@seasonkoh/webaz 0.1.30 → 0.1.32

package/dist/layer3-trust/L3-1-dispute-engine/dispute-engine.js

@@ -15,6 +15,8 @@
 import { generateId } from '../../layer0-foundation/L0-1-database/schema.js';
 import { dbOne, dbAll } from '../../layer0-foundation/L0-1-database/db.js'; // RFC-016 异步 seam(纯读)
 import { transition } from '../../layer0-foundation/L0-2-state-machine/engine.js';
+import { resolveDeclineContestDispute } from './decline-contest-resolve.js'; // PR3 唯一裁决器(超时硬兜底入口)
+import { notifyDeclineContestEscalated } from '../../layer2-business/L2-6-notifications/notification-engine.js'; // 四段式升级通知
 // RFC-014 PR5 — 争议资金处置走整数 base-units + 绝对值落库 + allocate 精确拆分。
 import { toUnits, toDecimal, mulRate, allocate } from '../../money.js';
 import { applyWalletDelta, debitStakeThenBalance, walletUnits } from '../../ledger.js';
@@ -41,6 +43,9 @@ export function initDisputeSchema(db) {
         `ALTER TABLE disputes ADD COLUMN auto_judge_paused_until INTEGER`,
         `ALTER TABLE disputes ADD COLUMN auto_judge_pause_reason TEXT`,
         `ALTER TABLE disputes ADD COLUMN audit_log TEXT DEFAULT '[]'`,
+        // 2026-07 统一仲裁台:案子类型标签。默认 'buyer_dispute'(既有买家/直付/退货争议);
+        //   'decline_contest' = RFC-007 卖家客观拒单举证并入 disputes(UI 显示"拒单举证仲裁",裁决走专用两选 + settleFault/settleDeclinedNoFault)。
+        `ALTER TABLE disputes ADD COLUMN dispute_type TEXT DEFAULT 'buyer_dispute'`,
     ];
     for (const stmt of newColumns) {
         try {
@@ -48,6 +53,11 @@ export function initDisputeSchema(db) {
         }
         catch { /* 列已存在，跳过 */ }
     }
+    // 幂等硬约束:一个订单最多一条 decline_contest dispute(防重复建行/重复结算)。部分唯一索引 —— 仅约束该类型行。
+    try {
+        db.exec(`CREATE UNIQUE INDEX IF NOT EXISTS ux_disputes_decline_contest_order ON disputes(order_id) WHERE dispute_type = 'decline_contest'`);
+    }
+    catch { /* 已存在，跳过 */ }
 }
 /** 任意参与方（非被告）主动提交证据 */
 export function addPartyEvidence(db, disputeId, submitterId, description, evidenceType = 'text', fileHash) {
@@ -121,6 +131,56 @@ export function createDispute(db, orderId, initiatorId, reason, evidenceIds) {
         message: `争议已记录（${disputeId}）。被诉方有 48 小时提交反驳证据，超时协议自动判你胜诉。`,
     };
 }
+/**
+ * RFC-007 → 统一仲裁台:为【已举证的客观拒单】订单建一条 decline_contest dispute 行。
+ *
+ * 单一真相源:contest_decline 路由(新单)与 backfill 脚本(历史 stuck 单,如 ord_54fa)都调此函数。
+ * 设计约束:
+ *   - 不改 order.status(订单仍 fault_seller + 标志位);dispute 行只是并入统一仲裁台的把手。
+ *   - initiator = 卖家(发起举证、承担"客观无责"举证责任);defendant = 买家(受影响方)。COI 由 arbitratorHasConflict
+ *     统一覆盖(买/卖/物流/发起/被告均不可裁,PR3 复用)。
+ *   - 幂等:一个订单至多一条 decline_contest dispute —— 存在性检查 + 部分唯一索引(ux_disputes_decline_contest_order)
+ *     双保险;并发建行由唯一索引兜底,重复调用返回既有行(existing=true),绝不建第二条。
+ *   - PR1 fail-closed:此行建好后【不可被通用自动裁决结算、不可被通用 arbitrate 误裁】(见 checkDisputeTimeouts /
+ *     arbitrate 路由的 decline_contest 分支),直到 PR3 打通专用两选裁决 + settleFault/settleDeclinedNoFault。
+ */
+export function createDeclineContestDispute(db, orderId) {
+    const order = db.prepare('SELECT * FROM orders WHERE id = ?').get(orderId);
+    if (!order)
+        return { success: false, error: `订单不存在：${orderId}` };
+    // 仅【已举证的临时判责】合格:fault_seller + provisional pending + contested + 未结算。
+    if (order.status !== 'fault_seller' || Number(order.decline_objective_pending) !== 1 || Number(order.decline_contested) !== 1 || order.settled_fault_at) {
+        return { success: false, error: '订单不是【已举证的客观拒单临时判责】状态,不建仲裁行' };
+    }
+    // 幂等①:存在性检查。
+    const existing = db.prepare("SELECT id FROM disputes WHERE order_id = ? AND dispute_type = 'decline_contest'").get(orderId);
+    if (existing)
+        return { success: true, disputeId: existing.id, existing: true };
+    const sellerId = order.seller_id;
+    const buyerId = order.buyer_id;
+    const now = new Date();
+    const disputeId = generateId('dsp');
+    const respondDeadline = addHours(now, 48); // 买家反驳窗口(PR3 定义超时四段式;PR1 仅建行,不驱动自动裁决)
+    const arbitrateDeadline = addHours(now, 120); // 仲裁窗口
+    const reasonCode = String(order.decline_reason_code || 'objective_decline');
+    const reason = `卖家客观拒单举证仲裁(${reasonCode}):卖家主张客观无责,请仲裁维持(免责·全退买家+退卖家质押)或驳回(判卖家违约)。`;
+    try {
+        db.prepare(`
+      INSERT INTO disputes (
+        id, order_id, initiator_id, defendant_id, reason, status, dispute_type,
+        defendant_evidence_ids, respond_deadline, arbitrate_deadline, assigned_arbitrators
+      ) VALUES (?, ?, ?, ?, ?, 'open', 'decline_contest', '[]', ?, ?, '[]')
+    `).run(disputeId, orderId, sellerId, buyerId, reason, respondDeadline, arbitrateDeadline);
+    }
+    catch (e) {
+        // 幂等②:并发建行撞唯一索引 → 返回既有行,不报错、不建第二条。
+        const race = db.prepare("SELECT id FROM disputes WHERE order_id = ? AND dispute_type = 'decline_contest'").get(orderId);
+        if (race)
+            return { success: true, disputeId: race.id, existing: true };
+        return { success: false, error: e.message };
+    }
+    return { success: true, disputeId };
+}
 // ─── L3-2 证据收集 ────────────────────────────────────────────
 /**
  * 被诉方提交反驳证据
@@ -616,6 +676,33 @@ export function checkDisputeTimeouts(db) {
     const openDisputes = db.prepare(`SELECT * FROM disputes WHERE status IN ('open', 'in_review')`).all();
     const sysUser = db.prepare("SELECT id FROM users WHERE id = 'sys_protocol'").get();
     for (const dispute of openDisputes) {
+        // PR3 四段式超时:decline_contest 不走通用自动裁决,走专用兜底。
+        //   仲裁窗口(arbitrate_deadline)内 → 不动;过窗口且 ≤+48h → 升级通知(去重,只发一次),等仲裁员/admin;
+        //   过 +48h admin fallback → 硬兜底判卖家违约(resolver 强制 decline_fault_confirmed + auto_resolved_by_timeout)。
+        if (dispute.dispute_type === 'decline_contest') {
+            const ad = dispute.arbitrate_deadline;
+            if (!ad || now <= ad)
+                continue; // 仲裁窗口内
+            const fallbackDeadline = addHours(new Date(ad), 48); // admin fallback 截止 = arbitrate_deadline + 48h
+            if (now <= fallbackDeadline) { // 段3:升级通知(去重),等人裁
+                try {
+                    notifyDeclineContestEscalated(db, dispute.order_id);
+                }
+                catch (e) {
+                    console.warn('[dc-escalate]', e.message);
+                }
+                continue;
+            }
+            // 段4:硬兜底 —— 判卖家违约。走与仲裁员完全相同的 resolver(dispute CAS + 终态 completed + 结算,单事务)。
+            try {
+                resolveDeclineContestDispute(db, dispute.id, 'sys_protocol', 'decline_fault_confirmed', '仲裁窗口 + admin 兜底窗口均超时,协议自动判卖家违约(卖家担客观无责举证责任)', 'timeout_auto');
+                details.push({ disputeId: dispute.id, action: 'decline_contest 超时自动判违约', orderId: dispute.order_id });
+            }
+            catch (e) {
+                console.warn('[dc-timeout-auto]', e.message);
+            }
+            continue;
+        }
         // task #1093 stage 6: skip auto-judge if arbitrator paused the clock (playbook §2.1)
         // Pause expires automatically when auto_judge_paused_until passes; no resume needed
         // for the clock to thaw — explicit resume just clears the field eagerly + audit log.
@@ -804,6 +891,28 @@ export async function getOpenDisputes(_db) {
     ORDER BY d.created_at ASC
   `);
 }
+/* PR2:decline_contest 现已进入统一仲裁员队列(SELECT d.* 带出 dispute_type,前端渲染"拒单举证仲裁"标签)。
+   裁决仍 fail-closed(checkDisputeTimeouts 跳过 + arbitrate 路由 409),PR3 打通专用两选裁决。 */
+/**
+ * 仲裁员历史裁决:近期已结(resolved/dismissed)争议。与 [[getOpenDisputes]] 同 DTO 形状(前端 compactRow 通用)。
+ *   `/api/disputes` 路由把它拼在 open+in_review 之后 → 前端"已结"sub-tab + todayDone KPI 有数据(此前恒空)。
+ *   getOpenDisputes 语义(仅 open)不变(MCP 也用它);历史用本函数,按 resolved_at 倒序,LIMIT 防拉全表。
+ */
+export async function getRecentResolvedDisputes(_db, limit = 50) {
+    return await dbAll(`
+    SELECT d.*,
+      u1.name as initiator_name, u1.role as initiator_role,
+      u2.name as defendant_name, u2.role as defendant_role,
+      o.total_amount, o.status as order_status, o.payment_rail
+    FROM disputes d
+    LEFT JOIN users u1 ON d.initiator_id = u1.id
+    LEFT JOIN users u2 ON d.defendant_id = u2.id
+    LEFT JOIN orders o ON d.order_id = o.id
+    WHERE d.status IN ('resolved', 'dismissed')
+    ORDER BY d.resolved_at DESC, d.created_at DESC
+    LIMIT ?
+  `, [limit]);
+}
 // ─── 工具函数 ─────────────────────────────────────────────────
 function addHours(date, hours) {
     return new Date(date.getTime() + hours * 3_600_000).toISOString();

