@curless/hotel-storefront 0.39.0 → 0.40.0

package/dist/huazhu/backend.js

@@ -8,14 +8,14 @@ import { BOOKING_LIMITS, DAY_MS, HOUR_MS, WindowCounter } from '../limits.js';
 import { formatMoney, minorFactor, money, multiplyMoney, toMinor } from '../money.js';
 import { UnionPayError, expiryMMyy, lastFour, } from '../payments/unionpay.js';
 import { MAX_ROOMS_PER_LINE, quoteLineKey } from '../trip.js';
-import { IN_REQUEST_AT_MS, StoreWriteError, nextCheckAt, statusOf, } from './bookings.js';
+import { IN_REQUEST_AT_MS, NOT_FOUND, StoreWriteError, nextCheckAt, statusOf, } from './bookings.js';
 import { describePolicy, feeFor, freeUntilOf, nightAuditOf, parseCancelPolicy, penaltyAt, refundableFrom, } from './cancel-policy.js';
 import { haystackOf, inPlace, namesOf, roomPhoto, toHotel } from './catalog.js';
 import { HuazhuRefusal, HuazhuUnreachable } from './client.js';
 import { bedNameEn, offerNameEn, rateNameEn, roomNameEn } from './english.js';
 import { rateLabels } from './labels.js';
 import { ariRanges, bookableNow, clockAt, goneWhy, hourlyWindow, inStayWindow, offeredAtAll, sell, } from './sellable.js';
-import { BOOK_EXISTS, BOOK_REFUSALS, CODES, } from './wire.js';
+import { BOOK_EXISTS, BOOK_REFUSALS, CODES, PAYMENT_FOR_GUARANTEE, } from './wire.js';
 export const HUAZHU_CAPABILITIES = {
     members: false,
     extras: false,
@@ -92,14 +92,16 @@ const WINDOW = {
     '1': 'Window',
     '2': 'Some rooms without a window',
     '3': 'No window',
-    '4': 'Window onto an inner courtyard',
+    // Huazhu's dictionary says 内景 - an inner view - and no more: no courtyard
+    // was ever said (2026-10-16 audit, P2).
+    '4': 'Inner-view window',
 };
 /** The same, as Huazhu's own dictionary says it - for a connector that speaks Chinese. */
 const WINDOW_ZH = {
     '1': '有窗',
     '2': '部分有窗',
     '3': '无窗',
-    '4': '内窗(朝天井)',
+    '4': '内景窗',
 };
 /** A rate's meal in Chinese, by its code; room only is 不含早. */
 const MEAL_ZH = {
@@ -513,6 +515,16 @@ export const createHuazhuHotels = (opts) => {
     const requestsByEmail = new WindowCounter(DAY_MS, now);
     const requestsByIp = new WindowCounter(HOUR_MS, now);
     const requestsByConversation = new WindowCounter(HOUR_MS, now);
+    /**
+     * Paying with UnionPay, asked - each ask reaches the gateway and UnionPay's
+     * test system, so each is counted, whatever it came to: by booking, by
+     * conversation and by address (2026-10-16 audit, P0-E: one booking asked
+     * 50 times bound 50 cards' worth of pages, and used up the gateway's rate).
+     */
+    const unionPayAsks = new WindowCounter(HOUR_MS, now);
+    const UNIONPAY_ASKS = { booking: 6, conversation: 12, ip: 120 };
+    /** UnionPay's page for binding a card is handed out again this long, not asked for again. */
+    const ENROLL_REUSE_MS = 30 * 60_000;
     /**
      * Bookings a request has passed the limits for and not yet written down.
      *
@@ -676,12 +688,25 @@ export const createHuazhuHotels = (opts) => {
     /** Whether a hotel sells any room by the hour on its today - from its products, no prices. */
     const sellsByTheHourToday = async (hotelId) => (await productsOf(hotelId)).some((p) => p.checkinType === 'HOUR' && inStayWindow(p.stayWindow, today()));
     const ariCache = new Map();
+    /**
+     * A hotel Huazhu answered "too many requests" (2009) for, let be until then -
+     * a minute, doubling to ten while it goes on (2026-10-16 audit, P1-11: asked
+     * again at once, every guest's ask). Prices last read are used meanwhile; a
+     * booking's own fresh ask is not held back.
+     */
+    const ariBackoff = new Map();
     /** Every product's prices, rules and rooms left, one element per date from `start` to `end`. */
     const ariFor = async (hotelId, start, end, fresh = false) => {
         const key = `${hotelId}|${start}|${end}`;
         const hit = ariCache.get(key);
         if (!fresh && hit && now() - hit.at < ariTtl)
             return hit.value;
+        const held = ariBackoff.get(hotelId);
+        if (!fresh && held && now() < held.until) {
+            if (hit)
+                return hit.value;
+            throw new HuazhuRefusal(CODES.rateLimited, 'Too many requests', '', '/ari/daily/offers');
+        }
         const ranges = ariRanges(start, end);
         const parts = await Promise.all(ranges.map(async (r) => {
             const [offers, inventory] = await Promise.all([
@@ -703,7 +728,14 @@ export const createHuazhuHotels = (opts) => {
                 offers: offers.dailyOffers ?? [],
                 inventory: inventory.dailyInventories ?? [],
             };
-        }));
+        })).catch((err) => {
+            if (err instanceof HuazhuRefusal && err.code === CODES.rateLimited) {
+                const wait = Math.min((ariBackoff.get(hotelId)?.wait ?? 30_000) * 2, 10 * 60_000);
+                ariBackoff.set(hotelId, { until: now() + wait, wait });
+            }
+            throw err;
+        });
+        ariBackoff.delete(hotelId);
         const out = new Map();
         const keys = new Set(parts.flatMap((p) => p.offers.map((o) => roomIdOf(o))));
         for (const k of keys) {
@@ -998,9 +1030,16 @@ export const createHuazhuHotels = (opts) => {
         const fails = priced.map((p) => p.res).filter((r) => !r.ok);
         if (fails.length > 0 && fails.every((f) => f.kind === 'party'))
             return partyNeedsOf(guests, largestOf(fails));
+        if (fails.some((f) => f.kind === 'partial-refund'))
+            return {
+                why: "This hotel's rooms by the hour are paid in advance on terms that keep part of the price if cancelled - and a stay paid in advance here goes back whole or not at all.",
+                code: 'partial-refund',
+            };
         if (fails.some((f) => f.kind === 'prepaid'))
             return {
-                why: "This hotel's rooms by the hour are paid in advance, and this connector books rates paid at the hotel.",
+                why: prepaidType
+                    ? "This hotel's rooms by the hour are sold only on payment terms this connector cannot take."
+                    : "This hotel's rooms by the hour are paid in advance, and this connector books rates paid at the hotel.",
                 code: 'prepaid-only',
             };
         const said = (re) => fails
@@ -1042,9 +1081,18 @@ export const createHuazhuHotels = (opts) => {
         // find a rate paid at the hotel. At Huazhu's test hotel (2026-10-15) 28
         // rates were prepaid and 4 sold out, and the guest was told only that
         // nothing could be booked (总线程).
+        // Paid in advance here, but on terms that keep part of the stay - true
+        // of a "one night's fee" rate over two nights or more (audit P1-9).
+        if (kinds.has('partial-refund') && !kinds.has('party') && !kinds.has('too-many-rooms'))
+            return {
+                why: `The rooms still open here for those nights are paid in advance on terms that keep part of the stay if cancelled - and a stay paid in advance here goes back whole or not at all, so they are not sold for ${nightsBetween(stay.checkIn, stay.checkOut)} nights. A shorter stay may be.`,
+                code: 'partial-refund',
+            };
         if (kinds.has('prepaid') && !kinds.has('party') && !kinds.has('too-many-rooms'))
             return {
-                why: 'Every room still open here for those nights is paid in advance, and this connector books rates paid at the hotel.',
+                why: prepaidType
+                    ? 'Every room still open here for those nights is sold only on payment terms this connector cannot take.'
+                    : 'Every room still open here for those nights is paid in advance, and this connector books rates paid at the hotel.',
                 code: 'prepaid-only',
             };
         if (only('sold-out'))
@@ -1266,13 +1314,15 @@ export const createHuazhuHotels = (opts) => {
             // here is taken or refunded.
             const status = b.status === 'cancelled' && p.issuedAt
                 ? 'hotel-refunds'
-                : p.lapsedAt || p.declined
-                    ? 'lapsed'
-                    : b.status === 'confirmed'
-                        ? 'paid'
-                        : p.issuedAt
-                            ? 'issued'
-                            : 'awaiting';
+                : // Not booked - turned down, written off by the follow-up queries,
+                    // lapsed: the hotel never booked it, so never charged the card.
