@xhulz/nina 0.28.16

package/releases/0.1.0/surfaces/edge-cf/tree/.claude/agents/architect.md

@@ -0,0 +1,14 @@
+<!-- nina:slot edge-cf.1 -->
+| `cloudflare:workers-best-practices` | `{{API_DIR}}/**` — routes, services, middleware, queue handlers |
+
+<!-- nina:slot edge-cf.2 -->
+| `cloudflare:durable-objects` | `{{API_DIR}}/src/do/**` or any DO call site |
+
+<!-- nina:slot edge-cf.3 -->
+| `cloudflare:cloudflare` | Queues, R2 or KV |
+
+<!-- nina:slot edge-cf.4 -->
+| `cloudflare:wrangler` | `wrangler.toml` or any wrangler command |
+
+<!-- nina:slot edge-cf.5 -->
+14. **Cloudflare skill flag** — if the spec touches `{{API_DIR}}/**` (Hono routes/services/queue handlers), the per-account Durable Object, Queues, R2/KV, or `wrangler` config, name which `cloudflare:*` plugin skill the implementer must consult (`cloudflare:workers-best-practices`, `cloudflare:durable-objects`, `cloudflare:cloudflare`, `cloudflare:wrangler`), or state why none applies. Retrieval beats recall — the reviewer rejects a spec that touches these surfaces without naming the skill.

package/releases/0.1.0/surfaces/edge-cf/tree/.claude/agents/dba.md

@@ -0,0 +1,2 @@
+<!-- nina:slot edge-cf.1 -->
+13. **Edge runtime compatibility.** New code paths use `@prisma/client/edge`. `compatibility_flags = ["nodejs_compat"]` is set in `wrangler.toml`.

package/releases/0.1.0/surfaces/edge-cf/tree/.claude/agents/devops.md

@@ -0,0 +1,31 @@
+<!-- nina:slot edge-cf.1 -->
+- **`cloudflare:wrangler`** — before running ANY `wrangler` command or reading `wrangler.toml`.
+  CLI flags and config fields churn between minor versions; pre-trained knowledge is stale.
+
+<!-- nina:slot edge-cf.2 -->
+- **`cloudflare:cloudflare`** — when the deploy touches R2, KV, Queues or Durable Object bindings.
+
+<!-- nina:slot edge-cf.3 -->
+2. **Both targets, or neither.** A change to the API surface needs the **staging Worker** (`wrangler deploy --env staging`) *and* **Pages** (`pnpm --filter {{PKG_SCOPE}}/app deploy`). Deploying the frontend alone against an old API is the failure that renders new fields as "—". State explicitly which targets this change requires and why.
+
+<!-- nina:slot edge-cf.4 -->
+5. **Secret and variable parity.** Everything the new code reads via `env.*` exists in the target environment (`wrangler secret list`). A missing secret fails at request time, not at deploy time.
+
+<!-- nina:slot edge-cf.5 -->
+
+## Pages: which branch, and why it matters
+
+`{{PAGES_PROJECT}}` is a **direct-upload** Pages project whose production branch is `main`. `wrangler pages
+deploy` decides production vs preview purely from `--branch`:
+
+- **Staging FE** → `--branch staging`. A preview deployment on its own URL. Production is untouched,
+  and this is the FE half of the staging pair with `{{API_STAGING}}`.
+- **Production FE** → `--branch main`. Only with an explicit go from {{OWNER}}, per the rule above.
+
+Deploying staging with `--branch=main` is a production deploy wearing a staging label — the
+permission classifier is right to stop it, and it blocked a two-target deploy for exactly this reason
+on 2026-09-21. Use the staging branch and the block disappears, because the block was correct.
+
+**`VITE_*` must be in the environment of the build command.** `[vars]` and `[env.*.vars]` in
+`{{APP_DIR}}/wrangler.toml` do NOT reach a Vite build — Vite inlines at build time, Pages vars apply at
+runtime to a project that has no server. A missing one ships a blank page with no error.

package/releases/0.1.0/surfaces/edge-cf/tree/.claude/agents/implementer.md

@@ -0,0 +1,14 @@
+<!-- nina:slot edge-cf.1 -->
+| `cloudflare:workers-best-practices` | anything under `{{API_DIR}}/**` |
+
+<!-- nina:slot edge-cf.2 -->
+| `cloudflare:durable-objects` | anything under `{{API_DIR}}/src/do/**` or a DO call site |
+
+<!-- nina:slot edge-cf.3 -->
+| `cloudflare:cloudflare` | a queue consumer, or R2 / KV access |
+
+<!-- nina:slot edge-cf.4 -->
+| `cloudflare:wrangler` | a change to `wrangler.toml` |
+
+<!-- nina:slot edge-cf.5 -->
+- Respect Workers conventions: secrets in `{{SECRETS_LOCAL}}` for local dev (never commit), `compatibility_flags = ["nodejs_compat"]` in `wrangler.toml`.

package/releases/0.1.0/surfaces/edge-cf/tree/.claude/agents/integration-tester.md

@@ -0,0 +1,11 @@
+<!-- nina:slot edge-cf.1 -->
+| `cloudflare:durable-objects` | DO lifecycle, alarms, RPC, storage — the API surface drifts fast |
+
+<!-- nina:slot edge-cf.2 -->
+| `cloudflare:cloudflare` | Queues, R2 or KV bindings |
+
+<!-- nina:slot edge-cf.3 -->
+| `cloudflare:wrangler` | anything you run through the wrangler CLI |
+
+<!-- nina:slot edge-cf.4 -->
+- Any new Cloudflare binding read/write: R2, KV, Queues, Durable Objects — drive the binding via Miniflare and observe real I/O

package/releases/0.1.0/surfaces/edge-cf/tree/.claude/agents/reviewer.md

@@ -0,0 +1,8 @@
+<!-- nina:slot edge-cf.1 -->
+| `cloudflare:workers-best-practices` | `{{API_DIR}}/**` |
+
+<!-- nina:slot edge-cf.2 -->
+| `cloudflare:durable-objects` | `{{API_DIR}}/src/do/**` or a DO call site |
+
+<!-- nina:slot edge-cf.3 -->
+- `{{API_DIR}}/src/do/` (`{{SERIALIZER}}`), a queue consumer, or a webhook receiver touched (serialization + idempotency surface)

package/releases/0.1.0/surfaces/edge-cf/tree/.claude/agents/secops.md

@@ -0,0 +1,8 @@
+<!-- nina:slot edge-cf.1 -->
+3. **Secrets & config exposure** — no secrets in committed files, logs, error messages, or generated artifacts (`worker-configuration.d.ts` must contain only types, never values). `{{SECRETS_LOCAL}}`/`.env` gitignored. `wrangler secret`/`[vars]` split correct. No secret echoed in a response or thrown error.
+
+<!-- nina:slot edge-cf.2 -->
+8. **Dependency & binding posture** — obviously risky dependency usage; Cloudflare binding scoping (R2 bucket names, Queue, DO) — nothing over-privileged or world-exposed; `nodejs_compat` and compatibility flags sane.
+
+<!-- nina:slot edge-cf.3 -->
+- Prefer retrieval over recall for Cloudflare/{{AUTH_LIB}} specifics: consult the `cloudflare:*` skills and the installed `node_modules` source / `.claude/integrations/*.md` rather than assuming.

