@curless/hotel-storefront 0.26.2 → 0.27.1

package/dist/huazhu/backend.js

@@ -1,16 +1,17 @@
 import { randomBytes, randomUUID } from 'node:crypto';
-import { DEFAULT_PAGE, MAX_PAGE, REQUEST_KINDS, REQUEST_NOTE_MAX, } from '../backend.js';
+import { DEFAULT_PAGE, MAX_PAGE, REQUEST_KINDS, REQUEST_NOTE_MAX, guestTooLong, partyNeeds, } from '../backend.js';
 import { addDays, atHotelTime, nights as nightsBetween, stayProblem, todayAt } from '../dates.js';
 import { byWords, splitByStay } from '../demo-hotels.js';
 import { FACILITIES, hasFacility } from '../facilities.js';
 import { BOOKING_LIMITS, DAY_MS, HOUR_MS, WindowCounter } from '../limits.js';
 import { formatMoney, minorFactor, money, multiplyMoney, toMinor } from '../money.js';
 import { MAX_ROOMS_PER_LINE } from '../trip.js';
-import { statusOf } from './bookings.js';
+import { IN_REQUEST_AT_MS, StoreWriteError, nextCheckAt, statusOf, } from './bookings.js';
 import { describePolicy, feeFor, freeUntilOf, nightAuditOf, parseCancelPolicy, penaltyAt, refundableFrom, } from './cancel-policy.js';
 import { haystackOf, inPlace, roomPhoto, toHotel } from './catalog.js';
 import { HuazhuRefusal, HuazhuUnreachable } from './client.js';
 import { ariRanges, bookableNow, clockAt, offeredAtAll, sell, } from './sellable.js';
+import { BOOK_EXISTS, BOOK_REFUSALS, CODES, } from './wire.js';
 export const HUAZHU_CAPABILITIES = {
     members: false,
     extras: false,
@@ -29,6 +30,26 @@ export const isPhone = (raw) => {
     const p = (raw ?? '').trim();
     return /^\+?[\d\s()-]+$/.test(p) && p.replace(/\D/g, '').length >= 6;
 };
+/**
+ * The guest's code for a booking: the connector's own, random, and the same
+ * from the moment it is asked for to the day it is forgotten.
+ *
+ * ⚠️ NEVER HUAZHU'S ORDER NUMBER. Huazhu numbers its orders in sequence
+ * (R + hotel + counter, on the sandbox 44 seconds apart: R10011014,
+ * R10021015): a code next to someone's gives their booking away to anyone
+ * who knows their email, and the count of everyone's (2026-10-05 audit, P1-6).
+ * 32 letters and digits that cannot be misread, eight of them: 2^40.
+ */
+const CODE_LETTERS = 'ABCDEFGHJKLMNPQRSTUVWXYZ23456789';
+export const newPublicCode = (taken) => {
+    for (;;) {
+        const code = `HZ-${[...randomBytes(8)].map((b) => CODE_LETTERS[b % 32]).join('')}`;
+        if (!taken(code))
+            return code;
+    }
+};
+/** The same trip asked for again this soon, by the same conversation and email, is answered with the first. */
+const SAME_TRIP_MS = 10 * 60_000;
 /**
  * The most hotels priced for one search. A city can hold hundreds of Huazhu
  * hotels, and every one priced is two calls to Huazhu; past this, the page is
@@ -156,8 +177,53 @@ export const createHuazhuHotels = (opts) => {
     const limits = { ...BOOKING_LIMITS, ...(opts.limits ?? {}) };
     const requestsByEmail = new WindowCounter(DAY_MS, now);
     const requestsByIp = new WindowCounter(HOUR_MS, now);
-    /** When the deployment's daily ceiling last turned a booking away - a person is asked for for a day after. */
-    let ceilingHitAt;
+    /**
+     * Bookings a request has passed the limits for and not yet written down.
+     *
+     * ⚠️ TAKEN THE MOMENT THE CHECK PASSES. The rows are written after prebook,
+     * seconds later - and five requests at once all passed a limit of three
+     * before any was written (2026-10-05 audit, P1-5).
+     */
+    const slots = new Set();
+    const slotsWhere = (pred) => [...slots].filter(pred).reduce((a, x) => a + x.n, 0);
+    /** Requests in flight, by conversation and by email - see `single`. */
+    const flights = new Map();
+    /** Set by `drain`: a stopping process starts no booking. */
+    let closing = false;
+    /**
+     * One booking request at a time per conversation and per email.
+     *
+     * ⚠️ TWO AT ONCE BOOKED TWICE. The trip is emptied only when a request
+     * succeeds, and every request has its own distributorResId: a guest who
+     * pressed twice, or a host that retried, had two real bookings (2026-10-05
+     * audit, P1-2). The second waits for the first, then finds its trip
+     * already booked.
+     */
+    const single = async (keys, run) => {
+        for (;;) {
+            const busy = keys.flatMap((k) => {
+                const p = flights.get(k);
+                return p ? [p] : [];
+            });
+            if (busy.length === 0)
+                break;
+            await Promise.allSettled(busy);
+        }
+        // Nothing awaited between the check above and these lines: no other
+        // request can slip in.
