@seasonkoh/webaz 0.1.29 → 0.1.31

package/dist/layer2-business/L2-6-notifications/notification-engine.js

@@ -14,7 +14,7 @@ export function initNotificationSchema(db) {
       id         TEXT PRIMARY KEY,
       user_id    TEXT NOT NULL REFERENCES users(id),
       order_id   TEXT REFERENCES orders(id),
-      type       TEXT NOT NULL,
+      type       TEXT NOT NULL DEFAULT 'system',   -- fresh 库直接带默认:server 的 2026-05-24 重建迁移只在"无默认"时触发,曾在 fresh boot 上重建并吞掉本函数刚 ALTER 的 template_key/params(pg 逐列 parity 抓出)
       title      TEXT NOT NULL,
       body       TEXT NOT NULL,
       read       INTEGER DEFAULT 0,
@@ -22,6 +22,16 @@ export function initNotificationSchema(db) {
     );
     CREATE INDEX IF NOT EXISTS idx_notif_user ON notifications(user_id, read, created_at DESC);
   `);
+    // N1 通知 i18n 架构(审计项 B):template_key + params(JSON)—— 客户端按 viewer locale 用 t() 渲染;
+    //   旧行两列为 NULL → 前端回退存量中文 title/body(不 backfill)。ALTER 必须在 CREATE 之后(schema 铁律)。
+    try {
+        db.exec('ALTER TABLE notifications ADD COLUMN template_key TEXT');
+    }
+    catch { /* 已有 */ }
+    try {
+        db.exec('ALTER TABLE notifications ADD COLUMN params TEXT');
+    }
+    catch { /* 已有 */ }
 }
 // 实时推送回调（由 PWA server 注入，解耦依赖）
 let pushCallback = null;
@@ -30,103 +40,139 @@ export function setPushCallback(cb) {
 }
 const RULES = {
     'created→paid': {
-        recipients: ['seller'],
+        recipients: ['seller'], key: 'ord_created_paid',
         title: '🛍️ 新订单',
         body: ctx => `${ctx.buyerName} 下单了「${ctx.productTitle}」，金额 ${ctx.totalAmount} WAZ。请在 24h 内接单，否则自动退款。`,
     },
     'paid→accepted': {
-        recipients: ['buyer'],
+        recipients: ['buyer'], key: 'ord_paid_accepted',
         title: '✅ 卖家已接单',
         body: ctx => `${ctx.sellerName} 已接受你的订单，预计 5 天内发货。`,
     },
     'paid→cancelled': {
-        recipients: ['buyer'],
+        recipients: ['buyer'], key: 'ord_paid_cancelled',
         title: '❌ 订单已取消',
         body: ctx => `订单「${ctx.productTitle}」已取消，${ctx.totalAmount} WAZ 将原路退回。`,
     },
     'accepted→shipped': {
-        recipients: ['buyer'],
+        recipients: ['buyer'], key: 'ord_accepted_shipped',
         title: '📦 商品已发货',
         body: ctx => `${ctx.sellerName} 已发货，物流 48h 内揽收后你可以追踪包裹。`,
     },
     'shipped→picked_up': {
-        recipients: ['buyer', 'seller'],
+        recipients: ['buyer', 'seller'], key: 'ord_shipped_picked_up',
         title: '🚚 物流已揽收',
         body: ctx => `包裹已由${ctx.logisticsName ?? '物流方'}揽收，正在运输中。`,
     },
     'picked_up→in_transit': {
-        recipients: ['buyer'],
+        recipients: ['buyer'], key: 'ord_picked_up_in_transit',
         title: '🚛 包裹运输中',
         body: ctx => `你的「${ctx.productTitle}」正在运输途中。`,
     },
-    // 注：曾有 'accepted→cancelled' 通知规则 — 但 VALID_TRANSITIONS 不允许 accepted 直接到
-    // cancelled（只能走 disputed 或 fault_seller）。该规则永不触发，已删除。
-    // 若以后开"卖家接单后主动取消"通道，需先在 L0-2 状态机加 transition，再恢复此规则。
+    // 注：曾有 'accepted→cancelled' 通知规则 — 该边现已存在但仅 system actor(直付取消退款握手,v12),
+    // 通知由握手路由自己发(direct_pay_cancel_settled),不走本规则表。
     'in_transit→delivered': {
-        recipients: ['buyer'],
+        recipients: ['buyer'], key: 'ord_in_transit_delivered',
         title: '📬 包裹已投递',
         body: ctx => `你的包裹已送达，请确认收货。72 小时内未确认将自动完成。`,
     },
     'delivered→confirmed': {
-        recipients: ['seller'],
-        title: '💰 买家确认收货',
-        body: ctx => `${ctx.buyerName} 已确认收货，${ctx.totalAmount} WAZ 结算中。`,
+        recipients: ['seller'], key: ctx => ctx.paymentRail === 'direct_p2p' ? 'ord_delivered_confirmed_dp' : 'ord_delivered_confirmed',
+        title: ctx => ctx.paymentRail === 'direct_p2p' ? '✅ 买家确认收货' : '💰 买家确认收货',
+        body: ctx => ctx.paymentRail === 'direct_p2p'
+            ? `${ctx.buyerName} 已确认收货，订单完成。直付为非托管:货款由你与买家场外结算,协议不代收、无平台资金入账。`
+            : `${ctx.buyerName} 已确认收货，${ctx.totalAmount} WAZ 结算中。`,
     },
     'confirmed→completed': {
