@visa/cli 4.1.0-rc.29 → 4.1.0-rc.291

package/dist/checkout-engine/executor.js

@@ -2,7 +2,8 @@
 //   prepareCheckout(): navigate -> stabilize -> mandate gate -> resolve the
 //   review facts. No credential is requested or filled in this phase.
 //   submitApprovedCheckout(): verify the approval is bound to that review ->
-//   revalidate -> mint credential -> fill -> revalidate -> submit.
+//   revalidate -> in dry-run stop without requesting a credential; in submit
+//   mode mint -> fill -> revalidate -> submit.
 //
 // runCheckout() remains the one-shot, auto-approved compatibility wrapper.
 //
@@ -11,16 +12,23 @@
 //     runs before instrument.getCredential(). No credential is minted and no
 //     field is filled on a page the mandate does not cover.
 //   - The PRE-SUBMIT gate re-runs the full check with the resolved amount and
-//     currency. No submit ever happens without it passing. Dry-run never
-//     clicks submit.
+//     currency. No submit ever happens without it passing. Dry-run requests no
+//     credential and neither fills fields nor clicks submit.
 import { randomUUID } from 'node:crypto';
 import { mkdir } from 'node:fs/promises';
 import { join } from 'node:path';
 import { detectFields } from './detect.js';
-import { checkMandate, checkMandatePreFill } from './mandate.js';
+import { checkMandate, checkMandatePreFill, } from './mandate.js';
 import { EvidenceLog, maskOtp } from './evidence.js';
 import { observeOutcome } from './outcome.js';
 import { selectAdapter } from './adapters/index.js';
+import { summarizeFillFailure } from './adapters/generic.js';
+import { traceHandleFields } from './trace-handles.js';
+import { readGenericPageAmount } from './amount.js';
+import { webBotAuthHeadersOrNone } from './web-bot-auth.js';
+import { assertShopifyGuestCheckout, ensureShopifyGuestCheckout, isShopifyCheckoutPage, readShopifyAmount, readStableShopifyAmount, shopifyEnglishCheckoutUrl, } from './adapters/shopify.js';
+import { navigationRedirectEvidence, shopifyPrimaryDomainAlias, } from './shopify-primary-domain.js';
+export { minorFromDecimal, pageCurrency } from './amount.js';
 const SUBMIT_TEXT = /pay|place order|complete|buy|submit|checkout/i;
 const REVEAL_TEXT = /continue|next|proceed|review|go to payment/i;
 // Post-submit confirmed/declined/challenge signals live in outcome.ts
@@ -35,92 +43,6 @@ async function settle(page) {
     await page.waitForTimeout(200);
     await page.waitForLoadState('networkidle', { timeout: 1500 }).catch(() => { });
 }
-// Convert a human decimal like "$50.00" to integer minor units without
-// floats. Fail-closed on separator ambiguity: only layouts with exactly one
-// reading are parsed; anything else returns null and the caller refuses. The
-// dangerous direction is UNDER-reading (an EU "1.234,56" read as 1.23 lets an
-// over-cap total pass the gate), so no layout is ever guessed.
-// Only 2-decimal currencies are supported (see pageCurrency's ISO allowlist).
-export function minorFromDecimal(text) {
-    const m = text.match(/\d[\d.,]*/);
-    if (!m)
-        return null;
-    const token = m[0].replace(/[.,]+$/, '');
-    // "1234" — plain integer major units.
-    if (/^\d+$/.test(token))
-        return Number.parseInt(token, 10) * 100;
-    // "1,234.56" — thousands groups of exactly 3 plus a 2-digit decimal.
-    if (/^\d{1,3}(,\d{3})+\.\d{2}$/.test(token)) {
-        const [whole, frac] = token.replace(/,/g, '').split('.');
-        return Number.parseInt(whole, 10) * 100 + Number.parseInt(frac, 10);
-    }
-    // "1.234,56" — the EU mirror: dot thousands, comma decimal.
-    if (/^\d{1,3}(\.\d{3})+,\d{2}$/.test(token)) {
-        const [whole, frac] = token.replace(/\./g, '').split(',');
-        return Number.parseInt(whole, 10) * 100 + Number.parseInt(frac, 10);
-    }
-    // "49.99" / "49.9" — dot decimal. A 3-digit dot group ("1.234") is EU
-    // thousands, not a decimal, so only 1-2 fraction digits qualify.
-    if (/^\d+\.\d{1,2}$/.test(token)) {
-        const [whole, frac] = token.split('.');
-        return Number.parseInt(whole, 10) * 100 + Number.parseInt(frac.padEnd(2, '0'), 10);
-    }
-    // "49,99" / "49,9" — comma decimal. Unambiguous: a thousands group is
-    // always exactly 3 digits, so a 1-2 digit comma tail can only be a decimal.
-    if (/^\d+,\d{1,2}$/.test(token)) {
-        const [whole, frac] = token.split(',');
-        return Number.parseInt(whole, 10) * 100 + Number.parseInt(frac.padEnd(2, '0'), 10);
-    }
-    // Everything else ("1,234" thousands-or-3-decimals, "1.2.3", ...) is
-    // ambiguous: refuse rather than guess.
-    return null;
-}
-// Currency stated by the page's total text, when unambiguous. "$" is shared
-// by USD/CAD/AUD/... and never qualifies. The ISO allowlist is 2-decimal
-// currencies only, matching minorFromDecimal's scaling.
-const ISO_CURRENCIES = ['USD', 'EUR', 'GBP', 'CAD', 'AUD', 'CHF', 'NZD'];
-export function pageCurrency(text) {
-    const iso = text.match(/\b([A-Z]{3})\b/);
-    if (iso && ISO_CURRENCIES.includes(iso[1]))
-        return iso[1];
-    if (text.includes('€'))
-        return 'EUR';
-    if (text.includes('£'))
-        return 'GBP';
-    return null;
-}
-// Read the order total from the page. Prefers an explicit data-total-minor
-// attribute (machine-readable), else parses a labelled total from the page.
-// Either way the currency comes from the element's text, or stays null. A
-// total that is present but ambiguous is 'unreadable' — the executor refuses
-// rather than falling back to the caller amount, because the page is showing
-// the user a number we cannot verify against the mandate.
-async function readPageAmount(page) {
-    const explicitLoc = page.locator('[data-total-minor]').first();
-    if ((await explicitLoc.count().catch(() => 0)) > 0) {
-        const explicit = await explicitLoc.getAttribute('data-total-minor').catch(() => null);
-        if (explicit && /^\d+$/.test(explicit)) {
-            const text = (await explicitLoc.textContent().catch(() => null)) ?? '';
-            return {
-                kind: 'ok',
-                amountMinor: Number.parseInt(explicit, 10),
-                currency: pageCurrency(text),
-                source: 'page-attr',
-            };
-        }
-    }
-    const totalLoc = page.locator('#order-total, .order-total, [data-testid="order-total"]').first();
-    if ((await totalLoc.count().catch(() => 0)) > 0) {
-        const totalText = await totalLoc.textContent().catch(() => null);
-        if (totalText && /\d/.test(totalText)) {
-            const amountMinor = minorFromDecimal(totalText);
-            if (amountMinor == null)
-                return { kind: 'unreadable' };
-            return { kind: 'ok', amountMinor, currency: pageCurrency(totalText), source: 'page-text' };
-        }
-    }
-    return { kind: 'none' };
-}
 async function tryReveal(page, evidence, clicked) {
     // 1) A payment-method radio for card/credit/debit (accordion layouts).
     const radios = page.locator('input[type="radio"]');
@@ -203,17 +125,63 @@ async function fingerprintSubmitTarget(locator, kind, fallbackLabel) {
         };
     }, { targetKind: kind, targetFallbackLabel: fallbackLabel });
 }
-async function findSubmit(page) {
-    const submitBtn = page.locator('button[type="submit"], input[type="submit"]').first();
-    if ((await submitBtn.count().catch(() => 0)) > 0) {
-        const label = ((await submitBtn.textContent().catch(() => '')) || '').trim() ||
-            (await submitBtn.getAttribute('value').catch(() => '')) ||
-            'submit';
-        return {
-            desc: `submit button ("${label}")`,
-            fingerprint: await fingerprintSubmitTarget(submitBtn, 'submit-control', 'submit'),
-            click: () => submitBtn.click(),
-        };
+// Shopify checkouts keep INERT duplicates of the pay control in the DOM —
+// aria-hidden="true", tabindex="-1", and/or zero-size. Playwright still reports
+// those as "visible, enabled and stable", so a bare `.first()` resolves to one
+// and then every click is swallowed by whatever paints on top of it
+// (observed live: `<h3 id="billingAddress"> intercepts pointer events`, retried
+// until the 6s timeout, deterministically, on casper.com). Rank the real
+// controls ahead of the inert ones and prefer a pay-labelled control.
