From 892ba5886da1238a7c5d805c8993003f6b15af5d Mon Sep 17 00:00:00 2001
From: lzq <357099073@qq.com>
Date: Mon, 19 Oct 2026 17:34:11 +0800
Subject: [PATCH] =?UTF-8?q?=E4=BF=AE=E5=A4=8Dbug?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 backend/src/api/reimburse.js                  |  14 +-
 backend/src/router/dynamicRoutes.js           |  11 +-
 backend/src/router/menuDefaults.js            |  48 +++
 backend/src/stores/menu.js                    |  27 +-
 backend/src/utils/request.js                  | 120 +++++---
 .../apps/oa/reimburse/components/detail.vue   | 167 ++++++++--
 .../apps/oa/reimburse/components/edit.vue     |   4 +-
 backend/src/views/apps/oa/reimburse/index.vue |  86 +++++-
 go/controllers/app_oa.go                      |  67 ++--
 go/controllers/app_oa_expense.go              |   2 +-
 go/controllers/backend_menu.go                |   4 +
 go/controllers/backend_reimburse.go           | 287 ++++++++++++++----
 go/controllers/backend_reimburse_test.go      |  27 ++
 go/controllers/reimburse_approval_core.go     |   2 +-
 go/main.go                                    |   4 +
 go/middleware/security_probe.go               | 283 +++++++++++++++++
 go/middleware/security_probe_test.go          |  92 ++++++
 go/routers/backend/backend.go                 |   1 +
 go/routers/router.go                          |   6 +
 go/routers/spa.go                             |   4 +-
 20 files changed, 1078 insertions(+), 178 deletions(-)
 create mode 100644 backend/src/router/menuDefaults.js
 create mode 100644 go/controllers/backend_reimburse_test.go
 create mode 100644 go/middleware/security_probe.go
 create mode 100644 go/middleware/security_probe_test.go

diff --git a/backend/src/api/reimburse.js b/backend/src/api/reimburse.js
index 120d7e3..8ac4c74 100644
--- a/backend/src/api/reimburse.js
+++ b/backend/src/api/reimburse.js
@@ -45,10 +45,20 @@ export function deleteReimbursement(id) {
   })
 }
 
-export function submitReimbursement(id) {
+export function submitReimbursement(id, comment = '') {
   return request({
     url: `/backend/reimbursements/${id}/submit`,
-    method: 'post'
+    method: 'post',
+    data: { comment }
+  })
+}
+
+// 撤回审批中的报销单：撤掉运行中的审批实例并回到草稿，撤回后可继续编辑、再次提交
+export function withdrawReimbursement(id, comment = '') {
+  return request({
+    url: `/backend/reimbursements/${id}/withdraw`,
+    method: 'post',
+    data: { comment }
   })
 }
 
diff --git a/backend/src/router/dynamicRoutes.js b/backend/src/router/dynamicRoutes.js
index 61a218a..275235a 100644
--- a/backend/src/router/dynamicRoutes.js
+++ b/backend/src/router/dynamicRoutes.js
@@ -1,4 +1,5 @@
 import { createComponentLoader } from '@/utils/pathResolver';
+import { pickDefaultChild } from './menuDefaults';
 
 function computeFullPath(menuPath, parentPath) {
   if (!menuPath) return parentPath || '';
@@ -105,7 +106,7 @@ function nestedMenuToRoute(menu, layoutAbsPath) {
       component: () => import('@/views/layouts/EmptyLayout.vue'),
       children: convertNestedMenuChildren(menu.children, childAbs),
     };
-    const firstChild = menu.children[0];
+    const firstChild = pickDefaultChild(menu.children);
     if (firstChild && firstChild.path) {
       const firstAbs = computeFullPath(firstChild.path, childAbs);
       const firstRel = toRelativeChildPath(childAbs, firstAbs);
@@ -193,9 +194,11 @@ export function convertMenusToRoutes(menus, parentPath = '') {
     } else if (hasChildren) {
       route.component = () => import('@/views/layouts/EmptyLayout.vue');
       route.children = convertMenusToRoutes(menu.children, fullPath);
-      const defaultChild = menu.children.find((child) =>
-        child.path === '/apps/cms/analytics/content' || child.path === 'analytics/content'
-      ) || menu.children[0];
+      // CMS 内容统计是内置默认页，保持原行为；其余模块统一优先「工作台」
+      const defaultChild =
+        menu.children.find(
+          (child) => child.path === '/apps/cms/analytics/content' || child.path === 'analytics/content'
+        ) || pickDefaultChild(menu.children);
       if (defaultChild && defaultChild.path) {
         const childFullPath = defaultChild.path.startsWith('/')
           ? defaultChild.path
diff --git a/backend/src/router/menuDefaults.js b/backend/src/router/menuDefaults.js
new file mode 100644
index 0000000..9eed2f4
--- /dev/null
+++ b/backend/src/router/menuDefaults.js
@@ -0,0 +1,48 @@
+/**
+ * 菜单默认落地页规则。
+ *
+ * 模块根菜单本身通常是目录，点击模块（如首页的 ERP 卡片）后由这里的规则
+ * 决定跳到哪个子菜单。规则按「工作台优先」收敛，避免依赖后端返回顺序
+ * 而落到某个先创建的页面（例如 ERP 的采购订单）。
+ */
+
+/** 工作台/仪表盘入口的识别规则（标题、菜单路径、组件路径） */
+const WORKBENCH_TITLE_RE = /工作台|仪表盘/;
+const WORKBENCH_PATH_RE = /(^|\/)(dashboard|workbench)(\/|\.|$)/i;
+
+export function isWorkbenchMenu(menu) {
+  if (!menu) return false;
+  return (
+    WORKBENCH_TITLE_RE.test(String(menu.title || '')) ||
+    WORKBENCH_PATH_RE.test(String(menu.path || '')) ||
+    WORKBENCH_PATH_RE.test(String(menu.component_path || ''))
+  );
+}
+
+/** 按 sort（其次 id）升序：后端菜单按 ID 返回，与侧栏按 sort 展示的顺序可能不一致 */
+export function sortByMenuOrder(menus) {
+  return [...menus].sort((a, b) => {
+    const sortA = Number(a.sort) || 0;
+    const sortB = Number(b.sort) || 0;
+    if (sortA !== sortB) return sortA - sortB;
+    return (Number(a.id) || 0) - (Number(b.id) || 0);
+  });
+}
+
+/**
+ * 模块默认落地页：统一优先「工作台 / 仪表盘」，其次侧栏排在最前的子菜单。
+ *
+ * 直接取 children[0] 不可靠：后端按 ID 顺序返回，而侧栏是按 sort 展示的。
+ * 早期先创建的页面（例如 ERP 的采购订单）会因此成为模块默认页，
+ * 即使「工作台」已经排在 sort=1。
+ */
+export function pickDefaultChild(children) {
+  if (!children || children.length === 0) return null;
+  const sorted = sortByMenuOrder(children);
+  const workbench =
+    sorted.find(isWorkbenchMenu) ||
+    // 工作台被放成二级目录（如 ERP：工作台 -> 仪表盘）时，选这个目录，
+    // 由该目录自己的 redirect 落到具体工作台页面
+    sorted.find((child) => Array.isArray(child.children) && child.children.some(isWorkbenchMenu));
+  return workbench || sorted[0];
+}
diff --git a/backend/src/stores/menu.js b/backend/src/stores/menu.js
index 61b0aaf..73aa347 100644
--- a/backend/src/stores/menu.js
+++ b/backend/src/stores/menu.js
@@ -3,6 +3,14 @@ import { ref, computed } from 'vue'
 // import { getUserInfo } from '@/utils/auth'
 import { getMenus } from '@/api/menu';
 
+// 是否属于「登录态失效」类错误。
+// request.js 已给鉴权错误打上 status=401，同时兼容历史文案与 axios 原始错误。
+const isAuthError = (err) =>
+  err?.status === 401 ||
+  err?.response?.status === 401 ||
+  err?.isAuthError === true ||
+  /token已过期|token无效|无效的token/.test(err?.message || '');
+
 export const useMenuStore = defineStore('menu', () => {
   // 菜单数据
   const menus = ref([]);
@@ -167,6 +175,18 @@ export const useMenuStore = defineStore('menu', () => {
         throw new Error(res.message || '获取菜单失败：响应格式错误');
       } catch (err) {
         error.value = err.message || '获取菜单失败';
+
+        // 鉴权失败（令牌过期/无效、会话被吊销）：清掉缓存并继续抛出，
+        // 由 request.js 静默续期或跳认证中心。
+        // 不能回退到缓存：否则令牌过期时会用旧菜单把登录态问题掩盖掉，
+        // 用户看到的是一份已经失效的权限菜单。
+        if (isAuthError(err)) {
+          clearCache();
+          menus.value = [];
+          console.warn('获取菜单失败（登录状态失效）:', err.message);
+          throw err;
+        }
+
         console.error('获取菜单失败:', err);
         console.error('错误详情:', {
           message: err.message,
@@ -174,13 +194,6 @@ export const useMenuStore = defineStore('menu', () => {
           stack: err.stack
         });
 
