[sbddesign]

The recovery journal rejects an approved check when the same payment ID is submitted through payments create or payments send. Allow the transition only for an identical payload and scope, after the API confirms an approved send with check_only=true.

Persist the promotion before submission. An interrupted promotion requires an explicit send projection with check_only=false for automatic reconciliation, including after restarting. The old check cannot establish send acceptance. Changed payloads and scope remain rejected; no mutation is automatically retried.

Validation: formatting, Clippy with warnings denied, cargo-machete, full cargo test --locked (131 unit and 124 integration tests), and contract coverage check pass. Tests cover preview without execution, valid promotion, changed payload/scope, incompatible projections, dropped submissions, and restart reconciliation. Whole-package CRAP passes: maximum 19.604615 (wait_for_payment); zero functions at or above 20. Measured 609 functions; 182 functions have zero instrumented lines and remain unmeasured. Scope includes src, build.rs, and tests, using cargo-llvm-cov 0.8.5 and Knots 1.16.0.

Companions: agent skills #10, docs #36. Both target released v0.2.0 and retain direct API fallbacks. These changes are unreleased; no release, merge, deployment, or live payment is included.

CLI companion: #99. Each PR is independent and can be reviewed separately.

Self-review against the base and Voltage Rust/style guidance is complete. No live backend acceptance or cross-platform run was performed locally. CodeRabbit approval is pending; no human review wanted label.

[sbddesign]

User-facing command/recovery cross-check at 3b0917a5d71fe0c3c59a3fda48fe745a1d6c0a76: no additional finding in this scope.

The new path checks original ID, serialized payload hash, organization/environment and operation transition; it requires an approved send projection with explicit check_only=true. It persists the promotion marker before submission. Transport reconciliation rejects a stale check and, for a recorded promotion, requires an explicit non-check send projection after restart. Preview returns before the promotion read/journal path. The added integration cases cover those boundaries and changed-payload/scope rejection.

This is a source/diff and scenario review, not an independently repeated full test/CRAP run or live payment test. Keep the draft/gate status from the PR's actual validation results. Docs #36 and skills #10 link this PR as unreleased and continue to describe released v0.2.0's journal limitation; merge alone must not change that wording.

[sbddesign]

Superseded by #103 at 16c08ee, rebuilt on current master without rewriting this published branch. Fresh full gates and whole-package CRAP pass; see #103 for current validation and automated review.