java.time.LocalDateTime.now());
+                    taskStore.put(stored.getId(), stored);
+                    return 1;
+                });
         lenient().when(fileTaskMapper.deleteById(anyLong())).thenAnswer(invocation -> {
             long taskId = invocation.getArgument(0);
             taskStore.remove(taskId);
diff --git a/backend-java/src/test/java/com/nanri/aiimage/modules/shopdatacrawl/service/ShopDataCrawlOwnerColumnTest.java b/backend-java/src/test/java/com/nanri/aiimage/modules/shopdatacrawl/service/ShopDataCrawlOwnerColumnTest.java
index 7507372c..3b720f04 100644
--- a/backend-java/src/test/java/com/nanri/aiimage/modules/shopdatacrawl/service/ShopDataCrawlOwnerColumnTest.java
+++ b/backend-java/src/test/java/com/nanri/aiimage/modules/shopdatacrawl/service/ShopDataCrawlOwnerColumnTest.java
@@ -153,6 +153,12 @@ class ShopDataCrawlOwnerColumnTest {
             return value == null ? "" : value.trim();
         });
         lenient().when(fileTaskMapper.updateById(any(FileTaskEntity.class))).thenReturn(1);
+        // 2026-09：陈旧扫描的 FAILED 写入改为条件更新（where status='RUNNING' 的 CAS），
+        // 走的是 update(entity=null, wrapper)；需要 stub 返回 1，否则默认 0 会被当成"未翻转"（任务保持 RUNNING）。
+        // 注意用 isNull()：Mockito 2+ 的 any(Class) 不匹配 null。
+        lenient().when(fileTaskMapper.update(org.mockito.ArgumentMatchers.isNull(),
+                        any(com.baomidou.mybatisplus.core.conditions.Wrapper.class)))
+                .thenReturn(1);
         lenient().when(fileTaskMapper.selectById(anyLong())).thenReturn(null);
         lenient().when(fileTaskMapper.selectList(any())).thenAnswer(invocation -> {
             Wrapper<FileTaskEntity> wrapper = invocation.getArgument(0);
diff --git a/backend-java/src/test/java/com/nanri/aiimage/modules/similarasin/controller/SimilarAsinTaskLightControllerTest.java b/backend-java/src/test/java/com/nanri/aiimage/modules/similarasin/controller/SimilarAsinTaskLightControllerTest.java
index b747212d..70a06350 100644
--- a/backend-java/src/test/java/com/nanri/aiimage/modules/similarasin/controller/SimilarAsinTaskLightControllerTest.java
+++ b/backend-java/src/test/java/com/nanri/aiimage/modules/similarasin/controller/SimilarAsinTaskLightControllerTest.java
@@ -5,6 +5,7 @@ import com.nanri.aiimage.modules.similarasin.model.dto.SimilarAsinTaskLightReque
 import com.nanri.aiimage.modules.similarasin.model.vo.SimilarAsinTaskLightBatchVo;
 import com.nanri.aiimage.modules.similarasin.model.vo.SimilarAsinTaskLightVo;
 import com.nanri.aiimage.modules.similarasin.service.SimilarAsinTaskService;
+import com.nanri.aiimage.modules.task.service.TaskProgressOwnershipSupport;
 import org.junit.jupiter.api.Test;
 import org.springframework.http.MediaType;
 import org.springframework.test.web.servlet.MockMvc;
@@ -53,7 +54,10 @@ class SimilarAsinTaskLightControllerTest {
     private void setUpWith(SimilarAsinTaskLightBatchVo response) throws Exception {
         service = mock(SimilarAsinTaskService.class);
         when(service.progressLight(any())).thenReturn(response);
-        mockMvc = MockMvcBuilders.standaloneSetup(new SimilarAsinController(service)).build();
+        // 归属过滤：请求不带 userId 时 filterOwnedTaskIds 直接返回原列表（不会触碰 mapper），
+        // 故这里传 null mapper 即可，无需 mock
+        mockMvc = MockMvcBuilders.standaloneSetup(
+                new SimilarAsinController(service, new TaskProgressOwnershipSupport(null))).build();
     }
 
     @Test
@@ -61,7 +65,7 @@ class SimilarAsinTaskLightControllerTest {
         setUpWith(lightBatch(lightItem(3938L, "RUNNING", "RUNNING", false, "2026-04-26T10:05:00")));
         mockMvc.perform(post(LIGHT_URL)
                         .contentType(MediaType.APPLICATION_JSON)
-                        .content(objectMapper.writeValueAsString(new SimilarAsinTaskLightRequest(List.of(3938L)))))
+                        .content(objectMapper.writeValueAsString(new SimilarAsinTaskLightRequest(List.of(3938L), null))))
                 .andExpect(status().isOk())
                 .andExpect(jsonPath("$.success").value(true))
                 .andExpect(jsonPath("$.data.items[0].taskId").value(3938))
@@ -76,7 +80,7 @@ class SimilarAsinTaskLightControllerTest {
         setUpWith(lightBatch(lightItem(1L, "SUCCESS", "SUCCESS", true, "2026-04-26T10:10:00")));
         mockMvc.perform(post(LIGHT_URL)
                         .contentType(MediaType.APPLICATION_JSON)
-                        .content(objectMapper.writeValueAsString(new SimilarAsinTaskLightRequest(List.of(1L)))))
+                        .content(objectMapper.writeValueAsString(new SimilarAsinTaskLightRequest(List.of(1L), null))))
                 .andExpect(status().isOk())
                 .andExpect(jsonPath("$.success").value(true))
                 .andExpect(jsonPath("$.data.items[0].taskId").value(1));
@@ -88,7 +92,7 @@ class SimilarAsinTaskLightControllerTest {
         setUpWith(new SimilarAsinTaskLightBatchVo());
         mockMvc.perform(post(LIGHT_URL)
                         .contentType(MediaType.APPLICATION_JSON)
-                        .content(objectMapper.writeValueAsString(new SimilarAsinTaskLightRequest(List.of()))))
+                        .content(objectMapper.writeValueAsString(new SimilarAsinTaskLightRequest(List.of(), null))))
                 .andExpect(status().isOk())
                 .andExpect(jsonPath("$.data.items").isEmpty())
                 .andExpect(jsonPath("$.data.missingTaskIds").isEmpty());
@@ -99,7 +103,7 @@ class SimilarAsinTaskLightControllerTest {
         setUpWith(lightBatch(lightItem(7L, "PENDING", null, false, "2026-04-26T10:00:00")));
         mockMvc.perform(post(LIGHT_URL)
                         .contentType(MediaType.APPLICATION_JSON)
-                        .content(objectMapper.writeValueAsString(new SimilarAsinTaskLightRequest(List.of(7L, 7L, 7L)))))
+                        .content(objectMapper.writeValueAsString(new SimilarAsinTaskLightRequest(List.of(7L, 7L, 7L), null))))
                 .andExpect(status().isOk())
                 .andExpect(jsonPath("$.data.items.length()").value(1));
     }
@@ -110,7 +114,10 @@ class SimilarAsinTaskLightControllerTest {
         request.setTaskIds(List.of(1L));
         service = mock(SimilarAsinTaskService.class);
         when(service.progressBatch(any())).thenReturn(new com.nanri.aiimage.modules.similarasin.model.vo.SimilarAsinTaskBatchVo());
-        mockMvc = MockMvcBuilders.standaloneSetup(new SimilarAsinController(service)).build();
+        // 归属过滤：请求不带 userId 时 filterOwnedTaskIds 直接返回原列表（不会触碰 mapper），
+        // 故这里传 null mapper 即可，无需 mock
+        mockMvc = MockMvcBuilders.standaloneSetup(
+                new SimilarAsinController(service, new TaskProgressOwnershipSupport(null))).build();
         mockMvc.perform(post("/api/similar-asin/tasks/progress/batch")
                         .contentType(MediaType.APPLICATION_JSON)
                         .content(objectMapper.writeValueAsString(request)))
@@ -124,7 +131,7 @@ class SimilarAsinTaskLightControllerTest {
         setUpWith(lightBatch(lightItem(2L, "SUCCESS", "SUCCESS", true, "2026-04-26T10:11:00")));
         mockMvc.perform(post(LIGHT_URL)
                         .contentType(MediaType.APPLICATION_JSON)
-                        .content(objectMapper.writeValueAsString(new SimilarAsinTaskLightRequest(List.of(2L)))))
+                        .content(objectMapper.writeValueAsString(new SimilarAsinTaskLightRequest(List.of(2L), null))))
                 .andExpect(status().isOk())
                 .andExpect(jsonPath("$.data.items[0].status").value("SUCCESS"));
     }
@@ -134,7 +141,7 @@ class SimilarAsinTaskLightControllerTest {
         setUpWith(lightBatch(lightItem(3L, "RUNNING", "SUCCESS", true, "2026-04-26T10:12:00")));
         mockMvc.perform(post(LIGHT_URL)
                         .contentType(MediaType.APPLICATION_JSON)
-                        .content(objectMapper.writeValueAsString(new SimilarAsinTaskLightRequest(List.of(3L)))))
+                        .content(objectMapper.writeValueAsString(new SimilarAsinTaskLightRequest(List.of(3L), null))))
                 .andExpect(status().isOk())
                 .andExpect(jsonPath("$.data.items[0].fileStatus").value("SUCCESS"))
                 .andExpect(jsonPath("$.data.items[0].fileReady").value(true));
@@ -147,7 +154,7 @@ class SimilarAsinTaskLightControllerTest {
         setUpWith(vo);
         mockMvc.perform(post(LIGHT_URL)
                         .contentType(MediaType.APPLICATION_JSON)
-                        .content(objectMapper.writeValueAsString(new SimilarAsinTaskLightRequest(List.of(99999L)))))
+                        .content(objectMapper.writeValueAsString(new SimilarAsinTaskLightRequest(List.of(99999L), null))))
                 .andExpect(status().isOk())
                 .andExpect(jsonPath("$.data.items").isEmpty())
                 .andExpect(jsonPath("$.data.missingTaskIds[0]").value(99999));
diff --git a/backend-java/src/test/java/com/nanri/aiimage/modules/task/contract/ResultSuccessTimingContractTest.java b/backend-java/src/test/java/com/nanri/aiimage/modules/task/contract/ResultSuccessTimingContractTest.java
index 9e875f99..6e055990 100644
--- a/backend-java/src/test/java/com/nanri/aiimage/modules/task/contract/ResultSuccessTimingContractTest.java
+++ b/backend-java/src/test/java/com/nanri/aiimage/modules/task/contract/ResultSuccessTimingContractTest.java
@@ -15,6 +15,7 @@ import com.nanri.aiimage.modules.publish.service.PublishTaskService;
 import com.nanri.aiimage.modules.similarasin.controller.SimilarAsinController;
 import com.nanri.aiimage.modules.similarasin.model.dto.SimilarAsinSubmitResultRequest;
 import com.nanri.aiimage.modules.similarasin.service.SimilarAsinTaskService;
+import com.nanri.aiimage.modules.task.service.TaskProgressOwnershipSupport;
 import jakarta.servlet.http.HttpServletResponse;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.extension.ExtendWith;
@@ -64,7 +65,7 @@ class ResultSuccessTimingContractTest {
             return null;
         }).when(similarAsinTaskService).submitResult(eq(TASK_ID), any(SimilarAsinSubmitResultRequest.class));
 
-        ApiResponse<Void> response = new SimilarAsinController(similarAsinTaskService)
+        ApiResponse<Void> response = new SimilarAsinController(similarAsinTaskService, new TaskProgressOwnershipSupport(null))
                 .result(TASK_ID, new SimilarAsinSubmitResultRequest(), mock(HttpServletResponse.class));
 
         responseAfterService.set(response != null);
@@ -79,7 +80,7 @@ class ResultSuccessTimingContractTest {
         doAnswer(invocation -> null)
                 .when(appearancePatentTaskService).submitResult(eq(TASK_ID), any(AppearancePatentSubmitResultRequest.class));
 
-        ApiResponse<Void> response = new AppearancePatentController(appearancePatentTaskService)
+        ApiResponse<Void> response = new AppearancePatentController(appearancePatentTaskService, new TaskProgressOwnershipSupport(null))
                 .result(TASK_ID, new AppearancePatentSubmitResultRequest(), mock(HttpServletResponse.class));
 
         assertTrue(response.isSuccess(), "success=true");
@@ -93,7 +94,7 @@ class ResultSuccessTimingContractTest {
         vo.setChunkIndex(1);
         when(collectDataService.submitResult(eq(TASK_ID), any(CollectDataSubmitResultRequest.class))).thenReturn(vo);
 
-        ApiResponse<CollectDataSubmitResultVo> response = new CollectDataController(collectDataService)
+        ApiResponse<CollectDataSubmitResultVo> response = new CollectDataController(collectDataService, new TaskProgressOwnershipSupport(null))
                 .submitResult(TASK_ID, new CollectDataSubmitResultRequest());
 
         assertTrue(response.isSuccess(), "success=true");
@@ -118,7 +119,7 @@ class ResultSuccessTimingContractTest {
         org.mockito.Mockito.doThrow(new BusinessException("落库失败"))
                 .when(similarAsinTaskService).submitResult(eq(TASK_ID), any(SimilarAsinSubmitResultRequest.class));
 
-        assertThrows(BusinessException.class, () -> new SimilarAsinController(similarAsinTaskService)
+        assertThrows(BusinessException.class, () -> new SimilarAsinController(similarAsinTaskService, new TaskProgressOwnershipSupport(null))
                 .result(TASK_ID, new SimilarAsinSubmitResultRequest(), mock(HttpServletResponse.class)));
     }
 
@@ -131,7 +132,7 @@ class ResultSuccessTimingContractTest {
             }
             return null;
         }).when(similarAsinTaskService).submitResult(eq(TASK_ID), any(SimilarAsinSubmitResultRequest.class));
-        SimilarAsinController controller = new SimilarAsinController(similarAsinTaskService);
+        SimilarAsinController controller = new SimilarAsinController(similarAsinTaskService, new TaskProgressOwnershipSupport(null));
 
         assertThrows(BusinessException.class, () -> controller
                 .result(TASK_ID, new SimilarAsinSubmitResultRequest(), mock(HttpServletResponse.class)));
@@ -149,7 +150,7 @@ class ResultSuccessTimingContractTest {
             order.add("service-submit");
             return null;
         }).when(appearancePatentTaskService).submitResult(eq(TASK_ID), any(AppearancePatentSubmitResultRequest.class));
-        AppearancePatentController controller = new AppearancePatentController(appearancePatentTaskService);
+        AppearancePatentController controller = new AppearancePatentController(appearancePatentTaskService, new TaskProgressOwnershipSupport(null));
 
         ApiResponse<Void> response = controller.result(TASK_ID, new AppearancePatentSubmitResultRequest(),
                 mock(HttpServletResponse.class));
diff --git a/backend-java/src/test/java/com/nanri/aiimage/modules/task/contract/RollbackSemanticsContractTest.java b/backend-java/src/test/java/com/nanri/aiimage/modules/task/contract/RollbackSemanticsContractTest.java
index 2456fe13..206947d0 100644
--- a/backend-java/src/test/java/com/nanri/aiimage/modules/task/contract/RollbackSemanticsContractTest.java
+++ b/backend-java/src/test/java/com/nanri/aiimage/modules/task/contract/RollbackSemanticsContractTest.java
@@ -224,13 +224,17 @@ class RollbackSemanticsContractTest {
         verify(taskCacheService).touchTaskHeartbeat(TASK_ID);
     }
 
+    private Object pipeline() {
+        return ReflectionTestUtils.invokeMethod(service, "pipelineSupport");
+    }
+
     @Test
     void computePhaseIsSideEffectFreeAndIdempotent() throws Exception {
         FileTaskEntity task = runningTask();
         when(fileTaskMapper.selectById(TASK_ID)).thenReturn(task);
 
-        Object first = ReflectionTestUtils.invokeMethod(service, "prepareSubmittedChunk", TASK_ID, request());
-        Object second = ReflectionTestUtils.invokeMethod(service, "prepareSubmittedChunk", TASK_ID, request());
+        Object first = ReflectionTestUtils.invokeMethod(pipeline(), "prepareSubmittedChunk", TASK_ID, request());
+        Object second = ReflectionTestUtils.invokeMethod(pipeline(), "prepareSubmittedChunk", TASK_ID, request());
 
         assertEquals(DigestUtil.sha256Hex(storedPayloadJson.get()),
                 ReflectionTestUtils.getField(first, "payloadHash"));
diff --git a/backend-java/src/test/java/com/nanri/aiimage/modules/task/contract/SuccessTimingContractTest.java b/backend-java/src/test/java/com/nanri/aiimage/modules/task/contract/SuccessTimingContractTest.java
index 44ca8138..901b2680 100644
--- a/backend-java/src/test/java/com/nanri/aiimage/modules/task/contract/SuccessTimingContractTest.java
+++ b/backend-java/src/test/java/com/nanri/aiimage/modules/task/contract/SuccessTimingContractTest.java
@@ -1,6 +1,7 @@
 package com.nanri.aiimage.modules.task.contract;
 
 import com.baomidou.mybatisplus.core.MybatisConfiguration;
+import com.baomidou.mybatisplus.core.conditions.update.LambdaUpdateWrapper;
 import com.baomidou.mybatisplus.core.metadata.TableInfoHelper;
 import com.fasterxml.jackson.databind.ObjectMapper;
 import com.nanri.aiimage.modules.collectdata.mapper.CollectDataCountryPrefMapper;
@@ -46,6 +47,7 @@ import static org.junit.jupiter.api.Assertions.assertThrows;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.ArgumentMatchers.isNull;
 import static org.mockito.Mockito.doThrow;
 import static org.mockito.Mockito.inOrder;
 import static org.mockito.Mockito.lenient;
@@ -125,20 +127,24 @@ class SuccessTimingContractTest {
         var order = inOrder(ossStorageService, fileResultMapper, fileTaskMapper);
         order.verify(ossStorageService).uploadResultFile(any(), eq("COLLECT_DATA"));
         order.verify(fileResultMapper).updateById(any(FileResultEntity.class));
-        order.verify(fileTaskMapper).updateById(any(FileTaskEntity.class));
+        // 2026-09：终态写入改为条件更新（where status != FAILED），不再走 updateById(实体)
+        order.verify(fileTaskMapper).update(isNull(), any(LambdaUpdateWrapper.class));
     }
 
