diff --git a/docs/PROJECT_STATE.md b/docs/PROJECT_STATE.md
index 43e7d72..3f10329 100644
--- a/docs/PROJECT_STATE.md
+++ b/docs/PROJECT_STATE.md
@@ -35,9 +35,10 @@ Local `main` in the main clone is at `5693f7b`, an older Production commit that
 | #30 M4.3 UPI Security Remediation | `launch-mvp` ← `feature/m4-3-upi-security-remediation` | `e4babe6` | `lint, unit, e2e` ✅ | PR Review Baseline for M4.3.1 |
 | #31 M4.3.1 Review Remediation | `feature/m4-3-upi-security-remediation` ← `feature/m4-3-1-review-remediation` | `03bf518` | `lint, unit, e2e` ✅ | Independent Review Corrections for PR #30 |
 | #32 M4.3.2 Financial Integrity Remediation | `feature/m4-3-1-review-remediation` ← `feature/m4-3-2-financial-integrity` | `62cb0a3` | `lint, unit, e2e` ✅ · Vercel ✅ | Fail-Closed Merchant Identity & Secure Manual Refund Reconciliation |
-| (Review) M4.3.3 Final Provider Verification Integrity | `feature/m4-3-2-financial-integrity` ← `feature/m4-3-3-provider-verification` | (work branch) | `lint, unit, e2e` ✅ | Removal of Currency Defaults, Elimination of Merchant Fallback, Authentic S2S Polling & Attestation |
+| #33 M4.3.3 Final Provider Verification Integrity | `feature/m4-3-2-financial-integrity` ← `feature/m4-3-3-provider-verification` | `4c54711` | `lint, unit, e2e` ✅ · Vercel ✅ | Removal of Currency Defaults, Elimination of Merchant Fallback, Authentic S2S Polling & Attestation |
+| #34 M4.3.4 Provider Contract Decision & M4 Closure | `feature/m4-3-3-provider-verification` ← `feature/m4-3-4-contract-decision` | `1e5bd19` | `lint, unit, e2e` ✅ | PhonePe Contract Determination (Outcome B), Full Regression Suite, Audit & Milestone M4 Closure |
 
-**Owner gate:** PR #17 must not be merged without the owner's separate approval. `main` has no GitHub Actions runs on record. PR #32, PR #31, PR #30, and PR #17 must not be merged without separate owner approval. Keep `ENABLE_LIVE_PAYMENTS=false` everywhere.
+**Owner gate:** PR #17 must not be merged without the owner's separate approval. `main` has no GitHub Actions runs on record. PR #34, PR #33, PR #32, PR #31, PR #30, and PR #17 must not be merged without separate owner approval. Keep `ENABLE_LIVE_PAYMENTS=false` everywhere.
 
 PR #23 is **merged** at `7c5079e` (P3 Location Intelligence + M2 Remediation).
 PR #25 is **merged** at `83a30a7` (Owner Addendum Ops: dynamic DB block list, branch archiving, Phase 5.6/5.7 reports).
@@ -48,6 +49,8 @@ PR #29 is **merged** at `c71ec8d` (M4.2 Independent UPI Payment Security & Produ
 PR #30 is **open / preserved** (`feature/m4-3-upi-security-remediation`).
 PR #31 is **open / preserved** (`feature/m4-3-1-review-remediation`).
 PR #32 is **open / preserved** (`feature/m4-3-2-financial-integrity`).
+PR #33 is **open / preserved** (`feature/m4-3-3-provider-verification`).
+PR #34 is **open / preserved** (`feature/m4-3-4-contract-decision`).
 
 ## 4. Migrations per environment
 
@@ -164,8 +167,12 @@ Per owner approval on 2026-11-03, each of the 19 fully merged remote branches wa
 | M4 Payment & Booking Readiness | `feature/m4-payment-booking-audit` / #27 | **Merged** @ `69cafae` into `launch-mvp` (Booking & payment architecture, payment readiness & financial safety report, booking integrity test report, 10/10 automated tests in `test/booking-integrity.test.js`) |
 | M4.1 UPI-First Checkout & Dynamic QR | `feature/m4-1-upi-checkout` / #28 | **Merged** @ `c3b4e83` into `launch-mvp` (UPI-First checkout, pure SVG dynamic QR, provider-neutral adapter with PhonePe PG primary, mobile intent links, SHA256 constant-time webhook verification, migration 015, 13/13 automated tests in `test/upi-checkout.test.js`) |
 | M4.2 UPI Security & Readiness Audit | `feature/m4-2-upi-security-audit` / #29 | **Merged** @ `c71ec8d` into `launch-mvp` (Independent audit of M4.1 UPI checkout: identified 2 Critical and 3 High severity defects; verdict: NOT READY FOR LIVE PAYMENTS; `ENABLE_LIVE_PAYMENTS=false` preserved) |
-| M4.3 Critical UPI Security & Financial Integrity Remediation | `feature/m4-3-upi-security-remediation` | **Completed** (Resolved all 9 M4.2 findings: SEC-01 Base64 webhook signature, FIN-01 underpayment defense & dispute audit, DATA-01 auth gate & guest booking claim API, CONCUR-01 active intent capacity holds & confirmation check, AUTH-01 status polling IDOR fix, QR-01 Dark Module & multi-block interleaving fix, UI-01 responsive viewport CSS isolation, LOG-01 dedicated rate limits, DB-01 immutable `payment_audits` trigger via migration 016; 21/21 tests in `test/upi-checkout.test.js` pass, 7/7 in `test/migrations.test.js` pass, full test suite 453/453 pass; `ENABLE_LIVE_PAYMENTS=false` preserved) |
-| M5–M10 | — | not started |
+| M4.3 Critical UPI Security & Financial Integrity Remediation | `feature/m4-3-upi-security-remediation` / #30 | **Completed** (Resolved all 9 M4.2 findings: SEC-01 Base64 webhook signature, FIN-01 underpayment defense & dispute audit, DATA-01 auth gate & guest booking claim API, CONCUR-01 active intent capacity holds & confirmation check, AUTH-01 status polling IDOR fix, QR-01 Dark Module & multi-block interleaving fix, UI-01 responsive viewport CSS isolation, LOG-01 dedicated rate limits, DB-01 immutable `payment_audits` trigger via migration 016; 21/21 tests in `test/upi-checkout.test.js` pass, 7/7 in `test/migrations.test.js` pass, full test suite 453/453 pass; `ENABLE_LIVE_PAYMENTS=false` preserved) |
+| M4.3.1 Review Remediation | `feature/m4-3-1-review-remediation` / #31 | **Completed** (Remediated independent review findings REV-01 through REV-07; 31/31 UPI tests pass, 464/464 unit/integration tests pass, `ENABLE_LIVE_PAYMENTS=false` preserved) |
+| M4.3.2 Financial Integrity Remediation | `feature/m4-3-2-financial-integrity` / #32 | **Completed** (Strict fail-closed merchant identity comparison across verified, stored, and configured identities; secure manual refund reconciliation with verified admin roles and verifiable external references; 33/33 UPI tests pass, 466/466 unit/integration tests pass, `ENABLE_LIVE_PAYMENTS=false` preserved) |
+| M4.3.3 Final Provider Verification Integrity | `feature/m4-3-3-provider-verification` / #33 | **Completed** (Eliminated synthetic currency defaults and configured merchant status check fallbacks; fail-closed currency and merchant identity gating; documented CBS operational limitation and operator attestation labeling; 37/37 UPI tests pass, 470/470 unit/integration tests pass, `ENABLE_LIVE_PAYMENTS=false` preserved) |
+| M4.3.4 Provider Contract Decision & M4 Closure | `feature/m4-3-4-contract-decision` | **Formally Closed (Live Payments Disabled)** (Adopted Outcome B: PhonePe v1 classified sandbox-only due to lack of machine-verifiable currency in payload; full 22-vector regression suite added; 38/38 UPI tests pass, 471/471 unit/integration tests pass, 157/157 Playwright E2E pass, 140/140 lint clean; `ENABLE_LIVE_PAYMENTS=false` preserved; all M4 exit criteria verified and passed) |
+| M5 Zero-Trust Live Payment Provider Integration | `feature/m5-...` | **Recommended Next Milestone** (Integrate zero-trust payment provider supplying explicit ISO currency evidence and signed webhook entities, or release free-only MVP) |
 
 ## 11. Where the detail lives
 
diff --git a/docs/UPI_PROVIDER_READINESS.md b/docs/UPI_PROVIDER_READINESS.md
index b318120..7bd4ff9 100644
--- a/docs/UPI_PROVIDER_READINESS.md
+++ b/docs/UPI_PROVIDER_READINESS.md
@@ -129,3 +129,101 @@ The safety switch remains locked:
 ENABLE_LIVE_PAYMENTS=false
 ```
 Under no circumstances should this flag be set to `true` until all engineering defects in Section 5A are resolved, verified by automated tests, and formal business signoff in Section 5B is granted.
