feat(资产钱包自动续费): 新增全局配置、每日扫描续购与可靠复机

- 新增单行配置表 tb_asset_auto_renewal_config 与尝试记录表 tb_asset_auto_renewal_attempt（迁移 000229/000230）
- 每日按上海自然日扫描，窗口内以同一资产钱包可用余额续购当前主套餐，资金/订单/套餐/审计同一事务闭合
- 唯一键保证每资产每日至多一次尝试，占位中断由后续扫描收敛，当日不重试
- 四类失败原因向客户与店铺各投递每日至多一条站内通知，并注册通知类型与个人客户白名单
- 续费成功后按条件经 Outbox 可靠投递复机，新增恢复扫描只查询回填，不使用即发即弃调用
- 配置读写仅超级管理员与平台账号，保存记录操作者、前后值快照并登记统一审计
- tasks 7.1–7.15 全部验证通过（本机隔离 PostgreSQL/Redis，零外部渠道调用）

internal/application/assetautorenewal/config.go

@@ -0,0 +1,226 @@
+package assetautorenewal
+
+import (
+	"context"
+	"sort"
+	"time"
+
+	"go.uber.org/zap"
+	"gorm.io/gorm"
+
+	"github.com/break/junhong_cmp_fiber/internal/infrastructure/audit"
+	"github.com/break/junhong_cmp_fiber/internal/model"
+	"github.com/break/junhong_cmp_fiber/pkg/constants"
+	"github.com/break/junhong_cmp_fiber/pkg/errors"
+	"github.com/break/junhong_cmp_fiber/pkg/middleware"
+)
+
+// ConfigView 是自动续费配置的读取视图。
+type ConfigView struct {
+	Enabled          int       `json:"enabled"`
+	Scope            string    `json:"scope"`
+	PackageIDs       []uint    `json:"package_ids"`
+	DaysBeforeExpiry int       `json:"days_before_expiry"`
+	ConfigVersion    int64     `json:"config_version"`
+	Updater          uint      `json:"updater"`
+	UpdatedAt        time.Time `json:"updated_at"`
+}
+
+// ConfigRequest 是保存自动续费配置的请求。
+type ConfigRequest struct {
+	Enabled          int    `json:"enabled"`
+	Scope            string `json:"scope"`
+	PackageIDs       []uint `json:"package_ids"`
+	DaysBeforeExpiry int    `json:"days_before_expiry"`
+}
+
+// GetConfig 读取唯一的自动续费配置；仅超级管理员与平台账号可见。
+func (s *Service) GetConfig(ctx context.Context) (*ConfigView, error) {
+	if _, err := requirePlatformOperator(ctx); err != nil {
+		return nil, err
+	}
+	config, err := s.configStore.Get(ctx)
+	if err != nil {
+		if err == gorm.ErrRecordNotFound {
+			return nil, errors.New(errors.CodeNotFound, "自动续费配置不存在")
+		}
+		return nil, errors.Wrap(errors.CodeDatabaseError, err, "读取自动续费配置失败")
+	}
+	return toConfigView(config), nil
+}
+
+// SaveConfig 保存自动续费配置：单行事务锁串行化、事务内自增配置版本，并与审计同事务写入。
+//
+// 保存只影响后续扫描：已产生的尝试记录保留触发时的配置版本快照，不重算。
+func (s *Service) SaveConfig(ctx context.Context, request ConfigRequest) (*ConfigView, error) {
+	operatorID, err := requirePlatformOperator(ctx)
+	if err != nil {
+		return nil, err
+	}
+	packageIDs, err := normalizeConfigRequest(&request)
+	if err != nil {
+		return nil, err
+	}
+	if len(packageIDs) > 0 {
+		if err := s.validateSellableMainPackages(ctx, packageIDs); err != nil {
+			return nil, err
+		}
+	}
+	if s.auditWriter == nil {
+		return nil, errors.New(errors.CodeInvalidStatus, "自动续费配置审计接缝未配置")
+	}
+	saved := &model.AssetAutoRenewalConfig{}
+	err = s.db.WithContext(ctx).Transaction(func(tx *gorm.DB) error {
+		current, lockErr := s.configStore.LockInTx(ctx, tx)
+		if lockErr != nil {
+			if lockErr == gorm.ErrRecordNotFound {
+				return errors.New(errors.CodeNotFound, "自动续费配置不存在")
+			}
+			return errors.Wrap(errors.CodeDatabaseError, lockErr, "锁定自动续费配置失败")
+		}
+		before := configSnapshot(current)
+		saved.Enabled = request.Enabled
+		saved.Scope = request.Scope
+		saved.PackageIDs = model.UintJSONBArray(packageIDs)
+		saved.DaysBeforeExpiry = request.DaysBeforeExpiry
+		saved.ConfigVersion = current.ConfigVersion + 1
+		saved.Creator = current.Creator
+		saved.Updater = operatorID
+		if saveErr := s.configStore.SaveInTx(ctx, tx, saved, operatorID); saveErr != nil {
+			return errors.Wrap(errors.CodeDatabaseError, saveErr, "保存自动续费配置失败")
+		}
+		if auditErr := s.auditWriter.WriteAssetAutoRenewalConfigChange(ctx, tx, audit.AssetAutoRenewalConfigAudit{
+			OperatorID:    operatorID,
+			OperationType: constants.AuditOperationAssetAutoRenewalConfigUpdate,
+			Description:   "保存资产钱包自动续费配置",
+			BeforeData:    before,
+			AfterData:     configSnapshot(saved),
+			RequestID:     derefString(middleware.GetRequestIDFromContext(ctx)),
+			CorrelationID: derefString(middleware.GetRequestIDFromContext(ctx)),
+		}); auditErr != nil {
+			return auditErr
+		}
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+	view := &ConfigView{
+		Enabled: saved.Enabled, Scope: saved.Scope, PackageIDs: packageIDs,
+		DaysBeforeExpiry: saved.DaysBeforeExpiry, ConfigVersion: saved.ConfigVersion,
+		Updater: saved.Updater, UpdatedAt: s.now(),
+	}
+	s.logger.Info("资产钱包自动续费配置已保存",
+		zap.Int("enabled", view.Enabled), zap.String("scope", view.Scope),
+		zap.Int("days_before_expiry", view.DaysBeforeExpiry), zap.Int64("config_version", view.ConfigVersion))
+	return view, nil
+}
+
+// derefString 安全解引用可空字符串，供审计上下文可选字段复用。
+func derefString(value *string) string {
+	if value == nil {
+		return ""
+	}
+	return *value
+}
+
+// requirePlatformOperator 复核调用者仅限超级管理员与平台账号，并返回其账号 ID。
+//
+// 路由组已做粗粒度门禁，这里在业务边界再复核一次账号类型（ENG-AUTHZ-001）：
+// 代理、企业与个人客户一律按「无权限或不存在」统一拒绝，不形成可枚举差异。
+func requirePlatformOperator(ctx context.Context) (uint, error) {
+	userType := middleware.GetUserTypeFromContext(ctx)
+	if userType != constants.UserTypeSuperAdmin && userType != constants.UserTypePlatform {
+		return 0, errors.New(errors.CodeForbidden, constants.PlatformManagementForbiddenMessage)
+	}
+	operatorID := middleware.GetUserIDFromContext(ctx)
+	if operatorID == 0 {
+		return 0, errors.New(errors.CodeForbidden, constants.PlatformManagementForbiddenMessage)
+	}
+	return operatorID, nil
+}
+
+// normalizeConfigRequest 归一化并校验保存请求，返回去重升序的指定套餐集合。
+func normalizeConfigRequest(request *ConfigRequest) ([]uint, error) {
+	if request.Enabled != constants.AssetAutoRenewalConfigEnabledOff &&
+		request.Enabled != constants.AssetAutoRenewalConfigEnabledOn {
+		return nil, errors.New(errors.CodeInvalidParam, "自动续费总开关取值非法")
+	}
+	if request.Scope != constants.AssetAutoRenewalScopeAll && request.Scope != constants.AssetAutoRenewalScopeSpecified {
+		return nil, errors.New(errors.CodeInvalidParam, "自动续费适用范围取值非法")
+	}
+	if request.DaysBeforeExpiry < constants.AssetAutoRenewalMinDaysBeforeExpiry ||
+		request.DaysBeforeExpiry > constants.AssetAutoRenewalMaxDaysBeforeExpiry {
+		return nil, errors.New(errors.CodeInvalidParam, "自动续费到期前天数必须在 1 至 90 之间")
+	}
+	seen := make(map[uint]struct{}, len(request.PackageIDs))
+	packageIDs := make([]uint, 0, len(request.PackageIDs))
+	for _, packageID := range request.PackageIDs {
+		if packageID == 0 {
+			return nil, errors.New(errors.CodeInvalidParam, "自动续费指定套餐包含无效 ID")
+		}
+		if _, exists := seen[packageID]; exists {
+			continue
+		}
+		seen[packageID] = struct{}{}
+		packageIDs = append(packageIDs, packageID)
+	}
+	sort.Slice(packageIDs, func(i, j int) bool { return packageIDs[i] < packageIDs[j] })
+	if request.Scope == constants.AssetAutoRenewalScopeSpecified && len(packageIDs) == 0 {
+		return nil, errors.New(errors.CodeInvalidParam, "指定范围必须至少选择一个主套餐")
+	}
+	if request.Scope == constants.AssetAutoRenewalScopeAll {
+		packageIDs = nil
+	}
+	return packageIDs, nil
+}
+
+// validateSellableMainPackages 校验指定集合只能选择当前可售主套餐。
+//
+// 可售口径与购买校验的平台分支一致：套餐为正式套餐、全局启用且上架。
+// 运行时不因后来下架而拒绝（交由续费豁免判定），因此下架只在此处拦截配置保存。
+func (s *Service) validateSellableMainPackages(ctx context.Context, packageIDs []uint) error {
+	packages, err := s.loadPackagesByIDs(ctx, packageIDs)
+	if err != nil {
+		return err
+	}
+	for _, packageID := range packageIDs {
+		pkg, exists := packages[packageID]
+		if !exists {
+			return errors.New(errors.CodeInvalidParam, "指定套餐不存在")
+		}
+		if pkg.PackageType != constants.PackageTypeFormal {
+			return errors.New(errors.CodeInvalidParam, "指定范围只能选择主套餐")
+		}
+		if pkg.Status != constants.StatusEnabled {
+			return errors.New(errors.CodeInvalidParam, "指定套餐已禁用")
+		}
+		if pkg.ShelfStatus != constants.ShelfStatusOn {
+			return errors.New(errors.CodeInvalidParam, "指定套餐已下架")
+		}
+	}
+	return nil
+}
+
+// configSnapshot 生成配置前后值快照，字段口径固定，便于审计比对。
+func configSnapshot(config *model.AssetAutoRenewalConfig) map[string]any {
+	return map[string]any{
+		"enabled":            config.Enabled,
+		"scope":              config.Scope,
+		"package_ids":        []uint(config.PackageIDs),
+		"days_before_expiry": config.DaysBeforeExpiry,
+		"config_version":     config.ConfigVersion,
+	}
+}
+
+func toConfigView(config *model.AssetAutoRenewalConfig) *ConfigView {
+	return &ConfigView{
+		Enabled:          config.Enabled,
+		Scope:            config.Scope,
+		PackageIDs:       []uint(config.PackageIDs),
+		DaysBeforeExpiry: config.DaysBeforeExpiry,
+		ConfigVersion:    config.ConfigVersion,
+		Updater:          config.Updater,
+		UpdatedAt:        config.UpdatedAt,
+	}
+}

