Feat/payment state durability - #110

Verified locally beyond the PR's claims: full suite against a live Postgres 17.7 (784 pass / 0 fail, matching CI), lint/typecheck clean, and we confirmed the load-bearing behaviors empirically — concurrent two-worker transparent delivery produces exactly one payment_required and no spurious payment_rejected; replay after lease expiry + worker restart dedups across all three encryption modes. The mode asymmetry (event-keyed tombstones for transparent, authorization-keyed coalescing for explicit), generation fencing, JCS canonical identity with published vectors, and monotonic clock guards are all exactly right. Also verified the phase machine is near-minimal: we tried to collapse phases/leases and each deletion reopens a #109 hole.

One structural decision before merge, plus smaller items:

1. Defer the PostgreSQL backend — split the PR. The state machine + in-memory store fixes every #109 bug within a process (~1,300 lines). Postgres (+CI service, migrations, pg peer-dep, ~300 src/~600 test lines) buys only two things: restart durability and cross-worker atomicity. Today's expected loss without it is roughly (crash frequency) × (payments in a 5-min lease window) × (amount) — cents per year at current volumes. Per YAGNI we shouldn't carry the maintenance surface until a deployment actually runs one paying identity across multiple processes. The cut is surgical thanks to the PR's own seams: src/payments/postgres/, the pg-only e2e, the CI postgres service, the export entry, the peer-deps. Keep the backend on a ready branch — the contract suite makes re-landing it later a clean merge, not a rewrite.

2. Document the constraint the split creates: one paying server identity = one process. Without that sentence in the withServerPayments JSDoc + how-to, someone will scale horizontally and reintroduce the exact #109 bugs invisibly.

3. Ticket: expired-grant retention horizon. A paid grant that expires unclaimed (user pays, misses the 5-min authorizationTtlMs, returns) blocks its invocation hash with -32000 payment_expired forever — retainUntilMs: null, never collected, no recovery method (verified empirically). With pg deferred this self-heals on restart, so it's no longer release-blocking — but fix it properly (collect after grantExpiry + X) in the durable-backend PR, and meanwhile consider an actionable error message.

4. Still needed on the core: the PMI grammar decision is now centralized in payment-option-schema.ts (good — that heals the #108 client/server asymmetry) but it must be decided consciously: kebab-only as a normative CEP-8 restriction, or the full W3C grammar including https:// identifiers — plus .max(2048). And add the missing changeset — this breaks the public AuthorizationStore API. Ticket the docs item (paymentTtlMs must be ≥ processor invoice TTL, or late payments escape verification) and the observability pass (admission/transition outcomes are silent server-side).

One deliberate divergence worth a code comment: payment records use Map + deadlines instead of the codebase-wide LruCache — correct (recency is the wrong eviction axis for replay tombstones), but note it so nobody "fixes" it back.

Verdict: request changes for 1 (split), 2, and 4 — all cheap. The core is the right foundation; keep it.