[PAY-E2E-08] Complete the deterministic MPP Tempo session lifecycle

[ponderingdemocritus]

Parent

Follow-up E2E verification work for #1688.

What to build

Prove a Tempo session as a complete deterministic channel lifecycle on a Tempo-capable local chain: open and fund the channel, authorize metered invoke and SSE work with vouchers, top up while active, settle accumulated value, close or cancel cleanly, and recover safely across process and replica boundaries.

Acceptance criteria

• Work test-first: introduce a failing state-transition or recovery scenario before implementing support for each lifecycle branch.
• Required PR tests open and fund a channel on an isolated Tempo-capable chain, bind it to the issued MPP challenge, and execute a paid invoke with a valid voucher.
• A paid SSE request meters the complete stream according to the declared policy and settles the authoritative amount even when delivery is interrupted.
• Multiple requests advance voucher value monotonically; receipt data, channel state, chain balances, and payment accounting remain reconcilable.
• An active session can be topped up and continue serving requests without opening a replacement channel.
• Scheduled or threshold settlement, explicit close, cancellation, expiry, and refund paths reach the expected terminal state and balances.
• Insufficient funds, stale/decreasing vouchers, invalid signatures, wrong channel/session binding, replay, and concurrent duplicate requests are rejected without double consumption.
• Handler failure, stream cancellation, settlement failure, and ambiguous response retry have explicit tested behavior and cannot create duplicate settlement.
• SQLite and Postgres stores pass the same restart and multi-replica behavioral contract, including leases, pending settlement, receipt recovery, and terminal-state idempotency.
• The suite is deterministic under repetition, runs in required PR CI without public RPCs or secrets, and emits redacted diagnostic state on failure.
• Documentation explains the channel lifecycle, durability requirements, metering semantics, deterministic command, and operational recovery procedure.

Blocked by

• [PAY-E2E-01] Establish the dual-lane payment E2E runner #1690
• MPP-06: Ship durable Tempo sessions for invoke #1686
• MPP-07: Add Tempo session metering to SSE #1687

[ponderingdemocritus]

Blocked by the pinned MPP cohort, not by Lucid server/store logic. This repo pins mppx 0.8.13 + viem 2.55.2; a real T5 open emitted type 0x76 with nonceKey=0 and no validity window, then reverted before ChannelOpened. Upstream fixed this exact session-management defect in mppx 0.8.14 (commit a3a0d82623db2630ecec890d67ea1e4fa5eeed01) by using expiring nonces. T5 Anvil also failed PrecompileOOG at its 771,000 gas estimate, while Foundry’s successful fixture uses 10,000,000. Keep this issue open with prerequisites: adopt/verify mppx >=0.8.14 and pin a known-good ghcr.io/tempoxyz/tempo image digest, then add the public invoke/SSE chain lifecycle. Existing deterministic tests cover logic only and do not claim chain E2E.