-        recipients: ['seller'],
-        title: '✅ 交易完成，资金到账',
-        body: ctx => `订单「${ctx.productTitle}」交易完成，收益已入账，查看钱包确认。`,
+        recipients: ['seller'], key: ctx => ctx.paymentRail === 'direct_p2p' ? 'ord_confirmed_completed_dp' : 'ord_confirmed_completed',
+        title: ctx => ctx.paymentRail === 'direct_p2p' ? '✅ 交易完成' : '✅ 交易完成，资金到账',
+        body: ctx => ctx.paymentRail === 'direct_p2p'
+            ? `订单「${ctx.productTitle}」交易完成。直付为非托管:无平台资金结算,货款以你与买家场外结算为准。`
+            : `订单「${ctx.productTitle}」交易完成，收益已入账，查看钱包确认。`,
     },
     'paid→disputed': {
-        recipients: ['seller'],
+        recipients: ['seller'], key: 'ord_paid_disputed',
         title: '⚠️ 买家发起争议',
         body: ctx => `${ctx.buyerName} 对订单「${ctx.productTitle}」发起了争议。请在 48 小时内提交反驳证据，否则协议自动裁定退款。`,
     },
     'accepted→disputed': {
-        recipients: ['seller'],
+        recipients: ['seller'], key: 'ord_accepted_disputed',
         title: '⚠️ 买家发起争议',
         body: ctx => `${ctx.buyerName} 对订单「${ctx.productTitle}」发起了争议，请在 48h 内回应。`,
     },
     'shipped→disputed': {
-        recipients: ['seller', 'logistics'],
+        recipients: ['seller', 'logistics'], key: 'ord_shipped_disputed',
         title: '⚠️ 发生争议',
         body: ctx => `订单「${ctx.productTitle}」出现争议，请提交相关证据。`,
     },
     'in_transit→disputed': {
-        recipients: ['seller', 'logistics'],
+        recipients: ['seller', 'logistics'], key: 'ord_in_transit_disputed',
         title: '⚠️ 运输中发生争议',
         body: ctx => `订单「${ctx.productTitle}」运输过程中发生争议，请及时回应。`,
     },
     'delivered→disputed': {
-        recipients: ['seller'],
+        recipients: ['seller'], key: 'ord_delivered_disputed',
         title: '⚠️ 买家对收货发起争议',
         body: ctx => `${ctx.buyerName} 声称货物有问题，已发起争议。请在 48h 内提交证据。`,
     },
+    // ── 裁定/违约:资金语义 rail-fork —— direct_p2p 非托管,平台不持货款,绝不能写"资金已释放/退回"(那是假话) ──
     'disputed→completed': {
-        recipients: ['buyer', 'seller'],
+        recipients: ['buyer', 'seller'], key: ctx => ctx.paymentRail === 'direct_p2p' ? 'ord_disputed_completed_dp' : 'ord_disputed_completed',
         title: '⚖️ 争议裁定：卖家胜诉',
-        body: ctx => `订单「${ctx.productTitle}」争议已裁定，资金已释放给卖家。`,
+        body: ctx => ctx.paymentRail === 'direct_p2p'
+            ? `订单「${ctx.productTitle}」争议已裁定:卖家胜诉(直付为信誉裁决,不涉资金流转)。`
+            : `订单「${ctx.productTitle}」争议已裁定，资金已释放给卖家。`,
     },
     'disputed→cancelled': {
-        recipients: ['buyer', 'seller'],
-        title: '⚖️ 争议裁定：退款买家',
-        body: ctx => `订单「${ctx.productTitle}」争议已裁定，${ctx.totalAmount} WAZ 已退回买家。`,
+        recipients: ['buyer', 'seller'], key: ctx => ctx.paymentRail === 'direct_p2p' ? 'ord_disputed_cancelled_dp' : 'ord_disputed_cancelled',
+        title: ctx => ctx.paymentRail === 'direct_p2p' ? '⚖️ 争议裁定：支持买家' : '⚖️ 争议裁定：退款买家',
+        body: ctx => ctx.paymentRail === 'direct_p2p'
+            ? `订单「${ctx.productTitle}」争议已裁定支持买家。直付非托管:平台无资金可退,退款由双方场外处理;卖家信誉处罚已记录。`
+            : `订单「${ctx.productTitle}」争议已裁定，${ctx.totalAmount} WAZ 已退回买家。`,
     },
     'paid→fault_seller': {
-        recipients: ['buyer', 'seller'],
+        recipients: ['buyer', 'seller'], key: 'ord_paid_fault_seller',
         title: '⏰ 卖家超时违约',
         body: ctx => `卖家超时未接单，订单已自动取消，${ctx.totalAmount} WAZ 退款处理中。`,
     },
     'accepted→fault_seller': {
-        recipients: ['buyer', 'seller'],
+        recipients: ['buyer', 'seller'], key: ctx => ctx.paymentRail === 'direct_p2p' ? 'ord_accepted_fault_seller_dp' : 'ord_accepted_fault_seller',
         title: '⏰ 卖家超时未发货',
-        body: ctx => `卖家超时未发货，订单已判违约，资金退回。`,
+        body: ctx => ctx.paymentRail === 'direct_p2p'
+            ? `卖家超时未发货，订单已判卖家违约(直付非托管:平台无资金可退,违约已记入卖家信誉;退款请与卖家场外协商,协商未果可发起争议)。`
+            : `卖家超时未发货，订单已判违约，资金退回。`,
     },
     'in_transit→fault_logistics': {
-        recipients: ['buyer', 'seller'],
+        recipients: ['buyer', 'seller'], key: 'ord_in_transit_fault_logistics',
