fix(payment): 渠道已收款时不再把支付单回滚成支付中

租客在待支付超时或取消的最后几十秒完成付款时，订单先被取消，乐刷的支付
结果几秒后才到，入账被判定订单不可支付而拒收。原先订单推进和支付单更新
在同一个事务里，订单一报错整笔回滚，支付单停在支付中且 paid_at 为空：
钱已在渠道，系统却毫不知情。乐刷重试十次后放弃，之后既补不回入账（订单
不再是待支付），后台人工退款也发不出去（退款要求原支付单是已支付）。
日志保留期内 13 天出了 5 笔，合计 4085.60 元。

- 取消前核对渠道：超时取消、租客取消、客服关单都先查一次渠道，已收款并
  已推进订单就放弃取消，让支付正常入账而不是走退款。渠道异常时按未收款
  继续，避免渠道一抖订单全卡住
- 回调兜底记账：订单确实已结束时不再回滚，把支付单如实记成已支付并写入
  paid_at 与渠道单号，后台人工退款从此可用。退款仍由客服人工发起
- 客服关单：待支付订单按实际已收款减已退款的差额退，补上本次事故中关单
  不生成退款的直接原因
- 补齐日志上下文：回调入账失败原先只有 error="order cannot pay"，现在带
  支付单号、订单号、订单状态和金额；新增 ERROR「渠道已收款但订单无法入账，
  需人工退款」作为唯一需人工介入的告警

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/internal/modules/payment/channel_probe.go

@@ -0,0 +1,89 @@
+package payment
+
+import (
+	"context"
+
+	"hfb_sys/backend/internal/model"
+
+	"go.uber.org/zap"
+)
+
+// ConfirmChannelPaidBeforeClose 在取消或关闭订单前跟渠道核对未完成的下单支付单。
+// 返回 true 表示渠道确认已收款且订单已被推进，调用方必须放弃本次取消。
+//
+// 待支付订单的 15 分钟超时和用户手动取消都可能正好撞上用户付款：
+// 订单先没了，渠道结果几秒后才到，于是钱收了、订单却是已取消。
+// 先核对一次能把绝大多数这种竞态挡在发生之前——而且是让支付正常入账，不必退款。
+func (r *Repository) ConfirmChannelPaidBeforeClose(ctx context.Context, orderID uint64) (bool, error) {
+	if r == nil || r.db == nil || orderID == 0 {
+		return false, nil
+	}
+	payments, err := r.pendingOrderPayments(ctx, orderID)
+	if err != nil {
+		return false, err
+	}
+	advanced := false
+	for i := range payments {
+		if err := r.probeChannelPaid(ctx, &payments[i]); err != nil {
+			// 渠道不可用不能阻塞取消，否则渠道一挂订单就全卡住。
+			// 真漏掉的由支付回调兜底记账并告警。
+			r.log().Warn("取消前核对渠道支付状态失败", paymentLogFields(ctx, appendFields(
+				paymentOrderFields(&payments[i]),
+				[]zap.Field{zap.Error(err)},
+			)...,
+			)...)
+			continue
+		}
+		// 以订单是否真的被推进为准。钱到了但商品已被他人租走时，入账路径只会记账
+		// 并告警等人工退款，不推进订单，这种情况仍然该让取消照常进行。
+		if orderAdvancedPastPayment(r.orderStatus(ctx, orderID)) {
+			advanced = true
+		}
+	}
+	return advanced, nil
+}
+
+// orderAdvancedPastPayment 判断订单是否已经靠这笔支付走出待支付阶段。
+func orderAdvancedPastPayment(status string) bool {
+	return status == "pending_handoff" || status == "renting"
+}
+
+// probeChannelPaid 向渠道查询一笔支付单的真实状态并落库。
+func (r *Repository) probeChannelPaid(ctx context.Context, payment *model.PaymentOrder) error {
+	if payment.ProviderOrderID == "" {
+		// 没有渠道单号说明下单请求没被渠道受理，不可能收到钱。
+		return nil
+	}
+	runtimeConfig, err := r.runtimeConfigForPayment(ctx, payment)
+	if err != nil {
+		return err
+	}
+	if runtimeConfig.isMockMode() || runtimeConfig.Channel == nil {
+		return nil
+	}
+	resp, err := runtimeConfig.Channel.QueryPayment(ctx, payment.ThirdOrderID, payment.ProviderOrderID)
+	if err != nil {
+		return err
+	}
+	if resp.Status != "paid" {
+		return nil
+	}
+	r.log().Warn("渠道核对到已收款但系统未入账", paymentLogFields(ctx, appendFields(
+		paymentOrderFields(payment),
+		runtimeConfigFields(runtimeConfig),
+		[]zap.Field{zap.String("order_status", r.orderStatus(ctx, payment.OrderID))},
+	)...,
+	)...)
+	// 走统一入账路径：订单还能支付就正常推进，已经结束就只记账并告警等人工退款。
+	return r.applyChannelStatus(ctx, payment, resp.Status, resp.PayTime, resp.Raw, channelSourceQuery)
+}
+
+func (r *Repository) pendingOrderPayments(ctx context.Context, orderID uint64) ([]model.PaymentOrder, error) {
+	var rows []model.PaymentOrder
+	err := r.db.WithContext(ctx).
+		Where("order_id = ? AND biz_type = ? AND status IN ? AND provider_order_id <> ''",
+			orderID, "order_pay", []string{"created", "paying"}).
+		Order("id DESC").
+		Find(&rows).Error
+	return rows, err
+}

