chore: release client-v1.0.69

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YZ4DskSRKsSiheQonFtQvx
chore: release server-v1.0.72
2026-06-21 19:09:47 +08:00 · 2026-06-21 19:09:30 +08:00 · 2026-06-21 18:14:54 +08:00 · 2026-06-21 18:14:27 +08:00 · 2026-06-21 17:33:32 +08:00 · 2026-06-21 17:32:55 +08:00
38 changed files with 1666 additions and 428 deletions
@@ -1,37 +1,35 @@
 name: DB Backup

 on:
-  # 定时备份已暂停（保留手动触发）。恢复时取消下面 schedule 的注释即可。
-  # schedule:
-  #   - cron: '0 18 * * *'  # UTC 18:00 = 北京时间 02:00
+  # 每日定时备份（北京时间 02:00）。手动触发亦可。
+  schedule:
+    - cron: '0 18 * * *'  # UTC 18:00 = 北京时间 02:00
  workflow_dispatch:

+concurrency:
+  group: db-backup
+  cancel-in-progress: false
+
 jobs:
  backup:
-    runs-on: ubuntu-latest
+    runs-on: mac
    steps:
-      - name: Setup SSH
-        run: |
-          mkdir -p ~/.ssh
-          printf '%s' "${{ secrets.EC2_SSH_KEY }}" > ~/.ssh/ec2.pem
-          chmod 600 ~/.ssh/ec2.pem
-          ssh-keyscan -H ${{ secrets.EC2_HOST }} >> ~/.ssh/known_hosts
+      - uses: actions/checkout@v4

-      - name: Dump MySQL to NAS
+      - name: Dump MySQL to local backup dir
        env:
+          EC2_SSH_KEY: ${{ secrets.EC2_SSH_KEY }}
          EC2_HOST: ${{ secrets.EC2_HOST }}
          EC2_USER: ${{ secrets.EC2_USER }}
-          DB_PASSWORD: ${{ secrets.DB_PASSWORD }}
-        run: |
-          BACKUP_DIR=/volume1/docker/backups/jiu-db
-          mkdir -p $BACKUP_DIR
-          FILENAME="jiu_db_$(date +%Y%m%d_%H%M%S).sql.gz"
-          ssh -i ~/.ssh/ec2.pem ${EC2_USER}@${EC2_HOST} \
-            "docker exec jiu_mysql mysqldump -uroot -p${DB_PASSWORD} jiu_db" \
-            | gzip > ${BACKUP_DIR}/${FILENAME}
-          find $BACKUP_DIR -name "*.sql.gz" -mtime +30 -delete
-          echo "Saved: ${BACKUP_DIR}/${FILENAME}"
+        run: sh scripts/ci/backup-db.sh

-      - name: Cleanup SSH key
+      - name: Notify (Telegram)
        if: always()
-        run: rm -f ~/.ssh/ec2.pem
+        env:
+          TELEGRAM_TOKEN: ${{ secrets.TELEGRAM_TOKEN }}
+          TELEGRAM_CHAT_ID: ${{ secrets.TELEGRAM_CHAT_ID }}
+        run: |
+          if [ "${{ job.status }}" = "success" ]; then ICON="✅"; LABEL="数据库备份成功"; else ICON="❌"; LABEL="数据库备份失败"; fi
+          curl -f -X POST "https://api.telegram.org/bot${TELEGRAM_TOKEN}/sendMessage" \
+            -d "chat_id=${TELEGRAM_CHAT_ID}" \
+            --data-urlencode "text=${ICON} 岩美 ${LABEL}" > /dev/null || true
@@ -5,6 +5,47 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

+## [1.0.69] - 2026-06-21
+
+### 新功能
+- 入库/出库审核列表：管理员可「撤回」审核中的单据，单据回到草稿，修改后重新提交审核
+
+### 改进
+- 新建入库单：批次号移到「生产日期」右侧、与各列对齐填写；生产日期输入框收窄，不再占用过宽
+
+## [1.0.68] - 2026-06-21
+
+### 改进
+- 店铺公开商品页：每个商品卡片显示「在库 N」数量，且只展示有货商品
+
+## [1.0.67] - 2026-06-21
+
+### 改进
+- 选择器改为服务端全量搜索：选供应商/客户时按关键词查全部往来单位（不再只在已加载的首页里找）；出库「选择商品」弹窗的搜索也改为实时查全部库存，输入即按编码/名称/系列匹配，不再漏掉未加载的商品
+
+## [1.0.66] - 2026-06-21
+
+### 改进
+- 入库/出库列表「日期」列改名为「入库时间/出库时间」，移除恒为空的旧「审核时间」列
+- 日期选择改为可直接键入的输入框 + 日历图标：能直接打年份（选老年份方便），支持只填到年或年月（自动补为月初）
+
+## [1.0.65] - 2026-06-21
+
+### 改进
+- 入库录入改为「每行一个独立产品」：每条明细对应一个独立编号，同名同规格录多次也各自独立（配合后端 server-v1.0.69）
+
+## [1.0.64] - 2026-06-20
+
+### 新功能
+- 入库单 / 出库单列表新增搜索框：输入单号或往来单位名称即可即时筛选，不用再翻页查找
+- 入库 / 出库 / 库存三个列表均新增刷新按钮：多端并发录入后可一键同步最新数据
+
+## [1.0.63] - 2026-06-20
+
+### 修复
+- 修复入库单 / 出库单「全部状态」筛选遗漏未审核单据的问题，状态下拉新增「待审核」选项，且筛选真正生效
+- 修复「入库审核 / 出库审核」标签页只显示部分待审核单、漏掉早期单号的问题：筛选改为服务端驱动，跨分页结果完整可靠
+
 ## [1.0.62] - 2026-06-20

 ### 改进
@@ -5,6 +5,45 @@
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

+## [1.0.72] - 2026-06-21
+
+### 新功能
+- 审核中（待审核）的入库单/出库单，管理员可「撤回」为草稿，修改后重新提交审核；已审核单据仍只读不可撤回
+
+## [1.0.71] - 2026-06-21
+
+### 改进
+- 公开店铺商品页只展示「当前有库存」的商品，并返回每个商品的在库数量与商品编码（序列号），无货商品不再露出
+
+## [1.0.70] - 2026-06-21
+
+### 改进
+- 商品名称/系列/规格选择接口支持关键词搜索（按名称或编码），为客户端选择器的服务端全量搜索提供支撑
+
+## [1.0.69] - 2026-06-21
+
+### 改进
+- 入库录入改为「每行一个独立产品」：每条明细新建独立商品、发独立序列号（同名同规格录多次也各自独立），不再复用已有商品编号，符合"每个货品一个唯一编号"的管理方式
+
+## [1.0.68] - 2026-06-21
+
+### 修复
+- 根治商品编码可能重复的问题：自动编码改为按现有最大序号递增生成（不再复用已删除商品占用过的编号、并发下也不会撞号），并在数据库层为「同门店 + 编码」加唯一约束，从此重复编码无法静默产生
+
+## [1.0.67] - 2026-06-20
+
+### 修复
+- 历史导入单审核入库后，库存里商品显示为「历史导入占位」、按真实名搜不到的问题：审核生成库存时改用单据明细自带的真实商品名/编码/系列/规格，库存列表也不再显示已删除的占位商品名
+- 库存列表按真实商品名/编码即可搜到这些历史商品
+
+### 新功能
+- 入库单 / 出库单列表支持关键词搜索：按单号或往来单位名称即时筛选
+
+## [1.0.66] - 2026-06-20
+
+### 修复
+- 入库/出库单据列表改为按业务日期（入库/出库日期）倒序排列：从旧系统迁入的历史单据按真实日期归位到列表顶部，不再因录入时间晚、被排到末尾分页而在首页遗漏
+
 ## [1.0.65] - 2026-06-20

 ### 修复
@@ -68,7 +68,7 @@ func (h *InventoryHandler) List(c *gin.Context) {
 	specStr := c.Query("spec")

 	if keyword != "" {
-		baseWhere += " AND (COALESCE(NULLIF(p.name,''), inv.product_name) LIKE ? OR COALESCE(NULLIF(p.code,''), inv.product_code) LIKE ? OR p.name_pinyin LIKE ? OR p.name_initials LIKE ?)"
+		baseWhere += " AND (COALESCE(NULLIF(p.name,''), NULLIF(sii.product_name,''), inv.product_name) LIKE ? OR COALESCE(NULLIF(p.code,''), NULLIF(sii.product_code,''), inv.product_code) LIKE ? OR p.name_pinyin LIKE ? OR p.name_initials LIKE ?)"
 		like := "%" + keyword + "%"
 		args = append(args, like, like, like, like)
 	}
@@ -101,7 +101,7 @@ func (h *InventoryHandler) List(c *gin.Context) {
 		SELECT COUNT(*)
 		FROM inventories inv
 		LEFT JOIN stock_in_items sii ON sii.id = inv.stock_in_item_id
-		LEFT JOIN products p ON p.id = inv.product_id
+		LEFT JOIN products p ON p.id = inv.product_id AND p.deleted_at IS NULL
 		LEFT JOIN warehouses w ON w.id = inv.warehouse_id
 		WHERE ` + baseWhere

@@ -116,10 +116,10 @@ func (h *InventoryHandler) List(c *gin.Context) {
 		SELECT
 		  inv.id, inv.shop_id, inv.warehouse_id, inv.product_id, inv.stock_in_item_id,
 		  inv.quantity,
-		  COALESCE(NULLIF(p.code,''), inv.product_code, '') AS product_code,
-		  COALESCE(NULLIF(p.name,''), inv.product_name, '') AS product_name,
-		  COALESCE(NULLIF(p.series,''), inv.series, '') AS series,
-		  COALESCE(NULLIF(p.spec,''), inv.spec, '') AS spec,
+		  COALESCE(NULLIF(p.code,''), NULLIF(sii.product_code,''), inv.product_code, '') AS product_code,
+		  COALESCE(NULLIF(p.name,''), NULLIF(sii.product_name,''), inv.product_name, '') AS product_name,
+		  COALESCE(NULLIF(p.series,''), NULLIF(sii.series,''), inv.series, '') AS series,
+		  COALESCE(NULLIF(p.spec,''), NULLIF(sii.spec,''), inv.spec, '') AS spec,
 		  COALESCE(NULLIF(p.unit,''), inv.unit, '') AS unit,
 		  COALESCE(NULLIF(w.name,''), inv.warehouse_name, '') AS warehouse_name,
 		  COALESCE(sii.unit_price, inv.unit_price) AS unit_price,
@@ -132,7 +132,7 @@ func (h *InventoryHandler) List(c *gin.Context) {
 		  inv.created_at
 		FROM inventories inv
 		LEFT JOIN stock_in_items sii ON sii.id = inv.stock_in_item_id
-		LEFT JOIN products p ON p.id = inv.product_id
+		LEFT JOIN products p ON p.id = inv.product_id AND p.deleted_at IS NULL
 		LEFT JOIN warehouses w ON w.id = inv.warehouse_id
 		WHERE ` + baseWhere + `
 		ORDER BY inv.id DESC
@@ -219,6 +219,52 @@ func TestInventoryHandler_List_HotelIsolation(t *testing.T) {
 	assert.Equal(t, float64(0), respB["total"].(float64))
 }

+// 库存指向已软删的占位商品时，列表应回退到明细/库存快照真名，
+// 而非占位商品名「历史导入占位」，且能按真名搜索到。
+func TestInventoryHandler_List_DeletedProductFallsBackToSnapshot(t *testing.T) {
+	db := testutil.SetupTestDB()
+	shop := testutil.CreateTestShop(db, "INV009")
+	user := testutil.CreateTestUser(db, shop.ID, "admin", "pass", "admin")
+	warehouse := testutil.CreateTestWarehouse(db, shop.ID, "Warehouse")
+	placeholder := testutil.CreateTestProduct(db, shop.ID, "历史导入占位")
+	token := getAuthToken(user.ID, shop.ID, "admin")
+	r := setupProtectedRouter(db)
+
+	// 明细携带真实快照名
+	item := model.StockInItem{
+		ShopID:      shop.ID,
+		ProductID:   placeholder.ID,
+		ProductCode: "ZXZ029751",
+		ProductName: "贵州茅台酒2006",
+		Quantity:    10,
+	}
+	require.NoError(t, db.Create(&item).Error)
+
+	// 库存：product_id 指向占位商品，且 product_name 也是占位名（模拟旧脏数据）
+	require.NoError(t, db.Create(&model.Inventory{
+		ShopID:        shop.ID,
+		WarehouseID:   &warehouse.ID,
+		ProductID:     &placeholder.ID,
+		StockInItemID: &item.ID,
+		ProductName:   "历史导入占位",
+		Quantity:      10,
+	}).Error)
+
+	// 软删占位商品
+	require.NoError(t, db.Delete(&placeholder).Error)
+
+	// 列表：名称应回退到明细快照真名
+	w := makeRequest(r, "GET", "/api/v1/inventory", token, nil)
+	resp := parseResponse(w)
+	require.Equal(t, float64(1), resp["total"].(float64))
+	invItem := resp["data"].([]interface{})[0].(map[string]interface{})
+	assert.Equal(t, "贵州茅台酒2006", invItem["product_name"])
+
+	// 按真名可搜到
+	w = makeRequest(r, "GET", "/api/v1/inventory?keyword=茅台", token, nil)
+	assert.Equal(t, float64(1), parseResponse(w)["total"].(float64))
+}
+
 func TestInventoryHandler_AfterStockInApprove(t *testing.T) {
 	db := testutil.SetupTestDB()
 	shop := testutil.CreateTestShop(db, "INV008")
@@ -62,6 +62,65 @@ func (h *ProductHandler) List(c *gin.Context) {
 	})
 }

+// nextProductCode 生成该门店下一个自动商品编码（P001、P002…）。
+// 取现有 P 开头编码的最大数字序号 +1，**含软删行**（deleted_at 非空也计入，不复用已删商品占用过的号）。
+// 不加行锁——并发下两请求可能算出同号，由 uk_shop_code 唯一约束 + 调用方 ErrDuplicatedKey 重试兜底。
+// 用 GORM 表达式（非 MySQL 方言 SQL），sqlite 单测也能跑。
+func nextProductCode(tx *gorm.DB, shopID uint64) (string, error) {
+	var codes []string
+	if err := tx.Model(&model.Product{}).
+		Where("shop_id = ? AND code LIKE 'P%'", shopID).
+		Pluck("code", &codes).Error; err != nil {
+		return "", err
+	}
+	maxN := 0
+	for _, c := range codes {
+		if len(c) < 2 {
+			continue
+		}
+		if n, err := strconv.Atoi(c[1:]); err == nil && n > maxN {
+			maxN = n
+		}
+	}
+	return fmt.Sprintf("P%03d", maxN+1), nil
+}
+
+// createIndependentProduct 为入库明细新建一个独立产品（特有产品/序列号），返回新 product。
+// "入库每行 = 一个特有产品"模型:每条明细建一个独立 product、发新序列号,不按名称复用。
+// 含 nextProductCode 自增 + 撞 uk_shop_code 唯一约束时重试。必须在事务内调用。
+func createIndependentProduct(tx *gorm.DB, shopID uint64, name, series, spec, batchNo string, prodDate *model.Date, price float64) (model.Product, error) {
+	namePinyin, nameInitials := util.ToPinyin(name)
+	var prod model.Product
+	var err error
+	for attempt := 0; attempt < 5; attempt++ {
+		code, e := nextProductCode(tx, shopID)
+		if e != nil {
+			return model.Product{}, e
+		}
+		prod = model.Product{
+			TenantBase:     model.TenantBase{ShopID: shopID},
+			PublicID:       uuid.New().String(),
+			Code:           code,
+			Name:           name,
+			Series:         series,
+			Spec:           spec,
+			BatchNo:        batchNo,
+			ProductionDate: prodDate,
+			PurchasePrice:  price,
+			NamePinyin:     namePinyin,
+			NameInitials:   nameInitials,
+		}
+		prod.ID = 0
+		if err = tx.Create(&prod).Error; err == nil || !errors.Is(err, gorm.ErrDuplicatedKey) {
+			break
+		}
+	}
+	if err != nil {
+		return model.Product{}, err
+	}
+	return prod, nil
+}
+
 // Create POST /api/v1/products
 func (h *ProductHandler) Create(c *gin.Context) {
 	shopID := middleware.GetShopID(c)
@@ -74,31 +133,24 @@ func (h *ProductHandler) Create(c *gin.Context) {
 	product.PublicID = uuid.New().String()
 	product.NamePinyin, product.NameInitials = util.ToPinyin(product.Name)

-	// Auto-generate product code if not provided (e.g. P001, P002)
-	// Retry up to 5 times on duplicate key to handle concurrent creates
-	if product.Code == "" {
-		var count int64
-		h.db.Model(&model.Product{}).
-			Where("shop_id = ? AND deleted_at IS NULL", shopID).
-			Count(&count)
-		product.Code = fmt.Sprintf("P%03d", count+1)
-	}
-
+	// 未显式指定编码时自动生成（事务内 max+1）；撞 uk_shop_code 唯一约束则重算下一号重试（应对并发）。
+	autoCode := product.Code == ""
 	var createErr error
 	for attempt := 0; attempt < 5; attempt++ {
-		if createErr = h.db.Create(&product).Error; createErr == nil {
+		createErr = h.db.Transaction(func(tx *gorm.DB) error {
+			if autoCode {
+				code, err := nextProductCode(tx, shopID)
+				if err != nil {
+					return err
+				}
+				product.Code = code
+			}
+			product.ID = 0
+			return tx.Create(&product).Error
+		})
+		if createErr == nil || !autoCode || !errors.Is(createErr, gorm.ErrDuplicatedKey) {
 			break
 		}
-		if !errors.Is(createErr, gorm.ErrDuplicatedKey) {
-			break
-		}
-		// Duplicate code: try next slot
-		var count int64
-		h.db.Model(&model.Product{}).
-			Where("shop_id = ? AND deleted_at IS NULL", shopID).
-			Count(&count)
-		product.ID = 0
-		product.Code = fmt.Sprintf("P%03d", count+int64(attempt)+2)
 	}
 	if createErr != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": createErr.Error()})
@@ -256,25 +308,37 @@ func (h *ProductHandler) FindOrCreate(c *gin.Context) {
 		return
 	}