+export function preferredSubmitIndex(cands, opts = {}) {
+    const indexed = cands.map((c, i) => ({ c, i }));
+    const usable = indexed.filter(({ c }) => c.visible && !c.ariaHidden && c.tabIndex !== -1 && c.area > 0);
+    const usablePayLike = usable.find(({ c }) => PAY_LABEL.test(c.label));
+    if (usablePayLike)
+        return usablePayLike.i;
+    if (!opts.allowDeferred)
+        return usable[0]?.i ?? -1;
+    // A genuine multi-step checkout can keep its final submit control inside a
+    // hidden payment section until a safe, non-submit Continue button advances
+    // the page. The human still needs that exact control bound into the review
+    // before approval. Accept it for fingerprinting only when it is not marked
+    // inert; the pre-click lookup remains strict and will refuse unless the same
+    // control becomes visible and has non-zero area after reveal.
+    const deferred = indexed.filter(({ c }) => !c.ariaHidden && c.tabIndex !== -1);
+    if (deferred.length === 0)
+        return -1;
+    const deferredPayLike = deferred.find(({ c }) => PAY_LABEL.test(c.label));
+    return (deferredPayLike ?? usable[0] ?? deferred[0]).i;
+}
+const PAY_LABEL = /pay|place order|complete order|submit order|buy now/i;
+async function findSubmit(page, opts = {}) {
+    const controls = page.locator('button[type="submit"], input[type="submit"]');
+    const handles = await controls.all().catch(() => []);
+    if (handles.length > 0) {
+        const metas = await Promise.all(handles.map(async (h) => {
+            const text = ((await h.textContent().catch(() => '')) || '').trim();
+            const value = text || (await h.getAttribute('value').catch(() => '')) || '';
+            const ariaHidden = await h.getAttribute('aria-hidden').catch(() => null);
+            const tabIndexRaw = await h.getAttribute('tabindex').catch(() => null);
+            const visible = await h.isVisible().catch(() => false);
+            const box = await h.boundingBox().catch(() => null);
+            return {
+                label: value,
+                ariaHidden: ariaHidden === 'true',
+                tabIndex: tabIndexRaw === null ? null : Number(tabIndexRaw),
+                visible,
+                area: box ? box.width * box.height : 0,
+            };
+        }));
+        const idx = preferredSubmitIndex(metas, opts);
+        if (idx >= 0) {
+            const chosen = handles[idx];
+            const label = metas[idx].label || 'submit';
+            return {
+                desc: `submit button ("${label}")`,
+                fingerprint: await fingerprintSubmitTarget(chosen, 'submit-control', 'submit'),
+                click: () => chosen.click(),
+            };
+        }
     }
     const byText = page.getByRole('button', { name: SUBMIT_TEXT }).first();
     if ((await byText.count().catch(() => 0)) > 0) {
@@ -226,6 +194,19 @@ async function findSubmit(page) {
     }
     return null;
 }
+// The diagnostic snapshot records the page ORIGIN only, never the full URL: a
+// payment-session path/query (e.g. a live Stripe `cs_live_...` checkout-session
+// id) must not be retained in the local receipt, which elsewhere promises
+// "hostname only" (#7101). Falls back to the raw value only if it does not parse
+// as a URL (never a real page.url()).
+export function snapshotOrigin(rawUrl) {
+    try {
+        return new URL(rawUrl).origin;
+    }
+    catch {
+        return '';
+    }
+}
 async function snapshotSummary(page) {
     const info = await page
         .evaluate(() => {
@@ -234,7 +215,7 @@ async function snapshotSummary(page) {
         return { title: document.title, heading: heading?.textContent?.trim() || '', body };
     })
         .catch(() => ({ title: '', heading: '', body: '' }));
-    return `url=${page.url()} title="${info.title}" heading="${info.heading}" body="${info.body}"`;
+    return `url=${snapshotOrigin(page.url())} title="${info.title}" heading="${info.heading}" body="${info.body}"`;
 }
 async function readConfirmationRef(page) {
     const ref = await page
@@ -408,7 +389,7 @@ function unknownPreparedCheckoutResult(reviewId) {
     evidence.step('approval', { approved: false, reviewId, reason: detail });
     return makeResult('failed', {}, evidence, [], detail);
 }
-function makeResult(outcome, fields, evidence, requiresAdapter, detail, confirmationRef) {
+function makeResult(outcome, fields, evidence, requiresAdapter, detail, confirmationRef, failureCode, refusalCode) {
     const steps = evidence.getSteps();
     const approved = steps.find((step) => step.type === 'approval' && step.data.approved === true);
     const minted = steps.find((step) => step.type === 'credential-minted');
@@ -426,6 +407,12 @@ function makeResult(outcome, fields, evidence, requiresAdapter, detail, confirma
             : filledRoles.has('number') || filledRoles.has('cvc')
                 ? 'partially-exposed'
                 : 'minted-not-exposed';
+    const terminalFailureCode = failureCode ??
+        (outcome === 'action-required'
+            ? 'human-action-required'
+            : outcome === 'blocked-by-mandate'
+                ? 'mandate-blocked'
+                : undefined);
     return {
         outcome,
         fields,
@@ -440,12 +427,34 @@ function makeResult(outcome, fields, evidence, requiresAdapter, detail, confirma
                 : {}),
             ...(completed ? { fillCompletedAt: completed.ts } : {}),
         },
+        ...(terminalFailureCode ? { failureCode: terminalFailureCode } : {}),
+        ...(refusalCode ? { refusalCode } : {}),
         ...(detail ? { detail } : {}),
         ...(confirmationRef ? { confirmationRef } : {}),
     };
 }
-async function readTransactionFacts(page, opts) {
-    const pageAmount = await readPageAmount(page);
+// Shopify computes shipping and tax asynchronously after the delivery address
+// lands; a settled, reconciled summary can take well over the default 6s on a
+// cold checkout. Review is free and safe to wait on; approval and pre-submit
+// keep the strict short window because they only confirm an already-settled page.
+const SHOPIFY_REVIEW_SETTLE_MS = 20_000;
+async function readTransactionFacts(page, opts, phase) {
+    const shopify = await isShopifyCheckoutPage(page);
+    const amountRead = shopify
+        ? phase === 'review'
+            ? await readStableShopifyAmount(page, SHOPIFY_REVIEW_SETTLE_MS, {
+                // A trusted UCP handoff carries the merchant-settled total; a page
+                // that omits a tax row must match it before the review trusts it.
