@curless/hotel-storefront 0.43.1 → 0.44.0

package/dist/huazhu/backend.js

@@ -4,14 +4,14 @@ import { addDays, arrivalInstant, atHotelTime, nights as nightsBetween, stayProb
 import { byWords, splitByStay } from '../demo-hotels.js';
 import { FACILITIES, hasFacility } from '../facilities.js';
 import { endOf, startProblem } from '../hourly.js';
-import { BOOKING_LIMITS, DAY_MS, HOUR_MS, WindowCounter } from '../limits.js';
+import { BOOKING_LIMITS, DAY_MS, HOUR_MS, UNPAID_PER_STRICT, WindowCounter, } from '../limits.js';
 import { formatMoney, minorFactor, money, multiplyMoney, toMinor } from '../money.js';
 import { UnionPayError, expiryMMyy, lastFour, } from '../payments/unionpay.js';
 import { MAX_ROOMS_PER_LINE, quoteLineKey } from '../trip.js';
 import { IN_REQUEST_AT_MS, NOT_FOUND, StoreWriteError, nextCheckAt, statusOf, } from './bookings.js';
-import { describePolicy, feeFor, freeUntilOf, nightAuditOf, parseCancelPolicy, penaltyAt, refundableFrom, stepsOf, } from './cancel-policy.js';
+import { describePolicy, feeFor, freeUntilOf, nightAuditOf, parseCancelPolicy, penaltyAt, phasesOf, refundableFrom, stepsOf, } from './cancel-policy.js';
 import { haystackOf, inPlace, namesOf, roomPhoto, toHotel } from './catalog.js';
-import { HuazhuRefusal, HuazhuUnreachable } from './client.js';
+import { HuazhuRefusal, HuazhuTooBusy, HuazhuUnreachable } from './client.js';
 import { bedNameEn, offerNameEn, rateNameEn, roomNameEn } from './english.js';
 import { rateLabels } from './labels.js';
 import { ariRanges, bookableNow, clockAt, goneWhy, hourlyWindow, inStayWindow, offeredAtAll, sell, } from './sellable.js';
@@ -191,6 +191,8 @@ const localIsoAt = (instant, tz) => {
         .map((x) => [x.type, x.value]));
     return `${p.year}-${p.month}-${p.day}T${p.hour}:${p.minute}`;
 };
+/** A stay paid for - on the card page, or confirmed on UnionPay (whose one-time card Huazhu then charges). */
+const paidInAdvance = (p) => p.method === 'unionpay' ? p.issuedAt !== undefined : p.paidAt !== undefined;
 const pool = async (items, n, fn) => {
     const out = new Array(items.length);
     let next = 0;
@@ -470,6 +472,19 @@ whole = true) => {
         said.push(`The total is now ${formatMoney(q.total)}, not the ${formatMoney(money(total, q.total.currency))} shown.`);
     return said.length ? said.join(' ') : undefined;
 };
+/** A read of a booking's detail is good for this long. */
+const DETAIL_FRESH_MS = 60_000;
+/** A read that failed is not tried again for this long - longer than a good one is kept. */
+const DETAIL_RETRY_MS = 2 * 60_000;
+/** The background watch tries a booking again this soon after a read of it failed (never later than its usual interval). */
+const WATCH_RETRY_MS = 30 * 60_000;
+/**
+ * The WHOLE background watch rests this long after a read it made failed
+ * (2026-10-21, 总线程): with Huazhu not answering, each 10-second pass tried
+ * one more stay and the hour's calls went on failures within minutes. A
+ * guest's own lookup is not held by it - it has its own cooldown a booking.
+ */
+const WATCH_PAUSE_MS = 5 * 60_000;
 export const createHuazhuHotels = (opts) => {
     const { client, catalog, store, reconciler } = opts;
     // ⚠️ NO MONEY TAKEN FOR A REAL HUAZHU YET: who takes it, the licence, a
@@ -512,6 +527,10 @@ export const createHuazhuHotels = (opts) => {
     const rateNameOf = (p) => (en ? rateNameEn(p.rateCodeName) : undefined) ?? p.rateCodeName ?? p.rateCode;
     const today = () => todayAt(now(), opts.tz);
     const limits = { ...BOOKING_LIMITS, ...(opts.limits ?? {}) };
+    /** The looser ceiling on unpaid requests to pay in advance - a multiple of the strict one unless set (T2-14). */
+    const unpaidPerDay = opts.limits?.unpaidPerDay ?? limits.perDeploymentPerDay * UNPAID_PER_STRICT;
+    /** When the unpaid ceiling was last said in the log: the strict one's time is the store's. */
+    let unpaidCeilingSaidAt;
     const requestsByEmail = new WindowCounter(DAY_MS, now);
     const requestsByIp = new WindowCounter(HOUR_MS, now);
     const requestsByConversation = new WindowCounter(HOUR_MS, now);
@@ -534,6 +553,15 @@ export const createHuazhuHotels = (opts) => {
      */
     const slots = new Set();
     const slotsWhere = (pred) => [...slots].filter(pred).reduce((a, x) => a + x.n, 0);
+    /**
+     * A request to pay in advance that has not been paid: waiting for its
+     * payment, or lapsed without (2026-10-21 re-audit, T2-14). It costs a
+     * prebook at Huazhu and a payment page at Stripe, and is counted against its
+     * own, looser daily ceiling - not the strict one that stops all booking.
+     */
+    const unpaidAsk = (b) => !!b.prepaid &&
+        !paidInAdvance(b.prepaid) &&
+        (b.status === 'awaiting-payment' || b.status === 'expired');
     /** Requests in flight, by conversation and by email - see `single`. */
     const flights = new Map();
     /** Set by `drain`: a stopping process starts no booking. */
@@ -1436,38 +1464,94 @@ export const createHuazhuHotels = (opts) => {
         return there;
     };
     /**
-     * Huazhu's own word on a booking, at most once a minute each.
+     * ⚠️ HUAZHU DOWN, OR SAYING "TOO MANY REQUESTS" (2009), IS NOT TO BE ASKED
+     * AGAIN AT ONCE (2026-10-21 re-audit, T2-4 / T2-5; the way `ariBackoff` does
+     * it for prices). One 2009 holds EVERY detail ask - a guest's and the
+     * background watch's - for a minute, doubling to ten while it goes on. What
+     * was last known stands meanwhile, and says so by its age.