         title: '⏰ 物流超时',
         body: ctx => `物流方超时未完成投递，已自动记录违约。`,
     },
+    // ── Direct Pay 货款协商(争议≠仲裁,非托管:全程无退款/资金语义)──────────────────
+    'accepted→payment_query': {
+        recipients: ['buyer'], key: 'ord_accepted_payment_query',
+        title: '🔎 卖家未收到货款',
+        body: ctx => `卖家报告尚未收到「${ctx.productTitle}」的货款,请核实:若确已付款请提供付款参考,若未付款可取消订单。直付非托管,协议不代收/不退款。`,
+    },
+    'payment_query→accepted': {
+        recipients: ['buyer'], key: 'ord_payment_query_accepted',
+        title: '✅ 卖家已确认收款',
+        body: ctx => `卖家已确认收到「${ctx.productTitle}」的货款,订单恢复,等待发货。`,
+    },
+    'payment_query→disputed': {
+        recipients: ['buyer', 'seller'], key: 'ord_payment_query_disputed',
+        title: '⚖️ 货款协商升级举证仲裁',
+        body: ctx => `「${ctx.productTitle}」货款协商未果,已进入举证仲裁(证据制信誉裁决,非托管:不涉退款/放款)。请提交证据。`,
+    },
+    'disputed→payment_query': {
+        recipients: ['buyer', 'seller'], key: 'ord_disputed_payment_query',
+        title: '↩️ 仲裁已撤回,回到协商',
+        body: ctx => `「${ctx.productTitle}」的仲裁申请已撤回,回到买卖双方协商。`,
+    },
+    'payment_query→cancelled': {
+        recipients: ['buyer', 'seller'], key: 'ord_payment_query_cancelled', // 买家取消(卖家知)/ 系统申诉窗满关单(买家知)
+        title: '🚫 直付订单已取消(协商)',
+        body: ctx => `「${ctx.productTitle}」订单已取消(货款协商未达成)。直付非托管,无平台退款。`,
+    },
 };
 // ─── 主入口：状态变更后调用 ───────────────────────────────────
 export function notifyTransition(db, orderId, fromStatus, toStatus) {
@@ -137,19 +183,23 @@ export function notifyTransition(db, orderId, fromStatus, toStatus) {
     const ctx = getOrderCtx(db, orderId);
     if (!ctx)
         return;
-    const title = rule.title;
+    const title = typeof rule.title === 'function' ? rule.title(ctx) : rule.title;
     const body = rule.body(ctx);
     const type = `${fromStatus}→${toStatus}`;
+    // N1 迁移:模板 key + 参数落库,客户端按 viewer locale 渲染;title/body 保持中文回退(零迁移)。
+    //   logistics 缺省的兜底词交给客户端模板本地化(服务端不硬编码中文进 params)。
+    const templateKey = typeof rule.key === 'function' ? rule.key(ctx) : rule.key;
+    const params = { buyer: ctx.buyerName, seller: ctx.sellerName, product: ctx.productTitle, amount: ctx.totalAmount, ...(ctx.logisticsName ? { logistics: ctx.logisticsName } : {}) };
     // 确定收件人 ID 列表
     const recipientIds = resolveRecipients(db, rule.recipients, ctx, orderId);
     for (const userId of recipientIds) {
-        createNotification(db, userId, orderId, type, title, body);
+        createNotification(db, userId, orderId, type, title, body, { templateKey, params });
     }
 }
 // ─── 工具函数 ─────────────────────────────────────────────────
 function getOrderCtx(db, orderId) {
     const row = db.prepare(`
-    SELECT o.buyer_id, o.seller_id, o.logistics_id, o.total_amount,
+    SELECT o.buyer_id, o.seller_id, o.logistics_id, o.total_amount, o.payment_rail,
            ub.name as buyer_name, us.name as seller_name,
            ul.name as logistics_name, p.title as product_title
     FROM orders o
@@ -168,6 +218,7 @@ function getOrderCtx(db, orderId) {
         logisticsName: row.logistics_name,
         productTitle: row.product_title,
         totalAmount: row.total_amount,
+        paymentRail: row.payment_rail,
     };
 }
 function resolveRecipients(db, roles, ctx, orderId) {
@@ -180,14 +231,31 @@ function resolveRecipients(db, roles, ctx, orderId) {
             ids.add(order.seller_id);
         if (role === 'logistics' && order.logistics_id)
             ids.add(order.logistics_id);
+        if (role === 'admins') {
+            // 收件人=全体 admin(users.role='admin';root/regional 由具体规则语义决定是否细分 —— 需要仅 root 的
+            //   通知(如 fee-prepay 审批,ROOT 门)不走本规则表,在各自路由直查 admin_type='root')。
+            try {
+                const admins = db.prepare("SELECT id FROM users WHERE role = 'admin'").all();
+                admins.forEach(a => ids.add(a.id));
+            }
+            catch { /* fresh-DB → 无收件人 */ }
+        }
