@curless/hotel-storefront 0.39.1 → 0.40.0

package/dist/huazhu/backend.js

@@ -8,14 +8,14 @@ import { BOOKING_LIMITS, DAY_MS, HOUR_MS, WindowCounter } from '../limits.js';
 import { formatMoney, minorFactor, money, multiplyMoney, toMinor } from '../money.js';
 import { UnionPayError, expiryMMyy, lastFour, } from '../payments/unionpay.js';
 import { MAX_ROOMS_PER_LINE, quoteLineKey } from '../trip.js';
-import { IN_REQUEST_AT_MS, StoreWriteError, nextCheckAt, statusOf, } from './bookings.js';
+import { IN_REQUEST_AT_MS, NOT_FOUND, StoreWriteError, nextCheckAt, statusOf, } from './bookings.js';
 import { describePolicy, feeFor, freeUntilOf, nightAuditOf, parseCancelPolicy, penaltyAt, refundableFrom, } from './cancel-policy.js';
 import { haystackOf, inPlace, namesOf, roomPhoto, toHotel } from './catalog.js';
 import { HuazhuRefusal, HuazhuUnreachable } from './client.js';
 import { bedNameEn, offerNameEn, rateNameEn, roomNameEn } from './english.js';
 import { rateLabels } from './labels.js';
 import { ariRanges, bookableNow, clockAt, goneWhy, hourlyWindow, inStayWindow, offeredAtAll, sell, } from './sellable.js';
-import { BOOK_EXISTS, BOOK_REFUSALS, CODES, } from './wire.js';
+import { BOOK_EXISTS, BOOK_REFUSALS, CODES, PAYMENT_FOR_GUARANTEE, } from './wire.js';
 export const HUAZHU_CAPABILITIES = {
     members: false,
     extras: false,
@@ -92,14 +92,16 @@ const WINDOW = {
     '1': 'Window',
     '2': 'Some rooms without a window',
     '3': 'No window',
-    '4': 'Window onto an inner courtyard',
+    // Huazhu's dictionary says 内景 - an inner view - and no more: no courtyard
+    // was ever said (2026-10-16 audit, P2).
+    '4': 'Inner-view window',
 };
 /** The same, as Huazhu's own dictionary says it - for a connector that speaks Chinese. */
 const WINDOW_ZH = {
     '1': '有窗',
     '2': '部分有窗',
     '3': '无窗',
-    '4': '内窗(朝天井)',
+    '4': '内景窗',
 };
 /** A rate's meal in Chinese, by its code; room only is 不含早. */
 const MEAL_ZH = {
@@ -686,12 +688,25 @@ export const createHuazhuHotels = (opts) => {
     /** Whether a hotel sells any room by the hour on its today - from its products, no prices. */
     const sellsByTheHourToday = async (hotelId) => (await productsOf(hotelId)).some((p) => p.checkinType === 'HOUR' && inStayWindow(p.stayWindow, today()));
     const ariCache = new Map();
+    /**
+     * A hotel Huazhu answered "too many requests" (2009) for, let be until then -
+     * a minute, doubling to ten while it goes on (2026-10-16 audit, P1-11: asked
+     * again at once, every guest's ask). Prices last read are used meanwhile; a
+     * booking's own fresh ask is not held back.
+     */
+    const ariBackoff = new Map();
     /** Every product's prices, rules and rooms left, one element per date from `start` to `end`. */
     const ariFor = async (hotelId, start, end, fresh = false) => {
         const key = `${hotelId}|${start}|${end}`;
         const hit = ariCache.get(key);
         if (!fresh && hit && now() - hit.at < ariTtl)
             return hit.value;
+        const held = ariBackoff.get(hotelId);
+        if (!fresh && held && now() < held.until) {
+            if (hit)
+                return hit.value;
+            throw new HuazhuRefusal(CODES.rateLimited, 'Too many requests', '', '/ari/daily/offers');
+        }
         const ranges = ariRanges(start, end);
         const parts = await Promise.all(ranges.map(async (r) => {
             const [offers, inventory] = await Promise.all([
@@ -713,7 +728,14 @@ export const createHuazhuHotels = (opts) => {
                 offers: offers.dailyOffers ?? [],
                 inventory: inventory.dailyInventories ?? [],
             };
-        }));
+        })).catch((err) => {
+            if (err instanceof HuazhuRefusal && err.code === CODES.rateLimited) {
+                const wait = Math.min((ariBackoff.get(hotelId)?.wait ?? 30_000) * 2, 10 * 60_000);
+                ariBackoff.set(hotelId, { until: now() + wait, wait });
+            }
+            throw err;
+        });
+        ariBackoff.delete(hotelId);
         const out = new Map();
         const keys = new Set(parts.flatMap((p) => p.offers.map((o) => roomIdOf(o))));
         for (const k of keys) {
@@ -1008,9 +1030,16 @@ export const createHuazhuHotels = (opts) => {
         const fails = priced.map((p) => p.res).filter((r) => !r.ok);
         if (fails.length > 0 && fails.every((f) => f.kind === 'party'))
             return partyNeedsOf(guests, largestOf(fails));
+        if (fails.some((f) => f.kind === 'partial-refund'))
+            return {
+                why: "This hotel's rooms by the hour are paid in advance on terms that keep part of the price if cancelled - and a stay paid in advance here goes back whole or not at all.",
+                code: 'partial-refund',
+            };
         if (fails.some((f) => f.kind === 'prepaid'))
             return {
-                why: "This hotel's rooms by the hour are paid in advance, and this connector books rates paid at the hotel.",
+                why: prepaidType
+                    ? "This hotel's rooms by the hour are sold only on payment terms this connector cannot take."
