@seasonkoh/webaz 0.1.8 → 0.1.9

package/dist/pwa/routes/claim-verify.js

@@ -0,0 +1,615 @@
+// ─── 域常量 ───────────────────────────────────────────────
+export const CLAIM_STAKE_DEFAULT = 10; // 买家发起质押 10 WAZ
+export const CLAIM_DEADLINE_HOURS = 48; // 接单 + 投票截止
+export const CLAIM_SELLER_EXTENSION_HOURS = 24; // 卖家提交证据后延期
+export const CLAIM_VERIFIERS_NEEDED = 3; // 共识阈值
+export const CLAIM_VERIFIER_MIN_REP = 200; // reputation_scores.total_points 门槛
+export const CLAIM_VERIFIER_MAX_ACTIVE = 5; // 同时进行中任务上限
+const CLAIM_VALID_TARGETS = new Set(['price', 'commission', 'protection', 'return', 'warranty', 'handling', 'other']);
+export const CLAIM_TARGET_LABEL_ZH = {
+    price: '价格优势', commission: '分享佣金', protection: '协议保障',
+    return: '退货条款', warranty: '质保条款', handling: '发货时效', other: '其他理由',
+};
+const CLAIM_VALID_VOTES = new Set(['pass', 'fail', 'no_fault', 'abstain']);
+// V3：abstain 不计入 3-vote 共识、不参与 majority、不触发 outlier
+const CLAIM_SELLER_FINE_RATE = 0.10; // pass 时扣 product.stake_amount × 10%
+const CLAIM_NO_FAULT_SUBSIDY = 1; // no_fault 路径协议池补贴每个 verifier 1 WAZ
+// 跨域共用（server.ts checkVerifierOutlier 跨 6 套 vote table 聚合也用同一阈值）
+export const CLAIM_SUSPEND_THRESHOLD = 3; // 180d 内 ≥3 次 outlier → 30d 冻结
+export const CLAIM_REVOKE_THRESHOLD = 5; // 180d 内 ≥5 次 outlier → 永封
+export const CLAIM_SUSPEND_DAYS = 30;
+export const CLAIM_OUTLIER_WINDOW_DAYS = 180;
+// ─── helpers (module-level, db 通过参数传) ───────────────────
+// 2026-05-22 V2：通知所有资格内 verifier 有新 claim 任务
+export function notifyEligibleVerifiers(db, generateId, args) {
+    const { taskId: _taskId, productTitle, claimTargetLabel, buyerId, sellerId, notificationType } = args;
+    // ① whitelist 用户（含内部审核员）  ② reputation_scores >= CLAIM_VERIFIER_MIN_REP
+    const rows = db.prepare(`
+    SELECT DISTINCT u.id
+    FROM users u
+    WHERE u.id IN (
+      SELECT user_id FROM verifier_whitelist
+      UNION
+      SELECT user_id FROM reputation_scores WHERE total_points >= ?
+    )
+    AND u.id NOT IN (?, ?)
+    AND COALESCE(u.notify_claim_tasks, 1) = 1
+    AND NOT EXISTS (
+      SELECT 1 FROM claim_verifier_suspensions s
+      WHERE s.user_id = u.id
+        AND (s.type = 'revoked' OR (s.until_at IS NOT NULL AND s.until_at > datetime('now')))
+    )
+  `).all(CLAIM_VERIFIER_MIN_REP, buyerId, sellerId);
+    if (rows.length === 0)
+        return 0;
+    const title = notificationType === 'claim_new'
+        ? `🔎 新验证任务：${claimTargetLabel}`
+        : `📎 验证任务有新证据：${claimTargetLabel}`;
+    const body = notificationType === 'claim_new'
+        ? `「${productTitle}」 — 去 #claims 广场查看并投票`
+        : `「${productTitle}」卖家提交了新证据，截止延期 24h`;
+    const ins = db.prepare(`INSERT INTO notifications (id, user_id, type, title, body, order_id) VALUES (?,?,?,?,?,?)`);
+    db.transaction(() => {
+        for (const r of rows) {
+            try {
+                ins.run(generateId('ntf'), r.id, notificationType, title, body, null);
+            }
+            catch { }
+        }
+    })();
+    return rows.length;
+}
+export function isEligibleClaimVerifier(db, userId) {
+    // ── M7.3b：先看是否被禁言 / 永封 ──
+    const sus = db.prepare(`SELECT type, until_at FROM claim_verifier_suspensions
+    WHERE user_id = ? AND (type = 'revoked' OR until_at > datetime('now'))
+    ORDER BY created_at DESC LIMIT 1`).get(userId);
+    if (sus) {
+        if (sus.type === 'revoked')
+            return { ok: false, reason: '该账号已永久撤销 verifier 资格（累计 5 次 outlier）' };
+        return { ok: false, reason: `账号 verifier 资格被冻结至 ${sus.until_at}（累计 3 次 outlier）` };
+    }
+    // ① verifier_whitelist 一票通过
+    const wl = db.prepare('SELECT user_id FROM verifier_whitelist WHERE user_id = ?').get(userId);
+    if (wl)
+        return { ok: true, via: 'whitelist' };
+    // ② 信誉门槛
+    const rep = db.prepare('SELECT total_points FROM reputation_scores WHERE user_id = ?').get(userId);
+    if (rep && (rep.total_points ?? 0) >= CLAIM_VERIFIER_MIN_REP)
+        return { ok: true, via: 'reputation' };
