[pandemicsyn]

Summary

Prevent concurrent Kilo Pass purchase requests from creating multiple Stripe Checkout Sessions and subscriptions.

• coordinate checkout creation per user across the generic Kilo Pass and KiloClaw upsell entrypoints
• reuse an existing open Kilo Pass Checkout Session and reject live Stripe subscriptions not yet persisted by webhooks
• paginate Stripe session and subscription checks and preserve legitimate resubscription after ended subscriptions

Verification

• No manual Stripe checkout was run because this change targets a provider concurrency race and local checkout uses mocked Stripe APIs.

Visual Changes

N/A

Reviewer Notes

Automated verification completed:

• pnpm --filter web typecheck
• pnpm --filter web lint
• targeted Jest coverage for createCheckoutSession and createKiloPassUpsellCheckout (24 passed)
• independent static review repeated after remediation until clean

The first request to acquire checkout coordination wins. A competing request reuses that open Checkout Session, including its selected tier, cadence, and optional hosting intent.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

Checkout reuse now requires matching tier, cadence, and KiloClaw hosting metadata, expires mismatched or URL-less sessions, and bounds Stripe scans with timeouts; no correctness issues found.

Files Reviewed (5 files)

• apps/web/src/lib/kilo-pass/checkout-session.ts
• apps/web/src/routers/kilo-pass-router.ts
• apps/web/src/routers/kilo-pass-router.test.ts
• apps/web/src/routers/kiloclaw-router.ts
• apps/web/src/routers/kiloclaw-billing-router.test.ts

Previous Review Summary (commit 13b1857)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit 13b1857)

Status: No Issues Found | Recommendation: Merge

Executive Summary

Shared Kilo Pass checkout coordination serializes per-user session creation with an advisory lock, reuses open Stripe sessions, and rejects live subscriptions not yet persisted by webhooks; no correctness issues found.

Files Reviewed (5 files)

• apps/web/src/lib/kilo-pass/checkout-session.ts
• apps/web/src/routers/kilo-pass-router.ts
• apps/web/src/routers/kilo-pass-router.test.ts
• apps/web/src/routers/kiloclaw-router.ts
• apps/web/src/routers/kiloclaw-billing-router.test.ts

---

_{Reviewed by grok-4.6 · Input: 245.6K · Output: 15.9K · Cached: 489.5K}

_{Review guidance: REVIEW.md from base branch main}

[pandemicsyn]

Addressed the reported checkout coordination findings in a91aa63fe:

• reuse now requires matching tier, cadence, and KiloClaw hosting metadata
• mismatched and null-URL open sessions are expired before replacement
• Stripe list/create/expire calls use 10s request timeouts and scans are capped at three pages while retaining the advisory lock for race safety
• added coverage for tier mismatch, hosting-intent mismatch, null URLs, and active store subscriptions

Kept the advisory-lock design intentionally: moving provider scans outside it would reopen the cross-instance race, while a durable checkout-intent model would add disproportionate schema and lifecycle complexity.