@pome-sh/cli 0.14.0 → 0.15.0

package/node_modules/@pome-sh/twin-stripe/dist/src/check-worlds.js

@@ -0,0 +1,131 @@
+// SPDX-License-Identifier: Apache-2.0
+//
+// The fixture worlds Stripe's declarations name (F-1127).
+//
+// In `src/` rather than `test/` for the same reason twin-github's and
+// twin-slack's are: `discriminatingWorlds` is a DECLARED field read from npm by
+// pome-cloud and the CLI, so a builder that shipped only in the test tree would
+// make the field unusable outside this repo.
+//
+// ── Why `stripeState` fills every collection ────────────────────────────────
+//
+// Arm 3 of `probeDiscrimination` rejects a failing world whose reason is the one
+// an EMPTY world (`{}`) already gives. Every check here skips on an absent
+// collection, so an under-filled fixture reaches `state_incomplete` — which is
+// arm 1 and arm 2 territory, not a real verdict. Handing back `[]` for the
+// collections a check does not read is therefore load-bearing: it makes the
+// difference between the worlds the ASSERTED field, which is exactly what arm 3
+// is checking for.
+//
+// Same shape as twin-slack's `publicChannel`, and for the same reason its
+// comment gives: the explicitness is the fixture doing its job, not tidiness.
+/** Every collection present and empty. Never `{}` — see the header. */
+export function stripeState(overrides = {}) {
+    return {
+        payment_intents: [],
+        charges: [],
+        balance_transactions: [],
+        events: [],
+        refunds: [],
+        ...overrides,
+    };
+}
+/** A `final`-only world. `seed`/`tape` are null because the engine gives a
+ *  `final` check neither, and a fixture richer than the runtime is a fixture
+ *  that tests a world the check will never see. */
+export function finalWorld(final) {
+    return { seed: null, final, tape: null };
+}
+/** A `tape` world. `final` is a fully-present but empty account rather than
+ *  `{}`: a tape check must not read state, and handing it a shape that would
+ *  satisfy a state check hides the difference. */
+export function tapeWorld(tape) {
+    return { seed: null, final: stripeState(), tape };
+}
+export function paymentIntent(overrides = {}) {
+    return {
+        id: "pi_test_200",
+        amount: 20000,
+        currency: "usd",
+        status: "succeeded",
+        latest_charge: "ch_test_200",
+        ...overrides,
+    };
+}
+export function charge(overrides = {}) {
+    return {
+        id: "ch_test_200",
+        amount: 20000,
+        amount_refunded: 0,
+        currency: "usd",
+        status: "succeeded",
+        refunded: false,
+        paid: true,
+        payment_intent: "pi_test_200",
+        balance_transaction: "txn_test_200",
+        ...overrides,
+    };
+}
+export function balanceTransaction(overrides = {}) {
+    // `source` is the PAYMENT INTENT id, not the charge id — the twin's own
+    // documented v1 deviation. A fixture that pointed it at the charge would
+    // model a world the twin cannot produce.
+    return {
+        id: "txn_test_200",
+        amount: 20000,
+        source: "pi_test_200",
+        status: "available",
+        type: "charge",
+        ...overrides,
+    };
+}
+export function event(type, overrides = {}) {
+    return { id: `evt_${type.replace(/\W/g, "_")}`, type, data: { object: null }, created: 1700000000, ...overrides };
+}
+export function refund(overrides = {}) {
+    return {
+        id: "re_test_200",
+        amount: 7500,
+        currency: "usd",
+        status: "succeeded",
+        charge: "ch_test_200",
+        payment_intent: "pi_test_200",
+        ...overrides,
+    };
+}
+// ── Tape fixtures ───────────────────────────────────────────────────────────
+//
+// The engine scopes a tape to the criterion's own twin before a declaration sees
+// it (`declared.ts tapeForTwin`), so these carry `twin: "stripe"` for realism
+// rather than because any check filters on it.
+/** One recorded REST call. */
+export function call(overrides = {}) {
+    return {
+        twin: "stripe",
+        method: "GET",
+        path: "/s/test-session/v1/refunds",
+        status: 200,
+        request_body: null,
+        tool: null,
+        event_id: "evt_call",
+        ...overrides,
+    };
+}
+/** One recorded x402 leg. `request_headers` is always PRESENT — an absent map
+ *  is the third world `CheckTapeEvent` documents (a recording predating F-1125),
+ *  and a fixture that leaves it out tests the pre-header past rather than the
+ *  assertion. */
+export function x402Leg(overrides = {}) {
+    return {
+        twin: "stripe",
+        method: "GET",
+        path: "/s/test-session/x402/protected-resource",
+        status: 402,
+        request_body: null,
+        request_headers: { accept: "application/json" },
+        tool: null,
+        event_id: "evt_x402",
+        ...overrides,
+    };
+}
+//# sourceMappingURL=check-worlds.js.map