+    return { ok: false, reason: `需要 verifier_whitelist 或 信誉积分 ≥ ${CLAIM_VERIFIER_MIN_REP}（当前 ${rep?.total_points ?? 0}）` };
+}
+export function activeClaimTaskCountForVerifier(db, userId) {
+    const r = db.prepare(`
+    SELECT COUNT(DISTINCT cvv.task_id) as n
+    FROM claim_verification_votes cvv
+    JOIN claim_verification_tasks cvt ON cvt.id = cvv.task_id
+    WHERE cvv.verifier_id = ? AND cvt.status = 'open'
+  `).get(userId);
+    return r.n;
+}
+// M7.3b：单个 outlier 处罚检查
+function checkAndApplyOutlierStrike(db, generateId, userId) {
+    const cnt = db.prepare(`
+    SELECT COUNT(*) as n FROM claim_verification_votes cvv
+    JOIN claim_verification_tasks cvt ON cvt.id = cvv.task_id
+    WHERE cvv.verifier_id = ?
+      AND cvv.was_majority = 0
+      AND cvt.resolved_at IS NOT NULL
+      AND cvt.resolved_at >= datetime('now', '-${CLAIM_OUTLIER_WINDOW_DAYS} days')
+  `).get(userId).n;
+    const existing = db.prepare(`SELECT type, outlier_count FROM claim_verifier_suspensions
+    WHERE user_id = ? AND (type = 'revoked' OR until_at > datetime('now'))
+    ORDER BY created_at DESC LIMIT 1`).get(userId);
+    if (existing?.type === 'revoked')
+        return { strikes_180d: cnt };
+    if (cnt >= CLAIM_REVOKE_THRESHOLD && (!existing || existing.outlier_count < CLAIM_REVOKE_THRESHOLD)) {
+        db.prepare(`INSERT INTO claim_verifier_suspensions (id, user_id, type, reason, outlier_count)
+      VALUES (?,?, 'revoked', ?, ?)`).run(generateId('cvs'), userId, `180d 内累计 ${cnt} 次 outlier`, cnt);
+        return { strikes_180d: cnt, suspension: { type: 'revoked', until_at: null } };
+    }
+    if (cnt >= CLAIM_SUSPEND_THRESHOLD && !existing) {
+        const until = new Date(Date.now() + CLAIM_SUSPEND_DAYS * 86400_000).toISOString();
+        db.prepare(`INSERT INTO claim_verifier_suspensions (id, user_id, type, until_at, reason, outlier_count)
+      VALUES (?,?, 'suspended', ?, ?, ?)`).run(generateId('cvs'), userId, until, `180d 内累计 ${cnt} 次 outlier`, cnt);
+        return { strikes_180d: cnt, suspension: { type: 'suspended', until_at: until } };
+    }
+    return { strikes_180d: cnt };
+}
+// 给一组 user_id 平均分发金额
+function distributePool(db, userIds, total) {
+    if (userIds.length === 0 || total <= 0)
+        return;
+    const each = Math.floor((total / userIds.length) * 100) / 100;
+    let used = 0;
+    for (let i = 0; i < userIds.length; i++) {
+        const amt = i === userIds.length - 1 ? Math.round((total - used) * 100) / 100 : each;
+        used += amt;
+        db.prepare('UPDATE wallets SET balance = balance + ? WHERE user_id = ?').run(amt, userIds[i]);
+    }
+}
+// M7.3b 核心：三路径结算
+export function settleClaimTask(db, generateId, taskId) {
+    const task = db.prepare('SELECT * FROM claim_verification_tasks WHERE id = ?').get(taskId);
+    if (!task)
+        return { ok: false, reason: 'task not found' };
+    if (String(task.status).startsWith('resolved_') || String(task.status).startsWith('timeout_')) {
+        return { ok: false, reason: '已结算' };
+    }
+    const allVotes = db.prepare('SELECT id, verifier_id, vote FROM claim_verification_votes WHERE task_id = ?').all(taskId);
+    const votes = allVotes.filter(v => v.vote !== 'abstain');
+    const counts = { pass: 0, fail: 0, no_fault: 0 };
+    for (const v of votes)
+        counts[v.vote] = (counts[v.vote] || 0) + 1;
+    let majority = 'no_fault';
+    let path = 'no_fault';
+    if (votes.length === 0) {
+        path = 'timeout_no_fault';
+        majority = 'no_fault';
+    }
+    else {
+        const maxN = Math.max(counts.pass, counts.fail, counts.no_fault);
+        const winners = ['pass', 'fail', 'no_fault'].filter(k => counts[k] === maxN);
+        if (winners.length > 1)
+            majority = 'no_fault';
+        else
+            majority = winners[0];
+        path = majority === 'pass' ? 'pass' : majority === 'fail' ? 'fail' : 'no_fault';
+    }
+    const buyerId = task.buyer_id;
+    const sellerId = task.seller_id;
+    const productId = task.product_id;
+    const stake = Number(task.stake_buyer);
+    const payouts = { path, majority, stake_buyer: stake };