     @Test
     void taskStatusBecomesSuccessWithFileFields() {
         service.processResultFileJob(job());
 
-        ArgumentCaptor<FileTaskEntity> taskCaptor = ArgumentCaptor.forClass(FileTaskEntity.class);
-        verify(fileTaskMapper).updateById(taskCaptor.capture());
-        FileTaskEntity updated = taskCaptor.getValue();
-        assertEquals("SUCCESS", updated.getStatus(), "任务状态成功时机 = 结果文件生成后");
-        assertEquals(1, updated.getSuccessFileCount());
-        assertEquals(0, updated.getFailedFileCount());
-        assertNotNull(updated.getFinishedAt());
+        // 2026-09：终态写入改为条件更新（LambdaUpdateWrapper，where status != FAILED），
+        // 不再有实体可捕获 —— 改为捕获 wrapper 并断言其 set 片段包含契约要求的字段。
+        ArgumentCaptor<LambdaUpdateWrapper<FileTaskEntity>> wrapperCaptor =
+                ArgumentCaptor.forClass(LambdaUpdateWrapper.class);
+        verify(fileTaskMapper).update(isNull(), wrapperCaptor.capture());
+        String setSql = String.valueOf(wrapperCaptor.getValue().getSqlSet());
+        assertTrue(setSql.contains("status"), "任务状态成功时机 = 结果文件生成后，set 片段应含 status: " + setSql);
+        assertTrue(setSql.contains("success_file_count"), "set 片段应含 success_file_count: " + setSql);
+        assertTrue(setSql.contains("failed_file_count"), "set 片段应含 failed_file_count: " + setSql);
+        assertTrue(setSql.contains("finished_at"), "set 片段应含 finished_at: " + setSql);
     }
 
     @Test
@@ -162,13 +168,16 @@ class SuccessTimingContractTest {
 
         // fileReady 由 url 推导（TaskProgressLightAssembler 语义），成功时机与 url 落库绑定
         verify(fileResultMapper).updateById(any(FileResultEntity.class));
-        verify(fileTaskMapper).updateById(any(FileTaskEntity.class));
+        // 2026-09：任务终态改为条件更新（见 taskStatusBecomesSuccessWithFileFields）
+        verify(fileTaskMapper).update(isNull(), any(LambdaUpdateWrapper.class));
     }
 
     @Test
     void noFileGeneratedNoSuccess() {
+        // 方法名同步：实现已由 writeWorkbookSegmented 改为 writeWorkbookStreaming（流式分页读，
+        // 避免几十万行结果集整体驻留堆），测试原先仍在 mock 旧方法名，导致"没抛异常"的假失败。
         doThrow(new IllegalStateException("工作簿生成失败"))
-                .when(excelAssemblyService).writeWorkbookSegmented(any(), any(), any(), any());
+                .when(excelAssemblyService).writeWorkbookStreaming(any(), any(), any(), any());
 
         assertThrows(IllegalStateException.class, () -> service.processResultFileJob(job()));
 
@@ -202,11 +211,13 @@ class SuccessTimingContractTest {
     void successContractFrozen() {
         service.processResultFileJob(job());
 
-        // 契约快照：文件生成+上传 → result 落库 → 任务 SUCCESS（一次 updateById 各一）
+        // 契约快照：文件生成+上传 → result 落库 → 任务 SUCCESS（各一次写入）
         verify(ossStorageService).uploadResultFile(any(), eq("COLLECT_DATA"));
         verify(fileResultMapper).updateById(any(FileResultEntity.class));
-        verify(fileTaskMapper).updateById(any(FileTaskEntity.class));
-        verify(fileTaskMapper, org.mockito.Mockito.times(1)).updateById(any(FileTaskEntity.class));
+        // 2026-09：任务终态写入由 updateById(实体) 改为条件更新（where status != FAILED，
+        // 避免覆盖客户端 /fail 并发上报的失败态）
+        verify(fileTaskMapper).update(isNull(), any(LambdaUpdateWrapper.class));
+        verify(fileTaskMapper, org.mockito.Mockito.times(1)).update(isNull(), any(LambdaUpdateWrapper.class));
     }
 
     private FileTaskEntity runningTask() {
diff --git a/backend-java/src/test/java/com/nanri/aiimage/modules/task/service/ResultFileJobHandlerTest.java b/backend-java/src/test/java/com/nanri/aiimage/modules/task/service/ResultFileJobHandlerTest.java
index 8c623028..8f4a0a98 100644
--- a/backend-java/src/test/java/com/nanri/aiimage/modules/task/service/ResultFileJobHandlerTest.java
+++ b/backend-java/src/test/java/com/nanri/aiimage/modules/task/service/ResultFileJobHandlerTest.java
@@ -38,8 +38,11 @@ class ResultFileJobHandlerTest {
 
     @Test
     void interfaceMethodsPresent() throws Exception {
-        assertEquals(7, ResultFileJobHandler.class.getDeclaredMethods().length,
-                "接口方法数量为 7（moduleType/process/onSuccess/cleanup/onFailure/supportsAsyncOffload/isOwnerScoped）");
+        // 2026-09：新增 fallbackAssembleOnFailure（job 重试耗尽时用部分数据兜底生成结果文件），
+        // 接口方法从 7 个增到 8 个，同步更新契约断言。
+        assertEquals(8, ResultFileJobHandler.class.getDeclaredMethods().length,
+                "接口方法数量为 8（moduleType/process/onSuccess/cleanup/onFailure/"
+                        + "fallbackAssembleOnFailure/supportsAsyncOffload/isOwnerScoped）");
         assertNotNull(methodOf(ResultFileJobHandler.class, "moduleType"));
         assertNotNull(methodOf(ResultFileJobHandler.class, "process", TaskFileJobEntity.class));
         assertNotNull(methodOf(ResultFileJobHandler.class, "onSuccess", TaskFileJobEntity.class));
diff --git a/backend-java/src/test/java/com/nanri/aiimage/modules/task/service/TransientPayloadDeleteOrchestratorTest.java b/backend-java/src/test/java/com/nanri/aiimage/modules/task/service/TransientPayloadDeleteOrchestratorTest.java
index cecc425d..bc58a8e6 100644
--- a/backend-java/src/test/java/com/nanri/aiimage/modules/task/service/TransientPayloadDeleteOrchestratorTest.java
+++ b/backend-java/src/test/java/com/nanri/aiimage/modules/task/service/TransientPayloadDeleteOrchestratorTest.java
@@ -117,8 +117,11 @@ class TransientPayloadDeleteOrchestratorTest {
         assertEquals(2, orchestrator.flushPendingDeletes(), "两个对象提交物理删除");
         assertTrue(done.await(2, TimeUnit.SECONDS), "异步删除完成");
         verify(rustfs, times(2)).deleteObject(anyString());
-        verify(chunkMapper).selectList(any(LambdaQueryWrapper.class));
-        verify(scopeStateMapper).selectList(any(LambdaQueryWrapper.class));
+        // 2026-09 修订：批量反查按指针里的 taskId 分组后各查一次（用 task_id 索引收敛，
+        // 避免 payload_json 这类 JSON 列的 IN 比较全表扫描）——本用例的 payload 来自 2 个 task，
+        // 故两张表各被查询 2 次（替换了原「合并成一次 IN 查询」的实现）。
+        verify(chunkMapper, times(2)).selectList(any(LambdaQueryWrapper.class));
+        verify(scopeStateMapper, times(2)).selectList(any(LambdaQueryWrapper.class));
     }
 
     @Test
diff --git a/backend/blueprints/version.py b/backend/blueprints/version.py
index 18188df2..e719bc37 100644
--- a/backend/blueprints/version.py
+++ b/backend/blueprints/version.py
@@ -21,15 +21,18 @@ def api_version():
 
 @version_bp.route('/version/latest')
 def api_version_latest():
-    """GET 获取最新版本的下载链接（按创建时间取最新一条）"""
+    """GET 获取最新版本的下载链接（取最新一条）
+
+    排序改用 id 而非 created_at：同一秒内写入多行时 created_at 无法定序，会取错版本。
+    """
+    conn = None
     try:
         conn = get_db()
         with conn.cursor() as cur:
             cur.execute(
-                "SELECT version, file_url FROM web_config ORDER BY created_at DESC LIMIT 1"
+                "SELECT version, file_url FROM web_config ORDER BY id DESC LIMIT 1"
             )
             row = cur.fetchone()
-        conn.close()
         if not row:
             return jsonify({'version': None, 'file_url': None})
         return jsonify({
@@ -39,3 +42,10 @@ def api_version_latest():
     except Exception as e:
         current_app.logger.error('[version] internal error: %s', e, exc_info=True)
         return jsonify({'error': '服务器内部错误，请稍后重试'}), 500
+    finally:
+        # 异常路径同样要关连接：此前 conn.close() 写在 try 内，查询抛错即泄漏连接
+        if conn is not None:
+            try:
+                conn.close()
+            except Exception:
+                pass
diff --git a/backend/utils/db.py b/backend/utils/db.py
index 418c01e7..13f03156 100644
--- a/backend/utils/db.py
+++ b/backend/utils/db.py
@@ -1,10 +1,8 @@
 """
 数据库连接与初始化
 """
-import os
 import re
 import pymysql
-from werkzeug.security import generate_password_hash
 
 try:
     from config import mysql_host as config_mysql_host
@@ -57,30 +55,17 @@ def get_db():
     )
 
 
-def _create_initial_admin():
-    """若没有任何管理员，则创建默认超级管理员（首次启动时，仅一个）"""
-    try:
-        conn = get_db()
-        with conn.cursor() as cur:
-            cur.execute("SELECT id FROM users WHERE role = 'super_admin' LIMIT 1")
-            if cur.fetchone():
-                conn.close()
-                return
-            admin_user = os.environ.get('ADMIN_USER', 'admin')
-            admin_pwd = os.environ.get('ADMIN_PASSWORD', 'admin123')
-            pwd_hash = generate_password_hash(admin_pwd, method='pbkdf2:sha256')
-            cur.execute(
-                "INSERT INTO users (username, password_hash, is_admin, role) VALUES (%s, %s, 1, 'super_admin')",
-                (admin_user, pwd_hash)
-            )
-        conn.commit()
-        conn.close()
-    except Exception:
-        pass
-
-
 def init_db():
-    """初始化数据库表，若不存在则创建"""
+    """确保版本公开 API 依赖的最小表结构存在。
+
+    本进程（15124）只服务 /api/version、/api/version/latest，仅依赖 web_config 表。
+
+    历史遗留说明（2026-09 全维度审查后删除）：这里原本还会创建 users 表、执行 role 角色
+    迁移、并在查不到 super_admin 时用 ADMIN_PASSWORD（默认 admin123）插入一个超管。
+    管理后台早已迁到 Java，users 表结构由 Flyway 迁移管理，本进程再写会与之冲突；
+    其中「无超管即用默认密码建超管」在生产等同于后门（删除超管或改 role 枚举后本进程
+    重启就会静默重建一个密码已知的超管），故整段移除。
+    """
     conn = pymysql.connect(
         host=mysql_host,
         user=mysql_user,
@@ -92,44 +77,6 @@ def init_db():
         with conn.cursor() as cur:
             cur.execute(f"CREATE DATABASE IF NOT EXISTS `{db_name}` DEFAULT CHARSET utf8mb4")
             cur.execute(f"USE `{db_name}`")
-            cur.execute("""
-                CREATE TABLE IF NOT EXISTS users (
-                    id INT AUTO_INCREMENT PRIMARY KEY,
-                    username VARCHAR(64) NOT NULL UNIQUE,
-                    password_hash VARCHAR(256) NOT NULL,
-                    is_admin TINYINT(1) DEFAULT 0,
-                    created_at DATETIME DEFAULT CURRENT_TIMESTAMP
-                )
-            """)
-            cur.execute("""
-                CREATE TABLE IF NOT EXISTS image_history (
-                    id INT AUTO_INCREMENT PRIMARY KEY,
-                    user_id INT NOT NULL,
-                    created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
-                    panel_type VARCHAR(64) DEFAULT '',
-                    original_urls JSON,
-                    params JSON,
-                    result_urls JSON,
-                    long_image_url VARCHAR(1024) DEFAULT NULL,
-                    INDEX idx_user_created (user_id, created_at DESC)
-                )
-            """)
-            try:
-                cur.execute("ALTER TABLE image_history ADD COLUMN long_image_url VARCHAR(1024) DEFAULT NULL")
-            except Exception:
-                pass
-            try:
-                cur.execute("ALTER TABLE users ADD COLUMN machine VARCHAR(64) DEFAULT NULL")
-            except Exception:
-                pass
-            try:
-                cur.execute("ALTER TABLE users ADD COLUMN role VARCHAR(20) DEFAULT 'normal'")
-            except Exception:
-                pass
-            try:
-                cur.execute("ALTER TABLE users ADD COLUMN created_by_id INT NULL")
-            except Exception:
-                pass
             cur.execute("""
                 CREATE TABLE IF NOT EXISTS web_config (
                     id INT AUTO_INCREMENT PRIMARY KEY,
@@ -138,18 +85,6 @@ def init_db():
                     created_at DATETIME DEFAULT CURRENT_TIMESTAMP
                 )
             """)
-            try:
-                cur.execute("UPDATE users SET role = 'normal' WHERE (role IS NULL OR role = '') AND (is_admin = 0 OR is_admin IS NULL)")
-                cur.execute("SELECT MIN(id) AS mid FROM users WHERE is_admin = 1")
-                row = cur.fetchone()
-                if row and row.get('mid'):
-                    mid = row['mid']
-                    cur.execute("UPDATE users SET role = 'super_admin' WHERE id = %s", (mid,))
-                    cur.execute("UPDATE users SET role = 'admin' WHERE is_admin = 1 AND id != %s", (mid,))
-                    cur.execute("UPDATE users SET created_by_id = %s WHERE role = 'admin' AND (created_by_id IS NULL)", (mid,))
-            except Exception:
-                pass
         conn.commit()
     finally:
         conn.close()
-    _create_initial_admin()
diff --git a/frontend-vue/src/App.vue b/frontend-vue/src/App.vue
index 8996c280..92f394cc 100644
--- a/frontend-vue/src/App.vue
+++ b/frontend-vue/src/App.vue
@@ -1,7 +1,14 @@
 <template>
-  <router-view />
+  <el-config-provider :locale="zhCn">
+    <router-view />
+  </el-config-provider>
 </template>
 
 <script setup lang="ts">
 // 数富AI SPA 根组件：页面均由路由渲染（URL 无 .html 后缀）
+//
+// Element Plus 改为按需引入（见 vite.config.ts 的 ElementPlusResolver）后，locale 不再通过
+// app.use(ElementPlus, { locale }) 全局注入，改由 ConfigProvider 提供；
+// 否则分页/日期选择器/上传等组件的内置文案会退回英文。
+import zhCn from 'element-plus/es/locale/lang/zh-cn'
 </script>
diff --git a/frontend-vue/src/main.ts b/frontend-vue/src/main.ts
index f86ace31..3c47bf7c 100644
--- a/frontend-vue/src/main.ts
+++ b/frontend-vue/src/main.ts
@@ -1,7 +1,4 @@
 import { createApp } from 'vue'
-import ElementPlus from 'element-plus'
-import zhCn from 'element-plus/es/locale/lang/zh-cn'
-import 'element-plus/dist/index.css'
 import '@/styles/main.css'
 
 import App from '@/App.vue'
@@ -15,6 +12,11 @@ import { ensureApiSecretsLoaded, loadApiSecrets } from '@/shared/utils/api-secre
  * 原 MPA 的 22 个 html 入口 + 22 个 *-main.ts 已合并：
  * 页面路由见 src/router/index.ts；登录态由路由守卫统一引导；
  * 密钥门禁：服务端密钥未配置完整时全站拦截到 /setup-secrets（拉取失败软失败放行）。
+ *
+ * Element Plus 走按需引入（vite.config.ts 的 ElementPlusResolver）：
+ * 此前 `app.use(ElementPlus)` + 全量 index.css 会把整套组件与样式打进入口
+ * （入口 JS 实测 1.05MB，而组件 resolver 的分包优势全部失效）。
+ * locale 由 App.vue 的 el-config-provider 提供。
  */
 
 // 后台预热密钥包，减少首次进入守卫时的等待
@@ -51,4 +53,4 @@ router.beforeEach((to) => {
   return true
 })
 
-createApp(App).use(router).use(ElementPlus, { locale: zhCn }).mount('#app')
+createApp(App).use(router).mount('#app')
diff --git a/frontend-vue/src/pages/brand/components/BrandDedupeTab.vue b/frontend-vue/src/pages/brand/components/BrandDedupeTab.vue
index c9c192cf..baf8ea5f 100644
--- a/frontend-vue/src/pages/brand/components/BrandDedupeTab.vue
+++ b/frontend-vue/src/pages/brand/components/BrandDedupeTab.vue
@@ -115,7 +115,7 @@
 </template>
 
