[daliu]

Closes #594. Child of #106.

Outcome

Newly delivered supported charge.dispute.created, charge.dispute.updated, and charge.dispute.closed Events now reject internally contradictory evidence when the embedded Dispute.created second is later than the outer Event.created second. The fixed result is durable target-free needs_review:invalid_dispute_event_chronology; equality and earlier Dispute time remain admitted.

Officer impact: None — this server-only evidence comparison changes no officer screen, task, field, permission, approval, topology, incident step, or recovery action.

Officer documentation: None — no officer procedure describes embedded Stripe timestamp admission, and no officer-visible or operational workflow changes.

Deployment evidence: Source and signed synthetic tests are verified on this candidate. Code is not yet merged. The website was not published and runmprc.com was not verified for this change. Firebase was not deployed or read back. Stripe or another outside provider was not configured or acted on. No production data changed. No checkout, payment, refund, or dispute activity was performed. Live production behavior was not verified.

Invariant and order

• For a new supported Dispute Event, require Dispute.created <= Event.created after both fields pass the existing non-coercing primitive safe-integer and Firestore-range checks.
• Preserve processed replay, outer realm, embedded realm, Event/status lifecycle, claimed metadata version, outer-time structure, and embedded-time structure precedence.
• Persist only the valid outer Event time as ledger stripeCreatedAt; do not return, log, store, or convert the rejected embedded value.
• Do not resolve a target or fallback, read or write provider bindings, read or mutate a business record, or evaluate object, money, provider IDs, or predecessor state after contradictory chronology.
• Keep exact processed ledgers authoritative, contradictory claimed-missing targets durable, and equal/earlier claimed-missing targets retryable.
• Compare fields inside one Event only. This does not infer webhook delivery order, receipt time, clock freshness, endpoint/API-version truth, or canonical provider history.

Stripe documents both fields as object-creation Unix seconds and the three lifecycle Events as carrying a Dispute. Stripe does not explicitly guarantee this cross-field inequality; it is a bounded MPRC source-admission inference. Webhook delivery order is explicitly outside this comparison.

Changes

• Add one exact-Dispute-set chronology condition immediately after PAY-003A14 structure admission.
• Add 65 focused cases spanning three lifecycles, both business domains, one-second and historical contradictions, precedence, routing/fallback isolation, missing targets, replay, equal/earlier chronology, inclusive epoch/Firestore-maximum equality, redaction, timestamp isolation, and non-Dispute compatibility.
• Correct only the chronology-invalid historical A7/A10/A13/A14 controls.
• Add the PAY-003A15 SOURCE ONLY / NOT LIVE design contract and reconcile those historical boundaries.

Verification

Exact base: 102209dd99b331797f139dde7e209de75ea73a63
Reviewed head: b4f6b1d67c888d79284b7ac6b1afbe0fde5db406
Tree: d4f64a11bf20696492e0394f55dd74fcc5acbc89
Patch SHA-256: d97cd93c7779245b180865437b9eb789ae1d6c80c896c260ef8f6a0f5d07d1aa

• PAY-003A15 focused: 65 passed
• Full webhook: 1,025 passed
• Full Functions: 7,487 passed; 64 skipped
• Functions lint: passed
• Frontend: 951 passed
• Workflow/release/artifact safety: 86 passed
• SPA navigation: 11 passed
• Firestore Rules emulator: 418 passed against demo-rules-test
• Commerce command journal emulator: 63 passed against demo-pay002b2-test
• Frontend lint baseline: passed (118 files; 113 reviewed legacy errors; 6 reviewed legacy warnings)
• Direct diagnostic production build: compiled
• Workflow YAML parse and git diff --check: passed
• Dependency audit baseline unchanged: root 59 total / 4 production; Functions 8; no critical findings; no dependency changes

Independent final security/runtime, adversarial-test, and provider/officer-documentation reviews returned GO. Self-review found no authorization, App Check, PII/logging, idempotency, replay, impossible-transition, migration, production-fallback, or scope issue.

Compatibility and migration

There is no schema, Rules, index, package, workflow, API, provider-configuration, migration, backfill, or historical reprocessing change. Previously processed ledgers remain authoritative. Existing business records, bindings, dispute fields, and historical ledger rows are not inspected or repaired.

[netlify]

✅ Deploy Preview for luminous-fox-7c393f ready!

Name	Link
🔨 Latest commit	b4f6b1d
🔍 Latest deploy log	https://app.netlify.com/projects/luminous-fox-7c393f/deploys/6a6eb7dc8db5610008dfb87e
😎 Deploy Preview	https://deploy-preview-595--luminous-fox-7c393f.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[daliu]

HOSTED REVIEW GO on exact head b4f6b1d67c888d79284b7ac6b1afbe0fde5db406.

• Required PR CI run 30730499205: all five jobs passed.
• Netlify preview 6a6eb7dc8db5610008dfb87e: ready, context deploy-preview, exact commit, published_at: null, HTTP 200, and X-Robots-Tag: noindex.
• Preview URL: https://deploy-preview-595--luminous-fox-7c393f.netlify.app
• Reviewed tree: d4f64a11bf20696492e0394f55dd74fcc5acbc89
• Patch SHA-256: d97cd93c7779245b180865437b9eb789ae1d6c80c896c260ef8f6a0f5d07d1aa
• Worktree is clean and the exact remote head matches the reviewed candidate.
• Independent security/runtime, adversarial-test, and provider/officer-documentation reviews returned GO after every finding was corrected. Self-review found no remaining issue.

Officer impact: none.
Officer documentation: None — no officer procedure changes.
Deployment evidence: candidate source/tests and the non-production preview are verified. No production website publication, runmprc.com verification for this change, Firebase deployment/readback, provider configuration/action, production-data change, checkout/payment/refund/dispute activity, or live-behavior claim is made.

[daliu]

Merge-policy record: the ordinary squash merge was attempted on exact head b4f6b1d67c888d79284b7ac6b1afbe0fde5db406 and exact base 102209dd99b331797f139dde7e209de75ea73a63. GitHub blocked it only under the base-branch policy: reviewDecision=REVIEW_REQUIRED; all five required CI jobs and all Netlify checks are complete and non-failing, and the author cannot approve the same pull request.

Three independent read-only reviews returned GO after their findings were corrected. The administrator exemption will be used only for the unavailable approval, not to bypass a failing/pending check, stale base, unresolved finding, or deployment requirement.

[daliu]

FINAL RELEASE AUDIT — GO

PR #595 is merged as exact main 3ac4acee407220f34ef5ced1f43efe69279dfa09; reviewed tree d4f64a11bf20696492e0394f55dd74fcc5acbc89 and patch SHA-256 d97cd93c7779245b180865437b9eb789ae1d6c80c896c260ef8f6a0f5d07d1aa match the candidate.

PR CI 30730499205 and post-main CI 30730603255 passed all five jobs. Preview 6a6eb7dc8db5610008dfb87e was ready/non-production/noindex. Exact-main production attempt 6a6eb8b626561400087f4372 failed without publication; the live site remains on source 9ad6837756cdd409d296009fde5082eeeae5c059.

Officer impact: none.
Officer documentation: None — no officer procedure changed.
Deployment evidence: source/test/merge/exact-main CI and the older-live-source distinction are verified. No #594 website publication, Firebase deployment/readback, outside-provider configuration/action, production-data change, checkout/payment/refund/dispute activity, or live behavior occurred.

COMPLETE / CLOSED / CLAIM RELEASED.