+        const p = run();
+        const done = p.then(() => undefined, () => undefined);
+        for (const k of keys)
+            flights.set(k, done);
+        try {
+            return await p;
+        }
+        finally {
+            for (const k of keys)
+                if (flights.get(k) === done)
+                    flights.delete(k);
+        }
+    };
     // ------------------------------------------------------------- lookups ----
     /**
      * Every hotel, as the connector shows it - worked out again only when the
@@ -342,7 +408,7 @@ export const createHuazhuHotels = (opts) => {
         const only = (k) => kinds.size === 1 && kinds.has(k);
         if (only('party')) {
             const largest = Math.max(...fails.map((f) => Number(/\d+/.exec(f.why)?.[0] ?? 0)));
-            return `No room here sleeps ${stay.guests}; the largest sleeps ${largest}, so two rooms would work.`;
+            return partyNeeds(stay.guests, largest);
         }
         if (only('prepaid'))
             return 'Every rate here for those nights is paid in advance, and this connector books rates paid at the hotel.';
@@ -505,24 +571,31 @@ export const createHuazhuHotels = (opts) => {
         ...(b.cancellationFee ? { cancellationFee: b.cancellationFee } : {}),
         ...(b.requests ? { requests: b.requests } : {}),
     });
+    /**
+     * The codes a guest may have been given for a booking: ours, and the
+     * distributorResId a booking still waiting on Huazhu showed before 0.27.
+     * ⚠️ NEVER Huazhu's order number - see `newPublicCode`. A booking made
+     * before 0.27 showed it as its code, and is opened by it only in the
+     * conversation that made it.
+     */
+    const codesOf = (b) => [b.confirmationCode !== b.resId ? b.confirmationCode : undefined, b.distributorResId]
+        .filter((x) => !!x)
+        .map((x) => x.toLowerCase());
     const findOwn = (ref, who) => {
         const wanted = ref.trim().toLowerCase();
         if (!wanted)
             return undefined;
-        const matches = (b) => [b.id, b.confirmationCode, b.resId, b.distributorResId]
-            .filter(Boolean)
-            .some((x) => String(x).toLowerCase() === wanted);
-        const own = store.all().find((b) => b.owners.includes(who.sessionId) && matches(b));
+        const own = store
+            .all()
+            .find((b) => b.owners.includes(who.sessionId) &&
+            [b.id.toLowerCase(), b.confirmationCode.toLowerCase(), ...codesOf(b)].includes(wanted));
         if (own || !who.email)
             return own;
         // ⚠️ A CODE AND ITS EMAIL, never an id and never an email alone - see the seam.
         const email = who.email.trim().toLowerCase();
         const there = store
             .all()
-            .find((b) => [b.confirmationCode, b.resId]
-            .filter(Boolean)
-            .some((x) => String(x).toLowerCase() === wanted) &&
-            b.guest.email.trim().toLowerCase() === email);
+            .find((b) => codesOf(b).includes(wanted) && b.guest.email.trim().toLowerCase() === email);
         if (there) {
             const owners = [...new Set([...there.owners, who.sessionId])];
             // The conversation that made it stays; the oldest finder goes.
@@ -557,6 +630,10 @@ export const createHuazhuHotels = (opts) => {
             return b;
         }
     };
+    /** Why a booking cannot be cancelled yet: Huazhu has not said whether it exists. */
+    const waitingWords = (b) => b.status === 'unconfirmed'
+        ? `${opts.sandbox ? 'The simulated Huazhu' : 'Huazhu'} has not said whether this booking was made, and a person here is confirming it. It cannot be cancelled here until then - ask again later.`
+        : `${opts.sandbox ? 'The simulated Huazhu' : 'Huazhu'} has not confirmed this booking yet - that takes up to eight minutes. It can be cancelled once it is confirmed.`;
     const feeNow = (b) => {
         const policy = policyOf(b.cancelCode);
         const amounts = {
@@ -582,18 +659,380 @@ export const createHuazhuHotels = (opts) => {
             freeUntil: freeUntilOf(policy, b.stay.checkIn, b.tz, now()),
         };
     };
-    /** Chase one unanswered booking call for a little while, inside the guest's request. */
-    const settle = async (row) => {
+    /**
+     * Chase one unanswered booking call inside the guest's request - the first
+     * of its checks (`IN_REQUEST_AT_MS`), on the reconciler's own schedule; the
+     * rest are the reconciler's, spread over the eight minutes.
+     */
+    const settle = async (id) => {
         const until = now() + (opts.settleWithinMs ?? 25_000);
-        let current = row;
-        while (current.pendingSince !== undefined && now() < until) {
-            await sleep(5_000);
-            await reconciler.check(current);
-            current = store.get(row.id) ?? current;
+        let row = store.get(id);
+        while (row?.pendingSince !== undefined && (row.checks ?? 0) < IN_REQUEST_AT_MS.length) {
+            const due = nextCheckAt(row);
+            if (due > until)
+                break;
+            if (due > now())
+                await sleep(due - now());
+            await reconciler.check(row);
+            row = store.get(id);
         }
-        return current;
+        return row;
     };
     const distributorResId = () => `CUR${now().toString(36).toUpperCase()}${randomBytes(6).toString('hex').toUpperCase()}`;
+    /**
+     * The conversation a booking is asked for in: the trip's owner when the
+     * card asks on a connection of its own, else the caller - what "this
+     * conversation's bookings" counts and what the same trip asked twice is
+     * matched by.
+     */
+    const conversationOf = (who) => who.tripOwner ?? who.sessionId;
+    /** A name for a booking in what the guest is told. */
+    const named = (b) => `${b.hotelName} (${b.confirmationCode})`;
+    const isLive = (b) => (b.status === 'confirmed' || b.status === 'requested' || b.status === 'unconfirmed') &&
+        !b.rollback &&
+        b.stay.checkOut >= today();
+    /** The booking itself, one request at a time per conversation and email - see `single`. */
+    const book = async (lines, tripKey, email, guest, contact, who, requests) => {
+        // ⚠️ THE SAME TRIP ASKED FOR AGAIN IS ANSWERED WITH THE FIRST. A second
+        // press, or a host retrying a call whose answer it lost, waited for the
+        // first request (`single`) and finds it here - rather than booking every
+        // stay a second time.
