Run-MPRC · daliu · Jul 16, 2026 · Jul 14, 2026
diff --git a/GITHUB_ISSUES.md b/GITHUB_ISSUES.md
@@ -64,7 +64,7 @@ Every issue inherits `AGENTS.md` and the definition of done in `IMPLEMENTATION_P
 | 10 | ABUSE-001 | Enforce native App Check and privacy-preserving abuse limits | P0 | L | partial: Enterprise browser source/tests tracked in [#159](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/159); provider config, native enforcement, rate limits, and live proof open | CI-001 baseline |
 | 11 | PAY-001 | Add strict request schemas and immutable monetary snapshots | P0 | L | partial: PAY-001A complete in [#157](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/157); race request/event-field adoption tracked in PAY-001B1 [#219](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/219); snapshots and remaining B/C/D work open | ABUSE-001 interface agreed |
 | 12 | PROMO-001 | Disable unmodeled Stripe promotions until discounts are authoritative | P0 | S | source/tests complete under open GitHub issue #102; provider inventory and deployment remain owner action | PAY-001 for any future discount contract |
-| 13 | PAY-002 | Implement idempotent payment commands and explicit state machines | P0 | L | partial: PAY-002A1 pure state source/tests tracked in [#161](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/161); PAY-002B1 pure command identity tracked in [#163](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/163); registered-only journal pair tracked in PAY-002B2A [#165](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/165); PAY-002B2B lease/fence source/tests tracked in [#169](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/169); PAY-002B2C1 immutable initial plan tracked in [#173](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/173); PAY-002B2C2 pre-send evidence/cutoff tracked in [#182](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/182); PAY-002B2C3A pure closed reconciliation decision tracked in [#184](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/184); PAY-002B2C3B immutable candidate persistence tracked in [#206](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/206); PAY-002B2C3C fresh-lease later-attempt authorization tracked in [#226](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/226); PAY-002B2C4A immutable authorized attempt-2 plan tracked in [#232](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/232); PAY-002B2C4B attempt-2 pre-send evidence tracked in [#238](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/238); result/reconciliation/runtime/migration/sagas open | CONFIG-001, PAY-001 |
+| 13 | PAY-002 | Implement idempotent payment commands and explicit state machines | P0 | L | partial: PAY-002A1 pure state source/tests tracked in [#161](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/161); PAY-002B1 pure command identity tracked in [#163](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/163); registered-only journal pair tracked in PAY-002B2A [#165](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/165); PAY-002B2B lease/fence source/tests tracked in [#169](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/169); PAY-002B2C1 immutable initial plan tracked in [#173](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/173); PAY-002B2C2 pre-send evidence/cutoff tracked in [#182](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/182); PAY-002B2C3A pure closed reconciliation decision tracked in [#184](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/184); PAY-002B2C3B immutable candidate persistence tracked in [#206](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/206); PAY-002B2C3C fresh-lease later-attempt authorization tracked in [#226](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/226); PAY-002B2C4A immutable authorized attempt-2 plan tracked in [#232](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/232); PAY-002B2C4B attempt-2 pre-send evidence tracked in [#238](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/238); PAY-002B2C4C1 pure unbound result-evidence policy tracked in [#246](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/246); trusted dispatch/result persistence/reconciliation/runtime/migration/sagas open | CONFIG-001, PAY-001 |
 | 14 | PAY-003 | Build idempotent, async-aware Stripe webhook ingestion | P0 | L | PAY-003A source merged in #101; PAY-003B/C remain open; not deployed | CONFIG-001, PAY-001/PAY-002 target contract |
 | 15 | RACE-001 | Add transactional race-capacity reservations | P0 | L | proposed | PAY-002, PAY-003 event contract |
 | 16 | MERCH-001 | Add SKU variants and transactional inventory reservations | P0 | L | proposed | PAY-002, PAY-003 event contract |
@@ -639,7 +639,7 @@ The local webhook/creator patch is a safety default, not a complete discount fea
 ## PAY-002 — Implement idempotent payment commands and explicit state machines
 
