@seasonkoh/webaz 0.1.28 → 0.1.30

package/dist/pwa/routes/orders-action.js

@@ -1,6 +1,27 @@
-import { dbOne, dbAll } from '../../layer0-foundation/L0-1-database/db.js';
+import { dbOne, dbAll, dbRun } from '../../layer0-foundation/L0-1-database/db.js';
+import { createNotification } from '../../layer2-business/L2-6-notifications/notification-engine.js';
+import { releaseFeeStake } from '../../direct-pay-ledger.js'; // Rail1 直付:取消/超时释放任何遗留模拟质押(AR 订单无 stake → no-op)
+import { restorePreShipDirectPayStock } from '../../direct-pay-stock.js'; // D3 库存回补唯一入口(pre-ship 放行;已出库拒绝)
+import { requireBothDisclosuresAcked } from '../../direct-pay-disclosures.js'; // PR-4e: D1/D2 披露契约门
+import { requireDirectPayHumanPasskey } from '../direct-pay-guards.js'; // PR-4e: 现场真人 Passkey/gate-token 门
 export function registerOrdersActionRoutes(app, deps) {
-    const { db, auth, isTrustedRole, generateId, transition, notifyTransition, settleOrder, settleFault, detectFraud, createDispute, checkTimeouts, recordViolationReputation, broadcastSystemEvent } = deps;
+    const { db, auth, isTrustedRole, generateId, transition, notifyTransition, settleOrder, settleFault, detectFraud, createDispute, checkTimeouts, recordViolationReputation, broadcastSystemEvent, consumeGateToken } = deps;
+    // PR-4e: direct_p2p 风险动作门 —— ① D1/D2 两次披露都 ack(缺则 DISCLOSURE_NOT_ACKED);② 现场真人 Passkey + 一次性
+    //   WebAuthn gate token(purpose 固定 direct_pay_order_action,order+action 走 purpose_data + validate)。
+    //   纯前置门:返回 ok 才允许后续写入。【先 disclosure(只读)再 Passkey(消费 token)】→ 缺 ack 不浪费 token。
+    //   调用方必须在【任何写入前 + 只读状态预检之后】调用,避免错误状态消耗 token。
+    function directPayActionGate(orderId, action, userId, webauthnToken) {
+        const disc = requireBothDisclosuresAcked(db, orderId);
+        if (!disc.ok)
+            return { ok: false, status: 409, error: disc.reason || '需先完成两次风险披露确认', error_code: disc.error_code || 'DISCLOSURE_NOT_ACKED' };
+        const gate = requireDirectPayHumanPasskey({ db, consumeGateToken }, {
+            userId, webauthnToken, purpose: 'direct_pay_order_action',
+            validate: (data) => { const d = data; return !!d && d.order_id === orderId && d.action === action; },
+        });
+        if (!gate.ok)
+            return { ok: false, status: 403, error: gate.reason || '需现场真人 Passkey 确认', error_code: gate.error_code || 'HUMAN_PRESENCE_REQUIRED' };
+        return { ok: true };
+    }
     // RFC-007 stage 2：卖家主动拒单 reason_code 白名单。
     //   classification(客观无责 vs 主观有责)是 stage 3 auto-verify 的事;stage 2 仅捕获 + 一律走违约结算。
     //   objective-claimed(stage 3 将尝试确定性核验):stock_consumed_concurrent / stale_price_snapshot / force_majeure
@@ -84,32 +105,47 @@ export function registerOrdersActionRoutes(app, deps) {
         // RFC-016: 校验读 → 异步 seam;下方 completed+history 写仍是同步 db.transaction(Phase 3 迁 pg 事务)
         const order = await dbOne('SELECT * FROM orders WHERE id = ?', [req.params.id]);
         if (!order)
-            return void res.status(404).json({ error: '订单不存在' });
+            return void res.status(404).json({ error: '订单不存在', error_code: 'ORDER_NOT_FOUND' });
         if (order.fulfillment_mode !== 'in_person')
-            return void res.status(400).json({ error: '该订单非面交' });
+            return void res.status(400).json({ error: '该订单非面交', error_code: 'NOT_IN_PERSON' });
         if (order.buyer_id !== user.id)
-            return void res.status(403).json({ error: '仅买家可确认面交完成' });
+            return void res.status(403).json({ error: '仅买家可确认面交完成', error_code: 'NOT_ORDER_BUYER' });
         if (!['paid', 'accepted'].includes(order.status))
-            return void res.status(400).json({ error: `订单状态 ${order.status} 不可确认面交` });
+            return void res.status(400).json({ error: `订单状态 ${order.status} 不可确认面交`, error_code: 'NOT_CONFIRMABLE_IN_PERSON' });
         if (order.has_pending_claim)
-            return void res.status(400).json({ error: '存在进行中的验证任务，不可确认' });
+            return void res.status(400).json({ error: '存在进行中的验证任务，不可确认', error_code: 'HAS_PENDING_CLAIM' });
+        // Rail1:平台费已切换为链下应收(accrue 在完成结算时,与 completed 同一原子边界,fail-closed)。
+        //   建单不再锁 fee-stake,故【不再】前置要求 locked stake(AR 订单本就无 stake)。
+        const isDirectP2p = order.payment_rail === 'direct_p2p';
+        // PR-4e:direct_p2p 面交完成 = RISK 动作 → 两次披露门 + 现场真人 Passkey 门。
+        if (isDirectP2p) {
+            const g = directPayActionGate(req.params.id, 'confirm_in_person', user.id, req.body?.webauthn_token);
+            if (!g.ok)
+                return void res.status(g.status).json({ error: g.error, error_code: g.error_code });
+        }
         const tx = db.transaction(() => {
