[KCL1104]

Summary

• Preserve the existing visual design. Replace enterprise targeting and duplicate search/notes fields with one multiline requirement area and optional files; budget, invoice and certification remain separate controls.
• Separate service/supplier labels: 會飛分析師 provides 個股分析 / 期貨分析; mello資本 provides 總經分析 / 加密市場資訊. Implement all four Demo report types across parsing, category checks, Seller wire protocol, buyer delivery binding and invoice item names.
• Save actual attachment bytes in PostgreSQL, with authenticated metadata/download, SHA-256 validation, bounded sizes/quotas and idempotent upload references. Files are not parsed, read by a model or sent to Sellers/Bazaar.
• Creating a modern request atomically links files and queues a discovery-only job. Visible flow: 提交需求 → 選擇服務 → 付款與憑證. No second exploration click and no payment until selection. Generation guards and a cross-kind unique index protect late/replayed workers.
• First invoice attempt succeeds in the normal Demo configuration. Retain genuine failure recovery, immutable historical evidence and necessary test-invoice/payment-mode disclosures. Normal UI does not expose raw invoice provider mode names.
• Support old unqueued drafts, lost-response recovery with the original key, and explicit re-upload after confirmed attachment expiry.
• Preserve guarded catalog migration: new IDs start UNREVIEWED; archive legacy A–D without rewriting legal identities, wallets, historical payments/invoices/caches or certifications. Reject stale credit-only Bazaar metadata; never silently substitute another category/local service.

Verification

• API unit: 53 files / 550 tests passed.
• Isolated loopback PostgreSQL: 20 files / 123 tests passed, including four modern procurement flows, durable discovery, real attachment persistence and catalog/history guards.
• Web unit: 27 tests passed. API/Web/Docs typecheck and lint passed (Docs retains its existing image warning); Web and Docs production builds passed.
• Python Playwright, local production Web at 375/768/1280: 13 complete fixture purchases, 41 intercepted writes, first-attempt invoices, exact attachment upload/download bytes, keyboard file picker, lost-response recovery, legacy queued-state compatibility and expired-file recovery. No public network request, wallet or actual settlement.
• Separate real Next BFF/loopback upstream test: anonymous/cross-origin/unsupported routes rejected; ordinary 64 KiB and upload 3 MiB body limits enforced; authenticated metadata plus byte-identical 168 KB download.
• Independent reviews covered concurrency/generation, upload auth/privacy, recovery and old-draft compatibility; findings fixed and browser-regressed.
• The separate local-stack integration harness requires its own Anvil + HTTP services and is excluded from the isolated fixture result; public RPC/wallet credentials were not substituted.

Rollout / authorization boundary — not merged or deployed

No Railway deployment, live DB update, certification grant, funding or indexing payment was performed. Merge/deployment remains paused for review.

When authorized: deploy Sellers, then API/migrations, then Web/Docs. Apply the attachment/generation migration, cross-kind dispatch index and extended workflow-kind CHECK before new workers. Do not mix old workers with DISCOVER_TASK jobs. Existing overlapping active jobs deliberately fail the new unique index: investigate, never delete jobs to force migration.

Explicitly change any deployed MOCK_INVOICE_FAIL_ONCE=true to false; source defaults do not override existing runtime variables. Historical attempt-2 invoices remain unchanged.

New service scopes still require review and refreshed Bazaar metadata/index. Indexing fees require separate target/amount confirmation. See docs/service-first-catalog.md for file limits, retention, test commands and rollout guards. Local fixture success is not proof of funded testnet or Bazaar indexing success.