fix(stability): 支付并发事务内加锁、组合支付流水记录、省市区树形缓存与地址安全防越权 (TDD)

application/admin/command/ShoproPayReconcile.php

@@ -108,15 +108,14 @@ class ShoproPayReconcile extends Command
             return true;
         }
 
-        // 与 Pay::notifyx 回调相同的完成路径：加锁复查 + 事务 + paymentProcess
-        $order = Order::nopay()->where('order_sn', $orderSn)->lock(true)->find();
-        if (!$order) {
-            // 已被回调或其他进程完成
-            $output->info("skip {$orderSn}: already processed");
-            return false;
-        }
+        // 与 Pay::notifyx 回调相同的完成路径：事务内加排他锁复查 + paymentProcess
+        $isCompleted = false;
+        Db::transaction(function () use ($orderSn, $paidInfo, $gateway, &$isCompleted) {
+            $order = Order::nopay()->where('order_sn', $orderSn)->lock(true)->find();
+            if (!$order) {
+                return;
+            }
 
-        Db::transaction(function () use ($order, $orderSn, $paidInfo, $gateway) {
             $notify = [
                 'order_sn'       => $orderSn,
                 'transaction_id' => $paidInfo['transaction_id'],
@@ -127,8 +126,15 @@ class ShoproPayReconcile extends Command
                 'pay_type'       => $order->pay_type == 'group' ? 'group' : $gateway,
             ];
             $order->paymentProcess($order, $notify);
+            $isCompleted = true;
         });
 
+        if (!$isCompleted) {
+            // 已被回调或其他进程完成
+            $output->info("skip {$orderSn}: already processed");
+            return false;
+        }
+
         $msg = "pay-reconcile completed {$orderSn} ({$paidInfo['pay_fee']})";
         Log::write($msg);
         $output->info($msg);