Disposable canonical-event inbox rehearsal

docs/production-plan.md

@@ -88,6 +88,8 @@ Blocked on P0 ADR; use P1 amount types and P2 durable events. Consensus work is
 
 **Accounting rehearsal increment, 2026-10-20:** [signed candidate → PostgreSQL reservation resolution](custody-sale-rehearsal.md) now exercises actual restricted-role SQL terminal postings from bounded synthetic transcripts, behind explicit disposable database/instance guards and without an HTTP route. Exact terms/hosting recipients and reservation commitments are checked; mature completion credits seller/fees once, cancellation/non-admission releases buyer funds, and conflicting post-settlement evidence durably holds mutations rather than repaying. Insert-only first/terminal evidence is audited. Final build, 172 offline tests and 22 PostgreSQL integration tests passed. This supersedes the earlier absence of any balance-posting test integration, **not** the production/activation boundary: caller-supplied seeds/blocks are not canonical evidence, intermediate unseen disconnects cannot be detected, and no signer, canonical inbox, live deposit/withdrawal or current-chain paid sale is enabled. M3 remains open.
 
+**Canonical inbox rehearsal increment, 2026-10-20:** the same gated disposable PostgreSQL instance now stores bounded append-only pages from an in-process `Ledger` adapter, checks stream/anchor/hash/tip/ancestor continuity, permits exact/overlapping/stale consumer retries, and verifies retained history during audits. Integration tests use locally validated blocks to exercise an excluded equal-work branch and a real reorg; tampering or stream changes durably hold mutations. Final build and 27 PostgreSQL tests pass; the offline regression count remains 172. The adapter is not scheduled, its stream is not tamper-proof against a schema owner, it does not match candidate transaction IDs or drive per-order settlement/reorg review, and the inbox's 4,096-event cap/full scan make it explicitly non-production. M3 remains blocked on production observer/checkpoint design, candidate network activation, transaction linkage and per-order reorg handling.
+
 - If a reviewed trustless design is selected: implement its actual cross-chain validity/evidence rules, compatible cryptographic primitives, both-party failure/refund paths and commission semantics. Run maintained reference vectors, negative tests, fuzz/property tests and specialist audit before claiming atomicity.
 - If a custodial/attested fallback is explicitly approved: define chain-enforced NFT lock, order identity, authorized releaser, cancellation/refund/expiry and stale-signature rules. Separate host control keys from seller wallet and processor payout keys. Reserve/refund procedures must not permit both buyer refund and later seller delivery/release. Describe who can steal, censor or lock assets and how recovery is authorized.
 - Completed-sale inclusion must require the approved evidence that payment is sufficiently confirmed. A peer must not insert a completed sale merely because its local database says paid. Define threshold/policy version, proof/attestation authorization and deterministic validation; no external HTTP calls in consensus validation.