+        const earlier = store
+            .all()
+            .filter((b) => b.tripKey === tripKey &&
+            b.owners.includes(conversationOf(who)) &&
+            b.guest.email.trim().toLowerCase() === email &&
+            now() - Date.parse(b.createdAt) < SAME_TRIP_MS &&
+            isLive(b));
+        const ref = earlier[0]?.tripRef;
+        if (ref &&
+            earlier.length === lines.length &&
+            earlier.every((b) => b.tripRef === ref) &&
+            (store.intent(ref)?.done ?? true)) {
+            return earlier.map(publicBooking);
+        }
+        // ⚠️ THE LIMITS - see `BookingLimits`. Each is said as what it is, and
+        // none suggests a way round itself (another email, another chat).
+        const plural = (n, one) => `${n} ${one}${n === 1 ? '' : 's'}`;
+        const liveHere = store.all().filter((b) => b.owners.includes(conversationOf(who)) && isLive(b)).length +
+            slotsWhere((x) => x.sessionId === conversationOf(who));
+        if (liveHere + lines.length > limits.perConversationLive) {
+            throw new Error(`Nothing was booked. This conversation already has ${plural(liveHere, 'booking')} still to come, and ${limits.perConversationLive} at once is the most - cancel one that is not needed, then ask again.`);
+        }
+        const liveForEmail = store.all().filter((b) => b.guest.email.trim().toLowerCase() === email && isLive(b)).length +
+            slotsWhere((x) => x.email === email);
+        if (liveForEmail + lines.length > limits.perEmailLive) {
+            throw new Error(`Nothing was booked. ${guest.email.trim()} already has ${plural(liveForEmail, 'booking')} still to come through this connector, and ${limits.perEmailLive} at once is the most - cancel one that is not needed, then ask again.`);
+        }
+        if (requestsByEmail.count(email) >= limits.perEmailPerDay) {
+            throw new Error(`Nothing was booked. ${guest.email.trim()} has asked for ${plural(limits.perEmailPerDay, 'booking')} in the last 24 hours, which is the most here - try again later.`);
+        }
+        if (who.ip && requestsByIp.count(who.ip) >= limits.perIpPerHour) {
+            throw new Error('Nothing was booked. Too many bookings have been asked for from this network in the last hour - try again later.');
+        }
+        const madeToday = store
+            .all()
+            .filter((b) => now() - Date.parse(b.createdAt) < DAY_MS &&
+            (b.status === 'confirmed' ||
+                b.status === 'requested' ||
+                b.status === 'unconfirmed' ||
+                b.status === 'cancelled')).length + slotsWhere(() => true);
+        if (madeToday + lines.length > limits.perDeploymentPerDay) {
+            // ⚠️ A CEILING HIT IS SOMETHING A PERSON SHOULD KNOW: either business
+            // is booming or somebody is filling hotels with names. Logged, and on
+            // /healthz/detail as needsAPerson for a day - across a restart.
+            const last = store.ceilingHitAt;
+            if (last === undefined || now() - last > HOUR_MS) {
+                console.error(`[huazhu bookings] ⚠️ NEEDS A PERSON: ${madeToday} bookings in the last 24 hours reached the ceiling of ${limits.perDeploymentPerDay}; new bookings are refused until the count falls`);
+            }
+            store.ceilingHitAt = now();
+            throw new Error(`Nothing was booked: bookings through this connector are paused for now. Try again later, or book with ${opts.brand} directly.`);
+        }
+        // The network counted once it has passed every limit - a request turned
+        // away is not one more against the guest, or a guest at a limit could
+        // never leave it. The email is counted when a booking is asked of Huazhu
+        // (`bookHeld`): a price that moved is not one of the guest's five.
+        if (who.ip)
+            requestsByIp.add(who.ip);
+        // ⚠️ AND ITS PLACES TAKEN NOW, before anything is awaited - see `slots`.
+        const slot = { sessionId: conversationOf(who), email, n: lines.length };
+        slots.add(slot);
+        try {
+            return await bookHeld(lines, tripKey, email, guest, contact, who, requests, slot);
+        }
+        finally {
+            slots.delete(slot);
+        }
+    };
+    const bookHeld = async (lines, tripKey, email, guest, contact, who, requests, slot) => {
+        // Priced afresh, not from the cache: this is the price that will be sent.
+        const priced = await quoteLines({ lines }, true);
+        if (priced.dropped?.length || priced.sold.size !== lines.length) {
+            throw new Error(`Nothing was booked. ${(priced.dropped ?? []).map((d) => `${d.title}: ${d.why}`).join(' ')} The trip is as it was - take that out or change it, then ask again.`);
+        }
+        const clean = cleanRequests(requests);
+        const comment = commentOf(clean, guest.notes);
+        const plans = [];
+        for (const [i, line] of lines.entries()) {
+            const sold = priced.sold.get(i);
+            const qline = priced.lines[i];
+            if (line.kind !== 'room' || !sold || !qline)
+                throw new Error('Nothing was booked: the trip changed while it was being priced.');
+            plans.push({ i, line, sold, qline });
+        }
+        for (const plan of plans) {
+            const s = plan.sold.res;
+            const title = `${plan.qline.hotelName} - ${plan.qline.title}`;
+            try {
+                const out = await client.prebook({
+                    hotelId: plan.line.hotelId,
+                    checkinType: 'DAY',
+                    paymentType: opts.paymentType,
+                    reservations: [
+                        {
+                            roomTypeCode: plan.sold.product.roomTypeCode,
+                            rateCode: plan.sold.product.rateCode,
+                            checkin: plan.line.stay.checkIn,
+                            checkout: plan.line.stay.checkOut,
+                            amountAfterTax: s.after,
+                            ...(s.before ? { amountBeforeTax: s.before } : {}),
+                            currencyCode: s.currency,
+                            roomCount: plan.qline.quantity ?? 1,
+                            adultCount: plan.line.stay.guests,
+                        },
+                    ],
+                });
+                plan.token = out?.preBookToken;
+            }
+            catch (err) {
+                if (err instanceof HuazhuRefusal)
+                    throw new Error(`Nothing was booked. ${refusalWords(err, title, s.currency)}`);
+                throw new Error(`Nothing was booked: Huazhu could not be reached to check ${title} (${err.message}). Asking again is safe.`);
+            }
+        }
+        requestsByEmail.add(email);
+        const tripRef = randomUUID();
+        const made = [];
+        /**
+         * Undo what this trip booked, when a later stay of it failed - and say
+         * what actually became of each, not what was meant to (2026-10-05 audit,
+         * e7: "flagged for a person" of a stay nobody had flagged).
