trustbase-seller-backend 0.1.5

package/oracle/c5-glue.js

@@ -0,0 +1,603 @@
+"use strict";
+/**
+ * c5-glue.js — oracle 侧胶水: C2 引导金发放 + E6 积分结算 (v3.9.3 联调批)
+ *
+ * 跑在服务端 oracle 进程内 (oracle-sync.js 挂载), authority/oracle 私钥绝不进商家机。
+ * 签名复用 routes/chain-writes.js 的 signAndBroadcast (SIGN_MODE 语义不变:
+ * .123 上默认走 trustchaind CLI keyring, 配了 ORACLE_MNEMONIC 则 JS 直签)。
+ *
+ * C2 引导金 (实名通过 → 发 100 TCT):
+ *   步骤1 MsgSubmitVerification 的 signer=owner (商户本人, keeper 无代提交通道) —
+ *   由商家后端 JS 直签提交 (routes/onboard.js /onboard/submit-verification);
+ *   oracle 侧只负责 步骤2 MsgApproveVerification (emergencyAuthority) +
+ *   步骤3 MsgDisburseBootstrap (authority, credential_hash 幂等一商户一次)。
+ *   触发: admin POST /api/oracle/bootstrap-grant {recipient, credential_hash?}
+ *   (全仓库暂无微信审核状态轮询 — 摸底结论, 信号源接入后改为自动入队)。
+ *
+ * E6 积分 (支付事实 CONFIRMED → 单笔 + 里程碑):
+ *   tick 轮询链上 serviceprovider facts (status=CONFIRMED) →
+ *   MsgGrantCredits{issuer=oracle, recipient, amount=链上 params 读取, reason_kind, ref_id}
+ *   幂等: 链上 reason_kind+ref_id + 本地台账 PRIMARY KEY 双层。
+ *   买家/卖家地址: order_ref → 本地 agent_pay_sessions.chain_order_id → 链上 x/order 订单;
+ *   查不到买家 → 只跳过买家奖励并记录原因, 不编造地址。
+ *   额度守护: params.monthly_quota vs 本地台账本月已发, 超限跳过并告警。
+ *
+ * N13 注册 (引导金发放前置, 2026-09-23): trustcoin.Account 未注册的商户上架/下单被链拒
+ *   (冒烟实测 "buyer must register a trustcoin account")。发放前先查链上 trustcoin 账户,
+ *   无则发 MsgRegisterAccount{creator=recipient, seller, CN}。
+ *   ⚠️ 链侧 signer=creator 强制 (proto 注解 + SDK v0.53 ante; 2026-09-23 .123 实测
+ *   "tx intended signer does not match") — oracle 代签必被拒, 只有持钥方本人能注册;
+ *   该错误入 last_error 后停试, 等商家后端自助注册流补位 (链侧放开前 N13 停在 failed)。
+ *
+ * N15 feegrant 代扣 gas (2026-09-23, xiaomu 拍板方案 A): 新商户 0 余额付不了手续费,
+ *   注册/KYC 卡死 (净室验收 oracle 人工垫 2 TCT)。审批通过 (MsgApproveVerification)
+ *   后 oracle 以 emergency-key 给商户发 AllowedMsgAllowance (防薅三道闸):
+ *     1. 触发点=审批后 (身份生成阶段不发);
+ *     2. 白名单四类 msg: 注册 / KYC 提交 / 下单 / 确认收货;
+ *     3. 总额 2 TCT + 周期 60s 内 ≤0.2 TCT (trustchaind tx feegrant grant --help 实测形状)。
+ *   幂等: LCD allowances 查已有 grant 直接跳过; 失败 warn 不阻塞后续注册/发放 (状态机无感)。
+ *   商户侧: chain-signer/chain-writes 走 FEE_GRANTER_ADDR 代付 (无 grant 自动回退自付)。
+ *
+ * N14 settle crank (2026-09-23): CONFIRMED 订单过 dispute_window (链上 order params,
+ *   默认 259200s=3 天) 后需 MsgSettleOrder 才 settled=true, 否则货款/质押/担保永卡在途。
+ *   每 tick 扫描 (无全局订单列表: 本地台账 chain_order_id + 链上 providers 的
+ *   by-seller 订单列表), 到期单发 MsgSettleOrder{caller=oracle} (permissionless,
+ *   签名者=caller 即可); 每 tick 最多 5 单; 已 settled/非 CONFIRMED 的链上返回按完成处理。
+ */
+const crypto = require("crypto");
+const chainWrites = require("../routes/chain-writes");
+
+// 链上模块未上线 (v3.9.3 前) 的特征: CLI 本地解码 / CheckTx / DeliverTx / LCD 404 都覆盖
+const MODULE_NOT_LIVE_RE = /unable to resolve type URL|unknown message type|no concrete type|unrecognized message|cannot unpack|no handler exists|not found|unknown query path/i;
+
+// N13: trustcoin "账户已存在" (重复注册按成功) / "signer=creator 强制" (oracle 代签被拒, 停试)
+const ALREADY_REGISTERED_RE = /account already exists|already registered/i;
+const SIGNER_FORBIDDEN_RE = /intended signer does not match|signature verification failed|invalid signer/i;
+
+// N14: settle 幂等 (已结算/状态已变/订单不存在 → 按完成处理, 不再重试)
+const SETTLE_DONE_RE = /already settled|not in confirmed status|order not found/i;
+
+function sha256Hex(s) {
+    return crypto.createHash("sha256").update(String(s)).digest("hex");
+}
