Every issue fixed today across the 5 native repos (Android / Android TV / iOS / tvOS / Windows) was independently re-reviewed against the business big picture — not just the diff. 全部12项修复逐一复审：不止看代码，更质询其商业逻辑与失败语义是否符合中国大陆网络现实。
Verdicts: 2 sound · 6 sound-with-risks · 3 flawed · 1 wrong-approach | 结论分布：2 稳健 · 6 稳健有险 · 3 有缺陷 · 1 方向错误
Exactly the class you flagged. Mirrors exist for robustness: one success = success. Four of today's fixes inverted this into "any failure = failure" — or fail-closed teardowns on transient noise. In CN, where one dead mirror is Tuesday, that converts routine network weather into outages, lockouts and forced re-logins. 四项修复（AND-13 / AND-11 / TV-8 / WIN-14）把「任一镜像成功即成功」反转为「任一镜像失败即失败」，或对瞬时故障做失败关闭式拆除。在墙内，单镜像故障是常态——这等于把日常网络波动变成事故。
Where it shipped today · 今日出现位置：
TV-8 one poisoned mirror blocks all CN logins
AND-11 plan catalog & order polling need all-mirror unanimity
WIN-14 frozen origin allowlist + deleted failover layers
AND-13 single-mirror 403 → durable account invalidation.
The mirror image, done right · 同类问题的正确修法：
APN-59 TV-11 relaxed over-strict exact-match provisioning checks to superset containment — the profile is an authorization superset, the signed binary stays exact. Same first principle, applied correctly. 描述文件本就是授权超集，改为包含校验、二进制仍精确校验——同一原理的正确应用。
Foregrounding the app stops a healthy streaming tunnel and never restarts it; one GFW-poisoned mirror vetoes healthy mirrors and blocks all CN logins; one CDN 502 wipes the device master key, permanently bricking the encrypted node cache; auto-reconnect removed entirely. 前台切换即断流不复连；单坏镜像否决登录；单次502即销毁主密钥；彻底移除自动重连。
WIN-14's frozen 18-host origin allowlist caused a same-day outage when the backend rotated the subscribe domain: paying users see a 购买套餐 upsell card instead of nodes. Until update adoption: point the panel's subscribe_url back at an approved v1 origin. 面板应先把 subscribe_url 切回 v1 白名单内域名，直至新版覆盖率达标。
AND-11: process death between order-journal write and POST bricks purchase AND logout forever (its own consultation doc flagged this P1 and it merged anyway); an ambiguous account-deletion timeout locks the whole app behind a non-dismissible screen. AND-13: post-upgrade first launch with flaky network silently refuses Connect despite a valid stored config. 订单日志落盘后进程被杀→购买与退出永久锁死；注销超时→全屏死锁；升级首启弱网→静默拒连。
Any-success mirror arbitration; revalidate without stopping the tunnel; key deletion only on logout; restore on-demand reconnect.
Then merge WIN-CEO after a Windows CI build; plan the signed runtime origin-policy channel to end the rotation treadmill.
Also: clear the mutation journal on definite success (AND-12), never latch identity from transport garbage.
Also restore visible connect errors in the V2 UI and run one signed-device NE smoke.
History still contains the keystore + credentials; containment currently rests on repo privacy alone.
"Reads: first valid success wins. Redundancy is never conjunctive. Fail-closed teardown only on authoritative business verdicts, never on transport noise." Four independent fixes re-invented the same inversion in one day — that's a missing written contract, not four careless authors. 一天内四处独立复发同一反转——缺的是成文契约，不是个别疏忽。
All four product invariants (ingress-IP secrecy, no protocol in UI, list-only nodes, liquid glass) passed in all 12 reviews — several fixes actively strengthened them (encrypted caches, label sanitization, log redaction). The low-level engineering is consistently strong: atomic encrypted persistence, one-shot POST transports, typed state machines, SHA-pinned CI. Today's failures are almost entirely policy-layer — what to do when something fails — not mechanics. 四条产品铁律12项全过，多项反而增强（缓存加密、标签脱敏、日志去址）。底层工程功力扎实——问题几乎全部出在「失败时怎么办」的策略层，而非机制层。