package/releases/0.1.0/surfaces/edge-cf/tree/.claude/patterns.md

@@ -0,0 +1,11 @@
+<!-- nina:slot edge-cf.1 -->
+
+---
+
+## Secrets
+
+- **Wrangler secrets** for Workers (`{{SECRETS_PROD}} X`). Never `.env` committed.
+- **Local dev:** `{{SECRETS_LOCAL}}` (gitignored).
+
+<!-- nina:slot edge-cf.2 -->
+- `compatibility_flags = ["nodejs_compat"]` in `wrangler.toml` is required for `@prisma/client/edge`.

package/releases/0.1.0/surfaces/edge-cf/tree/.claude/retrieval.md

@@ -0,0 +1,8 @@
+<!-- nina:slot edge-cf.1 -->
+| New Durable Object behavior (`{{SERIALIZER}}`) | `.claude/architecture.md` § *Durable Objects*, existing `{{API_DIR}}/src/do/` | architect → implementer → **integration-tester** → reviewer → qa |
+
+<!-- nina:slot edge-cf.2 -->
+| New Queue handler | `.claude/architecture.md` § *Processing pipeline*, `{{API_DIR}}/src/queues/` | architect → implementer → **integration-tester** → reviewer → qa |
+
+<!-- nina:slot edge-cf.3 -->
+| Wrangler / deploy / config | `CLAUDE.md` § *Common commands*, `{{API_DIR}}/wrangler.toml`, `.claude/patterns.md` § *Secrets* | reviewer (sanity check) |

package/releases/0.1.0/surfaces/edge-cf/tree/.claude/router.md

@@ -0,0 +1,18 @@
+<!-- nina:slot edge-cf.1 -->
+| `{{API_DIR}}/**` Hono routes / services / middleware / queue handlers | `cloudflare:workers-best-practices` |
+
+<!-- nina:slot edge-cf.2 -->
+| `{{API_DIR}}/src/do/**` or any DO call site | `cloudflare:durable-objects` |
+
+<!-- nina:slot edge-cf.3 -->
+| `{{API_DIR}}/src/queues/**`, R2/KV | `cloudflare:cloudflare` |
+
+<!-- nina:slot edge-cf.4 -->
+| `wrangler.toml` / `wrangler.jsonc` / any wrangler CLI | `cloudflare:wrangler` |
+
+<!-- nina:slot edge-cf.5 -->
+| **devops** running any wrangler command or deploy | **`cloudflare:wrangler`** (+ `cloudflare:cloudflare` for R2/KV/Queues/DO bindings) |
+
+<!-- nina:slot edge-cf.6 -->
+
+Irrelevant to {{PROJECT}} (do NOT invoke): `cloudflare:agents-sdk`, `cloudflare:sandbox-sdk`, `cloudflare:cloudflare-email-service`.

package/releases/0.1.0/surfaces/edge-cf/tree/CLAUDE.md

@@ -0,0 +1,27 @@
+<!-- nina:slot edge-cf.1 -->
+
+### Cloudflare plugin skills — USE THEM
+
+The `cloudflare@cloudflare` plugin is installed at user scope and exposes skills that retrieve the **current** Cloudflare docs at invocation time. Pre-trained knowledge of Workers / Wrangler / DO / Queues / Cron APIs is stale — prefer the skill over recalling from memory.
+
+<!-- nina:slot edge-cf.2 -->
+| Write or review code under `{{API_DIR}}/**` (Hono routes, services, middleware, webhook receivers, queue consumers) | `cloudflare:workers-best-practices` | catches floating promises, global-state misuse, missing `waitUntil`, streaming pitfalls |
+
+<!-- nina:slot edge-cf.3 -->
+| Touch `{{API_DIR}}/src/do/**` or any Durable Object call site | `cloudflare:durable-objects` | covers RPC, alarms, WebSocket, SQLite storage, lifecycle — DO API surface drifts fast |
+
+<!-- nina:slot edge-cf.4 -->
+| Touch `{{API_DIR}}/src/queues/**`, R2/KV usage | `cloudflare:cloudflare` | Queues, R2, KV decision tree |
+
+<!-- nina:slot edge-cf.5 -->
+| Author or modify `wrangler.toml` / `wrangler.jsonc` / run any `wrangler` CLI command | `cloudflare:wrangler` | CLI flags + config fields churn between minor versions |
+
+<!-- nina:slot edge-cf.6 -->
+| Run the **devops** deploy stage | `cloudflare:wrangler` (+ `cloudflare:cloudflare` for R2/KV/Queues/DO bindings) | deploy flags and binding config churn between versions |
+
+<!-- nina:slot edge-cf.7 -->
+
+Skills NOT relevant to {{PROJECT}} (skip them): `cloudflare:agents-sdk` (no agent runtime), `cloudflare:sandbox-sdk` (no untrusted code execution), `cloudflare:cloudflare-email-service` ({{AUTH_LIB}} handles magic-link email).
+
+<!-- nina:slot edge-cf.8 -->
+10. **Secrets in `{{SECRETS_LOCAL}}` for local dev, `{{SECRETS_PROD}}` for production.** Never `.env` committed. `compatibility_flags = ["nodejs_compat"]` is required in `wrangler.toml` for Prisma client edge.