-	var count int64
-	h.db.Model(&model.Product{}).Where("shop_id = ? AND deleted_at IS NULL", shopID).Count(&count)
 	namePinyin, nameInitials := util.ToPinyin(req.Name)
-	product = model.Product{
-		TenantBase:       model.TenantBase{ShopID: shopID},
-		PublicID:         uuid.New().String(),
-		Name:             req.Name,
-		Series:           req.Series,
-		Spec:             req.Spec,
-		Code:             fmt.Sprintf("P%03d", count+1),
-		NamePinyin:       namePinyin,
-		NameInitials:     nameInitials,
-		OriginID:         req.OriginID,
-		ShelfLifeID:      req.ShelfLifeID,
-		StorageID:        req.StorageID,
-		DescriptionDocID: req.DescriptionDocID,
+	// 事务内 max+1 生成编码；撞 uk_shop_code 唯一约束则重算下一号重试（应对并发）。
+	var createErr error
+	for attempt := 0; attempt < 5; attempt++ {
+		createErr = h.db.Transaction(func(tx *gorm.DB) error {
+			code, err := nextProductCode(tx, shopID)
+			if err != nil {
+				return err
+			}
+			product = model.Product{
+				TenantBase:       model.TenantBase{ShopID: shopID},
+				PublicID:         uuid.New().String(),
+				Name:             req.Name,
+				Series:           req.Series,
+				Spec:             req.Spec,
+				Code:             code,
+				NamePinyin:       namePinyin,
+				NameInitials:     nameInitials,
+				OriginID:         req.OriginID,
+				ShelfLifeID:      req.ShelfLifeID,
+				StorageID:        req.StorageID,
+				DescriptionDocID: req.DescriptionDocID,
+			}
+			return tx.Create(&product).Error
+		})
+		if createErr == nil || !errors.Is(createErr, gorm.ErrDuplicatedKey) {
+			break
+		}
 	}
-	if createErr := h.db.Create(&product).Error; createErr != nil {
-		// Race condition: try to find the record created by another request
+	if createErr != nil {
+		// Race condition: 并发可能已按同 name/series/spec 建好，回查返回既有
 		if h.db.Where("shop_id = ? AND name = ? AND series = ? AND spec = ? AND deleted_at IS NULL",
 			shopID, req.Name, req.Series, req.Spec).First(&product).Error == nil {
 			util.RespondSuccess(c, product)
@@ -2,6 +2,7 @@ package handler

 import (
 	"net/http"
+	"strings"

 	"github.com/gin-gonic/gin"
 	"gorm.io/gorm"
@@ -24,7 +25,12 @@ func NewProductOptionHandler(db *gorm.DB) *ProductOptionHandler {
 func (h *ProductOptionHandler) ListNames(c *gin.Context) {
 	shopID := middleware.GetShopID(c)
 	items := make([]model.ProductNameOption, 0)
-	h.db.Where("shop_id = ?", shopID).Order("id ASC").Find(&items)
+	q := h.db.Where("shop_id = ?", shopID)
+	if kw := strings.TrimSpace(c.Query("keyword")); kw != "" {
+		like := "%" + kw + "%"
+		q = q.Where("name LIKE ? OR code LIKE ?", like, like)
+	}
+	q.Order("id ASC").Find(&items)
 	util.RespondSuccess(c, items)
 }

@@ -85,7 +91,12 @@ func (h *ProductOptionHandler) DeleteName(c *gin.Context) {
 func (h *ProductOptionHandler) ListSeries(c *gin.Context) {
 	shopID := middleware.GetShopID(c)
 	items := make([]model.ProductSeriesOption, 0)
-	h.db.Where("shop_id = ?", shopID).Order("id ASC").Find(&items)
+	q := h.db.Where("shop_id = ?", shopID)
+	if kw := strings.TrimSpace(c.Query("keyword")); kw != "" {
+		like := "%" + kw + "%"
+		q = q.Where("name LIKE ? OR code LIKE ?", like, like)
+	}
+	q.Order("id ASC").Find(&items)
 	util.RespondSuccess(c, items)
 }

@@ -146,7 +157,12 @@ func (h *ProductOptionHandler) DeleteSeries(c *gin.Context) {
 func (h *ProductOptionHandler) ListSpecs(c *gin.Context) {
 	shopID := middleware.GetShopID(c)
 	items := make([]model.ProductSpecOption, 0)
-	h.db.Where("shop_id = ?", shopID).Order("id ASC").Find(&items)
+	q := h.db.Where("shop_id = ?", shopID)
+	if kw := strings.TrimSpace(c.Query("keyword")); kw != "" {
+		like := "%" + kw + "%"
+		q = q.Where("name LIKE ? OR code LIKE ?", like, like)
+	}
+	q.Order("id ASC").Find(&items)
 	util.RespondSuccess(c, items)
 }

@@ -0,0 +1,86 @@
+package handler
+
+import (
+	"net/http"
+	"testing"
+
+	"github.com/gin-gonic/gin"
+	"github.com/stretchr/testify/assert"
+	"gorm.io/gorm"
+
+	"github.com/wangjia/jiu/backend/internal/middleware"
+	"github.com/wangjia/jiu/backend/internal/model"
+	"github.com/wangjia/jiu/backend/testutil"
+)
+
+// setupOptionRouter 注册 product-options 名称路由（含 JWT）。
+func setupOptionRouter(db *gorm.DB) *gin.Engine {
+	h := NewProductOptionHandler(db)
+	r := gin.New()
+	r.Use(gin.Recovery())
+	api := r.Group("/api/v1")
+	api.Use(middleware.JWT(db))
+	names := api.Group("/product-options/names")
+	names.GET("", h.ListNames)
+	return r
+}
+
+func TestProductOptionHandler_ListNamesKeyword(t *testing.T) {
+	db := testutil.SetupTestDB()
+	shop := testutil.CreateTestShop(db, "OPT001")
+	user := testutil.CreateTestUser(db, shop.ID, "admin", "pass", "admin")
+	token := getAuthToken(user.ID, shop.ID, "admin")
+	r := setupOptionRouter(db)
+
+	db.Create(&model.ProductNameOption{
+		TenantBase: model.TenantBase{ShopID: shop.ID}, Code: "P001", Name: "茅台",
+	})
+	db.Create(&model.ProductNameOption{
+		TenantBase: model.TenantBase{ShopID: shop.ID}, Code: "P002", Name: "五粮液",
+	})
+
+	// 1. 无 keyword → 返回全部
+	w := makeRequest(r, "GET", "/api/v1/product-options/names", token, nil)
+	assert.Equal(t, http.StatusOK, w.Code)
+	data := parseResponse(w)["data"].([]interface{})
+	assert.Len(t, data, 2)
+
+	// 2. keyword 命中名称
+	w = makeRequest(r, "GET", "/api/v1/product-options/names?keyword=五粮", token, nil)
+	assert.Equal(t, http.StatusOK, w.Code)
+	data = parseResponse(w)["data"].([]interface{})
+	assert.Len(t, data, 1)
+	assert.Equal(t, "五粮液", data[0].(map[string]interface{})["name"])
+
+	// 3. keyword 命中编码
+	w = makeRequest(r, "GET", "/api/v1/product-options/names?keyword=P001", token, nil)
+	assert.Equal(t, http.StatusOK, w.Code)
+	data = parseResponse(w)["data"].([]interface{})
+	assert.Len(t, data, 1)
+	assert.Equal(t, "茅台", data[0].(map[string]interface{})["name"])
+
+	// 4. keyword 无命中 → 空
+	w = makeRequest(r, "GET", "/api/v1/product-options/names?keyword=不存在", token, nil)
+	assert.Equal(t, http.StatusOK, w.Code)
+	data = parseResponse(w)["data"].([]interface{})
+	assert.Len(t, data, 0)
+}
+
+func TestProductOptionHandler_ListNamesIsolation(t *testing.T) {
+	db := testutil.SetupTestDB()
+	shopA := testutil.CreateTestShop(db, "OPT_A")
+	userA := testutil.CreateTestUser(db, shopA.ID, "adminA", "pass", "admin")
+	tokenA := getAuthToken(userA.ID, shopA.ID, "admin")
+	shopB := testutil.CreateTestShop(db, "OPT_B")
+	r := setupOptionRouter(db)
+
+	db.Create(&model.ProductNameOption{
+		TenantBase: model.TenantBase{ShopID: shopB.ID}, Name: "他店商品",
+	})
+
+	// A 店即使 keyword 命中 B 店数据也查不到（shop_id 隔离）
+	w := makeRequest(r, "GET", "/api/v1/product-options/names?keyword=他店", tokenA, nil)
+	assert.Equal(t, http.StatusOK, w.Code)
+	data := parseResponse(w)["data"].([]interface{})
+	assert.Len(t, data, 0)
+}
@@ -2,13 +2,16 @@ package handler

 import (
 	"encoding/json"
+	"errors"
 	"fmt"
 	"net/http"
 	"testing"

 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
+	"gorm.io/gorm"

+	"github.com/wangjia/jiu/backend/internal/model"
 	"github.com/wangjia/jiu/backend/testutil"
 )

@@ -199,3 +202,67 @@ func TestProductHandler_Create_ShopIDFromToken(t *testing.T) {
 	dataBytes, _ := json.Marshal(data)
 	_ = dataBytes
 }
+
+// 自动编码按最大序号递增：P001 → P002 → P003。
+func TestProductHandler_AutoCode_Increment(t *testing.T) {
+	db := testutil.SetupTestDB()
+	shop := testutil.CreateTestShop(db, "AC001")
+	user := testutil.CreateTestUser(db, shop.ID, "admin", "pass", "admin")
+	token := getAuthToken(user.ID, shop.ID, "admin")
+	r := setupProtectedRouter(db)
+
+	var codes []string
+	for i := 0; i < 3; i++ {
+		w := makeRequest(r, "POST", "/api/v1/products", token, map[string]interface{}{
+			"name": fmt.Sprintf("AutoP %d", i), "unit": "个",
+		})
+		require.Equal(t, http.StatusCreated, w.Code)
+		data := parseResponse(w)["data"].(map[string]interface{})
+		codes = append(codes, data["code"].(string))
+	}
+	assert.Equal(t, []string{"P001", "P002", "P003"}, codes)
+}
+
+// 软删商品后，新建不复用被删的号（旧 count+1 逻辑会复用 → 重复，此为根因修复回归测试）。
+func TestProductHandler_AutoCode_NoReuseAfterSoftDelete(t *testing.T) {
+	db := testutil.SetupTestDB()
+	shop := testutil.CreateTestShop(db, "AC002")
+	user := testutil.CreateTestUser(db, shop.ID, "admin", "pass", "admin")
+	token := getAuthToken(user.ID, shop.ID, "admin")
+	r := setupProtectedRouter(db)
+
+	var lastID uint64
+	for i := 0; i < 3; i++ { // P001 P002 P003
+		w := makeRequest(r, "POST", "/api/v1/products", token, map[string]interface{}{
+			"name": fmt.Sprintf("NR %d", i), "unit": "个",
+		})
+		require.Equal(t, http.StatusCreated, w.Code)
+		lastID = extractID(w)
+	}
+	// 软删 P003
+	w := makeRequest(r, "DELETE", fmt.Sprintf("/api/v1/products/%d", lastID), token, nil)
+	require.Equal(t, http.StatusOK, w.Code)
+
+	// 再建 → 必须是 P004，不能复用已软删的 P003
+	w = makeRequest(r, "POST", "/api/v1/products", token, map[string]interface{}{
+		"name": "NR new", "unit": "个",
+	})
+	require.Equal(t, http.StatusCreated, w.Code)
+	data := parseResponse(w)["data"].(map[string]interface{})
+	assert.Equal(t, "P004", data["code"])
+}
+
+// (shop_id, code) 唯一约束生效，且重复被翻译成 gorm.ErrDuplicatedKey（Create/FindOrCreate 重试的前提）。
+func TestProductHandler_UniqueShopCode(t *testing.T) {
+	db := testutil.SetupTestDB()
+	shop := testutil.CreateTestShop(db, "UQ001")
+	require.NoError(t, db.Exec("CREATE UNIQUE INDEX uk_shop_code ON products(shop_id, code)").Error)
+
+	p1 := model.Product{TenantBase: model.TenantBase{ShopID: shop.ID}, Name: "A", Code: "P001"}
+	require.NoError(t, db.Create(&p1).Error)
+
+	p2 := model.Product{TenantBase: model.TenantBase{ShopID: shop.ID}, Name: "B", Code: "P001"}
+	err := db.Create(&p2).Error
+	require.Error(t, err)
+	assert.True(t, errors.Is(err, gorm.ErrDuplicatedKey))
+}
@@ -202,12 +202,14 @@ type publicProductImage struct {
 type publicProductResp struct {
 	ID        uint64               `json:"id"`
 	PublicID  string               `json:"public_id"`
+	Code      string               `json:"code"`
 	Name      string               `json:"name"`
 	Series    string               `json:"series"`
 	Spec      string               `json:"spec"`
 	Brand     string               `json:"brand"`
 	Unit      string               `json:"unit"`
 	SalePrice float64              `json:"sale_price"`
+	Quantity  float64              `json:"quantity"`
 	Images    []publicProductImage `json:"images"`
 }

@@ -234,8 +236,15 @@ func (h *PublicHandler) ListShopProducts(c *gin.Context) {
 		pageSize = 20
 	}

+	// 仅列「有库存」的商品：JOIN 库存按 product 聚合（数量>0）的子查询。
+	stockSub := h.db.Model(&model.Inventory{}).
+		Select("product_id, SUM(quantity) AS qty").
+		Where("shop_id = ? AND deleted_at IS NULL AND quantity > 0", shop.ID).
+		Group("product_id")
+
 	query := h.db.Model(&model.Product{}).
-		Where("shop_id = ? AND public_id IS NOT NULL AND public_id != '' AND deleted_at IS NULL", shop.ID)
+		Joins("JOIN (?) AS stk ON stk.product_id = products.id", stockSub).
+		Where("products.shop_id = ? AND products.public_id IS NOT NULL AND products.public_id != '' AND products.deleted_at IS NULL", shop.ID)

 	var total int64
 	if err := query.Count(&total).Error; err != nil {
@@ -248,12 +257,33 @@ func (h *PublicHandler) ListShopProducts(c *gin.Context) {
 	if err := query.Preload("Images").
 		Offset(offset).
 		Limit(pageSize).
-		Order("id DESC").
+		Order("products.id DESC").
 		Find(&products).Error; err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 		return
 	}