backend/internal/modules/payment/channel_status.go

@@ -92,6 +92,9 @@ func (r *Repository) confirmPaid(ctx context.Context, payment *model.PaymentOrde
 		return tx.Model(&model.PaymentOrder{}).Where("id = ?", payment.ID).Updates(updates).Error
 	})
 	if err != nil {
+		if settleErr, handled := r.settleUnpayableOrderPayment(ctx, payment, paidAt, raw, source, err); handled {
+			return settleErr
+		}
 		return err
 	}
 	if newConvID > 0 && notifyFn != nil {

backend/internal/modules/payment/late_paid.go

@@ -0,0 +1,113 @@
+package payment
+
+import (
+	"context"
+	"errors"
+	"time"
+
+	"hfb_sys/backend/internal/model"
+	"hfb_sys/backend/internal/modules/order"
+
+	"go.uber.org/zap"
+	"gorm.io/gorm"
+	"gorm.io/gorm/clause"
+)
+
+// isOrderUnpayable 判断订单侧的报错是否属于「钱已到渠道，但订单再也无法入账」。
+// 订单被取消或关单后回调才到属于前者，商品被他人抢租属于后者。
+func isOrderUnpayable(err error) bool {
+	return errors.Is(err, order.ErrOrderCannotPay) || errors.Is(err, order.ErrListingUnavailable)
+}
+
+func unpayableReason(err error) string {
+	switch {
+	case errors.Is(err, order.ErrOrderCannotPay):
+		return "order_not_payable"
+	case errors.Is(err, order.ErrListingUnavailable):
+		return "listing_unavailable"
+	default:
+		return "unknown"
+	}
+}
+
+// settleUnpayableOrderPayment 处理「渠道已收款、订单却无法入账」。
+//
+// 钱已经进了商户账户，这个事实必须先落库：把支付单如实记成已支付。
+// 如果让订单侧的报错把整笔事务回滚，支付单会停在「支付中」且 paid_at 为空，
+// 这时候既补不回入账（订单已不是待支付），也退不出去——后台人工退款要求
+// 原支付单是已支付，所以连客服都无能为力，钱就彻底对不上了。
+//
+// 这里只记账并告警，不自动退款：退款由客服在后台确认后人工发起，
+// 落账之后后台的人工退款就能正常走通。
+func (r *Repository) settleUnpayableOrderPayment(ctx context.Context, payment *model.PaymentOrder, paidAt time.Time, raw map[string]string, source string, cause error) (error, bool) {
+	if payment == nil || payment.BizType != "order_pay" || !isOrderUnpayable(cause) {
+		return nil, false
+	}
+	reason := unpayableReason(cause)
+	logFields := func(extra ...zap.Field) []zap.Field {
+		return paymentLogFields(ctx, appendFields(
+			paymentOrderFields(payment),
+			[]zap.Field{
+				zap.String("channel_source", source),
+				zap.String("unpayable_reason", reason),
+				zap.String("order_status", r.orderStatus(ctx, payment.OrderID)),
+			},
+			extra,
+		)...)
+	}
+
+	if err := r.markOrderPaymentPaid(ctx, payment, paidAt, withUnpayableDiagnostic(raw, reason), source); err != nil {
+		r.log().Error("渠道已收款但支付单落账失败", logFields(zap.Error(err))...)
+		return err, true
+	}
+	// 返回 nil 让渠道停止重试：重试解决不了问题，只会把同一条告警刷十遍。
+	r.log().Error("渠道已收款但订单无法入账，需人工退款", logFields()...)
+	return nil, true
+}
+
+// markOrderPaymentPaid 只更新支付单自身，不碰订单状态，用于订单已无法推进时如实记录收款。
+func (r *Repository) markOrderPaymentPaid(ctx context.Context, payment *model.PaymentOrder, paidAt time.Time, raw map[string]string, source string) error {
+	return r.db.WithContext(ctx).Transaction(func(tx *gorm.DB) error {
+		var latest model.PaymentOrder
+		if err := tx.Clauses(clause.Locking{Strength: "UPDATE"}).First(&latest, payment.ID).Error; err != nil {
+			return err
+		}
+		if latest.Status == "paid" && latest.PaidAt != nil {
+			return nil
+		}
+		updates := map[string]any{
+			"status":            "paid",
+			"provider_order_id": firstNonEmpty(raw["provider_order_id"], raw["schc_order_id"], raw["leshua_order_id"], raw["pay_order_no"], raw["trade_no"], latest.ProviderOrderID),
+			"raw_response":      jsonMap(withRawSource(raw, source)),
+			"paid_at":           paidAt,
+		}
+		if source == channelSourceNotify {
+			updates["notified_at"] = time.Now()
+		}
+		return tx.Model(&model.PaymentOrder{}).Where("id = ?", payment.ID).Updates(updates).Error
+	})
+}
+
+// withUnpayableDiagnostic 在 raw_response 里留下排查标记，后台支付列表可以直接看到原因。
+func withUnpayableDiagnostic(raw map[string]string, reason string) map[string]string {
+	out := make(map[string]string, len(raw)+2)
+	for key, value := range raw {
+		out[key] = value
+	}
+	out["_order_unpayable_reason"] = reason
+	out["_manual_refund_required"] = "true"
+	return out
+}
+
+func (r *Repository) orderStatus(ctx context.Context, orderID uint64) string {
+	if orderID == 0 {
+		return ""
+	}
+	var status string
+	if err := r.db.WithContext(ctx).Model(&model.RentalOrder{}).
+		Where("id = ?", orderID).
+		Pluck("status", &status).Error; err != nil {
+		return ""
+	}
+	return status
+}