package/dist/pwa/agent-order-minimal-view.js

@@ -0,0 +1,29 @@
+import { getActiveDeadline } from '../layer0-foundation/L0-2-state-machine/engine.js';
+import { CURRENT_RESPONSIBLE, CURRENT_RESPONSIBLE_SELF_FULFILL } from '../layer0-foundation/L0-2-state-machine/transitions.js';
+/** 调用方须只 SELECT 非 PII 列:id, status, total_amount, product_id, logistics_id, 及各 *_deadline 列。 */
+export function minimalSellerOrderView(order, db) {
+    const status = String(order.status ?? '');
+    const isSelfFulfill = !order.logistics_id;
+    const table = (isSelfFulfill ? CURRENT_RESPONSIBLE_SELF_FULFILL : CURRENT_RESPONSIBLE);
+    let deadline = null;
+    try {
+        deadline = getActiveDeadline(order, db)?.deadline ?? null;
+    }
+    catch {
+        deadline = null;
+    }
+    return {
+        order_id: String(order.id ?? ''),
+        status,
+        next_actor: table[status] ?? null,
+        deadline,
+        amount: order.total_amount == null ? null : Number(order.total_amount),
+        item_ref: order.product_id == null ? null : String(order.product_id),
+    };
+}
+/** 最小化读只取这些【非 PII】列(供路由 SELECT + 测试断言 SELECT 不含 PII)。 */
+export const MINIMAL_ORDER_COLUMNS = [
+    'id', 'status', 'total_amount', 'product_id', 'logistics_id',
+    'pending_accept_deadline', 'pay_deadline', 'accept_deadline', 'ship_deadline',
+    'pickup_deadline', 'delivery_deadline', 'confirm_deadline',
+];