package/releases/0.1.0/surfaces/external-api/tree/.claude/agents/architect.md

@@ -0,0 +1,17 @@
+<!-- nina:slot external-api.1 -->
+12. **External library premises (MANDATORY for integration surfaces)** — if the spec touches {{AUTH_LIB}}, a Cloudflare binding (R2/KV/Queues/Durable Objects), Prisma Accelerate cache behavior, or any third-party HTTP, you MUST include a section listing every behavior of the external library the implementation depends on. Each premise is a one-sentence claim followed by a **citation** in one of two forms:
+    - `node_modules/.pnpm/<lib>@<version>/.../<file>:<line>` pointing into the actual installed source, OR
+    - a reference to a `P<n>` premise in `.claude/integrations/<lib>.md` (which itself carries a `node_modules` citation).
+
+    A premise without a citation is an **assumption**, not a fact. The integration-tester will reject the spec if any cited line does not validate at runtime, and will reject the spec entirely if it lists uncited premises. When in doubt: read the source. Integration regressions ship to prod precisely when an external-library premise is assumed instead of cited — never assume a library's behavior you have not opened.
+
+    Also mark **"INTEGRATION-TESTER REQUIRED"** prominently at the top of the spec when this section is present.
+
+<!-- nina:slot external-api.2 -->
+13. **{{PROVIDER}} surface flag** — if the spec touches `{{PROVIDER_PKG}}/**` or introduces a new {{PROVIDER}} client call, mark **"INTEGRATION-TESTER REQUIRED"** at the top. **{{PROVIDER}} is a real, live provider and its API is the contract — theirs, not ours.** Cite each premise as a `P-AS<n>` in `.claude/integrations/{{PROVIDER_DOC}}`, a contract-test case in `{{PROVIDER_PKG}}/test/contract/`, or an observed sandbox response. Inference and vendor docs are not evidence. Both `{{PROVIDER_MOCK}}` and `{{PROVIDER_HTTP}}` must satisfy every case you reference. Confirm all access goes through the `{{PROVIDER_PKG_NAME}}` typed interface, that nothing else speaks HTTP to {{PROVIDER}}, and that reais⇄centavos conversion stays inside the package.
+
+<!-- nina:slot external-api.3 -->
+- **For every external-library behavior the implementation will depend on, OPEN the installed source under `node_modules/.pnpm/<lib>@<version>/...` and cite the file:line that proves the behavior.** This is the single most important rule for avoiding integration regressions. Library docs and editor-autocomplete guesses are not citations — only `node_modules` source counts. For {{PROVIDER}} surfaces, the equivalent citation is a `P-AS<n>` premise, a contract-test case, or an observed sandbox response.
+
+<!-- nina:slot external-api.4 -->
+- **State external-library behavior as fact without a `node_modules:<line>` citation** (or a contract-test case for {{PROVIDER}} surfaces). Uncited premises are assumptions, and assumptions are what ship money-routing bugs to prod. If you cannot find the citation, the answer is to read more source or escalate — not to write the spec anyway.

package/releases/0.1.0/surfaces/external-api/tree/.claude/agents/implementer.md

@@ -0,0 +1,16 @@
+<!-- nina:slot external-api.1 -->
+- If you change anything that touches an external-library integration surface ({{AUTH_LIB}}, Prisma Accelerate cache, R2/KV/Queues/Durable Objects bindings, third-party HTTP), flag it explicitly in the diff summary so the reviewer dispatches **integration-tester** before approving.
+
+<!-- nina:slot external-api.2 -->
+- If you change anything in `{{PROVIDER_PKG}}/`, flag it explicitly in the diff summary so the reviewer dispatches **integration-tester** to run the contract-test suite against BOTH implementations before approving.
+
+<!-- nina:slot external-api.3 -->
+
+## {{PROVIDER}}
+- All {{PROVIDER}} access goes through `{{PROVIDER_PKG}}` (the typed `{{PROVIDER_CLIENT}}` + `{{PROVIDER_HTTP}}` + `{{PROVIDER_MOCK}}`). **Never** make raw HTTP calls to {{PROVIDER}} from a service, route, DO, or queue.
+- {{PROVIDER}} is a **real, live provider**; its API is the contract. The contract-test suite at `{{PROVIDER_PKG}}/test/contract/` is the source of truth and **both** implementations must pass it.
+- Money crosses the boundary as `BigInt` centavos. Reais⇄centavos conversion lives only in `src/money.ts` / `src/wire-money.ts` — never `Number`, never in a service.
+- Inject the mock in tests.
+
+<!-- nina:slot external-api.4 -->
+- Make raw HTTP calls to {{PROVIDER}} from anywhere outside `{{PROVIDER_PKG}}`. Inject `{{PROVIDER_MOCK}}` in tests.

package/releases/0.1.0/surfaces/external-api/tree/.claude/agents/integration-tester.md

@@ -0,0 +1,30 @@
+<!-- nina:slot external-api.1 -->
+| `resend:resend` | the email transport path |
+
+<!-- nina:slot external-api.2 -->
+2. **{{PROVIDER}} — a real, live payment provider** (sandbox + production). *Their* API is the contract; we conform to it. There IS a real service to hit, and money moves through it. So for {{PROVIDER}} you run the **contract-test suite** at `{{PROVIDER_PKG}}/test/contract/` against **BOTH** `{{PROVIDER_MOCK}}` **and** `{{PROVIDER_HTTP}}`, and you check each `P-AS<n>` premise in `.claude/integrations/{{PROVIDER_DOC}}`.
+
+<!-- nina:slot external-api.3 -->
+- `{{API_DIR}}/src/auth/**` (any {{AUTH_LIB}} config or wrapper) — runtime against the real plugin
+
+<!-- nina:slot external-api.4 -->
+- Any code calling `auth.api.*` (any {{AUTH_LIB}} plugin endpoint) — exercise the real call
+
+<!-- nina:slot external-api.5 -->
+- `{{PROVIDER_PKG}}/**` or any new {{PROVIDER}} client call — run the contract-test suite against `{{PROVIDER_MOCK}}`
+
+<!-- nina:slot external-api.6 -->
+- For **{{PROVIDER}}**: `.claude/integrations/{{PROVIDER_DOC}}` — the published contract and premises P-AF1..P-AF5. This is the source of truth the mock must conform to.
+
+<!-- nina:slot external-api.7 -->
+
+## You MUST — {{PROVIDER}}
+
+- **Run the contract-test suite** at `{{PROVIDER_PKG}}/test/contract/` against **both** implementations (`*.contract.test.ts` for the mock, `*.http-contract.test.ts` for the HTTP client). Every `P-AS<n>` in `.claude/integrations/{{PROVIDER_DOC}}` maps to a case — verify every one that the diff touches.
+- **Never accept a green mock as proof.** If only the mock run is green, you have verified nothing about production. Say so and reject.
+- **Confirm nothing calls {{PROVIDER}} outside `{{PROVIDER_PKG}}`.** Grep the diff and the tree for raw HTTP or client construction outside the package boundary. Any leak is a hard reject — all access goes through the typed `{{PROVIDER_CLIENT}}`.
+- **Confirm `fetch` is bound to `globalThis` inside the client.** As an unbound instance method it throws *illegal invocation* under workerd and takes the whole {{PROVIDER}} path down in the deployed Worker — unit tests do not catch it. Guard: `{{API_DIR}}/test/integration/{{PROVIDER_SLUG}}-http-client-fetch-binding.integration.test.ts`.
+
+<!-- nina:slot external-api.8 -->
+- **Confirm DTOs validate with Zod at the package boundary** (in both implementations), so live-API drift surfaces structurally.
+- **Update `.claude/integrations/{{PROVIDER_DOC}}` when you observe new behavior**, with the evidence that settled it (contract case, sandbox response, or source citation).