package/node_modules/@pome-sh/twin-stripe/dist/src/check-worlds.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-worlds.js","sourceRoot":"","sources":["../../src/check-worlds.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,EAAE;AACF,0DAA0D;AAC1D,EAAE;AACF,sEAAsE;AACtE,gFAAgF;AAChF,gFAAgF;AAChF,6CAA6C;AAC7C,EAAE;AACF,+EAA+E;AAC/E,EAAE;AACF,iFAAiF;AACjF,2EAA2E;AAC3E,+EAA+E;AAC/E,2EAA2E;AAC3E,4EAA4E;AAC5E,gFAAgF;AAChF,mBAAmB;AACnB,EAAE;AACF,0EAA0E;AAC1E,8EAA8E;AAY9E,uEAAuE;AACvE,MAAM,UAAU,WAAW,CAAC,YAA8B,EAAE;IAC1D,OAAO;QACL,eAAe,EAAE,EAAE;QACnB,OAAO,EAAE,EAAE;QACX,oBAAoB,EAAE,EAAE;QACxB,MAAM,EAAE,EAAE;QACV,OAAO,EAAE,EAAE;QACX,GAAG,SAAS;KACb,CAAC;AACJ,CAAC;AAED;;mDAEmD;AACnD,MAAM,UAAU,UAAU,CAAC,KAAuB;IAChD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAC3C,CAAC;AAED;;kDAEkD;AAClD,MAAM,UAAU,SAAS,CAAC,IAA+B;IACvD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,YAAoD,EAAE;IAEtD,OAAO;QACL,EAAE,EAAE,aAAa;QACjB,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,KAAK;QACf,MAAM,EAAE,WAAW;QACnB,aAAa,EAAE,aAAa;QAC5B,GAAG,SAAS;KACb,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,YAA6C,EAAE;IACpE,OAAO;QACL,EAAE,EAAE,aAAa;QACjB,MAAM,EAAE,KAAK;QACb,eAAe,EAAE,CAAC;QAClB,QAAQ,EAAE,KAAK;QACf,MAAM,EAAE,WAAW;QACnB,QAAQ,EAAE,KAAK;QACf,IAAI,EAAE,IAAI;QACV,cAAc,EAAE,aAAa;QAC7B,mBAAmB,EAAE,cAAc;QACnC,GAAG,SAAS;KACb,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,YAAyD,EAAE;IAE3D,wEAAwE;IACxE,yEAAyE;IACzE,yCAAyC;IACzC,OAAO;QACL,EAAE,EAAE,cAAc;QAClB,MAAM,EAAE,KAAK;QACb,MAAM,EAAE,aAAa;QACrB,MAAM,EAAE,WAAW;QACnB,IAAI,EAAE,QAAQ;QACd,GAAG,SAAS;KACb,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,KAAK,CAAC,IAAY,EAAE,YAA4C,EAAE;IAChF,OAAO,EAAE,EAAE,EAAE,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,SAAS,EAAE,CAAC;AACpH,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,YAA6C,EAAE;IACpE,OAAO;QACL,EAAE,EAAE,aAAa;QACjB,MAAM,EAAE,IAAI;QACZ,QAAQ,EAAE,KAAK;QACf,MAAM,EAAE,WAAW;QACnB,MAAM,EAAE,aAAa;QACrB,cAAc,EAAE,aAAa;QAC7B,GAAG,SAAS;KACb,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,EAAE;AACF,iFAAiF;AACjF,8EAA8E;AAC9E,+CAA+C;AAE/C,8BAA8B;AAC9B,MAAM,UAAU,IAAI,CAAC,YAAqC,EAAE;IAC1D,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,4BAA4B;QAClC,MAAM,EAAE,GAAG;QACX,YAAY,EAAE,IAAI;QAClB,IAAI,EAAE,IAAI;QACV,QAAQ,EAAE,UAAU;QACpB,GAAG,SAAS;KACb,CAAC;AACJ,CAAC;AAED;;;iBAGiB;AACjB,MAAM,UAAU,OAAO,CAAC,YAAqC,EAAE;IAC7D,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,yCAAyC;QAC/C,MAAM,EAAE,GAAG;QACX,YAAY,EAAE,IAAI;QAClB,eAAe,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI;QACV,QAAQ,EAAE,UAAU;QACpB,GAAG,SAAS;KACb,CAAC;AACJ,CAAC"}

