Resolve payment credential and CRM pipeline commitment boundaries

Add research on PCI/tokenized payment references vs login Credentials (Payment
Instrument Reference, Payment Mandate) and CRM Opportunity promotion thresholds
(Pipeline Pursuit, binding_trigger). Resolve OpenQuestions for both topics.
Update glossary, conceptual model, terminology, and downstream recommendations.

model/ConceptualModel.md

@@ -30,7 +30,9 @@ collapsing into `user`, `group`, or `tenant`.
 - Commercial Record: billing, CRM, or commerce-system record linked to an actor
   or tenant (e.g., Stripe Customer, Salesforce Account).
 - Commercial Commitment: evidenced obligation binding commercial parties (contract,
-  subscription, payment mandate, regulated onboarding).
+  subscription, payment mandate, purchase order, regulated onboarding).
+- Pipeline Pursuit: in-flight CRM/procurement deal before binding commitment
+  (Opportunity, deal record); promotes on binding trigger only.
 - Profile: presentation or attribute surface.
 - Persona: contextual presentation of an actor.
 
@@ -43,6 +45,9 @@ collapsing into `user`, `group`, or `tenant`.
   interchange encoding.
 - Proxy Commercial Identifier: Registry Identifier with commercial-proxy
   authority (e.g., DUNS).
+- Payment Instrument Reference: tokenized payment-provider instrument reference
+  (e.g., Stripe pm_xxx); scoped identifier on Commercial Record — not Credential,
+  not CHD.
 - Scoped Identifier: identifier designed for limited correlation.
 - Credential: proof or control material.
 - Claim: statement made by a source or issuer.