/pay writes untagged ledger transactions (plugin_system = NULL) — $17M of peer payments unattributable

Finding (prod data, 12-day window)

Every in-game /pay transfer is written to the ledger with plugin_system = NULL, so the entire peer-payment layer is invisible to source attribution. It's the 2nd-largest money channel after ChestShop: 14,817 transactions / $16.99M currently land in the "(none)" bucket in any analysis grouped by plugin_system.

Root cause

PayCommand builds its TransferRequest with a null plugin_system:

• payPlayer(...) — new TransferRequest(senderAccountId, targetAccountId, normalized, memoLine, sender.getUniqueId(), null, /*plugin_system*/ null, null)
• payGovernmentAccount(...) — same null plugin_system

(For contrast, ChestShop, BusinessPlugin, treasury-salary, rest-api, etc. all set a plugin_system, so they attribute cleanly.)

Fix

Set a stable plugin_system tag on /pay transfers (e.g. "Treasury-Pay" or "pay") in both PayCommand paths, and on any other first-party transfer that currently passes null. Then explorer/analytics GROUP BY plugin_system attributes peer payments instead of dumping them into "(none)".

Note: the optional player memo already flows through (the <memo> route appends ": <memo>" to the message) — this issue is only about the missing source tag, not memos.

Acceptance

• New /pay (player→player and player→government) transactions carry a non-null plugin_system.
• Backfill is optional (historical rows stay null); document the cutover date so analytics can treat pre-fix nulls as legacy /pay.
• A unit/IT assertion that transfer from /pay records the tag.

Surfaced during an economy-data review; enables the oversight work in the sibling issue.