@seasonkoh/webaz 0.1.30 → 0.1.32

package/dist/pwa/public/app-grant-duration.js

@@ -0,0 +1,20 @@
+// RFC-020 — shared grant-duration picker (used by #pair initial pairing + #agent-approvals expansion).
+//   Classic script, loaded before the pages that use it. Globals (t / escHtml) resolve at call time.
+//   The human chooses the grant lifetime; safe scopes → up to 30d. Kept in one place so both approval
+//   surfaces stay identical and the pinned page files don't grow.
+;(function () {
+  const LABEL = { '1h': '1 小时', '24h': '24 小时', '7d': '7 天', '30d': '30 天' }   // 'once' intentionally omitted — no real single-use grant yet (would become a misleading 1h reusable bearer)
+
+  // Render a <select id=selectId> of `allowed` durations, pre-selecting `suggested`. Falls back to a safe set.
+  window.grantDurationSelect = function (allowed, suggested, selectId) {
+    const opts = (Array.isArray(allowed) && allowed.length) ? allowed : ['1h', '24h', '7d', '30d']
+    const sel = suggested || '7d'
+    return `<div style="margin-top:10px"><span style="font-size:12px;color:#6b7280">${t('授权时长')}(${t('你可以改')}):</span>`
+      + `<select id="${escHtml(String(selectId))}" style="width:100%;margin-top:4px;padding:8px;border:1px solid #d1d5db;border-radius:8px;font-size:14px">`
+      + opts.map(d => `<option value="${escHtml(String(d))}" ${d === sel ? 'selected' : ''}>${escHtml(t(LABEL[d] || String(d)))}</option>`).join('')
+      + `</select></div>`
+  }
+
+  // Read the human's chosen duration from a rendered selector (undefined if absent → backend uses its default).
+  window.grantDurationValue = function (selectId) { const el = document.getElementById(selectId); return (el && el.value) || undefined }
+})()