 <script setup lang="ts">
-import { computed, onMounted, ref } from 'vue'
+import { computed, onBeforeUnmount, onMounted, ref } from 'vue'
 import { ElMessage } from 'element-plus'
 import AmazonToolPageShell from '@/pages/amazon/components/AmazonToolPageShell.vue';
 import TaskCenterPanel from '@/shared/components/tasks/TaskCenterPanel.vue'
@@ -359,7 +359,10 @@ async function submitCleanRun() {
     }
     ElMessage.success('数据去重完成')
   } catch (error) {
-    ElMessage.error(error instanceof Error ? error.message : '去重失败')
+    // 卸载导致的轮询中止不提示（组件已不可见）
+    if (!disposed) {
+      ElMessage.error(error instanceof Error ? error.message : '去重失败')
+    }
   } finally {
     cleanRunning.value = false
   }
@@ -369,9 +372,19 @@ async function submitCleanRun() {
 const DEDUPE_POLL_INTERVAL_MS = 2000
 const DEDUPE_POLL_TIMEOUT_MS = 10 * 60 * 1000
 
+// 组件卸载标记：轮询在用户切页后仍会继续（最长 10 分钟），并往已卸载组件的 ref 写数据、
+// 触发全局确认框。卸载后立即中止轮询（服务端任务照常执行，结果在历史列表可查）。
+let disposed = false
+onBeforeUnmount(() => {
+  disposed = true
+})
+
 async function pollDedupeRunProgress(runId: string, onProgress?: (progress: DedupeRunProgressVo) => void): Promise<DedupeRunVo> {
   const deadline = Date.now() + DEDUPE_POLL_TIMEOUT_MS
   while (true) {
+    if (disposed) {
+      throw new Error('页面已离开，停止轮询')
+    }
     const progress = await getDedupeRunProgress(runId)
     if (progress.status === 'not_found') {
       throw new Error('去重任务不存在或已过期')
diff --git a/frontend-vue/src/pages/brand/components/BrandPatrolDeleteTab.vue b/frontend-vue/src/pages/brand/components/BrandPatrolDeleteTab.vue
index 93df0424..00faef22 100644
--- a/frontend-vue/src/pages/brand/components/BrandPatrolDeleteTab.vue
+++ b/frontend-vue/src/pages/brand/components/BrandPatrolDeleteTab.vue
@@ -768,10 +768,13 @@ function mergeHistoryProgressItems(incoming: PatrolDeleteHistoryItem[]) {
       cartRatios: next.cartRatios || item.cartRatios || [],
     };
   });
+  // 判重改 Set：此前 merged.some(...) 是 O(n×m)，历史条目越多每轮轮询越慢
+  const mergedKeys = new Set(merged.map(historyItemKey));
   for (const item of incoming) {
     const key = historyItemKey(item);
-    if (!merged.some((current) => historyItemKey(current) === key)) {
+    if (!mergedKeys.has(key)) {
       merged.push(item);
+      mergedKeys.add(key);
     }
   }
   historyItems.value = merged;
diff --git a/frontend-vue/src/pages/brand/components/BrandPriceTrackTab.vue b/frontend-vue/src/pages/brand/components/BrandPriceTrackTab.vue
index 5d4fae60..c52bb4ba 100644
--- a/frontend-vue/src/pages/brand/components/BrandPriceTrackTab.vue
+++ b/frontend-vue/src/pages/brand/components/BrandPriceTrackTab.vue
@@ -380,8 +380,15 @@ function activeLoopStorageKey() {
 function setStorageJson(key: string, value: unknown, shouldRemove: boolean) {
   if (typeof window === 'undefined') return
   try {
-    if (shouldRemove) window.localStorage.removeItem(key)
-    else window.localStorage.setItem(key, JSON.stringify(value))
+    if (shouldRemove) {
+      window.localStorage.removeItem(key)
+      return
+    }
+    const next = JSON.stringify(value)
+    // 内容未变则跳过写入：本函数在每轮轮询里对整份快照调用（可达数百 KB），
+    // 同步 setItem 会阻塞主线程造成周期性卡顿；相同内容重复写盘没有意义
+    if (window.localStorage.getItem(key) === next) return
+    window.localStorage.setItem(key, next)
   } catch {
     /* quota */
   }
diff --git a/frontend-vue/src/pages/brand/components/BrandProductRiskTab.vue b/frontend-vue/src/pages/brand/components/BrandProductRiskTab.vue
index 7860736e..cbe069ae 100644
--- a/frontend-vue/src/pages/brand/components/BrandProductRiskTab.vue
+++ b/frontend-vue/src/pages/brand/components/BrandProductRiskTab.vue
@@ -370,9 +370,13 @@ function setStorageJson(key: string, value: unknown, shouldRemove: boolean) {
   try {
     if (shouldRemove) {
       window.localStorage.removeItem(key)
-    } else {
-      window.localStorage.setItem(key, JSON.stringify(value))
+      return
     }
+    const next = JSON.stringify(value)
+    // 内容未变则跳过写入：本函数在每轮轮询里对整份快照调用（可达数百 KB），
+    // 同步 setItem 会阻塞主线程造成周期性卡顿
+    if (window.localStorage.getItem(key) === next) return
+    window.localStorage.setItem(key, next)
   } catch {
     /* quota */
   }
diff --git a/frontend-vue/src/pages/brand/components/BrandQueryAsinTab.vue b/frontend-vue/src/pages/brand/components/BrandQueryAsinTab.vue
index 2571c981..49c010ad 100644
--- a/frontend-vue/src/pages/brand/components/BrandQueryAsinTab.vue
+++ b/frontend-vue/src/pages/brand/components/BrandQueryAsinTab.vue
@@ -458,12 +458,16 @@ function withQueryAsinFallback<T extends QueryAsinHistoryItem | QueryAsinShopQue
   item: T,
   fallback?: QueryAsinShopQueueItem | QueryAsinHistoryItem | null,
 ) {
-  const queryAsins = hasQueryAsins(item)
-    ? readQueryAsins(item)
-    : readQueryAsins(fallback || undefined);
+  // 已有 queryAsins 时直接返回原对象：本函数在每轮轮询里对全量历史调用，
+  // 无条件 { ...item } 会让下游历史抽屉的全部卡片因 props 变化而每轮重渲染
+  if (hasQueryAsins(item)) {
+    return item;
+  }
+  const fallbackAsins = readQueryAsins(fallback || undefined);
+  const resolved = fallbackAsins.length ? fallbackAsins : fallbackQueryAsinsForShop(item.shopName);
   return {
     ...item,
-    queryAsins: queryAsins.length ? queryAsins : fallbackQueryAsinsForShop(item.shopName),
+    queryAsins: resolved,
   };
 }
 
@@ -689,10 +693,13 @@ function mergeHistoryProgressItems(incoming: QueryAsinHistoryItem[]) {
       queryAsins,
     };
   });
+  // 判重改 Set：此前 merged.some(...) 是 O(n×m)，历史 500 条 × 每轮 20 条即 1 万次比较
+  const mergedKeys = new Set(merged.map(historyItemKey));
   for (const item of incoming) {
     const key = historyItemKey(item);
-    if (!merged.some((current) => historyItemKey(current) === key)) {
+    if (!mergedKeys.has(key)) {
       merged.push(withQueryAsinFallback(item));
+      mergedKeys.add(key);
     }
   }
   historyItems.value = merged;
diff --git a/frontend-vue/src/pages/brand/components/BrandVariantTab.vue b/frontend-vue/src/pages/brand/components/BrandVariantTab.vue
index 24a85062..207fdf37 100644
--- a/frontend-vue/src/pages/brand/components/BrandVariantTab.vue
+++ b/frontend-vue/src/pages/brand/components/BrandVariantTab.vue
@@ -139,7 +139,7 @@
         <div class="kv-row"><span class="kv-key">进度信息</span><span class="kv-val">{{ latestMessage(detailItem) || '-' }}</span></div>
         <template v-if="resultFiles(detailItem).length">
           <div class="kv-section">结果文件</div>
-          <div v-for="(url, index) in resultFiles(detailItem)" :key="index" class="kv-row">
+          <div v-for="(url, index) in resultFiles(detailItem)" :key="url" class="kv-row">
             <span class="kv-key">文件 {{ index + 1 }}</span>
             <a class="kv-val link" :href="url" target="_blank" rel="noopener">{{ url }}</a>
           </div>
@@ -226,6 +226,10 @@ function statusClass(status?: number | string) {
 
 let autoTimer: number | null = null
 let refreshTimer: number | null = null
+// 导出轮询用独立计时器：此前与自动刷新共用 autoTimer，两条链互相覆盖，必有一条无法被 cleanup 清掉
+let exportTimer: number | null = null
+// 组件已卸载标记：轮询链的异步回调在卸载后仍会续链（切页后继续打接口）
+let disposed = false
 
 function uid() {
   const raw = typeof window === 'undefined' ? '' : window.localStorage.getItem('uid') || ''
@@ -567,6 +571,10 @@ function pollExport(bridge: NonNullable<ReturnType<typeof getPywebviewApi>>, fil
     let count = 0
     const maxAttempts = 60
     const tick = async () => {
+      if (disposed) {
+        resolve(null)
+        return
+      }
       count += 1
       try {
         const res = await bridge.vc_query_export!(fileId)
@@ -584,7 +592,7 @@ function pollExport(bridge: NonNullable<ReturnType<typeof getPywebviewApi>>, fil
         resolve(null)
         return
       }
-      autoTimer = window.setTimeout(tick, 2000)
+      exportTimer = window.setTimeout(tick, 2000)
     }
     void tick()
   })
@@ -601,8 +609,12 @@ function scheduleAutoRefresh() {
     autoTimer = null
   }
   autoTimer = window.setTimeout(async () => {
+    if (disposed) {
+      return
+    }
     await loadTasks(currentPage.value || 1)
-    if (currentTasks.value.some((item) => isBusy(item.status))) {
+    // 卸载后不得再续链：异步回调返回时组件可能已销毁，续链会持续打接口
+    if (!disposed && currentTasks.value.some((item) => isBusy(item.status))) {
       scheduleAutoRefresh()
     }
   }, 3000)
@@ -616,10 +628,15 @@ function startPolling() {
 }
 
 function cleanup() {
+  disposed = true
   if (autoTimer) {
     window.clearTimeout(autoTimer)
     autoTimer = null
   }
+  if (exportTimer) {
+    window.clearTimeout(exportTimer)
+    exportTimer = null
+  }
   if (refreshTimer) {
     window.clearInterval(refreshTimer)
     refreshTimer = null
diff --git a/frontend-vue/src/pages/brand/components/BrandWithdrawTab.vue b/frontend-vue/src/pages/brand/components/BrandWithdrawTab.vue
index c2c0bd7e..a97dd28e 100644
--- a/frontend-vue/src/pages/brand/components/BrandWithdrawTab.vue
+++ b/frontend-vue/src/pages/brand/components/BrandWithdrawTab.vue
@@ -817,10 +817,13 @@ function mergeHistoryProgressItems(incoming: WithdrawHistoryItem[]) {
       ...next,
     };
   });
+  // 判重改 Set：此前 merged.some(...) 是 O(n×m)，历史条目越多每轮轮询越慢
+  const mergedKeys = new Set(merged.map(historyItemKey));
   for (const item of incoming) {
     const key = historyItemKey(item);
-    if (!merged.some((current) => historyItemKey(current) === key)) {
+    if (!mergedKeys.has(key)) {
       merged.push(withWithdrawFallback(item));
+      mergedKeys.add(key);
     }
   }
   historyItems.value = merged;
diff --git a/frontend-vue/src/pages/home/DesktopHomePage.vue b/frontend-vue/src/pages/home/DesktopHomePage.vue
index f1aaf34c..c2c66db3 100644
--- a/frontend-vue/src/pages/home/DesktopHomePage.vue
+++ b/frontend-vue/src/pages/home/DesktopHomePage.vue
@@ -23,6 +23,7 @@
             </button>
           </div>
           <div class="update-hint">{{ hint }}</div>
+          <UpdateLogList :entries="changelog" />
           <UpdateProgressBar :progress="progress" />
           <div v-if="hasUpdate || canDownload" style="margin-top: 4px;">
             <button type="button" class="btn-download-update" :disabled="updating" @click="doUpdate">
@@ -64,13 +65,14 @@ import { restoreLoginUser } from '@/shared/auth/ensure-auth'
 import { getCurrentUserAppColumnRaw, readCachedAppColumnPermissions, type PermissionMenuItem } from '@/shared/api/permission'
 import { useVersionUpdate } from '@/shared/composables/useVersionUpdate'
 import UpdateProgressBar from '@/shared/components/UpdateProgressBar.vue'
+import UpdateLogList from '@/shared/components/UpdateLogList.vue'
 import NotificationBell from '@/shared/components/NotificationBell.vue'
 import { resolvePageHref } from '@/shared/page-prefix'
 
 const username = ref('')
 const updatePanel = ref(false)
 const toastText = ref('')
-const { checking, updating, currentVersion, hasUpdate, canDownload, hint, checked, progress, runCheck, doUpdate } =
+const { checking, updating, currentVersion, hasUpdate, canDownload, hint, checked, progress, changelog, runCheck, doUpdate } =
   useVersionUpdate()
 
 // 桌面端原 Flask /logout 已随瘦身下线：统一跳登录页并清本地 token（/login?logout=1）
diff --git a/frontend-vue/src/pages/image-video/components/DeliveryVideoWorkspace.vue b/frontend-vue/src/pages/image-video/components/DeliveryVideoWorkspace.vue
index b7c476e5..2b57c562 100644
--- a/frontend-vue/src/pages/image-video/components/DeliveryVideoWorkspace.vue
+++ b/frontend-vue/src/pages/image-video/components/DeliveryVideoWorkspace.vue
@@ -526,6 +526,13 @@ type VoiceStatusType = 'info' | 'success' | 'error'
 const IMAGE_VIDEO_TASK_POLL_DELAY_MS = 5000
 const IMAGE_VIDEO_TASK_MAX_POLLS = 720
 
+/**
+ * 组件卸载标记：本页有两类长轮询（组装结果、Coze 异步任务，后者最长 720 次 × 5 秒 = 1 小时）。
+ * 轮询回调在卸载后仍会「请求返回 → 续挂下一轮」，仅靠 onBeforeUnmount 清当前计时器挡不住
+ * 在途请求，必须用标记在每次续链前判定。
+ */
+let disposed = false
+
 type AssetState = {
   fileName: string
   previewUrl: string
@@ -1002,6 +1009,10 @@ function isTerminalImageVideoTask(task: ImageVideoAsyncTaskVo) {
 async function waitForImageVideoTask(ticket: ImageVideoAsyncTaskVo): Promise<unknown> {
   let task = ticket
   for (let pollCount = 0; pollCount < IMAGE_VIDEO_TASK_MAX_POLLS; pollCount += 1) {
+    if (disposed) {
+      // 组件已卸载：停止轮询（否则切页后仍会每 5 秒打接口，最长 1 小时）
+      throw new Error('页面已离开，停止轮询')
+    }
     if (task.status === 'SUCCESS') return task.result
     if (isTerminalImageVideoTask(task)) {
       throw new Error(task.errorMessage || 'Coze task failed')
@@ -1307,6 +1318,11 @@ async function pollAssemblyResult(tab: WorkspaceTab, taskId: number) {
     ElMessage.warning('Coze 执行结果查询超时，请稍后通过 execute_id 查看')
     return
   }
+  if (disposed) {
+    // 卸载瞬间请求在途时，回调返回后会重新挂表；此处判定保证卸载后不再续链
+    assembly.polling = false
+    return
+  }
   assembly.pollTimer = window.setTimeout(() => {
     void pollAssemblyResult(tab, taskId)
   }, IMAGE_VIDEO_TASK_POLL_DELAY_MS)
@@ -1791,6 +1807,7 @@ onMounted(() => {
 })
 
 onBeforeUnmount(() => {
+  disposed = true
   stopAssemblyPolling('remake')
   stopAssemblyPolling('imageToVideo')
 })
diff --git a/frontend-vue/src/pages/login/DesktopLoginPage.vue b/frontend-vue/src/pages/login/DesktopLoginPage.vue
index b12b4e45..9f7b4b58 100644
--- a/frontend-vue/src/pages/login/DesktopLoginPage.vue
+++ b/frontend-vue/src/pages/login/DesktopLoginPage.vue
@@ -2,6 +2,40 @@
   <div class="legacy-login-root">
     <header class="header">
       <span class="header-title">数富AI</span>
+      <!-- 版本更新入口固定右上角：桌面端自动下载安装；网页形态降级为下载最新安装包 -->
+      <div class="login-header-right">
+        <div class="login-update">
+          <button type="button" class="link-update" @click="toggleUpdate">
+            <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true">
+              <path d="M21 12a9 9 0 1 1-2.64-6.36"></path>
+              <path d="M21 3v6h-6"></path>
+            </svg>
+            更新版本
+          </button>
+          <div v-if="updateOpen" class="update-panel">
+            <div class="update-panel-title">软件更新</div>
+            <div class="update-row"><span>当前版本</span><b>{{ currentVersion || '—' }}</b></div>
+            <div class="update-row"><span>最新版本</span><b>{{ latestVersion || '—' }}</b></div>
+            <div class="update-actions">
+              <button type="button" class="btn-mini" :disabled="checking" @click="runCheck">
+                {{ checking ? '检测中...' : '检测' }}
+              </button>
+              <button
+                v-if="hasUpdate || canDownload"
+                type="button"
+                class="btn-mini btn-mini-green"
+                :disabled="updating"
+                @click="doUpdate"
+              >
+                {{ updating ? '更新中...' : '立即更新' }}
+              </button>
+            </div>
+            <div class="update-hint">{{ hint }}</div>
+            <UpdateLogList :entries="changelog" />
+            <UpdateProgressBar :progress="progress" />
+          </div>
+        </div>
+      </div>
     </header>
 