+                expectedMinor: opts.trustedMerchantIdentity ? (opts.amountMinor ?? null) : null,
+            })
+            : await readShopifyAmount(page, true)
+        : await readGenericPageAmount(page);
+    const pageAmount = shopify && amountRead.kind === 'none'
+        ? {
+            kind: 'unreadable',
+            reason: 'Shopify final tax and total summary is not available',
+        }
+        : amountRead;
     const amountMinor = pageAmount.kind === 'ok'
         ? pageAmount.amountMinor
         : pageAmount.kind === 'none'
@@ -473,11 +482,12 @@ async function readTransactionFacts(page, opts) {
             amountMinor,
             currency,
             source,
+            code: 'amount_unreadable',
             reason: pageAmount.kind === 'unreadable'
-                ? 'page total is displayed but cannot be parsed unambiguously'
+                ? (pageAmount.reason ?? 'page total is displayed but cannot be parsed unambiguously')
                 : 'transaction amount could not be determined',
             detail: pageAmount.kind === 'unreadable'
-                ? 'transaction amount could not be determined (page total present but ambiguous, e.g. separator layout); refusing fail-closed'
+                ? `transaction amount could not be determined (${pageAmount.reason ?? 'page total present but ambiguous'}); refusing fail-closed`
                 : 'transaction amount could not be determined (no readable page total, no amountMinor provided); refusing fail-closed',
         };
     }
@@ -487,6 +497,7 @@ async function readTransactionFacts(page, opts) {
             amountMinor,
             currency,
             source,
+            code: 'currency_unreadable',
             reason: 'transaction currency could not be determined',
             detail: 'transaction currency could not be determined (page total does not state one unambiguously, no currency asserted by the caller); refusing fail-closed',
         };
@@ -501,7 +512,10 @@ function recordTransactionFacts(evidence, phase, facts) {
         currency: facts.currency,
     });
 }
-function reviewChangeReason(review, merchantHost, facts) {
+function reviewChangeReason(review, merchantHost, facts, merchantOrigin) {
+    if (review.merchantOrigin && merchantOrigin !== review.merchantOrigin) {
+        return `merchant origin changed after review: ${review.merchantOrigin} -> ${merchantOrigin ?? 'invalid'}`;
+    }
     if (merchantHost !== review.merchantHost) {
         return `merchant changed after review: ${review.merchantHost} -> ${merchantHost}`;
     }
@@ -513,6 +527,113 @@ function reviewChangeReason(review, merchantHost, facts) {
     }
     return null;
 }
+function exactOrigin(value) {
+    try {
+        const url = new URL(value);
+        if (url.protocol !== 'https:' || url.username || url.password)
+            return null;
+        return url.origin.toLowerCase();
+    }
+    catch {
+        return null;
+    }
+}
+export function trustedMerchantOriginVerdict(options, pageUrl, expectedOrigin) {
+    const identity = options.trustedMerchantIdentity;
+    if (!identity)
+        return null;
+    if (Date.parse(identity.expiresAt) <= Date.now()) {
+        return { code: 'trusted_handoff_expired', reason: 'trusted UCP checkout handoff expired' };
+    }
+    const origin = exactOrigin(pageUrl);
+    if (!origin) {
+        return {
+            code: 'trusted_origin_insecure',
+            reason: 'trusted UCP checkout reached a non-HTTPS or credentialed origin',
+        };
+    }
+    if (expectedOrigin) {
+        return origin === expectedOrigin
+            ? null
+            : {
+                code: 'trusted_origin_changed',
+                reason: `merchant origin changed after review: ${expectedOrigin} -> ${origin}`,
+            };
+    }
+    return identity.allowedOrigins.includes(origin)
+        ? null
+        : {
+            code: 'trusted_origin_undeclared',
+            reason: `trusted UCP checkout reached undeclared origin ${origin}`,
+        };
+}
+export function trustedMerchantOriginRefusal(options, pageUrl, expectedOrigin) {
+    return trustedMerchantOriginVerdict(options, pageUrl, expectedOrigin)?.reason ?? null;
+}
+function wwwNormalizedHost(host) {
+    return host.toLowerCase().replace(/^www\./, '');
+}
+const MYSHOPIFY_SERVICE_HOST = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.myshopify\.com$/;
+/**
+ * Bind the storefront a trusted UCP continuation actually lands on (#8669).
+ *
+ * The merchant published its UCP business profile at its own business origin
+ * and declared the permanent `*.myshopify.com` service that issued the
+ * continuation; the CLI verified both before minting the handoff. That is
+ * independently verified merchant provenance, so the review may bind the final
+ * page origin when, and only when: the navigation started on that declared
+ * myshopify origin, the final origin is plain HTTPS, and its host is the
+ * declared business host modulo a leading `www.` label. The redirect chain in
+ * between (Shopify's primary-domain hop, its shop.app bounce, #8496) carries no
+ * authority either way: a redirect cannot land on the merchant's own business
+ * domain unless the merchant controls it, and any other final host stays an
+ * undeclared origin. Shopify's `primary_domain_redirection` proof is recorded
+ * as evidence when present but is not required.
+ */
+export function trustedShopifyAliasOrigin(args) {
+    let initial;
+    let final;
+    try {
+        initial = new URL(args.initialUrl);
+        final = new URL(args.finalUrl);
+    }
+    catch {
+        return null;
+    }
+    if (initial.protocol !== 'https:' || final.protocol !== 'https:')
+        return null;
+    if (final.username || final.password || final.port)
+        return null;
+    const initialHost = initial.hostname.toLowerCase();
+    const finalHost = final.hostname.toLowerCase();
+    if (!MYSHOPIFY_SERVICE_HOST.test(initialHost) || initialHost === finalHost)
+        return null;
+    // A declared origin is held to the same standard as the final one: plain
+    // HTTPS, default port, no credentials. Anything else never contributes a
+    // host, so the identity stays an origin set rather than widening to a host.
+    const declared = args.allowedOrigins.flatMap((candidate) => {
+        try {
+            const url = new URL(candidate);
+            return url.protocol === 'https:' && !url.username && !url.password && !url.port
+                ? [url.hostname.toLowerCase()]
+                : [];
+        }
+        catch {
+            return [];
+        }
+    });
+    if (!declared.includes(initialHost))
+        return null;
+    const declaredBusiness = declared.some((host) => host !== initialHost &&
+        !MYSHOPIFY_SERVICE_HOST.test(host) &&
+        wwwNormalizedHost(host) === wwwNormalizedHost(finalHost));
+    return declaredBusiness ? final.origin.toLowerCase() : null;
+}
+function mandateForPage(options, pageUrl) {
+    if (!options.trustedMerchantIdentity)
+        return options.mandate;
+    return { ...options.mandate, merchantHost: new URL(pageUrl).hostname };
+}
 function submitTargetChangeReason(review, current) {
     const reviewed = review.submitTargetFingerprint;
     if (!reviewed && !current)
@@ -729,9 +850,31 @@ export async function prepareCheckout(opts, store = defaultPreparedCheckoutStore
     const options = {
         ...opts,
         mandate: { ...opts.mandate },
+        ...(opts.trustedMerchantIdentity
+            ? {
+                trustedMerchantIdentity: Object.freeze({
+                    ...opts.trustedMerchantIdentity,
+                    allowedOrigins: Object.freeze([...opts.trustedMerchantIdentity.allowedOrigins]),
+                }),
+            }
+            : {}),
     };
     const evidence = new EvidenceLog();
-    const context = await options.browser.newContext();
+    // Pin an English locale: amount reconciliation reads the order summary by
+    // its visible labels (Subtotal/Taxes/Total), and merchants localize by
+    // Accept-Language (observed live 2026-08-16: a Shopify checkout redirected
+    // to /es-us and rendered "Impuestos estimados", so the total never parsed
+    // and the review refused fail-closed on a perfectly good checkout).
+    // Present Web Bot Auth (RFC 9421) credentials when, and only when, an
+    // operator directory is configured to resolve them. Off by default: an
+    // unresolvable signature fails verification and is worse than none. The
+    // signature covers @authority, so it is bound to the checkout host — a
+    // cross-origin redirect simply arrives unverified, never wrongly verified.
