# MVP-JRN-004 — Checkout failure safety

The operator builds a commercial order. A definitive failure or uncertain provider result creates no
false sales, makes no silent paid/unpaid assumption, initiates no blind duplicate charge, and leaves
the operator with visible recoverable behavior while unrelated queued orders remain intact.

Detailed contracts are [MVP-PAY-001](../stories/MVP-PAY-001.md),
[MVP-REL-001](../stories/MVP-REL-001.md), and [MVP-TECH-001](../stories/MVP-TECH-001.md).

Expected evidence: Playwright for visible recovery and integration tests for idempotency/outcome
state. Fake modes keep every failure class deterministic; Surfboard Demo adapter tests separately
prove conservative mapping of provider responses, transport uncertainty, and reconciliation data.