             db.prepare(`UPDATE orders SET status='completed', updated_at=datetime('now') WHERE id = ?`).run(req.params.id);
             db.prepare(`INSERT INTO order_state_history (id, order_id, from_status, to_status, actor_id, actor_role, notes)
         VALUES (?,?,?,?,?,?, '面交完成 — 买家确认')`)
                 .run(generateId('hst'), req.params.id, order.status, 'completed', user.id, user.role || 'buyer');
+            // direct_p2p:取平台费进同一事务 → 取费失败(缺 locked stake)回滚 completed,订单不会 terminal-completed 而费用落空。
+            if (isDirectP2p)
+                settleOrder(req.params.id);
         });
         try {
             tx();
         }
         catch (e) {
-            return void res.status(500).json({ error: '状态写入失败：' + e.message });
-        }
-        try {
-            settleOrder(req.params.id);
+            return void res.status(isDirectP2p ? 409 : 500).json({ error: (isDirectP2p ? '直付完成结算失败,订单未完成：' : '状态写入失败：') + e.message, ...(isDirectP2p ? { error_code: 'DIRECT_PAY_SETTLE_FAILED' } : {}) });
         }
-        catch (e) {
-            console.error('[settleOrder in-person]', e);
+        // escrow:沿用原有非原子结算(失败仅记日志,不回滚 completed —— 与既有行为一致,本次不改 escrow)。
+        if (!isDirectP2p) {
+            try {
+                settleOrder(req.params.id);
+            }
+            catch (e) {
+                console.error('[settleOrder in-person]', e);
+            }
         }
         res.json({ success: true });
     });
@@ -121,7 +157,8 @@ export function registerOrdersActionRoutes(app, deps) {
         // P0 fix: 受信角色禁交易
         if (isTrustedRole(user))
             return void res.status(403).json({ error: '受信角色不可参与订单流转', error_code: 'TRUSTED_ROLE_NO_TRADE' });
-        const { action, notes = '', evidence_description = '', logistics_company_id = '' } = req.body;
+        const { action, evidence_description = '', logistics_company_id = '' } = req.body;
+        let notes = String(req.body?.notes ?? '').slice(0, 500); // 服务端硬界:附言/备注最长 500 字符;mark_paid 时被服务端权威付款参考覆盖(见下)
         // RFC-016: 顶层校验读 → 异步 seam;state-machine / settle / decline 写序列仍同步(Phase 3 迁 pg 行锁+事务)
         const order = await dbOne('SELECT * FROM orders WHERE id = ?', [req.params.id]);
         if (!order)
@@ -137,6 +174,98 @@ export function registerOrdersActionRoutes(app, deps) {
         if (action === 'confirm' && uid !== buyerId) {
             return void res.status(403).json({ error: '你不是本订单的买家', error_code: 'NOT_ORDER_BUYER' });
         }
+        // Rail1 直付:买家专属动作。mark_paid = 买家声明"我已付款"→ accepted(进卖家发货流程);
+        //   cancel = 付款前买家取消 → cancelled(释放费用质押)。仅 buyer、仅 direct_p2p 且仍在付款窗口。
+        if (action === 'mark_paid' || action === 'cancel') {
+            if (uid !== buyerId) {
+                return void res.status(403).json({ error: '你不是本订单的买家', error_code: 'NOT_ORDER_BUYER' });
+            }
+            // 买家取消:付款窗口内(未付/后悔)/ 货款协商阶段(承认未付)/ 付款窗过期宽限期(确认未付,免等 48h 自动关单 ——
+            //   审计项 H:状态机本就允许 buyer direct_expired_unconfirmed→cancelled,此 guard 曾与状态机矛盾=死能力)。mark_paid 仍仅付款窗口。
+            const cancelInQuery = action === 'cancel' && ['payment_query', 'direct_expired_unconfirmed'].includes(order.status);
+            if (order.payment_rail !== 'direct_p2p' || (order.status !== 'direct_pay_window' && !cancelInQuery)) {
+                return void res.status(409).json({ error: '该操作仅适用于直付订单的付款窗口/过期宽限/协商阶段', error_code: 'NOT_DIRECT_PAY_WINDOW' });
+            }
+        }
+        // ── Rail1 直付货款协商(争议≠仲裁)动作。均仅 direct_p2p + 角色/状态门。PR-B1 人驱动协商 + PR-B2 卖家宽限后请求取消。 ──
+        const PQ_ACTIONS = ['report_nonpayment', 'confirm_received', 'pq_escalate', 'pq_withdraw', 'request_cancel'];
+        if (PQ_ACTIONS.includes(action)) {
+            if (order.payment_rail !== 'direct_p2p')
+                return void res.status(409).json({ error: '该操作仅适用于直付订单', error_code: 'NOT_DIRECT_PAY' });
+            if ((action === 'report_nonpayment' || action === 'confirm_received' || action === 'request_cancel') && uid !== sellerId)
+                return void res.status(403).json({ error: '你不是本订单的卖家', error_code: 'NOT_ORDER_SELLER' });
+            if ((action === 'pq_escalate' || action === 'pq_withdraw') && uid !== buyerId && uid !== sellerId)
+                return void res.status(403).json({ error: '只有买卖双方可操作', error_code: 'NOT_ORDER_PARTY' });
+            if (action === 'report_nonpayment' && order.status !== 'accepted')
+                return void res.status(409).json({ error: `仅可在【待发货(accepted)】阶段报告未收款,当前 ${order.status}`, error_code: 'NOT_ACCEPTED' });
+            if ((action === 'confirm_received' || action === 'pq_escalate' || action === 'request_cancel') && order.status !== 'payment_query')