+	// 取本页商品的在库总量（IN 限定在本页 ≤pageSize 个 id，开销小）
+	qtyMap := make(map[uint64]float64, len(products))
+	if len(products) > 0 {
+		pageIDs := make([]uint64, len(products))
+		for i, p := range products {
+			pageIDs[i] = p.ID
+		}
+		var stockRows []struct {
+			ProductID uint64
+			Qty       float64
+		}
+		h.db.Model(&model.Inventory{}).
+			Select("product_id, SUM(quantity) AS qty").
+			Where("shop_id = ? AND deleted_at IS NULL AND quantity > 0 AND product_id IN ?", shop.ID, pageIDs).
+			Group("product_id").
+			Scan(&stockRows)
+		for _, s := range stockRows {
+			qtyMap[s.ProductID] = s.Qty
+		}
+	}
+
 	listData := make([]publicProductResp, len(products))
 	for i, p := range products {
 		imgs := make([]publicProductImage, len(p.Images))
@@ -263,12 +293,14 @@ func (h *PublicHandler) ListShopProducts(c *gin.Context) {
 		listData[i] = publicProductResp{
 			ID:        p.ID,
 			PublicID:  p.PublicID,
+			Code:      p.Code,
 			Name:      p.Name,
 			Series:    p.Series,
 			Spec:      p.Spec,
 			Brand:     p.Brand,
 			Unit:      p.Unit,
 			SalePrice: p.SalePrice,
+			Quantity:  qtyMap[p.ID],
 			Images:    imgs,
 		}
 	}
@@ -0,0 +1,125 @@
+package handler
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/gin-gonic/gin"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"gorm.io/gorm"
+
+	"github.com/wangjia/jiu/backend/internal/model"
+	"github.com/wangjia/jiu/backend/testutil"
+)
+
+func setupPublicRouter(db *gorm.DB) *gin.Engine {
+	h := NewPublicHandler(db)
+	r := gin.New()
+	r.Use(gin.Recovery())
+	r.GET("/api/v1/public/shops/:shop_code/products", h.ListShopProducts)
+	return r
+}
+
+// 给商品补 public_id（CreateTestProduct 默认不设）
+func setPublicID(db *gorm.DB, productID uint64, pub string) {
+	require := func(err error) {
+		if err != nil {
+			panic(err)
+		}
+	}
+	require(db.Model(&model.Product{}).Where("id = ?", productID).Update("public_id", pub).Error)
+}
+
+func addInventory(db *gorm.DB, shopID, warehouseID, productID uint64, qty float64) {
+	wid := warehouseID
+	pid := productID
+	if err := db.Create(&model.Inventory{
+		ShopID:      shopID,
+		WarehouseID: &wid,
+		ProductID:   &pid,
+		Quantity:    qty,
+	}).Error; err != nil {
+		panic(err)
+	}
+}
+
+func TestPublicHandler_ListShopProducts_InStockOnly(t *testing.T) {
+	db := testutil.SetupTestDB()
+	shop := testutil.CreateTestShop(db, "PUB001")
+	wh := testutil.CreateTestWarehouse(db, shop.ID, "仓")
+	r := setupPublicRouter(db)
+
+	// A：有库存 5 → 应出现，quantity=5
+	pa := testutil.CreateTestProduct(db, shop.ID, "茅台A")
+	setPublicID(db, pa.ID, "pub-a")
+	addInventory(db, shop.ID, wh.ID, pa.ID, 5)
+
+	// B：有 public_id 但无库存 → 不出现
+	pb := testutil.CreateTestProduct(db, shop.ID, "五粮液B")
+	setPublicID(db, pb.ID, "pub-b")
+
+	// C：两条库存 3+2 → 出现，quantity=5
+	pc := testutil.CreateTestProduct(db, shop.ID, "汾酒C")
+	setPublicID(db, pc.ID, "pub-c")
+	addInventory(db, shop.ID, wh.ID, pc.ID, 3)
+	addInventory(db, shop.ID, wh.ID, pc.ID, 2)
+
+	// D：有库存但无 public_id → 不出现
+	pd := testutil.CreateTestProduct(db, shop.ID, "无公开D")
+	addInventory(db, shop.ID, wh.ID, pd.ID, 9)
+
+	w := httptest.NewRecorder()
+	req, _ := http.NewRequest("GET", "/api/v1/public/shops/PUB001/products", nil)
+	r.ServeHTTP(w, req)
+	require.Equal(t, http.StatusOK, w.Code)
+
+	var resp map[string]interface{}
+	require.NoError(t, json.Unmarshal(w.Body.Bytes(), &resp))
+
+	// 只 A、C 两个有库存 + 有 public_id
+	assert.Equal(t, float64(2), resp["total"])
+	data := resp["data"].([]interface{})
+	require.Len(t, data, 2)
+
+	byName := map[string]map[string]interface{}{}
+	for _, it := range data {
+		m := it.(map[string]interface{})
+		byName[m["name"].(string)] = m
+	}
+
+	require.Contains(t, byName, "茅台A")
+	require.Contains(t, byName, "汾酒C")
+	assert.NotContains(t, byName, "五粮液B") // 无库存
+	assert.NotContains(t, byName, "无公开D") // 无 public_id
+
+	// 数量正确（C 聚合 3+2=5）
+	assert.Equal(t, float64(5), byName["茅台A"]["quantity"])
+	assert.Equal(t, float64(5), byName["汾酒C"]["quantity"])
+	// 带上了序列号 code
+	assert.Equal(t, "P-茅台A", byName["茅台A"]["code"])
+}
+
+func TestPublicHandler_ListShopProducts_Isolation(t *testing.T) {
+	db := testutil.SetupTestDB()
+	shopA := testutil.CreateTestShop(db, "PUBA")
+	shopB := testutil.CreateTestShop(db, "PUBB")
+	whB := testutil.CreateTestWarehouse(db, shopB.ID, "仓B")
+	r := setupPublicRouter(db)
+
+	// B 店有个有库存商品
+	pb := testutil.CreateTestProduct(db, shopB.ID, "他店商品")
+	setPublicID(db, pb.ID, "pub-x")
+	addInventory(db, shopB.ID, whB.ID, pb.ID, 7)
+
+	// 查 A 店：看不到 B 店商品
+	w := httptest.NewRecorder()
+	req, _ := http.NewRequest("GET", "/api/v1/public/shops/"+shopA.Code+"/products", nil)
+	r.ServeHTTP(w, req)
+	require.Equal(t, http.StatusOK, w.Code)
+	var resp map[string]interface{}
+	require.NoError(t, json.Unmarshal(w.Body.Bytes(), &resp))
+	assert.Equal(t, float64(0), resp["total"])
+}
@@ -49,6 +49,13 @@ func (h *StockInHandler) List(c *gin.Context) {
 	if endDate := c.Query("end_date"); endDate != "" {
 		query = query.Where("order_date <= ?", endDate)
 	}
+	if kw := strings.TrimSpace(c.Query("keyword")); kw != "" {
+		like := "%" + kw + "%"
+		query = query.Where(
+			"order_no LIKE ? OR partner_id IN (SELECT id FROM partners WHERE shop_id = ? AND name LIKE ?)",
+			like, shopID, like,
+		)
+	}

 	var total int64
 	query.Count(&total)
@@ -56,7 +63,7 @@ func (h *StockInHandler) List(c *gin.Context) {
 	orders := make([]model.StockInOrder, 0)
 	query.Preload("Warehouse").Preload("Partner").Preload("Operator").Preload("Reviewer").
 		Offset((page - 1) * pageSize).Limit(pageSize).
-		Order("id DESC").Find(&orders)
+		Order("order_date DESC, id DESC").Find(&orders)

 	c.JSON(http.StatusOK, gin.H{"data": orders, "total": total, "page": page, "page_size": pageSize})
 }
@@ -99,19 +106,28 @@ func (h *StockInHandler) Create(c *gin.Context) {
 	}
 	req.OrderNo = orderNo

-	// 计算总金额；自动生成批次号
-	var total float64
-	for i := range req.Items {
-		req.Items[i].ShopID = shopID
-		req.Items[i].TotalPrice = req.Items[i].Quantity * req.Items[i].UnitPrice
-		total += req.Items[i].TotalPrice
-		if req.Items[i].BatchNo == "" {
-			req.Items[i].BatchNo = fmt.Sprintf("%s-%02d", req.OrderNo, i+1)
+	// 事务内：每条明细新建一个独立产品（特有产品/序列号，不按名称复用），回填 product_id，再建单。
+	err = h.db.Transaction(func(tx *gorm.DB) error {
+		var total float64
+		for i := range req.Items {
+			it := &req.Items[i]
+			it.ShopID = shopID
+			if it.BatchNo == "" {
+				it.BatchNo = fmt.Sprintf("%s-%02d", req.OrderNo, i+1)
+			}
+			prod, e := createIndependentProduct(tx, shopID, it.ProductName, it.Series, it.Spec, it.BatchNo, it.ProductionDate, it.UnitPrice)
+			if e != nil {
+				return e
+			}
+			it.ProductID = prod.ID
+			it.ProductCode = prod.Code // 保留快照,兼容现有查询(瘦身阶段再去)
+			it.TotalPrice = it.Quantity * it.UnitPrice
+			total += it.TotalPrice
 		}
-	}
-	req.TotalAmount = total
-
-	if err := h.db.Create(&req).Error; err != nil {
+		req.TotalAmount = total
+		return tx.Create(&req).Error
+	})
+	if err != nil {
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 		return
 	}
@@ -141,13 +157,20 @@ func (h *StockInHandler) Update(c *gin.Context) {
 		}
 		var total float64
 		for i := range req.Items {
-			req.Items[i].ShopID = shopID
-			req.Items[i].OrderID = order.ID
-			req.Items[i].TotalPrice = req.Items[i].Quantity * req.Items[i].UnitPrice
-			total += req.Items[i].TotalPrice
-			if req.Items[i].BatchNo == "" {
-				req.Items[i].BatchNo = fmt.Sprintf("%s-%02d", order.OrderNo, i+1)
+			it := &req.Items[i]
+			it.ShopID = shopID
+			it.OrderID = order.ID
+			if it.BatchNo == "" {
+				it.BatchNo = fmt.Sprintf("%s-%02d", order.OrderNo, i+1)
 			}
+			// 编辑草稿:旧明细已删,每条按新模型重建独立产品（旧草稿 product 无库存,暂留待后续清理）
+			prod, e := createIndependentProduct(tx, shopID, it.ProductName, it.Series, it.Spec, it.BatchNo, it.ProductionDate, it.UnitPrice)
+			if e != nil {
+				return e
+			}
+			it.ProductID = prod.ID
+			it.ProductCode = prod.Code
+			it.TotalPrice = it.Quantity * it.UnitPrice
 		}
 		updates := map[string]interface{}{
 			"warehouse_id": req.WarehouseID,
@@ -232,3 +255,18 @@ func (h *StockInHandler) Reject(c *gin.Context) {
 	}
 	c.JSON(http.StatusOK, gin.H{"message": "rejected"})
 }
+
+// Withdraw PUT /api/v1/stock-in/orders/:id/withdraw
+// 审核中(pending)撤回为草稿(draft)，供管理员修改后重新提交。仅 pending 可撤回；
+// 已审核(approved)单据只读、库存已变动，不可撤回。
+func (h *StockInHandler) Withdraw(c *gin.Context) {
+	shopID := middleware.GetShopID(c)
+	result := h.db.Model(&model.StockInOrder{}).
+		Where("id = ? AND shop_id = ? AND status = 'pending'", c.Param("id"), shopID).
+		Update("status", "draft")
+	if result.RowsAffected == 0 {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "order not found or not in pending status"})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{"message": "withdrawn"})
+}
@@ -28,9 +28,11 @@ func TestStockInHandler_FullFlow(t *testing.T) {
 		"order_date":   time.Now().Format(time.RFC3339),
 		"items": []map[string]interface{}{
 			{
-				"product_id": product.ID,
-				"quantity":   10.0,
-				"unit_price": 5.0,
+				"product_name": "Test Beer",
+				"series":       "普通",
+				"spec":         "500ml",
+				"quantity":     10.0,
+				"unit_price":   5.0,
 			},
 		},
 	})
@@ -57,15 +59,17 @@ func TestStockInHandler_FullFlow(t *testing.T) {
 	w = makeRequest(r, "PUT", fmt.Sprintf("/api/v1/stock-in/orders/%d/approve", orderID), token, nil)
 	require.Equal(t, http.StatusOK, w.Code)

-	// 5. 验证库存变化
+	// 5. 验证库存变化：入库为明细新建了独立产品，库存指向它（不是预设的 product）
 	var inv model.Inventory
-	db.Where("shop_id = ? AND warehouse_id = ? AND product_id = ?",
-		shop.ID, warehouse.ID, product.ID).First(&inv)
+	db.Where("shop_id = ? AND warehouse_id = ?",
+		shop.ID, warehouse.ID).First(&inv)
 	assert.Equal(t, float64(10), inv.Quantity)
+	assert.NotZero(t, inv.ProductID)
+	assert.NotEqual(t, product.ID, inv.ProductID)

 	// 6. 验证库存流水
 	var logs []model.InventoryLog
-	db.Where("shop_id = ? AND product_id = ?", shop.ID, product.ID).Find(&logs)
+	db.Where("shop_id = ? AND product_id = ?", shop.ID, inv.ProductID).Find(&logs)
 	require.Len(t, logs, 1)
 	assert.Equal(t, "in", logs[0].Direction)
 	assert.Equal(t, float64(10), logs[0].Quantity)
@@ -178,6 +182,47 @@ func TestStockInHandler_Reject(t *testing.T) {
 	assert.Equal(t, "rejected", detailData["status"])
 }

+func TestStockInHandler_Withdraw(t *testing.T) {
+	db := testutil.SetupTestDB()
+	shop := testutil.CreateTestShop(db, "SI006")
+	admin := testutil.CreateTestUser(db, shop.ID, "admin", "pass", "admin")
+	operator := testutil.CreateTestUser(db, shop.ID, "op", "pass", "operator")
+	warehouse := testutil.CreateTestWarehouse(db, shop.ID, "Warehouse")
+	product := testutil.CreateTestProduct(db, shop.ID, "Tequila")
+	adminToken := getAuthToken(admin.ID, shop.ID, "admin")
+	opToken := getAuthToken(operator.ID, shop.ID, "operator")
+	r := setupProtectedRouter(db)
+
+	// 创建并提交（进入 pending）
+	w := makeRequest(r, "POST", "/api/v1/stock-in/orders", adminToken, map[string]interface{}{
+		"warehouse_id": warehouse.ID,
+		"order_date":   time.Now().Format(time.RFC3339),
+		"items": []map[string]interface{}{
+			{"product_id": product.ID, "quantity": 5.0},
+		},
+	})
+	orderID := extractID(w)
+	makeRequest(r, "PUT", fmt.Sprintf("/api/v1/stock-in/orders/%d/submit", orderID), adminToken, nil)
+
+	// 1. 非管理员撤回 → 403
+	w = makeRequest(r, "PUT", fmt.Sprintf("/api/v1/stock-in/orders/%d/withdraw", orderID), opToken, nil)
+	assert.Equal(t, http.StatusForbidden, w.Code)
+
+	// 2. 管理员撤回 → 200，状态回到 draft
+	w = makeRequest(r, "PUT", fmt.Sprintf("/api/v1/stock-in/orders/%d/withdraw", orderID), adminToken, nil)
+	assert.Equal(t, http.StatusOK, w.Code)
+	w = makeRequest(r, "GET", fmt.Sprintf("/api/v1/stock-in/orders/%d", orderID), adminToken, nil)
+	assert.Equal(t, "draft", parseResponse(w)["data"].(map[string]interface{})["status"])
+
+	// 3. 撤回后已是 draft，再撤回 → 400（仅 pending 可撤回）
+	w = makeRequest(r, "PUT", fmt.Sprintf("/api/v1/stock-in/orders/%d/withdraw", orderID), adminToken, nil)
+	assert.Equal(t, http.StatusBadRequest, w.Code)
+
+	// 4. 撤回为 draft 后可再次修改并提交
+	w = makeRequest(r, "PUT", fmt.Sprintf("/api/v1/stock-in/orders/%d/submit", orderID), adminToken, nil)
+	assert.Equal(t, http.StatusOK, w.Code)
+}
+
 func TestStockInHandler_GetNotFound(t *testing.T) {
 	db := testutil.SetupTestDB()
 	shop := testutil.CreateTestShop(db, "SI006")
@@ -308,6 +353,51 @@ func TestStockInHandler_Reject_NotPending(t *testing.T) {
 	assert.Equal(t, http.StatusBadRequest, w.Code)
 }

+func TestStockInHandler_List_FilterByKeyword(t *testing.T) {
+	db := testutil.SetupTestDB()
+	shop := testutil.CreateTestShop(db, "SI011")
+	user := testutil.CreateTestUser(db, shop.ID, "admin", "pass", "admin")
+	warehouse := testutil.CreateTestWarehouse(db, shop.ID, "Warehouse")
+	product := testutil.CreateTestProduct(db, shop.ID, "Brandy")
+	token := getAuthToken(user.ID, shop.ID, "admin")
+	r := setupProtectedRouter(db)
+
+	// 往来单位：茅台供应商
+	partner := &model.Partner{Code: "P001", Name: "茅台供应商", Type: "supplier"}
+	partner.ShopID = shop.ID
+	require.NoError(t, db.Create(partner).Error)
+
+	// 单据1：挂往来单位
+	w := makeRequest(r, "POST", "/api/v1/stock-in/orders", token, map[string]interface{}{
+		"warehouse_id": warehouse.ID,
+		"partner_id":   partner.ID,
+		"order_date":   time.Now().Format(time.RFC3339),
+		"items":        []map[string]interface{}{{"product_id": product.ID, "quantity": 5.0}},
+	})
+	require.Equal(t, http.StatusCreated, w.Code)
+	order1No := parseResponse(w)["data"].(map[string]interface{})["order_no"].(string)
+
+	// 单据2：无往来单位
+	w = makeRequest(r, "POST", "/api/v1/stock-in/orders", token, map[string]interface{}{
+		"warehouse_id": warehouse.ID,
+		"order_date":   time.Now().Format(time.RFC3339),
+		"items":        []map[string]interface{}{{"product_id": product.ID, "quantity": 3.0}},
+	})
+	require.Equal(t, http.StatusCreated, w.Code)
+
+	// 按往来单位名搜索 → 只命中单据1
+	w = makeRequest(r, "GET", "/api/v1/stock-in/orders?keyword=茅台", token, nil)
+	assert.Equal(t, float64(1), parseResponse(w)["total"].(float64))
+
+	// 按单号搜索 → 只命中单据1
+	w = makeRequest(r, "GET", "/api/v1/stock-in/orders?keyword="+order1No, token, nil)
+	assert.Equal(t, float64(1), parseResponse(w)["total"].(float64))
+
+	// 无关键词 → 两条都在
+	w = makeRequest(r, "GET", "/api/v1/stock-in/orders", token, nil)
+	assert.Equal(t, float64(2), parseResponse(w)["total"].(float64))
+}
+
 func TestStockInHandler_List_FilterByStatus(t *testing.T) {
 	db := testutil.SetupTestDB()
 	shop := testutil.CreateTestShop(db, "SI010")
@@ -42,6 +42,13 @@ func (h *StockOutHandler) List(c *gin.Context) {
 	if endDate := c.Query("end_date"); endDate != "" {
 		query = query.Where("order_date <= ?", endDate)
 	}
+	if kw := strings.TrimSpace(c.Query("keyword")); kw != "" {
+		like := "%" + kw + "%"
+		query = query.Where(
+			"order_no LIKE ? OR partner_id IN (SELECT id FROM partners WHERE shop_id = ? AND name LIKE ?)",
+			like, shopID, like,
+		)
+	}

 	var total int64
 	query.Count(&total)
@@ -49,7 +56,7 @@ func (h *StockOutHandler) List(c *gin.Context) {
 	orders := make([]model.StockOutOrder, 0)
 	query.Preload("Warehouse").Preload("Partner").Preload("Operator").Preload("Reviewer").
 		Offset((page - 1) * pageSize).Limit(pageSize).
-		Order("id DESC").Find(&orders)
+		Order("order_date DESC, id DESC").Find(&orders)

 	c.JSON(http.StatusOK, gin.H{"data": orders, "total": total, "page": page, "page_size": pageSize})
 }
@@ -233,3 +240,18 @@ func (h *StockOutHandler) Reject(c *gin.Context) {
 	}
 	c.JSON(http.StatusOK, gin.H{"message": "rejected"})
 }
+
+// Withdraw PUT /api/v1/stock-out/orders/:id/withdraw
+// 审核中(pending)撤回为草稿(draft)，供管理员修改后重新提交。仅 pending 可撤回；
+// 已审核(approved)单据只读、库存已变动，不可撤回。
+func (h *StockOutHandler) Withdraw(c *gin.Context) {
+	shopID := middleware.GetShopID(c)
+	result := h.db.Model(&model.StockOutOrder{}).
+		Where("id = ? AND shop_id = ? AND status = 'pending'", c.Param("id"), shopID).
+		Update("status", "draft")
+	if result.RowsAffected == 0 {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "order not found or not in pending status"})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{"message": "withdrawn"})
+}
@@ -133,6 +133,51 @@ func TestStockOutHandler_List(t *testing.T) {
 	assert.Equal(t, float64(2), resp["total"].(float64))
 }