internal/application/assetautorenewal/event.go

@@ -0,0 +1,222 @@
+package assetautorenewal
+
+import (
+	"context"
+	"strconv"
+
+	"github.com/bytedance/sonic"
+	"go.uber.org/zap"
+	"gorm.io/gorm"
+
+	"github.com/break/junhong_cmp_fiber/internal/infrastructure/audit"
+	"github.com/break/junhong_cmp_fiber/internal/infrastructure/messaging/outbox"
+	"github.com/break/junhong_cmp_fiber/internal/model"
+	"github.com/break/junhong_cmp_fiber/pkg/auditcontext"
+	"github.com/break/junhong_cmp_fiber/pkg/constants"
+	"github.com/break/junhong_cmp_fiber/pkg/errors"
+	"github.com/break/junhong_cmp_fiber/pkg/outboxid"
+)
+
+// assetAutoRenewalResumePayloadVersion 是自动续费复机事件的载荷版本。
+const assetAutoRenewalResumePayloadVersion = 1
+
+// resumePayload 是自动续费复机事件的载荷，只携带尝试与资产标识，消费者按尝试 ID 认领执行权。
+type resumePayload struct {
+	AttemptID uint   `json:"attempt_id"`
+	AssetType string `json:"asset_type"`
+	AssetID   uint   `json:"asset_id"`
+}
+
+// AppendResumeRequested 在续费事务内幂等写入复机事件。
+//
+// 事件 ID 由尝试记录 ID 派生：续费成功与复机状态同事务写入，重复投递不会创建第二个事件
+// （ENG-OUTBOX-001）。调用方必须已确认可复机条件成立，本函数不做条件判定。
+func AppendResumeRequested(ctx context.Context, tx *gorm.DB, repository *outbox.Repository, attempt *model.AssetAutoRenewalAttempt) error {
+	if repository == nil {
+		return gorm.ErrInvalidDB
+	}
+	if attempt == nil || attempt.ID == 0 {
+		return gorm.ErrInvalidData
+	}
+	value := strconv.FormatUint(uint64(attempt.ID), 10)
+	_, err := repository.AppendIdempotent(ctx, tx, outbox.Envelope{
+		EventID:        outboxid.Stable(constants.OutboxEventTypeAssetAutoRenewalResumeRequested+":", value),
+		EventType:      constants.OutboxEventTypeAssetAutoRenewalResumeRequested,
+		PayloadVersion: assetAutoRenewalResumePayloadVersion,
+		AggregateType:  "asset_auto_renewal_attempt",
+		AggregateID:    value,
+		ResourceType:   attempt.AssetType,
+		ResourceID:     strconv.FormatUint(uint64(attempt.AssetID), 10),
+		BusinessKey:    constants.OutboxEventTypeAssetAutoRenewalResumeRequested + ":" + value,
+		Payload: resumePayload{
+			AttemptID: attempt.ID, AssetType: attempt.AssetType, AssetID: attempt.AssetID,
+		},
+	})
+	return err
+}
+
+// ResumeConsumer 把自动续费复机事件转成一次复机动作。
+type ResumeConsumer struct {
+	service *Service
+}
+
+// NewResumeConsumer 创建自动续费复机事件消费者。
+func NewResumeConsumer(service *Service) *ResumeConsumer {
+	return &ResumeConsumer{service: service}
+}
+
+// Consume 按尝试记录认领执行权后执行复机；重复投递由认领字段兜住，不会产生第二次外部调用。
+func (c *ResumeConsumer) Consume(ctx context.Context, envelope outbox.DeliveryEnvelope) error {
+	if c == nil || c.service == nil {
+		return errors.New(errors.CodeServiceUnavailable, "自动续费复机执行能力未配置")
+	}
+	if envelope.EventType != constants.OutboxEventTypeAssetAutoRenewalResumeRequested {
+		return outbox.Permanent(gorm.ErrInvalidData)
+	}
+	if envelope.PayloadVersion != assetAutoRenewalResumePayloadVersion {
+		return outbox.Permanent(errors.New(errors.CodeInvalidParam, "自动续费复机事件载荷版本不受支持"))
+	}
+	var payload resumePayload
+	if err := sonic.Unmarshal(envelope.Payload, &payload); err != nil {
+		return outbox.Permanent(errors.Wrap(errors.CodeInvalidParam, err, "自动续费复机事件载荷格式错误"))
+	}
+	if payload.AttemptID == 0 {
+		return outbox.Permanent(errors.New(errors.CodeInvalidParam, "自动续费复机事件载荷不完整"))
+	}
+	// 消费者不经过计划任务入口，必须自带操作者与来源，否则失败审计会因审计上下文缺失被拒（fail-closed）。
+	ctx = auditcontext.With(ctx, auditcontext.Context{
+		ActorKind: constants.AuditActorSystemTask, ActorID: constants.OutboxEventTypeAssetAutoRenewalResumeRequested,
+		ActorName: "资产钱包自动续费复机结果消费者", Source: constants.AuditSourceWorker,
+		CorrelationID: envelope.CorrelationID, ParentEventID: envelope.EventID,
+	})
+	return c.service.ExecuteResume(ctx, payload.AttemptID)
+}
+
+// ExecuteResume 认领并执行一次自动续费复机，回写尝试记录的复机状态、外部交互号与失败原因。
+//
+// 「回写复机终态 + 投递失败通知 + 失败审计」在同一个短事务内闭合：任一失败整体回滚，
+// 记录退回「已投递且已提交」，由恢复扫描按只读查询继续收敛，因此通知不会因一次写入抖动而永久丢失。
+// 复机失败或结果未知时绝不回滚续费事实：订单、套餐生效与钱包扣款保持已提交状态。
+func (s *Service) ExecuteResume(ctx context.Context, attemptID uint) error {
+	if s.resume == nil {
+		return errors.New(errors.CodeServiceUnavailable, "自动续费复机执行端口未配置")
+	}
+	attempt, err := s.attemptStore.Load(ctx, attemptID)
+	if err != nil {
+		if err == gorm.ErrRecordNotFound {
+			return nil
+		}
+		return errors.Wrap(errors.CodeDatabaseError, err, "读取自动续费尝试记录失败")
+	}
+	if attempt.ResumeStatus != constants.AssetAutoRenewalResumeStatusRequested {
+		// 已收敛或未投递复机：重复投递与非复机尝试都按幂等结束。
+		return nil
+	}
+	claimed, err := s.attemptStore.ClaimResumeSubmission(ctx, attemptID, s.now())
+	if err != nil {
+		return err
+	}
+	if !claimed {
+		// 认领已被占用：可能是并发重复投递，也可能是上次「已调用但未回写」的进程中断。
+		// 两种情况都不得再次调用运营商，留给恢复扫描按只读查询收敛。
+		s.logger.Info("自动续费复机已被并发执行，跳过重复调用", zap.Uint("attempt_id", attemptID))
+		return nil
+	}
+	outcome, resumeErr := s.resume.ResumeAssetForAutoRenewal(ctx, attempt.AssetType, attempt.AssetID)
+	status := constants.AssetAutoRenewalResumeStatusUnknown
+	reason := outcome.SafeReason
+	switch {
+	case !outcome.Applied:
+		// 判定在执行时已不成立：按跳过记录，不通知，也不改写任何续费事实。
+		status = constants.AssetAutoRenewalResumeStatusSkipped
+		reason = ""
+	case outcome.Result == constants.AuditResultSuccess:
+		status = constants.AssetAutoRenewalResumeStatusSucceeded
+		reason = ""
+	case outcome.Result == constants.AuditResultFailed:
+		status = constants.AssetAutoRenewalResumeStatusFailed
+		reason = resumeFailureDetail(outcome.SafeReason)
+	default:
+		status = constants.AssetAutoRenewalResumeStatusUnknown
+		reason = resumeFailureDetail(outcome.SafeReason)
+	}
+	if err := s.finalizeResumeOutcome(ctx, attempt, status, reason, outcome.IntegrationID); err != nil {
+		return err
+	}
+	if resumeErr != nil {
+		s.logger.Warn("自动续费复机执行未确认完成",
+			zap.Uint("attempt_id", attemptID), zap.String("result", outcome.Result), zap.Error(resumeErr))
+	}
+	return nil
+}
+
+// finalizeResumeOutcome 在同一短事务内回写复机终态；确认失败时同事务投递通知并写失败审计。
+func (s *Service) finalizeResumeOutcome(ctx context.Context, attempt *model.AssetAutoRenewalAttempt, status int, reason, integrationID string) error {
+	expected := []int{constants.AssetAutoRenewalResumeStatusRequested}
+	return s.db.WithContext(ctx).Transaction(func(tx *gorm.DB) error {
+		updated, err := s.attemptStore.MarkResumeOutcomeInTx(ctx, tx, attempt.ID, expected, status, integrationID, reason)
+		if err != nil {
+			return err
+		}
+		if !updated {
+			// 已被并发收敛：不重复投递通知与审计。
+			s.logger.Info("自动续费复机结果已被并发收敛，跳过通知与审计", zap.Uint("attempt_id", attempt.ID))
+			return nil
+		}
+		if status != constants.AssetAutoRenewalResumeStatusFailed {
+			return nil
+		}
+		if err := s.appendFailureNotifications(ctx, tx, failureNotification{
+			AttemptID: attempt.ID, AssetType: attempt.AssetType, AssetID: attempt.AssetID,
+			Identifier: s.assetIdentifier(ctx, attempt.AssetType, attempt.AssetID),
+			ShopID:     attempt.ShopID, CustomerID: attempt.CustomerID,
+			TriggerDate: attempt.TriggerDate, Reason: constants.AssetAutoRenewalFailureResumeFailed,
+			PackageName: s.packageName(ctx, attempt.RenewPackageID), FinalExpiresAt: attempt.FinalExpiresAt,
+		}); err != nil {
+			return err
+		}
+		return s.appendResumeFailureAudit(ctx, tx, attempt, reason)
+	})
+}
+
+// appendResumeFailureAudit 在复机失败终态事务内写统一审计，主资源为本次尝试记录。
+func (s *Service) appendResumeFailureAudit(ctx context.Context, tx *gorm.DB, attempt *model.AssetAutoRenewalAttempt, reason string) error {
+	if s.auditWriter == nil {
+		return errors.New(errors.CodeInvalidStatus, "自动续费统一审计接缝未配置")
+	}
+	attemptID := strconv.FormatUint(uint64(attempt.ID), 10)
+	return s.auditWriter.Append(ctx, tx, audit.AppendInput{
+		ActionCode: constants.AuditActionAssetAutoRenewalFailed, Summary: "资产钱包自动续费复机失败",
+		ScopeType: constants.AuditScopePlatform, Result: constants.AuditResultFailed,
+		ErrorSummary:  reason,
+		CorrelationID: attemptID,
+		Metadata: map[string]any{
+			"asset_type": attempt.AssetType, "asset_id": attempt.AssetID,
+			"trigger_date": formatShanghaiDate(&attempt.TriggerDate, s.now()),
+			"failure_kind": constants.AssetAutoRenewalFailureResumeFailed,
+		},
+		Resources: []audit.ResourceInput{{
+			Type: constants.AuditResourceAssetAutoRenewalAttempt, ID: &attemptID, Key: attemptID,
+			DisplayName: "自动续费尝试 " + attemptID,
+			Relation:    constants.AuditResourceRelationPrimary,
+			Role:        constants.AuditResourceRoleAssetAutoRenewalAttemptTarget,
+			IdentitySnapshot: map[string]any{
+				"id": attempt.ID, "asset_type": attempt.AssetType, "asset_id": attempt.AssetID,
+				"trigger_date":   formatShanghaiDate(&attempt.TriggerDate, s.now()),
+				"resume_status":  constants.AssetAutoRenewalResumeStatusFailed,
+				"failure_reason": constants.AssetAutoRenewalFailureResumeFailed,
+			},
+			BeforeData:        map[string]any{"resume_status": constants.AssetAutoRenewalResumeStatusRequested},
+			AfterData:         map[string]any{"resume_status": constants.AssetAutoRenewalResumeStatusFailed},
+			SubjectVisibility: constants.AuditSubjectInternalOnly,
+		}},
+	})
+}
+
+// resumeFailureDetail 组装可安全展示的复机失败原因，不写渠道报文原文。
+func resumeFailureDetail(safeReason string) string {
+	if safeReason == "" {
+		return "复机结果确认为失败"
+	}
+	return safeReason
+}