package/dist/pwa/public/app.js

@@ -566,7 +566,7 @@ async function render(page, params) {
     const { status, body } = await apiWithStatus('GET', '/me')
     if (status === 200 && body && !body.error) {
       state.user = body
-      connectSSE(); maybePromptPlacementBind(); refreshCartBadge(); maybeShowInstallBanner(); maybeClaimPendingProductShare(); maybeClaimPendingShopReferral(); setTimeout(refreshCompareBadge, 0); refreshChatsBadge(); refreshFeedbackBadge(); refreshSnfBadge(); setTimeout(ensureSnfPull, 800); if (window.arbEntryHydrate) arbEntryHydrate()
+      connectSSE(); maybePromptPlacementBind(); refreshCartBadge(); maybeShowInstallBanner(); maybeClaimPendingProductShare(); maybeClaimPendingShopReferral(); setTimeout(refreshCompareBadge, 0); refreshChatsBadge(); refreshFeedbackBadge(); refreshSnfBadge(); setTimeout(ensureSnfPull, 800); if (window.arbEntryHydrate) arbEntryHydrate(); if (window.refreshArbBadge) refreshArbBadge()
       try { p2pStart() } catch (e) { console.warn('[P2P] start err', e) }
     } else if (status === 401 || status === 403) {
       // 真·鉴权失败：清掉两层存储
@@ -1073,7 +1073,7 @@ function shell(content, activeTab, opts) {
     ]
   } else if (role === 'arbitrator') {
     tabs = [
-      { id: 'seller',        icon: '⚖️', label: t('仲裁台') },
+      { id: 'seller',        icon: '⚖️', label: t('仲裁台'), arbBadge: true },
       { id: 'orders',        icon: '📋', label: t('记录') },
       { id: 'chats',         target: 'chats/notifs', icon: '💬', label: t('消息'), chatsBadge: true },
       { id: 'wallet',        icon: '💰', label: t('钱包') },
@@ -1204,7 +1204,7 @@ function shell(content, activeTab, opts) {
           <span class="tab-icon" style="position:relative">
             ${tb.icon}
             ${tb.badge ? `<span id="notif-badge" style="position:absolute;top:-4px;right:-6px;background:#dc2626;color:#fff;border-radius:99px;font-size:10px;padding:0 4px;min-width:16px;text-align:center;display:${state.unread > 0 ? 'inline' : 'none'}">${state.unread || ''}</span>` : ''}
-            ${tb.chatsBadge ? (() => { const _agg = (state.chatsUnread||0)+(state.unread||0)+(state.announcementsUnread||0)+(state.feedbackUnread||0); return `<span class="chats-badge" style="position:absolute;top:-4px;right:-6px;background:#4f46e5;color:#fff;border-radius:99px;font-size:10px;padding:0 4px;min-width:16px;text-align:center;display:${_agg > 0 ? 'inline' : 'none'}">${_agg || ''}</span>` })() : ''}
