@seasonkoh/webaz 0.1.23 → 0.1.25

package/dist/pwa/routes/anchors.js

@@ -1,4 +1,5 @@
 import { generateAnchor, lookupAnchor, retireAnchor, userReferralVolume, computeTierLetter, userAnchorQuotaStats, TIER_THRESHOLDS, ANCHOR_HANDLE_MAX_FOR_USE, } from '../../layer2-business/L2-anchor-registry/anchor-registry.js';
+import { dbOne, dbAll, dbRun } from '../../layer0-foundation/L0-1-database/db.js'; // RFC-016 异步 DB seam
 export function registerAnchorsRoutes(app, deps) {
     const { db, auth, rateLimitOk } = deps;
     // POST /api/anchor/generate
@@ -25,7 +26,7 @@ export function registerAnchorsRoutes(app, deps) {
         res.json({ ok: true, anchor: r.anchor, tier_letter: r.tier_letter });
     });
     // GET /api/anchor/:code/lookup — 公开（无需 auth）
-    app.get('/api/anchor/:code/lookup', (req, res) => {
+    app.get('/api/anchor/:code/lookup', async (req, res) => {
         if (!rateLimitOk(req.ip || 'anon', 60, 60_000))
             return void res.status(429).json({ error: 'too_many_lookups' });
         const r = lookupAnchor(db, String(req.params.code || ''));
@@ -38,15 +39,15 @@ export function registerAnchorsRoutes(app, deps) {
             return void res.status(404).json({ found: false, hint: 'reclaimable' });
         }
         // 2026-05-24 富化响应：附 owner 详情 + 商品推荐指数
-        const owner = db.prepare(`
+        const owner = await dbOne(`
       SELECT u.name, u.handle, u.region, u.created_at, u.bio,
         (SELECT COUNT(*) FROM follows WHERE followee_id = u.id) as follower_count,
         (SELECT COALESCE(SUM(s.like_count), 0) FROM shareables s WHERE s.owner_id = u.id AND s.status = 'active') as total_likes_received
       FROM users u WHERE u.id = ? AND u.id != 'sys_protocol'
-    `).get(r.owner_id);
+    `, [r.owner_id]);
         let product = null;
         if (r.target_kind === 'product') {
-            product = db.prepare(`
+            product = (await dbOne(`
         SELECT p.id, p.title, p.price, p.category, p.images, p.completion_count, p.total_likes,
           (SELECT COUNT(DISTINCT buyer_id) FROM order_ratings rt WHERE rt.product_id = p.id AND rt.stars >= 4) as recommend_count,
           (SELECT ROUND(AVG(stars), 2) FROM order_ratings rt WHERE rt.product_id = p.id) as avg_rating,
@@ -54,12 +55,12 @@ export function registerAnchorsRoutes(app, deps) {
           u.handle as seller_handle, u.name as seller_name
         FROM products p LEFT JOIN users u ON u.id = p.seller_id
         WHERE p.id = ? AND p.status = 'active'
-      `).get(r.target_id);
+      `, [r.target_id])) ?? null;
         }
         else if (r.target_kind === 'shareable') {
-            const sh = db.prepare(`SELECT related_product_id FROM shareables WHERE id = ?`).get(r.target_id);
+            const sh = await dbOne(`SELECT related_product_id FROM shareables WHERE id = ?`, [r.target_id]);
             if (sh?.related_product_id) {
-                product = db.prepare(`
+                product = (await dbOne(`
           SELECT p.id, p.title, p.price, p.category, p.images, p.completion_count, p.total_likes,
             (SELECT COUNT(DISTINCT buyer_id) FROM order_ratings rt WHERE rt.product_id = p.id AND rt.stars >= 4) as recommend_count,
             (SELECT ROUND(AVG(stars), 2) FROM order_ratings rt WHERE rt.product_id = p.id) as avg_rating,
@@ -67,7 +68,7 @@ export function registerAnchorsRoutes(app, deps) {
