[johnnyeric]

Summary

Add default-off, opt-in queued accounting for staging with direct fallback. USAGE_QUEUE_ONLY_ENABLED=true takes effect only with VERCEL_TARGET_ENV=staging and a non-production Vercel environment. Confirmed HTTP 202 publication skips the gateway direct usage write in either function region. Missing configuration, failed lifetime registration, unavailable publication or unexpected rejection uses the existing writer with the same finalized usage ID and payload. Queue mode takes precedence over shadow mode, preventing a second publication. Production cannot enable queue-preferred accounting.

Move immediate spend-watched Bouncer reporting into the writer's existing post-commit tasks for both direct and queued writes. Billing and the Bouncer outbox commit together; the writer then attempts delivery without turning a delivery failure into a billing failure. Duplicate usage writes do not repeat delivery or bypass outbox backoff, and cron retries unsuccessful delivery. The gateway retains best-effort reporting if its direct write fails. Accounting returns an explicit queued or recorded status; queue acceptance does not imply a committed database row or a durable production publication guarantee.

Verification

• Parsed a synthetic provider response through the installed Next accounting lifetime, authenticated publisher HTTP handler, local emulated queue and shipped processing consumer, then the actual writer route against disposable PostgreSQL. Before releasing the delayed write: zero rows and charge. After release and replay: one billing effect, one outbox row marked delivered, and one Bouncer delivery call per request ID.
• Repeated with FRA and SFO gateway function settings. Exercised direct-first and queue-first ambiguous publication, a real accepted-publication HTTP timeout, and consumer writer outage/retry; each retained one charge and one Bouncer delivery.
• Exercised the actual writer route with committed rows visible during delivery, concurrent duplicate calls, Bouncer 503 followed by outbox-drainer retry, controlled transaction failure, and writes without a Bouncer event.
• The gateway lifetime used the installed Next request-context runtime; loopback HTTP invoked the real publisher and writer handlers. This did not run a full gateway/web Next application server. Queue scheduling was locally emulated, the consumer write was delayed by the HTTP fixture, and external Bouncer transport was stubbed. Hosted staging, real Bouncer delivery, credentials, deployment protection and hosted processing readiness require separate verification.

Visual Changes

N/A

Reviewer Notes

Stacked on the staging processing prerequisite, PR #8074. Review the production veto, tracked acceptance lifetime, same-ID fallback and writer-owned Bouncer delivery after commit. Publish/deploy the updated writer before relying on prompt reporting from the updated gateway; older writer deployments must preserve the Bouncer outbox payload. Publisher timeout can add up to two seconds before direct fallback starts; the writer now awaits the existing bounded Bouncer delivery attempt after commit (up to five seconds). Bouncer failure leaves the successful billing outcome and outbox retry intact. The consumer's retry/DLQ policy is unchanged.

Automated checks: 71 publisher/lifecycle tests, 82 writer/accounting/outbox tests, 10 composed FRA/SFO scenarios, shared and targeted route typechecks, focused lint, formatting and whitespace checks.

[iscekic]

LGTM