+    const webBotAuthHeaders = webBotAuthHeadersOrNone(options.webBotAuth ?? null, options.url, Date.now() / 1000);
+    const context = await options.browser.newContext({
+        locale: 'en-US',
+        ...(webBotAuthHeaders ? { extraHTTPHeaders: webBotAuthHeaders } : {}),
+    });
     // Bound every action so a mis-detected or hidden element fails fast instead
     // of stalling on Playwright's long default timeout.
     context.setDefaultTimeout(6000);
@@ -745,12 +888,84 @@ export async function prepareCheckout(opts, store = defaultPreparedCheckoutStore
     let fields = {};
     let keepOpen = false;
     try {
-        evidence.step('navigation', { url: options.url });
-        await page.goto(options.url, { waitUntil: 'domcontentloaded' });
+        evidence.step('navigation', {
+            url: options.trustedMerchantIdentity ? exactOrigin(options.url) : options.url,
+        });
+        const navigationResponse = await page.goto(options.url, { waitUntil: 'domcontentloaded' });
         await waitForStableDom(page);
-        evidence.step('dom-stable', { url: page.url() });
-        const merchantHost = new URL(page.url()).hostname;
-        const preFill = checkMandatePreFill(options.mandate, {
+        evidence.step('dom-stable', {
+            url: options.trustedMerchantIdentity ? exactOrigin(page.url()) : page.url(),
+        });
+        let merchantHost = new URL(page.url()).hostname;
+        let initialOriginVerdict = trustedMerchantOriginVerdict(options, page.url());
+        if (initialOriginVerdict?.code === 'trusted_origin_undeclared' &&
+            options.trustedMerchantIdentity) {
+            // #8669: the trusted path never got the Shopify primary-domain proof the
+            // generic path has carried since #8469, so every declared-business
+            // storefront that Shopify serves from its primary domain refused here.
+            const aliasOrigin = trustedShopifyAliasOrigin({
+                allowedOrigins: options.trustedMerchantIdentity.allowedOrigins,
+                initialUrl: options.url,
+                finalUrl: page.url(),
+                redirects: await navigationRedirectEvidence(navigationResponse),
+            });
+            if (aliasOrigin) {
+                evidence.step('note', {
+                    kind: 'shopify-primary-domain-alias',
+                    trusted: true,
+                    continuationHost: new URL(options.url).hostname,
+                    checkoutHost: new URL(aliasOrigin).hostname,
+                    shopifyProof: shopifyPrimaryDomainAlias({
+                        mandateHost: new URL(options.url).hostname,
+                        initialUrl: options.url,
+                        finalUrl: page.url(),
+                        redirects: await navigationRedirectEvidence(navigationResponse),
+                    }) !== null,
+                });
+                options.trustedMerchantIdentity = Object.freeze({
+                    ...options.trustedMerchantIdentity,
+                    allowedOrigins: Object.freeze([
+                        ...options.trustedMerchantIdentity.allowedOrigins,
+                        aliasOrigin,
+                    ]),
+                });
+                initialOriginVerdict = trustedMerchantOriginVerdict(options, page.url());
+            }
+        }
+        if (initialOriginVerdict) {
+            evidence.step('mandate-verdict', {
+                phase: 'trusted-origin',
+                ok: false,
+                reason: initialOriginVerdict.reason,
+                code: initialOriginVerdict.code,
+            });
+            evidence.setSnapshotSummary(await snapshotSummary(page));
+            return {
+                status: 'finished',
+                result: makeResult('blocked-by-mandate', fields, evidence, requiresAdapter, initialOriginVerdict.reason, undefined, undefined, initialOriginVerdict.code),
+            };
+        }
+        if (!options.trustedMerchantIdentity) {
+            const shopifyAlias = shopifyPrimaryDomainAlias({
+                mandateHost: options.mandate.merchantHost,
+                initialUrl: options.url,
+                finalUrl: page.url(),
+                redirects: await navigationRedirectEvidence(navigationResponse),
+            });
+            if (shopifyAlias) {
+                evidence.step('note', {
+                    kind: 'shopify-primary-domain-alias',
+                    mandateHost: options.mandate.merchantHost,
+                    checkoutHost: shopifyAlias,
+                });
+                // The proof is collected before any credential is minted. Bind this
+                // prepared session to Shopify's primary storefront host so every later
+                // approval and pre-submit revalidation stays strict on that host.
+                options.mandate = { ...options.mandate, merchantHost: shopifyAlias };
+            }
+        }
+        let reviewedOrigin;
+        const preFill = checkMandatePreFill(mandateForPage(options, page.url()), {
             merchantHost,
             currency: options.currency ?? null,
         });
@@ -759,7 +974,7 @@ export async function prepareCheckout(opts, store = defaultPreparedCheckoutStore
             evidence.setSnapshotSummary(await snapshotSummary(page));
             return {
                 status: 'finished',
-                result: makeResult('blocked-by-mandate', fields, evidence, requiresAdapter, preFill.reason),
+                result: makeResult('blocked-by-mandate', fields, evidence, requiresAdapter, preFill.reason, undefined, undefined, preFill.code),
             };
         }
         // Payer-chosen amount (Stripe payment links): an empty customUnitAmount
@@ -787,7 +1002,118 @@ export async function prepareCheckout(opts, store = defaultPreparedCheckoutStore
         }
         // Detection is read-only here. In particular, no adapter fill and no
         // Instrument.getCredential() call can occur before an explicit approval.
-        const detected = await detectFields(page);
+        let detected = await detectFields(page);
+        const shopifyPage = await isShopifyCheckoutPage(page);
+        if (shopifyPage) {
+            // Same checkout session, English presentation — the amount reader needs
+            // the English summary labels (see shopifyEnglishCheckoutUrl).
+            const englishUrl = shopifyEnglishCheckoutUrl(page.url());
+            if (englishUrl) {
+                await page.goto(englishUrl, { waitUntil: 'domcontentloaded' }).catch(() => { });
+                await waitForStableDom(page);
+                if (await isShopifyCheckoutPage(page)) {
+                    evidence.step('navigation', {
+                        url: options.trustedMerchantIdentity ? exactOrigin(page.url()) : page.url(),
+                        reason: 'shopify-locale-normalized',
+                    });
+                    detected = await detectFields(page);
+                }
+            }
+        }
+        let adapter = selectAdapter(detected, { shopify: shopifyPage });
+        if (options.contact && adapter.prepareContact) {
+            const recordPrefill = async (contact) => {
+                const result = await adapter.prepareContact(page, contact);
+                for (const field of result.filled) {
+                    evidence.step('contact-prefill', {
+                        role: field.role,
+                        confidence: field.confidence,
+                        source: field.source,
+                        frame: field.frame,
+                        value: field.value,
+                        ok: field.ok,
+                        error: field.error,
+                    });
+                }
+                return result;
+            };
+            let preparedContact = await recordPrefill(options.contact);
+            if (shopifyPage && options.checkoutRoute === 'guest-card') {
+                const guest = await ensureShopifyGuestCheckout(page);
+                evidence.step('note', {
+                    phase: 'contact-prefill',
+                    checkoutRoute: options.checkoutRoute,
+                    shopifyGuestStatus: guest.status,
+                    signal: guest.signal,
+                });
+                if (guest.status === 'action-required') {
+                    evidence.step('outcome', {
+                        outcome: 'action-required',
+                        signal: guest.signal,
+                        phase: 'contact-prefill',
+                    });
+                    evidence.setSnapshotSummary(await snapshotSummary(page));
+                    return {
+                        status: 'finished',
+                        result: makeResult('action-required', fields, evidence, requiresAdapter, guest.detail, undefined, 'human-action-required'),
+                    };
+                }
+                if (guest.status === 'transitioned') {
+                    // Do not write the recognized email a second time: Shopify can open
+                    // the same modal on every email input event. Only retry contact fill
+                    // when the takeover interrupted it, and omit email on that retry.