+         */
+        const takeBackAll = async () => {
+            const waiting = [];
+            const charged = [];
+            const flagged = [];
+            const retrying = [];
+            for (const b of made) {
+                const row = store.update(b.id, { rollback: true });
+                if (!row || row.status === 'failed' || row.status === 'cancelled')
+                    continue;
+                if (row.pendingSince !== undefined || row.status !== 'confirmed') {
+                    // The reconciler cancels it if it turns up.
+                    waiting.push(named(row));
+                    continue;
+                }
+                await reconciler.takeBack(row);
+                const after = store.get(b.id) ?? row;
+                if (after.status === 'cancelled') {
+                    if (after.cancellationFee && after.cancellationFee.minor > 0)
+                        charged.push(`${named(after)}: ${formatMoney(after.cancellationFee)}`);
+                }
+                else if (after.attention && !after.resolvedAt)
+                    flagged.push(named(after));
+                else
+                    retrying.push(named(after));
+            }
+            const and = (xs) => xs.join(' and ');
+            return [
+                charged.length
+                    ? ` Cancelling again cost a fee under the rate's terms - ${charged.join('; ')}. A person here has been told and will follow it up.`
+                    : '',
+                flagged.length
+                    ? ` ${and(flagged)} could not be cancelled automatically and has been flagged for a person to cancel with the hotel.`
+                    : '',
+                retrying.length
+                    ? ` ${and(retrying)} could not be cancelled yet: it is tried again automatically, and a person is told if that keeps failing.`
+                    : '',
+                waiting.length
+                    ? ` Whether ${and(waiting)} was booked is not known yet; if it turns up in the next few minutes it is cancelled automatically.`
+                    : '',
+            ].join('');
+        };
+        const notWritten = async (title) => {
+            const back = await takeBackAll();
+            throw new Error(`Nothing was booked: ${title} could not be written down here before asking Huazhu, so it was not asked for. A person has been told.${back}`);
+        };
+        // ⚠️ THE REQUEST, WRITTEN DOWN BEFORE ITS FIRST STAY IS BOOKED. A
+        // process that dies half way through a trip leaves this open, and the
+        // next one takes back what it booked (`Reconciler.recover`).
+        try {
+            store.open({
+                tripRef,
+                key: tripKey,
+                sessionId: conversationOf(who),
+                email,
+                stays: plans.length,
+                startedAt: now(),
+            });
+        }
+        catch (err) {
+            if (err instanceof StoreWriteError)
+                return notWritten('the trip');
+            throw err;
+        }
+        try {
+            for (const plan of plans) {
+                const s = plan.sold.res;
+                const rooms = plan.qline.quantity ?? 1;
+                const qTotal = plan.qline.total.minor;
+                const nightlyMinor = s.after.map((x) => toMinor(x, s.currency));
+                const allIn = nightlyMinor.reduce((a, b) => a + b, 0) * rooms;
+                const cur = s.currency;
+                const title = `${plan.qline.hotelName} - ${plan.qline.title}`;
+                const id = `hz_${randomUUID()}`;
+                const dres = distributorResId();
+                const row = {
+                    id,
+                    confirmationCode: newPublicCode((c) => store.all().some((b) => b.confirmationCode === c)),
+                    status: 'requested',
+                    createdAt: new Date(now()).toISOString(),
+                    hotelId: plan.line.hotelId,
+                    hotelName: plan.qline.hotelName,
+                    stay: plan.line.stay,
+                    guest,
+                    quote: {
+                        lines: [plan.qline],
+                        subtotal: money(qTotal, cur),
+                        taxesAndFees: money(allIn - qTotal, cur),
+                        total: money(allIn, cur),
+                        stay: plan.line.stay,
+                    },
+                    ...(clean ? { requests: clean } : {}),
+                    // The caller, and the conversation whose trip it was - see `Identity.tripOwner`.
+                    owners: [...new Set([who.sessionId, conversationOf(who)])],
+                    distributorResId: dres,
+                    tripRef,
+                    tripKey,
+                    paymentType: opts.paymentType,
+                    guaranteeCode: s.guaranteeCode,
+                    cancelCode: s.cancelCode,
+                    nightlyMinor,
+                    rooms,
+                    tz: opts.tz,
+                    roomTypeCode: plan.sold.product.roomTypeCode,
+                    rateCode: plan.sold.product.rateCode,
+                    // ⚠️ SET BEFORE THE CALL: a process that dies mid-call leaves a
+                    // record the reconciler follows up on restart.
+                    pendingSince: now(),
+                };
+                // ⚠️ NOT WRITTEN DOWN, NOT SENT. A booking Huazhu made that nobody
+                // here knows of is one nobody can find, follow up or cancel - and a
+                // write that failed used to skip taking back the trip's earlier stays
+                // too (2026-10-05 audit, P1-8).