+
+function nowSec() { return Math.floor(Date.now() / 1000); }
+
+/** oracle 签名配置: 复用 chain-writes cfg(), keyName 可被 ORACLE_CHAIN_KEY_NAME 覆盖 */
+function oracleCfg() {
+    const c = chainWrites.cfg();
+    return { ...c, keyName: process.env.ORACLE_CHAIN_KEY_NAME || c.keyName };
+}
+
+/** 默认 LCD GET (返回 null 表示失败/不存在)。注意: 不能是 async 函数, 否则返回的是 Promise */
+function defaultLcdGet(lcdUrl) {
+    return async (p) => {
+        try {
+            const resp = await fetch(lcdUrl + p, { signal: AbortSignal.timeout(10000) });
+            if (!resp.ok) return null;
+            return await resp.json();
+        } catch (_) { return null; }
+    };
+}
+
+/** 默认发链: 签名地址 → LCD 查序号 → signAndBroadcast (sequence mismatch 重查重试一次) */
+function defaultSendTx(c) {
+    return async (messages) => {
+        const addr = await chainWrites.keyAddress(c);
+        let account = await chainWrites.queryAccount(c, addr);
+        try {
+            return await chainWrites.signAndBroadcast(c, messages, account);
+        } catch (e) {
+            if (!(e instanceof chainWrites.SequenceMismatchError)) throw e;
+            console.warn("[oracle-glue] account sequence mismatch, 重查重试一次");
+            account = await chainWrites.queryAccount(c, addr);
+            return await chainWrites.signAndBroadcast(c, messages, account);
+        }
+    };
+}
+
+function ensureTables(db) {
+    db.exec(`
+CREATE TABLE IF NOT EXISTS oracle_bootstrap_grants (
+  credential_hash TEXT PRIMARY KEY,
+  recipient TEXT NOT NULL,
+  verification_id TEXT DEFAULT '',
+  approve_txhash TEXT DEFAULT '',
+  disburse_txhash TEXT DEFAULT '',
+  status TEXT NOT NULL DEFAULT 'pending',
+  -- pending → awaiting_verification → approving → registering → disbursing → done / waiting_module / failed
+  -- (registering/failed: N13 注册步; signer=creator 链侧强制时 oracle 代签停在 failed, 见文件头 N13)
+  last_error TEXT DEFAULT '',
+  created_at INTEGER NOT NULL,
+  updated_at INTEGER NOT NULL
+);
+CREATE TABLE IF NOT EXISTS oracle_credit_grants (
+  reason_kind TEXT NOT NULL,
+  ref_id TEXT NOT NULL,
+  recipient TEXT NOT NULL,
+  amount TEXT NOT NULL,
+  txhash TEXT DEFAULT '',
+  status TEXT NOT NULL DEFAULT 'pending',  -- pending/done/skipped/quota_skipped/failed
+  note TEXT DEFAULT '',
+  created_at INTEGER NOT NULL,
+  updated_at INTEGER NOT NULL,
+  PRIMARY KEY (reason_kind, ref_id)
+);
+`);
+}
+
+/**
+ * 创建胶水实例。deps 可注入 (离线测试): { cfg, lcdGet, sendTx, logger }
+ */
+function createOracleGlue(deps) {
+    const db = deps.db;
+    const cfg = deps.cfg || oracleCfg();
+    const lcdGet = deps.lcdGet || defaultLcdGet(cfg.lcdUrl);
+    const sendTx = deps.sendTx || defaultSendTx(cfg);
+    const log = deps.logger || console.log;
+    const warn = deps.warn || console.warn;
+    ensureTables(db);
+
+    // ============================== C2 引导金 ==============================
+
+    /** 入队 (幂等: credential_hash 已存在 → 返回现状) */
+    function enqueueBootstrapGrant({ recipient, credentialHash }) {
+        const ch = credentialHash || sha256Hex(recipient);
+        const existing = db.prepare("SELECT * FROM oracle_bootstrap_grants WHERE credential_hash = ?").get(ch);
+        if (existing) return { enqueued: false, status: existing.status, credential_hash: ch };
+        db.prepare("INSERT INTO oracle_bootstrap_grants (credential_hash, recipient, status, created_at, updated_at) VALUES (?,?,?,?,?)")
