trustbase-seller-backend 0.2.3 → 0.2.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trustbase-seller-backend",
-  "version": "0.2.3",
+  "version": "0.2.4",
   "description": "TrustBase Seller Backend (merchant edition) — 商品上链/订单/支付/质押 write API for TrustBase 保障链生态. 单卖家自托管形态: 签名 key 即卖家身份, 私钥不出门.",
   "main": "run-unified.js",
   "bin": {

package/payments/wechat/profitsharing.js

@@ -147,4 +147,41 @@ async function queryProfitsharing(outOrderNo, opts) {
     return r.mock ? { mock: true, out_order_no: String(outOrderNo) } : r;
 }
 
-module.exports = { addReceivers, requestProfitsharing, queryProfitsharing, assertShareAmount, MAX_SHARE_BP };
+/** M3-1: 分账接收方注册台账 (幂等标记; 已注册不重复调微信 — 重复调会报 "接收方已存在" 类错误) */
+function ensurePsReceiverTable(db) {
+    db.exec(`
+CREATE TABLE IF NOT EXISTS sp_ps_receivers (
+  account TEXT PRIMARY KEY,      -- 接收方商户号 (SP 自身 mchid)
+  registered_at INTEGER NOT NULL,
+  mock INTEGER NOT NULL DEFAULT 0
+);
+`);
+}
+
+/** M3-1: 注册默认分账接收方 (SP 自身 mchid, type MERCHANT_ID)。
+ *  调用时机: SP 服务启动 (createSpNotifyRouter 挂载) + 进件 FINISHED 钩子 (sp-applyment)。
+ *  幂等: 台账有记录 → {registered:false, reason:'already'} 不调微信; mock 模式同样落台账。 */
+async function registerDefaultReceivers(db) {
+    ensurePsReceiverTable(db);
+    const c = wxCfg();
+    const account = c.spMchid || c.mchid;
+    if (!account) {
+        console.warn("[profitsharing] 未配 WXPAY_SP_MCHID/WXPAY_MCHID, 跳过接收方注册");
+        return { registered: false, reason: "no_mchid" };
+    }
+    const row = db.prepare("SELECT account FROM sp_ps_receivers WHERE account = ?").get(account);
+    if (row) return { registered: false, reason: "already" };
+    const r = await addReceivers([{ account, type: "MERCHANT_ID", name: process.env.SP_NAME || "服务商" }]);
+    const one = Array.isArray(r) ? r[0] : r;
+    const ok = !!(one && (one.mock || one.status === 200));
+    if (ok) {
+        db.prepare("INSERT OR IGNORE INTO sp_ps_receivers (account, registered_at, mock) VALUES (?,?,?)")
+            .run(account, Math.floor(Date.now() / 1000), one.mock ? 1 : 0);
+        console.log(`[profitsharing] 分账接收方已注册 account=${account} mock=${!!one.mock}`);
+        return { registered: true, mock: !!one.mock };
+    }
+    console.warn(`[profitsharing] 接收方注册未成功 account=${account}: ${JSON.stringify(one && one.json || one).slice(0, 200)}`);
+    return { registered: false, reason: "wx_error", detail: one && one.json };
+}
+
+module.exports = { addReceivers, requestProfitsharing, queryProfitsharing, assertShareAmount, MAX_SHARE_BP, registerDefaultReceivers, ensurePsReceiverTable };

package/routes/sp-applyment.js

@@ -46,6 +46,8 @@ const crypto = require("crypto");
 const fs = require("fs");
 const agentPay = require("./agent-pay");
 const chainWrites = require("./chain-writes");
+const spCommission = require("./sp-commission");
+const profitsharing = require("../payments/wechat/profitsharing");
 
 const HttpError = chainWrites.HttpError;
 
