Resolve merged spec inconsistencies before contract freeze

Outcome

The merged design no longer contains known contradictions that would split implementation or recreate a staged demo.

Scope

• Keep the reliability matrix private and QA-only; the facilitator states factual boundaries but never suggests user inputs or a preferred result. Treat the phase table as a capability map: setup/search is primary, booking is conditional, and later drills are optional rather than theatrical beats.
• Use ApprovalInvalidated for revoked or amended authority; reserve ApprovalExpired for time/quote invalidation.
• Define initial and recovery payment_action_required states. In both flows, PaymentActionCompleted returns to the originating pending state without asserting provider success; verified provider success/failure may win the race.
• Separate agent judgment from core authority: the agent interprets, ranks, recommends, and selects; Farewright stores the graph, evaluates confirmed typed hard rules, and authoritatively revalidates/enforces them at execution.
• Replace global feasibility decisions with complete|no_matching_offers|temporarily_unavailable provider outcomes and candidate-local autonomous|approval_required|prohibited snapshots. Search evidence is never authority.
• Record explicit typed trip-request revisions and non-authorizing candidate selections. Material reprice drift requires a newly confirmed selection.
• Make RefundFailed terminal for one attempt, retain the obligation as a visible exception, and permit an idempotent retry with a new refund/effect ID. Distinguish a satisfied deliberately partial target from an incomplete partial settlement and define its guarded return to refund_pending.
• Restore demo-critical CSRF, webhook ordering/deduplication, initial and recovery payment-action, compensation, and provider-success-before-domain-append tests.
• Make USD-only rehearsal wording explicit, including a non-USD rejection.
• Keep a GitHub Project board optional throughout the spec and tracker.
• Require every mutation to append a declared domain event or named, durable, attributed operational record; complete the producer matrix for internal and external commands.
• Replace model-visible bearer-style browser links with non-authorizing handoff locators that require matching login, a server-issued HttpOnly session, CSRF, and a token-free redirect.
• Make fixture runs replay-complete: atomically materialize fresh attributed events from a versioned seed, never copy provider references, and block active-run switching while decisions/effects are unresolved.
• Separate terminal command receipts from asynchronous business outcomes: provider work returns accepted plus an operation ID and named result read.
• Close the service-refund path with a version-bound remedy, payment-bounded obligation, and resolution/failed-refund rules.

Acceptance

• Every listed ruling and later blocking audit correction recorded in the PR is applied to the governing spec.
• Event, state, command/tool, ledger, demo, and acceptance text agree with the rulings.
• Both payment-action completion transitions and the provider-outcome race appear consistently in diagrams, prose, schemas, and tests.
• Unsupported input, provider completeness, no matching inventory, candidate policy evidence, and execution authority are distinct contracts.
• No search result ranks, recommends, selects, or authorizes; no execution path trusts model arithmetic or a stale snapshot.
• No fixed route, dates, budget, threshold, remedy, refund, preferred result, or mandatory post-booking storyline is reintroduced.
• Reliability data cannot steer the user away from an honest no-match, prohibition, or outage result.
• git diff --check and the stale-term/contradiction sweep pass.

Dependencies

• M0-F rulings only where observed host behavior affects the text.

Review

Independent contract reviewer must approve the resolved wording as part of #10 before implementation fans out.

Start with the governing spec and the PR rulings referenced in the acceptance criteria, including the M0-F behavior dependency and review in #10. Compare the event, state, command/tool, ledger, demo, and acceptance sections against every listed ruling, then run git diff --check and the stale-term/contradiction sweep. Done means the rulings are consistently recorded and the independent contract reviewer approves the result.