+func TestStockOutHandler_List_FilterByKeyword(t *testing.T) {
+	db := testutil.SetupTestDB()
+	shop := testutil.CreateTestShop(db, "SO011")
+	user := testutil.CreateTestUser(db, shop.ID, "admin", "pass", "admin")
+	warehouse := testutil.CreateTestWarehouse(db, shop.ID, "Warehouse")
+	product := testutil.CreateTestProduct(db, shop.ID, "Beer")
+	token := getAuthToken(user.ID, shop.ID, "admin")
+	r := setupProtectedRouter(db)
+
+	// 往来单位：海底捞客户
+	partner := &model.Partner{Code: "C001", Name: "海底捞客户", Type: "customer"}
+	partner.ShopID = shop.ID
+	require.NoError(t, db.Create(partner).Error)
+
+	// 单据1：挂往来单位
+	w := makeRequest(r, "POST", "/api/v1/stock-out/orders", token, map[string]interface{}{
+		"warehouse_id": warehouse.ID,
+		"partner_id":   partner.ID,
+		"order_date":   time.Now().Format(time.RFC3339),
+		"items":        []map[string]interface{}{{"product_id": product.ID, "quantity": 1.0}},
+	})
+	require.Equal(t, http.StatusCreated, w.Code)
+	order1No := parseResponse(w)["data"].(map[string]interface{})["order_no"].(string)
+
+	// 单据2：无往来单位
+	w = makeRequest(r, "POST", "/api/v1/stock-out/orders", token, map[string]interface{}{
+		"warehouse_id": warehouse.ID,
+		"order_date":   time.Now().Format(time.RFC3339),
+		"items":        []map[string]interface{}{{"product_id": product.ID, "quantity": 1.0}},
+	})
+	require.Equal(t, http.StatusCreated, w.Code)
+
+	// 按往来单位名搜索
+	w = makeRequest(r, "GET", "/api/v1/stock-out/orders?keyword=海底捞", token, nil)
+	assert.Equal(t, float64(1), parseResponse(w)["total"].(float64))
+
+	// 按单号搜索
+	w = makeRequest(r, "GET", "/api/v1/stock-out/orders?keyword="+order1No, token, nil)
+	assert.Equal(t, float64(1), parseResponse(w)["total"].(float64))
+
+	// 无关键词
+	w = makeRequest(r, "GET", "/api/v1/stock-out/orders", token, nil)
+	assert.Equal(t, float64(2), parseResponse(w)["total"].(float64))
+}
+
 func TestStockOutHandler_Reject(t *testing.T) {
 	db := testutil.SetupTestDB()
 	shop := testutil.CreateTestShop(db, "SO004")
@@ -63,6 +63,7 @@ func setupProtectedRouter(db *gorm.DB) *gin.Engine {
 	stockIn.PUT("/orders/:id/submit", stockInH.Submit)
 	stockIn.PUT("/orders/:id/approve", stockInH.Approve)
 	stockIn.PUT("/orders/:id/reject", stockInH.Reject)
+	stockIn.PUT("/orders/:id/withdraw", middleware.AdminOnly(), stockInH.Withdraw)

 	// 出库路由
 	stockOut := api.Group("/stock-out")
@@ -72,6 +73,7 @@ func setupProtectedRouter(db *gorm.DB) *gin.Engine {
 	stockOut.PUT("/orders/:id/submit", stockOutH.Submit)
 	stockOut.PUT("/orders/:id/approve", stockOutH.Approve)
 	stockOut.PUT("/orders/:id/reject", stockOutH.Reject)
+	stockOut.PUT("/orders/:id/withdraw", middleware.AdminOnly(), stockOutH.Withdraw)

 	// 库存路由
 	inv := api.Group("/inventory")
@@ -10,6 +10,8 @@ type ProductCategory struct {
 type Product struct {
 	TenantBase
 	PublicID      string  `gorm:"size:36;uniqueIndex" json:"public_id"`
+	// Code 商品编码：同店内唯一。(shop_id, code) 联合唯一索引 uk_shop_code 由 autoMigrate 显式建（见 main.go），
+	// 不在此用 tag 声明——ShopID 在共用 TenantBase 上，tag 只能建单列索引会破坏多租户隔离。
 	Code          string  `gorm:"size:50" json:"code"`
 	Barcode       string  `gorm:"size:100" json:"barcode"`
 	Name          string  `gorm:"size:200;not null" json:"name"`
@@ -20,6 +22,9 @@ type Product struct {
 	Brand         string  `gorm:"size:100" json:"brand"`
 	PurchasePrice float64 `gorm:"type:decimal(12,2)" json:"purchase_price"`
 	SalePrice     float64 `gorm:"type:decimal(12,2)" json:"sale_price"`
+	// 特有产品的批次属性：每个 product = 一个特有产品/序列号，生产日期/批次归此（单一来源）
+	ProductionDate *Date  `gorm:"type:date" json:"production_date"`
+	BatchNo        string `gorm:"size:50" json:"batch_no"`
 	MinStock      int     `gorm:"default:0" json:"min_stock"`
 	Description   string  `gorm:"type:text" json:"description"`
 	CustomFields    JSON    `gorm:"type:json" json:"custom_fields,omitempty"`
@@ -153,6 +153,8 @@ func Setup(r *gin.Engine, db *gorm.DB) {
 			stockIn.PUT("/orders/:id/submit", stockInH.Submit)
 			stockIn.PUT("/orders/:id/approve", stockInH.Approve)
 			stockIn.PUT("/orders/:id/reject", stockInH.Reject)
+			// 撤回（审核中→草稿）仅管理员
+			stockIn.PUT("/orders/:id/withdraw", middleware.AdminOnly(), stockInH.Withdraw)
 		}

 		// 出库
@@ -166,6 +168,8 @@ func Setup(r *gin.Engine, db *gorm.DB) {
 			stockOut.PUT("/orders/:id/submit", stockOutH.Submit)
 			stockOut.PUT("/orders/:id/approve", stockOutH.Approve)
 			stockOut.PUT("/orders/:id/reject", stockOutH.Reject)
+			// 撤回（审核中→草稿）仅管理员
+			stockOut.PUT("/orders/:id/withdraw", middleware.AdminOnly(), stockOutH.Withdraw)
 		}

 		// 库存
@@ -64,16 +64,26 @@ func (s *StockService) ApproveStockIn(shopID, orderID, reviewerID uint64) error
 				unitPricePtr = &itemCopy.UnitPrice
 			}

-			productCode := ""
-			productName := ""
-			series := ""
-			spec := ""
+			// 优先使用明细自带快照列（历史导入单的真实商品信息在此），
+			// Product 关联仅作兜底（普通 UI 录入单的明细快照为空）。
+			productCode := itemCopy.ProductCode
+			productName := itemCopy.ProductName
+			series := itemCopy.Series
+			spec := itemCopy.Spec
 			unit := ""
 			if itemCopy.Product != nil {
-				productCode = itemCopy.Product.Code
-				productName = itemCopy.Product.Name
-				series = itemCopy.Product.Series
-				spec = itemCopy.Product.Spec
+				if productCode == "" {
+					productCode = itemCopy.Product.Code
+				}
+				if productName == "" {
+					productName = itemCopy.Product.Name
+				}
+				if series == "" {
+					series = itemCopy.Product.Series
+				}
+				if spec == "" {
+					spec = itemCopy.Product.Spec
+				}
 				unit = itemCopy.Product.Unit
 			}

@@ -65,6 +65,47 @@ func TestStockService_ApproveStockIn_Success(t *testing.T) {
 	assert.Equal(t, float64(10), logs[0].QtyAfter)
 }

+// 历史导入单：明细自带真实快照名，product_id 指向占位商品（名「历史导入占位」）。
+// 审核生成的库存应使用明细快照真名，而非占位商品名。
+func TestStockService_ApproveStockIn_PrefersItemSnapshot(t *testing.T) {
+	db := testutil.SetupTestDB()
+	shop := testutil.CreateTestShop(db, "STOCK009")
+	warehouse := testutil.CreateTestWarehouse(db, shop.ID, "Warehouse")
+	placeholder := testutil.CreateTestProduct(db, shop.ID, "历史导入占位")
+	user := testutil.CreateTestUser(db, shop.ID, "admin", "pass", "admin")
+
+	order := model.StockInOrder{
+		TenantBase:  model.TenantBase{ShopID: shop.ID},
+		OrderNo:     "IN20240101000009",
+		WarehouseID: warehouse.ID,
+		OperatorID:  user.ID,
+		Status:      "pending",
+		OrderDate:   model.Date{Time: time.Now()},
+		Items: []model.StockInItem{
+			{
+				ShopID:      shop.ID,
+				ProductID:   placeholder.ID,
+				ProductCode: "ZXZ029751",
+				ProductName: "贵州茅台酒2006",
+				Series:      "茅台",
+				Spec:        "500ml",
+				Quantity:    10,
+			},
+		},
+	}
+	require.NoError(t, db.Create(&order).Error)
+
+	svc := NewStockService(db)
+	require.NoError(t, svc.ApproveStockIn(shop.ID, order.ID, user.ID))
+
+	var inv model.Inventory
+	require.NoError(t, db.Where("shop_id = ? AND product_id = ?", shop.ID, placeholder.ID).First(&inv).Error)
+	assert.Equal(t, "贵州茅台酒2006", inv.ProductName)
+	assert.Equal(t, "ZXZ029751", inv.ProductCode)
+	assert.Equal(t, "茅台", inv.Series)
+	assert.Equal(t, "500ml", inv.Spec)
+}
+
 func TestStockService_ApproveStockIn_NotPending(t *testing.T) {
 	db := testutil.SetupTestDB()
 	shop := testutil.CreateTestShop(db, "STOCK002")
@@ -87,7 +87,8 @@ func initDB() *gorm.DB {
 	}

 	db, err := gorm.Open(mysql.Open(dsn), &gorm.Config{
-		Logger: logger.Default.LogMode(logLevel),
+		Logger:         logger.Default.LogMode(logLevel),
+		TranslateError: true, // 把 MySQL 1062 翻译成 gorm.ErrDuplicatedKey，供编码撞唯一约束时重试
 	})
 	if err != nil {
 		log.Fatalf("failed to connect database: %v", err)
@@ -136,5 +137,12 @@ func autoMigrate(db *gorm.DB) {
 	if err != nil {
 		log.Fatalf("auto migrate failed: %v", err)
 	}
+	// products(shop_id, code) 联合唯一索引：ShopID 在共用 TenantBase 上无法用 struct tag 表达，
+	// 故在此幂等显式建（保证同店内商品编码唯一，DB 层兜底防止重复编码静默落库）。
+	if !db.Migrator().HasIndex(&model.Product{}, "uk_shop_code") {
+		if err := db.Exec("CREATE UNIQUE INDEX uk_shop_code ON products (shop_id, code)").Error; err != nil {
+			log.Fatalf("create unique index uk_shop_code failed: %v", err)
+		}
+	}
 	log.Println("AutoMigrate completed")
 }
@@ -46,7 +46,8 @@ func SetupTestDB() *gorm.DB {
 	InitConfig()

 	db, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{
-		Logger: logger.Default.LogMode(logger.Silent),
+		Logger:         logger.Default.LogMode(logger.Silent),
+		TranslateError: true,
 	})
 	if err != nil {
 		panic(fmt.Sprintf("failed to open sqlite: %v", err))
@@ -187,6 +188,8 @@ func SetupTestDB() *gorm.DB {
 			brand TEXT,
 			purchase_price REAL,
 			sale_price REAL,
+			production_date DATETIME,
+			batch_no TEXT,
 			min_stock INTEGER DEFAULT 0,
 			description TEXT,
 			custom_fields TEXT,
@@ -238,6 +241,45 @@ func SetupTestDB() *gorm.DB {
 			content TEXT,
 			remark TEXT
 		)`,
+		`CREATE TABLE IF NOT EXISTS product_images (
+			id INTEGER PRIMARY KEY AUTOINCREMENT,
+			product_id INTEGER NOT NULL,
+			shop_id INTEGER NOT NULL,
+			url TEXT NOT NULL,
+			sort_order INTEGER DEFAULT 0,
+			created_at DATETIME
+		)`,
+		`CREATE TABLE IF NOT EXISTS product_name_options (
+			id INTEGER PRIMARY KEY AUTOINCREMENT,
+			created_at DATETIME,
+			updated_at DATETIME,
+			deleted_at DATETIME,
+			shop_id INTEGER NOT NULL,
+			code TEXT,
+			name TEXT NOT NULL,
+			remark TEXT
+		)`,
+		`CREATE TABLE IF NOT EXISTS product_series_options (
+			id INTEGER PRIMARY KEY AUTOINCREMENT,
+			created_at DATETIME,
+			updated_at DATETIME,
+			deleted_at DATETIME,
+			shop_id INTEGER NOT NULL,
+			code TEXT,
+			name TEXT NOT NULL,
+			remark TEXT
+		)`,
+		`CREATE TABLE IF NOT EXISTS product_spec_options (
+			id INTEGER PRIMARY KEY AUTOINCREMENT,
+			created_at DATETIME,
+			updated_at DATETIME,
+			deleted_at DATETIME,
+			shop_id INTEGER NOT NULL,
+			code TEXT,
+			name TEXT NOT NULL,
+			quantity INTEGER DEFAULT 0,
+			remark TEXT
+		)`,
 		`CREATE TABLE IF NOT EXISTS warehouses (
 			id INTEGER PRIMARY KEY AUTOINCREMENT,
 			created_at DATETIME,
@@ -194,3 +194,10 @@ final isReadonlyProvider = Provider<bool>((ref) {
  final role = ref.watch(authStateProvider.select((s) => s.user?.role));
  return role == 'readonly';
 });
+
+/// 当前登录用户是否为管理员（role == 'admin'）。
+/// 用于「撤回审核中单据」等仅管理员可用的操作；后端 middleware.AdminOnly() 兜底。
+final isAdminProvider = Provider<bool>((ref) {
+  final role = ref.watch(authStateProvider.select((s) => s.user?.role));
+  return role == 'admin';
+});
@@ -23,6 +23,7 @@ class StockInListNotifier extends AsyncNotifier<PageResult<StockInOrder>> {
  String _status = '';
  String? _startDate;
  String? _endDate;
+  String _keyword = '';
  PageResult<StockInOrder>? _cache;

  @override
@@ -44,6 +45,7 @@ class StockInListNotifier extends AsyncNotifier<PageResult<StockInOrder>> {
          status: _status.isEmpty ? null : _status,
          startDate: _startDate,
          endDate: _endDate,
+          keyword: _keyword.isEmpty ? null : _keyword,
          page: _page,
          pageSize: _pageSize,
        );
@@ -60,6 +62,9 @@ class StockInListNotifier extends AsyncNotifier<PageResult<StockInOrder>> {
    reload();
  }

+  /// 当前服务端状态过滤值（供页面进入时对齐标签/下拉，避免重复拉取）
+  String get currentStatus => _status;
+
  void setStatus(String status) {
    _status = status;
    _page = 1;
@@ -73,6 +78,12 @@ class StockInListNotifier extends AsyncNotifier<PageResult<StockInOrder>> {
    reload();
  }

+  void setKeyword(String keyword) {
+    _keyword = keyword;
+    _page = 1;
+    reload();
+  }
+
  void reload() {
    state = const AsyncValue.loading();
    _fetch().then((result) {
@@ -112,4 +123,9 @@ class StockInListNotifier extends AsyncNotifier<PageResult<StockInOrder>> {
    await ref.read(stockInRepositoryProvider).reject(id);
    reload();
  }
+
+  Future<void> withdrawOrder(int id) async {
+    await ref.read(stockInRepositoryProvider).withdraw(id);
+    reload();
+  }
 }
@@ -23,6 +23,7 @@ class StockOutListNotifier extends AsyncNotifier<PageResult<StockOutOrder>> {
  String _status = '';
  String? _startDate;
  String? _endDate;
+  String _keyword = '';
  PageResult<StockOutOrder>? _cache;

  @override
@@ -44,6 +45,7 @@ class StockOutListNotifier extends AsyncNotifier<PageResult<StockOutOrder>> {
          status: _status.isEmpty ? null : _status,
          startDate: _startDate,
          endDate: _endDate,
+          keyword: _keyword.isEmpty ? null : _keyword,
          page: _page,
          pageSize: _pageSize,
        );
@@ -60,6 +62,9 @@ class StockOutListNotifier extends AsyncNotifier<PageResult<StockOutOrder>> {
    reload();
  }

+  /// 当前服务端状态过滤值（供页面进入时对齐标签/下拉，避免重复拉取）
+  String get currentStatus => _status;
+
  void setStatus(String status) {
    _status = status;
    _page = 1;
@@ -73,6 +78,12 @@ class StockOutListNotifier extends AsyncNotifier<PageResult<StockOutOrder>> {
    reload();
  }