+            .run(ch, recipient, "pending", nowSec(), nowSec());
+        log(`[oracle-glue] bootstrap 入队 recipient=${recipient} credential_hash=${ch.slice(0, 12)}...`);
+        return { enqueued: true, status: "pending", credential_hash: ch };
+    }
+
+    /** 查链上实名记录 (返回 {verification_id, status} 或 null) */
+    async function findVerification(recipient) {
+        const j = await lcdGet(`/oxiaom/trustchain/verification/v1/owner/${recipient}`);
+        const list = j && (j.verifications || j.verification ? [].concat(j.verifications || j.verification) : []);
+        if (!list || list.length === 0) return null;
+        const v = list[0];
+        return { verification_id: String(v.verification_id || v.id || ""), status: String(v.status || "") };
+    }
+
+    /** 查链上 trustcoin.Account (N13; 未注册/LCD 不可达都返回 null, 终审交给链上幂等) */
+    async function findTrustcoinAccount(addr) {
+        const j = await lcdGet(`/oxiaom/trustchain/trustcoin/v1/accounts/${addr}`);
+        return (j && j.account) || null;
+    }
+
+    // N15 feegrant 防薅参数 (xiaomu 2026-09-23 拍板): 总额 2 TCT 封顶 + 60s 内 ≤0.2 TCT
+    const FEEGRANT_SPEND_LIMIT = "2000000";   // utct (2 TCT)
+    const FEEGRANT_PERIOD_SECS = 60;
+    const FEEGRANT_PERIOD_LIMIT = "200000";   // utct (0.2 TCT / 60s)
+    const FEEGRANT_ALLOWED_MSGS = [
+        "/trustchain.trustcoin.v1.MsgRegisterAccount",      // 自助注册
+        "/trustchain.verification.v1.MsgSubmitVerification", // KYC 提交
+        "/trustchain.order.v1.MsgCreateOrder",               // 下单
+        "/trustchain.order.v1.MsgConfirmOrder",              // 确认收货
+    ];
+
+    /** 查 grantee 名下已有 feegrant (N15 幂等用; 无/LCD 不可达返回 null) */
+    async function findFeegrant(grantee) {
+        const j = await lcdGet(`/cosmos/feegrant/v1beta1/allowances/${grantee}`);
+        const list = (j && j.allowances) || [];
+        return list.length > 0 ? list[0] : null;
+    }
+
+    /** N15: 审批通过后发 feegrant (MsgGrantAllowance, granter=oracle 自己签)。
+     *  已有 grant → 跳过; 失败 → warn 返回 false, 不阻塞后续注册/发放 (下轮重试)。 */
+    async function grantFeegrant(recipient, oracleAddr) {
+        try {
+            if (await findFeegrant(recipient)) {
+                log(`[oracle-glue] N15 feegrant 已存在, 跳过 grantee=${recipient}`);
+                return true;
+            }
+            const r = await sendTx([{
+                "@type": "/cosmos.feegrant.v1beta1.MsgGrantAllowance",
+                granter: oracleAddr,
+                grantee: recipient,
+                allowance: {
+                    "@type": "/cosmos.feegrant.v1beta1.AllowedMsgAllowance",
+                    allowance: {
+                        "@type": "/cosmos.feegrant.v1beta1.PeriodicAllowance",
+                        basic: { spend_limit: [{ denom: "utct", amount: FEEGRANT_SPEND_LIMIT }], expiration: null },
+                        period: `${FEEGRANT_PERIOD_SECS}s`,
+                        period_spend_limit: [{ denom: "utct", amount: FEEGRANT_PERIOD_LIMIT }],
+                    },
+                    allowed_messages: FEEGRANT_ALLOWED_MSGS,
+                },
+            }]);
+            if (r.code !== 0) {
+                if (/allowance exists|already exists/i.test(r.raw_log)) {
+                    log(`[oracle-glue] N15 feegrant 已存在 (链上幂等命中) grantee=${recipient}`);
+                    return true;
+                }
+                warn(`[oracle-glue] N15 feegrant 发放失败 grantee=${recipient} code=${r.code}: ${String(r.raw_log).slice(0, 200)} (下轮重试)`);
+                return false;
+            }
+            log(`[oracle-glue] N15 feegrant 已发放 grantee=${recipient} 白名单=${FEEGRANT_ALLOWED_MSGS.length}类 总额=${FEEGRANT_SPEND_LIMIT}utct 周期=${FEEGRANT_PERIOD_SECS}s/${FEEGRANT_PERIOD_LIMIT}utct tx=${r.txhash}`);
+            return true;
+        } catch (e) {
