[daniel-tsx]

What and why

Complete the dormant first-capture preparation from PR #17 with SQL-owned atomic financial application in forward migration 0016. A supported capture now commits its exact journal/entries, lot, cumulative payment, successful attempt, audit, effect links, application, own inbox claim CAS, covered source dispositions and one guarded revision together; independent immediate/deferred checks reject incomplete groups.

B2-C acknowledgment/replay/recovery, subsequent shared-PI captures, capture-failure finality, runtime enrollment, operational LOGIN grants, activation and F01/F04/F05/F06 closure remain out of scope.

Review guide

• Read carefully: 0016_capture_financial_application.sql effect/completion reconstruction, permit issuance/ownership, exact row guards, deferred missing-group checks, source admission and timestamp-only normalization. Account creation/locking follows the existing legacy capture account order.
• Read the application, concurrency and migration specs together, including mixed legacy writers, omitted groups, restricted authenticated LOGINs and populated non-UTC 0015 histories.
• Skim: appended journal metadata, historical fixture migration-prefix/count updates and the three owning documentation updates.
• Least confidence/unverified: operational installation with drained writers, deployed credential fencing and real provider/broker/Redis delivery.
• Tests removed or weakened: none. No new skips. Six pre-existing F01 skips remain: partial-refund settlement (asset5000/claim4850); full-refund zero funds; funded5000 dispute/release4700; stale refund candidate; stale dispute candidate; settledA4000/pendingB1000 refund attribution. B2-A remains pinned to its rollback-only 0015 contract.

Task size

T2 / HIGH_RISK. One PostgreSQL transaction owns exact balanced currency-isolated immutable journal/entries, NEW_CAPTURE lot, cumulative totals, successful attempt, financial audit, effect links, application and own-inbox finalization. Permits bind transaction/backend/session principal and SQL-issued manifest; source clearance is limited to independently proven original obligations; financial revision advances exactly once. Deferred validation also checks the independent reverse direction and missing whole groups. Historical migrations, accounting/rounding policy, REFUND, legacy and P-B/P-C boundaries remain intact.

Checks

Local finalization uses Node24.22.1 and pinned pnpm10.26.0; RUN_DB_TESTS=0 for workspace units, separate fresh Docker PostgreSQL17 for database tests. These local results are distinct from hosted CI.

Result	Command	Scope / notes
PASS	pnpm lint	API and web
PASS	RUN_DB_TESTS=0 pnpm test	API50 + web3 passed;1472 database cases excluded here
PASS	pnpm build	API and Next.js production build
PASS	pnpm typecheck	API and web, after build
PASS	pnpm test:verification	34 passed,0 failed/skipped
PASS	node scripts/sync-agent-skills.mjs --check	Vendored skill synchronization
PASS	node scripts/check-engineering-workflow.mjs	Workflow mirrors and checkpoint/resume guards
PASS	Dirty-tree migration-history + review-signal checks	16 historical SQL unchanged;0016 next/newer journal; no focused tests/new skips/removed assertions
PASS	git diff --check; git diff --check origin/main HEAD	Approved source and full committed diff, including new files
PASS	Changed-document relative links/anchors	3 documents,54 links,0 errors
PASS	pnpm test:integration:docker	1,466 passed,0 failed,6 existing F01 skips;45 passing/1 skipped suites;883.434s; all17 migrations; project fintech-verify-710114ec-eaf2-4d5c-b68a-6da821a08a44 cleaned
PASS	node scripts/check-migration-history.mjs origin/main HEAD	Exact committed append-only guard against freshly fetched main
PASS	node scripts/check-pr-review-signals.mjs origin/main HEAD	T2 SQL paths identified; no guard changes or test signals
PASS	Hosted Node22 checks	Node22.23.4; frozen install,34 verification tests,API50/web3,lint/build/typecheck and skill/workflow guards
PASS	Hosted Node24 checks	Node24.22.0; same required checks passed
PASS	Hosted PostgreSQL integration	PostgreSQL17.11;1,466 passed,0 failed,6 existing F01 skips;45 passing/1 skipped suites;388.486s; service cleanup PASS
PASS	Hosted append-only migration guard	Existing migration/snapshot/journal history preserved
PASS	Hosted review signals	T2 check and label synchronization passed; t2-area applied

Unverified boundaries

No production installation, scope activation, operational credential fencing, real Stripe calls, RabbitMQ/Redis runtime or browser testing is claimed. B2-C and F01/F04/F05/F06 remain open. Docker fixtures use placeholder providers and isolated resources; no shared database is used.

