fix(billing): 封住发布前计费竞态

阻止上游提交状态不明的任务被租约接管后重复执行，并为人工复核保留可操作的结算记录。

将生产提交绑定到当前估价签名，统一复用预处理快照，并补强规则形状、定点溢出与历史规则兼容校验。

已通过 PostgreSQL 16 集成测试、Go 全量测试与静态检查、前端测试与构建、OpenAPI、依赖审计、镜像、迁移、流水线和 SemVer 门禁。

apps/api/internal/store/tasks_runtime.go

@@ -157,7 +157,83 @@ func (s *Store) ClaimTaskExecution(ctx context.Context, taskID string, execution
 	if leaseTTL <= 0 {
 		leaseTTL = 5 * time.Minute
 	}
-	task, err := scanGatewayTask(s.pool.QueryRow(ctx, `
+	var task GatewayTask
+	manualReview := false
+	err := pgx.BeginFunc(ctx, s.pool, func(tx pgx.Tx) error {
+		var queuedReady bool
+		var runningExpired bool
+		var production bool
+		var hasGatewayUser bool
+		if err := tx.QueryRow(ctx, `
+SELECT status = 'queued' AND next_run_at <= now(),
+       status = 'running' AND (execution_lease_expires_at IS NULL OR execution_lease_expires_at <= now()),
+       run_mode = 'production',
+       gateway_user_id IS NOT NULL
+FROM gateway_tasks
+WHERE id = $1::uuid
+FOR UPDATE`, taskID).Scan(&queuedReady, &runningExpired, &production, &hasGatewayUser); err != nil {
+			return err
+		}
+		if !queuedReady && !runningExpired {
+			return ErrTaskExecutionLeaseUnavailable
+		}
+		if runningExpired && production {
+			var submissionAmbiguous bool
+			if err := tx.QueryRow(ctx, `
+SELECT COALESCE((
+  SELECT (
+    (status = 'running' AND upstream_submission_status IN ('submitting', 'response_received'))
+    OR (status = 'failed' AND upstream_submission_status = 'submitting')
+  )
+  FROM gateway_task_attempts
+  WHERE task_id = $1::uuid
+  ORDER BY attempt_no DESC, started_at DESC
+  LIMIT 1
+), false)`, taskID).Scan(&submissionAmbiguous); err != nil {
+				return err
+			}
+			if submissionAmbiguous {
+				if _, err := tx.Exec(ctx, `
+UPDATE gateway_tasks
+SET status = 'failed',
+    billing_status = CASE WHEN $2 THEN 'manual_review' ELSE 'not_required' END,
+    billing_updated_at = now(),
+    error = 'upstream submission result is unknown',
+    error_code = 'upstream_submission_unknown',
+    error_message = 'upstream submission result is unknown',
+    locked_by = NULL,
+    locked_at = NULL,
+    heartbeat_at = NULL,
+    execution_token = NULL,
+    execution_lease_expires_at = NULL,
+    finished_at = now(),
+    updated_at = now()
+WHERE id = $1::uuid`, taskID, hasGatewayUser); err != nil {
+					return err
+				}
+				if hasGatewayUser {
+					payloadJSON, _ := json.Marshal(map[string]any{
+						"taskId": taskID, "classification": "upstream_submission_unknown",
+					})
+					if _, err := tx.Exec(ctx, `
+INSERT INTO settlement_outbox (
+  task_id, event_type, action, amount, currency, pricing_snapshot, payload,
+  status, next_attempt_at, manual_review_reason
+)
+SELECT id, 'task.billing.review', 'release', reservation_amount, billing_currency,
+       pricing_snapshot, $2::jsonb, 'manual_review', now(), 'upstream_submission_unknown'
+FROM gateway_tasks
+WHERE id = $1::uuid
+ON CONFLICT (task_id, event_type) DO NOTHING`, taskID, string(payloadJSON)); err != nil {
+						return err
+					}
+				}
+				manualReview = true
+				return nil
+			}
+		}
+		var err error
+		task, err = scanGatewayTask(tx.QueryRow(ctx, `
 UPDATE gateway_tasks
 SET status = 'running',
     execution_token = $2::uuid,
@@ -171,10 +247,18 @@ WHERE id = $1::uuid
     OR (status = 'running' AND (execution_lease_expires_at IS NULL OR execution_lease_expires_at <= now()))
   )
 RETURNING `+gatewayTaskColumns, taskID, executionToken, int(leaseTTL/time.Second)))
-	if errors.Is(err, pgx.ErrNoRows) {
-		return GatewayTask{}, ErrTaskExecutionLeaseUnavailable
+		return err
+	})
+	if err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return GatewayTask{}, ErrTaskExecutionLeaseUnavailable
+		}
+		return GatewayTask{}, err
 	}
-	return task, err
+	if manualReview {
+		return GatewayTask{}, ErrTaskExecutionManualReview
+	}
+	return task, nil
 }
 
 func (s *Store) RenewTaskExecutionLease(ctx context.Context, taskID string, executionToken string, leaseTTL time.Duration) error {
@@ -193,6 +277,14 @@ WHERE id = $1::uuid
 		return err
 	}
 	if tag.RowsAffected() != 1 {
+		var stillRunning bool
+		if err := s.pool.QueryRow(ctx, `
+SELECT COALESCE((SELECT status = 'running' FROM gateway_tasks WHERE id = $1::uuid), false)`, taskID).Scan(&stillRunning); err != nil {
+			return err
+		}
+		if !stillRunning {
+			return ErrTaskExecutionFinished
+		}
 		return ErrTaskExecutionLeaseLost
 	}
 	return nil
@@ -902,8 +994,7 @@ SET status = $2,
     response_started_at = $6::timestamptz,
     response_finished_at = $7::timestamptz,
     response_duration_ms = $8,
-    finished_at = now(),
-    updated_at = now()
+    finished_at = now()
 WHERE id = $1::uuid`, input.AttemptID, attemptStatus, input.RequestID, input.Code, input.Message,
 				nullableTime(input.ResponseStartedAt), nullableTime(input.ResponseFinishedAt), input.ResponseDurationMS); err != nil {
 				return err
@@ -942,7 +1033,22 @@ WHERE id = $1::uuid
 		if tag.RowsAffected() != 1 {
 			return ErrTaskExecutionLeaseLost
 		}
-		return nil
+		payloadJSON, _ := json.Marshal(map[string]any{
+			"taskId": input.TaskID, "classification": input.Code,
+		})
+		_, err = tx.Exec(ctx, `
+INSERT INTO settlement_outbox (
+  task_id, event_type, action, amount, currency, pricing_snapshot, payload,
+  status, next_attempt_at, manual_review_reason
+)
+SELECT id, 'task.billing.review', 'release', reservation_amount, billing_currency,
+       pricing_snapshot, $2::jsonb, 'manual_review', now(), $3
+FROM gateway_tasks
+WHERE id = $1::uuid
+  AND run_mode = 'production'
+  AND gateway_user_id IS NOT NULL
+ON CONFLICT (task_id, event_type) DO NOTHING`, input.TaskID, string(payloadJSON), input.Code)
+		return err
 	})
 	if err != nil {
 		return GatewayTask{}, err