+            ${tb.chatsBadge ? (() => { const _agg = (state.chatsUnread||0)+(state.unread||0)+(state.announcementsUnread||0)+(state.feedbackUnread||0); return `<span class="chats-badge" style="position:absolute;top:-4px;right:-6px;background:#4f46e5;color:#fff;border-radius:99px;font-size:10px;padding:0 4px;min-width:16px;text-align:center;display:${_agg > 0 ? 'inline' : 'none'}">${_agg || ''}</span>` })() : ''}${tb.arbBadge ? `<span class="arb-badge" style="position:absolute;top:-4px;right:-6px;background:#7c3aed;color:#fff;border-radius:99px;font-size:10px;padding:0 4px;min-width:16px;text-align:center;display:${(state.arbPending||0) > 0 ? 'inline' : 'none'}">${state.arbPending || ''}</span>` : ''}
           </span>${tb.label}
         </button>`).join('')}
     </nav>`}`
@@ -13974,7 +13974,7 @@ function buildDisputeHtml(dispute, user) {
   // ── 仲裁员:暂停 / 恢复自动判定时钟(playbook §2.1)────
   // 补证据期 > 48h 时必须显式暂停,避免被协议层 48h 沉默判架空
   const isPaused = dispute.auto_judge_paused_until && dispute.auto_judge_paused_until * 1000 > Date.now()
-  const pauseSection = isArbitrator && dispute.status !== 'resolved' && !dispute.ruling_type ? (
+  const pauseSection = isArbitrator && dispute.dispute_type !== 'decline_contest' && dispute.status !== 'resolved' && !dispute.ruling_type ? (
     isPaused ? `
     <div style="margin-top:12px;background:#fef3c7;border:1px solid #fcd34d;border-radius:8px;padding:12px">
       <div style="font-size:13px;font-weight:600;color:#92400e;margin-bottom:6px">⏸️ ${t('自动判定时钟已冻结')}</div>
@@ -14011,7 +14011,7 @@ function buildDisputeHtml(dispute, user) {
   ) : ''
 
   // ── 仲裁员：发起补充证据请求 ──────────────────
-  const requestEvidenceSection = isArbitrator && dispute.status !== 'resolved' ? `
+  const requestEvidenceSection = isArbitrator && dispute.dispute_type !== 'decline_contest' && dispute.status !== 'resolved' ? `
     <div style="margin-top:12px">
       <button class="btn btn-outline btn-sm" style="width:auto;font-size:12px" onclick="(function(){var s=document.getElementById('req-ev-section');s.style.display=s.style.display==='none'?'':'none'})()">📋 请求补充证据</button>
       <div id="req-ev-section" style="display:none;margin-top:10px;background:#f8fafc;border-radius:8px;padding:12px">
@@ -14050,7 +14050,7 @@ function buildDisputeHtml(dispute, user) {
     </div>` : ''
 
