@odla-ai/chapter 0.42.4 → 0.43.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@odla-ai/chapter",
-  "version": "0.42.4",
+  "version": "0.43.0",
   "description": "A leader/follower foundation for branded membership sites: shared CRM, admin, auth, payments, booking, and explicit record delivery from one defineChapter config.",
   "license": "MIT",
   "homepage": "https://odla.ai/docs/packages/chapter",

package/runbooks/adopt-existing.md

@@ -581,6 +581,17 @@ this release. Preserve a host UI/route for non-USD or mismatched pricing. Test
 successful payment, duplicate webhook, failure, refund, and subscription
 cancellation before switching the UI.
 
+For a shared Stripe account, preserve Chapter's closed partition metadata on
+every new customer, subscription, payment intent, and refund: app, chapter,
+environment, data environment, and stable runtime. Do not infer ownership from
+the Stripe account or Price alone. The signed webhook must apply an exact target
+once, acknowledge a fully tagged sibling with zero local writes, quarantine an
+unmatched event for operators, and accept a metadata-free legacy object only
+when its Stripe customer, subscription, or gift id is already linked to this
+chapter and runtime. Exercise all four paths in development, including a replay
+of the identical body and an event-id collision with changed content, before
+removing any legacy payment adapter.
+
 ### Calendar and email
 
 Complete dev Google booking consent, reconnecting any grant from the retired

package/runbooks/greenfield.md

@@ -778,6 +778,18 @@ non-USD or unmatched pricing needs a host UI/route and cannot use the stock
 payment presentation. Never accept money until the provider equality check and
 webhook test prove authoritative paid/refunded state and idempotent replay.
 
+Chapter tags every newly created Stripe customer, subscription, payment intent,
+and refund with its app, chapter, environment, data environment, and stable
+runtime identity. Do not replace or omit those fields in a host payment route.
+The signed webhook acknowledges a fully tagged sibling event without a local
+write, accepts an untagged legacy event only when the referenced Stripe object is
+already linked to a local application or gift intent, and records a content-free
+receipt for each applied or unmatched event. Prove all three dispositions with
+synthetic test objects: exact target applies once, a sibling target writes zero
+rows, and an unmatched legacy event is quarantined and observable. Replaying the
+same event body must be a no-op; reusing its event id with different content must
+raise a collision signal and must not apply.
+
 ### Google Calendar
 
 Complete the human Google booking consent from provisioning, then: