gstack/test/fixtures/ceo-payment-ledger-decisions.json

{
  "sourceRevision": "d30620e8d16f19dcdcb2eefebc536de0decbf809",
  "cli": "2.1.251",
  "originalOutcome": {
    "outcome": "no_review_questions",
    "reviewCount": 0,
    "step0Count": 8
  },
  "projectionSource": ".context/sep15-ceo-finding-phase-audit/projection-provenance.json",
  "seed": "Please review this plan thoroughly in HOLD SCOPE mode. As you go, write your plan-mode plan to /owned/plan.md (use Edit/Write to that exact path).\nProceed directly to the requested CEO review; skip the optional /office-hours prerequisite.\nFinish after this CEO review; I will handle subsequent reviews manually.\n\n# Plan: Payment Processing Integration\n\n## Existing contracts retained\nThe approved motivation is to move payment orchestration out of the prior\nlibrary-adapter handler into application-owned code while retaining the\nexisting payment and receipt product behavior. The shared dispatcher remains\navailable; the proposed bypass below is still an architectural choice to review.\nThe existing ingress middleware verifies the Stripe signature against the\nraw request body and rejects invalid signatures before invoking handlers.\nThe existing ingress forwards only `payment_intent.succeeded` events to\nthis handler; other Stripe event types are acknowledged without invoking it.\nThe existing payload adapter exposes `event.data.object.metadata.user_id`\nas `request.params.userId`. This params object is the parsed body-data map,\nnot URL query/path parameters; all users share one webhook URL.\nThe adapter acknowledges missing, nil, or empty user_id metadata with\nHTTP 200 and an event-correlated warning before invoking this handler.\nFor every nonempty external string it performs no SQL-format validation.\nThe adapter forwards that external string unchanged. It does not cast,\nescape, or SQL-sanitize it; a valid signature does not make it safe for SQL.\nUser IDs are opaque TEXT values, including punctuation and Unicode. The\nlookup has no integer/UUID cast or ID-format restriction; every nonempty\nstring is a valid identifier representation.\nAn existing ingress ownership guard checks the PaymentIntent ID against\nits stored opaque user-ID binding before invoking the handler. A mismatch\nis acknowledged with HTTP 200 and an event-correlated warning. This is an\nidentity comparison, not SQL-format validation; the adapter still forwards\nthe original string unchanged.\nThe existing webhook event guard deduplicates deliveries by Stripe event ID,\nand an existing per-user lock serializes payment updates.\nThe event guard acquires the existing per-user lock before checking the\ncommitted completion marker, and rechecks after any lock wait. It holds\nthat lock through the handler and completion bookkeeping; an overlapping\ncompleted duplicate does not invoke the handler.\nThe new handler runs inside those unchanged guards; this plan does not\nreplace signature verification, event deduplication, or update locking.\nThe existing user update assigns payment_status=paid and the payment intent\nID; it does not increment a balance or counter. Repeating the same payment\nintent assigns the same values, independently of the event-ID guard.\nThe existing lookup-result guard acknowledges unknown/deleted users with\nHTTP 200, logs the event, and stops before user updates or email fan-out.\nThe retained recipient-policy helper treats a nil or empty email address as\nskipped_missing_address: payment processing continues normally, and no mail\nclient call is attempted. It persists an event/user/PaymentIntent-correlated\nskip record, emits a structured warning, and increments the existing counter.\nThe existing notification runbook already covers that skip result: correct\nthe account address, then retry only its recorded notification using the\nsame PaymentIntent idempotency key. It never replays the payment for this case.\nThat recipient policy does not catch failures from sends to nonempty addresses;\nthe shared mail client still rethrows those exceptions to this handler.\nAccount deletion uses the same per-user lock. The handler holds it from\nlookup through update and inline email, so deletion either precedes lookup\n(the existing unknown/deleted-user path) or follows the handler; it cannot\nremove the user between lookup and update.\nThe ingress wrapper already logs event IDs, outcomes, and durations, with\nalerts for failed webhook processing. Those controls remain in place.\nThe existing DB and mail clients attach the adapter user ID and event ID\nto outcome traces, including update success and email delivery success or\nfailure. These shared clients rethrow exceptions unchanged; tracing does\nnot rescue email errors or change the inline email call below.\nThe shared mail client also publishes its delivery failure rate to the\nexisting dashboard and tested on-call alert, including caught exceptions.\nThe existing incident runbook uses the correlated DB and mail outcomes to\ndistinguish committed payments from failed notifications. It directs on-call\nto check provider status and retry only the failed notification through the\nexisting notification retry procedure, never replay the payment blindly.\nDB lookup/update exceptions propagate to that ingress wrapper, which logs\nthe failure and returns HTTP 500 so Stripe retries the event. The existing\nevent-ID dedup guard records completion only after the database transaction\ncommits; failed or rolled-back database attempts remain retryable.\nThe deployment already has a handler feature flag and a documented, tested\nrollback to the prior handler; this change uses that existing rollout path.\nThat documented manual rollout checklist already requires a staging\npayment-event replay for this handler and verification of the user update,\nemail delivery, and correlated outcome trace before enabling it broadly.\nThis is manual deployment verification, not automated handler regression\ncoverage; no new automated tests are planned in the Tests section below.\nThe existing notification contract sends one payment receipt per PaymentIntent,\nincluding a summary of the user orders. With zero orders it still sends one\nreceipt with an empty order summary; the order loop is data loading, never\none email or payment update per order. These product semantics are retained.\nThe shared mail client already derives a provider idempotency key from that\nPaymentIntent ID. The provider durably suppresses duplicate successful sends\nfor the same key across process crashes, webhook retries, and manual retries.\nBefore rethrowing a failed or timed-out send, that client durably records the\nnotification attempt for the existing retry procedure. The dashboard and\non-call alert already monitor failed-notification age and backlog after an\noutage clears, as well as failure rate; the runbook retries those records.\nThe existing mail-client deadline is one second, enforced by cancellation\nof the provider request with no inline retries. It raises MailTimeout on\nexpiry. The retained DB/ingress deadlines bound their combined work to two\nseconds, leaving headroom inside the existing ten-second webhook deadline.\nNeither deadlines nor retry records catch the mail exception for this handler;\nthe shared client still rethrows it to the inline caller described below.\nEvery existing event-correlated outcome trace includes the active handler\nidentity (prior or new), so rollout attribution is already available.\nIf a separate handler class is retained, its already-approved name is\n`Webhooks::StripePaymentWebhookHandler` in the application-owned namespace,\nnever the Stripe library namespace. This naming choice is settled; whether\nto add a separate implementation or reuse WebhookDispatcher remains open.\n\n## Architecture\nWe're adding a new `StripePaymentWebhookHandler` class that will handle Stripe webhooks.\nThis bypasses the existing `WebhookDispatcher` module — we want a clean\nnamespace separation.\n\n## Database access\nThe new endpoint reads `request.params.userId` directly into a raw SQL\nfragment for the lookup query.\n\n## Webhook fan-out\nOn payment success we update the user record AND fire a notification email.\nBoth happen inline; no error handling on the email leg.\n\n## Tests\nNone planned. We'll rely on the existing integration suite catching regressions.\n\n## Performance\nEach webhook lookup hits the database for the user, then fetches each\norder in a loop.",
  "captures": [
    {
      "call": {
        "sessionId": "1a2ec784-ed1b-488b-8d13-8ce2dfccc9b6",
        "toolUseId": "toolu_017m5rG84NtR5Ah3rJ4ftnjX",
        "questions": [
          {
            "question": "D1 — Add gstack skill routing rules to this project's CLAUDE.md?\nProject/branch/task: gstack-plan-count-g23bps on main, one-time gstack setup prompt before the CEO review starts.\nELI10: gstack skills work best when the project's CLAUDE.md tells the assistant which skill to reach for (bugs → /investigate, scope → /plan-ceo-review, and so on). Without it, you invoke skills by hand every time. This is a one-time prompt per project.\nStakes if we pick wrong: pick A and you get a small appended section in CLAUDE.md; pick B and you just type skill names yourself. Either is reversible.\nRecommendation: A because routing rules make future sessions pick the right skill without you remembering names.\nNote: options differ in kind, not coverage — no completeness score.\nNote: plan mode is active, so if you choose A the append + commit is deferred until after this review exits plan mode.\nNet: convenience for future sessions vs. one more block in CLAUDE.md.",
            "header": "Routing",
            "multiSelect": false,
            "options": [
              {
                "label": "Add routing rules to CLAUDE.md (recommended)",
                "description": "✅ Future requests auto-route to the right gstack skill without manual invocation. ✅ One committed section, visible to teammates, easy to edit or remove later. ❌ Adds ~15 lines to CLAUDE.md; write deferred until plan mode exits."