backend/internal/modules/payment/late_paid_test.go

@@ -0,0 +1,163 @@
+package payment
+
+import (
+	"errors"
+	"testing"
+	"time"
+
+	"hfb_sys/backend/internal/model"
+	ordermodule "hfb_sys/backend/internal/modules/order"
+)
+
+// TestConfirmPaidSettlesPaymentWhenOrderAlreadyCancelled 钉住本次事故的根因：
+// 渠道回调带着「已支付」到达，而订单已经被取消。原先订单侧报 ErrOrderCannotPay 会把
+// 整笔事务回滚，支付单停在 paying 且 paid_at 为空，于是钱收了却既补不回入账
+// （订单不再是待支付），也退不出去——后台人工退款要求原支付单是已支付。
+// 现在必须如实把支付单记成已支付，人工退款才有的可退。
+func TestConfirmPaidSettlesPaymentWhenOrderAlreadyCancelled(t *testing.T) {
+	db := setupPaymentTestDB(t)
+	repo := NewRepository(db, nil, ordermodule.NewRepository(db))
+	fixture := createPayableOrderFixture(t, db, "LP01", true)
+	if err := db.Model(&model.RentalOrder{}).Where("id = ?", fixture.Order.ID).
+		Updates(map[string]any{"status": "cancelled", "handoff_status": "cancelled"}).Error; err != nil {
+		t.Fatalf("cancel order failed: %v", err)
+	}
+
+	paidAt := time.Date(2026, 9, 15, 23, 22, 47, 0, time.UTC)
+	if err := repo.confirmPaid(t.Context(), &fixture.Payment, "paid", paidAt, map[string]string{
+		"provider_order_id": "PROVIDERLP01",
+	}, channelSourceNotify); err != nil {
+		t.Fatalf("confirmPaid() error = %v, want nil so the channel stops retrying", err)
+	}
+
+	var payment model.PaymentOrder
+	if err := db.First(&payment, fixture.Payment.ID).Error; err != nil {
+		t.Fatalf("find payment failed: %v", err)
+	}
+	if payment.Status != "paid" {
+		t.Fatalf("payment status = %q, want paid", payment.Status)
+	}
+	if payment.PaidAt == nil {
+		t.Fatal("payment paid_at = nil, want the channel pay time")
+	}
+	if payment.ProviderOrderID != "PROVIDERLP01" {
+		t.Fatalf("provider order id = %q, want PROVIDERLP01", payment.ProviderOrderID)
+	}
+
+	var order model.RentalOrder
+	if err := db.First(&order, fixture.Order.ID).Error; err != nil {
+		t.Fatalf("find order failed: %v", err)
+	}
+	if order.Status != "cancelled" {
+		t.Fatalf("order status = %q, want cancelled (payment must not revive it)", order.Status)
+	}
+}
+
+// TestConfirmPaidDoesNotAutoRefundUnpayableOrder 退款一律由客服人工发起，
+// 入账路径不能自己动钱。
+func TestConfirmPaidDoesNotAutoRefundUnpayableOrder(t *testing.T) {
+	db := setupPaymentTestDB(t)
+	repo := NewRepository(db, nil, ordermodule.NewRepository(db))
+	fixture := createPayableOrderFixture(t, db, "LP02", true)
+	if err := db.Model(&model.RentalOrder{}).Where("id = ?", fixture.Order.ID).
+		Update("status", "closed").Error; err != nil {
+		t.Fatalf("close order failed: %v", err)
+	}
+
+	if err := repo.confirmPaid(t.Context(), &fixture.Payment, "paid", time.Now(), map[string]string{
+		"provider_order_id": "PROVIDERLP02",
+	}, channelSourceNotify); err != nil {
+		t.Fatalf("confirmPaid() error = %v", err)
+	}
+
+	var refundCount int64
+	if err := db.Model(&model.PaymentOrder{}).
+		Where("order_id = ? AND biz_type <> ?", fixture.Order.ID, "order_pay").
+		Count(&refundCount).Error; err != nil {
+		t.Fatalf("count refunds failed: %v", err)
+	}
+	if refundCount != 0 {
