PAY-002B2C2: persist Stripe pre-send retry evidence

GITHUB_ISSUES.md

@@ -62,7 +62,7 @@ Every issue inherits `AGENTS.md` and the definition of done in `IMPLEMENTATION_P
 | 10 | ABUSE-001 | Enforce native App Check and privacy-preserving abuse limits | P0 | L | partial: Enterprise browser source/tests tracked in [#159](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/159); provider config, native enforcement, rate limits, and live proof open | CI-001 baseline |
 | 11 | PAY-001 | Add strict request schemas and immutable monetary snapshots | P0 | L | partial: PAY-001A source/tests tracked in [#157](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/157); B/C/D and endpoint adoption open | ABUSE-001 interface agreed |
 | 12 | PROMO-001 | Disable unmodeled Stripe promotions until discounts are authoritative | P0 | S | source/tests complete under open GitHub issue #102; provider inventory and deployment remain owner action | PAY-001 for any future discount contract |
-| 13 | PAY-002 | Implement idempotent payment commands and explicit state machines | P0 | L | partial: PAY-002A1 pure state source/tests tracked in [#161](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/161); PAY-002B1 pure command identity tracked in [#163](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/163); registered-only journal pair tracked in PAY-002B2A [#165](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/165); PAY-002B2B lease/fence source/tests tracked in [#169](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/169); PAY-002B2C1 immutable initial-plan source/tests tracked in [#173](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/173); send/reconcile/runtime/migration/sagas open | CONFIG-001, PAY-001 |
+| 13 | PAY-002 | Implement idempotent payment commands and explicit state machines | P0 | L | partial: PAY-002A1 pure state source/tests tracked in [#161](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/161); PAY-002B1 pure command identity tracked in [#163](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/163); registered-only journal pair tracked in PAY-002B2A [#165](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/165); PAY-002B2B lease/fence source/tests tracked in [#169](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/169); PAY-002B2C1 immutable initial plan tracked in [#173](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/173); PAY-002B2C2 pre-send evidence/cutoff tracked in [#182](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/182); reconciliation/runtime/migration/sagas open | CONFIG-001, PAY-001 |
 | 14 | PAY-003 | Build idempotent, async-aware Stripe webhook ingestion | P0 | L | PAY-003A source merged in #101; PAY-003B/C remain open; not deployed | CONFIG-001, PAY-001/PAY-002 target contract |
 | 15 | RACE-001 | Add transactional race-capacity reservations | P0 | L | proposed | PAY-002, PAY-003 event contract |
 | 16 | MERCH-001 | Add SKU variants and transactional inventory reservations | P0 | L | proposed | PAY-002, PAY-003 event contract |
@@ -624,7 +624,7 @@ The local webhook/creator patch is a safety default, not a complete discount fea
 ## PAY-002 — Implement idempotent payment commands and explicit state machines
 
 **Labels:** `priority:P0`, `type:reliability`, `type:security`, `area:stripe`, `area:firebase`, `size:L`, `needs-migration`
-**Status:** Partial. PAY-002A1 pure state source/tests are tracked in live [#161](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/161). PAY-002B1 pure command-identity source/tests are tracked in live [#163](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/163). PAY-002B2A registered-only journal source/tests are tracked in live [#165](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/165). PAY-002B2B lease/fence source and tests are tracked in live [#169](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/169). PAY-002B2C1 immutable initial-plan source and tests are tracked in live [#173](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/173). Pre-POST evidence, ambiguity/reconciliation, safe attempt advancement, runtime adoption, real legacy inventory/migration, and checkout sagas remain open.
+**Status:** Partial. PAY-002A1 pure state source/tests are tracked in live [#161](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/161). PAY-002B1 pure command-identity source/tests are tracked in live [#163](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/163). PAY-002B2A registered-only journal source/tests are tracked in live [#165](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/165). PAY-002B2B lease/fence source and tests are tracked in live [#169](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/169). PAY-002B2C1 immutable initial-plan source/tests are tracked in live [#173](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/173). PAY-002B2C2 pre-POST evidence and retry-cutoff source/tests are tracked in live [#182](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/182). Verified reconciliation, safe attempt advancement, runtime adoption, real legacy inventory/migration, and checkout sagas remain open.
 **Depends on:** CONFIG-001 and PAY-001
 