         if (role === 'arbitrators') {
-            const arbs = db.prepare("SELECT id FROM users WHERE role = 'arbitrator'").all();
-            arbs.forEach(a => ids.add(a.id));
+            // 收件人=active arbitrator_whitelist(唯一仲裁能力源;legacy role='arbitrator' 会通知到打不开案件的人、漏掉真仲裁员)。
+            //   当前无 NOTIF_RULES 使用 'arbitrators'(仲裁员靠工作台拉取);此分支为未来规则备好正确的授权源。表缺失 → 静默空集。
+            try {
+                const arbs = db.prepare("SELECT user_id FROM arbitrator_whitelist WHERE status IS NULL OR status = 'active'").all();
+                arbs.forEach(a => ids.add(a.user_id));
+            }
+            catch { /* fresh-DB 无表 → 无收件人 */ }
         }
     }
     return [...ids];
 }
-export function createNotification(db, userId, orderId, type, title, body) {
+export function createNotification(db, userId, orderId, type, title, body, 
+// N1(审计项 B):可选 i18n 模板 —— template_key + params 落库,客户端按 viewer locale 用 t() 渲染;
+//   title/body 仍必填 = 中文回退(旧客户端/未知 key 一律回退,向后兼容,零迁移)。
+opts) {
     const notif = {
         id: generateId('ntf'),
         user_id: userId,
@@ -197,12 +265,13 @@ export function createNotification(db, userId, orderId, type, title, body) {
         body,
         read: 0,
         created_at: new Date().toISOString(),
+        ...(opts?.templateKey ? { template_key: opts.templateKey, params: JSON.stringify(opts.params ?? {}) } : {}),
     };
     db.prepare(`
-    INSERT INTO notifications (id, user_id, order_id, type, title, body)
-    VALUES (?, ?, ?, ?, ?, ?)
-  `).run(notif.id, userId, orderId, type, title, body);
-    // 实时推送（如果 PWA SSE 连接在线）
+    INSERT INTO notifications (id, user_id, order_id, type, title, body, template_key, params)
+    VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+  `).run(notif.id, userId, orderId, type, title, body, opts?.templateKey ?? null, opts?.templateKey ? JSON.stringify(opts.params ?? {}) : null);
+    // 实时推送(如果 PWA SSE 连接在线;payload 含模板字段,前端 toast 同样可本地化渲染)
     pushCallback?.(userId, notif);
     return notif;
 }

package/dist/layer3-trust/L3-1-dispute-engine/dispute-engine.js

@@ -17,7 +17,7 @@ import { dbOne, dbAll } from '../../layer0-foundation/L0-1-database/db.js'; // R
 import { transition } from '../../layer0-foundation/L0-2-state-machine/engine.js';
 // RFC-014 PR5 — 争议资金处置走整数 base-units + 绝对值落库 + allocate 精确拆分。
 import { toUnits, toDecimal, mulRate, allocate } from '../../money.js';
-import { applyWalletDelta, debitStakeThenBalance } from '../../ledger.js';
+import { applyWalletDelta, debitStakeThenBalance, walletUnits } from '../../ledger.js';
 // ─── Schema 初始化（幂等，安全重复调用）────────────────────────
 /**
  * 为 disputes 表添加 L3 需要的新列
@@ -156,6 +156,47 @@ export function respondToDispute(db, disputeId, responderId, notes, evidenceIds)
         message: '反驳证据已提交，争议进入仲裁阶段。仲裁员将在 120 小时（5 天）内做出裁定，超时协议自动判初诉方胜。',
     };
 }
+/**
+ * 非托管订单(direct_p2p / escrow_amount=0)的争议裁定 —— 【只做状态终结,绝不动任何资金】。
+ * 协议从未持有买家货款(买家场外直付卖家),故 executeSettlement 那套"退托管/扣质押/入协议费"会【凭空】给买家记
+ * balance、把不存在的托管退款、腐蚀账本(P0)。此路径只把订单推进到与 ruling 对应的既有争议终态,金额一律 0;
+ * reputation/strike 由路由层照常施加(那才是本轨"证据制信誉裁决,不涉资金赔付"的裁决效力)。
+ * 返回 non_custodial 标记 → 路由据此跳过 release_seller / partial_refund / liability_split 的佣金/PV/基金分润钩子。
+ */
+export function executeNonCustodialSettlement(db, orderId, ruling) {
+    const sysUser = db.prepare("SELECT id FROM users WHERE id = 'sys_protocol'").get();
+    if (!sysUser)
+        return { success: false, error: 'sys_protocol 用户不存在' };
+    const terminal = ruling === 'refund_buyer' ? 'refunded_full'
+        : ruling === 'release_seller' ? 'resolved_for_seller' : 'refunded_partial';
+    const r = transition(db, orderId, terminal, sysUser.id, [], `非托管(直付)争议裁定:协议不持货款,仅信誉裁决、不动任何资金 — ${ruling}`);
+    if (!r.success)
+        return { success: false, error: r.error };
+    // 金额全 0(供路由分润钩子据此算出 0),并打 non_custodial 标记。