+                    : "This hotel's rooms by the hour are paid in advance, and this connector books rates paid at the hotel.",
                 code: 'prepaid-only',
             };
         const said = (re) => fails
@@ -1052,9 +1081,18 @@ export const createHuazhuHotels = (opts) => {
         // find a rate paid at the hotel. At Huazhu's test hotel (2026-10-15) 28
         // rates were prepaid and 4 sold out, and the guest was told only that
         // nothing could be booked (总线程).
+        // Paid in advance here, but on terms that keep part of the stay - true
+        // of a "one night's fee" rate over two nights or more (audit P1-9).
+        if (kinds.has('partial-refund') && !kinds.has('party') && !kinds.has('too-many-rooms'))
+            return {
+                why: `The rooms still open here for those nights are paid in advance on terms that keep part of the stay if cancelled - and a stay paid in advance here goes back whole or not at all, so they are not sold for ${nightsBetween(stay.checkIn, stay.checkOut)} nights. A shorter stay may be.`,
+                code: 'partial-refund',
+            };
         if (kinds.has('prepaid') && !kinds.has('party') && !kinds.has('too-many-rooms'))
             return {
-                why: 'Every room still open here for those nights is paid in advance, and this connector books rates paid at the hotel.',
+                why: prepaidType
+                    ? 'Every room still open here for those nights is sold only on payment terms this connector cannot take.'
+                    : 'Every room still open here for those nights is paid in advance, and this connector books rates paid at the hotel.',
                 code: 'prepaid-only',
             };
         if (only('sold-out'))
@@ -1327,6 +1365,16 @@ export const createHuazhuHotels = (opts) => {
                 }
                 : {}),
             ...(refund ? { refundReason: refund.reason } : {}),
+            ...(refund?.amountMinor !== undefined && refund.amountMinor < b.quote.total.minor
+                ? { refundAmount: money(refund.amountMinor, b.quote.total.currency) }
+                : {}),
+            // Opened and refused, or never opened after every try: a person sees to it (audit P1-1).
+            ...(refund &&
+                (refund.status === 'failed' ||
+                    refund.status === 'rejected' ||
+                    (!refund.requestId && (refund.tries ?? 0) >= 8))
+                ? { refundStuck: true }
+                : {}),
         };
     };
     const publicBooking = (b) => ({
@@ -1353,7 +1401,14 @@ export const createHuazhuHotels = (opts) => {
      * before 0.27 showed it as its code, and is opened by it only in the
      * conversation that made it.
      */
-    const codesOf = (b) => [b.confirmationCode !== b.resId ? b.confirmationCode : undefined, b.distributorResId]
+    /**
+     * What a booking answers to with its email - the code the guest was given.
+     * ⚠️ NOT `distributorResId` (2026-10-16 audit, P2): no guest is ever told
+     * it, and it rides on the payment's metadata and UnionPay's item - with the
+     * email beside it on the payment page, anyone who could see those could
+     * have opened and cancelled the booking.
+     */
+    const codesOf = (b) => [b.confirmationCode !== b.resId ? b.confirmationCode : undefined]
         .filter((x) => !!x)
         .map((x) => x.toLowerCase());
     const findOwn = (ref, who) => {
@@ -1540,13 +1595,16 @@ export const createHuazhuHotels = (opts) => {
         if (who.ip && requestsByIp.count(who.ip) >= limits.perIpPerHour) {
             throw new Error('Nothing was booked. Too many bookings have been asked for from this network in the last hour - try again later.');
         }
-        const madeToday = store
-            .all()
-            .filter((b) => now() - Date.parse(b.createdAt) < DAY_MS &&
+        const madeToday = store.all().filter((b) => now() - Date.parse(b.createdAt) < DAY_MS &&
             (b.status === 'confirmed' ||
                 b.status === 'requested' ||
                 b.status === 'unconfirmed' ||
-                b.status === 'cancelled')).length + slotsWhere(() => true);
+                b.status === 'cancelled' ||
+                // A stay paid in advance asked Huazhu (its prebook) before any
+                // payment - waiting for one, or lapsed without, it counts too
+                // (2026-10-16 audit, P2: unpaid asks were never counted).