+                    p.lapsedAt || p.declined || b.status === 'failed' || b.status === 'expired'
+                        ? 'lapsed'
+                        : b.status === 'confirmed'
+                            ? 'paid'
+                            : p.issuedAt
+                                ? 'issued'
+                                : 'awaiting';
             return {
                 method: 'unionpay',
                 amount: b.quote.total,
@@ -1315,6 +1365,16 @@ export const createHuazhuHotels = (opts) => {
                 }
                 : {}),
             ...(refund ? { refundReason: refund.reason } : {}),
+            ...(refund?.amountMinor !== undefined && refund.amountMinor < b.quote.total.minor
+                ? { refundAmount: money(refund.amountMinor, b.quote.total.currency) }
+                : {}),
+            // Opened and refused, or never opened after every try: a person sees to it (audit P1-1).
+            ...(refund &&
+                (refund.status === 'failed' ||
+                    refund.status === 'rejected' ||
+                    (!refund.requestId && (refund.tries ?? 0) >= 8))
+                ? { refundStuck: true }
+                : {}),
         };
     };
     const publicBooking = (b) => ({
@@ -1341,7 +1401,14 @@ export const createHuazhuHotels = (opts) => {
      * before 0.27 showed it as its code, and is opened by it only in the
      * conversation that made it.
      */
-    const codesOf = (b) => [b.confirmationCode !== b.resId ? b.confirmationCode : undefined, b.distributorResId]
+    /**
+     * What a booking answers to with its email - the code the guest was given.
+     * ⚠️ NOT `distributorResId` (2026-10-16 audit, P2): no guest is ever told
+     * it, and it rides on the payment's metadata and UnionPay's item - with the
+     * email beside it on the payment page, anyone who could see those could
+     * have opened and cancelled the booking.
+     */
+    const codesOf = (b) => [b.confirmationCode !== b.resId ? b.confirmationCode : undefined]
         .filter((x) => !!x)
         .map((x) => x.toLowerCase());
     const findOwn = (ref, who) => {
@@ -1368,16 +1435,16 @@ export const createHuazhuHotels = (opts) => {
         }
         return there;
     };
-    /** Huazhu's own word on a booking, at most once a minute each. */
+    /**
+     * Huazhu's own word on a booking, at most once a minute each.
+     *
+     * ⚠️ IT ONLY READS (2026-10-16 audit, P0-A). It used to move a payment on
+     * as it was asked about - outside the booking's lock, from every lookup and
+     * every few seconds from a card waiting on a payment. Payments move on in
+     * the pass, the landing page and the steps a guest takes, one at a time.
+     */
     const refresh = async (found) => {
-        // A page open for payment, or money going back, is looked at as it is
-        // asked about - the guest who just paid sees it booked without waiting
-        // for the next pass.
-        let b = found;
-        if (b.prepaid && moneyPending(b)) {
-            await settlePrepaid(b);
-            b = store.get(b.id) ?? b;
-        }
+        const b = store.get(found.id) ?? found;
         if (!b.resId || b.pendingSince !== undefined)
             return b;
         if (b.refreshedAt && now() - b.refreshedAt < 60_000)
@@ -1405,7 +1472,7 @@ export const createHuazhuHotels = (opts) => {
     const waitingWords = (b) => b.status === 'unconfirmed'
         ? `${opts.sandbox ? 'The simulated Huazhu' : 'Huazhu'} has not said whether this booking was made, and a person here is confirming it. It cannot be cancelled here until then - ask again later.`
         : `${opts.sandbox ? 'The simulated Huazhu' : 'Huazhu'} has not confirmed this booking yet - that takes up to eight minutes. It can be cancelled once it is confirmed.`;
-    const feeNow = (b) => {
+    const feeNow = (b, at = now()) => {
         const policy = policyOf(b.cancelCode);
         const amounts = {
             currency: b.quote.total.currency,
@@ -1425,7 +1492,7 @@ export const createHuazhuHotels = (opts) => {
         }
         // A room by the hour that has begun is a no-show, whatever the code says
         // about the rest of the day - see `beforeStart`.
-        if (b.hourly && now() >= arrivalInstant(b.stay.checkIn, b.hourly.start, b.tz)) {
+        if (b.hourly && at >= arrivalInstant(b.stay.checkIn, b.hourly.start, b.tz)) {
             return {
                 fee: total,
                 forbidden: false,
@@ -1433,11 +1500,11 @@ export const createHuazhuHotels = (opts) => {
                 freeUntil: undefined,
             };
         }
-        const penalty = penaltyAt(policy, b.stay.checkIn, b.tz, now());
+        const penalty = penaltyAt(policy, b.stay.checkIn, b.tz, at);
         const fee = feeFor(penalty, amounts);
         const freeUntil = b.hourly
-            ? beforeStart(freeUntilOf(policy, b.stay.checkIn, b.tz, now()), b.stay.checkIn, b.hourly.start)
-            : freeUntilOf(policy, b.stay.checkIn, b.tz, now());
+            ? beforeStart(freeUntilOf(policy, b.stay.checkIn, b.tz, at), b.stay.checkIn, b.hourly.start)
+            : freeUntilOf(policy, b.stay.checkIn, b.tz, at);
         return {
             fee: fee ?? total,
             forbidden: fee === null,
@@ -1528,13 +1595,16 @@ export const createHuazhuHotels = (opts) => {
         if (who.ip && requestsByIp.count(who.ip) >= limits.perIpPerHour) {
             throw new Error('Nothing was booked. Too many bookings have been asked for from this network in the last hour - try again later.');
         }
-        const madeToday = store
-            .all()
-            .filter((b) => now() - Date.parse(b.createdAt) < DAY_MS &&
+        const madeToday = store.all().filter((b) => now() - Date.parse(b.createdAt) < DAY_MS &&
             (b.status === 'confirmed' ||
                 b.status === 'requested' ||
                 b.status === 'unconfirmed' ||
-                b.status === 'cancelled')).length + slotsWhere(() => true);
+                b.status === 'cancelled' ||
+                // A stay paid in advance asked Huazhu (its prebook) before any
+                // payment - waiting for one, or lapsed without, it counts too
+                // (2026-10-16 audit, P2: unpaid asks were never counted).
+                b.status === 'awaiting-payment' ||
+                (b.status === 'expired' && !!b.prepaid))).length + slotsWhere(() => true);
         if (madeToday + lines.length > limits.perDeploymentPerDay) {
             // ⚠️ A CEILING HIT IS SOMETHING A PERSON SHOULD KNOW: either business
             // is booming or somebody is filling hotels with names. Logged, and on
@@ -1593,10 +1663,45 @@ export const createHuazhuHotels = (opts) => {
         const contact = contactOf(row.guest);
         if (typeof contact === 'string') {
             const why = "the guest's name could not be sent to Huazhu as written";
-            store.update(id, { status: 'failed', ...(card ? { prepaid: { ...p, declined: why } } : {}) });
+            patch(id, { status: 'failed' }, card ? { declined: why } : {});
             await refundOf(id, why);
             return;
         }
+        // ⚠️ PREBOOKED AGAIN WHEN ITS TOKEN IS STALE (2026-10-16 audit, P2):
+        // Huazhu's token holds 10 minutes, and a page may be paid 30 minutes
+        // after the prebook. A price that moved, or no room left, is Huazhu's no
+        // to this stay - taken as one (all of it back). No answer: booked
+        // without a token - Huazhu checks the price at booking anyway.
+        if (p.prebookAt === undefined || now() - p.prebookAt >= PREBOOK_FRESH_MS) {
+            try {
+                const out = await client.prebook({
+                    hotelId: row.hotelId,
+                    checkinType: row.hourly ? 'HOUR' : 'DAY',
+                    paymentType: card ? 'CCPN' : row.paymentType,
+                    reservations: [
+                        {
+                            roomTypeCode: row.roomTypeCode,
+                            rateCode: row.rateCode,
+                            ...stayDatesOf(row),
+                            amountAfterTax: p.after,
+                            ...(p.before ? { amountBeforeTax: p.before } : {}),
+                            currencyCode: p.currency,
+                            roomCount: row.rooms,
+                            adultCount: row.stay.guests,
+                        },
+                    ],
+                });
+                patch(id, {}, { preBookToken: out?.preBookToken, prebookAt: now() });
+            }
+            catch (err) {
+                if (err instanceof HuazhuRefusal) {
+                    await turnedDown(id, err, !!card);
+                    return;
+                }
+                patch(id, {}, { preBookToken: undefined });
+            }
+        }
+        const token = store.get(id)?.prepaid?.preBookToken;
         const comment = commentOf(row.requests, row.guest.notes);
         const request = {
             hotelId: row.hotelId,
@@ -1633,16 +1738,37 @@ export const createHuazhuHotels = (opts) => {
                 },
             ],
             ...(comment ? { guestComment: comment } : {}),
-            ...(p.preBookToken ? { preBookToken: p.preBookToken } : {}),
+            ...(token ? { preBookToken: token } : {}),
         };
         // ⚠️ SET BEFORE THE CALL, as every booking is: a process that dies in it
-        // leaves a row the reconciler follows up.
-        store.update(id, { status: 'requested', pendingSince: now() });
+        // leaves a row the reconciler follows up. ⚠️ WRITTEN, OR NOT SENT
+        // (2026-10-05 audit P1-8, kept on this path - 2026-10-16 audit P2): a
+        // booking whose call is not written down could not be followed up. Left
+        // waiting, paid; the next pass tries again.