+    return { success: true, detail: { non_custodial: true, ruling, buyer_refund: 0, buyer_compensation: 0, seller_received: 0, seller_escrow_share: 0, actual_refund: 0, note: '非托管订单:仅信誉裁决,不动用任何托管/钱包/质押/佣金资金' } };
+}
+/** active arbitrator_whitelist 谓词(唯一 runtime 人类仲裁授权源;legacy NULL status 视为 active)。导出给
+ *   MCP 等 pwa 之外的消费方(layer1 不 import src/pwa,故从本引擎导出);表缺失 → fail-closed false。 */
+export function isActiveWhitelistArbitrator(db, userId) {
+    try {
+        const wl = db.prepare('SELECT status FROM arbitrator_whitelist WHERE user_id = ?').get(userId);
+        return !!wl && (wl.status ?? 'active') === 'active';
+    }
+    catch {
+        return false;
+    }
+}
+/** 仲裁授权源(PR-B/PR-C):sys_protocol 自动裁决(role='system') 或 active arbitrator_whitelist(唯一 runtime 人类
+ *   授权源;role='arbitrator' 旁路已移除)。裁定 arbitrateDispute 与补证 requestEvidence 共用,保证授权一致。
+ *   system 分支不查白名单表 → 超时自动裁决即便表缺失也不受影响。 */
+function isAuthorizedArbitrator(db, userId) {
+    const u = db.prepare('SELECT role FROM users WHERE id = ?').get(userId);
+    if (!u)
+        return false;
+    if (u.role === 'system')
+        return true;
+    return isActiveWhitelistArbitrator(db, userId);
+}
 export function arbitrateDispute(db, disputeId, arbitratorId, ruling, reason, refundAmount, liabilityParties, liablePartyId // 指定责任方 user_id（用于 partial_refund 第三方责任场景）
 ) {
     const dispute = db.prepare('SELECT * FROM disputes WHERE id = ?').get(disputeId);
@@ -164,16 +205,19 @@ export function arbitrateDispute(db, disputeId, arbitratorId, ruling, reason, re
     if (dispute.status === 'resolved' || dispute.status === 'dismissed') {
         return { success: false, error: '该争议已处理完毕' };
     }
-    const arbitrator = db.prepare('SELECT role FROM users WHERE id = ?').get(arbitratorId);
-    if (!arbitrator)
-        return { success: false, error: '仲裁员不存在' };
-    if (arbitrator.role !== 'arbitrator' && arbitrator.role !== 'system') {
-        return { success: false, error: `只有仲裁员才能做出裁定，你的角色是：${arbitrator.role}` };
+    // 授权源(PR-B/PR-C):sys_protocol(role=system)或 active arbitrator_whitelist。见 isAuthorizedArbitrator。
+    if (!isAuthorizedArbitrator(db, arbitratorId)) {
+        return { success: false, error: '仅 active 仲裁员(arbitrator_whitelist)或系统可裁定' };
     }
-    // 执行资金处置
-    const settlement = ruling === 'liability_split' && liabilityParties
-        ? executeLiabilitySplit(db, dispute.order_id, liabilityParties, refundAmount)
-        : executeSettlement(db, dispute.order_id, ruling, refundAmount, liablePartyId);
+    // 非托管(直付)订单:协议不持货款 → 走【只信誉、不动资金】路径,绝不跑 executeSettlement/executeLiabilitySplit 的托管资金链。
+    const ord0 = db.prepare('SELECT payment_rail FROM orders WHERE id = ?').get(dispute.order_id);
+    const nonCustodial = !!ord0 && ord0.payment_rail === 'direct_p2p';
+    // 执行资金处置(非托管 → 零资金终结)
+    const settlement = nonCustodial
+        ? executeNonCustodialSettlement(db, dispute.order_id, ruling)
+        : ruling === 'liability_split' && liabilityParties
+            ? executeLiabilitySplit(db, dispute.order_id, liabilityParties, refundAmount)
+            : executeSettlement(db, dispute.order_id, ruling, refundAmount, liablePartyId);
     if (!settlement.success)
         return { success: false, error: settlement.error };
     // 收取仲裁费（败诉/责任方付 1%，最低 1 WAZ）
@@ -181,7 +225,7 @@ export function arbitrateDispute(db, disputeId, arbitratorId, ruling, reason, re
         .get(dispute.order_id);
     const sysUser = db.prepare("SELECT id FROM users WHERE id = 'sys_protocol'").get();
     const arbFees = {};
-    if (order) {
+    if (order && !nonCustodial) { // 非托管:不收仲裁费(不动任何钱包资金)
         const amt = order.total_amount;
         if (ruling === 'refund_buyer') {
             const f = chargeArbitrationFee(db, order.seller_id, amt, arbitratorId, sysUser.id);
@@ -233,16 +277,57 @@ export function arbitrateDispute(db, disputeId, arbitratorId, ruling, reason, re
       liability_parties = ?,
       resolved_at = datetime('now')
     WHERE id = ?
