# 现有源码接手 First-10：合成交付样品

> **FICTIONAL / SYNTHETIC**：这是虚构 uni-app 订单后台的可复现样品，不是买家项目、真实漏洞、询盘、订单或付费交付。没有使用生产账号、凭据、个人数据或第三方私有源码。

## 首轮结论

- 决策：**AUDIT FIRST**
- 价格锚点：CNY299 / 24 小时
- 发现：10 项，ID 唯一 10/10
- 第一刀：恢复交接文档声明的启动命令别名；不先做全量依赖升级
- 验收：补丁别名可解析到现有脚本，PASS

## First-10

| ID | 严重度 | 证据 | 下一动作 |
|---|---|---|---|
| BOOT-01 | BLOCKER | npm run dev:h5 is absent from package.json scripts | Add dev:h5 as a reviewable alias to the existing dev script |
| RUNTIME-02 | HIGH | Declared Node 18; observed Node 22 | Pin the first reproduction to the declared runtime before upgrading |
| DEP-03 | HIGH | No lockfile is present in the handoff fixture | Recover or regenerate one lockfile only after the runtime is fixed |
| API-04 | MEDIUM | API base is fixed at src/config.js:4 | Move the base URL to a non-secret environment contract |
| AUTH-05 | HIGH | Refresh failure has no explicit error contract | Define expired, rejected and unavailable states before touching a real account |
| DATA-06 | HIGH | Order amount is represented as string | Define decimal precision and serialization before migration |
| BUILD-07 | MEDIUM | Mini-program build still uses a placeholder AppID | Keep buyer-owned AppID and signing steps outside the public sample |
| RELEASE-08 | MEDIUM | No CI or reproducible release command is declared | Add one bounded build check after the first boot chain is fixed |
| TEST-09 | HIGH | No smoke test is present | Add one synthetic order-path smoke test before wider refactoring |
| HANDOFF-10 | MEDIUM | No startup or handoff README is present | Record runtime, install, start, test and known-stop commands |

## 第一补丁

```json
{
  "file": "package.json",
  "operation": "add",
  "path": "/scripts/dev:h5",
  "value": "npm run dev"
}
```

该补丁只恢复已声明的交接命令，不假装解决依赖、接口、数据与发布问题。进入真实项目时，仍需买家确认源码权利，并提供脱敏最小复现或买家自有测试环境。

## 可复核证据

- fixture handoff SHA-256：`d7e48d9fe7693fa066a5f36d1157c5c31585be6b025fbcb3e3757ec9bbae74de`
- fixture package SHA-256：`d6f33bae5c0b3708e3af2ea52d1ae2aab8f619919924e1dbbe9f626d1443b138`
- JSON 回执：[/codebase-takeover-first10-sample.json](/codebase-takeover-first10-sample.json)
- 需求入口：[/codebase-takeover-first10](/codebase-takeover-first10)