+     */
+    let detailBackoff;
+    const detailHeld = () => detailBackoff !== undefined && now() < detailBackoff.until;
+    /** One ask a booking at a time: a second look at a booking being read waits for that read. */
+    const detailFlights = new Map();
+    /** Whether the last attempt on a booking was a failure, newer than any success. */
+    const failedLast = (b) => b.refreshFailedAt !== undefined &&
+        (b.refreshedAt === undefined || b.refreshFailedAt > b.refreshedAt);
+    /** Asked about so lately that asking again is no use: a success for a minute, a failure for two. */
+    const lookedAtLately = (b) => failedLast(b)
+        ? now() - b.refreshFailedAt < DETAIL_RETRY_MS
+        : b.refreshedAt !== undefined && now() - b.refreshedAt < DETAIL_FRESH_MS;
+    /** The one call to Huazhu for a booking, and what it is written down as. */
+    const askDetail = async (b) => {
+        // The booking as it is when the read BEGINS (2026-10-21 re-audit, T2-3):
+        // the row is live, so what it says afterwards is not what it said before.
+        const seen = b.status;
+        let d;
+        try {
+            d = await client.detail(b.resId);
+        }
+        catch (err) {
+            if (err instanceof HuazhuRefusal && err.code === CODES.rateLimited) {
+                const wait = Math.min((detailBackoff?.wait ?? 30_000) * 2, 10 * 60_000);
+                detailBackoff = { until: now() + wait, wait };
+            }
+            // Unreachable or refused: what we last knew stands, and says so by its
+            // age. The attempt is written down so it is not made again at once.
+            return { booking: store.update(b.id, { refreshFailedAt: now() }) ?? b, outcome: 'failed' };
+        }
+        detailBackoff = undefined;
+        // ⚠️ AN ANSWER OLDER THAN THE BOOKING IS NOT WRITTEN (2026-10-21 re-audit,
+        // T2-3, R3): a guest's cancellation completing while this was in flight
+        // was written back as "confirmed", the payment refunding, for a minute.
+        // The booking is read again here, after the wait, and changed only if its
+        // status is what it was when this read began.
+        const cur = store.get(b.id);
+        if (!cur || cur.status !== seen)
+            return { booking: cur ?? b, outcome: 'overtaken' };
+        const status = statusOf(d.status);
+        const line = d.reservations?.[0];
+        const row = store.update(b.id, {
+            hotelStatus: d.status,
+            status,
+            refreshedAt: now(),
+            ...(line?.cancelPolicyCode ? { cancelCode: line.cancelPolicyCode } : {}),
+            ...(status === 'cancelled' && !cur.cancelledAt
+                ? { cancelledAt: new Date(now()).toISOString() }
+                : {}),
+        });
+        return { booking: row ?? cur, outcome: 'read', moved: status !== seen };
+    };
+    /**
+     * Huazhu's own word on a booking, at most once a minute each - and after a
+     * failure, once in two, and not at all while it says "too many requests".
+     * Two looks at one booking at once are one call.
      *
      * ⚠️ IT ONLY READS (2026-10-16 audit, P0-A). It used to move a payment on
      * as it was asked about - outside the booking's lock, from every lookup and
      * every few seconds from a card waiting on a payment. Payments move on in
      * the pass, the landing page and the steps a guest takes, one at a time.
+     * What it writes is the booking's status and the time of the look; a
+     * cancellation at Huazhu's end is then a payment to settle (`moneyPending`).
+     *
+     * The guest's lookup and the background watch (`watchPass`) are this one
+     * function, so a cancellation found by either is written alike.
      */
-    const refresh = async (found) => {
+    const lookAt = (found) => {
         const b = store.get(found.id) ?? found;
         if (!b.resId || b.pendingSince !== undefined)
-            return b;
-        if (b.refreshedAt && now() - b.refreshedAt < 60_000)
-            return b;
-        try {
-            const d = await client.detail(b.resId);
-            const status = statusOf(d.status);
-            const line = d.reservations?.[0];
-            return (store.update(b.id, {
-                hotelStatus: d.status,
-                status,
-                refreshedAt: now(),
-                ...(line?.cancelPolicyCode ? { cancelCode: line.cancelPolicyCode } : {}),
-                ...(status === 'cancelled' && !b.cancelledAt
-                    ? { cancelledAt: new Date(now()).toISOString() }
-                    : {}),
-            }) ?? b);
-        }
-        catch {
-            // Unreachable or refused: what we last knew stands, and says so by its age.
-            return b;
-        }
+            return Promise.resolve({ booking: b, outcome: 'none' });
+        const flying = detailFlights.get(b.id);
+        if (flying)
+            return flying;
+        if (lookedAtLately(b) || detailHeld())
+            return Promise.resolve({ booking: b, outcome: 'none' });
+        const flight = askDetail(b).finally(() => {
+            detailFlights.delete(b.id);
+        });
+        detailFlights.set(b.id, flight);
+        return flight;
     };
+    const refresh = async (found) => (await lookAt(found)).booking;
     /** Why a booking cannot be cancelled yet: Huazhu has not said whether it exists. */
     const waitingWords = (b) => b.status === 'unconfirmed'
         ? `${opts.sandbox ? 'The simulated Huazhu' : 'Huazhu'} has not said whether this booking was made, and a person here is confirming it. It cannot be cancelled here until then - ask again later.`
@@ -1522,6 +1606,39 @@ export const createHuazhuHotels = (opts) => {
             steps,
         };
     };
+    /**
+     * The fee cancelling comes to if it is the SAME whenever in `from`..`to` it
+     * was done - by the rate's own terms, worked out by `feeNow` at both ends and
+     * at every moment in between that a window of the terms begins (and where a
+     * room by the hour begins) - or undefined when it differs, so that WHEN
+     * matters (2026-10-21 re-audit, T2-8). Undefined too when the terms cannot be
+     * read, or say the fee is only the most it could be, or say it cannot be
+     * cancelled: none of those is a fee.