+                try {
+                    store.put(row);
+                }
+                catch (err) {
+                    if (err instanceof StoreWriteError)
+                        return notWritten(title);
+                    throw err;
+                }
+                made.push(row);
+                slot.n -= 1;
+                const reservation = {
+                    roomTypeCode: plan.sold.product.roomTypeCode,
+                    rateCode: plan.sold.product.rateCode,
+                    checkin: plan.line.stay.checkIn,
+                    checkout: plan.line.stay.checkOut,
+                    amountAfterTax: s.after,
+                    ...(s.before ? { amountBeforeTax: s.before } : {}),
+                    ...(s.rack ? { rackRate: s.rack } : {}),
+                    currencyCode: cur,
+                    roomCount: rooms,
+                    adultCount: plan.line.stay.guests,
+                    guaranteePolicyCode: s.guaranteeCode,
+                    ...(clean?.arrivingAt ? { estimatedArrivalTime: clean.arrivingAt } : {}),
+                    resGuest: [contact],
+                };
+                const request = {
+                    hotelId: plan.line.hotelId,
+                    checkinType: 'DAY',
+                    contactPerson: contact,
+                    distributorResId: dres,
+                    paymentType: opts.paymentType,
+                    reservations: [reservation],
+                    ...(comment ? { guestComment: comment } : {}),
+                    ...(plan.token ? { preBookToken: plan.token } : {}),
+                };
+                // ⚠️ ONLY HUAZHU'S OWN "NO" MEANS "NOT BOOKED" - a code
+                // /reservation/book documents as one (`BOOK_REFUSALS`). Anything else
+                // - no answer, an answer that did not parse, a code nobody
+                // documented, a "yes" without an order number - means it may exist,
+                // and is followed up by the consistency query, never by sending the
+                // booking again.
+                let refusal;
+                let answer;
+                for (let attempt = 0; attempt < 2; attempt += 1) {
+                    try {
+                        const got = await client.book(request);
+                        if (got && typeof got.resId === 'string' && got.resId)
+                            answer = got;
+                    }
+                    catch (err) {
+                        if (err instanceof HuazhuRefusal && err.code === CODES.systemError && attempt === 0) {
+                            // The documentation's own advice: retry a system error, same id.
+                            await sleep(1_000);
+                            continue;
+                        }
+                        if (err instanceof HuazhuRefusal &&
+                            BOOK_REFUSALS.has(err.code) &&
+                            !BOOK_EXISTS.has(err.code))
+                            refusal = err;
+                    }
+                    break;
+                }
+                if (answer) {
+                    // Outside the try: a failure to WRITE this down is not Huazhu
+                    // refusing it, and must not be recorded as one.
+                    store.update(id, {
+                        resId: answer.resId,
+                        ...(answer.resCode ? { resCode: answer.resCode } : {}),
+                        status: 'confirmed',
+                        hotelStatus: 'HOTEL_RESERVATION',
+                        pendingSince: undefined,
+                    });
+                    continue;
+                }
+                if (refusal) {
+                    // Never made at Huazhu: nothing to follow up, nothing to show.
+                    store.update(id, { pendingSince: undefined, status: 'failed' });
+                    made.pop();
+                    const before = made.length;
+                    const back = await takeBackAll();
+                    throw new Error(`Nothing was booked. ${refusalWords(refusal, title, cur)}${before && !back ? ' The stays booked before it in this trip were cancelled again.' : ''}${back}`);
+                }
+                // Unknown: the eight minutes run from the moment that was known.
+                store.update(id, { pendingSince: now() });
+                const settled = await settle(id);
+                if (settled?.status === 'confirmed' && settled.pendingSince === undefined)
+                    continue;
+                if (plans.length > 1 || settled?.status === 'failed') {
+                    const back = await takeBackAll();
+                    if (settled?.status === 'failed') {
+                        throw new Error(`Nothing was booked: Huazhu did not confirm ${plan.qline.hotelName}.${back}`);
+                    }
+                    throw new Error(`Nothing was booked: Huazhu did not answer in time for ${plan.qline.hotelName}, so the trip was stopped.${back}`);
+                }
+                // One stay, outcome still unknown: it is the guest's booking, marked
+                // as waiting, and the reconciler settles it within eight minutes.
+            }
+        }
+        finally {
+            store.close(tripRef);
+        }
+        return made.map((b) => publicBooking(store.get(b.id) ?? b));
+    };
     return {
         brand: opts.brand,
         capabilities: HUAZHU_CAPABILITIES,
@@ -616,17 +1055,49 @@ export const createHuazhuHotels = (opts) => {
         },
         health() {
             const rows = store.all();
+            const open = store.unresolved();
+            const ceilingHitAt = store.ceilingHitAt;
+            const ceiling = ceilingHitAt !== undefined && now() - ceilingHitAt < DAY_MS;
             return {
                 catalog: catalog.state(),
                 bookings: rows.length,
                 pending: rows.filter((r) => r.pendingSince !== undefined).length,
-                needsAPerson: rows.filter((r) => r.attention).length +
-                    (ceilingHitAt !== undefined && now() - ceilingHitAt < DAY_MS ? 1 : 0),
-                ...(ceilingHitAt !== undefined && now() - ceilingHitAt < DAY_MS
-                    ? { ceilingHitAt: new Date(ceilingHitAt).toISOString() }
+                // ⚠️ ONLY WHAT IS STILL OPEN. A booking a person has dealt with is
+                // marked resolved, and stops counting (2026-10-05 audit, P1-9).