package/dist/pwa/order-action-exec.js

@@ -0,0 +1,158 @@
+import { transition } from '../layer0-foundation/L0-2-state-machine/engine.js';
+/** I4 占位符黑名单:N/A、无、test、全 0、纯重复字符(≥8 长度的多为全 0/纯重复;短的由长度/正则先挡)。从严。 */
+function isPlaceholderTracking(s) {
+    return /^n\/?a$/i.test(s) || s === '无' || /^test$/i.test(s) || /^0+$/.test(s) || /^(.)\1+$/.test(s);
+}
+/** I4 tracking 内容校验:非空 + trim≥8 + ^[A-Za-z0-9-]+$ + 非占位符。宁可误拒。 */
+export function validateTrackingContent(tracking) {
+    const t = (tracking ?? '').trim();
+    if (t.length < 8)
+        return { ok: false, error: 'tracking 长度不足(需 ≥8)' };
+    if (!/^[A-Za-z0-9-]+$/.test(t))
+        return { ok: false, error: 'tracking 含非法字符(仅字母/数字/连字符)' };
+    if (isPlaceholderTracking(t))
+        return { ok: false, error: 'tracking 疑似占位符,请填真实单号' };
+    return { ok: true };
+}
+/**
+ * 执行 accept/ship。守卫全内置;任一不满足 → {ok:false}(不 transition)。成功 → 订单状态跃迁 + evidence(ship)。
+ * 幂等/executed_at 由调用方(approve 路径)在外层 CAS;本函数只做守卫 + transition。
+ */
+export function executeSellerOrderAction(db, opts) {
+    const { orderId, action, actorId, nowIso, path } = opts;
+    // P2 fail-safe:漏传/undefined → strict;仅显式 false 放宽(自履行/无单号 api_key 路径)。
+    const strictTracking = opts.strictTracking !== false;
+    const fail = (error_code, http, error) => ({ ok: false, error_code, http, error });
+    // SLA 比较用 datetime() 归一化(SQLite datetime 空格格式 vs JS ISO 'T' 直比会错 → engine.ts:223、direct-pay-timeouts 全用 datetime()<datetime()。
+    //   *_expired = 1 已过 / 0 未过 / NULL 该 deadline 缺失(fail-closed 用)。
+    const order = db.prepare(`SELECT seller_id, status, accept_deadline, ship_deadline,
+      CASE WHEN accept_deadline IS NULL THEN NULL WHEN datetime(accept_deadline) < datetime(?) THEN 1 ELSE 0 END AS accept_expired,
+      CASE WHEN ship_deadline   IS NULL THEN NULL WHEN datetime(ship_deadline)   < datetime(?) THEN 1 ELSE 0 END AS ship_expired
+    FROM orders WHERE id = ?`).get(nowIso, nowIso, orderId);
+    if (!order)
+        return fail('ORDER_NOT_FOUND', 404, '订单不存在');
+    // 核心守卫①:归属(actor 必须是本单卖家)
+    if (order.seller_id !== actorId)
+        return fail('NOT_ORDER_SELLER', 403, '该订单不属于你');
+    // 核心守卫②③:状态前置 + SLA。P1-c(a) fail-closed:需要 SLA 的状态遇 deadline=NULL → 拒绝放行(绝不 skip),
+    //   防任何"忘写 deadline"的下单路径(如缺 ship_deadline 的 direct_p2p)静默绕过判责钟。
+    if (action === 'accept') {
+        if (order.status !== 'paid')
+            return fail('WRONG_STATUS', 409, '仅 paid 订单可接单');
+        if (order.accept_deadline == null)
+            return fail('SLA_DEADLINE_MISSING', 409, '订单缺 accept_deadline,fail-closed 拒绝执行');
+        if (order.accept_expired === 1)
+            return fail('SLA_EXPIRED', 409, '接单窗口已过');
+    }
+    else {
+        if (order.status !== 'accepted')
+            return fail('WRONG_STATUS', 409, '仅 accepted 订单可发货');
+        if (order.ship_deadline == null)
+            return fail('SLA_DEADLINE_MISSING', 409, '订单缺 ship_deadline,fail-closed 拒绝执行');
+        if (order.ship_expired === 1)
+            return fail('SLA_EXPIRED', 409, '发货窗口已过');
+        // I4(仅 strictTracking=true,即 agent-approve 路径):tracking 内容重校,不信任 request 内容
+        if (strictTracking) {
+            const v = validateTrackingContent(opts.tracking);
+            if (!v.ok)
+                return fail('INVALID_TRACKING', 400, v.error);
+        }
+    }
+    // 核心守卫④:evidence(ship 须证据;transition 内部再校非空 → 保持 api_key "无 evidence 即拒" 现状)
+    const evidenceIds = [];
+    if (action === 'ship') {
+        const desc = strictTracking
+            ? `快递单号:${String(opts.tracking)}${opts.evidenceRef ? ` · 凭证:${String(opts.evidenceRef)}` : ''}`
+            : (opts.evidenceDescription || null); // 非严格(api_key):仅当卖家提供 evidence_description 才建;缺则 transition 因证据空而拒(保持现状)
+        if (desc) {
+            const eid = opts.generateId('evt');
+            db.prepare("INSERT INTO evidence (id, order_id, uploader_id, type, description, file_hash) VALUES (?,?,?,'description',?,?)").run(eid, orderId, actorId, desc, `h_${nowIso}_${eid}`);
+            evidenceIds.push(eid);
+        }
+    }
+    // ⑤ transition(I3:绝不 UPDATE accept_deadline/ship_deadline;transition 只改 status + 事件链)
+    const toStatus = action === 'accept' ? 'accepted' : 'shipped';
+    const r = transition(db, orderId, toStatus, actorId, evidenceIds, `${action} via executor (${path})`);
+    if (!r.success)
+        return fail('TRANSITION_FAILED', 409, r.error);
+    return { ok: true, fromStatus: order.status, toStatus };
+}
+class AlreadyExecErr extends Error {