+     */
+    const constantFee = (b, from, to) => {
+        const policy = policyOf(b.cancelCode);
+        if (!policy || !Number.isFinite(from) || !Number.isFinite(to) || from > to)
+            return undefined;
+        const moments = new Set([from, to]);
+        for (const ph of phasesOf(policy, b.stay.checkIn, b.tz))
+            if (ph.from > from && ph.from <= to)
+                moments.add(ph.from);
+        if (b.hourly) {
+            const begins = arrivalInstant(b.stay.checkIn, b.hourly.start, b.tz);
+            if (begins > from && begins <= to)
+                moments.add(begins);
+        }
+        let fee;
+        for (const at of moments) {
+            const f = feeNow(b, at);
+            if (f.forbidden || f.feeIsCap)
+                return undefined;
+            if (fee !== undefined && f.fee !== fee)
+                return undefined;
+            fee = f.fee;
+        }
+        return fee;
+    };
     /** `feeNow`'s steps as the card reads them: money, and the hotel's clock. */
     const stepsTold = (b, steps) => steps
         ? {
@@ -1614,16 +1731,22 @@ export const createHuazhuHotels = (opts) => {
         if (who.ip && requestsByIp.count(who.ip) >= limits.perIpPerHour) {
             throw new Error('Nothing was booked. Too many bookings have been asked for from this network in the last hour - try again later.');
         }
+        // ⚠️ TWO CEILINGS, EACH SAYING WHICH (2026-10-21 re-audit, T2-14). This
+        // is the strict one: stays that are made - booked, being booked, cancelled
+        // since - or paid for and about to be booked. A request to pay in advance
+        // that has not been paid is counted apart, and looser, once it is known to
+        // be one (`bookHeld`). Since 2026-10-16 (audit, P2: each prebook and
+        // payment page had to be bounded) unpaid ones were counted HERE, and fifty
+        // anonymous emails, a request each, could fill the day and stop every real
+        // booking.
         const madeToday = store.all().filter((b) => now() - Date.parse(b.createdAt) < DAY_MS &&
+            !unpaidAsk(b) &&
             (b.status === 'confirmed' ||
                 b.status === 'requested' ||
                 b.status === 'unconfirmed' ||
                 b.status === 'cancelled' ||
-                // A stay paid in advance asked Huazhu (its prebook) before any
-                // payment - waiting for one, or lapsed without, it counts too
-                // (2026-10-16 audit, P2: unpaid asks were never counted).
-                b.status === 'awaiting-payment' ||
-                (b.status === 'expired' && !!b.prepaid))).length + slotsWhere(() => true);
+                // Paid, and about to be booked: the money is taken.
+                b.status === 'awaiting-payment')).length + slotsWhere((x) => !x.unpaid);
         if (madeToday + lines.length > limits.perDeploymentPerDay) {
             // ⚠️ A CEILING HIT IS SOMETHING A PERSON SHOULD KNOW: either business
             // is booming or somebody is filling hotels with names. Logged, and on
@@ -1633,7 +1756,7 @@ export const createHuazhuHotels = (opts) => {
                 console.error(`[huazhu bookings] ⚠️ NEEDS A PERSON: ${madeToday} bookings in the last 24 hours reached the ceiling of ${limits.perDeploymentPerDay}; new bookings are refused until the count falls`);
             }
             store.ceilingHitAt = now();
-            throw new Error(`Nothing was booked: bookings through this connector are paused for now. Try again later, or book with ${opts.brand} directly.`);
+            throw new Error(`Nothing was booked: bookings through this connector are paused for now - the limit on bookings made in a day has been reached. Try again later, or book with ${opts.brand} directly.`);
         }
         // The network counted once it has passed every limit - a request turned
         // away is not one more against the guest, or a guest at a limit could
@@ -1643,7 +1766,11 @@ export const createHuazhuHotels = (opts) => {
         if (who.ip)
             requestsByIp.add(who.ip);
         // ⚠️ AND ITS PLACES TAKEN NOW, before anything is awaited - see `slots`.
-        const slot = { sessionId: conversationOf(who), email, n: lines.length };
+        const slot = {
+            sessionId: conversationOf(who),
+            email,
+            n: lines.length,
+        };
         slots.add(slot);
         try {
             return await bookHeld(lines, shown, tripKey, email, guest, contact, who, requests, slot);
@@ -1778,6 +1905,7 @@ export const createHuazhuHotels = (opts) => {
         }
         let refusal;
         let answer;
+        let notSent = false;
         for (let attempt = 0; attempt < 2; attempt += 1) {
             try {
                 reconciler.inFlight(id, true);
@@ -1792,6 +1920,13 @@ export const createHuazhuHotels = (opts) => {
                     answer = got;
             }
             catch (err) {
+                // ⚠️ NEVER SENT IS NOT "NO ANSWER" (2026-10-21, P1-11): this connector's
+                // own limit on calls to Huazhu was full for too long, so the booking
+                // did not go out. Nothing can exist at Huazhu to be followed up.
+                if (err instanceof HuazhuTooBusy) {
+                    notSent = true;
+                    break;
+                }
                 if (err instanceof HuazhuRefusal && err.code === CODES.systemError && attempt === 0) {
                     await sleep(1_000);
                     continue;
@@ -1813,6 +1948,18 @@ export const createHuazhuHotels = (opts) => {
             });
             return;
         }
+        if (notSent) {
+            // Put back as it was before the call - paid, waiting to be booked, and
+            // NOT pending: the follow-up queries are for a booking that may exist,
+            // and this one was never asked for. The next pass books it, as it does
+            // when the booking could not be written down above. (Paid with
+            // UnionPay, the gateway hands the one-time card over once and it is
+            // gone: the next pass finds it gone and asks Huazhu whether the stay
+            // exists, as for any lost card - nothing is charged.)
+            store.update(id, { status: 'awaiting-payment', pendingSince: undefined });
+            console.error(`[huazhu prepaid ${id}] the booking was not sent to Huazhu - this connector's own limit on calls to Huazhu stayed full - and is tried again on the next pass`);
+            return;
+        }
         if (refusal)
             await turnedDown(id, refusal, !!card);
         // No answer: the reconciler's eight minutes decide it.
@@ -2110,6 +2257,46 @@ export const createHuazhuHotels = (opts) => {
             ...(cur.prepaid ? { prepaid: { ...cur.prepaid, ...fields } } : {}),
         });
     };
+    /**
+     * ⚠️ ONE RULE FOR CLOSING A CARD PAGE (2026-10-21 re-audit, T2-1 / T2-7):
+     * `closed` is closed and `paid` is paid - and EVERYTHING ELSE is no answer.