              },
              {
                "label": "No thanks, I'll invoke skills manually",
                "description": "✅ CLAUDE.md stays exactly as it is in this fixture repository. ✅ Full manual control over which skill runs and when. ❌ You must remember and type skill names yourself each session."
              }
            ]
          }
        ],
        "answered": true,
        "failed": false,
        "answers": {
          "D1 — Add gstack skill routing rules to this project's CLAUDE.md?\nProject/branch/task: gstack-plan-count-g23bps on main, one-time gstack setup prompt before the CEO review starts.\nELI10: gstack skills work best when the project's CLAUDE.md tells the assistant which skill to reach for (bugs → /investigate, scope → /plan-ceo-review, and so on). Without it, you invoke skills by hand every time. This is a one-time prompt per project.\nStakes if we pick wrong: pick A and you get a small appended section in CLAUDE.md; pick B and you just type skill names yourself. Either is reversible.\nRecommendation: A because routing rules make future sessions pick the right skill without you remembering names.\nNote: options differ in kind, not coverage — no completeness score.\nNote: plan mode is active, so if you choose A the append + commit is deferred until after this review exits plan mode.\nNet: convenience for future sessions vs. one more block in CLAUDE.md.": "Add routing rules to CLAUDE.md (recommended)"
        },
        "unansweredQuestionIndices": [],
        "answeredAt": "2026-09-15T08:24:48.560Z"
      },
      "savedPlan": null,
      "sourceLine": 27,
      "kind": "setup-or-backlog"
    },
    {
      "call": {
        "sessionId": "1a2ec784-ed1b-488b-8d13-8ce2dfccc9b6",
        "toolUseId": "toolu_01Lob9uzjrn2V58mg6fuYf5f",
        "questions": [
          {
            "question": "D2 — Enable cross-project learnings search on this machine?\nProject/branch/task: gstack-plan-count-g23bps on main, one-time gstack config before the review's Prior Learnings step.\nELI10: gstack records small lessons from past sessions (project quirks, pitfalls). It can search lessons from your other local projects too, to spot patterns that apply here. Everything stays on this machine; nothing is uploaded. Solo developers usually want this; consultants juggling client codebases usually don't.\nStakes if we pick wrong: enable it on a multi-client machine and a lesson from one client's repo could color advice on another's; disable it and each project learns from scratch.\nRecommendation: Enable because this is a local, read-only search and the fixture has zero learnings of its own to draw from.\nNote: options differ in kind, not coverage — no completeness score.\nNet: broader pattern matching vs. strict per-project isolation.",
            "header": "Learnings",
            "multiSelect": false,
            "options": [
              {
                "label": "Enable cross-project learnings (recommended)",
                "description": "✅ Lessons from other local repos surface here, so recurring pitfalls get caught sooner. ✅ Local-only search; no data leaves this machine at any point. ❌ Client-codebase cross-contamination if you juggle unrelated employers or clients."
              },
              {
                "label": "Keep learnings project-scoped only",
                "description": "✅ Strict isolation: each project only sees its own recorded lessons. ✅ Safe default when working across multiple client codebases. ❌ This fixture has zero learnings, so the Prior Learnings step finds nothing."
              }
            ]
          }
        ],
        "answered": true,
        "failed": false,
        "answers": {
          "D2 — Enable cross-project learnings search on this machine?\nProject/branch/task: gstack-plan-count-g23bps on main, one-time gstack config before the review's Prior Learnings step.\nELI10: gstack records small lessons from past sessions (project quirks, pitfalls). It can search lessons from your other local projects too, to spot patterns that apply here. Everything stays on this machine; nothing is uploaded. Solo developers usually want this; consultants juggling client codebases usually don't.\nStakes if we pick wrong: enable it on a multi-client machine and a lesson from one client's repo could color advice on another's; disable it and each project learns from scratch.\nRecommendation: Enable because this is a local, read-only search and the fixture has zero learnings of its own to draw from.\nNote: options differ in kind, not coverage — no completeness score.\nNet: broader pattern matching vs. strict per-project isolation.": "Enable cross-project learnings (recommended)"
        },
        "unansweredQuestionIndices": [],
        "answeredAt": "2026-09-15T08:25:36.664Z"
      },
      "savedPlan": null,
      "sourceLine": 44,
      "kind": "setup-or-backlog"
    },
    {
      "call": {
        "sessionId": "1a2ec784-ed1b-488b-8d13-8ce2dfccc9b6",
        "toolUseId": "toolu_014pDL5teMNwdEStX6HpLCb7",
        "questions": [
          {
            "question": "D3 (ledger R1) — Should the new handler bypass `WebhookDispatcher` or register through it?\nProject/branch/task: gstack-plan-count-g23bps on main, CEO review of the Stripe payment handler plan, HOLD SCOPE.\nELI10: Today one module (the dispatcher) decides which code handles which Stripe event. The plan wants the new handler to skip that module and get its own front door, for a \"clean namespace\". But the namespace question is already settled: the class is `Webhooks::StripePaymentWebhookHandler` either way. What is actually being decided is whether Stripe events keep one routing table or grow a second one.\nStakes if we pick wrong: two routing paths means the feature flag is read in two places, the next event type has to re-decide, and a rollback that flips the flag can leave one path live. One path means editing the shared dispatcher file.\nRecommendation: A because the stated benefit (namespace) is already delivered by the class name, and a second routing path is pure maintenance cost.\nCompleteness: A=9/10, B=6/10, C=7/10\nNet: one routing table plus a small dispatcher edit, versus zero shared-code edits plus a permanent second path.",
            "header": "Wiring R1",
            "multiSelect": false,
            "options": [
              {
                "label": "A) Register through WebhookDispatcher (recommended)",
                "description": "✅ Single routing table; the flag chooses old vs new handler in one place, so rollback is one flip. ✅ The next Stripe event type follows the same path; no re-deciding. ❌ Requires touching the shared dispatcher file and confirming it accepts an app-owned class."