             u.handle as seller_handle, u.name as seller_name
           FROM products p LEFT JOIN users u ON u.id = p.seller_id
           WHERE p.id = ? AND p.status = 'active'
-        `).get(sh.related_product_id);
+        `, [sh.related_product_id])) ?? null;
             }
         }
         res.json({
@@ -81,7 +82,7 @@ export function registerAnchorsRoutes(app, deps) {
         });
     });
     // POST /api/anchor/:code/touch — 写 attribution（first-touch + 30d）
-    app.post('/api/anchor/:code/touch', (req, res) => {
+    app.post('/api/anchor/:code/touch', async (req, res) => {
         const user = auth(req, res);
         if (!user)
             return;
@@ -93,27 +94,25 @@ export function registerAnchorsRoutes(app, deps) {
         let attributedProducts = 0;
         const expiresAt = new Date(Date.now() + 30 * 86400_000).toISOString().slice(0, 19).replace('T', ' ');
         if (r.target_kind === 'product') {
-            const existing = db.prepare(`SELECT 1 FROM product_share_attribution WHERE product_id = ? AND recipient_id = ?`).get(r.target_id, user.id);
+            const existing = await dbOne(`SELECT 1 FROM product_share_attribution WHERE product_id = ? AND recipient_id = ?`, [r.target_id, user.id]);
             if (!existing) {
-                db.prepare(`INSERT INTO product_share_attribution (product_id, recipient_id, sharer_id, shareable_id, expires_at) VALUES (?,?,?,NULL,?)`)
-                    .run(r.target_id, user.id, r.owner_id, expiresAt);
+                await dbRun(`INSERT INTO product_share_attribution (product_id, recipient_id, sharer_id, shareable_id, expires_at) VALUES (?,?,?,NULL,?)`, [r.target_id, user.id, r.owner_id, expiresAt]);
                 attributedProducts = 1;
             }
         }
         else if (r.target_kind === 'shareable') {
-            const s = db.prepare(`SELECT id, related_product_id FROM shareables WHERE id = ?`).get(r.target_id);
+            const s = await dbOne(`SELECT id, related_product_id FROM shareables WHERE id = ?`, [r.target_id]);
             if (s?.related_product_id) {
-                const existing = db.prepare(`SELECT 1 FROM product_share_attribution WHERE product_id = ? AND recipient_id = ?`).get(s.related_product_id, user.id);
+                const existing = await dbOne(`SELECT 1 FROM product_share_attribution WHERE product_id = ? AND recipient_id = ?`, [s.related_product_id, user.id]);
                 if (!existing) {
-                    db.prepare(`INSERT INTO product_share_attribution (product_id, recipient_id, sharer_id, shareable_id, expires_at) VALUES (?,?,?,?,?)`)
-                        .run(s.related_product_id, user.id, r.owner_id, s.id, expiresAt);
+                    await dbRun(`INSERT INTO product_share_attribution (product_id, recipient_id, sharer_id, shareable_id, expires_at) VALUES (?,?,?,?,?)`, [s.related_product_id, user.id, r.owner_id, s.id, expiresAt]);
                     attributedProducts = 1;
                 }
             }
         }
         else if (r.target_kind === 'user') {
             // 限 LIMIT 50 防 DoS
-            const ownerProducts = db.prepare(`SELECT id FROM products WHERE seller_id = ? AND status = 'active' ORDER BY last_sold_at DESC NULLS LAST LIMIT 50`).all(r.owner_id);
+            const ownerProducts = await dbAll(`SELECT id FROM products WHERE seller_id = ? AND status = 'active' ORDER BY last_sold_at DESC NULLS LAST LIMIT 50`, [r.owner_id]);