+                b.status === 'awaiting-payment' ||
+                (b.status === 'expired' && !!b.prepaid))).length + slotsWhere(() => true);
         if (madeToday + lines.length > limits.perDeploymentPerDay) {
             // ⚠️ A CEILING HIT IS SOMETHING A PERSON SHOULD KNOW: either business
             // is booming or somebody is filling hotels with names. Logged, and on
@@ -1609,6 +1667,41 @@ export const createHuazhuHotels = (opts) => {
             await refundOf(id, why);
             return;
         }
+        // ⚠️ PREBOOKED AGAIN WHEN ITS TOKEN IS STALE (2026-10-16 audit, P2):
+        // Huazhu's token holds 10 minutes, and a page may be paid 30 minutes
+        // after the prebook. A price that moved, or no room left, is Huazhu's no
+        // to this stay - taken as one (all of it back). No answer: booked
+        // without a token - Huazhu checks the price at booking anyway.
+        if (p.prebookAt === undefined || now() - p.prebookAt >= PREBOOK_FRESH_MS) {
+            try {
+                const out = await client.prebook({
+                    hotelId: row.hotelId,
+                    checkinType: row.hourly ? 'HOUR' : 'DAY',
+                    paymentType: card ? 'CCPN' : row.paymentType,
+                    reservations: [
+                        {
+                            roomTypeCode: row.roomTypeCode,
+                            rateCode: row.rateCode,
+                            ...stayDatesOf(row),
+                            amountAfterTax: p.after,
+                            ...(p.before ? { amountBeforeTax: p.before } : {}),
+                            currencyCode: p.currency,
+                            roomCount: row.rooms,
+                            adultCount: row.stay.guests,
+                        },
+                    ],
+                });
+                patch(id, {}, { preBookToken: out?.preBookToken, prebookAt: now() });
+            }
+            catch (err) {
+                if (err instanceof HuazhuRefusal) {
+                    await turnedDown(id, err, !!card);
+                    return;
+                }
+                patch(id, {}, { preBookToken: undefined });
+            }
+        }
+        const token = store.get(id)?.prepaid?.preBookToken;
         const comment = commentOf(row.requests, row.guest.notes);
         const request = {
             hotelId: row.hotelId,
@@ -1645,16 +1738,37 @@ export const createHuazhuHotels = (opts) => {
                 },
             ],
             ...(comment ? { guestComment: comment } : {}),
-            ...(p.preBookToken ? { preBookToken: p.preBookToken } : {}),
+            ...(token ? { preBookToken: token } : {}),
         };
         // ⚠️ SET BEFORE THE CALL, as every booking is: a process that dies in it
-        // leaves a row the reconciler follows up.
-        store.update(id, { status: 'requested', pendingSince: now() });
+        // leaves a row the reconciler follows up. ⚠️ WRITTEN, OR NOT SENT
+        // (2026-10-05 audit P1-8, kept on this path - 2026-10-16 audit P2): a
+        // booking whose call is not written down could not be followed up. Left
+        // waiting, paid; the next pass tries again.
+        const current = store.get(id);
+        if (!current)
+            return;
+        try {
+            store.put({ ...current, status: 'requested', pendingSince: now() });
+        }
+        catch (err) {
+            if (!(err instanceof StoreWriteError))
+                throw err;
+            raise(id, `the booking could not be written down before it was sent to Huazhu, so it was not sent (${err.message}) - it is tried again on the next pass`);
+            return;
+        }
         let refusal;
         let answer;
         for (let attempt = 0; attempt < 2; attempt += 1) {
             try {
-                const got = await client.book(request);
+                reconciler.inFlight(id, true);
+                let got;
+                try {
+                    got = await client.book(request);
+                }
+                finally {
+                    reconciler.inFlight(id, false);
+                }
                 if (got && typeof got.resId === 'string' && got.resId)
                     answer = got;
             }
@@ -1680,21 +1794,24 @@ export const createHuazhuHotels = (opts) => {
             });
             return;
         }
-        if (refusal && card) {
-            // Paid with UnionPay: the hotel charges the card, and a booking it did
-            // not make it never charged - there is nothing here to give back.
-            patch(id, { status: 'failed', pendingSince: undefined }, {
-                declined: `Huazhu did not take the booking: ${refusal.huazhuMessage} (${refusal.code})`.replace(/\d{12,19}/g, '****'),
-            });
+        if (refusal)
+            await turnedDown(id, refusal, !!card);
+        // No answer: the reconciler's eight minutes decide it.
+    };
+    /**
+     * Huazhu's no to a stay paid for, at its prebook or its booking. Paid with
+     * UnionPay, the hotel charges the card, and a booking it did not make it
+     * never charged - nothing here to give back. Paid on the card page (a price
+     * that moved since the prebook is one of these, 5209), all of it back.
+     */
+    const turnedDown = async (id, refusal, card) => {
+        const said = `Huazhu did not take the booking: ${refusal.huazhuMessage} (${refusal.code})`;
+        if (card) {
+            patch(id, { status: 'failed', pendingSince: undefined }, { declined: said.replace(/\d(?:[ -]?\d){11,18}/g, '****') });
             return;
         }
-        if (refusal) {
-            store.update(id, { status: 'failed', pendingSince: undefined });
-            // A price that moved since the prebook is one of these (5209): the
-            // guest paid for a price Huazhu no longer gives, and gets it all back.