+		t.Fatalf("refund payment count = %d, want 0 (refund must stay manual)", refundCount)
+	}
+
+	var order model.RentalOrder
+	if err := db.First(&order, fixture.Order.ID).Error; err != nil {
+		t.Fatalf("find order failed: %v", err)
+	}
+	if order.RefundStatus == "refunded" || order.RefundStatus == "refunding" {
+		t.Fatalf("order refund status = %q, want untouched", order.RefundStatus)
+	}
+}
+
+// TestConfirmPaidSettlementIsIdempotent 乐刷会重试十次同一个回调，重复落账不能出错。
+func TestConfirmPaidSettlementIsIdempotent(t *testing.T) {
+	db := setupPaymentTestDB(t)
+	repo := NewRepository(db, nil, ordermodule.NewRepository(db))
+	fixture := createPayableOrderFixture(t, db, "LP03", true)
+	if err := db.Model(&model.RentalOrder{}).Where("id = ?", fixture.Order.ID).
+		Update("status", "cancelled").Error; err != nil {
+		t.Fatalf("cancel order failed: %v", err)
+	}
+
+	paidAt := time.Date(2026, 9, 15, 23, 22, 47, 0, time.UTC)
+	for i := 0; i < 3; i++ {
+		if err := repo.confirmPaid(t.Context(), &fixture.Payment, "paid", paidAt.Add(time.Duration(i)*time.Minute), map[string]string{
+			"provider_order_id": "PROVIDERLP03",
+		}, channelSourceNotify); err != nil {
+			t.Fatalf("confirmPaid() attempt %d error = %v", i+1, err)
+		}
+	}
+
+	var payment model.PaymentOrder
+	if err := db.First(&payment, fixture.Payment.ID).Error; err != nil {
+		t.Fatalf("find payment failed: %v", err)
+	}
+	if payment.Status != "paid" {
+		t.Fatalf("payment status = %q, want paid", payment.Status)
+	}
+	// 首次落账的时间必须保留，后续重试不能把 paid_at 往后推。
+	if payment.PaidAt == nil || !payment.PaidAt.UTC().Equal(paidAt) {
+		t.Fatalf("payment paid_at = %v, want %v", payment.PaidAt, paidAt)
+	}
+}
+
+// TestConfirmPaidKeepsErrorForUnrelatedFailures 只有「订单再也无法入账」才走落账。
+// 其他错误仍要原样抛出，否则会把真正的故障当成已处理而静默掉。
+func TestConfirmPaidKeepsErrorForUnrelatedFailures(t *testing.T) {
+	db := setupPaymentTestDB(t)
+	repo := NewRepository(db, nil, nil)
+	fixture := createPayableOrderFixture(t, db, "LP04", true)
+
+	err := repo.confirmPaid(t.Context(), &fixture.Payment, "paid", time.Now(), map[string]string{}, channelSourceNotify)
+	if !errors.Is(err, ErrDependencyUnavailable) {
+		t.Fatalf("confirmPaid() error = %v, want ErrDependencyUnavailable", err)
+	}
+
+	var payment model.PaymentOrder
+	if findErr := db.First(&payment, fixture.Payment.ID).Error; findErr != nil {
+		t.Fatalf("find payment failed: %v", findErr)
+	}
+	if payment.Status != "paying" {
+		t.Fatalf("payment status = %q, want paying", payment.Status)
+	}
+}
+
+func TestIsOrderUnpayable(t *testing.T) {
+	cases := []struct {
+		name string
+		err  error
+		want bool
+	}{
+		{"订单已取消或已关单", ordermodule.ErrOrderCannotPay, true},
+		{"商品已被他人租走", ordermodule.ErrListingUnavailable, true},
+		{"依赖缺失", ErrDependencyUnavailable, false},
+		{"无错误", nil, false},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := isOrderUnpayable(tc.err); got != tc.want {
+				t.Fatalf("isOrderUnpayable(%v) = %v, want %v", tc.err, got, tc.want)
+			}
+		})
+	}
+}

