Evidence level: historically reviewed source and owner proposals; not freshly tested or certified for production.
Design and implementation invariants
- Commerce owns immutable purchase admission and order status, not the financial ledger or provider dispatch.
- Buyer webhook outbox delivery requires durable deduplication, bounded retries, lease/fencing handling and a recoverable notification state.
- Seller accounting and purchase admission require consistent owner boundaries rather than mixing in-memory adapters with unverified live YSQL state.
Verification still required
- Verify durable buyer notification worker state, reconnection and retry behavior using the owning Commerce contracts.
- Prove the Wallet hold and dispatch-intent linkage with live authorized YSQL roles, including negative and crash paths.
How to update
When the owner changes implementation or contract behavior, update this page and the relevant service interfaces. For cross-service changes, also update the platform interface map or decision register. State the actual verification performed; do not inherit historical pass claims without fresh evidence.