-            await refundOf(id, `Huazhu did not take the booking: ${refusal.huazhuMessage} (${refusal.code})`);
-        }
-        // No answer: the reconciler's eight minutes decide it.
+        store.update(id, { status: 'failed', pendingSince: undefined });
+        await refundOf(id, said);
     };
     /**
      * Gives a guest's money back, in full - the only refund the gateway makes.
@@ -1708,19 +1825,38 @@ export const createHuazhuHotels = (opts) => {
             return;
         const tries = (p.refund?.tries ?? 0) + 1;
         const at = p.refund?.at ?? now();
+        // Said once: a retry sends what the first try sent, word for word - Stripe
+        // refuses the same key with anything else, every time after (2026-10-16
+        // audit, P2).
+        const why = p.refund?.reason ?? reason;
         try {
             // Named by when it was decided: the same refund retried is the same refund.
-            const r = await checkout.refund(p.sessionId, reason, `${row.distributorResId}-${at}`);
-            patch(id, {}, { refund: { reason, at, requestId: r.requestId, status: r.status, tries } });
-            console.error(`[huazhu prepaid ${id}] refund ${r.requestId} (${r.status}) of session ${p.sessionId}: ${reason}`);
+            const r = await checkout.refund(p.sessionId, why, `${row.distributorResId}-${at}`, p.refund?.amountMinor);
+            patch(id, {}, {
+                refund: {
+                    reason: why,
+                    at,
+                    requestId: r.requestId,
+                    status: r.status,
+                    tries,
+                    triedAt: now(),
+                    ...(p.refund?.amountMinor !== undefined ? { amountMinor: p.refund.amountMinor } : {}),
+                },
+            });
+            console.error(`[huazhu prepaid ${id}] refund ${r.requestId} (${r.status}) of session ${p.sessionId}: ${why}`);
         }
         catch (err) {
-            patch(id, {}, { refund: { reason, at, tries } });
-            if (tries >= 8 && !row.attention) {
-                const why = `the guest paid (gateway session ${p.sessionId}) and the refund could not be opened: ${err.message}`;
-                store.update(id, { attention: why, attentionAt: new Date(now()).toISOString() });
-                console.error(`[huazhu prepaid ${id}] ⚠️ NEEDS A PERSON: ${why}`);
-            }
+            patch(id, {}, {
+                refund: {
+                    reason: why,
+                    at,
+                    tries,
+                    triedAt: now(),
+                    ...(p.refund?.amountMinor !== undefined ? { amountMinor: p.refund.amountMinor } : {}),
+                },
+            });
+            if (tries >= 8)
+                raise(id, `the guest paid (gateway session ${p.sessionId}) and the refund could not be opened`);
         }
     };
     /**
@@ -1754,18 +1890,66 @@ export const createHuazhuHotels = (opts) => {
             };
         if (byGuest && feeMinor >= b.quote.total.minor)
             return { row: {}, fields: { kept: { feeMinor, at: now() } } };
+        // A part kept by the hotel, cancelled by the guest here: the rest back
+        // (2026-10-16 audit, P2 - a fee above nothing gave back nothing).
+        if (byGuest)
+            return {
+                row: {},
+                fields: {
+                    refund: {
+                        reason: `cancelled with a fee of ${formatMoney(money(feeMinor, b.quote.total.currency))} kept by the hotel - the rest back`,
+                        at: now(),
+                        tries: 0,
+                        amountMinor: b.quote.total.minor - feeMinor,
+                    },
+                },
+            };
         const fee = formatMoney(money(feeMinor, b.quote.total.currency));
         const why = byGuest
             ? `cancelled with a fee of ${fee} of the ${formatMoney(b.quote.total)} paid (gateway session ${p.sessionId}): the difference is owed back, and a part refund is not made here`
             : `Huazhu shows ${b.distributorResId} cancelled - not by the guest here - after its free period (a fee of ${fee} by its terms) with ${formatMoney(b.quote.total)} paid (gateway session ${p.sessionId}): whether the guest is owed it back is to be judged with Huazhu`;
         console.error(`[huazhu prepaid ${b.id}] ⚠️ NEEDS A PERSON: ${why}`);
-        return { row: { attention: why, attentionAt: new Date(now()).toISOString() }, fields: {} };
+        return {
+            row: {
+                attention: why,
+                attentionAt: new Date(now()).toISOString(),
+                resolvedAt: undefined,
+                resolution: undefined,
+            },
+            fields: {},
+        };
+    };
+    /**
+     * The one-time card a lapsed or cancelled UnionPay stay will never use,
+     * thrown away at the gateway - now if it is there, refused when it comes
+     * (网关 a974cc2a; 2026-10-16 audit, P1-6 and P2). "Handed over already"
+     * means a step here took it: a person checks with Huazhu.