+
+---
+
+## 7. M4.3.4 Final Payment Provider Contract Determination & Safe Integration Decision
+
+### 7.1 Detailed Technical Analysis of PhonePe API v1 Contract
+
+An exhaustive inspection of PhonePe's official API specifications and the concrete adapter implementation (`lib/upi/adapter.js`, `lib/services/upi-payments.js`) established the following technical boundaries:
+
+#### 1. Authenticated Status Request URL vs Missing JSON `merchantId`
+- **Outbound Check Status Request**:
+  - Endpoint: `GET /apis/pg-sandbox/pg/v1/status/{merchantId}/{merchantTransactionId}`
+  - Transport Security: Server-to-server HTTPS (TLS 1.2/1.3) directly to PhonePe.
+  - Caller Authentication: `X-MERCHANT-ID: {merchantId}` and `X-VERIFY: SHA256('/pg/v1/status/' + merchantId + '/' + orderId + saltKey) + '###' + saltIndex`.
+  - PhonePe authenticates the caller using the shared `saltKey` and verifies that the transaction belongs to the path-specified `{merchantId}`. Unmatched requests are rejected with HTTP 401/403 `AUTHORIZATION_FAILED`.
+- **Response Merchant Identity Determination**:
+  - In PhonePe's standard v1 response JSON, `data.merchantId` is documented to echo the merchant identifier.
+  - However, the HTTP GET response body is **plain unsigned JSON**. PhonePe provides no cryptographic response signature or response HMAC header (unlike webhooks, which include `X-VERIFY`).
+  - If a gateway status response omits `data.merchantId` or returns null/empty, relying on the URL path alone would require the client adapter to "assume" or "synthesize" merchant identity.
+  - Under the strict zero-trust financial integrity policy established in M4.3.2 and M4.3.3, identity synthesis is prohibited. If `merchantId` is absent from the provider payload, it remains `null` and fails closed (`missing_verified_merchant_id`), preventing rogue or cross-merchant substitution.
+
+#### 2. Documented Domestic UPI Contract vs Missing Currency Field
+- **The Statutory Contract**:
+  - PhonePe PG v1/v2 operates under the regulatory jurisdiction of the Reserve Bank of India (RBI) and National Payments Corporation of India (NPCI) exclusively for domestic UPI and Indian banking instruments.
+  - The business and regulatory contract is strictly denominated in Indian Rupees (INR) with amounts expressed in integer paise (1 INR = 100 paise).
+  - Multi-currency processing does not exist on PhonePe's domestic UPI Standard Checkout.
+- **The Technical Contract**:
+  - PhonePe's official API schema (status check response and S2S callback payloads) **never includes a `currency` field**.
+  - `data.currency` is strictly `undefined` in authentic PhonePe payloads.
+- **Zero-Trust Invariant Conflict**:
+  - The core verification engine (`applySuccessfulUpiPayment`) strictly requires affirmative evidence that `currency === 'INR'` and matches `payment.currency`.
+  - When the adapter faithfully extracts `data.currency`, it evaluates to `null`.
+  - Without synthetic defaults, every native PhonePe transaction is disputed with `Payment verification failed: Currency mismatch (missing_currency)`.
+  - Injecting a hardcoded default (`currency: 'INR'`) inside the adapter would manufacture evidence that the provider did not supply, violating the project's zero-trust audit guarantees.
+
+#### 3. Cryptographic Authentication: Signed vs Unsigned Fields
+- **S2S Webhook (`POST /api/payments/webhook/phonepe`)**:
+  - Header: `X-VERIFY: SHA256(base64Response + saltKey) + "###" + saltIndex`.
+  - Body: `{ "response": "<base64_string>" }`.
+  - Because `X-VERIFY` is calculated over the entire base64 string, every field inside the decoded `data` object (`merchantId`, `merchantTransactionId`, `transactionId`, `amount`, `state`, `paymentInstrument`) is cryptographically signed and authenticated by PhonePe using the shared merchant secret.
+  - However, `currency` is completely absent from this signed payload.
+- **Status Polling API (`GET /pg/v1/status/...`)**:
+  - The outbound request is authenticated by the merchant; the inbound response is **NOT signed** by PhonePe. Authenticity relies entirely on TLS transport security to the PhonePe host.
+
+#### 4. Distinguishing Authentic from Fabricated or Mismatched Responses
+- The current implementation reliably distinguishes authentic from forged responses:
+  - Webhooks with invalid, tampered, or missing `X-VERIFY` signatures are immediately rejected with `WebhookSignatureError` (HTTP 401).
+  - Webhooks with mismatched or missing `merchantId` are rejected before database writes.
+  - Status queries with mismatched `merchantId`, underpayment/overpayment, or missing currency fail closed and transition the payment to `disputed` with 0 bookings and 0 Telegram invites created.
+  - Database-level immutable audit logging records every verification failure in `payment_audits`.
+
+---
+
+### 7.2 Decision: Safe Integration Approach
+
+Three potential outcomes were evaluated:
+
+- **Outcome A (Rejected)**: *PhonePe safely supported with adapter-level domestic contract assumptions.*
+  - Would require mapping PhonePe's domestic banking contract to synthetic `currency: 'INR'` at the adapter boundary.
+  - **Why Rejected**: Directly contradicts M4.3.3 integrity findings, manufactures provider evidence not present in JSON payloads, weakens the zero-trust verification standard, and violates Non-Negotiable Safeguard #5.
+
+- **Outcome B (ADOPTED)**: *PhonePe cannot currently meet the required verification standard. Keep it sandbox-only and recommend a provider whose documented API supplies the required merchant, amount, order and currency evidence.*
+  - **Verdict**: **FORMALLY ADOPTED**.
+  - **Rationale**:
+    1. PhonePe v1 API cannot supply machine-verifiable currency evidence without client-side assumptions.