+     * Stripe's `close` answers `open` when its expire is refused (a 400) while
+     * the page is still open, and may throw; neither means the page is shut, and
+     * neither means it was just paid. On no answer the caller changes nothing on
+     * the booking (no session cleared, no status moved) and leaves the page to
+     * the prepaid pass, which closes it once it is past its time.
+     */
+    const closePage = async (sessionId) => {
+        if (!checkout)
+            return { state: 'unanswered', why: 'there is no payment provider' };
+        try {
+            const answer = await checkout.close(sessionId);
+            return answer === 'closed' || answer === 'paid'
+                ? { state: answer }
+                : { state: 'unanswered', why: 'the page stayed open' };
+        }
+        catch (err) {
+            return { state: 'unanswered', why: err.message };
+        }
+    };
+    /**
+     * The card page for a booking - the one way it is opened: when the booking
+     * is asked for (`bookHeld`), and again when UnionPay's page would not open
+     * after this one was closed for it (`unionPay`, 2026-10-21 re-audit, T2-6).
+     * A page opened AGAIN says which opening it is (`attempt`): under the
+     * booking's first key the provider would answer with the closed page.
+     */
+    const openCardPage = (row, payBy, attempt) => checkout.open({
+        ref: row.distributorResId,
+        code: row.confirmationCode,
+        title: `${row.hotelName} · ${row.quote.lines[0]?.title ?? ''}`.slice(0, 200),
+        amountMinor: row.quote.total.minor,
+        currency: row.quote.total.currency,
+        email: row.guest.email,
+        // A minute past the booking's own deadline - ours closes it first.
+        expiresAt: payBy + 60_000,
+        ...(attempt ? { attempt } : {}),
+    });
     /** Whether a booking paid in advance still has money work to do. */
     const moneyPending = (b) => {
         const p = b.prepaid;
@@ -2154,8 +2341,15 @@ export const createHuazhuHotels = (opts) => {
             let state;
             try {
                 state = await checkout.state(p.sessionId);
-                if (state === 'open' && now() >= p.payBy)
-                    state = await checkout.close(p.sessionId);
+                if (state === 'open' && now() >= p.payBy) {
+                    // A close that left the page open is no answer either (2026-10-21
+                    // re-audit, T2-7): counted below as a page that could not be asked,
+                    // so one that will not close is a person's to look at - not "fine".
+                    const closing = await closePage(p.sessionId);
+                    if (closing.state === 'unanswered')
+                        throw new Error(closing.why);
+                    state = closing.state;
+                }
             }
             catch {
                 // Asked again on the next pass - but a page that cannot be asked
@@ -2302,6 +2496,105 @@ export const createHuazhuHotels = (opts) => {
             }
         }
     };
+    // ------------------------------------------------- watching paid stays ----
+    /**
+     * ⚠️ NOBODY WAS LOOKING AT A PAID STAY (2026-10-21 re-audit, T2-5, R7). The
+     * only read of Huazhu's order detail was a guest's own lookup, so a stay the
+     * hotel cancelled sat "confirmed" with the guest's money here - not given
+     * back, not decided - until the guest asked. This is the low-frequency look
+     * that does not wait to be asked: each paid stay, confirmed and not yet
+     * arrived, is read at most every `everyHours` (6), and the watch as a whole
+     * makes at most `callsPerHour` (20) reads an hour, whatever the number of
+     * stays. Until Huazhu says what it allows (docs/huazhu-card-payment-questions.md,
+     * question 29) these are ours to keep gentle.
+     */
+    const watchEveryMs = (opts.paidWatch?.everyHours ?? 6) * HOUR_MS;
+    const watchPerHour = opts.paidWatch?.callsPerHour ?? 20;
+    /** When each read the watch made was started, within the last hour. */
+    const watchCalls = [];
+    /** A pass is under way: the timer's next one does not start a second beside it. */
+    let watching = false;
+    /** No pass reads anything before this: a read failed (`WATCH_PAUSE_MS`). */
+    let watchPausedUntil = Number.NEGATIVE_INFINITY;
+    /** A stay paid for - by the page, or by the one-time card UnionPay issued - that Huazhu has confirmed and that has not arrived. */
+    const watchable = (b, t) => {
+        const p = b.prepaid;
+        if (!p || b.status !== 'confirmed' || !b.resId || b.pendingSince !== undefined)
+            return false;
+        const paid = paidInAdvance(p);
+        // Until the arrival day ends: after it the booking is Huazhu's and the hotel's.
+        return paid && t < nightAuditOf(b.stay.checkIn, b.tz);
+    };
+    /** When a watchable stay was last looked at: a read, a try that failed, or - never read - when it was paid. */
+    const lastLookOf = (b) => Math.max(b.refreshedAt ?? 0, b.refreshFailedAt ?? 0, Date.parse(b.createdAt) || 0, b.prepaid?.paidAt ?? 0, b.prepaid?.issuedAt ?? 0);
+    /** Due for a look: the interval since the last one - a short one after a failure. */
+    const watchDue = (b, t) => watchable(b, t) &&
+        t - lastLookOf(b) >= (failedLast(b) ? Math.min(WATCH_RETRY_MS, watchEveryMs) : watchEveryMs);
+    /**
+     * One pass of the watch. It runs after the pass over the money, so a slow
+     * Huazhu never holds a payment up. The stays due, longest unlooked first,
+     * each under its OWN lock - one a guest's step has taken is left for the next
+     * pass - until the hour's reads are spent, Huazhu says "too many requests",
+     * or a read fails (Huazhu is not answering: it is not asked for every other
+     * stay too, but tried again on the next pass).
+     *
+     * ⚠️ THE SAME LOOK AS A GUEST'S LOOKUP (`lookAt`), not a copy of it: what
+     * Huazhu says is written in one place. A stay found cancelled is then a
+     * payment to settle, and is settled in the same step - the money is owed
+     * back (or a person asked) as it would be when the guest next looked.
