Loop B red-team (money/security/dup-mod adversarial) findings on the full payments overhaul:
- CRITICAL-ish: IDEMPOTENCY_KEY_REUSED (409) no longer classified as a definitive
402 in chargeFailureStatus — it means the ORIGINAL charge may have landed with
a different body, so it is now AMBIGUOUS (503): the frontend keeps the same
idempotency key, the pending row stays rescuable by the sweep (which already
treated it as ambiguous), and the frontend no longer regenerates the key into
a possible double charge. SCA verification-required codes remain definitive 402.
- HIGH: reissueTwoFACodeAfterFailedCharge now writes a CRITICAL admin notification
(insertCriticalPaymentNotification) when issuance is refused (missing pepper /
unavailable delivery) instead of silently stranding the customer; documented that
a pepper CHANGE invalidates all pending codes.
- MEDIUM: family-alive cache invalidation crash window documented (invalidate-after-
commit leaves up to 30s warm on a crash; the near-TTL DB re-check bounds it).
- Consolidation regression checks (8b2fe3b helpers): writeChargeSnapshot guard
preserved at all sites, postChargeRecheck identical, squareRefundStatusToLocal
mappings verified, reissue fresh-only semantics confirmed at all 5 call sites.
Verified: 26/26 dev packages, both vet tags, frontend tests + build, env-docs 42/42.
popertots
dfe856b181