[daniel-tsx]

What and why

P-A supplied the tagged proof envelope but no atomic MANUAL authorization application. Migration 0013 adds dormant SQL preparation, application and original-result recognition for MANUAL AUTHORIZE_SUCCESS, consuming genuine accepted D02 command/execution/complete original result and independent SDK-signed B1 proof.

A successful caller-owned READ COMMITTED transaction establishes the canonical AUTH root, tagged manifest/permit, SUCCEEDED attempt, AUTHORIZED payment, exactly one provider audit, application, exact receipt/source dispositions, scope revision and current-generation PROCESSED inbox together. Result VERIFIED_NO_EFFECT / reason AUTHORIZE_SUCCESS recognizes no capture, fee, journal, lot or capture child. Missing, contradictory, stale, unsupported or incomplete evidence refuses without partial application.

P-B only. Contracts/enrollment remain empty by default; private NOLOGIN owners receive narrow rights, with no runtime LOGIN grants or activation. P-C, B2-A/B/C, automatic authorization, production routing/workers and financial posting are excluded. Existing REFUND behavior and historical financial policies remain intact.

Review guide

Read carefully — T2 Human Review Guide:

SQL boundary	Human review focus
Claim/issuance witnesses, issuer guards	Real SQL owner versus invoking principal; exact transaction/backend/session binding; root/manifest/permit forgery and prepare-only closure.
Original proof and complete validator, deferred finality	Original accepted command, complete D02 transport bytes, signed receipt/proof ownership; exact before/after images; forward and reverse whole-group checks; no capture effects.
Prepare and apply	Own inbox UPDATE → account SHARE → canonical advisory → scope NO KEY UPDATE → payment NO KEY UPDATE → attempts ORDER BY id UPDATE; revision/claim revalidation and all-or-nothing writes. Publication/seal/bind use separate transactions; no SHARE upgrade.
Terminal audit cardinality, prior-audit refusal, typed owner discovery	UUID identity covers uppercase, braces and hyphenless targets plus uppercase proof/root metadata. Unexplained prior terminal audit history refuses; final validation requires exactly one owned terminal audit.
History/recognition, effective causes	Original-result recognition takes the approved lock prefix and adds no permit, claim, audit or revision. Historical proof stays distinct from current capture eligibility; only exact complete original causes clear, while new sources/barriers/exceptions remain effective.
REFUND dispatch, B1 obligation dispatch, private grants	Preserve the original REFUND delegate and contract1/BLOCKING_REVIEW behavior; keep completed-AUTH dispatch narrow. Check qualified objects, pinned search paths, PUBLIC revocation, NOLOGIN owners and column grants needed for row locks.

Also read the restricted AUTH fixture: the positive chain starts REQUIRES_AUTHORIZATION with zero recognized totals, accepts D02 in the same initial transaction, executes scripted SDK transport and independently signed receipts, then seals/binds separately. It does not seed successful authorization evidence.

The application spec covers genuine success, ownership/contradiction/stale-claim refusal, duplicate recognition, raw grants/forgeries, 11 omitted whole groups, savepoint/late rollback, deferred immediate validation and observed distinct-backend concurrency. The migration spec covers fresh/repeated/populated upgrade, complete catalog/data/ACL/owner rollback and DDL waiting.

Skim: journal append, current-chain count updates in existing harness/specs, explicit original0012 staging for P-A catalog assertions, and owning-document additions. Historical SQL/snapshots and original financial assertions are unchanged.

Least confident / later gates: production principal/session fencing and all-writer integration; P-C CAPTURE_PENDING and genuine post-capture historical recognition; live provider/broker behavior. No production-readiness claim.

Tests removed, weakened or newly explicitly skipped: none. New suites use the standard environment gate. Six historical F01 cases remain opt-in. Review-signal warnings identify two new toBeDefined() error-presence checks in race tests; they are paired with observed lock waits and exact application/audit/revision/disposition or zero-application assertions, not replacements for old assertions. The refusal helper attempts prepare and apply, so prepare-only deferred rejection cannot mask invalid-evidence tests.

Task size

T2 / HIGH_RISK. Invariants touched: original source/proof and merchant/account/currency ownership; canonical application uniqueness; claim/principal/revision ownership; exact immutable audit cardinality; restricted SQL capabilities; ordered locking; commit-time finality and complete rollback.

Transaction boundary: prepare and apply share one caller-owned READ COMMITTED transaction. Claims/failure CAS and source publication/sealing/binding commit separately. Authorization remains distinct from capture/ledger/settlement/payout; no accounting semantics, rounding or public API idempotency contract changes.

Checks

Local results are not hosted CI. The 13 published files are byte-identical to independently approved checkpoint 52dd2466…b69b1c9; authorized commit/rebase changes Git metadata and incorporates main's agent/workflow-only update.