+        const current = store.get(id);
+        if (!current)
+            return;
+        try {
+            store.put({ ...current, status: 'requested', pendingSince: now() });
+        }
+        catch (err) {
+            if (!(err instanceof StoreWriteError))
+                throw err;
+            raise(id, `the booking could not be written down before it was sent to Huazhu, so it was not sent (${err.message}) - it is tried again on the next pass`);
+            return;
+        }
         let refusal;
         let answer;
         for (let attempt = 0; attempt < 2; attempt += 1) {
             try {
-                const got = await client.book(request);
+                reconciler.inFlight(id, true);
+                let got;
+                try {
+                    got = await client.book(request);
+                }
+                finally {
+                    reconciler.inFlight(id, false);
+                }
                 if (got && typeof got.resId === 'string' && got.resId)
                     answer = got;
             }
@@ -1668,26 +1794,24 @@ export const createHuazhuHotels = (opts) => {
             });
             return;
         }
-        if (refusal && card) {
-            // Paid with UnionPay: the hotel charges the card, and a booking it did
-            // not make it never charged - there is nothing here to give back.
-            store.update(id, {
-                status: 'failed',
-                pendingSince: undefined,
-                prepaid: {
-                    ...p,
-                    declined: `Huazhu did not take the booking: ${refusal.huazhuMessage} (${refusal.code})`.replace(/\d{12,19}/g, '****'),
-                },
-            });
+        if (refusal)
+            await turnedDown(id, refusal, !!card);
+        // No answer: the reconciler's eight minutes decide it.
+    };
+    /**
+     * Huazhu's no to a stay paid for, at its prebook or its booking. Paid with
+     * UnionPay, the hotel charges the card, and a booking it did not make it
+     * never charged - nothing here to give back. Paid on the card page (a price
+     * that moved since the prebook is one of these, 5209), all of it back.
+     */
+    const turnedDown = async (id, refusal, card) => {
+        const said = `Huazhu did not take the booking: ${refusal.huazhuMessage} (${refusal.code})`;
+        if (card) {
+            patch(id, { status: 'failed', pendingSince: undefined }, { declined: said.replace(/\d(?:[ -]?\d){11,18}/g, '****') });
             return;
         }
-        if (refusal) {
-            store.update(id, { status: 'failed', pendingSince: undefined });
-            // A price that moved since the prebook is one of these (5209): the
-            // guest paid for a price Huazhu no longer gives, and gets it all back.
-            await refundOf(id, `Huazhu did not take the booking: ${refusal.huazhuMessage} (${refusal.code})`);
-        }
-        // No answer: the reconciler's eight minutes decide it.
+        store.update(id, { status: 'failed', pendingSince: undefined });
+        await refundOf(id, said);
     };
     /**
      * Gives a guest's money back, in full - the only refund the gateway makes.
@@ -1701,21 +1825,117 @@ export const createHuazhuHotels = (opts) => {
             return;
         const tries = (p.refund?.tries ?? 0) + 1;
         const at = p.refund?.at ?? now();
+        // Said once: a retry sends what the first try sent, word for word - Stripe
+        // refuses the same key with anything else, every time after (2026-10-16
+        // audit, P2).
+        const why = p.refund?.reason ?? reason;
         try {
             // Named by when it was decided: the same refund retried is the same refund.
-            const r = await checkout.refund(p.sessionId, reason, `${row.distributorResId}-${at}`);
-            store.update(id, {
-                prepaid: { ...p, refund: { reason, at, requestId: r.requestId, status: r.status, tries } },
+            const r = await checkout.refund(p.sessionId, why, `${row.distributorResId}-${at}`, p.refund?.amountMinor);
+            patch(id, {}, {
+                refund: {
+                    reason: why,
+                    at,
+                    requestId: r.requestId,
+                    status: r.status,
+                    tries,
+                    triedAt: now(),
+                    ...(p.refund?.amountMinor !== undefined ? { amountMinor: p.refund.amountMinor } : {}),
+                },
             });
-            console.error(`[huazhu prepaid ${id}] refund ${r.requestId} (${r.status}) of session ${p.sessionId}: ${reason}`);
+            console.error(`[huazhu prepaid ${id}] refund ${r.requestId} (${r.status}) of session ${p.sessionId}: ${why}`);
         }
         catch (err) {
-            store.update(id, { prepaid: { ...p, refund: { reason, at, tries } } });
-            if (tries >= 8 && !row.attention) {
-                const why = `the guest paid (gateway session ${p.sessionId}) and the refund could not be opened: ${err.message}`;
-                store.update(id, { attention: why, attentionAt: new Date(now()).toISOString() });
-                console.error(`[huazhu prepaid ${id}] ⚠️ NEEDS A PERSON: ${why}`);
-            }
+            patch(id, {}, {
+                refund: {
+                    reason: why,
+                    at,
+                    tries,
+                    triedAt: now(),
+                    ...(p.refund?.amountMinor !== undefined ? { amountMinor: p.refund.amountMinor } : {}),
+                },
+            });
+            if (tries >= 8)
+                raise(id, `the guest paid (gateway session ${p.sessionId}) and the refund could not be opened`);
+        }
+    };
+    /**
+     * What a cancelled booking paid here in advance owes the guest - written in
+     * the SAME write as the cancellation (2026-10-16 audit, P0-B: written after
+     * it, a process stopped in between, Huazhu's 5402 and a cancellation made at
+     * Huazhu's end all left the money with us for good).
+     *
+     * - Free: all of it back - a refund to open.
+     * - Cancelled by the guest here, the fee the whole stay (the only kind of
+     *   rate sold paid in advance): kept as that fee.
+     * - Anything else - a part fee, or cancelled at Huazhu's end after the free
+     *   period, by the hotel or by the guest some other way: a person's to judge.
+     */
+    const owedOnCancel = (b, feeMinor, byGuest) => {
+        const p = b.prepaid;
+        if (!p?.paidAt || p.method === 'unionpay' || p.refund || p.kept)
+            return { row: {}, fields: {} };
+        if (feeMinor <= 0)
+            return {
+                row: {},
+                fields: {
+                    refund: {
+                        reason: byGuest
+                            ? 'cancelled within the free cancellation period'
+                            : 'cancelled at Huazhu within the free cancellation period',
+                        at: now(),
+                        tries: 0,
+                    },
+                },
+            };
+        if (byGuest && feeMinor >= b.quote.total.minor)
+            return { row: {}, fields: { kept: { feeMinor, at: now() } } };
+        // A part kept by the hotel, cancelled by the guest here: the rest back
+        // (2026-10-16 audit, P2 - a fee above nothing gave back nothing).
+        if (byGuest)
+            return {
+                row: {},
+                fields: {
+                    refund: {
+                        reason: `cancelled with a fee of ${formatMoney(money(feeMinor, b.quote.total.currency))} kept by the hotel - the rest back`,
+                        at: now(),
+                        tries: 0,
+                        amountMinor: b.quote.total.minor - feeMinor,
+                    },
+                },
+            };
+        const fee = formatMoney(money(feeMinor, b.quote.total.currency));
+        const why = byGuest
+            ? `cancelled with a fee of ${fee} of the ${formatMoney(b.quote.total)} paid (gateway session ${p.sessionId}): the difference is owed back, and a part refund is not made here`
+            : `Huazhu shows ${b.distributorResId} cancelled - not by the guest here - after its free period (a fee of ${fee} by its terms) with ${formatMoney(b.quote.total)} paid (gateway session ${p.sessionId}): whether the guest is owed it back is to be judged with Huazhu`;
+        console.error(`[huazhu prepaid ${b.id}] ⚠️ NEEDS A PERSON: ${why}`);
+        return {
+            row: {
+                attention: why,
+                attentionAt: new Date(now()).toISOString(),
+                resolvedAt: undefined,
+                resolution: undefined,
+            },
+            fields: {},
+        };
+    };
+    /**
+     * The one-time card a lapsed or cancelled UnionPay stay will never use,
+     * thrown away at the gateway - now if it is there, refused when it comes
+     * (网关 a974cc2a; 2026-10-16 audit, P1-6 and P2). "Handed over already"
+     * means a step here took it: a person checks with Huazhu.
+     */
+    const discardCard = async (id) => {
+        const row = store.get(id);
+        const sid = row?.prepaid?.method === 'unionpay' ? row.prepaid.sessionId : undefined;
+        if (!sid || !unionpay)
+            return;
+        try {
+            if ((await unionpay.discard(sid)) === 'released')
+                raise(id, `UnionPay's one-time card for gateway payment ${sid} was handed over here, yet the stay lapsed or was cancelled before it was booked: check with Huazhu whether ${row?.distributorResId} exists, and cancel it if it does`);
+        }
+        catch (err) {
+            console.error(`[huazhu prepaid ${id}] the gateway could not be told to throw away UnionPay's card for ${sid}: ${err.message}`);
         }
     };
     /**
@@ -1723,6 +1943,13 @@ export const createHuazhuHotels = (opts) => {
      * callback is seconds behind the guest. Later than this, it is never used.
