@seasonkoh/webaz 0.1.29 → 0.1.30

package/dist/pwa/routes/governance-onboarding.js

@@ -4,6 +4,8 @@ import { getCasesForRole, getCasesForMaintainer, validateCaseReviews } from '../
 // RFC-016 Phase 1 — 申请/题目/案例/申诉的校验读 + 列表读 + 单语句写 → async seam;
 //   activate/resign/resolve-appeal 的 3 个角色态 CAS db.transaction 保持同步(Phase 3 迁 pg)。
 import { dbOne, dbAll, dbRun } from '../../layer0-foundation/L0-1-database/db.js';
+import { grantArbitratorTx, suspendArbitrator } from '../arbitrator-lifecycle.js'; // PR-B/PR-C.2:激活桥接 active whitelist 同事务;#249-P2:仲裁员卸任真源=whitelist(suspend 可复用,非终态 revoke)
+import { isActiveWhitelistArbitrator } from '../../layer3-trust/L3-1-dispute-engine/dispute-engine.js';
 // PR #22 review fix P1-2:披露文本版本(server 与 client 同步,变更披露需 bump)
 // client 在 src/pwa/public/app.js 必须用相同 version
 export const GOVERNANCE_APPLY_DISCLOSURE_VERSION = 'v1.0-2026-06-02';
@@ -390,10 +392,14 @@ export function registerGovernanceOnboardingRoutes(app, deps) {
                 return void errorRes(res, 401, 'PASSKEY_INVALID', `maintainer Passkey 验证失败: ${result.reason || '未知'}`);
             }
         }
-        // 5. 事务:conditional UPDATE 防竞态 + INSERT activate row + 加 users.roles
+        // 5. 事务:conditional UPDATE 防竞态 + PR-C.2 仲裁授权 + INSERT activate row + 加 users.roles(仅治理记录,非 eligibility 源)
         // PR #25 self-review fix P1-1:status check 进 transaction(防 2 maintainer 同时激活 → 2 activate row)
         // PR #25 self-review fix P1-2:不存 note 到 appeal_resolution(语义错);maintainer note 由 logAdminAction(detail) 记
+        // PR-C.2:role='arbitrator' 的 grantArbitratorTx 与状态翻转【同事务】—— 保证"governance active ⟺ whitelist active",
+        //   grant 失败(revoked/非人类/无 Passkey)→ 抛 sentinel,整个激活回滚。verifier 角色走其自身白名单,不在此桥。
         const RACE_LOST = 'RACE_LOST_PENDING_TO_ACTIVE';
+        const GRANT_ABORT = 'GRANT_ABORT';
+        let grantErr = null;
         try {
             db.transaction(() => {
                 // 5.1 conditional UPDATE 原 apply row(只在 status='pending_onboarding' 时改 → 防竞态)
@@ -402,6 +408,14 @@ export function registerGovernanceOnboardingRoutes(app, deps) {
                     // 另一 maintainer 已激活 → 抛出 sentinel,整个事务回滚
                     throw new Error(RACE_LOST);
                 }
+                // 5.1b 仲裁授权与状态翻转同事务(唯一 runtime 授权源 = active arbitrator_whitelist)
+                if (role === 'arbitrator') {
+                    const g = grantArbitratorTx(db, { userId: app_.user_id, grantedBy: adminId, note: 'governance onboarding 激活' });
+                    if (!g.ok) {
+                        grantErr = g.error_code || 'GRANT_FAILED';
+                        throw new Error(GRANT_ABORT);
+                    }
+                }
                 // 5.2 INSERT 新 row(append-only audit trail,action='activate')
                 const activateId = generateId('gapp');
                 db.prepare(`
@@ -409,7 +423,10 @@ export function registerGovernanceOnboardingRoutes(app, deps) {
             (id, user_id, role, action, status, passkey_sig, iron_rule_method)
           VALUES (?, ?, ?, 'activate', 'active', ?, 'passkey')
         `).run(activateId, app_.user_id, role, webauthn_token || null);
-                // 5.3 加 role 到 users.roles JSON 数组(去重)
+                // 5.3 加 role 到 users.roles JSON 数组(去重)。
+                //   仲裁员例外:仲裁资格 = active arbitrator_whitelist(5.1b 已同事务 grant,#209/#220),【不是角色】——
+                //   写进 roles 会在角色切换 UI 造出可切换的"仲裁员"假身份(与买卖身份互斥感误导用户,梦想者1号被卡案根源之一)。
+                //   普通人保留 buyer/seller 身份 + 白名单资格,仲裁台入口随 can_arbitrate 出现,买卖能力不受影响。
                 const user = db.prepare("SELECT roles FROM users WHERE id = ?").get(app_.user_id);
                 let roles = [];
                 try {
@@ -418,7 +435,7 @@ export function registerGovernanceOnboardingRoutes(app, deps) {
                 catch {
                     roles = [];
                 }
-                if (!roles.includes(role)) {
+                if (role !== 'arbitrator' && !roles.includes(role)) {
                     roles.push(role);
                     db.prepare("UPDATE users SET roles = ? WHERE id = ?").run(JSON.stringify(roles), app_.user_id);
                 }
@@ -428,6 +445,10 @@ export function registerGovernanceOnboardingRoutes(app, deps) {
             if (e.message === RACE_LOST) {
                 return void errorRes(res, 409, 'ALREADY_ACTIVATED', '该 application 已被其他 maintainer 激活(竞态)');
             }
+            if (e.message === GRANT_ABORT) { // PR-C.2:仲裁授权失败 → 整个激活已回滚
+                logAdminAction(adminId, 'governance_activate', 'user', app_.user_id, { ok: false, role, error_code: grantErr });
+                return void errorRes(res, 409, grantErr || 'GRANT_FAILED', '激活失败:无法授予仲裁员资格(见 error_code),激活已回滚');
+            }
             throw e; // 真实 SQL error → re-throw 给 express error handler
         }
         // 6. admin 审计 log(maintainer note 存 detail JSON,非 governance_applications 字段)
@@ -478,7 +499,10 @@ export function registerGovernanceOnboardingRoutes(app, deps) {
         catch {
             currentRoles = [];
         }
-        if (!currentRoles.includes(role)) {
+        // #249-P2:activate 已不再把 arbitrator 写进 users.roles(资格=白名单)→ 仲裁员的"当前在任"真源