+    db.prepare('UPDATE wallets SET escrowed = escrowed - ? WHERE user_id = ?').run(stake, buyerId);
+    const majorityVoters = majority === 'no_fault'
+        ? votes.map(v => v.verifier_id)
+        : votes.filter(v => v.vote === majority).map(v => v.verifier_id);
+    if (path === 'pass') {
+        const refund = Math.round(stake * 0.5 * 100) / 100;
+        db.prepare('UPDATE wallets SET balance = balance + ? WHERE user_id = ?').run(refund, buyerId);
+        const voterPool = Math.round(stake * 0.5 * 100) / 100;
+        payouts.buyer_refund = refund;
+        payouts.voter_reward_from_buyer = voterPool;
+        distributePool(db, majorityVoters, voterPool);
+        const prod = db.prepare('SELECT stake_amount, stake_locked_at FROM products WHERE id = ?').get(productId);
+        if (prod && prod.stake_amount > 0) {
+            const fine = Math.round(prod.stake_amount * CLAIM_SELLER_FINE_RATE * 100) / 100;
+            const sellerWallet = db.prepare('SELECT balance, staked FROM wallets WHERE user_id = ?').get(sellerId);
+            if (prod.stake_locked_at) {
+                const fromStaked = Math.min(fine, sellerWallet.staked || 0);
+                db.prepare('UPDATE wallets SET staked = staked - ? WHERE user_id = ?').run(fromStaked, sellerId);
+                const remain = fine - fromStaked;
+                if (remain > 0) {
+                    db.prepare('UPDATE wallets SET balance = balance - ? WHERE user_id = ?').run(remain, sellerId);
+                }
+            }
+            else {
+                const fromBalance = Math.min(fine, sellerWallet.balance || 0);
+                db.prepare('UPDATE wallets SET balance = balance - ? WHERE user_id = ?').run(fromBalance, sellerId);
+                db.prepare("UPDATE products SET stake_locked_at = datetime('now') WHERE id = ?").run(productId);
+            }
+            const halfFine = Math.round(fine * 0.5 * 100) / 100;
+            distributePool(db, majorityVoters, halfFine);
+            db.prepare("UPDATE wallets SET balance = balance + ? WHERE user_id = 'sys_protocol'").run(fine - halfFine);
+            payouts.seller_fine = fine;
+            payouts.voter_reward_from_seller_fine = halfFine;
+            payouts.protocol_share = fine - halfFine;
+        }
+        db.prepare(`UPDATE claim_verification_tasks SET status = 'resolved_pass', majority_vote = ?, resolved_at = datetime('now') WHERE id = ?`).run(majority, taskId);
+    }
+    else if (path === 'fail') {
+        const voterPool = Math.round(stake * 0.5 * 100) / 100;
+        distributePool(db, majorityVoters, voterPool);
+        db.prepare("UPDATE wallets SET balance = balance + ? WHERE user_id = 'sys_protocol'").run(stake - voterPool);
+        payouts.buyer_refund = 0;
+        payouts.voter_reward = voterPool;
+        payouts.protocol_share = stake - voterPool;
+        db.prepare(`UPDATE claim_verification_tasks SET status = 'resolved_fail', majority_vote = ?, resolved_at = datetime('now') WHERE id = ?`).run(majority, taskId);
+    }
+    else {
+        db.prepare('UPDATE wallets SET balance = balance + ? WHERE user_id = ?').run(stake, buyerId);
+        const allVoters = votes.map(v => v.verifier_id);
+        const idealSubsidy = CLAIM_NO_FAULT_SUBSIDY * allVoters.length;
+        const sp = db.prepare("SELECT balance FROM wallets WHERE user_id = 'sys_protocol'").get();
+        const available = Math.max(0, sp?.balance ?? 0);
+        const subsidy = Math.min(idealSubsidy, available);
+        if (subsidy > 0) {
+            db.prepare("UPDATE wallets SET balance = balance - ? WHERE user_id = 'sys_protocol'").run(subsidy);
+            distributePool(db, allVoters, subsidy);
+        }
+        payouts.buyer_refund = stake;
+        payouts.voter_subsidy = subsidy;
+        if (subsidy < idealSubsidy)
+            payouts.voter_subsidy_shortfall = idealSubsidy - subsidy;
+        const finalStatus = votes.length === 0 ? 'timeout_no_fault' : 'resolved_no_fault';