-        // 如果是 token 无效错误，不使用缓存，直接抛出
-        if (err.message === 'token无效' || err.response?.status === 401) {
-          clearCache();
-          menus.value = [];
-          throw err;
-        }
-
         // 如果出错，尝试使用缓存数据
         const cachedMenus = loadFromCache();
         if (cachedMenus && cachedMenus.length > 0) {
diff --git a/backend/src/utils/request.js b/backend/src/utils/request.js
index 81433a3..90a0de6 100644
--- a/backend/src/utils/request.js
+++ b/backend/src/utils/request.js
@@ -13,7 +13,73 @@ const service = axios.create({
   timeout: 300000,
   withCredentials: false // JWT 不需要 Cookie
 });
- 
+
+// 构造鉴权失败错误：带上 status，调用方（如菜单 store）可直接按 401 判断，
+// 不必依赖中文文案；否则文案一改，登录态判断就静默失效了。
+function authError(message) {
+  const err = new Error(message || '登录状态已失效，请重新登录');
+  err.status = 401;
+  err.isAuthError = true;
+  return err;
+}
+
+// 清空登录态并回认证中心重新登录（只跳一次，避免并发请求反复跳转）
+function redirectToLoginOnce() {
+  clearTokens();
+  localStorage.removeItem('userInfo');
+  if (ssoRedirecting) return;
+  ssoRedirecting = true;
+  redirectToAuthorize().catch((err) => {
+    console.error('跳转统一认证失败:', err);
+    ssoRedirecting = false;
+  });
+}
+
+// 401 统一处理：
+//   阶段一：并发场景下，本请求带的是旧令牌，而别的请求已换成新令牌 → 直接用最新令牌重放；
+//   阶段二：仍 401 → 用 refresh_token 静默续期后重放一次；
+//   阶段三：续期失败 / 续期后仍 401 → 清登录态回认证中心。
+// 「重放」与「续期」是两个独立阶段：前者不消耗 refresh_token，只挡一次；
+// 否则令牌真的过期时就永远等不到续期，只会一路报「无效的token」。
+async function recoverAuth(config, bizMsg) {
+  const latestToken = localStorage.getItem('token') || '';
+  const sentToken = String(config?.headers?.Authorization || '').replace(/^Bearer\s+/i, '');
+  if (!config?._replayedWithLatest && latestToken && latestToken !== sentToken) {
+    console.warn('[auth] 请求携带的令牌已过期，改用最新令牌重放:', config?.url);
+    config.headers['Authorization'] = `Bearer ${latestToken}`;
+    config._replayedWithLatest = true;
+    return service.request(config);
+  }
+
+  if (config?._refreshed) {
+    // 续期拿到的令牌仍被判定过期/无效：继续留在页面只会一路报错，直接回认证中心
+    redirectToLoginOnce();
+    return Promise.reject(authError(bizMsg));
+  }
+
+  try {
+    const newToken = await refreshAccessToken();
+    config.headers['Authorization'] = `Bearer ${newToken}`;
+    config._refreshed = true;
+    return service.request(config);
+  } catch (e) {
+    redirectToLoginOnce();
+    return Promise.reject(authError('登录状态已失效，请重新登录'));
+  }
+}
+
+// 令牌类错误提示。后端部分接口（全局鉴权中间件为 warn 模式时控制器自行鉴权）
+// 会在 HTTP 200 的 body 里返回 code:401，需要按提示词识别。
+// 不能把所有 body code:401 都当令牌问题：个别接口（如新增用户时校验原密码）
+// 也用 401 表示业务失败，那类响应重放没有意义，更不能因此把用户登出。
+const TOKEN_ERROR_HINTS = ['token已过期', '无效的token', '未提供认证信息', '认证信息格式错误'];
+
+function isTokenFailure(body) {
+  if (!body || Number(body.code) !== 401) return false;
+  const msg = String(body.msg || body.message || '');
+  return TOKEN_ERROR_HINTS.some((hint) => msg.includes(hint));
+}
+
 // 请求拦截器
 service.interceptors.request.use(
   config => {
@@ -38,11 +104,16 @@ service.interceptors.request.use(
     return Promise.reject(error);
   }
 );
- 
+
 // 响应拦截器
 service.interceptors.response.use(
   response => {
-    return response.data;
+    const data = response.data;
+    // 兜住 HTTP 200 + body code:401 的令牌失效响应，让它走与真实 401 相同的续期流程
+    if (isTokenFailure(data)) {
+      return recoverAuth(response.config, data.msg || data.message);
+    }
+    return data;
   },
   async error => {
     if (error.response) {
@@ -50,43 +121,8 @@ service.interceptors.response.use(
       // 避免页面只显示 "Request failed with status code xxx"
       const bizMsg = error.response.data?.msg || error.response.data?.message;
       switch (error.response.status) {
-        case 401: {
-          // 阶段一：并发场景下，本请求可能带的是「旧令牌」，而别的请求已经把令牌换成新的
-          // （登录回跳、另一请求的静默续期都会改 localStorage）。
-          // 此时直接用最新令牌重放，免得白跑一次续期。
-          const latestToken = localStorage.getItem('token') || '';
-          const sentToken = String(error.config?.headers?.Authorization || '').replace(/^Bearer\s+/i, '');
-          if (!error.config?._replayedWithLatest && latestToken && latestToken !== sentToken) {
-            console.warn('[auth] 请求携带的令牌已过期，改用最新令牌重放:', error.config?.url);
-            error.config.headers['Authorization'] = `Bearer ${latestToken}`;
-            error.config._replayedWithLatest = true;
-            return service.request(error.config);
-          }
-          // 阶段二：仍 401 → 用 refresh_token 静默续期后重放一次。
-          // 注意「重放」与「续期」是两个独立阶段：前者不消耗 refresh_token，
-          // 只挡一次；否则令牌真的过期时就永远等不到续期，只会一路报「无效的token」。
-          if (error.config?._refreshed) {
-            return Promise.reject(new Error(bizMsg || 'token无效，请重新登录'));
-          }
-          try {
-            const newToken = await refreshAccessToken();
-            error.config.headers['Authorization'] = `Bearer ${newToken}`;
-            error.config._refreshed = true;
-            return service.request(error.config);
-          } catch (e) {
-            // 续期失败：清空登录态并跳认证中心重新登录（只跳一次，避免死循环）
-            clearTokens();
-            localStorage.removeItem('userInfo');
-            if (!ssoRedirecting) {
-              ssoRedirecting = true;
-              redirectToAuthorize().catch((err) => {
-                console.error('跳转统一认证失败:', err);
-                ssoRedirecting = false;
-              });
-            }
-            return Promise.reject(new Error('token无效，请重新登录'));
-          }
-        }
+        case 401:
+          return recoverAuth(error.config, bizMsg);
         case 404:
           console.error('请求的资源不存在');
           break;
@@ -108,5 +144,5 @@ service.interceptors.response.use(
     return Promise.reject(error);
   }
 );
- 
-export default service;
\ No newline at end of file
+
+export default service;
diff --git a/backend/src/views/apps/oa/reimburse/components/detail.vue b/backend/src/views/apps/oa/reimburse/components/detail.vue
index e4207b4..83969e8 100644
--- a/backend/src/views/apps/oa/reimburse/components/detail.vue
+++ b/backend/src/views/apps/oa/reimburse/components/detail.vue
@@ -20,10 +20,19 @@
         <el-button size="small" :loading="amountComparing" @click="handleCompareAmounts">
           核对发票金额
         </el-button>
-        <el-button v-if="isDraft" type="primary" size="small" @click="openAddItem">添加费用</el-button>
+        <el-button type="primary" size="small" :disabled="!isEditable" @click="openAddItem">添加费用</el-button>
       </div>
     </div>
 
+    <el-alert
+      v-if="!isEditable"
+      class="edit-lock-tip"
+      type="info"
+      :closable="false"
+      show-icon
+      :title="editLockTip"
+    />
+
     <div v-if="amountCompare" class="amount-compare-card">
       <div class="amount-compare-summary">
         <div class="compare-item">
@@ -75,7 +84,7 @@
       </el-table>
       </div>
       <div class="compare-actions">
-        <el-button v-if="isDraft" type="primary" size="small" :loading="amountSaving" @click="handleSaveReceiptAmounts">
+        <el-button v-if="isEditable" type="primary" size="small" :loading="amountSaving" @click="handleSaveReceiptAmounts">
           保存发票金额
         </el-button>
         <el-button size="small" @click="closeAmountCompare">取消</el-button>
@@ -105,7 +114,7 @@
         </template>
       </el-table-column>
       <el-table-column prop="description" label="描述" min-width="160" show-overflow-tooltip />
-      <el-table-column label="操作" :width="isDraft ? 176 : 70" fixed="right">
+      <el-table-column label="操作" width="176" fixed="right">
         <template #default="{ row }">
           <div class="item-actions">
             <el-button
@@ -118,26 +127,38 @@
             >
               <i class="fa-solid fa-eye"></i>
             </el-button>
-            <template v-if="isDraft">
             <el-button
               link
               type="success"
-              title="上传发票（可多选，追加到当前费用项）"
+              :title="isEditable ? '上传发票（可多选，追加到当前费用项）' : '当前状态不可编辑费用明细'"
               aria-label="上传发票"
-              :disabled="batchUploading"
+              :disabled="!isEditable || batchUploading"
               @click="openInvoiceFilePicker(row)"
             >
               <i
                 :class="batchUploading ? 'fa-solid fa-spinner fa-spin' : 'fa-solid fa-file-arrow-up'"
               ></i>
             </el-button>
-            <el-button link type="primary" title="编辑" aria-label="编辑" @click="openEditItem(row)">
+            <el-button
+              link
+              type="primary"
+              :title="isEditable ? '编辑' : '当前状态不可编辑费用明细'"
+              aria-label="编辑"
+              :disabled="!isEditable"
+              @click="openEditItem(row)"
+            >
               <i class="fa-solid fa-pen-to-square"></i>
             </el-button>
-            <el-button link type="danger" title="删除" aria-label="删除" @click="removeItem(row)">
+            <el-button
+              link
+              type="danger"
+              :title="isEditable ? '删除' : '当前状态不可编辑费用明细'"
+              aria-label="删除"
+              :disabled="!isEditable"
+              @click="removeItem(row)"
+            >
               <i class="fa-regular fa-trash-can"></i>
             </el-button>
-            </template>
           </div>
         </template>
       </el-table-column>
@@ -191,7 +212,7 @@
             <i v-else class="fa-regular fa-file-pdf receipt-thumb-pdf"></i>
             <span class="receipt-thumb-name" :title="receipt.name">{{ receipt.name }}</span>
             <el-button
-              v-if="isDraft"
+              v-if="isEditable"
               link
               type="danger"
               class="receipt-delete-btn"
@@ -227,8 +248,11 @@
         :timestamp="formatDateTime(record.create_time)"
         placement="top"
       >
-        <strong>{{ actionLabel(record.action) }} · {{ record.approver_name || '-' }}</strong>
-        <div v-if="record.comment" class="record-comment">{{ record.comment }}</div>
+        <div class="record-head">
+          <strong>{{ actionLabel(record.action) }}</strong>
+          <span class="record-operator">操作人：{{ record.approver_name || '-' }}</span>
+        </div>
+        <div class="record-comment">操作理由：{{ record.comment || defaultRecordReason(record) }}</div>
       </el-timeline-item>
     </el-timeline>
     <el-empty v-else description="暂无审批记录" :image-size="60" />
@@ -244,6 +268,14 @@
 
