Consequences, connected.

Every affected guarantee was evaluated on all of its prerequisites.

PR #pr:9002 Graph revision 1 Head public-demo-v1-S1_FIXED Assessment JSON

Verdict CLEAR_WITHIN_SCOPE

Why this verdict

R_ALL_HOLD4 prerequisite assumptions checked; every affected guarantee holds

What changed

Fact	Main	Proposed	Control
`paylane.retry_window_hoursconfig/partners/paylane.yaml:4`	24	72	external
`redis.max_ttl_hoursconfig/platform/redis.yaml:4`	48	72	us
`webhook.dedupe_ttl_hoursconfig/webhookingress.yaml:4`	24	72	us

How far it reaches

flowchart LR
  G_CHARGE_ONCE -. "relies on" .-> ADR_015["ADR-015"]
  G_CHARGE_ONCE -. "relies on" .-> ADR_018["ADR-018"]
  G_CHARGE_ONCE -. promises .-> ADR_012["ADR-012"]
  G_DEDUPE -. "relies on" .-> ADR_012["ADR-012"]
  G_DEDUPE -. promises .-> ADR_007["ADR-007"]
  G_LEDGER_CONSISTENT -. promises .-> ADR_018["ADR-018"]
  G_REFUND_MATCH -. "relies on" .-> ADR_018["ADR-018"]
  G_REFUND_MATCH -. promises .-> ADR_015["ADR-015"]
  classDef broken fill:#2a0f1a,stroke:#ff6b8b,color:#ffd3dd
  classDef unknown fill:#2a2310,stroke:#ffd27a,color:#fff0cc
  classDef holds fill:#0d2620,stroke:#7cf0c8,color:#d8fff2

Fig. 1. Each broken path fires from the changed assumption up to the decisions that promise or rely on it.

Dependency graph text

flowchart LR
  G_CHARGE_ONCE -. "relies on" .-> ADR_015["ADR-015"]
  G_CHARGE_ONCE -. "relies on" .-> ADR_018["ADR-018"]
  G_CHARGE_ONCE -. promises .-> ADR_012["ADR-012"]
  G_DEDUPE -. "relies on" .-> ADR_012["ADR-012"]
  G_DEDUPE -. promises .-> ADR_007["ADR-007"]
  G_LEDGER_CONSISTENT -. promises .-> ADR_018["ADR-018"]
  G_REFUND_MATCH -. "relies on" .-> ADR_018["ADR-018"]
  G_REFUND_MATCH -. promises .-> ADR_015["ADR-015"]

Guarantee	Status / baseline	Tier	Promised by	Relied on by	Exposed callers
`G_CHARGE_ONCE`	holdsMain: holds	1	ADR-012	ADR-018, ADR-015	checkoutservice, frontend, refundworker, webhookingress
`G_DEDUPE`	holdsMain: holds	1	ADR-007	ADR-012
`G_LEDGER_CONSISTENT`	holdsMain: holds	1	ADR-018		checkoutservice, frontend, refundworker, webhookingress
`G_REFUND_MATCH`	holdsMain: holds	1	ADR-015	ADR-018

Checked and not affected

holds

ADR-016 relies on G_ACK_FAST, also provided by ADR-007. Its full prerequisite set still holds.

Who should review

Remedies that survive verification

Only complete remedies may open a fix PR. Partial and rejected alternatives remain visible.

No verified remedy available for this assessment.

Assumption evidence

Assumption	State	Predicate / attestation
`A_ACK_BEFORE_TIMEOUT`We acknowledge every webhook before Paylane gives up on the delivery	holding	`2000 < 5000`webhook.ack_timeout_ms / paylane.delivery_timeout_ms
`A_REDIS_TTL`The shared Redis cluster keeps dedupe records for the full dedupe window	holding	`72 <= 72`webhook.dedupe_ttl_hours / redis.max_ttl_hours
`A_RETRY_WINDOW`Paylane stops retrying a webhook before our dedupe records expire	holding	`72 <= 72`paylane.retry_window_hours / webhook.dedupe_ttl_hours
`A_STABLE_EVENT_ID`Paylane sends the same event_id on every retry of a webhook	holding	Anika Rao · activeAttested: 2026-09-02 00:00 UTC Review by: 2027-03-01 00:00 UTC

The lexical gap

Fulltext search

Guarantee graph

The guarantee graph additionally reaches no additional decisions, whose decision bodies do not mention those terms.

Source citations

A_ACK_BEFORE_TIMEOUT adr/ADR-007.md:35 (local checkout)
A_REDIS_TTL adr/ADR-007.md:24 (local checkout)
A_RETRY_WINDOW adr/ADR-007.md:21 (local checkout)
A_STABLE_EVENT_ID adr/ADR-007.md:27 (local checkout)
G_CHARGE_ONCE adr/ADR-012.md:12 (local checkout)
G_DEDUPE adr/ADR-007.md:12 (local checkout)
G_LEDGER_CONSISTENT adr/ADR-018.md:12 (local checkout)
G_REFUND_MATCH adr/ADR-015.md:12 (local checkout)
paylane.retry_window_hours config/partners/paylane.yaml:4 (local checkout)
redis.max_ttl_hours config/platform/redis.yaml:4 (local checkout)
webhook.dedupe_ttl_hours config/webhookingress.yaml:4 (local checkout)