+}
+class NotPendingErr extends Error {
+}
+class ExecFailErr extends Error {
+    exec;
+    constructor(e) { super(e.error_code); this.exec = e; }
+}
+/**
+ * approve 路径:CAS pending→approved(若 pending)→ 执行(strictTracking=true)→ executed_at CAS(I5 幂等键)。
+ *   执行成功:executed_at + execution_result 写入(与 transition 同一事务,并发只一次)。
+ *   执行失败(守卫/transition):【不】写 executed_at,请求保持 approved 可重试;写失败 execution_result(注解)。
+ *   executed_at 已置位:幂等直接返回 already_executed。
+ * strictTracking=true 硬编码在此(agent 路径),不接受任何外部入参。
+ * P1-b 审计 fail-closed:approve / execute 的 agent_grant_auth_log 写入与状态改动【同一事务】—— 审计失败即回滚,
+ *   动作不发生(与 PR2 提交侧审计一致,绝不 fail-open 吞异常)。
+ */
+export function approveAndExecuteOrderAction(db, requestId, actorId, grantId, nowIso, generateId) {
+    const auditRow = (cap, outcome) => db.prepare('INSERT INTO agent_grant_auth_log (grant_id, human_id, capability, outcome, error_code) VALUES (?,?,?,?,?)').run(grantId, actorId, cap, outcome, null);
+    const r = db.prepare("SELECT status, kind, order_id, order_action, action_params, executed_at, expires_at FROM agent_permission_requests WHERE id = ?").get(requestId);
+    if (!r || r.kind !== 'order_action')
+        return { ok: false, error_code: 'NOT_ORDER_ACTION', http: 404 };
+    if (r.executed_at)
+        return { ok: true, already_executed: true }; // 幂等:已执行
+    if (r.status !== 'pending' && r.status !== 'approved')
+        return { ok: false, error_code: 'REQUEST_NOT_APPROVABLE', http: 409 };
+    // step 1:CAS→approved + 审计,同一事务 fail-closed(仅 pending;单独提交 → 执行失败仍保持 approved 可重试)。expires_at 原子守卫。
+    if (r.status === 'pending') {
+        try {
+            db.transaction(() => {
+                const c = db.prepare("UPDATE agent_permission_requests SET status='approved', approved_at=? WHERE id=? AND status='pending' AND expires_at > ?").run(nowIso, requestId, nowIso).changes;
+                if (c !== 1)
+                    throw new NotPendingErr();
+                auditRow(`order_action:approve:${r.order_id}:${r.order_action}`, 'allow'); // 审计写失败 → 抛 → 回滚 CAS(未 approve)
+            })();
+        }
+        catch (e) {
+            if (e instanceof NotPendingErr)
+                return { ok: false, error_code: 'REQUEST_NOT_PENDING_OR_EXPIRED', http: 409 };
+            return { ok: false, error_code: 'AUDIT_WRITE_FAILED', error: e.message, http: 500 }; // 审计 fail-closed:保持 pending,未 approve/未执行
+        }
+    }
+    // step 2:执行 + executed_at + 执行审计,同一事务原子 fail-closed(并发/重放/审计失败 → 回滚)
+    let params = {};
+    try {
+        params = r.action_params ? JSON.parse(r.action_params) : {};
+    }
+    catch {
+        params = {};
+    }
+    try {
+        const out = db.transaction(() => {
+            const cur = db.prepare('SELECT executed_at FROM agent_permission_requests WHERE id = ?').get(requestId);
+            if (cur.executed_at)
+                throw new AlreadyExecErr();
+            const exec = executeSellerOrderAction(db, { orderId: r.order_id, action: r.order_action, actorId, nowIso, strictTracking: true, tracking: params.tracking, evidenceRef: params.evidence_ref, generateId, path: 'approve' });
+            if (!exec.ok)
+                throw new ExecFailErr(exec);
+            const e = db.prepare("UPDATE agent_permission_requests SET executed_at=?, execution_result=? WHERE id=? AND executed_at IS NULL").run(nowIso, JSON.stringify({ ok: true, from: exec.fromStatus, to: exec.toStatus }), requestId).changes;
+            if (e !== 1)
+                throw new AlreadyExecErr();
+            auditRow(`order_action:execute:${r.order_id}:${r.order_action}`, 'allow'); // 审计写失败 → 抛 → 回滚执行 + executed_at(未执行)
+            return exec;
+        })();
+        return { ok: true, order_status: out.toStatus };
+    }
+    catch (err) {
+        if (err instanceof AlreadyExecErr)
+            return { ok: true, already_executed: true };
+        if (err instanceof ExecFailErr) {
+            try {
+                db.prepare("UPDATE agent_permission_requests SET execution_result=? WHERE id=? AND executed_at IS NULL").run(JSON.stringify({ ok: false, error_code: err.exec.error_code }), requestId);
+            }
+            catch { /* 注解 best-effort */ }
+            return { ok: false, error_code: err.exec.error_code, error: err.exec.error, http: err.exec.http }; // 请求保持 approved 可重试
+        }
+        return { ok: false, error_code: 'EXECUTE_FAILED', error: err.message, http: 500 }; // 含执行审计写失败 → 已回滚 → 未执行,可重试
+    }
+}