package/releases/0.1.0/surfaces/external-api/tree/.claude/agents/planner.md

@@ -0,0 +1,2 @@
+<!-- nina:slot external-api.1 -->
+5. **Integration flag** — if any subtask touches an external-library surface ({{AUTH_LIB}}, Prisma Accelerate cache, R2/KV/Queues/Durable Objects bindings, third-party HTTP) OR the {{PROVIDER}} surface (`{{PROVIDER_PKG}}/**` or a new {{PROVIDER}} client call), mark **"INTEGRATION-TESTER REQUIRED"** on that subtask.

package/releases/0.1.0/surfaces/external-api/tree/.claude/agents/reviewer.md

@@ -0,0 +1,17 @@
+<!-- nina:slot external-api.1 -->
+- **If an external-library integration surface was touched anywhere in the diff (`{{API_DIR}}/src/auth/**`, an `auth.api.*` callsite, Prisma Accelerate cache, R2/KV/Queues/Durable Objects binding, third-party HTTP) OR `{{PROVIDER_PKG}}/**` was touched: confirm `integration-tester` ran and approved.** If not → dispatch `integration-tester` now, or request changes. No approval without integration-tester sign-off on these surfaces. Additionally verify the architect's spec contains an **External library premises** section: for real libraries, each premise must carry a `node_modules/.pnpm/<lib>@<version>/.../<file>:<line>` citation; for {{PROVIDER}} (a live third-party API, not a library on disk), each premise references a `P-AS<n>` in `.claude/integrations/{{PROVIDER_DOC}}`, a contract-test case, or an observed sandbox response. If the section is missing or uncited, REJECT upstream — the spec is incomplete; do not approve the diff against an incomplete spec.
+
+<!-- nina:slot external-api.2 -->
+- The diff touches auth paths ({{AUTH_LIB}} config, `{{API_DIR}}/src/auth/**`, middleware) — **integration-tester also required**
+
+<!-- nina:slot external-api.3 -->
+- The diff touches an external-library integration surface (Prisma Accelerate cache, R2/KV/Queues/DO bindings, third-party HTTP) OR `{{PROVIDER_PKG}}/**` — **integration-tester also required**
+
+<!-- nina:slot external-api.4 -->
+- Skip the integration-tester check on external service changes "because the unit tests pass." Unit tests honor the spec's mock, not the real library or the published contract — only the integration-tester catches drift.
+
+<!-- nina:slot external-api.5 -->
+- External-library / {{PROVIDER}} surface touched but integration-tester missed → dispatch **integration-tester** now.
+
+<!-- nina:slot external-api.6 -->
+- Spec touches an external-service surface but lacks the **External library premises** section with citations (or contract-case references for {{PROVIDER}}) → back to **architect** for spec amendment (do NOT approve the implementer's diff against an incomplete spec).

package/releases/0.1.0/surfaces/external-api/tree/.claude/agents/secops.md

@@ -0,0 +1,2 @@
+<!-- nina:slot external-api.1 -->
+6. **Input validation / injection / SSRF** — Zod at every trust boundary (request body, query, queue message body, webhook payload, {{PROVIDER}} responses). Prisma parameterization (no raw string interpolation). Outbound HTTP to {{PROVIDER}} — SSRF / URL-allowlist posture. DO SQLite — parameterized, never string-built SQL. The two webhook routes and the staging-only `/dev/*` surface are the internet-facing unauthenticated-by-session paths: verify their HMAC / secret gates cannot be bypassed or replayed.

package/releases/0.1.0/surfaces/external-api/tree/.claude/agents-overview.md

@@ -0,0 +1,8 @@
+<!-- nina:slot external-api.1 -->
+- **Integration-tester guardrail** → the spec describes external behavior the implementer relies on. Unit tests with structural mocks honor the spec, NOT the dependency. For real services ({{AUTH_LIB}}, Cloudflare bindings, the {{PROVIDER}} sandbox) the integration-tester runs real flows; for **{{PROVIDER}}** it runs the **contract-test suite** against BOTH the mock and the HTTP client so they cannot diverge. Either way, drift between assumption and reality is caught before deploy.
+
+<!-- nina:slot external-api.2 -->
+| **integration-tester** | Mandatory gate on external-service (incl. {{PROVIDER}}) surfaces; real flows against real services ({{AUTH_LIB}}, Cloudflare bindings, {{PROVIDER}} sandbox) plus the {{PROVIDER}} contract-test suite; verifies each cited premise; updates `.claude/integrations/<lib>.md` | `.claude/agents/integration-tester.md` |
+
+<!-- nina:slot external-api.3 -->
+- **`.claude/integrations/`** — per-library verified premises + the {{PROVIDER}} contract notes