             db.transaction(() => {
                 for (const p of ownerProducts) {
                     const existing = db.prepare(`SELECT 1 FROM product_share_attribution WHERE product_id = ? AND recipient_id = ?`).get(p.id, user.id);
@@ -146,14 +145,14 @@ export function registerAnchorsRoutes(app, deps) {
         }
         res.json({ ok: true });
     });
-    app.get('/api/anchor/me', (req, res) => {
+    app.get('/api/anchor/me', async (req, res) => {
         const user = auth(req, res);
         if (!user)
             return;
-        const rows = db.prepare(`
+        const rows = await dbAll(`
       SELECT anchor, prefix, middle, tier_letter, target_kind, target_id, status, retired_at, hits, last_hit_at, created_at
       FROM anchor_registry WHERE owner_id = ? ORDER BY created_at DESC LIMIT 100
-    `).all(user.id);
+    `, [user.id]);
         const vol = userReferralVolume(db, user.id);
         const tier = computeTierLetter(vol);
         const quota = userAnchorQuotaStats(db, user.id);

package/dist/pwa/routes/announcements.js

@@ -1,6 +1,8 @@
+import { dbOne, dbAll, dbRun } from '../../layer0-foundation/L0-1-database/db.js'; // RFC-016 异步 DB seam
 export function registerAnnouncementsRoutes(app, deps) {
-    const { db, generateId, auth, safeRoles, requireProtocolAdmin, isRootAdmin, getAdminScope, logAdminAction } = deps;
-    app.post('/api/admin/announcements', (req, res) => {
+    // db 已走 RFC-016 异步 seam(dbOne/dbAll/dbRun),不再直接用 deps.db
+    const { generateId, auth, safeRoles, requireProtocolAdmin, isRootAdmin, getAdminScope, logAdminAction } = deps;
+    app.post('/api/admin/announcements', async (req, res) => {
         const admin = requireProtocolAdmin(req, res);
         if (!admin)
             return;
@@ -26,16 +28,15 @@ export function registerAnnouncementsRoutes(app, deps) {
             }
         }
         const id = generateId('ann');
-        db.prepare(`INSERT INTO announcements (id, author_id, title, body, target_roles, target_regions, severity, starts_at, expires_at) VALUES (?,?,?,?,?,?,?,?,?)`)
-            .run(id, admin.id, title.trim(), body.trim(), rolesJson, regionsJson, severity || 'info', starts_at || null, expires_at || null);
+        await dbRun(`INSERT INTO announcements (id, author_id, title, body, target_roles, target_regions, severity, starts_at, expires_at) VALUES (?,?,?,?,?,?,?,?,?)`, [id, admin.id, title.trim(), body.trim(), rolesJson, regionsJson, severity || 'info', starts_at || null, expires_at || null]);
         logAdminAction(admin.id, 'create_announcement', 'announcement', id, { title, severity: severity || 'info' });
         res.json({ success: true, id });
     });
-    app.patch('/api/admin/announcements/:id', (req, res) => {
+    app.patch('/api/admin/announcements/:id', async (req, res) => {
         const admin = requireProtocolAdmin(req, res);
         if (!admin)
             return;
-        const ann = db.prepare('SELECT id, author_id FROM announcements WHERE id = ?').get(req.params.id);
+        const ann = await dbOne('SELECT id, author_id FROM announcements WHERE id = ?', [req.params.id]);
         if (!ann)
             return void res.status(404).json({ error: '公告不存在' });
         if (!isRootAdmin(admin) && ann.author_id !== admin.id)
@@ -54,17 +55,17 @@ export function registerAnnouncementsRoutes(app, deps) {
