backend phase 10

dev/shared-working-context/backend/STATUS.md

@@ -12,6 +12,24 @@ One block per completed backend phase. Newest at the top. Backend lane writes he
 - **Notes for frontend:** <anything load-bearing>
 -->
 
+## backend-phase-10 — Payments core: ledger, transactions, webhooks & card capture — 2026-07-06
+- **Shipped:** the money core via one migration in a new **`payments`** schema — **4 tables** `PaymentGateways`
+  (encrypted `config_json`) / `PaymentTransactions` (the **two filtered uniques** — `gateway_reference_code` WHERE
+  NOT NULL, `booking_id` WHERE status='succeeded') / `PaymentWebhookEvents` (**UNIQUE(provider_code,
+  external_event_id)**) / **append-only** `LedgerEntries`. Features `InitiatePayment`, `HandlePaymentWebhook`,
+  `ConfirmPaymentAndPostLedger` (internal), `GetNursePayableBalance`; controllers
+  `POST bookings/{id}/payments`, public `POST webhooks/payments/{provider}`, `GET nurses/{id}/payable_balance`.
+  Extracted **`BookingFactory`** so b10's real capture reuses b9's conversion (b9 unchanged).
+- **Contracts:** `dev/contracts/domains/payments.md` written; **openapi snapshot refreshed**
+  (`dev/contracts/openapi/swagger.v1.json` — the three b10 paths + DTOs present).
+- **Mocked:** `IPaymentProvider`, `ISettlementSplitProvider`, `IWebhookVerifier`, `IDistributedLock` → 🟡
+  (see reports/mocks-registry.md). `IPaymentCaptureSimulator` (b9) retained for b9's Convert path/tests.
+- **Gate:** build clean (0 new warnings) / tests green (Foundation 198, Identity 4, Api 83; +12 Foundation +4 Api new).
+- **Handoff:** backend/handoff/after-backend-phase-10.md
+- **Notes for frontend:** money is an **IRR digit-string**; a booking exists only **on capture** (pay against the
+  accepted **request** id; the booking appears `confirmed` after the webhook); **never expose internal
+  `account_type`s** (checkout = gross + commission/VAT); payment idempotent end-to-end (`Idempotency-Key` header).
+
 ## backend-phase-9 — Bookings, sessions, care instructions & EVV — 2026-07-06
 - **Shipped:** the post-payment engine via one additive migration in the **`booking`** schema — **5 tables**
   `Bookings` / `BookingSessions` / `BookingCareInstructions` / `VisitVerifications` / `CancellationPolicies`