+     */
+    const discardCard = async (id) => {
+        const row = store.get(id);
+        const sid = row?.prepaid?.method === 'unionpay' ? row.prepaid.sessionId : undefined;
+        if (!sid || !unionpay)
+            return;
+        try {
+            if ((await unionpay.discard(sid)) === 'released')
+                raise(id, `UnionPay's one-time card for gateway payment ${sid} was handed over here, yet the stay lapsed or was cancelled before it was booked: check with Huazhu whether ${row?.distributorResId} exists, and cancel it if it does`);
+        }
+        catch (err) {
+            console.error(`[huazhu prepaid ${id}] the gateway could not be told to throw away UnionPay's card for ${sid}: ${err.message}`);
+        }
     };
     /**
      * A confirmation that lands a little after `payBy` was made in time - the
      * callback is seconds behind the guest. Later than this, it is never used.
      */
     const ISSUED_GRACE_MS = 5 * 60_000;
+    /** Huazhu's prebook token holds 10 minutes (v1.17): a paid stay older than this is prebooked again. */
+    const PREBOOK_FRESH_MS = 9 * 60_000;
+    /** Passes in a row without word from a card payment page, past its time, before a person is told. */
+    const UNANSWERED_PASSES = 30;
+    /** A paid booking nobody could confirm: Huazhu asked again this often, for this long (audit P1-2). */
+    const HELD_CHECK_MS = 30 * 60_000;
+    const HELD_LIMIT_MS = DAY_MS;
     /**
      * One step for a booking paid with UnionPay: confirmed on UnionPay's page →
      * the one-time card, once, straight into a CCPN booking with Huazhu;
@@ -1776,10 +1960,13 @@ export const createHuazhuHotels = (opts) => {
         const p = row.prepaid;
         if (row.status !== 'awaiting-payment' || !unionpay)
             return;
-        const lapse = () => patch(row.id, { status: 'expired' }, { lapsedAt: now(), url: undefined });
+        const lapse = async () => {
+            patch(row.id, { status: 'expired' }, { lapsedAt: now(), url: undefined });
+            await discardCard(row.id);
+        };
         if (!p.sessionId) {
             if (now() >= p.payBy)
-                lapse();
+                await lapse();
             return;
         }
         let state;
@@ -1787,7 +1974,11 @@ export const createHuazhuHotels = (opts) => {
             state = await unionpay.state(p.sessionId);
         }
         catch {
-            return; // asked again on the next pass
+            // Asked again on the next pass - until past its time and its grace: a
+            // card never taken is never charged, so it simply lapses (audit P1-4).
+            if (now() >= p.payBy + ISSUED_GRACE_MS)
+                await lapse();
+            return;
         }
         if (state === 'issued' && now() < p.payBy + ISSUED_GRACE_MS) {
             // ⚠️ ONCE: the gateway hands the card over a single time, then forgets it.
@@ -1825,7 +2016,7 @@ export const createHuazhuHotels = (opts) => {
         // Unconfirmed in time: lapsed. A confirmation after this is never handed
         // on, so nothing is ever charged for it.
         if (state === 'closed' || now() >= p.payBy)
-            lapse();
+            await lapse();
     };
     /**
      * ⚠️ ONE STEP AT A TIME ON A BOOKING - every step that moves a payment on:
@@ -1865,6 +2056,27 @@ export const createHuazhuHotels = (opts) => {
             throw new Error('A payment on this booking is being settled right now. Ask again in a moment.');
         return (await ifFree(id, fn));
     };
+    /**
+     * ⚠️ A PERSON ASKED - EVERY TIME THERE IS SOMETHING NEW (2026-10-16 audit,
+     * P1-1): an earlier ask, even one already seen to, kept a refund that later
+     * failed from being asked about at all. The same thing still open is not
+     * asked twice; a new one opens the ask again.
+     */
+    const raise = (id, why) => {
+        const cur = store.get(id);
+        if (!cur)
+            return;
+        const open = !!cur.attention && !cur.resolvedAt;
+        if (open && cur.attention?.includes(why))
+            return;
+        store.update(id, {
+            attention: open ? `${cur.attention} | ${why}` : why,
+            attentionAt: new Date(now()).toISOString(),
+            resolvedAt: undefined,
+            resolution: undefined,
+        });
+        console.error(`[huazhu prepaid ${id}] ⚠️ NEEDS A PERSON: ${why}`);
+    };
     /**
      * Writes a booking as it is NOW, with `row` and the prepaid `fields` on top -
      * never a whole record read before an await (audit P0-A: each of two steps
@@ -1927,8 +2139,17 @@ export const createHuazhuHotels = (opts) => {
                     state = await checkout.close(p.sessionId);
             }
             catch {
-                return; // asked again on the next pass
+                // Asked again on the next pass - but a page that cannot be asked
+                // about long past its time is a person's to look at: it may have been
+                // paid (2026-10-16 audit, P1-4).