+        //   = active whitelist(或 legacy roles 残留,两者任一即可卸);verifier 真源仍 = users.roles。
+        const wlActiveArb = role === 'arbitrator' && isActiveWhitelistArbitrator(db, userId);
+        if (!currentRoles.includes(role) && !wlActiveArb) {
             return void errorRes(res, 404, 'NOT_ACTIVE', `你当前不是 ${role},无需卸任`);
         }
         // 用于日志显示 + 后续 INSERT 关联(取最新的 active 行;若没有也容许,以 user.roles 为准)
@@ -534,7 +558,8 @@ export function registerGovernanceOnboardingRoutes(app, deps) {
         try {
             resignId = generateId('gapp');
             db.transaction(() => {
-                // 1. 重读 users.roles(进事务后)— 验证 role 仍存在再操作
+                // 1. 重读真源(进事务后)。仲裁员=active whitelist(#249 起 activate 不写 roles;suspend=自愿卸任可经
+                //    admin reinstate 复用,刻意不用终态 revoke);legacy roles 里的 'arbitrator' 存量一并摘除。verifier=users.roles。
                 const u = db.prepare("SELECT roles FROM users WHERE id = ?").get(userId);
                 let roles = [];
                 try {
@@ -543,10 +568,23 @@ export function registerGovernanceOnboardingRoutes(app, deps) {
                 catch {
                     roles = [];
                 }
-                if (!roles.includes(role))
+                const legacyInRoles = roles.includes(role);
+                if (role === 'arbitrator') {
+                    const wlNow = isActiveWhitelistArbitrator(db, userId);
+                    if (!wlNow && !legacyInRoles)
+                        throw new Error(RACE_LOST);
+                    if (wlNow) {
+                        const m = suspendArbitrator(db, { userId, note: '主动卸任(governance resign)' });
+                        if (!m.ok)
+                            throw new Error(RACE_LOST);
+                    }
+                }
+                else if (!legacyInRoles)
                     throw new Error(RACE_LOST);
-                roles = roles.filter(r => r !== role);
-                db.prepare("UPDATE users SET roles = ? WHERE id = ?").run(JSON.stringify(roles), userId);
+                if (legacyInRoles) {
+                    roles = roles.filter(r => r !== role);
+                    db.prepare("UPDATE users SET roles = ? WHERE id = ?").run(JSON.stringify(roles), userId);
+                }
                 // 2. 把所有该 user+role 的 active 行 → inactive(可能有 apply + activate 两行)
                 db.prepare("UPDATE governance_applications SET status = 'inactive' WHERE user_id = ? AND role = ? AND status = 'active'").run(userId, role);
                 // 3. INSERT resign 行(append-only audit)

package/dist/pwa/routes/logistics.js

@@ -1,8 +1,8 @@
 import { dbAll } from '../../layer0-foundation/L0-1-database/db.js'; // RFC-016 异步 DB seam
-import { stripDirectPayPaymentTarget } from '../direct-pay-order-redaction.js'; // 披露门:物流第三方绝不该见收款目标
+import { projectDirectPayTargetForViewer } from '../direct-pay-order-redaction.js'; // 披露门:按查看者投影(物流=第三方 → 剥离收款目标)
 export function registerLogisticsRoutes(app, deps) {
-    // db 已走 RFC-016 异步 seam(dbAll),不再直接用 deps.db
-    const { auth } = deps;
+    // 查询走 RFC-016 异步 seam(dbAll);db 仅传给共享投影器(其买家分支查 ack,本路由查看者恒第三方)
+    const { auth, db } = deps;
     app.get('/api/logistics/companies', async (_req, res) => {
         const companies = await dbAll(`SELECT id, name FROM users WHERE role = 'logistics' ORDER BY name ASC`);
         res.json(companies);
@@ -35,7 +35,7 @@ export function registerLogisticsRoutes(app, deps) {
     `, [user.id]);
         // 披露门:物流是非买家第三方,无条件删除 direct_p2p 收款目标(instruction 快照 + 账号快照);物流只需商品/状态/地址。
         for (const o of [...available, ...mine])
-            stripDirectPayPaymentTarget(o);
+            projectDirectPayTargetForViewer(db, o, user.id);
         res.json({ available, mine });
     });
 }

package/dist/pwa/routes/me-data.js

@@ -1,5 +1,5 @@
 import { dbOne, dbAll } from '../../layer0-foundation/L0-1-database/db.js'; // RFC-016 异步 DB seam
-import { redactUnackedDirectPayTarget } from '../direct-pay-order-redaction.js'; // 披露门:自导出的 orders 也不得旁路
+import { projectDirectPayTargetForViewer } from '../direct-pay-order-redaction.js'; // 披露门:自导出的 orders 也按查看者投影,不得旁路
 export function registerMeDataRoutes(app, deps) {
     // db 走 RFC-016 异步 seam(dbOne/dbAll);deps.db 仅供披露门(requireBothDisclosuresAcked 是同步 gate)
     const { auth, db } = deps;
@@ -58,7 +58,7 @@ export function registerMeDataRoutes(app, deps) {
             data.wallet = await dbOne(`SELECT balance, staked, escrowed, earned FROM wallets WHERE user_id = ?`, [uid]);
             data.orders = await dbAll(`SELECT * FROM orders WHERE buyer_id = ? OR seller_id = ? ORDER BY created_at DESC LIMIT 1000`, [uid, uid]);
             for (const o of data.orders)
-                redactUnackedDirectPayTarget(db, o, uid); // 披露门:自导出也不得在 D1/D2 ack 前泄露 direct_p2p 收款目标(JSON + CSV 同源)
+                projectDirectPayTargetForViewer(db, o, uid); // 披露门:自导出按查看者投影(买家行=ack 门/卖家行=收款方保留),JSON + CSV 同源
             data.shareables = await dbAll(`SELECT * FROM shareables WHERE owner_id = ? AND status != 'removed'`, [uid]);
             data.bookmarks = await dbAll(`SELECT b.*, s.title FROM shareable_bookmarks b LEFT JOIN shareables s ON s.id = b.shareable_id WHERE b.user_id = ?`, [uid]);
