English source · 32 min

Source responsibilities and verification map

Invoice checkout: src/payments/instructions.rs owns the typed recipient projection and customer/compound merchant rights. PaymentInstructions.tsx and its adjacent stylesheet render it in the existing native completion checkout. Provider source creation, recipient persistence and polling stay in the private Rust payment service. Contract, migration and acceptance.

Provider test modules: Mail fixture reuse, connected app scenarios and the native Rust regression command. The suite registry keeps its existing entries. Shared test servers live separately from test cases; the archived comparison implementation remains confined to tests.

Merchant catalogue setup: CSV upload, URL extraction, described demo products, private image jobs and native staged review.

Saved merchant planning: Native tasks, private checkpoints, worker restart, current authority and explicit continuation. agent_runs/ extends the existing planner/approval owner; it is not another agent backend.

Agent delegation: Planning-only keys, conservative central model allocations, personal live-shop stop and actual worker fences. The existing identity/task/outbox owners remain authoritative; cognition reuses the pure kernel allowance guard.

Browser authority: Merchant/customer HttpOnly transport, exact origins, cross-tab fences and Studio CSP.

Personal workspace and standard-shop editor: Illustrated workflow, shared models, rights, history, forms and publication.

Guided shop setup: Six review steps, inline native company editing and local acceptance. frontend/src/admin/setup/ owns the guide and return path, with its scoped PRODUCT.md brief retaining the existing Studio design. Its provider checks saved setup changes across tabs while preserving unrelated fresh workspace fields. SetupBasics.tsx reuses the existing settings draft, fields and save bar. Optional progress remains in src/studio/personal/model.rs with workspace revisions, RLS and history. src/agent_runs/context.rs admits bounded current setup context to the existing assistant. Domain tools and publication retain their native owners.

Studio setup and access: Channel wizard fixes, reusable roles, current grants, central B2B configuration and guided company creation.

13 October integration audit: shared current rights, configuration versions, selective publication, native POS defaults, B2B history/staging and inherited visitor controls are mapped in the connected feature guide. The testing guide separates current source checks from dated hosted acceptance and real-provider prerequisites.

Visitor behavior intelligence: consent-bound guest/customer observations, native orders and the current semantic product graph now meet in one channel report. Studio charts and private timelines use the same HTTP/MCP permissions. Data flow, native owners, setup and verification.

12 October workbench update: editable app patterns, explicit AI/agent proposal review, native control generation, approved catalogue translation jobs and scoped personalization. How to use it, ownership and verification boundaries.

main.rs contains process setup and the module registry. It delegates migrations and dependencies to bootstrap.rs and transports to routes.rs. HTTP, MCP and UCP invoke shared operations, rather than independently reimplementing checkout. Small modules use a crate-level shared type/import facade; SQL helpers remain internal. commerce/ and auth/ group their types, validation and operations. structure.py prevents Rust modules from exceeding 320 lines and keeps main.rs under 120. Every Rust source starts with a responsibility comment.

The five domain crates (kernel, commerce, apps, cognition, runtime) have explicit dependency boundaries checked against real Cargo metadata. New helper packages, external dependencies and build scripts require review; renaming a dependency does not evade its capability check. Kernel policies and handwritten Lean claims now share seven domain owners. Module audit and formal guarantees.

The table lists executable behavioral coverage, not percentage line coverage. Pure rules use Rust tests; API/domain/storage modules are exercised against real PostgreSQL, Qdrant and (where enabled) the real local model. Tests include rejected inputs and state effects. A module's presence does not count as a test.

The maintained full inventory, including all newly added Rust files, frontend feature folders, independent services and SDKs, is module-inventory.md. Coverage percentages and explicit remaining gaps are in testing.md. The tables below describe selected behavioral suites and must not be read as 100% coverage.

The public website's shared styles live in nine documented modules under site/styles/, each at most 320 lines. The ordered site/style.css entry is bundled once by scripts/build_site.py; marketing and handbook keep their existing asset URLs and identical CSS. scripts/check_site.py compares both published assets to that bundle. Extraction evidence.

Marketplace app and generic intake

extensions/apps/marketplaces/ owns provider protocols, mapping, inbox/review, worker, Studio vocabulary/UI, container packaging and local provider tests. Core only adds the provider-neutral apps/core_exchange.rs, commerce/external_order_input.rs and commerce/external_orders.rs host contracts, with its bounded commerce/external_order_labels.sql name lookup. Existing product/channel configuration, app consent/jobs/records, currency, stock, customer projection, documents and event owners remain authoritative. Detailed flow and actual limits. The registered marketplaces suite exercises native paid order/replay/restart, isolation, document and stock state effects; frontend tests exercise controls.