+    2. PhonePe status GET responses are not cryptographically signed by the provider.
+    3. Under the fail-closed zero-trust financial integrity architecture, PhonePe payments must remain sandbox/mock only.
+    4. Production live-payment capability for PhonePe is marked **BLOCKED**.
+    5. Milestone M4 can safely close with `ENABLE_LIVE_PAYMENTS=false` preserved across all environments, with zero real financial exposure.
+
+- **Outcome C (Rejected)**: *Wait for additional provider integration or contract confirmation before architecture approval.*
+  - **Why Rejected**: Postpones closure indefinitely without technical merit. The platform's booking integrity, seat allocation, refund controls, and audit ledger are fully built, audited, and tested.
+
+---
+
+### 7.3 Comparative Provider Evaluation: Zero-Trust Readiness
+
+| Capability / Evidence | PhonePe PG v1 | Standard Zero-Trust Gateway Spec | Audit Requirement |
+| :--- | :--- | :--- | :--- |
+| **S2S Webhook Signature** | HMAC SHA256 on base64 | HMAC SHA256 on raw body (`x-signature`) | Cryptographically authenticates sender |
+| **Provider-Signed Status Response** | ❌ None (TLS only) | ✅ Direct Auth Key+Secret over TLS | Proves provider authenticity |
+| **Explicit ISO Currency Field** | ❌ **Omitted** (Implicit INR) | ✅ **Included** (`"INR"` in payload `currency`) | Zero-trust currency invariant verification |
+| **Paise Amount Exact Match** | ✅ Integer paise | ✅ Integer paise (`amount`) | Exact financial match |
+| **Merchant ID in Callback** | ✅ `data.merchantId` | ✅ Account / `account_id` | Three-way identity comparison |
+| **Zero-Trust Live Gate Verdict** | **BLOCKED (Sandbox Only)** | **RECOMMENDED FOR M5** | Meets zero-trust verification |
+
+---
+
+### 7.4 Prerequisites for Production Payment Activation (Owner / Provider Action)
+
+To transition payment processing from `ENABLE_LIVE_PAYMENTS=false` to live production, the following prerequisites must be fulfilled:
+
+1. **Provider Selection & Migration (M5)**:
+   - Either migrate to a zero-trust provider with explicit ISO currency support and signed callbacks, OR
+   - Upgrade to PhonePe's newer PG v2 SDK if/when PhonePe provides official, machine-verifiable currency fields and signed status query endpoints.
+2. **KYB & Commercial Contracting**: Complete merchant onboarding, bank nodal account binding, and production credential issuance.
+3. **Webhook Whitelisting**: Register production webhook endpoints with HTTPS TLS termination.
+4. **₹1 Financial Pilot**: Execute an end-to-end live ₹1 payment and subsequent refund under supervision on a dedicated staging branch before enabling production traffic.
diff --git a/docs/UPI_SECURITY_AUDIT.md b/docs/UPI_SECURITY_AUDIT.md
index 45bc4d0..4aabc38 100644
--- a/docs/UPI_SECURITY_AUDIT.md
+++ b/docs/UPI_SECURITY_AUDIT.md
@@ -399,3 +399,100 @@ Milestone M4.3.3 implements a final zero-trust review and remediation of provide
 - **Migration Suite**: 8/8 passed (`test/migrations.test.js`).
 - **Linter**: `140/140 files OK` (`npm run lint`).
 - **Absolute Safety Boundary**: `ENABLE_LIVE_PAYMENTS=false` preserved across all files and environments. No real payments or refunds initiated. Merges to PR #32, PR #31, PR #30, and PR #17 strictly prohibited. Stopped for independent owner review.
+
+---
+
+## 9. Milestone M4.3.4 Final Payment Provider Contract Determination, Audit & M4 Closure
+
+Milestone M4.3.4 delivers the definitive provider-verification contract determination and closes Milestone M4 with an independently reviewable architectural decision, comprehensive regression tests, full system audit, and formalized exit criteria.
+
+### 9.1 Technical Contract Determination: PhonePe API v1
+
+1. **Merchant Identity Verification**:
+   - The status query `GET /pg/v1/status/{merchantId}/{orderId}` executes over TLS with client authentication (`X-VERIFY: SHA256(path + saltKey)###saltIndex` and `X-MERCHANT-ID`).
+   - While PhonePe authenticates the request, the HTTP response body is **plain unsigned JSON**.
+   - If a provider status response omits `data.merchantId`, relying on the URL path would require client/adapter-side identity synthesis. Under zero-trust rules, omitted fields remain `null` and fail closed (`missing_verified_merchant_id`), preventing rogue or cross-merchant substitution.
+2. **Currency Invariant Determination**:
+   - PhonePe is strictly a domestic Indian payment gateway operating under RBI/NPCI regulations. Amounts are in Indian paise (1 INR = 100 paise).
+   - However, PhonePe's official API schema (both GET status responses and S2S webhook callbacks) **never returns a `currency` field**.
+   - Under the zero-trust verification standard (`applySuccessfulUpiPayment`), payment confirmation strictly requires affirmative provider evidence that `currency === 'INR'`. When the adapter faithfully extracts `data.currency`, it evaluates to `null`, triggering a fail-closed dispute (`missing_currency`).
+   - Synthetic adapter defaults (`currency: 'INR'`) are strictly prohibited because they manufacture provider evidence not returned in the payload.
+3. **Cryptographic Signing Analysis**:
+   - S2S Webhooks are signed via `X-VERIFY: SHA256(base64Response + saltKey)###saltIndex`. Decoded fields (`merchantId`, `amount`, `merchantTransactionId`, `state`) are cryptographically authenticated. Currency is omitted.
+   - Status GET responses are **not signed** by PhonePe.
+4. **Forgery and Mismatch Resistance**:
+   - Webhooks with forged, invalid, or missing signatures are rejected (HTTP 401).
+   - Amount mismatches (underpayment or overpayment), currency mismatches, or merchant mismatches transition payments to `disputed` with 0 bookings and 0 Telegram invites.
+
+---
+
+### 9.2 Safe Integration Approach: Adoption of Outcome B
+
+- **Outcome B (Adopted)**: PhonePe cannot currently meet the required verification standard without synthetic adapter defaults. Keep it sandbox-only, keep live payments blocked (`ENABLE_LIVE_PAYMENTS=false`), close M4 cleanly, and recommend adopting a zero-trust payment provider supplying explicit ISO currency evidence and signed webhook entities for M5 live checkout.
+- **Trade-off Analysis**: Outcome A (manufacturing defaults) weakens zero-trust invariants; Outcome C (indefinite pause) delays milestone closure for external vendor roadmaps. Outcome B guarantees zero financial exposure, absolute audit conformance, and immediate M4 closure readiness.