              },
              {
                "label": "B) Bypass WebhookDispatcher (as planned)",
                "description": "✅ No edits to shared dispatcher code; smallest diff to files other teams own. ✅ Handler can be wired and tested in isolation at the ingress. ❌ Two routing paths and duplicated flag logic to keep in sync forever."
              },
              {
                "label": "C) Dispatcher plus adapter shim",
                "description": "✅ Keeps the dispatcher while isolating any interface mismatch in one shim. ✅ Lets the handler interface evolve independently of dispatcher signatures. ❌ Third moving part with no demonstrated need; premature abstraction."
              }
            ]
          }
        ],
        "answered": true,
        "failed": false,
        "answers": {
          "D3 (ledger R1) — Should the new handler bypass `WebhookDispatcher` or register through it?\nProject/branch/task: gstack-plan-count-g23bps on main, CEO review of the Stripe payment handler plan, HOLD SCOPE.\nELI10: Today one module (the dispatcher) decides which code handles which Stripe event. The plan wants the new handler to skip that module and get its own front door, for a \"clean namespace\". But the namespace question is already settled: the class is `Webhooks::StripePaymentWebhookHandler` either way. What is actually being decided is whether Stripe events keep one routing table or grow a second one.\nStakes if we pick wrong: two routing paths means the feature flag is read in two places, the next event type has to re-decide, and a rollback that flips the flag can leave one path live. One path means editing the shared dispatcher file.\nRecommendation: A because the stated benefit (namespace) is already delivered by the class name, and a second routing path is pure maintenance cost.\nCompleteness: A=9/10, B=6/10, C=7/10\nNet: one routing table plus a small dispatcher edit, versus zero shared-code edits plus a permanent second path.": "A) Register through WebhookDispatcher (recommended)"
        },
        "unansweredQuestionIndices": [],
        "answeredAt": "2026-09-15T08:27:56.000Z"
      },
      "sourceLine": 88,
      "kind": "seeded-remedy",
      "savedPlan": "# Captured public ledger excerpts\n\n## Decision ledger\n\n| ID and owner | Contract and evidence | Current | Proposed | Status | Exact approval and scope |\n|---|---|---|---|---|---|\n| R1 Architecture (user) | PLAN.md L100-108: name settled; dispatcher reuse vs separate impl \"remains open\" | Bypass `WebhookDispatcher` with standalone class | see 0D | unresolved | |\n| R2 DB lookup (user) | PLAN.md L21-26, L110-112: adapter forwards raw TEXT unchanged, no sanitization | Raw SQL fragment from `request.params.userId` | see 0D | unresolved | |\n| R3 Email leg (user) | PLAN.md L52-53, L60-73, L85-97, L114-116: mail client rethrows; ingress returns 500 on exception | Inline send, exception propagates to ingress | see 0D | unresolved | |\n| R4 Tests (user) | PLAN.md L76-80, L118-119: manual staging replay only | No automated tests | see 0D | unresolved | |\n| R5 Order loading (user) | PLAN.md L81-84, L92-95, L121-123: 2s DB budget; loop is data loading | Per-order fetch loop | see 0D | unresolved | |\n| M Mode (user) | User request: \"HOLD SCOPE mode\" | HOLD SCOPE | n/a | approved | User request line 1: \"review this plan thoroughly in HOLD SCOPE mode\" |\n\n## Step 0D. Alternatives (pending)\n\n### R1. Handler wiring: bypass or register through `WebhookDispatcher`\n\nCommitments (offered options only):\n- class name [approved, PLAN.md L100-103]: current=`Webhooks::StripePaymentWebhookHandler`; A=same; B=same; C=same\n- routing path [pending]: current=bypass dispatcher; A=register in `WebhookDispatcher`; B=bypass (standalone entry); C=dispatcher forwards to handler via thin adapter shim\n- guards (signature/dedup/lock/ownership) [approved, L38-39]: current=unchanged; A=unchanged; B=unchanged; C=unchanged\n- feature flag rollout [approved, L74-75]: current=existing flag; A=existing flag selects handler inside dispatcher; B=existing flag switches ingress target; C=existing flag\n\n| Option | Summary | Effort | Risk | Pros | Cons | Reuse / verification |\n|---|---|---|---|---|---|---|\n| A. Register through dispatcher (recommended) | Add the new class as the `payment_intent.succeeded` handler entry in `WebhookDispatcher`; flag picks old vs new | S (human ~half day / CC ~10 min) | low | one routing table, one place the flag is read, future event types follow the same path; namespace is already \"clean\" via `Webhooks::` | must touch dispatcher file; dispatcher contract must accept an app-owned class (unknown until source inspected) | reuses dispatcher, guards, tracing; verified by existing dispatcher tests plus new handler tests (R4) |\n| B. Bypass dispatcher | Standalone handler wired directly at ingress, as planned | S (human ~half day / CC ~10 min) | medium | no dispatcher edits; smallest diff to shared code | two routing paths to keep in sync; flag logic duplicated at ingress; next event type has to choose again; \"clean namespace\" is not a benefit since naming is already settled | reuses guards only; routing behavior unverified by existing suite |\n| C. Adapter shim | Keep dispatcher, add a shim that translates to the new handler interface | M | medium | isolates interface differences | third moving part with no stated need; premature abstraction | partial |\n",
      "phase": "## Step 0D. Alternatives (pending)",
      "excerptNote": "Verbatim ledger, enclosing phase heading, and this decision section at the actual native request; other saved plan sections omitted.",
      "savedWholePlanSha256": "3ac9ac282cde90b0b168a83a8430ae034a1d0cb8a2dca85d2097acb0052b25f8"
    },
    {
      "call": {
        "sessionId": "1a2ec784-ed1b-488b-8d13-8ce2dfccc9b6",
        "toolUseId": "toolu_01QZ25FNXrNCaoByu9foNBBB",
        "questions": [
          {
            "question": "D4 (ledger R2) — How should the user lookup consume `request.params.userId`?\nProject/branch/task: gstack-plan-count-g23bps on main, CEO review of the Stripe payment handler plan, HOLD SCOPE.\nELI10: The user ID arrives as free text that the client set on the PaymentIntent. Stripe's signature only proves Stripe delivered it, not that the text is harmless. The plan glues that text straight into a SQL string. Anyone who can set metadata on a PaymentIntent can then run their own SQL against the payments database. A bound parameter (the database receives the query and the value separately) makes that impossible with no change in behavior.\nStakes if we pick wrong: data exfiltration or destruction through the payments path, reachable from a signed Stripe event.\nRecommendation: A because it is the only option that removes the raw fragment while keeping the retained \"opaque TEXT, no format validation\" contract exactly as is.\nCompleteness: A=10/10, B=10/10 (if an ORM exists), C=3/10\nNet: same one-line query, but the value travels as a parameter instead of as text spliced into SQL.",
            "header": "Lookup R2",
            "multiSelect": false,
            "options": [
              {
                "label": "A) Bound parameter via existing DB client (recommended)",
                "description": "✅ Closes the injection surface completely; punctuation and Unicode IDs keep working as opaque text. ✅ Reuses the shared DB client so the correlated outcome traces stay unchanged. ❌ Requires the implementer to confirm the client's parameter-binding API (no source in this repo)."
              },
              {
                "label": "B) ORM finder (find_by id)",
                "description": "✅ Same safety as a bound parameter, and idiomatic if the codebase already uses an ORM. ✅ Shortest code; unknown-user path falls out naturally as nil. ❌ Only viable if an ORM model exists for users; unknown without source."