+                    if (!preparedContact.ok) {
+                        await settle(page);
+                        detected = await detectFields(page);
+                        adapter = selectAdapter(detected, { shopify: true });
+                        preparedContact = await recordPrefill({ ...options.contact, email: undefined });
+                    }
+                    const verifiedGuest = await assertShopifyGuestCheckout(page);
+                    if (verifiedGuest.status === 'action-required') {
+                        evidence.step('outcome', {
+                            outcome: 'action-required',
+                            signal: verifiedGuest.signal,
+                            phase: 'contact-prefill-guest-verification',
+                        });
+                        evidence.setSnapshotSummary(await snapshotSummary(page));
+                        return {
+                            status: 'finished',
+                            result: makeResult('action-required', fields, evidence, requiresAdapter, verifiedGuest.detail, undefined, 'human-action-required'),
+                        };
+                    }
+                }
+            }
+            if (!preparedContact.ok) {
+                evidence.setSnapshotSummary(await snapshotSummary(page));
+                return {
+                    status: 'finished',
+                    result: makeResult('failed', fields, evidence, requiresAdapter, preparedContact.detail ??
+                        'Shopify contact prefill did not complete; no payment credential was requested'),
+                };
+            }
+            await settle(page);
+            const prefillHost = new URL(page.url()).hostname;
+            const trustedPrefillVerdict = trustedMerchantOriginVerdict(options, page.url());
+            if (trustedPrefillVerdict || prefillHost !== merchantHost) {
+                const reason = trustedPrefillVerdict?.reason ??
+                    `merchant changed during contact prefill: ${merchantHost} -> ${prefillHost}`;
+                const code = trustedPrefillVerdict?.code ?? 'merchant_host_mismatch';
+                evidence.step('mandate-verdict', {
+                    phase: 'contact-prefill',
+                    ok: false,
+                    reason,
+                    code,
+                });
+                evidence.setSnapshotSummary(await snapshotSummary(page));
+                return {
+                    status: 'finished',
+                    result: makeResult('blocked-by-mandate', fields, evidence, requiresAdapter, reason, undefined, undefined, code),
+                };
+            }
+            detected = await detectFields(page);
+            adapter = selectAdapter(detected, { shopify: shopifyPage });
+            evidence.step('adapter-selected', { adapter: adapter.name, phase: 'review' });
+        }
         fields = detected.fields;
         evidence.step('detect', {
             phase: 'review',
@@ -801,17 +1127,58 @@ export async function prepareCheckout(opts, store = defaultPreparedCheckoutStore
                 evidence.step('psp-detected', { psp: p.psp, requiresAdapter: p.requiresAdapter });
             }
         }
-        const facts = await readTransactionFacts(page, options);
+        // A checkout the runner cannot put a card INTO is not reviewable. Without a
+        // detected card-number field a later pay would fill nothing and dispatch
+        // whatever control the review happened to bind (observed live 2026-08-16:
+        // a Payhip storefront SEARCH form, a FastSpring "PayPal Checkout" label,
+        // and a Shopify discount-form "Submit" all reviewed clean this way — the
+        // real card fields sat in unreachable PSP iframes or an unrendered payment
+        // section). Every adapter fills from this same detection, so a missing
+        // number field here means no pay can ever succeed: refuse while it is
+        // still free.
+        if (!fields.number) {
+            const found = Object.keys(fields);
+            const reason = `no card number field detected (roles found: ${found.length ? found.join(', ') : 'none'}) — ` +
+                'the card form is likely inside a PSP iframe or behind a later step, so a credential cannot be entered on this page';
+            evidence.step('detect', { phase: 'review', missingCardNumber: true, reason });
+            evidence.setSnapshotSummary(await snapshotSummary(page));
+            return {
+                status: 'finished',
+                result: makeResult('failed', fields, evidence, requiresAdapter, reason, undefined, 'card-number-field-unavailable'),
+            };
+        }
+        // Contact/shipping and Shopify locale normalization may legitimately move
+        // between the exact service and business origins authorized by UCP. Freeze
+        // whichever declared origin is actually on-screen only after those
+        // credential-free steps, then require that exact origin for approval,
+        // credential fill, and submit.
+        const reviewOriginVerdict = trustedMerchantOriginVerdict(options, page.url());
+        if (reviewOriginVerdict) {
+            evidence.step('mandate-verdict', {
+                phase: 'review-origin',
+                ok: false,
+                reason: reviewOriginVerdict.reason,
+                code: reviewOriginVerdict.code,
+            });
+            evidence.setSnapshotSummary(await snapshotSummary(page));
+            return {
+                status: 'finished',
+                result: makeResult('blocked-by-mandate', fields, evidence, requiresAdapter, reviewOriginVerdict.reason, undefined, undefined, reviewOriginVerdict.code),
+            };
+        }
+        merchantHost = new URL(page.url()).hostname;
+        reviewedOrigin = options.trustedMerchantIdentity ? exactOrigin(page.url()) : undefined;
+        const facts = await readTransactionFacts(page, options, 'review');
         recordTransactionFacts(evidence, 'review', facts);
         if (!facts.ok) {
             evidence.step('mandate-verdict', { phase: 'review', ok: false, reason: facts.reason });
             evidence.setSnapshotSummary(await snapshotSummary(page));
             return {
                 status: 'finished',
-                result: makeResult('blocked-by-mandate', fields, evidence, requiresAdapter, facts.detail),
+                result: makeResult('blocked-by-mandate', fields, evidence, requiresAdapter, facts.detail, undefined, undefined, facts.code),
             };
         }
-        const verdict = checkMandate(options.mandate, {
+        const verdict = checkMandate(mandateForPage(options, page.url()), {
             merchantHost,
             amountMinor: facts.amountMinor,
             currency: facts.currency,
@@ -821,14 +1188,21 @@ export async function prepareCheckout(opts, store = defaultPreparedCheckoutStore
             evidence.setSnapshotSummary(await snapshotSummary(page));
             return {
                 status: 'finished',
-                result: makeResult('blocked-by-mandate', fields, evidence, requiresAdapter, verdict.reason),
+                result: makeResult('blocked-by-mandate', fields, evidence, requiresAdapter, verdict.reason, undefined, undefined, verdict.code),
             };
         }
-        const submit = await findSubmit(page);
+        // Multi-step pages may expose the final submit control in a hidden section
+        // before a safe Continue reveals it. Fingerprint that exact control for the
+        // human review; the eventual click path still requires it to be usable.
+        const submit = await findSubmit(page, { allowDeferred: true });
         const review = Object.freeze({
             id: randomUUID(),
-            url: page.url(),
+            // A UCP continuation may contain a bearer-like path/query. The live page
+            // stays in the process-bound store; serializable review facts expose only
+            // the exact reviewed origin.
+            url: reviewedOrigin ?? page.url(),
             merchantHost,
+            ...(reviewedOrigin ? { merchantOrigin: reviewedOrigin } : {}),
             amountMinor: facts.amountMinor,
             currency: facts.currency,
             mandateMaxAmountMinor: options.mandate.maxAmountMinor,
@@ -836,6 +1210,7 @@ export async function prepareCheckout(opts, store = defaultPreparedCheckoutStore
             submitTarget: submit?.desc ?? null,
             submitTargetFingerprint: submit ? Object.freeze({ ...submit.fingerprint }) : null,
             detectedRoles: Object.freeze(Object.keys(fields)),
+            checkoutRoute: options.checkoutRoute,
         });
         evidence.step('review', {
             reviewId: review.id,
@@ -845,12 +1220,14 @@ export async function prepareCheckout(opts, store = defaultPreparedCheckoutStore
             submitTarget: review.submitTarget,
             submitTargetFingerprint: review.submitTargetFingerprint,
             detectedRoles: review.detectedRoles,
+            checkoutRoute: review.checkoutRoute,
         });
         const checkout = Object.freeze({
             review,
             fields: Object.freeze({ ...fields }),
             evidence,
             requiresAdapter: Object.freeze([...requiresAdapter]),
+            checkoutRoute: options.checkoutRoute,
         });
         store.put(review.id, {
             checkout,
@@ -902,7 +1279,18 @@ export async function submitApprovedCheckout(reviewId, opts, store = defaultPrep
         // the credential boundary. A changed checkout requires a fresh review.
