[LIghtJUNction]

Scope

Closes #73.
Closes #74.
Closes #75.

• Preserve published signed orders.buy@1 and orders.buy@2. The complete lifecycle explicitly uses orders.buy@3 (or orders.create@1 + orders.fund@1): immutable contracts, quantity reservations, signed funding, guarded transitions, objective refunds/timeouts and single-consumption settlement.
• Legacy and lifecycle escrow journals retain their original semantics but share the protected OrderEscrow debit boundary. Neither can settle the other. Current main's lease/completion fences, managed checkout and custodial-history changes are preserved.
• Managed delivery verifies pinned bytes and settles atomically without claiming receipt for the buyer. Sealed age ciphertext/service evidence requires explicit acceptance. Large payloads use real Transfer sessions and fresh buyer authorization.
• Verified buyer-owned email receives only order ID, checkout handle and a freshly authenticated site link; unverified addresses receive only a verification challenge. Disabled SMTP, failures, uncertainty and stale/revoked endpoints cannot change settlement or claim goods.
• Deterministic versioned panels/quorum, private evidence and immutable rationale, signed Decision facts, live credential/role-epoch checks, one disjoint appeal and atomic single consumption. Invalid authority holds funds, with no administrator/AI fallback.
• SQL-authoritative blob roots, real backup/restore, read-only doctor and disposable 20 MSG bank -> 10 MSG signature reward -> 5 MSG bundle selftest cover the lifecycle.

Verified exact source

Head: 5983f31f38abfe8b4f8b9c1d013dd41a8b9d80fe.
Tree: 2b690a68d3b964e552ad7245b7d752e2c4cdaebb.
Parent: 8bf48a5e843f1521beeda0de5bd316f2343fefe6, retaining main 3b827a16aa62b13a5fcc2ebd702818585a7e097c.

Integration additionally fixes restored checkout/funding/settlement snapshot mismatches, disabled-SMTP bypass, the actual emailed pickup URL selecting the wrong delivery reader, and HTTP 500/incorrect funded state when reading unpaid orders. Twenty new regression cases cover these integration findings; 19 reproduced failures before their fixes (the expired creation-time case already failed closed). Canonical/handle pickup URLs, HEAD/ETag, access/nonexistence equivalence and unchanged order/delivery/ledger/event/audit rows are checked.

Completed acceptance

GitHub Actions run 36383461953: SUCCESS on this exact head, Python 3.15/PostgreSQL 16.
https://github.com/TokenNotIncluded/msg.lmm.best/actions/runs/36383461953

• 1,244 core/business/security tests passed, four disjoint shards: 300 / 328 / 329 / 287.
• 8 conformance tests passed, including real transport adapters and tokenizer.
• Zero failures, errors or skipped test cases. All four jobs and the final contracts aggregate succeeded, including complete/disjoint evidence and all-job success checks.
• Downloaded all four run-bound artifacts, verified their SHA256 values, independently reran the unchanged evidence verifier, and matched all 1,244 node IDs against an independent full collection from the exact reviewed source. All 20 added integration regressions are present.
• Wheel and sdist built successfully in target CI. All 132 tracked package source/data files were checked against the reviewed source; wheel SHA256 0d2daf4ea195c2f2c745406f7c9e100723e2e5e583da13bd87cf6567ddd7d70c.
• Supplemental exact-head local run: 300 passed, zero failures/errors/skips, real PostgreSQL 17/Valkey/age, including full market, custodial-history, real backup/restore and isolated selftest. This overlapping subset is not added to the full CI count. Modified-module lint, compile and whitespace checks passed.

Earlier cancelled/superseded runs and local Python 3.13 results are not used as target acceptance. No CI assertion or dependency requirement was weakened.

Boundaries

See docs/MARKET_CONTRACTS.md. Finite credential ceilings do not expand automatically. Default arbitration candidates remain empty until explicitly provisioned. Production data, Root keys, deployment and real outbound mail are untouched. Temporary source/patch transport workflows exist only on auxiliary branches and are absent from this PR diff.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-09-27T20:40:18.340089Z	bfcf55d	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[LIghtJUNction]

Coordination for the parallel user request #74–76: I found this PR while preparing a separately tested market implementation. I will not publish a competing EscrowEngine/delivery schema over this work. I am reviewing #102 for #74/#75 and isolating my #76 live-authorization fixes and real PostgreSQL cross-transport regressions into a separate change. Please preserve #76 authorization checks when reconciling #99/#103, and do not treat pending CI as acceptance. My #76 changes do not alter money/order/delivery tables. No production changes.

[LIghtJUNction]

Integration verification update

Published implementation bfcf55d6567459c6a777cccaf9382eea316bd28c completed local verification on Python 3.15.0rc2 with real PostgreSQL 16, Valkey, age, nginx, Git/Git-LFS and the actual tokenizer:

• All six full-suite partitions completed successfully: 902 tests, 0 failures, 0 errors, 0 skipped (252 + 156 + 136 + 104 + 93 + 161).
• 8/8 conformance tests passed, no skips.
• Wheel and sdist builds succeeded.
• Final isolated selftest including actual bank registration, 10 MSG reward, 5 MSG bundle, optional email verification and arbitration returned ok: true and cleaned_up: true.