-  `).run(ruling, reason, ruling, refundAmount ?? null, JSON.stringify(liabilityParties ?? []), disputeId);
+  `).run(ruling, reason, ruling, nonCustodial ? null : (refundAmount ?? null), // 非托管:不落任何退款/赔付金额(不退款、不赔付)
+    JSON.stringify(nonCustodial ? [] : (liabilityParties ?? [])), disputeId);
     return {
         success: true,
-        message: `裁定已执行：${getRulingDescription(ruling, refundAmount)}`,
+        non_custodial: nonCustodial, // 路由据此跳过佣金/PV/基金分润钩子(非托管无托管结算)
+        message: nonCustodial ? getNonCustodialRulingDescription(ruling) : `裁定已执行：${getRulingDescription(ruling, refundAmount)}`,
         settlement: {
             ...settlement.detail,
             arbitration_fees: arbFees,
         },
     };
 }
+/**
+ * 仲裁员【驳回仲裁,退回协商】—— 非胜负裁决:不设 refund/liability、不动 escrow/settlement、不收仲裁费、不扣信誉。
+ *   仅对【direct_p2p 且由 payment_query 升级来】的争议有效(履约类争议须裁定,不可退回)。收口与 pq_withdraw 一致:
+ *   order disputed→payment_query(sys_protocol 代执行,授权由路由的 active-arbitrator + 现场 Passkey + COI/指派门守)、
+ *   active dispute→dismissed、重建 payment_query_deadline、清 payment_query_cancel_deadline。
+ *   【必须由路由用 db.transaction 包裹】(状态回退 + dispute 关闭同一原子边界;否则订单回协商但仲裁视图仍见活跃争议)。
+ */
+export function dismissDisputeToNegotiation(db, disputeId, reason) {
+    const dispute = db.prepare('SELECT id, order_id, status FROM disputes WHERE id = ?').get(disputeId);
+    if (!dispute)
+        return { success: false, error: '争议不存在', error_code: 'DISPUTE_NOT_FOUND' };
+    if (dispute.status === 'resolved' || dispute.status === 'dismissed')
+        return { success: false, error: '该争议已处理完毕', error_code: 'DISPUTE_ALREADY_RULED' };
+    const order = db.prepare('SELECT payment_rail FROM orders WHERE id = ?').get(dispute.order_id);
+    if (!order || order.payment_rail !== 'direct_p2p')
+        return { success: false, error: '仅直付(direct_p2p)货款协商争议可驳回退回协商', error_code: 'ARBITRATION_DISMISS_NOT_ALLOWED' };
+    // ★ 仅可退回【由货款协商升级】的仲裁:最近一次进入 disputed 必须 from payment_query。履约类(delivered→disputed 货损/货不对版)须裁定。fail-closed。
+    const lastDisputed = db.prepare("SELECT from_status FROM order_state_history WHERE order_id = ? AND to_status = 'disputed' ORDER BY created_at DESC, rowid DESC LIMIT 1").get(dispute.order_id);
+    if (!lastDisputed || lastDisputed.from_status !== 'payment_query')
+        return { success: false, error: '仅可退回由货款协商升级的仲裁;履约类争议(货损/货不对版)须经仲裁裁定', error_code: 'NOT_PAYMENT_QUERY_DISPUTE' };
+    const sys = db.prepare("SELECT id FROM users WHERE id = 'sys_protocol'").get();
+    if (!sys)
+        return { success: false, error: 'sys_protocol 不存在', error_code: 'SYS_MISSING' };
+    const tr = transition(db, dispute.order_id, 'payment_query', sys.id, [], '仲裁员驳回仲裁,退回买卖双方协商');
+    if (!tr.success)
+        return { success: false, error: tr.error, error_code: 'TRANSITION_FAILED' };
+    db.prepare("UPDATE disputes SET status='dismissed', verdict_reason=?, ruling_type='dismiss_to_negotiation', resolved_at=datetime('now') WHERE id=?")
+        .run(reason ? ('仲裁员驳回仲裁,退回买卖双方协商:' + String(reason).slice(0, 500)) : '仲裁员驳回仲裁,退回买卖双方协商', disputeId);
+    // 重建买家响应宽限 + 清卖家取消申诉窗(与 pq_withdraw 收口一致,让 PR-B2 宽限/超时 cron 有截止可依赖)
+    let gh = 72;
+    try {
+        const p = db.prepare("SELECT value FROM protocol_params WHERE key = 'direct_pay.payment_query_grace_hours'").get();
+        if (p)
+            gh = Math.max(1, Number(p.value) || 72);
+    }
+    catch { /* 用默认 72h */ }
+    db.prepare("UPDATE orders SET payment_query_deadline = datetime('now', ?), payment_query_cancel_deadline = NULL WHERE id = ?").run(`+${gh} hours`, dispute.order_id);
+    return { success: true, order_id: dispute.order_id };
+}
 /**
  * 执行多方责任分配结算
  *
@@ -269,12 +354,8 @@ export function executeLiabilitySplit(db, orderId, liabilityParties, buyerRefund
     const buyerId = order.buyer_id;
     const sellerId = order.seller_id;
     const sysUser = db.prepare("SELECT id FROM users WHERE id = 'sys_protocol'").get();
-    const product = db.prepare('SELECT stake_amount FROM products WHERE id = ?')