             data.likes = await dbAll(`SELECT l.*, s.title FROM shareable_likes l LEFT JOIN shareables s ON s.id = l.shareable_id WHERE l.user_id = ?`, [uid]);

package/dist/pwa/routes/mutual-cancel.js

@@ -0,0 +1,62 @@
+import { proposeMutualCancel, acceptMutualCancel, declineMutualCancel, withdrawMutualCancel, getMutualCancelState } from '../../layer3-trust/L3-1-dispute-engine/mutual-cancel.js';
+export function registerMutualCancelRoutes(app, deps) {
+    const { db, auth, generateId, errorRes } = deps;
+    // 域返回 error_code → HTTP 状态。未知/校验类 → 409(与当前状态冲突);系统缺失 → 500。
+    const httpFor = (code) => code === 'ORDER_NOT_FOUND' ? 404
+        : code === 'NOT_A_PARTY' ? 403
+            : code === 'SYS_MISSING' || code === 'TRANSITION_FAILED' ? 500
+                : 409;
+    app.get('/api/orders/:id/mutual-cancel', (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        const r = getMutualCancelState(db, req.params.id, user.id);
+        if (!r.ok)
+            return void errorRes(res, httpFor(r.error_code), r.error_code || 'MUTUAL_CANCEL_STATE_ERROR', r.error || '读取失败');
+        res.json({ success: true, proposal: r.proposal ?? null, can_propose: !!r.can_propose, can_accept: !!r.can_accept, can_decline: !!r.can_decline, can_withdraw: !!r.can_withdraw });
+    });
+    app.post('/api/orders/:id/mutual-cancel/propose', (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        const reason = typeof req.body?.reason === 'string' ? req.body.reason : null;
+        const r = proposeMutualCancel(db, req.params.id, user.id, reason, generateId('mcp'));
+        if (!r.ok)
+            return void errorRes(res, httpFor(r.error_code), r.error_code || 'MUTUAL_CANCEL_PROPOSE_ERROR', r.error || '提议失败');
+        res.json({ success: true, proposal_id: r.proposal_id, status: r.status });
+    });
+    app.post('/api/orders/:id/mutual-cancel/accept', (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        let r;
+        try {
+            // 资金 + 状态翻转 + 争议 resolved 必须同一原子边界(RFC-016 钱路铁律);域函数内已做竞态重校验。
+            r = db.transaction(() => acceptMutualCancel(db, req.params.id, user.id))();
+        }
+        catch (e) {
+            return void errorRes(res, 500, 'MUTUAL_CANCEL_ACCEPT_FAILED', e.message);
+        }
+        if (!r.ok)
+            return void errorRes(res, httpFor(r.error_code), r.error_code || 'MUTUAL_CANCEL_ACCEPT_ERROR', r.error || '确认失败');
+        res.json({ success: true, status: r.status, settlement: r.settlement });
+    });
+    app.post('/api/orders/:id/mutual-cancel/decline', (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        const r = declineMutualCancel(db, req.params.id, user.id);
+        if (!r.ok)
+            return void errorRes(res, httpFor(r.error_code), r.error_code || 'MUTUAL_CANCEL_DECLINE_ERROR', r.error || '拒绝失败');
+        res.json({ success: true, status: r.status });
+    });
+    app.post('/api/orders/:id/mutual-cancel/withdraw', (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        const r = withdrawMutualCancel(db, req.params.id, user.id);
+        if (!r.ok)
+            return void errorRes(res, httpFor(r.error_code), r.error_code || 'MUTUAL_CANCEL_WITHDRAW_ERROR', r.error || '撤回失败');
+        res.json({ success: true, status: r.status });
+    });
+}

package/dist/pwa/routes/orders-action.js

@@ -1,5 +1,7 @@
-import { dbOne, dbAll } from '../../layer0-foundation/L0-1-database/db.js';
+import { dbOne, dbAll, dbRun } from '../../layer0-foundation/L0-1-database/db.js';
+import { createNotification } from '../../layer2-business/L2-6-notifications/notification-engine.js';
 import { releaseFeeStake } from '../../direct-pay-ledger.js'; // Rail1 直付:取消/超时释放任何遗留模拟质押(AR 订单无 stake → no-op)
+import { restorePreShipDirectPayStock } from '../../direct-pay-stock.js'; // D3 库存回补唯一入口(pre-ship 放行;已出库拒绝)
 import { requireBothDisclosuresAcked } from '../../direct-pay-disclosures.js'; // PR-4e: D1/D2 披露契约门
 import { requireDirectPayHumanPasskey } from '../direct-pay-guards.js'; // PR-4e: 现场真人 Passkey/gate-token 门
 export function registerOrdersActionRoutes(app, deps) {
@@ -103,15 +105,15 @@ export function registerOrdersActionRoutes(app, deps) {
         // RFC-016: 校验读 → 异步 seam;下方 completed+history 写仍是同步 db.transaction(Phase 3 迁 pg 事务)
         const order = await dbOne('SELECT * FROM orders WHERE id = ?', [req.params.id]);
         if (!order)
-            return void res.status(404).json({ error: '订单不存在' });
+            return void res.status(404).json({ error: '订单不存在', error_code: 'ORDER_NOT_FOUND' });
         if (order.fulfillment_mode !== 'in_person')
-            return void res.status(400).json({ error: '该订单非面交' });
+            return void res.status(400).json({ error: '该订单非面交', error_code: 'NOT_IN_PERSON' });
         if (order.buyer_id !== user.id)
-            return void res.status(403).json({ error: '仅买家可确认面交完成' });
+            return void res.status(403).json({ error: '仅买家可确认面交完成', error_code: 'NOT_ORDER_BUYER' });
         if (!['paid', 'accepted'].includes(order.status))
-            return void res.status(400).json({ error: `订单状态 ${order.status} 不可确认面交` });
+            return void res.status(400).json({ error: `订单状态 ${order.status} 不可确认面交`, error_code: 'NOT_CONFIRMABLE_IN_PERSON' });