backend/internal/modules/payment/notify.go

@@ -50,7 +50,19 @@ func (r *Repository) HandleNotify(ctx context.Context, provider string, params m
 		return nil, ErrPaymentVerifyFailed
 	}
 	raw := withNotifyDiagnostic(params, rawPayload, contentType, verify, "verified")
-	if err := r.applyChannelStatus(ctx, payment, normalizeNotifyPaymentStatus(runtimeConfig.Provider, params["status"]), params["pay_time"], raw, channelSourceNotify); err != nil {
+	channelStatus := normalizeNotifyPaymentStatus(runtimeConfig.Provider, params["status"])
+	if err := r.applyChannelStatus(ctx, payment, channelStatus, params["pay_time"], raw, channelSourceNotify); err != nil {
+		// 入口处的 WARN 只有渠道参数，定位不到是哪个订单哪笔支付单，这里补齐上下文。
+		r.log().Warn("支付回调入账失败", paymentLogFields(ctx, appendFields(
+			paymentOrderFields(payment),
+			runtimeConfigFields(runtimeConfig),
+			[]zap.Field{
+				zap.String("channel_status", channelStatus),
+				zap.String("order_status", r.orderStatus(ctx, payment.OrderID)),
+				zap.Error(err),
+			},
+		)...,
+		)...)
 		return nil, err
 	}
 	return &NotifyResult{OK: true, Message: "000000"}, nil