@seasonkoh/webaz 0.1.28 → 0.1.30

package/dist/pwa/server.js

@@ -22,12 +22,15 @@ import crypto from 'crypto';
 import { initDatabase, generateId } from '../layer0-foundation/L0-1-database/schema.js';
 import { setSeamDb } from '../layer0-foundation/L0-1-database/db.js'; // RFC-016 异步 DB seam
 import { initSystemUser, transition, getOrderStatus, checkTimeouts, settleFault } from '../layer0-foundation/L0-2-state-machine/engine.js';
+import { genuineSalePredicate } from '../layer0-foundation/L0-2-state-machine/genuine-sale.js';
+import { settleDirectPayFeeAtCompletion } from '../direct-pay-fee-ar.js'; // RFC-018 PR4 genuine-sale SSOT + Direct Pay Rail 1 平台费链下应收(完成时释放遗留模拟 stake + accrue)
 import { endpointToAction, endpointToReadAction } from './endpoint-actions.js';
 import { AGENT_RATE_PER_MIN_DEFAULTS, CROSS_USER_READ_DAILY_CAP, MASS_ACTION_TYPES, MASS_ACTION_DAILY_CAPS } from './limits.js';
 // #420 P1-2/P1-3/P1-4 — 反滥用阈值单一真相源（governance-adjustable protocol_params）+ 纯决策函数
 import { ANTI_ABUSE_PARAMS, readAntiAbuseThresholds, agentTrustLevel, agentSybilPenalty, agentStrikeSeverity, verifierOutlierBand } from './anti-abuse-thresholds.js';
+import { DIRECT_PAY_CONTROL_PARAMS, DIRECT_PAY_AML_PARAMS } from '../direct-pay-controls.js'; // PR-4a 控制面 + PR-6D AML 监控 param 默认 seed(均 fail-closed / inert)
 import { initOrderChainSchema, appendOrderEvent, getOrderChain, verifyOrderChain } from '../layer0-foundation/L0-2-state-machine/order-chain.js';
-import { initVerifierWhitelistSchema, initMcpToolCallsSchema, initNotePhotoIndexSchema, initUserWishlistSchema, initProductQaSchema, initCouponsSchema, initAnnouncementsSchema, initProductWaitlistSchema, initFlashSalesSchema, initPublicIdeasSchema, initAuctionRemindersSchema, initEmailSubscriptionsSchema, initFeedbackTicketsSchema, initFeedbackMessagesSchema, initDisputeCasesSchema, initDisputeCommentsSchema, initDisputeCommentRepliesSchema, initShareableCommentsSchema, initDisputeFairnessVotesSchema, initOrderRatingsSchema, initBuyerRatingsSchema, initUserAddressesSchema, initP2pShopsSchema, initShareableLikesSchema, initShareableBookmarksSchema, initShareableTagsSchema, initManifestRegistrySchema, initPeerDirectorySchema, initSignalingQueueSchema, initConversationsSchema, initMessagesSchema, initChatReportsSchema, initQuotaIncreaseApplicationsSchema, initVerifierApplicationsSchema, initArbitratorReviewSchema, initVerifierAppealsSchema, initUserModerationSchema, initAdminAuditLogSchema, initVerificationCodesSchema, initAgentCallLogSchema, initAgentReputationSchema, initAgentDeclarationsSchema, initAgentAttestationsSchema, initAgentStrikesSchema, initAgentRevocationsSchema, initProductAliasesSchema, initRegionChangeLogSchema, initCartItemsSchema, initFollowsSchema, initPushSubscriptionsSchema, initUserSessionsSchema, initUserBlocklistSchema, initImportLogsSchema, initErrorLogSchema, initSecondhandItemsSchema, initProductTrialCampaignsSchema, initProductTrialClaimsSchema, initReturnRequestsSchema, initReturnMessagesSchema, initProductVariantsSchema, initEditorPicksSchema, initKycRecordsSchema, initWebauthnSchema, initClaimVerificationBaseSchema, initClaimVerifierSuspensionsSchema, initProductClaimSchema, initReviewClaimSchema, initSecondhandClaimSchema, initAuctionClaimSchema, initWishClaimSchema, initShareableClickLogSchema, initCommissionAuditLogSchema, initRegistrationAuditLogSchema, initProductExternalLinksBaseSchema, initLinkChallengesSchema, initVerifyTasksSchema, initVerifySubmissionsSchema, initVerifierStatsSchema, initRegisterListSearchColumns } from './server-schema.js';
+import { initVerifierWhitelistSchema, initMcpToolCallsSchema, initNotePhotoIndexSchema, initUserWishlistSchema, initProductQaSchema, initCouponsSchema, initAnnouncementsSchema, initProductWaitlistSchema, initFlashSalesSchema, initPublicIdeasSchema, initAuctionRemindersSchema, initEmailSubscriptionsSchema, initFeedbackTicketsSchema, initFeedbackMessagesSchema, initDisputeCasesSchema, initDisputeCommentsSchema, initDisputeCommentRepliesSchema, initShareableCommentsSchema, initDisputeFairnessVotesSchema, initOrderRatingsSchema, initBuyerRatingsSchema, initUserAddressesSchema, initP2pShopsSchema, initShareableLikesSchema, initShareableBookmarksSchema, initShareableTagsSchema, initManifestRegistrySchema, initPeerDirectorySchema, initSignalingQueueSchema, initConversationsSchema, initMessagesSchema, initChatReportsSchema, initQuotaIncreaseApplicationsSchema, initVerifierApplicationsSchema, initArbitratorReviewSchema, initVerifierAppealsSchema, initUserModerationSchema, initAdminAuditLogSchema, initVerificationCodesSchema, initAgentCallLogSchema, initAgentReputationSchema, initAgentDeclarationsSchema, initAgentAttestationsSchema, initAgentStrikesSchema, initAgentRevocationsSchema, initProductAliasesSchema, initRegionChangeLogSchema, initCartItemsSchema, initFollowsSchema, initPushSubscriptionsSchema, initUserSessionsSchema, initUserBlocklistSchema, initImportLogsSchema, initErrorLogSchema, initSecondhandItemsSchema, initProductTrialCampaignsSchema, initProductTrialClaimsSchema, initReturnRequestsSchema, initReturnMessagesSchema, initProductVariantsSchema, initEditorPicksSchema, initKycRecordsSchema, initWebauthnSchema, initClaimVerificationBaseSchema, initClaimVerifierSuspensionsSchema, initProductClaimSchema, initReviewClaimSchema, initSecondhandClaimSchema, initAuctionClaimSchema, initWishClaimSchema, initShareableClickLogSchema, initCommissionAuditLogSchema, initRegistrationAuditLogSchema, initProductExternalLinksBaseSchema, initLinkChallengesSchema, initVerifyTasksSchema, initVerifySubmissionsSchema, initVerifierStatsSchema, initRegisterListSearchColumns, initPendingCommissionEscrowSchema } from './server-schema.js';
 // RFC-014 PR4 — 正常成交结算走整数 base-units + allocate + 绝对值落库。
 import { toUnits, toDecimal, mulRate, allocate } from '../money.js';
 import { applyWalletDelta, creditColumns } from '../ledger.js';
@@ -38,6 +41,14 @@ import { ensureEvidenceColumns, uploadEvidence, listEvidence as listEvidenceFile