         if (order.has_pending_claim)
-            return void res.status(400).json({ error: '存在进行中的验证任务，不可确认' });
+            return void res.status(400).json({ error: '存在进行中的验证任务，不可确认', error_code: 'HAS_PENDING_CLAIM' });
         // Rail1:平台费已切换为链下应收(accrue 在完成结算时,与 completed 同一原子边界,fail-closed)。
         //   建单不再锁 fee-stake,故【不再】前置要求 locked stake(AR 订单本就无 stake)。
         const isDirectP2p = order.payment_rail === 'direct_p2p';
@@ -155,7 +157,8 @@ export function registerOrdersActionRoutes(app, deps) {
         // P0 fix: 受信角色禁交易
         if (isTrustedRole(user))
             return void res.status(403).json({ error: '受信角色不可参与订单流转', error_code: 'TRUSTED_ROLE_NO_TRADE' });
-        const { action, notes = '', evidence_description = '', logistics_company_id = '' } = req.body;
+        const { action, evidence_description = '', logistics_company_id = '' } = req.body;
+        let notes = String(req.body?.notes ?? '').slice(0, 500); // 服务端硬界:附言/备注最长 500 字符;mark_paid 时被服务端权威付款参考覆盖(见下)
         // RFC-016: 顶层校验读 → 异步 seam;state-machine / settle / decline 写序列仍同步(Phase 3 迁 pg 行锁+事务)
         const order = await dbOne('SELECT * FROM orders WHERE id = ?', [req.params.id]);
         if (!order)
@@ -177,15 +180,81 @@ export function registerOrdersActionRoutes(app, deps) {
             if (uid !== buyerId) {
                 return void res.status(403).json({ error: '你不是本订单的买家', error_code: 'NOT_ORDER_BUYER' });
             }
-            if (order.payment_rail !== 'direct_p2p' || order.status !== 'direct_pay_window') {
-                return void res.status(409).json({ error: '该操作仅适用于直付订单的付款窗口', error_code: 'NOT_DIRECT_PAY_WINDOW' });
+            // 买家取消:付款窗口内(未付/后悔)/ 货款协商阶段(承认未付)/ 付款窗过期宽限期(确认未付,免等 48h 自动关单 ——
+            //   审计项 H:状态机本就允许 buyer direct_expired_unconfirmed→cancelled,此 guard 曾与状态机矛盾=死能力)。mark_paid 仍仅付款窗口。
+            const cancelInQuery = action === 'cancel' && ['payment_query', 'direct_expired_unconfirmed'].includes(order.status);
+            if (order.payment_rail !== 'direct_p2p' || (order.status !== 'direct_pay_window' && !cancelInQuery)) {
+                return void res.status(409).json({ error: '该操作仅适用于直付订单的付款窗口/过期宽限/协商阶段', error_code: 'NOT_DIRECT_PAY_WINDOW' });
+            }
+        }
+        // ── Rail1 直付货款协商(争议≠仲裁)动作。均仅 direct_p2p + 角色/状态门。PR-B1 人驱动协商 + PR-B2 卖家宽限后请求取消。 ──
+        const PQ_ACTIONS = ['report_nonpayment', 'confirm_received', 'pq_escalate', 'pq_withdraw', 'request_cancel'];
+        if (PQ_ACTIONS.includes(action)) {
+            if (order.payment_rail !== 'direct_p2p')
+                return void res.status(409).json({ error: '该操作仅适用于直付订单', error_code: 'NOT_DIRECT_PAY' });
+            if ((action === 'report_nonpayment' || action === 'confirm_received' || action === 'request_cancel') && uid !== sellerId)
+                return void res.status(403).json({ error: '你不是本订单的卖家', error_code: 'NOT_ORDER_SELLER' });
+            if ((action === 'pq_escalate' || action === 'pq_withdraw') && uid !== buyerId && uid !== sellerId)
+                return void res.status(403).json({ error: '只有买卖双方可操作', error_code: 'NOT_ORDER_PARTY' });
+            if (action === 'report_nonpayment' && order.status !== 'accepted')
+                return void res.status(409).json({ error: `仅可在【待发货(accepted)】阶段报告未收款,当前 ${order.status}`, error_code: 'NOT_ACCEPTED' });
+            if ((action === 'confirm_received' || action === 'pq_escalate' || action === 'request_cancel') && order.status !== 'payment_query')
+                return void res.status(409).json({ error: `仅可在【货款协商(payment_query)】阶段操作,当前 ${order.status}`, error_code: 'NOT_PAYMENT_QUERY' });
+            if (action === 'pq_withdraw') {
+                if (order.status !== 'disputed')
+                    return void res.status(409).json({ error: `仅可在【争议(disputed)】阶段撤回,当前 ${order.status}`, error_code: 'NOT_DISPUTED' });
+                // 已裁定的争议不可撤回(disputed 已终结成 resolved/dismissed 前,dispute.status 仍 open/in_review)
+                const d = await dbOne("SELECT status FROM disputes WHERE order_id = ? ORDER BY created_at DESC LIMIT 1", [req.params.id]);
+                if (d && (d.status === 'resolved' || d.status === 'dismissed'))
+                    return void res.status(409).json({ error: '争议已裁定,不可撤回', error_code: 'DISPUTE_ALREADY_RULED' });
+                // ★ 撤回【仅限货款协商升级】的仲裁:最近一次进入 disputed 必须 from payment_query。
+                //   否则履约类争议(delivered→disputed 货损/货不对版)会被错误撤回、dismiss、状态倒退回 payment_query。fail-closed。
+                const lastDisputed = await dbOne("SELECT from_status FROM order_state_history WHERE order_id = ? AND to_status = 'disputed' ORDER BY created_at DESC, rowid DESC LIMIT 1", [req.params.id]);
+                if (!lastDisputed || lastDisputed.from_status !== 'payment_query')
+                    return void res.status(409).json({ error: '仅可撤回由货款协商升级的仲裁;履约类争议(货损/货不对版)须经仲裁裁定', error_code: 'NOT_PAYMENT_QUERY_DISPUTE' });
+            }
+        }
+        // PR-B2:卖家在【买家响应宽限已过】后请求取消 —— 不立即关单,而是开【N 天买家申诉窗】(payment_query_cancel_deadline)。
+        //   窗内买家仍可 confirm-side/主张已付/升级举证(pq_escalate);窗满由 cron 关单。不动状态,不涉资金。幂等(deadline 已设则不重置)。