+            warn(`[oracle-glue] N15 feegrant 异常 grantee=${recipient}: ${e.message} (下轮重试)`);
+            return false;
+        }
+    }
+
+    /** 单条 bootstrap grant 推进一步 (每 tick 调用; 失败留状态下次重试) */
+    async function stepBootstrapGrant(row, oracleAddr) {
+        const upd = (fields) => {
+            db.prepare(`UPDATE oracle_bootstrap_grants SET ${Object.keys(fields).map((k) => k + "=?").join(", ")}, updated_at=? WHERE credential_hash=?`)
+                .run(...Object.values(fields), nowSec(), row.credential_hash);
+        };
+
+        // 步骤2 前置: 找链上实名记录
+        if (!row.verification_id) {
+            const v = await findVerification(row.recipient);
+            if (!v) {
+                upd({ status: "awaiting_verification", last_error: "链上暂无该商户的实名提交 (等商家后端 submit-verification)" });
+                return;
+            }
+            upd({ verification_id: v.verification_id });
+            row.verification_id = v.verification_id;
+            row._chainStatus = v.status;
+        }
+
+        // 步骤2: 审批 (已 APPROVED 则跳过)
+        if (!row.approve_txhash) {
+            const v = await findVerification(row.recipient);
+            if (v && /APPROVED/i.test(v.status)) {
+                upd({ approve_txhash: "(already-approved-on-chain)" });
+                row.approve_txhash = "(already-approved-on-chain)";
+            } else {
+                upd({ status: "approving" });
+                const r = await sendTx([{
+                    "@type": "/trustchain.verification.v1.MsgApproveVerification",
+                    approver: oracleAddr,
+                    verification_id: row.verification_id,
+                    expires_at: "0",
+                }]);
+                if (r.code !== 0) {
+                    if (MODULE_NOT_LIVE_RE.test(r.raw_log)) { upd({ status: "waiting_module", last_error: "链上 verification 模块未上线 (等 v3.9.3)" }); return; }
+                    upd({ status: "failed", last_error: `approve code=${r.code}: ${String(r.raw_log).slice(0, 200)}` });
+                    return;
+                }
+                upd({ approve_txhash: r.txhash });
+                row.approve_txhash = r.txhash;
+                log(`[oracle-glue] 实名审批通过 vid=${row.verification_id} tx=${r.txhash}`);
+            }
+        }
+
+        // 步骤2.4 (N15): 审批已过 → 发 feegrant (商户此后注册/KYC 的手续费由 oracle 代付)。
+        // 失败不阻塞: 注册/发放继续, 下轮 tick 对未 done 行重试。
+        if (!row.disburse_txhash) {
+            await grantFeegrant(row.recipient, oracleAddr);
+        }
+
+        // 步骤2.5 (N13): trustcoin 账户注册 — 未注册商户收到引导金也无法上架/下单。
+        // 幂等: 链上已有账户 (LCD) 直接跳过; LCD 不可达也照发, 链上 "already exists" 按成功处理。
+        if (!row.disburse_txhash) {
+            const acc = await findTrustcoinAccount(row.recipient);
+            if (!acc) {
+                // 已知 signer=creator 强制 (上轮已拒): 停在 failed 等持钥方自助注册, 不再重试、不发放
+                if (SIGNER_FORBIDDEN_RE.test(row.last_error || "")) return;
+                upd({ status: "registering" });
+                let r;
+                try {
+                    r = await sendTx([{
+                        "@type": "/trustchain.trustcoin.v1.MsgRegisterAccount",
+                        creator: row.recipient,
+                        role: "seller",
+                        region: "CN",
+                    }]);
+                } catch (e) {
+                    // CLI 通道在本地 sign 步就拒 ("intended signer does not match"), 到不了链上 —
+                    // 链侧 signer=creator 强制, oracle 代签不可行: 停在 failed 不再重试 (文件头 N13)。
+                    const raw = `${e.message} ${e.stderr || ""}`;
+                    if (SIGNER_FORBIDDEN_RE.test(raw)) {
+                        // last_error 内嵌 "intended signer does not match" 标记短语 — 防重试 guard 靠它匹配