+                needsAPerson: open.length +
+                    (ceiling ? 1 : 0) +
+                    (store.writeFailing ? 1 : 0) +
+                    (client.misconfigured ? 1 : 0),
+                ...(open.length
+                    ? {
+                        attention: open.slice(0, 20).map((r) => ({
+                            id: r.id,
+                            since: r.attentionAt,
+                            why: r.attention,
+                        })),
+                    }
                     : {}),
+                ...(ceiling ? { ceilingHitAt: new Date(ceilingHitAt).toISOString() } : {}),
+                ...(store.writeFailing ? { writeFailing: store.writeFailing } : {}),
+                ...(client.misconfigured ? { misconfigured: client.misconfigured } : {}),
             };
         },
+        /** A person dealt with a booking that needed one - see `BookingStore.resolve`. */
+        resolve(id, resolution) {
+            const row = store.get(id);
+            if (!row?.attention)
+                return undefined;
+            return store.resolve(id, resolution);
+        },
+        /**
+         * Stop taking bookings, and wait for the ones in flight - a deploy's
+         * SIGTERM. A process stopped in the middle of a trip leaves its first
+         * stays booked and the rest not (2026-10-05 audit, P1-2).
+         */
+        async drain() {
+            closing = true;
+            await Promise.allSettled([...new Set(flights.values())]);
+        },
         async searchHotels(q) {
             const terms = (q.query ?? '')
                 .toLowerCase()
@@ -962,9 +1433,18 @@ export const createHuazhuHotels = (opts) => {
         },
         quote,
         async requestBooking(trip, guest, who, requests) {
+            if (closing) {
+                throw new Error('Nothing was booked: this connector is restarting. Ask again in a minute - the trip is kept.');
+            }
             if (!guest.name.trim() || !guest.email.includes('@')) {
-                throw new Error("A booking needs the guest's name and an email to send it to.");
+                // Nothing is emailed from here (2026-10-05 audit): the email is how the
+                // booking is found again, with its code.
+                throw new Error("A booking needs the guest's name and email - the email is how the booking is found again, with its code.");
             }
+            // Bounded at the seam too - see GUEST_LIMITS.
+            const tooLong = guestTooLong(guest);
+            if (tooLong.length)
+                throw new Error(`Nothing was booked: a booking takes ${tooLong.join(', ')}.`);
             const contact = contactOf(guest);
             if (typeof contact === 'string')
                 throw new Error(contact);
@@ -979,247 +1459,16 @@ export const createHuazhuHotels = (opts) => {
             }
             const { groups } = splitByStay(trip.lines);
             const lines = groups.flat();
-            // ⚠️ THE LIMITS - see `BookingLimits`. Each is said as what it is, and
-            // none suggests a way round itself (another email, another chat).
-            const isLive = (b) => (b.status === 'confirmed' || b.status === 'requested') && b.stay.checkOut >= today();
             const email = guest.email.trim().toLowerCase();
-            const plural = (n, one) => `${n} ${one}${n === 1 ? '' : 's'}`;
-            const liveHere = store
-                .all()
-                .filter((b) => b.owners.includes(who.sessionId) && isLive(b)).length;
-            if (liveHere + lines.length > limits.perConversationLive) {
-                throw new Error(`Nothing was booked. This conversation already has ${plural(liveHere, 'booking')} still to come, and ${limits.perConversationLive} at once is the most - cancel one that is not needed, then ask again.`);
-            }
-            const liveForEmail = store
-                .all()
-                .filter((b) => b.guest.email.trim().toLowerCase() === email && isLive(b)).length;
-            if (liveForEmail + lines.length > limits.perEmailLive) {
-                throw new Error(`Nothing was booked. ${guest.email.trim()} already has ${plural(liveForEmail, 'booking')} still to come through this connector, and ${limits.perEmailLive} at once is the most - cancel one that is not needed, then ask again.`);
-            }
-            if (requestsByEmail.count(email) >= limits.perEmailPerDay) {
-                throw new Error(`Nothing was booked. ${guest.email.trim()} has asked for ${plural(limits.perEmailPerDay, 'booking')} in the last 24 hours, which is the most here - try again later.`);
-            }
-            if (who.ip && requestsByIp.count(who.ip) >= limits.perIpPerHour) {
-                throw new Error('Nothing was booked. Too many bookings have been asked for from this network in the last hour - try again later.');
-            }
-            const madeToday = store
-                .all()
-                .filter((b) => now() - Date.parse(b.createdAt) < DAY_MS &&
-                (b.status === 'confirmed' || b.status === 'requested' || b.status === 'cancelled')).length;
-            if (madeToday + lines.length > limits.perDeploymentPerDay) {
-                // ⚠️ A CEILING HIT IS SOMETHING A PERSON SHOULD KNOW: either business
-                // is booming or somebody is filling hotels with names. Logged, and on
-                // /healthz/detail as needsAPerson for a day.
-                if (ceilingHitAt === undefined || now() - ceilingHitAt > HOUR_MS) {
-                    console.error(`[huazhu bookings] ⚠️ NEEDS A PERSON: ${madeToday} bookings in the last 24 hours reached the ceiling of ${limits.perDeploymentPerDay}; new bookings are refused until the count falls`);
-                }
-                ceilingHitAt = now();
-                throw new Error(`Nothing was booked: bookings through this connector are paused for now. Try again later, or book with ${opts.brand} directly.`);
-            }
-            // Counted once it has passed every limit - a request turned away is not
-            // one more against the guest, or a guest at a limit could never leave it.
-            requestsByEmail.add(email);
-            if (who.ip)
-                requestsByIp.add(who.ip);
-            // Priced afresh, not from the cache: this is the price that will be sent.