     <div class="login-box">
@@ -59,38 +93,6 @@
           {{ loggingIn ? '登录中...' : '登录' }}
         </button>
       </form>
-
-      <!-- 版本更新：桌面端自动下载安装；网页形态降级为下载最新安装包 -->
-      <div class="login-update">
-        <button type="button" class="link-update" @click="toggleUpdate">
-          <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true">
-            <path d="M21 12a9 9 0 1 1-2.64-6.36"></path>
-            <path d="M21 3v6h-6"></path>
-          </svg>
-          更新版本
-        </button>
-        <div v-if="updateOpen" class="update-panel">
-          <div class="update-panel-title">软件更新</div>
-          <div class="update-row"><span>当前版本</span><b>{{ currentVersion || '—' }}</b></div>
-          <div class="update-row"><span>最新版本</span><b>{{ latestVersion || '—' }}</b></div>
-          <div class="update-actions">
-            <button type="button" class="btn-mini" :disabled="checking" @click="runCheck">
-              {{ checking ? '检测中...' : '检测' }}
-            </button>
-            <button
-              v-if="hasUpdate || canDownload"
-              type="button"
-              class="btn-mini btn-mini-green"
-              :disabled="updating"
-              @click="doUpdate"
-            >
-              {{ updating ? '更新中...' : '立即更新' }}
-            </button>
-          </div>
-          <div class="update-hint">{{ hint }}</div>
-          <UpdateProgressBar :progress="progress" />
-        </div>
-      </div>
     </div>
   </div>
 </template>
@@ -103,6 +105,7 @@ import { KICK_NOTICE_KEY } from '@/shared/auth/kick-handler'
 import { useVersionUpdate } from '@/shared/composables/useVersionUpdate'
 import { clearApiSecretCache } from '@/shared/utils/api-secret-store'
 import UpdateProgressBar from '@/shared/components/UpdateProgressBar.vue'
+import UpdateLogList from '@/shared/components/UpdateLogList.vue'
 
 const router = useRouter()
 
@@ -134,6 +137,7 @@ const {
   hint,
   checked,
   progress,
+  changelog,
   runCheck,
   doUpdate,
 } = useVersionUpdate()
@@ -682,10 +686,15 @@ body {
   cursor: not-allowed;
 }
 
-/* 版本更新入口与面板 */
+/* 版本更新入口与面板：入口固定顶栏右上角，面板在该入口下方浮层展开
+   （类名加 login- 前缀，避免与首页同名全局样式互相覆盖） */
+.login-header-right {
+  display: flex;
+  align-items: center;
+}
+
 .login-update {
-  margin-top: 14px;
-  text-align: center;
+  position: relative;
 }
 
 .link-update {
@@ -713,11 +722,16 @@ body {
 }
 
 .update-panel {
-  margin-top: 10px;
+  position: absolute;
+  top: 34px;
+  right: 0;
+  z-index: 20;
+  width: 300px;
   padding: 12px 14px;
-  background: #f6fafd;
+  background: #ffffff;
   border: 1px solid #d5e6f2;
   border-radius: 8px;
+  box-shadow: 0 8px 24px rgba(20, 50, 80, 0.16);
   text-align: left;
 }
 
diff --git a/frontend-vue/src/shared/api/types/modules/appearance-patent.ts b/frontend-vue/src/shared/api/types/modules/appearance-patent.ts
index 77ff1f59..fb99f21e 100644
--- a/frontend-vue/src/shared/api/types/modules/appearance-patent.ts
+++ b/frontend-vue/src/shared/api/types/modules/appearance-patent.ts
@@ -156,7 +156,11 @@ async function postTaskProgressBatch<T>(
   }
 
   const requestPromise = unwrapJavaResponse(
-    post<JavaApiResponse<T>, { taskIds: number[] }>(path, { taskIds: normalizedTaskIds }, {
+    post<JavaApiResponse<T>, { taskIds: number[]; userId?: number }>(path, {
+      taskIds: normalizedTaskIds,
+      // 传当前用户 id：后端据此过滤非归属任务（未传时后端不过滤，保持向后兼容）
+      userId: Number(window.localStorage.getItem('uid')) || undefined,
+    }, {
       timeout: getTaskProgressTimeoutMs(),
     }),
   )
diff --git a/frontend-vue/src/shared/api/types/modules/collect-data.ts b/frontend-vue/src/shared/api/types/modules/collect-data.ts
index 43e7ef2d..d2f01646 100644
--- a/frontend-vue/src/shared/api/types/modules/collect-data.ts
+++ b/frontend-vue/src/shared/api/types/modules/collect-data.ts
@@ -181,7 +181,11 @@ async function postTaskProgressBatch<T>(
   }
 
   const requestPromise = unwrapJavaResponse(
-    post<JavaApiResponse<T>, { taskIds: number[] }>(path, { taskIds: normalizedTaskIds }, {
+    post<JavaApiResponse<T>, { taskIds: number[]; userId?: number }>(path, {
+      taskIds: normalizedTaskIds,
+      // 传当前用户 id：后端据此过滤非归属任务（未传时后端不过滤，保持向后兼容）
+      userId: Number(window.localStorage.getItem('uid')) || undefined,
+    }, {
       timeout: getTaskProgressTimeoutMs(),
     }),
   )
diff --git a/frontend-vue/src/shared/api/types/modules/delete-brand.ts b/frontend-vue/src/shared/api/types/modules/delete-brand.ts
index 890086ff..67e6ac80 100644
--- a/frontend-vue/src/shared/api/types/modules/delete-brand.ts
+++ b/frontend-vue/src/shared/api/types/modules/delete-brand.ts
@@ -205,7 +205,11 @@ async function postTaskProgressBatch<T>(
   }
 
   const requestPromise = unwrapJavaResponse(
-    post<JavaApiResponse<T>, { taskIds: number[] }>(path, { taskIds: normalizedTaskIds }, {
+    post<JavaApiResponse<T>, { taskIds: number[]; userId?: number }>(path, {
+      taskIds: normalizedTaskIds,
+      // 传当前用户 id：后端据此过滤非归属任务（未传时后端不过滤，保持向后兼容）
+      userId: Number(window.localStorage.getItem('uid')) || undefined,
+    }, {
       timeout: getTaskProgressTimeoutMs(),
     }),
   )
@@ -268,9 +272,13 @@ export function getDeleteBrandTaskDetail(taskId: number) {
 
 export function getDeleteBrandTaskDetails(taskIds: number[]) {
   return unwrapJavaResponse(
-    post<JavaApiResponse<DeleteBrandTaskBatchVo>, { taskIds: number[] }>(
+    post<JavaApiResponse<DeleteBrandTaskBatchVo>, { taskIds: number[]; userId?: number }>(
       buildJavaUrl(API_ENDPOINTS.deleteBrand.taskDetails),
-      { taskIds },
+      {
+        taskIds,
+        // 传当前用户 id：后端据此过滤非归属任务（未传时后端不过滤，保持向后兼容）
+        userId: Number(window.localStorage.getItem('uid')) || undefined,
+      },
     ),
   );
 }
diff --git a/frontend-vue/src/shared/api/types/modules/permission.ts b/frontend-vue/src/shared/api/types/modules/permission.ts
index 549f2495..6c467bc1 100644
--- a/frontend-vue/src/shared/api/types/modules/permission.ts
+++ b/frontend-vue/src/shared/api/types/modules/permission.ts
@@ -121,9 +121,39 @@ async function fetchAppColumnPermissions() {
   return items
 }
 
+/**
+ * 列权限键的内存缓存与 in-flight 合并（2026-09 全维度审查补）：
+ * 同一路由内多个组件各自 onMounted 调用（如 AmazonConsolePage + AmazonTopBar），
+ * 此前每次进页面都发两次相同请求；TTL 取 10s，既消掉重复又保证权限变更能较快生效。
+ */
+const APP_COLUMN_KEYS_TTL_MS = 10_000
+let appColumnKeysCache: { value: string[]; at: number } | null = null
+let appColumnKeysInflight: Promise<string[]> | null = null
+
 /** 归一化后的列权限键（菜单入口/卡片显隐用，见 AmazonConsolePage 等） */
 export async function getCurrentUserAppColumnKeys() {
-  return normalizeColumnKeys(await fetchAppColumnPermissions())
+  const now = Date.now()
+  if (appColumnKeysCache && now - appColumnKeysCache.at < APP_COLUMN_KEYS_TTL_MS) {
+    return appColumnKeysCache.value
+  }
+  if (appColumnKeysInflight) {
+    return appColumnKeysInflight
+  }
+  appColumnKeysInflight = (async () => {
+    try {
+      const keys = normalizeColumnKeys(await fetchAppColumnPermissions())
+      appColumnKeysCache = { value: keys, at: Date.now() }
+      return keys
+    } finally {
+      appColumnKeysInflight = null
+    }
+  })()
+  return appColumnKeysInflight
+}
+
+/** 失效列权限缓存（权限变更后需要立即生效时调用）。 */
+export function invalidateAppColumnKeysCache() {
+  appColumnKeysCache = null
 }
 
 /** 原始权限菜单项（页面需要自行计算权限状态时用，见 DesktopHomePage） */
diff --git a/frontend-vue/src/shared/api/types/modules/price-track.ts b/frontend-vue/src/shared/api/types/modules/price-track.ts
index 7ceff2e9..7799de98 100644
--- a/frontend-vue/src/shared/api/types/modules/price-track.ts
+++ b/frontend-vue/src/shared/api/types/modules/price-track.ts
@@ -238,7 +238,11 @@ async function postTaskProgressBatch<T>(
   }
 
   const requestPromise = unwrapJavaResponse(
-    post<JavaApiResponse<T>, { taskIds: number[] }>(path, { taskIds: normalizedTaskIds }, {
+    post<JavaApiResponse<T>, { taskIds: number[]; userId?: number }>(path, {
+      taskIds: normalizedTaskIds,
+      // 传当前用户 id：后端据此过滤非归属任务（未传时后端不过滤，保持向后兼容）
+      userId: Number(window.localStorage.getItem('uid')) || undefined,
+    }, {
       timeout: getTaskProgressTimeoutMs(),
     }),
   )
@@ -340,9 +344,13 @@ export function deletePriceTrackTask(taskId: number) {
 
 export function getPriceTrackTasksBatch(taskIds: number[]) {
   return unwrapJavaResponse(
-    post<JavaApiResponse<PriceTrackTaskBatchVo>, { taskIds: number[] }>(
+    post<JavaApiResponse<PriceTrackTaskBatchVo>, { taskIds: number[]; userId?: number }>(
       `${JAVA_API_PREFIX}/price-track/tasks/batch`,
-      { taskIds },
+      {
+        taskIds,
+        // 传当前用户 id：后端据此过滤非归属任务（未传时后端不过滤，保持向后兼容）
+        userId: Number(window.localStorage.getItem('uid')) || undefined,
+      },
     ),
   );
 }
diff --git a/frontend-vue/src/shared/api/types/modules/publish.ts b/frontend-vue/src/shared/api/types/modules/publish.ts
index ff5aec22..b59eb7e6 100644
--- a/frontend-vue/src/shared/api/types/modules/publish.ts
+++ b/frontend-vue/src/shared/api/types/modules/publish.ts
@@ -238,9 +238,11 @@ export function getPublishTaskProgressBatch(taskIds: number[]) {
   return unwrapJavaResponse(
     post<
       JavaApiResponse<PublishTaskBatchVo>,
-      { task_ids: number[] }
+      { task_ids: number[]; user_id?: number }
     >(buildJavaUrl(API_ENDPOINTS.publish.progressBatch), {
       task_ids: normalizedTaskIds,
+      // 传当前用户 id：后端据此过滤非归属任务（未传时后端不过滤，保持向后兼容）
+      user_id: Number(window.localStorage.getItem('uid')) || undefined,
     }, { timeout: getTaskProgressTimeoutMs() }),
   );
 }
diff --git a/frontend-vue/src/shared/api/types/modules/query-asin.ts b/frontend-vue/src/shared/api/types/modules/query-asin.ts
index ca080d90..aa5a2ca7 100644
--- a/frontend-vue/src/shared/api/types/modules/query-asin.ts
+++ b/frontend-vue/src/shared/api/types/modules/query-asin.ts
@@ -197,7 +197,11 @@ async function postTaskProgressBatch<T>(
   }
 
   const requestPromise = unwrapJavaResponse(
-    post<JavaApiResponse<T>, { taskIds: number[] }>(path, { taskIds: normalizedTaskIds }, {
+    post<JavaApiResponse<T>, { taskIds: number[]; userId?: number }>(path, {
+      taskIds: normalizedTaskIds,
+      // 传当前用户 id：后端据此过滤非归属任务（未传时后端不过滤，保持向后兼容）
+      userId: Number(window.localStorage.getItem('uid')) || undefined,
+    }, {
       timeout: getTaskProgressTimeoutMs(),
     }),
   )
diff --git a/frontend-vue/src/shared/api/types/modules/shop-match.ts b/frontend-vue/src/shared/api/types/modules/shop-match.ts
index d1fca1f0..88e5b683 100644
--- a/frontend-vue/src/shared/api/types/modules/shop-match.ts
+++ b/frontend-vue/src/shared/api/types/modules/shop-match.ts
@@ -232,7 +232,11 @@ async function postTaskProgressBatch<T>(
   }
 
   const requestPromise = unwrapJavaResponse(
-    post<JavaApiResponse<T>, { taskIds: number[] }>(path, { taskIds: normalizedTaskIds }, {
+    post<JavaApiResponse<T>, { taskIds: number[]; userId?: number }>(path, {
+      taskIds: normalizedTaskIds,
+      // 传当前用户 id：后端据此过滤非归属任务（未传时后端不过滤，保持向后兼容）
+      userId: Number(window.localStorage.getItem('uid')) || undefined,
+    }, {
       timeout: getTaskProgressTimeoutMs(),
     }),
   )
@@ -386,9 +390,13 @@ export function deletePendingProductRiskShopResult(shopName: string) {
 
 export function getProductRiskTasksBatch(taskIds: number[]) {
   return unwrapJavaResponse(
-    post<JavaApiResponse<ProductRiskTaskBatchVo>, { taskIds: number[] }>(
+    post<JavaApiResponse<ProductRiskTaskBatchVo>, { taskIds: number[]; userId?: number }>(
       `${JAVA_API_PREFIX}/product-risk-resolve/tasks/batch`,
-      { taskIds },
+      {
+        taskIds,
+        // 传当前用户 id：后端据此过滤非归属任务（未传时后端不过滤，保持向后兼容）
+        userId: Number(window.localStorage.getItem('uid')) || undefined,
+      },
     ),
   );
 }
@@ -548,9 +556,13 @@ export function completeShopMatchTaskStage(taskId: number, stageIndex: number) {
 
 export function getShopMatchTasksBatch(taskIds: number[]) {
   return unwrapJavaResponse(
-    post<JavaApiResponse<ShopMatchTaskBatchVo>, { taskIds: number[] }>(
+    post<JavaApiResponse<ShopMatchTaskBatchVo>, { taskIds: number[]; userId?: number }>(
       `${JAVA_API_PREFIX}/shop-match/tasks/batch`,
-      { taskIds },
+      {
+        taskIds,
+        // 传当前用户 id：后端据此过滤非归属任务（未传时后端不过滤，保持向后兼容）
+        userId: Number(window.localStorage.getItem('uid')) || undefined,
+      },
     ),
   );
 }
diff --git a/frontend-vue/src/shared/api/types/modules/similar-asin.ts b/frontend-vue/src/shared/api/types/modules/similar-asin.ts
index cff0772d..49c63a77 100644
--- a/frontend-vue/src/shared/api/types/modules/similar-asin.ts
+++ b/frontend-vue/src/shared/api/types/modules/similar-asin.ts
@@ -148,7 +148,11 @@ async function postTaskProgressBatch<T>(
   }
 
   const requestPromise = unwrapJavaResponse(
-    post<JavaApiResponse<T>, { taskIds: number[] }>(path, { taskIds: normalizedTaskIds }, {
+    post<JavaApiResponse<T>, { taskIds: number[]; userId?: number }>(path, {
+      taskIds: normalizedTaskIds,
+      // 传当前用户 id：后端据此过滤非归属任务（未传时后端不过滤，保持向后兼容）
+      userId: Number(window.localStorage.getItem('uid')) || undefined,
+    }, {
       timeout: getTaskProgressTimeoutMs(),
     }),
   )
diff --git a/frontend-vue/src/shared/api/types/modules/withdraw.ts b/frontend-vue/src/shared/api/types/modules/withdraw.ts
index 5a85382e..3cd60ccb 100644
--- a/frontend-vue/src/shared/api/types/modules/withdraw.ts
+++ b/frontend-vue/src/shared/api/types/modules/withdraw.ts
@@ -206,7 +206,11 @@ async function postTaskProgressBatch<T>(
   }
 
