fix(payment): harden payment and refund chains

src/AKSRT/Payment/OrderRepositoryCore.php

@@ -236,9 +236,29 @@ trait OrderRepositoryCore {
             $format[] = '%s';
         }
 
-        $result = $wpdb->update($this->table(), $update_data, ['order_number' => $order_number], $format, ['%s']);
+        // Compare-and-swap the status so concurrent callbacks cannot both win the
+        // first paid transition and trigger fulfillment twice.
+        $result = $wpdb->update(
+            $this->table(),
+            $update_data,
+            ['order_number' => $order_number, 'status' => $current_status],
+            $format,
+            ['%s', '%s']
+        );
 
-        if ($result !== false) {
+        if ($result === false) {
+            return false;
+        }
+
+        if ($result === 0) {
+            if (!empty($extra['require_transition'])) {
+                return false;
+            }
+            $latest = $this->get($order_number);
+            return is_array($latest) && ($latest['status'] ?? '') === $new_status;
+        }
+
+        if ($result > 0) {
             // 到账事件：让充值/VIP/商品履约等挂接（单一履约入口）。
             // 仅在「首次」转为 paid 时触发，避免回调多次到达重复履约。
             if ($new_status === \AKSRT\Core\DomainModel::ORDER_STATUS_PAID && $current_status !== \AKSRT\Core\DomainModel::ORDER_STATUS_PAID) {