docs(plan): define hashless recovery

.agent/AGENTS.md

@@ -34,8 +34,9 @@ OneShot's core promise is: `One job. Many retries. One settlement.`
 - Privy provides corporate wallet access and scoped authorization, policy, and
   spending permissions.
 - Arc is the USDC settlement rail.
-- The Graph provides live indexed history and recovery context. It is never the
-  duplicate-payment lock or authority for creating another Settlement.
+- Direct Privy and Arc evidence resolves known transaction identities. The Graph
+  is the selected v1 hashless candidate-discovery layer after its C01 evidence
+  gate; it is never the duplicate-payment lock or settlement authority.
 
 Read `.agent/PROJECT_CONTEXT.md`, `.agent/SECURITY_INVARIANTS.md`, and
 `.agent/SPONSOR_REQUIREMENTS.md` before changing these boundaries.
@@ -50,7 +51,7 @@ Read `.agent/PROJECT_CONTEXT.md`, `.agent/SECURITY_INVARIANTS.md`, and
 - Make state durable and transitions atomic and concurrency-safe.
 - Represent money as integer atomic units or `bigint`, never JavaScript
   floating point.
-- Graph absence or indexing delay is not proof that payment did not happen.
+- External-index absence or delay is not proof that payment did not happen.
 - Normal execution must not bypass Privy policy or OneShot controls.
 - Use testnet only unless the user explicitly authorizes another network.
 - Never log, expose, persist, commit, or send secrets, private keys, seed

.agent/PROJECT_CONTEXT.md

@@ -34,13 +34,14 @@ verticals over the same durable intent contract.
 - Privy is the corporate wallet and scoped authorization boundary. OneShot must
   use its policies and spending permissions on the normal execution path.
 - Arc is the real USDC settlement rail used by the demo.
-- The Graph supplies live indexed recovery/history context and agent decision
-  support after ambiguous outcomes. It can corroborate or locate activity, but
-  cannot authorize a duplicate payment.
+- Direct Privy lookup and Arc RPC receipt/log evidence resolve known transaction
+  identities after ambiguous outcomes.
+- The Graph is the selected v1 candidate-discovery layer when the transaction
+  hash is missing. C01 must prove live hashless discovery and AI-track value;
+  Graph results remain non-authoritative and can never authorize another payment.
 
 When an external submission may have happened but the result is uncertain,
-OneShot records `UNKNOWN` and reconciles. Missing Graph data never converts
-`UNKNOWN` into permission to submit again.
+OneShot records `UNKNOWN` and reconciles. Missing external-index data never converts `UNKNOWN` into permission to submit again.
 
 ## Glossary
 
@@ -64,14 +65,14 @@ have zero or one committed Settlement, never more than one.
 ### Reconciliation
 
 The process that resolves an ambiguous external effect using durable local
-state, provider identifiers and receipts, Arc state, and indexed evidence.
+state, provider identifiers and receipts, Graph-discovered candidates, and Arc proof.
 Reconciliation precedes any decision to retry payment when settlement state is
 `UNKNOWN`.
 
 ### Recovery View
 
-A derived, non-authoritative view assembled from durable OneShot records and
-live indexed history, including The Graph. It helps operators and agents explain
+A derived, non-authoritative view assembled from durable OneShot records, live
+Graph candidate discovery, and Arc verification. It helps operators and agents explain
 and recover work but does not grant permission to create a Settlement.
 
 ## Decision test

.agent/SECURITY_INVARIANTS.md

@@ -9,7 +9,7 @@ These rules fail closed. A feature, demo, or deadline does not override them.
 - Use durable, atomic, concurrency-safe transitions for settlement ownership.
 - A timeout, crash, disconnect, lost response, or provider error after possible
   submission creates `UNKNOWN`; reconcile before any payment retry.
-- Never infer non-payment from an empty or delayed Graph result.
+- Never infer non-payment from an empty or delayed external-index result.
 - Preserve a successful payment result even if a later supplier or API step
   fails.
 - Do not offer a normal code path that bypasses OneShot state controls or Privy

.agent/SPONSOR_REQUIREMENTS.md

@@ -3,38 +3,48 @@
 Use this document before sponsor-facing implementation, demo preparation,
 release, or submission claims.
 