+        db.prepare(`UPDATE claim_verification_tasks SET status = ?, majority_vote = ?, resolved_at = datetime('now') WHERE id = ?`).run(finalStatus, majority, taskId);
+    }
+    // 标记每张票是否属于 majority 派
+    for (const v of allVotes) {
+        if (v.vote === 'abstain') {
+            db.prepare('UPDATE claim_verification_votes SET was_majority = NULL WHERE id = ?').run(v.id);
+        }
+        else {
+            const wasMaj = v.vote === majority ? 1 : 0;
+            db.prepare('UPDATE claim_verification_votes SET was_majority = ? WHERE id = ?').run(wasMaj, v.id);
+        }
+    }
+    // outlier 处罚
+    const strikes = {};
+    if (votes.length >= 2) {
+        for (const v of votes) {
+            if (v.vote !== majority) {
+                const r = checkAndApplyOutlierStrike(db, generateId, v.verifier_id);
+                strikes[v.verifier_id] = r;
+            }
+        }
+    }
+    payouts.outlier_strikes = strikes;
+    db.prepare('UPDATE orders SET has_pending_claim = 0 WHERE id = ?').run(task.order_id);
+    return { ok: true, path, majority, payouts };
+}
+// 扫描需要结算的任务（5min enforcement cron 调用）
+export function processClaimTaskQueue(db, generateId) {
+    const details = [];
+    let sealed = 0, timeout = 0;
+    try {
+        const sealedTasks = db.prepare(`SELECT id FROM claim_verification_tasks WHERE status = 'sealed'`).all();
+        for (const t of sealedTasks) {
+            const r = settleClaimTask(db, generateId, t.id);
+            if (r.ok) {
+                sealed++;
+                details.push({ task_id: t.id, ...r });
+            }
+        }
+        const timedOut = db.prepare(`SELECT id FROM claim_verification_tasks WHERE status = 'open' AND deadline_at < datetime('now')`).all();
+        for (const t of timedOut) {
+            const r = settleClaimTask(db, generateId, t.id);
+            if (r.ok) {
+                timeout++;
+                details.push({ task_id: t.id, ...r });
+            }
+        }
+    }
+    catch (e) {
+        console.error('[M7.3b processClaimTaskQueue]', e.message);
+    }
+    return { sealed, timeout, details };
+}
+export function registerClaimVerifyRoutes(app, deps) {
+    const { db, auth, generateId, requireHumanPresence } = deps;
+    // 买家发起 claim 验证任务（绑定 paid 及之后的订单）
+    app.post('/api/orders/:id/claim-verification', (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        const order = db.prepare('SELECT * FROM orders WHERE id = ?').get(req.params.id);
+        if (!order)
+            return void res.status(404).json({ error: '订单不存在' });
+        if (order.buyer_id !== user.id)
+            return void res.status(403).json({ error: '仅订单买家可发起验证' });
+        const blockedStatuses = new Set(['created', 'cancelled', 'completed', 'refunded']);
+        if (blockedStatuses.has(order.status)) {
+            return void res.status(400).json({ error: `当前订单状态（${order.status}）不可发起验证` });
+        }
+        const existing = db.prepare('SELECT id FROM claim_verification_tasks WHERE order_id = ?').get(req.params.id);
+        if (existing)
+            return void res.status(409).json({ error: '该订单已存在验证任务（不可撤销）', task_id: existing.id });
+        const claim_target = String(req.body?.claim_target || '').trim();
+        if (!CLAIM_VALID_TARGETS.has(claim_target)) {
+            return void res.status(400).json({ error: `claim_target 必须是 ${[...CLAIM_VALID_TARGETS].join(' / ')} 之一` });
+        }
+        const claim_text = String(req.body?.claim_text || '').trim();
+        if (claim_text.length < 6 || claim_text.length > 500) {
+            return void res.status(400).json({ error: 'claim_text 长度需 6-500 字' });
+        }
+        const evidence_uri = req.body?.evidence_uri ? String(req.body.evidence_uri).trim().slice(0, 500) : null;
+        const wallet = db.prepare('SELECT balance FROM wallets WHERE user_id = ?').get(user.id);
+        const stake = CLAIM_STAKE_DEFAULT;
+        if (!wallet || wallet.balance < stake) {
+            return void res.status(400).json({ error: `余额不足：发起需锁 ${stake} WAZ，当前余额 ${wallet?.balance ?? 0} WAZ` });