+
+---
+
+### 9.3 M4.3.4 Regression Test Matrix (`test/upi-checkout.test.js`)
+
+| Test Scenario | Attack / Edge Vector Tested | Expected Result | Actual Result |
+|:---|:---|:---|:---|
+| **Missing Merchant ID (Polling)** | Gateway status response omits `data.merchantId` | Fail-closed, status `disputed`, reason `missing_verified_merchant_id`, 0 bookings | ✅ PASS |
+| **Mismatched Merchant ID (Polling)** | Gateway status returns `ATTACKER_MERCHANT_ID` | Fail-closed, status `disputed`, reason `merchant_mismatch`, 0 bookings | ✅ PASS |
+| **Missing Merchant ID (Webhook)** | Decoded payload omits `merchantId` | Rejects with `WebhookSignatureError`, status remains `pending`, 0 bookings | ✅ PASS |
+| **Mismatched Merchant ID (Webhook)** | Decoded payload contains `ROGUE_MERCHANT` | Rejects with `WebhookSignatureError`, status remains `pending`, 0 bookings | ✅ PASS |
+| **Native PhonePe Missing Currency** | Real native PhonePe payload (no `currency` field) | Fail-closed, status `disputed`, reason `missing_currency`, 0 bookings | ✅ PASS |
+| **Foreign Currency Injection** | Webhook payload contains `currency: 'USD'` | Fail-closed, status `disputed`, reason `currency_mismatch`, 0 bookings | ✅ PASS |
+| **Forged Webhook Signature** | Attacker sends forged `X-VERIFY` hash | Rejects with `WebhookSignatureError`, status remains `pending`, 0 bookings | ✅ PASS |
+| **Missing Webhook Signature Header** | Attacker omits `X-VERIFY` header | Rejects with `WebhookSignatureError` (missing header), 0 bookings | ✅ PASS |
+| **Corrupted Base64 Payload** | Body contains unparseable / malformed string | Rejects with 400 `invalid_payload` / signature error, 0 bookings | ✅ PASS |
+| **Gateway 502 Outage (Polling)** | Status polling receives HTTP 502 / network error | Adapter throws `GATEWAY_ERROR`, polling service logs warning, DB remains `pending` | ✅ PASS |
+| **Underpayment Attack** | Webhook reports 1,000 paise instead of 45,000 paise | Fail-closed, status `disputed`, reason `amount_mismatch`, 0 bookings | ✅ PASS |
+| **Overpayment Attack** | Webhook reports 50,000 paise instead of 45,000 paise | Fail-closed, status `disputed`, reason `amount_mismatch`, 0 bookings | ✅ PASS |
+| **Unknown Order ID** | Webhook reports non-existent order | Rejects with 404 `Payment not found`, 0 bookings | ✅ PASS |
+| **Replayed Webhooks** | Succeeded payment receives identical replayed webhook | Idempotent, returns `duplicate: true`, booking count remains exactly 1 | ✅ PASS |
+| **Duplicate Polling** | Succeeded payment polled with `checkGateway: true` | Idempotent, returns `succeeded`, duplicate status, booking count remains 1 | ✅ PASS |
+| **Client Return URL Spoofing** | Attendee visits return URL with fake success parameters | Render view only, DB status remains `pending`, 0 bookings, 0 invites | ✅ PASS |
+| **Client Polling Endpoint Isolation** | Attendee polls status without `checkGateway` | Reads existing DB status (`pending`), 0 state transitions | ✅ PASS |
+| **Pending State Gating** | Payment in `pending` state | 0 bookings created, 0 Telegram invites created | ✅ PASS |
+| **Failed State Gating** | Gateway reports `PAYMENT_ERROR` (`failed`) | Payment status updates to `failed`, 0 bookings, 0 invites | ✅ PASS |
+| **Disputed State Gating** | Payment verification fails (`disputed`) | Payment status updates to `disputed`, 0 bookings, 0 invites | ✅ PASS |
+| **Refund State & Invite Revocation** | Succeeded payment is refunded | Status `refunded`, booking `refunded`, Telegram invite revoked (`revoked_at IS NOT NULL`) | ✅ PASS |
+| **Comprehensive Gating Verification** | Across all 12 negative/unverified test cases | 0 bookings and 0 Telegram invites in database | ✅ PASS |
+
+---
+
+### 9.4 Final M4 System Audit Summary
+
+1. **Booking Integrity & Concurrency**:
+   - Double booking is blocked at intent creation (409 `already_booked`), confirmation (moves payment to `refund_pending`), and guest claim (409).
+   - SQLSTATE `23505` unique constraint races are defensively caught in `SAVEPOINT sp_confirm_booking`.
+   - Inventory capacity holds are enforced via `activePaymentHolds` and partial index `idx_payments_active_tier_holds`.
+2. **Refund & Reconciliation Controls**:
+   - Both `succeeded` and `refund_pending` payments can be refunded via `refundUpiOrder`.
+   - Provider failures leave payment recoverable in `refund_pending` without rolling back audit history.
+   - Manual finance reconciliation enforces verified database roles (`super_admin`, `finance`), anti-placeholder external reference validation (bank UTR, PG refund ARN), and mandatory evidence tracking.
+   - All manual reconciliations are explicitly tagged `operator_attested: true` and `bankVerified: false`.
+3. **Payment Audit Logs & Ledger Immutability**:
+   - `payment_audits` is strictly append-only; migration 016 database trigger prevents UPDATE and DELETE.
+   - Every status transition, dispute reason, and reconciliation event is immutably logged with actor, timestamp, and details JSON.
+4. **Idempotency & Isolation**:
+   - Replayed webhooks and polling checks return `duplicate: true` with zero duplicate bookings.
+   - Multi-tenant event and attendee boundaries are strictly isolated; cross-organiser inspection is forbidden.
+5. **Payment Provider Configuration & Live Gating**:
+   - Adapter merchant ID configuration is verified across verified, stored, and server identities.
+   - `ENABLE_LIVE_PAYMENTS=false` is enforced across all environments.
+
+---
+
+### 9.5 M4 Exit Criteria Pass/Fail Checklist
+
+- [x] **Booking Integrity**: **PASS** (Zero overselling under concurrency, double-booking prevention, 0 bookings on unverified payments).
+- [x] **Payment Verification Architecture**: **PASS** (Safe integer paise amount check, three-way merchant ID comparison, exact currency check, atomic locked transaction gating).
+- [x] **Provider Contract Evidence**: **PASS (for Architecture & Mock) / BLOCKED (for Live PhonePe)** (PhonePe v1 cannot supply machine-verifiable currency; safely classified as Sandbox-only under Outcome B).
+- [x] **Refund and Reconciliation Controls**: **PASS** (Automated provider refunds, operational recovery from `refund_pending`, authorized manual finance reconciliation with anti-fraud rules and CBS limitation disclosures).
+- [x] **Security Tests**: **PASS** (All 38/38 UPI tests passing, including 22 specific M4.3.4 regression vectors; 471/471 full unit/integration suite passing).
+- [x] **Documentation**: **PASS** (`UPI_PROVIDER_READINESS.md`, `UPI_SECURITY_AUDIT.md`, `PROJECT_STATE.md` fully synchronized and up to date).
+- [x] **Production Payment Activation Prerequisites**: **PASS (DOCUMENTED & GATED)** (`ENABLE_LIVE_PAYMENTS=false` preserved; clear M5 roadmap for zero-trust provider migration).
+
+**Milestone M4 Verdict: FORMALLY CLOSED (Live Payments Safely Disabled).**
diff --git a/lib/upi/adapter.js b/lib/upi/adapter.js
index c05c6b9..7894a63 100644
--- a/lib/upi/adapter.js
+++ b/lib/upi/adapter.js
@@ -53,6 +53,23 @@ export function buildAppIntents(baseUpiUri) {
 
 // ---------------- PhonePe PG Implementation ----------------
 
+/**
+ * PhonePeAdapter: Standard Checkout v1 Integration (Sandbox / Testing Only).
