feat(runtime): mock-L1 auction MVP round 9 unlist recovery

Add seller unlist reclaim after list or settlement_failed, plus Explorer
Mark failed / Cancel sell / Unlist CTAs and wire/RULES sync.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: CoNETProject

docs/mock-l1-auction-mvp.md

@@ -85,6 +85,16 @@ CoNET mainnet may already host `DLEChainRegistry1155V1`; this MVP still uses **l
 3. CLI: `preflight --candidateHash 0x…`.
 4. Explorer **Preflight** CTA + Settlement summary fee line (`feeAmount` / scanner / committee); settle / one-shot errors may prefix `Preflight:`.
 
+## MVP round 9 (2026-08)
+
+1. **`MockDleAuctionSettlement.unlist(sellerOrderHash)`**: seller-only reclaim when listing exists and not settled; emits `Unlisted`; deletes listing and returns NFT.
+2. Shared helper **`unlistMockL1Auction`** (`shared/mockL1Settle.ts`); Archive hook `submitL1UnlistTx`.
+3. Archive **`POST /trade/unlist`**: body `{ candidateHash, sellerPrivateKey }` (lab session key; **not** stored). Requires `listTxHash`; phase `match_certified` **or** `settlement_failed`. On success: set `unlistTxHash`, **clear `listTxHash`**, clear list errors; **do not** change phase. WAL `trade-unlist`.
+4. Lab recovery: `POST /trade/settle` with `outcome: 'failed'` → `settlement_failed` + `settlementError` (then unlist to reclaim escrow).
+5. CLI: `unlist --candidateHash 0x… --pk HEX`.
+6. Explorer: **Unlist escrow** / **Mark failed** / **Cancel sell order** CTAs; Settlement summary shows `unlistTxHash` / `unlistError` / `settlementError`; health pill `unlist:`.
+7. `/health`: `tradeUnlistConfigured` / `tradeUnlistMode` (`rpc` | `hook`).
+
 ## Fee
 
 ```

docs/mock-l1-auction-wire.md

@@ -25,12 +25,15 @@ All payloads below are **`mockL1Only: true`**. HTTP JSON only; Archive validates
 | `POST` | `/trade/candidate` | Submit `MockL1MatchCandidateV1` |
 | `POST` | `/trade/check` | Archive legality. With `MOCK_L1_RPC_URL` + `MOCK_L1_SETTLEMENT` (or custody hook), **eth_call / hook** — client `l1EscrowCustody` flags **ignored**. Otherwise lab flags fallback |
 | `POST` | `/trade/attest` | Freeze pool → draw → collect → certificate |
-| `POST` | `/trade/settle` | Mode A settlement transition (mock L1 settle separate) |
+| `POST` | `/trade/list` | Escrow NFT into settlement (`listTxHash`); needs `sellerPrivateKey` (session) |
+| `POST` | `/trade/unlist` | Seller reclaim after list / on `settlement_failed`; clears `listTxHash`, sets `unlistTxHash` |
+| `POST` | `/trade/approve` | Buyer ERC-20 approve for settlement |
+| `POST` | `/trade/settle` | Mode A settlement; `outcome: 'failed'` → `settlement_failed` (lab recovery) |
 | `GET` | `/trade/orders` | Order pool |
 | `GET` | `/trade/matches` | Match / cert timeline |
 | `GET` | `/trade/timeline` | Combined timeline |
 
-`/health` may include `tradeRpcCustodyConfigured` / `tradeRpcCustodyMode` (`rpc` | `hook` | `clientFlags`).
+`/health` may include `tradeRpcCustodyConfigured` / `tradeRpcCustodyMode` (`rpc` | `hook` | `clientFlags`), `tradeListConfigured` / `tradeListMode`, `tradeUnlistConfigured` / `tradeUnlistMode`, `tradeApproveConfigured` / `tradeApproveMode`, `tradeSettleConfigured` / `tradeSettleMode`, `tradeSettlePreflightConfigured` / `tradeSettlePreflightMode`.
 
 **Forbidden:** using `POST /ondemand/hook` or WaitingPool as this ingress.
 

explorer/README.md

@@ -19,7 +19,7 @@ Do **not** invent additional hostnames, and do **not** write this URL into Solid
 
 The UI uses a dark neon glass theme and the DLE mark in `explorer/public/dle-mark.png`. Events are listed **newest first**. There is no top navigation bar — main pages use a title capsule, detail pages use a circular back button, and section tabs stay in the footer.
 
-**Mock auction (local):** `/mock-auction` is a detail page for the mock-L1 EventIngress / match / certificate / settlement timeline. **MVP round 2:** session-only lab keys may sign sell/buy/attest (memory; never localStorage). Hash helpers: `explorer/src/lib/mockAuctionWire.ts` (no runtime import). **MVP round 4:** Settlement summary shows phase + real `settlementTxHash` capsules; **Archive settle** POSTs `/trade/settle` (authority stays on Archive). **MVP round 5:** **List NFT escrow** POSTs `/trade/list` with seller session key; summary shows `listTxHash`; health pill `list:`. **MVP round 6:** **Approve quote** POSTs `/trade/approve` with buyer session key; summary shows `approveTxHash`; health pill `approve:`. **MVP round 7:** one-shot **List → Approve → Settle**; Archive settle preflight gates list+approve (and optional RPC). **MVP round 8:** **Preflight** POSTs `/trade/preflight` (read-only); summary shows fee split. It is **not** CoNET mainnet and **not** production DePIN. Use the Home pill **Mock auction (local)** or navigate directly.
+**Mock auction (local):** `/mock-auction` is a detail page for the mock-L1 EventIngress / match / certificate / settlement timeline. **MVP round 2:** session-only lab keys may sign sell/buy/attest (memory; never localStorage). Hash helpers: `explorer/src/lib/mockAuctionWire.ts` (no runtime import). **MVP round 4:** Settlement summary shows phase + real `settlementTxHash` capsules; **Archive settle** POSTs `/trade/settle` (authority stays on Archive). **MVP round 5:** **List NFT escrow** POSTs `/trade/list` with seller session key; summary shows `listTxHash`; health pill `list:`. **MVP round 6:** **Approve quote** POSTs `/trade/approve` with buyer session key; summary shows `approveTxHash`; health pill `approve:`. **MVP round 7:** one-shot **List → Approve → Settle**; Archive settle preflight gates list+approve (and optional RPC). **MVP round 8:** **Preflight** POSTs `/trade/preflight` (read-only); summary shows fee split. **MVP round 9:** **Unlist escrow** / **Mark failed** / **Cancel sell order**; summary shows `unlistTxHash` / `settlementError`; health pill `unlist:`. It is **not** CoNET mainnet and **not** production DePIN. Use the Home pill **Mock auction (local)** or navigate directly.
 
 ## Run locally
 

explorer/RULES.md

@@ -118,11 +118,13 @@ Detail page (footer hidden). Local mock-L1 `/mockl1/*` + `/trade/*` against the
 
 **MVP round 8:** **Preflight** CTA POSTs read-only `/trade/preflight` (no phase change); Settlement summary shows certificate fee split (1 bps / scanner / committee); settle / one-shot errors may prefix `Preflight:`.
 
+**MVP round 9:** **Unlist escrow** POSTs `/trade/unlist` with seller session key (clears `listTxHash`, sets `unlistTxHash`; phase unchanged). **Mark failed** POSTs `/trade/settle` with `outcome: 'failed'`. **Cancel sell order** EIP-191 signs then POSTs `/trade/cancel`. Settlement summary shows `unlistTxHash` / `unlistError` / `settlementError`. Health pill `unlist:` from `tradeUnlistConfigured` / `tradeUnlistMode`.