   const requestPromise = unwrapJavaResponse(
-    post<JavaApiResponse<T>, { taskIds: number[] }>(path, { taskIds: normalizedTaskIds }, {
+    post<JavaApiResponse<T>, { taskIds: number[]; userId?: number }>(path, {
+      taskIds: normalizedTaskIds,
+      // 传当前用户 id：后端据此过滤非归属任务（未传时后端不过滤，保持向后兼容）
+      userId: Number(window.localStorage.getItem('uid')) || undefined,
+    }, {
       timeout: getTaskProgressTimeoutMs(),
     }),
   )
diff --git a/frontend-vue/src/shared/client-changelog.ts b/frontend-vue/src/shared/client-changelog.ts
new file mode 100644
index 00000000..032191df
--- /dev/null
+++ b/frontend-vue/src/shared/client-changelog.ts
@@ -0,0 +1,148 @@
+/**
+ * 桌面客户端更新日志（面向用户的通俗说明，桌面端更新面板展示）。
+ *
+ * 数据来源：app_client 仓库 git 历史——以各版本发版提交
+ * （chore(release): 版本号 x.y.z …）为界，取该窗口内的 feat/fix 提交，
+ * 自动整理成"用户能看懂的一句话"后追加到本文件（新版本放最前）。
+ * 取某版本区间的原始提交：
+ *   git -C app_client log --oneline <上一版提交>..<本版提交>
+ *
+ * 注意：version 必须与 web_config 发布记录 / /api/version/latest 的版本号
+ * 完全一致（不带 v 前缀），否则按本机版本筛选时匹配不到条目。
+ */
+
+import { compareVersions, normVersion } from './utils/version-compare.ts'
+
+export interface ClientChangelogEntry {
+  /** 客户端版本号，与线上发布记录一致 */
+  version: string
+  /** 发布日期 yyyy-MM-dd */
+  date: string
+  /** 面向用户的更新说明，一条一行，不用技术术语 */
+  items: string[]
+}
+
+/** 更新日志数据（新版本在前；发版时在数组最前追加一条） */
+export const CLIENT_CHANGELOG: ClientChangelogEntry[] = [
+  {
+    version: '4.0.11',
+    date: '2026-09-13',
+    items: [
+      '代理失效会自动切换并暂停购买，减少花冤枉钱',
+      '风险审批结果自动保存，网络波动也不白干（断开后自动补交）',
+      '品牌检测连续失败时自动停止，不再反复无效尝试',
+    ],
+  },
+  {
+    version: '4.0.10',
+    date: '2026-09-13',
+    items: [
+      '修复切换国家时页面断开后一直卡住不动的问题',
+      '修复产品风险审批"批准"数量一直不减（处理了却没算数）的问题',
+    ],
+  },
+  {
+    version: '4.0.9',
+    date: '2026-09-13',
+    items: [
+      '修复长时间使用后电脑越来越卡的问题（浏览器进程不再越积越多）',
+      '修复窗口最大化、还原时客户端偶尔没反应的问题',
+    ],
+  },
+  {
+    version: '4.0.7',
+    date: '2026-09-13',
+    items: [
+      '跟价、风险审批的"旧版/新版"选项恢复真实生效（选哪个就走哪个）',
+      '店铺界面已是新版时选"旧版"会明确提示，不再假装处理成功',
+    ],
+  },
+  {
+    version: '4.0.6',
+    date: '2026-09-13',
+    items: ['跟价指定 ASIN 时严格按指定范围执行，未指定 ASIN 的国家不再全量改价'],
+  },
+  {
+    version: '4.0.5',
+    date: '2026-09-13',
+    items: [
+      '重做产品风险审批的保存流程：保存结果如实反馈，不再"显示成功其实没保存"',
+      '修复风险审批多条待处理记录只处理第一条的问题',
+    ],
+  },
+  {
+    version: '4.0.4',
+    date: '2026-09-13',
+    items: [
+      '修复风险审批新界面里"提交"按钮从未被点击、选了记录也不保存的问题',
+      '修复跟价提示改价成功、实际没改价的问题；未设置最低价时不再漏处理商品',
+    ],
+  },
+  {
+    version: '4.0.3',
+    date: '2026-09-12',
+    items: [
+      '货源查询改用真实浏览器采集，结果更准确',
+      '修复跟价把购物车里已加购的商品误判为"没有卖家"的问题',
+      '修复部分电脑提示"更新程序缺失"无法自动更新；更新显示真实下载进度',
+    ],
+  },
+  {
+    version: '4.0.2',
+    date: '2026-09-12',
+    items: ['修复跟价等任务只处理第一页商品、其余被跳过的问题'],
+  },
+  {
+    version: '4.0.1',
+    date: '2026-09-12',
+    items: ['修复货源查询结果中"阿里巴巴"商品图片整列空白的问题'],
+  },
+  {
+    version: '4.0.0',
+    date: '2026-09-11',
+    items: [
+      '修复产品风险审批新界面频繁提示"处理失败"的问题',
+      '修复商品翻页加载慢时只处理第一页的问题',
+    ],
+  },
+  {
+    version: '3.0.73',
+    date: '2026-09-11',
+    items: ['修复集采数据、跟价等功能因接口鉴权失败无法使用的问题'],
+  },
+  {
+    version: '3.0.71',
+    date: '2026-09-11',
+    items: ['升级支持断点续传，并显示真实的下载进度'],
+  },
+]
+
+/** 数据文件里最新的版本号（无数据时空串）。 */
+export function newestChangelogVersion(entries: ClientChangelogEntry[] = CLIENT_CHANGELOG): string {
+  return entries.length ? normVersion(entries[0].version) : ''
+}
+
+/**
+ * 挑选本次要展示的更新日志：本机版本之后、最新版本（含）之间的条目，新的在前。
+ *
+ * - latestVersion 为空（检测未完成/失败）时按数据文件里最新版本兜底；
+ * - currentVersion 为空（旧客户端无版本桥）时只给最新版本一条，不把整段历史倒给用户；
+ * - 本机版本已高于线上（灰度/回滚）时返回空数组，由调用方隐藏该区块。
+ */
+export function selectChangelogEntries(options: {
+  currentVersion?: string
+  latestVersion?: string
+  entries?: ClientChangelogEntry[]
+} = {}): ClientChangelogEntry[] {
+  const entries = options.entries ?? CLIENT_CHANGELOG
+  if (!entries.length) return []
+  const current = normVersion(options.currentVersion)
+  const upper = normVersion(options.latestVersion) || newestChangelogVersion(entries)
+  const inRange = entries.filter((entry) => compareVersions(entry.version, upper) <= 0)
+  if (!inRange.length) return []
+  if (!current) {
+    const newest = inRange.find((entry) => compareVersions(entry.version, upper) === 0)
+    return [newest ?? inRange[0]]
+  }
+  return inRange.filter((entry) => compareVersions(entry.version, current) > 0)
+}
diff --git a/frontend-vue/src/shared/components/NotificationBell.vue b/frontend-vue/src/shared/components/NotificationBell.vue
index 19187ef5..e024d611 100644
--- a/frontend-vue/src/shared/components/NotificationBell.vue
+++ b/frontend-vue/src/shared/components/NotificationBell.vue
@@ -13,7 +13,7 @@
         viewBox="0 0 24 24"
         fill="none"
         stroke="currentColor"
-        stroke-width="2"
+        stroke-width="1.8"
         stroke-linecap="round"
         stroke-linejoin="round"
         aria-hidden="true"
@@ -35,8 +35,11 @@
         role="dialog"
         aria-label="通知列表"
       >
-      <div class="bell-panel-head">
-        <span class="bell-panel-title">通知</span>
+      <header class="bell-head">
+        <div class="bell-head-title">
+          <span class="bell-title-text">通知</span>
+          <span v-if="unreadCount > 0" class="bell-unread-chip">{{ unreadChipText }}</span>
+        </div>
         <button
           v-if="unreadCount > 0"
           type="button"
@@ -44,33 +47,75 @@
           :disabled="markingAll"
           @click="readAll"
         >
-          {{ markingAll ? '处理中...' : '全部已读' }}
+          <svg
+            viewBox="0 0 24 24"
+            fill="none"
+            stroke="currentColor"
+            stroke-width="2.4"
+            stroke-linecap="round"
+            stroke-linejoin="round"
+            aria-hidden="true"
+          >
+            <path d="m5 12 5 5L20 7" />
+          </svg>
+          {{ markingAll ? '处理中' : '全部已读' }}
         </button>
-      </div>
+      </header>
 
-      <div class="bell-search">
-        <input
-          v-model="keyword"
-          type="text"
-          class="bell-search-input"
-          placeholder="搜索标题或内容"
-          aria-label="搜索通知"
-          @input="onKeywordInput"
-        />
-        <div class="bell-search-days">
+      <div class="bell-filters">
+        <div class="bell-search-box">
+          <svg
+            class="bell-search-icon"
+            viewBox="0 0 24 24"
+            fill="none"
+            stroke="currentColor"
+            stroke-width="2"
+            stroke-linecap="round"
+            stroke-linejoin="round"
+            aria-hidden="true"
+          >
+            <circle cx="11" cy="11" r="7" />
+            <path d="m21 21-4.35-4.35" />
+          </svg>
           <input
-            v-model="startDate"
-            type="date"
-            class="bell-date-input"
-            aria-label="起始日期"
-            @change="reload"
+            v-model="keyword"
+            type="text"
+            class="bell-search-input"
+            placeholder="搜索标题或内容"
+            aria-label="搜索通知"
+            @input="onKeywordInput"
           />
-          <span class="bell-date-sep">至</span>
-          <input
-            v-model="endDate"
-            type="date"
-            class="bell-date-input"
-            aria-label="结束日期"
+          <button
+            v-if="keyword"
+            type="button"
+            class="bell-search-clear"
+            aria-label="清空搜索"
+            @click="clearKeyword"
+          >
+            <svg
+              viewBox="0 0 24 24"
+              fill="none"
+              stroke="currentColor"
+              stroke-width="2.2"
+              stroke-linecap="round"
+              aria-hidden="true"
+            >
+              <path d="M18 6 6 18M6 6l12 12" />
+            </svg>
+          </button>
+        </div>
+        <div class="bell-search-days">
+          <el-date-picker
+            :model-value="dateRange"
+            type="daterange"
+            value-format="YYYY-MM-DD"
+            start-placeholder="开始日期"
+            end-placeholder="结束日期"
+            range-separator="至"
+            class="bell-date-picker"
+            popper-class="bell-date-popper"
+            :clearable="true"
+            @update:model-value="onDateRangeChange"
             @change="reload"
           />
           <button v-if="hasFilter" type="button" class="bell-search-reset" @click="resetFilters">
@@ -79,11 +124,39 @@
         </div>
       </div>
 
-      <div v-if="loading && !items.length" class="bell-empty">正在加载...</div>
-      <div v-else-if="loadError && !items.length" class="bell-empty bell-empty--error">{{ loadError }}</div>
-      <div v-else-if="!items.length" class="bell-empty">
-        {{ hasFilter ? '没有符合条件的通知' : '暂无通知' }}
+      <div v-if="loading && !items.length" class="bell-skeleton" aria-label="正在加载">
+        <div v-for="row in 3" :key="row" class="bell-skeleton-row">
+          <span class="bell-skeleton-icon"></span>
+          <span class="bell-skeleton-lines">
+            <span class="bell-skeleton-bar bell-skeleton-bar--title"></span>
+            <span class="bell-skeleton-bar bell-skeleton-bar--text"></span>
+          </span>
+        </div>
       </div>
+
+      <div v-else-if="loadError && !items.length" class="bell-state">
+        <span class="bell-state-icon bell-state-icon--error" aria-hidden="true">
+          <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round">
+            <circle cx="12" cy="12" r="9" />
+            <path d="M12 8v4" />
+            <path d="M12 16h.01" />
+          </svg>
+        </span>
+        <p class="bell-state-text">{{ loadError }}</p>
+        <button type="button" class="bell-state-action" @click="reload">重新加载</button>
+      </div>
+
+      <div v-else-if="!items.length" class="bell-state">
+        <span class="bell-state-icon" aria-hidden="true">
+          <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round">
+            <path d="M18 8a6 6 0 0 0-12 0c0 7-3 9-3 9h18s-3-2-3-9" />
+            <path d="M13.73 21a2 2 0 0 1-3.46 0" />
+          </svg>
+        </span>
+        <p class="bell-state-text">{{ hasFilter ? '没有符合条件的通知' : '暂无通知' }}</p>
+        <p v-if="hasFilter" class="bell-state-sub">试试调整搜索词或时间范围</p>
+      </div>
+
       <ul v-else class="bell-list">
         <template v-for="group in groupedItems" :key="group.day || 'unknown'">
           <li class="bell-day-head">{{ group.label }}</li>
@@ -91,38 +164,94 @@
             v-for="item in group.items"
             :key="item.id"
             class="bell-item"
-            :class="[`bell-item--${item.level || 'warning'}`, { 'bell-item--unread': !item.read }]"
+            :class="[`bell-item--${itemLevel(item)}`, { 'bell-item--unread': !item.read }]"
             @click="onItemClick(item)"
           >
-            <div class="bell-item-head">
-              <span class="bell-item-title">{{ item.title }}</span>
-              <span class="bell-item-time">{{ formatTime(item.createdAt) }}</span>
+            <span class="bell-item-icon" aria-hidden="true">
+              <svg
+                v-if="itemLevel(item) === 'error'"
+                viewBox="0 0 24 24"
+                fill="none"
+                stroke="currentColor"
+                stroke-width="2"
+                stroke-linecap="round"
+                stroke-linejoin="round"
+              >
+                <path d="M10.29 3.86 1.82 18a2 2 0 0 0 1.71 3h16.94a2 2 0 0 0 1.71-3L13.71 3.86a2 2 0 0 0-3.42 0z" />
+                <path d="M12 9v4" />
+                <path d="M12 17h.01" />
+              </svg>
+              <svg
+                v-else-if="itemLevel(item) === 'info'"
+                viewBox="0 0 24 24"
+                fill="none"
+                stroke="currentColor"
+                stroke-width="2"
+                stroke-linecap="round"
+                stroke-linejoin="round"
+              >
+                <circle cx="12" cy="12" r="9" />
+                <path d="M12 11v5" />
+                <path d="M12 8h.01" />
+              </svg>
+              <svg
+                v-else
+                viewBox="0 0 24 24"
+                fill="none"
+                stroke="currentColor"
+                stroke-width="2"
+                stroke-linecap="round"
+                stroke-linejoin="round"
+              >
+                <circle cx="12" cy="12" r="9" />
+                <path d="M12 8v4" />
+                <path d="M12 16h.01" />
+              </svg>
+            </span>
+            <div class="bell-item-main">
+              <div class="bell-item-head">
+                <span class="bell-item-title" :title="item.title">{{ item.title }}</span>
+                <span class="bell-item-dot" :class="{ 'bell-item-dot--on': !item.read }" aria-hidden="true"></span>
+                <span class="bell-item-time">{{ formatTime(item.createdAt) }}</span>
+              </div>
+              <p class="bell-item-content" :title="item.content">{{ item.content }}</p>
             </div>
-            <div class="bell-item-content">{{ item.content }}</div>
           </li>
         </template>
       </ul>
 
-      <div class="bell-panel-foot">
-        <button
-          type="button"
-          class="bell-page-btn"
-          :disabled="page <= 1 || loading"
-          @click="goPage(page - 1)"
-        >
-          上一页
-        </button>
-        <span class="bell-page-info">{{ page }} / {{ totalPages }}</span>
-        <button
-          type="button"
-          class="bell-page-btn"
-          :disabled="page >= totalPages || loading"
-          @click="goPage(page + 1)"
-        >
-          下一页
-        </button>
-        <span class="bell-page-total">共 {{ total }} 条</span>
-      </div>
+      <footer class="bell-foot">
+        <div class="bell-foot-meta">
+          <span class="bell-foot-total">共 {{ total }} 条</span>
+          <select
+            v-model="pageSize"
+            class="bell-size-select"
+            aria-label="每页条数"
+            @change="onPageSizeChange"
+          >
+            <option v-for="size in PAGE_SIZES" :key="size" :value="size">{{ size }}条/页</option>
+          </select>
+        </div>
+        <div class="bell-pager">
+          <button
+            type="button"
+            class="bell-page-btn"
+            :disabled="page <= 1 || loading"
+            @click="goPage(page - 1)"
+          >
+            上一页
+          </button>
+          <span class="bell-page-info">第 {{ page }} / {{ totalPages }} 页</span>
+          <button
+            type="button"
+            class="bell-page-btn"
+            :disabled="page >= totalPages || loading"
+            @click="goPage(page + 1)"
+          >
+            下一页
+          </button>
+        </div>
+      </footer>
       </div>
     </Teleport>
   </div>
@@ -150,7 +279,8 @@ import {
   writeLastNotifiedId,
 } from '@/shared/utils/notification-bell.ts'
 
-const PAGE_SIZE = 10
+const DEFAULT_PAGE_SIZE = 10
+const PAGE_SIZES = [10, 20, 50, 100]
 
