fix(v2): 退款自愈扫描加回溯窗(防 LIMIT 尾部饥饿)+ 清死行

RefundApplyTask 的候选查询按 out_trade_no ASC/id ASC 取前 200,succeeded 退款历史
只增不减、partially_refunded 长期驻留,超过 limit 后最新的崩溃窗口永远排在候选外
扫不到。两路查询都加 since 回溯窗:RefundStore.ListDistinctOutTradeNosByStatusSince
(completed_at>=since)、OrderStore.ListOrdersByStatusSince(updated_at>=since),旧的
无窗方法原样保留。RefundApplyTask 新增 lookback/now 参数,config.ReconcileConfig 新增
RefundApplyLookbackMin(默认 48h)。顺带按 T6 复审补 OrderTTLMin 字段注释(须 ≫ crypto
orderTTL 15min),清 sync_test.go 死行 `_ = time.Second`。

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013nMthbVEmQquxBRKb9Fj8u

internal/store/order_query.go

@@ -175,6 +175,22 @@ func (s *OrderStore) ListOrdersByStatus(statuses []model.OrderStatusV2, limit in
 	return out, nil
 }
 
+// ListOrdersByStatusSince 同 ListOrdersByStatus,但加 updated_at>=since 回溯窗——
+// refunding/partially_refunded 是长期驻留态(订单进入后可能停留很久),不设窗口时
+// 会占满 limit 名额,把「近期才卡滞、需要自愈」的订单挤出候选(与
+// RefundStore.ListDistinctOutTradeNosByStatusSince 同一治法,同一 lookback 语义)。
+func (s *OrderStore) ListOrdersByStatusSince(statuses []model.OrderStatusV2, since time.Time, limit int) ([]model.OrderV2, error) {
+	if limit <= 0 || limit > 500 {
+		limit = 200
+	}
+	var out []model.OrderV2
+	if err := s.db.Where("status IN ? AND updated_at >= ?", statuses, since).
+		Order("id ASC").Limit(limit).Find(&out).Error; err != nil {
+		return nil, fmt.Errorf("store.ListOrdersByStatusSince: %w", err)
+	}
+	return out, nil
+}
+
 // ListAttemptsByChannelSince 列某渠道 created_at>=since 的 attempt(任意状态),
 // 供 orphan 扫描构造"已知期望金额集"(凡 pay 合法签发过的金额都不算孤儿)。
 func (s *OrderStore) ListAttemptsByChannelSince(channel string, since time.Time, limit int) ([]model.Attempt, error) {

internal/store/order_query_test.go

@@ -177,6 +177,37 @@ func TestListOrdersByStatus(t *testing.T) {
 	}
 }
 
+// TestListOrdersByStatusSinceExcludesStale 钉住回溯窗:updated_at 早于 since 的订单
+// 不应入候选(防 refunding/partially_refunded 长期驻留占满 LIMIT 名额——见 RefundApplyTask)。
+func TestListOrdersByStatusSinceExcludesStale(t *testing.T) {
+	db := model.OpenTestDB(t)
+	s := store.NewOrderStore(db)
+	now := time.Now()
+	stale := now.Add(-72 * time.Hour)
+	fresh := now.Add(-time.Hour)
+
+	if err := s.CreateOrder(&model.OrderV2{OutTradeNo: "O-STALE", AmountMinor: 100, Currency: "CNY", Status: model.OrderRefundingV2}); err != nil {
+		t.Fatal(err)
+	}
+	if err := db.Model(&model.OrderV2{}).Where("out_trade_no = ?", "O-STALE").Update("updated_at", stale).Error; err != nil {
+		t.Fatal(err)
+	}
+	if err := s.CreateOrder(&model.OrderV2{OutTradeNo: "O-FRESH", AmountMinor: 100, Currency: "CNY", Status: model.OrderRefundingV2}); err != nil {
+		t.Fatal(err)
+	}
+	if err := db.Model(&model.OrderV2{}).Where("out_trade_no = ?", "O-FRESH").Update("updated_at", fresh).Error; err != nil {
+		t.Fatal(err)
+	}
+
+	got, err := s.ListOrdersByStatusSince([]model.OrderStatusV2{model.OrderRefundingV2}, now.Add(-48*time.Hour), 50)
+	if err != nil {
+		t.Fatalf("list: %v", err)
+	}
+	if len(got) != 1 || got[0].OutTradeNo != "O-FRESH" {
+		t.Fatalf("只应命中窗内的 O-FRESH, got %+v", got)
+	}
+}
+
 // TestListAttemptsByChannelSince 供 orphan 扫描构造"已知期望金额集":同渠道、
 // created_at>=since、任意状态的 attempt(pending/paid/expired 都算——凡 pay
 // 合法签发过的金额都不算孤儿)。

internal/store/refund.go

@@ -144,6 +144,27 @@ func (s *RefundStore) ListDistinctOutTradeNosByStatus(status model.RefundStatus,
 	return out, nil
 }
 