+                        upd({ status: "failed", last_error: `register 需 recipient 本人签名 (oracle 代签被链拒: intended signer does not match): ${String(e.message).slice(0, 120)}` });
+                        warn(`[oracle-glue] ⚠️ N13 register 被链拒 recipient=${row.recipient}: 链上要求 creator 本人签名, oracle 代签不可行 — 该单停在 failed, 等商家后端自助注册 (guard 防重试)`);
+                        return;
+                    }
+                    throw e;
+                }
+                if (r.code !== 0) {
+                    if (ALREADY_REGISTERED_RE.test(r.raw_log)) {
+                        log(`[oracle-glue] trustcoin 账户已注册 (按成功处理) recipient=${row.recipient}`);
+                    } else if (MODULE_NOT_LIVE_RE.test(r.raw_log)) {
+                        upd({ status: "waiting_module", last_error: "链上 trustcoin 模块未上线 (等 v3.9.3)" });
+                        return;
+                    } else if (SIGNER_FORBIDDEN_RE.test(r.raw_log)) {
+                        upd({ status: "failed", last_error: `register 需 recipient 本人签名 (oracle 代签被链拒): ${String(r.raw_log).slice(0, 160)}` });
+                        return;
+                    } else {
+                        upd({ status: "failed", last_error: `register code=${r.code}: ${String(r.raw_log).slice(0, 200)}` });
+                        return;
+                    }
+                } else {
+                    log(`[oracle-glue] trustcoin 账户已注册 recipient=${row.recipient}`);
+                }
+            }
+        }
+
+        // 步骤3: 发放引导金 (链上 credential_hash 幂等, duplicate 也算成功)
+        upd({ status: "disbursing" });
+        const r = await sendTx([{
+            "@type": "/trustchain.subchain.v1.MsgDisburseBootstrap",
+            authority: oracleAddr,
+            recipient: row.recipient,
+            credential_hash: row.credential_hash,
+        }]);
+        if (r.code !== 0) {
+            if (MODULE_NOT_LIVE_RE.test(r.raw_log)) { upd({ status: "waiting_module", last_error: "链上 subchain 模块未上线 (等 v3.9.3)" }); return; }
+            upd({ status: "failed", last_error: `disburse code=${r.code}: ${String(r.raw_log).slice(0, 200)}` });
+            return;
+        }
+        upd({ disburse_txhash: r.txhash, status: "done", last_error: "" });
+        log(`[oracle-glue] 引导金已发放 recipient=${row.recipient} tx=${r.txhash}`);
+    }
+
+    // ============================== E6 积分结算 ==============================
+
+    /** 链上 economy params (奖励金额/月度额度, 不读缓存, 每次结算现查) */
+    async function getEconomyParams() {
+        const j = await lcdGet("/oxiaom/trustchain/economy/v1/params");
+        const p = j && j.params;
+        if (!p) return null;
+        const num = (k, def) => {
+            const n = Number(p[k]);
+            return Number.isFinite(n) && n > 0 ? n : def;
+        };
+        return {
+            rewardSellerPerOrder: num("reward_seller_per_order", 20),
+            rewardBuyerPerOrder: num("reward_buyer_per_order", 10),
+            rewardFirstOrder: num("reward_first_order", 500),
+            rewardTenOrders: num("reward_ten_orders", 800),
+            monthlyQuota: num("monthly_quota", 100000),
+        };
+    }
+
+    /** 本月已发额度 (本地台账 done 行求和; 额度守护数据源) */
+    function monthlyUsed() {
+        const monthStart = Math.floor(new Date(new Date().getFullYear(), new Date().getMonth(), 1).getTime() / 1000);
+        const r = db.prepare("SELECT COALESCE(SUM(CAST(amount AS INTEGER)),0) AS used FROM oracle_credit_grants WHERE status='done' AND created_at >= ?").get(monthStart);
+        return Number(r.used) || 0;
+    }
+
+    /** 记一条台账 (幂等: 同 reason_kind+ref_id 已存在 → 返回 false) */
+    function ledgerGrant(reasonKind, refId, recipient, amount, status, note) {
+        const r = db.prepare("INSERT OR IGNORE INTO oracle_credit_grants (reason_kind, ref_id, recipient, amount, status, note, created_at, updated_at) VALUES (?,?,?,?,?,?,?,?)")