         if (sets.length === 0)
             return void res.status(400).json({ error: '无可更新字段' });
         args.push(req.params.id);
-        db.prepare(`UPDATE announcements SET ${sets.join(', ')} WHERE id = ?`).run(...args);
+        await dbRun(`UPDATE announcements SET ${sets.join(', ')} WHERE id = ?`, args);
         res.json({ success: true });
     });
     // 列出对当前用户可见的活跃公告（按角色 + 区域过滤）
-    app.get('/api/announcements/active', (req, res) => {
+    app.get('/api/announcements/active', async (req, res) => {
         const user = auth(req, res);
         if (!user)
             return;
         const userRoles = safeRoles(user);
         const userRegion = user.region || 'global';
-        const rows = db.prepare(`
+        const rows = await dbAll(`
       SELECT a.id, a.title, a.body, a.severity, a.created_at, a.target_roles, a.target_regions,
              (SELECT 1 FROM announcement_reads WHERE user_id = ? AND announcement_id = a.id) as is_read
       FROM announcements a
@@ -72,7 +73,7 @@ export function registerAnnouncementsRoutes(app, deps) {
         AND (a.starts_at IS NULL OR a.starts_at <= datetime('now'))
         AND (a.expires_at IS NULL OR a.expires_at >= datetime('now'))
       ORDER BY a.created_at DESC LIMIT 50
-    `).all(user.id);
+    `, [user.id]);
         // JS 端 filter 角色 / 区域（避免 JSON LIKE 在 SQLite 中麻烦）
         const filtered = rows.filter(a => {
             if (a.target_roles) {
@@ -96,13 +97,12 @@ export function registerAnnouncementsRoutes(app, deps) {
         }).map(a => ({ ...a, target_roles: undefined, target_regions: undefined, is_read: !!a.is_read }));
         res.json({ items: filtered });
     });
-    app.post('/api/announcements/:id/read', (req, res) => {
+    app.post('/api/announcements/:id/read', async (req, res) => {
         const user = auth(req, res);
         if (!user)
             return;
         try {
-            db.prepare(`INSERT OR IGNORE INTO announcement_reads (user_id, announcement_id) VALUES (?,?)`)
-                .run(user.id, req.params.id);
+            await dbRun(`INSERT OR IGNORE INTO announcement_reads (user_id, announcement_id) VALUES (?,?)`, [user.id, req.params.id]);
         }
         catch { }
         res.json({ success: true });

package/dist/pwa/routes/arbitrator.js

@@ -1,4 +1,7 @@
+import { dbOne, dbAll } from '../../layer0-foundation/L0-1-database/db.js'; // RFC-016 异步 DB seam
 export function registerArbitratorRoutes(app, deps) {
+    // 只读/单写站点走 RFC-016 异步 seam;db 保留:apply/withdraw/approve/reject 是
+    // stake 资金路径,状态翻转 + 钱包扣/退必须原子(db.transaction + CAS),Phase 3 迁 pg 行锁。
     const { db, generateId, auth, requireArbitrationAdmin, checkArbitratorEligibility, getArbitratorState, errorRes, logAdminAction, ARB_STAKE_REQUIRED, ARB_APP_REJECT_COOLDOWN_DAYS, } = deps;
     app.get('/api/arbitrator/eligibility', (req, res) => {
         const user = auth(req, res);
@@ -12,7 +15,7 @@ export function registerArbitratorRoutes(app, deps) {
             return;
         res.json(getArbitratorState(user.id));
     });
-    app.post('/api/arbitrator/apply', (req, res) => {
+    app.post('/api/arbitrator/apply', async (req, res) => {
         const user = auth(req, res);
         if (!user)
             return;
@@ -20,13 +23,13 @@ export function registerArbitratorRoutes(app, deps) {
             return void errorRes(res, 403, 'ROLE_NOT_BUYER', '外部仲裁员仅 buyer 角色可申请（卖家 / 受信角色请联系管理员）');
