[daliu]

Outcome

Adds the unused server-only PAY-002B2C1 contract for one immutable Stripe Checkout Session plan. The exact active lease holder can bind attempt 1 once; exact recovery is read-only; stale, conflicting, corrupt, or chronologically impossible state fails closed.

The stored route is code-owned and static: checkout_session_create maps only to /v1/checkout/sessions. Arbitrary, object-ID-bearing, capability-shaped, unmapped, and mismatched paths reject before Firestore.

Security and reliability boundary

• Recomputes the B1 command identity and deterministic attempt-1 Stripe key.
• Stores command-bound commitments, never the raw Stripe account, parameters, key, lease ID, caller, payload, provider object, or result.
• Requires the exact current holder/fence before comparing an existing plan.
• Anchors fence 1 to lifecycle creation and validates bounded immediate-predecessor chronology for current and original binding leases.
• Creates the plan and deterministic audit atomically after all reads.
• Returns only a fixed frozen provider_plan_bound or provider_plan_existing classification; no send or execute permission exists.
• Adds explicit anonymous/member/browser-admin denial proof for the nested provider-attempt path.
• Adds a pinned test-only Firestore transaction commit rejection and proves every related record remains unchanged.

C1 still does not send a Stripe request. PAY-002B2C2 owns pre-POST evidence and the old/unknown-send cutoff. PAY-002B2C3 owns verified reconciliation and safe later-attempt authorization.

Verification

Node 20 / Java 17 local evidence on exact commit f1d1dd6cc1efebdd6f0945fcb62f92576b27b99a:

• Focused journal unit: 1 suite, 176/176 passed.
• Full Functions: 14 suites, 834 passed; 26 emulator-only tests skipped by design.
• Focused Firestore transaction emulator: 25/25 passed three consecutive times (45.820s, 53.405s, 42.984s).
• Firestore Rules: 4 suites, 311/311 passed.
• Frontend Jest: 10 suites, 134/134 passed.
• SPA navigation: 10/10 passed.
• Functions lint: passed.
• Diagnostic production build: passed.
• Six changed Markdown files: 14/14 relative links resolved.
• Diff check and credential/private-link scan: passed.

Two independent exact-snapshot reviews approved the 10-path diff SHA-256 43cabd3865a5931a7a0d9e72c877e54d5ea5ba8f584b0482cabcbe455ea2991c. Review-found endpoint-ID, historical-lease chronology, commit-failure coverage, and dependency-cycle issues were corrected before commit.

Migration and rollback

Additive unused target schema only. No endpoint imports this API. No backfill, TTL, deletion, production read/write, or provider inventory occurs. A rollback reverts this unused source/docs commit; it must not delete any future journal evidence.

Officer impact: None — checkout, refunds, admin work, and officer procedures do not change. Stripe commerce remains NOT AVAILABLE YET.

Officer documentation: None — this pull request changes only unused server-side safety source, synthetic tests, and engineering design/status documents. It adds no officer-visible behavior, permission, collected data, provider setting, or recovery step.

Deployment evidence: Source changed and local tests passed at f1d1dd6cc1efebdd6f0945fcb62f92576b27b99a. Code is not yet merged. Website publication: not attempted. runmprc.com: not verified because no website behavior changes. Firebase deployment: not attempted. Stripe/provider configuration: not changed or verified. Production behavior: not tested or claimed.

Closes #173

Final delivery evidence

Merged as acaa961058177ea7266d489c9537a22802b0905e. Exact post-merge CI run 29276143519 passed Frontend, Functions, Firestore Rules, and the named commerce journal emulator. Protected production release run 29276269838 passed exact-main/exact-CI preflight, then failed closed before build because the protected public REACT_APP_RECAPTCHA_SITE_KEY variable is absent. Firebase deployment and Pages publication were skipped. Stripe/provider settings and production data were untouched; no live behavior is claimed.

[netlify]

✅ Deploy Preview for luminous-fox-7c393f ready!

Name	Link
🔨 Latest commit	f1d1dd6
🔍 Latest deploy log	https://app.netlify.com/projects/luminous-fox-7c393f/deploys/6a5533289b7ee400088cf20e
😎 Deploy Preview	https://deploy-preview-174--luminous-fox-7c393f.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.