Implements the review phases left open by the previous tranche in the two
pure crates, per REVIEWS/NIGIG_PAY_CONSOLIDATED_REVIEW.md.
nigig-pay-domain:
- evidence.rs: ObservedEvidence/EvidenceLog make SMS and USSD output an
untrusted observation that can raise a reconciliation flag but can never
settle a payment (0.4, B2). Replays are de-duplicated by a deterministic
body digest; only the digest is retained, never the raw body (0.6).
- reconciliation.rs: explicit queue with typed reasons and attributed
resolutions (2.8, 6.3). SafeToRecreate never mutates or re-dispatches the
original intent. The user-facing message says "do not retry" and never
"failed" (U4).
- coordinator.rs: operation_id -> intent index so an unmatched callback
changes nothing (2.7); hard duplicate-dispatch guard where only a
never-started dispatch refunds the budget (2.9, B3);
expire_local_confirmation_window replaces Submitted -> Failed on timeout
and cannot disturb a settled payment.
nigig-pay-storage:
- schema migration 2 adds payment_intent_evidence with a unique digest
constraint and a durable payment_reconciliation_queue (3.2, 3.3).
- legacy import now durably queues unprovable records.
- fault-injection tests for unwritable path, corrupt file, unusable worker
path and audit-insert rollback (3.4); restart-equivalence tests (8.2).
Both crates deny unwrap/expect/panic/indexing outside tests (7.8). That
ratchet caught PaymentStorageWorker::spawn aborting on thread-spawn
failure; it is now fallible and returns StorageError.
Validated in an isolated toolchain over copies of the two pure crates:
cargo fmt --all --check clean, cargo clippy --workspace --all-targets
-D warnings clean, 43 domain tests and 17 storage tests passing, and all
49 workspace manifests parse. The full workspace is not asserted buildable
here: external Makepad/Robius sibling path dependencies are absent, so the
Makepad UI wiring, SQLCipher/Keystore encryption and the Java PIN scrub
remain explicitly unclaimed.