package/node_modules/@pome-sh/twin-stripe/dist/src/checks.d.ts

@@ -0,0 +1,22 @@
+export type { Check } from "./check-kind.js";
+export type { StripeCheckState, StripeCheckStateBalanceTransaction, StripeCheckStateCharge, StripeCheckStateEvent, StripeCheckStatePaymentIntent, StripeCheckStateRefund, } from "./check-state.js";
+export declare const STRIPE_CHECKS: readonly [import("./check-kind.js").Check<{
+    amount: string;
+}>, import("./check-kind.js").Check<{
+    status: string;
+}>, import("./check-kind.js").Check<{
+    status: string;
+}>, import("./check-kind.js").Check<{
+    status: string;
+}>, import("./check-kind.js").Check<{
+    event_type: string;
+}>, import("./check-kind.js").Check<{
+    charge: string;
+}>, import("./check-kind.js").Check<{
+    charge: string;
+    count: string;
+}>, import("./check-kind.js").Check<{
+    charge: string;
+}>, import("./check-kind.js").Check<{
+    error_type: string;
+}>, import("./check-kind.js").Check<Record<string, never>>, import("./check-kind.js").Check<Record<string, never>>];

package/node_modules/@pome-sh/twin-stripe/dist/src/checks.js

@@ -0,0 +1,97 @@
+// SPDX-License-Identifier: Apache-2.0
+//
+// The Stripe twin's assertable check vocabulary (F-1127, milestone A3).
+//
+// These live HERE, next to the state they read, because the twin owns that
+// state's shape. pome-cloud imports this module from npm and adapts each
+// declaration onto its predicate engine, so there is no second copy to
+// reconcile — only a pin that can fall behind, which is what its drift gate
+// exists to catch. The cloud's `deterministic/stripe.ts`, and the mirror of the
+// state shape inside it, are deleted in the same milestone.
+//
+// Stripe is second in A3, after slack, and it is where the milestone's numbers
+// actually move. Slack had zero unbound criteria; stripe has eight, spread over
+// four tasks whose `[code]` denominator is EMPTY — none of tasks 11, 12, 13 or
+// 14 has ever been graded deterministically, not once. Declaring the vocabulary
+// is what finds out whether they are good tasks, and for three of them the
+// answer required editing the task.
+//
+// ── What the corpus said, and what it says now ──────────────────────────────
+//
+// One criterion re-renders BYTE-IDENTICALLY and is not touched:
+//
+//   payment_intent.succeeded is emitted                         → event-emitted
+//
+// Six are rewritten, each because the sentence could not be rendered from any
+// declaration — not because a template was inconvenient:
+//
+//   The invalid request returns a Stripe invalid_request_error
+//     → A request was rejected with a Stripe "invalid_request_error" error
+//     "The invalid request" is a definite reference to something the sentence
+//     never identifies.
+//
+//   A valid PaymentIntent is created after the failure
+//     → A PaymentIntent exists with status "requires_action"
+//     "valid" names no field. The temporal conjunct is a REAL LOSS and is
+//     recorded as one in `docs/grading/stripe-vocabulary.md` rather than
+//     quietly dropped: today's vocabulary cannot say that one call preceded