+  void setKeyword(String keyword) {
+    _keyword = keyword;
+    _page = 1;
+    reload();
+  }
+
  void reload() {
    state = const AsyncValue.loading();
    _fetch().then((result) {
@@ -112,4 +123,9 @@ class StockOutListNotifier extends AsyncNotifier<PageResult<StockOutOrder>> {
    await ref.read(stockOutRepositoryProvider).reject(id);
    reload();
  }
+
+  Future<void> withdrawOrder(int id) async {
+    await ref.read(stockOutRepositoryProvider).withdraw(id);
+    reload();
+  }
 }
@@ -13,6 +13,7 @@ class StockInRepository {
    String? status,
    String? startDate,
    String? endDate,
+    String? keyword,
    int page = 1,
    int pageSize = 20,
  }) async {
@@ -23,6 +24,7 @@ class StockInRepository {
        if (status != null && status.isNotEmpty) 'status': status,
        if (startDate != null) 'start_date': startDate,
        if (endDate != null) 'end_date': endDate,
+        if (keyword != null && keyword.isNotEmpty) 'keyword': keyword,
      };
      final resp = await _client.get('/stock-in/orders', params: params);
      return PageResult.fromJson(
@@ -117,4 +119,15 @@ class StockInRepository {
      );
    }
  }
+
+  Future<void> withdraw(int id) async {
+    try {
+      await _client.put('/stock-in/orders/$id/withdraw');
+    } on DioException catch (e) {
+      throw AppException(
+        e.response?.data?['error'] as String? ?? '撤回失败',
+        statusCode: e.response?.statusCode,
+      );
+    }
+  }
 }
@@ -13,6 +13,7 @@ class StockOutRepository {
    String? status,
    String? startDate,
    String? endDate,
+    String? keyword,
    int page = 1,
    int pageSize = 20,
  }) async {
@@ -23,6 +24,7 @@ class StockOutRepository {
        if (status != null && status.isNotEmpty) 'status': status,
        if (startDate != null) 'start_date': startDate,
        if (endDate != null) 'end_date': endDate,
+        if (keyword != null && keyword.isNotEmpty) 'keyword': keyword,
      };
      final resp = await _client.get('/stock-out/orders', params: params);
      return PageResult.fromJson(
@@ -117,4 +119,15 @@ class StockOutRepository {
      );
    }
  }
+
+  Future<void> withdraw(int id) async {
+    try {
+      await _client.put('/stock-out/orders/$id/withdraw');
+    } on DioException catch (e) {
+      throw AppException(
+        e.response?.data?['error'] as String? ?? '撤回失败',
+        statusCode: e.response?.statusCode,
+      );
+    }
+  }
 }
@@ -677,6 +677,13 @@ class _InventoryListScreenState extends ConsumerState<InventoryListScreen> {
                                ColumnPrefs.save(_screenId, v);
                              },
                            ),
+                            IconButton(
+                              tooltip: '刷新',
+                              icon: const Icon(Icons.refresh, size: 20),
+                              onPressed: () => ref
+                                  .read(inventoryListProvider.notifier)
+                                  .reload(),
+                            ),
                          ],
                        ),
                      ],
@@ -712,6 +719,13 @@ class _InventoryListScreenState extends ConsumerState<InventoryListScreen> {
                          ColumnPrefs.save(_screenId, v);
                        },
                      ),
+                      const SizedBox(width: 8),
+                      OutlinedButton.icon(
+                        onPressed: () =>
+                            ref.read(inventoryListProvider.notifier).reload(),
+                        icon: const Icon(Icons.refresh, size: 16),
+                        label: const Text('刷新'),
+                      ),
                      const Spacer(),
                    ],
                  );
@@ -269,6 +269,12 @@ class _ProductCard extends StatelessWidget {
    final name = item['name'] as String? ?? '';
    final series = item['series'] as String? ?? '';
    final spec = item['spec'] as String? ?? '';
+    final unit = item['unit'] as String? ?? '';
+    final qtyNum = (item['quantity'] as num?)?.toDouble() ?? 0;
+    // 去掉整数的 .0 尾巴：5.0 → 5，1.5 → 1.5
+    final qtyStr = qtyNum == qtyNum.roundToDouble()
+        ? qtyNum.toInt().toString()
+        : qtyNum.toString();
    final images = (item['images'] as List<dynamic>? ?? [])
        .cast<Map<String, dynamic>>();
    final imageUrl = images.isNotEmpty
@@ -339,7 +345,18 @@ class _ProductCard extends StatelessWidget {
                    const Spacer(),
                    Row(
                      children: [
-                        const Spacer(),
+                        Flexible(
+                          child: Text(
+                            '在库 $qtyStr$unit',
+                            maxLines: 1,
+                            overflow: TextOverflow.ellipsis,
+                            style: const TextStyle(
+                                fontSize: 11,
+                                color: _kBurgundy,
+                                fontWeight: FontWeight.w600),
+                          ),
+                        ),
+                        const SizedBox(width: 4),
                        Container(
                          padding: const EdgeInsets.symmetric(
                              horizontal: 8, vertical: 3),
@@ -11,7 +11,6 @@ import '../../models/stock_in.dart';
 import '../../core/config/app_constants.dart';
 import '../../providers/partner_provider.dart';
 import '../../providers/product_option_provider.dart';
-import '../../providers/product_provider.dart';
 import '../../providers/inventory_provider.dart';
 import '../../providers/stock_in_provider.dart';
 import '../../providers/warehouse_provider.dart';
@@ -306,58 +305,22 @@ class _StockInFormScreenState extends ConsumerState<StockInFormScreen> {

    setState(() => _submitting = true);

-    // Resolve product IDs for items where productId is null
+    // 入库每行 = 一个特有产品：明细只带 名称/系列/规格(字典文本) + 批次/生产日期，
+    // 由后端为每行新建独立产品(序列号)，前端不再 findOrCreate 复用。
    final nameOpts = ref.read(productNameListProvider).valueOrNull ?? [];
    final seriesOpts = ref.read(productSeriesListProvider).valueOrNull ?? [];
    final specOpts = ref.read(productSpecListProvider).valueOrNull ?? [];
+    String optName(List<dynamic> opts, int? id) =>
+        opts.where((o) => o.id == id).firstOrNull?.name as String? ?? '';

    for (final item in _items) {
-      if (item.productId == null) {
-        final name = nameOpts
-                .where((o) => o.id == item.selectedNameId)
-                .firstOrNull
-                ?.name ??
-            '';
-        final series = seriesOpts
-                .where((o) => o.id == item.selectedSeriesId)
-                .firstOrNull
-                ?.name ??
-            '';
-        final spec = specOpts
-                .where((o) => o.id == item.selectedSpecId)
-                .firstOrNull
-                ?.name ??
-            '';
-        if (name.isEmpty) {
-          ScaffoldMessenger.of(context).showSnackBar(
-            const SnackBar(
-                content: Text('请选择商品名称'), backgroundColor: AppTheme.danger),
-          );
-          setState(() => _submitting = false);
-          return;
-        }
-        try {
-          final product =
-              await ref.read(productRepositoryProvider).findOrCreate(
-                    name: name,
-                    series: series,
-                    spec: spec,
-                    originId: item.selectedOriginId,
-                    shelfLifeId: item.selectedShelfLifeId,
-                    storageId: item.selectedStorageId,
-                    descriptionDocId: item.selectedDescriptionDocId,
-                  );
-          item.productId = product.id;
-        } catch (e) {
-          if (mounted) {
-            ScaffoldMessenger.of(context).showSnackBar(
-              SnackBar(
-                  content: Text('商品查找失败：$e'), backgroundColor: AppTheme.danger),
-            );
-            setState(() => _submitting = false);
-          }
-          return;
-        }
+      if (optName(nameOpts, item.selectedNameId).isEmpty) {
+        ScaffoldMessenger.of(context).showSnackBar(
+          const SnackBar(
+              content: Text('请选择商品名称'), backgroundColor: AppTheme.danger),
+        );
+        setState(() => _submitting = false);
+        return;
      }
    }

@@ -367,7 +330,9 @@ class _StockInFormScreenState extends ConsumerState<StockInFormScreen> {
      final batchNo = item.batchNoCtrl.text.trim();
      final productionDate = item.productionDateCtrl.text.trim();
      return {
-        'product_id': item.productId ?? 0,
+        'product_name': optName(nameOpts, item.selectedNameId),
+        'series': optName(seriesOpts, item.selectedSeriesId),
+        'spec': optName(specOpts, item.selectedSpecId),
        'quantity': qty,
        'unit_price': price,
        'total_price': qty * price,
@@ -639,6 +604,20 @@ class _StockInFormScreenState extends ConsumerState<StockInFormScreen> {
                                          hint: '请选择供应商',
                                          dialogTitle: '选择供应商',
                                          isRequired: true,
+                                          onSearch: (kw) async {
+                                            final res = await ref
+                                                .read(partnerRepositoryProvider)
+                                                .list(
+                                                    type: 'supplier',
+                                                    keyword: kw,
+                                                    pageSize: 50);
+                                            return res.data
+                                                .map((p) => OptionItem(
+                                                    id: p.id,
+                                                    name: p.name,
+                                                    code: p.code))
+                                                .toList();
+                                          },
                                          onChanged: (v) =>
                                              setState(() => _partnerId = v),
                                        ),
@@ -894,7 +873,6 @@ class _StockInFormScreenState extends ConsumerState<StockInFormScreen> {
      controller: item.batchNoCtrl,
      decoration: const InputDecoration(
        hintText: '选填',
-        labelText: '批次号',
        isDense: true,
      ),
      style: const TextStyle(fontSize: 13),
@@ -1014,7 +992,8 @@ class _StockInFormScreenState extends ConsumerState<StockInFormScreen> {
        Expanded(flex: 18, child: th('名称')),
        Expanded(flex: 12, child: th('系列')),
        Expanded(flex: 12, child: th('规格')),
-        Expanded(flex: 24, child: th('生产日期')),
+        Expanded(flex: 14, child: th('生产日期')),
+        Expanded(flex: 12, child: th('批次号')),
        Expanded(flex: 10, child: th('数量')),
        Expanded(flex: 10, child: th('单价')),
        Expanded(flex: 10, child: th('金额')),
@@ -1038,8 +1017,7 @@ class _StockInFormScreenState extends ConsumerState<StockInFormScreen> {
              style: TextStyle(fontSize: 13, color: color, fontWeight: weight)),
        );

-    final hasOptional = item.batchNoCtrl.text.isNotEmpty ||
-        item.selectedOriginId != null ||
+    final hasOptional = item.selectedOriginId != null ||
        item.selectedShelfLifeId != null ||
        item.selectedStorageId != null ||
        item.selectedDescriptionDocId != null;
@@ -1071,10 +1049,15 @@ class _StockInFormScreenState extends ConsumerState<StockInFormScreen> {
                      padding: const EdgeInsets.all(4),
                      child: _specField(item))),
              Expanded(
-                  flex: 24,
+                  flex: 14,
                  child: Padding(
                      padding: const EdgeInsets.all(4),
                      child: _dateField(item))),
+              Expanded(
+                  flex: 12,
+                  child: Padding(
+                      padding: const EdgeInsets.all(4),
+                      child: _batchField(item))),
              Expanded(
                  flex: 10,
                  child: Padding(
@@ -1092,7 +1075,7 @@ class _StockInFormScreenState extends ConsumerState<StockInFormScreen> {
              SizedBox(
                width: 32,
                child: Tooltip(
-                  message: item.expanded ? '收起选填' : '展开选填（批次/产地/保质期等）',
+                  message: item.expanded ? '收起选填' : '展开选填（产地/保质期等）',
                  child: IconButton(
                    icon: Icon(
                      item.expanded ? Icons.expand_less : Icons.expand_more,
@@ -1152,8 +1135,6 @@ class _StockInFormScreenState extends ConsumerState<StockInFormScreen> {
            spacing: 16,
            runSpacing: 12,
            children: [
-              _OptionalField(
-                  label: '批次号', width: 180, child: _batchField(item)),
              _OptionalField(
                  label: '产地', width: 180, child: _originField(item)),
              _OptionalField(
@@ -1191,6 +1172,7 @@ class _StockInFormScreenState extends ConsumerState<StockInFormScreen> {
        MobileCardField('系列', null, valueWidget: _seriesField(item)),
        MobileCardField('规格', null, valueWidget: _specField(item)),
        MobileCardField('生产日期', null, valueWidget: _dateField(item)),
+        MobileCardField('批次号', null, valueWidget: _batchField(item)),
        MobileCardField('数量', null, valueWidget: _qtyField(item)),
        MobileCardField('单价', null, valueWidget: _priceField(item)),
        MobileCardField('金额', '¥${amount.toStringAsFixed(2)}'),
@@ -1199,15 +1181,13 @@ class _StockInFormScreenState extends ConsumerState<StockInFormScreen> {
              onPressed: () => setState(() => item.expanded = !item.expanded),
              icon: Icon(item.expanded ? Icons.expand_less : Icons.expand_more,
                  size: 16),
-              label: Text(item.expanded ? '收起选填项' : '展开选填项（批次/产地/保质期…）'),
+              label: Text(item.expanded ? '收起选填项' : '展开选填项（产地/保质期…）'),
              style: TextButton.styleFrom(
                padding: EdgeInsets.zero,
                minimumSize: const Size(0, 32),
                foregroundColor: AppTheme.textSecondary,
              ),
            )),
-        if (item.expanded)
-          MobileCardField('批次号', null, valueWidget: _batchField(item)),
        if (item.expanded)
          MobileCardField('产地', null, valueWidget: _originField(item)),
        if (item.expanded)
@@ -25,6 +25,7 @@ import '../../providers/finance_provider.dart' show financeRepositoryProvider;
 import '../../providers/shop_provider.dart' show shopInfoProvider;
 import '../../widgets/write_guard.dart';
 import '../../widgets/order_row_actions.dart';
+import '../../core/auth/auth_state.dart' show isAdminProvider;

 class StockInListScreen extends ConsumerStatefulWidget {
  const StockInListScreen({super.key});
@@ -39,6 +40,7 @@ class _StockInListScreenState extends ConsumerState<StockInListScreen> {
  Set<String> _filterWarehouse = {};
  Set<String> _filterSupplier = {};
  Set<String>? _hiddenCols; // null = 尚未载入本地存档（回退到 minWidth 首次默认）
+  final _searchCtrl = TextEditingController();

  static const _screenId = 'stock_in_list';

@@ -48,8 +50,7 @@ class _StockInListScreenState extends ConsumerState<StockInListScreen> {
    ColDef('warehouse', '仓库'),
    ColDef('amount', '金额', minWidth: 800),
    ColDef('status', '状态'),
-    ColDef('date', '日期', minWidth: 900),
-    ColDef('reviewed_at', '入库时间', minWidth: 900),
+    ColDef('date', '入库时间', minWidth: 900),
    ColDef('operator', '入库员', minWidth: 1100),
    ColDef('reviewer', '审核员', minWidth: 1100),
    ColDef('actions', '操作', required: true),
@@ -61,8 +62,25 @@ class _StockInListScreenState extends ConsumerState<StockInListScreen> {
    ColumnPrefs.load(_screenId).then((saved) {
      if (saved != null && mounted) setState(() => _hiddenCols = saved);
    });
+    // 进入页面时把服务端状态过滤对齐到当前标签/下拉（provider 持久化，State 会重建）
+    WidgetsBinding.instance.addPostFrameCallback((_) {
+      if (!mounted) return;
+      final tab = ref.read(stockInTabProvider);
+      final want = tab == 1 ? 'pending,draft' : _statusFilter;
+      final notifier = ref.read(stockInListProvider.notifier);
+      if (notifier.currentStatus != want) notifier.setStatus(want);
+    });
  }

+  @override
+  void dispose() {
+    _searchCtrl.dispose();
+    super.dispose();
+  }
+
+  void _triggerSearch() =>
+      ref.read(stockInListProvider.notifier).setKeyword(_searchCtrl.text.trim());
+
  String? get _startDate => _dateRange != null
      ? '${_dateRange!.start.year}-${_dateRange!.start.month.toString().padLeft(2, '0')}-${_dateRange!.start.day.toString().padLeft(2, '0')}'
      : null;
@@ -89,7 +107,13 @@ class _StockInListScreenState extends ConsumerState<StockInListScreen> {
    return PageScaffold(
      title: '入库管理',
      initialTab: ref.read(stockInTabProvider),
-      onTabChanged: (i) => ref.read(stockInTabProvider.notifier).state = i,
+      onTabChanged: (i) {
+        ref.read(stockInTabProvider.notifier).state = i;
+        // 审核标签页按 pending+draft 服务端拉取；入库单页沿用下拉状态（'' 为全部）
+        ref
+            .read(stockInListProvider.notifier)
+            .setStatus(i == 1 ? 'pending,draft' : _statusFilter);
+      },
      tabs: const [
        Tab(text: '入库单'),
        Tab(text: '入库审核'),
@@ -124,15 +148,19 @@ class _StockInListScreenState extends ConsumerState<StockInListScreen> {
      ),
      data: (result) {
        final allOrders = result.data;
+        // 状态过滤已改为服务端驱动（setStatus）。这里仅按标签做轻量显示守卫，
+        // 避免共用 provider 在标签切换、refetch 在途时短暂闪现他状态数据。
        final List<StockInOrder> statusFiltered;
        if (filterStatus == 'pending') {
+          // 入库审核：服务端按 pending,draft 拉取
          statusFiltered = allOrders
              .where((o) => o.status == 'draft' || o.status == 'pending')
              .toList();
        } else if (filterStatus == 'exclude_pending') {
-          statusFiltered = allOrders
-              .where((o) => o.status != 'draft' && o.status != 'pending')
-              .toList();
+          // 入库单：服务端按下拉状态拉取；'全部状态' 显示全部（含未审核）
+          statusFiltered = _statusFilter.isEmpty
+              ? allOrders
+              : allOrders.where((o) => o.status == _statusFilter).toList();
        } else {
          statusFiltered = allOrders;
        }
@@ -242,12 +270,6 @@ class _StockInListScreenState extends ConsumerState<StockInListScreen> {
          return DataCell(StatusBadge(_apiStatusToEnum(o.status)));
        case 'date':
          return DataCell(Text(o.orderDate?.substring(0, 10) ?? '-'));
-        case 'reviewed_at':
-          return DataCell(Text(o.reviewedAt != null
-              ? o.reviewedAt!.length >= 16
-                  ? o.reviewedAt!.substring(0, 16)
-                  : o.reviewedAt!.substring(0, 10)
-              : '-'));
        case 'operator':
          return DataCell(Text(o.operatorName ?? '-',
              style: const TextStyle(fontSize: 13)));
@@ -334,6 +356,27 @@ class _StockInListScreenState extends ConsumerState<StockInListScreen> {
              )
            : null;