Native POS

src/pos/{config,gateway,input,workspace_gateway,customer,discount,schema,settlement}.rs are native channel adapters. Catalog/cart/currencies/promotions, order_checkout.rs, checkout_review.rs, inventory, payments, documents and outbox remain the commerce owners. marketing/coupons.rs retains the existing coupon handler with private-cart admission. customer.rs delegates to shared accounts with current PII admission; discount.rs delegates to native allocation/tax and transactional outbox. operations/receipt_text.rs exposes the same immutable invoice projection to the system printer. frontend/src/admin/pos owns the focus/scanner, customer, discount, printer and read-only advice workspace; app code stays in its own package. Real pos.py/payment_providers.py and UI regressions cover state effects. Architecture, proof scope and limits.

Production foundations

The illustrated architecture guide connects ingress, tenant scope, stock/money/payment transactions, outbox projections, AI and deployment. New boundaries live in money.rs, tenant_scope.rs, performance/{row_security, admission,invalidation}.rs, commerce/inventory.rs, payments/state.rs, platform/quotas.rs and migrations/schema.rs. Unit tests, the strict production_foundations suite, payment fixtures and original-Shopware money boundary comparison cover their effects; asynchronous SQL and provider code remain unproved.

International configuration and language boundaries

commerce/geography.rs owns catalogue/overlay/address admission; tax_rules.rs owns guarded destination selection and tax_context.rs its private Rule Builder facts. settings_defaults.rs, method_text.rs, content_text.rs and product_languages.rs own compatibility defaults, translations and language registration. international_capabilities.rs shares native HTTP operations with MCP. translations/{routes,worker,fields,apply}.rs own durable translation lifecycle, text-only inference and locked revision-checked apply. The real PostgreSQL suites international_commerce.py and translations.py plus catalog tests cover these paths. frontend/src/shared/geography owns controls reused in Studio and checkout. See international commerce for the exact contract.

Rust behavioral test map

New v0.5 modules

Frontend

Browser interactions were checked with the actual local app. They are not a committed automated browser regression suite. Accessibility, assistive-device coverage, all mobile breakpoints and exhaustive visual diffs remain additional work; do not infer those from screenshots or typechecking.

App frontend modules: AppsManager/AppEntity manage lifecycle/data; AppFrame provides the constrained iframe SDK bridge; AppSlot personalizes products; PaymentSession/PaymentManager display customer/provider state; admin/intelligence/KnowledgeView and MemoryRecommendations connect evidence to approved suggestions. app-i18n supplies four-language host vocabulary; apps.css scopes their layout. Verification: strict build plus actual browser navigation/data/configuration, backed by apps.py, services.py, payments.py and providers.py. No automated visual/iframe-browser regression suite is claimed.

Persistence, fixtures and tooling

Migrations 001–005 retain the earlier core/graph/context model. 006 adds SKU metadata, review storage and commerce settings; 007 initializes synthetic demo commerce once; 008 adds personal users/memberships/invitations/sessions; 009 corrects template variant capacity and the authored example review. Migrations are additive; existing stock/orders/prices are retained. Migration 010 adds managed app model metadata/storage, event deliveries, knowledge evidence and payment attempts/jobs/inbox/reservations; core monetary quotes retain their original shape. No production Shopware store is imported by these migrations.

fixtures/demo-catalog.json and demo-settings.json are fixed public templates for new workspaces, not exports of current merchant state. frontend/public/media contains 33 authored SVG illustrations. Four executable WAT policies and their limitations are documented in extensions/README.md.

The original Shopware reference lives in reference/ (Composer-pinned source and independent PHP runners). porting/units.json and scripts/port.py select incremental migration gates. scripts/dev.sh starts the isolated local demo; mcp_stdio.py bridges explicit client credentials. CI builds/types/lints/tests, executes original PHP comparisons and the real DB suites. Private state, credentials and DB backups remain ignored in .run, .env and local work.