     <template #footer>
       <div class="detail-toolbar">
+        <el-button
+          v-if="isApproving"
+          type="warning"
+          :loading="withdrawing"
+          @click="handleWithdraw"
+        >
+          撤回并编辑
+        </el-button>
         <el-button
           v-if="isApproved"
           type="success"
@@ -254,12 +286,12 @@
         </el-button>
         <div class="toolbar-right">
           <el-button
-            v-if="isDraft"
+            v-if="isEditable"
             type="primary"
             :loading="submitting"
             @click="handleSubmit"
           >
-            提交审核
+            {{ isDraft ? "提交审核" : "重新提交" }}
           </el-button>
         </div>
       </div>
@@ -271,7 +303,7 @@
 import { computed, onBeforeUnmount, onMounted, ref, watch } from 'vue'
 import { ElMessage, ElMessageBox } from 'element-plus'
 import { uploadFile } from '@/api/file'
-import { deleteReimbursementItem, submitReimbursement, updateReimbursementItem, updateReimbursementStatus } from '@/api/reimburse'
+import { deleteReimbursementItem, submitReimbursement, updateReimbursementItem, updateReimbursementStatus, withdrawReimbursement } from '@/api/reimburse'
 import { useAuthStore } from '@/stores/auth'
 import {
   compareReimbursementAmounts,
@@ -302,16 +334,34 @@ const statusOptions = [
   { value: 4, label: '已撤回' },
   { value: 5, label: '已打款' }
 ]
-const statusLabel = value => statusOptions.find(item => item.value === value)?.label || '未知'
-const statusType = value => ({ 0: 'info', 1: 'warning', 2: 'success', 3: 'danger', 4: 'info', 5: 'success' })[value] || 'info'
+const statusLabel = value => statusOptions.find(item => item.value === Number(value))?.label || '未知'
+const statusType = value => ({ 0: 'info', 1: 'warning', 2: 'success', 3: 'danger', 4: 'info', 5: 'success' })[Number(value)] || 'info'
 
 const visible = computed({
   get: () => props.modelValue,
   set: value => emit('update:modelValue', value)
 })
-const isDraft = computed(() => props.detail?.status === 0)
+const isDraft = computed(() => Number(props.detail?.status) === 0)
+// 可编辑状态：草稿、已驳回、已撤回；审批中需先撤回
+const isEditable = computed(() => [0, 3, 4].includes(Number(props.detail?.status)))
+// 审批中：可撤回到草稿后继续编辑
+const isApproving = computed(() => Number(props.detail?.status) === 1)
 // 审批通过（等待报销人确认款项到账）
-const isApproved = computed(() => props.detail?.status === 2)
+const isApproved = computed(() => Number(props.detail?.status) === 2)
+
+// 非可编辑状态时说明原因，避免按钮置灰后无从判断
+const editLockTip = computed(() => {
+  switch (Number(props.detail?.status)) {
+    case 1:
+      return '审批中不可编辑费用明细；如需修改，请点击底部「撤回并编辑」退回草稿。'
+    case 2:
+      return '审批已通过，费用明细不可编辑。'
+    case 5:
+      return '款项已打款，费用明细不可编辑。'
+    default:
+      return '当前状态不可编辑费用明细。'
+  }
+})
 
 const detailApplicantName = computed(() => {
   const name = props.detail?.user_name
@@ -326,6 +376,7 @@ const detailApplicantName = computed(() => {
   return '-'
 })
 const submitting = ref(false)
+const withdrawing = ref(false)
 const manualSaving = ref(false)
 const itemVisible = ref(false)
 const batchUploading = ref(false)
@@ -681,9 +732,19 @@ const handleItemsSaved = reimbursementId => {
 const handleSubmit = async () => {
   if (!props.detail?.id) return
   try {
-    await ElMessageBox.confirm('提交后将进入审批流程，确认提交吗？', '提示', { type: 'warning' })
+    const { value: comment } = await ElMessageBox.prompt(
+      '提交后将进入审批流程，可填写提交说明，将记录在审批时间线中。',
+      '提交审核',
+      {
+        type: 'warning',
+        confirmButtonText: '提交',
+        cancelButtonText: '取消',
+        inputType: 'textarea',
+        inputPlaceholder: '请输入提交说明（选填）'
+      }
+    )
     submitting.value = true
-    await submitReimbursement(props.detail.id)
+    await submitReimbursement(props.detail.id, comment || '')
     ElMessage.success('提交成功')
     emit('changed', props.detail.id)
   } catch (error) {
@@ -695,6 +756,35 @@ const handleSubmit = async () => {
   }
 }
 
+// 撤回审批中的单据：回到草稿后可继续编辑费用条目，再重新提交
+const handleWithdraw = async () => {
+  if (!props.detail?.id) return
+  try {
+    const { value: comment } = await ElMessageBox.prompt(
+      '撤回后单据将回到草稿，可继续编辑费用条目并重新提交。',
+      '撤回确认',
+      {
+        type: 'warning',
+        confirmButtonText: '确认撤回',
+        cancelButtonText: '取消',
+        inputType: 'textarea',
+        inputPlaceholder: '请输入撤回原因',
+        inputValidator: value => (String(value || '').trim() ? true : '请输入撤回原因')
+      }
+    )
+    withdrawing.value = true
+    await withdrawReimbursement(props.detail.id, String(comment || '').trim())
+    ElMessage.success('已撤回，可继续编辑')
+    emit('changed', props.detail.id)
+  } catch (error) {
+    if (error !== 'cancel' && error !== 'close') {
+      ElMessage.error(error?.message || '撤回失败')
+    }
+  } finally {
+    withdrawing.value = false
+  }
+}
+
 // 审批通过后由报销人本人确认款项到账，单据置为「已打款」
 const confirmPaid = async () => {
   if (!props.detail?.id) return
@@ -899,6 +989,23 @@ const removeReceipt = async receipt => {
 }
 
 const actionLabel = value => ({ 1: '提交申请', 2: '审批通过', 3: '审批驳回', 4: '转审', 5: '撤回' })[value] || '审批操作'
+// 老记录没有审批意见时，用动作补一条可读的说明，避免时间线只显示 “-”
+const defaultRecordReason = record => {
+  switch (Number(record?.action)) {
+    case 1:
+      return '提交报销申请'
+    case 2:
+      return '审批通过'
+    case 3:
+      return '审批驳回'
+    case 4:
+      return '转交他人审批'
+    case 5:
+      return '报销人主动撤回'
+    default:
+      return '-'
+  }
+}
 const money = value => Number(value || 0).toFixed(2)
 </script>
 
@@ -916,14 +1023,32 @@ const money = value => Number(value || 0).toFixed(2)
   gap: 8px;
 }
 
+.edit-lock-tip {
+  margin-bottom: 12px;
+}
+
 .detail-title {
   margin: 0 0 12px;
   color: #303133;
 }
 
+.record-head {
+  display: flex;
+  align-items: center;
+  gap: 10px;
+  flex-wrap: wrap;
+}
+
+.record-operator {
+  color: #909399;
+  font-size: 13px;
+}
+
 .record-comment {
   margin-top: 6px;
   color: #606266;
+  font-size: 13px;
+  white-space: pre-wrap;
 }
 
 .receipt-preview {
diff --git a/backend/src/views/apps/oa/reimburse/components/edit.vue b/backend/src/views/apps/oa/reimburse/components/edit.vue
index ce4407d..7408302 100644
--- a/backend/src/views/apps/oa/reimburse/components/edit.vue
+++ b/backend/src/views/apps/oa/reimburse/components/edit.vue
@@ -15,7 +15,7 @@
       </el-form-item>
 
       <el-alert
-        title="保存报销单后，可在详情中逐条添加报销事项。"
+        title="保存后为草稿，不会提交审批；可在详情中逐条添加报销事项，确认无误后再到列表操作栏点「提交审核」。"
         type="info"
         :closable="false"
         show-icon
@@ -56,7 +56,7 @@ const cloneForm = data => ({
 
 const form = reactive(cloneForm(props.formData))
 const formRef = ref()
-const submitLabel = computed(() => (props.isEdit ? '保存' : '创建'))
+const submitLabel = computed(() => (props.isEdit ? '保存' : '保存草稿'))
 const formRules = {
   apply_date: [{ required: true, message: '请选择申请日期', trigger: 'change' }]
 }
diff --git a/backend/src/views/apps/oa/reimburse/index.vue b/backend/src/views/apps/oa/reimburse/index.vue
index 5287461..55e4453 100644
--- a/backend/src/views/apps/oa/reimburse/index.vue
+++ b/backend/src/views/apps/oa/reimburse/index.vue
@@ -93,7 +93,14 @@
               >详情</el-button
             >
             <el-button
-              v-if="row.status === 2"
+              v-if="isStatus(row, 1)"
+              link
+              type="warning"
+              @click="handleWithdraw(row)"
+              >撤回</el-button
+            >
+            <el-button
+              v-if="isStatus(row, 2)"
               link
               type="success"
               @click="handleConfirmPaid(row)"
@@ -107,21 +114,21 @@
               >导出</el-button
             >
             <el-button
-              v-if="row.status === 0"
+              v-if="isEditable(row)"
               link
               type="primary"
               @click="openEdit(row.id)"
               >编辑</el-button
             >
             <el-button
-              v-if="row.status === 0"
+              v-if="isEditable(row)"
               link
               type="success"
               @click="handleSubmit(row)"
-              >提交</el-button
+              >{{ isStatus(row, 0) ? "提交审核" : "重新提交" }}</el-button
             >
             <el-button
-              v-if="row.status === 0"
+              v-if="isStatus(row, 0)"
               link
               type="danger"
               @click="handleDelete(row)"
@@ -189,6 +196,7 @@ import {
   submitReimbursement,
   updateReimbursement,
   updateReimbursementStatus,
+  withdrawReimbursement,
 } from "@/api/reimburse";
 
