diff --git a/xiaoqu-agent-service/src/main/java/me/iiv/agent/es/PaperUseLogEsGatewayImpl.java b/xiaoqu-agent-service/src/main/java/me/iiv/agent/es/PaperUseLogEsGatewayImpl.java
index 5c69d6f..51ee598 100644
--- a/xiaoqu-agent-service/src/main/java/me/iiv/agent/es/PaperUseLogEsGatewayImpl.java
+++ b/xiaoqu-agent-service/src/main/java/me/iiv/agent/es/PaperUseLogEsGatewayImpl.java
@@ -45,7 +45,8 @@ public class PaperUseLogEsGatewayImpl implements PaperUseLogEsGateway {
                                   Long fromMillis, Long toMillis, Integer deviceType, String positionMode) {
         ArrayNode filters = baseFilters(districtId, gender, fromMillis, toMillis, deviceType, positionMode);
         // 上纸(2)+撤纸(4) 合并后 rfid 去重（老 :302-342）
-        ArrayNode stateTerms = filters.addObject().putObject("terms").putObject("state").putArray("terms");
+        // 正确结构是 {"terms":{"state":[2,4]}}；写成 {"terms":{"state":{"terms":[...]}}} 会被 ES 以 400 拒绝（2026-09-22 生产实测）
+        ArrayNode stateTerms = filters.addObject().putObject("terms").putArray("state");
         stateTerms.add(2).add(4);
         try {
             ObjectNode body = mapper.createObjectNode();