package/dist/pwa/order-action-request.js

@@ -0,0 +1,57 @@
+import { createHash } from 'node:crypto';
+const TTL_HOURS = 24; // 请求短 TTL(I5)
+/** I6:仅 ship 保留 {tracking, evidence_ref};accept 无参;其它键(含任何地址)一律丢弃。 */
+export function sanitizeOrderActionParams(action, raw) {
+    if (action !== 'ship')
+        return {};
+    const r = (raw ?? {});
+    const out = {};
+    if (r.tracking != null)
+        out.tracking = String(r.tracking);
+    if (r.evidence_ref != null)
+        out.evidence_ref = String(r.evidence_ref);
+    return out;
+}
+export function computeParamsHash(orderId, action, params) {
+    return createHash('sha256').update(JSON.stringify({ order_id: orderId, action, params })).digest('hex');
+}
+/** 写 pending 请求;不执行、不改订单。归属校验(seller 本人)+ D2 拒 decline + I4 提交侧 ship tracking presence + 唯一索引防双 pending。 */
+export function createOrderActionRequest(db, opts) {
+    const { orderId, action } = opts;
+    if (action === 'decline')
+        return { ok: false, error_code: 'DECLINE_NOT_DELEGATED', error: 'decline 不可委托;请人工在 PWA 处理', http: 400 }; // D2
+    if (action !== 'accept' && action !== 'ship')
+        return { ok: false, error_code: 'BAD_ACTION', error: "action 必须为 'accept' | 'ship'", http: 400 };
+    const order = db.prepare('SELECT seller_id FROM orders WHERE id = ?').get(orderId);
+    if (!order)
+        return { ok: false, error_code: 'ORDER_NOT_FOUND', error: '订单不存在', http: 404 };
+    if (order.seller_id !== opts.humanId)
+        return { ok: false, error_code: 'NOT_ORDER_SELLER', error: '该订单不属于你', http: 403 }; // 归属
+    const params = sanitizeOrderActionParams(action, opts.rawParams); // I6:地址等被丢弃
+    if (action === 'ship' && (!params.tracking?.trim() || !params.evidence_ref?.trim())) {
+        return { ok: false, error_code: 'SHIP_TRACKING_REQUIRED', error: 'ship 请求必须带 tracking + evidence_ref', http: 400 }; // I4 提交侧(presence;内容重校在 PR3)
+    }
+    const paramsHash = computeParamsHash(orderId, action, params);
+    const id = opts.generateId('apr');
+    const expiresAt = new Date(Date.now() + TTL_HOURS * 3600_000).toISOString();
+    try {
+        db.transaction(() => {
+            db.prepare(`INSERT INTO agent_permission_requests
+        (id, human_id, grant_id, agent_label, requested_scopes, risk_level, duration, status, expires_at, kind, order_id, order_action, params_hash, action_params)
+        VALUES (?,?,?,?, '[]', 'medium', 'once', 'pending', ?, 'order_action', ?, ?, ?, ?)`)
+                .run(id, opts.humanId, opts.grantId, opts.agentLabel, expiresAt, orderId, action, paramsHash, JSON.stringify(params));
+            // I7:创建审计(不含地址;capability 只带 order_id/action/hash 前缀)
+            db.prepare('INSERT INTO agent_grant_auth_log (grant_id, human_id, capability, outcome, error_code) VALUES (?,?,?,?,?)')
+                .run(opts.grantId, opts.humanId, `order_action:request:${orderId}:${action}:${paramsHash.slice(0, 12)}`, 'allow', null);
+        })();
+    }
+    catch (e) {
+        const dup = db.prepare("SELECT 1 FROM agent_permission_requests WHERE order_id=? AND order_action=? AND kind='order_action' AND status IN ('pending','approved')").get(orderId, action);
+        if (dup)
+            return { ok: false, error_code: 'DUPLICATE_ACTION_REQUEST', error: '该订单该动作已有待批准请求', http: 409 };
+        return { ok: false, error_code: 'REQUEST_FAILED', error: e.message, http: 500 };
+    }
+    return { ok: true, request_id: id, params_hash: paramsHash };
+}
+// PR3:approve→执行 已移入 order-action-exec.ts::approveAndExecuteOrderAction(CAS approved + 执行 + executed_at CAS)。
+//   本模块自 PR3 起【只负责 submit】(createOrderActionRequest);approve/execute 不在此。

package/dist/pwa/public/app-admin-disputes.js

@@ -35,7 +35,7 @@ window.renderAdminDisputes = async function (app, opts = {}) {
           <div style="font-weight:600;overflow:hidden;text-overflow:ellipsis;white-space:nowrap">${escHtml(d.product_title || '—')}</div>
           <div style="font-size:12px;color:#6b7280;margin-top:2px;overflow:hidden;text-overflow:ellipsis;white-space:nowrap">${escHtml((d.reason || '').slice(0, 60))}</div>
           <div style="font-size:11px;color:#6b7280;margin-top:6px">${t('原告')}: ${escHtml(d.initiator_name || '—')} → ${t('被告')}: ${escHtml(d.defendant_name || '—')}</div>
-          <div style="display:flex;gap:5px;flex-wrap:wrap;margin-top:6px">${railBadge(d.payment_rail)}${assignChip(d)}${urgencyChip(d)}${verdictChip(d)}</div>
+          <div style="display:flex;gap:5px;flex-wrap:wrap;margin-top:6px">${window.dcChip ? window.dcChip(d) : ''}${railBadge(d.payment_rail)}${assignChip(d)}${urgencyChip(d)}${verdictChip(d)}</div>${window.dcAdminResolveBtn ? window.dcAdminResolveBtn(d) : ''}
           <div style="font-size:11px;color:#9ca3af;margin-top:6px;overflow:hidden;text-overflow:ellipsis;white-space:nowrap">${escHtml(d.id)} · ${fmtTime(d.created_at)}</div>
         </div>
         <div style="display:flex;flex-direction:column;gap:6px;align-items:flex-end;flex-shrink:0">

package/dist/pwa/public/app-agent-approvals-order.js

@@ -0,0 +1,18 @@
+// RFC-021 PR2 — order-action 审批卡正文(app-agent-approvals.js 在 LOC ceiling 上,故拆出)。
+//   渲染"对订单 <order_id> 执行 <accept|ship>(+tracking)"。不含任何买家地址/PII(list 端已 sanitize)。
+//   Passkey 三元组由 aaApprove 从 card 的 data-* 读取:{request_id, order_id, action, params_hash}。
+(function () {
+  window.aaOrderWhat = function (r) {
+    var ap = r.action_params || {}
+    var actionLabel = r.order_action === 'ship' ? t('发货') : r.order_action === 'accept' ? t('接单') : String(r.order_action || '')
+    var trackingLine = (r.order_action === 'ship' && ap.tracking)
+      ? '<div style="font-size:12px;color:#6b7280;margin-top:4px">' + t('物流单号') + ': <code>' + escHtml(String(ap.tracking)) + '</code></div>'
+      : ''
+    return '' +
+      '<div style="font-size:13px;color:#374151;line-height:1.7">⚡ ' + t('对订单') +
+        ' <code style="font-size:12px">' + escHtml(String(r.order_id || '')) + '</code> ' + t('执行') +
+        ' <b style="color:#6b21a8">' + escHtml(actionLabel) + '</b></div>' +
+      trackingLine +
+      '<div style="font-size:11px;color:#9ca3af;margin-top:2px">' + t('批准后由服务端在你授权下执行;agent 不直接执行') + '</div>'
+  }
+})()