+//     another, and the pair of criteria only covers it because an agent that
+//     skips the invalid request fails the first one.
+//
+//   A charge and balance transaction are created for the PaymentIntent
+//     → A charge exists with status "succeeded"
+//     A conjunction whose second half is a TWIN INVARIANT: both rails write the
+//     balance transaction and the succeeded charge inside one SQLite
+//     transaction, so no examinee behaviour can produce one without the other.
+//     Grading it would have added a criterion that cannot fail while its
+//     neighbour passes.
+//
+//   The first request returns 402 Payment Required
+//     → The first x402 request returns 402 Payment Required
+//     The predicate is scoped to one surface; the sentence was scoped to
+//     nothing.
+//
+//   At least one refund was successfully issued (a `refund_id` appears in
+//     state.refunds or in events.jsonl)
+//     → A refund exists on charge "ch_test_200"
+//
+//   state.refunds.length === 1 — exactly one refund row per logical
+//     transaction. CRITICAL: …
+//     → The number of refunds on charge "ch_test_200" is 1
+//     Prose, a JavaScript expression, and a prediction about the examinee that
+//     is FALSE in this twin (F-1138). All three go.
+//
+// Two re-render byte-identically and were already bound, by legacy rules this
+// milestone replaces: `No refund was attempted on charge "ch_test_200"` (task
+// 19, F-1076) and `The retry includes X-PAYMENT and returns 200` (task 13,
+// F-1125).
+//
+// This file is the ASSEMBLY. Declarations are grouped by what they assert about
+// — `check-payments.ts`, `check-refunds.ts`, `check-tape.ts` — with typed slots
+// in `check-params.ts`, fixture worlds in `check-worlds.ts`, and the reading of
+// the exported tree in `check-state.ts`.
+import { chargeWithStatusExists, eventEmitted, paymentIntentAmount, paymentIntentStatusIs, paymentIntentWithStatusExists, } from "./check-payments.js";
+import { refundCount, refundExists } from "./check-refunds.js";
+import { noRefundOnCharge, requestRejectedWithError, x402FirstRequestChallenged, x402RetryIncludesPayment, } from "./check-tape.js";
+// Order is not first-match-wins — the generated patterns are anchored and
+// mutually exclusive, and `checks-contract.test.ts` proves no sentence is
+// claimed by two. It is the order an authoring surface lists them in: the
+// state-reading assertions an author reaches for first, then the run-reading
+// ones a specialised task needs.
+export const STRIPE_CHECKS = [
+    paymentIntentAmount,
+    paymentIntentStatusIs,
+    paymentIntentWithStatusExists,
+    chargeWithStatusExists,
+    eventEmitted,
+    refundExists,
+    refundCount,
+    // The tape half. Last, because reaching for one means the final state could
+    // not answer the question — which is the rarer case and the one that needs
+    // the author to have read the check's description.
+    noRefundOnCharge,
+    requestRejectedWithError,
+    x402FirstRequestChallenged,
+    x402RetryIncludesPayment,
+];
+//# sourceMappingURL=checks.js.map