+        }
+        const id = generateId('cvt');
+        const deadline = new Date(Date.now() + CLAIM_DEADLINE_HOURS * 3600_000).toISOString();
+        const sellerId = order.seller_id;
+        db.prepare(`INSERT INTO claim_verification_tasks
+      (id, order_id, buyer_id, seller_id, product_id, claim_target, claim_text, evidence_uri, stake_buyer, deadline_at, status)
+      VALUES (?,?,?,?,?,?,?,?,?,?, 'open')`).run(id, req.params.id, user.id, sellerId, order.product_id, claim_target, claim_text, evidence_uri, stake, deadline);
+        db.prepare('UPDATE wallets SET balance = balance - ?, escrowed = escrowed + ? WHERE user_id = ?')
+            .run(stake, stake, user.id);
+        db.prepare('UPDATE orders SET has_pending_claim = 1 WHERE id = ?').run(req.params.id);
+        const productTitle = db.prepare('SELECT title FROM products WHERE id = ?').get(order.product_id)?.title || '—';
+        const claimLabel = CLAIM_TARGET_LABEL_ZH[claim_target] || claim_target;
+        try {
+            db.prepare(`INSERT INTO notifications (id, user_id, type, title, body, order_id) VALUES (?,?,?,?,?,?)`)
+                .run(generateId('ntf'), sellerId, 'claim_new', `⚠️ 买家发起验证：${claimLabel}`, `订单「${productTitle}」 — 48h 内提交证据可延期至 verifier 共识结案`, req.params.id);
+        }
+        catch (e) {
+            console.error('[V2 notify seller]', e.message);
+        }
+        try {
+            const notified = notifyEligibleVerifiers(db, generateId, {
+                taskId: id, productTitle, claimTargetLabel: claimLabel,
+                buyerId: user.id, sellerId,
+                notificationType: 'claim_new',
+            });
+            console.log(`[V2] claim_new ${id} notified ${notified} verifiers`);
+        }
+        catch (e) {
+            console.error('[V2 notify verifiers]', e.message);
+        }
+        res.json({ success: true, task_id: id, deadline_at: deadline, stake_locked: stake });
+    });
+    // 通过 order_id 查关联 task
+    app.get('/api/orders/:id/claim-task', (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        const task = db.prepare('SELECT * FROM claim_verification_tasks WHERE order_id = ?')
+            .get(req.params.id);
+        if (!task)
+            return void res.json({ task: null });
+        const hasVoted = db.prepare('SELECT id FROM claim_verification_votes WHERE task_id = ? AND verifier_id = ?')
+            .get(task.id, user.id);
+        const isParty = task.buyer_id === user.id || task.seller_id === user.id;
+        const elig = isEligibleClaimVerifier(db, user.id);
+        if (!isParty && !hasVoted && !elig.ok)
+            return void res.json({ task: null, visibility: 'restricted' });
+        const votes = db.prepare(`SELECT verifier_id, vote, voted_at FROM claim_verification_votes WHERE task_id = ? ORDER BY voted_at ASC`).all(task.id);
+        res.json({ task, votes, votes_needed: CLAIM_VERIFIERS_NEEDED });
+    });
+    // 列出可接的 open 任务
+    app.get('/api/claim-tasks/available', (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        const elig = isEligibleClaimVerifier(db, user.id);
+        if (!elig.ok)
+            return void res.status(403).json({ error: elig.reason, eligible: false });
+        const active = activeClaimTaskCountForVerifier(db, user.id);
+        if (active >= CLAIM_VERIFIER_MAX_ACTIVE) {
+            return void res.status(429).json({ error: `已有 ${active} 个进行中任务（上限 ${CLAIM_VERIFIER_MAX_ACTIVE}），请先完成`, active });
+        }
+        const rows = db.prepare(`
+      SELECT cvt.id, cvt.order_id, cvt.product_id, cvt.claim_target, cvt.claim_text,
+             cvt.evidence_uri, cvt.seller_evidence_uri, cvt.deadline_at, cvt.created_at,
+             (SELECT COUNT(*) FROM claim_verification_votes WHERE task_id = cvt.id AND vote != 'abstain') as votes_count,
+             p.title as product_title
+      FROM claim_verification_tasks cvt
+      LEFT JOIN products p ON p.id = cvt.product_id
+      WHERE cvt.status = 'open'
+        AND cvt.buyer_id != ? AND cvt.seller_id != ?