+            .run(reasonKind, refId, recipient, String(amount), status, note || "", nowSec(), nowSec());
+        return r.changes > 0;
+    }
+
+    /** order_ref → {seller, buyer} (本地会话表 → 链上订单; 查不到返回 null + 原因) */
+    async function resolveOrderParties(orderRef) {
+        const sess = db.prepare("SELECT chain_order_id FROM agent_pay_sessions WHERE order_ref = ?").get(orderRef);
+        if (!sess || !sess.chain_order_id) {
+            return { seller: null, buyer: null, reason: `order_ref=${orderRef} 无本地会话或链上单号` };
+        }
+        const j = await lcdGet(`/oxiaom/trustchain/order/v1/orders/${sess.chain_order_id}`);
+        const o = j && (j.order || j.Order);
+        if (!o || !o.seller) {
+            return { seller: null, buyer: null, reason: `链上订单 ${sess.chain_order_id} 查询失败` };
+        }
+        return { seller: o.seller, buyer: o.buyer || null, reason: o.buyer ? "" : "链上订单无买家地址 (游客单)" };
+    }
+
+    /** 单笔 CONFIRMED 事实的结算 (幂等, 额度守护) */
+    async function settleFact(fact, params, oracleAddr) {
+        const orderRef = String(fact.order_ref || "");
+        if (!orderRef) return;
+        // 已结算/已跳过 → 幂等短路
+        if (db.prepare("SELECT 1 FROM oracle_credit_grants WHERE reason_kind='order_confirmed' AND ref_id=?").get(orderRef)) return;
+
+        const parties = await resolveOrderParties(orderRef);
+        const grants = [];
+        if (!parties.seller) {
+            // 订单上下文缺失: 买卖双方都跳过, 如实记录, 不编造地址
+            ledgerGrant("order_confirmed", orderRef, "(unknown)", "0", "skipped", parties.reason);
+            warn(`[oracle-glue] E6 跳过 order_ref=${orderRef}: ${parties.reason}`);
+            return;
+        }
+        grants.push({ recipient: parties.seller, amount: params.rewardSellerPerOrder, kind: "order_confirmed", refId: orderRef, role: "seller" });
+        if (parties.buyer) {
+            grants.push({ recipient: parties.buyer, amount: params.rewardBuyerPerOrder, kind: "order_confirmed", refId: orderRef + ":buyer", role: "buyer" });
+        } else {
+            ledgerGrant("order_confirmed", orderRef + ":buyer", "(unknown)", "0", "skipped", `买家地址不可得 (${parties.reason}), 买家奖励跳过`);
+            warn(`[oracle-glue] E6 order_ref=${orderRef} 买家奖励跳过: ${parties.reason}`);
+        }
+
+        // 里程碑: 卖家累计已确认单量 (本地台账 done 的 order_confirmed 卖家行数 + 本笔)
+        const sellerDone = db.prepare("SELECT COUNT(*) AS n FROM oracle_credit_grants WHERE reason_kind='order_confirmed' AND recipient=? AND status='done'").get(parties.seller).n;
+        const totalOrders = Number(sellerDone) + grants.filter((g) => g.role === "seller").length;
+        if (totalOrders === 1) grants.push({ recipient: parties.seller, amount: params.rewardFirstOrder, kind: "milestone", refId: `first:${parties.seller}`, role: "milestone" });
+        if (totalOrders === 10) grants.push({ recipient: parties.seller, amount: params.rewardTenOrders, kind: "milestone", refId: `ten:${parties.seller}`, role: "milestone" });
+
+        // 额度守护: 本月已用 + 本批 > 链上月度额度 → 全批跳过并告警
+        const batchTotal = grants.reduce((s, g) => s + g.amount, 0);
+        const used = monthlyUsed();
+        if (used + batchTotal > params.monthlyQuota) {
+            for (const g of grants) {
+                ledgerGrant(g.kind === "milestone" ? "milestone" : "order_confirmed", g.refId, g.recipient, g.amount, "quota_skipped", `月度额度超限 (已用 ${used} + 本批 ${batchTotal} > 配额 ${params.monthlyQuota})`);
+            }
+            warn(`[oracle-glue] ⚠️ E6 额度告警: order_ref=${orderRef} 跳过 (本月已用 ${used}/${params.monthlyQuota}, 本批 ${batchTotal}) — 请检查额度或异常放量`);
+            return;
+        }
+
+        for (const g of grants) {
+            const reasonKind = g.kind === "milestone" ? "milestone" : "order_confirmed";
+            // 链上幂等键 reason_kind+ref_id; 台账已存在说明已发/已跳过
+            if (!ledgerGrant(reasonKind, g.refId, g.recipient, g.amount, "pending", "")) continue;
+            const r = await sendTx([{
+                "@type": "/trustchain.economy.v1.MsgGrantCredits",
+                issuer: oracleAddr,
+                recipient: g.recipient,
+                amount: String(g.amount),
+                reason_kind: reasonKind,
+                ref_id: g.refId,
+            }]);
+            if (r.code !== 0) {
+                const status = MODULE_NOT_LIVE_RE.test(r.raw_log) ? "pending" : "failed";
+                db.prepare("UPDATE oracle_credit_grants SET status=?, note=?, updated_at=? WHERE reason_kind=? AND ref_id=?")