         }
         const userId = user.id;
-        const wl = db.prepare("SELECT 1 FROM arbitrator_whitelist WHERE user_id = ?").get(userId);
+        const wl = await dbOne("SELECT 1 FROM arbitrator_whitelist WHERE user_id = ?", [userId]);
         if (wl)
             return void res.json({ error: '你已经是仲裁员，无需重新申请' });
-        const pending = db.prepare("SELECT 1 FROM arbitrator_applications WHERE user_id = ? AND status = 'pending'").get(userId);
+        const pending = await dbOne("SELECT 1 FROM arbitrator_applications WHERE user_id = ? AND status = 'pending'", [userId]);
         if (pending)
             return void res.json({ error: '你已有待审申请' });
-        const lastReject = db.prepare("SELECT reviewed_at FROM arbitrator_applications WHERE user_id = ? AND status = 'rejected' ORDER BY reviewed_at DESC LIMIT 1").get(userId);
+        const lastReject = await dbOne("SELECT reviewed_at FROM arbitrator_applications WHERE user_id = ? AND status = 'rejected' ORDER BY reviewed_at DESC LIMIT 1", [userId]);
         if (lastReject?.reviewed_at) {
             const cooldownEnd = new Date(new Date(lastReject.reviewed_at).getTime() + ARB_APP_REJECT_COOLDOWN_DAYS * 86400_000);
             if (cooldownEnd > new Date()) {
@@ -36,80 +39,143 @@ export function registerArbitratorRoutes(app, deps) {
         const elig = checkArbitratorEligibility(userId);
         if (!elig.eligible)
             return void res.json({ error: '信誉指标未达标', eligibility: elig });
+        // 友好预检查(读):真正的守恒门在事务内(WHERE balance >= stake)。
         if (ARB_STAKE_REQUIRED > 0) {
-            const wallet = db.prepare("SELECT balance, staked FROM wallets WHERE user_id = ?").get(userId);
+            const wallet = await dbOne("SELECT balance FROM wallets WHERE user_id = ?", [userId]);
             if (!wallet || wallet.balance < ARB_STAKE_REQUIRED) {
                 return void res.json({ error: `质押需 ${ARB_STAKE_REQUIRED} WAZ，钱包余额不足` });
             }
-            db.prepare("UPDATE wallets SET balance = balance - ?, staked = staked + ? WHERE user_id = ?")
-                .run(ARB_STAKE_REQUIRED, ARB_STAKE_REQUIRED, userId);
         }
-        db.prepare("INSERT INTO arbitrator_applications (id, user_id, status, snapshot) VALUES (?,?,?,?)")
-            .run(generateId('aapp'), userId, 'pending', JSON.stringify(elig.items));
+        const appId = generateId('aapp');
+        // stake 原子段:重检 whitelist/pending(防并发双申请双质押)+ 钱包扣减(守恒 guard)+ INSERT 申请
+        try {
+            db.transaction(() => {
+                if (db.prepare("SELECT 1 FROM arbitrator_whitelist WHERE user_id = ?").get(userId))
+                    throw new Error('ARB_ALREADY');
+                if (db.prepare("SELECT 1 FROM arbitrator_applications WHERE user_id = ? AND status = 'pending'").get(userId))
+                    throw new Error('ARB_PENDING');
+                if (ARB_STAKE_REQUIRED > 0) {
+                    const debit = db.prepare("UPDATE wallets SET balance = balance - ?, staked = staked + ? WHERE user_id = ? AND balance >= ?")
+                        .run(ARB_STAKE_REQUIRED, ARB_STAKE_REQUIRED, userId, ARB_STAKE_REQUIRED);
+                    if (debit.changes === 0)
+                        throw new Error('ARB_INSUFFICIENT');
+                }
+                db.prepare("INSERT INTO arbitrator_applications (id, user_id, status, snapshot) VALUES (?,?,?,?)")