 **Labels:** `priority:P0`, `type:reliability`, `type:security`, `area:stripe`, `area:firebase`, `size:L`, `needs-migration`
-**Status:** Partial. PAY-002A1 pure state source/tests are tracked in live [#161](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/161). PAY-002B1 pure command-identity source/tests are tracked in live [#163](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/163). PAY-002B2A registered-only journal source/tests are tracked in live [#165](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/165). PAY-002B2B lease/fence source and tests are tracked in live [#169](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/169). PAY-002B2C1 immutable initial-plan source/tests are tracked in live [#173](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/173). PAY-002B2C2 pre-POST evidence and retry-cutoff source/tests are tracked in live [#182](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/182). PAY-002B2C3A pure closed reconciliation-decision source/tests are tracked in live [#184](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/184). PAY-002B2C3B immutable reconciliation-candidate persistence source/tests are tracked in live [#206](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/206). PAY-002B2C3C fresh-lease later-attempt authorization source/tests are tracked in live [#226](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/226). PAY-002B2C4A immutable authorized attempt-2 plan source/tests are tracked in live [#232](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/232). PAY-002B2C4B attempt-2 pre-send source/tests are tracked in live [#238](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/238). Attempt-2 result/reconciliation, runtime adoption, real legacy inventory/migration, and checkout sagas remain open.
+**Status:** Partial. PAY-002A1 pure state source/tests are tracked in live [#161](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/161). PAY-002B1 pure command-identity source/tests are tracked in live [#163](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/163). PAY-002B2A registered-only journal source/tests are tracked in live [#165](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/165). PAY-002B2B lease/fence source and tests are tracked in live [#169](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/169). PAY-002B2C1 immutable initial-plan source/tests are tracked in live [#173](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/173). PAY-002B2C2 pre-POST evidence and retry-cutoff source/tests are tracked in live [#182](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/182). PAY-002B2C3A pure closed reconciliation-decision source/tests are tracked in live [#184](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/184). PAY-002B2C3B immutable reconciliation-candidate persistence source/tests are tracked in live [#206](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/206). PAY-002B2C3C fresh-lease later-attempt authorization source/tests are tracked in live [#226](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/226). PAY-002B2C4A immutable authorized attempt-2 plan source/tests are tracked in live [#232](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/232). PAY-002B2C4B attempt-2 pre-send source/tests are tracked in live [#238](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/238). PAY-002B2C4C1 pure unbound result-evidence source/tests are tracked in live [#246](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/246). Trusted dispatch evidence, result persistence/reconciliation, runtime adoption, real legacy inventory/migration, and checkout sagas remain open.
 **Depends on:** CONFIG-001 and PAY-001
 
 ### Current atomic boundary
@@ -676,9 +676,11 @@ C4B preserves the existing version-1 plan-commitment bytes. A separate `provider
 
 After the transaction, a fresh trusted-time check returns fixed `send_permitted` / `pre_send_recorded` only while time has not rolled back and remains strictly before both the transaction-captured current lease expiry and stored deadline. Equality, later time, rollback, or unreadable paired time returns fixed `reconciliation_required` / `provider_outcome_unknown`; stale lease input fails as `lease_stale`. Changed input conflicts, and malformed/orphan/future/detached pairs fail closed. C4B never creates attempt `3`, calls Stripe, writes business state, replays a result, or enters an endpoint/index. Product/Price creation, Session expiry, refunds, and privileged provider operations require separate operation-specific boundaries.
 
