chore(todo): 同步最新看板到 main(#24-#27 + #23→done)

主 checkout 停在陈旧 feat/private-dest-acl,其工作区 todo 看板反而领先 main
4 条(#24 UI连接态脱钩 / #25 私有服务在家直连 / #26 MySQL Promo 并发防线 /
#27 分支审核 Minor 硬化)且 #23 已推进到 done。工作区是 main 的干净超集
(main 无任何独有条目),取工作区版覆盖回 main,零丢失。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01A79VtQA1BwTuQN1ThpvYpo

todo/todo.json

@@ -1,9 +1,9 @@
 {
   "meta": {
     "title": "feature+windows — 项目 TODO",
-    "updated_at": "2026-07-22T16:59:57.735Z"
+    "updated_at": "2026-07-31T16:34:06.427Z"
   },
-  "seq": 23,
+  "seq": 27,
   "items": [
     {
       "id": 1,
@@ -368,11 +368,67 @@
       "tier": null,
       "tags": [],
       "owner": "agent",
-      "status": "doing",
+      "status": "done",
       "created_at": "2026-07-22T16:59:41.945Z",
       "done": false,
       "completed_at": null,
       "version": null
+    },
+    {
+      "id": 24,
+      "title": "客户端长时间运行后重开显示未连接(Offline)但隧道实际仍在连——UI连接态与真实VPN态脱钩。iOS实测:系统VPN设置里『已连接』(Pangolin加速/穿山甲激活),但app连接页显示Offline/Tap to connect。排查方向:app冷启/回前台时未从NETunnelProviderManager/系统VPN真实态同步隧道状态,statusStream初始态错判为off。四端可能共性(Dart侧状态流)。",
+      "desc": null,
+      "level": "mid",
+      "tier": null,
+      "tags": [],
+      "owner": "agent",
+      "status": "open",
+      "created_at": "2026-07-26T07:33:36.766Z",
+      "done": false,
+      "completed_at": null,
+      "version": null
+    },
+    {
+      "id": 25,
+      "title": "私有服务在家直连(不绕 Ali frps):nas/git/win/brain.51yanmei.com。方案=局域网分离解析 DNS(dnsmasq 或 AdGuard Home 挂 NAS,per-host 覆盖到 192.168.3.x + DHCP option6 下发)解决 VPN 关闭情形;VPN 开启情形走 B2 两旋钮(保留极小 dns-system 服务端清单,路由决策下沉用户规则)。需在家局域网环境操作。前置修复 reverse_mapping 已完成(commit e157b16)",
+      "desc": null,
+      "level": "mid",
+      "tier": null,
+      "tags": [],
+      "owner": "agent",
+      "status": "open",
+      "created_at": "2026-07-31T02:10:58.408Z",
+      "done": false,
+      "completed_at": null,
+      "version": null
+    },
+    {
+      "id": 26,
+      "title": "切 MySQL 前必补 Promo 限购并发防线:pay/webhook.go settle 对 pro_month_promo 靠应用层 HasPaidPurchaseExcludingTx 复查,MySQL READ COMMITTED 下并发两笔独立订单会双发一个月 Pro。当前 SQLite _txlock 串行化 + 部分唯一索引 ux_pay_promo_paid 双兜底,不触发;切 MySQL 需改 SELECT..FOR UPDATE 锁 user 维度或全表唯一索引",
+      "desc": null,
+      "level": "mid",
+      "tier": null,
+      "tags": [],
+      "owner": "agent",
+      "status": "open",
+      "created_at": "2026-07-31T16:34:06.353Z",
+      "done": false,
+      "completed_at": null,
+      "version": null
+    },
+    {
+      "id": 27,
+      "title": "分支审核 Minor 硬化(routing/pay):①TG webhook secret 改 subtle.ConstantTimeCompare(reward/handler.go:113 现用 !=);②routing 保存成功后回填服务端 Normalize 结果(现保留本地乐观值,重复/带空格规则短暂 UI 漂移);③nodes.go splitCN 冗余赋值清理",
+      "desc": null,
+      "level": "mid",
+      "tier": null,
+      "tags": [],
+      "owner": "agent",
+      "status": "open",
+      "created_at": "2026-07-31T16:34:06.426Z",
+      "done": false,
+      "completed_at": null,
+      "version": null
     }
   ]
 }