Record native dues failure and recovery verification

[daliu]

The connected staging dues flow now has a dated native failure/recovery receipt. It records caller/current-Auth denials, concurrent and uncertain purchase recovery, missed-callback reconciliation, actual sandbox refund holds, disabled-account/old-year payments and failed-card expiration. Injected faults and signed synthetic callbacks are explicitly distinguished from genuine Stripe Events and payments.

Officer impact: a stuck or held purchase retains its original evidence and needs specialist reconciliation; officers must not start another charge. The failed-card expiry screen remains a safe lock, not complete self-service recovery.

Officer documentation: OFFICER_START_HERE.md, docs/officers/TEST_DUES.md and README.md, docs/TEST_DUES_NATIVE_RECOVERY.md, the preceding hosted receipt, specialist dues guides and six root checkpoints. No final page structure, data movement, permissions or deployment changed, so existing diagrams remain accurate.

Deployment evidence: both native v1 Function archives still match approved application71f59e2/c31a22ed; website marker is unchanged. The isolated sandbox webhook was restored with its original settings after a 71-second lease. All ten fresh Sessions are complete/expired. Eight Auth identities and 26 disposable records are absent; 33 financial records retain their hashes. No application, Rules, IAM, secret version, runmprc.com, production or real-payment release.

Validation: native staging/provider/browser receipts; 16 focused helper guard checks; exact-file genuine Opus5.5 medium approvals before external helper mutations; final release verification; git diff --check; 157 relative documentation links resolve. Genuine Opus5.5 medium full review and provenance addendum APPROVED exact head a52fc95; CI39073801397 all6jobs/every62steps passed. Root verified unchanged13file hashes/tree4242e530. Native Git-ref read denial in the first review was resolved by the zero-denial final addendum, with no source change.

Qualification limits include issued foreign-tenant JWTs (native project has tenants disabled), actual asynchronous payment-method UI, full dispute lifecycle, restricted-key permissions, real calendar rollover and distributed outages. Further withdrawal/suspension/revision/failed-write cases retain source/emulator coverage only. Family enrollment, final legal policies and production/live money stay separate.

Refs #742.

[netlify]

✅ Deploy Preview for luminous-fox-7c393f ready!

Name	Link
🔨 Latest commit	a52fc95
🔍 Latest deploy log	https://app.netlify.com/projects/luminous-fox-7c393f/deploys/6ad3f1c0af6d1784b154b5df
😎 Deploy Preview	https://deploy-preview-746--luminous-fox-7c393f.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[daliu]

Genuine Opus5.5 medium APPROVED full head a52fc95a2609dbb0cadc42f1e0b28416dd53371d. The full evidence review found no blockers and no required acceptance work remaining for the existing card-only/default-tenant staging scope. A final read-only provenance addendum read the actual Git HEAD/branch ref and reaffirmed that exact40character head with zero permission denials and no model fallback. The first metadata-read denial is resolved, not counted as a source review or bypassed silently.

Root independently verified the unchanged patch and13file hashes, exact commit/tree 4242e530771a98332141f5498d4d919fa233a15b, and native CI39073801397 on that exact head: all six jobs and every step completed successfully, no skips. Existing Dave-authorized administrator merge capability supplies the delegated review gate; no fabricated GitHub reviewer or protection change.

Officer impact: the dated receipt and guide explain interrupted/late payment retention, refund holds and specialist-only failed-card recovery. Officer documentation: all13changed documentation files; no final architecture/diagram or application change. Deployment evidence: source71f59e2/duesv1/archivec31a22ed and original enabled test endpoint were reverified independently; no deployment or real-payment/production action.

#742 may close only as the tested staging/card-only/default-tenant outcome. Native full dispute lifecycle, foreign-tenant credentials, real async methods, restricted-key permissions, family invitations, final policies and real-money/production approval remain separate and unclaimed. Clearer failed-card recovery wording is an optional follow-up.