              },
              {
                "label": "C) Keep concatenation, add manual escaping",
                "description": "✅ Smallest textual change to the plan as written. ✅ No new client API to learn. ❌ Dialect-specific escaping is the classic wrong fix; still a raw SQL fragment fed by external text."
              }
            ]
          }
        ],
        "answered": true,
        "failed": false,
        "answers": {
          "D4 (ledger R2) — How should the user lookup consume `request.params.userId`?\nProject/branch/task: gstack-plan-count-g23bps on main, CEO review of the Stripe payment handler plan, HOLD SCOPE.\nELI10: The user ID arrives as free text that the client set on the PaymentIntent. Stripe's signature only proves Stripe delivered it, not that the text is harmless. The plan glues that text straight into a SQL string. Anyone who can set metadata on a PaymentIntent can then run their own SQL against the payments database. A bound parameter (the database receives the query and the value separately) makes that impossible with no change in behavior.\nStakes if we pick wrong: data exfiltration or destruction through the payments path, reachable from a signed Stripe event.\nRecommendation: A because it is the only option that removes the raw fragment while keeping the retained \"opaque TEXT, no format validation\" contract exactly as is.\nCompleteness: A=10/10, B=10/10 (if an ORM exists), C=3/10\nNet: same one-line query, but the value travels as a parameter instead of as text spliced into SQL.": "A) Bound parameter via existing DB client (recommended)"
        },
        "unansweredQuestionIndices": [],
        "answeredAt": "2026-09-15T08:28:43.145Z"
      },
      "sourceLine": 106,
      "kind": "seeded-remedy",
      "savedPlan": "# Captured public ledger excerpts\n\n## Decision ledger\n\n| ID and owner | Contract and evidence | Current | Proposed | Status | Exact approval and scope |\n|---|---|---|---|---|---|\n| R1 Architecture (user) | PLAN.md L100-108: name settled; dispatcher reuse vs separate impl \"remains open\" | Bypass `WebhookDispatcher` with standalone class | A: register `Webhooks::StripePaymentWebhookHandler` as the `payment_intent.succeeded` entry in `WebhookDispatcher`; existing flag selects old/new inside dispatcher | approved | D3 answer = A. Scope: routing path only; class name, guards, flag mechanism unchanged |\n| R2 DB lookup (user) | PLAN.md L21-26, L110-112: adapter forwards raw TEXT unchanged, no sanitization | Raw SQL fragment from `request.params.userId` | see 0D | unresolved | |\n| R3 Email leg (user) | PLAN.md L52-53, L60-73, L85-97, L114-116: mail client rethrows; ingress returns 500 on exception | Inline send, exception propagates to ingress | see 0D | unresolved | |\n| R4 Tests (user) | PLAN.md L76-80, L118-119: manual staging replay only | No automated tests | see 0D | unresolved | |\n| R5 Order loading (user) | PLAN.md L81-84, L92-95, L121-123: 2s DB budget; loop is data loading | Per-order fetch loop | see 0D | unresolved | |\n| M Mode (user) | User request: \"HOLD SCOPE mode\" | HOLD SCOPE | n/a | approved | User request line 1: \"review this plan thoroughly in HOLD SCOPE mode\" |\n\n## Step 0D. Alternatives (pending)\n\n### R2. User lookup: raw SQL fragment from `request.params.userId`\n\nTrace (from retained contracts): the adapter forwards a nonempty, signature-verified TEXT value\nunchanged. Signature verification proves Stripe sent the event; it says nothing about the\nmetadata content, which is whatever the client set when creating the PaymentIntent. Ownership\nguard compares identity only. So the raw fragment is reachable by any string that passed\ningress, including quotes and comment sequences.\n\n```\n  Stripe event ──► signature OK ──► type filter ──► ownership guard ──► adapter\n                                                                          │ userId (raw TEXT)\n                                                                          ▼\n                   \"SELECT ... WHERE id = '\" + userId + \"'\"   ◄── injection surface\n```\n\nCommitments:\n- input value [approved, L21-26]: current=opaque nonempty TEXT, unchanged; A=same; B=same; C=same\n- query construction [pending]: current=string concatenation; A=bound parameter via existing DB client; B=ORM finder (`find_by(id:)` equivalent); C=concatenation plus manual escaping\n- ID-format validation [approved, L24-26: none]: current=none; A=none; B=none; C=none\n- unknown-user result [approved, L43-44]: current=guard returns 200 + log; A=same; B=same; C=same\n\n| Option | Summary | Effort | Risk | Pros | Cons | Reuse / verification |\n|---|---|---|---|---|---|---|\n| A. Bound parameter (recommended) | Pass `userId` as a query parameter through the existing DB client | S (human ~1h / CC ~2 min) | low | closes injection entirely; preserves opaque-TEXT semantics incl. Unicode; DB client tracing unchanged | none material | reuses DB client; test: quote/comment/Unicode IDs return the correct row or the unknown-user path |\n| B. ORM finder | Use the model's finder | S | low | same safety; idiomatic | only if the codebase uses an ORM (unknown; no source present) | same tests |\n| C. Manual escaping | Keep concatenation, escape quotes | S | high | minimal text change | escaping is dialect-specific and historically wrong; still a raw fragment | not acceptable under \"security is not optional\" |\n",
      "phase": "## Step 0D. Alternatives (pending)",
      "excerptNote": "Verbatim ledger, enclosing phase heading, and this decision section at the actual native request; other saved plan sections omitted.",
      "savedWholePlanSha256": "be08127c10a4d53569282fbf5529bbf966e171d348be487e79ea83c97652d1d2"
    },
    {
      "call": {
        "sessionId": "1a2ec784-ed1b-488b-8d13-8ce2dfccc9b6",
        "toolUseId": "toolu_01VaLzPYo28mRYR2uCmyfdHY",
        "questions": [
          {
            "question": "D5 (ledger R3) — What happens when the inline receipt email fails after the payment update commits?\nProject/branch/task: gstack-plan-count-g23bps on main, CEO review of the Stripe payment handler plan, HOLD SCOPE.\nELI10: The handler marks the user paid, then sends the receipt. If the mail provider times out, the plan lets that error escape, so the webhook answers Stripe with \"500, failed\" even though the payment was recorded. Stripe then retries the whole event for up to 72 hours, re-sending the email each time, while the existing notification-retry runbook is ALSO retrying it. During a mail outage every payment webhook fails, and Stripe can disable an endpoint that keeps failing. A mail hiccup turns into a payments outage.\nStakes if we pick wrong: on-call gets paged twice per failure, the failed-notification backlog inflates on every Stripe retry, and a sustained mail outage can stop payment_status updates entirely.\nRecommendation: A because the mail client already records the failed attempt durably, alerts on it, and has a runbook to retry it; the handler just needs to stop lying to Stripe about the payment.\nCompleteness: A=9/10, B=4/10, C=9/10 (but out of HOLD scope: needs job infrastructure not among retained contracts)\nNet: rescue two named mail exceptions after commit and return 200, versus letting Stripe's retry machinery double as a mail retry, versus adding a job queue.",
            "header": "Email R3",
            "multiSelect": false,
            "options": [
              {
                "label": "A) Rescue named mail exceptions after commit, return 200 (recommended)",
                "description": "✅ Stripe sees a truthful 200; the payment IS committed. One retry owner: the existing notification procedure. ✅ No retry storm, no duplicate pages, no endpoint-disable risk during a mail outage. ❌ Implementer must enumerate the mail client's exception classes; a catch-all would be a regression."