package/dist/pwa/public/app-agent-approvals.js

@@ -3,7 +3,6 @@
 //   经典脚本,全局函数;globals(GET/POST/state/shell/t/escHtml/fmtTime/navigate/loading$/toast$/requestPasskeyGate)调用时解析。
 //   商家视角:不需要懂 scope/complete/verify —— 只看【哪个 agent · 要做什么 · 风险 · 多久】。批准需 Passkey(扩权=提权)。
 ;(function () {
-  const DURATION_LABEL = { once: '一次性', '1h': '1 小时', '24h': '24 小时', '7d': '7 天', '30d': '30 天' }
   const RISK = {
     low:    { label: '低风险', color: '#16a34a', bg: '#dcfce7' },
     medium: { label: '中风险', color: '#b45309', bg: '#fef3c7' },
@@ -50,11 +49,10 @@
     const risk = RISK[r.risk_level] || RISK.low
     const scopes = Array.isArray(r.requested_scopes) ? r.requested_scopes : []
     // Prefer the human-readable bundle summary; otherwise show the individual safe-scope chips.
-    const what = r.human_summary
+    const what = r.kind === 'order_action' ? (window.aaOrderWhat ? window.aaOrderWhat(r) : '') : r.human_summary
       ? `<div style="font-size:13px;color:#374151;line-height:1.7">${escHtml(r.human_summary)}</div>`
       : `<div style="margin-top:2px">${scopes.map(s => `<span style="display:inline-block;font-size:11px;color:#4f46e5;background:#eef2ff;padding:2px 8px;border-radius:4px;margin:2px 4px 2px 0">${escHtml(String(s))}</span>`).join('') || `<span style="font-size:12px;color:#9ca3af">${t('(无 —— 仅基础只读)')}</span>`}</div>`
-    const dur = DURATION_LABEL[r.duration] || r.duration || '—'
-    return `<div class="card" style="margin-bottom:12px;padding:16px;border:1px solid #e5e7eb" data-aa-id="${escHtml(String(r.id))}">
+    return `<div class="card" style="margin-bottom:12px;padding:16px;border:1px solid #e5e7eb" data-aa-id="${escHtml(String(r.id))}" data-aa-order-id="${escHtml(String(r.order_id||''))}" data-aa-action="${escHtml(String(r.order_action||''))}" data-aa-hash="${escHtml(String(r.params_hash||''))}">
       <div style="display:flex;justify-content:space-between;align-items:center;margin-bottom:8px">
         <div style="font-weight:600">${escHtml(r.agent_label || t('未命名 Agent'))} <span style="font-size:10px;color:#9ca3af">(${t('未验证')})</span></div>
         <span style="font-size:11px;color:${risk.color};background:${risk.bg};padding:2px 8px;border-radius:999px">${t(risk.label)}</span>
@@ -62,7 +60,8 @@
       <div style="font-size:11px;color:#6b7280;margin-bottom:2px">${t('它想做什么')}:</div>
       ${what}
       ${r.reason ? `<div style="font-size:12px;color:#6b7280;margin-top:8px">${t('用途(agent 自述)')}: ${escHtml(r.reason)} <span style="font-size:10px;color:#9ca3af">(${t('未验证')})</span></div>` : ''}
-      <div style="font-size:11px;color:#9ca3af;margin-top:8px">${t('授权时长')}: <strong style="color:#374151">${t(dur)}</strong> · ${t('请求于')} ${r.created_at ? fmtTime(r.created_at) : '—'}</div>
+      ${window.grantDurationSelect(r.allowed_durations, r.duration, 'aa-dur-' + escHtml(String(r.id)))}
+      <div style="font-size:11px;color:#9ca3af;margin-top:6px">${t('请求于')} ${r.created_at ? fmtTime(r.created_at) : '—'}</div>
       <div style="display:flex;gap:8px;margin-top:12px">
         <button class="btn btn-outline" style="flex:1;color:#dc2626;border-color:#fecaca" onclick="aaReject('${escHtml(String(r.id))}')">${t('拒绝')}</button>
         <button class="btn btn-primary" style="flex:2" onclick="aaApprove('${escHtml(String(r.id))}')">🔑 ${t('用 Passkey 批准')}</button>
@@ -75,9 +74,9 @@
     const btn = card ? card.querySelector('.btn-primary') : null; if (btn) btn.disabled = true
     let token
     // Passkey bound to THIS request (a token minted for request A can't approve B — server re-validates).
-    try { token = await requestPasskeyGate('agent_permission_approve', { request_id: id }) }
+    try { token = await requestPasskeyGate('agent_permission_approve', { request_id: id, order_id: (card && card.dataset.aaOrderId) || undefined, action: (card && card.dataset.aaAction) || undefined, params_hash: (card && card.dataset.aaHash) || undefined }) }
     catch (e) { if (window.dpPromptRegisterPasskey && e && e.code === 'NO_PASSKEY_REGISTERED') { await window.dpPromptRegisterPasskey(e) } else { toast$((e && e.message) || t('Passkey 验证已取消'), 'error') } if (btn) btn.disabled = false; return }
-    const r = await POST('/agent-grants/permission-requests/' + encodeURIComponent(id) + '/approve', { webauthn_token: token }).catch(() => null)
+    const r = await POST('/agent-grants/permission-requests/' + encodeURIComponent(id) + '/approve', { webauthn_token: token, duration: window.grantDurationValue('aa-dur-' + id) }).catch(() => null)
     if (!r || r.error) { toast$((r && r.error) || t('批准失败,请重试'), 'error'); if (btn) btn.disabled = false; return }
     toast$(t('已批准 —— 该 agent 的权限已扩展'))
     aaHydrate(); hydrateAgentApprovalsBadge()