+// ListDistinctOutTradeNosByStatusSince 同 ListDistinctOutTradeNosByStatus,但加
+// completed_at>=since 回溯窗——防「LIMIT 尾部饥饿」:succeeded 退款历史只增不减,
+// 若不设窗口,按 out_trade_no ASC 取前 limit 条,超过 limit 后最新出现的"退款已成但
+// 订单卡 paid"崩溃窗口(本扫描要自愈的目标)会被排在候选之外、永远扫不到。completed_at
+// 是 MarkRefundStatus 翻成 succeeded/failed 时打的时间戳(即"进入该终态"的时刻),succeeded
+// 是终态、之后不会再被改动,用它做窗口锚点比 updated_at 更精确。调用方(RefundApplyTask)
+// 用 now-lookback 算 since,lookback 只覆盖近期崩溃窗口——历史一致性由已收敛状态保证,
+// 不需要扫全表。
+func (s *RefundStore) ListDistinctOutTradeNosByStatusSince(status model.RefundStatus, since time.Time, limit int) ([]string, error) {
+	if limit <= 0 || limit > 500 {
+		limit = 200
+	}
+	var out []string
+	if err := s.db.Model(&model.Refund{}).Where("status = ? AND completed_at >= ?", status, since).
+		Group("out_trade_no").Order("out_trade_no ASC").Limit(limit).
+		Pluck("out_trade_no", &out).Error; err != nil {
+		return nil, fmt.Errorf("store.ListDistinctOutTradeNosByStatusSince: %w", err)
+	}
+	return out, nil
+}
+
 // ListStuckRefunds 列 status 落在给定集合、且 updated_at 早于 before 的退款行,供
 // 「卡滞 processing/manual_pending 退款告警」只读观测扫描用(不改状态)。updated_at
 // 用作「进入当前状态」的近似时刻——本表除 MarkRefundStatus/CreateRefundGuarded 外

internal/store/refund_test.go

@@ -126,6 +126,29 @@ func TestListDistinctOutTradeNosByStatus(t *testing.T) {
 	}
 }
 
+// TestListDistinctOutTradeNosByStatusSinceExcludesStale 钉住回溯窗:completed_at
+// 早于 since 的 succeeded 退款不应入候选(防 LIMIT 尾部饥饿——见 RefundApplyTask)。
+func TestListDistinctOutTradeNosByStatusSinceExcludesStale(t *testing.T) {
+	db := model.OpenTestDB(t)
+	rs := NewRefundStore(db)
+	now := time.Now()
+	stale := now.Add(-72 * time.Hour)
+	fresh := now.Add(-time.Hour)
+
+	_ = rs.CreateRefund(&model.Refund{RefundID: "s-stale", OutTradeNo: "PAY-STALE", AmountMinor: 100, Currency: "CNY",
+		Status: model.RefundSucceeded, CompletedAt: &stale})
+	_ = rs.CreateRefund(&model.Refund{RefundID: "s-fresh", OutTradeNo: "PAY-FRESH", AmountMinor: 100, Currency: "CNY",
+		Status: model.RefundSucceeded, CompletedAt: &fresh})
+
+	got, err := rs.ListDistinctOutTradeNosByStatusSince(model.RefundSucceeded, now.Add(-48*time.Hour), 50)
+	if err != nil {
+		t.Fatalf("list: %v", err)
+	}
+	if len(got) != 1 || got[0] != "PAY-FRESH" {
+		t.Fatalf("只应命中窗内的 PAY-FRESH, got %+v", got)
+	}
+}
+
 // TestListStuckRefunds 供「卡滞 processing/manual_pending 退款告警」:只挑 updated_at
 // 早于阈值的 processing/manual_pending 行,requested/succeeded/failed 不命中。
 func TestListStuckRefunds(t *testing.T) {