 const statusOptions = [
@@ -286,11 +294,22 @@ const openEdit = async (id) => {
 const saveForm = async (payload) => {
   saving.value = true;
   try {
-    if (editingId.value) await updateReimbursement(editingId.value, payload);
-    else await createReimbursement(payload);
-    ElMessage.success("保存成功");
+    let createdId = 0;
+    if (editingId.value) {
+      await updateReimbursement(editingId.value, payload);
+    } else {
+      // 新建只保存为草稿，不提交审批；审核需在列表操作栏点「提交审核」
+      const res = await createReimbursement(payload);
+      createdId = Number(res?.data?.id || res?.id || 0);
+    }
+    ElMessage.success(editingId.value ? "保存成功" : "已保存为草稿，可继续添加费用明细");
     formVisible.value = false;
-    loadList();
+    if (createdId) {
+      // 直接打开详情继续编辑，草稿状态下可反复修改
+      await openDetail(createdId);
+    } else {
+      loadList();
+    }
   } catch (error) {
     ElMessage.error(error?.message || "保存失败");
   } finally {
@@ -300,10 +319,18 @@ const saveForm = async (payload) => {
 
 const handleSubmit = async (row) => {
   try {
-    await ElMessageBox.confirm("提交后将进入审批流程，确认提交吗？", "提示", {
-      type: "warning",
-    });
-    await submitReimbursement(row.id);
+    const { value: comment } = await ElMessageBox.prompt(
+      "提交后将进入审批流程，可填写提交说明，将记录在审批时间线中。",
+      "提交审核",
+      {
+        type: "warning",
+        confirmButtonText: "提交",
+        cancelButtonText: "取消",
+        inputType: "textarea",
+        inputPlaceholder: "请输入提交说明（选填）",
+      }
+    );
+    await submitReimbursement(row.id, comment || "");
     ElMessage.success("提交成功");
     loadList();
   } catch (error) {
@@ -312,6 +339,31 @@ const handleSubmit = async (row) => {
   }
 };
 
+// 撤回审批中的单据：回到草稿后可继续编辑费用条目，再重新提交
+const handleWithdraw = async (row) => {
+  try {
+    const { value: comment } = await ElMessageBox.prompt(
+      "撤回后单据将回到草稿，可继续编辑费用条目并重新提交。",
+      "撤回确认",
+      {
+        type: "warning",
+        confirmButtonText: "确认撤回",
+        cancelButtonText: "取消",
+        inputType: "textarea",
+        inputPlaceholder: "请输入撤回原因",
+        inputValidator: (value) =>
+          String(value || "").trim() ? true : "请输入撤回原因",
+      }
+    );
+    await withdrawReimbursement(row.id, String(comment || "").trim());
+    ElMessage.success("已撤回，可继续编辑");
+    loadList();
+  } catch (error) {
+    if (error !== "cancel" && error !== "close")
+      ElMessage.error(error?.message || "撤回失败");
+  }
+};
+
 // 审批通过后由报销人本人确认款项到账，确认后状态变为「已打款」
 const handleConfirmPaid = async (row) => {
   try {
@@ -384,7 +436,11 @@ const formatDate = (value) => {
   return formatDateUtil(value);
 };
 const statusLabel = (value) =>
-  statusOptions.find((item) => item.value === value)?.label || "未知";
+  statusOptions.find((item) => item.value === Number(value))?.label || "未知";
+// 兼容后端把状态序列化为字符串的情况，避免编辑/提交按钮被误隐藏
+const isStatus = (row, status) => Number(row?.status) === status;
+// 可编辑状态：草稿、已驳回、已撤回；审批中需先撤回
+const isEditable = (row) => [0, 3, 4].includes(Number(row?.status));
 const statusType = (value) =>
   ({
     0: "info",
@@ -393,7 +449,7 @@ const statusType = (value) =>
     3: "danger",
     4: "info",
     5: "success",
-  })[value] || "info";
+  })[Number(value)] || "info";
 onMounted(() => {
   checkMobile();
   window.addEventListener("resize", checkMobile);
diff --git a/go/controllers/app_oa.go b/go/controllers/app_oa.go
index 075a252..530cb37 100644
--- a/go/controllers/app_oa.go
+++ b/go/controllers/app_oa.go
@@ -669,41 +669,48 @@ func (c *AppOaController) oaDashboardReimburse(tid, uid uint64) map[string]inter
 		}
 	}
 	expenseTypes := []map[string]interface{}{}
+	paidIDList := make([]uint64, 0, len(paidIDs))
+	for id := range paidIDs {
+		paidIDList = append(paidIDList, id)
+	}
 	var items []models.BackendReimbursementItem
-	if _, err := models.Orm.QueryTable(new(models.BackendReimbursementItem)).
-		Filter("tid", tid).Filter("uid", uid).Filter("is_deleted", 0).
-		All(&items); err == nil {
-		typeAgg := map[string]*struct {
-			count  int
-			amount float64
-		}{}
-		for i := range items {
-			if !paidIDs[items[i].ReimbursementID] {
-				continue
+	if len(paidIDList) > 0 {
+		// 按已打款主单 ID 查明细，不依赖明细行的 tid/uid（历史数据可能不一致）
+		if _, err := models.Orm.QueryTable(new(models.BackendReimbursementItem)).
+			Filter("reimbursement_id__in", paidIDList).Filter("is_deleted", 0).
+			All(&items); err == nil {
+			typeAgg := map[string]*struct {
+				count  int
+				amount float64
+			}{}
+			for i := range items {
+				if !paidIDs[items[i].ReimbursementID] {
+					continue
+				}
+				name := strings.TrimSpace(items[i].ExpenseType)
+				if name == "" {
+					name = "未分类"
+				}
+				agg, ok := typeAgg[name]
+				if !ok {
+					agg = &struct {
+						count  int
+						amount float64
+					}{}
+					typeAgg[name] = agg
+				}
+				agg.count++
+				agg.amount += items[i].Amount
 			}
-			name := strings.TrimSpace(items[i].ExpenseType)
-			if name == "" {
-				name = "未分类"
+			for name, agg := range typeAgg {
+				expenseTypes = append(expenseTypes, map[string]interface{}{
+					"name": name, "count": agg.count, "amount": agg.amount,
+				})
 			}
-			agg, ok := typeAgg[name]
-			if !ok {
-				agg = &struct {
-					count  int
-					amount float64
-				}{}
-				typeAgg[name] = agg
-			}
-			agg.count++
-			agg.amount += items[i].Amount
-		}
-		for name, agg := range typeAgg {
-			expenseTypes = append(expenseTypes, map[string]interface{}{
-				"name": name, "count": agg.count, "amount": agg.amount,
+			sort.Slice(expenseTypes, func(i, j int) bool {
+				return expenseTypes[i]["amount"].(float64) > expenseTypes[j]["amount"].(float64)
 			})
 		}
-		sort.Slice(expenseTypes, func(i, j int) bool {
-			return expenseTypes[i]["amount"].(float64) > expenseTypes[j]["amount"].(float64)
-		})
 	}
 
 	return map[string]interface{}{
diff --git a/go/controllers/app_oa_expense.go b/go/controllers/app_oa_expense.go
index 10b2a23..989b137 100644
--- a/go/controllers/app_oa_expense.go
+++ b/go/controllers/app_oa_expense.go
@@ -258,7 +258,7 @@ func (c *AppOaController) ExpenseSubmit() {
 		return
 	}
 
-	code, msg := reimburseSubmitCore(claims, id)
+	code, msg := reimburseSubmitCore(claims, id, readReimburseComment(&c.Controller))
 	if msg != "" {
 		c.oaErr(code, code, msg)
 		return
diff --git a/go/controllers/backend_menu.go b/go/controllers/backend_menu.go
index c25507a..4ce90c8 100644
--- a/go/controllers/backend_menu.go
+++ b/go/controllers/backend_menu.go
@@ -24,6 +24,10 @@ type AdminMenuController = BackendMenuController
 //   - 写接口（增删改、改状态）只有平台端能用，租户端能改菜单等于给自己开功能；
 //   - 读接口两端都能用，但租户端只能读租户端那一份（cid 强制为 2）。
 func (c *BackendMenuController) denyMenu(code int, msg string) {
+	// 必须同时设置 HTTP 状态码：只把 code 写进 body 而返回 200 时，
+	// 前端 axios 拦截器会把这次鉴权失败当成成功响应，既不静默续期也不跳登录，
+	// 菜单等页面只会停在「token已过期」的报错里。
+	c.Ctx.Output.SetStatus(code)
 	c.Data["json"] = map[string]interface{}{"code": code, "msg": msg}
 	_ = c.ServeJSON()
 }
diff --git a/go/controllers/backend_reimburse.go b/go/controllers/backend_reimburse.go
index 00c63c8..1d0f134 100644
--- a/go/controllers/backend_reimburse.go
+++ b/go/controllers/backend_reimburse.go
@@ -454,8 +454,10 @@ func reimburseDetailData(claims *jwtutil.Claims, id uint64, scheme, host string)
 		return nil, 404, "报销单不存在"
 	}
 	var items []models.BackendReimbursementItem
+	// 只按 reimbursement_id 查明细：主单已按 tid + 申请人校验过。
+	// 历史单据存在明细 tid 与主单不一致的情况，再按 tid 过滤会导致明细「消失」。
 	_, err = models.Orm.QueryTable(new(models.BackendReimbursementItem)).
-		Filter("reimbursement_id", id).Filter("tid", claims.TenantId).Filter("is_deleted", 0).
+		Filter("reimbursement_id", id).Filter("is_deleted", 0).
 		OrderBy("id").All(&items)
 	if err != nil && err != orm.ErrNoRows {
 		return nil, 500, "查询明细失败: " + err.Error()
@@ -533,6 +535,10 @@ func (c *BackendReimburseController) Create() {
 }
 