@@ -630,10 +632,10 @@ function createSpApplymentRouter(deps) {
     }
 
     /** GET /info — 服务商公开名片 (2026-10-03 xiaomu: 卖家入驻页要显示服务商是谁)
-     *  公开只读, 不要 admin key — 名片本来就是给商户看的公开信息 */
+     *  公开只读, 不要 admin key — 名片本来就是给商户看的公开信息
+     *  M3 🟡-1: 公示比例读 sp_commission_rates 默认行 (__default__) 优先, env 只作首次种子 */
     router.get("/info", (req, res) => {
-        const rateBp = Number(process.env.SP_DEFAULT_COMMISSION_BP || 100); // 默认 1%
-        const bp = Number.isInteger(rateBp) && rateBp >= 0 ? rateBp : 100;
+        const bp = spCommission.getDefaultRateBp(db);
         res.json({
             name: process.env.SP_NAME || "TrustBase 官方服务商",
             desc: process.env.SP_DESC || "",
@@ -719,12 +721,14 @@ function createSpApplymentRouter(deps) {
             if (r.status !== 200 || !(r.json.applyment_id != null)) return wxError(res, r, "提交进件失败");
             const applymentId = String(r.json.applyment_id);
             // 台账快照: 敏感字段脱敏 (身份证/卡号只留后 4 位; already_encrypted 时已是密文, 脱敏无妨)
+            // M3 🟡-1: 进件时刻的公示抽佣比例快照进 subject_json (事后对账依据)
             const snapshot = {
                 ...f,
                 legal_id_number: maskTail(f.legal_id_number),
                 account_number: maskTail(f.account_number),
                 business_code: undefined,
                 already_encrypted: undefined,
+                commission_bp_at_apply: spCommission.getDefaultRateBp(db),
             };
             const now = nowSec();
             // upsert: 驳回重提时更新已有行 (同 business_code 覆盖), 否则插新行
@@ -791,6 +795,8 @@ function createSpApplymentRouter(deps) {
  ON CONFLICT(sub_mchid) DO UPDATE SET seller_address=excluded.seller_address, shop_name=excluded.shop_name`)
                             .run(String(j.sub_mchid), row.tb_address || "", String(snap.merchant_shortname || ""), now);
                         console.log(`[sp-applyment] FINISHED 钩子: sub_mchid=${j.sub_mchid} 已登记回调路由 seller=${(row.tb_address || "").slice(0, 14)}…`);
+                        // M3-1: 进件通过时也确认分账接收方已注册 (启动时注册失败的兜底; 台账幂等)
+                        await profitsharing.registerDefaultReceivers(db);
                         if (row.tb_address) {
                             const g = await notifyOracleGrant(deps, { tb_address: row.tb_address, license_number: snap.license_number });
                             if (g.ok) {

package/routes/sp-commission.js

@@ -35,6 +35,21 @@ CREATE TABLE IF NOT EXISTS sp_commission_rates (
 /** rate_bp → 人性化百分比 ("1.50%") */
 function ratePct(rateBp) { return (rateBp / 100).toFixed(2) + "%"; }
 
+/** M3 🟡-1: 公示默认抽佣比例 (sub_mchid='__default__' 特殊行) — 读表优先,
+ *  env SP_DEFAULT_COMMISSION_BP 只作首次种子 (表里没有时落一行, 之后 PUT 覆盖生效) */
+const DEFAULT_ROW_KEY = "__default__";
+function getDefaultRateBp(db) {
+    ensureCommissionTables(db);
+    const row = db.prepare("SELECT rate_bp FROM sp_commission_rates WHERE sub_mchid = ?").get(DEFAULT_ROW_KEY);
+    if (row) return row.rate_bp;
+    let seed = Number(process.env.SP_DEFAULT_COMMISSION_BP || 100);
+    if (!Number.isInteger(seed) || seed < 0 || seed > MAX_RATE_BP) seed = 100;
+    const now = nowSec();
+    db.prepare("INSERT OR IGNORE INTO sp_commission_rates (sub_mchid, provider, rate_bp, updated_by, created_at, updated_at) VALUES (?,?,?,?,?,?)")
+        .run(DEFAULT_ROW_KEY, "", seed, "env-seed", now, now);
+    return seed;
+}
+
 function createSpCommissionRouter(deps) {
     const router = express.Router();
     const { db } = deps;
@@ -101,4 +116,4 @@ function createSpCommissionRouter(deps) {
     return router;
 }
 
