platform orders: mark activated guard for renewal missing subscription

app/Http/Controllers/Admin/PlatformOrderController.php

@@ -1073,6 +1073,11 @@ class PlatformOrderController extends Controller
     {
         $admin = $this->ensurePlatformAdmin($request);
 
+        // 治理优先：续费单必须绑定订阅（兼容历史脏数据/手工改库等场景）
+        if ((string) ($order->order_type ?? '') === 'renewal' && ! (int) ($order->site_subscription_id ?? 0)) {
+            return redirect()->back()->with('warning', '当前订单类型为「续费」，但未绑定订阅（site_subscription_id 为空）。为避免续期串单，请先补齐订阅关联后再标记为已生效。');
+        }
+
         // 仅标记“已生效”：用于处理已支付但未生效的订单（不改 payment_status）
         if ($order->payment_status !== 'paid') {
             return redirect()->back()->with('warning', '当前订单尚未支付，无法仅标记为已生效。');

tests/Feature/AdminPlatformOrderMarkActivatedRenewalMissingSubscriptionShouldGuardTest.php

@@ -0,0 +1,67 @@
+<?php
+
+namespace Tests\Feature;
+
+use App\Models\Merchant;
+use App\Models\Plan;
+use App\Models\PlatformOrder;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Tests\TestCase;
+
+class AdminPlatformOrderMarkActivatedRenewalMissingSubscriptionShouldGuardTest extends TestCase
+{
+    use RefreshDatabase;
+
+    protected function loginAsPlatformAdmin(): void
+    {
+        $this->seed();
+
+        $this->post('/admin/login', [
+            'email' => 'platform.admin@demo.local',
+            'password' => 'Platform@123456',
+        ])->assertRedirect('/admin');
+    }
+
+    public function test_mark_activated_should_be_blocked_when_renewal_order_missing_subscription(): void
+    {
+        $this->loginAsPlatformAdmin();
+
+        $merchant = Merchant::query()->firstOrFail();
+        $plan = Plan::query()->create([
+            'code' => 'po_mark_activated_renewal_missing_sub_plan',
+            'name' => '仅标记生效阻断（续费缺订阅）测试套餐',
+            'billing_cycle' => 'monthly',
+            'price' => 10,
+            'list_price' => 10,
+            'status' => 'active',
+            'sort' => 10,
+            'published_at' => now(),
+        ]);
+
+        $order = PlatformOrder::query()->create([
+            'merchant_id' => $merchant->id,
+            'plan_id' => $plan->id,
+            'order_no' => 'PO_MARK_ACT_RENEW_NO_SUB_0001',
+            'order_type' => 'renewal',
+            'status' => 'pending',
+            'payment_status' => 'paid',
+            'plan_name' => $plan->name,
+            'billing_cycle' => $plan->billing_cycle,
+            'period_months' => 1,
+            'quantity' => 1,
+            'payable_amount' => 10,
+            'paid_amount' => 10,
+            'placed_at' => now()->subMinutes(10),
+            'paid_at' => now()->subMinutes(9),
+            'activated_at' => null,
+            'meta' => [],
+        ]);
+
+        $res = $this->post('/admin/platform-orders/' . $order->id . '/mark-activated');
+        $res->assertRedirect();
+        $res->assertSessionHas('warning');
+
+        $order->refresh();
+        $this->assertSame('pending', $order->status);
+    }
+}