         await waitForStableDom(page);
         const merchantHost = new URL(page.url()).hostname;
-        const preFill = checkMandatePreFill(options.mandate, {
+        const approvalOriginVerdict = trustedMerchantOriginVerdict(options, page.url(), checkout.review.merchantOrigin);
+        if (approvalOriginVerdict) {
+            evidence.step('mandate-verdict', {
+                phase: 'approval-origin',
+                ok: false,
+                reason: approvalOriginVerdict.reason,
+                code: approvalOriginVerdict.code,
+            });
+            evidence.setSnapshotSummary(await snapshotSummary(page));
+            return makeResult('blocked-by-mandate', state.fields, evidence, requiresAdapter, approvalOriginVerdict.reason, undefined, undefined, approvalOriginVerdict.code);
+        }
+        const preFill = checkMandatePreFill(mandateForPage(options, page.url()), {
             merchantHost,
             currency: options.currency ?? null,
         });
@@ -910,9 +1298,9 @@ export async function submitApprovedCheckout(reviewId, opts, store = defaultPrep
         if (!preFill.ok) {
             evidence.step('approval', { approved: false, reviewId: checkout.review.id });
             evidence.setSnapshotSummary(await snapshotSummary(page));
-            return makeResult('blocked-by-mandate', state.fields, evidence, requiresAdapter, preFill.reason);
+            return makeResult('blocked-by-mandate', state.fields, evidence, requiresAdapter, preFill.reason, undefined, undefined, preFill.code);
         }
-        const approvedFacts = await readTransactionFacts(page, options);
+        const approvedFacts = await readTransactionFacts(page, options, 'approval');
         recordTransactionFacts(evidence, 'approval', approvedFacts);
         if (!approvedFacts.ok) {
             evidence.step('mandate-verdict', {
@@ -922,9 +1310,9 @@ export async function submitApprovedCheckout(reviewId, opts, store = defaultPrep
             });
             evidence.step('approval', { approved: false, reviewId: checkout.review.id });
             evidence.setSnapshotSummary(await snapshotSummary(page));
-            return makeResult('blocked-by-mandate', state.fields, evidence, requiresAdapter, approvedFacts.detail);
+            return makeResult('blocked-by-mandate', state.fields, evidence, requiresAdapter, approvedFacts.detail, undefined, undefined, approvedFacts.code);
         }
-        const approvalVerdict = checkMandate(options.mandate, {
+        const approvalVerdict = checkMandate(mandateForPage(options, page.url()), {
             merchantHost,
             amountMinor: approvedFacts.amountMinor,
             currency: approvedFacts.currency,
@@ -933,9 +1321,9 @@ export async function submitApprovedCheckout(reviewId, opts, store = defaultPrep
         if (!approvalVerdict.ok) {
             evidence.step('approval', { approved: false, reviewId: checkout.review.id });
             evidence.setSnapshotSummary(await snapshotSummary(page));
-            return makeResult('blocked-by-mandate', state.fields, evidence, requiresAdapter, approvalVerdict.reason);
+            return makeResult('blocked-by-mandate', state.fields, evidence, requiresAdapter, approvalVerdict.reason, undefined, undefined, approvalVerdict.code);
         }
-        const changedAtApproval = reviewChangeReason(checkout.review, merchantHost, approvedFacts);
+        const changedAtApproval = reviewChangeReason(checkout.review, merchantHost, approvedFacts, exactOrigin(page.url()) ?? undefined);
         if (changedAtApproval) {
             evidence.step('approval', {
                 approved: false,
@@ -943,9 +1331,12 @@ export async function submitApprovedCheckout(reviewId, opts, store = defaultPrep
                 reason: changedAtApproval,
             });
             evidence.setSnapshotSummary(await snapshotSummary(page));
-            return makeResult('blocked-by-mandate', state.fields, evidence, requiresAdapter, changedAtApproval);
+            return makeResult('blocked-by-mandate', state.fields, evidence, requiresAdapter, changedAtApproval, undefined, undefined, 'review_facts_changed');
         }
-        const approvalSubmit = await findSubmit(page);
+        // Revalidate the same future target before credential minting. This may be
+        // hidden on a multi-step checkout; the final lookup after reveal requires
+        // the reviewed control to be visible and usable before any click.
+        const approvalSubmit = await findSubmit(page, { allowDeferred: true });
         const submitChangedAtApproval = submitTargetChangeReason(checkout.review, approvalSubmit);
         if (submitChangedAtApproval) {
             evidence.step('approval', {
@@ -954,7 +1345,7 @@ export async function submitApprovedCheckout(reviewId, opts, store = defaultPrep
                 reason: submitChangedAtApproval,
             });
             evidence.setSnapshotSummary(await snapshotSummary(page));
-            return makeResult('blocked-by-mandate', state.fields, evidence, requiresAdapter, submitChangedAtApproval);
+            return makeResult('blocked-by-mandate', state.fields, evidence, requiresAdapter, submitChangedAtApproval, undefined, undefined, 'review_facts_changed');
         }
         if (opts.mode === 'submit' && !approvalSubmit) {
             const reason = 'no submit target was available for human review';
@@ -967,6 +1358,34 @@ export async function submitApprovedCheckout(reviewId, opts, store = defaultPrep
             return makeResult('blocked-by-mandate', state.fields, evidence, requiresAdapter, reason);
         }
         evidence.step('approval', { approved: true, reviewId: checkout.review.id });
+        if (opts.mode === 'dry-run') {
+            evidence.step('credential-skipped', {
+                reason: 'dry-run stops before credential mint or merchant-page disclosure',
+            });
+            evidence.step('submit', { would: true, target: approvalSubmit?.desc ?? 'none found' });
+            evidence.setSnapshotSummary(await snapshotSummary(page));
+            return makeResult('reviewed-dry-run', state.fields, evidence, requiresAdapter, approvalSubmit
+                ? `validated the reviewed checkout; would click ${approvalSubmit.desc}`
+                : 'validated the reviewed checkout; no submit control detected');
+        }
+        if (options.checkoutRoute === 'guest-card' && (await isShopifyCheckoutPage(page))) {
+            const guest = await assertShopifyGuestCheckout(page);
+            evidence.step('note', {
+                phase: 'pre-credential',
+                checkoutRoute: options.checkoutRoute,
+                shopifyGuestStatus: guest.status,
+                signal: guest.signal,
+            });
+            if (guest.status === 'action-required') {
+                evidence.step('outcome', {
+                    outcome: 'action-required',
+                    signal: guest.signal,
+                    phase: 'pre-credential',
+                });
+                evidence.setSnapshotSummary(await snapshotSummary(page));
+                return makeResult('action-required', state.fields, evidence, requiresAdapter, guest.detail, undefined, 'human-action-required');
+            }
+        }
         const credential = await opts.instrument.getCredential({
             merchantHost,
             amountMinor: approvedFacts.amountMinor,
@@ -976,17 +1395,23 @@ export async function submitApprovedCheckout(reviewId, opts, store = defaultPrep
             ...(credential.credentialExpiresAt
                 ? { credentialExpiresAt: credential.credentialExpiresAt }
                 : {}),
+            ...traceHandleFields(credential),
         });
         // Reveal + fill loop: fills whatever is present, then reveals the next
         // surface (card radio / next step) until the card number is filled.
         const clicked = new Set();
         let adapterName = null;
+        let adapterFillOk = true;
+        let adapterFillDetail = null;
         for (let attempt = 0; attempt < 4; attempt++) {
             // A reveal/continue action can navigate between attempts. Never expose
             // the credential to a host other than the one the human reviewed.
             const fillHost = new URL(page.url()).hostname;
-            if (fillHost !== checkout.review.merchantHost) {
-                const reason = `merchant changed after review: ${checkout.review.merchantHost} -> ${fillHost}`;
+            const fillOriginRefusal = trustedMerchantOriginRefusal(options, page.url(), checkout.review.merchantOrigin);
+            if (fillOriginRefusal ||
+                (!checkout.review.merchantOrigin && fillHost !== checkout.review.merchantHost)) {
+                const reason = fillOriginRefusal ??