package/releases/0.1.0/surfaces/external-api/tree/.claude/patterns.md

@@ -0,0 +1,23 @@
+<!-- nina:slot external-api.1 -->
+- **Queue** (`{{API_DIR}}/src/queues/<q>.ts`) / **Webhook** (`{{API_DIR}}/src/routes/{{PROVIDER_SLUG}}-*.ts`): same discipline — validate input, build deps, call one service function. There are no cron handlers; the system is webhook-driven.
+
+<!-- nina:slot external-api.2 -->
+8. **All {{PROVIDER}} calls live in `{{PROVIDER_PKG}}`.** Services import the typed interface (`abrirContaEscrow`, `consultarStatusKyc`, `consultarStatusOnboarding`, `enviarTransferencia`, `consultarStatusTransferencia`, `registrarWebhook`, `removerWebhook`). Services do not instantiate an HTTP client directly.
+
+<!-- nina:slot external-api.3 -->
+
+---
+
+## {{PROVIDER}} client conventions (enforced by integration-tester + reviewer)
+
+All {{PROVIDER}} access lives in `{{PROVIDER_PKG}}`. **{{PROVIDER}} is a real, live provider and its API is the contract** — we conform to it, we do not define it.
+
+- **One interface, two implementations.** `{{PROVIDER_CLIENT}}` is our adapter spec. `{{PROVIDER_MOCK}}` is deterministic and in-memory; `{{PROVIDER_HTTP}}` calls the real API. Services depend on the interface only.
+- **Contract-test suite is the source of truth.** `{{PROVIDER_PKG}}/test/contract/` exercises every method. **BOTH** implementations must pass it — a mock that is green while the HTTP client is not is a lie, and a hard reject.
+- **No raw HTTP to {{PROVIDER}} outside `{{PROVIDER_PKG}}`.** A service, route, DO or queue calling {{PROVIDER}} directly is a hard reject.
+- **`fetch` must be bound to `globalThis`** inside the client. As an unbound instance method it throws *illegal invocation* in workerd and takes down the whole {{PROVIDER}} path in the deployed Worker (regression guard: `{{API_DIR}}/test/integration/{{PROVIDER_SLUG}}-http-client-fetch-binding.integration.test.ts`).
+- **Money crosses the boundary as `BigInt` centavos.** Reais⇄centavos conversion lives ONLY in `src/money.ts` / `src/wire-money.ts` — never in a service, never via `Number`.
+- **Validate {{PROVIDER}} responses with Zod** at the package boundary — even in the mock — so live-API drift is caught structurally.
+
+<!-- nina:slot external-api.4 -->
+- **{{PROVIDER}}:** the contract-test suite in `{{PROVIDER_PKG}}/test/contract/` runs against BOTH `{{PROVIDER_MOCK}}` and `{{PROVIDER_HTTP}}`. Worker integration tests inject the mock; the live gate exercises the sandbox.

package/releases/0.1.0/surfaces/external-api/tree/.claude/pipeline.md

@@ -0,0 +1,19 @@
+<!-- nina:slot external-api.1 -->
+
+### 4b. Integration-tester (mandatory for external-service surfaces)
+
+- **Trigger:** any diff touching {{AUTH_LIB}} (`{{API_DIR}}/src/auth/**`, `auth.api.*`), Prisma Accelerate cache behavior, R2/KV/Queues/Durable Objects bindings, any third-party HTTP, OR `{{PROVIDER_PKG}}/**` / a new {{PROVIDER}} client call.
+- **Input:** architect spec (with **External library premises** section) + implementer diff + repo state.
+- **Output:** approve or reject. Approve includes a verified-premise table (premise → verdict → citation). Reject identifies which premise/contract case failed and whether the fix is upstream (respec) or in code.
+- **Tools:** Read, Write, Edit, Glob, Grep, Bash. Edits scoped to integration/contract test dirs and `.claude/integrations/**`.
+- **Checks:**
+  - **Real services** ({{AUTH_LIB}}, Cloudflare bindings): run REAL flows (Miniflare + dev DB branch). Read `.claude/integrations/<lib>.md` and probe each premise.
+  - **{{PROVIDER}}:** run the **contract-test suite** (`{{PROVIDER_PKG}}/test/contract/`) against **both** `{{PROVIDER_MOCK}}` and `{{PROVIDER_HTTP}}`. A mock that is green while the HTTP client is not is a lie. Confirm nothing calls {{PROVIDER}} outside `{{PROVIDER_PKG}}`.
+  - Update `.claude/integrations/<lib>.md` (or `{{PROVIDER_DOC}}`) when new behavior is observed.
+- **Position:** after implementer, in parallel with dba when both apply. Reviewer verifies both gates ran.
+
+<!-- nina:slot external-api.2 -->
+  - **If external-service surface touched → integration-tester approved.**
+
+<!-- nina:slot external-api.3 -->
+- **Integration-tester falsifies a premise / contract case** → loop back to architect (premise wrong → respec) OR implementer (premise right but code doesn't honor it). Update `.claude/integrations/<lib>.md` with the corrected premise.

package/releases/0.1.0/surfaces/external-api/tree/.claude/retrieval.md

@@ -0,0 +1,22 @@
+<!-- nina:slot external-api.1 -->
+
+## Integration docs (load whenever an external service is touched)
+
+Each file in `.claude/integrations/` captures verified runtime premises about a dependency. The architect MUST cite premises from these docs (or new ones it verifies with `node_modules/.pnpm/<lib>/...:<line>` references) in any spec that touches the integration surface. The integration-tester probes each cited premise (for {{PROVIDER}}, against the contract suite and the live sandbox) before the reviewer can approve.
+
+Current integration docs:
+
+<!-- nina:slot external-api.2 -->
+
+New docs are generated by the integration-tester probing the **real installed source** under `node_modules/.pnpm/<lib>@<version>/...`, so premises are version-accurate from day one.
+
+When you discover a new behavior for any dependency, append it as a premise to the relevant `.claude/integrations/<lib>.md`, **creating the file if absent** with a fresh `node_modules:<line>` citation against the version actually installed in this repo.
+
+<!-- nina:slot external-api.3 -->
+| New webhook receiver | `.claude/architecture.md` § *Processing pipeline*, `{{API_DIR}}/src/routes/{{PROVIDER_SLUG}}-webhooks.ts`, `{{API_DIR}}/src/middleware/require-{{PROVIDER_SLUG}}-webhook-auth.ts` | architect → implementer → **integration-tester** → reviewer → qa |
+
+<!-- nina:slot external-api.4 -->
+| {{PROVIDER}} client method or call | `.claude/patterns.md` § *{{PROVIDER}} client conventions*, `.claude/integrations/{{PROVIDER_DOC}}`, `{{PROVIDER_PKG}}/` | architect → implementer → **integration-tester** (contract suite, BOTH impls) → reviewer → qa |
+
+<!-- nina:slot external-api.5 -->
+| **Auth / session change ({{AUTH_LIB}})** | `.claude/architecture.md` § *API*, `{{API_DIR}}/src/auth/`, **`.claude/integrations/better-auth.md`** | architect (cites premises) → implementer → **integration-tester** (real flow) → reviewer → qa |

package/releases/0.1.0/surfaces/external-api/tree/.claude/router.md

@@ -0,0 +1,6 @@
+<!-- nina:slot external-api.1 -->
+
+### 1b. Integration-tester is a guardrail for external-service surfaces
+Invoke **integration-tester** any time the diff touches {{AUTH_LIB}}, Prisma Accelerate cache behavior, R2/KV/Queues/Durable Objects, third-party HTTP, OR `{{PROVIDER_PKG}}`. It runs REAL flows against real services; for {{PROVIDER}} it runs the **contract-test suite against BOTH `{{PROVIDER_MOCK}}` and `{{PROVIDER_HTTP}}`**, so the mock can never pass while the live path is broken. No such change merges without its approval.
+
+The architect's spec MUST include an **External library premises** section with `node_modules/.pnpm/<lib>/...:<line>` citations for every real-library behavior the implementer depends on. For {{PROVIDER}} — a live third-party API, not a library on disk — a premise is settled by a `P-AS<n>` in `.claude/integrations/{{PROVIDER_DOC}}`, a contract-test case, or an observed sandbox response. Never by inference.