+        if (action === 'request_cancel') {
+            const g = await dbOne("SELECT (payment_query_deadline IS NOT NULL AND datetime(payment_query_deadline) < datetime('now')) AS over FROM orders WHERE id = ?", [req.params.id]);
+            if (!g?.over)
+                return void res.status(409).json({ error: '买家响应宽限未到,暂不可请求取消', error_code: 'GRACE_NOT_ELAPSED' });
+            let rd = 7;
+            try {
+                const p = await dbOne("SELECT value FROM protocol_params WHERE key = 'direct_pay.payment_query_recourse_days'");
+                if (p)
+                    rd = Math.max(1, Number(p.value) || 7);
+            }
+            catch { }
+            await dbRun(`UPDATE orders SET payment_query_cancel_deadline = datetime('now', ? ) WHERE id = ? AND payment_query_cancel_deadline IS NULL`, [`+${rd} days`, req.params.id]);
+            const dl = (await dbOne("SELECT payment_query_cancel_deadline d FROM orders WHERE id = ?", [req.params.id]))?.d;
+            try {
+                createNotification(db, order.buyer_id, req.params.id, 'payment_query_cancel_requested', '⏳ 卖家申请取消订单', `卖家称未收到货款且你未回应,已申请取消。你约有 ${rd} 天:若确已付款请提供付款参考或发起举证(pq_escalate),否则订单将于 ${dl} 自动取消。直付非托管,无平台退款。`);
             }
+            catch { }
+            return void res.json({ success: true, status: 'payment_query', cancel_recourse_deadline: dl });
         }
         // PR-4e:mark_paid = direct_p2p RISK 动作(已过 direct_pay_window 只读预检)→ 两次披露门 + 现场真人 Passkey 门。cancel 不门控。
         if (action === 'mark_paid') {
             const g = directPayActionGate(req.params.id, 'mark_paid', uid, req.body?.webauthn_token);
             if (!g.ok)
                 return void res.status(g.status).json({ error: g.error, error_code: g.error_code });
+            // 防作弊 D1:付款参考【服务端权威派生】(与前端 dpPayRef 同算法),忽略客户端可伪造的参考文本 —— UI 已锁只读(#222),
+            //   这里把 API 级也收口:直接 POST 伪造 notes 冒充别单参考号 → 无效。客户端附言仅作补充备注,剥掉任何"付款参考"字样。
+            const canonicalRef = 'WAZ-' + req.params.id.replace(/[^a-zA-Z0-9]/g, '').slice(-8).toUpperCase();
+            const extra = notes.replace(/付款参考[::]?\s*[^\s·;,。]*/g, '').replace(/WAZ-[A-Z0-9]{8}/g, '').trim().slice(0, 120);
+            // 防作弊 D2:同买家·同卖家·同金额的其它在途直付单 → 时间线预警(一笔真实转账冒充两单的重复确认,卖家第一道防线)
+            const dup = await dbOne(`SELECT COUNT(*) n FROM orders WHERE buyer_id = ? AND seller_id = ? AND payment_rail = 'direct_p2p' AND total_amount = ? AND id != ? AND status IN ('accepted','shipped','picked_up','in_transit','delivered')`, [buyerId, sellerId, order.total_amount, req.params.id]);
+            // 审计项 E:时间线带上应付金额(下单冻结的参考换算)—— 卖家对账三要素:参考号 + 金额 + 币种,与买家所见同一数字
+            let payable = `应付 ${order.total_amount} USDC`;
+            try {
+                const ps = JSON.parse(order.direct_pay_account_snapshot || '{}');
+                if (Number.isFinite(Number(ps?.payable_approx)) && ps?.payable_currency)
+                    payable += `（≈${ps.payable_currency} ${Number(ps.payable_approx).toFixed(2)},下单时参考价）`;
+            }
+            catch { /* 快照缺失/坏 → 仅 USDC */ }
+            notes = `付款参考: ${canonicalRef} · ${payable}${extra ? ' · ' + extra : ''}${(dup?.n || 0) > 0 ? ` ⚠️ 同买家另有 ${dup.n} 笔同金额直付订单在途,请逐单核对付款参考再发货` : ''}`;
         }
         // Rail1:平台费链下应收,accrue 在完成结算时(settleOrder direct_p2p 分支)与 completed 同一原子边界、fail-closed
         //   (accrueFeeReceivable 缺费即抛 → 回滚 completed)。故【不再】前置要求 locked fee-stake。
@@ -324,6 +393,8 @@ export function registerOrdersActionRoutes(app, deps) {
                     if (!r.success)
                         throw new Error(r.error || '状态转移失败');
                     releaseFeeStake(db, { orderId: req.params.id });
+                    // D3 库存回补:经唯一守卫入口(仅 pre-ship 来源放行;已出库走退货验收,绝不直接回补 —— 见 direct-pay-stock.ts 情形矩阵)
+                    restorePreShipDirectPayStock(db, { fromStatus: fromStatusCancel, productId: order.product_id, quantity: Number(order.quantity) || 1 });
                 })();
             }
             catch (e) {
@@ -332,10 +403,65 @@ export function registerOrdersActionRoutes(app, deps) {
             notifyTransition(db, req.params.id, fromStatusCancel, 'cancelled');
             return void res.json({ success: true, status: 'cancelled', fee_stake_released: true });
         }
+        // 争议协商收口(买家侧):买家撤诉并确认收货 —— 限【delivered 来源履约争议 + 争议发起人本人 + 裁定前】。
+        //   为什么存在:买家发起"未收到货"争议后包裹晚到/找到代收点,双方合意收口不该只剩仲裁(卖家侧收口=协商取消)。
+        //   货款争议(payment_query 来源)不走这里 —— 那是 pq_withdraw 的撤回语义(回协商,不确认收货)。
+        //   全原子(Codex P1 模式):争议 dismissed + disputed→confirmed→completed + settleOrder 同一 db.transaction,
+        //   任一步失败整体回滚(订单仍 disputed、争议仍 open,可重试);两轨同块(escrow 释放托管货款,dp 计提平台费)。
+        if (action === 'dispute_withdraw_confirm') {
+            if (uid !== buyerId)
+                return void res.status(403).json({ error: '你不是本订单的买家', error_code: 'NOT_ORDER_BUYER' });
+            if (order.status !== 'disputed')
+                return void res.status(409).json({ error: `订单状态 ${order.status} 不可撤诉确认收货(仅争议中)`, error_code: 'ORDER_NOT_DISPUTED' });
+            // RFC-016:两条纯预检读 → 异步 seam;事务内的 disputes UPDATE + transition + settle 写序列仍同步(原子性)