-## Privy
+## Primary target: Privy
 
 - Privy must be core corporate wallet authorization, not login-only branding.
-- The working path must demonstrate scoped authorization, policies, or spending
-  permissions that constrain settlement.
+- The working path must demonstrate a Privy wallet plus scoped authorization,
+  policies, signers, quorum, or spending permissions that constrain settlement.
 - Policy denial or an amount above policy must produce zero settlement.
 - The normal agent path must not bypass Privy authorization.
 
-## Arc
+## Primary target: Arc
 
-- The demo must execute a real USDC settlement on the authorized Arc testnet.
-- Showing an Arc network label, wallet address, explorer page, or mocked payment
-  alone does not qualify.
-- OneShot must retain the settlement identity and result through retries and
+- The demo must execute a real USDC settlement on Arc Testnet.
+- Showing a network label, wallet, explorer page, or mocked payment alone does
+  not qualify.
+- The product must have a working frontend, backend, architecture diagram,
+  public source, documentation, and short demonstration.
+- OneShot must retain settlement identity and result through retries and
   downstream failures.
+- For the Launch track, include a disabled Arc Mainnet profile, deployment and
+  rollback artifacts, and readiness evidence. Actual mainnet execution remains
+  disabled until Circle publishes official production access/identities and a
+  human explicitly authorizes real-value activation.
 
-## The Graph
+## Selected target: The Graph AI Tooling or AI Use Case
 
-- The integration must use live indexed data for recovery, history, or agent
-  decision support.
-- The demo should show how indexed evidence helps resolve or explain an
-  ambiguous outcome.
-- The Graph must never be the sole duplicate-payment lock, authoritative intent
-  state, or proof that another settlement may be submitted.
-- Empty results and indexing delay must preserve safe behavior.
+The Graph is load-bearing for automatic recovery when a successful submission
+lost its transaction hash. It discovers candidates; Arc verifies them; OneShot
+decides. C01 must prove this with live data before any qualification claim.
+
+- Target the AI Tooling or AI Use Case track. The recovery agent must use live
+  Graph data for meaningful candidate selection, explanation, and automation.
+- Do not target Composable/Standardized with one custom Subgraph; that track
+  requires two Graph products or meaningful standardized-schema work.
+- Empty, delayed, multiple, or contradictory candidates preserve `UNKNOWN` and
+  cannot unlock another settlement.
+- Include a public repository, clear README, and a two-to-four-minute demo.
 
 ## Claim standard
 
-Do not state or imply sponsor qualification unless the integration exists in
-working code and the demo proves the required behavior. Plans, placeholders,
-mockups, environment variables, dependency declarations, and network labels are
-not implementation evidence.
+Do not state or imply sponsor qualification unless working code and live demo
+evidence prove every selected track requirement. Plans, placeholders, mocks,
+environment variables, dependencies, and network labels are not evidence.
 
-Use the `sponsor-qualification` skill to report each sponsor as `QUALIFIED`,
-`NOT QUALIFIED`, or `NOT VERIFIED`, with code, test, and demo evidence.
+Use the `sponsor-qualification` skill to report each selected sponsor as
+`QUALIFIED`, `NOT QUALIFIED`, or `NOT VERIFIED`, with code, test, demo, network,
+and limitation evidence.

.agent/TEST_MATRIX.md

@@ -1,7 +1,7 @@
 # OneShot Test Matrix
 
 Select every applicable case for changes to intents, retries, workers, queues,
-payments, settlements, reconciliation, Privy, Arc, or The Graph. Prefer tests at
+payments, settlements, reconciliation, Privy, Arc, or The Graph discovery. Prefer tests at
 the public domain boundary plus focused adapter tests. A test must assert durable
 state and external settlement count, not only an HTTP response.
 