package/dist/pwa/public/app-agent-pair.js

@@ -74,7 +74,7 @@
           <div><span style="color:#6b7280">${t('Agent 自称')}:</span> <strong>${escHtml(c.agent_label || t('未命名'))}</strong> <span style="font-size:10px;color:#9ca3af">(${t('未验证')})</span></div>
           ${c.reason ? `<div><span style="color:#6b7280">${t('用途(agent 自述)')}:</span> ${escHtml(c.reason)} <span style="font-size:10px;color:#9ca3af">(${t('未验证')})</span></div>` : ''}
           <div style="margin-top:6px"><span style="color:#6b7280">${t('请求的权限')}:</span><div style="margin-top:4px">${capHtml}</div></div>
-          <div style="font-size:11px;color:#9ca3af;margin-top:6px">${t('有效期至')} ${c.expires_at ? fmtTime(c.expires_at) : '—'}</div>
+          ${window.grantDurationSelect(c.allowed_durations, c.suggested_duration, 'pair-duration')}
         </div>
         <label style="display:flex;align-items:flex-start;gap:8px;margin:14px 0 4px;font-size:12px;color:#374151;cursor:pointer">
           <input type="checkbox" id="pair-confirm" onchange="document.getElementById('pair-approve-btn').disabled=!this.checked" style="margin-top:2px">
@@ -92,7 +92,7 @@
     let token
     try { token = await requestPasskeyGate('agent_pair_approve', { user_code: _code }) }
     catch (e) { if (window.dpPromptRegisterPasskey && e && e.code === 'NO_PASSKEY_REGISTERED') { await window.dpPromptRegisterPasskey(e) } else { toast$((e && e.message) || t('Passkey 验证已取消'), 'error') } if (btn) btn.disabled = false; return }
-    const r = await POST('/agent-grants/pair/' + encodeURIComponent(_code) + '/approve', { webauthn_token: token }).catch(() => null)
+    const r = await POST('/agent-grants/pair/' + encodeURIComponent(_code) + '/approve', { webauthn_token: token, duration: window.grantDurationValue('pair-duration') }).catch(() => null)
     if (!r || r.error) { toast$((r && r.error) || t('批准失败,请重试'), 'error'); if (btn) btn.disabled = false; return }
     dpairShowResult('approved', r)
   }

package/dist/pwa/public/app-arbitrator-admin.js

@@ -71,7 +71,7 @@ window.arbTaishCard = () => `
   <div style="margin-bottom:10px">
     <div class="card" onclick="location.hash='#disputes'" style="padding:14px;cursor:pointer;display:flex;align-items:center;gap:10px;min-height:64px">
       <div style="font-size:22px">⚖</div>
-      <div><div style="font-weight:600;font-size:14px">${t('仲裁台')}</div><div style="font-size:12px;color:#6b7280">${t('待响应 / 仲裁中 / 已结')}</div></div>
+      <div><div style="font-weight:600;font-size:14px">${t('仲裁台')}<span class="arb-badge" style="background:#7c3aed;color:#fff;border-radius:99px;font-size:11px;padding:1px 7px;margin-left:6px;display:${(window.state && state.arbPending > 0) ? 'inline' : 'none'}">${(window.state && state.arbPending) || ''}</span></div><div style="font-size:12px;color:#6b7280">${t('待响应 / 仲裁中 / 已结')}</div></div>
     </div>
   </div>`
 