internal/application/assetautorenewal/notify.go

@@ -0,0 +1,136 @@
+package assetautorenewal
+
+import (
+	"context"
+	"fmt"
+	"strconv"
+	"time"
+
+	"go.uber.org/zap"
+	"gorm.io/gorm"
+
+	notificationapp "github.com/break/junhong_cmp_fiber/internal/application/notification"
+	"github.com/break/junhong_cmp_fiber/internal/infrastructure/messaging/outbox"
+	"github.com/break/junhong_cmp_fiber/pkg/constants"
+	"github.com/break/junhong_cmp_fiber/pkg/errors"
+	"github.com/break/junhong_cmp_fiber/pkg/outboxid"
+)
+
+// failureNotification 是一条失败通知事件所需冻结的事实。
+type failureNotification struct {
+	AttemptID      uint
+	AssetType      string
+	AssetID        uint
+	Identifier     string
+	ShopID         *uint
+	CustomerID     uint
+	TriggerDate    time.Time
+	Reason         string
+	PackageName    string
+	FinalExpiresAt *time.Time
+}
+
+// appendFailureNotifications 在调用方事务内为当前个人客户与资产所属店铺各写一条幂等通知事件。
+//
+// 每日至多一条由上锁的两个条件推出：同一资产同一自然日至多一次尝试，且幂等键内嵌资产类型与资产 ID、
+// 上海自然日、原因类型与接收人。资产所属店铺当时无有效业务员时不阻断：店铺接收人由既有店铺解析
+// 在投递期完成，解析为空列表即正常结束，不影响续费事实与尝试记录；资产无店铺归属时只创建客户通知。
+// 非通知原因（如占位中断收敛）一律不投递，未登记原因按 fail-closed 处理。
+func (s *Service) appendFailureNotifications(ctx context.Context, tx *gorm.DB, request failureNotification) error {
+	if s.outbox == nil {
+		return errors.New(errors.CodeInvalidStatus, "自动续费通知 Outbox 未配置")
+	}
+	if !constants.IsAssetAutoRenewalNotifiableFailureReason(request.Reason) {
+		s.logger.Warn("自动续费失败原因不属于通知口径，已跳过通知投递",
+			zap.Uint("attempt_id", request.AttemptID), zap.String("reason", request.Reason))
+		return nil
+	}
+	templateData := map[string]string{
+		"asset_identifier": request.Identifier,
+		"package_name":     request.PackageName,
+		"failure_reason":   constants.GetAssetAutoRenewalFailureReasonName(request.Reason),
+		"expiry_date":      formatShanghaiDate(request.FinalExpiresAt, s.now()),
+	}
+	assetIDText := strconv.FormatUint(uint64(request.AssetID), 10)
+	// 资源引用按资产类型选择既有可跳转目标：卡用 iot_card 详情、设备用 device 详情
+	// （两者都在 internal/query/notification/target.go 的目标定义里，idTarget + 可用性复核），
+	// 使店铺/业务员点开通知能进入对应资产详情，而不是落到无目标类型。
+	refType := assetRefType(request.AssetType)
+	expiresAt := request.FinalExpiresAt
+	if expiresAt == nil {
+		fallback := s.now().UTC()
+		expiresAt = &fallback
+	}
+	if request.CustomerID > 0 {
+		eventID := failureEventID(request.AssetType, request.AssetID, request.TriggerDate, request.Reason, "c", request.CustomerID)
+		_, err := s.outbox.AppendIdempotent(ctx, tx, outbox.Envelope{
+			EventID: eventID, EventType: constants.OutboxEventTypePersonalCustomerDirectNotification,
+			PayloadVersion: constants.NotificationPayloadVersionV1,
+			AggregateType:  "asset_auto_renewal_attempt", AggregateID: strconv.FormatUint(uint64(request.AttemptID), 10),
+			ResourceType: request.AssetType, ResourceID: assetIDText, BusinessKey: eventID,
+			Payload: notificationapp.PersonalCustomerDirectPayload{
+				RecipientID: request.CustomerID, NotificationType: constants.NotificationTypeAssetAutoRenewalFailed,
+				TemplateData: templateData, RefType: refType, RefID: assetIDText,
+				ExpiresAt: expiresAt,
+			},
+		})
+		if err != nil {
+			return errors.Wrap(errors.CodeDatabaseError, err, "写入自动续费客户通知事件失败")
+		}
+	}
+	if request.ShopID == nil || *request.ShopID == 0 {
+		return nil
+	}
+	eventID := failureEventID(request.AssetType, request.AssetID, request.TriggerDate, request.Reason, "shop", *request.ShopID)
+	_, err := s.outbox.AppendIdempotent(ctx, tx, outbox.Envelope{
+		EventID: eventID, EventType: constants.OutboxEventTypeAdminDynamicNotification,
+		PayloadVersion: constants.NotificationPayloadVersionV1,
+		AggregateType:  "asset_auto_renewal_attempt", AggregateID: strconv.FormatUint(uint64(request.AttemptID), 10),
+		ResourceType: request.AssetType, ResourceID: assetIDText, BusinessKey: eventID,
+		Payload: notificationapp.AdminDynamicPayload{
+			TargetKind: constants.NotificationTargetKindShop, TargetID: *request.ShopID,
+			NotificationType: constants.NotificationTypeAssetAutoRenewalFailed,
+			TemplateData:     templateData, RefType: refType, RefID: assetIDText,
+			ExpiresAt: expiresAt,
+		},
+	})
+	if err != nil {
+		return errors.Wrap(errors.CodeDatabaseError, err, "写入自动续费店铺通知事件失败")
+	}
+	return nil
+}
+
+// assetRefType 把资产类型映射为可跳转的通知引用类型（卡片详情 / 设备详情）。
+func assetRefType(assetType string) string {
+	if assetType == constants.AssetWalletResourceTypeDevice {
+		return constants.NotificationRefTypeDevice
+	}
+	return constants.NotificationRefTypeIotCard
+}
+
+// failureEventID 构造失败通知的稳定幂等键。
+//
+// 键内嵌资产类型与资产 ID、上海自然日、原因类型与接收人；复机失败沿用该次尝试的日期键，
+// 因此同一尝试只通知一次且不跨日新增。超长时由 outboxid.Stable 追加稳定摘要，仍保持唯一。
+func failureEventID(assetType string, assetID uint, triggerDate time.Time, reason, recipientKind string, recipientID uint) string {
+	dateKey := triggerDate.In(shanghaiLocation).Format("20060102")
+	return outboxid.Stable("aar:", fmt.Sprintf("%s:%d:%s:%s:%s:%d",
+		assetCode(assetType), assetID, dateKey, reason, recipientKind, recipientID))
+}
+
+// assetCode 把资产类型压缩为单字母代码，只为把幂等键长度压进 Outbox 预算。
+func assetCode(assetType string) string {
+	if assetType == constants.AssetWalletResourceTypeDevice {
+		return "d"
+	}
+	return "c"
+}
+
+// formatShanghaiDate 把业务到期时间格式化为上海自然日文本，供通知模板与展示期使用。
+func formatShanghaiDate(value *time.Time, fallback time.Time) string {
+	target := fallback
+	if value != nil {
+		target = *value
+	}
+	return target.In(shanghaiLocation).Format("2006-01-02")
+}

internal/application/assetautorenewal/recovery.go

@@ -0,0 +1,108 @@
+package assetautorenewal
+
+import (
+	"context"
+	"time"
+
+	"go.uber.org/zap"
+
+	"github.com/break/junhong_cmp_fiber/internal/model"
+	"github.com/break/junhong_cmp_fiber/pkg/constants"
+	"github.com/break/junhong_cmp_fiber/pkg/errors"
+)
+
+// RecoveryResult 是一次复机结果恢复扫描的可观察结果。
+//
+// Scanned 为扫到的未收敛尝试数；Confirmed 为本次回填为已确认结果的尝试数；
+// Pending 为结果仍未确认、等待下次扫描的尝试数；Anomaly 为超过查询窗口仍不可确认、
+// 本次标记转人工的尝试数。
+type RecoveryResult struct {
+	Scanned   int
+	Confirmed int
+	Pending   int
+	Anomaly   int
+}
+
+// RecoverResumeResults 扫描未收敛的复机子结果：只查询运营商状态回填，绝不重复发起复机调用。
+//
+// 收敛口径与既有停复机恢复一致（internal/application/carrierthreshold/cycle.go:246-296）：
+//   - 查询确认已复机 → 回填成功；
+//   - 「已知但未复机」或不可判定 → 仍算未确认，等到下一次扫描；
+//   - 自提交起超过查询窗口仍不可确认 → 标记异常并退出自动扫描转人工核对。
+//
+// 恢复扫描**不**据此判定「复机失败」：续购后新主套餐多为待生效，卡在此期间本就可能仍处于停机，
+// 把「未复机」当失败会发出误报通知。复机失败只由消费者在网关明确返回失败时确认（「仅确认失败才通知」）。
+// 单条失败不中断整批，但会作为首个错误返回，交既有任务重试。
+func (s *Service) RecoverResumeResults(ctx context.Context) (RecoveryResult, error) {
+	result := RecoveryResult{}
+	if s.resume == nil {
+		return result, errors.New(errors.CodeServiceUnavailable, "自动续费复机执行端口未配置")
+	}
+	now := s.now()
+	attempts, err := s.attemptStore.ScanUnresolvedResumes(ctx, now, constants.AssetAutoRenewalRecoveryBatchSize)
+	if err != nil {
+		return result, err
+	}
+	result.Scanned = len(attempts)
+	var firstErr error
+	for index := range attempts {
+		if err := s.recoverResumeResult(ctx, &attempts[index], now, &result); err != nil {
+			s.logger.Warn("自动续费复机结果恢复单条失败",
+				zap.Uint("attempt_id", attempts[index].ID), zap.Error(err))
+			if firstErr == nil {
+				firstErr = err
+			}
+		}
+	}
+	s.logger.Info("自动续费复机结果恢复扫描完成",
+		zap.Int("scanned", result.Scanned), zap.Int("confirmed", result.Confirmed),
+		zap.Int("pending", result.Pending), zap.Int("anomaly", result.Anomaly))
+	return result, firstErr
+}
+
+// recoverResumeResult 处理单条未收敛的复机子结果。
+func (s *Service) recoverResumeResult(ctx context.Context, attempt *model.AssetAutoRenewalAttempt, now time.Time, result *RecoveryResult) error {
+	online, known, integrationID, err := s.resume.QueryAutoRenewalResumeState(ctx, attempt.AssetType, attempt.AssetID)
+	if err != nil || !known || !online {
+		// 查询失败、状态不可判定、或已知仍未复机：一律按「仍未确认」处理，
+		// 绝不误判为失败终态，也绝不据此发出失败通知。
+		result.Pending++
+		if !expiredResumeQueryWindow(attempt.ResumeSubmittedAt, now) {
+			return nil
+		}
+		marked, markErr := s.attemptStore.MarkResumeAnomaly(ctx, attempt.ID,
+			"复机结果超过确认窗口仍不可查，请人工核对")
+		if markErr != nil {
+			return markErr
+		}
+		if marked {
+			result.Anomaly++
+			s.logger.Warn("自动续费复机结果超期不可确认，已标记异常转人工",
+				zap.Uint("attempt_id", attempt.ID), zap.String("asset_type", attempt.AssetType),
+				zap.Uint("asset_id", attempt.AssetID))
+		}
+		return nil
+	}
+	expected := []int{
+		constants.AssetAutoRenewalResumeStatusRequested,
+		constants.AssetAutoRenewalResumeStatusUnknown,
+	}
+	marked, markErr := s.attemptStore.MarkResumeOutcome(ctx, attempt.ID, expected,
+		constants.AssetAutoRenewalResumeStatusSucceeded, integrationID, "")
+	if markErr != nil {
+		return markErr
+	}
+	if marked {
+		result.Confirmed++
+	}
+	return nil
+}
+
+// expiredResumeQueryWindow 判断复机子任务自提交起是否已超过自动查询窗口。
+// 未提交（提交认领时刻为空）表示尚未发起复机，不算超期。
+func expiredResumeQueryWindow(submittedAt *time.Time, now time.Time) bool {
+	if submittedAt == nil {
+		return false
+	}
+	return now.Sub(*submittedAt) >= constants.AssetAutoRenewalResumeQueryWindow
+}