 import { cleanupOrphanNotePhotos, } from '../layer2-business/L2-notes/note-photo-storage.js';
 import { initAnchorRegistrySchema, retireAnchorsByTarget, reclaimRetiredAnchors, retireIdleAnchors, userReferralVolume, computeTierLetter, } from '../layer2-business/L2-anchor-registry/anchor-registry.js';
 import { initDisputeSchema, createDispute, respondToDispute, arbitrateDispute, getOrderDispute, getDisputeDetails, getOpenDisputes, checkDisputeTimeouts, initEvidenceRequestSchema, requestEvidence, getEvidenceRequests, addPartyEvidence, } from '../layer3-trust/L3-1-dispute-engine/dispute-engine.js';
+import { initMutualCancelSchema } from '../layer3-trust/L3-1-dispute-engine/mutual-cancel.js';
+import { registerMutualCancelRoutes } from './routes/mutual-cancel.js';
+import { initDirectPayCancelRefundSchema } from '../direct-pay-cancel-refund.js';
+import { registerDirectPayCancelRefundRoutes } from './routes/direct-pay-cancel-refund.js';
+import { registerDirectPayReturnsRoutes } from './routes/direct-pay-returns.js';
+import { registerDirectPayPendingAcceptRoutes } from './routes/direct-pay-pending-accept.js';
+import { registerShippingTemplateRoutes } from './routes/shipping-templates.js';
+import { registerBondSellerRoutes } from './routes/bond-seller.js'; // 协商取消(disputed) + 直付取消退款握手(accepted):域 schema + 端点
 import { initNotificationSchema, notifyTransition, setPushCallback, scanDeadlineReminders, } from '../layer2-business/L2-6-notifications/notification-engine.js';
 import { initSkillMarketSchema } from '../layer4-economics/L4-4-skill-market/skill-listing-engine.js';
 import { computeAgentPassport } from '../layer1-agent/L1-2-identity/agent-passport.js';
@@ -84,6 +95,7 @@ import { registerClaimVerifyRoutes, processClaimTaskQueue, isEligibleClaimVerifi
 import { registerFollowsRoutes } from './routes/follows.js';
 // Leaderboard (#1013 Phase 11) — 单 endpoint 8 kinds（products/creators/buyers/sellers/value/agents/arbitrators/verifiers）
 import { registerLeaderboardRoutes } from './routes/leaderboard.js';
+import { registerFxRoutes } from './routes/fx.js'; // FX = display-only USDC→local rates
 // Shareables 互动 (#1013 Phase 12) — click/like/comments/bookmark 8 endpoints
 import { registerShareablesInteractionsRoutes } from './routes/shareables-interactions.js';
 // Shareables CRUD (#1013 Phase 13) — 11 endpoints (notes-photo + create + me + creator-stats + by-* + feed + detail + PATCH + DELETE)
@@ -150,10 +162,13 @@ import { registerExternalAnchorsRoutes } from './routes/external-anchors.js';
 import { registerAnchorsRoutes } from './routes/anchors.js';
 // 仲裁员申请 (#1013 Phase 44) — 4 user + 3 admin endpoints
 import { registerArbitratorRoutes } from './routes/arbitrator.js';
+import { isEligibleArbitrator as isEligibleArbitratorImpl } from './arbitrator-lifecycle.js'; // PR-B: active-whitelist-only 授权源
 // Governance onboarding (W3.5-B 实施 #1093 阶段 1) — 2 user endpoints
 import { registerGovernanceOnboardingRoutes } from './routes/governance-onboarding.js';
 import { startAutoDeactivateCron, runAutoDeactivateSweep } from './routes/governance-auto-deactivate.js';
 import { startEscrowExpireCron } from './routes/rewards-escrow-expire.js';
+import { startDirectPayTimeoutCron } from './routes/direct-pay-timeouts.js';
+import { startClearingMatureCron } from './routes/rewards-clearing-mature.js';
 import { startAutoDowngradeCron } from './routes/rewards-auto-downgrade.js';
 import { registerRewardsApplyRoutes } from './routes/rewards-apply.js';
 // 卖家配额 + 数据中心 (#1013 Phase 45) — 4 user + 3 admin
@@ -242,8 +257,17 @@ import { registerOrdersReadRoutes } from './routes/orders-read.js';
 import { registerOrdersActionRoutes } from './routes/orders-action.js';
 // Orders 下单端点 (#1013 Phase 85) — 1 endpoint (338-line POST /api/orders)
 import { registerOrdersCreateRoutes } from './routes/orders-create.js';
+import { registerDirectPayDisclosureAckRoutes } from './routes/direct-pay-disclosure-acks.js'; // PR-4d: Direct Pay 风险披露 ack 端点(薄 adapter)
+import { registerDirectReceivePaymentInstructionRoutes } from './routes/direct-receive-payment-instructions.js';
+import { registerDirectReceiveAccountsRoutes } from './routes/direct-receive-accounts.js';
+import { registerFeePrepayRequestRoutes } from './routes/fee-prepay-requests.js'; // PR-4f-a instruction CRUD + Phase C1 multi-account+QR + 平台服务费预充值申请(卖家侧)
+import { registerDirectPayAvailabilityRoutes } from './routes/direct-pay-availability.js';
+import { registerSellerDirectPayReportRoutes } from './routes/seller-directpay-report.js'; // PR-4a 可用性 + 卖家直付销售统计/对账/平台费明细(只读)
+import { registerAdminDirectReceiveDepositsRoutes } from './routes/admin-direct-receive-deposits.js';
+import { registerPlatformReceiveAccountsRoutes } from './routes/platform-receive-accounts.js'; // PR-4b-3 ROOT 生产保证金 + 平台多收款方式 admin 管理(fee 预充值申请流前置)
 // Disputes 读端点 (#1013 Phase 86) — 5 endpoints (list/similar/detail/evidence-list/parties)
 import { registerDisputesReadRoutes } from './routes/disputes-read.js';
+import { isArbitrationReadAdmin } from './arbitration-read-admin.js'; // 争议详情只读 admin 门(与后台列表授权一致)
 // Disputes 写端点 (#1013 Phase 87) — 5 endpoints (respond/arbitrate/add-evidence/evidence-blob/request-evidence)
 import { registerDisputesWriteRoutes } from './routes/disputes-write.js';
 // Products 声明 (#1013 Phase 88) — 2 endpoints (POST claim + GET claims)
@@ -384,11 +408,14 @@ const settleClaimTask = (taskId) => settleClaimTaskRaw(db, generateId, taskId);
 const notifyEligibleVerifiers = (args) => notifyEligibleVerifiersRaw(db, generateId, args);
 initSystemUser(db);
 initDisputeSchema(db);
+initMutualCancelSchema(db);
+initDirectPayCancelRefundSchema(db); // + mutual_cancel_proposals / direct_pay_cancel_requests 表
 initNotificationSchema(db);
 initSkillSchema(db);
 initSkillMarketSchema(db);
 initReputationSchema(db);
 initOrderChainSchema(db);
+initPendingCommissionEscrowSchema(db); // RFC-018 PR1: relocated from inline (was ~8250) so all escrow schema is built in this early batch — see helper. matures_at + reversed added (schema-only).
