diff --git a/openspec/changes/quota-cert-inline-bindings/tasks.md b/openspec/changes/quota-cert-inline-bindings/tasks.md
index 41060c750..5f9b81846 100644
--- a/openspec/changes/quota-cert-inline-bindings/tasks.md
+++ b/openspec/changes/quota-cert-inline-bindings/tasks.md
@@ -9,8 +9,10 @@
 
 ## 已执行验证
 - 后端相关 SQLite 内存测试：78 passed（含6项新增保护用例、引用只读状态断言）。
-- 前端真实页面脚本 harness：16 passed；包含新增空行、切换合同、引用/合同锁定与既有ID往返。
+- 前端真实页面脚本 harness：17 passed；包含新增空行、切换合同、引用/合同锁定与既有ID往返。
 - 改动页面和API文件 ESLint：通过；生产 Vite build：通过，有既有组件命名与大包提示。
 - 全仓 vue-tsc --noEmit：未通过，输出1326行，改动页面和API类型无诊断；其他文件类型错误未纳入本工单修复。
 - Chrome 1440×1000 合成数据组件渲染：使用实际两区模板、Element Plus 和构建CSS；新增空行/锁定状态无JS错误，锁定按钮禁用，提示可换行。该验证不等同于登录业务环境端到端或集成环境验收。
 - 未执行：真实业务环境联调、集成分支冒烟；未启停既有服务，未修改业务数据库。
+
+- 独立审查发现图片识别可填入只读空引用；已用页面真实识别流程复现失败，并修复识别合并时跳过锁定引用，新增回归通过。
diff --git a/web-admin/scripts/quota-cert-form.test.ts b/web-admin/scripts/quota-cert-form.test.ts
index 2a061ea41..37ac91567 100644
--- a/web-admin/scripts/quota-cert-form.test.ts
+++ b/web-admin/scripts/quota-cert-form.test.ts
@@ -566,3 +566,26 @@ test('referenced bindings and references cannot be edited or removed', async ()
     h.stop()
   }
 })
+
+test('recognition cannot populate locked empty references while other empty fields remain fillable', async () => {
+  const h = harness(),
+    s = h.state
+  try {
+    h.setCert({ referencesEditable: false, purchaseRefs: [], attachmentUrls: 'one.png' })
+    s.kind.value = 'transport'
+    await s.edit({ id: 'cert' })
+    const parsing = s.recognize()
+    h.parses[0].resolve({
+      candidates: {
+        purchaseRefs: [{ referenceType: 'unknown', referenceNo: 'OCR-NEW' }],
+        shipperName: '合成托运单位'
+      },
+      invalidFields: {}
+    })
+    await parsing
+    assert.deepEqual(s.form.value.purchaseRefs, [])
+    assert.equal(s.form.value.shipperName, '合成托运单位')
+  } finally {
+    h.stop()
+  }
+})
diff --git a/web-admin/src/views/pl/quota-cert/index.vue b/web-admin/src/views/pl/quota-cert/index.vue
index ecc40c33e..0b7493ef4 100644
--- a/web-admin/src/views/pl/quota-cert/index.vue
+++ b/web-admin/src/views/pl/quota-cert/index.vue
@@ -982,7 +982,9 @@
         !(form.value.attachmentUrls || '').split(',').includes(targetImage)
       )
         return
-      mergeCandidates(form.value as any, result.candidates, edited)
+      const protectedFields =
+        form.value.referencesEditable === false ? new Set([...edited, 'purchaseRefs']) : edited
+      mergeCandidates(form.value as any, result.candidates, protectedFields)
       await nextTick()
       if (session !== editSession || !formVisible.value) return
       formRef.value?.clearValidate()