[daliu]

Closes #206

Outcome

Adds one unused server-only journal API that can freeze an exact attempt-1 Stripe reconciliation candidate as one deterministic immutable record/audit pair. Persistence is still not authorization: this change cannot create attempt 2, send to Stripe, advance commerce state, or change current checkout/refund behavior.

The transaction validates the complete B1/B2A/B2B/C1/C2 history, the 23-hour retry cutoff, and the expired current lease. Exact retries are read-only; conflicts, malformed/orphan/future evidence, impossible lease history, terminal mismatches, and hostile input fail closed without repair.

Safety boundary

• C3A classifier source remains byte-identical.
• No endpoint, index, webhook, refund, provider-network, logger, random, or runtime adoption.
• No Firestore Rules source, workflow, package/lock, provider setting, production data, migration, or officer procedure change.
• Browser read/write/list/collection-group denial is proved against the existing Rules.
• Stored evidence excludes raw command/provider IDs, account IDs, keys, parameters, amounts, responses, PII, secrets, URLs, and free text.

Verification

Exact reviewed source commit: e6eb363
Exact pre-commit diff SHA-256: 56c56e32dc60b164fe23b5490e15a7f7e2ba328d7da40ef79456f92ec91809f7

• Focused journal/classifier tests: 253/253 passed.
• Real Functions/Firestore emulator reconciliation tests: 38/38 passed.
• Functions lint: passed.
• Full Functions tests: 1198 passed; 39 intentionally skipped.
• Firestore Rules tests: 357/357 passed.
• Frontend Jest: 198/198 passed.
• SPA navigation: 11/11 passed.
• Frontend lint baseline: passed.
• Production diagnostic build: passed (main.56edbdb7.js).
• Exact 11-path scope, excluded-file identity, secret-pattern scan, 14 relative links, and diff check: passed.
• Independent exact-diff security, concurrency/test, code, and dependency/documentation reviews: approved with no findings.

Officer handoff

Officer impact: None — this is unused server-only safety evidence and changes no current page, payment, refund, or officer task.

Officer documentation: None — no current officer duty, public navigation, collected data, permission, deployment, hosting, external account, payment operation, incident task, backup, or recovery procedure changes.

Deployment evidence: Source and local tests only at PR creation. The website is not published or verified, runmprc.com is not verified, Firebase is not deployed, Stripe/provider configuration is untouched, production data is untouched, and production behavior is not verified. Hosted checks and merge evidence will be recorded separately.

[netlify]

✅ Deploy Preview for luminous-fox-7c393f ready!

Name	Link
🔨 Latest commit	e6eb363
🔍 Latest deploy log	https://app.netlify.com/projects/luminous-fox-7c393f/deploys/6a55a8f7c27e97000826c214
😎 Deploy Preview	https://deploy-preview-207--luminous-fox-7c393f.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.