+
 | Rule | Detail |
 |---|---|
 | Scope | Local Hardhat/Anvil mock network only |
-| UI | May sign client orders/attests/list/approve with session keys; may ask Archive to settle via HTTP; does **not** self-claim Archive legality / quorum; does **not** hold authority key or broadcast settle txs |
-| Labels | Always show `mockL1Only` / `notProductionDepin` pills; custody/list/approve/settle mode from health when trusted |
+| UI | May sign client orders/attests/list/approve/unlist/cancel with session keys; may ask Archive to settle/fail via HTTP; does **not** self-claim Archive legality / quorum; does **not** hold authority key or broadcast settle txs |
+| Labels | Always show `mockL1Only` / `notProductionDepin` pills; custody/list/approve/unlist/settle mode from health when trusted |
 | Forbidden | Painting as CoNET mainnet, production DePIN, or live CL RANDAO; persisting private keys; treating demo fake hashes as on-chain settles |
 
 ## Other Explorer invariants

explorer/src/pages/MockAuctionPage.tsx

@@ -24,10 +24,13 @@ type TradeMatchRow = {
   phase?: string
   listTxHash?: string
   listError?: string
+  unlistTxHash?: string
+  unlistError?: string
   approveTxHash?: string
   approveError?: string
   settlementTxHash?: string
   settlementError?: string
+  sell?: { orderHash?: string }
   certificate?: {
     certificateHash?: string
     clearingPrice?: string
@@ -47,6 +50,8 @@ type TradeHealth = {
   tradeListMode?: string
   tradeApproveConfigured?: boolean
   tradeApproveMode?: string
+  tradeUnlistConfigured?: boolean
+  tradeUnlistMode?: string
   tradeMockL1Settlement?: string | null
 }
 
@@ -59,6 +64,7 @@ type TradeHealth = {
  * Round 6: UI may POST /trade/approve with session buyer key for quote ERC-20 allowance.
  * Round 7: one-shot List → Approve → Settle; Archive settle preflight refuses settle without list+approve.
  * Round 8: read-only Preflight CTA + fee split on Settlement summary.
+ * Round 9: Unlist reclaim + Mark failed + Cancel sell order; Settlement summary shows unlistTxHash / settlementError.
  * mockL1Only — not production DePIN / not CoNET mainnet NFT.
  */
 export function MockAuctionPage() {
@@ -401,6 +407,81 @@ export function MockAuctionPage() {
     }
   }
 
+  /** Round 9: seller reclaim escrow after settlement_failed (or before settle). Clears listTxHash; no phase change. */
+  const runUnlist = async () => {
+    if (busy) return
+    setBusy(true)
+    setError(null)
+    try {
+      if (!candidateHash) throw new Error('candidateHash required')
+      if (!sellerPk.trim()) throw new Error('seller session private key required for unlist')
+      const out = await postJson('/trade/unlist', {
+        candidateHash,
+        sellerPrivateKey: sellerPk.trim(),
+      })
+      setActionLog(out)
+      if (out.status >= 400) setError(String((out.body as { error?: string }).error ?? 'unlist failed'))
+      await load()
+    } catch (e) {
+      setError(e instanceof Error ? e.message : String(e))
+    } finally {
+      setBusy(false)
+    }
+  }
+
+  /** Round 9: mark match settlement_failed (lab recovery path before/without on-chain settle). */
+  const runMarkFailed = async () => {
+    if (busy) return
+    setBusy(true)
+    setError(null)
+    try {
+      if (!candidateHash) throw new Error('candidateHash required')
+      const out = await postJson('/trade/settle', {
+        candidateHash,
+        outcome: 'failed',
+        error: 'marked failed from Explorer (lab)',
+      })
+      setActionLog(out)
+      if (out.status >= 400) setError(String((out.body as { error?: string }).error ?? 'mark failed'))
+      await load()
+    } catch (e) {
+      setError(e instanceof Error ? e.message : String(e))
+    } finally {
+      setBusy(false)
+    }
+  }
+
+  /** Round 9: cancel open sell order via EIP-191 (maker must match seller session key). */
+  const runCancelSell = async () => {
+    if (busy) return
+    setBusy(true)
+    setError(null)
+    try {
+      if (!sellerPk.trim()) throw new Error('seller session private key required for cancel')
+      const row = matchRows.find((m) => m.candidateHash.toLowerCase() === candidateHash.toLowerCase())
+      const orderHash =
+        row?.sell?.orderHash ??