internal/application/assetautorenewal/renew.go

@@ -0,0 +1,809 @@
+package assetautorenewal
+
+import (
+	"context"
+	"strconv"
+	"strings"
+	"time"
+
+	"gorm.io/gorm"
+	"gorm.io/gorm/clause"
+
+	cardObservationApp "github.com/break/junhong_cmp_fiber/internal/application/cardobservation"
+	"github.com/break/junhong_cmp_fiber/internal/infrastructure/audit"
+	"github.com/break/junhong_cmp_fiber/internal/infrastructure/commissiondelivery"
+	"github.com/break/junhong_cmp_fiber/internal/model"
+	assetquery "github.com/break/junhong_cmp_fiber/internal/query/assetautorenewal"
+	packagepkg "github.com/break/junhong_cmp_fiber/internal/service/package"
+	"github.com/break/junhong_cmp_fiber/internal/service/purchase_validation"
+	"github.com/break/junhong_cmp_fiber/pkg/constants"
+	"github.com/break/junhong_cmp_fiber/pkg/errors"
+	"github.com/break/junhong_cmp_fiber/pkg/outboxid"
+)
+
+// renewalHalt 是执行事务内重读资格事实后必须终止本次尝试的可安全记录原因。
+//
+// 它作为事务闭包的返回错误使已取得行锁的续费事务整体回滚（此时尚未写入任何资金与订单事实），
+// 再由调用方在独立短事务中落终态、投递通知与写审计。
+// FailureReason 与 SkipReason 恰有一个非空：非空失败原因触发通知，跳过原因不触发通知。
+type renewalHalt struct {
+	FailureReason string
+	SkipReason    string
+	Detail        string
+}
+
+// Error 实现 error，使事务闭包能把终止信号回传给调用方。
+func (h *renewalHalt) Error() string {
+	if h.SkipReason != "" {
+		return "自动续费跳过：" + constants.GetAssetAutoRenewalSkipReasonName(h.SkipReason)
+	}
+	return "自动续费未执行：" + constants.GetAssetAutoRenewalFailureReasonName(h.FailureReason)
+}
+
+// renewalFacts 是一次续费执行成功后用于运行日志的关键事实。
+type renewalFacts struct {
+	RenewPrice int64
+	OrderID    uint
+	OrderNo    string
+}
+
+// executeRenewal 在单个事务内闭合一次续购：先锁资产钱包行、后锁资产载体行，锁后重读全部资格事实，
+// 再扣可用余额、建订单与明细、写已支付支付记录、写钱包流水、激活套餐、写佣金与观测 Outbox、
+// 更新尝试记录为成功并写成功审计。任一步失败整体回滚，不存在部分成功状态。
+//
+// windowDays 是本次扫描使用的配置窗口，必须传入实际配置值：窗口是触发条件而不是资格不变式，
+// 用常量上限会让「人工已把最终到期推远」被误判为失败。
+//
+// 返回 halt 表示重读后应落失败或跳过终态（事务已回滚且未写入任何事实）；返回 err 表示事务失败。
+func (s *Service) executeRenewal(ctx context.Context, candidate assetquery.Candidate, attempt *model.AssetAutoRenewalAttempt, windowDays int) (*renewalFacts, *renewalHalt, error) {
+	if s.outbox == nil {
+		return nil, nil, errors.New(errors.CodeInvalidStatus, "自动续费 Outbox 未配置")
+	}
+	wallet, err := s.assetWalletStore.GetByResourceTypeAndID(ctx, candidate.AssetType, candidate.AssetID)
+	if err != nil {
+		if err == gorm.ErrRecordNotFound {
+			return nil, &renewalHalt{
+				FailureReason: constants.AssetAutoRenewalFailureNotRenewable,
+				Detail:        "资产钱包不存在，无法以可用余额续购",
+			}, nil
+		}
+		return nil, nil, errors.Wrap(errors.CodeDatabaseError, err, "读取资产钱包失败")
+	}
+	facts := &renewalFacts{}
+	var halt *renewalHalt
+	err = s.db.WithContext(ctx).Transaction(func(tx *gorm.DB) error {
+		// 锁序固定为「先资产钱包行、后资产载体行」，与人工路径的「先冻结钱包、后激活套餐」一致，
+		// 避免与人工事务的锁序反转形成死锁。
+		lockedWallet, lockErr := s.assetWalletStore.LockByIDWithTx(ctx, tx, wallet.ID)
+		if lockErr != nil {
+			return errors.Wrap(errors.CodeDatabaseError, lockErr, "锁定资产钱包失败")
+		}
+		if carrierErr := s.lockCarrier(ctx, tx, candidate.AssetType, candidate.AssetID); carrierErr != nil {
+			return carrierErr
+		}
+		// 锁后重读：最终到期、当前主套餐、待生效主套餐、可售续费价与可用余额都以重读结果为准。
+		execution, execErr := s.rereadUnderLock(ctx, tx, candidate, lockedWallet, windowDays)
+		if execErr != nil {
+			var halted *renewalHalt
+			if asRenewalHalt(execErr, &halted) {
+				halt = halted
+				return execErr
+			}
+			return execErr
+		}
+		if err := s.writeRenewalFacts(ctx, tx, execution, attempt, facts); err != nil {
+			return err
+		}
+		return nil
+	})
+	if err != nil {
+		if halt != nil {
+			return nil, halt, nil
+		}
+		return nil, nil, err
+	}
+	return facts, nil, nil
+}
+
+// executionPlan 是锁后重读得到的执行输入。
+type executionPlan struct {
+	candidate  assetquery.Candidate
+	asset      *assetSnapshot
+	wallet     *model.AssetWallet
+	pkg        *model.Package
+	sellerShop *uint
+	price      int64
+	costPrice  int64
+}
+
+// assetSnapshot 是执行事务内锁定的资产事实。
+type assetSnapshot struct {
+	assetType  string
+	assetID    uint
+	identifier string
+	shopID     *uint
+	seriesID   *uint
+	generation int
+}
+
+// rereadUnderLock 在行锁内重读全部资格事实，并给出可执行或必须终止的判断。
+//
+// 判定顺序体现「资格不变式先于触发条件」：
+//  1. 先判资格不变式——已存在待生效主套餐即「人工已完成续购 / 不叠加周期」，无论最终到期被推到多远
+//     都 MUST 跳过（规格 Requirement 8），绝不退化为「不可续费」失败与错误通知；
+//  2. 再判窗口与推算（触发条件）——不在窗口或推算不再明确，才是「当前条件不允许自动续购」。
+//
+// 之后依次判在途人工订单、钱包状态、可售续费价与可用余额。
+func (s *Service) rereadUnderLock(ctx context.Context, tx *gorm.DB, candidate assetquery.Candidate, wallet *model.AssetWallet, windowDays int) (*executionPlan, error) {
+	asset, err := s.lockAndSnapshotAsset(ctx, tx, candidate.AssetType, candidate.AssetID)
+	if err != nil {
+		return nil, err
+	}
+	inTxQuery := s.candidates.WithDB(tx)
+	// 第 1 步：资格不变式（先于窗口判定）。
+	state, err := inTxQuery.MainUsageStateOf(ctx, candidate.AssetType, candidate.AssetID)
+	if err != nil {
+		return nil, err
+	}
+	if state.HasPendingMainPackage {
+		return nil, &renewalHalt{
+			SkipReason: constants.AssetAutoRenewalSkipManualRenewed,
+			Detail:     "锁后重读发现该资产已存在待生效主套餐",
+		}
+	}
+	if state.CurrentPackageID == 0 {
+		return nil, &renewalHalt{
+			FailureReason: constants.AssetAutoRenewalFailureNotRenewable,
+			Detail:        "锁后重读未找到当前主套餐商品",
+		}
+	}
+	// 第 2 步：触发条件（窗口与推算口径），窗口取本次扫描的配置值。
+	current, err := inTxQuery.Candidate(ctx, candidate.AssetType, candidate.AssetID, windowDays)
+	if err != nil {
+		return nil, err
+	}
+	if current == nil {
+		return nil, &renewalHalt{
+			FailureReason: constants.AssetAutoRenewalFailureNotRenewable,
+			Detail:        "锁后重读最终到期已不在触发窗口或推算结果不再明确",
+		}
+	}
+	inFlight, err := inTxQuery.OpenManualMainPackageOrder(ctx, wallet.ID, candidate.AssetType, candidate.AssetID)
+	if err != nil {
+		return nil, err
+	}
+	if inFlight {
+		return nil, &renewalHalt{
+			SkipReason: constants.AssetAutoRenewalSkipManualOrderPending,
+			Detail:     "锁后重读发现该资产存在未关闭的个人资产钱包主套餐订单",
+		}
+	}
+	if wallet.Status != constants.AssetWalletStatusNormal {
+		return nil, &renewalHalt{
+			FailureReason: constants.AssetAutoRenewalFailureNotRenewable,
+			Detail:        "资产钱包当前不可用于扣款",
+		}
+	}
+	price, pkg, sellerShop, costPrice, err := s.resolveExecutablePrice(ctx, candidate.AssetType, candidate.AssetID, current.CurrentPackageID)
+	if err != nil {
+		var halted *renewalHalt
+		if asRenewalHalt(err, &halted) {
+			return nil, halted
+		}
+		return nil, err
+	}
+	if wallet.GetAvailableBalance() < price {
+		return nil, &renewalHalt{
+			FailureReason: constants.AssetAutoRenewalFailureInsufficientBalance,
+			Detail:        "资产钱包可用余额小于执行时当前可售续费价",
+		}
+	}
+	return &executionPlan{
+		candidate: *current, asset: asset, wallet: wallet, pkg: pkg,
+		sellerShop: sellerShop, price: price, costPrice: costPrice,
+	}, nil
+}
+
+// resolveExecutablePrice 复用应用层购买校验与价格策略取得可续费判定与执行时续费价。
+//
+// 校验入口是个人卡/设备购买校验（含续费豁免下架与生效零售价、成本价比较），
+// 绝不依赖 handler 层续费价实现；任何校验失败都归一为「不可续费」并保留可安全记录的说明。
+func (s *Service) resolveExecutablePrice(ctx context.Context, assetType string, assetID, renewPackageID uint) (int64, *model.Package, *uint, int64, error) {
+	if s.purchaseValidation == nil {
+		return 0, nil, nil, 0, errors.New(errors.CodeServiceUnavailable, "购买校验能力未配置")
+	}
+	packageIDs := []uint{renewPackageID}
+	var result *purchase_validation.PurchaseValidationResult
+	var err error
+	switch assetType {
+	case constants.AssetWalletResourceTypeIotCard:
+		result, err = s.purchaseValidation.ValidatePersonalCardPurchase(ctx, assetID, packageIDs)
+	case constants.AssetWalletResourceTypeDevice:
+		result, err = s.purchaseValidation.ValidatePersonalDevicePurchase(ctx, assetID, packageIDs)
+	default:
+		return 0, nil, nil, 0, errors.New(errors.CodeInvalidParam, "资产类型无效")
+	}
+	if err != nil {
+		return 0, nil, nil, 0, &renewalHalt{
+			FailureReason: constants.AssetAutoRenewalFailureNotRenewable,
+			Detail:        "当前条件不允许自动续购：" + purchaseValidationReason(err),
+		}
+	}
+	if len(result.Packages) == 0 {
+		return 0, nil, nil, 0, &renewalHalt{
+			FailureReason: constants.AssetAutoRenewalFailureNotRenewable,
+			Detail:        "当前条件不允许自动续购：未解析到可售续费套餐",
+		}
+	}
+	var sellerShop uint
+	if result.Card != nil && result.Card.ShopID != nil {
+		sellerShop = *result.Card.ShopID
+	}
+	if result.Device != nil && result.Device.ShopID != nil {
+		sellerShop = *result.Device.ShopID
+	}
+	costPrice := int64(0)
+	if sellerShop > 0 {
+		resolved, costErr := s.purchaseValidation.GetCostPrice(ctx, result.Packages[0], sellerShop)
+		if costErr != nil {
+			return 0, nil, nil, 0, &renewalHalt{
+				FailureReason: constants.AssetAutoRenewalFailureNotRenewable,
+				Detail:        "当前条件不允许自动续购：渠道成本价不可读",
+			}
+		}
+		costPrice = resolved
+	}
+	if result.TotalPrice <= 0 {
+		return 0, nil, nil, 0, &renewalHalt{
+			FailureReason: constants.AssetAutoRenewalFailureNotRenewable,
+			Detail:        "当前条件不允许自动续购：生效续费价异常",
+		}
+	}
+	var sellerShopPtr *uint
+	if sellerShop > 0 {
+		sellerShopPtr = &sellerShop
+	}
+	return result.TotalPrice, result.Packages[0], sellerShopPtr, costPrice, nil
+}
+
+// writeRenewalFacts 在同一事务内闭合扣款、订单、支付、钱包流水、套餐生效、可靠事件、尝试记录与审计。
+func (s *Service) writeRenewalFacts(ctx context.Context, tx *gorm.DB, plan *executionPlan, attempt *model.AssetAutoRenewalAttempt, facts *renewalFacts) error {
+	now := s.now()
+	wallet := plan.wallet
+	if err := s.assetWalletStore.DeductBalanceWithTx(ctx, tx, wallet.ID, plan.price, wallet.Version); err != nil {
+		return errors.Wrap(errors.CodeConflict, err, "资产钱包扣款失败")
+	}
+	order, item, err := s.buildRenewalOrder(ctx, tx, plan, now)
+	if err != nil {
+		return err
+	}
+	if err := tx.WithContext(ctx).Create(order).Error; err != nil {
+		return errors.Wrap(errors.CodeDatabaseError, err, "写入续费订单失败")
+	}
+	item.OrderID = order.ID
+	if err := tx.WithContext(ctx).Create(item).Error; err != nil {
+		return errors.Wrap(errors.CodeDatabaseError, err, "写入续费订单明细失败")
+	}
+	payment := &model.Payment{
+		PaymentNo:     order.OrderNo,
+		OrderID:       order.ID,
+		OrderType:     model.PaymentOrderTypePackage,
+		PaymentMethod: model.PaymentByWallet,
+		Amount:        plan.price,
+		Status:        model.PaymentRecordStatusPaid,
+	}
+	if err := tx.WithContext(ctx).Create(payment).Error; err != nil {
+		return errors.Wrap(errors.CodeDatabaseError, err, "写入续费支付记录失败")
+	}
+	referenceType := constants.ReferenceTypeOrder
+	walletTransaction := &model.AssetWalletTransaction{
+		AssetWalletID:   wallet.ID,
+		ResourceType:    wallet.ResourceType,
+		ResourceID:      wallet.ResourceID,
+		UserID:          plan.candidate.CustomerID,
+		TransactionType: constants.AssetTransactionTypeDeduct,
+		Amount:          -plan.price,
+		BalanceBefore:   wallet.Balance,
+		BalanceAfter:    wallet.Balance - plan.price,
+		Status:          constants.TransactionStatusSuccess,
+		ReferenceType:   &referenceType,
+		ReferenceNo:     &order.OrderNo,
+		Creator:         plan.candidate.CustomerID,