+ *
+ * M4.3.4 Provider Contract Determination (Outcome B):
+ * Official PhonePe Standard Checkout API v1 payloads (status check responses and S2S webhooks)
+ * operate exclusively on Indian domestic UPI rails in paise, but do NOT return machine-verifiable
+ * ISO-4217 currency fields ('currency' is omitted from provider JSON). Furthermore, GET status responses
+ * are not cryptographically signed by PhonePe (relying solely on TLS transport security).
+ *
+ * Under the platform's zero-trust financial integrity policy, synthetic defaults (e.g. hardcoded
+ * 'INR' or configured merchantId fallback) are strictly prohibited. Native PhonePe responses lacking
+ * explicit currency fields fail closed into 'disputed' state with 0 bookings and 0 Telegram invites created.
+ *
+ * Consequently, PhonePe is formally classified as SANDBOX-ONLY / MOCK SUPPORTED.
+ * Live payments capability is BLOCKED (ENABLE_LIVE_PAYMENTS=false) pending migration to a zero-trust
+ * compatible payment provider with signed payloads and explicit ISO currency codes, or an upgraded PG SDK.
+ */
 export class PhonePeAdapter {
   constructor(options = {}) {
     this.merchantId = options.merchantId !== undefined
diff --git a/test/upi-checkout.test.js b/test/upi-checkout.test.js
index 43b455d..2762876 100644
--- a/test/upi-checkout.test.js
+++ b/test/upi-checkout.test.js
@@ -2611,3 +2611,531 @@ test('M4.3.3: Provider status authenticity, client return URL isolation and idem
   const failInvites = await db.one('SELECT count(*)::int AS n FROM invite_links WHERE user_id = $1', [guest2.userId]);
   assert.equal(failInvites.n, 0);
 });
+
+test('M4.3.4: Final provider verification contract decision & regression suite', async () => {
+  const saltKey = '099eb0cd-0252-4e2a-8aca-eb3c6bd470f1';
+  const adapter = new PhonePeAdapter({ merchantId: 'PGTESTPAYUAT', saltKey, saltIndex: '1' });
+  const { event, tier } = await createPaidEvent({ price: 45000 });
+
+  // -------------------------------------------------------------
+  // 1. Missing and mismatched merchant identity
+  // -------------------------------------------------------------
+  // 1a. Status polling with missing merchantId -> disputed (missing_verified_merchant_id)
+  const itPollMissingMerch = await createUpiPaymentIntent({ slug: event.slug, user: guest1, ticketTypeId: tier.id });
+  stubUrl('https://api-preprod.phonepe.com', (url) => {
+    if (url.includes(`/pg/v1/status/PGTESTPAYUAT/${itPollMissingMerch.orderId}`)) {
+      return {
+        status: 200,
+        body: JSON.stringify({
+          success: true,
+          code: 'PAYMENT_SUCCESS',
+          data: {
+            // merchantId omitted
+            merchantTransactionId: itPollMissingMerch.orderId,
+            transactionId: `TXN-P-NOMERCH-${itPollMissingMerch.orderId}`,
+            amount: 45000,
+            currency: 'INR',
+            state: 'COMPLETED'
+          }
+        })
+      };
+    }
+    return { status: 200, body: JSON.stringify({ success: true, code: 'PAYMENT_SUCCESS' }) };
+  });
+
+  const pollNoMerch = await getUpiPaymentStatus(itPollMissingMerch.orderId, { user: guest1, checkGateway: true });
+  assert.equal(pollNoMerch.status, 'disputed');
+  assert.equal(pollNoMerch.disputeReason, 'missing_verified_merchant_id');
+
+  const payNoMerchDb = await db.one('SELECT status, booking_id FROM payments WHERE order_id = $1', [itPollMissingMerch.orderId]);
+  assert.equal(payNoMerchDb.status, 'disputed');
+  assert.equal(payNoMerchDb.booking_id, null);
+
+  // 1b. Status polling with mismatched merchantId -> disputed (merchant_mismatch)
+  const itPollWrongMerch = await createUpiPaymentIntent({ slug: event.slug, user: guest1, ticketTypeId: tier.id });
+  stubUrl('https://api-preprod.phonepe.com', (url) => {
+    if (url.includes(`/pg/v1/status/PGTESTPAYUAT/${itPollWrongMerch.orderId}`)) {
+      return {
+        status: 200,
+        body: JSON.stringify({
+          success: true,
+          code: 'PAYMENT_SUCCESS',
+          data: {
+            merchantId: 'ATTACKER_MERCHANT_ID',
+            merchantTransactionId: itPollWrongMerch.orderId,
+            transactionId: `TXN-P-WRONGMERCH-${itPollWrongMerch.orderId}`,
+            amount: 45000,
+            currency: 'INR',
+            state: 'COMPLETED'
+          }
+        })
+      };
+    }
+    return { status: 200, body: JSON.stringify({ success: true, code: 'PAYMENT_SUCCESS' }) };
+  });
+
+  const pollWrongMerch = await getUpiPaymentStatus(itPollWrongMerch.orderId, { user: guest1, checkGateway: true });
+  assert.equal(pollWrongMerch.status, 'disputed');
+  assert.equal(pollWrongMerch.disputeReason, 'merchant_mismatch');
+
+  const payWrongMerchDb = await db.one('SELECT status, booking_id FROM payments WHERE order_id = $1', [itPollWrongMerch.orderId]);
+  assert.equal(payWrongMerchDb.status, 'disputed');
+  assert.equal(payWrongMerchDb.booking_id, null);
+
+  // 1c. Webhook with missing merchantId -> fails signature verification
+  const itHookMissingMerch = await createUpiPaymentIntent({ slug: event.slug, user: guest1, ticketTypeId: tier.id });
+  const pNoMerch = {
+    code: 'PAYMENT_SUCCESS',
+    data: {
+      // merchantId omitted
+      merchantTransactionId: itHookMissingMerch.orderId,
+      transactionId: `TXN-H-NOMERCH-${itHookMissingMerch.orderId}`,
+      amount: 45000,
+      currency: 'INR',
+      state: 'COMPLETED'
+    }
+  };
+  const b64NoMerch = Buffer.from(JSON.stringify(pNoMerch)).toString('base64');
+  const sigNoMerch = crypto.createHash('sha256').update(`${b64NoMerch}${saltKey}`).digest('hex') + '###1';
+  await assert.rejects(
+    () => processUpiWebhook({
+      headers: { 'x-verify': sigNoMerch },
+      rawBody: JSON.stringify({ response: b64NoMerch }),
+      clientIp: '127.0.0.1'
+    }),
+    /merchantId is missing/i
+  );
+  const payHookNoMerchDb = await db.one('SELECT status, booking_id FROM payments WHERE order_id = $1', [itHookMissingMerch.orderId]);
+  assert.equal(payHookNoMerchDb.status, 'pending');
+  assert.equal(payHookNoMerchDb.booking_id, null);
+
+  // 1d. Webhook with mismatched merchantId -> fails signature verification
+  const itHookWrongMerch = await createUpiPaymentIntent({ slug: event.slug, user: guest1, ticketTypeId: tier.id });
+  const pWrongMerch = {
+    code: 'PAYMENT_SUCCESS',
+    data: {
+      merchantId: 'ROGUE_MERCHANT',
