fix(governance): batch activate subscriptions excludes failed and dirty renewal orders

app/Http/Controllers/Admin/PlatformOrderController.php

@@ -1461,10 +1461,20 @@ class PlatformOrderController extends Controller
         }
 
         // 只处理“可同步”的订单（双保险，避免误操作）
+        // 口径需与 applyFilters(syncable_only=1) 一致：
+        // - 已支付 + 已生效
+        // - 未同步（subscription_activation.subscription_id 为空）
+        // - 非失败（subscription_activation_error.message 为空）
+        // - 排除：续费但未绑定订阅（脏数据，避免串单风险）
         $query = $query
             ->where('payment_status', 'paid')
             ->where('status', 'activated')
-            ->whereRaw("JSON_EXTRACT(meta, '$.subscription_activation.subscription_id') IS NULL");
+            ->whereRaw("JSON_EXTRACT(meta, '$.subscription_activation.subscription_id') IS NULL")
+            ->whereRaw("JSON_EXTRACT(meta, '$.subscription_activation_error.message') IS NULL")
+            ->where(function (Builder $q) {
+                $q->where('order_type', '!=', 'renewal')
+                    ->orWhereNotNull('site_subscription_id');
+            });
 
         $limit = (int) $request->input('limit', 50);
         $limit = max(1, min(500, $limit));