-        .get(order.product_id);
-    const stakeAmount = product?.stake_amount ?? 0;
     // RFC-014:整数 base-units
     const totalU = toUnits(totalAmount);
-    const stakeAmountU = toUnits(stakeAmount);
     const actualRefundU = Math.min(toUnits(buyerRefund ?? totalAmount), totalU);
     const sellerEscrowShareU = totalU - actualRefundU; // 残值,精确
     // 预先计算各责任方实际扣款（资金守恒：责任方扣款 = 协议金库收入），全整数 units
@@ -317,6 +398,10 @@ export function executeLiabilitySplit(db, orderId, liabilityParties, buyerRefund
         if (totalToTreasuryU > 0)
             applyWalletDelta(db, sysUser.id, { balance: totalToTreasuryU });
         // ── C. 卖家商品质押处理 ───────────────────────────────────────
+        // 【必须在 B 段责任罚款之后 re-read staked】:若 seller 同为责任方,B 段已从其 staked 扣过一次;此处只动【本单锁定
+        //   背书 order.stake_backing】且 cap 到【剩余】staked → 避免同一笔质押被扣两次 / staked 打负 / 凭空印钱。
+        //   不读名义 products.stake_amount(见 executeSettlement 注释);stage-1 backing=0 → 本段恒 no-op。
+        const stakeAmountU = Math.max(0, Math.min(toUnits(Number(order.stake_backing) || 0), walletUnits(db, sellerId).staked));
         if (stakeAmountU > 0) {
             if (sellerLiability) {
                 // 卖家有责：按责任金额扣罚质押(封顶),剩余返还
@@ -384,13 +469,14 @@ export function executeSettlement(db, orderId, ruling, refundAmount, liableParty
     const totalAmount = order.total_amount;
     const buyerId = order.buyer_id;
     const sellerId = order.seller_id;
-    const product = db.prepare('SELECT stake_amount FROM products WHERE id = ?')
-        .get(order.product_id);
-    const stakeAmount = product?.stake_amount ?? 0;
     const sysUser = db.prepare("SELECT id FROM users WHERE id = 'sys_protocol'").get();
     // RFC-014:整数 base-units
     const totalU = toUnits(totalAmount);
-    const stakeAmountU = toUnits(stakeAmount);
+    // 卖家质押 forfeit/return 只动【本订单实际锁定的赔付背书】order.stake_backing,再 cap 到卖家真实 staked。
+    //   绝不读 products.stake_amount —— 那是名义"预期 stake",完成时才锁(server.ts 结算);争议单 pre-completion 从未锁,
+    //   读它会没收/返还从未锁定的质押 → 打负 staked / 凭空印钱。RFC-008 stage-1 免赔付:stake_backing 恒 0 → 本段恒 no-op,
+    //   与"违约只退款不没收"一致;Phase-3 真正在建单锁 stake 后,同一段自动按真实 backing 处置。
+    const stakeAmountU = Math.max(0, Math.min(toUnits(Number(order.stake_backing) || 0), walletUnits(db, sellerId).staked));
     if (ruling === 'refund_buyer') {
         // ── 买家胜诉：退全款 + 卖家损失一半质押（惩罚,allocate 精确二分）──────────────
         const [penaltyU, stakeReturnU] = stakeAmountU > 0 ? allocate(stakeAmountU, [1, 1]) : [0, 0];
@@ -589,19 +675,21 @@ export function initEvidenceRequestSchema(db) {
  * 仲裁员向任意角色发出"补充证据"请求
  */
 export function requestEvidence(db, disputeId, arbitratorId, requestedFromId, evidenceTypes, description, deadlineHours = 48) {
-    const arb = db.prepare('SELECT role FROM users WHERE id = ?').get(arbitratorId);
-    if (!arb || (arb.role !== 'arbitrator' && arb.role !== 'system')) {
-        return { success: false, error: '仅仲裁员可发出证据请求' };
+    // PR-C:授权源同 arbitrateDispute —— system 或 active arbitrator_whitelist(role 旁路已移除)。
+    if (!isAuthorizedArbitrator(db, arbitratorId)) {
+        return { success: false, error: '仅 active 仲裁员可发出证据请求', error_code: 'NOT_ARBITRATOR' };
     }
-    const dispute = db.prepare('SELECT status FROM disputes WHERE id = ?').get(disputeId);
+    const dispute = db.prepare('SELECT status, order_id, initiator_id, defendant_id FROM disputes WHERE id = ?').get(disputeId);
     if (!dispute)
         return { success: false, error: '争议不存在' };
     if (dispute.status === 'resolved' || dispute.status === 'dismissed') {
         return { success: false, error: '该争议已结案' };
     }
-    const target = db.prepare('SELECT id FROM users WHERE id = ?').get(requestedFromId);
-    if (!target)
-        return { success: false, error: '指定用户不存在' };
+    // PR-E:补证对象必须是本案涉案方(buyer/seller/logistics/initiator/defendant),不得向无关用户要证据。
+    const order = db.prepare('SELECT buyer_id, seller_id, logistics_id FROM orders WHERE id = ?').get(dispute.order_id);
+    const parties = new Set([order?.buyer_id, order?.seller_id, order?.logistics_id, dispute.initiator_id, dispute.defendant_id].filter(Boolean));
+    if (!parties.has(requestedFromId))
+        return { success: false, error: '补证对象必须是本案涉案方', error_code: 'INVALID_EVIDENCE_TARGET' };
     const requestId = generateId('evr');
     db.prepare(`
     INSERT INTO dispute_evidence_requests
@@ -679,10 +767,12 @@ export async function getDisputeDetails(_db, disputeId) {
     return (await dbOne(`
     SELECT d.*,
       u1.name as initiator_name, u1.role as initiator_role,
-      u2.name as defendant_name, u2.role as defendant_role
+      u2.name as defendant_name, u2.role as defendant_role,
+      o.payment_rail as payment_rail
     FROM disputes d
     LEFT JOIN users u1 ON d.initiator_id = u1.id
     LEFT JOIN users u2 ON d.defendant_id = u2.id
+    LEFT JOIN orders o ON d.order_id = o.id
     WHERE d.id = ?
