test(ci): rehearse PR 216 redelivery integration

[EfeDurmaz16]

Purpose

Temporary integration rehearsal for the #216 redelivery stack against #219. This combines the current leaf heads to exercise the complete CI/harness matrix before maintainers merge the reviewable per-language and per-protocol PRs.

Included proof

• zero missing records in the 113-commit / 237-path delivery ledger
• Go race/lint/coverage clean
• Rust full tests and 75% per-file coverage gate clean
• Python full suite clean after integration fixes
• TypeScript typecheck, lint, formatting, and focused capability tests clean
• repo hygiene and publish workflow guard self-tests clean

This PR is not a replacement for the leaf PRs and should not be merged directly.

[EfeDurmaz16]

@greptile-apps please re-review. The rehearsal now preserves the Go v2 settlement outbox/lease semantics, removes stale PHP replay-store escape wiring, and restores the TypeScript subscription replay-store public contract; focused Go race/full, PHP full, Python session, and TypeScript build/type checks are green.

[greptile-apps]

Greptile Summary

This integration rehearsal combines six language SDKs (Go, Python, TypeScript, Rust, PHP, Ruby) and the full CI/harness matrix into a single rehearsal head against split/pr216-ci-harness-mega. It is explicitly not intended to be merged directly.

The substantive changes include:

• Dependency migration: all Go packages migrate from gagliardetto/solana-go to solana-foundation/solana-go/v2, and the Python package is renamed pay_kit → solana_pay_kit.
• Replay-store hardening: durable shared stores are now mandatory off localnet in Go, Python, TypeScript, and PHP; a PAY_KIT_ALLOW_INMEMORY_REPLAY_STORE escape hatch is provided for explicit development opt-in.
• Stronger on-chain verification seam: new VerifyOpenStateTx / VerifyTopUpStateTx hooks bind channel opens and top-ups to authoritative confirmed on-chain facts.
• Settlement outbox: SettlementWire, SettlementLastValidBlockHeight, and claim-ownership tokens are persisted atomically before broadcast so retries reuse the exact signed wire.

Confidence Score: 4/5

The three previously flagged issues have all been addressed: the nil-RPC + non-nil-signer gap is now rejected at construction, the settlement-not-landed TOCTOU was reworked to use IsBlockhashValid at finalized commitment, and the VerifyTopUpTx dispatch now uses a typed switch with a clear diagnostic. No new issues of comparable weight were introduced.

The VerifyTopUpTx any field in SessionConfig still allows a mistyped verifier to be assigned without a compile-time error when constructing the struct directly. The runtime error is now descriptive, but the failure only surfaces during a live top-up rather than at server construction. NewSession always writes a properly-typed value, so the public API path is safe.

go/protocols/mpp/server/session.go — SessionConfig.VerifyTopUpTx is typed any; a construction-time type assertion in NewSessionServer would eliminate the last runtime-only detection path for direct struct users.

Important Files Changed

Filename	Overview
go/paykit/adapters/x402/exact.go	Significant rework: replay store migrated from sync.Map to mppcore.Store with PutIfAbsent; cleanupConsumed pin moved before SendTransaction; settlementNotLanded rewritten to use IsBlockhashValid at finalized commitment.
go/protocols/mpp/server/session_method.go	SettlementRPC nil-guard is now enforced at construction; Logger defaults to slog.Default() when nil; closeOnIdle now always calls handleClose; isNilOption with reflect guards against typed-nil Signer/RPC.
go/protocols/mpp/server/session.go	VerifyOpenStateTx and VerifyTopUpStateTx hooks added; runTopUpTxVerifier type-switch replaces the old untyped dispatch; ConsumedTopUpSignatures deduplication added.
go/protocols/mpp/server/server.go	Store construction now requires SharedStore.IsShared() on non-localnet; cleanupConsumed = false moved before SendTransaction to pin marker on ambiguous transport errors.
python/src/solana_pay_kit/protocols/mpp/server/session.py	verify_open_state_tx and verify_top_up_state_tx hooks added; snapshot-before-verifier + mutator-deposit-check pattern mirrors Go; _require_production_session_safety guard added.
.github/workflows/ci.yml	fetch-depth: 0 added for PR216 ledger gate; Python HTML path corrected; Rust coverage script extracted; new x402 matrix and cross-server test runs with assert-run-count.mjs enforcement.
typescript/packages/pay-kit/src/replay-store.ts	New file: ReplayStore and ReservingReplayStore interfaces defined; isProductionReplayStore requires isDurable + isShared + not-memory.

_{Reviews (6): Last reviewed commit: "fix(integration): preserve replay store ..." | Re-trigger Greptile}

[EfeDurmaz16]

@greptile-apps please re-review the updated integration head. It now preserves explicit-false replay-store precedence over environment opt-in, restores only the localnet fallback, and closes the Go lint, PHP constructor, and TypeScript atomic-store merge gaps; adversarial Sol verification is clean.