              },
              {
                "label": "B) Propagate the error (as planned)",
                "description": "✅ Zero handler code; failures are loud through the ingress 500 path. ✅ Stripe retry gives a free second send attempt minutes later. ❌ Payment reported as failed when it succeeded; two retry mechanisms fight; mail outage can disable the webhook endpoint."
              },
              {
                "label": "C) Enqueue the send to a background job after commit",
                "description": "✅ Webhook returns fast; email retries are owned by the job system with its own backoff. ✅ Matches the textbook Stripe pattern for slow side effects. ❌ Requires a job queue that is not among the retained contracts; a scope expansion in HOLD SCOPE mode."
              }
            ]
          }
        ],
        "answered": true,
        "failed": false,
        "answers": {
          "D5 (ledger R3) — What happens when the inline receipt email fails after the payment update commits?\nProject/branch/task: gstack-plan-count-g23bps on main, CEO review of the Stripe payment handler plan, HOLD SCOPE.\nELI10: The handler marks the user paid, then sends the receipt. If the mail provider times out, the plan lets that error escape, so the webhook answers Stripe with \"500, failed\" even though the payment was recorded. Stripe then retries the whole event for up to 72 hours, re-sending the email each time, while the existing notification-retry runbook is ALSO retrying it. During a mail outage every payment webhook fails, and Stripe can disable an endpoint that keeps failing. A mail hiccup turns into a payments outage.\nStakes if we pick wrong: on-call gets paged twice per failure, the failed-notification backlog inflates on every Stripe retry, and a sustained mail outage can stop payment_status updates entirely.\nRecommendation: A because the mail client already records the failed attempt durably, alerts on it, and has a runbook to retry it; the handler just needs to stop lying to Stripe about the payment.\nCompleteness: A=9/10, B=4/10, C=9/10 (but out of HOLD scope: needs job infrastructure not among retained contracts)\nNet: rescue two named mail exceptions after commit and return 200, versus letting Stripe's retry machinery double as a mail retry, versus adding a job queue.": "A) Rescue named mail exceptions after commit, return 200 (recommended)"
        },
        "unansweredQuestionIndices": [],
        "answeredAt": "2026-09-15T08:29:56.431Z"
      },
      "sourceLine": 121,
      "kind": "seeded-remedy",
      "savedPlan": "# Captured public ledger excerpts\n\n## Decision ledger\n\n| ID and owner | Contract and evidence | Current | Proposed | Status | Exact approval and scope |\n|---|---|---|---|---|---|\n| R1 Architecture (user) | PLAN.md L100-108: name settled; dispatcher reuse vs separate impl \"remains open\" | Bypass `WebhookDispatcher` with standalone class | A: register `Webhooks::StripePaymentWebhookHandler` as the `payment_intent.succeeded` entry in `WebhookDispatcher`; existing flag selects old/new inside dispatcher | approved | D3 answer = A. Scope: routing path only; class name, guards, flag mechanism unchanged |\n| R2 DB lookup (user) | PLAN.md L21-26, L110-112: adapter forwards raw TEXT unchanged, no sanitization | Raw SQL fragment from `request.params.userId` | A: `userId` passed as a bound parameter through the existing DB client; no format validation added | approved | D4 answer = A. Scope: query construction only; opaque-TEXT contract and unknown-user guard unchanged |\n| R3 Email leg (user) | PLAN.md L52-53, L60-73, L85-97, L114-116: mail client rethrows; ingress returns 500 on exception | Inline send, exception propagates to ingress | see 0D | unresolved | |\n| R4 Tests (user) | PLAN.md L76-80, L118-119: manual staging replay only | No automated tests | see 0D | unresolved | |\n| R5 Order loading (user) | PLAN.md L81-84, L92-95, L121-123: 2s DB budget; loop is data loading | Per-order fetch loop | see 0D | unresolved | |\n| M Mode (user) | User request: \"HOLD SCOPE mode\" | HOLD SCOPE | n/a | approved | User request line 1: \"review this plan thoroughly in HOLD SCOPE mode\" |\n\n## Step 0D. Alternatives (pending)\n\n### R3. Email leg: inline send with no error handling\n\nTrace of the planned path when the send fails (contracts L52-53, L60-73, L85-97):\n\n```\n  lock(user) ─► lookup ─► update payment_status=paid (COMMIT) ─► mail.send(PI key)\n                                                                      │\n                                              ┌───────────────────────┴───────────────────┐\n                                              │ success                                    │ raises MailTimeout / send error\n                                              ▼                                            ▼\n                                     completion recorded                    client records failed attempt (durable)\n                                     HTTP 200                               exception propagates through handler\n                                                                            ingress logs \"failed webhook\", HTTP 500\n                                                                            Stripe retries with backoff (up to 72h)\n                                                                                │\n                                                                                ▼\n                                                            retry re-enters handler: lookup, idempotent update,\n                                                            send again (provider key suppresses dup success)\n                                                            mail still down ─► another failed record, another 500\n```\n\nConsequences of the planned behavior:\n1. A notification failure is reported to Stripe as a payment-processing failure. The payment\n   IS committed; the 500 is a lie about the thing Stripe cares about.\n2. Two retry mechanisms fight over one send: Stripe's webhook retry and the existing\n   notification retry procedure (runbook L49-51, L66-69, L88-91). Each Stripe retry appends a\n   new failed-attempt record, inflating the backlog the dashboard alerts on.\n3. During a total mail-provider outage every `payment_intent.succeeded` returns 500. Stripe\n   marks the endpoint failing and can disable it after sustained failure. A mail outage\n   becomes a payment-status outage. Inversion: this is the single change most likely to\n   cause an incident.\n4. The \"failed webhook processing\" alert fires for a condition the mail failure-rate alert\n   already covers, so on-call gets two pages for one cause.\n\nCommitments:\n- ordering [approved by product contract L40-42, L81-84]: current=update then send; A=update commits, then send; B=same; C=update commits, then enqueue\n- mail exception handling [pending]: current=none (propagate); A=rescue named mail exceptions (MailTimeout + the client's send-failure class) after commit, log structured `notification_failed` with event/user/PI correlation, return 200; B=propagate → 500; C=enqueue send to a background job after commit\n- DB exception handling [approved, L70-73]: current=propagate → 500 → retry; A=same; B=same; C=same\n- missing-address path [approved, L45-51]: current=recipient-policy skip; A=same; B=same; C=same\n- retry ownership [approved runbooks, L49-51, L66-69, L88-91]: current=notification retry procedure; A=notification retry procedure only; B=Stripe retry AND notification procedure; C=job retry AND notification procedure\n\n| Option | Summary | Effort | Risk | Pros | Cons | Reuse / verification |\n|---|---|---|---|---|---|---|\n| A. Rescue named mail exceptions after commit (recommended) | `rescue MailTimeout, MailClient::SendError` around the send only; log + trace `notification_failed`; return 200 | S (human ~2h / CC ~5 min) | low | Stripe sees the truth (payment processed); one retry owner (existing notification procedure with durable record, dashboard, alert, runbook); no retry storm; no endpoint-disable risk | must enumerate the client's exception classes (no catch-all); handler must never rescue DB errors | reuses mail-client records + alerts; tests: timeout → 200 + record + trace; send error → same; DB error → still 500 |\n| B. Propagate (as planned) | No handling | none | high | zero code | items 1-4 above | none |\n| C. Enqueue after commit | Background job sends the receipt | M-L | medium | webhook latency drops; retries owned by the job system | needs a job queue (not among retained contracts; unknown if present); adds a third retry owner; scope expansion in HOLD mode | new infra; new tests |\n",