-module.exports = { createSpCommissionRouter, ensureCommissionTables, ratePct, MAX_RATE_BP };
+module.exports = { createSpCommissionRouter, ensureCommissionTables, ratePct, MAX_RATE_BP, getDefaultRateBp, DEFAULT_ROW_KEY };

package/routes/sp-notify.js

@@ -12,6 +12,9 @@
  *     6. 上链 MsgSubmitPaymentFact (失败 warn 不阻塞, chain_txhash 留空等 retryPending 补)
  *     7. 转发商户 webhook (3s 超时, 结果记 forward_status)
  *     8. 按登记的抽佣比例触发微信分账 (默认 mock, WXPAY_PROFITSHARING_ENABLED=true 才真调)
+ *     9. M3 (2026-10-03): 分账台账列 (ps_*) + 触发落行 pending→done/mock/failed + 5min 补扫
+ *        (retryProfitsharingSweep 同步微信真实状态/同号重发) + 启动/进件时注册分账接收方
+ *        (profitsharing.registerDefaultReceivers, 台账幂等)
  *
  * 与直连模式 (agent-pay E2) 的差异: 回调只推到服务商, 服务商验签解密后按 sub_mchid
  * 分发 —— 上链提交支付事实 + 转发/落账给对应商户。
@@ -51,6 +54,16 @@ CREATE TABLE IF NOT EXISTS sp_sub_merchants (
   created_at INTEGER NOT NULL
 );
 `);
+    // M3-2: 分账台账列 (老库兼容: PRAGMA 检查后 ALTER)
+    const cols = db.prepare("PRAGMA table_info(sp_payment_facts)").all().map((c) => c.name);
+    for (const [col, ddl] of [
+        ["ps_out_order_no", "ALTER TABLE sp_payment_facts ADD COLUMN ps_out_order_no TEXT DEFAULT ''"],
+        ["ps_status", "ALTER TABLE sp_payment_facts ADD COLUMN ps_status TEXT DEFAULT ''"],       // ''/pending/mock/done/failed
+        ["ps_amount", "ALTER TABLE sp_payment_facts ADD COLUMN ps_amount INTEGER"],
+        ["ps_at", "ALTER TABLE sp_payment_facts ADD COLUMN ps_at INTEGER"],
+    ]) {
+        if (!cols.includes(col)) db.exec(ddl);
+    }
 }
 
 /** 上链 MsgSubmitPaymentFact (真实通道; 异常上抛, 由调用方降级为 warn 不阻塞)
@@ -102,12 +115,73 @@ async function retryPending(db, opts) {
     return { scanned: rows.length, retried, failed };
 }
 
