[daliu]

Outcome

Adds an unused, server-only command lifecycle foundation that keeps the PAY-002B2A registration records immutable while preventing expired or superseded workers from finalizing a command.

Security contract

• Stores mutable lifecycle state separately under checkoutRequests/{commandKeyHash}/lifecycle/current.
• Uses a fixed 60-second lease, a command-bound fingerprint of a trusted UUIDv4 holder, and a monotonic fence.
• Treats same-holder recovery and exact terminal retries as read-only.
• Rejects stale holders, stale fences, malformed partner records, terminal conflicts, and clock-invalid mutations.
• Stores only a command-bound terminal commitment for success and no reason for fixed final failure.
• Never stores, logs, or returns the raw holder, raw terminal input, caller, command ID, payload, provider key, result pointer, or Firestore path.
• Grants no authorization, price/capacity/inventory decision, provider-send permission, result proof, or response replay.
• Adds recursive browser-deny Rules coverage for the server-only lifecycle subtree.

Compatibility and migration

There is no runtime adoption and no data migration. Existing PAY-002B2A command roots and revision-1 audits remain byte-preserving. The new source has no endpoint or Functions index export. PAY-002B2C still owns provider-plan binding, ambiguous-send handling, reconciliation, and safe provider-attempt advancement before any Stripe call can claim retry safety.

Verification

• Focused unit: 72/72
• Exact opt-in Firestore emulator: 15/15 on repeated independent runs
• Full Functions: 730 passed; 16 intentionally skipped emulator-gated tests
• Firestore Rules: 308/308
• Frontend: 134/134 on rebased main, including the merged header-clearance tests
• SPA navigation: 10/10
• Functions lint, changed-file ESLint, diff check, and diagnostic production build: passed
• Two independent exact-commit reviews: approved at 2a60a36
• Pull-request CI 29272779994: all four named jobs passed
• Post-merge CI 29272942326: all four named jobs passed at merge 2eff107

Clock/retry amendment and redacted pre-PR evidence: #169 (comment)

Officer impact: None. This is unused server-only safety source and synthetic tests; no officer workflow or public behavior changes.

Officer documentation: None — no public content, admin duty, collected data, permission, deployment step, payment/refund operation, backup, or recovery procedure changes. Engineering and security design/status documents are updated.

Deployment evidence: Source merged as 2eff107 and exact post-merge CI passed. Production release 29273070135 passed the exact-main/CI preflight, then failed closed before checkout/build because the required public App Check site-key variable was absent. The Firebase and GitHub Pages jobs were skipped. No Netlify production deploy was recorded; a dated HTTP check showed runmprc.com still serving older main.58ede287.js and main.cdd8bda4.css assets instead of the exact-merge local build assets. No Stripe/provider setting or production data changed, and the unused source has no live behavior.

Closes #169

[netlify]

✅ Deploy Preview for luminous-fox-7c393f ready!

Name	Link
🔨 Latest commit	2a60a36
🔍 Latest deploy log	https://app.netlify.com/projects/luminous-fox-7c393f/deploys/6a5527f05a25c6000802633f
😎 Deploy Preview	https://deploy-preview-172--luminous-fox-7c393f.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.