fix: 付费块文章解锁无响应——unlockPost 守卫误用 canReadPost

付费块文章的整篇是公开的，canReadPost 恒为 true，导致解锁请求被"已有权限"守卫拦截直接跳回文章页，不创建订单。改为按 canReadPaidContent 判断（能否读付费内容），并补回归测试：付费块解锁→创建订单→沙箱支付→[paid] 块可见

plugins/neatstudio.membership/src/Http/MembershipController.php

@@ -78,8 +78,9 @@ class MembershipController
     {
         $user = $request->user();
 
-        // 已有阅读权限（会员 / 作者 / 已解锁）：直接查看文章，避免重复支付
-        if ($this->service->canReadPost($user, $post)) {
+        // 已能读付费内容（会员 / 作者 / 已解锁）：直接查看文章，避免重复支付。
+        // 注意：付费块文章的整篇是公开的，不能用 canReadPost 判断（否则永远"已有权限"）
+        if ($this->service->canReadPaidContent($user, $post)) {
             return redirect()->route('posts.show', $post->slug ?? $post->id);
         }
 

tests/Feature/MembershipFlowTest.php

@@ -186,6 +186,35 @@ class MembershipFlowTest extends TestCase
         $this->assertSame(0, Payment::query()->count());
     }
 
+    public function test_unlock_paid_block_creates_payment_for_non_member(): void
+    {
+        $post = Post::create([
+            'title' => '付费块文章',
+            'slug' => 'paid-block-unlock',
+            'content' => "开头\n\n[paid]\n隐藏付费块\n[/paid]\n\n结尾",
+            'content_format' => 'markdown',
+            'status' => 'published',
+            'published_at' => now(),
+            'meta' => ['price' => 500],
+        ]);
+
+        // 付费块文章的整篇公开，但 [paid] 块不可读——解锁必须创建订单，不能误判为"已有权限"
+        $this->actingAs($this->user)
+            ->post('/posts/'.$post->id.'/unlock')
+            ->assertRedirect(route('pay.checkout', Payment::first()));
+
+        $payment = Payment::query()->where('user_id', $this->user->id)->first();
+        $this->assertNotNull($payment);
+        $this->assertTrue($payment->payable->is($post));
+        $this->assertSame('pending', $payment->status);
+
+        // 沙箱支付后 [paid] 块可见
+        $this->actingAs($this->user)->post('/pay/sandbox/'.$payment->order_no.'/confirm');
+        $this->actingAs($this->user)->get('/posts/paid-block-unlock.shtml')
+            ->assertOk()
+            ->assertSee('隐藏付费块');
+    }
+
     public function test_members_only_post_shows_paywall_to_guest(): void
     {
         $post = Post::create([