+        final searchField = TextField(
+          controller: _searchCtrl,
+          decoration: InputDecoration(
+            hintText: '单号/往来单位，回车搜索',
+            prefixIcon: const Icon(Icons.search, size: 16),
+            hintStyle: const TextStyle(fontSize: 12),
+            suffixIcon: IconButton(
+              icon: const Icon(Icons.search, size: 16),
+              tooltip: '搜索',
+              onPressed: _triggerSearch,
+            ),
+          ),
+          onSubmitted: (_) => _triggerSearch(),
+        );
+
+        final refreshBtn = IconButton(
+          tooltip: '刷新',
+          icon: const Icon(Icons.refresh, size: 20),
+          onPressed: () => ref.read(stockInListProvider.notifier).reload(),
+        );
+
        final dateBtn = OutlinedButton.icon(
          onPressed: _pickDateRange,
          icon: const Icon(Icons.date_range, size: 16),
@@ -356,28 +399,36 @@ class _StockInListScreenState extends ConsumerState<StockInListScreen> {
            : null;

        if (isMobile) {
-          return Wrap(
-            spacing: 8,
-            runSpacing: 4,
-            crossAxisAlignment: WrapCrossAlignment.center,
+          return Column(
+            mainAxisSize: MainAxisSize.min,
            children: [
-              if (newBtn != null) newBtn,
-              if (statusFilter != null) statusFilter,
-              dateBtn,
-              if (clearDate != null) clearDate,
-              IconButton(
-                tooltip: '导出',
-                icon: const Icon(Icons.download, size: 20),
-                onPressed: doExport,
-              ),
-              ColumnToggleButton(
-                columns: _colDefs,
-                hidden: hidden,
-                compact: true,
-                onChanged: (v) {
-                  setState(() => _hiddenCols = v);
-                  ColumnPrefs.save(_screenId, v);
-                },
+              searchField,
+              const SizedBox(height: 8),
+              Wrap(
+                spacing: 8,
+                runSpacing: 4,
+                crossAxisAlignment: WrapCrossAlignment.center,
+                children: [
+                  if (newBtn != null) newBtn,
+                  if (statusFilter != null) statusFilter,
+                  dateBtn,
+                  if (clearDate != null) clearDate,
+                  IconButton(
+                    tooltip: '导出',
+                    icon: const Icon(Icons.download, size: 20),
+                    onPressed: doExport,
+                  ),
+                  ColumnToggleButton(
+                    columns: _colDefs,
+                    hidden: hidden,
+                    compact: true,
+                    onChanged: (v) {
+                      setState(() => _hiddenCols = v);
+                      ColumnPrefs.save(_screenId, v);
+                    },
+                  ),
+                  refreshBtn,
+                ],
              ),
            ],
          );
@@ -385,6 +436,8 @@ class _StockInListScreenState extends ConsumerState<StockInListScreen> {

        return Row(
          children: [
+            SizedBox(width: 220, child: searchField),
+            const SizedBox(width: 12),
            if (newBtn != null) newBtn,
            const Spacer(),
            if (statusFilter != null) ...[
@@ -411,6 +464,7 @@ class _StockInListScreenState extends ConsumerState<StockInListScreen> {
                ColumnPrefs.save(_screenId, v);
              },
            ),
+            refreshBtn,
          ],
        );
      }),
@@ -425,6 +479,7 @@ class _StockInListScreenState extends ConsumerState<StockInListScreen> {
  List<Widget> _orderActions(BuildContext context, StockInOrder o) {
    return buildOrderRowActions(
      readonly: WriteGuard.isReadonly(ref),
+      isAdmin: ref.watch(isAdminProvider),
      status: o.status,
      orderId: o.id,
      onDetail: () => _showDetail(context, o.id),
@@ -472,6 +527,7 @@ class _StockInListScreenState extends ConsumerState<StockInListScreen> {
      onSubmit: () => _confirmSubmit(context, o),
      onApprove: () => _confirmApprove(context, o),
      onReject: () => _confirmReject(context, o),
+      onWithdraw: () => _confirmWithdraw(context, o),
    );
  }

@@ -490,7 +546,7 @@ class _StockInListScreenState extends ConsumerState<StockInListScreen> {
            o.totalAmount != null
                ? '¥${o.totalAmount!.toStringAsFixed(2)}'
                : '-'),
-        MobileCardField('日期', o.orderDate?.substring(0, 10) ?? '-'),
+        MobileCardField('入库时间', o.orderDate?.substring(0, 10) ?? '-'),
      ],
      actions: _orderActions(context, o),
    );
@@ -701,6 +757,43 @@ class _StockInListScreenState extends ConsumerState<StockInListScreen> {
      }
    }
  }
+
+  Future<void> _confirmWithdraw(BuildContext context, StockInOrder o) async {
+    final confirmed = await showDialog<bool>(
+      context: context,
+      builder: (ctx) => AlertDialog(
+        title: const Text('撤回确认'),
+        content: Text('确认撤回入库单「${o.orderNo}」？撤回后单据回到草稿，可修改后重新提交审核。'),
+        actions: [
+          TextButton(
+              onPressed: () => Navigator.of(ctx).pop(false),
+              child: const Text('取消')),
+          ElevatedButton(
+            onPressed: () => Navigator.of(ctx).pop(true),
+            style: ElevatedButton.styleFrom(
+                backgroundColor: AppTheme.accent,
+                foregroundColor: Colors.white),
+            child: const Text('撤回'),
+          ),
+        ],
+      ),
+    );
+    if (confirmed == true && mounted) {
+      try {
+        await ref.read(stockInListProvider.notifier).withdrawOrder(o.id);
+        if (mounted) {
+          ScaffoldMessenger.of(context).showSnackBar(const SnackBar(
+              content: Text('已撤回为草稿'), backgroundColor: AppTheme.accent));
+        }
+      } catch (e) {
+        if (mounted) {
+          ScaffoldMessenger.of(context).showSnackBar(SnackBar(
+              content: Text('撤回失败：$e'),
+              backgroundColor: AppTheme.danger));
+        }
+      }
+    }
+  }
 }

 // Detail dialog — fetches full order with items
@@ -1041,6 +1134,7 @@ class _StatusFilterDropdown extends StatelessWidget {
          items: [
            const DropdownMenuItem(value: '', child: Text('全部状态', style: TextStyle(fontSize: 13))),
            const DropdownMenuItem(value: 'draft', child: Text('草稿', style: TextStyle(fontSize: 13))),
+            const DropdownMenuItem(value: 'pending', child: Text('待审核', style: TextStyle(fontSize: 13))),
            const DropdownMenuItem(value: 'approved', child: Text('已审核', style: TextStyle(fontSize: 13))),
            const DropdownMenuItem(value: 'rejected', child: Text('已拒绝', style: TextStyle(fontSize: 13))),
          ],
@@ -1,3 +1,5 @@
+import 'dart:async';
+
 import 'package:flutter/material.dart';
 import 'package:flutter/services.dart';
 import 'package:flutter_riverpod/flutter_riverpod.dart';
@@ -7,6 +9,7 @@ import '../../core/theme/app_theme.dart';
 import '../../core/auth/auth_state.dart';
 import '../../core/utils/print_util.dart';
 import '../../core/utils/date_util.dart';
+import '../../models/inventory.dart';
 import '../../models/stock_out.dart';
 import '../../widgets/date_picker_field.dart';
 import '../../widgets/searchable_option_field.dart';
@@ -39,6 +42,39 @@ class _PickerItem {
  });
 }

+/// 把库存行按 product 聚合为选择器条目（同一 product 的多行数量相加）。
+List<_PickerItem> _aggregatePickerItems(List<Inventory> rows) {
+  final Map<int, _PickerItem> map = {};
+  for (final inv in rows.where((inv) => inv.productId != null)) {
+    final pid = inv.productId!;
+    final existing = map[pid];
+    if (existing != null) {
+      map[pid] = _PickerItem(
+        productId: pid,
+        productCode: existing.productCode,
+        productName: existing.productName,
+        series: existing.series,
+        spec: existing.spec,
+        unit: existing.unit,
+        unitPrice: existing.unitPrice ?? inv.unitPrice,
+        availableQty: existing.availableQty + inv.quantity,
+      );
+    } else {
+      map[pid] = _PickerItem(
+        productId: pid,
+        productCode: inv.productCode,
+        productName: inv.productName,
+        series: inv.series,
+        spec: inv.spec,
+        unit: inv.unit,
+        unitPrice: inv.unitPrice,
+        availableQty: inv.quantity,
+      );
+    }
+  }
+  return map.values.toList();
+}
+
 class _ItemRow {
  int? productId;
  final String productCode;
@@ -158,36 +194,8 @@ class _StockOutFormScreenState extends ConsumerState<StockOutFormScreen> {
          .listInventory(
              warehouseId: warehouseId,
              pageSize: AppConstants.stockOutPickerPageSize);
-      final Map<int, _PickerItem> productMap = {};
-      for (final inv in result.data.where((inv) => inv.productId != null)) {
-        final pid = inv.productId!;
-        if (productMap.containsKey(pid)) {
-          final existing = productMap[pid]!;
-          productMap[pid] = _PickerItem(
-            productId: pid,
-            productCode: existing.productCode,
-            productName: existing.productName,
-            series: existing.series,
-            spec: existing.spec,
-            unit: existing.unit,
-            unitPrice: existing.unitPrice ?? inv.unitPrice,
-            availableQty: existing.availableQty + inv.quantity,
-          );
-        } else {
-          productMap[pid] = _PickerItem(
-            productId: pid,
-            productCode: inv.productCode,
-            productName: inv.productName,
-            series: inv.series,
-            spec: inv.spec,
-            unit: inv.unit,
-            unitPrice: inv.unitPrice,
-            availableQty: inv.quantity,
-          );
-        }
-      }
      setState(() {
-        _inventoryPickerItems = productMap.values.toList();
+        _inventoryPickerItems = _aggregatePickerItems(result.data);
        _inventoryMap = {
          for (final item in _inventoryPickerItems)
            item.productId: item.availableQty
@@ -206,7 +214,10 @@ class _StockOutFormScreenState extends ConsumerState<StockOutFormScreen> {
    }
    final selected = await showDialog<List<_PickerItem>>(
      context: context,
-      builder: (_) => _InventoryPickerDialog(items: _inventoryPickerItems),
+      builder: (_) => _InventoryPickerDialog(
+        items: _inventoryPickerItems,
+        warehouseId: _warehouseId,
+      ),
    );
    if (selected == null || selected.isEmpty) return;
    setState(() {
@@ -532,6 +543,20 @@ class _StockOutFormScreenState extends ConsumerState<StockOutFormScreen> {
                                          selectedId: _partnerId,
                                          hint: '请选择客户',
                                          dialogTitle: '选择客户',
+                                          onSearch: (kw) async {
+                                            final res = await ref
+                                                .read(partnerRepositoryProvider)
+                                                .list(
+                                                    type: 'customer',
+                                                    keyword: kw,
+                                                    pageSize: 50);
+                                            return res.data
+                                                .map((p) => OptionItem(
+                                                    id: p.id,
+                                                    name: p.name,
+                                                    code: p.code))
+                                                .toList();
+                                          },
                                          onChanged: (v) =>
                                              setState(() => _partnerId = v),
                                        ),
@@ -873,39 +898,67 @@ class _FormField extends StatelessWidget {
  }
 }

-class _InventoryPickerDialog extends StatefulWidget {
+class _InventoryPickerDialog extends ConsumerStatefulWidget {
  final List<_PickerItem> items;
-  const _InventoryPickerDialog({required this.items});
+  final int? warehouseId;
+  const _InventoryPickerDialog({required this.items, this.warehouseId});

  @override
-  State<_InventoryPickerDialog> createState() => _InventoryPickerDialogState();
+  ConsumerState<_InventoryPickerDialog> createState() =>
+      _InventoryPickerDialogState();
 }

-class _InventoryPickerDialogState extends State<_InventoryPickerDialog> {
+class _InventoryPickerDialogState
+    extends ConsumerState<_InventoryPickerDialog> {
  final _searchCtrl = TextEditingController();
  String _search = '';
  final Set<int> _selected = {};
+  // 服务端搜索结果（替代一次性拉全部本地过滤）；初始用调用方已加载的首屏
+  late List<_PickerItem> _results = widget.items;
+  // 已见过的条目（跨多次搜索），用于确认时按 productId 还原所选
+  late final Map<int, _PickerItem> _known = {
+    for (final it in widget.items) it.productId: it
+  };
+  bool _loading = false;
+  Timer? _debounce;

  @override
  void dispose() {
+    _debounce?.cancel();
    _searchCtrl.dispose();
    super.dispose();
  }

-  List<_PickerItem> get _filtered {
-    if (_search.isEmpty) return widget.items;
-    final q = _search.toLowerCase();
-    return widget.items
-        .where((item) =>
-            item.productName.toLowerCase().contains(q) ||
-            item.productCode.toLowerCase().contains(q) ||
-            item.series.toLowerCase().contains(q))
-        .toList();
+  void _onSearchChanged(String v) {
+    setState(() => _search = v);
+    _debounce?.cancel();
+    _debounce = Timer(const Duration(milliseconds: 300), _fetch);
+  }
+
+  Future<void> _fetch() async {
+    setState(() => _loading = true);
+    try {
+      final kw = _search.trim();
+      final result = await ref.read(inventoryRepositoryProvider).listInventory(
+            warehouseId: widget.warehouseId,
+            keyword: kw.isEmpty ? null : kw,
+            pageSize: AppConstants.stockOutPickerPageSize,
+          );
+      final items = _aggregatePickerItems(result.data);
+      for (final it in items) {
+        _known[it.productId] = it;
+      }
+      if (mounted) setState(() => _results = items);
+    } catch (_) {
+      // 忽略：保留上次结果
+    } finally {
+      if (mounted) setState(() => _loading = false);
+    }
  }

  @override
  Widget build(BuildContext context) {
-    final filtered = _filtered;
+    final filtered = _results;
    final allSelected = filtered.isNotEmpty &&
        filtered.every((e) => _selected.contains(e.productId));

@@ -945,14 +998,24 @@ class _InventoryPickerDialogState extends State<_InventoryPickerDialog> {
              padding: const EdgeInsets.symmetric(horizontal: 16, vertical: 10),
              child: TextField(
                controller: _searchCtrl,
-                decoration: const InputDecoration(
+                decoration: InputDecoration(
                  hintText: '搜索商品编码、名称或系列',
-                  prefixIcon: Icon(Icons.search, size: 18),
+                  prefixIcon: const Icon(Icons.search, size: 18),
+                  suffixIcon: _loading
+                      ? const Padding(
+                          padding: EdgeInsets.all(12),
+                          child: SizedBox(
+                            width: 16,
+                            height: 16,
+                            child: CircularProgressIndicator(strokeWidth: 2),
+                          ),
+                        )
+                      : null,
                  isDense: true,
                  contentPadding:
-                      EdgeInsets.symmetric(horizontal: 12, vertical: 10),
+                      const EdgeInsets.symmetric(horizontal: 12, vertical: 10),
                ),
-                onChanged: (v) => setState(() => _search = v),
+                onChanged: _onSearchChanged,
              ),
            ),
            // Table header
@@ -1068,9 +1131,9 @@ class _InventoryPickerDialogState extends State<_InventoryPickerDialog> {
                    onPressed: _selected.isEmpty
                        ? null
                        : () {
-                            final result = widget.items
-                                .where((item) =>
-                                    _selected.contains(item.productId))
+                            final result = _selected
+                                .map((id) => _known[id])
+                                .whereType<_PickerItem>()
                                .toList();
                            Navigator.pop(context, result);
                          },
@@ -23,6 +23,7 @@ import '../../providers/product_provider.dart';
 import '../../providers/finance_provider.dart' show financeRepositoryProvider;
 import '../../widgets/write_guard.dart';
 import '../../widgets/order_row_actions.dart';
+import '../../core/auth/auth_state.dart' show isAdminProvider;

 class StockOutListScreen extends ConsumerStatefulWidget {
  const StockOutListScreen({super.key});
@@ -38,6 +39,7 @@ class _StockOutListScreenState extends ConsumerState<StockOutListScreen> {
  Set<String> _filterWarehouse = {};
  Set<String> _filterCustomer = {};
  Set<String>? _hiddenCols; // null = 尚未载入本地存档（回退到 minWidth 首次默认）
+  final _searchCtrl = TextEditingController();

  static const _screenId = 'stock_out_list';

@@ -47,6 +49,14 @@ class _StockOutListScreenState extends ConsumerState<StockOutListScreen> {
    ColumnPrefs.load(_screenId).then((saved) {
      if (saved != null && mounted) setState(() => _hiddenCols = saved);
    });
+    // 进入页面时把服务端状态过滤对齐到当前标签/下拉（provider 持久化，State 会重建）
+    WidgetsBinding.instance.addPostFrameCallback((_) {
+      if (!mounted) return;
+      final tab = ref.read(stockOutTabProvider);
+      final want = tab == 1 ? 'pending,draft' : _statusFilter;
+      final notifier = ref.read(stockOutListProvider.notifier);
+      if (notifier.currentStatus != want) notifier.setStatus(want);
+    });
  }

  static const _colDefs = [
@@ -55,14 +65,23 @@ class _StockOutListScreenState extends ConsumerState<StockOutListScreen> {
    ColDef('warehouse', '仓库'),
    ColDef('amount', '金额', minWidth: 800),
    ColDef('status', '状态'),
-    ColDef('date', '日期', minWidth: 900),
-    ColDef('reviewed_at', '出库时间', minWidth: 900),
+    ColDef('date', '出库时间', minWidth: 900),
    ColDef('created_at', '创建时间', minWidth: 900),
    ColDef('operator', '出库员', minWidth: 1100),
    ColDef('reviewer', '审核员', minWidth: 1100),
    ColDef('actions', '操作', required: true),
  ];