      */
     const ISSUED_GRACE_MS = 5 * 60_000;
+    /** Huazhu's prebook token holds 10 minutes (v1.17): a paid stay older than this is prebooked again. */
+    const PREBOOK_FRESH_MS = 9 * 60_000;
+    /** Passes in a row without word from a card payment page, past its time, before a person is told. */
+    const UNANSWERED_PASSES = 30;
+    /** A paid booking nobody could confirm: Huazhu asked again this often, for this long (audit P1-2). */
+    const HELD_CHECK_MS = 30 * 60_000;
+    const HELD_LIMIT_MS = DAY_MS;
     /**
      * One step for a booking paid with UnionPay: confirmed on UnionPay's page →
      * the one-time card, once, straight into a CCPN booking with Huazhu;
@@ -1733,13 +1960,13 @@ export const createHuazhuHotels = (opts) => {
         const p = row.prepaid;
         if (row.status !== 'awaiting-payment' || !unionpay)
             return;
-        const lapse = () => store.update(row.id, {
-            status: 'expired',
-            prepaid: { ...p, lapsedAt: now(), url: undefined },
-        });
+        const lapse = async () => {
+            patch(row.id, { status: 'expired' }, { lapsedAt: now(), url: undefined });
+            await discardCard(row.id);
+        };
         if (!p.sessionId) {
             if (now() >= p.payBy)
-                lapse();
+                await lapse();
             return;
         }
         let state;
@@ -1747,7 +1974,11 @@ export const createHuazhuHotels = (opts) => {
             state = await unionpay.state(p.sessionId);
         }
         catch {
-            return; // asked again on the next pass
+            // Asked again on the next pass - until past its time and its grace: a
+            // card never taken is never charged, so it simply lapses (audit P1-4).
+            if (now() >= p.payBy + ISSUED_GRACE_MS)
+                await lapse();
+            return;
         }
         if (state === 'issued' && now() < p.payBy + ISSUED_GRACE_MS) {
             // ⚠️ ONCE: the gateway hands the card over a single time, then forgets it.
@@ -1763,20 +1994,21 @@ export const createHuazhuHotels = (opts) => {
                 return;
             }
             if (!card) {
-                // Handed over by the gateway and lost on the way, or never readable: the
-                // gateway gives it once, so this stay cannot be booked with it (总线程,
-                // 2026-10-15) - the guest books again and confirms on UnionPay again.
-                const why = 'UnionPay confirmed the payment, but its one-time card did not reach this connector, so the stay was not booked and nothing was charged. Ask for the booking again and confirm on UnionPay once more.';
-                store.update(row.id, {
-                    status: 'failed',
-                    prepaid: { ...p, url: undefined, declined: why },
-                });
-                console.error(`[huazhu prepaid ${row.id}] ${why}`);
+                // ⚠️ GONE FROM THE GATEWAY (410), OR NOT THIS MERCHANT'S (404) - NEVER
+                // "NOT BOOKED" BY GUESS (2026-10-16 audit, P0-A). Handed over once, to
+                // a step that may have booked it with Huazhu and then died: what
+                // Huazhu has decides. The stay waits on the follow-up queries
+                // (`Reconciler`) as any booking whose answer was lost does - booked
+                // if Huazhu has it, failed (nothing charged) if Huazhu says late in
+                // the eight minutes that it does not.
+                const cur = store.get(row.id);
+                if (!cur || cur.status !== 'awaiting-payment')
+                    return;
+                patch(row.id, { status: 'requested', pendingSince: now() }, { issuedAt: cur.prepaid?.issuedAt ?? now(), url: undefined });
+                console.error(`[huazhu prepaid ${row.id}] UnionPay's one-time card was not there to take (handed over already, or not this merchant's): asking Huazhu whether ${row.distributorResId} was booked`);
                 return;
             }
-            store.update(row.id, {
-                prepaid: { ...p, issuedAt: now(), cardLastFour: lastFour(card), url: undefined },
-            });
+            patch(row.id, {}, { issuedAt: now(), cardLastFour: lastFour(card), url: undefined });
             console.log(`[huazhu prepaid ${row.id}] UnionPay issued a one-time card ···· ${lastFour(card)}: booking it with Huazhu as CCPN`);
             await bookPaid(row.id, card);
             return;
@@ -1784,10 +2016,82 @@ export const createHuazhuHotels = (opts) => {
         // Unconfirmed in time: lapsed. A confirmation after this is never handed
         // on, so nothing is ever charged for it.
         if (state === 'closed' || now() >= p.payBy)
-            lapse();
+            await lapse();
+    };
+    /**
+     * ⚠️ ONE STEP AT A TIME ON A BOOKING - every step that moves a payment on:
+     * the pass, the landing page, paying with UnionPay instead, a cancellation
+     * (2026-10-16 audit, P0-A). A single flag for the pass alone was walked
+     * round by every lookup, which moved payments on unlocked: the one-time card
+     * taken twice, a stay Huazhu had booked written off as "not booked", a
+     * refund's record wiped and then reported as never opened.
+     */
+    const busy = new Set();
+    /** Every step under way - what a deploy's SIGTERM waits for (audit P1-3). */
+    const steps = new Set();
+    /** A step on this booking if nobody is taking one - undefined if somebody is, or the process is stopping. */
+    const ifFree = (id, fn) => {
+        if (busy.has(id) || closing)
+            return Promise.resolve(undefined);
+        busy.add(id);
+        const step = (async () => {
+            try {
+                return await fn();
+            }
+            finally {
+                busy.delete(id);
+            }
+        })();
+        steps.add(step);
+        void step.finally(() => steps.delete(step)).catch(() => { });
+        return step;
+    };
+    /** A step on this booking once it is its turn - one under way is waited for, a few seconds at most. */
+    const inTurnFor = async (id, fn) => {
+        for (let i = 0; busy.has(id) && i < 400; i += 1)
+            await new Promise((r) => setTimeout(r, 25));
+        if (closing)
+            throw new Error('This connector is restarting. Nothing changed - ask again in a moment.');
+        if (busy.has(id))
+            throw new Error('A payment on this booking is being settled right now. Ask again in a moment.');
+        return (await ifFree(id, fn));
+    };
+    /**
+     * ⚠️ A PERSON ASKED - EVERY TIME THERE IS SOMETHING NEW (2026-10-16 audit,
+     * P1-1): an earlier ask, even one already seen to, kept a refund that later
+     * failed from being asked about at all. The same thing still open is not
+     * asked twice; a new one opens the ask again.
+     */
+    const raise = (id, why) => {
+        const cur = store.get(id);
+        if (!cur)
+            return;
+        const open = !!cur.attention && !cur.resolvedAt;
+        if (open && cur.attention?.includes(why))
+            return;
+        store.update(id, {
+            attention: open ? `${cur.attention} | ${why}` : why,
+            attentionAt: new Date(now()).toISOString(),
+            resolvedAt: undefined,
+            resolution: undefined,
+        });
+        console.error(`[huazhu prepaid ${id}] ⚠️ NEEDS A PERSON: ${why}`);
+    };
+    /**
+     * Writes a booking as it is NOW, with `row` and the prepaid `fields` on top -
+     * never a whole record read before an await (audit P0-A: each of two steps
+     * wrote back what it had read, and the later one undid the earlier).
+     */
+    const patch = (id, row, fields = {}) => {
+        const cur = store.get(id);
+        if (!cur)
+            return undefined;
+        return store.update(id, {
+            ...row,
+            ...(cur.prepaid ? { prepaid: { ...cur.prepaid, ...fields } } : {}),
+        });
     };
     /** Whether a booking paid in advance still has money work to do. */
-    let ticking = false;
     const moneyPending = (b) => {
         const p = b.prepaid;
         if (!p)
@@ -1799,6 +2103,9 @@ export const createHuazhuHotels = (opts) => {
             return false;
         if (!p.paidAt)
             return false;
+        // Cancelled - at Huazhu's end, say - with nothing decided about the money yet.
+        if (b.status === 'cancelled' && !p.refund && !p.kept && !b.attention)
+            return true;
         // Booked: Huazhu's order number still to be written onto the payment, once.
         if (b.status === 'confirmed' && b.resId && !p.noted && !p.refund && checkout?.annotate)
             return true;
@@ -1822,7 +2129,7 @@ export const createHuazhuHotels = (opts) => {
         if (row.status === 'awaiting-payment') {
             if (!p.sessionId) {
                 if (now() >= p.payBy)
-                    store.update(row.id, { status: 'expired', prepaid: { ...p, lapsedAt: now() } });
+                    patch(row.id, { status: 'expired' }, { lapsedAt: now() });
                 return;
             }
             let state;
@@ -1832,8 +2139,17 @@ export const createHuazhuHotels = (opts) => {
                     state = await checkout.close(p.sessionId);
             }
             catch {
-                return; // asked again on the next pass
+                // Asked again on the next pass - but a page that cannot be asked
+                // about long past its time is a person's to look at: it may have been
+                // paid (2026-10-16 audit, P1-4).