@@ -15,7 +15,7 @@ state and external settlement count, not only an HTTP response.
 | Crash before submission | Kill process before any external submission | 0 settlements; retry is allowed from durable state |
 | Crash after submission | Kill process after possible submission but before local confirmation | Enter `UNKNOWN`; reconcile; no blind retry |
 | Lost payment response | Payment succeeds but HTTP response is lost | Exactly 1 committed settlement after reconciliation |
-| Graph delay or absence | The Graph temporarily returns nothing or lags | No duplicate settlement; absence is not non-payment proof |
+| Graph delay, absence, or ambiguity | The Graph returns nothing, lags, is unavailable, or returns multiple candidates | Remain `UNKNOWN`; no duplicate settlement; absence is not non-payment proof |
 | Privy denial | Policy denies or amount exceeds permission | 0 settlements and explicit authorization failure |
 | Service restart | Restart after durable intent creation or in-flight work | Intent and settlement state survive; invariant holds |
 | Downstream failure after payment | Supplier/API step fails after settlement | Payment result remains durable; no replacement payment |

.agent/context/20260906T201351Z-product-roadmap.md

@@ -42,7 +42,7 @@ contributes to the complete product.
 - All local Markdown links in `plan.md`, `milestones/`, and `docs/` resolve.
 - Exactly 18 packet files remain.
 - Packet headers contain no planning-size metadata.
-- Mermaid CLI 11.17.0 rendered all 10 diagrams successfully.
+- Mermaid CLI 11.17.0 rendered all 12 diagrams successfully.
 - `git diff --check` passes.
 - Gate A and Gate B were intentionally not run because the user explicitly
   requested skipping the two-review procedure for the planning phase.
@@ -55,5 +55,35 @@ contributes to the complete product.
 ## Git state
 
 - Branch: `milestone/product-roadmap`
-- Base: `develop` at `5ef6a66313614e67b476f56c98f47c65344fb6ec`
-- Pull request: `https://github.com/SWOFART/OneShot/pull/7`
+- Original roadmap base: `develop` at `5ef6a66313614e67b476f56c98f47c65344fb6ec`.
+- Follow-up base: `develop` at `4336e04d9fd42b419a9cfa961f4f8d25b15cd3cb`.
+- Original roadmap pull request: `https://github.com/SWOFART/OneShot/pull/7`
+  (merged into `develop` before this architecture correction).
+- Follow-up pull request: `https://github.com/SWOFART/OneShot/pull/8`.
+
+## 2026-09-06 architecture correction
+
+- The working Arc Testnet product remains the first live proof.
+- Mainnet readiness is now part of P0-P6 through a disabled typed profile,
+  deployment/preflight evidence, safe disable, rollback, and a human activation
+  gate. No unavailable Arc Mainnet values are guessed.
+- PostgreSQL remains authoritative. Direct Privy lookup and Arc receipt/log
+  evidence form the required recovery path.
+- The Graph is the selected v1 hashless candidate-discovery layer. C01 must
+  prove live value, freshness, multiple-candidate handling, and AI-track fit;
+  Arc remains authoritative and a failed gate removes the Graph claim.
+- Gate A and Gate B are skipped for this follow-up planning change by explicit
+  user instruction. Required repository CI and human review still apply.
+## 2026-09-06 Graph and Arc Memo decision
+
+- Primary submission direction: Privy authorizes, The Graph discovers, Arc
+  proves, and OneShot/PostgreSQL decides.
+- Target The Graph AI Tooling or AI Use Case, not Composable/Standardized.
+- Demonstrate a real Arc payment whose successful response/hash is discarded at
+  the adapter fault boundary, followed by live Graph discovery and direct Arc
+  verification with no second payment.
+- Prefer Arc Memo `memoId = hash(business_intent_id)` for unique correlation only
+  if B01 proves Privy can constrain the forwarded USDC call. Otherwise preserve
+  stricter authorization and use tuple/window search or a narrow typed contract.
+- Privy + Arc + The Graph is the final selected stack; alternative settlement
+  rails are outside this roadmap.