+                return void res.status(409).json({ error: `仅可在【货款协商(payment_query)】阶段操作,当前 ${order.status}`, error_code: 'NOT_PAYMENT_QUERY' });
+            if (action === 'pq_withdraw') {
+                if (order.status !== 'disputed')
+                    return void res.status(409).json({ error: `仅可在【争议(disputed)】阶段撤回,当前 ${order.status}`, error_code: 'NOT_DISPUTED' });
+                // 已裁定的争议不可撤回(disputed 已终结成 resolved/dismissed 前,dispute.status 仍 open/in_review)
+                const d = await dbOne("SELECT status FROM disputes WHERE order_id = ? ORDER BY created_at DESC LIMIT 1", [req.params.id]);
+                if (d && (d.status === 'resolved' || d.status === 'dismissed'))
+                    return void res.status(409).json({ error: '争议已裁定,不可撤回', error_code: 'DISPUTE_ALREADY_RULED' });
+                // ★ 撤回【仅限货款协商升级】的仲裁:最近一次进入 disputed 必须 from payment_query。
+                //   否则履约类争议(delivered→disputed 货损/货不对版)会被错误撤回、dismiss、状态倒退回 payment_query。fail-closed。
+                const lastDisputed = await dbOne("SELECT from_status FROM order_state_history WHERE order_id = ? AND to_status = 'disputed' ORDER BY created_at DESC, rowid DESC LIMIT 1", [req.params.id]);
+                if (!lastDisputed || lastDisputed.from_status !== 'payment_query')
+                    return void res.status(409).json({ error: '仅可撤回由货款协商升级的仲裁;履约类争议(货损/货不对版)须经仲裁裁定', error_code: 'NOT_PAYMENT_QUERY_DISPUTE' });
+            }
+        }
+        // PR-B2:卖家在【买家响应宽限已过】后请求取消 —— 不立即关单,而是开【N 天买家申诉窗】(payment_query_cancel_deadline)。
+        //   窗内买家仍可 confirm-side/主张已付/升级举证(pq_escalate);窗满由 cron 关单。不动状态,不涉资金。幂等(deadline 已设则不重置)。
+        if (action === 'request_cancel') {
+            const g = await dbOne("SELECT (payment_query_deadline IS NOT NULL AND datetime(payment_query_deadline) < datetime('now')) AS over FROM orders WHERE id = ?", [req.params.id]);
+            if (!g?.over)
+                return void res.status(409).json({ error: '买家响应宽限未到,暂不可请求取消', error_code: 'GRACE_NOT_ELAPSED' });
+            let rd = 7;
+            try {
+                const p = await dbOne("SELECT value FROM protocol_params WHERE key = 'direct_pay.payment_query_recourse_days'");
+                if (p)
+                    rd = Math.max(1, Number(p.value) || 7);
+            }
+            catch { }
+            await dbRun(`UPDATE orders SET payment_query_cancel_deadline = datetime('now', ? ) WHERE id = ? AND payment_query_cancel_deadline IS NULL`, [`+${rd} days`, req.params.id]);
+            const dl = (await dbOne("SELECT payment_query_cancel_deadline d FROM orders WHERE id = ?", [req.params.id]))?.d;
+            try {
+                createNotification(db, order.buyer_id, req.params.id, 'payment_query_cancel_requested', '⏳ 卖家申请取消订单', `卖家称未收到货款且你未回应,已申请取消。你约有 ${rd} 天:若确已付款请提供付款参考或发起举证(pq_escalate),否则订单将于 ${dl} 自动取消。直付非托管,无平台退款。`);
+            }
+            catch { }
+            return void res.json({ success: true, status: 'payment_query', cancel_recourse_deadline: dl });
+        }
+        // PR-4e:mark_paid = direct_p2p RISK 动作(已过 direct_pay_window 只读预检)→ 两次披露门 + 现场真人 Passkey 门。cancel 不门控。
+        if (action === 'mark_paid') {
+            const g = directPayActionGate(req.params.id, 'mark_paid', uid, req.body?.webauthn_token);
+            if (!g.ok)
+                return void res.status(g.status).json({ error: g.error, error_code: g.error_code });
+            // 防作弊 D1:付款参考【服务端权威派生】(与前端 dpPayRef 同算法),忽略客户端可伪造的参考文本 —— UI 已锁只读(#222),
+            //   这里把 API 级也收口:直接 POST 伪造 notes 冒充别单参考号 → 无效。客户端附言仅作补充备注,剥掉任何"付款参考"字样。
+            const canonicalRef = 'WAZ-' + req.params.id.replace(/[^a-zA-Z0-9]/g, '').slice(-8).toUpperCase();
+            const extra = notes.replace(/付款参考[::]?\s*[^\s·;,。]*/g, '').replace(/WAZ-[A-Z0-9]{8}/g, '').trim().slice(0, 120);
+            // 防作弊 D2:同买家·同卖家·同金额的其它在途直付单 → 时间线预警(一笔真实转账冒充两单的重复确认,卖家第一道防线)
+            const dup = await dbOne(`SELECT COUNT(*) n FROM orders WHERE buyer_id = ? AND seller_id = ? AND payment_rail = 'direct_p2p' AND total_amount = ? AND id != ? AND status IN ('accepted','shipped','picked_up','in_transit','delivered')`, [buyerId, sellerId, order.total_amount, req.params.id]);
+            // 审计项 E:时间线带上应付金额(下单冻结的参考换算)—— 卖家对账三要素:参考号 + 金额 + 币种,与买家所见同一数字
+            let payable = `应付 ${order.total_amount} USDC`;
+            try {
+                const ps = JSON.parse(order.direct_pay_account_snapshot || '{}');
+                if (Number.isFinite(Number(ps?.payable_approx)) && ps?.payable_currency)
+                    payable += `（≈${ps.payable_currency} ${Number(ps.payable_approx).toFixed(2)},下单时参考价）`;