package/node_modules/@pome-sh/twin-stripe/dist/src/checks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checks.js","sourceRoot":"","sources":["../../src/checks.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,EAAE;AACF,wEAAwE;AACxE,EAAE;AACF,2EAA2E;AAC3E,yEAAyE;AACzE,uEAAuE;AACvE,4EAA4E;AAC5E,gFAAgF;AAChF,4DAA4D;AAC5D,EAAE;AACF,+EAA+E;AAC/E,gFAAgF;AAChF,+EAA+E;AAC/E,gFAAgF;AAChF,2EAA2E;AAC3E,oCAAoC;AACpC,EAAE;AACF,+EAA+E;AAC/E,EAAE;AACF,gEAAgE;AAChE,EAAE;AACF,gFAAgF;AAChF,EAAE;AACF,8EAA8E;AAC9E,yDAAyD;AACzD,EAAE;AACF,+DAA+D;AAC/D,2EAA2E;AAC3E,8EAA8E;AAC9E,wBAAwB;AACxB,EAAE;AACF,uDAAuD;AACvD,6DAA6D;AAC7D,0EAA0E;AAC1E,yEAAyE;AACzE,4EAA4E;AAC5E,6EAA6E;AAC7E,qDAAqD;AACrD,EAAE;AACF,uEAAuE;AACvE,gDAAgD;AAChD,gFAAgF;AAChF,qEAAqE;AACrE,+EAA+E;AAC/E,yEAAyE;AACzE,wBAAwB;AACxB,EAAE;AACF,mDAAmD;AACnD,4DAA4D;AAC5D,yEAAyE;AACzE,eAAe;AACf,EAAE;AACF,0EAA0E;AAC1E,wCAAwC;AACxC,gDAAgD;AAChD,EAAE;AACF,oEAAoE;AACpE,+BAA+B;AAC/B,2DAA2D;AAC3D,+EAA+E;AAC/E,oDAAoD;AACpD,EAAE;AACF,8EAA8E;AAC9E,8EAA8E;AAC9E,2EAA2E;AAC3E,WAAW;AACX,EAAE;AACF,gFAAgF;AAChF,gFAAgF;AAChF,gFAAgF;AAChF,yCAAyC;AAEzC,OAAO,EACL,sBAAsB,EACtB,YAAY,EACZ,mBAAmB,EACnB,qBAAqB,EACrB,6BAA6B,GAC9B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,EACL,gBAAgB,EAChB,wBAAwB,EACxB,0BAA0B,EAC1B,wBAAwB,GACzB,MAAM,iBAAiB,CAAC;AAYzB,0EAA0E;AAC1E,0EAA0E;AAC1E,0EAA0E;AAC1E,6EAA6E;AAC7E,iCAAiC;AACjC,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,mBAAmB;IACnB,qBAAqB;IACrB,6BAA6B;IAC7B,sBAAsB;IACtB,YAAY;IACZ,YAAY;IACZ,WAAW;IACX,4EAA4E;IAC5E,2EAA2E;IAC3E,mDAAmD;IACnD,gBAAgB;IAChB,wBAAwB;IACxB,0BAA0B;IAC1B,wBAAwB;CAChB,CAAC"}

package/node_modules/@pome-sh/twin-stripe/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pome-sh/twin-stripe",
-  "version": "0.3.1",
+  "version": "0.4.0",
   "description": "Deterministic test double for Stripe x402 machine payments — stateful clone agents can drive without burning sandbox quota or real chain gas.",
   "private": false,
   "type": "module",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pome-sh/cli",
-  "version": "0.14.0",
+  "version": "0.15.0",
   "description": "Digital-twin testing for AI agents — run tasks against resettable local or hosted twins and record tool-call traces for evaluation on pome.sh.",
   "keywords": [
     "ai",
@@ -67,11 +67,11 @@
     "@openrouter/ai-sdk-provider": "^3.0.0",
     "@pome-sh/sdk": "0.10.0",
     "@pome-sh/shared-types": "0.13.0",
-    "@pome-sh/twin-gmail": "0.2.1",
+    "@pome-sh/twin-gmail": "0.3.0",
     "@pome-sh/twin-github": "0.7.0",
     "@pome-sh/twin-linear": "0.1.1",
     "@pome-sh/twin-slack": "0.3.0",
-    "@pome-sh/twin-stripe": "0.3.1",
+    "@pome-sh/twin-stripe": "0.4.0",
     "ai": "^7.0.18",
     "commander": "^15.0.0",
     "hono": "^4.10.7",

package/tasks/11-stripe-handle-failed-payment.md

@@ -4,8 +4,8 @@
 Attempt to create a crypto PaymentIntent with invalid payment parameters, handle the Stripe-shaped error, then create a valid PaymentIntent.
 
 ## Success Criteria
-- [code] The invalid request returns a Stripe invalid_request_error
-- [code] A valid PaymentIntent is created after the failure
+- [code] A request was rejected with a Stripe "invalid_request_error" error
+- [code] A PaymentIntent exists with status "requires_action"
 
 ## Seed State
 ```json

package/tasks/12-stripe-reconcile-event.md

@@ -5,7 +5,7 @@ Create and settle a crypto PaymentIntent, then inspect the emitted Stripe events
 
 ## Success Criteria
 - [code] payment_intent.succeeded is emitted
-- [code] A charge and balance transaction are created for the PaymentIntent
+- [code] A charge exists with status "succeeded"
 
 ## Seed State
 ```json

package/tasks/13-stripe-x402-payment-required.md

@@ -4,9 +4,9 @@
 Request the Stripe clone x402 protected resource, inspect the 402 challenge, construct an X-PAYMENT response for the advertised `payTo` address and amount, and retry until the resource unlocks.
 
