feat(billing): project current authoritative subscription observations

[seonghobae]

Buyer/data-integrity objective

Refs #488. This Draft is stacked on #526 and implements a tenant-scoped, read-only projection over accepted authoritative Stripe Subscription observations. It selects current state by explicit local append order, retains ordered Price and source-event provenance, enforces organization isolation, returns immutable values, and never mutates orgs.plan or otherwise infers entitlement.

Stripe webhook arrival order remains non-authoritative. The preceding stack owns provider verification and append-only persistence; this PR only projects already accepted observations.

Exact current stack

• protected develop: df0fa17bd5035af6455c889022c540b4f439e3d6;
• exact parent/base: feat(billing): persist authoritative subscription observations #526 feat/stripe-subscription-observation-ledger-488@cf01a755f1f64a5838033a94b4ba17a1622e0021;
• exact contributor head: a8a66035ceaa1abbee2f20873adbc0353c8217d7;
• fresh exact parent→child comparison: ahead 14, behind 0, exact parent as merge base, exactly six changed paths, +481/-3.

The current head is a non-destructive two-parent reconciliation of predecessor child 2d3f280cc90d7af068c98a38e70b16387d5c5c37 with exact current #526. The effective delta is limited to CHANGELOG.md, projection doctoring, package.json, server/stripe_subscription_current_projection.mjs, the coverage contract, and the focused projection regression. CHANGELOG.md adds exactly five projection lines with zero parent deletions.

The semantic package/coverage merge preserves the parent’s composed app/toast route, OpenCode/changelog tests, contextual-orchestrator attribution/routing regressions, Checkout attempt/reconciliation/provider tests, webhook trust/event-ledger coverage, provider-read and observation-ledger coverage, and accessibility suites while adding only current-projection production/test registrations.

Any parent or contributor-head movement invalidates this ancestry statement until freshly reconciled.

Projection contract

• selects the newest accepted observation by explicit append identity rather than webhook arrival or provider wall-clock alone;
• preserves ordered Price membership and source-event provenance;
• enforces organization isolation and canonical positive-decimal tenant authority before SQL lookup;
• rejects ambiguous tenant spellings such as whitespace, +42, hexadecimal, exponent notation, and leading zeroes;
• returns immutable values;
• never mutates orgs.plan or grants entitlement;
• preserves absence and missingness rather than inventing current state; and
• locks the module and focused suite into canonical normal-unit and c8 owned-production execution.

Causal failure repair

Predecessor Server Tests run 32086261953, unit-and-api job 95559322862, passed the complete unit suite including the current projection but failed API smoke because stale application composition returned 404 for protected /toast-state.css. The current repair starts from exact current #526’s composed application tree and overlays only the six projection paths, so the shipped static accessibility asset is preserved without weakening the smoke contract. The predecessor cloud-e2e job succeeded, but all predecessor/synthetic-merge evidence remains historical and non-authorizing after this head movement.

tests/unit/coverage-script-contract.test.mjs now proves the inherited server/application_routes.mjs, provider reader, observation ledger, and new current projection all remain instrumented, while their focused suites remain in normal unit CI and c8 execution.

Current exact-head evidence

Fresh repository-native workflows for exact contributor head a8a66035ceaa1abbee2f20873adbc0353c8217d7 are queued and therefore non-passing:

• Server Tests 32275070213;
• Dependency Review 32275070320; and
• OSV Scanner 32275070706.

The current review inventory contains no submitted review and no review thread, so there is no qualifying independent current-head approval. Queued, pending, skipped-required, cancelled, absent, neutral-required, failed, stale, predecessor, synthetic, status-only, author-only, or model-only evidence is non-passing.

Documentation and integration boundary

docs/doctoring/stripe-subscription-current-projection.md records the active-PR/shipped-truth boundary, security and entitlement separation, rollback, test evidence, and primary Stripe/SQLite references. CHANGELOG.md records active Unreleased behavior without claiming protected integration.

Do not merge independently of #526/#525 or the preceding #488 stack. #528 owns the entitlement-policy child and must be reconciled to this exact parent. Final integration requires fresh exact-head deterministic/browser/coverage/security/dependency/supply-chain/package/provenance evidence, resolved valid findings, and qualifying independent non-author approval under the live rules.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Caution

Review failed

An error occurred during the review process. Please try again later.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}