-C4B alone makes no complete runtime child ready. PAY-002C still waits for PAY-001B2 and RACE-001B. PAY-002D still waits for PAY-001C, MERCH-001B, and separate Product/Price boundaries. PAY-003B and later cancellation, refund, and provider-admin work retain their listed dependencies.
+PAY-002B2C4C1 [#246](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/246) owns only the unused pure `classifyAuthorizedStripeCheckoutResultEvidence` policy. It accepts only a primitive, length-bounded, canonical JSON string encoding the exact 16-field reported attempt-2 Checkout Session assertion envelope. Deterministic reserialization must match the input. Its sole exact tuple returns fixed `unbound_result_candidate`; all 46 alternate enum values reconcile, and malformed/non-canonical serialized values or non-string objects throw one fixed redacted error before hostile property access. The input and output contain no raw Stripe object, Session ID/URL, money, timestamp, provider body, or personal data.
 
-B2A/B2B/C1/C2/C3B/C3C/C4A/C4B add no TTL. Deleting paired plan, send, reconciliation, or authorization evidence could remove a durable duplicate barrier, so [#110](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/110) must approve retention and a server-only tombstone or equivalent durable barrier before any journal record is removed. CI-001B3 [#167](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/167) runs the exact demo-project/opt-in command-journal suite as a separate hosted release prerequisite; #169, #173, #182, #206, #226, #232, and #238 expand that same file. Hosted results remain synthetic source proof only. The current foundations, including C3A/C3B/C3C/C4A/C4B, are unused: they add no endpoint/index export, Firebase deployment, Stripe/provider configuration, production read/write, website change, or officer behavior.
+C4C1 has no dispatch or idempotency proof, raw-result projector, journal write, result persistence, provider call, endpoint/index import, or business transition. Its candidate still requires trusted dispatch evidence, persistence, and business validation. C4B/C4C1 alone make no complete runtime child ready. PAY-002C still waits for PAY-001B2, RACE-001B, and a trusted dispatch/result-persistence boundary. PAY-002D still waits for PAY-001C, MERCH-001B, separate Product/Price boundaries, and the same Checkout Session runtime result work. PAY-003B and later cancellation, refund, and provider-admin work retain their listed dependencies.
+
+B2A/B2B/C1/C2/C3B/C3C/C4A/C4B add no TTL. Deleting paired plan, send, reconciliation, or authorization evidence could remove a durable duplicate barrier, so [#110](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/110) must approve retention and a server-only tombstone or equivalent durable barrier before any journal record is removed. CI-001B3 [#167](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/167) runs the exact demo-project/opt-in command-journal suite as a separate hosted release prerequisite; #169, #173, #182, #206, #226, #232, and #238 expand that same file. Hosted results remain synthetic source proof only. The current foundations, including C3A/C3B/C3C/C4A/C4B/C4C1, are unused: they add no endpoint/index export, Firebase deployment, Stripe/provider configuration, production read/write, website change, or officer behavior.
 