See shopware-parity.md for exact equivalence boundaries and security.md for production gaps. No 100% code-coverage or full Shopware compatibility claim is made.

| src/checkout_handoff.rs | Generic expiring, single-use transfer of an authoritative cart; rotates tokens. | checkout_handoff.py real PostgreSQL concurrency/order checks | | extensions/apps/storyfront/manifest.json | Storyfront app capabilities, separate service and merchant UI contract. | Installed package + actual connector/browser flow; see storyfront.md |

Workbench and additional commerce domains

Migrations 011, 013–015 add source documents/chunks, environment/release/build records, customer sessions/profiles, rules/promotions/flows/channels/product metadata and anonymous behavior signals. Migration 012 contains checkout handoff. The domain file guard remains enforced: Rust modules at most 320 lines, main.rs at most 120 lines, each module starts with its responsibility comment.

Bounded reads and setup

scalability.py also checks a 120-variant family, last-page reviews, deep links, 64 cart edits with 32 clients and competing optimistic revisions. Independent processes were restarted against the million-product database, with warm database caches; this is not a machine/database cold-start or failover test.

Customer/merchant operations addition

The file guard verifies every Rust module's responsibility header and maximum 320 lines (main.rs maximum 120). Tests cover the listed actual behaviors; this does not claim every source line or every original Shopware operation is covered.

Formal policy extraction

The current Rust module status and review inventory are maintained in proof/manifest.json. The 63 consumer modules are reviewed bindings, not whole-module proofs. See the exact formal coverage and remaining gaps.

Connected provider apps and automation

The upstream condition-by-condition status is recorded in reference/rule-catalog.json.

Platform control plane

Frontend: PlatformConsole coordinates state; PlatformSignIn owns personal login; PlatformLanguage selects locales; PlatformDashboard renders factual metrics; PlatformShops owns directory/provisioning views; platform-api is the typed transport and platform-i18n contains complete operator UI translations. The production-mode Docker smoke test checks the packaged server and frontend.

Full-app surfaces and execution admission

Every host location and limit is listed in the full app contract. External app code, service declarations and frontend behavior remain outside the partial Lean proofs. No new core database migration was required for these optional manifest fields and shared app records.

Source rule and durable flow migration

See automation for the precise supported/disabled catalog and action mappings.

Reproducible local playground

The merchant walkthrough is playground.md. Its sample flow uses no model or external delivery provider. The exact current source inventory is generated separately.

Integrated catalog and category management (2026-10-05)

Original Shopware mapping, supported features and remaining gaps.

Company identity, per-channel inheritance, logos and legal storefront/issuer consumers: company settings module map. Real integration suite: scripts/company_settings.py; UI regressions: frontend/tests/unit/company-settings.test.tsx.

Scoped checkout settings, method dependency guards, selective staging and product media jobs: module map and verification.

Knowledge sources, product graph evidence, observed decisions and retrieval preview: domain ownership and verification. Real suites: knowledge_workspace.py, developer_documents.py, apps.py, connected_apps.py; component regressions: knowledge-workspace.test.tsx.

Managed storage/search integration: managed_search.py verifies ordinary PostgreSQL, real Qdrant, hostname scope, durable deletion/retry and lexical fallback with synthetic embeddings. It does not measure AI quality.

Connected CRM and entity history

history/{mod,routes,capability,restore,product}.rs owns trusted attribution, scoped paging, MCP parity and restoration through domain handlers. Migrations 034/035 capture transaction-coalesced aggregate snapshots. accounts/address_restore.rs owns validated address-book restoration; commerce/{customer_groups,group_usage}.rs owns group definitions, price basis and dependency admission. shared/history/ is reused by native editors and admin/shell/useEntityNavigation.ts owns scoped entity/back paths. scripts/crm_history.py and frontend/tests/unit/crm-history.test.tsx cover these paths, alongside existing customer, merchant, automation and staging suites. See history boundaries.

Guided app extension path

App assistants compile the shared Manifest in frontend/src/admin/developer/assistant-model.ts. Product/customer/order mounts reuse the native renderer with explicit object context. src/apps/editor_contract.rs owns field/context and direct-route scopes; src/apps/planning.rs filters merchant grounding and rechecks app proposal access at bind/apply. src/apps/schedules.rs and webhooks.rs persist emitted events/receipts via migration 036. scripts/app_assistants.py and app_surfaces.py exercise actual private stages, public/MCP boundaries, service fixtures, event/Flow writes, restart and scope rejection; frontend assistant tests cover editing and regional language inheritance. See guide and upstream extension requirements.

Platform control plane

Default fashion fixture

src/demo_catalog.rs copies the public Nord Atelier fixture into newly provisioned tenants and seeds an opt-in built-in demo once. src/auth/provision.rs controls whether catalog insertion is requested. src/knowledge/relations.rs chooses catalog-specific curated links. scripts/fashion_demo.py checks signup, localized names/navigation, actual images, all three coat sizes, tenant-separated stock, simulated checkout and a fresh-process restart. See the complete demo contract.