 initBuildFeedbackSchema(db); // RFC-004 build_feedback
 initBuildTasksSchema(db); // RFC-006 build_tasks(协调层)
 initBuildTaskAgentMetadataSchema(db); // PR9B — agent-ready task metadata satellite(schema only;FUTURE-TASK-BOARD-V1-DESIGN #326)
@@ -831,10 +858,10 @@ const DEFAULT_PARAMS = [
     // ⚠️ Codex #111:stake-required 模式(=1)【尚未实现】—— 下单不锁 stake、settleFault 仍按 stake_backing=0 不没收,
     //   开启会给出虚假"真没收"协议语义。故 max 锁 0(不可开启);待 Phase 3 钱路径迁移实现真锁(下单原子锁 balance→staked)再放开。
     { key: 'require_seller_stake', value: '0', type: 'number', description: 'RFC-008 是否要求卖家质押(0=起步免赔付/零门槛)。⚠️ stake-required(=1)未实现、暂锁 0 不可开启,见 Phase 3', category: 'fee', min: 0, max: 0 },
-    // RFC-008 stage 2:违约罚没率,【与质押率解耦】(低质押=低摩擦 + 高罚没=强威慑,单一费率做不到)。
-    //   背书订单:penalty = fault_penalty_rate × total,先扣 staked(封顶背书)再扣自由 balance(责任自负,真可执行)。
+    // RFC-008 stage 2:违约罚没率,【与质押率解耦】(低质押=低摩擦+高罚没=强威慑)。背书订单:penalty=rate×total,先扣 staked(封顶背书)再扣自由 balance(责任自负)。
     //   起步免赔付(stake_backing=0):仍 0 没收,绝不碰新商家自由余额。settleFault 按订单 stake_backing 判定。
     { key: 'fault_penalty_rate', value: '0.30', type: 'number', description: 'RFC-008 违约罚没率(与质押率解耦;背书订单 staked 不足扣自由 balance;起步免赔付订单不适用)', category: 'fee', min: 0, max: 0.50 },
+    { key: 'trade.platform_region_blocklist', value: '[]', type: 'json', description: '跨境 S1 平台合规禁售地区(JSON 数组大写区码,如 ["KP"]):建单 PRODUCT_RESTRICTED 硬拒,商家不可放宽;默认空。admin PATCH 有 JSON+区码校验', category: 'system' },
     // RFC-007 stage 3：客观理由拒单的【举证窗口】小时数。卖家声称客观无责拒单 → 临时判责,此窗口内可开仲裁(stage 5)举证;
     //   到期无人仲裁 → 自动终结为违约。窗口内买家 escrow 暂不退(随终结/翻案一次性结算),0=不给窗口(直接违约)。
     { key: 'decline_contest_window_hours', value: '24', type: 'number', description: 'RFC-007 客观拒单举证窗口(小时);到期未仲裁则终结为违约', category: 'limit', min: 0, max: 168 },
@@ -917,6 +944,7 @@ const DEFAULT_PARAMS = [
     // #420 P1-2/P1-3/P1-4:反滥用阈值(agent 信任公式 / strike 阶梯 / verifier outlier)→ 治理可调。
     // 默认值 === 抽取前硬编码字面量(单一真相源在 anti-abuse-thresholds.ts;测试强制校验一致)。
     ...ANTI_ABUSE_PARAMS,
+    ...DIRECT_PAY_CONTROL_PARAMS, ...DIRECT_PAY_AML_PARAMS,
 ];
 for (const p of DEFAULT_PARAMS) {
     try {
@@ -1360,11 +1388,7 @@ try {
 }
 catch { }
 // 2026-05-22: 复合索引 — GET /api/shares/dashboard bought_products 5 子查询性能优化
-// note_count / first_note_id 用：owner_id + related_order_id + type + status
-try {
-    db.exec("CREATE INDEX IF NOT EXISTS idx_share_owner_order_type ON shareables(owner_id, related_order_id, type, status)");
-}
-catch { }
+// note_count / first_note_id 用的 idx_share_owner_order_type 已移至下方 related_order_id ALTER 之后(此处列尚不存在,先建=fresh 库永缺该索引)
 // product_share_count 用：owner_id + related_product_id + status（避免回表）
 try {
     db.exec("CREATE INDEX IF NOT EXISTS idx_share_owner_product ON shareables(owner_id, related_product_id, status)");
@@ -1410,6 +1434,10 @@ try {
     db.exec("CREATE INDEX IF NOT EXISTS idx_share_order ON shareables(related_order_id) WHERE related_order_id IS NOT NULL");
 }
 catch { }
+try {
+    db.exec("CREATE INDEX IF NOT EXISTS idx_share_owner_order_type ON shareables(owner_id, related_order_id, type, status)");
+}
+catch { }
 // 笔记图片 hash 索引 / Wave A 购物表（心愿单 · 商品Q&A · 优惠券）→ server-schema.ts
 // 纯幂等建表/建索引 DDL，原位调用保持 boot 顺序不变
 initNotePhotoIndexSchema(db);
@@ -1655,13 +1683,12 @@ catch { }
 for (const stmt of [
     'ALTER TABLE products ADD COLUMN claim_loss_count INTEGER DEFAULT 0',
     'ALTER TABLE secondhand_items ADD COLUMN claim_loss_count INTEGER DEFAULT 0',
-    'ALTER TABLE auctions ADD COLUMN claim_loss_count INTEGER DEFAULT 0',
 ]) {
     try {
         db.exec(stmt);
     }
     catch { }
-}
+} // auctions 的同名 ALTER 在 auctions CREATE 之后(此处表尚不存在,先跑=fresh 库永缺列 — 铁律:ALTER AFTER CREATE)
 // P2P 原生商店 — 卖家本地节点存详情，WebAZ 只锚定 hash + 关键字段
 for (const stmt of [
     'ALTER TABLE products ADD COLUMN p2p_mode INTEGER DEFAULT 0',
@@ -2006,10 +2033,10 @@ try {
           read       INTEGER DEFAULT 0,
           created_at TEXT DEFAULT (datetime('now')),
           wish_id    TEXT,
-          actions    TEXT
+          actions    TEXT, template_key TEXT, params TEXT
         );
-        INSERT INTO notifications_new (id, user_id, order_id, type, title, body, read, created_at, wish_id, actions)
-          SELECT id, user_id, order_id, type, title, body, read, created_at, wish_id, actions FROM notifications;
+        INSERT INTO notifications_new (id, user_id, order_id, type, title, body, read, created_at, wish_id, actions, template_key, params)
+          SELECT id, user_id, order_id, type, title, body, read, created_at, wish_id, actions, template_key, params FROM notifications;
         DROP TABLE notifications;
         ALTER TABLE notifications_new RENAME TO notifications;
         CREATE INDEX IF NOT EXISTS idx_notif_user ON notifications(user_id, read, created_at DESC);
@@ -2407,11 +2434,15 @@ try {
     db.exec('CREATE INDEX IF NOT EXISTS idx_auctions_deadline ON auctions(status, deadline_at)');
 }
 catch { }
-// AUC P1：反狙击延长上限
+// AUC P1：反狙击延长上限;claim_loss_count 从 Sprint 4 数组移来(那里先于本表 CREATE,fresh 库静默失败)
 try {
     db.exec('ALTER TABLE auctions ADD COLUMN max_extends INTEGER DEFAULT 10');
 }
 catch { }
+try {
+    db.exec('ALTER TABLE auctions ADD COLUMN claim_loss_count INTEGER DEFAULT 0');
+}
+catch { }
 try {
     db.exec('ALTER TABLE auctions ADD COLUMN extends_used INTEGER DEFAULT 0');
 }
@@ -2957,7 +2988,7 @@ catch { }
         const upd = db.prepare(`UPDATE products SET