-            const priced = await quoteLines({ lines }, true);
-            if (priced.dropped?.length || priced.sold.size !== lines.length) {
-                throw new Error(`Nothing was booked. ${(priced.dropped ?? []).map((d) => `${d.title}: ${d.why}`).join(' ')} The trip is as it was - take that out or change it, then ask again.`);
-            }
-            const clean = cleanRequests(requests);
-            const comment = commentOf(clean, guest.notes);
-            const plans = [];
-            for (const [i, line] of lines.entries()) {
-                const sold = priced.sold.get(i);
-                const qline = priced.lines[i];
-                if (line.kind !== 'room' || !sold || !qline)
-                    throw new Error('Nothing was booked: the trip changed while it was being priced.');
-                plans.push({ i, line, sold, qline });
-            }
-            for (const plan of plans) {
-                const s = plan.sold.res;
-                const title = `${plan.qline.hotelName} - ${plan.qline.title}`;
-                try {
-                    const out = await client.prebook({
-                        hotelId: plan.line.hotelId,
-                        checkinType: 'DAY',
-                        paymentType: opts.paymentType,
-                        reservations: [
-                            {
-                                roomTypeCode: plan.sold.product.roomTypeCode,
-                                rateCode: plan.sold.product.rateCode,
-                                checkin: plan.line.stay.checkIn,
-                                checkout: plan.line.stay.checkOut,
-                                amountAfterTax: s.after,
-                                ...(s.before ? { amountBeforeTax: s.before } : {}),
-                                currencyCode: s.currency,
-                                roomCount: plan.qline.quantity ?? 1,
-                                adultCount: plan.line.stay.guests,
-                            },
-                        ],
-                    });
-                    plan.token = out.preBookToken;
-                }
-                catch (err) {
-                    if (err instanceof HuazhuRefusal)
-                        throw new Error(`Nothing was booked. ${refusalWords(err, title, s.currency)}`);
-                    throw new Error(`Nothing was booked: Huazhu could not be reached to check ${title} (${err.message}). Asking again is safe.`);
-                }
-            }
-            const tripRef = randomUUID();
-            const made = [];
-            /** Undo what this trip booked, when a later stay of it failed. */
-            const takeBackAll = async () => {
-                const stuck = [];
-                for (const b of made) {
-                    store.update(b.id, { rollback: true });
-                    const row = store.get(b.id);
-                    if (!row)
-                        continue;
-                    if (row.pendingSince !== undefined)
-                        continue; // the reconciler cancels it if it turns up
-                    await reconciler.takeBack(row);
-                    if (store.get(b.id)?.status !== 'cancelled')
-                        stuck.push(`${row.hotelName} (${row.confirmationCode})`);
-                }
-                return stuck.length
-                    ? ` ${stuck.join(' and ')} could not be cancelled automatically and has been flagged for a person to cancel with the hotel.`
-                    : '';
-            };
-            for (const plan of plans) {
-                const s = plan.sold.res;
-                const rooms = plan.qline.quantity ?? 1;
-                const qTotal = plan.qline.total.minor;
-                const nightlyMinor = s.after.map((x) => toMinor(x, s.currency));
-                const allIn = nightlyMinor.reduce((a, b) => a + b, 0) * rooms;
-                const cur = s.currency;
-                const id = `hz_${randomUUID()}`;
-                const dres = distributorResId();
-                const row = {
-                    id,
-                    confirmationCode: dres,
-                    status: 'requested',
-                    createdAt: new Date(now()).toISOString(),
-                    hotelId: plan.line.hotelId,
-                    hotelName: plan.qline.hotelName,
-                    stay: plan.line.stay,
-                    guest,
-                    quote: {
-                        lines: [plan.qline],
-                        subtotal: money(qTotal, cur),
-                        taxesAndFees: money(allIn - qTotal, cur),
-                        total: money(allIn, cur),
-                        stay: plan.line.stay,
-                    },
-                    ...(clean ? { requests: clean } : {}),
-                    owners: [who.sessionId],
-                    distributorResId: dres,
-                    tripRef,
-                    paymentType: opts.paymentType,
-                    guaranteeCode: s.guaranteeCode,
-                    cancelCode: s.cancelCode,
-                    nightlyMinor,
-                    rooms,
-                    tz: opts.tz,
-                    roomTypeCode: plan.sold.product.roomTypeCode,
-                    rateCode: plan.sold.product.rateCode,
-                    // ⚠️ SET BEFORE THE CALL: a process that dies mid-call leaves a
-                    // record the reconciler follows up on restart.
-                    pendingSince: now(),
-                };
-                store.put(row);
-                made.push(row);
-                const reservation = {
-                    roomTypeCode: plan.sold.product.roomTypeCode,
-                    rateCode: plan.sold.product.rateCode,
-                    checkin: plan.line.stay.checkIn,
-                    checkout: plan.line.stay.checkOut,
-                    amountAfterTax: s.after,
-                    ...(s.before ? { amountBeforeTax: s.before } : {}),
-                    ...(s.rack ? { rackRate: s.rack } : {}),
-                    currencyCode: cur,
-                    roomCount: rooms,
-                    adultCount: plan.line.stay.guests,
-                    guaranteePolicyCode: s.guaranteeCode,
-                    ...(clean?.arrivingAt ? { estimatedArrivalTime: clean.arrivingAt } : {}),
-                    resGuest: [contact],
-                };
-                const request = {
-                    hotelId: plan.line.hotelId,
-                    checkinType: 'DAY',
-                    contactPerson: contact,
-                    distributorResId: dres,
-                    paymentType: opts.paymentType,
-                    reservations: [reservation],
-                    ...(comment ? { guestComment: comment } : {}),
-                    ...(plan.token ? { preBookToken: plan.token } : {}),
-                };
-                // ⚠️ ONLY A REFUSAL FROM HUAZHU MEANS "NOT BOOKED". Anything else -
-                // no answer, an answer that did not parse, our own code failing after
-                // the call - means it may exist, and is followed up by the consistency
-                // query, never written off.