+      merchantTransactionId: itHookWrongMerch.orderId,
+      transactionId: `TXN-H-WRONGMERCH-${itHookWrongMerch.orderId}`,
+      amount: 45000,
+      currency: 'INR',
+      state: 'COMPLETED'
+    }
+  };
+  const b64WrongMerch = Buffer.from(JSON.stringify(pWrongMerch)).toString('base64');
+  const sigWrongMerch = crypto.createHash('sha256').update(`${b64WrongMerch}${saltKey}`).digest('hex') + '###1';
+  await assert.rejects(
+    () => processUpiWebhook({
+      headers: { 'x-verify': sigWrongMerch },
+      rawBody: JSON.stringify({ response: b64WrongMerch }),
+      clientIp: '127.0.0.1'
+    }),
+    /merchantId mismatch/i
+  );
+  const payHookWrongMerchDb = await db.one('SELECT status, booking_id FROM payments WHERE order_id = $1', [itHookWrongMerch.orderId]);
+  assert.equal(payHookWrongMerchDb.status, 'pending');
+  assert.equal(payHookWrongMerchDb.booking_id, null);
+
+  // -------------------------------------------------------------
+  // 2. Missing currency and documented domestic INR invariant
+  // -------------------------------------------------------------
+  // 2a. Real native PhonePe payload (currency field completely omitted) -> fail closed, disputed (missing_currency)
+  const itPhonePeNative = await createUpiPaymentIntent({ slug: event.slug, user: guest1, ticketTypeId: tier.id });
+  const pNativePhonePe = {
+    code: 'PAYMENT_SUCCESS',
+    data: {
+      merchantId: 'PGTESTPAYUAT',
+      merchantTransactionId: itPhonePeNative.orderId,
+      transactionId: `TXN-PHONEPE-NATIVE-${itPhonePeNative.orderId}`,
+      amount: 45000,
+      state: 'COMPLETED'
+      // NOTE: native PhonePe API v1 never supplies currency field
+    }
+  };
+  const b64Native = Buffer.from(JSON.stringify(pNativePhonePe)).toString('base64');
+  const sigNative = crypto.createHash('sha256').update(`${b64Native}${saltKey}`).digest('hex') + '###1';
+  const resNative = await processUpiWebhook({
+    headers: { 'x-verify': sigNative },
+    rawBody: JSON.stringify({ response: b64Native }),
+    clientIp: '127.0.0.1'
+  });
+  assert.equal(resNative.ok, false);
+  assert.equal(resNative.error, 'missing_currency');
+  const payNativeDb = await db.one('SELECT status, failure_reason, booking_id FROM payments WHERE order_id = $1', [itPhonePeNative.orderId]);
+  assert.equal(payNativeDb.status, 'disputed');
+  assert.ok(payNativeDb.failure_reason.includes('Currency mismatch (missing_currency)'));
+  assert.equal(payNativeDb.booking_id, null);
+
+  // 2b. Foreign currency (USD) -> disputed (currency_mismatch)
+  const itForeignCurr = await createUpiPaymentIntent({ slug: event.slug, user: guest1, ticketTypeId: tier.id });
+  const pForeignCurr = {
+    code: 'PAYMENT_SUCCESS',
+    data: {
+      merchantId: 'PGTESTPAYUAT',
+      merchantTransactionId: itForeignCurr.orderId,
+      transactionId: `TXN-USD-${itForeignCurr.orderId}`,
+      amount: 45000,
+      currency: 'USD',
+      state: 'COMPLETED'
+    }
+  };
+  const b64Foreign = Buffer.from(JSON.stringify(pForeignCurr)).toString('base64');
+  const sigForeign = crypto.createHash('sha256').update(`${b64Foreign}${saltKey}`).digest('hex') + '###1';
+  const resForeign = await processUpiWebhook({
+    headers: { 'x-verify': sigForeign },
+    rawBody: JSON.stringify({ response: b64Foreign }),
+    clientIp: '127.0.0.1'
+  });
+  assert.equal(resForeign.ok, false);
+  assert.equal(resForeign.error, 'currency_mismatch');
+  const payForeignDb = await db.one('SELECT status, failure_reason, booking_id FROM payments WHERE order_id = $1', [itForeignCurr.orderId]);
+  assert.equal(payForeignDb.status, 'disputed');
+  assert.ok(payForeignDb.failure_reason.includes('Currency mismatch (currency_mismatch)'));
+  assert.equal(payForeignDb.booking_id, null);
+
+  // -------------------------------------------------------------
+  // 3. Forged or unauthenticated provider responses
+  // -------------------------------------------------------------
+  // 3a. Forged webhook signature
+  const itForgedSig = await createUpiPaymentIntent({ slug: event.slug, user: guest1, ticketTypeId: tier.id });
+  const pForgedSig = {
+    code: 'PAYMENT_SUCCESS',
+    data: {
+      merchantId: 'PGTESTPAYUAT',
+      merchantTransactionId: itForgedSig.orderId,
+      transactionId: `TXN-FORGED-${itForgedSig.orderId}`,
+      amount: 45000,
+      currency: 'INR',
+      state: 'COMPLETED'
+    }
+  };
+  const b64Forged = Buffer.from(JSON.stringify(pForgedSig)).toString('base64');
+  await assert.rejects(
+    () => processUpiWebhook({
+      headers: { 'x-verify': '0000000000000000000000000000000000000000000000000000000000000000###1' },
+      rawBody: JSON.stringify({ response: b64Forged }),
+      clientIp: '127.0.0.1'
+    }),
+    /signature/i
+  );
+  const payForgedSigDb = await db.one('SELECT status, booking_id FROM payments WHERE order_id = $1', [itForgedSig.orderId]);
+  assert.equal(payForgedSigDb.status, 'pending');
+  assert.equal(payForgedSigDb.booking_id, null);
+
+  // 3b. Missing signature header
+  await assert.rejects(
+    () => processUpiWebhook({
+      headers: {},
+      rawBody: JSON.stringify({ response: b64Forged }),
+      clientIp: '127.0.0.1'
+    }),
+    /missing header/i
+  );
+
+  // 3c. Corrupted/unparseable base64 body
+  await assert.rejects(
+    () => processUpiWebhook({
+      headers: { 'x-verify': 'fake###1' },
+      rawBody: JSON.stringify({ response: 'NOT_VALID_BASE64_JSON_!@#' }),
+      clientIp: '127.0.0.1'
+    }),
+    /signature/i
+  );
+
+  // 3d. Status polling gateway error (HTTP 502 / network failure) leaves DB status pending
+  const itGatewayErr = await createUpiPaymentIntent({ slug: event.slug, user: guest1, ticketTypeId: tier.id });
+  stubUrl('https://api-preprod.phonepe.com', (url) => {
+    if (url.includes(`/pg/v1/status/PGTESTPAYUAT/${itGatewayErr.orderId}`)) {
+      return { status: 502, body: 'Bad Gateway' };
+    }
+    return { status: 200, body: '{}' };
+  });
+
+  // Direct adapter call throws PaymentAdapterError
+  await assert.rejects(
+    () => adapter.getPaymentStatus(itGatewayErr.orderId),
+    /PhonePe status check failed with HTTP 502/i
+  );
+
+  // Status service endpoint gracefully catches gateway failure, does NOT crash, and leaves DB pending
+  const pollGatewayErr = await getUpiPaymentStatus(itGatewayErr.orderId, { user: guest1, checkGateway: true });
