[stmr]

Scope

Closes #1499 without replacing the accepted lease-fencing implementation. Integrated upstream main 22fd831bdd422de4e8b1fac9c058d2332a02a136.

• Do not cache transient responses or nested reconciliation/in-progress errors; retry can execute again. Preserve deterministic replay, lease ownership, bounded encoded-body inspection and approved response headers.
• Preserve payer isolation in billing lookups and duplicate-request handling.
• Verify successful quote-bound on-chain app-token payment before fee signing; consume quote/payment atomically. Explicitly lock the quote before checking expiry after a lock wait. Compare the actual signed-envelope fee to the quote.
• Restore full type/test contracts and keep SQLite demo startup compatible with PostgreSQL-only migrations.

API change: fee execution requires quoteId, the unchanged inner XDR, and a 64-hex payment transaction hash. Payment must carry the quote's MEMO_HASH. See docs/fee-abstraction.md.

Verification

Verified source tree: ee43bd3754d5acb556586133ebd77dfbac57b908; public head 5da7305c51371d35767218b8680f4abcf26afa77.

• Local lint, full typecheck and application build passed.
• Full default suite against isolated native PostgreSQL: 191 suites / 2,844 tests passed, with two pre-existing skips; one snapshot passed. Default PGlite payment route mode also passed all 38 cases.
• Native PostgreSQL deterministic regression: 4/4 real multi-backend row-lock, rollback, unique-payment-index and expiry-during-wait scenarios passed. Runnable check: tests/integration/feeAbstraction.postgres.mjs.
• Actual compiled HTTP + SDK signing on native PostgreSQL: two requests blocked in distinct backends; exactly one cryptographically valid signed envelope. Unpaid/mismatched requests, replay and signing-failure rollback/retry checked. Synthetic chain transport only; no real funds.
• Compiled HTTP middleware/billing smoke: transient recovery, encoded replay, safe headers/cookies, body cap, lease fencing and payer isolation passed. Vercel bundle HTTP smoke passed.
• Independent Sol-model read-only payment review found no remaining concrete financial blocker. Exact XHigh effort is unconfirmed, not claimed.
• Exact-tree author-side Linux CI completed: build-and-test (including lint/types, 191 suites / 2,844 tests, bundle smoke) and OpenAPI compatibility passed. Migration-policy failed on the existing ten published-history violations. Overall CI is NOT green. The temporary validation PR was closed unmerged.

Release blockers — remains draft

Published SQL history is unchanged. The unsuppressed migration checker reports ten existing layout/approval violations: duplicate prefixes 26/27, missing payout/quote rollbacks, and missing destructive-approval markers. They require maintainer confirmation of deployed history before a data-safe repair; do not rename or replay financial backfills blindly. Existing deployment-history request.

No migration-policy waiver or maintainer CI configuration change requested. No deployment-readiness, points, award or payment claim.

[drips-wave]

@stmr Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[stmr]

Fixed the reachable author-side full-suite regression in eb3fd3f: the test now reads the current documented error.code envelope, preserving the same-key reconciliation→success→cached-replay and exactly-two-deductions assertions.

Full original Linux workflow on the exact source/tree: build-and-test passed (full lint/type/build,175 suites/2629 tests/1 snapshot,2 existing skipped tests, Vercel bundle), and OpenAPI compatibility passed. migration-policy still fails only on the existing duplicate0026 prefixes (twice) and missing payout rollback. Overall CI is therefore not all green.

The only remaining repair prerequisite is the published-migration deployment-history clarification, needed to avoid replaying a financial backfill or invalidating applied artifacts. No CI-setting change or weakened check is requested. Keeping this draft until the data-safe migration resolution is possible. No merge, deployment, points or payment claimed.

[stmr]

Integrated accepted main 22fd831 and pushed 5da7305c51371d35767218b8680f4abcf26afa77 without force; verified tree ee43bd3754d5acb556586133ebd77dfbac57b908.

Exact-tree Linux run: build-and-test passed (lint, full types, 191 suites / 2,844 tests, Vercel HTTP smoke); OpenAPI compatibility passed. Two pre-existing skips remain. Overall CI is not green: migration-policy still reports ten published-history/layout violations. No historical SQL was edited or renumbered; the existing deployed-history question remains the prerequisite for a data-safe repair.

Payment signing now verifies quote-bound on-chain payment and consumes it atomically. Native PostgreSQL reproduced an expiry-after-lock-wait bug; explicit row locking fixes it. Four deterministic multi-backend races passed, plus real compiled HTTP/SDK signing with two blocked native backends and exactly one cryptographically verified envelope. Synthetic chain transport only; no real funds. The API requires quoteId and the quote MEMO_HASH, documented in docs/fee-abstraction.md.

The temporary author-side validation PR was closed unmerged. Keeping this PR draft; not claiming deployment readiness, points or payment.