PAY-002B2C3A — Freeze the closed Stripe reconciliation decision contract #184

Officer impact: None. This child adds an unused server-only policy and tests. It changes no current checkout, payment, refund, or officer procedure.

Officer documentation: None — no public page, officer duty, provider account, deployment, or production behavior changes.

Deployment evidence: Source/tests only. Closure must explicitly say whether website, runmprc.com, Firebase, Stripe/provider configuration, and production behavior were changed; no green workflow proves those surfaces live.

Problem

PAY-002B2C2/#182 safely stops automatic POST retries when the original attempt is old or ambiguous. The next boundary must not turn a timeout, connection loss, Stripe 5xx, pruned idempotency key, missing reference, 404, or partial/empty search into permission for attempt 2.

A persistence or runtime API would be premature until the allowed evidence matrix is closed and exhaustively tested. Current C2 source also does not record a complete dispatch/response history.

Atomic outcome

Add one pure CommonJS classifier for attempt-1 reconciliation evidence. It returns only fixed frozen classifications:

• existing_attempt_found — exact verified attempt-1 provider evidence exists; do not advance.
• new_attempt_candidate — evidence is structurally sufficient for a later persistence/authorization review, but this result is not permission to send.
• reconciliation_required — outcome remains unsafe or unknown; do not advance.

The first version may produce new_attempt_candidate only for:

1. a complete trusted dispatch history proving endpoint execution never began, with exact plan binding and an explicitly eligible same logical operation; or
2. an exact verified attempt-1 Checkout Session that is terminal expired, unpaid, bound to the exact plan, supported by verified expiry evidence, and paired with an explicitly eligible new logical generation.

An exact open attempt, or exact completed paid/no-payment-required attempt with verified success evidence, may produce only existing_attempt_found.

Every other valid evidence combination produces reconciliation_required. Invalid/schema-hostile input fails with one fixed non-identifying error.

Non-negotiable exclusions

• No Firestore read/write or reconciliation record.
• No Stripe/network/provider call or SDK dependency.
• No provider-object ID, idempotency key, account, metadata, amount, member, order, or registration value in input/output.
• No runtime/index import.
• No send/execute/advance authorization, attempt-2 plan/key/document, response replay, or business transition.
• No caller-selected free text, URLs, status codes, timestamps, reason strings, or booleans that can bypass the closed enum matrix.
• No package/lock/workflow/Rules source/provider configuration/production data/officer procedure change.

Exact owned paths

• new functions/commerceProviderReconciliation.js
• new functions/commerceProviderReconciliation.test.js
• STRIPE_COMMERCE_DESIGN.md
• SYSTEM_DESIGN.md
• SECURITY.md
• IMPLEMENTATION_PLAN.md
• GITHUB_ISSUES.md
• GITHUB_ISSUE_SLICES.md

All other paths are excluded, especially functions/commerceCommandJournal.js, checkout creators, webhook runtime, index, Rules, package/lock/workflows, account/email/profile code, and officer docs.

Acceptance

• Exact root fields, schema version, provider stripe, and attempt 1 only.
• Closed enum matrix covers complete dispatch-never-began, exact open/success/expired provider evidence, and every unsafe/contradictory combination.
• Timeout, connection loss, 409/424/429/5xx, old/pruned key, missing reference, 404 without an exact known object, empty/partial search, unknown/open/complete-processing/conflicting Session evidence never produces a candidate.
• Results and error text are fixed/frozen and contain no input.
• Extra/missing/inherited/symbol fields, accessors, proxies, custom prototypes, invalid Unicode, unknown/future enums, and mutation attempts fail closed without invoking traps.
• Static tests prove no Firebase, Stripe, network, logger, environment, clock, random, filesystem, dynamic import, or runtime/index adoption.
• Focused and full Node 20 Functions suites, frontend suite/build, Rules suite, and workflow/artifact guards pass.
• Security, test/coverage, and documentation reviews approve the exact diff.

Dependencies and follow-ups

Dependencies complete: PAY-002B2C2/#182 merged as 95be260d08377b7e931dd3526da91b59c5fbf755; PAY-003A/#101 evidence vocabulary is merged.

This child does not complete PAY-002B2C3. Follow-ups remain:

• C3B: persist immutable paired reconciliation evidence only after a trusted verifier can produce it.
• C3C: authorize/version a later provider attempt only after persisted proof plus business transition and a fresh lease.
• PAY-001B/C, PAY-002C/D, PAY-003B, RACE/MERCH capacity/inventory, runtime adoption, protected deployment, and live verification.