Trusted private experience boundary

src/auth/{broker,broker_inference,handoff}.rs owns route-bound signatures, one-use personal login and inherited inference. src/shop_domains/frontends.rs owns guarded public mounts and credential-stripping proxying. src/commerce/product_create.rs accepts stable import IDs through the normal product save pipeline. scripts/identity_broker.py covers actual HTTP/PostgreSQL ownership, replay, scope, paused-shop and restart behavior. See configuration and trust boundaries.

• src/storefront_pages.rs: direct product URL HTML admission using existing tenant/channel policy.
• frontend/src/storefront/catalog/product-url.ts: localized product URLs, legacy SKU routes and collection navigation.

European operation

src/legal/ owns privacy policy/receipt, guarded checkout snapshots, sector facts and consumer request review. frontend/src/{admin,shared,storefront}/legal/ connects their actual interface and consent consumers. Migration 048 scopes receipts, logs and review audits; the email connector and Flow Builder consume their outbox events. See the complete behavior map and limits.

Hosted frontend transport

src/shop_domains/frontend_transport.rs streams the fixed, authenticated external frontend response with backpressure and an 8 MB cumulative body limit. SSE starts before upstream EOF; a body failure closes the stream. HOSTED_FRONTEND_COOKIE_NAMES defaults empty and optionally permits at most eight opaque anonymous shopper cookies. Login credentials remain stripped. Cookies returned to the browser must be host-only, Secure, HttpOnly and SameSite=Lax; redirects must be relative. This generic adapter contains no private Storyfront implementation. identity_broker exercises routing, foreign-shop denial, cookie filtering, paused shops and streaming through the real HTTP service. The network adapter remains outside the Lean proof boundary.

src/auth/broker_credentials.rs owns explicit trusted-email password enrollment/recovery and existing-password verification. Migration 052 marks new broker accounts pending; sessions.rs reports that state and handoff.rs enforces enrollment before Studio entry. scripts/identity_broker.py checks real login, ownership, replay and revocation. See merchant password enrollment.

Channel access and frontend bindings

marketing/channel_access.rs is the shared Store API/UCP/MCP/hosted admission boundary; channel_preview.rs owns personal, one-use browser previews. auth/middleware.rs strips forged preview principals and adds the validated request marker consumed by catalog, cart, navigation and legal paths. shop_domains/frontend_bindings.rs owns revisioned tenant/Experience alias CRUD; it reuses hosted_frontends, not another domain registry. The private renderer remains in the private integration repository. See channel management for behavior and limits.

HTTP failure diagnostics

src/channel_metrics.rs owns the bounded interval buffer and single bulk flush; src/channel_metrics/reads.rs shares exact status aggregation across operator overview, shop dossiers and infrastructure. src/studio.rs supplies status and sanitized route-template logs after authentication admission. Migration 056 preserves historical totals and adds only a bounded status-code histogram. frontend/src/platform/HTTPResponses.tsx presents access refusals, other 4xx, 5xx and unclassified history with the shared translated vocabulary. channel_metrics unit tests, scripts/platform_control.py and http-responses.test.tsx cover classification, real persistence, tenant-scoped reads, historical preservation and display. See the measurement boundary.

Core hardening owners

• src/request_context.rs, src/auth/{route_policy,identity,abuse,dto}.rs and identity.sql: trusted Principal, explicit method rights, one current grant lookup, persistent login admission and typed auth requests.
• crates/runtime/src/scoped_pool.rs, src/performance/{pool,row_security,cluster_lease}.rs, src/runtime_config.rs: local transaction scope, guarded session borrows, validated startup contracts and shared resource/connection budgets.
• src/sandbox_cache.rs, src/apps/runtime.rs, src/assets/image_provider.rs: bounded Wasm compilation/execution cache and blocking-pool image processing.
• src/work_signal.rs, src/outbox.rs, src/outbox/{control,retention}.rs, retention.sql and migration 057: commit hints, isolated retries/quarantine, permission-checked recovery and bounded retention.
• deploy/sql/provision-runtime.sh, scripts/security/core_hardening.py, scripts/testing/pooler.py, scripts/transaction_pooler.py: least-privilege provisioning and actual two-replica/one-backend PgBouncer regression paths.

All eighteen findings, shared architecture and exact limits.