+		ShopIDTag:       wallet.ShopIDTag,
+		EnterpriseIDTag: wallet.EnterpriseIDTag,
+	}
+	if err := s.walletTransactionStore.CreateWithTx(ctx, tx, walletTransaction); err != nil {
+		return errors.Wrap(errors.CodeDatabaseError, err, "写入续费钱包流水失败")
+	}
+	usage, err := s.activateMainPackage(ctx, tx, order, plan, now)
+	if err != nil {
+		return err
+	}
+	if err := commissiondelivery.AppendCommissionCalculate(ctx, tx, s.outbox, order.ID); err != nil {
+		return err
+	}
+	if s.observationEvents == nil {
+		return errors.New(errors.CodeInvalidStatus, "自动续费观测 Outbox 未配置")
+	}
+	observationID := "asset-auto-renewal:" + strconv.FormatUint(uint64(attempt.ID), 10)
+	if err := s.observationEvents.AppendSeriesRequested(ctx, tx, cardObservationApp.SeriesRequestedEvent{
+		EventID: outboxEventID(observationID), Scene: constants.CardObservationScenePackageChanged,
+		ResourceType: observationResourceType(plan.asset.assetType), ResourceID: plan.asset.assetID,
+		SyncTypes: []string{
+			constants.CardObservationSyncTypeRealname, constants.CardObservationSyncTypeTraffic,
+			constants.CardObservationSyncTypeNetwork,
+		},
+		Source: constants.CardObservationSourceBusinessEvent, OccurredAt: now.UTC(),
+		RequestID: observationID, CorrelationID: observationID,
+	}); err != nil {
+		return err
+	}
+	updates := map[string]any{
+		"status":                constants.AssetAutoRenewalAttemptStatusSucceeded,
+		"failure_reason":        "",
+		"failure_detail":        "",
+		"skip_reason":           "",
+		"final_expires_at":      plan.candidate.FinalExpiresAt,
+		"current_usage_id":      plan.candidate.CurrentUsageID,
+		"current_package_id":    plan.candidate.CurrentPackageID,
+		"renew_package_id":      plan.pkg.ID,
+		"renew_price":           plan.price,
+		"wallet_id":             wallet.ID,
+		"wallet_transaction_id": walletTransaction.ID,
+		"deduct_amount":         plan.price,
+		"balance_before":        wallet.Balance,
+		"balance_after":         wallet.Balance - plan.price,
+		"order_id":              order.ID,
+		"order_no":              order.OrderNo,
+	}
+	// current_usage_id / current_package_id 保留**触发时**解析到的当前主套餐快照（规格 Requirement 7
+	// 要求「触发时解析」），不覆盖为本次新生成的套餐使用记录；新记录通过 order_id / order_no 追溯，
+	// 「续购后处于待生效」也可由 usage_after_success 断言直接观察。
+	resumeReady, resumeReason, err := s.evaluateResumeGate(ctx, plan)
+	if err != nil {
+		return err
+	}
+	if resumeReady {
+		updates["resume_status"] = constants.AssetAutoRenewalResumeStatusRequested
+		updates["resume_failure_reason"] = ""
+	} else {
+		updates["resume_status"] = constants.AssetAutoRenewalResumeStatusSkipped
+		updates["resume_failure_reason"] = resumeReason
+	}
+	updated, err := s.attemptStore.FinalizeInTx(ctx, tx, attempt.ID, updates)
+	if err != nil {
+		return err
+	}
+	if !updated {
+		return errors.Wrap(errors.CodeConflict, gorm.ErrInvalidData, "续费尝试已非处理中，拒绝重复成功")
+	}
+	facts.RenewPrice = plan.price
+	facts.OrderID = order.ID
+	facts.OrderNo = order.OrderNo
+	if resumeReady {
+		attempt.ResumeStatus = constants.AssetAutoRenewalResumeStatusRequested
+		if err := AppendResumeRequested(ctx, tx, s.outbox, attempt); err != nil {
+			return err
+		}
+	}
+	return s.appendRenewalAudit(ctx, tx, plan, attempt, order, payment, wallet, walletTransaction, usage, updates)
+}
+
+// evaluateResumeGate 在同一事务内按可复机判定给出复机去向。
+//
+// 判定只做数据库读取、不持有任何外部 I/O，因此可以安全地留在资金事务闭包内（ENG-TX-001）；
+// 它也不对资产钱包行或载体行加锁，因此不会与已持有的行锁形成等待。
+func (s *Service) evaluateResumeGate(ctx context.Context, plan *executionPlan) (bool, string, error) {
+	if s.resume == nil {
+		return false, "", errors.New(errors.CodeServiceUnavailable, "自动续费复机执行端口未配置")
+	}
+	ready, reason, err := s.resume.AutoRenewalResumeReady(ctx, plan.asset.assetType, plan.asset.assetID)
+	if err != nil {
+		return false, "", err
+	}
+	return ready, reason, nil
+}
+
+// buildRenewalOrder 组装续购订单与唯一明细：买家恒为当前个人客户，金额为执行时当前可售续费价。
+func (s *Service) buildRenewalOrder(ctx context.Context, tx *gorm.DB, plan *executionPlan, now time.Time) (*model.Order, *model.OrderItem, error) {
+	orderType := model.OrderTypeSingleCard
+	var iotCardID, deviceID *uint
+	if plan.asset.assetType == constants.AssetWalletResourceTypeDevice {
+		orderType = model.OrderTypeDevice
+		deviceID = &plan.asset.assetID
+	} else {
+		iotCardID = &plan.asset.assetID
+	}
+	generation := plan.asset.generation
+	if generation <= 0 {
+		generation = 1
+	}
+	paidAmount := plan.price
+	operatorAccountID, operatorAccountName := s.personalCustomerOperatorSnapshot(ctx, plan.candidate.CustomerID)
+	order := &model.Order{
+		BaseModel: model.BaseModel{Creator: plan.candidate.CustomerID, Updater: plan.candidate.CustomerID},
+		OrderNo:   s.orderStore.GenerateOrderNo(), OrderType: orderType,
+		BuyerType: model.BuyerTypePersonal, BuyerID: plan.candidate.CustomerID,
+		IotCardID: iotCardID, DeviceID: deviceID, AssetIdentifier: plan.asset.identifier,
+		TotalAmount: plan.price, PaymentMethod: model.PaymentMethodWallet,
+		PaymentStatus: model.PaymentStatusPaid, PaidAt: &now,
+		CommissionStatus: model.CommissionStatusPending, CommissionConfigVersion: 0,
+		Source: constants.OrderSourceClient, Generation: generation, ActualPaidAmount: &paidAmount,
+		OperatorAccountID: operatorAccountID, OperatorAccountType: model.OperatorAccountTypePersonalCustomer,
+		OperatorAccountName: operatorAccountName, SellerShopID: plan.sellerShop,
+		SeriesID: plan.asset.seriesID, SellerCostPrice: plan.costPrice,
+	}
+	item := &model.OrderItem{
+		BaseModel: model.BaseModel{Creator: plan.candidate.CustomerID, Updater: plan.candidate.CustomerID},
+		PackageID: plan.pkg.ID, PackageName: plan.pkg.PackageName, Quantity: 1,
+		UnitPrice: plan.price, Amount: plan.price,
+		PackagePriceConfigStatus: plan.pkg.PriceConfigStatus, PackageIsGift: plan.pkg.IsGift,
+	}
+	return order, item, nil
+}
+
+// personalCustomerOperatorSnapshot 读取个人客户昵称作为订单操作者名称快照。
+func (s *Service) personalCustomerOperatorSnapshot(ctx context.Context, customerID uint) (*uint, string) {
+	if customerID == 0 {
+		return nil, ""
+	}
+	customer, err := s.personalCustomerStore.GetByID(ctx, customerID)
+	if err != nil {
+		return &customerID, ""
+	}
+	return &customerID, customer.Nickname
+}
+
+// activateMainPackage 在同一事务内激活续购的主套餐：按既有排队规则决定待生效或立即生效。
+//
+// 资格前置保证本次执行前不存在待生效主套餐，因此续购最多领先一个周期；
+// 只有当当前主套餐在执行前刚好过期时新记录才立即生效，此时按既有规则追加套餐生效优先轮询请求。
+func (s *Service) activateMainPackage(ctx context.Context, tx *gorm.DB, order *model.Order, plan *executionPlan, now time.Time) (*model.PackageUsage, error) {
+	terms, err := packagepkg.ResolveTermsFromTx(ctx, tx, plan.pkg, order.SellerShopID)
+	if err != nil {
+		return nil, err
+	}
+	hasCurrentMain, err := packagepkg.HasCurrentMainPackageForQueue(tx.WithContext(ctx), plan.asset.assetType, plan.asset.assetID, now)
+	if err != nil {
+		return nil, err
+	}
+	var status, priority int
+	var activatedAt, expiresAt time.Time
+	var nextResetAt *time.Time
+	pendingRealnameActivation := false
+	if terms.ExpiryBase == constants.PackageExpiryBaseFromActivation {
+		realnamed, realnameErr := s.isCarrierRealnamed(ctx, tx, plan.asset.assetType, plan.asset.assetID)
+		if realnameErr != nil {
+			return nil, realnameErr
+		}
+		pendingRealnameActivation = !realnamed
+	}
+	if hasCurrentMain {
+		status = constants.PackageUsageStatusPending
+		var maxPriority int
+		if err := tx.WithContext(ctx).Model(&model.PackageUsage{}).
+			Where(carrierColumn(plan.asset.assetType)+" = ?", plan.asset.assetID).
+			Select("COALESCE(MAX(priority), 0)").Scan(&maxPriority).Error; err != nil {
+			return nil, errors.Wrap(errors.CodeDatabaseError, err, "查询套餐排队优先级失败")
+		}
+		priority = maxPriority + 1
+	} else {
+		priority = 1
+		if pendingRealnameActivation {
+			status = constants.PackageUsageStatusPending
+		} else {
+			status = constants.PackageUsageStatusActive
+			activatedAt = now
+			expiresAt = packagepkg.CalculateExpiryTime(terms.CalendarType, activatedAt, terms.DurationMonths, terms.DurationDays)
+			nextResetAt = packagepkg.CalculateNextResetTime(plan.pkg.DataResetCycle, terms.CalendarType, now, activatedAt)
+		}
+	}
+	virtualTotalMB, displayGainRatio, enableVirtualData := model.BuildPackageUsageSnapshotValues(plan.pkg)
+	retailAmount := order.TotalAmount
+	usage := &model.PackageUsage{
+		BaseModel: model.BaseModel{Creator: order.Creator, Updater: order.Creator},
+		OrderID:   order.ID, OrderNo: order.OrderNo,
+		PackageID: plan.pkg.ID, PackageName: plan.pkg.PackageName, UsageType: order.OrderType,
+		DataLimitMB:            plan.pkg.RealDataMB,
+		VirtualTotalMBSnapshot: virtualTotalMB, DisplayGainRatioSnapshot: displayGainRatio,
+		EnableVirtualDataSnapshot: enableVirtualData, Status: status, Priority: priority,
+		DataResetCycle: plan.pkg.DataResetCycle, PendingRealnameActivation: pendingRealnameActivation,
+		Generation: order.Generation, PaidAmount: &order.SellerCostPrice, RetailAmount: &retailAmount,
+		PackagePriceConfigStatus: plan.pkg.PriceConfigStatus, PackageIsGift: plan.pkg.IsGift,
+	}
+	terms.Apply(usage)
+	if plan.asset.assetType == constants.AssetWalletResourceTypeIotCard {
+		usage.IotCardID = plan.asset.assetID
+	} else {
+		usage.DeviceID = plan.asset.assetID
+	}
+	if status == constants.PackageUsageStatusActive {
+		usage.ActivatedAt = &activatedAt
+		usage.ExpiresAt = &expiresAt
+		usage.NextResetAt = nextResetAt
+	}
+	if err := tx.WithContext(ctx).Omit("status", "pending_realname_activation").Create(usage).Error; err != nil {
+		return nil, errors.Wrap(errors.CodeDatabaseError, err, "写入续费套餐使用记录失败")
+	}
+	if err := tx.WithContext(ctx).Model(usage).Updates(map[string]any{
+		"status": usage.Status, "pending_realname_activation": usage.PendingRealnameActivation,
+	}).Error; err != nil {
+		return nil, errors.Wrap(errors.CodeDatabaseError, err, "写回续费套餐使用记录状态失败")
+	}
+	if status != constants.PackageUsageStatusActive {
+		return usage, nil
+	}
+	triggerType, err := packagepkg.ResolveActivationTriggerType(ctx, tx, plan.asset.assetType, plan.asset.assetID, usage.ID)
+	if err != nil {
+		return nil, err
+	}
+	if err := packagepkg.AppendActivatedPriorityRequested(ctx, tx, s.priorityEvents, usage,
+		plan.asset.assetType, plan.asset.assetID, triggerType, activatedAt); err != nil {
+		return nil, err
+	}
+	return usage, nil
+}
+
+// isCarrierRealnamed 判断载体是否已满足实名激活条件，口径与既有自动购包一致。
+func (s *Service) isCarrierRealnamed(ctx context.Context, tx *gorm.DB, assetType string, assetID uint) (bool, error) {
+	switch assetType {
+	case constants.AssetWalletResourceTypeIotCard:
+		var card model.IotCard
+		if err := tx.WithContext(ctx).Select("real_name_status").First(&card, assetID).Error; err != nil {
+			return false, errors.Wrap(errors.CodeDatabaseError, err, "读取卡实名状态失败")
+		}
+		return card.RealNameStatus == constants.RealNameStatusVerified, nil
+	case constants.AssetWalletResourceTypeDevice:
+		var count int64
+		subQuery := tx.WithContext(ctx).Model(&model.DeviceSimBinding{}).
+			Select("iot_card_id").Where("device_id = ? AND bind_status = ?", assetID, constants.BindStatusBound)
+		if err := tx.WithContext(ctx).Model(&model.IotCard{}).
+			Where("id IN (?) AND real_name_status = ?", subQuery, constants.RealNameStatusVerified).
+			Count(&count).Error; err != nil {
+			return false, errors.Wrap(errors.CodeDatabaseError, err, "统计设备实名卡失败")
+		}
+		return count > 0, nil
+	default:
+		return false, errors.New(errors.CodeInvalidParam, "资产类型无效")
+	}
+}
+
+// lockCarrier 在事务内按资产类型对载体行加行锁，作为与人工路径共享的序列化点。
+func (s *Service) lockCarrier(ctx context.Context, tx *gorm.DB, assetType string, assetID uint) error {
+	switch assetType {
+	case constants.AssetWalletResourceTypeIotCard:
+		var card model.IotCard
+		if err := tx.WithContext(ctx).Clauses(clause.Locking{Strength: "UPDATE"}).First(&card, assetID).Error; err != nil {
+			return errors.Wrap(errors.CodeDatabaseError, err, "锁定资产载体失败")
+		}
+		return nil
+	case constants.AssetWalletResourceTypeDevice:
+		var device model.Device
+		if err := tx.WithContext(ctx).Clauses(clause.Locking{Strength: "UPDATE"}).First(&device, assetID).Error; err != nil {
+			return errors.Wrap(errors.CodeDatabaseError, err, "锁定资产载体失败")
+		}
+		return nil
+	default:
+		return errors.New(errors.CodeInvalidParam, "资产类型无效")
+	}
+}
+
+// lockAndSnapshotAsset 在已有行锁的事务内读取资产快照。
+func (s *Service) lockAndSnapshotAsset(ctx context.Context, tx *gorm.DB, assetType string, assetID uint) (*assetSnapshot, error) {
+	switch assetType {
+	case constants.AssetWalletResourceTypeIotCard:
+		var card model.IotCard
+		if err := tx.WithContext(ctx).First(&card, assetID).Error; err != nil {
+			return nil, errors.Wrap(errors.CodeDatabaseError, err, "读取续费卡事实失败")
+		}
+		if !card.IsStandalone {
+			return nil, &renewalHalt{
+				FailureReason: constants.AssetAutoRenewalFailureNotRenewable,
+				Detail:        "该卡已绑定设备，独立卡维度不执行自动续费",
+			}
+		}
+		return &assetSnapshot{
+			assetType: constants.AssetWalletResourceTypeIotCard, assetID: card.ID,
+			identifier: card.ICCID, shopID: card.ShopID, seriesID: card.SeriesID, generation: card.Generation,
+		}, nil
+	case constants.AssetWalletResourceTypeDevice:
+		var device model.Device
+		if err := tx.WithContext(ctx).First(&device, assetID).Error; err != nil {
+			return nil, errors.Wrap(errors.CodeDatabaseError, err, "读取续费设备事实失败")
+		}
+		identifier := device.VirtualNo
+		if identifier == "" {
+			identifier = device.IMEI
+		}
+		return &assetSnapshot{
+			assetType: constants.AssetWalletResourceTypeDevice, assetID: device.ID,
+			identifier: identifier, shopID: device.ShopID, seriesID: device.SeriesID, generation: device.Generation,
+		}, nil
+	default:
+		return nil, errors.New(errors.CodeInvalidParam, "资产类型无效")
+	}
+}
+
+// carrierColumn 返回套餐使用记录上的资产外键列名。
+func carrierColumn(assetType string) string {
+	if assetType == constants.AssetWalletResourceTypeDevice {
+		return "device_id"
+	}
+	return "iot_card_id"
+}
+
+// observationResourceType 把资产类型映射为观测序列的资源类型。
+func observationResourceType(assetType string) string {
+	if assetType == constants.AssetWalletResourceTypeDevice {
+		return constants.CardObservationResourceTypeDevice
+	}
+	return constants.CardObservationResourceTypeCard
+}
+
+// asRenewalHalt 从错误中取出终止信号，非终止信号返回 false。
+func asRenewalHalt(err error, target **renewalHalt) bool {
+	halt, ok := err.(*renewalHalt)
+	if !ok {
+		return false
+	}
+	*target = halt
+	return true
+}
+
+// appendRenewalAudit 在续费事务内写成功审计，资源覆盖尝试记录、订单、钱包、流水与套餐使用记录。
+func (s *Service) appendRenewalAudit(
+	ctx context.Context,
+	tx *gorm.DB,
+	plan *executionPlan,
+	attempt *model.AssetAutoRenewalAttempt,
+	order *model.Order,
+	payment *model.Payment,
+	wallet *model.AssetWallet,
+	walletTransaction *model.AssetWalletTransaction,
+	usage *model.PackageUsage,
+	updates map[string]any,
+) error {
+	if s.auditWriter == nil {
+		return errors.New(errors.CodeInvalidStatus, "自动续费统一审计接缝未配置")
+	}
+	attemptID := strconv.FormatUint(uint64(attempt.ID), 10)
+	resources := []audit.ResourceInput{{
+		Type: constants.AuditResourceAssetAutoRenewalAttempt, ID: &attemptID, Key: attemptID,
+		DisplayName: "自动续费尝试 " + attemptID,
+		Relation:    constants.AuditResourceRelationPrimary,
+		Role:        constants.AuditResourceRoleAssetAutoRenewalAttemptTarget,
+		IdentitySnapshot: map[string]any{
+			"id": attempt.ID, "asset_type": attempt.AssetType, "asset_id": attempt.AssetID,
+			"trigger_date":     formatShanghaiDate(&attempt.TriggerDate, s.now()),
+			"status":           constants.AssetAutoRenewalAttemptStatusSucceeded,
+			"renew_package_id": plan.pkg.ID, "renew_price": plan.price,
+			"wallet_id": wallet.ID, "wallet_transaction_id": walletTransaction.ID,
+			"deduct_amount": plan.price, "balance_before": wallet.Balance,
+			"balance_after": wallet.Balance - plan.price,
+			"order_id":      order.ID, "order_no": order.OrderNo,
+			"resume_status": updates["resume_status"],
+		},
+		BeforeData:        map[string]any{"status": constants.AssetAutoRenewalAttemptStatusProcessing},
+		AfterData:         map[string]any{"status": constants.AssetAutoRenewalAttemptStatusSucceeded, "failure_reason": ""},
+		SubjectVisibility: constants.AuditSubjectInternalOnly,
+	}}
+	orderResource := audit.OrderResource(order, constants.AuditResourceRelationAffected, constants.AuditResourceRoleAssetAutoRenewalOrder)
+	resources = append(resources, orderResource)
+	walletID := strconv.FormatUint(uint64(wallet.ID), 10)
+	resources = append(resources, audit.ResourceInput{
+		Type: constants.AuditResourceAssetWallet, ID: &walletID, Key: walletID, DisplayName: "资产钱包 " + walletID,
+		Relation: constants.AuditResourceRelationAffected, Role: constants.AuditResourceRoleAssetAutoRenewalWallet,
+		IdentitySnapshot: map[string]any{
+			"id": wallet.ID, "resource_type": wallet.ResourceType, "resource_id": wallet.ResourceID,
+		},
+		BeforeData: map[string]any{"balance": walletTransaction.BalanceBefore},
+		AfterData:  map[string]any{"balance": walletTransaction.BalanceAfter},
+	})
+	walletTxID := strconv.FormatUint(uint64(walletTransaction.ID), 10)
+	resources = append(resources, audit.ResourceInput{
+		Type: constants.AuditResourceAssetWalletTransaction, ID: &walletTxID, Key: walletTxID,
+		DisplayName: "资产钱包流水 " + walletTxID,
+		Relation:    constants.AuditResourceRelationAffected,
+		Role:        constants.AuditResourceRoleAssetAutoRenewalWalletTransaction,
+		IdentitySnapshot: map[string]any{
+			"id": walletTransaction.ID, "asset_wallet_id": walletTransaction.AssetWalletID,
+			"resource_type": walletTransaction.ResourceType, "resource_id": walletTransaction.ResourceID,
+			"transaction_type": walletTransaction.TransactionType,
+			"reference_no":     walletTransaction.ReferenceNo, "status": walletTransaction.Status,
+		},
+		AfterData: map[string]any{
+			"amount": walletTransaction.Amount, "balance_before": walletTransaction.BalanceBefore,
+			"balance_after": walletTransaction.BalanceAfter,
+		},
+	})
+	resources = append(resources, audit.PaymentResource(payment, constants.AuditResourceRelationReference, constants.AuditResourceRoleOrderPayment, nil, nil))
+	if usage != nil {
+		resources = append(resources, audit.PackageUsageResource(usage,
+			constants.AuditResourceRelationAffected, constants.AuditResourceRolePackageUsageTarget, nil, nil))
+	}
+	return s.auditWriter.Append(ctx, tx, audit.AppendInput{
+		ActionCode: constants.AuditActionAssetAutoRenewalRenewed, Summary: "资产钱包自动续费完成",
+		ScopeType: constants.AuditScopePlatform, Result: constants.AuditResultSuccess,
+		CorrelationID: order.OrderNo,
+		Metadata: map[string]any{
+			"asset_type": plan.asset.assetType, "asset_id": plan.asset.assetID,
+			"trigger_date": formatShanghaiDate(&attempt.TriggerDate, s.now()),
+		},
+		Resources: resources,
+	})
+}
+
+// appendFailureAudit 在独立短事务内写失败审计；跳过终态不写审计，由尝试记录本身承载（Domain Ledger）。
+func (s *Service) appendFailureAudit(ctx context.Context, tx *gorm.DB, attempt *model.AssetAutoRenewalAttempt, reason, detail string) error {
+	if s.auditWriter == nil {
+		return errors.New(errors.CodeInvalidStatus, "自动续费统一审计接缝未配置")
+	}
+	attemptID := strconv.FormatUint(uint64(attempt.ID), 10)
+	return s.auditWriter.Append(ctx, tx, audit.AppendInput{
+		ActionCode: constants.AuditActionAssetAutoRenewalFailed, Summary: "资产钱包自动续费失败",
+		ScopeType: constants.AuditScopePlatform, Result: constants.AuditResultFailed,
+		ErrorCode: strconv.Itoa(reasonCode(reason)), ErrorSummary: detail,
+		CorrelationID: attemptID,
+		Metadata: map[string]any{
+			"asset_type": attempt.AssetType, "asset_id": attempt.AssetID,
+			"trigger_date": formatShanghaiDate(&attempt.TriggerDate, s.now()), "failure_reason": reason,
+		},
+		Resources: []audit.ResourceInput{{
+			Type: constants.AuditResourceAssetAutoRenewalAttempt, ID: &attemptID, Key: attemptID,
+			DisplayName: "自动续费尝试 " + attemptID,
+			Relation:    constants.AuditResourceRelationPrimary,
+			Role:        constants.AuditResourceRoleAssetAutoRenewalAttemptTarget,
+			IdentitySnapshot: map[string]any{
+				"id": attempt.ID, "asset_type": attempt.AssetType, "asset_id": attempt.AssetID,
+				"trigger_date":   formatShanghaiDate(&attempt.TriggerDate, s.now()),
+				"status":         constants.AssetAutoRenewalAttemptStatusFailed,
+				"failure_reason": reason,
+			},
+			BeforeData:        map[string]any{"status": constants.AssetAutoRenewalAttemptStatusProcessing},
+			AfterData:         map[string]any{"status": constants.AssetAutoRenewalAttemptStatusFailed, "failure_reason": reason},
+			SubjectVisibility: constants.AuditSubjectInternalOnly,
+		}},
+	})
+}
+
+// reasonCode 把失败归类映射为审计错误码位，便于按原因检索失败事件。
+func reasonCode(reason string) int {
+	switch reason {
+	case constants.AssetAutoRenewalFailureInsufficientBalance:
+		return 1
+	case constants.AssetAutoRenewalFailureNotRenewable:
+		return 2
+	case constants.AssetAutoRenewalFailureOrderFailed:
+		return 3
+	default:
+		return 0
+	}
+}
+
+// purchaseValidationReason 从购买校验错误中提取可安全记录的说明，不写底层错误细节。
+func purchaseValidationReason(err error) string {
+	if err == nil {
+		return ""
+	}
+	message := err.Error()
+	switch {
+	case strings.Contains(message, "套餐已禁用"):
+		return "套餐商品被禁用"
+	case strings.Contains(message, "套餐已下架"):
+		return "当前渠道下架且不满足续费豁免"
+	case strings.Contains(message, "价格配置异常"):
+		return "生效零售价低于成本价"
+	case strings.Contains(message, "可购买范围"), strings.Contains(message, "未关联套餐系列"),
+		strings.Contains(message, "绑定设备"):
+		return "不在可购买范围或资产未关联套餐系列"
+	case strings.Contains(message, "赠送套餐"):
+		return "赠送套餐不参与自动续购"
+	default:
+		return "当前条件不允许自动续购"
+	}
+}
+
+// outboxEventID 把观测事件标识裁剪进 Outbox 的事件 ID 长度预算。
+func outboxEventID(value string) string {
+	return outboxid.Stable("card-observation:", value)
+}