+            }
+            catch { /* 快照缺失/坏 → 仅 USDC */ }
+            notes = `付款参考: ${canonicalRef} · ${payable}${extra ? ' · ' + extra : ''}${(dup?.n || 0) > 0 ? ` ⚠️ 同买家另有 ${dup.n} 笔同金额直付订单在途,请逐单核对付款参考再发货` : ''}`;
+        }
+        // Rail1:平台费链下应收,accrue 在完成结算时(settleOrder direct_p2p 分支)与 completed 同一原子边界、fail-closed
+        //   (accrueFeeReceivable 缺费即抛 → 回滚 completed)。故【不再】前置要求 locked fee-stake。
+        // PR-4e:direct_p2p confirm = RISK 动作。先【只读状态预检】(仅 delivered 可确认收货,杜绝错误状态消耗 token),再两次披露门 + 现场真人 Passkey 门。
+        if (action === 'confirm' && order.payment_rail === 'direct_p2p') {
+            if (order.status !== 'delivered')
+                return void res.status(409).json({ error: `订单状态 ${order.status} 不可确认收货(仅 delivered)`, error_code: 'ORDER_NOT_DELIVERED' });
+            const g = directPayActionGate(req.params.id, 'confirm', uid, req.body?.webauthn_token);
+            if (!g.ok)
+                return void res.status(g.status).json({ error: g.error, error_code: g.error_code });
+        }
         if (action === 'pickup' || action === 'transit' || action === 'deliver') {
             // pickup 时若订单尚无物流，允许领取（孤儿单兜底）
             const isOrphanPickup = action === 'pickup' && !logisticsId;
@@ -254,9 +383,85 @@ export function registerOrdersActionRoutes(app, deps) {
                 note: '已就客观无责拒单发起人工仲裁举证。自动终结已暂停,等待仲裁员裁决:维持→免责全退+退质押,驳回→违约结算。',
             });
         }
+        // Rail1 直付:付款窗口内买家取消 → cancelled + 释放费用质押(单事务:转移成功必同步放质押,
+        //   杜绝"已取消但质押漏放"泄漏 —— cancelled 单超时 cron 不再扫,放质押无后备路径,故必须原子)。
+        if (action === 'cancel') {
+            const fromStatusCancel = order.status;
+            try {
+                db.transaction(() => {
+                    const r = transition(db, req.params.id, 'cancelled', uid, [], notes);
+                    if (!r.success)
+                        throw new Error(r.error || '状态转移失败');
+                    releaseFeeStake(db, { orderId: req.params.id });
+                    // D3 库存回补:经唯一守卫入口(仅 pre-ship 来源放行;已出库走退货验收,绝不直接回补 —— 见 direct-pay-stock.ts 情形矩阵)
+                    restorePreShipDirectPayStock(db, { fromStatus: fromStatusCancel, productId: order.product_id, quantity: Number(order.quantity) || 1 });
+                })();
+            }
+            catch (e) {
+                return void res.status(409).json({ error: e.message, error_code: 'CANCEL_FAILED' });
+            }
+            notifyTransition(db, req.params.id, fromStatusCancel, 'cancelled');
+            return void res.json({ success: true, status: 'cancelled', fee_stake_released: true });
+        }
+        // 争议协商收口(买家侧):买家撤诉并确认收货 —— 限【delivered 来源履约争议 + 争议发起人本人 + 裁定前】。
+        //   为什么存在:买家发起"未收到货"争议后包裹晚到/找到代收点,双方合意收口不该只剩仲裁(卖家侧收口=协商取消)。
+        //   货款争议(payment_query 来源)不走这里 —— 那是 pq_withdraw 的撤回语义(回协商,不确认收货)。
+        //   全原子(Codex P1 模式):争议 dismissed + disputed→confirmed→completed + settleOrder 同一 db.transaction,
+        //   任一步失败整体回滚(订单仍 disputed、争议仍 open,可重试);两轨同块(escrow 释放托管货款,dp 计提平台费)。
+        if (action === 'dispute_withdraw_confirm') {
+            if (uid !== buyerId)
+                return void res.status(403).json({ error: '你不是本订单的买家', error_code: 'NOT_ORDER_BUYER' });
+            if (order.status !== 'disputed')
+                return void res.status(409).json({ error: `订单状态 ${order.status} 不可撤诉确认收货(仅争议中)`, error_code: 'ORDER_NOT_DISPUTED' });
+            // RFC-016:两条纯预检读 → 异步 seam;事务内的 disputes UPDATE + transition + settle 写序列仍同步(原子性)
+            const dsp = await dbOne("SELECT id, initiator_id FROM disputes WHERE order_id = ? AND status IN ('open','in_review') ORDER BY created_at DESC, rowid DESC LIMIT 1", [req.params.id]);
+            if (!dsp)
+                return void res.status(409).json({ error: '争议已裁定或不存在,不可撤诉', error_code: 'DISPUTE_ALREADY_RULED' });
+            if (dsp.initiator_id !== uid)
+                return void res.status(403).json({ error: '仅争议发起人可撤诉', error_code: 'NOT_DISPUTE_INITIATOR' });
+            const lastDisputedFrom = await dbOne("SELECT from_status FROM order_state_history WHERE order_id = ? AND to_status = 'disputed' ORDER BY created_at DESC, rowid DESC LIMIT 1", [req.params.id]);
+            if (lastDisputedFrom?.from_status !== 'delivered') {
+                return void res.status(409).json({ error: '仅"已投递后未收到货/货有问题"类争议可撤诉确认收货;货款争议请用"撤回仲裁·回到协商"', error_code: 'NOT_FULFILMENT_DISPUTE' });
+            }
+            // dp = RISK 动作(确认收货即完成结算、计提平台费):所有只读预检过后才消费 Passkey token(与 confirm 同门)
+            if (order.payment_rail === 'direct_p2p') {
+                const g = directPayActionGate(req.params.id, 'dispute_withdraw_confirm', uid, req.body?.webauthn_token);