       last_sold_at = (SELECT MAX(COALESCE(updated_at, created_at)) FROM orders WHERE product_id = ? AND status = 'completed'),
       first_sold_at = (SELECT MIN(COALESCE(updated_at, created_at)) FROM orders WHERE product_id = ? AND status = 'completed'),
-      completion_count = (SELECT COUNT(1) FROM orders WHERE product_id = ? AND status = 'completed'),
+      completion_count = (SELECT COUNT(1) FROM orders WHERE product_id = ? AND ${genuineSalePredicate('orders')}),
       dispute_loss_count = (
         SELECT COUNT(1) FROM disputes d JOIN orders o ON o.id = d.order_id
         WHERE o.product_id = ? AND d.ruling_type IN ('refund_buyer','partial_refund')
@@ -3233,8 +3264,8 @@ function computeAgentTrust(apiKey) {
     if (!user)
         return null;
     const ageDays = Math.max(0, (Date.now() - new Date(user.created_at.replace(' ', 'T') + 'Z').getTime()) / 86400_000);
-    const completedBuyer = db.prepare(`SELECT COUNT(*) as n FROM orders WHERE buyer_id = ? AND status = 'completed'`).get(user.id).n;
-    const completedSeller = db.prepare(`SELECT COUNT(*) as n FROM orders WHERE seller_id = ? AND status = 'completed'`).get(user.id).n;
+    const completedBuyer = db.prepare(`SELECT COUNT(*) as n FROM orders WHERE buyer_id = ? AND ${genuineSalePredicate('orders')}`).get(user.id).n;
+    const completedSeller = db.prepare(`SELECT COUNT(*) as n FROM orders WHERE seller_id = ? AND ${genuineSalePredicate('orders')}`).get(user.id).n;
     const disputeLoss = db.prepare(`SELECT COUNT(*) as n FROM disputes WHERE defendant_id = ? AND ruling_type IN ('refund_buyer','partial_refund')`).get(user.id).n;
     // 商品分享带来的真实成交（创作者贡献）
     const shareConversions = db.prepare(`
@@ -4108,15 +4139,15 @@ app.use((req, res, next) => {
                 action, cap: capCheck.cap, used: capCheck.used, level: lvlForCap,
             });
         }
-        // Phase 3c：风险闸 — 高风险 agent 敏感写降速/暂停(只罚高风险,无责零成本)
+        // Phase 3c:风险闸 — 高风险 agent 敏感写降速/暂停。真人豁免(Tina 案二连,同 #241 原则):绑 Passkey=真人,敏感操作已有 Passkey 仪式把守;风险分含结构罚(同 IP 注册簇)+30 天半衰期,"30 秒重试"对真人=死锁
         const agentRisk = riskInfo.risk;
-        if (agentRisk >= 100) {
+        if (agentRisk >= 100 && !riskInfo.hasPasskey) {
             return void res.status(403).json({
                 error: 'agent 风险分已达上限，敏感操作已暂停 — 请在「我的 Agents」查看并申诉',
                 error_code: 'AGENT_RISK_SUSPENDED', action, risk: agentRisk,
             });
         }
-        if (agentRisk >= 70) {
+        if (agentRisk >= 70 && !riskInfo.hasPasskey) {
             res.setHeader('Retry-After', '30');
             return void res.status(429).json({
                 error: `agent 风险分偏高(${agentRisk}/100)，敏感操作已降速，请 30 秒后重试`,
@@ -4156,7 +4187,8 @@ app.use((req, res, next) => {
             }
         }
     }
-    // 分档 rate limit
+    if (riskInfo.hasPasskey || req.path === '/api/signaling/poll' || req.path === '/api/snf/pending')
+        return next(); // 分档 rate limit 前的真人豁免(Tina 案修复):绑 Passkey=真人本人/监护(PWA 页面加载+轮询天然高频,agent 约束原则=真人豁免,不进速率桶不触发 rate_limit_abuse strike);高频轮询端点亦不计 agent 配额
     const repRow = db.prepare(`SELECT level FROM agent_reputation WHERE api_key = ?`).get(apiKey);
     const level = repRow?.level || 'new';
     const cap = getAgentRateCap(level);
@@ -4460,6 +4492,14 @@ registerAgentReputationRoutes(app, {
 });
 // #1013 Phase 47: 6 公开用户主页 endpoints 已迁出到 routes/users-public.ts
 registerUsersPublicRoutes(app, { db, auth, noteAuthenticityBadges });
+registerDirectPayDisclosureAckRoutes(app, { db, auth, generateId, consumeGateToken }); // PR-4d
+registerDirectReceivePaymentInstructionRoutes(app, { db, auth, generateId });
+registerDirectReceiveAccountsRoutes(app, { db, auth, generateId, consumeGateToken });
+registerFeePrepayRequestRoutes(app, { db, auth, generateId }); // PR-4f-a + Phase C1 + fee 预充值申请
+registerDirectPayAvailabilityRoutes(app, { db, auth, getProtocolParam, generateId });
+registerSellerDirectPayReportRoutes(app, { db, auth }); // PR-4a + 缓交 + 卖家直付销售统计/对账/平台费明细(只读)
+registerAdminDirectReceiveDepositsRoutes(app, { db, requireRootAdmin: (req, res) => requireRootAdmin(req, res), consumeGateToken, logAdminAction, getProtocolParam });
+registerPlatformReceiveAccountsRoutes(app, { db, requireRootAdmin: (req, res) => requireRootAdmin(req, res), generateId, consumeGateToken, logAdminAction }); // PR-4b-3 + readiness + 平台多收款方式 admin CRUD(root+Passkey)
 // RFC-004 build_feedback — agent-native "use → build" 反馈管道
 registerBuildFeedbackRoutes(app, {
     db, auth,
@@ -5652,7 +5692,7 @@ function checkVerifierEligibility(userId) {
     const ageDays = Math.floor((Date.now() - new Date(user.created_at).getTime()) / 86400_000);
     items.push({ key: 'age', label: '账户年龄 ≥ 60 天', current: ageDays, required: 60, ok: ageDays >= 60 });
     items.push({ key: 'email', label: '邮箱已验证', current: user.email_verified ? '✓' : '✗', required: '✓', ok: !!user.email_verified });
-    const orders = db.prepare("SELECT COUNT(*) as n FROM orders WHERE (buyer_id = ? OR seller_id = ?) AND status = 'completed'").get(userId, userId).n;
+    const orders = db.prepare(`SELECT COUNT(*) as n FROM orders WHERE (buyer_id = ? OR seller_id = ?) AND ${genuineSalePredicate('orders')}`).get(userId, userId).n;
     items.push({ key: 'orders', label: '完成订单 ≥ 20 笔', current: orders, required: 20, ok: orders >= 20 });