+                const misses = (p.unanswered ?? 0) + 1;
+                patch(row.id, {}, { unanswered: misses });
+                if (misses >= UNANSWERED_PASSES && now() >= p.payBy)
+                    raise(row.id, `payment page ${p.sessionId} could not be asked where it stands, past its time: whether it was paid is not known - look it up with the payment provider`);
+                return;
             }
+            if (p.unanswered)
+                patch(row.id, {}, { unanswered: undefined });
             if (state === 'paid') {
                 // ⚠️ THE MONEY HELD TO THE QUOTE BEFORE ANYTHING IS BOOKED (总线程,
                 // 2026-10-15): what the page took, to the fen and in the currency,
@@ -1849,40 +2165,88 @@ export const createHuazhuHotels = (opts) => {
                 const want = row.quote.total;
                 if (!took || took.amountMinor !== want.minor || took.currency !== want.currency) {
                     const said = took ? `${took.amountMinor} ${took.currency}` : 'an amount it could not say';
-                    store.update(row.id, {
-                        status: 'failed',
-                        prepaid: {
-                            ...p,
-                            paidAt: now(),
-                            url: undefined,
-                            refund: {
-                                reason: `the payment page took ${said}, not the ${want.minor} ${want.currency} quoted - nothing was booked`,
-                                at: now(),
-                                tries: 0,
-                            },
+                    // Shown to the guest (`refundReason`): money as `formatMoney` writes
+                    // it, so the card can say it in the guest's own way (香格里拉,
+                    // 2026-10-16) - never minor units.
+                    const shown = took
+                        ? formatMoney(money(took.amountMinor, took.currency))
+                        : 'an amount it could not say';
+                    patch(row.id, { status: 'failed' }, {
+                        paidAt: now(),
+                        url: undefined,
+                        refund: {
+                            reason: `the payment page took ${shown}, not the ${formatMoney(want)} quoted - nothing was booked`,
+                            at: now(),
+                            tries: 0,
                         },
                     });
                     console.error(`[huazhu prepaid ${row.id}] ⚠️ paid ${said} against ${want.minor} ${want.currency} quoted: not booked, refunding`);
                     return;
                 }
-                store.update(row.id, { prepaid: { ...p, paidAt: now(), url: undefined } });
+                patch(row.id, {}, { paidAt: now(), url: undefined });
                 await bookPaid(row.id);
             }
             else if (state === 'closed') {
-                store.update(row.id, {
-                    status: 'expired',
-                    prepaid: { ...p, lapsedAt: now(), url: undefined },
-                });
+                patch(row.id, { status: 'expired' }, { lapsedAt: now(), url: undefined });
             }
             return;
         }
         if (!p.paidAt)
             return;
+        // Cancelled with the money not decided - at Huazhu's end (a lookup or a
+        // follow-up query saw HOTEL_CANCEL): free means all of it back, anything
+        // else a person's to judge (audit P0-B).
+        if (row.status === 'cancelled' && !p.refund && !p.kept) {
+            if (row.attention)
+                return;
+            const at = row.cancelledAt ? Date.parse(row.cancelledAt) : now();
+            const owed = owedOnCancel(row, row.cancellationFee?.minor ?? feeNow(row, at).fee, false);
+            patch(row.id, owed.row, owed.fields);
+            if (owed.fields.refund)
+                await refundOf(row.id, owed.fields.refund.reason);
+            return;
+        }
+        // ⚠️ NOBODY COULD CONFIRM IT: THE MONEY IS HELD, NOT GIVEN BACK (2026-10-16
+        // audit, P1-2). Refunded at once, a booking that did exist at Huazhu was
+        // kept unpaid - and past its free period, cost the whole stay to cancel.
+        // Huazhu is asked again every half hour: "none" refunds it all, "here it
+        // is" keeps it; a day without an answer is a person's.
+        if (row.status === 'unconfirmed' && !p.refund) {
+            const since = p.heldSince ?? now();
+            if (p.heldSince === undefined)
+                patch(row.id, {}, { heldSince: since });
+            if (p.checkedAt !== undefined && now() - p.checkedAt < HELD_CHECK_MS)
+                return;
+            patch(row.id, {}, { checkedAt: now() });
+            let found;
+            try {
+                found = await client.consistency(row.distributorResId);
+            }
+            catch (err) {
+                if (err instanceof HuazhuRefusal && err.code === NOT_FOUND) {
+                    const reason = 'Huazhu says it never booked the stay';
+                    patch(row.id, { status: 'failed', hotelStatus: 'HOTEL_FAILED' }, { refund: { reason, at: now(), tries: 0 } });
+                    store.resolve(row.id, `${reason}: refunded in full`);
+                    await refundOf(row.id, reason);
+                    return;
+                }
+                if (now() - since >= HELD_LIMIT_MS)
+                    raise(row.id, `nobody has been able to confirm ${row.distributorResId} with Huazhu for 24 hours and the guest's money is held: decide with Huazhu whether to keep it or refund it`);
+                return;
+            }
+            if (found?.resId && found.status) {
+                const status = statusOf(found.status);
+                patch(row.id, { status, resId: found.resId, hotelStatus: found.status });
+                if (status === 'confirmed')
+                    store.resolve(row.id, 'Huazhu has the booking: kept, and paid');
+            }
+            return;
+        }
         // ⚠️ HUAZHU'S ORDER NUMBER ON THE PAYMENT, ONCE (总线程, 2026-10-15), so
         // Stripe's dashboard and Huazhu's order are one look apart. Tried once:
         // a failure is said in the log and never touches the booking.
         if (row.status === 'confirmed' && row.resId && !p.noted && !p.refund && checkout.annotate) {
-            store.update(row.id, { prepaid: { ...p, noted: now() } });
+            patch(row.id, {}, { noted: now() });
             try {
                 await checkout.annotate(p.sessionId ?? '', {
                     huazhu_res_id: row.resId,
@@ -1894,25 +2258,25 @@ export const createHuazhuHotels = (opts) => {
             }
             return;
         }
-        if (!p.refund?.requestId &&
-            (p.refund || row.status === 'failed' || row.status === 'unconfirmed')) {
-            await refundOf(row.id, p.refund?.reason ??
-                (row.status === 'failed'
-                    ? 'Huazhu did not take the booking'
-                    : 'nobody could confirm the booking with Huazhu - if it turns up there, a person cancels it'));
+        if (!p.refund?.requestId && (p.refund || row.status === 'failed')) {
+            // Not opened after three tries: tried further apart - a minute,
+            // doubling to an hour - not every ten seconds for good (audit P2).
+            const tries = p.refund?.tries ?? 0;
+            const wait = tries < 3 ? 0 : Math.min(60_000 * 2 ** (tries - 3), 3_600_000);
+            if (p.refund?.triedAt !== undefined && now() < p.refund.triedAt + wait)
+                return;
+            await refundOf(row.id, p.refund?.reason ?? 'Huazhu did not take the booking');
             return;
         }
         const refund = p.refund;
         if (refund?.requestId && !['refunded', 'failed', 'rejected'].includes(refund.status ?? '')) {
             try {
                 const status = await checkout.refundState(refund.requestId);
-                if (status !== refund.status)
-                    store.update(row.id, { prepaid: { ...p, refund: { ...refund, status } } });
-                if ((status === 'failed' || status === 'rejected') && !row.attention) {
-                    const why = `refund ${refund.requestId} of gateway session ${p.sessionId} came back ${status}: the guest's money is not back`;
-                    store.update(row.id, { attention: why, attentionAt: new Date(now()).toISOString() });
-                    console.error(`[huazhu prepaid ${row.id}] ⚠️ NEEDS A PERSON: ${why}`);
-                }
+                const latest = store.get(row.id)?.prepaid?.refund;
+                if (latest && status !== latest.status)
+                    patch(row.id, {}, { refund: { ...latest, status } });
+                if (status === 'failed' || status === 'rejected')
+                    raise(row.id, `refund ${refund.requestId} of gateway session ${p.sessionId} came back ${status}: the guest's money is not back`);
             }
             catch {
                 // asked again on the next pass
@@ -2046,7 +2410,7 @@ export const createHuazhuHotels = (opts) => {
             const record = {
                 method: checkout.method,
                 payBy: now() + payWithin,
-                ...(plan.token ? { preBookToken: plan.token } : {}),
+                ...(plan.token ? { preBookToken: plan.token, prebookAt: now() } : {}),
                 after: s.after,
                 ...(s.before ? { before: s.before } : {}),
                 ...(s.rack ? { rack: s.rack } : {}),
@@ -2103,6 +2467,8 @@ export const createHuazhuHotels = (opts) => {
                     amountMinor: allIn,
                     currency: cur,
                     email: guest.email,
+                    // A minute past the booking's own deadline - ours closes it first.
+                    expiresAt: record.payBy + 60_000,
                 });
             }
             catch (err) {
@@ -2239,7 +2605,14 @@ export const createHuazhuHotels = (opts) => {
                 let answer;
                 for (let attempt = 0; attempt < 2; attempt += 1) {
                     try {
-                        const got = await client.book(request);
+                        reconciler.inFlight(id, true);
+                        let got;
+                        try {
+                            got = await client.book(request);
+                        }
+                        finally {
+                            reconciler.inFlight(id, false);
+                        }
                         if (got && typeof got.resId === 'string' && got.resId)
                             answer = got;
                     }
@@ -2294,23 +2667,6 @@ export const createHuazhuHotels = (opts) => {
         }
         return { booked: made.map((b) => publicBooking(store.get(b.id) ?? b)), failed };
     };
-    /**
-     * Waits its turn behind the pass and the landing page - the one at a time
-     * every step on a booking paid in advance takes - then runs.