+                if (!g.ok)
+                    return void res.status(g.status).json({ error: g.error, error_code: g.error_code });
+            }
+            try {
+                db.transaction(() => {
+                    db.prepare("UPDATE disputes SET status = 'dismissed', verdict_reason = ?, resolved_at = datetime('now') WHERE id = ? AND status IN ('open','in_review')")
+                        .run(notes ? `买家撤诉并确认收货:${notes}` : '买家撤诉并确认收货', dsp.id);
+                    const r1 = transition(db, req.params.id, 'confirmed', uid, [], notes);
+                    if (!r1.success)
+                        throw new Error(r1.error || 'confirmed transition failed');
+                    const r2 = transition(db, req.params.id, 'completed', 'sys_protocol', [], '系统自动结算');
+                    if (!r2.success)
+                        throw new Error(r2.error || 'completed transition failed');
+                    settleOrder(req.params.id);
+                })();
+            }
+            catch (e) {
+                return void res.status(409).json({ error: `撤诉确认收货失败,订单未变更(仍在争议中,可重试):${e.message}`, error_code: 'DISPUTE_CLOSE_SETTLE_FAILED' });
+            }
+            notifyTransition(db, req.params.id, 'confirmed', 'completed');
+            try {
+                createNotification(db, sellerId, req.params.id, 'dispute_withdrawn_confirmed', '✅ 买家已撤诉并确认收货', '买家撤回争议并确认收货,订单已完成结算,双方信誉不受影响。', { templateKey: 'dispute_withdrawn_confirmed', params: {} });
+            }
+            catch { /* 通知失败不阻断 */ }
+            try {
+                broadcastSystemEvent('order_completed', '✓', `订单完成 ${req.params.id}`, req.params.id);
+            }
+            catch { }
+            return void res.json({ success: true, status: 'completed', dispute_dismissed: true });
+        }
         const actionMap = {
             accept: 'accepted', ship: 'shipped', pickup: 'picked_up',
-            transit: 'in_transit', deliver: 'delivered', confirm: 'confirmed', dispute: 'disputed'
+            transit: 'in_transit', deliver: 'delivered', confirm: 'confirmed', dispute: 'disputed',
+            mark_paid: 'accepted', // Rail1 直付:买家声明"我已付款" → accepted(汇入既有卖家发货流程;协议不验真实付款)
+            // Rail1 货款协商:卖家报未收款→协商;卖家确认已收→恢复;升级→举证仲裁;撤回→回协商(pq_withdraw 由上方原子块 early-return 处理,列此仅为通过 !toStatus 校验)。
+            report_nonpayment: 'payment_query', confirm_received: 'accepted', pq_escalate: 'disputed', pq_withdraw: 'payment_query',
         };
         const toStatus = actionMap[action];
         if (!toStatus)
@@ -270,11 +475,84 @@ export function registerOrdersActionRoutes(app, deps) {
         VALUES (?,?,?,'description',?,?,?)`).run(eid, req.params.id, user.id, evidence_description, `hash_${Date.now()}`, evReasons.length ? JSON.stringify(evReasons) : null);
             evidenceIds.push(eid);
         }
+        // Rail1 全原子(Codex P1):direct_p2p confirm 必须把 delivered→confirmed→completed→settle/accrue 包进【同一 db.transaction】。
+        //   否则 delivered→confirmed 先单独提交、随后 accrue 失败 → 订单卡在 confirmed(retry 被 ORDER_NOT_DELIVERED 拒)。
+        //   任一步失败 → 整体回滚到 delivered(可重试);成功后再发通知。confirm-in-person 是另一端点、已单事务原子。
+        if (action === 'confirm' && order.payment_rail === 'direct_p2p') {
+            try {
+                db.transaction(() => {
+                    const r1 = transition(db, req.params.id, 'confirmed', user.id, evidenceIds, notes);
+                    if (!r1.success)
+                        throw new Error(r1.error || 'confirmed transition failed');
+                    const r2 = transition(db, req.params.id, 'completed', 'sys_protocol', [], '系统自动结算');
+                    if (!r2.success)
+                        throw new Error(r2.error || 'completed transition failed');
+                    settleOrder(req.params.id); // direct_p2p 分支:释放遗留模拟 stake + accrueFeeReceivable(fail-closed)
+                })();
+            }
+            catch (e) {
+                return void res.status(409).json({ error: `直付完成结算失败,订单未完成(仍停在 delivered,可重试):${e.message}`, error_code: 'DIRECT_PAY_SETTLE_FAILED' });
+            }
+            notifyTransition(db, req.params.id, 'delivered', 'confirmed');
+            notifyTransition(db, req.params.id, 'confirmed', 'completed');
+            try {
+                broadcastSystemEvent('order_completed', '✓', `订单完成 ${req.params.id}`, req.params.id);
+            }
+            catch { }
+            return void res.json({ success: true, status: 'completed', settlement: { rail: 'direct_p2p', fee_accrued: true } });
+        }
+        // Rail1 撤回仲裁:disputed→payment_query + 【同一事务】关闭活跃 dispute(否则订单回协商但仲裁视图仍见活跃争议 → 脏状态,