-                let outcome = 'unknown';
-                let refusal;
-                let answer;
-                for (let attempt = 0; attempt < 2 && !answer && !refusal; attempt += 1) {
-                    try {
-                        answer = await client.book(request);
-                    }
-                    catch (err) {
-                        if (!(err instanceof HuazhuRefusal))
-                            break;
-                        // "Already exists" for OUR id: an earlier try got through.
-                        if (err.code === 5218 || err.code === 5221 || err.code === 5231)
-                            break;
-                        if (err.code === 2001 && attempt === 0) {
-                            // The documentation's own advice: retry a system error, same id.
-                            await sleep(1_000);
-                            continue;
-                        }
-                        refusal = err;
-                    }
-                }
-                if (answer) {
-                    // Outside the try: a failure to WRITE this down is not Huazhu
-                    // refusing it, and must not be recorded as one.
-                    store.update(id, {
-                        resId: answer.resId,
-                        ...(answer.resCode ? { resCode: answer.resCode } : {}),
-                        confirmationCode: answer.resId,
-                        status: 'confirmed',
-                        hotelStatus: 'HOTEL_RESERVATION',
-                        pendingSince: undefined,
-                    });
-                    outcome = 'booked';
-                }
-                else if (refusal) {
-                    outcome = 'refused';
-                }
-                if (outcome === 'refused') {
-                    // Never made at Huazhu: nothing to follow up, nothing to show.
-                    store.update(id, { pendingSince: undefined, status: 'failed' });
-                    made.pop();
-                    const before = made.length;
-                    const back = await takeBackAll();
-                    const title = `${plan.qline.hotelName} - ${plan.qline.title}`;
-                    throw new Error(`Nothing was booked. ${refusal ? refusalWords(refusal, title, cur) : `Huazhu did not accept ${title}.`}${before && !back ? ' The stays booked before it in this trip were cancelled again.' : ''}${back}`);
-                }
-                if (outcome === 'unknown') {
-                    const settled = await settle(store.get(id) ?? row);
-                    if (settled.pendingSince !== undefined || settled.status !== 'confirmed') {
-                        if (plans.length > 1 || settled.status === 'failed') {
-                            const back = await takeBackAll();
-                            if (settled.status === 'failed') {
-                                throw new Error(`Nothing was booked: Huazhu did not confirm ${plan.qline.hotelName}.${back}`);
-                            }
-                            throw new Error(`Nothing was booked: Huazhu did not answer in time for ${plan.qline.hotelName}, so the trip was stopped. If that booking turns up in the next few minutes it is cancelled automatically.${back}`);
-                        }
-                        // One stay, outcome still unknown: it is the guest's booking, marked
-                        // as waiting, and the reconciler settles it within eight minutes.
-                    }
-                }
-            }
-            return made.map((b) => publicBooking(store.get(b.id) ?? b));
+            const tripKey = lines
+                .map((l) => l.kind === 'room'
+                ? `${l.hotelId}|${l.roomId}|${l.stay.checkIn}|${l.stay.checkOut}|${l.stay.guests}|${l.rooms ?? 1}`
+                : '')
+                .sort()
+                .join(';');
+            // The caller and, from the card, the conversation whose trip it is.
+            const keys = [...new Set([who.sessionId, who.tripOwner ?? who.sessionId])].map((k) => `s:${k}`);
+            return single([...keys, `e:${email}`], () => book(lines, tripKey, email, guest, contact, who, requests));
         },
         async listBookings(who, limit = 10) {
             const most = Math.max(1, Math.min(MAX_PAGE, Math.floor(Number(limit) > 0 ? limit : 10)));
@@ -1266,13 +1515,13 @@ export const createHuazhuHotels = (opts) => {
             const cur = b.quote.total.currency;
             const zero = money(0, cur);
             const past = now() >= nightAuditOf(b.stay.checkIn, b.tz);
-            if (b.pendingSince !== undefined) {
+            if (b.pendingSince !== undefined || b.status === 'unconfirmed') {
                 return {
                     bookingId: b.id,
                     confirmationCode: b.confirmationCode,
                     fee: zero,
                     refund: zero,
-                    rule: 'Huazhu has not confirmed this booking yet - that takes up to eight minutes. It can be cancelled once it is confirmed.',
+                    rule: waitingWords(b),
                     cancellable: false,
                 };
             }
@@ -1297,7 +1546,9 @@ export const createHuazhuHotels = (opts) => {
                 refund: zero,
                 rule: forbidden
                     ? `This rate cannot be cancelled now. ${rule}`
-                    : `${rule} Nothing was paid through this connector - the booking is paid at the hotel - so any fee is charged under the hotel's terms, and Huazhu works out the exact amount when it cancels.`,
+                    : opts.sandbox
+                        ? `${rule} This is a test booking in the simulated Huazhu: the fee is worked out as a real booking's would be, and nothing is charged to anyone.`
+                        : `${rule} Nothing was paid through this connector - the booking is paid at the hotel - so any fee is charged under the hotel's terms, and Huazhu works out the exact amount when it cancels.`,
                 ...(freeUntil ? { freeUntil: new Date(freeUntil).toISOString() } : {}),
                 cancellable: !forbidden,
             };
@@ -1307,9 +1558,11 @@ export const createHuazhuHotels = (opts) => {
             if (!found)
                 return null;
             const b = await refresh(found);
-            if (b.pendingSince !== undefined || !b.resId) {
-                throw new Error('Huazhu has not confirmed this booking yet - that takes up to eight minutes. It can be cancelled once it is confirmed.');
+            if (b.pendingSince !== undefined || b.status === 'unconfirmed') {
+                throw new Error(waitingWords(b));
             }
+            if (!b.resId)
+                return publicBooking(b);
             if (b.status !== 'confirmed')
                 return publicBooking(b);
             const cur = b.quote.total.currency;