     const disputeLost = db.prepare(`
     SELECT COUNT(*) as n FROM disputes
@@ -5799,7 +5839,7 @@ function checkArbitratorEligibility(userId) {
     const ageDays = Math.floor((Date.now() - new Date(user.created_at).getTime()) / 86400_000);
     items.push({ key: 'age', label: '账户年龄 ≥ 90 天', current: ageDays, required: 90, ok: ageDays >= 90 });
     items.push({ key: 'email', label: '邮箱已验证', current: user.email_verified ? '✓' : '✗', required: '✓', ok: !!user.email_verified });
-    const orders = db.prepare("SELECT COUNT(*) as n FROM orders WHERE (buyer_id = ? OR seller_id = ?) AND status = 'completed'").get(userId, userId).n;
+    const orders = db.prepare(`SELECT COUNT(*) as n FROM orders WHERE (buyer_id = ? OR seller_id = ?) AND ${genuineSalePredicate('orders')}`).get(userId, userId).n;
     items.push({ key: 'orders', label: '完成订单 ≥ 50 笔', current: orders, required: 50, ok: orders >= 50 });
     const disputeLost = db.prepare(`
     SELECT COUNT(*) as n FROM disputes
@@ -5827,25 +5867,20 @@ function getArbitratorState(userId) {
         state = 'rejected';
     if (wl)
         state = 'approved';
-    return { state, application: app ?? null, whitelist: wl ?? null };
+    // PR-E:真实运行时能力字段。前端必须以 can_arbitrate 为准(state='approved' 不区分 suspended/revoked)。
+    const arbitrator_status = wl ? (wl.status ?? 'active') : 'none'; // active / suspended / revoked / none
+    return { state, can_arbitrate: isEligibleArbitrator(userId).ok, arbitrator_status, application: app ?? null, whitelist: wl ?? null };
 }
-// 仲裁员身份判定（内部 role + 外部 whitelist 双通道）— 用于 /api/disputes/:id/arbitrate 守门
+// 仲裁员身份判定 — PR-B:唯一授权源 = active arbitrator_whitelist(role='arbitrator' 旁路已移除)。域逻辑见 arbitrator-lifecycle.ts。
 function isEligibleArbitrator(userId) {
-    const u = db.prepare("SELECT role FROM users WHERE id = ?").get(userId);
-    if (!u)
-        return { ok: false, reason: '用户不存在' };
-    if (u.role === 'arbitrator')
-        return { ok: true, via: 'role' };
-    const wl = db.prepare("SELECT user_id FROM arbitrator_whitelist WHERE user_id = ?").get(userId);
-    if (wl)
-        return { ok: true, via: 'whitelist' };
-    return { ok: false, reason: '非仲裁员 — 需 role=arbitrator（内部）或 arbitrator_whitelist（外部）' };
+    return isEligibleArbitratorImpl(db, userId);
 }
 // #1013 Phase 44: 4 user + 3 admin arbitrator endpoints 已迁出到 routes/arbitrator.ts
 registerArbitratorRoutes(app, {
     db, generateId, auth,
     requireArbitrationAdmin: (req, res) => requireAdminPermission(req, res, 'arbitration'),
     checkArbitratorEligibility, getArbitratorState, errorRes, logAdminAction,
+    consumeGateToken, // PR-B: grant/suspend/reinstate/revoke 的 purpose-bound 真人 Passkey
     ARB_STAKE_REQUIRED, ARB_APP_REJECT_COOLDOWN_DAYS,
 });
 // Governance onboarding (W3.5-B #1093) — apply + quiz + cases + admin activation + resign/appeal + auto_deactivate audit
@@ -6019,7 +6054,7 @@ registerOrdersReadRoutes(app, { db, auth, getOrderStatus, getOrderChain, verifyO
 registerOrdersActionRoutes(app, {
     db, auth, isTrustedRole, generateId, transition, notifyTransition,
     settleOrder, settleFault, detectFraud, createDispute, checkTimeouts, recordViolationReputation,
-    broadcastSystemEvent,
+    broadcastSystemEvent, consumeGateToken,
 });
 // #1013 Phase 85: POST /api/orders 巨型事务已迁出
 registerOrdersCreateRoutes(app, {
@@ -6043,7 +6078,7 @@ registerSellerQuotaRoutes(app, {
 registerDisputesReadRoutes(app, {
     db, auth, errorRes,
     getOpenDisputes, getDisputeDetails, getEvidenceRequests, listEvidenceFiles,
-    isEligibleArbitrator,
+    isEligibleArbitrator, isArbitrationAdmin: isArbitrationReadAdmin, // 后者=争议详情只读 admin 门,与后台列表 /admin/disputes 同款授权(单一真相源 arbitration-read-admin.ts)
 });
 // #1013 Phase 87: 5 disputes 写端点已迁出（包括 234 行 arbitrate）
 // FUND_BASE_RATE 是 const 函数在文件下游定义；用 getter 包一层避免 TDZ
@@ -6056,8 +6091,14 @@ registerDisputesWriteRoutes(app, {
     FUND_BASE_RATE: () => FUND_BASE_RATE(),
     settleCommission, depositToFund, calculatePv,
     recordDisputeReputation, issueAgentStrike, publishDisputeCase, logAdminAction, snfSend,
-    getProtocolParam,
+    getProtocolParam, notifyTransition,
 });
+registerMutualCancelRoutes(app, { db, auth, generateId, errorRes });
+registerDirectPayCancelRefundRoutes(app, { db, auth, generateId, errorRes, consumeGateToken });
+registerDirectPayReturnsRoutes(app, { db, auth, generateId, errorRes, consumeGateToken });
+registerDirectPayPendingAcceptRoutes(app, { db, auth, errorRes, getProtocolParam });
+registerShippingTemplateRoutes(app, { db, auth, errorRes });
+registerBondSellerRoutes(app, { db, auth, generateId, errorRes, getProtocolParam }); // 协商取消(disputed)+ 直付取消退款握手(accepted):关单手术均内部 db.transaction 原子
 // lightAuthGuard：轻量 Authorization 头守门（在 raw 解析之前挡掉无 auth 请求）
 // 被 Phase 13 shareables（视频上传）+ Phase 87 disputes evidence-blob 共享
 function lightAuthGuard(req, res, next) {
@@ -6134,8 +6175,8 @@ function awardBidAndCreateOrder(rfq, winner) {
             db.prepare(`
         INSERT INTO products (id, seller_id, title, description, price, stock, status, images,
           ship_regions, handling_hours, commission_rate, category_id, stake_amount,
-          listing_id, fulfillment_type, eta_hours, freshness_ts, cold_start_remaining)
-        VALUES (?,?,?,?,?,?,'active','[]',?,?,?,?,0,?,?,?,datetime('now'),?)