.agent/research/20260906-integration-decisions.md

@@ -2,7 +2,8 @@
 
 Date: 2026-09-06
 Scope: primary-source facts needed to make the first product implementation plan decision-complete.
-Target: Privy-authorized USDC settlement on Arc Testnet with The Graph as a non-authoritative recovery view.
+Target: Privy-authorized exactly-once settlement on Arc Testnet with The Graph
+as the hashless recovery index.
 
 ## Decisions
 
@@ -21,13 +22,15 @@ Target: Privy-authorized USDC settlement on Arc Testnet with The Graph as a non-
 - Arc transactions are pending until included, then immediately and deterministically final; there is no accumulating-confirmation state. A receipt with `status: 1` is final success only after validating the expected USDC `Transfer` log. A receipt with `status: 0` is final execution failure and zero settlement ([transaction lifecycle](https://docs.arc.io/integrate/wallets/transaction-lifecycle), [deterministic finality](https://docs.arc.io/arc/concepts/deterministic-finality)).
 - Deterministic finality does not eliminate submission ambiguity. A lost Privy/RPC response or process crash after a possible broadcast still becomes `UNKNOWN`; a new-nonce payment is forbidden until reconciliation proves a safe terminal result.
 
-### The Graph: live recovery evidence, never settlement authority
+### The Graph: selected for hashless discovery, never settlement authority
 
-- The Graph lists Arc Testnet as `arc-testnet`, protocol Ethereum, CAIP-2 `eip155:5042002` ([Arc Testnet support](https://thegraph.com/docs/en/supported-networks/arc-testnet/)).
-- Build a custom Subgraph over the unified USDC `Transfer` event. Identify each event by transaction hash plus log index and retain block number, block timestamp, sender, recipient, and amount as Graph `BigInt` ([Arc event indexing](https://docs.arc.io/integrate/infrastructure/indexing-events), [Subgraph quick start](https://thegraph.com/docs/en/subgraphs/quick-start/)).
-- Every query must request `_meta` block data, deployment ID, and `hasIndexingErrors`. Operational health must also compare indexed `latestBlock` with `chainHeadBlock`; `synced` only means the deployment caught up at least once ([GraphQL API](https://thegraph.com/docs/en/subgraphs/querying/graphql-api/), [indexing health](https://thegraph.com/docs/en/subgraphs/developing/deploying-publishing/multiple-networks/)).
-- Missing, empty, lagging, or unhealthy indexed results mean only that no matching event was observed through a known indexed block. They never prove non-payment or authorize another submission. Direct Arc receipts plus durable OneShot state remain authoritative.
-- Use a deployment-pinned query endpoint for schema-stable demo evidence. Do not claim sponsor qualification until a deployed endpoint returns live Arc data and lag/error behavior is demonstrated ([Subgraph ID versus deployment ID](https://thegraph.com/docs/en/subgraphs/querying/subgraph-id-vs-deployment-id/)).
+- Direct Privy lookup plus exact Arc receipt/log verification resolves known transaction identities. PostgreSQL remains authoritative for ownership, intent state, and the `UNKNOWN` hold.
+- The Graph is the selected v1 path for discovering candidate transfers when a successful submission lost its hash. C01 must prove this live and show a capability that disappears when Graph is removed.
+- Every query carries deployment and freshness/error evidence. Missing, empty, lagging, unhealthy, multiple, or contradictory candidates preserve `UNKNOWN`; Arc verifies every candidate before any commit.
+- Arc RPC can scan logs without a hash, so The Graph is a product choice for structured automatic discovery rather than the only technically possible scanner ([Arc event indexing](https://docs.arc.io/integrate/infrastructure/indexing-events), [Graph querying](https://thegraph.com/docs/en/subgraphs/querying/introduction/)).
+- Arc's Memo contract can attach a caller-supplied `memoId` and `callDataHash` to a forwarded USDC call specifically for correlation and reconciliation. C01/B01 must test `memoId = hash(business_intent_id)` as the preferred unique lookup key ([Arc Memo indexing](https://docs.arc.io/integrate/infrastructure/indexing-events)).
+- Privy can enforce chain, destination contract, decoded function, and decoded top-level calldata parameters. Before choosing Memo for settlement, B01 must prove the policy can constrain the forwarded USDC target and required business fields; otherwise use the tuple-search fallback or a narrow typed settlement contract without weakening authorization ([Privy policy fields](https://docs.privy.io/controls/policies/overview)).
+- Target the Graph AI Tooling or AI Use Case track: live Graph data must drive meaningful recovery-agent selection, explanation, or automation. The composable/standardized track requires two Graph products or meaningful use of a standardized schema; one custom Subgraph query is insufficient ([ETHOnline 2026 prize requirements](https://ethglobal.com/events/ethonline2026/prizes)).
 