+     */
+    const watchPass = async () => {
+        if (closing || watching || watchPerHour <= 0 || now() < watchPausedUntil)
+            return;
+        watching = true;
+        try {
+            const due = store
+                .all()
+                .filter((b) => watchDue(b, now()))
+                .sort((a, b) => lastLookOf(a) - lastLookOf(b));
+            for (const row of due) {
+                const t = now();
+                while (watchCalls.length && watchCalls[0] <= t - HOUR_MS)
+                    watchCalls.shift();
+                if (closing || detailHeld() || watchCalls.length >= watchPerHour)
+                    return;
+                let outcome;
+                try {
+                    outcome = await ifFree(row.id, async () => {
+                        const cur = store.get(row.id);
+                        // Asked again under the lock: a guest's lookup may have read it meanwhile.
+                        if (!cur || !watchDue(cur, now()))
+                            return undefined;
+                        const started = now();
+                        const look = await lookAt(cur);
+                        if (look.outcome === 'none')
+                            return look.outcome;
+                        watchCalls.push(started);
+                        if (look.outcome === 'read' && look.moved) {
+                            console.log(`[huazhu watch ${cur.id}] Huazhu now shows ${cur.distributorResId} as ${look.booking.hotelStatus}: ${look.booking.status}`);
+                            const moved = store.get(cur.id);
+                            if (moved && moneyPending(moved))
+                                await settlePrepaid(moved);
+                        }
+                        return look.outcome;
+                    });
+                }
+                catch (err) {
+                    console.error(`[huazhu watch ${row.id}] the look failed: ${err.message}`);
+                }
+                if (outcome === 'failed') {
+                    // Not answering: the whole watch rests. A 2009 ("too many requests")
+                    // has its own back-off, which every read waits on already.
+                    if (!detailHeld())
+                        watchPausedUntil = now() + WATCH_PAUSE_MS;
+                    return;
+                }
+            }
+        }
+        finally {
+            watching = false;
+        }
+    };
     const bookHeld = async (lines, shown, tripKey, email, guest, contact, who, requests, slot) => {
         // Priced afresh, not from the cache: this is the price that will be sent.
         const priced = await quoteLines({ lines }, true);
@@ -2365,6 +2658,26 @@ export const createHuazhuHotels = (opts) => {
         // The whole trip's rule: nothing is booked.
         if (lines.length > 1 && plans.some((p) => p.sold.res.prepaid))
             throw new Error('Nothing was booked: a stay paid in advance is booked on its own here. Take the other stays out of the trip, book this one, then book the rest.');
+        // ⚠️ THE OTHER CEILING (2026-10-21 re-audit, T2-14): a request to pay in
+        // advance costs one prebook at Huazhu and one payment page at Stripe
+        // whether or not it is ever paid, and anybody may make one. Unpaid ones -
+        // waiting, or lapsed - are counted apart from bookings, and looser, so a
+        // flood of them stops more of them and not the bookings that are real. It
+        // is checked before Huazhu is asked anything; this request's own place is
+        // already in `slot`.
+        if (plans.some((p) => p.sold.res.prepaid)) {
+            slot.unpaid = true;
+            const unpaid = store.all().filter((b) => now() - Date.parse(b.createdAt) < DAY_MS && unpaidAsk(b)).length +
+                slotsWhere((x) => !!x.unpaid);
+            if (unpaid > unpaidPerDay) {
+                if (unpaidCeilingSaidAt === undefined || now() - unpaidCeilingSaidAt > HOUR_MS) {
+                    unpaidCeilingSaidAt = now();
+                    console.error(`[huazhu bookings] ⚠️ NEEDS A PERSON: ${unpaid} requests to pay in advance left unpaid (waiting for payment or lapsed) in the last 24 hours reached the unpaid ceiling of ${unpaidPerDay}; new requests to pay in advance are refused until the count falls`);
+                }
+                store.ceilingHitAt = now();
+                throw new Error(`Nothing was booked: bookings paid in advance through this connector are paused for now - the limit on payment requests left unpaid in a day has been reached. Try again later, pay at the hotel where the rate allows it, or book with ${opts.brand} directly.`);
+            }
+        }
         // Prebook is Huazhu's own check of price, rooms and rules - for each stay
         // before any is booked, so a stay it turns down is said with the others'
         // outcome, not after them.
@@ -2479,16 +2792,7 @@ export const createHuazhuHotels = (opts) => {
             slot.n -= 1;
             let opened;
             try {
-                opened = await checkout.open({
-                    ref: dres,
-                    code: row.confirmationCode,
-                    title: `${plan.qline.hotelName} · ${plan.qline.title}`.slice(0, 200),
-                    amountMinor: allIn,
-                    currency: cur,
-                    email: guest.email,
-                    // A minute past the booking's own deadline - ours closes it first.
-                    expiresAt: record.payBy + 60_000,
-                });
+                opened = await openCardPage(row, record.payBy);
             }
             catch (err) {
                 store.update(id, { status: 'failed' });
@@ -2622,6 +2926,7 @@ export const createHuazhuHotels = (opts) => {
                 // booking again.
                 let refusal;
                 let answer;
+                let notSent;
                 for (let attempt = 0; attempt < 2; attempt += 1) {
                     try {
                         reconciler.inFlight(id, true);
@@ -2636,6 +2941,11 @@ export const createHuazhuHotels = (opts) => {
                             answer = got;
                     }
                     catch (err) {
+                        // Never sent (2026-10-21, P1-11): see `bookPaid`.
+                        if (err instanceof HuazhuTooBusy) {
+                            notSent = err.why;
+                            break;
+                        }
                         if (err instanceof HuazhuRefusal && err.code === CODES.systemError && attempt === 0) {
                             // The documentation's own advice: retry a system error, same id.
                             await sleep(1_000);
@@ -2660,6 +2970,15 @@ export const createHuazhuHotels = (opts) => {
                     });
                     continue;
                 }
+                if (notSent !== undefined) {
+                    // ⚠️ NEVER ASKED OF HUAZHU: nothing to follow up, nothing to show -
+                    // not "unknown, the eight minutes decide". Failed, and said as a
+                    // stay Huazhu could not be reached for, which asking again is safe for.
+                    store.update(id, { pendingSince: undefined, status: 'failed' });
+                    made.pop();
+                    failStay(plan.line, `Huazhu could not be reached to book ${title} (${notSent}). It was not sent, so nothing was booked. Asking again for this stay is safe.`, 'unreachable', undefined, named);
+                    continue;
+                }
                 if (refusal) {
                     // Never made at Huazhu: nothing to follow up, nothing to show -
                     // and the stays booked before it stay booked.