+                const misses = (p.unanswered ?? 0) + 1;
+                patch(row.id, {}, { unanswered: misses });
+                if (misses >= UNANSWERED_PASSES && now() >= p.payBy)
+                    raise(row.id, `payment page ${p.sessionId} could not be asked where it stands, past its time: whether it was paid is not known - look it up with the payment provider`);
+                return;
             }
+            if (p.unanswered)
+                patch(row.id, {}, { unanswered: undefined });
             if (state === 'paid') {
                 // ⚠️ THE MONEY HELD TO THE QUOTE BEFORE ANYTHING IS BOOKED (总线程,
                 // 2026-10-15): what the page took, to the fen and in the currency,
@@ -1985,6 +2206,42 @@ export const createHuazhuHotels = (opts) => {
                 await refundOf(row.id, owed.fields.refund.reason);
             return;
         }
+        // ⚠️ NOBODY COULD CONFIRM IT: THE MONEY IS HELD, NOT GIVEN BACK (2026-10-16
+        // audit, P1-2). Refunded at once, a booking that did exist at Huazhu was
+        // kept unpaid - and past its free period, cost the whole stay to cancel.
+        // Huazhu is asked again every half hour: "none" refunds it all, "here it
+        // is" keeps it; a day without an answer is a person's.
+        if (row.status === 'unconfirmed' && !p.refund) {
+            const since = p.heldSince ?? now();
+            if (p.heldSince === undefined)
+                patch(row.id, {}, { heldSince: since });
+            if (p.checkedAt !== undefined && now() - p.checkedAt < HELD_CHECK_MS)
+                return;
+            patch(row.id, {}, { checkedAt: now() });
+            let found;
+            try {
+                found = await client.consistency(row.distributorResId);
+            }
+            catch (err) {
+                if (err instanceof HuazhuRefusal && err.code === NOT_FOUND) {
+                    const reason = 'Huazhu says it never booked the stay';
+                    patch(row.id, { status: 'failed', hotelStatus: 'HOTEL_FAILED' }, { refund: { reason, at: now(), tries: 0 } });
+                    store.resolve(row.id, `${reason}: refunded in full`);
+                    await refundOf(row.id, reason);
+                    return;
+                }
+                if (now() - since >= HELD_LIMIT_MS)
+                    raise(row.id, `nobody has been able to confirm ${row.distributorResId} with Huazhu for 24 hours and the guest's money is held: decide with Huazhu whether to keep it or refund it`);
+                return;
+            }
+            if (found?.resId && found.status) {
+                const status = statusOf(found.status);
+                patch(row.id, { status, resId: found.resId, hotelStatus: found.status });
+                if (status === 'confirmed')
+                    store.resolve(row.id, 'Huazhu has the booking: kept, and paid');
+            }
+            return;
+        }
         // ⚠️ HUAZHU'S ORDER NUMBER ON THE PAYMENT, ONCE (总线程, 2026-10-15), so
         // Stripe's dashboard and Huazhu's order are one look apart. Tried once:
         // a failure is said in the log and never touches the booking.
@@ -2001,12 +2258,14 @@ export const createHuazhuHotels = (opts) => {
             }
             return;
         }
-        if (!p.refund?.requestId &&
-            (p.refund || row.status === 'failed' || row.status === 'unconfirmed')) {
-            await refundOf(row.id, p.refund?.reason ??
-                (row.status === 'failed'
-                    ? 'Huazhu did not take the booking'
-                    : 'nobody could confirm the booking with Huazhu - if it turns up there, a person cancels it'));
+        if (!p.refund?.requestId && (p.refund || row.status === 'failed')) {
+            // Not opened after three tries: tried further apart - a minute,
+            // doubling to an hour - not every ten seconds for good (audit P2).
+            const tries = p.refund?.tries ?? 0;
+            const wait = tries < 3 ? 0 : Math.min(60_000 * 2 ** (tries - 3), 3_600_000);
+            if (p.refund?.triedAt !== undefined && now() < p.refund.triedAt + wait)
+                return;
+            await refundOf(row.id, p.refund?.reason ?? 'Huazhu did not take the booking');
             return;
         }
         const refund = p.refund;
@@ -2016,11 +2275,8 @@ export const createHuazhuHotels = (opts) => {
                 const latest = store.get(row.id)?.prepaid?.refund;
                 if (latest && status !== latest.status)
                     patch(row.id, {}, { refund: { ...latest, status } });
-                if ((status === 'failed' || status === 'rejected') && !row.attention) {
-                    const why = `refund ${refund.requestId} of gateway session ${p.sessionId} came back ${status}: the guest's money is not back`;
-                    store.update(row.id, { attention: why, attentionAt: new Date(now()).toISOString() });
-                    console.error(`[huazhu prepaid ${row.id}] ⚠️ NEEDS A PERSON: ${why}`);
-                }
+                if (status === 'failed' || status === 'rejected')
+                    raise(row.id, `refund ${refund.requestId} of gateway session ${p.sessionId} came back ${status}: the guest's money is not back`);
             }
             catch {
                 // asked again on the next pass
@@ -2154,7 +2410,7 @@ export const createHuazhuHotels = (opts) => {
             const record = {
                 method: checkout.method,
                 payBy: now() + payWithin,
-                ...(plan.token ? { preBookToken: plan.token } : {}),
+                ...(plan.token ? { preBookToken: plan.token, prebookAt: now() } : {}),
                 after: s.after,
                 ...(s.before ? { before: s.before } : {}),
                 ...(s.rack ? { rack: s.rack } : {}),
@@ -2211,6 +2467,8 @@ export const createHuazhuHotels = (opts) => {
                     amountMinor: allIn,
                     currency: cur,
                     email: guest.email,
+                    // A minute past the booking's own deadline - ours closes it first.