internal/application/assetautorenewal/scan.go

@@ -0,0 +1,245 @@
+package assetautorenewal
+
+import (
+	"context"
+	"time"
+
+	"go.uber.org/zap"
+	"gorm.io/gorm"
+
+	"github.com/break/junhong_cmp_fiber/internal/model"
+	assetquery "github.com/break/junhong_cmp_fiber/internal/query/assetautorenewal"
+	"github.com/break/junhong_cmp_fiber/pkg/constants"
+	"github.com/break/junhong_cmp_fiber/pkg/errors"
+)
+
+// ScanResult 汇总一次每日扫描的可观察结果。
+type ScanResult struct {
+	Converged  int64
+	Candidates int
+	Attempted  int
+	Succeeded  int
+	Failed     int
+	Skipped    int
+	Duplicated int
+}
+
+// RunDailyScan 执行一次每日自动续费扫描：先收敛历史非终态尝试，再按资产扫描候选并逐项执行。
+//
+// 只有扫描级失败（配置读取、候选读取、数据库不可用）返回错误交既有任务重试；单个资产执行失败
+// 在用例内捕获并落终态后继续处理其余资产。总开关关闭时不创建任何新尝试与订单，既有记录保留。
+func (s *Service) RunDailyScan(ctx context.Context) (ScanResult, error) {
+	result := ScanResult{}
+	if s.db == nil {
+		return result, errors.New(errors.CodeServiceUnavailable, "自动续费用例未配置")
+	}
+	converged, err := s.attemptStore.ConvergeUnfinished(ctx, s.today())
+	if err != nil {
+		return result, err
+	}
+	result.Converged = converged
+	if converged > 0 {
+		s.logger.Info("自动续费历史非终态尝试已收敛", zap.Int64("converged", converged))
+	}
+	config, err := s.configStore.Get(ctx)
+	if err != nil {
+		if err == gorm.ErrRecordNotFound {
+			return result, errors.New(errors.CodeNotFound, "自动续费配置不存在")
+		}
+		return result, errors.Wrap(errors.CodeDatabaseError, err, "读取自动续费配置失败")
+	}
+	if config.Enabled != 1 {
+		s.logger.Info("自动续费总开关关闭，本次扫描不创建尝试与订单")
+		return result, nil
+	}
+	if config.Scope != constants.AssetAutoRenewalScopeAll && config.Scope != constants.AssetAutoRenewalScopeSpecified {
+		return result, errors.New(errors.CodeInvalidStatus, "自动续费配置范围取值非法")
+	}
+	candidates, err := s.candidates.Candidates(ctx, config.DaysBeforeExpiry)
+	if err != nil {
+		return result, err
+	}
+	result.Candidates = len(candidates)
+	scope := newScopeMatcher(config)
+	for _, candidate := range candidates {
+		if !scope.matches(candidate.CurrentPackageID) {
+			continue
+		}
+		outcome, processErr := s.processCandidate(ctx, candidate, config)
+		if processErr != nil {
+			// 单资产失败已落终态，继续处理其余资产；扫描任务本身不因该资产失败而失败。
+			s.logger.Error("自动续费单资产执行失败，继续处理其余资产",
+				zap.String("asset_type", candidate.AssetType), zap.Uint("asset_id", candidate.AssetID),
+				zap.Error(processErr))
+			result.Failed++
+			continue
+		}
+		switch outcome {
+		case candidateSucceeded:
+			result.Attempted++
+			result.Succeeded++
+		case candidateFailed:
+			result.Attempted++
+			result.Failed++
+		case candidateSkipped:
+			result.Attempted++
+			result.Skipped++
+		default:
+			result.Duplicated++
+		}
+	}
+	s.logger.Info("自动续费每日扫描完成",
+		zap.Int64("converged", result.Converged), zap.Int("candidates", result.Candidates),
+		zap.Int("succeeded", result.Succeeded), zap.Int("failed", result.Failed),
+		zap.Int("skipped", result.Skipped), zap.Int("duplicated", result.Duplicated))
+	return result, nil
+}
+
+// scanOutcome 是一次候选处理的终态归属，用于汇总扫描结果。
+type scanOutcome int
+
+const (
+	candidateDuplicated scanOutcome = iota
+	candidateSucceeded
+	candidateFailed
+	candidateSkipped
+)
+
+// scopeMatcher 表达配置的适用范围：全部主套餐，或指定主套餐集合。
+//
+// 运行时只按当前主套餐商品是否在集合内判定，不因后来下架而拒绝——下架交给续费豁免判定。
+type scopeMatcher struct {
+	all        bool
+	packageIDs map[uint]struct{}
+}
+
+func newScopeMatcher(config *model.AssetAutoRenewalConfig) scopeMatcher {
+	if config.Scope == constants.AssetAutoRenewalScopeAll {
+		return scopeMatcher{all: true}
+	}
+	ids := make(map[uint]struct{}, len(config.PackageIDs))
+	for _, packageID := range config.PackageIDs {
+		ids[packageID] = struct{}{}
+	}
+	return scopeMatcher{packageIDs: ids}
+}
+
+func (m scopeMatcher) matches(packageID uint) bool {
+	if m.all {
+		return true
+	}
+	_, exists := m.packageIDs[packageID]
+	return exists
+}
+
+// processCandidate 处理单个候选：占位写入、执行、落终态与通知。
+//
+// 占位冲突表示该资产当日已尝试，直接跳过且不重复扣款；执行阶段的失败与跳过各以独立短事务落终态。
+func (s *Service) processCandidate(ctx context.Context, candidate assetquery.Candidate, config *model.AssetAutoRenewalConfig) (scanOutcome, error) {
+	triggerDate := s.today()
+	attempt, err := s.buildAttempt(ctx, candidate, config, triggerDate)
+	if err != nil {
+		return candidateFailed, err
+	}
+	created, err := s.attemptStore.CreatePlaceholder(ctx, attempt)
+	if err != nil {
+		return candidateFailed, err
+	}
+	if !created {
+		s.logger.Info("该资产当日已存在自动续费尝试，跳过",
+			zap.String("asset_type", candidate.AssetType), zap.Uint("asset_id", candidate.AssetID))
+		return candidateDuplicated, nil
+	}
+	facts, halt, err := s.executeRenewal(ctx, candidate, attempt, config.DaysBeforeExpiry)
+	if halt != nil {
+		if halt.SkipReason != "" {
+			return candidateSkipped, s.finalizeSkip(ctx, attempt, halt)
+		}
+		return candidateFailed, s.finalizeFailure(ctx, attempt, halt.FailureReason, halt.Detail)
+	}
+	if err != nil {
+		s.logger.Error("自动续费事务失败并已整体回滚",
+			zap.String("asset_type", candidate.AssetType), zap.Uint("asset_id", candidate.AssetID), zap.Error(err))
+		return candidateFailed, s.finalizeFailure(ctx, attempt, constants.AssetAutoRenewalFailureOrderFailed,
+			"续购事务执行失败并已整体回滚，未产生订单、扣款与套餐事实")
+	}
+	s.logger.Info("自动续费续购成功",
+		zap.String("asset_type", candidate.AssetType), zap.Uint("asset_id", candidate.AssetID),
+		zap.Uint("order_id", facts.OrderID), zap.String("order_no", facts.OrderNo),
+		zap.Int64("renew_price", facts.RenewPrice))
+	return candidateSucceeded, nil
+}
+
+// buildAttempt 组装占位尝试记录，冻结触发时的客户、店铺、配置窗口与套餐快照。
+func (s *Service) buildAttempt(ctx context.Context, candidate assetquery.Candidate, config *model.AssetAutoRenewalConfig, triggerDate time.Time) (*model.AssetAutoRenewalAttempt, error) {
+	sequence, err := s.attemptStore.CountByAsset(ctx, candidate.AssetType, candidate.AssetID, triggerDate)
+	if err != nil {
+		return nil, err
+	}
+	finalExpiresAt := candidate.FinalExpiresAt
+	attempt := &model.AssetAutoRenewalAttempt{
+		AssetType: candidate.AssetType, AssetID: candidate.AssetID, TriggerDate: triggerDate,
+		Status:        constants.AssetAutoRenewalAttemptStatusProcessing,
+		CustomerID:    candidate.CustomerID,
+		ShopID:        candidate.ShopID,
+		ConfigVersion: config.ConfigVersion, WindowDays: config.DaysBeforeExpiry,
+		FinalExpiresAt:   &finalExpiresAt,
+		CurrentUsageID:   candidate.CurrentUsageID,
+		CurrentPackageID: candidate.CurrentPackageID,
+		RenewPackageID:   candidate.CurrentPackageID,
+		OperatorType:     constants.AssetAutoRenewalOperatorTypeSystemTask,
+		OperatorID:       constants.TaskTypeAssetAutoRenewalScan,
+		AttemptSeq:       int(sequence) + 1,
+	}
+	return attempt, nil
+}
+
+// finalizeSkip 以独立短事务落跳过终态：不扣款、不建订单、不发送通知。
+func (s *Service) finalizeSkip(ctx context.Context, attempt *model.AssetAutoRenewalAttempt, halt *renewalHalt) error {
+	_, err := s.attemptStore.Finalize(ctx, attempt.ID, map[string]any{
+		"status":         constants.AssetAutoRenewalAttemptStatusSkipped,
+		"skip_reason":    halt.SkipReason,
+		"failure_reason": "",
+		"failure_detail": halt.Detail,
+	})
+	if err != nil {
+		return err
+	}
+	s.logger.Info("自动续费跳过该资产",
+		zap.String("asset_type", attempt.AssetType), zap.Uint("asset_id", attempt.AssetID),
+		zap.String("skip_reason", halt.SkipReason))
+	return nil
+}
+
+// finalizeFailure 以独立短事务落失败终态，并在同一事务内投递通知与写失败审计。
+//
+// 该短事务与已回滚的续费事务不共用连接或事务（ENG-TX-001 例外），条件更新依据尝试记录仍非终态；
+// 已被并发收敛时不再投递通知与审计。中断收敛（interrupted）不属于通知口径，不会被通知。
+func (s *Service) finalizeFailure(ctx context.Context, attempt *model.AssetAutoRenewalAttempt, reason, detail string) error {
+	return s.db.WithContext(ctx).Transaction(func(tx *gorm.DB) error {
+		updated, err := s.attemptStore.FinalizeInTx(ctx, tx, attempt.ID, map[string]any{
+			"status":         constants.AssetAutoRenewalAttemptStatusFailed,
+			"failure_reason": reason,
+			"failure_detail": detail,
+			"skip_reason":    "",
+		})
+		if err != nil {
+			return err
+		}
+		if !updated {
+			s.logger.Info("自动续费尝试已被并发收敛，跳过通知与审计",
+				zap.Uint("attempt_id", attempt.ID))
+			return nil
+		}
+		if notifyErr := s.appendFailureNotifications(ctx, tx, failureNotification{
+			AttemptID: attempt.ID, AssetType: attempt.AssetType, AssetID: attempt.AssetID,
+			Identifier: s.assetIdentifier(ctx, attempt.AssetType, attempt.AssetID),
+			ShopID:     attempt.ShopID, CustomerID: attempt.CustomerID,
+			TriggerDate: attempt.TriggerDate, Reason: reason,
+			PackageName: s.packageName(ctx, attempt.RenewPackageID), FinalExpiresAt: attempt.FinalExpiresAt,
+		}); notifyErr != nil {
+			return notifyErr
+		}
+		return s.appendFailureAudit(ctx, tx, attempt, reason, detail)
+	})
+}