+                    .run(appId, userId, 'pending', JSON.stringify(elig.items));
+            })();
+        }
+        catch (e) {
+            const msg = e.message;
+            if (msg === 'ARB_ALREADY')
+                return void res.json({ error: '你已经是仲裁员，无需重新申请' });
+            if (msg === 'ARB_PENDING')
+                return void res.json({ error: '你已有待审申请' });
+            if (msg === 'ARB_INSUFFICIENT')
+                return void res.json({ error: `质押需 ${ARB_STAKE_REQUIRED} WAZ，钱包余额不足` });
+            console.error('[arbitrator apply tx]', msg);
+            return void res.status(500).json({ error: '申请失败,请重试' });
+        }
         res.json({ success: true, stake_locked: ARB_STAKE_REQUIRED });
     });
-    app.post('/api/arbitrator/withdraw-application', (req, res) => {
+    app.post('/api/arbitrator/withdraw-application', async (req, res) => {
         const user = auth(req, res);
         if (!user)
             return;
         const userId = user.id;
-        const pending = db.prepare("SELECT id FROM arbitrator_applications WHERE user_id = ? AND status = 'pending' LIMIT 1").get(userId);
+        const pending = await dbOne("SELECT id FROM arbitrator_applications WHERE user_id = ? AND status = 'pending' LIMIT 1", [userId]);
         if (!pending)
             return void res.json({ error: '没有待审申请' });
-        db.prepare("UPDATE arbitrator_applications SET status='withdrawn', reviewed_at=datetime('now') WHERE id = ?").run(pending.id);
-        if (ARB_STAKE_REQUIRED > 0) {
-            db.prepare("UPDATE wallets SET balance = balance + ?, staked = staked - ? WHERE user_id = ?")
-                .run(ARB_STAKE_REQUIRED, ARB_STAKE_REQUIRED, userId);
+        // 原子段:CAS 翻转 pending→withdrawn(防并发/admin 抢跑双退)+ 退质押仅在本请求真翻转时
+        try {
+            db.transaction(() => {
+                const cas = db.prepare("UPDATE arbitrator_applications SET status='withdrawn', reviewed_at=datetime('now') WHERE id = ? AND status = 'pending'").run(pending.id);
+                if (cas.changes === 0)
+                    throw new Error('ARB_RACE');
+                if (ARB_STAKE_REQUIRED > 0) {
+                    db.prepare("UPDATE wallets SET balance = balance + ?, staked = staked - ? WHERE user_id = ?").run(ARB_STAKE_REQUIRED, ARB_STAKE_REQUIRED, userId);
+                }
+            })();
+        }
+        catch (e) {
+            if (e.message === 'ARB_RACE')
+                return void res.status(409).json({ error: '申请状态已变化,请刷新' });
+            console.error('[arbitrator withdraw tx]', e.message);
+            return void res.status(500).json({ error: '撤回失败,请重试' });
         }
         res.json({ success: true });
     });
     // Admin
-    app.get('/api/admin/arbitrator-applications', (req, res) => {
+    app.get('/api/admin/arbitrator-applications', async (req, res) => {
         const admin = requireArbitrationAdmin(req, res);
         if (!admin)
             return;
         const status = String(req.query.status || 'pending');
-        const items = db.prepare(`
+        const items = await dbAll(`
       SELECT aa.*, u.name as user_name, u.handle, u.region
       FROM arbitrator_applications aa
       JOIN users u ON u.id = aa.user_id
       WHERE aa.status = ?
       ORDER BY aa.applied_at DESC LIMIT 100
-    `).all(status);
+    `, [status]);
         res.json({ items });
     });
-    app.post('/api/admin/arbitrator-applications/:id/approve', (req, res) => {
+    app.post('/api/admin/arbitrator-applications/:id/approve', async (req, res) => {
         const admin = requireArbitrationAdmin(req, res);
         if (!admin)
             return;
         const { note } = req.body;
-        const appRow = db.prepare("SELECT id, user_id, status FROM arbitrator_applications WHERE id = ?").get(req.params.id);
+        const appRow = await dbOne("SELECT id, user_id, status FROM arbitrator_applications WHERE id = ?", [req.params.id]);
         if (!appRow)
             return void res.json({ error: '申请不存在' });
         if (appRow.status !== 'pending')
             return void res.json({ error: '该申请不在待审状态' });
-        db.prepare("UPDATE arbitrator_applications SET status='approved', reviewed_at=datetime('now'), reviewed_by=?, decision_note=? WHERE id=?")