Review

Human accepted the reviewed dormant source and final Codex-native security review. No blocking P0/P1/P2 findings remain; automatic correction budget is exhausted (2/2), with no additional correction/rebaseline authorized.

• Approved source fingerprint: db7a502aa1d011bc1e2c4ee1d2335253ef4628ee244905946816e51fa1e03d58.
• Approved plan SHA-256: e5c1303362f50c01bda16a2ac5100a0b742eede1383fe1d7ea9a4abb9434c81b.
• Independent Codex code review: code-review-2.md, REVIEW_APPROVED; original timestamp P1 corrected/reviewed before acceptance. SHA-256 0923c3f7e75691552d5286eb15c3615874f76cef456937d69fafed6b1e8a0b74.
• Final fresh read-only Codex-native security subagent: /root/r2_b2_b_codex_security_review, security-review-3.md, SECURITY_APPROVED. SHA-256 319324e32802936321a320a51591bc37bd29a7f968134b90c47ba5e9aeb8c05c.
• Self-review followed the local payment/ponytail review guidance. Earlier reports remain immutable historical evidence; security-review-3.md is the accepted final security evidence.
• Engineering workflow r2-b2-b: immutable HUMAN_APPROVAL ledger validated READY before publication; human acceptance granted. Publication does not rebaseline that reviewed dirty-tree snapshot.
• Independent content digest of593 approved source files, excluding Git metadata: df104339429ef77f2d207083a50829a6f3589c23870c89cfcbba924910d51f48; matched after commit, binding published bytes to acceptance.

Docs and temporary files

Updated owning docs/concurrency.md, docs/database-design.md and docs/payment-lifecycle.md. Consulted accepted H01–H12, approved B1 accounting contract, approved R2 application design and capture preflight.

All eleven existing workflow files remain unchanged under ignored .tmp/agent-workflows/r2-b2-b/: state.json, plan.md, plan-review-1.md, plan-review-2.md, code-review-1.md, code-review-2.md, security-review-1.md, security-review-2.md, security-review-3.md, verification.json, final-checks.json. This single new handoff.md serves as the publication evidence/PR body. Original approved design artifacts in parent .tmp/r2-b2-b/ (plan.md, review-brief.md, review-1.md, review-2.md, verification.md), the isolated task worktree and earlier failed-run diagnostics remain until human merge/finalization. Ignored API/web build outputs and compiler caches remain local. No evidence is included in the commit. Passing run-owned database resources/byproducts are removed by their runner; no global cleanup.

Publication commit: 735e3da83361b99d73f1ce5faad8a0dd246e9342; tree c54712ea59c148165b66f3ab8bdfc6c2d193ece0; branch chore/r2-b2-b-design, base main at 654572ce103eee1ce1768d5abff7fba2479a58df. Exactly19 approved files committed (5 new/14 modified); all593 source-file bytes/modes match the approved content digest after commit, with a clean worktree. Commit/index/status metadata necessarily differs from the accepted dirty-tree fingerprint; the original ledger is preserved without rebaseline. All11 prior artifact digests match, including the final Codex-native security report. Direct project-label inspection found zero containers/volumes/networks and no remaining fresh-run files. PR #18 is open and unmerged. Hosted CI run41839147563, attempt1, completed successfully at the exact published head on 2026-11-04T13:40:31Z: all5 jobs passed. The CI checkout merge f86a53e1f605c62200ec9511c7c9eaa7ce438df8 has the exact published source tree c54712ea59c148165b66f3ab8bdfc6c2d193ece0, independently checked through GitHub Git data and checkout logs. No rerun, source correction, rebaseline, activation or merge performed. Do not merge automatically.