+  @override
+  void dispose() {
+    _searchCtrl.dispose();
+    super.dispose();
+  }
+
+  void _triggerSearch() => ref
+      .read(stockOutListProvider.notifier)
+      .setKeyword(_searchCtrl.text.trim());
+
  String? get _startDate => _dateRange != null
      ? '${_dateRange!.start.year}-${_dateRange!.start.month.toString().padLeft(2, '0')}-${_dateRange!.start.day.toString().padLeft(2, '0')}'
      : null;
@@ -89,7 +108,13 @@ class _StockOutListScreenState extends ConsumerState<StockOutListScreen> {
    return PageScaffold(
      title: '出库管理',
      initialTab: ref.read(stockOutTabProvider),
-      onTabChanged: (i) => ref.read(stockOutTabProvider.notifier).state = i,
+      onTabChanged: (i) {
+        ref.read(stockOutTabProvider.notifier).state = i;
+        // 审核标签页按 pending+draft 服务端拉取；出库单页沿用下拉状态（'' 为全部）
+        ref
+            .read(stockOutListProvider.notifier)
+            .setStatus(i == 1 ? 'pending,draft' : _statusFilter);
+      },
      tabs: const [
        Tab(text: '出库单'),
        Tab(text: '出库审核'),
@@ -124,15 +149,19 @@ class _StockOutListScreenState extends ConsumerState<StockOutListScreen> {
      ),
      data: (result) {
        final allOrders = result.data;
+        // 状态过滤已改为服务端驱动（setStatus）。这里仅按标签做轻量显示守卫，
+        // 避免共用 provider 在标签切换、refetch 在途时短暂闪现他状态数据。
        final List<StockOutOrder> statusFiltered;
        if (filterStatus == 'pending') {
+          // 出库审核：服务端按 pending,draft 拉取
          statusFiltered = allOrders
              .where((o) => o.status == 'draft' || o.status == 'pending')
              .toList();
        } else if (filterStatus == 'exclude_pending') {
-          statusFiltered = allOrders
-              .where((o) => o.status != 'draft' && o.status != 'pending')
-              .toList();
+          // 出库单：服务端按下拉状态拉取；'全部状态' 显示全部（含未审核）
+          statusFiltered = _statusFilter.isEmpty
+              ? allOrders
+              : allOrders.where((o) => o.status == _statusFilter).toList();
        } else {
          statusFiltered = allOrders;
        }
@@ -242,12 +271,6 @@ class _StockOutListScreenState extends ConsumerState<StockOutListScreen> {
          return DataCell(StatusBadge(_apiStatusToEnum(o.status)));
        case 'date':
          return DataCell(Text(o.orderDate?.substring(0, 10) ?? '-'));
-        case 'reviewed_at':
-          return DataCell(Text(o.reviewedAt != null
-              ? o.reviewedAt!.length >= 16
-                  ? o.reviewedAt!.substring(0, 16)
-                  : o.reviewedAt!.substring(0, 10)
-              : '-'));
        case 'created_at':
          return DataCell(Text(o.createdAt != null
              ? o.createdAt!.length >= 16
@@ -340,6 +363,27 @@ class _StockOutListScreenState extends ConsumerState<StockOutListScreen> {
              )
            : null;

+        final searchField = TextField(
+          controller: _searchCtrl,
+          decoration: InputDecoration(
+            hintText: '单号/往来单位，回车搜索',
+            prefixIcon: const Icon(Icons.search, size: 16),
+            hintStyle: const TextStyle(fontSize: 12),
+            suffixIcon: IconButton(
+              icon: const Icon(Icons.search, size: 16),
+              tooltip: '搜索',
+              onPressed: _triggerSearch,
+            ),
+          ),
+          onSubmitted: (_) => _triggerSearch(),
+        );
+
+        final refreshBtn = IconButton(
+          tooltip: '刷新',
+          icon: const Icon(Icons.refresh, size: 20),
+          onPressed: () => ref.read(stockOutListProvider.notifier).reload(),
+        );
+
        final dateBtn = OutlinedButton.icon(
          onPressed: _pickDateRange,
          icon: const Icon(Icons.date_range, size: 16),
@@ -362,28 +406,36 @@ class _StockOutListScreenState extends ConsumerState<StockOutListScreen> {
            : null;

        if (isMobile) {
-          return Wrap(
-            spacing: 8,
-            runSpacing: 4,
-            crossAxisAlignment: WrapCrossAlignment.center,
+          return Column(
+            mainAxisSize: MainAxisSize.min,
            children: [
-              if (newBtn != null) newBtn,
-              if (statusFilter != null) statusFilter,
-              dateBtn,
-              if (clearDate != null) clearDate,
-              IconButton(
-                tooltip: '导出',
-                icon: const Icon(Icons.download, size: 20),
-                onPressed: doExport,
-              ),
-              ColumnToggleButton(
-                columns: _colDefs,
-                hidden: hidden,
-                compact: true,
-                onChanged: (v) {
-                  setState(() => _hiddenCols = v);
-                  ColumnPrefs.save(_screenId, v);
-                },
+              searchField,
+              const SizedBox(height: 8),
+              Wrap(
+                spacing: 8,
+                runSpacing: 4,
+                crossAxisAlignment: WrapCrossAlignment.center,
+                children: [
+                  if (newBtn != null) newBtn,
+                  if (statusFilter != null) statusFilter,
+                  dateBtn,
+                  if (clearDate != null) clearDate,
+                  IconButton(
+                    tooltip: '导出',
+                    icon: const Icon(Icons.download, size: 20),
+                    onPressed: doExport,
+                  ),
+                  ColumnToggleButton(
+                    columns: _colDefs,
+                    hidden: hidden,
+                    compact: true,
+                    onChanged: (v) {
+                      setState(() => _hiddenCols = v);
+                      ColumnPrefs.save(_screenId, v);
+                    },
+                  ),
+                  refreshBtn,
+                ],
              ),
            ],
          );
@@ -391,6 +443,8 @@ class _StockOutListScreenState extends ConsumerState<StockOutListScreen> {

        return Row(
          children: [
+            SizedBox(width: 220, child: searchField),
+            const SizedBox(width: 12),
            if (newBtn != null) newBtn,
            const Spacer(),
            if (statusFilter != null) ...[
@@ -417,6 +471,7 @@ class _StockOutListScreenState extends ConsumerState<StockOutListScreen> {
                ColumnPrefs.save(_screenId, v);
              },
            ),
+            refreshBtn,
          ],
        );
      }),
@@ -430,6 +485,7 @@ class _StockOutListScreenState extends ConsumerState<StockOutListScreen> {
  List<Widget> _orderActions(BuildContext context, StockOutOrder o) {
    return buildOrderRowActions(
      readonly: WriteGuard.isReadonly(ref),
+      isAdmin: ref.watch(isAdminProvider),
      status: o.status,
      orderId: o.id,
      onDetail: () => _showDetail(context, o.id),
@@ -445,6 +501,7 @@ class _StockOutListScreenState extends ConsumerState<StockOutListScreen> {
      onSubmit: () => _confirmSubmit(context, o),
      onApprove: () => _confirmApprove(context, o),
      onReject: () => _confirmReject(context, o),
+      onWithdraw: () => _confirmWithdraw(context, o),
    );
  }

@@ -463,7 +520,7 @@ class _StockOutListScreenState extends ConsumerState<StockOutListScreen> {
            o.totalAmount != null
                ? '¥${o.totalAmount!.toStringAsFixed(2)}'
                : '-'),
-        MobileCardField('日期', o.orderDate?.substring(0, 10) ?? '-'),
+        MobileCardField('出库时间', o.orderDate?.substring(0, 10) ?? '-'),
      ],
      actions: _orderActions(context, o),
    );
@@ -678,6 +735,44 @@ class _StockOutListScreenState extends ConsumerState<StockOutListScreen> {
      }
    }
  }
+
+  Future<void> _confirmWithdraw(
+      BuildContext context, StockOutOrder o) async {
+    final confirmed = await showDialog<bool>(
+      context: context,
+      builder: (ctx) => AlertDialog(
+        title: const Text('撤回确认'),
+        content: Text('确认撤回出库单「${o.orderNo}」？撤回后单据回到草稿，可修改后重新提交审核。'),
+        actions: [
+          TextButton(
+              onPressed: () => Navigator.of(ctx).pop(false),
+              child: const Text('取消')),
+          ElevatedButton(
+            onPressed: () => Navigator.of(ctx).pop(true),
+            style: ElevatedButton.styleFrom(
+                backgroundColor: AppTheme.accent,
+                foregroundColor: Colors.white),
+            child: const Text('撤回'),
+          ),
+        ],
+      ),
+    );
+    if (confirmed == true && mounted) {
+      try {
+        await ref.read(stockOutListProvider.notifier).withdrawOrder(o.id);
+        if (mounted) {
+          ScaffoldMessenger.of(context).showSnackBar(const SnackBar(
+              content: Text('已撤回为草稿'), backgroundColor: AppTheme.accent));
+        }
+      } catch (e) {
+        if (mounted) {
+          ScaffoldMessenger.of(context).showSnackBar(SnackBar(
+              content: Text('撤回失败：$e'),
+              backgroundColor: AppTheme.danger));
+        }
+      }
+    }
+  }
 }

 // Detail dialog — fetches full order with items
@@ -950,6 +1045,7 @@ class _StatusFilterDropdown extends StatelessWidget {
          items: const [
            DropdownMenuItem(value: '', child: Text('全部状态', style: TextStyle(fontSize: 13))),
            DropdownMenuItem(value: 'draft', child: Text('草稿', style: TextStyle(fontSize: 13))),
+            DropdownMenuItem(value: 'pending', child: Text('待审核', style: TextStyle(fontSize: 13))),
            DropdownMenuItem(value: 'approved', child: Text('已审核', style: TextStyle(fontSize: 13))),
            DropdownMenuItem(value: 'rejected', child: Text('已拒绝', style: TextStyle(fontSize: 13))),
          ],
@@ -2,12 +2,12 @@ import 'package:flutter/material.dart';
 import '../core/theme/app_theme.dart';
 import '../core/utils/date_util.dart';

-/// 年/月/日 三个可编辑下拉框的日期选择组件，替代原生 showDatePicker。
+/// 可键入日期框 + 日历图标（替代旧的「年/月/日」三下拉）。
 ///
-/// - 每个下拉是 Material 3 `DropdownMenu`：点开可选，键入数字即过滤定位
-///   （年/月/日均为有界域，条目覆盖全范围，等价于「手动输入数字」）。
-/// - 改月/年时把超出当月的「日」自动 clamp 回当月最大值。
-/// - 值以 `yyyy-MM-dd` 字符串进出（[value] / [onChanged]）；三者未填齐时回调 null。
+/// - **直接键入**：支持「2024」「2024-5」「2024-5-12」「20240512」等，归一为 `yyyy-MM-dd`，
+///   缺的月/日补 `01`（老酒只知道年份，填 2024 即 2024-01-01）。失焦时把显示归一化。
+/// - **日历图标**：弹 Material `showDatePicker`（input 模式可直接键入年份，选老年份方便）。
+/// - 值以 `yyyy-MM-dd` 字符串进出（[value] / [onChanged]）；无有效年时回调 null。
 class DatePickerField extends StatefulWidget {
  final String? value; // yyyy-MM-dd
  final ValueChanged<String?> onChanged;
@@ -27,151 +27,130 @@ class DatePickerField extends StatefulWidget {
 }

 class _DatePickerFieldState extends State<DatePickerField> {
-  int? _year;
-  int? _month;
-  int? _day;
+  late final TextEditingController _ctrl;
+  final FocusNode _focus = FocusNode();

  @override
  void initState() {
    super.initState();
-    _parse(widget.value);
+    _ctrl = TextEditingController(text: widget.value ?? '');
+    _focus.addListener(() {
+      // 失焦时把输入归一化显示（如 2024 → 2024-01-01）
+      if (!_focus.hasFocus) {
+        final n = _normalize(_ctrl.text);
+        if (n != null && n != _ctrl.text) {
+          _ctrl.text = n;
+        }
+      }
+    });
  }

  @override
  void didUpdateWidget(DatePickerField old) {
    super.didUpdateWidget(old);
-    if (old.value != widget.value) {
-      _parse(widget.value);
+    // 仅在无焦点（非用户正在输入）时同步外部值，避免回流打断输入
+    if (!_focus.hasFocus &&
+        old.value != widget.value &&
+        (widget.value ?? '') != _ctrl.text) {
+      _ctrl.text = widget.value ?? '';
    }
  }

-  void _parse(String? v) {
-    final d = parseYmd(v);
-    _year = d?.year;
-    _month = d?.month;
-    _day = d?.day;
+  @override
+  void dispose() {
+    _ctrl.dispose();
+    _focus.dispose();
+    super.dispose();
  }

-  int get _daysInMonth {
-    final y = _year ?? DateTime.now().year;
-    final m = _month ?? 1;
-    return DateTime(y, m + 1, 0).day; // 下月第 0 天 = 当月最后一天
-  }
-
-  String? get _composed => composeYmd(_year, _month, _day);
-
-  void _emit(FormFieldState<String> field) {
-    // 改月/年后把超界的日 clamp 回当月最大值（与 composeYmd 一致，State 同步显示）
-    if (_day != null && _day! > _daysInMonth) {
-      _day = _daysInMonth;
+  /// 归一用户输入为 `yyyy-MM-dd`（缺月/日补 01）；无有效年返回 null。
+  static String? _normalize(String raw) {
+    final s = raw.trim();
+    if (s.isEmpty) return null;
+    int? y, mo, d;
+    if (RegExp(r'^[0-9]+$').hasMatch(s)) {
+      // 纯数字串：yyyymmdd / yyyymm / yyyy
+      if (s.length >= 8) {
+        y = int.tryParse(s.substring(0, 4));
+        mo = int.tryParse(s.substring(4, 6));
+        d = int.tryParse(s.substring(6, 8));
+      } else if (s.length == 6) {
+        y = int.tryParse(s.substring(0, 4));
+        mo = int.tryParse(s.substring(4, 6));
+      } else {
+        y = int.tryParse(s);
+      }
+    } else {
+      final parts =
+          s.split(RegExp(r'[^0-9]+')).where((e) => e.isNotEmpty).toList();
+      if (parts.isNotEmpty) y = int.tryParse(parts[0]);
+      if (parts.length >= 2) mo = int.tryParse(parts[1]);
+      if (parts.length >= 3) d = int.tryParse(parts[2]);
+    }
+    if (y == null || y < 1900 || y > 2200) return null;
+    mo ??= 1;
+    d ??= 1;
+    if (mo < 1 || mo > 12) return null;
+    final maxDay = DateTime(y, mo + 1, 0).day;
+    if (d < 1) d = 1;
+    if (d > maxDay) d = maxDay;
+    return '${y.toString().padLeft(4, '0')}-'
+        '${mo.toString().padLeft(2, '0')}-'
+        '${d.toString().padLeft(2, '0')}';
+  }
+
+  Future<void> _pickFromCalendar(FormFieldState<String> field) async {
+    final init =
+        parseYmd(_normalize(_ctrl.text) ?? widget.value) ?? DateTime.now();
+    final picked = await showDatePicker(
+      context: context,
+      initialDate: init,
+      firstDate: DateTime(1900),
+      lastDate: DateTime(2200),
+      initialEntryMode: DatePickerEntryMode.input,
+    );
+    if (picked != null) {
+      final v = formatYmd(picked);
+      _ctrl.text = v;
+      field.didChange(v);
+      widget.onChanged(v);
    }
-    final v = _composed;
-    field.didChange(v);
-    widget.onChanged(v);
-    setState(() {});
  }