+                    `merchant changed after review: ${checkout.review.merchantHost} -> ${fillHost}`;
                 evidence.step('mandate-verdict', {
                     phase: 'approved-submit',
                     ok: false,
@@ -1009,12 +1434,16 @@ export async function submitApprovedCheckout(reviewId, opts, store = defaultPrep
                     evidence.step('psp-detected', { psp: p.psp, requiresAdapter: p.requiresAdapter });
                 }
             }
-            const adapter = selectAdapter(detected);
+            const adapter = selectAdapter(detected, {
+                shopify: await isShopifyCheckoutPage(page),
+            });
             if (adapter.name !== adapterName) {
                 adapterName = adapter.name;
                 evidence.step('adapter-selected', { adapter: adapter.name });
             }
             const fill = await adapter.fill(page, detected.fields, credential, opts.contact);
+            adapterFillOk = fill.ok;
+            adapterFillDetail = fill.detail ?? null;
             for (const f of fill.filled) {
                 evidence.step('field-fill', {
                     role: f.role,
@@ -1024,6 +1453,7 @@ export async function submitApprovedCheckout(reviewId, opts, store = defaultPrep
                     value: f.value,
                     ok: f.ok,
                     error: f.error,
+                    ...(f.relocated ? { relocated: true } : {}),
                 });
             }
             const numberOk = fill.filled.some((f) => f.role === 'number' && f.ok);
@@ -1046,9 +1476,30 @@ export async function submitApprovedCheckout(reviewId, opts, store = defaultPrep
                 ? []
                 : ['expiry']),
         ];
+        // Roles the adapter TRIED to fill and never landed, across every reveal
+        // attempt. A job only exists when the field was detected, was visible, and
+        // we held a value for it (see `add()` in adapters/generic.ts) — so a failure
+        // here is never "the page didn't ask for it". It means the page asked, we
+        // answered, and the element refused.
+        //
+        // Roles that failed on an early attempt and succeeded after a reveal are
+        // excluded: `successfulRoles` spans all four attempts, same as above.
+        const failedFillRoles = [
+            ...new Set(evidence
+                .getSteps()
+                .filter((step) => step.type === 'field-fill' && step.data.ok === false)
+                .map((step) => String(step.data.role))),
+        ]
+            .filter((role) => !successfulRoles.has(role))
+            .sort();
         evidence.step('fill-complete', {
-            ok: missingCredentialRoles.length === 0,
+            // "Ready to submit", not "the card fields landed". Before 2026-08-17 this
+            // read only the credential roles, so a whop.com run whose city/state/
+            // postalCode all timed out recorded `ok: true` and clicked Get access on
+            // a form it knew was incomplete.
+            ok: missingCredentialRoles.length === 0 && failedFillRoles.length === 0,
             missingCredentialRoles,
+            failedFillRoles,
         });
         if (options.debugShotsDir) {
             await captureDebugShot(page, options.debugShotsDir, checkout.review.id, '2-filled', evidence, state.fields);
@@ -1056,7 +1507,7 @@ export async function submitApprovedCheckout(reviewId, opts, store = defaultPrep
         // Re-run the full gate after fill as well. Contact/shipping fields can
         // change the total; any drift from the approved review refuses before a
         // submit click and requires the caller to prepare a new review.
-        const submitFacts = await readTransactionFacts(page, options);
+        const submitFacts = await readTransactionFacts(page, options, 'pre-submit');
         recordTransactionFacts(evidence, 'pre-submit', submitFacts);
         if (!submitFacts.ok) {
             evidence.step('mandate-verdict', {
@@ -1065,10 +1516,21 @@ export async function submitApprovedCheckout(reviewId, opts, store = defaultPrep
                 reason: submitFacts.reason,
             });
             evidence.setSnapshotSummary(await snapshotSummary(page));
-            return makeResult('blocked-by-mandate', state.fields, evidence, requiresAdapter, submitFacts.detail);
+            return makeResult('blocked-by-mandate', state.fields, evidence, requiresAdapter, submitFacts.detail, undefined, undefined, submitFacts.code);
         }
         const submitMerchantHost = new URL(page.url()).hostname;
-        const verdict = checkMandate(options.mandate, {
+        const submitOriginVerdict = trustedMerchantOriginVerdict(options, page.url(), checkout.review.merchantOrigin);
+        if (submitOriginVerdict) {
+            evidence.step('mandate-verdict', {
+                phase: 'pre-submit-origin',
+                ok: false,
+                reason: submitOriginVerdict.reason,
+                code: submitOriginVerdict.code,
+            });
+            evidence.setSnapshotSummary(await snapshotSummary(page));
+            return makeResult('blocked-by-mandate', state.fields, evidence, requiresAdapter, submitOriginVerdict.reason, undefined, undefined, submitOriginVerdict.code);
+        }
+        const verdict = checkMandate(mandateForPage(options, page.url()), {
             merchantHost: submitMerchantHost,
             amountMinor: submitFacts.amountMinor,
             currency: submitFacts.currency,
@@ -1076,9 +1538,9 @@ export async function submitApprovedCheckout(reviewId, opts, store = defaultPrep
         evidence.step('mandate-verdict', { phase: 'pre-submit', ...verdict });
         if (!verdict.ok) {
             evidence.setSnapshotSummary(await snapshotSummary(page));
-            return makeResult('blocked-by-mandate', state.fields, evidence, requiresAdapter, verdict.reason);
+            return makeResult('blocked-by-mandate', state.fields, evidence, requiresAdapter, verdict.reason, undefined, undefined, verdict.code);
         }
-        const changedBeforeSubmit = reviewChangeReason(checkout.review, submitMerchantHost, submitFacts);
+        const changedBeforeSubmit = reviewChangeReason(checkout.review, submitMerchantHost, submitFacts, exactOrigin(page.url()) ?? undefined);
         if (changedBeforeSubmit) {
             evidence.step('mandate-verdict', {
                 phase: 'pre-submit',
@@ -1086,7 +1548,7 @@ export async function submitApprovedCheckout(reviewId, opts, store = defaultPrep
                 reason: changedBeforeSubmit,
             });
             evidence.setSnapshotSummary(await snapshotSummary(page));
-            return makeResult('blocked-by-mandate', state.fields, evidence, requiresAdapter, changedBeforeSubmit);
+            return makeResult('blocked-by-mandate', state.fields, evidence, requiresAdapter, changedBeforeSubmit, undefined, undefined, 'review_facts_changed');
         }
         const submit = await findSubmit(page);
         const submitChangedBeforeClick = submitTargetChangeReason(checkout.review, submit);
@@ -1097,23 +1559,46 @@ export async function submitApprovedCheckout(reviewId, opts, store = defaultPrep
                 reason: submitChangedBeforeClick,
             });
             evidence.setSnapshotSummary(await snapshotSummary(page));
-            return makeResult('blocked-by-mandate', state.fields, evidence, requiresAdapter, submitChangedBeforeClick);
+            return makeResult('blocked-by-mandate', state.fields, evidence, requiresAdapter, submitChangedBeforeClick, undefined, undefined, 'review_facts_changed');
         }
-        if (opts.mode === 'dry-run') {
-            evidence.step('submit', { would: true, target: submit?.desc ?? 'none found' });
+        if (!adapterFillOk) {
             evidence.setSnapshotSummary(await snapshotSummary(page));
-            if (missingCredentialRoles.length > 0) {
-                const adapterRequired = requiresAdapter.size > 0;
-                return makeResult(adapterRequired ? 'adapter-required' : 'partial-fill', state.fields, evidence, requiresAdapter, adapterRequired
-                    ? `credential fields require adapter: ${[...requiresAdapter].join(', ')}; missing ${missingCredentialRoles.join(', ')}`
-                    : `credential fill incomplete: missing ${missingCredentialRoles.join(', ')}`);
-            }
-            return makeResult('filled-dry-run', state.fields, evidence, requiresAdapter, submit ? `would click ${submit.desc}` : 'no submit control detected');
+            return makeResult('failed', state.fields, evidence, requiresAdapter, adapterFillDetail ?? `${adapterName ?? 'checkout'} adapter fill incomplete`);
         }
         if (missingCredentialRoles.length > 0) {
             evidence.setSnapshotSummary(await snapshotSummary(page));
             return makeResult('failed', state.fields, evidence, requiresAdapter, `credential fill incomplete: missing ${missingCredentialRoles.join(', ')}`);
         }
+        // STOP BEFORE THE CLICK when any field we tried to fill refused. Submitting
+        // a form we know is incomplete is how a PSP ends up holding a charge we
+        // cannot then confirm or account for: the 2026-08-17 whop.com run filled the
+        // card into Basis Theory iframes, watched city/state/postalCode time out at
+        // 5s each, clicked Get access anyway, and could never observe an outcome.