+        AND NOT EXISTS (SELECT 1 FROM claim_verification_votes WHERE task_id = cvt.id AND verifier_id = ?)
+        AND (SELECT COUNT(*) FROM claim_verification_votes WHERE task_id = cvt.id AND vote != 'abstain') < ?
+      ORDER BY cvt.created_at ASC
+      LIMIT 50
+    `).all(user.id, user.id, user.id, CLAIM_VERIFIERS_NEEDED);
+        res.json({ eligible: true, via: elig.via, active, max_active: CLAIM_VERIFIER_MAX_ACTIVE, tasks: rows });
+    });
+    // verifier 投票 — 铁律 §4
+    app.post('/api/claim-tasks/:id/vote', (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        const elig = isEligibleClaimVerifier(db, user.id);
+        if (!elig.ok)
+            return void res.status(403).json({ error: elig.reason });
+        // 2026-05-23 Agent 治理铁律：投票需真实人工
+        const hpCheck = requireHumanPresence(user.id, 'vote', req.body?.webauthn_token, 'require_human_presence_for_vote', (data) => {
+            const d = data;
+            return d == null || d.task_id === req.params.id;
+        });
+        if (!hpCheck.ok)
+            return void res.status(412).json({ error: hpCheck.reason, error_code: hpCheck.error_code });
+        const task = db.prepare('SELECT * FROM claim_verification_tasks WHERE id = ?').get(req.params.id);
+        if (!task)
+            return void res.status(404).json({ error: '任务不存在' });
+        if (task.status !== 'open')
+            return void res.status(400).json({ error: `任务状态为 ${task.status}，不接受投票` });
+        if (task.buyer_id === user.id)
+            return void res.status(403).json({ error: '买家不可对自己的发起任务投票' });
+        if (task.seller_id === user.id)
+            return void res.status(403).json({ error: '卖家不可对自己的商品投票' });
+        const vote = String(req.body?.vote || '').trim();
+        if (!CLAIM_VALID_VOTES.has(vote)) {
+            return void res.status(400).json({ error: `vote 必须是 ${[...CLAIM_VALID_VOTES].join(' / ')}` });
+        }
+        const evidence_uri = req.body?.evidence_uri ? String(req.body.evidence_uri).trim().slice(0, 500) : null;
+        const note = req.body?.note ? String(req.body.note).trim().slice(0, 500) : null;
+        const dup = db.prepare('SELECT id FROM claim_verification_votes WHERE task_id = ? AND verifier_id = ?')
