[daniel-tsx]

What and why

Add the dormant P-A shared payment-proof envelope. REFUND_V1 remains the default; PAYMENT_OPERATION_V1 requires an exact owned B1 proof and immutable original command/source/execution/receipt provenance. No payment application, capture intent, financial posting or financial scope is activated.

Review guide

• Read carefully: 0012_shared_payment_proof_envelope.sql branch CHECK, generated conditional FKs, canonical-root/provenance trigger and restricted NOLOGIN owner; corresponding Drizzle mapping and the two new PostgreSQL suites.
• Skim: historical migration fixture pinning, current-chain count13, harness count propagation, appended journal entry and owning-document paragraph.
• Least confident about: future P-B/P-C composition and deployed runtime boundaries are unexercised and remain closed.
• Tests removed or weakened: none. Original12-migration assertions are preserved through explicit0011 staging;0012 gets an additional phase containing the same seven financial comparisons. New suites use the established environment gates. The six unchanged F01 assertions are intentionally opt-in in the full matrix and were all run separately with their expected financial failures.

Task size

T2 / HIGH_RISK. Invariants: exactly one complete tagged proof branch; payment/merchant/currency/account/operation ownership; immutable original evidence; legacy REFUND behavior; restricted SQL privileges; deferred effect closure and rollback. Forward DDL is transactional with a10s lock timeout and preserves all0000–0011 SQL and prior journal entries. No monetary policy, runtime handler or financial application gate is opened.

Checks

Result	Command	Scope / notes
PASS	pnpm test:integration:docker	Fresh disposable PostgreSQL17.11:1014 tests /36 suites /0 failures;6 intentional F01 skips; scoped cleanup passed.
Expected FAIL preserved	Exported Docker runner selecting settlement-f01.pending.spec.ts, RUN_F01_PENDING=1	All6 unchanged financial assertion failures;0 skips; separate disposable database and cleanup.
PASS	pnpm --filter @fintech-lab/api test:unit --cache=false	50 cases /12 suites /0 skips.
PASS	pnpm test before publication	50 API cases /12 suites;1020 database-gated cases skipped here and covered by the separate PostgreSQL runs above. Web reports no configured automated browser tests.
PASS	pnpm lint; pnpm build; post-build pnpm typecheck	API and web on unchanged reviewed source.
PASS	pnpm test:verification	34 runner/migration/review guard cases.
PASS	node scripts/check-migration-history.mjs origin/main HEAD; node scripts/check-pr-review-signals.mjs origin/main HEAD	On committed P-A tree: append-only history, T2 detected, no test-removal/skip blockers.
PASS	Workflow/skill synchronization, owning-document22 relative links, diff checks and historical raw-byte hashes	12 historical SQL files,38 audit documents and original design/reviewer evidence preserved.
PASS	Independent reviewer: exported Docker runner selecting both new shared-proof suites	42 cases /2 suites /0 failures or skips; all13 migrations and scoped cleanup. These overlap the1014.
PASS	Hosted CI run40077528892	Exact PR head 991554cd52ef274cee2d7208be217d0476a4cf5c: all five jobs green. Node22/24 checks passed; PostgreSQL1014 cases/36 suites passed with6 intentional F01 skips; append-only history and review signals passed. Completed job logs independently inspected.

Unverified boundaries

Native PostgreSQL18, actual Stripe/provider calls, live Redis/RabbitMQ and deployed role/fencing/cutover behavior were not exercised. P-B MANUAL authorization application, P-C protected capture intent, B2-A monetary preparation, B2-B effects, B2-C recovery and B3 activation remain separate work. Existing F01 defects remain unchanged.

Review

engineering-workflow task r2-prerequisite-p-a-implementation, HIGH_RISK: independent /root/pa_plan_review_resume returned PLAN_APPROVED; fresh read-only /root/pa_code_review_1 inspected the actual SQL/diff/privileges/evidence and returned REVIEW_APPROVED with no P0/P1/acceptance-blocking P2. One of two correction rounds fixed historical0011 fixture selection and added0012 coverage without changing financial assertions. FINAL_GATE passed and stopped at HUMAN_APPROVAL; the human subsequently authorized commit, push and this draft PR. The full571-file staged tree was checked against the approved source before commit.

Docs and temporary files

Updated existing docs/database-design.md for the durable dormant contract; no permanent per-run report. Consulted approved H01–H12/D01 decisions, capture accounting §16, R2-A/B1 contracts and accepted P-A design.

Local ignored .tmp/agent-workflows/r2-prerequisite-p-a-implementation/ retains the original checkpoint/history, plan, immutable plan/code reviews, compact verification/final checks and preserved original blocked evidence. Failed Docker/F01 evidence remains local; passing-run outputs were removed by the runner. The isolated task checkout is .tmp/r2-prerequisite-p-a-implementation/worktree and will remain through PR disposition. No temporary files or environment values are committed.