 // reimburseCreateCore 创建报销单（草稿）共享逻辑。
+//
+// 创建只落草稿：不接受客户端传入的状态，也不启动审批流程。
+// 提交审批必须由用户显式调用 Submit（Web 端为列表操作栏的「提交审核」），
+// 在此之前草稿可反复编辑，满足周期性报销多次修改的需求。
 func reimburseCreateCore(claims *jwtutil.Claims, payload reimbursementPayload) (uint64, int, string) {
 	applyDate, err := parseReimburseDate(payload.ApplyDate)
 	if err != nil {
@@ -541,7 +547,8 @@ func reimburseCreateCore(claims *jwtutil.Claims, payload reimbursementPayload) (
 	uid := uint64(claims.UserID)
 	row := &models.BackendReimbursement{
 		Tid: uint64(claims.TenantId), UID: &uid, UserID: uid, DepartmentID: payload.DepartmentID,
-		TotalAmount: 0, Status: 0, ApplyDate: applyDate,
+		TotalAmount: 0, Status: reimbursementStatusDraft, ApplyDate: applyDate,
+		CurrentStep: 0, CurrentApproverID: 0,
 		Description: nullableReimburseString(payload.Description),
 	}
 	if err := saveReimbursement(row); err != nil {
@@ -575,14 +582,14 @@ func (c *BackendReimburseController) Update() {
 	c.reply(200, "success", map[string]interface{}{"id": id})
 }
 
-// reimburseUpdateCore 编辑报销单（仅草稿）共享逻辑。
+// reimburseUpdateCore 编辑报销单（草稿/已驳回/已撤回）共享逻辑。
 func reimburseUpdateCore(claims *jwtutil.Claims, id uint64, payload reimbursementPayload) (int, string) {
 	row, err := findOwnedReimbursement(claims, id)
 	if err != nil {
 		return 404, "报销单不存在"
 	}
-	if row.Status != 0 {
-		return 400, "只有草稿可以编辑"
+	if !canEditReimbursement(row.Status) {
+		return 400, "当前状态不可编辑，请先撤回"
 	}
 	applyDate, err := parseReimburseDate(payload.ApplyDate)
 	if err != nil {
@@ -621,7 +628,7 @@ func reimburseDeleteCore(claims *jwtutil.Claims, id uint64) (int, string) {
 	if err != nil {
 		return 404, "报销单不存在"
 	}
-	if row.Status != 0 {
+	if row.Status != reimbursementStatusDraft {
 		return 400, "只有草稿可以删除"
 	}
 	now := time.Now()
@@ -651,13 +658,13 @@ func (c *BackendReimburseController) getItemID() (uint64, bool) {
 }
 
 // findOwnedReimbursementItem 查询本人报销单下的费用明细（包级共享，移动端复用）。
-func findOwnedReimbursementItem(claims *jwtutil.Claims, id, reimbursementID uint64) (*models.BackendReimbursementItem, error) {
+// 主单归属已由 ensureEditableReimbursement 按 tid + 申请人校验，这里只按
+// id + reimbursement_id 定位，避免历史明细 tid/uid 不一致时无法编辑。
+func findOwnedReimbursementItem(_ *jwtutil.Claims, id, reimbursementID uint64) (*models.BackendReimbursementItem, error) {
 	item := &models.BackendReimbursementItem{}
 	err := models.Orm.QueryTable(new(models.BackendReimbursementItem)).
 		Filter("id", id).
 		Filter("reimbursement_id", reimbursementID).
-		Filter("tid", claims.TenantId).
-		Filter("uid", claims.UserID).
 		Filter("is_deleted", 0).
 		One(item)
 	return item, err
@@ -677,15 +684,82 @@ func validateReimbursementItem(item reimbursementItemPayload) (time.Time, error)
 	return date, nil
 }
 
-// ensureDraftReimbursement 校验报销单存在且为草稿（包级共享，移动端复用）。
+// canEditReimbursement 可编辑状态：草稿、已驳回、已撤回。
+// 审批中需先撤回；已通过/已打款不可编辑，保证审批结果与打款金额不被改动。
+func canEditReimbursement(status int8) bool {
+	switch status {
+	case reimbursementStatusDraft, reimbursementStatusRejected, reimbursementStatusWithdrawn:
+		return true
+	}
+	return false
+}
+
+// resolveReimburseUserName 按 identity_id 解析姓名：
+// 认证中心企业绑定表 → 身份表 → 老租户用户表。历史令牌/导入数据可能缺映射，逐级兜底。
+func resolveReimburseUserName(tid, userID uint64) string {
+	if userID == 0 {
+		return ""
+	}
+	if tid != 0 {
+		var bind models.AuthTenantUser
+		if err := models.Orm.QueryTable(new(models.AuthTenantUser)).
+			Filter("tid", tid).
+			Filter("identity_id", userID).
+			Filter("delete_time__isnull", true).
+			One(&bind); err == nil {
+			if bind.Name != nil && strings.TrimSpace(*bind.Name) != "" {
+				return strings.TrimSpace(*bind.Name)
+			}
+			if bind.Account != nil && strings.TrimSpace(*bind.Account) != "" {
+				return strings.TrimSpace(*bind.Account)
+			}
+		}
+	}
+	var ident models.AuthIdentity
+	if err := models.Orm.QueryTable(new(models.AuthIdentity)).
+		Filter("id", userID).
+		One(&ident); err == nil {
+		if ident.Nickname != nil && strings.TrimSpace(*ident.Nickname) != "" {
+			return strings.TrimSpace(*ident.Nickname)
+		}
+		if ident.Account != nil && strings.TrimSpace(*ident.Account) != "" {
+			return strings.TrimSpace(*ident.Account)
+		}
+		if ident.Mobile != nil && strings.TrimSpace(*ident.Mobile) != "" {
+			return strings.TrimSpace(*ident.Mobile)
+		}
+	}
+	account, name := services.OperationLogUser(&tid, userID)
+	if strings.TrimSpace(name) != "" {
+		return strings.TrimSpace(name)
+	}
+	return strings.TrimSpace(account)
+}
+
+// reimburseActorName 审批时间线的操作人名称：
+// 优先令牌中的 username，缺失时回落到认证中心/租户用户表。
+func reimburseActorName(tid uint64, claims *jwtutil.Claims) string {
+	if claims == nil {
+		return "系统"
+	}
+	if name := strings.TrimSpace(claims.Username); name != "" {
+		return name
+	}
+	if name := resolveReimburseUserName(tid, uint64(claims.UserID)); name != "" {
+		return name
+	}
+	return "系统"
+}
+
+// ensureEditableReimbursement 校验报销单存在且处于可编辑状态（包级共享，移动端复用）。
 // 返回 (报销单, HTTP 状态码, 错误信息)，错误信息为空串表示通过。
-func ensureDraftReimbursement(claims *jwtutil.Claims, id uint64) (*models.BackendReimbursement, int, string) {
+func ensureEditableReimbursement(claims *jwtutil.Claims, id uint64) (*models.BackendReimbursement, int, string) {
 	row, err := findOwnedReimbursement(claims, id)
 	if err != nil {
 		return nil, 404, "报销单不存在"
 	}
-	if row.Status != 0 {
-		return nil, 400, "只有草稿可以维护费用明细"
+	if !canEditReimbursement(row.Status) {
+		return nil, 400, "当前状态不可编辑费用明细，请先撤回"
 	}
 	return row, 200, ""
 }
@@ -737,7 +811,7 @@ func (c *BackendReimburseController) AddItem() {
 
 // reimburseAddItemCore 新增费用明细共享逻辑（仅草稿；自动重算报销总额）。
 func reimburseAddItemCore(claims *jwtutil.Claims, reimbursementID uint64, payload reimbursementItemPayload, scheme, host string) (map[string]interface{}, int, string) {
-	if _, _, msg := ensureDraftReimbursement(claims, reimbursementID); msg != "" {
+	if _, _, msg := ensureEditableReimbursement(claims, reimbursementID); msg != "" {
 		code := 400
 		if msg == "报销单不存在" {
 			code = 404
@@ -802,7 +876,7 @@ func (c *BackendReimburseController) UpdateItem() {
 
 // reimburseUpdateItemCore 更新费用明细共享逻辑（仅草稿；自动重算报销总额）。
 func reimburseUpdateItemCore(claims *jwtutil.Claims, reimbursementID, itemID uint64, payload reimbursementItemPayload, scheme, host string) (map[string]interface{}, int, string) {
-	if _, _, msg := ensureDraftReimbursement(claims, reimbursementID); msg != "" {
+	if _, _, msg := ensureEditableReimbursement(claims, reimbursementID); msg != "" {
 		code := 400
 		if msg == "报销单不存在" {
 			code = 404
@@ -864,7 +938,7 @@ func (c *BackendReimburseController) DeleteItem() {
 
 // reimburseDeleteItemCore 删除费用明细共享逻辑（仅草稿；自动重算报销总额）。
 func reimburseDeleteItemCore(claims *jwtutil.Claims, reimbursementID, itemID uint64) (int, string) {
-	if _, _, msg := ensureDraftReimbursement(claims, reimbursementID); msg != "" {
+	if _, _, msg := ensureEditableReimbursement(claims, reimbursementID); msg != "" {
 		if msg == "报销单不存在" {
 			return 404, msg
 		}
@@ -898,7 +972,7 @@ func (c *BackendReimburseController) Submit() {
 		c.reply(400, "无效ID", nil)
 		return
 	}
-	code, msg := reimburseSubmitCore(claims, id)
+	code, msg := reimburseSubmitCore(claims, id, c.readReimburseActPayload())
 	if msg != "" {
 		c.reply(code, msg, nil)
 		return
@@ -906,21 +980,104 @@ func (c *BackendReimburseController) Submit() {
 	c.reply(200, "success", nil)
 }
 