+                    expiresAt: record.payBy + 60_000,
                 });
             }
             catch (err) {
@@ -2347,7 +2605,14 @@ export const createHuazhuHotels = (opts) => {
                 let answer;
                 for (let attempt = 0; attempt < 2; attempt += 1) {
                     try {
-                        const got = await client.book(request);
+                        reconciler.inFlight(id, true);
+                        let got;
+                        try {
+                            got = await client.book(request);
+                        }
+                        finally {
+                            reconciler.inFlight(id, false);
+                        }
                         if (got && typeof got.resId === 'string' && got.resId)
                             answer = got;
                     }
@@ -2432,6 +2697,10 @@ export const createHuazhuHotels = (opts) => {
         const no = notWaiting(first);
         if (no)
             return no;
+        // Huazhu books this rate paid by card (CCPN) or not at all - its
+        // guarantee says which (2026-10-16 audit, P1-8).
+        if (!(PAYMENT_FOR_GUARANTEE[first.guaranteeCode] ?? []).includes('CCPN'))
+            return refused(`Huazhu does not take ${first.confirmationCode}'s rate paid by card, so it cannot be paid with UnionPay. Nothing changed - the card page still takes the payment.`, 'hotel-refused');
         // ⚠️ COUNTED BEFORE ANYTHING REACHES THE GATEWAY (audit P0-E).
         const keys = [
             [`b:${first.id}`, UNIONPAY_ASKS.booking],
@@ -2465,6 +2734,10 @@ export const createHuazhuHotels = (opts) => {
                 return { kind: 'enroll', url };
             }
             catch (err) {
+                // The gateway's own limit: three binding pages a guest an hour (网关
+                // a974cc2a). Said as "later" - never a failure, never asked again now.
+                if (err instanceof UnionPayError && err.status === 429)
+                    return refused("UnionPay's page for adding a card was asked for too often for this guest this hour. Nothing changed - the card page still takes the payment, or try UnionPay again later.", 'too-many-tries');
                 return refused(`UnionPay's page for adding a card could not be opened (${err.message}). Nothing changed - ask again.`, 'unreachable');
             }
         }
@@ -2476,21 +2749,6 @@ export const createHuazhuHotels = (opts) => {
             const p = row.prepaid;
             if (p.method === 'unionpay' && p.url)
                 return { kind: 'confirm', url: p.url, booking: publicBooking(row) };
-            // The card page first: closed, it cannot be paid after this.
-            if (p.method !== 'unionpay' && p.sessionId) {
-                let state;
-                try {
-                    state = await checkout.close(p.sessionId);
-                }
-                catch (err) {
-                    return refused(`The card page could not be closed (${err.message}). Nothing changed - ask again.`, 'unreachable');
-                }
-                if (state === 'paid') {
-                    await settlePrepaid(row);
-                    return { kind: 'paid-on-card', booking: publicBooking(store.get(row.id) ?? row) };
-                }
-                patch(row.id, {}, { sessionId: undefined, url: undefined });
-            }
             const title = row.quote.lines[0]?.title ?? row.hotelName;
             // Prebooked again the way it will be booked: Huazhu's token holds only
             // for the same request (wire.ts).
@@ -2515,13 +2773,48 @@ export const createHuazhuHotels = (opts) => {
                 }))?.preBookToken;
             }
             catch (err) {
+                // ⚠️ NOTHING CHANGES ON A NO (audit P1-8): asked before the card page
+                // is closed, so the card page still takes the payment.
                 if (err instanceof HuazhuRefusal) {
-                    patch(row.id, { status: 'expired' }, { sessionId: undefined, url: undefined, lapsedAt: now() });
                     const said = refusalCode(err, row.rooms).code;
-                    return refused(`Nothing was booked or charged: ${refusalWords(err, `${row.hotelName} - ${title}`, p.currency)}`, said === 'price-changed' || said === 'sold-out' ? said : 'hotel-refused');
+                    // A price that moved, or no room left: neither way books it at what
+                    // the guest was shown - the card page is closed too, and the stay
+                    // lapses (paid on it meanwhile, it goes on as that payment).
+                    if (said === 'price-changed' || said === 'sold-out') {
+                        if (p.sessionId) {
+                            const page = await checkout.close(p.sessionId).catch(() => undefined);
+                            if (page === 'paid') {
+                                await settlePrepaid(row);
+                                return { kind: 'paid-on-card', booking: publicBooking(store.get(row.id) ?? row) };
+                            }
+                        }
+                        patch(row.id, { status: 'expired' }, { sessionId: undefined, url: undefined, lapsedAt: now() });
+                        return refused(`Nothing was booked or charged: ${refusalWords(err, `${row.hotelName} - ${title}`, p.currency)}`, said);
+                    }
+                    // Anything else - Huazhu not taking this rate paid by card, say -
+                    // changes nothing: the card page still takes the payment.