+  assert.equal(pollGatewayErr.status, 'pending');
+
+  const payGatewayErrDb = await db.one('SELECT status, booking_id FROM payments WHERE order_id = $1', [itGatewayErr.orderId]);
+  assert.equal(payGatewayErrDb.status, 'pending');
+  assert.equal(payGatewayErrDb.booking_id, null);
+
+  // -------------------------------------------------------------
+  // 4. Wrong amount and order ID
+  // -------------------------------------------------------------
+  // 4a. Underpayment attack (paid 1000 paise instead of 45000 paise)
+  const itUnderpaid = await createUpiPaymentIntent({ slug: event.slug, user: guest1, ticketTypeId: tier.id });
+  const pUnderpaid = {
+    code: 'PAYMENT_SUCCESS',
+    data: {
+      merchantId: 'PGTESTPAYUAT',
+      merchantTransactionId: itUnderpaid.orderId,
+      transactionId: `TXN-UNDER-${itUnderpaid.orderId}`,
+      amount: 1000,
+      currency: 'INR',
+      state: 'COMPLETED'
+    }
+  };
+  const b64Under = Buffer.from(JSON.stringify(pUnderpaid)).toString('base64');
+  const sigUnder = crypto.createHash('sha256').update(`${b64Under}${saltKey}`).digest('hex') + '###1';
+  const resUnder = await processUpiWebhook({
+    headers: { 'x-verify': sigUnder },
+    rawBody: JSON.stringify({ response: b64Under }),
+    clientIp: '127.0.0.1'
+  });
+  assert.equal(resUnder.ok, false);
+  assert.equal(resUnder.error, 'amount_mismatch');
+  const payUnderDb = await db.one('SELECT status, failure_reason, booking_id FROM payments WHERE order_id = $1', [itUnderpaid.orderId]);
+  assert.equal(payUnderDb.status, 'disputed');
+  assert.ok(payUnderDb.failure_reason.includes('Amount mismatch'));
+  assert.equal(payUnderDb.booking_id, null);
+
+  // 4b. Overpayment attack (paid 50000 paise instead of 45000 paise)
+  const itOverpaid = await createUpiPaymentIntent({ slug: event.slug, user: guest1, ticketTypeId: tier.id });
+  const pOverpaid = {
+    code: 'PAYMENT_SUCCESS',
+    data: {
+      merchantId: 'PGTESTPAYUAT',
+      merchantTransactionId: itOverpaid.orderId,
+      transactionId: `TXN-OVER-${itOverpaid.orderId}`,
+      amount: 50000,
+      currency: 'INR',
+      state: 'COMPLETED'
+    }
+  };
+  const b64Over = Buffer.from(JSON.stringify(pOverpaid)).toString('base64');
+  const sigOver = crypto.createHash('sha256').update(`${b64Over}${saltKey}`).digest('hex') + '###1';
+  const resOver = await processUpiWebhook({
+    headers: { 'x-verify': sigOver },
+    rawBody: JSON.stringify({ response: b64Over }),
+    clientIp: '127.0.0.1'
+  });
+  assert.equal(resOver.ok, false);
+  assert.equal(resOver.error, 'amount_mismatch');
+  const payOverDb = await db.one('SELECT status, failure_reason, booking_id FROM payments WHERE order_id = $1', [itOverpaid.orderId]);
+  assert.equal(payOverDb.status, 'disputed');
+  assert.equal(payOverDb.booking_id, null);
+
+  // 4c. Unknown order ID
+  const pUnknownOrder = {
+    code: 'PAYMENT_SUCCESS',
+    data: {
+      merchantId: 'PGTESTPAYUAT',
+      merchantTransactionId: 'ORD-UNKNOWN-DOES-NOT-EXIST-999',
+      transactionId: 'TXN-UNK-1',
+      amount: 45000,
+      currency: 'INR',
+      state: 'COMPLETED'
+    }
+  };
+  const b64Unknown = Buffer.from(JSON.stringify(pUnknownOrder)).toString('base64');
+  const sigUnknown = crypto.createHash('sha256').update(`${b64Unknown}${saltKey}`).digest('hex') + '###1';
+  await assert.rejects(
+    () => processUpiWebhook({
+      headers: { 'x-verify': sigUnknown },
+      rawBody: JSON.stringify({ response: b64Unknown }),
+      clientIp: '127.0.0.1'
+    }),
+    /payment not found/i
+  );
+
+  // -------------------------------------------------------------
+  // 5. Replayed webhooks and duplicate polling
+  // -------------------------------------------------------------
+  const itIdempotent = await createUpiPaymentIntent({ slug: event.slug, user: guest1, ticketTypeId: tier.id });
+  const pValid = {
+    code: 'PAYMENT_SUCCESS',
+    data: {
+      merchantId: 'PGTESTPAYUAT',
+      merchantTransactionId: itIdempotent.orderId,
+      transactionId: `TXN-VALID-${itIdempotent.orderId}`,
+      amount: 45000,
+      currency: 'INR',
+      state: 'COMPLETED',
+      paymentInstrument: { type: 'UPI', utr: 'UTR-IDEMP-45000' }
+    }
+  };
+  const b64Valid = Buffer.from(JSON.stringify(pValid)).toString('base64');
+  const sigValid = crypto.createHash('sha256').update(`${b64Valid}${saltKey}`).digest('hex') + '###1';
+
+  // First delivery: confirms payment, creates 1 booking
+  const hookFirst = await processUpiWebhook({
+    headers: { 'x-verify': sigValid },
+    rawBody: JSON.stringify({ response: b64Valid }),
+    clientIp: '127.0.0.1'
+  });
+  assert.equal(hookFirst.ok, true);
+  assert.equal(hookFirst.result, 'confirmed');
+
+  const payConfirmed = await db.one('SELECT status, booking_id FROM payments WHERE order_id = $1', [itIdempotent.orderId]);
+  assert.equal(payConfirmed.status, 'succeeded');
+  assert.ok(payConfirmed.booking_id);
+
+  // Attach an active invite link to the confirmed booking
+  const invite1 = await db.one(
+    `INSERT INTO invite_links (booking_id, user_id, chat_id, link, expires_at)
+     VALUES ($1, $2, -1001111111111, 'https://t.me/+testidemp', now() + interval '1 day') RETURNING *`,
+    [payConfirmed.booking_id, guest1.userId]
+  );
+
+  const bookingsCount1 = await db.one('SELECT count(*)::int AS n FROM bookings WHERE id = $1', [payConfirmed.booking_id]);
+  const inviteCount1 = await db.one('SELECT count(*)::int AS n FROM invite_links WHERE booking_id = $1', [payConfirmed.booking_id]);
+
+  // Second delivery (replay): returns duplicate: true, 0 new bookings, 0 new invites
+  const hookReplay = await processUpiWebhook({
+    headers: { 'x-verify': sigValid },
+    rawBody: JSON.stringify({ response: b64Valid }),
+    clientIp: '127.0.0.1'
+  });
+  assert.equal(hookReplay.ok, true);
+  assert.equal(hookReplay.result, 'duplicate');
+
+  const bookingsCountAfterReplay = await db.one('SELECT count(*)::int AS n FROM bookings WHERE id = $1', [payConfirmed.booking_id]);
+  const inviteCountAfterReplay = await db.one('SELECT count(*)::int AS n FROM invite_links WHERE booking_id = $1', [payConfirmed.booking_id]);
+  assert.equal(bookingsCountAfterReplay.n, bookingsCount1.n);
+  assert.equal(inviteCountAfterReplay.n, inviteCount1.n);
+
+  // Status polling on succeeded payment: returns succeeded, duplicate: true
