[daliu]

Outcome

New race and merchandise Checkout Sessions no longer accept Stripe promotion codes or automatic tax. The signed webhook now refuses incomplete, malformed, inconsistent, overflowing, or nonzero discount/tax/shipping breakdowns instead of treating them as valid payments.

This is source safety only. Live commerce remains unavailable.

What changed

• set allow_promotion_codes: false and automatic_tax.enabled: false in both current Checkout creators
• add additive schemaVersion: "1" metadata to new Sessions and PaymentIntents while preserving legacy metadata compatibility
• require Stripe's complete total_details and present shipping_cost component shapes
• reconcile subtotal, discount, tax, shipping, and total with safe-integer arithmetic
• keep anomalous completion records unpaid/unfulfilled with durable review evidence
• preserve definitive failed/expired cancellation while retaining or adding review evidence
• add exact creator payload tests and signed event cases for zero, partial, 100%, legacy, malformed, overflow, hidden shipping, async failure, and expiry paths
• update engineering and plain-language officer documentation

Safety invariants

• browser or Dashboard configuration never proves an allowed price adjustment
• unknown or nonzero adjustments never mark a record paid or fulfilled
• ordinary all-zero failure/expiry does not erase an earlier review flag
• no production secrets, customer data, provider calls, Firebase deployment, or live payment test were used

Verification

• Node v20.20.2
• npm --prefix functions run lint — passed
• npm --prefix functions run test:run -- --runInBand — 159 passed; 1 emulator-only test skipped
• git diff --cached --check — passed
• 19 modified-document relative links — passed
• staged sensitive-pattern scan — passed
• two independent reviews approved exact staged SHA-256 391778bcfb54df137a2e5cb1ff9959a91e153bd99558658c7166eb0757a589c9

Remaining work

• PROMO-001 — Disable unmodeled Stripe price adjustments #102 must remain open for a private, redacted inventory of pre-change Sessions/provider adjustment settings.
• The current protected release plan names only profile-recovery Functions. It cannot deploy createCheckoutSession, createMerchCheckout, and stripeWebhook.
• A separate reviewed exact-commit release plan, Firebase readback, Stripe-owner readback, and test-mode/live-state verification are still required.

Officer impact: Officers must keep live race/shop checkout unavailable and must not create website promotion, tax, or shipping configuration. The guide now provides a short stop-and-escalate path.

Officer documentation: docs/officers/EVENTS_SHOP_MEMBERS.md

Deployment evidence: Website not published; Firebase not deployed; Stripe/provider settings not changed or verified; production behavior not verified. Source commit only: f944aaffb1eff745b708ea53d1e15f71bc401d0e.

Source work for #102; do not auto-close the issue.

[netlify]

✅ Deploy Preview for luminous-fox-7c393f ready!

Name	Link
🔨 Latest commit	f944aaf
🔍 Latest deploy log	https://app.netlify.com/projects/luminous-fox-7c393f/deploys/6a54c61ee759150007cd8d0c
😎 Deploy Preview	https://deploy-preview-144--luminous-fox-7c393f.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[daliu]

POST-MERGE EVIDENCE

• Squash merge: 2e3228acc7be649e0b154b450f7bac362e8dfb83
• PR exact-head CI 29244929462: frontend, Functions, and Rules passed; Netlify preview passed
• Post-merge CI 29245068926: frontend, Functions, and Rules passed
• PROMO-001 — Disable unmodeled Stripe price adjustments #102 moved to status:blocked-owner; source claim released

No protected release was requested. Firebase and Stripe were not changed or read back, the current protected plan does not name these three Stripe Functions, and production behavior remains unverified.