+                    return refused(said === 'prepaid-only'
+                        ? 'Huazhu does not take this rate paid by card, so it cannot be paid with UnionPay. Nothing changed - the card page still takes the payment.'
+                        : `Huazhu did not take it paid by card: ${refusalWords(err, `${row.hotelName} - ${title}`, p.currency)} Nothing changed - the card page still takes the payment.`, 'hotel-refused');
                 }
                 return refused(`Huazhu could not be reached to check the stay (${err.message}). Nothing was charged - ask again.`, 'unreachable');
             }
+            // Huazhu said yes: now the card page is closed, so it cannot be paid
+            // after this.
+            if (p.method !== 'unionpay' && p.sessionId) {
+                let state;
+                try {
+                    state = await checkout.close(p.sessionId);
+                }
+                catch (err) {
+                    return refused(`The card page could not be closed (${err.message}). Nothing changed - ask again.`, 'unreachable');
+                }
+                if (state === 'paid') {
+                    await settlePrepaid(row);
+                    return { kind: 'paid-on-card', booking: publicBooking(store.get(row.id) ?? row) };
+                }
+                patch(row.id, {}, { sessionId: undefined, url: undefined });
+            }
             const names = hotelNamesOf(row.hotelId);
             const nights = row.quote.lines[0]?.nights ?? 1;
             let opened;
@@ -2546,7 +2839,7 @@ export const createHuazhuHotels = (opts) => {
                 method: 'unionpay',
                 sessionId: opened.sessionId,
                 url: opened.url,
-                ...(token ? { preBookToken: token } : {}),
+                ...(token ? { preBookToken: token, prebookAt: now() } : {}),
                 payBy: now() + payWithin,
             }) ?? row;
             return { kind: 'confirm', url: opened.url, booking: publicBooking(updated) };
@@ -2569,14 +2862,27 @@ export const createHuazhuHotels = (opts) => {
                         : 'not-paid'
                     : row.status === 'expired'
                         ? 'not-paid'
-                        : p?.paidAt && (p.refund || row.status === 'failed' || row.status === 'unconfirmed')
-                            ? 'refunded'
-                            : row.status === 'failed' && !p?.paidAt
-                                ? 'not-paid'
-                                : 'unknown';
+                        : row.status === 'unconfirmed' && p?.paidAt && !p.refund
+                            ? // Held while Huazhu is asked (audit P1-2): paid, the hotel still being asked.
+                                'booking'
+                            : p?.paidAt && (p.refund || row.status === 'failed')
+                                ? 'refunded'
+                                : row.status === 'failed' && !p?.paidAt
+                                    ? 'not-paid'
+                                    : 'unknown';
         const names = hotelNamesOf(row.hotelId);
+        // Owed back, but not sent - a person is seeing to it: never said as "on its way" (audit P1-1).
+        const stuck = !!p?.refund &&
+            (p.refund.status === 'failed' ||
+                p.refund.status === 'rejected' ||
+                (!p.refund.requestId && (p.refund.tries ?? 0) >= 8));
+        const part = p?.refund?.amountMinor;
         return {
             state,
+            ...(state === 'refunded' && stuck ? { refundStuck: true } : {}),
+            ...(state === 'refunded' && part !== undefined && part < row.quote.total.minor
+                ? { refundAmount: money(part, row.quote.total.currency) }
+                : {}),
             code: row.confirmationCode,
             hotelName: row.hotelName,
             ...(names ? { hotelNames: names } : {}),
@@ -2630,8 +2936,9 @@ export const createHuazhuHotels = (opts) => {
             const page = await checkout.state(row.prepaid.sessionId).catch(() => undefined);
             if (page === 'paid')
                 return { ...told, state: 'booking' };
+            // Cannot be read just now: the page looks again (香格里拉's `checking`).
             if (page === undefined)
-                return { ...told, state: 'unknown' };
+                return { ...told, state: 'checking' };
         }
         return told;
     };
@@ -3416,7 +3723,9 @@ export const createHuazhuHotels = (opts) => {
                         ? await unionpay.state(b.prepaid.sessionId).catch(() => undefined)
                         : 'closed';
                     if (state !== 'issued' && state !== undefined) {
-                        return publicBooking(patch(b.id, { status: 'expired' }, { lapsedAt: now(), url: undefined }) ?? b);
+                        const lapsed = patch(b.id, { status: 'expired' }, { lapsedAt: now(), url: undefined }) ?? b;
+                        await discardCard(b.id);
+                        return publicBooking(store.get(b.id) ?? lapsed);
                     }
                     throw new Error(state === 'issued'
                         ? 'The guest has just confirmed on UnionPay, so the stay is being booked with Huazhu now. Ask again in a moment to cancel it.'