Request-hotpath consolidation (2026-10-08)

Raw measurements and exact limits; SQL/async adapters remain unproved despite explicit source-review locks.

App-platform ownership

The connected extension contract and file-level ownership are maintained in App platform, App Studio and App security. The generated module inventory lists every actual Rust/frontend/example source, including modules without measured coverage. Rich descriptions now share frontend/src/shared/content/editor/; do not create a separate app editor or catalog-only implementation.

Connected cognition foundation

The cognitive commerce guide maps migrations 071–078, bounded retrieval/model protocols, original registry read tools, native guardrail apply, evidence/signatures, controlled layout trials and private cart preferences. Its audit tracker identifies still-unimplemented recommendations. The generated module inventory includes every new source; no complete-core proof or 100% behavioral coverage is implied.

Forced-RLS lexical candidates

migrations/079-knowledge-lexical-indexes.sql owns transactional word projection backfill/triggers and composite source containment. src/knowledge/search.sql and src/documents/search.sql narrow candidates, then hydrate/rank/admit current native records. src/documents/retrieval.rs remains the public/private retrieval adapter. scripts/lexical_search.py, registered in the existing integration suite registry, checks real non-owner plans, native edits, withdrawal, source deletion and foreign-context rejection. These are rebuildable indexes, not another source registry. See the performance and migration boundary.

• src/apps/ontology.rs: validated namespaced app-node/edge metadata and bounded projections of current authorized native records; no second graph fact store.
• frontend/src/admin/developer/AppOntology.tsx: shared-language mapping controls over the exact human/agent app manifest.
• scripts/app_ontology.py: real API/MCP tenant, permission, reference and revision regression.

Checkout continuity source owners

App generation edits are adapted by src/developer/generation_edits.rs as bounded JSON Patch into the existing Manifest; generation_contract.rs and builds.rs remain the storage/access and validation owners.

App lifecycle and ERP reference ownership — 12 October 2026

apps/record_lifecycle.rs validates generic Manifest initial states, permitted edges and immutable fields. apps/data.rs enforces them and the current installed package digest inside the record/outbox transaction. apps/service_limits.rs owns shared egress bulkheads and replica-wide tenant/app leases.

The reference business vocabulary lives in extensions/apps/returns-workspace/. extensions/apps/erp-handoff/service/ owns independent Rust ERP delivery, configuration and app-private forced-RLS receipts; extensions/sdk/rust-events.rs is only a shared wire verifier. The registered erp_handoff suite delegates to that app's tests. app_assistants covers actual transitions and an upgrade/write race; app_events exercises aggregate admission across two real replicas. See the runtime and privilege boundary.

Modular B2B and EDI — 12 October 2026

Native company units, current employee rights, private catalogs, currency-bound budgets, separate approval, RFQ negotiation, quick order and repeat lists reuse the existing checkout, inventory, order, document and Flow owners. The Studio and customer account use the same API/MCP contracts. Setup, source owners and precise B2B comparison. The independent extensions/apps/edi/ package owns bounded EDIFACT/UBL/cXML parsing, mapped private requisition import and immutable native document export; no Core codec or second ledger. EDI profiles, deployment and network/certification limits.

Shared publication and observation owners

marketing/channel_config.rs owns transactional channel admission for native writes and releases; marketing/flow_policy.rs checks current action rights. staging/access.rs checks each selected domain and final_config.rs validates the final aggregate/POS defaults. b2b/staging.rs clones only configuration/catalogs and delegates publication to the same organization/catalog transactional writers. legal/model.rs owns inherited visitor settings; behavior capture/report/journey and consent disclosure consume that same policy. Shared history exposes B2B configuration over HTTP/MCP without financial rewind. No second settings, audit or analytics ledger is introduced. Integration map and limits.

Personal account security

auth/{totp,mfa,sessions,handoff,broker_session,broker_recovery,broker_credentials,routes}.rs own personal factor evidence, verified identity assertions, credential revisions and session/continuation admission. Migration 091 adds forced system-only identity state. The merchant/operator UI lives in frontend/src/shared/auth/. Existing outbox events record secret-free security changes. Registered account_security and identity_broker suites exercise native effects and restart. The private Experience owner implements email recovery/forms and rechecks current native proof; exact setup and boundaries.