package/dist/pwa/public/app-decline-contest-ruling.js

@@ -0,0 +1,53 @@
+// 统一仲裁台 · decline_contest 裁决 UI(PR3)。与 app-decline-contest-ui.js(PR2,已达 ceiling)分开新建。
+//   仲裁员两选裁决表单 + admin 兜底裁决 + 升级/落定通知模板。全局(t/GET/POST/state/handleArbitrate/requestPasskeyGate)运行时就绪。
+(function () {
+  // 仲裁员两选裁决表单。复用 window.handleArbitrate —— radio name/reason id/msg id 与通用裁决一致,提交 POST /api/disputes/:id/arbitrate,
+  //   后端按 dispute_type 分流到唯一 resolver(dispute CAS + COI + assignment + 终态 completed + 结算,单事务)。
+  window.dcRulingForm = function (dispute) {
+    var radio = function (val, label) {
+      return '<label style="display:flex;align-items:flex-start;gap:8px;padding:8px;border:1px solid #e9d5ff;border-radius:6px;cursor:pointer;font-size:13px"><input type="radio" name="arb-ruling-radio" value="' + val + '" style="margin-top:2px"> <span>' + label + '</span></label>'
+    }
+    return '' +
+      '<div style="margin-top:12px;border:1px solid #e9d5ff;background:#faf5ff;border-radius:8px;padding:12px">' +
+        '<div style="font-weight:600;font-size:13px;color:#6b21a8;margin-bottom:8px">⚖ ' + t('拒单举证仲裁裁决') + '</div>' +
+        '<div id="arbitrate-msg"></div>' +
+        '<div style="display:flex;flex-direction:column;gap:8px;margin-bottom:10px">' +
+          radio('decline_no_fault_upheld', t('维持无责 —— 全退买家 + 退卖家质押,零罚没')) +
+          radio('decline_fault_confirmed', t('驳回举证,判卖家违约 —— 退款买家 + 罚没质押')) +
+        '</div>' +
+        '<textarea class="form-control" id="arb-reason" rows="3" placeholder="' + t('裁定理由(必填)') + '" style="width:100%;margin-bottom:8px"></textarea>' +
+        '<button class="btn btn-primary btn-sm" style="width:auto" onclick="handleArbitrate(\'' + dispute.id + '\')">' + t('确认裁定') + '</button>' +
+      '</div>'
+  }
+
+  // admin 兜底裁决(管理面)。仅 decline_contest 且仲裁窗口(arbitrate_deadline)已过时给按钮;窗口未过后端 FALLBACK_TOO_EARLY。
+  window.dcAdminResolveBtn = function (d) {
+    if (!d || d.dispute_type !== 'decline_contest' || !d.arbitrate_deadline) return ''
+    if (new Date().toISOString() <= d.arbitrate_deadline) return ''   // 仲裁员优先:窗口内不给 admin 兜底入口
+    var b = function (dec, label, bg) { return '<button class="btn btn-sm" style="width:auto;background:' + bg + ';color:#fff;font-size:12px" onclick="dcAdminResolve(\'' + d.id + '\',\'' + dec + '\')">' + label + '</button>' }
+    return '<div style="display:flex;gap:6px;margin-top:6px">🛡️ ' + b('decline_no_fault_upheld', t('兜底·维持无责'), '#16a34a') + b('decline_fault_confirmed', t('兜底·判违约'), '#dc2626') + '</div>'
+  }
+  window.dcAdminResolve = async function (disputeId, decision) {
+    var reason = window.prompt(t('裁定理由(必填)'))
+    if (!reason || !reason.trim()) return
+    var tk
+    try { tk = await requestPasskeyGate('arbitrate', { dispute_id: disputeId, action: 'decline_contest_resolve', decision: decision }) }
+    catch (e) { window.alert(t('此操作需现场真人 Passkey 验证')); return }
+    var res = await POST('/admin/disputes/' + disputeId + '/decline-contest-resolve', { decision: decision, reason: reason, webauthn_token: tk })
+    if (res && res.error) { window.alert(res.error); return }
+    window.alert(t('裁决已执行'))
+    if (typeof renderAdminDisputes === 'function') renderAdminDisputes(document.getElementById('app'), {})
+  }
+
+  // 双语通知模板(升级 + 落定);运行时挂载到 NOTIF_TEMPLATES。
+  if (window.NOTIF_TEMPLATES) {
+    window.NOTIF_TEMPLATES['arb_decline_contest_escalated'] = function () {
+      return { title: '⏰ ' + t('拒单举证仲裁已超时,请尽快裁决'), body: t('一笔拒单举证仲裁已过仲裁窗口仍未裁决,已进入 admin 兜底窗口 —— 请尽快处理,否则将自动判卖家违约。') }
+    }
+    window.NOTIF_TEMPLATES['arb_decline_contest_resolved'] = function (p) {
+      var upheld = p && p.decision === 'decline_no_fault_upheld'
+      return { title: (upheld ? '✅ ' : '⚖ ') + (upheld ? t('拒单举证仲裁:维持无责') : t('拒单举证仲裁:驳回,判卖家违约')),
+        body: upheld ? t('仲裁认定卖家客观无责:买家已全额退款,卖家质押已退回,无罚没。订单已结。') : t('仲裁驳回卖家举证,判卖家违约:买家已退款,卖家质押按违约处置。订单已结。') }
+    }
+  }
+})()

package/dist/pwa/public/app-decline-contest-ui.js

@@ -0,0 +1,44 @@
+// 统一仲裁台 · decline_contest(拒单举证仲裁)前端渲染 + 待办角标。
+//   app.js / app-arbitrator-admin.js 都在 LOC ceiling 上(零余量),故所有渲染逻辑集中在此(非 pinned 域文件),
+//   pinned 文件侧只做 net-zero 的 window.* 调用。全局(t / GET / state)由 app.js 等 classic script 提供,运行时已就绪。
+(function () {
+  var isDC = function (d) { return d && d.dispute_type === 'decline_contest' }
+
+  // ① 列表行类型徽章(紫色 = 仲裁色系,镜像现有 arbitration chip)。
+  window.dcChip = function (d) {
+    return isDC(d)
+      ? '<span style="display:inline-flex;align-items:center;gap:3px;background:#faf5ff;color:#6b21a8;padding:0 6px;border-radius:99px;font-size:10px;font-weight:600;margin-right:5px">⚖ ' + t('拒单举证仲裁') + '</span>'
+      : ''
+  }
+
+  // ② 详情页:PR3 打通专用裁决前,decline_contest 的裁决通道 fail-closed —— 用只读提示卡【替代】裁决表单(不显示会 409 的按钮)。
+  window.dcNotice = function (dispute) {
+    return '' +
+      '<div class="card" style="margin-top:12px;border:1px solid #e9d5ff;background:#faf5ff;border-radius:8px;padding:12px">' +
+        '<div style="font-weight:600;font-size:13px;color:#6b21a8;margin-bottom:4px">⚖ ' + t('拒单举证仲裁') + '</div>' +
+        '<div style="font-size:12px;color:#6b7280;line-height:1.6">' + t('卖家主张客观无责并已举证。裁决通道即将开放——届时可裁定:维持无责(全退买家+退卖家质押)或驳回(判卖家违约)。') + '</div>' +
+        '<div style="font-size:12px;color:#9ca3af;margin-top:6px">⏳ ' + t('裁决通道即将开放') + '</div>' +
+      '</div>'
+  }
+
+  // ③ 待办角标:拉 pending-count → 写 state.arbPending → 就地刷新 .arb-badge(不整页重渲染,镜像 chats-badge 的 updateAggregate)。
+  window.refreshArbBadge = async function () {
+    try {
+      if (!(window.state && window.state.canArbitrate)) return
+      var r = await GET('/arbitrator/pending-count')
+      window.state.arbPending = (r && typeof r.count === 'number') ? r.count : 0
+      var n = window.state.arbPending
+      document.querySelectorAll('.arb-badge').forEach(function (b) {
+        b.textContent = n > 0 ? n : ''
+        b.style.display = n > 0 ? 'inline' : 'none'
+      })
+    } catch (e) { /* 角标非关键,静默 */ }
+  }
+
+  // ④ 双语通知模板(app-notif-templates.js 在 ceiling 上,故在此运行时挂载;title 约定「emoji+空格」开头 → 列表当图标)。
+  if (window.NOTIF_TEMPLATES) {
+    window.NOTIF_TEMPLATES['arb_decline_contest_new'] = function () {
+      return { title: '⚖ ' + t('新的拒单举证仲裁待处理'), body: t('一笔卖家客观拒单举证已进入统一仲裁台,等待仲裁员裁决。') }
+    }
+  }
+})()