 ### Current atomic boundary
@@ -637,9 +637,11 @@ PAY-002B2B [#169](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/169) own
 
 PAY-002B2C1 [#173](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/173) owns only the unused immutable initial-plan source and tests. While the exact current lease/fence is active, it binds attempt `1` to one Stripe account, mode, API version, the static `checkout_session_create` → `/v1/checkout/sessions` POST mapping, canonical parameter set, deterministic B1 key, and original binding fence. C1 rejects arbitrary or object-ID-bearing paths; later operations need an explicit reviewed mapping. Raw account, parameters, and key are never stored; command-bound commitments are equality evidence, not anonymization, configured-account proof, a send marker, or provider-execution proof. An exact active-lease retry is read-only, a valid takeover can observe but cannot rewrite the same plan, and conflicts or malformed partners fail closed.
 
-PAY-002B2C2 still owns pre-POST first-send evidence, exact same-attempt resend limits, and the old/unknown-send ambiguity cutoff without attempt advancement. PAY-002B2C3 owns verified reconciliation evidence and safe later-attempt authorization. PAY-002C/D, PAY-003B, RACE-001B, MERCH-001B, PAY-004, and PAY-005 depend on the completed B2C chain.
+PAY-002B2C2 [#182](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/182) owns only the unused pre-POST marker, deterministic audit, and fixed 23-hour automatic-retry cutoff. It preserves B2A, B2B, and C1 records byte-for-byte. Under the exact current lease/fence and exact attempt-1 plan, `recordInitialStripeSendEvidence` creates `providerAttempts/0000000001/sendEvidence/first` plus `auditEvents/commerce_provider_send_{commandKeyHash}_0000000001`, or creates neither. Both bind a command-bound digest of every immutable C1 plan field. The first atomic creation, and an exact retry, return fixed `send_permitted` only when a post-transaction trusted-time check remains strictly before the transaction-validated lease's captured expiry and the persisted deadline. That second check does not re-read lifecycle state. Lease/deadline equality, later time, clock rollback, paired missing/unreadable time, or a changed/replaced C1 plan returns fixed `reconciliation_required` or fails closed without advancing. These classifications are retry-safety evidence only: they do not authorize a caller, prove the configured account, report a Stripe outcome, make a request, advance to attempt `2`, or replay a result.
 
-B2A/B2B/C1 add no TTL. Deletion could re-enable an old command, so [#110](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/110) must approve retention and a server-only tombstone or equivalent durable duplicate barrier before any journal record is removed. CI-001B3 [#167](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/167) runs the exact demo-project/opt-in command-journal suite as a separate hosted release prerequisite; #169 and #173 expand that same file. Hosted results remain synthetic source proof only. #173's source is unused: it adds no endpoint/index export, Firebase deployment, Stripe/provider configuration, production read/write, website change, or officer behavior.
+PAY-002B2C3 owns verified reconciliation evidence and safe later-attempt authorization. PAY-002C/D, PAY-003B, RACE-001B, MERCH-001B, PAY-004, and PAY-005 depend on the completed B2C chain.
+
+B2A/B2B/C1/C2 add no TTL. Deleting both C2 partners would look like first use, so [#110](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/110) must approve retention and a server-only tombstone or equivalent durable duplicate barrier before any journal record is removed. CI-001B3 [#167](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/167) runs the exact demo-project/opt-in command-journal suite as a separate hosted release prerequisite; #169, #173, and #182 expand that same file. Hosted results remain synthetic source proof only. The current foundations are unused: they add no endpoint/index export, Firebase deployment, Stripe/provider configuration, production read/write, website change, or officer behavior.
 
