diff --git a/app/services/cc_completion.py b/app/services/cc_completion.py
index f145721..2f846cd 100644
--- a/app/services/cc_completion.py
+++ b/app/services/cc_completion.py
@@ -328,7 +328,10 @@ def cc_state_for(cc_map: dict | None, channel: str, value: str) -> dict | None:
 
 
 def outbound_number(value: str, state: dict | None) -> str:
-    """邮件正文联系方式行的展示值（spec §5 首封矩阵）：
+    """
+
+    ⚠️ 前提: state 必须来自 cc_state_for 的产物(canon 已匹配);
+    裸传 state 会失去残留态防御(审查 Issue 2)。邮件正文联系方式行的展示值（spec §5 首封矩阵）：
 
     - 有 e164 且 confirmed → 纯 e164（prefix_normalized/ip_confirm/
       customer_stated，码是客户自己写的/确认过的，零标注）；
@@ -341,7 +344,7 @@ def outbound_number(value: str, state: dict | None) -> str:
     raw = str(value or "")
     e164 = str((state or {}).get("e164") or "")
     if not e164:
-        return raw + NOTE_MISSING_CC if state is not None else raw
+        return (raw + NOTE_MISSING_CC) if state is not None else raw
     if state.get("confirmed"):
         return e164
     return e164 + NOTE_UNCONFIRMED