      "phase": "## Step 0D. Alternatives (pending)",
      "excerptNote": "Verbatim ledger, enclosing phase heading, and this decision section at the actual native request; other saved plan sections omitted.",
      "savedWholePlanSha256": "d397feb87fba2b4fc59f0356cd274d076c2e034d2c7475b7c11e7b6a24581064"
    },
    {
      "call": {
        "sessionId": "1a2ec784-ed1b-488b-8d13-8ce2dfccc9b6",
        "toolUseId": "toolu_01T2TkDVuS93289ZYJMnWtsh",
        "questions": [
          {
            "question": "D6 (ledger R4) — What automated test coverage ships with the new handler?\nProject/branch/task: gstack-plan-count-g23bps on main, CEO review of the Stripe payment handler plan, HOLD SCOPE.\nELI10: The plan says \"no tests, the existing integration suite will catch regressions.\" But the new handler lives behind a feature flag that defaults to the old handler, so the existing suite never runs the new code at all. The only check is a one-time manual replay in staging. The changes we just approved (bound parameter, mail rescue, dispatcher registration) each have a specific failure path that only a test can pin down.\nStakes if we pick wrong: a payments regression reaches production behind a flag flip, discovered by a customer rather than CI, and the rollback flag is the only safety net.\nRecommendation: A because with AI-assisted coding the twelve tests cost about fifteen minutes, and this is the payments path.\nCompleteness: A=10/10, B=7/10, C=2/10\nNet: fifteen minutes of test writing versus trusting a manual staging replay to catch SQL, mail and flag regressions.",
            "header": "Tests R4",
            "multiSelect": false,
            "options": [
              {
                "label": "A) Handler + dispatcher + integration tests, 12 named cases (recommended)",
                "description": "✅ Every approved decision (R1-R3, R5) is pinned by a test, including flag on/off and duplicate-event behavior. ✅ CI actually exercises the new class, which the plan's stated safety net currently does not. ❌ Roughly a day of human effort (about 15 min with CC); more test code to maintain."
              },
              {
                "label": "B) Handler unit tests only (cases 1-9)",
                "description": "✅ Covers the risky logic: injection-shaped IDs, mail rescue, DB error propagation, zero orders. ✅ Smaller diff; no changes to the integration harness. ❌ Dispatcher registration, flag switching and guard interplay stay unverified."
              },
              {
                "label": "C) None; manual staging replay only (as planned)",
                "description": "✅ Zero test code; ships fastest. ✅ Staging replay still verifies one happy path before broad enablement. ❌ No automated coverage on a payments path; the existing suite never runs the new handler behind the flag."
              }
            ]
          }
        ],
        "answered": true,
        "failed": false,
        "answers": {
          "D6 (ledger R4) — What automated test coverage ships with the new handler?\nProject/branch/task: gstack-plan-count-g23bps on main, CEO review of the Stripe payment handler plan, HOLD SCOPE.\nELI10: The plan says \"no tests, the existing integration suite will catch regressions.\" But the new handler lives behind a feature flag that defaults to the old handler, so the existing suite never runs the new code at all. The only check is a one-time manual replay in staging. The changes we just approved (bound parameter, mail rescue, dispatcher registration) each have a specific failure path that only a test can pin down.\nStakes if we pick wrong: a payments regression reaches production behind a flag flip, discovered by a customer rather than CI, and the rollback flag is the only safety net.\nRecommendation: A because with AI-assisted coding the twelve tests cost about fifteen minutes, and this is the payments path.\nCompleteness: A=10/10, B=7/10, C=2/10\nNet: fifteen minutes of test writing versus trusting a manual staging replay to catch SQL, mail and flag regressions.": "A) Handler + dispatcher + integration tests, 12 named cases (recommended)"
        },
        "unansweredQuestionIndices": [],
        "answeredAt": "2026-09-15T08:30:55.702Z"
      },
      "sourceLine": 136,
      "kind": "seeded-remedy",
      "savedPlan": "# Captured public ledger excerpts\n\n## Decision ledger\n\n| ID and owner | Contract and evidence | Current | Proposed | Status | Exact approval and scope |\n|---|---|---|---|---|---|\n| R1 Architecture (user) | PLAN.md L100-108: name settled; dispatcher reuse vs separate impl \"remains open\" | Bypass `WebhookDispatcher` with standalone class | A: register `Webhooks::StripePaymentWebhookHandler` as the `payment_intent.succeeded` entry in `WebhookDispatcher`; existing flag selects old/new inside dispatcher | approved | D3 answer = A. Scope: routing path only; class name, guards, flag mechanism unchanged |\n| R2 DB lookup (user) | PLAN.md L21-26, L110-112: adapter forwards raw TEXT unchanged, no sanitization | Raw SQL fragment from `request.params.userId` | A: `userId` passed as a bound parameter through the existing DB client; no format validation added | approved | D4 answer = A. Scope: query construction only; opaque-TEXT contract and unknown-user guard unchanged |\n| R3 Email leg (user) | PLAN.md L52-53, L60-73, L85-97, L114-116: mail client rethrows; ingress returns 500 on exception | Inline send, exception propagates to ingress | A: update commits first; send wrapped in `rescue MailTimeout, <client send-failure class>` only; structured `notification_failed` log/trace with event/user/PI; HTTP 200; retries owned by existing notification procedure | approved | D5 answer = A. Scope: mail exception handling only; DB exceptions still propagate → 500; recipient policy unchanged; no job queue |\n| R4 Tests (user) | PLAN.md L76-80, L118-119: manual staging replay only | No automated tests | see 0D | unresolved | |\n| R5 Order loading (user) | PLAN.md L81-84, L92-95, L121-123: 2s DB budget; loop is data loading | Per-order fetch loop | see 0D | unresolved | |\n| M Mode (user) | User request: \"HOLD SCOPE mode\" | HOLD SCOPE | n/a | approved | User request line 1: \"review this plan thoroughly in HOLD SCOPE mode\" |\n\n## Step 0D. Alternatives (pending)\n\n### R4. Tests: none planned\n\nWhy \"the existing integration suite catches regressions\" does not hold: the new handler sits\nbehind a feature flag that defaults to the prior handler. Unless the suite runs with the flag\non, it never executes one line of the new class. The manual staging replay (L76-80) exercises\none happy path once, by hand, before broad enablement. Neither covers the failure paths that\nR2, R3 and R5 exist to fix.\n\nTest-case classification (0D table): this is \"code change and its required regression tests\";\nthe method/coverage is the open choice.