+  stubUrl('https://api-preprod.phonepe.com', (url) => {
+    return {
+      status: 200,
+      body: JSON.stringify({
+        success: true,
+        code: 'PAYMENT_SUCCESS',
+        data: pValid.data
+      })
+    };
+  });
+  const pollAfterSuccess = await getUpiPaymentStatus(itIdempotent.orderId, { user: guest1, checkGateway: true });
+  assert.equal(pollAfterSuccess.status, 'succeeded');
+  assert.equal(pollAfterSuccess.bookingId, payConfirmed.booking_id);
+
+  // -------------------------------------------------------------
+  // 6. Client return URL spoofing
+  // -------------------------------------------------------------
+  const itSpoof = await createUpiPaymentIntent({ slug: event.slug, user: guest2, ticketTypeId: tier.id });
+
+  // Malicious attendee browses return URL with injected success query parameters
+  const clientSpoofGet = await guest2.get(
+    `/checkout/${event.slug}/upi?orderId=${itSpoof.orderId}&status=succeeded&amount=45000&verified=true&paid=1`
+  );
+  assert.equal(clientSpoofGet.status, 200);
+
+  // Database status is completely unaffected (remains pending)
+  const paySpoofedDb = await db.one('SELECT status, booking_id FROM payments WHERE order_id = $1', [itSpoof.orderId]);
+  assert.equal(paySpoofedDb.status, 'pending');
+  assert.equal(paySpoofedDb.booking_id, null);
+
+  // Client polling without checkGateway does not transition state
+  const clientPollStatus = await guest2.get(`/api/checkout/upi/status/${itSpoof.orderId}`);
+  assert.equal(clientPollStatus.status, 200);
+  assert.equal(clientPollStatus.json.status, 'pending');
+  assert.equal(clientPollStatus.json.bookingId, null);
+
+  // -------------------------------------------------------------
+  // 7. Pending, failed, disputed and refunded states
+  // -------------------------------------------------------------
+  // Pending state: 0 bookings, 0 invites
+  const bookingsPending = await db.one('SELECT count(*)::int AS n FROM bookings WHERE payment_id = (SELECT id FROM payments WHERE order_id = $1)', [itSpoof.orderId]);
+  assert.equal(bookingsPending.n, 0);
+
+  // Failed state: gateway reports failure -> status transitions to failed, 0 bookings, 0 invites
+  const itFailed = await createUpiPaymentIntent({ slug: event.slug, user: guest2, ticketTypeId: tier.id });
+  const pFailed = {
+    code: 'PAYMENT_ERROR',
+    data: {
+      merchantId: 'PGTESTPAYUAT',
+      merchantTransactionId: itFailed.orderId,
+      transactionId: `TXN-FAILED-${itFailed.orderId}`,
+      amount: 45000,
+      currency: 'INR',
+      state: 'FAILED'
+    }
+  };
+  const b64Failed = Buffer.from(JSON.stringify(pFailed)).toString('base64');
+  const sigFailed = crypto.createHash('sha256').update(`${b64Failed}${saltKey}`).digest('hex') + '###1';
+  await processUpiWebhook({
+    headers: { 'x-verify': sigFailed },
+    rawBody: JSON.stringify({ response: b64Failed }),
+    clientIp: '127.0.0.1'
+  });
+  const payFailedDb = await db.one('SELECT status, booking_id FROM payments WHERE order_id = $1', [itFailed.orderId]);
+  assert.equal(payFailedDb.status, 'failed');
+  assert.equal(payFailedDb.booking_id, null);
+  const bookingsFailed = await db.one('SELECT count(*)::int AS n FROM bookings WHERE payment_id = (SELECT id FROM payments WHERE order_id = $1)', [itFailed.orderId]);
+  assert.equal(bookingsFailed.n, 0);
+
+  // Disputed state: underpayment -> status transitions to disputed, 0 bookings, 0 invites
+  const bookingsDisputed = await db.one('SELECT count(*)::int AS n FROM bookings WHERE payment_id = (SELECT id FROM payments WHERE order_id = $1)', [itUnderpaid.orderId]);
+  assert.equal(bookingsDisputed.n, 0);
+
+  // Refunded state: refunding itIdempotent (which was succeeded) revokes invite links and cancels booking
+  stubUrl('https://api-preprod.phonepe.com', (url) => {
+    if (url.includes('/pg/v1/refund')) {
+      return {
+        status: 200,
+        body: JSON.stringify({
+          success: true,
+          code: 'PAYMENT_SUCCESS',
+          data: {
+            merchantId: 'PGTESTPAYUAT',
+            merchantTransactionId: `RFND-${itIdempotent.orderId}`,
+            transactionId: `TXN-RFND-${itIdempotent.orderId}`,
+            amount: 45000,
+            state: 'COMPLETED'
+          }
+        })
+      };
+    }
+    return { status: 200, body: '{}' };
+  });
+
+  const refundRes = await refundUpiOrder(itIdempotent.orderId, {
+    actor: 'admin:finance_user',
+    reason: 'Customer requested refund via regression test'
+  });
+  assert.equal(refundRes.status, 'refunded');
+
+  const payRefundedDb = await db.one('SELECT status, refund_ref FROM payments WHERE order_id = $1', [itIdempotent.orderId]);
+  assert.equal(payRefundedDb.status, 'refunded');
+  assert.ok(payRefundedDb.refund_ref);
+
+  const bookingRefunded = await db.one('SELECT status FROM bookings WHERE id = $1', [payConfirmed.booking_id]);
+  assert.equal(bookingRefunded.status, 'refunded');
+
+  const inviteCheck = await db.one('SELECT revoked_at FROM invite_links WHERE id = $1', [invite1.id]);
+  assert.ok(inviteCheck.revoked_at !== null, 'Telegram invite link must be revoked upon refund');
+
+  // -------------------------------------------------------------
+  // 8. Strict gating: No booking confirmation or Telegram invite without authoritative payment verification
+  // -------------------------------------------------------------
+  const allUnverifiedOrders = [
+    itPollMissingMerch.orderId,
+    itPollWrongMerch.orderId,
+    itHookMissingMerch.orderId,
+    itHookWrongMerch.orderId,
+    itPhonePeNative.orderId,
+    itForeignCurr.orderId,
+    itForgedSig.orderId,
+    itGatewayErr.orderId,
+    itUnderpaid.orderId,
+    itOverpaid.orderId,
+    itSpoof.orderId,
+    itFailed.orderId
+  ];
+
+  for (const ord of allUnverifiedOrders) {
+    const bRow = await db.one('SELECT count(*)::int AS n FROM bookings WHERE payment_id = (SELECT id FROM payments WHERE order_id = $1)', [ord]);
+    assert.equal(bRow.n, 0, `Unverified order ${ord} must have 0 bookings`);
+    const invRow = await db.one(
+      'SELECT count(*)::int AS n FROM invite_links WHERE booking_id IN (SELECT id FROM bookings WHERE payment_id = (SELECT id FROM payments WHERE order_id = $1))',
+      [ord]
+    );
+    assert.equal(invRow.n, 0, `Unverified order ${ord} must have 0 invite links`);
+  }
+});