+        //   仲裁员可能对已回协商的单裁定)。原子后重建买家响应宽限,让 PR-B2 的宽限/超时 cron 有截止时间可依赖。
+        if (action === 'pq_withdraw') {
+            try {
+                db.transaction(() => {
+                    const r = transition(db, req.params.id, 'payment_query', user.id, [], notes);
+                    if (!r.success)
+                        throw new Error(r.error || 'withdraw transition failed');
+                    db.prepare("UPDATE disputes SET status = 'dismissed', verdict_reason = COALESCE(verdict_reason, '撤回仲裁,回到协商'), resolved_at = datetime('now') WHERE order_id = ? AND status IN ('open', 'in_review')").run(req.params.id);
+                })();
+            }
+            catch (e) {
+                return void res.status(409).json({ error: `撤回仲裁失败:${e.message}`, error_code: 'WITHDRAW_FAILED' });
+            }
+            let gh = 72;
+            try {
+                const p = await dbOne("SELECT value FROM protocol_params WHERE key = 'direct_pay.payment_query_grace_hours'");
+                if (p)
+                    gh = Math.max(1, Number(p.value) || 72);
+            }
+            catch { }
+            await dbRun(`UPDATE orders SET payment_query_deadline = datetime('now', ? ), payment_query_cancel_deadline = NULL WHERE id = ?`, [`+${gh} hours`, req.params.id]);
+            notifyTransition(db, req.params.id, 'disputed', 'payment_query');
+            return void res.json({ success: true, status: 'payment_query', dispute_withdrawn: true });
+        }
         const fromStatus = order.status;
         const result = transition(db, req.params.id, toStatus, user.id, evidenceIds, notes);
         if (!result.success)
             return void res.json({ error: result.error });
         notifyTransition(db, req.params.id, fromStatus, toStatus);
+        // 审计项 B(N2):买家标记付款 → 通知卖家核款发货(direct_pay_window→accepted 不在 notifyTransition RULES,
+        //   此前卖家全程收不到"已付款"信号只能手动刷)。notes 即 D1/D2/E 的权威对账串(参考号+应付+多单预警),直接复用。
+        if (action === 'mark_paid') {
+            try {
+                createNotification(db, sellerId, req.params.id, 'direct_pay_marked_paid', '💰 买家已标记付款,请核对后发货', `${notes}。请核对银行/收款App流水后再发货;未收到请点"未收到货款"。`, { templateKey: 'dp_marked_paid', params: { detail: notes } });
+            }
+            catch { /* 通知失败不阻断 */ }
+        }
+        // Rail1 货款协商:卖家报未收款 → 设买家响应宽限(PR-B2 卖家据此才可请求取消);确认已收/升级 → 清协商截止。
+        if (action === 'report_nonpayment') {
+            let gh = 72;
+            try {
+                const p = await dbOne("SELECT value FROM protocol_params WHERE key = 'direct_pay.payment_query_grace_hours'");
+                if (p)
+                    gh = Math.max(1, Number(p.value) || 72);
+            }
+            catch { }
+            await dbRun(`UPDATE orders SET payment_query_deadline = datetime('now', ? ) WHERE id = ?`, [`+${gh} hours`, req.params.id]);
+        }
+        if (action === 'confirm_received' || action === 'pq_escalate') {
+            await dbRun(`UPDATE orders SET payment_query_deadline = NULL, payment_query_cancel_deadline = NULL WHERE id = ?`, [req.params.id]);
+        }
         if (toStatus === 'disputed') {
             createDispute(db, req.params.id, user.id, notes || evidence_description || '买家发起争议', evidenceIds);
             try {
@@ -292,6 +570,7 @@ export function registerOrdersActionRoutes(app, deps) {
         let settlementBreakdown = null;
         if (toStatus === 'confirmed') {
             const sysUser = db.prepare("SELECT id FROM users WHERE id = 'sys_protocol'").get();
+            // direct_p2p confirm 已在上方【全原子早返回块】处理(delivered→confirmed→completed→settle 同一 tx);此处仅 escrow。
             transition(db, req.params.id, 'completed', sysUser.id, [], '系统自动结算');
             notifyTransition(db, req.params.id, 'confirmed', 'completed');
             settleOrder(req.params.id);
@@ -339,7 +618,9 @@ export function registerOrdersActionRoutes(app, deps) {
                             reserveByKind.escrow_expired = round2(Number(r.s));
                     }
                     const redirectedToCommissionReserve = round2(reserveByKind.region_cap + reserveByKind.chain_gap + reserveByKind.orphan_sponsor + reserveByKind.opt_out_deactivated + reserveByKind.escrow_expired);
-                    const escrowRow = (await dbOne("SELECT COALESCE(SUM(amount),0) AS s FROM pending_commission_escrow WHERE order_id = ? AND status = 'pending'", [req.params.id]));
+                    // RFC-018: matures_at IS NULL = opt-out escrow only; clearing rows (matures_at NOT NULL) are
+                    // surfaced separately (PR3), not mislabeled as opt-out escrow here.