+/** M3-2: 分账补扫 — 扫 ps_status='pending'/'failed' 的台账行:
+ *  先 queryProfitsharing 同步微信侧真实状态 (FINISHED → done); 仍 failed 的用同 out_order_no
+ *  重发一笔 (微信侧幂等)。mock 模式: pending → mock, failed → 重发 mock 后记 mock。 */
+async function retryProfitsharingSweep(db, opts) {
+    const rows = db.prepare(`SELECT txn_id, sub_mchid, amount, ps_out_order_no, ps_amount, ps_status
+ FROM sp_payment_facts WHERE ps_status IN ('pending','failed') AND ps_out_order_no <> '' LIMIT 20`).all();
+    let synced = 0, retried = 0, failed = 0;
+    const receiverAccount = process.env.WXPAY_SP_MCHID || process.env.WXPAY_MCHID || "";
+    for (const row of rows) {
+        try {
+            const q = await profitsharing.queryProfitsharing(row.ps_out_order_no, { subMchid: row.sub_mchid });
+            if (q && q.mock) {
+                // mock: 无真实状态可同步; failed 行重发一笔 mock 分账
+                if (row.ps_status === "failed") {
+                    await profitsharing.requestProfitsharing({
+                        outTradeNo: row.ps_out_order_no, transactionId: row.txn_id, tradeAmount: row.amount,
+                        subMchid: row.sub_mchid,
+                        receivers: [{ account: receiverAccount, amount: row.ps_amount, description: "服务商抽佣" }],
+                    });
+                    retried++;
+                } else {
+                    synced++;
+                }
+                db.prepare("UPDATE sp_payment_facts SET ps_status='mock', ps_at=? WHERE txn_id=?").run(nowSec(), row.txn_id);
+                continue;
+            }
+            if (q && q.status === 200 && q.json) {
+                const st = String(q.json.state || "");
+                if (/FINISHED|SUCCESS/i.test(st)) {
+                    db.prepare("UPDATE sp_payment_facts SET ps_status='done', ps_at=? WHERE txn_id=?").run(nowSec(), row.txn_id);
+                    synced++;
+                } else if (row.ps_status === "failed") {
+                    // 微信侧未成功 → 同 out_order_no 重发 (幂等)
+                    const r2 = await profitsharing.requestProfitsharing({
+                        outTradeNo: row.ps_out_order_no, transactionId: row.txn_id, tradeAmount: row.amount,
+                        subMchid: row.sub_mchid,
+                        receivers: [{ account: receiverAccount, amount: row.ps_amount, description: "服务商抽佣" }],
+                    });
+                    const ok = r2 && r2.status === 200;
+                    db.prepare("UPDATE sp_payment_facts SET ps_status=?, ps_at=? WHERE txn_id=?").run(ok ? "pending" : "failed", nowSec(), row.txn_id);
+                    if (ok) retried++; else failed++;
+                }
+                // pending 且微信侧还在处理中: 保持 pending 下轮再扫
+            } else {
+                failed++;
+                console.warn(`[sp-notify] 分账补扫查询未成功 out_order_no=${row.ps_out_order_no} status=${q && q.status}`);
+            }
+        } catch (e) {
+            failed++;
+            console.warn(`[sp-notify] 分账补扫失败 txn=${row.txn_id}:`, e && e.message);
+        }
+    }
+    return { scanned: rows.length, synced, retried, failed };
+}
+
 function createSpNotifyRouter(deps) {
     const router = express.Router();
     const { db } = deps;
     ensureTables(db);
     spCommission.ensureCommissionTables(db); // 分账触发要查抽佣表
     const injectedSendTx = deps.sendTx || null; // 测试注入 (绕过真实链)
+    // M3-1: 启动即注册分账接收方 (SP 自身 mchid; 幂等, 台账标记, mock 也落行)
+    profitsharing.registerDefaultReceivers(db)
+        .catch((e) => console.warn("[sp-notify] 分账接收方注册失败 (进件 FINISHED 钩子会再试):", e && e.message));
+    // M3-2: 分账补扫定时器 (5min; 扫 ps_status pending/failed 同步微信真实状态/重发)
+    const psTimer = setInterval(() => { retryProfitsharingSweep(db).catch((e) => console.warn("[sp-notify] 分账补扫异常:", e && e.message)); }, 5 * 60 * 1000);
+    psTimer.unref && psTimer.unref();
 
     /** 上链统一入口: 禁用开关 > 测试注入 > 真实通道 */
     async function sendFact(fact) {
@@ -116,7 +190,8 @@ function createSpNotifyRouter(deps) {
         return submitPaymentFactToChain(fact);
     }
 