+          listing_id, fulfillment_type, eta_hours, freshness_ts, cold_start_remaining, currency)
+        VALUES (?,?,?,?,?,?,'active','[]',?,?,?,?,0,?,?,?,datetime('now'),?,'WAZ')
       `).run(productId, sellerId, String(rfq.title), `[RFQ ${rfqId}] ` + (rfq.notes ? String(rfq.notes).slice(0, 200) : '协议撮合订单'), price, qty, String(rfq.region_required || '全国'), 24, 0, 'cat_default', lstId, fulfillmentType, etaHours, 30);
         }
     }
@@ -6589,8 +6630,8 @@ function settleAuctionInner(aucId) {
         productId = generateId('p');
         db.prepare(`
       INSERT INTO products (id, seller_id, title, description, price, stock, status, images,
-        ship_regions, handling_hours, commission_rate, category_id, stake_amount, listing_id, freshness_ts, cold_start_remaining)
-      VALUES (?,?,?,?,?,?,'active','[]',?,?,?,?,0,?,datetime('now'),?)
+        ship_regions, handling_hours, commission_rate, category_id, stake_amount, listing_id, freshness_ts, cold_start_remaining, currency)
+      VALUES (?,?,?,?,?,?,'active','[]',?,?,?,?,0,?,datetime('now'),?,'WAZ')
     `).run(productId, sellerId, String(auc.title), `[AUC ${aucId}] ` + (auc.notes ? String(auc.notes).slice(0, 200) : '拍卖成交'), price, qty, '全国', 24, 0.10, 'cat_default', auc.listing_id ? String(auc.listing_id) : null, 30);
     }
     // 5) 截止期 — 拍卖订单走标准 17 天链（拍卖结束后再谈履约时效）
@@ -6718,7 +6759,7 @@ const TASK_DEFS = {
 };
 // 计算用户当前任务进度（不写库，纯读）
 function computeTaskProgress(userId) {
-    const completed = db.prepare(`SELECT COUNT(*) as n FROM orders WHERE buyer_id = ? AND status = 'completed'`).get(userId).n;
+    const completed = db.prepare(`SELECT COUNT(*) as n FROM orders WHERE buyer_id = ? AND ${genuineSalePredicate('orders')}`).get(userId).n;
     const ratingsGiven = db.prepare(`SELECT COUNT(*) as n FROM order_ratings WHERE buyer_id = ?`).get(userId).n;
     const ratingsReceived = db.prepare(`SELECT COUNT(*) as n FROM order_ratings WHERE seller_id = ?`).get(userId).n;
     const follows = db.prepare(`SELECT COUNT(*) as n FROM follows WHERE follower_id = ?`).get(userId).n;
@@ -6910,6 +6951,7 @@ registerShareablesInteractionsRoutes(app, {
     parseMentions, notifyMentions,
 });
 registerLeaderboardRoutes(app, { db, internalAuditorId: INTERNAL_AUDITOR_ID, rateLimitOk });
+registerFxRoutes(app, { rateLimitOk });
 // like-status / bookmark-status / bookmarked-shareables 已迁出 (#1013 Phase 12)
 // ─── Manifest Registry API（原生 P2P 内容索引，零字节存储）─────
 // ============================================================
@@ -7187,28 +7229,19 @@ function settleCommission(orderId, effectiveBase) {
         { level: 2, beneficiary: l2Uid },
         { level: 3, beneficiary: l3Uid },
     ];
-    // #7 Commission source_type — 查 attribution 找到带来 buyer 的 shareable，确定 channel 类型
-    // 反推: 该 uid 作为 sharer 把 product 分享给"下家"的 shareable 类型
-    function resolveSourceType(uid) {
-        if (!uid)
-            return 'sponsor';
-        const attr = db.prepare(`
-      SELECT shareable_id FROM product_share_attribution
-      WHERE product_id = ? AND sharer_id = ? AND shareable_id IS NOT NULL
-      ORDER BY created_at DESC LIMIT 1
-    `).get(order.product_id, uid);
-        if (!attr)
-            return 'sponsor';
-        const sh = db.prepare(`SELECT type FROM shareables WHERE id = ?`).get(attr.shareable_id);
-        if (!sh)
-            return 'sponsor';
-        return sh.type === 'note' ? 'note' : 'link';
-    }
+    // #7 Commission source_type resolution moved to module-level commissionSourceType() — RFC-018
+    // Option A writes commission_records at MATURATION (not here), so source_type is stamped there.
     // 2026-06-04：所有兜底统一入 commission_reserve（三级公池，独立科目，只进不出）。
     // commission 不再回流 global_fund（PV 资金）—— 三套科目解耦，redirected 始终 0。
     let toCommissionReserve = 0; // → commission_reserve（仅作日志/返回信息用）
     // 三级金额一次性 allocate(精确求和 ≡ poolU);各级再按 gate 路由到钱包/公池/escrow。
     const levelAmtU = allocate(poolU, [LEVEL_RATES[1], LEVEL_RATES[2], LEVEL_RATES[3]]);
+    // RFC-018 clearing window: opted-in commission accrues to pending_commission_escrow and matures
+    // after the product's return window + buffer. Anchor = now (settleCommission runs at order→completed).
+    const nowMsClearing = Date.now();
+    const returnDaysClearing = Number(db.prepare("SELECT return_days FROM products WHERE id = ?").get(order.product_id)?.return_days ?? 7);
+    const clearingBufferDays = Number(db.prepare("SELECT value FROM protocol_params WHERE key = 'settlement.clearing_buffer_days'").get()?.value ?? 2);
+    const maturesAtClearing = nowMsClearing + Math.max(0, returnDaysClearing + clearingBufferDays) * 86400 * 1000;
     for (const { level, beneficiary } of recipients) {
         const amountU = levelAmtU[level - 1];
         const amount = toDecimal(amountU);
@@ -7254,15 +7287,17 @@ function settleCommission(orderId, effectiveBase) {
             catch (e) { /* UNIQUE 冲突 — settleCommission 重入幂等 */ }
             continue;
         }
-        // ⑤ 正常分账
+        // ⑤ RFC-018 clearing (Option A): opted-in commission ACCRUES to pending_commission_escrow with a
+        // matures_at — it is NOT credited to the wallet now and writes NO commission_records yet. The
+        // maturation cron (rewards-clearing-mature) re-validates the order is still genuinely closed, then
+        // writes commission_records + credits the wallet. A return in-window reverses the pending row
+        // (proportionally) — never paid, never clawed back. expires_at is a NOT-NULL filler = matures_at;
+        // the escrow-expire cron ignores rows where matures_at IS NOT NULL (i.e. clearing rows).