+            const dsp = await dbOne("SELECT id, initiator_id FROM disputes WHERE order_id = ? AND status IN ('open','in_review') ORDER BY created_at DESC, rowid DESC LIMIT 1", [req.params.id]);
+            if (!dsp)
+                return void res.status(409).json({ error: '争议已裁定或不存在,不可撤诉', error_code: 'DISPUTE_ALREADY_RULED' });
+            if (dsp.initiator_id !== uid)
+                return void res.status(403).json({ error: '仅争议发起人可撤诉', error_code: 'NOT_DISPUTE_INITIATOR' });
+            const lastDisputedFrom = await dbOne("SELECT from_status FROM order_state_history WHERE order_id = ? AND to_status = 'disputed' ORDER BY created_at DESC, rowid DESC LIMIT 1", [req.params.id]);
+            if (lastDisputedFrom?.from_status !== 'delivered') {
+                return void res.status(409).json({ error: '仅"已投递后未收到货/货有问题"类争议可撤诉确认收货;货款争议请用"撤回仲裁·回到协商"', error_code: 'NOT_FULFILMENT_DISPUTE' });
+            }
+            // dp = RISK 动作(确认收货即完成结算、计提平台费):所有只读预检过后才消费 Passkey token(与 confirm 同门)
+            if (order.payment_rail === 'direct_p2p') {
+                const g = directPayActionGate(req.params.id, 'dispute_withdraw_confirm', uid, req.body?.webauthn_token);
+                if (!g.ok)
+                    return void res.status(g.status).json({ error: g.error, error_code: g.error_code });
+            }
+            try {
+                db.transaction(() => {
+                    db.prepare("UPDATE disputes SET status = 'dismissed', verdict_reason = ?, resolved_at = datetime('now') WHERE id = ? AND status IN ('open','in_review')")
+                        .run(notes ? `买家撤诉并确认收货:${notes}` : '买家撤诉并确认收货', dsp.id);
+                    const r1 = transition(db, req.params.id, 'confirmed', uid, [], notes);
+                    if (!r1.success)
+                        throw new Error(r1.error || 'confirmed transition failed');
+                    const r2 = transition(db, req.params.id, 'completed', 'sys_protocol', [], '系统自动结算');
+                    if (!r2.success)
+                        throw new Error(r2.error || 'completed transition failed');
+                    settleOrder(req.params.id);
+                })();
+            }
+            catch (e) {
+                return void res.status(409).json({ error: `撤诉确认收货失败,订单未变更(仍在争议中,可重试):${e.message}`, error_code: 'DISPUTE_CLOSE_SETTLE_FAILED' });
+            }
+            notifyTransition(db, req.params.id, 'confirmed', 'completed');
+            try {
+                createNotification(db, sellerId, req.params.id, 'dispute_withdrawn_confirmed', '✅ 买家已撤诉并确认收货', '买家撤回争议并确认收货,订单已完成结算,双方信誉不受影响。', { templateKey: 'dispute_withdrawn_confirmed', params: {} });
+            }
+            catch { /* 通知失败不阻断 */ }
+            try {
+                broadcastSystemEvent('order_completed', '✓', `订单完成 ${req.params.id}`, req.params.id);
+            }
+            catch { }
+            return void res.json({ success: true, status: 'completed', dispute_dismissed: true });
+        }
         const actionMap = {
             accept: 'accepted', ship: 'shipped', pickup: 'picked_up',
             transit: 'in_transit', deliver: 'delivered', confirm: 'confirmed', dispute: 'disputed',
             mark_paid: 'accepted', // Rail1 直付:买家声明"我已付款" → accepted(汇入既有卖家发货流程;协议不验真实付款)
+            // Rail1 货款协商:卖家报未收款→协商;卖家确认已收→恢复;升级→举证仲裁;撤回→回协商(pq_withdraw 由上方原子块 early-return 处理,列此仅为通过 !toStatus 校验)。
+            report_nonpayment: 'payment_query', confirm_received: 'accepted', pq_escalate: 'disputed', pq_withdraw: 'payment_query',
         };
         const toStatus = actionMap[action];
         if (!toStatus)
@@ -375,11 +501,58 @@ export function registerOrdersActionRoutes(app, deps) {
             catch { }
             return void res.json({ success: true, status: 'completed', settlement: { rail: 'direct_p2p', fee_accrued: true } });
         }
+        // Rail1 撤回仲裁:disputed→payment_query + 【同一事务】关闭活跃 dispute(否则订单回协商但仲裁视图仍见活跃争议 → 脏状态,
+        //   仲裁员可能对已回协商的单裁定)。原子后重建买家响应宽限,让 PR-B2 的宽限/超时 cron 有截止时间可依赖。
+        if (action === 'pq_withdraw') {
+            try {
+                db.transaction(() => {
+                    const r = transition(db, req.params.id, 'payment_query', user.id, [], notes);
+                    if (!r.success)
+                        throw new Error(r.error || 'withdraw transition failed');
+                    db.prepare("UPDATE disputes SET status = 'dismissed', verdict_reason = COALESCE(verdict_reason, '撤回仲裁,回到协商'), resolved_at = datetime('now') WHERE order_id = ? AND status IN ('open', 'in_review')").run(req.params.id);
+                })();
+            }
+            catch (e) {
+                return void res.status(409).json({ error: `撤回仲裁失败:${e.message}`, error_code: 'WITHDRAW_FAILED' });
+            }
+            let gh = 72;
+            try {
+                const p = await dbOne("SELECT value FROM protocol_params WHERE key = 'direct_pay.payment_query_grace_hours'");
+                if (p)
+                    gh = Math.max(1, Number(p.value) || 72);
+            }
+            catch { }
+            await dbRun(`UPDATE orders SET payment_query_deadline = datetime('now', ? ), payment_query_cancel_deadline = NULL WHERE id = ?`, [`+${gh} hours`, req.params.id]);