 /** 顶栏主题：工具页/配置页深色（dark），桌面入口首页浅色（light）。 */
 const props = withDefaults(defineProps<{ theme?: 'dark' | 'light' }>(), {
@@ -167,26 +297,39 @@ const unreadCount = ref(0)
 const items = ref<NotificationItem[]>([])
 const total = ref(0)
 const page = ref(1)
+/** 每页条数（面板底部下拉，取值同后台列表分页 10/20/50/100）。 */
+const pageSize = ref(DEFAULT_PAGE_SIZE)
 const panelOpen = ref(false)
 const loading = ref(false)
 const markingAll = ref(false)
 const loadError = ref('')
 const keyword = ref('')
-const startDate = ref('')
-const endDate = ref('')
+/** 日期区间（el-date-picker daterange，YYYY-MM-DD 字符串；未选为 null）。 */
+const dateRange = ref<[string, string] | null>(null)
 
 const badgeText = computed(() => formatUnreadBadge(unreadCount.value))
+const unreadChipText = computed(() =>
+  unreadCount.value > 99 ? '99+ 条未读' : `${unreadCount.value} 条未读`,
+)
 const groupedItems = computed(() => groupNotificationsByDay(items.value))
-const totalPages = computed(() => Math.max(1, Math.ceil(total.value / PAGE_SIZE)))
-const hasFilter = computed(() => Boolean(keyword.value.trim() || startDate.value || endDate.value))
+const totalPages = computed(() => Math.max(1, Math.ceil(total.value / pageSize.value)))
+const hasFilter = computed(() => Boolean(keyword.value.trim() || dateRange.value))
 
 let pollTimer: number | null = null
 let searchTimer: number | null = null
 
+/** 通知级别：后端只保证三类，非法值按 warning 兜底（配色与图标按级别区分）。 */
+function itemLevel(item: NotificationItem): 'error' | 'warning' | 'info' {
+  return item.level === 'error' || item.level === 'info' ? item.level : 'warning'
+}
+
 /** 起止日期倒挂时自动交换，避免用户只看到「没有符合条件的通知」不知原因。 */
 function normalizedDayRange(): { startDate?: string; endDate?: string } {
-  let start = startDate.value
-  let end = endDate.value
+  const range = dateRange.value
+  if (!range) {
+    return {}
+  }
+  let [start, end] = range
   if (start && end && start > end) {
     const swapped = start
     start = end
@@ -195,6 +338,15 @@ function normalizedDayRange(): { startDate?: string; endDate?: string } {
   return { startDate: start || undefined, endDate: end || undefined }
 }
 
+/** 日期区间变化（选择完成/清空都会触发）：只保留「两端齐全」的区间。 */
+function onDateRangeChange(value: unknown) {
+  if (Array.isArray(value) && value.length === 2 && value[0] && value[1]) {
+    dateRange.value = [String(value[0]), String(value[1])]
+    return
+  }
+  dateRange.value = null
+}
+
 /** 拉未读数：发现新通知提醒一次（localStorage 记录已提醒过的最大 id，避免重复弹）。 */
 async function refreshSummary() {
   try {
@@ -218,7 +370,7 @@ async function loadPage(targetPage: number) {
   try {
     const result = await fetchNotificationList({
       page: targetPage,
-      pageSize: PAGE_SIZE,
+      pageSize: pageSize.value,
       keyword: keyword.value,
       ...normalizedDayRange(),
     })
@@ -250,6 +402,12 @@ function goPage(targetPage: number) {
   void loadPage(safe)
 }
 
+/** 切换每页条数：回到第一页重新查询。 */
+function onPageSizeChange() {
+  console.log('[notification] 每页条数切换为', pageSize.value)
+  void loadPage(1)
+}
+
 /** 搜索/日期变化后回到第一页重新查询。 */
 function reload() {
   void loadPage(1)
@@ -266,21 +424,31 @@ function onKeywordInput() {
   }, 300)
 }
 
+function clearKeyword() {
+  keyword.value = ''
+  void loadPage(1)
+}
+
 function resetFilters() {
   keyword.value = ''
-  startDate.value = ''
-  endDate.value = ''
+  dateRange.value = null
   void loadPage(1)
 }
 
 /** 面板挂到 body 后用 fixed 定位，位置按触发器实时算（右对齐在铃铛下方）。 */
+const PANEL_WIDTH = 376
+
 function syncPanelPosition() {
   const trigger = rootRef.value
   if (!trigger) return
   const rect = trigger.getBoundingClientRect()
+  // 窗口过窄时右对齐会把面板顶出左边界，这里把 right 收回来保证整块可见
+  const panelWidth = Math.min(PANEL_WIDTH, window.innerWidth - 24)
+  const maxRight = Math.max(8, window.innerWidth - panelWidth - 8)
+  const right = Math.min(Math.max(8, Math.round(window.innerWidth - rect.right)), maxRight)
   panelStyle.value = {
     top: `${Math.round(rect.bottom + 10)}px`,
-    right: `${Math.max(8, Math.round(window.innerWidth - rect.right))}px`,
+    right: `${right}px`,
   }
 }
 
@@ -330,6 +498,8 @@ function onDocumentMouseDown(event: MouseEvent) {
   const target = event.target
   if (!(target instanceof Node)) return
   if (rootRef.value?.contains(target) || panelRef.value?.contains(target)) return
+  // 日期选择面板同样挂在 body 上（el-popper），点它不应关闭通知面板
+  if (target instanceof Element && target.closest('.el-popper')) return
   panelOpen.value = false
 }
 
@@ -391,7 +561,7 @@ onUnmounted(() => {
   height: 34px;
   padding: 0;
   border: none;
-  border-radius: 8px;
+  border-radius: 9px;
   background: transparent;
   color: #c8d2e2;
   cursor: pointer;
@@ -411,10 +581,10 @@ onUnmounted(() => {
 
 .bell-badge {
   position: absolute;
-  top: 2px;
-  right: 1px;
-  min-width: 16px;
-  height: 16px;
+  top: 1px;
+  right: 0;
+  min-width: 17px;
+  height: 17px;
   padding: 0 4px;
   box-sizing: border-box;
   border-radius: 999px;
@@ -422,47 +592,132 @@ onUnmounted(() => {
   color: #fff;
   font-size: 10px;
   font-weight: 700;
-  line-height: 16px;
+  line-height: 17px;
   text-align: center;
+  box-shadow: 0 1px 4px rgba(229, 72, 77, 0.45);
   pointer-events: none;
 }
 
+/* ---------------- 面板 ---------------- */
+
 .bell-panel {
+  --bell-bg: #151a26;
+  --bell-bg-elev: #1a2130;
+  --bell-border: #2b3548;
+  --bell-text: #ecf2fa;
+  --bell-text-dim: #9fabc0;
+  --bell-text-mute: #6f7d92;
+  --bell-accent: #6ea8ff;
+  --bell-accent-soft: rgba(110, 168, 255, 0.14);
+  --bell-hover: rgba(255, 255, 255, 0.045);
+  --bell-unread-bg: rgba(110, 168, 255, 0.07);
+  --bell-input-bg: #10151f;
+  --bell-shadow: 0 20px 48px rgba(0, 0, 0, 0.52), 0 2px 8px rgba(0, 0, 0, 0.32);
+  --bell-error: #ff7b7b;
+  --bell-error-bg: rgba(255, 123, 123, 0.14);
+  --bell-warning: #f0bb61;
+  --bell-warning-bg: rgba(240, 187, 97, 0.14);
+  --bell-info: #6ea8ff;
+  --bell-info-bg: rgba(110, 168, 255, 0.14);
+  --bell-skeleton: rgba(255, 255, 255, 0.07);
+  --bell-skeleton-shine: rgba(255, 255, 255, 0.13);
+
   position: fixed;
   z-index: 3200;
-  width: 360px;
-  max-width: calc(100vw - 32px);
-  max-height: 520px;
   display: flex;
   flex-direction: column;
-  border: 1px solid #2c3540;
-  border-radius: 12px;
-  background: #171b20;
-  box-shadow: 0 18px 48px rgba(0, 0, 0, 0.55);
+  width: 376px;
+  max-width: calc(100vw - 24px);
+  max-height: min(560px, calc(100vh - 96px));
+  border: 1px solid var(--bell-border);
+  border-radius: 14px;
+  background: var(--bell-bg);
+  box-shadow: var(--bell-shadow);
   overflow: hidden;
+  font-family: "PingFang SC", "Microsoft YaHei UI", "Microsoft YaHei", "微软雅黑", sans-serif;
 }
 
-.bell-panel-head {
+.bell-panel--light {
+  --bell-bg: #ffffff;
+  --bell-bg-elev: #f7f9fc;
+  --bell-border: #e6ecf3;
+  --bell-text: #1e2a3a;
+  --bell-text-dim: #5d6b7e;
+  --bell-text-mute: #93a1b3;
+  --bell-accent: #4c5bd4;
+  --bell-accent-soft: rgba(76, 91, 212, 0.1);
+  --bell-hover: #f2f6fb;
+  --bell-unread-bg: rgba(76, 91, 212, 0.055);
+  --bell-input-bg: #ffffff;
+  --bell-shadow: 0 20px 44px rgba(23, 43, 77, 0.16), 0 2px 8px rgba(23, 43, 77, 0.08);
+  --bell-error: #d64545;
+  --bell-error-bg: rgba(214, 69, 69, 0.1);
+  --bell-warning: #b57b23;
+  --bell-warning-bg: rgba(181, 123, 35, 0.12);
+  --bell-info: #4c5bd4;
+  --bell-info-bg: rgba(76, 91, 212, 0.1);
+  --bell-skeleton: #eef2f7;
+  --bell-skeleton-shine: #f8fafd;
+}
+
+/* 头部 */
+.bell-head {
   display: flex;
+  flex: 0 0 auto;
   align-items: center;
   justify-content: space-between;
-  padding: 12px 14px;
-  border-bottom: 1px solid #262d35;
+  gap: 8px;
+  padding: 13px 16px 11px;
 }
 
-.bell-panel-title {
-  color: #eef4fb;
-  font-size: 14px;
+.bell-head-title {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+  min-width: 0;
+}
+
+.bell-title-text {
+  color: var(--bell-text);
+  font-size: 15px;
   font-weight: 700;
+  letter-spacing: 0.01em;
+}
+
+.bell-unread-chip {
+  padding: 2px 8px;
+  border-radius: 999px;
+  background: var(--bell-accent-soft);
+  color: var(--bell-accent);
+  font-size: 11px;
+  font-weight: 600;
+  white-space: nowrap;
 }
 
 .bell-read-all {
-  border: none;
+  display: inline-flex;
+  flex-shrink: 0;
+  align-items: center;
+  gap: 4px;
+  padding: 5px 10px;
+  border: 1px solid var(--bell-border);
+  border-radius: 8px;
   background: transparent;
-  color: #8dc4ff;
+  color: var(--bell-text-dim);
   font-size: 12px;
   cursor: pointer;
-  padding: 0;
+  transition: color 0.15s ease, border-color 0.15s ease, background 0.15s ease;
+}
+
+.bell-read-all svg {
+  width: 12px;
+  height: 12px;
+}
+
+.bell-read-all:hover:not(:disabled) {
+  border-color: var(--bell-accent);
+  background: var(--bell-hover);
+  color: var(--bell-accent);
 }
 
 .bell-read-all:disabled {
@@ -470,308 +725,521 @@ onUnmounted(() => {
   cursor: not-allowed;
 }
 
-.bell-empty {
-  padding: 32px 0;
-  color: #7f8a96;
-  font-size: 13px;
-  text-align: center;
-}
-
-.bell-empty--error {
-  color: #ff9b9b;
-}
-
-.bell-list {
-  flex: 1;
-  margin: 0;
-  padding: 0;
-  list-style: none;
-  overflow-y: auto;
-}
-
-.bell-item {
-  padding: 11px 14px;
-  border-bottom: 1px solid #222830;
-  cursor: pointer;
-  transition: background 0.12s ease;
-}
-
-.bell-item:hover {
-  background: #1d242c;
-}
-
-.bell-item--unread {
-  background: #1b232e;
-}
-
-.bell-item--unread .bell-item-title::before {
-  content: '';
-  display: inline-block;
-  width: 7px;
-  height: 7px;
-  margin-right: 7px;
-  border-radius: 50%;
-  background: #e5484d;
-  vertical-align: 1px;
-}
-
-.bell-item--error .bell-item-title {
-  color: #ffb4b4;
-}
-
-.bell-item--warning .bell-item-title {
-  color: #f0c674;
-}
-
-.bell-item--info .bell-item-title {
-  color: #8dc4ff;
-}
-
-.bell-item-head {
+/* 筛选区 */
+.bell-filters {
   display: flex;
-  align-items: baseline;
-  justify-content: space-between;
-  gap: 10px;
+  flex: 0 0 auto;
+  flex-direction: column;
+  gap: 8px;
+  padding: 10px 12px 12px;
+  border-bottom: 1px solid var(--bell-border);
+  background: var(--bell-bg-elev);
 }
 
-.bell-item-title {
-  color: #dce6f0;
-  font-size: 13px;
-  font-weight: 700;
-  min-width: 0;
-  overflow: hidden;
-  text-overflow: ellipsis;
-  white-space: nowrap;
-}
-
-.bell-item-time {
-  flex-shrink: 0;
-  color: #6f7a86;
-  font-size: 11px;
-}
-
-.bell-item-content {
-  margin-top: 4px;
-  color: #9aa6b3;
-  font-size: 12px;
-  line-height: 1.55;
-  word-break: break-all;
-}
-
-.bell-panel-foot {
+.bell-search-box {
+  position: relative;
   display: flex;
   align-items: center;
-  justify-content: center;
-  gap: 10px;
-  padding: 7px 12px;
-  border-top: 1px solid #262d35;
 }
 
-.bell-search {
-  display: flex;
-  flex-direction: column;
-  gap: 6px;
-  padding: 10px 12px;
-  border-bottom: 1px solid #262d35;
-  background: #141920;
-}
-
-.bell-search-input,
-.bell-date-input {
-  height: 28px;
-  padding: 0 8px;
-  box-sizing: border-box;
-  border: 1px solid #2c3540;
-  border-radius: 6px;
-  background: #1b2027;
-  color: #dce6f0;
-  font-size: 12px;
-  outline: none;
-  color-scheme: dark;
+.bell-search-icon {
+  position: absolute;
+  left: 10px;
+  width: 14px;
+  height: 14px;
+  color: var(--bell-text-mute);
+  pointer-events: none;
 }
 
 .bell-search-input {
   width: 100%;
+  height: 32px;
+  padding: 0 30px 0 32px;
+  box-sizing: border-box;
+  border: 1px solid var(--bell-border);
+  border-radius: 9px;
+  background: var(--bell-input-bg);
+  color: var(--bell-text);
+  font-size: 12px;
+  outline: none;
+  transition: border-color 0.15s ease, box-shadow 0.15s ease;
 }
 
-.bell-search-input:focus,
-.bell-date-input:focus {
-  border-color: #4a86c7;
+.bell-search-input::placeholder {
+  color: var(--bell-text-mute);
+}
+
+.bell-search-input:focus {
+  border-color: var(--bell-accent);
+  box-shadow: 0 0 0 3px var(--bell-accent-soft);
+}
+
+.bell-search-clear {
+  position: absolute;
+  right: 8px;
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  width: 16px;
+  height: 16px;
+  padding: 0;
+  border: none;
+  border-radius: 50%;
+  background: var(--bell-border);
+  color: var(--bell-bg);
+  cursor: pointer;
+}
+
+.bell-search-clear svg {
+  width: 10px;
+  height: 10px;
+}
+
+.bell-search-clear:hover {
+  background: var(--bell-text-mute);
 }
 
 .bell-search-days {
   display: flex;
   align-items: center;
-  gap: 6px;
+  gap: 8px;
 }
 
-.bell-date-input {
+.bell-date-picker {
   flex: 1;
   min-width: 0;
+  width: 100%;
 }
 
-.bell-date-sep {
-  color: #6f7a86;
+.bell-panel :deep(.bell-date-picker.el-date-editor) {
+  --el-fill-color-blank: var(--bell-input-bg);
+  --el-text-color-regular: var(--bell-text);
+  --el-text-color-placeholder: var(--bell-text-mute);
+  --el-text-color-secondary: var(--bell-text-mute);
+  --el-border-color: var(--bell-border);
+  --el-border-color-hover: var(--bell-accent);
+  --el-color-primary: var(--bell-accent);
+  height: 32px;
+  border-radius: 9px;
+}
+
+.bell-panel :deep(.bell-date-picker .el-range-input) {
   font-size: 12px;
 }
 
+.bell-panel :deep(.bell-date-picker .el-range-separator) {
+  font-size: 12px;
+  color: var(--bell-text-mute);
+}
+
 .bell-search-reset {
   flex-shrink: 0;
-  height: 28px;
-  padding: 0 8px;
-  border: 1px solid #2c3540;
-  border-radius: 6px;
-  background: #1b2027;
-  color: #8dc4ff;
+  height: 32px;
+  padding: 0 12px;
+  border: 1px solid var(--bell-border);
+  border-radius: 9px;
+  background: var(--bell-input-bg);
+  color: var(--bell-text-dim);
   font-size: 12px;
   cursor: pointer;
+  transition: color 0.15s ease, border-color 0.15s ease;
 }
 
 .bell-search-reset:hover {
-  background: #212832;
+  border-color: var(--bell-accent);
+  color: var(--bell-accent);
+}
+
+/* 列表 */
+.bell-list {
+  flex: 1;
+  margin: 0;
+  padding: 0 0 4px;
+  list-style: none;
+  overflow-y: auto;
+  scrollbar-width: thin;
+  scrollbar-color: var(--bell-border) transparent;
+}
+
+.bell-list::-webkit-scrollbar {
+  width: 8px;
+}
+
+.bell-list::-webkit-scrollbar-track {
+  background: transparent;
+}
+
+.bell-list::-webkit-scrollbar-thumb {
+  border: 2px solid transparent;
+  border-radius: 999px;
+  background: var(--bell-border);
+  background-clip: content-box;
+}
+
+.bell-list::-webkit-scrollbar-thumb:hover {
+  background: var(--bell-text-mute);
+  background-clip: content-box;
 }
 
 .bell-day-head {
-  padding: 6px 14px;
-  background: #1b232e;
-  color: #8b97a4;
+  position: sticky;
+  top: 0;
+  z-index: 1;
+  padding: 9px 16px 6px;
+  background: var(--bell-bg);
+  color: var(--bell-text-mute);
   font-size: 11px;
-  font-weight: 700;
-  letter-spacing: 0.02em;
+  font-weight: 600;
+  letter-spacing: 0.04em;
 }
 
