[daliu]

Closes #182

Outcome

Adds the unused server-only PAY-002B2C2 persistence boundary that records evidence immediately before a possible first Stripe POST and stops automatic retries when the exact request is no longer provably inside its conservative window.

This does not call Stripe, authorize a caller, report a provider outcome, create attempt 2, replay a response, or wire any production endpoint.

Safety invariants

• Recomputes and validates the exact B1 command identity, B2B active lease/fence, and C1 attempt-1 plan.
• Atomically creates either both partners or neither:
  • checkoutRequests/{commandKeyHash}/providerAttempts/0000000001/sendEvidence/first
  • auditEvents/commerce_provider_send_{commandKeyHash}_0000000001
• Binds both partners to a command-bound digest of every immutable C1 field, including account/API/endpoint/parameters/idempotency-key commitments and original binding evidence.
• Persists a fixed version-1 retry deadline 23 hours after the pre-POST marker. Stripe documents that idempotency keys may be pruned after at least 24 hours, so the source-owned window stays strictly shorter: https://docs.stripe.com/api/idempotent_requests
• Validates holder/fence/leased state inside the transaction, then uses a fresh trusted timestamp to ensure return occurs before the lease expiry captured by that transaction and before the stored deadline.
• Deadline/lease equality, later time, clock rollback, paired unknown time, coherent plan replacement, malformed/orphan evidence, and stale/terminal lifecycle all reconcile or fail closed.
• Timeout, connection loss, and Stripe 5xx remain ambiguous and cannot enter this API or advance the attempt. Stripe likewise documents 500-class outcomes as indeterminate: https://docs.stripe.com/error-low-level
• B2A, B2B, and C1 documents/audits remain byte-preserved.
• Browser anonymous/member/admin access to nested send evidence remains denied.

Verification

Node 20 and Java 17:

• focused journal unit: 190/190
• real Firestore journal emulator: 31/31, including 24-worker concurrency and delete/recreate parent-plan survival
• full Functions: 15 suites, 945 passed, 32 skipped
• full frontend: 10 suites, 133/133
• full Firestore Rules: 4 suites, 317/317
• workflow/release/SPA/artifact guards: 48/48
• Functions lint: passed
• diagnostic production build: passed
• staged diff check and secret-shaped pattern scan: clean

Three independent read-only reviews (security, test/coverage, documentation/status) approved the exact 10-path diff with no findings.

Continuity and release truth

Officer impact: None. This is unused server-only source/test infrastructure and changes no current officer task or public behavior.

Officer documentation: None — no public content, navigation, officer duty, provider account, deployment, or production operation changes.

Deployment evidence: Source/tests only. No website publication, runmprc.com verification, Firebase deployment, Stripe/provider configuration, production read/write, or live behavior occurred. PAY-002B2C3 reconciliation, runtime adoption, protected deployment, and production verification remain open.

[netlify]

✅ Deploy Preview for luminous-fox-7c393f ready!

Name	Link
🔨 Latest commit	db70adc
🔍 Latest deploy log	https://app.netlify.com/projects/luminous-fox-7c393f/deploys/6a555a89b5d852000884efe7
😎 Deploy Preview	https://deploy-preview-183--luminous-fox-7c393f.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.