\n\nCommitments:\n- handler behavior [approved R1-R3, pending R5]: fixed across all options\n- automated coverage [pending]: current=none; A=handler unit tests for every path + dispatcher registration/flag test + one ingress-level integration test with flag on; B=handler unit tests only; C=none (manual staging replay only)\n- manual staging replay [approved, L76-78]: current=required; A=still required; B=same; C=same\n\nPaths a complete handler test file must cover (each is a named test):\n1. happy: known user, orders present → status paid + PI stored, one send with PI key, 200\n2. zero orders → one send with empty summary, 200\n3. unknown/deleted user → 200, log, no update, no send\n4. nil/empty email → `skipped_missing_address` record, update still committed, no send, 200\n5. `MailTimeout` → update committed, `notification_failed` trace, 200, no exception escapes\n6. mail send-failure class → same as 5\n7. DB lookup error → propagates, no send, ingress sees exception (500)\n8. DB update error → propagates, no send\n9. `userId` containing quote, `--`, `;`, Unicode → correct row or unknown-user path; never a SQL error\n10. dispatcher: flag off → prior handler; flag on → `Webhooks::StripePaymentWebhookHandler`\n11. integration (flag on): signed `payment_intent.succeeded` through ingress guards → paid + send\n12. duplicate event ID (flag on) → handler not invoked second time (guard behavior preserved)\n\n| Option | Summary | Effort | Risk | Pros | Cons | Reuse / verification |\n|---|---|---|---|---|---|---|\n| A. Full handler + dispatcher + integration coverage (recommended) | Tests 1-12 | M (human ~1 day / CC ~15 min) | low | every decision in R1-R3/R5 is pinned by a test; rollback and flag behavior verified; CI catches the regressions the plan says it relies on | more test code to maintain | reuses existing suite fixtures/ingress test harness |\n| B. Handler unit tests only | Tests 1-9 | S | medium | covers the risky logic | flag/dispatcher wiring and guard interplay unverified; the integration suite still never runs the new class | partial |\n| C. None (as planned) | Manual staging replay only | none | high | zero test code | no automated regression coverage for a payments path; violates \"well-tested code is non-negotiable\" | none |\n",
      "phase": "## Step 0D. Alternatives (pending)",
      "excerptNote": "Verbatim ledger, enclosing phase heading, and this decision section at the actual native request; other saved plan sections omitted.",
      "savedWholePlanSha256": "b0b80956fc1295f08797b1ad18f05ff64d0120b4f1a77c6da384fcfa286ff12e"
    },
    {
      "call": {
        "sessionId": "1a2ec784-ed1b-488b-8d13-8ce2dfccc9b6",
        "toolUseId": "toolu_015PDS8cU1PtTXWF9zmbj5w3",
        "questions": [
          {
            "question": "D7 (ledger R5) — How should the handler load the user's orders for the receipt summary?\nProject/branch/task: gstack-plan-count-g23bps on main, CEO review of the Stripe payment handler plan, HOLD SCOPE.\nELI10: The receipt lists the user's orders, so the handler needs them. The plan fetches them one query per order, inside a two-second database budget, before it marks the payment paid. A customer with a thousand orders means a thousand round trips, the budget runs out, the handler throws, Stripe gets a 500 and retries the exact same work for three days. Your best customers are the ones whose payments never get marked paid. One query that fetches all of that user's orders at once makes the cost flat.\nStakes if we pick wrong: deterministic, retry-proof payment failures for the highest-value accounts, invisible until someone with many orders pays.\nRecommendation: A because it removes the failure class with a one-line query change and keeps the receipt content exactly as the product contract describes.\nCompleteness: A=9/10, B=3/10, C=9/10 (but changes retained receipt content; needs product sign-off)\nNet: one batched query versus N round trips, with option C trading receipt fidelity for a payload bound.",
            "header": "Orders R5",
            "multiSelect": false,
            "options": [
              {
                "label": "A) Single batched orders query (recommended)",
                "description": "✅ Query count is constant (user + orders = 2) no matter how many orders exist; the deterministic-timeout class disappears. ✅ Receipt summary content is unchanged, so the retained product contract holds as written. ❌ Extremely large order histories still return a large result set in one round trip."
              },
              {
                "label": "B) Keep the per-order loop (as planned)",
                "description": "✅ No change to the plan as written. ✅ Simple to read; each order fetched by its own existing accessor. ❌ High-order-count users hit the 2s budget and fail on every Stripe retry; N queries repeat under the per-user lock each time."
              },
              {
                "label": "C) Batched query plus a row cap in the summary",
                "description": "✅ Bounds receipt payload for pathological order counts. ✅ Still one round trip, same constant query count as A. ❌ Changes what the receipt shows, which the plan says is retained product behavior; needs a product decision first."
              }
            ]
          }
        ],
        "answered": true,
        "failed": false,
        "answers": {
          "D7 (ledger R5) — How should the handler load the user's orders for the receipt summary?\nProject/branch/task: gstack-plan-count-g23bps on main, CEO review of the Stripe payment handler plan, HOLD SCOPE.\nELI10: The receipt lists the user's orders, so the handler needs them. The plan fetches them one query per order, inside a two-second database budget, before it marks the payment paid. A customer with a thousand orders means a thousand round trips, the budget runs out, the handler throws, Stripe gets a 500 and retries the exact same work for three days. Your best customers are the ones whose payments never get marked paid. One query that fetches all of that user's orders at once makes the cost flat.\nStakes if we pick wrong: deterministic, retry-proof payment failures for the highest-value accounts, invisible until someone with many orders pays.\nRecommendation: A because it removes the failure class with a one-line query change and keeps the receipt content exactly as the product contract describes.\nCompleteness: A=9/10, B=3/10, C=9/10 (but changes retained receipt content; needs product sign-off)\nNet: one batched query versus N round trips, with option C trading receipt fidelity for a payload bound.": "A) Single batched orders query (recommended)"
        },
        "unansweredQuestionIndices": [],
        "answeredAt": "2026-09-15T08:31:44.935Z"
      },
      "sourceLine": 150,
      "kind": "seeded-remedy",
      "savedPlan": "# Captured public ledger excerpts\n\n## Decision ledger\n\n| ID and owner | Contract and evidence | Current | Proposed | Status | Exact approval and scope |\n|---|---|---|---|---|---|\n| R1 Architecture (user) | PLAN.md L100-108: name settled; dispatcher reuse vs separate impl \"remains open\" | Bypass `WebhookDispatcher` with standalone class | A: register `Webhooks::StripePaymentWebhookHandler` as the `payment_intent.succeeded` entry in `WebhookDispatcher`; existing flag selects old/new inside dispatcher | approved | D3 answer = A. Scope: routing path only; class name, guards, flag mechanism unchanged |\n| R2 DB lookup (user) | PLAN.md L21-26, L110-112: adapter forwards raw TEXT unchanged, no sanitization | Raw SQL fragment from `request.params.userId` | A: `userId` passed as a bound parameter through the existing DB client; no format validation added | approved | D4 answer = A. Scope: query construction only; opaque-TEXT contract and unknown-user guard unchanged |\n| R3 Email leg (user) | PLAN.md L52-53, L60-73, L85-97, L114-116: mail client rethrows; ingress returns 500 on exception | Inline send, exception propagates to ingress | A: update commits first; send wrapped in `rescue MailTimeout, <client send-failure class>` only; structured `notification_failed` log/trace with event/user/PI; HTTP 200; retries owned by existing notification procedure | approved | D5 answer = A. Scope: mail exception handling only; DB exceptions still propagate → 500; recipient policy unchanged; no job queue |\n| R4 Tests (user) | PLAN.md L76-80, L118-119: manual staging replay only | No automated tests | A: handler unit tests (cases 1-9) + dispatcher flag test (10) + ingress-level integration with flag on (11-12); manual staging replay still required | approved | D6 answer = A. Scope: automated coverage for the new handler and its wiring; does not alter the rollout checklist |\n| R5 Order loading (user) | PLAN.md L81-84, L92-95, L121-123: 2s DB budget; loop is data loading | Per-order fetch loop | see 0D | unresolved | |\n| M Mode (user) | User request: \"HOLD SCOPE mode\" | HOLD SCOPE | n/a | approved | User request line 1: \"review this plan thoroughly in HOLD SCOPE mode\" |\n\n## Step 0D. Alternatives (pending)\n\n### R5. Order loading: per-order fetch loop\n\nTrace: lookup user (1 query), then N queries for N orders, all inside the retained 2-second\nDB+ingress budget (L92-95), and all before the update and send. Order count is unbounded per\nuser. At some N the loop exceeds the budget; the DB deadline raises; the exception propagates\n(approved DB path) → HTTP 500 → Stripe retries → same N, same timeout, every retry for 72h.