Resolve payment credential and CRM pipeline commitment boundaries

Add research on PCI/tokenized payment references vs login Credentials (Payment
Instrument Reference, Payment Mandate) and CRM Opportunity promotion thresholds
(Pipeline Pursuit, binding_trigger). Resolve OpenQuestions for both topics.
Update glossary, conceptual model, terminology, and downstream recommendations.

research/commercial-subscription/stripe-customer-billing.md

@@ -80,7 +80,8 @@ customer** that is explicitly not a login account. It demonstrates why
 | --- | --- |
 | Customer object | Commercial Record |
 | Subscription | Commercial Record lifecycle / entitlement metadata |
-| Payment method | Credential (payment instrument) — downstream |
+| Payment method | Payment Instrument Reference (not Credential) |
+| SetupIntent / mandate | Payment Mandate (Commercial Commitment) |
 | Metadata.tenant_id | Identifier binding to Tenant Scope |
 | business_name | Commercial Record attribute |
 | individual_name | Commercial Record attribute (person-backed) |
@@ -90,11 +91,14 @@ customer** that is explicitly not a login account. It demonstrates why
 
 ## Open Questions
 
-- Should payment methods on Commercial Record map to Credential in canon, or
-  remain strictly downstream PCI-scoped artifacts?
 - Does sole-proprietor billing (person-backed Commercial Record without
   Organization) need a distinct pattern in scenario tests?
 
+## Resolved (see payment-credential-pci-boundary.md)
+
+- Payment methods → **Payment Instrument Reference**; mandates → **Payment Mandate**.
+  CHD out of canon; not **Credential**.
+
 ## References
 
 - Stripe Customer object — https://docs.stripe.com/api/customers/object