+            .get(req.params.id, user.id);
+        if (dup)
+            return void res.status(409).json({ error: '已投过票' });
+        const votesNow = db.prepare(`SELECT COUNT(*) as n FROM claim_verification_votes WHERE task_id = ? AND vote != 'abstain'`)
+            .get(req.params.id).n;
+        if (votesNow >= CLAIM_VERIFIERS_NEEDED)
+            return void res.status(409).json({ error: '已收齐共识票数，等待结算' });
+        const active = activeClaimTaskCountForVerifier(db, user.id);
+        if (active >= CLAIM_VERIFIER_MAX_ACTIVE) {
+            return void res.status(429).json({ error: `已有 ${active} 个进行中任务（上限 ${CLAIM_VERIFIER_MAX_ACTIVE}）` });
+        }
+        const id = generateId('cvv');
+        try {
+            db.prepare(`INSERT INTO claim_verification_votes (id, task_id, verifier_id, vote, evidence_uri, note) VALUES (?,?,?,?,?,?)`)
+                .run(id, req.params.id, user.id, vote, evidence_uri, note);
+        }
+        catch {
+            return void res.status(409).json({ error: '投票失败（可能并发重复）' });
+        }
+        // 收齐 3 共识票 → 标记 sealed 并立即结算
+        const after = db.prepare(`SELECT COUNT(*) as n FROM claim_verification_votes WHERE task_id = ? AND vote != 'abstain'`)
+            .get(req.params.id).n;
+        let settlement = null;
+        if (after >= CLAIM_VERIFIERS_NEEDED) {
+            db.prepare(`UPDATE claim_verification_tasks SET status = 'sealed' WHERE id = ? AND status = 'open'`)
+                .run(req.params.id);
+            settlement = settleClaimTask(db, generateId, req.params.id);
+        }
+        res.json({
+            success: true, vote_id: id, votes_collected: after,
+            sealed: after >= CLAIM_VERIFIERS_NEEDED,
+            settlement: settlement?.ok ? { path: settlement.path, majority: settlement.majority, payouts: settlement.payouts } : undefined,
+        });
+    });
+    // 我相关的任务（必须在 /:id 之前注册，否则被 /:id 截获）
+    app.get('/api/claim-tasks/mine', (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        const asBuyer = db.prepare(`SELECT id, order_id, product_id, claim_target, status, deadline_at, created_at
+      FROM claim_verification_tasks WHERE buyer_id = ? ORDER BY created_at DESC LIMIT 50`).all(user.id);
+        const asSeller = db.prepare(`SELECT id, order_id, product_id, claim_target, status, deadline_at, created_at
+      FROM claim_verification_tasks WHERE seller_id = ? ORDER BY created_at DESC LIMIT 50`).all(user.id);
+        const asVerifier = db.prepare(`
+      SELECT cvt.id, cvt.order_id, cvt.product_id, cvt.claim_target, cvt.status, cvt.deadline_at, cvt.created_at,
+             cvv.vote, cvv.voted_at
+      FROM claim_verification_votes cvv
+      JOIN claim_verification_tasks cvt ON cvt.id = cvv.task_id
+      WHERE cvv.verifier_id = ?
+      ORDER BY cvv.voted_at DESC
+      LIMIT 50`).all(user.id);
+        res.json({ as_buyer: asBuyer, as_seller: asSeller, as_verifier: asVerifier });
+    });
+    // 通知偏好
+    app.post('/api/me/notify-claim-tasks', (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        const enabled = req.body?.enabled === false ? 0 : 1;
+        db.prepare('UPDATE users SET notify_claim_tasks = ? WHERE id = ?').run(enabled, user.id);
+        res.json({ success: true, notify_claim_tasks: enabled });
+    });
+    app.get('/api/me/notify-claim-tasks', (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        const row = db.prepare('SELECT COALESCE(notify_claim_tasks, 1) as enabled FROM users WHERE id = ?').get(user.id);
+        res.json({ notify_claim_tasks: row?.enabled ?? 1 });
+    });
+    // 公开 #claims 广场（无 auth — 透明性是验证声明信任的前提）
+    app.get('/api/claims/public', (req, res) => {
+        const status = String(req.query.status || 'open');
+        const limit = Math.min(50, Math.max(1, Number(req.query.limit) || 30));
+        let where;
+        let orderBy;
+        if (status === 'open') {
+            where = `cvt.status = 'open'`;
+            orderBy = `cvt.deadline_at ASC`;
+        }
+        else if (status === 'sealed') {
+            where = `cvt.status = 'sealed'`;
+            orderBy = `cvt.created_at DESC`;
+        }
+        else if (status === 'resolved') {
+            where = `cvt.status LIKE 'resolved_%' OR cvt.status LIKE 'timeout_%'`;
+            orderBy = `cvt.resolved_at DESC`;
+        }
+        else {
+            where = `1=1`;
+            orderBy = `cvt.created_at DESC`;
+        }
+        const rows = db.prepare(`
+      SELECT cvt.id, cvt.order_id, cvt.product_id, cvt.claim_target,
+             SUBSTR(cvt.claim_text, 1, 140) as claim_excerpt,
+             cvt.evidence_uri IS NOT NULL as has_buyer_evidence,
+             cvt.seller_evidence_uri IS NOT NULL as has_seller_evidence,
+             cvt.deadline_at, cvt.created_at, cvt.resolved_at,
+             cvt.status, cvt.majority_vote,
+             (SELECT COUNT(*) FROM claim_verification_votes WHERE task_id = cvt.id AND vote != 'abstain') as votes_count,
+             p.title as product_title, p.images as product_images, p.price as product_price
+      FROM claim_verification_tasks cvt
+      LEFT JOIN products p ON p.id = cvt.product_id
+      WHERE ${where}
+      ORDER BY ${orderBy}
+      LIMIT ?
