[daliu]

Outcome

Newly delivered supported Checkout Events now reject unusable embedded Checkout Session created evidence before any target, fallback, provider-binding, money, or business-state work.

Closes #588
Parent tracker: #106

Exact review identity

• Base: 51723b487ec67bb74620c97e47449ae1319f0daa
• Head: 0645e3977e87797c5b69848339801d42e75b5426
• Tree: dd970cd2994ffeafa52b603ea3094ca8224552cf
• Patch SHA-256: fa3d8148d33ef8fb5dbd43efb772055c4c43a732d3b77ad72a5b36064adedfc0

Invariant and failure behavior

After exact processed-Event replay and the existing realm, lifecycle, metadata, and outer Event-time checks, embedded Session created must be a primitive safe integer from Unix epoch second 0 through Firestore maximum second 253402300799, inclusive.

Invalid evidence produces fixed durable needs_review:invalid_checkout_session_created with:

• valid outer stripeCreatedAt;
• null target fields;
• fixed redacted logging;
• no coercion or rejected-value timestamp construction;
• no target/fallback query, provider binding, business read/mutation, money check, or transition.

Valid claimed missing targets remain retryable. Exact replay remains read-only. Session/Event chronology is deliberately unchanged and reserved for PAY-003A13.

Changes

• functions/stripeWebhook.js: one Checkout-only admission predicate and fixed reason.
• functions/stripeWebhook.test.js: valid provider-shaped Session fixture time, one named adversarial PAY-003A12 matrix/helpers, and the single inherited PAY-003A9 compatibility correction.
• STRIPE_COMMERCE_DESIGN.md: one PAY-003A12 SOURCE ONLY / NOT LIVE contract.

No schema, Rule, index, package, workflow, API, migration, backfill, history-repair, or provider-configuration change.

Trustworthy RED

On the exact base, the test-only PAY-003A12 registration/order matrix failed 2/2 because missing Session time reached payment_confirmed and changed both targets instead of creating target-free review.

Test-only diff SHA-256: d3d31782b39377a7f247cdae98817f3767dcda0cdbf3c1c5777d8e441f066bdf.

Verification

Node 20 and Java 21; Firebase commands used demo projects and emulators only.

• PAY-003A12: 157/157
• Complete webhook: 760/760
• Functions lint: passed
• Functions full: 7,222 passed; 64 intended skips
• Frontend: 951/951
• Workflow/artifact/supply safety: 86/86
• SPA navigation: 11/11
• Firestore Rules demo emulator: 418/418
• Commerce command-journal demo emulator: 63/63
• Frontend lint baseline: 118 files; 113 reviewed legacy errors; 6 reviewed legacy warnings
• Diagnostic build: passed
• Workflow YAML and diff checks: passed
• Dependency audits, unchanged by this no-package patch: root full 59, root production 4, Functions 8; no forced upgrade

Three independent exact-diff reviews returned GO: security/runtime, tests/compatibility, and design/backup-officer continuity.

Self-review

• Authorization/App Check: no callable or authorization surface changed.
• Input bounds: non-coercing primitive safe integer, inclusive Firestore timestamp range.
• PII/secrets/logging: rejected evidence is never stored, returned, or logged; log fields remain fixed and redacted.
• Idempotency/replay: existing processed Event remains first and byte-preserving.
• State transitions: invalid evidence is stopped before target work; valid lifecycle outcomes are unchanged.
• Production fallback: none added; no provider call or production service is used.
• Migration: none; historical processed ledgers remain authoritative.

Officer continuity

Officer impact: None — server-only pre-target admission. No officer screen, task, field, permission, topology, approval path, or available recovery step changes.

Officer documentation: None — current officer procedures remain factual. The engineering boundary is documented in STRIPE_COMMERCE_DESIGN.md.

Deployment evidence

• Source changed: yes, in this PR.
• Tests passed: yes, locally as listed; hosted CI pending.
• Code merged: no.
• Website published: no.
• runmprc.com verified: no.
• Firebase deployed/read back: no.
• Stripe or outside provider configured/contacted: no.
• Production data changed: no.
• Checkout/payment/refund/dispute performed: no.
• Production behavior verified: no.

Source and synthetic tests prove none of the unverified deployment/provider/live states.

[netlify]

✅ Deploy Preview for luminous-fox-7c393f ready!

Name	Link
🔨 Latest commit	0645e39
🔍 Latest deploy log	https://app.netlify.com/projects/luminous-fox-7c393f/deploys/6a6e9f32db2e2a0008b38afb
😎 Deploy Preview	https://deploy-preview-589--luminous-fox-7c393f.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[daliu]

SELF-REVIEW GO on exact head 0645e3977e87797c5b69848339801d42e75b5426, tree dd970cd2994ffeafa52b603ea3094ca8224552cf, patch SHA-256 fa3d8148d33ef8fb5dbd43efb772055c4c43a732d3b77ad72a5b36064adedfc0.

I reviewed every changed hunk after the full local gates. No authorization, App Check, input-bound, PII/secret, logging, idempotency, replay, impossible-state, migration, or production-fallback issue remains. Runtime scope is one non-coercing Checkout-only admission predicate after existing outer-time admission and before target work. Tests prove fixed target-free review, valid outer ledger time, null targets, exact reads/timestamps, fixed logs, replay, valid missing-target retry, four lifecycle/two-domain hostile shapes, positive boundaries/outcomes, and non-Checkout/chronology exclusions. Documentation is source-only and does not imply provider or live truth.

Independent security/runtime, tests/compatibility, and design/backup-officer reviews also returned GO. Hosted CI and preview checks remain pending; merge is stopped until exact-head checks finish.

[daliu]

EXACT-HEAD HOSTED REVIEW GO. CI run 30727364335 is bound to reviewed head 0645e3977e87797c5b69848339801d42e75b5426 and passed all five required jobs: Frontend, Cloud Functions, Firestore Rules, commerce command-journal emulator, and artifact scrubber. Netlify deploy-preview 6a6e9f32db2e2a0008b38afb is non-production; its preview/header/redirect checks passed and Pages-changed was correctly skipped for this server/docs patch.

Exact base remains 51723b487ec67bb74620c97e47449ae1319f0daa; remote main and head are unchanged. PR is mergeable. The sole block is repository approval policy (REVIEW_REQUIRED); all local, hosted, self, and three independent read-only reviews are GO. No website, Firebase, Stripe/provider, data, payment, or live action occurred.

[daliu]

FINAL MERGE / EXACT-MAIN REVIEW GO.

Reviewed head 0645e3977e87797c5b69848339801d42e75b5426 merged as exact main 56332507f394f419616acfa6320f1bfbb16c60b5; both trees are dd970cd2994ffeafa52b603ea3094ca8224552cf. Exact-main CI 30727456137 passed all five jobs. GitHub deployments are []; Netlify exact-main production attempt 6a6e9fe9a611ae0008db491f failed unpublished, while PR preview 6a6e9f32db2e2a0008b38afb was non-production. No Firebase/Stripe/provider/data/payment/live action is claimed.

Officer impact: None — server-only admission.

Officer documentation: None — no officer procedure changed.

Issue #588 is closed, coordination labels/assignee are cleared, remote branch is absent, and the claim is released. Session/Event chronology remains future PAY-003A13 scope.