+        (() => {
+          const o = orders as { orders?: Array<{ orderHash?: string; side?: number; cancelled?: boolean }> } | null
+          const openSell = o?.orders?.find(
+            (x) => String(x.side) === ORDER_SIDE_SELL && !x.cancelled,
+          )
+          return openSell?.orderHash
+        })()
+      if (!orderHash) throw new Error('sell orderHash required (select a candidate or submit a sell first)')
+      const wallet = new Wallet(sellerPk.trim())
+      const signature = await wallet.signMessage(orderPersonalSignMessage(orderHash))
+      const out = await postJson('/trade/cancel', { orderHash, signature })
+      setActionLog(out)
+      if (out.status >= 400) setError(String((out.body as { error?: string }).error ?? 'cancel failed'))
+      await load()
+    } catch (e) {
+      setError(e instanceof Error ? e.message : String(e))
+    } finally {
+      setBusy(false)
+    }
+  }
+
   const inputClass =
     'w-full rounded-lg border border-slate-600 bg-slate-950/80 px-3 py-2 text-sm text-slate-100 placeholder:text-slate-500'
 
@@ -411,6 +492,8 @@ export function MockAuctionPage() {
   const listReady = tradeHealth?.tradeListConfigured === true
   const approveMode = tradeHealth?.tradeApproveMode ?? 'unknown'
   const approveReady = tradeHealth?.tradeApproveConfigured === true
+  const unlistMode = tradeHealth?.tradeUnlistMode ?? 'unknown'
+  const unlistReady = tradeHealth?.tradeUnlistConfigured === true
 
   return (
     <DetailPageShell
@@ -430,6 +513,10 @@ export function MockAuctionPage() {
             label={approveReady ? `approve: ${approveMode}` : 'approve: off'}
             tone={approveReady ? 'ok' : 'warn'}
           />
+          <StatusPill
+            label={unlistReady ? `unlist: ${unlistMode}` : 'unlist: off'}
+            tone={unlistReady ? 'ok' : 'warn'}
+          />
           <StatusPill
             label={onChainReady ? `settle: ${settleMode}` : 'settle: off'}
             tone={onChainReady ? 'ok' : 'warn'}
@@ -440,10 +527,12 @@ export function MockAuctionPage() {
     >
       <p className="mb-6 max-w-3xl text-sm text-slate-300">
         Local archive routes <code className="text-cyan-200">/mockl1/*</code> and{' '}
-        <code className="text-cyan-200">/trade/*</code>. Session private keys sign orders/attests/list/approve
+        <code className="text-cyan-200">/trade/*</code>. Session private keys sign orders/attests/list/approve/unlist
         only and are never persisted. Seller must <code className="text-cyan-200">list</code> NFT into escrow and
         buyer must <code className="text-cyan-200">approve</code> quote ERC-20 before Archive{' '}
-        <code className="text-cyan-200">settle</code>. Custody and settle authority stay on Archive (
+        <code className="text-cyan-200">settle</code>. After <code className="text-cyan-200">settlement_failed</code>,
+        seller can <code className="text-cyan-200">unlist</code> to reclaim escrow (clears listTxHash; phase unchanged).
+        Custody and settle authority stay on Archive (
         <code className="text-cyan-200">MOCK_L1_*</code>) — this page never holds the authority key.