-            .run(admin.id, note || null, appRow.id);
-        db.prepare(`INSERT OR REPLACE INTO arbitrator_whitelist (user_id, note, is_system, granted_by, stake_amount) VALUES (?,?,0,?,?)`)
-            .run(appRow.user_id, note || '外部仲裁员批准', admin.id, ARB_STAKE_REQUIRED);
+        // 原子段:CAS 翻转 pending→approved + 入白名单仅在本请求真翻转时(防并发双批准)
+        try {
+            db.transaction(() => {
+                const cas = db.prepare("UPDATE arbitrator_applications SET status='approved', reviewed_at=datetime('now'), reviewed_by=?, decision_note=? WHERE id=? AND status='pending'")
+                    .run(admin.id, note || null, appRow.id);
+                if (cas.changes === 0)
+                    throw new Error('ARB_RACE');
+                db.prepare(`INSERT OR REPLACE INTO arbitrator_whitelist (user_id, note, is_system, granted_by, stake_amount) VALUES (?,?,0,?,?)`)
+                    .run(appRow.user_id, note || '外部仲裁员批准', admin.id, ARB_STAKE_REQUIRED);
+            })();
+        }
+        catch (e) {
+            if (e.message === 'ARB_RACE')
+                return void res.json({ error: '该申请不在待审状态' });
+            console.error('[arbitrator approve tx]', e.message);
+            return void res.status(500).json({ error: '批准失败,请重试' });
+        }
         logAdminAction(admin.id, 'approve_arbitrator', 'user', appRow.user_id, { note });
         res.json({ success: true });
     });
-    app.post('/api/admin/arbitrator-applications/:id/reject', (req, res) => {
+    app.post('/api/admin/arbitrator-applications/:id/reject', async (req, res) => {
         const admin = requireArbitrationAdmin(req, res);
         if (!admin)
             return;
         const { note } = req.body;
-        const appRow = db.prepare("SELECT id, user_id, status FROM arbitrator_applications WHERE id = ?").get(req.params.id);
+        const appRow = await dbOne("SELECT id, user_id, status FROM arbitrator_applications WHERE id = ?", [req.params.id]);
         if (!appRow)
             return void res.json({ error: '申请不存在' });
         if (appRow.status !== 'pending')
             return void res.json({ error: '该申请不在待审状态' });
-        db.prepare("UPDATE arbitrator_applications SET status='rejected', reviewed_at=datetime('now'), reviewed_by=?, decision_note=? WHERE id=?")
-            .run(admin.id, note || null, appRow.id);
-        if (ARB_STAKE_REQUIRED > 0) {
-            db.prepare("UPDATE wallets SET balance = balance + ?, staked = staked - ? WHERE user_id = ?")
-                .run(ARB_STAKE_REQUIRED, ARB_STAKE_REQUIRED, appRow.user_id);
+        // 原子段:CAS 翻转 pending→rejected + 退质押仅在本请求真翻转时(防并发双拒双退)
+        try {
+            db.transaction(() => {
+                const cas = db.prepare("UPDATE arbitrator_applications SET status='rejected', reviewed_at=datetime('now'), reviewed_by=?, decision_note=? WHERE id=? AND status='pending'")
+                    .run(admin.id, note || null, appRow.id);
+                if (cas.changes === 0)
+                    throw new Error('ARB_RACE');
+                if (ARB_STAKE_REQUIRED > 0) {
+                    db.prepare("UPDATE wallets SET balance = balance + ?, staked = staked - ? WHERE user_id = ?").run(ARB_STAKE_REQUIRED, ARB_STAKE_REQUIRED, appRow.user_id);
+                }
+            })();
+        }
+        catch (e) {
+            if (e.message === 'ARB_RACE')
+                return void res.json({ error: '该申请不在待审状态' });
+            console.error('[arbitrator reject tx]', e.message);
+            return void res.status(500).json({ error: '拒绝失败,请重试' });
         }
         logAdminAction(admin.id, 'reject_arbitrator', 'user', appRow.user_id, { note });
         res.json({ success: true });