-    /** 抽佣分账触发: 按 sp_commission_rates 登记比例, 失败只 warn (mock 默认, 不阻塞回调) */
+    /** 抽佣分账触发: 按 sp_commission_rates 登记比例, 失败只 warn (mock 默认, 不阻塞回调)
+     *  M3-2: 台账落行 pending → 微信/mock 返回后 done/mock/failed; failed/pending 由 retryProfitsharingSweep 补扫 */
     function maybeTriggerProfitsharing(f) {
         try {
             const rate = db.prepare("SELECT rate_bp FROM sp_commission_rates WHERE sub_mchid = ?").get(f.subMchid);
@@ -124,15 +199,22 @@ function createSpNotifyRouter(deps) {
             const commission = Math.floor(f.amount * rate.rate_bp / 10000);
             if (!(commission > 0)) return;
             const receiverAccount = process.env.WXPAY_SP_MCHID || process.env.WXPAY_MCHID || "";
+            const outOrderNo = "ps-" + f.txnId; // 分账单号 (微信侧 out_order_no, 幂等键)
+            // 台账先落 pending (即使后续调用失败也留痕可补扫)
+            db.prepare("UPDATE sp_payment_facts SET ps_out_order_no=?, ps_amount=?, ps_status='pending', ps_at=? WHERE txn_id=?")
+                .run(outOrderNo, commission, nowSec(), f.txnId);
             profitsharing.requestProfitsharing({
-                outTradeNo: "ps-" + f.txnId, // 分账单号 (微信侧 out_order_no, 幂等键)
+                outTradeNo: outOrderNo,
                 transactionId: f.txnId,
                 tradeAmount: f.amount,
                 subMchid: f.subMchid,
                 receivers: [{ account: receiverAccount, amount: commission, description: "服务商抽佣" }],
             }).then((r) => {
-                console.log(`[sp-notify] 分账触发 txn=${f.txnId} commission=${commission} mock=${!!(r && r.mock)}`);
+                const st = (r && r.mock) ? "mock" : (r && r.status === 200 ? "done" : "failed");
+                db.prepare("UPDATE sp_payment_facts SET ps_status=?, ps_at=? WHERE txn_id=?").run(st, nowSec(), f.txnId);
+                console.log(`[sp-notify] 分账触发 txn=${f.txnId} commission=${commission} ps_status=${st} mock=${!!(r && r.mock)}`);
             }).catch((e) => {
+                db.prepare("UPDATE sp_payment_facts SET ps_status='failed', ps_at=? WHERE txn_id=?").run(nowSec(), f.txnId);
                 console.warn(`[sp-notify] 分账触发失败 txn=${f.txnId}:`, e && e.message);
             });
         } catch (e) {
@@ -249,4 +331,4 @@ function createSpNotifyRouter(deps) {
     return router;
 }
 
-module.exports = { createSpNotifyRouter, ensureTables, retryPending, submitPaymentFactToChain };
+module.exports = { createSpNotifyRouter, ensureTables, retryPending, retryProfitsharingSweep, submitPaymentFactToChain };

package/test-sp-applyment.js

@@ -154,6 +154,8 @@ test("submit mock: 落台账 + 敏感字段加密 (非明文且可还原) + 重
         assert.ok(!row.subject_json.includes("440300199001011234"), "快照不含明文身份证");
         assert.ok(!row.subject_json.includes("6225880212345678"), "快照不含明文卡号");
         assert.ok(row.subject_json.includes("1234"), "脱敏后留后4位");
+        // M3 🟡-1: 进件时刻公示比例快照
+        assert.ok(JSON.parse(row.subject_json).commission_bp_at_apply >= 0, "快照含 commission_bp_at_apply");
 
