daliu · Jul 13, 2026 · Jul 13, 2026
diff --git a/GITHUB_ISSUES.md b/GITHUB_ISSUES.md
@@ -62,7 +62,7 @@ Every issue inherits `AGENTS.md` and the definition of done in `IMPLEMENTATION_P
 | 10 | ABUSE-001 | Enforce native App Check and privacy-preserving abuse limits | P0 | L | partial: Enterprise browser source/tests tracked in [#159](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/159); provider config, native enforcement, rate limits, and live proof open | CI-001 baseline |
 | 11 | PAY-001 | Add strict request schemas and immutable monetary snapshots | P0 | L | partial: PAY-001A source/tests tracked in [#157](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/157); B/C/D and endpoint adoption open | ABUSE-001 interface agreed |
 | 12 | PROMO-001 | Disable unmodeled Stripe promotions until discounts are authoritative | P0 | S | source/tests complete under open GitHub issue #102; provider inventory and deployment remain owner action | PAY-001 for any future discount contract |
-| 13 | PAY-002 | Implement idempotent payment commands and explicit state machines | P0 | L | partial: PAY-002A1 pure state source/tests tracked in [#161](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/161); PAY-002B1 pure command identity tracked in [#163](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/163); registered-only journal pair tracked in PAY-002B2A [#165](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/165); PAY-002B2B lease/fence source/tests tracked in [#169](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/169); provider/runtime/migration/sagas open | CONFIG-001, PAY-001 |
+| 13 | PAY-002 | Implement idempotent payment commands and explicit state machines | P0 | L | partial: PAY-002A1 pure state source/tests tracked in [#161](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/161); PAY-002B1 pure command identity tracked in [#163](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/163); registered-only journal pair tracked in PAY-002B2A [#165](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/165); PAY-002B2B lease/fence source/tests tracked in [#169](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/169); PAY-002B2C1 immutable initial-plan source/tests tracked in [#173](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/173); send/reconcile/runtime/migration/sagas open | CONFIG-001, PAY-001 |
 | 14 | PAY-003 | Build idempotent, async-aware Stripe webhook ingestion | P0 | L | PAY-003A source merged in #101; PAY-003B/C remain open; not deployed | CONFIG-001, PAY-001/PAY-002 target contract |
 | 15 | RACE-001 | Add transactional race-capacity reservations | P0 | L | proposed | PAY-002, PAY-003 event contract |
 | 16 | MERCH-001 | Add SKU variants and transactional inventory reservations | P0 | L | proposed | PAY-002, PAY-003 event contract |
@@ -624,7 +624,7 @@ The local webhook/creator patch is a safety default, not a complete discount fea
 ## PAY-002 — Implement idempotent payment commands and explicit state machines
 
 **Labels:** `priority:P0`, `type:reliability`, `type:security`, `area:stripe`, `area:firebase`, `size:L`, `needs-migration`
-**Status:** Partial. PAY-002A1 pure state source/tests are tracked in live [#161](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/161). PAY-002B1 pure command-identity source/tests are tracked in live [#163](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/163). PAY-002B2A registered-only journal source/tests are tracked in live [#165](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/165). PAY-002B2B lease/fence source and tests are tracked in live [#169](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/169). Provider-plan recovery, runtime adoption, real legacy inventory/migration, and checkout sagas remain open.
+**Status:** Partial. PAY-002A1 pure state source/tests are tracked in live [#161](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/161). PAY-002B1 pure command-identity source/tests are tracked in live [#163](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/163). PAY-002B2A registered-only journal source/tests are tracked in live [#165](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/165). PAY-002B2B lease/fence source and tests are tracked in live [#169](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/169). PAY-002B2C1 immutable initial-plan source and tests are tracked in live [#173](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/173). Pre-POST evidence, ambiguity/reconciliation, safe attempt advancement, runtime adoption, real legacy inventory/migration, and checkout sagas remain open.
 **Depends on:** CONFIG-001 and PAY-001
 
 ### Current atomic boundary
@@ -633,9 +633,13 @@ PAY-002A1 defines only a dependency-free version-1 target: separate payment, reg
 