+// Withdraw POST /backend/reimbursements/:id/withdraw
+//
+// 报销人撤回审批中的单据：撤掉运行中的审批实例，并把单据退回草稿，
+// 撤回后可在详情继续编辑费用条目，确认无误后再次提交审核。
+func (c *BackendReimburseController) Withdraw() {
+	claims, ok := c.claims()
+	if !ok {
+		c.reply(401, "未登录或无权限", nil)
+		return
+	}
+	id, ok := c.getID()
+	if !ok {
+		c.reply(400, "无效ID", nil)
+		return
+	}
+	code, msg := reimburseWithdrawCore(claims, id, c.readReimburseActPayload())
+	if msg != "" {
+		c.reply(code, msg, nil)
+		return
+	}
+	c.reply(200, "success", nil)
+}
+
+// reimburseWithdrawCore 撤回审批中的报销单并退回草稿。
+//
+// 与「审批中心」的发起人撤回一致：运行中的实例置为已撤回、待办任务置为已跳过；
+// 区别是报销单本身退回草稿（0）而不是已撤回（4），这样用户能继续编辑条目并重新提交。
+func reimburseWithdrawCore(claims *jwtutil.Claims, id uint64, comment string) (int, string) {
+	row, err := findOwnedReimbursement(claims, id)
+	if err != nil {
+		return 404, "报销单不存在"
+	}
+	if row.Status != reimbursementStatusApproving {
+		return 400, "只有审批中的报销单可以撤回"
+	}
+
+	// 历史单据可能没有审批实例：没有实例时直接退回草稿，保证仍可编辑
+	inst, ok := findReimburseInstance(row.Tid, row.ID)
+	if ok {
+		if inst.Status != models.ApprovalInstanceRunning {
+			return 400, "审批已结束，无法撤回"
+		}
+		now := time.Now()
+		if _, err = models.Orm.QueryTable(new(models.ApprovalInstance)).
+			Filter("id", inst.ID).
+			Update(orm.Params{
+				"status":      models.ApprovalInstanceWithdrawn,
+				"finish_time": now,
+				"update_time": now,
+			}); err != nil {
+			return 500, "撤回审批失败"
+		}
+		_, _ = models.Orm.QueryTable(new(models.ApprovalTask)).
+			Filter("instance_id", inst.ID).
+			Filter("status", models.ApprovalTaskPending).
+			Update(orm.Params{"status": models.ApprovalTaskSkipped, "update_time": now})
+	}
+
+	now := time.Now()
+	if _, err = models.Orm.QueryTable(new(models.BackendReimbursement)).
+		Filter("id", id).Filter("tid", claims.TenantId).
+		Update(orm.Params{
+			"status": reimbursementStatusDraft, "current_step": 0,
+			"current_approver_id": 0, "update_time": now,
+		}); err != nil {
+		return 500, "撤回失败"
+	}
+	// 时间线补一条撤回记录（不调用引擎 SyncBizResult，避免把单据同步成「已撤回」）
+	_, _ = models.Orm.Insert(&models.BackendApprovalRecord{
+		Tid: uint64(claims.TenantId), UID: uint64Ptr(uint64(claims.UserID)),
+		ReimbursementID: id, ApproverID: uint64(claims.UserID),
+		ApproverName: reimburseActorName(uint64(claims.TenantId), claims),
+		Action: models.ApprovalActionWithdraw, Comment: nullableReimburseString(comment),
+		Step: row.CurrentStep, PrevStep: row.CurrentStep,
+	})
+	return 200, ""
+}
+
 // reimburseActPayload 审批操作请求体。
 type reimburseActPayload struct {
 	Comment string `json:"comment"`
 }
 
-// readReimburseActPayload 读取审批意见（可空）。
-func (c *BackendReimburseController) readReimburseActPayload() string {
+// readReimburseComment 读取审批/撤回意见（可空），Web 与移动端共用。
+func readReimburseComment(ctrl *beego.Controller) string {
 	var payload reimburseActPayload
-	raw, err := io.ReadAll(c.Ctx.Request.Body)
+	raw, err := io.ReadAll(ctrl.Ctx.Request.Body)
 	if err == nil && len(raw) > 0 {
 		_ = json.Unmarshal(raw, &payload)
 	}
 	return strings.TrimSpace(payload.Comment)
 }
 
+// readReimburseActPayload 读取审批意见（可空）。
+func (c *BackendReimburseController) readReimburseActPayload() string {
+	return readReimburseComment(&c.Controller)
+}
+
 // Approve POST /backend/reimbursements/approve/:id 通过当前审批节点（body: {comment}）。
 func (c *BackendReimburseController) Approve() {
 	claims, ok := c.claims()
@@ -1000,12 +1157,12 @@ var reimburseFallbackBizTypes = []string{models.ApprovalBizReimburse, "oa"}
 // 审批最终结果由 services/approval.SyncBizResult 回写到报销单状态，保证
 // 「审批中心」与「报销管理」看到的状态一致。
 // 提交后报销单置为审批中（1），并写入 action=1 的审批记录供业务详情时间线展示。
-func reimburseSubmitCore(claims *jwtutil.Claims, id uint64) (int, string) {
+func reimburseSubmitCore(claims *jwtutil.Claims, id uint64, comment string) (int, string) {
 	row, err := findOwnedReimbursement(claims, id)
 	if err != nil {
 		return 404, "报销单不存在"
 	}
-	if row.Status != 0 {
+	if !canEditReimbursement(row.Status) {
 		return 400, "当前状态不可提交"
 	}
 	tid := uint64(claims.TenantId)
@@ -1013,6 +1170,7 @@ func reimburseSubmitCore(claims *jwtutil.Claims, id uint64) (int, string) {
 	if flowID == 0 {
 		return 400, "尚未配置审批流程"
 	}
+	actorName := reimburseActorName(tid, claims)
 
 	instID, err := approvalEngine.Submit(approvalEngine.SubmitInput{
 		Scope:      models.ApprovalScopeTenant,
@@ -1022,7 +1180,7 @@ func reimburseSubmitCore(claims *jwtutil.Claims, id uint64) (int, string) {
 		BizID:      id,
 		BizTitle:   reimburseBizTitle(row),
 		SubmitUID:  uint64(claims.UserID),
-		SubmitName: claims.Username,
+		SubmitName: actorName,
 		DeptID:     reimburseSubmitDeptID(tid, uint64(claims.UserID)),
 		FormData: map[string]interface{}{
 			"id":            id,
@@ -1037,7 +1195,7 @@ func reimburseSubmitCore(claims *jwtutil.Claims, id uint64) (int, string) {
 	}
 
 	// 流程未配置审批节点时引擎会直接通过，此时报销单同步为已通过（2）
-	status := int8(1)
+	status := reimbursementStatusApproving
 	var inst models.ApprovalInstance
 	if e := models.Orm.QueryTable(new(models.ApprovalInstance)).Filter("id", instID).One(&inst); e == nil {
 		switch inst.Status {
@@ -1057,7 +1215,8 @@ func reimburseSubmitCore(claims *jwtutil.Claims, id uint64) (int, string) {
 	}
 	_, err = models.Orm.Insert(&models.BackendApprovalRecord{
 		Tid: tid, UID: uint64Ptr(uint64(claims.UserID)), ReimbursementID: id,
-		ApproverID: uint64(claims.UserID), ApproverName: claims.Username, Action: models.ApprovalActionSubmit,
+		ApproverID: uint64(claims.UserID), ApproverName: actorName,
+		Action: models.ApprovalActionSubmit, Comment: nullableReimburseString(comment),
 		Step: 0, PrevStep: 0,
 	})
 	if err != nil {
@@ -1118,8 +1277,14 @@ type reimbursementStatusPayload struct {
 
 // 报销单状态（0草稿 1审批中 2已通过 3已驳回 4已撤回 5已打款）
 const (
-	reimbursementStatusApproved int8 = 2 // 已通过
-	reimbursementStatusPaid     int8 = 5 // 已打款
+	// reimbursementStatusDraft 草稿：新建后的唯一初始状态。
+	// 草稿可反复编辑/增删明细，只有用户在列表点「提交审核」才会进入审批流。
+	reimbursementStatusDraft     int8 = 0
+	reimbursementStatusApproving int8 = 1 // 审批中
+	reimbursementStatusApproved  int8 = 2 // 已通过
+	reimbursementStatusRejected  int8 = 3 // 已驳回
+	reimbursementStatusWithdrawn int8 = 4 // 已撤回
+	reimbursementStatusPaid      int8 = 5 // 已打款
 )
 
 // UpdateStatus POST /backend/reimbursements/:id/status — 报销人确认款项到账（置为「已打款」）。
@@ -1217,6 +1382,18 @@ func reimburseRecordsData(claims *jwtutil.Claims, id uint64) ([]models.BackendAp
 	if rows == nil {
 		rows = []models.BackendApprovalRecord{}
 	}
+	// 历史记录的 approver_name 可能为空（旧令牌没有 username 字段），读取时补齐
+	tid := uint64(claims.TenantId)
+	for i := range rows {
+		if strings.TrimSpace(rows[i].ApproverName) != "" {
+			continue
+		}
+		name := resolveReimburseUserName(tid, rows[i].ApproverID)
+		if name == "" {
+			name = "系统"
+		}
+		rows[i].ApproverName = name
+	}
 	return rows, 200, ""
 }
 
