fix(payments): Phase 3 — 二重決済・受注消失・ガス濫用・x402 取りこぼしを塞ぐ

.env.local.example

@@ -634,8 +634,18 @@ RELAY_MAX_JPYC=
 # 注: mainnet (Polygon 137) を self-host で relay するには KV (KV_REST_API_URL/TOKEN) 必須。
 # 未設定だと idempotency が fail-open になり二重 submit リスク → mainnet は 503 kv_required で拒否。
 # B4 circuit breaker: chain 日次の relay 件数上限 (Sybil による POL 枯渇 griefing を止める)。
-# 空 = 既定 500。KV (Upstash) 設定時のみ機能・fail-open (KV 障害は通す)。UTC 日付でカウント。
+# 空/不正/巨大値 = 既定 500。非負の有限 safe integer のみ有効。KV (Upstash) 設定時のみ機能・
+# fail-open (KV 障害は通す)。UTC 日付でカウント。
 RELAY_DAILY_TX_CAP=
+# forwarder の回収額が chain 別ガスフロア未満になる settle 専用の別枠 (UTC 日次・chain 単位)。
+# 共有 RELAY_DAILY_TX_CAP より先に評価し、低回収 settle が通常の gasless 枠を枯らすのを防ぐ。
+# 空/不正/巨大値 = 実効共有枠の 20% (整数切捨て、共有枠 500 なら 100)。共有枠が正なら明示値も
+# 共有枠未満へ clamp (共有枠 1 なら 0)。0 にすると sub-floor settle を停止。
+RELAY_SUBFLOOR_DAILY_TX_CAP=
+# 同じ署名済み払い元が上の専用枠を単独で枯らさないための UTC 日次上限 (chain + payer 単位)。
+# 空/不正/巨大値 = 実効専用枠の 20% (整数切捨て、専用枠 100 なら 20)。専用枠 > 1 なら明示値も
+# 専用枠未満へ clamp。専用枠 1 なら最大 1、専用枠 0 なら 0。Sybil は上の chain 単位枠で止める。
+RELAY_SUBFLOOR_PAYER_DAILY_TX_CAP=
 # B5 赤字防止: 1 tx の native (POL) gas コスト上限 (wei)。gas見積×gasPrice がこれを超える高騰時は
 # relay せず standard モードへ倒す。空/0 = 無効 (testnet 既定)。mainnet は回収 fee 相当額に設定。
 # 例: 0.01 POL = 10000000000000000 (回収 fee 2 JPYC が賄える範囲で worst-case を弾く値にする)。

README.md

@@ -226,6 +226,7 @@ The table below is a **curated subset** (core setup + production feature flags).
 | `NEXT_PUBLIC_*_RPC_URL` | Custom RPC per chain | recommended on prod |
 | `NEXT_PUBLIC_SENTRY_DSN` / `SENTRY_AUTH_TOKEN` | Sentry client + source-map upload | recommended on prod |
 | `KV_REST_API_URL` / `KV_REST_API_TOKEN` | Vercel KV — payment log **and** SIWE sessions / **encrypted** freee tokens / entitlements | optional (required for SIWE + freee sync) |
+| `RELAY_DAILY_TX_CAP` / `RELAY_SUBFLOOR_DAILY_TX_CAP` / `RELAY_SUBFLOOR_PAYER_DAILY_TX_CAP` | Server-only UTC-day circuit breakers for all relay traffic, sub-floor forwarder settlements, and each signed sub-floor payer. Only non-negative finite safe integers are accepted; invalid or oversized values use safe defaults. The shared default is **500**. An unset sub-floor cap is 20% of the effective shared cap (**100** by default), and an unset payer cap is 20% of the effective sub-floor cap (**20** by default), rounded down. When the shared cap is positive, the effective sub-floor cap is clamped below it (shared `1` ⇒ sub-floor `0`); when the sub-floor cap is above `1`, the payer cap is clamped below it (sub-floor `1` allows at most payer `1`). Sub-floor `0` keeps both sub-floor caps stopped. Requires KV; storage failures follow the existing fail-open policy. | optional (recommended on prod) |
 | `IP_HASH_SECRET` | Server-only HMAC secret for best-effort IP rate limits on auth and resource-write endpoints. Generate with `openssl rand -base64 32`; unset or shorter than 32 bytes makes the IP limiter inert. Self-hosted deployments must use a trusted proxy that overwrites client-supplied `X-Forwarded-For`. | optional (recommended on prod) |
 | `PAYMENT_LOG_ADMIN_TOKEN` | Bearer for `/api/log/payment/export` + `/stats` | optional |
 | `ADMIN_WALLETS` | Comma-separated wallet addresses allowed to read `/api/admin/billing/revenue` (requires a valid SIWE session **and** the wallet in this allowlist). Empty/unset ⇒ admin endpoints are closed (fail-closed). | optional |