Continue this existing rental WEBSITE project from delivered commit 85a38a60c5a715e2e82bb1fe735666c27dfc4379. Keep the existing frontend repository, design, Robinhood testnet deployment, full ABIs and customer-only scope. Make a focused repair, not a new application. Do not modify contracts, create a backend or broadcast transactions to the public testnet.

Keep the existing single rental dashboard page: equipment item 1, policy and deposit terms, wallet connection, approval/reservation, reservation-ID lookup, cancellation and refund credit withdrawal. Preserve its current copy and styling except for the corrected recovery explanation.

Independent review reproduced a recovery defect in src/engine.ts:

1. The renter accepts the policy and has sufficient allowance.
2. execute('reserve') sends the first booking request. The wallet response is lost: it throws a transport error without returning a transaction hash. The original transaction MAY already be broadcast and still pending. The engine correctly saves the original clientRef/calldata/quote as uncertain.
3. reservationByRef still returns zero because the original has not mined. The renter explicitly chooses Retry same booking reference.
4. The renter rejects ONLY THIS RETRY in the wallet (error code 4001).
5. send() currently sees isRejected(error) && !returnedHash and clears journal.operation. The persisted journal becomes {version:1}. Another execute('reserve') is then allowed and generates a different clientRef while the first request is still unresolved.

This was reproduced against the actual delivered RentalEngine using its existing test fixture. Original reference and retry reference were identical; after rejection a third send attempt used a new reference. The original 64 tests all pass but do not cover this sequence. This is a loss of pending-payment recovery, not proof that two deposits were charged: the contract still enforces item availability.

Required behavior:

• A rejection of a retry must not erase uncertainty about an earlier attempt. Retain the original reference, accepted terms, exact calldata, original timing/block information and any known hashes in memory and persistent storage. Explain that the retry was rejected but the earlier booking may still be pending.
• Fresh actions/new references remain blocked until the original request is reconciled. Reload must retain the same pending request. A later successful original receipt/reference must recover the correct booking without another payment.
• Preserve the useful distinction that a rejected FIRST attempt, with no earlier uncertainty or broadcast evidence, can be cleared normally.
• Apply this distinction consistently to other retry/preflight failures; do not treat absence of a returned hash or a zero mapping before mining as proof that an earlier attempt was never sent.
• Add a failing-before/passing-after engine regression for this exact sequence, including a blocked fresh execute, persisted state across a new engine instance, and later recovery when the original mines. Keep a first-attempt-rejection control test.
• Add a mocked-browser regression: intercept the first reservation send after the mock wallet has recorded its broadcast, lose its response, leave it pending, reject only the retry, then verify the same pending reference remains visible/saved and no fresh reservation is offered or sent. No real wallet or public-chain writes.

Also repair the clean-checkout validation packaging. The delivered repository has no artifacts/ directory, but tests/browser/smoke.mjs and scripts/live-read.mjs write reports under it without first creating it. Make report-producing commands create their output directories themselves. README references artifacts/validation.md and artifacts/design-probe.json that are absent: include legitimate evidence or correct those references/claims. Document an exact reproducible Playwright installation/version and browser-test command; do not require hidden worker tooling or manual directory creation.

Run typecheck, all existing and new tests, ABI verification, production build, bundle checks and the complete mocked-browser suite from a clean checkout with no pre-created artifacts/ directory. Report actual results and remaining limitations. Rebuild the committed dist/ export from the repaired source. Preserve the existing exact-deposit approvals, policy acceptance, account/network checks and separate cancellation/refund withdrawal behavior. No secrets, real payments, new contracts, admin/staff controls or private hosting access.