   `, [disputeId])) ?? null;
 }
@@ -690,10 +780,12 @@ export async function getOrderDispute(_db, orderId) {
     return (await dbOne(`
     SELECT d.*,
       u1.name as initiator_name, u1.role as initiator_role,
-      u2.name as defendant_name, u2.role as defendant_role
+      u2.name as defendant_name, u2.role as defendant_role,
+      o.payment_rail as payment_rail
     FROM disputes d
     LEFT JOIN users u1 ON d.initiator_id = u1.id
     LEFT JOIN users u2 ON d.defendant_id = u2.id
+    LEFT JOIN orders o ON d.order_id = o.id
     WHERE d.order_id = ? AND d.status NOT IN ('resolved', 'dismissed')
     ORDER BY d.created_at DESC LIMIT 1
   `, [orderId])) ?? null;
@@ -703,7 +795,7 @@ export async function getOpenDisputes(_db) {
     SELECT d.*,
       u1.name as initiator_name, u1.role as initiator_role,
       u2.name as defendant_name, u2.role as defendant_role,
-      o.total_amount, o.status as order_status
+      o.total_amount, o.status as order_status, o.payment_rail
     FROM disputes d
     LEFT JOIN users u1 ON d.initiator_id = u1.id
     LEFT JOIN users u2 ON d.defendant_id = u2.id
@@ -724,3 +816,13 @@ function getRulingDescription(ruling, refundAmount) {
         default: return ruling;
     }
 }
+// 非托管(直付)裁定文案:协议不持货款 → 只表达胜负/责任(信誉裁决),【绝不】写退款/资金释放/仲裁费(那些都不发生)。
+function getNonCustodialRulingDescription(ruling) {
+    switch (ruling) {
+        case 'refund_buyer': return '裁定已执行：买家胜诉(非托管信誉裁决 —— 协议不持货款,不发生退款/资金释放/仲裁费)';
+        case 'release_seller': return '裁定已执行：卖家胜诉(非托管信誉裁决 —— 不发生退款/资金释放/仲裁费)';
+        case 'partial_refund': return '裁定已执行：部分责任(非托管信誉裁决 —— 不发生退款/资金释放/仲裁费)';
+        case 'liability_split': return '裁定已执行：责任分配(非托管信誉裁决 —— 不发生退款/赔付/仲裁费)';
+        default: return '裁定已执行：非托管信誉裁决(不动任何资金)';
+    }
+}

package/dist/layer3-trust/L3-1-dispute-engine/evidence-storage.js

@@ -58,18 +58,30 @@ export function ensureEvidenceColumns(db) {
 function canonicalEvidenceMeta(m) {
     return [m.uploaderId, m.disputeId, m.hash, String(m.size), m.mime, m.description].join('|');
 }
+// PR-E:被指派仲裁员读/写证据须【仍是 active whitelist】—— suspended/revoked 立即失去权限。表缺失 → 视为非 active。
+function isActiveArbitratorWL(db, userId) {
+    try {
+        const wl = db.prepare('SELECT status FROM arbitrator_whitelist WHERE user_id = ?').get(userId);
+        return !!wl && ((wl.status ?? 'active') === 'active'); // legacy NULL = active
+    }
+    catch {
+        return false;
+    }
+}
 function isPartyOrArbitrator(db, disputeId, userId) {
     const dispute = db.prepare('SELECT order_id, initiator_id, defendant_id, assigned_arbitrators FROM disputes WHERE id = ?').get(disputeId);
     if (!dispute)
         return false;
     const order = db.prepare('SELECT buyer_id, seller_id, logistics_id FROM orders WHERE id = ?').get(dispute.order_id);
-    const arbitrators = JSON.parse(dispute.assigned_arbitrators || '[]');
-    const parties = new Set([
+    const caseParties = new Set([
         order?.buyer_id, order?.seller_id, order?.logistics_id,
         dispute.initiator_id, dispute.defendant_id,
-        ...arbitrators,
     ].filter(Boolean));
-    return parties.has(userId);
+    if (caseParties.has(userId))
+        return true;
+    // 仅【指派本案 且 当前 active】的仲裁员可读/写证据。
+    const arbitrators = JSON.parse(dispute.assigned_arbitrators || '[]');
+    return arbitrators.includes(userId) && isActiveArbitratorWL(db, userId);
 }
 export function uploadEvidence(db, args) {
     if (!args.blob || args.blob.length === 0)