[daliu]

Closes #165

Outcome

Adds the first durable PAY-002B journal boundary. A server caller can atomically create one deterministic command record and its revision-1 audit event, or create neither. An exact retry is read-only. A different command type, endpoint schema, or canonical payload fails as a conflict. Orphaned, malformed, timestamp-inconsistent, or future-version records fail closed without repair.

This is deliberately persistence only. It grants no lease, execution/send permission, Stripe action, result replay, endpoint, deployment, or production behavior.

Safety boundary

• Uses PAY-002B1 deterministic environment/caller-scoped identity.
• Stores no raw command UUID, caller identity, payload, PII, provider URL, or provider ID.
• Performs both reads before transaction creates.
• Uses transaction.create so races cannot overwrite either immutable record.
• Converts raw backend failures to fixed journal_unavailable output.
• Keeps runtime entrypoints unchanged; a static test scans all top-level runtime JavaScript imports.
• Defers leases/fencing to PAY-002B2B and provider-send ambiguity/reconciliation to PAY-002B2C.

Verification

• Focused unit suite: 43/43
• Dedicated Firestore emulator: 6/6
  • 24 concurrent identical calls
  • concurrent two-payload conflict
  • preseeded-audit atomic failure
  • lost-response retry
  • malformed timestamp rejection
  • future-version rejection
• Full Functions: 701 passed, 7 skipped
• Functions lint: passed
• Frontend: 132/132
• SPA navigation: 10/10
• Firestore Rules: 305/305
• Diagnostic frontend build: passed
• Diff, link, and sensitive-pattern checks: passed
• Three independent reviews: approved

Hosted CI intentionally does not run the opt-in dedicated Firestore emulator suite. The full local emulator evidence above is therefore separate from hosted evidence.

Compatibility and migration

Additive only. The new module is not imported by any runtime entrypoint, so existing production behavior and data are unchanged. No backfill is included. Retention or deletion remains blocked on #110 and requires an approved tombstone design.

Officer impact: None — this server-only module is unused by the live app and adds no officer task.

Officer documentation: None — no public content, navigation, admin duty, collected data, permission, deployment, payment operation, incident process, backup, or recovery behavior changes.

Deployment evidence: Source and local tests only before merge. No website publication, Firebase deployment, Stripe/provider configuration, or production behavior is claimed.

[netlify]

✅ Deploy Preview for luminous-fox-7c393f ready!

Name	Link
🔨 Latest commit	3c31139
🔍 Latest deploy log	https://app.netlify.com/projects/luminous-fox-7c393f/deploys/6a55180c121b750008a98ec0
😎 Deploy Preview	https://deploy-preview-166--luminous-fox-7c393f.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.