         // 敏感字段加密断言: 用同一入口 buildApplymentBody 组装, 密文非明文且测试私钥可还原
         const pem = fs.readFileSync(pubKeyPath, "utf8");
@@ -230,24 +232,57 @@ test("GET /api/sp/info 公开名片: 无 admin key 200 + env 覆盖生效", asyn
         assert.strictEqual(j.commission_rate_bp, 100, "默认 1%");
         assert.strictEqual(j.rate_pct, "1.00%");
         assert.ok(j.gateway.includes("127.0.0.1"), "gateway 从 req host 推断");
-        // env 覆盖
+        // env 覆盖: 文本类即时生效; SP_DEFAULT_COMMISSION_BP 只作首次种子 (M3 🟡-1),
+        // 当前库已被首次调用种子为 100 → 需新库验证种子语义
         process.env.SP_NAME = "无锡小播鼠网络科技";
         process.env.SP_DESC = "TrustBase 官方支付服务商";
         process.env.SP_OFFICIAL_URL = "https://trustbase.example.com";
         process.env.SP_CONTACT = "微信: xiaomu";
-        process.env.SP_DEFAULT_COMMISSION_BP = "150";
         process.env.SP_CHAIN_ADDR = "tct1zg7wa9v2gkwp3yvmxrjlmwgfu0tw9vwcuhwwg7";
         r = await fetch(base + "/api/sp/info");
         j = await r.json();
         assert.strictEqual(j.name, "无锡小播鼠网络科技");
         assert.strictEqual(j.contact, "微信: xiaomu");
-        assert.strictEqual(j.commission_rate_bp, 150);
-        assert.strictEqual(j.rate_pct, "1.50%");
+        assert.strictEqual(j.commission_rate_bp, 100, "种子已落表, env 改不动公示比例 (读表优先)");
         assert.strictEqual(j.chain_address, "tct1zg7wa9v2gkwp3yvmxrjlmwgfu0tw9vwcuhwwg7");
     } finally {
         srv.close();
         delete process.env.SP_NAME; delete process.env.SP_DESC; delete process.env.SP_OFFICIAL_URL;
-        delete process.env.SP_CONTACT; delete process.env.SP_DEFAULT_COMMISSION_BP; delete process.env.SP_CHAIN_ADDR;
+        delete process.env.SP_CONTACT; delete process.env.SP_CHAIN_ADDR;
+    }
+});
+
+test("M3 🟡-1: /info 公示比例 env 首种子 + 表行优先 (PUT __default__ 覆盖生效)", async () => {
+    // 新库 + env 种子 250 → 首次读 2.50% 且落表; 之后 admin PUT __default__=200 → 2.00% (env 不再生效)
+    process.env.SP_DEFAULT_COMMISSION_BP = "250";
+    const spCommission = require("./routes/sp-commission");
+    const db = new Database(":memory:");
+    const app = express();
+    app.use(express.json());
+    app.use("/api/sp", spApplyment.createSpApplymentRouter({ db }));
+    app.use("/api/sp", spCommission.createSpCommissionRouter({ db }));
+    const srv = app.listen(0);
+    await new Promise((r) => srv.once("listening", r));
+    const base = `http://127.0.0.1:${srv.address().port}`;
+    try {
+        let j = await (await fetch(base + "/api/sp/info")).json();
+        assert.strictEqual(j.commission_rate_bp, 250);
+        assert.strictEqual(j.rate_pct, "2.50%");
+        const seedRow = db.prepare("SELECT * FROM sp_commission_rates WHERE sub_mchid='__default__'").get();
+        assert.ok(seedRow, "env 首种子落表");
+        assert.strictEqual(seedRow.rate_bp, 250);
+        // admin 改公示比例 → 读表优先
+        const put = await fetch(base + "/api/sp/commission-rate", {
+            method: "PUT", headers: { "Content-Type": "application/json", "x-sp-admin-key": ADMIN_KEY },
+            body: JSON.stringify({ sub_mchid: "__default__", rate_bp: 200 }),
+        });
+        assert.strictEqual(put.status, 200, JSON.stringify(await put.json()));
+        j = await (await fetch(base + "/api/sp/info")).json();
+        assert.strictEqual(j.commission_rate_bp, 200, "PUT __default__ 覆盖生效");
+        assert.strictEqual(j.rate_pct, "2.00%");
+    } finally {
+        srv.close();
+        delete process.env.SP_DEFAULT_COMMISSION_BP;
     }
 });
 