@@ -2686,6 +3005,35 @@ export const createHuazhuHotels = (opts) => {
         }
         return { booked: made.map((b) => publicBooking(store.get(b.id) ?? b)), failed };
     };
+    /**
+     * A new card page for a booking whose card page was closed for UnionPay's
+     * and whose UnionPay page would not open (2026-10-21 re-audit, T2-6): the
+     * same booking and total, a page of a full life from now (the provider
+     * takes none shorter than half an hour), written back as the booking's own.
+     * The count of openings is written BEFORE the call, so a try whose answer
+     * was lost is not answered again by the next one's key.
+     */
+    const reopenCardPage = async (id) => {
+        const cur = store.get(id);
+        const p = cur?.prepaid;
+        if (!cur || !p || p.method !== 'card' || cur.status !== 'awaiting-payment' || p.sessionId)
+            return { why: 'the booking is not waiting on a card page that is gone' };
+        const attempt = (p.reopened ?? 0) + 1;
+        patch(id, {}, { reopened: attempt });
+        const payBy = now() + payWithin;
+        try {
+            const opened = await openCardPage(cur, payBy, attempt);
+            const row = patch(id, {}, { sessionId: opened.sessionId, url: opened.url, payBy });
+            return {
+                url: opened.url,
+                by: deadlineAt(row?.prepaid?.payBy ?? payBy, cur.tz, 'en'),
+            };
+        }
+        catch (err) {
+            console.error(`[huazhu prepaid ${id}] the card page closed for UnionPay's could not be opened again: ${err.message}`);
+            return { why: err.message };
+        }
+    };
     /**
      * Pay a booking waiting for payment with UnionPay instead of the card page
      * (robin, 2026-10-15). The card page is closed first - paid on it in the
@@ -2801,11 +3149,21 @@ export const createHuazhuHotels = (opts) => {
                     // lapses (paid on it meanwhile, it goes on as that payment).
                     if (said === 'price-changed' || said === 'sold-out') {
                         if (p.sessionId) {
-                            const page = await checkout.close(p.sessionId).catch(() => undefined);
-                            if (page === 'paid') {
+                            // ⚠️ THE STAY LAPSES ONLY ONCE THE CARD PAGE IS SEEN CLOSED
+                            // (2026-10-21 re-audit, T2-1): this branch swallowed a close that
+                            // got no answer and lapsed the stay anyway, with the Stripe page
+                            // still open - paid there, nothing ever looked at that session
+                            // again (an orphan payment). Closed lapses it; paid goes on as
+                            // that payment; anything else changes NOTHING (session and url
+                            // kept, as on the main path below and in cancelBooking), and the
+                            // prepaid pass closes the page when it is past its time.
+                            const page = await closePage(p.sessionId);
+                            if (page.state === 'paid') {
                                 await settlePrepaid(row);
                                 return { kind: 'paid-on-card', booking: publicBooking(store.get(row.id) ?? row) };
                             }
+                            if (page.state === 'unanswered')
+                                return refused(`Huazhu will not take ${row.hotelName} - ${title} paid by card now (${said === 'sold-out' ? 'no rooms are left for those nights' : 'its price moved since it was shown'}), but the card page could not be closed just now (${page.why}). Nothing changed - the card page may still be open and still takes the payment. Ask again to close it.`, 'unreachable');
                         }
                         patch(row.id, { status: 'expired' }, { sessionId: undefined, url: undefined, lapsedAt: now() });
                         return refused(`Nothing was booked or charged: ${refusalWords(err, `${row.hotelName} - ${title}`, p.currency)}`, said);
@@ -2820,19 +3178,20 @@ export const createHuazhuHotels = (opts) => {
             }
             // Huazhu said yes: now the card page is closed, so it cannot be paid
             // after this.
+            let cardPageClosed = false;
             if (p.method !== 'unionpay' && p.sessionId) {
-                let state;
-                try {
-                    state = await checkout.close(p.sessionId);
-                }
-                catch (err) {
-                    return refused(`The card page could not be closed (${err.message}). Nothing changed - ask again.`, 'unreachable');
-                }
-                if (state === 'paid') {
+                // Only a page seen `closed` is let go of (2026-10-21 re-audit, T2-7: an
+                // `open` answer used to pass as closed, and UnionPay's page was opened
+                // beside a card page that could still be paid).
+                const page = await closePage(p.sessionId);
+                if (page.state === 'unanswered')
+                    return refused(`The card page could not be closed (${page.why}). Nothing changed - the card page still takes the payment, or ask again.`, 'unreachable');
+                if (page.state === 'paid') {
                     await settlePrepaid(row);
                     return { kind: 'paid-on-card', booking: publicBooking(store.get(row.id) ?? row) };
                 }
                 patch(row.id, {}, { sessionId: undefined, url: undefined });
+                cardPageClosed = true;
             }
             const names = hotelNamesOf(row.hotelId);
             const nights = row.quote.lines[0]?.nights ?? 1;
@@ -2856,7 +3215,21 @@ export const createHuazhuHotels = (opts) => {
                 // calls it off (2026-10-16 audit, P2).
                 if (err instanceof UnionPayError && err.left)
                     raise(row.id, `UnionPay's page could not be opened, and the payment the gateway opened for it (${err.left}) could not be called off - it charges nothing, but cancel it at the gateway (POST /acp/<merchant>/checkout_sessions/${err.left}/cancel)`);
-                return refused(`UnionPay's page could not be opened (${err.message}). Nothing was charged - ask again.`, 'unreachable');
+                const said = `UnionPay's page could not be opened (${err.message}).`;
+                // ⚠️ NEVER A BOOKING WAITING FOR A PAYMENT WITH NOWHERE TO PAY IT
+                // (2026-10-21 re-audit, T2-6, R2). The card page was closed above, and
+                // opening UnionPay's first and closing the card page after would leave
+                // two pages that can be paid at once - so the order stays, and when
+                // UnionPay's page does not come the card page is opened again: a new
+                // page, under a key of its own, for the same booking and total.