   // ── 仲裁员裁定（含责任分配）────────────────────
-  const arbitrateSection = isArbitrator && (dispute.status === 'open' || dispute.status === 'in_review') ? `
+  const arbitrateSection = isArbitrator && (dispute.status === 'open' || dispute.status === 'in_review') ? (dispute.dispute_type === 'decline_contest' ? (window.dcRulingForm ? window.dcRulingForm(dispute) : '') : `
     <div style="margin-top:12px;border-top:1px solid #fecaca;padding-top:12px">
       <div style="font-weight:600;font-size:13px;margin-bottom:8px">⚖️ 仲裁员裁定（截止 ${fmtTime(dispute.arbitrate_deadline)}）</div>
       ${window.dpArbFeeNote ? window.dpArbFeeNote(dispute.payment_rail) : ''}
@@ -14102,7 +14102,7 @@ function buildDisputeHtml(dispute, user) {
         <textarea class="form-control" id="arb-reason" placeholder="${t('请详细说明裁定依据（将记录在案）')}" style="font-size:13px"></textarea>
       </div>
       <button class="btn btn-danger btn-sm" style="width:auto" onclick="handleArbitrate('${dispute.id}')">${t('确认裁定')}</button>
-    </div>` : ''
+    </div>`) : ''
   // ── 裁定结果已在 timeline 末尾以 'ruling' / 'resolved' 事件呈现（W4）
 
   // W4: 三方参与者头部（取代两行 detail-row，更紧凑）
@@ -14342,7 +14342,7 @@ window.handleArbitrate = async (disputeId) => {
     body = { ...body, liability_parties: liabilityParties, refund_amount: totalCalc }
   }
 
-  let _arbTk; try { _arbTk = await requestPasskeyGate('arbitrate', { dispute_id: disputeId }) } catch (e) { msgEl.innerHTML = alert$('error', (e && e.message ? e.message + ' — ' : '') + t('仲裁裁定需现场真人 Passkey 验证')); return }; msgEl.innerHTML = `<div class="alert alert-info"><span class="spinner"></span>${t('裁定中...')}</div>`  // 所有 ruling(含驳回)先取 arbitrate gate token
+  let _arbTk; try { _arbTk = await requestPasskeyGate('arbitrate', { dispute_id: disputeId, decision: ruling }) } catch (e) { msgEl.innerHTML = alert$('error', (e && e.message ? e.message + ' — ' : '') + t('仲裁裁定需现场真人 Passkey 验证')); return }; msgEl.innerHTML = `<div class="alert alert-info"><span class="spinner"></span>${t('裁定中...')}</div>`  // 所有 ruling(含驳回)先取 arbitrate gate token;绑 dispute_id + decision(decline_contest 钱路 fail-closed 校验)
   const res = await POST(`/disputes/${disputeId}/arbitrate`, { ...body, webauthn_token: _arbTk })
   if (res.error) { msgEl.innerHTML = alert$('error', res.error); return }
 
@@ -14622,7 +14622,7 @@ async function renderDisputeList(app) {
       <div class="card" onclick="navigate('#dispute/${d.id}')" style="padding:10px 12px;display:flex;align-items:center;gap:10px;cursor:pointer;${urgent ? 'border-left:3px solid #dc2626;' : ''}">
         <div style="font-size:22px;flex-shrink:0">${urgent ? '⏰' : stIcon}</div>
         <div style="flex:1;min-width:0">
-          <div style="font-size:13px;font-weight:600;white-space:nowrap;overflow:hidden;text-overflow:ellipsis">${escHtml(d.reason || '')}</div>
+          <div style="font-size:13px;font-weight:600;white-space:nowrap;overflow:hidden;text-overflow:ellipsis">${window.dcChip ? window.dcChip(d) : ''}${escHtml(d.reason || '')}</div>
           <div style="font-size:11px;color:#6b7280;margin-top:2px;white-space:nowrap;overflow:hidden;text-overflow:ellipsis">${escHtml(d.initiator_name || '?')} → ${escHtml(d.defendant_name || '—')} · ${d.total_amount} WAZ</div>
           <div style="font-size:10px;color:${urgent ? '#dc2626' : '#9ca3af'};margin-top:2px${urgent ? ';font-weight:600' : ''}">${disputeStatusLabelText(d.status)}${deadline ? ` · ${urgent ? '⚠ ' : ''}${t('截止')} ${fmtTime(deadline)}` : ` · ${fmtTime(d.updated_at || d.created_at)}`}</div>
         </div>