-     */
-    const inTurn = async (fn) => {
-        for (let i = 0; ticking && i < 400; i += 1)
-            await new Promise((r) => setTimeout(r, 25));
-        if (ticking)
-            throw new Error('A payment here is being settled right now. Ask again in a moment.');
-        ticking = true;
-        try {
-            return await fn();
-        }
-        finally {
-            ticking = false;
-        }
-    };
     /**
      * Pay a booking waiting for payment with UnionPay instead of the card page
      * (robin, 2026-10-15). The card page is closed first - paid on it in the
@@ -2341,6 +2697,20 @@ export const createHuazhuHotels = (opts) => {
         const no = notWaiting(first);
         if (no)
             return no;
+        // Huazhu books this rate paid by card (CCPN) or not at all - its
+        // guarantee says which (2026-10-16 audit, P1-8).
+        if (!(PAYMENT_FOR_GUARANTEE[first.guaranteeCode] ?? []).includes('CCPN'))
+            return refused(`Huazhu does not take ${first.confirmationCode}'s rate paid by card, so it cannot be paid with UnionPay. Nothing changed - the card page still takes the payment.`, 'hotel-refused');
+        // ⚠️ COUNTED BEFORE ANYTHING REACHES THE GATEWAY (audit P0-E).
+        const keys = [
+            [`b:${first.id}`, UNIONPAY_ASKS.booking],
+            [`s:${conversationOf(who)}`, UNIONPAY_ASKS.conversation],
+            ...(who.ip ? [[`ip:${who.ip}`, UNIONPAY_ASKS.ip]] : []),
+        ];
+        if (keys.some(([k, most]) => unionPayAsks.count(k) >= most))
+            return refused(`Paying ${first.confirmationCode} with UnionPay was asked for too often this hour. Nothing changed - the card page still takes the payment, or ask again later.`, 'too-many-tries');
+        for (const [k] of keys)
+            unionPayAsks.add(k);
         if (first.prepaid?.method === 'unionpay' && first.prepaid.url)
             return { kind: 'confirm', url: first.prepaid.url, booking: publicBooking(first) };
         let cards;
@@ -2352,15 +2722,26 @@ export const createHuazhuHotels = (opts) => {
         }
         const card = cards[0];
         // No card yet: UnionPay's page to bind one - and nothing else changes.
+        // The same page for half an hour (audit P0-E): asked again, it is handed
+        // out again, not asked of the gateway and UnionPay again.
         if (!card) {
+            const p0 = first.prepaid;
+            if (p0?.enrollUrl && p0.enrollAt !== undefined && now() - p0.enrollAt < ENROLL_REUSE_MS)
+                return { kind: 'enroll', url: p0.enrollUrl };
             try {
-                return { kind: 'enroll', url: (await unionpay.enroll(first.guest.email)).url };
+                const { url } = await unionpay.enroll(first.guest.email);
+                patch(first.id, {}, { enrollUrl: url, enrollAt: now() });
+                return { kind: 'enroll', url };
             }
             catch (err) {
+                // The gateway's own limit: three binding pages a guest an hour (网关
+                // a974cc2a). Said as "later" - never a failure, never asked again now.
+                if (err instanceof UnionPayError && err.status === 429)
+                    return refused("UnionPay's page for adding a card was asked for too often for this guest this hour. Nothing changed - the card page still takes the payment, or try UnionPay again later.", 'too-many-tries');
                 return refused(`UnionPay's page for adding a card could not be opened (${err.message}). Nothing changed - ask again.`, 'unreachable');
             }
         }
-        return inTurn(async () => {
+        return inTurnFor(first.id, async () => {
             const row = store.get(first.id) ?? first;
             const again = notWaiting(row);
             if (again)
@@ -2368,21 +2749,6 @@ export const createHuazhuHotels = (opts) => {
             const p = row.prepaid;
             if (p.method === 'unionpay' && p.url)
                 return { kind: 'confirm', url: p.url, booking: publicBooking(row) };
-            // The card page first: closed, it cannot be paid after this.
-            if (p.method !== 'unionpay' && p.sessionId) {
-                let state;
-                try {
-                    state = await checkout.close(p.sessionId);
-                }
-                catch (err) {
-                    return refused(`The card page could not be closed (${err.message}). Nothing changed - ask again.`, 'unreachable');
-                }
-                if (state === 'paid') {
-                    await settlePrepaid(row);
-                    return { kind: 'paid-on-card', booking: publicBooking(store.get(row.id) ?? row) };
-                }
-                store.update(row.id, { prepaid: { ...p, sessionId: undefined, url: undefined } });
-            }
             const title = row.quote.lines[0]?.title ?? row.hotelName;
             // Prebooked again the way it will be booked: Huazhu's token holds only
             // for the same request (wire.ts).
@@ -2407,16 +2773,48 @@ export const createHuazhuHotels = (opts) => {
                 }))?.preBookToken;
             }
             catch (err) {
+                // ⚠️ NOTHING CHANGES ON A NO (audit P1-8): asked before the card page
+                // is closed, so the card page still takes the payment.
                 if (err instanceof HuazhuRefusal) {
-                    store.update(row.id, {
-                        status: 'expired',
-                        prepaid: { ...p, sessionId: undefined, url: undefined, lapsedAt: now() },
-                    });
                     const said = refusalCode(err, row.rooms).code;
-                    return refused(`Nothing was booked or charged: ${refusalWords(err, `${row.hotelName} - ${title}`, p.currency)}`, said === 'price-changed' || said === 'sold-out' ? said : 'hotel-refused');
+                    // A price that moved, or no room left: neither way books it at what
+                    // the guest was shown - the card page is closed too, and the stay
+                    // lapses (paid on it meanwhile, it goes on as that payment).
+                    if (said === 'price-changed' || said === 'sold-out') {
+                        if (p.sessionId) {
+                            const page = await checkout.close(p.sessionId).catch(() => undefined);
+                            if (page === 'paid') {
+                                await settlePrepaid(row);
+                                return { kind: 'paid-on-card', booking: publicBooking(store.get(row.id) ?? row) };
+                            }
+                        }
+                        patch(row.id, { status: 'expired' }, { sessionId: undefined, url: undefined, lapsedAt: now() });
+                        return refused(`Nothing was booked or charged: ${refusalWords(err, `${row.hotelName} - ${title}`, p.currency)}`, said);
+                    }
+                    // Anything else - Huazhu not taking this rate paid by card, say -
+                    // changes nothing: the card page still takes the payment.
+                    return refused(said === 'prepaid-only'
+                        ? 'Huazhu does not take this rate paid by card, so it cannot be paid with UnionPay. Nothing changed - the card page still takes the payment.'
+                        : `Huazhu did not take it paid by card: ${refusalWords(err, `${row.hotelName} - ${title}`, p.currency)} Nothing changed - the card page still takes the payment.`, 'hotel-refused');
                 }
                 return refused(`Huazhu could not be reached to check the stay (${err.message}). Nothing was charged - ask again.`, 'unreachable');
             }
+            // Huazhu said yes: now the card page is closed, so it cannot be paid
+            // after this.
+            if (p.method !== 'unionpay' && p.sessionId) {
+                let state;
+                try {
+                    state = await checkout.close(p.sessionId);
+                }
+                catch (err) {
+                    return refused(`The card page could not be closed (${err.message}). Nothing changed - ask again.`, 'unreachable');
+                }
+                if (state === 'paid') {
+                    await settlePrepaid(row);
+                    return { kind: 'paid-on-card', booking: publicBooking(store.get(row.id) ?? row) };
+                }
+                patch(row.id, {}, { sessionId: undefined, url: undefined });
+            }
             const names = hotelNamesOf(row.hotelId);
             const nights = row.quote.lines[0]?.nights ?? 1;
             let opened;
@@ -2437,16 +2835,12 @@ export const createHuazhuHotels = (opts) => {
             catch (err) {
                 return refused(`UnionPay's page could not be opened (${err.message}). Nothing was charged - ask again.`, 'unreachable');
             }
-            const updated = store.update(row.id, {
-                paymentType: 'CCPN',
-                prepaid: {
-                    ...p,
-                    method: 'unionpay',
-                    sessionId: opened.sessionId,
-                    url: opened.url,
-                    ...(token ? { preBookToken: token } : {}),
-                    payBy: now() + payWithin,
-                },
+            const updated = patch(row.id, { paymentType: 'CCPN' }, {
+                method: 'unionpay',
+                sessionId: opened.sessionId,
+                url: opened.url,
+                ...(token ? { preBookToken: token, prebookAt: now() } : {}),
+                payBy: now() + payWithin,
             }) ?? row;
             return { kind: 'confirm', url: opened.url, booking: publicBooking(updated) };
         });
@@ -2468,14 +2862,27 @@ export const createHuazhuHotels = (opts) => {
                         : 'not-paid'
                     : row.status === 'expired'
                         ? 'not-paid'
-                        : p?.paidAt && (p.refund || row.status === 'failed' || row.status === 'unconfirmed')
-                            ? 'refunded'
-                            : row.status === 'failed' && !p?.paidAt
-                                ? 'not-paid'
-                                : 'unknown';
+                        : row.status === 'unconfirmed' && p?.paidAt && !p.refund
+                            ? // Held while Huazhu is asked (audit P1-2): paid, the hotel still being asked.