These numbers apply to that exact published source, not to the later merged head.

Main PR #101 was then integrated without overlapping implementation paths. Its nested tests/issue_78_80/conftest.py shadowed the root conftest, causing 121 import errors during full-suite collection (run 36348778183). Commit c1de28f052ef59971b45213f242749bc5810a2db adds only a package boundary for that nested suite. A minimal reproducer fails before and passes after this change; no tests, fixtures, assertions, or CI steps are removed or skipped. Full integrated CI remains the merge gate.

[LIghtJUNction]

Independent verification of the pinned original head bfcf55d: 27 tests passed in 265.95s across test_market_arbitration.py, test_market_delivery.py, test_market_manual_flow.py, test_market_recovery.py and test_market_lifecycle.py, using real PostgreSQL 14.24, Git and Ed25519 on Python 3.13.5. This includes the real backup/restore cases, not a SQLite substitute. The exported complete source tree matched c65e8f9971eee2fc4e1e2679b60d2bcc3c09e0fe. I see head has advanced to c1de28f; these results are not a claim that its full exact-head CI has passed. My review of the existing market policy/escrow/delivery/target/arbitration paths has not found an additional confirmed blocker. I am keeping #76 separate.

[LIghtJUNction]

Confirmed integration follow-up to c1de28f: adding tests/issue_78_80/init.py fixes conftest shadowing but leaves two collection errors because sibling imports remain absolute. In test_read_tree_transports.py change from test_read_query_tree import tree,query to from .test_read_query_tree import tree,query; in test_tree_query_ref.py make both sibling imports relative (.test_read_query_tree, .test_read_tree_transports). Reproduced on the complete 2dd6a0d tree: before package boundary 120 collection errors, with boundary 2 ModuleNotFoundError collection errors, with these three import changes 999 tests collect with zero errors (includes my 20 new #76 cases). I am publishing the same minimal integration repair in #105; no fixture, test or assertion is excluded. Please include this repair before your final CI/merge.

[LIghtJUNction]

Integration follow-up: f9fba2654a031ba4558a9b79a887d135d551fd79

The previous merge candidate a962d7f exposed a real #74 integration defect after main's lease fencing: _live_attempt persisted an expired market job as uncertain, while the order email projection remained queued. A real signed-checkout regression reproduced queued != delivered_unknown before the fix.

The new commit integrates main b1ac767 and updates only the still-selected, enabled buyer endpoint when a lease expires. Late finish/retry cannot resend, overwrite a disabled endpoint, claim goods or change settlement. Four new cases cover finish/retry × enabled/disabled notifications.

Verified locally: 59 passed, no skips, combining the new market-lease cases, main's lease deadline/retry suite, delivery regression and complete isolated application selftest. The final source also builds as sdist/wheel; installing that wheel into a fresh target confirms both the rationale module and lease-notification integration are included. Published source tree 98058a696597c388d33e1039e4174e39e8bafaed matches the local tree. Complete collection is 1136 tests; collection is not execution.

Prior 87185b0 validation remains recorded separately: 126 integrated PostgreSQL cases, 24 transport regression cases, 8 conformance cases and the missing-rationale red/green regression. A consolidated exact-final-tree regression and full GitHub CI are being checked; neither the old cancelled run nor a queued run is a passing gate. Issues #73–75 remain open pending successful merge.

[LIghtJUNction]

Continuing #73–75 integration: I see the new main/custodial merge at 8bf48a5 and will preserve it (no reset/force-push). Before merging, I am adding a small follow-up with reproduced HTTP regressions: the new lifecycle's emailed /_orders//_delivery URL dispatches to delivery.get@1, where the legacy target validator rejects the new target; unpaid orders.payment reads also index an empty receipt list. The fix will restore an authenticated read-only lifecycle bridge and report pending/no receipt for unpaid quotes. All legacy transport assertions remain. Please leave this PR unmerged until that follow-up and its exact-head complete CI pass; the cancelled ff4dd87 run is not acceptance.

[LIghtJUNction]

Exact-head local verification completed for 5983f31 (tree 2b690a68d3b964e552ad7245b7d752e2c4cdaebb): 300 passed, 0 failed, 0 errors, 0 skipped, 382.54 s, real PostgreSQL 17/Valkey/age on Python 3.13. This run includes market*, orders/HTTP paths, both legacy checkout contracts, both escrow journals, effect completion/retry fences, actual backup/restore, ledger migrations, registry/sharing, all custodial tests, complete isolated feature selftest, CI evidence integrity, test collection, base delivery/service. JUnit confirms those counts. These are one combined run, not summed overlapping earlier subsets.

Wheel + sdist built successfully from the same exact tree. The wheel's market policy/rationale, order/delivery, worker lease and new custodial lifecycle modules were checked byte-for-byte against source.

This does not replace required Python 3.15/PostgreSQL 16 CI. Target run 36383461953 has four queued shard jobs; there is no passing exact-head gate yet. Prior cancelled/superseded runs are not acceptance. No code/CI assertions were weakened and no production state was touched.