Stack/graceful deletion/03 payment drain

[dzdidi]

Summary

Part 3 of the graceful-deletion stack. Depends on Part 2.

Adds durable payment-window tracking and claim-fenced payment draining for content locks that have entered deletion.

The change:

• persists authoritative invoice windows;
• freezes Paykit and non-Paykit obligations at deletion admission;
• starts Paykit cleanup using opaque durable drain tokens;
• reconciles external Paykit progress into monotonic local state;
• supports crash and reclaim around external drain initiation;
• prevents deleting locks from admitting new payment work;
• advances only after every frozen payment obligation is terminal.

Rejected, canceled, proposal-expired, and accepted-expired payments are classified as Expired, not Failed.

Contract and risk impact

• Public API or SDK contract
• Persisted data or migration
• Authentication, authorization, identity, or secret handling
• Payment or entitlement behavior
• Runtime, deployment, or observability
• No contract/risk impact

Migrations:

• 0014_paykit_invoice_windows.sql
• 0015_content_lock_payment_drains.sql

Payment-drain mutations are fenced by the exact deletion job, worker, and claim token. Stale workers cannot persist progress after reclaim or force escalation.

Verification

The following commands were run successfully on the final combined stack:

• cargo fmt --all -- --check
• cargo test --workspace --all-targets --all-features
• cargo clippy --workspace --all-targets --all-features -- -D warnings
• git diff --check codex/bitkit-local-e2e-fixes..stack/graceful-deletion/05-execution

The final run included:

• locks-service library: 355 passed;
• deletion integration: 29 passed;
• PostgreSQL E2E: 12 passed.

This intermediate slice was not independently rerun after restacking; its isolated CI result should be recorded before merge.

Documentation

Updated:

• docs/plans/2026-08-10-graceful-content-lock-deletion.md

The plan documents authoritative payment windows, opaque drain tokens, terminal obligation handling, and crash/reclaim behavior.

Checklist

• The change is focused and self-reviewed.
• Regression tests were added where practical.
• No credentials, identities, private content, payment material, or generated local state are included.
• Formatting and relevant tests/lints pass.