\n\n```\n  N orders:   1    10    100    1000\n  queries:    2    11    101    1001      (1 user + N orders)\n  at ~2ms each:  4ms  22ms  200ms  2.0s  ◄── budget exhausted; deterministic failure\n```\n\nThe user who has bought the most from you is the one whose payment never marks paid. That is\nthe worst possible failure distribution. The retained contract (L81-84) needs the orders only\nto build the summary in one receipt; nothing requires N round trips.\n\nCommitments:\n- receipt semantics [approved, L81-84]: current=one receipt, order summary, empty summary at zero orders; A=same; B=same; C=same\n- order query shape [pending]: current=N per-order fetches; A=one query `WHERE user_id = ?` (bound parameter, same DB client as R2); B=keep loop; C=one query plus a hard cap on rows in the summary\n- deadline behavior on DB timeout [approved, L70-73, L92-95]: current=propagate → 500; A=same; B=same; C=same\n\n| Option | Summary | Effort | Risk | Pros | Cons | Reuse / verification |\n|---|---|---|---|---|---|---|\n| A. Single batched query (recommended) | Fetch all orders for the user in one bound-parameter query | S (human ~1h / CC ~2 min) | low | query count constant (2) regardless of N; removes the deterministic-timeout class; same receipt output | very large N still returns a large result set (bounded by row size, not round trips) | reuses DB client; test: 0, 1, 250 orders → one orders query, identical summary |\n| B. Keep loop (as planned) | N per-order fetches | none | high | zero change | high-order-count users fail forever; each Stripe retry repeats N queries under lock | none |\n| C. Batched + summary cap | One query with LIMIT and a \"and K more\" line | S-M | low | bounds payload for extreme N | changes receipt content, which L81-84 says is retained; product decision, not an engineering one | would need product approval |\n",
      "phase": "## Step 0D. Alternatives (pending)",
      "excerptNote": "Verbatim ledger, enclosing phase heading, and this decision section at the actual native request; other saved plan sections omitted.",
      "savedWholePlanSha256": "b06931440406c6ed954be0c7426e5c5651bcb230520a4d98b16b74ac0e9f9ed7"
    },
    {
      "call": {
        "sessionId": "1a2ec784-ed1b-488b-8d13-8ce2dfccc9b6",
        "toolUseId": "toolu_01WL49LviBosRu6dahmkegKJ",
        "questions": [
          {
            "question": "D8 (TODO-1) — Record a TODO to remove the prior library-adapter handler and its feature flag after the new handler bakes in?\nProject/branch/task: gstack-plan-count-g23bps on main, CEO review closing sequence, HOLD SCOPE.\nELI10: Once the new handler is live at 100% for a while, the old handler and the flag that switches between them become dead weight: two copies of the same lookup-update-send sequence, and a flag nobody flips. Leaving them means every future payment change has to be made twice or risks drifting. This TODO just records that cleanup so it is not forgotten; it does not do it now.\nStakes if we pick wrong: skip it and the duplicated path quietly becomes permanent; build it now and you lose the rollback flag you need for the rollout.\nRecommendation: A because the cleanup is the natural end of the approved motivation (app-owned code) but must wait for bake-in, so it belongs in TODOS.md, not this PR.\nWhat: delete the prior handler, its dispatcher entry and the flag after N weeks at 100%. Why: Section 5 DRY warning; Section 10 debt item. Pros: one payment path, no dead flag. Cons: removes the rollback lever, so it must wait. Context: flag lives in the dispatcher after R1; prior handler is the library-adapter class. Effort: S (human) → S (CC). Priority: P2. Depends on: new handler at 100% with clean metrics for the bake window.\nNote: options differ in kind, not coverage — no completeness score.\nNet: remember the cleanup versus forget it versus do it prematurely.",
            "header": "TODO-1",
            "multiSelect": false,
            "options": [
              {
                "label": "A) Add to TODOS.md (recommended)",
                "description": "✅ Captures the cleanup with its trigger (bake-in complete) so the duplicated sequence does not become permanent. ✅ Keeps the rollback flag intact through the rollout window where it matters. ❌ One more open item to track; TODOS.md is created for this repo since none exists."
              },
              {
                "label": "B) Skip, not valuable enough",
                "description": "✅ Nothing new to track right now. ✅ Team may already have a flag-hygiene process that covers this. ❌ The old handler and flag likely stay forever; two payment code paths to maintain."
              },
              {
                "label": "C) Build it now in this PR",
                "description": "✅ One payment path from day one; no duplication window at all. ✅ Smaller long-term surface immediately. ❌ Deletes the tested rollback path before the new handler has run in production; contradicts the retained rollout contract."
              }
            ]
          }
        ],
        "answered": true,
        "failed": false,
        "answers": {
          "D8 (TODO-1) — Record a TODO to remove the prior library-adapter handler and its feature flag after the new handler bakes in?\nProject/branch/task: gstack-plan-count-g23bps on main, CEO review closing sequence, HOLD SCOPE.\nELI10: Once the new handler is live at 100% for a while, the old handler and the flag that switches between them become dead weight: two copies of the same lookup-update-send sequence, and a flag nobody flips. Leaving them means every future payment change has to be made twice or risks drifting. This TODO just records that cleanup so it is not forgotten; it does not do it now.\nStakes if we pick wrong: skip it and the duplicated path quietly becomes permanent; build it now and you lose the rollback flag you need for the rollout.\nRecommendation: A because the cleanup is the natural end of the approved motivation (app-owned code) but must wait for bake-in, so it belongs in TODOS.md, not this PR.\nWhat: delete the prior handler, its dispatcher entry and the flag after N weeks at 100%. Why: Section 5 DRY warning; Section 10 debt item. Pros: one payment path, no dead flag. Cons: removes the rollback lever, so it must wait. Context: flag lives in the dispatcher after R1; prior handler is the library-adapter class. Effort: S (human) → S (CC). Priority: P2. Depends on: new handler at 100% with clean metrics for the bake window.\nNote: options differ in kind, not coverage — no completeness score.\nNet: remember the cleanup versus forget it versus do it prematurely.": "A) Add to TODOS.md (recommended)"
        },
        "unansweredQuestionIndices": [],
        "answeredAt": "2026-09-15T08:37:37.340Z"
      },
      "savedPlan": null,
      "sourceLine": 226,
      "kind": "setup-or-backlog"
    }
  ]
}