package/releases/0.1.0/surfaces/external-api/tree/CLAUDE.md

@@ -0,0 +1,17 @@
+<!-- nina:slot external-api.1 -->
+| **ANY external-library integration surface** ({{AUTH_LIB}} `{{API_DIR}}/src/auth/**` or `auth.api.*` call, Prisma Accelerate cache, R2/KV/Queues/Durable Objects bindings, third-party HTTP) | architect MUST cite premises with `node_modules:<line>` references in the spec; **+ integration-tester before reviewer** |
+
+<!-- nina:slot external-api.2 -->
+| **ANY {{PROVIDER}} surface** (`{{PROVIDER_PKG}}/**` or a new `{{PROVIDER_CLIENT}}` call) | architect cites the {{PROVIDER}} premises in `.claude/integrations/{{PROVIDER_DOC}}`; **+ integration-tester runs the contract-test suite against BOTH `{{PROVIDER_MOCK}}` and `{{PROVIDER_HTTP}}` before reviewer** |
+
+<!-- nina:slot external-api.3 -->
+- **integration-tester** → mandatory gate on external-service surfaces; runs REAL flows against real services ({{AUTH_LIB}}, Cloudflare bindings, the {{PROVIDER}} **sandbox**); for **{{PROVIDER}}** runs the **contract-test suite** against both the mock and the HTTP client so they cannot diverge; verifies every cited premise; updates `.claude/integrations/<lib>.md`
+
+<!-- nina:slot external-api.4 -->
+11. **The {{PROVIDER}} contract is THEIRS, and it is live.** All {{PROVIDER}} access goes through `{{PROVIDER_PKG}}` — never raw HTTP to {{PROVIDER}} from a route, service, DO, or queue. `{{PROVIDER_HTTP}}` and `{{PROVIDER_MOCK}}` MUST both pass the same contract-test suite; a mock that passes while the HTTP client does not is a lie, and a hard reject. Because the API is real, a premise is only settled by the installed source, the contract suite, or an observed sandbox response — never by inference. `fetch` inside the client must be bound to `globalThis` (workerd throws *illegal invocation* otherwise).
+
+<!-- nina:slot external-api.5 -->
+12. **External-library premises require `node_modules:<line>` citations in the spec.** The architect MAY NOT state {{AUTH_LIB}}, Cloudflare binding, or any third-party behavior as fact without opening the installed source and citing `node_modules/.pnpm/<lib>@<version>/.../<file>:<line>`. Library docs, vendor README, and inferred behavior are NOT citations — only installed source counts. Uncited premises = spec rejected by reviewer.
+
+<!-- nina:slot external-api.6 -->
+13. **External-service integration surfaces require the integration-tester gate before reviewer.** Any diff touching `{{API_DIR}}/src/auth/**`, an `auth.api.*` callsite, Prisma Accelerate cache behavior, R2/KV/Queues/Durable Objects bindings, third-party HTTP, OR `{{PROVIDER_PKG}}/**` MUST pass the integration-tester before reviewer approval. Unit-test mocks honor the spec, not the live service — only the integration-tester catches drift.

package/releases/0.1.0/surfaces/frontend/tree/.claude/agents/architect.md

@@ -0,0 +1,20 @@
+<!-- nina:slot frontend.1 -->
+| `cloudflare:web-perf` | a page-load performance question in `{{APP_DIR}}` |
+
+<!-- nina:slot frontend.2 -->
+
+## Visual acceptance — required in any spec touching `{{APP_DIR}}/**`
+
+A frontend spec that describes only structure produces a diff that only structure can verify, and
+structure is exactly what jsdom checks while being blind to the result. So state, as a short
+checklist, what must be TRUE ON THE SCREEN at **1440** and at **375**:
+
+- what is visible, and what must not be
+- what sits beside what, and what wraps or stacks at 375
+- the empty, loading and error states, if the change can produce them
+- anything that must not overflow, clip or overlap
+
+Each line must be checkable from a screenshot by someone who did not write the code — the **reviewer**
+checks the render against this list, and rejects on a mismatch. "Follows the design system" is not a
+criterion. A spec that touches `{{APP_DIR}}/**` without this section is incomplete, and the reviewer
+rejects it back to you.

package/releases/0.1.0/surfaces/frontend/tree/.claude/agents/devops.md

@@ -0,0 +1,25 @@
+<!-- nina:slot frontend.1 -->
+- Playwright is **not** a skill — it is an MCP server, and its `browser_*` tools are granted to you
+  directly in `tools:` above. Use them; there is nothing to invoke via `Skill`.
+
+<!-- nina:slot frontend.2 -->
+3. **Build-time env.** Vite inlines `VITE_*` at build time; `[vars]` in `wrangler.toml` never reach a Pages build. Verify every `VITE_*` the app reads is present in the build environment — a missing one ships a blank page, not an error.
+
+<!-- nina:slot frontend.3 -->
+
+## Render smoke — for any diff touching `{{APP_DIR}}/**`
+
+You are not the visual gate; the **reviewer** is, and it judges the render against the spec before
+the code ever reaches you. Your question is narrower and different: **did the deployed thing come up
+at all?** That is not the same failure — a build that renders perfectly on a reviewer's localhost
+still ships a blank page when `VITE_API_BASE_URL` was missing from the deploy build, which is exactly
+what happened here once.
+
+So on the preview URL, not localhost: `browser_navigate`, one screenshot at 1440, and
+`browser_console_messages`. You are checking that the page renders and the console is clean — not
+whether the layout is right. A blank page or a console error is `VERDICT: BLOCKED`.
+
+<!-- nina:slot frontend.4 -->
+
+If the changed path genuinely cannot be smoked without authenticating, do NOT authenticate: say so,
+report what you could verify, and hand the authenticated check to a human.