Result	Command	Scope / notes
PASS	pnpm lint	API and web.
PASS	RUN_DB_TESTS=0 RUN_MIGRATION_TESTS=0 pnpm test	API 50 unit cases / 12 suites; web 3 cases. 1,128 DB-gated cases skipped here and separately covered by Docker.
PASS	pnpm build then pnpm typecheck	API and web; typecheck after generated web route types. Existing Next multiple-lockfile workspace-root warning remains.
PASS	pnpm test:verification	34 passed, zero failures/skips; repeated after rebase.
PASS	pnpm test:integration:docker	Fresh PostgreSQL17.11: 1,122 passed, 38 suites, 6 intentional F01 skips; owned resources and 98 spec byproducts removed. Executed again during publication preparation.
PASS	existing verifyIntegration({run}) with Jest selection test/integration/(manual-authorization|shared-payment-proof-envelope)	Final post-rebase 143 passed / 4 suites, zero failures/skips; fresh run-owned resources and 16 spec byproducts removed. P-B96 application +5 migration cases are included.
PASS	node scripts/check-migration-history.mjs origin/main HEAD	Original SQL/snapshots/journal prefix unchanged; idx13 is a newer timestamp and follows current main.
PASS	node scripts/check-pr-review-signals.mjs origin/main HEAD	T2 identified; no focused tests, removed cases or added explicit skips; two new error-presence matcher warnings described above.
PASS	node scripts/sync-agent-skills.mjs --check; node scripts/check-engineering-workflow.mjs	Rebased agent/workflow guidance checks pass; no such changes are in this PR.
PASS	git diff --check origin/main...HEAD; approved-file SHA256/index/commit inventory checks	Exactly 13 approved files; no temp artifacts, logs, fixtures or databases committed.
EXPECTED FAIL — historical baseline	RUN_F01_PENDING=1, disposable runner selecting settlement-f01.pending.spec.ts	Original checkpoint separately executed all six financial assertion failures, zero pass/skip, expected exit1; final pre/post-correction names/statuses/full failure messages identical. Not rerun during publication; source unchanged. Default Docker skips these six.
NOT RUN before PR	Hosted CI	Query the exact PR head after creation; local results do not satisfy hosted checks.

F01 baseline retained: partial/full refunds and stale settlement candidates still produce the documented legacy discrepancies; funded dispute and cross-capture attribution expectations remain pending B2. This PR does not close F01/F04/F05/F06 or weaken those assertions.

Unverified boundaries

Node22 and PostgreSQL18 were not run locally; current local runtime is Node24 / PostgreSQL17.11. No real Stripe, RabbitMQ/Redis application integration, production migrations, principal fencing or runtime activation was exercised. Browser checks are n/a for this SQL-only change.

Exact P-C dependencies: human-accepted completed P-B AUTH root/history and exact effective-cause projection; separate protected first-intent/request/replay storage; an exclusive CAPTURE_INTENT alternative in the same permit while preserving APPLICATION; SQL-derived full/first-partial/final-partial child/outbox/accepted D02/audit/response/revision group; whole-group/replay/race tests and original AUTH recognition after CAPTURE_PENDING. Subsequent D02/B1 capture proof must reference the same original AUTH source. P-C must not lock the old AUTH inbox after scope. Genuine post-financial-capture history is B2-B's later gate; capture preparation/posting/recovery remain separately reviewed work.

Review

Engineering Workflow v1.1 task r2-prerequisite-p-b-implementation: original checkpoint validated at HUMAN_APPROVAL; two correction rounds used, no budget reset. Fresh plan reviewer /root/p_b_plan_review_2 approved. Original code reviewer /root/p_b_code_review_1 reproduced three blocking P2s; all corrected and regressions retained: typed UUID audit owner identity, prior/exact terminal audit cardinality, required original-recognition lock prefix.

Final accepted /root/p_b_code_review_3: REVIEW_APPROVED, no P0/P1/acceptance-blocking P2; independently executed full1,122-pass Docker run on the approved P-B content. Interrupted plan/code attempts supplied no accepted approval. Original adverse reports remain unchanged.

Claude Code's fresh /security-review also returned zero blocking findings on these exact SQL bytes. Its incorrect SELECT-only row-lock rationale was rejected using an actual PostgreSQL privilege probe; required narrow UPDATE grants were retained.

Publication review of committed HEAD 8718d4cb9ef76d89e32baf49c145ca286f20fb19: REVIEW_APPROVED, fresh native read-only reviewer /root/p_b_pr_review, the local codex-review skill's permitted fallback after automatic approval review blocked the external CLI before execution. No blocking findings; independently inspected the complete diff, SQL/callers/tests, all 13 approved hashes and committed guards. Database results were inspected rather than rerun by this publication reviewer. Self-review uses ponytail-review; no source edits during shipping.

Docs and temporary files

Updated docs/database-design.md and docs/payment-lifecycle.md for durable contract/lock/privilege/history semantics. Consulted the approved three-stage P design, H01–H12/D01, B1 accounting section16 and R2-A/D02/B1/P-A records; no policy was reinterpreted.

Only the approved13 source/doc files are committed. Original ignored workflow workspace remains sealed (12 state/plan/review/security/verification/handoff files) with ten historical failed/control/expected-failure runner evidence directories retained until disposition. Publication-only ignored workspace contains the PR draft, review brief/reports and compact verification/content-hash receipt; successful runners remove their own temporary outputs. No workflow artifacts, staged migration copies, logs, DB markers, dependencies, build outputs or databases are included in this PR. Keep task branch/worktree and evidence until merge/rejection; no merge, deployment, activation or P-C is authorized here.