+                    const escrowRow = (await dbOne("SELECT COALESCE(SUM(amount),0) AS s FROM pending_commission_escrow WHERE order_id = ? AND status = 'pending' AND matures_at IS NULL", [req.params.id]));
                     const heldInOptOutEscrow = round2(Number(escrowRow.s));
                     // QA 轮 9.5 P2：payouts 表只 MCP legacy 写，PWA settleOrder 直更 wallet.balance 不写 payouts
                     // 改用公式推算 sellerAmount（跟 PWA settleOrder 内部计算一致），更可靠

package/dist/pwa/routes/orders-create.js

@@ -1,7 +1,11 @@
 import { buildCartMandate, buildPaymentMandate, signMandate } from './ap2-mandate.js';
 // RFC-014 PR3 — 金额走整数 base-units;钱包写绝对值(防 REAL 浮点加法 dust)。
 import { toUnits, toDecimal, mulQty, mulRate } from '../../money.js';
+import { createDirectPayResponse } from '../../direct-pay-create.js'; // PR-4c: direct_p2p 建单分叉(生产门+收款指令门+原子建单;本金不入协议)
 import { applyWalletDelta } from '../../ledger.js';
+import { gateShippingForCreate } from '../../shipping-templates.js';
+import { buildTradeTermsSnapshot, writeTradeTermsSnapshot } from '../../trade-terms.js';
+import { gateSaleRegionForCreate } from '../../sale-regions.js'; // PR-2 运费守门 + S0 条款快照 + S1 可售门(意愿/合规先于物流)
 import { dbOne } from '../../layer0-foundation/L0-1-database/db.js'; // RFC-016 异步 DB seam(仅下单事务外的预检查;事务内 escrow/INSERT 保持同步)
 // 店铺推荐 → 商品三级归因的【懒升级】(sync,跑在下单事务内、getProductShareChain 之前)。
 // 严格门槛(任一不满足则不升级,绝不覆盖已有有效直接归因):
@@ -228,7 +232,12 @@ export function registerOrdersCreateRoutes(app, deps) {
         const priceAfterCouponU = Math.max(0, subtotalU - toUnits(couponDiscount));
         const insuranceRate = getProtocolParam('order_insurance_rate', 0.01);
         const insurancePremiumU = buy_insurance ? mulRate(priceAfterCouponU, insuranceRate) : 0;
-        const totalAmountU = Math.max(0, priceAfterCouponU + insurancePremiumU);
+        if (!gateSaleRegionForCreate(db, res, product, String(product.seller_uid), req.body?.ship_to_region, getProtocolParam))
+            return;
+        const _ship = gateShippingForCreate(db, res, product, String(product.seller_uid), req.body?.ship_to_region, String(req.body?.payment_rail || '') === 'direct_p2p' ? 'direct_p2p' : 'escrow', priceAfterCouponU);
+        if (!_ship)
+            return; // PR-2 运费模板:有模板必选地区且须命中(400/409 已写);无模板=原行为
+        const totalAmountU = Math.max(0, priceAfterCouponU + insurancePremiumU + _ship.feeU); // 运费并入总额(与保险费同惯例;快照 orders.shipping_fee)
         // B5 主动捐赠 — 按订单总额 × 比例算（额外扣款，进 charity_fund）
         const donationAmountU = donationPctNum > 0 ? mulRate(totalAmountU, donationPctNum) : 0;
         // decimal 视图(落库 / 下游 AP2 / 响应,均为 base-unit 干净值)
@@ -236,6 +245,10 @@ export function registerOrdersCreateRoutes(app, deps) {
         const insurancePremium = toDecimal(insurancePremiumU);
         const totalAmount = toDecimal(totalAmountU);
         const donationAmount = toDecimal(donationAmountU);
+        const shippingFee = toDecimal(_ship.feeU);
+        // PR-4c:direct_p2p 分叉 —— 本金不入协议,跳过下方 escrow 预检/事务,改走直付建单(生产门+收款指令门+原子建单,仅锁卖家 fee-stake)。
+        if (String(req.body?.payment_rail || '') === 'direct_p2p')
+            return void createDirectPayResponse(res, db, { generateId, transition, appendOrderEvent, getProtocolParam }, { product, buyerId: user.id, reqQty, basePrice, totalAmount, totalAmountU, shippingAddress: String(shipping_address), directReceiveAccountId: (typeof req.body?.direct_receive_account_id === 'string' && req.body.direct_receive_account_id) ? String(req.body.direct_receive_account_id) : undefined, opts: { variantId: variant_id, hasVariants: Number(product.has_variants) === 1, flashActive: !!flashSale, couponCode: coupon_code, buyInsurance: !!buy_insurance, donationPct: donationPctNum, isGift: !!is_gift, anonymous: anonymousFlag === 1, deliveryWindow: !!delivery_window }, shipping: { region: _ship.region, fee: _ship.fee, estDays: _ship.estDays, quoteRequired: _ship.quoteRequired, freeThresholdApplied: _ship.freeThresholdApplied } });
         // 友好预检查(读):真正的守恒在下面的同步事务内(applyWalletDelta 绝对值落库)。
         const wallet = await dbOne('SELECT balance FROM wallets WHERE user_id = ?', [user.id]);