package/releases/0.1.0/surfaces/frontend/tree/.claude/agents/implementer.md

@@ -0,0 +1,17 @@
+<!-- nina:slot frontend.1 -->
+| `frontend-design:frontend-design` | new UI in `{{APP_DIR}}` — a page or component that did not exist |
+
+<!-- nina:slot frontend.2 -->
+
+## Look at the screen you built
+
+When you change anything under `{{APP_DIR}}/**`, open it in the browser before you hand off — the dev
+server or a local build, with `browser_navigate` plus a screenshot at 1440 and 375. Your test suite
+runs in jsdom, which has no layout engine and cannot tell you whether the thing renders.
+
+This is a self-check, not a gate: you are the author, and an author reviewing their own work catches
+the obvious and misses the rest. **reviewer** is the gate. The point of doing it here is that the
+obvious defects are cheap to fix now and expensive after review, qa and a deploy.
+
+Report what you saw. "Rendered at both widths, matches the spec's Visual acceptance" — or what
+differed.

package/releases/0.1.0/surfaces/frontend/tree/.claude/agents/qa.md

@@ -0,0 +1,9 @@
+<!-- nina:slot frontend.1 -->
+
+## What your green does not mean
+
+Your suite runs in jsdom, which has **no layout engine**. `toHaveClass('flex')` passes whether or not
+anything was laid out; nothing you run can tell you the screen is right. When you report PASS on a
+diff touching `{{APP_DIR}}/**`, say so — the rendering is checked by the **reviewer**, against the
+spec's Visual acceptance criteria. A PASS read as "the screen works" is how frontend
+defects reached staging through every gate.

package/releases/0.1.0/surfaces/frontend/tree/.claude/agents/reviewer.md

@@ -0,0 +1,54 @@
+<!-- nina:slot frontend.1 -->
+tools: Read, Grep, Glob, Bash, WebFetch, Skill, mcp__plugin_playwright_playwright__browser_navigate, mcp__plugin_playwright_playwright__browser_resize, mcp__plugin_playwright_playwright__browser_take_screenshot, mcp__plugin_playwright_playwright__browser_snapshot, mcp__plugin_playwright_playwright__browser_console_messages, mcp__plugin_playwright_playwright__browser_click, mcp__plugin_playwright_playwright__browser_evaluate, mcp__plugin_playwright_playwright__browser_close
+
+<!-- nina:slot frontend.2 -->
+- **If the diff touches `{{APP_DIR}}/**`: the spec must carry a Visual acceptance section, and you check the render against it — see *Visual gate* below.** No section → REJECT upstream to the architect.
+
+<!-- nina:slot frontend.3 -->
+- `pnpm build` for the affected frontend packages (`{{APP_DIR}}`)
+
+<!-- nina:slot frontend.4 -->
+## Visual gate — you are the stage that looks at the screen
+
+Deciding whether a screen is right is review, not operations, and it belongs here. qa runs vitest in
+jsdom, which has **no layout engine**: `toHaveClass('flex')` passes whether or not a single pixel
+landed anywhere. Every gate before you reads text. This is why backend work lands first time through
+this pipeline and frontend work does not — the frontend defects were never expressible as a test.
+
+For any diff touching `{{APP_DIR}}/**`:
+
+1. Build and serve it — you already run `pnpm build` for frontend diffs; serve that build locally.
+   Every protected screen redirects to `/login` without a session, so a plain static server
+   screenshots the login page. Use `scripts/visual-fixture-server.mjs`, which serves the built
+   `dist` AND a canned API from ONE origin (no auth, no DB, no Worker):
+
+   ```bash
+   export PATH=/opt/homebrew/opt/node@22/bin:$PATH
+   cd {{APP_DIR}} && VITE_API_BASE_URL=http://localhost:5199 npx vite build --outDir /tmp/dist-vis
+   node ../../scripts/visual-fixture-server.mjs /tmp/dist-vis 5199
+   ```
+
+   `VITE_API_BASE_URL` must match the fixture's origin at BUILD time — Vite inlines it, and a
+   mismatch ships a screen that renders but fetches nothing. The fixture logs `UNSTUBBED: <path>`
+   for any endpoint it does not know; add a handler there rather than screenshotting a broken
+   screen. `FIXTURE_EMPTY=1` switches list endpoints to `[]` to exercise empty states.
+2. `browser_navigate` to the changed screen. Screenshot at **1440** and at **375**
+   (`browser_resize` first — the viewport resets to a narrow default across navigations, so
+   resize AFTER navigating and confirm the width in the screenshot before you judge it).
+
+   Many screens are not reachable by URL. Tabs on `/identification` and `/settings` are local
+   React state, never reflected in the route, so `browser_click` is the ONLY way in — a
+   navigate-and-screenshot lands on the default tab and proves nothing about the changed one.
+2b. **Measure, do not squint.** `browser_evaluate` turns "looks fine" into a number, and an
+   overflow you can measure is one you can attribute. To decide whether horizontal scroll is
+   yours or pre-existing, measure `document.documentElement.scrollWidth` vs `clientWidth` on
+   the changed screen AND on an untouched one (`/dashboard`) — and, when it matters, build the
+   parent commit into a second dist and measure both. Reporting a pre-existing app-wide defect
+   as a regression wastes a cycle; excusing a real one as "probably pre-existing" ships it.
+3. Check each screenshot against the spec's **Visual acceptance** list, item by item. Not "looks
+   fine" — the specific claims the spec made.
+4. `browser_console_messages`. An error there is a defect even when the page renders.
+
+A screen that contradicts the spec is `REJECTED`, with the screenshot and what is wrong in it. Say in
+your report which widths you looked at; a frontend approval that does not mention having looked is
+the failure this section exists to end.

package/releases/0.1.0/surfaces/frontend/tree/.claude/patterns.md

@@ -0,0 +1,15 @@
+<!-- nina:slot frontend.1 -->
+
+---
+
+## Frontend (Vite + React) conventions
+
+- React **function components, hooks only**. No class components.
+- **TanStack Query for all server state.** Never fetch in `useEffect`.
+- **shadcn/ui + Tailwind** for styling. No CSS modules, no styled-components, no Emotion.
+- **Single-app layout:** `{{APP_DIR}}` serves all roles (`user`, `admin`) with a role-aware sidebar. Routes live in `{{APP_DIR}}/src/routes/`.
+- **Reusable UI and utilities belong in `packages/web-shared` (`{{PKG_SCOPE}}/web-shared`)** when they are stable cross-cutting primitives: `apiFetch`, {{AUTH_LIB}} client, hooks (`useAuth`, `useMe`, `useAccount`, etc.), `AuthGuard`, all shadcn `ui/*`, `formatBrl`/`parseBrl`, test helpers, the Tailwind preset.
+  - Import shadcn primitives from `{{PKG_SCOPE}}/web-shared/components/ui/<name>`.
+  - Import `formatBrl` / `parseBrl` from `{{PKG_SCOPE}}/web-shared/lib`.
+- **App-specific UI stays in `{{APP_DIR}}/src/components/`** when not consumed elsewhere.
+- No global state libs unless genuinely global (auth user, active account). Prefer URL state and TanStack Query cache.

