Card fee (Open_card/Manage_fee) stayed Pending in Card history after KeySecure settled it. Fixes: (1) an older-stamped Success now settles a Pending row; (2) new sweeper reads stale Pending card fees back from KeySecure every 5 min and runs them through the Consumption handler; (3) contract-fee leg may overdraw the reserve mirror instead of rolling back the Success; (4) Card history polls while a recent swipe is Pending. Verified: BE unit + Postgres specs, FE suite, Maestro flow fe/.maestro/app/card-history-pending-fee.yaml against a local BE. Task: https://hola-tech.sg.larksuite.com/record/CO4grLUrvevDbEcissZl9LKagRc
Verification follow-up: preserved the original 3 commits and added reviewed repairs. Bind pulled consume/card/type and observed Pending version; enforce account/card/type under lock; reserve internal pull IDs; use bounded hashed IDs and plausible milliseconds (no guessed conversion); retry processed no-ops without claiming settlement unless the DB confirms it.
Ordering: retain protection against delayed declines while ordering supported fee backfills, amount corrections and terminal recovery by the actual prior persisted event. Missing/mismatched proof fails visibly for retry/provider confirmation. No live provider HTTP inside the database transaction.
App: old Pending card fees now keep updating while History is focused and the app is active; stop on blur/background/settlement. Ordinary purchases keep the 2-minute limit. Other still-pending transactions are not hidden or merged by amount.
Verified on Node 20.20.0: FE 134 suites / 1353 tests passed; FE typecheck passed; FE lint 0 errors / 29 existing warnings. BE production typecheck/build and changed-file lint/types passed; independent code/spec/security review APPROVE with 173 focused BE tests and 30 focused FE tests. PostgreSQL: 19 card-account tests passed, including 15 changed-scope cases.
Actual native verification: BOTH Maestro CLI and Maestro stdio MCP against final-source real local BE, isolated PostgreSQL and local issuer mock. Real 5-minute cron settled the same 3-day-old fee without retiming its provider timestamp. Open History changed Pending to Completed without pull/reopen; separate historical Completed row preserved. Balance 10.00 to 8.00, exactly one CARD_FEE debit and real fiat double-entry; signed duplicate deliveries and CLI re-entry left the ledger unchanged.
Baseline debt, not hidden: full BE 3485 passed / 75 failed, exactly the same 75 assertions as clean develop (stale lending test provider and treasury expectations, not missing env). Whole-project BE lint has the same 281 errors / 64 warnings as develop. Test-inclusive types have 89 errors outside changed files versus 90 on develop; production/changed-file checks are clean. No test/CI gate was disabled.
Limits: provider REST time unit/meaning and the original staging records remain unverified; no native Android/physical-device claim. Some DB specs disable FKs, while the native real-BE fixture runs normal FK enforcement. No dedicated negative-reserve alert added, and aggregate drift does not guarantee such an alert. Lease expiry can still duplicate read-only provider requests; DB guards protect posting.
Safety: no schema/dependency or user .env changes; FE development already points to the requested backend. No real financial/provider operations. Task-owned processes cleaned up; user Metro8081, Postgres5432 and existing BE3001 preserved. No merge performed.
CI timeout follow-up: pipeline 10874 timed out BE lint/test and FE lint while the jobs overlapped. Full logs show a 45-minute FE installation, then a 30-second cold installation and 40-second FE test run after the backend jobs stopped. Add one fixed node-quality resource group to BE/FE/admin bases, including installation/cache phases, without changing checks, worker counts, coverage, timeouts or existing allowed-failure policy. YAML regression passed (all 10 quality jobs, all other parsed properties identical); independent review approved. Node 20 local BE coverage with 4 workers completed in 212 seconds, with the same 75 known baseline assertion failures. Replacement CI verification is in progress; this is not an OOM claim. No merge performed.