E-invoicing recipient identifiers

The storage change documented here is under review. Deployment has not been verified.

Submission requests continue to use recipient_identifier_scheme and recipient_identifier_value. Authorized e-invoice responses continue to return recipient.identifier_value as a string or null. Clients can retain their existing request and response mappings.

After the rollout flag is enabled, new transmission recipient identifiers and the FNE fiscal response snapshot are encrypted on the transmission record using the application's organization-bound encryption service. Until then, new writes retain the legacy plaintext form for compatibility during the two-application deployment. An authorized read accepts legacy plaintext or decrypts the encrypted identifier. Existing rows remain unchanged during deployment; the founder converts them explicitly only after both brands run the new readers and the founder enables encrypted writes on both. The selected provider receives the readable identifier required to route or certify the invoice.

If FNE has certified an invoice but snapshot encryption fails, the response reports a successful submission with degraded: true and its document reference. Do not resend a certified invoice to repair missing bookkeeping. Follow the reported recovery process.

This storage change covers transmission records. It does not establish that historical logs, the archive's counterparty index, retained fiscal documents or backups have been erased or contain no readable identifiers.