Four rails, one order, exactly-once.

A Package is a versionable template — keys, stars_price (whole Stars, the canonical face), discount_pct, three nullable per-rail minor-unit overrides, enabled, sort. Editing it touches later orders only, because create_order/3 pins the money on the ORD at creation: the key count, the gross price_minor, and — for a non-Stars rail — the rate snapshot (rate_minor / rate_pair / rate_source / rate_quoted_at), read once from the key_shop_rates config. The order lands in created, and no keys are minted. The pricing itself is a pure function — no Repo, no clock, no HTTP:

def price_minor(package, "stars", _rates) do
  case Map.get(package, :stars_price) do
    p when is_integer(p) and p > 0 -> {:ok, p}                # the canonical face, verbatim
    _ -> {:error, :no_price}
  end
end

def price_minor(package, rail, rates) when rail in ~w(ton usdt rub) do
  case override(package, rail) do
    p when is_integer(p) and p > 0 ->
      {:ok, p}                                             # a pinned per-rail override wins

    _ ->
      with rate when is_integer(rate) and rate > 0 <- Map.get(rates, rail, :no_rate) do
        # minor = usd_face_cents × (rail minor units per USD cent), integer-exact, floored.
        {:ok, usd_face_cents(package, rates) * rate}
      else
        _ -> {:error, :no_rate}
      end
  end
end

def price_minor(_package, _rail, _rates), do: {:error, :bad_rail}

The client supplies only {package_id, rail} — the buy_keys route derives the key count and the price server-side, so a tampered client cannot name its own price (the keyshop story: create_order mints no keys; the client mint path is gone). The order statuses are the closed set created → paid → failed/refunded, checked at the changeset and again by the database. The seeded launch catalog is seven bundles, enabled and sorted — editable without a deploy.

The full provider receipt is preserved verbatim on the OTX row’s raw_payload (jsonb) — the reconciliation read order_reconciliation/1 returns the pinned order, its receipts, and the revenue row it booked, keyed by the ORD ref.

settle_payment/1 is one Repo.transaction under a FOR UPDATE order lock. It inserts the OTX receipt with on_conflict: :nothing on the (rail, external_id) partial unique index, then re-counts — the truth is the ledger, not the returned struct. Only if the count rose do the three writes fire. Select a delivery to run the settle over the fixed payment.

def settle_payment(%{order_id: order_id, rail: rail, external_id: external_id, amount_minor: amount_minor} = params) do
  payload = Map.get(params, :payload)

  Repo.transaction(fn ->
    case lock_order(order_id) do
      nil ->
        Repo.rollback(:no_order)

      order ->
        case insert_otx(order_id, rail, external_id, amount_minor, payload) do
          :suppressed ->
            # the (rail, external_id) dedup fired — a replay, mint NOTHING / book NOTHING
            :already_fulfilled

          :wrote ->
            # 1. MINT the keys (a players credit — always non-negative, A-7) keyed on the ORD.
            {:ok, _} = Wallet.credit_purchase(order.player, order.keys, order_id)
            # 2. BOOK the gross to the SAME revenue_ledger (cm-7 D-1/D-3) — account="platform",
            #    currency=the rail, reason="purchase", ref=the order id. ZERO DDL on revenue_ledger.
            Wallet.house_post(Wallet.house_account(), order.currency, amount_minor, "purchase", order_id)
            # 3. FLIP the order to paid (the only money-column-adjacent UPDATE; the price/rate stay pinned).
            mark_paid!(order)
            :fulfilled
        end
    end
  end)
end

defp lock_order(id), do: Repo.one(from o in Order, where: o.id == ^id, lock: "FOR UPDATE")

The index is the sole race-safe exactly-once authority — not a status == "paid" read-then-act, which carries a TOCTOU window the index closes. The insert’s conflict target names the migration’s predicate byte-for-byte: {:unsafe_fragment, "(rail, external_id) WHERE external_id IS NOT NULL"}. The keyshop story pins the behaviour: the 100-key bundle at gross 1449 Stars books one +1449 stars revenue row; a replayed successful_payment mints once and books once; the receipt, the key credit, and the revenue booking are all-or-nothing.

The gross a rail collects books into the same revenue_ledger read in C6.1; where the money goes out — cash-out and the treasury — is C6.3.