         try {
-            const srcType = resolveSourceType(beneficiary);
-            db.prepare(`INSERT INTO commission_records (id, order_id, beneficiary_id, source_buyer_id, level, amount, rate, region, source, source_type)
-                  VALUES (?,?,?,?,?,?,?,?,?,?)`)
-                .run(generateId('comm'), orderId, beneficiary, order.buyer_id, level, amount, rate, region, routeSource, srcType);
-            applyWalletDelta(db, beneficiary, { balance: amountU, earned: amountU });
+            db.prepare(`INSERT INTO pending_commission_escrow (recipient_user_id, order_id, amount, attribution_path, status, created_at, expires_at, matures_at) VALUES (?,?,?,?,'pending',?,?,?)`)
+                .run(beneficiary, orderId, amount, `L${level}`, nowMsClearing, maturesAtClearing, maturesAtClearing);
         }
-        catch (e) { /* UNIQUE 冲突 */ }
+        catch (e) { /* UNIQUE (recipient,order,path) — settleCommission re-entry idempotent */ }
     }
     db.prepare("UPDATE orders SET settled_commission_at = datetime('now') WHERE id = ?").run(orderId);
     // redirected 恒为 0：commission 兜底全部入 commission_reserve，不再回流 global_fund(PV 资金)。
@@ -7378,6 +7413,10 @@ function settleOrder(orderId) {
     // 内部 try/catch 用于非关键 hook（settlePinRewards / metrics 更新）失败不回滚资金主流程
     db.transaction(() => {
         const order = db.prepare('SELECT * FROM orders WHERE id = ?').get(orderId);
+        if (order && order.payment_rail === 'direct_p2p') {
+            settleDirectPayFeeAtCompletion(db, order, generateId('dpfr'));
+            return;
+        } // Rail1 直付:跳过 escrow 结算;平台费=链下应收(释放遗留模拟 stake + accrue,fail-closed 同原子边界)
         const total = order.total_amount;
         const isSecondhand = order.source === 'secondhand';
         const isInPerson = order.fulfillment_mode === 'in_person';
@@ -8704,72 +8743,10 @@ try {
     db.exec('CREATE INDEX IF NOT EXISTS idx_rewards_apps_action ON rewards_applications(user_id, action, created_at DESC)');
 }
 catch { }
-// 5. pending_commission_escrow:opt-out promoter 待激活领取队列(§3.5b)
-// PR-1c-b: order_id is NULLable so attribution_path='pv_pair' rows (which accrue
-// across many orders) can record amount without inventing a fake order_id.
-// L1/L2/L3 rows still carry a real order_id, enforced by the gate code path
-// in settleCommission (not by NOT NULL constraint).
-db.exec(`
-  CREATE TABLE IF NOT EXISTS pending_commission_escrow (
-    id                       INTEGER PRIMARY KEY AUTOINCREMENT,
-    recipient_user_id        TEXT NOT NULL,
-    order_id                 TEXT,                                 -- NULL for pv_pair (PR-1c-b)
-    amount                   REAL NOT NULL,    -- WAZ amount
-    attribution_path         TEXT NOT NULL,    -- 'L1' | 'L2' | 'L3' | 'pv_pair' | etc.
-    status                   TEXT NOT NULL DEFAULT 'pending',  -- 'pending' | 'settled' | 'expired'
-    created_at               INTEGER NOT NULL,
-    expires_at               INTEGER NOT NULL,
-    settled_at               INTEGER,
-    expired_to_charity_at    INTEGER,
-    FOREIGN KEY (recipient_user_id) REFERENCES users(id),
-    FOREIGN KEY (order_id) REFERENCES orders(id)
-  )
-`);
-(function migrateEscrowOrderIdNullable() {
-    const cols = db.prepare("PRAGMA table_info(pending_commission_escrow)").all();
-    const orderIdCol = cols.find(c => c.name === 'order_id');
-    if (!orderIdCol || orderIdCol.notnull === 0)
-        return; // already nullable (or table missing entirely)
-    console.log('[pc-escrow-migrate] order_id is NOT NULL — recreating table to allow NULL for pv_pair');
-    db.exec('PRAGMA foreign_keys = OFF');
-    db.transaction(() => {
-        db.exec(`
-      CREATE TABLE pending_commission_escrow_new (
-        id                       INTEGER PRIMARY KEY AUTOINCREMENT,
-        recipient_user_id        TEXT NOT NULL,
-        order_id                 TEXT,
-        amount                   REAL NOT NULL,
-        attribution_path         TEXT NOT NULL,
-        status                   TEXT NOT NULL DEFAULT 'pending',
-        created_at               INTEGER NOT NULL,
-        expires_at               INTEGER NOT NULL,
-        settled_at               INTEGER,
-        expired_to_charity_at    INTEGER,
-        FOREIGN KEY (recipient_user_id) REFERENCES users(id),
-        FOREIGN KEY (order_id) REFERENCES orders(id)
-      )
-    `);
-        db.exec('INSERT INTO pending_commission_escrow_new SELECT * FROM pending_commission_escrow');
-        db.exec('DROP TABLE pending_commission_escrow');
-        db.exec('ALTER TABLE pending_commission_escrow_new RENAME TO pending_commission_escrow');
-    })();
-    db.exec('PRAGMA foreign_keys = ON');
-})();
-try {
-    db.exec('CREATE INDEX IF NOT EXISTS idx_escrow_recipient ON pending_commission_escrow(recipient_user_id, status, expires_at)');
-}
-catch { }
-try {
-    db.exec('CREATE INDEX IF NOT EXISTS idx_escrow_expiry ON pending_commission_escrow(status, expires_at)');
-}
-catch { }
-// PR-1c-a: UNIQUE (recipient, order, path) defends against double-insert if settleCommission ever retries
-// Note: NULL order_id (PR-1c-b pv_pair) is distinct in SQLite UNIQUE — idempotency for pv_pair relies
-// on binary_score_records.settled_at instead (source-side dedup).
-try {
-    db.exec('CREATE UNIQUE INDEX IF NOT EXISTS uniq_escrow_recipient_order_path ON pending_commission_escrow(recipient_user_id, order_id, attribution_path)');
-}
-catch { }
+// pending_commission_escrow schema (table + migration + indexes) lives in
+// initPendingCommissionEscrowSchema (early helper batch above) — RFC-018 PR1 relocated it there so
+// all of its DDL is built once, never half-inline (fresh-DB silent-fail铁律). The backfill below
+// only READS the table; it still runs after the build (early batch precedes this line).