internal/application/assetautorenewal/service.go

@@ -0,0 +1,178 @@
+// Package assetautorenewal 编排资产钱包自动续费：受控配置维护、每日扫描与尝试、续费事务闭合、
+// 失败通知与复机可靠投递。
+//
+// 本包不调用任何支付渠道或运营商接口：续购价格与可售判定复用应用层购买校验与价格策略，
+// 复机执行通过 ResumeCommander 端口复用既有停复机单一事实源，通知与复机都通过公共 Outbox
+// 在业务事务内写出事件（ENG-OUTBOX-001）。资金、订单、套餐与成功审计在同一事务内闭合（ENG-TX-001）。
+package assetautorenewal
+
+import (
+	"context"
+	"strconv"
+	"time"
+
+	"github.com/redis/go-redis/v9"
+	"go.uber.org/zap"
+	"gorm.io/gorm"
+
+	cardObservationApp "github.com/break/junhong_cmp_fiber/internal/application/cardobservation"
+	priorityapp "github.com/break/junhong_cmp_fiber/internal/application/prioritypolling"
+	"github.com/break/junhong_cmp_fiber/internal/infrastructure/audit"
+	"github.com/break/junhong_cmp_fiber/internal/infrastructure/messaging/outbox"
+	"github.com/break/junhong_cmp_fiber/internal/model"
+	assetquery "github.com/break/junhong_cmp_fiber/internal/query/assetautorenewal"
+	"github.com/break/junhong_cmp_fiber/internal/service/purchase_validation"
+	"github.com/break/junhong_cmp_fiber/internal/store/postgres"
+	"github.com/break/junhong_cmp_fiber/pkg/constants"
+	"github.com/break/junhong_cmp_fiber/pkg/errors"
+)
+
+var shanghaiLocation = time.FixedZone("Asia/Shanghai", 8*60*60)
+
+// ResumeOutcome 是一次复机调用可安全记录的结果摘要。
+//
+// Applied 为 false 表示本次未满足可复机条件、没有发起任何复机调用；Result 取值
+// constants.AuditResultSuccess / Failed / Unknown。
+type ResumeOutcome struct {
+	Applied       bool
+	IntegrationID string
+	Result        string
+	SafeReason    string
+}
+
+// ResumeCommander 是自动续费成功后复机的执行边界。
+//
+// 实现必须复用既有停复机单一事实源（重试、Integration Log、统一审计、观测序列）与既有
+// 套餐/流量/实名/风险判定；本包绝不复制这些规则，也绝不直接调用运营商接口。
+type ResumeCommander interface {
+	// AutoRenewalResumeReady 判断该资产当前是否满足自动复机条件；不满足时返回可安全记录的原因。
+	AutoRenewalResumeReady(ctx context.Context, assetType string, assetID uint) (bool, string, error)
+	// ResumeAssetForAutoRenewal 执行复机并返回结果分类。
+	ResumeAssetForAutoRenewal(ctx context.Context, assetType string, assetID uint) (ResumeOutcome, error)
+	// QueryAutoRenewalResumeState 只查询运营商状态回填复机结果，绝不重复发起复机。
+	QueryAutoRenewalResumeState(ctx context.Context, assetType string, assetID uint) (online bool, known bool, integrationID string, err error)
+}
+
+// Dependencies 汇总自动续费用例的装配依赖。
+//
+// DB 与 Redis 用于构造本用例独占的资产钱包、流水、订单、套餐与资产 Store；
+// 其余依赖是配置、价格、候选、复机与可靠事件的能力边界。
+type Dependencies struct {
+	DB                 *gorm.DB
+	Redis              *redis.Client
+	Logger             *zap.Logger
+	Outbox             *outbox.Repository
+	AuditWriter        *audit.Writer
+	PurchaseValidation *purchase_validation.Service
+	Candidates         *assetquery.Query
+	Resume             ResumeCommander
+	ObservationEvents  cardObservationApp.SeriesEventWriter
+	PriorityEvents     priorityapp.PriorityEventWriter
+}
+
+// Service 执行资产钱包自动续费的配置维护、每日扫描、续费事务与终止态收敛。
+type Service struct {
+	db                     *gorm.DB
+	configStore            *postgres.AssetAutoRenewalConfigStore
+	attemptStore           *postgres.AssetAutoRenewalAttemptStore
+	assetWalletStore       *postgres.AssetWalletStore
+	walletTransactionStore *postgres.AssetWalletTransactionStore
+	orderStore             *postgres.OrderStore
+	packageUsageStore      *postgres.PackageUsageStore
+	packageStore           *postgres.PackageStore
+	iotCardStore           *postgres.IotCardStore
+	deviceStore            *postgres.DeviceStore
+	personalCustomerStore  *postgres.PersonalCustomerStore
+	candidates             *assetquery.Query
+	purchaseValidation     *purchase_validation.Service
+	outbox                 *outbox.Repository
+	auditWriter            *audit.Writer
+	resume                 ResumeCommander
+	observationEvents      cardObservationApp.SeriesEventWriter
+	priorityEvents         priorityapp.PriorityEventWriter
+	logger                 *zap.Logger
+	now                    func() time.Time
+}
+
+// NewService 创建资产钱包自动续费用例。
+func NewService(deps Dependencies) *Service {
+	logger := deps.Logger
+	if logger == nil {
+		logger = zap.NewNop()
+	}
+	return &Service{
+		db:                     deps.DB,
+		configStore:            postgres.NewAssetAutoRenewalConfigStore(deps.DB),
+		attemptStore:           postgres.NewAssetAutoRenewalAttemptStore(deps.DB),
+		assetWalletStore:       postgres.NewAssetWalletStore(deps.DB, deps.Redis),
+		walletTransactionStore: postgres.NewAssetWalletTransactionStore(deps.DB, deps.Redis),
+		orderStore:             postgres.NewOrderStore(deps.DB, deps.Redis),
+		packageUsageStore:      postgres.NewPackageUsageStore(deps.DB, deps.Redis),
+		packageStore:           postgres.NewPackageStore(deps.DB),
+		iotCardStore:           postgres.NewIotCardStore(deps.DB, deps.Redis),
+		deviceStore:            postgres.NewDeviceStore(deps.DB, deps.Redis),
+		personalCustomerStore:  postgres.NewPersonalCustomerStore(deps.DB, deps.Redis),
+		candidates:             deps.Candidates,
+		purchaseValidation:     deps.PurchaseValidation,
+		outbox:                 deps.Outbox,
+		auditWriter:            deps.AuditWriter,
+		resume:                 deps.Resume,
+		observationEvents:      deps.ObservationEvents,
+		priorityEvents:         deps.PriorityEvents,
+		logger:                 logger,
+		now:                    time.Now,
+	}
+}
+
+// today 返回当前上海自然日，作为触发日期与每日唯一键的统一口径。
+func (s *Service) today() time.Time {
+	return assetquery.Today(s.now())
+}
+
+// assetIdentifier 读取资产对外的可读标识，取不到时回退为资产 ID 文本。
+// 通知模板要求标识非空，因此绝不返回空串。
+func (s *Service) assetIdentifier(ctx context.Context, assetType string, assetID uint) string {
+	switch assetType {
+	case constants.AssetWalletResourceTypeIotCard:
+		if card, err := s.iotCardStore.GetByID(ctx, assetID); err == nil && card.ICCID != "" {
+			return card.ICCID
+		}
+	case constants.AssetWalletResourceTypeDevice:
+		if device, err := s.deviceStore.GetByID(ctx, assetID); err == nil {
+			if device.VirtualNo != "" {
+				return device.VirtualNo
+			}
+			if device.IMEI != "" {
+				return device.IMEI
+			}
+		}
+	}
+	return strconv.FormatUint(uint64(assetID), 10)
+}
+
+// packageName 读取套餐商品名称，取不到时回退为套餐 ID 文本。
+func (s *Service) packageName(ctx context.Context, packageID uint) string {
+	if packageID == 0 {
+		return "未知套餐"
+	}
+	if pkg, err := s.packageStore.GetByID(ctx, packageID); err == nil && pkg.PackageName != "" {
+		return pkg.PackageName
+	}
+	return strconv.FormatUint(uint64(packageID), 10)
+}
+
+// loadPackagesByIDs 批量读取套餐商品，用于一次性取价与快照。
+func (s *Service) loadPackagesByIDs(ctx context.Context, packageIDs []uint) (map[uint]*model.Package, error) {
+	result := make(map[uint]*model.Package, len(packageIDs))
+	if len(packageIDs) == 0 {
+		return result, nil
+	}
+	var packages []*model.Package
+	if err := s.db.WithContext(ctx).Where("id IN ?", packageIDs).Find(&packages).Error; err != nil {
+		return nil, errors.Wrap(errors.CodeDatabaseError, err, "读取自动续费套餐商品失败")
+	}
+	for _, pkg := range packages {
+		result[pkg.ID] = pkg
+	}
+	return result, nil
+}

internal/application/notification/read.go

@@ -219,6 +219,7 @@ func personalReadScope(db *gorm.DB, customerID uint, now time.Time) *gorm.DB {
 			constants.NotificationTypeExchangeShippingCreated,
 			constants.NotificationTypeH5PopupRiskExchange,
 			constants.NotificationTypeH5PopupOperation,
+			constants.NotificationTypeAssetAutoRenewalFailed,
 		},
 		now,
 	)