@@ -1603,38 +1780,44 @@ func (c *BackendReimburseController) Dashboard() {
 			paidIDs[rows[i].ID] = true
 		}
 	}
-	var items []models.BackendReimbursementItem
-	_, err = models.Orm.QueryTable(new(models.BackendReimbursementItem)).
-		Filter("tid", claims.TenantId).
-		Filter("uid", claims.UserID).
-		Filter("is_deleted", 0).
-		All(&items)
-	if err != nil {
-		c.reply(500, "查询失败", nil)
-		return
+	paidIDList := make([]uint64, 0, len(paidIDs))
+	for id := range paidIDs {
+		paidIDList = append(paidIDList, id)
 	}
 	typeAgg := map[string]*struct {
 		count  int
 		amount float64
 	}{}
-	for i := range items {
-		if !paidIDs[items[i].ReimbursementID] {
-			continue
+	if len(paidIDList) > 0 {
+		// 按已打款主单 ID 查明细，不依赖明细行的 tid/uid（历史数据可能不一致）
+		var items []models.BackendReimbursementItem
+		_, err = models.Orm.QueryTable(new(models.BackendReimbursementItem)).
+			Filter("reimbursement_id__in", paidIDList).
+			Filter("is_deleted", 0).
+			All(&items)
+		if err != nil {
+			c.reply(500, "查询失败", nil)
+			return
 		}
-		name := strings.TrimSpace(items[i].ExpenseType)
-		if name == "" {
-			name = "未分类"
+		for i := range items {
+			if !paidIDs[items[i].ReimbursementID] {
+				continue
+			}
+			name := strings.TrimSpace(items[i].ExpenseType)
+			if name == "" {
+				name = "未分类"
+			}
+			agg, ok := typeAgg[name]
+			if !ok {
+				agg = &struct {
+					count  int
+					amount float64
+				}{}
+				typeAgg[name] = agg
+			}
+			agg.count++
+			agg.amount += items[i].Amount
 		}
-		agg, ok := typeAgg[name]
-		if !ok {
-			agg = &struct {
-				count  int
-				amount float64
-			}{}
-			typeAgg[name] = agg
-		}
-		agg.count++
-		agg.amount += items[i].Amount
 	}
 	expenseTypes := make([]map[string]interface{}, 0, len(typeAgg))
 	for name, agg := range typeAgg {
diff --git a/go/controllers/backend_reimburse_test.go b/go/controllers/backend_reimburse_test.go
new file mode 100644
index 0000000..4fee870
--- /dev/null
+++ b/go/controllers/backend_reimburse_test.go
@@ -0,0 +1,27 @@
+package controllers
+
+import "testing"
+
+func TestCanEditReimbursement(t *testing.T) {
+	editable := []int8{
+		reimbursementStatusDraft,
+		reimbursementStatusRejected,
+		reimbursementStatusWithdrawn,
+	}
+	for _, status := range editable {
+		if !canEditReimbursement(status) {
+			t.Errorf("status %d should be editable", status)
+		}
+	}
+
+	locked := []int8{
+		reimbursementStatusApproving,
+		reimbursementStatusApproved,
+		reimbursementStatusPaid,
+	}
+	for _, status := range locked {
+		if canEditReimbursement(status) {
+			t.Errorf("status %d should not be editable", status)
+		}
+	}
+}
diff --git a/go/controllers/reimburse_approval_core.go b/go/controllers/reimburse_approval_core.go
index bbaca3d..18f5c2a 100644
--- a/go/controllers/reimburse_approval_core.go
+++ b/go/controllers/reimburse_approval_core.go
@@ -82,7 +82,7 @@ func reimburseActCore(claims *jwtutil.Claims, id uint64, pass bool, comment stri
 	}
 
 	applyReimburseApprovalResult(uint64(claims.TenantId), id,
-		uint64(claims.UserID), claims.Username, task.Sort,
+		uint64(claims.UserID), reimburseActorName(uint64(claims.TenantId), claims), task.Sort,
 		pass, comment, result.Finished, result.InstanceStat)
 
 	hint := result.Message
diff --git a/go/main.go b/go/main.go
index b7d74c0..5054a42 100644
--- a/go/main.go
+++ b/go/main.go
@@ -37,5 +37,9 @@ func main() {
 	// 启动支付补偿任务（超时关单 / 业务订单同步重试，5 分钟一轮）
 	payment.StartPaymentScheduler(make(chan struct{}))
 
