Payments unbundling — overnight execution
Sunday 23 August, 07:15. Covers the work since your rulings last night. Nothing is pushed. Nothing is deployed. Prod and the app are unchanged.
The short version
P0, P1, and P2 are code-complete. The build got a full adversarial dual review (Codex + Opus). The review found real defects. A fix wave closed all of them. All gates pass on the final code. The five-round adversarial review loop is closed. One action now sits with you: the App Store Connect session.
Decisions recorded from your rulings
DECIDEDPrices moved to Apple's grid: 24.99 / 79.99 / 749.99 AED. Your .95 endings do not exist as Apple price points. The .99 points are live on the UAE storefront today. Your weekly economics hold within 1%. Web Stripe mirrors the same prices.
DECIDEDFamily plan ditched (per-adult; gifting later via web). Money-back for Apple members = Apple refund-page redirect. No proration. Insurance purchase = Settings section via Stripe (P3). Other storefronts yes (Kuwait/Bahrain/Oman bill in USD). Tabby parked.
OPEN"Send Consumption Data" is not a toggle. Research correction: it needs ASSN setup, an API key, and customer consent that we capture ourselves. Consent UX + terms need counsel input. The server already answers Apple safely (declines to share) until then.
What was built
- Server (P1): component entitlement ledger (service + insurance as separate grants), the Apple webhook with durable inbox and full transition table, verify + purchase-eligibility endpoints, purchase intents + a reconciler, an append-only receipts ledger, and the consumer rewiring — the emergency gate, the deadman entitlement floor, coverage/policy/FNOL, money-back branching, renewal reminders. Migrations applied to staging only.
- Mobile (P2): Apple in-app purchase end to end — three intervals, eligibility check before the payment sheet, the server as the only source of entitlement (the client can never grant itself), Restore Purchases, honest failure states. Family Shield removed from sale. Stripe stays for insurance tiers.
- Contracts + CI: old installed builds can never crash on the new server data (tolerant schemas + soak flags); the zero-IAP CI guard now allows exactly react-native-iap and still bans self-granting.
- Your ASC runbook: docs/business/payments-unbundling-2026-08-22/p0-asc-runbook.md — a one-sitting, step-by-step script.
The review found real problems. They are fixed.
Both reviewers independently said "not ready" on the first build. The worst findings, each now closed with a test that reproduces the original failure:
| Finding | Why it mattered | |
|---|---|---|
| Cross-rail identity blindness (reproduced live) | A stale Apple event, a sweep, or a late Stripe refund could silently erase a member's paid coverage on the other rail. | FIXED |
| Missing bundle check on verify | Another developer's app could mint ELA coverage with a genuine Apple receipt. | FIXED |
| Certificate chain gap | A forged refund could disable a member's dispatch — a life-safety denial primitive. | FIXED |
| Old Shield checkout still reachable | A lapsed Shield member tapping Resubscribe got the ditched 3,750 AED bundled Stripe charge — the exact App Review rejection surface this project removes. | FIXED |
| No app-lifetime purchase listener | A crash after payment showed "you haven't been charged" — false — and could strand a paid member. | FIXED |
| New receipt fields broke installed apps | Every existing build's receipts screen would break — Stripe members too. Now behind a soak flag. | FIXED |
Equally important: both reviewers attacked and cleared the deadman floor, the account-hijack protections, the webhook idempotency design, and the no-client-grant law.
CLOSEDThe review loop ran five rounds and converged: 19 findings → 8 → 2 → 1 → zero. Each round re-verified the previous fixes and hunted regressions; every fix carries a test that reproduces the original failure. Codex's final verdict at ~07:00: round closed — the code is deploy-ready. What remains is external only: your ASC session, sandbox drills, and the client-build soak.
Your one action: the App Store Connect session (~30 min)
Open the interactive runbook → (checklist with progress saving; the repo source is docs/business/…/p0-asc-runbook.md). It covers: the Paid Applications Agreement, banking + tax, Small Business Program enrollment (keeps commission at 15%), and creating the subscription group with the three products.
Why it is urgent: the agreement gates all sandbox purchase testing. Bank verification is the slow step — often days. Until it clears, the Apple-side positive paths stay drill-unverified.
Blocked / not started
BLOCKEDSandbox purchase drills, Apple webhook certificates on staging, and the live-path evidence — all wait on your ASC session.
BLOCKEDDeploy: the tolerant app build must ship and soak before the server may emit Apple data to clients. Nothing deploys before you see the review reconciliation and say go.
OPENP3 (Settings insurance section), P4 (web checkout on ela.now), P5 (submission-pack rewrite + Family Shield copy sweep) — specified, not started. Money-back promise removal — with you/counsel. Sukoon questions — parked, safe default in code.
No screenshots in this brief: the wave was server-side, and the new checkout UI cannot run a real purchase until the ASC products exist — captures come with the sandbox drills.