+                if (cardPageClosed) {
+                    const back = await reopenCardPage(row.id);
+                    if (back.url)
+                        return refused(`${said} The card page was closed to make way for it, and a new card page is open: ${back.url} - pay on it by ${back.by} hotel time. Nothing was charged.`, 'unreachable');
+                    const left = store.get(row.id) ?? row;
+                    return refused(`${said} The card page that was closed to make way for it could not be opened again either (${back.why}), so this stay has no page to pay on now. Nothing was charged and nothing is booked: ask again to try UnionPay once more - or, left alone, it lapses by ${deadlineAt(left.prepaid?.payBy ?? now(), left.tz, 'en')} hotel time and the stay can be asked for again.`, 'unreachable');
+                }
+                return refused(`${said} Nothing was charged - ask again.`, 'unreachable');
             }
             const updated = patch(row.id, { paymentType: 'CCPN' }, {
                 method: 'unionpay',
@@ -2870,6 +3243,14 @@ export const createHuazhuHotels = (opts) => {
     };
     /** When each payment page last moved its booking on, for the page a paid guest lands on. */
     const returned = new Map();
+    /**
+     * What each unpaid payment page was last asked, and when - for the landing
+     * page's read-only look (2026-10-21 re-audit, T2-9). The answer is the
+     * pending read itself, so requests at the same moment share one call.
+     */
+    const looked = new Map();
+    /** One read of a page's state in this long - the landing page's step has the same limit. */
+    const LOOK_EVERY_MS = 10_000;
     /** What the landing page says of a booking - never the guest's name, email or phone. */
     const returnOf = (row) => {
         const p = row.prepaid;
@@ -2956,7 +3337,30 @@ export const createHuazhuHotels = (opts) => {
             row.prepaid?.method !== 'unionpay' &&
             row.prepaid?.sessionId &&
             checkout) {
-            const page = await checkout.state(row.prepaid.sessionId).catch(() => undefined);
+            // ⚠️ AT MOST ONE READ OF STRIPE A PAGE IN 10 SECONDS (2026-10-21
+            // re-audit, T2-9). Anybody holding a card page's address could open this
+            // page as often as they liked, and every open was a call to the Stripe
+            // account all the guests of this connector share - and its rate limit.
+            // A request within 10 seconds of the last read uses that read.
+            const sid = row.prepaid.sessionId;
+            const last = looked.get(sid);
+            const fresh = !last || at - last.at >= LOOK_EVERY_MS;
+            const read = fresh
+                ? checkout.state(sid).catch(() => undefined)
+                : last.page;
+            if (fresh) {
+                looked.set(sid, { at, page: read });
+                if (looked.size > 1_000)
+                    for (const [k, v] of looked)
+                        if (at - v.at >= LOOK_EVERY_MS)
+                            looked.delete(k);
+            }
+            let page = await read;
+            // ⚠️ A READ THAT SAID "OPEN" A MOMENT AGO IS NOT "NOT PAID" NOW: the guest
+            // may have paid since, and is told "not paid" only by a page just read
+            // (2026-10-16 audit, P0-D). Said as `checking`, the page looks again.
+            if (!fresh && page === 'open')
+                page = undefined;
             if (page === 'paid')
                 return { ...told, state: 'booking' };
             // Cannot be read just now: the page looks again (香格里拉's `checking`).
@@ -2996,6 +3400,8 @@ export const createHuazhuHotels = (opts) => {
                     console.error(`[huazhu prepaid ${row.id}] the pass's step failed: ${err.message}`);
                 }
             }
+            // Then the look at paid stays that nobody has asked about (T2-5).
+            await watchPass();
         },
         imageDomains() {
             const hosts = new Set();
@@ -3683,9 +4089,21 @@ export const createHuazhuHotels = (opts) => {
             const facts = { ...(feeIsCap ? { feeIsCap } : {}), ...stepsTold(b, steps) };
             // A test booking says it is one (2026-10-16 audit, P2): Huazhu's test
             // system charges nobody and books nothing anyone stays in.
-            const testNote = opts.testEnvironment
-                ? " This is a test booking in Huazhu's test system: nothing is charged to anyone."
-                : '';
+            // ⚠️ THE SIMULATION SAYS IT TOO (2026-10-21 re-audit, T2-12): this was
+            // said for Huazhu's test system only, so in the sandbox the "nothing
+            // comes back" and "cannot be cancelled" previews said nothing of being a
+            // test - while the "all of it back" one did.
+            const testNote = opts.sandbox
+                ? ' This is a test booking in the simulated Huazhu: nothing is charged to anyone.'
+                : opts.testEnvironment
+                    ? " This is a test booking in Huazhu's test system: nothing is charged to anyone."
+                    : '';
+            // A booking paid here in advance, in either: the money is a test too.
+            const paidTestNote = opts.sandbox
+                ? ' This is a test booking in the simulated Huazhu, paid in the gateway’s test mode: no real money moves.'
+                : opts.testEnvironment
+                    ? ' This is a test booking in Huazhu’s test system, paid in test mode: no real money moves.'
+                    : '';
             // Paid with UnionPay: Huazhu charged the one-time card, and gives back
             // to it what its terms allow - nothing passes through here (audit P0-C:
             // it was told as "paid at the hotel, nothing paid through here").
@@ -3716,10 +4134,10 @@ export const createHuazhuHotels = (opts) => {
                     fee: money(forbidden ? 0 : fee, cur),
                     refund: back ? b.quote.total : zero,
                     rule: forbidden
-                        ? `This rate cannot be cancelled now. ${rule} The ${formatMoney(b.quote.total)} paid stays paid.`
+                        ? `This rate cannot be cancelled now. ${rule} The ${formatMoney(b.quote.total)} paid stays paid.${paidTestNote}`
                         : back
-                            ? `${rule} Cancelling now gives back all ${formatMoney(b.quote.total)} paid, to the card it was paid with.${opts.sandbox ? ' This is a test booking in the simulated Huazhu, paid in the gateway’s test mode: no real money moves.' : opts.testEnvironment ? ' This is a test booking in Huazhu’s test system, paid in test mode: no real money moves.' : ''}`
-                            : `${rule} Cancelling now gives nothing back: the fee is the whole stay.${testNote}`,
+                            ? `${rule} Cancelling now gives back all ${formatMoney(b.quote.total)} paid, to the card it was paid with.${paidTestNote}`
+                            : `${rule} Cancelling now gives nothing back: the fee is the whole stay.${paidTestNote}`,
                     ...(freeUntil ? { freeUntil: new Date(freeUntil).toISOString() } : {}),
                     cancellable: !forbidden,
                     ...facts,
@@ -3767,15 +4185,25 @@ export const createHuazhuHotels = (opts) => {
                         ? 'The guest has just confirmed on UnionPay, so the stay is being booked with Huazhu now. Ask again in a moment to cancel it.'