package/dist/pwa/public/i18n.js

@@ -17,6 +17,29 @@ window.resolveInitialLang = (savedLang, navigatorLike) => {
 window._lang = window.resolveInitialLang(localStorage.getItem('webaz_lang'), typeof navigator !== 'undefined' ? navigator : null)
 
 const _EN = {
+  // ── RFC-021 order-action 审批卡(app-agent-approvals-order.js)──
+  '对订单': 'On order',
+  '批准后由服务端在你授权下执行;agent 不直接执行': 'On approval the server executes under your authority; the agent never executes directly',
+  // ── 统一仲裁台:decline_contest(拒单举证仲裁,app-decline-contest-ui.js)──
+  '拒单举证仲裁': 'Decline-contest arbitration',
+  '裁决通道即将开放': 'Ruling channel opening soon',
+  '卖家主张客观无责并已举证。裁决通道即将开放——届时可裁定:维持无责(全退买家+退卖家质押)或驳回(判卖家违约)。': 'The seller claims objective no-fault and has submitted evidence. The ruling channel is opening soon — an arbitrator will then rule: uphold no-fault (full refund to buyer + seller stake returned) or reject (seller at fault).',
+  '新的拒单举证仲裁待处理': 'New decline-contest arbitration pending',
+  '一笔卖家客观拒单举证已进入统一仲裁台,等待仲裁员裁决。': 'A seller objective-decline contest has entered the unified arbitration desk, awaiting an arbitrator ruling.',
+  '拒单举证仲裁裁决': 'Decline-contest ruling',
+  '维持无责 —— 全退买家 + 退卖家质押,零罚没': 'Uphold no-fault — full refund to buyer + seller stake returned, no forfeit',
+  '驳回举证,判卖家违约 —— 退款买家 + 罚没质押': 'Reject the contest, seller at fault — refund buyer + forfeit stake',
+  '裁定理由(必填)': 'Ruling reason (required)',
+  '兜底·维持无责': 'Fallback · uphold no-fault',
+  '兜底·判违约': 'Fallback · seller at fault',
+  '此操作需现场真人 Passkey 验证': 'This action requires a live human Passkey verification',
+  '裁决已执行': 'Ruling executed',
+  '拒单举证仲裁已超时,请尽快裁决': 'Decline-contest arbitration overdue — please rule soon',
+  '一笔拒单举证仲裁已过仲裁窗口仍未裁决,已进入 admin 兜底窗口 —— 请尽快处理,否则将自动判卖家违约。': 'A decline-contest arbitration has passed its ruling window unresolved and entered the admin fallback window — please handle it soon, or the seller will be auto-ruled at fault.',
+  '拒单举证仲裁:维持无责': 'Decline-contest: no-fault upheld',
+  '拒单举证仲裁:驳回,判卖家违约': 'Decline-contest: rejected, seller at fault',
+  '仲裁认定卖家客观无责:买家已全额退款,卖家质押已退回,无罚没。订单已结。': 'Arbitration found the seller objectively no-fault: buyer fully refunded, seller stake returned, no forfeit. Order closed.',
+  '仲裁驳回卖家举证,判卖家违约:买家已退款,卖家质押按违约处置。订单已结。': 'Arbitration rejected the seller\'s contest and ruled seller at fault: buyer refunded, seller stake handled per fault rules. Order closed.',
   // ── 仲裁员管理 admin UI(app-arbitrator-admin.js,PR-F)──
   '仲裁员管理': 'Arbitrator management',
   '授权真人仲裁员(唯一授权源=active 白名单)。目标须已注册 Passkey、非本案当事人、非 agent/系统账号。授权/暂停/撤销均需你现场 Passkey,后端留痕。': 'Grant real human arbitrators (the sole authorization source is the active whitelist). The target must have a registered Passkey, not be a party to the case, and not be an agent/system account. Grant/suspend/revoke each require your live Passkey and are audited server-side.',
@@ -556,11 +579,11 @@ const _EN = {
   '当你的 agent 请求更多权限时,会出现在这里等你批准。': 'When your agent requests more permissions, they appear here for your approval.',
   '它想做什么': 'What it wants to do',
   '授权时长': 'Grant duration',
+  '你可以改': 'you can change this',
   '请求于': 'Requested',
   '低风险': 'Low risk',
   '中风险': 'Medium risk',
   '高风险': 'High risk',
-  '一次性': 'One-time',
   '1 小时': '1 hour',
   '7 天': '7 days',
   '确认拒绝这个授权请求?': 'Reject this permission request?',