package/test-sp-gateway.js

@@ -359,3 +359,77 @@ test("retryPending: 上链失败台账留空 → 扫出重试补 txhash", async
         process.env.SP_CHAIN_DISABLED = "1";
     }
 });
+
+test("M3-1: 分账接收方注册幂等 (台账标记, 已注册不重复调)", async () => {
+    const db = new Database(":memory:");
+    spNotify.ensureTables(db);
+    // 首次注册 (mock 模式, WXPAY_SP_MCHID=1000686974 已在 env)
+    const r1 = await profitsharing.registerDefaultReceivers(db);
+    assert.strictEqual(r1.registered, true);
+    assert.strictEqual(r1.mock, true);
+    // 台账落行
+    const row = db.prepare("SELECT * FROM sp_ps_receivers WHERE account='1000686974'").get();
+    assert.ok(row, "接收方台账落行");
+    assert.strictEqual(row.mock, 1);
+    // 第二次 → 幂等跳过
+    const r2 = await profitsharing.registerDefaultReceivers(db);
+    assert.strictEqual(r2.registered, false);
+    assert.strictEqual(r2.reason, "already");
+    assert.strictEqual(db.prepare("SELECT COUNT(*) n FROM sp_ps_receivers").get().n, 1);
+});
+
+test("M3-2: 分账台账落行 (pending→mock) + 补扫重试 failed", async () => {
+    const { db, srv, merchantSrv, base } = await startServers();
+    try {
+        insertMerchant(db, SUB_MCHID, "");
+        // 登记抽佣 1% (100bp)
+        await fetch(base + "/commission-rate", {
+            method: "PUT", headers: { "content-type": "application/json", "x-sp-admin-key": ADMIN_KEY },
+            body: JSON.stringify({ sub_mchid: SUB_MCHID, rate_bp: 100 }),
+        });
+        const body = makeNotifyBody({
+            out_trade_no: "tb-ps-1", transaction_id: "4200009999000100",
+            trade_state: "SUCCESS", amount: { total: 10000, currency: "CNY" }, sub_mchid: SUB_MCHID,
+        });
+        const r = await fetch(base + "/notify/wechat", { method: "POST", headers: wxSignHeaders(body), body });
+        assert.strictEqual(r.status, 200);
+        // 分账 fire-and-forget → 等台账 ps_status 落定 (mock 秒回)
+        let row = null;
+        for (let i = 0; i < 50; i++) {
+            row = db.prepare("SELECT * FROM sp_payment_facts WHERE txn_id = ?").get("4200009999000100");
+            if (row && row.ps_status && row.ps_status !== "pending") break;
+            await new Promise((rs) => setTimeout(rs, 20));
+        }
+        assert.strictEqual(row.ps_out_order_no, "ps-4200009999000100", "分账单号落台账");
+        assert.strictEqual(row.ps_amount, 100, "1% 抽佣 = 100 分");
+        assert.strictEqual(row.ps_status, "mock", "mock 模式落 mock");
+        assert.ok(row.ps_at > 0);
+        // 手动置 failed → 补扫重发 (mock) → 回 mock
+        db.prepare("UPDATE sp_payment_facts SET ps_status='failed' WHERE txn_id=?").run("4200009999000100");
+        const res = await spNotify.retryProfitsharingSweep(db);
+        assert.strictEqual(res.scanned, 1);
+        assert.strictEqual(res.retried, 1, "failed 行重发一笔");
+        const row2 = db.prepare("SELECT ps_status FROM sp_payment_facts WHERE txn_id = ?").get("4200009999000100");
+        assert.strictEqual(row2.ps_status, "mock");
+        // 再扫: 无 pending/failed
+        const res2 = await spNotify.retryProfitsharingSweep(db);
+        assert.strictEqual(res2.scanned, 0);
+    } finally { srv.close(); merchantSrv.close(); }
+});
+
+test("M3-2: 无抽佣登记的商户回调 → 分账列留空 (不触发)", async () => {
+    const { db, srv, merchantSrv, base } = await startServers();
+    try {
+        insertMerchant(db, SUB_MCHID, "");
+        const body = makeNotifyBody({
+            out_trade_no: "tb-ps-2", transaction_id: "4200009999000101",
+            trade_state: "SUCCESS", amount: { total: 500 }, sub_mchid: SUB_MCHID,
+        });
+        const r = await fetch(base + "/notify/wechat", { method: "POST", headers: wxSignHeaders(body), body });
+        assert.strictEqual(r.status, 200);
+        await new Promise((rs) => setTimeout(rs, 100));
+        const row = db.prepare("SELECT * FROM sp_payment_facts WHERE txn_id = ?").get("4200009999000101");
+        assert.strictEqual(row.ps_status, "", "未登记抽佣不触发分账");
+        assert.strictEqual(row.ps_out_order_no, "");
+    } finally { srv.close(); merchantSrv.close(); }
+});