Provider-neutral fulfillment additions — 14 October 2026

Shared agentic grids — 14 October 2026

frontend/src/shared/grid/ owns the generic shell, layout-only preferences, stale-read fences and explicit filter review. The order/catalog/customer directory adapters own columns and navigation; declarative NativeDataBlock tables reuse only presentation and retain their existing action/inline-form contracts.

operations/{list_criteria,order_list,grid_schema,grid_plan}.rs and existing catalog/ customer list owners supply native validated queries and central model planning. MCP shares the field schema and handlers. grid_directory.py runs actual isolated PostgreSQL/Store API/HTTP/MCP/model wire checks. Guide and ownership boundaries.

Admin customer and reviewed order creation

operations/customer_create.rs commits profile/default addresses through native accounts/history/outbox; manual_orders.rs adapts native carts and checkout; manual_order_admission.rs owns actor-private and locked final admission; creation_schema.rs exports the same MCP contract. Studio uses modular CustomerCreate, OrderCreate, useOrderCreation, OrderProductPicker, OrderReview and the shared native customer picker. Workflow and proof boundaries.

Shared content editing styles belong to frontend/src/shared/i18n/content-editors.css, imported by the language picker and localized field themselves. Bounded customer selection owns frontend/src/shared/customer/customer-picker.css; B2B and Admin orders reuse it. A direct editor entry must not require visiting settings first.

Connected App Studio workbench

Site-builder page shape admission stays in extensions/apps/site-builder/: server.rs owns page/theme and current-shop validation, block_validation.rs reports bounded block/property errors, and planning.rs exposes the nested format to both native merchant planning and the coding-agent handoff. The same native checks run before review and before managed save; model guidance grants no rights.

See the illustrated workbench guide for multiple placements, compact adjustable panels, the contextual AI drawer, model-backed form editing, shared Flow visuals, installed app settings and scoped integration keys. These extend the existing native Manifest, runtime and release owners.

Fixed app storage

apps/records.rs, data.rs, native schema migration and PostgreSQL migrations 101–102 own logical models, record CAS, fixed index/reference projections and existing-data consolidation. App-specific business code stays package-owned. See storage, maintenance cutover and tests.

Native app lifecycles

apps/native_lifecycle owns bounded declarations, compilation, accepted snapshots and policy facts. commerce/fulfillment and b2b/quote_lifecycle retain native transition admission; quote offer/accept/checkout stay with their existing owners. b2b/contract owns the shared native operation catalogue. The example vocabulary stays in extensions/apps/production-review. See the workflow guide.

Inward agentic commerce

src/ucp/ adapts native carts, single-use handoff and native privacy receipts; src/legal/buyer_consent.rs protects contact requirements in every checkout. extensions/apps/catalog-import/ owns provider parsers and read-only Shop MCP egress; the existing native catalogue intake owns review, private save and release. frontend/src/admin/channels/AgenticChannels.tsx owns readiness presentation, and frontend/src/storefront/shell/storefront-actions.ts shares actual UI and optional browser-agent cart commands. Workflow and boundaries.

External services

Service integrations maps ten user-facing routes to the existing app, migration and native API owners. App-owned protocols reside in extensions/apps/{vercel,klaviyo,hubspot,contentful,algolia}/src/; extensions/services/connectors/src/integrations.rs hosts their generic queue and credential-revision fences. Shopware 6 extraction/normalization stays in extensions/apps/migration/; Nexus is an HTTP setup recipe only.

Configurable merchant reports

src/studio/reports.rs owns HTTP/MCP admission and snapshot composition; src/studio/reports/{config,period,traffic}.rs owns typed preferences, calendar bounds and reuse of native consent eligibility. Bundled SQL aggregates native orders/payment attempts without another ledger. frontend/src/admin/reports/ is shared by Shop today and personal workspace areas. Existing private workspace CAS/history stores presentation choices only. merchant_reports tests real native checkout/POS, consent, current rights, isolation and historical fixtures. See merchant reports for metric semantics and bounds.

Native capture and refund allocation

payments/{capture_configuration,capture_admission,settlements,refund_allocation}.rs reuse native shop settings, attempts, jobs and receipt claims. generic_receipts admits immutable provider evidence; worker preserves attempt-before-job locking. The shared Studio admin/payments/PaymentActions is used by orders and payment management. Merchant workflow and provider contract define balance, recovery and current-rights behavior. The generated conformance driver now dispatches through bounded files matching the existing seven policy domains.

Payment transaction observations

src/payments/{catalog,details,details_model,details_tests}.rs own the provider-neutral read contract and safe durable history projection. remote.rs omits customer/order payloads for inspection. Provider protocol and fee extraction remain in the private Rust payment service. frontend/src/admin/payments/PaymentDetails is shared by orders and payment management. Usage.