+                                'booking'
+                            : p?.paidAt && (p.refund || row.status === 'failed')
+                                ? 'refunded'
+                                : row.status === 'failed' && !p?.paidAt
+                                    ? 'not-paid'
+                                    : 'unknown';
         const names = hotelNamesOf(row.hotelId);
+        // Owed back, but not sent - a person is seeing to it: never said as "on its way" (audit P1-1).
+        const stuck = !!p?.refund &&
+            (p.refund.status === 'failed' ||
+                p.refund.status === 'rejected' ||
+                (!p.refund.requestId && (p.refund.tries ?? 0) >= 8));
+        const part = p?.refund?.amountMinor;
         return {
             state,
+            ...(state === 'refunded' && stuck ? { refundStuck: true } : {}),
+            ...(state === 'refunded' && part !== undefined && part < row.quote.total.minor
+                ? { refundAmount: money(part, row.quote.total.currency) }
+                : {}),
             code: row.confirmationCode,
             hotelName: row.hotelName,
             ...(names ? { hotelNames: names } : {}),
@@ -2500,25 +2907,40 @@ export const createHuazhuHotels = (opts) => {
             return undefined;
         const at = now();
         if (at - (returned.get(sessionId) ?? Number.NEGATIVE_INFINITY) >= 10_000 &&
-            !ticking &&
             moneyPending(found)) {
             returned.set(sessionId, at);
             if (returned.size > 1_000)
                 for (const [k, v] of returned)
                     if (at - v > 10 * 60_000)
                         returned.delete(k);
-            ticking = true;
             try {
-                await settlePrepaid(found);
+                // Under the booking's own lock - taken by the pass meanwhile, this
+                // step is the pass's to take (audit P0-A).
+                await ifFree(found.id, () => settlePrepaid(found));
             }
             catch (err) {
                 console.error(`[huazhu prepaid ${found.id}] the landing page's step failed: ${err.message}`);
             }
-            finally {
-                ticking = false;
-            }
         }
-        return returnOf(store.get(found.id) ?? found);
+        const row = store.get(found.id) ?? found;
+        const told = returnOf(row);
+        // ⚠️ "NOT PAID" ONLY WHEN STRIPE SAYS SO (audit P0-D): a pass busy on this
+        // booking, or behind on others, left a guest who had paid told "nothing
+        // was charged - book again". Not paid here yet, the page is asked - only
+        // read, never moved on.
+        if (told.state === 'not-paid' &&
+            row.status === 'awaiting-payment' &&
+            row.prepaid?.method !== 'unionpay' &&
+            row.prepaid?.sessionId &&
+            checkout) {
+            const page = await checkout.state(row.prepaid.sessionId).catch(() => undefined);
+            if (page === 'paid')
+                return { ...told, state: 'booking' };
+            // Cannot be read just now: the page looks again (香格里拉's `checking`).
+            if (page === undefined)
+                return { ...told, state: 'checking' };
+        }
+        return told;
     };
     return {
         brand: opts.brand,
@@ -2536,18 +2958,20 @@ export const createHuazhuHotels = (opts) => {
         ...(checkout ? { paymentReturn } : {}),
         ...(checkout && unionpay ? { unionPay } : {}),
         async prepaidTick() {
-            // ⚠️ ONE PASS AT A TIME: a pass slower than the ten seconds between
-            // them would otherwise book a paid stay, or give money back, twice.
-            if (ticking)
+            // ⚠️ EACH BOOKING UNDER ITS OWN LOCK (audit P0-A): two passes, or a
+            // pass and the landing page, never take a step on one booking at once.
+            // One booking's failure holds up none of the others (audit P2).
+            if (closing)
                 return;
-            ticking = true;
-            try {
-                for (const row of store.all())
-                    if (moneyPending(row))
-                        await settlePrepaid(row);
-            }
-            finally {
-                ticking = false;
+            for (const row of store.all()) {
+                if (!moneyPending(row))
+                    continue;
+                try {
+                    await ifFree(row.id, () => settlePrepaid(row));
+                }
+                catch (err) {
+                    console.error(`[huazhu prepaid ${row.id}] the pass's step failed: ${err.message}`);
+                }
             }
         },
         imageDomains() {
@@ -2612,7 +3036,9 @@ export const createHuazhuHotels = (opts) => {
          */
         async drain() {
             closing = true;
-            await Promise.allSettled([...new Set(flights.values())]);
+            // The steps on payments too - a refund or a booking half taken when the
+            // process stopped was lost (audit P1-3, P0-B).
+            await Promise.allSettled([...new Set(flights.values()), ...steps]);
         },
         async searchHotels(q) {
             const terms = (q.query ?? '')
@@ -3222,6 +3648,30 @@ export const createHuazhuHotels = (opts) => {
                 };
             }
             const { fee, forbidden, rule, freeUntil } = feeNow(b);
+            // A test booking says it is one (2026-10-16 audit, P2): Huazhu's test
+            // system charges nobody and books nothing anyone stays in.
+            const testNote = opts.testEnvironment
+                ? " This is a test booking in Huazhu's test system: nothing is charged to anyone."
+                : '';
+            // Paid with UnionPay: Huazhu charged the one-time card, and gives back
+            // to it what its terms allow - nothing passes through here (audit P0-C:
+            // it was told as "paid at the hotel, nothing paid through here").
+            if (b.prepaid?.method === 'unionpay' && b.prepaid.issuedAt) {
+                const back = !forbidden && fee === 0;
+                return {
+                    bookingId: b.id,
+                    confirmationCode: b.confirmationCode,
+                    fee: money(forbidden ? 0 : fee, cur),
+                    refund: back ? b.quote.total : zero,
+                    rule: forbidden
+                        ? `This rate cannot be cancelled now. ${rule} Huazhu keeps the ${formatMoney(b.quote.total)} it charged to the UnionPay card.${testNote}`
+                        : back
+                            ? `${rule} Paid with a UnionPay card that Huazhu charged: cancelling now, Huazhu gives all ${formatMoney(b.quote.total)} back to that same card - not through here.${testNote}`
+                            : `${rule} Paid with a UnionPay card that Huazhu charged: cancelling now gives nothing back - the fee is the whole stay, and Huazhu keeps it.${testNote}`,
+                    ...(freeUntil ? { freeUntil: new Date(freeUntil).toISOString() } : {}),
+                    cancellable: !forbidden,
+                };
+            }
             if (b.prepaid?.paidAt) {
                 // Paid here in advance: free means all of it back, anything else -
                 // the whole stay, on these rates - means none.
@@ -3234,8 +3684,8 @@ export const createHuazhuHotels = (opts) => {
                     rule: forbidden
                         ? `This rate cannot be cancelled now. ${rule} The ${formatMoney(b.quote.total)} paid stays paid.`
                         : back
-                            ? `${rule} Cancelling now gives back all ${formatMoney(b.quote.total)} paid, to the card it was paid with.${opts.sandbox ? ' This is a test booking in the simulated Huazhu, paid in the gateway’s test mode: no real money moves.' : ''}`
-                            : `${rule} Cancelling now gives nothing back: the fee is the whole stay.`,
+                            ? `${rule} Cancelling now gives back all ${formatMoney(b.quote.total)} paid, to the card it was paid with.${opts.sandbox ? ' This is a test booking in the simulated Huazhu, paid in the gateway’s test mode: no real money moves.' : opts.testEnvironment ? ' This is a test booking in Huazhu’s test system, paid in test mode: no real money moves.' : ''}`
+                            : `${rule} Cancelling now gives nothing back: the fee is the whole stay.${testNote}`,
                     ...(freeUntil ? { freeUntil: new Date(freeUntil).toISOString() } : {}),
                     cancellable: !forbidden,
                 };
@@ -3250,7 +3700,9 @@ export const createHuazhuHotels = (opts) => {
                     ? `This rate cannot be cancelled now. ${rule}`
                     : opts.sandbox
                         ? `${rule} This is a test booking in the simulated Huazhu: the fee is worked out as a real booking's would be, and nothing is charged to anyone.`
-                        : `${rule} Nothing was paid through this connector - the booking is paid at the hotel - so any fee is charged under the hotel's terms, and Huazhu works out the exact amount when it cancels.`,
+                        : opts.testEnvironment
+                            ? `${rule} This is a test booking in Huazhu's test system: the fee is worked out as a real booking's would be, and nothing is charged to anyone.`
+                            : `${rule} Nothing was paid through this connector - the booking is paid at the hotel - so any fee is charged under the hotel's terms, and Huazhu works out the exact amount when it cancels.`,
                 ...(freeUntil ? { freeUntil: new Date(freeUntil).toISOString() } : {}),
                 cancellable: !forbidden,
             };
@@ -3259,80 +3711,94 @@ export const createHuazhuHotels = (opts) => {
             const found = findOwn(ref, who);
             if (!found)
                 return null;
-            const b = await refresh(found);
-            // Waiting on UnionPay: a confirmation already made is being booked by
-            // the pass - which alone takes the card, once; one not made never will be.