+            notifyTransition(db, req.params.id, 'disputed', 'payment_query');
+            return void res.json({ success: true, status: 'payment_query', dispute_withdrawn: true });
+        }
         const fromStatus = order.status;
         const result = transition(db, req.params.id, toStatus, user.id, evidenceIds, notes);
         if (!result.success)
             return void res.json({ error: result.error });
         notifyTransition(db, req.params.id, fromStatus, toStatus);
+        // 审计项 B(N2):买家标记付款 → 通知卖家核款发货(direct_pay_window→accepted 不在 notifyTransition RULES,
+        //   此前卖家全程收不到"已付款"信号只能手动刷)。notes 即 D1/D2/E 的权威对账串(参考号+应付+多单预警),直接复用。
+        if (action === 'mark_paid') {
+            try {
+                createNotification(db, sellerId, req.params.id, 'direct_pay_marked_paid', '💰 买家已标记付款,请核对后发货', `${notes}。请核对银行/收款App流水后再发货;未收到请点"未收到货款"。`, { templateKey: 'dp_marked_paid', params: { detail: notes } });
+            }
+            catch { /* 通知失败不阻断 */ }
+        }
+        // Rail1 货款协商:卖家报未收款 → 设买家响应宽限(PR-B2 卖家据此才可请求取消);确认已收/升级 → 清协商截止。
+        if (action === 'report_nonpayment') {
+            let gh = 72;
+            try {
+                const p = await dbOne("SELECT value FROM protocol_params WHERE key = 'direct_pay.payment_query_grace_hours'");
+                if (p)
+                    gh = Math.max(1, Number(p.value) || 72);
+            }
+            catch { }
+            await dbRun(`UPDATE orders SET payment_query_deadline = datetime('now', ? ) WHERE id = ?`, [`+${gh} hours`, req.params.id]);
+        }
+        if (action === 'confirm_received' || action === 'pq_escalate') {
+            await dbRun(`UPDATE orders SET payment_query_deadline = NULL, payment_query_cancel_deadline = NULL WHERE id = ?`, [req.params.id]);
+        }
         if (toStatus === 'disputed') {
             createDispute(db, req.params.id, user.id, notes || evidence_description || '买家发起争议', evidenceIds);
             try {

package/dist/pwa/routes/orders-create.js

@@ -3,6 +3,9 @@ import { buildCartMandate, buildPaymentMandate, signMandate } from './ap2-mandat
 import { toUnits, toDecimal, mulQty, mulRate } from '../../money.js';
 import { createDirectPayResponse } from '../../direct-pay-create.js'; // PR-4c: direct_p2p 建单分叉(生产门+收款指令门+原子建单;本金不入协议)
 import { applyWalletDelta } from '../../ledger.js';
+import { gateShippingForCreate } from '../../shipping-templates.js';
+import { buildTradeTermsSnapshot, writeTradeTermsSnapshot } from '../../trade-terms.js';
+import { gateSaleRegionForCreate } from '../../sale-regions.js'; // PR-2 运费守门 + S0 条款快照 + S1 可售门(意愿/合规先于物流)
 import { dbOne } from '../../layer0-foundation/L0-1-database/db.js'; // RFC-016 异步 DB seam(仅下单事务外的预检查;事务内 escrow/INSERT 保持同步)
 // 店铺推荐 → 商品三级归因的【懒升级】(sync,跑在下单事务内、getProductShareChain 之前)。
 // 严格门槛(任一不满足则不升级,绝不覆盖已有有效直接归因):
@@ -229,7 +232,12 @@ export function registerOrdersCreateRoutes(app, deps) {
         const priceAfterCouponU = Math.max(0, subtotalU - toUnits(couponDiscount));
         const insuranceRate = getProtocolParam('order_insurance_rate', 0.01);
         const insurancePremiumU = buy_insurance ? mulRate(priceAfterCouponU, insuranceRate) : 0;
-        const totalAmountU = Math.max(0, priceAfterCouponU + insurancePremiumU);
+        if (!gateSaleRegionForCreate(db, res, product, String(product.seller_uid), req.body?.ship_to_region, getProtocolParam))
+            return;
+        const _ship = gateShippingForCreate(db, res, product, String(product.seller_uid), req.body?.ship_to_region, String(req.body?.payment_rail || '') === 'direct_p2p' ? 'direct_p2p' : 'escrow', priceAfterCouponU);
+        if (!_ship)
+            return; // PR-2 运费模板:有模板必选地区且须命中(400/409 已写);无模板=原行为
+        const totalAmountU = Math.max(0, priceAfterCouponU + insurancePremiumU + _ship.feeU); // 运费并入总额(与保险费同惯例;快照 orders.shipping_fee)
         // B5 主动捐赠 — 按订单总额 × 比例算（额外扣款，进 charity_fund）
         const donationAmountU = donationPctNum > 0 ? mulRate(totalAmountU, donationPctNum) : 0;
         // decimal 视图(落库 / 下游 AP2 / 响应,均为 base-unit 干净值)
@@ -237,9 +245,10 @@ export function registerOrdersCreateRoutes(app, deps) {
         const insurancePremium = toDecimal(insurancePremiumU);
         const totalAmount = toDecimal(totalAmountU);
         const donationAmount = toDecimal(donationAmountU);
+        const shippingFee = toDecimal(_ship.feeU);
         // PR-4c:direct_p2p 分叉 —— 本金不入协议,跳过下方 escrow 预检/事务,改走直付建单(生产门+收款指令门+原子建单,仅锁卖家 fee-stake)。
         if (String(req.body?.payment_rail || '') === 'direct_p2p')
-            return void createDirectPayResponse(res, db, { generateId, transition, appendOrderEvent, getProtocolParam }, { product, buyerId: user.id, reqQty, basePrice, totalAmount, totalAmountU, shippingAddress: String(shipping_address), directReceiveAccountId: (typeof req.body?.direct_receive_account_id === 'string' && req.body.direct_receive_account_id) ? String(req.body.direct_receive_account_id) : undefined, opts: { variantId: variant_id, hasVariants: Number(product.has_variants) === 1, flashActive: !!flashSale, couponCode: coupon_code, buyInsurance: !!buy_insurance, donationPct: donationPctNum, isGift: !!is_gift, anonymous: anonymousFlag === 1, deliveryWindow: !!delivery_window } });