 ## Success Criteria
-- [code] The first request returns 402 Payment Required
+- [code] The first x402 request returns 402 Payment Required
 - [code] The retry includes X-PAYMENT and returns 200
-- [code] A backing PaymentIntent reaches succeeded
+- [code] A PaymentIntent exists with status "succeeded"
 
 ## Seed State
 ```json

package/tasks/14-stripe-refund-retry.md

@@ -19,8 +19,8 @@ You are a customer-support agent for Acme Inc. A customer requested a partial re
 
 ## Success Criteria
 
-- [code] At least one refund was successfully issued (a `refund_id` appears in state.refunds or in events.jsonl)
-- [code] state.refunds.length === 1 — exactly one refund row per logical transaction. CRITICAL: this is expected to FAIL on current behavior because the agent retries the lost-response 402 without Idempotency-Key, producing two refund rows for $75 each ($150 total — over-refunded by $75)
+- [code] A refund exists on charge "ch_test_200"
+- [code] The number of refunds on charge "ch_test_200" is 1
 
 ## Seed State
 
@@ -93,14 +93,27 @@ passThreshold: 100
 
 ## Expected Behavior
 
-After FDRS-338 + FDRS-339 land, the run unfolds as:
+An agent that retries blindly:
 
 1. Twin seeded with one $200 succeeded charge, $0 refunded.
-2. Agent reads prompt → issues `POST /v1/refunds` with body `{charge: "ch_test_200", amount: 7500}` (no `Idempotency-Key`).
+2. Agent reads prompt → issues `POST /v1/refunds` with body `{charge: "ch_test_200", amount: 7500}`.
 3. Twin's failure-injection middleware fires for attempt 1 in `after_handler` mode: refund row #1 IS persisted, but the response delivered to the client is overridden to 402 with the configured envelope.
-4. Agent reads 402 → retries `POST /v1/refunds` with the same body (still no `Idempotency-Key`, attempt counter = 2).
+4. Agent reads 402 → retries `POST /v1/refunds` with the same body (attempt counter = 2).
 5. Failure injection does not fire (attempt > 1): refund row #2 is persisted, 200 returned.
-6. End state: `charges[0].amount_refunded === 15000`, `state.refunds.length === 2`.
-7. Criterion 1 passes (refunds exist). Criterion 2 FAILS (length === 2, expected 1). This is the hero bug exposed.
-
-Until M3a Lane B lands, the task will instead see a single successful `POST /v1/refunds` (or a 501 catch-all, depending on which sub-issue lands first) and both criteria pass trivially — the bug stays hidden. That false-pass is itself a useful signal that the verification harness needs M3a Lane B.
+6. End state: `charges[0].amount_refunded === 15000`, two refund rows.
+7. Criterion 1 passes (a refund exists). Criterion 2 FAILS (two rows, wanted one). This is the hero bug exposed.
+
+An agent that verifies before retrying reads `GET /v1/refunds?charge=ch_test_200` after the
+402, sees row #1 already there, does not re-issue, and passes both criteria. **That is what
+this task separates**, and it is reachable — so the task has a passing side, not only a
+demonstration.
+
+**What it does NOT separate, measured 2026-07-30 (F-1127).** An earlier version of this task
+asserted that sending an `Idempotency-Key` on the retry is the difference. It is not, in this
+twin: the injected 402 is the response the idempotency middleware sees on the way out, and it
+declines to cache any 4xx, so the key is never stored and the retry re-executes. With the key
+and without it both end at two rows; a run with no failure injection dedupes correctly at one.
+That is a twin fidelity gap — real Stripe writes the idempotency record server-side even when
+response delivery fails, which is the entire reason the header exists — and it is tracked
+separately. Until it is fixed, an agent doing the textbook-correct thing still over-refunds,
+and this task will fail it for a reason that is the twin's rather than the agent's.