         WaitingPool / on-demand is not this ingress. Lab demo fake hashes ≠ local RPC{' '}
         <code className="text-cyan-200">settlementTxHash</code>.
@@ -634,17 +723,50 @@ export function MockAuctionPage() {
           >
             List → Approve → Settle
           </button>
+          <button
+            type="button"
+            disabled={busy || !sellerPk.trim() || !candidateHash.trim()}
+            className="rounded-full bg-teal-700 px-4 py-2 text-sm font-medium text-white disabled:opacity-50"
+            onClick={() => void runUnlist()}
+            aria-label="Unlist NFT from mock settlement escrow"
+            aria-busy={busy}
+          >
+            Unlist escrow
+          </button>
+          <button
+            type="button"
+            disabled={busy || !candidateHash.trim()}
+            className="rounded-full border border-amber-500/60 bg-amber-950/40 px-4 py-2 text-sm font-medium text-amber-100 disabled:opacity-50"
+            onClick={() => void runMarkFailed()}
+            aria-label="Mark match settlement failed"
+            aria-busy={busy}
+          >
+            Mark failed
+          </button>
+          <button
+            type="button"
+            disabled={busy || !sellerPk.trim()}
+            className="rounded-full border border-slate-500 bg-slate-800 px-4 py-2 text-sm font-medium text-slate-100 disabled:opacity-50"
+            onClick={() => void runCancelSell()}
+            aria-label="Cancel open sell order"
+            aria-busy={busy}
+          >
+            Cancel sell order
+          </button>
         </div>
         <p className="text-xs text-slate-500">
           Preflight is read-only (POST /trade/preflight): checks list+approve records and optional RPC
           eth_call; returns fee split; never changes phase. List uses the seller session key (must match
           sell maker). Approve uses the buyer session key (must match buy maker). Both required before
           on-chain settle; Archive preflight returns 400 without them (phase stays match_certified).
-          One-shot runs list → approve → settle and stops on first failure.
+          One-shot runs list → approve → settle and stops on first failure. Unlist reclaims escrow after
+          list (or after settlement_failed); clears listTxHash without changing phase. Mark failed posts
+          settle outcome=failed. Cancel sell uses EIP-191 on the open sell orderHash.
           {listReady ? ` List mode: ${listMode}.` : ' List env not configured — list will fail.'}
           {approveReady
             ? ` Approve mode: ${approveMode}.`
             : ' Approve env not configured — approve will fail.'}
+          {unlistReady ? ` Unlist mode: ${unlistMode}.` : ' Unlist env not configured — unlist will fail.'}
         </p>
       </section>
 
@@ -701,6 +823,13 @@ export function MockAuctionPage() {
                   <p className="mb-2 text-xs text-slate-500">No listTxHash yet (list NFT escrow first).</p>
                 )}
                 {m.listError ? <p className="mb-2 text-xs text-amber-300">{m.listError}</p> : null}
+                {m.unlistTxHash ? (
+                  <div className="mb-2 flex flex-wrap items-center gap-2">
+                    <span className="text-xs text-slate-400">unlistTxHash</span>
+                    <HashCapsule value={m.unlistTxHash} />
+                  </div>
+                ) : null}
+                {m.unlistError ? <p className="mb-2 text-xs text-amber-300">{m.unlistError}</p> : null}
                 {m.approveTxHash ? (
                   <div className="mb-2 flex flex-wrap items-center gap-2">
                     <span className="text-xs text-slate-400">approveTxHash</span>
@@ -719,7 +848,9 @@ export function MockAuctionPage() {
                   <p className="text-xs text-slate-500">No settlementTxHash yet (lab or pending).</p>
                 )}
                 {m.settlementError ? (
-                  <p className="mt-2 text-xs text-rose-300">{m.settlementError}</p>
+                  <p className="mt-2 text-xs text-rose-300" title="settlementError">
+                    {m.settlementError}
+                  </p>
                 ) : null}
               </li>
             ))}