         if (!wallet)
@@ -245,6 +258,7 @@ export function registerOrdersCreateRoutes(app, deps) {
         const now = new Date();
         const orderId = generateId('ord');
         let autoAccepted = false;
+        const _acceptModeAuto = ((product.accept_mode ?? (await dbOne('SELECT store_accept_mode FROM users WHERE id = ?', [product.seller_uid]))?.store_accept_mode) === 'auto'); // 接单模式 v16:单品??店铺默认;'auto'→paid 后系统自动接单;escrow manual/未设=原流程(托管中间态+24h 超时退款)零钱路改动;tx 外 seam 读
         // P0: 整个下单流程原子化 — INSERT order + UPDATE wallet + UPDATE products + transition 任一步抛错全部回滚
         try {
             db.transaction(() => {
@@ -300,8 +314,9 @@ export function registerOrdersCreateRoutes(app, deps) {
           l1_uid, l2_uid, l3_uid, snapshot_commission_rate, buyer_region, content_hash_at_order,
           delivery_window, variant_id, variant_options_snapshot,
           gift_recipient_name, gift_recipient_phone, gift_message, insurance_premium,
-          anonymous_recipient, recipient_code, donation_amount, stake_backing
-        ) VALUES (?,?,?,?,?,?,?,?,'created',?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)`).run(orderId, product.id, user.id, product.seller_uid, reqQty, basePrice, totalAmount, totalAmount, shipping_address, notes || null, addHours(now, 24), addHours(now, 48), addHours(now, 120), addHours(now, 168), addHours(now, 336), addHours(now, 408), l1, l2, l3, snapshotRate, buyerRegionSnapshot, contentHashSnapshot, deliveryWindowJson, variant ? variant.id : null, variant ? variant.options_json : null, giftRecipientName, giftRecipientPhone, giftMessage, insurancePremium, anonymousFlag, recipientCode, donationAmount, stakeBacking);
+          anonymous_recipient, recipient_code, donation_amount, stake_backing, ship_to_region, shipping_fee, shipping_est_days
+        ) VALUES (?,?,?,?,?,?,?,?,'created',?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)`).run(orderId, product.id, user.id, product.seller_uid, reqQty, basePrice, totalAmount, totalAmount, shipping_address, notes || null, addHours(now, 24), addHours(now, 48), addHours(now, 120), addHours(now, 168), addHours(now, 336), addHours(now, 408), l1, l2, l3, snapshotRate, buyerRegionSnapshot, contentHashSnapshot, deliveryWindowJson, variant ? variant.id : null, variant ? variant.options_json : null, giftRecipientName, giftRecipientPhone, giftMessage, insurancePremium, anonymousFlag, recipientCode, donationAmount, stakeBacking, _ship.region, _ship.feeU > 0 || _ship.region ? shippingFee : null, _ship.estDays);
+                writeTradeTermsSnapshot(db, orderId, buildTradeTermsSnapshot(db, { productId: String(product.id), sellerId: String(product.seller_uid), shipping: { source: _ship.region ? 'template' : 'none', region: _ship.region ?? null, fee: _ship.region ? shippingFee : null, estDays: _ship.estDays ?? null, freeThresholdApplied: _ship.freeThresholdApplied }, acceptModeEffective: _acceptModeAuto ? 'auto' : null })); // S0 条款快照:冻结下单时效/退货/清关/税责声明(fail-soft,非计价输入)
                 // 协议层：写 genesis 事件 — order 创建（必然是 buyer 自己）
                 try {
                     appendOrderEvent(db, {
@@ -378,11 +393,11 @@ export function registerOrdersCreateRoutes(app, deps) {
                 catch (e) {
                     console.error('[M3-C audit]', e);
                 }
-                // 检查卖家是否有 auto_accept Skill
-                if (shouldAutoAccept(db, orderId)) {
+                // 自动接单:卖家接单模式 'auto'(v16)或 auto_accept Skill。
+                if (_acceptModeAuto || shouldAutoAccept(db, orderId)) {
                     const sysUser = db.prepare("SELECT id FROM users WHERE id = 'sys_protocol'").get();
                     if (sysUser) {
-                        const ar = transition(db, orderId, 'accepted', sysUser.id, [], '⚡ auto_accept Skill 自动接单');
+                        const ar = transition(db, orderId, 'accepted', sysUser.id, [], _acceptModeAuto ? '⚡ 自动接单(卖家接单模式设置)' : '⚡ auto_accept Skill 自动接单');
                         if (ar.success) {
                             notifyTransition(db, orderId, 'paid', 'accepted');
                             autoAccepted = true;