  @override
  Widget build(BuildContext context) {
-    final now = DateTime.now();
-    final years = [for (var y = now.year - 20; y <= now.year + 5; y++) y];
-    final months = [for (var m = 1; m <= 12; m++) m];
-    final days = [for (var d = 1; d <= _daysInMonth; d++) d];
-
-    // 每个下拉用 Expanded 撑满分得的宽度（expandedInsets:zero 让 DropdownMenu 填满父级），
-    // trailingIcon 用紧凑小箭头，避免默认大图标按钮挤掉数字（曾导致「2026」被裁成「007」）。
-    Widget menu({
-      required String label,
-      required int? value,
-      required List<int> items,
-      required ValueChanged<int?> onSel,
-      required FormFieldState<String> field,
-    }) {
-      return DropdownMenu<int>(
-        initialSelection: value,
-        label: Text(label, style: const TextStyle(fontSize: 11)),
-        enableFilter: true,
-        requestFocusOnTap: true,
-        textStyle: const TextStyle(fontSize: 13),
-        menuHeight: 280,
-        expandedInsets: EdgeInsets.zero,
-        trailingIcon: const Icon(Icons.arrow_drop_down, size: 18),
-        selectedTrailingIcon: const Icon(Icons.arrow_drop_up, size: 18),
-        inputDecorationTheme: const InputDecorationTheme(
-          isDense: true,
-          contentPadding: EdgeInsets.symmetric(horizontal: 6, vertical: 8),
-        ),
-        dropdownMenuEntries: [
-          for (final i in items) DropdownMenuEntry<int>(value: i, label: '$i'),
-        ],
-        onSelected: onSel,
-      );
-    }
-
    return FormField<String>(
      initialValue: widget.value,
      validator: widget.isRequired
-          ? (v) => (_composed == null ? '请选择日期' : null)
+          ? (_) => _normalize(_ctrl.text) == null ? '请输入日期' : null
          : null,
      builder: (field) {
-        return Column(
-          crossAxisAlignment: CrossAxisAlignment.start,
-          mainAxisSize: MainAxisSize.min,
-          children: [
-            Row(
-              children: [
-                Expanded(
-                  flex: 5,
-                  child: menu(
-                    label: '年',
-                    value: _year,
-                    items: years,
-                    field: field,
-                    onSel: (v) {
-                      _year = v;
-                      _emit(field);
-                    },
-                  ),
-                ),
-                const SizedBox(width: 6),
-                Expanded(
-                  flex: 4,
-                  child: menu(
-                    label: '月',
-                    value: _month,
-                    items: months,
-                    field: field,
-                    onSel: (v) {
-                      _month = v;
-                      _emit(field);
-                    },
-                  ),
-                ),
-                const SizedBox(width: 6),
-                Expanded(
-                  flex: 4,
-                  child: menu(
-                    label: '日',
-                    value: _day,
-                    items: days,
-                    field: field,
-                    onSel: (v) {
-                      _day = v;
-                      _emit(field);
-                    },
-                  ),
-                ),
-              ],
+        return TextField(
+          controller: _ctrl,
+          focusNode: _focus,
+          keyboardType: TextInputType.datetime,
+          style: const TextStyle(fontSize: 13),
+          decoration: InputDecoration(
+            isDense: true,
+            hintText: '年-月-日',
+            hintStyle: const TextStyle(fontSize: 12),
+            contentPadding:
+                const EdgeInsets.symmetric(horizontal: 8, vertical: 8),
+            errorText: field.errorText,
+            suffixIcon: IconButton(
+              icon: const Icon(Icons.calendar_today,
+                  size: 16, color: AppTheme.textSecondary),
+              padding: EdgeInsets.zero,
+              constraints: const BoxConstraints(minWidth: 34, minHeight: 34),
+              tooltip: '选择日期',
+              onPressed: () => _pickFromCalendar(field),
            ),
-            if (field.errorText != null)
-              Padding(
-                padding: const EdgeInsets.only(left: 12, top: 4),
-                child: Text(
-                  field.errorText!,
-                  style: const TextStyle(fontSize: 11, color: AppTheme.danger),
-                ),
-              ),
-          ],
+          ),
+          onChanged: (v) {
+            final n = _normalize(v);
+            field.didChange(n);
+            widget.onChanged(n);
+          },
        );
      },
    );
@@ -23,6 +23,8 @@ List<Widget> buildOrderRowActions({
  required VoidCallback onSubmit,
  required VoidCallback onApprove,
  required VoidCallback onReject,
+  required VoidCallback onWithdraw,
+  bool isAdmin = false,
  List<Widget> afterPrint = const [],
 }) {
  TextButton btn(String text, Color color, VoidCallback onPressed, {Key? key}) =>
@@ -49,6 +51,11 @@ List<Widget> buildOrderRowActions({
      WriteGuard(
          child: btn('拒绝', AppTheme.danger, onReject,
              key: Key('btn_reject_$orderId'))),
+      // 撤回（审核中→草稿）仅管理员可见
+      if (isAdmin)
+        WriteGuard(
+            child: btn('撤回', AppTheme.accent, onWithdraw,
+                key: Key('btn_withdraw_$orderId'))),
    ],
  ];
 }
@@ -1,3 +1,5 @@
+import 'dart:async';
+
 import '../core/utils/dialog_util.dart';
 import 'package:flutter/material.dart';
 import '../core/responsive/responsive.dart';
@@ -41,6 +43,9 @@ class SearchableOptionField extends StatelessWidget {
  /// 创建成功返回新选项 id（自动选中），失败/取消返回 null。为空则不显示新增入口。
  final Future<int?> Function(String keyword)? onCreate;

+  /// 可选：服务端搜索。提供时搜索框输入会 debounce 调它取结果（替代本地过滤）。
+  final Future<List<OptionItem>> Function(String keyword)? onSearch;
+
  const SearchableOptionField({
    super.key,
    required this.options,
@@ -51,6 +56,7 @@ class SearchableOptionField extends StatelessWidget {
    this.isRequired = false,
    this.isDense = true,
    this.onCreate,
+    this.onSearch,
  });

  String get _displayText {
@@ -66,6 +72,7 @@ class SearchableOptionField extends StatelessWidget {
        options: options,
        selectedId: selectedId,
        onCreate: onCreate,
+        onSearch: onSearch,
      ),
    );
    // result == -1 means "clear selection"
@@ -120,11 +127,13 @@ class _SearchDialog extends StatefulWidget {
  final List<OptionItem> options;
  final int? selectedId;
  final Future<int?> Function(String keyword)? onCreate;
+  final Future<List<OptionItem>> Function(String keyword)? onSearch;
  const _SearchDialog({
    required this.title,
    required this.options,
    this.selectedId,
    this.onCreate,
+    this.onSearch,
  });

  @override
@@ -135,9 +144,28 @@ class _SearchDialogState extends State<_SearchDialog> {
  final _ctrl = TextEditingController();
  String _keyword = '';
  bool _creating = false;
+  List<OptionItem>? _serverItems; // 服务端搜索结果（null=尚未搜索，用 widget.options）
+  bool _searching = false;
+  Timer? _debounce;
+
+  void _onSearchChanged(String v) {
+    setState(() => _keyword = v);
+    if (widget.onSearch == null) return;
+    _debounce?.cancel();
+    _debounce = Timer(const Duration(milliseconds: 300), () async {
+      setState(() => _searching = true);
+      try {
+        final res = await widget.onSearch!(v.trim());
+        if (mounted) setState(() => _serverItems = res);
+      } finally {
+        if (mounted) setState(() => _searching = false);
+      }
+    });
+  }

  @override
  void dispose() {
+    _debounce?.cancel();
    _ctrl.dispose();
    super.dispose();
  }
@@ -197,12 +225,14 @@ class _SearchDialogState extends State<_SearchDialog> {

  @override
  Widget build(BuildContext context) {
-    final filtered = _keyword.isEmpty
-        ? widget.options
-        : widget.options.where((o) => o.matches(_keyword)).toList();
+    final filtered = widget.onSearch != null
+        ? (_serverItems ?? widget.options)
+        : (_keyword.isEmpty
+            ? widget.options
+            : widget.options.where((o) => o.matches(_keyword)).toList());
    final kw = _keyword.trim();
    final hasExact =
-        widget.options.any((o) => o.name.toLowerCase() == kw.toLowerCase());
+        filtered.any((o) => o.name.toLowerCase() == kw.toLowerCase());
    final canCreate = widget.onCreate != null && kw.isNotEmpty && !hasExact;

    return AlertDialog(
@@ -216,12 +246,22 @@ class _SearchDialogState extends State<_SearchDialog> {
            TextField(
              controller: _ctrl,
              autofocus: true,
-              decoration: const InputDecoration(
+              decoration: InputDecoration(
                hintText: '搜索...',
-                prefixIcon: Icon(Icons.search, size: 18),
+                prefixIcon: const Icon(Icons.search, size: 18),
+                suffixIcon: _searching
+                    ? const Padding(
+                        padding: EdgeInsets.all(10),
+                        child: SizedBox(
+                          width: 16,
+                          height: 16,
+                          child: CircularProgressIndicator(strokeWidth: 2),
+                        ),
+                      )
+                    : null,
                isDense: true,
              ),
-              onChanged: (v) => setState(() => _keyword = v),
+              onChanged: _onSearchChanged,
            ),
            const SizedBox(height: 8),
            Expanded(
@@ -31,26 +31,47 @@ void main() {
  });

  group('DatePickerField', () {
-    testWidgets('渲染三个年/月/日下拉框', (tester) async {
+    testWidgets('渲染可键入框 + 日历图标', (tester) async {
      await tester.pumpWidget(MaterialApp(
        home: Scaffold(
          body: DatePickerField(value: '2026-06-19', onChanged: (_) {}),
        ),
      ));
      await tester.pumpAndSettle();
-      expect(find.byType(DropdownMenu<int>), findsNWidgets(3));
+      expect(find.byType(TextField), findsOneWidget);
+      expect(find.byIcon(Icons.calendar_today), findsOneWidget);
    });

-    testWidgets('初始值回显到三个下拉框', (tester) async {
+    testWidgets('初始值回显到输入框', (tester) async {
      await tester.pumpWidget(MaterialApp(
        home: Scaffold(
          body: DatePickerField(value: '2026-06-19', onChanged: (_) {}),
        ),
      ));
      await tester.pumpAndSettle();
-      expect(find.widgetWithText(DropdownMenu<int>, '2026'), findsOneWidget);
-      expect(find.widgetWithText(DropdownMenu<int>, '6'), findsOneWidget);
-      expect(find.widgetWithText(DropdownMenu<int>, '19'), findsOneWidget);
+      expect(find.text('2026-06-19'), findsOneWidget);
+    });
+
+    testWidgets('只输年份归一为 yyyy-01-01', (tester) async {
+      String? out;
+      await tester.pumpWidget(MaterialApp(
+        home: Scaffold(
+          body: DatePickerField(onChanged: (v) => out = v),
+        ),
+      ));
+      await tester.enterText(find.byType(TextField), '2024');
+      expect(out, '2024-01-01');
+    });
+
+    testWidgets('年月归一为 yyyy-MM-01', (tester) async {
+      String? out;
+      await tester.pumpWidget(MaterialApp(
+        home: Scaffold(
+          body: DatePickerField(onChanged: (v) => out = v),
+        ),
+      ));
+      await tester.enterText(find.byType(TextField), '2024-5');
+      expect(out, '2024-05-01');
    });
  });
 }
@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+# backup-db.sh — dump the production MySQL (jiu_db) from EC2 and keep a gzip
+# snapshot on the mac (host) runner's local disk (~/jiu-db-backups), retaining
+# the last 30 days. The DB password is read on EC2 from production.env's
+# DATABASE_DSN, so no DB-password secret is needed.
+#
+# Requires env (same as deploy-server): EC2_SSH_KEY, EC2_HOST, EC2_USER.
+set -euo pipefail
+
+# shellcheck source=scripts/ci/lib-forgejo.sh
+. "$(dirname "$0")/lib-forgejo.sh"
+
+BACKUP_DIR="${HOME}/jiu-db-backups"
+mkdir -p "${BACKUP_DIR}"
+FILENAME="jiu_db_$(date +%Y%m%d_%H%M%S).sql.gz"
+DEST="${BACKUP_DIR}/${FILENAME}"
+
+setup_ssh
+trap teardown_ssh EXIT
+
+echo "==> backup-db: dumping jiu_db from ${EC2_HOST}"
+# On EC2: parse the DSN password from production.env, then mysqldump the
+# container to stdout; stream back over ssh and gzip locally. The heredoc is
+# single-quoted, so it runs verbatim on EC2 (no local expansion). ${SSH} carries
+# no -t, keeping stdout a clean dump stream.
+${SSH} "${EC2_USER}@${EC2_HOST}" 'bash -s' <<'ENDSSH' | gzip > "${DEST}"
+set -euo pipefail
+PW=$(python3 -c 'import re;e=open("/opt/jiu/config/production.env").read();d=re.search(r"DATABASE_DSN=(.*)",e).group(1).strip().strip(chr(34)).strip(chr(39));print(re.match(r"[^:]+:([^@]+)@",d).group(1))')
+exec docker exec -e MYSQL_PWD="${PW}" jiu_mysql mysqldump -uroot --single-transaction --no-tablespaces jiu_db
+ENDSSH
+
+# Integrity + sanity + retention.
+gzip -t "${DEST}"
+SIZE=$(stat -f%z "${DEST}" 2>/dev/null || stat -c%s "${DEST}")
+if [ "${SIZE}" -lt 100000 ]; then
+  echo "==> backup-db: dump suspiciously small (${SIZE} bytes), aborting" >&2
+  rm -f "${DEST}"
+  exit 1
+fi
+find "${BACKUP_DIR}" -name '*.sql.gz' -mtime +30 -delete
+echo "==> backup-db: saved ${DEST} (${SIZE} bytes)"
Author	SHA1	Message	Date
wangjia	381588826c	chore: release client-v1.0.69 Deploy Client / build-client-web (push) Successful in 40s Details Deploy Client / build-macos (push) Successful in 2m13s Details Deploy Client / build-android (push) Successful in 1m6s Details Deploy Client / build-windows (push) Successful in 1m56s Details Deploy Client / build-ios (push) Successful in 2m41s Details Deploy Client / release-deploy-client (push) Successful in 1m24s Details Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YZ4DskSRKsSiheQonFtQvx	2026-06-21 19:09:47 +08:00
wangjia	7a78448a25	chore: release server-v1.0.72 Deploy Server / release-deploy-server (push) Successful in 56s Details Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YZ4DskSRKsSiheQonFtQvx	2026-06-21 19:09:30 +08:00
wangjia	fcc0fd988b	chore: release client-v1.0.68 Deploy Client / build-client-web (push) Successful in 38s Details Deploy Client / build-windows (push) Successful in 1m53s Details Deploy Client / build-macos (push) Successful in 2m7s Details Deploy Client / build-android (push) Successful in 59s Details Deploy Client / build-ios (push) Successful in 2m36s Details Deploy Client / release-deploy-client (push) Successful in 1m23s Details Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YZ4DskSRKsSiheQonFtQvx	2026-06-21 18:14:54 +08:00
wangjia	203cc7ce21	chore: release server-v1.0.71 Deploy Server / release-deploy-server (push) Successful in 56s Details Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YZ4DskSRKsSiheQonFtQvx	2026-06-21 18:14:27 +08:00
wangjia	6d70bd3e37	chore: release client-v1.0.67 Deploy Client / build-client-web (push) Successful in 41s Details Deploy Client / build-windows (push) Successful in 1m52s Details Deploy Client / build-macos (push) Successful in 2m33s Details Deploy Client / build-android (push) Successful in 1m6s Details Deploy Client / build-ios (push) Successful in 2m42s Details Deploy Client / release-deploy-client (push) Successful in 1m27s Details Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YZ4DskSRKsSiheQonFtQvx	2026-06-21 17:33:32 +08:00
wangjia	7b67466a3e	chore: release server-v1.0.70 Deploy Server / release-deploy-server (push) Successful in 56s Details Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YZ4DskSRKsSiheQonFtQvx	2026-06-21 17:32:55 +08:00
wangjia	182adca282	feat(client): 列表日期列改名入库/出库时间删审核时间列 + 日期控件改可键入框带日历 Deploy Client / build-client-web (push) Successful in 41s Details Deploy Client / build-windows (push) Successful in 2m34s Details Deploy Client / build-macos (push) Successful in 2m20s Details Deploy Client / build-android (push) Successful in 1m5s Details Deploy Client / build-ios (push) Successful in 2m44s Details Deploy Client / release-deploy-client (push) Successful in 1m26s Details Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YZ4DskSRKsSiheQonFtQvx	2026-06-21 16:39:32 +08:00
wangjia	025f3b7bbc	feat(client): 入库录入去除按名称复用，明细带产品信息由后端建独立产品 Deploy Client / build-client-web (push) Successful in 40s Details Deploy Client / build-macos (push) Successful in 2m14s Details Deploy Client / build-android (push) Successful in 1m31s Details Deploy Client / build-ios (push) Successful in 2m53s Details Deploy Client / build-windows (push) Has been cancelled Details Deploy Client / release-deploy-client (push) Has been cancelled Details Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YZ4DskSRKsSiheQonFtQvx	2026-06-21 16:30:37 +08:00
wangjia	c1febfffec	feat(backend): 入库每行新建独立产品发独立序列号(product 加生产日期/批次列) Deploy Server / release-deploy-server (push) Successful in 59s Details 入库 Create/Update 改为对每条明细新建独立 product（createIndependentProduct， nextProductCode 自增 + uk_shop_code 唯一约束兜底），回填 product_id；不再按名称复用。 product 表加 production_date/batch_no。向后兼容：保留明细/库存快照列。 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YZ4DskSRKsSiheQonFtQvx	2026-06-21 16:30:11 +08:00
wangjia	b42a70ff3b	ci: 修复数据库备份 workflow——改用 mac runner、EC2 端读密码、本机落盘、每日定时 backup.yml 原 runs-on ubuntu-latest 无对应 runner、落盘 NAS 路径在 mac runner 不存在，长期跑不起来。改为 runs-on mac + scripts/ci/backup-db.sh：复用 lib-forgejo 的 ssh 封装连 EC2，在 EC2 端从 production.env 读 DSN 密码 mysqldump（零额外 secret），流回本机 ~/jiu-db-backups gzip 落盘、保留 30 天、完整性校验，恢复每日 02:00 定时 + Telegram 成败通知。 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YZ4DskSRKsSiheQonFtQvx	2026-06-21 11:39:28 +08:00
wangjia	1a1d9aa15e	fix(backend): 商品编码改用最大序号生成不复用软删号 + 加 (shop_id,code) 唯一约束，根治重复编码 Deploy Server / release-deploy-server (push) Successful in 53s Details Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YZ4DskSRKsSiheQonFtQvx	2026-06-21 10:51:34 +08:00
wangjia	71ed15b40b	feat(client): 入库/出库加搜索框，入库/出库/库存加刷新按钮 Deploy Client / build-client-web (push) Successful in 42s Details Deploy Client / build-windows (push) Successful in 1m53s Details Deploy Client / build-macos (push) Successful in 2m10s Details Deploy Client / build-android (push) Successful in 1m15s Details Deploy Client / build-ios (push) Successful in 2m28s Details Deploy Client / release-deploy-client (push) Successful in 1m21s Details Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YZ4DskSRKsSiheQonFtQvx	2026-06-20 16:03:01 +08:00
wangjia	fb1e637ce4	fix(backend): 入库审核库存沿用明细真实快照名 + 库存列表过滤软删商品，修复历史导入占位顶替；入库/出库列表支持 keyword 搜索 Deploy Server / release-deploy-server (push) Successful in 53s Details Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YZ4DskSRKsSiheQonFtQvx	2026-06-20 16:02:02 +08:00
wangjia	7f3261a4a9	chore: release server-v1.0.66 Deploy Server / release-deploy-server (push) Successful in 51s Details fix(backend): 入库/出库列表按 order_date 倒序，历史导入单按业务日期归位 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-20 12:50:26 +08:00
wangjia	bcc02a2f09	chore: release client-v1.0.63 Deploy Client / build-client-web (push) Successful in 37s Details Deploy Client / build-windows (push) Successful in 2m32s Details Deploy Client / build-macos (push) Successful in 2m2s Details Deploy Client / build-android (push) Successful in 1m7s Details Deploy Client / build-ios (push) Successful in 2m31s Details Deploy Client / release-deploy-client (push) Successful in 1m33s Details fix(client): 入库/出库单状态筛选改服务端，全部状态含未审核 + 下拉补待审核 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-20 12:19:51 +08:00