[daliu]

Closes #163

Officer impact: None. This adds an unused server-side safety contract. Checkout, refunds, admin actions, and officer procedures remain unavailable.

Officer documentation: None — no officer-visible behavior, procedure, permission, provider setting, or deployed surface changes.

Deployment evidence: Source and local-test evidence only before merge. No endpoint imports this module. No website publication, Firebase deployment, Stripe configuration, provider object, or production behavior is claimed.

Outcome

• Adds a versioned caller/environment/UUID command-key contract.
• Adds a distinct trusted-command/payload fingerprint for conflict detection.
• Adds deterministic, mode-bound Stripe idempotency keys for one immutable logical provider attempt.
• Rejects mutable, accessor, Proxy, cyclic, custom-prototype, unbounded, malformed-Unicode, or non-integer payload structures with fixed redacted errors.
• Splits pure PAY-002B1 identity from future PAY-002B2 journal persistence, leases, replay, recovery, and audit.
• Records the Stripe key-pruning boundary: exact POST retry is allowed only inside a conservative stored safe-send window; later or unknown-send outcomes stop and reconcile.

Exact boundary

Eight claimed paths only. No runtime endpoint, export/index, Firestore/Rules, package/lockfile, workflow, environment, UI, officer guide, provider setting, or production data changed.

Source SHA-256: 9458adfba96da5218f20df005dd8a268755bfb3a10ffb58755b8cd9a57781af7

Test SHA-256: db36cec470c6ddba4e8a80f9513cc7fb8319281a8ecde169f63dbeca74f624d1

Verification

• Node 20 focused command-identity tests: 91/91
• Node 20 full Functions tests: 658 passed, 1 intentional skip
• Node 20 frontend tests: 132/132
• Node 20 SPA navigation: 10/10
• Java 17 demo-only Firestore Rules: 305/305
• Functions lint, syntax, diagnostic production build, diff check, relative-link check, and credential-pattern scan: passed
• Independent exact-snapshot code review: approved
• Independent exact-snapshot adversarial security review: approved
• Independent exact-snapshot documentation/scope review: approved

[netlify]

✅ Deploy Preview for luminous-fox-7c393f ready!

Name	Link
🔨 Latest commit	3005fbb
🔍 Latest deploy log	https://app.netlify.com/projects/luminous-fox-7c393f/deploys/6a550ff61ece23000829a97c
😎 Deploy Preview	https://deploy-preview-164--luminous-fox-7c393f.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.