+    `).all(limit);
+        const items = rows.map(r => {
+            let firstImage = null;
+            try {
+                const arr = JSON.parse(r.product_images || '[]');
+                if (Array.isArray(arr) && arr.length > 0)
+                    firstImage = String(arr[0]);
+            }
+            catch { }
+            return {
+                id: r.id,
+                product_id: r.product_id,
+                product_title: r.product_title,
+                product_image: firstImage,
+                product_price: r.product_price,
+                claim_target: r.claim_target,
+                claim_excerpt: r.claim_excerpt,
+                has_buyer_evidence: !!r.has_buyer_evidence,
+                has_seller_evidence: !!r.has_seller_evidence,
+                votes_count: r.votes_count,
+                votes_needed: CLAIM_VERIFIERS_NEEDED,
+                status: r.status,
+                majority_vote: r.majority_vote,
+                deadline_at: r.deadline_at,
+                created_at: r.created_at,
+                resolved_at: r.resolved_at,
+            };
+        });
+        res.json({ items, votes_needed: CLAIM_VERIFIERS_NEEDED });
+    });
+    // 任务详情
+    app.get('/api/claim-tasks/:id', (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        const task = db.prepare('SELECT * FROM claim_verification_tasks WHERE id = ?')
+            .get(req.params.id);
+        if (!task)
+            return void res.status(404).json({ error: '任务不存在' });
+        const hasVoted = db.prepare('SELECT id FROM claim_verification_votes WHERE task_id = ? AND verifier_id = ?')
+            .get(req.params.id, user.id);
+        const isParty = task.buyer_id === user.id || task.seller_id === user.id;
+        const elig = isEligibleClaimVerifier(db, user.id);
+        const canRead = isParty || !!hasVoted || elig.ok;
+        if (!canRead) {
+            return void res.status(403).json({ error: '仅当事人或已投票 / 资格内 verifier 可见任务详情' });
+        }
+        const votes = db.prepare(`SELECT id, verifier_id, vote, evidence_uri, note, voted_at
+      FROM claim_verification_votes WHERE task_id = ? ORDER BY voted_at ASC`).all(req.params.id);
+        res.json({ task, votes, votes_needed: CLAIM_VERIFIERS_NEEDED });
+    });
+    // 卖家提交证据 → 延期 24h；状态保持 open
+    app.post('/api/claim-tasks/:id/seller-evidence', (req, res) => {
+        const user = auth(req, res);
+        if (!user)
+            return;
+        const task = db.prepare('SELECT * FROM claim_verification_tasks WHERE id = ?')
+            .get(req.params.id);
+        if (!task)
+            return void res.status(404).json({ error: '任务不存在' });
+        if (task.seller_id !== user.id)
+            return void res.status(403).json({ error: '仅订单卖家可提交证据' });
+        if (task.status !== 'open')
+            return void res.status(400).json({ error: '任务非 open 状态，不接受证据' });
+        if (task.seller_evidence_at)
+            return void res.status(409).json({ error: '已提交过证据' });
+        const evidence_uri = String(req.body?.evidence_uri || '').trim();
+        if (!evidence_uri || evidence_uri.length < 4 || evidence_uri.length > 500) {
+            return void res.status(400).json({ error: 'evidence_uri 长度需 4-500' });
+        }
+        const oldDeadline = new Date(String(task.deadline_at)).getTime();
+        const newCandidate = Date.now() + CLAIM_SELLER_EXTENSION_HOURS * 3600_000;
+        const newDeadline = new Date(Math.max(oldDeadline, newCandidate)).toISOString();
+        db.prepare(`UPDATE claim_verification_tasks
+      SET seller_evidence_uri = ?, seller_evidence_at = datetime('now'), deadline_at = ?
+      WHERE id = ?`).run(evidence_uri, newDeadline, req.params.id);
+        try {
+            const productTitle = db.prepare('SELECT title FROM products WHERE id = ?').get(task.product_id)?.title || '—';
+            const claimLabel = CLAIM_TARGET_LABEL_ZH[String(task.claim_target)] || String(task.claim_target);
+            notifyEligibleVerifiers(db, generateId, {
+                taskId: String(task.id), productTitle, claimTargetLabel: claimLabel,
+                buyerId: task.buyer_id, sellerId: task.seller_id,
+                notificationType: 'claim_evidence_added',
+            });
+        }
+        catch (e) {
+            console.error('[V2 seller evidence notify]', e.message);
+        }
+        res.json({ success: true, deadline_at: newDeadline, warning: '虚假证据将在结算时扣除 20% stake（M7.3b）' });
+    });
+}