+	// 保留 dev 模式原有的 `[D] router.go` 访问日志样式，
+	// 但改走带探针过滤的 console 适配器（见 middleware/security_probe.go）。
+	beego.BConfig.Log.Outputs = map[string]string{"filterconsole": ""}
+
 	beego.Run()
 }
diff --git a/go/middleware/security_probe.go b/go/middleware/security_probe.go
new file mode 100644
index 0000000..1f25cfe
--- /dev/null
+++ b/go/middleware/security_probe.go
@@ -0,0 +1,283 @@
+package middleware
+
+import (
+	"log"
+	"path"
+	"regexp"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/beego/beego/v2/core/logs"
+	beego "github.com/beego/beego/v2/server/web"
+	"github.com/beego/beego/v2/server/web/context"
+)
+
+// security_probe.go 扫描器探针的日志降噪与泄露检测。
+//
+// 公网服务器每天都会收到大量针对 .env / config.js / credentials.json 等
+// 敏感文件的自动化探测。它们全部 404 时属于背景噪音，逐条打印访问日志只会淹没真正的告警。
+// 这里接管 Beego 的访问日志过滤器：
+//   - 探针路径不再逐条打印；
+//   - 持续探测但均未命中时，每 10 分钟汇总提示一次「未发现泄露」；
+//   - 一旦探针路径返回 2xx（文件真实可访问），立即输出 [security][leak] 告警。
+//
+// 注意：该过滤器依赖 Beego 的 access log 流程，app.conf 中不要开启
+// EnableStaticLogs=true，否则 Beego 会跳过 DefaultAccessLogFilter。
+
+// filterconsole 是带探针过滤的 console 日志适配器。
+// 在 main.go 里把 BConfig.Log.Outputs 指向它，既保留 Beego dev 模式原有的
+// `[D] router.go` 访问日志样式，又能把探针/根路径 404 从日志里过滤掉。
+func init() {
+	logs.Register("filterconsole", func() logs.Logger {
+		return &probeFilterLogger{inner: logs.NewConsole()}
+	})
+}
+
+type probeFilterLogger struct {
+	inner logs.Logger
+}
+
+func (l *probeFilterLogger) Init(config string) error { return l.inner.Init(config) }
+
+func (l *probeFilterLogger) WriteMsg(lm *logs.LogMsg) error {
+	if shouldSuppressAccessLogMsg(lm.Msg) {
+		return nil
+	}
+	return l.inner.WriteMsg(lm)
+}
+
+func (l *probeFilterLogger) Destroy() { l.inner.Destroy() }
+func (l *probeFilterLogger) Flush()   { l.inner.Flush() }
+
+func (l *probeFilterLogger) SetFormatter(f logs.LogFormatter) { l.inner.SetFormatter(f) }
+
+var (
+	ansiColorRe      = regexp.MustCompile(`\x1b\[[0-9;]*m`)
+	accessStatusRe   = regexp.MustCompile(`\|\s*(\d{3})\s*\|`)
+	accessMethodPath = regexp.MustCompile(`\|\s*(GET|POST|PUT|DELETE|PATCH|HEAD|OPTIONS)\s+(\S+)`)
+)
+
+// shouldSuppressAccessLogMsg 解析 Beego dev 访问日志行，过滤探针与根路径 404。
+func shouldSuppressAccessLogMsg(msg string) bool {
+	clean := ansiColorRe.ReplaceAllString(msg, "")
+	m := accessMethodPath.FindStringSubmatch(clean)
+	if len(m) < 3 {
+		return false
+	}
+	p := path.Clean(m[2])
+	status := 0
+	if sm := accessStatusRe.FindStringSubmatch(clean); len(sm) == 2 {
+		status, _ = strconv.Atoi(sm[1])
+	}
+
+	if p == "/" && status == 404 {
+		recordRootNoise()
+		return true
+	}
+	if IsScannerProbe(p) {
+		recordProbeNoise()
+		return true
+	}
+	return false
+}
+
+// scannerProbeFiles 常见扫描器探测的完整文件名（小写）。
+var scannerProbeFiles = map[string]struct{}{
+	".env":                {},
+	"env":                 {},
+	"env.js":              {},
+	"env.txt":             {},
+	"config.js":           {},
+	"config.json":         {},
+	"config.yaml":         {},
+	"config.yml":          {},
+	"config.php":          {},
+	"credentials":         {},
+	"credentials.json":    {},
+	"credentials.ini":     {},
+	"secrets.json":        {},
+	"lithic.json":         {},
+	"sardine.json":        {},
+	"database.sql":        {},
+	"phpinfo":             {},
+	"phpinfo.php":         {},
+	"info.php":            {},
+	"wp-config.php":       {},
+	"wp-config.php.bak":   {},
+	"wp-login.php":        {},
+	"docker-compose.yml":  {},
+	"docker-compose.yaml": {},
+	"composer.json":       {},
+	"gitconfig":           {},
+	"runtime-config.js":   {},
+	"settings.json":       {},
+	"index.js":            {},
+	"aws.yml":             {},
+	"aws.json":            {},
+}
+
+// scannerProbeDirs 目录型探针（源代码/凭证/WordPress 目录）。
+var scannerProbeDirs = []string{
+	"/.git",
+	"/.svn",
+	"/.aws",
+	"/.ssh",
+	"/vendor/composer",
+	"/wp-content",
+	"/wp-admin",
+	// Go 源码目录：日志里出现的 /middleware、/controllers、/routers 等
+	"/middleware",
+	"/routers",
+	"/controllers",
+	"/models",
+	"/services",
+	"/pkg",
+	"/scripts",
+	"/conf",
+	"/database",
+	"/docs",
+	"/cmd",
+	"/version",
+}
+
+// IsScannerProbe 判断路径是否属于常见的敏感文件扫描探针。
+func IsScannerProbe(rawPath string) bool {
+	p := strings.ToLower(path.Clean("/" + strings.TrimPrefix(rawPath, "/")))
+	if p == "/" {
+		return false
+	}
+	base := path.Base(p)
+	if _, ok := scannerProbeFiles[base]; ok {
+		return true
+	}
+	// .env / .env.local / sendgrid.env / config.env 等变体
+	if base == ".env" || base == "env" ||
+		strings.HasPrefix(base, ".env.") || strings.HasSuffix(base, ".env") {
+		return true
+	}
+	for _, dir := range scannerProbeDirs {
+		if p == dir || strings.HasPrefix(p, dir+"/") {
+			return true
+		}
+	}
+	// 源码/配置文件后缀：/middleware/security_probe.go、/controllers/backend_reimburse.go 等
+	switch path.Ext(base) {
+	case ".go", ".vue", ".ts", ".sql", ".conf":
+		return true
+	}
+	// WordPress 常见备份文件，如 wp-config.php.bak
+	if strings.HasPrefix(base, "wp-") && strings.HasSuffix(base, ".bak") {
+		return true
+	}
+	return false
+}
+
+const probeSummaryInterval = 10 * time.Minute
+
+var probeLogState = struct {
+	mu              sync.Mutex
+	suppressed      int
+	lastSummary     time.Time
+	rootSuppressed  int
+	lastRootSummary time.Time
+	leakLogged      map[string]time.Time
+}{
+	leakLogged: make(map[string]time.Time),
+}
+
+// probeAccessLogFilter 包装 Beego 默认访问日志过滤器。
+// Filter 返回 true 时 Beego 跳过该请求的访问日志。
+type probeAccessLogFilter struct {
+	fallback beego.FilterHandler
+}
+
+// NewSecurityProbeLogFilter 创建扫描探针访问日志过滤器。
+func NewSecurityProbeLogFilter(fallback beego.FilterHandler) beego.FilterHandler {
+	return &probeAccessLogFilter{fallback: fallback}
+}
+
+func (f *probeAccessLogFilter) Filter(ctx *context.Context) bool {
+	p := path.Clean(ctx.Request.URL.Path)
+	status := ctx.ResponseWriter.Status
+
+	// 当前进程只提供后端 API / 认证中心，根路径没有绑定站点；
+	// 公网扫描器/爬虫大量请求 / 得到 404，单独聚合，不逐条刷日志。
+	if p == "/" && status == 404 {
+		recordRootNoise()
+		return true
+	}
+
+	if !IsScannerProbe(p) {
+		if f.fallback != nil {
+			return f.fallback.Filter(ctx)
+		}
+		return false
+	}
+
+	// 平台后台 SPA 对未知路径会兜底返回 index.html（200），
+	// 这不代表敏感文件可访问，不能当成泄露。
+	spaFallback, _ := ctx.Input.GetData("spa_fallback").(bool)
+	contentType := strings.TrimSpace(ctx.ResponseWriter.Header().Get("Content-Type"))
+
+	// 只有「明确 2xx + 有内容类型」才判定为可访问资源。
+	// status=0 或 Content-Type 为空多为 SPA 兜底/空响应，避免误报泄漏。
+	if status >= 200 && status < 300 && !spaFallback && contentType != "" {
+		recordProbeLeak(ctx, status, contentType)
+	} else {
+		recordProbeNoise()
+	}
+
+	// 探针请求不进入常规访问日志
+	return true
+}
+
+func recordProbeNoise() {
+	probeLogState.mu.Lock()
+	defer probeLogState.mu.Unlock()
+
+	probeLogState.suppressed++
+	if !probeLogState.lastSummary.IsZero() &&
+		time.Since(probeLogState.lastSummary) < probeSummaryInterval {
+		return
+	}
+	count := probeLogState.suppressed
+	probeLogState.suppressed = 0
+	probeLogState.lastSummary = time.Now()
+	log.Printf("[security] 已忽略 %d 次敏感文件探测请求（.env/config/credentials 等），未发现泄漏", count)
+}
+
+func recordRootNoise() {
+	probeLogState.mu.Lock()
+	defer probeLogState.mu.Unlock()
+
+	probeLogState.rootSuppressed++
+	if !probeLogState.lastRootSummary.IsZero() &&
+		time.Since(probeLogState.lastRootSummary) < probeSummaryInterval {
+		return
+	}
+	count := probeLogState.rootSuppressed
+	probeLogState.rootSuppressed = 0
+	probeLogState.lastRootSummary = time.Now()
+	log.Printf("[http] 已忽略 %d 次根路径 404（当前 Host 未绑定站点），如需排查请用正式域名访问", count)
+}
+
+func recordProbeLeak(ctx *context.Context, status int, contentType string) {
+	key := ctx.Request.Method + " " + ctx.Request.URL.Path
+	now := time.Now()
+
+	probeLogState.mu.Lock()
+	last := probeLogState.leakLogged[key]
+	if !last.IsZero() && now.Sub(last) < probeSummaryInterval {
+		probeLogState.mu.Unlock()
+		return
+	}
+	probeLogState.leakLogged[key] = now
+	probeLogState.mu.Unlock()
+
+	log.Printf(
+		"[security][leak] 敏感文件探测命中可访问资源: %s %s -> %d (Content-Type: %s)，疑似泄漏，请立即检查该路径是否应公开",
+		ctx.Request.Method, ctx.Request.URL.Path, status, contentType,
+	)
+}
diff --git a/go/middleware/security_probe_test.go b/go/middleware/security_probe_test.go
new file mode 100644
index 0000000..e0ad292
--- /dev/null
+++ b/go/middleware/security_probe_test.go
@@ -0,0 +1,92 @@
+package middleware
+
+import "testing"
+
+func TestShouldSuppressAccessLogMsg(t *testing.T) {
+	probeLine := "|      127.0.0.1| 404 |    221.723µs| nomatch| GET      /middleware/security_probe.go"
+	if !shouldSuppressAccessLogMsg(probeLine) {
+		t.Fatalf("probe access line should be suppressed")
+	}
+
+	rootLine := "|      127.0.0.1| 404 |    219.710µs| nomatch| GET      /"
+	if !shouldSuppressAccessLogMsg(rootLine) {
+		t.Fatalf("root 404 access line should be suppressed")
+	}
+
+	normalLine := "|      127.0.0.1| 200 |      1.649ms|   match| GET      /auth/login   r:/auth/login"
+	if shouldSuppressAccessLogMsg(normalLine) {
+		t.Fatalf("normal access line should not be suppressed")
+	}
+}
+
+func TestIsScannerProbe(t *testing.T) {
+	probes := []string{
+		"/config.js",
+		"/config.json",
+		"/config.yaml",
+		"/config.php",
+		"/config/config.js",
+		"/database.sql",
+		"/.env",
+		"/demo/.env",
+		"/sendgrid.env",
+		"/config.env",
+		"/.env.lithic",
+		"/credentials",
+		"/credentials.json",
+		"/credentials.ini",
+		"/secrets.json",
+		"/lithic.json",
+		"/sardine.json",
+		"/phpinfo",
+		"/phpinfo.php",
+		"/info.php",
+		"/wp-config.php",
+		"/wp-config.php.bak",
+		"/wp-content/debug.log",
+		"/wp-login.php",
+		"/vendor/composer/installed.json",
+		"/docker-compose.yml",
+		"/composer.json",
+		"/gitconfig",
+		"/runtime-config.js",
+		"/settings.json",
+		"/index.js",
+		"/config/aws.yml",
+		"/v1/.env",
+		"/demo/../.env",
+		"/middleware",
+		"/middleware/security_probe.go",
+		"/controllers/backend_reimburse.go",
+		"/routers",
+		"/routers/spa.go",
+		"/models/reimburse.go",
+		"/services/approval/engine.go",
+		"/scripts/uidmigrate/migrate_uid.go",
+		"/conf/app.conf",
+	}
+	for _, p := range probes {
+		if !IsScannerProbe(p) {
+			t.Errorf("IsScannerProbe(%q) = false, want true", p)
+		}
+	}
+
+	normal := []string{
+		"/",
+		"/favicon.ico",
+		"/backend/reimbursements",
+		"/platform/menu/1",
+		"/site/setting",
+		"/site/news/1",
+		"/uploads/logo.png",
+		"/themes/default/index.html",
+		"/static/js/app.js",
+		"/news",
+		"/page/about",
+	}
+	for _, p := range normal {
+		if IsScannerProbe(p) {
+			t.Errorf("IsScannerProbe(%q) = true, want false", p)
+		}
+	}
+}
diff --git a/go/routers/backend/backend.go b/go/routers/backend/backend.go
index 20a40b6..035c373 100644
--- a/go/routers/backend/backend.go
+++ b/go/routers/backend/backend.go
@@ -310,6 +310,7 @@ func RegisterAuthRoutes() {
 	beego.Router("/backend/reimbursements/:id/items/:item_id", &controllers.BackendReimburseController{}, "post:UpdateItem;delete:DeleteItem")
 	beego.Router("/backend/reimbursements/:id", &controllers.BackendReimburseController{}, "get:Detail;post:Update;delete:Delete")
 	beego.Router("/backend/reimbursements/:id/submit", &controllers.BackendReimburseController{}, "post:Submit")
+	beego.Router("/backend/reimbursements/:id/withdraw", &controllers.BackendReimburseController{}, "post:Withdraw")
 	beego.Router("/backend/reimbursements/:id/status", &controllers.BackendReimburseController{}, "post:UpdateStatus")
 	beego.Router("/backend/reimbursements/:id/records", &controllers.BackendReimburseController{}, "get:Records")
 
diff --git a/go/routers/router.go b/go/routers/router.go
index 999e6c2..6edf43b 100644
--- a/go/routers/router.go
+++ b/go/routers/router.go
@@ -18,6 +18,12 @@ import (
 
 // 初始化路由（精简版）
 func init() {
+	// 扫描器探针降噪：.env / config.js / credentials.json / Go 源码路径等探测请求不再逐条打印，
+	// 全部 404 时只定期汇总「未发现泄露」，一旦返回 2xx 立即告警具体路径。
+	// dev 模式的 `[D] router.go` 访问日志由 middleware 的 filterconsole 适配器过滤，
+	// 这里保留 DefaultAccessLogFilter 仅用于 AccessLogs 开启的场景。
+	beego.DefaultAccessLogFilter = middleware.NewSecurityProbeLogFilter(beego.DefaultAccessLogFilter)
+
 	// 全局 CORS 处理 + 预检请求
 	// 注意：Allow-Origin 为 * 时不能同时设置 Allow-Credentials: true，否则浏览器会拒绝带 Authorization 的预检（上传/接口跨域常见现象）。
 	// 当前 JWT 走 Header、前端 axios withCredentials=false，无需携带 Cookie，故不返回 Allow-Credentials。
diff --git a/go/routers/spa.go b/go/routers/spa.go
index 355cc43..4f9c4d4 100644
--- a/go/routers/spa.go
+++ b/go/routers/spa.go
@@ -75,7 +75,9 @@ func RegisterPlatformSPA(spaDir string, hosts ...string) {
 			return
 		}
 
-		// SPA fallback：未知路径（hash 路由直接访问 /xxx/yyy）回 index.html
+		// SPA fallback：未知路径（hash 路由直接访问 /xxx/yyy）回 index.html。
+		// 标记一下，避免安全探针过滤器把「兜底返回首页」误判成敏感文件泄露。
+		ctx.Input.SetData("spa_fallback", true)
 		http.ServeFile(ctx.ResponseWriter, ctx.Request, spaDir+"/index.html")
 	})
 }
\ No newline at end of file