package/releases/0.1.0/surfaces/frontend/tree/.claude/retrieval.md

@@ -0,0 +1,5 @@
+<!-- nina:slot frontend.1 -->
+| Frontend (single app — `{{APP_DIR}}`) | `.claude/architecture.md` § *Frontend*, `{{APP_DIR}}/src/routes/` | implementer → reviewer → qa |
+
+<!-- nina:slot frontend.2 -->
+| Shared frontend code (`packages/web-shared`) | `.claude/patterns.md` § *Frontend conventions*, `packages/web-shared/package.json` | architect → implementer → reviewer → qa |

package/releases/0.1.0/surfaces/frontend/tree/.claude/router.md

@@ -0,0 +1,17 @@
+<!-- nina:slot frontend.1 -->
+| `{{APP_DIR}}/**` page-load perf audit (LCP/INP/CLS/bundle) | `cloudflare:web-perf` |
+
+<!-- nina:slot frontend.2 -->
+
+### 6c. Nothing before devops can see the screen
+The reviewer reads a diff. qa runs vitest in jsdom, which has **no layout engine** — `toHaveClass('flex')`
+passes whether or not a pixel landed anywhere. Every backend invariant is checkable in text, which is why
+the same pipeline lands backend work first time and lets frontend defects through every gate: they were
+never expressible as a test.
+
+So any diff touching `{{APP_DIR}}/**` carries a visual contract: the **architect** writes a *Visual acceptance*
+checklist (what must be true on screen at 1440 and 375), the **reviewer** rejects an FE spec without one, the
+**implementer** looks at its own screen before handing off, and the **reviewer** builds, serves and screenshots it,
+rejecting on a mismatch — judging the screen is review, not operations. **devops** only smokes the
+deployed preview for a blank page. Browser access is granted through the Playwright MCP `browser_*` tools in those agents'
+`tools:` lists — it is not a skill, and an agent without those tools in its list cannot see anything.

package/releases/0.1.0/surfaces/frontend/tree/CLAUDE.md

@@ -0,0 +1,5 @@
+<!-- nina:slot frontend.1 -->
+| Audit page-load perf on `{{APP_DIR}}` — LCP, INP, CLS, bundle size | `cloudflare:web-perf` | Core Web Vitals + Chrome DevTools MCP integration |
+
+<!-- nina:slot frontend.2 -->
+| **ANY diff touching `{{APP_DIR}}/**`** | architect writes a **Visual acceptance** checklist; the **reviewer builds, serves and screenshots at 1440 and 375** and rejects on a mismatch; devops smokes the deployed preview for a blank page. jsdom has no layout engine — a green suite says nothing about the screen |

package/releases/0.1.0/surfaces/money/tree/.claude/agents/architect.md

@@ -0,0 +1,12 @@
+<!-- nina:slot money.1 -->
+11. **Money-movement invariants** — if the spec touches matching, split, payout generation, or {{PROVIDER}} export, explicitly confirm the design honors:
+    - Money is `BigInt` centavos end-to-end; percentages are basis points. Never `number` for money.
+    - A rule's total distribution may NEVER exceed the matched entry value → **block** (reject the rule/entry).
+    - A distribution **less** than the entry → **allow**, surface a shortfall alert, leave the remainder **parked** in escrow — never silently distributed.
+    - Payouts are **idempotent** — a transfer is NEVER sent twice. Dedup is enforced through the per-account Durable Object (`blockConcurrencyWhile` + its SQLite ledger) via an idempotency key before anything reaches {{PROVIDER}}.
+    - Every legal state transition (`{{ENTRY_MODEL}}`, `{{PAYOUT_MODEL}}`) writes an `{{AUDIT_MODEL}}` row (who/when/from→to). Illegal transitions throw.
+
+    If the design cannot satisfy all of these, redesign before submitting the spec.
+
+<!-- nina:slot money.2 -->
+- Design a money movement that can exceed the matched entry value, silently distribute a shortfall, or send a transfer twice. If the design needs monetary computation, that computation lives in `{{CORE_PKG}}` as a pure function — never inline in a service or route.

package/releases/0.1.0/surfaces/money/tree/.claude/agents/dba.md

@@ -0,0 +1,14 @@
+<!-- nina:slot money.1 -->
+7. **No cache on conciliation/payout-feeding reads.** Any read that feeds a **conciliation or payout write** — anything that loads an `{{ENTRY_MODEL}}` or `{{ACCOUNT_MODEL}}.balanceCents` before matching, generating, approving, or sending a payout/batch — MUST NOT carry a `cacheStrategy`. A stale `{{ENTRY_MODEL}}` or `{{ACCOUNT_MODEL}}.balance` contaminates real money movement. **Hard reject if violated.**
+
+<!-- nina:slot money.2 -->
+9. **Monetary columns.** Money is `BigInt` (Postgres `BIGINT`), stored in centavos (`R$ 12,53 → 1253`). Percentages are basis points stored as `Int`. Reject `Decimal`, `Float`, or `Int` for monetary values (Int is for bps only).
+
+<!-- nina:slot money.3 -->
+10. **Money-integrity invariants.** When the change touches `{{PAYOUT_MODEL}}` or `{{BATCH_MODEL}}`: verify the unique `idempotencyKey` constraint/index exists on the model (`@unique` in schema → `UNIQUE` in the migration SQL). This backs the "a transfer is never sent twice" invariant; a missing or dropped uniqueness on `idempotencyKey` is a **hard reject**. Likewise confirm `{{ACCOUNT_MODEL}}.userId` is `@unique` (1:1 escrow account per user) when `{{ACCOUNT_MODEL}}` is touched.
+
+<!-- nina:slot money.4 -->
+- Approve a query annotated with `cacheStrategy` if it feeds a conciliation or payout write.
+
+<!-- nina:slot money.5 -->
+- Approve a `{{PAYOUT_MODEL}}` or `{{BATCH_MODEL}}` change that lacks the unique `idempotencyKey` constraint.