+        //
+        // This refusal happens BEFORE the submit click, so nothing can be charged by
+        // it — the safe direction, and the reason it is allowed to be strict. A
+        // merchant whose address widget we cannot drive now fails cleanly and
+        // retryably instead of dangerously.
+        if (failedFillRoles.length > 0) {
+            evidence.setSnapshotSummary(await snapshotSummary(page));
+            // Name the CAUSE per field, not just the field. The refusal is the only
+            // artifact that survives to the operator (a v2 receipt carries no evidence
+            // log), and "city, postalCode refused" without a reason means the next
+            // person has to reproduce a live merchant to learn anything. Each cause
+            // points at a different fix — see summarizeFillFailure.
+            //
+            // Last attempt wins: a role that failed differently across reveal passes
+            // is best described by how it failed when we finally gave up on it.
+            const lastFillError = (role) => {
+                const errors = evidence
+                    .getSteps()
+                    .filter((step) => step.type === 'field-fill' && step.data.ok === false && step.data.role === role)
+                    .map((step) => (typeof step.data.error === 'string' ? step.data.error : undefined));
+                return errors[errors.length - 1];
+            };
+            const reasons = failedFillRoles.map((role) => `${role} (${summarizeFillFailure(lastFillError(role))})`);
+            return makeResult('partial-fill', state.fields, evidence, requiresAdapter, `required field fill failed: ${reasons.join(', ')} — not submitting an incomplete form. Nothing was charged.`, undefined, 'required-field-unfillable');
+        }
         if (!submit) {
             evidence.setSnapshotSummary(await snapshotSummary(page));
             return makeResult('failed', state.fields, evidence, requiresAdapter, 'no submit control detected');
@@ -1129,6 +1614,36 @@ export async function submitApprovedCheckout(reviewId, opts, store = defaultPrep
         // Stripe's submit chain mid-flight (#5879) — see waitForLinkLookupQuiet.
         const linkQuiet = await waitForLinkLookupQuiet(page);
         evidence.step('note', { linkQuiet });
+        // This is deliberately the last await before the irreversible click.
+        // Mint-time validation is not enough: reveal/fill and Link suppression can
+        // consume a short-lived DAVV. Refuse malformed or <60s credentials so an
+        // expiry decline cannot masquerade as a form-fill failure.
+        const credentialExpiresAt = credential.credentialExpiresAt;
+        const expiryMissing = opts.instrument.kind === 'agentic-token' && credentialExpiresAt === undefined;
+        const expiresMs = credentialExpiresAt === undefined ? Number.NaN : Date.parse(credentialExpiresAt);
+        if (expiryMissing ||
+            (credentialExpiresAt !== undefined &&
+                (!Number.isFinite(expiresMs) || expiresMs - Date.now() < 60_000))) {
+            evidence.step('credential-expiry-check', {
+                ok: false,
+                reason: expiryMissing ? 'missing' : 'invalid-or-expiring',
+                ...(credentialExpiresAt !== undefined ? { credentialExpiresAt } : {}),
+            });
+            evidence.setSnapshotSummary(await snapshotSummary(page));
+            return makeResult('failed', state.fields, evidence, requiresAdapter, 'credential expired before submit; obtain a fresh intent and re-review');
+        }
+        if (credentialExpiresAt !== undefined) {
+            evidence.step('credential-expiry-check', {
+                ok: true,
+                credentialExpiresAt,
+            });
+        }
+        // ORDER IS LOAD-BEARING: record the click BEFORE performing it. The catch
+        // block classifies a throw by whether this step exists — recorded means
+        // "we may have charged" (`unverified`), absent means "retry is safe"
+        // (`failed`). Recording after `submit.click()` would let a throw raised by
+        // the click itself look retry-safe, which is the double-charge direction.
+        // Pinned by "a throw AFTER the pay control was clicked reports unverified".
         evidence.step('submit', { clicked: true, target: submit.desc });
         await submit.click();
         await settle(page);
@@ -1250,19 +1765,35 @@ export async function submitApprovedCheckout(reviewId, opts, store = defaultPrep
             });
             return makeResult('confirmed', state.fields, evidence, requiresAdapter, undefined, confirmationRef);
         }
+        // The pay control was clicked and the observer reached its deadline with no
+        // definitive answer. This is NOT a failure — it is the absence of an answer,
+        // and the charge may well have captured. Reporting it as `failed` is what
+        // let a caller re-run the 2026-08-17 whop.com purchase and draw a second $5.
         evidence.step('outcome', {
-            outcome: 'failed',
+            outcome: 'unverified',
             reason: 'no confirmation or decline signal',
             lastSeen: observed.lastSeen,
             attempts: observed.attempts,
             elapsedMs: observed.elapsedMs,
         });
-        return makeResult('failed', state.fields, evidence, requiresAdapter, observed.lastSeen === 'processing'
-            ? 'submitted but outcome unknown (page still processing at deadline)'
-            : 'submitted but outcome unknown');
+        return makeResult('unverified', state.fields, evidence, requiresAdapter, observed.lastSeen === 'processing'
+            ? 'submitted but outcome unknown (page still processing at deadline) — the charge may have gone through; verify with the merchant before any retry'
+            : 'submitted but outcome unknown — the charge may have gone through; verify with the merchant before any retry');
     }
     catch (err) {
         const detail = err.message;
+        // A throw AFTER the pay control was clicked (browser teardown, navigation
+        // race, evidence I/O) leaves the same open question as the deadline path: we
+        // clicked, and we do not know what happened. It must not report `failed`
+        // either. A throw before the click never disclosed a payable form, so it
+        // stays a clean, retry-safe failure.
+        const submitted = evidence
+            .getSteps()
+            .some((step) => step.type === 'submit' && step.data.clicked === true);
+        if (submitted) {
+            evidence.step('outcome', { outcome: 'unverified', error: detail });
+            return makeResult('unverified', state.fields, evidence, requiresAdapter, `${detail} — the pay control was already clicked; the charge may have gone through, so verify with the merchant before any retry`);
+        }
         evidence.step('outcome', { outcome: 'failed', error: detail });
         return makeResult('failed', state.fields, evidence, requiresAdapter, detail);
     }
@@ -1292,7 +1823,7 @@ export async function cancelPreparedCheckout(reviewId, detail = 'checkout cancel
 // explicit prepareCheckout()/submitApprovedCheckout() pair instead.
 export async function runCheckout(opts, store = defaultPreparedCheckoutStore) {
     const { instrument, contact, mode, outcomeDeadlineMs, resolveEmailOtp, ...prepareOptions } = opts;
-    const preparation = await prepareCheckout(prepareOptions, store);
+    const preparation = await prepareCheckout({ ...prepareOptions, contact }, store);
     if (preparation.status === 'finished')
         return preparation.result;
     return submitApprovedCheckout(preparation.checkout.review.id, {