 The next boundaries remain separate. A later inventory/migration child must use #113-approved data categories and a dry-run before writes. PAY-002B1 [#163](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/163) owns only pure caller-scoped command keys, payload fingerprints, and deterministic Stripe keys with closed environment/mode pairing. A provider attempt is one logical generation, not an HTTP retry. PAY-002B2A [#165](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/165) owns only the atomic `checkoutRequests/{commandKeyHash}` registered record plus deterministic revision-1 `auditEvents` partner. Exact existing pairs are read-only; same-key command-type/schema/payload conflicts and malformed pairs reject. Environment and caller scope derive different B1 keys; there is no cross-scope UUID query. B2A adds no lease, execute/send permission, result replay, provider plan/attempt, or reconciliation.
 
-PAY-002B2B [#169](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/169) owns the unused lease/fence source and tests. It preserves those B2A records exactly and stores mutable state separately at `checkoutRequests/{commandKeyHash}/lifecycle/current`. A fixed 60-second server lease fingerprints a trusted UUID v4 holder; a monotonic fence rejects stale or expired workers; each real change appends one deterministic audit. Terminal success stores only a command-bound server-only commitment, not a business/Stripe result, action proof, or replay value. The lease does not authorize the caller or permit a provider request. PAY-002B2C still owns immutable provider-plan binding, safe-send cutoff, ambiguous outcomes, reconciliation, and safe provider-attempt advancement. PAY-002C/D, PAY-003B, RACE-001B, MERCH-001B, PAY-004, and PAY-005 depend on B2C.
+PAY-002B2B [#169](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/169) owns the unused lease/fence source and tests. It preserves those B2A records exactly and stores mutable state separately at `checkoutRequests/{commandKeyHash}/lifecycle/current`. A fixed 60-second server lease fingerprints a trusted UUID v4 holder; a monotonic fence rejects stale or expired workers; each real change appends one deterministic audit. Terminal success stores only a command-bound server-only commitment, not a business/Stripe result, action proof, or replay value. The lease does not authorize the caller or permit a provider request.
 
-B2A/B2B add no TTL. Deletion could re-enable an old command, so [#110](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/110) must approve retention and a server-only tombstone or equivalent durable duplicate barrier before any journal record is removed. CI-001B3 [#167](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/167) runs the exact demo-project/opt-in command-journal suite as a separate hosted release prerequisite; #169 expands that same file for lease and terminal races. Hosted results remain synthetic source proof only. #169's source is unused: it adds no endpoint/index export, Firebase deployment, Stripe/provider configuration, production read/write, website change, or officer behavior.
+PAY-002B2C1 [#173](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/173) owns only the unused immutable initial-plan source and tests. While the exact current lease/fence is active, it binds attempt `1` to one Stripe account, mode, API version, the static `checkout_session_create` → `/v1/checkout/sessions` POST mapping, canonical parameter set, deterministic B1 key, and original binding fence. C1 rejects arbitrary or object-ID-bearing paths; later operations need an explicit reviewed mapping. Raw account, parameters, and key are never stored; command-bound commitments are equality evidence, not anonymization, configured-account proof, a send marker, or provider-execution proof. An exact active-lease retry is read-only, a valid takeover can observe but cannot rewrite the same plan, and conflicts or malformed partners fail closed.
+
+PAY-002B2C2 still owns pre-POST first-send evidence, exact same-attempt resend limits, and the old/unknown-send ambiguity cutoff without attempt advancement. PAY-002B2C3 owns verified reconciliation evidence and safe later-attempt authorization. PAY-002C/D, PAY-003B, RACE-001B, MERCH-001B, PAY-004, and PAY-005 depend on the completed B2C chain.
+
+B2A/B2B/C1 add no TTL. Deletion could re-enable an old command, so [#110](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/110) must approve retention and a server-only tombstone or equivalent durable duplicate barrier before any journal record is removed. CI-001B3 [#167](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/167) runs the exact demo-project/opt-in command-journal suite as a separate hosted release prerequisite; #169 and #173 expand that same file. Hosted results remain synthetic source proof only. #173's source is unused: it adds no endpoint/index export, Firebase deployment, Stripe/provider configuration, production read/write, website change, or officer behavior.
 
 ### Problem