package/dist/pwa/public/index.html

@@ -60,9 +60,11 @@
   <script src="/app-price.js"></script>
   <script src="/app-order-labels.js"></script>
   <script src="/app-seller.js"></script>
+  <script src="/app-grant-duration.js"></script>
   <script src="/app-agents.js"></script>
   <script src="/app-agent-pair.js"></script>
   <script src="/app-agent-approvals.js"></script>
+  <script src="/app-agent-approvals-order.js"></script>
   <script src="/app-agent-appeal.js"></script>
   <script src="/app-direct-pay.js"></script>
   <script src="/app-direct-pay-readiness.js"></script>
@@ -107,6 +109,8 @@
   <script src="/app-order-errors.js"></script>
   <script src="/app-arbitrator-entry.js"></script>
   <script src="/app-arbitrator-admin.js"></script>
+  <script src="/app-decline-contest-ui.js"></script>
+  <script src="/app-decline-contest-ruling.js"></script>
   <script src="/app-contribution-hub.js"></script>
   <script src="/app-prelaunch-waz.js"></script>
   <script src="/app-chat-poll.js"></script>

package/dist/pwa/public/openapi.json

@@ -3,7 +3,7 @@
   "info": {
     "title": "WebAZ Protocol API",
     "version": "0.4.14",
-    "description": "Auto-generated endpoint inventory (776 endpoints, 17 with full schema). See docs/ for design context."
+    "description": "Auto-generated endpoint inventory (780 endpoints, 17 with full schema). See docs/ for design context."
   },
   "servers": [
     {
@@ -648,28 +648,6 @@
         ]
       }
     },
-    "/api/admin/decline-contests": {
-      "get": {
-        "summary": "仲裁员待办:列出所有被举证的临时判责拒单",
-        "tags": [],
-        "security": [
-          {
-            "bearerAuth": []
-          }
-        ]
-      }
-    },
-    "/api/admin/decline-contests/:orderId/resolve": {
-      "post": {
-        "summary": "仲裁员裁决",
-        "tags": [],
-        "security": [
-          {
-            "bearerAuth": []
-          }
-        ]
-      }
-    },
     "/api/admin/direct-receive/aml-flags": {
       "post": {
         "summary": "POST /api/admin/direct-receive/aml-flags",
@@ -1035,6 +1013,20 @@
         ]
       }
     },
+    "/api/admin/disputes/:id/decline-contest-resolve": {
+      "post": {
+        "summary": "(dispute CAS + COI + 终态 completed + 结算 + 审计,单事务全回滚)。admin override 不占用 assigned_arbitrators。",
+        "tags": [
+          "admin",
+          "dispute"
+        ],
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ]
+      }
+    },
     "/api/admin/economic-summary": {
       "get": {
         "summary": "隐私第一：运营财务，仅 protocol admin 可见。",
@@ -2764,6 +2756,48 @@
         "security": []
       }
     },
+    "/api/agent/orders": {
+      "get": {
+        "summary": "买家地址/联系/gift_recipient 连取都不取(I6)。纯只读,无任何执行(order_action_request 在 PR2/PR3 才有提交/执行)。",
+        "tags": [
+          "order"
+        ],
+        "security": [
+          {
+            "grantBearer": []
+          }
+        ],
+        "x-webaz-grant-scope": "seller_orders_read_minimal"
+      }
+    },
+    "/api/agent/orders/:id": {
+      "get": {
+        "summary": "GET /api/agent/orders/:id",
+        "tags": [
+          "order"
+        ],
+        "security": [
+          {
+            "grantBearer": []
+          }
+        ],
+        "x-webaz-grant-scope": "seller_orders_read_minimal"
+      }
+    },
+    "/api/agent/orders/:orderId/action-request": {
+      "post": {
+        "summary": "同 (order_id,action) 双 pending 被唯一索引拒。执行(accept/ship)在 PR3 经人 Passkey 批准后由服务端跑。",
+        "tags": [
+          "order"
+        ],
+        "security": [
+          {
+            "grantBearer": []
+          }
+        ],
+        "x-webaz-grant-scope": "order_action_request"
+      }
+    },
     "/api/agent/seller/products": {
       "get": {
         "summary": "The consumption (allow AND the permission_required deny) is audited by the middleware.",
@@ -2774,6 +2808,16 @@
           }
         ],
         "x-webaz-grant-scope": "seller_products_read"
+      },
+      "post": {
+        "summary": "POST /api/agent/seller/products",
+        "tags": [],
+        "security": [
+          {
+            "grantBearer": []
+          }
+        ],
+        "x-webaz-grant-scope": "seller_product_draft"
       }
     },
     "/api/agent/verifiability": {
@@ -3017,6 +3061,17 @@
         ]
       }
     },
+    "/api/arbitrator/pending-count": {
+      "get": {
+        "summary": "非仲裁员返回 0(不报错,前端 badge 拉取对所有人无害)。",
+        "tags": [],
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ]
+      }
+    },
     "/api/arbitrator/status": {
       "get": {
         "summary": "GET /api/arbitrator/status",

