Loan-Draw Review Controls

01Problem问题

Construction-loan draws are paid in stages. An AI check can flag a missing invoice, but the decision to wire money has to stay with people, and a retry or a race must never fund a draw twice.建筑贷款按阶段放款。AI 可以标记缺失的发票，但汇款决定必须留在人手里，重试或竞态也绝不能让同一笔提款放两次。

02What I built我做了什么

• Two-person (maker-checker) approval for higher-risk draws, behind a feature flag.高风险提款采用双人（制单-复核）审批，置于功能开关之后。
• Loan-level PostgreSQL row locks, a repeat-funding check and a partial unique index on the wire reference.贷款级 PostgreSQL 行锁、重复放款检查，以及电汇编号上的部分唯一索引。
• Hash-chained audit records with a verification routine.带验证程序的哈希链审计记录。
• Transactional outbox and Temporal recovery for draw verification, with a partial unique index that prevents two verification runs at once.为提款核验加入事务性 outbox 与 Temporal 恢复，并用部分唯一索引防止两次核验同时运行。
• A release gate that replaced a deploy workflow which hid failed migrations: verified backup, preflight checks, migration, health check and rollback, plus a regression gate that blocks any new test failure.发布闸门：替换了一个会隐藏迁移失败的部署流程——先做经过验证的备份、预检、迁移、健康检查，失败即回滚；另有回归闸门，任何新增的测试失败都会被拦下。

03Measured测量结果

04Limits, stated plainly局限，直说

• Not yet deployed, and dual approval stays off until the loan portal supports a pending-approval state. Employer code is private; this page describes the design only.尚未部署；在贷款门户支持“待审批”状态前，双人审批保持关闭。雇主代码不公开，本页只描述设计。