+                    .run(status, `code=${r.code}: ${String(r.raw_log).slice(0, 200)}`, nowSec(), reasonKind, g.refId);
+                if (status === "pending") warn(`[oracle-glue] economy 模块未上线, ${reasonKind}/${g.refId} 留下次重试`);
+                continue;
+            }
+            db.prepare("UPDATE oracle_credit_grants SET status='done', txhash=?, updated_at=? WHERE reason_kind=? AND ref_id=?")
+                .run(r.txhash, nowSec(), reasonKind, g.refId);
+            log(`[oracle-glue] E6 已发放 ${reasonKind}/${g.refId} → ${g.recipient} +${g.amount} (tx=${r.txhash})`);
+        }
+    }
+
+    /** E6 一轮: 拉 CONFIRMED 事实 → 逐笔结算 */
+    async function settleConfirmedFacts(oracleAddr) {
+        const params = await getEconomyParams();
+        if (!params) { warn("[oracle-glue] economy params 查询失败 (模块未上线?), 本轮 E6 跳过"); return; }
+        const pj = await lcdGet("/oxiaom/trustchain/serviceprovider/v1/providers");
+        const providers = pj && (pj.providers || pj.service_providers) || [];
+        for (const p of providers) {
+            const paddr = typeof p === "string" ? p : p.address;
+            if (!paddr) continue;
+            const fj = await lcdGet(`/oxiaom/trustchain/serviceprovider/v1/facts/${paddr}`);
+            const facts = fj && (fj.facts || fj.payment_facts) || [];
+            for (const f of facts) {
+                if (String(f.status).toUpperCase() !== "CONFIRMED") continue;
+            // 支付口径双标准 (xiaomu 2026-09-22): 国内=微信支付, 国外=PayPal, 每市场唯一通道不混算。
+            // 当前 proto 无 channel 字段 — 提交口 (agent-serviceprovider) 只放行 wechat/paypal,
+            // 所以链上事实均为双标准内的口径; 下个升级 PaymentFact 加 channel 字段后在此按口径分组结算:
+            //   wechat → 国内统计口径; paypal → 海外统计口径; 两者不互相混算。
+                try {
+                    await settleFact(f, params, oracleAddr);
+                } catch (e) {
+                    warn(`[oracle-glue] E6 结算失败 order_ref=${f.order_ref}: ${e.message} (下轮重试)`);
+                }
+            }
+        }
+    }
+
+    // ============================== N14 settle crank ==============================
+
+    const SETTLE_MAX_PER_TICK = 5;      // 每 tick 最多结算单数 (防堆积打爆串行队列)
+    const SETTLE_SELLER_SCAN_CAP = 20;  // 每 tick 最多扫描的 provider (卖家) 数
+    const SETTLE_BEAT_SECS = 1800;      // 无到期单时的心跳日志间隔
+    const DEFAULT_DISPUTE_WINDOW = 259200; // 3 天; 链上 order params 读取失败时的兜底
+    let lastSweepBeatAt = 0;
+
+    /** 链上 order params (dispute_window, 秒) */
+    async function getDisputeWindow() {
+        const j = await lcdGet("/oxiaom/trustchain/order/v1/params");
+        const n = Number(j && j.params && j.params.dispute_window);
+        return Number.isFinite(n) && n > 0 ? n : DEFAULT_DISPUTE_WINDOW;
+    }
+
+    /** 单查链上订单 (返回 Order 对象或 null) */
+    async function getOrder(orderId) {
+        const j = await lcdGet(`/oxiaom/trustchain/order/v1/orders/${orderId}`);
+        return (j && (j.order || j.Order)) || null;
+    }
+
+    /** CONFIRMED 且争议窗口已过 → 到期可结算 (status 兼容枚举名/数字两种 LCD 形态) */
+    function orderSettleEligible(o, window) {
+        const st = String(o.status || "");
+        if (!(st === "2" || /CONFIRMED$/i.test(st))) return false;
+        if (o.settled) return false;
+        const at = Number(o.confirmed_at || 0);
+        return at > 0 && at + window < nowSec();
+    }
+
+    /** 本地台账 chain_order_id 候选 (表由 indexer 建; 不存在时按无候选处理) */
+    function localChainOrderIds() {
+        const has = db.prepare("SELECT 1 FROM sqlite_master WHERE type='table' AND name='agent_pay_sessions'").get();
+        if (!has) return [];
+        return db.prepare("SELECT DISTINCT chain_order_id AS id FROM agent_pay_sessions WHERE chain_order_id IS NOT NULL AND chain_order_id != ''").all();
+    }
+
+    /** N14 一轮: 扫到期 CONFIRMED 单 → 逐条发 MsgSettleOrder (caller=oracle, permissionless)。
+     *  候选源: 本地台账 agent_pay_sessions.chain_order_id (逐单现查) + 链上 providers
+     *  的 by-seller 订单列表 (列表自带全量字段, 免逐单查; 链上无全局订单列表查询)。 */
+    async function settleExpiredOrders(oracleAddr) {
+        const win = await getDisputeWindow();