+            return void createDirectPayResponse(res, db, { generateId, transition, appendOrderEvent, getProtocolParam }, { product, buyerId: user.id, reqQty, basePrice, totalAmount, totalAmountU, shippingAddress: String(shipping_address), directReceiveAccountId: (typeof req.body?.direct_receive_account_id === 'string' && req.body.direct_receive_account_id) ? String(req.body.direct_receive_account_id) : undefined, opts: { variantId: variant_id, hasVariants: Number(product.has_variants) === 1, flashActive: !!flashSale, couponCode: coupon_code, buyInsurance: !!buy_insurance, donationPct: donationPctNum, isGift: !!is_gift, anonymous: anonymousFlag === 1, deliveryWindow: !!delivery_window }, shipping: { region: _ship.region, fee: _ship.fee, estDays: _ship.estDays, quoteRequired: _ship.quoteRequired, freeThresholdApplied: _ship.freeThresholdApplied } });
         // 友好预检查(读):真正的守恒在下面的同步事务内(applyWalletDelta 绝对值落库)。
         const wallet = await dbOne('SELECT balance FROM wallets WHERE user_id = ?', [user.id]);
         if (!wallet)
@@ -249,6 +258,7 @@ export function registerOrdersCreateRoutes(app, deps) {
         const now = new Date();
         const orderId = generateId('ord');
         let autoAccepted = false;
+        const _acceptModeAuto = ((product.accept_mode ?? (await dbOne('SELECT store_accept_mode FROM users WHERE id = ?', [product.seller_uid]))?.store_accept_mode) === 'auto'); // 接单模式 v16:单品??店铺默认;'auto'→paid 后系统自动接单;escrow manual/未设=原流程(托管中间态+24h 超时退款)零钱路改动;tx 外 seam 读
         // P0: 整个下单流程原子化 — INSERT order + UPDATE wallet + UPDATE products + transition 任一步抛错全部回滚
         try {
             db.transaction(() => {
@@ -304,8 +314,9 @@ export function registerOrdersCreateRoutes(app, deps) {
           l1_uid, l2_uid, l3_uid, snapshot_commission_rate, buyer_region, content_hash_at_order,
           delivery_window, variant_id, variant_options_snapshot,
           gift_recipient_name, gift_recipient_phone, gift_message, insurance_premium,
-          anonymous_recipient, recipient_code, donation_amount, stake_backing
-        ) VALUES (?,?,?,?,?,?,?,?,'created',?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)`).run(orderId, product.id, user.id, product.seller_uid, reqQty, basePrice, totalAmount, totalAmount, shipping_address, notes || null, addHours(now, 24), addHours(now, 48), addHours(now, 120), addHours(now, 168), addHours(now, 336), addHours(now, 408), l1, l2, l3, snapshotRate, buyerRegionSnapshot, contentHashSnapshot, deliveryWindowJson, variant ? variant.id : null, variant ? variant.options_json : null, giftRecipientName, giftRecipientPhone, giftMessage, insurancePremium, anonymousFlag, recipientCode, donationAmount, stakeBacking);
+          anonymous_recipient, recipient_code, donation_amount, stake_backing, ship_to_region, shipping_fee, shipping_est_days
+        ) VALUES (?,?,?,?,?,?,?,?,'created',?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)`).run(orderId, product.id, user.id, product.seller_uid, reqQty, basePrice, totalAmount, totalAmount, shipping_address, notes || null, addHours(now, 24), addHours(now, 48), addHours(now, 120), addHours(now, 168), addHours(now, 336), addHours(now, 408), l1, l2, l3, snapshotRate, buyerRegionSnapshot, contentHashSnapshot, deliveryWindowJson, variant ? variant.id : null, variant ? variant.options_json : null, giftRecipientName, giftRecipientPhone, giftMessage, insurancePremium, anonymousFlag, recipientCode, donationAmount, stakeBacking, _ship.region, _ship.feeU > 0 || _ship.region ? shippingFee : null, _ship.estDays);
+                writeTradeTermsSnapshot(db, orderId, buildTradeTermsSnapshot(db, { productId: String(product.id), sellerId: String(product.seller_uid), shipping: { source: _ship.region ? 'template' : 'none', region: _ship.region ?? null, fee: _ship.region ? shippingFee : null, estDays: _ship.estDays ?? null, freeThresholdApplied: _ship.freeThresholdApplied }, acceptModeEffective: _acceptModeAuto ? 'auto' : null })); // S0 条款快照:冻结下单时效/退货/清关/税责声明(fail-soft,非计价输入)
                 // 协议层：写 genesis 事件 — order 创建（必然是 buyer 自己）
                 try {
                     appendOrderEvent(db, {
@@ -382,11 +393,11 @@ export function registerOrdersCreateRoutes(app, deps) {
                 catch (e) {
                     console.error('[M3-C audit]', e);
                 }
-                // 检查卖家是否有 auto_accept Skill
-                if (shouldAutoAccept(db, orderId)) {
+                // 自动接单:卖家接单模式 'auto'(v16)或 auto_accept Skill。
+                if (_acceptModeAuto || shouldAutoAccept(db, orderId)) {
                     const sysUser = db.prepare("SELECT id FROM users WHERE id = 'sys_protocol'").get();
                     if (sysUser) {
-                        const ar = transition(db, orderId, 'accepted', sysUser.id, [], '⚡ auto_accept Skill 自动接单');
+                        const ar = transition(db, orderId, 'accepted', sysUser.id, [], _acceptModeAuto ? '⚡ 自动接单(卖家接单模式设置)' : '⚡ auto_accept Skill 自动接单');
                         if (ar.success) {
                             notifyTransition(db, orderId, 'paid', 'accepted');
                             autoAccepted = true;