-            if (b.status === 'awaiting-payment' && b.prepaid?.method === 'unionpay') {
-                const state = b.prepaid.sessionId && unionpay
-                    ? await unionpay.state(b.prepaid.sessionId).catch(() => undefined)
-                    : 'closed';
-                if (state !== 'issued' && state !== undefined) {
-                    return publicBooking(store.update(b.id, {
-                        status: 'expired',
-                        prepaid: { ...b.prepaid, lapsedAt: now(), url: undefined },
-                    }) ?? b);
+            const first = await refresh(found);
+            // A booking paid in advance is cancelled under its own lock - the pass,
+            // the landing page and a switch to UnionPay wait (audit P0-A).
+            const run = async () => {
+                const b = store.get(first.id) ?? first;
+                // Waiting on UnionPay: a confirmation already made is being booked by
+                // the pass - which alone takes the card, once; one not made never will be.
+                if (b.status === 'awaiting-payment' && b.prepaid?.method === 'unionpay') {
+                    const state = b.prepaid.sessionId && unionpay
+                        ? await unionpay.state(b.prepaid.sessionId).catch(() => undefined)
+                        : 'closed';
+                    if (state !== 'issued' && state !== undefined) {
+                        const lapsed = patch(b.id, { status: 'expired' }, { lapsedAt: now(), url: undefined }) ?? b;
+                        await discardCard(b.id);
+                        return publicBooking(store.get(b.id) ?? lapsed);
+                    }
+                    throw new Error(state === 'issued'
+                        ? 'The guest has just confirmed on UnionPay, so the stay is being booked with Huazhu now. Ask again in a moment to cancel it.'
+                        : 'UnionPay could not be reached to say whether the guest confirmed. Ask again in a moment - nothing is booked until it can.');
                 }
-                throw new Error(state === 'issued'
-                    ? 'The guest has just confirmed on UnionPay, so the stay is being booked with Huazhu now. Ask again in a moment to cancel it.'
-                    : 'UnionPay could not be reached to say whether the guest confirmed. Ask again in a moment - nothing is booked until it can.');
-            }
-            // Not paid yet: the page is closed, so it cannot be paid after this.
-            if (b.status === 'awaiting-payment' && b.prepaid?.sessionId && checkout) {
-                const state = await checkout.close(b.prepaid.sessionId).catch(() => undefined);
-                if (state === 'closed') {
-                    return publicBooking(store.update(b.id, {
-                        status: 'expired',
-                        prepaid: { ...b.prepaid, lapsedAt: now(), url: undefined },
-                    }) ?? b);
+                // Not paid yet: the page is closed, so it cannot be paid after this.
+                if (b.status === 'awaiting-payment' && b.prepaid?.sessionId && checkout) {
+                    const state = await checkout.close(b.prepaid.sessionId).catch(() => undefined);
+                    if (state === 'closed') {
+                        return publicBooking(patch(b.id, { status: 'expired' }, { lapsedAt: now(), url: undefined }) ?? b);
+                    }
+                    // ⚠️ NO ANSWER IS NOT "PAID" (audit P0-C): the page may well still be
+                    // open and unpaid.
+                    if (state === undefined)
+                        throw new Error('The payment page could not be reached to close it, so nothing was cancelled yet. Ask again in a moment - nothing is booked or charged until the page is paid.');
+                    // Paid in the last second: it is booked now, and cancelled as one.
+                    await settlePrepaid(b);
+                    throw new Error('The guest has just paid, so the stay is being booked with Huazhu now. Ask again in a moment to cancel it - a cancellation in the free period gives all the money back.');
                 }
-                // Paid in the last second: it is booked now, and cancelled as one.
-                await settlePrepaid(b);
-                throw new Error('The guest has just paid, so the stay is being booked with Huazhu now. Ask again in a moment to cancel it - a cancellation in the free period gives all the money back.');
-            }
-            if (b.pendingSince !== undefined || b.status === 'unconfirmed') {
-                throw new Error(waitingWords(b));
-            }
-            if (!b.resId)
-                return publicBooking(b);
-            if (b.status !== 'confirmed')
-                return publicBooking(b);
-            const cur = b.quote.total.currency;
-            try {
-                const out = await client.cancel(b.resId);
-                const fee = typeof out.penaltyAmount === 'number'
-                    ? money(toMinor(out.penaltyAmount, out.penaltyCurrencyCode || cur), out.penaltyCurrencyCode || cur)
-                    : money(feeNow(b).fee, cur);
-                const cancelled = store.update(b.id, {
-                    status: 'cancelled',
-                    hotelStatus: 'HOTEL_CANCEL',
-                    cancelledAt: new Date(now()).toISOString(),
-                    cancellationFee: fee,
-                }) ?? b;
-                // Paid in advance and cancelled free: all of it back. A fee here is
-                // the whole stay (only whole-or-nothing rates are sold this way), so
-                // nothing comes back.
-                if (cancelled.prepaid?.paidAt && fee.minor === 0)
-                    await refundOf(b.id, 'cancelled within the free cancellation period');
-                return publicBooking(store.get(b.id) ?? cancelled);
-            }
-            catch (err) {
-                if (err instanceof HuazhuRefusal && err.code === 5402) {
-                    return publicBooking(store.update(b.id, {
+                if (b.pendingSince !== undefined || b.status === 'unconfirmed') {
+                    throw new Error(waitingWords(b));
+                }
+                if (!b.resId)
+                    return publicBooking(b);
+                if (b.status !== 'confirmed')
+                    return publicBooking(b);
+                const cur = b.quote.total.currency;
+                // ⚠️ THE CANCELLATION AND WHAT IT OWES IN ONE WRITE, then the refund
+                // (audit P0-B) - a process stopped in between leaves the refund to
+                // open, which the pass opens.
+                const cancelled = (fee, at) => {
+                    const latest = store.get(b.id) ?? b;
+                    const owed = owedOnCancel(latest, fee.minor, true);
+                    const done = patch(b.id, {
                         status: 'cancelled',
                         hotelStatus: 'HOTEL_CANCEL',
-                        cancelledAt: b.cancelledAt ?? new Date(now()).toISOString(),
-                    }) ?? b);
-                }
-                if (err instanceof HuazhuRefusal && (err.code === 5401 || err.code === 5405)) {
-                    throw new Error(err.code === 5405
-                        ? 'Huazhu says this stay has already started, so it cannot be cancelled.'
-                        : 'Huazhu says this booking cannot be cancelled.');
+                        cancelledAt: at,
+                        cancellationFee: fee,
+                        ...owed.row,
+                    }, owed.fields) ?? b;
+                    return publicBooking(done);
+                };
+                try {
+                    const out = await client.cancel(b.resId);
+                    const fee = typeof out.penaltyAmount === 'number'
+                        ? money(toMinor(out.penaltyAmount, out.penaltyCurrencyCode || cur), out.penaltyCurrencyCode || cur)
+                        : money(feeNow(b).fee, cur);
+                    cancelled(fee, new Date(now()).toISOString());
                 }
-                if (err instanceof HuazhuUnreachable) {
-                    throw new Error('Huazhu did not answer, so it is not known whether the booking was cancelled. Asking again is safe - cancelling twice does not charge twice.');
+                catch (err) {
+                    if (err instanceof HuazhuRefusal && err.code === 5402) {
+                        // Cancelled already - by this guest's own earlier try whose answer
+                        // was lost, most likely: owed as that cancellation was (audit P0-B).
+                        cancelled(b.cancellationFee ?? money(feeNow(b).fee, cur), b.cancelledAt ?? new Date(now()).toISOString());
+                    }
+                    else if (err instanceof HuazhuRefusal && (err.code === 5401 || err.code === 5405)) {
+                        throw new Error(err.code === 5405
+                            ? 'Huazhu says this stay has already started, so it cannot be cancelled.'
+                            : 'Huazhu says this booking cannot be cancelled.');
+                    }
+                    else if (err instanceof HuazhuUnreachable) {
+                        throw new Error('Huazhu did not answer, so it is not known whether the booking was cancelled. Asking again is safe - cancelling twice does not charge twice.');
+                    }
+                    else
+                        throw err;
                 }
-                throw err;
-            }
+                const after = store.get(b.id);
+                const refund = after?.prepaid?.refund;
+                if (refund && !refund.requestId)
+                    await refundOf(b.id, refund.reason);
+                return publicBooking(store.get(b.id) ?? after ?? b);
+            };
+            return first.prepaid ? inTurnFor(first.id, run) : run();
         },
         async policies() {
             // Huazhu publishes no policy text: each RATE carries its terms, and those