 ### Problem
 

diff --git a/GITHUB_ISSUE_SLICES.md b/GITHUB_ISSUE_SLICES.md
@@ -78,8 +78,9 @@ An agent-ready child has one observable outcome, one trust boundary, explicit de
 | PAY-002B2C3C | source/tests tracked in live [#226](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/226); PAY-002B2C3B/#206; unused/no runtime or deploy | Under a fresh later-fence lease, validate the exact persisted C3B pair and matching closed transition before atomically creating one immutable attempt-2 authorization/audit pair. Command-bind the opaque transition commitment and attempt-2 key fingerprint. The fixed result still requires plan binding and cannot send, call Stripe, or change a business record. | Exact never-began and expired/unpaid mappings; unsafe-evidence/stale-lease/chronology denial; atomic pair, retry, lost-ack, orphan/malformed/future, redaction, browser-denial, and 24-way identical plus 12-v-12 conflict emulator tests. |
 | PAY-002B2C4A | source/tests tracked in live [#232](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/232); PAY-002B2C3C/#226 and CI-001B3/#167; unused/no runtime or deploy | Under the exact C3C authorization and current active lease, atomically bind one immutable attempt-2 plan/audit pair. Version 1 preserves attempt-1 account, mode, API version, operation, endpoint, and canonical parameters. Only the internally derived attempt-2 key commitment, current fence/time, attempt number, and C3C provenance may differ. The fixed result requires separate C4B pre-send evidence. | Mock plus #167-hosted emulator equality/drift, lease-time, atomic-pair, exact-retry, later-lease observation, conflict, commit/lost-ack, orphan/malformed/future, complete prior-byte immutability, redaction, no-call/adoption, and browser-denial tests. |
 | PAY-002B2C4B | source/tests tracked in live [#238](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/238); PAY-002B2C4A/#232 and CI-001B3/#167; unused/no runtime or deploy | Revalidate B1-C4A and the current lease before atomically recording attempt-2 Checkout Session pre-send evidence/audit. Preserve v1 bytes; bind every authorized C4A plan field and provenance with commitment version 2. Use one immutable 23-hour deadline and a second trusted-time check; fixed permission is retry-safety only. No Stripe call, result, attempt `3`, or business write. | Golden v1/v2 commitment tests; mock plus #167-hosted emulator transition/concurrency/conflict/later-lease/nanosecond/rollback/commit/lost-ack/malformed/provenance/immutability/redaction/no-call tests; explicit browser denial. |
-| PAY-002C | proposed; PAY-001B2, PAY-002B2C4B/#238, RACE-001B | Convert race checkout to persistence-first record/hold plus deterministic Stripe Session saga. | One record/Session on retry at every failure boundary. |
-| PAY-002D | proposed; PAY-001C, PAY-002B2C4B/#238 for Checkout Sessions, separate operation-specific Product/Price plan and pre-send gates, MERCH-001B | Convert merchandise/catalog creation to persistence-first order/hold plus deterministic Stripe keys. | One order/Session/catalog object on retry; failure recovery tests. |
+| PAY-002B2C4C1 | source/tests tracked in live [#246](https://github.com/Run-MPRC/Run-MPRC.github.io/issues/246); PAY-002B2C4B/#238; #184 vocabulary precedent; unused/no runtime or deploy | Accept only one primitive, length-bounded canonical JSON encoding of the reported 16-field attempt-2 Checkout Session assertion envelope. The sole exact tuple returns fixed `unbound_result_candidate`; all 46 alternate closed enum values reconcile. No dispatch/idempotency/result proof, raw Stripe parsing, journal, persistence, provider call, business transition, or replay. | Exact positive/46-alternate matrix; timeout/provider/paid/expired mismatches reconcile; non-string/proxy/accessor/re-branded-native/private-slot rejection; invalid/oversized/reordered/duplicate/missing/extra/alternate-encoding JSON rejection; pre/post-load prototype-pollution redaction; frozen singleton/error; static zero-adoption and removed-trust-vocabulary tests. |
+| PAY-002C | proposed; PAY-001B2, PAY-002B2C4C1/#246, later trusted dispatch evidence, reviewed result projector/provider validation, and persistence, RACE-001B | Convert race checkout to persistence-first record/hold plus deterministic Stripe Session saga. C4C1 supplies only an unbound canonical serialized reported shape. | One record/Session on retry at every failure boundary; dispatch/result/business evidence survives lost acknowledgements. |
+| PAY-002D | proposed; PAY-001C, PAY-002B2C4C1/#246 for Checkout Sessions, later trusted dispatch evidence, reviewed result projector/provider validation, and persistence, separate operation-specific Product/Price plan/pre-send/result gates, MERCH-001B | Convert merchandise/catalog creation to persistence-first order/hold plus deterministic Stripe keys. C4C1 supplies only an unbound canonical serialized reported Checkout Session shape. | One order/Session/catalog object on retry; failure recovery tests; no result accepted from C4C1 alone. |
 
 ## Webhooks, capacity, inventory, and cancellation