 ### Durable state and work delivery
 
@@ -41,9 +44,14 @@ Target: Privy-authorized USDC settlement on Arc Testnet with The Graph as a non-
 1. Pin exact SDK and runtime versions only after a compatibility spike validates Privy request signing, Arc chain support, and policy condition syntax.
 2. Assert `eth_chainId == 5042002` and bytecode exists at the configured USDC address during testnet startup checks.
 3. Prove the chosen Privy policy denies wrong chain, wrong contract, wrong recipient, wrong method, non-zero native value, and above-cap amount with zero settlement.
-4. Prove The Graph deployment health and lag thresholds against live Arc Testnet before sponsor qualification.
+4. Prove live The Graph hashless discovery, freshness, multiple-candidate handling, safe degradation, and AI-track value; otherwise remove the Graph claim and use direct recovery.
 5. Keep Privy webhooks outside the critical path until plan availability and signature verification are demonstrated.
 
 ## Planning consequence
 
-The work can be split into three independent backend tracks after one contract freeze: (A) domain/storage/API, (B) Privy/Arc settlement, and (C) indexing/reconciliation. Each track must ship its own contract simulator and tests so progress does not depend on another track's implementation. Frontend begins only after the integrated backend contract and recovery semantics are stable.
+The work can be split into three independent backend tracks after one contract
+freeze: (A) domain/storage/API, (B) the Privy/Arc adapter, and (C) The Graph
+reconciliation/evidence. Each track must ship its own contract simulator and
+tests so progress does not depend on another track's implementation. Frontend
+begins only after the integrated backend contract and recovery semantics are
+stable.

.agents/skills/oneshot-failure-injection/SKILL.md

@@ -17,7 +17,7 @@ submitted, and definitely confirmed.
 - Deliver the same request repeatedly and from 10 parallel workers; prove at
   most one committed settlement.
 - Restart services between durable transitions and external responses.
-- Delay or empty The Graph results; prove no duplicate settlement.
+- Delay, empty, corrupt, or multiply-match The Graph candidate results and prove `UNKNOWN` plus no duplicate settlement.
 - Deny Privy policy and exceed spending amount; prove zero settlement.
 - Fail a supplier/API action after payment; prove settlement result remains.
 - Assert external settlement count, durable intent/attempt/settlement state, and

.agents/skills/oneshot-idempotency/SKILL.md

@@ -20,7 +20,7 @@ Read `.agent/PROJECT_CONTEXT.md`, `.agent/SECURITY_INVARIANTS.md`, and
   where the provider supports it. This supplements, not replaces, OneShot state.
 - Treat any possibly submitted but unconfirmed payment as `UNKNOWN`. Reconcile
   from durable/provider/Arc evidence before retrying.
-- Never use Graph absence or indexing delay as permission to pay.
+- Never use external-index absence or delay as permission to pay.
 - Keep money in integer atomic units or `bigint`; validate asset, network,
   recipient, amount, and Privy policy before submission.
 - Preserve payment results when later supplier/API work fails.