-.bell-page-btn {
-  padding: 3px 10px;
-  border: 1px solid #2c3540;
-  border-radius: 6px;
-  background: #1b2027;
-  color: #8dc4ff;
+.bell-item {
+  position: relative;
+  display: flex;
+  gap: 10px;
+  padding: 11px 16px;
+  border-top: 1px solid transparent;
+  cursor: pointer;
+  transition: background 0.12s ease;
+}
+
+.bell-item:hover {
+  background: var(--bell-hover);
+}
+
+.bell-item--unread {
+  background: var(--bell-unread-bg);
+}
+
+.bell-item-icon {
+  display: inline-flex;
+  flex: 0 0 auto;
+  align-items: center;
+  justify-content: center;
+  width: 26px;
+  height: 26px;
+  margin-top: 1px;
+  border-radius: 50%;
+  background: var(--bell-bg-elev);
+  color: var(--bell-text-mute);
+}
+
+.bell-item-icon svg {
+  width: 14px;
+  height: 14px;
+}
+
+.bell-item--unread.bell-item--error .bell-item-icon {
+  background: var(--bell-error-bg);
+  color: var(--bell-error);
+}
+
+.bell-item--unread.bell-item--warning .bell-item-icon {
+  background: var(--bell-warning-bg);
+  color: var(--bell-warning);
+}
+
+.bell-item--unread.bell-item--info .bell-item-icon {
+  background: var(--bell-info-bg);
+  color: var(--bell-info);
+}
+
+.bell-item-main {
+  flex: 1;
+  min-width: 0;
+}
+
+.bell-item-head {
+  display: flex;
+  align-items: baseline;
+  gap: 8px;
+}
+
+.bell-item-title {
+  flex: 1;
+  min-width: 0;
+  overflow: hidden;
+  color: var(--bell-text-dim);
+  font-size: 13px;
+  font-weight: 500;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+
+.bell-item--unread .bell-item-title {
+  color: var(--bell-text);
+  font-weight: 700;
+}
+
+.bell-item--unread.bell-item--error .bell-item-title {
+  color: var(--bell-error);
+}
+
+.bell-item--unread.bell-item--warning .bell-item-title {
+  color: var(--bell-warning);
+}
+
+.bell-item-dot {
+  flex: 0 0 auto;
+  align-self: center;
+  width: 6px;
+  height: 6px;
+  border-radius: 50%;
+  background: transparent;
+}
+
+.bell-item-dot--on {
+  background: var(--bell-error);
+}
+
+.bell-item-time {
+  flex: 0 0 auto;
+  color: var(--bell-text-mute);
+  font-size: 11px;
+  font-variant-numeric: tabular-nums;
+}
+
+.bell-item-content {
+  display: -webkit-box;
+  margin: 3px 0 0;
+  overflow: hidden;
+  color: var(--bell-text-mute);
+  font-size: 12px;
+  line-height: 1.6;
+  overflow-wrap: anywhere;
+  -webkit-box-orient: vertical;
+  -webkit-line-clamp: 2;
+}
+
+.bell-item--unread .bell-item-content {
+  color: var(--bell-text-dim);
+}
+
+/* 空态 / 加载态 */
+.bell-state {
+  display: flex;
+  flex: 1;
+  flex-direction: column;
+  align-items: center;
+  justify-content: center;
+  gap: 8px;
+  padding: 40px 20px;
+  text-align: center;
+}
+
+.bell-state-icon {
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  width: 46px;
+  height: 46px;
+  border-radius: 50%;
+  background: var(--bell-bg-elev);
+  color: var(--bell-text-mute);
+}
+
+.bell-state-icon svg {
+  width: 22px;
+  height: 22px;
+}
+
+.bell-state-icon--error {
+  background: var(--bell-error-bg);
+  color: var(--bell-error);
+}
+
+.bell-state-text {
+  margin: 0;
+  color: var(--bell-text-dim);
+  font-size: 13px;
+}
+
+.bell-state-sub {
+  margin: 0;
+  color: var(--bell-text-mute);
+  font-size: 12px;
+}
+
+.bell-state-action {
+  margin-top: 4px;
+  padding: 5px 14px;
+  border: 1px solid var(--bell-border);
+  border-radius: 8px;
+  background: transparent;
+  color: var(--bell-accent);
   font-size: 12px;
   cursor: pointer;
 }
 
+.bell-state-action:hover {
+  border-color: var(--bell-accent);
+  background: var(--bell-hover);
+}
+
+.bell-skeleton {
+  flex: 1;
+  padding: 8px 16px;
+}
+
+.bell-skeleton-row {
+  display: flex;
+  gap: 10px;
+  padding: 10px 0;
+}
+
+.bell-skeleton-icon {
+  flex: 0 0 auto;
+  width: 26px;
+  height: 26px;
+  border-radius: 50%;
+  background: var(--bell-skeleton);
+  animation: bell-pulse 1.4s ease-in-out infinite;
+}
+
+.bell-skeleton-lines {
+  display: flex;
+  flex: 1;
+  flex-direction: column;
+  gap: 8px;
+  padding-top: 2px;
+}
+
+.bell-skeleton-bar {
+  height: 10px;
+  border-radius: 5px;
+  background: var(--bell-skeleton);
+  animation: bell-pulse 1.4s ease-in-out infinite;
+}
+
+.bell-skeleton-bar--title {
+  width: 62%;
+}
+
+.bell-skeleton-bar--text {
+  width: 88%;
+  background: var(--bell-skeleton-shine);
+}
+
+@keyframes bell-pulse {
+  0%,
+  100% {
+    opacity: 1;
+  }
+
+  50% {
+    opacity: 0.45;
+  }
+}
+
+/* 底部：结构对齐后台列表分页（共 N 条 + 每页条数下拉 + 上一页 / 第 x / y 页 / 下一页） */
+.bell-foot {
+  display: flex;
+  flex: 0 0 auto;
+  flex-wrap: wrap;
+  align-items: center;
+  justify-content: space-between;
+  gap: 8px;
+  padding: 9px 12px 9px 16px;
+  border-top: 1px solid var(--bell-border);
+  background: var(--bell-bg-elev);
+}
+
+.bell-foot-meta {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+}
+
+.bell-foot-total {
+  color: var(--bell-text-mute);
+  font-size: 12px;
+  font-variant-numeric: tabular-nums;
+}
+
+.bell-size-select {
+  height: 26px;
+  padding: 0 4px;
+  border: 1px solid var(--bell-border);
+  border-radius: 7px;
+  background: var(--bell-bg);
+  color: var(--bell-text-dim);
+  font-family: inherit;
+  font-size: 12px;
+  cursor: pointer;
+  outline: none;
+  color-scheme: dark;
+}
+
+.bell-panel--light .bell-size-select {
+  color-scheme: light;
+}
+
+.bell-size-select:hover,
+.bell-size-select:focus {
+  border-color: var(--bell-accent);
+  color: var(--bell-accent);
+}
+
+.bell-size-select option {
+  background: var(--bell-bg);
+  color: var(--bell-text);
+}
+
+.bell-pager {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+}
+
+.bell-page-btn {
+  min-height: 26px;
+  padding: 0 10px;
+  border: 1px solid var(--bell-border);
+  border-radius: 8px;
+  background: var(--bell-bg);
+  color: var(--bell-text-dim);
+  font-family: inherit;
+  font-size: 12px;
+  cursor: pointer;
+  transition: color 0.15s ease, border-color 0.15s ease, background 0.15s ease;
+}
+
 .bell-page-btn:hover:not(:disabled) {
-  background: #212832;
+  border-color: var(--bell-accent);
+  background: var(--bell-hover);
+  color: var(--bell-accent);
 }
 
 .bell-page-btn:disabled {
-  opacity: 0.5;
+  background: var(--bell-bg-elev);
+  color: var(--bell-text-mute);
+  opacity: 0.6;
   cursor: not-allowed;
 }
 
 .bell-page-info {
-  color: #dce6f0;
+  min-width: 58px;
+  color: var(--bell-text-dim);
   font-size: 12px;
-  font-weight: 600;
-}
-
-.bell-page-total {
-  color: #6f7a86;
-  font-size: 11px;
+  font-variant-numeric: tabular-nums;
+  text-align: center;
 }
 
 /* ---- 浅色主题（桌面入口首页顶栏） ---- */
 .notification-bell--light .bell-trigger {
-  color: #555;
+  color: #55627a;
 }
 
 .notification-bell--light .bell-trigger:hover,
 .notification-bell--light .bell-trigger--active {
-  background: rgba(0, 0, 0, 0.06);
-  color: #333;
-}
-
-.bell-panel--light {
-  border-color: #e2e8f0;
-  background: #ffffff;
-  box-shadow: 0 18px 48px rgba(31, 45, 61, 0.18);
-}
-
-.bell-panel--light .bell-panel-head {
-  border-bottom-color: #edf1f5;
-}
-
-.bell-panel--light .bell-panel-title {
-  color: #333;
-}
-
-.bell-panel--light .bell-read-all {
+  background: rgba(76, 91, 212, 0.1);
   color: #4c5bd4;
 }
-
-.bell-panel--light .bell-empty {
-  color: #999;
-}
-
-.bell-panel--light .bell-item {
-  border-bottom-color: #f0f3f7;
-}
-
-.bell-panel--light .bell-item:hover {
-  background: #f7f9fc;
-}
-
-.bell-panel--light .bell-item--unread {
-  background: #f2f6ff;
-}
-
-.bell-panel--light .bell-item-title {
-  color: #333;
-}
-
-.bell-panel--light .bell-item--error .bell-item-title {
-  color: #c0392b;
-}
-
-.bell-panel--light .bell-item--warning .bell-item-title {
-  color: #a8793e;
-}
-
-.bell-panel--light .bell-item--info .bell-item-title {
-  color: #4c5bd4;
-}
-
-.bell-panel--light .bell-item-time {
-  color: #9aa6b3;
-}
-
-.bell-panel--light .bell-item-content {
-  color: #667085;
-}
-
-.bell-panel--light .bell-search {
-  background: #f8fafc;
-  border-bottom-color: #edf1f5;
-}
-
-.bell-panel--light .bell-search-input,
-.bell-panel--light .bell-date-input {
-  border-color: #e2e8f0;
-  background: #ffffff;
-  color: #333;
-  color-scheme: light;
-}
-
-.bell-panel--light .bell-day-head {
-  background: #f4f7fa;
-  color: #7c8b9a;
-}
-
-.bell-panel--light .bell-panel-foot {
-  border-top-color: #edf1f5;
-}
-
-.bell-panel--light .bell-page-btn {
-  border-color: #e2e8f0;
-  background: #ffffff;
-  color: #4c5bd4;
-}
-
-.bell-panel--light .bell-page-info {
-  color: #333;
-}
-
-.bell-panel--light .bell-page-total {
-  color: #9aa6b3;
-}
+</style>
+
+<style>
+/* 日期选择面板与通知面板同为 body 级浮层，须压在通知面板（3200）之上 */
+.bell-date-popper {
+  z-index: 3300 !important;
+}
 </style>
diff --git a/frontend-vue/src/shared/components/UpdateLogList.vue b/frontend-vue/src/shared/components/UpdateLogList.vue
new file mode 100644
index 00000000..471c8787
--- /dev/null
+++ b/frontend-vue/src/shared/components/UpdateLogList.vue
@@ -0,0 +1,87 @@
+<template>
+  <div v-if="entries.length" class="update-log">
+    <div class="update-log-title">更新日志</div>
+    <div class="update-log-scroll">
+      <div v-for="entry in entries" :key="entry.version" class="update-log-entry">
+        <div class="update-log-head">
+          <span class="update-log-version">v{{ entry.version }}</span>
+          <span v-if="entry.date" class="update-log-date">{{ entry.date }}</span>
+        </div>
+        <ul class="update-log-items">
+          <li v-for="item in entry.items" :key="item">{{ item }}</li>
+        </ul>
+      </div>
+    </div>
+  </div>
+</template>
+
+<script setup lang="ts">
+/**
+ * 客户端更新日志（登录页 / 首页更新面板共用）。
+ *
+ * 内容来自 shared/client-changelog（发版时按 git 历史整理追加），
+ * 由 useVersionUpdate 按"本机版本 → 最新版本"区间筛好后传入；
+ * 条目多时区域内滚动，避免把面板撑长。
+ */
+import type { ClientChangelogEntry } from '@/shared/client-changelog'
+
+defineProps<{ entries: ClientChangelogEntry[] }>()
+</script>
+
+<style scoped>
+.update-log {
+  margin-top: 10px;
+  padding-top: 8px;
+  border-top: 1px solid rgba(0, 0, 0, 0.06);
+  text-align: left;
+}
+
+.update-log-title {
+  font-size: 12.5px;
+  font-weight: 600;
+  color: #4e6479;
+  margin-bottom: 6px;
+}
+
+.update-log-scroll {
+  max-height: 176px;
+  overflow-y: auto;
+  padding-right: 4px;
+}
+
+.update-log-entry + .update-log-entry {
+  margin-top: 8px;
+  padding-top: 8px;
+  border-top: 1px dashed rgba(0, 0, 0, 0.07);
+}
+
+.update-log-head {
+  display: flex;
+  align-items: baseline;
+  gap: 6px;
+}
+
+.update-log-version {
+  font-size: 12.5px;
+  font-weight: 600;
+  color: #2f5d8b;
+}
+
+.update-log-date {
+  font-size: 11.5px;
+  color: #8293a5;
+}
+
+.update-log-items {
+  margin: 4px 0 0;
+  padding-left: 16px;
+  list-style: disc;
+}
+
+.update-log-items li {
+  font-size: 12.5px;
+  line-height: 1.6;
+  color: #4e6479;
+  word-break: break-word;
+}
+</style>
diff --git a/frontend-vue/src/shared/components/tasks/HistoryTaskLayer.vue b/frontend-vue/src/shared/components/tasks/HistoryTaskLayer.vue
index bf783112..e238ab56 100644
--- a/frontend-vue/src/shared/components/tasks/HistoryTaskLayer.vue
+++ b/frontend-vue/src/shared/components/tasks/HistoryTaskLayer.vue
@@ -4,7 +4,9 @@
       历史任务<template v-if="count > 0">（{{ count }}）</template>
     </button>
 
-    <el-drawer v-model="open" :title="historyTitle" size="640px" class="task-history-drawer">
+    <!-- destroy-on-close：抽屉关闭即销毁内部 DOM。默认按 v-show 保留，历史条目多时
+         （每卡 8+ 节点）关闭后仍留在文档里参与后续 diff；条目数上限属产品语义，另行决策。 -->
+    <el-drawer v-model="open" :title="historyTitle" size="640px" class="task-history-drawer" destroy-on-close>
       <div class="history-body">
         <!-- 批量删除工具条（传入 onBatchDelete 时显示） -->
         <div v-if="onBatchDelete" class="history-toolbar">
diff --git a/frontend-vue/src/shared/composables/useVersionUpdate.ts b/frontend-vue/src/shared/composables/useVersionUpdate.ts
index 9de1f752..fc6c006e 100644
--- a/frontend-vue/src/shared/composables/useVersionUpdate.ts
+++ b/frontend-vue/src/shared/composables/useVersionUpdate.ts
@@ -8,6 +8,7 @@
 
 import { computed, ref } from 'vue'
 import { getPywebviewApi } from '@/shared/bridges/pywebview'
+import { selectChangelogEntries, type ClientChangelogEntry } from '@/shared/client-changelog'
 import { compareVersions, normVersion } from '@/shared/utils/version-compare'
 import {
   normalizeUpdateProgress,
@@ -138,8 +139,8 @@ export function useVersionUpdate() {
     const doUpdateApp = bridge?.do_update_app
     const desktopUpdate = Boolean(doUpdateApp)
     const tip = desktopUpdate
-      ? '有更新，是否现在更新？\n更新将下载安装包并重启程序。'
-      : '发现新版本，是否下载最新安装包？'
+      ? `有更新，是否现在更新？${changelogConfirmSuffix()}\n更新将下载安装包并重启程序。`
+      : `发现新版本，是否下载最新安装包？${changelogConfirmSuffix()}`
     if (!window.confirm(tip)) return
     updating.value = true
     if (!desktopUpdate) {
@@ -200,6 +201,17 @@ export function useVersionUpdate() {
   // 进度条的百分比/文案由 UpdateProgressBar 组件从 progress 自行派生（见 shared/utils/update-progress）
   const progress = computed(() => updateProgress.value)
 