 // Codex #69 P1:pv_escrow_reserve(#1106 隔离负债账)回填历史 pending pv_pair escrow —— 按 delta 对账,不全量转。
 //   该列在 global_fund 上新增(line ~2319);#1106 之后新建的 pv_pair escrow 结算时【已】pv_escrow_reserve += wazAmount,
 //   但加列【之前】产生的 pending pv_pair 从没进过 reserve。升级窗口里两者混存。
@@ -8819,6 +8796,7 @@ const RFC002_PARAMS = [
     { key: 'rewards_opt_in.min_completed_orders', value: '1', type: 'number', description: 'RFC-002 §3.2:申请 rewards opt-in 的最小已完成订单数', category: 'rewards', min: 0, max: 100, metaRuleLocked: false },
     { key: 'rewards_opt_in.require_passkey', value: '1', type: 'number', description: 'RFC-002 §3.3:申请 / 关闭是否需 Passkey(1=必须,0=允许 password)— META-RULE LOCKED,降低需 60d meta-rule track', category: 'rewards', min: 0, max: 1, metaRuleLocked: true },
     { key: 'rewards_opt_in.escrow_days', value: '30', type: 'number', description: 'RFC-002 §3.5b:pending commission escrow 过期天数(过期后流入 charity_fund)', category: 'rewards', min: 7, max: 180, metaRuleLocked: false },
+    { key: 'settlement.clearing_buffer_days', value: '2', type: 'number', description: 'RFC-018:佣金清算期 = 商品 return_days + 此 buffer(成熟才入钱包;窗内退货则冲销,永不 clawback)', category: 'rewards', min: 0, max: 30, metaRuleLocked: false },
     { key: 'rewards_opt_in.consent_delay_seconds', value: '8', type: 'number', description: 'RFC-002 §3.3:server-side 8s 反诱导延迟 — META-RULE LOCKED,降低需 60d meta-rule track', category: 'rewards', min: 0, max: 60, metaRuleLocked: true },
     { key: 'rewards_opt_in.reconfirm_grace_days', value: '14', type: 'number', description: 'RFC-002 §3.10:major consent 变更后用户重新确认 grace 期(过期 auto_downgrade)', category: 'rewards', min: 3, max: 90, metaRuleLocked: false },
 ];
@@ -8907,6 +8885,8 @@ app.listen(PORT, () => {
     startAutoDeactivateCron({ db, generateId, getProtocolParam });
     // #1090 RFC-002 PR-1c-a: escrow expire cron (every 1h)
     startEscrowExpireCron({ db, redirectToCommissionReserve });
+    startDirectPayTimeoutCron({ db });
+    startClearingMatureCron({ db }); // RFC-018: pay/hold matured clearing commission (logic in the cron module)
     // #1090 RFC-002 PR-3 slice 2: auto_downgrade cron (every 24h)
     // Triggered when a new major consent text is published; opted-in users
     // who don't reconfirm within reconfirm_grace_days (14d default) get

package/dist/runtime/agent-grant-scopes.js

@@ -27,6 +27,13 @@ export const SAFE_SCOPES = [
     'list_product_draft',
     'product_publish_request',
     'draft_order',
+    // Seller-scoped read/draft surfaces (Catalog Agent role) — read the seller's own catalog + propose
+    //   drafts/pricing/publish-REQUESTS. NONE of these publish, accept orders, ship, or move money.
+    'seller_profile_read',
+    'seller_products_read',
+    'seller_inventory_read',
+    'seller_product_draft',
+    'seller_pricing_suggestion',
 ];
 /**
  * Real actions that WILL require a live Passkey each time — but are NOT yet gated
@@ -119,10 +126,71 @@ export function grantIsActive(grant, nowIso) {
 }
 /** Short-lived bearer policy for SAFE scopes (RFC-020 bearer-first; PoP before risk/longer). */
 export const GRANT_TTL_DEFAULT_SEC = 3600; // 1h
-export const GRANT_TTL_MAX_SEC = 24 * 3600; // 24h cap — short-lived only
+export const GRANT_TTL_MAX_SEC = 24 * 3600; // 24h cap — short-lived only (legacy webaz_pair bearer)
 export function clampTtlSeconds(requested) {
     const n = Number(requested);
     if (!Number.isFinite(n) || n <= 0)
         return GRANT_TTL_DEFAULT_SEC;
     return Math.min(Math.floor(n), GRANT_TTL_MAX_SEC);
 }
+export const PERMISSION_BUNDLES = {
+    catalog_agent: {
+        key: 'catalog_agent',
+        label: 'Catalog Agent',
+        scopes: ['read_public', 'profile_read', 'search', 'seller_profile_read', 'seller_products_read', 'seller_inventory_read', 'seller_product_draft', 'seller_pricing_suggestion', 'product_publish_request'],
+        human_summary: '选品、商品草稿、库存字段检查、价格建议、上架请求。它不能发布商品、不能接单、不能发货、不能动用资金。',
+        human_summary_en: 'Sourcing, product drafts, inventory-field checks, pricing suggestions, and publish REQUESTS. It cannot publish products, accept orders, ship, or move funds.',
+    },
+};
+/** Resolve a bundle key → its safe scopes + human summary, or null if unknown. */
+export function resolveBundle(key) {
+    return (typeof key === 'string' && Object.prototype.hasOwnProperty.call(PERMISSION_BUNDLES, key)) ? PERMISSION_BUNDLES[key] : null;
+}
+/** INVARIANT check (acceptance #7): a bundle must be all-safe. Returns the offending non-safe scopes. */
+export function bundleNonSafeScopes(bundle) {
+    return bundle.scopes.filter(s => classifyScope(s) !== 'safe');
+}
+// Load-time assertion: no bundle may ship with a risk/never/unknown scope (fail LOUD at import, not runtime).
+for (const b of Object.values(PERMISSION_BUNDLES)) {
+    const bad = bundleNonSafeScopes(b);
+    if (bad.length)
+        throw new Error(`Permission bundle '${b.key}' contains non-safe scope(s): ${bad.join(', ')} — bundles are safe-only (RFC-020)`);
+}
+export const DURATION_SECONDS = { '1h': 3600, '24h': 86400, '7d': 604800, '30d': 2592000 };
+/**
+ * Which durations a set of scopes may be granted for, capped by the HIGHEST risk tier present:
+ *   - never-delegable / unknown  → []            (cannot be granted at all)
+ *   - risk (high)                → ['once']       (single Passkey each time; NEVER long-term)
+ *   - safe (low/medium)          → once…30d       (long-term ok)
+ */
+export function allowedDurationsForScopes(scopes) {
+    const tiers = scopes.map(classifyScope);
+    if (tiers.some(t => t === 'never_delegable' || t === 'unknown'))
+        return [];
+    if (tiers.some(t => t === 'risk'))
+        return ['once'];
+    return ['once', '1h', '24h', '7d', '30d'];
+}
+export function durationAllowedForScopes(scopes, duration) {
+    return typeof duration === 'string' && allowedDurationsForScopes(scopes).includes(duration);
+}
+/** Suggested default: 7d for long-term-eligible safe scopes; else the safest available (once). */
+export function suggestedDurationForScopes(scopes) {
+    const a = allowedDurationsForScopes(scopes);
+    return a.includes('7d') ? '7d' : (a[0] ?? 'once');
+}
+/** Grant lifetime in seconds for an approved (non-'once') duration. 'once' handled separately (single-use). */
+export function durationToSeconds(duration) {
+    return duration === 'once' ? 0 : DURATION_SECONDS[duration];
+}
+/** Coarse risk label for the human-facing request card. */
+export function riskLevelForScopes(scopes) {
+    const tiers = scopes.map(classifyScope);
+    if (tiers.some(t => t === 'never_delegable' || t === 'unknown'))
+        return 'blocked';
+    if (tiers.some(t => t === 'risk'))
+        return 'high';
+    if (scopes.includes('product_publish_request'))
+        return 'medium'; // request-only (still human-gated to publish), flag as medium
+    return 'low';
+}