+        const due = [];
+        const seen = new Set();
+        const consider = (o, seller) => {
+            if (!o || !o.order_id || seen.has(String(o.order_id))) return;
+            seen.add(String(o.order_id));
+            if (orderSettleEligible(o, win)) due.push({ id: String(o.order_id), seller: o.seller || seller || "", confirmedAt: Number(o.confirmed_at) });
+        };
+        for (const r of localChainOrderIds()) {
+            const id = String(r.id || "");
+            if (!/^\d+$/.test(id)) continue;
+            consider(await getOrder(id));
+        }
+        const pj = await lcdGet("/oxiaom/trustchain/serviceprovider/v1/providers");
+        const providers = pj && (pj.providers || pj.service_providers) || [];
+        for (const p of providers.slice(0, SETTLE_SELLER_SCAN_CAP)) {
+            const paddr = typeof p === "string" ? p : p.address;
+            if (!paddr) continue;
+            const oj = await lcdGet(`/oxiaom/trustchain/order/v1/sellers/${paddr}/orders`);
+            for (const o of (oj && oj.orders) || []) consider(o, paddr);
+        }
+        if (due.length === 0) {
+            if (nowSec() - lastSweepBeatAt >= SETTLE_BEAT_SECS) {
+                lastSweepBeatAt = nowSec();
+                log(`[oracle-glue] N14 settle 扫描: 无到期订单 (checked=${seen.size} window=${win}s)`);
+            }
+            return;
+        }
+        due.sort((a, b) => a.confirmedAt - b.confirmedAt); // 最老的先结
+        for (const d of due.slice(0, SETTLE_MAX_PER_TICK)) {
+            let r;
+            try {
+                r = await sendTx([{
+                    "@type": "/trustchain.order.v1.MsgSettleOrder",
+                    caller: oracleAddr,
+                    order_id: d.id,
+                }]);
+            } catch (e) {
+                warn(`[oracle-glue] N14 settle order=${d.id} 异常: ${e.message} (下轮重试)`);
+                continue;
+            }
+            if (r.code !== 0) {
+                if (SETTLE_DONE_RE.test(r.raw_log)) {
+                    log(`[oracle-glue] N14 settle order=${d.id} 按完成处理 (${String(r.raw_log).slice(0, 80)})`);
+                } else if (MODULE_NOT_LIVE_RE.test(r.raw_log)) {
+                    warn(`[oracle-glue] order 模块未上线, settle order=${d.id} 留待下轮`);
+                } else {
+                    warn(`[oracle-glue] N14 settle order=${d.id} 失败 code=${r.code}: ${String(r.raw_log).slice(0, 200)} (下轮重试)`);
+                }
+                continue;
+            }
+            log(`[oracle-glue] N14 订单已结算 order=${d.id} seller=${d.seller} tx=${r.txhash}`);
+        }
+    }
+
+    /** 每 tick: 推进 bootstrap 队列 + E6 结算 + N14 settle 扫描。签名地址每轮现取 (CLI/JS 通道皆可) */
+    async function tick() {
+        let oracleAddr = deps.oracleAddr;
+        if (!oracleAddr) {
+            try {
+                oracleAddr = await chainWrites.keyAddress(cfg);
+            } catch (e) {
+                warn(`[oracle-glue] 签名地址获取失败 (${e.message}), 本轮跳过`);
+                return;
+            }
+        }
+        const rows = db.prepare("SELECT * FROM oracle_bootstrap_grants WHERE status NOT IN ('done')").all();
+        for (const row of rows) {
+            try {
+                await stepBootstrapGrant(row, oracleAddr);
+            } catch (e) {
+                db.prepare("UPDATE oracle_bootstrap_grants SET last_error=?, updated_at=? WHERE credential_hash=?")
+                    .run(String(e.message).slice(0, 300), nowSec(), row.credential_hash);
+                warn(`[oracle-glue] bootstrap ${row.credential_hash.slice(0, 12)}... 失败: ${e.message} (下轮重试)`);
+            }
+        }
+        await settleConfirmedFacts(oracleAddr);
+        await settleExpiredOrders(oracleAddr);
+    }
+
+    return { tick, enqueueBootstrapGrant, settleConfirmedFacts, settleExpiredOrders, stepBootstrapGrant, getEconomyParams, monthlyUsed, resolveOrderParties, settleFact, grantFeegrant, findFeegrant };
+}
+
+module.exports = { createOracleGlue, oracleCfg, sha256Hex, MODULE_NOT_LIVE_RE };