package/dist/pwa/routes/admin-reports.js

@@ -1,7 +1,9 @@
 import { dbOne, dbAll } from '../../layer0-foundation/L0-1-database/db.js'; // RFC-016 异步 DB seam
+import { resolveDeclineContestDispute } from '../../layer3-trust/L3-1-dispute-engine/decline-contest-resolve.js'; // PR3 唯一裁决器(admin fallback 入口)
+import { notifyDeclineContestResolved } from '../../layer2-business/L2-6-notifications/notification-engine.js';
 export function registerAdminReportsRoutes(app, deps) {
-    // db 已全量走 RFC-016 异步 seam(dbOne/dbAll),不再直接用 deps.db
-    const { requireContentAdmin, requireArbitrationAdmin, requireProtocolAdmin } = deps;
+    // 读表盘走 RFC-016 异步 seam(dbOne/dbAll);唯一例外 = decline-contest 裁决器需 sync db.transaction(domain 层),用 deps.db。
+    const { db, requireContentAdmin, requireArbitrationAdmin, requireProtocolAdmin, requireHumanPresence } = deps;
     app.get('/api/admin/orders', async (req, res) => {
         const admin = requireContentAdmin(req, res);
         if (!admin)
@@ -42,6 +44,7 @@ export function registerAdminReportsRoutes(app, deps) {
         const rail = typeof req.query.rail === 'string' ? req.query.rail.trim() : '';
         const where = [];
         const params = [];
+        // PR2:decline_contest 现进入 admin 监督台(前端按 dispute_type 打"拒单举证仲裁"标签)。
         if (status) {
             where.push('d.status = ?');
             params.push(status);
@@ -51,7 +54,7 @@ export function registerAdminReportsRoutes(app, deps) {
             params.push(rail);
         }
         const rows = await dbAll(`
-      SELECT d.id, d.order_id, d.initiator_id, d.defendant_id, d.reason, d.status,
+      SELECT d.id, d.order_id, d.initiator_id, d.defendant_id, d.reason, d.status, d.dispute_type,
              d.created_at, d.respond_deadline, d.arbitrate_deadline, d.resolved_at,
              d.verdict, d.ruling_type, d.assigned_arbitrators,
              u1.name as initiator_name, u2.name as defendant_name,
@@ -68,6 +71,40 @@ export function registerAdminReportsRoutes(app, deps) {
         const counts = await dbAll('SELECT status, COUNT(*) n FROM disputes GROUP BY status');
         res.json({ disputes: rows, counts: Object.fromEntries(counts.map(c => [c.status, c.n])), total: counts.reduce((s, c) => s + c.n, 0) });
     });
+    // PR3 admin fallback:仲裁窗口(arbitrate_deadline)过后,仲裁 admin 可 override 裁决卡住的拒单举证仲裁。
+    //   §3 仲裁员优先(窗口未过 → resolver 抛 FALLBACK_TOO_EARLY);走【与仲裁员完全相同】的唯一 resolver
+    //   (dispute CAS + COI + 终态 completed + 结算 + 审计,单事务全回滚)。admin override 不占用 assigned_arbitrators。
+    app.post('/api/admin/disputes/:id/decline-contest-resolve', async (req, res) => {
+        const admin = requireArbitrationAdmin(req, res);
+        if (!admin)
+            return;
+        const { decision, reason } = (req.body ?? {});
+        if (decision !== 'decline_no_fault_upheld' && decision !== 'decline_fault_confirmed')
+            return void res.status(400).json({ error: "decision 必须为 'decline_no_fault_upheld' / 'decline_fault_confirmed'", error_code: 'BAD_DECISION' });
+        if (!reason || !String(reason).trim())
+            return void res.status(400).json({ error: '请提供裁决理由', error_code: 'REASON_REQUIRED' });
+        // Passkey purpose_data 绑 dispute_id + action + decision —— 钱路/状态闭环动作,fail-closed:
+        //   token 必须【显式绑定】本案 + 本动作 + 本结果。绝不允许 null(未绑定 token)或缺字段通过,否则一个泛化的
+        //   arbitrate token 就能对任意过期 decline-contest 触发退款/罚没/completed。
+        const hp = requireHumanPresence(admin.id, 'arbitrate', req.body?.webauthn_token, 'require_human_presence_for_arbitrate', (data) => {
+            const d = data;
+            return d != null && typeof d === 'object' && d.dispute_id === req.params.id && d.action === 'decline_contest_resolve' && d.decision === decision;
+        });
+        if (!hp.ok)
+            return void res.status(412).json({ error: hp.reason || '此操作需真实人工 WebAuthn 验证', error_code: hp.error_code || 'HUMAN_PRESENCE_REQUIRED' });
+        try {
+            const r = resolveDeclineContestDispute(db, req.params.id, admin.id, decision, reason, 'admin_fallback');
+            try {
+                notifyDeclineContestResolved(db, r.orderId, r.decision);
+            }
+            catch { /* 通知失败不影响已完成结算 */ }
+            return void res.json({ success: true, outcome: r.decision, order_status: 'completed', source: 'admin_fallback' });
+        }
+        catch (e) {
+            const err = e;
+            return void res.status(err.http || 400).json({ error: err.message || '裁决失败', error_code: err.code || 'DC_RESOLVE_FAILED' });
+        }
+    });
     app.get('/api/admin/verify-tasks', async (req, res) => {
         const admin = requireArbitrationAdmin(req, res);
         if (!admin)