                         : 'UnionPay could not be reached to say whether the guest confirmed. Ask again in a moment - nothing is booked until it can.');
                 }
+                // ⚠️ NO PAGE, NOTHING THAT CAN BE PAID (2026-10-21, T2-6): a card page
+                // closed to make way for UnionPay's and not opened again leaves a stay
+                // waiting with nowhere to pay it. Cancelling it called it "cancelled"
+                // and changed nothing; with no page there is nothing to close, so it
+                // is called off as a closed page is.
+                if (b.status === 'awaiting-payment' && b.prepaid && !b.prepaid.sessionId && checkout) {
+                    return publicBooking(patch(b.id, { status: 'expired' }, { lapsedAt: now(), url: undefined }) ?? b);
+                }
                 // Not paid yet: the page is closed, so it cannot be paid after this.
                 if (b.status === 'awaiting-payment' && b.prepaid?.sessionId && checkout) {
-                    const state = await checkout.close(b.prepaid.sessionId).catch(() => undefined);
-                    if (state === 'closed') {
+                    const page = await closePage(b.prepaid.sessionId);
+                    if (page.state === 'closed') {
                         return publicBooking(patch(b.id, { status: 'expired' }, { lapsedAt: now(), url: undefined }) ?? b);
                     }
                     // ⚠️ NO ANSWER IS NOT "PAID" (audit P0-C): the page may well still be
-                    // open and unpaid.
-                    if (state === undefined)
+                    // open and unpaid. That includes a close that answered `open`
+                    // (2026-10-21 re-audit, T2-7: it was read as "paid in the last
+                    // second", settled, and told to the guest as paid).
+                    if (page.state === 'unanswered')
                         throw new Error('The payment page could not be reached to close it, so nothing was cancelled yet. Ask again in a moment - nothing is booked or charged until the page is paid.');
                     // Paid in the last second: it is booked now, and cancelled as one.
                     await settlePrepaid(b);
@@ -3815,13 +4243,55 @@ export const createHuazhuHotels = (opts) => {
                     if (err instanceof HuazhuRefusal && err.code === 5402) {
                         // Cancelled already - by this guest's own earlier try whose answer
                         // was lost, most likely: owed as that cancellation was (audit P0-B).
-                        cancelled(b.cancellationFee ?? money(feeNow(b).fee, cur), b.cancelledAt ?? new Date(now()).toISOString());
+                        const when = b.cancelledAt ?? new Date(now()).toISOString();
+                        const p = b.prepaid;
+                        // Money held here that nobody has decided about yet.
+                        const held = !!p?.paidAt && p.method !== 'unionpay' && !p.refund && !p.kept;
+                        const constant = held && !b.cancellationFee
+                            ? constantFee(b, Date.parse(b.createdAt), Date.parse(when))
+                            : undefined;
+                        if (!held || b.cancellationFee) {
+                            // Nothing to decide here: the fee is the hotel's to charge, and
+                            // what is shown is only what it would be.
+                            cancelled(b.cancellationFee ?? money(feeNow(b).fee, cur), when);
+                        }
+                        else if (constant !== undefined) {
+                            // ⚠️ THE SAME FEE AT EVERY MOMENT UP TO NOW: whenever it was
+                            // cancelled, this was the fee - so not knowing when does not
+                            // matter. Free is all of it back; the whole stay is kept; a part
+                            // is kept and the rest goes back - as a cancellation made here
+                            // is owed (`owedOnCancel`).
+                            cancelled(money(constant, cur), when);
+                        }
+                        else {
+                            // ⚠️ CANCELLED, BUT WHEN IS NOT KNOWN, AND THE FEE DEPENDS ON WHEN
+                            // (2026-10-21 re-audit, T2-8). The fee was worked out as of NOW,
+                            // so a cancellation made inside the free period whose answer was
+                            // lost, and asked again after it, wrote the guest's money off.
+                            // Huazhu's order detail carries no cancellation time (only its
+                            // status and the booking's own time), so there is nothing to
+                            // work it out from and nothing is guessed: where the fee was not
+                            // the same at every moment since booking (`constantFee`), the
+                            // booking is cancelled, no refund is opened and none is kept,
+                            // and a person judges it with Huazhu.
+                            patch(b.id, {
+                                status: 'cancelled',
+                                hotelStatus: 'HOTEL_CANCEL',
+                                cancelledAt: when,
+                            });
+                            const paid = formatMoney(b.quote.total);
+                            raise(b.id, `Huazhu answered 5402 (already cancelled) to the cancellation of ${b.distributorResId}, and does not say when it was cancelled, and what cancelling cost was not the same at every moment since the booking was made (the free period ended before this was found, or the terms cannot be read), so what of the ${paid} paid (gateway session ${p?.sessionId}) comes back - whole if it was cancelled inside the free period, less the fee if after - is to be judged with Huazhu; nothing was refunded or kept`);
+                            throw new Error(`Huazhu says ${b.confirmationCode} is already cancelled, but not when - and what cancelling costs depends on when - so what comes back of the ${paid} paid cannot be worked out here. The booking is shown as cancelled; nothing has been refunded or kept yet, and a person here is settling it with Huazhu.`);
+                        }
                     }
                     else if (err instanceof HuazhuRefusal && (err.code === 5401 || err.code === 5405)) {
                         throw new Error(err.code === 5405
                             ? 'Huazhu says this stay has already started, so it cannot be cancelled.'
                             : 'Huazhu says this booking cannot be cancelled.');
                     }
+                    else if (err instanceof HuazhuTooBusy) {
+                        throw new Error('Huazhu was not asked: this connector is calling Huazhu at its own limit just now, so nothing was cancelled. Ask again in a moment.');
+                    }
                     else if (err instanceof HuazhuUnreachable) {
                         throw new Error('Huazhu did not answer, so it is not known whether the booking was cancelled. Asking again is safe - cancelling twice does not charge twice.');
                     }