+  // 更新日志：本机版本之后到最新版本之间的条目（文案见 shared/client-changelog）
+  const changelog = computed<ClientChangelogEntry[]>(() =>
+    selectChangelogEntries({ currentVersion: currentVersion.value, latestVersion: latestVersion.value }),
+  )
+
+  /** 更新确认框里的"本次更新内容"：只取最新一条、最多 5 行，避免弹窗过长 */
+  function changelogConfirmSuffix(): string {
+    const items = (changelog.value[0]?.items ?? []).slice(0, 5)
+    return items.length ? `\n本次更新内容：\n${items.map((item) => `· ${item}`).join('\n')}` : ''
+  }
+
   return {
     checking,
     updating,
@@ -211,6 +223,7 @@ export function useVersionUpdate() {
     hint,
     checked,
     progress,
+    changelog,
     loadCurrentVersion,
     runCheck,
     doUpdate,
diff --git a/frontend-vue/tests/client-changelog.test.ts b/frontend-vue/tests/client-changelog.test.ts
new file mode 100644
index 00000000..ce9be889
--- /dev/null
+++ b/frontend-vue/tests/client-changelog.test.ts
@@ -0,0 +1,106 @@
+import { test } from 'node:test'
+import assert from 'node:assert/strict'
+
+import {
+  CLIENT_CHANGELOG,
+  newestChangelogVersion,
+  selectChangelogEntries,
+  type ClientChangelogEntry,
+} from '../src/shared/client-changelog.ts'
+
+const FIXTURE: ClientChangelogEntry[] = [
+  { version: '4.1.0', date: '2026-09-20', items: ['新功能甲'] },
+  { version: '4.0.11', date: '2026-09-13', items: ['修复乙'] },
+  { version: '4.0.9', date: '2026-09-13', items: ['修复丙'] },
+  { version: '4.0.4', date: '2026-09-13', items: ['修复丁'] },
+]
+
+test('更新日志：数据文件新版本在前且版本号唯一', () => {
+  const versions = CLIENT_CHANGELOG.map((entry) => entry.version)
+  assert.ok(versions.length > 0, '更新日志不应为空')
+  assert.deepEqual(
+    versions,
+    [...new Set(versions)],
+    '版本号不得重复（重复会让面板出现两条同名记录）',
+  )
+  const sorted = [...versions].sort((a, b) => {
+    const pa = a.split('.').map(Number)
+    const pb = b.split('.').map(Number)
+    for (let i = 0; i < Math.max(pa.length, pb.length); i++) {
+      const diff = (pa[i] ?? 0) - (pb[i] ?? 0)
+      if (diff !== 0) return diff
+    }
+    return 0
+  })
+  assert.deepEqual(versions, sorted.reverse(), '更新日志应按版本号从新到旧排列')
+})
+
+test('更新日志：每条都有日期与面向用户的说明', () => {
+  for (const entry of CLIENT_CHANGELOG) {
+    assert.match(entry.version, /^\d+(\.\d+)+$/, `版本号格式异常：${entry.version}`)
+    assert.match(entry.date, /^\d{4}-\d{2}-\d{2}$/, `日期格式异常：${entry.version}`)
+    assert.ok(entry.items.length > 0, `缺少更新说明：${entry.version}`)
+    for (const item of entry.items) {
+      assert.ok(item.trim().length > 0, `更新说明为空：${entry.version}`)
+      assert.ok(item.length <= 40, `更新说明过长（面板放不下，需精简）：${entry.version} -> ${item}`)
+    }
+  }
+})
+
+test('更新日志：最新版本号取数据文件第一条', () => {
+  assert.equal(newestChangelogVersion(FIXTURE), '4.1.0')
+  assert.equal(newestChangelogVersion([]), '')
+})
+
+test('更新日志：只给本机版本之后的条目，新版本在前', () => {
+  const entries = selectChangelogEntries({ entries: FIXTURE, currentVersion: '4.0.11', latestVersion: '4.1.0' })
+  assert.deepEqual(entries.map((entry) => entry.version), ['4.1.0'])
+})
+
+test('更新日志：落后多个版本时逐版本列出（含中间版本）', () => {
+  const entries = selectChangelogEntries({ entries: FIXTURE, currentVersion: '4.0.4', latestVersion: '4.1.0' })
+  assert.deepEqual(entries.map((entry) => entry.version), ['4.1.0', '4.0.11', '4.0.9'])
+})
+
+test('更新日志：已是最新版本时没有条目（面板隐藏该区块）', () => {
+  assert.deepEqual(
+    selectChangelogEntries({ entries: FIXTURE, currentVersion: '4.0.11', latestVersion: '4.0.11' }),
+    [],
+  )
+})
+
+test('更新日志：本机版本高于线上（灰度/回滚）不列条目', () => {
+  assert.deepEqual(
+    selectChangelogEntries({ entries: FIXTURE, currentVersion: '4.1.0', latestVersion: '4.0.11' }),
+    [],
+  )
+})
+
+test('更新日志：线上已发布但日志未收录的新版本不误报旧条目', () => {
+  const entries = selectChangelogEntries({ entries: FIXTURE, currentVersion: '4.1.0', latestVersion: '4.2.0' })
+  assert.deepEqual(entries, [], '没有对应版本条目不倒推历史，避免把已装过的改动当成新内容')
+})
+
+test('更新日志：拿不到本机版本（旧客户端）时只给最新一条', () => {
+  const entries = selectChangelogEntries({ entries: FIXTURE, currentVersion: '', latestVersion: '4.1.0' })
+  assert.deepEqual(entries.map((entry) => entry.version), ['4.1.0'])
+})
+
+test('更新日志：检测未完成（线上版本为空）时按数据文件最新版本兜底', () => {
+  const entries = selectChangelogEntries({ entries: FIXTURE, currentVersion: '4.0.4', latestVersion: '' })
+  assert.deepEqual(entries.map((entry) => entry.version), ['4.1.0', '4.0.11', '4.0.9'])
+})
+
+test('更新日志：两边版本都拿不到时给数据文件最新一条', () => {
+  const entries = selectChangelogEntries({ entries: FIXTURE })
+  assert.deepEqual(entries.map((entry) => entry.version), ['4.1.0'])
+})
+
+test('更新日志：空数据不报错', () => {
+  assert.deepEqual(selectChangelogEntries({ entries: [], currentVersion: '4.0.4' }), [])
+})
+
+test('更新日志：版本号前缀 v 不影响筛选', () => {
+  const entries = selectChangelogEntries({ entries: FIXTURE, currentVersion: 'v4.0.4', latestVersion: 'v4.0.11' })
+  assert.deepEqual(entries.map((entry) => entry.version), ['4.0.11', '4.0.9'])
+})
diff --git a/frontend-vue/tests/modules-appearance-patent.test.ts b/frontend-vue/tests/modules-appearance-patent.test.ts
index 4db9f247..38e38f85 100644
--- a/frontend-vue/tests/modules-appearance-patent.test.ts
+++ b/frontend-vue/tests/modules-appearance-patent.test.ts
@@ -99,7 +99,7 @@ test('test_appearance_patent_progress_batch_timeout', async (t) => {
   const result = await getAppearancePatentTaskProgressBatch([5, 3])
   assert.equal(captured.url, '/newApi/api/appearance-patent/tasks/progress/batch')
   assert.equal(captured.method, 'POST')
-  assert.deepEqual(captured.data, { taskIds: [3, 5] })
+  assert.deepEqual(captured.data, { taskIds: [3, 5], userId: 42 })
   assert.equal(captured.timeout, 10000)
   assert.deepEqual(result, { items: [], missingTaskIds: [] })
 })
diff --git a/frontend-vue/tests/modules-collect-data.test.ts b/frontend-vue/tests/modules-collect-data.test.ts
index a43d07b3..a883e1ab 100644
--- a/frontend-vue/tests/modules-collect-data.test.ts
+++ b/frontend-vue/tests/modules-collect-data.test.ts
@@ -66,7 +66,7 @@ test('test_collect_data_progress_batch', async (t) => {
   const result = await getCollectDataTaskProgressBatch([5, 3], { force: true })
   assert.equal(calls[0].url, '/newApi/api/collect-data/tasks/progress/batch')
   assert.equal(calls[0].method, 'POST')
-  assert.deepEqual(calls[0].data, { taskIds: [3, 5] })
+  assert.deepEqual(calls[0].data, { taskIds: [3, 5], userId: 42 })
   assert.equal(calls[0].timeout, 10000)
   assert.deepEqual(result, { items: [], missingTaskIds: [] })
 })
diff --git a/frontend-vue/tests/modules-delete-brand.test.ts b/frontend-vue/tests/modules-delete-brand.test.ts
index 119fc2e0..e1897c82 100644
--- a/frontend-vue/tests/modules-delete-brand.test.ts
+++ b/frontend-vue/tests/modules-delete-brand.test.ts
@@ -97,7 +97,7 @@ test('test_delete_brand_task_details', async (t) => {
   await getDeleteBrandTaskDetails([5, 3])
   assert.equal(captured.url, '/newApi/api/delete-brand/tasks/batch')
   assert.equal(captured.method, 'POST')
-  assert.deepEqual(captured.data, { taskIds: [5, 3] })
+  assert.deepEqual(captured.data, { taskIds: [5, 3], userId: 42 })
 })
 
 test('test_delete_brand_task_download_url', async (t) => {
@@ -143,7 +143,7 @@ test('test_delete_brand_progress_batch', async (t) => {
   const result = await getDeleteBrandTaskProgress([5, 3])
   assert.equal(captured.url, '/newApi/api/delete-brand/tasks/progress/batch')
   assert.equal(captured.method, 'POST')
-  assert.deepEqual(captured.data, { taskIds: [3, 5] })
+  assert.deepEqual(captured.data, { taskIds: [3, 5], userId: 42 })
   assert.equal(captured.timeout, 10000)
   assert.deepEqual(result, { items: [], missingTaskIds: [] })
 })
diff --git a/frontend-vue/tests/modules-price-track.test.ts b/frontend-vue/tests/modules-price-track.test.ts
index 195f5fa7..314082d6 100644
--- a/frontend-vue/tests/modules-price-track.test.ts
+++ b/frontend-vue/tests/modules-price-track.test.ts
@@ -124,7 +124,7 @@ test('test_price_track_tasks_batch_delete', async (t) => {
   await deletePriceTrackTask(7)
   assert.equal(calls[0].url, '/newApi/api/price-track/tasks/batch')
   assert.equal(calls[0].method, 'POST')
-  assert.deepEqual(calls[0].data, { taskIds: [5, 3] })
+  assert.deepEqual(calls[0].data, { taskIds: [5, 3], userId: 42 })
   assert.equal(calls[1].url, '/newApi/api/price-track/tasks/7?user_id=42')
   assert.equal(calls[1].method, 'DELETE')
 })
@@ -173,7 +173,7 @@ test('test_price_track_progress_batch_timeout', async (t) => {
   const result = await getPriceTrackTaskProgressBatch([5, 3])
   assert.equal(captured.url, '/newApi/api/price-track/tasks/progress/batch')
   assert.equal(captured.method, 'POST')
-  assert.deepEqual(captured.data, { taskIds: [3, 5] })
+  assert.deepEqual(captured.data, { taskIds: [3, 5], userId: 42 })
   assert.equal(captured.timeout, 10000)
   assert.deepEqual(result, { items: [], missingTaskIds: [] })
 })
diff --git a/frontend-vue/tests/modules-publish.test.ts b/frontend-vue/tests/modules-publish.test.ts
index aa3acbc3..7e8a1940 100644
--- a/frontend-vue/tests/modules-publish.test.ts
+++ b/frontend-vue/tests/modules-publish.test.ts
@@ -105,7 +105,7 @@ test('test_publish_progress_batch_timeout', async (t) => {
   const result = await getPublishTaskProgressBatch([5, 3, 5])
   assert.equal(captured.url, '/newApi/api/publish/tasks/progress/batch')
   assert.equal(captured.method, 'POST')
-  assert.deepEqual(captured.data, { task_ids: [3, 5] })
+  assert.deepEqual(captured.data, { task_ids: [3, 5], user_id: 42 })
   assert.equal(captured.timeout, 10000)
   assert.deepEqual(result, { items: [], missingTaskIds: [] })
 
diff --git a/frontend-vue/tests/modules-query-asin.test.ts b/frontend-vue/tests/modules-query-asin.test.ts
index e481c450..c26dcdcc 100644
--- a/frontend-vue/tests/modules-query-asin.test.ts
+++ b/frontend-vue/tests/modules-query-asin.test.ts
@@ -132,7 +132,7 @@ test('test_shop_data_crawl_progress_batch_timeout', async (t) => {
   const result = await getShopDataCrawlTaskProgressBatch([5, 3])
   assert.equal(captured.url, '/newApi/api/shop-data-crawl/tasks/progress/batch')
   assert.equal(captured.method, 'POST')
-  assert.deepEqual(captured.data, { taskIds: [3, 5] })
+  assert.deepEqual(captured.data, { taskIds: [3, 5], userId: 42 })
   assert.equal(captured.timeout, 10000)
   assert.deepEqual(result, { items: [], missingTaskIds: [] })
 })
@@ -204,7 +204,7 @@ test('test_query_asin_progress_delete_download', async (t) => {
   await deleteQueryAsinTask(7)
   await deleteQueryAsinHistory(9)
   assert.equal(calls[0].url, '/newApi/api/query-asin/tasks/progress/batch')
-  assert.deepEqual(calls[0].data, { taskIds: [3, 5] })
+  assert.deepEqual(calls[0].data, { taskIds: [3, 5], userId: 42 })
   assert.equal(calls[0].timeout, 10000)
   assert.equal(calls[1].url, '/newApi/api/query-asin/tasks/7')
   assert.equal(calls[1].method, 'DELETE')
diff --git a/frontend-vue/tests/modules-shop-match.test.ts b/frontend-vue/tests/modules-shop-match.test.ts
index 58fb7d24..f6505c78 100644
--- a/frontend-vue/tests/modules-shop-match.test.ts
+++ b/frontend-vue/tests/modules-shop-match.test.ts
@@ -113,7 +113,7 @@ test('test_product_risk_task_apis', async (t) => {
   assert.equal(calls[2].url, '/newApi/api/product-risk-resolve/pending-shop-result')
   assert.deepEqual(calls[2].params, { user_id: 42, shop_name: '店铺A' })
   assert.equal(calls[3].url, '/newApi/api/product-risk-resolve/tasks/batch')
-  assert.deepEqual(calls[3].data, { taskIds: [5, 3] })
+  assert.deepEqual(calls[3].data, { taskIds: [5, 3], userId: 42 })
 })
 
 test('test_product_risk_dashboard_history_download', async (t) => {
@@ -199,7 +199,7 @@ test('test_shop_match_task_apis', async (t) => {
   assert.equal(calls[3].url, '/newApi/api/shop-match/tasks/7/stage-finished?user_id=42')
   assert.deepEqual(calls[3].data, { stage_index: 1 })
   assert.equal(calls[4].url, '/newApi/api/shop-match/tasks/batch')
-  assert.deepEqual(calls[4].data, { taskIds: [5, 3] })
+  assert.deepEqual(calls[4].data, { taskIds: [5, 3], userId: 42 })
 })
 
 test('test_shop_match_dashboard_history_skip_asins', async (t) => {
@@ -236,10 +236,10 @@ test('test_shop_match_product_risk_progress_batch', async (t) => {
   const shopMatch = await getShopMatchTaskProgressBatch([5, 3])
   const productRisk = await getProductRiskTaskProgressBatch([5, 3])
   assert.equal(calls[0].url, '/newApi/api/shop-match/tasks/progress/batch')
-  assert.deepEqual(calls[0].data, { taskIds: [3, 5] })
+  assert.deepEqual(calls[0].data, { taskIds: [3, 5], userId: 42 })
   assert.equal(calls[0].timeout, 10000)
   assert.equal(calls[1].url, '/newApi/api/product-risk-resolve/tasks/progress/batch')
-  assert.deepEqual(calls[1].data, { taskIds: [3, 5] })
+  assert.deepEqual(calls[1].data, { taskIds: [3, 5], userId: 42 })
   assert.equal(calls[1].timeout, 10000)
   assert.deepEqual(shopMatch, { items: [], missingTaskIds: [] })
   assert.deepEqual(productRisk, { items: [], missingTaskIds: [] })
diff --git a/frontend-vue/tests/modules-similar-asin.test.ts b/frontend-vue/tests/modules-similar-asin.test.ts
index 45539c14..aac1b74d 100644
--- a/frontend-vue/tests/modules-similar-asin.test.ts
+++ b/frontend-vue/tests/modules-similar-asin.test.ts
@@ -100,7 +100,7 @@ test('test_similar_asin_progress_batch_timeout', async (t) => {
   const result = await getSimilarAsinTaskProgressBatch([5, 3])
   assert.equal(captured.url, '/newApi/api/similar-asin/tasks/progress/batch')
   assert.equal(captured.method, 'POST')
-  assert.deepEqual(captured.data, { taskIds: [3, 5] })
+  assert.deepEqual(captured.data, { taskIds: [3, 5], userId: 42 })
   assert.equal(captured.timeout, 10000)
   assert.deepEqual(result, { items: [], missingTaskIds: [] })
 
diff --git a/frontend-vue/tests/modules-withdraw.test.ts b/frontend-vue/tests/modules-withdraw.test.ts
index ac5646b7..4702b0dd 100644
--- a/frontend-vue/tests/modules-withdraw.test.ts
+++ b/frontend-vue/tests/modules-withdraw.test.ts
@@ -114,7 +114,7 @@ test('test_withdraw_progress_dashboard_history', async (t) => {
   await deleteWithdrawHistory(9)
   assert.equal(calls[0].url, '/newApi/api/withdraw/tasks/progress/batch')
   assert.equal(calls[0].method, 'POST')
-  assert.deepEqual(calls[0].data, { taskIds: [3, 5] })
+  assert.deepEqual(calls[0].data, { taskIds: [3, 5], userId: 42 })
   assert.equal(calls[0].timeout, 10000)
   assert.equal(calls[1].url, '/newApi/api/withdraw/dashboard')
   assert.deepEqual(calls[1].params, { user_id: 42 })
@@ -208,7 +208,7 @@ test('test_patrol_delete_progress_dashboard_download', async (t) => {
   await deletePatrolDeleteHistory(9)
   assert.equal(calls[0].url, '/newApi/api/patrol-delete/tasks/progress/batch')
   assert.equal(calls[0].method, 'POST')
-  assert.deepEqual(calls[0].data, { taskIds: [3, 5] })
+  assert.deepEqual(calls[0].data, { taskIds: [3, 5], userId: 42 })
   assert.equal(calls[0].timeout, 10000)
   assert.equal(calls[1].url, '/newApi/api/patrol-delete/dashboard')
   assert.deepEqual(calls[1].params, { user_id: 42 })