 ### Problem
 

GITHUB_ISSUE_SLICES.md

@@ -67,8 +67,8 @@ An agent-ready child has one observable outcome, one trust boundary, explicit de
 | PAY-002B2A | source/tests tracked in live [#165](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/165); PAY-002B1; unused/no runtime or deploy | Atomically create one immutable `registered` command and deterministic revision-1 audit partner, return a fixed read-only exact-existing classification, and reject same-key type/schema/payload conflicts or malformed pairs. Environment/caller changes derive another B1 key; stored mismatches are corruption. No lease, execute/send permission, result replay, provider, or reconciliation API. | Mocked transaction plus dedicated opt-in demo-emulator concurrent pair/conflict/orphan/failure tests; CI-001B3 [#167](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/167) adds the exact suite as a hosted release prerequisite. |
 | PAY-002B2B | source/tests tracked in live [#169](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/169); PAY-002B2A/#165 and CI-001B3/#167; unused/no runtime or deploy | Preserve the immutable B2A root/audit and add separate `lifecycle/current` state with a fixed 60-second server lease, command-bound UUID-holder fingerprint, monotonic fence, terminal commitment/fixed final failure, and append-oriented transition audit. The lease grants no provider-send permission; the commitment is not result proof or replay. | Mock plus #167-hosted emulator races for acquire/recovery/busy/expiry/takeover/stale fence/terminal conflict, exact read-only retry, malformed partner, and immutable B2A records; explicit browser deny tests. |
 | PAY-002B2C1 | source/tests tracked in live [#173](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/173); PAY-002B2B/#169; unused/no runtime or deploy | While the exact current lease/fence is active, atomically bind one immutable attempt-1 Stripe account/mode/API-version/static `checkout_session_create` POST mapping/parameters/key plan and deterministic audit. Reject arbitrary or object-ID-bearing paths. Store only command-bound commitments; this is not account proof or send permission. | Mock plus #167-hosted emulator races for exact bind/recovery/conflict/expiry/takeover/malformed partners and byte-preserved B2A/B2B records; explicit browser-denial tests. |
-| PAY-002B2C2 | proposed; PAY-002B2C1 | Persist pre-POST first-send evidence and a conservative code-owned resend cutoff; reuse only the exact plan/key, preserve timeout/network/5xx uncertainty, and require reconciliation after an old or unknown send time. Never advance the attempt. | Exact-resend/clock-boundary/unknown-send/timeout/5xx/concurrency tests with synthetic provider fixtures and no real request. |
-| PAY-002B2C3 | proposed; PAY-002B2C2 and the merged PAY-003A/#101 evidence vocabulary | Append verified reconciliation evidence and permit a later attempt only after proven non-execution or an explicitly safe corrected/new logical operation. Keep every prior attempt immutable. PAY-003B may later consume this result; C3 does not wait on PAY-003B. | Closed evidence-reason matrix; unsafe timeout/5xx/old-key/missing-reference/partial-search advancement denied; synthetic provider/business reconciliation tests. |
+| PAY-002B2C2 | source/tests tracked in live [#182](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/182); PAY-002B2C1/#173 and CI-001B3/#167; unused/no runtime or deploy | Recompute the exact B1/C1 attempt-1 plan under the current lease/fence, then atomically create a separate pre-POST marker and deterministic audit. Bind both to a command-bound digest of every immutable C1 plan field. The persisted version-1 deadline is 23 hours after the marker. The first atomic creation, and an exact retry, return fixed `send_permitted` only after a post-transaction trusted-time check remains before the transaction-validated lease's captured expiry and deadline; this does not re-read lifecycle state. Equality, later time, rollback, missing/unreadable paired time, or plan replacement reconciles or fails closed. Never create attempt 2 or make a provider request. | Mock and #167-hosted emulator concurrency, post-transaction lease expiry, self-consistent plan replacement, commit-failure, lost-response, takeover, nanosecond cutoff, unknown-time, timeout/connection-loss/5xx ambiguity, conflict, malformed-partner, byte-preservation, redaction, static no-call/random, and explicit browser-denial tests. |
+| PAY-002B2C3 | proposed; PAY-002B2C2/#182 and the merged PAY-003A/#101 evidence vocabulary | Append verified reconciliation evidence and permit a later attempt only after proven non-execution or an explicitly safe corrected/new logical operation. Keep every prior attempt immutable. PAY-003B may later consume this result; C3 does not wait on PAY-003B. | Closed evidence-reason matrix; unsafe timeout/5xx/old-key/missing-reference/partial-search advancement denied; synthetic provider/business reconciliation tests. |
 | PAY-002C | proposed; PAY-001B, PAY-002B2C3, RACE-001B | Convert race checkout to persistence-first record/hold plus deterministic Stripe Session saga. | One record/Session on retry at every failure boundary. |
 | PAY-002D | proposed; PAY-001C, PAY-002B2C3, MERCH-001B | Convert merchandise/catalog creation to persistence-first order/hold plus deterministic Stripe keys. | One order/Session/catalog object on retry; failure recovery tests. |